diff --git a/.github/workflows/close-stale.yml b/.github/workflows/close-stale.yml
new file mode 100644
index 00000000000..c63a6be690c
--- /dev/null
+++ b/.github/workflows/close-stale.yml
@@ -0,0 +1,30 @@
+name: Mark stale issues
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "30 1 * * *"
+
+jobs:
+  stale:
+    if: github.repository == 'github/codeql'
+
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/stale@v3
+      with:
+        repo-token: ${{ secrets.GITHUB_TOKEN }}
+        stale-issue-message: 'This issue is stale because it has been open 14 days with no activity. Comment or remove the `Stale` label in order to avoid having this issue closed in 7 days.'
+        close-issue-message: 'This issue was closed because it has been inactive for 7 days.'
+        days-before-stale: 14
+        days-before-close: 7
+        only-labels: awaiting-response
+
+        # do not mark PRs as stale
+        days-before-pr-stale: -1
+        days-before-pr-close: -1
+
+        # Uncomment for dry-run
+        # debug-only: true
+        # operations-per-run: 1000
diff --git a/.github/workflows/docs-review.yml b/.github/workflows/docs-review.yml
deleted file mode 100644
index bf813f46ead..00000000000
--- a/.github/workflows/docs-review.yml
+++ /dev/null
@@ -1,29 +0,0 @@
-# When a PR is labelled with 'ready-for-docs-review',
-# this workflow comments on the PR to notify the GitHub CodeQL docs team.
-name: Request docs review
-on:
-  # Runs in the context of the base repo.
-  # This gives the workflow write access to comment on PRs.
-  # The workflow should not check out or build the given ref,
-  # or use untrusted data from the event payload in a command line.
-  pull_request_target:
-    types: [labeled]
-
-jobs:
-  request-docs-review:
-    name: Request docs review
-    # Run only on labelled PRs to the main repository.
-    # Do not run on PRs to forks.
-    if:
-      github.event.label.name == 'ready-for-docs-review'
-      && github.event.pull_request.draft == false
-      && github.event.pull_request.base.repo.full_name == 'github/codeql'
-    runs-on: ubuntu-latest
-    steps:
-      - name: Comment to request docs review
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-        run: |
-          gh pr comment "$PR_NUMBER" --repo "github/codeql" \
-            --body "Hello @github/docs-content-codeql - this PR is ready for docs review."
diff --git a/config/identical-files.json b/config/identical-files.json
index b63690c5f1e..3916e95a0cf 100644
--- a/config/identical-files.json
+++ b/config/identical-files.json
@@ -36,6 +36,7 @@
     "cpp/ql/src/semmle/code/cpp/dataflow/internal/tainttracking2/TaintTrackingImpl.qll",
     "cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/tainttracking1/TaintTrackingImpl.qll",
     "cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/tainttracking2/TaintTrackingImpl.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/tainttracking3/TaintTrackingImpl.qll",
     "csharp/ql/src/semmle/code/csharp/dataflow/internal/tainttracking1/TaintTrackingImpl.qll",
     "csharp/ql/src/semmle/code/csharp/dataflow/internal/tainttracking2/TaintTrackingImpl.qll",
     "csharp/ql/src/semmle/code/csharp/dataflow/internal/tainttracking3/TaintTrackingImpl.qll",
@@ -55,6 +56,10 @@
     "csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImplConsistency.qll",
     "python/ql/src/semmle/python/dataflow/new/internal/DataFlowImplConsistency.qll"
   ],
+  "DataFlow Java/C# Flow Summaries": [
+    "java/ql/src/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll"
+  ],
   "SsaReadPosition Java/C#": [
     "java/ql/src/semmle/code/java/dataflow/internal/rangeanalysis/SsaReadPositionCommon.qll",
     "csharp/ql/src/semmle/code/csharp/dataflow/internal/rangeanalysis/SsaReadPositionCommon.qll"
@@ -376,7 +381,6 @@
   ],
   "DuplicationProblems.inc.qhelp": [
     "cpp/ql/src/Metrics/Files/DuplicationProblems.inc.qhelp",
-    "csharp/ql/src/Metrics/Files/DuplicationProblems.inc.qhelp",
     "javascript/ql/src/Metrics/DuplicationProblems.inc.qhelp",
     "python/ql/src/Metrics/DuplicationProblems.inc.qhelp"
   ],
@@ -429,10 +433,11 @@
   "SSA C#": [
     "csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImplCommon.qll",
     "csharp/ql/src/semmle/code/csharp/controlflow/internal/pressa/SsaImplCommon.qll",
-    "csharp/ql/src/semmle/code/csharp/dataflow/internal/basessa/SsaImplCommon.qll"
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/basessa/SsaImplCommon.qll",
+    "csharp/ql/src/semmle/code/cil/internal/SsaImplCommon.qll"
   ],
   "CryptoAlgorithms Python/JS": [
     "javascript/ql/src/semmle/javascript/security/CryptoAlgorithms.qll",
     "python/ql/src/semmle/crypto/Crypto.qll"
   ]
-}
+}
\ No newline at end of file
diff --git a/cpp/autobuilder/Semmle.Autobuild.Cpp.Tests/BuildScripts.cs b/cpp/autobuilder/Semmle.Autobuild.Cpp.Tests/BuildScripts.cs
index 87390b7bf8f..d37f3e30e66 100644
--- a/cpp/autobuilder/Semmle.Autobuild.Cpp.Tests/BuildScripts.cs
+++ b/cpp/autobuilder/Semmle.Autobuild.Cpp.Tests/BuildScripts.cs
@@ -5,6 +5,7 @@ using System;
 using System.Linq;
 using Microsoft.Build.Construction;
 using System.Xml;
+using System.IO;
 
 namespace Semmle.Autobuild.Cpp.Tests
 {
@@ -43,6 +44,8 @@ namespace Semmle.Autobuild.Cpp.Tests
         public IDictionary<string, int> RunProcess = new Dictionary<string, int>();
         public IDictionary<string, string> RunProcessOut = new Dictionary<string, string>();
         public IDictionary<string, string> RunProcessWorkingDirectory = new Dictionary<string, string>();
+        public HashSet<string> CreateDirectories { get; } = new HashSet<string>();
+        public HashSet<(string, string)> DownloadFiles { get; } = new HashSet<(string, string)>();
 
         int IBuildActions.RunProcess(string cmd, string args, string? workingDirectory, IDictionary<string, string>? env, out IList<string> stdOut)
         {
@@ -135,6 +138,14 @@ namespace Semmle.Autobuild.Cpp.Tests
 
         string IBuildActions.GetFullPath(string path) => path;
 
+        string? IBuildActions.GetFileName(string? path) => Path.GetFileName(path?.Replace('\\', '/'));
+
+        public string? GetDirectoryName(string? path)
+        {
+            var dir = Path.GetDirectoryName(path?.Replace('\\', '/'));
+            return dir is null ? path : path?.Substring(0, dir.Length);
+        }
+
         void IBuildActions.WriteAllText(string filename, string contents)
         {
         }
@@ -153,6 +164,18 @@ namespace Semmle.Autobuild.Cpp.Tests
                 s = s.Replace($"%{kvp.Key}%", kvp.Value);
             return s;
         }
+
+        public void CreateDirectory(string path)
+        {
+            if (!CreateDirectories.Contains(path))
+                throw new ArgumentException($"Missing CreateDirectory, {path}");
+        }
+
+        public void DownloadFile(string address, string fileName)
+        {
+            if (!DownloadFiles.Contains((address, fileName)))
+                throw new ArgumentException($"Missing DownloadFile, {address}, {fileName}");
+        }
     }
 
     /// <summary>
@@ -213,6 +236,7 @@ namespace Semmle.Autobuild.Cpp.Tests
             Actions.GetEnvironmentVariable[$"CODEQL_EXTRACTOR_{codeqlUpperLanguage}_SOURCE_ARCHIVE_DIR"] = "";
             Actions.GetEnvironmentVariable[$"CODEQL_EXTRACTOR_{codeqlUpperLanguage}_ROOT"] = $@"C:\codeql\{codeqlUpperLanguage.ToLowerInvariant()}";
             Actions.GetEnvironmentVariable["CODEQL_JAVA_HOME"] = @"C:\codeql\tools\java";
+            Actions.GetEnvironmentVariable["CODEQL_PLATFORM"] = "win64";
             Actions.GetEnvironmentVariable["SEMMLE_DIST"] = @"C:\odasa";
             Actions.GetEnvironmentVariable["SEMMLE_JAVA_HOME"] = @"C:\odasa\tools\java";
             Actions.GetEnvironmentVariable["SEMMLE_PLATFORM_TOOLS"] = @"C:\odasa\tools";
@@ -273,7 +297,8 @@ namespace Semmle.Autobuild.Cpp.Tests
         [Fact]
         public void TestCppAutobuilderSuccess()
         {
-            Actions.RunProcess[@"cmd.exe /C C:\odasa\tools\csharp\nuget\nuget.exe restore C:\Project\test.sln"] = 1;
+            Actions.RunProcess[@"cmd.exe /C nuget restore C:\Project\test.sln -DisableParallelProcessing"] = 1;
+            Actions.RunProcess[@"cmd.exe /C C:\Project\.nuget\nuget.exe restore C:\Project\test.sln -DisableParallelProcessing"] = 0;
             Actions.RunProcess[@"cmd.exe /C CALL ^""C:\Program Files ^(x86^)\Microsoft Visual Studio 14.0\VC\vcvarsall.bat^"" && set Platform=&& type NUL && C:\odasa\tools\odasa index --auto msbuild C:\Project\test.sln /p:UseSharedCompilation=false /t:rebuild /p:Platform=""x86"" /p:Configuration=""Release"" /p:MvcBuildViews=true"] = 0;
             Actions.RunProcessOut[@"C:\Program Files (x86)\Microsoft Visual Studio\Installer\vswhere.exe -prerelease -legacy -property installationPath"] = "";
             Actions.RunProcess[@"C:\Program Files (x86)\Microsoft Visual Studio\Installer\vswhere.exe -prerelease -legacy -property installationPath"] = 1;
@@ -286,11 +311,13 @@ namespace Semmle.Autobuild.Cpp.Tests
             Actions.FileExists[@"C:\Program Files (x86)\Microsoft Visual Studio\Installer\vswhere.exe"] = true;
             Actions.EnumerateFiles[@"C:\Project"] = "foo.cs\ntest.slx";
             Actions.EnumerateDirectories[@"C:\Project"] = "";
+            Actions.CreateDirectories.Add(@"C:\Project\.nuget");
+            Actions.DownloadFiles.Add(("https://dist.nuget.org/win-x86-commandline/latest/nuget.exe", @"C:\Project\.nuget\nuget.exe"));
 
             var autobuilder = CreateAutoBuilder(true);
             var solution = new TestSolution(@"C:\Project\test.sln");
             autobuilder.ProjectsOrSolutionsToBuild.Add(solution);
-            TestAutobuilderScript(autobuilder, 0, 2);
+            TestAutobuilderScript(autobuilder, 0, 3);
         }
     }
 }
diff --git a/cpp/autobuilder/Semmle.Autobuild.Cpp/Semmle.Autobuild.Cpp.csproj b/cpp/autobuilder/Semmle.Autobuild.Cpp/Semmle.Autobuild.Cpp.csproj
index 68cfef57b3d..1d6459d77e3 100644
--- a/cpp/autobuilder/Semmle.Autobuild.Cpp/Semmle.Autobuild.Cpp.csproj
+++ b/cpp/autobuilder/Semmle.Autobuild.Cpp/Semmle.Autobuild.Cpp.csproj
@@ -17,7 +17,7 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Build" Version="16.0.461" />
+    <PackageReference Include="Microsoft.Build" Version="16.9.0" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/cpp/change-notes/2021-04-06-assign-where-compare-meant.md b/cpp/change-notes/2021-04-06-assign-where-compare-meant.md
new file mode 100644
index 00000000000..e540593b15a
--- /dev/null
+++ b/cpp/change-notes/2021-04-06-assign-where-compare-meant.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* The 'Assignment where comparison was intended' (cpp/assign-where-compare-meant) query has been improved to flag fewer benign assignments in conditionals.
diff --git a/cpp/change-notes/2021-04-13-arithmetic-queries.md b/cpp/change-notes/2021-04-13-arithmetic-queries.md
new file mode 100644
index 00000000000..4d0f8833adc
--- /dev/null
+++ b/cpp/change-notes/2021-04-13-arithmetic-queries.md
@@ -0,0 +1,2 @@
+lgtm
+* The queries cpp/tainted-arithmetic, cpp/uncontrolled-arithmetic, and cpp/arithmetic-with-extreme-values have been improved to produce fewer false positives.
diff --git a/cpp/ql/src/Diagnostics/ExtractionErrors.ql b/cpp/ql/src/Diagnostics/ExtractionErrors.ql
new file mode 100644
index 00000000000..a445c3bc0c4
--- /dev/null
+++ b/cpp/ql/src/Diagnostics/ExtractionErrors.ql
@@ -0,0 +1,16 @@
+/**
+ * @name Extraction errors
+ * @description List all extraction errors for files in the source code directory.
+ * @kind diagnostic
+ * @id cpp/diagnostics/extraction-errors
+ */
+
+import cpp
+import ExtractionErrors
+
+from ExtractionError error
+where
+  error instanceof ExtractionUnknownError or
+  exists(error.getFile().getRelativePath())
+select error, "Extraction failed in " + error.getFile() + " with error " + error.getErrorMessage(),
+  error.getSeverity()
diff --git a/cpp/ql/src/Diagnostics/ExtractionErrors.qll b/cpp/ql/src/Diagnostics/ExtractionErrors.qll
new file mode 100644
index 00000000000..4cf6f8145f8
--- /dev/null
+++ b/cpp/ql/src/Diagnostics/ExtractionErrors.qll
@@ -0,0 +1,137 @@
+/**
+ * Provides a common hierarchy of all types of errors that can occur during extraction.
+ */
+
+import cpp
+
+/*
+ * A note about how the C/C++ extractor emits diagnostics:
+ * When the extractor frontend encounters an error, it emits a diagnostic message,
+ * that includes a message, location and severity.
+ * However, that process is best-effort and may fail (e.g. due to lack of memory).
+ * Thus, if the extractor emitted at least one diagnostic of severity discretionary
+ * error (or higher), it *also* emits a simple "There was an error during this compilation"
+ * error diagnostic, without location information.
+ * In the common case, this means that a compilation during which one or more errors happened also gets
+ * the catch-all diagnostic.
+ * This diagnostic has the empty string as file path.
+ * We filter out these useless diagnostics if there is at least one error-level diagnostic
+ * for the affected compilation in the database.
+ * Otherwise, we show it to indicate that something went wrong and that we
+ * don't know what exactly happened.
+ */
+
+/**
+ * An error that, if present, leads to a file being marked as non-successfully extracted.
+ */
+class ReportableError extends Diagnostic {
+  ReportableError() {
+    (
+      this instanceof CompilerDiscretionaryError or
+      this instanceof CompilerError or
+      this instanceof CompilerCatastrophe
+    ) and
+    // Filter for the catch-all diagnostic, see note above.
+    not this.getFile().getAbsolutePath() = ""
+  }
+}
+
+private newtype TExtractionError =
+  TReportableError(ReportableError err) or
+  TCompilationFailed(Compilation c, File f) {
+    f = c.getAFileCompiled() and not c.normalTermination()
+  } or
+  // Show the catch-all diagnostic (see note above) only if we haven't seen any other error-level diagnostic
+  // for that compilation
+  TUnknownError(CompilerError err) {
+    not exists(ReportableError e | e.getCompilation() = err.getCompilation())
+  }
+
+/**
+ * Superclass for the extraction error hierarchy.
+ */
+class ExtractionError extends TExtractionError {
+  /** Gets the string representation of the error. */
+  string toString() { none() }
+
+  /** Gets the error message for this error. */
+  string getErrorMessage() { none() }
+
+  /** Gets the file this error occured in. */
+  File getFile() { none() }
+
+  /** Gets the location this error occured in. */
+  Location getLocation() { none() }
+
+  /** Gets the SARIF severity of this error. */
+  int getSeverity() {
+    // Unfortunately, we can't distinguish between errors and fatal errors in SARIF,
+    // so all errors have severity 2.
+    result = 2
+  }
+}
+
+/**
+ * An unrecoverable extraction error, where extraction was unable to finish.
+ * This can be caused by a multitude of reasons, for example:
+ *  - hitting a frontend assertion
+ *  - crashing due to dereferencing an invalid pointer
+ *  - stack overflow
+ *  - out of memory
+ */
+class ExtractionUnrecoverableError extends ExtractionError, TCompilationFailed {
+  Compilation c;
+  File f;
+
+  ExtractionUnrecoverableError() { this = TCompilationFailed(c, f) }
+
+  override string toString() {
+    result = "Unrecoverable extraction error while compiling " + f.toString()
+  }
+
+  override string getErrorMessage() { result = "unrecoverable compilation failure." }
+
+  override File getFile() { result = f }
+
+  override Location getLocation() { result = f.getLocation() }
+}
+
+/**
+ * A recoverable extraction error.
+ * These are compiler errors from the frontend.
+ * Upon encountering one of these, we still continue extraction, but the
+ * database will be incomplete for that file.
+ */
+class ExtractionRecoverableError extends ExtractionError, TReportableError {
+  ReportableError err;
+
+  ExtractionRecoverableError() { this = TReportableError(err) }
+
+  override string toString() { result = "Recoverable extraction error: " + err }
+
+  override string getErrorMessage() { result = err.getFullMessage() }
+
+  override File getFile() { result = err.getFile() }
+
+  override Location getLocation() { result = err.getLocation() }
+}
+
+/**
+ * An unknown error happened during extraction.
+ * These are only displayed if we know that we encountered an error during extraction,
+ * but, for some reason, failed to emit a proper diagnostic with location information
+ * and error message.
+ */
+class ExtractionUnknownError extends ExtractionError, TUnknownError {
+  CompilerError err;
+
+  ExtractionUnknownError() { this = TUnknownError(err) }
+
+  override string toString() { result = "Unknown extraction error: " + err }
+
+  override string getErrorMessage() { result = err.getFullMessage() }
+
+  override File getFile() { result = err.getFile() }
+
+  override Location getLocation() { result = err.getLocation() }
+}
diff --git a/cpp/ql/src/Diagnostics/FailedExtractions.ql b/cpp/ql/src/Diagnostics/FailedExtractorInvocations.ql
similarity index 70%
rename from cpp/ql/src/Diagnostics/FailedExtractions.ql
rename to cpp/ql/src/Diagnostics/FailedExtractorInvocations.ql
index 513c833f14f..ec1a243f245 100644
--- a/cpp/ql/src/Diagnostics/FailedExtractions.ql
+++ b/cpp/ql/src/Diagnostics/FailedExtractorInvocations.ql
@@ -1,8 +1,8 @@
 /**
- * @name Failed extractions
- * @description Gives the command-line of compilations for which extraction did not run to completion.
+ * @name Failed extractor invocations
+ * @description Gives the command line of compilations for which extraction did not run to completion.
  * @kind diagnostic
- * @id cpp/diagnostics/failed-extractions
+ * @id cpp/diagnostics/failed-extractor-invocations
  */
 
 import cpp
@@ -19,4 +19,4 @@ string describe(Compilation c) {
 
 from Compilation c
 where not c.normalTermination()
-select c, "Extraction failed for " + describe(c), 2
+select c, "Extraction aborted for " + describe(c), 2
diff --git a/cpp/ql/src/Diagnostics/SuccessfullyExtractedFiles.ql b/cpp/ql/src/Diagnostics/SuccessfullyExtractedFiles.ql
new file mode 100644
index 00000000000..a920af8e767
--- /dev/null
+++ b/cpp/ql/src/Diagnostics/SuccessfullyExtractedFiles.ql
@@ -0,0 +1,15 @@
+/**
+ * @name Successfully extracted files
+ * @description Lists all files in the source code directory that were extracted without encountering an error in the file.
+ * @kind diagnostic
+ * @id cpp/diagnostics/successfully-extracted-files
+ */
+
+import cpp
+import ExtractionErrors
+
+from File f
+where
+  not exists(ExtractionError e | e.getFile() = f) and
+  exists(f.getRelativePath())
+select f, ""
diff --git a/cpp/ql/src/Likely Bugs/Likely Typos/AssignWhereCompareMeant.ql b/cpp/ql/src/Likely Bugs/Likely Typos/AssignWhereCompareMeant.ql
index ca116a8609c..e60b763bc53 100644
--- a/cpp/ql/src/Likely Bugs/Likely Typos/AssignWhereCompareMeant.ql	
+++ b/cpp/ql/src/Likely Bugs/Likely Typos/AssignWhereCompareMeant.ql	
@@ -54,7 +54,7 @@ class BooleanControllingAssignmentInExpr extends BooleanControllingAssignment {
   override predicate isWhitelisted() {
     this.getConversion().(ParenthesisExpr).isParenthesised()
     or
-    // whitelist this assignment if all comparison operations in the expression that this
+    // Allow this assignment if all comparison operations in the expression that this
     // assignment is part of, are not parenthesized. In that case it seems like programmer
     // is fine with unparenthesized comparison operands to binary logical operators, and
     // the parenthesis around this assignment was used to call it out as an assignment.
@@ -62,6 +62,21 @@ class BooleanControllingAssignmentInExpr extends BooleanControllingAssignment {
     forex(ComparisonOperation op | op = getComparisonOperand*(this.getParent+()) |
       not op.isParenthesised()
     )
+    or
+    // Match a pattern like:
+    // ```
+    // if((a = b) && use_value(a)) { ... }
+    // ```
+    // where the assignment is meant to update the value of `a` before it's used in some other boolean
+    // subexpression that is guarenteed to be evaluate _after_ the assignment.
+    this.isParenthesised() and
+    exists(LogicalAndExpr parent, Variable var, VariableAccess access |
+      var = this.getLValue().(VariableAccess).getTarget() and
+      access = var.getAnAccess() and
+      not access.isUsedAsLValue() and
+      parent.getRightOperand() = access.getParent*() and
+      parent.getLeftOperand() = this.getParent*()
+    )
   }
 }
 
diff --git a/cpp/ql/src/Likely Bugs/Memory Management/ReturnStackAllocatedMemory.ql b/cpp/ql/src/Likely Bugs/Memory Management/ReturnStackAllocatedMemory.ql
index fc06ed0a500..f5dda53d484 100644
--- a/cpp/ql/src/Likely Bugs/Memory Management/ReturnStackAllocatedMemory.ql	
+++ b/cpp/ql/src/Likely Bugs/Memory Management/ReturnStackAllocatedMemory.ql	
@@ -13,6 +13,7 @@
 
 import cpp
 import semmle.code.cpp.dataflow.EscapesTree
+import semmle.code.cpp.models.interfaces.PointerWrapper
 import semmle.code.cpp.dataflow.DataFlow
 
 /**
@@ -39,6 +40,10 @@ predicate hasNontrivialConversion(Expr e) {
     e instanceof ParenthesisExpr
   )
   or
+  // A smart pointer can be stack-allocated while the data it points to is heap-allocated.
+  // So we exclude such "conversions" from this predicate.
+  e = any(PointerWrapper wrapper).getAnUnwrapperFunction().getACallToThisFunction()
+  or
   hasNontrivialConversion(e.getConversion())
 }
 
diff --git a/cpp/ql/src/Metrics/Dependencies/ExternalDependencies.ql b/cpp/ql/src/Metrics/Dependencies/ExternalDependencies.ql
index 47ddb9d1f1e..a4e9c925119 100644
--- a/cpp/ql/src/Metrics/Dependencies/ExternalDependencies.ql
+++ b/cpp/ql/src/Metrics/Dependencies/ExternalDependencies.ql
@@ -5,7 +5,6 @@
  * @kind treemap
  * @treemap.warnOn highValues
  * @metricType externalDependency
- * @precision medium
  * @id cpp/external-dependencies
  * @tags modularity
  */
diff --git a/cpp/ql/src/Metrics/Files/FLinesOfCode.ql b/cpp/ql/src/Metrics/Files/FLinesOfCode.ql
index 07c8934115c..11b3eac2977 100644
--- a/cpp/ql/src/Metrics/Files/FLinesOfCode.ql
+++ b/cpp/ql/src/Metrics/Files/FLinesOfCode.ql
@@ -7,7 +7,6 @@
  * @treemap.warnOn highValues
  * @metricType file
  * @metricAggregate avg sum max
- * @precision very-high
  * @id cpp/lines-of-code-in-files
  * @tags maintainability
  *       complexity
diff --git a/cpp/ql/src/Metrics/Files/FLinesOfCommentedOutCode.ql b/cpp/ql/src/Metrics/Files/FLinesOfCommentedOutCode.ql
index 495464d633b..13ff54e5525 100644
--- a/cpp/ql/src/Metrics/Files/FLinesOfCommentedOutCode.ql
+++ b/cpp/ql/src/Metrics/Files/FLinesOfCommentedOutCode.ql
@@ -5,7 +5,6 @@
  * @treemap.warnOn highValues
  * @metricType file
  * @metricAggregate avg sum max
- * @precision high
  * @id cpp/lines-of-commented-out-code-in-files
  * @tags documentation
  */
diff --git a/cpp/ql/src/Metrics/Files/FLinesOfComments.ql b/cpp/ql/src/Metrics/Files/FLinesOfComments.ql
index 4787587474e..2372f5cc375 100644
--- a/cpp/ql/src/Metrics/Files/FLinesOfComments.ql
+++ b/cpp/ql/src/Metrics/Files/FLinesOfComments.ql
@@ -7,7 +7,6 @@
  * @treemap.warnOn lowValues
  * @metricType file
  * @metricAggregate avg sum max
- * @precision very-high
  * @id cpp/lines-of-comments-in-files
  * @tags maintainability
  *       documentation
diff --git a/cpp/ql/src/Metrics/Files/FLinesOfDuplicatedCode.ql b/cpp/ql/src/Metrics/Files/FLinesOfDuplicatedCode.ql
index ab9317ea316..8b46df05adc 100644
--- a/cpp/ql/src/Metrics/Files/FLinesOfDuplicatedCode.ql
+++ b/cpp/ql/src/Metrics/Files/FLinesOfDuplicatedCode.ql
@@ -8,7 +8,6 @@
  * @treemap.warnOn highValues
  * @metricType file
  * @metricAggregate avg sum max
- * @precision high
  * @id cpp/duplicated-lines-in-files
  * @tags testability
  *       modularity
diff --git a/cpp/ql/src/Metrics/Files/FNumberOfTests.ql b/cpp/ql/src/Metrics/Files/FNumberOfTests.ql
index 421fc2baba1..c7ec5983253 100644
--- a/cpp/ql/src/Metrics/Files/FNumberOfTests.ql
+++ b/cpp/ql/src/Metrics/Files/FNumberOfTests.ql
@@ -5,7 +5,6 @@
  * @treemap.warnOn lowValues
  * @metricType file
  * @metricAggregate avg sum max
- * @precision medium
  * @id cpp/tests-in-files
  * @tags maintainability
  */
diff --git a/cpp/ql/src/Security/CWE/CWE-428/UnsafeCreateProcessCall.ql b/cpp/ql/src/Security/CWE/CWE-428/UnsafeCreateProcessCall.ql
index 81e50446d9d..c0f44a0c3d6 100644
--- a/cpp/ql/src/Security/CWE/CWE-428/UnsafeCreateProcessCall.ql
+++ b/cpp/ql/src/Security/CWE/CWE-428/UnsafeCreateProcessCall.ql
@@ -93,7 +93,7 @@ class QuotedCommandInCreateProcessFunctionConfiguration extends DataFlow2::Confi
 
 bindingset[s]
 predicate isQuotedOrNoSpaceApplicationNameOnCmd(string s) {
-  s.regexpMatch("\"([^\"])*\"(\\s|.)*") // The first element (path) is quoted
+  s.regexpMatch("\"([^\"])*\"[\\s\\S]*") // The first element (path) is quoted
   or
   s.regexpMatch("[^\\s]+") // There are no spaces in the string
 }
diff --git a/cpp/ql/src/Summary/LinesOfCode.ql b/cpp/ql/src/Summary/LinesOfCode.ql
new file mode 100644
index 00000000000..3b2aa2ac4c9
--- /dev/null
+++ b/cpp/ql/src/Summary/LinesOfCode.ql
@@ -0,0 +1,11 @@
+/**
+ * @id cpp/summary/lines-of-code
+ * @name Total lines of C/C++ code in the database
+ * @description The total number of lines of C/C++ code across all files, including system headers, libraries, and auto-generated files. This is a useful metric of the size of a database. For all files that were seen during the build, this query counts the lines of code, excluding whitespace or comments.
+ * @kind metric
+ * @tags summary
+ */
+
+import cpp
+
+select sum(File f | f.fromSource() | f.getMetrics().getNumberOfLinesOfCode())
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-570/WrongInDetectingAndHandlingMemoryAllocationErrors.ql b/cpp/ql/src/experimental/Security/CWE/CWE-570/WrongInDetectingAndHandlingMemoryAllocationErrors.ql
index dd9c16fac11..4869da7e6f3 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-570/WrongInDetectingAndHandlingMemoryAllocationErrors.ql
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-570/WrongInDetectingAndHandlingMemoryAllocationErrors.ql
@@ -72,9 +72,9 @@ class WrongCheckErrorOperatorNew extends FunctionCall {
   }
 
   /**
-   * Holds if `(std::nothrow)` exists in call `operator new`.
+   * Holds if `(std::nothrow)` or `(std::noexcept)` exists in call `operator new`.
    */
-  predicate isExistsNothrow() { this.getAChild().toString() = "nothrow" }
+  predicate isExistsNothrow() { getTarget().isNoExcept() or getTarget().isNoThrow() }
 }
 
 from WrongCheckErrorOperatorNew op
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.c b/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.c
new file mode 100644
index 00000000000..27631843118
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.c
@@ -0,0 +1,4 @@
+if(len>0 & memset(buf,0,len)) return 1; // BAD: `memset` will be called regardless of the value of the `len` variable. moreover, one cannot be sure that it will happen after verification
+...
+if(len>0 && memset(buf,0,len)) return 1; // GOOD: `memset` will be called after the `len` variable has been checked.
+...
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.qhelp b/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.qhelp
new file mode 100644
index 00000000000..f49d5a4fe78
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.qhelp
@@ -0,0 +1,28 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+<overview>
+<p>Using bitwise operations can be a mistake in some situations. For example, if parameters are evaluated in an expression and the function should be called only upon certain test results. These bitwise operations look suspicious and require developer attention.</p>
+
+
+</overview>
+<recommendation>
+
+<p>We recommend that you evaluate the correctness of using the specified bit operations.</p>
+
+</recommendation>
+<example>
+<p>The following example demonstrates the erroneous and fixed use of bit and logical operations.</p>
+<sample src="InsufficientControlFlowManagementWhenUsingBitOperations.c" />
+
+</example>
+<references>
+
+<li>
+  CWE Common Weakness Enumeration:
+  <a href="https://cwe.mitre.org/data/definitions/691.html"> CWE-691: Insufficient Control Flow Management</a>.
+</li>
+
+</references>
+</qhelp>
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.ql b/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.ql
new file mode 100644
index 00000000000..72d7625b517
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.ql
@@ -0,0 +1,78 @@
+/**
+ * @name Errors When Using Bit Operations
+ * @description Unlike the binary operations `||` and `&&`, there is no sequence point after evaluating an
+ *              operand of a bitwise operation like `|` or `&`. If left-to-right evaluation is expected this may be confusing.
+ * @kind problem
+ * @id cpp/errors-when-using-bit-operations
+ * @problem.severity warning
+ * @precision medium
+ * @tags correctness
+ *       security
+ *       external/cwe/cwe-691
+ */
+
+import cpp
+import semmle.code.cpp.valuenumbering.GlobalValueNumbering
+
+/**
+ * Dangerous uses of bit operations.
+ * For example: `if(intA>0 & intA<10 & charBuf&myFunc(charBuf[intA]))`.
+ * In this case, the function will be called in any case, and even the sequence of the call is not guaranteed.
+ */
+class DangerousBitOperations extends BinaryBitwiseOperation {
+  FunctionCall bfc;
+
+  /**
+   * The assignment indicates the conscious use of the bit operator.
+   * Use in comparison, conversion, or return value indicates conscious use of the bit operator.
+   * The use of shifts and bitwise operations on any element of an expression indicates a conscious use of the bitwise operator.
+   */
+  DangerousBitOperations() {
+    bfc = this.getRightOperand() and
+    not this.getParent*() instanceof Assignment and
+    not this.getParent*() instanceof Initializer and
+    not this.getParent*() instanceof ReturnStmt and
+    not this.getParent*() instanceof EqualityOperation and
+    not this.getParent*() instanceof UnaryLogicalOperation and
+    not this.getParent*() instanceof BinaryLogicalOperation and
+    not this.getAChild*() instanceof BitwiseXorExpr and
+    not this.getAChild*() instanceof LShiftExpr and
+    not this.getAChild*() instanceof RShiftExpr
+  }
+
+  /** Holds when part of a bit expression is used in a logical operation. */
+  predicate useInLogicalOperations() {
+    exists(BinaryLogicalOperation blop, Expr exp |
+      blop.getAChild*() = exp and
+      exp.(FunctionCall).getTarget() = bfc.getTarget() and
+      not exp.getParent() instanceof ComparisonOperation and
+      not exp.getParent() instanceof BinaryBitwiseOperation
+    )
+  }
+
+  /** Holds when part of a bit expression is used as part of another supply. For example, as an argument to another function. */
+  predicate useInOtherCalls() {
+    bfc.hasQualifier() or
+    bfc.getTarget() instanceof Operator or
+    exists(FunctionCall fc | fc.getAnArgument().getAChild*() = this) or
+    bfc.getTarget() instanceof BuiltInFunction
+  }
+
+  /** Holds when the bit expression contains both arguments and a function call. */
+  predicate dangerousArgumentChecking() {
+    not this.getLeftOperand() instanceof Call and
+    globalValueNumber(this.getLeftOperand().getAChild*()) = globalValueNumber(bfc.getAnArgument())
+  }
+
+  /** Holds when function calls are present in the bit expression. */
+  predicate functionCallsInBitsExpression() {
+    this.getLeftOperand().getAChild*() instanceof FunctionCall
+  }
+}
+
+from DangerousBitOperations dbo
+where
+  not dbo.useInOtherCalls() and
+  dbo.useInLogicalOperations() and
+  (not dbo.functionCallsInBitsExpression() or dbo.dangerousArgumentChecking())
+select dbo, "This bitwise operation appears in a context where a Boolean operation is expected."
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBoolType.c b/cpp/ql/src/experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBoolType.c
new file mode 100644
index 00000000000..8458d82f7ad
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBoolType.c
@@ -0,0 +1,11 @@
+if(len=funcReadData()==0) return 1; // BAD: variable `len` will not equal the value returned by function `funcReadData()`
+...
+if((len=funcReadData())==0) return 1; // GOOD: variable `len` equal the value returned by function `funcReadData()`
+...
+bool a=true;
+a++;// BAD: variable `a` does not change its meaning
+bool b;
+b=-a;// BAD: variable `b` equal `true`
+...
+a=false;// GOOD: variable `a` equal `false`
+b=!a;// GOOD: variable `b` equal `false`
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBoolType.qhelp b/cpp/ql/src/experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBoolType.qhelp
new file mode 100644
index 00000000000..8114da831fe
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBoolType.qhelp
@@ -0,0 +1,28 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+<overview>
+<p>Finding places of confusing use of boolean type. For example, a unary minus does not work before a boolean type and an increment always gives true.</p>
+
+
+</overview>
+<recommendation>
+
+<p>we recommend making the code simpler.</p>
+
+</recommendation>
+<example>
+<p>The following example demonstrates erroneous and fixed methods for using a boolean data type.</p>
+<sample src="OperatorPrecedenceLogicErrorWhenUseBoolType.c" />
+
+</example>
+<references>
+
+<li>
+  CERT C Coding Standard:
+  <a href="https://wiki.sei.cmu.edu/confluence/display/c/EXP00-C.+Use+parentheses+for+precedence+of+operation">EXP00-C. Use parentheses for precedence of operation</a>.
+</li>
+
+</references>
+</qhelp>
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBoolType.ql b/cpp/ql/src/experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBoolType.ql
new file mode 100644
index 00000000000..4f30f112eb0
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBoolType.ql
@@ -0,0 +1,54 @@
+/**
+ * @name Operator Precedence Logic Error When Use Bool Type
+ * @description --Finding places of confusing use of boolean type.
+ *              --For example, a unary minus does not work before a boolean type and an increment always gives true.
+ * @kind problem
+ * @id cpp/operator-precedence-logic-error-when-use-bool-type
+ * @problem.severity warning
+ * @precision medium
+ * @tags correctness
+ *       security
+ *       external/cwe/cwe-783
+ *       external/cwe/cwe-480
+ */
+
+import cpp
+import semmle.code.cpp.valuenumbering.HashCons
+
+/** Holds if `exp` increments a boolean value. */
+predicate incrementBoolType(IncrementOperation exp) {
+  exp.getOperand().getType() instanceof BoolType
+}
+
+/** Holds if `exp` applies the unary minus operator to a boolean type. */
+predicate revertSignBoolType(UnaryMinusExpr exp) {
+  exp.getAnOperand().getType() instanceof BoolType and
+  exp.getFullyConverted().getType() instanceof BoolType
+}
+
+/** Holds, if this is an expression, uses comparison and assignment outside of execution precedence. */
+predicate assignBoolType(Expr exp) {
+  exists(ComparisonOperation co |
+    exp.(AssignExpr).getRValue() = co and
+    exp.isCondition() and
+    not co.isParenthesised() and
+    not exp.(AssignExpr).getLValue().getType() instanceof BoolType and
+    not exists(Expr exbl |
+      hashCons(exbl.(AssignExpr).getLValue()) = hashCons(exp.(AssignExpr).getLValue()) and
+      not exbl.isCondition() and
+      exbl.(AssignExpr).getRValue().getType() instanceof BoolType and
+      exbl.(AssignExpr).getLValue().getType() = exp.(AssignExpr).getLValue().getType()
+    ) and
+    co.getLeftOperand() instanceof FunctionCall and
+    not co.getRightOperand().getType() instanceof BoolType and
+    not co.getRightOperand().getValue() = "0" and
+    not co.getRightOperand().getValue() = "1"
+  )
+}
+
+from Expr exp
+where
+  incrementBoolType(exp) or
+  revertSignBoolType(exp) or
+  assignBoolType(exp)
+select exp, "this expression needs attention"
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrlen.ql b/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrlen.ql
index 012109074e9..e4577968730 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrlen.ql
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrlen.ql
@@ -3,7 +3,7 @@
  * @description The expression `buffer [strlen (buffer)] = 0` is potentially dangerous, if the variable `buffer` does not have a terminal zero, then access beyond the bounds of the allocated memory is possible, which will lead to undefined behavior.
  *              If terminal zero is present, then the specified expression is meaningless.
  * @kind problem
- * @id cpp/access-memory-location-after-end-buffer
+ * @id cpp/access-memory-location-after-end-buffer-strlen
  * @problem.severity warning
  * @precision medium
  * @tags correctness
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.ql b/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.ql
index 5311ffe2708..f68395f29bf 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.ql
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.ql
@@ -2,7 +2,7 @@
  * @name Access Of Memory Location After The End Of A Buffer Using Strncat
  * @description Calls of the form `strncat(dest, source, sizeof (dest) - strlen (dest))` set the third argument to one more than possible. So when `dest` is full, the expression `sizeof(dest) - strlen (dest)` will be equal to one, and not zero as the programmer might think. Making a call of this type may result in a zero byte being written just outside the `dest` buffer.
  * @kind problem
- * @id cpp/access-memory-location-after-end-buffer
+ * @id cpp/access-memory-location-after-end-buffer-strncat
  * @problem.severity warning
  * @precision medium
  * @tags correctness
@@ -11,54 +11,32 @@
  */
 
 import cpp
+import semmle.code.cpp.models.implementations.Strcat
 import semmle.code.cpp.valuenumbering.GlobalValueNumbering
 
 /**
- * A call to `strncat` of the form `strncat(buff, str, someExpr - strlen(buf))`, for some expression `someExpr` equal to `sizeof(buff)`.
+ * Holds if `call` is a call to `strncat` such that `sizeArg` and `destArg` are the size and
+ * destination arguments, respectively.
  */
-class WrongCallStrncat extends FunctionCall {
-  Expr leftsomeExpr;
-
-  WrongCallStrncat() {
-    this.getTarget().hasGlobalOrStdName("strncat") and
-    // the expression of the first argument in `strncat` and `strnlen` is identical
-    globalValueNumber(this.getArgument(0)) =
-      globalValueNumber(this.getArgument(2).(SubExpr).getRightOperand().(StrlenCall).getStringExpr()) and
-    // using a string constant often speaks of manually calculating the length of the required buffer.
-    (
-      not this.getArgument(1) instanceof StringLiteral and
-      not this.getArgument(1) instanceof CharLiteral
-    ) and
-    // for use in predicates
-    leftsomeExpr = this.getArgument(2).(SubExpr).getLeftOperand()
-  }
-
-  /**
-   * Holds if the left side of the expression `someExpr` equal to `sizeof(buf)`.
-   */
-  predicate isExpressionEqualSizeof() {
-    // the left side of the expression `someExpr` is `sizeof(buf)`.
-    globalValueNumber(this.getArgument(0)) =
-      globalValueNumber(leftsomeExpr.(SizeofExprOperator).getExprOperand())
-    or
-    // value of the left side of the expression `someExpr` equal  `sizeof(buf)` value, and `buf` is array.
-    leftsomeExpr.getValue().toInt() = this.getArgument(0).getType().getSize()
-  }
-
-  /**
-   * Holds if the left side of the expression `someExpr` equal to variable containing the length of the memory allocated for the buffer.
-   */
-  predicate isVariableEqualValueSizegBuffer() {
-    // the left side of expression `someExpr` is the variable that was used in the function of allocating memory for the buffer`.
-    exists(AllocationExpr alc |
-      leftsomeExpr.(VariableAccess).getTarget() =
-        alc.(FunctionCall).getArgument(0).(VariableAccess).getTarget()
-    )
-  }
+predicate interestringCallWithArgs(Call call, Expr sizeArg, Expr destArg) {
+  exists(StrcatFunction strcat |
+    strcat = call.getTarget() and
+    sizeArg = call.getArgument(strcat.getParamSize()) and
+    destArg = call.getArgument(strcat.getParamDest())
+  )
 }
 
-from WrongCallStrncat sc
+from FunctionCall call, Expr sizeArg, Expr destArg, SubExpr sub, int n
 where
-  sc.isExpressionEqualSizeof() or
-  sc.isVariableEqualValueSizegBuffer()
-select sc, "if the used buffer is full, writing out of the buffer is possible"
+  interestringCallWithArgs(call, sizeArg, destArg) and
+  // The destination buffer is an array of size n
+  destArg.getUnspecifiedType().(ArrayType).getSize() = n and
+  // The size argument is equivalent to a subtraction
+  globalValueNumber(sizeArg).getAnExpr() = sub and
+  // ... where the left side of the subtraction is the constant n
+  globalValueNumber(sub.getLeftOperand()).getAnExpr().getValue().toInt() = n and
+  // ... and the right side of the subtraction is a call to `strlen` where the argument is the
+  // destination buffer.
+  globalValueNumber(sub.getRightOperand()).getAnExpr().(StrlenCall).getStringExpr() =
+    globalValueNumber(destArg).getAnExpr()
+select call, "Possible out-of-bounds write due to incorrect size argument."
diff --git a/cpp/ql/src/external/tests/DefectFilter.ql b/cpp/ql/src/external/tests/DefectFilter.ql
deleted file mode 100644
index 88da84e1a52..00000000000
--- a/cpp/ql/src/external/tests/DefectFilter.ql
+++ /dev/null
@@ -1,12 +0,0 @@
-/**
- * @name Defect filter
- * @description Only include results in large files (200) lines of code, and change the message.
- * @tags filter
- */
-
-import cpp
-import external.DefectFilter
-
-from DefectResult res
-where res.getFile().getMetrics().getNumberOfLinesOfCode() > 200
-select res, "Large files: " + res.getMessage()
diff --git a/cpp/ql/src/external/tests/DefectFromExternalData.ql b/cpp/ql/src/external/tests/DefectFromExternalData.ql
deleted file mode 100644
index 276977e35b5..00000000000
--- a/cpp/ql/src/external/tests/DefectFromExternalData.ql
+++ /dev/null
@@ -1,18 +0,0 @@
-/**
- * @name Defect from external data
- * @description Insert description here...
- * @kind problem
- * @problem.severity warning
- * @tags external-data
- */
-
-import cpp
-import external.ExternalArtifact
-
-from ExternalData d, File u
-where
-  d.getQueryPath() = "external-data.ql" and
-  u.getShortName() = d.getField(0)
-select u,
-  d.getField(5) + ", " + d.getFieldAsDate(1) + ", " + d.getField(2) + ", " + d.getFieldAsFloat(3) +
-    ", " + d.getFieldAsInt(4) + ": " + d.getNumFields()
diff --git a/cpp/ql/src/external/tests/MetricFilter.ql b/cpp/ql/src/external/tests/MetricFilter.ql
deleted file mode 100644
index ba2868254ef..00000000000
--- a/cpp/ql/src/external/tests/MetricFilter.ql
+++ /dev/null
@@ -1,12 +0,0 @@
-/**
- * @name Metric filter
- * @description Only include results in large files (200) lines of code.
- * @tags filter
- */
-
-import cpp
-import external.MetricFilter
-
-from MetricResult res
-where res.getFile().getMetrics().getNumberOfLinesOfCode() > 200
-select res, res.getValue()
diff --git a/cpp/ql/src/filters/FilterAutogenerated.ql b/cpp/ql/src/filters/FilterAutogenerated.ql
deleted file mode 100644
index 43956b48d05..00000000000
--- a/cpp/ql/src/filters/FilterAutogenerated.ql
+++ /dev/null
@@ -1,16 +0,0 @@
-/**
- * @name Filter: exclude results from files that are autogenerated
- * @description Use this filter to return results only if they are
- *              located in files that are maintained manually.
- * @kind problem
- * @id cpp/autogenerated-filter
- * @tags filter
- */
-
-import cpp
-import semmle.code.cpp.AutogeneratedFile
-import external.DefectFilter
-
-from DefectResult res
-where not res.getFile() instanceof AutogeneratedFile
-select res, res.getMessage()
diff --git a/cpp/ql/src/filters/FilterAutogeneratedForMetric.ql b/cpp/ql/src/filters/FilterAutogeneratedForMetric.ql
deleted file mode 100644
index 6cc6833f7f8..00000000000
--- a/cpp/ql/src/filters/FilterAutogeneratedForMetric.ql
+++ /dev/null
@@ -1,16 +0,0 @@
-/**
- * @name Metric filter: exclude results from files that are autogenerated
- * @description Use this filter to return results only if they are
- *              located in files that are maintained manually.
- * @kind treemap
- * @id cpp/autogenerated-for-metric-filter
- * @tags filter
- */
-
-import cpp
-import semmle.code.cpp.AutogeneratedFile
-import external.MetricFilter
-
-from MetricResult res
-where not res.getFile() instanceof AutogeneratedFile
-select res, res.getValue()
diff --git a/cpp/ql/src/filters/FromSource.ql b/cpp/ql/src/filters/FromSource.ql
deleted file mode 100644
index 459ca94d3c6..00000000000
--- a/cpp/ql/src/filters/FromSource.ql
+++ /dev/null
@@ -1,16 +0,0 @@
-/**
- * @name Filter: exclude results from files for which we do not have
- *       source code
- * @description Use this filter to return results only if they are
- *              located in files for which we have source code.
- * @kind problem
- * @id cpp/from-source-filter
- * @tags filter
- */
-
-import cpp
-import external.DefectFilter
-
-from DefectResult res
-where res.getFile().fromSource()
-select res, res.getMessage()
diff --git a/cpp/ql/src/filters/Macros.ql b/cpp/ql/src/filters/Macros.ql
deleted file mode 100644
index b5e9e7ca5bf..00000000000
--- a/cpp/ql/src/filters/Macros.ql
+++ /dev/null
@@ -1,36 +0,0 @@
-/**
- * @name Filter: exclude results on lines covered by a macro expansion
- * @description Use this filter to return results only when there is no
- *              macro expansion whose location spans all the lines of
- *              the result's location.
- * @kind problem
- * @id cpp/macros-filter
- * @tags filter
- */
-
-import cpp
-import external.DefectFilter
-
-predicate macroLocation(File f, int startLine, int endLine) {
-  exists(MacroInvocation mi, Location l |
-    l = mi.getLocation() and
-    l.getFile() = f and
-    l.getStartLine() = startLine and
-    l.getEndLine() = endLine
-  )
-}
-
-predicate macroCovering(DefectResult r) {
-  exists(File f, int macroStart, int macroEnd, int defectStart, int defectEnd |
-    f = r.getFile() and
-    defectStart = r.getStartLine() and
-    defectEnd = r.getEndLine() and
-    macroLocation(f, macroStart, macroEnd) and
-    macroStart <= defectStart and
-    macroEnd >= defectEnd
-  )
-}
-
-from DefectResult res
-where not macroCovering(res)
-select res, res.getMessage()
diff --git a/cpp/ql/src/jsf/4.10 Classes/AV Rule 79.ql b/cpp/ql/src/jsf/4.10 Classes/AV Rule 79.ql
index d582cfa4224..3ae7bc65b45 100644
--- a/cpp/ql/src/jsf/4.10 Classes/AV Rule 79.ql	
+++ b/cpp/ql/src/jsf/4.10 Classes/AV Rule 79.ql	
@@ -91,16 +91,17 @@ private predicate exprReleases(Expr e, Expr released, string kind) {
   // `e` is a call to a release function and `released` is the released argument
   releaseExpr(e, released, kind)
   or
-  exists(Function f, int arg |
+  exists(int arg, VariableAccess access, Function f |
     // `e` is a call to a function that releases one of it's parameters,
     // and `released` is the corresponding argument
     (
       e.(FunctionCall).getTarget() = f or
       e.(FunctionCall).getTarget().(MemberFunction).getAnOverridingFunction+() = f
     ) and
+    access = f.getParameter(arg).getAnAccess() and
     e.(FunctionCall).getArgument(arg) = released and
     exprReleases(_,
-      exprOrDereference(globalValueNumber(f.getParameter(arg).getAnAccess()).getAnExpr()), kind)
+      pragma[only_bind_into](exprOrDereference(globalValueNumber(access).getAnExpr())), kind)
   )
   or
   exists(Function f, ThisExpr innerThis |
@@ -112,7 +113,7 @@ private predicate exprReleases(Expr e, Expr released, string kind) {
     ) and
     e.(FunctionCall).getQualifier() = exprOrDereference(released) and
     innerThis.getEnclosingFunction() = f and
-    exprReleases(_, globalValueNumber(innerThis).getAnExpr(), kind)
+    exprReleases(_, pragma[only_bind_into](globalValueNumber(innerThis).getAnExpr()), kind)
   )
 }
 
diff --git a/cpp/ql/src/semmle/code/cpp/Diagnostics.qll b/cpp/ql/src/semmle/code/cpp/Diagnostics.qll
index 79074fa8657..9ad38d4e4be 100644
--- a/cpp/ql/src/semmle/code/cpp/Diagnostics.qll
+++ b/cpp/ql/src/semmle/code/cpp/Diagnostics.qll
@@ -6,6 +6,9 @@ import semmle.code.cpp.Location
 
 /** A compiler-generated error, warning or remark. */
 class Diagnostic extends Locatable, @diagnostic {
+  /** Gets the compilation that generated this diagnostic. */
+  Compilation getCompilation() { diagnostic_for(underlyingElement(this), result, _, _) }
+
   /**
    * Gets the severity of the message, on a range from 1 to 5: 1=remark,
    * 2=warning, 3=discretionary error, 4=error, 5=catastrophic error.
diff --git a/cpp/ql/src/semmle/code/cpp/Location.qll b/cpp/ql/src/semmle/code/cpp/Location.qll
index dc37d4009c0..8d3653ea1c0 100644
--- a/cpp/ql/src/semmle/code/cpp/Location.qll
+++ b/cpp/ql/src/semmle/code/cpp/Location.qll
@@ -72,6 +72,7 @@ class Location extends @location {
   }
 
   /** Holds if `this` comes on a line strictly before `l`. */
+  pragma[inline]
   predicate isBefore(Location l) {
     this.getFile() = l.getFile() and this.getEndLine() < l.getStartLine()
   }
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/AddressFlow.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/AddressFlow.qll
index 7024f9d8598..f6072763e1a 100644
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/AddressFlow.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/AddressFlow.qll
@@ -15,6 +15,7 @@
  */
 
 private import cpp
+private import semmle.code.cpp.models.interfaces.PointerWrapper
 
 /**
  * Holds if `f` is an instantiation of the `std::move` or `std::forward`
@@ -94,6 +95,12 @@ private predicate pointerToPointerStep(Expr pointerIn, Expr pointerOut) {
 
 private predicate lvalueToReferenceStep(Expr lvalueIn, Expr referenceOut) {
   lvalueIn.getConversion() = referenceOut.(ReferenceToExpr)
+  or
+  exists(PointerWrapper wrapper, Call call | call = referenceOut |
+    referenceOut.getUnspecifiedType() instanceof ReferenceType and
+    call = wrapper.getAnUnwrapperFunction().getACallToThisFunction() and
+    lvalueIn = call.getQualifier().getFullyConverted()
+  )
 }
 
 private predicate referenceToLvalueStep(Expr referenceIn, Expr lvalueOut) {
@@ -106,6 +113,13 @@ private predicate referenceToPointerStep(Expr referenceIn, Expr pointerOut) {
       stdAddressOf(call.getTarget()) and
       referenceIn = call.getArgument(0).getFullyConverted()
     )
+  or
+  exists(CopyConstructor copy, Call call | call = pointerOut |
+    copy.getDeclaringType() instanceof PointerWrapper and
+    call.getTarget() = copy and
+    // The 0'th argument is the value being copied.
+    referenceIn = call.getArgument(0).getFullyConverted()
+  )
 }
 
 private predicate referenceToReferenceStep(Expr referenceIn, Expr referenceOut) {
@@ -190,6 +204,19 @@ private predicate pointerToUpdate(Expr pointer, Expr outer, ControlFlowNode node
         // See the `lvalueToUpdate` case for an explanation of this conjunct.
         call.getType().isDeeplyConstBelow()
       )
+      or
+      // Pointer wrappers behave as raw pointers for dataflow purposes.
+      outer = call.getAnArgument().getFullyConverted() and
+      exists(PointerWrapper wrapper | wrapper = outer.getType().stripTopLevelSpecifiers() |
+        not wrapper.pointsToConst()
+      )
+      or
+      outer = call.getQualifier().getFullyConverted() and
+      outer.getUnspecifiedType() instanceof PointerWrapper and
+      not (
+        call.getTarget().hasSpecifier("const") and
+        call.getType().isDeeplyConstBelow()
+      )
     )
     or
     exists(PointerFieldAccess fa |
@@ -218,7 +245,9 @@ private predicate referenceToUpdate(Expr reference, Expr outer, ControlFlowNode
     not stdIdentityFunction(call.getTarget()) and
     not stdAddressOf(call.getTarget()) and
     exists(ReferenceType rt | rt = outer.getType().stripTopLevelSpecifiers() |
-      not rt.getBaseType().isConst()
+      not rt.getBaseType().isConst() or
+      rt.getBaseType().getUnspecifiedType() =
+        any(PointerWrapper wrapper | not wrapper.pointsToConst())
     )
   ) and
   reference = outer
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll
index 8b446d28b86..9498e51e7e6 100644
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll
@@ -2133,11 +2133,8 @@ private module Stage4 {
 
   bindingset[node, cc, config]
   private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll
index 8b446d28b86..9498e51e7e6 100644
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll
@@ -2133,11 +2133,8 @@ private module Stage4 {
 
   bindingset[node, cc, config]
   private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll
index 8b446d28b86..9498e51e7e6 100644
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll
@@ -2133,11 +2133,8 @@ private module Stage4 {
 
   bindingset[node, cc, config]
   private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll
index 8b446d28b86..9498e51e7e6 100644
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll
@@ -2133,11 +2133,8 @@ private module Stage4 {
 
   bindingset[node, cc, config]
   private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImplCommon.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImplCommon.qll
index 1319f972037..a51c20c2288 100644
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImplCommon.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImplCommon.qll
@@ -26,15 +26,243 @@ predicate accessPathCostLimits(int apLimit, int tupleLimit) {
   tupleLimit = 1000
 }
 
+/**
+ * Provides a simple data-flow analysis for resolving lambda calls. The analysis
+ * currently excludes read-steps, store-steps, and flow-through.
+ *
+ * The analysis uses non-linear recursion: When computing a flow path in or out
+ * of a call, we use the results of the analysis recursively to resolve lamba
+ * calls. For this reason, we cannot reuse the code from `DataFlowImpl.qll` directly.
+ */
+private module LambdaFlow {
+  private predicate viableParamNonLambda(DataFlowCall call, int i, ParameterNode p) {
+    p.isParameterOf(viableCallable(call), i)
+  }
+
+  private predicate viableParamLambda(DataFlowCall call, int i, ParameterNode p) {
+    p.isParameterOf(viableCallableLambda(call, _), i)
+  }
+
+  private predicate viableParamArgNonLambda(DataFlowCall call, ParameterNode p, ArgumentNode arg) {
+    exists(int i |
+      viableParamNonLambda(call, i, p) and
+      arg.argumentOf(call, i)
+    )
+  }
+
+  private predicate viableParamArgLambda(DataFlowCall call, ParameterNode p, ArgumentNode arg) {
+    exists(int i |
+      viableParamLambda(call, i, p) and
+      arg.argumentOf(call, i)
+    )
+  }
+
+  private newtype TReturnPositionSimple =
+    TReturnPositionSimple0(DataFlowCallable c, ReturnKind kind) {
+      exists(ReturnNode ret |
+        c = getNodeEnclosingCallable(ret) and
+        kind = ret.getKind()
+      )
+    }
+
+  pragma[noinline]
+  private TReturnPositionSimple getReturnPositionSimple(ReturnNode ret, ReturnKind kind) {
+    result = TReturnPositionSimple0(getNodeEnclosingCallable(ret), kind)
+  }
+
+  pragma[nomagic]
+  private TReturnPositionSimple viableReturnPosNonLambda(DataFlowCall call, ReturnKind kind) {
+    result = TReturnPositionSimple0(viableCallable(call), kind)
+  }
+
+  pragma[nomagic]
+  private TReturnPositionSimple viableReturnPosLambda(
+    DataFlowCall call, DataFlowCallOption lastCall, ReturnKind kind
+  ) {
+    result = TReturnPositionSimple0(viableCallableLambda(call, lastCall), kind)
+  }
+
+  private predicate viableReturnPosOutNonLambda(
+    DataFlowCall call, TReturnPositionSimple pos, OutNode out
+  ) {
+    exists(ReturnKind kind |
+      pos = viableReturnPosNonLambda(call, kind) and
+      out = getAnOutNode(call, kind)
+    )
+  }
+
+  private predicate viableReturnPosOutLambda(
+    DataFlowCall call, DataFlowCallOption lastCall, TReturnPositionSimple pos, OutNode out
+  ) {
+    exists(ReturnKind kind |
+      pos = viableReturnPosLambda(call, lastCall, kind) and
+      out = getAnOutNode(call, kind)
+    )
+  }
+
+  /**
+   * Holds if data can flow (inter-procedurally) from `node` (of type `t`) to
+   * the lambda call `lambdaCall`.
+   *
+   * The parameter `toReturn` indicates whether the path from `node` to
+   * `lambdaCall` goes through a return, and `toJump` whether the path goes
+   * through a jump step.
+   *
+   * The call context `lastCall` records the last call on the path from `node`
+   * to `lambdaCall`, if any. That is, `lastCall` is able to target the enclosing
+   * callable of `lambdaCall`.
+   */
+  pragma[nomagic]
+  predicate revLambdaFlow(
+    DataFlowCall lambdaCall, LambdaCallKind kind, Node node, DataFlowType t, boolean toReturn,
+    boolean toJump, DataFlowCallOption lastCall
+  ) {
+    revLambdaFlow0(lambdaCall, kind, node, t, toReturn, toJump, lastCall) and
+    if node instanceof CastNode or node instanceof ArgumentNode or node instanceof ReturnNode
+    then compatibleTypes(t, getNodeType(node))
+    else any()
+  }
+
+  pragma[nomagic]
+  predicate revLambdaFlow0(
+    DataFlowCall lambdaCall, LambdaCallKind kind, Node node, DataFlowType t, boolean toReturn,
+    boolean toJump, DataFlowCallOption lastCall
+  ) {
+    lambdaCall(lambdaCall, kind, node) and
+    t = getNodeType(node) and
+    toReturn = false and
+    toJump = false and
+    lastCall = TDataFlowCallNone()
+    or
+    // local flow
+    exists(Node mid, DataFlowType t0 |
+      revLambdaFlow(lambdaCall, kind, mid, t0, toReturn, toJump, lastCall)
+    |
+      simpleLocalFlowStep(node, mid) and
+      t = t0
+      or
+      exists(boolean preservesValue |
+        additionalLambdaFlowStep(node, mid, preservesValue) and
+        getNodeEnclosingCallable(node) = getNodeEnclosingCallable(mid)
+      |
+        preservesValue = false and
+        t = getNodeType(node)
+        or
+        preservesValue = true and
+        t = t0
+      )
+    )
+    or
+    // jump step
+    exists(Node mid, DataFlowType t0 |
+      revLambdaFlow(lambdaCall, kind, mid, t0, _, _, _) and
+      toReturn = false and
+      toJump = true and
+      lastCall = TDataFlowCallNone()
+    |
+      jumpStep(node, mid) and
+      t = t0
+      or
+      exists(boolean preservesValue |
+        additionalLambdaFlowStep(node, mid, preservesValue) and
+        getNodeEnclosingCallable(node) != getNodeEnclosingCallable(mid)
+      |
+        preservesValue = false and
+        t = getNodeType(node)
+        or
+        preservesValue = true and
+        t = t0
+      )
+    )
+    or
+    // flow into a callable
+    exists(ParameterNode p, DataFlowCallOption lastCall0, DataFlowCall call |
+      revLambdaFlowIn(lambdaCall, kind, p, t, toJump, lastCall0) and
+      (
+        if lastCall0 = TDataFlowCallNone() and toJump = false
+        then lastCall = TDataFlowCallSome(call)
+        else lastCall = lastCall0
+      ) and
+      toReturn = false
+    |
+      viableParamArgNonLambda(call, p, node)
+      or
+      viableParamArgLambda(call, p, node) // non-linear recursion
+    )
+    or
+    // flow out of a callable
+    exists(TReturnPositionSimple pos |
+      revLambdaFlowOut(lambdaCall, kind, pos, t, toJump, lastCall) and
+      getReturnPositionSimple(node, node.(ReturnNode).getKind()) = pos and
+      toReturn = true
+    )
+  }
+
+  pragma[nomagic]
+  predicate revLambdaFlowOutLambdaCall(
+    DataFlowCall lambdaCall, LambdaCallKind kind, OutNode out, DataFlowType t, boolean toJump,
+    DataFlowCall call, DataFlowCallOption lastCall
+  ) {
+    revLambdaFlow(lambdaCall, kind, out, t, _, toJump, lastCall) and
+    exists(ReturnKindExt rk |
+      out = rk.getAnOutNode(call) and
+      lambdaCall(call, _, _)
+    )
+  }
+
+  pragma[nomagic]
+  predicate revLambdaFlowOut(
+    DataFlowCall lambdaCall, LambdaCallKind kind, TReturnPositionSimple pos, DataFlowType t,
+    boolean toJump, DataFlowCallOption lastCall
+  ) {
+    exists(DataFlowCall call, OutNode out |
+      revLambdaFlow(lambdaCall, kind, out, t, _, toJump, lastCall) and
+      viableReturnPosOutNonLambda(call, pos, out)
+      or
+      // non-linear recursion
+      revLambdaFlowOutLambdaCall(lambdaCall, kind, out, t, toJump, call, lastCall) and
+      viableReturnPosOutLambda(call, _, pos, out)
+    )
+  }
+
+  pragma[nomagic]
+  predicate revLambdaFlowIn(
+    DataFlowCall lambdaCall, LambdaCallKind kind, ParameterNode p, DataFlowType t, boolean toJump,
+    DataFlowCallOption lastCall
+  ) {
+    revLambdaFlow(lambdaCall, kind, p, t, false, toJump, lastCall)
+  }
+}
+
+private DataFlowCallable viableCallableExt(DataFlowCall call) {
+  result = viableCallable(call)
+  or
+  result = viableCallableLambda(call, _)
+}
+
 cached
 private module Cached {
+  /**
+   * Gets a viable target for the lambda call `call`.
+   *
+   * `lastCall` records the call required to reach `call` in order for the result
+   * to be a viable target, if any.
+   */
+  cached
+  DataFlowCallable viableCallableLambda(DataFlowCall call, DataFlowCallOption lastCall) {
+    exists(Node creation, LambdaCallKind kind |
+      LambdaFlow::revLambdaFlow(call, kind, creation, _, _, _, lastCall) and
+      lambdaCreation(creation, kind, result)
+    )
+  }
+
   /**
    * Holds if `p` is the `i`th parameter of a viable dispatch target of `call`.
    * The instance parameter is considered to have index `-1`.
    */
   pragma[nomagic]
   private predicate viableParam(DataFlowCall call, int i, ParameterNode p) {
-    p.isParameterOf(viableCallable(call), i)
+    p.isParameterOf(viableCallableExt(call), i)
   }
 
   /**
@@ -52,7 +280,7 @@ private module Cached {
 
   pragma[nomagic]
   private ReturnPosition viableReturnPos(DataFlowCall call, ReturnKindExt kind) {
-    viableCallable(call) = result.getCallable() and
+    viableCallableExt(call) = result.getCallable() and
     kind = result.getKind()
   }
 
@@ -317,6 +545,35 @@ private module Cached {
 
   cached
   private module DispatchWithCallContext {
+    /**
+     * Holds if the set of viable implementations that can be called by `call`
+     * might be improved by knowing the call context.
+     */
+    pragma[nomagic]
+    private predicate mayBenefitFromCallContextExt(DataFlowCall call, DataFlowCallable callable) {
+      mayBenefitFromCallContext(call, callable)
+      or
+      callable = call.getEnclosingCallable() and
+      exists(viableCallableLambda(call, TDataFlowCallSome(_)))
+    }
+
+    /**
+     * Gets a viable dispatch target of `call` in the context `ctx`. This is
+     * restricted to those `call`s for which a context might make a difference.
+     */
+    pragma[nomagic]
+    private DataFlowCallable viableImplInCallContextExt(DataFlowCall call, DataFlowCall ctx) {
+      result = viableImplInCallContext(call, ctx)
+      or
+      result = viableCallableLambda(call, TDataFlowCallSome(ctx))
+      or
+      exists(DataFlowCallable enclosing |
+        mayBenefitFromCallContextExt(call, enclosing) and
+        enclosing = viableCallableExt(ctx) and
+        result = viableCallableLambda(call, TDataFlowCallNone())
+      )
+    }
+
     /**
      * Holds if the call context `ctx` reduces the set of viable run-time
      * dispatch targets of call `call` in `c`.
@@ -324,10 +581,10 @@ private module Cached {
     cached
     predicate reducedViableImplInCallContext(DataFlowCall call, DataFlowCallable c, DataFlowCall ctx) {
       exists(int tgts, int ctxtgts |
-        mayBenefitFromCallContext(call, c) and
-        c = viableCallable(ctx) and
-        ctxtgts = count(viableImplInCallContext(call, ctx)) and
-        tgts = strictcount(viableCallable(call)) and
+        mayBenefitFromCallContextExt(call, c) and
+        c = viableCallableExt(ctx) and
+        ctxtgts = count(viableImplInCallContextExt(call, ctx)) and
+        tgts = strictcount(viableCallableExt(call)) and
         ctxtgts < tgts
       )
     }
@@ -339,7 +596,7 @@ private module Cached {
      */
     cached
     DataFlowCallable prunedViableImplInCallContext(DataFlowCall call, DataFlowCall ctx) {
-      result = viableImplInCallContext(call, ctx) and
+      result = viableImplInCallContextExt(call, ctx) and
       reducedViableImplInCallContext(call, _, ctx)
     }
 
@@ -351,10 +608,10 @@ private module Cached {
     cached
     predicate reducedViableImplInReturn(DataFlowCallable c, DataFlowCall call) {
       exists(int tgts, int ctxtgts |
-        mayBenefitFromCallContext(call, _) and
-        c = viableCallable(call) and
-        ctxtgts = count(DataFlowCall ctx | c = viableImplInCallContext(call, ctx)) and
-        tgts = strictcount(DataFlowCall ctx | viableCallable(ctx) = call.getEnclosingCallable()) and
+        mayBenefitFromCallContextExt(call, _) and
+        c = viableCallableExt(call) and
+        ctxtgts = count(DataFlowCall ctx | c = viableImplInCallContextExt(call, ctx)) and
+        tgts = strictcount(DataFlowCall ctx | viableCallableExt(ctx) = call.getEnclosingCallable()) and
         ctxtgts < tgts
       )
     }
@@ -367,7 +624,7 @@ private module Cached {
      */
     cached
     DataFlowCallable prunedViableImplInCallContextReverse(DataFlowCall call, DataFlowCall ctx) {
-      result = viableImplInCallContext(call, ctx) and
+      result = viableImplInCallContextExt(call, ctx) and
       reducedViableImplInReturn(result, call)
     }
   }
@@ -481,6 +738,11 @@ private module Cached {
     TBooleanNone() or
     TBooleanSome(boolean b) { b = true or b = false }
 
+  cached
+  newtype TDataFlowCallOption =
+    TDataFlowCallNone() or
+    TDataFlowCallSome(DataFlowCall call)
+
   cached
   newtype TTypedContent = MkTypedContent(Content c, DataFlowType t) { store(_, c, _, _, t) }
 
@@ -777,7 +1039,7 @@ ReturnPosition getReturnPosition(ReturnNodeExt ret) {
 
 bindingset[cc, callable]
 predicate resolveReturn(CallContext cc, DataFlowCallable callable, DataFlowCall call) {
-  cc instanceof CallContextAny and callable = viableCallable(call)
+  cc instanceof CallContextAny and callable = viableCallableExt(call)
   or
   exists(DataFlowCallable c0, DataFlowCall call0 |
     call0.getEnclosingCallable() = callable and
@@ -791,14 +1053,14 @@ DataFlowCallable resolveCall(DataFlowCall call, CallContext cc) {
   exists(DataFlowCall ctx | cc = TSpecificCall(ctx) |
     if reducedViableImplInCallContext(call, _, ctx)
     then result = prunedViableImplInCallContext(call, ctx)
-    else result = viableCallable(call)
+    else result = viableCallableExt(call)
   )
   or
-  result = viableCallable(call) and cc instanceof CallContextSomeCall
+  result = viableCallableExt(call) and cc instanceof CallContextSomeCall
   or
-  result = viableCallable(call) and cc instanceof CallContextAny
+  result = viableCallableExt(call) and cc instanceof CallContextAny
   or
-  result = viableCallable(call) and cc instanceof CallContextReturn
+  result = viableCallableExt(call) and cc instanceof CallContextReturn
 }
 
 predicate read = readStep/3;
@@ -812,6 +1074,19 @@ class BooleanOption extends TBooleanOption {
   }
 }
 
+/** An optional `DataFlowCall`. */
+class DataFlowCallOption extends TDataFlowCallOption {
+  string toString() {
+    this = TDataFlowCallNone() and
+    result = "(none)"
+    or
+    exists(DataFlowCall call |
+      this = TDataFlowCallSome(call) and
+      result = call.toString()
+    )
+  }
+}
+
 /** Content tagged with the type of a containing object. */
 class TypedContent extends MkTypedContent {
   private Content c;
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImplLocal.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImplLocal.qll
index 8b446d28b86..9498e51e7e6 100644
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImplLocal.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImplLocal.qll
@@ -2133,11 +2133,8 @@ private module Stage4 {
 
   bindingset[node, cc, config]
   private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowPrivate.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowPrivate.qll
index da20528760f..835e6c46451 100644
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowPrivate.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowPrivate.qll
@@ -312,3 +312,14 @@ predicate isImmutableOrUnobservable(Node n) {
 
 /** Holds if `n` should be hidden from path explanations. */
 predicate nodeIsHidden(Node n) { none() }
+
+class LambdaCallKind = Unit;
+
+/** Holds if `creation` is an expression that creates a lambda of kind `kind` for `c`. */
+predicate lambdaCreation(Node creation, LambdaCallKind kind, DataFlowCallable c) { none() }
+
+/** Holds if `call` is a lambda call of kind `kind` where `receiver` is the lambda expression. */
+predicate lambdaCall(DataFlowCall call, LambdaCallKind kind, Node receiver) { none() }
+
+/** Extra data-flow steps needed for lamba flow analysis. */
+predicate additionalLambdaFlowStep(Node nodeFrom, Node nodeTo, boolean preservesValue) { none() }
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll
index 0a6d459ec79..690f24fc59a 100644
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll
@@ -46,7 +46,7 @@ class Node extends TNode {
   /**
    * INTERNAL: Do not use. Alternative name for `getFunction`.
    */
-  final Function getEnclosingCallable() { result = unique(Function f | f = this.getFunction() | f) }
+  final Function getEnclosingCallable() { result = this.getFunction() }
 
   /** Gets the type of this node. */
   Type getType() { none() } // overridden in subclasses
@@ -324,7 +324,7 @@ private class VariablePartialDefinitionNode extends PartialDefinitionNode {
  * A synthetic data flow node used for flow into a collection when an iterator
  * write occurs in a callee.
  */
-class IteratorPartialDefinitionNode extends PartialDefinitionNode {
+private class IteratorPartialDefinitionNode extends PartialDefinitionNode {
   override IteratorPartialDefinition pd;
 
   override Node getPreUpdateNode() { pd.definesExpressions(_, result.asExpr()) }
@@ -715,6 +715,7 @@ private predicate exprToDefinitionByReferenceStep(Expr exprIn, Expr argOut) {
 }
 
 private module FieldFlow {
+  private import DataFlowImplCommon
   private import DataFlowImplLocal
   private import DataFlowPrivate
 
@@ -747,7 +748,7 @@ private module FieldFlow {
     exists(FieldConfiguration cfg | cfg.hasFlow(node1, node2)) and
     // This configuration should not be able to cross function boundaries, but
     // we double-check here just to be sure.
-    node1.getEnclosingCallable() = node2.getEnclosingCallable()
+    getNodeEnclosingCallable(node1) = getNodeEnclosingCallable(node2)
   }
 }
 
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/FlowVar.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/FlowVar.qll
index f3aa94a7992..e3f8b6f68fb 100644
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/FlowVar.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/FlowVar.qll
@@ -7,6 +7,7 @@ private import semmle.code.cpp.controlflow.SSA
 private import semmle.code.cpp.dataflow.internal.SubBasicBlocks
 private import semmle.code.cpp.dataflow.internal.AddressFlow
 private import semmle.code.cpp.models.implementations.Iterator
+private import semmle.code.cpp.models.interfaces.PointerWrapper
 
 /**
  * A conceptual variable that is assigned only once, like an SSA variable. This
@@ -158,18 +159,14 @@ private module PartialDefinitions {
     Expr innerDefinedExpr;
 
     IteratorPartialDefinition() {
-      exists(Expr convertedInner |
-        not this instanceof Conversion and
-        valueToUpdate(convertedInner, this.getFullyConverted(), node) and
-        innerDefinedExpr = convertedInner.getUnconverted() and
-        (
-          innerDefinedExpr.(Call).getQualifier() = getAnIteratorAccess(collection)
-          or
-          innerDefinedExpr.(Call).getQualifier() = collection.getAnAccess() and
-          collection instanceof IteratorParameter
-        ) and
-        innerDefinedExpr.(Call).getTarget() instanceof IteratorPointerDereferenceMemberOperator
-      )
+      innerDefinedExpr = getInnerDefinedExpr(this, node) and
+      (
+        innerDefinedExpr.(Call).getQualifier() = getAnIteratorAccess(collection)
+        or
+        innerDefinedExpr.(Call).getQualifier() = collection.getAnAccess() and
+        collection instanceof IteratorParameter
+      ) and
+      innerDefinedExpr.(Call).getTarget() instanceof IteratorPointerDereferenceMemberOperator
       or
       // iterators passed by value without a copy constructor
       exists(Call call |
@@ -207,16 +204,18 @@ private module PartialDefinitions {
     }
   }
 
+  private Expr getInnerDefinedExpr(Expr e, ControlFlowNode node) {
+    not e instanceof Conversion and
+    exists(Expr convertedInner |
+      valueToUpdate(convertedInner, e.getFullyConverted(), node) and
+      result = convertedInner.getUnconverted()
+    )
+  }
+
   class VariablePartialDefinition extends PartialDefinition {
     Expr innerDefinedExpr;
 
-    VariablePartialDefinition() {
-      not this instanceof Conversion and
-      exists(Expr convertedInner |
-        valueToUpdate(convertedInner, this.getFullyConverted(), node) and
-        innerDefinedExpr = convertedInner.getUnconverted()
-      )
-    }
+    VariablePartialDefinition() { innerDefinedExpr = getInnerDefinedExpr(this, node) }
 
     deprecated override predicate partiallyDefines(Variable v) {
       innerDefinedExpr = v.getAnAccess()
@@ -296,7 +295,8 @@ module FlowVar_internal {
     // treating them as immutable, but for data flow it gives better results in
     // practice to make the variable synonymous with its contents.
     not v.getUnspecifiedType() instanceof ReferenceType and
-    not v instanceof IteratorParameter
+    not v instanceof IteratorParameter and
+    not v instanceof PointerWrapperParameter
   }
 
   /**
@@ -644,10 +644,19 @@ module FlowVar_internal {
   predicate parameterIsNonConstReference(Parameter p) {
     exists(ReferenceType refType |
       refType = p.getUnderlyingType() and
-      not refType.getBaseType().isConst()
+      (
+        not refType.getBaseType().isConst()
+        or
+        // A field of a parameter of type `const std::shared_ptr<A>& p` can still be changed even though
+        // the base type of the reference is `const`.
+        refType.getBaseType().getUnspecifiedType() =
+          any(PointerWrapper wrapper | not wrapper.pointsToConst())
+      )
     )
     or
     p instanceof IteratorParameter
+    or
+    p instanceof PointerWrapperParameter
   }
 
   /**
@@ -836,6 +845,10 @@ module FlowVar_internal {
     IteratorParameter() { this.getUnspecifiedType() instanceof Iterator }
   }
 
+  class PointerWrapperParameter extends Parameter {
+    PointerWrapperParameter() { this.getUnspecifiedType() instanceof PointerWrapper }
+  }
+
   /**
    * Holds if `v` is initialized to have value `assignedExpr`.
    */
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/TaintTrackingUtil.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/TaintTrackingUtil.qll
index 1ef340c4f21..591f461c8eb 100644
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/TaintTrackingUtil.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/TaintTrackingUtil.qll
@@ -11,6 +11,7 @@
 private import semmle.code.cpp.models.interfaces.DataFlow
 private import semmle.code.cpp.models.interfaces.Taint
 private import semmle.code.cpp.models.interfaces.Iterator
+private import semmle.code.cpp.models.interfaces.PointerWrapper
 
 private module DataFlow {
   import semmle.code.cpp.dataflow.internal.DataFlowUtil
@@ -141,7 +142,10 @@ private predicate noFlowFromChildExpr(Expr e) {
   or
   e instanceof LogicalOrExpr
   or
-  e instanceof Call
+  // Allow taint from `operator*` on smart pointers.
+  exists(Call call | e = call |
+    not call.getTarget() = any(PointerWrapper wrapper).getAnUnwrapperFunction()
+  )
   or
   e instanceof SizeofOperator
   or
diff --git a/cpp/ql/src/semmle/code/cpp/exprs/Call.qll b/cpp/ql/src/semmle/code/cpp/exprs/Call.qll
index c57c608b69b..6f6f710ac4b 100644
--- a/cpp/ql/src/semmle/code/cpp/exprs/Call.qll
+++ b/cpp/ql/src/semmle/code/cpp/exprs/Call.qll
@@ -300,17 +300,25 @@ class FunctionCall extends Call, @funbindexpr {
   }
 }
 
+/** A _user-defined_ unary `operator*` function. */
+class OverloadedPointerDereferenceFunction extends Function {
+  OverloadedPointerDereferenceFunction() {
+    this.hasName("operator*") and
+    this.getEffectiveNumberOfParameters() = 1
+  }
+}
+
 /**
  * An instance of a _user-defined_ unary `operator*` applied to its argument.
  * ```
  * T1 operator*(const T2 &);
  * T1 a; T2 b;
  * a = *b;
+ * ```
  */
 class OverloadedPointerDereferenceExpr extends FunctionCall {
   OverloadedPointerDereferenceExpr() {
-    getTarget().hasName("operator*") and
-    getTarget().getEffectiveNumberOfParameters() = 1
+    this.getTarget() instanceof OverloadedPointerDereferenceFunction
   }
 
   override string getAPrimaryQlClass() { result = "OverloadedPointerDereferenceExpr" }
diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll
index 7ca03067d0a..3092031cbc7 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll
@@ -2,13 +2,16 @@ import cpp
 import semmle.code.cpp.security.Security
 private import semmle.code.cpp.ir.dataflow.DataFlow
 private import semmle.code.cpp.ir.dataflow.internal.DataFlowUtil
-private import semmle.code.cpp.ir.dataflow.DataFlow2
 private import semmle.code.cpp.ir.dataflow.DataFlow3
 private import semmle.code.cpp.ir.IR
 private import semmle.code.cpp.ir.dataflow.internal.DataFlowDispatch as Dispatch
 private import semmle.code.cpp.controlflow.IRGuards
 private import semmle.code.cpp.models.interfaces.Taint
 private import semmle.code.cpp.models.interfaces.DataFlow
+private import semmle.code.cpp.ir.dataflow.TaintTracking
+private import semmle.code.cpp.ir.dataflow.TaintTracking2
+private import semmle.code.cpp.ir.dataflow.TaintTracking3
+private import semmle.code.cpp.ir.dataflow.internal.ModelUtil
 
 /**
  * A predictable instruction is one where an external user can predict
@@ -65,23 +68,19 @@ private DataFlow::Node getNodeForExpr(Expr node) {
   not argv(node.(VariableAccess).getTarget())
 }
 
-private class DefaultTaintTrackingCfg extends DataFlow::Configuration {
+private class DefaultTaintTrackingCfg extends TaintTracking::Configuration {
   DefaultTaintTrackingCfg() { this = "DefaultTaintTrackingCfg" }
 
   override predicate isSource(DataFlow::Node source) { source = getNodeForSource(_) }
 
   override predicate isSink(DataFlow::Node sink) { exists(adjustedSink(sink)) }
 
-  override predicate isAdditionalFlowStep(DataFlow::Node n1, DataFlow::Node n2) {
-    commonTaintStep(n1, n2)
-  }
+  override predicate isSanitizer(DataFlow::Node node) { nodeIsBarrier(node) }
 
-  override predicate isBarrier(DataFlow::Node node) { nodeIsBarrier(node) }
-
-  override predicate isBarrierIn(DataFlow::Node node) { nodeIsBarrierIn(node) }
+  override predicate isSanitizerIn(DataFlow::Node node) { nodeIsBarrierIn(node) }
 }
 
-private class ToGlobalVarTaintTrackingCfg extends DataFlow::Configuration {
+private class ToGlobalVarTaintTrackingCfg extends TaintTracking::Configuration {
   ToGlobalVarTaintTrackingCfg() { this = "GlobalVarTaintTrackingCfg" }
 
   override predicate isSource(DataFlow::Node source) { source = getNodeForSource(_) }
@@ -90,20 +89,18 @@ private class ToGlobalVarTaintTrackingCfg extends DataFlow::Configuration {
     sink.asVariable() instanceof GlobalOrNamespaceVariable
   }
 
-  override predicate isAdditionalFlowStep(DataFlow::Node n1, DataFlow::Node n2) {
-    commonTaintStep(n1, n2)
-    or
+  override predicate isAdditionalTaintStep(DataFlow::Node n1, DataFlow::Node n2) {
     writesVariable(n1.asInstruction(), n2.asVariable().(GlobalOrNamespaceVariable))
     or
     readsVariable(n2.asInstruction(), n1.asVariable().(GlobalOrNamespaceVariable))
   }
 
-  override predicate isBarrier(DataFlow::Node node) { nodeIsBarrier(node) }
+  override predicate isSanitizer(DataFlow::Node node) { nodeIsBarrier(node) }
 
-  override predicate isBarrierIn(DataFlow::Node node) { nodeIsBarrierIn(node) }
+  override predicate isSanitizerIn(DataFlow::Node node) { nodeIsBarrierIn(node) }
 }
 
-private class FromGlobalVarTaintTrackingCfg extends DataFlow2::Configuration {
+private class FromGlobalVarTaintTrackingCfg extends TaintTracking2::Configuration {
   FromGlobalVarTaintTrackingCfg() { this = "FromGlobalVarTaintTrackingCfg" }
 
   override predicate isSource(DataFlow::Node source) {
@@ -114,18 +111,16 @@ private class FromGlobalVarTaintTrackingCfg extends DataFlow2::Configuration {
 
   override predicate isSink(DataFlow::Node sink) { exists(adjustedSink(sink)) }
 
-  override predicate isAdditionalFlowStep(DataFlow::Node n1, DataFlow::Node n2) {
-    commonTaintStep(n1, n2)
-    or
+  override predicate isAdditionalTaintStep(DataFlow::Node n1, DataFlow::Node n2) {
     // Additional step for flow out of variables. There is no flow _into_
     // variables in this configuration, so this step only serves to take flow
     // out of a variable that's a source.
     readsVariable(n2.asInstruction(), n1.asVariable())
   }
 
-  override predicate isBarrier(DataFlow::Node node) { nodeIsBarrier(node) }
+  override predicate isSanitizer(DataFlow::Node node) { nodeIsBarrier(node) }
 
-  override predicate isBarrierIn(DataFlow::Node node) { nodeIsBarrierIn(node) }
+  override predicate isSanitizerIn(DataFlow::Node node) { nodeIsBarrierIn(node) }
 }
 
 private predicate readsVariable(LoadInstruction load, Variable var) {
@@ -202,206 +197,26 @@ private predicate nodeIsBarrierIn(DataFlow::Node node) {
     // `getNodeForSource`.
     node = DataFlow::definitionByReferenceNodeFromArgument(source)
   )
-}
-
-cached
-private predicate commonTaintStep(DataFlow::Node fromNode, DataFlow::Node toNode) {
-  operandToInstructionTaintStep(fromNode.asOperand(), toNode.asInstruction())
   or
-  instructionToOperandTaintStep(fromNode.asInstruction(), toNode.asOperand())
-}
-
-private predicate instructionToOperandTaintStep(Instruction fromInstr, Operand toOperand) {
-  // Propagate flow from the definition of an operand to the operand, even when the overlap is inexact.
-  // We only do this in certain cases:
-  // 1. The instruction's result must not be conflated, and
-  // 2. The instruction's result type is one the types where we expect element-to-object flow. Currently
-  // this is array types and union types. This matches the other two cases of element-to-object flow in
-  // `DefaultTaintTracking`.
-  toOperand.getAnyDef() = fromInstr and
-  not fromInstr.isResultConflated() and
-  (
-    fromInstr.getResultType() instanceof ArrayType or
-    fromInstr.getResultType() instanceof Union
+  // don't use dataflow into binary instructions if both operands are unpredictable
+  exists(BinaryInstruction iTo |
+    iTo = node.asInstruction() and
+    not predictableInstruction(iTo.getLeft()) and
+    not predictableInstruction(iTo.getRight()) and
+    // propagate taint from either the pointer or the offset, regardless of predictability
+    not iTo instanceof PointerArithmeticInstruction
   )
   or
-  exists(ReadSideEffectInstruction readInstr |
-    fromInstr = readInstr.getArgumentDef() and
-    toOperand = readInstr.getSideEffectOperand()
-  )
-}
-
-private predicate operandToInstructionTaintStep(Operand fromOperand, Instruction toInstr) {
-  // Expressions computed from tainted data are also tainted
-  exists(CallInstruction call, int argIndex | call = toInstr |
-    isPureFunction(call.getStaticCallTarget().getName()) and
-    fromOperand = getACallArgumentOrIndirection(call, argIndex) and
-    forall(Operand argOperand | argOperand = call.getAnArgumentOperand() |
-      argOperand = getACallArgumentOrIndirection(call, argIndex) or
-      predictableInstruction(argOperand.getAnyDef())
-    ) and
-    // flow through `strlen` tends to cause dubious results, if the length is
-    // bounded.
-    not call.getStaticCallTarget().getName() = "strlen"
-  )
-  or
-  // Flow from argument to return value
-  toInstr =
-    any(CallInstruction call |
-      exists(int indexIn |
-        modelTaintToReturnValue(call.getStaticCallTarget(), indexIn) and
-        fromOperand = getACallArgumentOrIndirection(call, indexIn) and
-        not predictableOnlyFlow(call.getStaticCallTarget().getName())
-      )
-    )
-  or
-  // Flow from input argument to output argument
-  // TODO: This won't work in practice as long as all aliased memory is tracked
-  // together in a single virtual variable.
-  // TODO: Will this work on the test for `TaintedPath.ql`, where the output arg
-  // is a pointer addition expression?
-  toInstr =
-    any(WriteSideEffectInstruction outInstr |
-      exists(CallInstruction call, int indexIn, int indexOut |
-        modelTaintToParameter(call.getStaticCallTarget(), indexIn, indexOut) and
-        fromOperand = getACallArgumentOrIndirection(call, indexIn) and
-        outInstr.getIndex() = indexOut and
-        outInstr.getPrimaryInstruction() = call
-      )
-    )
-  or
-  // Flow through pointer dereference
-  toInstr.(LoadInstruction).getSourceAddressOperand() = fromOperand
-  or
-  // Flow through partial reads of arrays and unions
-  toInstr.(LoadInstruction).getSourceValueOperand() = fromOperand and
-  exists(Instruction fromInstr | fromInstr = fromOperand.getAnyDef() |
-    not fromInstr.isResultConflated() and
-    (
-      fromInstr.getResultType() instanceof ArrayType or
-      fromInstr.getResultType() instanceof Union
-    )
-  )
-  or
-  // Unary instructions tend to preserve enough information in practice that we
-  // want taint to flow through.
-  // The exception is `FieldAddressInstruction`. Together with the rule for
-  // `LoadInstruction` above and for `ChiInstruction` below, flow through
-  // `FieldAddressInstruction` could cause flow into one field to come out an
-  // unrelated field. This would happen across function boundaries, where the IR
-  // would not be able to match loads to stores.
-  toInstr.(UnaryInstruction).getUnaryOperand() = fromOperand and
-  (
-    not toInstr instanceof FieldAddressInstruction
-    or
-    toInstr.(FieldAddressInstruction).getField().getDeclaringType() instanceof Union
-  )
-  or
-  // Flow from an element to an array or union that contains it.
-  toInstr.(ChiInstruction).getPartialOperand() = fromOperand and
-  not toInstr.isResultConflated() and
-  exists(Type t | toInstr.getResultLanguageType().hasType(t, false) |
-    t instanceof Union
-    or
-    t instanceof ArrayType
-  )
-  or
-  exists(BinaryInstruction bin |
-    bin = toInstr and
-    predictableInstruction(toInstr.getAnOperand().getDef()) and
-    fromOperand = toInstr.getAnOperand()
-  )
-  or
-  // This is part of the translation of `a[i]`, where we want taint to flow
-  // from `a`.
-  toInstr.(PointerAddInstruction).getLeftOperand() = fromOperand
-  or
-  // Until we have flow through indirections across calls, we'll take flow out
-  // of the indirection and into the argument.
-  // When we get proper flow through indirections across calls, this code can be
-  // moved to `adjusedSink` or possibly into the `DataFlow::ExprNode` class.
-  exists(ReadSideEffectInstruction read |
-    read.getSideEffectOperand() = fromOperand and
-    read.getArgumentDef() = toInstr
-  )
-  or
-  // Until we have from through indirections across calls, we'll take flow out
-  // of the parameter and into its indirection.
-  // `InitializeIndirectionInstruction` only has a single operand: the address of the
-  // value whose indirection we are initializing. When initializing an indirection of a parameter `p`,
-  // the IR looks like this:
-  // ```
-  // m1 = InitializeParameter[p] : &r1
-  // r2 = Load[p] : r2, m1
-  // m3 = InitializeIndirection[p] : &r2
-  // ```
-  // So by having flow from `r2` to `m3` we're enabling flow from `m1` to `m3`. This relies on the
-  // `LoadOperand`'s overlap being exact.
-  toInstr.(InitializeIndirectionInstruction).getAnOperand() = fromOperand
-}
-
-/**
- * Returns the index of the side effect instruction corresponding to the specified function output,
- * if one exists.
- */
-private int getWriteSideEffectIndex(FunctionOutput output) {
-  output.isParameterDeref(result)
-  or
-  output.isQualifierObject() and result = -1
-}
-
-/**
- * Get an operand that goes into argument `argumentIndex` of `call`. This
- * can be either directly or through one pointer indirection.
- */
-private Operand getACallArgumentOrIndirection(CallInstruction call, int argumentIndex) {
-  result = call.getPositionalArgumentOperand(argumentIndex)
-  or
-  exists(ReadSideEffectInstruction readSE |
-    // TODO: why are read side effect operands imprecise?
-    result = readSE.getSideEffectOperand() and
-    readSE.getPrimaryInstruction() = call and
-    readSE.getIndex() = argumentIndex
-  )
-}
-
-private predicate modelTaintToParameter(Function f, int parameterIn, int parameterOut) {
-  exists(FunctionInput modelIn, FunctionOutput modelOut |
-    (
-      f.(DataFlowFunction).hasDataFlow(modelIn, modelOut)
-      or
-      f.(TaintFunction).hasTaintFlow(modelIn, modelOut)
-    ) and
-    (modelIn.isParameter(parameterIn) or modelIn.isParameterDeref(parameterIn)) and
-    parameterOut = getWriteSideEffectIndex(modelOut)
-  )
-}
-
-private predicate modelTaintToReturnValue(Function f, int parameterIn) {
-  // Taint flow from parameter to return value
-  exists(FunctionInput modelIn, FunctionOutput modelOut |
-    f.(TaintFunction).hasTaintFlow(modelIn, modelOut) and
-    (modelIn.isParameter(parameterIn) or modelIn.isParameterDeref(parameterIn)) and
-    (modelOut.isReturnValue() or modelOut.isReturnValueDeref())
-  )
-  or
-  // Data flow (not taint flow) to where the return value points. For the time
-  // being we will conflate pointers and objects in taint tracking.
-  exists(FunctionInput modelIn, FunctionOutput modelOut |
-    f.(DataFlowFunction).hasDataFlow(modelIn, modelOut) and
-    (modelIn.isParameter(parameterIn) or modelIn.isParameterDeref(parameterIn)) and
-    modelOut.isReturnValueDeref()
-  )
-  or
-  // Taint flow from one argument to another and data flow from an argument to a
-  // return value. This happens in functions like `strcat` and `memcpy`. We
-  // could model this flow in two separate steps, but that would add reverse
-  // flow from the write side-effect to the call instruction, which may not be
-  // desirable.
-  exists(int parameterMid, InParameter modelMid, OutReturnValue returnOut |
-    modelTaintToParameter(f, parameterIn, parameterMid) and
-    modelMid.isParameter(parameterMid) and
-    f.(DataFlowFunction).hasDataFlow(modelMid, returnOut)
+  // don't use dataflow through calls to pure functions if two or more operands
+  // are unpredictable
+  exists(Instruction iFrom1, Instruction iFrom2, CallInstruction iTo |
+    iTo = node.asInstruction() and
+    isPureFunction(iTo.getStaticCallTarget().getName()) and
+    iFrom1 = iTo.getAnArgument() and
+    iFrom2 = iTo.getAnArgument() and
+    not predictableInstruction(iFrom1) and
+    not predictableInstruction(iFrom2) and
+    iFrom1 != iFrom2
   )
 }
 
@@ -440,6 +255,14 @@ private Element adjustedSink(DataFlow::Node sink) {
   or
   // Taint `e1 += e2`, `e &= e2` and friends when `e1` or `e2` is tainted.
   result.(AssignOperation).getAnOperand() = sink.asExpr()
+  or
+  result =
+    sink.asOperand()
+        .(SideEffectOperand)
+        .getUse()
+        .(ReadSideEffectInstruction)
+        .getArgumentDef()
+        .getUnconvertedResultExpression()
 }
 
 /**
@@ -558,7 +381,7 @@ module TaintedWithPath {
     string toString() { result = "TaintTrackingConfiguration" }
   }
 
-  private class AdjustedConfiguration extends DataFlow3::Configuration {
+  private class AdjustedConfiguration extends TaintTracking3::Configuration {
     AdjustedConfiguration() { this = "AdjustedConfiguration" }
 
     override predicate isSource(DataFlow::Node source) {
@@ -571,21 +394,34 @@ module TaintedWithPath {
       exists(TaintTrackingConfiguration cfg | cfg.isSink(adjustedSink(sink)))
     }
 
-    override predicate isAdditionalFlowStep(DataFlow::Node n1, DataFlow::Node n2) {
-      commonTaintStep(n1, n2)
-      or
+    override predicate isAdditionalTaintStep(DataFlow::Node n1, DataFlow::Node n2) {
+      // Steps into and out of global variables
       exists(TaintTrackingConfiguration cfg | cfg.taintThroughGlobals() |
         writesVariable(n1.asInstruction(), n2.asVariable().(GlobalOrNamespaceVariable))
         or
         readsVariable(n2.asInstruction(), n1.asVariable().(GlobalOrNamespaceVariable))
       )
+      or
+      // Step to return value of a modeled function when an input taints the
+      // dereference of the return value
+      exists(CallInstruction call, Function func, FunctionInput modelIn, FunctionOutput modelOut |
+        n1.asOperand() = callInput(call, modelIn) and
+        (
+          func.(TaintFunction).hasTaintFlow(modelIn, modelOut)
+          or
+          func.(DataFlowFunction).hasDataFlow(modelIn, modelOut)
+        ) and
+        call.getStaticCallTarget() = func and
+        modelOut.isReturnValueDeref() and
+        call = n2.asInstruction()
+      )
     }
 
-    override predicate isBarrier(DataFlow::Node node) {
+    override predicate isSanitizer(DataFlow::Node node) {
       exists(TaintTrackingConfiguration cfg, Expr e | cfg.isBarrier(e) and node = getNodeForExpr(e))
     }
 
-    override predicate isBarrierIn(DataFlow::Node node) { nodeIsBarrierIn(node) }
+    override predicate isSanitizerIn(DataFlow::Node node) { nodeIsBarrierIn(node) }
   }
 
   /*
diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/TaintTracking3.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/TaintTracking3.qll
new file mode 100644
index 00000000000..98e1caebf38
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/TaintTracking3.qll
@@ -0,0 +1,15 @@
+/**
+ * Provides a `TaintTracking3` module, which is a copy of the `TaintTracking`
+ * module. Use this class when data-flow configurations or taint-tracking
+ * configurations must depend on each other. Two classes extending
+ * `DataFlow::Configuration` should never depend on each other, but one of them
+ * should instead depend on a `DataFlow2::Configuration`, a
+ * `DataFlow3::Configuration`, or a `DataFlow4::Configuration`. The
+ * `TaintTracking::Configuration` class extends `DataFlow::Configuration`, and
+ * `TaintTracking2::Configuration` extends `DataFlow2::Configuration`.
+ *
+ * See `semmle.code.cpp.ir.dataflow.TaintTracking` for the full documentation.
+ */
+module TaintTracking3 {
+  import semmle.code.cpp.ir.dataflow.internal.tainttracking3.TaintTrackingImpl
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll
index 8b446d28b86..9498e51e7e6 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll
@@ -2133,11 +2133,8 @@ private module Stage4 {
 
   bindingset[node, cc, config]
   private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and
diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll
index 8b446d28b86..9498e51e7e6 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll
@@ -2133,11 +2133,8 @@ private module Stage4 {
 
   bindingset[node, cc, config]
   private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and
diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll
index 8b446d28b86..9498e51e7e6 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll
@@ -2133,11 +2133,8 @@ private module Stage4 {
 
   bindingset[node, cc, config]
   private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and
diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll
index 8b446d28b86..9498e51e7e6 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll
@@ -2133,11 +2133,8 @@ private module Stage4 {
 
   bindingset[node, cc, config]
   private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and
diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImplCommon.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImplCommon.qll
index 1319f972037..a51c20c2288 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImplCommon.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImplCommon.qll
@@ -26,15 +26,243 @@ predicate accessPathCostLimits(int apLimit, int tupleLimit) {
   tupleLimit = 1000
 }
 
+/**
+ * Provides a simple data-flow analysis for resolving lambda calls. The analysis
+ * currently excludes read-steps, store-steps, and flow-through.
+ *
+ * The analysis uses non-linear recursion: When computing a flow path in or out
+ * of a call, we use the results of the analysis recursively to resolve lamba
+ * calls. For this reason, we cannot reuse the code from `DataFlowImpl.qll` directly.
+ */
+private module LambdaFlow {
+  private predicate viableParamNonLambda(DataFlowCall call, int i, ParameterNode p) {
+    p.isParameterOf(viableCallable(call), i)
+  }
+
+  private predicate viableParamLambda(DataFlowCall call, int i, ParameterNode p) {
+    p.isParameterOf(viableCallableLambda(call, _), i)
+  }
+
+  private predicate viableParamArgNonLambda(DataFlowCall call, ParameterNode p, ArgumentNode arg) {
+    exists(int i |
+      viableParamNonLambda(call, i, p) and
+      arg.argumentOf(call, i)
+    )
+  }
+
+  private predicate viableParamArgLambda(DataFlowCall call, ParameterNode p, ArgumentNode arg) {
+    exists(int i |
+      viableParamLambda(call, i, p) and
+      arg.argumentOf(call, i)
+    )
+  }
+
+  private newtype TReturnPositionSimple =
+    TReturnPositionSimple0(DataFlowCallable c, ReturnKind kind) {
+      exists(ReturnNode ret |
+        c = getNodeEnclosingCallable(ret) and
+        kind = ret.getKind()
+      )
+    }
+
+  pragma[noinline]
+  private TReturnPositionSimple getReturnPositionSimple(ReturnNode ret, ReturnKind kind) {
+    result = TReturnPositionSimple0(getNodeEnclosingCallable(ret), kind)
+  }
+
+  pragma[nomagic]
+  private TReturnPositionSimple viableReturnPosNonLambda(DataFlowCall call, ReturnKind kind) {
+    result = TReturnPositionSimple0(viableCallable(call), kind)
+  }
+
+  pragma[nomagic]
+  private TReturnPositionSimple viableReturnPosLambda(
+    DataFlowCall call, DataFlowCallOption lastCall, ReturnKind kind
+  ) {
+    result = TReturnPositionSimple0(viableCallableLambda(call, lastCall), kind)
+  }
+
+  private predicate viableReturnPosOutNonLambda(
+    DataFlowCall call, TReturnPositionSimple pos, OutNode out
+  ) {
+    exists(ReturnKind kind |
+      pos = viableReturnPosNonLambda(call, kind) and
+      out = getAnOutNode(call, kind)
+    )
+  }
+
+  private predicate viableReturnPosOutLambda(
+    DataFlowCall call, DataFlowCallOption lastCall, TReturnPositionSimple pos, OutNode out
+  ) {
+    exists(ReturnKind kind |
+      pos = viableReturnPosLambda(call, lastCall, kind) and
+      out = getAnOutNode(call, kind)
+    )
+  }
+
+  /**
+   * Holds if data can flow (inter-procedurally) from `node` (of type `t`) to
+   * the lambda call `lambdaCall`.
+   *
+   * The parameter `toReturn` indicates whether the path from `node` to
+   * `lambdaCall` goes through a return, and `toJump` whether the path goes
+   * through a jump step.
+   *
+   * The call context `lastCall` records the last call on the path from `node`
+   * to `lambdaCall`, if any. That is, `lastCall` is able to target the enclosing
+   * callable of `lambdaCall`.
+   */
+  pragma[nomagic]
+  predicate revLambdaFlow(
+    DataFlowCall lambdaCall, LambdaCallKind kind, Node node, DataFlowType t, boolean toReturn,
+    boolean toJump, DataFlowCallOption lastCall
+  ) {
+    revLambdaFlow0(lambdaCall, kind, node, t, toReturn, toJump, lastCall) and
+    if node instanceof CastNode or node instanceof ArgumentNode or node instanceof ReturnNode
+    then compatibleTypes(t, getNodeType(node))
+    else any()
+  }
+
+  pragma[nomagic]
+  predicate revLambdaFlow0(
+    DataFlowCall lambdaCall, LambdaCallKind kind, Node node, DataFlowType t, boolean toReturn,
+    boolean toJump, DataFlowCallOption lastCall
+  ) {
+    lambdaCall(lambdaCall, kind, node) and
+    t = getNodeType(node) and
+    toReturn = false and
+    toJump = false and
+    lastCall = TDataFlowCallNone()
+    or
+    // local flow
+    exists(Node mid, DataFlowType t0 |
+      revLambdaFlow(lambdaCall, kind, mid, t0, toReturn, toJump, lastCall)
+    |
+      simpleLocalFlowStep(node, mid) and
+      t = t0
+      or
+      exists(boolean preservesValue |
+        additionalLambdaFlowStep(node, mid, preservesValue) and
+        getNodeEnclosingCallable(node) = getNodeEnclosingCallable(mid)
+      |
+        preservesValue = false and
+        t = getNodeType(node)
+        or
+        preservesValue = true and
+        t = t0
+      )
+    )
+    or
+    // jump step
+    exists(Node mid, DataFlowType t0 |
+      revLambdaFlow(lambdaCall, kind, mid, t0, _, _, _) and
+      toReturn = false and
+      toJump = true and
+      lastCall = TDataFlowCallNone()
+    |
+      jumpStep(node, mid) and
+      t = t0
+      or
+      exists(boolean preservesValue |
+        additionalLambdaFlowStep(node, mid, preservesValue) and
+        getNodeEnclosingCallable(node) != getNodeEnclosingCallable(mid)
+      |
+        preservesValue = false and
+        t = getNodeType(node)
+        or
+        preservesValue = true and
+        t = t0
+      )
+    )
+    or
+    // flow into a callable
+    exists(ParameterNode p, DataFlowCallOption lastCall0, DataFlowCall call |
+      revLambdaFlowIn(lambdaCall, kind, p, t, toJump, lastCall0) and
+      (
+        if lastCall0 = TDataFlowCallNone() and toJump = false
+        then lastCall = TDataFlowCallSome(call)
+        else lastCall = lastCall0
+      ) and
+      toReturn = false
+    |
+      viableParamArgNonLambda(call, p, node)
+      or
+      viableParamArgLambda(call, p, node) // non-linear recursion
+    )
+    or
+    // flow out of a callable
+    exists(TReturnPositionSimple pos |
+      revLambdaFlowOut(lambdaCall, kind, pos, t, toJump, lastCall) and
+      getReturnPositionSimple(node, node.(ReturnNode).getKind()) = pos and
+      toReturn = true
+    )
+  }
+
+  pragma[nomagic]
+  predicate revLambdaFlowOutLambdaCall(
+    DataFlowCall lambdaCall, LambdaCallKind kind, OutNode out, DataFlowType t, boolean toJump,
+    DataFlowCall call, DataFlowCallOption lastCall
+  ) {
+    revLambdaFlow(lambdaCall, kind, out, t, _, toJump, lastCall) and
+    exists(ReturnKindExt rk |
+      out = rk.getAnOutNode(call) and
+      lambdaCall(call, _, _)
+    )
+  }
+
+  pragma[nomagic]
+  predicate revLambdaFlowOut(
+    DataFlowCall lambdaCall, LambdaCallKind kind, TReturnPositionSimple pos, DataFlowType t,
+    boolean toJump, DataFlowCallOption lastCall
+  ) {
+    exists(DataFlowCall call, OutNode out |
+      revLambdaFlow(lambdaCall, kind, out, t, _, toJump, lastCall) and
+      viableReturnPosOutNonLambda(call, pos, out)
+      or
+      // non-linear recursion
+      revLambdaFlowOutLambdaCall(lambdaCall, kind, out, t, toJump, call, lastCall) and
+      viableReturnPosOutLambda(call, _, pos, out)
+    )
+  }
+
+  pragma[nomagic]
+  predicate revLambdaFlowIn(
+    DataFlowCall lambdaCall, LambdaCallKind kind, ParameterNode p, DataFlowType t, boolean toJump,
+    DataFlowCallOption lastCall
+  ) {
+    revLambdaFlow(lambdaCall, kind, p, t, false, toJump, lastCall)
+  }
+}
+
+private DataFlowCallable viableCallableExt(DataFlowCall call) {
+  result = viableCallable(call)
+  or
+  result = viableCallableLambda(call, _)
+}
+
 cached
 private module Cached {
+  /**
+   * Gets a viable target for the lambda call `call`.
+   *
+   * `lastCall` records the call required to reach `call` in order for the result
+   * to be a viable target, if any.
+   */
+  cached
+  DataFlowCallable viableCallableLambda(DataFlowCall call, DataFlowCallOption lastCall) {
+    exists(Node creation, LambdaCallKind kind |
+      LambdaFlow::revLambdaFlow(call, kind, creation, _, _, _, lastCall) and
+      lambdaCreation(creation, kind, result)
+    )
+  }
+
   /**
    * Holds if `p` is the `i`th parameter of a viable dispatch target of `call`.
    * The instance parameter is considered to have index `-1`.
    */
   pragma[nomagic]
   private predicate viableParam(DataFlowCall call, int i, ParameterNode p) {
-    p.isParameterOf(viableCallable(call), i)
+    p.isParameterOf(viableCallableExt(call), i)
   }
 
   /**
@@ -52,7 +280,7 @@ private module Cached {
 
   pragma[nomagic]
   private ReturnPosition viableReturnPos(DataFlowCall call, ReturnKindExt kind) {
-    viableCallable(call) = result.getCallable() and
+    viableCallableExt(call) = result.getCallable() and
     kind = result.getKind()
   }
 
@@ -317,6 +545,35 @@ private module Cached {
 
   cached
   private module DispatchWithCallContext {
+    /**
+     * Holds if the set of viable implementations that can be called by `call`
+     * might be improved by knowing the call context.
+     */
+    pragma[nomagic]
+    private predicate mayBenefitFromCallContextExt(DataFlowCall call, DataFlowCallable callable) {
+      mayBenefitFromCallContext(call, callable)
+      or
+      callable = call.getEnclosingCallable() and
+      exists(viableCallableLambda(call, TDataFlowCallSome(_)))
+    }
+
+    /**
+     * Gets a viable dispatch target of `call` in the context `ctx`. This is
+     * restricted to those `call`s for which a context might make a difference.
+     */
+    pragma[nomagic]
+    private DataFlowCallable viableImplInCallContextExt(DataFlowCall call, DataFlowCall ctx) {
+      result = viableImplInCallContext(call, ctx)
+      or
+      result = viableCallableLambda(call, TDataFlowCallSome(ctx))
+      or
+      exists(DataFlowCallable enclosing |
+        mayBenefitFromCallContextExt(call, enclosing) and
+        enclosing = viableCallableExt(ctx) and
+        result = viableCallableLambda(call, TDataFlowCallNone())
+      )
+    }
+
     /**
      * Holds if the call context `ctx` reduces the set of viable run-time
      * dispatch targets of call `call` in `c`.
@@ -324,10 +581,10 @@ private module Cached {
     cached
     predicate reducedViableImplInCallContext(DataFlowCall call, DataFlowCallable c, DataFlowCall ctx) {
       exists(int tgts, int ctxtgts |
-        mayBenefitFromCallContext(call, c) and
-        c = viableCallable(ctx) and
-        ctxtgts = count(viableImplInCallContext(call, ctx)) and
-        tgts = strictcount(viableCallable(call)) and
+        mayBenefitFromCallContextExt(call, c) and
+        c = viableCallableExt(ctx) and
+        ctxtgts = count(viableImplInCallContextExt(call, ctx)) and
+        tgts = strictcount(viableCallableExt(call)) and
         ctxtgts < tgts
       )
     }
@@ -339,7 +596,7 @@ private module Cached {
      */
     cached
     DataFlowCallable prunedViableImplInCallContext(DataFlowCall call, DataFlowCall ctx) {
-      result = viableImplInCallContext(call, ctx) and
+      result = viableImplInCallContextExt(call, ctx) and
       reducedViableImplInCallContext(call, _, ctx)
     }
 
@@ -351,10 +608,10 @@ private module Cached {
     cached
     predicate reducedViableImplInReturn(DataFlowCallable c, DataFlowCall call) {
       exists(int tgts, int ctxtgts |
-        mayBenefitFromCallContext(call, _) and
-        c = viableCallable(call) and
-        ctxtgts = count(DataFlowCall ctx | c = viableImplInCallContext(call, ctx)) and
-        tgts = strictcount(DataFlowCall ctx | viableCallable(ctx) = call.getEnclosingCallable()) and
+        mayBenefitFromCallContextExt(call, _) and
+        c = viableCallableExt(call) and
+        ctxtgts = count(DataFlowCall ctx | c = viableImplInCallContextExt(call, ctx)) and
+        tgts = strictcount(DataFlowCall ctx | viableCallableExt(ctx) = call.getEnclosingCallable()) and
         ctxtgts < tgts
       )
     }
@@ -367,7 +624,7 @@ private module Cached {
      */
     cached
     DataFlowCallable prunedViableImplInCallContextReverse(DataFlowCall call, DataFlowCall ctx) {
-      result = viableImplInCallContext(call, ctx) and
+      result = viableImplInCallContextExt(call, ctx) and
       reducedViableImplInReturn(result, call)
     }
   }
@@ -481,6 +738,11 @@ private module Cached {
     TBooleanNone() or
     TBooleanSome(boolean b) { b = true or b = false }
 
+  cached
+  newtype TDataFlowCallOption =
+    TDataFlowCallNone() or
+    TDataFlowCallSome(DataFlowCall call)
+
   cached
   newtype TTypedContent = MkTypedContent(Content c, DataFlowType t) { store(_, c, _, _, t) }
 
@@ -777,7 +1039,7 @@ ReturnPosition getReturnPosition(ReturnNodeExt ret) {
 
 bindingset[cc, callable]
 predicate resolveReturn(CallContext cc, DataFlowCallable callable, DataFlowCall call) {
-  cc instanceof CallContextAny and callable = viableCallable(call)
+  cc instanceof CallContextAny and callable = viableCallableExt(call)
   or
   exists(DataFlowCallable c0, DataFlowCall call0 |
     call0.getEnclosingCallable() = callable and
@@ -791,14 +1053,14 @@ DataFlowCallable resolveCall(DataFlowCall call, CallContext cc) {
   exists(DataFlowCall ctx | cc = TSpecificCall(ctx) |
     if reducedViableImplInCallContext(call, _, ctx)
     then result = prunedViableImplInCallContext(call, ctx)
-    else result = viableCallable(call)
+    else result = viableCallableExt(call)
   )
   or
-  result = viableCallable(call) and cc instanceof CallContextSomeCall
+  result = viableCallableExt(call) and cc instanceof CallContextSomeCall
   or
-  result = viableCallable(call) and cc instanceof CallContextAny
+  result = viableCallableExt(call) and cc instanceof CallContextAny
   or
-  result = viableCallable(call) and cc instanceof CallContextReturn
+  result = viableCallableExt(call) and cc instanceof CallContextReturn
 }
 
 predicate read = readStep/3;
@@ -812,6 +1074,19 @@ class BooleanOption extends TBooleanOption {
   }
 }
 
+/** An optional `DataFlowCall`. */
+class DataFlowCallOption extends TDataFlowCallOption {
+  string toString() {
+    this = TDataFlowCallNone() and
+    result = "(none)"
+    or
+    exists(DataFlowCall call |
+      this = TDataFlowCallSome(call) and
+      result = call.toString()
+    )
+  }
+}
+
 /** Content tagged with the type of a containing object. */
 class TypedContent extends MkTypedContent {
   private Content c;
diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
index a2b1cae14d6..3b94e574de0 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
@@ -548,3 +548,14 @@ predicate isImmutableOrUnobservable(Node n) {
 
 /** Holds if `n` should be hidden from path explanations. */
 predicate nodeIsHidden(Node n) { n instanceof OperandNode and not n instanceof ArgumentNode }
+
+class LambdaCallKind = Unit;
+
+/** Holds if `creation` is an expression that creates a lambda of kind `kind` for `c`. */
+predicate lambdaCreation(Node creation, LambdaCallKind kind, DataFlowCallable c) { none() }
+
+/** Holds if `call` is a lambda call of kind `kind` where `receiver` is the lambda expression. */
+predicate lambdaCall(DataFlowCall call, LambdaCallKind kind, Node receiver) { none() }
+
+/** Extra data-flow steps needed for lamba flow analysis. */
+predicate additionalLambdaFlowStep(Node nodeFrom, Node nodeTo, boolean preservesValue) { none() }
diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
index 76ca7b215dc..f5fb7309cff 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
@@ -362,15 +362,22 @@ private class ExplicitFieldStoreQualifierNode extends PartialDefinitionNode {
 
 /**
  * Not every store instruction generates a chi instruction that we can attach a PostUpdateNode to.
- * For instance, an update to a field of a struct containing only one field. For these cases we
- * attach the PostUpdateNode to the store instruction. There's no obvious pre update node for this case
- * (as the entire memory is updated), so `getPreUpdateNode` is implemented as `none()`.
+ * For instance, an update to a field of a struct containing only one field. Even if the store does
+ * have a chi instruction, a subsequent use of the result of the store may be linked directly to the
+ * result of the store as an inexact definition if the store totally overlaps the use. For these
+ * cases we attach the PostUpdateNode to the store instruction. There's no obvious pre update node
+ * for this case (as the entire memory is updated), so `getPreUpdateNode` is implemented as
+ * `none()`.
  */
 private class ExplicitSingleFieldStoreQualifierNode extends PartialDefinitionNode {
   override StoreInstruction instr;
 
   ExplicitSingleFieldStoreQualifierNode() {
-    not exists(ChiInstruction chi | chi.getPartial() = instr) and
+    (
+      instr.getAUse().isDefinitionInexact()
+      or
+      not exists(ChiInstruction chi | chi.getPartial() = instr)
+    ) and
     // Without this condition any store would create a `PostUpdateNode`.
     instr.getDestinationAddress() instanceof FieldAddressInstruction
   }
diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/ModelUtil.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/ModelUtil.qll
index 93d74519ca5..2f4037d4ec8 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/ModelUtil.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/ModelUtil.qll
@@ -9,30 +9,18 @@ private import semmle.code.cpp.ir.dataflow.DataFlow
 /**
  * Gets the instruction that goes into `input` for `call`.
  */
-DataFlow::Node callInput(CallInstruction call, FunctionInput input) {
-  // A positional argument
+Operand callInput(CallInstruction call, FunctionInput input) {
+  // An argument or qualifier
   exists(int index |
-    result.asInstruction() = call.getPositionalArgument(index) and
-    input.isParameter(index)
+    result = call.getArgumentOperand(index) and
+    input.isParameterOrQualifierAddress(index)
   )
   or
-  // A value pointed to by a positional argument
+  // A value pointed to by an argument or qualifier
   exists(ReadSideEffectInstruction read |
-    result.asOperand() = read.getSideEffectOperand() and
+    result = read.getSideEffectOperand() and
     read.getPrimaryInstruction() = call and
-    input.isParameterDeref(read.getIndex())
-  )
-  or
-  // The qualifier pointer
-  result.asInstruction() = call.getThisArgument() and
-  input.isQualifierAddress()
-  or
-  // The qualifier object
-  exists(ReadSideEffectInstruction read |
-    result.asOperand() = read.getSideEffectOperand() and
-    read.getPrimaryInstruction() = call and
-    read.getIndex() = -1 and
-    input.isQualifierObject()
+    input.isParameterDerefOrQualifierObject(read.getIndex())
   )
 }
 
@@ -44,19 +32,11 @@ Instruction callOutput(CallInstruction call, FunctionOutput output) {
   result = call and
   output.isReturnValue()
   or
-  // The side effect of a call on the value pointed to by a positional argument
+  // The side effect of a call on the value pointed to by an argument or qualifier
   exists(WriteSideEffectInstruction effect |
     result = effect and
     effect.getPrimaryInstruction() = call and
-    output.isParameterDeref(effect.getIndex())
-  )
-  or
-  // The side effect of a call on the qualifier object
-  exists(WriteSideEffectInstruction effect |
-    result = effect and
-    effect.getPrimaryInstruction() = call and
-    effect.getIndex() = -1 and
-    output.isQualifierObject()
+    output.isParameterDerefOrQualifierObject(effect.getIndex())
   )
   // TODO: return value dereference
 }
diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/PrintIRLocalFlow.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/PrintIRLocalFlow.qll
index 337dc71a3ca..16182296e40 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/PrintIRLocalFlow.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/PrintIRLocalFlow.qll
@@ -6,34 +6,7 @@ private import semmle.code.cpp.ir.ValueNumbering
 private import semmle.code.cpp.ir.IR
 private import semmle.code.cpp.ir.dataflow.DataFlow
 private import semmle.code.cpp.ir.dataflow.internal.DataFlowUtil
-
-/**
- * Gets a short ID for an IR dataflow node.
- * - For `Instruction`s, this is just the result ID of the instruction (e.g. `m128`).
- * - For `Operand`s, this is the label of the operand, prefixed with the result ID of the
- *   instruction and a dot (e.g. `m128.left`).
- * - For `Variable`s, this is the qualified name of the variable.
- */
-private string nodeId(DataFlow::Node node, int order1, int order2) {
-  exists(Instruction instruction | instruction = node.asInstruction() |
-    result = instruction.getResultId() and
-    order1 = instruction.getBlock().getDisplayIndex() and
-    order2 = instruction.getDisplayIndexInBlock()
-  )
-  or
-  exists(Operand operand, Instruction instruction |
-    operand = node.asOperand() and
-    instruction = operand.getUse()
-  |
-    result = instruction.getResultId() + "." + operand.getDumpId() and
-    order1 = instruction.getBlock().getDisplayIndex() and
-    order2 = instruction.getDisplayIndexInBlock()
-  )
-  or
-  result = "var(" + node.asVariable().getQualifiedName() + ")" and
-  order1 = 1000000 and
-  order2 = 0
-}
+private import PrintIRUtilities
 
 /**
  * Gets the local dataflow from other nodes in the same function to this node.
diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/PrintIRStoreSteps.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/PrintIRStoreSteps.qll
new file mode 100644
index 00000000000..8c318216217
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/PrintIRStoreSteps.qll
@@ -0,0 +1,33 @@
+/**
+ * Print the dataflow local store steps in IR dumps.
+ */
+
+private import cpp
+// The `ValueNumbering` library has to be imported right after `cpp` to ensure
+// that the cached IR gets the same checksum here as it does in queries that use
+// `ValueNumbering` without `DataFlow`.
+private import semmle.code.cpp.ir.ValueNumbering
+private import semmle.code.cpp.ir.IR
+private import semmle.code.cpp.ir.dataflow.DataFlow
+private import semmle.code.cpp.ir.dataflow.internal.DataFlowUtil
+private import semmle.code.cpp.ir.dataflow.internal.DataFlowPrivate
+private import PrintIRUtilities
+
+/**
+ * Property provider for local IR dataflow store steps.
+ */
+class LocalFlowPropertyProvider extends IRPropertyProvider {
+  override string getInstructionProperty(Instruction instruction, string key) {
+    exists(DataFlow::Node objectNode, Content content |
+      key = "content[" + content.toString() + "]" and
+      instruction = objectNode.asInstruction() and
+      result =
+        strictconcat(string element, DataFlow::Node fieldNode |
+          storeStep(fieldNode, content, objectNode) and
+          element = nodeId(fieldNode, _, _)
+        |
+          element, ", "
+        )
+    )
+  }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/PrintIRUtilities.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/PrintIRUtilities.qll
new file mode 100644
index 00000000000..5fc15cf986c
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/PrintIRUtilities.qll
@@ -0,0 +1,39 @@
+/**
+ * Shared utilities used when printing dataflow annotations in IR dumps.
+ */
+
+private import cpp
+// The `ValueNumbering` library has to be imported right after `cpp` to ensure
+// that the cached IR gets the same checksum here as it does in queries that use
+// `ValueNumbering` without `DataFlow`.
+private import semmle.code.cpp.ir.ValueNumbering
+private import semmle.code.cpp.ir.IR
+private import semmle.code.cpp.ir.dataflow.DataFlow
+
+/**
+ * Gets a short ID for an IR dataflow node.
+ * - For `Instruction`s, this is just the result ID of the instruction (e.g. `m128`).
+ * - For `Operand`s, this is the label of the operand, prefixed with the result ID of the
+ *   instruction and a dot (e.g. `m128.left`).
+ * - For `Variable`s, this is the qualified name of the variable.
+ */
+string nodeId(DataFlow::Node node, int order1, int order2) {
+  exists(Instruction instruction | instruction = node.asInstruction() |
+    result = instruction.getResultId() and
+    order1 = instruction.getBlock().getDisplayIndex() and
+    order2 = instruction.getDisplayIndexInBlock()
+  )
+  or
+  exists(Operand operand, Instruction instruction |
+    operand = node.asOperand() and
+    instruction = operand.getUse()
+  |
+    result = instruction.getResultId() + "." + operand.getDumpId() and
+    order1 = instruction.getBlock().getDisplayIndex() and
+    order2 = instruction.getDisplayIndexInBlock()
+  )
+  or
+  result = "var(" + node.asVariable().getQualifiedName() + ")" and
+  order1 = 1000000 and
+  order2 = 0
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/TaintTrackingUtil.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/TaintTrackingUtil.qll
index 202d3f1c14e..ab1177daea9 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/TaintTrackingUtil.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/TaintTrackingUtil.qll
@@ -21,53 +21,104 @@ predicate localTaintStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
  */
 cached
 predicate localAdditionalTaintStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
-  localInstructionTaintStep(nodeFrom.asInstruction(), nodeTo.asInstruction())
+  operandToInstructionTaintStep(nodeFrom.asOperand(), nodeTo.asInstruction())
   or
-  modeledTaintStep(nodeFrom, nodeTo)
+  instructionToOperandTaintStep(nodeFrom.asInstruction(), nodeTo.asOperand())
+}
+
+private predicate instructionToOperandTaintStep(Instruction fromInstr, Operand toOperand) {
+  // Propagate flow from the definition of an operand to the operand, even when the overlap is inexact.
+  // We only do this in certain cases:
+  // 1. The instruction's result must not be conflated, and
+  // 2. The instruction's result type is one the types where we expect element-to-object flow. Currently
+  // this is array types and union types. This matches the other two cases of element-to-object flow in
+  // `DefaultTaintTracking`.
+  toOperand.getAnyDef() = fromInstr and
+  not fromInstr.isResultConflated() and
+  (
+    fromInstr.getResultType() instanceof ArrayType or
+    fromInstr.getResultType() instanceof Union
+  )
+  or
+  exists(ReadSideEffectInstruction readInstr |
+    fromInstr = readInstr.getArgumentDef() and
+    toOperand = readInstr.getSideEffectOperand()
+  )
+  or
+  toOperand.(LoadOperand).getAnyDef() = fromInstr
 }
 
 /**
  * Holds if taint propagates from `nodeFrom` to `nodeTo` in exactly one local
  * (intra-procedural) step.
  */
-private predicate localInstructionTaintStep(Instruction nodeFrom, Instruction nodeTo) {
+private predicate operandToInstructionTaintStep(Operand opFrom, Instruction instrTo) {
   // Taint can flow through expressions that alter the value but preserve
   // more than one bit of it _or_ expressions that follow data through
   // pointer indirections.
-  nodeTo.getAnOperand().getAnyDef() = nodeFrom and
+  instrTo.getAnOperand() = opFrom and
   (
-    nodeTo instanceof ArithmeticInstruction
+    instrTo instanceof ArithmeticInstruction
     or
-    nodeTo instanceof BitwiseInstruction
+    instrTo instanceof BitwiseInstruction
     or
-    nodeTo instanceof PointerArithmeticInstruction
-    or
-    nodeTo instanceof FieldAddressInstruction
+    instrTo instanceof PointerArithmeticInstruction
     or
     // The `CopyInstruction` case is also present in non-taint data flow, but
     // that uses `getDef` rather than `getAnyDef`. For taint, we want flow
     // from a definition of `myStruct` to a `myStruct.myField` expression.
-    nodeTo instanceof CopyInstruction
+    instrTo instanceof CopyInstruction
   )
   or
-  nodeTo.(LoadInstruction).getSourceAddress() = nodeFrom
-  or
-  // Flow through partial reads of arrays and unions
-  nodeTo.(LoadInstruction).getSourceValueOperand().getAnyDef() = nodeFrom and
-  not nodeFrom.isResultConflated() and
+  // Unary instructions tend to preserve enough information in practice that we
+  // want taint to flow through.
+  // The exception is `FieldAddressInstruction`. Together with the rules below for
+  // `LoadInstruction`s and `ChiInstruction`s, flow through `FieldAddressInstruction`
+  // could cause flow into one field to come out an unrelated field.
+  // This would happen across function boundaries, where the IR would not be able to
+  // match loads to stores.
+  instrTo.(UnaryInstruction).getUnaryOperand() = opFrom and
   (
-    nodeFrom.getResultType() instanceof ArrayType or
-    nodeFrom.getResultType() instanceof Union
+    not instrTo instanceof FieldAddressInstruction
+    or
+    instrTo.(FieldAddressInstruction).getField().getDeclaringType() instanceof Union
   )
   or
+  instrTo.(LoadInstruction).getSourceAddressOperand() = opFrom
+  or
   // Flow from an element to an array or union that contains it.
-  nodeTo.(ChiInstruction).getPartial() = nodeFrom and
-  not nodeTo.isResultConflated() and
-  exists(Type t | nodeTo.getResultLanguageType().hasType(t, false) |
+  instrTo.(ChiInstruction).getPartialOperand() = opFrom and
+  not instrTo.isResultConflated() and
+  exists(Type t | instrTo.getResultLanguageType().hasType(t, false) |
     t instanceof Union
     or
     t instanceof ArrayType
   )
+  or
+  // Until we have flow through indirections across calls, we'll take flow out
+  // of the indirection and into the argument.
+  // When we get proper flow through indirections across calls, this code can be
+  // moved to `adjusedSink` or possibly into the `DataFlow::ExprNode` class.
+  exists(ReadSideEffectInstruction read |
+    read.getSideEffectOperand() = opFrom and
+    read.getArgumentDef() = instrTo
+  )
+  or
+  // Until we have from through indirections across calls, we'll take flow out
+  // of the parameter and into its indirection.
+  // `InitializeIndirectionInstruction` only has a single operand: the address of the
+  // value whose indirection we are initializing. When initializing an indirection of a parameter `p`,
+  // the IR looks like this:
+  // ```
+  // m1 = InitializeParameter[p] : &r1
+  // r2 = Load[p] : r2, m1
+  // m3 = InitializeIndirection[p] : &r2
+  // ```
+  // So by having flow from `r2` to `m3` we're enabling flow from `m1` to `m3`. This relies on the
+  // `LoadOperand`'s overlap being exact.
+  instrTo.(InitializeIndirectionInstruction).getAnOperand() = opFrom
+  or
+  modeledTaintStep(opFrom, instrTo)
 }
 
 /**
@@ -110,17 +161,19 @@ predicate defaultTaintSanitizer(DataFlow::Node node) { none() }
  * Holds if taint can flow from `instrIn` to `instrOut` through a call to a
  * modeled function.
  */
-predicate modeledTaintStep(DataFlow::Node nodeIn, DataFlow::Node nodeOut) {
+predicate modeledTaintStep(Operand nodeIn, Instruction nodeOut) {
   exists(CallInstruction call, TaintFunction func, FunctionInput modelIn, FunctionOutput modelOut |
     (
       nodeIn = callInput(call, modelIn)
       or
       exists(int n |
-        modelIn.isParameterDeref(n) and
-        nodeIn = callInput(call, any(InParameter inParam | inParam.getIndex() = n))
+        modelIn.isParameterDerefOrQualifierObject(n) and
+        if n = -1
+        then nodeIn = callInput(call, any(InQualifierObject inQualifier))
+        else nodeIn = callInput(call, any(InParameter inParam | inParam.getIndex() = n))
       )
     ) and
-    nodeOut.asInstruction() = callOutput(call, modelOut) and
+    nodeOut = callOutput(call, modelOut) and
     call.getStaticCallTarget() = func and
     func.hasTaintFlow(modelIn, modelOut)
   )
@@ -135,11 +188,29 @@ predicate modeledTaintStep(DataFlow::Node nodeIn, DataFlow::Node nodeOut) {
     int indexMid, InParameter modelMidIn, OutReturnValue modelOut
   |
     nodeIn = callInput(call, modelIn) and
-    nodeOut.asInstruction() = callOutput(call, modelOut) and
+    nodeOut = callOutput(call, modelOut) and
     call.getStaticCallTarget() = func and
     func.(TaintFunction).hasTaintFlow(modelIn, modelMidOut) and
     func.(DataFlowFunction).hasDataFlow(modelMidIn, modelOut) and
     modelMidOut.isParameterDeref(indexMid) and
     modelMidIn.isParameter(indexMid)
   )
+  or
+  // Taint flow from a pointer argument to an output, when the model specifies flow from the deref
+  // to that output, but the deref is not modeled in the IR for the caller.
+  exists(
+    CallInstruction call, ReadSideEffectInstruction read, Function func, FunctionInput modelIn,
+    FunctionOutput modelOut
+  |
+    read.getSideEffectOperand() = callInput(call, modelIn) and
+    read.getArgumentDef() = nodeIn.getDef() and
+    not read.getSideEffect().isResultModeled() and
+    call.getStaticCallTarget() = func and
+    (
+      func.(DataFlowFunction).hasDataFlow(modelIn, modelOut)
+      or
+      func.(TaintFunction).hasTaintFlow(modelIn, modelOut)
+    ) and
+    nodeOut = callOutput(call, modelOut)
+  )
 }
diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/tainttracking3/TaintTrackingImpl.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/tainttracking3/TaintTrackingImpl.qll
new file mode 100644
index 00000000000..b509fad9cd2
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/tainttracking3/TaintTrackingImpl.qll
@@ -0,0 +1,115 @@
+/**
+ * Provides an implementation of global (interprocedural) taint tracking.
+ * This file re-exports the local (intraprocedural) taint-tracking analysis
+ * from `TaintTrackingParameter::Public` and adds a global analysis, mainly
+ * exposed through the `Configuration` class. For some languages, this file
+ * exists in several identical copies, allowing queries to use multiple
+ * `Configuration` classes that depend on each other without introducing
+ * mutual recursion among those configurations.
+ */
+
+import TaintTrackingParameter::Public
+private import TaintTrackingParameter::Private
+
+/**
+ * A configuration of interprocedural taint tracking analysis. This defines
+ * sources, sinks, and any other configurable aspect of the analysis. Each
+ * use of the taint tracking library must define its own unique extension of
+ * this abstract class.
+ *
+ * A taint-tracking configuration is a special data flow configuration
+ * (`DataFlow::Configuration`) that allows for flow through nodes that do not
+ * necessarily preserve values but are still relevant from a taint tracking
+ * perspective. (For example, string concatenation, where one of the operands
+ * is tainted.)
+ *
+ * To create a configuration, extend this class with a subclass whose
+ * characteristic predicate is a unique singleton string. For example, write
+ *
+ * ```ql
+ * class MyAnalysisConfiguration extends TaintTracking::Configuration {
+ *   MyAnalysisConfiguration() { this = "MyAnalysisConfiguration" }
+ *   // Override `isSource` and `isSink`.
+ *   // Optionally override `isSanitizer`.
+ *   // Optionally override `isSanitizerIn`.
+ *   // Optionally override `isSanitizerOut`.
+ *   // Optionally override `isSanitizerGuard`.
+ *   // Optionally override `isAdditionalTaintStep`.
+ * }
+ * ```
+ *
+ * Then, to query whether there is flow between some `source` and `sink`,
+ * write
+ *
+ * ```ql
+ * exists(MyAnalysisConfiguration cfg | cfg.hasFlow(source, sink))
+ * ```
+ *
+ * Multiple configurations can coexist, but it is unsupported to depend on
+ * another `TaintTracking::Configuration` or a `DataFlow::Configuration` in the
+ * overridden predicates that define sources, sinks, or additional steps.
+ * Instead, the dependency should go to a `TaintTracking2::Configuration` or a
+ * `DataFlow2::Configuration`, `DataFlow3::Configuration`, etc.
+ */
+abstract class Configuration extends DataFlow::Configuration {
+  bindingset[this]
+  Configuration() { any() }
+
+  /**
+   * Holds if `source` is a relevant taint source.
+   *
+   * The smaller this predicate is, the faster `hasFlow()` will converge.
+   */
+  // overridden to provide taint-tracking specific qldoc
+  abstract override predicate isSource(DataFlow::Node source);
+
+  /**
+   * Holds if `sink` is a relevant taint sink.
+   *
+   * The smaller this predicate is, the faster `hasFlow()` will converge.
+   */
+  // overridden to provide taint-tracking specific qldoc
+  abstract override predicate isSink(DataFlow::Node sink);
+
+  /** Holds if the node `node` is a taint sanitizer. */
+  predicate isSanitizer(DataFlow::Node node) { none() }
+
+  final override predicate isBarrier(DataFlow::Node node) {
+    isSanitizer(node) or
+    defaultTaintSanitizer(node)
+  }
+
+  /** Holds if taint propagation into `node` is prohibited. */
+  predicate isSanitizerIn(DataFlow::Node node) { none() }
+
+  final override predicate isBarrierIn(DataFlow::Node node) { isSanitizerIn(node) }
+
+  /** Holds if taint propagation out of `node` is prohibited. */
+  predicate isSanitizerOut(DataFlow::Node node) { none() }
+
+  final override predicate isBarrierOut(DataFlow::Node node) { isSanitizerOut(node) }
+
+  /** Holds if taint propagation through nodes guarded by `guard` is prohibited. */
+  predicate isSanitizerGuard(DataFlow::BarrierGuard guard) { none() }
+
+  final override predicate isBarrierGuard(DataFlow::BarrierGuard guard) { isSanitizerGuard(guard) }
+
+  /**
+   * Holds if the additional taint propagation step from `node1` to `node2`
+   * must be taken into account in the analysis.
+   */
+  predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) { none() }
+
+  final override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
+    isAdditionalTaintStep(node1, node2) or
+    defaultAdditionalTaintStep(node1, node2)
+  }
+
+  /**
+   * Holds if taint may flow from `source` to `sink` for this configuration.
+   */
+  // overridden to provide taint-tracking specific qldoc
+  override predicate hasFlow(DataFlow::Node source, DataFlow::Node sink) {
+    super.hasFlow(source, sink)
+  }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/tainttracking3/TaintTrackingParameter.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/tainttracking3/TaintTrackingParameter.qll
new file mode 100644
index 00000000000..2a3b69f55cd
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/tainttracking3/TaintTrackingParameter.qll
@@ -0,0 +1,5 @@
+import semmle.code.cpp.ir.dataflow.internal.TaintTrackingUtil as Public
+
+module Private {
+  import semmle.code.cpp.ir.dataflow.DataFlow3::DataFlow3 as DataFlow
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/SideEffects.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/SideEffects.qll
new file mode 100644
index 00000000000..350127a58d1
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/SideEffects.qll
@@ -0,0 +1,109 @@
+/**
+ * Predicates to compute the modeled side effects of calls during IR construction.
+ *
+ * These are used in `TranslatedElement.qll` to generate the `TTranslatedSideEffect` instances, and
+ * also in `TranslatedCall.qll` to inject the actual side effect instructions.
+ */
+
+private import cpp
+private import semmle.code.cpp.ir.implementation.Opcode
+private import semmle.code.cpp.models.interfaces.SideEffect
+
+/**
+ * Holds if the specified call has a side effect that does not come from a `SideEffectFunction`
+ * model.
+ */
+private predicate hasDefaultSideEffect(Call call, ParameterIndex i, boolean buffer, boolean isWrite) {
+  not call.getTarget() instanceof SideEffectFunction and
+  (
+    exists(MemberFunction mfunc |
+      // A non-static member function, including a constructor or destructor, may write to `*this`,
+      // and may also read from `*this` if it is not a constructor.
+      i = -1 and
+      mfunc = call.getTarget() and
+      not mfunc.isStatic() and
+      buffer = false and
+      (
+        isWrite = false and not mfunc instanceof Constructor
+        or
+        isWrite = true and not mfunc instanceof ConstMemberFunction
+      )
+    )
+    or
+    exists(Expr expr |
+      // A pointer-like argument is assumed to read from the pointed-to buffer, and may write to the
+      // buffer as well unless the pointer points to a `const` value.
+      i >= 0 and
+      buffer = true and
+      expr = call.getArgument(i).getFullyConverted() and
+      exists(Type t | t = expr.getUnspecifiedType() |
+        t instanceof ArrayType or
+        t instanceof PointerType or
+        t instanceof ReferenceType
+      ) and
+      (
+        isWrite = true and
+        not call.getTarget().getParameter(i).getType().isDeeplyConstBelow()
+        or
+        isWrite = false
+      )
+    )
+  )
+}
+
+/**
+ * Returns a side effect opcode for parameter index `i` of the specified call.
+ *
+ * This predicate will return at most two results: one read side effect, and one write side effect.
+ */
+Opcode getASideEffectOpcode(Call call, ParameterIndex i) {
+  exists(boolean buffer |
+    (
+      call.getTarget().(SideEffectFunction).hasSpecificReadSideEffect(i, buffer)
+      or
+      not call.getTarget() instanceof SideEffectFunction and
+      hasDefaultSideEffect(call, i, buffer, false)
+    ) and
+    if exists(call.getTarget().(SideEffectFunction).getParameterSizeIndex(i))
+    then (
+      buffer = true and
+      result instanceof Opcode::SizedBufferReadSideEffect
+    ) else (
+      buffer = false and result instanceof Opcode::IndirectReadSideEffect
+      or
+      buffer = true and result instanceof Opcode::BufferReadSideEffect
+    )
+  )
+  or
+  exists(boolean buffer, boolean mustWrite |
+    (
+      call.getTarget().(SideEffectFunction).hasSpecificWriteSideEffect(i, buffer, mustWrite)
+      or
+      not call.getTarget() instanceof SideEffectFunction and
+      hasDefaultSideEffect(call, i, buffer, true) and
+      mustWrite = false
+    ) and
+    if exists(call.getTarget().(SideEffectFunction).getParameterSizeIndex(i))
+    then (
+      buffer = true and
+      mustWrite = false and
+      result instanceof Opcode::SizedBufferMayWriteSideEffect
+      or
+      buffer = true and
+      mustWrite = true and
+      result instanceof Opcode::SizedBufferMustWriteSideEffect
+    ) else (
+      buffer = false and
+      mustWrite = false and
+      result instanceof Opcode::IndirectMayWriteSideEffect
+      or
+      buffer = false and
+      mustWrite = true and
+      result instanceof Opcode::IndirectMustWriteSideEffect
+      or
+      buffer = true and mustWrite = false and result instanceof Opcode::BufferMayWriteSideEffect
+      or
+      buffer = true and mustWrite = true and result instanceof Opcode::BufferMustWriteSideEffect
+    )
+  )
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll
index 7ad1dd2c01e..56d4c807ac8 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll
@@ -4,6 +4,7 @@ private import semmle.code.cpp.ir.implementation.internal.OperandTag
 private import semmle.code.cpp.ir.internal.CppType
 private import semmle.code.cpp.models.interfaces.SideEffect
 private import InstructionTag
+private import SideEffects
 private import TranslatedElement
 private import TranslatedExpr
 private import TranslatedFunction
@@ -424,12 +425,15 @@ class TranslatedCallSideEffects extends TranslatedSideEffects, TTranslatedCallSi
 }
 
 class TranslatedStructorCallSideEffects extends TranslatedCallSideEffects {
-  TranslatedStructorCallSideEffects() { getParent().(TranslatedStructorCall).hasQualifier() }
+  TranslatedStructorCallSideEffects() {
+    getParent().(TranslatedStructorCall).hasQualifier() and
+    getASideEffectOpcode(expr, -1) instanceof WriteSideEffectOpcode
+  }
 
   override predicate hasInstruction(Opcode opcode, InstructionTag tag, CppType t) {
-    opcode instanceof Opcode::IndirectMayWriteSideEffect and
     tag instanceof OnlyInstructionTag and
-    t = getTypeForPRValue(expr.getTarget().getDeclaringType())
+    t = getTypeForPRValue(expr.getTarget().getDeclaringType()) and
+    opcode = getASideEffectOpcode(expr, -1).(WriteSideEffectOpcode)
   }
 
   override Instruction getInstructionSuccessor(InstructionTag tag, EdgeKind kind) {
@@ -460,9 +464,11 @@ class TranslatedSideEffect extends TranslatedElement, TTranslatedArgumentSideEff
   Call call;
   Expr arg;
   int index;
-  boolean write;
+  SideEffectOpcode sideEffectOpcode;
 
-  TranslatedSideEffect() { this = TTranslatedArgumentSideEffect(call, arg, index, write) }
+  TranslatedSideEffect() {
+    this = TTranslatedArgumentSideEffect(call, arg, index, sideEffectOpcode)
+  }
 
   override Locatable getAST() { result = arg }
 
@@ -472,13 +478,13 @@ class TranslatedSideEffect extends TranslatedElement, TTranslatedArgumentSideEff
 
   int getArgumentIndex() { result = index }
 
-  predicate isWrite() { write = true }
+  predicate isWrite() { sideEffectOpcode instanceof WriteSideEffectOpcode }
 
   override string toString() {
-    write = true and
+    isWrite() and
     result = "(write side effect for " + arg.toString() + ")"
     or
-    write = false and
+    not isWrite() and
     result = "(read side effect for " + arg.toString() + ")"
   }
 
@@ -489,29 +495,29 @@ class TranslatedSideEffect extends TranslatedElement, TTranslatedArgumentSideEff
   override Instruction getFirstInstruction() { result = getInstruction(OnlyInstructionTag()) }
 
   override predicate hasInstruction(Opcode opcode, InstructionTag tag, CppType type) {
-    isWrite() and
-    hasSpecificWriteSideEffect(opcode) and
     tag = OnlyInstructionTag() and
+    opcode = sideEffectOpcode and
     (
-      opcode instanceof BufferAccessOpcode and
-      type = getUnknownType()
-      or
-      not opcode instanceof BufferAccessOpcode and
-      exists(Type baseType | baseType = arg.getUnspecifiedType().(DerivedType).getBaseType() |
-        if baseType instanceof VoidType
-        then type = getUnknownType()
-        else type = getTypeForPRValueOrUnknown(baseType)
+      isWrite() and
+      (
+        opcode instanceof BufferAccessOpcode and
+        type = getUnknownType()
+        or
+        not opcode instanceof BufferAccessOpcode and
+        exists(Type baseType | baseType = arg.getUnspecifiedType().(DerivedType).getBaseType() |
+          if baseType instanceof VoidType
+          then type = getUnknownType()
+          else type = getTypeForPRValueOrUnknown(baseType)
+        )
+        or
+        index = -1 and
+        not arg.getUnspecifiedType() instanceof DerivedType and
+        type = getTypeForPRValueOrUnknown(arg.getUnspecifiedType())
       )
       or
-      index = -1 and
-      not arg.getUnspecifiedType() instanceof DerivedType and
-      type = getTypeForPRValueOrUnknown(arg.getUnspecifiedType())
+      not isWrite() and
+      type = getVoidType()
     )
-    or
-    not isWrite() and
-    hasSpecificReadSideEffect(opcode) and
-    tag = OnlyInstructionTag() and
-    type = getVoidType()
   }
 
   override Instruction getInstructionSuccessor(InstructionTag tag, EdgeKind kind) {
@@ -535,7 +541,7 @@ class TranslatedSideEffect extends TranslatedElement, TTranslatedArgumentSideEff
 
   override CppType getInstructionMemoryOperandType(InstructionTag tag, TypedOperandTag operandTag) {
     not isWrite() and
-    if hasSpecificReadSideEffect(any(BufferAccessOpcode op))
+    if sideEffectOpcode instanceof BufferAccessOpcode
     then
       result = getUnknownType() and
       tag instanceof OnlyInstructionTag and
@@ -557,56 +563,6 @@ class TranslatedSideEffect extends TranslatedElement, TTranslatedArgumentSideEff
       )
   }
 
-  predicate hasSpecificWriteSideEffect(Opcode op) {
-    exists(boolean buffer, boolean mustWrite |
-      if exists(call.getTarget().(SideEffectFunction).getParameterSizeIndex(index))
-      then
-        call.getTarget().(SideEffectFunction).hasSpecificWriteSideEffect(index, true, mustWrite) and
-        buffer = true and
-        (
-          mustWrite = false and op instanceof Opcode::SizedBufferMayWriteSideEffect
-          or
-          mustWrite = true and op instanceof Opcode::SizedBufferMustWriteSideEffect
-        )
-      else (
-        call.getTarget().(SideEffectFunction).hasSpecificWriteSideEffect(index, buffer, mustWrite) and
-        (
-          buffer = true and mustWrite = false and op instanceof Opcode::BufferMayWriteSideEffect
-          or
-          buffer = false and mustWrite = false and op instanceof Opcode::IndirectMayWriteSideEffect
-          or
-          buffer = true and mustWrite = true and op instanceof Opcode::BufferMustWriteSideEffect
-          or
-          buffer = false and mustWrite = true and op instanceof Opcode::IndirectMustWriteSideEffect
-        )
-      )
-    )
-    or
-    not call.getTarget() instanceof SideEffectFunction and
-    getArgumentIndex() != -1 and
-    op instanceof Opcode::BufferMayWriteSideEffect
-    or
-    not call.getTarget() instanceof SideEffectFunction and
-    getArgumentIndex() = -1 and
-    op instanceof Opcode::IndirectMayWriteSideEffect
-  }
-
-  predicate hasSpecificReadSideEffect(Opcode op) {
-    exists(boolean buffer |
-      call.getTarget().(SideEffectFunction).hasSpecificReadSideEffect(index, buffer) and
-      if exists(call.getTarget().(SideEffectFunction).getParameterSizeIndex(index))
-      then buffer = true and op instanceof Opcode::SizedBufferReadSideEffect
-      else (
-        buffer = true and op instanceof Opcode::BufferReadSideEffect
-        or
-        buffer = false and op instanceof Opcode::IndirectReadSideEffect
-      )
-    )
-    or
-    not call.getTarget() instanceof SideEffectFunction and
-    op instanceof Opcode::BufferReadSideEffect
-  }
-
   override Instruction getPrimaryInstructionForSideEffect(InstructionTag tag) {
     tag = OnlyInstructionTag() and
     result = getTranslatedCallInstruction(call)
diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedElement.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedElement.qll
index 1de9936ae1f..eca659914b0 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedElement.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedElement.qll
@@ -12,6 +12,7 @@ private import TranslatedStmt
 private import TranslatedExpr
 private import IRConstruction
 private import semmle.code.cpp.models.interfaces.SideEffect
+private import SideEffects
 
 /**
  * Gets the "real" parent of `expr`. This predicate treats conversions as if
@@ -635,46 +636,15 @@ newtype TTranslatedElement =
   // The side effects of an allocation, i.e. `new`, `new[]` or `malloc`
   TTranslatedAllocationSideEffects(AllocationExpr expr) { not ignoreExpr(expr) } or
   // A precise side effect of an argument to a `Call`
-  TTranslatedArgumentSideEffect(Call call, Expr expr, int n, boolean isWrite) {
-    (
-      expr = call.getArgument(n).getFullyConverted()
-      or
-      expr = call.getQualifier().getFullyConverted() and
-      n = -1 and
-      // Exclude calls to static member functions. They don't modify the qualifier
-      not exists(MemberFunction func | func = call.getTarget() and func.isStatic())
-    ) and
-    (
-      call.getTarget().(SideEffectFunction).hasSpecificReadSideEffect(n, _) and
-      isWrite = false
-      or
-      call.getTarget().(SideEffectFunction).hasSpecificWriteSideEffect(n, _, _) and
-      isWrite = true
-      or
-      not call.getTarget() instanceof SideEffectFunction and
-      exists(Type t | t = expr.getUnspecifiedType() |
-        t instanceof ArrayType or
-        t instanceof PointerType or
-        t instanceof ReferenceType
-      ) and
-      (
-        isWrite = true and
-        not call.getTarget().getParameter(n).getType().isDeeplyConstBelow()
-        or
-        isWrite = false
-      )
-      or
-      not call.getTarget() instanceof SideEffectFunction and
-      n = -1 and
-      (
-        isWrite = true and
-        not call.getTarget() instanceof ConstMemberFunction
-        or
-        isWrite = false
-      )
-    ) and
+  TTranslatedArgumentSideEffect(Call call, Expr expr, int n, SideEffectOpcode opcode) {
     not ignoreExpr(expr) and
-    not ignoreExpr(call)
+    not ignoreExpr(call) and
+    (
+      n >= 0 and expr = call.getArgument(n).getFullyConverted()
+      or
+      n = -1 and expr = call.getQualifier().getFullyConverted()
+    ) and
+    opcode = getASideEffectOpcode(call, n)
   }
 
 /**
diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/Accept.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/Accept.qll
index 150f481de28..cea4598acf3 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/Accept.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/Accept.qll
@@ -15,9 +15,7 @@ import semmle.code.cpp.models.interfaces.SideEffect
 private class Accept extends ArrayFunction, AliasFunction, TaintFunction, SideEffectFunction {
   Accept() { this.hasGlobalName(["accept", "accept4", "WSAAccept"]) }
 
-  override predicate hasArrayWithVariableSize(int bufParam, int countParam) {
-    bufParam = 1 and countParam = 2
-  }
+  override predicate hasArrayWithUnknownSize(int bufParam) { bufParam = 1 }
 
   override predicate hasArrayInput(int bufParam) { bufParam = 1 }
 
@@ -46,8 +44,8 @@ private class Accept extends ArrayFunction, AliasFunction, TaintFunction, SideEf
     i = 1 and buffer = false
   }
 
-  override ParameterIndex getParameterSizeIndex(ParameterIndex i) { i = 1 and result = 2 }
-
+  // NOTE: The size parameter is a pointer to the size. So we can't implement `getParameterSizeIndex` for
+  // this model.
   // NOTE: We implement thse two predicates as none because we can't model the low-level changes made to
   // the structure pointed to by the file-descriptor argument.
   override predicate hasOnlySpecificReadSideEffects() { none() }
diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/SmartPointer.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/SmartPointer.qll
index c6152624792..adef44a1125 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/SmartPointer.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/SmartPointer.qll
@@ -1,10 +1,37 @@
 import semmle.code.cpp.models.interfaces.Taint
+import semmle.code.cpp.models.interfaces.DataFlow
+import semmle.code.cpp.models.interfaces.PointerWrapper
 
 /**
  * The `std::shared_ptr` and `std::unique_ptr` template classes.
  */
-private class UniqueOrSharedPtr extends Class {
+private class UniqueOrSharedPtr extends Class, PointerWrapper {
   UniqueOrSharedPtr() { this.hasQualifiedName(["std", "bsl"], ["shared_ptr", "unique_ptr"]) }
+
+  override MemberFunction getAnUnwrapperFunction() {
+    result.(OverloadedPointerDereferenceFunction).getDeclaringType() = this
+    or
+    result.getClassAndName(["operator->", "get"]) = this
+  }
+
+  override predicate pointsToConst() { this.getTemplateArgument(0).(Type).isConst() }
+}
+
+/** Any function that unwraps a pointer wrapper class to reveal the underlying pointer. */
+private class PointerWrapperFlow extends TaintFunction, DataFlowFunction {
+  PointerWrapperFlow() {
+    this = any(PointerWrapper wrapper).getAnUnwrapperFunction() and
+    not this.getUnspecifiedType() instanceof ReferenceType
+  }
+
+  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+    input.isReturnValueDeref() and
+    output.isQualifierObject()
+  }
+
+  override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
+    input.isQualifierObject() and output.isReturnValue()
+  }
 }
 
 /**
diff --git a/cpp/ql/src/semmle/code/cpp/models/interfaces/PointerWrapper.qll b/cpp/ql/src/semmle/code/cpp/models/interfaces/PointerWrapper.qll
new file mode 100644
index 00000000000..8948aee424b
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/models/interfaces/PointerWrapper.qll
@@ -0,0 +1,17 @@
+/** Provides classes for modeling pointer wrapper types and expressions. */
+
+private import cpp
+
+/** A class that wraps a pointer type. For example, `std::unique_ptr` and `std::shared_ptr`. */
+abstract class PointerWrapper extends Class {
+  /**
+   * Gets a member function of this class that returns the wrapped pointer, if any.
+   *
+   * This includes both functions that return the wrapped pointer by value, and functions
+   * that return a reference to the pointed-to object.
+   */
+  abstract MemberFunction getAnUnwrapperFunction();
+
+  /** Holds if the type of the data that is pointed to by this pointer wrapper is `const`. */
+  abstract predicate pointsToConst();
+}
diff --git a/cpp/ql/src/semmle/code/cpp/security/Overflow.qll b/cpp/ql/src/semmle/code/cpp/security/Overflow.qll
index e7ad1c559e6..465e64b9b6c 100644
--- a/cpp/ql/src/semmle/code/cpp/security/Overflow.qll
+++ b/cpp/ql/src/semmle/code/cpp/security/Overflow.qll
@@ -5,6 +5,8 @@
 
 import cpp
 import semmle.code.cpp.controlflow.Dominance
+import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis
+import semmle.code.cpp.rangeanalysis.RangeAnalysisUtils
 
 /**
  * Holds if the value of `use` is guarded using `abs`.
@@ -94,9 +96,15 @@ predicate guardedGreater(Operation e, Expr use) {
 VariableAccess varUse(LocalScopeVariable v) { result = v.getAnAccess() }
 
 /**
- * Holds if `e` is not guarded against overflow by `use`.
+ * Holds if `e` potentially overflows and `use` is an operand of `e` that is not guarded.
  */
 predicate missingGuardAgainstOverflow(Operation e, VariableAccess use) {
+  (
+    convertedExprMightOverflowPositively(e)
+    or
+    // Ensure that the predicate holds when range analysis cannot determine an upper bound
+    upperBound(e.getFullyConverted()) = exprMaxVal(e.getFullyConverted())
+  ) and
   use = e.getAnOperand() and
   exists(LocalScopeVariable v | use.getTarget() = v |
     // overflow possible if large
@@ -115,9 +123,15 @@ predicate missingGuardAgainstOverflow(Operation e, VariableAccess use) {
 }
 
 /**
- * Holds if `e` is not guarded against underflow by `use`.
+ * Holds if `e` potentially underflows and `use` is an operand of `e` that is not guarded.
  */
 predicate missingGuardAgainstUnderflow(Operation e, VariableAccess use) {
+  (
+    convertedExprMightOverflowNegatively(e)
+    or
+    // Ensure that the predicate holds when range analysis cannot determine a lower bound
+    lowerBound(e.getFullyConverted()) = exprMinVal(e.getFullyConverted())
+  ) and
   use = e.getAnOperand() and
   exists(LocalScopeVariable v | use.getTarget() = v |
     // underflow possible if use is left operand and small
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-570/semmle/tests/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-570/semmle/tests/test.cpp
index e4aa8cf2976..4fc12d9ccbf 100644
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-570/semmle/tests/test.cpp
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-570/semmle/tests/test.cpp
@@ -14,8 +14,8 @@ using namespace std;
 
 void* operator new(std::size_t _Size);
 void* operator new[](std::size_t _Size);
-void* operator new( std::size_t count, const std::nothrow_t& tag );
-void* operator new[]( std::size_t count, const std::nothrow_t& tag );
+void* operator new( std::size_t count, const std::nothrow_t& tag ) noexcept;
+void* operator new[]( std::size_t count, const std::nothrow_t& tag ) noexcept;
 
 void badNew_0_0()
 {
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementWhenUsingBitOperations.expected b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementWhenUsingBitOperations.expected
new file mode 100644
index 00000000000..d11bbd446a6
--- /dev/null
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementWhenUsingBitOperations.expected
@@ -0,0 +1,2 @@
+| test.c:8:6:8:51 | ... & ... | This bitwise operation appears in a context where a Boolean operation is expected. |
+| test.c:10:6:10:30 | ... & ... | This bitwise operation appears in a context where a Boolean operation is expected. |
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementWhenUsingBitOperations.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementWhenUsingBitOperations.qlref
new file mode 100644
index 00000000000..9bf28db3c8a
--- /dev/null
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementWhenUsingBitOperations.qlref
@@ -0,0 +1 @@
+experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.ql
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/test.c b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/test.c
new file mode 100644
index 00000000000..1db60826b60
--- /dev/null
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/test.c
@@ -0,0 +1,28 @@
+int tmpFunction(){
+  return 5;
+}
+void workFunction_0(char *s) {
+  int intSize;
+  char buf[80];
+  if(intSize>0 && intSize<80 && memset(buf,0,intSize)) return; // GOOD
+  if(intSize>0 & intSize<80 & memset(buf,0,intSize)) return; // BAD
+  if(intSize>0 && tmpFunction()) return;
+  if(intSize<0 & tmpFunction()) return; // BAD
+}
+void workFunction_1(char *s) {
+  int intA,intB;
+
+  if(intA + intB) return; // BAD [NOT DETECTED]
+  if(intA + intB>4) return; // GOOD
+  if(intA>0 && (intA + intB)) return; // BAD [NOT DETECTED]
+  while(intA>0)
+  {
+    if(intB - intA<10) break;
+    intA--;
+  }while(intA>0); // BAD [NOT DETECTED]
+  while(intA>0)
+  {
+    if(intB - intA<10) break;
+    intA--;
+  } // GOOD
+}
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/AccessOfMemoryLocationAfterEndOfBufferUsingStrlen.expected b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/AccessOfMemoryLocationAfterEndOfBufferUsingStrlen.expected
index 103afd8ffd9..cd160a70638 100644
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/AccessOfMemoryLocationAfterEndOfBufferUsingStrlen.expected
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/AccessOfMemoryLocationAfterEndOfBufferUsingStrlen.expected
@@ -1,9 +1,9 @@
-| test.c:42:3:42:24 | ... = ... | potential unsafe or redundant assignment. |
-| test.c:43:3:43:40 | ... = ... | potential unsafe or redundant assignment. |
-| test.c:44:3:44:40 | ... = ... | potential unsafe or redundant assignment. |
-| test.c:45:3:45:44 | ... = ... | potential unsafe or redundant assignment. |
-| test.c:46:3:46:44 | ... = ... | potential unsafe or redundant assignment. |
-| test.c:47:3:47:48 | ... = ... | potential unsafe or redundant assignment. |
-| test.c:48:3:48:48 | ... = ... | potential unsafe or redundant assignment. |
-| test.c:49:3:49:50 | ... = ... | potential unsafe or redundant assignment. |
-| test.c:50:3:50:50 | ... = ... | potential unsafe or redundant assignment. |
+| test.c:54:3:54:24 | ... = ... | potential unsafe or redundant assignment. |
+| test.c:55:3:55:40 | ... = ... | potential unsafe or redundant assignment. |
+| test.c:56:3:56:44 | ... = ... | potential unsafe or redundant assignment. |
+| test.c:57:3:57:44 | ... = ... | potential unsafe or redundant assignment. |
+| test.c:58:3:58:48 | ... = ... | potential unsafe or redundant assignment. |
+| test.c:59:3:59:48 | ... = ... | potential unsafe or redundant assignment. |
+| test.c:60:3:60:52 | ... = ... | potential unsafe or redundant assignment. |
+| test.c:61:3:61:50 | ... = ... | potential unsafe or redundant assignment. |
+| test.c:62:3:62:54 | ... = ... | potential unsafe or redundant assignment. |
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.expected b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.expected
index af52dac0144..3e9791e1024 100644
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.expected
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.expected
@@ -1,3 +1,5 @@
-| test.c:4:3:4:9 | call to strncat | if the used buffer is full, writing out of the buffer is possible |
-| test.c:11:3:11:9 | call to strncat | if the used buffer is full, writing out of the buffer is possible |
-| test.c:19:3:19:9 | call to strncat | if the used buffer is full, writing out of the buffer is possible |
+| test.c:8:3:8:9 | call to strncat | Possible out-of-bounds write due to incorrect size argument. |
+| test.c:9:3:9:9 | call to strncat | Possible out-of-bounds write due to incorrect size argument. |
+| test.c:17:3:17:9 | call to strncat | Possible out-of-bounds write due to incorrect size argument. |
+| test.c:18:3:18:9 | call to strncat | Possible out-of-bounds write due to incorrect size argument. |
+| test.c:46:3:46:9 | call to strncat | Possible out-of-bounds write due to incorrect size argument. |
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/OperatorPrecedenceLogicErrorWhenUseBoolType.expected b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/OperatorPrecedenceLogicErrorWhenUseBoolType.expected
new file mode 100644
index 00000000000..1209c7e7830
--- /dev/null
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/OperatorPrecedenceLogicErrorWhenUseBoolType.expected
@@ -0,0 +1,5 @@
+| test.cpp:10:8:10:10 | - ... | this expression needs attention |
+| test.cpp:12:3:12:6 | ... ++ | this expression needs attention |
+| test.cpp:13:3:13:6 | ++ ... | this expression needs attention |
+| test.cpp:14:6:14:21 | ... = ... | this expression needs attention |
+| test.cpp:16:6:16:21 | ... = ... | this expression needs attention |
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/OperatorPrecedenceLogicErrorWhenUseBoolType.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/OperatorPrecedenceLogicErrorWhenUseBoolType.qlref
new file mode 100644
index 00000000000..5189abcce5d
--- /dev/null
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/OperatorPrecedenceLogicErrorWhenUseBoolType.qlref
@@ -0,0 +1 @@
+experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBoolType.ql
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/test.c b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/test.c
index d986bb3b13c..6d310875630 100644
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/test.c
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/test.c
@@ -1,70 +1,84 @@
-void workFunction_0(char *s) {
+char * strncat(char*, const char*, unsigned);
+unsigned strlen(const char*);
+void* malloc(unsigned);
+
+void strncat_test1(char *s) {
   char buf[80];
-  strncat(buf, s, sizeof(buf)-strlen(buf)-1); // GOOD
-  strncat(buf, s, sizeof(buf)-strlen(buf));  // BAD
-  strncat(buf, "fix", sizeof(buf)-strlen(buf)); // BAD [NOT DETECTED] 
+  strncat(buf, s, sizeof(buf) - strlen(buf) - 1); // GOOD
+  strncat(buf, s, sizeof(buf) - strlen(buf));  // BAD
+  strncat(buf, "fix", sizeof(buf)-strlen(buf)); // BAD
 }
-void workFunction_1(char *s) {
+
 #define MAX_SIZE 80
+
+void strncat_test2(char *s) {
   char buf[MAX_SIZE];
-  strncat(buf, s, MAX_SIZE-strlen(buf)-1); // GOOD
-  strncat(buf, s, MAX_SIZE-strlen(buf));  // BAD
-  strncat(buf, "fix", MAX_SIZE-strlen(buf)); // BAD [NOT DETECTED]
+  strncat(buf, s, MAX_SIZE - strlen(buf) - 1); // GOOD
+  strncat(buf, s, MAX_SIZE - strlen(buf));  // BAD
+  strncat(buf, "fix", MAX_SIZE - strlen(buf)); // BAD
 }
-void workFunction_2_0(char *s) {
-  char * buf;
-  int len=80;
-  buf = (char *) malloc(len);
-  strncat(buf, s, len-strlen(buf)-1); // GOOD
-  strncat(buf, s, len-strlen(buf));  // BAD
-  strncat(buf, "fix", len-strlen(buf)); // BAD [NOT DETECTED]
+
+void strncat_test3(char *s) {
+  int len = 80;
+  char* buf = (char *) malloc(len);
+  strncat(buf, s, len - strlen(buf) - 1); // GOOD
+  strncat(buf, s, len - strlen(buf));  // BAD [NOT DETECTED]
+  strncat(buf, "fix", len - strlen(buf)); // BAD [NOT DETECTED]
 }
-void workFunction_2_1(char *s) {
-  char * buf;
-  int len=80;
-  buf = (char *) malloc(len+1);
-  strncat(buf, s, len-strlen(buf)-1); // GOOD
-  strncat(buf, s, len-strlen(buf));  // GOOD
+
+void strncat_test4(char *s) {
+  int len = 80;
+  char* buf = (char *) malloc(len + 1);
+  strncat(buf, s, len - strlen(buf) - 1); // GOOD
+  strncat(buf, s, len - strlen(buf)); // GOOD
 }
 
 struct buffers
 {
-    unsigned char buff1[50];
-    unsigned char *buff2;
+    unsigned char array[50];
+    unsigned char *pointer;
 } globalBuff1,*globalBuff2,globalBuff1_c,*globalBuff2_c;
 
+void strncat_test5(char* s, struct buffers* buffers) {
+  unsigned len_array = strlen(buffers->array);
+  unsigned max_size = sizeof(buffers->array);
+  unsigned free_size = max_size - len_array;
+  strncat(buffers->array, s, free_size); // BAD
+}
 
-void badFunc0(){
+void strlen_test1(){
   unsigned char buff1[12];
   struct buffers buffAll;
   struct buffers * buffAll1;
   
   buff1[strlen(buff1)]=0; // BAD
-  buffAll.buff1[strlen(buffAll.buff1)]=0; // BAD
-  buffAll.buff2[strlen(buffAll.buff2)]=0; // BAD
-  buffAll1->buff1[strlen(buffAll1->buff1)]=0; // BAD
-  buffAll1->buff2[strlen(buffAll1->buff2)]=0; // BAD
-  globalBuff1.buff1[strlen(globalBuff1.buff1)]=0; // BAD
-  globalBuff1.buff2[strlen(globalBuff1.buff2)]=0; // BAD
-  globalBuff2->buff1[strlen(globalBuff2->buff1)]=0; // BAD
-  globalBuff2->buff2[strlen(globalBuff2->buff2)]=0; // BAD
+  buffAll.array[strlen(buffAll.array)]=0; // BAD
+  buffAll.pointer[strlen(buffAll.pointer)]=0; // BAD
+  buffAll1->array[strlen(buffAll1->array)]=0; // BAD
+  buffAll1->pointer[strlen(buffAll1->pointer)]=0; // BAD
+  globalBuff1.array[strlen(globalBuff1.array)]=0; // BAD
+  globalBuff1.pointer[strlen(globalBuff1.pointer)]=0; // BAD
+  globalBuff2->array[strlen(globalBuff2->array)]=0; // BAD
+  globalBuff2->pointer[strlen(globalBuff2->pointer)]=0; // BAD
 }
-void noBadFunc0(){
+
+void strlen_test2(){
   unsigned char buff1[12],buff1_c[12];
   struct buffers buffAll,buffAll_c;
   struct buffers * buffAll1,*buffAll1_c;
   
   buff1[strlen(buff1_c)]=0; // GOOD
-  buffAll.buff1[strlen(buffAll_c.buff1)]=0; // GOOD
-  buffAll.buff2[strlen(buffAll.buff1)]=0; // GOOD
-  buffAll1->buff1[strlen(buffAll1_c->buff1)]=0; // GOOD
-  buffAll1->buff2[strlen(buffAll1->buff1)]=0; // GOOD
-  globalBuff1.buff1[strlen(globalBuff1_c.buff1)]=0; // GOOD
-  globalBuff1.buff2[strlen(globalBuff1.buff1)]=0; // GOOD
-  globalBuff2->buff1[strlen(globalBuff2_c->buff1)]=0; // GOOD
-  globalBuff2->buff2[strlen(globalBuff2->buff1)]=0; // GOOD
+  buffAll.array[strlen(buffAll_c.array)]=0; // GOOD
+  buffAll.pointer[strlen(buffAll.array)]=0; // GOOD
+  buffAll1->array[strlen(buffAll1_c->array)]=0; // GOOD
+  buffAll1->pointer[strlen(buffAll1->array)]=0; // GOOD
+  globalBuff1.array[strlen(globalBuff1_c.array)]=0; // GOOD
+  globalBuff1.pointer[strlen(globalBuff1.array)]=0; // GOOD
+  globalBuff2->array[strlen(globalBuff2_c->array)]=0; // GOOD
+  globalBuff2->pointer[strlen(globalBuff2->array)]=0; // GOOD
 }
-void goodFunc0(){
+
+void strlen_test3(){
   unsigned char buffer[12];
   int i;
   for(i = 0; i < 6; i++)
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/test.cpp
new file mode 100644
index 00000000000..f08d2a45757
--- /dev/null
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/test.cpp
@@ -0,0 +1,26 @@
+int tmpFunc()
+{
+  return 12;
+}
+void testFunction()
+{
+  int i1,i2,i3;
+  bool b1,b2,b3;
+  char c1,c2,c3;
+  b1 = -b2; //BAD
+  b1 = !b2; //GOOD
+  b1++; //BAD
+  ++b1; //BAD
+  if(i1=tmpFunc()!=i2) //BAD
+    return;
+  if(i1=tmpFunc()!=11) //BAD
+    return;
+  if((i1=tmpFunc())!=i2) //GOOD
+    return;
+  if((i1=tmpFunc())!=11) //GOOD
+    return;
+  if(i1=tmpFunc()!=1) //GOOD
+    return;
+  if(i1=tmpFunc()==b1) //GOOD
+    return;
+}
diff --git a/cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/annotate_path_to_sink/tainted.ql b/cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/annotate_path_to_sink/tainted.ql
index 89a7622c49a..27f45cf64ef 100644
--- a/cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/annotate_path_to_sink/tainted.ql
+++ b/cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/annotate_path_to_sink/tainted.ql
@@ -6,6 +6,7 @@
 import cpp
 import semmle.code.cpp.security.TaintTrackingImpl as ASTTaintTracking
 import semmle.code.cpp.ir.dataflow.DefaultTaintTracking as IRDefaultTaintTracking
+import IRDefaultTaintTracking::TaintedWithPath as TaintedWithPath
 import TestUtilities.InlineExpectationsTest
 
 predicate isSink(Element sink) {
@@ -17,7 +18,13 @@ predicate isSink(Element sink) {
 
 predicate astTaint(Expr source, Element sink) { ASTTaintTracking::tainted(source, sink) }
 
-predicate irTaint(Expr source, Element sink) { IRDefaultTaintTracking::tainted(source, sink) }
+class SourceConfiguration extends TaintedWithPath::TaintTrackingConfiguration {
+  override predicate isSink(Element e) { any() }
+}
+
+predicate irTaint(Expr source, Element sink) {
+  TaintedWithPath::taintedWithPath(source, sink, _, _)
+}
 
 class IRDefaultTaintTrackingTest extends InlineExpectationsTest {
   IRDefaultTaintTrackingTest() { this = "IRDefaultTaintTrackingTest" }
diff --git a/cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/annotate_sinks_only/defaulttainttracking.cpp b/cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/annotate_sinks_only/defaulttainttracking.cpp
index 020a2f90b9e..d64f1966b49 100644
--- a/cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/annotate_sinks_only/defaulttainttracking.cpp
+++ b/cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/annotate_sinks_only/defaulttainttracking.cpp
@@ -19,7 +19,7 @@ int main() {
 
   char untainted_buf[100] = "";
   char buf[100] = "VAR = ";
-  sink(strcat(buf, getenv("VAR"))); // $ ast,ir
+  sink(strcat(buf, getenv("VAR"))); // $ ast MISSING: ir
 
   sink(buf); // $ ast,ir
   sink(untainted_buf); // the two buffers would be conflated if we added flow through all partial chi inputs
@@ -250,12 +250,12 @@ void sink(iovec);
 int test_readv_and_writev(iovec* iovs) {
   readv(0, iovs, 16);
   sink(iovs); // $ast,ir
-  sink(iovs[0]); // $ast MISSING: ir
-  sink(*iovs); // $ast MISSING: ir
+  sink(iovs[0]); // $ast,ir
+  sink(*iovs); // $ast,ir
 
   char* p = (char*)iovs[1].iov_base;
-  sink(p); // $ MISSING: ast,ir
-  sink(*p); // $ MISSING: ast,ir
+  sink(p); // $ ir MISSING: ast
+  sink(*p); // $ ir MISSING: ast
 
   writev(0, iovs, 16); // $ remote
 }
diff --git a/cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/annotate_sinks_only/stl.cpp b/cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/annotate_sinks_only/stl.cpp
index e2f5d3b16bd..8a15071ef3c 100644
--- a/cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/annotate_sinks_only/stl.cpp
+++ b/cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/annotate_sinks_only/stl.cpp
@@ -73,7 +73,7 @@ void test_string()
 	sink(b); // clean
 	sink(c); // $ ir MISSING: ast
 	sink(b.c_str()); // clean
-	sink(c.c_str()); // $ MISSING: ast,ir
+	sink(c.c_str()); // $ ir MISSING: ast
 }
 
 void test_stringstream()
@@ -93,10 +93,10 @@ void test_stringstream()
 	sink(ss4); // $ ir MISSING: ast
 	sink(ss5); // $ ir MISSING: ast
 	sink(ss1.str());
-	sink(ss2.str()); // $ MISSING: ast,ir
+	sink(ss2.str()); // $ ir MISSING: ast
 	sink(ss3.str()); // $ MISSING: ast,ir
-	sink(ss4.str()); // $ MISSING: ast,ir
-	sink(ss5.str()); // $ MISSING: ast,ir
+	sink(ss4.str()); // $ ir MISSING: ast
+	sink(ss5.str()); // $ ir MISSING: ast
 }
 
 void test_stringstream_int(int source)
@@ -123,14 +123,14 @@ void sink(const char *filename, const char *mode);
 void test_strings2()
 {
 	string path1 = user_input();
-	sink(path1.c_str(), "r"); // $ MISSING: ast,ir
+	sink(path1.c_str(), "r"); // $ ir MISSING: ast
 
 	string path2;
 	path2 = user_input();
-	sink(path2.c_str(), "r"); // $ MISSING: ast,ir
+	sink(path2.c_str(), "r"); // $ ir MISSING: ast
 
 	string path3(user_input());
-	sink(path3.c_str(), "r"); // $ MISSING: ast,ir
+	sink(path3.c_str(), "r"); // $ ir MISSING: ast
 }
 
 void test_string3()
@@ -154,6 +154,6 @@ void test_string4()
 	// convert back std::string -> char *
 	cs = ss.c_str();
 
-	sink(cs); // $ ast MISSING: ir
+	sink(cs); // $ ast,ir
 	sink(ss); // $ ir MISSING: ast
 }
diff --git a/cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/annotate_sinks_only/tainted.ql b/cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/annotate_sinks_only/tainted.ql
index d6ddf93bf49..5784906862b 100644
--- a/cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/annotate_sinks_only/tainted.ql
+++ b/cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/annotate_sinks_only/tainted.ql
@@ -7,9 +7,10 @@
 import cpp
 import semmle.code.cpp.security.TaintTrackingImpl as ASTTaintTracking
 import semmle.code.cpp.ir.dataflow.DefaultTaintTracking as IRDefaultTaintTracking
+import IRDefaultTaintTracking::TaintedWithPath as TaintedWithPath
 import TestUtilities.InlineExpectationsTest
 
-predicate isSink(Element sink) {
+predicate argToSinkCall(Element sink) {
   exists(FunctionCall call |
     call.getTarget().getName() = "sink" and
     sink = call.getAnArgument()
@@ -17,11 +18,15 @@ predicate isSink(Element sink) {
 }
 
 predicate astTaint(Expr source, Element sink) {
-  ASTTaintTracking::tainted(source, sink) and isSink(sink)
+  ASTTaintTracking::tainted(source, sink) and argToSinkCall(sink)
+}
+
+class SourceConfiguration extends TaintedWithPath::TaintTrackingConfiguration {
+  override predicate isSink(Element e) { argToSinkCall(e) }
 }
 
 predicate irTaint(Expr source, Element sink) {
-  IRDefaultTaintTracking::tainted(source, sink) and isSink(sink)
+  TaintedWithPath::taintedWithPath(source, sink, _, _)
 }
 
 class IRDefaultTaintTrackingTest extends InlineExpectationsTest {
diff --git a/cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-ir-consistency.expected b/cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-ir-consistency.expected
index fc6c97aa2a6..db9a86fbb57 100644
--- a/cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-ir-consistency.expected
+++ b/cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-ir-consistency.expected
@@ -26,6 +26,7 @@ unreachableNodeCCtx
 localCallNodes
 postIsNotPre
 postHasUniquePre
+| test.cpp:373:5:373:20 | Store | PostUpdateNode should have one pre-update node but has 0. |
 uniquePostUpdate
 postIsInSameCallable
 reverseRead
@@ -82,4 +83,5 @@ postWithInFlow
 | test.cpp:125:3:125:11 | Chi | PostUpdateNode should not be the target of local flow. |
 | test.cpp:359:5:359:20 | Chi | PostUpdateNode should not be the target of local flow. |
 | test.cpp:373:5:373:20 | Chi | PostUpdateNode should not be the target of local flow. |
+| test.cpp:373:5:373:20 | Store | PostUpdateNode should not be the target of local flow. |
 | test.cpp:465:3:465:15 | Chi | PostUpdateNode should not be the target of local flow. |
diff --git a/cpp/ql/test/library-tests/dataflow/fields/dataflow-ir-consistency.expected b/cpp/ql/test/library-tests/dataflow/fields/dataflow-ir-consistency.expected
index 63d3b2c0f48..fe7d8360403 100644
--- a/cpp/ql/test/library-tests/dataflow/fields/dataflow-ir-consistency.expected
+++ b/cpp/ql/test/library-tests/dataflow/fields/dataflow-ir-consistency.expected
@@ -20,7 +20,9 @@ unreachableNodeCCtx
 localCallNodes
 postIsNotPre
 postHasUniquePre
+| D.cpp:57:5:57:42 | Store | PostUpdateNode should have one pre-update node but has 0. |
 | simple.cpp:65:5:65:22 | Store | PostUpdateNode should have one pre-update node but has 0. |
+| simple.cpp:83:9:83:28 | Store | PostUpdateNode should have one pre-update node but has 0. |
 | simple.cpp:92:5:92:22 | Store | PostUpdateNode should have one pre-update node but has 0. |
 uniquePostUpdate
 postIsInSameCallable
@@ -54,6 +56,7 @@ postWithInFlow
 | D.cpp:49:15:49:24 | Chi | PostUpdateNode should not be the target of local flow. |
 | D.cpp:56:15:56:24 | Chi | PostUpdateNode should not be the target of local flow. |
 | D.cpp:57:5:57:42 | Chi | PostUpdateNode should not be the target of local flow. |
+| D.cpp:57:5:57:42 | Store | PostUpdateNode should not be the target of local flow. |
 | aliasing.cpp:9:3:9:22 | Chi | PostUpdateNode should not be the target of local flow. |
 | aliasing.cpp:13:3:13:21 | Chi | PostUpdateNode should not be the target of local flow. |
 | aliasing.cpp:17:3:17:21 | Chi | PostUpdateNode should not be the target of local flow. |
@@ -150,6 +153,7 @@ postWithInFlow
 | simple.cpp:23:35:23:35 | Chi | PostUpdateNode should not be the target of local flow. |
 | simple.cpp:65:5:65:22 | Store | PostUpdateNode should not be the target of local flow. |
 | simple.cpp:83:9:83:28 | Chi | PostUpdateNode should not be the target of local flow. |
+| simple.cpp:83:9:83:28 | Store | PostUpdateNode should not be the target of local flow. |
 | simple.cpp:92:5:92:22 | Store | PostUpdateNode should not be the target of local flow. |
 | struct_init.c:20:20:20:29 | Chi | PostUpdateNode should not be the target of local flow. |
 | struct_init.c:20:34:20:34 | Chi | PostUpdateNode should not be the target of local flow. |
diff --git a/cpp/ql/test/library-tests/dataflow/fields/ir-path-flow.expected b/cpp/ql/test/library-tests/dataflow/fields/ir-path-flow.expected
index 37a0dc3832a..e6234ca17f7 100644
--- a/cpp/ql/test/library-tests/dataflow/fields/ir-path-flow.expected
+++ b/cpp/ql/test/library-tests/dataflow/fields/ir-path-flow.expected
@@ -228,8 +228,8 @@ edges
 | simple.cpp:65:5:65:22 | Store [i] | simple.cpp:66:12:66:12 | Store [i] |
 | simple.cpp:65:11:65:20 | call to user_input | simple.cpp:65:5:65:22 | Store [i] |
 | simple.cpp:66:12:66:12 | Store [i] | simple.cpp:67:13:67:13 | i |
-| simple.cpp:83:9:83:28 | Chi [f1] | simple.cpp:84:14:84:20 | this indirection [f1] |
-| simple.cpp:83:17:83:26 | call to user_input | simple.cpp:83:9:83:28 | Chi [f1] |
+| simple.cpp:83:9:83:28 | Store [f1] | simple.cpp:84:14:84:20 | this indirection [f1] |
+| simple.cpp:83:17:83:26 | call to user_input | simple.cpp:83:9:83:28 | Store [f1] |
 | simple.cpp:84:14:84:20 | this indirection [f1] | simple.cpp:84:14:84:20 | call to getf2f1 |
 | simple.cpp:92:5:92:22 | Store [i] | simple.cpp:93:20:93:20 | Store [i] |
 | simple.cpp:92:11:92:20 | call to user_input | simple.cpp:92:5:92:22 | Store [i] |
@@ -494,7 +494,7 @@ nodes
 | simple.cpp:65:11:65:20 | call to user_input | semmle.label | call to user_input |
 | simple.cpp:66:12:66:12 | Store [i] | semmle.label | Store [i] |
 | simple.cpp:67:13:67:13 | i | semmle.label | i |
-| simple.cpp:83:9:83:28 | Chi [f1] | semmle.label | Chi [f1] |
+| simple.cpp:83:9:83:28 | Store [f1] | semmle.label | Store [f1] |
 | simple.cpp:83:17:83:26 | call to user_input | semmle.label | call to user_input |
 | simple.cpp:84:14:84:20 | call to getf2f1 | semmle.label | call to getf2f1 |
 | simple.cpp:84:14:84:20 | this indirection [f1] | semmle.label | this indirection [f1] |
diff --git a/cpp/ql/test/library-tests/dataflow/fields/partial-definition-diff.ql b/cpp/ql/test/library-tests/dataflow/fields/partial-definition-diff.ql
index d8b6b4e0e69..fae4b06da5a 100644
--- a/cpp/ql/test/library-tests/dataflow/fields/partial-definition-diff.ql
+++ b/cpp/ql/test/library-tests/dataflow/fields/partial-definition-diff.ql
@@ -19,15 +19,19 @@ class IRPartialDefNode extends IRNode {
   override string toString() { result = n.asPartialDefinition().toString() }
 }
 
-from Node node, AST::Node astNode, IR::Node irNode, string msg
+from Node node, string msg
 where
-  node.asIR() = irNode and
-  exists(irNode.asPartialDefinition()) and
-  not exists(AST::Node otherNode | otherNode.asPartialDefinition() = irNode.asPartialDefinition()) and
+  exists(IR::Node irNode, Expr partial |
+    node.asIR() = irNode and
+    partial = irNode.asPartialDefinition() and
+    not exists(AST::Node otherNode | otherNode.asPartialDefinition() = partial)
+  ) and
   msg = "IR only"
   or
-  node.asAST() = astNode and
-  exists(astNode.asPartialDefinition()) and
-  not exists(IR::Node otherNode | otherNode.asPartialDefinition() = astNode.asPartialDefinition()) and
+  exists(AST::Node astNode, Expr partial |
+    node.asAST() = astNode and
+    partial = astNode.asPartialDefinition() and
+    not exists(IR::Node otherNode | otherNode.asPartialDefinition() = partial)
+  ) and
   msg = "AST only"
 select node, msg
diff --git a/cpp/ql/test/library-tests/dataflow/security-taint/tainted_diff.expected b/cpp/ql/test/library-tests/dataflow/security-taint/tainted_diff.expected
index 26441b08ba4..2b1b021716b 100644
--- a/cpp/ql/test/library-tests/dataflow/security-taint/tainted_diff.expected
+++ b/cpp/ql/test/library-tests/dataflow/security-taint/tainted_diff.expected
@@ -1,19 +1,42 @@
+| test.cpp:23:23:23:28 | call to getenv | test.cpp:8:24:8:25 | s1 | AST only |
+| test.cpp:23:23:23:28 | call to getenv | test.cpp:23:14:23:19 | envStr | AST only |
+| test.cpp:38:23:38:28 | call to getenv | test.cpp:8:24:8:25 | s1 | AST only |
+| test.cpp:38:23:38:28 | call to getenv | test.cpp:38:14:38:19 | envStr | AST only |
+| test.cpp:49:23:49:28 | call to getenv | test.cpp:8:24:8:25 | s1 | AST only |
+| test.cpp:49:23:49:28 | call to getenv | test.cpp:45:13:45:24 | envStrGlobal | AST only |
+| test.cpp:49:23:49:28 | call to getenv | test.cpp:49:14:49:19 | envStr | AST only |
 | test.cpp:49:23:49:28 | call to getenv | test.cpp:50:15:50:24 | envStr_ptr | AST only |
 | test.cpp:49:23:49:28 | call to getenv | test.cpp:50:28:50:40 | & ... | AST only |
 | test.cpp:49:23:49:28 | call to getenv | test.cpp:50:29:50:40 | envStrGlobal | AST only |
 | test.cpp:49:23:49:28 | call to getenv | test.cpp:52:2:52:12 | * ... | AST only |
 | test.cpp:49:23:49:28 | call to getenv | test.cpp:52:3:52:12 | envStr_ptr | AST only |
+| test.cpp:60:29:60:34 | call to getenv | test.cpp:10:27:10:27 | s | AST only |
+| test.cpp:60:29:60:34 | call to getenv | test.cpp:60:18:60:25 | userName | AST only |
 | test.cpp:68:28:68:33 | call to getenv | test.cpp:11:20:11:21 | s1 | AST only |
+| test.cpp:68:28:68:33 | call to getenv | test.cpp:11:36:11:37 | s2 | AST only |
 | test.cpp:68:28:68:33 | call to getenv | test.cpp:67:7:67:13 | copying | AST only |
+| test.cpp:68:28:68:33 | call to getenv | test.cpp:68:17:68:24 | userName | AST only |
 | test.cpp:68:28:68:33 | call to getenv | test.cpp:69:10:69:13 | copy | AST only |
+| test.cpp:68:28:68:33 | call to getenv | test.cpp:70:5:70:10 | call to strcpy | AST only |
 | test.cpp:68:28:68:33 | call to getenv | test.cpp:70:12:70:15 | copy | AST only |
 | test.cpp:68:28:68:33 | call to getenv | test.cpp:71:12:71:15 | copy | AST only |
+| test.cpp:75:20:75:25 | call to getenv | test.cpp:15:22:15:25 | nptr | AST only |
+| test.cpp:83:28:83:33 | call to getenv | test.cpp:8:24:8:25 | s1 | AST only |
 | test.cpp:83:28:83:33 | call to getenv | test.cpp:11:20:11:21 | s1 | AST only |
+| test.cpp:83:28:83:33 | call to getenv | test.cpp:11:36:11:37 | s2 | AST only |
+| test.cpp:83:28:83:33 | call to getenv | test.cpp:83:17:83:24 | userName | AST only |
 | test.cpp:83:28:83:33 | call to getenv | test.cpp:85:8:85:11 | copy | AST only |
+| test.cpp:83:28:83:33 | call to getenv | test.cpp:86:2:86:7 | call to strcpy | AST only |
 | test.cpp:83:28:83:33 | call to getenv | test.cpp:86:9:86:12 | copy | AST only |
+| test.cpp:100:12:100:15 | call to gets | test.cpp:98:8:98:14 | pointer | AST only |
 | test.cpp:100:12:100:15 | call to gets | test.cpp:100:2:100:8 | pointer | AST only |
+| test.cpp:100:17:100:22 | buffer | test.cpp:93:18:93:18 | s | AST only |
 | test.cpp:100:17:100:22 | buffer | test.cpp:97:7:97:12 | buffer | AST only |
 | test.cpp:100:17:100:22 | buffer | test.cpp:100:17:100:22 | array to pointer conversion | IR only |
+| test.cpp:106:28:106:33 | call to getenv | test.cpp:8:24:8:25 | s1 | AST only |
 | test.cpp:106:28:106:33 | call to getenv | test.cpp:11:20:11:21 | s1 | AST only |
+| test.cpp:106:28:106:33 | call to getenv | test.cpp:11:36:11:37 | s2 | AST only |
+| test.cpp:106:28:106:33 | call to getenv | test.cpp:106:17:106:24 | userName | AST only |
 | test.cpp:106:28:106:33 | call to getenv | test.cpp:108:8:108:11 | copy | AST only |
+| test.cpp:106:28:106:33 | call to getenv | test.cpp:109:2:109:7 | call to strcpy | AST only |
 | test.cpp:106:28:106:33 | call to getenv | test.cpp:109:9:109:12 | copy | AST only |
diff --git a/cpp/ql/test/library-tests/dataflow/security-taint/tainted_diff.ql b/cpp/ql/test/library-tests/dataflow/security-taint/tainted_diff.ql
index 13a1b7b6f3f..37bd9f5437d 100644
--- a/cpp/ql/test/library-tests/dataflow/security-taint/tainted_diff.ql
+++ b/cpp/ql/test/library-tests/dataflow/security-taint/tainted_diff.ql
@@ -2,14 +2,18 @@ import semmle.code.cpp.security.TaintTrackingImpl as AST
 import semmle.code.cpp.ir.dataflow.DefaultTaintTracking as IR
 import cpp
 
+class SourceConfiguration extends IR::TaintedWithPath::TaintTrackingConfiguration {
+  override predicate isSink(Element e) { any() }
+}
+
 from Expr source, Element tainted, string side
 where
   AST::taintedIncludingGlobalVars(source, tainted, _) and
-  not IR::taintedIncludingGlobalVars(source, tainted, _) and
+  not IR::TaintedWithPath::taintedWithPath(source, tainted, _, _) and
   not tainted.getLocation().getFile().getExtension() = "h" and
   side = "AST only"
   or
-  IR::taintedIncludingGlobalVars(source, tainted, _) and
+  IR::TaintedWithPath::taintedWithPath(source, tainted, _, _) and
   not AST::taintedIncludingGlobalVars(source, tainted, _) and
   not tainted.getLocation().getFile().getExtension() = "h" and
   side = "IR only"
diff --git a/cpp/ql/test/library-tests/dataflow/security-taint/tainted_ir.expected b/cpp/ql/test/library-tests/dataflow/security-taint/tainted_ir.expected
index 50c90bccb2b..fb19ea7fc9f 100644
--- a/cpp/ql/test/library-tests/dataflow/security-taint/tainted_ir.expected
+++ b/cpp/ql/test/library-tests/dataflow/security-taint/tainted_ir.expected
@@ -1,71 +1,48 @@
-| test.cpp:23:23:23:28 | call to getenv | test.cpp:8:24:8:25 | s1 |  |
-| test.cpp:23:23:23:28 | call to getenv | test.cpp:23:14:23:19 | envStr |  |
-| test.cpp:23:23:23:28 | call to getenv | test.cpp:23:23:23:28 | call to getenv |  |
-| test.cpp:23:23:23:28 | call to getenv | test.cpp:23:23:23:40 | (const char *)... |  |
-| test.cpp:23:23:23:28 | call to getenv | test.cpp:25:6:25:29 | ! ... |  |
-| test.cpp:23:23:23:28 | call to getenv | test.cpp:25:7:25:12 | call to strcmp |  |
-| test.cpp:23:23:23:28 | call to getenv | test.cpp:25:7:25:29 | (bool)... |  |
-| test.cpp:23:23:23:28 | call to getenv | test.cpp:25:14:25:19 | envStr |  |
-| test.cpp:23:23:23:28 | call to getenv | test.cpp:29:6:29:28 | ! ... |  |
-| test.cpp:23:23:23:28 | call to getenv | test.cpp:29:7:29:12 | call to strcmp |  |
-| test.cpp:23:23:23:28 | call to getenv | test.cpp:29:7:29:28 | (bool)... |  |
-| test.cpp:23:23:23:28 | call to getenv | test.cpp:29:14:29:19 | envStr |  |
-| test.cpp:38:23:38:28 | call to getenv | test.cpp:8:24:8:25 | s1 |  |
-| test.cpp:38:23:38:28 | call to getenv | test.cpp:38:14:38:19 | envStr |  |
-| test.cpp:38:23:38:28 | call to getenv | test.cpp:38:23:38:28 | call to getenv |  |
-| test.cpp:38:23:38:28 | call to getenv | test.cpp:38:23:38:40 | (const char *)... |  |
-| test.cpp:38:23:38:28 | call to getenv | test.cpp:40:14:40:19 | envStr |  |
-| test.cpp:49:23:49:28 | call to getenv | test.cpp:8:24:8:25 | s1 |  |
-| test.cpp:49:23:49:28 | call to getenv | test.cpp:45:13:45:24 | envStrGlobal |  |
-| test.cpp:49:23:49:28 | call to getenv | test.cpp:49:14:49:19 | envStr |  |
-| test.cpp:49:23:49:28 | call to getenv | test.cpp:49:23:49:28 | call to getenv |  |
-| test.cpp:49:23:49:28 | call to getenv | test.cpp:49:23:49:40 | (const char *)... |  |
-| test.cpp:49:23:49:28 | call to getenv | test.cpp:52:16:52:21 | envStr |  |
-| test.cpp:49:23:49:28 | call to getenv | test.cpp:54:6:54:35 | ! ... |  |
-| test.cpp:49:23:49:28 | call to getenv | test.cpp:54:7:54:12 | call to strcmp |  |
-| test.cpp:49:23:49:28 | call to getenv | test.cpp:54:7:54:35 | (bool)... |  |
-| test.cpp:49:23:49:28 | call to getenv | test.cpp:54:14:54:25 | envStrGlobal |  |
-| test.cpp:60:29:60:34 | call to getenv | test.cpp:10:27:10:27 | s |  |
-| test.cpp:60:29:60:34 | call to getenv | test.cpp:60:18:60:25 | userName |  |
-| test.cpp:60:29:60:34 | call to getenv | test.cpp:60:29:60:34 | call to getenv |  |
-| test.cpp:60:29:60:34 | call to getenv | test.cpp:60:29:60:47 | (const char *)... |  |
-| test.cpp:60:29:60:34 | call to getenv | test.cpp:64:25:64:32 | userName |  |
-| test.cpp:68:28:68:33 | call to getenv | test.cpp:11:36:11:37 | s2 |  |
-| test.cpp:68:28:68:33 | call to getenv | test.cpp:68:17:68:24 | userName |  |
-| test.cpp:68:28:68:33 | call to getenv | test.cpp:68:28:68:33 | call to getenv |  |
-| test.cpp:68:28:68:33 | call to getenv | test.cpp:68:28:68:46 | (const char *)... |  |
-| test.cpp:68:28:68:33 | call to getenv | test.cpp:70:5:70:10 | call to strcpy |  |
-| test.cpp:68:28:68:33 | call to getenv | test.cpp:70:18:70:25 | userName |  |
-| test.cpp:75:20:75:25 | call to getenv | test.cpp:15:22:15:25 | nptr |  |
-| test.cpp:75:20:75:25 | call to getenv | test.cpp:75:15:75:18 | call to atoi |  |
-| test.cpp:75:20:75:25 | call to getenv | test.cpp:75:20:75:25 | call to getenv |  |
-| test.cpp:75:20:75:25 | call to getenv | test.cpp:75:20:75:45 | (const char *)... |  |
-| test.cpp:83:28:83:33 | call to getenv | test.cpp:8:24:8:25 | s1 |  |
-| test.cpp:83:28:83:33 | call to getenv | test.cpp:11:36:11:37 | s2 |  |
-| test.cpp:83:28:83:33 | call to getenv | test.cpp:83:17:83:24 | userName |  |
-| test.cpp:83:28:83:33 | call to getenv | test.cpp:83:28:83:33 | call to getenv |  |
-| test.cpp:83:28:83:33 | call to getenv | test.cpp:83:28:83:46 | (const char *)... |  |
-| test.cpp:83:28:83:33 | call to getenv | test.cpp:86:2:86:7 | call to strcpy |  |
-| test.cpp:83:28:83:33 | call to getenv | test.cpp:86:15:86:22 | userName |  |
-| test.cpp:83:28:83:33 | call to getenv | test.cpp:88:6:88:27 | ! ... |  |
-| test.cpp:83:28:83:33 | call to getenv | test.cpp:88:7:88:12 | call to strcmp |  |
-| test.cpp:83:28:83:33 | call to getenv | test.cpp:88:7:88:27 | (bool)... |  |
-| test.cpp:83:28:83:33 | call to getenv | test.cpp:88:14:88:17 | (const char *)... |  |
-| test.cpp:83:28:83:33 | call to getenv | test.cpp:88:14:88:17 | copy |  |
-| test.cpp:100:12:100:15 | call to gets | test.cpp:98:8:98:14 | pointer |  |
-| test.cpp:100:12:100:15 | call to gets | test.cpp:100:12:100:15 | call to gets |  |
-| test.cpp:100:17:100:22 | buffer | test.cpp:93:18:93:18 | s |  |
-| test.cpp:100:17:100:22 | buffer | test.cpp:100:17:100:22 | array to pointer conversion |  |
-| test.cpp:100:17:100:22 | buffer | test.cpp:100:17:100:22 | buffer |  |
-| test.cpp:106:28:106:33 | call to getenv | test.cpp:8:24:8:25 | s1 |  |
-| test.cpp:106:28:106:33 | call to getenv | test.cpp:11:36:11:37 | s2 |  |
-| test.cpp:106:28:106:33 | call to getenv | test.cpp:106:17:106:24 | userName |  |
-| test.cpp:106:28:106:33 | call to getenv | test.cpp:106:28:106:33 | call to getenv |  |
-| test.cpp:106:28:106:33 | call to getenv | test.cpp:106:28:106:46 | (const char *)... |  |
-| test.cpp:106:28:106:33 | call to getenv | test.cpp:109:2:109:7 | call to strcpy |  |
-| test.cpp:106:28:106:33 | call to getenv | test.cpp:109:15:109:22 | userName |  |
-| test.cpp:106:28:106:33 | call to getenv | test.cpp:111:6:111:27 | ! ... |  |
-| test.cpp:106:28:106:33 | call to getenv | test.cpp:111:7:111:12 | call to strcmp |  |
-| test.cpp:106:28:106:33 | call to getenv | test.cpp:111:7:111:27 | (bool)... |  |
-| test.cpp:106:28:106:33 | call to getenv | test.cpp:111:14:111:17 | (const char *)... |  |
-| test.cpp:106:28:106:33 | call to getenv | test.cpp:111:14:111:17 | copy |  |
+| test.cpp:23:23:23:28 | call to getenv | test.cpp:23:23:23:28 | call to getenv |
+| test.cpp:23:23:23:28 | call to getenv | test.cpp:23:23:23:40 | (const char *)... |
+| test.cpp:23:23:23:28 | call to getenv | test.cpp:25:6:25:29 | ! ... |
+| test.cpp:23:23:23:28 | call to getenv | test.cpp:25:7:25:12 | call to strcmp |
+| test.cpp:23:23:23:28 | call to getenv | test.cpp:25:7:25:29 | (bool)... |
+| test.cpp:23:23:23:28 | call to getenv | test.cpp:25:14:25:19 | envStr |
+| test.cpp:23:23:23:28 | call to getenv | test.cpp:29:6:29:28 | ! ... |
+| test.cpp:23:23:23:28 | call to getenv | test.cpp:29:7:29:12 | call to strcmp |
+| test.cpp:23:23:23:28 | call to getenv | test.cpp:29:7:29:28 | (bool)... |
+| test.cpp:23:23:23:28 | call to getenv | test.cpp:29:14:29:19 | envStr |
+| test.cpp:38:23:38:28 | call to getenv | test.cpp:38:23:38:28 | call to getenv |
+| test.cpp:38:23:38:28 | call to getenv | test.cpp:38:23:38:40 | (const char *)... |
+| test.cpp:38:23:38:28 | call to getenv | test.cpp:40:14:40:19 | envStr |
+| test.cpp:49:23:49:28 | call to getenv | test.cpp:49:23:49:28 | call to getenv |
+| test.cpp:49:23:49:28 | call to getenv | test.cpp:49:23:49:40 | (const char *)... |
+| test.cpp:49:23:49:28 | call to getenv | test.cpp:52:16:52:21 | envStr |
+| test.cpp:49:23:49:28 | call to getenv | test.cpp:54:6:54:35 | ! ... |
+| test.cpp:49:23:49:28 | call to getenv | test.cpp:54:7:54:12 | call to strcmp |
+| test.cpp:49:23:49:28 | call to getenv | test.cpp:54:7:54:35 | (bool)... |
+| test.cpp:49:23:49:28 | call to getenv | test.cpp:54:14:54:25 | envStrGlobal |
+| test.cpp:60:29:60:34 | call to getenv | test.cpp:60:29:60:34 | call to getenv |
+| test.cpp:60:29:60:34 | call to getenv | test.cpp:60:29:60:47 | (const char *)... |
+| test.cpp:60:29:60:34 | call to getenv | test.cpp:64:25:64:32 | userName |
+| test.cpp:68:28:68:33 | call to getenv | test.cpp:68:28:68:33 | call to getenv |
+| test.cpp:68:28:68:33 | call to getenv | test.cpp:68:28:68:46 | (const char *)... |
+| test.cpp:68:28:68:33 | call to getenv | test.cpp:70:18:70:25 | userName |
+| test.cpp:75:20:75:25 | call to getenv | test.cpp:75:15:75:18 | call to atoi |
+| test.cpp:75:20:75:25 | call to getenv | test.cpp:75:20:75:25 | call to getenv |
+| test.cpp:75:20:75:25 | call to getenv | test.cpp:75:20:75:45 | (const char *)... |
+| test.cpp:83:28:83:33 | call to getenv | test.cpp:83:28:83:33 | call to getenv |
+| test.cpp:83:28:83:33 | call to getenv | test.cpp:83:28:83:46 | (const char *)... |
+| test.cpp:83:28:83:33 | call to getenv | test.cpp:86:15:86:22 | userName |
+| test.cpp:83:28:83:33 | call to getenv | test.cpp:88:6:88:27 | ! ... |
+| test.cpp:83:28:83:33 | call to getenv | test.cpp:88:7:88:12 | call to strcmp |
+| test.cpp:83:28:83:33 | call to getenv | test.cpp:88:7:88:27 | (bool)... |
+| test.cpp:83:28:83:33 | call to getenv | test.cpp:88:14:88:17 | (const char *)... |
+| test.cpp:83:28:83:33 | call to getenv | test.cpp:88:14:88:17 | copy |
+| test.cpp:100:12:100:15 | call to gets | test.cpp:100:12:100:15 | call to gets |
+| test.cpp:100:17:100:22 | buffer | test.cpp:100:17:100:22 | array to pointer conversion |
+| test.cpp:100:17:100:22 | buffer | test.cpp:100:17:100:22 | buffer |
+| test.cpp:106:28:106:33 | call to getenv | test.cpp:106:28:106:33 | call to getenv |
+| test.cpp:106:28:106:33 | call to getenv | test.cpp:106:28:106:46 | (const char *)... |
+| test.cpp:106:28:106:33 | call to getenv | test.cpp:109:15:109:22 | userName |
+| test.cpp:106:28:106:33 | call to getenv | test.cpp:111:6:111:27 | ! ... |
+| test.cpp:106:28:106:33 | call to getenv | test.cpp:111:7:111:12 | call to strcmp |
+| test.cpp:106:28:106:33 | call to getenv | test.cpp:111:7:111:27 | (bool)... |
+| test.cpp:106:28:106:33 | call to getenv | test.cpp:111:14:111:17 | (const char *)... |
+| test.cpp:106:28:106:33 | call to getenv | test.cpp:111:14:111:17 | copy |
diff --git a/cpp/ql/test/library-tests/dataflow/security-taint/tainted_ir.ql b/cpp/ql/test/library-tests/dataflow/security-taint/tainted_ir.ql
index 6d8effe7ffe..2a07e444cf9 100644
--- a/cpp/ql/test/library-tests/dataflow/security-taint/tainted_ir.ql
+++ b/cpp/ql/test/library-tests/dataflow/security-taint/tainted_ir.ql
@@ -1,7 +1,11 @@
 import semmle.code.cpp.ir.dataflow.DefaultTaintTracking
 
-from Expr source, Element tainted, string globalVar
+class SourceConfiguration extends TaintedWithPath::TaintTrackingConfiguration {
+  override predicate isSink(Element e) { any() }
+}
+
+from Expr source, Element tainted
 where
-  taintedIncludingGlobalVars(source, tainted, globalVar) and
+  TaintedWithPath::taintedWithPath(source, tainted, _, _) and
   not tainted.getLocation().getFile().getExtension() = "h"
-select source, tainted, globalVar
+select source, tainted
diff --git a/cpp/ql/test/library-tests/dataflow/smart-pointers-taint/memory.h b/cpp/ql/test/library-tests/dataflow/smart-pointers-taint/memory.h
new file mode 100644
index 00000000000..79f39b831c6
--- /dev/null
+++ b/cpp/ql/test/library-tests/dataflow/smart-pointers-taint/memory.h
@@ -0,0 +1,127 @@
+
+namespace std {
+  namespace detail {
+    template<typename T>
+    class compressed_pair_element {
+      T element;
+
+    public:
+      compressed_pair_element() = default;
+      compressed_pair_element(const T& t) : element(t) {}
+      
+      T& get() { return element; }
+
+      const T& get() const { return element; }
+    };
+
+    template<typename T, typename U>
+    struct compressed_pair : private compressed_pair_element<T>, private compressed_pair_element<U> {
+      compressed_pair() = default;
+      compressed_pair(T& t) : compressed_pair_element<T>(t), compressed_pair_element<U>() {}
+      compressed_pair(const compressed_pair&) = delete;
+      compressed_pair(compressed_pair<T, U>&&) noexcept = default;
+
+      T& first() { return static_cast<compressed_pair_element<T>&>(*this).get(); }
+      U& second() { return static_cast<compressed_pair_element<U>&>(*this).get(); }
+
+      const T& first() const { return static_cast<const compressed_pair_element<T>&>(*this).get(); }
+      const U& second() const { return static_cast<const compressed_pair_element<U>&>(*this).get(); }
+    };
+  }
+
+  template<class T>
+  struct default_delete {
+    void operator()(T* ptr) const { delete ptr; }
+  };
+
+  template<class T>
+  struct default_delete<T[]> {
+    template<class U>
+    void operator()(U* ptr) const { delete[] ptr; }
+  };
+
+  template<class T, class Deleter = default_delete<T> >
+  class unique_ptr {
+  private:
+    detail::compressed_pair<T*, Deleter> data;
+  public:
+    constexpr unique_ptr() noexcept {}
+    explicit unique_ptr(T* ptr) noexcept : data(ptr) {}
+    unique_ptr(const unique_ptr& ptr) = delete;
+    unique_ptr(unique_ptr&& ptr) noexcept = default;
+
+    unique_ptr& operator=(unique_ptr&& ptr) noexcept = default;
+
+    T& operator*() const { return *get(); }
+    T* operator->() const noexcept { return get(); }
+
+    T* get() const noexcept { return data.first(); }
+
+    ~unique_ptr() {
+      Deleter& d = data.second();
+      d(data.first());
+    }
+  };
+  
+  template<typename T, class... Args> unique_ptr<T> make_unique(Args&&... args) {
+    return unique_ptr<T>(new T(args...)); // std::forward calls elided for simplicity.
+  }
+
+  class ctrl_block {
+    unsigned uses;
+
+  public:
+    ctrl_block() : uses(1) {}
+
+    void inc() { ++uses; }
+    bool dec() { return --uses == 0; }
+
+    virtual void destroy() = 0;
+    virtual ~ctrl_block() {}
+  };
+
+  template<typename T, class Deleter = default_delete<T> >
+  struct ctrl_block_impl: public ctrl_block {
+    T* ptr;
+    Deleter d;
+
+    ctrl_block_impl(T* ptr, Deleter d) : ptr(ptr), d(d) {}
+    virtual void destroy() override { d(ptr); }
+  };
+
+  template<class T>
+  class shared_ptr {
+  private:
+    ctrl_block* ctrl;
+    T* ptr;
+
+    void dec() {
+      if(ctrl->dec()) {
+        ctrl->destroy();
+        delete ctrl;
+      }
+    }
+
+    void inc() {
+      ctrl->inc();
+    }
+
+  public:
+    constexpr shared_ptr() noexcept = default;
+    shared_ptr(T* ptr) : ctrl(new ctrl_block_impl<T>(ptr, default_delete<T>())) {}
+    shared_ptr(const shared_ptr& s) noexcept : ptr(s.ptr), ctrl(s.ctrl) {
+      inc();
+    }
+    shared_ptr(shared_ptr&& s) noexcept = default;
+
+    T* operator->() const { return ptr; }
+
+    T& operator*() const { return *ptr; }
+
+    ~shared_ptr() { dec(); }
+  };
+
+  template<typename T, class... Args> shared_ptr<T> make_shared(Args&&... args) {
+    return shared_ptr<T>(new T(args...)); // std::forward calls elided for simplicity.
+  }
+}
\ No newline at end of file
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-937/Program.cs b/cpp/ql/test/library-tests/dataflow/smart-pointers-taint/taint.expected
similarity index 100%
rename from csharp/ql/test/query-tests/Security Features/CWE-937/Program.cs
rename to cpp/ql/test/library-tests/dataflow/smart-pointers-taint/taint.expected
diff --git a/cpp/ql/test/library-tests/dataflow/smart-pointers-taint/taint.ql b/cpp/ql/test/library-tests/dataflow/smart-pointers-taint/taint.ql
new file mode 100644
index 00000000000..4f18139b2af
--- /dev/null
+++ b/cpp/ql/test/library-tests/dataflow/smart-pointers-taint/taint.ql
@@ -0,0 +1,39 @@
+import TestUtilities.dataflow.FlowTestCommon
+
+module ASTTest {
+  private import semmle.code.cpp.dataflow.TaintTracking
+
+  class ASTSmartPointerTaintConfig extends TaintTracking::Configuration {
+    ASTSmartPointerTaintConfig() { this = "ASTSmartPointerTaintConfig" }
+
+    override predicate isSource(DataFlow::Node source) {
+      source.asExpr().(FunctionCall).getTarget().getName() = "source"
+    }
+
+    override predicate isSink(DataFlow::Node sink) {
+      exists(FunctionCall call |
+        call.getTarget().getName() = "sink" and
+        sink.asExpr() = call.getAnArgument()
+      )
+    }
+  }
+}
+
+module IRTest {
+  private import semmle.code.cpp.ir.dataflow.TaintTracking
+
+  class IRSmartPointerTaintConfig extends TaintTracking::Configuration {
+    IRSmartPointerTaintConfig() { this = "IRSmartPointerTaintConfig" }
+
+    override predicate isSource(DataFlow::Node source) {
+      source.asExpr().(FunctionCall).getTarget().getName() = "source"
+    }
+
+    override predicate isSink(DataFlow::Node sink) {
+      exists(FunctionCall call |
+        call.getTarget().getName() = "sink" and
+        sink.asExpr() = call.getAnArgument()
+      )
+    }
+  }
+}
diff --git a/cpp/ql/test/library-tests/dataflow/smart-pointers-taint/test.cpp b/cpp/ql/test/library-tests/dataflow/smart-pointers-taint/test.cpp
new file mode 100644
index 00000000000..0dbbd7a2384
--- /dev/null
+++ b/cpp/ql/test/library-tests/dataflow/smart-pointers-taint/test.cpp
@@ -0,0 +1,46 @@
+#include "memory.h"
+
+int source();
+void sink(int);
+
+void test_unique_ptr_int() {
+	std::unique_ptr<int> p1(new int(source()));
+	std::unique_ptr<int> p2 = std::make_unique<int>(source());
+	
+	sink(*p1); // $ MISSING: ast,ir
+	sink(*p2); // $ ast ir=8:50
+}
+
+struct A {
+	int x, y;
+
+	A(int x, int y) : x(x), y(y) {}
+};
+
+void test_unique_ptr_struct() {
+	std::unique_ptr<A> p1(new A{source(), 0});
+	std::unique_ptr<A> p2 = std::make_unique<A>(source(), 0);
+	
+	sink(p1->x); // $ MISSING: ast,ir
+	sink(p1->y);
+	sink(p2->x); // $ MISSING: ast,ir
+	sink(p2->y);
+}
+
+void test_shared_ptr_int() {
+	std::shared_ptr<int> p1(new int(source()));
+	std::shared_ptr<int> p2 = std::make_shared<int>(source());
+	
+	sink(*p1); // $ ast
+	sink(*p2); // $ ast ir=32:50 
+}
+
+void test_shared_ptr_struct() {
+	std::shared_ptr<A> p1(new A{source(), 0});
+	std::shared_ptr<A> p2 = std::make_shared<A>(source(), 0);
+	
+	sink(p1->x); // $ MISSING: ast,ir
+	sink(p1->y);
+	sink(p2->x); // $ MISSING: ast,ir
+	sink(p2->y);
+}
\ No newline at end of file
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/bsd.cpp b/cpp/ql/test/library-tests/dataflow/taint-tests/bsd.cpp
index 4846420a5a5..fe138a8d8fc 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/bsd.cpp
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/bsd.cpp
@@ -19,6 +19,6 @@ void test_accept() {
   int size = sizeof(sockaddr);
   int a = accept(s, &addr, &size);
 
-  sink(a); // $ ast=17:11 SPURIOUS: ast=18:12 MISSING: ir
-  sink(addr); // $ ast MISSING: ir
+  sink(a); // $ ast=17:11 ir SPURIOUS: ast=18:12
+  sink(addr); // $ ast,ir
 }
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
index 4444ea13267..b003dc5a12b 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
@@ -3223,52 +3223,224 @@
 | smart_pointer.cpp:11:30:11:50 | call to make_shared | smart_pointer.cpp:12:11:12:11 | p |  |
 | smart_pointer.cpp:11:30:11:50 | call to make_shared | smart_pointer.cpp:13:10:13:10 | p |  |
 | smart_pointer.cpp:11:52:11:57 | call to source | smart_pointer.cpp:11:30:11:50 | call to make_shared | TAINT |
-| smart_pointer.cpp:12:11:12:11 | p | smart_pointer.cpp:12:10:12:10 | call to operator* | TAINT |
+| smart_pointer.cpp:12:11:12:11 | p | smart_pointer.cpp:12:10:12:10 | call to operator* |  |
 | smart_pointer.cpp:12:11:12:11 | ref arg p | smart_pointer.cpp:13:10:13:10 | p |  |
 | smart_pointer.cpp:17:32:17:54 | call to make_shared | smart_pointer.cpp:18:11:18:11 | p |  |
 | smart_pointer.cpp:17:32:17:54 | call to make_shared | smart_pointer.cpp:19:10:19:10 | p |  |
+| smart_pointer.cpp:18:10:18:10 | ref arg call to operator* | smart_pointer.cpp:18:11:18:11 | p [inner post update] |  |
+| smart_pointer.cpp:18:10:18:10 | ref arg call to operator* | smart_pointer.cpp:19:10:19:10 | p |  |
 | smart_pointer.cpp:18:11:18:11 | p | smart_pointer.cpp:18:10:18:10 | call to operator* | TAINT |
+| smart_pointer.cpp:18:11:18:11 | ref arg p | smart_pointer.cpp:18:11:18:11 | p [inner post update] |  |
 | smart_pointer.cpp:18:11:18:11 | ref arg p | smart_pointer.cpp:19:10:19:10 | p |  |
 | smart_pointer.cpp:23:30:23:50 | call to make_unique | smart_pointer.cpp:24:11:24:11 | p |  |
 | smart_pointer.cpp:23:30:23:50 | call to make_unique | smart_pointer.cpp:25:10:25:10 | p |  |
 | smart_pointer.cpp:23:52:23:57 | call to source | smart_pointer.cpp:23:30:23:50 | call to make_unique | TAINT |
-| smart_pointer.cpp:24:11:24:11 | p | smart_pointer.cpp:24:10:24:10 | call to operator* | TAINT |
+| smart_pointer.cpp:24:11:24:11 | p | smart_pointer.cpp:24:10:24:10 | call to operator* |  |
 | smart_pointer.cpp:24:11:24:11 | ref arg p | smart_pointer.cpp:25:10:25:10 | p |  |
 | smart_pointer.cpp:29:32:29:54 | call to make_unique | smart_pointer.cpp:30:11:30:11 | p |  |
 | smart_pointer.cpp:29:32:29:54 | call to make_unique | smart_pointer.cpp:31:10:31:10 | p |  |
+| smart_pointer.cpp:30:10:30:10 | ref arg call to operator* | smart_pointer.cpp:30:11:30:11 | p [inner post update] |  |
+| smart_pointer.cpp:30:10:30:10 | ref arg call to operator* | smart_pointer.cpp:31:10:31:10 | p |  |
 | smart_pointer.cpp:30:11:30:11 | p | smart_pointer.cpp:30:10:30:10 | call to operator* | TAINT |
+| smart_pointer.cpp:30:11:30:11 | ref arg p | smart_pointer.cpp:30:11:30:11 | p [inner post update] |  |
 | smart_pointer.cpp:30:11:30:11 | ref arg p | smart_pointer.cpp:31:10:31:10 | p |  |
 | smart_pointer.cpp:35:30:35:50 | call to make_shared | smart_pointer.cpp:37:6:37:6 | p |  |
 | smart_pointer.cpp:35:30:35:50 | call to make_shared | smart_pointer.cpp:38:10:38:10 | p |  |
 | smart_pointer.cpp:35:30:35:50 | call to make_shared | smart_pointer.cpp:39:11:39:11 | p |  |
+| smart_pointer.cpp:37:5:37:5 | call to operator* [post update] | smart_pointer.cpp:37:6:37:6 | p [inner post update] |  |
+| smart_pointer.cpp:37:5:37:5 | call to operator* [post update] | smart_pointer.cpp:38:10:38:10 | p |  |
+| smart_pointer.cpp:37:5:37:5 | call to operator* [post update] | smart_pointer.cpp:39:11:39:11 | p |  |
 | smart_pointer.cpp:37:5:37:17 | ... = ... | smart_pointer.cpp:37:5:37:5 | call to operator* [post update] |  |
-| smart_pointer.cpp:37:6:37:6 | p | smart_pointer.cpp:37:5:37:5 | call to operator* | TAINT |
+| smart_pointer.cpp:37:6:37:6 | p | smart_pointer.cpp:37:5:37:5 | call to operator* |  |
+| smart_pointer.cpp:37:6:37:6 | ref arg p | smart_pointer.cpp:37:6:37:6 | p [inner post update] |  |
 | smart_pointer.cpp:37:6:37:6 | ref arg p | smart_pointer.cpp:38:10:38:10 | p |  |
 | smart_pointer.cpp:37:6:37:6 | ref arg p | smart_pointer.cpp:39:11:39:11 | p |  |
 | smart_pointer.cpp:37:10:37:15 | call to source | smart_pointer.cpp:37:5:37:17 | ... = ... |  |
 | smart_pointer.cpp:38:10:38:10 | ref arg p | smart_pointer.cpp:39:11:39:11 | p |  |
-| smart_pointer.cpp:39:11:39:11 | p | smart_pointer.cpp:39:10:39:10 | call to operator* | TAINT |
+| smart_pointer.cpp:39:11:39:11 | p | smart_pointer.cpp:39:10:39:10 | call to operator* |  |
 | smart_pointer.cpp:43:29:43:51 | call to unique_ptr | smart_pointer.cpp:45:6:45:6 | p |  |
 | smart_pointer.cpp:43:29:43:51 | call to unique_ptr | smart_pointer.cpp:46:10:46:10 | p |  |
 | smart_pointer.cpp:43:29:43:51 | call to unique_ptr | smart_pointer.cpp:47:11:47:11 | p |  |
+| smart_pointer.cpp:45:5:45:5 | call to operator* [post update] | smart_pointer.cpp:45:6:45:6 | p [inner post update] |  |
+| smart_pointer.cpp:45:5:45:5 | call to operator* [post update] | smart_pointer.cpp:46:10:46:10 | p |  |
+| smart_pointer.cpp:45:5:45:5 | call to operator* [post update] | smart_pointer.cpp:47:11:47:11 | p |  |
 | smart_pointer.cpp:45:5:45:17 | ... = ... | smart_pointer.cpp:45:5:45:5 | call to operator* [post update] |  |
-| smart_pointer.cpp:45:6:45:6 | p | smart_pointer.cpp:45:5:45:5 | call to operator* | TAINT |
+| smart_pointer.cpp:45:6:45:6 | p | smart_pointer.cpp:45:5:45:5 | call to operator* |  |
+| smart_pointer.cpp:45:6:45:6 | ref arg p | smart_pointer.cpp:45:6:45:6 | p [inner post update] |  |
 | smart_pointer.cpp:45:6:45:6 | ref arg p | smart_pointer.cpp:46:10:46:10 | p |  |
 | smart_pointer.cpp:45:6:45:6 | ref arg p | smart_pointer.cpp:47:11:47:11 | p |  |
 | smart_pointer.cpp:45:10:45:15 | call to source | smart_pointer.cpp:45:5:45:17 | ... = ... |  |
 | smart_pointer.cpp:46:10:46:10 | ref arg p | smart_pointer.cpp:47:11:47:11 | p |  |
-| smart_pointer.cpp:47:11:47:11 | p | smart_pointer.cpp:47:10:47:10 | call to operator* | TAINT |
+| smart_pointer.cpp:47:11:47:11 | p | smart_pointer.cpp:47:10:47:10 | call to operator* |  |
 | smart_pointer.cpp:51:30:51:50 | call to make_shared | smart_pointer.cpp:52:10:52:10 | p |  |
 | smart_pointer.cpp:51:52:51:57 | call to source | smart_pointer.cpp:51:30:51:50 | call to make_shared | TAINT |
-| smart_pointer.cpp:52:10:52:10 | p | smart_pointer.cpp:52:12:52:14 | call to get | TAINT |
+| smart_pointer.cpp:52:10:52:10 | p | smart_pointer.cpp:52:12:52:14 | call to get |  |
+| smart_pointer.cpp:52:12:52:14 | ref arg call to get | smart_pointer.cpp:52:10:52:10 | ref arg p | TAINT |
 | smart_pointer.cpp:56:30:56:50 | call to make_unique | smart_pointer.cpp:57:10:57:10 | p |  |
 | smart_pointer.cpp:56:52:56:57 | call to source | smart_pointer.cpp:56:30:56:50 | call to make_unique | TAINT |
-| smart_pointer.cpp:57:10:57:10 | p | smart_pointer.cpp:57:12:57:14 | call to get | TAINT |
+| smart_pointer.cpp:57:10:57:10 | p | smart_pointer.cpp:57:12:57:14 | call to get |  |
+| smart_pointer.cpp:57:12:57:14 | ref arg call to get | smart_pointer.cpp:57:10:57:10 | ref arg p | TAINT |
 | smart_pointer.cpp:65:28:65:46 | call to make_unique | smart_pointer.cpp:66:10:66:10 | p |  |
 | smart_pointer.cpp:65:28:65:46 | call to make_unique | smart_pointer.cpp:67:10:67:10 | p |  |
 | smart_pointer.cpp:65:48:65:53 | call to source | smart_pointer.cpp:65:28:65:46 | call to make_unique | TAINT |
 | smart_pointer.cpp:65:58:65:58 | 0 | smart_pointer.cpp:65:28:65:46 | call to make_unique | TAINT |
+| smart_pointer.cpp:66:10:66:10 | p | smart_pointer.cpp:66:11:66:11 | call to operator-> |  |
 | smart_pointer.cpp:66:10:66:10 | ref arg p | smart_pointer.cpp:67:10:67:10 | p |  |
+| smart_pointer.cpp:67:10:67:10 | p | smart_pointer.cpp:67:11:67:11 | call to operator-> |  |
+| smart_pointer.cpp:70:37:70:39 | ptr | smart_pointer.cpp:70:37:70:39 | ptr |  |
+| smart_pointer.cpp:70:37:70:39 | ptr | smart_pointer.cpp:71:4:71:6 | ptr |  |
+| smart_pointer.cpp:71:3:71:3 | call to operator* [post update] | smart_pointer.cpp:70:37:70:39 | ptr |  |
+| smart_pointer.cpp:71:3:71:3 | call to operator* [post update] | smart_pointer.cpp:71:4:71:6 | ptr [inner post update] |  |
+| smart_pointer.cpp:71:3:71:17 | ... = ... | smart_pointer.cpp:71:3:71:3 | call to operator* [post update] |  |
+| smart_pointer.cpp:71:4:71:6 | ptr | smart_pointer.cpp:71:3:71:3 | call to operator* |  |
+| smart_pointer.cpp:71:4:71:6 | ref arg ptr | smart_pointer.cpp:70:37:70:39 | ptr |  |
+| smart_pointer.cpp:71:4:71:6 | ref arg ptr | smart_pointer.cpp:71:4:71:6 | ptr [inner post update] |  |
+| smart_pointer.cpp:71:10:71:15 | call to source | smart_pointer.cpp:71:3:71:17 | ... = ... |  |
+| smart_pointer.cpp:75:26:75:33 | call to shared_ptr | smart_pointer.cpp:76:13:76:13 | p |  |
+| smart_pointer.cpp:75:26:75:33 | call to shared_ptr | smart_pointer.cpp:77:9:77:9 | p |  |
+| smart_pointer.cpp:76:13:76:13 | p | smart_pointer.cpp:76:13:76:13 | call to shared_ptr |  |
+| smart_pointer.cpp:76:13:76:13 | ref arg call to shared_ptr | smart_pointer.cpp:76:13:76:13 | p [inner post update] |  |
+| smart_pointer.cpp:76:13:76:13 | ref arg call to shared_ptr | smart_pointer.cpp:77:9:77:9 | p |  |
+| smart_pointer.cpp:76:13:76:13 | ref arg p | smart_pointer.cpp:76:13:76:13 | p [inner post update] |  |
+| smart_pointer.cpp:76:13:76:13 | ref arg p | smart_pointer.cpp:77:9:77:9 | p |  |
+| smart_pointer.cpp:77:9:77:9 | p | smart_pointer.cpp:77:8:77:8 | call to operator* |  |
+| smart_pointer.cpp:86:45:86:45 | p | smart_pointer.cpp:86:45:86:45 | p |  |
+| smart_pointer.cpp:86:45:86:45 | p | smart_pointer.cpp:87:3:87:3 | p |  |
+| smart_pointer.cpp:86:45:86:45 | p | smart_pointer.cpp:88:8:88:8 | p |  |
+| smart_pointer.cpp:86:45:86:45 | p | smart_pointer.cpp:89:8:89:8 | p |  |
+| smart_pointer.cpp:86:67:86:67 | q | smart_pointer.cpp:86:67:86:67 | q |  |
+| smart_pointer.cpp:86:67:86:67 | q | smart_pointer.cpp:91:3:91:3 | q |  |
+| smart_pointer.cpp:86:67:86:67 | q | smart_pointer.cpp:92:8:92:8 | q |  |
+| smart_pointer.cpp:86:67:86:67 | q | smart_pointer.cpp:93:8:93:8 | q |  |
+| smart_pointer.cpp:86:67:86:67 | q | smart_pointer.cpp:94:8:94:8 | q |  |
+| smart_pointer.cpp:87:3:87:3 | p | smart_pointer.cpp:87:4:87:4 | call to operator-> |  |
+| smart_pointer.cpp:87:3:87:3 | ref arg p | smart_pointer.cpp:86:45:86:45 | p |  |
+| smart_pointer.cpp:87:3:87:3 | ref arg p | smart_pointer.cpp:88:8:88:8 | p |  |
+| smart_pointer.cpp:87:3:87:3 | ref arg p | smart_pointer.cpp:89:8:89:8 | p |  |
+| smart_pointer.cpp:87:3:87:17 | ... = ... | smart_pointer.cpp:87:6:87:6 | x [post update] |  |
+| smart_pointer.cpp:87:3:87:17 | ... = ... | smart_pointer.cpp:88:11:88:11 | x |  |
+| smart_pointer.cpp:87:4:87:4 | call to operator-> [post update] | smart_pointer.cpp:87:3:87:3 | ref arg p | TAINT |
+| smart_pointer.cpp:87:10:87:15 | call to source | smart_pointer.cpp:87:3:87:17 | ... = ... |  |
+| smart_pointer.cpp:88:8:88:8 | p | smart_pointer.cpp:88:9:88:9 | call to operator-> |  |
+| smart_pointer.cpp:88:8:88:8 | ref arg p | smart_pointer.cpp:86:45:86:45 | p |  |
+| smart_pointer.cpp:88:8:88:8 | ref arg p | smart_pointer.cpp:89:8:89:8 | p |  |
+| smart_pointer.cpp:89:8:89:8 | p | smart_pointer.cpp:89:9:89:9 | call to operator-> |  |
+| smart_pointer.cpp:89:8:89:8 | ref arg p | smart_pointer.cpp:86:45:86:45 | p |  |
+| smart_pointer.cpp:91:3:91:3 | q | smart_pointer.cpp:91:4:91:4 | call to operator-> |  |
+| smart_pointer.cpp:91:3:91:3 | ref arg q | smart_pointer.cpp:86:67:86:67 | q |  |
+| smart_pointer.cpp:91:3:91:3 | ref arg q | smart_pointer.cpp:92:8:92:8 | q |  |
+| smart_pointer.cpp:91:3:91:3 | ref arg q | smart_pointer.cpp:93:8:93:8 | q |  |
+| smart_pointer.cpp:91:3:91:3 | ref arg q | smart_pointer.cpp:94:8:94:8 | q |  |
+| smart_pointer.cpp:91:3:91:20 | ... = ... | smart_pointer.cpp:91:9:91:9 | x [post update] |  |
+| smart_pointer.cpp:91:3:91:20 | ... = ... | smart_pointer.cpp:92:14:92:14 | x |  |
+| smart_pointer.cpp:91:4:91:4 | call to operator-> [post update] | smart_pointer.cpp:91:3:91:3 | ref arg q | TAINT |
+| smart_pointer.cpp:91:13:91:18 | call to source | smart_pointer.cpp:91:3:91:20 | ... = ... |  |
+| smart_pointer.cpp:92:8:92:8 | q | smart_pointer.cpp:92:9:92:9 | call to operator-> |  |
+| smart_pointer.cpp:92:8:92:8 | ref arg q | smart_pointer.cpp:86:67:86:67 | q |  |
+| smart_pointer.cpp:92:8:92:8 | ref arg q | smart_pointer.cpp:93:8:93:8 | q |  |
+| smart_pointer.cpp:92:8:92:8 | ref arg q | smart_pointer.cpp:94:8:94:8 | q |  |
+| smart_pointer.cpp:93:8:93:8 | q | smart_pointer.cpp:93:9:93:9 | call to operator-> |  |
+| smart_pointer.cpp:93:8:93:8 | ref arg q | smart_pointer.cpp:86:67:86:67 | q |  |
+| smart_pointer.cpp:93:8:93:8 | ref arg q | smart_pointer.cpp:94:8:94:8 | q |  |
+| smart_pointer.cpp:94:8:94:8 | q | smart_pointer.cpp:94:9:94:9 | call to operator-> |  |
+| smart_pointer.cpp:94:8:94:8 | ref arg q | smart_pointer.cpp:86:67:86:67 | q |  |
+| smart_pointer.cpp:97:17:97:18 | pa | smart_pointer.cpp:98:5:98:6 | pa |  |
+| smart_pointer.cpp:98:5:98:20 | ... = ... | smart_pointer.cpp:98:9:98:9 | x [post update] |  |
+| smart_pointer.cpp:98:13:98:18 | call to source | smart_pointer.cpp:98:5:98:20 | ... = ... |  |
+| smart_pointer.cpp:102:25:102:50 | call to unique_ptr | smart_pointer.cpp:103:11:103:11 | p |  |
+| smart_pointer.cpp:102:25:102:50 | call to unique_ptr | smart_pointer.cpp:104:8:104:8 | p |  |
+| smart_pointer.cpp:103:11:103:11 | p | smart_pointer.cpp:103:13:103:15 | call to get |  |
+| smart_pointer.cpp:103:11:103:11 | ref arg p | smart_pointer.cpp:104:8:104:8 | p |  |
+| smart_pointer.cpp:103:13:103:15 | ref arg call to get | smart_pointer.cpp:103:11:103:11 | ref arg p | TAINT |
+| smart_pointer.cpp:104:8:104:8 | p | smart_pointer.cpp:104:9:104:9 | call to operator-> |  |
+| smart_pointer.cpp:112:40:112:42 | ptr | smart_pointer.cpp:112:40:112:42 | ptr |  |
+| smart_pointer.cpp:112:40:112:42 | ptr | smart_pointer.cpp:113:2:113:4 | ptr |  |
+| smart_pointer.cpp:113:2:113:4 | ptr | smart_pointer.cpp:113:5:113:5 | call to operator-> |  |
+| smart_pointer.cpp:113:2:113:4 | ref arg ptr | smart_pointer.cpp:112:40:112:42 | ptr |  |
+| smart_pointer.cpp:113:2:113:18 | ... = ... | smart_pointer.cpp:113:7:113:7 | x [post update] |  |
+| smart_pointer.cpp:113:5:113:5 | call to operator-> [post update] | smart_pointer.cpp:113:2:113:4 | ref arg ptr | TAINT |
+| smart_pointer.cpp:113:11:113:16 | call to source | smart_pointer.cpp:113:2:113:18 | ... = ... |  |
+| smart_pointer.cpp:116:52:116:54 | ptr | smart_pointer.cpp:116:52:116:54 | ptr |  |
+| smart_pointer.cpp:116:52:116:54 | ptr | smart_pointer.cpp:117:2:117:4 | ptr |  |
+| smart_pointer.cpp:117:2:117:4 | ptr | smart_pointer.cpp:117:5:117:5 | call to operator-> |  |
+| smart_pointer.cpp:117:2:117:4 | ref arg ptr | smart_pointer.cpp:116:52:116:54 | ptr |  |
+| smart_pointer.cpp:117:2:117:18 | ... = ... | smart_pointer.cpp:117:7:117:7 | x [post update] |  |
+| smart_pointer.cpp:117:5:117:5 | call to operator-> [post update] | smart_pointer.cpp:117:2:117:4 | ref arg ptr | TAINT |
+| smart_pointer.cpp:117:11:117:16 | call to source | smart_pointer.cpp:117:2:117:18 | ... = ... |  |
+| smart_pointer.cpp:120:48:120:50 | ptr | smart_pointer.cpp:120:48:120:50 | ptr |  |
+| smart_pointer.cpp:120:48:120:50 | ptr | smart_pointer.cpp:121:4:121:6 | ptr |  |
+| smart_pointer.cpp:121:3:121:3 | call to operator* [post update] | smart_pointer.cpp:120:48:120:50 | ptr |  |
+| smart_pointer.cpp:121:3:121:3 | call to operator* [post update] | smart_pointer.cpp:121:4:121:6 | ptr [inner post update] |  |
+| smart_pointer.cpp:121:3:121:17 | ... = ... | smart_pointer.cpp:121:3:121:3 | call to operator* [post update] |  |
+| smart_pointer.cpp:121:4:121:6 | ptr | smart_pointer.cpp:121:3:121:3 | call to operator* |  |
+| smart_pointer.cpp:121:4:121:6 | ref arg ptr | smart_pointer.cpp:120:48:120:50 | ptr |  |
+| smart_pointer.cpp:121:4:121:6 | ref arg ptr | smart_pointer.cpp:121:4:121:6 | ptr [inner post update] |  |
+| smart_pointer.cpp:121:10:121:15 | call to source | smart_pointer.cpp:121:3:121:17 | ... = ... |  |
+| smart_pointer.cpp:124:48:124:49 | p1 | smart_pointer.cpp:124:48:124:49 | p1 |  |
+| smart_pointer.cpp:124:48:124:49 | p1 | smart_pointer.cpp:125:18:125:19 | p1 |  |
+| smart_pointer.cpp:124:48:124:49 | p1 | smart_pointer.cpp:126:8:126:9 | p1 |  |
+| smart_pointer.cpp:124:90:124:91 | p2 | smart_pointer.cpp:124:90:124:91 | p2 |  |
+| smart_pointer.cpp:124:90:124:91 | p2 | smart_pointer.cpp:128:14:128:15 | p2 |  |
+| smart_pointer.cpp:124:90:124:91 | p2 | smart_pointer.cpp:129:10:129:11 | p2 |  |
+| smart_pointer.cpp:125:18:125:19 | p1 | smart_pointer.cpp:125:20:125:20 | call to operator-> |  |
+| smart_pointer.cpp:125:18:125:19 | ref arg p1 | smart_pointer.cpp:124:48:124:49 | p1 |  |
+| smart_pointer.cpp:125:18:125:19 | ref arg p1 | smart_pointer.cpp:126:8:126:9 | p1 |  |
+| smart_pointer.cpp:125:18:125:22 | ref arg call to shared_ptr | smart_pointer.cpp:125:22:125:22 | q [inner post update] |  |
+| smart_pointer.cpp:125:20:125:20 | call to operator-> [post update] | smart_pointer.cpp:125:18:125:19 | ref arg p1 | TAINT |
+| smart_pointer.cpp:125:22:125:22 | q | smart_pointer.cpp:125:18:125:22 | call to shared_ptr |  |
+| smart_pointer.cpp:125:22:125:22 | ref arg q | smart_pointer.cpp:125:22:125:22 | q [inner post update] |  |
+| smart_pointer.cpp:126:8:126:9 | p1 | smart_pointer.cpp:126:10:126:10 | call to operator-> |  |
+| smart_pointer.cpp:126:8:126:9 | ref arg p1 | smart_pointer.cpp:124:48:124:49 | p1 |  |
+| smart_pointer.cpp:126:10:126:10 | call to operator-> [post update] | smart_pointer.cpp:126:8:126:9 | ref arg p1 | TAINT |
+| smart_pointer.cpp:126:12:126:12 | q | smart_pointer.cpp:126:13:126:13 | call to operator-> |  |
+| smart_pointer.cpp:128:13:128:13 | call to operator* | smart_pointer.cpp:128:13:128:15 | call to shared_ptr | TAINT |
+| smart_pointer.cpp:128:13:128:13 | ref arg call to operator* | smart_pointer.cpp:124:90:124:91 | p2 |  |
+| smart_pointer.cpp:128:13:128:13 | ref arg call to operator* | smart_pointer.cpp:128:13:128:13 | call to operator* [inner post update] |  |
+| smart_pointer.cpp:128:13:128:13 | ref arg call to operator* | smart_pointer.cpp:128:14:128:15 | p2 [inner post update] |  |
+| smart_pointer.cpp:128:13:128:13 | ref arg call to operator* | smart_pointer.cpp:129:10:129:11 | p2 |  |
+| smart_pointer.cpp:128:13:128:15 | ref arg call to shared_ptr | smart_pointer.cpp:124:90:124:91 | p2 |  |
+| smart_pointer.cpp:128:13:128:15 | ref arg call to shared_ptr | smart_pointer.cpp:128:13:128:13 | call to operator* [inner post update] |  |
+| smart_pointer.cpp:128:13:128:15 | ref arg call to shared_ptr | smart_pointer.cpp:128:14:128:15 | p2 [inner post update] |  |
+| smart_pointer.cpp:128:13:128:15 | ref arg call to shared_ptr | smart_pointer.cpp:129:10:129:11 | p2 |  |
+| smart_pointer.cpp:128:14:128:15 | p2 | smart_pointer.cpp:128:13:128:13 | call to operator* | TAINT |
+| smart_pointer.cpp:128:14:128:15 | ref arg p2 | smart_pointer.cpp:124:90:124:91 | p2 |  |
+| smart_pointer.cpp:128:14:128:15 | ref arg p2 | smart_pointer.cpp:128:14:128:15 | p2 [inner post update] |  |
+| smart_pointer.cpp:128:14:128:15 | ref arg p2 | smart_pointer.cpp:129:10:129:11 | p2 |  |
+| smart_pointer.cpp:129:9:129:9 | call to operator* | smart_pointer.cpp:129:8:129:8 | call to operator* | TAINT |
+| smart_pointer.cpp:129:9:129:9 | ref arg call to operator* | smart_pointer.cpp:124:90:124:91 | p2 |  |
+| smart_pointer.cpp:129:9:129:9 | ref arg call to operator* | smart_pointer.cpp:129:10:129:11 | p2 [inner post update] |  |
+| smart_pointer.cpp:129:10:129:11 | p2 | smart_pointer.cpp:129:8:129:8 | call to operator* |  |
+| smart_pointer.cpp:129:10:129:11 | p2 | smart_pointer.cpp:129:9:129:9 | call to operator* | TAINT |
+| smart_pointer.cpp:129:10:129:11 | ref arg p2 | smart_pointer.cpp:124:90:124:91 | p2 |  |
+| smart_pointer.cpp:129:10:129:11 | ref arg p2 | smart_pointer.cpp:129:10:129:11 | p2 [inner post update] |  |
+| smart_pointer.cpp:132:53:132:54 | p1 | smart_pointer.cpp:132:53:132:54 | p1 |  |
+| smart_pointer.cpp:132:53:132:54 | p1 | smart_pointer.cpp:133:23:133:24 | p1 |  |
+| smart_pointer.cpp:132:53:132:54 | p1 | smart_pointer.cpp:134:8:134:9 | p1 |  |
+| smart_pointer.cpp:132:95:132:96 | p2 | smart_pointer.cpp:132:95:132:96 | p2 |  |
+| smart_pointer.cpp:132:95:132:96 | p2 | smart_pointer.cpp:136:18:136:19 | p2 |  |
+| smart_pointer.cpp:132:95:132:96 | p2 | smart_pointer.cpp:137:10:137:11 | p2 |  |
+| smart_pointer.cpp:133:23:133:24 | p1 | smart_pointer.cpp:133:25:133:25 | call to operator-> |  |
+| smart_pointer.cpp:133:23:133:24 | ref arg p1 | smart_pointer.cpp:132:53:132:54 | p1 |  |
+| smart_pointer.cpp:133:23:133:24 | ref arg p1 | smart_pointer.cpp:134:8:134:9 | p1 |  |
+| smart_pointer.cpp:133:25:133:25 | call to operator-> [post update] | smart_pointer.cpp:133:23:133:24 | ref arg p1 | TAINT |
+| smart_pointer.cpp:134:8:134:9 | p1 | smart_pointer.cpp:134:10:134:10 | call to operator-> |  |
+| smart_pointer.cpp:134:8:134:9 | ref arg p1 | smart_pointer.cpp:132:53:132:54 | p1 |  |
+| smart_pointer.cpp:134:10:134:10 | call to operator-> [post update] | smart_pointer.cpp:134:8:134:9 | ref arg p1 | TAINT |
+| smart_pointer.cpp:134:12:134:12 | q | smart_pointer.cpp:134:13:134:13 | call to operator-> |  |
+| smart_pointer.cpp:136:17:136:17 | ref arg call to operator* | smart_pointer.cpp:132:95:132:96 | p2 |  |
+| smart_pointer.cpp:136:17:136:17 | ref arg call to operator* | smart_pointer.cpp:136:18:136:19 | p2 [inner post update] |  |
+| smart_pointer.cpp:136:17:136:17 | ref arg call to operator* | smart_pointer.cpp:137:10:137:11 | p2 |  |
+| smart_pointer.cpp:136:18:136:19 | p2 | smart_pointer.cpp:136:17:136:17 | call to operator* | TAINT |
+| smart_pointer.cpp:136:18:136:19 | ref arg p2 | smart_pointer.cpp:132:95:132:96 | p2 |  |
+| smart_pointer.cpp:136:18:136:19 | ref arg p2 | smart_pointer.cpp:136:18:136:19 | p2 [inner post update] |  |
+| smart_pointer.cpp:136:18:136:19 | ref arg p2 | smart_pointer.cpp:137:10:137:11 | p2 |  |
+| smart_pointer.cpp:137:9:137:9 | call to operator* | smart_pointer.cpp:137:8:137:8 | call to operator* | TAINT |
+| smart_pointer.cpp:137:9:137:9 | ref arg call to operator* | smart_pointer.cpp:132:95:132:96 | p2 |  |
+| smart_pointer.cpp:137:9:137:9 | ref arg call to operator* | smart_pointer.cpp:137:10:137:11 | p2 [inner post update] |  |
+| smart_pointer.cpp:137:10:137:11 | p2 | smart_pointer.cpp:137:8:137:8 | call to operator* |  |
+| smart_pointer.cpp:137:10:137:11 | p2 | smart_pointer.cpp:137:9:137:9 | call to operator* | TAINT |
+| smart_pointer.cpp:137:10:137:11 | ref arg p2 | smart_pointer.cpp:132:95:132:96 | p2 |  |
+| smart_pointer.cpp:137:10:137:11 | ref arg p2 | smart_pointer.cpp:137:10:137:11 | p2 [inner post update] |  |
 | standalone_iterators.cpp:39:45:39:51 | source1 | standalone_iterators.cpp:39:45:39:51 | source1 |  |
 | standalone_iterators.cpp:39:45:39:51 | source1 | standalone_iterators.cpp:40:11:40:17 | source1 |  |
 | standalone_iterators.cpp:39:45:39:51 | source1 | standalone_iterators.cpp:41:12:41:18 | source1 |  |
@@ -3388,125 +3560,125 @@
 | stl.h:292:30:292:40 | call to allocator | stl.h:292:21:292:41 | noexcept(...) | TAINT |
 | stl.h:292:30:292:40 | call to allocator | stl.h:292:21:292:41 | noexcept(...) | TAINT |
 | stl.h:292:53:292:63 | 0 | stl.h:292:46:292:64 | (no string representation) | TAINT |
-| stl.h:388:9:388:9 | Unknown literal | stl.h:388:9:388:9 | constructor init of field first | TAINT |
-| stl.h:388:9:388:9 | Unknown literal | stl.h:388:9:388:9 | constructor init of field first | TAINT |
-| stl.h:388:9:388:9 | Unknown literal | stl.h:388:9:388:9 | constructor init of field first | TAINT |
-| stl.h:388:9:388:9 | Unknown literal | stl.h:388:9:388:9 | constructor init of field first | TAINT |
-| stl.h:388:9:388:9 | Unknown literal | stl.h:388:9:388:9 | constructor init of field first | TAINT |
-| stl.h:388:9:388:9 | Unknown literal | stl.h:388:9:388:9 | constructor init of field second | TAINT |
-| stl.h:388:9:388:9 | Unknown literal | stl.h:388:9:388:9 | constructor init of field second | TAINT |
-| stl.h:388:9:388:9 | Unknown literal | stl.h:388:9:388:9 | constructor init of field second | TAINT |
-| stl.h:388:9:388:9 | Unknown literal | stl.h:388:9:388:9 | constructor init of field second | TAINT |
-| stl.h:388:9:388:9 | Unknown literal | stl.h:388:9:388:9 | constructor init of field second | TAINT |
-| stl.h:388:9:388:9 | constructor init of field first [post-this] | stl.h:388:9:388:9 | constructor init of field second [pre-this] |  |
-| stl.h:388:9:388:9 | constructor init of field first [post-this] | stl.h:388:9:388:9 | constructor init of field second [pre-this] |  |
-| stl.h:388:9:388:9 | constructor init of field first [post-this] | stl.h:388:9:388:9 | constructor init of field second [pre-this] |  |
-| stl.h:388:9:388:9 | constructor init of field first [post-this] | stl.h:388:9:388:9 | constructor init of field second [pre-this] |  |
-| stl.h:388:9:388:9 | constructor init of field first [post-this] | stl.h:388:9:388:9 | constructor init of field second [pre-this] |  |
-| stl.h:388:9:388:9 | constructor init of field first [pre-this] | stl.h:388:9:388:9 | constructor init of field second [pre-this] |  |
-| stl.h:388:9:388:9 | constructor init of field first [pre-this] | stl.h:388:9:388:9 | constructor init of field second [pre-this] |  |
-| stl.h:388:9:388:9 | constructor init of field first [pre-this] | stl.h:388:9:388:9 | constructor init of field second [pre-this] |  |
-| stl.h:388:9:388:9 | constructor init of field first [pre-this] | stl.h:388:9:388:9 | constructor init of field second [pre-this] |  |
-| stl.h:388:9:388:9 | constructor init of field first [pre-this] | stl.h:388:9:388:9 | constructor init of field second [pre-this] |  |
-| stl.h:388:9:388:9 | this | stl.h:388:9:388:9 | constructor init of field first [pre-this] |  |
-| stl.h:388:9:388:9 | this | stl.h:388:9:388:9 | constructor init of field first [pre-this] |  |
-| stl.h:388:9:388:9 | this | stl.h:388:9:388:9 | constructor init of field first [pre-this] |  |
-| stl.h:388:9:388:9 | this | stl.h:388:9:388:9 | constructor init of field first [pre-this] |  |
-| stl.h:388:9:388:9 | this | stl.h:388:9:388:9 | constructor init of field first [pre-this] |  |
-| stl.h:395:3:395:3 | this | stl.h:395:36:395:43 | constructor init of field first [pre-this] |  |
-| stl.h:395:3:395:3 | this | stl.h:395:36:395:43 | constructor init of field first [pre-this] |  |
-| stl.h:395:3:395:3 | this | stl.h:395:36:395:43 | constructor init of field first [pre-this] |  |
-| stl.h:395:3:395:3 | this | stl.h:395:36:395:43 | constructor init of field first [pre-this] |  |
-| stl.h:395:3:395:3 | this | stl.h:395:36:395:43 | constructor init of field first [pre-this] |  |
-| stl.h:395:3:395:6 | this | stl.h:395:36:395:43 | constructor init of field first [pre-this] |  |
-| stl.h:395:18:395:18 | x | stl.h:395:42:395:42 | x |  |
-| stl.h:395:18:395:18 | x | stl.h:395:42:395:42 | x |  |
-| stl.h:395:18:395:18 | x | stl.h:395:42:395:42 | x |  |
-| stl.h:395:18:395:18 | x | stl.h:395:42:395:42 | x |  |
-| stl.h:395:18:395:18 | x | stl.h:395:42:395:42 | x |  |
-| stl.h:395:18:395:18 | x | stl.h:395:42:395:42 | x |  |
-| stl.h:395:31:395:31 | y | stl.h:395:53:395:53 | y |  |
-| stl.h:395:31:395:31 | y | stl.h:395:53:395:53 | y |  |
-| stl.h:395:31:395:31 | y | stl.h:395:53:395:53 | y |  |
-| stl.h:395:31:395:31 | y | stl.h:395:53:395:53 | y |  |
-| stl.h:395:31:395:31 | y | stl.h:395:53:395:53 | y |  |
-| stl.h:395:31:395:31 | y | stl.h:395:53:395:53 | y |  |
-| stl.h:395:36:395:43 | call to unknown function | stl.h:395:36:395:43 | constructor init of field first | TAINT |
-| stl.h:395:36:395:43 | constructor init of field first [post-this] | stl.h:395:46:395:54 | constructor init of field second [pre-this] |  |
-| stl.h:395:36:395:43 | constructor init of field first [post-this] | stl.h:395:46:395:54 | constructor init of field second [pre-this] |  |
-| stl.h:395:36:395:43 | constructor init of field first [post-this] | stl.h:395:46:395:54 | constructor init of field second [pre-this] |  |
-| stl.h:395:36:395:43 | constructor init of field first [post-this] | stl.h:395:46:395:54 | constructor init of field second [pre-this] |  |
-| stl.h:395:36:395:43 | constructor init of field first [post-this] | stl.h:395:46:395:54 | constructor init of field second [pre-this] |  |
-| stl.h:395:36:395:43 | constructor init of field first [post-this] | stl.h:395:46:395:54 | constructor init of field second [pre-this] |  |
-| stl.h:395:36:395:43 | constructor init of field first [pre-this] | stl.h:395:46:395:54 | constructor init of field second [pre-this] |  |
-| stl.h:395:36:395:43 | constructor init of field first [pre-this] | stl.h:395:46:395:54 | constructor init of field second [pre-this] |  |
-| stl.h:395:36:395:43 | constructor init of field first [pre-this] | stl.h:395:46:395:54 | constructor init of field second [pre-this] |  |
-| stl.h:395:36:395:43 | constructor init of field first [pre-this] | stl.h:395:46:395:54 | constructor init of field second [pre-this] |  |
-| stl.h:395:36:395:43 | constructor init of field first [pre-this] | stl.h:395:46:395:54 | constructor init of field second [pre-this] |  |
-| stl.h:395:36:395:43 | constructor init of field first [pre-this] | stl.h:395:46:395:54 | constructor init of field second [pre-this] |  |
-| stl.h:395:42:395:42 | x | stl.h:395:36:395:43 | constructor init of field first | TAINT |
-| stl.h:395:42:395:42 | x | stl.h:395:36:395:43 | constructor init of field first | TAINT |
-| stl.h:395:42:395:42 | x | stl.h:395:36:395:43 | constructor init of field first | TAINT |
-| stl.h:395:42:395:42 | x | stl.h:395:36:395:43 | constructor init of field first | TAINT |
-| stl.h:395:42:395:42 | x | stl.h:395:36:395:43 | constructor init of field first | TAINT |
-| stl.h:395:46:395:54 | call to unknown function | stl.h:395:46:395:54 | constructor init of field second | TAINT |
-| stl.h:395:53:395:53 | y | stl.h:395:46:395:54 | constructor init of field second | TAINT |
-| stl.h:395:53:395:53 | y | stl.h:395:46:395:54 | constructor init of field second | TAINT |
-| stl.h:395:53:395:53 | y | stl.h:395:46:395:54 | constructor init of field second | TAINT |
-| stl.h:395:53:395:53 | y | stl.h:395:46:395:54 | constructor init of field second | TAINT |
-| stl.h:395:53:395:53 | y | stl.h:395:46:395:54 | constructor init of field second | TAINT |
-| stl.h:401:87:401:87 | x | stl.h:401:87:401:87 | x |  |
-| stl.h:401:87:401:87 | x | stl.h:401:87:401:87 | x |  |
-| stl.h:401:87:401:87 | x | stl.h:401:87:401:87 | x |  |
-| stl.h:401:87:401:87 | x | stl.h:401:87:401:87 | x |  |
-| stl.h:401:87:401:87 | x | stl.h:401:87:401:87 | x |  |
-| stl.h:401:87:401:87 | x | stl.h:401:87:401:87 | x |  |
-| stl.h:401:87:401:87 | x | stl.h:401:87:401:87 | x |  |
-| stl.h:401:87:401:87 | x | stl.h:402:58:402:58 | x |  |
-| stl.h:401:87:401:87 | x | stl.h:402:58:402:58 | x |  |
-| stl.h:401:87:401:87 | x | stl.h:402:58:402:58 | x |  |
-| stl.h:401:87:401:87 | x | stl.h:402:58:402:58 | x |  |
-| stl.h:401:87:401:87 | x | stl.h:402:58:402:58 | x |  |
-| stl.h:401:87:401:87 | x | stl.h:402:58:402:58 | x |  |
-| stl.h:401:87:401:87 | x | stl.h:402:58:402:58 | x |  |
-| stl.h:401:95:401:95 | y | stl.h:401:95:401:95 | y |  |
-| stl.h:401:95:401:95 | y | stl.h:401:95:401:95 | y |  |
-| stl.h:401:95:401:95 | y | stl.h:401:95:401:95 | y |  |
-| stl.h:401:95:401:95 | y | stl.h:401:95:401:95 | y |  |
-| stl.h:401:95:401:95 | y | stl.h:401:95:401:95 | y |  |
-| stl.h:401:95:401:95 | y | stl.h:401:95:401:95 | y |  |
-| stl.h:401:95:401:95 | y | stl.h:401:95:401:95 | y |  |
-| stl.h:401:95:401:95 | y | stl.h:402:79:402:79 | y |  |
-| stl.h:401:95:401:95 | y | stl.h:402:79:402:79 | y |  |
-| stl.h:401:95:401:95 | y | stl.h:402:79:402:79 | y |  |
-| stl.h:401:95:401:95 | y | stl.h:402:79:402:79 | y |  |
-| stl.h:401:95:401:95 | y | stl.h:402:79:402:79 | y |  |
-| stl.h:401:95:401:95 | y | stl.h:402:79:402:79 | y |  |
-| stl.h:401:95:401:95 | y | stl.h:402:79:402:79 | y |  |
-| stl.h:402:58:402:58 | x | stl.h:402:41:402:56 | call to forward |  |
-| stl.h:402:58:402:58 | x | stl.h:402:41:402:56 | call to forward |  |
-| stl.h:402:58:402:58 | x | stl.h:402:41:402:56 | call to forward |  |
-| stl.h:402:58:402:58 | x | stl.h:402:41:402:56 | call to forward |  |
-| stl.h:402:58:402:58 | x | stl.h:402:41:402:56 | call to forward |  |
-| stl.h:402:58:402:58 | x | stl.h:402:41:402:56 | call to forward |  |
-| stl.h:402:62:402:77 | call to forward | stl.h:402:3:402:82 | call to pair | TAINT |
-| stl.h:402:62:402:77 | call to forward | stl.h:402:3:402:82 | call to pair | TAINT |
-| stl.h:402:62:402:77 | call to forward | stl.h:402:3:402:82 | call to pair | TAINT |
-| stl.h:402:62:402:77 | call to forward | stl.h:402:3:402:82 | call to pair | TAINT |
-| stl.h:402:62:402:77 | call to forward | stl.h:402:3:402:82 | call to pair | TAINT |
-| stl.h:402:62:402:77 | call to forward | stl.h:402:3:402:82 | call to pair | TAINT |
-| stl.h:402:79:402:79 | y | stl.h:402:3:402:82 | call to pair | TAINT |
-| stl.h:402:79:402:79 | y | stl.h:402:3:402:82 | call to pair | TAINT |
-| stl.h:402:79:402:79 | y | stl.h:402:3:402:82 | call to pair | TAINT |
-| stl.h:402:79:402:79 | y | stl.h:402:3:402:82 | call to pair | TAINT |
-| stl.h:402:79:402:79 | y | stl.h:402:3:402:82 | call to pair | TAINT |
-| stl.h:402:79:402:79 | y | stl.h:402:3:402:82 | call to pair | TAINT |
-| stl.h:402:79:402:79 | y | stl.h:402:62:402:77 | call to forward |  |
-| stl.h:402:79:402:79 | y | stl.h:402:62:402:77 | call to forward |  |
-| stl.h:402:79:402:79 | y | stl.h:402:62:402:77 | call to forward |  |
-| stl.h:402:79:402:79 | y | stl.h:402:62:402:77 | call to forward |  |
-| stl.h:402:79:402:79 | y | stl.h:402:62:402:77 | call to forward |  |
-| stl.h:402:79:402:79 | y | stl.h:402:62:402:77 | call to forward |  |
+| stl.h:389:9:389:9 | Unknown literal | stl.h:389:9:389:9 | constructor init of field first | TAINT |
+| stl.h:389:9:389:9 | Unknown literal | stl.h:389:9:389:9 | constructor init of field first | TAINT |
+| stl.h:389:9:389:9 | Unknown literal | stl.h:389:9:389:9 | constructor init of field first | TAINT |
+| stl.h:389:9:389:9 | Unknown literal | stl.h:389:9:389:9 | constructor init of field first | TAINT |
+| stl.h:389:9:389:9 | Unknown literal | stl.h:389:9:389:9 | constructor init of field first | TAINT |
+| stl.h:389:9:389:9 | Unknown literal | stl.h:389:9:389:9 | constructor init of field second | TAINT |
+| stl.h:389:9:389:9 | Unknown literal | stl.h:389:9:389:9 | constructor init of field second | TAINT |
+| stl.h:389:9:389:9 | Unknown literal | stl.h:389:9:389:9 | constructor init of field second | TAINT |
+| stl.h:389:9:389:9 | Unknown literal | stl.h:389:9:389:9 | constructor init of field second | TAINT |
+| stl.h:389:9:389:9 | Unknown literal | stl.h:389:9:389:9 | constructor init of field second | TAINT |
+| stl.h:389:9:389:9 | constructor init of field first [post-this] | stl.h:389:9:389:9 | constructor init of field second [pre-this] |  |
+| stl.h:389:9:389:9 | constructor init of field first [post-this] | stl.h:389:9:389:9 | constructor init of field second [pre-this] |  |
+| stl.h:389:9:389:9 | constructor init of field first [post-this] | stl.h:389:9:389:9 | constructor init of field second [pre-this] |  |
+| stl.h:389:9:389:9 | constructor init of field first [post-this] | stl.h:389:9:389:9 | constructor init of field second [pre-this] |  |
+| stl.h:389:9:389:9 | constructor init of field first [post-this] | stl.h:389:9:389:9 | constructor init of field second [pre-this] |  |
+| stl.h:389:9:389:9 | constructor init of field first [pre-this] | stl.h:389:9:389:9 | constructor init of field second [pre-this] |  |
+| stl.h:389:9:389:9 | constructor init of field first [pre-this] | stl.h:389:9:389:9 | constructor init of field second [pre-this] |  |
+| stl.h:389:9:389:9 | constructor init of field first [pre-this] | stl.h:389:9:389:9 | constructor init of field second [pre-this] |  |
+| stl.h:389:9:389:9 | constructor init of field first [pre-this] | stl.h:389:9:389:9 | constructor init of field second [pre-this] |  |
+| stl.h:389:9:389:9 | constructor init of field first [pre-this] | stl.h:389:9:389:9 | constructor init of field second [pre-this] |  |
+| stl.h:389:9:389:9 | this | stl.h:389:9:389:9 | constructor init of field first [pre-this] |  |
+| stl.h:389:9:389:9 | this | stl.h:389:9:389:9 | constructor init of field first [pre-this] |  |
+| stl.h:389:9:389:9 | this | stl.h:389:9:389:9 | constructor init of field first [pre-this] |  |
+| stl.h:389:9:389:9 | this | stl.h:389:9:389:9 | constructor init of field first [pre-this] |  |
+| stl.h:389:9:389:9 | this | stl.h:389:9:389:9 | constructor init of field first [pre-this] |  |
+| stl.h:396:3:396:3 | this | stl.h:396:36:396:43 | constructor init of field first [pre-this] |  |
+| stl.h:396:3:396:3 | this | stl.h:396:36:396:43 | constructor init of field first [pre-this] |  |
+| stl.h:396:3:396:3 | this | stl.h:396:36:396:43 | constructor init of field first [pre-this] |  |
+| stl.h:396:3:396:3 | this | stl.h:396:36:396:43 | constructor init of field first [pre-this] |  |
+| stl.h:396:3:396:3 | this | stl.h:396:36:396:43 | constructor init of field first [pre-this] |  |
+| stl.h:396:3:396:6 | this | stl.h:396:36:396:43 | constructor init of field first [pre-this] |  |
+| stl.h:396:18:396:18 | x | stl.h:396:42:396:42 | x |  |
+| stl.h:396:18:396:18 | x | stl.h:396:42:396:42 | x |  |
+| stl.h:396:18:396:18 | x | stl.h:396:42:396:42 | x |  |
+| stl.h:396:18:396:18 | x | stl.h:396:42:396:42 | x |  |
+| stl.h:396:18:396:18 | x | stl.h:396:42:396:42 | x |  |
+| stl.h:396:18:396:18 | x | stl.h:396:42:396:42 | x |  |
+| stl.h:396:31:396:31 | y | stl.h:396:53:396:53 | y |  |
+| stl.h:396:31:396:31 | y | stl.h:396:53:396:53 | y |  |
+| stl.h:396:31:396:31 | y | stl.h:396:53:396:53 | y |  |
+| stl.h:396:31:396:31 | y | stl.h:396:53:396:53 | y |  |
+| stl.h:396:31:396:31 | y | stl.h:396:53:396:53 | y |  |
+| stl.h:396:31:396:31 | y | stl.h:396:53:396:53 | y |  |
+| stl.h:396:36:396:43 | call to unknown function | stl.h:396:36:396:43 | constructor init of field first | TAINT |
+| stl.h:396:36:396:43 | constructor init of field first [post-this] | stl.h:396:46:396:54 | constructor init of field second [pre-this] |  |
+| stl.h:396:36:396:43 | constructor init of field first [post-this] | stl.h:396:46:396:54 | constructor init of field second [pre-this] |  |
+| stl.h:396:36:396:43 | constructor init of field first [post-this] | stl.h:396:46:396:54 | constructor init of field second [pre-this] |  |
+| stl.h:396:36:396:43 | constructor init of field first [post-this] | stl.h:396:46:396:54 | constructor init of field second [pre-this] |  |
+| stl.h:396:36:396:43 | constructor init of field first [post-this] | stl.h:396:46:396:54 | constructor init of field second [pre-this] |  |
+| stl.h:396:36:396:43 | constructor init of field first [post-this] | stl.h:396:46:396:54 | constructor init of field second [pre-this] |  |
+| stl.h:396:36:396:43 | constructor init of field first [pre-this] | stl.h:396:46:396:54 | constructor init of field second [pre-this] |  |
+| stl.h:396:36:396:43 | constructor init of field first [pre-this] | stl.h:396:46:396:54 | constructor init of field second [pre-this] |  |
+| stl.h:396:36:396:43 | constructor init of field first [pre-this] | stl.h:396:46:396:54 | constructor init of field second [pre-this] |  |
+| stl.h:396:36:396:43 | constructor init of field first [pre-this] | stl.h:396:46:396:54 | constructor init of field second [pre-this] |  |
+| stl.h:396:36:396:43 | constructor init of field first [pre-this] | stl.h:396:46:396:54 | constructor init of field second [pre-this] |  |
+| stl.h:396:36:396:43 | constructor init of field first [pre-this] | stl.h:396:46:396:54 | constructor init of field second [pre-this] |  |
+| stl.h:396:42:396:42 | x | stl.h:396:36:396:43 | constructor init of field first | TAINT |
+| stl.h:396:42:396:42 | x | stl.h:396:36:396:43 | constructor init of field first | TAINT |
+| stl.h:396:42:396:42 | x | stl.h:396:36:396:43 | constructor init of field first | TAINT |
+| stl.h:396:42:396:42 | x | stl.h:396:36:396:43 | constructor init of field first | TAINT |
+| stl.h:396:42:396:42 | x | stl.h:396:36:396:43 | constructor init of field first | TAINT |
+| stl.h:396:46:396:54 | call to unknown function | stl.h:396:46:396:54 | constructor init of field second | TAINT |
+| stl.h:396:53:396:53 | y | stl.h:396:46:396:54 | constructor init of field second | TAINT |
+| stl.h:396:53:396:53 | y | stl.h:396:46:396:54 | constructor init of field second | TAINT |
+| stl.h:396:53:396:53 | y | stl.h:396:46:396:54 | constructor init of field second | TAINT |
+| stl.h:396:53:396:53 | y | stl.h:396:46:396:54 | constructor init of field second | TAINT |
+| stl.h:396:53:396:53 | y | stl.h:396:46:396:54 | constructor init of field second | TAINT |
+| stl.h:402:87:402:87 | x | stl.h:402:87:402:87 | x |  |
+| stl.h:402:87:402:87 | x | stl.h:402:87:402:87 | x |  |
+| stl.h:402:87:402:87 | x | stl.h:402:87:402:87 | x |  |
+| stl.h:402:87:402:87 | x | stl.h:402:87:402:87 | x |  |
+| stl.h:402:87:402:87 | x | stl.h:402:87:402:87 | x |  |
+| stl.h:402:87:402:87 | x | stl.h:402:87:402:87 | x |  |
+| stl.h:402:87:402:87 | x | stl.h:402:87:402:87 | x |  |
+| stl.h:402:87:402:87 | x | stl.h:403:58:403:58 | x |  |
+| stl.h:402:87:402:87 | x | stl.h:403:58:403:58 | x |  |
+| stl.h:402:87:402:87 | x | stl.h:403:58:403:58 | x |  |
+| stl.h:402:87:402:87 | x | stl.h:403:58:403:58 | x |  |
+| stl.h:402:87:402:87 | x | stl.h:403:58:403:58 | x |  |
+| stl.h:402:87:402:87 | x | stl.h:403:58:403:58 | x |  |
+| stl.h:402:87:402:87 | x | stl.h:403:58:403:58 | x |  |
+| stl.h:402:95:402:95 | y | stl.h:402:95:402:95 | y |  |
+| stl.h:402:95:402:95 | y | stl.h:402:95:402:95 | y |  |
+| stl.h:402:95:402:95 | y | stl.h:402:95:402:95 | y |  |
+| stl.h:402:95:402:95 | y | stl.h:402:95:402:95 | y |  |
+| stl.h:402:95:402:95 | y | stl.h:402:95:402:95 | y |  |
+| stl.h:402:95:402:95 | y | stl.h:402:95:402:95 | y |  |
+| stl.h:402:95:402:95 | y | stl.h:402:95:402:95 | y |  |
+| stl.h:402:95:402:95 | y | stl.h:403:79:403:79 | y |  |
+| stl.h:402:95:402:95 | y | stl.h:403:79:403:79 | y |  |
+| stl.h:402:95:402:95 | y | stl.h:403:79:403:79 | y |  |
+| stl.h:402:95:402:95 | y | stl.h:403:79:403:79 | y |  |
+| stl.h:402:95:402:95 | y | stl.h:403:79:403:79 | y |  |
+| stl.h:402:95:402:95 | y | stl.h:403:79:403:79 | y |  |
+| stl.h:402:95:402:95 | y | stl.h:403:79:403:79 | y |  |
+| stl.h:403:58:403:58 | x | stl.h:403:41:403:56 | call to forward |  |
+| stl.h:403:58:403:58 | x | stl.h:403:41:403:56 | call to forward |  |
+| stl.h:403:58:403:58 | x | stl.h:403:41:403:56 | call to forward |  |
+| stl.h:403:58:403:58 | x | stl.h:403:41:403:56 | call to forward |  |
+| stl.h:403:58:403:58 | x | stl.h:403:41:403:56 | call to forward |  |
+| stl.h:403:58:403:58 | x | stl.h:403:41:403:56 | call to forward |  |
+| stl.h:403:62:403:77 | call to forward | stl.h:403:3:403:82 | call to pair | TAINT |
+| stl.h:403:62:403:77 | call to forward | stl.h:403:3:403:82 | call to pair | TAINT |
+| stl.h:403:62:403:77 | call to forward | stl.h:403:3:403:82 | call to pair | TAINT |
+| stl.h:403:62:403:77 | call to forward | stl.h:403:3:403:82 | call to pair | TAINT |
+| stl.h:403:62:403:77 | call to forward | stl.h:403:3:403:82 | call to pair | TAINT |
+| stl.h:403:62:403:77 | call to forward | stl.h:403:3:403:82 | call to pair | TAINT |
+| stl.h:403:79:403:79 | y | stl.h:403:3:403:82 | call to pair | TAINT |
+| stl.h:403:79:403:79 | y | stl.h:403:3:403:82 | call to pair | TAINT |
+| stl.h:403:79:403:79 | y | stl.h:403:3:403:82 | call to pair | TAINT |
+| stl.h:403:79:403:79 | y | stl.h:403:3:403:82 | call to pair | TAINT |
+| stl.h:403:79:403:79 | y | stl.h:403:3:403:82 | call to pair | TAINT |
+| stl.h:403:79:403:79 | y | stl.h:403:3:403:82 | call to pair | TAINT |
+| stl.h:403:79:403:79 | y | stl.h:403:62:403:77 | call to forward |  |
+| stl.h:403:79:403:79 | y | stl.h:403:62:403:77 | call to forward |  |
+| stl.h:403:79:403:79 | y | stl.h:403:62:403:77 | call to forward |  |
+| stl.h:403:79:403:79 | y | stl.h:403:62:403:77 | call to forward |  |
+| stl.h:403:79:403:79 | y | stl.h:403:62:403:77 | call to forward |  |
+| stl.h:403:79:403:79 | y | stl.h:403:62:403:77 | call to forward |  |
 | string.cpp:25:12:25:17 | call to source | string.cpp:29:7:29:7 | a |  |
 | string.cpp:26:16:26:20 | 123 | string.cpp:26:16:26:21 | call to basic_string | TAINT |
 | string.cpp:26:16:26:21 | call to basic_string | string.cpp:30:7:30:7 | b |  |
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/map.cpp b/cpp/ql/test/library-tests/dataflow/taint-tests/map.cpp
index 0154ef2c7bb..aabd898830e 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/map.cpp
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/map.cpp
@@ -152,8 +152,8 @@ void test_map()
 	for (i2 = m2.begin(); i2 != m2.end(); i2++)
 	{
 		sink(*i2); // $ ast,ir
-		sink(i2->first); // $ SPURIOUS: ir
-		sink(i2->second); // $ ir MISSING: ast
+		sink(i2->first); // clean
+		sink(i2->second); // $ MISSING: ast,ir
 	}
 	for (i3 = m3.begin(); i3 != m3.end(); i3++)
 	{
@@ -304,8 +304,8 @@ void test_unordered_map()
 	for (i2 = m2.begin(); i2 != m2.end(); i2++)
 	{
 		sink(*i2); // $ ast,ir
-		sink(i2->first); // $ SPURIOUS: ir
-		sink(i2->second); // $ ir MISSING: ast
+		sink(i2->first); // clean
+		sink(i2->second); // $ MISSING: ast,ir
 	}
 	for (i3 = m3.begin(); i3 != m3.end(); i3++)
 	{
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/smart_pointer.cpp b/cpp/ql/test/library-tests/dataflow/taint-tests/smart_pointer.cpp
index f45260228e8..39cff39e3ed 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/smart_pointer.cpp
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/smart_pointer.cpp
@@ -35,16 +35,16 @@ void test_reverse_taint_shared() {
     std::shared_ptr<int> p = std::make_shared<int>();
 
     *p = source();
-    sink(p); // $ MISSING: ast,ir
-    sink(*p); // $ MISSING: ast,ir
+    sink(p); // $ ast MISSING: ir
+    sink(*p); // $ ast MISSING: ir
 }
 
 void test_reverse_taint_unique() {
     std::unique_ptr<int> p = std::unique_ptr<int>();
 
     *p = source();
-    sink(p); // $ MISSING: ast,ir
-    sink(*p); // $ MISSING: ast,ir
+    sink(p); // $ ast MISSING: ir
+    sink(*p); // $ ast MISSING: ir
 }
 
 void test_shared_get() {
@@ -65,4 +65,74 @@ void test_shared_field_member() {
     std::unique_ptr<A> p = std::make_unique<A>(source(), 0);
     sink(p->x); // $ MISSING: ast,ir
     sink(p->y); // not tainted
+}
+
+void getNumber(std::shared_ptr<int> ptr) {
+  *ptr = source();
+}
+
+int test_from_issue_5190() {
+  std::shared_ptr<int> p(new int);
+  getNumber(p);
+  sink(*p); // $ ast MISSING: ir
+}
+
+struct B {
+  A a1;
+  A a2;
+  int z;
+};
+
+void test_operator_arrow(std::unique_ptr<A> p, std::unique_ptr<B> q) {
+  p->x = source();
+  sink(p->x); // $ ast MISSING: ir
+  sink(p->y);
+
+  q->a1.x = source();
+  sink(q->a1.x); // $ ast MISSING: ir
+  sink(q->a1.y);
+  sink(q->a2.x);
+}
+
+void taint_x(A* pa) {
+    pa->x = source();
+}
+
+void reverse_taint_smart_pointer() {
+  std::unique_ptr<A> p = std::unique_ptr<A>(new A);
+  taint_x(p.get());
+  sink(p->x); // $ ast MISSING: ir
+}
+
+struct C {
+	int z;
+	std::shared_ptr<A> q;
+};
+
+void taint_x_shared(std::shared_ptr<A> ptr) {
+	ptr->x = source();
+}
+
+void taint_x_shared_cref(const std::shared_ptr<A>& ptr) {
+	ptr->x = source();
+}
+
+void getNumberCRef(const std::shared_ptr<int>& ptr) {
+  *ptr = source();
+}
+
+int nested_shared_ptr_taint(std::shared_ptr<C> p1, std::unique_ptr<std::shared_ptr<int>> p2) {
+  taint_x_shared(p1->q);
+  sink(p1->q->x); // $ ast MISSING: ir
+
+  getNumber(*p2);
+  sink(**p2); // $ ast MISSING: ir
+}
+
+int nested_shared_ptr_taint_cref(std::shared_ptr<C> p1, std::unique_ptr<std::shared_ptr<int>> p2) {
+  taint_x_shared_cref(p1->q);
+  sink(p1->q->x); // $ ast MISSING: ir
+
+  getNumberCRef(*p2);
+  sink(**p2); // $ ast MISSING: ir
 }
\ No newline at end of file
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/standalone_iterators.cpp b/cpp/ql/test/library-tests/dataflow/taint-tests/standalone_iterators.cpp
index 362784eeb1a..376582381ac 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/standalone_iterators.cpp
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/standalone_iterators.cpp
@@ -39,13 +39,13 @@ public:
 void test_typedefs(int_iterator_by_typedefs source1) {
     sink(*source1); // $ ast,ir
     sink(*(source1++)); // $ ast,ir
-    sink(*(++source1)); // $ ast MISSING: ir
+    sink(*(++source1)); // $ ast,ir
 }
 
 void test_trait(int_iterator_by_trait source1) {
     sink(*source1); // $ ast,ir
     sink(*(source1++)); // $ ast,ir
-    sink(*(++source1)); // $ ast MISSING: ir
+    sink(*(++source1)); // $ ast,ir
 }
 
 void test_non_iterator(non_iterator source1) {
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/stl.h b/cpp/ql/test/library-tests/dataflow/taint-tests/stl.h
index 09e77c5a3b6..44550c3df76 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/stl.h
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/stl.h
@@ -349,6 +349,7 @@ namespace std {
 	public:
 		shared_ptr() noexcept;
 		explicit shared_ptr(T*);
+		shared_ptr(const shared_ptr&) noexcept;
 		template<class U> shared_ptr(const shared_ptr<U>&) noexcept;
 		template<class U> shared_ptr(shared_ptr<U>&&) noexcept;
 
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/string.cpp b/cpp/ql/test/library-tests/dataflow/taint-tests/string.cpp
index 9169113c1d9..0e29d314887 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/string.cpp
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/string.cpp
@@ -396,9 +396,9 @@ void test_string_iterators() {
 		sink(*(i2+1)); // $ ast,ir
 		sink(*(i2-1)); // $ ast,ir
 		i3 = i2;
-		sink(*(++i3)); // $ ast MISSING: ir
+		sink(*(++i3)); // $ ast,ir
 		i4 = i2;
-		sink(*(--i4)); // $ ast MISSING: ir
+		sink(*(--i4)); // $ ast,ir
 		i5 = i2;
 		i5++;
 		sink(*i5); // $ ast,ir
@@ -406,9 +406,9 @@ void test_string_iterators() {
 		i6--;
 		sink(*i6); // $ ast,ir
 		i7 = i2;
-		sink(*(i7+=1)); // $ ast MISSING: ir
+		sink(*(i7+=1)); // $ ast,ir
 		i8 = i2;
-		sink(*(i8-=1)); // $ ast MISSING: ir
+		sink(*(i8-=1)); // $ ast,ir
 
 		i9 = s2.end();
 		--i9;
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/stringstream.cpp b/cpp/ql/test/library-tests/dataflow/taint-tests/stringstream.cpp
index 7b7712f0c01..fab96fc878d 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/stringstream.cpp
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/stringstream.cpp
@@ -32,18 +32,18 @@ void test_stringstream_string(int amount)
 	sink(ss2 << source()); // $ ast,ir
 	sink(ss3 << "123" << source()); // $ ast,ir
 	sink(ss4 << source() << "456"); // $ ast,ir
-	sink(ss5 << t); // $ ast MISSING: ir
+	sink(ss5 << t); // $ ast,ir
 
 	sink(ss1);
 	sink(ss2); // $ ast,ir
 	sink(ss3); // $ ast MISSING: ir
 	sink(ss4); // $ ast,ir
-	sink(ss5); // $ ast MISSING: ir
+	sink(ss5); // $ ast,ir
 	sink(ss1.str());
 	sink(ss2.str()); // $ ast,ir
 	sink(ss3.str()); // $ ast MISSING: ir
 	sink(ss4.str()); // $ ast,ir
-	sink(ss5.str()); // $ ast MISSING: ir
+	sink(ss5.str()); // $ ast,ir
 
 	ss6.str("abc");
 	ss6.str(source()); // (overwrites)
@@ -229,7 +229,7 @@ void test_getline()
 
 	sink(ss2.getline(b7, 1000).getline(b8, 1000)); // $ ast,ir
 	sink(b7); // $ ast,ir
-	sink(b8); // $ ast MISSING: ir
+	sink(b8); // $ ast,ir
 
 	sink(getline(ss1, s1));
 	sink(getline(ss2, s2)); // $ ast,ir
@@ -261,7 +261,7 @@ void test_chaining()
 
 	sink(ss1.get(b1, 100).unget().get(b2, 100)); // $ ast,ir
 	sink(b1); // $ ast,ir
-	sink(b2); // $ ast MISSING: ir
+	sink(b2); // $ ast,ir
 
 	sink(ss2.write("abc", 3).flush().write(source(), 3).flush().write("xyz", 3)); // $ ast MISSING: ir
 	sink(ss2); // $ ast MISSING: ir
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/taint.cpp b/cpp/ql/test/library-tests/dataflow/taint-tests/taint.cpp
index 5ba2425300f..0365d8c2c77 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/taint.cpp
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/taint.cpp
@@ -192,7 +192,7 @@ void *memcpy(void *dest, void *src, int len);
 void test_memcpy(int *source) {
 	int x;
 	memcpy(&x, source, sizeof(int));
-	sink(x); // $ ast=192:23 MISSING: ir SPURIOUS: ast=193:6
+	sink(x); // $ ast=192:23 ir SPURIOUS: ast=193:6
 }
 
 // --- std::swap ---
@@ -369,9 +369,9 @@ void test_strdup(char *source)
 	a = strdup(source);
 	b = strdup("hello, world");
 	c = strndup(source, 100);
-	sink(a); // $ ast MISSING: ir
+	sink(a); // $ ast,ir
 	sink(b);
-	sink(c); // $ ast MISSING: ir
+	sink(c); // $ ast,ir
 }
 
 void test_strndup(int source)
@@ -388,7 +388,7 @@ void test_wcsdup(wchar_t *source)
 
 	a = wcsdup(source);
 	b = wcsdup(L"hello, world");
-	sink(a); // $ ast MISSING: ir
+	sink(a); // $ ast,ir
 	sink(b);
 }
 
@@ -518,7 +518,7 @@ void *mempcpy(void *dest, const void *src, size_t n);
 void test_mempcpy(int *source) {
 	int x;
 	mempcpy(&x, source, sizeof(int));
-	sink(x); // $ ast=518:24 MISSING: ir SPURIOUS: ast=519:6
+	sink(x); // $ ast=518:24 ir SPURIOUS: ast=519:6
 }
 
 // --- memccpy ---
@@ -528,7 +528,7 @@ void *memccpy(void *dest, const void *src, int c, size_t n);
 void test_memccpy(int *source) {
 	int dest[16];
 	memccpy(dest, source, 42, sizeof(dest));
-	sink(dest); // $ ast=528:24 MISSING: ir SPURIOUS: ast=529:6
+	sink(dest); // $ ast=528:24 ir SPURIOUS: ast=529:6
 }
 
 // --- strcat and related functions ---
diff --git a/cpp/ql/test/library-tests/ir/ir/raw_ir.expected b/cpp/ql/test/library-tests/ir/ir/raw_ir.expected
index a7dac56cc96..e008e2de659 100644
--- a/cpp/ql/test/library-tests/ir/ir/raw_ir.expected
+++ b/cpp/ql/test/library-tests/ir/ir/raw_ir.expected
@@ -42,7 +42,7 @@ bad_asts.cpp:
 #   16|     r16_3(int)            = Constant[1]                     : 
 #   16|     r16_4(int)            = Call[MemberFunction]            : func:r16_2, this:r16_1, 0:r16_3
 #   16|     mu16_5(unknown)       = ^CallSideEffect                 : ~m?
-#   16|     v16_6(void)           = ^BufferReadSideEffect[-1]       : &:r16_1, ~m?
+#   16|     v16_6(void)           = ^IndirectReadSideEffect[-1]     : &:r16_1, ~m?
 #   16|     mu16_7(S)             = ^IndirectMayWriteSideEffect[-1] : &:r16_1
 #   17|     v17_1(void)           = NoOp                            : 
 #   14|     v14_4(void)           = ReturnVoid                      : 
@@ -3385,47 +3385,46 @@ ir.cpp:
 
 #  622| void CallMethods(String&, String*, String)
 #  622|   Block 0
-#  622|     v622_1(void)            = EnterFunction                   : 
-#  622|     mu622_2(unknown)        = AliasedDefinition               : 
-#  622|     mu622_3(unknown)        = InitializeNonLocal              : 
-#  622|     r622_4(glval<String &>) = VariableAddress[r]              : 
-#  622|     mu622_5(String &)       = InitializeParameter[r]          : &:r622_4
-#  622|     r622_6(String &)        = Load[r]                         : &:r622_4, ~m?
-#  622|     mu622_7(unknown)        = InitializeIndirection[r]        : &:r622_6
-#  622|     r622_8(glval<String *>) = VariableAddress[p]              : 
-#  622|     mu622_9(String *)       = InitializeParameter[p]          : &:r622_8
-#  622|     r622_10(String *)       = Load[p]                         : &:r622_8, ~m?
-#  622|     mu622_11(unknown)       = InitializeIndirection[p]        : &:r622_10
-#  622|     r622_12(glval<String>)  = VariableAddress[s]              : 
-#  622|     mu622_13(String)        = InitializeParameter[s]          : &:r622_12
-#  623|     r623_1(glval<String &>) = VariableAddress[r]              : 
-#  623|     r623_2(String &)        = Load[r]                         : &:r623_1, ~m?
-#  623|     r623_3(glval<String>)   = CopyValue                       : r623_2
-#  623|     r623_4(glval<String>)   = Convert                         : r623_3
-#  623|     r623_5(glval<unknown>)  = FunctionAddress[c_str]          : 
-#  623|     r623_6(char *)          = Call[c_str]                     : func:r623_5, this:r623_4
-#  623|     mu623_7(unknown)        = ^CallSideEffect                 : ~m?
-#  623|     v623_8(void)            = ^BufferReadSideEffect[-1]       : &:r623_4, ~m?
-#  624|     r624_1(glval<String *>) = VariableAddress[p]              : 
-#  624|     r624_2(String *)        = Load[p]                         : &:r624_1, ~m?
-#  624|     r624_3(String *)        = Convert                         : r624_2
-#  624|     r624_4(glval<unknown>)  = FunctionAddress[c_str]          : 
-#  624|     r624_5(char *)          = Call[c_str]                     : func:r624_4, this:r624_3
-#  624|     mu624_6(unknown)        = ^CallSideEffect                 : ~m?
-#  624|     v624_7(void)            = ^BufferReadSideEffect[-1]       : &:r624_3, ~m?
-#  624|     mu624_8(String)         = ^IndirectMayWriteSideEffect[-1] : &:r624_3
-#  625|     r625_1(glval<String>)   = VariableAddress[s]              : 
-#  625|     r625_2(glval<String>)   = Convert                         : r625_1
-#  625|     r625_3(glval<unknown>)  = FunctionAddress[c_str]          : 
-#  625|     r625_4(char *)          = Call[c_str]                     : func:r625_3, this:r625_2
-#  625|     mu625_5(unknown)        = ^CallSideEffect                 : ~m?
-#  625|     v625_6(void)            = ^BufferReadSideEffect[-1]       : &:r625_2, ~m?
-#  626|     v626_1(void)            = NoOp                            : 
-#  622|     v622_14(void)           = ReturnIndirection[r]            : &:r622_6, ~m?
-#  622|     v622_15(void)           = ReturnIndirection[p]            : &:r622_10, ~m?
-#  622|     v622_16(void)           = ReturnVoid                      : 
-#  622|     v622_17(void)           = AliasedUse                      : ~m?
-#  622|     v622_18(void)           = ExitFunction                    : 
+#  622|     v622_1(void)            = EnterFunction               : 
+#  622|     mu622_2(unknown)        = AliasedDefinition           : 
+#  622|     mu622_3(unknown)        = InitializeNonLocal          : 
+#  622|     r622_4(glval<String &>) = VariableAddress[r]          : 
+#  622|     mu622_5(String &)       = InitializeParameter[r]      : &:r622_4
+#  622|     r622_6(String &)        = Load[r]                     : &:r622_4, ~m?
+#  622|     mu622_7(unknown)        = InitializeIndirection[r]    : &:r622_6
+#  622|     r622_8(glval<String *>) = VariableAddress[p]          : 
+#  622|     mu622_9(String *)       = InitializeParameter[p]      : &:r622_8
+#  622|     r622_10(String *)       = Load[p]                     : &:r622_8, ~m?
+#  622|     mu622_11(unknown)       = InitializeIndirection[p]    : &:r622_10
+#  622|     r622_12(glval<String>)  = VariableAddress[s]          : 
+#  622|     mu622_13(String)        = InitializeParameter[s]      : &:r622_12
+#  623|     r623_1(glval<String &>) = VariableAddress[r]          : 
+#  623|     r623_2(String &)        = Load[r]                     : &:r623_1, ~m?
+#  623|     r623_3(glval<String>)   = CopyValue                   : r623_2
+#  623|     r623_4(glval<String>)   = Convert                     : r623_3
+#  623|     r623_5(glval<unknown>)  = FunctionAddress[c_str]      : 
+#  623|     r623_6(char *)          = Call[c_str]                 : func:r623_5, this:r623_4
+#  623|     mu623_7(unknown)        = ^CallSideEffect             : ~m?
+#  623|     v623_8(void)            = ^IndirectReadSideEffect[-1] : &:r623_4, ~m?
+#  624|     r624_1(glval<String *>) = VariableAddress[p]          : 
+#  624|     r624_2(String *)        = Load[p]                     : &:r624_1, ~m?
+#  624|     r624_3(String *)        = Convert                     : r624_2
+#  624|     r624_4(glval<unknown>)  = FunctionAddress[c_str]      : 
+#  624|     r624_5(char *)          = Call[c_str]                 : func:r624_4, this:r624_3
+#  624|     mu624_6(unknown)        = ^CallSideEffect             : ~m?
+#  624|     v624_7(void)            = ^IndirectReadSideEffect[-1] : &:r624_3, ~m?
+#  625|     r625_1(glval<String>)   = VariableAddress[s]          : 
+#  625|     r625_2(glval<String>)   = Convert                     : r625_1
+#  625|     r625_3(glval<unknown>)  = FunctionAddress[c_str]      : 
+#  625|     r625_4(char *)          = Call[c_str]                 : func:r625_3, this:r625_2
+#  625|     mu625_5(unknown)        = ^CallSideEffect             : ~m?
+#  625|     v625_6(void)            = ^IndirectReadSideEffect[-1] : &:r625_2, ~m?
+#  626|     v626_1(void)            = NoOp                        : 
+#  622|     v622_14(void)           = ReturnIndirection[r]        : &:r622_6, ~m?
+#  622|     v622_15(void)           = ReturnIndirection[p]        : &:r622_10, ~m?
+#  622|     v622_16(void)           = ReturnVoid                  : 
+#  622|     v622_17(void)           = AliasedUse                  : ~m?
+#  622|     v622_18(void)           = ExitFunction                : 
 
 #  628| void C::~C()
 #  628|   Block 0
@@ -3575,7 +3574,7 @@ ir.cpp:
 #  653|     r653_4(int)            = Constant[0]                             : 
 #  653|     r653_5(int)            = Call[InstanceMemberFunction]            : func:r653_3, this:r653_2, 0:r653_4
 #  653|     mu653_6(unknown)       = ^CallSideEffect                         : ~m?
-#  653|     v653_7(void)           = ^BufferReadSideEffect[-1]               : &:r653_2, ~m?
+#  653|     v653_7(void)           = ^IndirectReadSideEffect[-1]             : &:r653_2, ~m?
 #  653|     mu653_8(C)             = ^IndirectMayWriteSideEffect[-1]         : &:r653_2
 #  654|     r654_1(glval<unknown>) = VariableAddress[#this]                  : 
 #  654|     r654_2(C *)            = Load[#this]                             : &:r654_1, ~m?
@@ -3584,7 +3583,7 @@ ir.cpp:
 #  654|     r654_5(int)            = Constant[1]                             : 
 #  654|     r654_6(int)            = Call[InstanceMemberFunction]            : func:r654_4, this:r654_3, 0:r654_5
 #  654|     mu654_7(unknown)       = ^CallSideEffect                         : ~m?
-#  654|     v654_8(void)           = ^BufferReadSideEffect[-1]               : &:r654_3, ~m?
+#  654|     v654_8(void)           = ^IndirectReadSideEffect[-1]             : &:r654_3, ~m?
 #  654|     mu654_9(C)             = ^IndirectMayWriteSideEffect[-1]         : &:r654_3
 #  655|     r655_1(glval<unknown>) = VariableAddress[#this]                  : 
 #  655|     r655_2(C *)            = Load[#this]                             : &:r655_1, ~m?
@@ -3592,7 +3591,7 @@ ir.cpp:
 #  655|     r655_4(int)            = Constant[2]                             : 
 #  655|     r655_5(int)            = Call[InstanceMemberFunction]            : func:r655_3, this:r655_2, 0:r655_4
 #  655|     mu655_6(unknown)       = ^CallSideEffect                         : ~m?
-#  655|     v655_7(void)           = ^BufferReadSideEffect[-1]               : &:r655_2, ~m?
+#  655|     v655_7(void)           = ^IndirectReadSideEffect[-1]             : &:r655_2, ~m?
 #  655|     mu655_8(C)             = ^IndirectMayWriteSideEffect[-1]         : &:r655_2
 #  656|     v656_1(void)           = NoOp                                    : 
 #  652|     v652_8(void)           = ReturnIndirection[#this]                : &:r652_6, ~m?
@@ -4006,7 +4005,7 @@ ir.cpp:
 #-----|     r0_6(String &)          = CopyValue                                    : r745_15
 #  745|     r745_16(String &)       = Call[operator=]                              : func:r745_12, this:r745_11, 0:r0_6
 #  745|     mu745_17(unknown)       = ^CallSideEffect                              : ~m?
-#  745|     v745_18(void)           = ^BufferReadSideEffect[-1]                    : &:r745_11, ~m?
+#  745|     v745_18(void)           = ^IndirectReadSideEffect[-1]                  : &:r745_11, ~m?
 #-----|     v0_7(void)              = ^BufferReadSideEffect[0]                     : &:r0_6, ~m?
 #  745|     mu745_19(String)        = ^IndirectMayWriteSideEffect[-1]              : &:r745_11
 #-----|     r0_8(glval<String>)     = CopyValue                                    : r745_16
@@ -4113,7 +4112,7 @@ ir.cpp:
 #-----|     r0_8(Base &)             = CopyValue                                    : r754_14
 #  754|     r754_15(Base &)          = Call[operator=]                              : func:r754_10, this:r0_5, 0:r0_8
 #  754|     mu754_16(unknown)        = ^CallSideEffect                              : ~m?
-#-----|     v0_9(void)               = ^BufferReadSideEffect[-1]                    : &:r0_5, ~m?
+#-----|     v0_9(void)               = ^IndirectReadSideEffect[-1]                  : &:r0_5, ~m?
 #-----|     v0_10(void)              = ^BufferReadSideEffect[0]                     : &:r0_8, ~m?
 #-----|     mu0_11(Base)             = ^IndirectMayWriteSideEffect[-1]              : &:r0_5
 #-----|     r0_12(glval<Base>)       = CopyValue                                    : r754_15
@@ -4129,7 +4128,7 @@ ir.cpp:
 #-----|     r0_14(String &)          = CopyValue                                    : r754_24
 #  754|     r754_25(String &)        = Call[operator=]                              : func:r754_21, this:r754_20, 0:r0_14
 #  754|     mu754_26(unknown)        = ^CallSideEffect                              : ~m?
-#  754|     v754_27(void)            = ^BufferReadSideEffect[-1]                    : &:r754_20, ~m?
+#  754|     v754_27(void)            = ^IndirectReadSideEffect[-1]                  : &:r754_20, ~m?
 #-----|     v0_15(void)              = ^BufferReadSideEffect[0]                     : &:r0_14, ~m?
 #  754|     mu754_28(String)         = ^IndirectMayWriteSideEffect[-1]              : &:r754_20
 #-----|     r0_16(glval<String>)     = CopyValue                                    : r754_25
@@ -4220,7 +4219,7 @@ ir.cpp:
 #-----|     r0_8(Middle &)            = CopyValue                                    : r763_14
 #  763|     r763_15(Middle &)         = Call[operator=]                              : func:r763_10, this:r0_5, 0:r0_8
 #  763|     mu763_16(unknown)         = ^CallSideEffect                              : ~m?
-#-----|     v0_9(void)                = ^BufferReadSideEffect[-1]                    : &:r0_5, ~m?
+#-----|     v0_9(void)                = ^IndirectReadSideEffect[-1]                  : &:r0_5, ~m?
 #-----|     v0_10(void)               = ^BufferReadSideEffect[0]                     : &:r0_8, ~m?
 #-----|     mu0_11(Middle)            = ^IndirectMayWriteSideEffect[-1]              : &:r0_5
 #-----|     r0_12(glval<Middle>)      = CopyValue                                    : r763_15
@@ -4236,7 +4235,7 @@ ir.cpp:
 #-----|     r0_14(String &)           = CopyValue                                    : r763_24
 #  763|     r763_25(String &)         = Call[operator=]                              : func:r763_21, this:r763_20, 0:r0_14
 #  763|     mu763_26(unknown)         = ^CallSideEffect                              : ~m?
-#  763|     v763_27(void)             = ^BufferReadSideEffect[-1]                    : &:r763_20, ~m?
+#  763|     v763_27(void)             = ^IndirectReadSideEffect[-1]                  : &:r763_20, ~m?
 #-----|     v0_15(void)               = ^BufferReadSideEffect[0]                     : &:r0_14, ~m?
 #  763|     mu763_28(String)          = ^IndirectMayWriteSideEffect[-1]              : &:r763_20
 #-----|     r0_16(glval<String>)      = CopyValue                                    : r763_25
@@ -4505,7 +4504,7 @@ ir.cpp:
 #  808|     r808_5(Base &)             = CopyValue                                 : r808_4
 #  808|     r808_6(Base &)             = Call[operator=]                           : func:r808_2, this:r808_1, 0:r808_5
 #  808|     mu808_7(unknown)           = ^CallSideEffect                           : ~m?
-#  808|     v808_8(void)               = ^BufferReadSideEffect[-1]                 : &:r808_1, ~m?
+#  808|     v808_8(void)               = ^IndirectReadSideEffect[-1]               : &:r808_1, ~m?
 #  808|     v808_9(void)               = ^BufferReadSideEffect[0]                  : &:r808_5, ~m?
 #  808|     mu808_10(Base)             = ^IndirectMayWriteSideEffect[-1]           : &:r808_1
 #  808|     r808_11(glval<Base>)       = CopyValue                                 : r808_6
@@ -4525,7 +4524,7 @@ ir.cpp:
 #  809|     r809_14(Base &)            = CopyValue                                 : r809_13
 #  809|     r809_15(Base &)            = Call[operator=]                           : func:r809_2, this:r809_1, 0:r809_14
 #  809|     mu809_16(unknown)          = ^CallSideEffect                           : ~m?
-#  809|     v809_17(void)              = ^BufferReadSideEffect[-1]                 : &:r809_1, ~m?
+#  809|     v809_17(void)              = ^IndirectReadSideEffect[-1]               : &:r809_1, ~m?
 #  809|     v809_18(void)              = ^BufferReadSideEffect[0]                  : &:r809_14, ~m?
 #  809|     mu809_19(Base)             = ^IndirectMayWriteSideEffect[-1]           : &:r809_1
 #  809|     r809_20(glval<Base>)       = CopyValue                                 : r809_15
@@ -4545,7 +4544,7 @@ ir.cpp:
 #  810|     r810_14(Base &)            = CopyValue                                 : r810_13
 #  810|     r810_15(Base &)            = Call[operator=]                           : func:r810_2, this:r810_1, 0:r810_14
 #  810|     mu810_16(unknown)          = ^CallSideEffect                           : ~m?
-#  810|     v810_17(void)              = ^BufferReadSideEffect[-1]                 : &:r810_1, ~m?
+#  810|     v810_17(void)              = ^IndirectReadSideEffect[-1]               : &:r810_1, ~m?
 #  810|     v810_18(void)              = ^BufferReadSideEffect[0]                  : &:r810_14, ~m?
 #  810|     mu810_19(Base)             = ^IndirectMayWriteSideEffect[-1]           : &:r810_1
 #  810|     r810_20(glval<Base>)       = CopyValue                                 : r810_15
@@ -4577,7 +4576,7 @@ ir.cpp:
 #  816|     r816_6(Middle &)           = CopyValue                                 : r816_5
 #  816|     r816_7(Middle &)           = Call[operator=]                           : func:r816_2, this:r816_1, 0:r816_6
 #  816|     mu816_8(unknown)           = ^CallSideEffect                           : ~m?
-#  816|     v816_9(void)               = ^BufferReadSideEffect[-1]                 : &:r816_1, ~m?
+#  816|     v816_9(void)               = ^IndirectReadSideEffect[-1]               : &:r816_1, ~m?
 #  816|     v816_10(void)              = ^BufferReadSideEffect[0]                  : &:r816_6, ~m?
 #  816|     mu816_11(Middle)           = ^IndirectMayWriteSideEffect[-1]           : &:r816_1
 #  816|     r816_12(glval<Middle>)     = CopyValue                                 : r816_7
@@ -4589,7 +4588,7 @@ ir.cpp:
 #  817|     r817_6(Middle &)           = CopyValue                                 : r817_5
 #  817|     r817_7(Middle &)           = Call[operator=]                           : func:r817_2, this:r817_1, 0:r817_6
 #  817|     mu817_8(unknown)           = ^CallSideEffect                           : ~m?
-#  817|     v817_9(void)               = ^BufferReadSideEffect[-1]                 : &:r817_1, ~m?
+#  817|     v817_9(void)               = ^IndirectReadSideEffect[-1]               : &:r817_1, ~m?
 #  817|     v817_10(void)              = ^BufferReadSideEffect[0]                  : &:r817_6, ~m?
 #  817|     mu817_11(Middle)           = ^IndirectMayWriteSideEffect[-1]           : &:r817_1
 #  817|     r817_12(glval<Middle>)     = CopyValue                                 : r817_7
@@ -4616,7 +4615,7 @@ ir.cpp:
 #  822|     r822_6(Base &)             = CopyValue                                 : r822_5
 #  822|     r822_7(Base &)             = Call[operator=]                           : func:r822_2, this:r822_1, 0:r822_6
 #  822|     mu822_8(unknown)           = ^CallSideEffect                           : ~m?
-#  822|     v822_9(void)               = ^BufferReadSideEffect[-1]                 : &:r822_1, ~m?
+#  822|     v822_9(void)               = ^IndirectReadSideEffect[-1]               : &:r822_1, ~m?
 #  822|     v822_10(void)              = ^BufferReadSideEffect[0]                  : &:r822_6, ~m?
 #  822|     mu822_11(Base)             = ^IndirectMayWriteSideEffect[-1]           : &:r822_1
 #  822|     r822_12(glval<Base>)       = CopyValue                                 : r822_7
@@ -4637,7 +4636,7 @@ ir.cpp:
 #  823|     r823_15(Base &)            = CopyValue                                 : r823_14
 #  823|     r823_16(Base &)            = Call[operator=]                           : func:r823_2, this:r823_1, 0:r823_15
 #  823|     mu823_17(unknown)          = ^CallSideEffect                           : ~m?
-#  823|     v823_18(void)              = ^BufferReadSideEffect[-1]                 : &:r823_1, ~m?
+#  823|     v823_18(void)              = ^IndirectReadSideEffect[-1]               : &:r823_1, ~m?
 #  823|     v823_19(void)              = ^BufferReadSideEffect[0]                  : &:r823_15, ~m?
 #  823|     mu823_20(Base)             = ^IndirectMayWriteSideEffect[-1]           : &:r823_1
 #  823|     r823_21(glval<Base>)       = CopyValue                                 : r823_16
@@ -4658,7 +4657,7 @@ ir.cpp:
 #  824|     r824_15(Base &)            = CopyValue                                 : r824_14
 #  824|     r824_16(Base &)            = Call[operator=]                           : func:r824_2, this:r824_1, 0:r824_15
 #  824|     mu824_17(unknown)          = ^CallSideEffect                           : ~m?
-#  824|     v824_18(void)              = ^BufferReadSideEffect[-1]                 : &:r824_1, ~m?
+#  824|     v824_18(void)              = ^IndirectReadSideEffect[-1]               : &:r824_1, ~m?
 #  824|     v824_19(void)              = ^BufferReadSideEffect[0]                  : &:r824_15, ~m?
 #  824|     mu824_20(Base)             = ^IndirectMayWriteSideEffect[-1]           : &:r824_1
 #  824|     r824_21(glval<Base>)       = CopyValue                                 : r824_16
@@ -4694,7 +4693,7 @@ ir.cpp:
 #  830|     r830_7(Derived &)          = CopyValue                                 : r830_6
 #  830|     r830_8(Derived &)          = Call[operator=]                           : func:r830_2, this:r830_1, 0:r830_7
 #  830|     mu830_9(unknown)           = ^CallSideEffect                           : ~m?
-#  830|     v830_10(void)              = ^BufferReadSideEffect[-1]                 : &:r830_1, ~m?
+#  830|     v830_10(void)              = ^IndirectReadSideEffect[-1]               : &:r830_1, ~m?
 #  830|     v830_11(void)              = ^BufferReadSideEffect[0]                  : &:r830_7, ~m?
 #  830|     mu830_12(Derived)          = ^IndirectMayWriteSideEffect[-1]           : &:r830_1
 #  830|     r830_13(glval<Derived>)    = CopyValue                                 : r830_8
@@ -4707,7 +4706,7 @@ ir.cpp:
 #  831|     r831_7(Derived &)          = CopyValue                                 : r831_6
 #  831|     r831_8(Derived &)          = Call[operator=]                           : func:r831_2, this:r831_1, 0:r831_7
 #  831|     mu831_9(unknown)           = ^CallSideEffect                           : ~m?
-#  831|     v831_10(void)              = ^BufferReadSideEffect[-1]                 : &:r831_1, ~m?
+#  831|     v831_10(void)              = ^IndirectReadSideEffect[-1]               : &:r831_1, ~m?
 #  831|     v831_11(void)              = ^BufferReadSideEffect[0]                  : &:r831_7, ~m?
 #  831|     mu831_12(Derived)          = ^IndirectMayWriteSideEffect[-1]           : &:r831_1
 #  831|     r831_13(glval<Derived>)    = CopyValue                                 : r831_8
@@ -5688,7 +5687,7 @@ ir.cpp:
 # 1044|     r1044_4(float)                            = Constant[1.0]                          : 
 # 1044|     r1044_5(char)                             = Call[operator()]                       : func:r1044_3, this:r1044_2, 0:r1044_4
 # 1044|     mu1044_6(unknown)                         = ^CallSideEffect                        : ~m?
-# 1044|     v1044_7(void)                             = ^BufferReadSideEffect[-1]              : &:r1044_2, ~m?
+# 1044|     v1044_7(void)                             = ^IndirectReadSideEffect[-1]            : &:r1044_2, ~m?
 # 1045|     r1045_1(glval<decltype([...](...){...})>) = VariableAddress[lambda_val]            : 
 # 1045|     r1045_2(glval<decltype([...](...){...})>) = VariableAddress[#temp1045:20]          : 
 # 1045|     mu1045_3(decltype([...](...){...}))       = Uninitialized[#temp1045:20]            : &:r1045_2
@@ -5709,7 +5708,7 @@ ir.cpp:
 # 1046|     r1046_4(float)                            = Constant[2.0]                          : 
 # 1046|     r1046_5(char)                             = Call[operator()]                       : func:r1046_3, this:r1046_2, 0:r1046_4
 # 1046|     mu1046_6(unknown)                         = ^CallSideEffect                        : ~m?
-# 1046|     v1046_7(void)                             = ^BufferReadSideEffect[-1]              : &:r1046_2, ~m?
+# 1046|     v1046_7(void)                             = ^IndirectReadSideEffect[-1]            : &:r1046_2, ~m?
 # 1047|     r1047_1(glval<decltype([...](...){...})>) = VariableAddress[lambda_ref_explicit]   : 
 # 1047|     r1047_2(glval<decltype([...](...){...})>) = VariableAddress[#temp1047:29]          : 
 # 1047|     mu1047_3(decltype([...](...){...}))       = Uninitialized[#temp1047:29]            : &:r1047_2
@@ -5727,7 +5726,7 @@ ir.cpp:
 # 1048|     r1048_4(float)                            = Constant[3.0]                          : 
 # 1048|     r1048_5(char)                             = Call[operator()]                       : func:r1048_3, this:r1048_2, 0:r1048_4
 # 1048|     mu1048_6(unknown)                         = ^CallSideEffect                        : ~m?
-# 1048|     v1048_7(void)                             = ^BufferReadSideEffect[-1]              : &:r1048_2, ~m?
+# 1048|     v1048_7(void)                             = ^IndirectReadSideEffect[-1]            : &:r1048_2, ~m?
 # 1049|     r1049_1(glval<decltype([...](...){...})>) = VariableAddress[lambda_val_explicit]   : 
 # 1049|     r1049_2(glval<decltype([...](...){...})>) = VariableAddress[#temp1049:29]          : 
 # 1049|     mu1049_3(decltype([...](...){...}))       = Uninitialized[#temp1049:29]            : &:r1049_2
@@ -5744,7 +5743,7 @@ ir.cpp:
 # 1050|     r1050_4(float)                            = Constant[4.0]                          : 
 # 1050|     r1050_5(char)                             = Call[operator()]                       : func:r1050_3, this:r1050_2, 0:r1050_4
 # 1050|     mu1050_6(unknown)                         = ^CallSideEffect                        : ~m?
-# 1050|     v1050_7(void)                             = ^BufferReadSideEffect[-1]              : &:r1050_2, ~m?
+# 1050|     v1050_7(void)                             = ^IndirectReadSideEffect[-1]            : &:r1050_2, ~m?
 # 1051|     r1051_1(glval<decltype([...](...){...})>) = VariableAddress[lambda_mixed_explicit] : 
 # 1051|     r1051_2(glval<decltype([...](...){...})>) = VariableAddress[#temp1051:31]          : 
 # 1051|     mu1051_3(decltype([...](...){...}))       = Uninitialized[#temp1051:31]            : &:r1051_2
@@ -5766,7 +5765,7 @@ ir.cpp:
 # 1052|     r1052_4(float)                            = Constant[5.0]                          : 
 # 1052|     r1052_5(char)                             = Call[operator()]                       : func:r1052_3, this:r1052_2, 0:r1052_4
 # 1052|     mu1052_6(unknown)                         = ^CallSideEffect                        : ~m?
-# 1052|     v1052_7(void)                             = ^BufferReadSideEffect[-1]              : &:r1052_2, ~m?
+# 1052|     v1052_7(void)                             = ^IndirectReadSideEffect[-1]            : &:r1052_2, ~m?
 # 1053|     r1053_1(glval<int>)                       = VariableAddress[r]                     : 
 # 1053|     r1053_2(glval<int>)                       = VariableAddress[x]                     : 
 # 1053|     r1053_3(int)                              = Load[x]                                : &:r1053_2, ~m?
@@ -5804,7 +5803,7 @@ ir.cpp:
 # 1055|     r1055_4(float)                            = Constant[6.0]                          : 
 # 1055|     r1055_5(char)                             = Call[operator()]                       : func:r1055_3, this:r1055_2, 0:r1055_4
 # 1055|     mu1055_6(unknown)                         = ^CallSideEffect                        : ~m?
-# 1055|     v1055_7(void)                             = ^BufferReadSideEffect[-1]              : &:r1055_2, ~m?
+# 1055|     v1055_7(void)                             = ^IndirectReadSideEffect[-1]            : &:r1055_2, ~m?
 # 1056|     v1056_1(void)                             = NoOp                                   : 
 # 1040|     v1040_10(void)                            = ReturnIndirection[s]                   : &:r1040_8, ~m?
 # 1040|     v1040_11(void)                            = ReturnVoid                             : 
@@ -5869,7 +5868,7 @@ ir.cpp:
 # 1043|     r1043_16(glval<unknown>)                         = FunctionAddress[c_str]       : 
 # 1043|     r1043_17(char *)                                 = Call[c_str]                  : func:r1043_16, this:r1043_15
 # 1043|     mu1043_18(unknown)                               = ^CallSideEffect              : ~m?
-# 1043|     v1043_19(void)                                   = ^BufferReadSideEffect[-1]    : &:r1043_15, ~m?
+# 1043|     v1043_19(void)                                   = ^IndirectReadSideEffect[-1]  : &:r1043_15, ~m?
 # 1043|     r1043_20(glval<unknown>)                         = VariableAddress[#this]       : 
 # 1043|     r1043_21(lambda [] type at line 1043, col. 21 *) = Load[#this]                  : &:r1043_20, ~m?
 # 1043|     r1043_22(glval<int &>)                           = FieldAddress[x]              : r1043_21
@@ -5921,7 +5920,7 @@ ir.cpp:
 # 1045|     r1045_14(glval<unknown>)                         = FunctionAddress[c_str]       : 
 # 1045|     r1045_15(char *)                                 = Call[c_str]                  : func:r1045_14, this:r1045_13
 # 1045|     mu1045_16(unknown)                               = ^CallSideEffect              : ~m?
-# 1045|     v1045_17(void)                                   = ^BufferReadSideEffect[-1]    : &:r1045_13, ~m?
+# 1045|     v1045_17(void)                                   = ^IndirectReadSideEffect[-1]  : &:r1045_13, ~m?
 # 1045|     r1045_18(glval<unknown>)                         = VariableAddress[#this]       : 
 # 1045|     r1045_19(lambda [] type at line 1045, col. 21 *) = Load[#this]                  : &:r1045_18, ~m?
 # 1045|     r1045_20(glval<int>)                             = FieldAddress[x]              : r1045_19
@@ -5955,7 +5954,7 @@ ir.cpp:
 # 1047|     r1047_16(glval<unknown>)                         = FunctionAddress[c_str]       : 
 # 1047|     r1047_17(char *)                                 = Call[c_str]                  : func:r1047_16, this:r1047_15
 # 1047|     mu1047_18(unknown)                               = ^CallSideEffect              : ~m?
-# 1047|     v1047_19(void)                                   = ^BufferReadSideEffect[-1]    : &:r1047_15, ~m?
+# 1047|     v1047_19(void)                                   = ^IndirectReadSideEffect[-1]  : &:r1047_15, ~m?
 # 1047|     r1047_20(int)                                    = Constant[0]                  : 
 # 1047|     r1047_21(glval<char>)                            = PointerAdd[1]                : r1047_17, r1047_20
 # 1047|     r1047_22(char)                                   = Load[?]                      : &:r1047_21, ~m?
@@ -6003,7 +6002,7 @@ ir.cpp:
 # 1049|     r1049_14(glval<unknown>)                         = FunctionAddress[c_str]       : 
 # 1049|     r1049_15(char *)                                 = Call[c_str]                  : func:r1049_14, this:r1049_13
 # 1049|     mu1049_16(unknown)                               = ^CallSideEffect              : ~m?
-# 1049|     v1049_17(void)                                   = ^BufferReadSideEffect[-1]    : &:r1049_13, ~m?
+# 1049|     v1049_17(void)                                   = ^IndirectReadSideEffect[-1]  : &:r1049_13, ~m?
 # 1049|     r1049_18(int)                                    = Constant[0]                  : 
 # 1049|     r1049_19(glval<char>)                            = PointerAdd[1]                : r1049_15, r1049_18
 # 1049|     r1049_20(char)                                   = Load[?]                      : &:r1049_19, ~m?
@@ -6034,7 +6033,7 @@ ir.cpp:
 # 1051|     r1051_16(glval<unknown>)                         = FunctionAddress[c_str]       : 
 # 1051|     r1051_17(char *)                                 = Call[c_str]                  : func:r1051_16, this:r1051_15
 # 1051|     mu1051_18(unknown)                               = ^CallSideEffect              : ~m?
-# 1051|     v1051_19(void)                                   = ^BufferReadSideEffect[-1]    : &:r1051_15, ~m?
+# 1051|     v1051_19(void)                                   = ^IndirectReadSideEffect[-1]  : &:r1051_15, ~m?
 # 1051|     r1051_20(glval<unknown>)                         = VariableAddress[#this]       : 
 # 1051|     r1051_21(lambda [] type at line 1051, col. 32 *) = Load[#this]                  : &:r1051_20, ~m?
 # 1051|     r1051_22(glval<int>)                             = FieldAddress[x]              : r1051_21
@@ -6068,7 +6067,7 @@ ir.cpp:
 # 1054|     r1054_16(glval<unknown>)                         = FunctionAddress[c_str]       : 
 # 1054|     r1054_17(char *)                                 = Call[c_str]                  : func:r1054_16, this:r1054_15
 # 1054|     mu1054_18(unknown)                               = ^CallSideEffect              : ~m?
-# 1054|     v1054_19(void)                                   = ^BufferReadSideEffect[-1]    : &:r1054_15, ~m?
+# 1054|     v1054_19(void)                                   = ^IndirectReadSideEffect[-1]  : &:r1054_15, ~m?
 # 1054|     r1054_20(glval<unknown>)                         = VariableAddress[#this]       : 
 # 1054|     r1054_21(lambda [] type at line 1054, col. 23 *) = Load[#this]                  : &:r1054_20, ~m?
 # 1054|     r1054_22(glval<int>)                             = FieldAddress[x]              : r1054_21
@@ -6095,37 +6094,37 @@ ir.cpp:
 
 # 1077| void RangeBasedFor(vector<int> const&)
 # 1077|   Block 0
-# 1077|     v1077_1(void)                  = EnterFunction              : 
-# 1077|     mu1077_2(unknown)              = AliasedDefinition          : 
-# 1077|     mu1077_3(unknown)              = InitializeNonLocal         : 
-# 1077|     r1077_4(glval<vector<int> &>)  = VariableAddress[v]         : 
-# 1077|     mu1077_5(vector<int> &)        = InitializeParameter[v]     : &:r1077_4
-# 1077|     r1077_6(vector<int> &)         = Load[v]                    : &:r1077_4, ~m?
-# 1077|     mu1077_7(unknown)              = InitializeIndirection[v]   : &:r1077_6
-# 1078|     r1078_1(glval<vector<int> &>)  = VariableAddress[(__range)] : 
-# 1078|     r1078_2(glval<vector<int> &>)  = VariableAddress[v]         : 
-# 1078|     r1078_3(vector<int> &)         = Load[v]                    : &:r1078_2, ~m?
-# 1078|     r1078_4(glval<vector<int>>)    = CopyValue                  : r1078_3
-# 1078|     r1078_5(vector<int> &)         = CopyValue                  : r1078_4
-# 1078|     mu1078_6(vector<int> &)        = Store[(__range)]           : &:r1078_1, r1078_5
-# 1078|     r1078_7(glval<iterator>)       = VariableAddress[(__begin)] : 
-# 1078|     r1078_8(glval<vector<int> &>)  = VariableAddress[(__range)] : 
-# 1078|     r1078_9(vector<int> &)         = Load[(__range)]            : &:r1078_8, ~m?
-#-----|     r0_1(glval<vector<int>>)       = CopyValue                  : r1078_9
-# 1078|     r1078_10(glval<unknown>)       = FunctionAddress[begin]     : 
-# 1078|     r1078_11(iterator)             = Call[begin]                : func:r1078_10, this:r0_1
-# 1078|     mu1078_12(unknown)             = ^CallSideEffect            : ~m?
-#-----|     v0_2(void)                     = ^BufferReadSideEffect[-1]  : &:r0_1, ~m?
-# 1078|     mu1078_13(iterator)            = Store[(__begin)]           : &:r1078_7, r1078_11
-# 1078|     r1078_14(glval<iterator>)      = VariableAddress[(__end)]   : 
-# 1078|     r1078_15(glval<vector<int> &>) = VariableAddress[(__range)] : 
-# 1078|     r1078_16(vector<int> &)        = Load[(__range)]            : &:r1078_15, ~m?
-#-----|     r0_3(glval<vector<int>>)       = CopyValue                  : r1078_16
-# 1078|     r1078_17(glval<unknown>)       = FunctionAddress[end]       : 
-# 1078|     r1078_18(iterator)             = Call[end]                  : func:r1078_17, this:r0_3
-# 1078|     mu1078_19(unknown)             = ^CallSideEffect            : ~m?
-#-----|     v0_4(void)                     = ^BufferReadSideEffect[-1]  : &:r0_3, ~m?
-# 1078|     mu1078_20(iterator)            = Store[(__end)]             : &:r1078_14, r1078_18
+# 1077|     v1077_1(void)                  = EnterFunction               : 
+# 1077|     mu1077_2(unknown)              = AliasedDefinition           : 
+# 1077|     mu1077_3(unknown)              = InitializeNonLocal          : 
+# 1077|     r1077_4(glval<vector<int> &>)  = VariableAddress[v]          : 
+# 1077|     mu1077_5(vector<int> &)        = InitializeParameter[v]      : &:r1077_4
+# 1077|     r1077_6(vector<int> &)         = Load[v]                     : &:r1077_4, ~m?
+# 1077|     mu1077_7(unknown)              = InitializeIndirection[v]    : &:r1077_6
+# 1078|     r1078_1(glval<vector<int> &>)  = VariableAddress[(__range)]  : 
+# 1078|     r1078_2(glval<vector<int> &>)  = VariableAddress[v]          : 
+# 1078|     r1078_3(vector<int> &)         = Load[v]                     : &:r1078_2, ~m?
+# 1078|     r1078_4(glval<vector<int>>)    = CopyValue                   : r1078_3
+# 1078|     r1078_5(vector<int> &)         = CopyValue                   : r1078_4
+# 1078|     mu1078_6(vector<int> &)        = Store[(__range)]            : &:r1078_1, r1078_5
+# 1078|     r1078_7(glval<iterator>)       = VariableAddress[(__begin)]  : 
+# 1078|     r1078_8(glval<vector<int> &>)  = VariableAddress[(__range)]  : 
+# 1078|     r1078_9(vector<int> &)         = Load[(__range)]             : &:r1078_8, ~m?
+#-----|     r0_1(glval<vector<int>>)       = CopyValue                   : r1078_9
+# 1078|     r1078_10(glval<unknown>)       = FunctionAddress[begin]      : 
+# 1078|     r1078_11(iterator)             = Call[begin]                 : func:r1078_10, this:r0_1
+# 1078|     mu1078_12(unknown)             = ^CallSideEffect             : ~m?
+#-----|     v0_2(void)                     = ^IndirectReadSideEffect[-1] : &:r0_1, ~m?
+# 1078|     mu1078_13(iterator)            = Store[(__begin)]            : &:r1078_7, r1078_11
+# 1078|     r1078_14(glval<iterator>)      = VariableAddress[(__end)]    : 
+# 1078|     r1078_15(glval<vector<int> &>) = VariableAddress[(__range)]  : 
+# 1078|     r1078_16(vector<int> &)        = Load[(__range)]             : &:r1078_15, ~m?
+#-----|     r0_3(glval<vector<int>>)       = CopyValue                   : r1078_16
+# 1078|     r1078_17(glval<unknown>)       = FunctionAddress[end]        : 
+# 1078|     r1078_18(iterator)             = Call[end]                   : func:r1078_17, this:r0_3
+# 1078|     mu1078_19(unknown)             = ^CallSideEffect             : ~m?
+#-----|     v0_4(void)                     = ^IndirectReadSideEffect[-1] : &:r0_3, ~m?
+# 1078|     mu1078_20(iterator)            = Store[(__end)]              : &:r1078_14, r1078_18
 #-----|   Goto -> Block 1
 
 # 1078|   Block 1
@@ -6136,26 +6135,26 @@ ir.cpp:
 # 1078|     r1078_24(iterator)        = Load[(__end)]               : &:r1078_23, ~m?
 # 1078|     r1078_25(bool)            = Call[operator!=]            : func:r1078_22, this:r0_5, 0:r1078_24
 # 1078|     mu1078_26(unknown)        = ^CallSideEffect             : ~m?
-#-----|     v0_6(void)                = ^BufferReadSideEffect[-1]   : &:r0_5, ~m?
+#-----|     v0_6(void)                = ^IndirectReadSideEffect[-1] : &:r0_5, ~m?
 # 1078|     v1078_27(void)            = ConditionalBranch           : r1078_25
 #-----|   False -> Block 5
 #-----|   True -> Block 2
 
 # 1078|   Block 2
-# 1078|     r1078_28(glval<int>)      = VariableAddress[e]         : 
-# 1078|     r1078_29(glval<iterator>) = VariableAddress[(__begin)] : 
-#-----|     r0_7(glval<iterator>)     = Convert                    : r1078_29
-# 1078|     r1078_30(glval<unknown>)  = FunctionAddress[operator*] : 
-# 1078|     r1078_31(int &)           = Call[operator*]            : func:r1078_30, this:r0_7
-# 1078|     mu1078_32(unknown)        = ^CallSideEffect            : ~m?
-#-----|     v0_8(void)                = ^BufferReadSideEffect[-1]  : &:r0_7, ~m?
-# 1078|     r1078_33(int)             = Load[?]                    : &:r1078_31, ~m?
-# 1078|     mu1078_34(int)            = Store[e]                   : &:r1078_28, r1078_33
-# 1079|     r1079_1(glval<int>)       = VariableAddress[e]         : 
-# 1079|     r1079_2(int)              = Load[e]                    : &:r1079_1, ~m?
-# 1079|     r1079_3(int)              = Constant[0]                : 
-# 1079|     r1079_4(bool)             = CompareGT                  : r1079_2, r1079_3
-# 1079|     v1079_5(void)             = ConditionalBranch          : r1079_4
+# 1078|     r1078_28(glval<int>)      = VariableAddress[e]          : 
+# 1078|     r1078_29(glval<iterator>) = VariableAddress[(__begin)]  : 
+#-----|     r0_7(glval<iterator>)     = Convert                     : r1078_29
+# 1078|     r1078_30(glval<unknown>)  = FunctionAddress[operator*]  : 
+# 1078|     r1078_31(int &)           = Call[operator*]             : func:r1078_30, this:r0_7
+# 1078|     mu1078_32(unknown)        = ^CallSideEffect             : ~m?
+#-----|     v0_8(void)                = ^IndirectReadSideEffect[-1] : &:r0_7, ~m?
+# 1078|     r1078_33(int)             = Load[?]                     : &:r1078_31, ~m?
+# 1078|     mu1078_34(int)            = Store[e]                    : &:r1078_28, r1078_33
+# 1079|     r1079_1(glval<int>)       = VariableAddress[e]          : 
+# 1079|     r1079_2(int)              = Load[e]                     : &:r1079_1, ~m?
+# 1079|     r1079_3(int)              = Constant[0]                 : 
+# 1079|     r1079_4(bool)             = CompareGT                   : r1079_2, r1079_3
+# 1079|     v1079_5(void)             = ConditionalBranch           : r1079_4
 #-----|   False -> Block 4
 #-----|   True -> Block 3
 
@@ -6169,36 +6168,36 @@ ir.cpp:
 # 1078|     r1078_37(glval<unknown>)  = FunctionAddress[operator++]     : 
 # 1078|     r1078_38(iterator &)      = Call[operator++]                : func:r1078_37, this:r1078_36
 # 1078|     mu1078_39(unknown)        = ^CallSideEffect                 : ~m?
-# 1078|     v1078_40(void)            = ^BufferReadSideEffect[-1]       : &:r1078_36, ~m?
+# 1078|     v1078_40(void)            = ^IndirectReadSideEffect[-1]     : &:r1078_36, ~m?
 # 1078|     mu1078_41(iterator)       = ^IndirectMayWriteSideEffect[-1] : &:r1078_36
 # 1078|     r1078_42(glval<iterator>) = CopyValue                       : r1078_38
 #-----|   Goto (back edge) -> Block 1
 
 # 1084|   Block 5
-# 1084|     r1084_1(glval<vector<int> &>)  = VariableAddress[(__range)] : 
-# 1084|     r1084_2(glval<vector<int> &>)  = VariableAddress[v]         : 
-# 1084|     r1084_3(vector<int> &)         = Load[v]                    : &:r1084_2, ~m?
-# 1084|     r1084_4(glval<vector<int>>)    = CopyValue                  : r1084_3
-# 1084|     r1084_5(vector<int> &)         = CopyValue                  : r1084_4
-# 1084|     mu1084_6(vector<int> &)        = Store[(__range)]           : &:r1084_1, r1084_5
-# 1084|     r1084_7(glval<iterator>)       = VariableAddress[(__begin)] : 
-# 1084|     r1084_8(glval<vector<int> &>)  = VariableAddress[(__range)] : 
-# 1084|     r1084_9(vector<int> &)         = Load[(__range)]            : &:r1084_8, ~m?
-#-----|     r0_9(glval<vector<int>>)       = CopyValue                  : r1084_9
-# 1084|     r1084_10(glval<unknown>)       = FunctionAddress[begin]     : 
-# 1084|     r1084_11(iterator)             = Call[begin]                : func:r1084_10, this:r0_9
-# 1084|     mu1084_12(unknown)             = ^CallSideEffect            : ~m?
-#-----|     v0_10(void)                    = ^BufferReadSideEffect[-1]  : &:r0_9, ~m?
-# 1084|     mu1084_13(iterator)            = Store[(__begin)]           : &:r1084_7, r1084_11
-# 1084|     r1084_14(glval<iterator>)      = VariableAddress[(__end)]   : 
-# 1084|     r1084_15(glval<vector<int> &>) = VariableAddress[(__range)] : 
-# 1084|     r1084_16(vector<int> &)        = Load[(__range)]            : &:r1084_15, ~m?
-#-----|     r0_11(glval<vector<int>>)      = CopyValue                  : r1084_16
-# 1084|     r1084_17(glval<unknown>)       = FunctionAddress[end]       : 
-# 1084|     r1084_18(iterator)             = Call[end]                  : func:r1084_17, this:r0_11
-# 1084|     mu1084_19(unknown)             = ^CallSideEffect            : ~m?
-#-----|     v0_12(void)                    = ^BufferReadSideEffect[-1]  : &:r0_11, ~m?
-# 1084|     mu1084_20(iterator)            = Store[(__end)]             : &:r1084_14, r1084_18
+# 1084|     r1084_1(glval<vector<int> &>)  = VariableAddress[(__range)]  : 
+# 1084|     r1084_2(glval<vector<int> &>)  = VariableAddress[v]          : 
+# 1084|     r1084_3(vector<int> &)         = Load[v]                     : &:r1084_2, ~m?
+# 1084|     r1084_4(glval<vector<int>>)    = CopyValue                   : r1084_3
+# 1084|     r1084_5(vector<int> &)         = CopyValue                   : r1084_4
+# 1084|     mu1084_6(vector<int> &)        = Store[(__range)]            : &:r1084_1, r1084_5
+# 1084|     r1084_7(glval<iterator>)       = VariableAddress[(__begin)]  : 
+# 1084|     r1084_8(glval<vector<int> &>)  = VariableAddress[(__range)]  : 
+# 1084|     r1084_9(vector<int> &)         = Load[(__range)]             : &:r1084_8, ~m?
+#-----|     r0_9(glval<vector<int>>)       = CopyValue                   : r1084_9
+# 1084|     r1084_10(glval<unknown>)       = FunctionAddress[begin]      : 
+# 1084|     r1084_11(iterator)             = Call[begin]                 : func:r1084_10, this:r0_9
+# 1084|     mu1084_12(unknown)             = ^CallSideEffect             : ~m?
+#-----|     v0_10(void)                    = ^IndirectReadSideEffect[-1] : &:r0_9, ~m?
+# 1084|     mu1084_13(iterator)            = Store[(__begin)]            : &:r1084_7, r1084_11
+# 1084|     r1084_14(glval<iterator>)      = VariableAddress[(__end)]    : 
+# 1084|     r1084_15(glval<vector<int> &>) = VariableAddress[(__range)]  : 
+# 1084|     r1084_16(vector<int> &)        = Load[(__range)]             : &:r1084_15, ~m?
+#-----|     r0_11(glval<vector<int>>)      = CopyValue                   : r1084_16
+# 1084|     r1084_17(glval<unknown>)       = FunctionAddress[end]        : 
+# 1084|     r1084_18(iterator)             = Call[end]                   : func:r1084_17, this:r0_11
+# 1084|     mu1084_19(unknown)             = ^CallSideEffect             : ~m?
+#-----|     v0_12(void)                    = ^IndirectReadSideEffect[-1] : &:r0_11, ~m?
+# 1084|     mu1084_20(iterator)            = Store[(__end)]              : &:r1084_14, r1084_18
 #-----|   Goto -> Block 6
 
 # 1084|   Block 6
@@ -6209,7 +6208,7 @@ ir.cpp:
 # 1084|     r1084_24(iterator)        = Load[(__end)]               : &:r1084_23, ~m?
 # 1084|     r1084_25(bool)            = Call[operator!=]            : func:r1084_22, this:r0_13, 0:r1084_24
 # 1084|     mu1084_26(unknown)        = ^CallSideEffect             : ~m?
-#-----|     v0_14(void)               = ^BufferReadSideEffect[-1]   : &:r0_13, ~m?
+#-----|     v0_14(void)               = ^IndirectReadSideEffect[-1] : &:r0_13, ~m?
 # 1084|     v1084_27(void)            = ConditionalBranch           : r1084_25
 #-----|   False -> Block 10
 #-----|   True -> Block 8
@@ -6219,29 +6218,29 @@ ir.cpp:
 # 1084|     r1084_29(glval<unknown>)  = FunctionAddress[operator++]     : 
 # 1084|     r1084_30(iterator &)      = Call[operator++]                : func:r1084_29, this:r1084_28
 # 1084|     mu1084_31(unknown)        = ^CallSideEffect                 : ~m?
-# 1084|     v1084_32(void)            = ^BufferReadSideEffect[-1]       : &:r1084_28, ~m?
+# 1084|     v1084_32(void)            = ^IndirectReadSideEffect[-1]     : &:r1084_28, ~m?
 # 1084|     mu1084_33(iterator)       = ^IndirectMayWriteSideEffect[-1] : &:r1084_28
 # 1084|     r1084_34(glval<iterator>) = CopyValue                       : r1084_30
 #-----|   Goto (back edge) -> Block 6
 
 # 1084|   Block 8
-# 1084|     r1084_35(glval<int &>)    = VariableAddress[e]         : 
-# 1084|     r1084_36(glval<iterator>) = VariableAddress[(__begin)] : 
-#-----|     r0_15(glval<iterator>)    = Convert                    : r1084_36
-# 1084|     r1084_37(glval<unknown>)  = FunctionAddress[operator*] : 
-# 1084|     r1084_38(int &)           = Call[operator*]            : func:r1084_37, this:r0_15
-# 1084|     mu1084_39(unknown)        = ^CallSideEffect            : ~m?
-#-----|     v0_16(void)               = ^BufferReadSideEffect[-1]  : &:r0_15, ~m?
-# 1084|     r1084_40(glval<int>)      = CopyValue                  : r1084_38
-# 1084|     r1084_41(glval<int>)      = Convert                    : r1084_40
-# 1084|     r1084_42(int &)           = CopyValue                  : r1084_41
-# 1084|     mu1084_43(int &)          = Store[e]                   : &:r1084_35, r1084_42
-# 1085|     r1085_1(glval<int &>)     = VariableAddress[e]         : 
-# 1085|     r1085_2(int &)            = Load[e]                    : &:r1085_1, ~m?
-# 1085|     r1085_3(int)              = Load[?]                    : &:r1085_2, ~m?
-# 1085|     r1085_4(int)              = Constant[5]                : 
-# 1085|     r1085_5(bool)             = CompareLT                  : r1085_3, r1085_4
-# 1085|     v1085_6(void)             = ConditionalBranch          : r1085_5
+# 1084|     r1084_35(glval<int &>)    = VariableAddress[e]          : 
+# 1084|     r1084_36(glval<iterator>) = VariableAddress[(__begin)]  : 
+#-----|     r0_15(glval<iterator>)    = Convert                     : r1084_36
+# 1084|     r1084_37(glval<unknown>)  = FunctionAddress[operator*]  : 
+# 1084|     r1084_38(int &)           = Call[operator*]             : func:r1084_37, this:r0_15
+# 1084|     mu1084_39(unknown)        = ^CallSideEffect             : ~m?
+#-----|     v0_16(void)               = ^IndirectReadSideEffect[-1] : &:r0_15, ~m?
+# 1084|     r1084_40(glval<int>)      = CopyValue                   : r1084_38
+# 1084|     r1084_41(glval<int>)      = Convert                     : r1084_40
+# 1084|     r1084_42(int &)           = CopyValue                   : r1084_41
+# 1084|     mu1084_43(int &)          = Store[e]                    : &:r1084_35, r1084_42
+# 1085|     r1085_1(glval<int &>)     = VariableAddress[e]          : 
+# 1085|     r1085_2(int &)            = Load[e]                     : &:r1085_1, ~m?
+# 1085|     r1085_3(int)              = Load[?]                     : &:r1085_2, ~m?
+# 1085|     r1085_4(int)              = Constant[5]                 : 
+# 1085|     r1085_5(bool)             = CompareLT                   : r1085_3, r1085_4
+# 1085|     v1085_6(void)             = ConditionalBranch           : r1085_5
 #-----|   False -> Block 7
 #-----|   True -> Block 9
 
@@ -7525,7 +7524,7 @@ ir.cpp:
 # 1373|     r1373_8(glval<unknown>)  = FunctionAddress[c_str]            : 
 # 1373|     r1373_9(char *)          = Call[c_str]                       : func:r1373_8, this:r1373_7
 # 1373|     mu1373_10(unknown)       = ^CallSideEffect                   : ~m?
-# 1373|     v1373_11(void)           = ^BufferReadSideEffect[-1]         : &:r1373_7, ~m?
+# 1373|     v1373_11(void)           = ^IndirectReadSideEffect[-1]       : &:r1373_7, ~m?
 # 1374|     r1374_1(glval<String>)   = VariableAddress[#temp1374:5]      : 
 # 1374|     r1374_2(glval<unknown>)  = FunctionAddress[returnValue]      : 
 # 1374|     r1374_3(String)          = Call[returnValue]                 : func:r1374_2
@@ -7535,7 +7534,7 @@ ir.cpp:
 # 1374|     r1374_7(glval<unknown>)  = FunctionAddress[c_str]            : 
 # 1374|     r1374_8(char *)          = Call[c_str]                       : func:r1374_7, this:r1374_6
 # 1374|     mu1374_9(unknown)        = ^CallSideEffect                   : ~m?
-# 1374|     v1374_10(void)           = ^BufferReadSideEffect[-1]         : &:r1374_6, ~m?
+# 1374|     v1374_10(void)           = ^IndirectReadSideEffect[-1]       : &:r1374_6, ~m?
 # 1376|     r1376_1(glval<String>)   = VariableAddress[#temp1376:5]      : 
 # 1376|     r1376_2(glval<unknown>)  = FunctionAddress[defaultConstruct] : 
 # 1376|     r1376_3(String)          = Call[defaultConstruct]            : func:r1376_2
@@ -7589,7 +7588,7 @@ ir.cpp:
 # 1385|     r1385_4(glval<unknown>)           = FunctionAddress[method]           : 
 # 1385|     v1385_5(void)                     = Call[method]                      : func:r1385_4, this:r1385_1
 # 1385|     mu1385_6(unknown)                 = ^CallSideEffect                   : ~m?
-# 1385|     v1385_7(void)                     = ^BufferReadSideEffect[-1]         : &:r1385_1, ~m?
+# 1385|     v1385_7(void)                     = ^IndirectReadSideEffect[-1]       : &:r1385_1, ~m?
 # 1385|     mu1385_8(destructor_only)         = ^IndirectMayWriteSideEffect[-1]   : &:r1385_1
 # 1386|     r1386_1(glval<destructor_only>)   = VariableAddress[#temp1386:5]      : 
 # 1386|     r1386_2(glval<unknown>)           = FunctionAddress[returnValue]      : 
@@ -7599,7 +7598,7 @@ ir.cpp:
 # 1386|     r1386_6(glval<unknown>)           = FunctionAddress[method]           : 
 # 1386|     v1386_7(void)                     = Call[method]                      : func:r1386_6, this:r1386_1
 # 1386|     mu1386_8(unknown)                 = ^CallSideEffect                   : ~m?
-# 1386|     v1386_9(void)                     = ^BufferReadSideEffect[-1]         : &:r1386_1, ~m?
+# 1386|     v1386_9(void)                     = ^IndirectReadSideEffect[-1]       : &:r1386_1, ~m?
 # 1386|     mu1386_10(destructor_only)        = ^IndirectMayWriteSideEffect[-1]   : &:r1386_1
 # 1388|     r1388_1(glval<destructor_only>)   = VariableAddress[#temp1388:5]      : 
 # 1388|     r1388_2(glval<unknown>)           = FunctionAddress[defaultConstruct] : 
@@ -7667,7 +7666,7 @@ ir.cpp:
 # 1397|     r1397_7(glval<unknown>)            = FunctionAddress[method]           : 
 # 1397|     v1397_8(void)                      = Call[method]                      : func:r1397_7, this:r1397_1
 # 1397|     mu1397_9(unknown)                  = ^CallSideEffect                   : ~m?
-# 1397|     v1397_10(void)                     = ^BufferReadSideEffect[-1]         : &:r1397_1, ~m?
+# 1397|     v1397_10(void)                     = ^IndirectReadSideEffect[-1]       : &:r1397_1, ~m?
 # 1397|     mu1397_11(copy_constructor)        = ^IndirectMayWriteSideEffect[-1]   : &:r1397_1
 # 1398|     r1398_1(glval<copy_constructor>)   = VariableAddress[#temp1398:5]      : 
 # 1398|     r1398_2(glval<unknown>)            = FunctionAddress[returnValue]      : 
@@ -7677,7 +7676,7 @@ ir.cpp:
 # 1398|     r1398_6(glval<unknown>)            = FunctionAddress[method]           : 
 # 1398|     v1398_7(void)                      = Call[method]                      : func:r1398_6, this:r1398_1
 # 1398|     mu1398_8(unknown)                  = ^CallSideEffect                   : ~m?
-# 1398|     v1398_9(void)                      = ^BufferReadSideEffect[-1]         : &:r1398_1, ~m?
+# 1398|     v1398_9(void)                      = ^IndirectReadSideEffect[-1]       : &:r1398_1, ~m?
 # 1398|     mu1398_10(copy_constructor)        = ^IndirectMayWriteSideEffect[-1]   : &:r1398_1
 # 1399|     r1399_1(glval<copy_constructor>)   = VariableAddress[#temp1399:5]      : 
 # 1399|     r1399_2(glval<unknown>)            = FunctionAddress[defaultConstruct] : 
@@ -7851,7 +7850,7 @@ ir.cpp:
 # 1447|     r1447_9(glval<unknown>)     = FunctionAddress[f]                                : 
 # 1447|     r1447_10(float)             = Call[f]                                           : func:r1447_9, this:r1447_8
 # 1447|     mu1447_11(unknown)          = ^CallSideEffect                                   : ~m?
-# 1447|     v1447_12(void)              = ^BufferReadSideEffect[-1]                         : &:r1447_8, ~m?
+# 1447|     v1447_12(void)              = ^IndirectReadSideEffect[-1]                       : &:r1447_8, ~m?
 # 1447|     mu1447_13(float)            = Store[f]                                          : &:r1447_1, r1447_10
 # 1448|     v1448_1(void)               = NoOp                                              : 
 # 1443|     v1443_4(void)               = ReturnVoid                                        : 
diff --git a/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected b/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected
index c4019a38251..76de50dd792 100644
--- a/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected
+++ b/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected
@@ -1059,7 +1059,7 @@ ssa.cpp:
 #  241|     v241_3(void)                 = Call[g]                         : func:r241_2, this:r241_1
 #  241|     m241_4(unknown)              = ^CallSideEffect                 : ~m240_7
 #  241|     m241_5(unknown)              = Chi                             : total:m240_7, partial:m241_4
-#  241|     v241_6(void)                 = ^BufferReadSideEffect[-1]       : &:r241_1, ~m240_9
+#  241|     v241_6(void)                 = ^IndirectReadSideEffect[-1]     : &:r241_1, m240_9
 #  241|     m241_7(Constructible)        = ^IndirectMayWriteSideEffect[-1] : &:r241_1
 #  241|     m241_8(Constructible)        = Chi                             : total:m240_9, partial:m241_7
 #  242|     r242_1(glval<Constructible>) = VariableAddress[c]              : 
@@ -1067,7 +1067,7 @@ ssa.cpp:
 #  242|     v242_3(void)                 = Call[g]                         : func:r242_2, this:r242_1
 #  242|     m242_4(unknown)              = ^CallSideEffect                 : ~m241_5
 #  242|     m242_5(unknown)              = Chi                             : total:m241_5, partial:m242_4
-#  242|     v242_6(void)                 = ^BufferReadSideEffect[-1]       : &:r242_1, ~m241_8
+#  242|     v242_6(void)                 = ^IndirectReadSideEffect[-1]     : &:r242_1, m241_8
 #  242|     m242_7(Constructible)        = ^IndirectMayWriteSideEffect[-1] : &:r242_1
 #  242|     m242_8(Constructible)        = Chi                             : total:m241_8, partial:m242_7
 #  243|     r243_1(glval<Constructible>) = VariableAddress[c2]             : 
@@ -1084,7 +1084,7 @@ ssa.cpp:
 #  244|     v244_3(void)                 = Call[g]                         : func:r244_2, this:r244_1
 #  244|     m244_4(unknown)              = ^CallSideEffect                 : ~m243_7
 #  244|     m244_5(unknown)              = Chi                             : total:m243_7, partial:m244_4
-#  244|     v244_6(void)                 = ^BufferReadSideEffect[-1]       : &:r244_1, ~m243_9
+#  244|     v244_6(void)                 = ^IndirectReadSideEffect[-1]     : &:r244_1, m243_9
 #  244|     m244_7(Constructible)        = ^IndirectMayWriteSideEffect[-1] : &:r244_1
 #  244|     m244_8(Constructible)        = Chi                             : total:m243_9, partial:m244_7
 #  245|     v245_1(void)                 = NoOp                            : 
diff --git a/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir_unsound.expected b/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir_unsound.expected
index a101e638cd0..ab79d20214a 100644
--- a/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir_unsound.expected
+++ b/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir_unsound.expected
@@ -1054,7 +1054,7 @@ ssa.cpp:
 #  241|     v241_3(void)                 = Call[g]                         : func:r241_2, this:r241_1
 #  241|     m241_4(unknown)              = ^CallSideEffect                 : ~m240_7
 #  241|     m241_5(unknown)              = Chi                             : total:m240_7, partial:m241_4
-#  241|     v241_6(void)                 = ^BufferReadSideEffect[-1]       : &:r241_1, ~m240_9
+#  241|     v241_6(void)                 = ^IndirectReadSideEffect[-1]     : &:r241_1, m240_9
 #  241|     m241_7(Constructible)        = ^IndirectMayWriteSideEffect[-1] : &:r241_1
 #  241|     m241_8(Constructible)        = Chi                             : total:m240_9, partial:m241_7
 #  242|     r242_1(glval<Constructible>) = VariableAddress[c]              : 
@@ -1062,7 +1062,7 @@ ssa.cpp:
 #  242|     v242_3(void)                 = Call[g]                         : func:r242_2, this:r242_1
 #  242|     m242_4(unknown)              = ^CallSideEffect                 : ~m241_5
 #  242|     m242_5(unknown)              = Chi                             : total:m241_5, partial:m242_4
-#  242|     v242_6(void)                 = ^BufferReadSideEffect[-1]       : &:r242_1, ~m241_8
+#  242|     v242_6(void)                 = ^IndirectReadSideEffect[-1]     : &:r242_1, m241_8
 #  242|     m242_7(Constructible)        = ^IndirectMayWriteSideEffect[-1] : &:r242_1
 #  242|     m242_8(Constructible)        = Chi                             : total:m241_8, partial:m242_7
 #  243|     r243_1(glval<Constructible>) = VariableAddress[c2]             : 
@@ -1079,7 +1079,7 @@ ssa.cpp:
 #  244|     v244_3(void)                 = Call[g]                         : func:r244_2, this:r244_1
 #  244|     m244_4(unknown)              = ^CallSideEffect                 : ~m243_7
 #  244|     m244_5(unknown)              = Chi                             : total:m243_7, partial:m244_4
-#  244|     v244_6(void)                 = ^BufferReadSideEffect[-1]       : &:r244_1, ~m243_9
+#  244|     v244_6(void)                 = ^IndirectReadSideEffect[-1]     : &:r244_1, m243_9
 #  244|     m244_7(Constructible)        = ^IndirectMayWriteSideEffect[-1] : &:r244_1
 #  244|     m244_8(Constructible)        = Chi                             : total:m243_9, partial:m244_7
 #  245|     v245_1(void)                 = NoOp                            : 
diff --git a/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected b/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected
index 8b6cf17dbbb..0b257db98a4 100644
--- a/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected
+++ b/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected
@@ -983,13 +983,13 @@ ssa.cpp:
 #  241|     r241_2(glval<unknown>)       = FunctionAddress[g]              : 
 #  241|     v241_3(void)                 = Call[g]                         : func:r241_2, this:r241_1
 #  241|     mu241_4(unknown)             = ^CallSideEffect                 : ~m?
-#  241|     v241_5(void)                 = ^BufferReadSideEffect[-1]       : &:r241_1, ~m?
+#  241|     v241_5(void)                 = ^IndirectReadSideEffect[-1]     : &:r241_1, ~m?
 #  241|     mu241_6(Constructible)       = ^IndirectMayWriteSideEffect[-1] : &:r241_1
 #  242|     r242_1(glval<Constructible>) = VariableAddress[c]              : 
 #  242|     r242_2(glval<unknown>)       = FunctionAddress[g]              : 
 #  242|     v242_3(void)                 = Call[g]                         : func:r242_2, this:r242_1
 #  242|     mu242_4(unknown)             = ^CallSideEffect                 : ~m?
-#  242|     v242_5(void)                 = ^BufferReadSideEffect[-1]       : &:r242_1, ~m?
+#  242|     v242_5(void)                 = ^IndirectReadSideEffect[-1]     : &:r242_1, ~m?
 #  242|     mu242_6(Constructible)       = ^IndirectMayWriteSideEffect[-1] : &:r242_1
 #  243|     r243_1(glval<Constructible>) = VariableAddress[c2]             : 
 #  243|     mu243_2(Constructible)       = Uninitialized[c2]               : &:r243_1
@@ -1002,7 +1002,7 @@ ssa.cpp:
 #  244|     r244_2(glval<unknown>)       = FunctionAddress[g]              : 
 #  244|     v244_3(void)                 = Call[g]                         : func:r244_2, this:r244_1
 #  244|     mu244_4(unknown)             = ^CallSideEffect                 : ~m?
-#  244|     v244_5(void)                 = ^BufferReadSideEffect[-1]       : &:r244_1, ~m?
+#  244|     v244_5(void)                 = ^IndirectReadSideEffect[-1]     : &:r244_1, ~m?
 #  244|     mu244_6(Constructible)       = ^IndirectMayWriteSideEffect[-1] : &:r244_1
 #  245|     v245_1(void)                 = NoOp                            : 
 #  239|     v239_4(void)                 = ReturnVoid                      : 
diff --git a/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir_unsound.expected b/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir_unsound.expected
index 8b6cf17dbbb..0b257db98a4 100644
--- a/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir_unsound.expected
+++ b/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir_unsound.expected
@@ -983,13 +983,13 @@ ssa.cpp:
 #  241|     r241_2(glval<unknown>)       = FunctionAddress[g]              : 
 #  241|     v241_3(void)                 = Call[g]                         : func:r241_2, this:r241_1
 #  241|     mu241_4(unknown)             = ^CallSideEffect                 : ~m?
-#  241|     v241_5(void)                 = ^BufferReadSideEffect[-1]       : &:r241_1, ~m?
+#  241|     v241_5(void)                 = ^IndirectReadSideEffect[-1]     : &:r241_1, ~m?
 #  241|     mu241_6(Constructible)       = ^IndirectMayWriteSideEffect[-1] : &:r241_1
 #  242|     r242_1(glval<Constructible>) = VariableAddress[c]              : 
 #  242|     r242_2(glval<unknown>)       = FunctionAddress[g]              : 
 #  242|     v242_3(void)                 = Call[g]                         : func:r242_2, this:r242_1
 #  242|     mu242_4(unknown)             = ^CallSideEffect                 : ~m?
-#  242|     v242_5(void)                 = ^BufferReadSideEffect[-1]       : &:r242_1, ~m?
+#  242|     v242_5(void)                 = ^IndirectReadSideEffect[-1]     : &:r242_1, ~m?
 #  242|     mu242_6(Constructible)       = ^IndirectMayWriteSideEffect[-1] : &:r242_1
 #  243|     r243_1(glval<Constructible>) = VariableAddress[c2]             : 
 #  243|     mu243_2(Constructible)       = Uninitialized[c2]               : &:r243_1
@@ -1002,7 +1002,7 @@ ssa.cpp:
 #  244|     r244_2(glval<unknown>)       = FunctionAddress[g]              : 
 #  244|     v244_3(void)                 = Call[g]                         : func:r244_2, this:r244_1
 #  244|     mu244_4(unknown)             = ^CallSideEffect                 : ~m?
-#  244|     v244_5(void)                 = ^BufferReadSideEffect[-1]       : &:r244_1, ~m?
+#  244|     v244_5(void)                 = ^IndirectReadSideEffect[-1]     : &:r244_1, ~m?
 #  244|     mu244_6(Constructible)       = ^IndirectMayWriteSideEffect[-1] : &:r244_1
 #  245|     v245_1(void)                 = NoOp                            : 
 #  239|     v239_4(void)                 = ReturnVoid                      : 
diff --git a/cpp/ql/test/library-tests/syntax-zoo/modeled-functions.cpp b/cpp/ql/test/library-tests/syntax-zoo/modeled-functions.cpp
new file mode 100644
index 00000000000..c6867a9abe3
--- /dev/null
+++ b/cpp/ql/test/library-tests/syntax-zoo/modeled-functions.cpp
@@ -0,0 +1,7 @@
+void accept(int arg, char *buf, unsigned long* bufSize);
+
+void testAccept(int socket1, int socket2)
+{
+  char buffer[1024];
+  accept(socket2, 0, 0);
+}
diff --git a/cpp/ql/test/query-tests/Critical/MemoryFreed/MemoryNeverFreed.expected b/cpp/ql/test/query-tests/Critical/MemoryFreed/MemoryNeverFreed.expected
index 900925d8927..d44735d4bee 100644
--- a/cpp/ql/test/query-tests/Critical/MemoryFreed/MemoryNeverFreed.expected
+++ b/cpp/ql/test/query-tests/Critical/MemoryFreed/MemoryNeverFreed.expected
@@ -10,3 +10,4 @@
 | test.cpp:89:18:89:23 | call to malloc | This memory is never freed |
 | test.cpp:156:3:156:26 | new | This memory is never freed |
 | test.cpp:157:3:157:26 | new[] | This memory is never freed |
+| test.cpp:167:14:167:19 | call to strdup | This memory is never freed |
diff --git a/cpp/ql/test/query-tests/Critical/MemoryFreed/test.cpp b/cpp/ql/test/query-tests/Critical/MemoryFreed/test.cpp
index 63636166fc8..651afe85006 100644
--- a/cpp/ql/test/query-tests/Critical/MemoryFreed/test.cpp
+++ b/cpp/ql/test/query-tests/Critical/MemoryFreed/test.cpp
@@ -156,3 +156,15 @@ int overloadedNew() {
   new(std::nothrow) int(3); // BAD
   new(std::nothrow) int[2]; // BAD
 }
+
+// --- strdup ---
+
+char *strdup(const char *s1);
+void output_msg(const char *msg);
+
+void test_strdup() {
+	char msg[] = "OctoCat";
+	char *cpy = strdup(msg); // BAD
+
+	output_msg(cpy);
+}
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/AssignWhereCompareMeant/AssignWhereCompareMeant.expected b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/AssignWhereCompareMeant/AssignWhereCompareMeant.expected
index 6c4dfaea0a7..a5a1a6ca0bd 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/AssignWhereCompareMeant/AssignWhereCompareMeant.expected	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/AssignWhereCompareMeant/AssignWhereCompareMeant.expected	
@@ -19,3 +19,7 @@
 | test.cpp:144:32:144:36 | ... = ... | Use of '=' where '==' may have been intended. |
 | test.cpp:150:32:150:36 | ... = ... | Use of '=' where '==' may have been intended. |
 | test.cpp:153:46:153:50 | ... = ... | Use of '=' where '==' may have been intended. |
+| test.cpp:166:22:166:27 | ... = ... | Use of '=' where '==' may have been intended. |
+| test.cpp:168:24:168:29 | ... = ... | Use of '=' where '==' may have been intended. |
+| test.cpp:169:23:169:28 | ... = ... | Use of '=' where '==' may have been intended. |
+| test.cpp:171:7:171:12 | ... = ... | Use of '=' where '==' may have been intended. |
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/AssignWhereCompareMeant/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/AssignWhereCompareMeant/test.cpp
index 63cac141cc6..3cd18125467 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/AssignWhereCompareMeant/test.cpp	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/AssignWhereCompareMeant/test.cpp	
@@ -153,3 +153,21 @@ void f3(int x, int y) {
   if((x == 10) || ((z == z) && (x == 1)) && (y = 2)) { // BAD
   }
 }
+
+bool use(int);
+
+void f4(int x, bool b) {
+  if((x = 10) && use(x)) {} // GOOD: This is likely just a short-hand way of writing an assignment
+                            // followed by a boolean check.
+  if((x = 10) && b && use(x)) {} // GOOD: Same reason as above
+  if((x = 10) && use(x) && b) {} // GOOD: Same reason as above
+  if((x = 10) && (use(x) && b)) {} // GOOD: Same reason as above
+
+  if(use(x) && b && (x = 10)) {} // BAD: The assignment is the last thing that happens in the comparison.
+                                 // This doesn't match the usual pattern.
+  if((use(x) && b) && (x = 10)) {} // BAD: Same reason as above
+  if(use(x) && (b && (x = 10))) {} // BAD: Same reason as above
+
+  if((x = 10) || use(x)) {} // BAD: This doesn't follow the usual style of writing an assignment in
+                            // a boolean check.
+}
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnStackAllocatedMemory/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnStackAllocatedMemory/test.cpp
index 03b202817ca..1ce2558a34f 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnStackAllocatedMemory/test.cpp	
+++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnStackAllocatedMemory/test.cpp	
@@ -189,3 +189,30 @@ int *&conversionInFlow() {
   int *&pRef = p; // has conversion in the middle of data flow
   return pRef; // BAD [NOT DETECTED]
 }
+
+namespace std {
+	template<typename T>
+	class shared_ptr {
+	public:
+		shared_ptr() noexcept;
+		explicit shared_ptr(T*);
+		shared_ptr(const shared_ptr&) noexcept;
+		template<class U> shared_ptr(const shared_ptr<U>&) noexcept;
+		template<class U> shared_ptr(shared_ptr<U>&&) noexcept;
+
+		shared_ptr<T>& operator=(const shared_ptr<T>&) noexcept;
+		shared_ptr<T>& operator=(shared_ptr<T>&&) noexcept;
+
+		T& operator*() const noexcept;
+		T* operator->() const noexcept;
+
+		T* get() const noexcept;
+	};
+}
+
+auto make_read_port()
+{
+  auto port = std::shared_ptr<int>(new int);
+  auto ptr = port.get();
+  return ptr; // GOOD
+}
\ No newline at end of file
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-022/semmle/tests/TaintedPath.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-022/semmle/tests/TaintedPath.expected
index d7db531fbde..7b513c574ad 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-022/semmle/tests/TaintedPath.expected
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-022/semmle/tests/TaintedPath.expected
@@ -3,11 +3,15 @@ edges
 | test.c:9:23:9:26 | argv | test.c:17:11:17:18 | (const char *)... |
 | test.c:9:23:9:26 | argv | test.c:17:11:17:18 | fileName |
 | test.c:9:23:9:26 | argv | test.c:17:11:17:18 | fileName |
+| test.c:9:23:9:26 | argv | test.c:17:11:17:18 | fileName indirection |
+| test.c:9:23:9:26 | argv | test.c:17:11:17:18 | fileName indirection |
 nodes
 | test.c:9:23:9:26 | argv | semmle.label | argv |
 | test.c:9:23:9:26 | argv | semmle.label | argv |
 | test.c:17:11:17:18 | (const char *)... | semmle.label | (const char *)... |
 | test.c:17:11:17:18 | (const char *)... | semmle.label | (const char *)... |
 | test.c:17:11:17:18 | fileName | semmle.label | fileName |
+| test.c:17:11:17:18 | fileName indirection | semmle.label | fileName indirection |
+| test.c:17:11:17:18 | fileName indirection | semmle.label | fileName indirection |
 #select
 | test.c:17:11:17:18 | fileName | test.c:9:23:9:26 | argv | test.c:17:11:17:18 | fileName | This argument to a file access function is derived from $@ and then passed to fopen(filename) | test.c:9:23:9:26 | argv | user input (argv) |
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-079/semmle/CgiXss/CgiXss.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-079/semmle/CgiXss/CgiXss.expected
index 6fc3eab83e9..d9fa0d7029f 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-079/semmle/CgiXss/CgiXss.expected
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-079/semmle/CgiXss/CgiXss.expected
@@ -1,13 +1,17 @@
 edges
 | search.c:14:24:14:28 | *query | search.c:17:8:17:12 | (const char *)... |
 | search.c:14:24:14:28 | *query | search.c:17:8:17:12 | query |
+| search.c:14:24:14:28 | *query | search.c:17:8:17:12 | query indirection |
 | search.c:14:24:14:28 | query | search.c:17:8:17:12 | (const char *)... |
 | search.c:14:24:14:28 | query | search.c:17:8:17:12 | query |
 | search.c:14:24:14:28 | query | search.c:17:8:17:12 | query |
+| search.c:14:24:14:28 | query | search.c:17:8:17:12 | query indirection |
 | search.c:22:24:22:28 | *query | search.c:23:39:23:43 | query |
 | search.c:22:24:22:28 | *query | search.c:23:39:23:43 | query |
+| search.c:22:24:22:28 | *query | search.c:23:39:23:43 | query indirection |
 | search.c:22:24:22:28 | query | search.c:23:39:23:43 | query |
 | search.c:22:24:22:28 | query | search.c:23:39:23:43 | query |
+| search.c:22:24:22:28 | query | search.c:23:39:23:43 | query indirection |
 | search.c:51:21:51:26 | call to getenv | search.c:55:5:55:15 | raw_query |
 | search.c:51:21:51:26 | call to getenv | search.c:55:5:55:15 | raw_query |
 | search.c:51:21:51:26 | call to getenv | search.c:55:17:55:25 | raw_query indirection |
@@ -28,11 +32,15 @@ nodes
 | search.c:17:8:17:12 | query | semmle.label | query |
 | search.c:17:8:17:12 | query | semmle.label | query |
 | search.c:17:8:17:12 | query | semmle.label | query |
+| search.c:17:8:17:12 | query indirection | semmle.label | query indirection |
+| search.c:17:8:17:12 | query indirection | semmle.label | query indirection |
 | search.c:22:24:22:28 | *query | semmle.label | *query |
 | search.c:22:24:22:28 | query | semmle.label | query |
 | search.c:23:39:23:43 | query | semmle.label | query |
 | search.c:23:39:23:43 | query | semmle.label | query |
 | search.c:23:39:23:43 | query | semmle.label | query |
+| search.c:23:39:23:43 | query indirection | semmle.label | query indirection |
+| search.c:23:39:23:43 | query indirection | semmle.label | query indirection |
 | search.c:51:21:51:26 | call to getenv | semmle.label | call to getenv |
 | search.c:51:21:51:26 | call to getenv | semmle.label | call to getenv |
 | search.c:55:5:55:15 | raw_query | semmle.label | raw_query |
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/SqlTainted.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/SqlTainted.expected
index af50f184740..e267dd48bba 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/SqlTainted.expected
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/SqlTainted.expected
@@ -3,11 +3,15 @@ edges
 | test.c:15:20:15:23 | argv | test.c:21:18:21:23 | (const char *)... |
 | test.c:15:20:15:23 | argv | test.c:21:18:21:23 | query1 |
 | test.c:15:20:15:23 | argv | test.c:21:18:21:23 | query1 |
+| test.c:15:20:15:23 | argv | test.c:21:18:21:23 | query1 indirection |
+| test.c:15:20:15:23 | argv | test.c:21:18:21:23 | query1 indirection |
 nodes
 | test.c:15:20:15:23 | argv | semmle.label | argv |
 | test.c:15:20:15:23 | argv | semmle.label | argv |
 | test.c:21:18:21:23 | (const char *)... | semmle.label | (const char *)... |
 | test.c:21:18:21:23 | (const char *)... | semmle.label | (const char *)... |
 | test.c:21:18:21:23 | query1 | semmle.label | query1 |
+| test.c:21:18:21:23 | query1 indirection | semmle.label | query1 indirection |
+| test.c:21:18:21:23 | query1 indirection | semmle.label | query1 indirection |
 #select
 | test.c:21:18:21:23 | query1 | test.c:15:20:15:23 | argv | test.c:21:18:21:23 | query1 | This argument to a SQL query function is derived from $@ and then passed to mysql_query(sqlArg) | test.c:15:20:15:23 | argv | user input (argv) |
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-114/semmle/UncontrolledProcessOperation/UncontrolledProcessOperation.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-114/semmle/UncontrolledProcessOperation/UncontrolledProcessOperation.expected
index e67d10272aa..5b45af80d5b 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-114/semmle/UncontrolledProcessOperation/UncontrolledProcessOperation.expected
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-114/semmle/UncontrolledProcessOperation/UncontrolledProcessOperation.expected
@@ -1,12 +1,16 @@
 edges
 | test.cpp:24:30:24:36 | *command | test.cpp:26:10:26:16 | command |
 | test.cpp:24:30:24:36 | *command | test.cpp:26:10:26:16 | command |
+| test.cpp:24:30:24:36 | *command | test.cpp:26:10:26:16 | command indirection |
 | test.cpp:24:30:24:36 | command | test.cpp:26:10:26:16 | command |
 | test.cpp:24:30:24:36 | command | test.cpp:26:10:26:16 | command |
+| test.cpp:24:30:24:36 | command | test.cpp:26:10:26:16 | command indirection |
 | test.cpp:29:30:29:36 | *command | test.cpp:31:10:31:16 | command |
 | test.cpp:29:30:29:36 | *command | test.cpp:31:10:31:16 | command |
+| test.cpp:29:30:29:36 | *command | test.cpp:31:10:31:16 | command indirection |
 | test.cpp:29:30:29:36 | command | test.cpp:31:10:31:16 | command |
 | test.cpp:29:30:29:36 | command | test.cpp:31:10:31:16 | command |
+| test.cpp:29:30:29:36 | command | test.cpp:31:10:31:16 | command indirection |
 | test.cpp:42:7:42:16 | call to getenv | test.cpp:24:30:24:36 | command |
 | test.cpp:42:18:42:23 | call to getenv | test.cpp:42:7:42:16 | call to getenv |
 | test.cpp:42:18:42:23 | call to getenv | test.cpp:42:18:42:34 | call to getenv indirection |
@@ -21,31 +25,55 @@ edges
 | test.cpp:43:18:43:34 | call to getenv indirection | test.cpp:29:30:29:36 | *command |
 | test.cpp:56:12:56:17 | buffer | test.cpp:62:10:62:15 | (const char *)... |
 | test.cpp:56:12:56:17 | buffer | test.cpp:62:10:62:15 | buffer |
+| test.cpp:56:12:56:17 | buffer | test.cpp:62:10:62:15 | buffer indirection |
 | test.cpp:56:12:56:17 | buffer | test.cpp:63:10:63:13 | (const char *)... |
 | test.cpp:56:12:56:17 | buffer | test.cpp:63:10:63:13 | data |
+| test.cpp:56:12:56:17 | buffer | test.cpp:63:10:63:13 | data indirection |
 | test.cpp:56:12:56:17 | fgets output argument | test.cpp:62:10:62:15 | (const char *)... |
 | test.cpp:56:12:56:17 | fgets output argument | test.cpp:62:10:62:15 | buffer |
+| test.cpp:56:12:56:17 | fgets output argument | test.cpp:62:10:62:15 | buffer indirection |
 | test.cpp:56:12:56:17 | fgets output argument | test.cpp:63:10:63:13 | (const char *)... |
 | test.cpp:56:12:56:17 | fgets output argument | test.cpp:63:10:63:13 | data |
+| test.cpp:56:12:56:17 | fgets output argument | test.cpp:63:10:63:13 | data indirection |
 | test.cpp:76:12:76:17 | buffer | test.cpp:78:10:78:15 | (const char *)... |
 | test.cpp:76:12:76:17 | buffer | test.cpp:78:10:78:15 | buffer |
+| test.cpp:76:12:76:17 | buffer | test.cpp:78:10:78:15 | buffer indirection |
 | test.cpp:76:12:76:17 | buffer | test.cpp:79:10:79:13 | (const char *)... |
 | test.cpp:76:12:76:17 | buffer | test.cpp:79:10:79:13 | data |
+| test.cpp:76:12:76:17 | buffer | test.cpp:79:10:79:13 | data indirection |
 | test.cpp:76:12:76:17 | fgets output argument | test.cpp:78:10:78:15 | (const char *)... |
 | test.cpp:76:12:76:17 | fgets output argument | test.cpp:78:10:78:15 | buffer |
+| test.cpp:76:12:76:17 | fgets output argument | test.cpp:78:10:78:15 | buffer indirection |
 | test.cpp:76:12:76:17 | fgets output argument | test.cpp:79:10:79:13 | (const char *)... |
 | test.cpp:76:12:76:17 | fgets output argument | test.cpp:79:10:79:13 | data |
+| test.cpp:76:12:76:17 | fgets output argument | test.cpp:79:10:79:13 | data indirection |
+| test.cpp:98:17:98:22 | buffer | test.cpp:99:15:99:20 | (const char *)... |
+| test.cpp:98:17:98:22 | buffer | test.cpp:99:15:99:20 | buffer |
+| test.cpp:98:17:98:22 | buffer | test.cpp:99:15:99:20 | buffer indirection |
+| test.cpp:98:17:98:22 | recv output argument | test.cpp:99:15:99:20 | (const char *)... |
+| test.cpp:98:17:98:22 | recv output argument | test.cpp:99:15:99:20 | buffer |
+| test.cpp:98:17:98:22 | recv output argument | test.cpp:99:15:99:20 | buffer indirection |
+| test.cpp:106:17:106:22 | buffer | test.cpp:107:15:107:20 | (const char *)... |
+| test.cpp:106:17:106:22 | buffer | test.cpp:107:15:107:20 | buffer |
+| test.cpp:106:17:106:22 | buffer | test.cpp:107:15:107:20 | buffer indirection |
+| test.cpp:106:17:106:22 | recv output argument | test.cpp:107:15:107:20 | (const char *)... |
+| test.cpp:106:17:106:22 | recv output argument | test.cpp:107:15:107:20 | buffer |
+| test.cpp:106:17:106:22 | recv output argument | test.cpp:107:15:107:20 | buffer indirection |
 nodes
 | test.cpp:24:30:24:36 | *command | semmle.label | *command |
 | test.cpp:24:30:24:36 | command | semmle.label | command |
 | test.cpp:26:10:26:16 | command | semmle.label | command |
 | test.cpp:26:10:26:16 | command | semmle.label | command |
 | test.cpp:26:10:26:16 | command | semmle.label | command |
+| test.cpp:26:10:26:16 | command indirection | semmle.label | command indirection |
+| test.cpp:26:10:26:16 | command indirection | semmle.label | command indirection |
 | test.cpp:29:30:29:36 | *command | semmle.label | *command |
 | test.cpp:29:30:29:36 | command | semmle.label | command |
 | test.cpp:31:10:31:16 | command | semmle.label | command |
 | test.cpp:31:10:31:16 | command | semmle.label | command |
 | test.cpp:31:10:31:16 | command | semmle.label | command |
+| test.cpp:31:10:31:16 | command indirection | semmle.label | command indirection |
+| test.cpp:31:10:31:16 | command indirection | semmle.label | command indirection |
 | test.cpp:42:7:42:16 | call to getenv | semmle.label | call to getenv |
 | test.cpp:42:18:42:23 | call to getenv | semmle.label | call to getenv |
 | test.cpp:42:18:42:34 | (const char *)... | semmle.label | (const char *)... |
@@ -59,17 +87,39 @@ nodes
 | test.cpp:62:10:62:15 | (const char *)... | semmle.label | (const char *)... |
 | test.cpp:62:10:62:15 | (const char *)... | semmle.label | (const char *)... |
 | test.cpp:62:10:62:15 | buffer | semmle.label | buffer |
+| test.cpp:62:10:62:15 | buffer indirection | semmle.label | buffer indirection |
+| test.cpp:62:10:62:15 | buffer indirection | semmle.label | buffer indirection |
 | test.cpp:63:10:63:13 | (const char *)... | semmle.label | (const char *)... |
 | test.cpp:63:10:63:13 | (const char *)... | semmle.label | (const char *)... |
 | test.cpp:63:10:63:13 | data | semmle.label | data |
+| test.cpp:63:10:63:13 | data indirection | semmle.label | data indirection |
+| test.cpp:63:10:63:13 | data indirection | semmle.label | data indirection |
 | test.cpp:76:12:76:17 | buffer | semmle.label | buffer |
 | test.cpp:76:12:76:17 | fgets output argument | semmle.label | fgets output argument |
 | test.cpp:78:10:78:15 | (const char *)... | semmle.label | (const char *)... |
 | test.cpp:78:10:78:15 | (const char *)... | semmle.label | (const char *)... |
 | test.cpp:78:10:78:15 | buffer | semmle.label | buffer |
+| test.cpp:78:10:78:15 | buffer indirection | semmle.label | buffer indirection |
+| test.cpp:78:10:78:15 | buffer indirection | semmle.label | buffer indirection |
 | test.cpp:79:10:79:13 | (const char *)... | semmle.label | (const char *)... |
 | test.cpp:79:10:79:13 | (const char *)... | semmle.label | (const char *)... |
 | test.cpp:79:10:79:13 | data | semmle.label | data |
+| test.cpp:79:10:79:13 | data indirection | semmle.label | data indirection |
+| test.cpp:79:10:79:13 | data indirection | semmle.label | data indirection |
+| test.cpp:98:17:98:22 | buffer | semmle.label | buffer |
+| test.cpp:98:17:98:22 | recv output argument | semmle.label | recv output argument |
+| test.cpp:99:15:99:20 | (const char *)... | semmle.label | (const char *)... |
+| test.cpp:99:15:99:20 | (const char *)... | semmle.label | (const char *)... |
+| test.cpp:99:15:99:20 | buffer | semmle.label | buffer |
+| test.cpp:99:15:99:20 | buffer indirection | semmle.label | buffer indirection |
+| test.cpp:99:15:99:20 | buffer indirection | semmle.label | buffer indirection |
+| test.cpp:106:17:106:22 | buffer | semmle.label | buffer |
+| test.cpp:106:17:106:22 | recv output argument | semmle.label | recv output argument |
+| test.cpp:107:15:107:20 | (const char *)... | semmle.label | (const char *)... |
+| test.cpp:107:15:107:20 | (const char *)... | semmle.label | (const char *)... |
+| test.cpp:107:15:107:20 | buffer | semmle.label | buffer |
+| test.cpp:107:15:107:20 | buffer indirection | semmle.label | buffer indirection |
+| test.cpp:107:15:107:20 | buffer indirection | semmle.label | buffer indirection |
 #select
 | test.cpp:26:10:26:16 | command | test.cpp:42:18:42:23 | call to getenv | test.cpp:26:10:26:16 | command | The value of this argument may come from $@ and is being passed to system | test.cpp:42:18:42:23 | call to getenv | call to getenv |
 | test.cpp:31:10:31:16 | command | test.cpp:43:18:43:23 | call to getenv | test.cpp:31:10:31:16 | command | The value of this argument may come from $@ and is being passed to system | test.cpp:43:18:43:23 | call to getenv | call to getenv |
@@ -77,3 +127,5 @@ nodes
 | test.cpp:63:10:63:13 | data | test.cpp:56:12:56:17 | buffer | test.cpp:63:10:63:13 | data | The value of this argument may come from $@ and is being passed to system | test.cpp:56:12:56:17 | buffer | buffer |
 | test.cpp:78:10:78:15 | buffer | test.cpp:76:12:76:17 | buffer | test.cpp:78:10:78:15 | buffer | The value of this argument may come from $@ and is being passed to system | test.cpp:76:12:76:17 | buffer | buffer |
 | test.cpp:79:10:79:13 | data | test.cpp:76:12:76:17 | buffer | test.cpp:79:10:79:13 | data | The value of this argument may come from $@ and is being passed to system | test.cpp:76:12:76:17 | buffer | buffer |
+| test.cpp:99:15:99:20 | buffer | test.cpp:98:17:98:22 | buffer | test.cpp:99:15:99:20 | buffer | The value of this argument may come from $@ and is being passed to LoadLibrary | test.cpp:98:17:98:22 | buffer | buffer |
+| test.cpp:107:15:107:20 | buffer | test.cpp:106:17:106:22 | buffer | test.cpp:107:15:107:20 | buffer | The value of this argument may come from $@ and is being passed to LoadLibrary | test.cpp:106:17:106:22 | buffer | buffer |
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-114/semmle/UncontrolledProcessOperation/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-114/semmle/UncontrolledProcessOperation/test.cpp
index eb9436bcadb..26aff44f3d8 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-114/semmle/UncontrolledProcessOperation/test.cpp
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-114/semmle/UncontrolledProcessOperation/test.cpp
@@ -81,3 +81,29 @@ void testReferencePointer2()
 		system(data2); // BAD [NOT DETECTED]
 	}
 }
+
+// ---
+
+typedef unsigned long size_t;
+
+void accept(int arg, char *buf, size_t *bufSize);
+void recv(int arg, char *buf, size_t bufSize);
+void LoadLibrary(const char *arg);
+
+void testAcceptRecv(int socket1, int socket2)
+{
+	{
+		char buffer[1024];
+
+		recv(socket1, buffer, 1024);
+		LoadLibrary(buffer); // BAD: using data from recv
+	}
+	
+	{
+		char buffer[1024];
+
+		accept(socket2, 0, 0);
+		recv(socket2, buffer, 1024);
+		LoadLibrary(buffer); // BAD: using data from recv
+	}
+}
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/UnboundedWrite.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/UnboundedWrite.expected
index 291c1cb3a71..5255753b235 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/UnboundedWrite.expected
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/UnboundedWrite.expected
@@ -5,16 +5,50 @@ edges
 | tests.c:28:22:28:25 | argv | tests.c:28:22:28:28 | access to array |
 | tests.c:28:22:28:25 | argv | tests.c:28:22:28:28 | access to array |
 | tests.c:28:22:28:25 | argv | tests.c:28:22:28:28 | access to array |
+| tests.c:28:22:28:25 | argv | tests.c:28:22:28:28 | access to array indirection |
+| tests.c:28:22:28:25 | argv | tests.c:28:22:28:28 | access to array indirection |
+| tests.c:28:22:28:25 | argv | tests.c:31:15:31:23 | buffer100 |
+| tests.c:28:22:28:25 | argv | tests.c:31:15:31:23 | buffer100 |
+| tests.c:28:22:28:25 | argv | tests.c:31:15:31:23 | buffer100 indirection |
+| tests.c:28:22:28:25 | argv | tests.c:31:15:31:23 | buffer100 indirection |
+| tests.c:28:22:28:25 | argv | tests.c:33:21:33:29 | buffer100 |
+| tests.c:28:22:28:25 | argv | tests.c:33:21:33:29 | buffer100 |
+| tests.c:28:22:28:25 | argv | tests.c:33:21:33:29 | buffer100 indirection |
+| tests.c:28:22:28:25 | argv | tests.c:33:21:33:29 | buffer100 indirection |
 | tests.c:29:28:29:31 | argv | tests.c:29:28:29:34 | access to array |
 | tests.c:29:28:29:31 | argv | tests.c:29:28:29:34 | access to array |
 | tests.c:29:28:29:31 | argv | tests.c:29:28:29:34 | access to array |
 | tests.c:29:28:29:31 | argv | tests.c:29:28:29:34 | access to array |
+| tests.c:29:28:29:31 | argv | tests.c:29:28:29:34 | access to array indirection |
+| tests.c:29:28:29:31 | argv | tests.c:29:28:29:34 | access to array indirection |
+| tests.c:29:28:29:31 | argv | tests.c:31:15:31:23 | buffer100 |
+| tests.c:29:28:29:31 | argv | tests.c:31:15:31:23 | buffer100 |
+| tests.c:29:28:29:31 | argv | tests.c:31:15:31:23 | buffer100 indirection |
+| tests.c:29:28:29:31 | argv | tests.c:31:15:31:23 | buffer100 indirection |
+| tests.c:29:28:29:31 | argv | tests.c:33:21:33:29 | buffer100 |
+| tests.c:29:28:29:31 | argv | tests.c:33:21:33:29 | buffer100 |
+| tests.c:29:28:29:31 | argv | tests.c:33:21:33:29 | buffer100 indirection |
+| tests.c:29:28:29:31 | argv | tests.c:33:21:33:29 | buffer100 indirection |
+| tests.c:31:15:31:23 | array to pointer conversion | tests.c:31:15:31:23 | buffer100 |
+| tests.c:31:15:31:23 | array to pointer conversion | tests.c:31:15:31:23 | buffer100 indirection |
+| tests.c:31:15:31:23 | buffer100 | tests.c:31:15:31:23 | buffer100 |
+| tests.c:31:15:31:23 | buffer100 | tests.c:31:15:31:23 | buffer100 indirection |
+| tests.c:31:15:31:23 | buffer100 | tests.c:33:21:33:29 | buffer100 |
+| tests.c:31:15:31:23 | buffer100 | tests.c:33:21:33:29 | buffer100 indirection |
+| tests.c:31:15:31:23 | scanf output argument | tests.c:33:21:33:29 | buffer100 |
+| tests.c:31:15:31:23 | scanf output argument | tests.c:33:21:33:29 | buffer100 indirection |
+| tests.c:33:21:33:29 | array to pointer conversion | tests.c:33:21:33:29 | buffer100 |
+| tests.c:33:21:33:29 | array to pointer conversion | tests.c:33:21:33:29 | buffer100 indirection |
+| tests.c:33:21:33:29 | buffer100 | tests.c:33:21:33:29 | buffer100 |
+| tests.c:33:21:33:29 | buffer100 | tests.c:33:21:33:29 | buffer100 indirection |
 | tests.c:34:10:34:13 | argv | tests.c:34:10:34:16 | (const char *)... |
 | tests.c:34:10:34:13 | argv | tests.c:34:10:34:16 | (const char *)... |
 | tests.c:34:10:34:13 | argv | tests.c:34:10:34:16 | access to array |
 | tests.c:34:10:34:13 | argv | tests.c:34:10:34:16 | access to array |
 | tests.c:34:10:34:13 | argv | tests.c:34:10:34:16 | access to array |
 | tests.c:34:10:34:13 | argv | tests.c:34:10:34:16 | access to array |
+| tests.c:34:10:34:13 | argv | tests.c:34:10:34:16 | access to array indirection |
+| tests.c:34:10:34:13 | argv | tests.c:34:10:34:16 | access to array indirection |
 nodes
 | tests.c:28:22:28:25 | argv | semmle.label | argv |
 | tests.c:28:22:28:25 | argv | semmle.label | argv |
@@ -23,21 +57,30 @@ nodes
 | tests.c:28:22:28:28 | access to array | semmle.label | access to array |
 | tests.c:28:22:28:28 | access to array | semmle.label | access to array |
 | tests.c:28:22:28:28 | access to array | semmle.label | access to array |
+| tests.c:28:22:28:28 | access to array indirection | semmle.label | access to array indirection |
+| tests.c:28:22:28:28 | access to array indirection | semmle.label | access to array indirection |
 | tests.c:29:28:29:31 | argv | semmle.label | argv |
 | tests.c:29:28:29:31 | argv | semmle.label | argv |
 | tests.c:29:28:29:34 | access to array | semmle.label | access to array |
 | tests.c:29:28:29:34 | access to array | semmle.label | access to array |
 | tests.c:29:28:29:34 | access to array | semmle.label | access to array |
+| tests.c:29:28:29:34 | access to array indirection | semmle.label | access to array indirection |
+| tests.c:29:28:29:34 | access to array indirection | semmle.label | access to array indirection |
 | tests.c:31:15:31:23 | array to pointer conversion | semmle.label | array to pointer conversion |
 | tests.c:31:15:31:23 | array to pointer conversion | semmle.label | array to pointer conversion |
 | tests.c:31:15:31:23 | buffer100 | semmle.label | buffer100 |
 | tests.c:31:15:31:23 | buffer100 | semmle.label | buffer100 |
 | tests.c:31:15:31:23 | buffer100 | semmle.label | buffer100 |
+| tests.c:31:15:31:23 | buffer100 indirection | semmle.label | buffer100 indirection |
+| tests.c:31:15:31:23 | buffer100 indirection | semmle.label | buffer100 indirection |
+| tests.c:31:15:31:23 | scanf output argument | semmle.label | scanf output argument |
 | tests.c:33:21:33:29 | array to pointer conversion | semmle.label | array to pointer conversion |
 | tests.c:33:21:33:29 | array to pointer conversion | semmle.label | array to pointer conversion |
 | tests.c:33:21:33:29 | buffer100 | semmle.label | buffer100 |
 | tests.c:33:21:33:29 | buffer100 | semmle.label | buffer100 |
 | tests.c:33:21:33:29 | buffer100 | semmle.label | buffer100 |
+| tests.c:33:21:33:29 | buffer100 indirection | semmle.label | buffer100 indirection |
+| tests.c:33:21:33:29 | buffer100 indirection | semmle.label | buffer100 indirection |
 | tests.c:34:10:34:13 | argv | semmle.label | argv |
 | tests.c:34:10:34:13 | argv | semmle.label | argv |
 | tests.c:34:10:34:16 | (const char *)... | semmle.label | (const char *)... |
@@ -45,9 +88,16 @@ nodes
 | tests.c:34:10:34:16 | access to array | semmle.label | access to array |
 | tests.c:34:10:34:16 | access to array | semmle.label | access to array |
 | tests.c:34:10:34:16 | access to array | semmle.label | access to array |
+| tests.c:34:10:34:16 | access to array indirection | semmle.label | access to array indirection |
+| tests.c:34:10:34:16 | access to array indirection | semmle.label | access to array indirection |
 #select
 | tests.c:28:3:28:9 | call to sprintf | tests.c:28:22:28:25 | argv | tests.c:28:22:28:28 | access to array | This 'call to sprintf' with input from $@ may overflow the destination. | tests.c:28:22:28:25 | argv | argv |
 | tests.c:29:3:29:9 | call to sprintf | tests.c:29:28:29:31 | argv | tests.c:29:28:29:34 | access to array | This 'call to sprintf' with input from $@ may overflow the destination. | tests.c:29:28:29:31 | argv | argv |
+| tests.c:31:15:31:23 | buffer100 | tests.c:28:22:28:25 | argv | tests.c:31:15:31:23 | buffer100 | This 'scanf string argument' with input from $@ may overflow the destination. | tests.c:28:22:28:25 | argv | argv |
+| tests.c:31:15:31:23 | buffer100 | tests.c:29:28:29:31 | argv | tests.c:31:15:31:23 | buffer100 | This 'scanf string argument' with input from $@ may overflow the destination. | tests.c:29:28:29:31 | argv | argv |
 | tests.c:31:15:31:23 | buffer100 | tests.c:31:15:31:23 | buffer100 | tests.c:31:15:31:23 | buffer100 | This 'scanf string argument' with input from $@ may overflow the destination. | tests.c:31:15:31:23 | buffer100 | buffer100 |
+| tests.c:33:21:33:29 | buffer100 | tests.c:28:22:28:25 | argv | tests.c:33:21:33:29 | buffer100 | This 'scanf string argument' with input from $@ may overflow the destination. | tests.c:28:22:28:25 | argv | argv |
+| tests.c:33:21:33:29 | buffer100 | tests.c:29:28:29:31 | argv | tests.c:33:21:33:29 | buffer100 | This 'scanf string argument' with input from $@ may overflow the destination. | tests.c:29:28:29:31 | argv | argv |
+| tests.c:33:21:33:29 | buffer100 | tests.c:31:15:31:23 | buffer100 | tests.c:33:21:33:29 | buffer100 | This 'scanf string argument' with input from $@ may overflow the destination. | tests.c:31:15:31:23 | buffer100 | buffer100 |
 | tests.c:33:21:33:29 | buffer100 | tests.c:33:21:33:29 | buffer100 | tests.c:33:21:33:29 | buffer100 | This 'scanf string argument' with input from $@ may overflow the destination. | tests.c:33:21:33:29 | buffer100 | buffer100 |
 | tests.c:34:25:34:33 | buffer100 | tests.c:34:10:34:13 | argv | tests.c:34:10:34:16 | access to array | This 'sscanf string argument' with input from $@ may overflow the destination. | tests.c:34:10:34:13 | argv | argv |
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/argv/argvLocal.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/argv/argvLocal.expected
index 4c02b16cfe7..b1cf6fbaf8d 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/argv/argvLocal.expected
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/argv/argvLocal.expected
@@ -5,54 +5,76 @@ edges
 | argvLocal.c:95:9:95:12 | argv | argvLocal.c:95:9:95:15 | access to array |
 | argvLocal.c:95:9:95:12 | argv | argvLocal.c:95:9:95:15 | access to array |
 | argvLocal.c:95:9:95:12 | argv | argvLocal.c:95:9:95:15 | access to array |
+| argvLocal.c:95:9:95:12 | argv | argvLocal.c:95:9:95:15 | access to array indirection |
+| argvLocal.c:95:9:95:12 | argv | argvLocal.c:95:9:95:15 | access to array indirection |
 | argvLocal.c:96:15:96:18 | argv | argvLocal.c:96:15:96:21 | access to array |
 | argvLocal.c:96:15:96:18 | argv | argvLocal.c:96:15:96:21 | access to array |
 | argvLocal.c:96:15:96:18 | argv | argvLocal.c:96:15:96:21 | access to array |
 | argvLocal.c:96:15:96:18 | argv | argvLocal.c:96:15:96:21 | access to array |
+| argvLocal.c:96:15:96:18 | argv | argvLocal.c:96:15:96:21 | access to array indirection |
+| argvLocal.c:96:15:96:18 | argv | argvLocal.c:96:15:96:21 | access to array indirection |
 | argvLocal.c:100:7:100:10 | argv | argvLocal.c:101:9:101:10 | (const char *)... |
 | argvLocal.c:100:7:100:10 | argv | argvLocal.c:101:9:101:10 | (const char *)... |
 | argvLocal.c:100:7:100:10 | argv | argvLocal.c:101:9:101:10 | i1 |
 | argvLocal.c:100:7:100:10 | argv | argvLocal.c:101:9:101:10 | i1 |
 | argvLocal.c:100:7:100:10 | argv | argvLocal.c:101:9:101:10 | i1 |
 | argvLocal.c:100:7:100:10 | argv | argvLocal.c:101:9:101:10 | i1 |
+| argvLocal.c:100:7:100:10 | argv | argvLocal.c:101:9:101:10 | i1 indirection |
+| argvLocal.c:100:7:100:10 | argv | argvLocal.c:101:9:101:10 | i1 indirection |
 | argvLocal.c:100:7:100:10 | argv | argvLocal.c:102:15:102:16 | i1 |
 | argvLocal.c:100:7:100:10 | argv | argvLocal.c:102:15:102:16 | i1 |
 | argvLocal.c:100:7:100:10 | argv | argvLocal.c:102:15:102:16 | i1 |
 | argvLocal.c:100:7:100:10 | argv | argvLocal.c:102:15:102:16 | i1 |
+| argvLocal.c:100:7:100:10 | argv | argvLocal.c:102:15:102:16 | i1 indirection |
+| argvLocal.c:100:7:100:10 | argv | argvLocal.c:102:15:102:16 | i1 indirection |
 | argvLocal.c:100:7:100:10 | argv | argvLocal.c:144:9:144:10 | (const char *)... |
 | argvLocal.c:100:7:100:10 | argv | argvLocal.c:144:9:144:10 | (const char *)... |
 | argvLocal.c:100:7:100:10 | argv | argvLocal.c:144:9:144:10 | i7 |
 | argvLocal.c:100:7:100:10 | argv | argvLocal.c:144:9:144:10 | i7 |
 | argvLocal.c:100:7:100:10 | argv | argvLocal.c:144:9:144:10 | i7 |
 | argvLocal.c:100:7:100:10 | argv | argvLocal.c:144:9:144:10 | i7 |
+| argvLocal.c:100:7:100:10 | argv | argvLocal.c:144:9:144:10 | i7 indirection |
+| argvLocal.c:100:7:100:10 | argv | argvLocal.c:144:9:144:10 | i7 indirection |
 | argvLocal.c:100:7:100:10 | argv | argvLocal.c:145:15:145:16 | i7 |
 | argvLocal.c:100:7:100:10 | argv | argvLocal.c:145:15:145:16 | i7 |
 | argvLocal.c:100:7:100:10 | argv | argvLocal.c:145:15:145:16 | i7 |
 | argvLocal.c:100:7:100:10 | argv | argvLocal.c:145:15:145:16 | i7 |
+| argvLocal.c:100:7:100:10 | argv | argvLocal.c:145:15:145:16 | i7 indirection |
+| argvLocal.c:100:7:100:10 | argv | argvLocal.c:145:15:145:16 | i7 indirection |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:106:9:106:13 | (const char *)... |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:106:9:106:13 | (const char *)... |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:106:9:106:13 | access to array |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:106:9:106:13 | access to array |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:106:9:106:13 | access to array |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:106:9:106:13 | access to array |
+| argvLocal.c:105:14:105:17 | argv | argvLocal.c:106:9:106:13 | access to array indirection |
+| argvLocal.c:105:14:105:17 | argv | argvLocal.c:106:9:106:13 | access to array indirection |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:107:15:107:19 | access to array |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:107:15:107:19 | access to array |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:107:15:107:19 | access to array |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:107:15:107:19 | access to array |
+| argvLocal.c:105:14:105:17 | argv | argvLocal.c:107:15:107:19 | access to array indirection |
+| argvLocal.c:105:14:105:17 | argv | argvLocal.c:107:15:107:19 | access to array indirection |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:110:9:110:11 | (const char *)... |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:110:9:110:11 | (const char *)... |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:110:9:110:11 | * ... |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:110:9:110:11 | * ... |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:110:9:110:11 | * ... |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:110:9:110:11 | * ... |
+| argvLocal.c:105:14:105:17 | argv | argvLocal.c:110:9:110:11 | * ... indirection |
+| argvLocal.c:105:14:105:17 | argv | argvLocal.c:110:9:110:11 | * ... indirection |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:111:15:111:17 | * ... |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:111:15:111:17 | * ... |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:111:15:111:17 | * ... |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:111:15:111:17 | * ... |
+| argvLocal.c:105:14:105:17 | argv | argvLocal.c:111:15:111:17 | * ... indirection |
+| argvLocal.c:105:14:105:17 | argv | argvLocal.c:111:15:111:17 | * ... indirection |
 | argvLocal.c:115:13:115:16 | argv | argvLocal.c:116:9:116:10 | (const char *)... |
 | argvLocal.c:115:13:115:16 | argv | argvLocal.c:116:9:116:10 | (const char *)... |
 | argvLocal.c:115:13:115:16 | argv | argvLocal.c:116:9:116:10 | i3 |
 | argvLocal.c:115:13:115:16 | argv | argvLocal.c:116:9:116:10 | i3 |
+| argvLocal.c:115:13:115:16 | argv | argvLocal.c:116:9:116:10 | i3 indirection |
+| argvLocal.c:115:13:115:16 | argv | argvLocal.c:116:9:116:10 | i3 indirection |
 | argvLocal.c:115:13:115:16 | argv | argvLocal.c:117:2:117:13 | i3 |
 | argvLocal.c:115:13:115:16 | argv | argvLocal.c:117:2:117:13 | i3 |
 | argvLocal.c:115:13:115:16 | argv | argvLocal.c:117:15:117:16 | array to pointer conversion |
@@ -61,10 +83,14 @@ edges
 | argvLocal.c:115:13:115:16 | argv | argvLocal.c:117:15:117:16 | i3 |
 | argvLocal.c:115:13:115:16 | argv | argvLocal.c:117:15:117:16 | i3 indirection |
 | argvLocal.c:115:13:115:16 | argv | argvLocal.c:117:15:117:16 | i3 indirection |
+| argvLocal.c:115:13:115:16 | argv | argvLocal.c:117:15:117:16 | i3 indirection |
+| argvLocal.c:115:13:115:16 | argv | argvLocal.c:117:15:117:16 | i3 indirection |
 | argvLocal.c:115:13:115:16 | argv | argvLocal.c:121:9:121:10 | (const char *)... |
 | argvLocal.c:115:13:115:16 | argv | argvLocal.c:121:9:121:10 | (const char *)... |
 | argvLocal.c:115:13:115:16 | argv | argvLocal.c:121:9:121:10 | i4 |
 | argvLocal.c:115:13:115:16 | argv | argvLocal.c:121:9:121:10 | i4 |
+| argvLocal.c:115:13:115:16 | argv | argvLocal.c:121:9:121:10 | i4 indirection |
+| argvLocal.c:115:13:115:16 | argv | argvLocal.c:121:9:121:10 | i4 indirection |
 | argvLocal.c:115:13:115:16 | argv | argvLocal.c:122:2:122:13 | i4 |
 | argvLocal.c:115:13:115:16 | argv | argvLocal.c:122:2:122:13 | i4 |
 | argvLocal.c:115:13:115:16 | argv | argvLocal.c:122:15:122:16 | i4 |
@@ -73,36 +99,50 @@ edges
 | argvLocal.c:115:13:115:16 | argv | argvLocal.c:122:15:122:16 | i4 |
 | argvLocal.c:115:13:115:16 | argv | argvLocal.c:122:15:122:16 | i4 indirection |
 | argvLocal.c:115:13:115:16 | argv | argvLocal.c:122:15:122:16 | i4 indirection |
+| argvLocal.c:115:13:115:16 | argv | argvLocal.c:122:15:122:16 | i4 indirection |
+| argvLocal.c:115:13:115:16 | argv | argvLocal.c:122:15:122:16 | i4 indirection |
 | argvLocal.c:115:13:115:16 | argv | argvLocal.c:135:9:135:12 | (const char *)... |
 | argvLocal.c:115:13:115:16 | argv | argvLocal.c:135:9:135:12 | (const char *)... |
 | argvLocal.c:115:13:115:16 | argv | argvLocal.c:135:9:135:12 | ... ++ |
 | argvLocal.c:115:13:115:16 | argv | argvLocal.c:135:9:135:12 | ... ++ |
+| argvLocal.c:115:13:115:16 | argv | argvLocal.c:135:9:135:12 | ... ++ indirection |
+| argvLocal.c:115:13:115:16 | argv | argvLocal.c:135:9:135:12 | ... ++ indirection |
 | argvLocal.c:115:13:115:16 | argv | argvLocal.c:136:15:136:18 | -- ... |
 | argvLocal.c:115:13:115:16 | argv | argvLocal.c:136:15:136:18 | -- ... |
 | argvLocal.c:115:13:115:16 | argv | argvLocal.c:136:15:136:18 | -- ... |
 | argvLocal.c:115:13:115:16 | argv | argvLocal.c:136:15:136:18 | -- ... |
+| argvLocal.c:115:13:115:16 | argv | argvLocal.c:136:15:136:18 | -- ... indirection |
+| argvLocal.c:115:13:115:16 | argv | argvLocal.c:136:15:136:18 | -- ... indirection |
 | argvLocal.c:117:2:117:13 | i3 | argvLocal.c:117:15:117:16 | printWrapper output argument |
 | argvLocal.c:117:15:117:16 | i3 indirection | argvLocal.c:117:15:117:16 | printWrapper output argument |
 | argvLocal.c:117:15:117:16 | printWrapper output argument | argvLocal.c:121:9:121:10 | (const char *)... |
 | argvLocal.c:117:15:117:16 | printWrapper output argument | argvLocal.c:121:9:121:10 | i4 |
+| argvLocal.c:117:15:117:16 | printWrapper output argument | argvLocal.c:121:9:121:10 | i4 indirection |
 | argvLocal.c:117:15:117:16 | printWrapper output argument | argvLocal.c:122:2:122:13 | i4 |
 | argvLocal.c:117:15:117:16 | printWrapper output argument | argvLocal.c:122:15:122:16 | i4 |
 | argvLocal.c:117:15:117:16 | printWrapper output argument | argvLocal.c:122:15:122:16 | i4 |
 | argvLocal.c:117:15:117:16 | printWrapper output argument | argvLocal.c:122:15:122:16 | i4 indirection |
+| argvLocal.c:117:15:117:16 | printWrapper output argument | argvLocal.c:122:15:122:16 | i4 indirection |
 | argvLocal.c:117:15:117:16 | printWrapper output argument | argvLocal.c:135:9:135:12 | (const char *)... |
 | argvLocal.c:117:15:117:16 | printWrapper output argument | argvLocal.c:135:9:135:12 | ... ++ |
+| argvLocal.c:117:15:117:16 | printWrapper output argument | argvLocal.c:135:9:135:12 | ... ++ indirection |
 | argvLocal.c:117:15:117:16 | printWrapper output argument | argvLocal.c:136:15:136:18 | -- ... |
 | argvLocal.c:117:15:117:16 | printWrapper output argument | argvLocal.c:136:15:136:18 | -- ... |
+| argvLocal.c:117:15:117:16 | printWrapper output argument | argvLocal.c:136:15:136:18 | -- ... indirection |
 | argvLocal.c:122:2:122:13 | i4 | argvLocal.c:122:15:122:16 | printWrapper output argument |
 | argvLocal.c:122:15:122:16 | i4 indirection | argvLocal.c:122:15:122:16 | printWrapper output argument |
 | argvLocal.c:122:15:122:16 | printWrapper output argument | argvLocal.c:135:9:135:12 | (const char *)... |
 | argvLocal.c:122:15:122:16 | printWrapper output argument | argvLocal.c:135:9:135:12 | ... ++ |
+| argvLocal.c:122:15:122:16 | printWrapper output argument | argvLocal.c:135:9:135:12 | ... ++ indirection |
 | argvLocal.c:122:15:122:16 | printWrapper output argument | argvLocal.c:136:15:136:18 | -- ... |
 | argvLocal.c:122:15:122:16 | printWrapper output argument | argvLocal.c:136:15:136:18 | -- ... |
+| argvLocal.c:122:15:122:16 | printWrapper output argument | argvLocal.c:136:15:136:18 | -- ... indirection |
 | argvLocal.c:126:10:126:13 | argv | argvLocal.c:127:9:127:10 | (const char *)... |
 | argvLocal.c:126:10:126:13 | argv | argvLocal.c:127:9:127:10 | (const char *)... |
 | argvLocal.c:126:10:126:13 | argv | argvLocal.c:127:9:127:10 | i5 |
 | argvLocal.c:126:10:126:13 | argv | argvLocal.c:127:9:127:10 | i5 |
+| argvLocal.c:126:10:126:13 | argv | argvLocal.c:127:9:127:10 | i5 indirection |
+| argvLocal.c:126:10:126:13 | argv | argvLocal.c:127:9:127:10 | i5 indirection |
 | argvLocal.c:126:10:126:13 | argv | argvLocal.c:128:2:128:13 | i5 |
 | argvLocal.c:126:10:126:13 | argv | argvLocal.c:128:2:128:13 | i5 |
 | argvLocal.c:126:10:126:13 | argv | argvLocal.c:128:15:128:16 | array to pointer conversion |
@@ -111,56 +151,80 @@ edges
 | argvLocal.c:126:10:126:13 | argv | argvLocal.c:128:15:128:16 | i5 |
 | argvLocal.c:126:10:126:13 | argv | argvLocal.c:128:15:128:16 | i5 indirection |
 | argvLocal.c:126:10:126:13 | argv | argvLocal.c:128:15:128:16 | i5 indirection |
+| argvLocal.c:126:10:126:13 | argv | argvLocal.c:128:15:128:16 | i5 indirection |
+| argvLocal.c:126:10:126:13 | argv | argvLocal.c:128:15:128:16 | i5 indirection |
 | argvLocal.c:126:10:126:13 | argv | argvLocal.c:131:9:131:14 | (const char *)... |
 | argvLocal.c:126:10:126:13 | argv | argvLocal.c:131:9:131:14 | (const char *)... |
 | argvLocal.c:126:10:126:13 | argv | argvLocal.c:131:9:131:14 | ... + ... |
 | argvLocal.c:126:10:126:13 | argv | argvLocal.c:131:9:131:14 | ... + ... |
+| argvLocal.c:126:10:126:13 | argv | argvLocal.c:131:9:131:14 | ... + ... indirection |
+| argvLocal.c:126:10:126:13 | argv | argvLocal.c:131:9:131:14 | ... + ... indirection |
 | argvLocal.c:126:10:126:13 | argv | argvLocal.c:132:15:132:20 | ... + ... |
 | argvLocal.c:126:10:126:13 | argv | argvLocal.c:132:15:132:20 | ... + ... |
 | argvLocal.c:126:10:126:13 | argv | argvLocal.c:132:15:132:20 | ... + ... |
 | argvLocal.c:126:10:126:13 | argv | argvLocal.c:132:15:132:20 | ... + ... |
+| argvLocal.c:126:10:126:13 | argv | argvLocal.c:132:15:132:20 | ... + ... indirection |
+| argvLocal.c:126:10:126:13 | argv | argvLocal.c:132:15:132:20 | ... + ... indirection |
 | argvLocal.c:128:2:128:13 | i5 | argvLocal.c:128:15:128:16 | printWrapper output argument |
 | argvLocal.c:128:15:128:16 | i5 indirection | argvLocal.c:128:15:128:16 | printWrapper output argument |
 | argvLocal.c:128:15:128:16 | printWrapper output argument | argvLocal.c:131:9:131:14 | (const char *)... |
 | argvLocal.c:128:15:128:16 | printWrapper output argument | argvLocal.c:131:9:131:14 | ... + ... |
+| argvLocal.c:128:15:128:16 | printWrapper output argument | argvLocal.c:131:9:131:14 | ... + ... indirection |
 | argvLocal.c:128:15:128:16 | printWrapper output argument | argvLocal.c:132:15:132:20 | ... + ... |
 | argvLocal.c:128:15:128:16 | printWrapper output argument | argvLocal.c:132:15:132:20 | ... + ... |
+| argvLocal.c:128:15:128:16 | printWrapper output argument | argvLocal.c:132:15:132:20 | ... + ... indirection |
 | argvLocal.c:149:11:149:14 | argv | argvLocal.c:150:9:150:10 | (const char *)... |
 | argvLocal.c:149:11:149:14 | argv | argvLocal.c:150:9:150:10 | (const char *)... |
 | argvLocal.c:149:11:149:14 | argv | argvLocal.c:150:9:150:10 | i8 |
 | argvLocal.c:149:11:149:14 | argv | argvLocal.c:150:9:150:10 | i8 |
 | argvLocal.c:149:11:149:14 | argv | argvLocal.c:150:9:150:10 | i8 |
 | argvLocal.c:149:11:149:14 | argv | argvLocal.c:150:9:150:10 | i8 |
+| argvLocal.c:149:11:149:14 | argv | argvLocal.c:150:9:150:10 | i8 indirection |
+| argvLocal.c:149:11:149:14 | argv | argvLocal.c:150:9:150:10 | i8 indirection |
 | argvLocal.c:149:11:149:14 | argv | argvLocal.c:151:15:151:16 | i8 |
 | argvLocal.c:149:11:149:14 | argv | argvLocal.c:151:15:151:16 | i8 |
 | argvLocal.c:149:11:149:14 | argv | argvLocal.c:151:15:151:16 | i8 |
 | argvLocal.c:149:11:149:14 | argv | argvLocal.c:151:15:151:16 | i8 |
+| argvLocal.c:149:11:149:14 | argv | argvLocal.c:151:15:151:16 | i8 indirection |
+| argvLocal.c:149:11:149:14 | argv | argvLocal.c:151:15:151:16 | i8 indirection |
 | argvLocal.c:156:23:156:26 | argv | argvLocal.c:157:9:157:10 | (const char *)... |
 | argvLocal.c:156:23:156:26 | argv | argvLocal.c:157:9:157:10 | (const char *)... |
 | argvLocal.c:156:23:156:26 | argv | argvLocal.c:157:9:157:10 | i9 |
 | argvLocal.c:156:23:156:26 | argv | argvLocal.c:157:9:157:10 | i9 |
+| argvLocal.c:156:23:156:26 | argv | argvLocal.c:157:9:157:10 | i9 indirection |
+| argvLocal.c:156:23:156:26 | argv | argvLocal.c:157:9:157:10 | i9 indirection |
 | argvLocal.c:156:23:156:26 | argv | argvLocal.c:158:15:158:16 | i9 |
 | argvLocal.c:156:23:156:26 | argv | argvLocal.c:158:15:158:16 | i9 |
 | argvLocal.c:156:23:156:26 | argv | argvLocal.c:158:15:158:16 | i9 |
 | argvLocal.c:156:23:156:26 | argv | argvLocal.c:158:15:158:16 | i9 |
+| argvLocal.c:156:23:156:26 | argv | argvLocal.c:158:15:158:16 | i9 indirection |
+| argvLocal.c:156:23:156:26 | argv | argvLocal.c:158:15:158:16 | i9 indirection |
 | argvLocal.c:163:22:163:25 | argv | argvLocal.c:164:9:164:11 | (const char *)... |
 | argvLocal.c:163:22:163:25 | argv | argvLocal.c:164:9:164:11 | (const char *)... |
 | argvLocal.c:163:22:163:25 | argv | argvLocal.c:164:9:164:11 | i91 |
 | argvLocal.c:163:22:163:25 | argv | argvLocal.c:164:9:164:11 | i91 |
+| argvLocal.c:163:22:163:25 | argv | argvLocal.c:164:9:164:11 | i91 indirection |
+| argvLocal.c:163:22:163:25 | argv | argvLocal.c:164:9:164:11 | i91 indirection |
 | argvLocal.c:163:22:163:25 | argv | argvLocal.c:165:15:165:17 | i91 |
 | argvLocal.c:163:22:163:25 | argv | argvLocal.c:165:15:165:17 | i91 |
 | argvLocal.c:163:22:163:25 | argv | argvLocal.c:165:15:165:17 | i91 |
 | argvLocal.c:163:22:163:25 | argv | argvLocal.c:165:15:165:17 | i91 |
+| argvLocal.c:163:22:163:25 | argv | argvLocal.c:165:15:165:17 | i91 indirection |
+| argvLocal.c:163:22:163:25 | argv | argvLocal.c:165:15:165:17 | i91 indirection |
 | argvLocal.c:168:18:168:21 | argv | argvLocal.c:169:9:169:20 | (char *)... |
 | argvLocal.c:168:18:168:21 | argv | argvLocal.c:169:9:169:20 | (char *)... |
 | argvLocal.c:168:18:168:21 | argv | argvLocal.c:169:9:169:20 | (const char *)... |
 | argvLocal.c:168:18:168:21 | argv | argvLocal.c:169:9:169:20 | (const char *)... |
+| argvLocal.c:168:18:168:21 | argv | argvLocal.c:169:9:169:20 | i10 indirection |
+| argvLocal.c:168:18:168:21 | argv | argvLocal.c:169:9:169:20 | i10 indirection |
 | argvLocal.c:168:18:168:21 | argv | argvLocal.c:169:18:169:20 | i10 |
 | argvLocal.c:168:18:168:21 | argv | argvLocal.c:169:18:169:20 | i10 |
 | argvLocal.c:168:18:168:21 | argv | argvLocal.c:169:18:169:20 | i10 |
 | argvLocal.c:168:18:168:21 | argv | argvLocal.c:169:18:169:20 | i10 |
 | argvLocal.c:168:18:168:21 | argv | argvLocal.c:170:15:170:26 | (char *)... |
 | argvLocal.c:168:18:168:21 | argv | argvLocal.c:170:15:170:26 | (char *)... |
+| argvLocal.c:168:18:168:21 | argv | argvLocal.c:170:15:170:26 | i10 indirection |
+| argvLocal.c:168:18:168:21 | argv | argvLocal.c:170:15:170:26 | i10 indirection |
 | argvLocal.c:168:18:168:21 | argv | argvLocal.c:170:24:170:26 | i10 |
 | argvLocal.c:168:18:168:21 | argv | argvLocal.c:170:24:170:26 | i10 |
 | argvLocal.c:168:18:168:21 | argv | argvLocal.c:170:24:170:26 | i10 |
@@ -176,11 +240,15 @@ nodes
 | argvLocal.c:95:9:95:15 | access to array | semmle.label | access to array |
 | argvLocal.c:95:9:95:15 | access to array | semmle.label | access to array |
 | argvLocal.c:95:9:95:15 | access to array | semmle.label | access to array |
+| argvLocal.c:95:9:95:15 | access to array indirection | semmle.label | access to array indirection |
+| argvLocal.c:95:9:95:15 | access to array indirection | semmle.label | access to array indirection |
 | argvLocal.c:96:15:96:18 | argv | semmle.label | argv |
 | argvLocal.c:96:15:96:18 | argv | semmle.label | argv |
 | argvLocal.c:96:15:96:21 | access to array | semmle.label | access to array |
 | argvLocal.c:96:15:96:21 | access to array | semmle.label | access to array |
 | argvLocal.c:96:15:96:21 | access to array | semmle.label | access to array |
+| argvLocal.c:96:15:96:21 | access to array indirection | semmle.label | access to array indirection |
+| argvLocal.c:96:15:96:21 | access to array indirection | semmle.label | access to array indirection |
 | argvLocal.c:100:7:100:10 | argv | semmle.label | argv |
 | argvLocal.c:100:7:100:10 | argv | semmle.label | argv |
 | argvLocal.c:101:9:101:10 | (const char *)... | semmle.label | (const char *)... |
@@ -188,9 +256,13 @@ nodes
 | argvLocal.c:101:9:101:10 | i1 | semmle.label | i1 |
 | argvLocal.c:101:9:101:10 | i1 | semmle.label | i1 |
 | argvLocal.c:101:9:101:10 | i1 | semmle.label | i1 |
+| argvLocal.c:101:9:101:10 | i1 indirection | semmle.label | i1 indirection |
+| argvLocal.c:101:9:101:10 | i1 indirection | semmle.label | i1 indirection |
 | argvLocal.c:102:15:102:16 | i1 | semmle.label | i1 |
 | argvLocal.c:102:15:102:16 | i1 | semmle.label | i1 |
 | argvLocal.c:102:15:102:16 | i1 | semmle.label | i1 |
+| argvLocal.c:102:15:102:16 | i1 indirection | semmle.label | i1 indirection |
+| argvLocal.c:102:15:102:16 | i1 indirection | semmle.label | i1 indirection |
 | argvLocal.c:105:14:105:17 | argv | semmle.label | argv |
 | argvLocal.c:105:14:105:17 | argv | semmle.label | argv |
 | argvLocal.c:106:9:106:13 | (const char *)... | semmle.label | (const char *)... |
@@ -198,68 +270,97 @@ nodes
 | argvLocal.c:106:9:106:13 | access to array | semmle.label | access to array |
 | argvLocal.c:106:9:106:13 | access to array | semmle.label | access to array |
 | argvLocal.c:106:9:106:13 | access to array | semmle.label | access to array |
+| argvLocal.c:106:9:106:13 | access to array indirection | semmle.label | access to array indirection |
+| argvLocal.c:106:9:106:13 | access to array indirection | semmle.label | access to array indirection |
 | argvLocal.c:107:15:107:19 | access to array | semmle.label | access to array |
 | argvLocal.c:107:15:107:19 | access to array | semmle.label | access to array |
 | argvLocal.c:107:15:107:19 | access to array | semmle.label | access to array |
+| argvLocal.c:107:15:107:19 | access to array indirection | semmle.label | access to array indirection |
+| argvLocal.c:107:15:107:19 | access to array indirection | semmle.label | access to array indirection |
 | argvLocal.c:110:9:110:11 | (const char *)... | semmle.label | (const char *)... |
 | argvLocal.c:110:9:110:11 | (const char *)... | semmle.label | (const char *)... |
 | argvLocal.c:110:9:110:11 | * ... | semmle.label | * ... |
 | argvLocal.c:110:9:110:11 | * ... | semmle.label | * ... |
 | argvLocal.c:110:9:110:11 | * ... | semmle.label | * ... |
+| argvLocal.c:110:9:110:11 | * ... indirection | semmle.label | * ... indirection |
+| argvLocal.c:110:9:110:11 | * ... indirection | semmle.label | * ... indirection |
 | argvLocal.c:111:15:111:17 | * ... | semmle.label | * ... |
 | argvLocal.c:111:15:111:17 | * ... | semmle.label | * ... |
 | argvLocal.c:111:15:111:17 | * ... | semmle.label | * ... |
+| argvLocal.c:111:15:111:17 | * ... indirection | semmle.label | * ... indirection |
+| argvLocal.c:111:15:111:17 | * ... indirection | semmle.label | * ... indirection |
 | argvLocal.c:115:13:115:16 | argv | semmle.label | argv |
 | argvLocal.c:115:13:115:16 | argv | semmle.label | argv |
 | argvLocal.c:116:9:116:10 | (const char *)... | semmle.label | (const char *)... |
 | argvLocal.c:116:9:116:10 | (const char *)... | semmle.label | (const char *)... |
 | argvLocal.c:116:9:116:10 | i3 | semmle.label | i3 |
+| argvLocal.c:116:9:116:10 | i3 indirection | semmle.label | i3 indirection |
+| argvLocal.c:116:9:116:10 | i3 indirection | semmle.label | i3 indirection |
 | argvLocal.c:117:2:117:13 | i3 | semmle.label | i3 |
 | argvLocal.c:117:15:117:16 | array to pointer conversion | semmle.label | array to pointer conversion |
 | argvLocal.c:117:15:117:16 | array to pointer conversion | semmle.label | array to pointer conversion |
 | argvLocal.c:117:15:117:16 | i3 | semmle.label | i3 |
 | argvLocal.c:117:15:117:16 | i3 indirection | semmle.label | i3 indirection |
+| argvLocal.c:117:15:117:16 | i3 indirection | semmle.label | i3 indirection |
 | argvLocal.c:117:15:117:16 | printWrapper output argument | semmle.label | printWrapper output argument |
 | argvLocal.c:121:9:121:10 | (const char *)... | semmle.label | (const char *)... |
 | argvLocal.c:121:9:121:10 | (const char *)... | semmle.label | (const char *)... |
 | argvLocal.c:121:9:121:10 | i4 | semmle.label | i4 |
+| argvLocal.c:121:9:121:10 | i4 indirection | semmle.label | i4 indirection |
+| argvLocal.c:121:9:121:10 | i4 indirection | semmle.label | i4 indirection |
 | argvLocal.c:122:2:122:13 | i4 | semmle.label | i4 |
 | argvLocal.c:122:15:122:16 | i4 | semmle.label | i4 |
 | argvLocal.c:122:15:122:16 | i4 | semmle.label | i4 |
 | argvLocal.c:122:15:122:16 | i4 | semmle.label | i4 |
 | argvLocal.c:122:15:122:16 | i4 indirection | semmle.label | i4 indirection |
+| argvLocal.c:122:15:122:16 | i4 indirection | semmle.label | i4 indirection |
 | argvLocal.c:122:15:122:16 | printWrapper output argument | semmle.label | printWrapper output argument |
 | argvLocal.c:126:10:126:13 | argv | semmle.label | argv |
 | argvLocal.c:126:10:126:13 | argv | semmle.label | argv |
 | argvLocal.c:127:9:127:10 | (const char *)... | semmle.label | (const char *)... |
 | argvLocal.c:127:9:127:10 | (const char *)... | semmle.label | (const char *)... |
 | argvLocal.c:127:9:127:10 | i5 | semmle.label | i5 |
+| argvLocal.c:127:9:127:10 | i5 indirection | semmle.label | i5 indirection |
+| argvLocal.c:127:9:127:10 | i5 indirection | semmle.label | i5 indirection |
 | argvLocal.c:128:2:128:13 | i5 | semmle.label | i5 |
 | argvLocal.c:128:15:128:16 | array to pointer conversion | semmle.label | array to pointer conversion |
 | argvLocal.c:128:15:128:16 | array to pointer conversion | semmle.label | array to pointer conversion |
 | argvLocal.c:128:15:128:16 | i5 | semmle.label | i5 |
 | argvLocal.c:128:15:128:16 | i5 indirection | semmle.label | i5 indirection |
+| argvLocal.c:128:15:128:16 | i5 indirection | semmle.label | i5 indirection |
 | argvLocal.c:128:15:128:16 | printWrapper output argument | semmle.label | printWrapper output argument |
 | argvLocal.c:131:9:131:14 | (const char *)... | semmle.label | (const char *)... |
 | argvLocal.c:131:9:131:14 | (const char *)... | semmle.label | (const char *)... |
 | argvLocal.c:131:9:131:14 | ... + ... | semmle.label | ... + ... |
+| argvLocal.c:131:9:131:14 | ... + ... indirection | semmle.label | ... + ... indirection |
+| argvLocal.c:131:9:131:14 | ... + ... indirection | semmle.label | ... + ... indirection |
 | argvLocal.c:132:15:132:20 | ... + ... | semmle.label | ... + ... |
 | argvLocal.c:132:15:132:20 | ... + ... | semmle.label | ... + ... |
 | argvLocal.c:132:15:132:20 | ... + ... | semmle.label | ... + ... |
+| argvLocal.c:132:15:132:20 | ... + ... indirection | semmle.label | ... + ... indirection |
+| argvLocal.c:132:15:132:20 | ... + ... indirection | semmle.label | ... + ... indirection |
 | argvLocal.c:135:9:135:12 | (const char *)... | semmle.label | (const char *)... |
 | argvLocal.c:135:9:135:12 | (const char *)... | semmle.label | (const char *)... |
 | argvLocal.c:135:9:135:12 | ... ++ | semmle.label | ... ++ |
+| argvLocal.c:135:9:135:12 | ... ++ indirection | semmle.label | ... ++ indirection |
+| argvLocal.c:135:9:135:12 | ... ++ indirection | semmle.label | ... ++ indirection |
 | argvLocal.c:136:15:136:18 | -- ... | semmle.label | -- ... |
 | argvLocal.c:136:15:136:18 | -- ... | semmle.label | -- ... |
 | argvLocal.c:136:15:136:18 | -- ... | semmle.label | -- ... |
+| argvLocal.c:136:15:136:18 | -- ... indirection | semmle.label | -- ... indirection |
+| argvLocal.c:136:15:136:18 | -- ... indirection | semmle.label | -- ... indirection |
 | argvLocal.c:144:9:144:10 | (const char *)... | semmle.label | (const char *)... |
 | argvLocal.c:144:9:144:10 | (const char *)... | semmle.label | (const char *)... |
 | argvLocal.c:144:9:144:10 | i7 | semmle.label | i7 |
 | argvLocal.c:144:9:144:10 | i7 | semmle.label | i7 |
 | argvLocal.c:144:9:144:10 | i7 | semmle.label | i7 |
+| argvLocal.c:144:9:144:10 | i7 indirection | semmle.label | i7 indirection |
+| argvLocal.c:144:9:144:10 | i7 indirection | semmle.label | i7 indirection |
 | argvLocal.c:145:15:145:16 | i7 | semmle.label | i7 |
 | argvLocal.c:145:15:145:16 | i7 | semmle.label | i7 |
 | argvLocal.c:145:15:145:16 | i7 | semmle.label | i7 |
+| argvLocal.c:145:15:145:16 | i7 indirection | semmle.label | i7 indirection |
+| argvLocal.c:145:15:145:16 | i7 indirection | semmle.label | i7 indirection |
 | argvLocal.c:149:11:149:14 | argv | semmle.label | argv |
 | argvLocal.c:149:11:149:14 | argv | semmle.label | argv |
 | argvLocal.c:150:9:150:10 | (const char *)... | semmle.label | (const char *)... |
@@ -267,36 +368,52 @@ nodes
 | argvLocal.c:150:9:150:10 | i8 | semmle.label | i8 |
 | argvLocal.c:150:9:150:10 | i8 | semmle.label | i8 |
 | argvLocal.c:150:9:150:10 | i8 | semmle.label | i8 |
+| argvLocal.c:150:9:150:10 | i8 indirection | semmle.label | i8 indirection |
+| argvLocal.c:150:9:150:10 | i8 indirection | semmle.label | i8 indirection |
 | argvLocal.c:151:15:151:16 | i8 | semmle.label | i8 |
 | argvLocal.c:151:15:151:16 | i8 | semmle.label | i8 |
 | argvLocal.c:151:15:151:16 | i8 | semmle.label | i8 |
+| argvLocal.c:151:15:151:16 | i8 indirection | semmle.label | i8 indirection |
+| argvLocal.c:151:15:151:16 | i8 indirection | semmle.label | i8 indirection |
 | argvLocal.c:156:23:156:26 | argv | semmle.label | argv |
 | argvLocal.c:156:23:156:26 | argv | semmle.label | argv |
 | argvLocal.c:157:9:157:10 | (const char *)... | semmle.label | (const char *)... |
 | argvLocal.c:157:9:157:10 | (const char *)... | semmle.label | (const char *)... |
 | argvLocal.c:157:9:157:10 | i9 | semmle.label | i9 |
+| argvLocal.c:157:9:157:10 | i9 indirection | semmle.label | i9 indirection |
+| argvLocal.c:157:9:157:10 | i9 indirection | semmle.label | i9 indirection |
 | argvLocal.c:158:15:158:16 | i9 | semmle.label | i9 |
 | argvLocal.c:158:15:158:16 | i9 | semmle.label | i9 |
 | argvLocal.c:158:15:158:16 | i9 | semmle.label | i9 |
+| argvLocal.c:158:15:158:16 | i9 indirection | semmle.label | i9 indirection |
+| argvLocal.c:158:15:158:16 | i9 indirection | semmle.label | i9 indirection |
 | argvLocal.c:163:22:163:25 | argv | semmle.label | argv |
 | argvLocal.c:163:22:163:25 | argv | semmle.label | argv |
 | argvLocal.c:164:9:164:11 | (const char *)... | semmle.label | (const char *)... |
 | argvLocal.c:164:9:164:11 | (const char *)... | semmle.label | (const char *)... |
 | argvLocal.c:164:9:164:11 | i91 | semmle.label | i91 |
+| argvLocal.c:164:9:164:11 | i91 indirection | semmle.label | i91 indirection |
+| argvLocal.c:164:9:164:11 | i91 indirection | semmle.label | i91 indirection |
 | argvLocal.c:165:15:165:17 | i91 | semmle.label | i91 |
 | argvLocal.c:165:15:165:17 | i91 | semmle.label | i91 |
 | argvLocal.c:165:15:165:17 | i91 | semmle.label | i91 |
+| argvLocal.c:165:15:165:17 | i91 indirection | semmle.label | i91 indirection |
+| argvLocal.c:165:15:165:17 | i91 indirection | semmle.label | i91 indirection |
 | argvLocal.c:168:18:168:21 | argv | semmle.label | argv |
 | argvLocal.c:168:18:168:21 | argv | semmle.label | argv |
 | argvLocal.c:169:9:169:20 | (char *)... | semmle.label | (char *)... |
 | argvLocal.c:169:9:169:20 | (char *)... | semmle.label | (char *)... |
 | argvLocal.c:169:9:169:20 | (const char *)... | semmle.label | (const char *)... |
 | argvLocal.c:169:9:169:20 | (const char *)... | semmle.label | (const char *)... |
+| argvLocal.c:169:9:169:20 | i10 indirection | semmle.label | i10 indirection |
+| argvLocal.c:169:9:169:20 | i10 indirection | semmle.label | i10 indirection |
 | argvLocal.c:169:18:169:20 | i10 | semmle.label | i10 |
 | argvLocal.c:169:18:169:20 | i10 | semmle.label | i10 |
 | argvLocal.c:169:18:169:20 | i10 | semmle.label | i10 |
 | argvLocal.c:170:15:170:26 | (char *)... | semmle.label | (char *)... |
 | argvLocal.c:170:15:170:26 | (char *)... | semmle.label | (char *)... |
+| argvLocal.c:170:15:170:26 | i10 indirection | semmle.label | i10 indirection |
+| argvLocal.c:170:15:170:26 | i10 indirection | semmle.label | i10 indirection |
 | argvLocal.c:170:24:170:26 | i10 | semmle.label | i10 |
 | argvLocal.c:170:24:170:26 | i10 | semmle.label | i10 |
 | argvLocal.c:170:24:170:26 | i10 | semmle.label | i10 |
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/funcs/funcsLocal.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/funcs/funcsLocal.expected
index a05e392ecf2..ceaf0489ec6 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/funcs/funcsLocal.expected
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/funcs/funcsLocal.expected
@@ -1,51 +1,71 @@
 edges
 | funcsLocal.c:16:8:16:9 | fread output argument | funcsLocal.c:17:9:17:10 | (const char *)... |
 | funcsLocal.c:16:8:16:9 | fread output argument | funcsLocal.c:17:9:17:10 | i1 |
+| funcsLocal.c:16:8:16:9 | fread output argument | funcsLocal.c:17:9:17:10 | i1 indirection |
 | funcsLocal.c:16:8:16:9 | fread output argument | funcsLocal.c:58:9:58:10 | (const char *)... |
 | funcsLocal.c:16:8:16:9 | fread output argument | funcsLocal.c:58:9:58:10 | e1 |
+| funcsLocal.c:16:8:16:9 | fread output argument | funcsLocal.c:58:9:58:10 | e1 indirection |
 | funcsLocal.c:16:8:16:9 | i1 | funcsLocal.c:17:9:17:10 | (const char *)... |
 | funcsLocal.c:16:8:16:9 | i1 | funcsLocal.c:17:9:17:10 | i1 |
+| funcsLocal.c:16:8:16:9 | i1 | funcsLocal.c:17:9:17:10 | i1 indirection |
 | funcsLocal.c:16:8:16:9 | i1 | funcsLocal.c:58:9:58:10 | (const char *)... |
 | funcsLocal.c:16:8:16:9 | i1 | funcsLocal.c:58:9:58:10 | e1 |
+| funcsLocal.c:16:8:16:9 | i1 | funcsLocal.c:58:9:58:10 | e1 indirection |
 | funcsLocal.c:26:8:26:9 | fgets output argument | funcsLocal.c:27:9:27:10 | (const char *)... |
 | funcsLocal.c:26:8:26:9 | fgets output argument | funcsLocal.c:27:9:27:10 | i3 |
+| funcsLocal.c:26:8:26:9 | fgets output argument | funcsLocal.c:27:9:27:10 | i3 indirection |
 | funcsLocal.c:26:8:26:9 | i3 | funcsLocal.c:27:9:27:10 | (const char *)... |
 | funcsLocal.c:26:8:26:9 | i3 | funcsLocal.c:27:9:27:10 | i3 |
+| funcsLocal.c:26:8:26:9 | i3 | funcsLocal.c:27:9:27:10 | i3 indirection |
 | funcsLocal.c:31:13:31:17 | call to fgets | funcsLocal.c:32:9:32:10 | (const char *)... |
 | funcsLocal.c:31:13:31:17 | call to fgets | funcsLocal.c:32:9:32:10 | (const char *)... |
 | funcsLocal.c:31:13:31:17 | call to fgets | funcsLocal.c:32:9:32:10 | i4 |
 | funcsLocal.c:31:13:31:17 | call to fgets | funcsLocal.c:32:9:32:10 | i4 |
 | funcsLocal.c:31:13:31:17 | call to fgets | funcsLocal.c:32:9:32:10 | i4 |
 | funcsLocal.c:31:13:31:17 | call to fgets | funcsLocal.c:32:9:32:10 | i4 |
+| funcsLocal.c:31:13:31:17 | call to fgets | funcsLocal.c:32:9:32:10 | i4 indirection |
+| funcsLocal.c:31:13:31:17 | call to fgets | funcsLocal.c:32:9:32:10 | i4 indirection |
 | funcsLocal.c:31:19:31:21 | fgets output argument | funcsLocal.c:32:9:32:10 | (const char *)... |
 | funcsLocal.c:31:19:31:21 | fgets output argument | funcsLocal.c:32:9:32:10 | i4 |
+| funcsLocal.c:31:19:31:21 | fgets output argument | funcsLocal.c:32:9:32:10 | i4 indirection |
 | funcsLocal.c:31:19:31:21 | i41 | funcsLocal.c:32:9:32:10 | (const char *)... |
 | funcsLocal.c:31:19:31:21 | i41 | funcsLocal.c:32:9:32:10 | i4 |
+| funcsLocal.c:31:19:31:21 | i41 | funcsLocal.c:32:9:32:10 | i4 indirection |
 | funcsLocal.c:36:7:36:8 | gets output argument | funcsLocal.c:37:9:37:10 | (const char *)... |
 | funcsLocal.c:36:7:36:8 | gets output argument | funcsLocal.c:37:9:37:10 | i5 |
+| funcsLocal.c:36:7:36:8 | gets output argument | funcsLocal.c:37:9:37:10 | i5 indirection |
 | funcsLocal.c:36:7:36:8 | i5 | funcsLocal.c:37:9:37:10 | (const char *)... |
 | funcsLocal.c:36:7:36:8 | i5 | funcsLocal.c:37:9:37:10 | i5 |
+| funcsLocal.c:36:7:36:8 | i5 | funcsLocal.c:37:9:37:10 | i5 indirection |
 | funcsLocal.c:41:13:41:16 | call to gets | funcsLocal.c:42:9:42:10 | (const char *)... |
 | funcsLocal.c:41:13:41:16 | call to gets | funcsLocal.c:42:9:42:10 | (const char *)... |
 | funcsLocal.c:41:13:41:16 | call to gets | funcsLocal.c:42:9:42:10 | i6 |
 | funcsLocal.c:41:13:41:16 | call to gets | funcsLocal.c:42:9:42:10 | i6 |
 | funcsLocal.c:41:13:41:16 | call to gets | funcsLocal.c:42:9:42:10 | i6 |
 | funcsLocal.c:41:13:41:16 | call to gets | funcsLocal.c:42:9:42:10 | i6 |
+| funcsLocal.c:41:13:41:16 | call to gets | funcsLocal.c:42:9:42:10 | i6 indirection |
+| funcsLocal.c:41:13:41:16 | call to gets | funcsLocal.c:42:9:42:10 | i6 indirection |
 | funcsLocal.c:41:18:41:20 | gets output argument | funcsLocal.c:42:9:42:10 | (const char *)... |
 | funcsLocal.c:41:18:41:20 | gets output argument | funcsLocal.c:42:9:42:10 | i6 |
+| funcsLocal.c:41:18:41:20 | gets output argument | funcsLocal.c:42:9:42:10 | i6 indirection |
 | funcsLocal.c:41:18:41:20 | i61 | funcsLocal.c:42:9:42:10 | (const char *)... |
 | funcsLocal.c:41:18:41:20 | i61 | funcsLocal.c:42:9:42:10 | i6 |
+| funcsLocal.c:41:18:41:20 | i61 | funcsLocal.c:42:9:42:10 | i6 indirection |
 nodes
 | funcsLocal.c:16:8:16:9 | fread output argument | semmle.label | fread output argument |
 | funcsLocal.c:16:8:16:9 | i1 | semmle.label | i1 |
 | funcsLocal.c:17:9:17:10 | (const char *)... | semmle.label | (const char *)... |
 | funcsLocal.c:17:9:17:10 | (const char *)... | semmle.label | (const char *)... |
 | funcsLocal.c:17:9:17:10 | i1 | semmle.label | i1 |
+| funcsLocal.c:17:9:17:10 | i1 indirection | semmle.label | i1 indirection |
+| funcsLocal.c:17:9:17:10 | i1 indirection | semmle.label | i1 indirection |
 | funcsLocal.c:26:8:26:9 | fgets output argument | semmle.label | fgets output argument |
 | funcsLocal.c:26:8:26:9 | i3 | semmle.label | i3 |
 | funcsLocal.c:27:9:27:10 | (const char *)... | semmle.label | (const char *)... |
 | funcsLocal.c:27:9:27:10 | (const char *)... | semmle.label | (const char *)... |
 | funcsLocal.c:27:9:27:10 | i3 | semmle.label | i3 |
+| funcsLocal.c:27:9:27:10 | i3 indirection | semmle.label | i3 indirection |
+| funcsLocal.c:27:9:27:10 | i3 indirection | semmle.label | i3 indirection |
 | funcsLocal.c:31:13:31:17 | call to fgets | semmle.label | call to fgets |
 | funcsLocal.c:31:13:31:17 | call to fgets | semmle.label | call to fgets |
 | funcsLocal.c:31:19:31:21 | fgets output argument | semmle.label | fgets output argument |
@@ -55,11 +75,15 @@ nodes
 | funcsLocal.c:32:9:32:10 | i4 | semmle.label | i4 |
 | funcsLocal.c:32:9:32:10 | i4 | semmle.label | i4 |
 | funcsLocal.c:32:9:32:10 | i4 | semmle.label | i4 |
+| funcsLocal.c:32:9:32:10 | i4 indirection | semmle.label | i4 indirection |
+| funcsLocal.c:32:9:32:10 | i4 indirection | semmle.label | i4 indirection |
 | funcsLocal.c:36:7:36:8 | gets output argument | semmle.label | gets output argument |
 | funcsLocal.c:36:7:36:8 | i5 | semmle.label | i5 |
 | funcsLocal.c:37:9:37:10 | (const char *)... | semmle.label | (const char *)... |
 | funcsLocal.c:37:9:37:10 | (const char *)... | semmle.label | (const char *)... |
 | funcsLocal.c:37:9:37:10 | i5 | semmle.label | i5 |
+| funcsLocal.c:37:9:37:10 | i5 indirection | semmle.label | i5 indirection |
+| funcsLocal.c:37:9:37:10 | i5 indirection | semmle.label | i5 indirection |
 | funcsLocal.c:41:13:41:16 | call to gets | semmle.label | call to gets |
 | funcsLocal.c:41:13:41:16 | call to gets | semmle.label | call to gets |
 | funcsLocal.c:41:18:41:20 | gets output argument | semmle.label | gets output argument |
@@ -69,9 +93,13 @@ nodes
 | funcsLocal.c:42:9:42:10 | i6 | semmle.label | i6 |
 | funcsLocal.c:42:9:42:10 | i6 | semmle.label | i6 |
 | funcsLocal.c:42:9:42:10 | i6 | semmle.label | i6 |
+| funcsLocal.c:42:9:42:10 | i6 indirection | semmle.label | i6 indirection |
+| funcsLocal.c:42:9:42:10 | i6 indirection | semmle.label | i6 indirection |
 | funcsLocal.c:58:9:58:10 | (const char *)... | semmle.label | (const char *)... |
 | funcsLocal.c:58:9:58:10 | (const char *)... | semmle.label | (const char *)... |
 | funcsLocal.c:58:9:58:10 | e1 | semmle.label | e1 |
+| funcsLocal.c:58:9:58:10 | e1 indirection | semmle.label | e1 indirection |
+| funcsLocal.c:58:9:58:10 | e1 indirection | semmle.label | e1 indirection |
 #select
 | funcsLocal.c:17:9:17:10 | i1 | funcsLocal.c:16:8:16:9 | i1 | funcsLocal.c:17:9:17:10 | i1 | The value of this argument may come from $@ and is being used as a formatting argument to printf(format) | funcsLocal.c:16:8:16:9 | i1 | fread |
 | funcsLocal.c:27:9:27:10 | i3 | funcsLocal.c:26:8:26:9 | i3 | funcsLocal.c:27:9:27:10 | i3 | The value of this argument may come from $@ and is being used as a formatting argument to printf(format) | funcsLocal.c:26:8:26:9 | i3 | fgets |
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/globalVars/UncontrolledFormatStringThroughGlobalVar.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/globalVars/UncontrolledFormatStringThroughGlobalVar.expected
index 1e66a438a5a..f095153f39c 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/globalVars/UncontrolledFormatStringThroughGlobalVar.expected
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/globalVars/UncontrolledFormatStringThroughGlobalVar.expected
@@ -29,18 +29,23 @@ edges
 | globalVars.c:24:11:24:14 | argv indirection | globalVars.c:11:22:11:25 | *argv |
 | globalVars.c:27:9:27:12 | copy | globalVars.c:27:9:27:12 | (const char *)... |
 | globalVars.c:27:9:27:12 | copy | globalVars.c:27:9:27:12 | copy |
+| globalVars.c:27:9:27:12 | copy | globalVars.c:27:9:27:12 | copy indirection |
 | globalVars.c:30:15:30:18 | copy | globalVars.c:30:15:30:18 | copy |
 | globalVars.c:30:15:30:18 | copy | globalVars.c:30:15:30:18 | copy |
 | globalVars.c:30:15:30:18 | copy | globalVars.c:30:15:30:18 | copy |
+| globalVars.c:30:15:30:18 | copy | globalVars.c:30:15:30:18 | copy indirection |
 | globalVars.c:35:2:35:9 | copy | globalVars.c:15:21:15:23 | val |
 | globalVars.c:35:11:35:14 | copy | globalVars.c:35:2:35:9 | copy |
 | globalVars.c:38:9:38:13 | copy2 | globalVars.c:38:9:38:13 | (const char *)... |
 | globalVars.c:38:9:38:13 | copy2 | globalVars.c:38:9:38:13 | copy2 |
+| globalVars.c:38:9:38:13 | copy2 | globalVars.c:38:9:38:13 | copy2 indirection |
 | globalVars.c:41:15:41:19 | copy2 | globalVars.c:41:15:41:19 | copy2 |
 | globalVars.c:41:15:41:19 | copy2 | globalVars.c:41:15:41:19 | copy2 |
 | globalVars.c:41:15:41:19 | copy2 | globalVars.c:41:15:41:19 | copy2 |
+| globalVars.c:41:15:41:19 | copy2 | globalVars.c:41:15:41:19 | copy2 indirection |
 | globalVars.c:50:9:50:13 | copy2 | globalVars.c:50:9:50:13 | (const char *)... |
 | globalVars.c:50:9:50:13 | copy2 | globalVars.c:50:9:50:13 | copy2 |
+| globalVars.c:50:9:50:13 | copy2 | globalVars.c:50:9:50:13 | copy2 indirection |
 nodes
 | globalVars.c:8:7:8:10 | copy | semmle.label | copy |
 | globalVars.c:9:7:9:11 | copy2 | semmle.label | copy2 |
@@ -58,9 +63,13 @@ nodes
 | globalVars.c:27:9:27:12 | copy | semmle.label | copy |
 | globalVars.c:27:9:27:12 | copy | semmle.label | copy |
 | globalVars.c:27:9:27:12 | copy | semmle.label | copy |
+| globalVars.c:27:9:27:12 | copy indirection | semmle.label | copy indirection |
+| globalVars.c:27:9:27:12 | copy indirection | semmle.label | copy indirection |
 | globalVars.c:30:15:30:18 | copy | semmle.label | copy |
 | globalVars.c:30:15:30:18 | copy | semmle.label | copy |
 | globalVars.c:30:15:30:18 | copy | semmle.label | copy |
+| globalVars.c:30:15:30:18 | copy indirection | semmle.label | copy indirection |
+| globalVars.c:30:15:30:18 | copy indirection | semmle.label | copy indirection |
 | globalVars.c:35:2:35:9 | copy | semmle.label | copy |
 | globalVars.c:35:11:35:14 | copy | semmle.label | copy |
 | globalVars.c:38:9:38:13 | (const char *)... | semmle.label | (const char *)... |
@@ -68,14 +77,20 @@ nodes
 | globalVars.c:38:9:38:13 | copy2 | semmle.label | copy2 |
 | globalVars.c:38:9:38:13 | copy2 | semmle.label | copy2 |
 | globalVars.c:38:9:38:13 | copy2 | semmle.label | copy2 |
+| globalVars.c:38:9:38:13 | copy2 indirection | semmle.label | copy2 indirection |
+| globalVars.c:38:9:38:13 | copy2 indirection | semmle.label | copy2 indirection |
 | globalVars.c:41:15:41:19 | copy2 | semmle.label | copy2 |
 | globalVars.c:41:15:41:19 | copy2 | semmle.label | copy2 |
 | globalVars.c:41:15:41:19 | copy2 | semmle.label | copy2 |
+| globalVars.c:41:15:41:19 | copy2 indirection | semmle.label | copy2 indirection |
+| globalVars.c:41:15:41:19 | copy2 indirection | semmle.label | copy2 indirection |
 | globalVars.c:50:9:50:13 | (const char *)... | semmle.label | (const char *)... |
 | globalVars.c:50:9:50:13 | (const char *)... | semmle.label | (const char *)... |
 | globalVars.c:50:9:50:13 | copy2 | semmle.label | copy2 |
 | globalVars.c:50:9:50:13 | copy2 | semmle.label | copy2 |
 | globalVars.c:50:9:50:13 | copy2 | semmle.label | copy2 |
+| globalVars.c:50:9:50:13 | copy2 indirection | semmle.label | copy2 indirection |
+| globalVars.c:50:9:50:13 | copy2 indirection | semmle.label | copy2 indirection |
 #select
 | globalVars.c:27:9:27:12 | copy | globalVars.c:24:11:24:14 | argv | globalVars.c:27:9:27:12 | copy | The value of this argument may come from $@ and is being used as a formatting argument to printf(format) | globalVars.c:24:11:24:14 | argv | argv |
 | globalVars.c:30:15:30:18 | copy | globalVars.c:24:11:24:14 | argv | globalVars.c:30:15:30:18 | copy | The value of this argument may come from $@ and is being used as a formatting argument to printWrapper(str), which calls printf(format) | globalVars.c:24:11:24:14 | argv | argv |
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/ifs/ifs.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/ifs/ifs.expected
index 62c36d0192d..50ae940400a 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/ifs/ifs.expected
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/ifs/ifs.expected
@@ -5,66 +5,88 @@ edges
 | ifs.c:61:8:61:11 | argv | ifs.c:62:9:62:10 | c7 |
 | ifs.c:61:8:61:11 | argv | ifs.c:62:9:62:10 | c7 |
 | ifs.c:61:8:61:11 | argv | ifs.c:62:9:62:10 | c7 |
+| ifs.c:61:8:61:11 | argv | ifs.c:62:9:62:10 | c7 indirection |
+| ifs.c:61:8:61:11 | argv | ifs.c:62:9:62:10 | c7 indirection |
 | ifs.c:68:8:68:11 | argv | ifs.c:69:9:69:10 | (const char *)... |
 | ifs.c:68:8:68:11 | argv | ifs.c:69:9:69:10 | (const char *)... |
 | ifs.c:68:8:68:11 | argv | ifs.c:69:9:69:10 | c8 |
 | ifs.c:68:8:68:11 | argv | ifs.c:69:9:69:10 | c8 |
 | ifs.c:68:8:68:11 | argv | ifs.c:69:9:69:10 | c8 |
 | ifs.c:68:8:68:11 | argv | ifs.c:69:9:69:10 | c8 |
+| ifs.c:68:8:68:11 | argv | ifs.c:69:9:69:10 | c8 indirection |
+| ifs.c:68:8:68:11 | argv | ifs.c:69:9:69:10 | c8 indirection |
 | ifs.c:74:8:74:11 | argv | ifs.c:75:9:75:10 | (const char *)... |
 | ifs.c:74:8:74:11 | argv | ifs.c:75:9:75:10 | (const char *)... |
 | ifs.c:74:8:74:11 | argv | ifs.c:75:9:75:10 | i1 |
 | ifs.c:74:8:74:11 | argv | ifs.c:75:9:75:10 | i1 |
 | ifs.c:74:8:74:11 | argv | ifs.c:75:9:75:10 | i1 |
 | ifs.c:74:8:74:11 | argv | ifs.c:75:9:75:10 | i1 |
+| ifs.c:74:8:74:11 | argv | ifs.c:75:9:75:10 | i1 indirection |
+| ifs.c:74:8:74:11 | argv | ifs.c:75:9:75:10 | i1 indirection |
 | ifs.c:80:8:80:11 | argv | ifs.c:81:9:81:10 | (const char *)... |
 | ifs.c:80:8:80:11 | argv | ifs.c:81:9:81:10 | (const char *)... |
 | ifs.c:80:8:80:11 | argv | ifs.c:81:9:81:10 | i2 |
 | ifs.c:80:8:80:11 | argv | ifs.c:81:9:81:10 | i2 |
 | ifs.c:80:8:80:11 | argv | ifs.c:81:9:81:10 | i2 |
 | ifs.c:80:8:80:11 | argv | ifs.c:81:9:81:10 | i2 |
+| ifs.c:80:8:80:11 | argv | ifs.c:81:9:81:10 | i2 indirection |
+| ifs.c:80:8:80:11 | argv | ifs.c:81:9:81:10 | i2 indirection |
 | ifs.c:86:8:86:11 | argv | ifs.c:87:9:87:10 | (const char *)... |
 | ifs.c:86:8:86:11 | argv | ifs.c:87:9:87:10 | (const char *)... |
 | ifs.c:86:8:86:11 | argv | ifs.c:87:9:87:10 | i3 |
 | ifs.c:86:8:86:11 | argv | ifs.c:87:9:87:10 | i3 |
 | ifs.c:86:8:86:11 | argv | ifs.c:87:9:87:10 | i3 |
 | ifs.c:86:8:86:11 | argv | ifs.c:87:9:87:10 | i3 |
+| ifs.c:86:8:86:11 | argv | ifs.c:87:9:87:10 | i3 indirection |
+| ifs.c:86:8:86:11 | argv | ifs.c:87:9:87:10 | i3 indirection |
 | ifs.c:92:8:92:11 | argv | ifs.c:93:9:93:10 | (const char *)... |
 | ifs.c:92:8:92:11 | argv | ifs.c:93:9:93:10 | (const char *)... |
 | ifs.c:92:8:92:11 | argv | ifs.c:93:9:93:10 | i4 |
 | ifs.c:92:8:92:11 | argv | ifs.c:93:9:93:10 | i4 |
 | ifs.c:92:8:92:11 | argv | ifs.c:93:9:93:10 | i4 |
 | ifs.c:92:8:92:11 | argv | ifs.c:93:9:93:10 | i4 |
+| ifs.c:92:8:92:11 | argv | ifs.c:93:9:93:10 | i4 indirection |
+| ifs.c:92:8:92:11 | argv | ifs.c:93:9:93:10 | i4 indirection |
 | ifs.c:98:8:98:11 | argv | ifs.c:99:9:99:10 | (const char *)... |
 | ifs.c:98:8:98:11 | argv | ifs.c:99:9:99:10 | (const char *)... |
 | ifs.c:98:8:98:11 | argv | ifs.c:99:9:99:10 | i5 |
 | ifs.c:98:8:98:11 | argv | ifs.c:99:9:99:10 | i5 |
 | ifs.c:98:8:98:11 | argv | ifs.c:99:9:99:10 | i5 |
 | ifs.c:98:8:98:11 | argv | ifs.c:99:9:99:10 | i5 |
+| ifs.c:98:8:98:11 | argv | ifs.c:99:9:99:10 | i5 indirection |
+| ifs.c:98:8:98:11 | argv | ifs.c:99:9:99:10 | i5 indirection |
 | ifs.c:105:8:105:11 | argv | ifs.c:106:9:106:10 | (const char *)... |
 | ifs.c:105:8:105:11 | argv | ifs.c:106:9:106:10 | (const char *)... |
 | ifs.c:105:8:105:11 | argv | ifs.c:106:9:106:10 | i6 |
 | ifs.c:105:8:105:11 | argv | ifs.c:106:9:106:10 | i6 |
 | ifs.c:105:8:105:11 | argv | ifs.c:106:9:106:10 | i6 |
 | ifs.c:105:8:105:11 | argv | ifs.c:106:9:106:10 | i6 |
+| ifs.c:105:8:105:11 | argv | ifs.c:106:9:106:10 | i6 indirection |
+| ifs.c:105:8:105:11 | argv | ifs.c:106:9:106:10 | i6 indirection |
 | ifs.c:111:8:111:11 | argv | ifs.c:112:9:112:10 | (const char *)... |
 | ifs.c:111:8:111:11 | argv | ifs.c:112:9:112:10 | (const char *)... |
 | ifs.c:111:8:111:11 | argv | ifs.c:112:9:112:10 | i7 |
 | ifs.c:111:8:111:11 | argv | ifs.c:112:9:112:10 | i7 |
 | ifs.c:111:8:111:11 | argv | ifs.c:112:9:112:10 | i7 |
 | ifs.c:111:8:111:11 | argv | ifs.c:112:9:112:10 | i7 |
+| ifs.c:111:8:111:11 | argv | ifs.c:112:9:112:10 | i7 indirection |
+| ifs.c:111:8:111:11 | argv | ifs.c:112:9:112:10 | i7 indirection |
 | ifs.c:117:8:117:11 | argv | ifs.c:118:9:118:10 | (const char *)... |
 | ifs.c:117:8:117:11 | argv | ifs.c:118:9:118:10 | (const char *)... |
 | ifs.c:117:8:117:11 | argv | ifs.c:118:9:118:10 | i8 |
 | ifs.c:117:8:117:11 | argv | ifs.c:118:9:118:10 | i8 |
 | ifs.c:117:8:117:11 | argv | ifs.c:118:9:118:10 | i8 |
 | ifs.c:117:8:117:11 | argv | ifs.c:118:9:118:10 | i8 |
+| ifs.c:117:8:117:11 | argv | ifs.c:118:9:118:10 | i8 indirection |
+| ifs.c:117:8:117:11 | argv | ifs.c:118:9:118:10 | i8 indirection |
 | ifs.c:123:8:123:11 | argv | ifs.c:124:9:124:10 | (const char *)... |
 | ifs.c:123:8:123:11 | argv | ifs.c:124:9:124:10 | (const char *)... |
 | ifs.c:123:8:123:11 | argv | ifs.c:124:9:124:10 | i9 |
 | ifs.c:123:8:123:11 | argv | ifs.c:124:9:124:10 | i9 |
 | ifs.c:123:8:123:11 | argv | ifs.c:124:9:124:10 | i9 |
 | ifs.c:123:8:123:11 | argv | ifs.c:124:9:124:10 | i9 |
+| ifs.c:123:8:123:11 | argv | ifs.c:124:9:124:10 | i9 indirection |
+| ifs.c:123:8:123:11 | argv | ifs.c:124:9:124:10 | i9 indirection |
 nodes
 | ifs.c:61:8:61:11 | argv | semmle.label | argv |
 | ifs.c:61:8:61:11 | argv | semmle.label | argv |
@@ -73,6 +95,8 @@ nodes
 | ifs.c:62:9:62:10 | c7 | semmle.label | c7 |
 | ifs.c:62:9:62:10 | c7 | semmle.label | c7 |
 | ifs.c:62:9:62:10 | c7 | semmle.label | c7 |
+| ifs.c:62:9:62:10 | c7 indirection | semmle.label | c7 indirection |
+| ifs.c:62:9:62:10 | c7 indirection | semmle.label | c7 indirection |
 | ifs.c:68:8:68:11 | argv | semmle.label | argv |
 | ifs.c:68:8:68:11 | argv | semmle.label | argv |
 | ifs.c:69:9:69:10 | (const char *)... | semmle.label | (const char *)... |
@@ -80,6 +104,8 @@ nodes
 | ifs.c:69:9:69:10 | c8 | semmle.label | c8 |
 | ifs.c:69:9:69:10 | c8 | semmle.label | c8 |
 | ifs.c:69:9:69:10 | c8 | semmle.label | c8 |
+| ifs.c:69:9:69:10 | c8 indirection | semmle.label | c8 indirection |
+| ifs.c:69:9:69:10 | c8 indirection | semmle.label | c8 indirection |
 | ifs.c:74:8:74:11 | argv | semmle.label | argv |
 | ifs.c:74:8:74:11 | argv | semmle.label | argv |
 | ifs.c:75:9:75:10 | (const char *)... | semmle.label | (const char *)... |
@@ -87,6 +113,8 @@ nodes
 | ifs.c:75:9:75:10 | i1 | semmle.label | i1 |
 | ifs.c:75:9:75:10 | i1 | semmle.label | i1 |
 | ifs.c:75:9:75:10 | i1 | semmle.label | i1 |
+| ifs.c:75:9:75:10 | i1 indirection | semmle.label | i1 indirection |
+| ifs.c:75:9:75:10 | i1 indirection | semmle.label | i1 indirection |
 | ifs.c:80:8:80:11 | argv | semmle.label | argv |
 | ifs.c:80:8:80:11 | argv | semmle.label | argv |
 | ifs.c:81:9:81:10 | (const char *)... | semmle.label | (const char *)... |
@@ -94,6 +122,8 @@ nodes
 | ifs.c:81:9:81:10 | i2 | semmle.label | i2 |
 | ifs.c:81:9:81:10 | i2 | semmle.label | i2 |
 | ifs.c:81:9:81:10 | i2 | semmle.label | i2 |
+| ifs.c:81:9:81:10 | i2 indirection | semmle.label | i2 indirection |
+| ifs.c:81:9:81:10 | i2 indirection | semmle.label | i2 indirection |
 | ifs.c:86:8:86:11 | argv | semmle.label | argv |
 | ifs.c:86:8:86:11 | argv | semmle.label | argv |
 | ifs.c:87:9:87:10 | (const char *)... | semmle.label | (const char *)... |
@@ -101,6 +131,8 @@ nodes
 | ifs.c:87:9:87:10 | i3 | semmle.label | i3 |
 | ifs.c:87:9:87:10 | i3 | semmle.label | i3 |
 | ifs.c:87:9:87:10 | i3 | semmle.label | i3 |
+| ifs.c:87:9:87:10 | i3 indirection | semmle.label | i3 indirection |
+| ifs.c:87:9:87:10 | i3 indirection | semmle.label | i3 indirection |
 | ifs.c:92:8:92:11 | argv | semmle.label | argv |
 | ifs.c:92:8:92:11 | argv | semmle.label | argv |
 | ifs.c:93:9:93:10 | (const char *)... | semmle.label | (const char *)... |
@@ -108,6 +140,8 @@ nodes
 | ifs.c:93:9:93:10 | i4 | semmle.label | i4 |
 | ifs.c:93:9:93:10 | i4 | semmle.label | i4 |
 | ifs.c:93:9:93:10 | i4 | semmle.label | i4 |
+| ifs.c:93:9:93:10 | i4 indirection | semmle.label | i4 indirection |
+| ifs.c:93:9:93:10 | i4 indirection | semmle.label | i4 indirection |
 | ifs.c:98:8:98:11 | argv | semmle.label | argv |
 | ifs.c:98:8:98:11 | argv | semmle.label | argv |
 | ifs.c:99:9:99:10 | (const char *)... | semmle.label | (const char *)... |
@@ -115,6 +149,8 @@ nodes
 | ifs.c:99:9:99:10 | i5 | semmle.label | i5 |
 | ifs.c:99:9:99:10 | i5 | semmle.label | i5 |
 | ifs.c:99:9:99:10 | i5 | semmle.label | i5 |
+| ifs.c:99:9:99:10 | i5 indirection | semmle.label | i5 indirection |
+| ifs.c:99:9:99:10 | i5 indirection | semmle.label | i5 indirection |
 | ifs.c:105:8:105:11 | argv | semmle.label | argv |
 | ifs.c:105:8:105:11 | argv | semmle.label | argv |
 | ifs.c:106:9:106:10 | (const char *)... | semmle.label | (const char *)... |
@@ -122,6 +158,8 @@ nodes
 | ifs.c:106:9:106:10 | i6 | semmle.label | i6 |
 | ifs.c:106:9:106:10 | i6 | semmle.label | i6 |
 | ifs.c:106:9:106:10 | i6 | semmle.label | i6 |
+| ifs.c:106:9:106:10 | i6 indirection | semmle.label | i6 indirection |
+| ifs.c:106:9:106:10 | i6 indirection | semmle.label | i6 indirection |
 | ifs.c:111:8:111:11 | argv | semmle.label | argv |
 | ifs.c:111:8:111:11 | argv | semmle.label | argv |
 | ifs.c:112:9:112:10 | (const char *)... | semmle.label | (const char *)... |
@@ -129,6 +167,8 @@ nodes
 | ifs.c:112:9:112:10 | i7 | semmle.label | i7 |
 | ifs.c:112:9:112:10 | i7 | semmle.label | i7 |
 | ifs.c:112:9:112:10 | i7 | semmle.label | i7 |
+| ifs.c:112:9:112:10 | i7 indirection | semmle.label | i7 indirection |
+| ifs.c:112:9:112:10 | i7 indirection | semmle.label | i7 indirection |
 | ifs.c:117:8:117:11 | argv | semmle.label | argv |
 | ifs.c:117:8:117:11 | argv | semmle.label | argv |
 | ifs.c:118:9:118:10 | (const char *)... | semmle.label | (const char *)... |
@@ -136,6 +176,8 @@ nodes
 | ifs.c:118:9:118:10 | i8 | semmle.label | i8 |
 | ifs.c:118:9:118:10 | i8 | semmle.label | i8 |
 | ifs.c:118:9:118:10 | i8 | semmle.label | i8 |
+| ifs.c:118:9:118:10 | i8 indirection | semmle.label | i8 indirection |
+| ifs.c:118:9:118:10 | i8 indirection | semmle.label | i8 indirection |
 | ifs.c:123:8:123:11 | argv | semmle.label | argv |
 | ifs.c:123:8:123:11 | argv | semmle.label | argv |
 | ifs.c:124:9:124:10 | (const char *)... | semmle.label | (const char *)... |
@@ -143,6 +185,8 @@ nodes
 | ifs.c:124:9:124:10 | i9 | semmle.label | i9 |
 | ifs.c:124:9:124:10 | i9 | semmle.label | i9 |
 | ifs.c:124:9:124:10 | i9 | semmle.label | i9 |
+| ifs.c:124:9:124:10 | i9 indirection | semmle.label | i9 indirection |
+| ifs.c:124:9:124:10 | i9 indirection | semmle.label | i9 indirection |
 #select
 | ifs.c:62:9:62:10 | c7 | ifs.c:61:8:61:11 | argv | ifs.c:62:9:62:10 | c7 | The value of this argument may come from $@ and is being used as a formatting argument to printf(format) | ifs.c:61:8:61:11 | argv | argv |
 | ifs.c:69:9:69:10 | c8 | ifs.c:68:8:68:11 | argv | ifs.c:69:9:69:10 | c8 | The value of this argument may come from $@ and is being used as a formatting argument to printf(format) | ifs.c:68:8:68:11 | argv | argv |
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/TaintedAllocationSize.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/TaintedAllocationSize.expected
index 8b5e24af336..25ff3162973 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/TaintedAllocationSize.expected
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/TaintedAllocationSize.expected
@@ -27,6 +27,24 @@ edges
 | test.cpp:39:21:39:24 | argv | test.cpp:52:35:52:60 | ... * ... |
 | test.cpp:39:21:39:24 | argv | test.cpp:52:35:52:60 | ... * ... |
 | test.cpp:39:21:39:24 | argv | test.cpp:52:35:52:60 | ... * ... |
+| test.cpp:75:25:75:29 | start | test.cpp:79:18:79:28 | ... - ... |
+| test.cpp:75:25:75:29 | start | test.cpp:79:18:79:28 | ... - ... |
+| test.cpp:75:38:75:40 | end | test.cpp:79:18:79:28 | ... - ... |
+| test.cpp:75:38:75:40 | end | test.cpp:79:18:79:28 | ... - ... |
+| test.cpp:97:18:97:23 | buffer | test.cpp:100:4:100:15 | buffer |
+| test.cpp:97:18:97:23 | buffer | test.cpp:100:17:100:22 | buffer indirection |
+| test.cpp:97:18:97:23 | buffer | test.cpp:101:4:101:15 | ... + ... |
+| test.cpp:97:18:97:23 | buffer | test.cpp:101:4:101:15 | buffer |
+| test.cpp:97:18:97:23 | fread output argument | test.cpp:100:4:100:15 | buffer |
+| test.cpp:97:18:97:23 | fread output argument | test.cpp:100:17:100:22 | buffer indirection |
+| test.cpp:97:18:97:23 | fread output argument | test.cpp:101:4:101:15 | ... + ... |
+| test.cpp:97:18:97:23 | fread output argument | test.cpp:101:4:101:15 | buffer |
+| test.cpp:100:4:100:15 | buffer | test.cpp:100:17:100:22 | processData1 output argument |
+| test.cpp:100:17:100:22 | buffer indirection | test.cpp:100:17:100:22 | processData1 output argument |
+| test.cpp:100:17:100:22 | processData1 output argument | test.cpp:101:4:101:15 | ... + ... |
+| test.cpp:100:17:100:22 | processData1 output argument | test.cpp:101:4:101:15 | buffer |
+| test.cpp:101:4:101:15 | ... + ... | test.cpp:75:38:75:40 | end |
+| test.cpp:101:4:101:15 | buffer | test.cpp:75:25:75:29 | start |
 | test.cpp:123:18:123:23 | call to getenv | test.cpp:127:24:127:41 | ... * ... |
 | test.cpp:123:18:123:23 | call to getenv | test.cpp:127:24:127:41 | ... * ... |
 | test.cpp:123:18:123:31 | (const char *)... | test.cpp:127:24:127:41 | ... * ... |
@@ -106,6 +124,21 @@ nodes
 | test.cpp:52:35:52:60 | ... * ... | semmle.label | ... * ... |
 | test.cpp:52:35:52:60 | ... * ... | semmle.label | ... * ... |
 | test.cpp:52:35:52:60 | ... * ... | semmle.label | ... * ... |
+| test.cpp:64:25:64:30 | *buffer | semmle.label | *buffer |
+| test.cpp:64:25:64:30 | *buffer | semmle.label | *buffer |
+| test.cpp:64:25:64:30 | buffer | semmle.label | buffer |
+| test.cpp:75:25:75:29 | start | semmle.label | start |
+| test.cpp:75:38:75:40 | end | semmle.label | end |
+| test.cpp:79:18:79:28 | ... - ... | semmle.label | ... - ... |
+| test.cpp:79:18:79:28 | ... - ... | semmle.label | ... - ... |
+| test.cpp:79:18:79:28 | ... - ... | semmle.label | ... - ... |
+| test.cpp:97:18:97:23 | buffer | semmle.label | buffer |
+| test.cpp:97:18:97:23 | fread output argument | semmle.label | fread output argument |
+| test.cpp:100:4:100:15 | buffer | semmle.label | buffer |
+| test.cpp:100:17:100:22 | buffer indirection | semmle.label | buffer indirection |
+| test.cpp:100:17:100:22 | processData1 output argument | semmle.label | processData1 output argument |
+| test.cpp:101:4:101:15 | ... + ... | semmle.label | ... + ... |
+| test.cpp:101:4:101:15 | buffer | semmle.label | buffer |
 | test.cpp:123:18:123:23 | call to getenv | semmle.label | call to getenv |
 | test.cpp:123:18:123:31 | (const char *)... | semmle.label | (const char *)... |
 | test.cpp:127:24:127:41 | ... * ... | semmle.label | ... * ... |
@@ -180,6 +213,7 @@ nodes
 | test.cpp:48:25:48:30 | call to malloc | test.cpp:39:21:39:24 | argv | test.cpp:48:32:48:35 | size | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) |
 | test.cpp:49:17:49:30 | new[] | test.cpp:39:21:39:24 | argv | test.cpp:49:26:49:29 | size | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) |
 | test.cpp:52:21:52:27 | call to realloc | test.cpp:39:21:39:24 | argv | test.cpp:52:35:52:60 | ... * ... | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) |
+| test.cpp:79:9:79:29 | new[] | test.cpp:97:18:97:23 | buffer | test.cpp:79:18:79:28 | ... - ... | This allocation size is derived from $@ and might overflow | test.cpp:97:18:97:23 | buffer | user input (fread) |
 | test.cpp:127:17:127:22 | call to malloc | test.cpp:123:18:123:23 | call to getenv | test.cpp:127:24:127:41 | ... * ... | This allocation size is derived from $@ and might overflow | test.cpp:123:18:123:23 | call to getenv | user input (getenv) |
 | test.cpp:134:3:134:8 | call to malloc | test.cpp:132:19:132:24 | call to getenv | test.cpp:134:10:134:27 | ... * ... | This allocation size is derived from $@ and might overflow | test.cpp:132:19:132:24 | call to getenv | user input (getenv) |
 | test.cpp:142:4:142:9 | call to malloc | test.cpp:138:19:138:24 | call to getenv | test.cpp:142:11:142:28 | ... * ... | This allocation size is derived from $@ and might overflow | test.cpp:138:19:138:24 | call to getenv | user input (getenv) |
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/test.cpp
index 0683f7211e3..943bc3b1214 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/test.cpp
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/test.cpp
@@ -76,7 +76,7 @@ void processData2(char *start, char *end)
 {
 	char *copy;
 
-	copy = new char[end - start]; // GOOD
+	copy = new char[end - start]; // GOOD [FALSE POSITIVE]
 
 	// ...
 
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/extreme/ArithmeticWithExtremeValues.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/extreme/ArithmeticWithExtremeValues.expected
index a46371f36b6..77b08e62d83 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/extreme/ArithmeticWithExtremeValues.expected
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/extreme/ArithmeticWithExtremeValues.expected
@@ -4,5 +4,4 @@
 | test.c:59:3:59:5 | sc6 | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:58:9:58:16 | 127 | Extreme value |
 | test.c:63:3:63:5 | sc8 | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.c:62:9:62:16 | - ... | Extreme value |
 | test.c:75:3:75:5 | sc1 | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:74:9:74:16 | 127 | Extreme value |
-| test.c:76:3:76:5 | sc1 | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:74:9:74:16 | 127 | Extreme value |
 | test.c:124:9:124:9 | x | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:118:17:118:23 | 2147483647 | Extreme value |
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/extreme/test.c b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/extreme/test.c
index 8c40d984ee0..ee2e041db3c 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/extreme/test.c
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/extreme/test.c
@@ -73,7 +73,7 @@ void test_negatives() {
 
   sc1 = CHAR_MAX;
   sc1 += 0; // GOOD [FALSE POSITIVE]
-  sc1 += -1; // GOOD [FALSE POSITIVE]
+  sc1 += -1; // GOOD
   sc2 = CHAR_MIN;
   sc2 += -1; // BAD [NOT DETECTED]
   sc3 = CHAR_MIN;
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/ArithmeticTainted.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/ArithmeticTainted.expected
index 8bb25025b86..bdf00e0a5df 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/ArithmeticTainted.expected
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/ArithmeticTainted.expected
@@ -1,8 +1,5 @@
 | test2.cpp:14:11:14:11 | v | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test2.cpp:25:22:25:23 | & ... | User-provided value |
 | test2.cpp:14:11:14:11 | v | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test2.cpp:25:22:25:23 | & ... | User-provided value |
-| test3.c:15:10:15:10 | x | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test3.c:11:15:11:18 | argv | User-provided value |
-| test3.c:15:14:15:14 | y | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test3.c:11:15:11:18 | argv | User-provided value |
-| test3.c:15:18:15:18 | z | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test3.c:11:15:11:18 | argv | User-provided value |
 | test5.cpp:17:6:17:18 | call to getTaintedInt | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test5.cpp:9:7:9:9 | buf | User-provided value |
 | test5.cpp:19:6:19:6 | y | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test5.cpp:9:7:9:9 | buf | User-provided value |
 | test5.cpp:19:6:19:6 | y | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test5.cpp:9:7:9:9 | buf | User-provided value |
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/uncontrolled/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/uncontrolled/test.cpp
index 5d4d7e8c5c3..d3dc3352a29 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/uncontrolled/test.cpp
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/uncontrolled/test.cpp
@@ -28,7 +28,7 @@ void randomTester2()
 	{
 		int r;
 		get_rand2(&r);
-		r = r + 100; // BAD [NOT DETECTED]
+		r = r + 100; // BAD
 	}
 
 	{
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-290/semmle/AuthenticationBypass/AuthenticationBypass.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-290/semmle/AuthenticationBypass/AuthenticationBypass.expected
index e2671c07952..1ad31c3f9f7 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-290/semmle/AuthenticationBypass/AuthenticationBypass.expected
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-290/semmle/AuthenticationBypass/AuthenticationBypass.expected
@@ -1,32 +1,44 @@
 edges
 | test.cpp:16:25:16:30 | call to getenv | test.cpp:20:14:20:20 | address |
 | test.cpp:16:25:16:30 | call to getenv | test.cpp:20:14:20:20 | address |
+| test.cpp:16:25:16:30 | call to getenv | test.cpp:20:14:20:20 | address indirection |
 | test.cpp:16:25:16:42 | (const char *)... | test.cpp:20:14:20:20 | address |
 | test.cpp:16:25:16:42 | (const char *)... | test.cpp:20:14:20:20 | address |
+| test.cpp:16:25:16:42 | (const char *)... | test.cpp:20:14:20:20 | address indirection |
 | test.cpp:27:25:27:30 | call to getenv | test.cpp:31:14:31:20 | address |
 | test.cpp:27:25:27:30 | call to getenv | test.cpp:31:14:31:20 | address |
+| test.cpp:27:25:27:30 | call to getenv | test.cpp:31:14:31:20 | address indirection |
 | test.cpp:27:25:27:42 | (const char *)... | test.cpp:31:14:31:20 | address |
 | test.cpp:27:25:27:42 | (const char *)... | test.cpp:31:14:31:20 | address |
+| test.cpp:27:25:27:42 | (const char *)... | test.cpp:31:14:31:20 | address indirection |
 | test.cpp:38:25:38:30 | call to getenv | test.cpp:42:14:42:20 | address |
 | test.cpp:38:25:38:30 | call to getenv | test.cpp:42:14:42:20 | address |
+| test.cpp:38:25:38:30 | call to getenv | test.cpp:42:14:42:20 | address indirection |
 | test.cpp:38:25:38:42 | (const char *)... | test.cpp:42:14:42:20 | address |
 | test.cpp:38:25:38:42 | (const char *)... | test.cpp:42:14:42:20 | address |
+| test.cpp:38:25:38:42 | (const char *)... | test.cpp:42:14:42:20 | address indirection |
 nodes
 | test.cpp:16:25:16:30 | call to getenv | semmle.label | call to getenv |
 | test.cpp:16:25:16:42 | (const char *)... | semmle.label | (const char *)... |
 | test.cpp:20:14:20:20 | address | semmle.label | address |
 | test.cpp:20:14:20:20 | address | semmle.label | address |
 | test.cpp:20:14:20:20 | address | semmle.label | address |
+| test.cpp:20:14:20:20 | address indirection | semmle.label | address indirection |
+| test.cpp:20:14:20:20 | address indirection | semmle.label | address indirection |
 | test.cpp:27:25:27:30 | call to getenv | semmle.label | call to getenv |
 | test.cpp:27:25:27:42 | (const char *)... | semmle.label | (const char *)... |
 | test.cpp:31:14:31:20 | address | semmle.label | address |
 | test.cpp:31:14:31:20 | address | semmle.label | address |
 | test.cpp:31:14:31:20 | address | semmle.label | address |
+| test.cpp:31:14:31:20 | address indirection | semmle.label | address indirection |
+| test.cpp:31:14:31:20 | address indirection | semmle.label | address indirection |
 | test.cpp:38:25:38:30 | call to getenv | semmle.label | call to getenv |
 | test.cpp:38:25:38:42 | (const char *)... | semmle.label | (const char *)... |
 | test.cpp:42:14:42:20 | address | semmle.label | address |
 | test.cpp:42:14:42:20 | address | semmle.label | address |
 | test.cpp:42:14:42:20 | address | semmle.label | address |
+| test.cpp:42:14:42:20 | address indirection | semmle.label | address indirection |
+| test.cpp:42:14:42:20 | address indirection | semmle.label | address indirection |
 #select
 | test.cpp:20:7:20:12 | call to strcmp | test.cpp:16:25:16:30 | call to getenv | test.cpp:20:14:20:20 | address | Untrusted input $@ might be vulnerable to a spoofing attack. | test.cpp:16:25:16:30 | call to getenv | call to getenv |
 | test.cpp:31:7:31:12 | call to strcmp | test.cpp:27:25:27:30 | call to getenv | test.cpp:31:14:31:20 | address | Untrusted input $@ might be vulnerable to a spoofing attack. | test.cpp:27:25:27:30 | call to getenv | call to getenv |
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/CleartextBufferWrite.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/CleartextBufferWrite.expected
index f78d75eeed1..e4f9bc918a4 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/CleartextBufferWrite.expected
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/CleartextBufferWrite.expected
@@ -3,11 +3,15 @@ edges
 | test.cpp:54:17:54:20 | argv | test.cpp:58:25:58:29 | input |
 | test.cpp:54:17:54:20 | argv | test.cpp:58:25:58:29 | input |
 | test.cpp:54:17:54:20 | argv | test.cpp:58:25:58:29 | input |
+| test.cpp:54:17:54:20 | argv | test.cpp:58:25:58:29 | input indirection |
+| test.cpp:54:17:54:20 | argv | test.cpp:58:25:58:29 | input indirection |
 nodes
 | test.cpp:54:17:54:20 | argv | semmle.label | argv |
 | test.cpp:54:17:54:20 | argv | semmle.label | argv |
 | test.cpp:58:25:58:29 | input | semmle.label | input |
 | test.cpp:58:25:58:29 | input | semmle.label | input |
 | test.cpp:58:25:58:29 | input | semmle.label | input |
+| test.cpp:58:25:58:29 | input indirection | semmle.label | input indirection |
+| test.cpp:58:25:58:29 | input indirection | semmle.label | input indirection |
 #select
 | test.cpp:58:3:58:9 | call to sprintf | test.cpp:54:17:54:20 | argv | test.cpp:58:25:58:29 | input | This write into buffer 'passwd' may contain unencrypted data from $@ | test.cpp:54:17:54:20 | argv | user input (argv) |
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-764/semmle/tests/UnreleasedLock.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-764/semmle/tests/UnreleasedLock.expected
index 0d06ce59719..de14b91f8eb 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-764/semmle/tests/UnreleasedLock.expected
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-764/semmle/tests/UnreleasedLock.expected
@@ -7,3 +7,4 @@
 | test.cpp:303:11:303:18 | call to try_lock | This lock might not be unlocked or might be locked more times than it is unlocked. |
 | test.cpp:313:11:313:18 | call to try_lock | This lock might not be unlocked or might be locked more times than it is unlocked. |
 | test.cpp:442:8:442:17 | call to mutex_lock | This lock might not be unlocked or might be locked more times than it is unlocked. |
+| test.cpp:482:2:482:19 | call to pthread_mutex_lock | This lock might not be unlocked or might be locked more times than it is unlocked. |
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-764/semmle/tests/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-764/semmle/tests/test.cpp
index c08ac2f63c3..9114e545fd5 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-764/semmle/tests/test.cpp
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-764/semmle/tests/test.cpp
@@ -445,3 +445,46 @@ bool test_mutex(data_t *data)
 
 	return true;
 }
+
+// ---
+
+struct pthread_mutex
+{
+	// ...
+};
+
+void pthread_mutex_lock(pthread_mutex *m);
+void pthread_mutex_unlock(pthread_mutex *m);
+
+class MyClass
+{
+public:
+	pthread_mutex lock;
+};
+
+bool maybe();
+
+int test_MyClass_good(MyClass *obj)
+{
+	pthread_mutex_lock(&obj->lock);
+	
+	if (maybe()) {
+		pthread_mutex_unlock(&obj->lock);
+		return -1; // GOOD
+	}
+
+	pthread_mutex_unlock(&obj->lock); // GOOD
+	return 0;
+}
+
+int test_MyClass_bad(MyClass *obj)
+{
+	pthread_mutex_lock(&obj->lock);
+
+	if (maybe()) {
+		return -1; // BAD
+	}
+
+	pthread_mutex_unlock(&obj->lock); // GOOD
+	return 0;
+}
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-807/semmle/TaintedCondition/TaintedCondition.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-807/semmle/TaintedCondition/TaintedCondition.expected
index cc5004047cf..e04a20830d0 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-807/semmle/TaintedCondition/TaintedCondition.expected
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-807/semmle/TaintedCondition/TaintedCondition.expected
@@ -1,37 +1,21 @@
 edges
 | test.cpp:20:29:20:34 | call to getenv | test.cpp:24:10:24:35 | ! ... |
 | test.cpp:20:29:20:34 | call to getenv | test.cpp:24:11:24:16 | call to strcmp |
-| test.cpp:20:29:20:34 | call to getenv | test.cpp:24:11:24:16 | call to strcmp |
-| test.cpp:20:29:20:34 | call to getenv | test.cpp:24:11:24:35 | (bool)... |
 | test.cpp:20:29:20:34 | call to getenv | test.cpp:41:10:41:38 | ! ... |
 | test.cpp:20:29:20:34 | call to getenv | test.cpp:41:11:41:16 | call to strcmp |
-| test.cpp:20:29:20:34 | call to getenv | test.cpp:41:11:41:16 | call to strcmp |
-| test.cpp:20:29:20:34 | call to getenv | test.cpp:41:11:41:38 | (bool)... |
 | test.cpp:20:29:20:47 | (const char *)... | test.cpp:24:10:24:35 | ! ... |
 | test.cpp:20:29:20:47 | (const char *)... | test.cpp:24:11:24:16 | call to strcmp |
-| test.cpp:20:29:20:47 | (const char *)... | test.cpp:24:11:24:16 | call to strcmp |
-| test.cpp:20:29:20:47 | (const char *)... | test.cpp:24:11:24:35 | (bool)... |
 | test.cpp:20:29:20:47 | (const char *)... | test.cpp:41:10:41:38 | ! ... |
 | test.cpp:20:29:20:47 | (const char *)... | test.cpp:41:11:41:16 | call to strcmp |
-| test.cpp:20:29:20:47 | (const char *)... | test.cpp:41:11:41:16 | call to strcmp |
-| test.cpp:20:29:20:47 | (const char *)... | test.cpp:41:11:41:38 | (bool)... |
-| test.cpp:24:11:24:16 | call to strcmp | test.cpp:24:10:24:35 | ! ... |
-| test.cpp:24:11:24:16 | call to strcmp | test.cpp:24:11:24:35 | (bool)... |
-| test.cpp:41:11:41:16 | call to strcmp | test.cpp:41:10:41:38 | ! ... |
-| test.cpp:41:11:41:16 | call to strcmp | test.cpp:41:11:41:38 | (bool)... |
 nodes
 | test.cpp:20:29:20:34 | call to getenv | semmle.label | call to getenv |
 | test.cpp:20:29:20:47 | (const char *)... | semmle.label | (const char *)... |
 | test.cpp:24:10:24:35 | ! ... | semmle.label | ! ... |
 | test.cpp:24:11:24:16 | call to strcmp | semmle.label | call to strcmp |
 | test.cpp:24:11:24:16 | call to strcmp | semmle.label | call to strcmp |
-| test.cpp:24:11:24:35 | (bool)... | semmle.label | (bool)... |
-| test.cpp:24:11:24:35 | (bool)... | semmle.label | (bool)... |
 | test.cpp:41:10:41:38 | ! ... | semmle.label | ! ... |
 | test.cpp:41:11:41:16 | call to strcmp | semmle.label | call to strcmp |
 | test.cpp:41:11:41:16 | call to strcmp | semmle.label | call to strcmp |
-| test.cpp:41:11:41:38 | (bool)... | semmle.label | (bool)... |
-| test.cpp:41:11:41:38 | (bool)... | semmle.label | (bool)... |
 #select
 | test.cpp:24:10:24:35 | ! ... | test.cpp:20:29:20:34 | call to getenv | test.cpp:24:10:24:35 | ! ... | Reliance on untrusted input $@ to raise privilege at $@ | test.cpp:20:29:20:34 | call to getenv | call to getenv | test.cpp:25:9:25:27 | ... = ... | ... = ... |
 | test.cpp:41:10:41:38 | ! ... | test.cpp:20:29:20:34 | call to getenv | test.cpp:41:10:41:38 | ! ... | Reliance on untrusted input $@ to raise privilege at $@ | test.cpp:20:29:20:34 | call to getenv | call to getenv | test.cpp:42:8:42:26 | ... = ... | ... = ... |
diff --git a/cpp/ql/test/query-tests/Summary/LinesOfCode.expected b/cpp/ql/test/query-tests/Summary/LinesOfCode.expected
new file mode 100644
index 00000000000..a75c288c151
--- /dev/null
+++ b/cpp/ql/test/query-tests/Summary/LinesOfCode.expected
@@ -0,0 +1 @@
+| 93 |
diff --git a/cpp/ql/test/query-tests/Summary/LinesOfCode.qlref b/cpp/ql/test/query-tests/Summary/LinesOfCode.qlref
new file mode 100644
index 00000000000..b60eb791722
--- /dev/null
+++ b/cpp/ql/test/query-tests/Summary/LinesOfCode.qlref
@@ -0,0 +1 @@
+Summary/LinesOfCode.ql
diff --git a/cpp/ql/test/query-tests/Summary/empty-file.cpp b/cpp/ql/test/query-tests/Summary/empty-file.cpp
new file mode 100644
index 00000000000..8b137891791
--- /dev/null
+++ b/cpp/ql/test/query-tests/Summary/empty-file.cpp
@@ -0,0 +1 @@
+
diff --git a/cpp/ql/test/query-tests/Summary/large-file.cpp b/cpp/ql/test/query-tests/Summary/large-file.cpp
new file mode 100644
index 00000000000..b4af2da0cde
--- /dev/null
+++ b/cpp/ql/test/query-tests/Summary/large-file.cpp
@@ -0,0 +1,123 @@
+int a00(float x) {
+    return (int)x;
+}
+
+int a01(float x) {
+    return (int)x;
+}
+
+int a02(float x) {
+    return (int)x;
+}
+
+int a03(float x) {
+    return (int)x;
+}
+
+int a04(float x) {
+    return (int)x;
+}
+
+int a05(float x) {
+    return (int)x;
+}
+
+int a06(float x) {
+    return (int)x;
+}
+
+/**
+ * This is a multi-line comment
+ */
+int a07(float x) {
+    return (int)x;
+}
+
+// this is a single-line comment
+int a08(float x) {
+    return (int)x;
+}
+
+int a09(float x) {
+    return (int)x;
+}
+
+int a10(float x) {
+    return (int)x;
+}
+
+int a11(float x) {
+    return (int)x;
+}
+
+int a12(float x) {
+    return (int)x;
+}
+
+int a13(float x) {
+    return (int)x;
+}
+
+int a14(float x) {
+    return (int)x;
+}
+
+int a15(float x) {
+    return (int)x;
+}
+
+int a16(float x) {
+    return (int)x;
+}
+
+int a17(float x) {
+    return (int)x;
+}
+
+int a18(float x) {
+    return (int)x;
+}
+
+int a19(float x) {
+    return (int)x;
+}
+
+int a20(float x) {
+    return (int)x;
+}
+
+int a21(float x) {
+    return (int)x;
+}
+
+int a22(float x) {
+    return (int)x;
+}
+
+int a23(float x) {
+    return (int)x;
+}
+
+int a24(float x) {
+    return (int)x;
+}
+
+int a25(float x) {
+    return (int)x;
+}
+
+int a26(float x) {
+    return (int)x;
+}
+
+int a27(float x) {
+    return (int)x;
+}
+
+int a28(float x) {
+    return (int)x;
+}
+
+int a29(float x) {
+    return (int)x;
+}
diff --git a/cpp/ql/test/query-tests/Summary/short-file.cpp b/cpp/ql/test/query-tests/Summary/short-file.cpp
new file mode 100644
index 00000000000..e4055360d37
--- /dev/null
+++ b/cpp/ql/test/query-tests/Summary/short-file.cpp
@@ -0,0 +1,3 @@
+int g(float x) {
+    return (int)x;
+}
diff --git a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/AV Rule 79.expected b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/AV Rule 79.expected
index 1d0ef245f3b..70ee3fb4704 100644
--- a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/AV Rule 79.expected	
+++ b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/AV Rule 79.expected	
@@ -18,9 +18,10 @@
 | NoDestructor.cpp:23:3:23:20 | ... = ... | Resource n is acquired by class MyClass5 but not released anywhere in this class. |
 | PlacementNew.cpp:36:3:36:36 | ... = ... | Resource p1 is acquired by class MyTestForPlacementNew but not released anywhere in this class. |
 | SelfRegistering.cpp:25:3:25:24 | ... = ... | Resource side is acquired by class MyOwner but not released anywhere in this class. |
-| Variants.cpp:25:3:25:13 | ... = ... | Resource f is acquired by class MyClass4 but not released anywhere in this class. |
-| Variants.cpp:65:3:65:17 | ... = ... | Resource a is acquired by class MyClass6 but not released anywhere in this class. |
-| Variants.cpp:66:3:66:36 | ... = ... | Resource b is acquired by class MyClass6 but not released anywhere in this class. |
-| Variants.cpp:67:3:67:41 | ... = ... | Resource c is acquired by class MyClass6 but not released anywhere in this class. |
+| Variants.cpp:26:3:26:13 | ... = ... | Resource f is acquired by class MyClass4 but not released anywhere in this class. |
+| Variants.cpp:69:3:69:17 | ... = ... | Resource a is acquired by class MyClass6 but not released anywhere in this class. |
+| Variants.cpp:70:3:70:36 | ... = ... | Resource b is acquired by class MyClass6 but not released anywhere in this class. |
+| Variants.cpp:71:3:71:41 | ... = ... | Resource c is acquired by class MyClass6 but not released anywhere in this class. |
+| Variants.cpp:72:3:72:22 | ... = ... | Resource d is acquired by class MyClass6 but not released anywhere in this class. |
 | Wrapped.cpp:46:3:46:22 | ... = ... | Resource ptr2 is acquired by class Wrapped2 but not released anywhere in this class. |
 | Wrapped.cpp:59:3:59:22 | ... = ... | Resource ptr4 is acquired by class Wrapped2 but not released anywhere in this class. |
diff --git a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/Variants.cpp b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/Variants.cpp
index e96a5cd4f0d..7727a038248 100644
--- a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/Variants.cpp	
+++ b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/Variants.cpp	
@@ -5,6 +5,7 @@ void *malloc(size_t size);
 void *calloc(size_t nmemb, size_t size);
 void *realloc(void *ptr, size_t size);
 void free(void* ptr);
+char *strdup(const char *s1);
 
 int *ID(int *x) 
 {
@@ -45,6 +46,7 @@ public:
 		a = new int[10]; // GOOD
 		b = (int *)calloc(10, sizeof(int)); // GOOD
 		c = (int *)realloc(0, 10 * sizeof(int)); // GOOD
+		d = strdup("string");
 	}
 	
 	~MyClass5()
@@ -52,9 +54,11 @@ public:
 		delete [] a;
 		free(b);
 		free(c);
+		free(d);
 	}
 
 	int *a, *b, *c;
+	char *d;
 };
 
 class MyClass6
@@ -65,6 +69,7 @@ public:
 		a = new int[10]; // BAD
 		b = (int *)calloc(10, sizeof(int)); // BAD
 		c = (int *)realloc(0, 10 * sizeof(int)); // BAD
+		d = strdup("string"); // BAD
 	}
 	
 	~MyClass6()
@@ -72,6 +77,7 @@ public:
 	}
 
 	int *a, *b, *c;
+	char *d;
 };
 
 class MyClass7
diff --git a/csharp/autobuilder/Semmle.Autobuild.CSharp.Tests/BuildScripts.cs b/csharp/autobuilder/Semmle.Autobuild.CSharp.Tests/BuildScripts.cs
index 7b9f2e78881..99ad4c8f963 100644
--- a/csharp/autobuilder/Semmle.Autobuild.CSharp.Tests/BuildScripts.cs
+++ b/csharp/autobuilder/Semmle.Autobuild.CSharp.Tests/BuildScripts.cs
@@ -976,13 +976,11 @@ Microsoft.NETCore.App 2.1.4 [/usr/local/share/dotnet/shared/Microsoft.NETCore.Ap
             TestAutobuilderScript(autobuilder, 0, 9);
         }
 
-        [Fact]
-        public void TestDotnetVersionWindows()
+        private void TestDotnetVersionWindows(Action action, int commandsRun)
         {
             actions.RunProcess["cmd.exe /C dotnet --list-sdks"] = 0;
             actions.RunProcessOut["cmd.exe /C dotnet --list-sdks"] = "2.1.3 [C:\\Program Files\\dotnet\\sdks]\n2.1.4 [C:\\Program Files\\dotnet\\sdks]";
-            actions.RunProcess[@"cmd.exe /C powershell -NoProfile -ExecutionPolicy unrestricted -file C:\Project\install-dotnet.ps1 -Version 2.1.3 -InstallDir C:\Project\.dotnet"] = 0;
-            actions.RunProcess[@"cmd.exe /C del C:\Project\install-dotnet.ps1"] = 0;
+            action();
             actions.RunProcess[@"cmd.exe /C C:\Project\.dotnet\dotnet --info"] = 0;
             actions.RunProcess[@"cmd.exe /C C:\Project\.dotnet\dotnet clean C:\Project\test.csproj"] = 0;
             actions.RunProcess[@"cmd.exe /C C:\Project\.dotnet\dotnet restore C:\Project\test.csproj"] = 0;
@@ -1005,7 +1003,28 @@ Microsoft.NETCore.App 2.1.4 [/usr/local/share/dotnet/shared/Microsoft.NETCore.Ap
             actions.LoadXml[@"C:\Project\test.csproj"] = xml;
 
             var autobuilder = CreateAutoBuilder(true, dotnetVersion: "2.1.3");
-            TestAutobuilderScript(autobuilder, 0, 7);
+            TestAutobuilderScript(autobuilder, 0, commandsRun);
+        }
+
+        [Fact]
+        public void TestDotnetVersionWindowsWithPwsh()
+        {
+            TestDotnetVersionWindows(() =>
+            {
+                actions.RunProcess[@"cmd.exe /C pwsh -NoProfile -ExecutionPolicy unrestricted -Command ""[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; &([scriptblock]::Create((Invoke-WebRequest -UseBasicParsing 'https://dot.net/v1/dotnet-install.ps1'))) -Version 2.1.3 -InstallDir C:\Project\.dotnet"""] = 0;
+            },
+            6);
+        }
+
+        [Fact]
+        public void TestDotnetVersionWindowsWithoutPwsh()
+        {
+            TestDotnetVersionWindows(() =>
+            {
+                actions.RunProcess[@"cmd.exe /C pwsh -NoProfile -ExecutionPolicy unrestricted -Command ""[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; &([scriptblock]::Create((Invoke-WebRequest -UseBasicParsing 'https://dot.net/v1/dotnet-install.ps1'))) -Version 2.1.3 -InstallDir C:\Project\.dotnet"""] = 1;
+                actions.RunProcess[@"cmd.exe /C powershell -NoProfile -ExecutionPolicy unrestricted -Command ""[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; &([scriptblock]::Create((Invoke-WebRequest -UseBasicParsing 'https://dot.net/v1/dotnet-install.ps1'))) -Version 2.1.3 -InstallDir C:\Project\.dotnet"""] = 0;
+            },
+            7);
         }
 
         [Fact]
diff --git a/csharp/autobuilder/Semmle.Autobuild.CSharp.Tests/Semmle.Autobuild.CSharp.Tests.csproj b/csharp/autobuilder/Semmle.Autobuild.CSharp.Tests/Semmle.Autobuild.CSharp.Tests.csproj
index 64e25a8eb64..cc79699848a 100644
--- a/csharp/autobuilder/Semmle.Autobuild.CSharp.Tests/Semmle.Autobuild.CSharp.Tests.csproj
+++ b/csharp/autobuilder/Semmle.Autobuild.CSharp.Tests/Semmle.Autobuild.CSharp.Tests.csproj
@@ -1,7 +1,6 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
-    <OutputType>Exe</OutputType>
     <TargetFramework>net5.0</TargetFramework>
     <GenerateAssemblyInfo>false</GenerateAssemblyInfo>
     <RuntimeIdentifiers>win-x64;linux-x64;osx-x64</RuntimeIdentifiers>
@@ -12,10 +11,11 @@
     <PackageReference Include="System.IO.FileSystem" Version="4.3.0" />
     <PackageReference Include="System.IO.FileSystem.Primitives" Version="4.3.0" />
     <PackageReference Include="xunit" Version="2.4.1" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="2.4.1">
+    <PackageReference Include="xunit.runner.visualstudio" Version="2.4.3">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
     </PackageReference>
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="16.9.1" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/csharp/autobuilder/Semmle.Autobuild.CSharp/DotNetRule.cs b/csharp/autobuilder/Semmle.Autobuild.CSharp/DotNetRule.cs
index 93f0a630d1e..a456c9407db 100644
--- a/csharp/autobuilder/Semmle.Autobuild.CSharp/DotNetRule.cs
+++ b/csharp/autobuilder/Semmle.Autobuild.CSharp/DotNetRule.cs
@@ -145,7 +145,7 @@ namespace Semmle.Autobuild.CSharp
                 try
                 {
                     var o = JObject.Parse(File.ReadAllText(path));
-                    version = (string)o["sdk"]["version"];
+                    version = (string)(o?["sdk"]?["version"]!);
                 }
                 catch  // lgtm[cs/catch-of-all-exceptions]
                 {
@@ -179,53 +179,20 @@ namespace Semmle.Autobuild.CSharp
 
                     if (builder.Actions.IsWindows())
                     {
-                        var psScript = @"param([string]$Version, [string]$InstallDir)
 
-add-type @""
-using System.Net;
-using System.Security.Cryptography.X509Certificates;
-public class TrustAllCertsPolicy : ICertificatePolicy
-{
-    public bool CheckValidationResult(ServicePoint srvPoint, X509Certificate certificate, WebRequest request, int certificateProblem)
-    {
-        return true;
-    }
-}
-""@
-$AllProtocols = [System.Net.SecurityProtocolType]'Ssl3,Tls,Tls11,Tls12'
-[System.Net.ServicePointManager]::SecurityProtocol = $AllProtocols
-[System.Net.ServicePointManager]::CertificatePolicy = New-Object TrustAllCertsPolicy
-$Script = Invoke-WebRequest -useb 'https://dot.net/v1/dotnet-install.ps1'
+                        var psCommand = $"[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; &([scriptblock]::Create((Invoke-WebRequest -UseBasicParsing 'https://dot.net/v1/dotnet-install.ps1'))) -Version {version} -InstallDir {path}";
 
-$arguments = @{
-  Channel = 'release'
-  Version = $Version
-  InstallDir = $InstallDir
-}
-
-$ScriptBlock = [scriptblock]::create("".{$($Script)} $(&{$args} @arguments)"")
-
-Invoke-Command -ScriptBlock $ScriptBlock";
-                        var psScriptFile = builder.Actions.PathCombine(builder.Options.RootDirectory, "install-dotnet.ps1");
-                        builder.Actions.WriteAllText(psScriptFile, psScript);
-
-                        var install = new CommandBuilder(builder.Actions).
-                            RunCommand("powershell").
+                        BuildScript GetInstall(string pwsh) =>
+                            new CommandBuilder(builder.Actions).
+                            RunCommand(pwsh).
                             Argument("-NoProfile").
                             Argument("-ExecutionPolicy").
                             Argument("unrestricted").
-                            Argument("-file").
-                            Argument(psScriptFile).
-                            Argument("-Version").
-                            Argument(version).
-                            Argument("-InstallDir").
-                            Argument(path);
+                            Argument("-Command").
+                            Argument("\"" + psCommand + "\"").
+                            Script;
 
-                        var removeScript = new CommandBuilder(builder.Actions).
-                            RunCommand("del").
-                            Argument(psScriptFile);
-
-                        return install.Script & BuildScript.Try(removeScript.Script);
+                        return GetInstall("pwsh") | GetInstall("powershell");
                     }
                     else
                     {
diff --git a/csharp/autobuilder/Semmle.Autobuild.CSharp/Semmle.Autobuild.CSharp.csproj b/csharp/autobuilder/Semmle.Autobuild.CSharp/Semmle.Autobuild.CSharp.csproj
index b02b1a3fef1..b24f243de01 100644
--- a/csharp/autobuilder/Semmle.Autobuild.CSharp/Semmle.Autobuild.CSharp.csproj
+++ b/csharp/autobuilder/Semmle.Autobuild.CSharp/Semmle.Autobuild.CSharp.csproj
@@ -17,8 +17,8 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Build" Version="16.0.461" />
-    <PackageReference Include="Newtonsoft.Json" Version="12.0.2" />
+    <PackageReference Include="Microsoft.Build" Version="16.9.0" />
+    <PackageReference Include="Newtonsoft.Json" Version="13.0.1" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/csharp/autobuilder/Semmle.Autobuild.Shared/Semmle.Autobuild.Shared.csproj b/csharp/autobuilder/Semmle.Autobuild.Shared/Semmle.Autobuild.Shared.csproj
index 5f59b205527..ae1c61bc992 100644
--- a/csharp/autobuilder/Semmle.Autobuild.Shared/Semmle.Autobuild.Shared.csproj
+++ b/csharp/autobuilder/Semmle.Autobuild.Shared/Semmle.Autobuild.Shared.csproj
@@ -14,7 +14,7 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Build" Version="16.0.461" />
+    <PackageReference Include="Microsoft.Build" Version="16.9.0" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/csharp/change-notes/2021-03-24-cil-ssa.md b/csharp/change-notes/2021-03-24-cil-ssa.md
new file mode 100644
index 00000000000..2c971fe39f5
--- /dev/null
+++ b/csharp/change-notes/2021-03-24-cil-ssa.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* A static single assignment (SSA) library has been added to the CIL analysis library. The SSA library replaces the existing `DefUse` module, which has been deprecated.
diff --git a/csharp/change-notes/2021-03-24-remove-legacy-queries.md b/csharp/change-notes/2021-03-24-remove-legacy-queries.md
new file mode 100644
index 00000000000..1cbcbb6a1a0
--- /dev/null
+++ b/csharp/change-notes/2021-03-24-remove-legacy-queries.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* Legacy queries in the folders `external` and `filters` have all been removed.
\ No newline at end of file
diff --git a/csharp/change-notes/2021-03-24-remove-vuln-package-query.md b/csharp/change-notes/2021-03-24-remove-vuln-package-query.md
new file mode 100644
index 00000000000..2a211823b39
--- /dev/null
+++ b/csharp/change-notes/2021-03-24-remove-vuln-package-query.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* The query `VulnerablePackage.ql` has been removed.
\ No newline at end of file
diff --git a/csharp/change-notes/2021-04-09-dapper-support.md b/csharp/change-notes/2021-04-09-dapper-support.md
new file mode 100644
index 00000000000..a7db9d045d2
--- /dev/null
+++ b/csharp/change-notes/2021-04-09-dapper-support.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* Support for the Dapper ORM library has been added to the SQL injection checks.
\ No newline at end of file
diff --git a/csharp/change-notes/2021-04-09-default-argument-values.md b/csharp/change-notes/2021-04-09-default-argument-values.md
new file mode 100644
index 00000000000..ef34dca4f6a
--- /dev/null
+++ b/csharp/change-notes/2021-04-09-default-argument-values.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* The extractor has been improved to store default argument values for parameters that are extracted from referenced assemblies.
\ No newline at end of file
diff --git a/csharp/change-notes/2021-04-14-customizations.md b/csharp/change-notes/2021-04-14-customizations.md
new file mode 100644
index 00000000000..a2f957ca923
--- /dev/null
+++ b/csharp/change-notes/2021-04-14-customizations.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* A new library, `Customizations.qll`, has been added, which allows for global customizations that affect all queries.
\ No newline at end of file
diff --git a/csharp/config/suites/lgtm/csharp-metrics-lgtm b/csharp/config/suites/lgtm/csharp-metrics-lgtm
index 00c35820362..7a9cd6efb31 100644
--- a/csharp/config/suites/lgtm/csharp-metrics-lgtm
+++ b/csharp/config/suites/lgtm/csharp-metrics-lgtm
@@ -4,8 +4,6 @@
     @_namespace com.lgtm/csharp-queries
 + odasa-csharp-metrics/Files/FLinesOfCommentedCode.ql: /Metrics/Documentation
     @_namespace com.lgtm/csharp-queries
-+ odasa-csharp-metrics/Files/FLinesOfDuplicatedCode.ql: /Metrics/Coupling
-    @_namespace com.lgtm/csharp-queries
 + odasa-csharp-metrics/Files/FNumberOfTests.ql: /Metrics/Size
     @_namespace com.lgtm/csharp-queries
 
diff --git a/csharp/extractor/Semmle.Extraction.CSharp.Standalone/Semmle.Extraction.CSharp.Standalone.csproj b/csharp/extractor/Semmle.Extraction.CSharp.Standalone/Semmle.Extraction.CSharp.Standalone.csproj
index adf51941ad7..aed85473e7c 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp.Standalone/Semmle.Extraction.CSharp.Standalone.csproj
+++ b/csharp/extractor/Semmle.Extraction.CSharp.Standalone/Semmle.Extraction.CSharp.Standalone.csproj
@@ -23,7 +23,7 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Build" Version="16.0.461" />
+    <PackageReference Include="Microsoft.Build" Version="16.9.0" />
     <PackageReference Include="Microsoft.Win32.Primitives" Version="4.3.0" />
     <PackageReference Include="System.Net.Primitives" Version="4.3.1" />
     <PackageReference Include="System.Security.Principal" Version="4.3.0" />
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/CachedSymbol.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/CachedSymbol.cs
index f7f18ff4c25..d6fb0d65e5d 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/CachedSymbol.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/CachedSymbol.cs
@@ -151,13 +151,10 @@ namespace Semmle.Extraction.CSharp.Entities
                 if (handleProp is null)
                 {
                     var underlyingSymbolProp = GetPropertyInfo(Symbol, "UnderlyingSymbol");
-                    if (underlyingSymbolProp is not null)
+                    if (underlyingSymbolProp?.GetValue(Symbol) is object underlying)
                     {
-                        if (underlyingSymbolProp.GetValue(Symbol) is object underlying)
-                        {
-                            handleProp = GetPropertyInfo(underlying, "Handle");
-                            handleObj = underlying;
-                        }
+                        handleProp = GetPropertyInfo(underlying, "Handle");
+                        handleObj = underlying;
                     }
                 }
 
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expression.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expression.cs
index cdf17311440..6d36dded801 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expression.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expression.cs
@@ -164,6 +164,39 @@ namespace Semmle.Extraction.CSharp.Entities
             }
         }
 
+        /// <summary>
+        /// Creates a generated expression for a default argument value.
+        /// </summary>
+        public static Expression? CreateGenerated(Context cx, IParameterSymbol parameter, IExpressionParentEntity parent,
+            int childIndex, Extraction.Entities.Location location)
+        {
+            if (!parameter.HasExplicitDefaultValue)
+            {
+                return null;
+            }
+
+            var defaultValue = parameter.ExplicitDefaultValue;
+
+            if (parameter.Type is INamedTypeSymbol nt && nt.EnumUnderlyingType is not null)
+            {
+                // = (MyEnum)1, = MyEnum.Value1, = default(MyEnum), = new MyEnum()
+                // we're generating a (MyEnum)value cast expression:
+                defaultValue ??= 0;
+                Action<Expression, int> createChild = (parent, index) => Literal.CreateGenerated(cx, parent, index, nt.EnumUnderlyingType, defaultValue, location);
+                return Cast.CreateGenerated(cx, parent, childIndex, parameter.Type, defaultValue, createChild, location);
+            }
+
+            if (defaultValue is null)
+            {
+                // = null, = default, = default(T), = new MyStruct()
+                // we're generating a default expression:
+                return Default.CreateGenerated(cx, parent, childIndex, location, parameter.Type.IsReferenceType ? ValueAsString(null) : null);
+            }
+
+            // const literal:
+            return Literal.CreateGenerated(cx, parent, childIndex, parameter.Type, defaultValue, location);
+        }
+
         /// <summary>
         /// Adapt the operator kind depending on whether it's a dynamic call or a user-operator call.
         /// </summary>
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Default.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Default.cs
index 9e1b42834b1..9fdfd18d3bd 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Default.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Default.cs
@@ -14,5 +14,20 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
         {
             TypeAccess.Create(Context, Syntax.Type, this, 0);
         }
+
+        public static Expression CreateGenerated(Context cx, IExpressionParentEntity parent, int childIndex, Extraction.Entities.Location location, string? value)
+        {
+            var info = new ExpressionInfo(
+                cx,
+                null,
+                location,
+                ExprKind.DEFAULT,
+                parent,
+                childIndex,
+                true,
+                value);
+
+            return new Expression(info);
+        }
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/ImplicitCast.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/ImplicitCast.cs
index a6995adc30f..2d617cdb1b9 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/ImplicitCast.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/ImplicitCast.cs
@@ -3,7 +3,7 @@ using Semmle.Extraction.Kinds;
 
 namespace Semmle.Extraction.CSharp.Entities.Expressions
 {
-    internal class ImplicitCast : Expression
+    internal sealed class ImplicitCast : Expression
     {
         public Expression Expr
         {
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/MemberAccess.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/MemberAccess.cs
index 0de154509c8..426145e2d27 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/MemberAccess.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/MemberAccess.cs
@@ -4,7 +4,7 @@ using Semmle.Extraction.Kinds;
 
 namespace Semmle.Extraction.CSharp.Entities.Expressions
 {
-    internal class MemberAccess : Expression
+    internal sealed class MemberAccess : Expression
     {
         private MemberAccess(ExpressionNodeInfo info, ExpressionSyntax qualifier, ISymbol? target) : base(info)
         {
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Parameter.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Parameter.cs
index 3bbf38a71eb..462c8bbb297 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Parameter.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Parameter.cs
@@ -4,6 +4,7 @@ using System.Linq;
 using Microsoft.CodeAnalysis.CSharp.Syntax;
 using Semmle.Extraction.Entities;
 using System.IO;
+using System;
 
 namespace Semmle.Extraction.CSharp.Entities
 {
@@ -124,6 +125,17 @@ namespace Semmle.Extraction.CSharp.Entities
                 trapFile.param_location(this, Context.CreateLocation());
             }
 
+            if (Symbol.HasExplicitDefaultValue && Context.Defines(Symbol))
+            {
+                var defaultValueSyntax = GetDefaultValueFromSyntax(Symbol);
+
+                Action defaultValueExpressionCreation = defaultValueSyntax is not null
+                    ? () => Expression.Create(Context, defaultValueSyntax.Value, this, 0)
+                    : () => Expression.CreateGenerated(Context, Symbol, this, 0, Location);
+
+                Context.PopulateLater(defaultValueExpressionCreation);
+            }
+
             if (!IsSourceDeclaration || !Symbol.FromSource())
                 return;
 
@@ -139,36 +151,28 @@ namespace Semmle.Extraction.CSharp.Entities
                     TypeMention.Create(Context, syntax.Type!, this, type);
                 }
             }
+        }
 
-            if (Symbol.HasExplicitDefaultValue && Context.Defines(Symbol))
+        private static EqualsValueClauseSyntax? GetDefaultValueFromSyntax(IParameterSymbol symbol)
+        {
+            // This is a slight bug in the dbscheme
+            // We should really define param_default(param, string)
+            // And use parameter child #0 to encode the default expression.
+            var defaultValue = GetParameterDefaultValue(symbol);
+            if (defaultValue is null)
             {
-                // This is a slight bug in the dbscheme
-                // We should really define param_default(param, string)
-                // And use parameter child #0 to encode the default expression.
-                var defaultValue = GetParameterDefaultValue(Symbol);
-                if (defaultValue is null)
+                // In case this parameter belongs to an accessor of an indexer, we need
+                // to get the default value from the corresponding parameter belonging
+                // to the indexer itself
+                if (symbol.ContainingSymbol is IMethodSymbol method)
                 {
-                    // In case this parameter belongs to an accessor of an indexer, we need
-                    // to get the default value from the corresponding parameter belonging
-                    // to the indexer itself
-                    var method = (IMethodSymbol)Symbol.ContainingSymbol;
-                    if (method is not null)
-                    {
-                        var i = method.Parameters.IndexOf(Symbol);
-                        var indexer = (IPropertySymbol?)method.AssociatedSymbol;
-                        if (indexer is not null)
-                            defaultValue = GetParameterDefaultValue(indexer.Parameters[i]);
-                    }
-                }
-
-                if (defaultValue is not null)
-                {
-                    Context.PopulateLater(() =>
-                    {
-                        Expression.Create(Context, defaultValue.Value, this, 0);
-                    });
+                    var i = method.Parameters.IndexOf(symbol);
+                    if (method.AssociatedSymbol is IPropertySymbol indexer)
+                        defaultValue = GetParameterDefaultValue(indexer.Parameters[i]);
                 }
             }
+
+            return defaultValue;
         }
 
         public override bool IsSourceDeclaration => Symbol.IsSourceDeclaration();
diff --git a/csharp/extractor/Semmle.Extraction.Tests/Semmle.Extraction.Tests.csproj b/csharp/extractor/Semmle.Extraction.Tests/Semmle.Extraction.Tests.csproj
index 5b242d984ee..4a3e079e754 100644
--- a/csharp/extractor/Semmle.Extraction.Tests/Semmle.Extraction.Tests.csproj
+++ b/csharp/extractor/Semmle.Extraction.Tests/Semmle.Extraction.Tests.csproj
@@ -1,7 +1,6 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
-    <OutputType>Exe</OutputType>
     <TargetFramework>net5.0</TargetFramework>
     <GenerateAssemblyInfo>false</GenerateAssemblyInfo>
     <RuntimeIdentifiers>win-x64;linux-x64;osx-x64</RuntimeIdentifiers>
@@ -12,10 +11,11 @@
     <PackageReference Include="System.IO.FileSystem" Version="4.3.0" />
     <PackageReference Include="System.IO.FileSystem.Primitives" Version="4.3.0" />
     <PackageReference Include="xunit" Version="2.4.1" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="2.4.1">
+    <PackageReference Include="xunit.runner.visualstudio" Version="2.4.3">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
     </PackageReference>
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="16.9.1" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/csharp/extractor/Semmle.Extraction/Semmle.Extraction.csproj b/csharp/extractor/Semmle.Extraction/Semmle.Extraction.csproj
index 87259c99668..03189150a47 100644
--- a/csharp/extractor/Semmle.Extraction/Semmle.Extraction.csproj
+++ b/csharp/extractor/Semmle.Extraction/Semmle.Extraction.csproj
@@ -16,7 +16,7 @@
 
   <ItemGroup>
     <PackageReference Include="Microsoft.CodeAnalysis" Version="3.9.0" />
-    <PackageReference Include="GitInfo" Version="2.0.20">
+    <PackageReference Include="GitInfo" Version="2.1.2">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>
diff --git a/csharp/extractor/Semmle.Util.Tests/Semmle.Util.Tests.csproj b/csharp/extractor/Semmle.Util.Tests/Semmle.Util.Tests.csproj
index ca9599cf770..e5c2019bb42 100644
--- a/csharp/extractor/Semmle.Util.Tests/Semmle.Util.Tests.csproj
+++ b/csharp/extractor/Semmle.Util.Tests/Semmle.Util.Tests.csproj
@@ -1,7 +1,6 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
-    <OutputType>Exe</OutputType>
     <TargetFramework>net5.0</TargetFramework>
     <GenerateAssemblyInfo>false</GenerateAssemblyInfo>
     <RuntimeIdentifiers>win-x64;linux-x64;osx-x64</RuntimeIdentifiers>
@@ -10,10 +9,11 @@
 
   <ItemGroup>
     <PackageReference Include="xunit" Version="2.4.1" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="2.4.1">
+    <PackageReference Include="xunit.runner.visualstudio" Version="2.4.3">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
     </PackageReference>
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="16.9.1" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/csharp/ql/src/API Abuse/DisposeNotCalledOnException.ql b/csharp/ql/src/API Abuse/DisposeNotCalledOnException.ql
index 7469cbc59e7..abb962449b9 100644
--- a/csharp/ql/src/API Abuse/DisposeNotCalledOnException.ql	
+++ b/csharp/ql/src/API Abuse/DisposeNotCalledOnException.ql	
@@ -18,36 +18,6 @@ import csharp
 import Dispose
 import semmle.code.csharp.frameworks.System
 
-/**
- * Gets an exception type that may be thrown during the execution of method `m`.
- * Assumes any exception may be thrown by library types.
- */
-Class getAThrownException(Method m) {
-  m.fromLibrary() and
-  result = any(SystemExceptionClass sc)
-  or
-  exists(ControlFlowElement cfe |
-    cfe = any(ThrowElement te | result = te.getExpr().getType()) or
-    cfe = any(MethodCall mc | result = getAThrownException(mc.getARuntimeTarget()))
-  |
-    cfe.getEnclosingCallable() = m and
-    not isTriedAgainstException(cfe, result)
-  )
-}
-
-/**
- * Holds if control flow element is tried against throwing an exception of type
- * `ec`.
- */
-pragma[noinline]
-predicate isTriedAgainstException(ControlFlowElement cfe, ExceptionClass ec) {
-  (cfe instanceof ThrowElement or cfe instanceof MethodCall) and
-  exists(TryStmt ts |
-    ts.getATriedElement() = cfe and
-    exists(ts.getAnExceptionHandler(ec))
-  )
-}
-
 private class DisposeCall extends MethodCall {
   DisposeCall() { this.getTarget() instanceof DisposeMethod }
 }
@@ -78,8 +48,17 @@ predicate disposeReachableFromDisposableCreation(DisposeCall disposeCall, Expr d
   reachesDisposeCall(disposeCall, DataFlow::exprNode(disposableCreation))
 }
 
-class MethodCallThatMayThrow extends MethodCall {
-  MethodCallThatMayThrow() { exists(getAThrownException(this.getARuntimeTarget())) }
+/**
+ * Holds if control flow element is tried against throwing an exception of type
+ * `ec`.
+ */
+pragma[noinline]
+predicate isTriedAgainstException(ControlFlowElement cfe, ExceptionClass ec) {
+  (cfe instanceof ThrowElement or cfe instanceof MethodCall) and
+  exists(TryStmt ts |
+    ts.getATriedElement() = cfe and
+    exists(ts.getAnExceptionHandler(ec))
+  )
 }
 
 ControlFlowElement getACatchOrFinallyClauseChild() {
@@ -88,15 +67,71 @@ ControlFlowElement getACatchOrFinallyClauseChild() {
   result = getACatchOrFinallyClauseChild().getAChild()
 }
 
-from DisposeCall disposeCall, Expr disposableCreation, MethodCallThatMayThrow callThatThrows
-where
+private predicate candidate(DisposeCall disposeCall, Call call, Expr disposableCreation) {
   disposeReachableFromDisposableCreation(disposeCall, disposableCreation) and
   // The dispose call is not, itself, within a dispose method.
   not disposeCall.getEnclosingCallable() instanceof DisposeMethod and
   // Dispose call not within a finally or catch block
   not getACatchOrFinallyClauseChild() = disposeCall and
   // At least one method call exists between the allocation and disposal that could throw
-  disposableCreation.getAReachableElement() = callThatThrows and
-  callThatThrows.getAReachableElement() = disposeCall
+  disposableCreation.getAReachableElement() = call and
+  call.getAReachableElement() = disposeCall
+}
+
+private class RelevantMethod extends Method {
+  RelevantMethod() {
+    exists(Call call |
+      candidate(_, call, _) and
+      this = call.getARuntimeTarget()
+    )
+    or
+    exists(RelevantMethod other | other.calls(this))
+  }
+
+  pragma[noinline]
+  private RelevantMethod callsNoTry() {
+    exists(MethodCall mc |
+      result = mc.getARuntimeTarget() and
+      not isTriedAgainstException(mc, _) and
+      mc.getEnclosingCallable() = this
+    )
+  }
+
+  pragma[noinline]
+  private RelevantMethod callsInTry(MethodCall mc) {
+    result = mc.getARuntimeTarget() and
+    isTriedAgainstException(mc, _) and
+    mc.getEnclosingCallable() = this
+  }
+
+  /**
+   * Gets an exception type that may be thrown during the execution of this method.
+   * Assumes any exception may be thrown by library types.
+   */
+  Class getAThrownException() {
+    this.fromLibrary() and
+    result instanceof SystemExceptionClass
+    or
+    exists(ControlFlowElement cfe |
+      result = cfe.(ThrowElement).getExpr().getType() and
+      cfe.getEnclosingCallable() = this
+      or
+      result = this.callsInTry(cfe).getAThrownException()
+    |
+      not isTriedAgainstException(cfe, result)
+    )
+    or
+    result = this.callsNoTry().getAThrownException()
+  }
+}
+
+class MethodCallThatMayThrow extends MethodCall {
+  MethodCallThatMayThrow() {
+    exists(this.getARuntimeTarget().(RelevantMethod).getAThrownException())
+  }
+}
+
+from DisposeCall disposeCall, Expr disposableCreation, MethodCallThatMayThrow callThatThrows
+where candidate(disposeCall, callThatThrows, disposableCreation)
 select disposeCall, "Dispose missed if exception is thrown by $@.", callThatThrows,
   callThatThrows.toString()
diff --git a/csharp/ql/src/Customizations.qll b/csharp/ql/src/Customizations.qll
new file mode 100644
index 00000000000..d5378a44f0d
--- /dev/null
+++ b/csharp/ql/src/Customizations.qll
@@ -0,0 +1,12 @@
+/**
+ * Contains customizations to the standard library.
+ *
+ * This module is imported by `csharp.qll`, so any customizations defined here automatically
+ * apply to all queries.
+ *
+ * Typical examples of customizations include adding new subclasses of abstract classes such as
+ * the `RemoteFlowSource` and `SummarizedCallable` classes associated with the security queries
+ * to model frameworks that are not covered by the standard library.
+ */
+
+import csharp
diff --git a/csharp/ql/src/Metrics/Dependencies/ExternalDependencies.ql b/csharp/ql/src/Metrics/Dependencies/ExternalDependencies.ql
index 6139262afd3..87e7d3a5cf6 100644
--- a/csharp/ql/src/Metrics/Dependencies/ExternalDependencies.ql
+++ b/csharp/ql/src/Metrics/Dependencies/ExternalDependencies.ql
@@ -5,7 +5,6 @@
  * @kind treemap
  * @treemap.warnOn highValues
  * @metricType externalDependency
- * @precision medium
  * @id cs/external-dependencies
  */
 
diff --git a/csharp/ql/src/Metrics/Files/DuplicationProblems.inc.qhelp b/csharp/ql/src/Metrics/Files/DuplicationProblems.inc.qhelp
deleted file mode 100644
index 54397da6c99..00000000000
--- a/csharp/ql/src/Metrics/Files/DuplicationProblems.inc.qhelp
+++ /dev/null
@@ -1,16 +0,0 @@
-<!DOCTYPE qhelp PUBLIC
-  "-//Semmle//qhelp//EN"
-  "qhelp.dtd">
-<qhelp>
-<overview>
-<p>
-Duplicated code increases overall code size, making the code base
-harder to maintain and harder to understand. It also becomes harder to fix bugs,
-since a programmer applying a fix to one copy has to always remember to update
-other copies accordingly. Finally, code duplication is generally an indication of
-a poorly designed or hastily written code base, which typically suffers from other
-problems as well.
-</p>
-
-</overview>
-</qhelp>
diff --git a/csharp/ql/src/Metrics/Files/FLinesOfCode.ql b/csharp/ql/src/Metrics/Files/FLinesOfCode.ql
index 7aa709b2579..93f426d6329 100644
--- a/csharp/ql/src/Metrics/Files/FLinesOfCode.ql
+++ b/csharp/ql/src/Metrics/Files/FLinesOfCode.ql
@@ -5,7 +5,6 @@
  * @treemap.warnOn highValues
  * @metricType file
  * @metricAggregate avg sum max
- * @precision very-high
  * @id cs/lines-of-code-in-files
  * @tags maintainability
  *       complexity
diff --git a/csharp/ql/src/Metrics/Files/FLinesOfComment.ql b/csharp/ql/src/Metrics/Files/FLinesOfComment.ql
index 2071b86ad7a..0686268169f 100644
--- a/csharp/ql/src/Metrics/Files/FLinesOfComment.ql
+++ b/csharp/ql/src/Metrics/Files/FLinesOfComment.ql
@@ -5,7 +5,6 @@
  * @treemap.warnOn lowValues
  * @metricType file
  * @metricAggregate avg sum max
- * @precision very-high
  * @id cs/lines-of-comments-in-files
  * @tags maintainability
  *       documentation
diff --git a/csharp/ql/src/Metrics/Files/FLinesOfCommentedCode.ql b/csharp/ql/src/Metrics/Files/FLinesOfCommentedCode.ql
index 7e88ef5e91b..e84100b8928 100644
--- a/csharp/ql/src/Metrics/Files/FLinesOfCommentedCode.ql
+++ b/csharp/ql/src/Metrics/Files/FLinesOfCommentedCode.ql
@@ -5,7 +5,6 @@
  * @treemap.warnOn highValues
  * @metricType file
  * @metricAggregate avg sum max
- * @precision high
  * @id cs/lines-of-commented-out-code-in-files
  * @tags maintainability
  *       documentation
diff --git a/csharp/ql/src/Metrics/Files/FLinesOfDuplicatedCode.qhelp b/csharp/ql/src/Metrics/Files/FLinesOfDuplicatedCode.qhelp
deleted file mode 100644
index 3f7b574a4dc..00000000000
--- a/csharp/ql/src/Metrics/Files/FLinesOfDuplicatedCode.qhelp
+++ /dev/null
@@ -1,30 +0,0 @@
-<!DOCTYPE qhelp PUBLIC
-  "-//Semmle//qhelp//EN"
-  "qhelp.dtd">
-<qhelp>
-<overview>
-<p>
-A file that contains many lines that are duplicated within the code base is problematic
-for a number of reasons.
-</p>
-
-</overview>
-<include src="DuplicationProblems.inc.qhelp" />
-
-<recommendation>
-
-<p>
-Refactor files with lots of duplicated code to extract the common code into
-shared classes and assemblies.
-</p>
-
-</recommendation>
-<references> 
-
-
-<li>Wikipedia: <a href="http://en.wikipedia.org/wiki/Duplicate_code">Duplicate code</a>.</li>
-<li>M. Fowler, <em>Refactoring</em>. Addison-Wesley, 1999.</li>
-
-
-</references>
-</qhelp>
diff --git a/csharp/ql/src/Metrics/Files/FLinesOfDuplicatedCode.ql b/csharp/ql/src/Metrics/Files/FLinesOfDuplicatedCode.ql
deleted file mode 100644
index bf3da5e1f80..00000000000
--- a/csharp/ql/src/Metrics/Files/FLinesOfDuplicatedCode.ql
+++ /dev/null
@@ -1,27 +0,0 @@
-/**
- * @deprecated
- * @name Duplicated lines in files
- * @description The number of lines in a file, including code, comment and whitespace lines,
- *              which are duplicated in at least one other place.
- * @kind treemap
- * @treemap.warnOn highValues
- * @metricType file
- * @metricAggregate avg sum max
- * @precision high
- * @id cs/duplicated-lines-in-files
- * @tags testability
- *       modularity
- */
-
-import external.CodeDuplication
-
-from SourceFile f, int n
-where
-  n =
-    count(int line |
-      exists(DuplicateBlock d | d.sourceFile() = f |
-        line in [d.sourceStartLine() .. d.sourceEndLine()] and
-        not whitelistedLineForDuplication(f, line)
-      )
-    )
-select f, n order by n desc
diff --git a/csharp/ql/src/Metrics/Files/FNumberOfTests.ql b/csharp/ql/src/Metrics/Files/FNumberOfTests.ql
index 613c76c68af..f7abfc24a91 100644
--- a/csharp/ql/src/Metrics/Files/FNumberOfTests.ql
+++ b/csharp/ql/src/Metrics/Files/FNumberOfTests.ql
@@ -5,7 +5,6 @@
  * @treemap.warnOn highValues
  * @metricType file
  * @metricAggregate avg sum max
- * @precision medium
  * @id cs/tests-in-files
  * @tags maintainability
  */
diff --git a/csharp/ql/src/Security Features/CWE-937/Vulnerabilities.qll b/csharp/ql/src/Security Features/CWE-937/Vulnerabilities.qll
deleted file mode 100644
index 86f32443cdb..00000000000
--- a/csharp/ql/src/Security Features/CWE-937/Vulnerabilities.qll	
+++ /dev/null
@@ -1,335 +0,0 @@
-/**
- * Provides a list of NuGet packages with known vulnerabilities.
- *
- * To add a new vulnerability follow the existing pattern.
- * Create a new class that extends the abstract class `Vulnerability`,
- * supplying the name and the URL, and override one (or both) of
- * `matchesRange` and `matchesVersion`.
- */
-
-import csharp
-import Vulnerability
-
-class MicrosoftAdvisory4021279 extends Vulnerability {
-  MicrosoftAdvisory4021279() { this = "Microsoft Security Advisory 4021279" }
-
-  override string getUrl() { result = "https://github.com/dotnet/corefx/issues/19535" }
-
-  override predicate matchesRange(string name, Version affected, Version fixed) {
-    name = "System.Text.Encodings.Web" and
-    (
-      affected = "4.0.0" and fixed = "4.0.1"
-      or
-      affected = "4.3.0" and fixed = "4.3.1"
-    )
-    or
-    name = "System.Net.Http" and
-    (
-      affected = "4.1.1" and fixed = "4.1.2"
-      or
-      affected = "4.3.1" and fixed = "4.3.2"
-    )
-    or
-    name = "System.Net.Http.WinHttpHandler" and
-    (
-      affected = "4.0.1" and fixed = "4.0.2"
-      or
-      affected = "4.3.0" and fixed = "4.3.1"
-    )
-    or
-    name = "System.Net.Security" and
-    (
-      affected = "4.0.0" and fixed = "4.0.1"
-      or
-      affected = "4.3.0" and fixed = "4.3.1"
-    )
-    or
-    (
-      name = "Microsoft.AspNetCore.Mvc"
-      or
-      name = "Microsoft.AspNetCore.Mvc.Core"
-      or
-      name = "Microsoft.AspNetCore.Mvc.Abstractions"
-      or
-      name = "Microsoft.AspNetCore.Mvc.ApiExplorer"
-      or
-      name = "Microsoft.AspNetCore.Mvc.Cors"
-      or
-      name = "Microsoft.AspNetCore.Mvc.DataAnnotations"
-      or
-      name = "Microsoft.AspNetCore.Mvc.Formatters.Json"
-      or
-      name = "Microsoft.AspNetCore.Mvc.Formatters.Xml"
-      or
-      name = "Microsoft.AspNetCore.Mvc.Localization"
-      or
-      name = "Microsoft.AspNetCore.Mvc.Razor.Host"
-      or
-      name = "Microsoft.AspNetCore.Mvc.Razor"
-      or
-      name = "Microsoft.AspNetCore.Mvc.TagHelpers"
-      or
-      name = "Microsoft.AspNetCore.Mvc.ViewFeatures"
-      or
-      name = "Microsoft.AspNetCore.Mvc.WebApiCompatShim"
-    ) and
-    (
-      affected = "1.0.0" and fixed = "1.0.4"
-      or
-      affected = "1.1.0" and fixed = "1.1.3"
-    )
-  }
-}
-
-class CVE_2017_8700 extends Vulnerability {
-  CVE_2017_8700() { this = "CVE-2017-8700" }
-
-  override string getUrl() { result = "https://github.com/aspnet/Announcements/issues/279" }
-
-  override predicate matchesRange(string name, Version affected, Version fixed) {
-    (
-      name = "Microsoft.AspNetCore.Mvc.Core"
-      or
-      name = "Microsoft.AspNetCore.Mvc.Cors"
-    ) and
-    (
-      affected = "1.0.0" and fixed = "1.0.6"
-      or
-      affected = "1.1.0" and fixed = "1.1.6"
-    )
-  }
-}
-
-class CVE_2018_0765 extends Vulnerability {
-  CVE_2018_0765() { this = "CVE-2018-0765" }
-
-  override string getUrl() { result = "https://github.com/dotnet/announcements/issues/67" }
-
-  override predicate matchesRange(string name, Version affected, Version fixed) {
-    name = "System.Security.Cryptography.Xml" and
-    affected = "0.0.0" and
-    fixed = "4.4.2"
-  }
-}
-
-class AspNetCore_Mar18 extends Vulnerability {
-  AspNetCore_Mar18() { this = "ASPNETCore-Mar18" }
-
-  override string getUrl() { result = "https://github.com/aspnet/Announcements/issues/300" }
-
-  override predicate matchesRange(string name, Version affected, Version fixed) {
-    (
-      name = "Microsoft.AspNetCore.Server.Kestrel.Core"
-      or
-      name = "Microsoft.AspNetCore.Server.Kestrel.Transport.Abstractions"
-      or
-      name = "Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv"
-    ) and
-    affected = "2.0.0" and
-    fixed = "2.0.3"
-    or
-    name = "Microsoft.AspNetCore.All" and
-    affected = "2.0.0" and
-    fixed = "2.0.8"
-  }
-}
-
-class CVE_2018_8409 extends Vulnerability {
-  CVE_2018_8409() { this = "CVE-2018-8409" }
-
-  override string getUrl() { result = "https://github.com/aspnet/Announcements/issues/316" }
-
-  override predicate matchesRange(string name, Version affected, Version fixed) {
-    name = "System.IO.Pipelines" and affected = "4.5.0" and fixed = "4.5.1"
-    or
-    (name = "Microsoft.AspNetCore.All" or name = "Microsoft.AspNetCore.App") and
-    affected = "2.1.0" and
-    fixed = "2.1.4"
-  }
-}
-
-class CVE_2018_8171 extends Vulnerability {
-  CVE_2018_8171() { this = "CVE-2018-8171" }
-
-  override string getUrl() { result = "https://github.com/aspnet/Announcements/issues/310" }
-
-  override predicate matchesRange(string name, Version affected, Version fixed) {
-    name = "Microsoft.AspNetCore.Identity" and
-    (
-      affected = "1.0.0" and fixed = "1.0.6"
-      or
-      affected = "1.1.0" and fixed = "1.1.6"
-      or
-      affected = "2.0.0" and fixed = "2.0.4"
-      or
-      affected = "2.1.0" and fixed = "2.1.2"
-    )
-  }
-}
-
-class CVE_2018_8356 extends Vulnerability {
-  CVE_2018_8356() { this = "CVE-2018-8356" }
-
-  override string getUrl() { result = "https://github.com/dotnet/announcements/issues/73" }
-
-  override predicate matchesRange(string name, Version affected, Version fixed) {
-    (
-      name = "System.Private.ServiceModel"
-      or
-      name = "System.ServiceModel.Http"
-      or
-      name = "System.ServiceModel.NetTcp"
-    ) and
-    (
-      affected = "4.0.0" and fixed = "4.1.3"
-      or
-      affected = "4.3.0" and fixed = "4.3.3"
-      or
-      affected = "4.4.0" and fixed = "4.4.4"
-      or
-      affected = "4.5.0" and fixed = "4.5.3"
-    )
-    or
-    (
-      name = "System.ServiceModel.Duplex"
-      or
-      name = "System.ServiceModel.Security"
-    ) and
-    (
-      affected = "4.0.0" and fixed = "4.0.4"
-      or
-      affected = "4.3.0" and fixed = "4.3.3"
-      or
-      affected = "4.4.0" and fixed = "4.4.4"
-      or
-      affected = "4.5.0" and fixed = "4.5.3"
-    )
-    or
-    name = "System.ServiceModel.NetTcp" and
-    (
-      affected = "4.0.0" and fixed = "4.1.3"
-      or
-      affected = "4.3.0" and fixed = "4.3.3"
-      or
-      affected = "4.4.0" and fixed = "4.4.4"
-      or
-      affected = "4.5.0" and fixed = "4.5.1"
-    )
-  }
-}
-
-class ASPNETCore_Jul18 extends Vulnerability {
-  ASPNETCore_Jul18() { this = "ASPNETCore-July18" }
-
-  override string getUrl() { result = "https://github.com/aspnet/Announcements/issues/311" }
-
-  override predicate matchesRange(string name, Version affected, Version fixed) {
-    name = "Microsoft.AspNetCore.Server.Kestrel.Core" and
-    (
-      affected = "2.0.0" and fixed = "2.0.4"
-      or
-      affected = "2.1.0" and fixed = "2.1.2"
-    )
-    or
-    name = "Microsoft.AspNetCore.All" and
-    (
-      affected = "2.0.0" and fixed = "2.0.9"
-      or
-      affected = "2.1.0" and fixed = "2.1.2"
-    )
-    or
-    name = "Microsoft.AspNetCore.App" and
-    affected = "2.1.0" and
-    fixed = "2.1.2"
-  }
-}
-
-class CVE_2018_8292 extends Vulnerability {
-  CVE_2018_8292() { this = "CVE-2018-8292" }
-
-  override string getUrl() { result = "https://github.com/dotnet/announcements/issues/88" }
-
-  override predicate matchesVersion(string name, Version affected, Version fixed) {
-    name = "System.Net.Http" and
-    (
-      affected = "2.0" or
-      affected = "4.0.0" or
-      affected = "4.1.0" or
-      affected = "1.1.1" or
-      affected = "4.1.2" or
-      affected = "4.3.0" or
-      affected = "4.3.1" or
-      affected = "4.3.2" or
-      affected = "4.3.3"
-    ) and
-    fixed = "4.3.4"
-  }
-}
-
-class CVE_2018_0786 extends Vulnerability {
-  CVE_2018_0786() { this = "CVE-2018-0786" }
-
-  override string getUrl() { result = "https://github.com/dotnet/announcements/issues/51" }
-
-  override predicate matchesRange(string name, Version affected, Version fixed) {
-    (
-      name = "System.ServiceModel.Primitives"
-      or
-      name = "System.ServiceModel.Http"
-      or
-      name = "System.ServiceModel.NetTcp"
-      or
-      name = "System.ServiceModel.Duplex"
-      or
-      name = "System.ServiceModel.Security"
-      or
-      name = "System.Private.ServiceModel"
-    ) and
-    (
-      affected = "4.4.0" and fixed = "4.4.1"
-      or
-      affected = "4.3.0" and fixed = "4.3.1"
-    )
-    or
-    (
-      name = "System.ServiceModel.Primitives"
-      or
-      name = "System.ServiceModel.Http"
-      or
-      name = "System.ServiceModel.NetTcp"
-      or
-      name = "System.Private.ServiceModel"
-    ) and
-    affected = "4.1.0" and
-    fixed = "4.1.1"
-    or
-    (
-      name = "System.ServiceModel.Duplex"
-      or
-      name = "System.ServiceModel.Security"
-    ) and
-    affected = "4.0.1" and
-    fixed = "4.0.2"
-  }
-}
-
-class CVE_2019_0657 extends Vulnerability {
-  CVE_2019_0657() { this = "CVE-2019-0657" }
-
-  override predicate matchesRange(string name, Version affected, Version fixed) {
-    name = "Microsoft.NETCore.App" and
-    (
-      affected = "2.1.0" and fixed = "2.1.8"
-      or
-      affected = "2.2.0" and fixed = "2.2.2"
-    )
-  }
-
-  override predicate matchesVersion(string name, Version affected, Version fixed) {
-    name = "System.Private.Uri" and
-    affected = "4.3.0" and
-    fixed = "4.3.1"
-  }
-
-  override string getUrl() { result = "https://github.com/dotnet/announcements/issues/97" }
-}
diff --git a/csharp/ql/src/Security Features/CWE-937/Vulnerability.qll b/csharp/ql/src/Security Features/CWE-937/Vulnerability.qll
deleted file mode 100644
index a2c6d482c1c..00000000000
--- a/csharp/ql/src/Security Features/CWE-937/Vulnerability.qll	
+++ /dev/null
@@ -1,93 +0,0 @@
-import csharp
-
-/**
- * A package reference in an XML file, for example in a
- * `.csproj` file, a `.props` file, or a `packages.config` file.
- */
-class Package extends XMLElement {
-  string name;
-  Version version;
-
-  Package() {
-    (this.getName() = "PackageManagement" or this.getName() = "PackageReference") and
-    name = this.getAttributeValue("Include") and
-    version = this.getAttributeValue("Version")
-    or
-    this.getName() = "package" and
-    name = this.getAttributeValue("id") and
-    version = this.getAttributeValue("version")
-  }
-
-  /** Gets the name of the package, for example `System.IO.Pipelines`. */
-  string getPackageName() { result = name }
-
-  /** Gets the version of the package, for example `4.5.1`. */
-  Version getVersion() { result = version }
-
-  override string toString() { result = name + " " + version }
-}
-
-/**
- * A vulnerability, where the name of the vulnerability is this string.
- * One of `matchesRange` or `matchesVersion` must be overridden in order to
- * specify which packages are vulnerable.
- */
-abstract class Vulnerability extends string {
-  bindingset[this]
-  Vulnerability() { any() }
-
-  /**
-   * Holds if a package with name `name` is vulnerable from version `affected`
-   * until version `fixed`.
-   */
-  predicate matchesRange(string name, Version affected, Version fixed) { none() }
-
-  /**
-   * Holds if a package with name `name` is vulnerable in version `affected`, and
-   * is fixed by version `fixed`.
-   */
-  predicate matchesVersion(string name, Version affected, Version fixed) { none() }
-
-  /** Gets the URL describing the vulnerability. */
-  abstract string getUrl();
-
-  /**
-   * Holds if a package with name `name` and version `version`
-   * has this vulnerability. The fixed version is given by `fixed`.
-   */
-  bindingset[name, version]
-  predicate isVulnerable(string name, Version version, Version fixed) {
-    exists(Version affected, string n | name.toLowerCase() = n.toLowerCase() |
-      matchesRange(n, affected, fixed) and
-      version.compareTo(fixed) < 0 and
-      version.compareTo(affected) >= 0
-      or
-      matchesVersion(n, affected, fixed) and
-      version.compareTo(affected) = 0
-    )
-  }
-}
-
-bindingset[name, version]
-private Version getUltimateFix(string name, Version version) {
-  result = max(Version fix | any(Vulnerability v).isVulnerable(name, version, fix))
-}
-
-/**
- * A package with a vulnerability.
- */
-class VulnerablePackage extends Package {
-  Vulnerability vuln;
-
-  VulnerablePackage() { vuln.isVulnerable(this.getPackageName(), this.getVersion(), _) }
-
-  /** Gets the vulnerability of this package. */
-  Vulnerability getVulnerability() { result = vuln }
-
-  /** Gets the version of this package where the vulnerability is fixed. */
-  Version getFixedVersion() {
-    // This is needed because sometimes the "fixed" version of some
-    // vulnerabilities are themselves vulnerable to other vulnerabilities.
-    result = getUltimateFix(this.getPackageName(), this.getVersion())
-  }
-}
diff --git a/csharp/ql/src/Security Features/CWE-937/VulnerablePackage.qhelp b/csharp/ql/src/Security Features/CWE-937/VulnerablePackage.qhelp
deleted file mode 100644
index 112642c7958..00000000000
--- a/csharp/ql/src/Security Features/CWE-937/VulnerablePackage.qhelp	
+++ /dev/null
@@ -1,43 +0,0 @@
-<!DOCTYPE qhelp PUBLIC
-  "-//Semmle//qhelp//EN"
-  "qhelp.dtd">
-<qhelp>
-
-<overview>
-<p>
-Using a package with a known vulnerability is a security risk that could leave the
-software vulnerable to attack.
-</p>
-<p>
-This query reads the packages imported by the project build files and
-<code>.config</code> files, and checks them against a list of packages with known
-vulnerabilities.
-</p>
-</overview>
-
-<recommendation>
-<p>
-Upgrade the package to the recommended version using, for example, the NuGet package manager,
-or by editing the project files directly.
-</p>
-</recommendation>
-
-<example>
-<p>
-The following example shows a C# project file referencing package <code>System.Net.Http</code>
-version 4.3.1, which is vulnerable to <a href="https://github.com/dotnet/announcements/issues/88">CVE-2018-8292</a>.
-</p>
-<sample src="VulnerablePackageBAD.csproj" />
-<p>
-The project file can be fixed by changing the version of the package to 4.3.4.
-</p>
-<sample src="VulnerablePackageGOOD.csproj" />
-</example>
-
-<references>
-<li>
-OWASP: <a href="https://www.owasp.org/index.php/Top_10-2017_A9-Using_Components_with_Known_Vulnerabilities">A9-Using Components with Known Vulnerabilities</a>.
-</li>
-</references>
-
-</qhelp>
diff --git a/csharp/ql/src/Security Features/CWE-937/VulnerablePackage.ql b/csharp/ql/src/Security Features/CWE-937/VulnerablePackage.ql
deleted file mode 100644
index 4be7c76dd7b..00000000000
--- a/csharp/ql/src/Security Features/CWE-937/VulnerablePackage.ql	
+++ /dev/null
@@ -1,20 +0,0 @@
-/**
- * @name Using a package with a known vulnerability
- * @description Using a package with a known vulnerability is a security risk.
- *              Upgrade the package to a version that does not contain the vulnerability.
- * @kind problem
- * @problem.severity error
- * @precision high
- * @id cs/use-of-vulnerable-package
- * @tags security
- *       external/cwe/cwe-937
- */
-
-import csharp
-import Vulnerabilities
-
-from Vulnerability vuln, VulnerablePackage package
-where vuln = package.getVulnerability()
-select package,
-  "Package '" + package + "' has vulnerability $@, and should be upgraded to version " +
-    package.getFixedVersion() + ".", vuln.getUrl(), vuln.toString()
diff --git a/csharp/ql/src/Security Features/CWE-937/VulnerablePackageBAD.csproj b/csharp/ql/src/Security Features/CWE-937/VulnerablePackageBAD.csproj
deleted file mode 100644
index b13494984ec..00000000000
--- a/csharp/ql/src/Security Features/CWE-937/VulnerablePackageBAD.csproj	
+++ /dev/null
@@ -1,15 +0,0 @@
-<Project Sdk="Microsoft.NET.Sdk">
-
-  <PropertyGroup>
-    <TargetFramework>netcoreapp2.0</TargetFramework>
-    <AssemblyName>Semmle.Autobuild</AssemblyName>
-    <RootNamespace>Semmle.Autobuild</RootNamespace>
-    <OutputType>Exe</OutputType>
-  </PropertyGroup>
-
-  <ItemGroup>
-    <PackageReference Include="Microsoft.Build" Version="15.8.166" />
-    <PackageReference Include="System.Net.Http" Version="4.3.1" />
-  </ItemGroup>
-
-</Project>
diff --git a/csharp/ql/src/Security Features/CWE-937/VulnerablePackageGOOD.csproj b/csharp/ql/src/Security Features/CWE-937/VulnerablePackageGOOD.csproj
deleted file mode 100644
index 98275b86a6f..00000000000
--- a/csharp/ql/src/Security Features/CWE-937/VulnerablePackageGOOD.csproj	
+++ /dev/null
@@ -1,15 +0,0 @@
-<Project Sdk="Microsoft.NET.Sdk">
-
-  <PropertyGroup>
-    <TargetFramework>netcoreapp2.0</TargetFramework>
-    <AssemblyName>Semmle.Autobuild</AssemblyName>
-    <RootNamespace>Semmle.Autobuild</RootNamespace>
-    <OutputType>Exe</OutputType>
-  </PropertyGroup>
-
-  <ItemGroup>
-    <PackageReference Include="Microsoft.Build" Version="15.8.166" />
-    <PackageReference Include="System.Net.Http" Version="4.3.4" />
-  </ItemGroup>
-
-</Project>
diff --git a/csharp/ql/src/Stubs/make_stubs.py b/csharp/ql/src/Stubs/make_stubs.py
index e94cf0c7261..7d2ce9f7ed7 100644
--- a/csharp/ql/src/Stubs/make_stubs.py
+++ b/csharp/ql/src/Stubs/make_stubs.py
@@ -43,12 +43,6 @@ if not foundCS:
     print("Test directory does not contain .cs files. Please specify a working qltest directory.")
     exit(1)
 
-cmd = ['odasa', 'selfTest']
-print('Running ' + ' '.join(cmd))
-if subprocess.check_call(cmd):
-    print("odasa selfTest failed. Ensure odasa is on your current path.")
-    exit(1)
-
 csharpQueries = os.path.abspath(os.path.dirname(sys.argv[0]))
 outputFile = os.path.join(testDir, 'stubs.cs')
 
@@ -58,56 +52,75 @@ if os.path.isfile(outputFile):
     os.remove(outputFile)  # It would interfere with the test.
     print("Removed previous", outputFile)
 
-cmd = ['odasa', 'qltest', '--optimize', '--leave-temp-files', testDir]
+cmd = ['codeql', 'test', 'run', '--keep-databases', testDir]
 print('Running ' + ' '.join(cmd))
 if subprocess.check_call(cmd):
-    print("qltest failed. Please fix up the test before proceeding.")
+    print("codeql test failed. Please fix up the test before proceeding.")
     exit(1)
 
-dbDir = os.path.join(testDir, os.path.basename(testDir) + ".testproj", "db-csharp")
+dbDir = os.path.join(testDir, os.path.basename(testDir) + ".testproj")
 
 if not os.path.isdir(dbDir):
-    print("Expected database directory " + dbDir + " not found. Please contact Semmle.")
+    print("Expected database directory " + dbDir + " not found.")
     exit(1)
 
-cmd = ['odasa', 'runQuery', '--query', os.path.join(csharpQueries, 'MinimalStubsFromSource.ql'), '--db', dbDir, '--output-file', outputFile]
+cmd = ['codeql', 'query', 'run', os.path.join(
+    csharpQueries, 'MinimalStubsFromSource.ql'), '--database', dbDir, '--output', outputFile]
 print('Running ' + ' '.join(cmd))
 if subprocess.check_call(cmd):
-    print('Failed to run the query to generate output file. Please contact Semmle.')
+    print('Failed to run the query to generate output file.')
     exit(1)
 
-# Remove the leading " and trailing " bytes from the file
-len = os.stat(outputFile).st_size
-f = open(outputFile, "rb")
-try:
-    quote = f.read(1)
-    if quote != b'"':
-        print("Unexpected character in file. Please contact Semmle.")
-    contents = f.read(len-3)
-    quote = f.read(1)
-    if quote != b'"':
-        print("Unexpected end character. Please contact Semmle.", quote)
-finally:
-    f.close()
+# Remove the leading and trailing bytes from the file
+length = os.stat(outputFile).st_size
+if length < 20:
+    contents = b''
+else:
+    f = open(outputFile, "rb")
+    try:
+        countTillSlash = 0
+        foundSlash = False
+        slash = f.read(1)
+        while slash != b'':
+            if slash == b'/':
+                foundSlash = True
+                break
+            countTillSlash += 1
+            slash = f.read(1)
+
+        if not foundSlash:
+            countTillSlash = 0
+
+        f.seek(0)
+        quote = f.read(countTillSlash)
+        print("Start characters in file skipped.", quote)
+        post = b'\x0e\x01\x08#select\x01\x01\x00s\x00'
+        contents = f.read(length - len(post) - countTillSlash)
+        quote = f.read(len(post))
+        if quote != post:
+            print("Unexpected end character in file.", quote)
+    finally:
+        f.close()
 
 f = open(outputFile, "wb")
 f.write(contents)
 f.close()
 
-cmd = ['odasa', 'qltest', '--optimize', testDir]
+cmd = ['codeql', 'test', 'run', testDir]
 print('Running ' + ' '.join(cmd))
 if subprocess.check_call(cmd):
-  print('\nTest failed. You may need to fix up', outputFile)
-  print('It may help to view', outputFile, ' in Visual Studio')
-  print("Next steps:")
-  print('1. Look at the compilation errors, and fix up', outputFile, 'so that the test compiles')
-  print('2. Re-run odasa qltest --optimize "' + testDir + '"')
-  print('3. git add "' + outputFile + '"')
-  exit(1)
+    print('\nTest failed. You may need to fix up', outputFile)
+    print('It may help to view', outputFile, ' in Visual Studio')
+    print("Next steps:")
+    print('1. Look at the compilation errors, and fix up',
+          outputFile, 'so that the test compiles')
+    print('2. Re-run codeql test run "' + testDir + '"')
+    print('3. git add "' + outputFile + '"')
+    exit(1)
 
 print("\nStub generation successful! Next steps:")
 print('1. Edit "semmle-extractor-options" in the .cs files to remove unused references')
-print('2. Re-run odasa qltest --optimize "' + testDir + '"')
+print('2. Re-run codeql test run "' + testDir + '"')
 print('3. git add "' + outputFile + '"')
 print('4. Commit your changes.')
 
diff --git a/csharp/ql/src/codeql-suites/csharp-code-scanning.qls b/csharp/ql/src/codeql-suites/csharp-code-scanning.qls
index 44fe11937e4..3646204da7d 100644
--- a/csharp/ql/src/codeql-suites/csharp-code-scanning.qls
+++ b/csharp/ql/src/codeql-suites/csharp-code-scanning.qls
@@ -2,5 +2,3 @@
 - qlpack: codeql-csharp
 - apply: code-scanning-selectors.yml
   from: codeql-suite-helpers
-- apply: codeql-suites/exclude-dependency-queries.yml
-  from: codeql-csharp
diff --git a/csharp/ql/src/codeql-suites/csharp-security-and-quality.qls b/csharp/ql/src/codeql-suites/csharp-security-and-quality.qls
index f5df6527965..20ead656db0 100644
--- a/csharp/ql/src/codeql-suites/csharp-security-and-quality.qls
+++ b/csharp/ql/src/codeql-suites/csharp-security-and-quality.qls
@@ -2,5 +2,3 @@
 - qlpack: codeql-csharp
 - apply: security-and-quality-selectors.yml
   from: codeql-suite-helpers
-- apply: codeql-suites/exclude-dependency-queries.yml
-  from: codeql-csharp
diff --git a/csharp/ql/src/codeql-suites/csharp-security-extended.qls b/csharp/ql/src/codeql-suites/csharp-security-extended.qls
index f4efe70892c..b74ffa9c2e0 100644
--- a/csharp/ql/src/codeql-suites/csharp-security-extended.qls
+++ b/csharp/ql/src/codeql-suites/csharp-security-extended.qls
@@ -2,5 +2,3 @@
 - qlpack: codeql-csharp
 - apply: security-extended-selectors.yml
   from: codeql-suite-helpers
-- apply: codeql-suites/exclude-dependency-queries.yml
-  from: codeql-csharp
diff --git a/csharp/ql/src/codeql-suites/exclude-dependency-queries.yml b/csharp/ql/src/codeql-suites/exclude-dependency-queries.yml
deleted file mode 100644
index 53ad48be212..00000000000
--- a/csharp/ql/src/codeql-suites/exclude-dependency-queries.yml
+++ /dev/null
@@ -1,4 +0,0 @@
-- description: C# queries which overlap with dependency analysis
-- exclude:
-    query path:
-      - Security Features/CWE-937/VulnerablePackage.ql
diff --git a/csharp/ql/src/csharp.qll b/csharp/ql/src/csharp.qll
index 3c821c9a443..dc187fc8d92 100644
--- a/csharp/ql/src/csharp.qll
+++ b/csharp/ql/src/csharp.qll
@@ -2,6 +2,7 @@
  * The default C# QL library.
  */
 
+import Customizations
 import semmle.code.csharp.Attribute
 import semmle.code.csharp.Callable
 import semmle.code.csharp.Comments
diff --git a/csharp/ql/src/definitions.qll b/csharp/ql/src/definitions.qll
index 2004ad0d218..c1b456f4dbf 100644
--- a/csharp/ql/src/definitions.qll
+++ b/csharp/ql/src/definitions.qll
@@ -187,5 +187,11 @@ cached
 Declaration definitionOf(Use use, string kind) {
   result = use.getDefinition() and
   result.fromSource() and
-  kind = use.getUseType()
+  kind = use.getUseType() and
+  // Some entities have many locations. This can arise for files that
+  // are duplicated multiple times in the database at different
+  // locations. Rather than letting the result set explode, we just
+  // exclude results that are "too ambiguous" -- we could also arbitrarily
+  // pick one location later on.
+  strictcount(result.getLocation()) < 10
 }
diff --git a/csharp/ql/src/external/CodeDuplication.qll b/csharp/ql/src/external/CodeDuplication.qll
deleted file mode 100644
index f4165e599e8..00000000000
--- a/csharp/ql/src/external/CodeDuplication.qll
+++ /dev/null
@@ -1,305 +0,0 @@
-import csharp
-
-private string relativePath(File file) { result = file.getRelativePath().replaceAll("\\", "/") }
-
-/**
- * Holds if the `index`-th token of block `copy` is in file `file`, spanning
- * column `sc` of line `sl` to column `ec` of line `el`.
- *
- * For more information, see [Locations](https://help.semmle.com/QL/learn-ql/ql/locations.html).
- */
-pragma[nomagic]
-predicate tokenLocation(File file, int sl, int sc, int ec, int el, Copy copy, int index) {
-  file = copy.sourceFile() and
-  tokens(copy, index, sl, sc, ec, el)
-}
-
-class Copy extends @duplication_or_similarity {
-  private int lastToken() { result = max(int i | tokens(this, i, _, _, _, _) | i) }
-
-  int tokenStartingAt(Location loc) {
-    tokenLocation(loc.getFile(), loc.getStartLine(), loc.getStartColumn(), _, _, this, result)
-  }
-
-  int tokenEndingAt(Location loc) {
-    tokenLocation(loc.getFile(), _, _, loc.getEndLine(), loc.getEndColumn(), this, result)
-  }
-
-  int sourceStartLine() { tokens(this, 0, result, _, _, _) }
-
-  int sourceStartColumn() { tokens(this, 0, _, result, _, _) }
-
-  int sourceEndLine() { tokens(this, lastToken(), _, _, result, _) }
-
-  int sourceEndColumn() { tokens(this, lastToken(), _, _, _, result) }
-
-  int sourceLines() { result = this.sourceEndLine() + 1 - this.sourceStartLine() }
-
-  int getEquivalenceClass() { duplicateCode(this, _, result) or similarCode(this, _, result) }
-
-  File sourceFile() {
-    exists(string name | duplicateCode(this, name, _) or similarCode(this, name, _) |
-      name.replaceAll("\\", "/") = relativePath(result)
-    )
-  }
-
-  predicate hasLocationInfo(
-    string filepath, int startline, int startcolumn, int endline, int endcolumn
-  ) {
-    sourceFile().getAbsolutePath() = filepath and
-    startline = sourceStartLine() and
-    startcolumn = sourceStartColumn() and
-    endline = sourceEndLine() and
-    endcolumn = sourceEndColumn()
-  }
-
-  string toString() { none() }
-}
-
-class DuplicateBlock extends Copy, @duplication {
-  override string toString() { result = "Duplicate code: " + sourceLines() + " duplicated lines." }
-}
-
-class SimilarBlock extends Copy, @similarity {
-  override string toString() {
-    result = "Similar code: " + sourceLines() + " almost duplicated lines."
-  }
-}
-
-private Method sourceMethod() { method_location(result, _) and numlines(result, _, _, _) }
-
-private int numberOfSourceMethods(Class c) {
-  result = count(Method m | m = sourceMethod() and m.getDeclaringType() = c)
-}
-
-private predicate blockCoversStatement(int equivClass, int first, int last, Stmt stmt) {
-  exists(DuplicateBlock b, Location loc |
-    stmt.getLocation() = loc and
-    first = b.tokenStartingAt(loc) and
-    last = b.tokenEndingAt(loc) and
-    b.getEquivalenceClass() = equivClass
-  )
-}
-
-private Stmt statementInMethod(Method m) {
-  result.getEnclosingCallable() = m and
-  not result instanceof BlockStmt
-}
-
-private predicate duplicateStatement(Method m1, Method m2, Stmt s1, Stmt s2) {
-  exists(int equivClass, int first, int last |
-    s1 = statementInMethod(m1) and
-    s2 = statementInMethod(m2) and
-    blockCoversStatement(equivClass, first, last, s1) and
-    blockCoversStatement(equivClass, first, last, s2) and
-    s1 != s2 and
-    m1 != m2
-  )
-}
-
-/** Holds if `duplicate` number of statements are duplicated in the methods. */
-predicate duplicateStatements(Method m1, Method m2, int duplicate, int total) {
-  duplicate = strictcount(Stmt s | duplicateStatement(m1, m2, s, _)) and
-  total = strictcount(statementInMethod(m1))
-}
-
-/**
- * Find pairs of methods are identical
- */
-predicate duplicateMethod(Method m, Method other) {
-  exists(int total | duplicateStatements(m, other, total, total))
-}
-
-private predicate similarLines(File f, int line) {
-  exists(SimilarBlock b | b.sourceFile() = f and line in [b.sourceStartLine() .. b.sourceEndLine()])
-}
-
-private predicate similarLinesPerEquivalenceClass(int equivClass, int lines, File f) {
-  lines =
-    strictsum(SimilarBlock b, int toSum |
-      (b.sourceFile() = f and b.getEquivalenceClass() = equivClass) and
-      toSum = b.sourceLines()
-    |
-      toSum
-    )
-}
-
-pragma[noopt]
-private predicate similarLinesCovered(File f, int coveredLines, File otherFile) {
-  exists(int numLines | numLines = f.getNumberOfLines() |
-    exists(int coveredApprox |
-      coveredApprox =
-        strictsum(int num |
-          exists(int equivClass |
-            similarLinesPerEquivalenceClass(equivClass, num, f) and
-            similarLinesPerEquivalenceClass(equivClass, num, otherFile) and
-            f != otherFile
-          )
-        ) and
-      exists(int n, int product | product = coveredApprox * 100 and n = product / numLines | n > 75)
-    ) and
-    exists(int notCovered |
-      notCovered =
-        count(int j |
-          j in [1 .. numLines] and
-          not similarLines(f, j)
-        ) and
-      coveredLines = numLines - notCovered
-    )
-  )
-}
-
-private predicate duplicateLines(File f, int line) {
-  exists(DuplicateBlock b |
-    b.sourceFile() = f and line in [b.sourceStartLine() .. b.sourceEndLine()]
-  )
-}
-
-private predicate duplicateLinesPerEquivalenceClass(int equivClass, int lines, File f) {
-  lines =
-    strictsum(DuplicateBlock b, int toSum |
-      (b.sourceFile() = f and b.getEquivalenceClass() = equivClass) and
-      toSum = b.sourceLines()
-    |
-      toSum
-    )
-}
-
-pragma[noopt]
-private predicate duplicateLinesCovered(File f, int coveredLines, File otherFile) {
-  exists(int numLines | numLines = f.getNumberOfLines() |
-    exists(int coveredApprox |
-      coveredApprox =
-        strictsum(int num |
-          exists(int equivClass |
-            duplicateLinesPerEquivalenceClass(equivClass, num, f) and
-            duplicateLinesPerEquivalenceClass(equivClass, num, otherFile) and
-            f != otherFile
-          )
-        ) and
-      exists(int n, int product | product = coveredApprox * 100 and n = product / numLines | n > 75)
-    ) and
-    exists(int notCovered |
-      notCovered =
-        count(int j |
-          j in [1 .. numLines] and
-          not duplicateLines(f, j)
-        ) and
-      coveredLines = numLines - notCovered
-    )
-  )
-}
-
-/** Holds if the two files are not duplicated but have more than 80% similar lines. */
-predicate similarFiles(File f, File other, int percent) {
-  exists(int covered, int total |
-    similarLinesCovered(f, covered, other) and
-    total = f.getNumberOfLines() and
-    covered * 100 / total = percent and
-    percent > 80
-  ) and
-  not duplicateFiles(f, other, _)
-}
-
-/** Holds if the two files have more than 70% duplicated lines. */
-predicate duplicateFiles(File f, File other, int percent) {
-  exists(int covered, int total |
-    duplicateLinesCovered(f, covered, other) and
-    total = f.getNumberOfLines() and
-    covered * 100 / total = percent and
-    percent > 70
-  )
-}
-
-pragma[noopt]
-private predicate duplicateAnonymousClass(AnonymousClass c, AnonymousClass other) {
-  exists(int numDup |
-    numDup =
-      strictcount(Method m1 |
-        exists(Method m2 |
-          duplicateMethod(m1, m2) and
-          m1 = sourceMethod() and
-          m1.getDeclaringType() = c and
-          c instanceof AnonymousClass and
-          m2.getDeclaringType() = other and
-          other instanceof AnonymousClass and
-          c != other
-        )
-      ) and
-    numDup = numberOfSourceMethods(c) and
-    numDup = numberOfSourceMethods(other) and
-    forall(Type t | c.getABaseType() = t | t = other.getABaseType())
-  )
-}
-
-pragma[noopt]
-private predicate mostlyDuplicateClassBase(Class c, Class other, int numDup, int total) {
-  numDup =
-    strictcount(Method m1 |
-      exists(Method m2 |
-        duplicateMethod(m1, m2) and
-        m1 = sourceMethod() and
-        m1.getDeclaringType() = c and
-        m2.getDeclaringType() = other and
-        other instanceof Class and
-        c != other
-      )
-    ) and
-  total = numberOfSourceMethods(c) and
-  exists(int n, int product | product = 100 * numDup and n = product / total | n > 80) and
-  not c instanceof AnonymousClass and
-  not other instanceof AnonymousClass
-}
-
-/** Holds if the methods in the two classes are more than 80% duplicated. */
-predicate mostlyDuplicateClass(Class c, Class other, string message) {
-  exists(int numDup, int total |
-    mostlyDuplicateClassBase(c, other, numDup, total) and
-    (
-      total != numDup and
-      exists(string s1, string s2, string s3, string name |
-        s1 = " out of " and
-        s2 = " methods in " and
-        s3 = " are duplicated in $@." and
-        name = c.getName()
-      |
-        message = numDup + s1 + total + s2 + name + s3
-      )
-      or
-      total = numDup and
-      exists(string s1, string s2, string name |
-        s1 = "All methods in " and s2 = " are identical in $@." and name = c.getName()
-      |
-        message = s1 + name + s2
-      )
-    )
-  )
-}
-
-/** Holds if the two files are similar or duplicated. */
-predicate fileLevelDuplication(File f, File other) {
-  similarFiles(f, other, _) or duplicateFiles(f, other, _)
-}
-
-/**
- * Holds if the two classes are duplicated anonymous classes or more than 80% of
- * their methods are duplicated.
- */
-predicate classLevelDuplication(Class c, Class other) {
-  duplicateAnonymousClass(c, other) or mostlyDuplicateClass(c, other, _)
-}
-
-private Element whitelistedDuplicateElement() {
-  result instanceof UsingNamespaceDirective or
-  result instanceof UsingStaticDirective
-}
-
-/**
- * Holds if the `line` in the `file` contains an element, such as a `using`
- * directive, that is not considered for code duplication.
- */
-predicate whitelistedLineForDuplication(File file, int line) {
-  exists(Location loc | loc = whitelistedDuplicateElement().getLocation() |
-    line = loc.getStartLine() and file = loc.getFile()
-  )
-}
diff --git a/csharp/ql/src/external/DefectFilter.qll b/csharp/ql/src/external/DefectFilter.qll
deleted file mode 100644
index 4f4f60b66c1..00000000000
--- a/csharp/ql/src/external/DefectFilter.qll
+++ /dev/null
@@ -1,34 +0,0 @@
-import csharp
-
-external predicate defectResults(
-  int id, string queryPath, string file, int startline, int startcol, int endline, int endcol,
-  string message
-);
-
-class DefectResult extends int {
-  DefectResult() { defectResults(this, _, _, _, _, _, _, _) }
-
-  string getQueryPath() { defectResults(this, result, _, _, _, _, _, _) }
-
-  File getFile() {
-    exists(string path |
-      defectResults(this, _, path, _, _, _, _, _) and result.getAbsolutePath() = path
-    )
-  }
-
-  int getStartLine() { defectResults(this, _, _, result, _, _, _, _) }
-
-  int getStartColumn() { defectResults(this, _, _, _, result, _, _, _) }
-
-  int getEndLine() { defectResults(this, _, _, _, _, result, _, _) }
-
-  int getEndColumn() { defectResults(this, _, _, _, _, _, result, _) }
-
-  string getMessage() { defectResults(this, _, _, _, _, _, _, result) }
-
-  string getURL() {
-    result =
-      "file://" + getFile().getAbsolutePath() + ":" + getStartLine() + ":" + getStartColumn() + ":" +
-        getEndLine() + ":" + getEndColumn()
-  }
-}
diff --git a/csharp/ql/src/external/DuplicateMethod.cs b/csharp/ql/src/external/DuplicateMethod.cs
deleted file mode 100644
index 8a963528267..00000000000
--- a/csharp/ql/src/external/DuplicateMethod.cs
+++ /dev/null
@@ -1,22 +0,0 @@
-class Toolbox
-{
-    private int x;
-    private int y;
-    public void move(int x, int y)
-    {
-        this.x = x;
-        this.y = y;
-    }
-    // ...
-}
-class Window
-{
-    private int x;
-    private int y;
-    public void move(int x, int y)
-    {
-        this.x = x;
-        this.y = y;
-    }
-    // ...
-}
diff --git a/csharp/ql/src/external/DuplicateMethod.qhelp b/csharp/ql/src/external/DuplicateMethod.qhelp
deleted file mode 100644
index d42ffb73c64..00000000000
--- a/csharp/ql/src/external/DuplicateMethod.qhelp
+++ /dev/null
@@ -1,35 +0,0 @@
-<!DOCTYPE qhelp PUBLIC
-  "-//Semmle//qhelp//EN"
-  "qhelp.dtd">
-<qhelp>
-<overview>
-<p>Methods should not be duplicated at more than one place in the program. Duplicating code makes it harder to update 
-should a change need to be made. It also makes the code harder to read.</p>
-
-</overview>
-<recommendation>
-<p>Determining how to address this issue requires some consideration. If the duplicate methods are in the same class 
-then it is normally possible to just remove one and replace all references to that method by references to the other 
-method. If the methods are in different classes then there might be a need to create a superclass that 
-contains the method, which both classes inherit. If it is not logical to create a superclass the method 
-could be moved into a separate utility class.</p>
-
-</recommendation>
-<example>
-<p>In this example the Toolbox and the Window class both have the same move method. In this case it would be logical to 
-put this method as well as the x and y properties into a new superclass that Toolbox and Window extend.</p>
-<sample src="DuplicateMethod.cs" />
-
-</example>
-<section title="Fixing Using a Superclass">
-<p>The example could be easily fixed by moving the x and y properties as well as the move method to a parent class. Note 
-that the x and y properties have to be changed to protected if they are accessed from the Toolbox and Window classes.</p>
-<sample src="DuplicateMethodFix.cs" />
-
-</section>
-<references>
-
-  <li>Elmar Juergens, Florian Deissenboeck, Benjamin Hummel and Stefan Wagner. <em>Do Code Clones Matter?</em>. 2009.</li>
-
-</references>
-</qhelp>
diff --git a/csharp/ql/src/external/DuplicateMethod.ql b/csharp/ql/src/external/DuplicateMethod.ql
deleted file mode 100644
index 371315cd4e6..00000000000
--- a/csharp/ql/src/external/DuplicateMethod.ql
+++ /dev/null
@@ -1,41 +0,0 @@
-/**
- * @deprecated
- * @name Duplicate method
- * @description There is another identical implementation of this method. Extract the code to a common superclass or delegate to improve sharing.
- * @kind problem
- * @problem.severity recommendation
- * @precision high
- * @id cs/duplicate-method
- * @tags testability
- *       maintainability
- *       useless-code
- *       duplicate-code
- *       statistical
- *       non-attributable
- */
-
-import csharp
-import CodeDuplication
-
-predicate relevant(Method m) {
-  m.getNumberOfLinesOfCode() > 5 and not m.getName().matches("get%")
-  or
-  m.getNumberOfLinesOfCode() > 10
-}
-
-pragma[noopt]
-predicate query(Method m, Method other) {
-  duplicateMethod(m, other) and
-  relevant(m) and
-  not exists(File f1, File f2 |
-    m.getFile() = f1 and fileLevelDuplication(f1, f2) and other.getFile() = f2
-  ) and
-  not exists(Type t1, Type t2 |
-    m.getDeclaringType() = t1 and classLevelDuplication(t1, t2) and other.getDeclaringType() = t2
-  )
-}
-
-from Method m, Method other
-where query(m, other)
-select m, "Method " + m.getName() + " is duplicated in $@.", other,
-  other.getDeclaringType().getName() + "." + other.getName()
diff --git a/csharp/ql/src/external/DuplicateMethodFix.cs b/csharp/ql/src/external/DuplicateMethodFix.cs
deleted file mode 100644
index 5fb9864de99..00000000000
--- a/csharp/ql/src/external/DuplicateMethodFix.cs
+++ /dev/null
@@ -1,18 +0,0 @@
-class Container
-{
-    protected int x;
-    protected int y;
-    public void move(int x, int y)
-    {
-        this.x = x;
-        this.y = y;
-    }
-}
-class Toolbox : Container
-{
-    // ...
-}
-class Window : Container
-{
-    // ...
-}
diff --git a/csharp/ql/src/external/ExternalArtifact.qll b/csharp/ql/src/external/ExternalArtifact.qll
deleted file mode 100644
index 15be44b15bd..00000000000
--- a/csharp/ql/src/external/ExternalArtifact.qll
+++ /dev/null
@@ -1,79 +0,0 @@
-import csharp
-
-class ExternalElement extends @external_element {
-  /** Gets a textual representation of this element. */
-  string toString() { none() }
-
-  /** Gets the location of this element. */
-  Location getLocation() { none() }
-
-  /** Gets the file containing this element. */
-  File getFile() { result = getLocation().getFile() }
-}
-
-class ExternalDefect extends ExternalElement, @externalDefect {
-  string getQueryPath() {
-    exists(string path |
-      externalDefects(this, path, _, _, _) and
-      result = path.replaceAll("\\", "/")
-    )
-  }
-
-  string getMessage() { externalDefects(this, _, _, result, _) }
-
-  float getSeverity() { externalDefects(this, _, _, _, result) }
-
-  override Location getLocation() { externalDefects(this, _, result, _, _) }
-
-  override string toString() {
-    result = getQueryPath() + ": " + getLocation() + " - " + getMessage()
-  }
-}
-
-class ExternalMetric extends ExternalElement, @externalMetric {
-  string getQueryPath() { externalMetrics(this, result, _, _) }
-
-  float getValue() { externalMetrics(this, _, _, result) }
-
-  override Location getLocation() { externalMetrics(this, _, result, _) }
-
-  override string toString() { result = getQueryPath() + ": " + getLocation() + " - " + getValue() }
-}
-
-class ExternalData extends ExternalElement, @externalDataElement {
-  string getDataPath() { externalData(this, result, _, _) }
-
-  string getQueryPath() { result = getDataPath().regexpReplaceAll("\\.[^.]*$", ".ql") }
-
-  int getNumFields() { result = 1 + max(int i | externalData(this, _, i, _) | i) }
-
-  string getField(int index) { externalData(this, _, index, result) }
-
-  int getFieldAsInt(int index) { result = getField(index).toInt() }
-
-  float getFieldAsFloat(int index) { result = getField(index).toFloat() }
-
-  date getFieldAsDate(int index) { result = getField(index).toDate() }
-
-  override string toString() { result = getQueryPath() + ": " + buildTupleString(0) }
-
-  private string buildTupleString(int start) {
-    start = getNumFields() - 1 and result = getField(start)
-    or
-    start < getNumFields() - 1 and result = getField(start) + "," + buildTupleString(start + 1)
-  }
-}
-
-/**
- * External data with a location, and a message, as produced by tools that used to produce QLDs.
- */
-class DefectExternalData extends ExternalData {
-  DefectExternalData() {
-    this.getField(0).regexpMatch("\\w+://.*:[0-9]+:[0-9]+:[0-9]+:[0-9]+$") and
-    this.getNumFields() = 2
-  }
-
-  string getURL() { result = getField(0) }
-
-  string getMessage() { result = getField(1) }
-}
diff --git a/csharp/ql/src/external/MetricFilter.qll b/csharp/ql/src/external/MetricFilter.qll
deleted file mode 100644
index 6d7197662c0..00000000000
--- a/csharp/ql/src/external/MetricFilter.qll
+++ /dev/null
@@ -1,44 +0,0 @@
-import csharp
-
-external predicate metricResults(
-  int id, string queryPath, string file, int startline, int startcol, int endline, int endcol,
-  float value
-);
-
-class MetricResult extends int {
-  MetricResult() { metricResults(this, _, _, _, _, _, _, _) }
-
-  string getQueryPath() { metricResults(this, result, _, _, _, _, _, _) }
-
-  File getFile() {
-    exists(string path |
-      metricResults(this, _, path, _, _, _, _, _) and result.getAbsolutePath() = path
-    )
-  }
-
-  int getStartLine() { metricResults(this, _, _, result, _, _, _, _) }
-
-  int getStartColumn() { metricResults(this, _, _, _, result, _, _, _) }
-
-  int getEndLine() { metricResults(this, _, _, _, _, result, _, _) }
-
-  int getEndColumn() { metricResults(this, _, _, _, _, _, result, _) }
-
-  predicate hasMatchingLocation() { exists(this.getMatchingLocation()) }
-
-  Location getMatchingLocation() {
-    result.getFile() = this.getFile() and
-    result.getStartLine() = this.getStartLine() and
-    result.getEndLine() = this.getEndLine() and
-    result.getStartColumn() = this.getStartColumn() and
-    result.getEndColumn() = this.getEndColumn()
-  }
-
-  float getValue() { metricResults(this, _, _, _, _, _, _, result) }
-
-  string getURL() {
-    result =
-      "file://" + getFile().getAbsolutePath() + ":" + getStartLine() + ":" + getStartColumn() + ":" +
-        getEndLine() + ":" + getEndColumn()
-  }
-}
diff --git a/csharp/ql/src/external/MostlyDuplicateClass.qhelp b/csharp/ql/src/external/MostlyDuplicateClass.qhelp
deleted file mode 100644
index 2e053657d0a..00000000000
--- a/csharp/ql/src/external/MostlyDuplicateClass.qhelp
+++ /dev/null
@@ -1,20 +0,0 @@
-<!DOCTYPE qhelp PUBLIC
-  "-//Semmle//qhelp//EN"
-  "qhelp.dtd">
-<qhelp>
-<overview>
-<p>If two classes share a lot of each other's methods then there is a lot of unnecessary code duplication. 
-This makes it difficult to make changes in future and makes the code harder to read.</p>
-
-</overview>
-<recommendation>
-<p>If a duplicate class has been included by mistake then remove it. Otherwise consider making a common 
-superclass for both classes or even making one of the classes a superclass of the other.</p>
-
-</recommendation>
-<references>
-
-  <li>Elmar Juergens, Florian Deissenboeck, Benjamin Hummel and Stefan Wagner. <em>Do Code Clones Matter?</em>. 2009.</li>
-
-</references>
-</qhelp>
diff --git a/csharp/ql/src/external/MostlyDuplicateClass.ql b/csharp/ql/src/external/MostlyDuplicateClass.ql
deleted file mode 100644
index 7b7d5ef3eff..00000000000
--- a/csharp/ql/src/external/MostlyDuplicateClass.ql
+++ /dev/null
@@ -1,24 +0,0 @@
-/**
- * @deprecated
- * @name Duplicate class
- * @description More than 80% of the methods in this class are duplicated in another class. Create a common supertype to improve code sharing.
- * @kind problem
- * @problem.severity recommendation
- * @precision high
- * @id cs/duplicate-class
- * @tags testability
- *       maintainability
- *       useless-code
- *       duplicate-code
- *       statistical
- *       non-attributable
- */
-
-import csharp
-import CodeDuplication
-
-from Class c, string message, Class link
-where
-  mostlyDuplicateClass(c, link, message) and
-  not fileLevelDuplication(c.getFile(), _)
-select c, message, link, link.getName()
diff --git a/csharp/ql/src/external/MostlyDuplicateFile.qhelp b/csharp/ql/src/external/MostlyDuplicateFile.qhelp
deleted file mode 100644
index 9cfe21f43cf..00000000000
--- a/csharp/ql/src/external/MostlyDuplicateFile.qhelp
+++ /dev/null
@@ -1,31 +0,0 @@
-<!DOCTYPE qhelp PUBLIC
-  "-//Semmle//qhelp//EN"
-  "qhelp.dtd">
-<qhelp>
-<overview>
-<p>If two files share a lot of each other's code then there is a lot of unnecessary code duplication. 
-This makes it difficult to make changes in future and makes the code harder to read.</p>
-
-</overview>
-<recommendation>
-<p>While completely duplicated files are rare, they are usually a sign of a simple oversight. 
-Usually the required action is to remove all but one of them. A common exception to this rule may arise  
-from generated code that simply occurs in several places in the source tree; the check can be 
-adapted to exclude such results.</p>
-
-<p>It is far more common to see duplication of many lines between two files, leaving just a few that 
-are actually different. Consider such situations carefully. Are the differences deliberate or 
-a result of an inconsistent update to one of the clones? If the latter, then treating the files as 
-completely duplicate and eliminating one (while preserving any corrections or new features that 
-may have been introduced) is the best course. If two files serve genuinely different purposes but almost 
-all of their lines are the same, that can be a sign that there is a missing level of abstraction. Look 
-for ways to share the functionality, either by creating a utility class for the common parts or by 
-encapsulating the common parts into a new super class of any classes involved.</p>
-
-</recommendation>
-<references>
-
-  <li>Elmar Juergens, Florian Deissenboeck, Benjamin Hummel and Stefan Wagner. <em>Do Code Clones Matter?</em>. 2009.</li>
-
-</references>
-</qhelp>
diff --git a/csharp/ql/src/external/MostlyDuplicateFile.ql b/csharp/ql/src/external/MostlyDuplicateFile.ql
deleted file mode 100644
index 2dbc2e17ffb..00000000000
--- a/csharp/ql/src/external/MostlyDuplicateFile.ql
+++ /dev/null
@@ -1,23 +0,0 @@
-/**
- * @deprecated
- * @name Mostly duplicate file
- * @description There is another file that shares a lot of the code with this file. Merge the two files to improve maintainability.
- * @kind problem
- * @problem.severity recommendation
- * @precision high
- * @id cs/duplicate-file
- * @tags testability
- *       maintainability
- *       useless-code
- *       duplicate-code
- *       statistical
- *       non-attributable
- */
-
-import csharp
-import CodeDuplication
-
-from File f, File other, int percent
-where duplicateFiles(f, other, percent)
-select f, percent + "% of the lines in " + f.getBaseName() + " are copies of lines in $@.", other,
-  other.getBaseName()
diff --git a/csharp/ql/src/external/MostlyDuplicateMethod.qhelp b/csharp/ql/src/external/MostlyDuplicateMethod.qhelp
deleted file mode 100644
index 8388520189d..00000000000
--- a/csharp/ql/src/external/MostlyDuplicateMethod.qhelp
+++ /dev/null
@@ -1,48 +0,0 @@
-<!DOCTYPE qhelp PUBLIC
-  "-//Semmle//qhelp//EN"
-  "qhelp.dtd">
-<qhelp>
-
-<overview>
-<p>When most of the lines in one method are duplicated in one or more other
-methods, the methods themselves are regarded as <em>mostly duplicate</em> or <em>similar</em>.</p>
-
-<p>Code duplication in general is highly undesirable for a range of reasons. The artificially
-inflated amount of code is more difficult to understand, and sequences of similar but subtly different lines
-can mask the real purpose or intention behind them. Also, there is always a risk that only one 
-of several copies of the code is updated to address a defect or add a feature.</p>
-
-</overview>
-<recommendation>
-<p>Although completely duplicated methods are rare, they are usually a sign of a simple
-oversight (or deliberate copy/paste) by a developer. Usually the required solution
-is to remove all but one of them.</p>
-
-<p>It is more common to see duplication of many lines between two methods, leaving just
-a few that are actually different. Decide whether the differences are
-intended or the result of an inconsistent update to one of the copies.</p>
-<ul>
-<li>If the two methods serve different purposes but many of their lines are duplicated, this indicates
-that there is a missing level of abstraction. Look for ways of encapsulating the commonality and sharing it while
-retaining the differences in functionality. Perhaps the method can be moved to a single place
-and given an additional parameter, allowing it to cover all use cases. Alternatively, there
-may be a common pre-processing or post-processing step that can be extracted to its own (shared)
-method, leaving only the specific parts in the existing methods. Modern IDEs may provide 
-refactoring support for this sort of issue, usually with the names "Extract method", "Change method signature", 
-"Pull up" or "Extract supertype".</li>
-<li>If the two methods serve the same purpose and are different only as a result of inconsistent updates 
-then treat the methods as completely duplicate. Determine 
-the most up-to-date and correct version of the code and eliminate all near duplicates. Callers of the 
-removed methods should be updated to call the remaining method instead. </li></ul>
-
-</recommendation>
-<references>
-
-<li>E. Juergens, F. Deissenboeck, B. Hummel, S. Wagner. 
-<em>Do code clones matter?</em> Proceedings of the 31st International Conference on
-Software Engineering, 
-485-495, 2009.</li>
-
-
-</references>
-</qhelp>
diff --git a/csharp/ql/src/external/MostlyDuplicateMethod.ql b/csharp/ql/src/external/MostlyDuplicateMethod.ql
deleted file mode 100644
index aa0003c113b..00000000000
--- a/csharp/ql/src/external/MostlyDuplicateMethod.ql
+++ /dev/null
@@ -1,30 +0,0 @@
-/**
- * @deprecated
- * @name Mostly duplicate method
- * @description There is another method that shares a lot of the code with this method. Extract the code to a common superclass or delegate to improve sharing.
- * @kind problem
- * @problem.severity recommendation
- * @precision high
- * @id cs/similar-method
- * @tags testability
- *       maintainability
- *       useless-code
- *       statistical
- *       non-attributable
- */
-
-import csharp
-import CodeDuplication
-
-from Method m, int covered, int total, Method other, int percent
-where
-  duplicateStatements(m, other, covered, total) and
-  covered != total and
-  m.getNumberOfLinesOfCode() > 5 and
-  covered * 100 / total = percent and
-  percent > 80 and
-  not duplicateMethod(m, other) and
-  not classLevelDuplication(m.getDeclaringType(), other.getDeclaringType()) and
-  not fileLevelDuplication(m.getFile(), other.getFile())
-select m, percent + "% of the statements in " + m.getName() + " are duplicated in $@.", other,
-  other.getDeclaringType().getName() + "." + other.getName()
diff --git a/csharp/ql/src/external/MostlySimilarFile.qhelp b/csharp/ql/src/external/MostlySimilarFile.qhelp
deleted file mode 100644
index f0fd64c99ad..00000000000
--- a/csharp/ql/src/external/MostlySimilarFile.qhelp
+++ /dev/null
@@ -1,24 +0,0 @@
-<!DOCTYPE qhelp PUBLIC
-  "-//Semmle//qhelp//EN"
-  "qhelp.dtd">
-<qhelp>
-<overview>
-<p>This rule identifies two files that have a lot of the same lines but with different variable and method 
-names. This makes it difficult to make changes in future and makes the code harder to read.</p>
-
-</overview>
-<recommendation>
-<p>It is important to determine why there are small differences in the files. Sometimes the files might have 
-been duplicates but an update was only applied to one copy. If this is the case it should be simple to merge 
-the files, preserving any changes.</p>
-
-<p>If the files are intentionally different then it could be a good idea to consider extracting some of the 
-shared code into a superclass or a separate utility class.</p>
-
-</recommendation>
-<references>
-
-  <li>Elmar Juergens, Florian Deissenboeck, Benjamin Hummel and Stefan Wagner. <em>Do Code Clones Matter?</em>. 2009.</li>
-
-</references>
-</qhelp>
diff --git a/csharp/ql/src/external/MostlySimilarFile.ql b/csharp/ql/src/external/MostlySimilarFile.ql
deleted file mode 100644
index a66df834aca..00000000000
--- a/csharp/ql/src/external/MostlySimilarFile.ql
+++ /dev/null
@@ -1,31 +0,0 @@
-/**
- * @deprecated
- * @name Mostly similar file
- * @description There is another file that shares a lot of the code with this file. Notice that names of variables and types may have been changed. Merge the two files to improve maintainability.
- * @kind problem
- * @problem.severity recommendation
- * @precision high
- * @id cs/similar-file
- * @tags testability
- *       maintainability
- *       useless-code
- *       duplicate-code
- *       statistical
- *       non-attributable
- */
-
-import csharp
-import CodeDuplication
-
-predicate irrelevant(File f) {
-  f.getStem() = "AssemblyInfo" or
-  f.getStem().matches("%.Designer")
-}
-
-from File f, File other, int percent
-where
-  similarFiles(f, other, percent) and
-  not irrelevant(f) and
-  not irrelevant(other)
-select f, percent + "% of the lines in " + f.getBaseName() + " are similar to lines in $@.", other,
-  other.getBaseName()
diff --git a/csharp/ql/src/filters/ChangedLines.ql b/csharp/ql/src/filters/ChangedLines.ql
deleted file mode 100644
index f97e60d4faf..00000000000
--- a/csharp/ql/src/filters/ChangedLines.ql
+++ /dev/null
@@ -1,20 +0,0 @@
-/**
- * @name Filter: only keep results from source that have been changed since the base line
- * @description Exclude results that have not changed since the base line.
- * @id cs/changed-lines-filter
- * @kind problem
- */
-
-import csharp
-import external.ExternalArtifact
-import external.DefectFilter
-import ChangedLines
-
-from DefectResult res
-where
-  changedLine(res.getFile(), res.getStartLine())
-  or
-  changedLine(res.getFile(), res.getEndLine())
-  or
-  res.getStartLine() = 0 and changedLine(res.getFile(), _)
-select res, res.getMessage()
diff --git a/csharp/ql/src/filters/ChangedLines.qll b/csharp/ql/src/filters/ChangedLines.qll
deleted file mode 100644
index 75628dab020..00000000000
--- a/csharp/ql/src/filters/ChangedLines.qll
+++ /dev/null
@@ -1,12 +0,0 @@
-import csharp
-import external.ExternalArtifact
-
-pragma[noopt]
-predicate changedLine(File f, int line) {
-  exists(ExternalMetric metric, Location l |
-    exists(string s | s = "changedLines.ql" and metric.getQueryPath() = s) and
-    l = metric.getLocation() and
-    f = l.getFile() and
-    line = l.getStartLine()
-  )
-}
diff --git a/csharp/ql/src/filters/ChangedLinesForMetric.ql b/csharp/ql/src/filters/ChangedLinesForMetric.ql
deleted file mode 100644
index d04cc681a37..00000000000
--- a/csharp/ql/src/filters/ChangedLinesForMetric.ql
+++ /dev/null
@@ -1,15 +0,0 @@
-/**
- * @name Filter: only keep results from source that have been changed since the base line
- * @description Exclude results that have not changed since the base line.
- * @id cs/changed-lines-metric-filter
- * @kind treemap
- */
-
-import csharp
-import external.ExternalArtifact
-import external.MetricFilter
-import ChangedLines
-
-from MetricResult res
-where changedLine(res.getFile(), _)
-select res, res.getValue()
diff --git a/csharp/ql/src/filters/ClassifyFiles.ql b/csharp/ql/src/filters/ClassifyFiles.ql
index 4277e321a1c..23b0994dcfa 100644
--- a/csharp/ql/src/filters/ClassifyFiles.ql
+++ b/csharp/ql/src/filters/ClassifyFiles.ql
@@ -2,6 +2,8 @@
  * @name Classify files
  * @description This query produces a list of all files in a snapshot
  *              that are classified as generated code or test code.
+ *
+ *              Used by LGTM.
  * @kind file-classifier
  * @id cs/file-classifier
  */
diff --git a/csharp/ql/src/filters/FromSource.ql b/csharp/ql/src/filters/FromSource.ql
deleted file mode 100644
index e19785afad9..00000000000
--- a/csharp/ql/src/filters/FromSource.ql
+++ /dev/null
@@ -1,13 +0,0 @@
-/**
- * @name Filter: only keep results from source
- * @description Exclude results that do not come from source code files.
- * @kind problem
- * @id cs/source-filter
- */
-
-import csharp
-import external.DefectFilter
-
-from DefectResult res
-where res.getFile().fromSource()
-select res, res.getMessage()
diff --git a/csharp/ql/src/filters/FromSourceForMetric.ql b/csharp/ql/src/filters/FromSourceForMetric.ql
deleted file mode 100644
index 49e1d4a2f3c..00000000000
--- a/csharp/ql/src/filters/FromSourceForMetric.ql
+++ /dev/null
@@ -1,13 +0,0 @@
-/**
- * @name Filter: only keep metric results from source
- * @description Exclude results that do not come from source code files.
- * @kind treemap
- * @id cs/source-metric-filter
- */
-
-import csharp
-import external.MetricFilter
-
-from MetricResult res
-where res.getFile().fromSource()
-select res, res.getValue()
diff --git a/csharp/ql/src/filters/NotGenerated.ql b/csharp/ql/src/filters/NotGenerated.ql
deleted file mode 100644
index 5e80ffe8e2e..00000000000
--- a/csharp/ql/src/filters/NotGenerated.ql
+++ /dev/null
@@ -1,13 +0,0 @@
-/**
- * @name Filter: only keep results in non-generated files
- * @description Exclude results that come from generated code.
- * @kind problem
- * @id cs/not-generated-file-filter
- */
-
-import semmle.code.csharp.commons.GeneratedCode
-import external.DefectFilter
-
-from DefectResult res
-where not isGeneratedCode(res.getFile())
-select res, res.getMessage()
diff --git a/csharp/ql/src/filters/NotGeneratedForMetric.ql b/csharp/ql/src/filters/NotGeneratedForMetric.ql
deleted file mode 100644
index ca6e7f8080f..00000000000
--- a/csharp/ql/src/filters/NotGeneratedForMetric.ql
+++ /dev/null
@@ -1,13 +0,0 @@
-/**
- * @name Filter: only keep metric results in non-generated files
- * @description Exclude results that come from generated code.
- * @kind treemap
- * @id cs/not-generated-file-metric-filter
- */
-
-import semmle.code.csharp.commons.GeneratedCode
-import external.MetricFilter
-
-from MetricResult res
-where not isGeneratedCode(res.getFile())
-select res, res.getValue()
diff --git a/csharp/ql/src/filters/NotInTestFile.ql b/csharp/ql/src/filters/NotInTestFile.ql
deleted file mode 100644
index 041163ef946..00000000000
--- a/csharp/ql/src/filters/NotInTestFile.ql
+++ /dev/null
@@ -1,14 +0,0 @@
-/**
- * @name Filter: only keep results that are outside of test files
- * @description Exclude results in test files.
- * @kind problem
- * @id cs/test-file-filter
- */
-
-import csharp
-import semmle.code.csharp.frameworks.Test
-import external.DefectFilter
-
-from DefectResult res
-where not res.getFile() instanceof TestFile
-select res, res.getMessage()
diff --git a/csharp/ql/src/filters/NotInTestFileForMetric.ql b/csharp/ql/src/filters/NotInTestFileForMetric.ql
deleted file mode 100644
index 47b8e71253f..00000000000
--- a/csharp/ql/src/filters/NotInTestFileForMetric.ql
+++ /dev/null
@@ -1,14 +0,0 @@
-/**
- * @name Filter: only keep results that are outside of test files
- * @description Exclude results in test files.
- * @kind treemap
- * @id cs/test-file-metric-filter
- */
-
-import csharp
-import semmle.code.csharp.frameworks.Test
-import external.MetricFilter
-
-from MetricResult res
-where not res.getFile() instanceof TestFile
-select res, res.getValue()
diff --git a/csharp/ql/src/filters/NotInTestMethod.ql b/csharp/ql/src/filters/NotInTestMethod.ql
deleted file mode 100644
index 2981b891380..00000000000
--- a/csharp/ql/src/filters/NotInTestMethod.ql
+++ /dev/null
@@ -1,17 +0,0 @@
-/**
- * @name Filter: only keep results that are outside of test methods
- * @description Exclude results in test methods.
- * @kind problem
- * @id cs/test-method-filter
- */
-
-import csharp
-import semmle.code.csharp.frameworks.Test
-import external.DefectFilter
-
-from DefectResult res
-where
-  not res.getFile() instanceof TestFile
-  or
-  not res.getStartLine() = res.getFile().(TestFile).lineInTestMethod()
-select res, res.getMessage()
diff --git a/csharp/ql/src/filters/NotInTestMethodExpectingException.ql b/csharp/ql/src/filters/NotInTestMethodExpectingException.ql
deleted file mode 100644
index f4879211484..00000000000
--- a/csharp/ql/src/filters/NotInTestMethodExpectingException.ql
+++ /dev/null
@@ -1,24 +0,0 @@
-/**
- * @name Filter: only keep results that are outside of a test method expecting an exception
- * @description Exclude results in test methods expecting exceptions.
- * @kind problem
- * @id cs/test-method-exception-filter
- */
-
-import csharp
-import semmle.code.csharp.frameworks.Test
-import external.DefectFilter
-
-predicate ignoredLine(File f, int line) {
-  exists(TestMethod m | m.expectsException() |
-    f = m.getFile() and
-    line in [m.getLocation().getStartLine() .. m.getBody().getLocation().getEndLine()]
-  )
-}
-
-from DefectResult res
-where
-  not res.getFile() instanceof TestFile
-  or
-  not ignoredLine(res.getFile(), res.getStartLine())
-select res, res.getMessage()
diff --git a/csharp/ql/src/filters/UnchangedLines.ql b/csharp/ql/src/filters/UnchangedLines.ql
deleted file mode 100644
index 89d43ac2561..00000000000
--- a/csharp/ql/src/filters/UnchangedLines.ql
+++ /dev/null
@@ -1,22 +0,0 @@
-/**
- * @name Filter: only keep results from source that have not changed since the base line
- * @description Complement of ChangedLines.ql.
- * @kind problem
- * @id cs/unchanged-lines-filter
- */
-
-import csharp
-import external.ExternalArtifact
-import external.DefectFilter
-import ChangedLines
-
-from DefectResult res
-where
-  not (
-    changedLine(res.getFile(), res.getStartLine())
-    or
-    changedLine(res.getFile(), res.getEndLine())
-    or
-    res.getStartLine() = 0 and changedLine(res.getFile(), _)
-  )
-select res, res.getMessage()
diff --git a/csharp/ql/src/filters/UnchangedLinesForMetric.ql b/csharp/ql/src/filters/UnchangedLinesForMetric.ql
deleted file mode 100644
index b31b4cb5d56..00000000000
--- a/csharp/ql/src/filters/UnchangedLinesForMetric.ql
+++ /dev/null
@@ -1,15 +0,0 @@
-/**
- * @name Filter: only keep results from source that have not changed since the base line
- * @description Complement of ChangedLinesForMetric.ql.
- * @kind treemap
- * @id cs/unchanged-lines-metric-filter
- */
-
-import csharp
-import external.ExternalArtifact
-import external.MetricFilter
-import ChangedLines
-
-from MetricResult res
-where not changedLine(res.getFile(), _)
-select res, res.getValue()
diff --git a/csharp/ql/src/semmle/code/cil/BasicBlock.qll b/csharp/ql/src/semmle/code/cil/BasicBlock.qll
index 459bb667e6f..0c9c0b8ad07 100644
--- a/csharp/ql/src/semmle/code/cil/BasicBlock.qll
+++ b/csharp/ql/src/semmle/code/cil/BasicBlock.qll
@@ -240,6 +240,9 @@ class BasicBlock extends Cached::TBasicBlockStart {
 
   /** Gets a textual representation of this basic block. */
   string toString() { result = getFirstNode().toString() }
+
+  /** Gets the location of this basic block. */
+  Location getLocation() { result = this.getFirstNode().getLocation() }
 }
 
 /**
@@ -305,7 +308,7 @@ class EntryBasicBlock extends BasicBlock {
 }
 
 /** Holds if `bb` is an entry basic block. */
-private predicate entryBB(BasicBlock bb) { bb.getFirstNode() instanceof EntryPoint }
+private predicate entryBB(BasicBlock bb) { bb.getFirstNode() instanceof MethodImplementation }
 
 /**
  * An exit basic block, that is, a basic block whose last node is
diff --git a/csharp/ql/src/semmle/code/cil/CIL.qll b/csharp/ql/src/semmle/code/cil/CIL.qll
index 1e77d98fd29..db0018d8216 100644
--- a/csharp/ql/src/semmle/code/cil/CIL.qll
+++ b/csharp/ql/src/semmle/code/cil/CIL.qll
@@ -20,3 +20,4 @@ import Attribute
 import Stubs
 import CustomModifierReceiver
 import Parameterizable
+import semmle.code.cil.Ssa
diff --git a/csharp/ql/src/semmle/code/cil/CallableReturns.qll b/csharp/ql/src/semmle/code/cil/CallableReturns.qll
index ee60713b801..8b029d87dd4 100644
--- a/csharp/ql/src/semmle/code/cil/CallableReturns.qll
+++ b/csharp/ql/src/semmle/code/cil/CallableReturns.qll
@@ -42,7 +42,11 @@ private predicate alwaysNullExpr(Expr expr) {
   or
   alwaysNullMethod(expr.(StaticCall).getTarget())
   or
-  forex(VariableUpdate vu | DefUse::variableUpdateUse(_, vu, expr) | alwaysNullVariableUpdate(vu))
+  forex(Ssa::Definition def |
+    expr = any(Ssa::Definition def0 | def = def0.getAnUltimateDefinition()).getARead()
+  |
+    alwaysNullVariableUpdate(def.getVariableUpdate())
+  )
 }
 
 pragma[noinline]
@@ -58,7 +62,9 @@ private predicate alwaysNotNullExpr(Expr expr) {
   or
   alwaysNotNullMethod(expr.(StaticCall).getTarget())
   or
-  forex(VariableUpdate vu | DefUse::variableUpdateUse(_, vu, expr) |
-    alwaysNotNullVariableUpdate(vu)
+  forex(Ssa::Definition def |
+    expr = any(Ssa::Definition def0 | def = def0.getAnUltimateDefinition()).getARead()
+  |
+    alwaysNotNullVariableUpdate(def.getVariableUpdate())
   )
 }
diff --git a/csharp/ql/src/semmle/code/cil/ControlFlow.qll b/csharp/ql/src/semmle/code/cil/ControlFlow.qll
index 176df2a20dc..52a2ddc3376 100644
--- a/csharp/ql/src/semmle/code/cil/ControlFlow.qll
+++ b/csharp/ql/src/semmle/code/cil/ControlFlow.qll
@@ -9,6 +9,9 @@ class ControlFlowNode extends @cil_controlflow_node {
   /** Gets a textual representation of this control flow node. */
   string toString() { none() }
 
+  /** Gets the location of this control flow node. */
+  Location getLocation() { none() }
+
   /**
    * Gets the number of items this node pushes onto the stack.
    * This value is either 0 or 1, except for the instruction `dup`
diff --git a/csharp/ql/src/semmle/code/cil/DataFlow.qll b/csharp/ql/src/semmle/code/cil/DataFlow.qll
index 6991658ea3a..d62ee739369 100644
--- a/csharp/ql/src/semmle/code/cil/DataFlow.qll
+++ b/csharp/ql/src/semmle/code/cil/DataFlow.qll
@@ -57,12 +57,40 @@ class Untainted extends TaintType, TExactValue { }
 /** A taint type where the data is tainted. */
 class Tainted extends TaintType, TTaintedValue { }
 
+private predicate localFlowPhiInput(DataFlowNode input, Ssa::PhiNode phi) {
+  exists(Ssa::Definition def, BasicBlock bb, int i | phi.hasLastInputRef(def, bb, i) |
+    def.definesAt(_, bb, i) and
+    input = def.getVariableUpdate().getSource()
+    or
+    input =
+      any(ReadAccess ra |
+        bb.getNode(i) = ra and
+        ra.getTarget() = def.getSourceVariable()
+      )
+  )
+  or
+  exists(Ssa::PhiNode mid, BasicBlock bb, int i |
+    localFlowPhiInput(input, mid) and
+    phi.hasLastInputRef(mid, bb, i) and
+    mid.definesAt(_, bb, i)
+  )
+}
+
 private predicate localExactStep(DataFlowNode src, DataFlowNode sink) {
   src = sink.(Opcodes::Dup).getAnOperand()
   or
-  defUse(_, src, sink)
+  exists(Ssa::Definition def, VariableUpdate vu |
+    vu = def.getVariableUpdate() and
+    src = vu.getSource() and
+    sink = def.getAFirstRead()
+  )
   or
-  src = sink.(ParameterReadAccess).getTarget()
+  any(Ssa::Definition def).hasAdjacentReads(src, sink)
+  or
+  exists(Ssa::PhiNode phi |
+    localFlowPhiInput(src, phi) and
+    sink = phi.getAFirstRead()
+  )
   or
   src = sink.(Conversion).getExpr()
   or
@@ -73,12 +101,6 @@ private predicate localExactStep(DataFlowNode src, DataFlowNode sink) {
   src = sink.(Return).getExpr()
   or
   src = sink.(ConditionalBranch).getAnOperand()
-  or
-  src = sink.(MethodParameter).getAWrite()
-  or
-  exists(VariableUpdate update |
-    update.getVariable().(Parameter) = sink and src = update.getSource()
-  )
 }
 
 private predicate localTaintStep(DataFlowNode src, DataFlowNode sink) {
@@ -87,8 +109,7 @@ private predicate localTaintStep(DataFlowNode src, DataFlowNode sink) {
   src = sink.(UnaryBitwiseOperation).getOperand()
 }
 
-cached
-module DefUse {
+deprecated module DefUse {
   /**
    * A classification of variable references into reads and writes.
    */
@@ -189,7 +210,7 @@ module DefUse {
 
   /** Holds if the variable update `vu` can be used at the read `use`. */
   cached
-  predicate variableUpdateUse(StackVariable target, VariableUpdate vu, ReadAccess use) {
+  deprecated predicate variableUpdateUse(StackVariable target, VariableUpdate vu, ReadAccess use) {
     defReachesReadWithinBlock(target, vu, use)
     or
     exists(BasicBlock bb, int i |
@@ -202,23 +223,40 @@ module DefUse {
 
   /** Holds if the update `def` can be used at the read `use`. */
   cached
-  predicate defUse(StackVariable target, Expr def, ReadAccess use) {
+  deprecated predicate defUse(StackVariable target, Expr def, ReadAccess use) {
     exists(VariableUpdate vu | def = vu.getSource() | variableUpdateUse(target, vu, use))
   }
 }
 
-private import DefUse
-
-abstract library class VariableUpdate extends Instruction {
-  abstract Expr getSource();
+/** A node that updates a variable. */
+abstract class VariableUpdate extends DataFlowNode {
+  /** Gets the value assigned, if any. */
+  abstract DataFlowNode getSource();
 
+  /** Gets the variable that is updated. */
   abstract Variable getVariable();
+
+  /** Holds if this variable update happens at index `i` in basic block `bb`. */
+  abstract predicate updatesAt(BasicBlock bb, int i);
+}
+
+private class MethodParameterDef extends VariableUpdate, MethodParameter {
+  override MethodParameter getSource() { result = this }
+
+  override MethodParameter getVariable() { result = this }
+
+  override predicate updatesAt(BasicBlock bb, int i) {
+    bb.(EntryBasicBlock).getANode().getImplementation().getMethod() = this.getMethod() and
+    i = -1
+  }
 }
 
 private class VariableWrite extends VariableUpdate, WriteAccess {
-  override Expr getSource() { result = getExpr() }
+  override Expr getSource() { result = this.getExpr() }
 
-  override Variable getVariable() { result = getTarget() }
+  override Variable getVariable() { result = this.getTarget() }
+
+  override predicate updatesAt(BasicBlock bb, int i) { this = bb.getNode(i) }
 }
 
 private class MethodOutOrRefTarget extends VariableUpdate, Call {
@@ -230,5 +268,7 @@ private class MethodOutOrRefTarget extends VariableUpdate, Call {
     result = this.getRawArgument(parameterIndex).(ReadAccess).getTarget()
   }
 
-  override Expr getSource() { result = this }
+  override Expr getSource() { none() }
+
+  override predicate updatesAt(BasicBlock bb, int i) { this = bb.getNode(i) }
 }
diff --git a/csharp/ql/src/semmle/code/cil/Method.qll b/csharp/ql/src/semmle/code/cil/Method.qll
index 5ef282e582a..8da707cb423 100644
--- a/csharp/ql/src/semmle/code/cil/Method.qll
+++ b/csharp/ql/src/semmle/code/cil/Method.qll
@@ -19,7 +19,7 @@ class MethodImplementation extends EntryPoint, @cil_method_implementation {
   override MethodImplementation getImplementation() { result = this }
 
   /** Gets the location of this implementation. */
-  Assembly getLocation() { cil_method_implementation(this, _, result) }
+  override Assembly getLocation() { cil_method_implementation(this, _, result) }
 
   /** Gets the instruction at index `index`. */
   Instruction getInstruction(int index) { cil_instruction(result, _, index, this) }
diff --git a/csharp/ql/src/semmle/code/cil/Ssa.qll b/csharp/ql/src/semmle/code/cil/Ssa.qll
new file mode 100644
index 00000000000..229925f6d08
--- /dev/null
+++ b/csharp/ql/src/semmle/code/cil/Ssa.qll
@@ -0,0 +1,66 @@
+/**
+ * Provides the module `Ssa` for working with static single assignment (SSA) form.
+ */
+
+private import CIL
+
+/**
+ * Provides classes for working with static single assignment (SSA) form.
+ */
+module Ssa {
+  private import internal.SsaImplCommon as SsaImpl
+  private import internal.SsaImpl
+
+  /** An SSA definition. */
+  class Definition extends SsaImpl::Definition {
+    /** Gets a read of this SSA definition. */
+    final ReadAccess getARead() { result = getARead(this) }
+
+    /** Gets the underlying variable update, if any. */
+    final VariableUpdate getVariableUpdate() {
+      exists(BasicBlock bb, int i |
+        result.updatesAt(bb, i) and
+        this.definesAt(result.getVariable(), bb, i)
+      )
+    }
+
+    /** Gets a first read of this SSA definition. */
+    final ReadAccess getAFirstRead() { result = getAFirstRead(this) }
+
+    /** Holds if `first` and `second` are adjacent reads of this SSA definition. */
+    final predicate hasAdjacentReads(ReadAccess first, ReadAccess second) {
+      hasAdjacentReads(this, first, second)
+    }
+
+    private Definition getAPhiInput() { result = this.(PhiNode).getAnInput() }
+
+    /**
+     * Gets a definition that ultimately defines this SSA definition and is
+     * not itself a phi node.
+     */
+    final Definition getAnUltimateDefinition() {
+      result = this.getAPhiInput*() and
+      not result instanceof PhiNode
+    }
+
+    /** Gets the location of this SSA definition. */
+    Location getLocation() { result = this.getVariableUpdate().getLocation() }
+  }
+
+  /** A phi node. */
+  class PhiNode extends SsaImpl::PhiNode, Definition {
+    final override Location getLocation() { result = this.getBasicBlock().getLocation() }
+
+    /** Gets an input to this phi node. */
+    final Definition getAnInput() { result = getAPhiInput(this) }
+
+    /**
+     * Holds if if `def` is an input to this phi node, and a reference to `def` at
+     * index `i` in basic block `bb` can reach this phi node without going through
+     * other references.
+     */
+    final predicate hasLastInputRef(Definition def, BasicBlock bb, int i) {
+      hasLastInputRef(this, def, bb, i)
+    }
+  }
+}
diff --git a/csharp/ql/src/semmle/code/cil/internal/SsaImpl.qll b/csharp/ql/src/semmle/code/cil/internal/SsaImpl.qll
new file mode 100644
index 00000000000..593c877b9af
--- /dev/null
+++ b/csharp/ql/src/semmle/code/cil/internal/SsaImpl.qll
@@ -0,0 +1,45 @@
+private import semmle.code.cil.CIL
+private import SsaImplCommon
+
+cached
+private module Cached {
+  cached
+  predicate forceCachingInSameStage() { any() }
+
+  cached
+  ReadAccess getARead(Definition def) {
+    exists(BasicBlock bb, int i |
+      ssaDefReachesRead(_, def, bb, i) and
+      result = bb.getNode(i)
+    )
+  }
+
+  cached
+  ReadAccess getAFirstRead(Definition def) {
+    exists(BasicBlock bb1, int i1, BasicBlock bb2, int i2 |
+      def.definesAt(_, bb1, i1) and
+      adjacentDefRead(def, bb1, i1, bb2, i2) and
+      result = bb2.getNode(i2)
+    )
+  }
+
+  cached
+  predicate hasAdjacentReads(Definition def, ReadAccess first, ReadAccess second) {
+    exists(BasicBlock bb1, int i1, BasicBlock bb2, int i2 |
+      first = bb1.getNode(i1) and
+      adjacentDefRead(def, bb1, i1, bb2, i2) and
+      second = bb2.getNode(i2)
+    )
+  }
+
+  cached
+  Definition getAPhiInput(PhiNode phi) { phiHasInputFromBlock(phi, result, _) }
+
+  cached
+  predicate hasLastInputRef(Definition phi, Definition def, BasicBlock bb, int i) {
+    lastRefRedef(def, bb, i, phi) and
+    def = getAPhiInput(phi)
+  }
+}
+
+import Cached
diff --git a/csharp/ql/src/semmle/code/cil/internal/SsaImplCommon.qll b/csharp/ql/src/semmle/code/cil/internal/SsaImplCommon.qll
new file mode 100644
index 00000000000..f828419a440
--- /dev/null
+++ b/csharp/ql/src/semmle/code/cil/internal/SsaImplCommon.qll
@@ -0,0 +1,620 @@
+/**
+ * Provides a language-independent implementation of static single assignment
+ * (SSA) form.
+ */
+
+private import SsaImplSpecific
+
+private BasicBlock getABasicBlockPredecessor(BasicBlock bb) { getABasicBlockSuccessor(result) = bb }
+
+/**
+ * Liveness analysis (based on source variables) to restrict the size of the
+ * SSA representation.
+ */
+private module Liveness {
+  /**
+   * A classification of variable references into reads (of a given kind) and
+   * (certain or uncertain) writes.
+   */
+  private newtype TRefKind =
+    Read(boolean certain) { certain in [false, true] } or
+    Write(boolean certain) { certain in [false, true] }
+
+  private class RefKind extends TRefKind {
+    string toString() {
+      exists(boolean certain | this = Read(certain) and result = "read (" + certain + ")")
+      or
+      exists(boolean certain | this = Write(certain) and result = "write (" + certain + ")")
+    }
+
+    int getOrder() {
+      this = Read(_) and
+      result = 0
+      or
+      this = Write(_) and
+      result = 1
+    }
+  }
+
+  /**
+   * Holds if the `i`th node of basic block `bb` is a reference to `v` of kind `k`.
+   */
+  private predicate ref(BasicBlock bb, int i, SourceVariable v, RefKind k) {
+    exists(boolean certain | variableRead(bb, i, v, certain) | k = Read(certain))
+    or
+    exists(boolean certain | variableWrite(bb, i, v, certain) | k = Write(certain))
+  }
+
+  private newtype OrderedRefIndex =
+    MkOrderedRefIndex(int i, int tag) {
+      exists(RefKind rk | ref(_, i, _, rk) | tag = rk.getOrder())
+    }
+
+  private OrderedRefIndex refOrd(BasicBlock bb, int i, SourceVariable v, RefKind k, int ord) {
+    ref(bb, i, v, k) and
+    result = MkOrderedRefIndex(i, ord) and
+    ord = k.getOrder()
+  }
+
+  /**
+   * Gets the (1-based) rank of the reference to `v` at the `i`th node of
+   * basic block `bb`, which has the given reference kind `k`.
+   *
+   * Reads are considered before writes when they happen at the same index.
+   */
+  private int refRank(BasicBlock bb, int i, SourceVariable v, RefKind k) {
+    refOrd(bb, i, v, k, _) =
+      rank[result](int j, int ord, OrderedRefIndex res |
+        res = refOrd(bb, j, v, _, ord)
+      |
+        res order by j, ord
+      )
+  }
+
+  private int maxRefRank(BasicBlock bb, SourceVariable v) {
+    result = refRank(bb, _, v, _) and
+    not result + 1 = refRank(bb, _, v, _)
+  }
+
+  /**
+   * Gets the (1-based) rank of the first reference to `v` inside basic block `bb`
+   * that is either a read or a certain write.
+   */
+  private int firstReadOrCertainWrite(BasicBlock bb, SourceVariable v) {
+    result =
+      min(int r, RefKind k |
+        r = refRank(bb, _, v, k) and
+        k != Write(false)
+      |
+        r
+      )
+  }
+
+  /**
+   * Holds if source variable `v` is live at the beginning of basic block `bb`.
+   */
+  predicate liveAtEntry(BasicBlock bb, SourceVariable v) {
+    // The first read or certain write to `v` inside `bb` is a read
+    refRank(bb, _, v, Read(_)) = firstReadOrCertainWrite(bb, v)
+    or
+    // There is no certain write to `v` inside `bb`, but `v` is live at entry
+    // to a successor basic block of `bb`
+    not exists(firstReadOrCertainWrite(bb, v)) and
+    liveAtExit(bb, v)
+  }
+
+  /**
+   * Holds if source variable `v` is live at the end of basic block `bb`.
+   */
+  predicate liveAtExit(BasicBlock bb, SourceVariable v) {
+    liveAtEntry(getABasicBlockSuccessor(bb), v)
+  }
+
+  /**
+   * Holds if variable `v` is live in basic block `bb` at index `i`.
+   * The rank of `i` is `rnk` as defined by `refRank()`.
+   */
+  private predicate liveAtRank(BasicBlock bb, int i, SourceVariable v, int rnk) {
+    exists(RefKind kind | rnk = refRank(bb, i, v, kind) |
+      rnk = maxRefRank(bb, v) and
+      liveAtExit(bb, v)
+      or
+      ref(bb, i, v, kind) and
+      kind = Read(_)
+      or
+      exists(RefKind nextKind |
+        liveAtRank(bb, _, v, rnk + 1) and
+        rnk + 1 = refRank(bb, _, v, nextKind) and
+        nextKind != Write(true)
+      )
+    )
+  }
+
+  /**
+   * Holds if variable `v` is live after the (certain or uncertain) write at
+   * index `i` inside basic block `bb`.
+   */
+  predicate liveAfterWrite(BasicBlock bb, int i, SourceVariable v) {
+    exists(int rnk | rnk = refRank(bb, i, v, Write(_)) | liveAtRank(bb, i, v, rnk))
+  }
+}
+
+private import Liveness
+
+/** Holds if `bb1` strictly dominates `bb2`. */
+private predicate strictlyDominates(BasicBlock bb1, BasicBlock bb2) {
+  bb1 = getImmediateBasicBlockDominator+(bb2)
+}
+
+/** Holds if `bb1` dominates a predecessor of `bb2`. */
+private predicate dominatesPredecessor(BasicBlock bb1, BasicBlock bb2) {
+  exists(BasicBlock pred | pred = getABasicBlockPredecessor(bb2) |
+    bb1 = pred
+    or
+    strictlyDominates(bb1, pred)
+  )
+}
+
+/** Holds if `df` is in the dominance frontier of `bb`. */
+private predicate inDominanceFrontier(BasicBlock bb, BasicBlock df) {
+  dominatesPredecessor(bb, df) and
+  not strictlyDominates(bb, df)
+}
+
+/**
+ * Holds if `bb` is in the dominance frontier of a block containing a
+ * definition of `v`.
+ */
+pragma[noinline]
+private predicate inDefDominanceFrontier(BasicBlock bb, SourceVariable v) {
+  exists(BasicBlock defbb, Definition def |
+    def.definesAt(v, defbb, _) and
+    inDominanceFrontier(defbb, bb)
+  )
+}
+
+cached
+newtype TDefinition =
+  TWriteDef(SourceVariable v, BasicBlock bb, int i) {
+    variableWrite(bb, i, v, _) and
+    liveAfterWrite(bb, i, v)
+  } or
+  TPhiNode(SourceVariable v, BasicBlock bb) {
+    inDefDominanceFrontier(bb, v) and
+    liveAtEntry(bb, v)
+  }
+
+private module SsaDefReaches {
+  newtype TSsaRefKind =
+    SsaRead() or
+    SsaDef()
+
+  /**
+   * A classification of SSA variable references into reads and definitions.
+   */
+  class SsaRefKind extends TSsaRefKind {
+    string toString() {
+      this = SsaRead() and
+      result = "SsaRead"
+      or
+      this = SsaDef() and
+      result = "SsaDef"
+    }
+
+    int getOrder() {
+      this = SsaRead() and
+      result = 0
+      or
+      this = SsaDef() and
+      result = 1
+    }
+  }
+
+  /**
+   * Holds if the `i`th node of basic block `bb` is a reference to `v`,
+   * either a read (when `k` is `SsaRead()`) or an SSA definition (when `k`
+   * is `SsaDef()`).
+   *
+   * Unlike `Liveness::ref`, this includes `phi` nodes.
+   */
+  predicate ssaRef(BasicBlock bb, int i, SourceVariable v, SsaRefKind k) {
+    variableRead(bb, i, v, _) and
+    k = SsaRead()
+    or
+    exists(Definition def | def.definesAt(v, bb, i)) and
+    k = SsaDef()
+  }
+
+  private newtype OrderedSsaRefIndex =
+    MkOrderedSsaRefIndex(int i, SsaRefKind k) { ssaRef(_, i, _, k) }
+
+  private OrderedSsaRefIndex ssaRefOrd(BasicBlock bb, int i, SourceVariable v, SsaRefKind k, int ord) {
+    ssaRef(bb, i, v, k) and
+    result = MkOrderedSsaRefIndex(i, k) and
+    ord = k.getOrder()
+  }
+
+  /**
+   * Gets the (1-based) rank of the reference to `v` at the `i`th node of basic
+   * block `bb`, which has the given reference kind `k`.
+   *
+   * For example, if `bb` is a basic block with a phi node for `v` (considered
+   * to be at index -1), reads `v` at node 2, and defines it at node 5, we have:
+   *
+   * ```ql
+   * ssaRefRank(bb, -1, v, SsaDef()) = 1    // phi node
+   * ssaRefRank(bb,  2, v, Read())   = 2    // read at node 2
+   * ssaRefRank(bb,  5, v, SsaDef()) = 3    // definition at node 5
+   * ```
+   *
+   * Reads are considered before writes when they happen at the same index.
+   */
+  int ssaRefRank(BasicBlock bb, int i, SourceVariable v, SsaRefKind k) {
+    ssaRefOrd(bb, i, v, k, _) =
+      rank[result](int j, int ord, OrderedSsaRefIndex res |
+        res = ssaRefOrd(bb, j, v, _, ord)
+      |
+        res order by j, ord
+      )
+  }
+
+  int maxSsaRefRank(BasicBlock bb, SourceVariable v) {
+    result = ssaRefRank(bb, _, v, _) and
+    not result + 1 = ssaRefRank(bb, _, v, _)
+  }
+
+  /**
+   * Holds if the SSA definition `def` reaches rank index `rnk` in its own
+   * basic block `bb`.
+   */
+  predicate ssaDefReachesRank(BasicBlock bb, Definition def, int rnk, SourceVariable v) {
+    exists(int i |
+      rnk = ssaRefRank(bb, i, v, SsaDef()) and
+      def.definesAt(v, bb, i)
+    )
+    or
+    ssaDefReachesRank(bb, def, rnk - 1, v) and
+    rnk = ssaRefRank(bb, _, v, SsaRead())
+  }
+
+  /**
+   * Holds if the SSA definition of `v` at `def` reaches index `i` in the same
+   * basic block `bb`, without crossing another SSA definition of `v`.
+   */
+  predicate ssaDefReachesReadWithinBlock(SourceVariable v, Definition def, BasicBlock bb, int i) {
+    exists(int rnk |
+      ssaDefReachesRank(bb, def, rnk, v) and
+      rnk = ssaRefRank(bb, i, v, SsaRead()) and
+      variableRead(bb, i, v, _)
+    )
+  }
+
+  /**
+   * Holds if the SSA definition of `v` at `def` reaches uncertain SSA definition
+   * `redef` in the same basic block, without crossing another SSA definition of `v`.
+   */
+  predicate ssaDefReachesUncertainDefWithinBlock(
+    SourceVariable v, Definition def, UncertainWriteDefinition redef
+  ) {
+    exists(BasicBlock bb, int rnk, int i |
+      ssaDefReachesRank(bb, def, rnk, v) and
+      rnk = ssaRefRank(bb, i, v, SsaDef()) - 1 and
+      redef.definesAt(v, bb, i)
+    )
+  }
+
+  /**
+   * Same as `ssaRefRank()`, but restricted to a particular SSA definition `def`.
+   */
+  int ssaDefRank(Definition def, SourceVariable v, BasicBlock bb, int i, SsaRefKind k) {
+    v = def.getSourceVariable() and
+    result = ssaRefRank(bb, i, v, k) and
+    (
+      ssaDefReachesRead(_, def, bb, i)
+      or
+      def.definesAt(_, bb, i)
+    )
+  }
+
+  predicate defOccursInBlock(Definition def, BasicBlock bb, SourceVariable v) {
+    exists(ssaDefRank(def, v, bb, _, _))
+  }
+
+  pragma[noinline]
+  private predicate ssaDefReachesThroughBlock(Definition def, BasicBlock bb) {
+    ssaDefReachesEndOfBlock(bb, def, _) and
+    not defOccursInBlock(_, bb, def.getSourceVariable())
+  }
+
+  /**
+   * Holds if `def` is accessed in basic block `bb1` (either a read or a write),
+   * `bb2` is a transitive successor of `bb1`, `def` is live at the end of `bb1`,
+   * and the underlying variable for `def` is neither read nor written in any block
+   * on the path between `bb1` and `bb2`.
+   */
+  predicate varBlockReaches(Definition def, BasicBlock bb1, BasicBlock bb2) {
+    defOccursInBlock(def, bb1, _) and
+    bb2 = getABasicBlockSuccessor(bb1)
+    or
+    exists(BasicBlock mid |
+      varBlockReaches(def, bb1, mid) and
+      ssaDefReachesThroughBlock(def, mid) and
+      bb2 = getABasicBlockSuccessor(mid)
+    )
+  }
+
+  /**
+   * Holds if `def` is accessed in basic block `bb1` (either a read or a write),
+   * `def` is read at index `i2` in basic block `bb2`, `bb2` is in a transitive
+   * successor block of `bb1`, and `def` is neither read nor written in any block
+   * on a path between `bb1` and `bb2`.
+   */
+  predicate defAdjacentRead(Definition def, BasicBlock bb1, BasicBlock bb2, int i2) {
+    varBlockReaches(def, bb1, bb2) and
+    ssaRefRank(bb2, i2, def.getSourceVariable(), SsaRead()) = 1 and
+    variableRead(bb2, i2, _, _)
+  }
+}
+
+private import SsaDefReaches
+
+pragma[nomagic]
+predicate liveThrough(BasicBlock bb, SourceVariable v) {
+  liveAtExit(bb, v) and
+  not ssaRef(bb, _, v, SsaDef())
+}
+
+/**
+ * NB: If this predicate is exposed, it should be cached.
+ *
+ * Holds if the SSA definition of `v` at `def` reaches the end of basic
+ * block `bb`, at which point it is still live, without crossing another
+ * SSA definition of `v`.
+ */
+pragma[nomagic]
+predicate ssaDefReachesEndOfBlock(BasicBlock bb, Definition def, SourceVariable v) {
+  exists(int last | last = maxSsaRefRank(bb, v) |
+    ssaDefReachesRank(bb, def, last, v) and
+    liveAtExit(bb, v)
+  )
+  or
+  // The construction of SSA form ensures that each read of a variable is
+  // dominated by its definition. An SSA definition therefore reaches a
+  // control flow node if it is the _closest_ SSA definition that dominates
+  // the node. If two definitions dominate a node then one must dominate the
+  // other, so therefore the definition of _closest_ is given by the dominator
+  // tree. Thus, reaching definitions can be calculated in terms of dominance.
+  ssaDefReachesEndOfBlock(getImmediateBasicBlockDominator(bb), def, pragma[only_bind_into](v)) and
+  liveThrough(bb, pragma[only_bind_into](v))
+}
+
+/**
+ * NB: If this predicate is exposed, it should be cached.
+ *
+ * Holds if `inp` is an input to the phi node `phi` along the edge originating in `bb`.
+ */
+pragma[nomagic]
+predicate phiHasInputFromBlock(PhiNode phi, Definition inp, BasicBlock bb) {
+  exists(SourceVariable v, BasicBlock bbDef |
+    phi.definesAt(v, bbDef, _) and
+    getABasicBlockPredecessor(bbDef) = bb and
+    ssaDefReachesEndOfBlock(bb, inp, v)
+  )
+}
+
+/**
+ * NB: If this predicate is exposed, it should be cached.
+ *
+ * Holds if the SSA definition of `v` at `def` reaches a read at index `i` in
+ * basic block `bb`, without crossing another SSA definition of `v`. The read
+ * is of kind `rk`.
+ */
+pragma[nomagic]
+predicate ssaDefReachesRead(SourceVariable v, Definition def, BasicBlock bb, int i) {
+  ssaDefReachesReadWithinBlock(v, def, bb, i)
+  or
+  variableRead(bb, i, v, _) and
+  ssaDefReachesEndOfBlock(getABasicBlockPredecessor(bb), def, v) and
+  not ssaDefReachesReadWithinBlock(v, _, bb, i)
+}
+
+/**
+ * NB: If this predicate is exposed, it should be cached.
+ *
+ * Holds if `def` is accessed at index `i1` in basic block `bb1` (either a read
+ * or a write), `def` is read at index `i2` in basic block `bb2`, and there is a
+ * path between them without any read of `def`.
+ */
+pragma[nomagic]
+predicate adjacentDefRead(Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2) {
+  exists(int rnk |
+    rnk = ssaDefRank(def, _, bb1, i1, _) and
+    rnk + 1 = ssaDefRank(def, _, bb1, i2, SsaRead()) and
+    variableRead(bb1, i2, _, _) and
+    bb2 = bb1
+  )
+  or
+  exists(SourceVariable v | ssaDefRank(def, v, bb1, i1, _) = maxSsaRefRank(bb1, v)) and
+  defAdjacentRead(def, bb1, bb2, i2)
+}
+
+private predicate adjacentDefReachesRead(
+  Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2
+) {
+  adjacentDefRead(def, bb1, i1, bb2, i2) and
+  exists(SourceVariable v | v = def.getSourceVariable() |
+    ssaRef(bb1, i1, v, SsaDef())
+    or
+    variableRead(bb1, i1, v, true)
+  )
+  or
+  exists(BasicBlock bb3, int i3 |
+    adjacentDefReachesRead(def, bb1, i1, bb3, i3) and
+    variableRead(bb3, i3, _, false) and
+    adjacentDefRead(def, bb3, i3, bb2, i2)
+  )
+}
+
+/**
+ * NB: If this predicate is exposed, it should be cached.
+ *
+ * Same as `adjacentDefRead`, but ignores uncertain reads.
+ */
+pragma[nomagic]
+predicate adjacentDefNoUncertainReads(Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2) {
+  adjacentDefReachesRead(def, bb1, i1, bb2, i2) and
+  variableRead(bb2, i2, _, true)
+}
+
+/**
+ * NB: If this predicate is exposed, it should be cached.
+ *
+ * Holds if the node at index `i` in `bb` is a last reference to SSA definition
+ * `def`. The reference is last because it can reach another write `next`,
+ * without passing through another read or write.
+ */
+pragma[nomagic]
+predicate lastRefRedef(Definition def, BasicBlock bb, int i, Definition next) {
+  exists(int rnk, SourceVariable v, int j | rnk = ssaDefRank(def, v, bb, i, _) |
+    // Next reference to `v` inside `bb` is a write
+    next.definesAt(v, bb, j) and
+    rnk + 1 = ssaRefRank(bb, j, v, SsaDef())
+    or
+    // Can reach a write using one or more steps
+    rnk = maxSsaRefRank(bb, v) and
+    exists(BasicBlock bb2 |
+      varBlockReaches(def, bb, bb2) and
+      next.definesAt(v, bb2, j) and
+      1 = ssaRefRank(bb2, j, v, SsaDef())
+    )
+  )
+}
+
+/**
+ * NB: If this predicate is exposed, it should be cached.
+ *
+ * Holds if `inp` is an immediately preceding definition of uncertain definition
+ * `def`. Since `def` is uncertain, the value from the preceding definition might
+ * still be valid.
+ */
+pragma[nomagic]
+predicate uncertainWriteDefinitionInput(UncertainWriteDefinition def, Definition inp) {
+  lastRefRedef(inp, _, _, def)
+}
+
+private predicate adjacentDefReachesUncertainRead(
+  Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2
+) {
+  adjacentDefReachesRead(def, bb1, i1, bb2, i2) and
+  variableRead(bb2, i2, _, false)
+}
+
+/**
+ * NB: If this predicate is exposed, it should be cached.
+ *
+ * Same as `lastRefRedef`, but ignores uncertain reads.
+ */
+pragma[nomagic]
+predicate lastRefRedefNoUncertainReads(Definition def, BasicBlock bb, int i, Definition next) {
+  lastRefRedef(def, bb, i, next) and
+  not variableRead(bb, i, def.getSourceVariable(), false)
+  or
+  exists(BasicBlock bb0, int i0 |
+    lastRefRedef(def, bb0, i0, next) and
+    adjacentDefReachesUncertainRead(def, bb, i, bb0, i0)
+  )
+}
+
+/**
+ * NB: If this predicate is exposed, it should be cached.
+ *
+ * Holds if the node at index `i` in `bb` is a last reference to SSA
+ * definition `def`.
+ *
+ * That is, the node can reach the end of the enclosing callable, or another
+ * SSA definition for the underlying source variable, without passing through
+ * another read.
+ */
+pragma[nomagic]
+predicate lastRef(Definition def, BasicBlock bb, int i) {
+  lastRefRedef(def, bb, i, _)
+  or
+  exists(SourceVariable v | ssaDefRank(def, v, bb, i, _) = maxSsaRefRank(bb, v) |
+    // Can reach exit directly
+    bb instanceof ExitBasicBlock
+    or
+    // Can reach a block using one or more steps, where `def` is no longer live
+    exists(BasicBlock bb2 | varBlockReaches(def, bb, bb2) |
+      not defOccursInBlock(def, bb2, _) and
+      not ssaDefReachesEndOfBlock(bb2, def, _)
+    )
+  )
+}
+
+/**
+ * NB: If this predicate is exposed, it should be cached.
+ *
+ * Same as `lastRefRedef`, but ignores uncertain reads.
+ */
+pragma[nomagic]
+predicate lastRefNoUncertainReads(Definition def, BasicBlock bb, int i) {
+  lastRef(def, bb, i) and
+  not variableRead(bb, i, def.getSourceVariable(), false)
+  or
+  exists(BasicBlock bb0, int i0 |
+    lastRef(def, bb0, i0) and
+    adjacentDefReachesUncertainRead(def, bb, i, bb0, i0)
+  )
+}
+
+/** A static single assignment (SSA) definition. */
+class Definition extends TDefinition {
+  /** Gets the source variable underlying this SSA definition. */
+  SourceVariable getSourceVariable() { this.definesAt(result, _, _) }
+
+  /**
+   * Holds if this SSA definition defines `v` at index `i` in basic block `bb`.
+   * Phi nodes are considered to be at index `-1`, while normal variable writes
+   * are at the index of the control flow node they wrap.
+   */
+  final predicate definesAt(SourceVariable v, BasicBlock bb, int i) {
+    this = TWriteDef(v, bb, i)
+    or
+    this = TPhiNode(v, bb) and i = -1
+  }
+
+  /** Gets the basic block to which this SSA definition belongs. */
+  final BasicBlock getBasicBlock() { this.definesAt(_, result, _) }
+
+  /** Gets a textual representation of this SSA definition. */
+  string toString() { none() }
+}
+
+/** An SSA definition that corresponds to a write. */
+class WriteDefinition extends Definition, TWriteDef {
+  private SourceVariable v;
+  private BasicBlock bb;
+  private int i;
+
+  WriteDefinition() { this = TWriteDef(v, bb, i) }
+
+  override string toString() { result = "WriteDef" }
+}
+
+/** A phi node. */
+class PhiNode extends Definition, TPhiNode {
+  override string toString() { result = "Phi" }
+}
+
+/**
+ * An SSA definition that represents an uncertain update of the underlying
+ * source variable.
+ */
+class UncertainWriteDefinition extends WriteDefinition {
+  UncertainWriteDefinition() {
+    exists(SourceVariable v, BasicBlock bb, int i |
+      this.definesAt(v, bb, i) and
+      variableWrite(bb, i, v, false)
+    )
+  }
+}
diff --git a/csharp/ql/src/semmle/code/cil/internal/SsaImplSpecific.qll b/csharp/ql/src/semmle/code/cil/internal/SsaImplSpecific.qll
new file mode 100644
index 00000000000..94b4812d996
--- /dev/null
+++ b/csharp/ql/src/semmle/code/cil/internal/SsaImplSpecific.qll
@@ -0,0 +1,30 @@
+/** Provides the CIL specific parameters for `SsaImplCommon.qll`. */
+
+private import cil
+private import SsaImpl
+
+class BasicBlock = CIL::BasicBlock;
+
+BasicBlock getImmediateBasicBlockDominator(BasicBlock bb) { result = bb.getImmediateDominator() }
+
+BasicBlock getABasicBlockSuccessor(BasicBlock bb) { result = bb.getASuccessor() }
+
+class ExitBasicBlock = CIL::ExitBasicBlock;
+
+class SourceVariable = CIL::StackVariable;
+
+predicate variableWrite(BasicBlock bb, int i, SourceVariable v, boolean certain) {
+  forceCachingInSameStage() and
+  exists(CIL::VariableUpdate vu |
+    vu.updatesAt(bb, i) and
+    v = vu.getVariable() and
+    certain = true
+  )
+}
+
+predicate variableRead(BasicBlock bb, int i, SourceVariable v, boolean certain) {
+  exists(CIL::ReadAccess ra | bb.getNode(i) = ra |
+    ra.getTarget() = v and
+    certain = true
+  )
+}
diff --git a/csharp/ql/src/semmle/code/csharp/Callable.qll b/csharp/ql/src/semmle/code/csharp/Callable.qll
index 6dc7cfced9b..111702bac48 100644
--- a/csharp/ql/src/semmle/code/csharp/Callable.qll
+++ b/csharp/ql/src/semmle/code/csharp/Callable.qll
@@ -206,7 +206,11 @@ class Callable extends DotNet::Callable, Parameterizable, ExprOrStmtParent, @cal
     exists(ReturnStmt ret | ret.getEnclosingCallable() = this | e = ret.getExpr())
     or
     e = this.getExpressionBody() and
-    not this.getReturnType() instanceof VoidType
+    not this.getReturnType() instanceof VoidType and
+    (
+      not this.(Modifiable).isAsync() or
+      this.getReturnType() instanceof Generic
+    )
   }
 
   /** Holds if this callable can yield return the expression `e`. */
diff --git a/csharp/ql/src/semmle/code/csharp/Element.qll b/csharp/ql/src/semmle/code/csharp/Element.qll
index 521138db1b5..fbd96f6086d 100644
--- a/csharp/ql/src/semmle/code/csharp/Element.qll
+++ b/csharp/ql/src/semmle/code/csharp/Element.qll
@@ -27,9 +27,6 @@ class Element extends DotNet::Element, @element {
   /** Gets a location of this element, including sources and assemblies. */
   override Location getALocation() { none() }
 
-  /** Holds if this element is from an assembly. */
-  predicate fromLibrary() { this.getFile().fromLibrary() }
-
   /** Gets the parent of this element, if any. */
   Element getParent() { result.getAChild() = this }
 
diff --git a/csharp/ql/src/semmle/code/csharp/Enclosing.qll b/csharp/ql/src/semmle/code/csharp/Enclosing.qll
deleted file mode 100644
index ab106421196..00000000000
--- a/csharp/ql/src/semmle/code/csharp/Enclosing.qll
+++ /dev/null
@@ -1,83 +0,0 @@
-/**
- * INTERNAL: Do not use.
- *
- * Provides efficient cached predicates for finding enclosing statements and callables.
- *
- * There are a number of difficulties. There can be expressions without
- * enclosing statements (for example initialisers for fields and constructors)
- * or enclosing callables (even if we consider constructor initialisers
- * to be enclosed by constructors, field initialisers don't have callables).
- *
- * The only cases where a `Stmt` has an `Expr` parent are delegate and lambda
- * expressions, which are both callable.
- */
-
-import Stmt
-private import semmle.code.csharp.ExprOrStmtParent
-
-/**
- * INTERNAL: Do not use.
- */
-cached
-module Internal {
-  /**
-   * INTERNAL: Do not use.
-   *
-   * Holds if `c` is the enclosing callable of statement `s`.
-   */
-  cached
-  predicate enclosingCallable(Stmt s, Callable c) {
-    // Compute the enclosing callable for a statement. This walks up through
-    // enclosing statements until it hits a callable. It's unambiguous, since
-    // if a statement has no parent statement, it's either the method body
-    // or the body of an anonymous function declaration, in each of which cases the
-    // non-statement parent is in fact the enclosing callable.
-    c.getAChildStmt+() = s
-  }
-
-  private Expr getAChildExpr(ExprOrStmtParent p) {
-    result = p.getAChildExpr() or
-    result = p.(AssignOperation).getExpandedAssignment()
-  }
-
-  /**
-   * INTERNAL: Do not use.
-   *
-   * Holds if `s` is the enclosing statement of expression `e`.
-   */
-  cached
-  predicate enclosingStmt(Expr e, Stmt s) {
-    // Compute the enclosing statement for an expression. Note that this need
-    // not exist, since expressions can occur in contexts where they have no
-    // enclosing statement (examples include field initialisers, both inline
-    // and explicit on constructor definitions, and annotation arguments).
-    getAChildExpr+(s) = e
-  }
-
-  private predicate childExprOfCallable(Callable parent, Expr child) {
-    child = getAChildExpr(parent)
-    or
-    exists(Expr mid | childExprOfCallable(parent, mid) |
-      not mid instanceof Callable and
-      child = getAChildExpr(mid)
-    )
-  }
-
-  /**
-   * INTERNAL: Do not use.
-   *
-   * Holds if `c` is the enclosing callable of expression `e`.
-   */
-  cached
-  predicate exprEnclosingCallable(Expr e, Callable c) {
-    // Compute the enclosing callable of an expression. Note that expressions in
-    // lambda functions should have the lambdas as enclosing callables, and their
-    // enclosing statement may be the same as the enclosing statement of the
-    // lambda; thus, it is *not* safe to go up to the enclosing statement and
-    // take its own enclosing callable.
-    childExprOfCallable(c, e)
-    or
-    not childExprOfCallable(_, e) and
-    exists(Stmt s | enclosingStmt(e, s) | enclosingCallable(s, c))
-  }
-}
diff --git a/csharp/ql/src/semmle/code/csharp/ExprOrStmtParent.qll b/csharp/ql/src/semmle/code/csharp/ExprOrStmtParent.qll
index c7c7bfe00e8..b6501477117 100644
--- a/csharp/ql/src/semmle/code/csharp/ExprOrStmtParent.qll
+++ b/csharp/ql/src/semmle/code/csharp/ExprOrStmtParent.qll
@@ -138,6 +138,54 @@ private module Cached {
         )
     else expr_parent(child, i, parent)
   }
+
+  private Expr getAChildExpr(ExprOrStmtParent parent) {
+    result = parent.getAChildExpr() or
+    result = parent.(AssignOperation).getExpandedAssignment()
+  }
+
+  private ControlFlowElement getAChild(ExprOrStmtParent parent) {
+    result = getAChildExpr(parent)
+    or
+    result = parent.getAChildStmt()
+  }
+
+  pragma[inline]
+  private ControlFlowElement enclosingStart(ControlFlowElement cfe) {
+    result = cfe
+    or
+    getAChild(result).(AnonymousFunctionExpr) = cfe
+  }
+
+  private predicate parent(ControlFlowElement child, ExprOrStmtParent parent) {
+    child = getAChild(parent) and
+    not child instanceof Callable
+  }
+
+  /** Holds if the enclosing body of `cfe` is `body`. */
+  cached
+  predicate enclosingBody(ControlFlowElement cfe, ControlFlowElement body) {
+    body = any(Callable c).getBody() and
+    parent*(enclosingStart(cfe), body)
+  }
+
+  /** Holds if the enclosing callable of `cfe` is `c`. */
+  cached
+  predicate enclosingCallable(ControlFlowElement cfe, Callable c) {
+    enclosingBody(cfe, c.getBody())
+    or
+    parent*(enclosingStart(cfe), c.(Constructor).getInitializer())
+  }
+
+  /** Holds if the enclosing statement of expression `e` is `s`. */
+  cached
+  predicate enclosingStmt(Expr e, Stmt s) {
+    // Compute the enclosing statement for an expression. Note that this need
+    // not exist, since expressions can occur in contexts where they have no
+    // enclosing statement (examples include field initialisers, both inline
+    // and explicit on constructor definitions, and annotation arguments).
+    getAChildExpr+(s) = e
+  }
 }
 
 import Cached
diff --git a/csharp/ql/src/semmle/code/csharp/Stmt.qll b/csharp/ql/src/semmle/code/csharp/Stmt.qll
index 375e698d1cb..2ccd57078db 100644
--- a/csharp/ql/src/semmle/code/csharp/Stmt.qll
+++ b/csharp/ql/src/semmle/code/csharp/Stmt.qll
@@ -8,7 +8,7 @@ import Element
 import Location
 import Member
 import exprs.Expr
-private import semmle.code.csharp.Enclosing::Internal
+private import semmle.code.csharp.ExprOrStmtParent
 private import semmle.code.csharp.frameworks.System
 private import TypeRef
 
diff --git a/csharp/ql/src/semmle/code/csharp/commons/Disposal.qll b/csharp/ql/src/semmle/code/csharp/commons/Disposal.qll
index 28c79d749ff..090599a60a7 100644
--- a/csharp/ql/src/semmle/code/csharp/commons/Disposal.qll
+++ b/csharp/ql/src/semmle/code/csharp/commons/Disposal.qll
@@ -11,14 +11,22 @@ private predicate isDisposeMethod(DotNet::Callable method) {
   method.getNumberOfParameters() = 0
 }
 
+private predicate cilVariableReadFlowsTo(CIL::Variable variable, CIL::DataFlowNode n) {
+  n = variable.getARead()
+  or
+  exists(CIL::DataFlowNode mid |
+    cilVariableReadFlowsTo(variable, mid) and
+    mid.getALocalFlowSucc(n, any(CIL::Untainted u))
+  )
+}
+
 private predicate disposedCilVariable(CIL::Variable variable) {
   // `variable` is the `this` parameter on a dispose method.
   isDisposeMethod(variable.(CIL::ThisParameter).getMethod())
   or
   // `variable` is passed to a method that disposes it.
-  exists(CIL::Call call, CIL::Parameter param, CIL::ReadAccess read |
-    read.getTarget() = variable and
-    read.flowsTo(call.getArgumentForParameter(param)) and
+  exists(CIL::Call call, CIL::Parameter param |
+    cilVariableReadFlowsTo(variable, call.getArgumentForParameter(param)) and
     disposedCilVariable(param)
   )
   or
@@ -27,9 +35,8 @@ private predicate disposedCilVariable(CIL::Variable variable) {
   or
   // A variable is disposed if it's assigned to another variable
   // that may be disposed.
-  exists(CIL::ReadAccess read, CIL::WriteAccess write |
-    read.flowsTo(write.getExpr()) and
-    read.getTarget() = variable and
+  exists(CIL::WriteAccess write |
+    cilVariableReadFlowsTo(variable, write.getExpr()) and
     disposedCilVariable(write.getTarget())
   )
 }
diff --git a/csharp/ql/src/semmle/code/csharp/controlflow/internal/pressa/SsaImplCommon.qll b/csharp/ql/src/semmle/code/csharp/controlflow/internal/pressa/SsaImplCommon.qll
index be01c05b8fa..f828419a440 100644
--- a/csharp/ql/src/semmle/code/csharp/controlflow/internal/pressa/SsaImplCommon.qll
+++ b/csharp/ql/src/semmle/code/csharp/controlflow/internal/pressa/SsaImplCommon.qll
@@ -1,5 +1,5 @@
 /**
- * Provides a language-independant implementation of static single assignment
+ * Provides a language-independent implementation of static single assignment
  * (SSA) form.
  */
 
@@ -321,10 +321,9 @@ private module SsaDefReaches {
   }
 
   pragma[noinline]
-  private BasicBlock getAMaybeLiveSuccessor(Definition def, BasicBlock bb) {
-    result = getABasicBlockSuccessor(bb) and
-    not defOccursInBlock(_, bb, def.getSourceVariable()) and
-    ssaDefReachesEndOfBlock(bb, def, _)
+  private predicate ssaDefReachesThroughBlock(Definition def, BasicBlock bb) {
+    ssaDefReachesEndOfBlock(bb, def, _) and
+    not defOccursInBlock(_, bb, def.getSourceVariable())
   }
 
   /**
@@ -337,7 +336,11 @@ private module SsaDefReaches {
     defOccursInBlock(def, bb1, _) and
     bb2 = getABasicBlockSuccessor(bb1)
     or
-    exists(BasicBlock mid | varBlockReaches(def, bb1, mid) | bb2 = getAMaybeLiveSuccessor(def, mid))
+    exists(BasicBlock mid |
+      varBlockReaches(def, bb1, mid) and
+      ssaDefReachesThroughBlock(def, mid) and
+      bb2 = getABasicBlockSuccessor(mid)
+    )
   }
 
   /**
@@ -355,17 +358,10 @@ private module SsaDefReaches {
 
 private import SsaDefReaches
 
-pragma[noinline]
-private predicate ssaDefReachesEndOfBlockRec(BasicBlock bb, Definition def, SourceVariable v) {
-  exists(BasicBlock idom | ssaDefReachesEndOfBlock(idom, def, v) |
-    // The construction of SSA form ensures that each read of a variable is
-    // dominated by its definition. An SSA definition therefore reaches a
-    // control flow node if it is the _closest_ SSA definition that dominates
-    // the node. If two definitions dominate a node then one must dominate the
-    // other, so therefore the definition of _closest_ is given by the dominator
-    // tree. Thus, reaching definitions can be calculated in terms of dominance.
-    idom = getImmediateBasicBlockDominator(bb)
-  )
+pragma[nomagic]
+predicate liveThrough(BasicBlock bb, SourceVariable v) {
+  liveAtExit(bb, v) and
+  not ssaRef(bb, _, v, SsaDef())
 }
 
 /**
@@ -382,9 +378,14 @@ predicate ssaDefReachesEndOfBlock(BasicBlock bb, Definition def, SourceVariable
     liveAtExit(bb, v)
   )
   or
-  ssaDefReachesEndOfBlockRec(bb, def, v) and
-  liveAtExit(bb, v) and
-  not ssaRef(bb, _, v, SsaDef())
+  // The construction of SSA form ensures that each read of a variable is
+  // dominated by its definition. An SSA definition therefore reaches a
+  // control flow node if it is the _closest_ SSA definition that dominates
+  // the node. If two definitions dominate a node then one must dominate the
+  // other, so therefore the definition of _closest_ is given by the dominator
+  // tree. Thus, reaching definitions can be calculated in terms of dominance.
+  ssaDefReachesEndOfBlock(getImmediateBasicBlockDominator(bb), def, pragma[only_bind_into](v)) and
+  liveThrough(bb, pragma[only_bind_into](v))
 }
 
 /**
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/CallContext.qll b/csharp/ql/src/semmle/code/csharp/dataflow/CallContext.qll
index 8be2fc0939f..47ff7f96111 100755
--- a/csharp/ql/src/semmle/code/csharp/dataflow/CallContext.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/CallContext.qll
@@ -1,4 +1,6 @@
 /**
+ * DEPRECATED.
+ *
  * Provides classes for data flow call contexts.
  */
 
@@ -15,11 +17,13 @@ private newtype TCallContext =
   TArgFunctionPointerCallContext(FunctionPointerCall fptrc, int i) { exists(fptrc.getArgument(i)) }
 
 /**
+ * DEPRECATED.
+ *
  * A call context.
  *
  * A call context records the origin of data flow into callables.
  */
-class CallContext extends TCallContext {
+deprecated class CallContext extends TCallContext {
   /** Gets a textual representation of this call context. */
   string toString() { none() }
 
@@ -27,18 +31,20 @@ class CallContext extends TCallContext {
   Location getLocation() { none() }
 }
 
-/** An empty call context. */
-class EmptyCallContext extends CallContext, TEmptyCallContext {
+/** DEPRECATED. An empty call context. */
+deprecated class EmptyCallContext extends CallContext, TEmptyCallContext {
   override string toString() { result = "<empty>" }
 
   override EmptyLocation getLocation() { any() }
 }
 
 /**
+ * DEPRECATED.
+ *
  * An argument call context, that is a call argument through which data flows
  * into a callable.
  */
-abstract class ArgumentCallContext extends CallContext {
+abstract deprecated class ArgumentCallContext extends CallContext {
   /**
    * Holds if this call context represents the argument at position `i` of the
    * call expression `call`.
@@ -46,8 +52,9 @@ abstract class ArgumentCallContext extends CallContext {
   abstract predicate isArgument(Expr call, int i);
 }
 
-/** An argument of a non-delegate call. */
-class NonDelegateCallArgumentCallContext extends ArgumentCallContext, TArgNonDelegateCallContext {
+/** DEPRECATED. An argument of a non-delegate call. */
+deprecated class NonDelegateCallArgumentCallContext extends ArgumentCallContext,
+  TArgNonDelegateCallContext {
   Expr arg;
 
   NonDelegateCallArgumentCallContext() { this = TArgNonDelegateCallContext(arg) }
@@ -61,8 +68,8 @@ class NonDelegateCallArgumentCallContext extends ArgumentCallContext, TArgNonDel
   override Location getLocation() { result = arg.getLocation() }
 }
 
-/** An argument of a delegate or function pointer call. */
-class DelegateLikeCallArgumentCallContext extends ArgumentCallContext {
+/** DEPRECATED. An argument of a delegate or function pointer call. */
+deprecated class DelegateLikeCallArgumentCallContext extends ArgumentCallContext {
   DelegateLikeCall dc;
   int arg;
 
@@ -80,10 +87,10 @@ class DelegateLikeCallArgumentCallContext extends ArgumentCallContext {
   override Location getLocation() { result = dc.getArgument(arg).getLocation() }
 }
 
-/** An argument of a delegate call. */
-class DelegateCallArgumentCallContext extends DelegateLikeCallArgumentCallContext,
+/** DEPRECATED. An argument of a delegate call. */
+deprecated class DelegateCallArgumentCallContext extends DelegateLikeCallArgumentCallContext,
   TArgDelegateCallContext { }
 
-/** An argument of a function pointer call. */
-class FunctionPointerCallArgumentCallContext extends DelegateLikeCallArgumentCallContext,
+/** DEPRECATED. An argument of a function pointer call. */
+deprecated class FunctionPointerCallArgumentCallContext extends DelegateLikeCallArgumentCallContext,
   TArgFunctionPointerCallContext { }
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/FlowSummary.qll b/csharp/ql/src/semmle/code/csharp/dataflow/FlowSummary.qll
index 587a6dc0cd0..374c42ed7e9 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/FlowSummary.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/FlowSummary.qll
@@ -1,181 +1,109 @@
-/**
- * Provides classes and predicates for definining flow summaries.
- */
+/** Provides classes and predicates for defining flow summaries. */
 
 import csharp
 private import internal.FlowSummaryImpl as Impl
-private import internal.FlowSummarySpecific::Private
-private import internal.DataFlowPublic as DataFlowPublic
+private import internal.DataFlowDispatch
+
 // import all instances below
-private import semmle.code.csharp.dataflow.LibraryTypeDataFlow
-private import semmle.code.csharp.frameworks.EntityFramework
+private module Summaries {
+  private import semmle.code.csharp.dataflow.LibraryTypeDataFlow
+  private import semmle.code.csharp.frameworks.EntityFramework
+}
 
-class SummarizableCallable = Impl::Public::SummarizableCallable;
+class SummaryComponent = Impl::Public::SummaryComponent;
 
-/** An unbound method. */
-class SummarizableMethod extends SummarizableCallable, Method { }
+/** Provides predicates for constructing summary components. */
+module SummaryComponent {
+  import Impl::Public::SummaryComponent
 
-class ContentList = Impl::Public::ContentList;
+  /** Gets a summary component that represents a qualifier. */
+  SummaryComponent qualifier() { result = argument(-1) }
 
-/** Provides predicates for constructing content lists. */
-module ContentList {
-  import Impl::Public::ContentList
+  /** Gets a summary component that represents an element in a collection. */
+  SummaryComponent element() { result = content(any(DataFlow::ElementContent c)) }
 
-  /** Gets the singleton "element content" content list. */
-  ContentList element() { result = singleton(any(DataFlowPublic::ElementContent c)) }
-
-  /** Gets a singleton property content list. */
-  ContentList property(Property p) {
-    result =
-      singleton(any(DataFlowPublic::PropertyContent c | c.getProperty() = p.getUnboundDeclaration()))
+  /** Gets a summary component for property `p`. */
+  SummaryComponent property(Property p) {
+    result = content(any(DataFlow::PropertyContent c | c.getProperty() = p.getUnboundDeclaration()))
   }
 
-  /** Gets a singleton field content list. */
-  ContentList field(Field f) {
+  /** Gets a summary component for field `f`. */
+  SummaryComponent field(Field f) {
+    result = content(any(DataFlow::FieldContent c | c.getField() = f.getUnboundDeclaration()))
+  }
+
+  /** Gets a summary component that represents the return value of a call. */
+  SummaryComponent return() { result = return(any(NormalReturnKind rk)) }
+
+  /**
+   * Gets a summary component that represents the return value through the `i`th
+   * `out` argument of a call.
+   */
+  SummaryComponent outArgument(int i) {
+    result = return(any(OutReturnKind rk | rk.getPosition() = i))
+  }
+
+  /**
+   * Gets a summary component that represents the return value through the `i`th
+   * `ref` argument of a call.
+   */
+  SummaryComponent refArgument(int i) {
+    result = return(any(RefReturnKind rk | rk.getPosition() = i))
+  }
+
+  /** Gets a summary component that represents a jump to `c`. */
+  SummaryComponent jump(Callable c) {
     result =
-      singleton(any(DataFlowPublic::FieldContent c | c.getField() = f.getUnboundDeclaration()))
+      return(any(JumpReturnKind jrk |
+          jrk.getTarget() = c.getUnboundDeclaration() and
+          jrk.getTargetReturnKind() instanceof NormalReturnKind
+        ))
   }
 }
 
-class SummaryInput = Impl::Public::SummaryInput;
+class SummaryComponentStack = Impl::Public::SummaryComponentStack;
 
-/** Provides predicates for constructing flow-summary input specifications */
-module SummaryInput {
-  private import semmle.code.csharp.frameworks.system.Collections
+/** Provides predicates for constructing stacks of summary components. */
+module SummaryComponentStack {
+  import Impl::Public::SummaryComponentStack
 
-  /**
-   * Gets an input specification that specifies the `i`th parameter as
-   * the input.
-   */
-  SummaryInput parameter(int i) { result = TParameterSummaryInput(i) }
+  /** Gets a singleton stack representing a qualifier. */
+  SummaryComponentStack qualifier() { result = singleton(SummaryComponent::qualifier()) }
 
-  private predicate isCollectionType(ValueOrRefType t) {
-    t.getABaseType*() instanceof SystemCollectionsIEnumerableInterface and
-    not t instanceof StringType
+  /** Gets a stack representing an element of `container`. */
+  SummaryComponentStack elementOf(SummaryComponentStack container) {
+    result = push(SummaryComponent::element(), container)
   }
 
-  /**
-   * Gets an input specification that specifies the `i`th parameter as
-   * the input.
-   *
-   * `inputContents` is either empty or a singleton element content list,
-   * depending on whether the type of the `i`th parameter of `c` is a
-   * collection type.
-   */
-  SummaryInput parameter(SummarizableCallable c, int i, ContentList inputContents) {
-    result = parameter(i) and
-    exists(Parameter p |
-      p = c.getParameter(i) and
-      if isCollectionType(p.getType())
-      then inputContents = ContentList::element()
-      else inputContents = ContentList::empty()
-    )
+  /** Gets a stack representing a propery `p` of `object`. */
+  SummaryComponentStack propertyOf(Property p, SummaryComponentStack object) {
+    result = push(SummaryComponent::property(p), object)
   }
 
-  /**
-   * Gets an input specification that specifies the implicit `this` parameter
-   * as the input.
-   */
-  SummaryInput thisParameter() { result = TParameterSummaryInput(-1) }
-
-  /**
-   * Gets an input specification that specifies output from the delegate at
-   * parameter `i` as the input.
-   */
-  SummaryInput delegate(int i) { result = TDelegateSummaryInput(i) }
-
-  /**
-   * Gets an input specification that specifies output from the delegate at
-   * parameter `i` as the input.
-   *
-   * `c` must be a compatible callable, that is, a callable where the `i`th
-   * parameter is a delegate.
-   */
-  SummaryInput delegate(SummarizableCallable c, int i) {
-    result = delegate(i) and
-    hasDelegateArgumentPosition(c, i)
-  }
-}
-
-class SummaryOutput = Impl::Public::SummaryOutput;
-
-/** Provides predicates for constructing flow-summary output specifications. */
-module SummaryOutput {
-  /**
-   * Gets an output specification that specifies the return value from a call as
-   * the output.
-   */
-  SummaryOutput return() { result = TReturnSummaryOutput() }
-
-  /**
-   * Gets an output specification that specifies the `i`th parameter as the
-   * output.
-   */
-  SummaryOutput parameter(int i) { result = TParameterSummaryOutput(i) }
-
-  /**
-   * Gets an output specification that specifies the implicit `this` parameter
-   * as the output.
-   */
-  SummaryOutput thisParameter() { result = TParameterSummaryOutput(-1) }
-
-  /**
-   * Gets an output specification that specifies parameter `j` of the delegate at
-   * parameter `i` as the output.
-   */
-  SummaryOutput delegate(int i, int j) { result = TDelegateSummaryOutput(i, j) }
-
-  /**
-   * Gets an output specification that specifies parameter `j` of the delegate at
-   * parameter `i` as the output.
-   *
-   * `c` must be a compatible callable, that is, a callable where the `i`th
-   * parameter is a delegate with a parameter at position `j`.
-   */
-  SummaryOutput delegate(SummarizableCallable c, int i, int j) {
-    result = TDelegateSummaryOutput(i, j) and
-    hasDelegateArgumentPosition2(c, i, j)
+  /** Gets a stack representing a field `f` of `object`. */
+  SummaryComponentStack fieldOf(Field f, SummaryComponentStack object) {
+    result = push(SummaryComponent::field(f), object)
   }
 
+  /** Gets a singleton stack representing the return value of a call. */
+  SummaryComponentStack return() { result = singleton(SummaryComponent::return()) }
+
   /**
-   * Gets an output specification that specifies the `output` of `target` as the
-   * output. That is, data will flow into one callable and out of another callable
-   * (`target`).
-   *
-   * `output` is limited to (this) parameters and ordinary returns.
+   * Gets a singleton stack representing the return value through the `i`th
+   * `out` argument of a call.
    */
-  SummaryOutput jump(SummarizableCallable target, SummaryOutput output) {
-    result = TJumpSummaryOutput(target, toReturnKind(output))
-  }
+  SummaryComponentStack outArgument(int i) { result = singleton(SummaryComponent::outArgument(i)) }
+
+  /**
+   * Gets a singleton stack representing the return value through the `i`th
+   * `ref` argument of a call.
+   */
+  SummaryComponentStack refArgument(int i) { result = singleton(SummaryComponent::refArgument(i)) }
+
+  /** Gets a singleton stack representing a jump to `c`. */
+  SummaryComponentStack jump(Callable c) { result = singleton(SummaryComponent::jump(c)) }
 }
 
 class SummarizedCallable = Impl::Public::SummarizedCallable;
 
-/** Provides a query predicate for outputting a set of relevant flow summaries. */
-module TestOutput {
-  /** A flow summary to include in the `summary/3` query predicate. */
-  abstract class RelevantSummarizedCallable extends SummarizedCallable { }
-
-  /** A query predicate for outputting flow summaries in QL tests. */
-  query predicate summary(string callable, string flow, boolean preservesValue) {
-    exists(
-      RelevantSummarizedCallable c, SummaryInput input, ContentList inputContents,
-      string inputContentsString, SummaryOutput output, ContentList outputContents,
-      string outputContentsString
-    |
-      callable = c.getQualifiedNameWithTypes() and
-      Impl::Private::summary(c, input, inputContents, output, outputContents, preservesValue) and
-      (
-        if inputContents.length() = 0
-        then inputContentsString = ""
-        else inputContentsString = " [" + inputContents + "]"
-      ) and
-      (
-        if outputContents.length() = 0
-        then outputContentsString = ""
-        else outputContentsString = " [" + outputContents + "]"
-      ) and
-      flow = input + inputContentsString + " -> " + output + outputContentsString
-    )
-  }
-}
+class RequiredSummaryComponentStack = Impl::Public::RequiredSummaryComponentStack;
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/LibraryTypeDataFlow.qll b/csharp/ql/src/semmle/code/csharp/dataflow/LibraryTypeDataFlow.qll
index 547d269a24c..5798080a98a 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/LibraryTypeDataFlow.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/LibraryTypeDataFlow.qll
@@ -354,86 +354,148 @@ abstract class LibraryTypeDataFlow extends Type {
   }
 }
 
-private CallableFlowSource toCallableFlowSource(SummaryInput input) {
-  result = TCallableFlowSourceQualifier() and
-  input = SummaryInput::parameter(-1)
-  or
-  exists(int i |
-    result = TCallableFlowSourceArg(i) and
-    input = SummaryInput::parameter(i)
-  )
-  or
-  exists(int i |
-    result = TCallableFlowSourceDelegateArg(i) and
-    input = SummaryInput::delegate(i)
-  )
-}
-
-private CallableFlowSink toCallableFlowSink(SummaryOutput output) {
-  result = TCallableFlowSinkQualifier() and
-  output = SummaryOutput::parameter(-1)
-  or
-  result = TCallableFlowSinkReturn() and
-  output = SummaryOutput::return()
-  or
-  exists(int i |
-    result = TCallableFlowSinkArg(i) and
-    output = SummaryOutput::parameter(i)
-  )
-  or
-  exists(int i, int j |
-    result = TCallableFlowSinkDelegateArg(i, j) and
-    output = SummaryOutput::delegate(i, j)
-  )
-}
-
-private AccessPath toAccessPath(ContentList cl) {
-  cl = ContentList::empty() and
-  result = TNilAccessPath()
-  or
-  exists(Content head, ContentList tail |
-    cl = ContentList::cons(head, tail) and
-    result = TConsAccessPath(head, toAccessPath(tail))
-  )
-}
-
-private class FrameworkDataFlowAdaptor extends SummarizedCallable {
-  private LibraryTypeDataFlow ltdf;
-
-  FrameworkDataFlowAdaptor() {
-    ltdf.callableFlow(_, _, this, _) or
-    ltdf.callableFlow(_, _, _, _, this, _) or
-    ltdf.clearsContent(_, _, this)
-  }
-
-  override predicate propagatesFlow(SummaryInput input, SummaryOutput output, boolean preservesValue) {
-    ltdf.callableFlow(toCallableFlowSource(input), toCallableFlowSink(output), this, preservesValue)
-  }
-
-  override predicate propagatesFlow(
-    SummaryInput input, ContentList inputContents, SummaryOutput output, ContentList outputContents,
-    boolean preservesValue
-  ) {
-    ltdf.callableFlow(toCallableFlowSource(input), toAccessPath(inputContents),
-      toCallableFlowSink(output), toAccessPath(outputContents), this, preservesValue)
-  }
-
-  private AccessPath getAnAccessPath() {
-    ltdf.callableFlow(_, result, _, _, this, _)
+/**
+ * An internal module for translating old `LibraryTypeDataFlow`-style
+ * flow summaries into the new style.
+ */
+private module FrameworkDataFlowAdaptor {
+  private CallableFlowSource toCallableFlowSource(SummaryComponentStack input) {
+    result = TCallableFlowSourceQualifier() and
+    input = SummaryComponentStack::qualifier()
     or
-    ltdf.callableFlow(_, _, _, result, _, _)
-  }
-
-  override predicate requiresContentList(Content head, ContentList tail) {
-    exists(AccessPath ap |
-      ap = this.getAnAccessPath().drop(_) and
-      head = ap.getHead() and
-      toAccessPath(tail) = ap.getTail()
+    exists(int i |
+      result = TCallableFlowSourceArg(i) and
+      input = SummaryComponentStack::argument(i)
+    )
+    or
+    exists(int i | result = TCallableFlowSourceDelegateArg(i) |
+      input =
+        SummaryComponentStack::push(SummaryComponent::return(), SummaryComponentStack::argument(i))
     )
   }
 
-  override predicate clearsContent(SummaryInput input, Content content) {
-    ltdf.clearsContent(toCallableFlowSource(input), content, this)
+  private CallableFlowSink toCallableFlowSink(SummaryComponentStack output) {
+    result = TCallableFlowSinkQualifier() and
+    output = SummaryComponentStack::qualifier()
+    or
+    result = TCallableFlowSinkReturn() and
+    output = SummaryComponentStack::return()
+    or
+    exists(int i |
+      result = TCallableFlowSinkArg(i) and
+      output = SummaryComponentStack::outArgument(i)
+    )
+    or
+    exists(int i, int j | result = TCallableFlowSinkDelegateArg(i, j) |
+      output =
+        SummaryComponentStack::push(SummaryComponent::parameter(j),
+          SummaryComponentStack::argument(i))
+    )
+  }
+
+  private class FrameworkDataFlowAdaptor extends SummarizedCallable {
+    private LibraryTypeDataFlow ltdf;
+
+    FrameworkDataFlowAdaptor() {
+      ltdf.callableFlow(_, _, this, _) or
+      ltdf.callableFlow(_, _, _, _, this, _) or
+      ltdf.clearsContent(_, _, this)
+    }
+
+    predicate input(
+      CallableFlowSource source, AccessPath sourceAp, SummaryComponent head,
+      SummaryComponentStack tail, int i
+    ) {
+      ltdf.callableFlow(source, sourceAp, _, _, this, _) and
+      source = toCallableFlowSource(tail) and
+      head = SummaryComponent::content(sourceAp.getHead()) and
+      i = 0
+      or
+      exists(SummaryComponent tailHead, SummaryComponentStack tailTail |
+        this.input(source, sourceAp, tailHead, tailTail, i - 1) and
+        head = SummaryComponent::content(sourceAp.drop(i).getHead()) and
+        tail = SummaryComponentStack::push(tailHead, tailTail)
+      )
+    }
+
+    predicate output(
+      CallableFlowSink sink, AccessPath sinkAp, SummaryComponent head, SummaryComponentStack tail,
+      int i
+    ) {
+      ltdf.callableFlow(_, _, sink, sinkAp, this, _) and
+      sink = toCallableFlowSink(tail) and
+      head = SummaryComponent::content(sinkAp.getHead()) and
+      i = 0
+      or
+      exists(SummaryComponent tailHead, SummaryComponentStack tailTail |
+        this.output(sink, sinkAp, tailHead, tailTail, i - 1) and
+        head = SummaryComponent::content(sinkAp.drop(i).getHead()) and
+        tail = SummaryComponentStack::push(tailHead, tailTail)
+      )
+    }
+
+    override predicate propagatesFlow(
+      SummaryComponentStack input, SummaryComponentStack output, boolean preservesValue
+    ) {
+      ltdf.callableFlow(toCallableFlowSource(input), toCallableFlowSink(output), this,
+        preservesValue)
+      or
+      exists(
+        CallableFlowSource source, AccessPath sourceAp, CallableFlowSink sink, AccessPath sinkAp
+      |
+        ltdf.callableFlow(source, sourceAp, sink, sinkAp, this, preservesValue) and
+        (
+          exists(SummaryComponent head, SummaryComponentStack tail |
+            this.input(source, sourceAp, head, tail, sourceAp.length() - 1) and
+            input = SummaryComponentStack::push(head, tail)
+          )
+          or
+          sourceAp.length() = 0 and
+          source = toCallableFlowSource(input)
+        ) and
+        (
+          exists(SummaryComponent head, SummaryComponentStack tail |
+            this.output(sink, sinkAp, head, tail, sinkAp.length() - 1) and
+            output = SummaryComponentStack::push(head, tail)
+          )
+          or
+          sinkAp.length() = 0 and
+          sink = toCallableFlowSink(output)
+        )
+      )
+    }
+
+    override predicate clearsContent(int i, Content content) {
+      exists(SummaryComponentStack input |
+        ltdf.clearsContent(toCallableFlowSource(input), content, this) and
+        input = SummaryComponentStack::singleton(SummaryComponent::argument(i))
+      )
+    }
+  }
+
+  private class AdaptorRequiredSummaryComponentStack extends RequiredSummaryComponentStack {
+    private SummaryComponent head;
+
+    AdaptorRequiredSummaryComponentStack() {
+      exists(int i |
+        exists(TCallableFlowSourceDelegateArg(i)) and
+        head = SummaryComponent::return() and
+        this = SummaryComponentStack::singleton(SummaryComponent::argument(i))
+      )
+      or
+      exists(int i, int j | exists(TCallableFlowSinkDelegateArg(i, j)) |
+        head = SummaryComponent::parameter(j) and
+        this = SummaryComponentStack::singleton(SummaryComponent::argument(i))
+      )
+      or
+      exists(FrameworkDataFlowAdaptor adaptor |
+        adaptor.input(_, _, head, this, _)
+        or
+        adaptor.output(_, _, head, this, _)
+      )
+    }
+
+    override predicate required(SummaryComponent c) { c = head }
   }
 }
 
@@ -2417,20 +2479,38 @@ class StringValuesFlow extends LibraryTypeDataFlow, Struct {
   }
 }
 
+private predicate recordConstructorFlow(Constructor c, int i, Property p) {
+  c = any(Record r).getAMember() and
+  exists(string name |
+    c.getParameter(i).getName() = name and
+    c.getDeclaringType().getAMember(name) = p
+  )
+}
+
+private class RecordConstructorFlowRequiredSummaryComponentStack extends RequiredSummaryComponentStack {
+  private SummaryComponent head;
+
+  RecordConstructorFlowRequiredSummaryComponentStack() {
+    exists(Property p |
+      recordConstructorFlow(_, _, p) and
+      head = SummaryComponent::property(p) and
+      this = SummaryComponentStack::singleton(SummaryComponent::return())
+    )
+  }
+
+  override predicate required(SummaryComponent c) { c = head }
+}
+
 private class RecordConstructorFlow extends SummarizedCallable {
-  RecordConstructorFlow() { this = any(Record r).getAMember().(Constructor) }
+  RecordConstructorFlow() { recordConstructorFlow(this, _, _) }
 
   override predicate propagatesFlow(
-    SummaryInput input, ContentList inputContents, SummaryOutput output, ContentList outputContents,
-    boolean preservesValue
+    SummaryComponentStack input, SummaryComponentStack output, boolean preservesValue
   ) {
-    exists(int i, Property p, string name |
-      this.getParameter(i).getName() = name and
-      this.getDeclaringType().getAMember(name) = p and
-      input = SummaryInput::parameter(i) and
-      inputContents = ContentList::empty() and
-      output = SummaryOutput::return() and
-      outputContents = ContentList::property(p) and
+    exists(int i, Property p |
+      recordConstructorFlow(this, i, p) and
+      input = SummaryComponentStack::argument(i) and
+      output = SummaryComponentStack::propertyOf(p, SummaryComponentStack::return()) and
       preservesValue = true
     )
   }
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowDispatch.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowDispatch.qll
index c68ba38e0b5..4eac274b04f 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowDispatch.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowDispatch.qll
@@ -1,14 +1,20 @@
 private import csharp
 private import cil
 private import dotnet
+private import DataFlowPublic
 private import DataFlowPrivate
-private import DelegateDataFlow
 private import FlowSummaryImpl as FlowSummaryImpl
 private import semmle.code.csharp.dataflow.FlowSummary
 private import semmle.code.csharp.dispatch.Dispatch
 private import semmle.code.csharp.frameworks.system.Collections
 private import semmle.code.csharp.frameworks.system.collections.Generic
 
+private predicate summarizedCallable(DataFlowCallable c) {
+  c instanceof SummarizedCallable
+  or
+  FlowSummaryImpl::Private::summaryReturnNode(_, TJumpReturnKind(c, _))
+}
+
 /**
  * Gets a source declaration of callable `c` that has a body or has
  * a flow summary.
@@ -18,11 +24,8 @@ private import semmle.code.csharp.frameworks.system.collections.Generic
  */
 DotNet::Callable getCallableForDataFlow(DotNet::Callable c) {
   exists(DotNet::Callable unboundDecl | unboundDecl = c.getUnboundDeclaration() |
-    result = unboundDecl and
-    result instanceof SummarizedCallable
-    or
-    result = unboundDecl and
-    FlowSummaryImpl::Private::summary(_, _, _, SummaryOutput::jump(result, _), _, _)
+    summarizedCallable(unboundDecl) and
+    result = unboundDecl
     or
     result.hasBody() and
     if unboundDecl.getFile().fromSource()
@@ -44,17 +47,6 @@ DotNet::Callable getCallableForDataFlow(DotNet::Callable c) {
   )
 }
 
-/**
- * Holds if callable `c` can return `e` as an `out`/`ref` value for parameter `p`.
- */
-private predicate callableReturnsOutOrRef(Callable c, Parameter p, Expr e) {
-  exists(Ssa::ExplicitDefinition def |
-    def.getADefinition().getSource() = e and
-    def.isLiveOutRefParameterDefinition(p) and
-    p = c.getAParameter()
-  )
-}
-
 /**
  * Holds if `cfn` corresponds to a call that can reach callable `c` using
  * additional calls, and `c` is a callable that either reads or writes to
@@ -82,19 +74,22 @@ private module Cached {
   cached
   newtype TReturnKind =
     TNormalReturnKind() { Stages::DataFlowStage::forceCachingInSameStage() } or
-    TYieldReturnKind() or
-    TOutReturnKind(int i) {
-      exists(Parameter p | callableReturnsOutOrRef(_, p, _) and p.isOut() | i = p.getPosition())
-    } or
-    TRefReturnKind(int i) {
-      exists(Parameter p | callableReturnsOutOrRef(_, p, _) and p.isRef() | i = p.getPosition())
-    } or
+    TOutReturnKind(int i) { i = any(Parameter p | p.isOut()).getPosition() } or
+    TRefReturnKind(int i) { i = any(Parameter p | p.isRef()).getPosition() } or
     TImplicitCapturedReturnKind(LocalScopeVariable v) {
       exists(Ssa::ExplicitDefinition def | def.isCapturedVariableDefinitionFlowOut(_, _) |
         v = def.getSourceVariable().getAssignable()
       )
     } or
-    TQualifierReturnKind()
+    TJumpReturnKind(DataFlowCallable target, ReturnKind rk) {
+      rk instanceof NormalReturnKind and
+      (
+        target instanceof Constructor or
+        not target.getReturnType() instanceof VoidType
+      )
+      or
+      exists(target.getParameter(rk.(OutRefReturnKind).getPosition()))
+    }
 
   cached
   newtype TDataFlowCall =
@@ -111,16 +106,8 @@ private module Cached {
       // No need to include calls that are compiled from source
       not call.getImplementation().getMethod().compiledFromSource()
     } or
-    TSummaryDelegateCall(SummarizedCallable c, int pos) {
-      exists(SummaryInput input |
-        FlowSummaryImpl::Private::summary(c, input, _, _, _, _) and
-        input = SummaryInput::delegate(pos)
-      )
-      or
-      exists(SummaryOutput output |
-        FlowSummaryImpl::Private::summary(c, _, _, output, _, _) and
-        output = SummaryOutput::delegate(pos, _)
-      )
+    TSummaryCall(SummarizedCallable c, Node receiver) {
+      FlowSummaryImpl::Private::summaryCallbackRange(c, receiver)
     }
 
   /** Gets a viable run-time target for the call `call`. */
@@ -131,45 +118,24 @@ private module Cached {
 import Cached
 
 private module DispatchImpl {
-  private import CallContext
-
-  /**
-   * Gets a viable run-time target for the delegate call `call`, requiring
-   * call context `cc`.
-   */
-  private DataFlowCallable viableDelegateCallable(DataFlowCall call, CallContext cc) {
-    result = call.(DelegateDataFlowCall).getARuntimeTarget(cc)
-  }
-
   /**
    * Holds if the set of viable implementations that can be called by `call`
    * might be improved by knowing the call context. This is the case if the
    * call is a delegate call, or if the qualifier accesses a parameter of
    * the enclosing callable `c` (including the implicit `this` parameter).
    */
-  predicate mayBenefitFromCallContext(DataFlowCall call, Callable c) {
+  predicate mayBenefitFromCallContext(NonDelegateDataFlowCall call, Callable c) {
     c = call.getEnclosingCallable() and
-    (
-      exists(CallContext cc | exists(viableDelegateCallable(call, cc)) |
-        not cc instanceof EmptyCallContext
-      )
-      or
-      call.(NonDelegateDataFlowCall).getDispatchCall().mayBenefitFromCallContext()
-    )
+    call.getDispatchCall().mayBenefitFromCallContext()
   }
 
   /**
    * Gets a viable dispatch target of `call` in the context `ctx`. This is
    * restricted to those `call`s for which a context might make a difference.
    */
-  DataFlowCallable viableImplInCallContext(DataFlowCall call, DataFlowCall ctx) {
-    exists(ArgumentCallContext cc | result = viableDelegateCallable(call, cc) |
-      cc.isArgument(ctx.getExpr(), _)
-    )
-    or
+  DataFlowCallable viableImplInCallContext(NonDelegateDataFlowCall call, DataFlowCall ctx) {
     result =
-      call.(NonDelegateDataFlowCall)
-          .getDispatchCall()
+      call.getDispatchCall()
           .getADynamicTargetInCallContext(ctx.(NonDelegateDataFlowCall).getDispatchCall())
           .getUnboundDeclaration()
   }
@@ -197,12 +163,7 @@ abstract class ReturnKind extends TReturnKind {
  * body, that is, a "normal" return.
  */
 class NormalReturnKind extends ReturnKind, TNormalReturnKind {
-  override string toString() { result = "return" }
-}
-
-/** A value returned from a callable using a `yield return` statement. */
-class YieldReturnKind extends ReturnKind, TYieldReturnKind {
-  override string toString() { result = "yield return" }
+  override string toString() { result = "normal" }
 }
 
 /** A value returned from a callable using an `out` or a `ref` parameter. */
@@ -213,16 +174,24 @@ abstract class OutRefReturnKind extends ReturnKind {
 
 /** A value returned from a callable using an `out` parameter. */
 class OutReturnKind extends OutRefReturnKind, TOutReturnKind {
-  override int getPosition() { this = TOutReturnKind(result) }
+  private int pos;
 
-  override string toString() { result = "out" }
+  OutReturnKind() { this = TOutReturnKind(pos) }
+
+  override int getPosition() { result = pos }
+
+  override string toString() { result = "out parameter " + pos }
 }
 
 /** A value returned from a callable using a `ref` parameter. */
 class RefReturnKind extends OutRefReturnKind, TRefReturnKind {
-  override int getPosition() { this = TRefReturnKind(result) }
+  private int pos;
 
-  override string toString() { result = "ref" }
+  RefReturnKind() { this = TRefReturnKind(pos) }
+
+  override int getPosition() { result = pos }
+
+  override string toString() { result = "ref parameter " + pos }
 }
 
 /** A value implicitly returned from a callable using a captured variable. */
@@ -237,12 +206,30 @@ class ImplicitCapturedReturnKind extends ReturnKind, TImplicitCapturedReturnKind
   override string toString() { result = "captured " + v }
 }
 
-/** A value returned through the qualifier of a call. */
-class QualifierReturnKind extends ReturnKind, TQualifierReturnKind {
-  override string toString() { result = "qualifier" }
+/**
+ * A value returned through the output of another callable.
+ *
+ * This is currently only used to model flow summaries where data may flow into
+ * one API entry point and out of another.
+ */
+class JumpReturnKind extends ReturnKind, TJumpReturnKind {
+  private DataFlowCallable target;
+  private ReturnKind rk;
+
+  JumpReturnKind() { this = TJumpReturnKind(target, rk) }
+
+  /** Gets the target of the jump. */
+  DataFlowCallable getTarget() { result = target }
+
+  /** Gets the return kind of the target. */
+  ReturnKind getTargetReturnKind() { result = rk }
+
+  override string toString() { result = "jump to " + target }
 }
 
-class DataFlowCallable = DotNet::Callable;
+class DataFlowCallable extends DotNet::Callable {
+  DataFlowCallable() { this.isUnboundDeclaration() }
+}
 
 /** A call relevant for data flow. */
 abstract class DataFlowCall extends TDataFlowCall {
@@ -293,7 +280,7 @@ class NonDelegateDataFlowCall extends DataFlowCall, TNonDelegateCall {
 
   override DataFlow::ExprNode getNode() { result.getControlFlowNode() = cfn }
 
-  override Callable getEnclosingCallable() { result = cfn.getEnclosingCallable() }
+  override DataFlowCallable getEnclosingCallable() { result = cfn.getEnclosingCallable() }
 
   override string toString() { result = cfn.toString() }
 
@@ -301,12 +288,7 @@ class NonDelegateDataFlowCall extends DataFlowCall, TNonDelegateCall {
 }
 
 /** A delegate call relevant for data flow. */
-abstract class DelegateDataFlowCall extends DataFlowCall {
-  /** Gets a viable run-time target of this call requiring call context `cc`. */
-  abstract DataFlowCallable getARuntimeTarget(CallContext::CallContext cc);
-
-  override DataFlowCallable getARuntimeTarget() { result = this.getARuntimeTarget(_) }
-}
+abstract class DelegateDataFlowCall extends DataFlowCall { }
 
 /** An explicit delegate or function pointer call relevant for data flow. */
 class ExplicitDelegateLikeDataFlowCall extends DelegateDataFlowCall, TExplicitDelegateLikeCall {
@@ -315,15 +297,18 @@ class ExplicitDelegateLikeDataFlowCall extends DelegateDataFlowCall, TExplicitDe
 
   ExplicitDelegateLikeDataFlowCall() { this = TExplicitDelegateLikeCall(cfn, dc) }
 
-  override DataFlowCallable getARuntimeTarget(CallContext::CallContext cc) {
-    result = getCallableForDataFlow(dc.getARuntimeTarget(cc))
+  /** Gets the underlying call. */
+  DelegateLikeCall getCall() { result = dc }
+
+  override DataFlowCallable getARuntimeTarget() {
+    none() // handled by the shared library
   }
 
   override ControlFlow::Nodes::ElementNode getControlFlowNode() { result = cfn }
 
   override DataFlow::ExprNode getNode() { result.getControlFlowNode() = cfn }
 
-  override Callable getEnclosingCallable() { result = cfn.getEnclosingCallable() }
+  override DataFlowCallable getEnclosingCallable() { result = cfn.getEnclosingCallable() }
 
   override string toString() { result = cfn.toString() }
 
@@ -341,13 +326,13 @@ class TransitiveCapturedDataFlowCall extends DataFlowCall, TTransitiveCapturedCa
 
   TransitiveCapturedDataFlowCall() { this = TTransitiveCapturedCall(cfn, target) }
 
-  override Callable getARuntimeTarget() { result = target }
+  override DataFlowCallable getARuntimeTarget() { result = target }
 
   override ControlFlow::Nodes::ElementNode getControlFlowNode() { result = cfn }
 
   override DataFlow::ExprNode getNode() { none() }
 
-  override Callable getEnclosingCallable() { result = cfn.getEnclosingCallable() }
+  override DataFlowCallable getEnclosingCallable() { result = cfn.getEnclosingCallable() }
 
   override string toString() { result = "[transitive] " + cfn.toString() }
 
@@ -369,7 +354,7 @@ class CilDataFlowCall extends DataFlowCall, TCilCall {
 
   override DataFlow::ExprNode getNode() { result.getExpr() = call }
 
-  override CIL::Callable getEnclosingCallable() { result = call.getEnclosingCallable() }
+  override DataFlowCallable getEnclosingCallable() { result = call.getEnclosingCallable() }
 
   override string toString() { result = call.toString() }
 
@@ -377,32 +362,32 @@ class CilDataFlowCall extends DataFlowCall, TCilCall {
 }
 
 /**
- * A delegate call inside a callable with a flow summary.
+ * A synthesized call inside a callable with a flow summary.
  *
  * For example, in `ints.Select(i => i + 1)` there is a call to the delegate at
  * parameter position `1` (counting the qualifier as the `0`th argument) inside
  * the method `Select`.
  */
-class SummaryDelegateCall extends DelegateDataFlowCall, TSummaryDelegateCall {
+class SummaryCall extends DelegateDataFlowCall, TSummaryCall {
   private SummarizedCallable c;
-  private int pos;
+  private Node receiver;
 
-  SummaryDelegateCall() { this = TSummaryDelegateCall(c, pos) }
+  SummaryCall() { this = TSummaryCall(c, receiver) }
 
-  override DataFlowCallable getARuntimeTarget(CallContext::CallContext cc) {
-    exists(SummaryDelegateParameterSink p |
-      p.isParameterOf(c, pos) and
-      result = p.getARuntimeTarget(cc)
-    )
+  /** Gets the data flow node that this call targets. */
+  Node getReceiver() { result = receiver }
+
+  override DataFlowCallable getARuntimeTarget() {
+    none() // handled by the shared library
   }
 
   override ControlFlow::Nodes::ElementNode getControlFlowNode() { none() }
 
   override DataFlow::Node getNode() { none() }
 
-  override Callable getEnclosingCallable() { result = c }
+  override DataFlowCallable getEnclosingCallable() { result = c }
 
-  override string toString() { result = "[summary] delegate call, parameter " + pos + " of " + c }
+  override string toString() { result = "[summary] call to " + receiver + " in " + c }
 
   override Location getLocation() { result = c.getLocation() }
 }
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl.qll
index 8b446d28b86..9498e51e7e6 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl.qll
@@ -2133,11 +2133,8 @@ private module Stage4 {
 
   bindingset[node, cc, config]
   private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl2.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl2.qll
index 8b446d28b86..9498e51e7e6 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl2.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl2.qll
@@ -2133,11 +2133,8 @@ private module Stage4 {
 
   bindingset[node, cc, config]
   private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl3.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl3.qll
index 8b446d28b86..9498e51e7e6 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl3.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl3.qll
@@ -2133,11 +2133,8 @@ private module Stage4 {
 
   bindingset[node, cc, config]
   private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl4.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl4.qll
index 8b446d28b86..9498e51e7e6 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl4.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl4.qll
@@ -2133,11 +2133,8 @@ private module Stage4 {
 
   bindingset[node, cc, config]
   private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl5.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl5.qll
index 8b446d28b86..9498e51e7e6 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl5.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl5.qll
@@ -2133,11 +2133,8 @@ private module Stage4 {
 
   bindingset[node, cc, config]
   private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImplCommon.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImplCommon.qll
index 1319f972037..a51c20c2288 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImplCommon.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImplCommon.qll
@@ -26,15 +26,243 @@ predicate accessPathCostLimits(int apLimit, int tupleLimit) {
   tupleLimit = 1000
 }
 
+/**
+ * Provides a simple data-flow analysis for resolving lambda calls. The analysis
+ * currently excludes read-steps, store-steps, and flow-through.
+ *
+ * The analysis uses non-linear recursion: When computing a flow path in or out
+ * of a call, we use the results of the analysis recursively to resolve lamba
+ * calls. For this reason, we cannot reuse the code from `DataFlowImpl.qll` directly.
+ */
+private module LambdaFlow {
+  private predicate viableParamNonLambda(DataFlowCall call, int i, ParameterNode p) {
+    p.isParameterOf(viableCallable(call), i)
+  }
+
+  private predicate viableParamLambda(DataFlowCall call, int i, ParameterNode p) {
+    p.isParameterOf(viableCallableLambda(call, _), i)
+  }
+
+  private predicate viableParamArgNonLambda(DataFlowCall call, ParameterNode p, ArgumentNode arg) {
+    exists(int i |
+      viableParamNonLambda(call, i, p) and
+      arg.argumentOf(call, i)
+    )
+  }
+
+  private predicate viableParamArgLambda(DataFlowCall call, ParameterNode p, ArgumentNode arg) {
+    exists(int i |
+      viableParamLambda(call, i, p) and
+      arg.argumentOf(call, i)
+    )
+  }
+
+  private newtype TReturnPositionSimple =
+    TReturnPositionSimple0(DataFlowCallable c, ReturnKind kind) {
+      exists(ReturnNode ret |
+        c = getNodeEnclosingCallable(ret) and
+        kind = ret.getKind()
+      )
+    }
+
+  pragma[noinline]
+  private TReturnPositionSimple getReturnPositionSimple(ReturnNode ret, ReturnKind kind) {
+    result = TReturnPositionSimple0(getNodeEnclosingCallable(ret), kind)
+  }
+
+  pragma[nomagic]
+  private TReturnPositionSimple viableReturnPosNonLambda(DataFlowCall call, ReturnKind kind) {
+    result = TReturnPositionSimple0(viableCallable(call), kind)
+  }
+
+  pragma[nomagic]
+  private TReturnPositionSimple viableReturnPosLambda(
+    DataFlowCall call, DataFlowCallOption lastCall, ReturnKind kind
+  ) {
+    result = TReturnPositionSimple0(viableCallableLambda(call, lastCall), kind)
+  }
+
+  private predicate viableReturnPosOutNonLambda(
+    DataFlowCall call, TReturnPositionSimple pos, OutNode out
+  ) {
+    exists(ReturnKind kind |
+      pos = viableReturnPosNonLambda(call, kind) and
+      out = getAnOutNode(call, kind)
+    )
+  }
+
+  private predicate viableReturnPosOutLambda(
+    DataFlowCall call, DataFlowCallOption lastCall, TReturnPositionSimple pos, OutNode out
+  ) {
+    exists(ReturnKind kind |
+      pos = viableReturnPosLambda(call, lastCall, kind) and
+      out = getAnOutNode(call, kind)
+    )
+  }
+
+  /**
+   * Holds if data can flow (inter-procedurally) from `node` (of type `t`) to
+   * the lambda call `lambdaCall`.
+   *
+   * The parameter `toReturn` indicates whether the path from `node` to
+   * `lambdaCall` goes through a return, and `toJump` whether the path goes
+   * through a jump step.
+   *
+   * The call context `lastCall` records the last call on the path from `node`
+   * to `lambdaCall`, if any. That is, `lastCall` is able to target the enclosing
+   * callable of `lambdaCall`.
+   */
+  pragma[nomagic]
+  predicate revLambdaFlow(
+    DataFlowCall lambdaCall, LambdaCallKind kind, Node node, DataFlowType t, boolean toReturn,
+    boolean toJump, DataFlowCallOption lastCall
+  ) {
+    revLambdaFlow0(lambdaCall, kind, node, t, toReturn, toJump, lastCall) and
+    if node instanceof CastNode or node instanceof ArgumentNode or node instanceof ReturnNode
+    then compatibleTypes(t, getNodeType(node))
+    else any()
+  }
+
+  pragma[nomagic]
+  predicate revLambdaFlow0(
+    DataFlowCall lambdaCall, LambdaCallKind kind, Node node, DataFlowType t, boolean toReturn,
+    boolean toJump, DataFlowCallOption lastCall
+  ) {
+    lambdaCall(lambdaCall, kind, node) and
+    t = getNodeType(node) and
+    toReturn = false and
+    toJump = false and
+    lastCall = TDataFlowCallNone()
+    or
+    // local flow
+    exists(Node mid, DataFlowType t0 |
+      revLambdaFlow(lambdaCall, kind, mid, t0, toReturn, toJump, lastCall)
+    |
+      simpleLocalFlowStep(node, mid) and
+      t = t0
+      or
+      exists(boolean preservesValue |
+        additionalLambdaFlowStep(node, mid, preservesValue) and
+        getNodeEnclosingCallable(node) = getNodeEnclosingCallable(mid)
+      |
+        preservesValue = false and
+        t = getNodeType(node)
+        or
+        preservesValue = true and
+        t = t0
+      )
+    )
+    or
+    // jump step
+    exists(Node mid, DataFlowType t0 |
+      revLambdaFlow(lambdaCall, kind, mid, t0, _, _, _) and
+      toReturn = false and
+      toJump = true and
+      lastCall = TDataFlowCallNone()
+    |
+      jumpStep(node, mid) and
+      t = t0
+      or
+      exists(boolean preservesValue |
+        additionalLambdaFlowStep(node, mid, preservesValue) and
+        getNodeEnclosingCallable(node) != getNodeEnclosingCallable(mid)
+      |
+        preservesValue = false and
+        t = getNodeType(node)
+        or
+        preservesValue = true and
+        t = t0
+      )
+    )
+    or
+    // flow into a callable
+    exists(ParameterNode p, DataFlowCallOption lastCall0, DataFlowCall call |
+      revLambdaFlowIn(lambdaCall, kind, p, t, toJump, lastCall0) and
+      (
+        if lastCall0 = TDataFlowCallNone() and toJump = false
+        then lastCall = TDataFlowCallSome(call)
+        else lastCall = lastCall0
+      ) and
+      toReturn = false
+    |
+      viableParamArgNonLambda(call, p, node)
+      or
+      viableParamArgLambda(call, p, node) // non-linear recursion
+    )
+    or
+    // flow out of a callable
+    exists(TReturnPositionSimple pos |
+      revLambdaFlowOut(lambdaCall, kind, pos, t, toJump, lastCall) and
+      getReturnPositionSimple(node, node.(ReturnNode).getKind()) = pos and
+      toReturn = true
+    )
+  }
+
+  pragma[nomagic]
+  predicate revLambdaFlowOutLambdaCall(
+    DataFlowCall lambdaCall, LambdaCallKind kind, OutNode out, DataFlowType t, boolean toJump,
+    DataFlowCall call, DataFlowCallOption lastCall
+  ) {
+    revLambdaFlow(lambdaCall, kind, out, t, _, toJump, lastCall) and
+    exists(ReturnKindExt rk |
+      out = rk.getAnOutNode(call) and
+      lambdaCall(call, _, _)
+    )
+  }
+
+  pragma[nomagic]
+  predicate revLambdaFlowOut(
+    DataFlowCall lambdaCall, LambdaCallKind kind, TReturnPositionSimple pos, DataFlowType t,
+    boolean toJump, DataFlowCallOption lastCall
+  ) {
+    exists(DataFlowCall call, OutNode out |
+      revLambdaFlow(lambdaCall, kind, out, t, _, toJump, lastCall) and
+      viableReturnPosOutNonLambda(call, pos, out)
+      or
+      // non-linear recursion
+      revLambdaFlowOutLambdaCall(lambdaCall, kind, out, t, toJump, call, lastCall) and
+      viableReturnPosOutLambda(call, _, pos, out)
+    )
+  }
+
+  pragma[nomagic]
+  predicate revLambdaFlowIn(
+    DataFlowCall lambdaCall, LambdaCallKind kind, ParameterNode p, DataFlowType t, boolean toJump,
+    DataFlowCallOption lastCall
+  ) {
+    revLambdaFlow(lambdaCall, kind, p, t, false, toJump, lastCall)
+  }
+}
+
+private DataFlowCallable viableCallableExt(DataFlowCall call) {
+  result = viableCallable(call)
+  or
+  result = viableCallableLambda(call, _)
+}
+
 cached
 private module Cached {
+  /**
+   * Gets a viable target for the lambda call `call`.
+   *
+   * `lastCall` records the call required to reach `call` in order for the result
+   * to be a viable target, if any.
+   */
+  cached
+  DataFlowCallable viableCallableLambda(DataFlowCall call, DataFlowCallOption lastCall) {
+    exists(Node creation, LambdaCallKind kind |
+      LambdaFlow::revLambdaFlow(call, kind, creation, _, _, _, lastCall) and
+      lambdaCreation(creation, kind, result)
+    )
+  }
+
   /**
    * Holds if `p` is the `i`th parameter of a viable dispatch target of `call`.
    * The instance parameter is considered to have index `-1`.
    */
   pragma[nomagic]
   private predicate viableParam(DataFlowCall call, int i, ParameterNode p) {
-    p.isParameterOf(viableCallable(call), i)
+    p.isParameterOf(viableCallableExt(call), i)
   }
 
   /**
@@ -52,7 +280,7 @@ private module Cached {
 
   pragma[nomagic]
   private ReturnPosition viableReturnPos(DataFlowCall call, ReturnKindExt kind) {
-    viableCallable(call) = result.getCallable() and
+    viableCallableExt(call) = result.getCallable() and
     kind = result.getKind()
   }
 
@@ -317,6 +545,35 @@ private module Cached {
 
   cached
   private module DispatchWithCallContext {
+    /**
+     * Holds if the set of viable implementations that can be called by `call`
+     * might be improved by knowing the call context.
+     */
+    pragma[nomagic]
+    private predicate mayBenefitFromCallContextExt(DataFlowCall call, DataFlowCallable callable) {
+      mayBenefitFromCallContext(call, callable)
+      or
+      callable = call.getEnclosingCallable() and
+      exists(viableCallableLambda(call, TDataFlowCallSome(_)))
+    }
+
+    /**
+     * Gets a viable dispatch target of `call` in the context `ctx`. This is
+     * restricted to those `call`s for which a context might make a difference.
+     */
+    pragma[nomagic]
+    private DataFlowCallable viableImplInCallContextExt(DataFlowCall call, DataFlowCall ctx) {
+      result = viableImplInCallContext(call, ctx)
+      or
+      result = viableCallableLambda(call, TDataFlowCallSome(ctx))
+      or
+      exists(DataFlowCallable enclosing |
+        mayBenefitFromCallContextExt(call, enclosing) and
+        enclosing = viableCallableExt(ctx) and
+        result = viableCallableLambda(call, TDataFlowCallNone())
+      )
+    }
+
     /**
      * Holds if the call context `ctx` reduces the set of viable run-time
      * dispatch targets of call `call` in `c`.
@@ -324,10 +581,10 @@ private module Cached {
     cached
     predicate reducedViableImplInCallContext(DataFlowCall call, DataFlowCallable c, DataFlowCall ctx) {
       exists(int tgts, int ctxtgts |
-        mayBenefitFromCallContext(call, c) and
-        c = viableCallable(ctx) and
-        ctxtgts = count(viableImplInCallContext(call, ctx)) and
-        tgts = strictcount(viableCallable(call)) and
+        mayBenefitFromCallContextExt(call, c) and
+        c = viableCallableExt(ctx) and
+        ctxtgts = count(viableImplInCallContextExt(call, ctx)) and
+        tgts = strictcount(viableCallableExt(call)) and
         ctxtgts < tgts
       )
     }
@@ -339,7 +596,7 @@ private module Cached {
      */
     cached
     DataFlowCallable prunedViableImplInCallContext(DataFlowCall call, DataFlowCall ctx) {
-      result = viableImplInCallContext(call, ctx) and
+      result = viableImplInCallContextExt(call, ctx) and
       reducedViableImplInCallContext(call, _, ctx)
     }
 
@@ -351,10 +608,10 @@ private module Cached {
     cached
     predicate reducedViableImplInReturn(DataFlowCallable c, DataFlowCall call) {
       exists(int tgts, int ctxtgts |
-        mayBenefitFromCallContext(call, _) and
-        c = viableCallable(call) and
-        ctxtgts = count(DataFlowCall ctx | c = viableImplInCallContext(call, ctx)) and
-        tgts = strictcount(DataFlowCall ctx | viableCallable(ctx) = call.getEnclosingCallable()) and
+        mayBenefitFromCallContextExt(call, _) and
+        c = viableCallableExt(call) and
+        ctxtgts = count(DataFlowCall ctx | c = viableImplInCallContextExt(call, ctx)) and
+        tgts = strictcount(DataFlowCall ctx | viableCallableExt(ctx) = call.getEnclosingCallable()) and
         ctxtgts < tgts
       )
     }
@@ -367,7 +624,7 @@ private module Cached {
      */
     cached
     DataFlowCallable prunedViableImplInCallContextReverse(DataFlowCall call, DataFlowCall ctx) {
-      result = viableImplInCallContext(call, ctx) and
+      result = viableImplInCallContextExt(call, ctx) and
       reducedViableImplInReturn(result, call)
     }
   }
@@ -481,6 +738,11 @@ private module Cached {
     TBooleanNone() or
     TBooleanSome(boolean b) { b = true or b = false }
 
+  cached
+  newtype TDataFlowCallOption =
+    TDataFlowCallNone() or
+    TDataFlowCallSome(DataFlowCall call)
+
   cached
   newtype TTypedContent = MkTypedContent(Content c, DataFlowType t) { store(_, c, _, _, t) }
 
@@ -777,7 +1039,7 @@ ReturnPosition getReturnPosition(ReturnNodeExt ret) {
 
 bindingset[cc, callable]
 predicate resolveReturn(CallContext cc, DataFlowCallable callable, DataFlowCall call) {
-  cc instanceof CallContextAny and callable = viableCallable(call)
+  cc instanceof CallContextAny and callable = viableCallableExt(call)
   or
   exists(DataFlowCallable c0, DataFlowCall call0 |
     call0.getEnclosingCallable() = callable and
@@ -791,14 +1053,14 @@ DataFlowCallable resolveCall(DataFlowCall call, CallContext cc) {
   exists(DataFlowCall ctx | cc = TSpecificCall(ctx) |
     if reducedViableImplInCallContext(call, _, ctx)
     then result = prunedViableImplInCallContext(call, ctx)
-    else result = viableCallable(call)
+    else result = viableCallableExt(call)
   )
   or
-  result = viableCallable(call) and cc instanceof CallContextSomeCall
+  result = viableCallableExt(call) and cc instanceof CallContextSomeCall
   or
-  result = viableCallable(call) and cc instanceof CallContextAny
+  result = viableCallableExt(call) and cc instanceof CallContextAny
   or
-  result = viableCallable(call) and cc instanceof CallContextReturn
+  result = viableCallableExt(call) and cc instanceof CallContextReturn
 }
 
 predicate read = readStep/3;
@@ -812,6 +1074,19 @@ class BooleanOption extends TBooleanOption {
   }
 }
 
+/** An optional `DataFlowCall`. */
+class DataFlowCallOption extends TDataFlowCallOption {
+  string toString() {
+    this = TDataFlowCallNone() and
+    result = "(none)"
+    or
+    exists(DataFlowCall call |
+      this = TDataFlowCallSome(call) and
+      result = call.toString()
+    )
+  }
+}
+
 /** Content tagged with the type of a containing object. */
 class TypedContent extends MkTypedContent {
   private Content c;
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
index 5e3ac64f7c2..3b646973e28 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
@@ -5,7 +5,6 @@ private import DataFlowPublic
 private import DataFlowDispatch
 private import DataFlowImplCommon
 private import ControlFlowReachability
-private import DelegateDataFlow
 private import FlowSummaryImpl as FlowSummaryImpl
 private import semmle.code.csharp.dataflow.FlowSummary
 private import semmle.code.csharp.Caching
@@ -19,7 +18,6 @@ private import semmle.code.csharp.frameworks.EntityFramework
 private import semmle.code.csharp.frameworks.NHibernate
 private import semmle.code.csharp.frameworks.system.Collections
 private import semmle.code.csharp.frameworks.system.threading.Tasks
-private import semmle.code.csharp.frameworks.system.linq.Expressions
 
 abstract class NodeImpl extends Node {
   /** Do not call: use `getEnclosingCallable()` instead. */
@@ -71,9 +69,6 @@ private class ExprNodeImpl extends ExprNode, NodeImpl {
   }
 }
 
-/** A data-flow node used to interpret a flow summary. */
-abstract private class SummaryNodeImpl extends NodeImpl { }
-
 /** Calculation of the relative order in which `this` references are read. */
 private module ThisFlow {
   private class BasicBlock = ControlFlow::BasicBlock;
@@ -292,8 +287,8 @@ module LocalFlow {
    */
   private predicate localFlowSsaInput(Node nodeFrom, Ssa::Definition def, Ssa::Definition next) {
     exists(ControlFlow::BasicBlock bb, int i | SsaImpl::lastRefBeforeRedef(def, bb, i, next) |
-      def = nodeFrom.(SsaDefinitionNode).getDefinition() and
-      def.definesAt(_, bb, i)
+      def.definesAt(_, bb, i) and
+      def = getSsaDefinition(nodeFrom)
       or
       nodeFrom.asExprAtNode(bb.getNode(i)) instanceof AssignableRead
     )
@@ -380,7 +375,7 @@ module LocalFlow {
    * inter-procedurality or field-sensitivity.
    */
   predicate excludeFromExposedRelations(Node n) {
-    n instanceof SummaryNodeImpl or
+    n instanceof SummaryNode or
     n instanceof ImplicitCapturedArgumentNode
   }
 }
@@ -433,7 +428,7 @@ private class Argument extends Expr {
         this = dc.getQualifier() and arg = -1 and not dc.getAStaticTarget().(Modifiable).isStatic()
       ).getCall()
     or
-    this = call.(DelegateCall).getArgument(arg)
+    this = call.(DelegateLikeCall).getArgument(arg)
   }
 
   /**
@@ -456,9 +451,9 @@ private predicate fieldOrPropertyStore(Expr e, Content c, Expr src, Expr q, bool
       f.isFieldLike() and
       f instanceof InstanceFieldOrProperty
       or
-      exists(ContentList cl |
-        FlowSummaryImpl::Private::summary(_, _, cl, _, _, _) and
-        cl.contains(f.getContent())
+      exists(SummarizedCallable callable, FlowSummaryImpl::Public::SummaryComponentStack input |
+        callable.propagatesFlow(input, _, _) and
+        input.contains(SummaryComponent::content(f.getContent()))
       )
     )
   |
@@ -612,8 +607,6 @@ private Gvn::GvnType getANonTypeParameterSubTypeRestricted(DataFlowType t) {
 /** A collection of cached types and predicates to be evaluated in the same stage. */
 cached
 private module Cached {
-  private import FlowSummarySpecific as FlowSummarySpecific
-
   cached
   newtype TNode =
     TExprNode(ControlFlow::Nodes::ElementNode cfn) {
@@ -632,6 +625,9 @@ private module Cached {
     TYieldReturnNode(ControlFlow::Nodes::ElementNode cfn) {
       any(Callable c).canYieldReturn(cfn.getElement())
     } or
+    TAsyncReturnNode(ControlFlow::Nodes::ElementNode cfn) {
+      any(Callable c | c.(Modifiable).isAsync()).canReturn(cfn.getElement())
+    } or
     TImplicitCapturedArgumentNode(ControlFlow::Nodes::ElementNode cfn, LocalScopeVariable v) {
       exists(Ssa::ExplicitDefinition def | def.isCapturedVariableDefinitionFlowIn(_, cfn, _) |
         v = def.getSourceVariable().getAssignable()
@@ -662,32 +658,8 @@ private module Cached {
         cfn.getElement() = fla.getQualifier()
       )
     } or
-    TSummaryInternalNode(
-      SummarizedCallable c, FlowSummaryImpl::Private::SummaryInternalNodeState state
-    ) {
-      FlowSummaryImpl::Private::internalNodeRange(c, state)
-    } or
-    TSummaryReturnNode(SummarizedCallable c, ReturnKind rk) {
-      exists(SummaryOutput output |
-        FlowSummaryImpl::Private::summary(c, _, _, output, _, _) and
-        rk = FlowSummarySpecific::Private::toReturnKind(output)
-      )
-    } or
-    TSummaryDelegateOutNode(SummarizedCallable c, int pos) {
-      exists(SummaryInput input |
-        FlowSummaryImpl::Private::summary(c, input, _, _, _, _) and
-        input = SummaryInput::delegate(pos)
-      )
-    } or
-    TSummaryDelegateArgumentNode(SummarizedCallable c, int delegateIndex, int parameterIndex) {
-      exists(SummaryOutput output |
-        FlowSummaryImpl::Private::summary(c, _, _, output, _, _) and
-        output = SummaryOutput::delegate(delegateIndex, parameterIndex)
-      )
-    } or
-    TSummaryJumpNode(SummarizedCallable c, SummarizableCallable target, ReturnKind rk) {
-      FlowSummaryImpl::Private::summary(c, _, _,
-        FlowSummarySpecific::Private::TJumpSummaryOutput(target, rk), _, _)
+    TSummaryNode(SummarizedCallable c, FlowSummaryImpl::Private::SummaryNodeState state) {
+      FlowSummaryImpl::Private::summaryNodeRange(c, state)
     } or
     TParamsArgumentNode(ControlFlow::Node callCfn) {
       callCfn = any(Call c | isParamsArg(c, _, _)).getAControlFlowNode()
@@ -705,7 +677,7 @@ private module Cached {
     or
     LocalFlow::localFlowCapturedVarStep(nodeFrom, nodeTo)
     or
-    FlowSummaryImpl::Private::localStep(nodeFrom, nodeTo, true)
+    FlowSummaryImpl::Private::Steps::summaryLocalStep(nodeFrom, nodeTo, true)
     or
     nodeTo.(ObjectCreationNode).getPreUpdateNode() = nodeFrom.(ObjectInitializerNode)
   }
@@ -725,7 +697,7 @@ private module Cached {
     or
     // Simple flow through library code is included in the exposed local
     // step relation, even though flow is technically inter-procedural
-    FlowSummaryImpl::Private::throughStep(nodeFrom, nodeTo, true)
+    FlowSummaryImpl::Private::Steps::summaryThroughStep(nodeFrom, nodeTo, true)
   }
 
   /**
@@ -746,7 +718,11 @@ private module Cached {
       flr.hasNonlocalValue()
     )
     or
-    succ = pred.(SummaryJumpNode).getAJumpTarget()
+    exists(JumpReturnKind jrk, DataFlowCall call |
+      FlowSummaryImpl::Private::summaryReturnNode(pred, jrk) and
+      viableCallable(call) = jrk.getTarget() and
+      succ = getAnOutNode(call, jrk.getTargetReturnKind())
+    )
   }
 
   cached
@@ -783,7 +759,13 @@ private module Cached {
       c instanceof ElementContent
     )
     or
-    FlowSummaryImpl::Private::storeStep(node1, c, node2)
+    exists(Expr e |
+      e = node1.asExpr() and
+      node2.(AsyncReturnNode).getExpr() = e and
+      c = getResultContent()
+    )
+    or
+    FlowSummaryImpl::Private::Steps::summaryStoreStep(node1, c, node2)
   }
 
   pragma[nomagic]
@@ -847,7 +829,7 @@ private module Cached {
       )
     )
     or
-    FlowSummaryImpl::Private::readStep(node1, c, node2)
+    FlowSummaryImpl::Private::Steps::summaryReadStep(node1, c, node2)
   }
 
   /**
@@ -861,14 +843,10 @@ private module Cached {
     or
     fieldOrPropertyStore(_, c, _, n.(ObjectInitializerNode).getInitializer(), false)
     or
-    FlowSummaryImpl::Private::storeStep(n, c, _) and
+    FlowSummaryImpl::Private::Steps::summaryStoresIntoArg(c, n) and
     not c instanceof ElementContent
     or
-    exists(SummaryInput input, DataFlowCall call, int i |
-      FlowSummaryImpl::Private::clearsContent(input, call, c) and
-      input = SummaryInput::parameter(i) and
-      n.(ArgumentNode).argumentOf(call, i)
-    )
+    FlowSummaryImpl::Private::Steps::summaryClearsContent(n, c)
     or
     exists(WithExpr we, ObjectInitializer oi, FieldOrProperty f |
       oi = we.getInitializer() and
@@ -930,11 +908,24 @@ private module Cached {
   }
 
   cached
-  predicate qualifierOutNode(DataFlowCall call, Node n) {
-    n.(ExprPostUpdateNode).getPreUpdateNode().(ExplicitArgumentNode).argumentOf(call, -1)
-    or
-    any(ObjectOrCollectionInitializerConfiguration x)
-        .hasExprPath(_, n.(ExprNode).getControlFlowNode(), _, call.getControlFlowNode())
+  predicate summaryOutNodeCached(DataFlowCall c, Node out, ReturnKind rk) {
+    FlowSummaryImpl::Private::summaryOutNode(c, out, rk)
+  }
+
+  cached
+  predicate summaryArgumentNodeCached(DataFlowCall c, Node arg, int i) {
+    FlowSummaryImpl::Private::summaryArgumentNode(c, arg, i)
+  }
+
+  cached
+  predicate summaryPostUpdateNodeCached(Node post, ParameterNode pre) {
+    FlowSummaryImpl::Private::summaryPostUpdateNode(post, pre)
+  }
+
+  cached
+  predicate summaryReturnNodeCached(Node ret, ReturnKind rk) {
+    FlowSummaryImpl::Private::summaryReturnNode(ret, rk) and
+    not rk instanceof JumpReturnKind
   }
 
   cached
@@ -960,13 +951,17 @@ private module Cached {
       not p.fromSource()
     )
     or
+    n = TInstanceParameterNode(any(Callable c | not c.fromSource()))
+    or
     n instanceof YieldReturnNode
     or
+    n instanceof AsyncReturnNode
+    or
     n instanceof ImplicitCapturedArgumentNode
     or
     n instanceof MallocNode
     or
-    n instanceof SummaryNodeImpl
+    n instanceof SummaryNode
     or
     n instanceof ParamsArgumentNode
     or
@@ -985,7 +980,7 @@ class SsaDefinitionNode extends NodeImpl, TSsaDefinitionNode {
   /** Gets the underlying SSA definition. */
   Ssa::Definition getDefinition() { result = def }
 
-  override Callable getEnclosingCallableImpl() { result = def.getEnclosingCallable() }
+  override DataFlowCallable getEnclosingCallableImpl() { result = def.getEnclosingCallable() }
 
   override Type getTypeImpl() { result = def.getSourceVariable().getType() }
 
@@ -996,9 +991,13 @@ class SsaDefinitionNode extends NodeImpl, TSsaDefinitionNode {
   override string toStringImpl() { result = def.toString() }
 }
 
-private module ParameterNodes {
-  abstract private class ParameterNodeImpl extends ParameterNode, NodeImpl { }
+abstract class ParameterNodeImpl extends NodeImpl {
+  abstract DotNet::Parameter getParameter();
 
+  abstract predicate isParameterOf(DataFlowCallable c, int i);
+}
+
+private module ParameterNodes {
   /**
    * The value of an explicit parameter at function entry, viewed as a node in a data
    * flow graph.
@@ -1038,9 +1037,11 @@ private module ParameterNodes {
     /** Gets the callable containing this implicit instance parameter. */
     Callable getCallable() { result = callable }
 
+    override DotNet::Parameter getParameter() { none() }
+
     override predicate isParameterOf(DataFlowCallable c, int pos) { callable = c and pos = -1 }
 
-    override Callable getEnclosingCallableImpl() { result = callable }
+    override DataFlowCallable getEnclosingCallableImpl() { result = callable }
 
     override Type getTypeImpl() { result = callable.getDeclaringType() }
 
@@ -1104,7 +1105,7 @@ private module ParameterNodes {
    * }                      }
    * ```
    */
-  class ImplicitCapturedParameterNode extends ParameterNode, SsaDefinitionNode {
+  class ImplicitCapturedParameterNode extends ParameterNodeImpl, SsaDefinitionNode {
     override SsaCapturedEntryDefinition def;
 
     ImplicitCapturedParameterNode() { def = this.getDefinition() }
@@ -1112,6 +1113,8 @@ private module ParameterNodes {
     /** Gets the captured variable that this implicit parameter models. */
     LocalScopeVariable getVariable() { result = def.getVariable() }
 
+    override DotNet::Parameter getParameter() { none() }
+
     override predicate isParameterOf(DataFlowCallable c, int i) {
       i = getParameterPosition(def) and
       c = this.getEnclosingCallable()
@@ -1213,7 +1216,7 @@ private module ArgumentNodes {
       )
     }
 
-    override Callable getEnclosingCallableImpl() { result = cfn.getEnclosingCallable() }
+    override DataFlowCallable getEnclosingCallableImpl() { result = cfn.getEnclosingCallable() }
 
     override Type getTypeImpl() { result = v.getType() }
 
@@ -1240,7 +1243,7 @@ private module ArgumentNodes {
 
     override ControlFlow::Node getControlFlowNodeImpl() { result = cfn }
 
-    override Callable getEnclosingCallableImpl() { result = cfn.getEnclosingCallable() }
+    override DataFlowCallable getEnclosingCallableImpl() { result = cfn.getEnclosingCallable() }
 
     override Type getTypeImpl() { result = cfn.getElement().(Expr).getType() }
 
@@ -1277,7 +1280,7 @@ private module ArgumentNodes {
       pos = this.getParameter().getPosition()
     }
 
-    override Callable getEnclosingCallableImpl() { result = callCfn.getEnclosingCallable() }
+    override DataFlowCallable getEnclosingCallableImpl() { result = callCfn.getEnclosingCallable() }
 
     override Type getTypeImpl() { result = this.getParameter().getType() }
 
@@ -1288,46 +1291,15 @@ private module ArgumentNodes {
     override string toStringImpl() { result = "[implicit array creation] " + callCfn }
   }
 
-  /**
-   * An argument node inside a callable with a flow summary, where the argument is
-   * passed to a supplied delegate. For example, in `ints.Select(Foo)` there is a
-   * node that represents the argument of the call to `Foo` inside `Select`.
-   */
-  class SummaryDelegateArgumentNode extends ArgumentNode, SummaryNodeImpl,
-    TSummaryDelegateArgumentNode {
-    private SummarizedCallable c;
-    private int delegateIndex;
-    private int parameterIndex;
+  private class SummaryArgumentNode extends SummaryNode, ArgumentNode {
+    private DataFlowCall c;
+    private int i;
 
-    SummaryDelegateArgumentNode() {
-      this = TSummaryDelegateArgumentNode(c, delegateIndex, parameterIndex)
-    }
-
-    override DataFlowCallable getEnclosingCallableImpl() { result = c }
-
-    override DotNet::Type getTypeImpl() {
-      result =
-        c.getParameter(delegateIndex)
-            .getType()
-            .(SystemLinqExpressions::DelegateExtType)
-            .getDelegateType()
-            .getParameter(parameterIndex)
-            .getType()
-    }
-
-    override ControlFlow::Node getControlFlowNodeImpl() { none() }
-
-    override Location getLocationImpl() { result = c.getLocation() }
-
-    override string toStringImpl() {
-      result =
-        "[summary] argument " + parameterIndex + " of delegate call, parameter " + parameterIndex +
-          " of " + c
-    }
+    SummaryArgumentNode() { summaryArgumentNodeCached(c, this, i) }
 
     override predicate argumentOf(DataFlowCall call, int pos) {
-      call = TSummaryDelegateCall(c, delegateIndex) and
-      pos = parameterIndex
+      call = c and
+      i = pos
     }
   }
 }
@@ -1343,19 +1315,18 @@ abstract class ReturnNode extends Node {
 private module ReturnNodes {
   /**
    * A data-flow node that represents an expression returned by a callable,
-   * either using a (`yield`) `return` statement or an expression body (`=>`).
+   * either using a `return` statement or an expression body (`=>`).
    */
   class ExprReturnNode extends ReturnNode, ExprNode {
     ExprReturnNode() {
       exists(DotNet::Callable c, DotNet::Expr e | e = this.getExpr() |
-        c.canReturn(e)
-        or
-        c.(Callable).canYieldReturn(e)
+        c.canReturn(e) and not c.(Modifiable).isAsync()
       )
     }
 
-    override ReturnKind getKind() {
-      any(DotNet::Callable c).canReturn(this.getExpr()) and result instanceof NormalReturnKind
+    override NormalReturnKind getKind() {
+      any(DotNet::Callable c).canReturn(this.getExpr()) and
+      exists(result)
     }
   }
 
@@ -1384,9 +1355,9 @@ private module ReturnNodes {
 
     YieldReturnStmt getYieldReturnStmt() { result = yrs }
 
-    override YieldReturnKind getKind() { any() }
+    override NormalReturnKind getKind() { any() }
 
-    override Callable getEnclosingCallableImpl() { result = yrs.getEnclosingCallable() }
+    override DataFlowCallable getEnclosingCallableImpl() { result = yrs.getEnclosingCallable() }
 
     override Type getTypeImpl() { result = yrs.getEnclosingCallable().getReturnType() }
 
@@ -1397,6 +1368,30 @@ private module ReturnNodes {
     override string toStringImpl() { result = yrs.toString() }
   }
 
+  /**
+   * A synthesized `return` node for returned expressions inside `async` methods.
+   */
+  class AsyncReturnNode extends ReturnNode, NodeImpl, TAsyncReturnNode {
+    private ControlFlow::Nodes::ElementNode cfn;
+    private Expr expr;
+
+    AsyncReturnNode() { this = TAsyncReturnNode(cfn) and expr = cfn.getElement() }
+
+    Expr getExpr() { result = expr }
+
+    override NormalReturnKind getKind() { any() }
+
+    override DataFlowCallable getEnclosingCallableImpl() { result = expr.getEnclosingCallable() }
+
+    override Type getTypeImpl() { result = expr.getEnclosingCallable().getReturnType() }
+
+    override ControlFlow::Node getControlFlowNodeImpl() { result = cfn }
+
+    override Location getLocationImpl() { result = expr.getLocation() }
+
+    override string toStringImpl() { result = expr.toString() }
+  }
+
   /**
    * The value of a captured variable as an implicit return from a call, viewed
    * as a node in a data flow graph.
@@ -1436,30 +1431,10 @@ private module ReturnNodes {
     }
   }
 
-  /** A return node for a callable with a flow summary. */
-  class SummaryReturnNode extends ReturnNode, SummaryNodeImpl, TSummaryReturnNode {
-    private SummarizedCallable sc;
+  private class SummaryReturnNode extends SummaryNode, ReturnNode {
     private ReturnKind rk;
 
-    SummaryReturnNode() { this = TSummaryReturnNode(sc, rk) }
-
-    override Callable getEnclosingCallableImpl() { result = sc }
-
-    override DotNet::Type getTypeImpl() {
-      rk instanceof NormalReturnKind and
-      result in [sc.getReturnType(), sc.(Constructor).getDeclaringType()]
-      or
-      rk instanceof QualifierReturnKind and
-      result = sc.getDeclaringType()
-      or
-      result = sc.getParameter(rk.(OutRefReturnKind).getPosition()).getType()
-    }
-
-    override ControlFlow::Node getControlFlowNodeImpl() { none() }
-
-    override Location getLocationImpl() { result = sc.getLocation() }
-
-    override string toStringImpl() { result = "[summary] return of kind " + rk + " inside " + sc }
+    SummaryReturnNode() { summaryReturnNodeCached(this, rk) }
 
     override ReturnKind getKind() { result = rk }
   }
@@ -1483,21 +1458,6 @@ private module OutNodes {
     result = TExplicitDelegateLikeCall(cfn, e)
   }
 
-  /** A valid return type for a method that uses `yield return`. */
-  private class YieldReturnType extends Type {
-    YieldReturnType() {
-      exists(Type t | t = this.getUnboundDeclaration() |
-        t instanceof SystemCollectionsIEnumerableInterface
-        or
-        t instanceof SystemCollectionsIEnumeratorInterface
-        or
-        t instanceof SystemCollectionsGenericIEnumerableTInterface
-        or
-        t instanceof SystemCollectionsGenericIEnumeratorInterface
-      )
-    }
-  }
-
   /**
    * A data-flow node that reads a value returned directly by a callable,
    * either via a C# call or a CIL call.
@@ -1518,9 +1478,6 @@ private module OutNodes {
       (
         kind instanceof NormalReturnKind and
         not call.getExpr().getType() instanceof VoidType
-        or
-        kind instanceof YieldReturnKind and
-        call.getExpr().getType() instanceof YieldReturnType
       )
     }
   }
@@ -1535,32 +1492,17 @@ private module OutNodes {
     ) {
       exactScope = false and
       scope = e1 and
-      isSuccessor = false and
-      (
+      isSuccessor = true and
+      exists(ObjectOrCollectionInitializer init | init = e1.(ObjectCreation).getInitializer() |
         // E.g. `new Dictionary<int, string>{ {0, "a"}, {1, "b"} }`
-        e1.(CollectionInitializer).getAnElementInitializer() = e2
+        e2 = init.(CollectionInitializer).getAnElementInitializer()
         or
         // E.g. `new Dictionary<int, string>() { [0] = "a", [1] = "b" }`
-        e1.(ObjectInitializer).getAMemberInitializer().getLValue() = e2
+        e2 = init.(ObjectInitializer).getAMemberInitializer().getLValue()
       )
     }
   }
 
-  /**
-   * A data-flow node that contains a value returned by a callable, by writing
-   * to the qualifier of the call.
-   */
-  private class QualifierOutNode extends OutNode, Node {
-    private DataFlowCall call;
-
-    QualifierOutNode() { qualifierOutNode(call, this) }
-
-    override DataFlowCall getCall(ReturnKind kind) {
-      result = call and
-      kind instanceof QualifierReturnKind
-    }
-  }
-
   /**
    * A data-flow node that reads a value returned implicitly by a callable
    * using a captured variable.
@@ -1606,39 +1548,15 @@ private module OutNodes {
     }
   }
 
-  /**
-   * An output node inside a callable with a flow summary, where the output is the
-   * result of calling a supplied delegate. For example, in `ints.Select(Foo)` there
-   * is a node that represents the output of calling `Foo` inside `Select`.
-   */
-  private class SummaryDelegateOutNode extends OutNode, SummaryNodeImpl, TSummaryDelegateOutNode {
-    private SummarizedCallable c;
-    private int pos;
+  private class SummaryOutNode extends SummaryNode, OutNode {
+    private DataFlowCall c;
+    private ReturnKind rk;
 
-    SummaryDelegateOutNode() { this = TSummaryDelegateOutNode(c, pos) }
+    SummaryOutNode() { summaryOutNodeCached(c, this, rk) }
 
-    override Callable getEnclosingCallableImpl() { result = c }
-
-    override DotNet::Type getTypeImpl() {
-      result =
-        c.getParameter(pos)
-            .getType()
-            .(SystemLinqExpressions::DelegateExtType)
-            .getDelegateType()
-            .getReturnType()
-    }
-
-    override ControlFlow::Node getControlFlowNodeImpl() { none() }
-
-    override Location getLocationImpl() { result = c.getLocation() }
-
-    override string toStringImpl() {
-      result = "[summary] output from delegate call, parameter " + pos + " of " + c + "]"
-    }
-
-    override SummaryDelegateCall getCall(ReturnKind kind) {
-      result = TSummaryDelegateCall(c, pos) and
-      kind instanceof NormalReturnKind
+    override DataFlowCall getCall(ReturnKind kind) {
+      result = c and
+      kind = rk
     }
   }
 }
@@ -1646,15 +1564,17 @@ private module OutNodes {
 import OutNodes
 
 /** A data-flow node used to model flow summaries. */
-private class SummaryInternalNode extends SummaryNodeImpl, TSummaryInternalNode {
+private class SummaryNode extends NodeImpl, TSummaryNode {
   private SummarizedCallable c;
-  private FlowSummaryImpl::Private::SummaryInternalNodeState state;
+  private FlowSummaryImpl::Private::SummaryNodeState state;
 
-  SummaryInternalNode() { this = TSummaryInternalNode(c, state) }
+  SummaryNode() { this = TSummaryNode(c, state) }
 
   override DataFlowCallable getEnclosingCallableImpl() { result = c }
 
-  override DataFlowType getDataFlowType() { result = state.getType() }
+  override DataFlowType getDataFlowType() {
+    result = FlowSummaryImpl::Private::summaryNodeType(this)
+  }
 
   override DotNet::Type getTypeImpl() { none() }
 
@@ -1665,28 +1585,6 @@ private class SummaryInternalNode extends SummaryNodeImpl, TSummaryInternalNode
   override string toStringImpl() { result = "[summary] " + state + " in " + c }
 }
 
-/** A data-flow node used to model flow summaries with jumps. */
-private class SummaryJumpNode extends SummaryNodeImpl, TSummaryJumpNode {
-  private SummarizedCallable c;
-  private SummarizableCallable target;
-  private ReturnKind rk;
-
-  SummaryJumpNode() { this = TSummaryJumpNode(c, target, rk) }
-
-  /** Gets a jump target of this node. */
-  OutNode getAJumpTarget() { target = viableCallable(result.getCall(rk)) }
-
-  override Callable getEnclosingCallableImpl() { result = c }
-
-  override DotNet::Type getTypeImpl() { result = target.getReturnType() }
-
-  override ControlFlow::Node getControlFlowNodeImpl() { none() }
-
-  override Location getLocationImpl() { result = c.getLocation() }
-
-  override string toStringImpl() { result = "[summary] jump to " + target }
-}
-
 /** A field or a property. */
 class FieldOrProperty extends Assignable, Modifiable {
   FieldOrProperty() {
@@ -1921,7 +1819,7 @@ private module PostUpdateNodes {
    * Such a node acts as both a post-update node for the `MallocNode`, as well as
    * a pre-update node for the `ObjectCreationNode`.
    */
-  class ObjectInitializerNode extends PostUpdateNode, NodeImpl, TObjectInitializerNode {
+  class ObjectInitializerNode extends PostUpdateNode, NodeImpl, ArgumentNode, TObjectInitializerNode {
     private ObjectCreation oc;
     private ControlFlow::Nodes::ElementNode cfn;
 
@@ -1935,7 +1833,13 @@ private module PostUpdateNodes {
 
     override MallocNode getPreUpdateNode() { result.getControlFlowNode() = cfn }
 
-    override Callable getEnclosingCallableImpl() { result = cfn.getEnclosingCallable() }
+    override predicate argumentOf(DataFlowCall call, int pos) {
+      pos = -1 and
+      any(ObjectOrCollectionInitializerConfiguration x)
+          .hasExprPath(_, cfn, _, call.getControlFlowNode())
+    }
+
+    override DataFlowCallable getEnclosingCallableImpl() { result = cfn.getEnclosingCallable() }
 
     override DotNet::Type getTypeImpl() { result = oc.getType() }
 
@@ -1953,7 +1857,7 @@ private module PostUpdateNodes {
 
     override ExprNode getPreUpdateNode() { cfn = result.getControlFlowNode() }
 
-    override Callable getEnclosingCallableImpl() { result = cfn.getEnclosingCallable() }
+    override DataFlowCallable getEnclosingCallableImpl() { result = cfn.getEnclosingCallable() }
 
     override Type getTypeImpl() { result = cfn.getElement().(Expr).getType() }
 
@@ -1963,6 +1867,14 @@ private module PostUpdateNodes {
 
     override string toStringImpl() { result = "[post] " + cfn.toString() }
   }
+
+  private class SummaryPostUpdateNode extends SummaryNode, PostUpdateNode {
+    private Node pre;
+
+    SummaryPostUpdateNode() { summaryPostUpdateNodeCached(this, pre) }
+
+    override Node getPreUpdateNode() { result = pre }
+  }
 }
 
 private import PostUpdateNodes
@@ -2022,3 +1934,69 @@ class Unit extends TUnit {
  * This predicate is only used for consistency checks.
  */
 predicate isImmutableOrUnobservable(Node n) { none() }
+
+class LambdaCallKind = Unit;
+
+/** Holds if `creation` is an expression that creates a delegate for `c`. */
+predicate lambdaCreation(ExprNode creation, LambdaCallKind kind, DataFlowCallable c) {
+  exists(Expr e | e = creation.getExpr() |
+    c = e.(AnonymousFunctionExpr)
+    or
+    c = e.(CallableAccess).getTarget().getUnboundDeclaration()
+    or
+    c = e.(AddressOfExpr).getOperand().(CallableAccess).getTarget().getUnboundDeclaration()
+  ) and
+  kind = TMkUnit()
+}
+
+private class LambdaConfiguration extends ControlFlowReachabilityConfiguration {
+  LambdaConfiguration() { this = "LambdaConfiguration" }
+
+  override predicate candidate(
+    Expr e1, Expr e2, ControlFlowElement scope, boolean exactScope, boolean isSuccessor
+  ) {
+    e1 = e2.(DelegateLikeCall).getExpr() and
+    exactScope = false and
+    scope = e2 and
+    isSuccessor = true
+    or
+    e1 = e2.(DelegateCreation).getArgument() and
+    exactScope = false and
+    scope = e2 and
+    isSuccessor = true
+  }
+}
+
+/** Holds if `call` is a lambda call where `receiver` is the lambda expression. */
+predicate lambdaCall(DataFlowCall call, LambdaCallKind kind, Node receiver) {
+  (
+    exists(LambdaConfiguration x, DelegateLikeCall dc |
+      x.hasExprPath(dc.getExpr(), receiver.(ExprNode).getControlFlowNode(), dc,
+        call.getControlFlowNode())
+    )
+    or
+    receiver = call.(SummaryCall).getReceiver()
+  ) and
+  kind = TMkUnit()
+}
+
+/** Extra data-flow steps needed for lamba flow analysis. */
+predicate additionalLambdaFlowStep(Node nodeFrom, Node nodeTo, boolean preservesValue) {
+  exists(Ssa::Definition def |
+    LocalFlow::localSsaFlowStep(def, nodeFrom, nodeTo) and
+    LocalFlow::usesInstanceField(def) and
+    preservesValue = true
+  )
+  or
+  exists(LambdaConfiguration x, DelegateCreation dc |
+    x.hasExprPath(dc.getArgument(), nodeFrom.(ExprNode).getControlFlowNode(), dc,
+      nodeTo.(ExprNode).getControlFlowNode()) and
+    preservesValue = false
+  )
+  or
+  exists(AddEventExpr aee |
+    nodeFrom.asExpr() = aee.getRValue() and
+    nodeTo.asExpr().(EventRead).getTarget() = aee.getTarget() and
+    preservesValue = false
+  )
+}
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPublic.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPublic.qll
index 13ca7658240..dd6e72d54f6 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPublic.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPublic.qll
@@ -47,14 +47,14 @@ class Node extends TNode {
   cached
   final DataFlowCallable getEnclosingCallable() {
     Stages::DataFlowStage::forceCachingInSameStage() and
-    result = unique(DataFlowCallable c | c = this.(NodeImpl).getEnclosingCallableImpl() | c)
+    result = this.(NodeImpl).getEnclosingCallableImpl()
   }
 
   /** Gets the control flow node corresponding to this node, if any. */
   cached
   final ControlFlow::Node getControlFlowNode() {
     Stages::DataFlowStage::forceCachingInSameStage() and
-    result = unique(ControlFlow::Node n | n = this.(NodeImpl).getControlFlowNodeImpl() | n)
+    result = this.(NodeImpl).getControlFlowNodeImpl()
   }
 
   /** Gets a textual representation of this node. */
@@ -117,22 +117,18 @@ class ExprNode extends Node {
  * flow graph.
  */
 class ParameterNode extends Node {
-  ParameterNode() {
-    // charpred needed to avoid making `ParameterNode` abstract
-    this = TExplicitParameterNode(_) or
-    this.(SsaDefinitionNode).getDefinition() instanceof
-      ImplicitCapturedParameterNodeImpl::SsaCapturedEntryDefinition or
-    this = TInstanceParameterNode(_)
-  }
+  private ParameterNodeImpl p;
+
+  ParameterNode() { this = p }
 
   /** Gets the parameter corresponding to this node, if any. */
-  DotNet::Parameter getParameter() { none() }
+  DotNet::Parameter getParameter() { result = p.getParameter() }
 
   /**
    * Holds if this node is the parameter of callable `c` at the specified
    * (zero-based) position.
    */
-  predicate isParameterOf(DataFlowCallable c, int i) { none() }
+  predicate isParameterOf(DataFlowCallable c, int i) { p.isParameterOf(c, i) }
 }
 
 /** A definition, viewed as a node in a data flow graph. */
@@ -236,7 +232,7 @@ class FieldContent extends Content, TFieldContent {
   /** Gets the field that is referenced. */
   Field getField() { result = f }
 
-  override string toString() { result = f.toString() }
+  override string toString() { result = "field " + f.getName() }
 
   override Location getLocation() { result = f.getLocation() }
 
@@ -256,7 +252,7 @@ class PropertyContent extends Content, TPropertyContent {
   /** Gets the property that is referenced. */
   Property getProperty() { result = p }
 
-  override string toString() { result = p.toString() }
+  override string toString() { result = "property " + p.getName() }
 
   override Location getLocation() { result = p.getLocation() }
 
@@ -269,7 +265,7 @@ class PropertyContent extends Content, TPropertyContent {
 
 /** A reference to an element in a collection. */
 class ElementContent extends Content, TElementContent {
-  override string toString() { result = "[]" }
+  override string toString() { result = "element" }
 
   override Location getLocation() { result instanceof EmptyLocation }
 }
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DelegateDataFlow.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DelegateDataFlow.qll
index e6b15b95d7f..df6f62a3975 100755
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DelegateDataFlow.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DelegateDataFlow.qll
@@ -1,4 +1,6 @@
 /**
+ * DEPRECATED.
+ *
  * INTERNAL: Do not use.
  *
  * Provides classes for resolving delegate calls.
@@ -108,7 +110,7 @@ abstract private class DelegateLikeFlowSink extends DataFlow::Node {
    * possible delegates resolved on line 6.
    */
   cached
-  Callable getARuntimeTarget(CallContext context) {
+  deprecated Callable getARuntimeTarget(CallContext context) {
     exists(DelegateLikeFlowSource dfs |
       flowsFrom(this, dfs, _, context) and
       result = dfs.getCallable()
@@ -117,7 +119,7 @@ abstract private class DelegateLikeFlowSink extends DataFlow::Node {
 }
 
 /** A delegate or function pointer call expression. */
-class DelegateLikeCallExpr extends DelegateLikeFlowSink, DataFlow::ExprNode {
+deprecated class DelegateLikeCallExpr extends DelegateLikeFlowSink, DataFlow::ExprNode {
   DelegateLikeCall dc;
 
   DelegateLikeCallExpr() { this.getExpr() = dc.getExpr() }
@@ -126,16 +128,8 @@ class DelegateLikeCallExpr extends DelegateLikeFlowSink, DataFlow::ExprNode {
   DelegateLikeCall getCall() { result = dc }
 }
 
-/** A parameter of delegate type belonging to a callable with a flow summary. */
-class SummaryDelegateParameterSink extends DelegateLikeFlowSink, ParameterNode {
-  SummaryDelegateParameterSink() {
-    this.getType() instanceof SystemLinqExpressions::DelegateExtType and
-    this.isParameterOf(any(SummarizedCallable c), _)
-  }
-}
-
 /** A delegate expression that is added to an event. */
-class AddEventSource extends DelegateLikeFlowSink, DataFlow::ExprNode {
+deprecated class AddEventSource extends DelegateLikeFlowSink, DataFlow::ExprNode {
   AddEventExpr ae;
 
   AddEventSource() { this.getExpr() = ae.getRValue() }
@@ -173,7 +167,7 @@ private class NormalReturnNode extends Node {
  * `node` goes through a returned expression. The call context `lastCall`
  * records the last call on the path from `node` to `sink`, if any.
  */
-private predicate flowsFrom(
+deprecated private predicate flowsFrom(
   DelegateLikeFlowSink sink, DataFlow::Node node, boolean isReturned, CallContext lastCall
 ) {
   // Base case
@@ -244,7 +238,7 @@ private predicate flowsFrom(
  * previous call if it exists, otherwise `call` is the last call.
  */
 bindingset[call, i]
-private CallContext getLastCall(CallContext prevLastCall, Expr call, int i) {
+deprecated private CallContext getLastCall(CallContext prevLastCall, Expr call, int i) {
   prevLastCall instanceof EmptyCallContext and
   result.(ArgumentCallContext).isArgument(call, i)
   or
@@ -263,7 +257,7 @@ private predicate flowIntoNonDelegateCall(NonDelegateCall call, Expr arg, DotNet
 }
 
 pragma[noinline]
-private predicate flowIntoDelegateCall(DelegateLikeCall call, Callable c, Expr arg, int i) {
+deprecated private predicate flowIntoDelegateCall(DelegateLikeCall call, Callable c, Expr arg, int i) {
   exists(DelegateLikeFlowSource dfs, DelegateLikeCallExpr dce |
     // the call context is irrelevant because the delegate call
     // itself will be the context
@@ -280,7 +274,7 @@ private predicate flowOutOfNonDelegateCall(NonDelegateCall call, NormalReturnNod
 }
 
 pragma[noinline]
-private predicate flowOutOfDelegateCall(
+deprecated private predicate flowOutOfDelegateCall(
   DelegateLikeCall dc, NormalReturnNode ret, CallContext lastCall
 ) {
   exists(DelegateLikeFlowSource dfs, DelegateLikeCallExpr dce, Callable c |
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll
index 2a258d04f2e..3c8c94c913c 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll
@@ -1,127 +1,174 @@
 /**
- * Provides classes and predicates for definining flow summaries.
+ * Provides classes and predicates for defining flow summaries.
  *
- * The definitions in this file are language-independant, and language-specific
- * definitions are passed in via the `FlowSummarySpecific` module.
+ * The definitions in this file are language-independent, and language-specific
+ * definitions are passed in via the `DataFlowImplSpecific` and
+ * `FlowSummaryImplSpecific` modules.
  */
 
-private import FlowSummarySpecific::Private
+private import FlowSummaryImplSpecific
+private import DataFlowImplSpecific::Private
+private import DataFlowImplSpecific::Public
 
-/**
- * Provides classes and predicates for definining flow summaries.
- */
+/** Provides classes and predicates for defining flow summaries. */
 module Public {
-  import FlowSummarySpecific::Public
+  private import Private
 
-  private newtype TContentList =
-    TNilContentList() or
-    TConsContentList(Content head, ContentList tail) {
-      tail = TNilContentList()
+  /**
+   * A component used in a flow summary.
+   *
+   * Either a parameter or an argument at a given position, a specific
+   * content type, or a return kind.
+   */
+  class SummaryComponent extends TSummaryComponent {
+    /** Gets a textual representation of this summary component. */
+    string toString() {
+      exists(Content c | this = TContentSummaryComponent(c) and result = c.toString())
       or
-      any(SummarizedCallable c).requiresContentList(head, tail) and
-      tail.length() < accessPathLimit()
+      exists(int i | this = TParameterSummaryComponent(i) and result = "parameter " + i)
+      or
+      exists(int i | this = TArgumentSummaryComponent(i) and result = "argument " + i)
+      or
+      exists(ReturnKind rk | this = TReturnSummaryComponent(rk) and result = "return (" + rk + ")")
+    }
+  }
+
+  /** Provides predicates for constructing summary components. */
+  module SummaryComponent {
+    /** Gets a summary component for content `c`. */
+    SummaryComponent content(Content c) { result = TContentSummaryComponent(c) }
+
+    /** Gets a summary component for parameter `i`. */
+    SummaryComponent parameter(int i) { result = TParameterSummaryComponent(i) }
+
+    /** Gets a summary component for argument `i`. */
+    SummaryComponent argument(int i) { result = TArgumentSummaryComponent(i) }
+
+    /** Gets a summary component for a return of kind `rk`. */
+    SummaryComponent return(ReturnKind rk) { result = TReturnSummaryComponent(rk) }
+  }
+
+  /**
+   * A (non-empty) stack of summary components.
+   *
+   * A stack is used to represent where data is read from (input) or where it
+   * is written to (output). For example, an input stack `[Field f, Argument 0]`
+   * means that data is read from field `f` from the `0`th argument, while an
+   * output stack `[Field g, Return]` means that data is written to the field
+   * `g` of the returned object.
+   */
+  class SummaryComponentStack extends TSummaryComponentStack {
+    /** Gets the head of this stack. */
+    SummaryComponent head() {
+      this = TSingletonSummaryComponentStack(result) or
+      this = TConsSummaryComponentStack(result, _)
     }
 
-  /** A content list. */
-  class ContentList extends TContentList {
-    /** Gets the head of this content list, if any. */
-    Content head() { this = TConsContentList(result, _) }
+    /** Gets the tail of this stack, if any. */
+    SummaryComponentStack tail() { this = TConsSummaryComponentStack(_, result) }
 
-    /** Gets the tail of this content list, if any. */
-    ContentList tail() { this = TConsContentList(_, result) }
-
-    /** Gets the length of this content list. */
+    /** Gets the length of this stack. */
     int length() {
-      this = TNilContentList() and result = 0
+      this = TSingletonSummaryComponentStack(_) and result = 1
       or
       result = 1 + this.tail().length()
     }
 
-    /** Gets the content list obtained by dropping the first `i` elements, if any. */
-    ContentList drop(int i) {
+    /** Gets the stack obtained by dropping the first `i` elements, if any. */
+    SummaryComponentStack drop(int i) {
       i = 0 and result = this
       or
       result = this.tail().drop(i - 1)
     }
 
-    /** Holds if this content list contains content `c`. */
-    predicate contains(Content c) { c = this.drop(_).head() }
+    /** Holds if this stack contains summary component `c`. */
+    predicate contains(SummaryComponent c) { c = this.drop(_).head() }
 
-    /** Gets a textual representation of this content list. */
+    /** Gets a textual representation of this stack. */
     string toString() {
-      exists(Content head, ContentList tail |
+      exists(SummaryComponent head, SummaryComponentStack tail |
         head = this.head() and
         tail = this.tail() and
-        if tail.length() = 0 then result = head.toString() else result = head + ", " + tail
+        result = head + " of " + tail
       )
       or
-      this = TNilContentList() and
-      result = "<empty>"
+      exists(SummaryComponent c |
+        this = TSingletonSummaryComponentStack(c) and
+        result = c.toString()
+      )
     }
   }
 
-  /** Provides predicates for constructing content lists. */
-  module ContentList {
-    /** Gets the empty content list. */
-    ContentList empty() { result = TNilContentList() }
+  /** Provides predicates for constructing stacks of summary components. */
+  module SummaryComponentStack {
+    /** Gets a singleton stack containing `c`. */
+    SummaryComponentStack singleton(SummaryComponent c) {
+      result = TSingletonSummaryComponentStack(c)
+    }
 
-    /** Gets a singleton content list containing `c`. */
-    ContentList singleton(Content c) { result = TConsContentList(c, TNilContentList()) }
-
-    /** Gets the content list obtained by consing `head` onto `tail`. */
-    ContentList cons(Content head, ContentList tail) { result = TConsContentList(head, tail) }
-  }
-
-  /** A callable with flow summaries. */
-  abstract class SummarizedCallable extends SummarizableCallable {
     /**
-     * Holds if data may flow from `input` to `output` through this callable.
+     * Gets the stack obtained by pushing `head` onto `tail`.
      *
-     * `preservesValue` indicates whether this is a value-preserving step
-     * or a taint-step.
+     * Make sure to override `RequiredSummaryComponentStack::required()` in order
+     * to ensure that the constructed stack exists.
      */
-    pragma[nomagic]
-    predicate propagatesFlow(SummaryInput input, SummaryOutput output, boolean preservesValue) {
-      none()
+    SummaryComponentStack push(SummaryComponent head, SummaryComponentStack tail) {
+      result = TConsSummaryComponentStack(head, tail)
     }
 
+    /** Gets a singleton stack for argument `i`. */
+    SummaryComponentStack argument(int i) { result = singleton(SummaryComponent::argument(i)) }
+
+    /** Gets a singleton stack representing a return of kind `rk`. */
+    SummaryComponentStack return(ReturnKind rk) { result = singleton(SummaryComponent::return(rk)) }
+  }
+
+  /**
+   * A class that exists for QL technical reasons only (the IPA type used
+   * to represent component stacks needs to be bounded).
+   */
+  abstract class RequiredSummaryComponentStack extends SummaryComponentStack {
+    /**
+     * Holds if the stack obtained by pushing `head` onto `tail` is required.
+     */
+    abstract predicate required(SummaryComponent c);
+  }
+
+  /** A callable with a flow summary. */
+  abstract class SummarizedCallable extends DataFlowCallable {
     /**
      * Holds if data may flow from `input` to `output` through this callable.
      *
-     * `inputContents` describes the contents that is popped from the access
-     * path from the input and `outputContents` describes the contents that
-     * is pushed onto the resulting access path.
-     *
      * `preservesValue` indicates whether this is a value-preserving step
      * or a taint-step.
+     *
+     * Input specifications are restricted to stacks that end with
+     * `SummaryComponent::argument(_)`, preceded by zero or more
+     * `SummaryComponent::return(_)` or `SummaryComponent::content(_)` components.
+     *
+     * Output specifications are restricted to stacks that end with
+     * `SummaryComponent::return(_)` or `SummaryComponent::argument(_)`.
+     *
+     * Output stacks ending with `SummaryComponent::return(_)` can be preceded by zero
+     * or more `SummaryComponent::content(_)` components.
+     *
+     * Output stacks ending with `SummaryComponent::argument(_)` can be preceded by an
+     * optional `SummaryComponent::parameter(_)` component, which in turn can be preceded
+     * by zero or more `SummaryComponent::content(_)` components.
      */
     pragma[nomagic]
     predicate propagatesFlow(
-      SummaryInput input, ContentList inputContents, SummaryOutput output,
-      ContentList outputContents, boolean preservesValue
+      SummaryComponentStack input, SummaryComponentStack output, boolean preservesValue
     ) {
       none()
     }
 
-    /**
-     * Holds if the content list obtained by consing `head` onto `tail` is needed
-     * for a summary specified by `propagatesFlow()`.
-     *
-     * This predicate is needed for QL technical reasons only (the IPA type used
-     * to represent content lists needs to be bounded).
-     *
-     * Only summaries using content lists of length >= 2 need to override this
-     * predicate.
-     */
-    pragma[nomagic]
-    predicate requiresContentList(Content head, ContentList tail) { none() }
-
     /**
      * Holds if values stored inside `content` are cleared on objects passed as
-     * arguments of type `input` to this callable.
+     * the `i`th argument to this callable.
      */
     pragma[nomagic]
-    predicate clearsContent(SummaryInput input, Content content) { none() }
+    predicate clearsContent(int i, Content content) { none() }
   }
 }
 
@@ -131,340 +178,497 @@ module Public {
  */
 module Private {
   private import Public
-  private import DataFlowDispatch
-  private import FlowSummarySpecific::Public
+  private import DataFlowImplCommon as DataFlowImplCommon
+
+  newtype TSummaryComponent =
+    TContentSummaryComponent(Content c) or
+    TParameterSummaryComponent(int i) { parameterPosition(i) } or
+    TArgumentSummaryComponent(int i) { parameterPosition(i) } or
+    TReturnSummaryComponent(ReturnKind rk)
+
+  newtype TSummaryComponentStack =
+    TSingletonSummaryComponentStack(SummaryComponent c) or
+    TConsSummaryComponentStack(SummaryComponent head, SummaryComponentStack tail) {
+      tail.(RequiredSummaryComponentStack).required(head)
+    }
 
-  /**
-   * Holds if data may flow from `input` to `output` when calling `c`.
-   *
-   * `inputContents` describes the contents that is popped from the access
-   * path from the input and `outputContents` describes the contents that
-   * is pushed onto the resulting access path.
-   *
-   * `preservesValue` indicates whether this is a value-preserving step
-   * or a taint-step.
-   */
   pragma[nomagic]
-  predicate summary(
-    SummarizedCallable c, SummaryInput input, ContentList inputContents, SummaryOutput output,
-    ContentList outputContents, boolean preservesValue
+  private predicate summary(
+    SummarizedCallable c, SummaryComponentStack input, SummaryComponentStack output,
+    boolean preservesValue
   ) {
-    c.propagatesFlow(input, output, preservesValue) and
-    inputContents = ContentList::empty() and
-    outputContents = ContentList::empty()
-    or
-    c.propagatesFlow(input, inputContents, output, outputContents, preservesValue)
+    c.propagatesFlow(input, output, preservesValue)
   }
 
-  /** Gets the `i`th element in `l`. */
-  pragma[noinline]
-  private Content getContent(ContentList l, int i) { result = l.drop(i).head() }
-
-  private newtype TContentListRev =
-    TConsNilContentListRev(Content c) or
-    TConsContentListRev(Content head, ContentListRev tail) {
-      exists(ContentList l, int i |
-        tail = reverse(l, i) and
-        head = getContent(l, i)
-      )
-    }
-
-  /**
-   * Gets the reversed content list that contains the `i` first elements of `l`
-   * in reverse order.
-   */
-  private ContentListRev reverse(ContentList l, int i) {
-    exists(Content head |
-      result = TConsNilContentListRev(head) and
-      head = l.head() and
-      i = 1
-      or
-      exists(ContentListRev tail |
-        result = TConsContentListRev(head, tail) and
-        tail = reverse(l, i - 1) and
-        head = getContent(l, i - 1)
-      )
-    )
-  }
-
-  /** A reversed, non-empty content list. */
-  private class ContentListRev extends TContentListRev {
-    /** Gets the head of this reversed content list. */
-    Content head() {
-      this = TConsNilContentListRev(result) or this = TConsContentListRev(result, _)
-    }
-
-    /** Gets the tail of this reversed content list, if any. */
-    ContentListRev tail() { this = TConsContentListRev(_, result) }
-
-    /** Gets the length of this reversed content list. */
-    int length() {
-      this = TConsNilContentListRev(_) and result = 1
-      or
-      result = 1 + this.tail().length()
-    }
-
-    /** Gets a textual representation of this reversed content list. */
-    string toString() {
-      exists(Content head |
-        this = TConsNilContentListRev(head) and
-        result = head.toString()
-        or
-        exists(ContentListRev tail |
-          head = this.head() and
-          tail = this.tail() and
-          result = head + ", " + tail
-        )
-      )
-    }
-  }
-
-  private newtype TSummaryInternalNodeState =
-    TSummaryInternalNodeReadState(SummaryInput input, ContentListRev l) {
-      exists(ContentList inputContents |
-        summary(_, input, inputContents, _, _, _) and
-        l = reverse(inputContents, _)
+  private newtype TSummaryNodeState =
+    TSummaryNodeInputState(SummaryComponentStack s) {
+      exists(SummaryComponentStack input |
+        summary(_, input, _, _) and
+        s = input.drop(_)
       )
     } or
-    TSummaryInternalNodeStoreState(SummaryOutput output, ContentListRev l) {
-      exists(ContentList outputContents |
-        summary(_, _, _, output, outputContents, _) and
-        l = reverse(outputContents, _)
+    TSummaryNodeOutputState(SummaryComponentStack s) {
+      exists(SummaryComponentStack output |
+        summary(_, _, output, _) and
+        s = output.drop(_)
       )
     }
 
   /**
    * A state used to break up (complex) flow summaries into atomic flow steps.
-   * For a flow summary with input `input`, input contents `inputContents`, output
-   * `output`, and output contents `outputContents`, the following states are used:
+   * For a flow summary
    *
-   * - `TSummaryInternalNodeReadState(SummaryInput input, ContentListRev l)`:
-   *   this state represents that the contents in `l` has been read from `input`,
-   *   where `l` is a reversed, non-empty suffix of `inputContents`.
-   * - `TSummaryInternalNodeStoreState(SummaryOutput output, ContentListRev l)`:
-   *   this state represents that the contents of `l` remains to be stored into
-   *   `output`, where `l` is a reversed, non-empty suffix of `outputContents`.
+   * ```ql
+   * propagatesFlow(
+   *   SummaryComponentStack input, SummaryComponentStack output, boolean preservesValue
+   * )
+   * ```
+   *
+   * the following states are used:
+   *
+   * - `TSummaryNodeInputState(SummaryComponentStack s)`:
+   *   this state represents that the components in `s` _have been read_ from the
+   *   input.
+   * - `TSummaryNodeOutputState(SummaryComponentStack s)`:
+   *   this state represents that the components in `s` _remain to be written_ to
+   *   the output.
    */
-  class SummaryInternalNodeState extends TSummaryInternalNodeState {
-    /**
-     * Holds if this state represents that the `i` first elements of `inputContents`
-     * have been read from `input` in `c`.
-     */
+  class SummaryNodeState extends TSummaryNodeState {
+    /** Holds if this state is a valid input state for `c`. */
     pragma[nomagic]
-    predicate isReadState(SummarizedCallable c, SummaryInput input, ContentList inputContents, int i) {
-      this = TSummaryInternalNodeReadState(input, reverse(inputContents, i)) and
-      summary(c, input, inputContents, _, _, _)
+    predicate isInputState(SummarizedCallable c, SummaryComponentStack s) {
+      this = TSummaryNodeInputState(s) and
+      exists(SummaryComponentStack input |
+        summary(c, input, _, _) and
+        s = input.drop(_)
+      )
     }
 
-    /**
-     * Holds if this state represents that the `i` first elements of `outputContents`
-     * remain to be stored into `output` in `c`.
-     */
+    /** Holds if this state is a valid output state for `c`. */
     pragma[nomagic]
-    predicate isStoreState(
-      SummarizedCallable c, SummaryOutput output, ContentList outputContents, int i
-    ) {
-      this = TSummaryInternalNodeStoreState(output, reverse(outputContents, i)) and
-      summary(c, _, _, output, outputContents, _)
-    }
-
-    /** Gets the type of a node in this state. */
-    DataFlowType getType() {
-      exists(ContentListRev l | result = getContentType(l.head()) |
-        this = TSummaryInternalNodeReadState(_, l)
-        or
-        this = TSummaryInternalNodeStoreState(_, l)
+    predicate isOutputState(SummarizedCallable c, SummaryComponentStack s) {
+      this = TSummaryNodeOutputState(s) and
+      exists(SummaryComponentStack output |
+        summary(c, _, output, _) and
+        s = output.drop(_)
       )
     }
 
     /** Gets a textual representation of this state. */
     string toString() {
-      exists(SummaryInput input, ContentListRev l |
-        this = TSummaryInternalNodeReadState(input, l) and
-        result = "input: " + input + ", read: " + l
+      exists(SummaryComponentStack s |
+        this = TSummaryNodeInputState(s) and
+        result = "read: " + s
       )
       or
-      exists(SummaryOutput output, ContentListRev l |
-        this = TSummaryInternalNodeStoreState(output, l) and
-        result = "output: " + output + ", to store: " + l
+      exists(SummaryComponentStack s |
+        this = TSummaryNodeOutputState(s) and
+        result = "to write: " + s
       )
     }
   }
 
   /**
-   * Holds if an internal summary node is needed for the state `state` in summarized
+   * Holds if `state` represents having read the `i`th argument for `c`. In this case
+   * we are not synthesizing a data-flow node, but instead assume that a relevant
+   * parameter node already exists.
+   */
+  private predicate parameterReadState(SummarizedCallable c, SummaryNodeState state, int i) {
+    state.isInputState(c, SummaryComponentStack::argument(i))
+  }
+
+  /**
+   * Holds if a synthesized summary node is needed for the state `state` in summarized
    * callable `c`.
    */
-  predicate internalNodeRange(SummarizedCallable c, SummaryInternalNodeState state) {
-    state.isReadState(c, _, _, _)
+  predicate summaryNodeRange(SummarizedCallable c, SummaryNodeState state) {
+    state.isInputState(c, _) and
+    not parameterReadState(c, state, _)
     or
-    state.isStoreState(c, _, _, _)
+    state.isOutputState(c, _)
   }
 
   pragma[noinline]
-  private Node internalNodeLastReadState(
-    SummarizedCallable c, SummaryInput input, ContentList inputContents
-  ) {
-    exists(SummaryInternalNodeState state |
-      state.isReadState(c, input, inputContents, inputContents.length()) and
-      result = internalNode(c, state)
+  private Node summaryNodeInputState(SummarizedCallable c, SummaryComponentStack s) {
+    exists(SummaryNodeState state | state.isInputState(c, s) |
+      result = summaryNode(c, state)
+      or
+      exists(int i |
+        parameterReadState(c, state, i) and
+        result.(ParameterNode).isParameterOf(c, i)
+      )
     )
   }
 
   pragma[noinline]
-  private Node internalNodeFirstStoreState(
-    SummarizedCallable c, SummaryOutput output, ContentList outputContents
+  private Node summaryNodeOutputState(SummarizedCallable c, SummaryComponentStack s) {
+    exists(SummaryNodeState state |
+      state.isOutputState(c, s) and
+      result = summaryNode(c, state)
+    )
+  }
+
+  /**
+   * Holds if a write targets `post`, which is a post-update node for the `i`th
+   * parameter of `c`.
+   */
+  private predicate isParameterPostUpdate(Node post, SummarizedCallable c, int i) {
+    post = summaryNodeOutputState(c, SummaryComponentStack::argument(i))
+  }
+
+  /** Holds if a parameter node is required for the `i`th parameter of `c`. */
+  predicate summaryParameterNodeRange(SummarizedCallable c, int i) {
+    parameterReadState(c, _, i)
+    or
+    isParameterPostUpdate(_, c, i)
+  }
+
+  private predicate callbackOutput(
+    SummarizedCallable c, SummaryComponentStack s, Node receiver, ReturnKind rk
   ) {
-    exists(SummaryInternalNodeState state |
-      state.isStoreState(c, output, outputContents, outputContents.length()) and
-      result = internalNode(c, state)
-    )
+    any(SummaryNodeState state).isInputState(c, s) and
+    s.head() = TReturnSummaryComponent(rk) and
+    receiver = summaryNodeInputState(c, s.drop(1))
+  }
+
+  private Node pre(Node post) {
+    summaryPostUpdateNode(post, result)
+    or
+    not summaryPostUpdateNode(post, _) and
+    result = post
+  }
+
+  private predicate callbackInput(
+    SummarizedCallable c, SummaryComponentStack s, Node receiver, int i
+  ) {
+    any(SummaryNodeState state).isOutputState(c, s) and
+    s.head() = TParameterSummaryComponent(i) and
+    receiver = pre(summaryNodeOutputState(c, s.drop(1)))
+  }
+
+  /** Holds if a call targeting `receiver` should be synthesized inside `c`. */
+  predicate summaryCallbackRange(SummarizedCallable c, Node receiver) {
+    callbackOutput(c, _, receiver, _)
+    or
+    callbackInput(c, _, receiver, _)
   }
 
   /**
-   * Holds if there is a local step from `pred` to `succ`, which is synthesized
-   * from a flow summary.
+   * Gets the type of synthesized summary node `n`.
+   *
+   * The type is computed based on the language-specific predicates
+   * `getContentType()`, `getReturnType()`, `getCallbackParameterType()`, and
+   * `getCallbackReturnType()`.
    */
-  predicate localStep(Node pred, Node succ, boolean preservesValue) {
-    exists(
-      SummarizedCallable c, SummaryInput input, ContentList inputContents, SummaryOutput output,
-      ContentList outputContents
-    |
-      summary(c, input, inputContents, output, outputContents, preservesValue)
-    |
-      pred = inputNode(c, input) and
+  DataFlowType summaryNodeType(Node n) {
+    exists(Node pre |
+      summaryPostUpdateNode(n, pre) and
+      result = getNodeType(pre)
+    )
+    or
+    exists(SummarizedCallable c, SummaryComponentStack s, SummaryComponent head | head = s.head() |
+      n = summaryNodeInputState(c, s) and
       (
-        // Simple flow summary without reads or stores
-        inputContents = ContentList::empty() and
-        outputContents = ContentList::empty() and
-        succ = outputNode(c, output)
+        exists(Content cont |
+          head = TContentSummaryComponent(cont) and result = getContentType(cont)
+        )
         or
-        // Flow summary with stores but no reads
-        inputContents = ContentList::empty() and
-        succ = internalNodeFirstStoreState(c, output, outputContents)
+        exists(ReturnKind rk |
+          head = TReturnSummaryComponent(rk) and
+          result = getCallbackReturnType(getNodeType(summaryNodeInputState(c, s.drop(1))), rk)
+        )
       )
       or
-      pred = internalNodeLastReadState(c, input, inputContents) and
+      n = summaryNodeOutputState(c, s) and
       (
-        // Exit step after last read (no stores)
-        outputContents = ContentList::empty() and
-        succ = outputNode(c, output)
+        exists(Content cont |
+          head = TContentSummaryComponent(cont) and result = getContentType(cont)
+        )
         or
-        // Internal step for complex flow summaries with both reads and writes
-        succ = internalNodeFirstStoreState(c, output, outputContents)
+        s.length() = 1 and
+        exists(ReturnKind rk |
+          head = TReturnSummaryComponent(rk) and
+          result = getReturnType(c, rk)
+        )
+        or
+        exists(int i | head = TParameterSummaryComponent(i) |
+          result = getCallbackParameterType(getNodeType(summaryNodeOutputState(c, s.drop(1))), i)
+        )
       )
     )
   }
 
-  /**
-   * Holds if there is a read step from `pred` to `succ`, which is synthesized
-   * from a flow summary.
-   */
-  predicate readStep(Node pred, Content c, Node succ) {
-    exists(
-      SummarizedCallable sc, SummaryInput input, ContentList inputContents,
-      SummaryInternalNodeState succState, int i
-    |
-      succState.isReadState(sc, input, inputContents, i) and
-      succ = internalNode(sc, succState) and
-      c = getContent(inputContents, i - 1)
-    |
-      // First read
-      i = 1 and
-      pred = inputNode(sc, input)
-      or
-      // Subsequent reads
-      exists(SummaryInternalNodeState predState |
-        predState.isReadState(sc, input, inputContents, i - 1) and
-        pred = internalNode(sc, predState)
+  /** Holds if summary node `out` contains output of kind `rk` from call `c`. */
+  predicate summaryOutNode(DataFlowCall c, Node out, ReturnKind rk) {
+    exists(SummarizedCallable callable, SummaryComponentStack s, Node receiver |
+      callbackOutput(callable, s, receiver, rk) and
+      out = summaryNodeInputState(callable, s) and
+      c = summaryDataFlowCall(receiver)
+    )
+  }
+
+  /** Holds if summary node `arg` is the `i`th argument of call `c`. */
+  predicate summaryArgumentNode(DataFlowCall c, Node arg, int i) {
+    exists(SummarizedCallable callable, SummaryComponentStack s, Node receiver |
+      callbackInput(callable, s, receiver, i) and
+      arg = summaryNodeOutputState(callable, s) and
+      c = summaryDataFlowCall(receiver)
+    )
+  }
+
+  /** Holds if summary node `post` is a post-update node with pre-update node `pre`. */
+  predicate summaryPostUpdateNode(Node post, ParameterNode pre) {
+    exists(SummarizedCallable c, int i |
+      isParameterPostUpdate(post, c, i) and
+      pre.isParameterOf(c, i)
+    )
+  }
+
+  /** Holds if summary node `ret` is a return node of kind `rk`. */
+  predicate summaryReturnNode(Node ret, ReturnKind rk) {
+    exists(SummarizedCallable callable, SummaryComponentStack s |
+      ret = summaryNodeOutputState(callable, s) and
+      s = TSingletonSummaryComponentStack(TReturnSummaryComponent(rk))
+    )
+  }
+
+  /** Provides a compilation of flow summaries to atomic data-flow steps. */
+  module Steps {
+    /**
+     * Holds if there is a local step from `pred` to `succ`, which is synthesized
+     * from a flow summary.
+     */
+    predicate summaryLocalStep(Node pred, Node succ, boolean preservesValue) {
+      exists(
+        SummarizedCallable c, SummaryComponentStack inputContents,
+        SummaryComponentStack outputContents
+      |
+        summary(c, inputContents, outputContents, preservesValue) and
+        pred = summaryNodeInputState(c, inputContents) and
+        succ = summaryNodeOutputState(c, outputContents)
       )
-    )
-  }
+    }
 
-  /**
-   * Holds if there is a store step from `pred` to `succ`, which is synthesized
-   * from a flow summary.
-   */
-  predicate storeStep(Node pred, Content c, Node succ) {
-    exists(
-      SummarizedCallable sc, SummaryOutput output, ContentList outputContents,
-      SummaryInternalNodeState predState, int i
-    |
-      predState.isStoreState(sc, output, outputContents, i) and
-      pred = internalNode(sc, predState) and
-      c = getContent(outputContents, i - 1)
-    |
-      // More stores needed
-      exists(SummaryInternalNodeState succState |
-        succState.isStoreState(sc, output, outputContents, i - 1) and
-        succ = internalNode(sc, succState)
+    /**
+     * Holds if there is a read step of content `c` from `pred` to `succ`, which
+     * is synthesized from a flow summary.
+     */
+    predicate summaryReadStep(Node pred, Content c, Node succ) {
+      exists(SummarizedCallable sc, SummaryComponentStack s |
+        pred = summaryNodeInputState(sc, s.drop(1)) and
+        succ = summaryNodeInputState(sc, s) and
+        SummaryComponent::content(c) = s.head()
       )
-      or
-      // Last store
-      i = 1 and
-      succ = outputNode(sc, output)
-    )
-  }
+    }
 
-  pragma[nomagic]
-  private ParameterNode summaryArgParam(ArgumentNode arg, ReturnKind rk, OutNode out) {
-    exists(DataFlowCall call, int pos, SummarizedCallable callable |
-      arg.argumentOf(call, pos) and
-      viableCallable(call) = callable and
-      result.isParameterOf(callable, pos) and
-      call = out.getCall(rk)
-    )
+    /**
+     * Holds if there is a store step of content `c` from `pred` to `succ`, which
+     * is synthesized from a flow summary.
+     */
+    predicate summaryStoreStep(Node pred, Content c, Node succ) {
+      exists(SummarizedCallable sc, SummaryComponentStack s |
+        pred = summaryNodeOutputState(sc, s) and
+        succ = summaryNodeOutputState(sc, s.drop(1)) and
+        SummaryComponent::content(c) = s.head()
+      )
+    }
+
+    /**
+     * Holds if values stored inside content `c` are cleared when passed as
+     * input of type `input` in `call`.
+     */
+    predicate summaryClearsContent(ArgumentNode arg, Content c) {
+      exists(DataFlowCall call, int i |
+        viableCallable(call).(SummarizedCallable).clearsContent(i, c) and
+        arg.argumentOf(call, i)
+      )
+    }
+
+    pragma[nomagic]
+    private ParameterNode summaryArgParam(
+      ArgumentNode arg, DataFlowImplCommon::ReturnKindExt rk, DataFlowImplCommon::OutNodeExt out
+    ) {
+      exists(DataFlowCall call, int pos, SummarizedCallable callable |
+        arg.argumentOf(call, pos) and
+        viableCallable(call) = callable and
+        result.isParameterOf(callable, pos) and
+        out = rk.getAnOutNode(call)
+      )
+    }
+
+    /**
+     * Holds if `arg` flows to `out` using a simple flow summary, that is, a flow
+     * summary without reads and stores.
+     *
+     * NOTE: This step should not be used in global data-flow/taint-tracking, but may
+     * be useful to include in the exposed local data-flow/taint-tracking relations.
+     */
+    predicate summaryThroughStep(ArgumentNode arg, Node out, boolean preservesValue) {
+      exists(DataFlowImplCommon::ReturnKindExt rk, DataFlowImplCommon::ReturnNodeExt ret |
+        summaryLocalStep(summaryArgParam(arg, rk, out), ret, preservesValue) and
+        ret.getKind() = rk
+      )
+    }
+
+    /**
+     * Holds if there is a read(+taint) of `c` from `arg` to `out` using a
+     * flow summary.
+     *
+     * NOTE: This step should not be used in global data-flow/taint-tracking, but may
+     * be useful to include in the exposed local data-flow/taint-tracking relations.
+     */
+    predicate summaryGetterStep(ArgumentNode arg, Content c, Node out) {
+      exists(DataFlowImplCommon::ReturnKindExt rk, Node mid, DataFlowImplCommon::ReturnNodeExt ret |
+        summaryReadStep(summaryArgParam(arg, rk, out), c, mid) and
+        summaryLocalStep(mid, ret, _) and
+        ret.getKind() = rk
+      )
+    }
+
+    /**
+     * Holds if there is a (taint+)store of `arg` into content `c` of `out` using a
+     * flow summary.
+     *
+     * NOTE: This step should not be used in global data-flow/taint-tracking, but may
+     * be useful to include in the exposed local data-flow/taint-tracking relations.
+     */
+    predicate summarySetterStep(ArgumentNode arg, Content c, Node out) {
+      exists(DataFlowImplCommon::ReturnKindExt rk, Node mid, DataFlowImplCommon::ReturnNodeExt ret |
+        summaryLocalStep(summaryArgParam(arg, rk, out), mid, _) and
+        summaryStoreStep(mid, c, ret) and
+        ret.getKind() = rk
+      )
+    }
+
+    /**
+     * Holds if data is written into content `c` of argument `arg` using a flow summary.
+     *
+     * Depending on the type of `c`, this predicate may be relevant to include in the
+     * definition of `clearsContent()`.
+     */
+    predicate summaryStoresIntoArg(Content c, Node arg) {
+      exists(
+        DataFlowImplCommon::ParamUpdateReturnKind rk, DataFlowImplCommon::ReturnNodeExt ret,
+        PostUpdateNode out
+      |
+        exists(DataFlowCall call, SummarizedCallable callable |
+          DataFlowImplCommon::getNodeEnclosingCallable(ret) = callable and
+          viableCallable(call) = callable and
+          summaryStoreStep(_, c, ret) and
+          ret.getKind() = pragma[only_bind_into](rk) and
+          out = rk.getAnOutNode(call) and
+          arg = out.getPreUpdateNode()
+        )
+      )
+    }
   }
 
   /**
-   * Holds if `arg` flows to `out` using a simple flow summary, that is, a flow
-   * summary without reads and stores.
-   *
-   * NOTE: This step should not be used in global data-flow/taint-tracking, but may
-   * be useful to include in the exposed local data-flow/taint-tracking relations.
+   * Provides a means of translating externally (e.g., CSV) defined flow
+   * summaries into a `SummarizedCallable`s.
    */
-  predicate throughStep(ArgumentNode arg, OutNode out, boolean preservesValue) {
-    exists(ReturnKind rk, ReturnNode ret |
-      localStep(summaryArgParam(arg, rk, out), ret, preservesValue) and
-      ret.getKind() = rk
-    )
+  module External {
+    /**
+     * Provides a means of translating an externally (e.g., CSV) defined flow
+     * summary into a `SummarizedCallable`.
+     */
+    abstract class ExternalSummaryCompilation extends string {
+      bindingset[this]
+      ExternalSummaryCompilation() { any() }
+
+      /** Holds if this flow summary is for callable `c`. */
+      abstract predicate callable(DataFlowCallable c, boolean preservesValue);
+
+      /** Holds if the `i`th input component is `c`. */
+      abstract predicate input(int i, SummaryComponent c);
+
+      /** Holds if the `i`th output component is `c`. */
+      abstract predicate output(int i, SummaryComponent c);
+
+      /**
+       * Holds if the input components starting from index `i` translate into `suffix`.
+       */
+      final predicate translateInput(int i, SummaryComponentStack suffix) {
+        exists(SummaryComponent comp | this.input(i, comp) |
+          i = max(int j | this.input(j, _)) and
+          suffix = TSingletonSummaryComponentStack(comp)
+          or
+          exists(TSummaryComponent head, SummaryComponentStack tail |
+            this.translateInputCons(i, head, tail) and
+            suffix = TConsSummaryComponentStack(head, tail)
+          )
+        )
+      }
+
+      final predicate translateInputCons(int i, SummaryComponent head, SummaryComponentStack tail) {
+        this.input(i, head) and
+        this.translateInput(i + 1, tail)
+      }
+
+      /**
+       * Holds if the output components starting from index `i` translate into `suffix`.
+       */
+      predicate translateOutput(int i, SummaryComponentStack suffix) {
+        exists(SummaryComponent comp | this.output(i, comp) |
+          i = max(int j | this.output(j, _)) and
+          suffix = TSingletonSummaryComponentStack(comp)
+          or
+          exists(TSummaryComponent head, SummaryComponentStack tail |
+            this.translateOutputCons(i, head, tail) and
+            suffix = TConsSummaryComponentStack(head, tail)
+          )
+        )
+      }
+
+      predicate translateOutputCons(int i, SummaryComponent head, SummaryComponentStack tail) {
+        this.output(i, head) and
+        this.translateOutput(i + 1, tail)
+      }
+    }
+
+    private class ExternalRequiredSummaryComponentStack extends RequiredSummaryComponentStack {
+      private SummaryComponent head;
+
+      ExternalRequiredSummaryComponentStack() {
+        any(ExternalSummaryCompilation s).translateInputCons(_, head, this) or
+        any(ExternalSummaryCompilation s).translateOutputCons(_, head, this)
+      }
+
+      override predicate required(SummaryComponent c) { c = head }
+    }
+
+    class ExternalSummarizedCallableAdaptor extends SummarizedCallable {
+      ExternalSummarizedCallableAdaptor() { any(ExternalSummaryCompilation s).callable(this, _) }
+
+      override predicate propagatesFlow(
+        SummaryComponentStack input, SummaryComponentStack output, boolean preservesValue
+      ) {
+        exists(ExternalSummaryCompilation s |
+          s.callable(this, preservesValue) and
+          s.translateInput(0, input) and
+          s.translateOutput(0, output)
+        )
+      }
+    }
   }
 
-  /**
-   * Holds if there is a read(+taint) of `c` from `arg` to `out` using a
-   * flow summary.
-   *
-   * NOTE: This step should not be used in global data-flow/taint-tracking, but may
-   * be useful to include in the exposed local data-flow/taint-tracking relations.
-   */
-  predicate getterStep(ArgumentNode arg, Content c, OutNode out) {
-    exists(ReturnKind rk, Node mid, ReturnNode ret |
-      readStep(summaryArgParam(arg, rk, out), c, mid) and
-      localStep(mid, ret, _) and
-      ret.getKind() = rk
-    )
-  }
+  /** Provides a query predicate for outputting a set of relevant flow summaries. */
+  module TestOutput {
+    /** A flow summary to include in the `summary/3` query predicate. */
+    abstract class RelevantSummarizedCallable extends SummarizedCallable {
+      /** Gets the string representation of this callable used by `summary/3`. */
+      string getFullString() { result = this.toString() }
+    }
 
-  /**
-   * Holds if there is a (taint+)store of `arg` into content `c` of `out` using a
-   * flow summary.
-   *
-   * NOTE: This step should not be used in global data-flow/taint-tracking, but may
-   * be useful to include in the exposed local data-flow/taint-tracking relations.
-   */
-  predicate setterStep(ArgumentNode arg, Content c, OutNode out) {
-    exists(ReturnKind rk, Node mid, ReturnNode ret |
-      localStep(summaryArgParam(arg, rk, out), mid, _) and
-      storeStep(mid, c, ret) and
-      ret.getKind() = rk
-    )
-  }
-
-  /**
-   * Holds if values stored inside content `c` are cleared when passed as
-   * input of type `input` in `call`.
-   */
-  predicate clearsContent(SummaryInput input, DataFlowCall call, Content c) {
-    viableCallable(call).(SummarizedCallable).clearsContent(input, c)
+    /** A query predicate for outputting flow summaries in QL tests. */
+    query predicate summary(string callable, string flow, boolean preservesValue) {
+      exists(
+        RelevantSummarizedCallable c, SummaryComponentStack input, SummaryComponentStack output
+      |
+        callable = c.getFullString() and
+        c.propagatesFlow(input, output, preservesValue) and
+        flow = input + " -> " + output
+      )
+    }
   }
 }
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/FlowSummaryImplSpecific.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/FlowSummaryImplSpecific.qll
new file mode 100644
index 00000000000..01e3a2e1633
--- /dev/null
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/FlowSummaryImplSpecific.qll
@@ -0,0 +1,79 @@
+/**
+ * Provides C# specific classes and predicates for defining flow summaries.
+ */
+
+private import csharp
+private import semmle.code.csharp.frameworks.system.linq.Expressions
+private import DataFlowDispatch
+private import DataFlowPrivate
+private import DataFlowPublic
+private import FlowSummaryImpl::Private
+private import FlowSummaryImpl::Public
+private import semmle.code.csharp.Unification
+
+/** Holds is `i` is a valid parameter position. */
+predicate parameterPosition(int i) { i in [-1 .. any(Parameter p).getPosition()] }
+
+/** Gets the synthesized summary data-flow node for the given values. */
+Node summaryNode(SummarizedCallable c, SummaryNodeState state) { result = TSummaryNode(c, state) }
+
+/** Gets the synthesized data-flow call for `receiver`. */
+SummaryCall summaryDataFlowCall(Node receiver) { receiver = result.getReceiver() }
+
+/** Gets the type of content `c`. */
+DataFlowType getContentType(Content c) {
+  exists(Type t | result = Gvn::getGlobalValueNumber(t) |
+    t = c.(FieldContent).getField().getType()
+    or
+    t = c.(PropertyContent).getProperty().getType()
+    or
+    c instanceof ElementContent and
+    t instanceof ObjectType // we don't know what the actual element type is
+  )
+}
+
+private DataFlowType getReturnTypeBase(DataFlowCallable c, ReturnKind rk) {
+  exists(Type t | result = Gvn::getGlobalValueNumber(t) |
+    rk instanceof NormalReturnKind and
+    (
+      t = c.(Constructor).getDeclaringType()
+      or
+      not c instanceof Constructor and
+      t = c.getReturnType()
+    )
+    or
+    t = c.getParameter(rk.(OutRefReturnKind).getPosition()).getType()
+  )
+}
+
+/** Gets the return type of kind `rk` for callable `c`. */
+bindingset[c]
+DataFlowType getReturnType(SummarizedCallable c, ReturnKind rk) {
+  result = getReturnTypeBase(c, rk)
+  or
+  rk =
+    any(JumpReturnKind jrk | result = getReturnTypeBase(jrk.getTarget(), jrk.getTargetReturnKind()))
+}
+
+/**
+ * Gets the type of the `i`th parameter in a synthesized call that targets a
+ * callback of type `t`.
+ */
+DataFlowType getCallbackParameterType(DataFlowType t, int i) {
+  exists(SystemLinqExpressions::DelegateExtType dt |
+    t = Gvn::getGlobalValueNumber(dt) and
+    result = Gvn::getGlobalValueNumber(dt.getDelegateType().getParameter(i).getType())
+  )
+}
+
+/**
+ * Gets the return type of kind `rk` in a synthesized call that targets a
+ * callback of type `t`.
+ */
+DataFlowType getCallbackReturnType(DataFlowType t, ReturnKind rk) {
+  rk instanceof NormalReturnKind and
+  exists(SystemLinqExpressions::DelegateExtType dt |
+    t = Gvn::getGlobalValueNumber(dt) and
+    result = Gvn::getGlobalValueNumber(dt.getDelegateType().getReturnType())
+  )
+}
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/FlowSummarySpecific.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/FlowSummarySpecific.qll
deleted file mode 100644
index 2edca6111ed..00000000000
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/FlowSummarySpecific.qll
+++ /dev/null
@@ -1,178 +0,0 @@
-/**
- * Provides C# specific classes and predicates for definining flow summaries.
- */
-
-private import csharp
-private import semmle.code.csharp.frameworks.system.linq.Expressions
-private import DataFlowDispatch
-
-module Private {
-  private import Public
-  private import DataFlowPrivate as DataFlowPrivate
-  private import DataFlowPublic as DataFlowPublic
-  private import FlowSummaryImpl as Impl
-  private import semmle.code.csharp.Unification
-
-  class Content = DataFlowPublic::Content;
-
-  class DataFlowType = DataFlowPrivate::DataFlowType;
-
-  class Node = DataFlowPublic::Node;
-
-  class ParameterNode = DataFlowPublic::ParameterNode;
-
-  class ArgumentNode = DataFlowPrivate::ArgumentNode;
-
-  class ReturnNode = DataFlowPrivate::ReturnNode;
-
-  class OutNode = DataFlowPrivate::OutNode;
-
-  private class NodeImpl = DataFlowPrivate::NodeImpl;
-
-  predicate accessPathLimit = DataFlowPrivate::accessPathLimit/0;
-
-  predicate hasDelegateArgumentPosition(SummarizableCallable c, int i) {
-    exists(DelegateType dt |
-      dt = c.getParameter(i).getType().(SystemLinqExpressions::DelegateExtType).getDelegateType()
-    |
-      not dt.getReturnType() instanceof VoidType
-    )
-  }
-
-  predicate hasDelegateArgumentPosition2(SummarizableCallable c, int i, int j) {
-    exists(DelegateType dt |
-      dt = c.getParameter(i).getType().(SystemLinqExpressions::DelegateExtType).getDelegateType()
-    |
-      exists(dt.getParameter(j))
-    )
-  }
-
-  newtype TSummaryInput =
-    TParameterSummaryInput(int i) { i in [-1, any(Parameter p).getPosition()] } or
-    TDelegateSummaryInput(int i) { hasDelegateArgumentPosition(_, i) }
-
-  newtype TSummaryOutput =
-    TReturnSummaryOutput() or
-    TParameterSummaryOutput(int i) {
-      i in [-1, any(SummarizableCallable c).getAParameter().getPosition()]
-    } or
-    TDelegateSummaryOutput(int i, int j) { hasDelegateArgumentPosition2(_, i, j) } or
-    TJumpSummaryOutput(SummarizableCallable target, ReturnKind rk) {
-      rk instanceof NormalReturnKind and
-      (
-        target instanceof Constructor or
-        not target.getReturnType() instanceof VoidType
-      )
-      or
-      rk instanceof QualifierReturnKind and
-      not target.(Modifiable).isStatic()
-      or
-      exists(target.getParameter(rk.(OutRefReturnKind).getPosition()))
-    }
-
-  /** Gets the return kind that matches `sink`, if any. */
-  ReturnKind toReturnKind(SummaryOutput output) {
-    output = TReturnSummaryOutput() and
-    result instanceof NormalReturnKind
-    or
-    exists(int i | output = TParameterSummaryOutput(i) |
-      i = -1 and
-      result instanceof QualifierReturnKind
-      or
-      i = result.(OutRefReturnKind).getPosition()
-    )
-  }
-
-  /** Gets the input node for `c` of type `input`. */
-  NodeImpl inputNode(SummarizableCallable c, SummaryInput input) {
-    exists(int i |
-      input = TParameterSummaryInput(i) and
-      result.(ParameterNode).isParameterOf(c, i)
-    )
-    or
-    exists(int i |
-      input = TDelegateSummaryInput(i) and
-      result = DataFlowPrivate::TSummaryDelegateOutNode(c, i)
-    )
-  }
-
-  /** Gets the output node for `c` of type `output`. */
-  NodeImpl outputNode(SummarizableCallable c, SummaryOutput output) {
-    result = DataFlowPrivate::TSummaryReturnNode(c, toReturnKind(output))
-    or
-    exists(int i, int j |
-      output = TDelegateSummaryOutput(i, j) and
-      result = DataFlowPrivate::TSummaryDelegateArgumentNode(c, i, j)
-    )
-    or
-    exists(SummarizableCallable target, ReturnKind rk |
-      output = TJumpSummaryOutput(target, rk) and
-      result = DataFlowPrivate::TSummaryJumpNode(c, target, rk)
-    )
-  }
-
-  /** Gets the internal summary node for the given values. */
-  Node internalNode(SummarizableCallable c, Impl::Private::SummaryInternalNodeState state) {
-    result = DataFlowPrivate::TSummaryInternalNode(c, state)
-  }
-
-  /** Gets the type of content `c`. */
-  pragma[noinline]
-  DataFlowType getContentType(Content c) {
-    exists(Type t | result = Gvn::getGlobalValueNumber(t) |
-      t = c.(DataFlowPublic::FieldContent).getField().getType()
-      or
-      t = c.(DataFlowPublic::PropertyContent).getProperty().getType()
-      or
-      c instanceof DataFlowPublic::ElementContent and
-      t instanceof ObjectType // we don't know what the actual element type is
-    )
-  }
-}
-
-module Public {
-  private import Private
-
-  /** An unbound callable. */
-  class SummarizableCallable extends Callable {
-    SummarizableCallable() { this.isUnboundDeclaration() }
-  }
-
-  /** A flow-summary input specification. */
-  class SummaryInput extends TSummaryInput {
-    /** Gets a textual representation of this input specification. */
-    final string toString() {
-      exists(int i |
-        this = TParameterSummaryInput(i) and
-        if i = -1 then result = "this parameter" else result = "parameter " + i
-        or
-        this = TDelegateSummaryInput(i) and
-        result = "deleget output from parameter " + i
-      )
-    }
-  }
-
-  /** A flow-summary output specification. */
-  class SummaryOutput extends TSummaryOutput {
-    /** Gets a textual representation of this flow sink specification. */
-    final string toString() {
-      this = TReturnSummaryOutput() and
-      result = "return"
-      or
-      exists(int i |
-        this = TParameterSummaryOutput(i) and
-        if i = -1 then result = "this parameter" else result = "parameter " + i
-      )
-      or
-      exists(int delegateIndex, int parameterIndex |
-        this = TDelegateSummaryOutput(delegateIndex, parameterIndex) and
-        result = "parameter " + parameterIndex + " of delegate parameter " + delegateIndex
-      )
-      or
-      exists(SummarizableCallable target, ReturnKind rk |
-        this = TJumpSummaryOutput(target, rk) and
-        result = "jump to " + target + " (" + rk + ")"
-      )
-    }
-  }
-}
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImpl.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImpl.qll
index 7f54d3287d1..63d6c902fed 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImpl.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImpl.qll
@@ -235,7 +235,6 @@ private module CallGraph {
   }
 
   private module SimpleDelegateAnalysis {
-    private import semmle.code.csharp.dataflow.internal.DelegateDataFlow
     private import semmle.code.csharp.dataflow.internal.Steps
     private import semmle.code.csharp.frameworks.system.linq.Expressions
 
@@ -269,56 +268,146 @@ private module CallGraph {
         )
     }
 
+    /**
+     * A simple flow step that does not take flow through fields or flow out
+     * of callables into account.
+     */
+    pragma[nomagic]
     private predicate delegateFlowStep(Expr pred, Expr succ) {
       Steps::stepClosed(pred, succ)
       or
-      exists(Call call, Callable callable |
-        callable.getUnboundDeclaration().canReturn(pred) and
-        call = succ
-      |
-        callable = call.getTarget() or
-        callable = call.getTarget().(Method).getAnOverrider+() or
-        callable = call.getTarget().(Method).getAnUltimateImplementor() or
-        callable = getARuntimeDelegateTarget(call, false)
-      )
-      or
       pred = succ.(DelegateCreation).getArgument()
       or
-      exists(AssignableDefinition def, Assignable a |
-        a instanceof Field or
-        a instanceof Property
-      |
-        a = def.getTarget() and
-        succ.(AssignableRead) = a.getAnAccess() and
-        pred = def.getSource()
-      )
-      or
       exists(AddEventExpr ae | succ.(EventAccess).getTarget() = ae.getTarget() |
         pred = ae.getRValue()
       )
     }
 
-    private predicate reachesDelegateCall(Expr e) {
-      delegateCall(_, e, _)
+    private predicate delegateCreationReaches(Callable c, Expr e) {
+      delegateCreation(e, c, _)
       or
-      exists(Expr mid | reachesDelegateCall(mid) | delegateFlowStep(e, mid))
+      exists(Expr mid |
+        delegateCreationReaches(c, mid) and
+        delegateFlowStep(mid, e)
+      )
     }
 
-    pragma[nomagic]
-    private predicate delegateFlowStepReaches(Expr pred, Expr succ) {
-      delegateFlowStep(pred, succ) and
-      reachesDelegateCall(succ)
+    private predicate reachesDelegateCall(Expr e, Call c, boolean libraryDelegateCall) {
+      delegateCall(c, e, libraryDelegateCall)
+      or
+      exists(Expr mid |
+        reachesDelegateCall(mid, c, libraryDelegateCall) and
+        delegateFlowStep(e, mid)
+      )
     }
 
-    private Expr delegateCallSource(Callable c) {
-      delegateCreation(result, c, _)
-      or
-      delegateFlowStepReaches(delegateCallSource(c), result)
+    /**
+     * A "busy" flow element, that is, a node in the data-flow graph that typically
+     * has a large fan-in or a large fan-out (or both).
+     *
+     * For such busy elements, we do not track flow directly from all delegate
+     * creations, but instead we first perform a flow analysis between busy elements,
+     * and then only in the end join up with delegate creations and delegate calls.
+     */
+    abstract private class BusyFlowElement extends Element {
+      pragma[nomagic]
+      abstract Expr getAnInput();
+
+      pragma[nomagic]
+      abstract Expr getAnOutput();
+
+      /** Holds if this element can be reached from expression `e`. */
+      pragma[nomagic]
+      private predicate exprReaches(Expr e) {
+        this.reachesCall(_) and
+        e = this.getAnInput()
+        or
+        exists(Expr mid |
+          this.exprReaches(mid) and
+          delegateFlowStep(e, mid)
+        )
+      }
+
+      /**
+       * Holds if this element can reach a delegate call `c` directly without
+       * passing through another busy element.
+       */
+      pragma[nomagic]
+      predicate delegateCall(Call c, boolean libraryDelegateCall) {
+        reachesDelegateCall(this.getAnOutput(), c, libraryDelegateCall)
+      }
+
+      pragma[nomagic]
+      private BusyFlowElement getASuccessor() { result.exprReaches(this.getAnOutput()) }
+
+      /**
+       * Holds if this element reaches another busy element `other`,
+       * which can reach a delegate call directly without passing
+       * through another busy element.
+       */
+      pragma[nomagic]
+      private predicate reachesCall(BusyFlowElement other) {
+        this = other and
+        other.delegateCall(_, _)
+        or
+        this.getASuccessor().reachesCall(other)
+      }
+
+      /** Holds if this element is reached by a delegate creation for `c`. */
+      pragma[nomagic]
+      predicate isReachedBy(Callable c) {
+        exists(BusyFlowElement pred |
+          pred.reachesCall(this) and
+          delegateCreationReaches(c, pred.getAnInput())
+        )
+      }
+    }
+
+    private class TFieldOrProperty = @field or @property;
+
+    private class FieldOrPropertyFlow extends BusyFlowElement, Assignable, TFieldOrProperty {
+      final override Expr getAnInput() {
+        exists(Assignable target |
+          target = this.getUnboundDeclaration() and
+          result = target.getAnAssignedValue()
+        )
+      }
+
+      final override AssignableRead getAnOutput() {
+        exists(Assignable target |
+          target = this.getUnboundDeclaration() and
+          result = target.getAnAccess()
+        )
+      }
+    }
+
+    private class CallOutputFlow extends BusyFlowElement, Callable {
+      final override Expr getAnInput() { this.canReturn(result) }
+
+      final override Call getAnOutput() {
+        exists(Callable target | this = target.getUnboundDeclaration() |
+          target = result.getTarget() or
+          target = result.getTarget().(Method).getAnOverrider+() or
+          target = result.getTarget().(Method).getAnUltimateImplementor() or
+          target = getARuntimeDelegateTarget(result, false)
+        )
+      }
     }
 
     /** Gets a run-time target for the delegate call `c`. */
+    pragma[nomagic]
     Callable getARuntimeDelegateTarget(Call c, boolean libraryDelegateCall) {
-      delegateCall(c, delegateCallSource(result), libraryDelegateCall)
+      // directly resolvable without going through a "busy" element
+      exists(Expr e |
+        delegateCreationReaches(result, e) and
+        delegateCall(c, e, libraryDelegateCall)
+      )
+      or
+      // resolvable by going through one or more "busy" elements
+      exists(BusyFlowElement busy |
+        busy.isReachedBy(result) and
+        busy.delegateCall(c, libraryDelegateCall)
+      )
     }
   }
 
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImplCommon.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImplCommon.qll
index be01c05b8fa..f828419a440 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImplCommon.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImplCommon.qll
@@ -1,5 +1,5 @@
 /**
- * Provides a language-independant implementation of static single assignment
+ * Provides a language-independent implementation of static single assignment
  * (SSA) form.
  */
 
@@ -321,10 +321,9 @@ private module SsaDefReaches {
   }
 
   pragma[noinline]
-  private BasicBlock getAMaybeLiveSuccessor(Definition def, BasicBlock bb) {
-    result = getABasicBlockSuccessor(bb) and
-    not defOccursInBlock(_, bb, def.getSourceVariable()) and
-    ssaDefReachesEndOfBlock(bb, def, _)
+  private predicate ssaDefReachesThroughBlock(Definition def, BasicBlock bb) {
+    ssaDefReachesEndOfBlock(bb, def, _) and
+    not defOccursInBlock(_, bb, def.getSourceVariable())
   }
 
   /**
@@ -337,7 +336,11 @@ private module SsaDefReaches {
     defOccursInBlock(def, bb1, _) and
     bb2 = getABasicBlockSuccessor(bb1)
     or
-    exists(BasicBlock mid | varBlockReaches(def, bb1, mid) | bb2 = getAMaybeLiveSuccessor(def, mid))
+    exists(BasicBlock mid |
+      varBlockReaches(def, bb1, mid) and
+      ssaDefReachesThroughBlock(def, mid) and
+      bb2 = getABasicBlockSuccessor(mid)
+    )
   }
 
   /**
@@ -355,17 +358,10 @@ private module SsaDefReaches {
 
 private import SsaDefReaches
 
-pragma[noinline]
-private predicate ssaDefReachesEndOfBlockRec(BasicBlock bb, Definition def, SourceVariable v) {
-  exists(BasicBlock idom | ssaDefReachesEndOfBlock(idom, def, v) |
-    // The construction of SSA form ensures that each read of a variable is
-    // dominated by its definition. An SSA definition therefore reaches a
-    // control flow node if it is the _closest_ SSA definition that dominates
-    // the node. If two definitions dominate a node then one must dominate the
-    // other, so therefore the definition of _closest_ is given by the dominator
-    // tree. Thus, reaching definitions can be calculated in terms of dominance.
-    idom = getImmediateBasicBlockDominator(bb)
-  )
+pragma[nomagic]
+predicate liveThrough(BasicBlock bb, SourceVariable v) {
+  liveAtExit(bb, v) and
+  not ssaRef(bb, _, v, SsaDef())
 }
 
 /**
@@ -382,9 +378,14 @@ predicate ssaDefReachesEndOfBlock(BasicBlock bb, Definition def, SourceVariable
     liveAtExit(bb, v)
   )
   or
-  ssaDefReachesEndOfBlockRec(bb, def, v) and
-  liveAtExit(bb, v) and
-  not ssaRef(bb, _, v, SsaDef())
+  // The construction of SSA form ensures that each read of a variable is
+  // dominated by its definition. An SSA definition therefore reaches a
+  // control flow node if it is the _closest_ SSA definition that dominates
+  // the node. If two definitions dominate a node then one must dominate the
+  // other, so therefore the definition of _closest_ is given by the dominator
+  // tree. Thus, reaching definitions can be calculated in terms of dominance.
+  ssaDefReachesEndOfBlock(getImmediateBasicBlockDominator(bb), def, pragma[only_bind_into](v)) and
+  liveThrough(bb, pragma[only_bind_into](v))
 }
 
 /**
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/TaintTrackingPrivate.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/TaintTrackingPrivate.qll
index e8922edbf9f..72525d3234a 100755
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/TaintTrackingPrivate.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/TaintTrackingPrivate.qll
@@ -103,19 +103,19 @@ private module Cached {
     (
       // Simple flow through library code is included in the exposed local
       // step relation, even though flow is technically inter-procedural
-      FlowSummaryImpl::Private::throughStep(nodeFrom, nodeTo, false)
+      FlowSummaryImpl::Private::Steps::summaryThroughStep(nodeFrom, nodeTo, false)
       or
       // Taint collection by adding a tainted element
       exists(DataFlow::ElementContent c |
         storeStep(nodeFrom, c, nodeTo)
         or
-        FlowSummaryImpl::Private::setterStep(nodeFrom, c, nodeTo)
+        FlowSummaryImpl::Private::Steps::summarySetterStep(nodeFrom, c, nodeTo)
       )
       or
       exists(DataFlow::Content c |
         readStep(nodeFrom, c, nodeTo)
         or
-        FlowSummaryImpl::Private::getterStep(nodeFrom, c, nodeTo)
+        FlowSummaryImpl::Private::Steps::summaryGetterStep(nodeFrom, c, nodeTo)
       |
         // Taint members
         c = any(TaintedMember m).(FieldOrProperty).getContent()
@@ -142,7 +142,7 @@ private module Cached {
     // tracking configurations where the source is a collection
     readStep(nodeFrom, TElementContent(), nodeTo)
     or
-    FlowSummaryImpl::Private::localStep(nodeFrom, nodeTo, false)
+    FlowSummaryImpl::Private::Steps::summaryLocalStep(nodeFrom, nodeTo, false)
     or
     nodeTo = nodeFrom.(DataFlow::NonLocalJumpNode).getAJumpSuccessor(false)
   }
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/basessa/SsaImplCommon.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/basessa/SsaImplCommon.qll
index be01c05b8fa..f828419a440 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/basessa/SsaImplCommon.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/basessa/SsaImplCommon.qll
@@ -1,5 +1,5 @@
 /**
- * Provides a language-independant implementation of static single assignment
+ * Provides a language-independent implementation of static single assignment
  * (SSA) form.
  */
 
@@ -321,10 +321,9 @@ private module SsaDefReaches {
   }
 
   pragma[noinline]
-  private BasicBlock getAMaybeLiveSuccessor(Definition def, BasicBlock bb) {
-    result = getABasicBlockSuccessor(bb) and
-    not defOccursInBlock(_, bb, def.getSourceVariable()) and
-    ssaDefReachesEndOfBlock(bb, def, _)
+  private predicate ssaDefReachesThroughBlock(Definition def, BasicBlock bb) {
+    ssaDefReachesEndOfBlock(bb, def, _) and
+    not defOccursInBlock(_, bb, def.getSourceVariable())
   }
 
   /**
@@ -337,7 +336,11 @@ private module SsaDefReaches {
     defOccursInBlock(def, bb1, _) and
     bb2 = getABasicBlockSuccessor(bb1)
     or
-    exists(BasicBlock mid | varBlockReaches(def, bb1, mid) | bb2 = getAMaybeLiveSuccessor(def, mid))
+    exists(BasicBlock mid |
+      varBlockReaches(def, bb1, mid) and
+      ssaDefReachesThroughBlock(def, mid) and
+      bb2 = getABasicBlockSuccessor(mid)
+    )
   }
 
   /**
@@ -355,17 +358,10 @@ private module SsaDefReaches {
 
 private import SsaDefReaches
 
-pragma[noinline]
-private predicate ssaDefReachesEndOfBlockRec(BasicBlock bb, Definition def, SourceVariable v) {
-  exists(BasicBlock idom | ssaDefReachesEndOfBlock(idom, def, v) |
-    // The construction of SSA form ensures that each read of a variable is
-    // dominated by its definition. An SSA definition therefore reaches a
-    // control flow node if it is the _closest_ SSA definition that dominates
-    // the node. If two definitions dominate a node then one must dominate the
-    // other, so therefore the definition of _closest_ is given by the dominator
-    // tree. Thus, reaching definitions can be calculated in terms of dominance.
-    idom = getImmediateBasicBlockDominator(bb)
-  )
+pragma[nomagic]
+predicate liveThrough(BasicBlock bb, SourceVariable v) {
+  liveAtExit(bb, v) and
+  not ssaRef(bb, _, v, SsaDef())
 }
 
 /**
@@ -382,9 +378,14 @@ predicate ssaDefReachesEndOfBlock(BasicBlock bb, Definition def, SourceVariable
     liveAtExit(bb, v)
   )
   or
-  ssaDefReachesEndOfBlockRec(bb, def, v) and
-  liveAtExit(bb, v) and
-  not ssaRef(bb, _, v, SsaDef())
+  // The construction of SSA form ensures that each read of a variable is
+  // dominated by its definition. An SSA definition therefore reaches a
+  // control flow node if it is the _closest_ SSA definition that dominates
+  // the node. If two definitions dominate a node then one must dominate the
+  // other, so therefore the definition of _closest_ is given by the dominator
+  // tree. Thus, reaching definitions can be calculated in terms of dominance.
+  ssaDefReachesEndOfBlock(getImmediateBasicBlockDominator(bb), def, pragma[only_bind_into](v)) and
+  liveThrough(bb, pragma[only_bind_into](v))
 }
 
 /**
diff --git a/csharp/ql/src/semmle/code/csharp/dispatch/Dispatch.qll b/csharp/ql/src/semmle/code/csharp/dispatch/Dispatch.qll
index 1e0eaaf8017..e436fb2b99a 100644
--- a/csharp/ql/src/semmle/code/csharp/dispatch/Dispatch.qll
+++ b/csharp/ql/src/semmle/code/csharp/dispatch/Dispatch.qll
@@ -636,31 +636,41 @@ private module Internal {
       )
     }
 
-    private predicate stepExpr0(Expr succ, Expr pred) {
-      Steps::stepOpen(pred, succ)
-      or
-      exists(Assignable a |
-        a instanceof Field or
-        a instanceof Property
-      |
-        succ.(AssignableRead) = a.getAnAccess() and
-        pred = a.getAnAssignedValue() and
-        a = any(Modifiable m | not m.isEffectivelyPublic())
-      )
-    }
-
-    private predicate stepExpr(Expr succ, Expr pred) {
-      stepExpr0(succ, pred) and
+    private predicate stepExpr(Expr pred, Expr succ) {
+      Steps::stepOpen(pred, succ) and
       // Do not step through down casts
       not downCast(succ) and
       // Only step when we may learn more about the actual type
       typeMayBeImprecise(succ.getType())
     }
 
-    private predicate stepTC(Expr succ, Expr pred) = fastTC(stepExpr/2)(succ, pred)
+    private class AnalyzableFieldOrProperty extends Assignable, Modifiable {
+      AnalyzableFieldOrProperty() {
+        (
+          this instanceof Field or
+          this instanceof Property
+        ) and
+        not this.isEffectivelyPublic() and
+        exists(this.getAnAssignedValue())
+      }
+
+      AssignableRead getARead() { result = this.getAnAccess() }
+    }
 
     private class Source extends Expr {
-      Source() { not stepExpr(this, _) }
+      Source() {
+        not stepExpr(_, this) and
+        not this = any(AnalyzableFieldOrProperty a).getARead()
+      }
+
+      Type getType(boolean isExact) {
+        result = this.getType() and
+        if
+          this instanceof ObjectCreation or
+          this instanceof BaseAccess
+        then isExact = true
+        else isExact = false
+      }
     }
 
     private class Sink extends Expr {
@@ -680,24 +690,38 @@ private module Internal {
         this = any(DispatchCallImpl c).getArgument(_)
       }
 
-      Source getASource() { stepTC(this, result) }
+      pragma[nomagic]
+      Expr getAPred() { stepExpr*(result, this) }
+
+      pragma[nomagic]
+      AnalyzableFieldOrProperty getAPredRead() { this.getAPred() = result.getARead() }
     }
 
-    /** Holds if the expression `e` has an exact type. */
-    private predicate hasExactType(Expr e) {
-      e instanceof ObjectCreation or
-      e instanceof BaseAccess
+    /** Gets a source type for sink expression `e`, using simple data flow. */
+    Type getASourceType(Sink sink, boolean isExact) {
+      result = sink.getAPred().(Source).getType(isExact)
+      or
+      result = sink.getAPredRead().(RelevantFieldOrProperty).getASourceType(isExact)
     }
 
-    /** Gets a source type for expression `e`, using simple data flow. */
-    Type getASourceType(Sink e, boolean isExact) {
-      exists(Source s |
-        s = e.getASource() or
-        s = e
-      |
-        result = s.getType() and
-        if hasExactType(s) then isExact = true else isExact = false
-      )
+    private class RelevantFieldOrProperty extends AnalyzableFieldOrProperty {
+      RelevantFieldOrProperty() {
+        this = any(Sink s).getAPredRead()
+        or
+        this = any(RelevantFieldOrProperty a).getAPredRead()
+      }
+
+      pragma[nomagic]
+      Expr getAPred() { stepExpr*(result, this.getAnAssignedValue()) }
+
+      pragma[nomagic]
+      AnalyzableFieldOrProperty getAPredRead() { this.getAPred() = result.getARead() }
+
+      Type getASourceType(boolean isExact) {
+        result = this.getAPred().(Source).getType(isExact)
+        or
+        result = this.getAPredRead().(RelevantFieldOrProperty).getASourceType(isExact)
+      }
     }
   }
 
diff --git a/csharp/ql/src/semmle/code/csharp/exprs/Call.qll b/csharp/ql/src/semmle/code/csharp/exprs/Call.qll
index 078ecd1a52a..6dc88e941ef 100644
--- a/csharp/ql/src/semmle/code/csharp/exprs/Call.qll
+++ b/csharp/ql/src/semmle/code/csharp/exprs/Call.qll
@@ -8,6 +8,8 @@ import Expr
 import semmle.code.csharp.Callable
 import semmle.code.csharp.dataflow.CallContext as CallContext
 private import semmle.code.csharp.dataflow.internal.DelegateDataFlow
+private import semmle.code.csharp.dataflow.internal.DataFlowDispatch
+private import semmle.code.csharp.dataflow.internal.DataFlowImplCommon
 private import semmle.code.csharp.dispatch.Dispatch
 private import dotnet
 
@@ -536,10 +538,12 @@ class DelegateLikeCall extends Call, DelegateLikeCall_ {
   override Callable getTarget() { none() }
 
   /**
+   * DEPRECATED: Use `getARuntimeTarget/0` instead.
+   *
    * Gets a potential run-time target of this delegate or function pointer call in the given
    * call context `cc`.
    */
-  Callable getARuntimeTarget(CallContext::CallContext cc) {
+  deprecated Callable getARuntimeTarget(CallContext::CallContext cc) {
     exists(DelegateLikeCallExpr call |
       this = call.getCall() and
       result = call.getARuntimeTarget(cc)
@@ -562,7 +566,12 @@ class DelegateLikeCall extends Call, DelegateLikeCall_ {
    */
   Expr getExpr() { result = this.getChild(-1) }
 
-  override Callable getARuntimeTarget() { result = getARuntimeTarget(_) }
+  final override Callable getARuntimeTarget() {
+    exists(ExplicitDelegateLikeDataFlowCall call |
+      this = call.getCall() and
+      result = viableCallableLambda(call, _)
+    )
+  }
 
   override Expr getRuntimeArgument(int i) { result = getArgument(i) }
 }
@@ -582,10 +591,12 @@ class DelegateLikeCall extends Call, DelegateLikeCall_ {
  */
 class DelegateCall extends DelegateLikeCall, @delegate_invocation_expr {
   /**
+   * DEPRECATED: Use `getARuntimeTarget/0` instead.
+   *
    * Gets a potential run-time target of this delegate call in the given
    * call context `cc`.
    */
-  override Callable getARuntimeTarget(CallContext::CallContext cc) {
+  deprecated override Callable getARuntimeTarget(CallContext::CallContext cc) {
     result = DelegateLikeCall.super.getARuntimeTarget(cc)
     or
     exists(AddEventSource aes, CallContext::CallContext cc2 |
@@ -601,16 +612,16 @@ class DelegateCall extends DelegateLikeCall, @delegate_invocation_expr {
     )
   }
 
-  private AddEventSource getAnAddEventSource(Callable enclosingCallable) {
+  deprecated private AddEventSource getAnAddEventSource(Callable enclosingCallable) {
     this.getExpr().(EventAccess).getTarget() = result.getEvent() and
     enclosingCallable = result.getExpr().getEnclosingCallable()
   }
 
-  private AddEventSource getAnAddEventSourceSameEnclosingCallable() {
+  deprecated private AddEventSource getAnAddEventSourceSameEnclosingCallable() {
     result = getAnAddEventSource(this.getEnclosingCallable())
   }
 
-  private AddEventSource getAnAddEventSourceDifferentEnclosingCallable() {
+  deprecated private AddEventSource getAnAddEventSourceDifferentEnclosingCallable() {
     exists(Callable c | result = getAnAddEventSource(c) | c != this.getEnclosingCallable())
   }
 
diff --git a/csharp/ql/src/semmle/code/csharp/exprs/Expr.qll b/csharp/ql/src/semmle/code/csharp/exprs/Expr.qll
index 6006e165470..0988bb84340 100644
--- a/csharp/ql/src/semmle/code/csharp/exprs/Expr.qll
+++ b/csharp/ql/src/semmle/code/csharp/exprs/Expr.qll
@@ -20,7 +20,7 @@ import semmle.code.csharp.Location
 import semmle.code.csharp.Stmt
 import semmle.code.csharp.Type
 private import dotnet
-private import semmle.code.csharp.Enclosing::Internal
+private import semmle.code.csharp.ExprOrStmtParent
 private import semmle.code.csharp.frameworks.System
 private import semmle.code.csharp.TypeRef
 
@@ -55,7 +55,7 @@ class Expr extends DotNet::Expr, ControlFlowElement, @expr {
   final Stmt getEnclosingStmt() { enclosingStmt(this, result) }
 
   /** Gets the enclosing callable of this expression, if any. */
-  override Callable getEnclosingCallable() { exprEnclosingCallable(this, result) }
+  override Callable getEnclosingCallable() { enclosingCallable(this, result) }
 
   /**
    * Holds if this expression is generated by the compiler and does not appear
diff --git a/csharp/ql/src/semmle/code/csharp/frameworks/Dapper.qll b/csharp/ql/src/semmle/code/csharp/frameworks/Dapper.qll
new file mode 100644
index 00000000000..3d25f4389fd
--- /dev/null
+++ b/csharp/ql/src/semmle/code/csharp/frameworks/Dapper.qll
@@ -0,0 +1,42 @@
+/**
+ * Classes for modeling Dapper.
+ */
+
+import csharp
+private import semmle.code.csharp.frameworks.system.Data
+
+/** Definitions relating to the `Dapper` package. */
+module Dapper {
+  /** The namespace `Dapper`. */
+  class DapperNamespace extends Namespace {
+    DapperNamespace() { this.hasQualifiedName("Dapper") }
+  }
+
+  /** A class in `Dapper`. */
+  class DapperClass extends Class {
+    DapperClass() { this.getParent() instanceof DapperNamespace }
+  }
+
+  /** A struct in `Dapper`. */
+  class DapperStruct extends Struct {
+    DapperStruct() { this.getParent() instanceof DapperNamespace }
+  }
+
+  /** The `Dapper.SqlMapper` class. */
+  class SqlMapperClass extends DapperClass {
+    SqlMapperClass() { this.hasName("SqlMapper") }
+
+    /** Gets a DB query method. */
+    ExtensionMethod getAQueryMethod() {
+      result = this.getAMethod() and
+      result.getName().regexpMatch("Query.*|Execute.*") and
+      result.getExtendedType() instanceof SystemDataIDbConnectionInterface and
+      result.isPublic()
+    }
+  }
+
+  /** The `Dapper.CommandDefinition` struct. */
+  class CommandDefinitionStruct extends DapperStruct {
+    CommandDefinitionStruct() { this.hasName("CommandDefinition") }
+  }
+}
diff --git a/csharp/ql/src/semmle/code/csharp/frameworks/EntityFramework.qll b/csharp/ql/src/semmle/code/csharp/frameworks/EntityFramework.qll
index 19f598d0ad1..29939efccdb 100644
--- a/csharp/ql/src/semmle/code/csharp/frameworks/EntityFramework.qll
+++ b/csharp/ql/src/semmle/code/csharp/frameworks/EntityFramework.qll
@@ -9,6 +9,7 @@ private import semmle.code.csharp.frameworks.system.data.Entity
 private import semmle.code.csharp.frameworks.system.collections.Generic
 private import semmle.code.csharp.frameworks.Sql
 private import semmle.code.csharp.dataflow.FlowSummary
+private import semmle.code.csharp.dataflow.internal.DataFlowPrivate as DataFlowPrivate
 
 /**
  * Definitions relating to the `System.ComponentModel.DataAnnotations`
@@ -74,7 +75,7 @@ module EntityFramework {
     DbSet() { this.getName() = "DbSet<>" }
 
     /** Gets a method that adds or updates entities in a DB set. */
-    SummarizableMethod getAnAddOrUpdateMethod(boolean range) {
+    Method getAnAddOrUpdateMethod(boolean range) {
       exists(string name | result = this.getAMethod(name) |
         name in ["Add", "AddAsync", "Attach", "Update"] and
         range = false
@@ -88,23 +89,31 @@ module EntityFramework {
   /** A flow summary for EntityFramework. */
   abstract class EFSummarizedCallable extends SummarizedCallable { }
 
+  private class DbSetAddOrUpdateRequiredSummaryComponentStack extends RequiredSummaryComponentStack {
+    private SummaryComponent head;
+
+    DbSetAddOrUpdateRequiredSummaryComponentStack() {
+      this = SummaryComponentStack::argument([-1, 0]) and
+      head = SummaryComponent::element()
+    }
+
+    override predicate required(SummaryComponent c) { c = head }
+  }
+
   private class DbSetAddOrUpdate extends EFSummarizedCallable {
     private boolean range;
 
     DbSetAddOrUpdate() { this = any(DbSet c).getAnAddOrUpdateMethod(range) }
 
     override predicate propagatesFlow(
-      SummaryInput input, ContentList inputContents, SummaryOutput output,
-      ContentList outputContents, boolean preservesValue
+      SummaryComponentStack input, SummaryComponentStack output, boolean preservesValue
     ) {
-      input = SummaryInput::parameter(0) and
       (
         if range = true
-        then inputContents = ContentList::element()
-        else inputContents = ContentList::empty()
+        then input = SummaryComponentStack::elementOf(SummaryComponentStack::argument(0))
+        else input = SummaryComponentStack::argument(0)
       ) and
-      output = SummaryOutput::thisParameter() and
-      outputContents = ContentList::element() and
+      output = SummaryComponentStack::elementOf(SummaryComponentStack::argument(-1)) and
       preservesValue = true
     }
   }
@@ -165,27 +174,27 @@ module EntityFramework {
   }
 
   private class RawSqlStringSummarizedCallable extends EFSummarizedCallable {
-    private SummaryInput input_;
-    private SummaryOutput output_;
+    private SummaryComponentStack input_;
+    private SummaryComponentStack output_;
     private boolean preservesValue_;
 
     RawSqlStringSummarizedCallable() {
       exists(RawSqlStringStruct s |
         this = s.getAConstructor() and
-        input_ = SummaryInput::parameter(0) and
+        input_ = SummaryComponentStack::argument(0) and
         this.getNumberOfParameters() > 0 and
-        output_ = SummaryOutput::return() and
+        output_ = SummaryComponentStack::return() and
         preservesValue_ = false
         or
         this = s.getAConversionTo() and
-        input_ = SummaryInput::parameter(0) and
-        output_ = SummaryOutput::return() and
+        input_ = SummaryComponentStack::argument(0) and
+        output_ = SummaryComponentStack::return() and
         preservesValue_ = false
       )
     }
 
     override predicate propagatesFlow(
-      SummaryInput input, SummaryOutput output, boolean preservesValue
+      SummaryComponentStack input, SummaryComponentStack output, boolean preservesValue
     ) {
       input = input_ and
       output = output_ and
@@ -295,15 +304,17 @@ module EntityFramework {
      * If `t2` is a column type, `c2` will be included in the model (see
      * https://docs.microsoft.com/en-us/ef/core/modeling/entity-types?tabs=data-annotations).
      */
-    private predicate step(Content c1, Type t1, Content c2, Type t2) {
+    private predicate step(Content c1, Type t1, Content c2, Type t2, int dist) {
       exists(Property p1 |
         p1 = this.getADbSetProperty(t2) and
         c1.(PropertyContent).getProperty() = p1 and
         t1 = p1.getType() and
-        c2 instanceof ElementContent
+        c2 instanceof ElementContent and
+        dist = 0
       )
       or
-      step(_, _, c1, t1) and
+      step(_, _, c1, t1, dist - 1) and
+      dist < DataFlowPrivate::accessPathLimit() - 1 and
       not isNotMapped(t2) and
       (
         // Navigation property (https://docs.microsoft.com/en-us/ef/ef6/fundamentals/relationships)
@@ -350,52 +361,61 @@ module EntityFramework {
      * }
      * ```
      */
-    private Property getAColumnProperty() {
+    Property getAColumnProperty(int dist) {
       exists(PropertyContent c, Type t |
-        this.step(_, _, c, t) and
+        this.step(_, _, c, t, dist) and
         c.getProperty() = result and
         isColumnType(t)
       )
     }
 
+    private predicate stepRev(Content c1, Type t1, Content c2, Type t2, int dist) {
+      step(c1, t1, c2, t2, dist) and
+      c2.(PropertyContent).getProperty() = getAColumnProperty(dist)
+      or
+      stepRev(c2, t2, _, _, dist + 1) and
+      step(c1, t1, c2, t2, dist)
+    }
+
     /** Gets a `SaveChanges[Async]` method. */
     pragma[nomagic]
-    SummarizableMethod getASaveChanges() {
+    Method getASaveChanges() {
       this.hasMethod(result) and
       result.getName().matches("SaveChanges%")
     }
 
-    /** Holds if content list `head :: tail` is required. */
-    predicate requiresContentList(
-      Content head, Type headType, ContentList tail, Type tailType, Property last
+    /** Holds if component stack `head :: tail` is required for the input specification. */
+    predicate requiresComponentStackIn(
+      Content head, Type headType, SummaryComponentStack tail, int dist
     ) {
-      exists(PropertyContent p |
-        last = this.getAColumnProperty() and
-        p.getProperty() = last and
-        tail = ContentList::singleton(p) and
-        this.step(head, headType, p, tailType)
-      )
+      tail = SummaryComponentStack::qualifier() and
+      this.stepRev(head, headType, _, _, 0) and
+      dist = -1
       or
-      exists(Content tailHead, ContentList tailTail |
-        this.requiresContentList(tailHead, tailType, tailTail, _, last) and
-        tail = ContentList::cons(tailHead, tailTail) and
-        this.step(head, headType, tailHead, tailType)
+      exists(Content tailHead, Type tailType, SummaryComponentStack tailTail |
+        this.requiresComponentStackIn(tailHead, tailType, tailTail, dist - 1) and
+        tail = SummaryComponentStack::push(SummaryComponent::content(tailHead), tailTail) and
+        this.stepRev(tailHead, tailType, head, headType, dist)
       )
     }
 
-    /**
-     * Holds if the access path obtained by concatenating `head` onto `tail`
-     * is a path from `dbSet` (which is a `DbSet<T>` property belonging to
-     * this DB context) to `last`, which is a property that is mapped directly
-     * to a column in the underlying DB.
-     */
-    pragma[noinline]
-    predicate pathFromDbSetToDbProperty(
-      Property dbSet, PropertyContent head, ContentList tail, Property last
+    /** Holds if component stack `head :: tail` is required for the output specification. */
+    predicate requiresComponentStackOut(
+      Content head, Type headType, SummaryComponentStack tail, int dist
     ) {
-      this.requiresContentList(head, _, tail, _, last) and
-      head.getProperty() = dbSet and
-      dbSet = this.getADbSetProperty(_)
+      exists(Property dbSetProp, PropertyContent c1 |
+        dbSetProp = this.getADbSetProperty(headType) and
+        this.stepRev(c1, _, head, headType, 0) and
+        c1.getProperty() = dbSetProp and
+        tail = SummaryComponentStack::jump(dbSetProp.getGetter()) and
+        dist = 0
+      )
+      or
+      exists(Content tailHead, SummaryComponentStack tailTail, Type tailType |
+        this.requiresComponentStackOut(tailHead, tailType, tailTail, dist - 1) and
+        tail = SummaryComponentStack::push(SummaryComponent::content(tailHead), tailTail) and
+        this.stepRev(tailHead, tailType, head, headType, dist)
+      )
     }
   }
 
@@ -404,26 +424,46 @@ module EntityFramework {
 
     DbContextSaveChanges() { this = c.getASaveChanges() }
 
-    override predicate requiresContentList(Content head, ContentList tail) {
-      c.requiresContentList(head, _, tail, _, _)
+    pragma[noinline]
+    private predicate input(SummaryComponentStack input, Property mapped) {
+      exists(PropertyContent head, SummaryComponentStack tail |
+        c.requiresComponentStackIn(head, _, tail, _) and
+        head.getProperty() = mapped and
+        mapped = c.getAColumnProperty(_) and
+        input = SummaryComponentStack::push(SummaryComponent::content(head), tail)
+      )
+    }
+
+    pragma[noinline]
+    private predicate output(SummaryComponentStack output, Property mapped) {
+      exists(PropertyContent head, SummaryComponentStack tail |
+        c.requiresComponentStackOut(head, _, tail, _) and
+        head.getProperty() = mapped and
+        mapped = c.getAColumnProperty(_) and
+        output = SummaryComponentStack::push(SummaryComponent::content(head), tail)
+      )
     }
 
     override predicate propagatesFlow(
-      SummaryInput input, ContentList inputContents, SummaryOutput output,
-      ContentList outputContents, boolean preservesValue
+      SummaryComponentStack input, SummaryComponentStack output, boolean preservesValue
     ) {
       exists(Property mapped |
         preservesValue = true and
-        exists(PropertyContent sourceHead, ContentList sourceTail |
-          input = SummaryInput::thisParameter() and
-          c.pathFromDbSetToDbProperty(_, sourceHead, sourceTail, mapped) and
-          inputContents = ContentList::cons(sourceHead, sourceTail)
-        ) and
-        exists(Property dbSetProp |
-          output = SummaryOutput::jump(dbSetProp.getGetter(), SummaryOutput::return()) and
-          c.pathFromDbSetToDbProperty(dbSetProp, _, outputContents, mapped)
-        )
+        input(input, mapped) and
+        output(output, mapped)
       )
     }
   }
+
+  private class DbContextSaveChangesRequiredSummaryComponentStack extends RequiredSummaryComponentStack {
+    private Content head;
+
+    DbContextSaveChangesRequiredSummaryComponentStack() {
+      any(DbContextClass c).requiresComponentStackIn(head, _, this, _)
+      or
+      any(DbContextClass c).requiresComponentStackOut(head, _, this, _)
+    }
+
+    override predicate required(SummaryComponent c) { c = SummaryComponent::content(head) }
+  }
 }
diff --git a/csharp/ql/src/semmle/code/csharp/frameworks/Sql.qll b/csharp/ql/src/semmle/code/csharp/frameworks/Sql.qll
index 5774b22a631..1a727030bea 100644
--- a/csharp/ql/src/semmle/code/csharp/frameworks/Sql.qll
+++ b/csharp/ql/src/semmle/code/csharp/frameworks/Sql.qll
@@ -5,6 +5,8 @@ private import semmle.code.csharp.frameworks.system.Data
 private import semmle.code.csharp.frameworks.system.data.SqlClient
 private import semmle.code.csharp.frameworks.EntityFramework
 private import semmle.code.csharp.frameworks.NHibernate
+private import semmle.code.csharp.frameworks.Dapper
+private import semmle.code.csharp.dataflow.DataFlow4
 
 /** An expression containing a SQL command. */
 abstract class SqlExpr extends Expr {
@@ -83,3 +85,37 @@ class MicrosoftSqlHelperMethodCallSqlExpr extends SqlExpr, MethodCall {
     )
   }
 }
+
+/** A `Dapper.SqlMapper` method that is taking a SQL string argument. */
+class DapperSqlMethodCallSqlExpr extends SqlExpr, MethodCall {
+  DapperSqlMethodCallSqlExpr() {
+    this.getTarget() = any(Dapper::SqlMapperClass c).getAQueryMethod()
+  }
+
+  override Expr getSql() { result = this.getArgumentForName("sql") }
+}
+
+/** A `Dapper.CommandDefinition` creation that is taking a SQL string argument and is passed to a `Dapper.SqlMapper` method. */
+class DapperCommandDefinitionMethodCallSqlExpr extends SqlExpr, ObjectCreation {
+  DapperCommandDefinitionMethodCallSqlExpr() {
+    this.getObjectType() instanceof Dapper::CommandDefinitionStruct and
+    exists(Conf c | c.hasFlow(DataFlow::exprNode(this), _))
+  }
+
+  override Expr getSql() { result = this.getArgumentForName("commandText") }
+}
+
+private class Conf extends DataFlow4::Configuration {
+  Conf() { this = "DapperCommandDefinitionFlowConfig" }
+
+  override predicate isSource(DataFlow::Node node) {
+    node.asExpr().(ObjectCreation).getObjectType() instanceof Dapper::CommandDefinitionStruct
+  }
+
+  override predicate isSink(DataFlow::Node node) {
+    exists(MethodCall mc |
+      mc.getTarget() = any(Dapper::SqlMapperClass c).getAQueryMethod() and
+      node.asExpr() = mc.getArgumentForName("command")
+    )
+  }
+}
diff --git a/csharp/ql/src/semmle/code/dotnet/Element.qll b/csharp/ql/src/semmle/code/dotnet/Element.qll
index 956a5f2c052..c38b09ce270 100644
--- a/csharp/ql/src/semmle/code/dotnet/Element.qll
+++ b/csharp/ql/src/semmle/code/dotnet/Element.qll
@@ -28,6 +28,9 @@ class Element extends @dotnet_element {
   /** Holds if this element is from source code. */
   predicate fromSource() { this.getFile().fromSource() }
 
+  /** Holds if this element is from an assembly. */
+  predicate fromLibrary() { this.getFile().fromLibrary() }
+
   /**
    * Gets the "language" of this program element, as defined by the extension of the filename.
    * For example, C# has language "cs", and Visual Basic has language "vb".
diff --git a/csharp/ql/test/library-tests/controlflow/graph/Common.qll b/csharp/ql/test/library-tests/controlflow/graph/Common.qll
index 5945d2003b2..f6f9b26f1cd 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/Common.qll
+++ b/csharp/ql/test/library-tests/controlflow/graph/Common.qll
@@ -11,9 +11,15 @@ class SourceControlFlowElement extends ControlFlowElement {
 }
 
 class SourceControlFlowNode extends ControlFlow::Node {
-  SourceControlFlowNode() { not this.getLocation().getFile() instanceof StubFile }
+  SourceControlFlowNode() {
+    not this.getLocation().getFile() instanceof StubFile and
+    not this.getLocation().getFile().fromLibrary()
+  }
 }
 
 class SourceBasicBlock extends ControlFlow::BasicBlock {
-  SourceBasicBlock() { not this.getLocation().getFile() instanceof StubFile }
+  SourceBasicBlock() {
+    not this.getLocation().getFile() instanceof StubFile and
+    not this.getLocation().getFile().fromLibrary()
+  }
 }
diff --git a/csharp/ql/test/library-tests/controlflow/splits/SplittingStressTest.ql b/csharp/ql/test/library-tests/controlflow/splits/SplittingStressTest.ql
index 4a07618c373..2c637ff0db1 100644
--- a/csharp/ql/test/library-tests/controlflow/splits/SplittingStressTest.ql
+++ b/csharp/ql/test/library-tests/controlflow/splits/SplittingStressTest.ql
@@ -1,6 +1,7 @@
 import csharp
 
 query predicate countSplits(ControlFlowElement cfe, int i) {
+  not cfe.fromLibrary() and
   i = strictcount(ControlFlow::Nodes::ElementNode n | n.getElement() = cfe)
 }
 
diff --git a/csharp/ql/test/library-tests/csharp7.1/DefaultLiterals.ql b/csharp/ql/test/library-tests/csharp7.1/DefaultLiterals.ql
index 63e5a69b6e5..578b7e7fef4 100644
--- a/csharp/ql/test/library-tests/csharp7.1/DefaultLiterals.ql
+++ b/csharp/ql/test/library-tests/csharp7.1/DefaultLiterals.ql
@@ -1,4 +1,5 @@
 import csharp
 
 from DefaultValueExpr l
+where l.fromSource()
 select l, l.getValue()
diff --git a/csharp/ql/test/library-tests/csharp7/GlobalFlow.expected b/csharp/ql/test/library-tests/csharp7/GlobalFlow.expected
index 9e928eddbf9..1c058bc57f8 100644
--- a/csharp/ql/test/library-tests/csharp7/GlobalFlow.expected
+++ b/csharp/ql/test/library-tests/csharp7/GlobalFlow.expected
@@ -4,9 +4,9 @@ edges
 | CSharp7.cs:51:22:51:23 | SSA def(t1) : String | CSharp7.cs:53:18:53:19 | access to local variable t1 |
 | CSharp7.cs:57:11:57:19 | "tainted" : String | CSharp7.cs:57:30:57:31 | SSA def(t4) : String |
 | CSharp7.cs:57:30:57:31 | SSA def(t4) : String | CSharp7.cs:58:18:58:19 | access to local variable t4 |
-| CSharp7.cs:89:18:89:34 | (..., ...) [Item1] : String | CSharp7.cs:92:20:92:21 | access to local variable t1 [Item1] : String |
-| CSharp7.cs:89:19:89:27 | "tainted" : String | CSharp7.cs:89:18:89:34 | (..., ...) [Item1] : String |
-| CSharp7.cs:92:20:92:21 | access to local variable t1 [Item1] : String | CSharp7.cs:92:20:92:27 | access to field Item1 : String |
+| CSharp7.cs:89:18:89:34 | (..., ...) [field Item1] : String | CSharp7.cs:92:20:92:21 | access to local variable t1 [field Item1] : String |
+| CSharp7.cs:89:19:89:27 | "tainted" : String | CSharp7.cs:89:18:89:34 | (..., ...) [field Item1] : String |
+| CSharp7.cs:92:20:92:21 | access to local variable t1 [field Item1] : String | CSharp7.cs:92:20:92:27 | access to field Item1 : String |
 | CSharp7.cs:92:20:92:27 | access to field Item1 : String | CSharp7.cs:92:18:92:28 | call to method I |
 | CSharp7.cs:177:22:177:30 | "tainted" : String | CSharp7.cs:183:23:183:25 | access to local variable src : String |
 | CSharp7.cs:177:22:177:30 | "tainted" : String | CSharp7.cs:184:23:184:25 | access to local variable src : String |
@@ -20,10 +20,10 @@ nodes
 | CSharp7.cs:57:11:57:19 | "tainted" : String | semmle.label | "tainted" : String |
 | CSharp7.cs:57:30:57:31 | SSA def(t4) : String | semmle.label | SSA def(t4) : String |
 | CSharp7.cs:58:18:58:19 | access to local variable t4 | semmle.label | access to local variable t4 |
-| CSharp7.cs:89:18:89:34 | (..., ...) [Item1] : String | semmle.label | (..., ...) [Item1] : String |
+| CSharp7.cs:89:18:89:34 | (..., ...) [field Item1] : String | semmle.label | (..., ...) [field Item1] : String |
 | CSharp7.cs:89:19:89:27 | "tainted" : String | semmle.label | "tainted" : String |
 | CSharp7.cs:92:18:92:28 | call to method I | semmle.label | call to method I |
-| CSharp7.cs:92:20:92:21 | access to local variable t1 [Item1] : String | semmle.label | access to local variable t1 [Item1] : String |
+| CSharp7.cs:92:20:92:21 | access to local variable t1 [field Item1] : String | semmle.label | access to local variable t1 [field Item1] : String |
 | CSharp7.cs:92:20:92:27 | access to field Item1 : String | semmle.label | access to field Item1 : String |
 | CSharp7.cs:177:22:177:30 | "tainted" | semmle.label | "tainted" |
 | CSharp7.cs:177:22:177:30 | "tainted" : String | semmle.label | "tainted" : String |
diff --git a/csharp/ql/test/library-tests/csharp7/GlobalTaintTracking.expected b/csharp/ql/test/library-tests/csharp7/GlobalTaintTracking.expected
index 5a04e010d6b..905162f0bbb 100644
--- a/csharp/ql/test/library-tests/csharp7/GlobalTaintTracking.expected
+++ b/csharp/ql/test/library-tests/csharp7/GlobalTaintTracking.expected
@@ -4,9 +4,9 @@ edges
 | CSharp7.cs:51:22:51:23 | SSA def(t1) : String | CSharp7.cs:53:18:53:19 | access to local variable t1 |
 | CSharp7.cs:57:11:57:19 | "tainted" : String | CSharp7.cs:57:30:57:31 | SSA def(t4) : String |
 | CSharp7.cs:57:30:57:31 | SSA def(t4) : String | CSharp7.cs:58:18:58:19 | access to local variable t4 |
-| CSharp7.cs:89:18:89:34 | (..., ...) [Item1] : String | CSharp7.cs:92:20:92:21 | access to local variable t1 [Item1] : String |
-| CSharp7.cs:89:19:89:27 | "tainted" : String | CSharp7.cs:89:18:89:34 | (..., ...) [Item1] : String |
-| CSharp7.cs:92:20:92:21 | access to local variable t1 [Item1] : String | CSharp7.cs:92:20:92:27 | access to field Item1 : String |
+| CSharp7.cs:89:18:89:34 | (..., ...) [field Item1] : String | CSharp7.cs:92:20:92:21 | access to local variable t1 [field Item1] : String |
+| CSharp7.cs:89:19:89:27 | "tainted" : String | CSharp7.cs:89:18:89:34 | (..., ...) [field Item1] : String |
+| CSharp7.cs:92:20:92:21 | access to local variable t1 [field Item1] : String | CSharp7.cs:92:20:92:27 | access to field Item1 : String |
 | CSharp7.cs:92:20:92:27 | access to field Item1 : String | CSharp7.cs:92:18:92:28 | call to method I |
 | CSharp7.cs:177:22:177:30 | "tainted" : String | CSharp7.cs:182:23:182:25 | access to local variable src : String |
 | CSharp7.cs:177:22:177:30 | "tainted" : String | CSharp7.cs:183:23:183:25 | access to local variable src : String |
@@ -22,10 +22,10 @@ nodes
 | CSharp7.cs:57:11:57:19 | "tainted" : String | semmle.label | "tainted" : String |
 | CSharp7.cs:57:30:57:31 | SSA def(t4) : String | semmle.label | SSA def(t4) : String |
 | CSharp7.cs:58:18:58:19 | access to local variable t4 | semmle.label | access to local variable t4 |
-| CSharp7.cs:89:18:89:34 | (..., ...) [Item1] : String | semmle.label | (..., ...) [Item1] : String |
+| CSharp7.cs:89:18:89:34 | (..., ...) [field Item1] : String | semmle.label | (..., ...) [field Item1] : String |
 | CSharp7.cs:89:19:89:27 | "tainted" : String | semmle.label | "tainted" : String |
 | CSharp7.cs:92:18:92:28 | call to method I | semmle.label | call to method I |
-| CSharp7.cs:92:20:92:21 | access to local variable t1 [Item1] : String | semmle.label | access to local variable t1 [Item1] : String |
+| CSharp7.cs:92:20:92:21 | access to local variable t1 [field Item1] : String | semmle.label | access to local variable t1 [field Item1] : String |
 | CSharp7.cs:92:20:92:27 | access to field Item1 : String | semmle.label | access to field Item1 : String |
 | CSharp7.cs:177:22:177:30 | "tainted" | semmle.label | "tainted" |
 | CSharp7.cs:177:22:177:30 | "tainted" : String | semmle.label | "tainted" : String |
diff --git a/csharp/ql/test/library-tests/csharp7/LocalTaintFlow.ql b/csharp/ql/test/library-tests/csharp7/LocalTaintFlow.ql
index 22f61aacdd8..ed293efc2ba 100644
--- a/csharp/ql/test/library-tests/csharp7/LocalTaintFlow.ql
+++ b/csharp/ql/test/library-tests/csharp7/LocalTaintFlow.ql
@@ -2,5 +2,7 @@ import csharp
 import semmle.code.csharp.dataflow.TaintTracking
 
 from DataFlow::Node pred, DataFlow::Node succ
-where TaintTracking::localTaintStep(pred, succ)
+where
+  TaintTracking::localTaintStep(pred, succ) and
+  not pred.asExpr().fromLibrary()
 select pred, succ
diff --git a/csharp/ql/test/library-tests/dataflow/async/Async.cs b/csharp/ql/test/library-tests/dataflow/async/Async.cs
new file mode 100644
index 00000000000..feb30fbbc49
--- /dev/null
+++ b/csharp/ql/test/library-tests/dataflow/async/Async.cs
@@ -0,0 +1,52 @@
+using System.Threading.Tasks;
+
+class Test
+{
+    private void Sink(string s)
+    {
+    }
+
+    public void TestNonAwait(string input)
+    {
+        Sink(Return(input));
+    }
+
+    private string Return(string x)
+    {
+        return x;
+    }
+
+    public async Task TestAwait1(string input)
+    {
+        Sink(await ReturnAwait(input));
+    }
+
+    public async Task TestAwait2(string input)
+    {
+        var x = await ReturnAwait(input);
+        Sink(x);
+    }
+
+    public void TestAwait3(string input)
+    {
+        Sink(ReturnAwait2(input).Result);
+    }
+
+    private async Task<string> ReturnAwait(string x)
+    {
+        await Task.Delay(1);
+        return x;
+    }
+
+    public void TestTask(string input)
+    {
+        Sink(ReturnTask(input).Result);
+    }
+
+    private Task<string> ReturnTask(string x)
+    {
+        return Task.FromResult(x);
+    }
+
+    private async Task<string> ReturnAwait2(string x) => x;
+}
\ No newline at end of file
diff --git a/csharp/ql/test/library-tests/dataflow/async/Async.expected b/csharp/ql/test/library-tests/dataflow/async/Async.expected
new file mode 100644
index 00000000000..6e1434dcf68
--- /dev/null
+++ b/csharp/ql/test/library-tests/dataflow/async/Async.expected
@@ -0,0 +1,67 @@
+edges
+| Async.cs:9:37:9:41 | input : String | Async.cs:11:21:11:25 | access to parameter input : String |
+| Async.cs:11:21:11:25 | access to parameter input : String | Async.cs:11:14:11:26 | call to method Return |
+| Async.cs:14:34:14:34 | x : String | Async.cs:16:16:16:16 | access to parameter x : String |
+| Async.cs:16:16:16:16 | access to parameter x : String | Async.cs:11:14:11:26 | call to method Return |
+| Async.cs:19:41:19:45 | input : String | Async.cs:21:32:21:36 | access to parameter input : String |
+| Async.cs:21:20:21:37 | call to method ReturnAwait [property Result] : String | Async.cs:21:14:21:37 | await ... |
+| Async.cs:21:32:21:36 | access to parameter input : String | Async.cs:21:20:21:37 | call to method ReturnAwait [property Result] : String |
+| Async.cs:24:41:24:45 | input : String | Async.cs:26:35:26:39 | access to parameter input : String |
+| Async.cs:26:17:26:40 | await ... : String | Async.cs:27:14:27:14 | access to local variable x |
+| Async.cs:26:23:26:40 | call to method ReturnAwait [property Result] : String | Async.cs:26:17:26:40 | await ... : String |
+| Async.cs:26:35:26:39 | access to parameter input : String | Async.cs:26:23:26:40 | call to method ReturnAwait [property Result] : String |
+| Async.cs:30:35:30:39 | input : String | Async.cs:32:27:32:31 | access to parameter input : String |
+| Async.cs:32:14:32:32 | call to method ReturnAwait2 [property Result] : String | Async.cs:32:14:32:39 | access to property Result |
+| Async.cs:32:27:32:31 | access to parameter input : String | Async.cs:32:14:32:32 | call to method ReturnAwait2 [property Result] : String |
+| Async.cs:35:51:35:51 | x : String | Async.cs:38:16:38:16 | access to parameter x : String |
+| Async.cs:38:16:38:16 | access to parameter x : String | Async.cs:21:20:21:37 | call to method ReturnAwait [property Result] : String |
+| Async.cs:38:16:38:16 | access to parameter x : String | Async.cs:26:23:26:40 | call to method ReturnAwait [property Result] : String |
+| Async.cs:41:33:41:37 | input : String | Async.cs:43:25:43:29 | access to parameter input : String |
+| Async.cs:43:14:43:30 | call to method ReturnTask [property Result] : String | Async.cs:43:14:43:37 | access to property Result |
+| Async.cs:43:25:43:29 | access to parameter input : String | Async.cs:43:14:43:30 | call to method ReturnTask [property Result] : String |
+| Async.cs:46:44:46:44 | x : String | Async.cs:48:32:48:32 | access to parameter x : String |
+| Async.cs:48:16:48:33 | call to method FromResult [property Result] : String | Async.cs:43:14:43:30 | call to method ReturnTask [property Result] : String |
+| Async.cs:48:32:48:32 | access to parameter x : String | Async.cs:48:16:48:33 | call to method FromResult [property Result] : String |
+| Async.cs:51:52:51:52 | x : String | Async.cs:51:58:51:58 | access to parameter x : String |
+| Async.cs:51:58:51:58 | access to parameter x : String | Async.cs:32:14:32:32 | call to method ReturnAwait2 [property Result] : String |
+nodes
+| Async.cs:9:37:9:41 | input : String | semmle.label | input : String |
+| Async.cs:11:14:11:26 | call to method Return | semmle.label | call to method Return |
+| Async.cs:11:21:11:25 | access to parameter input : String | semmle.label | access to parameter input : String |
+| Async.cs:14:34:14:34 | x : String | semmle.label | x : String |
+| Async.cs:16:16:16:16 | access to parameter x : String | semmle.label | access to parameter x : String |
+| Async.cs:19:41:19:45 | input : String | semmle.label | input : String |
+| Async.cs:21:14:21:37 | await ... | semmle.label | await ... |
+| Async.cs:21:20:21:37 | call to method ReturnAwait [property Result] : String | semmle.label | call to method ReturnAwait [property Result] : String |
+| Async.cs:21:32:21:36 | access to parameter input : String | semmle.label | access to parameter input : String |
+| Async.cs:24:41:24:45 | input : String | semmle.label | input : String |
+| Async.cs:26:17:26:40 | await ... : String | semmle.label | await ... : String |
+| Async.cs:26:23:26:40 | call to method ReturnAwait [property Result] : String | semmle.label | call to method ReturnAwait [property Result] : String |
+| Async.cs:26:35:26:39 | access to parameter input : String | semmle.label | access to parameter input : String |
+| Async.cs:27:14:27:14 | access to local variable x | semmle.label | access to local variable x |
+| Async.cs:30:35:30:39 | input : String | semmle.label | input : String |
+| Async.cs:32:14:32:32 | call to method ReturnAwait2 [property Result] : String | semmle.label | call to method ReturnAwait2 [property Result] : String |
+| Async.cs:32:14:32:39 | access to property Result | semmle.label | access to property Result |
+| Async.cs:32:27:32:31 | access to parameter input : String | semmle.label | access to parameter input : String |
+| Async.cs:35:51:35:51 | x : String | semmle.label | x : String |
+| Async.cs:38:16:38:16 | access to parameter x : String | semmle.label | access to parameter x : String |
+| Async.cs:41:33:41:37 | input : String | semmle.label | input : String |
+| Async.cs:43:14:43:30 | call to method ReturnTask [property Result] : String | semmle.label | call to method ReturnTask [property Result] : String |
+| Async.cs:43:14:43:37 | access to property Result | semmle.label | access to property Result |
+| Async.cs:43:25:43:29 | access to parameter input : String | semmle.label | access to parameter input : String |
+| Async.cs:46:44:46:44 | x : String | semmle.label | x : String |
+| Async.cs:48:16:48:33 | call to method FromResult [property Result] : String | semmle.label | call to method FromResult [property Result] : String |
+| Async.cs:48:32:48:32 | access to parameter x : String | semmle.label | access to parameter x : String |
+| Async.cs:51:52:51:52 | x : String | semmle.label | x : String |
+| Async.cs:51:58:51:58 | access to parameter x : String | semmle.label | access to parameter x : String |
+#select
+| Async.cs:11:14:11:26 | call to method Return | Async.cs:9:37:9:41 | input : String | Async.cs:11:14:11:26 | call to method Return | $@ flows to here and is used. | Async.cs:9:37:9:41 | input | User-provided value |
+| Async.cs:11:14:11:26 | call to method Return | Async.cs:14:34:14:34 | x : String | Async.cs:11:14:11:26 | call to method Return | $@ flows to here and is used. | Async.cs:14:34:14:34 | x | User-provided value |
+| Async.cs:21:14:21:37 | await ... | Async.cs:19:41:19:45 | input : String | Async.cs:21:14:21:37 | await ... | $@ flows to here and is used. | Async.cs:19:41:19:45 | input | User-provided value |
+| Async.cs:21:14:21:37 | await ... | Async.cs:35:51:35:51 | x : String | Async.cs:21:14:21:37 | await ... | $@ flows to here and is used. | Async.cs:35:51:35:51 | x | User-provided value |
+| Async.cs:27:14:27:14 | access to local variable x | Async.cs:24:41:24:45 | input : String | Async.cs:27:14:27:14 | access to local variable x | $@ flows to here and is used. | Async.cs:24:41:24:45 | input | User-provided value |
+| Async.cs:27:14:27:14 | access to local variable x | Async.cs:35:51:35:51 | x : String | Async.cs:27:14:27:14 | access to local variable x | $@ flows to here and is used. | Async.cs:35:51:35:51 | x | User-provided value |
+| Async.cs:32:14:32:39 | access to property Result | Async.cs:30:35:30:39 | input : String | Async.cs:32:14:32:39 | access to property Result | $@ flows to here and is used. | Async.cs:30:35:30:39 | input | User-provided value |
+| Async.cs:32:14:32:39 | access to property Result | Async.cs:51:52:51:52 | x : String | Async.cs:32:14:32:39 | access to property Result | $@ flows to here and is used. | Async.cs:51:52:51:52 | x | User-provided value |
+| Async.cs:43:14:43:37 | access to property Result | Async.cs:41:33:41:37 | input : String | Async.cs:43:14:43:37 | access to property Result | $@ flows to here and is used. | Async.cs:41:33:41:37 | input | User-provided value |
+| Async.cs:43:14:43:37 | access to property Result | Async.cs:46:44:46:44 | x : String | Async.cs:43:14:43:37 | access to property Result | $@ flows to here and is used. | Async.cs:46:44:46:44 | x | User-provided value |
diff --git a/csharp/ql/test/library-tests/dataflow/async/Async.ql b/csharp/ql/test/library-tests/dataflow/async/Async.ql
new file mode 100644
index 00000000000..71799e22f8a
--- /dev/null
+++ b/csharp/ql/test/library-tests/dataflow/async/Async.ql
@@ -0,0 +1,33 @@
+import csharp
+import semmle.code.csharp.dataflow.DataFlow::DataFlow::PathGraph
+
+class MySink extends DataFlow::ExprNode {
+  MySink() {
+    exists(Method m, MethodCall mc |
+      mc.getTarget() = m and
+      m.getName() = "Sink" and
+      this.getExpr() = mc.getArgumentForName("s")
+    )
+  }
+}
+
+class MySource extends DataFlow::ParameterNode {
+  MySource() {
+    exists(Parameter p | p = this.getParameter() |
+      p = any(Class c | c.hasQualifiedName("Test")).getAMethod().getAParameter()
+    )
+  }
+}
+
+class MyConfig extends TaintTracking::Configuration {
+  MyConfig() { this = "MyConfig" }
+
+  override predicate isSource(DataFlow::Node source) { source instanceof MySource }
+
+  override predicate isSink(DataFlow::Node sink) { sink instanceof MySink }
+}
+
+from MyConfig c, DataFlow::PathNode source, DataFlow::PathNode sink
+where c.hasFlowPath(source, sink)
+select sink.getNode(), source, sink, "$@ flows to here and is used.", source.getNode(),
+  "User-provided value"
diff --git a/csharp/ql/test/library-tests/dataflow/collections/CollectionFlow.expected b/csharp/ql/test/library-tests/dataflow/collections/CollectionFlow.expected
index 3c27e96311b..3295c03ac94 100644
--- a/csharp/ql/test/library-tests/dataflow/collections/CollectionFlow.expected
+++ b/csharp/ql/test/library-tests/dataflow/collections/CollectionFlow.expected
@@ -1,367 +1,367 @@
 edges
 | CollectionFlow.cs:14:17:14:23 | object creation of type A : A | CollectionFlow.cs:15:27:15:27 | access to local variable a : A |
-| CollectionFlow.cs:15:25:15:29 | { ..., ... } [[]] : A | CollectionFlow.cs:16:14:16:16 | access to local variable as [[]] : A |
-| CollectionFlow.cs:15:25:15:29 | { ..., ... } [[]] : A | CollectionFlow.cs:17:18:17:20 | access to local variable as [[]] : A |
-| CollectionFlow.cs:15:25:15:29 | { ..., ... } [[]] : A | CollectionFlow.cs:18:20:18:22 | access to local variable as [[]] : A |
-| CollectionFlow.cs:15:27:15:27 | access to local variable a : A | CollectionFlow.cs:15:25:15:29 | { ..., ... } [[]] : A |
-| CollectionFlow.cs:16:14:16:16 | access to local variable as [[]] : A | CollectionFlow.cs:16:14:16:19 | access to array element |
-| CollectionFlow.cs:17:18:17:20 | access to local variable as [[]] : A | CollectionFlow.cs:374:40:374:41 | ts [[]] : A |
-| CollectionFlow.cs:18:20:18:22 | access to local variable as [[]] : A | CollectionFlow.cs:18:14:18:23 | call to method First |
+| CollectionFlow.cs:15:25:15:29 | { ..., ... } [element] : A | CollectionFlow.cs:16:14:16:16 | access to local variable as [element] : A |
+| CollectionFlow.cs:15:25:15:29 | { ..., ... } [element] : A | CollectionFlow.cs:17:18:17:20 | access to local variable as [element] : A |
+| CollectionFlow.cs:15:25:15:29 | { ..., ... } [element] : A | CollectionFlow.cs:18:20:18:22 | access to local variable as [element] : A |
+| CollectionFlow.cs:15:27:15:27 | access to local variable a : A | CollectionFlow.cs:15:25:15:29 | { ..., ... } [element] : A |
+| CollectionFlow.cs:16:14:16:16 | access to local variable as [element] : A | CollectionFlow.cs:16:14:16:19 | access to array element |
+| CollectionFlow.cs:17:18:17:20 | access to local variable as [element] : A | CollectionFlow.cs:374:40:374:41 | ts [element] : A |
+| CollectionFlow.cs:18:20:18:22 | access to local variable as [element] : A | CollectionFlow.cs:18:14:18:23 | call to method First |
 | CollectionFlow.cs:32:17:32:23 | object creation of type A : A | CollectionFlow.cs:33:53:33:53 | access to local variable a : A |
-| CollectionFlow.cs:33:38:33:57 | { ..., ... } [As, []] : A | CollectionFlow.cs:34:14:34:14 | access to local variable c [As, []] : A |
-| CollectionFlow.cs:33:38:33:57 | { ..., ... } [As, []] : A | CollectionFlow.cs:35:18:35:18 | access to local variable c [As, []] : A |
-| CollectionFlow.cs:33:38:33:57 | { ..., ... } [As, []] : A | CollectionFlow.cs:36:20:36:20 | access to local variable c [As, []] : A |
-| CollectionFlow.cs:33:45:33:55 | { ..., ... } [[]] : A | CollectionFlow.cs:33:38:33:57 | { ..., ... } [As, []] : A |
-| CollectionFlow.cs:33:53:33:53 | access to local variable a : A | CollectionFlow.cs:33:45:33:55 | { ..., ... } [[]] : A |
-| CollectionFlow.cs:34:14:34:14 | access to local variable c [As, []] : A | CollectionFlow.cs:34:14:34:17 | access to field As [[]] : A |
-| CollectionFlow.cs:34:14:34:17 | access to field As [[]] : A | CollectionFlow.cs:34:14:34:20 | access to array element |
-| CollectionFlow.cs:35:18:35:18 | access to local variable c [As, []] : A | CollectionFlow.cs:35:18:35:21 | access to field As [[]] : A |
-| CollectionFlow.cs:35:18:35:21 | access to field As [[]] : A | CollectionFlow.cs:374:40:374:41 | ts [[]] : A |
-| CollectionFlow.cs:36:20:36:20 | access to local variable c [As, []] : A | CollectionFlow.cs:36:20:36:23 | access to field As [[]] : A |
-| CollectionFlow.cs:36:20:36:23 | access to field As [[]] : A | CollectionFlow.cs:36:14:36:24 | call to method First |
+| CollectionFlow.cs:33:38:33:57 | { ..., ... } [field As, element] : A | CollectionFlow.cs:34:14:34:14 | access to local variable c [field As, element] : A |
+| CollectionFlow.cs:33:38:33:57 | { ..., ... } [field As, element] : A | CollectionFlow.cs:35:18:35:18 | access to local variable c [field As, element] : A |
+| CollectionFlow.cs:33:38:33:57 | { ..., ... } [field As, element] : A | CollectionFlow.cs:36:20:36:20 | access to local variable c [field As, element] : A |
+| CollectionFlow.cs:33:45:33:55 | { ..., ... } [element] : A | CollectionFlow.cs:33:38:33:57 | { ..., ... } [field As, element] : A |
+| CollectionFlow.cs:33:53:33:53 | access to local variable a : A | CollectionFlow.cs:33:45:33:55 | { ..., ... } [element] : A |
+| CollectionFlow.cs:34:14:34:14 | access to local variable c [field As, element] : A | CollectionFlow.cs:34:14:34:17 | access to field As [element] : A |
+| CollectionFlow.cs:34:14:34:17 | access to field As [element] : A | CollectionFlow.cs:34:14:34:20 | access to array element |
+| CollectionFlow.cs:35:18:35:18 | access to local variable c [field As, element] : A | CollectionFlow.cs:35:18:35:21 | access to field As [element] : A |
+| CollectionFlow.cs:35:18:35:21 | access to field As [element] : A | CollectionFlow.cs:374:40:374:41 | ts [element] : A |
+| CollectionFlow.cs:36:20:36:20 | access to local variable c [field As, element] : A | CollectionFlow.cs:36:20:36:23 | access to field As [element] : A |
+| CollectionFlow.cs:36:20:36:23 | access to field As [element] : A | CollectionFlow.cs:36:14:36:24 | call to method First |
 | CollectionFlow.cs:50:17:50:23 | object creation of type A : A | CollectionFlow.cs:52:18:52:18 | access to local variable a : A |
-| CollectionFlow.cs:52:9:52:11 | [post] access to local variable as [[]] : A | CollectionFlow.cs:53:14:53:16 | access to local variable as [[]] : A |
-| CollectionFlow.cs:52:9:52:11 | [post] access to local variable as [[]] : A | CollectionFlow.cs:54:18:54:20 | access to local variable as [[]] : A |
-| CollectionFlow.cs:52:9:52:11 | [post] access to local variable as [[]] : A | CollectionFlow.cs:55:20:55:22 | access to local variable as [[]] : A |
-| CollectionFlow.cs:52:18:52:18 | access to local variable a : A | CollectionFlow.cs:52:9:52:11 | [post] access to local variable as [[]] : A |
-| CollectionFlow.cs:53:14:53:16 | access to local variable as [[]] : A | CollectionFlow.cs:53:14:53:19 | access to array element |
-| CollectionFlow.cs:54:18:54:20 | access to local variable as [[]] : A | CollectionFlow.cs:374:40:374:41 | ts [[]] : A |
-| CollectionFlow.cs:55:20:55:22 | access to local variable as [[]] : A | CollectionFlow.cs:55:14:55:23 | call to method First |
+| CollectionFlow.cs:52:9:52:11 | [post] access to local variable as [element] : A | CollectionFlow.cs:53:14:53:16 | access to local variable as [element] : A |
+| CollectionFlow.cs:52:9:52:11 | [post] access to local variable as [element] : A | CollectionFlow.cs:54:18:54:20 | access to local variable as [element] : A |
+| CollectionFlow.cs:52:9:52:11 | [post] access to local variable as [element] : A | CollectionFlow.cs:55:20:55:22 | access to local variable as [element] : A |
+| CollectionFlow.cs:52:18:52:18 | access to local variable a : A | CollectionFlow.cs:52:9:52:11 | [post] access to local variable as [element] : A |
+| CollectionFlow.cs:53:14:53:16 | access to local variable as [element] : A | CollectionFlow.cs:53:14:53:19 | access to array element |
+| CollectionFlow.cs:54:18:54:20 | access to local variable as [element] : A | CollectionFlow.cs:374:40:374:41 | ts [element] : A |
+| CollectionFlow.cs:55:20:55:22 | access to local variable as [element] : A | CollectionFlow.cs:55:14:55:23 | call to method First |
 | CollectionFlow.cs:70:17:70:23 | object creation of type A : A | CollectionFlow.cs:72:19:72:19 | access to local variable a : A |
-| CollectionFlow.cs:72:9:72:12 | [post] access to local variable list [[]] : A | CollectionFlow.cs:73:14:73:17 | access to local variable list [[]] : A |
-| CollectionFlow.cs:72:9:72:12 | [post] access to local variable list [[]] : A | CollectionFlow.cs:74:22:74:25 | access to local variable list [[]] : A |
-| CollectionFlow.cs:72:9:72:12 | [post] access to local variable list [[]] : A | CollectionFlow.cs:75:24:75:27 | access to local variable list [[]] : A |
-| CollectionFlow.cs:72:19:72:19 | access to local variable a : A | CollectionFlow.cs:72:9:72:12 | [post] access to local variable list [[]] : A |
-| CollectionFlow.cs:73:14:73:17 | access to local variable list [[]] : A | CollectionFlow.cs:73:14:73:20 | access to indexer |
-| CollectionFlow.cs:74:22:74:25 | access to local variable list [[]] : A | CollectionFlow.cs:376:49:376:52 | list [[]] : A |
-| CollectionFlow.cs:75:24:75:27 | access to local variable list [[]] : A | CollectionFlow.cs:75:14:75:28 | call to method ListFirst |
+| CollectionFlow.cs:72:9:72:12 | [post] access to local variable list [element] : A | CollectionFlow.cs:73:14:73:17 | access to local variable list [element] : A |
+| CollectionFlow.cs:72:9:72:12 | [post] access to local variable list [element] : A | CollectionFlow.cs:74:22:74:25 | access to local variable list [element] : A |
+| CollectionFlow.cs:72:9:72:12 | [post] access to local variable list [element] : A | CollectionFlow.cs:75:24:75:27 | access to local variable list [element] : A |
+| CollectionFlow.cs:72:19:72:19 | access to local variable a : A | CollectionFlow.cs:72:9:72:12 | [post] access to local variable list [element] : A |
+| CollectionFlow.cs:73:14:73:17 | access to local variable list [element] : A | CollectionFlow.cs:73:14:73:20 | access to indexer |
+| CollectionFlow.cs:74:22:74:25 | access to local variable list [element] : A | CollectionFlow.cs:376:49:376:52 | list [element] : A |
+| CollectionFlow.cs:75:24:75:27 | access to local variable list [element] : A | CollectionFlow.cs:75:14:75:28 | call to method ListFirst |
 | CollectionFlow.cs:89:17:89:23 | object creation of type A : A | CollectionFlow.cs:90:36:90:36 | access to local variable a : A |
-| CollectionFlow.cs:90:34:90:38 | { ..., ... } [[]] : A | CollectionFlow.cs:91:14:91:17 | access to local variable list [[]] : A |
-| CollectionFlow.cs:90:34:90:38 | { ..., ... } [[]] : A | CollectionFlow.cs:92:22:92:25 | access to local variable list [[]] : A |
-| CollectionFlow.cs:90:34:90:38 | { ..., ... } [[]] : A | CollectionFlow.cs:93:24:93:27 | access to local variable list [[]] : A |
-| CollectionFlow.cs:90:36:90:36 | access to local variable a : A | CollectionFlow.cs:90:34:90:38 | { ..., ... } [[]] : A |
-| CollectionFlow.cs:91:14:91:17 | access to local variable list [[]] : A | CollectionFlow.cs:91:14:91:20 | access to indexer |
-| CollectionFlow.cs:92:22:92:25 | access to local variable list [[]] : A | CollectionFlow.cs:376:49:376:52 | list [[]] : A |
-| CollectionFlow.cs:93:24:93:27 | access to local variable list [[]] : A | CollectionFlow.cs:93:14:93:28 | call to method ListFirst |
+| CollectionFlow.cs:90:20:90:38 | object creation of type List<A> [element] : A | CollectionFlow.cs:91:14:91:17 | access to local variable list [element] : A |
+| CollectionFlow.cs:90:20:90:38 | object creation of type List<A> [element] : A | CollectionFlow.cs:92:22:92:25 | access to local variable list [element] : A |
+| CollectionFlow.cs:90:20:90:38 | object creation of type List<A> [element] : A | CollectionFlow.cs:93:24:93:27 | access to local variable list [element] : A |
+| CollectionFlow.cs:90:36:90:36 | access to local variable a : A | CollectionFlow.cs:90:20:90:38 | object creation of type List<A> [element] : A |
+| CollectionFlow.cs:91:14:91:17 | access to local variable list [element] : A | CollectionFlow.cs:91:14:91:20 | access to indexer |
+| CollectionFlow.cs:92:22:92:25 | access to local variable list [element] : A | CollectionFlow.cs:376:49:376:52 | list [element] : A |
+| CollectionFlow.cs:93:24:93:27 | access to local variable list [element] : A | CollectionFlow.cs:93:14:93:28 | call to method ListFirst |
 | CollectionFlow.cs:106:17:106:23 | object creation of type A : A | CollectionFlow.cs:108:18:108:18 | access to local variable a : A |
-| CollectionFlow.cs:108:9:108:12 | [post] access to local variable list [[]] : A | CollectionFlow.cs:109:14:109:17 | access to local variable list [[]] : A |
-| CollectionFlow.cs:108:9:108:12 | [post] access to local variable list [[]] : A | CollectionFlow.cs:110:22:110:25 | access to local variable list [[]] : A |
-| CollectionFlow.cs:108:9:108:12 | [post] access to local variable list [[]] : A | CollectionFlow.cs:111:24:111:27 | access to local variable list [[]] : A |
-| CollectionFlow.cs:108:18:108:18 | access to local variable a : A | CollectionFlow.cs:108:9:108:12 | [post] access to local variable list [[]] : A |
-| CollectionFlow.cs:109:14:109:17 | access to local variable list [[]] : A | CollectionFlow.cs:109:14:109:20 | access to indexer |
-| CollectionFlow.cs:110:22:110:25 | access to local variable list [[]] : A | CollectionFlow.cs:376:49:376:52 | list [[]] : A |
-| CollectionFlow.cs:111:24:111:27 | access to local variable list [[]] : A | CollectionFlow.cs:111:14:111:28 | call to method ListFirst |
+| CollectionFlow.cs:108:9:108:12 | [post] access to local variable list [element] : A | CollectionFlow.cs:109:14:109:17 | access to local variable list [element] : A |
+| CollectionFlow.cs:108:9:108:12 | [post] access to local variable list [element] : A | CollectionFlow.cs:110:22:110:25 | access to local variable list [element] : A |
+| CollectionFlow.cs:108:9:108:12 | [post] access to local variable list [element] : A | CollectionFlow.cs:111:24:111:27 | access to local variable list [element] : A |
+| CollectionFlow.cs:108:18:108:18 | access to local variable a : A | CollectionFlow.cs:108:9:108:12 | [post] access to local variable list [element] : A |
+| CollectionFlow.cs:109:14:109:17 | access to local variable list [element] : A | CollectionFlow.cs:109:14:109:20 | access to indexer |
+| CollectionFlow.cs:110:22:110:25 | access to local variable list [element] : A | CollectionFlow.cs:376:49:376:52 | list [element] : A |
+| CollectionFlow.cs:111:24:111:27 | access to local variable list [element] : A | CollectionFlow.cs:111:14:111:28 | call to method ListFirst |
 | CollectionFlow.cs:125:17:125:23 | object creation of type A : A | CollectionFlow.cs:127:19:127:19 | access to local variable a : A |
-| CollectionFlow.cs:127:9:127:12 | [post] access to local variable dict [[], Value] : A | CollectionFlow.cs:128:14:128:17 | access to local variable dict [[], Value] : A |
-| CollectionFlow.cs:127:9:127:12 | [post] access to local variable dict [[], Value] : A | CollectionFlow.cs:129:23:129:26 | access to local variable dict [[], Value] : A |
-| CollectionFlow.cs:127:9:127:12 | [post] access to local variable dict [[], Value] : A | CollectionFlow.cs:130:28:130:31 | access to local variable dict [[], Value] : A |
-| CollectionFlow.cs:127:9:127:12 | [post] access to local variable dict [[], Value] : A | CollectionFlow.cs:131:29:131:32 | access to local variable dict [[], Value] : A |
-| CollectionFlow.cs:127:9:127:12 | [post] access to local variable dict [[], Value] : A | CollectionFlow.cs:132:30:132:33 | access to local variable dict [[], Value] : A |
-| CollectionFlow.cs:127:19:127:19 | access to local variable a : A | CollectionFlow.cs:127:9:127:12 | [post] access to local variable dict [[], Value] : A |
-| CollectionFlow.cs:128:14:128:17 | access to local variable dict [[], Value] : A | CollectionFlow.cs:128:14:128:20 | access to indexer |
-| CollectionFlow.cs:129:23:129:26 | access to local variable dict [[], Value] : A | CollectionFlow.cs:378:61:378:64 | dict [[], Value] : A |
-| CollectionFlow.cs:130:28:130:31 | access to local variable dict [[], Value] : A | CollectionFlow.cs:130:14:130:32 | call to method DictIndexZero |
-| CollectionFlow.cs:131:29:131:32 | access to local variable dict [[], Value] : A | CollectionFlow.cs:131:14:131:33 | call to method DictFirstValue |
-| CollectionFlow.cs:132:30:132:33 | access to local variable dict [[], Value] : A | CollectionFlow.cs:132:14:132:34 | call to method DictValuesFirst |
+| CollectionFlow.cs:127:9:127:12 | [post] access to local variable dict [element, property Value] : A | CollectionFlow.cs:128:14:128:17 | access to local variable dict [element, property Value] : A |
+| CollectionFlow.cs:127:9:127:12 | [post] access to local variable dict [element, property Value] : A | CollectionFlow.cs:129:23:129:26 | access to local variable dict [element, property Value] : A |
+| CollectionFlow.cs:127:9:127:12 | [post] access to local variable dict [element, property Value] : A | CollectionFlow.cs:130:28:130:31 | access to local variable dict [element, property Value] : A |
+| CollectionFlow.cs:127:9:127:12 | [post] access to local variable dict [element, property Value] : A | CollectionFlow.cs:131:29:131:32 | access to local variable dict [element, property Value] : A |
+| CollectionFlow.cs:127:9:127:12 | [post] access to local variable dict [element, property Value] : A | CollectionFlow.cs:132:30:132:33 | access to local variable dict [element, property Value] : A |
+| CollectionFlow.cs:127:19:127:19 | access to local variable a : A | CollectionFlow.cs:127:9:127:12 | [post] access to local variable dict [element, property Value] : A |
+| CollectionFlow.cs:128:14:128:17 | access to local variable dict [element, property Value] : A | CollectionFlow.cs:128:14:128:20 | access to indexer |
+| CollectionFlow.cs:129:23:129:26 | access to local variable dict [element, property Value] : A | CollectionFlow.cs:378:61:378:64 | dict [element, property Value] : A |
+| CollectionFlow.cs:130:28:130:31 | access to local variable dict [element, property Value] : A | CollectionFlow.cs:130:14:130:32 | call to method DictIndexZero |
+| CollectionFlow.cs:131:29:131:32 | access to local variable dict [element, property Value] : A | CollectionFlow.cs:131:14:131:33 | call to method DictFirstValue |
+| CollectionFlow.cs:132:30:132:33 | access to local variable dict [element, property Value] : A | CollectionFlow.cs:132:14:132:34 | call to method DictValuesFirst |
 | CollectionFlow.cs:148:17:148:23 | object creation of type A : A | CollectionFlow.cs:149:52:149:52 | access to local variable a : A |
-| CollectionFlow.cs:149:45:149:56 | { ..., ... } [[], Value] : A | CollectionFlow.cs:150:14:150:17 | access to local variable dict [[], Value] : A |
-| CollectionFlow.cs:149:45:149:56 | { ..., ... } [[], Value] : A | CollectionFlow.cs:151:23:151:26 | access to local variable dict [[], Value] : A |
-| CollectionFlow.cs:149:45:149:56 | { ..., ... } [[], Value] : A | CollectionFlow.cs:152:28:152:31 | access to local variable dict [[], Value] : A |
-| CollectionFlow.cs:149:45:149:56 | { ..., ... } [[], Value] : A | CollectionFlow.cs:153:29:153:32 | access to local variable dict [[], Value] : A |
-| CollectionFlow.cs:149:45:149:56 | { ..., ... } [[], Value] : A | CollectionFlow.cs:154:30:154:33 | access to local variable dict [[], Value] : A |
-| CollectionFlow.cs:149:52:149:52 | access to local variable a : A | CollectionFlow.cs:149:45:149:56 | { ..., ... } [[], Value] : A |
-| CollectionFlow.cs:150:14:150:17 | access to local variable dict [[], Value] : A | CollectionFlow.cs:150:14:150:20 | access to indexer |
-| CollectionFlow.cs:151:23:151:26 | access to local variable dict [[], Value] : A | CollectionFlow.cs:378:61:378:64 | dict [[], Value] : A |
-| CollectionFlow.cs:152:28:152:31 | access to local variable dict [[], Value] : A | CollectionFlow.cs:152:14:152:32 | call to method DictIndexZero |
-| CollectionFlow.cs:153:29:153:32 | access to local variable dict [[], Value] : A | CollectionFlow.cs:153:14:153:33 | call to method DictFirstValue |
-| CollectionFlow.cs:154:30:154:33 | access to local variable dict [[], Value] : A | CollectionFlow.cs:154:14:154:34 | call to method DictValuesFirst |
+| CollectionFlow.cs:149:20:149:56 | object creation of type Dictionary<Int32,A> [element, property Value] : A | CollectionFlow.cs:150:14:150:17 | access to local variable dict [element, property Value] : A |
+| CollectionFlow.cs:149:20:149:56 | object creation of type Dictionary<Int32,A> [element, property Value] : A | CollectionFlow.cs:151:23:151:26 | access to local variable dict [element, property Value] : A |
+| CollectionFlow.cs:149:20:149:56 | object creation of type Dictionary<Int32,A> [element, property Value] : A | CollectionFlow.cs:152:28:152:31 | access to local variable dict [element, property Value] : A |
+| CollectionFlow.cs:149:20:149:56 | object creation of type Dictionary<Int32,A> [element, property Value] : A | CollectionFlow.cs:153:29:153:32 | access to local variable dict [element, property Value] : A |
+| CollectionFlow.cs:149:20:149:56 | object creation of type Dictionary<Int32,A> [element, property Value] : A | CollectionFlow.cs:154:30:154:33 | access to local variable dict [element, property Value] : A |
+| CollectionFlow.cs:149:52:149:52 | access to local variable a : A | CollectionFlow.cs:149:20:149:56 | object creation of type Dictionary<Int32,A> [element, property Value] : A |
+| CollectionFlow.cs:150:14:150:17 | access to local variable dict [element, property Value] : A | CollectionFlow.cs:150:14:150:20 | access to indexer |
+| CollectionFlow.cs:151:23:151:26 | access to local variable dict [element, property Value] : A | CollectionFlow.cs:378:61:378:64 | dict [element, property Value] : A |
+| CollectionFlow.cs:152:28:152:31 | access to local variable dict [element, property Value] : A | CollectionFlow.cs:152:14:152:32 | call to method DictIndexZero |
+| CollectionFlow.cs:153:29:153:32 | access to local variable dict [element, property Value] : A | CollectionFlow.cs:153:14:153:33 | call to method DictFirstValue |
+| CollectionFlow.cs:154:30:154:33 | access to local variable dict [element, property Value] : A | CollectionFlow.cs:154:14:154:34 | call to method DictValuesFirst |
 | CollectionFlow.cs:169:17:169:23 | object creation of type A : A | CollectionFlow.cs:170:53:170:53 | access to local variable a : A |
-| CollectionFlow.cs:170:45:170:55 | { ..., ... } [[], Value] : A | CollectionFlow.cs:171:14:171:17 | access to local variable dict [[], Value] : A |
-| CollectionFlow.cs:170:45:170:55 | { ..., ... } [[], Value] : A | CollectionFlow.cs:172:23:172:26 | access to local variable dict [[], Value] : A |
-| CollectionFlow.cs:170:45:170:55 | { ..., ... } [[], Value] : A | CollectionFlow.cs:173:28:173:31 | access to local variable dict [[], Value] : A |
-| CollectionFlow.cs:170:45:170:55 | { ..., ... } [[], Value] : A | CollectionFlow.cs:174:29:174:32 | access to local variable dict [[], Value] : A |
-| CollectionFlow.cs:170:45:170:55 | { ..., ... } [[], Value] : A | CollectionFlow.cs:175:30:175:33 | access to local variable dict [[], Value] : A |
-| CollectionFlow.cs:170:53:170:53 | access to local variable a : A | CollectionFlow.cs:170:45:170:55 | { ..., ... } [[], Value] : A |
-| CollectionFlow.cs:171:14:171:17 | access to local variable dict [[], Value] : A | CollectionFlow.cs:171:14:171:20 | access to indexer |
-| CollectionFlow.cs:172:23:172:26 | access to local variable dict [[], Value] : A | CollectionFlow.cs:378:61:378:64 | dict [[], Value] : A |
-| CollectionFlow.cs:173:28:173:31 | access to local variable dict [[], Value] : A | CollectionFlow.cs:173:14:173:32 | call to method DictIndexZero |
-| CollectionFlow.cs:174:29:174:32 | access to local variable dict [[], Value] : A | CollectionFlow.cs:174:14:174:33 | call to method DictFirstValue |
-| CollectionFlow.cs:175:30:175:33 | access to local variable dict [[], Value] : A | CollectionFlow.cs:175:14:175:34 | call to method DictValuesFirst |
+| CollectionFlow.cs:170:20:170:55 | object creation of type Dictionary<Int32,A> [element, property Value] : A | CollectionFlow.cs:171:14:171:17 | access to local variable dict [element, property Value] : A |
+| CollectionFlow.cs:170:20:170:55 | object creation of type Dictionary<Int32,A> [element, property Value] : A | CollectionFlow.cs:172:23:172:26 | access to local variable dict [element, property Value] : A |
+| CollectionFlow.cs:170:20:170:55 | object creation of type Dictionary<Int32,A> [element, property Value] : A | CollectionFlow.cs:173:28:173:31 | access to local variable dict [element, property Value] : A |
+| CollectionFlow.cs:170:20:170:55 | object creation of type Dictionary<Int32,A> [element, property Value] : A | CollectionFlow.cs:174:29:174:32 | access to local variable dict [element, property Value] : A |
+| CollectionFlow.cs:170:20:170:55 | object creation of type Dictionary<Int32,A> [element, property Value] : A | CollectionFlow.cs:175:30:175:33 | access to local variable dict [element, property Value] : A |
+| CollectionFlow.cs:170:53:170:53 | access to local variable a : A | CollectionFlow.cs:170:20:170:55 | object creation of type Dictionary<Int32,A> [element, property Value] : A |
+| CollectionFlow.cs:171:14:171:17 | access to local variable dict [element, property Value] : A | CollectionFlow.cs:171:14:171:20 | access to indexer |
+| CollectionFlow.cs:172:23:172:26 | access to local variable dict [element, property Value] : A | CollectionFlow.cs:378:61:378:64 | dict [element, property Value] : A |
+| CollectionFlow.cs:173:28:173:31 | access to local variable dict [element, property Value] : A | CollectionFlow.cs:173:14:173:32 | call to method DictIndexZero |
+| CollectionFlow.cs:174:29:174:32 | access to local variable dict [element, property Value] : A | CollectionFlow.cs:174:14:174:33 | call to method DictFirstValue |
+| CollectionFlow.cs:175:30:175:33 | access to local variable dict [element, property Value] : A | CollectionFlow.cs:175:14:175:34 | call to method DictValuesFirst |
 | CollectionFlow.cs:191:17:191:23 | object creation of type A : A | CollectionFlow.cs:192:49:192:49 | access to local variable a : A |
-| CollectionFlow.cs:192:45:192:56 | { ..., ... } [[], Key] : A | CollectionFlow.cs:193:14:193:17 | access to local variable dict [[], Key] : A |
-| CollectionFlow.cs:192:45:192:56 | { ..., ... } [[], Key] : A | CollectionFlow.cs:194:21:194:24 | access to local variable dict [[], Key] : A |
-| CollectionFlow.cs:192:45:192:56 | { ..., ... } [[], Key] : A | CollectionFlow.cs:195:28:195:31 | access to local variable dict [[], Key] : A |
-| CollectionFlow.cs:192:45:192:56 | { ..., ... } [[], Key] : A | CollectionFlow.cs:196:27:196:30 | access to local variable dict [[], Key] : A |
-| CollectionFlow.cs:192:49:192:49 | access to local variable a : A | CollectionFlow.cs:192:45:192:56 | { ..., ... } [[], Key] : A |
-| CollectionFlow.cs:193:14:193:17 | access to local variable dict [[], Key] : A | CollectionFlow.cs:193:14:193:22 | access to property Keys [[]] : A |
-| CollectionFlow.cs:193:14:193:22 | access to property Keys [[]] : A | CollectionFlow.cs:193:14:193:30 | call to method First |
-| CollectionFlow.cs:194:21:194:24 | access to local variable dict [[], Key] : A | CollectionFlow.cs:380:59:380:62 | dict [[], Key] : A |
-| CollectionFlow.cs:195:28:195:31 | access to local variable dict [[], Key] : A | CollectionFlow.cs:195:14:195:32 | call to method DictKeysFirst |
-| CollectionFlow.cs:196:27:196:30 | access to local variable dict [[], Key] : A | CollectionFlow.cs:196:14:196:31 | call to method DictFirstKey |
+| CollectionFlow.cs:192:20:192:56 | object creation of type Dictionary<A,Int32> [element, property Key] : A | CollectionFlow.cs:193:14:193:17 | access to local variable dict [element, property Key] : A |
+| CollectionFlow.cs:192:20:192:56 | object creation of type Dictionary<A,Int32> [element, property Key] : A | CollectionFlow.cs:194:21:194:24 | access to local variable dict [element, property Key] : A |
+| CollectionFlow.cs:192:20:192:56 | object creation of type Dictionary<A,Int32> [element, property Key] : A | CollectionFlow.cs:195:28:195:31 | access to local variable dict [element, property Key] : A |
+| CollectionFlow.cs:192:20:192:56 | object creation of type Dictionary<A,Int32> [element, property Key] : A | CollectionFlow.cs:196:27:196:30 | access to local variable dict [element, property Key] : A |
+| CollectionFlow.cs:192:49:192:49 | access to local variable a : A | CollectionFlow.cs:192:20:192:56 | object creation of type Dictionary<A,Int32> [element, property Key] : A |
+| CollectionFlow.cs:193:14:193:17 | access to local variable dict [element, property Key] : A | CollectionFlow.cs:193:14:193:22 | access to property Keys [element] : A |
+| CollectionFlow.cs:193:14:193:22 | access to property Keys [element] : A | CollectionFlow.cs:193:14:193:30 | call to method First |
+| CollectionFlow.cs:194:21:194:24 | access to local variable dict [element, property Key] : A | CollectionFlow.cs:380:59:380:62 | dict [element, property Key] : A |
+| CollectionFlow.cs:195:28:195:31 | access to local variable dict [element, property Key] : A | CollectionFlow.cs:195:14:195:32 | call to method DictKeysFirst |
+| CollectionFlow.cs:196:27:196:30 | access to local variable dict [element, property Key] : A | CollectionFlow.cs:196:14:196:31 | call to method DictFirstKey |
 | CollectionFlow.cs:210:17:210:23 | object creation of type A : A | CollectionFlow.cs:211:48:211:48 | access to local variable a : A |
-| CollectionFlow.cs:211:45:211:55 | { ..., ... } [[], Key] : A | CollectionFlow.cs:212:14:212:17 | access to local variable dict [[], Key] : A |
-| CollectionFlow.cs:211:45:211:55 | { ..., ... } [[], Key] : A | CollectionFlow.cs:213:21:213:24 | access to local variable dict [[], Key] : A |
-| CollectionFlow.cs:211:45:211:55 | { ..., ... } [[], Key] : A | CollectionFlow.cs:214:28:214:31 | access to local variable dict [[], Key] : A |
-| CollectionFlow.cs:211:45:211:55 | { ..., ... } [[], Key] : A | CollectionFlow.cs:215:27:215:30 | access to local variable dict [[], Key] : A |
-| CollectionFlow.cs:211:48:211:48 | access to local variable a : A | CollectionFlow.cs:211:45:211:55 | { ..., ... } [[], Key] : A |
-| CollectionFlow.cs:212:14:212:17 | access to local variable dict [[], Key] : A | CollectionFlow.cs:212:14:212:22 | access to property Keys [[]] : A |
-| CollectionFlow.cs:212:14:212:22 | access to property Keys [[]] : A | CollectionFlow.cs:212:14:212:30 | call to method First |
-| CollectionFlow.cs:213:21:213:24 | access to local variable dict [[], Key] : A | CollectionFlow.cs:380:59:380:62 | dict [[], Key] : A |
-| CollectionFlow.cs:214:28:214:31 | access to local variable dict [[], Key] : A | CollectionFlow.cs:214:14:214:32 | call to method DictKeysFirst |
-| CollectionFlow.cs:215:27:215:30 | access to local variable dict [[], Key] : A | CollectionFlow.cs:215:14:215:31 | call to method DictFirstKey |
+| CollectionFlow.cs:211:20:211:55 | object creation of type Dictionary<A,Int32> [element, property Key] : A | CollectionFlow.cs:212:14:212:17 | access to local variable dict [element, property Key] : A |
+| CollectionFlow.cs:211:20:211:55 | object creation of type Dictionary<A,Int32> [element, property Key] : A | CollectionFlow.cs:213:21:213:24 | access to local variable dict [element, property Key] : A |
+| CollectionFlow.cs:211:20:211:55 | object creation of type Dictionary<A,Int32> [element, property Key] : A | CollectionFlow.cs:214:28:214:31 | access to local variable dict [element, property Key] : A |
+| CollectionFlow.cs:211:20:211:55 | object creation of type Dictionary<A,Int32> [element, property Key] : A | CollectionFlow.cs:215:27:215:30 | access to local variable dict [element, property Key] : A |
+| CollectionFlow.cs:211:48:211:48 | access to local variable a : A | CollectionFlow.cs:211:20:211:55 | object creation of type Dictionary<A,Int32> [element, property Key] : A |
+| CollectionFlow.cs:212:14:212:17 | access to local variable dict [element, property Key] : A | CollectionFlow.cs:212:14:212:22 | access to property Keys [element] : A |
+| CollectionFlow.cs:212:14:212:22 | access to property Keys [element] : A | CollectionFlow.cs:212:14:212:30 | call to method First |
+| CollectionFlow.cs:213:21:213:24 | access to local variable dict [element, property Key] : A | CollectionFlow.cs:380:59:380:62 | dict [element, property Key] : A |
+| CollectionFlow.cs:214:28:214:31 | access to local variable dict [element, property Key] : A | CollectionFlow.cs:214:14:214:32 | call to method DictKeysFirst |
+| CollectionFlow.cs:215:27:215:30 | access to local variable dict [element, property Key] : A | CollectionFlow.cs:215:14:215:31 | call to method DictFirstKey |
 | CollectionFlow.cs:229:17:229:23 | object creation of type A : A | CollectionFlow.cs:230:27:230:27 | access to local variable a : A |
-| CollectionFlow.cs:230:25:230:29 | { ..., ... } [[]] : A | CollectionFlow.cs:231:27:231:29 | access to local variable as [[]] : A |
-| CollectionFlow.cs:230:27:230:27 | access to local variable a : A | CollectionFlow.cs:230:25:230:29 | { ..., ... } [[]] : A |
+| CollectionFlow.cs:230:25:230:29 | { ..., ... } [element] : A | CollectionFlow.cs:231:27:231:29 | access to local variable as [element] : A |
+| CollectionFlow.cs:230:27:230:27 | access to local variable a : A | CollectionFlow.cs:230:25:230:29 | { ..., ... } [element] : A |
 | CollectionFlow.cs:231:22:231:22 | SSA def(x) : A | CollectionFlow.cs:232:18:232:18 | access to local variable x |
-| CollectionFlow.cs:231:27:231:29 | access to local variable as [[]] : A | CollectionFlow.cs:231:22:231:22 | SSA def(x) : A |
+| CollectionFlow.cs:231:27:231:29 | access to local variable as [element] : A | CollectionFlow.cs:231:22:231:22 | SSA def(x) : A |
 | CollectionFlow.cs:244:17:244:23 | object creation of type A : A | CollectionFlow.cs:245:27:245:27 | access to local variable a : A |
-| CollectionFlow.cs:245:25:245:29 | { ..., ... } [[]] : A | CollectionFlow.cs:246:26:246:28 | access to local variable as [[]] : A |
-| CollectionFlow.cs:245:27:245:27 | access to local variable a : A | CollectionFlow.cs:245:25:245:29 | { ..., ... } [[]] : A |
-| CollectionFlow.cs:246:26:246:28 | access to local variable as [[]] : A | CollectionFlow.cs:246:26:246:44 | call to method GetEnumerator [Current] : A |
-| CollectionFlow.cs:246:26:246:44 | call to method GetEnumerator [Current] : A | CollectionFlow.cs:248:18:248:27 | access to local variable enumerator [Current] : A |
-| CollectionFlow.cs:248:18:248:27 | access to local variable enumerator [Current] : A | CollectionFlow.cs:248:18:248:35 | access to property Current |
+| CollectionFlow.cs:245:25:245:29 | { ..., ... } [element] : A | CollectionFlow.cs:246:26:246:28 | access to local variable as [element] : A |
+| CollectionFlow.cs:245:27:245:27 | access to local variable a : A | CollectionFlow.cs:245:25:245:29 | { ..., ... } [element] : A |
+| CollectionFlow.cs:246:26:246:28 | access to local variable as [element] : A | CollectionFlow.cs:246:26:246:44 | call to method GetEnumerator [property Current] : A |
+| CollectionFlow.cs:246:26:246:44 | call to method GetEnumerator [property Current] : A | CollectionFlow.cs:248:18:248:27 | access to local variable enumerator [property Current] : A |
+| CollectionFlow.cs:248:18:248:27 | access to local variable enumerator [property Current] : A | CollectionFlow.cs:248:18:248:35 | access to property Current |
 | CollectionFlow.cs:261:17:261:23 | object creation of type A : A | CollectionFlow.cs:263:18:263:18 | access to local variable a : A |
-| CollectionFlow.cs:263:9:263:12 | [post] access to local variable list [[]] : A | CollectionFlow.cs:264:26:264:29 | access to local variable list [[]] : A |
-| CollectionFlow.cs:263:18:263:18 | access to local variable a : A | CollectionFlow.cs:263:9:263:12 | [post] access to local variable list [[]] : A |
-| CollectionFlow.cs:264:26:264:29 | access to local variable list [[]] : A | CollectionFlow.cs:264:26:264:45 | call to method GetEnumerator [Current] : A |
-| CollectionFlow.cs:264:26:264:45 | call to method GetEnumerator [Current] : A | CollectionFlow.cs:266:18:266:27 | access to local variable enumerator [Current] : A |
-| CollectionFlow.cs:266:18:266:27 | access to local variable enumerator [Current] : A | CollectionFlow.cs:266:18:266:35 | access to property Current |
+| CollectionFlow.cs:263:9:263:12 | [post] access to local variable list [element] : A | CollectionFlow.cs:264:26:264:29 | access to local variable list [element] : A |
+| CollectionFlow.cs:263:18:263:18 | access to local variable a : A | CollectionFlow.cs:263:9:263:12 | [post] access to local variable list [element] : A |
+| CollectionFlow.cs:264:26:264:29 | access to local variable list [element] : A | CollectionFlow.cs:264:26:264:45 | call to method GetEnumerator [property Current] : A |
+| CollectionFlow.cs:264:26:264:45 | call to method GetEnumerator [property Current] : A | CollectionFlow.cs:266:18:266:27 | access to local variable enumerator [property Current] : A |
+| CollectionFlow.cs:266:18:266:27 | access to local variable enumerator [property Current] : A | CollectionFlow.cs:266:18:266:35 | access to property Current |
 | CollectionFlow.cs:280:17:280:23 | object creation of type A : A | CollectionFlow.cs:282:43:282:43 | access to local variable a : A |
-| CollectionFlow.cs:282:9:282:12 | [post] access to local variable list [[], Key] : A | CollectionFlow.cs:283:9:283:12 | access to local variable list [[], Key] : A |
-| CollectionFlow.cs:282:18:282:47 | object creation of type KeyValuePair<A,Int32> [Key] : A | CollectionFlow.cs:282:9:282:12 | [post] access to local variable list [[], Key] : A |
-| CollectionFlow.cs:282:43:282:43 | access to local variable a : A | CollectionFlow.cs:282:18:282:47 | object creation of type KeyValuePair<A,Int32> [Key] : A |
-| CollectionFlow.cs:283:9:283:12 | access to local variable list [[], Key] : A | CollectionFlow.cs:283:21:283:23 | kvp [Key] : A |
-| CollectionFlow.cs:283:21:283:23 | kvp [Key] : A | CollectionFlow.cs:285:18:285:20 | access to parameter kvp [Key] : A |
-| CollectionFlow.cs:285:18:285:20 | access to parameter kvp [Key] : A | CollectionFlow.cs:285:18:285:24 | access to property Key |
+| CollectionFlow.cs:282:9:282:12 | [post] access to local variable list [element, property Key] : A | CollectionFlow.cs:283:9:283:12 | access to local variable list [element, property Key] : A |
+| CollectionFlow.cs:282:18:282:47 | object creation of type KeyValuePair<A,Int32> [property Key] : A | CollectionFlow.cs:282:9:282:12 | [post] access to local variable list [element, property Key] : A |
+| CollectionFlow.cs:282:43:282:43 | access to local variable a : A | CollectionFlow.cs:282:18:282:47 | object creation of type KeyValuePair<A,Int32> [property Key] : A |
+| CollectionFlow.cs:283:9:283:12 | access to local variable list [element, property Key] : A | CollectionFlow.cs:283:21:283:23 | kvp [property Key] : A |
+| CollectionFlow.cs:283:21:283:23 | kvp [property Key] : A | CollectionFlow.cs:285:18:285:20 | access to parameter kvp [property Key] : A |
+| CollectionFlow.cs:285:18:285:20 | access to parameter kvp [property Key] : A | CollectionFlow.cs:285:18:285:24 | access to property Key |
 | CollectionFlow.cs:306:17:306:23 | object creation of type A : A | CollectionFlow.cs:308:23:308:23 | access to local variable a : A |
-| CollectionFlow.cs:308:18:308:20 | [post] access to local variable as [[]] : A | CollectionFlow.cs:309:14:309:16 | access to local variable as [[]] : A |
-| CollectionFlow.cs:308:18:308:20 | [post] access to local variable as [[]] : A | CollectionFlow.cs:310:18:310:20 | access to local variable as [[]] : A |
-| CollectionFlow.cs:308:18:308:20 | [post] access to local variable as [[]] : A | CollectionFlow.cs:311:20:311:22 | access to local variable as [[]] : A |
-| CollectionFlow.cs:308:23:308:23 | access to local variable a : A | CollectionFlow.cs:308:18:308:20 | [post] access to local variable as [[]] : A |
-| CollectionFlow.cs:309:14:309:16 | access to local variable as [[]] : A | CollectionFlow.cs:309:14:309:19 | access to array element |
-| CollectionFlow.cs:310:18:310:20 | access to local variable as [[]] : A | CollectionFlow.cs:374:40:374:41 | ts [[]] : A |
-| CollectionFlow.cs:311:20:311:22 | access to local variable as [[]] : A | CollectionFlow.cs:311:14:311:23 | call to method First |
+| CollectionFlow.cs:308:18:308:20 | [post] access to local variable as [element] : A | CollectionFlow.cs:309:14:309:16 | access to local variable as [element] : A |
+| CollectionFlow.cs:308:18:308:20 | [post] access to local variable as [element] : A | CollectionFlow.cs:310:18:310:20 | access to local variable as [element] : A |
+| CollectionFlow.cs:308:18:308:20 | [post] access to local variable as [element] : A | CollectionFlow.cs:311:20:311:22 | access to local variable as [element] : A |
+| CollectionFlow.cs:308:23:308:23 | access to local variable a : A | CollectionFlow.cs:308:18:308:20 | [post] access to local variable as [element] : A |
+| CollectionFlow.cs:309:14:309:16 | access to local variable as [element] : A | CollectionFlow.cs:309:14:309:19 | access to array element |
+| CollectionFlow.cs:310:18:310:20 | access to local variable as [element] : A | CollectionFlow.cs:374:40:374:41 | ts [element] : A |
+| CollectionFlow.cs:311:20:311:22 | access to local variable as [element] : A | CollectionFlow.cs:311:14:311:23 | call to method First |
 | CollectionFlow.cs:328:17:328:23 | object creation of type A : A | CollectionFlow.cs:330:23:330:23 | access to local variable a : A |
-| CollectionFlow.cs:330:17:330:20 | [post] access to local variable list [[]] : A | CollectionFlow.cs:331:14:331:17 | access to local variable list [[]] : A |
-| CollectionFlow.cs:330:17:330:20 | [post] access to local variable list [[]] : A | CollectionFlow.cs:332:22:332:25 | access to local variable list [[]] : A |
-| CollectionFlow.cs:330:17:330:20 | [post] access to local variable list [[]] : A | CollectionFlow.cs:333:24:333:27 | access to local variable list [[]] : A |
-| CollectionFlow.cs:330:23:330:23 | access to local variable a : A | CollectionFlow.cs:330:17:330:20 | [post] access to local variable list [[]] : A |
-| CollectionFlow.cs:331:14:331:17 | access to local variable list [[]] : A | CollectionFlow.cs:331:14:331:20 | access to indexer |
-| CollectionFlow.cs:332:22:332:25 | access to local variable list [[]] : A | CollectionFlow.cs:376:49:376:52 | list [[]] : A |
-| CollectionFlow.cs:333:24:333:27 | access to local variable list [[]] : A | CollectionFlow.cs:333:14:333:28 | call to method ListFirst |
-| CollectionFlow.cs:347:20:347:26 | object creation of type A : A | CollectionFlow.cs:396:49:396:52 | args [[]] : A |
-| CollectionFlow.cs:348:26:348:32 | object creation of type A : A | CollectionFlow.cs:396:49:396:52 | args [[]] : A |
-| CollectionFlow.cs:349:26:349:32 | object creation of type A : A | CollectionFlow.cs:396:49:396:52 | args [[]] : A |
-| CollectionFlow.cs:350:20:350:38 | array creation of type A[] [[]] : A | CollectionFlow.cs:396:49:396:52 | args [[]] : A |
-| CollectionFlow.cs:350:28:350:38 | { ..., ... } [[]] : A | CollectionFlow.cs:350:20:350:38 | array creation of type A[] [[]] : A |
-| CollectionFlow.cs:350:30:350:36 | object creation of type A : A | CollectionFlow.cs:350:28:350:38 | { ..., ... } [[]] : A |
-| CollectionFlow.cs:374:40:374:41 | ts [[]] : A | CollectionFlow.cs:374:52:374:53 | access to parameter ts [[]] : A |
-| CollectionFlow.cs:374:40:374:41 | ts [[]] : A | CollectionFlow.cs:374:52:374:53 | access to parameter ts [[]] : A |
-| CollectionFlow.cs:374:52:374:53 | access to parameter ts [[]] : A | CollectionFlow.cs:374:52:374:56 | access to array element |
-| CollectionFlow.cs:374:52:374:53 | access to parameter ts [[]] : A | CollectionFlow.cs:374:52:374:56 | access to array element |
-| CollectionFlow.cs:376:49:376:52 | list [[]] : A | CollectionFlow.cs:376:63:376:66 | access to parameter list [[]] : A |
-| CollectionFlow.cs:376:49:376:52 | list [[]] : A | CollectionFlow.cs:376:63:376:66 | access to parameter list [[]] : A |
-| CollectionFlow.cs:376:49:376:52 | list [[]] : A | CollectionFlow.cs:376:63:376:66 | access to parameter list [[]] : A |
-| CollectionFlow.cs:376:49:376:52 | list [[]] : A | CollectionFlow.cs:376:63:376:66 | access to parameter list [[]] : A |
-| CollectionFlow.cs:376:63:376:66 | access to parameter list [[]] : A | CollectionFlow.cs:376:63:376:69 | access to indexer |
-| CollectionFlow.cs:376:63:376:66 | access to parameter list [[]] : A | CollectionFlow.cs:376:63:376:69 | access to indexer |
-| CollectionFlow.cs:376:63:376:66 | access to parameter list [[]] : A | CollectionFlow.cs:376:63:376:69 | access to indexer |
-| CollectionFlow.cs:376:63:376:66 | access to parameter list [[]] : A | CollectionFlow.cs:376:63:376:69 | access to indexer |
-| CollectionFlow.cs:378:61:378:64 | dict [[], Value] : A | CollectionFlow.cs:378:75:378:78 | access to parameter dict [[], Value] : A |
-| CollectionFlow.cs:378:75:378:78 | access to parameter dict [[], Value] : A | CollectionFlow.cs:378:75:378:81 | access to indexer |
-| CollectionFlow.cs:380:59:380:62 | dict [[], Key] : A | CollectionFlow.cs:380:73:380:76 | access to parameter dict [[], Key] : A |
-| CollectionFlow.cs:380:73:380:76 | access to parameter dict [[], Key] : A | CollectionFlow.cs:380:73:380:81 | access to property Keys [[]] : A |
-| CollectionFlow.cs:380:73:380:81 | access to property Keys [[]] : A | CollectionFlow.cs:380:73:380:89 | call to method First |
-| CollectionFlow.cs:396:49:396:52 | args [[]] : A | CollectionFlow.cs:396:63:396:66 | access to parameter args [[]] : A |
-| CollectionFlow.cs:396:49:396:52 | args [[]] : A | CollectionFlow.cs:396:63:396:66 | access to parameter args [[]] : A |
-| CollectionFlow.cs:396:63:396:66 | access to parameter args [[]] : A | CollectionFlow.cs:396:63:396:69 | access to array element |
-| CollectionFlow.cs:396:63:396:66 | access to parameter args [[]] : A | CollectionFlow.cs:396:63:396:69 | access to array element |
+| CollectionFlow.cs:330:17:330:20 | [post] access to local variable list [element] : A | CollectionFlow.cs:331:14:331:17 | access to local variable list [element] : A |
+| CollectionFlow.cs:330:17:330:20 | [post] access to local variable list [element] : A | CollectionFlow.cs:332:22:332:25 | access to local variable list [element] : A |
+| CollectionFlow.cs:330:17:330:20 | [post] access to local variable list [element] : A | CollectionFlow.cs:333:24:333:27 | access to local variable list [element] : A |
+| CollectionFlow.cs:330:23:330:23 | access to local variable a : A | CollectionFlow.cs:330:17:330:20 | [post] access to local variable list [element] : A |
+| CollectionFlow.cs:331:14:331:17 | access to local variable list [element] : A | CollectionFlow.cs:331:14:331:20 | access to indexer |
+| CollectionFlow.cs:332:22:332:25 | access to local variable list [element] : A | CollectionFlow.cs:376:49:376:52 | list [element] : A |
+| CollectionFlow.cs:333:24:333:27 | access to local variable list [element] : A | CollectionFlow.cs:333:14:333:28 | call to method ListFirst |
+| CollectionFlow.cs:347:20:347:26 | object creation of type A : A | CollectionFlow.cs:396:49:396:52 | args [element] : A |
+| CollectionFlow.cs:348:26:348:32 | object creation of type A : A | CollectionFlow.cs:396:49:396:52 | args [element] : A |
+| CollectionFlow.cs:349:26:349:32 | object creation of type A : A | CollectionFlow.cs:396:49:396:52 | args [element] : A |
+| CollectionFlow.cs:350:20:350:38 | array creation of type A[] [element] : A | CollectionFlow.cs:396:49:396:52 | args [element] : A |
+| CollectionFlow.cs:350:28:350:38 | { ..., ... } [element] : A | CollectionFlow.cs:350:20:350:38 | array creation of type A[] [element] : A |
+| CollectionFlow.cs:350:30:350:36 | object creation of type A : A | CollectionFlow.cs:350:28:350:38 | { ..., ... } [element] : A |
+| CollectionFlow.cs:374:40:374:41 | ts [element] : A | CollectionFlow.cs:374:52:374:53 | access to parameter ts [element] : A |
+| CollectionFlow.cs:374:40:374:41 | ts [element] : A | CollectionFlow.cs:374:52:374:53 | access to parameter ts [element] : A |
+| CollectionFlow.cs:374:52:374:53 | access to parameter ts [element] : A | CollectionFlow.cs:374:52:374:56 | access to array element |
+| CollectionFlow.cs:374:52:374:53 | access to parameter ts [element] : A | CollectionFlow.cs:374:52:374:56 | access to array element |
+| CollectionFlow.cs:376:49:376:52 | list [element] : A | CollectionFlow.cs:376:63:376:66 | access to parameter list [element] : A |
+| CollectionFlow.cs:376:49:376:52 | list [element] : A | CollectionFlow.cs:376:63:376:66 | access to parameter list [element] : A |
+| CollectionFlow.cs:376:49:376:52 | list [element] : A | CollectionFlow.cs:376:63:376:66 | access to parameter list [element] : A |
+| CollectionFlow.cs:376:49:376:52 | list [element] : A | CollectionFlow.cs:376:63:376:66 | access to parameter list [element] : A |
+| CollectionFlow.cs:376:63:376:66 | access to parameter list [element] : A | CollectionFlow.cs:376:63:376:69 | access to indexer |
+| CollectionFlow.cs:376:63:376:66 | access to parameter list [element] : A | CollectionFlow.cs:376:63:376:69 | access to indexer |
+| CollectionFlow.cs:376:63:376:66 | access to parameter list [element] : A | CollectionFlow.cs:376:63:376:69 | access to indexer |
+| CollectionFlow.cs:376:63:376:66 | access to parameter list [element] : A | CollectionFlow.cs:376:63:376:69 | access to indexer |
+| CollectionFlow.cs:378:61:378:64 | dict [element, property Value] : A | CollectionFlow.cs:378:75:378:78 | access to parameter dict [element, property Value] : A |
+| CollectionFlow.cs:378:75:378:78 | access to parameter dict [element, property Value] : A | CollectionFlow.cs:378:75:378:81 | access to indexer |
+| CollectionFlow.cs:380:59:380:62 | dict [element, property Key] : A | CollectionFlow.cs:380:73:380:76 | access to parameter dict [element, property Key] : A |
+| CollectionFlow.cs:380:73:380:76 | access to parameter dict [element, property Key] : A | CollectionFlow.cs:380:73:380:81 | access to property Keys [element] : A |
+| CollectionFlow.cs:380:73:380:81 | access to property Keys [element] : A | CollectionFlow.cs:380:73:380:89 | call to method First |
+| CollectionFlow.cs:396:49:396:52 | args [element] : A | CollectionFlow.cs:396:63:396:66 | access to parameter args [element] : A |
+| CollectionFlow.cs:396:49:396:52 | args [element] : A | CollectionFlow.cs:396:63:396:66 | access to parameter args [element] : A |
+| CollectionFlow.cs:396:63:396:66 | access to parameter args [element] : A | CollectionFlow.cs:396:63:396:69 | access to array element |
+| CollectionFlow.cs:396:63:396:66 | access to parameter args [element] : A | CollectionFlow.cs:396:63:396:69 | access to array element |
 nodes
 | CollectionFlow.cs:14:17:14:23 | object creation of type A : A | semmle.label | object creation of type A : A |
-| CollectionFlow.cs:15:25:15:29 | { ..., ... } [[]] : A | semmle.label | { ..., ... } [[]] : A |
+| CollectionFlow.cs:15:25:15:29 | { ..., ... } [element] : A | semmle.label | { ..., ... } [element] : A |
 | CollectionFlow.cs:15:27:15:27 | access to local variable a : A | semmle.label | access to local variable a : A |
-| CollectionFlow.cs:16:14:16:16 | access to local variable as [[]] : A | semmle.label | access to local variable as [[]] : A |
+| CollectionFlow.cs:16:14:16:16 | access to local variable as [element] : A | semmle.label | access to local variable as [element] : A |
 | CollectionFlow.cs:16:14:16:19 | access to array element | semmle.label | access to array element |
-| CollectionFlow.cs:17:18:17:20 | access to local variable as [[]] : A | semmle.label | access to local variable as [[]] : A |
+| CollectionFlow.cs:17:18:17:20 | access to local variable as [element] : A | semmle.label | access to local variable as [element] : A |
 | CollectionFlow.cs:18:14:18:23 | call to method First | semmle.label | call to method First |
-| CollectionFlow.cs:18:20:18:22 | access to local variable as [[]] : A | semmle.label | access to local variable as [[]] : A |
+| CollectionFlow.cs:18:20:18:22 | access to local variable as [element] : A | semmle.label | access to local variable as [element] : A |
 | CollectionFlow.cs:32:17:32:23 | object creation of type A : A | semmle.label | object creation of type A : A |
-| CollectionFlow.cs:33:38:33:57 | { ..., ... } [As, []] : A | semmle.label | { ..., ... } [As, []] : A |
-| CollectionFlow.cs:33:45:33:55 | { ..., ... } [[]] : A | semmle.label | { ..., ... } [[]] : A |
+| CollectionFlow.cs:33:38:33:57 | { ..., ... } [field As, element] : A | semmle.label | { ..., ... } [field As, element] : A |
+| CollectionFlow.cs:33:45:33:55 | { ..., ... } [element] : A | semmle.label | { ..., ... } [element] : A |
 | CollectionFlow.cs:33:53:33:53 | access to local variable a : A | semmle.label | access to local variable a : A |
-| CollectionFlow.cs:34:14:34:14 | access to local variable c [As, []] : A | semmle.label | access to local variable c [As, []] : A |
-| CollectionFlow.cs:34:14:34:17 | access to field As [[]] : A | semmle.label | access to field As [[]] : A |
+| CollectionFlow.cs:34:14:34:14 | access to local variable c [field As, element] : A | semmle.label | access to local variable c [field As, element] : A |
+| CollectionFlow.cs:34:14:34:17 | access to field As [element] : A | semmle.label | access to field As [element] : A |
 | CollectionFlow.cs:34:14:34:20 | access to array element | semmle.label | access to array element |
-| CollectionFlow.cs:35:18:35:18 | access to local variable c [As, []] : A | semmle.label | access to local variable c [As, []] : A |
-| CollectionFlow.cs:35:18:35:21 | access to field As [[]] : A | semmle.label | access to field As [[]] : A |
+| CollectionFlow.cs:35:18:35:18 | access to local variable c [field As, element] : A | semmle.label | access to local variable c [field As, element] : A |
+| CollectionFlow.cs:35:18:35:21 | access to field As [element] : A | semmle.label | access to field As [element] : A |
 | CollectionFlow.cs:36:14:36:24 | call to method First | semmle.label | call to method First |
-| CollectionFlow.cs:36:20:36:20 | access to local variable c [As, []] : A | semmle.label | access to local variable c [As, []] : A |
-| CollectionFlow.cs:36:20:36:23 | access to field As [[]] : A | semmle.label | access to field As [[]] : A |
+| CollectionFlow.cs:36:20:36:20 | access to local variable c [field As, element] : A | semmle.label | access to local variable c [field As, element] : A |
+| CollectionFlow.cs:36:20:36:23 | access to field As [element] : A | semmle.label | access to field As [element] : A |
 | CollectionFlow.cs:50:17:50:23 | object creation of type A : A | semmle.label | object creation of type A : A |
-| CollectionFlow.cs:52:9:52:11 | [post] access to local variable as [[]] : A | semmle.label | [post] access to local variable as [[]] : A |
+| CollectionFlow.cs:52:9:52:11 | [post] access to local variable as [element] : A | semmle.label | [post] access to local variable as [element] : A |
 | CollectionFlow.cs:52:18:52:18 | access to local variable a : A | semmle.label | access to local variable a : A |
-| CollectionFlow.cs:53:14:53:16 | access to local variable as [[]] : A | semmle.label | access to local variable as [[]] : A |
+| CollectionFlow.cs:53:14:53:16 | access to local variable as [element] : A | semmle.label | access to local variable as [element] : A |
 | CollectionFlow.cs:53:14:53:19 | access to array element | semmle.label | access to array element |
-| CollectionFlow.cs:54:18:54:20 | access to local variable as [[]] : A | semmle.label | access to local variable as [[]] : A |
+| CollectionFlow.cs:54:18:54:20 | access to local variable as [element] : A | semmle.label | access to local variable as [element] : A |
 | CollectionFlow.cs:55:14:55:23 | call to method First | semmle.label | call to method First |
-| CollectionFlow.cs:55:20:55:22 | access to local variable as [[]] : A | semmle.label | access to local variable as [[]] : A |
+| CollectionFlow.cs:55:20:55:22 | access to local variable as [element] : A | semmle.label | access to local variable as [element] : A |
 | CollectionFlow.cs:70:17:70:23 | object creation of type A : A | semmle.label | object creation of type A : A |
-| CollectionFlow.cs:72:9:72:12 | [post] access to local variable list [[]] : A | semmle.label | [post] access to local variable list [[]] : A |
+| CollectionFlow.cs:72:9:72:12 | [post] access to local variable list [element] : A | semmle.label | [post] access to local variable list [element] : A |
 | CollectionFlow.cs:72:19:72:19 | access to local variable a : A | semmle.label | access to local variable a : A |
-| CollectionFlow.cs:73:14:73:17 | access to local variable list [[]] : A | semmle.label | access to local variable list [[]] : A |
+| CollectionFlow.cs:73:14:73:17 | access to local variable list [element] : A | semmle.label | access to local variable list [element] : A |
 | CollectionFlow.cs:73:14:73:20 | access to indexer | semmle.label | access to indexer |
-| CollectionFlow.cs:74:22:74:25 | access to local variable list [[]] : A | semmle.label | access to local variable list [[]] : A |
+| CollectionFlow.cs:74:22:74:25 | access to local variable list [element] : A | semmle.label | access to local variable list [element] : A |
 | CollectionFlow.cs:75:14:75:28 | call to method ListFirst | semmle.label | call to method ListFirst |
-| CollectionFlow.cs:75:24:75:27 | access to local variable list [[]] : A | semmle.label | access to local variable list [[]] : A |
+| CollectionFlow.cs:75:24:75:27 | access to local variable list [element] : A | semmle.label | access to local variable list [element] : A |
 | CollectionFlow.cs:89:17:89:23 | object creation of type A : A | semmle.label | object creation of type A : A |
-| CollectionFlow.cs:90:34:90:38 | { ..., ... } [[]] : A | semmle.label | { ..., ... } [[]] : A |
+| CollectionFlow.cs:90:20:90:38 | object creation of type List<A> [element] : A | semmle.label | object creation of type List<A> [element] : A |
 | CollectionFlow.cs:90:36:90:36 | access to local variable a : A | semmle.label | access to local variable a : A |
-| CollectionFlow.cs:91:14:91:17 | access to local variable list [[]] : A | semmle.label | access to local variable list [[]] : A |
+| CollectionFlow.cs:91:14:91:17 | access to local variable list [element] : A | semmle.label | access to local variable list [element] : A |
 | CollectionFlow.cs:91:14:91:20 | access to indexer | semmle.label | access to indexer |
-| CollectionFlow.cs:92:22:92:25 | access to local variable list [[]] : A | semmle.label | access to local variable list [[]] : A |
+| CollectionFlow.cs:92:22:92:25 | access to local variable list [element] : A | semmle.label | access to local variable list [element] : A |
 | CollectionFlow.cs:93:14:93:28 | call to method ListFirst | semmle.label | call to method ListFirst |
-| CollectionFlow.cs:93:24:93:27 | access to local variable list [[]] : A | semmle.label | access to local variable list [[]] : A |
+| CollectionFlow.cs:93:24:93:27 | access to local variable list [element] : A | semmle.label | access to local variable list [element] : A |
 | CollectionFlow.cs:106:17:106:23 | object creation of type A : A | semmle.label | object creation of type A : A |
-| CollectionFlow.cs:108:9:108:12 | [post] access to local variable list [[]] : A | semmle.label | [post] access to local variable list [[]] : A |
+| CollectionFlow.cs:108:9:108:12 | [post] access to local variable list [element] : A | semmle.label | [post] access to local variable list [element] : A |
 | CollectionFlow.cs:108:18:108:18 | access to local variable a : A | semmle.label | access to local variable a : A |
-| CollectionFlow.cs:109:14:109:17 | access to local variable list [[]] : A | semmle.label | access to local variable list [[]] : A |
+| CollectionFlow.cs:109:14:109:17 | access to local variable list [element] : A | semmle.label | access to local variable list [element] : A |
 | CollectionFlow.cs:109:14:109:20 | access to indexer | semmle.label | access to indexer |
-| CollectionFlow.cs:110:22:110:25 | access to local variable list [[]] : A | semmle.label | access to local variable list [[]] : A |
+| CollectionFlow.cs:110:22:110:25 | access to local variable list [element] : A | semmle.label | access to local variable list [element] : A |
 | CollectionFlow.cs:111:14:111:28 | call to method ListFirst | semmle.label | call to method ListFirst |
-| CollectionFlow.cs:111:24:111:27 | access to local variable list [[]] : A | semmle.label | access to local variable list [[]] : A |
+| CollectionFlow.cs:111:24:111:27 | access to local variable list [element] : A | semmle.label | access to local variable list [element] : A |
 | CollectionFlow.cs:125:17:125:23 | object creation of type A : A | semmle.label | object creation of type A : A |
-| CollectionFlow.cs:127:9:127:12 | [post] access to local variable dict [[], Value] : A | semmle.label | [post] access to local variable dict [[], Value] : A |
+| CollectionFlow.cs:127:9:127:12 | [post] access to local variable dict [element, property Value] : A | semmle.label | [post] access to local variable dict [element, property Value] : A |
 | CollectionFlow.cs:127:19:127:19 | access to local variable a : A | semmle.label | access to local variable a : A |
-| CollectionFlow.cs:128:14:128:17 | access to local variable dict [[], Value] : A | semmle.label | access to local variable dict [[], Value] : A |
+| CollectionFlow.cs:128:14:128:17 | access to local variable dict [element, property Value] : A | semmle.label | access to local variable dict [element, property Value] : A |
 | CollectionFlow.cs:128:14:128:20 | access to indexer | semmle.label | access to indexer |
-| CollectionFlow.cs:129:23:129:26 | access to local variable dict [[], Value] : A | semmle.label | access to local variable dict [[], Value] : A |
+| CollectionFlow.cs:129:23:129:26 | access to local variable dict [element, property Value] : A | semmle.label | access to local variable dict [element, property Value] : A |
 | CollectionFlow.cs:130:14:130:32 | call to method DictIndexZero | semmle.label | call to method DictIndexZero |
-| CollectionFlow.cs:130:28:130:31 | access to local variable dict [[], Value] : A | semmle.label | access to local variable dict [[], Value] : A |
+| CollectionFlow.cs:130:28:130:31 | access to local variable dict [element, property Value] : A | semmle.label | access to local variable dict [element, property Value] : A |
 | CollectionFlow.cs:131:14:131:33 | call to method DictFirstValue | semmle.label | call to method DictFirstValue |
-| CollectionFlow.cs:131:29:131:32 | access to local variable dict [[], Value] : A | semmle.label | access to local variable dict [[], Value] : A |
+| CollectionFlow.cs:131:29:131:32 | access to local variable dict [element, property Value] : A | semmle.label | access to local variable dict [element, property Value] : A |
 | CollectionFlow.cs:132:14:132:34 | call to method DictValuesFirst | semmle.label | call to method DictValuesFirst |
-| CollectionFlow.cs:132:30:132:33 | access to local variable dict [[], Value] : A | semmle.label | access to local variable dict [[], Value] : A |
+| CollectionFlow.cs:132:30:132:33 | access to local variable dict [element, property Value] : A | semmle.label | access to local variable dict [element, property Value] : A |
 | CollectionFlow.cs:148:17:148:23 | object creation of type A : A | semmle.label | object creation of type A : A |
-| CollectionFlow.cs:149:45:149:56 | { ..., ... } [[], Value] : A | semmle.label | { ..., ... } [[], Value] : A |
+| CollectionFlow.cs:149:20:149:56 | object creation of type Dictionary<Int32,A> [element, property Value] : A | semmle.label | object creation of type Dictionary<Int32,A> [element, property Value] : A |
 | CollectionFlow.cs:149:52:149:52 | access to local variable a : A | semmle.label | access to local variable a : A |
-| CollectionFlow.cs:150:14:150:17 | access to local variable dict [[], Value] : A | semmle.label | access to local variable dict [[], Value] : A |
+| CollectionFlow.cs:150:14:150:17 | access to local variable dict [element, property Value] : A | semmle.label | access to local variable dict [element, property Value] : A |
 | CollectionFlow.cs:150:14:150:20 | access to indexer | semmle.label | access to indexer |
-| CollectionFlow.cs:151:23:151:26 | access to local variable dict [[], Value] : A | semmle.label | access to local variable dict [[], Value] : A |
+| CollectionFlow.cs:151:23:151:26 | access to local variable dict [element, property Value] : A | semmle.label | access to local variable dict [element, property Value] : A |
 | CollectionFlow.cs:152:14:152:32 | call to method DictIndexZero | semmle.label | call to method DictIndexZero |
-| CollectionFlow.cs:152:28:152:31 | access to local variable dict [[], Value] : A | semmle.label | access to local variable dict [[], Value] : A |
+| CollectionFlow.cs:152:28:152:31 | access to local variable dict [element, property Value] : A | semmle.label | access to local variable dict [element, property Value] : A |
 | CollectionFlow.cs:153:14:153:33 | call to method DictFirstValue | semmle.label | call to method DictFirstValue |
-| CollectionFlow.cs:153:29:153:32 | access to local variable dict [[], Value] : A | semmle.label | access to local variable dict [[], Value] : A |
+| CollectionFlow.cs:153:29:153:32 | access to local variable dict [element, property Value] : A | semmle.label | access to local variable dict [element, property Value] : A |
 | CollectionFlow.cs:154:14:154:34 | call to method DictValuesFirst | semmle.label | call to method DictValuesFirst |
-| CollectionFlow.cs:154:30:154:33 | access to local variable dict [[], Value] : A | semmle.label | access to local variable dict [[], Value] : A |
+| CollectionFlow.cs:154:30:154:33 | access to local variable dict [element, property Value] : A | semmle.label | access to local variable dict [element, property Value] : A |
 | CollectionFlow.cs:169:17:169:23 | object creation of type A : A | semmle.label | object creation of type A : A |
-| CollectionFlow.cs:170:45:170:55 | { ..., ... } [[], Value] : A | semmle.label | { ..., ... } [[], Value] : A |
+| CollectionFlow.cs:170:20:170:55 | object creation of type Dictionary<Int32,A> [element, property Value] : A | semmle.label | object creation of type Dictionary<Int32,A> [element, property Value] : A |
 | CollectionFlow.cs:170:53:170:53 | access to local variable a : A | semmle.label | access to local variable a : A |
-| CollectionFlow.cs:171:14:171:17 | access to local variable dict [[], Value] : A | semmle.label | access to local variable dict [[], Value] : A |
+| CollectionFlow.cs:171:14:171:17 | access to local variable dict [element, property Value] : A | semmle.label | access to local variable dict [element, property Value] : A |
 | CollectionFlow.cs:171:14:171:20 | access to indexer | semmle.label | access to indexer |
-| CollectionFlow.cs:172:23:172:26 | access to local variable dict [[], Value] : A | semmle.label | access to local variable dict [[], Value] : A |
+| CollectionFlow.cs:172:23:172:26 | access to local variable dict [element, property Value] : A | semmle.label | access to local variable dict [element, property Value] : A |
 | CollectionFlow.cs:173:14:173:32 | call to method DictIndexZero | semmle.label | call to method DictIndexZero |
-| CollectionFlow.cs:173:28:173:31 | access to local variable dict [[], Value] : A | semmle.label | access to local variable dict [[], Value] : A |
+| CollectionFlow.cs:173:28:173:31 | access to local variable dict [element, property Value] : A | semmle.label | access to local variable dict [element, property Value] : A |
 | CollectionFlow.cs:174:14:174:33 | call to method DictFirstValue | semmle.label | call to method DictFirstValue |
-| CollectionFlow.cs:174:29:174:32 | access to local variable dict [[], Value] : A | semmle.label | access to local variable dict [[], Value] : A |
+| CollectionFlow.cs:174:29:174:32 | access to local variable dict [element, property Value] : A | semmle.label | access to local variable dict [element, property Value] : A |
 | CollectionFlow.cs:175:14:175:34 | call to method DictValuesFirst | semmle.label | call to method DictValuesFirst |
-| CollectionFlow.cs:175:30:175:33 | access to local variable dict [[], Value] : A | semmle.label | access to local variable dict [[], Value] : A |
+| CollectionFlow.cs:175:30:175:33 | access to local variable dict [element, property Value] : A | semmle.label | access to local variable dict [element, property Value] : A |
 | CollectionFlow.cs:191:17:191:23 | object creation of type A : A | semmle.label | object creation of type A : A |
-| CollectionFlow.cs:192:45:192:56 | { ..., ... } [[], Key] : A | semmle.label | { ..., ... } [[], Key] : A |
+| CollectionFlow.cs:192:20:192:56 | object creation of type Dictionary<A,Int32> [element, property Key] : A | semmle.label | object creation of type Dictionary<A,Int32> [element, property Key] : A |
 | CollectionFlow.cs:192:49:192:49 | access to local variable a : A | semmle.label | access to local variable a : A |
-| CollectionFlow.cs:193:14:193:17 | access to local variable dict [[], Key] : A | semmle.label | access to local variable dict [[], Key] : A |
-| CollectionFlow.cs:193:14:193:22 | access to property Keys [[]] : A | semmle.label | access to property Keys [[]] : A |
+| CollectionFlow.cs:193:14:193:17 | access to local variable dict [element, property Key] : A | semmle.label | access to local variable dict [element, property Key] : A |
+| CollectionFlow.cs:193:14:193:22 | access to property Keys [element] : A | semmle.label | access to property Keys [element] : A |
 | CollectionFlow.cs:193:14:193:30 | call to method First | semmle.label | call to method First |
-| CollectionFlow.cs:194:21:194:24 | access to local variable dict [[], Key] : A | semmle.label | access to local variable dict [[], Key] : A |
+| CollectionFlow.cs:194:21:194:24 | access to local variable dict [element, property Key] : A | semmle.label | access to local variable dict [element, property Key] : A |
 | CollectionFlow.cs:195:14:195:32 | call to method DictKeysFirst | semmle.label | call to method DictKeysFirst |
-| CollectionFlow.cs:195:28:195:31 | access to local variable dict [[], Key] : A | semmle.label | access to local variable dict [[], Key] : A |
+| CollectionFlow.cs:195:28:195:31 | access to local variable dict [element, property Key] : A | semmle.label | access to local variable dict [element, property Key] : A |
 | CollectionFlow.cs:196:14:196:31 | call to method DictFirstKey | semmle.label | call to method DictFirstKey |
-| CollectionFlow.cs:196:27:196:30 | access to local variable dict [[], Key] : A | semmle.label | access to local variable dict [[], Key] : A |
+| CollectionFlow.cs:196:27:196:30 | access to local variable dict [element, property Key] : A | semmle.label | access to local variable dict [element, property Key] : A |
 | CollectionFlow.cs:210:17:210:23 | object creation of type A : A | semmle.label | object creation of type A : A |
-| CollectionFlow.cs:211:45:211:55 | { ..., ... } [[], Key] : A | semmle.label | { ..., ... } [[], Key] : A |
+| CollectionFlow.cs:211:20:211:55 | object creation of type Dictionary<A,Int32> [element, property Key] : A | semmle.label | object creation of type Dictionary<A,Int32> [element, property Key] : A |
 | CollectionFlow.cs:211:48:211:48 | access to local variable a : A | semmle.label | access to local variable a : A |
-| CollectionFlow.cs:212:14:212:17 | access to local variable dict [[], Key] : A | semmle.label | access to local variable dict [[], Key] : A |
-| CollectionFlow.cs:212:14:212:22 | access to property Keys [[]] : A | semmle.label | access to property Keys [[]] : A |
+| CollectionFlow.cs:212:14:212:17 | access to local variable dict [element, property Key] : A | semmle.label | access to local variable dict [element, property Key] : A |
+| CollectionFlow.cs:212:14:212:22 | access to property Keys [element] : A | semmle.label | access to property Keys [element] : A |
 | CollectionFlow.cs:212:14:212:30 | call to method First | semmle.label | call to method First |
-| CollectionFlow.cs:213:21:213:24 | access to local variable dict [[], Key] : A | semmle.label | access to local variable dict [[], Key] : A |
+| CollectionFlow.cs:213:21:213:24 | access to local variable dict [element, property Key] : A | semmle.label | access to local variable dict [element, property Key] : A |
 | CollectionFlow.cs:214:14:214:32 | call to method DictKeysFirst | semmle.label | call to method DictKeysFirst |
-| CollectionFlow.cs:214:28:214:31 | access to local variable dict [[], Key] : A | semmle.label | access to local variable dict [[], Key] : A |
+| CollectionFlow.cs:214:28:214:31 | access to local variable dict [element, property Key] : A | semmle.label | access to local variable dict [element, property Key] : A |
 | CollectionFlow.cs:215:14:215:31 | call to method DictFirstKey | semmle.label | call to method DictFirstKey |
-| CollectionFlow.cs:215:27:215:30 | access to local variable dict [[], Key] : A | semmle.label | access to local variable dict [[], Key] : A |
+| CollectionFlow.cs:215:27:215:30 | access to local variable dict [element, property Key] : A | semmle.label | access to local variable dict [element, property Key] : A |
 | CollectionFlow.cs:229:17:229:23 | object creation of type A : A | semmle.label | object creation of type A : A |
-| CollectionFlow.cs:230:25:230:29 | { ..., ... } [[]] : A | semmle.label | { ..., ... } [[]] : A |
+| CollectionFlow.cs:230:25:230:29 | { ..., ... } [element] : A | semmle.label | { ..., ... } [element] : A |
 | CollectionFlow.cs:230:27:230:27 | access to local variable a : A | semmle.label | access to local variable a : A |
 | CollectionFlow.cs:231:22:231:22 | SSA def(x) : A | semmle.label | SSA def(x) : A |
-| CollectionFlow.cs:231:27:231:29 | access to local variable as [[]] : A | semmle.label | access to local variable as [[]] : A |
+| CollectionFlow.cs:231:27:231:29 | access to local variable as [element] : A | semmle.label | access to local variable as [element] : A |
 | CollectionFlow.cs:232:18:232:18 | access to local variable x | semmle.label | access to local variable x |
 | CollectionFlow.cs:244:17:244:23 | object creation of type A : A | semmle.label | object creation of type A : A |
-| CollectionFlow.cs:245:25:245:29 | { ..., ... } [[]] : A | semmle.label | { ..., ... } [[]] : A |
+| CollectionFlow.cs:245:25:245:29 | { ..., ... } [element] : A | semmle.label | { ..., ... } [element] : A |
 | CollectionFlow.cs:245:27:245:27 | access to local variable a : A | semmle.label | access to local variable a : A |
-| CollectionFlow.cs:246:26:246:28 | access to local variable as [[]] : A | semmle.label | access to local variable as [[]] : A |
-| CollectionFlow.cs:246:26:246:44 | call to method GetEnumerator [Current] : A | semmle.label | call to method GetEnumerator [Current] : A |
-| CollectionFlow.cs:248:18:248:27 | access to local variable enumerator [Current] : A | semmle.label | access to local variable enumerator [Current] : A |
+| CollectionFlow.cs:246:26:246:28 | access to local variable as [element] : A | semmle.label | access to local variable as [element] : A |
+| CollectionFlow.cs:246:26:246:44 | call to method GetEnumerator [property Current] : A | semmle.label | call to method GetEnumerator [property Current] : A |
+| CollectionFlow.cs:248:18:248:27 | access to local variable enumerator [property Current] : A | semmle.label | access to local variable enumerator [property Current] : A |
 | CollectionFlow.cs:248:18:248:35 | access to property Current | semmle.label | access to property Current |
 | CollectionFlow.cs:261:17:261:23 | object creation of type A : A | semmle.label | object creation of type A : A |
-| CollectionFlow.cs:263:9:263:12 | [post] access to local variable list [[]] : A | semmle.label | [post] access to local variable list [[]] : A |
+| CollectionFlow.cs:263:9:263:12 | [post] access to local variable list [element] : A | semmle.label | [post] access to local variable list [element] : A |
 | CollectionFlow.cs:263:18:263:18 | access to local variable a : A | semmle.label | access to local variable a : A |
-| CollectionFlow.cs:264:26:264:29 | access to local variable list [[]] : A | semmle.label | access to local variable list [[]] : A |
-| CollectionFlow.cs:264:26:264:45 | call to method GetEnumerator [Current] : A | semmle.label | call to method GetEnumerator [Current] : A |
-| CollectionFlow.cs:266:18:266:27 | access to local variable enumerator [Current] : A | semmle.label | access to local variable enumerator [Current] : A |
+| CollectionFlow.cs:264:26:264:29 | access to local variable list [element] : A | semmle.label | access to local variable list [element] : A |
+| CollectionFlow.cs:264:26:264:45 | call to method GetEnumerator [property Current] : A | semmle.label | call to method GetEnumerator [property Current] : A |
+| CollectionFlow.cs:266:18:266:27 | access to local variable enumerator [property Current] : A | semmle.label | access to local variable enumerator [property Current] : A |
 | CollectionFlow.cs:266:18:266:35 | access to property Current | semmle.label | access to property Current |
 | CollectionFlow.cs:280:17:280:23 | object creation of type A : A | semmle.label | object creation of type A : A |
-| CollectionFlow.cs:282:9:282:12 | [post] access to local variable list [[], Key] : A | semmle.label | [post] access to local variable list [[], Key] : A |
-| CollectionFlow.cs:282:18:282:47 | object creation of type KeyValuePair<A,Int32> [Key] : A | semmle.label | object creation of type KeyValuePair<A,Int32> [Key] : A |
+| CollectionFlow.cs:282:9:282:12 | [post] access to local variable list [element, property Key] : A | semmle.label | [post] access to local variable list [element, property Key] : A |
+| CollectionFlow.cs:282:18:282:47 | object creation of type KeyValuePair<A,Int32> [property Key] : A | semmle.label | object creation of type KeyValuePair<A,Int32> [property Key] : A |
 | CollectionFlow.cs:282:43:282:43 | access to local variable a : A | semmle.label | access to local variable a : A |
-| CollectionFlow.cs:283:9:283:12 | access to local variable list [[], Key] : A | semmle.label | access to local variable list [[], Key] : A |
-| CollectionFlow.cs:283:21:283:23 | kvp [Key] : A | semmle.label | kvp [Key] : A |
-| CollectionFlow.cs:285:18:285:20 | access to parameter kvp [Key] : A | semmle.label | access to parameter kvp [Key] : A |
+| CollectionFlow.cs:283:9:283:12 | access to local variable list [element, property Key] : A | semmle.label | access to local variable list [element, property Key] : A |
+| CollectionFlow.cs:283:21:283:23 | kvp [property Key] : A | semmle.label | kvp [property Key] : A |
+| CollectionFlow.cs:285:18:285:20 | access to parameter kvp [property Key] : A | semmle.label | access to parameter kvp [property Key] : A |
 | CollectionFlow.cs:285:18:285:24 | access to property Key | semmle.label | access to property Key |
 | CollectionFlow.cs:306:17:306:23 | object creation of type A : A | semmle.label | object creation of type A : A |
-| CollectionFlow.cs:308:18:308:20 | [post] access to local variable as [[]] : A | semmle.label | [post] access to local variable as [[]] : A |
+| CollectionFlow.cs:308:18:308:20 | [post] access to local variable as [element] : A | semmle.label | [post] access to local variable as [element] : A |
 | CollectionFlow.cs:308:23:308:23 | access to local variable a : A | semmle.label | access to local variable a : A |
-| CollectionFlow.cs:309:14:309:16 | access to local variable as [[]] : A | semmle.label | access to local variable as [[]] : A |
+| CollectionFlow.cs:309:14:309:16 | access to local variable as [element] : A | semmle.label | access to local variable as [element] : A |
 | CollectionFlow.cs:309:14:309:19 | access to array element | semmle.label | access to array element |
-| CollectionFlow.cs:310:18:310:20 | access to local variable as [[]] : A | semmle.label | access to local variable as [[]] : A |
+| CollectionFlow.cs:310:18:310:20 | access to local variable as [element] : A | semmle.label | access to local variable as [element] : A |
 | CollectionFlow.cs:311:14:311:23 | call to method First | semmle.label | call to method First |
-| CollectionFlow.cs:311:20:311:22 | access to local variable as [[]] : A | semmle.label | access to local variable as [[]] : A |
+| CollectionFlow.cs:311:20:311:22 | access to local variable as [element] : A | semmle.label | access to local variable as [element] : A |
 | CollectionFlow.cs:328:17:328:23 | object creation of type A : A | semmle.label | object creation of type A : A |
-| CollectionFlow.cs:330:17:330:20 | [post] access to local variable list [[]] : A | semmle.label | [post] access to local variable list [[]] : A |
+| CollectionFlow.cs:330:17:330:20 | [post] access to local variable list [element] : A | semmle.label | [post] access to local variable list [element] : A |
 | CollectionFlow.cs:330:23:330:23 | access to local variable a : A | semmle.label | access to local variable a : A |
-| CollectionFlow.cs:331:14:331:17 | access to local variable list [[]] : A | semmle.label | access to local variable list [[]] : A |
+| CollectionFlow.cs:331:14:331:17 | access to local variable list [element] : A | semmle.label | access to local variable list [element] : A |
 | CollectionFlow.cs:331:14:331:20 | access to indexer | semmle.label | access to indexer |
-| CollectionFlow.cs:332:22:332:25 | access to local variable list [[]] : A | semmle.label | access to local variable list [[]] : A |
+| CollectionFlow.cs:332:22:332:25 | access to local variable list [element] : A | semmle.label | access to local variable list [element] : A |
 | CollectionFlow.cs:333:14:333:28 | call to method ListFirst | semmle.label | call to method ListFirst |
-| CollectionFlow.cs:333:24:333:27 | access to local variable list [[]] : A | semmle.label | access to local variable list [[]] : A |
+| CollectionFlow.cs:333:24:333:27 | access to local variable list [element] : A | semmle.label | access to local variable list [element] : A |
 | CollectionFlow.cs:347:20:347:26 | object creation of type A : A | semmle.label | object creation of type A : A |
 | CollectionFlow.cs:348:26:348:32 | object creation of type A : A | semmle.label | object creation of type A : A |
 | CollectionFlow.cs:349:26:349:32 | object creation of type A : A | semmle.label | object creation of type A : A |
-| CollectionFlow.cs:350:20:350:38 | array creation of type A[] [[]] : A | semmle.label | array creation of type A[] [[]] : A |
-| CollectionFlow.cs:350:28:350:38 | { ..., ... } [[]] : A | semmle.label | { ..., ... } [[]] : A |
+| CollectionFlow.cs:350:20:350:38 | array creation of type A[] [element] : A | semmle.label | array creation of type A[] [element] : A |
+| CollectionFlow.cs:350:28:350:38 | { ..., ... } [element] : A | semmle.label | { ..., ... } [element] : A |
 | CollectionFlow.cs:350:30:350:36 | object creation of type A : A | semmle.label | object creation of type A : A |
-| CollectionFlow.cs:374:40:374:41 | ts [[]] : A | semmle.label | ts [[]] : A |
-| CollectionFlow.cs:374:40:374:41 | ts [[]] : A | semmle.label | ts [[]] : A |
-| CollectionFlow.cs:374:52:374:53 | access to parameter ts [[]] : A | semmle.label | access to parameter ts [[]] : A |
-| CollectionFlow.cs:374:52:374:53 | access to parameter ts [[]] : A | semmle.label | access to parameter ts [[]] : A |
+| CollectionFlow.cs:374:40:374:41 | ts [element] : A | semmle.label | ts [element] : A |
+| CollectionFlow.cs:374:40:374:41 | ts [element] : A | semmle.label | ts [element] : A |
+| CollectionFlow.cs:374:52:374:53 | access to parameter ts [element] : A | semmle.label | access to parameter ts [element] : A |
+| CollectionFlow.cs:374:52:374:53 | access to parameter ts [element] : A | semmle.label | access to parameter ts [element] : A |
 | CollectionFlow.cs:374:52:374:56 | access to array element | semmle.label | access to array element |
-| CollectionFlow.cs:376:49:376:52 | list [[]] : A | semmle.label | list [[]] : A |
-| CollectionFlow.cs:376:49:376:52 | list [[]] : A | semmle.label | list [[]] : A |
-| CollectionFlow.cs:376:49:376:52 | list [[]] : A | semmle.label | list [[]] : A |
-| CollectionFlow.cs:376:49:376:52 | list [[]] : A | semmle.label | list [[]] : A |
-| CollectionFlow.cs:376:63:376:66 | access to parameter list [[]] : A | semmle.label | access to parameter list [[]] : A |
-| CollectionFlow.cs:376:63:376:66 | access to parameter list [[]] : A | semmle.label | access to parameter list [[]] : A |
-| CollectionFlow.cs:376:63:376:66 | access to parameter list [[]] : A | semmle.label | access to parameter list [[]] : A |
-| CollectionFlow.cs:376:63:376:66 | access to parameter list [[]] : A | semmle.label | access to parameter list [[]] : A |
+| CollectionFlow.cs:376:49:376:52 | list [element] : A | semmle.label | list [element] : A |
+| CollectionFlow.cs:376:49:376:52 | list [element] : A | semmle.label | list [element] : A |
+| CollectionFlow.cs:376:49:376:52 | list [element] : A | semmle.label | list [element] : A |
+| CollectionFlow.cs:376:49:376:52 | list [element] : A | semmle.label | list [element] : A |
+| CollectionFlow.cs:376:63:376:66 | access to parameter list [element] : A | semmle.label | access to parameter list [element] : A |
+| CollectionFlow.cs:376:63:376:66 | access to parameter list [element] : A | semmle.label | access to parameter list [element] : A |
+| CollectionFlow.cs:376:63:376:66 | access to parameter list [element] : A | semmle.label | access to parameter list [element] : A |
+| CollectionFlow.cs:376:63:376:66 | access to parameter list [element] : A | semmle.label | access to parameter list [element] : A |
 | CollectionFlow.cs:376:63:376:69 | access to indexer | semmle.label | access to indexer |
-| CollectionFlow.cs:378:61:378:64 | dict [[], Value] : A | semmle.label | dict [[], Value] : A |
-| CollectionFlow.cs:378:75:378:78 | access to parameter dict [[], Value] : A | semmle.label | access to parameter dict [[], Value] : A |
+| CollectionFlow.cs:378:61:378:64 | dict [element, property Value] : A | semmle.label | dict [element, property Value] : A |
+| CollectionFlow.cs:378:75:378:78 | access to parameter dict [element, property Value] : A | semmle.label | access to parameter dict [element, property Value] : A |
 | CollectionFlow.cs:378:75:378:81 | access to indexer | semmle.label | access to indexer |
-| CollectionFlow.cs:380:59:380:62 | dict [[], Key] : A | semmle.label | dict [[], Key] : A |
-| CollectionFlow.cs:380:73:380:76 | access to parameter dict [[], Key] : A | semmle.label | access to parameter dict [[], Key] : A |
-| CollectionFlow.cs:380:73:380:81 | access to property Keys [[]] : A | semmle.label | access to property Keys [[]] : A |
+| CollectionFlow.cs:380:59:380:62 | dict [element, property Key] : A | semmle.label | dict [element, property Key] : A |
+| CollectionFlow.cs:380:73:380:76 | access to parameter dict [element, property Key] : A | semmle.label | access to parameter dict [element, property Key] : A |
+| CollectionFlow.cs:380:73:380:81 | access to property Keys [element] : A | semmle.label | access to property Keys [element] : A |
 | CollectionFlow.cs:380:73:380:89 | call to method First | semmle.label | call to method First |
-| CollectionFlow.cs:396:49:396:52 | args [[]] : A | semmle.label | args [[]] : A |
-| CollectionFlow.cs:396:49:396:52 | args [[]] : A | semmle.label | args [[]] : A |
-| CollectionFlow.cs:396:63:396:66 | access to parameter args [[]] : A | semmle.label | access to parameter args [[]] : A |
-| CollectionFlow.cs:396:63:396:66 | access to parameter args [[]] : A | semmle.label | access to parameter args [[]] : A |
+| CollectionFlow.cs:396:49:396:52 | args [element] : A | semmle.label | args [element] : A |
+| CollectionFlow.cs:396:49:396:52 | args [element] : A | semmle.label | args [element] : A |
+| CollectionFlow.cs:396:63:396:66 | access to parameter args [element] : A | semmle.label | access to parameter args [element] : A |
+| CollectionFlow.cs:396:63:396:66 | access to parameter args [element] : A | semmle.label | access to parameter args [element] : A |
 | CollectionFlow.cs:396:63:396:69 | access to array element | semmle.label | access to array element |
 #select
 | CollectionFlow.cs:14:17:14:23 | object creation of type A : A | CollectionFlow.cs:14:17:14:23 | object creation of type A : A | CollectionFlow.cs:16:14:16:19 | access to array element | $@ | CollectionFlow.cs:16:14:16:19 | access to array element | access to array element |
diff --git a/csharp/ql/test/library-tests/dataflow/delegates/DelegateFlow.cs b/csharp/ql/test/library-tests/dataflow/delegates/DelegateFlow.cs
index 59c1c924a80..15d628aea9a 100644
--- a/csharp/ql/test/library-tests/dataflow/delegates/DelegateFlow.cs
+++ b/csharp/ql/test/library-tests/dataflow/delegates/DelegateFlow.cs
@@ -124,4 +124,13 @@ class DelegateFlow
         delegate*<Action<int>, void> fnptr = &M2;
         fnptr((i) => { });
     }
+
+    void M19(Action a, bool b)
+    {
+        if (b)
+            a = () => {};
+        a();
+    }
+
+    void M20(bool b) => M19(() => {}, b);
 }
diff --git a/csharp/ql/test/library-tests/dataflow/delegates/DelegateFlow.expected b/csharp/ql/test/library-tests/dataflow/delegates/DelegateFlow.expected
index 80ae0d0fe89..f9fbbbab6be 100644
--- a/csharp/ql/test/library-tests/dataflow/delegates/DelegateFlow.expected
+++ b/csharp/ql/test/library-tests/dataflow/delegates/DelegateFlow.expected
@@ -1,26 +1,55 @@
-summaryDelegateCall
-| file://:0:0:0:0 | valueFactory | DelegateFlow.cs:104:23:104:30 | (...) => ... | DelegateFlow.cs:105:23:105:23 | access to local variable f |
-| file://:0:0:0:0 | valueFactory | DelegateFlow.cs:106:13:106:20 | (...) => ... | DelegateFlow.cs:107:23:107:23 | access to local variable f |
 delegateCall
-| DelegateFlow.cs:9:9:9:12 | delegate call | DelegateFlow.cs:5:10:5:11 | M1 | DelegateFlow.cs:17:12:17:13 | delegate creation of type Action<Int32> |
-| DelegateFlow.cs:9:9:9:12 | delegate call | DelegateFlow.cs:5:10:5:11 | M1 | DelegateFlow.cs:22:12:22:12 | access to parameter a |
-| DelegateFlow.cs:9:9:9:12 | delegate call | DelegateFlow.cs:16:12:16:19 | (...) => ... | DelegateFlow.cs:16:12:16:19 | (...) => ... |
-| DelegateFlow.cs:9:9:9:12 | delegate call | DelegateFlow.cs:27:12:27:19 | (...) => ... | DelegateFlow.cs:22:12:22:12 | access to parameter a |
-| DelegateFlow.cs:9:9:9:12 | delegate call | DelegateFlow.cs:98:9:98:37 | LocalFunction | DelegateFlow.cs:99:12:99:24 | delegate creation of type Action<Int32> |
-| DelegateFlow.cs:9:9:9:12 | delegate call | DelegateFlow.cs:119:18:119:27 | (...) => ... | DelegateFlow.cs:114:15:114:15 | access to parameter a |
-| DelegateFlow.cs:9:9:9:12 | delegate call | DelegateFlow.cs:125:15:125:24 | (...) => ... | DelegateFlow.cs:125:15:125:24 | (...) => ... |
-| DelegateFlow.cs:11:9:11:12 | delegate call | DelegateFlow.cs:10:13:10:20 | (...) => ... | file://:0:0:0:0 | <empty> |
-| DelegateFlow.cs:33:9:33:13 | delegate call | DelegateFlow.cs:38:12:38:25 | (...) => ... | DelegateFlow.cs:38:12:38:25 | (...) => ... |
-| DelegateFlow.cs:38:19:38:22 | delegate call | DelegateFlow.cs:5:10:5:11 | M1 | DelegateFlow.cs:33:12:33:12 | access to parameter a |
-| DelegateFlow.cs:44:15:44:22 | delegate call | DelegateFlow.cs:43:22:43:29 | (...) => ... | DelegateFlow.cs:50:18:50:23 | dynamic access to member Prop |
-| DelegateFlow.cs:57:9:57:11 | delegate call | DelegateFlow.cs:53:34:53:47 | (...) => ... | file://:0:0:0:0 | <empty> |
-| DelegateFlow.cs:57:9:57:14 | delegate call | DelegateFlow.cs:53:40:53:47 | (...) => ... | file://:0:0:0:0 | <empty> |
-| DelegateFlow.cs:67:9:67:16 | delegate call | DelegateFlow.cs:62:16:62:23 | (...) => ... | file://:0:0:0:0 | <empty> |
-| DelegateFlow.cs:77:9:77:15 | delegate call | DelegateFlow.cs:55:10:55:11 | M9 | file://:0:0:0:0 | <empty> |
-| DelegateFlow.cs:77:9:77:15 | delegate call | DelegateFlow.cs:65:10:65:12 | M11 | file://:0:0:0:0 | <empty> |
-| DelegateFlow.cs:84:9:84:15 | delegate call | DelegateFlow.cs:55:10:55:11 | M9 | DelegateFlow.cs:78:13:78:14 | delegate creation of type EventHandler |
-| DelegateFlow.cs:84:9:84:15 | delegate call | DelegateFlow.cs:65:10:65:12 | M11 | file://:0:0:0:0 | <empty> |
-| DelegateFlow.cs:89:35:89:37 | delegate call | DelegateFlow.cs:55:10:55:11 | M9 | DelegateFlow.cs:90:13:90:30 | delegate creation of type MyDelegate |
-| DelegateFlow.cs:89:35:89:37 | delegate call | DelegateFlow.cs:65:10:65:12 | M11 | DelegateFlow.cs:91:13:91:47 | delegate creation of type MyDelegate |
-| DelegateFlow.cs:89:35:89:37 | delegate call | DelegateFlow.cs:74:17:74:19 | M12 | DelegateFlow.cs:92:13:92:15 | delegate creation of type MyDelegate |
-| DelegateFlow.cs:89:35:89:37 | delegate call | DelegateFlow.cs:93:13:93:21 | (...) => ... | DelegateFlow.cs:93:13:93:21 | (...) => ... |
+| DelegateFlow.cs:9:9:9:12 | delegate call | DelegateFlow.cs:5:10:5:11 | M1 |
+| DelegateFlow.cs:9:9:9:12 | delegate call | DelegateFlow.cs:16:12:16:19 | (...) => ... |
+| DelegateFlow.cs:9:9:9:12 | delegate call | DelegateFlow.cs:27:12:27:19 | (...) => ... |
+| DelegateFlow.cs:9:9:9:12 | delegate call | DelegateFlow.cs:98:9:98:37 | LocalFunction |
+| DelegateFlow.cs:9:9:9:12 | delegate call | DelegateFlow.cs:119:18:119:27 | (...) => ... |
+| DelegateFlow.cs:9:9:9:12 | delegate call | DelegateFlow.cs:125:15:125:24 | (...) => ... |
+| DelegateFlow.cs:11:9:11:12 | delegate call | DelegateFlow.cs:10:13:10:20 | (...) => ... |
+| DelegateFlow.cs:33:9:33:13 | delegate call | DelegateFlow.cs:38:12:38:25 | (...) => ... |
+| DelegateFlow.cs:38:19:38:22 | delegate call | DelegateFlow.cs:5:10:5:11 | M1 |
+| DelegateFlow.cs:44:15:44:22 | delegate call | DelegateFlow.cs:43:22:43:29 | (...) => ... |
+| DelegateFlow.cs:57:9:57:11 | delegate call | DelegateFlow.cs:53:34:53:47 | (...) => ... |
+| DelegateFlow.cs:57:9:57:14 | delegate call | DelegateFlow.cs:53:40:53:47 | (...) => ... |
+| DelegateFlow.cs:67:9:67:16 | delegate call | DelegateFlow.cs:62:16:62:23 | (...) => ... |
+| DelegateFlow.cs:77:9:77:15 | delegate call | DelegateFlow.cs:55:10:55:11 | M9 |
+| DelegateFlow.cs:77:9:77:15 | delegate call | DelegateFlow.cs:65:10:65:12 | M11 |
+| DelegateFlow.cs:84:9:84:15 | delegate call | DelegateFlow.cs:55:10:55:11 | M9 |
+| DelegateFlow.cs:84:9:84:15 | delegate call | DelegateFlow.cs:65:10:65:12 | M11 |
+| DelegateFlow.cs:89:35:89:37 | delegate call | DelegateFlow.cs:55:10:55:11 | M9 |
+| DelegateFlow.cs:89:35:89:37 | delegate call | DelegateFlow.cs:65:10:65:12 | M11 |
+| DelegateFlow.cs:89:35:89:37 | delegate call | DelegateFlow.cs:74:17:74:19 | M12 |
+| DelegateFlow.cs:89:35:89:37 | delegate call | DelegateFlow.cs:93:13:93:21 | (...) => ... |
+| DelegateFlow.cs:114:9:114:16 | function pointer call | DelegateFlow.cs:7:17:7:18 | M2 |
+| DelegateFlow.cs:125:9:125:25 | function pointer call | DelegateFlow.cs:7:17:7:18 | M2 |
+| DelegateFlow.cs:132:9:132:11 | delegate call | DelegateFlow.cs:131:17:131:24 | (...) => ... |
+| DelegateFlow.cs:132:9:132:11 | delegate call | DelegateFlow.cs:135:29:135:36 | (...) => ... |
+viableLambda
+| DelegateFlow.cs:9:9:9:12 | delegate call | DelegateFlow.cs:16:9:16:20 | call to method M2 | DelegateFlow.cs:16:12:16:19 | (...) => ... |
+| DelegateFlow.cs:9:9:9:12 | delegate call | DelegateFlow.cs:17:9:17:14 | call to method M2 | DelegateFlow.cs:5:10:5:11 | M1 |
+| DelegateFlow.cs:9:9:9:12 | delegate call | DelegateFlow.cs:22:9:22:13 | call to method M2 | DelegateFlow.cs:5:10:5:11 | M1 |
+| DelegateFlow.cs:9:9:9:12 | delegate call | DelegateFlow.cs:22:9:22:13 | call to method M2 | DelegateFlow.cs:27:12:27:19 | (...) => ... |
+| DelegateFlow.cs:9:9:9:12 | delegate call | DelegateFlow.cs:99:9:99:25 | call to method M2 | DelegateFlow.cs:98:9:98:37 | LocalFunction |
+| DelegateFlow.cs:9:9:9:12 | delegate call | DelegateFlow.cs:114:9:114:16 | function pointer call | DelegateFlow.cs:119:18:119:27 | (...) => ... |
+| DelegateFlow.cs:9:9:9:12 | delegate call | DelegateFlow.cs:125:9:125:25 | function pointer call | DelegateFlow.cs:125:15:125:24 | (...) => ... |
+| DelegateFlow.cs:11:9:11:12 | delegate call | file://:0:0:0:0 | (none) | DelegateFlow.cs:10:13:10:20 | (...) => ... |
+| DelegateFlow.cs:33:9:33:13 | delegate call | DelegateFlow.cs:38:9:38:30 | call to method M6 | DelegateFlow.cs:38:12:38:25 | (...) => ... |
+| DelegateFlow.cs:38:19:38:22 | delegate call | DelegateFlow.cs:33:9:33:13 | delegate call | DelegateFlow.cs:5:10:5:11 | M1 |
+| DelegateFlow.cs:44:15:44:22 | delegate call | DelegateFlow.cs:50:9:50:14 | dynamic access to member Prop | DelegateFlow.cs:43:22:43:29 | (...) => ... |
+| DelegateFlow.cs:57:9:57:11 | delegate call | file://:0:0:0:0 | (none) | DelegateFlow.cs:53:34:53:47 | (...) => ... |
+| DelegateFlow.cs:57:9:57:14 | delegate call | file://:0:0:0:0 | (none) | DelegateFlow.cs:53:40:53:47 | (...) => ... |
+| DelegateFlow.cs:67:9:67:16 | delegate call | file://:0:0:0:0 | (none) | DelegateFlow.cs:62:16:62:23 | (...) => ... |
+| DelegateFlow.cs:77:9:77:15 | delegate call | file://:0:0:0:0 | (none) | DelegateFlow.cs:55:10:55:11 | M9 |
+| DelegateFlow.cs:77:9:77:15 | delegate call | file://:0:0:0:0 | (none) | DelegateFlow.cs:65:10:65:12 | M11 |
+| DelegateFlow.cs:84:9:84:15 | delegate call | DelegateFlow.cs:78:9:78:15 | call to method M13 | DelegateFlow.cs:55:10:55:11 | M9 |
+| DelegateFlow.cs:84:9:84:15 | delegate call | file://:0:0:0:0 | (none) | DelegateFlow.cs:65:10:65:12 | M11 |
+| DelegateFlow.cs:89:35:89:37 | delegate call | DelegateFlow.cs:90:9:90:31 | call to local function M14 | DelegateFlow.cs:55:10:55:11 | M9 |
+| DelegateFlow.cs:89:35:89:37 | delegate call | DelegateFlow.cs:91:9:91:48 | call to local function M14 | DelegateFlow.cs:65:10:65:12 | M11 |
+| DelegateFlow.cs:89:35:89:37 | delegate call | DelegateFlow.cs:92:9:92:16 | call to local function M14 | DelegateFlow.cs:74:17:74:19 | M12 |
+| DelegateFlow.cs:89:35:89:37 | delegate call | DelegateFlow.cs:93:9:93:22 | call to local function M14 | DelegateFlow.cs:93:13:93:21 | (...) => ... |
+| DelegateFlow.cs:114:9:114:16 | function pointer call | DelegateFlow.cs:119:9:119:28 | call to method M16 | DelegateFlow.cs:7:17:7:18 | M2 |
+| DelegateFlow.cs:125:9:125:25 | function pointer call | file://:0:0:0:0 | (none) | DelegateFlow.cs:7:17:7:18 | M2 |
+| DelegateFlow.cs:132:9:132:11 | delegate call | DelegateFlow.cs:135:25:135:40 | call to method M19 | DelegateFlow.cs:135:29:135:36 | (...) => ... |
+| DelegateFlow.cs:132:9:132:11 | delegate call | file://:0:0:0:0 | (none) | DelegateFlow.cs:131:17:131:24 | (...) => ... |
+| file://:0:0:0:0 | [summary] call to valueFactory in Lazy | DelegateFlow.cs:105:9:105:24 | object creation of type Lazy<Int32> | DelegateFlow.cs:104:23:104:30 | (...) => ... |
+| file://:0:0:0:0 | [summary] call to valueFactory in Lazy | DelegateFlow.cs:107:9:107:24 | object creation of type Lazy<Int32> | DelegateFlow.cs:106:13:106:20 | (...) => ... |
diff --git a/csharp/ql/test/library-tests/dataflow/delegates/DelegateFlow.ql b/csharp/ql/test/library-tests/dataflow/delegates/DelegateFlow.ql
index c01feabc2f9..6ec7637bf6c 100644
--- a/csharp/ql/test/library-tests/dataflow/delegates/DelegateFlow.ql
+++ b/csharp/ql/test/library-tests/dataflow/delegates/DelegateFlow.ql
@@ -1,22 +1,34 @@
 import csharp
-import semmle.code.csharp.dataflow.internal.DataFlowPrivate
-import semmle.code.csharp.dataflow.internal.DelegateDataFlow
+import semmle.code.csharp.dataflow.internal.DataFlowImplCommon
+import semmle.code.csharp.dataflow.internal.DataFlowDispatch
 
-private class NodeAdjusted extends TNode {
-  string toString() { result = this.(DataFlow::Node).toString() }
+query predicate delegateCall(DelegateLikeCall dc, Callable c) { c = dc.getARuntimeTarget() }
+
+private class LocatableDataFlowCallOption extends DataFlowCallOption {
+  Location getLocation() {
+    this = TDataFlowCallNone() and
+    result instanceof EmptyLocation
+    or
+    exists(DataFlowCall call |
+      this = TDataFlowCallSome(call) and
+      result = call.getLocation()
+    )
+  }
+}
+
+private class LocatableDataFlowCall extends TDataFlowCall {
+  string toString() { result = this.(DataFlowCall).toString() }
 
   Location getLocation() {
     exists(Location l |
-      l = this.(DataFlow::Node).getLocation() and
+      l = this.(DataFlowCall).getLocation() and
       if l instanceof SourceLocation then result = l else result instanceof EmptyLocation
     )
   }
 }
 
-query predicate summaryDelegateCall(NodeAdjusted sink, Callable c, CallContext::CallContext cc) {
-  c = sink.(SummaryDelegateParameterSink).getARuntimeTarget(cc)
-}
-
-query predicate delegateCall(DelegateCall dc, Callable c, CallContext::CallContext cc) {
-  c = dc.getARuntimeTarget(cc)
+query predicate viableLambda(
+  LocatableDataFlowCall call, LocatableDataFlowCallOption lastCall, DataFlowCallable target
+) {
+  target = viableCallableLambda(call, lastCall)
 }
diff --git a/csharp/ql/test/library-tests/dataflow/fields/FieldFlow.expected b/csharp/ql/test/library-tests/dataflow/fields/FieldFlow.expected
index e776b086467..46dfd50b07a 100644
--- a/csharp/ql/test/library-tests/dataflow/fields/FieldFlow.expected
+++ b/csharp/ql/test/library-tests/dataflow/fields/FieldFlow.expected
@@ -1,542 +1,542 @@
 edges
 | A.cs:5:17:5:23 | object creation of type C : C | A.cs:6:24:6:24 | access to local variable c : C |
-| A.cs:6:17:6:25 | call to method Make [c] : C | A.cs:7:14:7:14 | access to local variable b [c] : C |
-| A.cs:6:24:6:24 | access to local variable c : C | A.cs:6:17:6:25 | call to method Make [c] : C |
-| A.cs:7:14:7:14 | access to local variable b [c] : C | A.cs:7:14:7:16 | access to field c |
-| A.cs:13:9:13:9 | [post] access to local variable b [c] : C1 | A.cs:14:14:14:14 | access to local variable b [c] : C1 |
-| A.cs:13:15:13:22 | object creation of type C1 : C1 | A.cs:13:9:13:9 | [post] access to local variable b [c] : C1 |
-| A.cs:14:14:14:14 | access to local variable b [c] : C1 | A.cs:14:14:14:20 | call to method Get |
-| A.cs:15:15:15:28 | object creation of type B [c] : C | A.cs:15:14:15:35 | call to method Get |
-| A.cs:15:21:15:27 | object creation of type C : C | A.cs:15:15:15:28 | object creation of type B [c] : C |
-| A.cs:22:14:22:33 | call to method SetOnB [c] : C2 | A.cs:24:14:24:15 | access to local variable b2 [c] : C2 |
-| A.cs:22:25:22:32 | object creation of type C2 : C2 | A.cs:22:14:22:33 | call to method SetOnB [c] : C2 |
-| A.cs:24:14:24:15 | access to local variable b2 [c] : C2 | A.cs:24:14:24:17 | access to field c |
-| A.cs:31:14:31:37 | call to method SetOnBWrap [c] : C2 | A.cs:33:14:33:15 | access to local variable b2 [c] : C2 |
-| A.cs:31:29:31:36 | object creation of type C2 : C2 | A.cs:31:14:31:37 | call to method SetOnBWrap [c] : C2 |
-| A.cs:33:14:33:15 | access to local variable b2 [c] : C2 | A.cs:33:14:33:17 | access to field c |
+| A.cs:6:17:6:25 | call to method Make [field c] : C | A.cs:7:14:7:14 | access to local variable b [field c] : C |
+| A.cs:6:24:6:24 | access to local variable c : C | A.cs:6:17:6:25 | call to method Make [field c] : C |
+| A.cs:7:14:7:14 | access to local variable b [field c] : C | A.cs:7:14:7:16 | access to field c |
+| A.cs:13:9:13:9 | [post] access to local variable b [field c] : C1 | A.cs:14:14:14:14 | access to local variable b [field c] : C1 |
+| A.cs:13:15:13:22 | object creation of type C1 : C1 | A.cs:13:9:13:9 | [post] access to local variable b [field c] : C1 |
+| A.cs:14:14:14:14 | access to local variable b [field c] : C1 | A.cs:14:14:14:20 | call to method Get |
+| A.cs:15:15:15:28 | object creation of type B [field c] : C | A.cs:15:14:15:35 | call to method Get |
+| A.cs:15:21:15:27 | object creation of type C : C | A.cs:15:15:15:28 | object creation of type B [field c] : C |
+| A.cs:22:14:22:33 | call to method SetOnB [field c] : C2 | A.cs:24:14:24:15 | access to local variable b2 [field c] : C2 |
+| A.cs:22:25:22:32 | object creation of type C2 : C2 | A.cs:22:14:22:33 | call to method SetOnB [field c] : C2 |
+| A.cs:24:14:24:15 | access to local variable b2 [field c] : C2 | A.cs:24:14:24:17 | access to field c |
+| A.cs:31:14:31:37 | call to method SetOnBWrap [field c] : C2 | A.cs:33:14:33:15 | access to local variable b2 [field c] : C2 |
+| A.cs:31:29:31:36 | object creation of type C2 : C2 | A.cs:31:14:31:37 | call to method SetOnBWrap [field c] : C2 |
+| A.cs:33:14:33:15 | access to local variable b2 [field c] : C2 | A.cs:33:14:33:17 | access to field c |
 | A.cs:55:17:55:23 | object creation of type A : A | A.cs:57:16:57:16 | access to local variable a : A |
-| A.cs:57:9:57:10 | [post] access to local variable c1 [a] : A | A.cs:58:12:58:13 | access to local variable c1 [a] : A |
-| A.cs:57:16:57:16 | access to local variable a : A | A.cs:57:9:57:10 | [post] access to local variable c1 [a] : A |
-| A.cs:58:12:58:13 | access to local variable c1 [a] : A | A.cs:60:22:60:22 | c [a] : A |
-| A.cs:60:22:60:22 | c [a] : A | A.cs:64:19:64:23 | (...) ... [a] : A |
-| A.cs:64:19:64:23 | (...) ... [a] : A | A.cs:64:18:64:26 | access to field a |
-| A.cs:83:9:83:9 | [post] access to parameter b [c] : C | A.cs:88:12:88:12 | [post] access to local variable b [c] : C |
-| A.cs:83:15:83:21 | object creation of type C : C | A.cs:83:9:83:9 | [post] access to parameter b [c] : C |
-| A.cs:88:12:88:12 | [post] access to local variable b [c] : C | A.cs:89:14:89:14 | access to local variable b [c] : C |
-| A.cs:89:14:89:14 | access to local variable b [c] : C | A.cs:89:14:89:16 | access to field c |
-| A.cs:97:13:97:13 | [post] access to parameter b [c] : C | A.cs:98:22:98:36 | ... ? ... : ... [c] : C |
-| A.cs:97:13:97:13 | [post] access to parameter b [c] : C | A.cs:105:23:105:23 | [post] access to local variable b [c] : C |
-| A.cs:97:19:97:25 | object creation of type C : C | A.cs:97:13:97:13 | [post] access to parameter b [c] : C |
-| A.cs:98:13:98:16 | [post] this access [b, c] : C | A.cs:105:17:105:29 | object creation of type D [b, c] : C |
-| A.cs:98:13:98:16 | [post] this access [b] : B | A.cs:105:17:105:29 | object creation of type D [b] : B |
-| A.cs:98:22:98:36 | ... ? ... : ... : B | A.cs:98:13:98:16 | [post] this access [b] : B |
-| A.cs:98:22:98:36 | ... ? ... : ... [c] : C | A.cs:98:13:98:16 | [post] this access [b, c] : C |
+| A.cs:57:9:57:10 | [post] access to local variable c1 [field a] : A | A.cs:58:12:58:13 | access to local variable c1 [field a] : A |
+| A.cs:57:16:57:16 | access to local variable a : A | A.cs:57:9:57:10 | [post] access to local variable c1 [field a] : A |
+| A.cs:58:12:58:13 | access to local variable c1 [field a] : A | A.cs:60:22:60:22 | c [field a] : A |
+| A.cs:60:22:60:22 | c [field a] : A | A.cs:64:19:64:23 | (...) ... [field a] : A |
+| A.cs:64:19:64:23 | (...) ... [field a] : A | A.cs:64:18:64:26 | access to field a |
+| A.cs:83:9:83:9 | [post] access to parameter b [field c] : C | A.cs:88:12:88:12 | [post] access to local variable b [field c] : C |
+| A.cs:83:15:83:21 | object creation of type C : C | A.cs:83:9:83:9 | [post] access to parameter b [field c] : C |
+| A.cs:88:12:88:12 | [post] access to local variable b [field c] : C | A.cs:89:14:89:14 | access to local variable b [field c] : C |
+| A.cs:89:14:89:14 | access to local variable b [field c] : C | A.cs:89:14:89:16 | access to field c |
+| A.cs:97:13:97:13 | [post] access to parameter b [field c] : C | A.cs:98:22:98:36 | ... ? ... : ... [field c] : C |
+| A.cs:97:13:97:13 | [post] access to parameter b [field c] : C | A.cs:105:23:105:23 | [post] access to local variable b [field c] : C |
+| A.cs:97:19:97:25 | object creation of type C : C | A.cs:97:13:97:13 | [post] access to parameter b [field c] : C |
+| A.cs:98:13:98:16 | [post] this access [field b, field c] : C | A.cs:105:17:105:29 | object creation of type D [field b, field c] : C |
+| A.cs:98:13:98:16 | [post] this access [field b] : B | A.cs:105:17:105:29 | object creation of type D [field b] : B |
+| A.cs:98:22:98:36 | ... ? ... : ... : B | A.cs:98:13:98:16 | [post] this access [field b] : B |
+| A.cs:98:22:98:36 | ... ? ... : ... [field c] : C | A.cs:98:13:98:16 | [post] this access [field b, field c] : C |
 | A.cs:98:30:98:36 | object creation of type B : B | A.cs:98:22:98:36 | ... ? ... : ... : B |
 | A.cs:104:17:104:23 | object creation of type B : B | A.cs:105:23:105:23 | access to local variable b : B |
-| A.cs:105:17:105:29 | object creation of type D [b, c] : C | A.cs:107:14:107:14 | access to local variable d [b, c] : C |
-| A.cs:105:17:105:29 | object creation of type D [b] : B | A.cs:106:14:106:14 | access to local variable d [b] : B |
-| A.cs:105:23:105:23 | [post] access to local variable b [c] : C | A.cs:108:14:108:14 | access to local variable b [c] : C |
-| A.cs:105:23:105:23 | access to local variable b : B | A.cs:105:17:105:29 | object creation of type D [b] : B |
-| A.cs:106:14:106:14 | access to local variable d [b] : B | A.cs:106:14:106:16 | access to field b |
-| A.cs:107:14:107:14 | access to local variable d [b, c] : C | A.cs:107:14:107:16 | access to field b [c] : C |
-| A.cs:107:14:107:16 | access to field b [c] : C | A.cs:107:14:107:18 | access to field c |
-| A.cs:108:14:108:14 | access to local variable b [c] : C | A.cs:108:14:108:16 | access to field c |
+| A.cs:105:17:105:29 | object creation of type D [field b, field c] : C | A.cs:107:14:107:14 | access to local variable d [field b, field c] : C |
+| A.cs:105:17:105:29 | object creation of type D [field b] : B | A.cs:106:14:106:14 | access to local variable d [field b] : B |
+| A.cs:105:23:105:23 | [post] access to local variable b [field c] : C | A.cs:108:14:108:14 | access to local variable b [field c] : C |
+| A.cs:105:23:105:23 | access to local variable b : B | A.cs:105:17:105:29 | object creation of type D [field b] : B |
+| A.cs:106:14:106:14 | access to local variable d [field b] : B | A.cs:106:14:106:16 | access to field b |
+| A.cs:107:14:107:14 | access to local variable d [field b, field c] : C | A.cs:107:14:107:16 | access to field b [field c] : C |
+| A.cs:107:14:107:16 | access to field b [field c] : C | A.cs:107:14:107:18 | access to field c |
+| A.cs:108:14:108:14 | access to local variable b [field c] : C | A.cs:108:14:108:16 | access to field c |
 | A.cs:113:17:113:23 | object creation of type B : B | A.cs:114:29:114:29 | access to local variable b : B |
-| A.cs:114:18:114:54 | object creation of type MyList [head] : B | A.cs:115:35:115:36 | access to local variable l1 [head] : B |
-| A.cs:114:29:114:29 | access to local variable b : B | A.cs:114:18:114:54 | object creation of type MyList [head] : B |
-| A.cs:115:18:115:37 | object creation of type MyList [next, head] : B | A.cs:116:35:116:36 | access to local variable l2 [next, head] : B |
-| A.cs:115:35:115:36 | access to local variable l1 [head] : B | A.cs:115:18:115:37 | object creation of type MyList [next, head] : B |
-| A.cs:116:18:116:37 | object creation of type MyList [next, next, head] : B | A.cs:119:14:119:15 | access to local variable l3 [next, next, head] : B |
-| A.cs:116:18:116:37 | object creation of type MyList [next, next, head] : B | A.cs:121:41:121:41 | access to local variable l [next, next, head] : B |
-| A.cs:116:35:116:36 | access to local variable l2 [next, head] : B | A.cs:116:18:116:37 | object creation of type MyList [next, next, head] : B |
-| A.cs:119:14:119:15 | access to local variable l3 [next, next, head] : B | A.cs:119:14:119:20 | access to field next [next, head] : B |
-| A.cs:119:14:119:20 | access to field next [next, head] : B | A.cs:119:14:119:25 | access to field next [head] : B |
-| A.cs:119:14:119:25 | access to field next [head] : B | A.cs:119:14:119:30 | access to field head |
-| A.cs:121:41:121:41 | access to local variable l [next, head] : B | A.cs:121:41:121:46 | access to field next [head] : B |
-| A.cs:121:41:121:41 | access to local variable l [next, next, head] : B | A.cs:121:41:121:46 | access to field next [next, head] : B |
-| A.cs:121:41:121:46 | access to field next [head] : B | A.cs:123:18:123:18 | access to local variable l [head] : B |
-| A.cs:121:41:121:46 | access to field next [next, head] : B | A.cs:121:41:121:41 | access to local variable l [next, head] : B |
-| A.cs:123:18:123:18 | access to local variable l [head] : B | A.cs:123:18:123:23 | access to field head |
+| A.cs:114:18:114:54 | object creation of type MyList [field head] : B | A.cs:115:35:115:36 | access to local variable l1 [field head] : B |
+| A.cs:114:29:114:29 | access to local variable b : B | A.cs:114:18:114:54 | object creation of type MyList [field head] : B |
+| A.cs:115:18:115:37 | object creation of type MyList [field next, field head] : B | A.cs:116:35:116:36 | access to local variable l2 [field next, field head] : B |
+| A.cs:115:35:115:36 | access to local variable l1 [field head] : B | A.cs:115:18:115:37 | object creation of type MyList [field next, field head] : B |
+| A.cs:116:18:116:37 | object creation of type MyList [field next, field next, field head] : B | A.cs:119:14:119:15 | access to local variable l3 [field next, field next, field head] : B |
+| A.cs:116:18:116:37 | object creation of type MyList [field next, field next, field head] : B | A.cs:121:41:121:41 | access to local variable l [field next, field next, field head] : B |
+| A.cs:116:35:116:36 | access to local variable l2 [field next, field head] : B | A.cs:116:18:116:37 | object creation of type MyList [field next, field next, field head] : B |
+| A.cs:119:14:119:15 | access to local variable l3 [field next, field next, field head] : B | A.cs:119:14:119:20 | access to field next [field next, field head] : B |
+| A.cs:119:14:119:20 | access to field next [field next, field head] : B | A.cs:119:14:119:25 | access to field next [field head] : B |
+| A.cs:119:14:119:25 | access to field next [field head] : B | A.cs:119:14:119:30 | access to field head |
+| A.cs:121:41:121:41 | access to local variable l [field next, field head] : B | A.cs:121:41:121:46 | access to field next [field head] : B |
+| A.cs:121:41:121:41 | access to local variable l [field next, field next, field head] : B | A.cs:121:41:121:46 | access to field next [field next, field head] : B |
+| A.cs:121:41:121:46 | access to field next [field head] : B | A.cs:123:18:123:18 | access to local variable l [field head] : B |
+| A.cs:121:41:121:46 | access to field next [field next, field head] : B | A.cs:121:41:121:41 | access to local variable l [field next, field head] : B |
+| A.cs:123:18:123:18 | access to local variable l [field head] : B | A.cs:123:18:123:23 | access to field head |
 | B.cs:5:17:5:26 | object creation of type Elem : Elem | B.cs:6:27:6:27 | access to local variable e : Elem |
-| B.cs:6:18:6:34 | object creation of type Box1 [elem1] : Elem | B.cs:7:27:7:28 | access to local variable b1 [elem1] : Elem |
-| B.cs:6:27:6:27 | access to local variable e : Elem | B.cs:6:18:6:34 | object creation of type Box1 [elem1] : Elem |
-| B.cs:7:18:7:29 | object creation of type Box2 [box1, elem1] : Elem | B.cs:8:14:8:15 | access to local variable b2 [box1, elem1] : Elem |
-| B.cs:7:27:7:28 | access to local variable b1 [elem1] : Elem | B.cs:7:18:7:29 | object creation of type Box2 [box1, elem1] : Elem |
-| B.cs:8:14:8:15 | access to local variable b2 [box1, elem1] : Elem | B.cs:8:14:8:20 | access to field box1 [elem1] : Elem |
-| B.cs:8:14:8:20 | access to field box1 [elem1] : Elem | B.cs:8:14:8:26 | access to field elem1 |
+| B.cs:6:18:6:34 | object creation of type Box1 [field elem1] : Elem | B.cs:7:27:7:28 | access to local variable b1 [field elem1] : Elem |
+| B.cs:6:27:6:27 | access to local variable e : Elem | B.cs:6:18:6:34 | object creation of type Box1 [field elem1] : Elem |
+| B.cs:7:18:7:29 | object creation of type Box2 [field box1, field elem1] : Elem | B.cs:8:14:8:15 | access to local variable b2 [field box1, field elem1] : Elem |
+| B.cs:7:27:7:28 | access to local variable b1 [field elem1] : Elem | B.cs:7:18:7:29 | object creation of type Box2 [field box1, field elem1] : Elem |
+| B.cs:8:14:8:15 | access to local variable b2 [field box1, field elem1] : Elem | B.cs:8:14:8:20 | access to field box1 [field elem1] : Elem |
+| B.cs:8:14:8:20 | access to field box1 [field elem1] : Elem | B.cs:8:14:8:26 | access to field elem1 |
 | B.cs:14:17:14:26 | object creation of type Elem : Elem | B.cs:15:33:15:33 | access to local variable e : Elem |
-| B.cs:15:18:15:34 | object creation of type Box1 [elem2] : Elem | B.cs:16:27:16:28 | access to local variable b1 [elem2] : Elem |
-| B.cs:15:33:15:33 | access to local variable e : Elem | B.cs:15:18:15:34 | object creation of type Box1 [elem2] : Elem |
-| B.cs:16:18:16:29 | object creation of type Box2 [box1, elem2] : Elem | B.cs:18:14:18:15 | access to local variable b2 [box1, elem2] : Elem |
-| B.cs:16:27:16:28 | access to local variable b1 [elem2] : Elem | B.cs:16:18:16:29 | object creation of type Box2 [box1, elem2] : Elem |
-| B.cs:18:14:18:15 | access to local variable b2 [box1, elem2] : Elem | B.cs:18:14:18:20 | access to field box1 [elem2] : Elem |
-| B.cs:18:14:18:20 | access to field box1 [elem2] : Elem | B.cs:18:14:18:26 | access to field elem2 |
-| C.cs:3:18:3:19 | [post] this access [s1] : Elem | C.cs:12:15:12:21 | object creation of type C [s1] : Elem |
-| C.cs:3:23:3:32 | object creation of type Elem : Elem | C.cs:3:18:3:19 | [post] this access [s1] : Elem |
-| C.cs:4:27:4:28 | [post] this access [s2] : Elem | C.cs:12:15:12:21 | object creation of type C [s2] : Elem |
-| C.cs:4:32:4:41 | object creation of type Elem : Elem | C.cs:4:27:4:28 | [post] this access [s2] : Elem |
+| B.cs:15:18:15:34 | object creation of type Box1 [field elem2] : Elem | B.cs:16:27:16:28 | access to local variable b1 [field elem2] : Elem |
+| B.cs:15:33:15:33 | access to local variable e : Elem | B.cs:15:18:15:34 | object creation of type Box1 [field elem2] : Elem |
+| B.cs:16:18:16:29 | object creation of type Box2 [field box1, field elem2] : Elem | B.cs:18:14:18:15 | access to local variable b2 [field box1, field elem2] : Elem |
+| B.cs:16:27:16:28 | access to local variable b1 [field elem2] : Elem | B.cs:16:18:16:29 | object creation of type Box2 [field box1, field elem2] : Elem |
+| B.cs:18:14:18:15 | access to local variable b2 [field box1, field elem2] : Elem | B.cs:18:14:18:20 | access to field box1 [field elem2] : Elem |
+| B.cs:18:14:18:20 | access to field box1 [field elem2] : Elem | B.cs:18:14:18:26 | access to field elem2 |
+| C.cs:3:18:3:19 | [post] this access [field s1] : Elem | C.cs:12:15:12:21 | object creation of type C [field s1] : Elem |
+| C.cs:3:23:3:32 | object creation of type Elem : Elem | C.cs:3:18:3:19 | [post] this access [field s1] : Elem |
+| C.cs:4:27:4:28 | [post] this access [field s2] : Elem | C.cs:12:15:12:21 | object creation of type C [field s2] : Elem |
+| C.cs:4:32:4:41 | object creation of type Elem : Elem | C.cs:4:27:4:28 | [post] this access [field s2] : Elem |
 | C.cs:6:30:6:39 | object creation of type Elem : Elem | C.cs:26:14:26:15 | access to field s4 |
-| C.cs:7:18:7:19 | [post] this access [s5] : Elem | C.cs:12:15:12:21 | object creation of type C [s5] : Elem |
-| C.cs:7:37:7:46 | object creation of type Elem : Elem | C.cs:7:18:7:19 | [post] this access [s5] : Elem |
+| C.cs:7:18:7:19 | [post] this access [property s5] : Elem | C.cs:12:15:12:21 | object creation of type C [property s5] : Elem |
+| C.cs:7:37:7:46 | object creation of type Elem : Elem | C.cs:7:18:7:19 | [post] this access [property s5] : Elem |
 | C.cs:8:30:8:39 | object creation of type Elem : Elem | C.cs:28:14:28:15 | access to property s6 |
-| C.cs:12:15:12:21 | object creation of type C [s1] : Elem | C.cs:13:9:13:9 | access to local variable c [s1] : Elem |
-| C.cs:12:15:12:21 | object creation of type C [s2] : Elem | C.cs:13:9:13:9 | access to local variable c [s2] : Elem |
-| C.cs:12:15:12:21 | object creation of type C [s3] : Elem | C.cs:13:9:13:9 | access to local variable c [s3] : Elem |
-| C.cs:12:15:12:21 | object creation of type C [s5] : Elem | C.cs:13:9:13:9 | access to local variable c [s5] : Elem |
-| C.cs:13:9:13:9 | access to local variable c [s1] : Elem | C.cs:21:17:21:18 | this [s1] : Elem |
-| C.cs:13:9:13:9 | access to local variable c [s2] : Elem | C.cs:21:17:21:18 | this [s2] : Elem |
-| C.cs:13:9:13:9 | access to local variable c [s3] : Elem | C.cs:21:17:21:18 | this [s3] : Elem |
-| C.cs:13:9:13:9 | access to local variable c [s5] : Elem | C.cs:21:17:21:18 | this [s5] : Elem |
-| C.cs:18:9:18:12 | [post] this access [s3] : Elem | C.cs:12:15:12:21 | object creation of type C [s3] : Elem |
-| C.cs:18:19:18:28 | object creation of type Elem : Elem | C.cs:18:9:18:12 | [post] this access [s3] : Elem |
-| C.cs:21:17:21:18 | this [s1] : Elem | C.cs:23:14:23:15 | this access [s1] : Elem |
-| C.cs:21:17:21:18 | this [s2] : Elem | C.cs:24:14:24:15 | this access [s2] : Elem |
-| C.cs:21:17:21:18 | this [s3] : Elem | C.cs:25:14:25:15 | this access [s3] : Elem |
-| C.cs:21:17:21:18 | this [s5] : Elem | C.cs:27:14:27:15 | this access [s5] : Elem |
-| C.cs:23:14:23:15 | this access [s1] : Elem | C.cs:23:14:23:15 | access to field s1 |
-| C.cs:24:14:24:15 | this access [s2] : Elem | C.cs:24:14:24:15 | access to field s2 |
-| C.cs:25:14:25:15 | this access [s3] : Elem | C.cs:25:14:25:15 | access to field s3 |
-| C.cs:27:14:27:15 | this access [s5] : Elem | C.cs:27:14:27:15 | access to property s5 |
+| C.cs:12:15:12:21 | object creation of type C [field s1] : Elem | C.cs:13:9:13:9 | access to local variable c [field s1] : Elem |
+| C.cs:12:15:12:21 | object creation of type C [field s2] : Elem | C.cs:13:9:13:9 | access to local variable c [field s2] : Elem |
+| C.cs:12:15:12:21 | object creation of type C [field s3] : Elem | C.cs:13:9:13:9 | access to local variable c [field s3] : Elem |
+| C.cs:12:15:12:21 | object creation of type C [property s5] : Elem | C.cs:13:9:13:9 | access to local variable c [property s5] : Elem |
+| C.cs:13:9:13:9 | access to local variable c [field s1] : Elem | C.cs:21:17:21:18 | this [field s1] : Elem |
+| C.cs:13:9:13:9 | access to local variable c [field s2] : Elem | C.cs:21:17:21:18 | this [field s2] : Elem |
+| C.cs:13:9:13:9 | access to local variable c [field s3] : Elem | C.cs:21:17:21:18 | this [field s3] : Elem |
+| C.cs:13:9:13:9 | access to local variable c [property s5] : Elem | C.cs:21:17:21:18 | this [property s5] : Elem |
+| C.cs:18:9:18:12 | [post] this access [field s3] : Elem | C.cs:12:15:12:21 | object creation of type C [field s3] : Elem |
+| C.cs:18:19:18:28 | object creation of type Elem : Elem | C.cs:18:9:18:12 | [post] this access [field s3] : Elem |
+| C.cs:21:17:21:18 | this [field s1] : Elem | C.cs:23:14:23:15 | this access [field s1] : Elem |
+| C.cs:21:17:21:18 | this [field s2] : Elem | C.cs:24:14:24:15 | this access [field s2] : Elem |
+| C.cs:21:17:21:18 | this [field s3] : Elem | C.cs:25:14:25:15 | this access [field s3] : Elem |
+| C.cs:21:17:21:18 | this [property s5] : Elem | C.cs:27:14:27:15 | this access [property s5] : Elem |
+| C.cs:23:14:23:15 | this access [field s1] : Elem | C.cs:23:14:23:15 | access to field s1 |
+| C.cs:24:14:24:15 | this access [field s2] : Elem | C.cs:24:14:24:15 | access to field s2 |
+| C.cs:25:14:25:15 | this access [field s3] : Elem | C.cs:25:14:25:15 | access to field s3 |
+| C.cs:27:14:27:15 | this access [property s5] : Elem | C.cs:27:14:27:15 | access to property s5 |
 | D.cs:29:17:29:28 | object creation of type Object : Object | D.cs:31:24:31:24 | access to local variable o : Object |
 | D.cs:29:17:29:28 | object creation of type Object : Object | D.cs:37:26:37:26 | access to local variable o : Object |
 | D.cs:29:17:29:28 | object creation of type Object : Object | D.cs:43:32:43:32 | access to local variable o : Object |
-| D.cs:31:17:31:37 | call to method Create [AutoProp] : Object | D.cs:32:14:32:14 | access to local variable d [AutoProp] : Object |
-| D.cs:31:24:31:24 | access to local variable o : Object | D.cs:31:17:31:37 | call to method Create [AutoProp] : Object |
-| D.cs:32:14:32:14 | access to local variable d [AutoProp] : Object | D.cs:32:14:32:23 | access to property AutoProp |
-| D.cs:37:13:37:33 | call to method Create [trivialPropField] : Object | D.cs:39:14:39:14 | access to local variable d [trivialPropField] : Object |
-| D.cs:37:13:37:33 | call to method Create [trivialPropField] : Object | D.cs:40:14:40:14 | access to local variable d [trivialPropField] : Object |
-| D.cs:37:13:37:33 | call to method Create [trivialPropField] : Object | D.cs:41:14:41:14 | access to local variable d [trivialPropField] : Object |
-| D.cs:37:26:37:26 | access to local variable o : Object | D.cs:37:13:37:33 | call to method Create [trivialPropField] : Object |
-| D.cs:39:14:39:14 | access to local variable d [trivialPropField] : Object | D.cs:39:14:39:26 | access to property TrivialProp |
-| D.cs:40:14:40:14 | access to local variable d [trivialPropField] : Object | D.cs:40:14:40:31 | access to field trivialPropField |
-| D.cs:41:14:41:14 | access to local variable d [trivialPropField] : Object | D.cs:41:14:41:26 | access to property ComplexProp |
-| D.cs:43:13:43:33 | call to method Create [trivialPropField] : Object | D.cs:45:14:45:14 | access to local variable d [trivialPropField] : Object |
-| D.cs:43:13:43:33 | call to method Create [trivialPropField] : Object | D.cs:46:14:46:14 | access to local variable d [trivialPropField] : Object |
-| D.cs:43:13:43:33 | call to method Create [trivialPropField] : Object | D.cs:47:14:47:14 | access to local variable d [trivialPropField] : Object |
-| D.cs:43:32:43:32 | access to local variable o : Object | D.cs:43:13:43:33 | call to method Create [trivialPropField] : Object |
-| D.cs:45:14:45:14 | access to local variable d [trivialPropField] : Object | D.cs:45:14:45:26 | access to property TrivialProp |
-| D.cs:46:14:46:14 | access to local variable d [trivialPropField] : Object | D.cs:46:14:46:31 | access to field trivialPropField |
-| D.cs:47:14:47:14 | access to local variable d [trivialPropField] : Object | D.cs:47:14:47:26 | access to property ComplexProp |
+| D.cs:31:17:31:37 | call to method Create [property AutoProp] : Object | D.cs:32:14:32:14 | access to local variable d [property AutoProp] : Object |
+| D.cs:31:24:31:24 | access to local variable o : Object | D.cs:31:17:31:37 | call to method Create [property AutoProp] : Object |
+| D.cs:32:14:32:14 | access to local variable d [property AutoProp] : Object | D.cs:32:14:32:23 | access to property AutoProp |
+| D.cs:37:13:37:33 | call to method Create [field trivialPropField] : Object | D.cs:39:14:39:14 | access to local variable d [field trivialPropField] : Object |
+| D.cs:37:13:37:33 | call to method Create [field trivialPropField] : Object | D.cs:40:14:40:14 | access to local variable d [field trivialPropField] : Object |
+| D.cs:37:13:37:33 | call to method Create [field trivialPropField] : Object | D.cs:41:14:41:14 | access to local variable d [field trivialPropField] : Object |
+| D.cs:37:26:37:26 | access to local variable o : Object | D.cs:37:13:37:33 | call to method Create [field trivialPropField] : Object |
+| D.cs:39:14:39:14 | access to local variable d [field trivialPropField] : Object | D.cs:39:14:39:26 | access to property TrivialProp |
+| D.cs:40:14:40:14 | access to local variable d [field trivialPropField] : Object | D.cs:40:14:40:31 | access to field trivialPropField |
+| D.cs:41:14:41:14 | access to local variable d [field trivialPropField] : Object | D.cs:41:14:41:26 | access to property ComplexProp |
+| D.cs:43:13:43:33 | call to method Create [field trivialPropField] : Object | D.cs:45:14:45:14 | access to local variable d [field trivialPropField] : Object |
+| D.cs:43:13:43:33 | call to method Create [field trivialPropField] : Object | D.cs:46:14:46:14 | access to local variable d [field trivialPropField] : Object |
+| D.cs:43:13:43:33 | call to method Create [field trivialPropField] : Object | D.cs:47:14:47:14 | access to local variable d [field trivialPropField] : Object |
+| D.cs:43:32:43:32 | access to local variable o : Object | D.cs:43:13:43:33 | call to method Create [field trivialPropField] : Object |
+| D.cs:45:14:45:14 | access to local variable d [field trivialPropField] : Object | D.cs:45:14:45:26 | access to property TrivialProp |
+| D.cs:46:14:46:14 | access to local variable d [field trivialPropField] : Object | D.cs:46:14:46:31 | access to field trivialPropField |
+| D.cs:47:14:47:14 | access to local variable d [field trivialPropField] : Object | D.cs:47:14:47:26 | access to property ComplexProp |
 | E.cs:22:17:22:28 | object creation of type Object : Object | E.cs:23:25:23:25 | access to local variable o : Object |
-| E.cs:23:17:23:26 | call to method CreateS [Field] : Object | E.cs:24:14:24:14 | access to local variable s [Field] : Object |
-| E.cs:23:25:23:25 | access to local variable o : Object | E.cs:23:17:23:26 | call to method CreateS [Field] : Object |
-| E.cs:24:14:24:14 | access to local variable s [Field] : Object | E.cs:24:14:24:20 | access to field Field |
+| E.cs:23:17:23:26 | call to method CreateS [field Field] : Object | E.cs:24:14:24:14 | access to local variable s [field Field] : Object |
+| E.cs:23:25:23:25 | access to local variable o : Object | E.cs:23:17:23:26 | call to method CreateS [field Field] : Object |
+| E.cs:24:14:24:14 | access to local variable s [field Field] : Object | E.cs:24:14:24:20 | access to field Field |
 | F.cs:10:17:10:28 | object creation of type Object : Object | F.cs:11:24:11:24 | access to local variable o : Object |
 | F.cs:10:17:10:28 | object creation of type Object : Object | F.cs:15:26:15:26 | access to local variable o : Object |
 | F.cs:10:17:10:28 | object creation of type Object : Object | F.cs:19:32:19:32 | access to local variable o : Object |
 | F.cs:10:17:10:28 | object creation of type Object : Object | F.cs:23:32:23:32 | access to local variable o : Object |
-| F.cs:11:17:11:31 | call to method Create [Field1] : Object | F.cs:12:14:12:14 | access to local variable f [Field1] : Object |
-| F.cs:11:24:11:24 | access to local variable o : Object | F.cs:11:17:11:31 | call to method Create [Field1] : Object |
-| F.cs:12:14:12:14 | access to local variable f [Field1] : Object | F.cs:12:14:12:21 | access to field Field1 |
-| F.cs:15:13:15:27 | call to method Create [Field2] : Object | F.cs:17:14:17:14 | access to local variable f [Field2] : Object |
-| F.cs:15:26:15:26 | access to local variable o : Object | F.cs:15:13:15:27 | call to method Create [Field2] : Object |
-| F.cs:17:14:17:14 | access to local variable f [Field2] : Object | F.cs:17:14:17:21 | access to field Field2 |
-| F.cs:19:21:19:34 | { ..., ... } [Field1] : Object | F.cs:20:14:20:14 | access to local variable f [Field1] : Object |
-| F.cs:19:32:19:32 | access to local variable o : Object | F.cs:19:21:19:34 | { ..., ... } [Field1] : Object |
-| F.cs:20:14:20:14 | access to local variable f [Field1] : Object | F.cs:20:14:20:21 | access to field Field1 |
-| F.cs:23:21:23:34 | { ..., ... } [Field2] : Object | F.cs:25:14:25:14 | access to local variable f [Field2] : Object |
-| F.cs:23:32:23:32 | access to local variable o : Object | F.cs:23:21:23:34 | { ..., ... } [Field2] : Object |
-| F.cs:25:14:25:14 | access to local variable f [Field2] : Object | F.cs:25:14:25:21 | access to field Field2 |
+| F.cs:11:17:11:31 | call to method Create [field Field1] : Object | F.cs:12:14:12:14 | access to local variable f [field Field1] : Object |
+| F.cs:11:24:11:24 | access to local variable o : Object | F.cs:11:17:11:31 | call to method Create [field Field1] : Object |
+| F.cs:12:14:12:14 | access to local variable f [field Field1] : Object | F.cs:12:14:12:21 | access to field Field1 |
+| F.cs:15:13:15:27 | call to method Create [field Field2] : Object | F.cs:17:14:17:14 | access to local variable f [field Field2] : Object |
+| F.cs:15:26:15:26 | access to local variable o : Object | F.cs:15:13:15:27 | call to method Create [field Field2] : Object |
+| F.cs:17:14:17:14 | access to local variable f [field Field2] : Object | F.cs:17:14:17:21 | access to field Field2 |
+| F.cs:19:21:19:34 | { ..., ... } [field Field1] : Object | F.cs:20:14:20:14 | access to local variable f [field Field1] : Object |
+| F.cs:19:32:19:32 | access to local variable o : Object | F.cs:19:21:19:34 | { ..., ... } [field Field1] : Object |
+| F.cs:20:14:20:14 | access to local variable f [field Field1] : Object | F.cs:20:14:20:21 | access to field Field1 |
+| F.cs:23:21:23:34 | { ..., ... } [field Field2] : Object | F.cs:25:14:25:14 | access to local variable f [field Field2] : Object |
+| F.cs:23:32:23:32 | access to local variable o : Object | F.cs:23:21:23:34 | { ..., ... } [field Field2] : Object |
+| F.cs:25:14:25:14 | access to local variable f [field Field2] : Object | F.cs:25:14:25:21 | access to field Field2 |
 | G.cs:7:18:7:27 | object creation of type Elem : Elem | G.cs:9:23:9:23 | access to local variable e : Elem |
-| G.cs:9:9:9:9 | [post] access to local variable b [Box1, Elem] : Elem | G.cs:10:18:10:18 | access to local variable b [Box1, Elem] : Elem |
-| G.cs:9:9:9:14 | [post] access to field Box1 [Elem] : Elem | G.cs:9:9:9:9 | [post] access to local variable b [Box1, Elem] : Elem |
-| G.cs:9:23:9:23 | access to local variable e : Elem | G.cs:9:9:9:14 | [post] access to field Box1 [Elem] : Elem |
-| G.cs:10:18:10:18 | access to local variable b [Box1, Elem] : Elem | G.cs:37:38:37:39 | b2 [Box1, Elem] : Elem |
+| G.cs:9:9:9:9 | [post] access to local variable b [field Box1, field Elem] : Elem | G.cs:10:18:10:18 | access to local variable b [field Box1, field Elem] : Elem |
+| G.cs:9:9:9:14 | [post] access to field Box1 [field Elem] : Elem | G.cs:9:9:9:9 | [post] access to local variable b [field Box1, field Elem] : Elem |
+| G.cs:9:23:9:23 | access to local variable e : Elem | G.cs:9:9:9:14 | [post] access to field Box1 [field Elem] : Elem |
+| G.cs:10:18:10:18 | access to local variable b [field Box1, field Elem] : Elem | G.cs:37:38:37:39 | b2 [field Box1, field Elem] : Elem |
 | G.cs:15:18:15:27 | object creation of type Elem : Elem | G.cs:17:24:17:24 | access to local variable e : Elem |
-| G.cs:17:9:17:9 | [post] access to local variable b [Box1, Elem] : Elem | G.cs:18:18:18:18 | access to local variable b [Box1, Elem] : Elem |
-| G.cs:17:9:17:14 | [post] access to field Box1 [Elem] : Elem | G.cs:17:9:17:9 | [post] access to local variable b [Box1, Elem] : Elem |
-| G.cs:17:24:17:24 | access to local variable e : Elem | G.cs:17:9:17:14 | [post] access to field Box1 [Elem] : Elem |
-| G.cs:18:18:18:18 | access to local variable b [Box1, Elem] : Elem | G.cs:37:38:37:39 | b2 [Box1, Elem] : Elem |
+| G.cs:17:9:17:9 | [post] access to local variable b [field Box1, field Elem] : Elem | G.cs:18:18:18:18 | access to local variable b [field Box1, field Elem] : Elem |
+| G.cs:17:9:17:14 | [post] access to field Box1 [field Elem] : Elem | G.cs:17:9:17:9 | [post] access to local variable b [field Box1, field Elem] : Elem |
+| G.cs:17:24:17:24 | access to local variable e : Elem | G.cs:17:9:17:14 | [post] access to field Box1 [field Elem] : Elem |
+| G.cs:18:18:18:18 | access to local variable b [field Box1, field Elem] : Elem | G.cs:37:38:37:39 | b2 [field Box1, field Elem] : Elem |
 | G.cs:23:18:23:27 | object creation of type Elem : Elem | G.cs:25:28:25:28 | access to local variable e : Elem |
-| G.cs:25:9:25:9 | [post] access to local variable b [Box1, Elem] : Elem | G.cs:26:18:26:18 | access to local variable b [Box1, Elem] : Elem |
-| G.cs:25:9:25:19 | [post] call to method GetBox1 [Elem] : Elem | G.cs:25:9:25:9 | [post] access to local variable b [Box1, Elem] : Elem |
-| G.cs:25:28:25:28 | access to local variable e : Elem | G.cs:25:9:25:19 | [post] call to method GetBox1 [Elem] : Elem |
-| G.cs:26:18:26:18 | access to local variable b [Box1, Elem] : Elem | G.cs:37:38:37:39 | b2 [Box1, Elem] : Elem |
+| G.cs:25:9:25:9 | [post] access to local variable b [field Box1, field Elem] : Elem | G.cs:26:18:26:18 | access to local variable b [field Box1, field Elem] : Elem |
+| G.cs:25:9:25:19 | [post] call to method GetBox1 [field Elem] : Elem | G.cs:25:9:25:9 | [post] access to local variable b [field Box1, field Elem] : Elem |
+| G.cs:25:28:25:28 | access to local variable e : Elem | G.cs:25:9:25:19 | [post] call to method GetBox1 [field Elem] : Elem |
+| G.cs:26:18:26:18 | access to local variable b [field Box1, field Elem] : Elem | G.cs:37:38:37:39 | b2 [field Box1, field Elem] : Elem |
 | G.cs:31:18:31:27 | object creation of type Elem : Elem | G.cs:33:29:33:29 | access to local variable e : Elem |
-| G.cs:33:9:33:9 | [post] access to local variable b [Box1, Elem] : Elem | G.cs:34:18:34:18 | access to local variable b [Box1, Elem] : Elem |
-| G.cs:33:9:33:19 | [post] call to method GetBox1 [Elem] : Elem | G.cs:33:9:33:9 | [post] access to local variable b [Box1, Elem] : Elem |
-| G.cs:33:29:33:29 | access to local variable e : Elem | G.cs:33:9:33:19 | [post] call to method GetBox1 [Elem] : Elem |
-| G.cs:34:18:34:18 | access to local variable b [Box1, Elem] : Elem | G.cs:37:38:37:39 | b2 [Box1, Elem] : Elem |
-| G.cs:37:38:37:39 | b2 [Box1, Elem] : Elem | G.cs:39:14:39:15 | access to parameter b2 [Box1, Elem] : Elem |
-| G.cs:39:14:39:15 | access to parameter b2 [Box1, Elem] : Elem | G.cs:39:14:39:25 | call to method GetBox1 [Elem] : Elem |
-| G.cs:39:14:39:25 | call to method GetBox1 [Elem] : Elem | G.cs:39:14:39:35 | call to method GetElem |
+| G.cs:33:9:33:9 | [post] access to local variable b [field Box1, field Elem] : Elem | G.cs:34:18:34:18 | access to local variable b [field Box1, field Elem] : Elem |
+| G.cs:33:9:33:19 | [post] call to method GetBox1 [field Elem] : Elem | G.cs:33:9:33:9 | [post] access to local variable b [field Box1, field Elem] : Elem |
+| G.cs:33:29:33:29 | access to local variable e : Elem | G.cs:33:9:33:19 | [post] call to method GetBox1 [field Elem] : Elem |
+| G.cs:34:18:34:18 | access to local variable b [field Box1, field Elem] : Elem | G.cs:37:38:37:39 | b2 [field Box1, field Elem] : Elem |
+| G.cs:37:38:37:39 | b2 [field Box1, field Elem] : Elem | G.cs:39:14:39:15 | access to parameter b2 [field Box1, field Elem] : Elem |
+| G.cs:39:14:39:15 | access to parameter b2 [field Box1, field Elem] : Elem | G.cs:39:14:39:25 | call to method GetBox1 [field Elem] : Elem |
+| G.cs:39:14:39:25 | call to method GetBox1 [field Elem] : Elem | G.cs:39:14:39:35 | call to method GetElem |
 | G.cs:44:18:44:27 | object creation of type Elem : Elem | G.cs:46:30:46:30 | access to local variable e : Elem |
-| G.cs:46:9:46:16 | [post] access to field boxfield [Box1, Elem] : Elem | G.cs:46:9:46:16 | [post] this access [boxfield, Box1, Elem] : Elem |
-| G.cs:46:9:46:16 | [post] this access [boxfield, Box1, Elem] : Elem | G.cs:47:9:47:13 | this access [boxfield, Box1, Elem] : Elem |
-| G.cs:46:9:46:21 | [post] access to field Box1 [Elem] : Elem | G.cs:46:9:46:16 | [post] access to field boxfield [Box1, Elem] : Elem |
-| G.cs:46:30:46:30 | access to local variable e : Elem | G.cs:46:9:46:21 | [post] access to field Box1 [Elem] : Elem |
-| G.cs:47:9:47:13 | this access [boxfield, Box1, Elem] : Elem | G.cs:50:18:50:20 | this [boxfield, Box1, Elem] : Elem |
-| G.cs:50:18:50:20 | this [boxfield, Box1, Elem] : Elem | G.cs:52:14:52:21 | this access [boxfield, Box1, Elem] : Elem |
-| G.cs:52:14:52:21 | access to field boxfield [Box1, Elem] : Elem | G.cs:52:14:52:26 | access to field Box1 [Elem] : Elem |
-| G.cs:52:14:52:21 | this access [boxfield, Box1, Elem] : Elem | G.cs:52:14:52:21 | access to field boxfield [Box1, Elem] : Elem |
-| G.cs:52:14:52:26 | access to field Box1 [Elem] : Elem | G.cs:52:14:52:31 | access to field Elem |
-| H.cs:23:9:23:9 | [post] access to local variable a [FieldA] : Object | H.cs:24:27:24:27 | access to local variable a [FieldA] : Object |
-| H.cs:23:20:23:31 | object creation of type Object : Object | H.cs:23:9:23:9 | [post] access to local variable a [FieldA] : Object |
-| H.cs:24:21:24:28 | call to method Clone [FieldA] : Object | H.cs:25:14:25:18 | access to local variable clone [FieldA] : Object |
-| H.cs:24:27:24:27 | access to local variable a [FieldA] : Object | H.cs:24:21:24:28 | call to method Clone [FieldA] : Object |
-| H.cs:25:14:25:18 | access to local variable clone [FieldA] : Object | H.cs:25:14:25:25 | access to field FieldA |
-| H.cs:43:9:43:9 | [post] access to local variable a [FieldA] : Object | H.cs:44:27:44:27 | access to local variable a [FieldA] : Object |
-| H.cs:43:20:43:31 | object creation of type Object : Object | H.cs:43:9:43:9 | [post] access to local variable a [FieldA] : Object |
-| H.cs:44:17:44:28 | call to method Transform [FieldB] : Object | H.cs:45:14:45:14 | access to local variable b [FieldB] : Object |
-| H.cs:44:27:44:27 | access to local variable a [FieldA] : Object | H.cs:44:17:44:28 | call to method Transform [FieldB] : Object |
-| H.cs:45:14:45:14 | access to local variable b [FieldB] : Object | H.cs:45:14:45:21 | access to field FieldB |
-| H.cs:63:9:63:9 | [post] access to local variable a [FieldA] : Object | H.cs:64:22:64:22 | access to local variable a [FieldA] : Object |
-| H.cs:63:20:63:31 | object creation of type Object : Object | H.cs:63:9:63:9 | [post] access to local variable a [FieldA] : Object |
-| H.cs:64:22:64:22 | access to local variable a [FieldA] : Object | H.cs:64:25:64:26 | [post] access to local variable b1 [FieldB] : Object |
-| H.cs:64:25:64:26 | [post] access to local variable b1 [FieldB] : Object | H.cs:65:14:65:15 | access to local variable b1 [FieldB] : Object |
-| H.cs:65:14:65:15 | access to local variable b1 [FieldB] : Object | H.cs:65:14:65:22 | access to field FieldB |
-| H.cs:88:17:88:17 | [post] access to local variable a [FieldA] : Object | H.cs:89:14:89:14 | access to local variable a [FieldA] : Object |
-| H.cs:88:20:88:31 | object creation of type Object : Object | H.cs:88:17:88:17 | [post] access to local variable a [FieldA] : Object |
-| H.cs:88:20:88:31 | object creation of type Object : Object | H.cs:88:34:88:35 | [post] access to local variable b1 [FieldB] : Object |
-| H.cs:88:34:88:35 | [post] access to local variable b1 [FieldB] : Object | H.cs:90:14:90:15 | access to local variable b1 [FieldB] : Object |
-| H.cs:89:14:89:14 | access to local variable a [FieldA] : Object | H.cs:89:14:89:21 | access to field FieldA |
-| H.cs:90:14:90:15 | access to local variable b1 [FieldB] : Object | H.cs:90:14:90:22 | access to field FieldB |
-| H.cs:112:9:112:9 | [post] access to local variable a [FieldA] : Object | H.cs:113:31:113:31 | access to local variable a [FieldA] : Object |
-| H.cs:112:20:112:31 | object creation of type Object : Object | H.cs:112:9:112:9 | [post] access to local variable a [FieldA] : Object |
-| H.cs:113:17:113:32 | call to method TransformWrap [FieldB] : Object | H.cs:114:14:114:14 | access to local variable b [FieldB] : Object |
-| H.cs:113:31:113:31 | access to local variable a [FieldA] : Object | H.cs:113:17:113:32 | call to method TransformWrap [FieldB] : Object |
-| H.cs:114:14:114:14 | access to local variable b [FieldB] : Object | H.cs:114:14:114:21 | access to field FieldB |
-| H.cs:130:9:130:9 | [post] access to local variable a [FieldA] : Object | H.cs:131:18:131:18 | access to local variable a [FieldA] : Object |
-| H.cs:130:20:130:31 | object creation of type Object : Object | H.cs:130:9:130:9 | [post] access to local variable a [FieldA] : Object |
-| H.cs:131:18:131:18 | access to local variable a [FieldA] : Object | H.cs:131:14:131:19 | call to method Get |
+| G.cs:46:9:46:16 | [post] access to field boxfield [field Box1, field Elem] : Elem | G.cs:46:9:46:16 | [post] this access [field boxfield, field Box1, field Elem] : Elem |
+| G.cs:46:9:46:16 | [post] this access [field boxfield, field Box1, field Elem] : Elem | G.cs:47:9:47:13 | this access [field boxfield, field Box1, field Elem] : Elem |
+| G.cs:46:9:46:21 | [post] access to field Box1 [field Elem] : Elem | G.cs:46:9:46:16 | [post] access to field boxfield [field Box1, field Elem] : Elem |
+| G.cs:46:30:46:30 | access to local variable e : Elem | G.cs:46:9:46:21 | [post] access to field Box1 [field Elem] : Elem |
+| G.cs:47:9:47:13 | this access [field boxfield, field Box1, field Elem] : Elem | G.cs:50:18:50:20 | this [field boxfield, field Box1, field Elem] : Elem |
+| G.cs:50:18:50:20 | this [field boxfield, field Box1, field Elem] : Elem | G.cs:52:14:52:21 | this access [field boxfield, field Box1, field Elem] : Elem |
+| G.cs:52:14:52:21 | access to field boxfield [field Box1, field Elem] : Elem | G.cs:52:14:52:26 | access to field Box1 [field Elem] : Elem |
+| G.cs:52:14:52:21 | this access [field boxfield, field Box1, field Elem] : Elem | G.cs:52:14:52:21 | access to field boxfield [field Box1, field Elem] : Elem |
+| G.cs:52:14:52:26 | access to field Box1 [field Elem] : Elem | G.cs:52:14:52:31 | access to field Elem |
+| H.cs:23:9:23:9 | [post] access to local variable a [field FieldA] : Object | H.cs:24:27:24:27 | access to local variable a [field FieldA] : Object |
+| H.cs:23:20:23:31 | object creation of type Object : Object | H.cs:23:9:23:9 | [post] access to local variable a [field FieldA] : Object |
+| H.cs:24:21:24:28 | call to method Clone [field FieldA] : Object | H.cs:25:14:25:18 | access to local variable clone [field FieldA] : Object |
+| H.cs:24:27:24:27 | access to local variable a [field FieldA] : Object | H.cs:24:21:24:28 | call to method Clone [field FieldA] : Object |
+| H.cs:25:14:25:18 | access to local variable clone [field FieldA] : Object | H.cs:25:14:25:25 | access to field FieldA |
+| H.cs:43:9:43:9 | [post] access to local variable a [field FieldA] : Object | H.cs:44:27:44:27 | access to local variable a [field FieldA] : Object |
+| H.cs:43:20:43:31 | object creation of type Object : Object | H.cs:43:9:43:9 | [post] access to local variable a [field FieldA] : Object |
+| H.cs:44:17:44:28 | call to method Transform [field FieldB] : Object | H.cs:45:14:45:14 | access to local variable b [field FieldB] : Object |
+| H.cs:44:27:44:27 | access to local variable a [field FieldA] : Object | H.cs:44:17:44:28 | call to method Transform [field FieldB] : Object |
+| H.cs:45:14:45:14 | access to local variable b [field FieldB] : Object | H.cs:45:14:45:21 | access to field FieldB |
+| H.cs:63:9:63:9 | [post] access to local variable a [field FieldA] : Object | H.cs:64:22:64:22 | access to local variable a [field FieldA] : Object |
+| H.cs:63:20:63:31 | object creation of type Object : Object | H.cs:63:9:63:9 | [post] access to local variable a [field FieldA] : Object |
+| H.cs:64:22:64:22 | access to local variable a [field FieldA] : Object | H.cs:64:25:64:26 | [post] access to local variable b1 [field FieldB] : Object |
+| H.cs:64:25:64:26 | [post] access to local variable b1 [field FieldB] : Object | H.cs:65:14:65:15 | access to local variable b1 [field FieldB] : Object |
+| H.cs:65:14:65:15 | access to local variable b1 [field FieldB] : Object | H.cs:65:14:65:22 | access to field FieldB |
+| H.cs:88:17:88:17 | [post] access to local variable a [field FieldA] : Object | H.cs:89:14:89:14 | access to local variable a [field FieldA] : Object |
+| H.cs:88:20:88:31 | object creation of type Object : Object | H.cs:88:17:88:17 | [post] access to local variable a [field FieldA] : Object |
+| H.cs:88:20:88:31 | object creation of type Object : Object | H.cs:88:34:88:35 | [post] access to local variable b1 [field FieldB] : Object |
+| H.cs:88:34:88:35 | [post] access to local variable b1 [field FieldB] : Object | H.cs:90:14:90:15 | access to local variable b1 [field FieldB] : Object |
+| H.cs:89:14:89:14 | access to local variable a [field FieldA] : Object | H.cs:89:14:89:21 | access to field FieldA |
+| H.cs:90:14:90:15 | access to local variable b1 [field FieldB] : Object | H.cs:90:14:90:22 | access to field FieldB |
+| H.cs:112:9:112:9 | [post] access to local variable a [field FieldA] : Object | H.cs:113:31:113:31 | access to local variable a [field FieldA] : Object |
+| H.cs:112:20:112:31 | object creation of type Object : Object | H.cs:112:9:112:9 | [post] access to local variable a [field FieldA] : Object |
+| H.cs:113:17:113:32 | call to method TransformWrap [field FieldB] : Object | H.cs:114:14:114:14 | access to local variable b [field FieldB] : Object |
+| H.cs:113:31:113:31 | access to local variable a [field FieldA] : Object | H.cs:113:17:113:32 | call to method TransformWrap [field FieldB] : Object |
+| H.cs:114:14:114:14 | access to local variable b [field FieldB] : Object | H.cs:114:14:114:21 | access to field FieldB |
+| H.cs:130:9:130:9 | [post] access to local variable a [field FieldA] : Object | H.cs:131:18:131:18 | access to local variable a [field FieldA] : Object |
+| H.cs:130:20:130:31 | object creation of type Object : Object | H.cs:130:9:130:9 | [post] access to local variable a [field FieldA] : Object |
+| H.cs:131:18:131:18 | access to local variable a [field FieldA] : Object | H.cs:131:14:131:19 | call to method Get |
 | H.cs:147:17:147:32 | call to method Through : A | H.cs:148:14:148:14 | access to local variable a |
 | H.cs:147:25:147:31 | object creation of type A : A | H.cs:147:17:147:32 | call to method Through : A |
 | H.cs:155:17:155:23 | object creation of type B : B | H.cs:156:9:156:9 | access to local variable b : B |
 | H.cs:156:9:156:9 | access to local variable b : B | H.cs:157:20:157:20 | access to local variable b : B |
-| H.cs:157:9:157:9 | [post] access to parameter a [FieldA] : B | H.cs:164:19:164:19 | [post] access to local variable a [FieldA] : B |
-| H.cs:157:20:157:20 | access to local variable b : B | H.cs:157:9:157:9 | [post] access to parameter a [FieldA] : B |
+| H.cs:157:9:157:9 | [post] access to parameter a [field FieldA] : B | H.cs:164:19:164:19 | [post] access to local variable a [field FieldA] : B |
+| H.cs:157:20:157:20 | access to local variable b : B | H.cs:157:9:157:9 | [post] access to parameter a [field FieldA] : B |
 | H.cs:163:17:163:28 | object creation of type Object : Object | H.cs:164:22:164:22 | access to local variable o : Object |
-| H.cs:164:19:164:19 | [post] access to local variable a [FieldA, FieldB] : Object | H.cs:165:21:165:21 | access to local variable a [FieldA, FieldB] : Object |
-| H.cs:164:19:164:19 | [post] access to local variable a [FieldA] : B | H.cs:165:21:165:21 | access to local variable a [FieldA] : B |
-| H.cs:164:22:164:22 | access to local variable o : Object | H.cs:164:19:164:19 | [post] access to local variable a [FieldA, FieldB] : Object |
+| H.cs:164:19:164:19 | [post] access to local variable a [field FieldA, field FieldB] : Object | H.cs:165:21:165:21 | access to local variable a [field FieldA, field FieldB] : Object |
+| H.cs:164:19:164:19 | [post] access to local variable a [field FieldA] : B | H.cs:165:21:165:21 | access to local variable a [field FieldA] : B |
+| H.cs:164:22:164:22 | access to local variable o : Object | H.cs:164:19:164:19 | [post] access to local variable a [field FieldA, field FieldB] : Object |
 | H.cs:165:17:165:28 | (...) ... : B | H.cs:166:14:166:14 | access to local variable b |
-| H.cs:165:17:165:28 | (...) ... [FieldB] : Object | H.cs:167:14:167:14 | access to local variable b [FieldB] : Object |
-| H.cs:165:21:165:21 | access to local variable a [FieldA, FieldB] : Object | H.cs:165:21:165:28 | access to field FieldA [FieldB] : Object |
-| H.cs:165:21:165:21 | access to local variable a [FieldA] : B | H.cs:165:21:165:28 | access to field FieldA : B |
+| H.cs:165:17:165:28 | (...) ... [field FieldB] : Object | H.cs:167:14:167:14 | access to local variable b [field FieldB] : Object |
+| H.cs:165:21:165:21 | access to local variable a [field FieldA, field FieldB] : Object | H.cs:165:21:165:28 | access to field FieldA [field FieldB] : Object |
+| H.cs:165:21:165:21 | access to local variable a [field FieldA] : B | H.cs:165:21:165:28 | access to field FieldA : B |
 | H.cs:165:21:165:28 | access to field FieldA : B | H.cs:165:17:165:28 | (...) ... : B |
-| H.cs:165:21:165:28 | access to field FieldA [FieldB] : Object | H.cs:165:17:165:28 | (...) ... [FieldB] : Object |
-| H.cs:167:14:167:14 | access to local variable b [FieldB] : Object | H.cs:167:14:167:21 | access to field FieldB |
-| I.cs:7:9:7:14 | [post] this access [Field1] : Object | I.cs:21:13:21:19 | object creation of type I [Field1] : Object |
-| I.cs:7:9:7:14 | [post] this access [Field1] : Object | I.cs:26:13:26:37 | [pre-initializer] object creation of type I [Field1] : Object |
-| I.cs:7:18:7:29 | object creation of type Object : Object | I.cs:7:9:7:14 | [post] this access [Field1] : Object |
+| H.cs:165:21:165:28 | access to field FieldA [field FieldB] : Object | H.cs:165:17:165:28 | (...) ... [field FieldB] : Object |
+| H.cs:167:14:167:14 | access to local variable b [field FieldB] : Object | H.cs:167:14:167:21 | access to field FieldB |
+| I.cs:7:9:7:14 | [post] this access [field Field1] : Object | I.cs:21:13:21:19 | object creation of type I [field Field1] : Object |
+| I.cs:7:9:7:14 | [post] this access [field Field1] : Object | I.cs:26:13:26:37 | [pre-initializer] object creation of type I [field Field1] : Object |
+| I.cs:7:18:7:29 | object creation of type Object : Object | I.cs:7:9:7:14 | [post] this access [field Field1] : Object |
 | I.cs:13:17:13:28 | object creation of type Object : Object | I.cs:15:20:15:20 | access to local variable o : Object |
-| I.cs:15:9:15:9 | [post] access to local variable i [Field1] : Object | I.cs:16:9:16:9 | access to local variable i [Field1] : Object |
-| I.cs:15:20:15:20 | access to local variable o : Object | I.cs:15:9:15:9 | [post] access to local variable i [Field1] : Object |
-| I.cs:16:9:16:9 | access to local variable i [Field1] : Object | I.cs:17:9:17:9 | access to local variable i [Field1] : Object |
-| I.cs:17:9:17:9 | access to local variable i [Field1] : Object | I.cs:18:14:18:14 | access to local variable i [Field1] : Object |
-| I.cs:18:14:18:14 | access to local variable i [Field1] : Object | I.cs:18:14:18:21 | access to field Field1 |
-| I.cs:21:13:21:19 | object creation of type I [Field1] : Object | I.cs:22:9:22:9 | access to local variable i [Field1] : Object |
-| I.cs:22:9:22:9 | access to local variable i [Field1] : Object | I.cs:23:14:23:14 | access to local variable i [Field1] : Object |
-| I.cs:23:14:23:14 | access to local variable i [Field1] : Object | I.cs:23:14:23:21 | access to field Field1 |
-| I.cs:26:13:26:37 | [pre-initializer] object creation of type I [Field1] : Object | I.cs:27:14:27:14 | access to local variable i [Field1] : Object |
-| I.cs:27:14:27:14 | access to local variable i [Field1] : Object | I.cs:27:14:27:21 | access to field Field1 |
+| I.cs:15:9:15:9 | [post] access to local variable i [field Field1] : Object | I.cs:16:9:16:9 | access to local variable i [field Field1] : Object |
+| I.cs:15:20:15:20 | access to local variable o : Object | I.cs:15:9:15:9 | [post] access to local variable i [field Field1] : Object |
+| I.cs:16:9:16:9 | access to local variable i [field Field1] : Object | I.cs:17:9:17:9 | access to local variable i [field Field1] : Object |
+| I.cs:17:9:17:9 | access to local variable i [field Field1] : Object | I.cs:18:14:18:14 | access to local variable i [field Field1] : Object |
+| I.cs:18:14:18:14 | access to local variable i [field Field1] : Object | I.cs:18:14:18:21 | access to field Field1 |
+| I.cs:21:13:21:19 | object creation of type I [field Field1] : Object | I.cs:22:9:22:9 | access to local variable i [field Field1] : Object |
+| I.cs:22:9:22:9 | access to local variable i [field Field1] : Object | I.cs:23:14:23:14 | access to local variable i [field Field1] : Object |
+| I.cs:23:14:23:14 | access to local variable i [field Field1] : Object | I.cs:23:14:23:21 | access to field Field1 |
+| I.cs:26:13:26:37 | [pre-initializer] object creation of type I [field Field1] : Object | I.cs:27:14:27:14 | access to local variable i [field Field1] : Object |
+| I.cs:27:14:27:14 | access to local variable i [field Field1] : Object | I.cs:27:14:27:21 | access to field Field1 |
 | I.cs:31:13:31:24 | object creation of type Object : Object | I.cs:32:20:32:20 | access to local variable o : Object |
-| I.cs:32:9:32:9 | [post] access to local variable i [Field1] : Object | I.cs:33:9:33:9 | access to local variable i [Field1] : Object |
-| I.cs:32:20:32:20 | access to local variable o : Object | I.cs:32:9:32:9 | [post] access to local variable i [Field1] : Object |
-| I.cs:33:9:33:9 | access to local variable i [Field1] : Object | I.cs:34:12:34:12 | access to local variable i [Field1] : Object |
-| I.cs:34:12:34:12 | access to local variable i [Field1] : Object | I.cs:37:23:37:23 | i [Field1] : Object |
-| I.cs:37:23:37:23 | i [Field1] : Object | I.cs:39:9:39:9 | access to parameter i [Field1] : Object |
-| I.cs:39:9:39:9 | access to parameter i [Field1] : Object | I.cs:40:14:40:14 | access to parameter i [Field1] : Object |
-| I.cs:40:14:40:14 | access to parameter i [Field1] : Object | I.cs:40:14:40:21 | access to field Field1 |
+| I.cs:32:9:32:9 | [post] access to local variable i [field Field1] : Object | I.cs:33:9:33:9 | access to local variable i [field Field1] : Object |
+| I.cs:32:20:32:20 | access to local variable o : Object | I.cs:32:9:32:9 | [post] access to local variable i [field Field1] : Object |
+| I.cs:33:9:33:9 | access to local variable i [field Field1] : Object | I.cs:34:12:34:12 | access to local variable i [field Field1] : Object |
+| I.cs:34:12:34:12 | access to local variable i [field Field1] : Object | I.cs:37:23:37:23 | i [field Field1] : Object |
+| I.cs:37:23:37:23 | i [field Field1] : Object | I.cs:39:9:39:9 | access to parameter i [field Field1] : Object |
+| I.cs:39:9:39:9 | access to parameter i [field Field1] : Object | I.cs:40:14:40:14 | access to parameter i [field Field1] : Object |
+| I.cs:40:14:40:14 | access to parameter i [field Field1] : Object | I.cs:40:14:40:21 | access to field Field1 |
 | J.cs:12:17:12:28 | object creation of type Object : Object | J.cs:13:29:13:29 | access to local variable o : Object |
 | J.cs:12:17:12:28 | object creation of type Object : Object | J.cs:21:36:21:36 | access to local variable o : Object |
-| J.cs:13:18:13:36 | object creation of type Record [Prop1] : Object | J.cs:14:14:14:15 | access to local variable r1 [Prop1] : Object |
-| J.cs:13:18:13:36 | object creation of type Record [Prop1] : Object | J.cs:18:14:18:15 | access to local variable r2 [Prop1] : Object |
-| J.cs:13:18:13:36 | object creation of type Record [Prop1] : Object | J.cs:22:14:22:15 | access to local variable r3 [Prop1] : Object |
-| J.cs:13:29:13:29 | access to local variable o : Object | J.cs:13:18:13:36 | object creation of type Record [Prop1] : Object |
-| J.cs:14:14:14:15 | access to local variable r1 [Prop1] : Object | J.cs:14:14:14:21 | access to property Prop1 |
-| J.cs:18:14:18:15 | access to local variable r2 [Prop1] : Object | J.cs:18:14:18:21 | access to property Prop1 |
-| J.cs:21:18:21:38 | ... with { ... } [Prop2] : Object | J.cs:23:14:23:15 | access to local variable r3 [Prop2] : Object |
-| J.cs:21:36:21:36 | access to local variable o : Object | J.cs:21:18:21:38 | ... with { ... } [Prop2] : Object |
-| J.cs:22:14:22:15 | access to local variable r3 [Prop1] : Object | J.cs:22:14:22:21 | access to property Prop1 |
-| J.cs:23:14:23:15 | access to local variable r3 [Prop2] : Object | J.cs:23:14:23:21 | access to property Prop2 |
+| J.cs:13:18:13:36 | object creation of type Record [property Prop1] : Object | J.cs:14:14:14:15 | access to local variable r1 [property Prop1] : Object |
+| J.cs:13:18:13:36 | object creation of type Record [property Prop1] : Object | J.cs:18:14:18:15 | access to local variable r2 [property Prop1] : Object |
+| J.cs:13:18:13:36 | object creation of type Record [property Prop1] : Object | J.cs:22:14:22:15 | access to local variable r3 [property Prop1] : Object |
+| J.cs:13:29:13:29 | access to local variable o : Object | J.cs:13:18:13:36 | object creation of type Record [property Prop1] : Object |
+| J.cs:14:14:14:15 | access to local variable r1 [property Prop1] : Object | J.cs:14:14:14:21 | access to property Prop1 |
+| J.cs:18:14:18:15 | access to local variable r2 [property Prop1] : Object | J.cs:18:14:18:21 | access to property Prop1 |
+| J.cs:21:18:21:38 | ... with { ... } [property Prop2] : Object | J.cs:23:14:23:15 | access to local variable r3 [property Prop2] : Object |
+| J.cs:21:36:21:36 | access to local variable o : Object | J.cs:21:18:21:38 | ... with { ... } [property Prop2] : Object |
+| J.cs:22:14:22:15 | access to local variable r3 [property Prop1] : Object | J.cs:22:14:22:21 | access to property Prop1 |
+| J.cs:23:14:23:15 | access to local variable r3 [property Prop2] : Object | J.cs:23:14:23:21 | access to property Prop2 |
 nodes
 | A.cs:5:17:5:23 | object creation of type C : C | semmle.label | object creation of type C : C |
-| A.cs:6:17:6:25 | call to method Make [c] : C | semmle.label | call to method Make [c] : C |
+| A.cs:6:17:6:25 | call to method Make [field c] : C | semmle.label | call to method Make [field c] : C |
 | A.cs:6:24:6:24 | access to local variable c : C | semmle.label | access to local variable c : C |
-| A.cs:7:14:7:14 | access to local variable b [c] : C | semmle.label | access to local variable b [c] : C |
+| A.cs:7:14:7:14 | access to local variable b [field c] : C | semmle.label | access to local variable b [field c] : C |
 | A.cs:7:14:7:16 | access to field c | semmle.label | access to field c |
-| A.cs:13:9:13:9 | [post] access to local variable b [c] : C1 | semmle.label | [post] access to local variable b [c] : C1 |
+| A.cs:13:9:13:9 | [post] access to local variable b [field c] : C1 | semmle.label | [post] access to local variable b [field c] : C1 |
 | A.cs:13:15:13:22 | object creation of type C1 : C1 | semmle.label | object creation of type C1 : C1 |
-| A.cs:14:14:14:14 | access to local variable b [c] : C1 | semmle.label | access to local variable b [c] : C1 |
+| A.cs:14:14:14:14 | access to local variable b [field c] : C1 | semmle.label | access to local variable b [field c] : C1 |
 | A.cs:14:14:14:20 | call to method Get | semmle.label | call to method Get |
 | A.cs:15:14:15:35 | call to method Get | semmle.label | call to method Get |
-| A.cs:15:15:15:28 | object creation of type B [c] : C | semmle.label | object creation of type B [c] : C |
+| A.cs:15:15:15:28 | object creation of type B [field c] : C | semmle.label | object creation of type B [field c] : C |
 | A.cs:15:21:15:27 | object creation of type C : C | semmle.label | object creation of type C : C |
-| A.cs:22:14:22:33 | call to method SetOnB [c] : C2 | semmle.label | call to method SetOnB [c] : C2 |
+| A.cs:22:14:22:33 | call to method SetOnB [field c] : C2 | semmle.label | call to method SetOnB [field c] : C2 |
 | A.cs:22:25:22:32 | object creation of type C2 : C2 | semmle.label | object creation of type C2 : C2 |
-| A.cs:24:14:24:15 | access to local variable b2 [c] : C2 | semmle.label | access to local variable b2 [c] : C2 |
+| A.cs:24:14:24:15 | access to local variable b2 [field c] : C2 | semmle.label | access to local variable b2 [field c] : C2 |
 | A.cs:24:14:24:17 | access to field c | semmle.label | access to field c |
-| A.cs:31:14:31:37 | call to method SetOnBWrap [c] : C2 | semmle.label | call to method SetOnBWrap [c] : C2 |
+| A.cs:31:14:31:37 | call to method SetOnBWrap [field c] : C2 | semmle.label | call to method SetOnBWrap [field c] : C2 |
 | A.cs:31:29:31:36 | object creation of type C2 : C2 | semmle.label | object creation of type C2 : C2 |
-| A.cs:33:14:33:15 | access to local variable b2 [c] : C2 | semmle.label | access to local variable b2 [c] : C2 |
+| A.cs:33:14:33:15 | access to local variable b2 [field c] : C2 | semmle.label | access to local variable b2 [field c] : C2 |
 | A.cs:33:14:33:17 | access to field c | semmle.label | access to field c |
 | A.cs:55:17:55:23 | object creation of type A : A | semmle.label | object creation of type A : A |
-| A.cs:57:9:57:10 | [post] access to local variable c1 [a] : A | semmle.label | [post] access to local variable c1 [a] : A |
+| A.cs:57:9:57:10 | [post] access to local variable c1 [field a] : A | semmle.label | [post] access to local variable c1 [field a] : A |
 | A.cs:57:16:57:16 | access to local variable a : A | semmle.label | access to local variable a : A |
-| A.cs:58:12:58:13 | access to local variable c1 [a] : A | semmle.label | access to local variable c1 [a] : A |
-| A.cs:60:22:60:22 | c [a] : A | semmle.label | c [a] : A |
+| A.cs:58:12:58:13 | access to local variable c1 [field a] : A | semmle.label | access to local variable c1 [field a] : A |
+| A.cs:60:22:60:22 | c [field a] : A | semmle.label | c [field a] : A |
 | A.cs:64:18:64:26 | access to field a | semmle.label | access to field a |
-| A.cs:64:19:64:23 | (...) ... [a] : A | semmle.label | (...) ... [a] : A |
-| A.cs:83:9:83:9 | [post] access to parameter b [c] : C | semmle.label | [post] access to parameter b [c] : C |
+| A.cs:64:19:64:23 | (...) ... [field a] : A | semmle.label | (...) ... [field a] : A |
+| A.cs:83:9:83:9 | [post] access to parameter b [field c] : C | semmle.label | [post] access to parameter b [field c] : C |
 | A.cs:83:15:83:21 | object creation of type C : C | semmle.label | object creation of type C : C |
-| A.cs:88:12:88:12 | [post] access to local variable b [c] : C | semmle.label | [post] access to local variable b [c] : C |
-| A.cs:89:14:89:14 | access to local variable b [c] : C | semmle.label | access to local variable b [c] : C |
+| A.cs:88:12:88:12 | [post] access to local variable b [field c] : C | semmle.label | [post] access to local variable b [field c] : C |
+| A.cs:89:14:89:14 | access to local variable b [field c] : C | semmle.label | access to local variable b [field c] : C |
 | A.cs:89:14:89:16 | access to field c | semmle.label | access to field c |
-| A.cs:97:13:97:13 | [post] access to parameter b [c] : C | semmle.label | [post] access to parameter b [c] : C |
+| A.cs:97:13:97:13 | [post] access to parameter b [field c] : C | semmle.label | [post] access to parameter b [field c] : C |
 | A.cs:97:19:97:25 | object creation of type C : C | semmle.label | object creation of type C : C |
-| A.cs:98:13:98:16 | [post] this access [b, c] : C | semmle.label | [post] this access [b, c] : C |
-| A.cs:98:13:98:16 | [post] this access [b] : B | semmle.label | [post] this access [b] : B |
+| A.cs:98:13:98:16 | [post] this access [field b, field c] : C | semmle.label | [post] this access [field b, field c] : C |
+| A.cs:98:13:98:16 | [post] this access [field b] : B | semmle.label | [post] this access [field b] : B |
 | A.cs:98:22:98:36 | ... ? ... : ... : B | semmle.label | ... ? ... : ... : B |
-| A.cs:98:22:98:36 | ... ? ... : ... [c] : C | semmle.label | ... ? ... : ... [c] : C |
+| A.cs:98:22:98:36 | ... ? ... : ... [field c] : C | semmle.label | ... ? ... : ... [field c] : C |
 | A.cs:98:30:98:36 | object creation of type B : B | semmle.label | object creation of type B : B |
 | A.cs:104:17:104:23 | object creation of type B : B | semmle.label | object creation of type B : B |
-| A.cs:105:17:105:29 | object creation of type D [b, c] : C | semmle.label | object creation of type D [b, c] : C |
-| A.cs:105:17:105:29 | object creation of type D [b] : B | semmle.label | object creation of type D [b] : B |
-| A.cs:105:23:105:23 | [post] access to local variable b [c] : C | semmle.label | [post] access to local variable b [c] : C |
+| A.cs:105:17:105:29 | object creation of type D [field b, field c] : C | semmle.label | object creation of type D [field b, field c] : C |
+| A.cs:105:17:105:29 | object creation of type D [field b] : B | semmle.label | object creation of type D [field b] : B |
+| A.cs:105:23:105:23 | [post] access to local variable b [field c] : C | semmle.label | [post] access to local variable b [field c] : C |
 | A.cs:105:23:105:23 | access to local variable b : B | semmle.label | access to local variable b : B |
-| A.cs:106:14:106:14 | access to local variable d [b] : B | semmle.label | access to local variable d [b] : B |
+| A.cs:106:14:106:14 | access to local variable d [field b] : B | semmle.label | access to local variable d [field b] : B |
 | A.cs:106:14:106:16 | access to field b | semmle.label | access to field b |
-| A.cs:107:14:107:14 | access to local variable d [b, c] : C | semmle.label | access to local variable d [b, c] : C |
-| A.cs:107:14:107:16 | access to field b [c] : C | semmle.label | access to field b [c] : C |
+| A.cs:107:14:107:14 | access to local variable d [field b, field c] : C | semmle.label | access to local variable d [field b, field c] : C |
+| A.cs:107:14:107:16 | access to field b [field c] : C | semmle.label | access to field b [field c] : C |
 | A.cs:107:14:107:18 | access to field c | semmle.label | access to field c |
-| A.cs:108:14:108:14 | access to local variable b [c] : C | semmle.label | access to local variable b [c] : C |
+| A.cs:108:14:108:14 | access to local variable b [field c] : C | semmle.label | access to local variable b [field c] : C |
 | A.cs:108:14:108:16 | access to field c | semmle.label | access to field c |
 | A.cs:113:17:113:23 | object creation of type B : B | semmle.label | object creation of type B : B |
-| A.cs:114:18:114:54 | object creation of type MyList [head] : B | semmle.label | object creation of type MyList [head] : B |
+| A.cs:114:18:114:54 | object creation of type MyList [field head] : B | semmle.label | object creation of type MyList [field head] : B |
 | A.cs:114:29:114:29 | access to local variable b : B | semmle.label | access to local variable b : B |
-| A.cs:115:18:115:37 | object creation of type MyList [next, head] : B | semmle.label | object creation of type MyList [next, head] : B |
-| A.cs:115:35:115:36 | access to local variable l1 [head] : B | semmle.label | access to local variable l1 [head] : B |
-| A.cs:116:18:116:37 | object creation of type MyList [next, next, head] : B | semmle.label | object creation of type MyList [next, next, head] : B |
-| A.cs:116:35:116:36 | access to local variable l2 [next, head] : B | semmle.label | access to local variable l2 [next, head] : B |
-| A.cs:119:14:119:15 | access to local variable l3 [next, next, head] : B | semmle.label | access to local variable l3 [next, next, head] : B |
-| A.cs:119:14:119:20 | access to field next [next, head] : B | semmle.label | access to field next [next, head] : B |
-| A.cs:119:14:119:25 | access to field next [head] : B | semmle.label | access to field next [head] : B |
+| A.cs:115:18:115:37 | object creation of type MyList [field next, field head] : B | semmle.label | object creation of type MyList [field next, field head] : B |
+| A.cs:115:35:115:36 | access to local variable l1 [field head] : B | semmle.label | access to local variable l1 [field head] : B |
+| A.cs:116:18:116:37 | object creation of type MyList [field next, field next, field head] : B | semmle.label | object creation of type MyList [field next, field next, field head] : B |
+| A.cs:116:35:116:36 | access to local variable l2 [field next, field head] : B | semmle.label | access to local variable l2 [field next, field head] : B |
+| A.cs:119:14:119:15 | access to local variable l3 [field next, field next, field head] : B | semmle.label | access to local variable l3 [field next, field next, field head] : B |
+| A.cs:119:14:119:20 | access to field next [field next, field head] : B | semmle.label | access to field next [field next, field head] : B |
+| A.cs:119:14:119:25 | access to field next [field head] : B | semmle.label | access to field next [field head] : B |
 | A.cs:119:14:119:30 | access to field head | semmle.label | access to field head |
-| A.cs:121:41:121:41 | access to local variable l [next, head] : B | semmle.label | access to local variable l [next, head] : B |
-| A.cs:121:41:121:41 | access to local variable l [next, next, head] : B | semmle.label | access to local variable l [next, next, head] : B |
-| A.cs:121:41:121:46 | access to field next [head] : B | semmle.label | access to field next [head] : B |
-| A.cs:121:41:121:46 | access to field next [next, head] : B | semmle.label | access to field next [next, head] : B |
-| A.cs:123:18:123:18 | access to local variable l [head] : B | semmle.label | access to local variable l [head] : B |
+| A.cs:121:41:121:41 | access to local variable l [field next, field head] : B | semmle.label | access to local variable l [field next, field head] : B |
+| A.cs:121:41:121:41 | access to local variable l [field next, field next, field head] : B | semmle.label | access to local variable l [field next, field next, field head] : B |
+| A.cs:121:41:121:46 | access to field next [field head] : B | semmle.label | access to field next [field head] : B |
+| A.cs:121:41:121:46 | access to field next [field next, field head] : B | semmle.label | access to field next [field next, field head] : B |
+| A.cs:123:18:123:18 | access to local variable l [field head] : B | semmle.label | access to local variable l [field head] : B |
 | A.cs:123:18:123:23 | access to field head | semmle.label | access to field head |
 | B.cs:5:17:5:26 | object creation of type Elem : Elem | semmle.label | object creation of type Elem : Elem |
-| B.cs:6:18:6:34 | object creation of type Box1 [elem1] : Elem | semmle.label | object creation of type Box1 [elem1] : Elem |
+| B.cs:6:18:6:34 | object creation of type Box1 [field elem1] : Elem | semmle.label | object creation of type Box1 [field elem1] : Elem |
 | B.cs:6:27:6:27 | access to local variable e : Elem | semmle.label | access to local variable e : Elem |
-| B.cs:7:18:7:29 | object creation of type Box2 [box1, elem1] : Elem | semmle.label | object creation of type Box2 [box1, elem1] : Elem |
-| B.cs:7:27:7:28 | access to local variable b1 [elem1] : Elem | semmle.label | access to local variable b1 [elem1] : Elem |
-| B.cs:8:14:8:15 | access to local variable b2 [box1, elem1] : Elem | semmle.label | access to local variable b2 [box1, elem1] : Elem |
-| B.cs:8:14:8:20 | access to field box1 [elem1] : Elem | semmle.label | access to field box1 [elem1] : Elem |
+| B.cs:7:18:7:29 | object creation of type Box2 [field box1, field elem1] : Elem | semmle.label | object creation of type Box2 [field box1, field elem1] : Elem |
+| B.cs:7:27:7:28 | access to local variable b1 [field elem1] : Elem | semmle.label | access to local variable b1 [field elem1] : Elem |
+| B.cs:8:14:8:15 | access to local variable b2 [field box1, field elem1] : Elem | semmle.label | access to local variable b2 [field box1, field elem1] : Elem |
+| B.cs:8:14:8:20 | access to field box1 [field elem1] : Elem | semmle.label | access to field box1 [field elem1] : Elem |
 | B.cs:8:14:8:26 | access to field elem1 | semmle.label | access to field elem1 |
 | B.cs:14:17:14:26 | object creation of type Elem : Elem | semmle.label | object creation of type Elem : Elem |
-| B.cs:15:18:15:34 | object creation of type Box1 [elem2] : Elem | semmle.label | object creation of type Box1 [elem2] : Elem |
+| B.cs:15:18:15:34 | object creation of type Box1 [field elem2] : Elem | semmle.label | object creation of type Box1 [field elem2] : Elem |
 | B.cs:15:33:15:33 | access to local variable e : Elem | semmle.label | access to local variable e : Elem |
-| B.cs:16:18:16:29 | object creation of type Box2 [box1, elem2] : Elem | semmle.label | object creation of type Box2 [box1, elem2] : Elem |
-| B.cs:16:27:16:28 | access to local variable b1 [elem2] : Elem | semmle.label | access to local variable b1 [elem2] : Elem |
-| B.cs:18:14:18:15 | access to local variable b2 [box1, elem2] : Elem | semmle.label | access to local variable b2 [box1, elem2] : Elem |
-| B.cs:18:14:18:20 | access to field box1 [elem2] : Elem | semmle.label | access to field box1 [elem2] : Elem |
+| B.cs:16:18:16:29 | object creation of type Box2 [field box1, field elem2] : Elem | semmle.label | object creation of type Box2 [field box1, field elem2] : Elem |
+| B.cs:16:27:16:28 | access to local variable b1 [field elem2] : Elem | semmle.label | access to local variable b1 [field elem2] : Elem |
+| B.cs:18:14:18:15 | access to local variable b2 [field box1, field elem2] : Elem | semmle.label | access to local variable b2 [field box1, field elem2] : Elem |
+| B.cs:18:14:18:20 | access to field box1 [field elem2] : Elem | semmle.label | access to field box1 [field elem2] : Elem |
 | B.cs:18:14:18:26 | access to field elem2 | semmle.label | access to field elem2 |
-| C.cs:3:18:3:19 | [post] this access [s1] : Elem | semmle.label | [post] this access [s1] : Elem |
+| C.cs:3:18:3:19 | [post] this access [field s1] : Elem | semmle.label | [post] this access [field s1] : Elem |
 | C.cs:3:23:3:32 | object creation of type Elem : Elem | semmle.label | object creation of type Elem : Elem |
-| C.cs:4:27:4:28 | [post] this access [s2] : Elem | semmle.label | [post] this access [s2] : Elem |
+| C.cs:4:27:4:28 | [post] this access [field s2] : Elem | semmle.label | [post] this access [field s2] : Elem |
 | C.cs:4:32:4:41 | object creation of type Elem : Elem | semmle.label | object creation of type Elem : Elem |
 | C.cs:6:30:6:39 | object creation of type Elem : Elem | semmle.label | object creation of type Elem : Elem |
-| C.cs:7:18:7:19 | [post] this access [s5] : Elem | semmle.label | [post] this access [s5] : Elem |
+| C.cs:7:18:7:19 | [post] this access [property s5] : Elem | semmle.label | [post] this access [property s5] : Elem |
 | C.cs:7:37:7:46 | object creation of type Elem : Elem | semmle.label | object creation of type Elem : Elem |
 | C.cs:8:30:8:39 | object creation of type Elem : Elem | semmle.label | object creation of type Elem : Elem |
-| C.cs:12:15:12:21 | object creation of type C [s1] : Elem | semmle.label | object creation of type C [s1] : Elem |
-| C.cs:12:15:12:21 | object creation of type C [s2] : Elem | semmle.label | object creation of type C [s2] : Elem |
-| C.cs:12:15:12:21 | object creation of type C [s3] : Elem | semmle.label | object creation of type C [s3] : Elem |
-| C.cs:12:15:12:21 | object creation of type C [s5] : Elem | semmle.label | object creation of type C [s5] : Elem |
-| C.cs:13:9:13:9 | access to local variable c [s1] : Elem | semmle.label | access to local variable c [s1] : Elem |
-| C.cs:13:9:13:9 | access to local variable c [s2] : Elem | semmle.label | access to local variable c [s2] : Elem |
-| C.cs:13:9:13:9 | access to local variable c [s3] : Elem | semmle.label | access to local variable c [s3] : Elem |
-| C.cs:13:9:13:9 | access to local variable c [s5] : Elem | semmle.label | access to local variable c [s5] : Elem |
-| C.cs:18:9:18:12 | [post] this access [s3] : Elem | semmle.label | [post] this access [s3] : Elem |
+| C.cs:12:15:12:21 | object creation of type C [field s1] : Elem | semmle.label | object creation of type C [field s1] : Elem |
+| C.cs:12:15:12:21 | object creation of type C [field s2] : Elem | semmle.label | object creation of type C [field s2] : Elem |
+| C.cs:12:15:12:21 | object creation of type C [field s3] : Elem | semmle.label | object creation of type C [field s3] : Elem |
+| C.cs:12:15:12:21 | object creation of type C [property s5] : Elem | semmle.label | object creation of type C [property s5] : Elem |
+| C.cs:13:9:13:9 | access to local variable c [field s1] : Elem | semmle.label | access to local variable c [field s1] : Elem |
+| C.cs:13:9:13:9 | access to local variable c [field s2] : Elem | semmle.label | access to local variable c [field s2] : Elem |
+| C.cs:13:9:13:9 | access to local variable c [field s3] : Elem | semmle.label | access to local variable c [field s3] : Elem |
+| C.cs:13:9:13:9 | access to local variable c [property s5] : Elem | semmle.label | access to local variable c [property s5] : Elem |
+| C.cs:18:9:18:12 | [post] this access [field s3] : Elem | semmle.label | [post] this access [field s3] : Elem |
 | C.cs:18:19:18:28 | object creation of type Elem : Elem | semmle.label | object creation of type Elem : Elem |
-| C.cs:21:17:21:18 | this [s1] : Elem | semmle.label | this [s1] : Elem |
-| C.cs:21:17:21:18 | this [s2] : Elem | semmle.label | this [s2] : Elem |
-| C.cs:21:17:21:18 | this [s3] : Elem | semmle.label | this [s3] : Elem |
-| C.cs:21:17:21:18 | this [s5] : Elem | semmle.label | this [s5] : Elem |
+| C.cs:21:17:21:18 | this [field s1] : Elem | semmle.label | this [field s1] : Elem |
+| C.cs:21:17:21:18 | this [field s2] : Elem | semmle.label | this [field s2] : Elem |
+| C.cs:21:17:21:18 | this [field s3] : Elem | semmle.label | this [field s3] : Elem |
+| C.cs:21:17:21:18 | this [property s5] : Elem | semmle.label | this [property s5] : Elem |
 | C.cs:23:14:23:15 | access to field s1 | semmle.label | access to field s1 |
-| C.cs:23:14:23:15 | this access [s1] : Elem | semmle.label | this access [s1] : Elem |
+| C.cs:23:14:23:15 | this access [field s1] : Elem | semmle.label | this access [field s1] : Elem |
 | C.cs:24:14:24:15 | access to field s2 | semmle.label | access to field s2 |
-| C.cs:24:14:24:15 | this access [s2] : Elem | semmle.label | this access [s2] : Elem |
+| C.cs:24:14:24:15 | this access [field s2] : Elem | semmle.label | this access [field s2] : Elem |
 | C.cs:25:14:25:15 | access to field s3 | semmle.label | access to field s3 |
-| C.cs:25:14:25:15 | this access [s3] : Elem | semmle.label | this access [s3] : Elem |
+| C.cs:25:14:25:15 | this access [field s3] : Elem | semmle.label | this access [field s3] : Elem |
 | C.cs:26:14:26:15 | access to field s4 | semmle.label | access to field s4 |
 | C.cs:27:14:27:15 | access to property s5 | semmle.label | access to property s5 |
-| C.cs:27:14:27:15 | this access [s5] : Elem | semmle.label | this access [s5] : Elem |
+| C.cs:27:14:27:15 | this access [property s5] : Elem | semmle.label | this access [property s5] : Elem |
 | C.cs:28:14:28:15 | access to property s6 | semmle.label | access to property s6 |
 | D.cs:29:17:29:28 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
-| D.cs:31:17:31:37 | call to method Create [AutoProp] : Object | semmle.label | call to method Create [AutoProp] : Object |
+| D.cs:31:17:31:37 | call to method Create [property AutoProp] : Object | semmle.label | call to method Create [property AutoProp] : Object |
 | D.cs:31:24:31:24 | access to local variable o : Object | semmle.label | access to local variable o : Object |
-| D.cs:32:14:32:14 | access to local variable d [AutoProp] : Object | semmle.label | access to local variable d [AutoProp] : Object |
+| D.cs:32:14:32:14 | access to local variable d [property AutoProp] : Object | semmle.label | access to local variable d [property AutoProp] : Object |
 | D.cs:32:14:32:23 | access to property AutoProp | semmle.label | access to property AutoProp |
-| D.cs:37:13:37:33 | call to method Create [trivialPropField] : Object | semmle.label | call to method Create [trivialPropField] : Object |
+| D.cs:37:13:37:33 | call to method Create [field trivialPropField] : Object | semmle.label | call to method Create [field trivialPropField] : Object |
 | D.cs:37:26:37:26 | access to local variable o : Object | semmle.label | access to local variable o : Object |
-| D.cs:39:14:39:14 | access to local variable d [trivialPropField] : Object | semmle.label | access to local variable d [trivialPropField] : Object |
+| D.cs:39:14:39:14 | access to local variable d [field trivialPropField] : Object | semmle.label | access to local variable d [field trivialPropField] : Object |
 | D.cs:39:14:39:26 | access to property TrivialProp | semmle.label | access to property TrivialProp |
-| D.cs:40:14:40:14 | access to local variable d [trivialPropField] : Object | semmle.label | access to local variable d [trivialPropField] : Object |
+| D.cs:40:14:40:14 | access to local variable d [field trivialPropField] : Object | semmle.label | access to local variable d [field trivialPropField] : Object |
 | D.cs:40:14:40:31 | access to field trivialPropField | semmle.label | access to field trivialPropField |
-| D.cs:41:14:41:14 | access to local variable d [trivialPropField] : Object | semmle.label | access to local variable d [trivialPropField] : Object |
+| D.cs:41:14:41:14 | access to local variable d [field trivialPropField] : Object | semmle.label | access to local variable d [field trivialPropField] : Object |
 | D.cs:41:14:41:26 | access to property ComplexProp | semmle.label | access to property ComplexProp |
-| D.cs:43:13:43:33 | call to method Create [trivialPropField] : Object | semmle.label | call to method Create [trivialPropField] : Object |
+| D.cs:43:13:43:33 | call to method Create [field trivialPropField] : Object | semmle.label | call to method Create [field trivialPropField] : Object |
 | D.cs:43:32:43:32 | access to local variable o : Object | semmle.label | access to local variable o : Object |
-| D.cs:45:14:45:14 | access to local variable d [trivialPropField] : Object | semmle.label | access to local variable d [trivialPropField] : Object |
+| D.cs:45:14:45:14 | access to local variable d [field trivialPropField] : Object | semmle.label | access to local variable d [field trivialPropField] : Object |
 | D.cs:45:14:45:26 | access to property TrivialProp | semmle.label | access to property TrivialProp |
-| D.cs:46:14:46:14 | access to local variable d [trivialPropField] : Object | semmle.label | access to local variable d [trivialPropField] : Object |
+| D.cs:46:14:46:14 | access to local variable d [field trivialPropField] : Object | semmle.label | access to local variable d [field trivialPropField] : Object |
 | D.cs:46:14:46:31 | access to field trivialPropField | semmle.label | access to field trivialPropField |
-| D.cs:47:14:47:14 | access to local variable d [trivialPropField] : Object | semmle.label | access to local variable d [trivialPropField] : Object |
+| D.cs:47:14:47:14 | access to local variable d [field trivialPropField] : Object | semmle.label | access to local variable d [field trivialPropField] : Object |
 | D.cs:47:14:47:26 | access to property ComplexProp | semmle.label | access to property ComplexProp |
 | E.cs:22:17:22:28 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
-| E.cs:23:17:23:26 | call to method CreateS [Field] : Object | semmle.label | call to method CreateS [Field] : Object |
+| E.cs:23:17:23:26 | call to method CreateS [field Field] : Object | semmle.label | call to method CreateS [field Field] : Object |
 | E.cs:23:25:23:25 | access to local variable o : Object | semmle.label | access to local variable o : Object |
-| E.cs:24:14:24:14 | access to local variable s [Field] : Object | semmle.label | access to local variable s [Field] : Object |
+| E.cs:24:14:24:14 | access to local variable s [field Field] : Object | semmle.label | access to local variable s [field Field] : Object |
 | E.cs:24:14:24:20 | access to field Field | semmle.label | access to field Field |
 | F.cs:10:17:10:28 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
-| F.cs:11:17:11:31 | call to method Create [Field1] : Object | semmle.label | call to method Create [Field1] : Object |
+| F.cs:11:17:11:31 | call to method Create [field Field1] : Object | semmle.label | call to method Create [field Field1] : Object |
 | F.cs:11:24:11:24 | access to local variable o : Object | semmle.label | access to local variable o : Object |
-| F.cs:12:14:12:14 | access to local variable f [Field1] : Object | semmle.label | access to local variable f [Field1] : Object |
+| F.cs:12:14:12:14 | access to local variable f [field Field1] : Object | semmle.label | access to local variable f [field Field1] : Object |
 | F.cs:12:14:12:21 | access to field Field1 | semmle.label | access to field Field1 |
-| F.cs:15:13:15:27 | call to method Create [Field2] : Object | semmle.label | call to method Create [Field2] : Object |
+| F.cs:15:13:15:27 | call to method Create [field Field2] : Object | semmle.label | call to method Create [field Field2] : Object |
 | F.cs:15:26:15:26 | access to local variable o : Object | semmle.label | access to local variable o : Object |
-| F.cs:17:14:17:14 | access to local variable f [Field2] : Object | semmle.label | access to local variable f [Field2] : Object |
+| F.cs:17:14:17:14 | access to local variable f [field Field2] : Object | semmle.label | access to local variable f [field Field2] : Object |
 | F.cs:17:14:17:21 | access to field Field2 | semmle.label | access to field Field2 |
-| F.cs:19:21:19:34 | { ..., ... } [Field1] : Object | semmle.label | { ..., ... } [Field1] : Object |
+| F.cs:19:21:19:34 | { ..., ... } [field Field1] : Object | semmle.label | { ..., ... } [field Field1] : Object |
 | F.cs:19:32:19:32 | access to local variable o : Object | semmle.label | access to local variable o : Object |
-| F.cs:20:14:20:14 | access to local variable f [Field1] : Object | semmle.label | access to local variable f [Field1] : Object |
+| F.cs:20:14:20:14 | access to local variable f [field Field1] : Object | semmle.label | access to local variable f [field Field1] : Object |
 | F.cs:20:14:20:21 | access to field Field1 | semmle.label | access to field Field1 |
-| F.cs:23:21:23:34 | { ..., ... } [Field2] : Object | semmle.label | { ..., ... } [Field2] : Object |
+| F.cs:23:21:23:34 | { ..., ... } [field Field2] : Object | semmle.label | { ..., ... } [field Field2] : Object |
 | F.cs:23:32:23:32 | access to local variable o : Object | semmle.label | access to local variable o : Object |
-| F.cs:25:14:25:14 | access to local variable f [Field2] : Object | semmle.label | access to local variable f [Field2] : Object |
+| F.cs:25:14:25:14 | access to local variable f [field Field2] : Object | semmle.label | access to local variable f [field Field2] : Object |
 | F.cs:25:14:25:21 | access to field Field2 | semmle.label | access to field Field2 |
 | G.cs:7:18:7:27 | object creation of type Elem : Elem | semmle.label | object creation of type Elem : Elem |
-| G.cs:9:9:9:9 | [post] access to local variable b [Box1, Elem] : Elem | semmle.label | [post] access to local variable b [Box1, Elem] : Elem |
-| G.cs:9:9:9:14 | [post] access to field Box1 [Elem] : Elem | semmle.label | [post] access to field Box1 [Elem] : Elem |
+| G.cs:9:9:9:9 | [post] access to local variable b [field Box1, field Elem] : Elem | semmle.label | [post] access to local variable b [field Box1, field Elem] : Elem |
+| G.cs:9:9:9:14 | [post] access to field Box1 [field Elem] : Elem | semmle.label | [post] access to field Box1 [field Elem] : Elem |
 | G.cs:9:23:9:23 | access to local variable e : Elem | semmle.label | access to local variable e : Elem |
-| G.cs:10:18:10:18 | access to local variable b [Box1, Elem] : Elem | semmle.label | access to local variable b [Box1, Elem] : Elem |
+| G.cs:10:18:10:18 | access to local variable b [field Box1, field Elem] : Elem | semmle.label | access to local variable b [field Box1, field Elem] : Elem |
 | G.cs:15:18:15:27 | object creation of type Elem : Elem | semmle.label | object creation of type Elem : Elem |
-| G.cs:17:9:17:9 | [post] access to local variable b [Box1, Elem] : Elem | semmle.label | [post] access to local variable b [Box1, Elem] : Elem |
-| G.cs:17:9:17:14 | [post] access to field Box1 [Elem] : Elem | semmle.label | [post] access to field Box1 [Elem] : Elem |
+| G.cs:17:9:17:9 | [post] access to local variable b [field Box1, field Elem] : Elem | semmle.label | [post] access to local variable b [field Box1, field Elem] : Elem |
+| G.cs:17:9:17:14 | [post] access to field Box1 [field Elem] : Elem | semmle.label | [post] access to field Box1 [field Elem] : Elem |
 | G.cs:17:24:17:24 | access to local variable e : Elem | semmle.label | access to local variable e : Elem |
-| G.cs:18:18:18:18 | access to local variable b [Box1, Elem] : Elem | semmle.label | access to local variable b [Box1, Elem] : Elem |
+| G.cs:18:18:18:18 | access to local variable b [field Box1, field Elem] : Elem | semmle.label | access to local variable b [field Box1, field Elem] : Elem |
 | G.cs:23:18:23:27 | object creation of type Elem : Elem | semmle.label | object creation of type Elem : Elem |
-| G.cs:25:9:25:9 | [post] access to local variable b [Box1, Elem] : Elem | semmle.label | [post] access to local variable b [Box1, Elem] : Elem |
-| G.cs:25:9:25:19 | [post] call to method GetBox1 [Elem] : Elem | semmle.label | [post] call to method GetBox1 [Elem] : Elem |
+| G.cs:25:9:25:9 | [post] access to local variable b [field Box1, field Elem] : Elem | semmle.label | [post] access to local variable b [field Box1, field Elem] : Elem |
+| G.cs:25:9:25:19 | [post] call to method GetBox1 [field Elem] : Elem | semmle.label | [post] call to method GetBox1 [field Elem] : Elem |
 | G.cs:25:28:25:28 | access to local variable e : Elem | semmle.label | access to local variable e : Elem |
-| G.cs:26:18:26:18 | access to local variable b [Box1, Elem] : Elem | semmle.label | access to local variable b [Box1, Elem] : Elem |
+| G.cs:26:18:26:18 | access to local variable b [field Box1, field Elem] : Elem | semmle.label | access to local variable b [field Box1, field Elem] : Elem |
 | G.cs:31:18:31:27 | object creation of type Elem : Elem | semmle.label | object creation of type Elem : Elem |
-| G.cs:33:9:33:9 | [post] access to local variable b [Box1, Elem] : Elem | semmle.label | [post] access to local variable b [Box1, Elem] : Elem |
-| G.cs:33:9:33:19 | [post] call to method GetBox1 [Elem] : Elem | semmle.label | [post] call to method GetBox1 [Elem] : Elem |
+| G.cs:33:9:33:9 | [post] access to local variable b [field Box1, field Elem] : Elem | semmle.label | [post] access to local variable b [field Box1, field Elem] : Elem |
+| G.cs:33:9:33:19 | [post] call to method GetBox1 [field Elem] : Elem | semmle.label | [post] call to method GetBox1 [field Elem] : Elem |
 | G.cs:33:29:33:29 | access to local variable e : Elem | semmle.label | access to local variable e : Elem |
-| G.cs:34:18:34:18 | access to local variable b [Box1, Elem] : Elem | semmle.label | access to local variable b [Box1, Elem] : Elem |
-| G.cs:37:38:37:39 | b2 [Box1, Elem] : Elem | semmle.label | b2 [Box1, Elem] : Elem |
-| G.cs:39:14:39:15 | access to parameter b2 [Box1, Elem] : Elem | semmle.label | access to parameter b2 [Box1, Elem] : Elem |
-| G.cs:39:14:39:25 | call to method GetBox1 [Elem] : Elem | semmle.label | call to method GetBox1 [Elem] : Elem |
+| G.cs:34:18:34:18 | access to local variable b [field Box1, field Elem] : Elem | semmle.label | access to local variable b [field Box1, field Elem] : Elem |
+| G.cs:37:38:37:39 | b2 [field Box1, field Elem] : Elem | semmle.label | b2 [field Box1, field Elem] : Elem |
+| G.cs:39:14:39:15 | access to parameter b2 [field Box1, field Elem] : Elem | semmle.label | access to parameter b2 [field Box1, field Elem] : Elem |
+| G.cs:39:14:39:25 | call to method GetBox1 [field Elem] : Elem | semmle.label | call to method GetBox1 [field Elem] : Elem |
 | G.cs:39:14:39:35 | call to method GetElem | semmle.label | call to method GetElem |
 | G.cs:44:18:44:27 | object creation of type Elem : Elem | semmle.label | object creation of type Elem : Elem |
-| G.cs:46:9:46:16 | [post] access to field boxfield [Box1, Elem] : Elem | semmle.label | [post] access to field boxfield [Box1, Elem] : Elem |
-| G.cs:46:9:46:16 | [post] this access [boxfield, Box1, Elem] : Elem | semmle.label | [post] this access [boxfield, Box1, Elem] : Elem |
-| G.cs:46:9:46:21 | [post] access to field Box1 [Elem] : Elem | semmle.label | [post] access to field Box1 [Elem] : Elem |
+| G.cs:46:9:46:16 | [post] access to field boxfield [field Box1, field Elem] : Elem | semmle.label | [post] access to field boxfield [field Box1, field Elem] : Elem |
+| G.cs:46:9:46:16 | [post] this access [field boxfield, field Box1, field Elem] : Elem | semmle.label | [post] this access [field boxfield, field Box1, field Elem] : Elem |
+| G.cs:46:9:46:21 | [post] access to field Box1 [field Elem] : Elem | semmle.label | [post] access to field Box1 [field Elem] : Elem |
 | G.cs:46:30:46:30 | access to local variable e : Elem | semmle.label | access to local variable e : Elem |
-| G.cs:47:9:47:13 | this access [boxfield, Box1, Elem] : Elem | semmle.label | this access [boxfield, Box1, Elem] : Elem |
-| G.cs:50:18:50:20 | this [boxfield, Box1, Elem] : Elem | semmle.label | this [boxfield, Box1, Elem] : Elem |
-| G.cs:52:14:52:21 | access to field boxfield [Box1, Elem] : Elem | semmle.label | access to field boxfield [Box1, Elem] : Elem |
-| G.cs:52:14:52:21 | this access [boxfield, Box1, Elem] : Elem | semmle.label | this access [boxfield, Box1, Elem] : Elem |
-| G.cs:52:14:52:26 | access to field Box1 [Elem] : Elem | semmle.label | access to field Box1 [Elem] : Elem |
+| G.cs:47:9:47:13 | this access [field boxfield, field Box1, field Elem] : Elem | semmle.label | this access [field boxfield, field Box1, field Elem] : Elem |
+| G.cs:50:18:50:20 | this [field boxfield, field Box1, field Elem] : Elem | semmle.label | this [field boxfield, field Box1, field Elem] : Elem |
+| G.cs:52:14:52:21 | access to field boxfield [field Box1, field Elem] : Elem | semmle.label | access to field boxfield [field Box1, field Elem] : Elem |
+| G.cs:52:14:52:21 | this access [field boxfield, field Box1, field Elem] : Elem | semmle.label | this access [field boxfield, field Box1, field Elem] : Elem |
+| G.cs:52:14:52:26 | access to field Box1 [field Elem] : Elem | semmle.label | access to field Box1 [field Elem] : Elem |
 | G.cs:52:14:52:31 | access to field Elem | semmle.label | access to field Elem |
-| H.cs:23:9:23:9 | [post] access to local variable a [FieldA] : Object | semmle.label | [post] access to local variable a [FieldA] : Object |
+| H.cs:23:9:23:9 | [post] access to local variable a [field FieldA] : Object | semmle.label | [post] access to local variable a [field FieldA] : Object |
 | H.cs:23:20:23:31 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
-| H.cs:24:21:24:28 | call to method Clone [FieldA] : Object | semmle.label | call to method Clone [FieldA] : Object |
-| H.cs:24:27:24:27 | access to local variable a [FieldA] : Object | semmle.label | access to local variable a [FieldA] : Object |
-| H.cs:25:14:25:18 | access to local variable clone [FieldA] : Object | semmle.label | access to local variable clone [FieldA] : Object |
+| H.cs:24:21:24:28 | call to method Clone [field FieldA] : Object | semmle.label | call to method Clone [field FieldA] : Object |
+| H.cs:24:27:24:27 | access to local variable a [field FieldA] : Object | semmle.label | access to local variable a [field FieldA] : Object |
+| H.cs:25:14:25:18 | access to local variable clone [field FieldA] : Object | semmle.label | access to local variable clone [field FieldA] : Object |
 | H.cs:25:14:25:25 | access to field FieldA | semmle.label | access to field FieldA |
-| H.cs:43:9:43:9 | [post] access to local variable a [FieldA] : Object | semmle.label | [post] access to local variable a [FieldA] : Object |
+| H.cs:43:9:43:9 | [post] access to local variable a [field FieldA] : Object | semmle.label | [post] access to local variable a [field FieldA] : Object |
 | H.cs:43:20:43:31 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
-| H.cs:44:17:44:28 | call to method Transform [FieldB] : Object | semmle.label | call to method Transform [FieldB] : Object |
-| H.cs:44:27:44:27 | access to local variable a [FieldA] : Object | semmle.label | access to local variable a [FieldA] : Object |
-| H.cs:45:14:45:14 | access to local variable b [FieldB] : Object | semmle.label | access to local variable b [FieldB] : Object |
+| H.cs:44:17:44:28 | call to method Transform [field FieldB] : Object | semmle.label | call to method Transform [field FieldB] : Object |
+| H.cs:44:27:44:27 | access to local variable a [field FieldA] : Object | semmle.label | access to local variable a [field FieldA] : Object |
+| H.cs:45:14:45:14 | access to local variable b [field FieldB] : Object | semmle.label | access to local variable b [field FieldB] : Object |
 | H.cs:45:14:45:21 | access to field FieldB | semmle.label | access to field FieldB |
-| H.cs:63:9:63:9 | [post] access to local variable a [FieldA] : Object | semmle.label | [post] access to local variable a [FieldA] : Object |
+| H.cs:63:9:63:9 | [post] access to local variable a [field FieldA] : Object | semmle.label | [post] access to local variable a [field FieldA] : Object |
 | H.cs:63:20:63:31 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
-| H.cs:64:22:64:22 | access to local variable a [FieldA] : Object | semmle.label | access to local variable a [FieldA] : Object |
-| H.cs:64:25:64:26 | [post] access to local variable b1 [FieldB] : Object | semmle.label | [post] access to local variable b1 [FieldB] : Object |
-| H.cs:65:14:65:15 | access to local variable b1 [FieldB] : Object | semmle.label | access to local variable b1 [FieldB] : Object |
+| H.cs:64:22:64:22 | access to local variable a [field FieldA] : Object | semmle.label | access to local variable a [field FieldA] : Object |
+| H.cs:64:25:64:26 | [post] access to local variable b1 [field FieldB] : Object | semmle.label | [post] access to local variable b1 [field FieldB] : Object |
+| H.cs:65:14:65:15 | access to local variable b1 [field FieldB] : Object | semmle.label | access to local variable b1 [field FieldB] : Object |
 | H.cs:65:14:65:22 | access to field FieldB | semmle.label | access to field FieldB |
-| H.cs:88:17:88:17 | [post] access to local variable a [FieldA] : Object | semmle.label | [post] access to local variable a [FieldA] : Object |
+| H.cs:88:17:88:17 | [post] access to local variable a [field FieldA] : Object | semmle.label | [post] access to local variable a [field FieldA] : Object |
 | H.cs:88:20:88:31 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
-| H.cs:88:34:88:35 | [post] access to local variable b1 [FieldB] : Object | semmle.label | [post] access to local variable b1 [FieldB] : Object |
-| H.cs:89:14:89:14 | access to local variable a [FieldA] : Object | semmle.label | access to local variable a [FieldA] : Object |
+| H.cs:88:34:88:35 | [post] access to local variable b1 [field FieldB] : Object | semmle.label | [post] access to local variable b1 [field FieldB] : Object |
+| H.cs:89:14:89:14 | access to local variable a [field FieldA] : Object | semmle.label | access to local variable a [field FieldA] : Object |
 | H.cs:89:14:89:21 | access to field FieldA | semmle.label | access to field FieldA |
-| H.cs:90:14:90:15 | access to local variable b1 [FieldB] : Object | semmle.label | access to local variable b1 [FieldB] : Object |
+| H.cs:90:14:90:15 | access to local variable b1 [field FieldB] : Object | semmle.label | access to local variable b1 [field FieldB] : Object |
 | H.cs:90:14:90:22 | access to field FieldB | semmle.label | access to field FieldB |
-| H.cs:112:9:112:9 | [post] access to local variable a [FieldA] : Object | semmle.label | [post] access to local variable a [FieldA] : Object |
+| H.cs:112:9:112:9 | [post] access to local variable a [field FieldA] : Object | semmle.label | [post] access to local variable a [field FieldA] : Object |
 | H.cs:112:20:112:31 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
-| H.cs:113:17:113:32 | call to method TransformWrap [FieldB] : Object | semmle.label | call to method TransformWrap [FieldB] : Object |
-| H.cs:113:31:113:31 | access to local variable a [FieldA] : Object | semmle.label | access to local variable a [FieldA] : Object |
-| H.cs:114:14:114:14 | access to local variable b [FieldB] : Object | semmle.label | access to local variable b [FieldB] : Object |
+| H.cs:113:17:113:32 | call to method TransformWrap [field FieldB] : Object | semmle.label | call to method TransformWrap [field FieldB] : Object |
+| H.cs:113:31:113:31 | access to local variable a [field FieldA] : Object | semmle.label | access to local variable a [field FieldA] : Object |
+| H.cs:114:14:114:14 | access to local variable b [field FieldB] : Object | semmle.label | access to local variable b [field FieldB] : Object |
 | H.cs:114:14:114:21 | access to field FieldB | semmle.label | access to field FieldB |
-| H.cs:130:9:130:9 | [post] access to local variable a [FieldA] : Object | semmle.label | [post] access to local variable a [FieldA] : Object |
+| H.cs:130:9:130:9 | [post] access to local variable a [field FieldA] : Object | semmle.label | [post] access to local variable a [field FieldA] : Object |
 | H.cs:130:20:130:31 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
 | H.cs:131:14:131:19 | call to method Get | semmle.label | call to method Get |
-| H.cs:131:18:131:18 | access to local variable a [FieldA] : Object | semmle.label | access to local variable a [FieldA] : Object |
+| H.cs:131:18:131:18 | access to local variable a [field FieldA] : Object | semmle.label | access to local variable a [field FieldA] : Object |
 | H.cs:147:17:147:32 | call to method Through : A | semmle.label | call to method Through : A |
 | H.cs:147:25:147:31 | object creation of type A : A | semmle.label | object creation of type A : A |
 | H.cs:148:14:148:14 | access to local variable a | semmle.label | access to local variable a |
 | H.cs:155:17:155:23 | object creation of type B : B | semmle.label | object creation of type B : B |
 | H.cs:156:9:156:9 | access to local variable b : B | semmle.label | access to local variable b : B |
-| H.cs:157:9:157:9 | [post] access to parameter a [FieldA] : B | semmle.label | [post] access to parameter a [FieldA] : B |
+| H.cs:157:9:157:9 | [post] access to parameter a [field FieldA] : B | semmle.label | [post] access to parameter a [field FieldA] : B |
 | H.cs:157:20:157:20 | access to local variable b : B | semmle.label | access to local variable b : B |
 | H.cs:163:17:163:28 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
-| H.cs:164:19:164:19 | [post] access to local variable a [FieldA, FieldB] : Object | semmle.label | [post] access to local variable a [FieldA, FieldB] : Object |
-| H.cs:164:19:164:19 | [post] access to local variable a [FieldA] : B | semmle.label | [post] access to local variable a [FieldA] : B |
+| H.cs:164:19:164:19 | [post] access to local variable a [field FieldA, field FieldB] : Object | semmle.label | [post] access to local variable a [field FieldA, field FieldB] : Object |
+| H.cs:164:19:164:19 | [post] access to local variable a [field FieldA] : B | semmle.label | [post] access to local variable a [field FieldA] : B |
 | H.cs:164:22:164:22 | access to local variable o : Object | semmle.label | access to local variable o : Object |
 | H.cs:165:17:165:28 | (...) ... : B | semmle.label | (...) ... : B |
-| H.cs:165:17:165:28 | (...) ... [FieldB] : Object | semmle.label | (...) ... [FieldB] : Object |
-| H.cs:165:21:165:21 | access to local variable a [FieldA, FieldB] : Object | semmle.label | access to local variable a [FieldA, FieldB] : Object |
-| H.cs:165:21:165:21 | access to local variable a [FieldA] : B | semmle.label | access to local variable a [FieldA] : B |
+| H.cs:165:17:165:28 | (...) ... [field FieldB] : Object | semmle.label | (...) ... [field FieldB] : Object |
+| H.cs:165:21:165:21 | access to local variable a [field FieldA, field FieldB] : Object | semmle.label | access to local variable a [field FieldA, field FieldB] : Object |
+| H.cs:165:21:165:21 | access to local variable a [field FieldA] : B | semmle.label | access to local variable a [field FieldA] : B |
 | H.cs:165:21:165:28 | access to field FieldA : B | semmle.label | access to field FieldA : B |
-| H.cs:165:21:165:28 | access to field FieldA [FieldB] : Object | semmle.label | access to field FieldA [FieldB] : Object |
+| H.cs:165:21:165:28 | access to field FieldA [field FieldB] : Object | semmle.label | access to field FieldA [field FieldB] : Object |
 | H.cs:166:14:166:14 | access to local variable b | semmle.label | access to local variable b |
-| H.cs:167:14:167:14 | access to local variable b [FieldB] : Object | semmle.label | access to local variable b [FieldB] : Object |
+| H.cs:167:14:167:14 | access to local variable b [field FieldB] : Object | semmle.label | access to local variable b [field FieldB] : Object |
 | H.cs:167:14:167:21 | access to field FieldB | semmle.label | access to field FieldB |
-| I.cs:7:9:7:14 | [post] this access [Field1] : Object | semmle.label | [post] this access [Field1] : Object |
+| I.cs:7:9:7:14 | [post] this access [field Field1] : Object | semmle.label | [post] this access [field Field1] : Object |
 | I.cs:7:18:7:29 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
 | I.cs:13:17:13:28 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
-| I.cs:15:9:15:9 | [post] access to local variable i [Field1] : Object | semmle.label | [post] access to local variable i [Field1] : Object |
+| I.cs:15:9:15:9 | [post] access to local variable i [field Field1] : Object | semmle.label | [post] access to local variable i [field Field1] : Object |
 | I.cs:15:20:15:20 | access to local variable o : Object | semmle.label | access to local variable o : Object |
-| I.cs:16:9:16:9 | access to local variable i [Field1] : Object | semmle.label | access to local variable i [Field1] : Object |
-| I.cs:17:9:17:9 | access to local variable i [Field1] : Object | semmle.label | access to local variable i [Field1] : Object |
-| I.cs:18:14:18:14 | access to local variable i [Field1] : Object | semmle.label | access to local variable i [Field1] : Object |
+| I.cs:16:9:16:9 | access to local variable i [field Field1] : Object | semmle.label | access to local variable i [field Field1] : Object |
+| I.cs:17:9:17:9 | access to local variable i [field Field1] : Object | semmle.label | access to local variable i [field Field1] : Object |
+| I.cs:18:14:18:14 | access to local variable i [field Field1] : Object | semmle.label | access to local variable i [field Field1] : Object |
 | I.cs:18:14:18:21 | access to field Field1 | semmle.label | access to field Field1 |
-| I.cs:21:13:21:19 | object creation of type I [Field1] : Object | semmle.label | object creation of type I [Field1] : Object |
-| I.cs:22:9:22:9 | access to local variable i [Field1] : Object | semmle.label | access to local variable i [Field1] : Object |
-| I.cs:23:14:23:14 | access to local variable i [Field1] : Object | semmle.label | access to local variable i [Field1] : Object |
+| I.cs:21:13:21:19 | object creation of type I [field Field1] : Object | semmle.label | object creation of type I [field Field1] : Object |
+| I.cs:22:9:22:9 | access to local variable i [field Field1] : Object | semmle.label | access to local variable i [field Field1] : Object |
+| I.cs:23:14:23:14 | access to local variable i [field Field1] : Object | semmle.label | access to local variable i [field Field1] : Object |
 | I.cs:23:14:23:21 | access to field Field1 | semmle.label | access to field Field1 |
-| I.cs:26:13:26:37 | [pre-initializer] object creation of type I [Field1] : Object | semmle.label | [pre-initializer] object creation of type I [Field1] : Object |
-| I.cs:27:14:27:14 | access to local variable i [Field1] : Object | semmle.label | access to local variable i [Field1] : Object |
+| I.cs:26:13:26:37 | [pre-initializer] object creation of type I [field Field1] : Object | semmle.label | [pre-initializer] object creation of type I [field Field1] : Object |
+| I.cs:27:14:27:14 | access to local variable i [field Field1] : Object | semmle.label | access to local variable i [field Field1] : Object |
 | I.cs:27:14:27:21 | access to field Field1 | semmle.label | access to field Field1 |
 | I.cs:31:13:31:24 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
-| I.cs:32:9:32:9 | [post] access to local variable i [Field1] : Object | semmle.label | [post] access to local variable i [Field1] : Object |
+| I.cs:32:9:32:9 | [post] access to local variable i [field Field1] : Object | semmle.label | [post] access to local variable i [field Field1] : Object |
 | I.cs:32:20:32:20 | access to local variable o : Object | semmle.label | access to local variable o : Object |
-| I.cs:33:9:33:9 | access to local variable i [Field1] : Object | semmle.label | access to local variable i [Field1] : Object |
-| I.cs:34:12:34:12 | access to local variable i [Field1] : Object | semmle.label | access to local variable i [Field1] : Object |
-| I.cs:37:23:37:23 | i [Field1] : Object | semmle.label | i [Field1] : Object |
-| I.cs:39:9:39:9 | access to parameter i [Field1] : Object | semmle.label | access to parameter i [Field1] : Object |
-| I.cs:40:14:40:14 | access to parameter i [Field1] : Object | semmle.label | access to parameter i [Field1] : Object |
+| I.cs:33:9:33:9 | access to local variable i [field Field1] : Object | semmle.label | access to local variable i [field Field1] : Object |
+| I.cs:34:12:34:12 | access to local variable i [field Field1] : Object | semmle.label | access to local variable i [field Field1] : Object |
+| I.cs:37:23:37:23 | i [field Field1] : Object | semmle.label | i [field Field1] : Object |
+| I.cs:39:9:39:9 | access to parameter i [field Field1] : Object | semmle.label | access to parameter i [field Field1] : Object |
+| I.cs:40:14:40:14 | access to parameter i [field Field1] : Object | semmle.label | access to parameter i [field Field1] : Object |
 | I.cs:40:14:40:21 | access to field Field1 | semmle.label | access to field Field1 |
 | J.cs:12:17:12:28 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
-| J.cs:13:18:13:36 | object creation of type Record [Prop1] : Object | semmle.label | object creation of type Record [Prop1] : Object |
+| J.cs:13:18:13:36 | object creation of type Record [property Prop1] : Object | semmle.label | object creation of type Record [property Prop1] : Object |
 | J.cs:13:29:13:29 | access to local variable o : Object | semmle.label | access to local variable o : Object |
-| J.cs:14:14:14:15 | access to local variable r1 [Prop1] : Object | semmle.label | access to local variable r1 [Prop1] : Object |
+| J.cs:14:14:14:15 | access to local variable r1 [property Prop1] : Object | semmle.label | access to local variable r1 [property Prop1] : Object |
 | J.cs:14:14:14:21 | access to property Prop1 | semmle.label | access to property Prop1 |
-| J.cs:18:14:18:15 | access to local variable r2 [Prop1] : Object | semmle.label | access to local variable r2 [Prop1] : Object |
+| J.cs:18:14:18:15 | access to local variable r2 [property Prop1] : Object | semmle.label | access to local variable r2 [property Prop1] : Object |
 | J.cs:18:14:18:21 | access to property Prop1 | semmle.label | access to property Prop1 |
-| J.cs:21:18:21:38 | ... with { ... } [Prop2] : Object | semmle.label | ... with { ... } [Prop2] : Object |
+| J.cs:21:18:21:38 | ... with { ... } [property Prop2] : Object | semmle.label | ... with { ... } [property Prop2] : Object |
 | J.cs:21:36:21:36 | access to local variable o : Object | semmle.label | access to local variable o : Object |
-| J.cs:22:14:22:15 | access to local variable r3 [Prop1] : Object | semmle.label | access to local variable r3 [Prop1] : Object |
+| J.cs:22:14:22:15 | access to local variable r3 [property Prop1] : Object | semmle.label | access to local variable r3 [property Prop1] : Object |
 | J.cs:22:14:22:21 | access to property Prop1 | semmle.label | access to property Prop1 |
-| J.cs:23:14:23:15 | access to local variable r3 [Prop2] : Object | semmle.label | access to local variable r3 [Prop2] : Object |
+| J.cs:23:14:23:15 | access to local variable r3 [property Prop2] : Object | semmle.label | access to local variable r3 [property Prop2] : Object |
 | J.cs:23:14:23:21 | access to property Prop2 | semmle.label | access to property Prop2 |
 #select
 | A.cs:7:14:7:16 | access to field c | A.cs:5:17:5:23 | object creation of type C : C | A.cs:7:14:7:16 | access to field c | $@ | A.cs:5:17:5:23 | object creation of type C : C | object creation of type C : C |
diff --git a/csharp/ql/test/library-tests/dataflow/functionpointers/FunctionPointerFlow.expected b/csharp/ql/test/library-tests/dataflow/functionpointers/FunctionPointerFlow.expected
index ad2bfb887c0..a25f9c14539 100644
--- a/csharp/ql/test/library-tests/dataflow/functionpointers/FunctionPointerFlow.expected
+++ b/csharp/ql/test/library-tests/dataflow/functionpointers/FunctionPointerFlow.expected
@@ -1,9 +1,20 @@
-| FunctionPointerFlow.cs:14:9:14:12 | function pointer call | FunctionPointerFlow.cs:5:24:5:27 | Log1 | FunctionPointerFlow.cs:21:12:21:16 | &... |
-| FunctionPointerFlow.cs:14:9:14:12 | function pointer call | FunctionPointerFlow.cs:6:24:6:27 | Log2 | FunctionPointerFlow.cs:26:12:26:12 | access to parameter a |
-| FunctionPointerFlow.cs:14:9:14:12 | function pointer call | FunctionPointerFlow.cs:10:24:10:27 | Log6 | FunctionPointerFlow.cs:26:12:26:12 | access to parameter a |
-| FunctionPointerFlow.cs:14:9:14:12 | function pointer call | FunctionPointerFlow.cs:46:9:46:44 | LocalFunction | FunctionPointerFlow.cs:47:12:47:25 | &... |
-| FunctionPointerFlow.cs:16:9:16:12 | function pointer call | FunctionPointerFlow.cs:7:24:7:27 | Log3 | file://:0:0:0:0 | <empty> |
-| FunctionPointerFlow.cs:41:9:41:15 | function pointer call | FunctionPointerFlow.cs:8:24:8:27 | Log4 | file://:0:0:0:0 | <empty> |
-| FunctionPointerFlow.cs:54:9:54:16 | function pointer call | FunctionPointerFlow.cs:9:24:9:27 | Log5 | file://:0:0:0:0 | <empty> |
-| FunctionPointerFlow.cs:59:9:59:13 | function pointer call | FunctionPointerFlow.cs:24:24:24:25 | M4 | FunctionPointerFlow.cs:64:13:64:15 | &... |
-| FunctionPointerFlow.cs:69:9:69:13 | function pointer call | FunctionPointerFlow.cs:72:24:72:26 | M17 | FunctionPointerFlow.cs:81:13:81:16 | &... |
+fptrCall
+| FunctionPointerFlow.cs:14:9:14:12 | function pointer call | FunctionPointerFlow.cs:5:24:5:27 | Log1 |
+| FunctionPointerFlow.cs:14:9:14:12 | function pointer call | FunctionPointerFlow.cs:6:24:6:27 | Log2 |
+| FunctionPointerFlow.cs:14:9:14:12 | function pointer call | FunctionPointerFlow.cs:10:24:10:27 | Log6 |
+| FunctionPointerFlow.cs:14:9:14:12 | function pointer call | FunctionPointerFlow.cs:46:9:46:44 | LocalFunction |
+| FunctionPointerFlow.cs:16:9:16:12 | function pointer call | FunctionPointerFlow.cs:7:24:7:27 | Log3 |
+| FunctionPointerFlow.cs:41:9:41:15 | function pointer call | FunctionPointerFlow.cs:8:24:8:27 | Log4 |
+| FunctionPointerFlow.cs:54:9:54:16 | function pointer call | FunctionPointerFlow.cs:9:24:9:27 | Log5 |
+| FunctionPointerFlow.cs:59:9:59:13 | function pointer call | FunctionPointerFlow.cs:24:24:24:25 | M4 |
+| FunctionPointerFlow.cs:69:9:69:13 | function pointer call | FunctionPointerFlow.cs:72:24:72:26 | M17 |
+fptrCallContext
+| FunctionPointerFlow.cs:14:9:14:12 | function pointer call | FunctionPointerFlow.cs:21:9:21:17 | call to method M2 | FunctionPointerFlow.cs:5:24:5:27 | Log1 |
+| FunctionPointerFlow.cs:14:9:14:12 | function pointer call | FunctionPointerFlow.cs:26:9:26:13 | call to method M2 | FunctionPointerFlow.cs:6:24:6:27 | Log2 |
+| FunctionPointerFlow.cs:14:9:14:12 | function pointer call | FunctionPointerFlow.cs:26:9:26:13 | call to method M2 | FunctionPointerFlow.cs:10:24:10:27 | Log6 |
+| FunctionPointerFlow.cs:14:9:14:12 | function pointer call | FunctionPointerFlow.cs:47:9:47:26 | call to method M2 | FunctionPointerFlow.cs:46:9:46:44 | LocalFunction |
+| FunctionPointerFlow.cs:16:9:16:12 | function pointer call | file://:0:0:0:0 | (none) | FunctionPointerFlow.cs:7:24:7:27 | Log3 |
+| FunctionPointerFlow.cs:41:9:41:15 | function pointer call | file://:0:0:0:0 | (none) | FunctionPointerFlow.cs:8:24:8:27 | Log4 |
+| FunctionPointerFlow.cs:54:9:54:16 | function pointer call | file://:0:0:0:0 | (none) | FunctionPointerFlow.cs:9:24:9:27 | Log5 |
+| FunctionPointerFlow.cs:59:9:59:13 | function pointer call | FunctionPointerFlow.cs:64:9:64:23 | call to method M10 | FunctionPointerFlow.cs:24:24:24:25 | M4 |
+| FunctionPointerFlow.cs:69:9:69:13 | function pointer call | FunctionPointerFlow.cs:81:9:81:29 | call to method M16 | FunctionPointerFlow.cs:72:24:72:26 | M17 |
diff --git a/csharp/ql/test/library-tests/dataflow/functionpointers/FunctionPointerFlow.ql b/csharp/ql/test/library-tests/dataflow/functionpointers/FunctionPointerFlow.ql
index 3434d068329..fced49bc9c6 100644
--- a/csharp/ql/test/library-tests/dataflow/functionpointers/FunctionPointerFlow.ql
+++ b/csharp/ql/test/library-tests/dataflow/functionpointers/FunctionPointerFlow.ql
@@ -1,5 +1,38 @@
 import csharp
+import semmle.code.csharp.dataflow.internal.DataFlowImplCommon
+import semmle.code.csharp.dataflow.internal.DataFlowDispatch
 
-query predicate fptrCall(FunctionPointerCall fptrc, Callable c, CallContext::CallContext cc) {
-  c = fptrc.getARuntimeTarget(cc)
+query predicate fptrCall(FunctionPointerCall dc, Callable c) { c = dc.getARuntimeTarget() }
+
+private class LocatableDataFlowCallOption extends DataFlowCallOption {
+  Location getLocation() {
+    this = TDataFlowCallNone() and
+    result instanceof EmptyLocation
+    or
+    exists(DataFlowCall call |
+      this = TDataFlowCallSome(call) and
+      result = call.getLocation()
+    )
+  }
+}
+
+private class LocatableDataFlowCall extends TDataFlowCall {
+  LocatableDataFlowCall() {
+    this.(ExplicitDelegateLikeDataFlowCall).getCall() instanceof FunctionPointerCall
+  }
+
+  string toString() { result = this.(DataFlowCall).toString() }
+
+  Location getLocation() {
+    exists(Location l |
+      l = this.(DataFlowCall).getLocation() and
+      if l instanceof SourceLocation then result = l else result instanceof EmptyLocation
+    )
+  }
+}
+
+query predicate fptrCallContext(
+  LocatableDataFlowCall call, LocatableDataFlowCallOption lastCall, DataFlowCallable target
+) {
+  target = viableCallableLambda(call, lastCall)
 }
diff --git a/csharp/ql/test/library-tests/dataflow/global/DataFlow.expected b/csharp/ql/test/library-tests/dataflow/global/DataFlow.expected
index 9c382aaee62..b0506ab3e4e 100644
--- a/csharp/ql/test/library-tests/dataflow/global/DataFlow.expected
+++ b/csharp/ql/test/library-tests/dataflow/global/DataFlow.expected
@@ -52,6 +52,7 @@
 | GlobalDataFlow.cs:401:15:401:20 | access to local variable sink11 |
 | GlobalDataFlow.cs:424:41:424:46 | access to local variable sink20 |
 | GlobalDataFlow.cs:475:15:475:20 | access to local variable sink45 |
+| GlobalDataFlow.cs:483:32:483:32 | access to parameter s |
 | Splitting.cs:9:15:9:15 | [b (line 3): false] access to local variable x |
 | Splitting.cs:9:15:9:15 | [b (line 3): true] access to local variable x |
 | Splitting.cs:11:19:11:19 | access to local variable x |
diff --git a/csharp/ql/test/library-tests/dataflow/global/DataFlowPath.expected b/csharp/ql/test/library-tests/dataflow/global/DataFlowPath.expected
index a806a9a6256..41258053f33 100644
--- a/csharp/ql/test/library-tests/dataflow/global/DataFlowPath.expected
+++ b/csharp/ql/test/library-tests/dataflow/global/DataFlowPath.expected
@@ -119,30 +119,30 @@ edges
 | GlobalDataFlow.cs:79:30:79:34 | SSA def(sink3) : String | GlobalDataFlow.cs:80:15:80:19 | access to local variable sink3 |
 | GlobalDataFlow.cs:79:30:79:34 | SSA def(sink3) : String | GlobalDataFlow.cs:81:59:81:63 | access to local variable sink3 : String |
 | GlobalDataFlow.cs:79:30:79:34 | SSA def(sink3) : String | GlobalDataFlow.cs:136:29:136:33 | access to local variable sink3 : String |
-| GlobalDataFlow.cs:81:22:81:85 | call to method SelectEven [[]] : String | GlobalDataFlow.cs:81:22:81:93 | call to method First : String |
+| GlobalDataFlow.cs:81:22:81:85 | call to method SelectEven [element] : String | GlobalDataFlow.cs:81:22:81:93 | call to method First : String |
 | GlobalDataFlow.cs:81:22:81:93 | call to method First : String | GlobalDataFlow.cs:82:15:82:20 | access to local variable sink13 |
 | GlobalDataFlow.cs:81:22:81:93 | call to method First : String | GlobalDataFlow.cs:83:59:83:64 | access to local variable sink13 : String |
-| GlobalDataFlow.cs:81:23:81:65 | (...) ... [[]] : String | GlobalDataFlow.cs:81:22:81:85 | call to method SelectEven [[]] : String |
-| GlobalDataFlow.cs:81:57:81:65 | { ..., ... } [[]] : String | GlobalDataFlow.cs:81:23:81:65 | (...) ... [[]] : String |
-| GlobalDataFlow.cs:81:59:81:63 | access to local variable sink3 : String | GlobalDataFlow.cs:81:57:81:65 | { ..., ... } [[]] : String |
-| GlobalDataFlow.cs:83:22:83:87 | call to method Select [[]] : String | GlobalDataFlow.cs:83:22:83:95 | call to method First : String |
+| GlobalDataFlow.cs:81:23:81:65 | (...) ... [element] : String | GlobalDataFlow.cs:81:22:81:85 | call to method SelectEven [element] : String |
+| GlobalDataFlow.cs:81:57:81:65 | { ..., ... } [element] : String | GlobalDataFlow.cs:81:23:81:65 | (...) ... [element] : String |
+| GlobalDataFlow.cs:81:59:81:63 | access to local variable sink3 : String | GlobalDataFlow.cs:81:57:81:65 | { ..., ... } [element] : String |
+| GlobalDataFlow.cs:83:22:83:87 | call to method Select [element] : String | GlobalDataFlow.cs:83:22:83:95 | call to method First : String |
 | GlobalDataFlow.cs:83:22:83:95 | call to method First : String | GlobalDataFlow.cs:84:15:84:20 | access to local variable sink14 |
 | GlobalDataFlow.cs:83:22:83:95 | call to method First : String | GlobalDataFlow.cs:85:59:85:64 | access to local variable sink14 : String |
-| GlobalDataFlow.cs:83:23:83:66 | (...) ... [[]] : String | GlobalDataFlow.cs:83:22:83:87 | call to method Select [[]] : String |
-| GlobalDataFlow.cs:83:23:83:66 | (...) ... [[]] : String | GlobalDataFlow.cs:312:31:312:40 | sinkParam8 : String |
-| GlobalDataFlow.cs:83:57:83:66 | { ..., ... } [[]] : String | GlobalDataFlow.cs:83:23:83:66 | (...) ... [[]] : String |
-| GlobalDataFlow.cs:83:59:83:64 | access to local variable sink13 : String | GlobalDataFlow.cs:83:57:83:66 | { ..., ... } [[]] : String |
-| GlobalDataFlow.cs:85:22:85:128 | call to method Zip [[]] : String | GlobalDataFlow.cs:85:22:85:136 | call to method First : String |
+| GlobalDataFlow.cs:83:23:83:66 | (...) ... [element] : String | GlobalDataFlow.cs:83:22:83:87 | call to method Select [element] : String |
+| GlobalDataFlow.cs:83:23:83:66 | (...) ... [element] : String | GlobalDataFlow.cs:312:31:312:40 | sinkParam8 : String |
+| GlobalDataFlow.cs:83:57:83:66 | { ..., ... } [element] : String | GlobalDataFlow.cs:83:23:83:66 | (...) ... [element] : String |
+| GlobalDataFlow.cs:83:59:83:64 | access to local variable sink13 : String | GlobalDataFlow.cs:83:57:83:66 | { ..., ... } [element] : String |
+| GlobalDataFlow.cs:85:22:85:128 | call to method Zip [element] : String | GlobalDataFlow.cs:85:22:85:136 | call to method First : String |
 | GlobalDataFlow.cs:85:22:85:136 | call to method First : String | GlobalDataFlow.cs:86:15:86:20 | access to local variable sink15 |
 | GlobalDataFlow.cs:85:22:85:136 | call to method First : String | GlobalDataFlow.cs:87:106:87:111 | access to local variable sink15 : String |
-| GlobalDataFlow.cs:85:23:85:66 | (...) ... [[]] : String | GlobalDataFlow.cs:85:22:85:128 | call to method Zip [[]] : String |
-| GlobalDataFlow.cs:85:57:85:66 | { ..., ... } [[]] : String | GlobalDataFlow.cs:85:23:85:66 | (...) ... [[]] : String |
-| GlobalDataFlow.cs:85:59:85:64 | access to local variable sink14 : String | GlobalDataFlow.cs:85:57:85:66 | { ..., ... } [[]] : String |
-| GlobalDataFlow.cs:87:22:87:128 | call to method Zip [[]] : String | GlobalDataFlow.cs:87:22:87:136 | call to method First : String |
+| GlobalDataFlow.cs:85:23:85:66 | (...) ... [element] : String | GlobalDataFlow.cs:85:22:85:128 | call to method Zip [element] : String |
+| GlobalDataFlow.cs:85:57:85:66 | { ..., ... } [element] : String | GlobalDataFlow.cs:85:23:85:66 | (...) ... [element] : String |
+| GlobalDataFlow.cs:85:59:85:64 | access to local variable sink14 : String | GlobalDataFlow.cs:85:57:85:66 | { ..., ... } [element] : String |
+| GlobalDataFlow.cs:87:22:87:128 | call to method Zip [element] : String | GlobalDataFlow.cs:87:22:87:136 | call to method First : String |
 | GlobalDataFlow.cs:87:22:87:136 | call to method First : String | GlobalDataFlow.cs:88:15:88:20 | access to local variable sink16 |
-| GlobalDataFlow.cs:87:70:87:113 | (...) ... [[]] : String | GlobalDataFlow.cs:87:22:87:128 | call to method Zip [[]] : String |
-| GlobalDataFlow.cs:87:104:87:113 | { ..., ... } [[]] : String | GlobalDataFlow.cs:87:70:87:113 | (...) ... [[]] : String |
-| GlobalDataFlow.cs:87:106:87:111 | access to local variable sink15 : String | GlobalDataFlow.cs:87:104:87:113 | { ..., ... } [[]] : String |
+| GlobalDataFlow.cs:87:70:87:113 | (...) ... [element] : String | GlobalDataFlow.cs:87:22:87:128 | call to method Zip [element] : String |
+| GlobalDataFlow.cs:87:104:87:113 | { ..., ... } [element] : String | GlobalDataFlow.cs:87:70:87:113 | (...) ... [element] : String |
+| GlobalDataFlow.cs:87:106:87:111 | access to local variable sink15 : String | GlobalDataFlow.cs:87:104:87:113 | { ..., ... } [element] : String |
 | GlobalDataFlow.cs:136:21:136:34 | delegate call : String | GlobalDataFlow.cs:137:15:137:19 | access to local variable sink4 |
 | GlobalDataFlow.cs:136:21:136:34 | delegate call : String | GlobalDataFlow.cs:144:39:144:43 | access to local variable sink4 : String |
 | GlobalDataFlow.cs:136:29:136:33 | access to local variable sink3 : String | GlobalDataFlow.cs:136:21:136:34 | delegate call : String |
@@ -151,42 +151,42 @@ edges
 | GlobalDataFlow.cs:154:21:154:25 | call to method Out : String | GlobalDataFlow.cs:155:15:155:19 | access to local variable sink6 |
 | GlobalDataFlow.cs:157:20:157:24 | SSA def(sink7) : String | GlobalDataFlow.cs:158:15:158:19 | access to local variable sink7 |
 | GlobalDataFlow.cs:160:20:160:24 | SSA def(sink8) : String | GlobalDataFlow.cs:161:15:161:19 | access to local variable sink8 |
-| GlobalDataFlow.cs:162:22:162:31 | call to method OutYield [[]] : String | GlobalDataFlow.cs:162:22:162:39 | call to method First : String |
+| GlobalDataFlow.cs:162:22:162:31 | call to method OutYield [element] : String | GlobalDataFlow.cs:162:22:162:39 | call to method First : String |
 | GlobalDataFlow.cs:162:22:162:39 | call to method First : String | GlobalDataFlow.cs:163:15:163:20 | access to local variable sink12 |
 | GlobalDataFlow.cs:164:22:164:43 | call to method TaintedParam : String | GlobalDataFlow.cs:165:15:165:20 | access to local variable sink23 |
 | GlobalDataFlow.cs:180:35:180:48 | "taint source" : String | GlobalDataFlow.cs:181:21:181:26 | delegate call : String |
 | GlobalDataFlow.cs:181:21:181:26 | delegate call : String | GlobalDataFlow.cs:182:15:182:19 | access to local variable sink9 |
-| GlobalDataFlow.cs:190:22:190:42 | object creation of type Lazy<String> [Value] : String | GlobalDataFlow.cs:190:22:190:48 | access to property Value : String |
+| GlobalDataFlow.cs:190:22:190:42 | object creation of type Lazy<String> [property Value] : String | GlobalDataFlow.cs:190:22:190:48 | access to property Value : String |
 | GlobalDataFlow.cs:190:22:190:48 | access to property Value : String | GlobalDataFlow.cs:191:15:191:20 | access to local variable sink10 |
 | GlobalDataFlow.cs:198:22:198:32 | access to property OutProperty : String | GlobalDataFlow.cs:199:15:199:20 | access to local variable sink19 |
-| GlobalDataFlow.cs:208:38:208:61 | array creation of type String[] [[]] : String | GlobalDataFlow.cs:208:38:208:75 | call to method AsQueryable [[]] : String |
-| GlobalDataFlow.cs:208:38:208:75 | call to method AsQueryable [[]] : String | GlobalDataFlow.cs:213:22:213:28 | access to local variable tainted [[]] : String |
-| GlobalDataFlow.cs:208:38:208:75 | call to method AsQueryable [[]] : String | GlobalDataFlow.cs:215:22:215:28 | access to local variable tainted [[]] : String |
-| GlobalDataFlow.cs:208:38:208:75 | call to method AsQueryable [[]] : String | GlobalDataFlow.cs:217:22:217:28 | access to local variable tainted [[]] : String |
-| GlobalDataFlow.cs:208:44:208:61 | { ..., ... } [[]] : String | GlobalDataFlow.cs:208:38:208:61 | array creation of type String[] [[]] : String |
-| GlobalDataFlow.cs:208:46:208:59 | "taint source" : String | GlobalDataFlow.cs:208:44:208:61 | { ..., ... } [[]] : String |
+| GlobalDataFlow.cs:208:38:208:61 | array creation of type String[] [element] : String | GlobalDataFlow.cs:208:38:208:75 | call to method AsQueryable [element] : String |
+| GlobalDataFlow.cs:208:38:208:75 | call to method AsQueryable [element] : String | GlobalDataFlow.cs:213:22:213:28 | access to local variable tainted [element] : String |
+| GlobalDataFlow.cs:208:38:208:75 | call to method AsQueryable [element] : String | GlobalDataFlow.cs:215:22:215:28 | access to local variable tainted [element] : String |
+| GlobalDataFlow.cs:208:38:208:75 | call to method AsQueryable [element] : String | GlobalDataFlow.cs:217:22:217:28 | access to local variable tainted [element] : String |
+| GlobalDataFlow.cs:208:44:208:61 | { ..., ... } [element] : String | GlobalDataFlow.cs:208:38:208:61 | array creation of type String[] [element] : String |
+| GlobalDataFlow.cs:208:46:208:59 | "taint source" : String | GlobalDataFlow.cs:208:44:208:61 | { ..., ... } [element] : String |
 | GlobalDataFlow.cs:211:35:211:45 | sinkParam10 : String | GlobalDataFlow.cs:211:58:211:68 | access to parameter sinkParam10 |
 | GlobalDataFlow.cs:212:71:212:71 | x : String | GlobalDataFlow.cs:212:89:212:89 | access to parameter x : String |
 | GlobalDataFlow.cs:212:89:212:89 | access to parameter x : String | GlobalDataFlow.cs:318:32:318:41 | sinkParam9 : String |
-| GlobalDataFlow.cs:213:22:213:28 | access to local variable tainted [[]] : String | GlobalDataFlow.cs:211:35:211:45 | sinkParam10 : String |
-| GlobalDataFlow.cs:213:22:213:28 | access to local variable tainted [[]] : String | GlobalDataFlow.cs:213:22:213:39 | call to method Select [[]] : String |
-| GlobalDataFlow.cs:213:22:213:39 | call to method Select [[]] : String | GlobalDataFlow.cs:213:22:213:47 | call to method First : String |
+| GlobalDataFlow.cs:213:22:213:28 | access to local variable tainted [element] : String | GlobalDataFlow.cs:211:35:211:45 | sinkParam10 : String |
+| GlobalDataFlow.cs:213:22:213:28 | access to local variable tainted [element] : String | GlobalDataFlow.cs:213:22:213:39 | call to method Select [element] : String |
+| GlobalDataFlow.cs:213:22:213:39 | call to method Select [element] : String | GlobalDataFlow.cs:213:22:213:47 | call to method First : String |
 | GlobalDataFlow.cs:213:22:213:47 | call to method First : String | GlobalDataFlow.cs:214:15:214:20 | access to local variable sink24 |
-| GlobalDataFlow.cs:215:22:215:28 | access to local variable tainted [[]] : String | GlobalDataFlow.cs:212:71:212:71 | x : String |
-| GlobalDataFlow.cs:215:22:215:28 | access to local variable tainted [[]] : String | GlobalDataFlow.cs:215:22:215:39 | call to method Select [[]] : String |
-| GlobalDataFlow.cs:215:22:215:39 | call to method Select [[]] : String | GlobalDataFlow.cs:215:22:215:47 | call to method First : String |
+| GlobalDataFlow.cs:215:22:215:28 | access to local variable tainted [element] : String | GlobalDataFlow.cs:212:71:212:71 | x : String |
+| GlobalDataFlow.cs:215:22:215:28 | access to local variable tainted [element] : String | GlobalDataFlow.cs:215:22:215:39 | call to method Select [element] : String |
+| GlobalDataFlow.cs:215:22:215:39 | call to method Select [element] : String | GlobalDataFlow.cs:215:22:215:47 | call to method First : String |
 | GlobalDataFlow.cs:215:22:215:47 | call to method First : String | GlobalDataFlow.cs:216:15:216:20 | access to local variable sink25 |
-| GlobalDataFlow.cs:217:22:217:28 | access to local variable tainted [[]] : String | GlobalDataFlow.cs:217:22:217:49 | call to method Select [[]] : String |
-| GlobalDataFlow.cs:217:22:217:28 | access to local variable tainted [[]] : String | GlobalDataFlow.cs:324:32:324:42 | sinkParam11 : String |
-| GlobalDataFlow.cs:217:22:217:49 | call to method Select [[]] : String | GlobalDataFlow.cs:217:22:217:57 | call to method First : String |
+| GlobalDataFlow.cs:217:22:217:28 | access to local variable tainted [element] : String | GlobalDataFlow.cs:217:22:217:49 | call to method Select [element] : String |
+| GlobalDataFlow.cs:217:22:217:28 | access to local variable tainted [element] : String | GlobalDataFlow.cs:324:32:324:42 | sinkParam11 : String |
+| GlobalDataFlow.cs:217:22:217:49 | call to method Select [element] : String | GlobalDataFlow.cs:217:22:217:57 | call to method First : String |
 | GlobalDataFlow.cs:217:22:217:57 | call to method First : String | GlobalDataFlow.cs:218:15:218:20 | access to local variable sink26 |
-| GlobalDataFlow.cs:238:20:238:49 | call to method Run [Result] : String | GlobalDataFlow.cs:239:22:239:25 | access to local variable task [Result] : String |
-| GlobalDataFlow.cs:238:20:238:49 | call to method Run [Result] : String | GlobalDataFlow.cs:241:28:241:31 | access to local variable task [Result] : String |
-| GlobalDataFlow.cs:238:35:238:48 | "taint source" : String | GlobalDataFlow.cs:238:20:238:49 | call to method Run [Result] : String |
-| GlobalDataFlow.cs:239:22:239:25 | access to local variable task [Result] : String | GlobalDataFlow.cs:239:22:239:32 | access to property Result : String |
+| GlobalDataFlow.cs:238:20:238:49 | call to method Run [property Result] : String | GlobalDataFlow.cs:239:22:239:25 | access to local variable task [property Result] : String |
+| GlobalDataFlow.cs:238:20:238:49 | call to method Run [property Result] : String | GlobalDataFlow.cs:241:28:241:31 | access to local variable task [property Result] : String |
+| GlobalDataFlow.cs:238:35:238:48 | "taint source" : String | GlobalDataFlow.cs:238:20:238:49 | call to method Run [property Result] : String |
+| GlobalDataFlow.cs:239:22:239:25 | access to local variable task [property Result] : String | GlobalDataFlow.cs:239:22:239:32 | access to property Result : String |
 | GlobalDataFlow.cs:239:22:239:32 | access to property Result : String | GlobalDataFlow.cs:240:15:240:20 | access to local variable sink41 |
 | GlobalDataFlow.cs:241:22:241:31 | await ... : String | GlobalDataFlow.cs:242:15:242:20 | access to local variable sink42 |
-| GlobalDataFlow.cs:241:28:241:31 | access to local variable task [Result] : String | GlobalDataFlow.cs:241:22:241:31 | await ... : String |
+| GlobalDataFlow.cs:241:28:241:31 | access to local variable task [property Result] : String | GlobalDataFlow.cs:241:22:241:31 | await ... : String |
 | GlobalDataFlow.cs:254:26:254:35 | sinkParam0 : String | GlobalDataFlow.cs:256:16:256:25 | access to parameter sinkParam0 : String |
 | GlobalDataFlow.cs:254:26:254:35 | sinkParam0 : String | GlobalDataFlow.cs:257:15:257:24 | access to parameter sinkParam0 |
 | GlobalDataFlow.cs:256:16:256:25 | access to parameter sinkParam0 : String | GlobalDataFlow.cs:254:26:254:35 | sinkParam0 : String |
@@ -200,12 +200,12 @@ edges
 | GlobalDataFlow.cs:318:32:318:41 | sinkParam9 : String | GlobalDataFlow.cs:320:15:320:24 | access to parameter sinkParam9 |
 | GlobalDataFlow.cs:324:32:324:42 | sinkParam11 : String | GlobalDataFlow.cs:326:15:326:25 | access to parameter sinkParam11 |
 | GlobalDataFlow.cs:338:16:338:29 | "taint source" : String | GlobalDataFlow.cs:154:21:154:25 | call to method Out : String |
-| GlobalDataFlow.cs:338:16:338:29 | "taint source" : String | GlobalDataFlow.cs:190:22:190:42 | object creation of type Lazy<String> [Value] : String |
+| GlobalDataFlow.cs:338:16:338:29 | "taint source" : String | GlobalDataFlow.cs:190:22:190:42 | object creation of type Lazy<String> [property Value] : String |
 | GlobalDataFlow.cs:343:9:343:26 | SSA def(x) : String | GlobalDataFlow.cs:157:20:157:24 | SSA def(sink7) : String |
 | GlobalDataFlow.cs:343:13:343:26 | "taint source" : String | GlobalDataFlow.cs:343:9:343:26 | SSA def(x) : String |
 | GlobalDataFlow.cs:348:9:348:26 | SSA def(x) : String | GlobalDataFlow.cs:160:20:160:24 | SSA def(sink8) : String |
 | GlobalDataFlow.cs:348:13:348:26 | "taint source" : String | GlobalDataFlow.cs:348:9:348:26 | SSA def(x) : String |
-| GlobalDataFlow.cs:354:22:354:35 | "taint source" : String | GlobalDataFlow.cs:162:22:162:31 | call to method OutYield [[]] : String |
+| GlobalDataFlow.cs:354:22:354:35 | "taint source" : String | GlobalDataFlow.cs:162:22:162:31 | call to method OutYield [element] : String |
 | GlobalDataFlow.cs:379:41:379:41 | x : String | GlobalDataFlow.cs:381:11:381:11 | access to parameter x : String |
 | GlobalDataFlow.cs:379:41:379:41 | x : String | GlobalDataFlow.cs:381:11:381:11 | access to parameter x : String |
 | GlobalDataFlow.cs:381:11:381:11 | access to parameter x : String | GlobalDataFlow.cs:54:15:54:15 | x : String |
@@ -221,14 +221,18 @@ edges
 | GlobalDataFlow.cs:402:16:402:21 | access to local variable sink11 : String | GlobalDataFlow.cs:164:22:164:43 | call to method TaintedParam : String |
 | GlobalDataFlow.cs:424:9:424:11 | value : String | GlobalDataFlow.cs:424:41:424:46 | access to local variable sink20 |
 | GlobalDataFlow.cs:435:22:435:35 | "taint source" : String | GlobalDataFlow.cs:198:22:198:32 | access to property OutProperty : String |
-| GlobalDataFlow.cs:471:20:471:49 | call to method Run [Result] : String | GlobalDataFlow.cs:472:25:472:28 | access to local variable task [Result] : String |
-| GlobalDataFlow.cs:471:35:471:48 | "taint source" : String | GlobalDataFlow.cs:471:20:471:49 | call to method Run [Result] : String |
-| GlobalDataFlow.cs:472:25:472:28 | access to local variable task [Result] : String | GlobalDataFlow.cs:472:25:472:50 | call to method ConfigureAwait [m_configuredTaskAwaiter, m_task, Result] : String |
-| GlobalDataFlow.cs:472:25:472:50 | call to method ConfigureAwait [m_configuredTaskAwaiter, m_task, Result] : String | GlobalDataFlow.cs:473:23:473:31 | access to local variable awaitable [m_configuredTaskAwaiter, m_task, Result] : String |
-| GlobalDataFlow.cs:473:23:473:31 | access to local variable awaitable [m_configuredTaskAwaiter, m_task, Result] : String | GlobalDataFlow.cs:473:23:473:44 | call to method GetAwaiter [m_task, Result] : String |
-| GlobalDataFlow.cs:473:23:473:44 | call to method GetAwaiter [m_task, Result] : String | GlobalDataFlow.cs:474:22:474:28 | access to local variable awaiter [m_task, Result] : String |
-| GlobalDataFlow.cs:474:22:474:28 | access to local variable awaiter [m_task, Result] : String | GlobalDataFlow.cs:474:22:474:40 | call to method GetResult : String |
+| GlobalDataFlow.cs:471:20:471:49 | call to method Run [property Result] : String | GlobalDataFlow.cs:472:25:472:28 | access to local variable task [property Result] : String |
+| GlobalDataFlow.cs:471:35:471:48 | "taint source" : String | GlobalDataFlow.cs:471:20:471:49 | call to method Run [property Result] : String |
+| GlobalDataFlow.cs:472:25:472:28 | access to local variable task [property Result] : String | GlobalDataFlow.cs:472:25:472:50 | call to method ConfigureAwait [field m_configuredTaskAwaiter, field m_task, property Result] : String |
+| GlobalDataFlow.cs:472:25:472:50 | call to method ConfigureAwait [field m_configuredTaskAwaiter, field m_task, property Result] : String | GlobalDataFlow.cs:473:23:473:31 | access to local variable awaitable [field m_configuredTaskAwaiter, field m_task, property Result] : String |
+| GlobalDataFlow.cs:473:23:473:31 | access to local variable awaitable [field m_configuredTaskAwaiter, field m_task, property Result] : String | GlobalDataFlow.cs:473:23:473:44 | call to method GetAwaiter [field m_task, property Result] : String |
+| GlobalDataFlow.cs:473:23:473:44 | call to method GetAwaiter [field m_task, property Result] : String | GlobalDataFlow.cs:474:22:474:28 | access to local variable awaiter [field m_task, property Result] : String |
+| GlobalDataFlow.cs:474:22:474:28 | access to local variable awaiter [field m_task, property Result] : String | GlobalDataFlow.cs:474:22:474:40 | call to method GetResult : String |
 | GlobalDataFlow.cs:474:22:474:40 | call to method GetResult : String | GlobalDataFlow.cs:475:15:475:20 | access to local variable sink45 |
+| GlobalDataFlow.cs:480:53:480:55 | arg : String | GlobalDataFlow.cs:484:15:484:17 | access to parameter arg : String |
+| GlobalDataFlow.cs:483:21:483:21 | s : String | GlobalDataFlow.cs:483:32:483:32 | access to parameter s |
+| GlobalDataFlow.cs:484:15:484:17 | access to parameter arg : String | GlobalDataFlow.cs:483:21:483:21 | s : String |
+| GlobalDataFlow.cs:487:27:487:40 | "taint source" : String | GlobalDataFlow.cs:480:53:480:55 | arg : String |
 | Splitting.cs:3:28:3:34 | tainted : String | Splitting.cs:8:24:8:30 | [b (line 3): false] access to parameter tainted : String |
 | Splitting.cs:3:28:3:34 | tainted : String | Splitting.cs:8:24:8:30 | [b (line 3): true] access to parameter tainted : String |
 | Splitting.cs:8:17:8:31 | [b (line 3): false] call to method Return : String | Splitting.cs:9:15:9:15 | [b (line 3): false] access to local variable x |
@@ -315,28 +319,28 @@ nodes
 | GlobalDataFlow.cs:79:19:79:23 | access to local variable sink2 : String | semmle.label | access to local variable sink2 : String |
 | GlobalDataFlow.cs:79:30:79:34 | SSA def(sink3) : String | semmle.label | SSA def(sink3) : String |
 | GlobalDataFlow.cs:80:15:80:19 | access to local variable sink3 | semmle.label | access to local variable sink3 |
-| GlobalDataFlow.cs:81:22:81:85 | call to method SelectEven [[]] : String | semmle.label | call to method SelectEven [[]] : String |
+| GlobalDataFlow.cs:81:22:81:85 | call to method SelectEven [element] : String | semmle.label | call to method SelectEven [element] : String |
 | GlobalDataFlow.cs:81:22:81:93 | call to method First : String | semmle.label | call to method First : String |
-| GlobalDataFlow.cs:81:23:81:65 | (...) ... [[]] : String | semmle.label | (...) ... [[]] : String |
-| GlobalDataFlow.cs:81:57:81:65 | { ..., ... } [[]] : String | semmle.label | { ..., ... } [[]] : String |
+| GlobalDataFlow.cs:81:23:81:65 | (...) ... [element] : String | semmle.label | (...) ... [element] : String |
+| GlobalDataFlow.cs:81:57:81:65 | { ..., ... } [element] : String | semmle.label | { ..., ... } [element] : String |
 | GlobalDataFlow.cs:81:59:81:63 | access to local variable sink3 : String | semmle.label | access to local variable sink3 : String |
 | GlobalDataFlow.cs:82:15:82:20 | access to local variable sink13 | semmle.label | access to local variable sink13 |
-| GlobalDataFlow.cs:83:22:83:87 | call to method Select [[]] : String | semmle.label | call to method Select [[]] : String |
+| GlobalDataFlow.cs:83:22:83:87 | call to method Select [element] : String | semmle.label | call to method Select [element] : String |
 | GlobalDataFlow.cs:83:22:83:95 | call to method First : String | semmle.label | call to method First : String |
-| GlobalDataFlow.cs:83:23:83:66 | (...) ... [[]] : String | semmle.label | (...) ... [[]] : String |
-| GlobalDataFlow.cs:83:57:83:66 | { ..., ... } [[]] : String | semmle.label | { ..., ... } [[]] : String |
+| GlobalDataFlow.cs:83:23:83:66 | (...) ... [element] : String | semmle.label | (...) ... [element] : String |
+| GlobalDataFlow.cs:83:57:83:66 | { ..., ... } [element] : String | semmle.label | { ..., ... } [element] : String |
 | GlobalDataFlow.cs:83:59:83:64 | access to local variable sink13 : String | semmle.label | access to local variable sink13 : String |
 | GlobalDataFlow.cs:84:15:84:20 | access to local variable sink14 | semmle.label | access to local variable sink14 |
-| GlobalDataFlow.cs:85:22:85:128 | call to method Zip [[]] : String | semmle.label | call to method Zip [[]] : String |
+| GlobalDataFlow.cs:85:22:85:128 | call to method Zip [element] : String | semmle.label | call to method Zip [element] : String |
 | GlobalDataFlow.cs:85:22:85:136 | call to method First : String | semmle.label | call to method First : String |
-| GlobalDataFlow.cs:85:23:85:66 | (...) ... [[]] : String | semmle.label | (...) ... [[]] : String |
-| GlobalDataFlow.cs:85:57:85:66 | { ..., ... } [[]] : String | semmle.label | { ..., ... } [[]] : String |
+| GlobalDataFlow.cs:85:23:85:66 | (...) ... [element] : String | semmle.label | (...) ... [element] : String |
+| GlobalDataFlow.cs:85:57:85:66 | { ..., ... } [element] : String | semmle.label | { ..., ... } [element] : String |
 | GlobalDataFlow.cs:85:59:85:64 | access to local variable sink14 : String | semmle.label | access to local variable sink14 : String |
 | GlobalDataFlow.cs:86:15:86:20 | access to local variable sink15 | semmle.label | access to local variable sink15 |
-| GlobalDataFlow.cs:87:22:87:128 | call to method Zip [[]] : String | semmle.label | call to method Zip [[]] : String |
+| GlobalDataFlow.cs:87:22:87:128 | call to method Zip [element] : String | semmle.label | call to method Zip [element] : String |
 | GlobalDataFlow.cs:87:22:87:136 | call to method First : String | semmle.label | call to method First : String |
-| GlobalDataFlow.cs:87:70:87:113 | (...) ... [[]] : String | semmle.label | (...) ... [[]] : String |
-| GlobalDataFlow.cs:87:104:87:113 | { ..., ... } [[]] : String | semmle.label | { ..., ... } [[]] : String |
+| GlobalDataFlow.cs:87:70:87:113 | (...) ... [element] : String | semmle.label | (...) ... [element] : String |
+| GlobalDataFlow.cs:87:104:87:113 | { ..., ... } [element] : String | semmle.label | { ..., ... } [element] : String |
 | GlobalDataFlow.cs:87:106:87:111 | access to local variable sink15 : String | semmle.label | access to local variable sink15 : String |
 | GlobalDataFlow.cs:88:15:88:20 | access to local variable sink16 | semmle.label | access to local variable sink16 |
 | GlobalDataFlow.cs:136:21:136:34 | delegate call : String | semmle.label | delegate call : String |
@@ -351,7 +355,7 @@ nodes
 | GlobalDataFlow.cs:158:15:158:19 | access to local variable sink7 | semmle.label | access to local variable sink7 |
 | GlobalDataFlow.cs:160:20:160:24 | SSA def(sink8) : String | semmle.label | SSA def(sink8) : String |
 | GlobalDataFlow.cs:161:15:161:19 | access to local variable sink8 | semmle.label | access to local variable sink8 |
-| GlobalDataFlow.cs:162:22:162:31 | call to method OutYield [[]] : String | semmle.label | call to method OutYield [[]] : String |
+| GlobalDataFlow.cs:162:22:162:31 | call to method OutYield [element] : String | semmle.label | call to method OutYield [element] : String |
 | GlobalDataFlow.cs:162:22:162:39 | call to method First : String | semmle.label | call to method First : String |
 | GlobalDataFlow.cs:163:15:163:20 | access to local variable sink12 | semmle.label | access to local variable sink12 |
 | GlobalDataFlow.cs:164:22:164:43 | call to method TaintedParam : String | semmle.label | call to method TaintedParam : String |
@@ -359,38 +363,38 @@ nodes
 | GlobalDataFlow.cs:180:35:180:48 | "taint source" : String | semmle.label | "taint source" : String |
 | GlobalDataFlow.cs:181:21:181:26 | delegate call : String | semmle.label | delegate call : String |
 | GlobalDataFlow.cs:182:15:182:19 | access to local variable sink9 | semmle.label | access to local variable sink9 |
-| GlobalDataFlow.cs:190:22:190:42 | object creation of type Lazy<String> [Value] : String | semmle.label | object creation of type Lazy<String> [Value] : String |
+| GlobalDataFlow.cs:190:22:190:42 | object creation of type Lazy<String> [property Value] : String | semmle.label | object creation of type Lazy<String> [property Value] : String |
 | GlobalDataFlow.cs:190:22:190:48 | access to property Value : String | semmle.label | access to property Value : String |
 | GlobalDataFlow.cs:191:15:191:20 | access to local variable sink10 | semmle.label | access to local variable sink10 |
 | GlobalDataFlow.cs:198:22:198:32 | access to property OutProperty : String | semmle.label | access to property OutProperty : String |
 | GlobalDataFlow.cs:199:15:199:20 | access to local variable sink19 | semmle.label | access to local variable sink19 |
-| GlobalDataFlow.cs:208:38:208:61 | array creation of type String[] [[]] : String | semmle.label | array creation of type String[] [[]] : String |
-| GlobalDataFlow.cs:208:38:208:75 | call to method AsQueryable [[]] : String | semmle.label | call to method AsQueryable [[]] : String |
-| GlobalDataFlow.cs:208:44:208:61 | { ..., ... } [[]] : String | semmle.label | { ..., ... } [[]] : String |
+| GlobalDataFlow.cs:208:38:208:61 | array creation of type String[] [element] : String | semmle.label | array creation of type String[] [element] : String |
+| GlobalDataFlow.cs:208:38:208:75 | call to method AsQueryable [element] : String | semmle.label | call to method AsQueryable [element] : String |
+| GlobalDataFlow.cs:208:44:208:61 | { ..., ... } [element] : String | semmle.label | { ..., ... } [element] : String |
 | GlobalDataFlow.cs:208:46:208:59 | "taint source" : String | semmle.label | "taint source" : String |
 | GlobalDataFlow.cs:211:35:211:45 | sinkParam10 : String | semmle.label | sinkParam10 : String |
 | GlobalDataFlow.cs:211:58:211:68 | access to parameter sinkParam10 | semmle.label | access to parameter sinkParam10 |
 | GlobalDataFlow.cs:212:71:212:71 | x : String | semmle.label | x : String |
 | GlobalDataFlow.cs:212:89:212:89 | access to parameter x : String | semmle.label | access to parameter x : String |
-| GlobalDataFlow.cs:213:22:213:28 | access to local variable tainted [[]] : String | semmle.label | access to local variable tainted [[]] : String |
-| GlobalDataFlow.cs:213:22:213:39 | call to method Select [[]] : String | semmle.label | call to method Select [[]] : String |
+| GlobalDataFlow.cs:213:22:213:28 | access to local variable tainted [element] : String | semmle.label | access to local variable tainted [element] : String |
+| GlobalDataFlow.cs:213:22:213:39 | call to method Select [element] : String | semmle.label | call to method Select [element] : String |
 | GlobalDataFlow.cs:213:22:213:47 | call to method First : String | semmle.label | call to method First : String |
 | GlobalDataFlow.cs:214:15:214:20 | access to local variable sink24 | semmle.label | access to local variable sink24 |
-| GlobalDataFlow.cs:215:22:215:28 | access to local variable tainted [[]] : String | semmle.label | access to local variable tainted [[]] : String |
-| GlobalDataFlow.cs:215:22:215:39 | call to method Select [[]] : String | semmle.label | call to method Select [[]] : String |
+| GlobalDataFlow.cs:215:22:215:28 | access to local variable tainted [element] : String | semmle.label | access to local variable tainted [element] : String |
+| GlobalDataFlow.cs:215:22:215:39 | call to method Select [element] : String | semmle.label | call to method Select [element] : String |
 | GlobalDataFlow.cs:215:22:215:47 | call to method First : String | semmle.label | call to method First : String |
 | GlobalDataFlow.cs:216:15:216:20 | access to local variable sink25 | semmle.label | access to local variable sink25 |
-| GlobalDataFlow.cs:217:22:217:28 | access to local variable tainted [[]] : String | semmle.label | access to local variable tainted [[]] : String |
-| GlobalDataFlow.cs:217:22:217:49 | call to method Select [[]] : String | semmle.label | call to method Select [[]] : String |
+| GlobalDataFlow.cs:217:22:217:28 | access to local variable tainted [element] : String | semmle.label | access to local variable tainted [element] : String |
+| GlobalDataFlow.cs:217:22:217:49 | call to method Select [element] : String | semmle.label | call to method Select [element] : String |
 | GlobalDataFlow.cs:217:22:217:57 | call to method First : String | semmle.label | call to method First : String |
 | GlobalDataFlow.cs:218:15:218:20 | access to local variable sink26 | semmle.label | access to local variable sink26 |
-| GlobalDataFlow.cs:238:20:238:49 | call to method Run [Result] : String | semmle.label | call to method Run [Result] : String |
+| GlobalDataFlow.cs:238:20:238:49 | call to method Run [property Result] : String | semmle.label | call to method Run [property Result] : String |
 | GlobalDataFlow.cs:238:35:238:48 | "taint source" : String | semmle.label | "taint source" : String |
-| GlobalDataFlow.cs:239:22:239:25 | access to local variable task [Result] : String | semmle.label | access to local variable task [Result] : String |
+| GlobalDataFlow.cs:239:22:239:25 | access to local variable task [property Result] : String | semmle.label | access to local variable task [property Result] : String |
 | GlobalDataFlow.cs:239:22:239:32 | access to property Result : String | semmle.label | access to property Result : String |
 | GlobalDataFlow.cs:240:15:240:20 | access to local variable sink41 | semmle.label | access to local variable sink41 |
 | GlobalDataFlow.cs:241:22:241:31 | await ... : String | semmle.label | await ... : String |
-| GlobalDataFlow.cs:241:28:241:31 | access to local variable task [Result] : String | semmle.label | access to local variable task [Result] : String |
+| GlobalDataFlow.cs:241:28:241:31 | access to local variable task [property Result] : String | semmle.label | access to local variable task [property Result] : String |
 | GlobalDataFlow.cs:242:15:242:20 | access to local variable sink42 | semmle.label | access to local variable sink42 |
 | GlobalDataFlow.cs:254:26:254:35 | sinkParam0 : String | semmle.label | sinkParam0 : String |
 | GlobalDataFlow.cs:256:16:256:25 | access to parameter sinkParam0 : String | semmle.label | access to parameter sinkParam0 : String |
@@ -435,15 +439,20 @@ nodes
 | GlobalDataFlow.cs:424:9:424:11 | value : String | semmle.label | value : String |
 | GlobalDataFlow.cs:424:41:424:46 | access to local variable sink20 | semmle.label | access to local variable sink20 |
 | GlobalDataFlow.cs:435:22:435:35 | "taint source" : String | semmle.label | "taint source" : String |
-| GlobalDataFlow.cs:471:20:471:49 | call to method Run [Result] : String | semmle.label | call to method Run [Result] : String |
+| GlobalDataFlow.cs:471:20:471:49 | call to method Run [property Result] : String | semmle.label | call to method Run [property Result] : String |
 | GlobalDataFlow.cs:471:35:471:48 | "taint source" : String | semmle.label | "taint source" : String |
-| GlobalDataFlow.cs:472:25:472:28 | access to local variable task [Result] : String | semmle.label | access to local variable task [Result] : String |
-| GlobalDataFlow.cs:472:25:472:50 | call to method ConfigureAwait [m_configuredTaskAwaiter, m_task, Result] : String | semmle.label | call to method ConfigureAwait [m_configuredTaskAwaiter, m_task, Result] : String |
-| GlobalDataFlow.cs:473:23:473:31 | access to local variable awaitable [m_configuredTaskAwaiter, m_task, Result] : String | semmle.label | access to local variable awaitable [m_configuredTaskAwaiter, m_task, Result] : String |
-| GlobalDataFlow.cs:473:23:473:44 | call to method GetAwaiter [m_task, Result] : String | semmle.label | call to method GetAwaiter [m_task, Result] : String |
-| GlobalDataFlow.cs:474:22:474:28 | access to local variable awaiter [m_task, Result] : String | semmle.label | access to local variable awaiter [m_task, Result] : String |
+| GlobalDataFlow.cs:472:25:472:28 | access to local variable task [property Result] : String | semmle.label | access to local variable task [property Result] : String |
+| GlobalDataFlow.cs:472:25:472:50 | call to method ConfigureAwait [field m_configuredTaskAwaiter, field m_task, property Result] : String | semmle.label | call to method ConfigureAwait [field m_configuredTaskAwaiter, field m_task, property Result] : String |
+| GlobalDataFlow.cs:473:23:473:31 | access to local variable awaitable [field m_configuredTaskAwaiter, field m_task, property Result] : String | semmle.label | access to local variable awaitable [field m_configuredTaskAwaiter, field m_task, property Result] : String |
+| GlobalDataFlow.cs:473:23:473:44 | call to method GetAwaiter [field m_task, property Result] : String | semmle.label | call to method GetAwaiter [field m_task, property Result] : String |
+| GlobalDataFlow.cs:474:22:474:28 | access to local variable awaiter [field m_task, property Result] : String | semmle.label | access to local variable awaiter [field m_task, property Result] : String |
 | GlobalDataFlow.cs:474:22:474:40 | call to method GetResult : String | semmle.label | call to method GetResult : String |
 | GlobalDataFlow.cs:475:15:475:20 | access to local variable sink45 | semmle.label | access to local variable sink45 |
+| GlobalDataFlow.cs:480:53:480:55 | arg : String | semmle.label | arg : String |
+| GlobalDataFlow.cs:483:21:483:21 | s : String | semmle.label | s : String |
+| GlobalDataFlow.cs:483:32:483:32 | access to parameter s | semmle.label | access to parameter s |
+| GlobalDataFlow.cs:484:15:484:17 | access to parameter arg : String | semmle.label | access to parameter arg : String |
+| GlobalDataFlow.cs:487:27:487:40 | "taint source" : String | semmle.label | "taint source" : String |
 | Splitting.cs:3:28:3:34 | tainted : String | semmle.label | tainted : String |
 | Splitting.cs:8:17:8:31 | [b (line 3): false] call to method Return : String | semmle.label | [b (line 3): false] call to method Return : String |
 | Splitting.cs:8:17:8:31 | [b (line 3): true] call to method Return : String | semmle.label | [b (line 3): true] call to method Return : String |
@@ -520,6 +529,7 @@ nodes
 | GlobalDataFlow.cs:182:15:182:19 | access to local variable sink9 | GlobalDataFlow.cs:180:35:180:48 | "taint source" : String | GlobalDataFlow.cs:182:15:182:19 | access to local variable sink9 | access to local variable sink9 |
 | Splitting.cs:11:19:11:19 | access to local variable x | Splitting.cs:3:28:3:34 | tainted : String | Splitting.cs:11:19:11:19 | access to local variable x | access to local variable x |
 | Splitting.cs:34:19:34:19 | access to local variable x | Splitting.cs:24:28:24:34 | tainted : String | Splitting.cs:34:19:34:19 | access to local variable x | access to local variable x |
+| GlobalDataFlow.cs:483:32:483:32 | access to parameter s | GlobalDataFlow.cs:487:27:487:40 | "taint source" : String | GlobalDataFlow.cs:483:32:483:32 | access to parameter s | access to parameter s |
 | Capture.cs:57:27:57:32 | access to parameter sink39 | Capture.cs:7:20:7:26 | tainted : String | Capture.cs:57:27:57:32 | access to parameter sink39 | access to parameter sink39 |
 | GlobalDataFlow.cs:257:15:257:24 | access to parameter sinkParam0 | GlobalDataFlow.cs:18:27:18:40 | "taint source" : String | GlobalDataFlow.cs:257:15:257:24 | access to parameter sinkParam0 | access to parameter sinkParam0 |
 | GlobalDataFlow.cs:262:15:262:24 | access to parameter sinkParam1 | GlobalDataFlow.cs:18:27:18:40 | "taint source" : String | GlobalDataFlow.cs:262:15:262:24 | access to parameter sinkParam1 | access to parameter sinkParam1 |
diff --git a/csharp/ql/test/library-tests/dataflow/global/GetAnOutNode.expected b/csharp/ql/test/library-tests/dataflow/global/GetAnOutNode.expected
index 5b4957a19e9..ce0ed3c75af 100644
--- a/csharp/ql/test/library-tests/dataflow/global/GetAnOutNode.expected
+++ b/csharp/ql/test/library-tests/dataflow/global/GetAnOutNode.expected
@@ -1,364 +1,313 @@
-| Capture.cs:33:9:33:40 | call to method Select | return | Capture.cs:33:9:33:40 | call to method Select |
-| Capture.cs:33:9:33:40 | call to method Select | yield return | Capture.cs:33:9:33:40 | call to method Select |
-| Capture.cs:33:9:33:50 | call to method ToArray | return | Capture.cs:33:9:33:50 | call to method ToArray |
+| Capture.cs:33:9:33:40 | call to method Select | normal | Capture.cs:33:9:33:40 | call to method Select |
+| Capture.cs:33:9:33:50 | call to method ToArray | normal | Capture.cs:33:9:33:50 | call to method ToArray |
 | Capture.cs:71:9:71:21 | call to local function CaptureOut1 | captured sink30 | Capture.cs:71:9:71:21 | SSA call def(sink30) |
 | Capture.cs:83:9:83:21 | [transitive] call to local function CaptureOut2 | captured sink31 | Capture.cs:83:9:83:21 | SSA call def(sink31) |
 | Capture.cs:92:9:92:41 | [transitive] call to method Select | captured sink32 | Capture.cs:92:9:92:41 | SSA call def(sink32) |
-| Capture.cs:92:9:92:41 | call to method Select | return | Capture.cs:92:9:92:41 | call to method Select |
-| Capture.cs:92:9:92:41 | call to method Select | yield return | Capture.cs:92:9:92:41 | call to method Select |
-| Capture.cs:92:9:92:51 | call to method ToArray | return | Capture.cs:92:9:92:51 | call to method ToArray |
+| Capture.cs:92:9:92:41 | call to method Select | normal | Capture.cs:92:9:92:41 | call to method Select |
+| Capture.cs:92:9:92:51 | call to method ToArray | normal | Capture.cs:92:9:92:51 | call to method ToArray |
 | Capture.cs:121:9:121:35 | [transitive] call to local function CaptureOutMultipleLambdas | captured nonSink0 | Capture.cs:121:9:121:35 | SSA call def(nonSink0) |
 | Capture.cs:121:9:121:35 | [transitive] call to local function CaptureOutMultipleLambdas | captured sink40 | Capture.cs:121:9:121:35 | SSA call def(sink40) |
 | Capture.cs:132:9:132:25 | call to local function CaptureThrough1 | captured sink33 | Capture.cs:132:9:132:25 | SSA call def(sink33) |
 | Capture.cs:144:9:144:25 | [transitive] call to local function CaptureThrough2 | captured sink34 | Capture.cs:144:9:144:25 | SSA call def(sink34) |
 | Capture.cs:153:9:153:45 | [transitive] call to method Select | captured sink35 | Capture.cs:153:9:153:45 | SSA call def(sink35) |
-| Capture.cs:153:9:153:45 | call to method Select | return | Capture.cs:153:9:153:45 | call to method Select |
-| Capture.cs:153:9:153:45 | call to method Select | yield return | Capture.cs:153:9:153:45 | call to method Select |
-| Capture.cs:153:9:153:55 | call to method ToArray | return | Capture.cs:153:9:153:55 | call to method ToArray |
-| Capture.cs:160:22:160:38 | call to local function CaptureThrough4 | return | Capture.cs:160:22:160:38 | call to local function CaptureThrough4 |
+| Capture.cs:153:9:153:45 | call to method Select | normal | Capture.cs:153:9:153:45 | call to method Select |
+| Capture.cs:153:9:153:55 | call to method ToArray | normal | Capture.cs:153:9:153:55 | call to method ToArray |
+| Capture.cs:160:22:160:38 | call to local function CaptureThrough4 | normal | Capture.cs:160:22:160:38 | call to local function CaptureThrough4 |
 | Capture.cs:168:9:168:32 | call to local function CaptureThrough5 | captured sink37 | Capture.cs:168:9:168:32 | SSA call def(sink37) |
-| Capture.cs:191:20:191:22 | call to local function M | return | Capture.cs:191:20:191:22 | call to local function M |
-| Capture.cs:194:22:194:32 | call to local function Id | return | Capture.cs:194:22:194:32 | call to local function Id |
-| Capture.cs:196:20:196:25 | call to local function Id | return | Capture.cs:196:20:196:25 | call to local function Id |
-| GlobalDataFlow.cs:26:9:26:26 | access to property SinkProperty0 | return | GlobalDataFlow.cs:26:9:26:26 | access to property SinkProperty0 |
-| GlobalDataFlow.cs:27:15:27:32 | access to property SinkProperty0 | return | GlobalDataFlow.cs:27:15:27:32 | access to property SinkProperty0 |
-| GlobalDataFlow.cs:30:9:30:29 | access to property NonSinkProperty0 | return | GlobalDataFlow.cs:30:9:30:29 | access to property NonSinkProperty0 |
-| GlobalDataFlow.cs:31:15:31:35 | access to property NonSinkProperty0 | return | GlobalDataFlow.cs:31:15:31:35 | access to property NonSinkProperty0 |
-| GlobalDataFlow.cs:32:9:32:29 | access to property NonSinkProperty1 | return | GlobalDataFlow.cs:32:9:32:29 | access to property NonSinkProperty1 |
-| GlobalDataFlow.cs:33:15:33:35 | access to property NonSinkProperty1 | return | GlobalDataFlow.cs:33:15:33:35 | access to property NonSinkProperty1 |
-| GlobalDataFlow.cs:36:13:36:30 | access to property SinkProperty0 | return | GlobalDataFlow.cs:36:13:36:30 | access to property SinkProperty0 |
-| GlobalDataFlow.cs:37:26:37:58 | call to method GetMethod | qualifier | GlobalDataFlow.cs:37:26:37:41 | [post] typeof(...) |
-| GlobalDataFlow.cs:37:26:37:58 | call to method GetMethod | return | GlobalDataFlow.cs:37:26:37:58 | call to method GetMethod |
-| GlobalDataFlow.cs:38:35:38:52 | access to property SinkProperty0 | return | GlobalDataFlow.cs:38:35:38:52 | access to property SinkProperty0 |
-| GlobalDataFlow.cs:39:9:39:37 | call to method Invoke | return | GlobalDataFlow.cs:39:9:39:37 | call to method Invoke |
-| GlobalDataFlow.cs:46:13:46:30 | access to property SinkProperty0 | return | GlobalDataFlow.cs:46:13:46:30 | access to property SinkProperty0 |
-| GlobalDataFlow.cs:53:20:53:37 | access to property SinkProperty0 | return | GlobalDataFlow.cs:53:20:53:37 | access to property SinkProperty0 |
-| GlobalDataFlow.cs:54:28:54:45 | access to property SinkProperty0 | return | GlobalDataFlow.cs:54:28:54:45 | access to property SinkProperty0 |
-| GlobalDataFlow.cs:55:44:55:61 | access to property SinkProperty0 | return | GlobalDataFlow.cs:55:44:55:61 | access to property SinkProperty0 |
-| GlobalDataFlow.cs:56:28:56:45 | access to property SinkProperty0 | return | GlobalDataFlow.cs:56:28:56:45 | access to property SinkProperty0 |
-| GlobalDataFlow.cs:58:35:58:52 | access to property SinkProperty0 | return | GlobalDataFlow.cs:58:35:58:52 | access to property SinkProperty0 |
-| GlobalDataFlow.cs:65:9:65:18 | access to property InProperty | qualifier | GlobalDataFlow.cs:65:9:65:18 | [post] this access |
-| GlobalDataFlow.cs:65:9:65:18 | access to property InProperty | return | GlobalDataFlow.cs:65:9:65:18 | access to property InProperty |
-| GlobalDataFlow.cs:65:22:65:39 | access to property SinkProperty0 | return | GlobalDataFlow.cs:65:22:65:39 | access to property SinkProperty0 |
-| GlobalDataFlow.cs:68:9:68:21 | access to property NonInProperty | qualifier | GlobalDataFlow.cs:68:9:68:21 | [post] this access |
-| GlobalDataFlow.cs:68:9:68:21 | access to property NonInProperty | return | GlobalDataFlow.cs:68:9:68:21 | access to property NonInProperty |
-| GlobalDataFlow.cs:71:21:71:46 | call to method Return | return | GlobalDataFlow.cs:71:21:71:46 | call to method Return |
-| GlobalDataFlow.cs:71:28:71:45 | access to property SinkProperty0 | return | GlobalDataFlow.cs:71:28:71:45 | access to property SinkProperty0 |
-| GlobalDataFlow.cs:73:29:73:64 | call to method GetMethod | qualifier | GlobalDataFlow.cs:73:29:73:44 | [post] typeof(...) |
-| GlobalDataFlow.cs:73:29:73:64 | call to method GetMethod | return | GlobalDataFlow.cs:73:29:73:64 | call to method GetMethod |
-| GlobalDataFlow.cs:73:29:73:101 | call to method Invoke | return | GlobalDataFlow.cs:73:29:73:101 | call to method Invoke |
-| GlobalDataFlow.cs:76:9:76:46 | call to method ReturnOut | out | GlobalDataFlow.cs:76:30:76:34 | SSA def(sink2) |
-| GlobalDataFlow.cs:76:9:76:46 | call to method ReturnOut | ref | GlobalDataFlow.cs:76:30:76:34 | SSA def(sink2) |
-| GlobalDataFlow.cs:79:9:79:46 | call to method ReturnRef | out | GlobalDataFlow.cs:79:30:79:34 | SSA def(sink3) |
-| GlobalDataFlow.cs:79:9:79:46 | call to method ReturnRef | ref | GlobalDataFlow.cs:79:30:79:34 | SSA def(sink3) |
-| GlobalDataFlow.cs:81:22:81:85 | call to method SelectEven | return | GlobalDataFlow.cs:81:22:81:85 | call to method SelectEven |
-| GlobalDataFlow.cs:81:22:81:85 | call to method SelectEven | yield return | GlobalDataFlow.cs:81:22:81:85 | call to method SelectEven |
-| GlobalDataFlow.cs:81:22:81:93 | call to method First | return | GlobalDataFlow.cs:81:22:81:93 | call to method First |
-| GlobalDataFlow.cs:83:22:83:87 | call to method Select | return | GlobalDataFlow.cs:83:22:83:87 | call to method Select |
-| GlobalDataFlow.cs:83:22:83:87 | call to method Select | yield return | GlobalDataFlow.cs:83:22:83:87 | call to method Select |
-| GlobalDataFlow.cs:83:22:83:95 | call to method First | return | GlobalDataFlow.cs:83:22:83:95 | call to method First |
-| GlobalDataFlow.cs:85:22:85:128 | call to method Zip | return | GlobalDataFlow.cs:85:22:85:128 | call to method Zip |
-| GlobalDataFlow.cs:85:22:85:128 | call to method Zip | yield return | GlobalDataFlow.cs:85:22:85:128 | call to method Zip |
-| GlobalDataFlow.cs:85:22:85:136 | call to method First | return | GlobalDataFlow.cs:85:22:85:136 | call to method First |
-| GlobalDataFlow.cs:87:22:87:128 | call to method Zip | return | GlobalDataFlow.cs:87:22:87:128 | call to method Zip |
-| GlobalDataFlow.cs:87:22:87:128 | call to method Zip | yield return | GlobalDataFlow.cs:87:22:87:128 | call to method Zip |
-| GlobalDataFlow.cs:87:22:87:136 | call to method First | return | GlobalDataFlow.cs:87:22:87:136 | call to method First |
-| GlobalDataFlow.cs:89:22:89:110 | call to method Aggregate | return | GlobalDataFlow.cs:89:22:89:110 | call to method Aggregate |
-| GlobalDataFlow.cs:91:22:91:110 | call to method Aggregate | return | GlobalDataFlow.cs:91:22:91:110 | call to method Aggregate |
-| GlobalDataFlow.cs:94:9:94:42 | call to method TryParse | out | GlobalDataFlow.cs:94:36:94:41 | SSA def(sink21) |
-| GlobalDataFlow.cs:94:9:94:42 | call to method TryParse | ref | GlobalDataFlow.cs:94:36:94:41 | SSA def(sink21) |
-| GlobalDataFlow.cs:94:9:94:42 | call to method TryParse | return | GlobalDataFlow.cs:94:9:94:42 | call to method TryParse |
-| GlobalDataFlow.cs:97:9:97:41 | call to method TryParse | out | GlobalDataFlow.cs:97:35:97:40 | SSA def(sink22) |
-| GlobalDataFlow.cs:97:9:97:41 | call to method TryParse | ref | GlobalDataFlow.cs:97:35:97:40 | SSA def(sink22) |
-| GlobalDataFlow.cs:97:9:97:41 | call to method TryParse | return | GlobalDataFlow.cs:97:9:97:41 | call to method TryParse |
-| GlobalDataFlow.cs:101:24:101:33 | call to method Return | return | GlobalDataFlow.cs:101:24:101:33 | call to method Return |
-| GlobalDataFlow.cs:103:28:103:63 | call to method GetMethod | qualifier | GlobalDataFlow.cs:103:28:103:43 | [post] typeof(...) |
-| GlobalDataFlow.cs:103:28:103:63 | call to method GetMethod | return | GlobalDataFlow.cs:103:28:103:63 | call to method GetMethod |
-| GlobalDataFlow.cs:103:28:103:103 | call to method Invoke | return | GlobalDataFlow.cs:103:28:103:103 | call to method Invoke |
-| GlobalDataFlow.cs:105:9:105:49 | call to method ReturnOut | out | GlobalDataFlow.cs:105:27:105:34 | SSA def(nonSink0) |
-| GlobalDataFlow.cs:105:9:105:49 | call to method ReturnOut | ref | GlobalDataFlow.cs:105:27:105:34 | SSA def(nonSink0) |
-| GlobalDataFlow.cs:107:9:107:49 | call to method ReturnOut | out | GlobalDataFlow.cs:107:41:107:48 | SSA def(nonSink0) |
-| GlobalDataFlow.cs:109:9:109:49 | call to method ReturnRef | out | GlobalDataFlow.cs:109:27:109:34 | SSA def(nonSink0) |
-| GlobalDataFlow.cs:109:9:109:49 | call to method ReturnRef | ref | GlobalDataFlow.cs:109:27:109:34 | SSA def(nonSink0) |
-| GlobalDataFlow.cs:111:9:111:49 | call to method ReturnRef | out | GlobalDataFlow.cs:111:30:111:34 | SSA def(sink1) |
-| GlobalDataFlow.cs:111:9:111:49 | call to method ReturnRef | ref | GlobalDataFlow.cs:111:30:111:34 | SSA def(sink1) |
-| GlobalDataFlow.cs:113:20:113:86 | call to method SelectEven | return | GlobalDataFlow.cs:113:20:113:86 | call to method SelectEven |
-| GlobalDataFlow.cs:113:20:113:86 | call to method SelectEven | yield return | GlobalDataFlow.cs:113:20:113:86 | call to method SelectEven |
-| GlobalDataFlow.cs:113:20:113:94 | call to method First | return | GlobalDataFlow.cs:113:20:113:94 | call to method First |
-| GlobalDataFlow.cs:115:20:115:82 | call to method Select | return | GlobalDataFlow.cs:115:20:115:82 | call to method Select |
-| GlobalDataFlow.cs:115:20:115:82 | call to method Select | yield return | GlobalDataFlow.cs:115:20:115:82 | call to method Select |
-| GlobalDataFlow.cs:115:20:115:90 | call to method First | return | GlobalDataFlow.cs:115:20:115:90 | call to method First |
-| GlobalDataFlow.cs:117:20:117:126 | call to method Zip | return | GlobalDataFlow.cs:117:20:117:126 | call to method Zip |
-| GlobalDataFlow.cs:117:20:117:126 | call to method Zip | yield return | GlobalDataFlow.cs:117:20:117:126 | call to method Zip |
-| GlobalDataFlow.cs:117:20:117:134 | call to method First | return | GlobalDataFlow.cs:117:20:117:134 | call to method First |
-| GlobalDataFlow.cs:119:20:119:126 | call to method Zip | return | GlobalDataFlow.cs:119:20:119:126 | call to method Zip |
-| GlobalDataFlow.cs:119:20:119:126 | call to method Zip | yield return | GlobalDataFlow.cs:119:20:119:126 | call to method Zip |
-| GlobalDataFlow.cs:119:20:119:134 | call to method First | return | GlobalDataFlow.cs:119:20:119:134 | call to method First |
-| GlobalDataFlow.cs:121:20:121:104 | call to method Aggregate | return | GlobalDataFlow.cs:121:20:121:104 | call to method Aggregate |
-| GlobalDataFlow.cs:123:20:123:109 | call to method Aggregate | return | GlobalDataFlow.cs:123:20:123:109 | call to method Aggregate |
-| GlobalDataFlow.cs:125:20:125:107 | call to method Aggregate | return | GlobalDataFlow.cs:125:20:125:107 | call to method Aggregate |
-| GlobalDataFlow.cs:128:9:128:46 | call to method TryParse | out | GlobalDataFlow.cs:128:38:128:45 | SSA def(nonSink2) |
-| GlobalDataFlow.cs:128:9:128:46 | call to method TryParse | ref | GlobalDataFlow.cs:128:38:128:45 | SSA def(nonSink2) |
-| GlobalDataFlow.cs:128:9:128:46 | call to method TryParse | return | GlobalDataFlow.cs:128:9:128:46 | call to method TryParse |
-| GlobalDataFlow.cs:131:9:131:45 | call to method TryParse | out | GlobalDataFlow.cs:131:37:131:44 | SSA def(nonSink3) |
-| GlobalDataFlow.cs:131:9:131:45 | call to method TryParse | ref | GlobalDataFlow.cs:131:37:131:44 | SSA def(nonSink3) |
-| GlobalDataFlow.cs:131:9:131:45 | call to method TryParse | return | GlobalDataFlow.cs:131:9:131:45 | call to method TryParse |
-| GlobalDataFlow.cs:135:45:135:64 | call to method ApplyFunc | return | GlobalDataFlow.cs:135:45:135:64 | call to method ApplyFunc |
-| GlobalDataFlow.cs:136:21:136:34 | delegate call | return | GlobalDataFlow.cs:136:21:136:34 | delegate call |
-| GlobalDataFlow.cs:140:20:140:36 | delegate call | return | GlobalDataFlow.cs:140:20:140:36 | delegate call |
-| GlobalDataFlow.cs:144:21:144:44 | call to method ApplyFunc | return | GlobalDataFlow.cs:144:21:144:44 | call to method ApplyFunc |
-| GlobalDataFlow.cs:148:20:148:40 | call to method ApplyFunc | return | GlobalDataFlow.cs:148:20:148:40 | call to method ApplyFunc |
-| GlobalDataFlow.cs:150:20:150:44 | call to method ApplyFunc | return | GlobalDataFlow.cs:150:20:150:44 | call to method ApplyFunc |
-| GlobalDataFlow.cs:154:21:154:25 | call to method Out | qualifier | GlobalDataFlow.cs:154:21:154:25 | [post] this access |
-| GlobalDataFlow.cs:154:21:154:25 | call to method Out | return | GlobalDataFlow.cs:154:21:154:25 | call to method Out |
-| GlobalDataFlow.cs:157:9:157:25 | call to method OutOut | out | GlobalDataFlow.cs:157:20:157:24 | SSA def(sink7) |
-| GlobalDataFlow.cs:157:9:157:25 | call to method OutOut | qualifier | GlobalDataFlow.cs:157:9:157:25 | [post] this access |
-| GlobalDataFlow.cs:157:9:157:25 | call to method OutOut | ref | GlobalDataFlow.cs:157:20:157:24 | SSA def(sink7) |
-| GlobalDataFlow.cs:160:9:160:25 | call to method OutRef | out | GlobalDataFlow.cs:160:20:160:24 | SSA def(sink8) |
-| GlobalDataFlow.cs:160:9:160:25 | call to method OutRef | qualifier | GlobalDataFlow.cs:160:9:160:25 | [post] this access |
-| GlobalDataFlow.cs:160:9:160:25 | call to method OutRef | ref | GlobalDataFlow.cs:160:20:160:24 | SSA def(sink8) |
-| GlobalDataFlow.cs:162:22:162:31 | call to method OutYield | qualifier | GlobalDataFlow.cs:162:22:162:31 | [post] this access |
-| GlobalDataFlow.cs:162:22:162:31 | call to method OutYield | return | GlobalDataFlow.cs:162:22:162:31 | call to method OutYield |
-| GlobalDataFlow.cs:162:22:162:31 | call to method OutYield | yield return | GlobalDataFlow.cs:162:22:162:31 | call to method OutYield |
-| GlobalDataFlow.cs:162:22:162:39 | call to method First | return | GlobalDataFlow.cs:162:22:162:39 | call to method First |
-| GlobalDataFlow.cs:164:22:164:43 | call to method TaintedParam | return | GlobalDataFlow.cs:164:22:164:43 | call to method TaintedParam |
-| GlobalDataFlow.cs:168:20:168:27 | call to method NonOut | qualifier | GlobalDataFlow.cs:168:20:168:27 | [post] this access |
-| GlobalDataFlow.cs:168:20:168:27 | call to method NonOut | return | GlobalDataFlow.cs:168:20:168:27 | call to method NonOut |
-| GlobalDataFlow.cs:170:9:170:31 | call to method NonOutOut | out | GlobalDataFlow.cs:170:23:170:30 | SSA def(nonSink0) |
-| GlobalDataFlow.cs:170:9:170:31 | call to method NonOutOut | qualifier | GlobalDataFlow.cs:170:9:170:31 | [post] this access |
-| GlobalDataFlow.cs:170:9:170:31 | call to method NonOutOut | ref | GlobalDataFlow.cs:170:23:170:30 | SSA def(nonSink0) |
-| GlobalDataFlow.cs:172:9:172:31 | call to method NonOutRef | out | GlobalDataFlow.cs:172:23:172:30 | SSA def(nonSink0) |
-| GlobalDataFlow.cs:172:9:172:31 | call to method NonOutRef | qualifier | GlobalDataFlow.cs:172:9:172:31 | [post] this access |
-| GlobalDataFlow.cs:172:9:172:31 | call to method NonOutRef | ref | GlobalDataFlow.cs:172:23:172:30 | SSA def(nonSink0) |
-| GlobalDataFlow.cs:174:20:174:32 | call to method NonOutYield | qualifier | GlobalDataFlow.cs:174:20:174:32 | [post] this access |
-| GlobalDataFlow.cs:174:20:174:32 | call to method NonOutYield | return | GlobalDataFlow.cs:174:20:174:32 | call to method NonOutYield |
-| GlobalDataFlow.cs:174:20:174:32 | call to method NonOutYield | yield return | GlobalDataFlow.cs:174:20:174:32 | call to method NonOutYield |
-| GlobalDataFlow.cs:174:20:174:40 | call to method First | return | GlobalDataFlow.cs:174:20:174:40 | call to method First |
-| GlobalDataFlow.cs:176:20:176:44 | call to method NonTaintedParam | return | GlobalDataFlow.cs:176:20:176:44 | call to method NonTaintedParam |
-| GlobalDataFlow.cs:181:21:181:26 | delegate call | return | GlobalDataFlow.cs:181:21:181:26 | delegate call |
-| GlobalDataFlow.cs:186:20:186:27 | delegate call | return | GlobalDataFlow.cs:186:20:186:27 | delegate call |
-| GlobalDataFlow.cs:190:22:190:42 | object creation of type Lazy<String> | return | GlobalDataFlow.cs:190:22:190:42 | object creation of type Lazy<String> |
-| GlobalDataFlow.cs:190:22:190:48 | access to property Value | qualifier | GlobalDataFlow.cs:190:22:190:42 | [post] object creation of type Lazy<String> |
-| GlobalDataFlow.cs:190:22:190:48 | access to property Value | return | GlobalDataFlow.cs:190:22:190:48 | access to property Value |
-| GlobalDataFlow.cs:194:20:194:43 | object creation of type Lazy<String> | return | GlobalDataFlow.cs:194:20:194:43 | object creation of type Lazy<String> |
-| GlobalDataFlow.cs:194:20:194:49 | access to property Value | qualifier | GlobalDataFlow.cs:194:20:194:43 | [post] object creation of type Lazy<String> |
-| GlobalDataFlow.cs:194:20:194:49 | access to property Value | return | GlobalDataFlow.cs:194:20:194:49 | access to property Value |
-| GlobalDataFlow.cs:198:22:198:32 | access to property OutProperty | qualifier | GlobalDataFlow.cs:198:22:198:32 | [post] this access |
-| GlobalDataFlow.cs:198:22:198:32 | access to property OutProperty | return | GlobalDataFlow.cs:198:22:198:32 | access to property OutProperty |
-| GlobalDataFlow.cs:202:20:202:33 | access to property NonOutProperty | qualifier | GlobalDataFlow.cs:202:20:202:33 | [post] this access |
-| GlobalDataFlow.cs:202:20:202:33 | access to property NonOutProperty | return | GlobalDataFlow.cs:202:20:202:33 | access to property NonOutProperty |
-| GlobalDataFlow.cs:208:38:208:75 | call to method AsQueryable | return | GlobalDataFlow.cs:208:38:208:75 | call to method AsQueryable |
-| GlobalDataFlow.cs:209:41:209:77 | call to method AsQueryable | return | GlobalDataFlow.cs:209:41:209:77 | call to method AsQueryable |
-| GlobalDataFlow.cs:212:76:212:90 | call to method ReturnCheck2 | return | GlobalDataFlow.cs:212:76:212:90 | call to method ReturnCheck2 |
-| GlobalDataFlow.cs:213:22:213:39 | call to method Select | return | GlobalDataFlow.cs:213:22:213:39 | call to method Select |
-| GlobalDataFlow.cs:213:22:213:39 | call to method Select | yield return | GlobalDataFlow.cs:213:22:213:39 | call to method Select |
-| GlobalDataFlow.cs:213:22:213:47 | call to method First | return | GlobalDataFlow.cs:213:22:213:47 | call to method First |
-| GlobalDataFlow.cs:215:22:215:39 | call to method Select | return | GlobalDataFlow.cs:215:22:215:39 | call to method Select |
-| GlobalDataFlow.cs:215:22:215:47 | call to method First | return | GlobalDataFlow.cs:215:22:215:47 | call to method First |
-| GlobalDataFlow.cs:217:22:217:49 | call to method Select | return | GlobalDataFlow.cs:217:22:217:49 | call to method Select |
-| GlobalDataFlow.cs:217:22:217:49 | call to method Select | yield return | GlobalDataFlow.cs:217:22:217:49 | call to method Select |
-| GlobalDataFlow.cs:217:22:217:57 | call to method First | return | GlobalDataFlow.cs:217:22:217:57 | call to method First |
-| GlobalDataFlow.cs:222:76:222:92 | call to method NonReturnCheck | return | GlobalDataFlow.cs:222:76:222:92 | call to method NonReturnCheck |
-| GlobalDataFlow.cs:223:23:223:43 | call to method Select | return | GlobalDataFlow.cs:223:23:223:43 | call to method Select |
-| GlobalDataFlow.cs:223:23:223:43 | call to method Select | yield return | GlobalDataFlow.cs:223:23:223:43 | call to method Select |
-| GlobalDataFlow.cs:223:23:223:51 | call to method First | return | GlobalDataFlow.cs:223:23:223:51 | call to method First |
-| GlobalDataFlow.cs:225:19:225:39 | call to method Select | return | GlobalDataFlow.cs:225:19:225:39 | call to method Select |
-| GlobalDataFlow.cs:225:19:225:47 | call to method First | return | GlobalDataFlow.cs:225:19:225:47 | call to method First |
-| GlobalDataFlow.cs:227:19:227:39 | call to method Select | return | GlobalDataFlow.cs:227:19:227:39 | call to method Select |
-| GlobalDataFlow.cs:227:19:227:39 | call to method Select | yield return | GlobalDataFlow.cs:227:19:227:39 | call to method Select |
-| GlobalDataFlow.cs:227:19:227:47 | call to method First | return | GlobalDataFlow.cs:227:19:227:47 | call to method First |
-| GlobalDataFlow.cs:229:19:229:39 | call to method Select | return | GlobalDataFlow.cs:229:19:229:39 | call to method Select |
-| GlobalDataFlow.cs:229:19:229:47 | call to method First | return | GlobalDataFlow.cs:229:19:229:47 | call to method First |
-| GlobalDataFlow.cs:231:19:231:49 | call to method Select | return | GlobalDataFlow.cs:231:19:231:49 | call to method Select |
-| GlobalDataFlow.cs:231:19:231:49 | call to method Select | yield return | GlobalDataFlow.cs:231:19:231:49 | call to method Select |
-| GlobalDataFlow.cs:231:19:231:57 | call to method First | return | GlobalDataFlow.cs:231:19:231:57 | call to method First |
-| GlobalDataFlow.cs:238:20:238:49 | call to method Run | return | GlobalDataFlow.cs:238:20:238:49 | call to method Run |
-| GlobalDataFlow.cs:239:22:239:32 | access to property Result | qualifier | GlobalDataFlow.cs:239:22:239:25 | [post] access to local variable task |
-| GlobalDataFlow.cs:239:22:239:32 | access to property Result | return | GlobalDataFlow.cs:239:22:239:32 | access to property Result |
-| GlobalDataFlow.cs:245:16:245:33 | call to method Run | return | GlobalDataFlow.cs:245:16:245:33 | call to method Run |
-| GlobalDataFlow.cs:246:24:246:34 | access to property Result | qualifier | GlobalDataFlow.cs:246:24:246:27 | [post] access to local variable task |
-| GlobalDataFlow.cs:246:24:246:34 | access to property Result | return | GlobalDataFlow.cs:246:24:246:34 | access to property Result |
-| GlobalDataFlow.cs:297:17:297:38 | call to method ApplyFunc | return | GlobalDataFlow.cs:297:17:297:38 | call to method ApplyFunc |
-| GlobalDataFlow.cs:386:16:386:19 | delegate call | return | GlobalDataFlow.cs:386:16:386:19 | delegate call |
-| GlobalDataFlow.cs:445:9:445:20 | call to method Append | qualifier | GlobalDataFlow.cs:445:9:445:10 | [post] access to parameter sb |
-| GlobalDataFlow.cs:445:9:445:20 | call to method Append | return | GlobalDataFlow.cs:445:9:445:20 | call to method Append |
-| GlobalDataFlow.cs:450:18:450:36 | object creation of type StringBuilder | return | GlobalDataFlow.cs:450:18:450:36 | object creation of type StringBuilder |
-| GlobalDataFlow.cs:452:22:452:34 | call to method ToString | qualifier | GlobalDataFlow.cs:452:22:452:23 | [post] access to local variable sb |
-| GlobalDataFlow.cs:452:22:452:34 | call to method ToString | return | GlobalDataFlow.cs:452:22:452:34 | call to method ToString |
-| GlobalDataFlow.cs:455:9:455:18 | call to method Clear | qualifier | GlobalDataFlow.cs:455:9:455:10 | [post] access to local variable sb |
-| GlobalDataFlow.cs:455:9:455:18 | call to method Clear | return | GlobalDataFlow.cs:455:9:455:18 | call to method Clear |
-| GlobalDataFlow.cs:456:23:456:35 | call to method ToString | qualifier | GlobalDataFlow.cs:456:23:456:24 | [post] access to local variable sb |
-| GlobalDataFlow.cs:456:23:456:35 | call to method ToString | return | GlobalDataFlow.cs:456:23:456:35 | call to method ToString |
-| GlobalDataFlow.cs:462:22:462:65 | call to method Join | return | GlobalDataFlow.cs:462:22:462:65 | call to method Join |
-| GlobalDataFlow.cs:465:23:465:65 | call to method Join | return | GlobalDataFlow.cs:465:23:465:65 | call to method Join |
-| GlobalDataFlow.cs:471:20:471:49 | call to method Run | return | GlobalDataFlow.cs:471:20:471:49 | call to method Run |
-| GlobalDataFlow.cs:472:25:472:50 | call to method ConfigureAwait | qualifier | GlobalDataFlow.cs:472:25:472:28 | [post] access to local variable task |
-| GlobalDataFlow.cs:472:25:472:50 | call to method ConfigureAwait | return | GlobalDataFlow.cs:472:25:472:50 | call to method ConfigureAwait |
-| GlobalDataFlow.cs:473:23:473:44 | call to method GetAwaiter | return | GlobalDataFlow.cs:473:23:473:44 | call to method GetAwaiter |
-| GlobalDataFlow.cs:474:22:474:40 | call to method GetResult | return | GlobalDataFlow.cs:474:22:474:40 | call to method GetResult |
-| GlobalDataFlow.cs:486:44:486:47 | delegate call | return | GlobalDataFlow.cs:486:44:486:47 | delegate call |
-| Splitting.cs:8:17:8:31 | [b (line 3): false] call to method Return | return | Splitting.cs:8:17:8:31 | [b (line 3): false] call to method Return |
-| Splitting.cs:8:17:8:31 | [b (line 3): true] call to method Return | return | Splitting.cs:8:17:8:31 | [b (line 3): true] call to method Return |
-| Splitting.cs:20:22:20:30 | call to method Return | return | Splitting.cs:20:22:20:30 | call to method Return |
-| Splitting.cs:21:21:21:33 | call to method Return | return | Splitting.cs:21:21:21:33 | call to method Return |
-| Splitting.cs:30:9:30:13 | [b (line 24): false] dynamic access to element | qualifier | Splitting.cs:30:9:30:9 | [post] [b (line 24): false] access to local variable d |
-| Splitting.cs:30:9:30:13 | [b (line 24): false] dynamic access to element | return | Splitting.cs:30:9:30:13 | [b (line 24): false] dynamic access to element |
-| Splitting.cs:30:9:30:13 | [b (line 24): true] dynamic access to element | qualifier | Splitting.cs:30:9:30:9 | [post] [b (line 24): true] access to local variable d |
-| Splitting.cs:30:9:30:13 | [b (line 24): true] dynamic access to element | return | Splitting.cs:30:9:30:13 | [b (line 24): true] dynamic access to element |
-| Splitting.cs:31:17:31:26 | [b (line 24): false] dynamic access to element | qualifier | Splitting.cs:31:17:31:17 | [post] [b (line 24): false] access to local variable d |
-| Splitting.cs:31:17:31:26 | [b (line 24): false] dynamic access to element | return | Splitting.cs:31:17:31:26 | [b (line 24): false] dynamic access to element |
-| Splitting.cs:31:17:31:26 | [b (line 24): true] dynamic access to element | qualifier | Splitting.cs:31:17:31:17 | [post] [b (line 24): true] access to local variable d |
-| Splitting.cs:31:17:31:26 | [b (line 24): true] dynamic access to element | return | Splitting.cs:31:17:31:26 | [b (line 24): true] dynamic access to element |
-| Splitting.cs:32:9:32:16 | [b (line 24): false] dynamic call to method Check | return | Splitting.cs:32:9:32:16 | [b (line 24): false] dynamic call to method Check |
-| Splitting.cs:32:9:32:16 | [b (line 24): true] dynamic call to method Check | return | Splitting.cs:32:9:32:16 | [b (line 24): true] dynamic call to method Check |
-| Splitting.cs:34:13:34:20 | dynamic call to method Check | return | Splitting.cs:34:13:34:20 | dynamic call to method Check |
-| This.cs:12:9:12:20 | call to method M | qualifier | This.cs:12:9:12:12 | [post] this access |
-| This.cs:13:9:13:15 | call to method M | qualifier | This.cs:13:9:13:15 | [post] this access |
-| This.cs:15:9:15:21 | call to method M | qualifier | This.cs:15:9:15:12 | [post] this access |
-| This.cs:16:9:16:16 | call to method M | qualifier | This.cs:16:9:16:16 | [post] this access |
-| This.cs:17:9:17:18 | object creation of type This | return | This.cs:17:9:17:18 | object creation of type This |
-| This.cs:26:13:26:24 | call to method M | qualifier | This.cs:26:13:26:16 | [post] this access |
-| This.cs:27:13:27:24 | call to method M | qualifier | This.cs:27:13:27:16 | [post] base access |
-| This.cs:28:13:28:21 | object creation of type Sub | return | This.cs:28:13:28:21 | object creation of type Sub |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of ContinueWith | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of ContinueWith] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of ContinueWith | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of ContinueWith] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of ContinueWith | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of ContinueWith] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of ContinueWith | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of ContinueWith] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of ContinueWith | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of ContinueWith] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of ContinueWith | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of ContinueWith] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of ContinueWith | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of ContinueWith] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of ContinueWith | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of ContinueWith] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of ContinueWith | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of ContinueWith] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of ContinueWith | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of ContinueWith] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of ContinueWith | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of ContinueWith] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of ContinueWith | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of ContinueWith] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of ContinueWith | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of ContinueWith] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of ContinueWith | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of ContinueWith] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of ContinueWith | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of ContinueWith] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of ContinueWith | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of ContinueWith] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of ContinueWith | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of ContinueWith] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of ContinueWith | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of ContinueWith] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of ContinueWith | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of ContinueWith] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of ContinueWith | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of ContinueWith] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of Lazy | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of Lazy] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of Lazy | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of Lazy] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of Lazy | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of Lazy] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of Run | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of Run] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of Run | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of Run] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of Run | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of Run] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of Run | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of Run] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of StartNew | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of StartNew] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of StartNew | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of StartNew] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of StartNew | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of StartNew] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of StartNew | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of StartNew] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of StartNew | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of StartNew] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of StartNew | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of StartNew] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of StartNew | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of StartNew] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of StartNew | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of StartNew] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of StartNew | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of StartNew] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of StartNew | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of StartNew] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of StartNew | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of StartNew] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of StartNew | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of StartNew] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of StartNew | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of StartNew] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of StartNew | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of StartNew] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of StartNew | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of StartNew] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of StartNew | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of StartNew] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of Task | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of Task] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of Task | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of Task] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of Task | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of Task] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of Task | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of Task] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of Task | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of Task] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of Task | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of Task] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of Task | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of Task] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 0 of Task | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 0 of Task] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of Aggregate | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of Aggregate] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of Aggregate | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of Aggregate] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of ContinueWhenAll | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of ContinueWhenAll] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of ContinueWhenAll | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of ContinueWhenAll] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of ContinueWhenAll | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of ContinueWhenAll] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of ContinueWhenAll | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of ContinueWhenAll] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of ContinueWhenAll | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of ContinueWhenAll] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of ContinueWhenAll | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of ContinueWhenAll] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of ContinueWhenAll | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of ContinueWhenAll] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of ContinueWhenAll | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of ContinueWhenAll] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of ContinueWhenAll | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of ContinueWhenAll] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of ContinueWhenAll | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of ContinueWhenAll] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of ContinueWhenAll | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of ContinueWhenAll] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of ContinueWhenAll | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of ContinueWhenAll] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of ContinueWhenAll | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of ContinueWhenAll] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of ContinueWhenAll | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of ContinueWhenAll] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of ContinueWhenAll | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of ContinueWhenAll] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of ContinueWhenAll | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of ContinueWhenAll] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of ContinueWhenAny | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of ContinueWhenAny] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of ContinueWhenAny | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of ContinueWhenAny] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of ContinueWhenAny | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of ContinueWhenAny] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of ContinueWhenAny | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of ContinueWhenAny] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of ContinueWhenAny | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of ContinueWhenAny] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of ContinueWhenAny | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of ContinueWhenAny] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of ContinueWhenAny | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of ContinueWhenAny] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of ContinueWhenAny | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of ContinueWhenAny] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of ContinueWhenAny | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of ContinueWhenAny] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of ContinueWhenAny | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of ContinueWhenAny] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of ContinueWhenAny | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of ContinueWhenAny] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of ContinueWhenAny | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of ContinueWhenAny] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of ContinueWhenAny | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of ContinueWhenAny] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of ContinueWhenAny | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of ContinueWhenAny] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of ContinueWhenAny | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of ContinueWhenAny] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of ContinueWhenAny | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of ContinueWhenAny] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of GroupBy | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of GroupBy] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of GroupBy | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of GroupBy] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of GroupBy | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of GroupBy] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of GroupBy | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of GroupBy] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of GroupBy | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of GroupBy] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of GroupBy | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of GroupBy] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of GroupBy | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of GroupBy] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of GroupBy | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of GroupBy] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of GroupBy | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of GroupBy] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of Select | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of Select] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of Select | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of Select] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of Select | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of Select] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of Select | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of Select] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of SelectMany | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of SelectMany] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of SelectMany | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of SelectMany] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of SelectMany | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of SelectMany] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of SelectMany | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of SelectMany] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of SelectMany | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of SelectMany] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of SelectMany | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of SelectMany] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of SelectMany | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of SelectMany] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 1 of SelectMany | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 1 of SelectMany] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 2 of Aggregate | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 2 of Aggregate] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 2 of Aggregate | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 2 of Aggregate] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 2 of Aggregate | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 2 of Aggregate] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 2 of Aggregate | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 2 of Aggregate] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 2 of GroupBy | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 2 of GroupBy] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 2 of GroupBy | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 2 of GroupBy] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 2 of GroupBy | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 2 of GroupBy] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 2 of GroupBy | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 2 of GroupBy] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 2 of GroupBy | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 2 of GroupBy] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 2 of GroupBy | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 2 of GroupBy] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 2 of GroupBy | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 2 of GroupBy] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 2 of GroupBy | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 2 of GroupBy] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 2 of SelectMany | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 2 of SelectMany] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 2 of SelectMany | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 2 of SelectMany] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 2 of SelectMany | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 2 of SelectMany] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 2 of SelectMany | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 2 of SelectMany] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 2 of ToDictionary | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 2 of ToDictionary] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 2 of ToDictionary | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 2 of ToDictionary] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 2 of ToLookup | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 2 of ToLookup] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 2 of ToLookup | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 2 of ToLookup] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 2 of Zip | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 2 of Zip] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 2 of Zip | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 2 of Zip] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 3 of Aggregate | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 3 of Aggregate] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 3 of Aggregate | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 3 of Aggregate] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 3 of GroupBy | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 3 of GroupBy] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 3 of GroupBy | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 3 of GroupBy] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 3 of GroupBy | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 3 of GroupBy] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 3 of GroupBy | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 3 of GroupBy] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 4 of GroupJoin | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 4 of GroupJoin] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 4 of GroupJoin | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 4 of GroupJoin] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 4 of GroupJoin | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 4 of GroupJoin] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 4 of GroupJoin | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 4 of GroupJoin] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 4 of Join | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 4 of Join] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 4 of Join | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 4 of Join] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 4 of Join | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 4 of Join] |
-| file://:0:0:0:0 | [summary] delegate call, parameter 4 of Join | return | file://:0:0:0:0 | [summary] output from delegate call, parameter 4 of Join] |
+| Capture.cs:191:20:191:22 | call to local function M | normal | Capture.cs:191:20:191:22 | call to local function M |
+| Capture.cs:194:22:194:32 | call to local function Id | normal | Capture.cs:194:22:194:32 | call to local function Id |
+| Capture.cs:196:20:196:25 | call to local function Id | normal | Capture.cs:196:20:196:25 | call to local function Id |
+| GlobalDataFlow.cs:26:9:26:26 | access to property SinkProperty0 | normal | GlobalDataFlow.cs:26:9:26:26 | access to property SinkProperty0 |
+| GlobalDataFlow.cs:27:15:27:32 | access to property SinkProperty0 | normal | GlobalDataFlow.cs:27:15:27:32 | access to property SinkProperty0 |
+| GlobalDataFlow.cs:30:9:30:29 | access to property NonSinkProperty0 | normal | GlobalDataFlow.cs:30:9:30:29 | access to property NonSinkProperty0 |
+| GlobalDataFlow.cs:31:15:31:35 | access to property NonSinkProperty0 | normal | GlobalDataFlow.cs:31:15:31:35 | access to property NonSinkProperty0 |
+| GlobalDataFlow.cs:32:9:32:29 | access to property NonSinkProperty1 | normal | GlobalDataFlow.cs:32:9:32:29 | access to property NonSinkProperty1 |
+| GlobalDataFlow.cs:33:15:33:35 | access to property NonSinkProperty1 | normal | GlobalDataFlow.cs:33:15:33:35 | access to property NonSinkProperty1 |
+| GlobalDataFlow.cs:36:13:36:30 | access to property SinkProperty0 | normal | GlobalDataFlow.cs:36:13:36:30 | access to property SinkProperty0 |
+| GlobalDataFlow.cs:37:26:37:58 | call to method GetMethod | normal | GlobalDataFlow.cs:37:26:37:58 | call to method GetMethod |
+| GlobalDataFlow.cs:38:35:38:52 | access to property SinkProperty0 | normal | GlobalDataFlow.cs:38:35:38:52 | access to property SinkProperty0 |
+| GlobalDataFlow.cs:39:9:39:37 | call to method Invoke | normal | GlobalDataFlow.cs:39:9:39:37 | call to method Invoke |
+| GlobalDataFlow.cs:46:13:46:30 | access to property SinkProperty0 | normal | GlobalDataFlow.cs:46:13:46:30 | access to property SinkProperty0 |
+| GlobalDataFlow.cs:53:20:53:37 | access to property SinkProperty0 | normal | GlobalDataFlow.cs:53:20:53:37 | access to property SinkProperty0 |
+| GlobalDataFlow.cs:54:28:54:45 | access to property SinkProperty0 | normal | GlobalDataFlow.cs:54:28:54:45 | access to property SinkProperty0 |
+| GlobalDataFlow.cs:55:44:55:61 | access to property SinkProperty0 | normal | GlobalDataFlow.cs:55:44:55:61 | access to property SinkProperty0 |
+| GlobalDataFlow.cs:56:28:56:45 | access to property SinkProperty0 | normal | GlobalDataFlow.cs:56:28:56:45 | access to property SinkProperty0 |
+| GlobalDataFlow.cs:58:35:58:52 | access to property SinkProperty0 | normal | GlobalDataFlow.cs:58:35:58:52 | access to property SinkProperty0 |
+| GlobalDataFlow.cs:65:9:65:18 | access to property InProperty | normal | GlobalDataFlow.cs:65:9:65:18 | access to property InProperty |
+| GlobalDataFlow.cs:65:22:65:39 | access to property SinkProperty0 | normal | GlobalDataFlow.cs:65:22:65:39 | access to property SinkProperty0 |
+| GlobalDataFlow.cs:68:9:68:21 | access to property NonInProperty | normal | GlobalDataFlow.cs:68:9:68:21 | access to property NonInProperty |
+| GlobalDataFlow.cs:71:21:71:46 | call to method Return | normal | GlobalDataFlow.cs:71:21:71:46 | call to method Return |
+| GlobalDataFlow.cs:71:28:71:45 | access to property SinkProperty0 | normal | GlobalDataFlow.cs:71:28:71:45 | access to property SinkProperty0 |
+| GlobalDataFlow.cs:73:29:73:64 | call to method GetMethod | normal | GlobalDataFlow.cs:73:29:73:64 | call to method GetMethod |
+| GlobalDataFlow.cs:73:29:73:101 | call to method Invoke | normal | GlobalDataFlow.cs:73:29:73:101 | call to method Invoke |
+| GlobalDataFlow.cs:76:9:76:46 | call to method ReturnOut | out parameter 1 | GlobalDataFlow.cs:76:30:76:34 | SSA def(sink2) |
+| GlobalDataFlow.cs:76:9:76:46 | call to method ReturnOut | ref parameter 1 | GlobalDataFlow.cs:76:30:76:34 | SSA def(sink2) |
+| GlobalDataFlow.cs:79:9:79:46 | call to method ReturnRef | out parameter 1 | GlobalDataFlow.cs:79:30:79:34 | SSA def(sink3) |
+| GlobalDataFlow.cs:79:9:79:46 | call to method ReturnRef | ref parameter 1 | GlobalDataFlow.cs:79:30:79:34 | SSA def(sink3) |
+| GlobalDataFlow.cs:81:22:81:85 | call to method SelectEven | normal | GlobalDataFlow.cs:81:22:81:85 | call to method SelectEven |
+| GlobalDataFlow.cs:81:22:81:93 | call to method First | normal | GlobalDataFlow.cs:81:22:81:93 | call to method First |
+| GlobalDataFlow.cs:83:22:83:87 | call to method Select | normal | GlobalDataFlow.cs:83:22:83:87 | call to method Select |
+| GlobalDataFlow.cs:83:22:83:95 | call to method First | normal | GlobalDataFlow.cs:83:22:83:95 | call to method First |
+| GlobalDataFlow.cs:85:22:85:128 | call to method Zip | normal | GlobalDataFlow.cs:85:22:85:128 | call to method Zip |
+| GlobalDataFlow.cs:85:22:85:136 | call to method First | normal | GlobalDataFlow.cs:85:22:85:136 | call to method First |
+| GlobalDataFlow.cs:87:22:87:128 | call to method Zip | normal | GlobalDataFlow.cs:87:22:87:128 | call to method Zip |
+| GlobalDataFlow.cs:87:22:87:136 | call to method First | normal | GlobalDataFlow.cs:87:22:87:136 | call to method First |
+| GlobalDataFlow.cs:89:22:89:110 | call to method Aggregate | normal | GlobalDataFlow.cs:89:22:89:110 | call to method Aggregate |
+| GlobalDataFlow.cs:91:22:91:110 | call to method Aggregate | normal | GlobalDataFlow.cs:91:22:91:110 | call to method Aggregate |
+| GlobalDataFlow.cs:94:9:94:42 | call to method TryParse | normal | GlobalDataFlow.cs:94:9:94:42 | call to method TryParse |
+| GlobalDataFlow.cs:94:9:94:42 | call to method TryParse | out parameter 1 | GlobalDataFlow.cs:94:36:94:41 | SSA def(sink21) |
+| GlobalDataFlow.cs:94:9:94:42 | call to method TryParse | ref parameter 1 | GlobalDataFlow.cs:94:36:94:41 | SSA def(sink21) |
+| GlobalDataFlow.cs:97:9:97:41 | call to method TryParse | normal | GlobalDataFlow.cs:97:9:97:41 | call to method TryParse |
+| GlobalDataFlow.cs:97:9:97:41 | call to method TryParse | out parameter 1 | GlobalDataFlow.cs:97:35:97:40 | SSA def(sink22) |
+| GlobalDataFlow.cs:97:9:97:41 | call to method TryParse | ref parameter 1 | GlobalDataFlow.cs:97:35:97:40 | SSA def(sink22) |
+| GlobalDataFlow.cs:101:24:101:33 | call to method Return | normal | GlobalDataFlow.cs:101:24:101:33 | call to method Return |
+| GlobalDataFlow.cs:103:28:103:63 | call to method GetMethod | normal | GlobalDataFlow.cs:103:28:103:63 | call to method GetMethod |
+| GlobalDataFlow.cs:103:28:103:103 | call to method Invoke | normal | GlobalDataFlow.cs:103:28:103:103 | call to method Invoke |
+| GlobalDataFlow.cs:105:9:105:49 | call to method ReturnOut | out parameter 1 | GlobalDataFlow.cs:105:27:105:34 | SSA def(nonSink0) |
+| GlobalDataFlow.cs:105:9:105:49 | call to method ReturnOut | ref parameter 1 | GlobalDataFlow.cs:105:27:105:34 | SSA def(nonSink0) |
+| GlobalDataFlow.cs:107:9:107:49 | call to method ReturnOut | out parameter 2 | GlobalDataFlow.cs:107:41:107:48 | SSA def(nonSink0) |
+| GlobalDataFlow.cs:107:9:107:49 | call to method ReturnOut | ref parameter 2 | GlobalDataFlow.cs:107:41:107:48 | SSA def(nonSink0) |
+| GlobalDataFlow.cs:109:9:109:49 | call to method ReturnRef | out parameter 1 | GlobalDataFlow.cs:109:27:109:34 | SSA def(nonSink0) |
+| GlobalDataFlow.cs:109:9:109:49 | call to method ReturnRef | ref parameter 1 | GlobalDataFlow.cs:109:27:109:34 | SSA def(nonSink0) |
+| GlobalDataFlow.cs:111:9:111:49 | call to method ReturnRef | out parameter 1 | GlobalDataFlow.cs:111:30:111:34 | SSA def(sink1) |
+| GlobalDataFlow.cs:111:9:111:49 | call to method ReturnRef | ref parameter 1 | GlobalDataFlow.cs:111:30:111:34 | SSA def(sink1) |
+| GlobalDataFlow.cs:113:20:113:86 | call to method SelectEven | normal | GlobalDataFlow.cs:113:20:113:86 | call to method SelectEven |
+| GlobalDataFlow.cs:113:20:113:94 | call to method First | normal | GlobalDataFlow.cs:113:20:113:94 | call to method First |
+| GlobalDataFlow.cs:115:20:115:82 | call to method Select | normal | GlobalDataFlow.cs:115:20:115:82 | call to method Select |
+| GlobalDataFlow.cs:115:20:115:90 | call to method First | normal | GlobalDataFlow.cs:115:20:115:90 | call to method First |
+| GlobalDataFlow.cs:117:20:117:126 | call to method Zip | normal | GlobalDataFlow.cs:117:20:117:126 | call to method Zip |
+| GlobalDataFlow.cs:117:20:117:134 | call to method First | normal | GlobalDataFlow.cs:117:20:117:134 | call to method First |
+| GlobalDataFlow.cs:119:20:119:126 | call to method Zip | normal | GlobalDataFlow.cs:119:20:119:126 | call to method Zip |
+| GlobalDataFlow.cs:119:20:119:134 | call to method First | normal | GlobalDataFlow.cs:119:20:119:134 | call to method First |
+| GlobalDataFlow.cs:121:20:121:104 | call to method Aggregate | normal | GlobalDataFlow.cs:121:20:121:104 | call to method Aggregate |
+| GlobalDataFlow.cs:123:20:123:109 | call to method Aggregate | normal | GlobalDataFlow.cs:123:20:123:109 | call to method Aggregate |
+| GlobalDataFlow.cs:125:20:125:107 | call to method Aggregate | normal | GlobalDataFlow.cs:125:20:125:107 | call to method Aggregate |
+| GlobalDataFlow.cs:128:9:128:46 | call to method TryParse | normal | GlobalDataFlow.cs:128:9:128:46 | call to method TryParse |
+| GlobalDataFlow.cs:128:9:128:46 | call to method TryParse | out parameter 1 | GlobalDataFlow.cs:128:38:128:45 | SSA def(nonSink2) |
+| GlobalDataFlow.cs:128:9:128:46 | call to method TryParse | ref parameter 1 | GlobalDataFlow.cs:128:38:128:45 | SSA def(nonSink2) |
+| GlobalDataFlow.cs:131:9:131:45 | call to method TryParse | normal | GlobalDataFlow.cs:131:9:131:45 | call to method TryParse |
+| GlobalDataFlow.cs:131:9:131:45 | call to method TryParse | out parameter 1 | GlobalDataFlow.cs:131:37:131:44 | SSA def(nonSink3) |
+| GlobalDataFlow.cs:131:9:131:45 | call to method TryParse | ref parameter 1 | GlobalDataFlow.cs:131:37:131:44 | SSA def(nonSink3) |
+| GlobalDataFlow.cs:135:45:135:64 | call to method ApplyFunc | normal | GlobalDataFlow.cs:135:45:135:64 | call to method ApplyFunc |
+| GlobalDataFlow.cs:136:21:136:34 | delegate call | normal | GlobalDataFlow.cs:136:21:136:34 | delegate call |
+| GlobalDataFlow.cs:140:20:140:36 | delegate call | normal | GlobalDataFlow.cs:140:20:140:36 | delegate call |
+| GlobalDataFlow.cs:144:21:144:44 | call to method ApplyFunc | normal | GlobalDataFlow.cs:144:21:144:44 | call to method ApplyFunc |
+| GlobalDataFlow.cs:148:20:148:40 | call to method ApplyFunc | normal | GlobalDataFlow.cs:148:20:148:40 | call to method ApplyFunc |
+| GlobalDataFlow.cs:150:20:150:44 | call to method ApplyFunc | normal | GlobalDataFlow.cs:150:20:150:44 | call to method ApplyFunc |
+| GlobalDataFlow.cs:154:21:154:25 | call to method Out | normal | GlobalDataFlow.cs:154:21:154:25 | call to method Out |
+| GlobalDataFlow.cs:157:9:157:25 | call to method OutOut | out parameter 0 | GlobalDataFlow.cs:157:20:157:24 | SSA def(sink7) |
+| GlobalDataFlow.cs:157:9:157:25 | call to method OutOut | ref parameter 0 | GlobalDataFlow.cs:157:20:157:24 | SSA def(sink7) |
+| GlobalDataFlow.cs:160:9:160:25 | call to method OutRef | out parameter 0 | GlobalDataFlow.cs:160:20:160:24 | SSA def(sink8) |
+| GlobalDataFlow.cs:160:9:160:25 | call to method OutRef | ref parameter 0 | GlobalDataFlow.cs:160:20:160:24 | SSA def(sink8) |
+| GlobalDataFlow.cs:162:22:162:31 | call to method OutYield | normal | GlobalDataFlow.cs:162:22:162:31 | call to method OutYield |
+| GlobalDataFlow.cs:162:22:162:39 | call to method First | normal | GlobalDataFlow.cs:162:22:162:39 | call to method First |
+| GlobalDataFlow.cs:164:22:164:43 | call to method TaintedParam | normal | GlobalDataFlow.cs:164:22:164:43 | call to method TaintedParam |
+| GlobalDataFlow.cs:168:20:168:27 | call to method NonOut | normal | GlobalDataFlow.cs:168:20:168:27 | call to method NonOut |
+| GlobalDataFlow.cs:170:9:170:31 | call to method NonOutOut | out parameter 0 | GlobalDataFlow.cs:170:23:170:30 | SSA def(nonSink0) |
+| GlobalDataFlow.cs:170:9:170:31 | call to method NonOutOut | ref parameter 0 | GlobalDataFlow.cs:170:23:170:30 | SSA def(nonSink0) |
+| GlobalDataFlow.cs:172:9:172:31 | call to method NonOutRef | out parameter 0 | GlobalDataFlow.cs:172:23:172:30 | SSA def(nonSink0) |
+| GlobalDataFlow.cs:172:9:172:31 | call to method NonOutRef | ref parameter 0 | GlobalDataFlow.cs:172:23:172:30 | SSA def(nonSink0) |
+| GlobalDataFlow.cs:174:20:174:32 | call to method NonOutYield | normal | GlobalDataFlow.cs:174:20:174:32 | call to method NonOutYield |
+| GlobalDataFlow.cs:174:20:174:40 | call to method First | normal | GlobalDataFlow.cs:174:20:174:40 | call to method First |
+| GlobalDataFlow.cs:176:20:176:44 | call to method NonTaintedParam | normal | GlobalDataFlow.cs:176:20:176:44 | call to method NonTaintedParam |
+| GlobalDataFlow.cs:181:21:181:26 | delegate call | normal | GlobalDataFlow.cs:181:21:181:26 | delegate call |
+| GlobalDataFlow.cs:186:20:186:27 | delegate call | normal | GlobalDataFlow.cs:186:20:186:27 | delegate call |
+| GlobalDataFlow.cs:190:22:190:42 | object creation of type Lazy<String> | normal | GlobalDataFlow.cs:190:22:190:42 | object creation of type Lazy<String> |
+| GlobalDataFlow.cs:190:22:190:48 | access to property Value | normal | GlobalDataFlow.cs:190:22:190:48 | access to property Value |
+| GlobalDataFlow.cs:194:20:194:43 | object creation of type Lazy<String> | normal | GlobalDataFlow.cs:194:20:194:43 | object creation of type Lazy<String> |
+| GlobalDataFlow.cs:194:20:194:49 | access to property Value | normal | GlobalDataFlow.cs:194:20:194:49 | access to property Value |
+| GlobalDataFlow.cs:198:22:198:32 | access to property OutProperty | normal | GlobalDataFlow.cs:198:22:198:32 | access to property OutProperty |
+| GlobalDataFlow.cs:202:20:202:33 | access to property NonOutProperty | normal | GlobalDataFlow.cs:202:20:202:33 | access to property NonOutProperty |
+| GlobalDataFlow.cs:208:38:208:75 | call to method AsQueryable | normal | GlobalDataFlow.cs:208:38:208:75 | call to method AsQueryable |
+| GlobalDataFlow.cs:209:41:209:77 | call to method AsQueryable | normal | GlobalDataFlow.cs:209:41:209:77 | call to method AsQueryable |
+| GlobalDataFlow.cs:212:76:212:90 | call to method ReturnCheck2 | normal | GlobalDataFlow.cs:212:76:212:90 | call to method ReturnCheck2 |
+| GlobalDataFlow.cs:213:22:213:39 | call to method Select | normal | GlobalDataFlow.cs:213:22:213:39 | call to method Select |
+| GlobalDataFlow.cs:213:22:213:47 | call to method First | normal | GlobalDataFlow.cs:213:22:213:47 | call to method First |
+| GlobalDataFlow.cs:215:22:215:39 | call to method Select | normal | GlobalDataFlow.cs:215:22:215:39 | call to method Select |
+| GlobalDataFlow.cs:215:22:215:47 | call to method First | normal | GlobalDataFlow.cs:215:22:215:47 | call to method First |
+| GlobalDataFlow.cs:217:22:217:49 | call to method Select | normal | GlobalDataFlow.cs:217:22:217:49 | call to method Select |
+| GlobalDataFlow.cs:217:22:217:57 | call to method First | normal | GlobalDataFlow.cs:217:22:217:57 | call to method First |
+| GlobalDataFlow.cs:222:76:222:92 | call to method NonReturnCheck | normal | GlobalDataFlow.cs:222:76:222:92 | call to method NonReturnCheck |
+| GlobalDataFlow.cs:223:23:223:43 | call to method Select | normal | GlobalDataFlow.cs:223:23:223:43 | call to method Select |
+| GlobalDataFlow.cs:223:23:223:51 | call to method First | normal | GlobalDataFlow.cs:223:23:223:51 | call to method First |
+| GlobalDataFlow.cs:225:19:225:39 | call to method Select | normal | GlobalDataFlow.cs:225:19:225:39 | call to method Select |
+| GlobalDataFlow.cs:225:19:225:47 | call to method First | normal | GlobalDataFlow.cs:225:19:225:47 | call to method First |
+| GlobalDataFlow.cs:227:19:227:39 | call to method Select | normal | GlobalDataFlow.cs:227:19:227:39 | call to method Select |
+| GlobalDataFlow.cs:227:19:227:47 | call to method First | normal | GlobalDataFlow.cs:227:19:227:47 | call to method First |
+| GlobalDataFlow.cs:229:19:229:39 | call to method Select | normal | GlobalDataFlow.cs:229:19:229:39 | call to method Select |
+| GlobalDataFlow.cs:229:19:229:47 | call to method First | normal | GlobalDataFlow.cs:229:19:229:47 | call to method First |
+| GlobalDataFlow.cs:231:19:231:49 | call to method Select | normal | GlobalDataFlow.cs:231:19:231:49 | call to method Select |
+| GlobalDataFlow.cs:231:19:231:57 | call to method First | normal | GlobalDataFlow.cs:231:19:231:57 | call to method First |
+| GlobalDataFlow.cs:238:20:238:49 | call to method Run | normal | GlobalDataFlow.cs:238:20:238:49 | call to method Run |
+| GlobalDataFlow.cs:239:22:239:32 | access to property Result | normal | GlobalDataFlow.cs:239:22:239:32 | access to property Result |
+| GlobalDataFlow.cs:245:16:245:33 | call to method Run | normal | GlobalDataFlow.cs:245:16:245:33 | call to method Run |
+| GlobalDataFlow.cs:246:24:246:34 | access to property Result | normal | GlobalDataFlow.cs:246:24:246:34 | access to property Result |
+| GlobalDataFlow.cs:297:17:297:38 | call to method ApplyFunc | normal | GlobalDataFlow.cs:297:17:297:38 | call to method ApplyFunc |
+| GlobalDataFlow.cs:386:16:386:19 | delegate call | normal | GlobalDataFlow.cs:386:16:386:19 | delegate call |
+| GlobalDataFlow.cs:445:9:445:20 | call to method Append | normal | GlobalDataFlow.cs:445:9:445:20 | call to method Append |
+| GlobalDataFlow.cs:450:18:450:36 | object creation of type StringBuilder | normal | GlobalDataFlow.cs:450:18:450:36 | object creation of type StringBuilder |
+| GlobalDataFlow.cs:452:22:452:34 | call to method ToString | normal | GlobalDataFlow.cs:452:22:452:34 | call to method ToString |
+| GlobalDataFlow.cs:455:9:455:18 | call to method Clear | normal | GlobalDataFlow.cs:455:9:455:18 | call to method Clear |
+| GlobalDataFlow.cs:456:23:456:35 | call to method ToString | normal | GlobalDataFlow.cs:456:23:456:35 | call to method ToString |
+| GlobalDataFlow.cs:462:22:462:65 | call to method Join | normal | GlobalDataFlow.cs:462:22:462:65 | call to method Join |
+| GlobalDataFlow.cs:465:23:465:65 | call to method Join | normal | GlobalDataFlow.cs:465:23:465:65 | call to method Join |
+| GlobalDataFlow.cs:471:20:471:49 | call to method Run | normal | GlobalDataFlow.cs:471:20:471:49 | call to method Run |
+| GlobalDataFlow.cs:472:25:472:50 | call to method ConfigureAwait | normal | GlobalDataFlow.cs:472:25:472:50 | call to method ConfigureAwait |
+| GlobalDataFlow.cs:473:23:473:44 | call to method GetAwaiter | normal | GlobalDataFlow.cs:473:23:473:44 | call to method GetAwaiter |
+| GlobalDataFlow.cs:474:22:474:40 | call to method GetResult | normal | GlobalDataFlow.cs:474:22:474:40 | call to method GetResult |
+| GlobalDataFlow.cs:498:44:498:47 | delegate call | normal | GlobalDataFlow.cs:498:44:498:47 | delegate call |
+| Splitting.cs:8:17:8:31 | [b (line 3): false] call to method Return | normal | Splitting.cs:8:17:8:31 | [b (line 3): false] call to method Return |
+| Splitting.cs:8:17:8:31 | [b (line 3): true] call to method Return | normal | Splitting.cs:8:17:8:31 | [b (line 3): true] call to method Return |
+| Splitting.cs:20:22:20:30 | call to method Return | normal | Splitting.cs:20:22:20:30 | call to method Return |
+| Splitting.cs:21:21:21:33 | call to method Return | normal | Splitting.cs:21:21:21:33 | call to method Return |
+| Splitting.cs:30:9:30:13 | [b (line 24): false] dynamic access to element | normal | Splitting.cs:30:9:30:13 | [b (line 24): false] dynamic access to element |
+| Splitting.cs:30:9:30:13 | [b (line 24): true] dynamic access to element | normal | Splitting.cs:30:9:30:13 | [b (line 24): true] dynamic access to element |
+| Splitting.cs:31:17:31:26 | [b (line 24): false] dynamic access to element | normal | Splitting.cs:31:17:31:26 | [b (line 24): false] dynamic access to element |
+| Splitting.cs:31:17:31:26 | [b (line 24): true] dynamic access to element | normal | Splitting.cs:31:17:31:26 | [b (line 24): true] dynamic access to element |
+| Splitting.cs:32:9:32:16 | [b (line 24): false] dynamic call to method Check | normal | Splitting.cs:32:9:32:16 | [b (line 24): false] dynamic call to method Check |
+| Splitting.cs:32:9:32:16 | [b (line 24): true] dynamic call to method Check | normal | Splitting.cs:32:9:32:16 | [b (line 24): true] dynamic call to method Check |
+| Splitting.cs:34:13:34:20 | dynamic call to method Check | normal | Splitting.cs:34:13:34:20 | dynamic call to method Check |
+| This.cs:17:9:17:18 | object creation of type This | normal | This.cs:17:9:17:18 | object creation of type This |
+| This.cs:28:13:28:21 | object creation of type Sub | normal | This.cs:28:13:28:21 | object creation of type Sub |
+| file://:0:0:0:0 | [summary] call to collectionSelector in SelectMany | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in SelectMany |
+| file://:0:0:0:0 | [summary] call to collectionSelector in SelectMany | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in SelectMany |
+| file://:0:0:0:0 | [summary] call to collectionSelector in SelectMany | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in SelectMany |
+| file://:0:0:0:0 | [summary] call to collectionSelector in SelectMany | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in SelectMany |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWhenAll | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in ContinueWhenAll |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWhenAll | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in ContinueWhenAll |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWhenAll | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in ContinueWhenAll |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWhenAll | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in ContinueWhenAll |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWhenAll | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in ContinueWhenAll |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWhenAll | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in ContinueWhenAll |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWhenAll | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in ContinueWhenAll |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWhenAll | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in ContinueWhenAll |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWhenAll | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in ContinueWhenAll |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWhenAll | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in ContinueWhenAll |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWhenAll | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in ContinueWhenAll |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWhenAll | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in ContinueWhenAll |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWhenAll | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in ContinueWhenAll |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWhenAll | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in ContinueWhenAll |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWhenAll | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in ContinueWhenAll |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWhenAll | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in ContinueWhenAll |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWhenAny | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in ContinueWhenAny |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWhenAny | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in ContinueWhenAny |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWhenAny | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in ContinueWhenAny |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWhenAny | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in ContinueWhenAny |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWhenAny | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in ContinueWhenAny |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWhenAny | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in ContinueWhenAny |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWhenAny | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in ContinueWhenAny |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWhenAny | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in ContinueWhenAny |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWhenAny | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in ContinueWhenAny |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWhenAny | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in ContinueWhenAny |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWhenAny | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in ContinueWhenAny |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWhenAny | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in ContinueWhenAny |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWhenAny | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in ContinueWhenAny |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWhenAny | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in ContinueWhenAny |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWhenAny | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in ContinueWhenAny |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWhenAny | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in ContinueWhenAny |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWith | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in ContinueWith |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWith | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in ContinueWith |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWith | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in ContinueWith |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWith | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in ContinueWith |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWith | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in ContinueWith |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWith | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in ContinueWith |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWith | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in ContinueWith |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWith | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in ContinueWith |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWith | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in ContinueWith |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWith | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in ContinueWith |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWith | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in ContinueWith |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWith | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in ContinueWith |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWith | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in ContinueWith |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWith | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in ContinueWith |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWith | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in ContinueWith |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWith | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in ContinueWith |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWith | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in ContinueWith |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWith | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in ContinueWith |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWith | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in ContinueWith |
+| file://:0:0:0:0 | [summary] call to continuationFunction in ContinueWith | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in ContinueWith |
+| file://:0:0:0:0 | [summary] call to elementSelector in GroupBy | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 2 in GroupBy |
+| file://:0:0:0:0 | [summary] call to elementSelector in GroupBy | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 2 in GroupBy |
+| file://:0:0:0:0 | [summary] call to elementSelector in GroupBy | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 2 in GroupBy |
+| file://:0:0:0:0 | [summary] call to elementSelector in GroupBy | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 2 in GroupBy |
+| file://:0:0:0:0 | [summary] call to elementSelector in GroupBy | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 2 in GroupBy |
+| file://:0:0:0:0 | [summary] call to elementSelector in GroupBy | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 2 in GroupBy |
+| file://:0:0:0:0 | [summary] call to elementSelector in ToDictionary | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 2 in ToDictionary |
+| file://:0:0:0:0 | [summary] call to elementSelector in ToDictionary | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 2 in ToDictionary |
+| file://:0:0:0:0 | [summary] call to elementSelector in ToLookup | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 2 in ToLookup |
+| file://:0:0:0:0 | [summary] call to elementSelector in ToLookup | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 2 in ToLookup |
+| file://:0:0:0:0 | [summary] call to func in Aggregate | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in Aggregate |
+| file://:0:0:0:0 | [summary] call to func in Aggregate | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in Aggregate |
+| file://:0:0:0:0 | [summary] call to func in Aggregate | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 2 in Aggregate |
+| file://:0:0:0:0 | [summary] call to func in Aggregate | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 2 in Aggregate |
+| file://:0:0:0:0 | [summary] call to func in Aggregate | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 2 in Aggregate |
+| file://:0:0:0:0 | [summary] call to func in Aggregate | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 2 in Aggregate |
+| file://:0:0:0:0 | [summary] call to function in Run | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in Run |
+| file://:0:0:0:0 | [summary] call to function in Run | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in Run |
+| file://:0:0:0:0 | [summary] call to function in Run | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in Run |
+| file://:0:0:0:0 | [summary] call to function in Run | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in Run |
+| file://:0:0:0:0 | [summary] call to function in StartNew | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in StartNew |
+| file://:0:0:0:0 | [summary] call to function in StartNew | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in StartNew |
+| file://:0:0:0:0 | [summary] call to function in StartNew | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in StartNew |
+| file://:0:0:0:0 | [summary] call to function in StartNew | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in StartNew |
+| file://:0:0:0:0 | [summary] call to function in StartNew | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in StartNew |
+| file://:0:0:0:0 | [summary] call to function in StartNew | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in StartNew |
+| file://:0:0:0:0 | [summary] call to function in StartNew | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in StartNew |
+| file://:0:0:0:0 | [summary] call to function in StartNew | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in StartNew |
+| file://:0:0:0:0 | [summary] call to function in StartNew | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in StartNew |
+| file://:0:0:0:0 | [summary] call to function in StartNew | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in StartNew |
+| file://:0:0:0:0 | [summary] call to function in StartNew | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in StartNew |
+| file://:0:0:0:0 | [summary] call to function in StartNew | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in StartNew |
+| file://:0:0:0:0 | [summary] call to function in StartNew | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in StartNew |
+| file://:0:0:0:0 | [summary] call to function in StartNew | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in StartNew |
+| file://:0:0:0:0 | [summary] call to function in StartNew | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in StartNew |
+| file://:0:0:0:0 | [summary] call to function in StartNew | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in StartNew |
+| file://:0:0:0:0 | [summary] call to function in Task | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in Task |
+| file://:0:0:0:0 | [summary] call to function in Task | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in Task |
+| file://:0:0:0:0 | [summary] call to function in Task | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in Task |
+| file://:0:0:0:0 | [summary] call to function in Task | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in Task |
+| file://:0:0:0:0 | [summary] call to function in Task | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in Task |
+| file://:0:0:0:0 | [summary] call to function in Task | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in Task |
+| file://:0:0:0:0 | [summary] call to function in Task | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in Task |
+| file://:0:0:0:0 | [summary] call to function in Task | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in Task |
+| file://:0:0:0:0 | [summary] call to keySelector in GroupBy | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in GroupBy |
+| file://:0:0:0:0 | [summary] call to keySelector in GroupBy | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in GroupBy |
+| file://:0:0:0:0 | [summary] call to keySelector in GroupBy | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in GroupBy |
+| file://:0:0:0:0 | [summary] call to keySelector in GroupBy | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in GroupBy |
+| file://:0:0:0:0 | [summary] call to keySelector in GroupBy | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in GroupBy |
+| file://:0:0:0:0 | [summary] call to keySelector in GroupBy | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in GroupBy |
+| file://:0:0:0:0 | [summary] call to keySelector in GroupBy | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in GroupBy |
+| file://:0:0:0:0 | [summary] call to keySelector in GroupBy | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in GroupBy |
+| file://:0:0:0:0 | [summary] call to keySelector in GroupBy | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in GroupBy |
+| file://:0:0:0:0 | [summary] call to resultSelector in Aggregate | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 3 in Aggregate |
+| file://:0:0:0:0 | [summary] call to resultSelector in GroupBy | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 2 in GroupBy |
+| file://:0:0:0:0 | [summary] call to resultSelector in GroupBy | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 2 in GroupBy |
+| file://:0:0:0:0 | [summary] call to resultSelector in GroupBy | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 3 in GroupBy |
+| file://:0:0:0:0 | [summary] call to resultSelector in GroupBy | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 3 in GroupBy |
+| file://:0:0:0:0 | [summary] call to resultSelector in GroupBy | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 3 in GroupBy |
+| file://:0:0:0:0 | [summary] call to resultSelector in GroupBy | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 3 in GroupBy |
+| file://:0:0:0:0 | [summary] call to resultSelector in GroupJoin | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 4 in GroupJoin |
+| file://:0:0:0:0 | [summary] call to resultSelector in GroupJoin | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 4 in GroupJoin |
+| file://:0:0:0:0 | [summary] call to resultSelector in GroupJoin | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 4 in GroupJoin |
+| file://:0:0:0:0 | [summary] call to resultSelector in GroupJoin | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 4 in GroupJoin |
+| file://:0:0:0:0 | [summary] call to resultSelector in Join | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 4 in Join |
+| file://:0:0:0:0 | [summary] call to resultSelector in Join | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 4 in Join |
+| file://:0:0:0:0 | [summary] call to resultSelector in Join | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 4 in Join |
+| file://:0:0:0:0 | [summary] call to resultSelector in Join | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 4 in Join |
+| file://:0:0:0:0 | [summary] call to resultSelector in SelectMany | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 2 in SelectMany |
+| file://:0:0:0:0 | [summary] call to resultSelector in SelectMany | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 2 in SelectMany |
+| file://:0:0:0:0 | [summary] call to resultSelector in SelectMany | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 2 in SelectMany |
+| file://:0:0:0:0 | [summary] call to resultSelector in SelectMany | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 2 in SelectMany |
+| file://:0:0:0:0 | [summary] call to resultSelector in Zip | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 2 in Zip |
+| file://:0:0:0:0 | [summary] call to resultSelector in Zip | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 2 in Zip |
+| file://:0:0:0:0 | [summary] call to selector in Aggregate | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 3 in Aggregate |
+| file://:0:0:0:0 | [summary] call to selector in Select | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in Select |
+| file://:0:0:0:0 | [summary] call to selector in Select | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in Select |
+| file://:0:0:0:0 | [summary] call to selector in Select | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in Select |
+| file://:0:0:0:0 | [summary] call to selector in Select | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in Select |
+| file://:0:0:0:0 | [summary] call to selector in SelectMany | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in SelectMany |
+| file://:0:0:0:0 | [summary] call to selector in SelectMany | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in SelectMany |
+| file://:0:0:0:0 | [summary] call to selector in SelectMany | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in SelectMany |
+| file://:0:0:0:0 | [summary] call to selector in SelectMany | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 1 in SelectMany |
+| file://:0:0:0:0 | [summary] call to valueFactory in Lazy | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in Lazy |
+| file://:0:0:0:0 | [summary] call to valueFactory in Lazy | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in Lazy |
+| file://:0:0:0:0 | [summary] call to valueFactory in Lazy | normal | file://:0:0:0:0 | [summary] read: return (normal) of argument 0 in Lazy |
diff --git a/csharp/ql/test/library-tests/dataflow/global/GlobalDataFlow.cs b/csharp/ql/test/library-tests/dataflow/global/GlobalDataFlow.cs
index 4d072ca4d1c..5405acd5a6c 100644
--- a/csharp/ql/test/library-tests/dataflow/global/GlobalDataFlow.cs
+++ b/csharp/ql/test/library-tests/dataflow/global/GlobalDataFlow.cs
@@ -474,6 +474,18 @@ public class DataFlow
         var sink45 = awaiter.GetResult();
         Check(sink45);
     }
+
+    void M5(bool b)
+    {
+        void Inner(Action<string> a, bool b, string arg)
+        {
+            if (b)
+                a = s => Check(s);
+            a(arg);
+        }
+
+        Inner(_ => {}, b, "taint source");
+    }
 }
 
 static class IEnumerableExtensions
diff --git a/csharp/ql/test/library-tests/dataflow/global/TaintTracking.expected b/csharp/ql/test/library-tests/dataflow/global/TaintTracking.expected
index fd800913202..43e5ee21e42 100644
--- a/csharp/ql/test/library-tests/dataflow/global/TaintTracking.expected
+++ b/csharp/ql/test/library-tests/dataflow/global/TaintTracking.expected
@@ -58,6 +58,7 @@
 | GlobalDataFlow.cs:453:15:453:20 | access to local variable sink43 |
 | GlobalDataFlow.cs:463:15:463:20 | access to local variable sink44 |
 | GlobalDataFlow.cs:475:15:475:20 | access to local variable sink45 |
+| GlobalDataFlow.cs:483:32:483:32 | access to parameter s |
 | Splitting.cs:9:15:9:15 | [b (line 3): false] access to local variable x |
 | Splitting.cs:9:15:9:15 | [b (line 3): true] access to local variable x |
 | Splitting.cs:11:19:11:19 | access to local variable x |
diff --git a/csharp/ql/test/library-tests/dataflow/global/TaintTrackingPath.expected b/csharp/ql/test/library-tests/dataflow/global/TaintTrackingPath.expected
index 7297686b5e3..2bd27156b17 100644
--- a/csharp/ql/test/library-tests/dataflow/global/TaintTrackingPath.expected
+++ b/csharp/ql/test/library-tests/dataflow/global/TaintTrackingPath.expected
@@ -119,36 +119,36 @@ edges
 | GlobalDataFlow.cs:79:30:79:34 | SSA def(sink3) : String | GlobalDataFlow.cs:80:15:80:19 | access to local variable sink3 |
 | GlobalDataFlow.cs:79:30:79:34 | SSA def(sink3) : String | GlobalDataFlow.cs:81:59:81:63 | access to local variable sink3 : String |
 | GlobalDataFlow.cs:79:30:79:34 | SSA def(sink3) : String | GlobalDataFlow.cs:136:29:136:33 | access to local variable sink3 : String |
-| GlobalDataFlow.cs:81:22:81:85 | call to method SelectEven [[]] : String | GlobalDataFlow.cs:81:22:81:93 | call to method First : String |
+| GlobalDataFlow.cs:81:22:81:85 | call to method SelectEven [element] : String | GlobalDataFlow.cs:81:22:81:93 | call to method First : String |
 | GlobalDataFlow.cs:81:22:81:93 | call to method First : String | GlobalDataFlow.cs:82:15:82:20 | access to local variable sink13 |
 | GlobalDataFlow.cs:81:22:81:93 | call to method First : String | GlobalDataFlow.cs:83:59:83:64 | access to local variable sink13 : String |
-| GlobalDataFlow.cs:81:23:81:65 | (...) ... [[]] : String | GlobalDataFlow.cs:81:22:81:85 | call to method SelectEven [[]] : String |
-| GlobalDataFlow.cs:81:57:81:65 | { ..., ... } [[]] : String | GlobalDataFlow.cs:81:23:81:65 | (...) ... [[]] : String |
-| GlobalDataFlow.cs:81:59:81:63 | access to local variable sink3 : String | GlobalDataFlow.cs:81:57:81:65 | { ..., ... } [[]] : String |
-| GlobalDataFlow.cs:83:22:83:87 | call to method Select [[]] : String | GlobalDataFlow.cs:83:22:83:95 | call to method First : String |
+| GlobalDataFlow.cs:81:23:81:65 | (...) ... [element] : String | GlobalDataFlow.cs:81:22:81:85 | call to method SelectEven [element] : String |
+| GlobalDataFlow.cs:81:57:81:65 | { ..., ... } [element] : String | GlobalDataFlow.cs:81:23:81:65 | (...) ... [element] : String |
+| GlobalDataFlow.cs:81:59:81:63 | access to local variable sink3 : String | GlobalDataFlow.cs:81:57:81:65 | { ..., ... } [element] : String |
+| GlobalDataFlow.cs:83:22:83:87 | call to method Select [element] : String | GlobalDataFlow.cs:83:22:83:95 | call to method First : String |
 | GlobalDataFlow.cs:83:22:83:95 | call to method First : String | GlobalDataFlow.cs:84:15:84:20 | access to local variable sink14 |
 | GlobalDataFlow.cs:83:22:83:95 | call to method First : String | GlobalDataFlow.cs:85:59:85:64 | access to local variable sink14 : String |
 | GlobalDataFlow.cs:83:22:83:95 | call to method First : String | GlobalDataFlow.cs:89:59:89:64 | access to local variable sink14 : String |
 | GlobalDataFlow.cs:83:22:83:95 | call to method First : String | GlobalDataFlow.cs:91:75:91:80 | access to local variable sink14 : String |
-| GlobalDataFlow.cs:83:23:83:66 | (...) ... [[]] : String | GlobalDataFlow.cs:83:22:83:87 | call to method Select [[]] : String |
-| GlobalDataFlow.cs:83:23:83:66 | (...) ... [[]] : String | GlobalDataFlow.cs:312:31:312:40 | sinkParam8 : String |
-| GlobalDataFlow.cs:83:57:83:66 | { ..., ... } [[]] : String | GlobalDataFlow.cs:83:23:83:66 | (...) ... [[]] : String |
-| GlobalDataFlow.cs:83:59:83:64 | access to local variable sink13 : String | GlobalDataFlow.cs:83:57:83:66 | { ..., ... } [[]] : String |
-| GlobalDataFlow.cs:85:22:85:128 | call to method Zip [[]] : String | GlobalDataFlow.cs:85:22:85:136 | call to method First : String |
+| GlobalDataFlow.cs:83:23:83:66 | (...) ... [element] : String | GlobalDataFlow.cs:83:22:83:87 | call to method Select [element] : String |
+| GlobalDataFlow.cs:83:23:83:66 | (...) ... [element] : String | GlobalDataFlow.cs:312:31:312:40 | sinkParam8 : String |
+| GlobalDataFlow.cs:83:57:83:66 | { ..., ... } [element] : String | GlobalDataFlow.cs:83:23:83:66 | (...) ... [element] : String |
+| GlobalDataFlow.cs:83:59:83:64 | access to local variable sink13 : String | GlobalDataFlow.cs:83:57:83:66 | { ..., ... } [element] : String |
+| GlobalDataFlow.cs:85:22:85:128 | call to method Zip [element] : String | GlobalDataFlow.cs:85:22:85:136 | call to method First : String |
 | GlobalDataFlow.cs:85:22:85:136 | call to method First : String | GlobalDataFlow.cs:86:15:86:20 | access to local variable sink15 |
 | GlobalDataFlow.cs:85:22:85:136 | call to method First : String | GlobalDataFlow.cs:87:106:87:111 | access to local variable sink15 : String |
-| GlobalDataFlow.cs:85:23:85:66 | (...) ... [[]] : String | GlobalDataFlow.cs:85:22:85:128 | call to method Zip [[]] : String |
-| GlobalDataFlow.cs:85:57:85:66 | { ..., ... } [[]] : String | GlobalDataFlow.cs:85:23:85:66 | (...) ... [[]] : String |
-| GlobalDataFlow.cs:85:59:85:64 | access to local variable sink14 : String | GlobalDataFlow.cs:85:57:85:66 | { ..., ... } [[]] : String |
-| GlobalDataFlow.cs:87:22:87:128 | call to method Zip [[]] : String | GlobalDataFlow.cs:87:22:87:136 | call to method First : String |
+| GlobalDataFlow.cs:85:23:85:66 | (...) ... [element] : String | GlobalDataFlow.cs:85:22:85:128 | call to method Zip [element] : String |
+| GlobalDataFlow.cs:85:57:85:66 | { ..., ... } [element] : String | GlobalDataFlow.cs:85:23:85:66 | (...) ... [element] : String |
+| GlobalDataFlow.cs:85:59:85:64 | access to local variable sink14 : String | GlobalDataFlow.cs:85:57:85:66 | { ..., ... } [element] : String |
+| GlobalDataFlow.cs:87:22:87:128 | call to method Zip [element] : String | GlobalDataFlow.cs:87:22:87:136 | call to method First : String |
 | GlobalDataFlow.cs:87:22:87:136 | call to method First : String | GlobalDataFlow.cs:88:15:88:20 | access to local variable sink16 |
-| GlobalDataFlow.cs:87:70:87:113 | (...) ... [[]] : String | GlobalDataFlow.cs:87:22:87:128 | call to method Zip [[]] : String |
-| GlobalDataFlow.cs:87:104:87:113 | { ..., ... } [[]] : String | GlobalDataFlow.cs:87:70:87:113 | (...) ... [[]] : String |
-| GlobalDataFlow.cs:87:106:87:111 | access to local variable sink15 : String | GlobalDataFlow.cs:87:104:87:113 | { ..., ... } [[]] : String |
+| GlobalDataFlow.cs:87:70:87:113 | (...) ... [element] : String | GlobalDataFlow.cs:87:22:87:128 | call to method Zip [element] : String |
+| GlobalDataFlow.cs:87:104:87:113 | { ..., ... } [element] : String | GlobalDataFlow.cs:87:70:87:113 | (...) ... [element] : String |
+| GlobalDataFlow.cs:87:106:87:111 | access to local variable sink15 : String | GlobalDataFlow.cs:87:104:87:113 | { ..., ... } [element] : String |
 | GlobalDataFlow.cs:89:22:89:110 | call to method Aggregate : String | GlobalDataFlow.cs:90:15:90:20 | access to local variable sink17 |
-| GlobalDataFlow.cs:89:23:89:66 | (...) ... [[]] : String | GlobalDataFlow.cs:89:22:89:110 | call to method Aggregate : String |
-| GlobalDataFlow.cs:89:57:89:66 | { ..., ... } [[]] : String | GlobalDataFlow.cs:89:23:89:66 | (...) ... [[]] : String |
-| GlobalDataFlow.cs:89:59:89:64 | access to local variable sink14 : String | GlobalDataFlow.cs:89:57:89:66 | { ..., ... } [[]] : String |
+| GlobalDataFlow.cs:89:23:89:66 | (...) ... [element] : String | GlobalDataFlow.cs:89:22:89:110 | call to method Aggregate : String |
+| GlobalDataFlow.cs:89:57:89:66 | { ..., ... } [element] : String | GlobalDataFlow.cs:89:23:89:66 | (...) ... [element] : String |
+| GlobalDataFlow.cs:89:59:89:64 | access to local variable sink14 : String | GlobalDataFlow.cs:89:57:89:66 | { ..., ... } [element] : String |
 | GlobalDataFlow.cs:91:22:91:110 | call to method Aggregate : String | GlobalDataFlow.cs:92:15:92:20 | access to local variable sink18 |
 | GlobalDataFlow.cs:91:22:91:110 | call to method Aggregate : String | GlobalDataFlow.cs:94:24:94:29 | access to local variable sink18 : String |
 | GlobalDataFlow.cs:91:22:91:110 | call to method Aggregate : String | GlobalDataFlow.cs:97:23:97:28 | access to local variable sink18 : String |
@@ -165,42 +165,42 @@ edges
 | GlobalDataFlow.cs:154:21:154:25 | call to method Out : String | GlobalDataFlow.cs:155:15:155:19 | access to local variable sink6 |
 | GlobalDataFlow.cs:157:20:157:24 | SSA def(sink7) : String | GlobalDataFlow.cs:158:15:158:19 | access to local variable sink7 |
 | GlobalDataFlow.cs:160:20:160:24 | SSA def(sink8) : String | GlobalDataFlow.cs:161:15:161:19 | access to local variable sink8 |
-| GlobalDataFlow.cs:162:22:162:31 | call to method OutYield [[]] : String | GlobalDataFlow.cs:162:22:162:39 | call to method First : String |
+| GlobalDataFlow.cs:162:22:162:31 | call to method OutYield [element] : String | GlobalDataFlow.cs:162:22:162:39 | call to method First : String |
 | GlobalDataFlow.cs:162:22:162:39 | call to method First : String | GlobalDataFlow.cs:163:15:163:20 | access to local variable sink12 |
 | GlobalDataFlow.cs:164:22:164:43 | call to method TaintedParam : String | GlobalDataFlow.cs:165:15:165:20 | access to local variable sink23 |
 | GlobalDataFlow.cs:180:35:180:48 | "taint source" : String | GlobalDataFlow.cs:181:21:181:26 | delegate call : String |
 | GlobalDataFlow.cs:181:21:181:26 | delegate call : String | GlobalDataFlow.cs:182:15:182:19 | access to local variable sink9 |
-| GlobalDataFlow.cs:190:22:190:42 | object creation of type Lazy<String> [Value] : String | GlobalDataFlow.cs:190:22:190:48 | access to property Value : String |
+| GlobalDataFlow.cs:190:22:190:42 | object creation of type Lazy<String> [property Value] : String | GlobalDataFlow.cs:190:22:190:48 | access to property Value : String |
 | GlobalDataFlow.cs:190:22:190:48 | access to property Value : String | GlobalDataFlow.cs:191:15:191:20 | access to local variable sink10 |
 | GlobalDataFlow.cs:198:22:198:32 | access to property OutProperty : String | GlobalDataFlow.cs:199:15:199:20 | access to local variable sink19 |
-| GlobalDataFlow.cs:208:38:208:61 | array creation of type String[] [[]] : String | GlobalDataFlow.cs:208:38:208:75 | call to method AsQueryable [[]] : String |
-| GlobalDataFlow.cs:208:38:208:75 | call to method AsQueryable [[]] : String | GlobalDataFlow.cs:213:22:213:28 | access to local variable tainted [[]] : String |
-| GlobalDataFlow.cs:208:38:208:75 | call to method AsQueryable [[]] : String | GlobalDataFlow.cs:215:22:215:28 | access to local variable tainted [[]] : String |
-| GlobalDataFlow.cs:208:38:208:75 | call to method AsQueryable [[]] : String | GlobalDataFlow.cs:217:22:217:28 | access to local variable tainted [[]] : String |
-| GlobalDataFlow.cs:208:44:208:61 | { ..., ... } [[]] : String | GlobalDataFlow.cs:208:38:208:61 | array creation of type String[] [[]] : String |
-| GlobalDataFlow.cs:208:46:208:59 | "taint source" : String | GlobalDataFlow.cs:208:44:208:61 | { ..., ... } [[]] : String |
+| GlobalDataFlow.cs:208:38:208:61 | array creation of type String[] [element] : String | GlobalDataFlow.cs:208:38:208:75 | call to method AsQueryable [element] : String |
+| GlobalDataFlow.cs:208:38:208:75 | call to method AsQueryable [element] : String | GlobalDataFlow.cs:213:22:213:28 | access to local variable tainted [element] : String |
+| GlobalDataFlow.cs:208:38:208:75 | call to method AsQueryable [element] : String | GlobalDataFlow.cs:215:22:215:28 | access to local variable tainted [element] : String |
+| GlobalDataFlow.cs:208:38:208:75 | call to method AsQueryable [element] : String | GlobalDataFlow.cs:217:22:217:28 | access to local variable tainted [element] : String |
+| GlobalDataFlow.cs:208:44:208:61 | { ..., ... } [element] : String | GlobalDataFlow.cs:208:38:208:61 | array creation of type String[] [element] : String |
+| GlobalDataFlow.cs:208:46:208:59 | "taint source" : String | GlobalDataFlow.cs:208:44:208:61 | { ..., ... } [element] : String |
 | GlobalDataFlow.cs:211:35:211:45 | sinkParam10 : String | GlobalDataFlow.cs:211:58:211:68 | access to parameter sinkParam10 |
 | GlobalDataFlow.cs:212:71:212:71 | x : String | GlobalDataFlow.cs:212:89:212:89 | access to parameter x : String |
 | GlobalDataFlow.cs:212:89:212:89 | access to parameter x : String | GlobalDataFlow.cs:318:32:318:41 | sinkParam9 : String |
-| GlobalDataFlow.cs:213:22:213:28 | access to local variable tainted [[]] : String | GlobalDataFlow.cs:211:35:211:45 | sinkParam10 : String |
-| GlobalDataFlow.cs:213:22:213:28 | access to local variable tainted [[]] : String | GlobalDataFlow.cs:213:22:213:39 | call to method Select [[]] : String |
-| GlobalDataFlow.cs:213:22:213:39 | call to method Select [[]] : String | GlobalDataFlow.cs:213:22:213:47 | call to method First : String |
+| GlobalDataFlow.cs:213:22:213:28 | access to local variable tainted [element] : String | GlobalDataFlow.cs:211:35:211:45 | sinkParam10 : String |
+| GlobalDataFlow.cs:213:22:213:28 | access to local variable tainted [element] : String | GlobalDataFlow.cs:213:22:213:39 | call to method Select [element] : String |
+| GlobalDataFlow.cs:213:22:213:39 | call to method Select [element] : String | GlobalDataFlow.cs:213:22:213:47 | call to method First : String |
 | GlobalDataFlow.cs:213:22:213:47 | call to method First : String | GlobalDataFlow.cs:214:15:214:20 | access to local variable sink24 |
-| GlobalDataFlow.cs:215:22:215:28 | access to local variable tainted [[]] : String | GlobalDataFlow.cs:212:71:212:71 | x : String |
-| GlobalDataFlow.cs:215:22:215:28 | access to local variable tainted [[]] : String | GlobalDataFlow.cs:215:22:215:39 | call to method Select [[]] : String |
-| GlobalDataFlow.cs:215:22:215:39 | call to method Select [[]] : String | GlobalDataFlow.cs:215:22:215:47 | call to method First : String |
+| GlobalDataFlow.cs:215:22:215:28 | access to local variable tainted [element] : String | GlobalDataFlow.cs:212:71:212:71 | x : String |
+| GlobalDataFlow.cs:215:22:215:28 | access to local variable tainted [element] : String | GlobalDataFlow.cs:215:22:215:39 | call to method Select [element] : String |
+| GlobalDataFlow.cs:215:22:215:39 | call to method Select [element] : String | GlobalDataFlow.cs:215:22:215:47 | call to method First : String |
 | GlobalDataFlow.cs:215:22:215:47 | call to method First : String | GlobalDataFlow.cs:216:15:216:20 | access to local variable sink25 |
-| GlobalDataFlow.cs:217:22:217:28 | access to local variable tainted [[]] : String | GlobalDataFlow.cs:217:22:217:49 | call to method Select [[]] : String |
-| GlobalDataFlow.cs:217:22:217:28 | access to local variable tainted [[]] : String | GlobalDataFlow.cs:324:32:324:42 | sinkParam11 : String |
-| GlobalDataFlow.cs:217:22:217:49 | call to method Select [[]] : String | GlobalDataFlow.cs:217:22:217:57 | call to method First : String |
+| GlobalDataFlow.cs:217:22:217:28 | access to local variable tainted [element] : String | GlobalDataFlow.cs:217:22:217:49 | call to method Select [element] : String |
+| GlobalDataFlow.cs:217:22:217:28 | access to local variable tainted [element] : String | GlobalDataFlow.cs:324:32:324:42 | sinkParam11 : String |
+| GlobalDataFlow.cs:217:22:217:49 | call to method Select [element] : String | GlobalDataFlow.cs:217:22:217:57 | call to method First : String |
 | GlobalDataFlow.cs:217:22:217:57 | call to method First : String | GlobalDataFlow.cs:218:15:218:20 | access to local variable sink26 |
-| GlobalDataFlow.cs:238:20:238:49 | call to method Run [Result] : String | GlobalDataFlow.cs:239:22:239:25 | access to local variable task [Result] : String |
-| GlobalDataFlow.cs:238:20:238:49 | call to method Run [Result] : String | GlobalDataFlow.cs:241:28:241:31 | access to local variable task [Result] : String |
-| GlobalDataFlow.cs:238:35:238:48 | "taint source" : String | GlobalDataFlow.cs:238:20:238:49 | call to method Run [Result] : String |
-| GlobalDataFlow.cs:239:22:239:25 | access to local variable task [Result] : String | GlobalDataFlow.cs:239:22:239:32 | access to property Result : String |
+| GlobalDataFlow.cs:238:20:238:49 | call to method Run [property Result] : String | GlobalDataFlow.cs:239:22:239:25 | access to local variable task [property Result] : String |
+| GlobalDataFlow.cs:238:20:238:49 | call to method Run [property Result] : String | GlobalDataFlow.cs:241:28:241:31 | access to local variable task [property Result] : String |
+| GlobalDataFlow.cs:238:35:238:48 | "taint source" : String | GlobalDataFlow.cs:238:20:238:49 | call to method Run [property Result] : String |
+| GlobalDataFlow.cs:239:22:239:25 | access to local variable task [property Result] : String | GlobalDataFlow.cs:239:22:239:32 | access to property Result : String |
 | GlobalDataFlow.cs:239:22:239:32 | access to property Result : String | GlobalDataFlow.cs:240:15:240:20 | access to local variable sink41 |
 | GlobalDataFlow.cs:241:22:241:31 | await ... : String | GlobalDataFlow.cs:242:15:242:20 | access to local variable sink42 |
-| GlobalDataFlow.cs:241:28:241:31 | access to local variable task [Result] : String | GlobalDataFlow.cs:241:22:241:31 | await ... : String |
+| GlobalDataFlow.cs:241:28:241:31 | access to local variable task [property Result] : String | GlobalDataFlow.cs:241:22:241:31 | await ... : String |
 | GlobalDataFlow.cs:254:26:254:35 | sinkParam0 : String | GlobalDataFlow.cs:256:16:256:25 | access to parameter sinkParam0 : String |
 | GlobalDataFlow.cs:254:26:254:35 | sinkParam0 : String | GlobalDataFlow.cs:257:15:257:24 | access to parameter sinkParam0 |
 | GlobalDataFlow.cs:256:16:256:25 | access to parameter sinkParam0 : String | GlobalDataFlow.cs:254:26:254:35 | sinkParam0 : String |
@@ -214,12 +214,12 @@ edges
 | GlobalDataFlow.cs:318:32:318:41 | sinkParam9 : String | GlobalDataFlow.cs:320:15:320:24 | access to parameter sinkParam9 |
 | GlobalDataFlow.cs:324:32:324:42 | sinkParam11 : String | GlobalDataFlow.cs:326:15:326:25 | access to parameter sinkParam11 |
 | GlobalDataFlow.cs:338:16:338:29 | "taint source" : String | GlobalDataFlow.cs:154:21:154:25 | call to method Out : String |
-| GlobalDataFlow.cs:338:16:338:29 | "taint source" : String | GlobalDataFlow.cs:190:22:190:42 | object creation of type Lazy<String> [Value] : String |
+| GlobalDataFlow.cs:338:16:338:29 | "taint source" : String | GlobalDataFlow.cs:190:22:190:42 | object creation of type Lazy<String> [property Value] : String |
 | GlobalDataFlow.cs:343:9:343:26 | SSA def(x) : String | GlobalDataFlow.cs:157:20:157:24 | SSA def(sink7) : String |
 | GlobalDataFlow.cs:343:13:343:26 | "taint source" : String | GlobalDataFlow.cs:343:9:343:26 | SSA def(x) : String |
 | GlobalDataFlow.cs:348:9:348:26 | SSA def(x) : String | GlobalDataFlow.cs:160:20:160:24 | SSA def(sink8) : String |
 | GlobalDataFlow.cs:348:13:348:26 | "taint source" : String | GlobalDataFlow.cs:348:9:348:26 | SSA def(x) : String |
-| GlobalDataFlow.cs:354:22:354:35 | "taint source" : String | GlobalDataFlow.cs:162:22:162:31 | call to method OutYield [[]] : String |
+| GlobalDataFlow.cs:354:22:354:35 | "taint source" : String | GlobalDataFlow.cs:162:22:162:31 | call to method OutYield [element] : String |
 | GlobalDataFlow.cs:379:41:379:41 | x : String | GlobalDataFlow.cs:381:11:381:11 | access to parameter x : String |
 | GlobalDataFlow.cs:379:41:379:41 | x : String | GlobalDataFlow.cs:381:11:381:11 | access to parameter x : String |
 | GlobalDataFlow.cs:381:11:381:11 | access to parameter x : String | GlobalDataFlow.cs:54:15:54:15 | x : String |
@@ -235,20 +235,24 @@ edges
 | GlobalDataFlow.cs:402:16:402:21 | access to local variable sink11 : String | GlobalDataFlow.cs:164:22:164:43 | call to method TaintedParam : String |
 | GlobalDataFlow.cs:424:9:424:11 | value : String | GlobalDataFlow.cs:424:41:424:46 | access to local variable sink20 |
 | GlobalDataFlow.cs:435:22:435:35 | "taint source" : String | GlobalDataFlow.cs:198:22:198:32 | access to property OutProperty : String |
-| GlobalDataFlow.cs:451:31:451:32 | [post] access to local variable sb [[]] : String | GlobalDataFlow.cs:452:22:452:23 | access to local variable sb [[]] : String |
-| GlobalDataFlow.cs:451:35:451:48 | "taint source" : String | GlobalDataFlow.cs:451:31:451:32 | [post] access to local variable sb [[]] : String |
-| GlobalDataFlow.cs:452:22:452:23 | access to local variable sb [[]] : String | GlobalDataFlow.cs:452:22:452:34 | call to method ToString : String |
+| GlobalDataFlow.cs:451:31:451:32 | [post] access to local variable sb [element] : String | GlobalDataFlow.cs:452:22:452:23 | access to local variable sb [element] : String |
+| GlobalDataFlow.cs:451:35:451:48 | "taint source" : String | GlobalDataFlow.cs:451:31:451:32 | [post] access to local variable sb [element] : String |
+| GlobalDataFlow.cs:452:22:452:23 | access to local variable sb [element] : String | GlobalDataFlow.cs:452:22:452:34 | call to method ToString : String |
 | GlobalDataFlow.cs:452:22:452:34 | call to method ToString : String | GlobalDataFlow.cs:453:15:453:20 | access to local variable sink43 |
 | GlobalDataFlow.cs:462:22:462:65 | call to method Join : String | GlobalDataFlow.cs:463:15:463:20 | access to local variable sink44 |
 | GlobalDataFlow.cs:462:51:462:64 | "taint source" : String | GlobalDataFlow.cs:462:22:462:65 | call to method Join : String |
-| GlobalDataFlow.cs:471:20:471:49 | call to method Run [Result] : String | GlobalDataFlow.cs:472:25:472:28 | access to local variable task [Result] : String |
-| GlobalDataFlow.cs:471:35:471:48 | "taint source" : String | GlobalDataFlow.cs:471:20:471:49 | call to method Run [Result] : String |
-| GlobalDataFlow.cs:472:25:472:28 | access to local variable task [Result] : String | GlobalDataFlow.cs:472:25:472:50 | call to method ConfigureAwait [m_configuredTaskAwaiter, m_task, Result] : String |
-| GlobalDataFlow.cs:472:25:472:50 | call to method ConfigureAwait [m_configuredTaskAwaiter, m_task, Result] : String | GlobalDataFlow.cs:473:23:473:31 | access to local variable awaitable [m_configuredTaskAwaiter, m_task, Result] : String |
-| GlobalDataFlow.cs:473:23:473:31 | access to local variable awaitable [m_configuredTaskAwaiter, m_task, Result] : String | GlobalDataFlow.cs:473:23:473:44 | call to method GetAwaiter [m_task, Result] : String |
-| GlobalDataFlow.cs:473:23:473:44 | call to method GetAwaiter [m_task, Result] : String | GlobalDataFlow.cs:474:22:474:28 | access to local variable awaiter [m_task, Result] : String |
-| GlobalDataFlow.cs:474:22:474:28 | access to local variable awaiter [m_task, Result] : String | GlobalDataFlow.cs:474:22:474:40 | call to method GetResult : String |
+| GlobalDataFlow.cs:471:20:471:49 | call to method Run [property Result] : String | GlobalDataFlow.cs:472:25:472:28 | access to local variable task [property Result] : String |
+| GlobalDataFlow.cs:471:35:471:48 | "taint source" : String | GlobalDataFlow.cs:471:20:471:49 | call to method Run [property Result] : String |
+| GlobalDataFlow.cs:472:25:472:28 | access to local variable task [property Result] : String | GlobalDataFlow.cs:472:25:472:50 | call to method ConfigureAwait [field m_configuredTaskAwaiter, field m_task, property Result] : String |
+| GlobalDataFlow.cs:472:25:472:50 | call to method ConfigureAwait [field m_configuredTaskAwaiter, field m_task, property Result] : String | GlobalDataFlow.cs:473:23:473:31 | access to local variable awaitable [field m_configuredTaskAwaiter, field m_task, property Result] : String |
+| GlobalDataFlow.cs:473:23:473:31 | access to local variable awaitable [field m_configuredTaskAwaiter, field m_task, property Result] : String | GlobalDataFlow.cs:473:23:473:44 | call to method GetAwaiter [field m_task, property Result] : String |
+| GlobalDataFlow.cs:473:23:473:44 | call to method GetAwaiter [field m_task, property Result] : String | GlobalDataFlow.cs:474:22:474:28 | access to local variable awaiter [field m_task, property Result] : String |
+| GlobalDataFlow.cs:474:22:474:28 | access to local variable awaiter [field m_task, property Result] : String | GlobalDataFlow.cs:474:22:474:40 | call to method GetResult : String |
 | GlobalDataFlow.cs:474:22:474:40 | call to method GetResult : String | GlobalDataFlow.cs:475:15:475:20 | access to local variable sink45 |
+| GlobalDataFlow.cs:480:53:480:55 | arg : String | GlobalDataFlow.cs:484:15:484:17 | access to parameter arg : String |
+| GlobalDataFlow.cs:483:21:483:21 | s : String | GlobalDataFlow.cs:483:32:483:32 | access to parameter s |
+| GlobalDataFlow.cs:484:15:484:17 | access to parameter arg : String | GlobalDataFlow.cs:483:21:483:21 | s : String |
+| GlobalDataFlow.cs:487:27:487:40 | "taint source" : String | GlobalDataFlow.cs:480:53:480:55 | arg : String |
 | Splitting.cs:3:28:3:34 | tainted : String | Splitting.cs:8:24:8:30 | [b (line 3): false] access to parameter tainted : String |
 | Splitting.cs:3:28:3:34 | tainted : String | Splitting.cs:8:24:8:30 | [b (line 3): true] access to parameter tainted : String |
 | Splitting.cs:8:17:8:31 | [b (line 3): false] call to method Return : String | Splitting.cs:9:15:9:15 | [b (line 3): false] access to local variable x |
@@ -335,33 +339,33 @@ nodes
 | GlobalDataFlow.cs:79:19:79:23 | access to local variable sink2 : String | semmle.label | access to local variable sink2 : String |
 | GlobalDataFlow.cs:79:30:79:34 | SSA def(sink3) : String | semmle.label | SSA def(sink3) : String |
 | GlobalDataFlow.cs:80:15:80:19 | access to local variable sink3 | semmle.label | access to local variable sink3 |
-| GlobalDataFlow.cs:81:22:81:85 | call to method SelectEven [[]] : String | semmle.label | call to method SelectEven [[]] : String |
+| GlobalDataFlow.cs:81:22:81:85 | call to method SelectEven [element] : String | semmle.label | call to method SelectEven [element] : String |
 | GlobalDataFlow.cs:81:22:81:93 | call to method First : String | semmle.label | call to method First : String |
-| GlobalDataFlow.cs:81:23:81:65 | (...) ... [[]] : String | semmle.label | (...) ... [[]] : String |
-| GlobalDataFlow.cs:81:57:81:65 | { ..., ... } [[]] : String | semmle.label | { ..., ... } [[]] : String |
+| GlobalDataFlow.cs:81:23:81:65 | (...) ... [element] : String | semmle.label | (...) ... [element] : String |
+| GlobalDataFlow.cs:81:57:81:65 | { ..., ... } [element] : String | semmle.label | { ..., ... } [element] : String |
 | GlobalDataFlow.cs:81:59:81:63 | access to local variable sink3 : String | semmle.label | access to local variable sink3 : String |
 | GlobalDataFlow.cs:82:15:82:20 | access to local variable sink13 | semmle.label | access to local variable sink13 |
-| GlobalDataFlow.cs:83:22:83:87 | call to method Select [[]] : String | semmle.label | call to method Select [[]] : String |
+| GlobalDataFlow.cs:83:22:83:87 | call to method Select [element] : String | semmle.label | call to method Select [element] : String |
 | GlobalDataFlow.cs:83:22:83:95 | call to method First : String | semmle.label | call to method First : String |
-| GlobalDataFlow.cs:83:23:83:66 | (...) ... [[]] : String | semmle.label | (...) ... [[]] : String |
-| GlobalDataFlow.cs:83:57:83:66 | { ..., ... } [[]] : String | semmle.label | { ..., ... } [[]] : String |
+| GlobalDataFlow.cs:83:23:83:66 | (...) ... [element] : String | semmle.label | (...) ... [element] : String |
+| GlobalDataFlow.cs:83:57:83:66 | { ..., ... } [element] : String | semmle.label | { ..., ... } [element] : String |
 | GlobalDataFlow.cs:83:59:83:64 | access to local variable sink13 : String | semmle.label | access to local variable sink13 : String |
 | GlobalDataFlow.cs:84:15:84:20 | access to local variable sink14 | semmle.label | access to local variable sink14 |
-| GlobalDataFlow.cs:85:22:85:128 | call to method Zip [[]] : String | semmle.label | call to method Zip [[]] : String |
+| GlobalDataFlow.cs:85:22:85:128 | call to method Zip [element] : String | semmle.label | call to method Zip [element] : String |
 | GlobalDataFlow.cs:85:22:85:136 | call to method First : String | semmle.label | call to method First : String |
-| GlobalDataFlow.cs:85:23:85:66 | (...) ... [[]] : String | semmle.label | (...) ... [[]] : String |
-| GlobalDataFlow.cs:85:57:85:66 | { ..., ... } [[]] : String | semmle.label | { ..., ... } [[]] : String |
+| GlobalDataFlow.cs:85:23:85:66 | (...) ... [element] : String | semmle.label | (...) ... [element] : String |
+| GlobalDataFlow.cs:85:57:85:66 | { ..., ... } [element] : String | semmle.label | { ..., ... } [element] : String |
 | GlobalDataFlow.cs:85:59:85:64 | access to local variable sink14 : String | semmle.label | access to local variable sink14 : String |
 | GlobalDataFlow.cs:86:15:86:20 | access to local variable sink15 | semmle.label | access to local variable sink15 |
-| GlobalDataFlow.cs:87:22:87:128 | call to method Zip [[]] : String | semmle.label | call to method Zip [[]] : String |
+| GlobalDataFlow.cs:87:22:87:128 | call to method Zip [element] : String | semmle.label | call to method Zip [element] : String |
 | GlobalDataFlow.cs:87:22:87:136 | call to method First : String | semmle.label | call to method First : String |
-| GlobalDataFlow.cs:87:70:87:113 | (...) ... [[]] : String | semmle.label | (...) ... [[]] : String |
-| GlobalDataFlow.cs:87:104:87:113 | { ..., ... } [[]] : String | semmle.label | { ..., ... } [[]] : String |
+| GlobalDataFlow.cs:87:70:87:113 | (...) ... [element] : String | semmle.label | (...) ... [element] : String |
+| GlobalDataFlow.cs:87:104:87:113 | { ..., ... } [element] : String | semmle.label | { ..., ... } [element] : String |
 | GlobalDataFlow.cs:87:106:87:111 | access to local variable sink15 : String | semmle.label | access to local variable sink15 : String |
 | GlobalDataFlow.cs:88:15:88:20 | access to local variable sink16 | semmle.label | access to local variable sink16 |
 | GlobalDataFlow.cs:89:22:89:110 | call to method Aggregate : String | semmle.label | call to method Aggregate : String |
-| GlobalDataFlow.cs:89:23:89:66 | (...) ... [[]] : String | semmle.label | (...) ... [[]] : String |
-| GlobalDataFlow.cs:89:57:89:66 | { ..., ... } [[]] : String | semmle.label | { ..., ... } [[]] : String |
+| GlobalDataFlow.cs:89:23:89:66 | (...) ... [element] : String | semmle.label | (...) ... [element] : String |
+| GlobalDataFlow.cs:89:57:89:66 | { ..., ... } [element] : String | semmle.label | { ..., ... } [element] : String |
 | GlobalDataFlow.cs:89:59:89:64 | access to local variable sink14 : String | semmle.label | access to local variable sink14 : String |
 | GlobalDataFlow.cs:90:15:90:20 | access to local variable sink17 | semmle.label | access to local variable sink17 |
 | GlobalDataFlow.cs:91:22:91:110 | call to method Aggregate : String | semmle.label | call to method Aggregate : String |
@@ -385,7 +389,7 @@ nodes
 | GlobalDataFlow.cs:158:15:158:19 | access to local variable sink7 | semmle.label | access to local variable sink7 |
 | GlobalDataFlow.cs:160:20:160:24 | SSA def(sink8) : String | semmle.label | SSA def(sink8) : String |
 | GlobalDataFlow.cs:161:15:161:19 | access to local variable sink8 | semmle.label | access to local variable sink8 |
-| GlobalDataFlow.cs:162:22:162:31 | call to method OutYield [[]] : String | semmle.label | call to method OutYield [[]] : String |
+| GlobalDataFlow.cs:162:22:162:31 | call to method OutYield [element] : String | semmle.label | call to method OutYield [element] : String |
 | GlobalDataFlow.cs:162:22:162:39 | call to method First : String | semmle.label | call to method First : String |
 | GlobalDataFlow.cs:163:15:163:20 | access to local variable sink12 | semmle.label | access to local variable sink12 |
 | GlobalDataFlow.cs:164:22:164:43 | call to method TaintedParam : String | semmle.label | call to method TaintedParam : String |
@@ -393,38 +397,38 @@ nodes
 | GlobalDataFlow.cs:180:35:180:48 | "taint source" : String | semmle.label | "taint source" : String |
 | GlobalDataFlow.cs:181:21:181:26 | delegate call : String | semmle.label | delegate call : String |
 | GlobalDataFlow.cs:182:15:182:19 | access to local variable sink9 | semmle.label | access to local variable sink9 |
-| GlobalDataFlow.cs:190:22:190:42 | object creation of type Lazy<String> [Value] : String | semmle.label | object creation of type Lazy<String> [Value] : String |
+| GlobalDataFlow.cs:190:22:190:42 | object creation of type Lazy<String> [property Value] : String | semmle.label | object creation of type Lazy<String> [property Value] : String |
 | GlobalDataFlow.cs:190:22:190:48 | access to property Value : String | semmle.label | access to property Value : String |
 | GlobalDataFlow.cs:191:15:191:20 | access to local variable sink10 | semmle.label | access to local variable sink10 |
 | GlobalDataFlow.cs:198:22:198:32 | access to property OutProperty : String | semmle.label | access to property OutProperty : String |
 | GlobalDataFlow.cs:199:15:199:20 | access to local variable sink19 | semmle.label | access to local variable sink19 |
-| GlobalDataFlow.cs:208:38:208:61 | array creation of type String[] [[]] : String | semmle.label | array creation of type String[] [[]] : String |
-| GlobalDataFlow.cs:208:38:208:75 | call to method AsQueryable [[]] : String | semmle.label | call to method AsQueryable [[]] : String |
-| GlobalDataFlow.cs:208:44:208:61 | { ..., ... } [[]] : String | semmle.label | { ..., ... } [[]] : String |
+| GlobalDataFlow.cs:208:38:208:61 | array creation of type String[] [element] : String | semmle.label | array creation of type String[] [element] : String |
+| GlobalDataFlow.cs:208:38:208:75 | call to method AsQueryable [element] : String | semmle.label | call to method AsQueryable [element] : String |
+| GlobalDataFlow.cs:208:44:208:61 | { ..., ... } [element] : String | semmle.label | { ..., ... } [element] : String |
 | GlobalDataFlow.cs:208:46:208:59 | "taint source" : String | semmle.label | "taint source" : String |
 | GlobalDataFlow.cs:211:35:211:45 | sinkParam10 : String | semmle.label | sinkParam10 : String |
 | GlobalDataFlow.cs:211:58:211:68 | access to parameter sinkParam10 | semmle.label | access to parameter sinkParam10 |
 | GlobalDataFlow.cs:212:71:212:71 | x : String | semmle.label | x : String |
 | GlobalDataFlow.cs:212:89:212:89 | access to parameter x : String | semmle.label | access to parameter x : String |
-| GlobalDataFlow.cs:213:22:213:28 | access to local variable tainted [[]] : String | semmle.label | access to local variable tainted [[]] : String |
-| GlobalDataFlow.cs:213:22:213:39 | call to method Select [[]] : String | semmle.label | call to method Select [[]] : String |
+| GlobalDataFlow.cs:213:22:213:28 | access to local variable tainted [element] : String | semmle.label | access to local variable tainted [element] : String |
+| GlobalDataFlow.cs:213:22:213:39 | call to method Select [element] : String | semmle.label | call to method Select [element] : String |
 | GlobalDataFlow.cs:213:22:213:47 | call to method First : String | semmle.label | call to method First : String |
 | GlobalDataFlow.cs:214:15:214:20 | access to local variable sink24 | semmle.label | access to local variable sink24 |
-| GlobalDataFlow.cs:215:22:215:28 | access to local variable tainted [[]] : String | semmle.label | access to local variable tainted [[]] : String |
-| GlobalDataFlow.cs:215:22:215:39 | call to method Select [[]] : String | semmle.label | call to method Select [[]] : String |
+| GlobalDataFlow.cs:215:22:215:28 | access to local variable tainted [element] : String | semmle.label | access to local variable tainted [element] : String |
+| GlobalDataFlow.cs:215:22:215:39 | call to method Select [element] : String | semmle.label | call to method Select [element] : String |
 | GlobalDataFlow.cs:215:22:215:47 | call to method First : String | semmle.label | call to method First : String |
 | GlobalDataFlow.cs:216:15:216:20 | access to local variable sink25 | semmle.label | access to local variable sink25 |
-| GlobalDataFlow.cs:217:22:217:28 | access to local variable tainted [[]] : String | semmle.label | access to local variable tainted [[]] : String |
-| GlobalDataFlow.cs:217:22:217:49 | call to method Select [[]] : String | semmle.label | call to method Select [[]] : String |
+| GlobalDataFlow.cs:217:22:217:28 | access to local variable tainted [element] : String | semmle.label | access to local variable tainted [element] : String |
+| GlobalDataFlow.cs:217:22:217:49 | call to method Select [element] : String | semmle.label | call to method Select [element] : String |
 | GlobalDataFlow.cs:217:22:217:57 | call to method First : String | semmle.label | call to method First : String |
 | GlobalDataFlow.cs:218:15:218:20 | access to local variable sink26 | semmle.label | access to local variable sink26 |
-| GlobalDataFlow.cs:238:20:238:49 | call to method Run [Result] : String | semmle.label | call to method Run [Result] : String |
+| GlobalDataFlow.cs:238:20:238:49 | call to method Run [property Result] : String | semmle.label | call to method Run [property Result] : String |
 | GlobalDataFlow.cs:238:35:238:48 | "taint source" : String | semmle.label | "taint source" : String |
-| GlobalDataFlow.cs:239:22:239:25 | access to local variable task [Result] : String | semmle.label | access to local variable task [Result] : String |
+| GlobalDataFlow.cs:239:22:239:25 | access to local variable task [property Result] : String | semmle.label | access to local variable task [property Result] : String |
 | GlobalDataFlow.cs:239:22:239:32 | access to property Result : String | semmle.label | access to property Result : String |
 | GlobalDataFlow.cs:240:15:240:20 | access to local variable sink41 | semmle.label | access to local variable sink41 |
 | GlobalDataFlow.cs:241:22:241:31 | await ... : String | semmle.label | await ... : String |
-| GlobalDataFlow.cs:241:28:241:31 | access to local variable task [Result] : String | semmle.label | access to local variable task [Result] : String |
+| GlobalDataFlow.cs:241:28:241:31 | access to local variable task [property Result] : String | semmle.label | access to local variable task [property Result] : String |
 | GlobalDataFlow.cs:242:15:242:20 | access to local variable sink42 | semmle.label | access to local variable sink42 |
 | GlobalDataFlow.cs:254:26:254:35 | sinkParam0 : String | semmle.label | sinkParam0 : String |
 | GlobalDataFlow.cs:256:16:256:25 | access to parameter sinkParam0 : String | semmle.label | access to parameter sinkParam0 : String |
@@ -469,23 +473,28 @@ nodes
 | GlobalDataFlow.cs:424:9:424:11 | value : String | semmle.label | value : String |
 | GlobalDataFlow.cs:424:41:424:46 | access to local variable sink20 | semmle.label | access to local variable sink20 |
 | GlobalDataFlow.cs:435:22:435:35 | "taint source" : String | semmle.label | "taint source" : String |
-| GlobalDataFlow.cs:451:31:451:32 | [post] access to local variable sb [[]] : String | semmle.label | [post] access to local variable sb [[]] : String |
+| GlobalDataFlow.cs:451:31:451:32 | [post] access to local variable sb [element] : String | semmle.label | [post] access to local variable sb [element] : String |
 | GlobalDataFlow.cs:451:35:451:48 | "taint source" : String | semmle.label | "taint source" : String |
-| GlobalDataFlow.cs:452:22:452:23 | access to local variable sb [[]] : String | semmle.label | access to local variable sb [[]] : String |
+| GlobalDataFlow.cs:452:22:452:23 | access to local variable sb [element] : String | semmle.label | access to local variable sb [element] : String |
 | GlobalDataFlow.cs:452:22:452:34 | call to method ToString : String | semmle.label | call to method ToString : String |
 | GlobalDataFlow.cs:453:15:453:20 | access to local variable sink43 | semmle.label | access to local variable sink43 |
 | GlobalDataFlow.cs:462:22:462:65 | call to method Join : String | semmle.label | call to method Join : String |
 | GlobalDataFlow.cs:462:51:462:64 | "taint source" : String | semmle.label | "taint source" : String |
 | GlobalDataFlow.cs:463:15:463:20 | access to local variable sink44 | semmle.label | access to local variable sink44 |
-| GlobalDataFlow.cs:471:20:471:49 | call to method Run [Result] : String | semmle.label | call to method Run [Result] : String |
+| GlobalDataFlow.cs:471:20:471:49 | call to method Run [property Result] : String | semmle.label | call to method Run [property Result] : String |
 | GlobalDataFlow.cs:471:35:471:48 | "taint source" : String | semmle.label | "taint source" : String |
-| GlobalDataFlow.cs:472:25:472:28 | access to local variable task [Result] : String | semmle.label | access to local variable task [Result] : String |
-| GlobalDataFlow.cs:472:25:472:50 | call to method ConfigureAwait [m_configuredTaskAwaiter, m_task, Result] : String | semmle.label | call to method ConfigureAwait [m_configuredTaskAwaiter, m_task, Result] : String |
-| GlobalDataFlow.cs:473:23:473:31 | access to local variable awaitable [m_configuredTaskAwaiter, m_task, Result] : String | semmle.label | access to local variable awaitable [m_configuredTaskAwaiter, m_task, Result] : String |
-| GlobalDataFlow.cs:473:23:473:44 | call to method GetAwaiter [m_task, Result] : String | semmle.label | call to method GetAwaiter [m_task, Result] : String |
-| GlobalDataFlow.cs:474:22:474:28 | access to local variable awaiter [m_task, Result] : String | semmle.label | access to local variable awaiter [m_task, Result] : String |
+| GlobalDataFlow.cs:472:25:472:28 | access to local variable task [property Result] : String | semmle.label | access to local variable task [property Result] : String |
+| GlobalDataFlow.cs:472:25:472:50 | call to method ConfigureAwait [field m_configuredTaskAwaiter, field m_task, property Result] : String | semmle.label | call to method ConfigureAwait [field m_configuredTaskAwaiter, field m_task, property Result] : String |
+| GlobalDataFlow.cs:473:23:473:31 | access to local variable awaitable [field m_configuredTaskAwaiter, field m_task, property Result] : String | semmle.label | access to local variable awaitable [field m_configuredTaskAwaiter, field m_task, property Result] : String |
+| GlobalDataFlow.cs:473:23:473:44 | call to method GetAwaiter [field m_task, property Result] : String | semmle.label | call to method GetAwaiter [field m_task, property Result] : String |
+| GlobalDataFlow.cs:474:22:474:28 | access to local variable awaiter [field m_task, property Result] : String | semmle.label | access to local variable awaiter [field m_task, property Result] : String |
 | GlobalDataFlow.cs:474:22:474:40 | call to method GetResult : String | semmle.label | call to method GetResult : String |
 | GlobalDataFlow.cs:475:15:475:20 | access to local variable sink45 | semmle.label | access to local variable sink45 |
+| GlobalDataFlow.cs:480:53:480:55 | arg : String | semmle.label | arg : String |
+| GlobalDataFlow.cs:483:21:483:21 | s : String | semmle.label | s : String |
+| GlobalDataFlow.cs:483:32:483:32 | access to parameter s | semmle.label | access to parameter s |
+| GlobalDataFlow.cs:484:15:484:17 | access to parameter arg : String | semmle.label | access to parameter arg : String |
+| GlobalDataFlow.cs:487:27:487:40 | "taint source" : String | semmle.label | "taint source" : String |
 | Splitting.cs:3:28:3:34 | tainted : String | semmle.label | tainted : String |
 | Splitting.cs:8:17:8:31 | [b (line 3): false] call to method Return : String | semmle.label | [b (line 3): false] call to method Return : String |
 | Splitting.cs:8:17:8:31 | [b (line 3): true] call to method Return : String | semmle.label | [b (line 3): true] call to method Return : String |
@@ -573,6 +582,7 @@ nodes
 | GlobalDataFlow.cs:453:15:453:20 | access to local variable sink43 | GlobalDataFlow.cs:451:35:451:48 | "taint source" : String | GlobalDataFlow.cs:453:15:453:20 | access to local variable sink43 | access to local variable sink43 |
 | GlobalDataFlow.cs:463:15:463:20 | access to local variable sink44 | GlobalDataFlow.cs:462:51:462:64 | "taint source" : String | GlobalDataFlow.cs:463:15:463:20 | access to local variable sink44 | access to local variable sink44 |
 | GlobalDataFlow.cs:475:15:475:20 | access to local variable sink45 | GlobalDataFlow.cs:471:35:471:48 | "taint source" : String | GlobalDataFlow.cs:475:15:475:20 | access to local variable sink45 | access to local variable sink45 |
+| GlobalDataFlow.cs:483:32:483:32 | access to parameter s | GlobalDataFlow.cs:487:27:487:40 | "taint source" : String | GlobalDataFlow.cs:483:32:483:32 | access to parameter s | access to parameter s |
 | Splitting.cs:9:15:9:15 | [b (line 3): false] access to local variable x | Splitting.cs:3:28:3:34 | tainted : String | Splitting.cs:9:15:9:15 | [b (line 3): false] access to local variable x | [b (line 3): false] access to local variable x |
 | Splitting.cs:9:15:9:15 | [b (line 3): true] access to local variable x | Splitting.cs:3:28:3:34 | tainted : String | Splitting.cs:9:15:9:15 | [b (line 3): true] access to local variable x | [b (line 3): true] access to local variable x |
 | Splitting.cs:11:19:11:19 | access to local variable x | Splitting.cs:3:28:3:34 | tainted : String | Splitting.cs:11:19:11:19 | access to local variable x | access to local variable x |
diff --git a/csharp/ql/test/library-tests/dataflow/library/FlowSummaries.expected b/csharp/ql/test/library-tests/dataflow/library/FlowSummaries.expected
index 8ea7f7d9875..30b6ee553a1 100644
--- a/csharp/ql/test/library-tests/dataflow/library/FlowSummaries.expected
+++ b/csharp/ql/test/library-tests/dataflow/library/FlowSummaries.expected
@@ -1,2710 +1,2710 @@
-| MS.Internal.Xml.Linq.ComponentModel.XDeferredAxis<>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.().Create<T1, T2, T3, T4, T5, T6, T7, T8>(T1, T2, T3, T4, T5, T6, T7, T8) | parameter 0 -> return [Item1] | true |
-| System.().Create<T1, T2, T3, T4, T5, T6, T7, T8>(T1, T2, T3, T4, T5, T6, T7, T8) | parameter 1 -> return [Item2] | true |
-| System.().Create<T1, T2, T3, T4, T5, T6, T7, T8>(T1, T2, T3, T4, T5, T6, T7, T8) | parameter 2 -> return [Item3] | true |
-| System.().Create<T1, T2, T3, T4, T5, T6, T7, T8>(T1, T2, T3, T4, T5, T6, T7, T8) | parameter 3 -> return [Item4] | true |
-| System.().Create<T1, T2, T3, T4, T5, T6, T7, T8>(T1, T2, T3, T4, T5, T6, T7, T8) | parameter 4 -> return [Item5] | true |
-| System.().Create<T1, T2, T3, T4, T5, T6, T7, T8>(T1, T2, T3, T4, T5, T6, T7, T8) | parameter 5 -> return [Item6] | true |
-| System.().Create<T1, T2, T3, T4, T5, T6, T7, T8>(T1, T2, T3, T4, T5, T6, T7, T8) | parameter 6 -> return [Item7] | true |
-| System.().Create<T1, T2, T3, T4, T5, T6, T7, T8>(T1, T2, T3, T4, T5, T6, T7, T8) | parameter 7 -> return [Item8] | true |
-| System.().Create<T1, T2, T3, T4, T5, T6, T7>(T1, T2, T3, T4, T5, T6, T7) | parameter 0 -> return [Item1] | true |
-| System.().Create<T1, T2, T3, T4, T5, T6, T7>(T1, T2, T3, T4, T5, T6, T7) | parameter 1 -> return [Item2] | true |
-| System.().Create<T1, T2, T3, T4, T5, T6, T7>(T1, T2, T3, T4, T5, T6, T7) | parameter 2 -> return [Item3] | true |
-| System.().Create<T1, T2, T3, T4, T5, T6, T7>(T1, T2, T3, T4, T5, T6, T7) | parameter 3 -> return [Item4] | true |
-| System.().Create<T1, T2, T3, T4, T5, T6, T7>(T1, T2, T3, T4, T5, T6, T7) | parameter 4 -> return [Item5] | true |
-| System.().Create<T1, T2, T3, T4, T5, T6, T7>(T1, T2, T3, T4, T5, T6, T7) | parameter 5 -> return [Item6] | true |
-| System.().Create<T1, T2, T3, T4, T5, T6, T7>(T1, T2, T3, T4, T5, T6, T7) | parameter 6 -> return [Item7] | true |
-| System.().Create<T1, T2, T3, T4, T5, T6>(T1, T2, T3, T4, T5, T6) | parameter 0 -> return [Item1] | true |
-| System.().Create<T1, T2, T3, T4, T5, T6>(T1, T2, T3, T4, T5, T6) | parameter 1 -> return [Item2] | true |
-| System.().Create<T1, T2, T3, T4, T5, T6>(T1, T2, T3, T4, T5, T6) | parameter 2 -> return [Item3] | true |
-| System.().Create<T1, T2, T3, T4, T5, T6>(T1, T2, T3, T4, T5, T6) | parameter 3 -> return [Item4] | true |
-| System.().Create<T1, T2, T3, T4, T5, T6>(T1, T2, T3, T4, T5, T6) | parameter 4 -> return [Item5] | true |
-| System.().Create<T1, T2, T3, T4, T5, T6>(T1, T2, T3, T4, T5, T6) | parameter 5 -> return [Item6] | true |
-| System.().Create<T1, T2, T3, T4, T5>(T1, T2, T3, T4, T5) | parameter 0 -> return [Item1] | true |
-| System.().Create<T1, T2, T3, T4, T5>(T1, T2, T3, T4, T5) | parameter 1 -> return [Item2] | true |
-| System.().Create<T1, T2, T3, T4, T5>(T1, T2, T3, T4, T5) | parameter 2 -> return [Item3] | true |
-| System.().Create<T1, T2, T3, T4, T5>(T1, T2, T3, T4, T5) | parameter 3 -> return [Item4] | true |
-| System.().Create<T1, T2, T3, T4, T5>(T1, T2, T3, T4, T5) | parameter 4 -> return [Item5] | true |
-| System.().Create<T1, T2, T3, T4>(T1, T2, T3, T4) | parameter 0 -> return [Item1] | true |
-| System.().Create<T1, T2, T3, T4>(T1, T2, T3, T4) | parameter 1 -> return [Item2] | true |
-| System.().Create<T1, T2, T3, T4>(T1, T2, T3, T4) | parameter 2 -> return [Item3] | true |
-| System.().Create<T1, T2, T3, T4>(T1, T2, T3, T4) | parameter 3 -> return [Item4] | true |
-| System.().Create<T1, T2, T3>(T1, T2, T3) | parameter 0 -> return [Item1] | true |
-| System.().Create<T1, T2, T3>(T1, T2, T3) | parameter 1 -> return [Item2] | true |
-| System.().Create<T1, T2, T3>(T1, T2, T3) | parameter 2 -> return [Item3] | true |
-| System.().Create<T1, T2>(T1, T2) | parameter 0 -> return [Item1] | true |
-| System.().Create<T1, T2>(T1, T2) | parameter 1 -> return [Item2] | true |
-| System.().Create<T1>(T1) | parameter 0 -> return [Item1] | true |
-| System.(T1).ValueTuple(T1) | parameter 0 -> return [Item1] | true |
-| System.(T1).get_Item(int) | this parameter [Item1] -> return | true |
-| System.(T1,T2).ValueTuple(T1, T2) | parameter 0 -> return [Item1] | true |
-| System.(T1,T2).ValueTuple(T1, T2) | parameter 1 -> return [Item2] | true |
-| System.(T1,T2).get_Item(int) | this parameter [Item1] -> return | true |
-| System.(T1,T2).get_Item(int) | this parameter [Item2] -> return | true |
-| System.(T1,T2,T3).ValueTuple(T1, T2, T3) | parameter 0 -> return [Item1] | true |
-| System.(T1,T2,T3).ValueTuple(T1, T2, T3) | parameter 1 -> return [Item2] | true |
-| System.(T1,T2,T3).ValueTuple(T1, T2, T3) | parameter 2 -> return [Item3] | true |
-| System.(T1,T2,T3).get_Item(int) | this parameter [Item1] -> return | true |
-| System.(T1,T2,T3).get_Item(int) | this parameter [Item2] -> return | true |
-| System.(T1,T2,T3).get_Item(int) | this parameter [Item3] -> return | true |
-| System.(T1,T2,T3,T4).ValueTuple(T1, T2, T3, T4) | parameter 0 -> return [Item1] | true |
-| System.(T1,T2,T3,T4).ValueTuple(T1, T2, T3, T4) | parameter 1 -> return [Item2] | true |
-| System.(T1,T2,T3,T4).ValueTuple(T1, T2, T3, T4) | parameter 2 -> return [Item3] | true |
-| System.(T1,T2,T3,T4).ValueTuple(T1, T2, T3, T4) | parameter 3 -> return [Item4] | true |
-| System.(T1,T2,T3,T4).get_Item(int) | this parameter [Item1] -> return | true |
-| System.(T1,T2,T3,T4).get_Item(int) | this parameter [Item2] -> return | true |
-| System.(T1,T2,T3,T4).get_Item(int) | this parameter [Item3] -> return | true |
-| System.(T1,T2,T3,T4).get_Item(int) | this parameter [Item4] -> return | true |
-| System.(T1,T2,T3,T4,T5).ValueTuple(T1, T2, T3, T4, T5) | parameter 0 -> return [Item1] | true |
-| System.(T1,T2,T3,T4,T5).ValueTuple(T1, T2, T3, T4, T5) | parameter 1 -> return [Item2] | true |
-| System.(T1,T2,T3,T4,T5).ValueTuple(T1, T2, T3, T4, T5) | parameter 2 -> return [Item3] | true |
-| System.(T1,T2,T3,T4,T5).ValueTuple(T1, T2, T3, T4, T5) | parameter 3 -> return [Item4] | true |
-| System.(T1,T2,T3,T4,T5).ValueTuple(T1, T2, T3, T4, T5) | parameter 4 -> return [Item5] | true |
-| System.(T1,T2,T3,T4,T5).get_Item(int) | this parameter [Item1] -> return | true |
-| System.(T1,T2,T3,T4,T5).get_Item(int) | this parameter [Item2] -> return | true |
-| System.(T1,T2,T3,T4,T5).get_Item(int) | this parameter [Item3] -> return | true |
-| System.(T1,T2,T3,T4,T5).get_Item(int) | this parameter [Item4] -> return | true |
-| System.(T1,T2,T3,T4,T5).get_Item(int) | this parameter [Item5] -> return | true |
-| System.(T1,T2,T3,T4,T5,T6).ValueTuple(T1, T2, T3, T4, T5, T6) | parameter 0 -> return [Item1] | true |
-| System.(T1,T2,T3,T4,T5,T6).ValueTuple(T1, T2, T3, T4, T5, T6) | parameter 1 -> return [Item2] | true |
-| System.(T1,T2,T3,T4,T5,T6).ValueTuple(T1, T2, T3, T4, T5, T6) | parameter 2 -> return [Item3] | true |
-| System.(T1,T2,T3,T4,T5,T6).ValueTuple(T1, T2, T3, T4, T5, T6) | parameter 3 -> return [Item4] | true |
-| System.(T1,T2,T3,T4,T5,T6).ValueTuple(T1, T2, T3, T4, T5, T6) | parameter 4 -> return [Item5] | true |
-| System.(T1,T2,T3,T4,T5,T6).ValueTuple(T1, T2, T3, T4, T5, T6) | parameter 5 -> return [Item6] | true |
-| System.(T1,T2,T3,T4,T5,T6).get_Item(int) | this parameter [Item1] -> return | true |
-| System.(T1,T2,T3,T4,T5,T6).get_Item(int) | this parameter [Item2] -> return | true |
-| System.(T1,T2,T3,T4,T5,T6).get_Item(int) | this parameter [Item3] -> return | true |
-| System.(T1,T2,T3,T4,T5,T6).get_Item(int) | this parameter [Item4] -> return | true |
-| System.(T1,T2,T3,T4,T5,T6).get_Item(int) | this parameter [Item5] -> return | true |
-| System.(T1,T2,T3,T4,T5,T6).get_Item(int) | this parameter [Item6] -> return | true |
-| System.(T1,T2,T3,T4,T5,T6,T7).ValueTuple(T1, T2, T3, T4, T5, T6, T7) | parameter 0 -> return [Item1] | true |
-| System.(T1,T2,T3,T4,T5,T6,T7).ValueTuple(T1, T2, T3, T4, T5, T6, T7) | parameter 1 -> return [Item2] | true |
-| System.(T1,T2,T3,T4,T5,T6,T7).ValueTuple(T1, T2, T3, T4, T5, T6, T7) | parameter 2 -> return [Item3] | true |
-| System.(T1,T2,T3,T4,T5,T6,T7).ValueTuple(T1, T2, T3, T4, T5, T6, T7) | parameter 3 -> return [Item4] | true |
-| System.(T1,T2,T3,T4,T5,T6,T7).ValueTuple(T1, T2, T3, T4, T5, T6, T7) | parameter 4 -> return [Item5] | true |
-| System.(T1,T2,T3,T4,T5,T6,T7).ValueTuple(T1, T2, T3, T4, T5, T6, T7) | parameter 5 -> return [Item6] | true |
-| System.(T1,T2,T3,T4,T5,T6,T7).ValueTuple(T1, T2, T3, T4, T5, T6, T7) | parameter 6 -> return [Item7] | true |
-| System.(T1,T2,T3,T4,T5,T6,T7).get_Item(int) | this parameter [Item1] -> return | true |
-| System.(T1,T2,T3,T4,T5,T6,T7).get_Item(int) | this parameter [Item2] -> return | true |
-| System.(T1,T2,T3,T4,T5,T6,T7).get_Item(int) | this parameter [Item3] -> return | true |
-| System.(T1,T2,T3,T4,T5,T6,T7).get_Item(int) | this parameter [Item4] -> return | true |
-| System.(T1,T2,T3,T4,T5,T6,T7).get_Item(int) | this parameter [Item5] -> return | true |
-| System.(T1,T2,T3,T4,T5,T6,T7).get_Item(int) | this parameter [Item6] -> return | true |
-| System.(T1,T2,T3,T4,T5,T6,T7).get_Item(int) | this parameter [Item7] -> return | true |
-| System.Array.Add(object) | parameter 0 -> this parameter [[]] | true |
-| System.Array.AsReadOnly<T>(T[]) | parameter 0 [[]] -> return [[]] | true |
-| System.Array.Clone() | parameter 0 [[]] -> return [[]] | true |
-| System.Array.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Array.CopyTo(Array, long) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Array.Find<T>(T[], Predicate<T>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Array.Find<T>(T[], Predicate<T>) | parameter 0 [[]] -> return | true |
-| System.Array.FindAll<T>(T[], Predicate<T>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Array.FindAll<T>(T[], Predicate<T>) | parameter 0 [[]] -> return | true |
-| System.Array.FindLast<T>(T[], Predicate<T>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Array.FindLast<T>(T[], Predicate<T>) | parameter 0 [[]] -> return | true |
-| System.Array.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Array.Insert(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Array.Reverse(Array) | parameter 0 [[]] -> return [[]] | true |
-| System.Array.Reverse(Array, int, int) | parameter 0 [[]] -> return [[]] | true |
-| System.Array.Reverse<T>(T[]) | parameter 0 [[]] -> return [[]] | true |
-| System.Array.Reverse<T>(T[], int, int) | parameter 0 [[]] -> return [[]] | true |
-| System.Array.get_Item(int) | this parameter [[]] -> return | true |
-| System.Array.set_Item(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Boolean.Parse(string) | parameter 0 -> return | false |
-| System.Boolean.TryParse(string, out bool) | parameter 0 -> parameter 1 | false |
-| System.Boolean.TryParse(string, out bool) | parameter 0 -> return | false |
-| System.Collections.ArrayList.Add(object) | parameter 0 -> this parameter [[]] | true |
-| System.Collections.ArrayList.AddRange(ICollection) | parameter 0 [[]] -> this parameter [[]] | true |
-| System.Collections.ArrayList.Clone() | parameter 0 [[]] -> return [[]] | true |
-| System.Collections.ArrayList.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.ArrayList.FixedSize(ArrayList) | parameter 0 [[]] -> return [[]] | true |
-| System.Collections.ArrayList.FixedSize(IList) | parameter 0 [[]] -> return [[]] | true |
-| System.Collections.ArrayList.FixedSizeArrayList.Add(object) | parameter 0 -> this parameter [[]] | true |
-| System.Collections.ArrayList.FixedSizeArrayList.AddRange(ICollection) | parameter 0 [[]] -> this parameter [[]] | true |
-| System.Collections.ArrayList.FixedSizeArrayList.Clone() | parameter 0 [[]] -> return [[]] | true |
-| System.Collections.ArrayList.FixedSizeArrayList.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.ArrayList.FixedSizeArrayList.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.ArrayList.FixedSizeArrayList.GetEnumerator(int, int) | this parameter [[]] -> return [Current] | true |
-| System.Collections.ArrayList.FixedSizeArrayList.GetRange(int, int) | parameter 0 [[]] -> return [[]] | true |
-| System.Collections.ArrayList.FixedSizeArrayList.Insert(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.ArrayList.FixedSizeArrayList.InsertRange(int, ICollection) | parameter 1 [[]] -> this parameter [[]] | true |
-| System.Collections.ArrayList.FixedSizeArrayList.Reverse(int, int) | parameter 0 [[]] -> return [[]] | true |
-| System.Collections.ArrayList.FixedSizeArrayList.get_Item(int) | this parameter [[]] -> return | true |
-| System.Collections.ArrayList.FixedSizeArrayList.set_Item(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.ArrayList.FixedSizeList.Add(object) | parameter 0 -> this parameter [[]] | true |
-| System.Collections.ArrayList.FixedSizeList.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.ArrayList.FixedSizeList.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.ArrayList.FixedSizeList.Insert(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.ArrayList.FixedSizeList.get_Item(int) | this parameter [[]] -> return | true |
-| System.Collections.ArrayList.FixedSizeList.set_Item(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.ArrayList.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.ArrayList.GetEnumerator(int, int) | this parameter [[]] -> return [Current] | true |
-| System.Collections.ArrayList.GetRange(int, int) | parameter 0 [[]] -> return [[]] | true |
-| System.Collections.ArrayList.IListWrapper.Add(object) | parameter 0 -> this parameter [[]] | true |
-| System.Collections.ArrayList.IListWrapper.AddRange(ICollection) | parameter 0 [[]] -> this parameter [[]] | true |
-| System.Collections.ArrayList.IListWrapper.Clone() | parameter 0 [[]] -> return [[]] | true |
-| System.Collections.ArrayList.IListWrapper.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.ArrayList.IListWrapper.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.ArrayList.IListWrapper.GetEnumerator(int, int) | this parameter [[]] -> return [Current] | true |
-| System.Collections.ArrayList.IListWrapper.GetRange(int, int) | parameter 0 [[]] -> return [[]] | true |
-| System.Collections.ArrayList.IListWrapper.Insert(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.ArrayList.IListWrapper.InsertRange(int, ICollection) | parameter 1 [[]] -> this parameter [[]] | true |
-| System.Collections.ArrayList.IListWrapper.Reverse(int, int) | parameter 0 [[]] -> return [[]] | true |
-| System.Collections.ArrayList.IListWrapper.get_Item(int) | this parameter [[]] -> return | true |
-| System.Collections.ArrayList.IListWrapper.set_Item(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.ArrayList.Insert(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.ArrayList.InsertRange(int, ICollection) | parameter 1 [[]] -> this parameter [[]] | true |
-| System.Collections.ArrayList.Range.Add(object) | parameter 0 -> this parameter [[]] | true |
-| System.Collections.ArrayList.Range.AddRange(ICollection) | parameter 0 [[]] -> this parameter [[]] | true |
-| System.Collections.ArrayList.Range.Clone() | parameter 0 [[]] -> return [[]] | true |
-| System.Collections.ArrayList.Range.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.ArrayList.Range.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.ArrayList.Range.GetEnumerator(int, int) | this parameter [[]] -> return [Current] | true |
-| System.Collections.ArrayList.Range.GetRange(int, int) | parameter 0 [[]] -> return [[]] | true |
-| System.Collections.ArrayList.Range.Insert(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.ArrayList.Range.InsertRange(int, ICollection) | parameter 1 [[]] -> this parameter [[]] | true |
-| System.Collections.ArrayList.Range.Reverse(int, int) | parameter 0 [[]] -> return [[]] | true |
-| System.Collections.ArrayList.Range.get_Item(int) | this parameter [[]] -> return | true |
-| System.Collections.ArrayList.Range.set_Item(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.ArrayList.ReadOnlyArrayList.Add(object) | parameter 0 -> this parameter [[]] | true |
-| System.Collections.ArrayList.ReadOnlyArrayList.AddRange(ICollection) | parameter 0 [[]] -> this parameter [[]] | true |
-| System.Collections.ArrayList.ReadOnlyArrayList.Clone() | parameter 0 [[]] -> return [[]] | true |
-| System.Collections.ArrayList.ReadOnlyArrayList.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.ArrayList.ReadOnlyArrayList.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.ArrayList.ReadOnlyArrayList.GetEnumerator(int, int) | this parameter [[]] -> return [Current] | true |
-| System.Collections.ArrayList.ReadOnlyArrayList.GetRange(int, int) | parameter 0 [[]] -> return [[]] | true |
-| System.Collections.ArrayList.ReadOnlyArrayList.Insert(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.ArrayList.ReadOnlyArrayList.InsertRange(int, ICollection) | parameter 1 [[]] -> this parameter [[]] | true |
-| System.Collections.ArrayList.ReadOnlyArrayList.Reverse(int, int) | parameter 0 [[]] -> return [[]] | true |
-| System.Collections.ArrayList.ReadOnlyArrayList.get_Item(int) | this parameter [[]] -> return | true |
-| System.Collections.ArrayList.ReadOnlyArrayList.set_Item(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.ArrayList.ReadOnlyList.Add(object) | parameter 0 -> this parameter [[]] | true |
-| System.Collections.ArrayList.ReadOnlyList.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.ArrayList.ReadOnlyList.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.ArrayList.ReadOnlyList.Insert(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.ArrayList.ReadOnlyList.get_Item(int) | this parameter [[]] -> return | true |
-| System.Collections.ArrayList.ReadOnlyList.set_Item(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.ArrayList.Repeat(object, int) | parameter 0 -> return [[]] | true |
-| System.Collections.ArrayList.Reverse() | parameter 0 [[]] -> return [[]] | true |
-| System.Collections.ArrayList.Reverse(int, int) | parameter 0 [[]] -> return [[]] | true |
-| System.Collections.ArrayList.SyncArrayList.Add(object) | parameter 0 -> this parameter [[]] | true |
-| System.Collections.ArrayList.SyncArrayList.AddRange(ICollection) | parameter 0 [[]] -> this parameter [[]] | true |
-| System.Collections.ArrayList.SyncArrayList.Clone() | parameter 0 [[]] -> return [[]] | true |
-| System.Collections.ArrayList.SyncArrayList.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.ArrayList.SyncArrayList.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.ArrayList.SyncArrayList.GetEnumerator(int, int) | this parameter [[]] -> return [Current] | true |
-| System.Collections.ArrayList.SyncArrayList.GetRange(int, int) | parameter 0 [[]] -> return [[]] | true |
-| System.Collections.ArrayList.SyncArrayList.Insert(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.ArrayList.SyncArrayList.InsertRange(int, ICollection) | parameter 1 [[]] -> this parameter [[]] | true |
-| System.Collections.ArrayList.SyncArrayList.Reverse(int, int) | parameter 0 [[]] -> return [[]] | true |
-| System.Collections.ArrayList.SyncArrayList.get_Item(int) | this parameter [[]] -> return | true |
-| System.Collections.ArrayList.SyncArrayList.set_Item(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.ArrayList.SyncIList.Add(object) | parameter 0 -> this parameter [[]] | true |
-| System.Collections.ArrayList.SyncIList.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.ArrayList.SyncIList.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.ArrayList.SyncIList.Insert(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.ArrayList.SyncIList.get_Item(int) | this parameter [[]] -> return | true |
-| System.Collections.ArrayList.SyncIList.set_Item(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.ArrayList.get_Item(int) | this parameter [[]] -> return | true |
-| System.Collections.ArrayList.set_Item(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.BitArray.Clone() | parameter 0 [[]] -> return [[]] | true |
-| System.Collections.BitArray.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.BitArray.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.CollectionBase.Add(object) | parameter 0 -> this parameter [[]] | true |
-| System.Collections.CollectionBase.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.CollectionBase.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.CollectionBase.Insert(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.CollectionBase.get_Item(int) | this parameter [[]] -> return | true |
-| System.Collections.CollectionBase.set_Item(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.Concurrent.BlockingCollection<>.<GetConsumingEnumerable>d__68.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.Concurrent.BlockingCollection<>.Add(T) | parameter 0 -> this parameter [[]] | true |
-| System.Collections.Concurrent.BlockingCollection<>.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Concurrent.BlockingCollection<>.CopyTo(T[], int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Concurrent.BlockingCollection<>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.Concurrent.ConcurrentBag<>.Add(T) | parameter 0 -> this parameter [[]] | true |
-| System.Collections.Concurrent.ConcurrentBag<>.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Concurrent.ConcurrentBag<>.CopyTo(T[], int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Concurrent.ConcurrentBag<>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.Concurrent.ConcurrentDictionary<,>.Add(KeyValuePair<TKey, TValue>) | parameter 0 -> this parameter [[]] | true |
-| System.Collections.Concurrent.ConcurrentDictionary<,>.Add(KeyValuePair<TKey, TValue>) | parameter 0 [Key] -> this parameter [[], Key] | true |
-| System.Collections.Concurrent.ConcurrentDictionary<,>.Add(KeyValuePair<TKey, TValue>) | parameter 0 [Value] -> this parameter [[], Value] | true |
-| System.Collections.Concurrent.ConcurrentDictionary<,>.Add(TKey, TValue) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.Concurrent.ConcurrentDictionary<,>.Add(TKey, TValue) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.Concurrent.ConcurrentDictionary<,>.Add(object, object) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.Concurrent.ConcurrentDictionary<,>.Add(object, object) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.Concurrent.ConcurrentDictionary<,>.ConcurrentDictionary(IEnumerable<KeyValuePair<TKey,TValue>>) | parameter 0 [[], Key] -> return [[], Key] | true |
-| System.Collections.Concurrent.ConcurrentDictionary<,>.ConcurrentDictionary(IEnumerable<KeyValuePair<TKey,TValue>>) | parameter 0 [[], Value] -> return [[], Value] | true |
-| System.Collections.Concurrent.ConcurrentDictionary<,>.ConcurrentDictionary(IEnumerable<KeyValuePair<TKey,TValue>>, IEqualityComparer<TKey>) | parameter 0 [[], Key] -> return [[], Key] | true |
-| System.Collections.Concurrent.ConcurrentDictionary<,>.ConcurrentDictionary(IEnumerable<KeyValuePair<TKey,TValue>>, IEqualityComparer<TKey>) | parameter 0 [[], Value] -> return [[], Value] | true |
-| System.Collections.Concurrent.ConcurrentDictionary<,>.ConcurrentDictionary(int, IEnumerable<KeyValuePair<TKey,TValue>>, IEqualityComparer<TKey>) | parameter 1 [[], Key] -> return [[], Key] | true |
-| System.Collections.Concurrent.ConcurrentDictionary<,>.ConcurrentDictionary(int, IEnumerable<KeyValuePair<TKey,TValue>>, IEqualityComparer<TKey>) | parameter 1 [[], Value] -> return [[], Value] | true |
-| System.Collections.Concurrent.ConcurrentDictionary<,>.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Concurrent.ConcurrentDictionary<,>.CopyTo(KeyValuePair<TKey,TValue>[], int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Concurrent.ConcurrentDictionary<,>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.Concurrent.ConcurrentDictionary<,>.get_Item(TKey) | this parameter [[], Value] -> return | true |
-| System.Collections.Concurrent.ConcurrentDictionary<,>.get_Item(object) | this parameter [[], Value] -> return | true |
-| System.Collections.Concurrent.ConcurrentDictionary<,>.get_Keys() | this parameter [[], Key] -> return [[]] | true |
-| System.Collections.Concurrent.ConcurrentDictionary<,>.get_Values() | this parameter [[], Value] -> return [[]] | true |
-| System.Collections.Concurrent.ConcurrentDictionary<,>.set_Item(TKey, TValue) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.Concurrent.ConcurrentDictionary<,>.set_Item(TKey, TValue) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.Concurrent.ConcurrentDictionary<,>.set_Item(object, object) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.Concurrent.ConcurrentDictionary<,>.set_Item(object, object) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.Concurrent.ConcurrentQueue<>.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Concurrent.ConcurrentQueue<>.CopyTo(T[], int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Concurrent.ConcurrentQueue<>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.Concurrent.ConcurrentStack<>.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Concurrent.ConcurrentStack<>.CopyTo(T[], int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Concurrent.ConcurrentStack<>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.Concurrent.IProducerConsumerCollection<>.CopyTo(T[], int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Concurrent.OrderablePartitioner<>.EnumerableDropIndices.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.Concurrent.Partitioner.<CreateRanges>d__7.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.Concurrent.Partitioner.<CreateRanges>d__10.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.Concurrent.Partitioner.DynamicPartitionerForArray<>.InternalPartitionEnumerable.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.Concurrent.Partitioner.DynamicPartitionerForIEnumerable<>.InternalPartitionEnumerable.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.Concurrent.Partitioner.DynamicPartitionerForIList<>.InternalPartitionEnumerable.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.DictionaryBase.Add(object, object) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.DictionaryBase.Add(object, object) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.DictionaryBase.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.DictionaryBase.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.DictionaryBase.get_Item(object) | this parameter [[], Value] -> return | true |
-| System.Collections.DictionaryBase.get_Keys() | this parameter [[], Key] -> return [[]] | true |
-| System.Collections.DictionaryBase.get_Values() | this parameter [[], Value] -> return [[]] | true |
-| System.Collections.DictionaryBase.set_Item(object, object) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.DictionaryBase.set_Item(object, object) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.EmptyReadOnlyDictionaryInternal.Add(object, object) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.EmptyReadOnlyDictionaryInternal.Add(object, object) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.EmptyReadOnlyDictionaryInternal.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.EmptyReadOnlyDictionaryInternal.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.EmptyReadOnlyDictionaryInternal.get_Item(object) | this parameter [[], Value] -> return | true |
-| System.Collections.EmptyReadOnlyDictionaryInternal.get_Keys() | this parameter [[], Key] -> return [[]] | true |
-| System.Collections.EmptyReadOnlyDictionaryInternal.get_Values() | this parameter [[], Value] -> return [[]] | true |
-| System.Collections.EmptyReadOnlyDictionaryInternal.set_Item(object, object) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.EmptyReadOnlyDictionaryInternal.set_Item(object, object) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.Generic.Dictionary<,>.Add(KeyValuePair<TKey, TValue>) | parameter 0 -> this parameter [[]] | true |
-| System.Collections.Generic.Dictionary<,>.Add(KeyValuePair<TKey, TValue>) | parameter 0 [Key] -> this parameter [[], Key] | true |
-| System.Collections.Generic.Dictionary<,>.Add(KeyValuePair<TKey, TValue>) | parameter 0 [Value] -> this parameter [[], Value] | true |
-| System.Collections.Generic.Dictionary<,>.Add(TKey, TValue) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.Generic.Dictionary<,>.Add(TKey, TValue) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.Generic.Dictionary<,>.Add(object, object) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.Generic.Dictionary<,>.Add(object, object) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.Generic.Dictionary<,>.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Generic.Dictionary<,>.CopyTo(KeyValuePair<TKey,TValue>[], int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Generic.Dictionary<,>.Dictionary(IDictionary<TKey, TValue>) | parameter 0 [[], Key] -> return [[], Key] | true |
-| System.Collections.Generic.Dictionary<,>.Dictionary(IDictionary<TKey, TValue>) | parameter 0 [[], Value] -> return [[], Value] | true |
-| System.Collections.Generic.Dictionary<,>.Dictionary(IDictionary<TKey, TValue>, IEqualityComparer<TKey>) | parameter 0 [[], Key] -> return [[], Key] | true |
-| System.Collections.Generic.Dictionary<,>.Dictionary(IDictionary<TKey, TValue>, IEqualityComparer<TKey>) | parameter 0 [[], Value] -> return [[], Value] | true |
-| System.Collections.Generic.Dictionary<,>.Dictionary(IEnumerable<KeyValuePair<TKey,TValue>>) | parameter 0 [[], Key] -> return [[], Key] | true |
-| System.Collections.Generic.Dictionary<,>.Dictionary(IEnumerable<KeyValuePair<TKey,TValue>>) | parameter 0 [[], Value] -> return [[], Value] | true |
-| System.Collections.Generic.Dictionary<,>.Dictionary(IEnumerable<KeyValuePair<TKey,TValue>>, IEqualityComparer<TKey>) | parameter 0 [[], Key] -> return [[], Key] | true |
-| System.Collections.Generic.Dictionary<,>.Dictionary(IEnumerable<KeyValuePair<TKey,TValue>>, IEqualityComparer<TKey>) | parameter 0 [[], Value] -> return [[], Value] | true |
-| System.Collections.Generic.Dictionary<,>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.Generic.Dictionary<,>.KeyCollection.Add(TKey) | parameter 0 -> this parameter [[]] | true |
-| System.Collections.Generic.Dictionary<,>.KeyCollection.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Generic.Dictionary<,>.KeyCollection.CopyTo(TKey[], int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Generic.Dictionary<,>.KeyCollection.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.Generic.Dictionary<,>.ValueCollection.Add(TValue) | parameter 0 -> this parameter [[]] | true |
-| System.Collections.Generic.Dictionary<,>.ValueCollection.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Generic.Dictionary<,>.ValueCollection.CopyTo(TValue[], int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Generic.Dictionary<,>.ValueCollection.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.Generic.Dictionary<,>.get_Item(TKey) | this parameter [[], Value] -> return | true |
-| System.Collections.Generic.Dictionary<,>.get_Item(object) | this parameter [[], Value] -> return | true |
-| System.Collections.Generic.Dictionary<,>.get_Keys() | this parameter [[], Key] -> return [[]] | true |
-| System.Collections.Generic.Dictionary<,>.get_Values() | this parameter [[], Value] -> return [[]] | true |
-| System.Collections.Generic.Dictionary<,>.set_Item(TKey, TValue) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.Generic.Dictionary<,>.set_Item(TKey, TValue) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.Generic.Dictionary<,>.set_Item(object, object) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.Generic.Dictionary<,>.set_Item(object, object) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.Generic.HashSet<>.Add(T) | parameter 0 -> this parameter [[]] | true |
-| System.Collections.Generic.HashSet<>.CopyTo(T[], int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Generic.HashSet<>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.Generic.ICollection<>.Add(T) | parameter 0 -> this parameter [[]] | true |
-| System.Collections.Generic.ICollection<>.CopyTo(T[], int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Generic.IDictionary<,>.Add(TKey, TValue) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.Generic.IDictionary<,>.Add(TKey, TValue) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.Generic.IDictionary<,>.get_Item(TKey) | this parameter [[], Value] -> return | true |
-| System.Collections.Generic.IDictionary<,>.get_Keys() | this parameter [[], Key] -> return [[]] | true |
-| System.Collections.Generic.IDictionary<,>.get_Values() | this parameter [[], Value] -> return [[]] | true |
-| System.Collections.Generic.IDictionary<,>.set_Item(TKey, TValue) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.Generic.IDictionary<,>.set_Item(TKey, TValue) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.Generic.IList<>.Insert(int, T) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.Generic.IList<>.get_Item(int) | this parameter [[]] -> return | true |
-| System.Collections.Generic.IList<>.set_Item(int, T) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.Generic.ISet<>.Add(T) | parameter 0 -> this parameter [[]] | true |
-| System.Collections.Generic.KeyValuePair<,>.KeyValuePair() | parameter 0 -> return [Key] | true |
-| System.Collections.Generic.KeyValuePair<,>.KeyValuePair() | parameter 1 -> return [Value] | true |
-| System.Collections.Generic.KeyValuePair<,>.KeyValuePair(TKey, TValue) | parameter 0 -> return [Key] | true |
-| System.Collections.Generic.KeyValuePair<,>.KeyValuePair(TKey, TValue) | parameter 1 -> return [Value] | true |
-| System.Collections.Generic.LinkedList<>.Add(T) | parameter 0 -> this parameter [[]] | true |
-| System.Collections.Generic.LinkedList<>.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Generic.LinkedList<>.CopyTo(T[], int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Generic.LinkedList<>.Find(T) | this parameter [[]] -> return | true |
-| System.Collections.Generic.LinkedList<>.FindLast(T) | this parameter [[]] -> return | true |
-| System.Collections.Generic.LinkedList<>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.Generic.List<>.Add(T) | parameter 0 -> this parameter [[]] | true |
-| System.Collections.Generic.List<>.Add(object) | parameter 0 -> this parameter [[]] | true |
-| System.Collections.Generic.List<>.AddRange(IEnumerable<T>) | parameter 0 [[]] -> this parameter [[]] | true |
-| System.Collections.Generic.List<>.AsReadOnly() | parameter 0 [[]] -> return [[]] | true |
-| System.Collections.Generic.List<>.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Generic.List<>.CopyTo(T[], int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Generic.List<>.Find(Predicate<T>) | this parameter [[]] -> parameter 0 of delegate parameter 0 | true |
-| System.Collections.Generic.List<>.Find(Predicate<T>) | this parameter [[]] -> return | true |
-| System.Collections.Generic.List<>.FindAll(Predicate<T>) | this parameter [[]] -> parameter 0 of delegate parameter 0 | true |
-| System.Collections.Generic.List<>.FindAll(Predicate<T>) | this parameter [[]] -> return | true |
-| System.Collections.Generic.List<>.FindLast(Predicate<T>) | this parameter [[]] -> parameter 0 of delegate parameter 0 | true |
-| System.Collections.Generic.List<>.FindLast(Predicate<T>) | this parameter [[]] -> return | true |
-| System.Collections.Generic.List<>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.Generic.List<>.GetRange(int, int) | parameter 0 [[]] -> return [[]] | true |
-| System.Collections.Generic.List<>.Insert(int, T) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.Generic.List<>.Insert(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.Generic.List<>.InsertRange(int, IEnumerable<T>) | parameter 1 [[]] -> this parameter [[]] | true |
-| System.Collections.Generic.List<>.Reverse() | parameter 0 [[]] -> return [[]] | true |
-| System.Collections.Generic.List<>.Reverse(int, int) | parameter 0 [[]] -> return [[]] | true |
-| System.Collections.Generic.List<>.get_Item(int) | this parameter [[]] -> return | true |
-| System.Collections.Generic.List<>.set_Item(int, T) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.Generic.List<>.set_Item(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.Generic.Queue<>.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Generic.Queue<>.CopyTo(T[], int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Generic.Queue<>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.Generic.Queue<>.Peek() | this parameter [[]] -> return | true |
-| System.Collections.Generic.SortedDictionary<,>.Add(KeyValuePair<TKey, TValue>) | parameter 0 -> this parameter [[]] | true |
-| System.Collections.Generic.SortedDictionary<,>.Add(KeyValuePair<TKey, TValue>) | parameter 0 [Key] -> this parameter [[], Key] | true |
-| System.Collections.Generic.SortedDictionary<,>.Add(KeyValuePair<TKey, TValue>) | parameter 0 [Value] -> this parameter [[], Value] | true |
-| System.Collections.Generic.SortedDictionary<,>.Add(TKey, TValue) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.Generic.SortedDictionary<,>.Add(TKey, TValue) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.Generic.SortedDictionary<,>.Add(object, object) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.Generic.SortedDictionary<,>.Add(object, object) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.Generic.SortedDictionary<,>.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Generic.SortedDictionary<,>.CopyTo(KeyValuePair<TKey,TValue>[], int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Generic.SortedDictionary<,>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.Generic.SortedDictionary<,>.KeyCollection.Add(TKey) | parameter 0 -> this parameter [[]] | true |
-| System.Collections.Generic.SortedDictionary<,>.KeyCollection.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Generic.SortedDictionary<,>.KeyCollection.CopyTo(TKey[], int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Generic.SortedDictionary<,>.KeyCollection.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.Generic.SortedDictionary<,>.SortedDictionary(IDictionary<TKey, TValue>) | parameter 0 [[], Key] -> return [[], Key] | true |
-| System.Collections.Generic.SortedDictionary<,>.SortedDictionary(IDictionary<TKey, TValue>) | parameter 0 [[], Value] -> return [[], Value] | true |
-| System.Collections.Generic.SortedDictionary<,>.SortedDictionary(IDictionary<TKey, TValue>, IComparer<TKey>) | parameter 0 [[], Key] -> return [[], Key] | true |
-| System.Collections.Generic.SortedDictionary<,>.SortedDictionary(IDictionary<TKey, TValue>, IComparer<TKey>) | parameter 0 [[], Value] -> return [[], Value] | true |
-| System.Collections.Generic.SortedDictionary<,>.ValueCollection.Add(TValue) | parameter 0 -> this parameter [[]] | true |
-| System.Collections.Generic.SortedDictionary<,>.ValueCollection.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Generic.SortedDictionary<,>.ValueCollection.CopyTo(TValue[], int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Generic.SortedDictionary<,>.ValueCollection.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.Generic.SortedDictionary<,>.get_Item(TKey) | this parameter [[], Value] -> return | true |
-| System.Collections.Generic.SortedDictionary<,>.get_Item(object) | this parameter [[], Value] -> return | true |
-| System.Collections.Generic.SortedDictionary<,>.get_Keys() | this parameter [[], Key] -> return [[]] | true |
-| System.Collections.Generic.SortedDictionary<,>.get_Values() | this parameter [[], Value] -> return [[]] | true |
-| System.Collections.Generic.SortedDictionary<,>.set_Item(TKey, TValue) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.Generic.SortedDictionary<,>.set_Item(TKey, TValue) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.Generic.SortedDictionary<,>.set_Item(object, object) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.Generic.SortedDictionary<,>.set_Item(object, object) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.Generic.SortedList<,>.Add(KeyValuePair<TKey, TValue>) | parameter 0 -> this parameter [[]] | true |
-| System.Collections.Generic.SortedList<,>.Add(KeyValuePair<TKey, TValue>) | parameter 0 [Key] -> this parameter [[], Key] | true |
-| System.Collections.Generic.SortedList<,>.Add(KeyValuePair<TKey, TValue>) | parameter 0 [Value] -> this parameter [[], Value] | true |
-| System.Collections.Generic.SortedList<,>.Add(TKey, TValue) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.Generic.SortedList<,>.Add(TKey, TValue) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.Generic.SortedList<,>.Add(object, object) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.Generic.SortedList<,>.Add(object, object) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.Generic.SortedList<,>.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Generic.SortedList<,>.CopyTo(KeyValuePair<TKey,TValue>[], int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Generic.SortedList<,>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.Generic.SortedList<,>.KeyList.Add(TKey) | parameter 0 -> this parameter [[]] | true |
-| System.Collections.Generic.SortedList<,>.KeyList.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Generic.SortedList<,>.KeyList.CopyTo(TKey[], int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Generic.SortedList<,>.KeyList.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.Generic.SortedList<,>.KeyList.Insert(int, TKey) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.Generic.SortedList<,>.KeyList.get_Item(int) | this parameter [[]] -> return | true |
-| System.Collections.Generic.SortedList<,>.KeyList.set_Item(int, TKey) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.Generic.SortedList<,>.SortedList(IDictionary<TKey, TValue>) | parameter 0 [[], Key] -> return [[], Key] | true |
-| System.Collections.Generic.SortedList<,>.SortedList(IDictionary<TKey, TValue>) | parameter 0 [[], Value] -> return [[], Value] | true |
-| System.Collections.Generic.SortedList<,>.SortedList(IDictionary<TKey, TValue>, IComparer<TKey>) | parameter 0 [[], Key] -> return [[], Key] | true |
-| System.Collections.Generic.SortedList<,>.SortedList(IDictionary<TKey, TValue>, IComparer<TKey>) | parameter 0 [[], Value] -> return [[], Value] | true |
-| System.Collections.Generic.SortedList<,>.ValueList.Add(TValue) | parameter 0 -> this parameter [[]] | true |
-| System.Collections.Generic.SortedList<,>.ValueList.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Generic.SortedList<,>.ValueList.CopyTo(TValue[], int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Generic.SortedList<,>.ValueList.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.Generic.SortedList<,>.ValueList.Insert(int, TValue) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.Generic.SortedList<,>.ValueList.get_Item(int) | this parameter [[]] -> return | true |
-| System.Collections.Generic.SortedList<,>.ValueList.set_Item(int, TValue) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.Generic.SortedList<,>.get_Item(TKey) | this parameter [[], Value] -> return | true |
-| System.Collections.Generic.SortedList<,>.get_Item(object) | this parameter [[], Value] -> return | true |
-| System.Collections.Generic.SortedList<,>.get_Keys() | this parameter [[], Key] -> return [[]] | true |
-| System.Collections.Generic.SortedList<,>.get_Values() | this parameter [[], Value] -> return [[]] | true |
-| System.Collections.Generic.SortedList<,>.set_Item(TKey, TValue) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.Generic.SortedList<,>.set_Item(TKey, TValue) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.Generic.SortedList<,>.set_Item(object, object) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.Generic.SortedList<,>.set_Item(object, object) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.Generic.SortedSet<>.<Reverse>d__84.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.Generic.SortedSet<>.Add(T) | parameter 0 -> this parameter [[]] | true |
-| System.Collections.Generic.SortedSet<>.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Generic.SortedSet<>.CopyTo(T[], int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Generic.SortedSet<>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.Generic.SortedSet<>.Reverse() | parameter 0 [[]] -> return [[]] | true |
-| System.Collections.Generic.Stack<>.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Generic.Stack<>.CopyTo(T[], int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Generic.Stack<>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.Generic.Stack<>.Peek() | this parameter [[]] -> return | true |
-| System.Collections.Generic.Stack<>.Pop() | this parameter [[]] -> return | true |
-| System.Collections.Hashtable.Add(object, object) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.Hashtable.Add(object, object) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.Hashtable.Clone() | parameter 0 [[]] -> return [[]] | true |
-| System.Collections.Hashtable.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Hashtable.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.Hashtable.Hashtable(IDictionary) | parameter 0 [[], Key] -> return [[], Key] | true |
-| System.Collections.Hashtable.Hashtable(IDictionary) | parameter 0 [[], Value] -> return [[], Value] | true |
-| System.Collections.Hashtable.Hashtable(IDictionary, IEqualityComparer) | parameter 0 [[], Key] -> return [[], Key] | true |
-| System.Collections.Hashtable.Hashtable(IDictionary, IEqualityComparer) | parameter 0 [[], Value] -> return [[], Value] | true |
-| System.Collections.Hashtable.Hashtable(IDictionary, IHashCodeProvider, IComparer) | parameter 0 [[], Key] -> return [[], Key] | true |
-| System.Collections.Hashtable.Hashtable(IDictionary, IHashCodeProvider, IComparer) | parameter 0 [[], Value] -> return [[], Value] | true |
-| System.Collections.Hashtable.Hashtable(IDictionary, float) | parameter 0 [[], Key] -> return [[], Key] | true |
-| System.Collections.Hashtable.Hashtable(IDictionary, float) | parameter 0 [[], Value] -> return [[], Value] | true |
-| System.Collections.Hashtable.Hashtable(IDictionary, float, IEqualityComparer) | parameter 0 [[], Key] -> return [[], Key] | true |
-| System.Collections.Hashtable.Hashtable(IDictionary, float, IEqualityComparer) | parameter 0 [[], Value] -> return [[], Value] | true |
-| System.Collections.Hashtable.Hashtable(IDictionary, float, IHashCodeProvider, IComparer) | parameter 0 [[], Key] -> return [[], Key] | true |
-| System.Collections.Hashtable.Hashtable(IDictionary, float, IHashCodeProvider, IComparer) | parameter 0 [[], Value] -> return [[], Value] | true |
-| System.Collections.Hashtable.KeyCollection.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Hashtable.KeyCollection.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.Hashtable.SyncHashtable.Add(object, object) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.Hashtable.SyncHashtable.Add(object, object) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.Hashtable.SyncHashtable.Clone() | parameter 0 [[]] -> return [[]] | true |
-| System.Collections.Hashtable.SyncHashtable.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Hashtable.SyncHashtable.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.Hashtable.SyncHashtable.get_Item(object) | this parameter [[], Value] -> return | true |
-| System.Collections.Hashtable.SyncHashtable.get_Keys() | this parameter [[], Key] -> return [[]] | true |
-| System.Collections.Hashtable.SyncHashtable.get_Values() | this parameter [[], Value] -> return [[]] | true |
-| System.Collections.Hashtable.SyncHashtable.set_Item(object, object) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.Hashtable.SyncHashtable.set_Item(object, object) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.Hashtable.ValueCollection.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Hashtable.ValueCollection.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.Hashtable.get_Item(object) | this parameter [[], Value] -> return | true |
-| System.Collections.Hashtable.get_Keys() | this parameter [[], Key] -> return [[]] | true |
-| System.Collections.Hashtable.get_Values() | this parameter [[], Value] -> return [[]] | true |
-| System.Collections.Hashtable.set_Item(object, object) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.Hashtable.set_Item(object, object) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.ICollection.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.IDictionary.Add(object, object) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.IDictionary.Add(object, object) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.IDictionary.get_Item(object) | this parameter [[], Value] -> return | true |
-| System.Collections.IDictionary.get_Keys() | this parameter [[], Key] -> return [[]] | true |
-| System.Collections.IDictionary.get_Values() | this parameter [[], Value] -> return [[]] | true |
-| System.Collections.IDictionary.set_Item(object, object) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.IDictionary.set_Item(object, object) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.IEnumerable.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.IList.Add(object) | parameter 0 -> this parameter [[]] | true |
-| System.Collections.IList.Insert(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.IList.get_Item(int) | this parameter [[]] -> return | true |
-| System.Collections.IList.set_Item(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.ListDictionaryInternal.Add(object, object) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.ListDictionaryInternal.Add(object, object) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.ListDictionaryInternal.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.ListDictionaryInternal.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.ListDictionaryInternal.NodeKeyValueCollection.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.ListDictionaryInternal.NodeKeyValueCollection.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.ListDictionaryInternal.get_Item(object) | this parameter [[], Value] -> return | true |
-| System.Collections.ListDictionaryInternal.get_Keys() | this parameter [[], Key] -> return [[]] | true |
-| System.Collections.ListDictionaryInternal.get_Values() | this parameter [[], Value] -> return [[]] | true |
-| System.Collections.ListDictionaryInternal.set_Item(object, object) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.ListDictionaryInternal.set_Item(object, object) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.ObjectModel.Collection<>.Add(T) | parameter 0 -> this parameter [[]] | true |
-| System.Collections.ObjectModel.Collection<>.Add(object) | parameter 0 -> this parameter [[]] | true |
-| System.Collections.ObjectModel.Collection<>.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.ObjectModel.Collection<>.CopyTo(T[], int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.ObjectModel.Collection<>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.ObjectModel.Collection<>.Insert(int, T) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.ObjectModel.Collection<>.Insert(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.ObjectModel.Collection<>.get_Item(int) | this parameter [[]] -> return | true |
-| System.Collections.ObjectModel.Collection<>.set_Item(int, T) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.ObjectModel.Collection<>.set_Item(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.ObjectModel.KeyedCollection<,>.get_Item(TKey) | this parameter [[]] -> return | true |
-| System.Collections.ObjectModel.ReadOnlyCollection<>.Add(T) | parameter 0 -> this parameter [[]] | true |
-| System.Collections.ObjectModel.ReadOnlyCollection<>.Add(object) | parameter 0 -> this parameter [[]] | true |
-| System.Collections.ObjectModel.ReadOnlyCollection<>.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.ObjectModel.ReadOnlyCollection<>.CopyTo(T[], int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.ObjectModel.ReadOnlyCollection<>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.ObjectModel.ReadOnlyCollection<>.Insert(int, T) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.ObjectModel.ReadOnlyCollection<>.Insert(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.ObjectModel.ReadOnlyCollection<>.get_Item(int) | this parameter [[]] -> return | true |
-| System.Collections.ObjectModel.ReadOnlyCollection<>.set_Item(int, T) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.ObjectModel.ReadOnlyCollection<>.set_Item(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.ObjectModel.ReadOnlyDictionary<,>.Add(KeyValuePair<TKey, TValue>) | parameter 0 -> this parameter [[]] | true |
-| System.Collections.ObjectModel.ReadOnlyDictionary<,>.Add(KeyValuePair<TKey, TValue>) | parameter 0 [Key] -> this parameter [[], Key] | true |
-| System.Collections.ObjectModel.ReadOnlyDictionary<,>.Add(KeyValuePair<TKey, TValue>) | parameter 0 [Value] -> this parameter [[], Value] | true |
-| System.Collections.ObjectModel.ReadOnlyDictionary<,>.Add(TKey, TValue) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.ObjectModel.ReadOnlyDictionary<,>.Add(TKey, TValue) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.ObjectModel.ReadOnlyDictionary<,>.Add(object, object) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.ObjectModel.ReadOnlyDictionary<,>.Add(object, object) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.ObjectModel.ReadOnlyDictionary<,>.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.ObjectModel.ReadOnlyDictionary<,>.CopyTo(KeyValuePair<TKey,TValue>[], int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.ObjectModel.ReadOnlyDictionary<,>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.ObjectModel.ReadOnlyDictionary<,>.KeyCollection.Add(TKey) | parameter 0 -> this parameter [[]] | true |
-| System.Collections.ObjectModel.ReadOnlyDictionary<,>.KeyCollection.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.ObjectModel.ReadOnlyDictionary<,>.KeyCollection.CopyTo(TKey[], int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.ObjectModel.ReadOnlyDictionary<,>.KeyCollection.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.ObjectModel.ReadOnlyDictionary<,>.ReadOnlyDictionary(IDictionary<TKey, TValue>) | parameter 0 [[], Key] -> return [[], Key] | true |
-| System.Collections.ObjectModel.ReadOnlyDictionary<,>.ReadOnlyDictionary(IDictionary<TKey, TValue>) | parameter 0 [[], Value] -> return [[], Value] | true |
-| System.Collections.ObjectModel.ReadOnlyDictionary<,>.ValueCollection.Add(TValue) | parameter 0 -> this parameter [[]] | true |
-| System.Collections.ObjectModel.ReadOnlyDictionary<,>.ValueCollection.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.ObjectModel.ReadOnlyDictionary<,>.ValueCollection.CopyTo(TValue[], int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.ObjectModel.ReadOnlyDictionary<,>.ValueCollection.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.ObjectModel.ReadOnlyDictionary<,>.get_Item(TKey) | this parameter [[], Value] -> return | true |
-| System.Collections.ObjectModel.ReadOnlyDictionary<,>.get_Item(object) | this parameter [[], Value] -> return | true |
-| System.Collections.ObjectModel.ReadOnlyDictionary<,>.get_Keys() | this parameter [[], Key] -> return [[]] | true |
-| System.Collections.ObjectModel.ReadOnlyDictionary<,>.get_Values() | this parameter [[], Value] -> return [[]] | true |
-| System.Collections.ObjectModel.ReadOnlyDictionary<,>.set_Item(TKey, TValue) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.ObjectModel.ReadOnlyDictionary<,>.set_Item(TKey, TValue) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.ObjectModel.ReadOnlyDictionary<,>.set_Item(object, object) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.ObjectModel.ReadOnlyDictionary<,>.set_Item(object, object) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.Queue.Clone() | parameter 0 [[]] -> return [[]] | true |
-| System.Collections.Queue.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Queue.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.Queue.Peek() | this parameter [[]] -> return | true |
-| System.Collections.Queue.SynchronizedQueue.Clone() | parameter 0 [[]] -> return [[]] | true |
-| System.Collections.Queue.SynchronizedQueue.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Queue.SynchronizedQueue.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.Queue.SynchronizedQueue.Peek() | this parameter [[]] -> return | true |
-| System.Collections.ReadOnlyCollectionBase.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.ReadOnlyCollectionBase.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.SortedList.Add(object, object) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.SortedList.Add(object, object) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.SortedList.Clone() | parameter 0 [[]] -> return [[]] | true |
-| System.Collections.SortedList.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.SortedList.GetByIndex(int) | this parameter [[], Value] -> return | true |
-| System.Collections.SortedList.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.SortedList.GetValueList() | this parameter [[], Value] -> return [[]] | true |
-| System.Collections.SortedList.KeyList.Add(object) | parameter 0 -> this parameter [[]] | true |
-| System.Collections.SortedList.KeyList.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.SortedList.KeyList.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.SortedList.KeyList.Insert(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.SortedList.KeyList.get_Item(int) | this parameter [[]] -> return | true |
-| System.Collections.SortedList.KeyList.set_Item(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.SortedList.SortedList(IDictionary) | parameter 0 [[], Key] -> return [[], Key] | true |
-| System.Collections.SortedList.SortedList(IDictionary) | parameter 0 [[], Value] -> return [[], Value] | true |
-| System.Collections.SortedList.SortedList(IDictionary, IComparer) | parameter 0 [[], Key] -> return [[], Key] | true |
-| System.Collections.SortedList.SortedList(IDictionary, IComparer) | parameter 0 [[], Value] -> return [[], Value] | true |
-| System.Collections.SortedList.SyncSortedList.Add(object, object) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.SortedList.SyncSortedList.Add(object, object) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.SortedList.SyncSortedList.Clone() | parameter 0 [[]] -> return [[]] | true |
-| System.Collections.SortedList.SyncSortedList.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.SortedList.SyncSortedList.GetByIndex(int) | this parameter [[], Value] -> return | true |
-| System.Collections.SortedList.SyncSortedList.GetValueList() | this parameter [[], Value] -> return [[]] | true |
-| System.Collections.SortedList.SyncSortedList.get_Item(object) | this parameter [[], Value] -> return | true |
-| System.Collections.SortedList.SyncSortedList.set_Item(object, object) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.SortedList.SyncSortedList.set_Item(object, object) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.SortedList.ValueList.Add(object) | parameter 0 -> this parameter [[]] | true |
-| System.Collections.SortedList.ValueList.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.SortedList.ValueList.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.SortedList.ValueList.Insert(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.SortedList.ValueList.get_Item(int) | this parameter [[]] -> return | true |
-| System.Collections.SortedList.ValueList.set_Item(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.SortedList.get_Item(object) | this parameter [[], Value] -> return | true |
-| System.Collections.SortedList.get_Keys() | this parameter [[], Key] -> return [[]] | true |
-| System.Collections.SortedList.get_Values() | this parameter [[], Value] -> return [[]] | true |
-| System.Collections.SortedList.set_Item(object, object) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.SortedList.set_Item(object, object) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.Specialized.HybridDictionary.Add(object, object) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.Specialized.HybridDictionary.Add(object, object) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.Specialized.HybridDictionary.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Specialized.HybridDictionary.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.Specialized.HybridDictionary.get_Item(object) | this parameter [[], Value] -> return | true |
-| System.Collections.Specialized.HybridDictionary.get_Keys() | this parameter [[], Key] -> return [[]] | true |
-| System.Collections.Specialized.HybridDictionary.get_Values() | this parameter [[], Value] -> return [[]] | true |
-| System.Collections.Specialized.HybridDictionary.set_Item(object, object) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.Specialized.HybridDictionary.set_Item(object, object) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.Specialized.IOrderedDictionary.get_Item(int) | this parameter [[], Value] -> return | true |
-| System.Collections.Specialized.IOrderedDictionary.set_Item(int, object) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.Specialized.IOrderedDictionary.set_Item(int, object) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.Specialized.ListDictionary.Add(object, object) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.Specialized.ListDictionary.Add(object, object) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.Specialized.ListDictionary.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Specialized.ListDictionary.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.Specialized.ListDictionary.NodeKeyValueCollection.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Specialized.ListDictionary.NodeKeyValueCollection.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.Specialized.ListDictionary.get_Item(object) | this parameter [[], Value] -> return | true |
-| System.Collections.Specialized.ListDictionary.get_Keys() | this parameter [[], Key] -> return [[]] | true |
-| System.Collections.Specialized.ListDictionary.get_Values() | this parameter [[], Value] -> return [[]] | true |
-| System.Collections.Specialized.ListDictionary.set_Item(object, object) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.Specialized.ListDictionary.set_Item(object, object) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.Specialized.NameObjectCollectionBase.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Specialized.NameObjectCollectionBase.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.Specialized.NameObjectCollectionBase.KeysCollection.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Specialized.NameObjectCollectionBase.KeysCollection.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.Specialized.NameValueCollection.Add(NameValueCollection) | parameter 0 -> this parameter [[]] | true |
-| System.Collections.Specialized.NameValueCollection.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Specialized.OrderedDictionary.Add(object, object) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.Specialized.OrderedDictionary.Add(object, object) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.Specialized.OrderedDictionary.AsReadOnly() | parameter 0 [[]] -> return [[]] | true |
-| System.Collections.Specialized.OrderedDictionary.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Specialized.OrderedDictionary.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.Specialized.OrderedDictionary.OrderedDictionaryKeyValueCollection.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Specialized.OrderedDictionary.OrderedDictionaryKeyValueCollection.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.Specialized.OrderedDictionary.get_Item(int) | this parameter [[], Value] -> return | true |
-| System.Collections.Specialized.OrderedDictionary.get_Item(object) | this parameter [[], Value] -> return | true |
-| System.Collections.Specialized.OrderedDictionary.get_Keys() | this parameter [[], Key] -> return [[]] | true |
-| System.Collections.Specialized.OrderedDictionary.get_Values() | this parameter [[], Value] -> return [[]] | true |
-| System.Collections.Specialized.OrderedDictionary.set_Item(int, object) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.Specialized.OrderedDictionary.set_Item(int, object) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.Specialized.OrderedDictionary.set_Item(object, object) | parameter 0 -> this parameter [[], Key] | true |
-| System.Collections.Specialized.OrderedDictionary.set_Item(object, object) | parameter 1 -> this parameter [[], Value] | true |
-| System.Collections.Specialized.ReadOnlyList.Add(object) | parameter 0 -> this parameter [[]] | true |
-| System.Collections.Specialized.ReadOnlyList.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Specialized.ReadOnlyList.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.Specialized.ReadOnlyList.Insert(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.Specialized.ReadOnlyList.get_Item(int) | this parameter [[]] -> return | true |
-| System.Collections.Specialized.ReadOnlyList.set_Item(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.Specialized.StringCollection.Add(object) | parameter 0 -> this parameter [[]] | true |
-| System.Collections.Specialized.StringCollection.Add(string) | parameter 0 -> this parameter [[]] | true |
-| System.Collections.Specialized.StringCollection.AddRange(String[]) | parameter 0 [[]] -> this parameter [[]] | true |
-| System.Collections.Specialized.StringCollection.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Specialized.StringCollection.CopyTo(String[], int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Specialized.StringCollection.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.Specialized.StringCollection.Insert(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.Specialized.StringCollection.Insert(int, string) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.Specialized.StringCollection.get_Item(int) | this parameter [[]] -> return | true |
-| System.Collections.Specialized.StringCollection.set_Item(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.Specialized.StringCollection.set_Item(int, string) | parameter 1 -> this parameter [[]] | true |
-| System.Collections.Specialized.StringDictionary.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.Stack.Clone() | parameter 0 [[]] -> return [[]] | true |
-| System.Collections.Stack.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Stack.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.Stack.Peek() | this parameter [[]] -> return | true |
-| System.Collections.Stack.Pop() | this parameter [[]] -> return | true |
-| System.Collections.Stack.SyncStack.Clone() | parameter 0 [[]] -> return [[]] | true |
-| System.Collections.Stack.SyncStack.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Collections.Stack.SyncStack.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Collections.Stack.SyncStack.Peek() | this parameter [[]] -> return | true |
-| System.Collections.Stack.SyncStack.Pop() | this parameter [[]] -> return | true |
-| System.ComponentModel.AttributeCollection.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.ComponentModel.AttributeCollection.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.ComponentModel.BindingList<>.Find(PropertyDescriptor, object) | this parameter [[]] -> return | true |
-| System.ComponentModel.Design.DesignerCollection.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.ComponentModel.Design.DesignerCollection.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.ComponentModel.Design.DesignerOptionService.DesignerOptionCollection.Add(object) | parameter 0 -> this parameter [[]] | true |
-| System.ComponentModel.Design.DesignerOptionService.DesignerOptionCollection.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.ComponentModel.Design.DesignerOptionService.DesignerOptionCollection.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.ComponentModel.Design.DesignerOptionService.DesignerOptionCollection.Insert(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.ComponentModel.Design.DesignerOptionService.DesignerOptionCollection.get_Item(int) | this parameter [[]] -> return | true |
-| System.ComponentModel.Design.DesignerOptionService.DesignerOptionCollection.get_Item(string) | this parameter [[]] -> return | true |
-| System.ComponentModel.Design.DesignerOptionService.DesignerOptionCollection.set_Item(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.ComponentModel.Design.DesignerVerbCollection.Add(DesignerVerb) | parameter 0 -> this parameter [[]] | true |
-| System.ComponentModel.Design.DesignerVerbCollection.AddRange(DesignerVerbCollection) | parameter 0 [[]] -> this parameter [[]] | true |
-| System.ComponentModel.Design.DesignerVerbCollection.AddRange(DesignerVerb[]) | parameter 0 [[]] -> this parameter [[]] | true |
-| System.ComponentModel.Design.DesignerVerbCollection.CopyTo(DesignerVerb[], int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.ComponentModel.Design.DesignerVerbCollection.Insert(int, DesignerVerb) | parameter 1 -> this parameter [[]] | true |
-| System.ComponentModel.Design.DesignerVerbCollection.get_Item(int) | this parameter [[]] -> return | true |
-| System.ComponentModel.Design.DesignerVerbCollection.set_Item(int, DesignerVerb) | parameter 1 -> this parameter [[]] | true |
-| System.ComponentModel.EventDescriptorCollection.Add(EventDescriptor) | parameter 0 -> this parameter [[]] | true |
-| System.ComponentModel.EventDescriptorCollection.Add(object) | parameter 0 -> this parameter [[]] | true |
-| System.ComponentModel.EventDescriptorCollection.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.ComponentModel.EventDescriptorCollection.Find(string, bool) | this parameter [[]] -> return | true |
-| System.ComponentModel.EventDescriptorCollection.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.ComponentModel.EventDescriptorCollection.Insert(int, EventDescriptor) | parameter 1 -> this parameter [[]] | true |
-| System.ComponentModel.EventDescriptorCollection.Insert(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.ComponentModel.EventDescriptorCollection.get_Item(int) | this parameter [[]] -> return | true |
-| System.ComponentModel.EventDescriptorCollection.get_Item(string) | this parameter [[]] -> return | true |
-| System.ComponentModel.EventDescriptorCollection.set_Item(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.ComponentModel.IBindingList.Find(PropertyDescriptor, object) | this parameter [[]] -> return | true |
-| System.ComponentModel.ListSortDescriptionCollection.Add(object) | parameter 0 -> this parameter [[]] | true |
-| System.ComponentModel.ListSortDescriptionCollection.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.ComponentModel.ListSortDescriptionCollection.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.ComponentModel.ListSortDescriptionCollection.Insert(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.ComponentModel.ListSortDescriptionCollection.get_Item(int) | this parameter [[]] -> return | true |
-| System.ComponentModel.ListSortDescriptionCollection.set_Item(int, ListSortDescription) | parameter 1 -> this parameter [[]] | true |
-| System.ComponentModel.ListSortDescriptionCollection.set_Item(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.ComponentModel.PropertyDescriptorCollection.Add(PropertyDescriptor) | parameter 0 -> this parameter [[]] | true |
-| System.ComponentModel.PropertyDescriptorCollection.Add(PropertyDescriptor) | parameter 0 [Key] -> this parameter [[], Key] | true |
-| System.ComponentModel.PropertyDescriptorCollection.Add(PropertyDescriptor) | parameter 0 [Value] -> this parameter [[], Value] | true |
-| System.ComponentModel.PropertyDescriptorCollection.Add(object) | parameter 0 -> this parameter [[]] | true |
-| System.ComponentModel.PropertyDescriptorCollection.Add(object) | parameter 0 [Key] -> this parameter [[], Key] | true |
-| System.ComponentModel.PropertyDescriptorCollection.Add(object) | parameter 0 [Value] -> this parameter [[], Value] | true |
-| System.ComponentModel.PropertyDescriptorCollection.Add(object, object) | parameter 0 -> this parameter [[], Key] | true |
-| System.ComponentModel.PropertyDescriptorCollection.Add(object, object) | parameter 1 -> this parameter [[], Value] | true |
-| System.ComponentModel.PropertyDescriptorCollection.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.ComponentModel.PropertyDescriptorCollection.Find(string, bool) | this parameter [[]] -> return | true |
-| System.ComponentModel.PropertyDescriptorCollection.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.ComponentModel.PropertyDescriptorCollection.Insert(int, PropertyDescriptor) | parameter 1 -> this parameter [[]] | true |
-| System.ComponentModel.PropertyDescriptorCollection.Insert(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.ComponentModel.PropertyDescriptorCollection.PropertyDescriptorCollection(PropertyDescriptor[]) | parameter 0 [[], Key] -> return [[], Key] | true |
-| System.ComponentModel.PropertyDescriptorCollection.PropertyDescriptorCollection(PropertyDescriptor[]) | parameter 0 [[], Value] -> return [[], Value] | true |
-| System.ComponentModel.PropertyDescriptorCollection.PropertyDescriptorCollection(PropertyDescriptor[], bool) | parameter 0 [[], Key] -> return [[], Key] | true |
-| System.ComponentModel.PropertyDescriptorCollection.PropertyDescriptorCollection(PropertyDescriptor[], bool) | parameter 0 [[], Value] -> return [[], Value] | true |
-| System.ComponentModel.PropertyDescriptorCollection.get_Item(int) | this parameter [[], Value] -> return | true |
-| System.ComponentModel.PropertyDescriptorCollection.get_Item(int) | this parameter [[]] -> return | true |
-| System.ComponentModel.PropertyDescriptorCollection.get_Item(object) | this parameter [[], Value] -> return | true |
-| System.ComponentModel.PropertyDescriptorCollection.get_Item(object) | this parameter [[]] -> return | true |
-| System.ComponentModel.PropertyDescriptorCollection.get_Item(string) | this parameter [[], Value] -> return | true |
-| System.ComponentModel.PropertyDescriptorCollection.get_Item(string) | this parameter [[]] -> return | true |
-| System.ComponentModel.PropertyDescriptorCollection.get_Keys() | this parameter [[], Key] -> return [[]] | true |
-| System.ComponentModel.PropertyDescriptorCollection.get_Values() | this parameter [[], Value] -> return [[]] | true |
-| System.ComponentModel.PropertyDescriptorCollection.set_Item(int, object) | parameter 0 -> this parameter [[], Key] | true |
-| System.ComponentModel.PropertyDescriptorCollection.set_Item(int, object) | parameter 1 -> this parameter [[], Value] | true |
-| System.ComponentModel.PropertyDescriptorCollection.set_Item(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.ComponentModel.PropertyDescriptorCollection.set_Item(object, object) | parameter 0 -> this parameter [[], Key] | true |
-| System.ComponentModel.PropertyDescriptorCollection.set_Item(object, object) | parameter 1 -> this parameter [[], Value] | true |
-| System.ComponentModel.PropertyDescriptorCollection.set_Item(object, object) | parameter 1 -> this parameter [[]] | true |
-| System.ComponentModel.TypeConverter.StandardValuesCollection.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.ComponentModel.TypeConverter.StandardValuesCollection.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.ConsolePal.UnixConsoleStream.Read(Byte[], int, int) | this parameter -> parameter 0 | false |
-| System.ConsolePal.UnixConsoleStream.Write(Byte[], int, int) | parameter 0 -> this parameter | false |
-| System.Convert.ChangeType(object, Type) | parameter 0 -> return | false |
-| System.Convert.ChangeType(object, Type, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.ChangeType(object, TypeCode) | parameter 0 -> return | false |
-| System.Convert.ChangeType(object, TypeCode, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.FromBase64CharArray(Char[], int, int) | parameter 0 -> return | false |
-| System.Convert.FromBase64String(string) | parameter 0 -> return | false |
-| System.Convert.FromHexString(ReadOnlySpan<Char>) | parameter 0 -> return | false |
-| System.Convert.FromHexString(string) | parameter 0 -> return | false |
-| System.Convert.GetTypeCode(object) | parameter 0 -> return | false |
-| System.Convert.IsDBNull(object) | parameter 0 -> return | false |
-| System.Convert.ToBase64CharArray(Byte[], int, int, Char[], int) | parameter 0 -> return | false |
-| System.Convert.ToBase64CharArray(Byte[], int, int, Char[], int, Base64FormattingOptions) | parameter 0 -> return | false |
-| System.Convert.ToBase64String(Byte[]) | parameter 0 -> return | false |
-| System.Convert.ToBase64String(Byte[], Base64FormattingOptions) | parameter 0 -> return | false |
-| System.Convert.ToBase64String(Byte[], int, int) | parameter 0 -> return | false |
-| System.Convert.ToBase64String(Byte[], int, int, Base64FormattingOptions) | parameter 0 -> return | false |
-| System.Convert.ToBase64String(ReadOnlySpan<Byte>, Base64FormattingOptions) | parameter 0 -> return | false |
-| System.Convert.ToBoolean(DateTime) | parameter 0 -> return | false |
-| System.Convert.ToBoolean(bool) | parameter 0 -> return | false |
-| System.Convert.ToBoolean(byte) | parameter 0 -> return | false |
-| System.Convert.ToBoolean(char) | parameter 0 -> return | false |
-| System.Convert.ToBoolean(decimal) | parameter 0 -> return | false |
-| System.Convert.ToBoolean(double) | parameter 0 -> return | false |
-| System.Convert.ToBoolean(float) | parameter 0 -> return | false |
-| System.Convert.ToBoolean(int) | parameter 0 -> return | false |
-| System.Convert.ToBoolean(long) | parameter 0 -> return | false |
-| System.Convert.ToBoolean(object) | parameter 0 -> return | false |
-| System.Convert.ToBoolean(object, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.ToBoolean(sbyte) | parameter 0 -> return | false |
-| System.Convert.ToBoolean(short) | parameter 0 -> return | false |
-| System.Convert.ToBoolean(string) | parameter 0 -> return | false |
-| System.Convert.ToBoolean(string, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.ToBoolean(uint) | parameter 0 -> return | false |
-| System.Convert.ToBoolean(ulong) | parameter 0 -> return | false |
-| System.Convert.ToBoolean(ushort) | parameter 0 -> return | false |
-| System.Convert.ToByte(DateTime) | parameter 0 -> return | false |
-| System.Convert.ToByte(bool) | parameter 0 -> return | false |
-| System.Convert.ToByte(byte) | parameter 0 -> return | false |
-| System.Convert.ToByte(char) | parameter 0 -> return | false |
-| System.Convert.ToByte(decimal) | parameter 0 -> return | false |
-| System.Convert.ToByte(double) | parameter 0 -> return | false |
-| System.Convert.ToByte(float) | parameter 0 -> return | false |
-| System.Convert.ToByte(int) | parameter 0 -> return | false |
-| System.Convert.ToByte(long) | parameter 0 -> return | false |
-| System.Convert.ToByte(object) | parameter 0 -> return | false |
-| System.Convert.ToByte(object, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.ToByte(sbyte) | parameter 0 -> return | false |
-| System.Convert.ToByte(short) | parameter 0 -> return | false |
-| System.Convert.ToByte(string) | parameter 0 -> return | false |
-| System.Convert.ToByte(string, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.ToByte(string, int) | parameter 0 -> return | false |
-| System.Convert.ToByte(uint) | parameter 0 -> return | false |
-| System.Convert.ToByte(ulong) | parameter 0 -> return | false |
-| System.Convert.ToByte(ushort) | parameter 0 -> return | false |
-| System.Convert.ToChar(DateTime) | parameter 0 -> return | false |
-| System.Convert.ToChar(bool) | parameter 0 -> return | false |
-| System.Convert.ToChar(byte) | parameter 0 -> return | false |
-| System.Convert.ToChar(char) | parameter 0 -> return | false |
-| System.Convert.ToChar(decimal) | parameter 0 -> return | false |
-| System.Convert.ToChar(double) | parameter 0 -> return | false |
-| System.Convert.ToChar(float) | parameter 0 -> return | false |
-| System.Convert.ToChar(int) | parameter 0 -> return | false |
-| System.Convert.ToChar(long) | parameter 0 -> return | false |
-| System.Convert.ToChar(object) | parameter 0 -> return | false |
-| System.Convert.ToChar(object, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.ToChar(sbyte) | parameter 0 -> return | false |
-| System.Convert.ToChar(short) | parameter 0 -> return | false |
-| System.Convert.ToChar(string) | parameter 0 -> return | false |
-| System.Convert.ToChar(string, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.ToChar(uint) | parameter 0 -> return | false |
-| System.Convert.ToChar(ulong) | parameter 0 -> return | false |
-| System.Convert.ToChar(ushort) | parameter 0 -> return | false |
-| System.Convert.ToDateTime(DateTime) | parameter 0 -> return | false |
-| System.Convert.ToDateTime(bool) | parameter 0 -> return | false |
-| System.Convert.ToDateTime(byte) | parameter 0 -> return | false |
-| System.Convert.ToDateTime(char) | parameter 0 -> return | false |
-| System.Convert.ToDateTime(decimal) | parameter 0 -> return | false |
-| System.Convert.ToDateTime(double) | parameter 0 -> return | false |
-| System.Convert.ToDateTime(float) | parameter 0 -> return | false |
-| System.Convert.ToDateTime(int) | parameter 0 -> return | false |
-| System.Convert.ToDateTime(long) | parameter 0 -> return | false |
-| System.Convert.ToDateTime(object) | parameter 0 -> return | false |
-| System.Convert.ToDateTime(object, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.ToDateTime(sbyte) | parameter 0 -> return | false |
-| System.Convert.ToDateTime(short) | parameter 0 -> return | false |
-| System.Convert.ToDateTime(string) | parameter 0 -> return | false |
-| System.Convert.ToDateTime(string, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.ToDateTime(uint) | parameter 0 -> return | false |
-| System.Convert.ToDateTime(ulong) | parameter 0 -> return | false |
-| System.Convert.ToDateTime(ushort) | parameter 0 -> return | false |
-| System.Convert.ToDecimal(DateTime) | parameter 0 -> return | false |
-| System.Convert.ToDecimal(bool) | parameter 0 -> return | false |
-| System.Convert.ToDecimal(byte) | parameter 0 -> return | false |
-| System.Convert.ToDecimal(char) | parameter 0 -> return | false |
-| System.Convert.ToDecimal(decimal) | parameter 0 -> return | false |
-| System.Convert.ToDecimal(double) | parameter 0 -> return | false |
-| System.Convert.ToDecimal(float) | parameter 0 -> return | false |
-| System.Convert.ToDecimal(int) | parameter 0 -> return | false |
-| System.Convert.ToDecimal(long) | parameter 0 -> return | false |
-| System.Convert.ToDecimal(object) | parameter 0 -> return | false |
-| System.Convert.ToDecimal(object, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.ToDecimal(sbyte) | parameter 0 -> return | false |
-| System.Convert.ToDecimal(short) | parameter 0 -> return | false |
-| System.Convert.ToDecimal(string) | parameter 0 -> return | false |
-| System.Convert.ToDecimal(string, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.ToDecimal(uint) | parameter 0 -> return | false |
-| System.Convert.ToDecimal(ulong) | parameter 0 -> return | false |
-| System.Convert.ToDecimal(ushort) | parameter 0 -> return | false |
-| System.Convert.ToDouble(DateTime) | parameter 0 -> return | false |
-| System.Convert.ToDouble(bool) | parameter 0 -> return | false |
-| System.Convert.ToDouble(byte) | parameter 0 -> return | false |
-| System.Convert.ToDouble(char) | parameter 0 -> return | false |
-| System.Convert.ToDouble(decimal) | parameter 0 -> return | false |
-| System.Convert.ToDouble(double) | parameter 0 -> return | false |
-| System.Convert.ToDouble(float) | parameter 0 -> return | false |
-| System.Convert.ToDouble(int) | parameter 0 -> return | false |
-| System.Convert.ToDouble(long) | parameter 0 -> return | false |
-| System.Convert.ToDouble(object) | parameter 0 -> return | false |
-| System.Convert.ToDouble(object, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.ToDouble(sbyte) | parameter 0 -> return | false |
-| System.Convert.ToDouble(short) | parameter 0 -> return | false |
-| System.Convert.ToDouble(string) | parameter 0 -> return | false |
-| System.Convert.ToDouble(string, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.ToDouble(uint) | parameter 0 -> return | false |
-| System.Convert.ToDouble(ulong) | parameter 0 -> return | false |
-| System.Convert.ToDouble(ushort) | parameter 0 -> return | false |
-| System.Convert.ToHexString(Byte[]) | parameter 0 -> return | false |
-| System.Convert.ToHexString(Byte[], int, int) | parameter 0 -> return | false |
-| System.Convert.ToHexString(ReadOnlySpan<Byte>) | parameter 0 -> return | false |
-| System.Convert.ToInt16(DateTime) | parameter 0 -> return | false |
-| System.Convert.ToInt16(bool) | parameter 0 -> return | false |
-| System.Convert.ToInt16(byte) | parameter 0 -> return | false |
-| System.Convert.ToInt16(char) | parameter 0 -> return | false |
-| System.Convert.ToInt16(decimal) | parameter 0 -> return | false |
-| System.Convert.ToInt16(double) | parameter 0 -> return | false |
-| System.Convert.ToInt16(float) | parameter 0 -> return | false |
-| System.Convert.ToInt16(int) | parameter 0 -> return | false |
-| System.Convert.ToInt16(long) | parameter 0 -> return | false |
-| System.Convert.ToInt16(object) | parameter 0 -> return | false |
-| System.Convert.ToInt16(object, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.ToInt16(sbyte) | parameter 0 -> return | false |
-| System.Convert.ToInt16(short) | parameter 0 -> return | false |
-| System.Convert.ToInt16(string) | parameter 0 -> return | false |
-| System.Convert.ToInt16(string, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.ToInt16(string, int) | parameter 0 -> return | false |
-| System.Convert.ToInt16(uint) | parameter 0 -> return | false |
-| System.Convert.ToInt16(ulong) | parameter 0 -> return | false |
-| System.Convert.ToInt16(ushort) | parameter 0 -> return | false |
-| System.Convert.ToInt32(DateTime) | parameter 0 -> return | false |
-| System.Convert.ToInt32(bool) | parameter 0 -> return | false |
-| System.Convert.ToInt32(byte) | parameter 0 -> return | false |
-| System.Convert.ToInt32(char) | parameter 0 -> return | false |
-| System.Convert.ToInt32(decimal) | parameter 0 -> return | false |
-| System.Convert.ToInt32(double) | parameter 0 -> return | false |
-| System.Convert.ToInt32(float) | parameter 0 -> return | false |
-| System.Convert.ToInt32(int) | parameter 0 -> return | false |
-| System.Convert.ToInt32(long) | parameter 0 -> return | false |
-| System.Convert.ToInt32(object) | parameter 0 -> return | false |
-| System.Convert.ToInt32(object, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.ToInt32(sbyte) | parameter 0 -> return | false |
-| System.Convert.ToInt32(short) | parameter 0 -> return | false |
-| System.Convert.ToInt32(string) | parameter 0 -> return | false |
-| System.Convert.ToInt32(string, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.ToInt32(string, int) | parameter 0 -> return | false |
-| System.Convert.ToInt32(uint) | parameter 0 -> return | false |
-| System.Convert.ToInt32(ulong) | parameter 0 -> return | false |
-| System.Convert.ToInt32(ushort) | parameter 0 -> return | false |
-| System.Convert.ToInt64(DateTime) | parameter 0 -> return | false |
-| System.Convert.ToInt64(bool) | parameter 0 -> return | false |
-| System.Convert.ToInt64(byte) | parameter 0 -> return | false |
-| System.Convert.ToInt64(char) | parameter 0 -> return | false |
-| System.Convert.ToInt64(decimal) | parameter 0 -> return | false |
-| System.Convert.ToInt64(double) | parameter 0 -> return | false |
-| System.Convert.ToInt64(float) | parameter 0 -> return | false |
-| System.Convert.ToInt64(int) | parameter 0 -> return | false |
-| System.Convert.ToInt64(long) | parameter 0 -> return | false |
-| System.Convert.ToInt64(object) | parameter 0 -> return | false |
-| System.Convert.ToInt64(object, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.ToInt64(sbyte) | parameter 0 -> return | false |
-| System.Convert.ToInt64(short) | parameter 0 -> return | false |
-| System.Convert.ToInt64(string) | parameter 0 -> return | false |
-| System.Convert.ToInt64(string, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.ToInt64(string, int) | parameter 0 -> return | false |
-| System.Convert.ToInt64(uint) | parameter 0 -> return | false |
-| System.Convert.ToInt64(ulong) | parameter 0 -> return | false |
-| System.Convert.ToInt64(ushort) | parameter 0 -> return | false |
-| System.Convert.ToSByte(DateTime) | parameter 0 -> return | false |
-| System.Convert.ToSByte(bool) | parameter 0 -> return | false |
-| System.Convert.ToSByte(byte) | parameter 0 -> return | false |
-| System.Convert.ToSByte(char) | parameter 0 -> return | false |
-| System.Convert.ToSByte(decimal) | parameter 0 -> return | false |
-| System.Convert.ToSByte(double) | parameter 0 -> return | false |
-| System.Convert.ToSByte(float) | parameter 0 -> return | false |
-| System.Convert.ToSByte(int) | parameter 0 -> return | false |
-| System.Convert.ToSByte(long) | parameter 0 -> return | false |
-| System.Convert.ToSByte(object) | parameter 0 -> return | false |
-| System.Convert.ToSByte(object, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.ToSByte(sbyte) | parameter 0 -> return | false |
-| System.Convert.ToSByte(short) | parameter 0 -> return | false |
-| System.Convert.ToSByte(string) | parameter 0 -> return | false |
-| System.Convert.ToSByte(string, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.ToSByte(string, int) | parameter 0 -> return | false |
-| System.Convert.ToSByte(uint) | parameter 0 -> return | false |
-| System.Convert.ToSByte(ulong) | parameter 0 -> return | false |
-| System.Convert.ToSByte(ushort) | parameter 0 -> return | false |
-| System.Convert.ToSingle(DateTime) | parameter 0 -> return | false |
-| System.Convert.ToSingle(bool) | parameter 0 -> return | false |
-| System.Convert.ToSingle(byte) | parameter 0 -> return | false |
-| System.Convert.ToSingle(char) | parameter 0 -> return | false |
-| System.Convert.ToSingle(decimal) | parameter 0 -> return | false |
-| System.Convert.ToSingle(double) | parameter 0 -> return | false |
-| System.Convert.ToSingle(float) | parameter 0 -> return | false |
-| System.Convert.ToSingle(int) | parameter 0 -> return | false |
-| System.Convert.ToSingle(long) | parameter 0 -> return | false |
-| System.Convert.ToSingle(object) | parameter 0 -> return | false |
-| System.Convert.ToSingle(object, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.ToSingle(sbyte) | parameter 0 -> return | false |
-| System.Convert.ToSingle(short) | parameter 0 -> return | false |
-| System.Convert.ToSingle(string) | parameter 0 -> return | false |
-| System.Convert.ToSingle(string, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.ToSingle(uint) | parameter 0 -> return | false |
-| System.Convert.ToSingle(ulong) | parameter 0 -> return | false |
-| System.Convert.ToSingle(ushort) | parameter 0 -> return | false |
-| System.Convert.ToString(DateTime) | parameter 0 -> return | false |
-| System.Convert.ToString(DateTime, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.ToString(bool) | parameter 0 -> return | false |
-| System.Convert.ToString(bool, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.ToString(byte) | parameter 0 -> return | false |
-| System.Convert.ToString(byte, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.ToString(byte, int) | parameter 0 -> return | false |
-| System.Convert.ToString(char) | parameter 0 -> return | false |
-| System.Convert.ToString(char, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.ToString(decimal) | parameter 0 -> return | false |
-| System.Convert.ToString(decimal, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.ToString(double) | parameter 0 -> return | false |
-| System.Convert.ToString(double, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.ToString(float) | parameter 0 -> return | false |
-| System.Convert.ToString(float, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.ToString(int) | parameter 0 -> return | false |
-| System.Convert.ToString(int, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.ToString(int, int) | parameter 0 -> return | false |
-| System.Convert.ToString(long) | parameter 0 -> return | false |
-| System.Convert.ToString(long, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.ToString(long, int) | parameter 0 -> return | false |
-| System.Convert.ToString(object) | parameter 0 -> return | false |
-| System.Convert.ToString(object, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.ToString(sbyte) | parameter 0 -> return | false |
-| System.Convert.ToString(sbyte, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.ToString(short) | parameter 0 -> return | false |
-| System.Convert.ToString(short, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.ToString(short, int) | parameter 0 -> return | false |
-| System.Convert.ToString(string) | parameter 0 -> return | false |
-| System.Convert.ToString(string, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.ToString(uint) | parameter 0 -> return | false |
-| System.Convert.ToString(uint, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.ToString(ulong) | parameter 0 -> return | false |
-| System.Convert.ToString(ulong, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.ToString(ushort) | parameter 0 -> return | false |
-| System.Convert.ToString(ushort, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.ToUInt16(DateTime) | parameter 0 -> return | false |
-| System.Convert.ToUInt16(bool) | parameter 0 -> return | false |
-| System.Convert.ToUInt16(byte) | parameter 0 -> return | false |
-| System.Convert.ToUInt16(char) | parameter 0 -> return | false |
-| System.Convert.ToUInt16(decimal) | parameter 0 -> return | false |
-| System.Convert.ToUInt16(double) | parameter 0 -> return | false |
-| System.Convert.ToUInt16(float) | parameter 0 -> return | false |
-| System.Convert.ToUInt16(int) | parameter 0 -> return | false |
-| System.Convert.ToUInt16(long) | parameter 0 -> return | false |
-| System.Convert.ToUInt16(object) | parameter 0 -> return | false |
-| System.Convert.ToUInt16(object, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.ToUInt16(sbyte) | parameter 0 -> return | false |
-| System.Convert.ToUInt16(short) | parameter 0 -> return | false |
-| System.Convert.ToUInt16(string) | parameter 0 -> return | false |
-| System.Convert.ToUInt16(string, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.ToUInt16(string, int) | parameter 0 -> return | false |
-| System.Convert.ToUInt16(uint) | parameter 0 -> return | false |
-| System.Convert.ToUInt16(ulong) | parameter 0 -> return | false |
-| System.Convert.ToUInt16(ushort) | parameter 0 -> return | false |
-| System.Convert.ToUInt32(DateTime) | parameter 0 -> return | false |
-| System.Convert.ToUInt32(bool) | parameter 0 -> return | false |
-| System.Convert.ToUInt32(byte) | parameter 0 -> return | false |
-| System.Convert.ToUInt32(char) | parameter 0 -> return | false |
-| System.Convert.ToUInt32(decimal) | parameter 0 -> return | false |
-| System.Convert.ToUInt32(double) | parameter 0 -> return | false |
-| System.Convert.ToUInt32(float) | parameter 0 -> return | false |
-| System.Convert.ToUInt32(int) | parameter 0 -> return | false |
-| System.Convert.ToUInt32(long) | parameter 0 -> return | false |
-| System.Convert.ToUInt32(object) | parameter 0 -> return | false |
-| System.Convert.ToUInt32(object, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.ToUInt32(sbyte) | parameter 0 -> return | false |
-| System.Convert.ToUInt32(short) | parameter 0 -> return | false |
-| System.Convert.ToUInt32(string) | parameter 0 -> return | false |
-| System.Convert.ToUInt32(string, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.ToUInt32(string, int) | parameter 0 -> return | false |
-| System.Convert.ToUInt32(uint) | parameter 0 -> return | false |
-| System.Convert.ToUInt32(ulong) | parameter 0 -> return | false |
-| System.Convert.ToUInt32(ushort) | parameter 0 -> return | false |
-| System.Convert.ToUInt64(DateTime) | parameter 0 -> return | false |
-| System.Convert.ToUInt64(bool) | parameter 0 -> return | false |
-| System.Convert.ToUInt64(byte) | parameter 0 -> return | false |
-| System.Convert.ToUInt64(char) | parameter 0 -> return | false |
-| System.Convert.ToUInt64(decimal) | parameter 0 -> return | false |
-| System.Convert.ToUInt64(double) | parameter 0 -> return | false |
-| System.Convert.ToUInt64(float) | parameter 0 -> return | false |
-| System.Convert.ToUInt64(int) | parameter 0 -> return | false |
-| System.Convert.ToUInt64(long) | parameter 0 -> return | false |
-| System.Convert.ToUInt64(object) | parameter 0 -> return | false |
-| System.Convert.ToUInt64(object, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.ToUInt64(sbyte) | parameter 0 -> return | false |
-| System.Convert.ToUInt64(short) | parameter 0 -> return | false |
-| System.Convert.ToUInt64(string) | parameter 0 -> return | false |
-| System.Convert.ToUInt64(string, IFormatProvider) | parameter 0 -> return | false |
-| System.Convert.ToUInt64(string, int) | parameter 0 -> return | false |
-| System.Convert.ToUInt64(uint) | parameter 0 -> return | false |
-| System.Convert.ToUInt64(ulong) | parameter 0 -> return | false |
-| System.Convert.ToUInt64(ushort) | parameter 0 -> return | false |
-| System.Convert.TryFromBase64Chars(ReadOnlySpan<Char>, Span<Byte>, out int) | parameter 0 -> return | false |
-| System.Convert.TryFromBase64String(string, Span<Byte>, out int) | parameter 0 -> return | false |
-| System.Convert.TryToBase64Chars(ReadOnlySpan<Byte>, Span<Char>, out int, Base64FormattingOptions) | parameter 0 -> return | false |
-| System.Diagnostics.Tracing.CounterPayload.<get_ForEnumeration>d__51.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Diagnostics.Tracing.CounterPayload.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Diagnostics.Tracing.EventPayload.Add(KeyValuePair<String, Object>) | parameter 0 -> this parameter [[]] | true |
-| System.Diagnostics.Tracing.EventPayload.Add(KeyValuePair<String, Object>) | parameter 0 [Key] -> this parameter [[], Key] | true |
-| System.Diagnostics.Tracing.EventPayload.Add(KeyValuePair<String, Object>) | parameter 0 [Value] -> this parameter [[], Value] | true |
-| System.Diagnostics.Tracing.EventPayload.Add(string, object) | parameter 0 -> this parameter [[], Key] | true |
-| System.Diagnostics.Tracing.EventPayload.Add(string, object) | parameter 1 -> this parameter [[], Value] | true |
-| System.Diagnostics.Tracing.EventPayload.CopyTo(KeyValuePair<String,Object>[], int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Diagnostics.Tracing.EventPayload.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Diagnostics.Tracing.EventPayload.get_Item(string) | this parameter [[], Value] -> return | true |
-| System.Diagnostics.Tracing.EventPayload.get_Keys() | this parameter [[], Key] -> return [[]] | true |
-| System.Diagnostics.Tracing.EventPayload.get_Values() | this parameter [[], Value] -> return [[]] | true |
-| System.Diagnostics.Tracing.EventPayload.set_Item(string, object) | parameter 0 -> this parameter [[], Key] | true |
-| System.Diagnostics.Tracing.EventPayload.set_Item(string, object) | parameter 1 -> this parameter [[], Value] | true |
-| System.Diagnostics.Tracing.IncrementingCounterPayload.<get_ForEnumeration>d__39.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Diagnostics.Tracing.IncrementingCounterPayload.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Dynamic.ExpandoObject.Add(KeyValuePair<String, Object>) | parameter 0 -> this parameter [[]] | true |
-| System.Dynamic.ExpandoObject.Add(KeyValuePair<String, Object>) | parameter 0 [Key] -> this parameter [[], Key] | true |
-| System.Dynamic.ExpandoObject.Add(KeyValuePair<String, Object>) | parameter 0 [Value] -> this parameter [[], Value] | true |
-| System.Dynamic.ExpandoObject.Add(string, object) | parameter 0 -> this parameter [[], Key] | true |
-| System.Dynamic.ExpandoObject.Add(string, object) | parameter 1 -> this parameter [[], Value] | true |
-| System.Dynamic.ExpandoObject.CopyTo(KeyValuePair<String,Object>[], int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Dynamic.ExpandoObject.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Dynamic.ExpandoObject.KeyCollection.Add(string) | parameter 0 -> this parameter [[]] | true |
-| System.Dynamic.ExpandoObject.KeyCollection.CopyTo(String[], int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Dynamic.ExpandoObject.KeyCollection.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Dynamic.ExpandoObject.MetaExpando.<GetDynamicMemberNames>d__6.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Dynamic.ExpandoObject.ValueCollection.Add(object) | parameter 0 -> this parameter [[]] | true |
-| System.Dynamic.ExpandoObject.ValueCollection.CopyTo(Object[], int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Dynamic.ExpandoObject.ValueCollection.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Dynamic.ExpandoObject.get_Item(string) | this parameter [[], Value] -> return | true |
-| System.Dynamic.ExpandoObject.get_Keys() | this parameter [[], Key] -> return [[]] | true |
-| System.Dynamic.ExpandoObject.get_Values() | this parameter [[], Value] -> return [[]] | true |
-| System.Dynamic.ExpandoObject.set_Item(string, object) | parameter 0 -> this parameter [[], Key] | true |
-| System.Dynamic.ExpandoObject.set_Item(string, object) | parameter 1 -> this parameter [[], Value] | true |
-| System.Dynamic.Utils.ListProvider<>.Add(T) | parameter 0 -> this parameter [[]] | true |
-| System.Dynamic.Utils.ListProvider<>.CopyTo(T[], int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Dynamic.Utils.ListProvider<>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Dynamic.Utils.ListProvider<>.Insert(int, T) | parameter 1 -> this parameter [[]] | true |
-| System.Dynamic.Utils.ListProvider<>.get_Item(int) | this parameter [[]] -> return | true |
-| System.Dynamic.Utils.ListProvider<>.set_Item(int, T) | parameter 1 -> this parameter [[]] | true |
-| System.IO.BufferedStream.BeginRead(Byte[], int, int, AsyncCallback, object) | this parameter -> parameter 0 | false |
-| System.IO.BufferedStream.BeginWrite(Byte[], int, int, AsyncCallback, object) | parameter 0 -> this parameter | false |
-| System.IO.BufferedStream.CopyTo(Stream, int) | this parameter -> parameter 0 | false |
-| System.IO.BufferedStream.CopyToAsync(Stream, int, CancellationToken) | this parameter -> parameter 0 | false |
-| System.IO.BufferedStream.Read(Byte[], int, int) | this parameter -> parameter 0 | false |
-| System.IO.BufferedStream.ReadAsync(Byte[], int, int, CancellationToken) | this parameter -> parameter 0 | false |
-| System.IO.BufferedStream.Write(Byte[], int, int) | parameter 0 -> this parameter | false |
-| System.IO.BufferedStream.WriteAsync(Byte[], int, int, CancellationToken) | parameter 0 -> this parameter | false |
-| System.IO.Compression.CheckSumAndSizeWriteStream.Read(Byte[], int, int) | this parameter -> parameter 0 | false |
-| System.IO.Compression.CheckSumAndSizeWriteStream.Write(Byte[], int, int) | parameter 0 -> this parameter | false |
-| System.IO.Compression.DeflateManagedStream.BeginRead(Byte[], int, int, AsyncCallback, object) | this parameter -> parameter 0 | false |
-| System.IO.Compression.DeflateManagedStream.Read(Byte[], int, int) | this parameter -> parameter 0 | false |
-| System.IO.Compression.DeflateManagedStream.ReadAsync(Byte[], int, int, CancellationToken) | this parameter -> parameter 0 | false |
-| System.IO.Compression.DeflateManagedStream.Write(Byte[], int, int) | parameter 0 -> this parameter | false |
-| System.IO.Compression.DeflateStream.BeginRead(Byte[], int, int, AsyncCallback, object) | this parameter -> parameter 0 | false |
-| System.IO.Compression.DeflateStream.BeginWrite(Byte[], int, int, AsyncCallback, object) | parameter 0 -> this parameter | false |
-| System.IO.Compression.DeflateStream.CopyTo(Stream, int) | this parameter -> parameter 0 | false |
-| System.IO.Compression.DeflateStream.CopyToAsync(Stream, int, CancellationToken) | this parameter -> parameter 0 | false |
-| System.IO.Compression.DeflateStream.CopyToStream.Read(Byte[], int, int) | this parameter -> parameter 0 | false |
-| System.IO.Compression.DeflateStream.CopyToStream.Write(Byte[], int, int) | parameter 0 -> this parameter | false |
-| System.IO.Compression.DeflateStream.CopyToStream.WriteAsync(Byte[], int, int, CancellationToken) | parameter 0 -> this parameter | false |
-| System.IO.Compression.DeflateStream.DeflateStream(Stream, CompressionLevel) | parameter 0 -> return | false |
-| System.IO.Compression.DeflateStream.DeflateStream(Stream, CompressionLevel, bool) | parameter 0 -> return | false |
-| System.IO.Compression.DeflateStream.DeflateStream(Stream, CompressionMode) | parameter 0 -> return | false |
-| System.IO.Compression.DeflateStream.DeflateStream(Stream, CompressionMode, bool) | parameter 0 -> return | false |
-| System.IO.Compression.DeflateStream.Read(Byte[], int, int) | this parameter -> parameter 0 | false |
-| System.IO.Compression.DeflateStream.ReadAsync(Byte[], int, int, CancellationToken) | this parameter -> parameter 0 | false |
-| System.IO.Compression.DeflateStream.Write(Byte[], int, int) | parameter 0 -> this parameter | false |
-| System.IO.Compression.DeflateStream.WriteAsync(Byte[], int, int, CancellationToken) | parameter 0 -> this parameter | false |
-| System.IO.Compression.GZipStream.BeginRead(Byte[], int, int, AsyncCallback, object) | this parameter -> parameter 0 | false |
-| System.IO.Compression.GZipStream.BeginWrite(Byte[], int, int, AsyncCallback, object) | parameter 0 -> this parameter | false |
-| System.IO.Compression.GZipStream.CopyTo(Stream, int) | this parameter -> parameter 0 | false |
-| System.IO.Compression.GZipStream.CopyToAsync(Stream, int, CancellationToken) | this parameter -> parameter 0 | false |
-| System.IO.Compression.GZipStream.Read(Byte[], int, int) | this parameter -> parameter 0 | false |
-| System.IO.Compression.GZipStream.ReadAsync(Byte[], int, int, CancellationToken) | this parameter -> parameter 0 | false |
-| System.IO.Compression.GZipStream.Write(Byte[], int, int) | parameter 0 -> this parameter | false |
-| System.IO.Compression.GZipStream.WriteAsync(Byte[], int, int, CancellationToken) | parameter 0 -> this parameter | false |
-| System.IO.Compression.PositionPreservingWriteOnlyStreamWrapper.BeginWrite(Byte[], int, int, AsyncCallback, object) | parameter 0 -> this parameter | false |
-| System.IO.Compression.PositionPreservingWriteOnlyStreamWrapper.Read(Byte[], int, int) | this parameter -> parameter 0 | false |
-| System.IO.Compression.PositionPreservingWriteOnlyStreamWrapper.Write(Byte[], int, int) | parameter 0 -> this parameter | false |
-| System.IO.Compression.PositionPreservingWriteOnlyStreamWrapper.WriteAsync(Byte[], int, int, CancellationToken) | parameter 0 -> this parameter | false |
-| System.IO.Compression.SubReadStream.Read(Byte[], int, int) | this parameter -> parameter 0 | false |
-| System.IO.Compression.SubReadStream.Write(Byte[], int, int) | parameter 0 -> this parameter | false |
-| System.IO.Compression.WrappedStream.Read(Byte[], int, int) | this parameter -> parameter 0 | false |
-| System.IO.Compression.WrappedStream.Write(Byte[], int, int) | parameter 0 -> this parameter | false |
-| System.IO.Compression.ZipArchiveEntry.DirectToArchiveWriterStream.Read(Byte[], int, int) | this parameter -> parameter 0 | false |
-| System.IO.Compression.ZipArchiveEntry.DirectToArchiveWriterStream.Write(Byte[], int, int) | parameter 0 -> this parameter | false |
-| System.IO.FileStream.BeginRead(Byte[], int, int, AsyncCallback, object) | this parameter -> parameter 0 | false |
-| System.IO.FileStream.BeginWrite(Byte[], int, int, AsyncCallback, object) | parameter 0 -> this parameter | false |
-| System.IO.FileStream.CopyToAsync(Stream, int, CancellationToken) | this parameter -> parameter 0 | false |
-| System.IO.FileStream.Read(Byte[], int, int) | this parameter -> parameter 0 | false |
-| System.IO.FileStream.ReadAsync(Byte[], int, int, CancellationToken) | this parameter -> parameter 0 | false |
-| System.IO.FileStream.Write(Byte[], int, int) | parameter 0 -> this parameter | false |
-| System.IO.FileStream.WriteAsync(Byte[], int, int, CancellationToken) | parameter 0 -> this parameter | false |
-| System.IO.MemoryStream.CopyTo(Stream, int) | this parameter -> parameter 0 | false |
-| System.IO.MemoryStream.CopyToAsync(Stream, int, CancellationToken) | this parameter -> parameter 0 | false |
-| System.IO.MemoryStream.MemoryStream(Byte[]) | parameter 0 -> return | false |
-| System.IO.MemoryStream.MemoryStream(Byte[], bool) | parameter 0 -> return | false |
-| System.IO.MemoryStream.MemoryStream(Byte[], int, int) | parameter 0 -> return | false |
-| System.IO.MemoryStream.MemoryStream(Byte[], int, int, bool) | parameter 0 -> return | false |
-| System.IO.MemoryStream.MemoryStream(Byte[], int, int, bool, bool) | parameter 0 -> return | false |
-| System.IO.MemoryStream.Read(Byte[], int, int) | this parameter -> parameter 0 | false |
-| System.IO.MemoryStream.ReadAsync(Byte[], int, int, CancellationToken) | this parameter -> parameter 0 | false |
-| System.IO.MemoryStream.ToArray() | this parameter -> return | false |
-| System.IO.MemoryStream.Write(Byte[], int, int) | parameter 0 -> this parameter | false |
-| System.IO.MemoryStream.WriteAsync(Byte[], int, int, CancellationToken) | parameter 0 -> this parameter | false |
-| System.IO.Path.Combine(params String[]) | parameter 0 [[]] -> return | false |
-| System.IO.Path.Combine(string, string) | parameter 0 -> return | false |
-| System.IO.Path.Combine(string, string) | parameter 1 -> return | false |
-| System.IO.Path.Combine(string, string, string) | parameter 0 -> return | false |
-| System.IO.Path.Combine(string, string, string) | parameter 1 -> return | false |
-| System.IO.Path.Combine(string, string, string) | parameter 2 -> return | false |
-| System.IO.Path.Combine(string, string, string, string) | parameter 0 -> return | false |
-| System.IO.Path.Combine(string, string, string, string) | parameter 1 -> return | false |
-| System.IO.Path.Combine(string, string, string, string) | parameter 2 -> return | false |
-| System.IO.Path.Combine(string, string, string, string) | parameter 3 -> return | false |
-| System.IO.Path.GetDirectoryName(ReadOnlySpan<Char>) | parameter 0 -> return | false |
-| System.IO.Path.GetDirectoryName(string) | parameter 0 -> return | false |
-| System.IO.Path.GetExtension(ReadOnlySpan<Char>) | parameter 0 -> return | false |
-| System.IO.Path.GetExtension(string) | parameter 0 -> return | false |
-| System.IO.Path.GetFileName(ReadOnlySpan<Char>) | parameter 0 -> return | false |
-| System.IO.Path.GetFileName(string) | parameter 0 -> return | false |
-| System.IO.Path.GetFileNameWithoutExtension(ReadOnlySpan<Char>) | parameter 0 -> return | false |
-| System.IO.Path.GetFileNameWithoutExtension(string) | parameter 0 -> return | false |
-| System.IO.Path.GetFullPath(string) | parameter 0 -> return | false |
-| System.IO.Path.GetFullPath(string, string) | parameter 0 -> return | false |
-| System.IO.Path.GetPathRoot(ReadOnlySpan<Char>) | parameter 0 -> return | false |
-| System.IO.Path.GetPathRoot(string) | parameter 0 -> return | false |
-| System.IO.Path.GetRelativePath(string, string) | parameter 1 -> return | false |
-| System.IO.Pipes.PipeStream.BeginRead(Byte[], int, int, AsyncCallback, object) | this parameter -> parameter 0 | false |
-| System.IO.Pipes.PipeStream.BeginWrite(Byte[], int, int, AsyncCallback, object) | parameter 0 -> this parameter | false |
-| System.IO.Pipes.PipeStream.Read(Byte[], int, int) | this parameter -> parameter 0 | false |
-| System.IO.Pipes.PipeStream.ReadAsync(Byte[], int, int, CancellationToken) | this parameter -> parameter 0 | false |
-| System.IO.Pipes.PipeStream.Write(Byte[], int, int) | parameter 0 -> this parameter | false |
-| System.IO.Pipes.PipeStream.WriteAsync(Byte[], int, int, CancellationToken) | parameter 0 -> this parameter | false |
-| System.IO.Stream.BeginRead(Byte[], int, int, AsyncCallback, object) | this parameter -> parameter 0 | false |
-| System.IO.Stream.BeginWrite(Byte[], int, int, AsyncCallback, object) | parameter 0 -> this parameter | false |
-| System.IO.Stream.CopyTo(Stream) | this parameter -> parameter 0 | false |
-| System.IO.Stream.CopyTo(Stream, int) | this parameter -> parameter 0 | false |
-| System.IO.Stream.CopyToAsync(Stream) | this parameter -> parameter 0 | false |
-| System.IO.Stream.CopyToAsync(Stream, CancellationToken) | this parameter -> parameter 0 | false |
-| System.IO.Stream.CopyToAsync(Stream, int) | this parameter -> parameter 0 | false |
-| System.IO.Stream.CopyToAsync(Stream, int, CancellationToken) | this parameter -> parameter 0 | false |
-| System.IO.Stream.NullStream.BeginRead(Byte[], int, int, AsyncCallback, object) | this parameter -> parameter 0 | false |
-| System.IO.Stream.NullStream.BeginWrite(Byte[], int, int, AsyncCallback, object) | parameter 0 -> this parameter | false |
-| System.IO.Stream.NullStream.CopyTo(Stream, int) | this parameter -> parameter 0 | false |
-| System.IO.Stream.NullStream.CopyToAsync(Stream, int, CancellationToken) | this parameter -> parameter 0 | false |
-| System.IO.Stream.NullStream.Read(Byte[], int, int) | this parameter -> parameter 0 | false |
-| System.IO.Stream.NullStream.ReadAsync(Byte[], int, int, CancellationToken) | this parameter -> parameter 0 | false |
-| System.IO.Stream.NullStream.Write(Byte[], int, int) | parameter 0 -> this parameter | false |
-| System.IO.Stream.NullStream.WriteAsync(Byte[], int, int, CancellationToken) | parameter 0 -> this parameter | false |
-| System.IO.Stream.Read(Byte[], int, int) | this parameter -> parameter 0 | false |
-| System.IO.Stream.ReadAsync(Byte[], int, int) | this parameter -> parameter 0 | false |
-| System.IO.Stream.ReadAsync(Byte[], int, int, CancellationToken) | this parameter -> parameter 0 | false |
-| System.IO.Stream.SyncStream.BeginRead(Byte[], int, int, AsyncCallback, object) | this parameter -> parameter 0 | false |
-| System.IO.Stream.SyncStream.BeginWrite(Byte[], int, int, AsyncCallback, object) | parameter 0 -> this parameter | false |
-| System.IO.Stream.SyncStream.Read(Byte[], int, int) | this parameter -> parameter 0 | false |
-| System.IO.Stream.SyncStream.Write(Byte[], int, int) | parameter 0 -> this parameter | false |
-| System.IO.Stream.Write(Byte[], int, int) | parameter 0 -> this parameter | false |
-| System.IO.Stream.WriteAsync(Byte[], int, int) | parameter 0 -> this parameter | false |
-| System.IO.Stream.WriteAsync(Byte[], int, int, CancellationToken) | parameter 0 -> this parameter | false |
-| System.IO.StringReader.Read() | this parameter -> return | false |
-| System.IO.StringReader.Read(Char[], int, int) | this parameter -> return | false |
-| System.IO.StringReader.Read(Span<Char>) | this parameter -> return | false |
-| System.IO.StringReader.ReadAsync(Char[], int, int) | this parameter -> return | false |
-| System.IO.StringReader.ReadAsync(Memory<Char>, CancellationToken) | this parameter -> return | false |
-| System.IO.StringReader.ReadBlock(Span<Char>) | this parameter -> return | false |
-| System.IO.StringReader.ReadBlockAsync(Char[], int, int) | this parameter -> return | false |
-| System.IO.StringReader.ReadBlockAsync(Memory<Char>, CancellationToken) | this parameter -> return | false |
-| System.IO.StringReader.ReadLine() | this parameter -> return | false |
-| System.IO.StringReader.ReadLineAsync() | this parameter -> return | false |
-| System.IO.StringReader.ReadToEnd() | this parameter -> return | false |
-| System.IO.StringReader.ReadToEndAsync() | this parameter -> return | false |
-| System.IO.StringReader.StringReader(string) | parameter 0 -> return | false |
-| System.IO.TextReader.Read() | this parameter -> return | false |
-| System.IO.TextReader.Read(Char[], int, int) | this parameter -> return | false |
-| System.IO.TextReader.Read(Span<Char>) | this parameter -> return | false |
-| System.IO.TextReader.ReadAsync(Char[], int, int) | this parameter -> return | false |
-| System.IO.TextReader.ReadAsync(Memory<Char>, CancellationToken) | this parameter -> return | false |
-| System.IO.TextReader.ReadAsyncInternal(Memory<Char>, CancellationToken) | this parameter -> return | false |
-| System.IO.TextReader.ReadBlock(Char[], int, int) | this parameter -> return | false |
-| System.IO.TextReader.ReadBlock(Span<Char>) | this parameter -> return | false |
-| System.IO.TextReader.ReadBlockAsync(Char[], int, int) | this parameter -> return | false |
-| System.IO.TextReader.ReadBlockAsync(Memory<Char>, CancellationToken) | this parameter -> return | false |
-| System.IO.TextReader.ReadLine() | this parameter -> return | false |
-| System.IO.TextReader.ReadLineAsync() | this parameter -> return | false |
-| System.IO.TextReader.ReadToEnd() | this parameter -> return | false |
-| System.IO.TextReader.ReadToEndAsync() | this parameter -> return | false |
-| System.IO.UnmanagedMemoryStream.Read(Byte[], int, int) | this parameter -> parameter 0 | false |
-| System.IO.UnmanagedMemoryStream.ReadAsync(Byte[], int, int, CancellationToken) | this parameter -> parameter 0 | false |
-| System.IO.UnmanagedMemoryStream.Write(Byte[], int, int) | parameter 0 -> this parameter | false |
-| System.IO.UnmanagedMemoryStream.WriteAsync(Byte[], int, int, CancellationToken) | parameter 0 -> this parameter | false |
-| System.IO.UnmanagedMemoryStreamWrapper.CopyToAsync(Stream, int, CancellationToken) | this parameter -> parameter 0 | false |
-| System.IO.UnmanagedMemoryStreamWrapper.Read(Byte[], int, int) | this parameter -> parameter 0 | false |
-| System.IO.UnmanagedMemoryStreamWrapper.ReadAsync(Byte[], int, int, CancellationToken) | this parameter -> parameter 0 | false |
-| System.IO.UnmanagedMemoryStreamWrapper.ToArray() | this parameter -> return | false |
-| System.IO.UnmanagedMemoryStreamWrapper.Write(Byte[], int, int) | parameter 0 -> this parameter | false |
-| System.IO.UnmanagedMemoryStreamWrapper.WriteAsync(Byte[], int, int, CancellationToken) | parameter 0 -> this parameter | false |
-| System.Int32.Parse(string) | parameter 0 -> return | false |
-| System.Int32.Parse(string, IFormatProvider) | parameter 0 -> return | false |
-| System.Int32.Parse(string, NumberStyles) | parameter 0 -> return | false |
-| System.Int32.Parse(string, NumberStyles, IFormatProvider) | parameter 0 -> return | false |
-| System.Int32.TryParse(string, NumberStyles, IFormatProvider, out int) | parameter 0 -> parameter 3 | false |
-| System.Int32.TryParse(string, NumberStyles, IFormatProvider, out int) | parameter 0 -> return | false |
-| System.Int32.TryParse(string, out int) | parameter 0 -> parameter 1 | false |
-| System.Int32.TryParse(string, out int) | parameter 0 -> return | false |
-| System.Lazy<>.Lazy(Func<T>) | deleget output from parameter 0 -> return [Value] | true |
-| System.Lazy<>.Lazy(Func<T>, LazyThreadSafetyMode) | deleget output from parameter 0 -> return [Value] | true |
-| System.Lazy<>.Lazy(Func<T>, bool) | deleget output from parameter 0 -> return [Value] | true |
-| System.Lazy<>.get_Value() | this parameter -> return | false |
-| System.Linq.EmptyPartition<>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.Enumerable.<CastIterator>d__64<>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.Enumerable.<ExceptIterator>d__81<>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.Enumerable.<GroupJoinIterator>d__98<,,,>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.Enumerable.<IntersectIterator>d__101<>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.Enumerable.<JoinIterator>d__105<,,,>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.Enumerable.<OfTypeIterator>d__62<>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.Enumerable.<SelectIterator>d__174<,>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.Enumerable.<SelectManyIterator>d__177<,>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.Enumerable.<SelectManyIterator>d__179<,,>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.Enumerable.<SelectManyIterator>d__181<,,>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.Enumerable.<SkipLastIterator>d__194<>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.Enumerable.<SkipWhileIterator>d__190<>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.Enumerable.<SkipWhileIterator>d__192<>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.Enumerable.<TakeLastIterator>d__221<>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.Enumerable.<TakeWhileIterator>d__217<>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.Enumerable.<TakeWhileIterator>d__219<>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.Enumerable.<WhereIterator>d__240<>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.Enumerable.<ZipIterator>d__243<,>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.Enumerable.<ZipIterator>d__244<,,>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.Enumerable.Aggregate<TSource, TAccumulate, TResult>(IEnumerable<TSource>, TAccumulate, Func<TAccumulate, TSource, TAccumulate>, Func<TAccumulate, TResult>) | deleget output from parameter 2 -> parameter 0 of delegate parameter 3 | true |
-| System.Linq.Enumerable.Aggregate<TSource, TAccumulate, TResult>(IEnumerable<TSource>, TAccumulate, Func<TAccumulate, TSource, TAccumulate>, Func<TAccumulate, TResult>) | deleget output from parameter 3 -> return | true |
-| System.Linq.Enumerable.Aggregate<TSource, TAccumulate, TResult>(IEnumerable<TSource>, TAccumulate, Func<TAccumulate, TSource, TAccumulate>, Func<TAccumulate, TResult>) | parameter 0 [[]] -> parameter 1 of delegate parameter 2 | true |
-| System.Linq.Enumerable.Aggregate<TSource, TAccumulate, TResult>(IEnumerable<TSource>, TAccumulate, Func<TAccumulate, TSource, TAccumulate>, Func<TAccumulate, TResult>) | parameter 1 -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.Enumerable.Aggregate<TSource, TAccumulate>(IEnumerable<TSource>, TAccumulate, Func<TAccumulate, TSource, TAccumulate>) | deleget output from parameter 2 -> return | true |
-| System.Linq.Enumerable.Aggregate<TSource, TAccumulate>(IEnumerable<TSource>, TAccumulate, Func<TAccumulate, TSource, TAccumulate>) | parameter 0 [[]] -> parameter 1 of delegate parameter 2 | true |
-| System.Linq.Enumerable.Aggregate<TSource, TAccumulate>(IEnumerable<TSource>, TAccumulate, Func<TAccumulate, TSource, TAccumulate>) | parameter 1 -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.Enumerable.Aggregate<TSource>(IEnumerable<TSource>, Func<TSource, TSource, TSource>) | deleget output from parameter 1 -> return | true |
-| System.Linq.Enumerable.Aggregate<TSource>(IEnumerable<TSource>, Func<TSource, TSource, TSource>) | parameter 0 [[]] -> parameter 1 of delegate parameter 1 | true |
-| System.Linq.Enumerable.All<TSource>(IEnumerable<TSource>, Func<TSource, Boolean>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Any<TSource>(IEnumerable<TSource>, Func<TSource, Boolean>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.AsEnumerable<TSource>(IEnumerable<TSource>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Enumerable.Average<TSource>(IEnumerable<TSource>, Func<TSource, Decimal>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Average<TSource>(IEnumerable<TSource>, Func<TSource, Double>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Average<TSource>(IEnumerable<TSource>, Func<TSource, Int32>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Average<TSource>(IEnumerable<TSource>, Func<TSource, Int64>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Average<TSource>(IEnumerable<TSource>, Func<TSource, Nullable<Decimal>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Average<TSource>(IEnumerable<TSource>, Func<TSource, Nullable<Double>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Average<TSource>(IEnumerable<TSource>, Func<TSource, Nullable<Int32>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Average<TSource>(IEnumerable<TSource>, Func<TSource, Nullable<Int64>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Average<TSource>(IEnumerable<TSource>, Func<TSource, Nullable<Single>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Average<TSource>(IEnumerable<TSource>, Func<TSource, Single>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Cast<TResult>(IEnumerable) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Enumerable.Concat<TSource>(IEnumerable<TSource>, IEnumerable<TSource>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Enumerable.Concat<TSource>(IEnumerable<TSource>, IEnumerable<TSource>) | parameter 1 [[]] -> return [[]] | true |
-| System.Linq.Enumerable.Count<TSource>(IEnumerable<TSource>, Func<TSource, Boolean>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.DefaultIfEmpty<TSource>(IEnumerable<TSource>) | parameter 0 [[]] -> return | true |
-| System.Linq.Enumerable.DefaultIfEmpty<TSource>(IEnumerable<TSource>, TSource) | parameter 0 [[]] -> return | true |
-| System.Linq.Enumerable.DefaultIfEmpty<TSource>(IEnumerable<TSource>, TSource) | parameter 1 -> return | true |
-| System.Linq.Enumerable.Distinct<TSource>(IEnumerable<TSource>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Enumerable.Distinct<TSource>(IEnumerable<TSource>, IEqualityComparer<TSource>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Enumerable.ElementAt<TSource>(IEnumerable<TSource>, int) | parameter 0 [[]] -> return | true |
-| System.Linq.Enumerable.ElementAtOrDefault<TSource>(IEnumerable<TSource>, int) | parameter 0 [[]] -> return | true |
-| System.Linq.Enumerable.Except<TSource>(IEnumerable<TSource>, IEnumerable<TSource>) | parameter 0 [[]] -> return | true |
-| System.Linq.Enumerable.Except<TSource>(IEnumerable<TSource>, IEnumerable<TSource>, IEqualityComparer<TSource>) | parameter 0 [[]] -> return | true |
-| System.Linq.Enumerable.First<TSource>(IEnumerable<TSource>) | parameter 0 [[]] -> return | true |
-| System.Linq.Enumerable.First<TSource>(IEnumerable<TSource>, Func<TSource, Boolean>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.First<TSource>(IEnumerable<TSource>, Func<TSource, Boolean>) | parameter 0 [[]] -> return | true |
-| System.Linq.Enumerable.FirstOrDefault<TSource>(IEnumerable<TSource>) | parameter 0 [[]] -> return | true |
-| System.Linq.Enumerable.FirstOrDefault<TSource>(IEnumerable<TSource>, Func<TSource, Boolean>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.FirstOrDefault<TSource>(IEnumerable<TSource>, Func<TSource, Boolean>) | parameter 0 [[]] -> return | true |
-| System.Linq.Enumerable.GroupBy<TSource, TKey, TElement, TResult>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, Func<TKey, IEnumerable<TElement>, TResult>) | deleget output from parameter 1 -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.Enumerable.GroupBy<TSource, TKey, TElement, TResult>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, Func<TKey, IEnumerable<TElement>, TResult>) | deleget output from parameter 2 -> parameter 1 of delegate parameter 3 [[]] | true |
-| System.Linq.Enumerable.GroupBy<TSource, TKey, TElement, TResult>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, Func<TKey, IEnumerable<TElement>, TResult>) | deleget output from parameter 3 -> return [[]] | true |
-| System.Linq.Enumerable.GroupBy<TSource, TKey, TElement, TResult>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, Func<TKey, IEnumerable<TElement>, TResult>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.GroupBy<TSource, TKey, TElement, TResult>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, Func<TKey, IEnumerable<TElement>, TResult>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.Enumerable.GroupBy<TSource, TKey, TElement, TResult>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, Func<TKey, IEnumerable<TElement>, TResult>, IEqualityComparer<TKey>) | deleget output from parameter 1 -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.Enumerable.GroupBy<TSource, TKey, TElement, TResult>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, Func<TKey, IEnumerable<TElement>, TResult>, IEqualityComparer<TKey>) | deleget output from parameter 2 -> parameter 1 of delegate parameter 3 [[]] | true |
-| System.Linq.Enumerable.GroupBy<TSource, TKey, TElement, TResult>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, Func<TKey, IEnumerable<TElement>, TResult>, IEqualityComparer<TKey>) | deleget output from parameter 3 -> return [[]] | true |
-| System.Linq.Enumerable.GroupBy<TSource, TKey, TElement, TResult>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, Func<TKey, IEnumerable<TElement>, TResult>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.GroupBy<TSource, TKey, TElement, TResult>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, Func<TKey, IEnumerable<TElement>, TResult>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.Enumerable.GroupBy<TSource, TKey, TElement>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>) | deleget output from parameter 2 -> return [[]] | true |
-| System.Linq.Enumerable.GroupBy<TSource, TKey, TElement>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.GroupBy<TSource, TKey, TElement>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.Enumerable.GroupBy<TSource, TKey, TElement>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, IEqualityComparer<TKey>) | deleget output from parameter 1 -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.Enumerable.GroupBy<TSource, TKey, TElement>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.GroupBy<TSource, TKey, TElement>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.Enumerable.GroupBy<TSource, TKey, TResult>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TKey, IEnumerable<TSource>, TResult>) | deleget output from parameter 1 -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.Enumerable.GroupBy<TSource, TKey, TResult>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TKey, IEnumerable<TSource>, TResult>) | deleget output from parameter 2 -> return [[]] | true |
-| System.Linq.Enumerable.GroupBy<TSource, TKey, TResult>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TKey, IEnumerable<TSource>, TResult>) | parameter 0 -> parameter 1 of delegate parameter 2 | true |
-| System.Linq.Enumerable.GroupBy<TSource, TKey, TResult>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TKey, IEnumerable<TSource>, TResult>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.GroupBy<TSource, TKey, TResult>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TKey, IEnumerable<TSource>, TResult>, IEqualityComparer<TKey>) | deleget output from parameter 1 -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.Enumerable.GroupBy<TSource, TKey, TResult>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TKey, IEnumerable<TSource>, TResult>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.GroupBy<TSource, TKey, TResult>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TKey, IEnumerable<TSource>, TResult>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.Enumerable.GroupBy<TSource, TKey>(IEnumerable<TSource>, Func<TSource, TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.GroupBy<TSource, TKey>(IEnumerable<TSource>, Func<TSource, TKey>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.GroupJoin<TOuter, TInner, TKey, TResult>(IEnumerable<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>) | deleget output from parameter 4 -> return [[]] | true |
-| System.Linq.Enumerable.GroupJoin<TOuter, TInner, TKey, TResult>(IEnumerable<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.Enumerable.GroupJoin<TOuter, TInner, TKey, TResult>(IEnumerable<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>) | parameter 0 [[]] -> parameter 0 of delegate parameter 4 | true |
-| System.Linq.Enumerable.GroupJoin<TOuter, TInner, TKey, TResult>(IEnumerable<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>) | parameter 1 [[]] -> parameter 0 of delegate parameter 3 | true |
-| System.Linq.Enumerable.GroupJoin<TOuter, TInner, TKey, TResult>(IEnumerable<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>) | parameter 1 [[]] -> parameter 1 of delegate parameter 4 | true |
-| System.Linq.Enumerable.GroupJoin<TOuter, TInner, TKey, TResult>(IEnumerable<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>, IEqualityComparer<TKey>) | deleget output from parameter 4 -> return [[]] | true |
-| System.Linq.Enumerable.GroupJoin<TOuter, TInner, TKey, TResult>(IEnumerable<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.Enumerable.GroupJoin<TOuter, TInner, TKey, TResult>(IEnumerable<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 4 | true |
-| System.Linq.Enumerable.GroupJoin<TOuter, TInner, TKey, TResult>(IEnumerable<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>, IEqualityComparer<TKey>) | parameter 1 [[]] -> parameter 0 of delegate parameter 3 | true |
-| System.Linq.Enumerable.GroupJoin<TOuter, TInner, TKey, TResult>(IEnumerable<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>, IEqualityComparer<TKey>) | parameter 1 [[]] -> parameter 1 of delegate parameter 4 | true |
-| System.Linq.Enumerable.Intersect<TSource>(IEnumerable<TSource>, IEnumerable<TSource>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Enumerable.Intersect<TSource>(IEnumerable<TSource>, IEnumerable<TSource>) | parameter 1 [[]] -> return [[]] | true |
-| System.Linq.Enumerable.Intersect<TSource>(IEnumerable<TSource>, IEnumerable<TSource>, IEqualityComparer<TSource>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Enumerable.Intersect<TSource>(IEnumerable<TSource>, IEnumerable<TSource>, IEqualityComparer<TSource>) | parameter 1 [[]] -> return [[]] | true |
-| System.Linq.Enumerable.Iterator<>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.Enumerable.Join<TOuter, TInner, TKey, TResult>(IEnumerable<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>) | deleget output from parameter 4 -> return [[]] | true |
-| System.Linq.Enumerable.Join<TOuter, TInner, TKey, TResult>(IEnumerable<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.Enumerable.Join<TOuter, TInner, TKey, TResult>(IEnumerable<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>) | parameter 0 [[]] -> parameter 0 of delegate parameter 4 | true |
-| System.Linq.Enumerable.Join<TOuter, TInner, TKey, TResult>(IEnumerable<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>) | parameter 1 [[]] -> parameter 0 of delegate parameter 3 | true |
-| System.Linq.Enumerable.Join<TOuter, TInner, TKey, TResult>(IEnumerable<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>) | parameter 1 [[]] -> parameter 1 of delegate parameter 4 | true |
-| System.Linq.Enumerable.Join<TOuter, TInner, TKey, TResult>(IEnumerable<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>, IEqualityComparer<TKey>) | deleget output from parameter 4 -> return [[]] | true |
-| System.Linq.Enumerable.Join<TOuter, TInner, TKey, TResult>(IEnumerable<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.Enumerable.Join<TOuter, TInner, TKey, TResult>(IEnumerable<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 4 | true |
-| System.Linq.Enumerable.Join<TOuter, TInner, TKey, TResult>(IEnumerable<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>, IEqualityComparer<TKey>) | parameter 1 [[]] -> parameter 0 of delegate parameter 3 | true |
-| System.Linq.Enumerable.Join<TOuter, TInner, TKey, TResult>(IEnumerable<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>, IEqualityComparer<TKey>) | parameter 1 [[]] -> parameter 1 of delegate parameter 4 | true |
-| System.Linq.Enumerable.Last<TSource>(IEnumerable<TSource>) | parameter 0 [[]] -> return | true |
-| System.Linq.Enumerable.Last<TSource>(IEnumerable<TSource>, Func<TSource, Boolean>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Last<TSource>(IEnumerable<TSource>, Func<TSource, Boolean>) | parameter 0 [[]] -> return | true |
-| System.Linq.Enumerable.LastOrDefault<TSource>(IEnumerable<TSource>) | parameter 0 [[]] -> return | true |
-| System.Linq.Enumerable.LastOrDefault<TSource>(IEnumerable<TSource>, Func<TSource, Boolean>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.LastOrDefault<TSource>(IEnumerable<TSource>, Func<TSource, Boolean>) | parameter 0 [[]] -> return | true |
-| System.Linq.Enumerable.LongCount<TSource>(IEnumerable<TSource>, Func<TSource, Boolean>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Max<TSource, TResult>(IEnumerable<TSource>, Func<TSource, TResult>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Max<TSource>(IEnumerable<TSource>, Func<TSource, Decimal>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Max<TSource>(IEnumerable<TSource>, Func<TSource, Double>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Max<TSource>(IEnumerable<TSource>, Func<TSource, Int32>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Max<TSource>(IEnumerable<TSource>, Func<TSource, Int64>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Max<TSource>(IEnumerable<TSource>, Func<TSource, Nullable<Decimal>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Max<TSource>(IEnumerable<TSource>, Func<TSource, Nullable<Double>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Max<TSource>(IEnumerable<TSource>, Func<TSource, Nullable<Int32>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Max<TSource>(IEnumerable<TSource>, Func<TSource, Nullable<Int64>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Max<TSource>(IEnumerable<TSource>, Func<TSource, Nullable<Single>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Max<TSource>(IEnumerable<TSource>, Func<TSource, Single>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Min<TSource, TResult>(IEnumerable<TSource>, Func<TSource, TResult>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Min<TSource>(IEnumerable<TSource>, Func<TSource, Decimal>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Min<TSource>(IEnumerable<TSource>, Func<TSource, Double>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Min<TSource>(IEnumerable<TSource>, Func<TSource, Int32>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Min<TSource>(IEnumerable<TSource>, Func<TSource, Int64>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Min<TSource>(IEnumerable<TSource>, Func<TSource, Nullable<Decimal>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Min<TSource>(IEnumerable<TSource>, Func<TSource, Nullable<Double>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Min<TSource>(IEnumerable<TSource>, Func<TSource, Nullable<Int32>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Min<TSource>(IEnumerable<TSource>, Func<TSource, Nullable<Int64>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Min<TSource>(IEnumerable<TSource>, Func<TSource, Nullable<Single>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Min<TSource>(IEnumerable<TSource>, Func<TSource, Single>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.OfType<TResult>(IEnumerable) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Enumerable.OrderBy<TSource, TKey>(IEnumerable<TSource>, Func<TSource, TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.OrderBy<TSource, TKey>(IEnumerable<TSource>, Func<TSource, TKey>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Enumerable.OrderBy<TSource, TKey>(IEnumerable<TSource>, Func<TSource, TKey>, IComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.OrderBy<TSource, TKey>(IEnumerable<TSource>, Func<TSource, TKey>, IComparer<TKey>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Enumerable.OrderByDescending<TSource, TKey>(IEnumerable<TSource>, Func<TSource, TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.OrderByDescending<TSource, TKey>(IEnumerable<TSource>, Func<TSource, TKey>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Enumerable.OrderByDescending<TSource, TKey>(IEnumerable<TSource>, Func<TSource, TKey>, IComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.OrderByDescending<TSource, TKey>(IEnumerable<TSource>, Func<TSource, TKey>, IComparer<TKey>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Enumerable.Reverse<TSource>(IEnumerable<TSource>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Enumerable.Select<TSource, TResult>(IEnumerable<TSource>, Func<TSource, Int32, TResult>) | deleget output from parameter 1 -> return [[]] | true |
-| System.Linq.Enumerable.Select<TSource, TResult>(IEnumerable<TSource>, Func<TSource, Int32, TResult>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Select<TSource, TResult>(IEnumerable<TSource>, Func<TSource, TResult>) | deleget output from parameter 1 -> return [[]] | true |
-| System.Linq.Enumerable.Select<TSource, TResult>(IEnumerable<TSource>, Func<TSource, TResult>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.SelectMany<TSource, TCollection, TResult>(IEnumerable<TSource>, Func<TSource, IEnumerable<TCollection>>, Func<TSource, TCollection, TResult>) | deleget output from parameter 1 [[]] -> parameter 1 of delegate parameter 2 | true |
-| System.Linq.Enumerable.SelectMany<TSource, TCollection, TResult>(IEnumerable<TSource>, Func<TSource, IEnumerable<TCollection>>, Func<TSource, TCollection, TResult>) | deleget output from parameter 2 -> return [[]] | true |
-| System.Linq.Enumerable.SelectMany<TSource, TCollection, TResult>(IEnumerable<TSource>, Func<TSource, IEnumerable<TCollection>>, Func<TSource, TCollection, TResult>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.SelectMany<TSource, TCollection, TResult>(IEnumerable<TSource>, Func<TSource, IEnumerable<TCollection>>, Func<TSource, TCollection, TResult>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.Enumerable.SelectMany<TSource, TCollection, TResult>(IEnumerable<TSource>, Func<TSource, Int32, IEnumerable<TCollection>>, Func<TSource, TCollection, TResult>) | deleget output from parameter 1 [[]] -> parameter 1 of delegate parameter 2 | true |
-| System.Linq.Enumerable.SelectMany<TSource, TCollection, TResult>(IEnumerable<TSource>, Func<TSource, Int32, IEnumerable<TCollection>>, Func<TSource, TCollection, TResult>) | deleget output from parameter 2 -> return [[]] | true |
-| System.Linq.Enumerable.SelectMany<TSource, TCollection, TResult>(IEnumerable<TSource>, Func<TSource, Int32, IEnumerable<TCollection>>, Func<TSource, TCollection, TResult>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.SelectMany<TSource, TCollection, TResult>(IEnumerable<TSource>, Func<TSource, Int32, IEnumerable<TCollection>>, Func<TSource, TCollection, TResult>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.Enumerable.SelectMany<TSource, TResult>(IEnumerable<TSource>, Func<TSource, IEnumerable<TResult>>) | deleget output from parameter 1 -> return [[]] | true |
-| System.Linq.Enumerable.SelectMany<TSource, TResult>(IEnumerable<TSource>, Func<TSource, IEnumerable<TResult>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.SelectMany<TSource, TResult>(IEnumerable<TSource>, Func<TSource, Int32, IEnumerable<TResult>>) | deleget output from parameter 1 -> return [[]] | true |
-| System.Linq.Enumerable.SelectMany<TSource, TResult>(IEnumerable<TSource>, Func<TSource, Int32, IEnumerable<TResult>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Single<TSource>(IEnumerable<TSource>) | parameter 0 [[]] -> return | true |
-| System.Linq.Enumerable.Single<TSource>(IEnumerable<TSource>, Func<TSource, Boolean>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Single<TSource>(IEnumerable<TSource>, Func<TSource, Boolean>) | parameter 0 [[]] -> return | true |
-| System.Linq.Enumerable.SingleOrDefault<TSource>(IEnumerable<TSource>) | parameter 0 [[]] -> return | true |
-| System.Linq.Enumerable.SingleOrDefault<TSource>(IEnumerable<TSource>, Func<TSource, Boolean>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.SingleOrDefault<TSource>(IEnumerable<TSource>, Func<TSource, Boolean>) | parameter 0 [[]] -> return | true |
-| System.Linq.Enumerable.Skip<TSource>(IEnumerable<TSource>, int) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Enumerable.SkipWhile<TSource>(IEnumerable<TSource>, Func<TSource, Boolean>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.SkipWhile<TSource>(IEnumerable<TSource>, Func<TSource, Boolean>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Enumerable.SkipWhile<TSource>(IEnumerable<TSource>, Func<TSource, Int32, Boolean>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.SkipWhile<TSource>(IEnumerable<TSource>, Func<TSource, Int32, Boolean>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Enumerable.Sum<TSource>(IEnumerable<TSource>, Func<TSource, Decimal>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Sum<TSource>(IEnumerable<TSource>, Func<TSource, Double>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Sum<TSource>(IEnumerable<TSource>, Func<TSource, Int32>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Sum<TSource>(IEnumerable<TSource>, Func<TSource, Int64>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Sum<TSource>(IEnumerable<TSource>, Func<TSource, Nullable<Decimal>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Sum<TSource>(IEnumerable<TSource>, Func<TSource, Nullable<Double>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Sum<TSource>(IEnumerable<TSource>, Func<TSource, Nullable<Int32>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Sum<TSource>(IEnumerable<TSource>, Func<TSource, Nullable<Int64>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Sum<TSource>(IEnumerable<TSource>, Func<TSource, Nullable<Single>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Sum<TSource>(IEnumerable<TSource>, Func<TSource, Single>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Take<TSource>(IEnumerable<TSource>, int) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Enumerable.TakeWhile<TSource>(IEnumerable<TSource>, Func<TSource, Boolean>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.TakeWhile<TSource>(IEnumerable<TSource>, Func<TSource, Boolean>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Enumerable.TakeWhile<TSource>(IEnumerable<TSource>, Func<TSource, Int32, Boolean>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.TakeWhile<TSource>(IEnumerable<TSource>, Func<TSource, Int32, Boolean>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Enumerable.ThenBy<TSource, TKey>(IOrderedEnumerable<TSource>, Func<TSource, TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.ThenBy<TSource, TKey>(IOrderedEnumerable<TSource>, Func<TSource, TKey>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Enumerable.ThenBy<TSource, TKey>(IOrderedEnumerable<TSource>, Func<TSource, TKey>, IComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.ThenBy<TSource, TKey>(IOrderedEnumerable<TSource>, Func<TSource, TKey>, IComparer<TKey>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Enumerable.ThenByDescending<TSource, TKey>(IOrderedEnumerable<TSource>, Func<TSource, TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.ThenByDescending<TSource, TKey>(IOrderedEnumerable<TSource>, Func<TSource, TKey>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Enumerable.ThenByDescending<TSource, TKey>(IOrderedEnumerable<TSource>, Func<TSource, TKey>, IComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.ThenByDescending<TSource, TKey>(IOrderedEnumerable<TSource>, Func<TSource, TKey>, IComparer<TKey>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Enumerable.ToArray<TSource>(IEnumerable<TSource>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Enumerable.ToDictionary<TSource, TKey, TElement>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>) | deleget output from parameter 2 -> return [[]] | true |
-| System.Linq.Enumerable.ToDictionary<TSource, TKey, TElement>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.ToDictionary<TSource, TKey, TElement>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.Enumerable.ToDictionary<TSource, TKey, TElement>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, IEqualityComparer<TKey>) | deleget output from parameter 2 -> return [[]] | true |
-| System.Linq.Enumerable.ToDictionary<TSource, TKey, TElement>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.ToDictionary<TSource, TKey, TElement>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.Enumerable.ToDictionary<TSource, TKey>(IEnumerable<TSource>, Func<TSource, TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.ToDictionary<TSource, TKey>(IEnumerable<TSource>, Func<TSource, TKey>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Enumerable.ToDictionary<TSource, TKey>(IEnumerable<TSource>, Func<TSource, TKey>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.ToDictionary<TSource, TKey>(IEnumerable<TSource>, Func<TSource, TKey>, IEqualityComparer<TKey>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Enumerable.ToList<TSource>(IEnumerable<TSource>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Enumerable.ToLookup<TSource, TKey, TElement>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>) | deleget output from parameter 2 -> return [[]] | true |
-| System.Linq.Enumerable.ToLookup<TSource, TKey, TElement>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.ToLookup<TSource, TKey, TElement>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.Enumerable.ToLookup<TSource, TKey, TElement>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, IEqualityComparer<TKey>) | deleget output from parameter 2 -> return [[]] | true |
-| System.Linq.Enumerable.ToLookup<TSource, TKey, TElement>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.ToLookup<TSource, TKey, TElement>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.Enumerable.ToLookup<TSource, TKey>(IEnumerable<TSource>, Func<TSource, TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.ToLookup<TSource, TKey>(IEnumerable<TSource>, Func<TSource, TKey>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Enumerable.ToLookup<TSource, TKey>(IEnumerable<TSource>, Func<TSource, TKey>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.ToLookup<TSource, TKey>(IEnumerable<TSource>, Func<TSource, TKey>, IEqualityComparer<TKey>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Enumerable.Union<TSource>(IEnumerable<TSource>, IEnumerable<TSource>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Enumerable.Union<TSource>(IEnumerable<TSource>, IEnumerable<TSource>) | parameter 1 [[]] -> return [[]] | true |
-| System.Linq.Enumerable.Union<TSource>(IEnumerable<TSource>, IEnumerable<TSource>, IEqualityComparer<TSource>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Enumerable.Union<TSource>(IEnumerable<TSource>, IEnumerable<TSource>, IEqualityComparer<TSource>) | parameter 1 [[]] -> return [[]] | true |
-| System.Linq.Enumerable.Where<TSource>(IEnumerable<TSource>, Func<TSource, Boolean>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Where<TSource>(IEnumerable<TSource>, Func<TSource, Boolean>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Enumerable.Where<TSource>(IEnumerable<TSource>, Func<TSource, Int32, Boolean>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Enumerable.Where<TSource>(IEnumerable<TSource>, Func<TSource, Int32, Boolean>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Enumerable.Zip<TFirst, TSecond, TResult>(IEnumerable<TFirst>, IEnumerable<TSecond>, Func<TFirst, TSecond, TResult>) | deleget output from parameter 2 -> return [[]] | true |
-| System.Linq.Enumerable.Zip<TFirst, TSecond, TResult>(IEnumerable<TFirst>, IEnumerable<TSecond>, Func<TFirst, TSecond, TResult>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.Enumerable.Zip<TFirst, TSecond, TResult>(IEnumerable<TFirst>, IEnumerable<TSecond>, Func<TFirst, TSecond, TResult>) | parameter 1 [[]] -> parameter 1 of delegate parameter 2 | true |
-| System.Linq.EnumerableQuery<>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.Expressions.BlockExpressionList.Add(Expression) | parameter 0 -> this parameter [[]] | true |
-| System.Linq.Expressions.BlockExpressionList.CopyTo(Expression[], int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Linq.Expressions.BlockExpressionList.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.Expressions.BlockExpressionList.Insert(int, Expression) | parameter 1 -> this parameter [[]] | true |
-| System.Linq.Expressions.BlockExpressionList.get_Item(int) | this parameter [[]] -> return | true |
-| System.Linq.Expressions.BlockExpressionList.set_Item(int, Expression) | parameter 1 -> this parameter [[]] | true |
-| System.Linq.Expressions.Compiler.CompilerScope.<GetVariablesIncludingMerged>d__32.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.Expressions.Compiler.ParameterList.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.Expressions.Interpreter.InterpretedFrame.<GetStackTraceDebugInfo>d__29.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.GroupedEnumerable<,,>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.GroupedEnumerable<,>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.GroupedResultEnumerable<,,,>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.GroupedResultEnumerable<,,>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.Grouping<,>.Add(TElement) | parameter 0 -> this parameter [[]] | true |
-| System.Linq.Grouping<,>.CopyTo(TElement[], int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Linq.Grouping<,>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.Grouping<,>.Insert(int, TElement) | parameter 1 -> this parameter [[]] | true |
-| System.Linq.Grouping<,>.get_Item(int) | this parameter [[]] -> return | true |
-| System.Linq.Grouping<,>.set_Item(int, TElement) | parameter 1 -> this parameter [[]] | true |
-| System.Linq.Lookup<,>.<ApplyResultSelector>d__19<>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.Lookup<,>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.OrderedEnumerable<>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.OrderedPartition<>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.Parallel.CancellableEnumerable.<Wrap>d__0<>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.Parallel.EnumerableWrapperWeakToStrong.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.Parallel.ExceptionAggregator.<WrapEnumerable>d__0<>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.Parallel.ExceptionAggregator.<WrapQueryEnumerator>d__1<,>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.Parallel.GroupByGrouping<,>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.Parallel.ListChunk<>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.Parallel.Lookup<,>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.Parallel.MergeExecutor<>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.Parallel.OrderedGroupByGrouping<,,>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.Parallel.ParallelEnumerableWrapper.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.Parallel.PartitionerQueryOperator<>.<AsSequentialQuery>d__5.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.Parallel.QueryResults<>.Add(T) | parameter 0 -> this parameter [[]] | true |
-| System.Linq.Parallel.QueryResults<>.CopyTo(T[], int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Linq.Parallel.QueryResults<>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.Parallel.QueryResults<>.Insert(int, T) | parameter 1 -> this parameter [[]] | true |
-| System.Linq.Parallel.QueryResults<>.get_Item(int) | this parameter [[]] -> return | true |
-| System.Linq.Parallel.QueryResults<>.set_Item(int, T) | parameter 1 -> this parameter [[]] | true |
-| System.Linq.Parallel.RangeEnumerable.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.Parallel.ZipQueryOperator<,,>.<AsSequentialQuery>d__9.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.ParallelEnumerable.Aggregate<TSource, TAccumulate, TResult>(ParallelQuery<TSource>, TAccumulate, Func<TAccumulate, TSource, TAccumulate>, Func<TAccumulate, TResult>) | deleget output from parameter 2 -> parameter 0 of delegate parameter 3 | true |
-| System.Linq.ParallelEnumerable.Aggregate<TSource, TAccumulate, TResult>(ParallelQuery<TSource>, TAccumulate, Func<TAccumulate, TSource, TAccumulate>, Func<TAccumulate, TResult>) | deleget output from parameter 3 -> return | true |
-| System.Linq.ParallelEnumerable.Aggregate<TSource, TAccumulate, TResult>(ParallelQuery<TSource>, TAccumulate, Func<TAccumulate, TSource, TAccumulate>, Func<TAccumulate, TResult>) | parameter 0 [[]] -> parameter 1 of delegate parameter 2 | true |
-| System.Linq.ParallelEnumerable.Aggregate<TSource, TAccumulate, TResult>(ParallelQuery<TSource>, TAccumulate, Func<TAccumulate, TSource, TAccumulate>, Func<TAccumulate, TResult>) | parameter 1 -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.ParallelEnumerable.Aggregate<TSource, TAccumulate>(ParallelQuery<TSource>, TAccumulate, Func<TAccumulate, TSource, TAccumulate>) | deleget output from parameter 2 -> return | true |
-| System.Linq.ParallelEnumerable.Aggregate<TSource, TAccumulate>(ParallelQuery<TSource>, TAccumulate, Func<TAccumulate, TSource, TAccumulate>) | parameter 0 [[]] -> parameter 1 of delegate parameter 2 | true |
-| System.Linq.ParallelEnumerable.Aggregate<TSource, TAccumulate>(ParallelQuery<TSource>, TAccumulate, Func<TAccumulate, TSource, TAccumulate>) | parameter 1 -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.ParallelEnumerable.Aggregate<TSource>(ParallelQuery<TSource>, Func<TSource, TSource, TSource>) | deleget output from parameter 1 -> return | true |
-| System.Linq.ParallelEnumerable.Aggregate<TSource>(ParallelQuery<TSource>, Func<TSource, TSource, TSource>) | parameter 0 [[]] -> parameter 1 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.All<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Any<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.AsEnumerable<TSource>(ParallelQuery<TSource>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.Average<TSource>(ParallelQuery<TSource>, Func<TSource, Decimal>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Average<TSource>(ParallelQuery<TSource>, Func<TSource, Double>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Average<TSource>(ParallelQuery<TSource>, Func<TSource, Int32>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Average<TSource>(ParallelQuery<TSource>, Func<TSource, Int64>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Average<TSource>(ParallelQuery<TSource>, Func<TSource, Nullable<Decimal>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Average<TSource>(ParallelQuery<TSource>, Func<TSource, Nullable<Double>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Average<TSource>(ParallelQuery<TSource>, Func<TSource, Nullable<Int32>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Average<TSource>(ParallelQuery<TSource>, Func<TSource, Nullable<Int64>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Average<TSource>(ParallelQuery<TSource>, Func<TSource, Nullable<Single>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Average<TSource>(ParallelQuery<TSource>, Func<TSource, Single>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Cast<TResult>(ParallelQuery) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.Concat<TSource>(ParallelQuery<TSource>, IEnumerable<TSource>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.Concat<TSource>(ParallelQuery<TSource>, IEnumerable<TSource>) | parameter 1 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.Concat<TSource>(ParallelQuery<TSource>, ParallelQuery<TSource>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.Concat<TSource>(ParallelQuery<TSource>, ParallelQuery<TSource>) | parameter 1 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.Count<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.DefaultIfEmpty<TSource>(ParallelQuery<TSource>) | parameter 0 [[]] -> return | true |
-| System.Linq.ParallelEnumerable.DefaultIfEmpty<TSource>(ParallelQuery<TSource>, TSource) | parameter 0 [[]] -> return | true |
-| System.Linq.ParallelEnumerable.DefaultIfEmpty<TSource>(ParallelQuery<TSource>, TSource) | parameter 1 -> return | true |
-| System.Linq.ParallelEnumerable.Distinct<TSource>(ParallelQuery<TSource>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.Distinct<TSource>(ParallelQuery<TSource>, IEqualityComparer<TSource>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.ElementAt<TSource>(ParallelQuery<TSource>, int) | parameter 0 [[]] -> return | true |
-| System.Linq.ParallelEnumerable.ElementAtOrDefault<TSource>(ParallelQuery<TSource>, int) | parameter 0 [[]] -> return | true |
-| System.Linq.ParallelEnumerable.Except<TSource>(ParallelQuery<TSource>, IEnumerable<TSource>) | parameter 0 [[]] -> return | true |
-| System.Linq.ParallelEnumerable.Except<TSource>(ParallelQuery<TSource>, IEnumerable<TSource>, IEqualityComparer<TSource>) | parameter 0 [[]] -> return | true |
-| System.Linq.ParallelEnumerable.Except<TSource>(ParallelQuery<TSource>, ParallelQuery<TSource>) | parameter 0 [[]] -> return | true |
-| System.Linq.ParallelEnumerable.Except<TSource>(ParallelQuery<TSource>, ParallelQuery<TSource>, IEqualityComparer<TSource>) | parameter 0 [[]] -> return | true |
-| System.Linq.ParallelEnumerable.First<TSource>(ParallelQuery<TSource>) | parameter 0 [[]] -> return | true |
-| System.Linq.ParallelEnumerable.First<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.First<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | parameter 0 [[]] -> return | true |
-| System.Linq.ParallelEnumerable.FirstOrDefault<TSource>(ParallelQuery<TSource>) | parameter 0 [[]] -> return | true |
-| System.Linq.ParallelEnumerable.FirstOrDefault<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.FirstOrDefault<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | parameter 0 [[]] -> return | true |
-| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TElement, TResult>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, Func<TKey, IEnumerable<TElement>, TResult>) | deleget output from parameter 1 -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TElement, TResult>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, Func<TKey, IEnumerable<TElement>, TResult>) | deleget output from parameter 2 -> parameter 1 of delegate parameter 3 [[]] | true |
-| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TElement, TResult>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, Func<TKey, IEnumerable<TElement>, TResult>) | deleget output from parameter 3 -> return [[]] | true |
-| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TElement, TResult>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, Func<TKey, IEnumerable<TElement>, TResult>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TElement, TResult>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, Func<TKey, IEnumerable<TElement>, TResult>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TElement, TResult>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, Func<TKey, IEnumerable<TElement>, TResult>, IEqualityComparer<TKey>) | deleget output from parameter 1 -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TElement, TResult>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, Func<TKey, IEnumerable<TElement>, TResult>, IEqualityComparer<TKey>) | deleget output from parameter 2 -> parameter 1 of delegate parameter 3 [[]] | true |
-| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TElement, TResult>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, Func<TKey, IEnumerable<TElement>, TResult>, IEqualityComparer<TKey>) | deleget output from parameter 3 -> return [[]] | true |
-| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TElement, TResult>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, Func<TKey, IEnumerable<TElement>, TResult>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TElement, TResult>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, Func<TKey, IEnumerable<TElement>, TResult>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TElement>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>) | deleget output from parameter 2 -> return [[]] | true |
-| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TElement>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TElement>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TElement>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, IEqualityComparer<TKey>) | deleget output from parameter 1 -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TElement>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TElement>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TResult>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TKey, IEnumerable<TSource>, TResult>) | deleget output from parameter 1 -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TResult>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TKey, IEnumerable<TSource>, TResult>) | deleget output from parameter 2 -> return [[]] | true |
-| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TResult>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TKey, IEnumerable<TSource>, TResult>) | parameter 0 -> parameter 1 of delegate parameter 2 | true |
-| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TResult>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TKey, IEnumerable<TSource>, TResult>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TResult>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TKey, IEnumerable<TSource>, TResult>, IEqualityComparer<TKey>) | deleget output from parameter 1 -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TResult>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TKey, IEnumerable<TSource>, TResult>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TResult>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TKey, IEnumerable<TSource>, TResult>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey>(ParallelQuery<TSource>, Func<TSource, TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey>(ParallelQuery<TSource>, Func<TSource, TKey>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.GroupJoin<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>) | deleget output from parameter 4 -> return [[]] | true |
-| System.Linq.ParallelEnumerable.GroupJoin<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.ParallelEnumerable.GroupJoin<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>) | parameter 0 [[]] -> parameter 0 of delegate parameter 4 | true |
-| System.Linq.ParallelEnumerable.GroupJoin<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>) | parameter 1 [[]] -> parameter 0 of delegate parameter 3 | true |
-| System.Linq.ParallelEnumerable.GroupJoin<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>) | parameter 1 [[]] -> parameter 1 of delegate parameter 4 | true |
-| System.Linq.ParallelEnumerable.GroupJoin<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>, IEqualityComparer<TKey>) | deleget output from parameter 4 -> return [[]] | true |
-| System.Linq.ParallelEnumerable.GroupJoin<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.ParallelEnumerable.GroupJoin<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 4 | true |
-| System.Linq.ParallelEnumerable.GroupJoin<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>, IEqualityComparer<TKey>) | parameter 1 [[]] -> parameter 0 of delegate parameter 3 | true |
-| System.Linq.ParallelEnumerable.GroupJoin<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>, IEqualityComparer<TKey>) | parameter 1 [[]] -> parameter 1 of delegate parameter 4 | true |
-| System.Linq.ParallelEnumerable.GroupJoin<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, ParallelQuery<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>) | deleget output from parameter 4 -> return [[]] | true |
-| System.Linq.ParallelEnumerable.GroupJoin<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, ParallelQuery<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.ParallelEnumerable.GroupJoin<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, ParallelQuery<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>) | parameter 0 [[]] -> parameter 0 of delegate parameter 4 | true |
-| System.Linq.ParallelEnumerable.GroupJoin<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, ParallelQuery<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>) | parameter 1 [[]] -> parameter 0 of delegate parameter 3 | true |
-| System.Linq.ParallelEnumerable.GroupJoin<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, ParallelQuery<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>) | parameter 1 [[]] -> parameter 1 of delegate parameter 4 | true |
-| System.Linq.ParallelEnumerable.GroupJoin<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, ParallelQuery<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>, IEqualityComparer<TKey>) | deleget output from parameter 4 -> return [[]] | true |
-| System.Linq.ParallelEnumerable.GroupJoin<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, ParallelQuery<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.ParallelEnumerable.GroupJoin<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, ParallelQuery<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 4 | true |
-| System.Linq.ParallelEnumerable.GroupJoin<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, ParallelQuery<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>, IEqualityComparer<TKey>) | parameter 1 [[]] -> parameter 0 of delegate parameter 3 | true |
-| System.Linq.ParallelEnumerable.GroupJoin<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, ParallelQuery<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>, IEqualityComparer<TKey>) | parameter 1 [[]] -> parameter 1 of delegate parameter 4 | true |
-| System.Linq.ParallelEnumerable.Intersect<TSource>(ParallelQuery<TSource>, IEnumerable<TSource>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.Intersect<TSource>(ParallelQuery<TSource>, IEnumerable<TSource>) | parameter 1 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.Intersect<TSource>(ParallelQuery<TSource>, IEnumerable<TSource>, IEqualityComparer<TSource>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.Intersect<TSource>(ParallelQuery<TSource>, IEnumerable<TSource>, IEqualityComparer<TSource>) | parameter 1 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.Intersect<TSource>(ParallelQuery<TSource>, ParallelQuery<TSource>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.Intersect<TSource>(ParallelQuery<TSource>, ParallelQuery<TSource>) | parameter 1 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.Intersect<TSource>(ParallelQuery<TSource>, ParallelQuery<TSource>, IEqualityComparer<TSource>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.Intersect<TSource>(ParallelQuery<TSource>, ParallelQuery<TSource>, IEqualityComparer<TSource>) | parameter 1 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.Join<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>) | deleget output from parameter 4 -> return [[]] | true |
-| System.Linq.ParallelEnumerable.Join<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.ParallelEnumerable.Join<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>) | parameter 0 [[]] -> parameter 0 of delegate parameter 4 | true |
-| System.Linq.ParallelEnumerable.Join<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>) | parameter 1 [[]] -> parameter 0 of delegate parameter 3 | true |
-| System.Linq.ParallelEnumerable.Join<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>) | parameter 1 [[]] -> parameter 1 of delegate parameter 4 | true |
-| System.Linq.ParallelEnumerable.Join<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>, IEqualityComparer<TKey>) | deleget output from parameter 4 -> return [[]] | true |
-| System.Linq.ParallelEnumerable.Join<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.ParallelEnumerable.Join<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 4 | true |
-| System.Linq.ParallelEnumerable.Join<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>, IEqualityComparer<TKey>) | parameter 1 [[]] -> parameter 0 of delegate parameter 3 | true |
-| System.Linq.ParallelEnumerable.Join<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>, IEqualityComparer<TKey>) | parameter 1 [[]] -> parameter 1 of delegate parameter 4 | true |
-| System.Linq.ParallelEnumerable.Join<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, ParallelQuery<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>) | deleget output from parameter 4 -> return [[]] | true |
-| System.Linq.ParallelEnumerable.Join<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, ParallelQuery<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.ParallelEnumerable.Join<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, ParallelQuery<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>) | parameter 0 [[]] -> parameter 0 of delegate parameter 4 | true |
-| System.Linq.ParallelEnumerable.Join<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, ParallelQuery<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>) | parameter 1 [[]] -> parameter 0 of delegate parameter 3 | true |
-| System.Linq.ParallelEnumerable.Join<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, ParallelQuery<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>) | parameter 1 [[]] -> parameter 1 of delegate parameter 4 | true |
-| System.Linq.ParallelEnumerable.Join<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, ParallelQuery<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>, IEqualityComparer<TKey>) | deleget output from parameter 4 -> return [[]] | true |
-| System.Linq.ParallelEnumerable.Join<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, ParallelQuery<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.ParallelEnumerable.Join<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, ParallelQuery<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 4 | true |
-| System.Linq.ParallelEnumerable.Join<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, ParallelQuery<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>, IEqualityComparer<TKey>) | parameter 1 [[]] -> parameter 0 of delegate parameter 3 | true |
-| System.Linq.ParallelEnumerable.Join<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, ParallelQuery<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>, IEqualityComparer<TKey>) | parameter 1 [[]] -> parameter 1 of delegate parameter 4 | true |
-| System.Linq.ParallelEnumerable.Last<TSource>(ParallelQuery<TSource>) | parameter 0 [[]] -> return | true |
-| System.Linq.ParallelEnumerable.Last<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Last<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | parameter 0 [[]] -> return | true |
-| System.Linq.ParallelEnumerable.LastOrDefault<TSource>(ParallelQuery<TSource>) | parameter 0 [[]] -> return | true |
-| System.Linq.ParallelEnumerable.LastOrDefault<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.LastOrDefault<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | parameter 0 [[]] -> return | true |
-| System.Linq.ParallelEnumerable.LongCount<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Max<TSource, TResult>(ParallelQuery<TSource>, Func<TSource, TResult>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Max<TSource>(ParallelQuery<TSource>, Func<TSource, Decimal>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Max<TSource>(ParallelQuery<TSource>, Func<TSource, Double>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Max<TSource>(ParallelQuery<TSource>, Func<TSource, Int32>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Max<TSource>(ParallelQuery<TSource>, Func<TSource, Int64>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Max<TSource>(ParallelQuery<TSource>, Func<TSource, Nullable<Decimal>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Max<TSource>(ParallelQuery<TSource>, Func<TSource, Nullable<Double>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Max<TSource>(ParallelQuery<TSource>, Func<TSource, Nullable<Int32>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Max<TSource>(ParallelQuery<TSource>, Func<TSource, Nullable<Int64>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Max<TSource>(ParallelQuery<TSource>, Func<TSource, Nullable<Single>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Max<TSource>(ParallelQuery<TSource>, Func<TSource, Single>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Min<TSource, TResult>(ParallelQuery<TSource>, Func<TSource, TResult>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Min<TSource>(ParallelQuery<TSource>, Func<TSource, Decimal>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Min<TSource>(ParallelQuery<TSource>, Func<TSource, Double>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Min<TSource>(ParallelQuery<TSource>, Func<TSource, Int32>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Min<TSource>(ParallelQuery<TSource>, Func<TSource, Int64>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Min<TSource>(ParallelQuery<TSource>, Func<TSource, Nullable<Decimal>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Min<TSource>(ParallelQuery<TSource>, Func<TSource, Nullable<Double>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Min<TSource>(ParallelQuery<TSource>, Func<TSource, Nullable<Int32>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Min<TSource>(ParallelQuery<TSource>, Func<TSource, Nullable<Int64>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Min<TSource>(ParallelQuery<TSource>, Func<TSource, Nullable<Single>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Min<TSource>(ParallelQuery<TSource>, Func<TSource, Single>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.OfType<TResult>(ParallelQuery) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.OrderBy<TSource, TKey>(ParallelQuery<TSource>, Func<TSource, TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.OrderBy<TSource, TKey>(ParallelQuery<TSource>, Func<TSource, TKey>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.OrderBy<TSource, TKey>(ParallelQuery<TSource>, Func<TSource, TKey>, IComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.OrderBy<TSource, TKey>(ParallelQuery<TSource>, Func<TSource, TKey>, IComparer<TKey>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.OrderByDescending<TSource, TKey>(ParallelQuery<TSource>, Func<TSource, TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.OrderByDescending<TSource, TKey>(ParallelQuery<TSource>, Func<TSource, TKey>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.OrderByDescending<TSource, TKey>(ParallelQuery<TSource>, Func<TSource, TKey>, IComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.OrderByDescending<TSource, TKey>(ParallelQuery<TSource>, Func<TSource, TKey>, IComparer<TKey>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.Reverse<TSource>(ParallelQuery<TSource>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.Select<TSource, TResult>(ParallelQuery<TSource>, Func<TSource, Int32, TResult>) | deleget output from parameter 1 -> return [[]] | true |
-| System.Linq.ParallelEnumerable.Select<TSource, TResult>(ParallelQuery<TSource>, Func<TSource, Int32, TResult>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Select<TSource, TResult>(ParallelQuery<TSource>, Func<TSource, TResult>) | deleget output from parameter 1 -> return [[]] | true |
-| System.Linq.ParallelEnumerable.Select<TSource, TResult>(ParallelQuery<TSource>, Func<TSource, TResult>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.SelectMany<TSource, TCollection, TResult>(ParallelQuery<TSource>, Func<TSource, IEnumerable<TCollection>>, Func<TSource, TCollection, TResult>) | deleget output from parameter 1 [[]] -> parameter 1 of delegate parameter 2 | true |
-| System.Linq.ParallelEnumerable.SelectMany<TSource, TCollection, TResult>(ParallelQuery<TSource>, Func<TSource, IEnumerable<TCollection>>, Func<TSource, TCollection, TResult>) | deleget output from parameter 2 -> return [[]] | true |
-| System.Linq.ParallelEnumerable.SelectMany<TSource, TCollection, TResult>(ParallelQuery<TSource>, Func<TSource, IEnumerable<TCollection>>, Func<TSource, TCollection, TResult>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.SelectMany<TSource, TCollection, TResult>(ParallelQuery<TSource>, Func<TSource, IEnumerable<TCollection>>, Func<TSource, TCollection, TResult>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.ParallelEnumerable.SelectMany<TSource, TCollection, TResult>(ParallelQuery<TSource>, Func<TSource, Int32, IEnumerable<TCollection>>, Func<TSource, TCollection, TResult>) | deleget output from parameter 1 [[]] -> parameter 1 of delegate parameter 2 | true |
-| System.Linq.ParallelEnumerable.SelectMany<TSource, TCollection, TResult>(ParallelQuery<TSource>, Func<TSource, Int32, IEnumerable<TCollection>>, Func<TSource, TCollection, TResult>) | deleget output from parameter 2 -> return [[]] | true |
-| System.Linq.ParallelEnumerable.SelectMany<TSource, TCollection, TResult>(ParallelQuery<TSource>, Func<TSource, Int32, IEnumerable<TCollection>>, Func<TSource, TCollection, TResult>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.SelectMany<TSource, TCollection, TResult>(ParallelQuery<TSource>, Func<TSource, Int32, IEnumerable<TCollection>>, Func<TSource, TCollection, TResult>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.ParallelEnumerable.SelectMany<TSource, TResult>(ParallelQuery<TSource>, Func<TSource, IEnumerable<TResult>>) | deleget output from parameter 1 -> return [[]] | true |
-| System.Linq.ParallelEnumerable.SelectMany<TSource, TResult>(ParallelQuery<TSource>, Func<TSource, IEnumerable<TResult>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.SelectMany<TSource, TResult>(ParallelQuery<TSource>, Func<TSource, Int32, IEnumerable<TResult>>) | deleget output from parameter 1 -> return [[]] | true |
-| System.Linq.ParallelEnumerable.SelectMany<TSource, TResult>(ParallelQuery<TSource>, Func<TSource, Int32, IEnumerable<TResult>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Single<TSource>(ParallelQuery<TSource>) | parameter 0 [[]] -> return | true |
-| System.Linq.ParallelEnumerable.Single<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Single<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | parameter 0 [[]] -> return | true |
-| System.Linq.ParallelEnumerable.SingleOrDefault<TSource>(ParallelQuery<TSource>) | parameter 0 [[]] -> return | true |
-| System.Linq.ParallelEnumerable.SingleOrDefault<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.SingleOrDefault<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | parameter 0 [[]] -> return | true |
-| System.Linq.ParallelEnumerable.Skip<TSource>(ParallelQuery<TSource>, int) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.SkipWhile<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.SkipWhile<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.SkipWhile<TSource>(ParallelQuery<TSource>, Func<TSource, Int32, Boolean>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.SkipWhile<TSource>(ParallelQuery<TSource>, Func<TSource, Int32, Boolean>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.Sum<TSource>(ParallelQuery<TSource>, Func<TSource, Decimal>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Sum<TSource>(ParallelQuery<TSource>, Func<TSource, Double>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Sum<TSource>(ParallelQuery<TSource>, Func<TSource, Int32>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Sum<TSource>(ParallelQuery<TSource>, Func<TSource, Int64>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Sum<TSource>(ParallelQuery<TSource>, Func<TSource, Nullable<Decimal>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Sum<TSource>(ParallelQuery<TSource>, Func<TSource, Nullable<Double>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Sum<TSource>(ParallelQuery<TSource>, Func<TSource, Nullable<Int32>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Sum<TSource>(ParallelQuery<TSource>, Func<TSource, Nullable<Int64>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Sum<TSource>(ParallelQuery<TSource>, Func<TSource, Nullable<Single>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Sum<TSource>(ParallelQuery<TSource>, Func<TSource, Single>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Take<TSource>(ParallelQuery<TSource>, int) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.TakeWhile<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.TakeWhile<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.TakeWhile<TSource>(ParallelQuery<TSource>, Func<TSource, Int32, Boolean>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.TakeWhile<TSource>(ParallelQuery<TSource>, Func<TSource, Int32, Boolean>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.ThenBy<TSource, TKey>(OrderedParallelQuery<TSource>, Func<TSource, TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.ThenBy<TSource, TKey>(OrderedParallelQuery<TSource>, Func<TSource, TKey>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.ThenBy<TSource, TKey>(OrderedParallelQuery<TSource>, Func<TSource, TKey>, IComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.ThenBy<TSource, TKey>(OrderedParallelQuery<TSource>, Func<TSource, TKey>, IComparer<TKey>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.ThenByDescending<TSource, TKey>(OrderedParallelQuery<TSource>, Func<TSource, TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.ThenByDescending<TSource, TKey>(OrderedParallelQuery<TSource>, Func<TSource, TKey>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.ThenByDescending<TSource, TKey>(OrderedParallelQuery<TSource>, Func<TSource, TKey>, IComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.ThenByDescending<TSource, TKey>(OrderedParallelQuery<TSource>, Func<TSource, TKey>, IComparer<TKey>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.ToArray<TSource>(ParallelQuery<TSource>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.ToDictionary<TSource, TKey, TElement>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>) | deleget output from parameter 2 -> return [[]] | true |
-| System.Linq.ParallelEnumerable.ToDictionary<TSource, TKey, TElement>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.ToDictionary<TSource, TKey, TElement>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.ParallelEnumerable.ToDictionary<TSource, TKey, TElement>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, IEqualityComparer<TKey>) | deleget output from parameter 2 -> return [[]] | true |
-| System.Linq.ParallelEnumerable.ToDictionary<TSource, TKey, TElement>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.ToDictionary<TSource, TKey, TElement>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.ParallelEnumerable.ToDictionary<TSource, TKey>(ParallelQuery<TSource>, Func<TSource, TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.ToDictionary<TSource, TKey>(ParallelQuery<TSource>, Func<TSource, TKey>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.ToDictionary<TSource, TKey>(ParallelQuery<TSource>, Func<TSource, TKey>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.ToDictionary<TSource, TKey>(ParallelQuery<TSource>, Func<TSource, TKey>, IEqualityComparer<TKey>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.ToList<TSource>(ParallelQuery<TSource>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.ToLookup<TSource, TKey, TElement>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>) | deleget output from parameter 2 -> return [[]] | true |
-| System.Linq.ParallelEnumerable.ToLookup<TSource, TKey, TElement>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.ToLookup<TSource, TKey, TElement>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.ParallelEnumerable.ToLookup<TSource, TKey, TElement>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, IEqualityComparer<TKey>) | deleget output from parameter 2 -> return [[]] | true |
-| System.Linq.ParallelEnumerable.ToLookup<TSource, TKey, TElement>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.ToLookup<TSource, TKey, TElement>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.ParallelEnumerable.ToLookup<TSource, TKey>(ParallelQuery<TSource>, Func<TSource, TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.ToLookup<TSource, TKey>(ParallelQuery<TSource>, Func<TSource, TKey>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.ToLookup<TSource, TKey>(ParallelQuery<TSource>, Func<TSource, TKey>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.ToLookup<TSource, TKey>(ParallelQuery<TSource>, Func<TSource, TKey>, IEqualityComparer<TKey>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.Union<TSource>(ParallelQuery<TSource>, IEnumerable<TSource>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.Union<TSource>(ParallelQuery<TSource>, IEnumerable<TSource>) | parameter 1 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.Union<TSource>(ParallelQuery<TSource>, IEnumerable<TSource>, IEqualityComparer<TSource>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.Union<TSource>(ParallelQuery<TSource>, IEnumerable<TSource>, IEqualityComparer<TSource>) | parameter 1 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.Union<TSource>(ParallelQuery<TSource>, ParallelQuery<TSource>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.Union<TSource>(ParallelQuery<TSource>, ParallelQuery<TSource>) | parameter 1 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.Union<TSource>(ParallelQuery<TSource>, ParallelQuery<TSource>, IEqualityComparer<TSource>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.Union<TSource>(ParallelQuery<TSource>, ParallelQuery<TSource>, IEqualityComparer<TSource>) | parameter 1 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.Where<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Where<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.Where<TSource>(ParallelQuery<TSource>, Func<TSource, Int32, Boolean>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.ParallelEnumerable.Where<TSource>(ParallelQuery<TSource>, Func<TSource, Int32, Boolean>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.ParallelEnumerable.Zip<TFirst, TSecond, TResult>(ParallelQuery<TFirst>, IEnumerable<TSecond>, Func<TFirst, TSecond, TResult>) | deleget output from parameter 2 -> return [[]] | true |
-| System.Linq.ParallelEnumerable.Zip<TFirst, TSecond, TResult>(ParallelQuery<TFirst>, IEnumerable<TSecond>, Func<TFirst, TSecond, TResult>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.ParallelEnumerable.Zip<TFirst, TSecond, TResult>(ParallelQuery<TFirst>, IEnumerable<TSecond>, Func<TFirst, TSecond, TResult>) | parameter 1 [[]] -> parameter 1 of delegate parameter 2 | true |
-| System.Linq.ParallelEnumerable.Zip<TFirst, TSecond, TResult>(ParallelQuery<TFirst>, ParallelQuery<TSecond>, Func<TFirst, TSecond, TResult>) | deleget output from parameter 2 -> return [[]] | true |
-| System.Linq.ParallelEnumerable.Zip<TFirst, TSecond, TResult>(ParallelQuery<TFirst>, ParallelQuery<TSecond>, Func<TFirst, TSecond, TResult>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.ParallelEnumerable.Zip<TFirst, TSecond, TResult>(ParallelQuery<TFirst>, ParallelQuery<TSecond>, Func<TFirst, TSecond, TResult>) | parameter 1 [[]] -> parameter 1 of delegate parameter 2 | true |
-| System.Linq.ParallelQuery.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Linq.Queryable.Aggregate<TSource, TAccumulate, TResult>(IQueryable<TSource>, TAccumulate, Expression<Func<TAccumulate,TSource,TAccumulate>>, Expression<Func<TAccumulate,TResult>>) | deleget output from parameter 2 -> parameter 0 of delegate parameter 3 | true |
-| System.Linq.Queryable.Aggregate<TSource, TAccumulate, TResult>(IQueryable<TSource>, TAccumulate, Expression<Func<TAccumulate,TSource,TAccumulate>>, Expression<Func<TAccumulate,TResult>>) | deleget output from parameter 3 -> return | true |
-| System.Linq.Queryable.Aggregate<TSource, TAccumulate, TResult>(IQueryable<TSource>, TAccumulate, Expression<Func<TAccumulate,TSource,TAccumulate>>, Expression<Func<TAccumulate,TResult>>) | parameter 0 [[]] -> parameter 1 of delegate parameter 2 | true |
-| System.Linq.Queryable.Aggregate<TSource, TAccumulate, TResult>(IQueryable<TSource>, TAccumulate, Expression<Func<TAccumulate,TSource,TAccumulate>>, Expression<Func<TAccumulate,TResult>>) | parameter 1 -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.Queryable.Aggregate<TSource, TAccumulate>(IQueryable<TSource>, TAccumulate, Expression<Func<TAccumulate,TSource,TAccumulate>>) | deleget output from parameter 2 -> return | true |
-| System.Linq.Queryable.Aggregate<TSource, TAccumulate>(IQueryable<TSource>, TAccumulate, Expression<Func<TAccumulate,TSource,TAccumulate>>) | parameter 0 [[]] -> parameter 1 of delegate parameter 2 | true |
-| System.Linq.Queryable.Aggregate<TSource, TAccumulate>(IQueryable<TSource>, TAccumulate, Expression<Func<TAccumulate,TSource,TAccumulate>>) | parameter 1 -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.Queryable.Aggregate<TSource>(IQueryable<TSource>, Expression<Func<TSource,TSource,TSource>>) | deleget output from parameter 1 -> return | true |
-| System.Linq.Queryable.Aggregate<TSource>(IQueryable<TSource>, Expression<Func<TSource,TSource,TSource>>) | parameter 0 [[]] -> parameter 1 of delegate parameter 1 | true |
-| System.Linq.Queryable.All<TSource>(IQueryable<TSource>, Expression<Func<TSource,Boolean>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.Any<TSource>(IQueryable<TSource>, Expression<Func<TSource,Boolean>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.AsQueryable(IEnumerable) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Queryable.AsQueryable<TElement>(IEnumerable<TElement>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Queryable.Average<TSource>(IQueryable<TSource>, Expression<Func<TSource,Decimal>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.Average<TSource>(IQueryable<TSource>, Expression<Func<TSource,Double>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.Average<TSource>(IQueryable<TSource>, Expression<Func<TSource,Int32>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.Average<TSource>(IQueryable<TSource>, Expression<Func<TSource,Int64>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.Average<TSource>(IQueryable<TSource>, Expression<Func<TSource,Nullable<Decimal>>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.Average<TSource>(IQueryable<TSource>, Expression<Func<TSource,Nullable<Double>>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.Average<TSource>(IQueryable<TSource>, Expression<Func<TSource,Nullable<Int32>>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.Average<TSource>(IQueryable<TSource>, Expression<Func<TSource,Nullable<Int64>>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.Average<TSource>(IQueryable<TSource>, Expression<Func<TSource,Nullable<Single>>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.Average<TSource>(IQueryable<TSource>, Expression<Func<TSource,Single>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.Cast<TResult>(IQueryable) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Queryable.Concat<TSource>(IQueryable<TSource>, IEnumerable<TSource>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Queryable.Concat<TSource>(IQueryable<TSource>, IEnumerable<TSource>) | parameter 1 [[]] -> return [[]] | true |
-| System.Linq.Queryable.Count<TSource>(IQueryable<TSource>, Expression<Func<TSource,Boolean>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.DefaultIfEmpty<TSource>(IQueryable<TSource>) | parameter 0 [[]] -> return | true |
-| System.Linq.Queryable.DefaultIfEmpty<TSource>(IQueryable<TSource>, TSource) | parameter 0 [[]] -> return | true |
-| System.Linq.Queryable.DefaultIfEmpty<TSource>(IQueryable<TSource>, TSource) | parameter 1 -> return | true |
-| System.Linq.Queryable.Distinct<TSource>(IQueryable<TSource>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Queryable.Distinct<TSource>(IQueryable<TSource>, IEqualityComparer<TSource>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Queryable.ElementAt<TSource>(IQueryable<TSource>, int) | parameter 0 [[]] -> return | true |
-| System.Linq.Queryable.ElementAtOrDefault<TSource>(IQueryable<TSource>, int) | parameter 0 [[]] -> return | true |
-| System.Linq.Queryable.Except<TSource>(IQueryable<TSource>, IEnumerable<TSource>) | parameter 0 [[]] -> return | true |
-| System.Linq.Queryable.Except<TSource>(IQueryable<TSource>, IEnumerable<TSource>, IEqualityComparer<TSource>) | parameter 0 [[]] -> return | true |
-| System.Linq.Queryable.First<TSource>(IQueryable<TSource>) | parameter 0 [[]] -> return | true |
-| System.Linq.Queryable.First<TSource>(IQueryable<TSource>, Expression<Func<TSource,Boolean>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.First<TSource>(IQueryable<TSource>, Expression<Func<TSource,Boolean>>) | parameter 0 [[]] -> return | true |
-| System.Linq.Queryable.FirstOrDefault<TSource>(IQueryable<TSource>) | parameter 0 [[]] -> return | true |
-| System.Linq.Queryable.FirstOrDefault<TSource>(IQueryable<TSource>, Expression<Func<TSource,Boolean>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.FirstOrDefault<TSource>(IQueryable<TSource>, Expression<Func<TSource,Boolean>>) | parameter 0 [[]] -> return | true |
-| System.Linq.Queryable.GroupBy<TSource, TKey, TElement, TResult>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, Expression<Func<TSource,TElement>>, Expression<Func<TKey,IEnumerable<TElement>,TResult>>) | deleget output from parameter 1 -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.Queryable.GroupBy<TSource, TKey, TElement, TResult>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, Expression<Func<TSource,TElement>>, Expression<Func<TKey,IEnumerable<TElement>,TResult>>) | deleget output from parameter 2 -> parameter 1 of delegate parameter 3 [[]] | true |
-| System.Linq.Queryable.GroupBy<TSource, TKey, TElement, TResult>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, Expression<Func<TSource,TElement>>, Expression<Func<TKey,IEnumerable<TElement>,TResult>>) | deleget output from parameter 3 -> return [[]] | true |
-| System.Linq.Queryable.GroupBy<TSource, TKey, TElement, TResult>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, Expression<Func<TSource,TElement>>, Expression<Func<TKey,IEnumerable<TElement>,TResult>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.GroupBy<TSource, TKey, TElement, TResult>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, Expression<Func<TSource,TElement>>, Expression<Func<TKey,IEnumerable<TElement>,TResult>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.Queryable.GroupBy<TSource, TKey, TElement, TResult>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, Expression<Func<TSource,TElement>>, Expression<Func<TKey,IEnumerable<TElement>,TResult>>, IEqualityComparer<TKey>) | deleget output from parameter 1 -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.Queryable.GroupBy<TSource, TKey, TElement, TResult>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, Expression<Func<TSource,TElement>>, Expression<Func<TKey,IEnumerable<TElement>,TResult>>, IEqualityComparer<TKey>) | deleget output from parameter 2 -> parameter 1 of delegate parameter 3 [[]] | true |
-| System.Linq.Queryable.GroupBy<TSource, TKey, TElement, TResult>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, Expression<Func<TSource,TElement>>, Expression<Func<TKey,IEnumerable<TElement>,TResult>>, IEqualityComparer<TKey>) | deleget output from parameter 3 -> return [[]] | true |
-| System.Linq.Queryable.GroupBy<TSource, TKey, TElement, TResult>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, Expression<Func<TSource,TElement>>, Expression<Func<TKey,IEnumerable<TElement>,TResult>>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.GroupBy<TSource, TKey, TElement, TResult>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, Expression<Func<TSource,TElement>>, Expression<Func<TKey,IEnumerable<TElement>,TResult>>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.Queryable.GroupBy<TSource, TKey, TElement>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, Expression<Func<TSource,TElement>>) | deleget output from parameter 2 -> return [[]] | true |
-| System.Linq.Queryable.GroupBy<TSource, TKey, TElement>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, Expression<Func<TSource,TElement>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.GroupBy<TSource, TKey, TElement>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, Expression<Func<TSource,TElement>>, IEqualityComparer<TKey>) | deleget output from parameter 1 -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.Queryable.GroupBy<TSource, TKey, TElement>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, Expression<Func<TSource,TElement>>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.GroupBy<TSource, TKey, TElement>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, Expression<Func<TSource,TElement>>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.Queryable.GroupBy<TSource, TKey, TResult>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, Expression<Func<TKey,IEnumerable<TSource>,TResult>>) | deleget output from parameter 2 -> return [[]] | true |
-| System.Linq.Queryable.GroupBy<TSource, TKey, TResult>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, Expression<Func<TKey,IEnumerable<TSource>,TResult>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.GroupBy<TSource, TKey, TResult>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, Expression<Func<TKey,IEnumerable<TSource>,TResult>>, IEqualityComparer<TKey>) | deleget output from parameter 1 -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.Queryable.GroupBy<TSource, TKey, TResult>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, Expression<Func<TKey,IEnumerable<TSource>,TResult>>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.GroupBy<TSource, TKey, TResult>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, Expression<Func<TKey,IEnumerable<TSource>,TResult>>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.Queryable.GroupBy<TSource, TKey>(IQueryable<TSource>, Expression<Func<TSource,TKey>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.GroupBy<TSource, TKey>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.GroupJoin<TOuter, TInner, TKey, TResult>(IQueryable<TOuter>, IEnumerable<TInner>, Expression<Func<TOuter,TKey>>, Expression<Func<TInner,TKey>>, Expression<Func<TOuter,IEnumerable<TInner>,TResult>>) | deleget output from parameter 4 -> return [[]] | true |
-| System.Linq.Queryable.GroupJoin<TOuter, TInner, TKey, TResult>(IQueryable<TOuter>, IEnumerable<TInner>, Expression<Func<TOuter,TKey>>, Expression<Func<TInner,TKey>>, Expression<Func<TOuter,IEnumerable<TInner>,TResult>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.Queryable.GroupJoin<TOuter, TInner, TKey, TResult>(IQueryable<TOuter>, IEnumerable<TInner>, Expression<Func<TOuter,TKey>>, Expression<Func<TInner,TKey>>, Expression<Func<TOuter,IEnumerable<TInner>,TResult>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 4 | true |
-| System.Linq.Queryable.GroupJoin<TOuter, TInner, TKey, TResult>(IQueryable<TOuter>, IEnumerable<TInner>, Expression<Func<TOuter,TKey>>, Expression<Func<TInner,TKey>>, Expression<Func<TOuter,IEnumerable<TInner>,TResult>>) | parameter 1 [[]] -> parameter 0 of delegate parameter 3 | true |
-| System.Linq.Queryable.GroupJoin<TOuter, TInner, TKey, TResult>(IQueryable<TOuter>, IEnumerable<TInner>, Expression<Func<TOuter,TKey>>, Expression<Func<TInner,TKey>>, Expression<Func<TOuter,IEnumerable<TInner>,TResult>>) | parameter 1 [[]] -> parameter 1 of delegate parameter 4 | true |
-| System.Linq.Queryable.GroupJoin<TOuter, TInner, TKey, TResult>(IQueryable<TOuter>, IEnumerable<TInner>, Expression<Func<TOuter,TKey>>, Expression<Func<TInner,TKey>>, Expression<Func<TOuter,IEnumerable<TInner>,TResult>>, IEqualityComparer<TKey>) | deleget output from parameter 4 -> return [[]] | true |
-| System.Linq.Queryable.GroupJoin<TOuter, TInner, TKey, TResult>(IQueryable<TOuter>, IEnumerable<TInner>, Expression<Func<TOuter,TKey>>, Expression<Func<TInner,TKey>>, Expression<Func<TOuter,IEnumerable<TInner>,TResult>>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.Queryable.GroupJoin<TOuter, TInner, TKey, TResult>(IQueryable<TOuter>, IEnumerable<TInner>, Expression<Func<TOuter,TKey>>, Expression<Func<TInner,TKey>>, Expression<Func<TOuter,IEnumerable<TInner>,TResult>>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 4 | true |
-| System.Linq.Queryable.GroupJoin<TOuter, TInner, TKey, TResult>(IQueryable<TOuter>, IEnumerable<TInner>, Expression<Func<TOuter,TKey>>, Expression<Func<TInner,TKey>>, Expression<Func<TOuter,IEnumerable<TInner>,TResult>>, IEqualityComparer<TKey>) | parameter 1 [[]] -> parameter 0 of delegate parameter 3 | true |
-| System.Linq.Queryable.GroupJoin<TOuter, TInner, TKey, TResult>(IQueryable<TOuter>, IEnumerable<TInner>, Expression<Func<TOuter,TKey>>, Expression<Func<TInner,TKey>>, Expression<Func<TOuter,IEnumerable<TInner>,TResult>>, IEqualityComparer<TKey>) | parameter 1 [[]] -> parameter 1 of delegate parameter 4 | true |
-| System.Linq.Queryable.Intersect<TSource>(IQueryable<TSource>, IEnumerable<TSource>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Queryable.Intersect<TSource>(IQueryable<TSource>, IEnumerable<TSource>) | parameter 1 [[]] -> return [[]] | true |
-| System.Linq.Queryable.Intersect<TSource>(IQueryable<TSource>, IEnumerable<TSource>, IEqualityComparer<TSource>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Queryable.Intersect<TSource>(IQueryable<TSource>, IEnumerable<TSource>, IEqualityComparer<TSource>) | parameter 1 [[]] -> return [[]] | true |
-| System.Linq.Queryable.Join<TOuter, TInner, TKey, TResult>(IQueryable<TOuter>, IEnumerable<TInner>, Expression<Func<TOuter,TKey>>, Expression<Func<TInner,TKey>>, Expression<Func<TOuter,TInner,TResult>>) | deleget output from parameter 4 -> return [[]] | true |
-| System.Linq.Queryable.Join<TOuter, TInner, TKey, TResult>(IQueryable<TOuter>, IEnumerable<TInner>, Expression<Func<TOuter,TKey>>, Expression<Func<TInner,TKey>>, Expression<Func<TOuter,TInner,TResult>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.Queryable.Join<TOuter, TInner, TKey, TResult>(IQueryable<TOuter>, IEnumerable<TInner>, Expression<Func<TOuter,TKey>>, Expression<Func<TInner,TKey>>, Expression<Func<TOuter,TInner,TResult>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 4 | true |
-| System.Linq.Queryable.Join<TOuter, TInner, TKey, TResult>(IQueryable<TOuter>, IEnumerable<TInner>, Expression<Func<TOuter,TKey>>, Expression<Func<TInner,TKey>>, Expression<Func<TOuter,TInner,TResult>>) | parameter 1 [[]] -> parameter 0 of delegate parameter 3 | true |
-| System.Linq.Queryable.Join<TOuter, TInner, TKey, TResult>(IQueryable<TOuter>, IEnumerable<TInner>, Expression<Func<TOuter,TKey>>, Expression<Func<TInner,TKey>>, Expression<Func<TOuter,TInner,TResult>>) | parameter 1 [[]] -> parameter 1 of delegate parameter 4 | true |
-| System.Linq.Queryable.Join<TOuter, TInner, TKey, TResult>(IQueryable<TOuter>, IEnumerable<TInner>, Expression<Func<TOuter,TKey>>, Expression<Func<TInner,TKey>>, Expression<Func<TOuter,TInner,TResult>>, IEqualityComparer<TKey>) | deleget output from parameter 4 -> return [[]] | true |
-| System.Linq.Queryable.Join<TOuter, TInner, TKey, TResult>(IQueryable<TOuter>, IEnumerable<TInner>, Expression<Func<TOuter,TKey>>, Expression<Func<TInner,TKey>>, Expression<Func<TOuter,TInner,TResult>>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.Queryable.Join<TOuter, TInner, TKey, TResult>(IQueryable<TOuter>, IEnumerable<TInner>, Expression<Func<TOuter,TKey>>, Expression<Func<TInner,TKey>>, Expression<Func<TOuter,TInner,TResult>>, IEqualityComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 4 | true |
-| System.Linq.Queryable.Join<TOuter, TInner, TKey, TResult>(IQueryable<TOuter>, IEnumerable<TInner>, Expression<Func<TOuter,TKey>>, Expression<Func<TInner,TKey>>, Expression<Func<TOuter,TInner,TResult>>, IEqualityComparer<TKey>) | parameter 1 [[]] -> parameter 0 of delegate parameter 3 | true |
-| System.Linq.Queryable.Join<TOuter, TInner, TKey, TResult>(IQueryable<TOuter>, IEnumerable<TInner>, Expression<Func<TOuter,TKey>>, Expression<Func<TInner,TKey>>, Expression<Func<TOuter,TInner,TResult>>, IEqualityComparer<TKey>) | parameter 1 [[]] -> parameter 1 of delegate parameter 4 | true |
-| System.Linq.Queryable.Last<TSource>(IQueryable<TSource>) | parameter 0 [[]] -> return | true |
-| System.Linq.Queryable.Last<TSource>(IQueryable<TSource>, Expression<Func<TSource,Boolean>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.Last<TSource>(IQueryable<TSource>, Expression<Func<TSource,Boolean>>) | parameter 0 [[]] -> return | true |
-| System.Linq.Queryable.LastOrDefault<TSource>(IQueryable<TSource>) | parameter 0 [[]] -> return | true |
-| System.Linq.Queryable.LastOrDefault<TSource>(IQueryable<TSource>, Expression<Func<TSource,Boolean>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.LastOrDefault<TSource>(IQueryable<TSource>, Expression<Func<TSource,Boolean>>) | parameter 0 [[]] -> return | true |
-| System.Linq.Queryable.LongCount<TSource>(IQueryable<TSource>, Expression<Func<TSource,Boolean>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.Max<TSource, TResult>(IQueryable<TSource>, Expression<Func<TSource,TResult>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.Min<TSource, TResult>(IQueryable<TSource>, Expression<Func<TSource,TResult>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.OfType<TResult>(IQueryable) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Queryable.OrderBy<TSource, TKey>(IQueryable<TSource>, Expression<Func<TSource,TKey>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.OrderBy<TSource, TKey>(IQueryable<TSource>, Expression<Func<TSource,TKey>>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Queryable.OrderBy<TSource, TKey>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, IComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.OrderBy<TSource, TKey>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, IComparer<TKey>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Queryable.OrderByDescending<TSource, TKey>(IQueryable<TSource>, Expression<Func<TSource,TKey>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.OrderByDescending<TSource, TKey>(IQueryable<TSource>, Expression<Func<TSource,TKey>>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Queryable.OrderByDescending<TSource, TKey>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, IComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.OrderByDescending<TSource, TKey>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, IComparer<TKey>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Queryable.Reverse<TSource>(IQueryable<TSource>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Queryable.Select<TSource, TResult>(IQueryable<TSource>, Expression<Func<TSource,Int32,TResult>>) | deleget output from parameter 1 -> return [[]] | true |
-| System.Linq.Queryable.Select<TSource, TResult>(IQueryable<TSource>, Expression<Func<TSource,Int32,TResult>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.Select<TSource, TResult>(IQueryable<TSource>, Expression<Func<TSource,TResult>>) | deleget output from parameter 1 -> return [[]] | true |
-| System.Linq.Queryable.Select<TSource, TResult>(IQueryable<TSource>, Expression<Func<TSource,TResult>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.SelectMany<TSource, TCollection, TResult>(IQueryable<TSource>, Expression<Func<TSource,IEnumerable<TCollection>>>, Expression<Func<TSource,TCollection,TResult>>) | deleget output from parameter 1 [[]] -> parameter 1 of delegate parameter 2 | true |
-| System.Linq.Queryable.SelectMany<TSource, TCollection, TResult>(IQueryable<TSource>, Expression<Func<TSource,IEnumerable<TCollection>>>, Expression<Func<TSource,TCollection,TResult>>) | deleget output from parameter 2 -> return [[]] | true |
-| System.Linq.Queryable.SelectMany<TSource, TCollection, TResult>(IQueryable<TSource>, Expression<Func<TSource,IEnumerable<TCollection>>>, Expression<Func<TSource,TCollection,TResult>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.SelectMany<TSource, TCollection, TResult>(IQueryable<TSource>, Expression<Func<TSource,IEnumerable<TCollection>>>, Expression<Func<TSource,TCollection,TResult>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.Queryable.SelectMany<TSource, TCollection, TResult>(IQueryable<TSource>, Expression<Func<TSource,Int32,IEnumerable<TCollection>>>, Expression<Func<TSource,TCollection,TResult>>) | deleget output from parameter 1 [[]] -> parameter 1 of delegate parameter 2 | true |
-| System.Linq.Queryable.SelectMany<TSource, TCollection, TResult>(IQueryable<TSource>, Expression<Func<TSource,Int32,IEnumerable<TCollection>>>, Expression<Func<TSource,TCollection,TResult>>) | deleget output from parameter 2 -> return [[]] | true |
-| System.Linq.Queryable.SelectMany<TSource, TCollection, TResult>(IQueryable<TSource>, Expression<Func<TSource,Int32,IEnumerable<TCollection>>>, Expression<Func<TSource,TCollection,TResult>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.SelectMany<TSource, TCollection, TResult>(IQueryable<TSource>, Expression<Func<TSource,Int32,IEnumerable<TCollection>>>, Expression<Func<TSource,TCollection,TResult>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.Queryable.SelectMany<TSource, TResult>(IQueryable<TSource>, Expression<Func<TSource,IEnumerable<TResult>>>) | deleget output from parameter 1 -> return [[]] | true |
-| System.Linq.Queryable.SelectMany<TSource, TResult>(IQueryable<TSource>, Expression<Func<TSource,IEnumerable<TResult>>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.SelectMany<TSource, TResult>(IQueryable<TSource>, Expression<Func<TSource,Int32,IEnumerable<TResult>>>) | deleget output from parameter 1 -> return [[]] | true |
-| System.Linq.Queryable.SelectMany<TSource, TResult>(IQueryable<TSource>, Expression<Func<TSource,Int32,IEnumerable<TResult>>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.Single<TSource>(IQueryable<TSource>) | parameter 0 [[]] -> return | true |
-| System.Linq.Queryable.Single<TSource>(IQueryable<TSource>, Expression<Func<TSource,Boolean>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.Single<TSource>(IQueryable<TSource>, Expression<Func<TSource,Boolean>>) | parameter 0 [[]] -> return | true |
-| System.Linq.Queryable.SingleOrDefault<TSource>(IQueryable<TSource>) | parameter 0 [[]] -> return | true |
-| System.Linq.Queryable.SingleOrDefault<TSource>(IQueryable<TSource>, Expression<Func<TSource,Boolean>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.SingleOrDefault<TSource>(IQueryable<TSource>, Expression<Func<TSource,Boolean>>) | parameter 0 [[]] -> return | true |
-| System.Linq.Queryable.Skip<TSource>(IQueryable<TSource>, int) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Queryable.SkipWhile<TSource>(IQueryable<TSource>, Expression<Func<TSource,Boolean>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.SkipWhile<TSource>(IQueryable<TSource>, Expression<Func<TSource,Boolean>>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Queryable.SkipWhile<TSource>(IQueryable<TSource>, Expression<Func<TSource,Int32,Boolean>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.SkipWhile<TSource>(IQueryable<TSource>, Expression<Func<TSource,Int32,Boolean>>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Queryable.Sum<TSource>(IQueryable<TSource>, Expression<Func<TSource,Decimal>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.Sum<TSource>(IQueryable<TSource>, Expression<Func<TSource,Double>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.Sum<TSource>(IQueryable<TSource>, Expression<Func<TSource,Int32>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.Sum<TSource>(IQueryable<TSource>, Expression<Func<TSource,Int64>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.Sum<TSource>(IQueryable<TSource>, Expression<Func<TSource,Nullable<Decimal>>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.Sum<TSource>(IQueryable<TSource>, Expression<Func<TSource,Nullable<Double>>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.Sum<TSource>(IQueryable<TSource>, Expression<Func<TSource,Nullable<Int32>>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.Sum<TSource>(IQueryable<TSource>, Expression<Func<TSource,Nullable<Int64>>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.Sum<TSource>(IQueryable<TSource>, Expression<Func<TSource,Nullable<Single>>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.Sum<TSource>(IQueryable<TSource>, Expression<Func<TSource,Single>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.Take<TSource>(IQueryable<TSource>, int) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Queryable.TakeWhile<TSource>(IQueryable<TSource>, Expression<Func<TSource,Boolean>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.TakeWhile<TSource>(IQueryable<TSource>, Expression<Func<TSource,Boolean>>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Queryable.TakeWhile<TSource>(IQueryable<TSource>, Expression<Func<TSource,Int32,Boolean>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.TakeWhile<TSource>(IQueryable<TSource>, Expression<Func<TSource,Int32,Boolean>>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Queryable.ThenBy<TSource, TKey>(IOrderedQueryable<TSource>, Expression<Func<TSource,TKey>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.ThenBy<TSource, TKey>(IOrderedQueryable<TSource>, Expression<Func<TSource,TKey>>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Queryable.ThenBy<TSource, TKey>(IOrderedQueryable<TSource>, Expression<Func<TSource,TKey>>, IComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.ThenBy<TSource, TKey>(IOrderedQueryable<TSource>, Expression<Func<TSource,TKey>>, IComparer<TKey>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Queryable.ThenByDescending<TSource, TKey>(IOrderedQueryable<TSource>, Expression<Func<TSource,TKey>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.ThenByDescending<TSource, TKey>(IOrderedQueryable<TSource>, Expression<Func<TSource,TKey>>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Queryable.ThenByDescending<TSource, TKey>(IOrderedQueryable<TSource>, Expression<Func<TSource,TKey>>, IComparer<TKey>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.ThenByDescending<TSource, TKey>(IOrderedQueryable<TSource>, Expression<Func<TSource,TKey>>, IComparer<TKey>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Queryable.Union<TSource>(IQueryable<TSource>, IEnumerable<TSource>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Queryable.Union<TSource>(IQueryable<TSource>, IEnumerable<TSource>) | parameter 1 [[]] -> return [[]] | true |
-| System.Linq.Queryable.Union<TSource>(IQueryable<TSource>, IEnumerable<TSource>, IEqualityComparer<TSource>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Queryable.Union<TSource>(IQueryable<TSource>, IEnumerable<TSource>, IEqualityComparer<TSource>) | parameter 1 [[]] -> return [[]] | true |
-| System.Linq.Queryable.Where<TSource>(IQueryable<TSource>, Expression<Func<TSource,Boolean>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.Where<TSource>(IQueryable<TSource>, Expression<Func<TSource,Boolean>>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Queryable.Where<TSource>(IQueryable<TSource>, Expression<Func<TSource,Int32,Boolean>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 1 | true |
-| System.Linq.Queryable.Where<TSource>(IQueryable<TSource>, Expression<Func<TSource,Int32,Boolean>>) | parameter 0 [[]] -> return [[]] | true |
-| System.Linq.Queryable.Zip<TFirst, TSecond, TResult>(IQueryable<TFirst>, IEnumerable<TSecond>, Expression<Func<TFirst,TSecond,TResult>>) | deleget output from parameter 2 -> return [[]] | true |
-| System.Linq.Queryable.Zip<TFirst, TSecond, TResult>(IQueryable<TFirst>, IEnumerable<TSecond>, Expression<Func<TFirst,TSecond,TResult>>) | parameter 0 [[]] -> parameter 0 of delegate parameter 2 | true |
-| System.Linq.Queryable.Zip<TFirst, TSecond, TResult>(IQueryable<TFirst>, IEnumerable<TSecond>, Expression<Func<TFirst,TSecond,TResult>>) | parameter 1 [[]] -> parameter 1 of delegate parameter 2 | true |
-| System.Net.Cookie.get_Value() | this parameter -> return | false |
-| System.Net.CookieCollection.Add(Cookie) | parameter 0 -> this parameter [[]] | true |
-| System.Net.CookieCollection.Add(CookieCollection) | parameter 0 -> this parameter [[]] | true |
-| System.Net.CookieCollection.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Net.CookieCollection.CopyTo(Cookie[], int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Net.CookieCollection.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Net.CredentialCache.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Net.HttpListenerPrefixCollection.Add(string) | parameter 0 -> this parameter [[]] | true |
-| System.Net.HttpListenerPrefixCollection.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Net.HttpListenerPrefixCollection.CopyTo(String[], int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Net.HttpListenerPrefixCollection.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Net.HttpRequestStream.BeginRead(Byte[], int, int, AsyncCallback, object) | this parameter -> parameter 0 | false |
-| System.Net.HttpRequestStream.BeginWrite(Byte[], int, int, AsyncCallback, object) | parameter 0 -> this parameter | false |
-| System.Net.HttpRequestStream.Read(Byte[], int, int) | this parameter -> parameter 0 | false |
-| System.Net.HttpRequestStream.Write(Byte[], int, int) | parameter 0 -> this parameter | false |
-| System.Net.HttpResponseStream.BeginRead(Byte[], int, int, AsyncCallback, object) | this parameter -> parameter 0 | false |
-| System.Net.HttpResponseStream.BeginWrite(Byte[], int, int, AsyncCallback, object) | parameter 0 -> this parameter | false |
-| System.Net.HttpResponseStream.Read(Byte[], int, int) | this parameter -> parameter 0 | false |
-| System.Net.HttpResponseStream.Write(Byte[], int, int) | parameter 0 -> this parameter | false |
-| System.Net.NetworkInformation.IPAddressCollection.Add(IPAddress) | parameter 0 -> this parameter [[]] | true |
-| System.Net.NetworkInformation.IPAddressCollection.CopyTo(IPAddress[], int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Net.NetworkInformation.IPAddressCollection.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Net.Security.CipherSuitesPolicy.<get_AllowedCipherSuites>d__6.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Net.Security.NegotiateStream.BeginRead(Byte[], int, int, AsyncCallback, object) | this parameter -> parameter 0 | false |
-| System.Net.Security.NegotiateStream.BeginWrite(Byte[], int, int, AsyncCallback, object) | parameter 0 -> this parameter | false |
-| System.Net.Security.NegotiateStream.Read(Byte[], int, int) | this parameter -> parameter 0 | false |
-| System.Net.Security.NegotiateStream.ReadAsync(Byte[], int, int, CancellationToken) | this parameter -> parameter 0 | false |
-| System.Net.Security.NegotiateStream.Write(Byte[], int, int) | parameter 0 -> this parameter | false |
-| System.Net.Security.NegotiateStream.WriteAsync(Byte[], int, int, CancellationToken) | parameter 0 -> this parameter | false |
-| System.Net.Security.SslStream.BeginRead(Byte[], int, int, AsyncCallback, object) | this parameter -> parameter 0 | false |
-| System.Net.Security.SslStream.BeginWrite(Byte[], int, int, AsyncCallback, object) | parameter 0 -> this parameter | false |
-| System.Net.Security.SslStream.Read(Byte[], int, int) | this parameter -> parameter 0 | false |
-| System.Net.Security.SslStream.ReadAsync(Byte[], int, int, CancellationToken) | this parameter -> parameter 0 | false |
-| System.Net.Security.SslStream.Write(Byte[], int, int) | parameter 0 -> this parameter | false |
-| System.Net.Security.SslStream.WriteAsync(Byte[], int, int, CancellationToken) | parameter 0 -> this parameter | false |
-| System.Net.WebUtility.HtmlEncode(string) | parameter 0 -> return | false |
-| System.Net.WebUtility.HtmlEncode(string, TextWriter) | parameter 0 -> return | false |
-| System.Net.WebUtility.UrlEncode(string) | parameter 0 -> return | false |
-| System.Nullable<>.GetValueOrDefault() | this parameter [Value] -> return | true |
-| System.Nullable<>.GetValueOrDefault(T) | parameter 0 -> return | true |
-| System.Nullable<>.GetValueOrDefault(T) | this parameter [Value] -> return | true |
-| System.Nullable<>.Nullable(T) | parameter 0 -> return [Value] | true |
-| System.Nullable<>.get_HasValue() | this parameter [Value] -> return | false |
-| System.Nullable<>.get_Value() | this parameter -> return | false |
-| System.Reflection.TypeInfo.<GetDeclaredMethods>d__10.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Reflection.TypeInfo.<get_DeclaredNestedTypes>d__22.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Resources.ResourceFallbackManager.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Resources.ResourceReader.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Resources.ResourceSet.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Resources.RuntimeResourceSet.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Runtime.CompilerServices.ConditionalWeakTable<,>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Runtime.CompilerServices.ConfiguredTaskAwaitable<>.ConfiguredTaskAwaiter.GetResult() | this parameter [m_task, Result] -> return | true |
-| System.Runtime.CompilerServices.ConfiguredTaskAwaitable<>.GetAwaiter() | this parameter [m_configuredTaskAwaiter] -> return | true |
-| System.Runtime.CompilerServices.ReadOnlyCollectionBuilder<>.Add(T) | parameter 0 -> this parameter [[]] | true |
-| System.Runtime.CompilerServices.ReadOnlyCollectionBuilder<>.Add(object) | parameter 0 -> this parameter [[]] | true |
-| System.Runtime.CompilerServices.ReadOnlyCollectionBuilder<>.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Runtime.CompilerServices.ReadOnlyCollectionBuilder<>.CopyTo(T[], int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Runtime.CompilerServices.ReadOnlyCollectionBuilder<>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Runtime.CompilerServices.ReadOnlyCollectionBuilder<>.Insert(int, T) | parameter 1 -> this parameter [[]] | true |
-| System.Runtime.CompilerServices.ReadOnlyCollectionBuilder<>.Insert(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Runtime.CompilerServices.ReadOnlyCollectionBuilder<>.Reverse() | parameter 0 [[]] -> return [[]] | true |
-| System.Runtime.CompilerServices.ReadOnlyCollectionBuilder<>.Reverse(int, int) | parameter 0 [[]] -> return [[]] | true |
-| System.Runtime.CompilerServices.ReadOnlyCollectionBuilder<>.get_Item(int) | this parameter [[]] -> return | true |
-| System.Runtime.CompilerServices.ReadOnlyCollectionBuilder<>.set_Item(int, T) | parameter 1 -> this parameter [[]] | true |
-| System.Runtime.CompilerServices.ReadOnlyCollectionBuilder<>.set_Item(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Runtime.CompilerServices.TaskAwaiter<>.GetResult() | this parameter [m_task, Result] -> return | true |
-| System.Runtime.InteropServices.MemoryMarshal.<ToEnumerable>d__15<>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Runtime.Loader.AssemblyLoadContext.<get_All>d__83.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Runtime.Loader.AssemblyLoadContext.<get_Assemblies>d__53.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Runtime.Loader.LibraryNameVariation.<DetermineLibraryNameVariations>d__5.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Security.Cryptography.CryptoStream.BeginRead(Byte[], int, int, AsyncCallback, object) | this parameter -> parameter 0 | false |
-| System.Security.Cryptography.CryptoStream.BeginWrite(Byte[], int, int, AsyncCallback, object) | parameter 0 -> this parameter | false |
-| System.Security.Cryptography.CryptoStream.Read(Byte[], int, int) | this parameter -> parameter 0 | false |
-| System.Security.Cryptography.CryptoStream.ReadAsync(Byte[], int, int, CancellationToken) | this parameter -> parameter 0 | false |
-| System.Security.Cryptography.CryptoStream.Write(Byte[], int, int) | parameter 0 -> this parameter | false |
-| System.Security.Cryptography.CryptoStream.WriteAsync(Byte[], int, int, CancellationToken) | parameter 0 -> this parameter | false |
-| System.Security.PermissionSet.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Security.PermissionSet.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.String.Clone() | this parameter -> return | true |
-| System.String.Concat(IEnumerable<String>) | parameter 0 [[]] -> return | false |
-| System.String.Concat(ReadOnlySpan<Char>, ReadOnlySpan<Char>) | parameter 0 -> return | false |
-| System.String.Concat(ReadOnlySpan<Char>, ReadOnlySpan<Char>) | parameter 1 -> return | false |
-| System.String.Concat(ReadOnlySpan<Char>, ReadOnlySpan<Char>, ReadOnlySpan<Char>) | parameter 0 -> return | false |
-| System.String.Concat(ReadOnlySpan<Char>, ReadOnlySpan<Char>, ReadOnlySpan<Char>) | parameter 1 -> return | false |
-| System.String.Concat(ReadOnlySpan<Char>, ReadOnlySpan<Char>, ReadOnlySpan<Char>) | parameter 2 -> return | false |
-| System.String.Concat(ReadOnlySpan<Char>, ReadOnlySpan<Char>, ReadOnlySpan<Char>, ReadOnlySpan<Char>) | parameter 0 -> return | false |
-| System.String.Concat(ReadOnlySpan<Char>, ReadOnlySpan<Char>, ReadOnlySpan<Char>, ReadOnlySpan<Char>) | parameter 1 -> return | false |
-| System.String.Concat(ReadOnlySpan<Char>, ReadOnlySpan<Char>, ReadOnlySpan<Char>, ReadOnlySpan<Char>) | parameter 2 -> return | false |
-| System.String.Concat(ReadOnlySpan<Char>, ReadOnlySpan<Char>, ReadOnlySpan<Char>, ReadOnlySpan<Char>) | parameter 3 -> return | false |
-| System.String.Concat(object) | parameter 0 -> return | false |
-| System.String.Concat(object, object) | parameter 0 -> return | false |
-| System.String.Concat(object, object) | parameter 1 -> return | false |
-| System.String.Concat(object, object, object) | parameter 0 -> return | false |
-| System.String.Concat(object, object, object) | parameter 1 -> return | false |
-| System.String.Concat(object, object, object) | parameter 2 -> return | false |
-| System.String.Concat(params Object[]) | parameter 0 [[]] -> return | false |
-| System.String.Concat(params String[]) | parameter 0 [[]] -> return | false |
-| System.String.Concat(string, string) | parameter 0 -> return | false |
-| System.String.Concat(string, string) | parameter 1 -> return | false |
-| System.String.Concat(string, string, string) | parameter 0 -> return | false |
-| System.String.Concat(string, string, string) | parameter 1 -> return | false |
-| System.String.Concat(string, string, string) | parameter 2 -> return | false |
-| System.String.Concat(string, string, string, string) | parameter 0 -> return | false |
-| System.String.Concat(string, string, string, string) | parameter 1 -> return | false |
-| System.String.Concat(string, string, string, string) | parameter 2 -> return | false |
-| System.String.Concat(string, string, string, string) | parameter 3 -> return | false |
-| System.String.Concat<T>(IEnumerable<T>) | parameter 0 [[]] -> return | false |
-| System.String.Copy(string) | parameter 0 -> return | true |
-| System.String.Format(IFormatProvider, string, object) | parameter 1 -> return | false |
-| System.String.Format(IFormatProvider, string, object) | parameter 2 -> return | false |
-| System.String.Format(IFormatProvider, string, object, object) | parameter 1 -> return | false |
-| System.String.Format(IFormatProvider, string, object, object) | parameter 2 -> return | false |
-| System.String.Format(IFormatProvider, string, object, object) | parameter 3 -> return | false |
-| System.String.Format(IFormatProvider, string, object, object, object) | parameter 1 -> return | false |
-| System.String.Format(IFormatProvider, string, object, object, object) | parameter 2 -> return | false |
-| System.String.Format(IFormatProvider, string, object, object, object) | parameter 3 -> return | false |
-| System.String.Format(IFormatProvider, string, object, object, object) | parameter 4 -> return | false |
-| System.String.Format(IFormatProvider, string, params Object[]) | parameter 1 -> return | false |
-| System.String.Format(IFormatProvider, string, params Object[]) | parameter 2 [[]] -> return | false |
-| System.String.Format(string, object) | parameter 0 -> return | false |
-| System.String.Format(string, object) | parameter 1 -> return | false |
-| System.String.Format(string, object, object) | parameter 0 -> return | false |
-| System.String.Format(string, object, object) | parameter 1 -> return | false |
-| System.String.Format(string, object, object) | parameter 2 -> return | false |
-| System.String.Format(string, object, object, object) | parameter 0 -> return | false |
-| System.String.Format(string, object, object, object) | parameter 1 -> return | false |
-| System.String.Format(string, object, object, object) | parameter 2 -> return | false |
-| System.String.Format(string, object, object, object) | parameter 3 -> return | false |
-| System.String.Format(string, params Object[]) | parameter 0 -> return | false |
-| System.String.Format(string, params Object[]) | parameter 1 [[]] -> return | false |
-| System.String.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.String.Insert(int, string) | parameter 1 -> return | false |
-| System.String.Insert(int, string) | this parameter -> return | false |
-| System.String.Join(char, String[], int, int) | parameter 0 -> return | false |
-| System.String.Join(char, String[], int, int) | parameter 1 [[]] -> return | false |
-| System.String.Join(char, params Object[]) | parameter 0 -> return | false |
-| System.String.Join(char, params Object[]) | parameter 1 [[]] -> return | false |
-| System.String.Join(char, params String[]) | parameter 0 -> return | false |
-| System.String.Join(char, params String[]) | parameter 1 [[]] -> return | false |
-| System.String.Join(string, IEnumerable<String>) | parameter 0 -> return | false |
-| System.String.Join(string, IEnumerable<String>) | parameter 1 [[]] -> return | false |
-| System.String.Join(string, String[], int, int) | parameter 0 -> return | false |
-| System.String.Join(string, String[], int, int) | parameter 1 [[]] -> return | false |
-| System.String.Join(string, params Object[]) | parameter 0 -> return | false |
-| System.String.Join(string, params Object[]) | parameter 1 [[]] -> return | false |
-| System.String.Join(string, params String[]) | parameter 0 -> return | false |
-| System.String.Join(string, params String[]) | parameter 1 [[]] -> return | false |
-| System.String.Join<T>(char, IEnumerable<T>) | parameter 0 -> return | false |
-| System.String.Join<T>(char, IEnumerable<T>) | parameter 1 [[]] -> return | false |
-| System.String.Join<T>(string, IEnumerable<T>) | parameter 0 -> return | false |
-| System.String.Join<T>(string, IEnumerable<T>) | parameter 1 [[]] -> return | false |
-| System.String.Normalize() | this parameter -> return | false |
-| System.String.Normalize(NormalizationForm) | this parameter -> return | false |
-| System.String.PadLeft(int) | this parameter -> return | false |
-| System.String.PadLeft(int, char) | this parameter -> return | false |
-| System.String.PadRight(int) | this parameter -> return | false |
-| System.String.PadRight(int, char) | this parameter -> return | false |
-| System.String.Remove(int) | this parameter -> return | false |
-| System.String.Remove(int, int) | this parameter -> return | false |
-| System.String.Replace(char, char) | parameter 1 -> return | false |
-| System.String.Replace(char, char) | this parameter -> return | false |
-| System.String.Replace(string, string) | parameter 1 -> return | false |
-| System.String.Replace(string, string) | this parameter -> return | false |
-| System.String.Split(Char[], StringSplitOptions) | this parameter -> return [[]] | false |
-| System.String.Split(Char[], int) | this parameter -> return [[]] | false |
-| System.String.Split(Char[], int, StringSplitOptions) | this parameter -> return [[]] | false |
-| System.String.Split(String[], StringSplitOptions) | this parameter -> return [[]] | false |
-| System.String.Split(String[], int, StringSplitOptions) | this parameter -> return [[]] | false |
-| System.String.Split(char, StringSplitOptions) | this parameter -> return [[]] | false |
-| System.String.Split(char, int, StringSplitOptions) | this parameter -> return [[]] | false |
-| System.String.Split(params Char[]) | this parameter -> return [[]] | false |
-| System.String.Split(string, StringSplitOptions) | this parameter -> return [[]] | false |
-| System.String.Split(string, int, StringSplitOptions) | this parameter -> return [[]] | false |
-| System.String.String(Char[]) | parameter 0 [[]] -> return | false |
-| System.String.String(Char[], int, int) | parameter 0 [[]] -> return | false |
-| System.String.Substring(int) | this parameter -> return | false |
-| System.String.Substring(int, int) | this parameter -> return | false |
-| System.String.ToLower() | this parameter -> return | false |
-| System.String.ToLower(CultureInfo) | this parameter -> return | false |
-| System.String.ToLowerInvariant() | this parameter -> return | false |
-| System.String.ToString() | this parameter -> return | true |
-| System.String.ToString(IFormatProvider) | this parameter -> return | true |
-| System.String.ToUpper() | this parameter -> return | false |
-| System.String.ToUpper(CultureInfo) | this parameter -> return | false |
-| System.String.ToUpperInvariant() | this parameter -> return | false |
-| System.String.Trim() | this parameter -> return | false |
-| System.String.Trim(char) | this parameter -> return | false |
-| System.String.Trim(params Char[]) | this parameter -> return | false |
-| System.String.TrimEnd() | this parameter -> return | false |
-| System.String.TrimEnd(char) | this parameter -> return | false |
-| System.String.TrimEnd(params Char[]) | this parameter -> return | false |
-| System.String.TrimStart() | this parameter -> return | false |
-| System.String.TrimStart(char) | this parameter -> return | false |
-| System.String.TrimStart(params Char[]) | this parameter -> return | false |
-| System.Text.Encoding.GetBytes(Char[]) | parameter 0 [[]] -> return | false |
-| System.Text.Encoding.GetBytes(Char[], int, int) | parameter 0 [[]] -> return | false |
-| System.Text.Encoding.GetBytes(Char[], int, int, Byte[], int) | parameter 0 [[]] -> return | false |
-| System.Text.Encoding.GetBytes(ReadOnlySpan<Char>, Span<Byte>) | parameter 0 -> return | false |
-| System.Text.Encoding.GetBytes(char*, int, byte*, int) | parameter 0 -> return | false |
-| System.Text.Encoding.GetBytes(char*, int, byte*, int, EncoderNLS) | parameter 0 -> return | false |
-| System.Text.Encoding.GetBytes(string) | parameter 0 -> return | false |
-| System.Text.Encoding.GetBytes(string, int, int) | parameter 0 -> return | false |
-| System.Text.Encoding.GetBytes(string, int, int, Byte[], int) | parameter 0 -> return | false |
-| System.Text.Encoding.GetChars(Byte[]) | parameter 0 [[]] -> return | false |
-| System.Text.Encoding.GetChars(Byte[], int, int) | parameter 0 [[]] -> return | false |
-| System.Text.Encoding.GetChars(Byte[], int, int, Char[], int) | parameter 0 [[]] -> return | false |
-| System.Text.Encoding.GetChars(ReadOnlySpan<Byte>, Span<Char>) | parameter 0 [[]] -> return | false |
-| System.Text.Encoding.GetChars(byte*, int, char*, int) | parameter 0 [[]] -> return | false |
-| System.Text.Encoding.GetChars(byte*, int, char*, int, DecoderNLS) | parameter 0 [[]] -> return | false |
-| System.Text.Encoding.GetString(Byte[]) | parameter 0 [[]] -> return | false |
-| System.Text.Encoding.GetString(Byte[], int, int) | parameter 0 [[]] -> return | false |
-| System.Text.Encoding.GetString(ReadOnlySpan<Byte>) | parameter 0 [[]] -> return | false |
-| System.Text.Encoding.GetString(byte*, int) | parameter 0 [[]] -> return | false |
-| System.Text.RegularExpressions.CaptureCollection.Add(Capture) | parameter 0 -> this parameter [[]] | true |
-| System.Text.RegularExpressions.CaptureCollection.Add(object) | parameter 0 -> this parameter [[]] | true |
-| System.Text.RegularExpressions.CaptureCollection.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Text.RegularExpressions.CaptureCollection.CopyTo(Capture[], int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Text.RegularExpressions.CaptureCollection.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Text.RegularExpressions.CaptureCollection.Insert(int, Capture) | parameter 1 -> this parameter [[]] | true |
-| System.Text.RegularExpressions.CaptureCollection.Insert(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Text.RegularExpressions.CaptureCollection.get_Item(int) | this parameter [[]] -> return | true |
-| System.Text.RegularExpressions.CaptureCollection.set_Item(int, Capture) | parameter 1 -> this parameter [[]] | true |
-| System.Text.RegularExpressions.CaptureCollection.set_Item(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Text.RegularExpressions.GroupCollection.<get_Keys>d__49.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Text.RegularExpressions.GroupCollection.<get_Values>d__51.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Text.RegularExpressions.GroupCollection.Add(Group) | parameter 0 -> this parameter [[]] | true |
-| System.Text.RegularExpressions.GroupCollection.Add(object) | parameter 0 -> this parameter [[]] | true |
-| System.Text.RegularExpressions.GroupCollection.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Text.RegularExpressions.GroupCollection.CopyTo(Group[], int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Text.RegularExpressions.GroupCollection.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Text.RegularExpressions.GroupCollection.Insert(int, Group) | parameter 1 -> this parameter [[]] | true |
-| System.Text.RegularExpressions.GroupCollection.Insert(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Text.RegularExpressions.GroupCollection.get_Item(int) | this parameter [[]] -> return | true |
-| System.Text.RegularExpressions.GroupCollection.get_Item(string) | this parameter [[]] -> return | true |
-| System.Text.RegularExpressions.GroupCollection.set_Item(int, Group) | parameter 1 -> this parameter [[]] | true |
-| System.Text.RegularExpressions.GroupCollection.set_Item(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Text.RegularExpressions.MatchCollection.Add(Match) | parameter 0 -> this parameter [[]] | true |
-| System.Text.RegularExpressions.MatchCollection.Add(object) | parameter 0 -> this parameter [[]] | true |
-| System.Text.RegularExpressions.MatchCollection.CopyTo(Array, int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Text.RegularExpressions.MatchCollection.CopyTo(Match[], int) | this parameter [[]] -> parameter 0 [[]] | true |
-| System.Text.RegularExpressions.MatchCollection.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Text.RegularExpressions.MatchCollection.Insert(int, Match) | parameter 1 -> this parameter [[]] | true |
-| System.Text.RegularExpressions.MatchCollection.Insert(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Text.RegularExpressions.MatchCollection.get_Item(int) | this parameter [[]] -> return | true |
-| System.Text.RegularExpressions.MatchCollection.set_Item(int, Match) | parameter 1 -> this parameter [[]] | true |
-| System.Text.RegularExpressions.MatchCollection.set_Item(int, object) | parameter 1 -> this parameter [[]] | true |
-| System.Text.StringBuilder.Append(object) | parameter 0 -> return [[]] | true |
-| System.Text.StringBuilder.Append(object) | parameter 0 -> this parameter [[]] | true |
-| System.Text.StringBuilder.Append(string) | parameter 0 -> return [[]] | true |
-| System.Text.StringBuilder.Append(string) | parameter 0 -> this parameter [[]] | true |
-| System.Text.StringBuilder.Append(string, int, int) | parameter 0 -> return [[]] | true |
-| System.Text.StringBuilder.Append(string, int, int) | parameter 0 -> this parameter [[]] | true |
-| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object) | parameter 1 -> return [[]] | true |
-| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object) | parameter 1 -> this parameter [[]] | true |
-| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object) | parameter 2 -> return [[]] | true |
-| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object) | parameter 2 -> this parameter [[]] | true |
-| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object) | parameter 1 -> return [[]] | true |
-| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object) | parameter 1 -> this parameter [[]] | true |
-| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object) | parameter 2 -> return [[]] | true |
-| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object) | parameter 2 -> this parameter [[]] | true |
-| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object) | parameter 3 -> return [[]] | true |
-| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object) | parameter 3 -> this parameter [[]] | true |
-| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object, object) | parameter 1 -> return [[]] | true |
-| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object, object) | parameter 1 -> this parameter [[]] | true |
-| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object, object) | parameter 2 -> return [[]] | true |
-| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object, object) | parameter 2 -> this parameter [[]] | true |
-| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object, object) | parameter 3 -> return [[]] | true |
-| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object, object) | parameter 3 -> this parameter [[]] | true |
-| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object, object) | parameter 4 -> return [[]] | true |
-| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object, object) | parameter 4 -> this parameter [[]] | true |
-| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, params Object[]) | parameter 1 -> return [[]] | true |
-| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, params Object[]) | parameter 1 -> this parameter [[]] | true |
-| System.Text.StringBuilder.AppendFormat(string, object) | parameter 0 -> return [[]] | true |
-| System.Text.StringBuilder.AppendFormat(string, object) | parameter 0 -> this parameter [[]] | true |
-| System.Text.StringBuilder.AppendFormat(string, object) | parameter 1 -> return [[]] | true |
-| System.Text.StringBuilder.AppendFormat(string, object) | parameter 1 -> this parameter [[]] | true |
-| System.Text.StringBuilder.AppendFormat(string, object, object) | parameter 0 -> return [[]] | true |
-| System.Text.StringBuilder.AppendFormat(string, object, object) | parameter 0 -> this parameter [[]] | true |
-| System.Text.StringBuilder.AppendFormat(string, object, object) | parameter 1 -> return [[]] | true |
-| System.Text.StringBuilder.AppendFormat(string, object, object) | parameter 1 -> this parameter [[]] | true |
-| System.Text.StringBuilder.AppendFormat(string, object, object) | parameter 2 -> return [[]] | true |
-| System.Text.StringBuilder.AppendFormat(string, object, object) | parameter 2 -> this parameter [[]] | true |
-| System.Text.StringBuilder.AppendFormat(string, object, object, object) | parameter 0 -> return [[]] | true |
-| System.Text.StringBuilder.AppendFormat(string, object, object, object) | parameter 0 -> this parameter [[]] | true |
-| System.Text.StringBuilder.AppendFormat(string, object, object, object) | parameter 1 -> return [[]] | true |
-| System.Text.StringBuilder.AppendFormat(string, object, object, object) | parameter 1 -> this parameter [[]] | true |
-| System.Text.StringBuilder.AppendFormat(string, object, object, object) | parameter 2 -> return [[]] | true |
-| System.Text.StringBuilder.AppendFormat(string, object, object, object) | parameter 2 -> this parameter [[]] | true |
-| System.Text.StringBuilder.AppendFormat(string, object, object, object) | parameter 3 -> return [[]] | true |
-| System.Text.StringBuilder.AppendFormat(string, object, object, object) | parameter 3 -> this parameter [[]] | true |
-| System.Text.StringBuilder.AppendFormat(string, params Object[]) | parameter 0 -> return [[]] | true |
-| System.Text.StringBuilder.AppendFormat(string, params Object[]) | parameter 0 -> this parameter [[]] | true |
-| System.Text.StringBuilder.AppendLine(string) | parameter 0 -> return [[]] | true |
-| System.Text.StringBuilder.AppendLine(string) | parameter 0 -> this parameter [[]] | true |
-| System.Text.StringBuilder.StringBuilder(string) | parameter 0 -> return [[]] | true |
-| System.Text.StringBuilder.StringBuilder(string, int) | parameter 0 -> return [[]] | true |
-| System.Text.StringBuilder.StringBuilder(string, int, int, int) | parameter 0 -> return [[]] | true |
-| System.Text.StringBuilder.ToString() | this parameter [[]] -> return | false |
-| System.Text.StringBuilder.ToString(int, int) | this parameter [[]] -> return | false |
-| System.Text.TranscodingStream.BeginRead(Byte[], int, int, AsyncCallback, object) | this parameter -> parameter 0 | false |
-| System.Text.TranscodingStream.BeginWrite(Byte[], int, int, AsyncCallback, object) | parameter 0 -> this parameter | false |
-| System.Text.TranscodingStream.Read(Byte[], int, int) | this parameter -> parameter 0 | false |
-| System.Text.TranscodingStream.ReadAsync(Byte[], int, int, CancellationToken) | this parameter -> parameter 0 | false |
-| System.Text.TranscodingStream.Write(Byte[], int, int) | parameter 0 -> this parameter | false |
-| System.Text.TranscodingStream.WriteAsync(Byte[], int, int, CancellationToken) | parameter 0 -> this parameter | false |
-| System.Threading.Tasks.SingleProducerSingleConsumerQueue<>.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Threading.Tasks.Task.ContinueWith(Action<Task, Object>, object) | parameter 1 -> parameter 1 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task.ContinueWith(Action<Task, Object>, object, CancellationToken) | parameter 1 -> parameter 1 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task.ContinueWith(Action<Task, Object>, object, CancellationToken, TaskContinuationOptions, TaskScheduler) | parameter 1 -> parameter 1 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task.ContinueWith(Action<Task, Object>, object, TaskContinuationOptions) | parameter 1 -> parameter 1 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task.ContinueWith(Action<Task, Object>, object, TaskScheduler) | parameter 1 -> parameter 1 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task.ContinueWith<TResult>(Func<Task, Object, TResult>, object) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.Task.ContinueWith<TResult>(Func<Task, Object, TResult>, object) | parameter 1 -> parameter 1 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task.ContinueWith<TResult>(Func<Task, Object, TResult>, object, CancellationToken) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.Task.ContinueWith<TResult>(Func<Task, Object, TResult>, object, CancellationToken) | parameter 1 -> parameter 1 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task.ContinueWith<TResult>(Func<Task, Object, TResult>, object, CancellationToken, TaskContinuationOptions, TaskScheduler) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.Task.ContinueWith<TResult>(Func<Task, Object, TResult>, object, CancellationToken, TaskContinuationOptions, TaskScheduler) | parameter 1 -> parameter 1 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task.ContinueWith<TResult>(Func<Task, Object, TResult>, object, TaskContinuationOptions) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.Task.ContinueWith<TResult>(Func<Task, Object, TResult>, object, TaskContinuationOptions) | parameter 1 -> parameter 1 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task.ContinueWith<TResult>(Func<Task, Object, TResult>, object, TaskScheduler) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.Task.ContinueWith<TResult>(Func<Task, Object, TResult>, object, TaskScheduler) | parameter 1 -> parameter 1 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task.ContinueWith<TResult>(Func<Task, TResult>) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.Task.ContinueWith<TResult>(Func<Task, TResult>, CancellationToken) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.Task.ContinueWith<TResult>(Func<Task, TResult>, CancellationToken, TaskContinuationOptions, TaskScheduler) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.Task.ContinueWith<TResult>(Func<Task, TResult>, TaskContinuationOptions) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.Task.ContinueWith<TResult>(Func<Task, TResult>, TaskScheduler) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.Task.FromResult<TResult>(TResult) | parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.Task.Run<TResult>(Func<TResult>) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.Task.Run<TResult>(Func<TResult>, CancellationToken) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.Task.Run<TResult>(Func<Task<TResult>>) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.Task.Run<TResult>(Func<Task<TResult>>, CancellationToken) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.Task.Task(Action<Object>, object) | parameter 1 -> parameter 0 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task.Task(Action<Object>, object, CancellationToken) | parameter 1 -> parameter 0 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task.Task(Action<Object>, object, CancellationToken, TaskCreationOptions) | parameter 1 -> parameter 0 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task.Task(Action<Object>, object, TaskCreationOptions) | parameter 1 -> parameter 0 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task.WhenAll<TResult>(IEnumerable<Task<TResult>>) | parameter 0 [[], Result] -> return [Result, []] | true |
-| System.Threading.Tasks.Task.WhenAll<TResult>(params Task<TResult>[]) | parameter 0 [[], Result] -> return [Result, []] | true |
-| System.Threading.Tasks.Task.WhenAny<TResult>(IEnumerable<Task<TResult>>) | parameter 0 [[], Result] -> return [Result, []] | true |
-| System.Threading.Tasks.Task.WhenAny<TResult>(Task<TResult>, Task<TResult>) | parameter 0 [[], Result] -> return [Result, []] | true |
-| System.Threading.Tasks.Task.WhenAny<TResult>(Task<TResult>, Task<TResult>) | parameter 1 [[], Result] -> return [Result, []] | true |
-| System.Threading.Tasks.Task.WhenAny<TResult>(params Task<TResult>[]) | parameter 0 [[], Result] -> return [Result, []] | true |
-| System.Threading.Tasks.Task<>.ConfigureAwait(bool) | this parameter -> return [m_configuredTaskAwaiter, m_task] | true |
-| System.Threading.Tasks.Task<>.ContinueWith(Action<Task<>, Object>, object) | parameter 1 -> parameter 1 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task<>.ContinueWith(Action<Task<>, Object>, object) | this parameter -> parameter 0 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task<>.ContinueWith(Action<Task<>, Object>, object, CancellationToken) | parameter 1 -> parameter 1 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task<>.ContinueWith(Action<Task<>, Object>, object, CancellationToken) | this parameter -> parameter 0 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task<>.ContinueWith(Action<Task<>, Object>, object, CancellationToken, TaskContinuationOptions, TaskScheduler) | parameter 1 -> parameter 1 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task<>.ContinueWith(Action<Task<>, Object>, object, CancellationToken, TaskContinuationOptions, TaskScheduler) | this parameter -> parameter 0 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task<>.ContinueWith(Action<Task<>, Object>, object, TaskContinuationOptions) | parameter 1 -> parameter 1 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task<>.ContinueWith(Action<Task<>, Object>, object, TaskContinuationOptions) | this parameter -> parameter 0 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task<>.ContinueWith(Action<Task<>, Object>, object, TaskScheduler) | parameter 1 -> parameter 1 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task<>.ContinueWith(Action<Task<>, Object>, object, TaskScheduler) | this parameter -> parameter 0 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task<>.ContinueWith(Action<Task<>>) | this parameter -> parameter 0 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task<>.ContinueWith(Action<Task<>>, CancellationToken) | this parameter -> parameter 0 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task<>.ContinueWith(Action<Task<>>, CancellationToken, TaskContinuationOptions, TaskScheduler) | this parameter -> parameter 0 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task<>.ContinueWith(Action<Task<>>, TaskContinuationOptions) | this parameter -> parameter 0 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task<>.ContinueWith(Action<Task<>>, TaskScheduler) | this parameter -> parameter 0 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, Object, TNewResult>, object) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, Object, TNewResult>, object) | parameter 1 -> parameter 1 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, Object, TNewResult>, object) | this parameter -> parameter 0 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, Object, TNewResult>, object, CancellationToken) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, Object, TNewResult>, object, CancellationToken) | parameter 1 -> parameter 1 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, Object, TNewResult>, object, CancellationToken) | this parameter -> parameter 0 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, Object, TNewResult>, object, CancellationToken, TaskContinuationOptions, TaskScheduler) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, Object, TNewResult>, object, CancellationToken, TaskContinuationOptions, TaskScheduler) | parameter 1 -> parameter 1 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, Object, TNewResult>, object, CancellationToken, TaskContinuationOptions, TaskScheduler) | this parameter -> parameter 0 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, Object, TNewResult>, object, TaskContinuationOptions) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, Object, TNewResult>, object, TaskContinuationOptions) | parameter 1 -> parameter 1 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, Object, TNewResult>, object, TaskContinuationOptions) | this parameter -> parameter 0 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, Object, TNewResult>, object, TaskScheduler) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, Object, TNewResult>, object, TaskScheduler) | parameter 1 -> parameter 1 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, Object, TNewResult>, object, TaskScheduler) | this parameter -> parameter 0 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, TNewResult>) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, TNewResult>) | this parameter -> parameter 0 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, TNewResult>, CancellationToken) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, TNewResult>, CancellationToken) | this parameter -> parameter 0 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, TNewResult>, CancellationToken, TaskContinuationOptions, TaskScheduler) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, TNewResult>, CancellationToken, TaskContinuationOptions, TaskScheduler) | this parameter -> parameter 0 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, TNewResult>, TaskContinuationOptions) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, TNewResult>, TaskContinuationOptions) | this parameter -> parameter 0 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, TNewResult>, TaskScheduler) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, TNewResult>, TaskScheduler) | this parameter -> parameter 0 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task<>.GetAwaiter() | this parameter -> return [m_task] | true |
-| System.Threading.Tasks.Task<>.Task(Func<Object, TResult>, object) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.Task<>.Task(Func<Object, TResult>, object) | parameter 1 -> parameter 0 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task<>.Task(Func<Object, TResult>, object, CancellationToken) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.Task<>.Task(Func<Object, TResult>, object, CancellationToken) | parameter 1 -> parameter 0 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task<>.Task(Func<Object, TResult>, object, CancellationToken, TaskCreationOptions) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.Task<>.Task(Func<Object, TResult>, object, CancellationToken, TaskCreationOptions) | parameter 1 -> parameter 0 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task<>.Task(Func<Object, TResult>, object, TaskCreationOptions) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.Task<>.Task(Func<Object, TResult>, object, TaskCreationOptions) | parameter 1 -> parameter 0 of delegate parameter 0 | true |
-| System.Threading.Tasks.Task<>.Task(Func<TResult>) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.Task<>.Task(Func<TResult>, CancellationToken) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.Task<>.Task(Func<TResult>, CancellationToken, TaskCreationOptions) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.Task<>.Task(Func<TResult>, TaskCreationOptions) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.Task<>.get_Result() | this parameter -> return | false |
-| System.Threading.Tasks.TaskFactory.ContinueWhenAll<TAntecedentResult, TResult>(Task<TAntecedentResult>[], Func<Task, TResult>) | deleget output from parameter 1 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory.ContinueWhenAll<TAntecedentResult, TResult>(Task<TAntecedentResult>[], Func<Task, TResult>) | parameter 0 -> parameter 0 of delegate parameter 1 | true |
-| System.Threading.Tasks.TaskFactory.ContinueWhenAll<TAntecedentResult, TResult>(Task<TAntecedentResult>[], Func<Task, TResult>, CancellationToken) | deleget output from parameter 1 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory.ContinueWhenAll<TAntecedentResult, TResult>(Task<TAntecedentResult>[], Func<Task, TResult>, CancellationToken) | parameter 0 -> parameter 0 of delegate parameter 1 | true |
-| System.Threading.Tasks.TaskFactory.ContinueWhenAll<TAntecedentResult, TResult>(Task<TAntecedentResult>[], Func<Task, TResult>, CancellationToken, TaskContinuationOptions, TaskScheduler) | deleget output from parameter 1 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory.ContinueWhenAll<TAntecedentResult, TResult>(Task<TAntecedentResult>[], Func<Task, TResult>, CancellationToken, TaskContinuationOptions, TaskScheduler) | parameter 0 -> parameter 0 of delegate parameter 1 | true |
-| System.Threading.Tasks.TaskFactory.ContinueWhenAll<TAntecedentResult, TResult>(Task<TAntecedentResult>[], Func<Task, TResult>, TaskContinuationOptions) | deleget output from parameter 1 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory.ContinueWhenAll<TAntecedentResult, TResult>(Task<TAntecedentResult>[], Func<Task, TResult>, TaskContinuationOptions) | parameter 0 -> parameter 0 of delegate parameter 1 | true |
-| System.Threading.Tasks.TaskFactory.ContinueWhenAll<TAntecedentResult>(Task<TAntecedentResult>[], Action<Task>) | parameter 0 -> parameter 0 of delegate parameter 1 | true |
-| System.Threading.Tasks.TaskFactory.ContinueWhenAll<TAntecedentResult>(Task<TAntecedentResult>[], Action<Task>, CancellationToken) | parameter 0 -> parameter 0 of delegate parameter 1 | true |
-| System.Threading.Tasks.TaskFactory.ContinueWhenAll<TAntecedentResult>(Task<TAntecedentResult>[], Action<Task>, CancellationToken, TaskContinuationOptions, TaskScheduler) | parameter 0 -> parameter 0 of delegate parameter 1 | true |
-| System.Threading.Tasks.TaskFactory.ContinueWhenAll<TAntecedentResult>(Task<TAntecedentResult>[], Action<Task>, TaskContinuationOptions) | parameter 0 -> parameter 0 of delegate parameter 1 | true |
-| System.Threading.Tasks.TaskFactory.ContinueWhenAll<TResult>(Task[], Func<Task[], TResult>) | deleget output from parameter 1 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory.ContinueWhenAll<TResult>(Task[], Func<Task[], TResult>, CancellationToken) | deleget output from parameter 1 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory.ContinueWhenAll<TResult>(Task[], Func<Task[], TResult>, CancellationToken, TaskContinuationOptions, TaskScheduler) | deleget output from parameter 1 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory.ContinueWhenAll<TResult>(Task[], Func<Task[], TResult>, TaskContinuationOptions) | deleget output from parameter 1 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory.ContinueWhenAny<TAntecedentResult, TResult>(Task<TAntecedentResult>[], Func<Task<TAntecedentResult>, TResult>) | deleget output from parameter 1 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory.ContinueWhenAny<TAntecedentResult, TResult>(Task<TAntecedentResult>[], Func<Task<TAntecedentResult>, TResult>) | parameter 0 -> parameter 0 of delegate parameter 1 | true |
-| System.Threading.Tasks.TaskFactory.ContinueWhenAny<TAntecedentResult, TResult>(Task<TAntecedentResult>[], Func<Task<TAntecedentResult>, TResult>, CancellationToken) | deleget output from parameter 1 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory.ContinueWhenAny<TAntecedentResult, TResult>(Task<TAntecedentResult>[], Func<Task<TAntecedentResult>, TResult>, CancellationToken) | parameter 0 -> parameter 0 of delegate parameter 1 | true |
-| System.Threading.Tasks.TaskFactory.ContinueWhenAny<TAntecedentResult, TResult>(Task<TAntecedentResult>[], Func<Task<TAntecedentResult>, TResult>, CancellationToken, TaskContinuationOptions, TaskScheduler) | deleget output from parameter 1 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory.ContinueWhenAny<TAntecedentResult, TResult>(Task<TAntecedentResult>[], Func<Task<TAntecedentResult>, TResult>, CancellationToken, TaskContinuationOptions, TaskScheduler) | parameter 0 -> parameter 0 of delegate parameter 1 | true |
-| System.Threading.Tasks.TaskFactory.ContinueWhenAny<TAntecedentResult, TResult>(Task<TAntecedentResult>[], Func<Task<TAntecedentResult>, TResult>, TaskContinuationOptions) | deleget output from parameter 1 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory.ContinueWhenAny<TAntecedentResult, TResult>(Task<TAntecedentResult>[], Func<Task<TAntecedentResult>, TResult>, TaskContinuationOptions) | parameter 0 -> parameter 0 of delegate parameter 1 | true |
-| System.Threading.Tasks.TaskFactory.ContinueWhenAny<TAntecedentResult>(Task<TAntecedentResult>[], Action<Task<TAntecedentResult>>) | parameter 0 -> parameter 0 of delegate parameter 1 | true |
-| System.Threading.Tasks.TaskFactory.ContinueWhenAny<TAntecedentResult>(Task<TAntecedentResult>[], Action<Task<TAntecedentResult>>, CancellationToken) | parameter 0 -> parameter 0 of delegate parameter 1 | true |
-| System.Threading.Tasks.TaskFactory.ContinueWhenAny<TAntecedentResult>(Task<TAntecedentResult>[], Action<Task<TAntecedentResult>>, CancellationToken, TaskContinuationOptions, TaskScheduler) | parameter 0 -> parameter 0 of delegate parameter 1 | true |
-| System.Threading.Tasks.TaskFactory.ContinueWhenAny<TAntecedentResult>(Task<TAntecedentResult>[], Action<Task<TAntecedentResult>>, TaskContinuationOptions) | parameter 0 -> parameter 0 of delegate parameter 1 | true |
-| System.Threading.Tasks.TaskFactory.ContinueWhenAny<TResult>(Task[], Func<Task, TResult>) | deleget output from parameter 1 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory.ContinueWhenAny<TResult>(Task[], Func<Task, TResult>, CancellationToken) | deleget output from parameter 1 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory.ContinueWhenAny<TResult>(Task[], Func<Task, TResult>, CancellationToken, TaskContinuationOptions, TaskScheduler) | deleget output from parameter 1 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory.ContinueWhenAny<TResult>(Task[], Func<Task, TResult>, TaskContinuationOptions) | deleget output from parameter 1 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory.StartNew(Action<Object>, object) | parameter 1 -> parameter 0 of delegate parameter 0 | true |
-| System.Threading.Tasks.TaskFactory.StartNew(Action<Object>, object, CancellationToken) | parameter 1 -> parameter 0 of delegate parameter 0 | true |
-| System.Threading.Tasks.TaskFactory.StartNew(Action<Object>, object, CancellationToken, TaskCreationOptions, TaskScheduler) | parameter 1 -> parameter 0 of delegate parameter 0 | true |
-| System.Threading.Tasks.TaskFactory.StartNew(Action<Object>, object, TaskCreationOptions) | parameter 1 -> parameter 0 of delegate parameter 0 | true |
-| System.Threading.Tasks.TaskFactory.StartNew<TResult>(Func<Object, TResult>, object) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory.StartNew<TResult>(Func<Object, TResult>, object) | parameter 1 -> parameter 0 of delegate parameter 0 | true |
-| System.Threading.Tasks.TaskFactory.StartNew<TResult>(Func<Object, TResult>, object, CancellationToken) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory.StartNew<TResult>(Func<Object, TResult>, object, CancellationToken) | parameter 1 -> parameter 0 of delegate parameter 0 | true |
-| System.Threading.Tasks.TaskFactory.StartNew<TResult>(Func<Object, TResult>, object, CancellationToken, TaskCreationOptions, TaskScheduler) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory.StartNew<TResult>(Func<Object, TResult>, object, CancellationToken, TaskCreationOptions, TaskScheduler) | parameter 1 -> parameter 0 of delegate parameter 0 | true |
-| System.Threading.Tasks.TaskFactory.StartNew<TResult>(Func<Object, TResult>, object, TaskCreationOptions) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory.StartNew<TResult>(Func<Object, TResult>, object, TaskCreationOptions) | parameter 1 -> parameter 0 of delegate parameter 0 | true |
-| System.Threading.Tasks.TaskFactory.StartNew<TResult>(Func<TResult>) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory.StartNew<TResult>(Func<TResult>, CancellationToken) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory.StartNew<TResult>(Func<TResult>, CancellationToken, TaskCreationOptions, TaskScheduler) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory.StartNew<TResult>(Func<TResult>, TaskCreationOptions) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory<>.ContinueWhenAll(Task[], Func<Task[], TResult>) | deleget output from parameter 1 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory<>.ContinueWhenAll(Task[], Func<Task[], TResult>, CancellationToken) | deleget output from parameter 1 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory<>.ContinueWhenAll(Task[], Func<Task[], TResult>, CancellationToken, TaskContinuationOptions, TaskScheduler) | deleget output from parameter 1 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory<>.ContinueWhenAll(Task[], Func<Task[], TResult>, TaskContinuationOptions) | deleget output from parameter 1 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory<>.ContinueWhenAll<TAntecedentResult>(Task<TAntecedentResult>[], Func<Task, TResult>) | deleget output from parameter 1 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory<>.ContinueWhenAll<TAntecedentResult>(Task<TAntecedentResult>[], Func<Task, TResult>) | parameter 0 -> parameter 0 of delegate parameter 1 | true |
-| System.Threading.Tasks.TaskFactory<>.ContinueWhenAll<TAntecedentResult>(Task<TAntecedentResult>[], Func<Task, TResult>, CancellationToken) | deleget output from parameter 1 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory<>.ContinueWhenAll<TAntecedentResult>(Task<TAntecedentResult>[], Func<Task, TResult>, CancellationToken) | parameter 0 -> parameter 0 of delegate parameter 1 | true |
-| System.Threading.Tasks.TaskFactory<>.ContinueWhenAll<TAntecedentResult>(Task<TAntecedentResult>[], Func<Task, TResult>, CancellationToken, TaskContinuationOptions, TaskScheduler) | deleget output from parameter 1 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory<>.ContinueWhenAll<TAntecedentResult>(Task<TAntecedentResult>[], Func<Task, TResult>, CancellationToken, TaskContinuationOptions, TaskScheduler) | parameter 0 -> parameter 0 of delegate parameter 1 | true |
-| System.Threading.Tasks.TaskFactory<>.ContinueWhenAll<TAntecedentResult>(Task<TAntecedentResult>[], Func<Task, TResult>, TaskContinuationOptions) | deleget output from parameter 1 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory<>.ContinueWhenAll<TAntecedentResult>(Task<TAntecedentResult>[], Func<Task, TResult>, TaskContinuationOptions) | parameter 0 -> parameter 0 of delegate parameter 1 | true |
-| System.Threading.Tasks.TaskFactory<>.ContinueWhenAny(Task[], Func<Task, TResult>) | deleget output from parameter 1 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory<>.ContinueWhenAny(Task[], Func<Task, TResult>, CancellationToken) | deleget output from parameter 1 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory<>.ContinueWhenAny(Task[], Func<Task, TResult>, CancellationToken, TaskContinuationOptions, TaskScheduler) | deleget output from parameter 1 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory<>.ContinueWhenAny(Task[], Func<Task, TResult>, TaskContinuationOptions) | deleget output from parameter 1 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory<>.ContinueWhenAny<TAntecedentResult>(Task<TAntecedentResult>[], Func<Task<TAntecedentResult>, TResult>) | deleget output from parameter 1 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory<>.ContinueWhenAny<TAntecedentResult>(Task<TAntecedentResult>[], Func<Task<TAntecedentResult>, TResult>) | parameter 0 -> parameter 0 of delegate parameter 1 | true |
-| System.Threading.Tasks.TaskFactory<>.ContinueWhenAny<TAntecedentResult>(Task<TAntecedentResult>[], Func<Task<TAntecedentResult>, TResult>, CancellationToken) | deleget output from parameter 1 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory<>.ContinueWhenAny<TAntecedentResult>(Task<TAntecedentResult>[], Func<Task<TAntecedentResult>, TResult>, CancellationToken) | parameter 0 -> parameter 0 of delegate parameter 1 | true |
-| System.Threading.Tasks.TaskFactory<>.ContinueWhenAny<TAntecedentResult>(Task<TAntecedentResult>[], Func<Task<TAntecedentResult>, TResult>, CancellationToken, TaskContinuationOptions, TaskScheduler) | deleget output from parameter 1 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory<>.ContinueWhenAny<TAntecedentResult>(Task<TAntecedentResult>[], Func<Task<TAntecedentResult>, TResult>, CancellationToken, TaskContinuationOptions, TaskScheduler) | parameter 0 -> parameter 0 of delegate parameter 1 | true |
-| System.Threading.Tasks.TaskFactory<>.ContinueWhenAny<TAntecedentResult>(Task<TAntecedentResult>[], Func<Task<TAntecedentResult>, TResult>, TaskContinuationOptions) | deleget output from parameter 1 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory<>.ContinueWhenAny<TAntecedentResult>(Task<TAntecedentResult>[], Func<Task<TAntecedentResult>, TResult>, TaskContinuationOptions) | parameter 0 -> parameter 0 of delegate parameter 1 | true |
-| System.Threading.Tasks.TaskFactory<>.StartNew(Func<Object, TResult>, object) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory<>.StartNew(Func<Object, TResult>, object) | parameter 1 -> parameter 0 of delegate parameter 0 | true |
-| System.Threading.Tasks.TaskFactory<>.StartNew(Func<Object, TResult>, object, CancellationToken) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory<>.StartNew(Func<Object, TResult>, object, CancellationToken) | parameter 1 -> parameter 0 of delegate parameter 0 | true |
-| System.Threading.Tasks.TaskFactory<>.StartNew(Func<Object, TResult>, object, CancellationToken, TaskCreationOptions, TaskScheduler) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory<>.StartNew(Func<Object, TResult>, object, CancellationToken, TaskCreationOptions, TaskScheduler) | parameter 1 -> parameter 0 of delegate parameter 0 | true |
-| System.Threading.Tasks.TaskFactory<>.StartNew(Func<Object, TResult>, object, TaskCreationOptions) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory<>.StartNew(Func<Object, TResult>, object, TaskCreationOptions) | parameter 1 -> parameter 0 of delegate parameter 0 | true |
-| System.Threading.Tasks.TaskFactory<>.StartNew(Func<TResult>) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory<>.StartNew(Func<TResult>, CancellationToken) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory<>.StartNew(Func<TResult>, CancellationToken, TaskCreationOptions, TaskScheduler) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.TaskFactory<>.StartNew(Func<TResult>, TaskCreationOptions) | deleget output from parameter 0 -> return [Result] | true |
-| System.Threading.Tasks.ThreadPoolTaskScheduler.<FilterTasksFromWorkItems>d__6.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Threading.ThreadPool.<GetLocallyQueuedWorkItems>d__52.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Threading.ThreadPool.<GetQueuedWorkItems>d__51.GetEnumerator() | this parameter [[]] -> return [Current] | true |
-| System.Tuple.Create<T1, T2, T3, T4, T5, T6, T7, T8>(T1, T2, T3, T4, T5, T6, T7, T8) | parameter 0 -> return [Item1] | true |
-| System.Tuple.Create<T1, T2, T3, T4, T5, T6, T7, T8>(T1, T2, T3, T4, T5, T6, T7, T8) | parameter 1 -> return [Item2] | true |
-| System.Tuple.Create<T1, T2, T3, T4, T5, T6, T7, T8>(T1, T2, T3, T4, T5, T6, T7, T8) | parameter 2 -> return [Item3] | true |
-| System.Tuple.Create<T1, T2, T3, T4, T5, T6, T7, T8>(T1, T2, T3, T4, T5, T6, T7, T8) | parameter 3 -> return [Item4] | true |
-| System.Tuple.Create<T1, T2, T3, T4, T5, T6, T7, T8>(T1, T2, T3, T4, T5, T6, T7, T8) | parameter 4 -> return [Item5] | true |
-| System.Tuple.Create<T1, T2, T3, T4, T5, T6, T7, T8>(T1, T2, T3, T4, T5, T6, T7, T8) | parameter 5 -> return [Item6] | true |
-| System.Tuple.Create<T1, T2, T3, T4, T5, T6, T7, T8>(T1, T2, T3, T4, T5, T6, T7, T8) | parameter 6 -> return [Item7] | true |
-| System.Tuple.Create<T1, T2, T3, T4, T5, T6, T7>(T1, T2, T3, T4, T5, T6, T7) | parameter 0 -> return [Item1] | true |
-| System.Tuple.Create<T1, T2, T3, T4, T5, T6, T7>(T1, T2, T3, T4, T5, T6, T7) | parameter 1 -> return [Item2] | true |
-| System.Tuple.Create<T1, T2, T3, T4, T5, T6, T7>(T1, T2, T3, T4, T5, T6, T7) | parameter 2 -> return [Item3] | true |
-| System.Tuple.Create<T1, T2, T3, T4, T5, T6, T7>(T1, T2, T3, T4, T5, T6, T7) | parameter 3 -> return [Item4] | true |
-| System.Tuple.Create<T1, T2, T3, T4, T5, T6, T7>(T1, T2, T3, T4, T5, T6, T7) | parameter 4 -> return [Item5] | true |
-| System.Tuple.Create<T1, T2, T3, T4, T5, T6, T7>(T1, T2, T3, T4, T5, T6, T7) | parameter 5 -> return [Item6] | true |
-| System.Tuple.Create<T1, T2, T3, T4, T5, T6, T7>(T1, T2, T3, T4, T5, T6, T7) | parameter 6 -> return [Item7] | true |
-| System.Tuple.Create<T1, T2, T3, T4, T5, T6>(T1, T2, T3, T4, T5, T6) | parameter 0 -> return [Item1] | true |
-| System.Tuple.Create<T1, T2, T3, T4, T5, T6>(T1, T2, T3, T4, T5, T6) | parameter 1 -> return [Item2] | true |
-| System.Tuple.Create<T1, T2, T3, T4, T5, T6>(T1, T2, T3, T4, T5, T6) | parameter 2 -> return [Item3] | true |
-| System.Tuple.Create<T1, T2, T3, T4, T5, T6>(T1, T2, T3, T4, T5, T6) | parameter 3 -> return [Item4] | true |
-| System.Tuple.Create<T1, T2, T3, T4, T5, T6>(T1, T2, T3, T4, T5, T6) | parameter 4 -> return [Item5] | true |
-| System.Tuple.Create<T1, T2, T3, T4, T5, T6>(T1, T2, T3, T4, T5, T6) | parameter 5 -> return [Item6] | true |
-| System.Tuple.Create<T1, T2, T3, T4, T5>(T1, T2, T3, T4, T5) | parameter 0 -> return [Item1] | true |
-| System.Tuple.Create<T1, T2, T3, T4, T5>(T1, T2, T3, T4, T5) | parameter 1 -> return [Item2] | true |
-| System.Tuple.Create<T1, T2, T3, T4, T5>(T1, T2, T3, T4, T5) | parameter 2 -> return [Item3] | true |
-| System.Tuple.Create<T1, T2, T3, T4, T5>(T1, T2, T3, T4, T5) | parameter 3 -> return [Item4] | true |
-| System.Tuple.Create<T1, T2, T3, T4, T5>(T1, T2, T3, T4, T5) | parameter 4 -> return [Item5] | true |
-| System.Tuple.Create<T1, T2, T3, T4>(T1, T2, T3, T4) | parameter 0 -> return [Item1] | true |
-| System.Tuple.Create<T1, T2, T3, T4>(T1, T2, T3, T4) | parameter 1 -> return [Item2] | true |
-| System.Tuple.Create<T1, T2, T3, T4>(T1, T2, T3, T4) | parameter 2 -> return [Item3] | true |
-| System.Tuple.Create<T1, T2, T3, T4>(T1, T2, T3, T4) | parameter 3 -> return [Item4] | true |
-| System.Tuple.Create<T1, T2, T3>(T1, T2, T3) | parameter 0 -> return [Item1] | true |
-| System.Tuple.Create<T1, T2, T3>(T1, T2, T3) | parameter 1 -> return [Item2] | true |
-| System.Tuple.Create<T1, T2, T3>(T1, T2, T3) | parameter 2 -> return [Item3] | true |
-| System.Tuple.Create<T1, T2>(T1, T2) | parameter 0 -> return [Item1] | true |
-| System.Tuple.Create<T1, T2>(T1, T2) | parameter 1 -> return [Item2] | true |
-| System.Tuple.Create<T1>(T1) | parameter 0 -> return [Item1] | true |
-| System.Tuple<,,,,,,,>.Tuple(T1, T2, T3, T4, T5, T6, T7, TRest) | parameter 0 -> return [Item1] | true |
-| System.Tuple<,,,,,,,>.Tuple(T1, T2, T3, T4, T5, T6, T7, TRest) | parameter 1 -> return [Item2] | true |
-| System.Tuple<,,,,,,,>.Tuple(T1, T2, T3, T4, T5, T6, T7, TRest) | parameter 2 -> return [Item3] | true |
-| System.Tuple<,,,,,,,>.Tuple(T1, T2, T3, T4, T5, T6, T7, TRest) | parameter 3 -> return [Item4] | true |
-| System.Tuple<,,,,,,,>.Tuple(T1, T2, T3, T4, T5, T6, T7, TRest) | parameter 4 -> return [Item5] | true |
-| System.Tuple<,,,,,,,>.Tuple(T1, T2, T3, T4, T5, T6, T7, TRest) | parameter 5 -> return [Item6] | true |
-| System.Tuple<,,,,,,,>.Tuple(T1, T2, T3, T4, T5, T6, T7, TRest) | parameter 6 -> return [Item7] | true |
-| System.Tuple<,,,,,,,>.get_Item(int) | this parameter [Item1] -> return | true |
-| System.Tuple<,,,,,,,>.get_Item(int) | this parameter [Item2] -> return | true |
-| System.Tuple<,,,,,,,>.get_Item(int) | this parameter [Item3] -> return | true |
-| System.Tuple<,,,,,,,>.get_Item(int) | this parameter [Item4] -> return | true |
-| System.Tuple<,,,,,,,>.get_Item(int) | this parameter [Item5] -> return | true |
-| System.Tuple<,,,,,,,>.get_Item(int) | this parameter [Item6] -> return | true |
-| System.Tuple<,,,,,,,>.get_Item(int) | this parameter [Item7] -> return | true |
-| System.Tuple<,,,,,,>.Tuple(T1, T2, T3, T4, T5, T6, T7) | parameter 0 -> return [Item1] | true |
-| System.Tuple<,,,,,,>.Tuple(T1, T2, T3, T4, T5, T6, T7) | parameter 1 -> return [Item2] | true |
-| System.Tuple<,,,,,,>.Tuple(T1, T2, T3, T4, T5, T6, T7) | parameter 2 -> return [Item3] | true |
-| System.Tuple<,,,,,,>.Tuple(T1, T2, T3, T4, T5, T6, T7) | parameter 3 -> return [Item4] | true |
-| System.Tuple<,,,,,,>.Tuple(T1, T2, T3, T4, T5, T6, T7) | parameter 4 -> return [Item5] | true |
-| System.Tuple<,,,,,,>.Tuple(T1, T2, T3, T4, T5, T6, T7) | parameter 5 -> return [Item6] | true |
-| System.Tuple<,,,,,,>.Tuple(T1, T2, T3, T4, T5, T6, T7) | parameter 6 -> return [Item7] | true |
-| System.Tuple<,,,,,,>.get_Item(int) | this parameter [Item1] -> return | true |
-| System.Tuple<,,,,,,>.get_Item(int) | this parameter [Item2] -> return | true |
-| System.Tuple<,,,,,,>.get_Item(int) | this parameter [Item3] -> return | true |
-| System.Tuple<,,,,,,>.get_Item(int) | this parameter [Item4] -> return | true |
-| System.Tuple<,,,,,,>.get_Item(int) | this parameter [Item5] -> return | true |
-| System.Tuple<,,,,,,>.get_Item(int) | this parameter [Item6] -> return | true |
-| System.Tuple<,,,,,,>.get_Item(int) | this parameter [Item7] -> return | true |
-| System.Tuple<,,,,,>.Tuple(T1, T2, T3, T4, T5, T6) | parameter 0 -> return [Item1] | true |
-| System.Tuple<,,,,,>.Tuple(T1, T2, T3, T4, T5, T6) | parameter 1 -> return [Item2] | true |
-| System.Tuple<,,,,,>.Tuple(T1, T2, T3, T4, T5, T6) | parameter 2 -> return [Item3] | true |
-| System.Tuple<,,,,,>.Tuple(T1, T2, T3, T4, T5, T6) | parameter 3 -> return [Item4] | true |
-| System.Tuple<,,,,,>.Tuple(T1, T2, T3, T4, T5, T6) | parameter 4 -> return [Item5] | true |
-| System.Tuple<,,,,,>.Tuple(T1, T2, T3, T4, T5, T6) | parameter 5 -> return [Item6] | true |
-| System.Tuple<,,,,,>.get_Item(int) | this parameter [Item1] -> return | true |
-| System.Tuple<,,,,,>.get_Item(int) | this parameter [Item2] -> return | true |
-| System.Tuple<,,,,,>.get_Item(int) | this parameter [Item3] -> return | true |
-| System.Tuple<,,,,,>.get_Item(int) | this parameter [Item4] -> return | true |
-| System.Tuple<,,,,,>.get_Item(int) | this parameter [Item5] -> return | true |
-| System.Tuple<,,,,,>.get_Item(int) | this parameter [Item6] -> return | true |
-| System.Tuple<,,,,>.Tuple(T1, T2, T3, T4, T5) | parameter 0 -> return [Item1] | true |
-| System.Tuple<,,,,>.Tuple(T1, T2, T3, T4, T5) | parameter 1 -> return [Item2] | true |
-| System.Tuple<,,,,>.Tuple(T1, T2, T3, T4, T5) | parameter 2 -> return [Item3] | true |
-| System.Tuple<,,,,>.Tuple(T1, T2, T3, T4, T5) | parameter 3 -> return [Item4] | true |
-| System.Tuple<,,,,>.Tuple(T1, T2, T3, T4, T5) | parameter 4 -> return [Item5] | true |
-| System.Tuple<,,,,>.get_Item(int) | this parameter [Item1] -> return | true |
-| System.Tuple<,,,,>.get_Item(int) | this parameter [Item2] -> return | true |
-| System.Tuple<,,,,>.get_Item(int) | this parameter [Item3] -> return | true |
-| System.Tuple<,,,,>.get_Item(int) | this parameter [Item4] -> return | true |
-| System.Tuple<,,,,>.get_Item(int) | this parameter [Item5] -> return | true |
-| System.Tuple<,,,>.Tuple(T1, T2, T3, T4) | parameter 0 -> return [Item1] | true |
-| System.Tuple<,,,>.Tuple(T1, T2, T3, T4) | parameter 1 -> return [Item2] | true |
-| System.Tuple<,,,>.Tuple(T1, T2, T3, T4) | parameter 2 -> return [Item3] | true |
-| System.Tuple<,,,>.Tuple(T1, T2, T3, T4) | parameter 3 -> return [Item4] | true |
-| System.Tuple<,,,>.get_Item(int) | this parameter [Item1] -> return | true |
-| System.Tuple<,,,>.get_Item(int) | this parameter [Item2] -> return | true |
-| System.Tuple<,,,>.get_Item(int) | this parameter [Item3] -> return | true |
-| System.Tuple<,,,>.get_Item(int) | this parameter [Item4] -> return | true |
-| System.Tuple<,,>.Tuple(T1, T2, T3) | parameter 0 -> return [Item1] | true |
-| System.Tuple<,,>.Tuple(T1, T2, T3) | parameter 1 -> return [Item2] | true |
-| System.Tuple<,,>.Tuple(T1, T2, T3) | parameter 2 -> return [Item3] | true |
-| System.Tuple<,,>.get_Item(int) | this parameter [Item1] -> return | true |
-| System.Tuple<,,>.get_Item(int) | this parameter [Item2] -> return | true |
-| System.Tuple<,,>.get_Item(int) | this parameter [Item3] -> return | true |
-| System.Tuple<,>.Tuple(T1, T2) | parameter 0 -> return [Item1] | true |
-| System.Tuple<,>.Tuple(T1, T2) | parameter 1 -> return [Item2] | true |
-| System.Tuple<,>.get_Item(int) | this parameter [Item1] -> return | true |
-| System.Tuple<,>.get_Item(int) | this parameter [Item2] -> return | true |
-| System.Tuple<>.Tuple(T1) | parameter 0 -> return [Item1] | true |
-| System.Tuple<>.get_Item(int) | this parameter [Item1] -> return | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18, T19, T20, T21>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18,T19,T20,T21>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18, out T19, out T20, out T21) | parameter 0 [Item1] -> parameter 1 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18, T19, T20, T21>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18,T19,T20,T21>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18, out T19, out T20, out T21) | parameter 0 [Item2] -> parameter 2 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18, T19, T20, T21>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18,T19,T20,T21>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18, out T19, out T20, out T21) | parameter 0 [Item3] -> parameter 3 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18, T19, T20, T21>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18,T19,T20,T21>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18, out T19, out T20, out T21) | parameter 0 [Item4] -> parameter 4 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18, T19, T20, T21>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18,T19,T20,T21>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18, out T19, out T20, out T21) | parameter 0 [Item5] -> parameter 5 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18, T19, T20, T21>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18,T19,T20,T21>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18, out T19, out T20, out T21) | parameter 0 [Item6] -> parameter 6 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18, T19, T20, T21>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18,T19,T20,T21>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18, out T19, out T20, out T21) | parameter 0 [Item7] -> parameter 7 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18, T19, T20>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18,T19,T20>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18, out T19, out T20) | parameter 0 [Item1] -> parameter 1 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18, T19, T20>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18,T19,T20>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18, out T19, out T20) | parameter 0 [Item2] -> parameter 2 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18, T19, T20>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18,T19,T20>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18, out T19, out T20) | parameter 0 [Item3] -> parameter 3 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18, T19, T20>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18,T19,T20>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18, out T19, out T20) | parameter 0 [Item4] -> parameter 4 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18, T19, T20>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18,T19,T20>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18, out T19, out T20) | parameter 0 [Item5] -> parameter 5 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18, T19, T20>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18,T19,T20>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18, out T19, out T20) | parameter 0 [Item6] -> parameter 6 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18, T19, T20>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18,T19,T20>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18, out T19, out T20) | parameter 0 [Item7] -> parameter 7 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18, T19>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18,T19>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18, out T19) | parameter 0 [Item1] -> parameter 1 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18, T19>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18,T19>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18, out T19) | parameter 0 [Item2] -> parameter 2 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18, T19>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18,T19>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18, out T19) | parameter 0 [Item3] -> parameter 3 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18, T19>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18,T19>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18, out T19) | parameter 0 [Item4] -> parameter 4 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18, T19>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18,T19>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18, out T19) | parameter 0 [Item5] -> parameter 5 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18, T19>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18,T19>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18, out T19) | parameter 0 [Item6] -> parameter 6 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18, T19>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18,T19>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18, out T19) | parameter 0 [Item7] -> parameter 7 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18) | parameter 0 [Item1] -> parameter 1 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18) | parameter 0 [Item2] -> parameter 2 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18) | parameter 0 [Item3] -> parameter 3 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18) | parameter 0 [Item4] -> parameter 4 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18) | parameter 0 [Item5] -> parameter 5 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18) | parameter 0 [Item6] -> parameter 6 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18) | parameter 0 [Item7] -> parameter 7 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17) | parameter 0 [Item1] -> parameter 1 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17) | parameter 0 [Item2] -> parameter 2 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17) | parameter 0 [Item3] -> parameter 3 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17) | parameter 0 [Item4] -> parameter 4 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17) | parameter 0 [Item5] -> parameter 5 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17) | parameter 0 [Item6] -> parameter 6 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17) | parameter 0 [Item7] -> parameter 7 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16) | parameter 0 [Item1] -> parameter 1 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16) | parameter 0 [Item2] -> parameter 2 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16) | parameter 0 [Item3] -> parameter 3 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16) | parameter 0 [Item4] -> parameter 4 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16) | parameter 0 [Item5] -> parameter 5 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16) | parameter 0 [Item6] -> parameter 6 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16) | parameter 0 [Item7] -> parameter 7 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15) | parameter 0 [Item1] -> parameter 1 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15) | parameter 0 [Item2] -> parameter 2 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15) | parameter 0 [Item3] -> parameter 3 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15) | parameter 0 [Item4] -> parameter 4 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15) | parameter 0 [Item5] -> parameter 5 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15) | parameter 0 [Item6] -> parameter 6 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15) | parameter 0 [Item7] -> parameter 7 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14) | parameter 0 [Item1] -> parameter 1 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14) | parameter 0 [Item2] -> parameter 2 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14) | parameter 0 [Item3] -> parameter 3 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14) | parameter 0 [Item4] -> parameter 4 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14) | parameter 0 [Item5] -> parameter 5 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14) | parameter 0 [Item6] -> parameter 6 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14) | parameter 0 [Item7] -> parameter 7 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13) | parameter 0 [Item1] -> parameter 1 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13) | parameter 0 [Item2] -> parameter 2 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13) | parameter 0 [Item3] -> parameter 3 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13) | parameter 0 [Item4] -> parameter 4 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13) | parameter 0 [Item5] -> parameter 5 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13) | parameter 0 [Item6] -> parameter 6 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13) | parameter 0 [Item7] -> parameter 7 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12) | parameter 0 [Item1] -> parameter 1 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12) | parameter 0 [Item2] -> parameter 2 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12) | parameter 0 [Item3] -> parameter 3 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12) | parameter 0 [Item4] -> parameter 4 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12) | parameter 0 [Item5] -> parameter 5 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12) | parameter 0 [Item6] -> parameter 6 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12) | parameter 0 [Item7] -> parameter 7 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11) | parameter 0 [Item1] -> parameter 1 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11) | parameter 0 [Item2] -> parameter 2 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11) | parameter 0 [Item3] -> parameter 3 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11) | parameter 0 [Item4] -> parameter 4 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11) | parameter 0 [Item5] -> parameter 5 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11) | parameter 0 [Item6] -> parameter 6 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11) | parameter 0 [Item7] -> parameter 7 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10) | parameter 0 [Item1] -> parameter 1 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10) | parameter 0 [Item2] -> parameter 2 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10) | parameter 0 [Item3] -> parameter 3 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10) | parameter 0 [Item4] -> parameter 4 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10) | parameter 0 [Item5] -> parameter 5 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10) | parameter 0 [Item6] -> parameter 6 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10) | parameter 0 [Item7] -> parameter 7 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9) | parameter 0 [Item1] -> parameter 1 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9) | parameter 0 [Item2] -> parameter 2 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9) | parameter 0 [Item3] -> parameter 3 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9) | parameter 0 [Item4] -> parameter 4 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9) | parameter 0 [Item5] -> parameter 5 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9) | parameter 0 [Item6] -> parameter 6 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9) | parameter 0 [Item7] -> parameter 7 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8) | parameter 0 [Item1] -> parameter 1 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8) | parameter 0 [Item2] -> parameter 2 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8) | parameter 0 [Item3] -> parameter 3 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8) | parameter 0 [Item4] -> parameter 4 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8) | parameter 0 [Item5] -> parameter 5 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8) | parameter 0 [Item6] -> parameter 6 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8) | parameter 0 [Item7] -> parameter 7 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7>(Tuple<T1, T2, T3, T4, T5, T6, T7>, out T1, out T2, out T3, out T4, out T5, out T6, out T7) | parameter 0 [Item1] -> parameter 1 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7>(Tuple<T1, T2, T3, T4, T5, T6, T7>, out T1, out T2, out T3, out T4, out T5, out T6, out T7) | parameter 0 [Item2] -> parameter 2 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7>(Tuple<T1, T2, T3, T4, T5, T6, T7>, out T1, out T2, out T3, out T4, out T5, out T6, out T7) | parameter 0 [Item3] -> parameter 3 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7>(Tuple<T1, T2, T3, T4, T5, T6, T7>, out T1, out T2, out T3, out T4, out T5, out T6, out T7) | parameter 0 [Item4] -> parameter 4 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7>(Tuple<T1, T2, T3, T4, T5, T6, T7>, out T1, out T2, out T3, out T4, out T5, out T6, out T7) | parameter 0 [Item5] -> parameter 5 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7>(Tuple<T1, T2, T3, T4, T5, T6, T7>, out T1, out T2, out T3, out T4, out T5, out T6, out T7) | parameter 0 [Item6] -> parameter 6 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7>(Tuple<T1, T2, T3, T4, T5, T6, T7>, out T1, out T2, out T3, out T4, out T5, out T6, out T7) | parameter 0 [Item7] -> parameter 7 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6>(Tuple<T1, T2, T3, T4, T5, T6>, out T1, out T2, out T3, out T4, out T5, out T6) | parameter 0 [Item1] -> parameter 1 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6>(Tuple<T1, T2, T3, T4, T5, T6>, out T1, out T2, out T3, out T4, out T5, out T6) | parameter 0 [Item2] -> parameter 2 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6>(Tuple<T1, T2, T3, T4, T5, T6>, out T1, out T2, out T3, out T4, out T5, out T6) | parameter 0 [Item3] -> parameter 3 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6>(Tuple<T1, T2, T3, T4, T5, T6>, out T1, out T2, out T3, out T4, out T5, out T6) | parameter 0 [Item4] -> parameter 4 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6>(Tuple<T1, T2, T3, T4, T5, T6>, out T1, out T2, out T3, out T4, out T5, out T6) | parameter 0 [Item5] -> parameter 5 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6>(Tuple<T1, T2, T3, T4, T5, T6>, out T1, out T2, out T3, out T4, out T5, out T6) | parameter 0 [Item6] -> parameter 6 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5>(Tuple<T1, T2, T3, T4, T5>, out T1, out T2, out T3, out T4, out T5) | parameter 0 [Item1] -> parameter 1 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5>(Tuple<T1, T2, T3, T4, T5>, out T1, out T2, out T3, out T4, out T5) | parameter 0 [Item2] -> parameter 2 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5>(Tuple<T1, T2, T3, T4, T5>, out T1, out T2, out T3, out T4, out T5) | parameter 0 [Item3] -> parameter 3 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5>(Tuple<T1, T2, T3, T4, T5>, out T1, out T2, out T3, out T4, out T5) | parameter 0 [Item4] -> parameter 4 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5>(Tuple<T1, T2, T3, T4, T5>, out T1, out T2, out T3, out T4, out T5) | parameter 0 [Item5] -> parameter 5 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4>(Tuple<T1, T2, T3, T4>, out T1, out T2, out T3, out T4) | parameter 0 [Item1] -> parameter 1 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4>(Tuple<T1, T2, T3, T4>, out T1, out T2, out T3, out T4) | parameter 0 [Item2] -> parameter 2 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4>(Tuple<T1, T2, T3, T4>, out T1, out T2, out T3, out T4) | parameter 0 [Item3] -> parameter 3 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3, T4>(Tuple<T1, T2, T3, T4>, out T1, out T2, out T3, out T4) | parameter 0 [Item4] -> parameter 4 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3>(Tuple<T1, T2, T3>, out T1, out T2, out T3) | parameter 0 [Item1] -> parameter 1 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3>(Tuple<T1, T2, T3>, out T1, out T2, out T3) | parameter 0 [Item2] -> parameter 2 | true |
-| System.TupleExtensions.Deconstruct<T1, T2, T3>(Tuple<T1, T2, T3>, out T1, out T2, out T3) | parameter 0 [Item3] -> parameter 3 | true |
-| System.TupleExtensions.Deconstruct<T1, T2>(Tuple<T1, T2>, out T1, out T2) | parameter 0 [Item1] -> parameter 1 | true |
-| System.TupleExtensions.Deconstruct<T1, T2>(Tuple<T1, T2>, out T1, out T2) | parameter 0 [Item2] -> parameter 2 | true |
-| System.TupleExtensions.Deconstruct<T1>(Tuple<T1>, out T1) | parameter 0 [Item1] -> parameter 1 | true |
-| System.Uri.ToString() | this parameter -> return | false |
-| System.Uri.Uri(string) | parameter 0 -> return | false |
-| System.Uri.Uri(string, UriKind) | parameter 0 -> return | false |
-| System.Uri.Uri(string, bool) | parameter 0 -> return | false |
-| System.Uri.get_OriginalString() | this parameter -> return | false |
-| System.Uri.get_PathAndQuery() | this parameter -> return | false |
-| System.Uri.get_Query() | this parameter -> return | false |
-| System.ValueTuple<,,,,,,,>.ValueTuple(T1, T2, T3, T4, T5, T6, T7, TRest) | parameter 0 -> return [Item1] | true |
-| System.ValueTuple<,,,,,,,>.ValueTuple(T1, T2, T3, T4, T5, T6, T7, TRest) | parameter 1 -> return [Item2] | true |
-| System.ValueTuple<,,,,,,,>.ValueTuple(T1, T2, T3, T4, T5, T6, T7, TRest) | parameter 2 -> return [Item3] | true |
-| System.ValueTuple<,,,,,,,>.ValueTuple(T1, T2, T3, T4, T5, T6, T7, TRest) | parameter 3 -> return [Item4] | true |
-| System.ValueTuple<,,,,,,,>.ValueTuple(T1, T2, T3, T4, T5, T6, T7, TRest) | parameter 4 -> return [Item5] | true |
-| System.ValueTuple<,,,,,,,>.ValueTuple(T1, T2, T3, T4, T5, T6, T7, TRest) | parameter 5 -> return [Item6] | true |
-| System.ValueTuple<,,,,,,,>.ValueTuple(T1, T2, T3, T4, T5, T6, T7, TRest) | parameter 6 -> return [Item7] | true |
-| System.ValueTuple<,,,,,,,>.get_Item(int) | this parameter [Item1] -> return | true |
-| System.ValueTuple<,,,,,,,>.get_Item(int) | this parameter [Item2] -> return | true |
-| System.ValueTuple<,,,,,,,>.get_Item(int) | this parameter [Item3] -> return | true |
-| System.ValueTuple<,,,,,,,>.get_Item(int) | this parameter [Item4] -> return | true |
-| System.ValueTuple<,,,,,,,>.get_Item(int) | this parameter [Item5] -> return | true |
-| System.ValueTuple<,,,,,,,>.get_Item(int) | this parameter [Item6] -> return | true |
-| System.ValueTuple<,,,,,,,>.get_Item(int) | this parameter [Item7] -> return | true |
-| System.Web.HttpCookie.get_Value() | this parameter -> return | false |
-| System.Web.HttpCookie.get_Values() | this parameter -> return | false |
-| System.Web.HttpServerUtility.UrlEncode(string) | parameter 0 -> return | false |
-| System.Web.HttpUtility.HtmlAttributeEncode(string) | parameter 0 -> return | false |
-| System.Web.HttpUtility.HtmlEncode(object) | parameter 0 -> return | false |
-| System.Web.HttpUtility.HtmlEncode(string) | parameter 0 -> return | false |
-| System.Web.HttpUtility.UrlEncode(string) | parameter 0 -> return | false |
-| System.Web.UI.WebControls.TextBox.get_Text() | this parameter -> return | false |
+| MS.Internal.Xml.Linq.ComponentModel.XDeferredAxis<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.().Create<T1, T2, T3, T4, T5, T6, T7, T8>(T1, T2, T3, T4, T5, T6, T7, T8) | argument 0 -> field Item1 of return (normal) | true |
+| System.().Create<T1, T2, T3, T4, T5, T6, T7, T8>(T1, T2, T3, T4, T5, T6, T7, T8) | argument 1 -> field Item2 of return (normal) | true |
+| System.().Create<T1, T2, T3, T4, T5, T6, T7, T8>(T1, T2, T3, T4, T5, T6, T7, T8) | argument 2 -> field Item3 of return (normal) | true |
+| System.().Create<T1, T2, T3, T4, T5, T6, T7, T8>(T1, T2, T3, T4, T5, T6, T7, T8) | argument 3 -> field Item4 of return (normal) | true |
+| System.().Create<T1, T2, T3, T4, T5, T6, T7, T8>(T1, T2, T3, T4, T5, T6, T7, T8) | argument 4 -> field Item5 of return (normal) | true |
+| System.().Create<T1, T2, T3, T4, T5, T6, T7, T8>(T1, T2, T3, T4, T5, T6, T7, T8) | argument 5 -> field Item6 of return (normal) | true |
+| System.().Create<T1, T2, T3, T4, T5, T6, T7, T8>(T1, T2, T3, T4, T5, T6, T7, T8) | argument 6 -> field Item7 of return (normal) | true |
+| System.().Create<T1, T2, T3, T4, T5, T6, T7, T8>(T1, T2, T3, T4, T5, T6, T7, T8) | argument 7 -> field Item8 of return (normal) | true |
+| System.().Create<T1, T2, T3, T4, T5, T6, T7>(T1, T2, T3, T4, T5, T6, T7) | argument 0 -> field Item1 of return (normal) | true |
+| System.().Create<T1, T2, T3, T4, T5, T6, T7>(T1, T2, T3, T4, T5, T6, T7) | argument 1 -> field Item2 of return (normal) | true |
+| System.().Create<T1, T2, T3, T4, T5, T6, T7>(T1, T2, T3, T4, T5, T6, T7) | argument 2 -> field Item3 of return (normal) | true |
+| System.().Create<T1, T2, T3, T4, T5, T6, T7>(T1, T2, T3, T4, T5, T6, T7) | argument 3 -> field Item4 of return (normal) | true |
+| System.().Create<T1, T2, T3, T4, T5, T6, T7>(T1, T2, T3, T4, T5, T6, T7) | argument 4 -> field Item5 of return (normal) | true |
+| System.().Create<T1, T2, T3, T4, T5, T6, T7>(T1, T2, T3, T4, T5, T6, T7) | argument 5 -> field Item6 of return (normal) | true |
+| System.().Create<T1, T2, T3, T4, T5, T6, T7>(T1, T2, T3, T4, T5, T6, T7) | argument 6 -> field Item7 of return (normal) | true |
+| System.().Create<T1, T2, T3, T4, T5, T6>(T1, T2, T3, T4, T5, T6) | argument 0 -> field Item1 of return (normal) | true |
+| System.().Create<T1, T2, T3, T4, T5, T6>(T1, T2, T3, T4, T5, T6) | argument 1 -> field Item2 of return (normal) | true |
+| System.().Create<T1, T2, T3, T4, T5, T6>(T1, T2, T3, T4, T5, T6) | argument 2 -> field Item3 of return (normal) | true |
+| System.().Create<T1, T2, T3, T4, T5, T6>(T1, T2, T3, T4, T5, T6) | argument 3 -> field Item4 of return (normal) | true |
+| System.().Create<T1, T2, T3, T4, T5, T6>(T1, T2, T3, T4, T5, T6) | argument 4 -> field Item5 of return (normal) | true |
+| System.().Create<T1, T2, T3, T4, T5, T6>(T1, T2, T3, T4, T5, T6) | argument 5 -> field Item6 of return (normal) | true |
+| System.().Create<T1, T2, T3, T4, T5>(T1, T2, T3, T4, T5) | argument 0 -> field Item1 of return (normal) | true |
+| System.().Create<T1, T2, T3, T4, T5>(T1, T2, T3, T4, T5) | argument 1 -> field Item2 of return (normal) | true |
+| System.().Create<T1, T2, T3, T4, T5>(T1, T2, T3, T4, T5) | argument 2 -> field Item3 of return (normal) | true |
+| System.().Create<T1, T2, T3, T4, T5>(T1, T2, T3, T4, T5) | argument 3 -> field Item4 of return (normal) | true |
+| System.().Create<T1, T2, T3, T4, T5>(T1, T2, T3, T4, T5) | argument 4 -> field Item5 of return (normal) | true |
+| System.().Create<T1, T2, T3, T4>(T1, T2, T3, T4) | argument 0 -> field Item1 of return (normal) | true |
+| System.().Create<T1, T2, T3, T4>(T1, T2, T3, T4) | argument 1 -> field Item2 of return (normal) | true |
+| System.().Create<T1, T2, T3, T4>(T1, T2, T3, T4) | argument 2 -> field Item3 of return (normal) | true |
+| System.().Create<T1, T2, T3, T4>(T1, T2, T3, T4) | argument 3 -> field Item4 of return (normal) | true |
+| System.().Create<T1, T2, T3>(T1, T2, T3) | argument 0 -> field Item1 of return (normal) | true |
+| System.().Create<T1, T2, T3>(T1, T2, T3) | argument 1 -> field Item2 of return (normal) | true |
+| System.().Create<T1, T2, T3>(T1, T2, T3) | argument 2 -> field Item3 of return (normal) | true |
+| System.().Create<T1, T2>(T1, T2) | argument 0 -> field Item1 of return (normal) | true |
+| System.().Create<T1, T2>(T1, T2) | argument 1 -> field Item2 of return (normal) | true |
+| System.().Create<T1>(T1) | argument 0 -> field Item1 of return (normal) | true |
+| System.(T1).ValueTuple(T1) | argument 0 -> field Item1 of return (normal) | true |
+| System.(T1).get_Item(int) | field Item1 of argument -1 -> return (normal) | true |
+| System.(T1,T2).ValueTuple(T1, T2) | argument 0 -> field Item1 of return (normal) | true |
+| System.(T1,T2).ValueTuple(T1, T2) | argument 1 -> field Item2 of return (normal) | true |
+| System.(T1,T2).get_Item(int) | field Item1 of argument -1 -> return (normal) | true |
+| System.(T1,T2).get_Item(int) | field Item2 of argument -1 -> return (normal) | true |
+| System.(T1,T2,T3).ValueTuple(T1, T2, T3) | argument 0 -> field Item1 of return (normal) | true |
+| System.(T1,T2,T3).ValueTuple(T1, T2, T3) | argument 1 -> field Item2 of return (normal) | true |
+| System.(T1,T2,T3).ValueTuple(T1, T2, T3) | argument 2 -> field Item3 of return (normal) | true |
+| System.(T1,T2,T3).get_Item(int) | field Item1 of argument -1 -> return (normal) | true |
+| System.(T1,T2,T3).get_Item(int) | field Item2 of argument -1 -> return (normal) | true |
+| System.(T1,T2,T3).get_Item(int) | field Item3 of argument -1 -> return (normal) | true |
+| System.(T1,T2,T3,T4).ValueTuple(T1, T2, T3, T4) | argument 0 -> field Item1 of return (normal) | true |
+| System.(T1,T2,T3,T4).ValueTuple(T1, T2, T3, T4) | argument 1 -> field Item2 of return (normal) | true |
+| System.(T1,T2,T3,T4).ValueTuple(T1, T2, T3, T4) | argument 2 -> field Item3 of return (normal) | true |
+| System.(T1,T2,T3,T4).ValueTuple(T1, T2, T3, T4) | argument 3 -> field Item4 of return (normal) | true |
+| System.(T1,T2,T3,T4).get_Item(int) | field Item1 of argument -1 -> return (normal) | true |
+| System.(T1,T2,T3,T4).get_Item(int) | field Item2 of argument -1 -> return (normal) | true |
+| System.(T1,T2,T3,T4).get_Item(int) | field Item3 of argument -1 -> return (normal) | true |
+| System.(T1,T2,T3,T4).get_Item(int) | field Item4 of argument -1 -> return (normal) | true |
+| System.(T1,T2,T3,T4,T5).ValueTuple(T1, T2, T3, T4, T5) | argument 0 -> field Item1 of return (normal) | true |
+| System.(T1,T2,T3,T4,T5).ValueTuple(T1, T2, T3, T4, T5) | argument 1 -> field Item2 of return (normal) | true |
+| System.(T1,T2,T3,T4,T5).ValueTuple(T1, T2, T3, T4, T5) | argument 2 -> field Item3 of return (normal) | true |
+| System.(T1,T2,T3,T4,T5).ValueTuple(T1, T2, T3, T4, T5) | argument 3 -> field Item4 of return (normal) | true |
+| System.(T1,T2,T3,T4,T5).ValueTuple(T1, T2, T3, T4, T5) | argument 4 -> field Item5 of return (normal) | true |
+| System.(T1,T2,T3,T4,T5).get_Item(int) | field Item1 of argument -1 -> return (normal) | true |
+| System.(T1,T2,T3,T4,T5).get_Item(int) | field Item2 of argument -1 -> return (normal) | true |
+| System.(T1,T2,T3,T4,T5).get_Item(int) | field Item3 of argument -1 -> return (normal) | true |
+| System.(T1,T2,T3,T4,T5).get_Item(int) | field Item4 of argument -1 -> return (normal) | true |
+| System.(T1,T2,T3,T4,T5).get_Item(int) | field Item5 of argument -1 -> return (normal) | true |
+| System.(T1,T2,T3,T4,T5,T6).ValueTuple(T1, T2, T3, T4, T5, T6) | argument 0 -> field Item1 of return (normal) | true |
+| System.(T1,T2,T3,T4,T5,T6).ValueTuple(T1, T2, T3, T4, T5, T6) | argument 1 -> field Item2 of return (normal) | true |
+| System.(T1,T2,T3,T4,T5,T6).ValueTuple(T1, T2, T3, T4, T5, T6) | argument 2 -> field Item3 of return (normal) | true |
+| System.(T1,T2,T3,T4,T5,T6).ValueTuple(T1, T2, T3, T4, T5, T6) | argument 3 -> field Item4 of return (normal) | true |
+| System.(T1,T2,T3,T4,T5,T6).ValueTuple(T1, T2, T3, T4, T5, T6) | argument 4 -> field Item5 of return (normal) | true |
+| System.(T1,T2,T3,T4,T5,T6).ValueTuple(T1, T2, T3, T4, T5, T6) | argument 5 -> field Item6 of return (normal) | true |
+| System.(T1,T2,T3,T4,T5,T6).get_Item(int) | field Item1 of argument -1 -> return (normal) | true |
+| System.(T1,T2,T3,T4,T5,T6).get_Item(int) | field Item2 of argument -1 -> return (normal) | true |
+| System.(T1,T2,T3,T4,T5,T6).get_Item(int) | field Item3 of argument -1 -> return (normal) | true |
+| System.(T1,T2,T3,T4,T5,T6).get_Item(int) | field Item4 of argument -1 -> return (normal) | true |
+| System.(T1,T2,T3,T4,T5,T6).get_Item(int) | field Item5 of argument -1 -> return (normal) | true |
+| System.(T1,T2,T3,T4,T5,T6).get_Item(int) | field Item6 of argument -1 -> return (normal) | true |
+| System.(T1,T2,T3,T4,T5,T6,T7).ValueTuple(T1, T2, T3, T4, T5, T6, T7) | argument 0 -> field Item1 of return (normal) | true |
+| System.(T1,T2,T3,T4,T5,T6,T7).ValueTuple(T1, T2, T3, T4, T5, T6, T7) | argument 1 -> field Item2 of return (normal) | true |
+| System.(T1,T2,T3,T4,T5,T6,T7).ValueTuple(T1, T2, T3, T4, T5, T6, T7) | argument 2 -> field Item3 of return (normal) | true |
+| System.(T1,T2,T3,T4,T5,T6,T7).ValueTuple(T1, T2, T3, T4, T5, T6, T7) | argument 3 -> field Item4 of return (normal) | true |
+| System.(T1,T2,T3,T4,T5,T6,T7).ValueTuple(T1, T2, T3, T4, T5, T6, T7) | argument 4 -> field Item5 of return (normal) | true |
+| System.(T1,T2,T3,T4,T5,T6,T7).ValueTuple(T1, T2, T3, T4, T5, T6, T7) | argument 5 -> field Item6 of return (normal) | true |
+| System.(T1,T2,T3,T4,T5,T6,T7).ValueTuple(T1, T2, T3, T4, T5, T6, T7) | argument 6 -> field Item7 of return (normal) | true |
+| System.(T1,T2,T3,T4,T5,T6,T7).get_Item(int) | field Item1 of argument -1 -> return (normal) | true |
+| System.(T1,T2,T3,T4,T5,T6,T7).get_Item(int) | field Item2 of argument -1 -> return (normal) | true |
+| System.(T1,T2,T3,T4,T5,T6,T7).get_Item(int) | field Item3 of argument -1 -> return (normal) | true |
+| System.(T1,T2,T3,T4,T5,T6,T7).get_Item(int) | field Item4 of argument -1 -> return (normal) | true |
+| System.(T1,T2,T3,T4,T5,T6,T7).get_Item(int) | field Item5 of argument -1 -> return (normal) | true |
+| System.(T1,T2,T3,T4,T5,T6,T7).get_Item(int) | field Item6 of argument -1 -> return (normal) | true |
+| System.(T1,T2,T3,T4,T5,T6,T7).get_Item(int) | field Item7 of argument -1 -> return (normal) | true |
+| System.Array.Add(object) | argument 0 -> element of argument -1 | true |
+| System.Array.AsReadOnly<T>(T[]) | element of argument 0 -> element of return (normal) | true |
+| System.Array.Clone() | element of argument 0 -> element of return (normal) | true |
+| System.Array.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Array.CopyTo(Array, long) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Array.Find<T>(T[], Predicate<T>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Array.Find<T>(T[], Predicate<T>) | element of argument 0 -> return (normal) | true |
+| System.Array.FindAll<T>(T[], Predicate<T>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Array.FindAll<T>(T[], Predicate<T>) | element of argument 0 -> return (normal) | true |
+| System.Array.FindLast<T>(T[], Predicate<T>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Array.FindLast<T>(T[], Predicate<T>) | element of argument 0 -> return (normal) | true |
+| System.Array.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Array.Insert(int, object) | argument 1 -> element of argument -1 | true |
+| System.Array.Reverse(Array) | element of argument 0 -> element of return (normal) | true |
+| System.Array.Reverse(Array, int, int) | element of argument 0 -> element of return (normal) | true |
+| System.Array.Reverse<T>(T[]) | element of argument 0 -> element of return (normal) | true |
+| System.Array.Reverse<T>(T[], int, int) | element of argument 0 -> element of return (normal) | true |
+| System.Array.get_Item(int) | element of argument -1 -> return (normal) | true |
+| System.Array.set_Item(int, object) | argument 1 -> element of argument -1 | true |
+| System.Boolean.Parse(string) | argument 0 -> return (normal) | false |
+| System.Boolean.TryParse(string, out bool) | argument 0 -> return (normal) | false |
+| System.Boolean.TryParse(string, out bool) | argument 0 -> return (out parameter 1) | false |
+| System.Collections.ArrayList.Add(object) | argument 0 -> element of argument -1 | true |
+| System.Collections.ArrayList.AddRange(ICollection) | element of argument 0 -> element of argument -1 | true |
+| System.Collections.ArrayList.Clone() | element of argument 0 -> element of return (normal) | true |
+| System.Collections.ArrayList.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.ArrayList.FixedSize(ArrayList) | element of argument 0 -> element of return (normal) | true |
+| System.Collections.ArrayList.FixedSize(IList) | element of argument 0 -> element of return (normal) | true |
+| System.Collections.ArrayList.FixedSizeArrayList.Add(object) | argument 0 -> element of argument -1 | true |
+| System.Collections.ArrayList.FixedSizeArrayList.AddRange(ICollection) | element of argument 0 -> element of argument -1 | true |
+| System.Collections.ArrayList.FixedSizeArrayList.Clone() | element of argument 0 -> element of return (normal) | true |
+| System.Collections.ArrayList.FixedSizeArrayList.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.ArrayList.FixedSizeArrayList.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.ArrayList.FixedSizeArrayList.GetEnumerator(int, int) | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.ArrayList.FixedSizeArrayList.GetRange(int, int) | element of argument 0 -> element of return (normal) | true |
+| System.Collections.ArrayList.FixedSizeArrayList.Insert(int, object) | argument 1 -> element of argument -1 | true |
+| System.Collections.ArrayList.FixedSizeArrayList.InsertRange(int, ICollection) | element of argument 1 -> element of argument -1 | true |
+| System.Collections.ArrayList.FixedSizeArrayList.Reverse(int, int) | element of argument 0 -> element of return (normal) | true |
+| System.Collections.ArrayList.FixedSizeArrayList.get_Item(int) | element of argument -1 -> return (normal) | true |
+| System.Collections.ArrayList.FixedSizeArrayList.set_Item(int, object) | argument 1 -> element of argument -1 | true |
+| System.Collections.ArrayList.FixedSizeList.Add(object) | argument 0 -> element of argument -1 | true |
+| System.Collections.ArrayList.FixedSizeList.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.ArrayList.FixedSizeList.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.ArrayList.FixedSizeList.Insert(int, object) | argument 1 -> element of argument -1 | true |
+| System.Collections.ArrayList.FixedSizeList.get_Item(int) | element of argument -1 -> return (normal) | true |
+| System.Collections.ArrayList.FixedSizeList.set_Item(int, object) | argument 1 -> element of argument -1 | true |
+| System.Collections.ArrayList.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.ArrayList.GetEnumerator(int, int) | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.ArrayList.GetRange(int, int) | element of argument 0 -> element of return (normal) | true |
+| System.Collections.ArrayList.IListWrapper.Add(object) | argument 0 -> element of argument -1 | true |
+| System.Collections.ArrayList.IListWrapper.AddRange(ICollection) | element of argument 0 -> element of argument -1 | true |
+| System.Collections.ArrayList.IListWrapper.Clone() | element of argument 0 -> element of return (normal) | true |
+| System.Collections.ArrayList.IListWrapper.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.ArrayList.IListWrapper.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.ArrayList.IListWrapper.GetEnumerator(int, int) | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.ArrayList.IListWrapper.GetRange(int, int) | element of argument 0 -> element of return (normal) | true |
+| System.Collections.ArrayList.IListWrapper.Insert(int, object) | argument 1 -> element of argument -1 | true |
+| System.Collections.ArrayList.IListWrapper.InsertRange(int, ICollection) | element of argument 1 -> element of argument -1 | true |
+| System.Collections.ArrayList.IListWrapper.Reverse(int, int) | element of argument 0 -> element of return (normal) | true |
+| System.Collections.ArrayList.IListWrapper.get_Item(int) | element of argument -1 -> return (normal) | true |
+| System.Collections.ArrayList.IListWrapper.set_Item(int, object) | argument 1 -> element of argument -1 | true |
+| System.Collections.ArrayList.Insert(int, object) | argument 1 -> element of argument -1 | true |
+| System.Collections.ArrayList.InsertRange(int, ICollection) | element of argument 1 -> element of argument -1 | true |
+| System.Collections.ArrayList.Range.Add(object) | argument 0 -> element of argument -1 | true |
+| System.Collections.ArrayList.Range.AddRange(ICollection) | element of argument 0 -> element of argument -1 | true |
+| System.Collections.ArrayList.Range.Clone() | element of argument 0 -> element of return (normal) | true |
+| System.Collections.ArrayList.Range.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.ArrayList.Range.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.ArrayList.Range.GetEnumerator(int, int) | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.ArrayList.Range.GetRange(int, int) | element of argument 0 -> element of return (normal) | true |
+| System.Collections.ArrayList.Range.Insert(int, object) | argument 1 -> element of argument -1 | true |
+| System.Collections.ArrayList.Range.InsertRange(int, ICollection) | element of argument 1 -> element of argument -1 | true |
+| System.Collections.ArrayList.Range.Reverse(int, int) | element of argument 0 -> element of return (normal) | true |
+| System.Collections.ArrayList.Range.get_Item(int) | element of argument -1 -> return (normal) | true |
+| System.Collections.ArrayList.Range.set_Item(int, object) | argument 1 -> element of argument -1 | true |
+| System.Collections.ArrayList.ReadOnlyArrayList.Add(object) | argument 0 -> element of argument -1 | true |
+| System.Collections.ArrayList.ReadOnlyArrayList.AddRange(ICollection) | element of argument 0 -> element of argument -1 | true |
+| System.Collections.ArrayList.ReadOnlyArrayList.Clone() | element of argument 0 -> element of return (normal) | true |
+| System.Collections.ArrayList.ReadOnlyArrayList.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.ArrayList.ReadOnlyArrayList.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.ArrayList.ReadOnlyArrayList.GetEnumerator(int, int) | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.ArrayList.ReadOnlyArrayList.GetRange(int, int) | element of argument 0 -> element of return (normal) | true |
+| System.Collections.ArrayList.ReadOnlyArrayList.Insert(int, object) | argument 1 -> element of argument -1 | true |
+| System.Collections.ArrayList.ReadOnlyArrayList.InsertRange(int, ICollection) | element of argument 1 -> element of argument -1 | true |
+| System.Collections.ArrayList.ReadOnlyArrayList.Reverse(int, int) | element of argument 0 -> element of return (normal) | true |
+| System.Collections.ArrayList.ReadOnlyArrayList.get_Item(int) | element of argument -1 -> return (normal) | true |
+| System.Collections.ArrayList.ReadOnlyArrayList.set_Item(int, object) | argument 1 -> element of argument -1 | true |
+| System.Collections.ArrayList.ReadOnlyList.Add(object) | argument 0 -> element of argument -1 | true |
+| System.Collections.ArrayList.ReadOnlyList.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.ArrayList.ReadOnlyList.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.ArrayList.ReadOnlyList.Insert(int, object) | argument 1 -> element of argument -1 | true |
+| System.Collections.ArrayList.ReadOnlyList.get_Item(int) | element of argument -1 -> return (normal) | true |
+| System.Collections.ArrayList.ReadOnlyList.set_Item(int, object) | argument 1 -> element of argument -1 | true |
+| System.Collections.ArrayList.Repeat(object, int) | argument 0 -> element of return (normal) | true |
+| System.Collections.ArrayList.Reverse() | element of argument 0 -> element of return (normal) | true |
+| System.Collections.ArrayList.Reverse(int, int) | element of argument 0 -> element of return (normal) | true |
+| System.Collections.ArrayList.SyncArrayList.Add(object) | argument 0 -> element of argument -1 | true |
+| System.Collections.ArrayList.SyncArrayList.AddRange(ICollection) | element of argument 0 -> element of argument -1 | true |
+| System.Collections.ArrayList.SyncArrayList.Clone() | element of argument 0 -> element of return (normal) | true |
+| System.Collections.ArrayList.SyncArrayList.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.ArrayList.SyncArrayList.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.ArrayList.SyncArrayList.GetEnumerator(int, int) | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.ArrayList.SyncArrayList.GetRange(int, int) | element of argument 0 -> element of return (normal) | true |
+| System.Collections.ArrayList.SyncArrayList.Insert(int, object) | argument 1 -> element of argument -1 | true |
+| System.Collections.ArrayList.SyncArrayList.InsertRange(int, ICollection) | element of argument 1 -> element of argument -1 | true |
+| System.Collections.ArrayList.SyncArrayList.Reverse(int, int) | element of argument 0 -> element of return (normal) | true |
+| System.Collections.ArrayList.SyncArrayList.get_Item(int) | element of argument -1 -> return (normal) | true |
+| System.Collections.ArrayList.SyncArrayList.set_Item(int, object) | argument 1 -> element of argument -1 | true |
+| System.Collections.ArrayList.SyncIList.Add(object) | argument 0 -> element of argument -1 | true |
+| System.Collections.ArrayList.SyncIList.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.ArrayList.SyncIList.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.ArrayList.SyncIList.Insert(int, object) | argument 1 -> element of argument -1 | true |
+| System.Collections.ArrayList.SyncIList.get_Item(int) | element of argument -1 -> return (normal) | true |
+| System.Collections.ArrayList.SyncIList.set_Item(int, object) | argument 1 -> element of argument -1 | true |
+| System.Collections.ArrayList.get_Item(int) | element of argument -1 -> return (normal) | true |
+| System.Collections.ArrayList.set_Item(int, object) | argument 1 -> element of argument -1 | true |
+| System.Collections.BitArray.Clone() | element of argument 0 -> element of return (normal) | true |
+| System.Collections.BitArray.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.BitArray.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.CollectionBase.Add(object) | argument 0 -> element of argument -1 | true |
+| System.Collections.CollectionBase.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.CollectionBase.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.CollectionBase.Insert(int, object) | argument 1 -> element of argument -1 | true |
+| System.Collections.CollectionBase.get_Item(int) | element of argument -1 -> return (normal) | true |
+| System.Collections.CollectionBase.set_Item(int, object) | argument 1 -> element of argument -1 | true |
+| System.Collections.Concurrent.BlockingCollection<>.<GetConsumingEnumerable>d__68.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.Concurrent.BlockingCollection<>.Add(T) | argument 0 -> element of argument -1 | true |
+| System.Collections.Concurrent.BlockingCollection<>.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Concurrent.BlockingCollection<>.CopyTo(T[], int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Concurrent.BlockingCollection<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.Concurrent.ConcurrentBag<>.Add(T) | argument 0 -> element of argument -1 | true |
+| System.Collections.Concurrent.ConcurrentBag<>.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Concurrent.ConcurrentBag<>.CopyTo(T[], int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Concurrent.ConcurrentBag<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.Concurrent.ConcurrentDictionary<,>.Add(KeyValuePair<TKey, TValue>) | argument 0 -> element of argument -1 | true |
+| System.Collections.Concurrent.ConcurrentDictionary<,>.Add(KeyValuePair<TKey, TValue>) | property Key of argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.Concurrent.ConcurrentDictionary<,>.Add(KeyValuePair<TKey, TValue>) | property Value of argument 0 -> property Value of element of argument -1 | true |
+| System.Collections.Concurrent.ConcurrentDictionary<,>.Add(TKey, TValue) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.Concurrent.ConcurrentDictionary<,>.Add(TKey, TValue) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.Concurrent.ConcurrentDictionary<,>.Add(object, object) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.Concurrent.ConcurrentDictionary<,>.Add(object, object) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.Concurrent.ConcurrentDictionary<,>.ConcurrentDictionary(IEnumerable<KeyValuePair<TKey,TValue>>) | property Key of element of argument 0 -> property Key of element of return (normal) | true |
+| System.Collections.Concurrent.ConcurrentDictionary<,>.ConcurrentDictionary(IEnumerable<KeyValuePair<TKey,TValue>>) | property Value of element of argument 0 -> property Value of element of return (normal) | true |
+| System.Collections.Concurrent.ConcurrentDictionary<,>.ConcurrentDictionary(IEnumerable<KeyValuePair<TKey,TValue>>, IEqualityComparer<TKey>) | property Key of element of argument 0 -> property Key of element of return (normal) | true |
+| System.Collections.Concurrent.ConcurrentDictionary<,>.ConcurrentDictionary(IEnumerable<KeyValuePair<TKey,TValue>>, IEqualityComparer<TKey>) | property Value of element of argument 0 -> property Value of element of return (normal) | true |
+| System.Collections.Concurrent.ConcurrentDictionary<,>.ConcurrentDictionary(int, IEnumerable<KeyValuePair<TKey,TValue>>, IEqualityComparer<TKey>) | property Key of element of argument 1 -> property Key of element of return (normal) | true |
+| System.Collections.Concurrent.ConcurrentDictionary<,>.ConcurrentDictionary(int, IEnumerable<KeyValuePair<TKey,TValue>>, IEqualityComparer<TKey>) | property Value of element of argument 1 -> property Value of element of return (normal) | true |
+| System.Collections.Concurrent.ConcurrentDictionary<,>.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Concurrent.ConcurrentDictionary<,>.CopyTo(KeyValuePair<TKey,TValue>[], int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Concurrent.ConcurrentDictionary<,>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.Concurrent.ConcurrentDictionary<,>.get_Item(TKey) | property Value of element of argument -1 -> return (normal) | true |
+| System.Collections.Concurrent.ConcurrentDictionary<,>.get_Item(object) | property Value of element of argument -1 -> return (normal) | true |
+| System.Collections.Concurrent.ConcurrentDictionary<,>.get_Keys() | property Key of element of argument -1 -> element of return (normal) | true |
+| System.Collections.Concurrent.ConcurrentDictionary<,>.get_Values() | property Value of element of argument -1 -> element of return (normal) | true |
+| System.Collections.Concurrent.ConcurrentDictionary<,>.set_Item(TKey, TValue) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.Concurrent.ConcurrentDictionary<,>.set_Item(TKey, TValue) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.Concurrent.ConcurrentDictionary<,>.set_Item(object, object) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.Concurrent.ConcurrentDictionary<,>.set_Item(object, object) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.Concurrent.ConcurrentQueue<>.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Concurrent.ConcurrentQueue<>.CopyTo(T[], int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Concurrent.ConcurrentQueue<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.Concurrent.ConcurrentStack<>.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Concurrent.ConcurrentStack<>.CopyTo(T[], int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Concurrent.ConcurrentStack<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.Concurrent.IProducerConsumerCollection<>.CopyTo(T[], int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Concurrent.OrderablePartitioner<>.EnumerableDropIndices.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.Concurrent.Partitioner.<CreateRanges>d__7.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.Concurrent.Partitioner.<CreateRanges>d__10.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.Concurrent.Partitioner.DynamicPartitionerForArray<>.InternalPartitionEnumerable.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.Concurrent.Partitioner.DynamicPartitionerForIEnumerable<>.InternalPartitionEnumerable.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.Concurrent.Partitioner.DynamicPartitionerForIList<>.InternalPartitionEnumerable.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.DictionaryBase.Add(object, object) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.DictionaryBase.Add(object, object) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.DictionaryBase.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.DictionaryBase.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.DictionaryBase.get_Item(object) | property Value of element of argument -1 -> return (normal) | true |
+| System.Collections.DictionaryBase.get_Keys() | property Key of element of argument -1 -> element of return (normal) | true |
+| System.Collections.DictionaryBase.get_Values() | property Value of element of argument -1 -> element of return (normal) | true |
+| System.Collections.DictionaryBase.set_Item(object, object) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.DictionaryBase.set_Item(object, object) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.EmptyReadOnlyDictionaryInternal.Add(object, object) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.EmptyReadOnlyDictionaryInternal.Add(object, object) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.EmptyReadOnlyDictionaryInternal.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.EmptyReadOnlyDictionaryInternal.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.EmptyReadOnlyDictionaryInternal.get_Item(object) | property Value of element of argument -1 -> return (normal) | true |
+| System.Collections.EmptyReadOnlyDictionaryInternal.get_Keys() | property Key of element of argument -1 -> element of return (normal) | true |
+| System.Collections.EmptyReadOnlyDictionaryInternal.get_Values() | property Value of element of argument -1 -> element of return (normal) | true |
+| System.Collections.EmptyReadOnlyDictionaryInternal.set_Item(object, object) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.EmptyReadOnlyDictionaryInternal.set_Item(object, object) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.Generic.Dictionary<,>.Add(KeyValuePair<TKey, TValue>) | argument 0 -> element of argument -1 | true |
+| System.Collections.Generic.Dictionary<,>.Add(KeyValuePair<TKey, TValue>) | property Key of argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.Generic.Dictionary<,>.Add(KeyValuePair<TKey, TValue>) | property Value of argument 0 -> property Value of element of argument -1 | true |
+| System.Collections.Generic.Dictionary<,>.Add(TKey, TValue) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.Generic.Dictionary<,>.Add(TKey, TValue) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.Generic.Dictionary<,>.Add(object, object) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.Generic.Dictionary<,>.Add(object, object) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.Generic.Dictionary<,>.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Generic.Dictionary<,>.CopyTo(KeyValuePair<TKey,TValue>[], int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Generic.Dictionary<,>.Dictionary(IDictionary<TKey, TValue>) | property Key of element of argument 0 -> property Key of element of return (normal) | true |
+| System.Collections.Generic.Dictionary<,>.Dictionary(IDictionary<TKey, TValue>) | property Value of element of argument 0 -> property Value of element of return (normal) | true |
+| System.Collections.Generic.Dictionary<,>.Dictionary(IDictionary<TKey, TValue>, IEqualityComparer<TKey>) | property Key of element of argument 0 -> property Key of element of return (normal) | true |
+| System.Collections.Generic.Dictionary<,>.Dictionary(IDictionary<TKey, TValue>, IEqualityComparer<TKey>) | property Value of element of argument 0 -> property Value of element of return (normal) | true |
+| System.Collections.Generic.Dictionary<,>.Dictionary(IEnumerable<KeyValuePair<TKey,TValue>>) | property Key of element of argument 0 -> property Key of element of return (normal) | true |
+| System.Collections.Generic.Dictionary<,>.Dictionary(IEnumerable<KeyValuePair<TKey,TValue>>) | property Value of element of argument 0 -> property Value of element of return (normal) | true |
+| System.Collections.Generic.Dictionary<,>.Dictionary(IEnumerable<KeyValuePair<TKey,TValue>>, IEqualityComparer<TKey>) | property Key of element of argument 0 -> property Key of element of return (normal) | true |
+| System.Collections.Generic.Dictionary<,>.Dictionary(IEnumerable<KeyValuePair<TKey,TValue>>, IEqualityComparer<TKey>) | property Value of element of argument 0 -> property Value of element of return (normal) | true |
+| System.Collections.Generic.Dictionary<,>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.Generic.Dictionary<,>.KeyCollection.Add(TKey) | argument 0 -> element of argument -1 | true |
+| System.Collections.Generic.Dictionary<,>.KeyCollection.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Generic.Dictionary<,>.KeyCollection.CopyTo(TKey[], int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Generic.Dictionary<,>.KeyCollection.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.Generic.Dictionary<,>.ValueCollection.Add(TValue) | argument 0 -> element of argument -1 | true |
+| System.Collections.Generic.Dictionary<,>.ValueCollection.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Generic.Dictionary<,>.ValueCollection.CopyTo(TValue[], int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Generic.Dictionary<,>.ValueCollection.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.Generic.Dictionary<,>.get_Item(TKey) | property Value of element of argument -1 -> return (normal) | true |
+| System.Collections.Generic.Dictionary<,>.get_Item(object) | property Value of element of argument -1 -> return (normal) | true |
+| System.Collections.Generic.Dictionary<,>.get_Keys() | property Key of element of argument -1 -> element of return (normal) | true |
+| System.Collections.Generic.Dictionary<,>.get_Values() | property Value of element of argument -1 -> element of return (normal) | true |
+| System.Collections.Generic.Dictionary<,>.set_Item(TKey, TValue) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.Generic.Dictionary<,>.set_Item(TKey, TValue) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.Generic.Dictionary<,>.set_Item(object, object) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.Generic.Dictionary<,>.set_Item(object, object) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.Generic.HashSet<>.Add(T) | argument 0 -> element of argument -1 | true |
+| System.Collections.Generic.HashSet<>.CopyTo(T[], int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Generic.HashSet<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.Generic.ICollection<>.Add(T) | argument 0 -> element of argument -1 | true |
+| System.Collections.Generic.ICollection<>.CopyTo(T[], int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Generic.IDictionary<,>.Add(TKey, TValue) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.Generic.IDictionary<,>.Add(TKey, TValue) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.Generic.IDictionary<,>.get_Item(TKey) | property Value of element of argument -1 -> return (normal) | true |
+| System.Collections.Generic.IDictionary<,>.get_Keys() | property Key of element of argument -1 -> element of return (normal) | true |
+| System.Collections.Generic.IDictionary<,>.get_Values() | property Value of element of argument -1 -> element of return (normal) | true |
+| System.Collections.Generic.IDictionary<,>.set_Item(TKey, TValue) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.Generic.IDictionary<,>.set_Item(TKey, TValue) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.Generic.IList<>.Insert(int, T) | argument 1 -> element of argument -1 | true |
+| System.Collections.Generic.IList<>.get_Item(int) | element of argument -1 -> return (normal) | true |
+| System.Collections.Generic.IList<>.set_Item(int, T) | argument 1 -> element of argument -1 | true |
+| System.Collections.Generic.ISet<>.Add(T) | argument 0 -> element of argument -1 | true |
+| System.Collections.Generic.KeyValuePair<,>.KeyValuePair() | argument 0 -> property Key of return (normal) | true |
+| System.Collections.Generic.KeyValuePair<,>.KeyValuePair() | argument 1 -> property Value of return (normal) | true |
+| System.Collections.Generic.KeyValuePair<,>.KeyValuePair(TKey, TValue) | argument 0 -> property Key of return (normal) | true |
+| System.Collections.Generic.KeyValuePair<,>.KeyValuePair(TKey, TValue) | argument 1 -> property Value of return (normal) | true |
+| System.Collections.Generic.LinkedList<>.Add(T) | argument 0 -> element of argument -1 | true |
+| System.Collections.Generic.LinkedList<>.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Generic.LinkedList<>.CopyTo(T[], int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Generic.LinkedList<>.Find(T) | element of argument -1 -> return (normal) | true |
+| System.Collections.Generic.LinkedList<>.FindLast(T) | element of argument -1 -> return (normal) | true |
+| System.Collections.Generic.LinkedList<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.Generic.List<>.Add(T) | argument 0 -> element of argument -1 | true |
+| System.Collections.Generic.List<>.Add(object) | argument 0 -> element of argument -1 | true |
+| System.Collections.Generic.List<>.AddRange(IEnumerable<T>) | element of argument 0 -> element of argument -1 | true |
+| System.Collections.Generic.List<>.AsReadOnly() | element of argument 0 -> element of return (normal) | true |
+| System.Collections.Generic.List<>.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Generic.List<>.CopyTo(T[], int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Generic.List<>.Find(Predicate<T>) | element of argument -1 -> parameter 0 of argument 0 | true |
+| System.Collections.Generic.List<>.Find(Predicate<T>) | element of argument -1 -> return (normal) | true |
+| System.Collections.Generic.List<>.FindAll(Predicate<T>) | element of argument -1 -> parameter 0 of argument 0 | true |
+| System.Collections.Generic.List<>.FindAll(Predicate<T>) | element of argument -1 -> return (normal) | true |
+| System.Collections.Generic.List<>.FindLast(Predicate<T>) | element of argument -1 -> parameter 0 of argument 0 | true |
+| System.Collections.Generic.List<>.FindLast(Predicate<T>) | element of argument -1 -> return (normal) | true |
+| System.Collections.Generic.List<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.Generic.List<>.GetRange(int, int) | element of argument 0 -> element of return (normal) | true |
+| System.Collections.Generic.List<>.Insert(int, T) | argument 1 -> element of argument -1 | true |
+| System.Collections.Generic.List<>.Insert(int, object) | argument 1 -> element of argument -1 | true |
+| System.Collections.Generic.List<>.InsertRange(int, IEnumerable<T>) | element of argument 1 -> element of argument -1 | true |
+| System.Collections.Generic.List<>.Reverse() | element of argument 0 -> element of return (normal) | true |
+| System.Collections.Generic.List<>.Reverse(int, int) | element of argument 0 -> element of return (normal) | true |
+| System.Collections.Generic.List<>.get_Item(int) | element of argument -1 -> return (normal) | true |
+| System.Collections.Generic.List<>.set_Item(int, T) | argument 1 -> element of argument -1 | true |
+| System.Collections.Generic.List<>.set_Item(int, object) | argument 1 -> element of argument -1 | true |
+| System.Collections.Generic.Queue<>.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Generic.Queue<>.CopyTo(T[], int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Generic.Queue<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.Generic.Queue<>.Peek() | element of argument -1 -> return (normal) | true |
+| System.Collections.Generic.SortedDictionary<,>.Add(KeyValuePair<TKey, TValue>) | argument 0 -> element of argument -1 | true |
+| System.Collections.Generic.SortedDictionary<,>.Add(KeyValuePair<TKey, TValue>) | property Key of argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.Generic.SortedDictionary<,>.Add(KeyValuePair<TKey, TValue>) | property Value of argument 0 -> property Value of element of argument -1 | true |
+| System.Collections.Generic.SortedDictionary<,>.Add(TKey, TValue) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.Generic.SortedDictionary<,>.Add(TKey, TValue) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.Generic.SortedDictionary<,>.Add(object, object) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.Generic.SortedDictionary<,>.Add(object, object) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.Generic.SortedDictionary<,>.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Generic.SortedDictionary<,>.CopyTo(KeyValuePair<TKey,TValue>[], int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Generic.SortedDictionary<,>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.Generic.SortedDictionary<,>.KeyCollection.Add(TKey) | argument 0 -> element of argument -1 | true |
+| System.Collections.Generic.SortedDictionary<,>.KeyCollection.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Generic.SortedDictionary<,>.KeyCollection.CopyTo(TKey[], int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Generic.SortedDictionary<,>.KeyCollection.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.Generic.SortedDictionary<,>.SortedDictionary(IDictionary<TKey, TValue>) | property Key of element of argument 0 -> property Key of element of return (normal) | true |
+| System.Collections.Generic.SortedDictionary<,>.SortedDictionary(IDictionary<TKey, TValue>) | property Value of element of argument 0 -> property Value of element of return (normal) | true |
+| System.Collections.Generic.SortedDictionary<,>.SortedDictionary(IDictionary<TKey, TValue>, IComparer<TKey>) | property Key of element of argument 0 -> property Key of element of return (normal) | true |
+| System.Collections.Generic.SortedDictionary<,>.SortedDictionary(IDictionary<TKey, TValue>, IComparer<TKey>) | property Value of element of argument 0 -> property Value of element of return (normal) | true |
+| System.Collections.Generic.SortedDictionary<,>.ValueCollection.Add(TValue) | argument 0 -> element of argument -1 | true |
+| System.Collections.Generic.SortedDictionary<,>.ValueCollection.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Generic.SortedDictionary<,>.ValueCollection.CopyTo(TValue[], int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Generic.SortedDictionary<,>.ValueCollection.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.Generic.SortedDictionary<,>.get_Item(TKey) | property Value of element of argument -1 -> return (normal) | true |
+| System.Collections.Generic.SortedDictionary<,>.get_Item(object) | property Value of element of argument -1 -> return (normal) | true |
+| System.Collections.Generic.SortedDictionary<,>.get_Keys() | property Key of element of argument -1 -> element of return (normal) | true |
+| System.Collections.Generic.SortedDictionary<,>.get_Values() | property Value of element of argument -1 -> element of return (normal) | true |
+| System.Collections.Generic.SortedDictionary<,>.set_Item(TKey, TValue) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.Generic.SortedDictionary<,>.set_Item(TKey, TValue) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.Generic.SortedDictionary<,>.set_Item(object, object) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.Generic.SortedDictionary<,>.set_Item(object, object) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.Generic.SortedList<,>.Add(KeyValuePair<TKey, TValue>) | argument 0 -> element of argument -1 | true |
+| System.Collections.Generic.SortedList<,>.Add(KeyValuePair<TKey, TValue>) | property Key of argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.Generic.SortedList<,>.Add(KeyValuePair<TKey, TValue>) | property Value of argument 0 -> property Value of element of argument -1 | true |
+| System.Collections.Generic.SortedList<,>.Add(TKey, TValue) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.Generic.SortedList<,>.Add(TKey, TValue) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.Generic.SortedList<,>.Add(object, object) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.Generic.SortedList<,>.Add(object, object) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.Generic.SortedList<,>.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Generic.SortedList<,>.CopyTo(KeyValuePair<TKey,TValue>[], int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Generic.SortedList<,>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.Generic.SortedList<,>.KeyList.Add(TKey) | argument 0 -> element of argument -1 | true |
+| System.Collections.Generic.SortedList<,>.KeyList.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Generic.SortedList<,>.KeyList.CopyTo(TKey[], int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Generic.SortedList<,>.KeyList.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.Generic.SortedList<,>.KeyList.Insert(int, TKey) | argument 1 -> element of argument -1 | true |
+| System.Collections.Generic.SortedList<,>.KeyList.get_Item(int) | element of argument -1 -> return (normal) | true |
+| System.Collections.Generic.SortedList<,>.KeyList.set_Item(int, TKey) | argument 1 -> element of argument -1 | true |
+| System.Collections.Generic.SortedList<,>.SortedList(IDictionary<TKey, TValue>) | property Key of element of argument 0 -> property Key of element of return (normal) | true |
+| System.Collections.Generic.SortedList<,>.SortedList(IDictionary<TKey, TValue>) | property Value of element of argument 0 -> property Value of element of return (normal) | true |
+| System.Collections.Generic.SortedList<,>.SortedList(IDictionary<TKey, TValue>, IComparer<TKey>) | property Key of element of argument 0 -> property Key of element of return (normal) | true |
+| System.Collections.Generic.SortedList<,>.SortedList(IDictionary<TKey, TValue>, IComparer<TKey>) | property Value of element of argument 0 -> property Value of element of return (normal) | true |
+| System.Collections.Generic.SortedList<,>.ValueList.Add(TValue) | argument 0 -> element of argument -1 | true |
+| System.Collections.Generic.SortedList<,>.ValueList.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Generic.SortedList<,>.ValueList.CopyTo(TValue[], int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Generic.SortedList<,>.ValueList.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.Generic.SortedList<,>.ValueList.Insert(int, TValue) | argument 1 -> element of argument -1 | true |
+| System.Collections.Generic.SortedList<,>.ValueList.get_Item(int) | element of argument -1 -> return (normal) | true |
+| System.Collections.Generic.SortedList<,>.ValueList.set_Item(int, TValue) | argument 1 -> element of argument -1 | true |
+| System.Collections.Generic.SortedList<,>.get_Item(TKey) | property Value of element of argument -1 -> return (normal) | true |
+| System.Collections.Generic.SortedList<,>.get_Item(object) | property Value of element of argument -1 -> return (normal) | true |
+| System.Collections.Generic.SortedList<,>.get_Keys() | property Key of element of argument -1 -> element of return (normal) | true |
+| System.Collections.Generic.SortedList<,>.get_Values() | property Value of element of argument -1 -> element of return (normal) | true |
+| System.Collections.Generic.SortedList<,>.set_Item(TKey, TValue) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.Generic.SortedList<,>.set_Item(TKey, TValue) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.Generic.SortedList<,>.set_Item(object, object) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.Generic.SortedList<,>.set_Item(object, object) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.Generic.SortedSet<>.<Reverse>d__84.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.Generic.SortedSet<>.Add(T) | argument 0 -> element of argument -1 | true |
+| System.Collections.Generic.SortedSet<>.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Generic.SortedSet<>.CopyTo(T[], int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Generic.SortedSet<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.Generic.SortedSet<>.Reverse() | element of argument 0 -> element of return (normal) | true |
+| System.Collections.Generic.Stack<>.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Generic.Stack<>.CopyTo(T[], int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Generic.Stack<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.Generic.Stack<>.Peek() | element of argument -1 -> return (normal) | true |
+| System.Collections.Generic.Stack<>.Pop() | element of argument -1 -> return (normal) | true |
+| System.Collections.Hashtable.Add(object, object) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.Hashtable.Add(object, object) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.Hashtable.Clone() | element of argument 0 -> element of return (normal) | true |
+| System.Collections.Hashtable.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Hashtable.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.Hashtable.Hashtable(IDictionary) | property Key of element of argument 0 -> property Key of element of return (normal) | true |
+| System.Collections.Hashtable.Hashtable(IDictionary) | property Value of element of argument 0 -> property Value of element of return (normal) | true |
+| System.Collections.Hashtable.Hashtable(IDictionary, IEqualityComparer) | property Key of element of argument 0 -> property Key of element of return (normal) | true |
+| System.Collections.Hashtable.Hashtable(IDictionary, IEqualityComparer) | property Value of element of argument 0 -> property Value of element of return (normal) | true |
+| System.Collections.Hashtable.Hashtable(IDictionary, IHashCodeProvider, IComparer) | property Key of element of argument 0 -> property Key of element of return (normal) | true |
+| System.Collections.Hashtable.Hashtable(IDictionary, IHashCodeProvider, IComparer) | property Value of element of argument 0 -> property Value of element of return (normal) | true |
+| System.Collections.Hashtable.Hashtable(IDictionary, float) | property Key of element of argument 0 -> property Key of element of return (normal) | true |
+| System.Collections.Hashtable.Hashtable(IDictionary, float) | property Value of element of argument 0 -> property Value of element of return (normal) | true |
+| System.Collections.Hashtable.Hashtable(IDictionary, float, IEqualityComparer) | property Key of element of argument 0 -> property Key of element of return (normal) | true |
+| System.Collections.Hashtable.Hashtable(IDictionary, float, IEqualityComparer) | property Value of element of argument 0 -> property Value of element of return (normal) | true |
+| System.Collections.Hashtable.Hashtable(IDictionary, float, IHashCodeProvider, IComparer) | property Key of element of argument 0 -> property Key of element of return (normal) | true |
+| System.Collections.Hashtable.Hashtable(IDictionary, float, IHashCodeProvider, IComparer) | property Value of element of argument 0 -> property Value of element of return (normal) | true |
+| System.Collections.Hashtable.KeyCollection.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Hashtable.KeyCollection.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.Hashtable.SyncHashtable.Add(object, object) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.Hashtable.SyncHashtable.Add(object, object) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.Hashtable.SyncHashtable.Clone() | element of argument 0 -> element of return (normal) | true |
+| System.Collections.Hashtable.SyncHashtable.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Hashtable.SyncHashtable.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.Hashtable.SyncHashtable.get_Item(object) | property Value of element of argument -1 -> return (normal) | true |
+| System.Collections.Hashtable.SyncHashtable.get_Keys() | property Key of element of argument -1 -> element of return (normal) | true |
+| System.Collections.Hashtable.SyncHashtable.get_Values() | property Value of element of argument -1 -> element of return (normal) | true |
+| System.Collections.Hashtable.SyncHashtable.set_Item(object, object) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.Hashtable.SyncHashtable.set_Item(object, object) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.Hashtable.ValueCollection.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Hashtable.ValueCollection.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.Hashtable.get_Item(object) | property Value of element of argument -1 -> return (normal) | true |
+| System.Collections.Hashtable.get_Keys() | property Key of element of argument -1 -> element of return (normal) | true |
+| System.Collections.Hashtable.get_Values() | property Value of element of argument -1 -> element of return (normal) | true |
+| System.Collections.Hashtable.set_Item(object, object) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.Hashtable.set_Item(object, object) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.ICollection.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.IDictionary.Add(object, object) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.IDictionary.Add(object, object) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.IDictionary.get_Item(object) | property Value of element of argument -1 -> return (normal) | true |
+| System.Collections.IDictionary.get_Keys() | property Key of element of argument -1 -> element of return (normal) | true |
+| System.Collections.IDictionary.get_Values() | property Value of element of argument -1 -> element of return (normal) | true |
+| System.Collections.IDictionary.set_Item(object, object) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.IDictionary.set_Item(object, object) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.IEnumerable.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.IList.Add(object) | argument 0 -> element of argument -1 | true |
+| System.Collections.IList.Insert(int, object) | argument 1 -> element of argument -1 | true |
+| System.Collections.IList.get_Item(int) | element of argument -1 -> return (normal) | true |
+| System.Collections.IList.set_Item(int, object) | argument 1 -> element of argument -1 | true |
+| System.Collections.ListDictionaryInternal.Add(object, object) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.ListDictionaryInternal.Add(object, object) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.ListDictionaryInternal.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.ListDictionaryInternal.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.ListDictionaryInternal.NodeKeyValueCollection.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.ListDictionaryInternal.NodeKeyValueCollection.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.ListDictionaryInternal.get_Item(object) | property Value of element of argument -1 -> return (normal) | true |
+| System.Collections.ListDictionaryInternal.get_Keys() | property Key of element of argument -1 -> element of return (normal) | true |
+| System.Collections.ListDictionaryInternal.get_Values() | property Value of element of argument -1 -> element of return (normal) | true |
+| System.Collections.ListDictionaryInternal.set_Item(object, object) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.ListDictionaryInternal.set_Item(object, object) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.ObjectModel.Collection<>.Add(T) | argument 0 -> element of argument -1 | true |
+| System.Collections.ObjectModel.Collection<>.Add(object) | argument 0 -> element of argument -1 | true |
+| System.Collections.ObjectModel.Collection<>.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.ObjectModel.Collection<>.CopyTo(T[], int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.ObjectModel.Collection<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.ObjectModel.Collection<>.Insert(int, T) | argument 1 -> element of argument -1 | true |
+| System.Collections.ObjectModel.Collection<>.Insert(int, object) | argument 1 -> element of argument -1 | true |
+| System.Collections.ObjectModel.Collection<>.get_Item(int) | element of argument -1 -> return (normal) | true |
+| System.Collections.ObjectModel.Collection<>.set_Item(int, T) | argument 1 -> element of argument -1 | true |
+| System.Collections.ObjectModel.Collection<>.set_Item(int, object) | argument 1 -> element of argument -1 | true |
+| System.Collections.ObjectModel.KeyedCollection<,>.get_Item(TKey) | element of argument -1 -> return (normal) | true |
+| System.Collections.ObjectModel.ReadOnlyCollection<>.Add(T) | argument 0 -> element of argument -1 | true |
+| System.Collections.ObjectModel.ReadOnlyCollection<>.Add(object) | argument 0 -> element of argument -1 | true |
+| System.Collections.ObjectModel.ReadOnlyCollection<>.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.ObjectModel.ReadOnlyCollection<>.CopyTo(T[], int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.ObjectModel.ReadOnlyCollection<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.ObjectModel.ReadOnlyCollection<>.Insert(int, T) | argument 1 -> element of argument -1 | true |
+| System.Collections.ObjectModel.ReadOnlyCollection<>.Insert(int, object) | argument 1 -> element of argument -1 | true |
+| System.Collections.ObjectModel.ReadOnlyCollection<>.get_Item(int) | element of argument -1 -> return (normal) | true |
+| System.Collections.ObjectModel.ReadOnlyCollection<>.set_Item(int, T) | argument 1 -> element of argument -1 | true |
+| System.Collections.ObjectModel.ReadOnlyCollection<>.set_Item(int, object) | argument 1 -> element of argument -1 | true |
+| System.Collections.ObjectModel.ReadOnlyDictionary<,>.Add(KeyValuePair<TKey, TValue>) | argument 0 -> element of argument -1 | true |
+| System.Collections.ObjectModel.ReadOnlyDictionary<,>.Add(KeyValuePair<TKey, TValue>) | property Key of argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.ObjectModel.ReadOnlyDictionary<,>.Add(KeyValuePair<TKey, TValue>) | property Value of argument 0 -> property Value of element of argument -1 | true |
+| System.Collections.ObjectModel.ReadOnlyDictionary<,>.Add(TKey, TValue) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.ObjectModel.ReadOnlyDictionary<,>.Add(TKey, TValue) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.ObjectModel.ReadOnlyDictionary<,>.Add(object, object) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.ObjectModel.ReadOnlyDictionary<,>.Add(object, object) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.ObjectModel.ReadOnlyDictionary<,>.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.ObjectModel.ReadOnlyDictionary<,>.CopyTo(KeyValuePair<TKey,TValue>[], int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.ObjectModel.ReadOnlyDictionary<,>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.ObjectModel.ReadOnlyDictionary<,>.KeyCollection.Add(TKey) | argument 0 -> element of argument -1 | true |
+| System.Collections.ObjectModel.ReadOnlyDictionary<,>.KeyCollection.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.ObjectModel.ReadOnlyDictionary<,>.KeyCollection.CopyTo(TKey[], int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.ObjectModel.ReadOnlyDictionary<,>.KeyCollection.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.ObjectModel.ReadOnlyDictionary<,>.ReadOnlyDictionary(IDictionary<TKey, TValue>) | property Key of element of argument 0 -> property Key of element of return (normal) | true |
+| System.Collections.ObjectModel.ReadOnlyDictionary<,>.ReadOnlyDictionary(IDictionary<TKey, TValue>) | property Value of element of argument 0 -> property Value of element of return (normal) | true |
+| System.Collections.ObjectModel.ReadOnlyDictionary<,>.ValueCollection.Add(TValue) | argument 0 -> element of argument -1 | true |
+| System.Collections.ObjectModel.ReadOnlyDictionary<,>.ValueCollection.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.ObjectModel.ReadOnlyDictionary<,>.ValueCollection.CopyTo(TValue[], int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.ObjectModel.ReadOnlyDictionary<,>.ValueCollection.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.ObjectModel.ReadOnlyDictionary<,>.get_Item(TKey) | property Value of element of argument -1 -> return (normal) | true |
+| System.Collections.ObjectModel.ReadOnlyDictionary<,>.get_Item(object) | property Value of element of argument -1 -> return (normal) | true |
+| System.Collections.ObjectModel.ReadOnlyDictionary<,>.get_Keys() | property Key of element of argument -1 -> element of return (normal) | true |
+| System.Collections.ObjectModel.ReadOnlyDictionary<,>.get_Values() | property Value of element of argument -1 -> element of return (normal) | true |
+| System.Collections.ObjectModel.ReadOnlyDictionary<,>.set_Item(TKey, TValue) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.ObjectModel.ReadOnlyDictionary<,>.set_Item(TKey, TValue) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.ObjectModel.ReadOnlyDictionary<,>.set_Item(object, object) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.ObjectModel.ReadOnlyDictionary<,>.set_Item(object, object) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.Queue.Clone() | element of argument 0 -> element of return (normal) | true |
+| System.Collections.Queue.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Queue.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.Queue.Peek() | element of argument -1 -> return (normal) | true |
+| System.Collections.Queue.SynchronizedQueue.Clone() | element of argument 0 -> element of return (normal) | true |
+| System.Collections.Queue.SynchronizedQueue.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Queue.SynchronizedQueue.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.Queue.SynchronizedQueue.Peek() | element of argument -1 -> return (normal) | true |
+| System.Collections.ReadOnlyCollectionBase.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.ReadOnlyCollectionBase.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.SortedList.Add(object, object) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.SortedList.Add(object, object) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.SortedList.Clone() | element of argument 0 -> element of return (normal) | true |
+| System.Collections.SortedList.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.SortedList.GetByIndex(int) | property Value of element of argument -1 -> return (normal) | true |
+| System.Collections.SortedList.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.SortedList.GetValueList() | property Value of element of argument -1 -> element of return (normal) | true |
+| System.Collections.SortedList.KeyList.Add(object) | argument 0 -> element of argument -1 | true |
+| System.Collections.SortedList.KeyList.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.SortedList.KeyList.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.SortedList.KeyList.Insert(int, object) | argument 1 -> element of argument -1 | true |
+| System.Collections.SortedList.KeyList.get_Item(int) | element of argument -1 -> return (normal) | true |
+| System.Collections.SortedList.KeyList.set_Item(int, object) | argument 1 -> element of argument -1 | true |
+| System.Collections.SortedList.SortedList(IDictionary) | property Key of element of argument 0 -> property Key of element of return (normal) | true |
+| System.Collections.SortedList.SortedList(IDictionary) | property Value of element of argument 0 -> property Value of element of return (normal) | true |
+| System.Collections.SortedList.SortedList(IDictionary, IComparer) | property Key of element of argument 0 -> property Key of element of return (normal) | true |
+| System.Collections.SortedList.SortedList(IDictionary, IComparer) | property Value of element of argument 0 -> property Value of element of return (normal) | true |
+| System.Collections.SortedList.SyncSortedList.Add(object, object) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.SortedList.SyncSortedList.Add(object, object) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.SortedList.SyncSortedList.Clone() | element of argument 0 -> element of return (normal) | true |
+| System.Collections.SortedList.SyncSortedList.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.SortedList.SyncSortedList.GetByIndex(int) | property Value of element of argument -1 -> return (normal) | true |
+| System.Collections.SortedList.SyncSortedList.GetValueList() | property Value of element of argument -1 -> element of return (normal) | true |
+| System.Collections.SortedList.SyncSortedList.get_Item(object) | property Value of element of argument -1 -> return (normal) | true |
+| System.Collections.SortedList.SyncSortedList.set_Item(object, object) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.SortedList.SyncSortedList.set_Item(object, object) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.SortedList.ValueList.Add(object) | argument 0 -> element of argument -1 | true |
+| System.Collections.SortedList.ValueList.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.SortedList.ValueList.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.SortedList.ValueList.Insert(int, object) | argument 1 -> element of argument -1 | true |
+| System.Collections.SortedList.ValueList.get_Item(int) | element of argument -1 -> return (normal) | true |
+| System.Collections.SortedList.ValueList.set_Item(int, object) | argument 1 -> element of argument -1 | true |
+| System.Collections.SortedList.get_Item(object) | property Value of element of argument -1 -> return (normal) | true |
+| System.Collections.SortedList.get_Keys() | property Key of element of argument -1 -> element of return (normal) | true |
+| System.Collections.SortedList.get_Values() | property Value of element of argument -1 -> element of return (normal) | true |
+| System.Collections.SortedList.set_Item(object, object) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.SortedList.set_Item(object, object) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.Specialized.HybridDictionary.Add(object, object) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.Specialized.HybridDictionary.Add(object, object) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.Specialized.HybridDictionary.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Specialized.HybridDictionary.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.Specialized.HybridDictionary.get_Item(object) | property Value of element of argument -1 -> return (normal) | true |
+| System.Collections.Specialized.HybridDictionary.get_Keys() | property Key of element of argument -1 -> element of return (normal) | true |
+| System.Collections.Specialized.HybridDictionary.get_Values() | property Value of element of argument -1 -> element of return (normal) | true |
+| System.Collections.Specialized.HybridDictionary.set_Item(object, object) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.Specialized.HybridDictionary.set_Item(object, object) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.Specialized.IOrderedDictionary.get_Item(int) | property Value of element of argument -1 -> return (normal) | true |
+| System.Collections.Specialized.IOrderedDictionary.set_Item(int, object) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.Specialized.IOrderedDictionary.set_Item(int, object) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.Specialized.ListDictionary.Add(object, object) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.Specialized.ListDictionary.Add(object, object) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.Specialized.ListDictionary.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Specialized.ListDictionary.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.Specialized.ListDictionary.NodeKeyValueCollection.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Specialized.ListDictionary.NodeKeyValueCollection.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.Specialized.ListDictionary.get_Item(object) | property Value of element of argument -1 -> return (normal) | true |
+| System.Collections.Specialized.ListDictionary.get_Keys() | property Key of element of argument -1 -> element of return (normal) | true |
+| System.Collections.Specialized.ListDictionary.get_Values() | property Value of element of argument -1 -> element of return (normal) | true |
+| System.Collections.Specialized.ListDictionary.set_Item(object, object) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.Specialized.ListDictionary.set_Item(object, object) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.Specialized.NameObjectCollectionBase.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Specialized.NameObjectCollectionBase.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.Specialized.NameObjectCollectionBase.KeysCollection.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Specialized.NameObjectCollectionBase.KeysCollection.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.Specialized.NameValueCollection.Add(NameValueCollection) | argument 0 -> element of argument -1 | true |
+| System.Collections.Specialized.NameValueCollection.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Specialized.OrderedDictionary.Add(object, object) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.Specialized.OrderedDictionary.Add(object, object) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.Specialized.OrderedDictionary.AsReadOnly() | element of argument 0 -> element of return (normal) | true |
+| System.Collections.Specialized.OrderedDictionary.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Specialized.OrderedDictionary.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.Specialized.OrderedDictionary.OrderedDictionaryKeyValueCollection.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Specialized.OrderedDictionary.OrderedDictionaryKeyValueCollection.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.Specialized.OrderedDictionary.get_Item(int) | property Value of element of argument -1 -> return (normal) | true |
+| System.Collections.Specialized.OrderedDictionary.get_Item(object) | property Value of element of argument -1 -> return (normal) | true |
+| System.Collections.Specialized.OrderedDictionary.get_Keys() | property Key of element of argument -1 -> element of return (normal) | true |
+| System.Collections.Specialized.OrderedDictionary.get_Values() | property Value of element of argument -1 -> element of return (normal) | true |
+| System.Collections.Specialized.OrderedDictionary.set_Item(int, object) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.Specialized.OrderedDictionary.set_Item(int, object) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.Specialized.OrderedDictionary.set_Item(object, object) | argument 0 -> property Key of element of argument -1 | true |
+| System.Collections.Specialized.OrderedDictionary.set_Item(object, object) | argument 1 -> property Value of element of argument -1 | true |
+| System.Collections.Specialized.ReadOnlyList.Add(object) | argument 0 -> element of argument -1 | true |
+| System.Collections.Specialized.ReadOnlyList.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Specialized.ReadOnlyList.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.Specialized.ReadOnlyList.Insert(int, object) | argument 1 -> element of argument -1 | true |
+| System.Collections.Specialized.ReadOnlyList.get_Item(int) | element of argument -1 -> return (normal) | true |
+| System.Collections.Specialized.ReadOnlyList.set_Item(int, object) | argument 1 -> element of argument -1 | true |
+| System.Collections.Specialized.StringCollection.Add(object) | argument 0 -> element of argument -1 | true |
+| System.Collections.Specialized.StringCollection.Add(string) | argument 0 -> element of argument -1 | true |
+| System.Collections.Specialized.StringCollection.AddRange(String[]) | element of argument 0 -> element of argument -1 | true |
+| System.Collections.Specialized.StringCollection.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Specialized.StringCollection.CopyTo(String[], int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Specialized.StringCollection.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.Specialized.StringCollection.Insert(int, object) | argument 1 -> element of argument -1 | true |
+| System.Collections.Specialized.StringCollection.Insert(int, string) | argument 1 -> element of argument -1 | true |
+| System.Collections.Specialized.StringCollection.get_Item(int) | element of argument -1 -> return (normal) | true |
+| System.Collections.Specialized.StringCollection.set_Item(int, object) | argument 1 -> element of argument -1 | true |
+| System.Collections.Specialized.StringCollection.set_Item(int, string) | argument 1 -> element of argument -1 | true |
+| System.Collections.Specialized.StringDictionary.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.Stack.Clone() | element of argument 0 -> element of return (normal) | true |
+| System.Collections.Stack.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Stack.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.Stack.Peek() | element of argument -1 -> return (normal) | true |
+| System.Collections.Stack.Pop() | element of argument -1 -> return (normal) | true |
+| System.Collections.Stack.SyncStack.Clone() | element of argument 0 -> element of return (normal) | true |
+| System.Collections.Stack.SyncStack.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Collections.Stack.SyncStack.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Collections.Stack.SyncStack.Peek() | element of argument -1 -> return (normal) | true |
+| System.Collections.Stack.SyncStack.Pop() | element of argument -1 -> return (normal) | true |
+| System.ComponentModel.AttributeCollection.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.ComponentModel.AttributeCollection.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.ComponentModel.BindingList<>.Find(PropertyDescriptor, object) | element of argument -1 -> return (normal) | true |
+| System.ComponentModel.Design.DesignerCollection.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.ComponentModel.Design.DesignerCollection.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.ComponentModel.Design.DesignerOptionService.DesignerOptionCollection.Add(object) | argument 0 -> element of argument -1 | true |
+| System.ComponentModel.Design.DesignerOptionService.DesignerOptionCollection.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.ComponentModel.Design.DesignerOptionService.DesignerOptionCollection.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.ComponentModel.Design.DesignerOptionService.DesignerOptionCollection.Insert(int, object) | argument 1 -> element of argument -1 | true |
+| System.ComponentModel.Design.DesignerOptionService.DesignerOptionCollection.get_Item(int) | element of argument -1 -> return (normal) | true |
+| System.ComponentModel.Design.DesignerOptionService.DesignerOptionCollection.get_Item(string) | element of argument -1 -> return (normal) | true |
+| System.ComponentModel.Design.DesignerOptionService.DesignerOptionCollection.set_Item(int, object) | argument 1 -> element of argument -1 | true |
+| System.ComponentModel.Design.DesignerVerbCollection.Add(DesignerVerb) | argument 0 -> element of argument -1 | true |
+| System.ComponentModel.Design.DesignerVerbCollection.AddRange(DesignerVerbCollection) | element of argument 0 -> element of argument -1 | true |
+| System.ComponentModel.Design.DesignerVerbCollection.AddRange(DesignerVerb[]) | element of argument 0 -> element of argument -1 | true |
+| System.ComponentModel.Design.DesignerVerbCollection.CopyTo(DesignerVerb[], int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.ComponentModel.Design.DesignerVerbCollection.Insert(int, DesignerVerb) | argument 1 -> element of argument -1 | true |
+| System.ComponentModel.Design.DesignerVerbCollection.get_Item(int) | element of argument -1 -> return (normal) | true |
+| System.ComponentModel.Design.DesignerVerbCollection.set_Item(int, DesignerVerb) | argument 1 -> element of argument -1 | true |
+| System.ComponentModel.EventDescriptorCollection.Add(EventDescriptor) | argument 0 -> element of argument -1 | true |
+| System.ComponentModel.EventDescriptorCollection.Add(object) | argument 0 -> element of argument -1 | true |
+| System.ComponentModel.EventDescriptorCollection.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.ComponentModel.EventDescriptorCollection.Find(string, bool) | element of argument -1 -> return (normal) | true |
+| System.ComponentModel.EventDescriptorCollection.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.ComponentModel.EventDescriptorCollection.Insert(int, EventDescriptor) | argument 1 -> element of argument -1 | true |
+| System.ComponentModel.EventDescriptorCollection.Insert(int, object) | argument 1 -> element of argument -1 | true |
+| System.ComponentModel.EventDescriptorCollection.get_Item(int) | element of argument -1 -> return (normal) | true |
+| System.ComponentModel.EventDescriptorCollection.get_Item(string) | element of argument -1 -> return (normal) | true |
+| System.ComponentModel.EventDescriptorCollection.set_Item(int, object) | argument 1 -> element of argument -1 | true |
+| System.ComponentModel.IBindingList.Find(PropertyDescriptor, object) | element of argument -1 -> return (normal) | true |
+| System.ComponentModel.ListSortDescriptionCollection.Add(object) | argument 0 -> element of argument -1 | true |
+| System.ComponentModel.ListSortDescriptionCollection.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.ComponentModel.ListSortDescriptionCollection.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.ComponentModel.ListSortDescriptionCollection.Insert(int, object) | argument 1 -> element of argument -1 | true |
+| System.ComponentModel.ListSortDescriptionCollection.get_Item(int) | element of argument -1 -> return (normal) | true |
+| System.ComponentModel.ListSortDescriptionCollection.set_Item(int, ListSortDescription) | argument 1 -> element of argument -1 | true |
+| System.ComponentModel.ListSortDescriptionCollection.set_Item(int, object) | argument 1 -> element of argument -1 | true |
+| System.ComponentModel.PropertyDescriptorCollection.Add(PropertyDescriptor) | argument 0 -> element of argument -1 | true |
+| System.ComponentModel.PropertyDescriptorCollection.Add(PropertyDescriptor) | property Key of argument 0 -> property Key of element of argument -1 | true |
+| System.ComponentModel.PropertyDescriptorCollection.Add(PropertyDescriptor) | property Value of argument 0 -> property Value of element of argument -1 | true |
+| System.ComponentModel.PropertyDescriptorCollection.Add(object) | argument 0 -> element of argument -1 | true |
+| System.ComponentModel.PropertyDescriptorCollection.Add(object) | property Key of argument 0 -> property Key of element of argument -1 | true |
+| System.ComponentModel.PropertyDescriptorCollection.Add(object) | property Value of argument 0 -> property Value of element of argument -1 | true |
+| System.ComponentModel.PropertyDescriptorCollection.Add(object, object) | argument 0 -> property Key of element of argument -1 | true |
+| System.ComponentModel.PropertyDescriptorCollection.Add(object, object) | argument 1 -> property Value of element of argument -1 | true |
+| System.ComponentModel.PropertyDescriptorCollection.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.ComponentModel.PropertyDescriptorCollection.Find(string, bool) | element of argument -1 -> return (normal) | true |
+| System.ComponentModel.PropertyDescriptorCollection.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.ComponentModel.PropertyDescriptorCollection.Insert(int, PropertyDescriptor) | argument 1 -> element of argument -1 | true |
+| System.ComponentModel.PropertyDescriptorCollection.Insert(int, object) | argument 1 -> element of argument -1 | true |
+| System.ComponentModel.PropertyDescriptorCollection.PropertyDescriptorCollection(PropertyDescriptor[]) | property Key of element of argument 0 -> property Key of element of return (normal) | true |
+| System.ComponentModel.PropertyDescriptorCollection.PropertyDescriptorCollection(PropertyDescriptor[]) | property Value of element of argument 0 -> property Value of element of return (normal) | true |
+| System.ComponentModel.PropertyDescriptorCollection.PropertyDescriptorCollection(PropertyDescriptor[], bool) | property Key of element of argument 0 -> property Key of element of return (normal) | true |
+| System.ComponentModel.PropertyDescriptorCollection.PropertyDescriptorCollection(PropertyDescriptor[], bool) | property Value of element of argument 0 -> property Value of element of return (normal) | true |
+| System.ComponentModel.PropertyDescriptorCollection.get_Item(int) | element of argument -1 -> return (normal) | true |
+| System.ComponentModel.PropertyDescriptorCollection.get_Item(int) | property Value of element of argument -1 -> return (normal) | true |
+| System.ComponentModel.PropertyDescriptorCollection.get_Item(object) | element of argument -1 -> return (normal) | true |
+| System.ComponentModel.PropertyDescriptorCollection.get_Item(object) | property Value of element of argument -1 -> return (normal) | true |
+| System.ComponentModel.PropertyDescriptorCollection.get_Item(string) | element of argument -1 -> return (normal) | true |
+| System.ComponentModel.PropertyDescriptorCollection.get_Item(string) | property Value of element of argument -1 -> return (normal) | true |
+| System.ComponentModel.PropertyDescriptorCollection.get_Keys() | property Key of element of argument -1 -> element of return (normal) | true |
+| System.ComponentModel.PropertyDescriptorCollection.get_Values() | property Value of element of argument -1 -> element of return (normal) | true |
+| System.ComponentModel.PropertyDescriptorCollection.set_Item(int, object) | argument 0 -> property Key of element of argument -1 | true |
+| System.ComponentModel.PropertyDescriptorCollection.set_Item(int, object) | argument 1 -> element of argument -1 | true |
+| System.ComponentModel.PropertyDescriptorCollection.set_Item(int, object) | argument 1 -> property Value of element of argument -1 | true |
+| System.ComponentModel.PropertyDescriptorCollection.set_Item(object, object) | argument 0 -> property Key of element of argument -1 | true |
+| System.ComponentModel.PropertyDescriptorCollection.set_Item(object, object) | argument 1 -> element of argument -1 | true |
+| System.ComponentModel.PropertyDescriptorCollection.set_Item(object, object) | argument 1 -> property Value of element of argument -1 | true |
+| System.ComponentModel.TypeConverter.StandardValuesCollection.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.ComponentModel.TypeConverter.StandardValuesCollection.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.ConsolePal.UnixConsoleStream.Read(Byte[], int, int) | argument -1 -> return (out parameter 0) | false |
+| System.ConsolePal.UnixConsoleStream.Write(Byte[], int, int) | argument 0 -> argument -1 | false |
+| System.Convert.ChangeType(object, Type) | argument 0 -> return (normal) | false |
+| System.Convert.ChangeType(object, Type, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.ChangeType(object, TypeCode) | argument 0 -> return (normal) | false |
+| System.Convert.ChangeType(object, TypeCode, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.FromBase64CharArray(Char[], int, int) | argument 0 -> return (normal) | false |
+| System.Convert.FromBase64String(string) | argument 0 -> return (normal) | false |
+| System.Convert.FromHexString(ReadOnlySpan<Char>) | argument 0 -> return (normal) | false |
+| System.Convert.FromHexString(string) | argument 0 -> return (normal) | false |
+| System.Convert.GetTypeCode(object) | argument 0 -> return (normal) | false |
+| System.Convert.IsDBNull(object) | argument 0 -> return (normal) | false |
+| System.Convert.ToBase64CharArray(Byte[], int, int, Char[], int) | argument 0 -> return (normal) | false |
+| System.Convert.ToBase64CharArray(Byte[], int, int, Char[], int, Base64FormattingOptions) | argument 0 -> return (normal) | false |
+| System.Convert.ToBase64String(Byte[]) | argument 0 -> return (normal) | false |
+| System.Convert.ToBase64String(Byte[], Base64FormattingOptions) | argument 0 -> return (normal) | false |
+| System.Convert.ToBase64String(Byte[], int, int) | argument 0 -> return (normal) | false |
+| System.Convert.ToBase64String(Byte[], int, int, Base64FormattingOptions) | argument 0 -> return (normal) | false |
+| System.Convert.ToBase64String(ReadOnlySpan<Byte>, Base64FormattingOptions) | argument 0 -> return (normal) | false |
+| System.Convert.ToBoolean(DateTime) | argument 0 -> return (normal) | false |
+| System.Convert.ToBoolean(bool) | argument 0 -> return (normal) | false |
+| System.Convert.ToBoolean(byte) | argument 0 -> return (normal) | false |
+| System.Convert.ToBoolean(char) | argument 0 -> return (normal) | false |
+| System.Convert.ToBoolean(decimal) | argument 0 -> return (normal) | false |
+| System.Convert.ToBoolean(double) | argument 0 -> return (normal) | false |
+| System.Convert.ToBoolean(float) | argument 0 -> return (normal) | false |
+| System.Convert.ToBoolean(int) | argument 0 -> return (normal) | false |
+| System.Convert.ToBoolean(long) | argument 0 -> return (normal) | false |
+| System.Convert.ToBoolean(object) | argument 0 -> return (normal) | false |
+| System.Convert.ToBoolean(object, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.ToBoolean(sbyte) | argument 0 -> return (normal) | false |
+| System.Convert.ToBoolean(short) | argument 0 -> return (normal) | false |
+| System.Convert.ToBoolean(string) | argument 0 -> return (normal) | false |
+| System.Convert.ToBoolean(string, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.ToBoolean(uint) | argument 0 -> return (normal) | false |
+| System.Convert.ToBoolean(ulong) | argument 0 -> return (normal) | false |
+| System.Convert.ToBoolean(ushort) | argument 0 -> return (normal) | false |
+| System.Convert.ToByte(DateTime) | argument 0 -> return (normal) | false |
+| System.Convert.ToByte(bool) | argument 0 -> return (normal) | false |
+| System.Convert.ToByte(byte) | argument 0 -> return (normal) | false |
+| System.Convert.ToByte(char) | argument 0 -> return (normal) | false |
+| System.Convert.ToByte(decimal) | argument 0 -> return (normal) | false |
+| System.Convert.ToByte(double) | argument 0 -> return (normal) | false |
+| System.Convert.ToByte(float) | argument 0 -> return (normal) | false |
+| System.Convert.ToByte(int) | argument 0 -> return (normal) | false |
+| System.Convert.ToByte(long) | argument 0 -> return (normal) | false |
+| System.Convert.ToByte(object) | argument 0 -> return (normal) | false |
+| System.Convert.ToByte(object, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.ToByte(sbyte) | argument 0 -> return (normal) | false |
+| System.Convert.ToByte(short) | argument 0 -> return (normal) | false |
+| System.Convert.ToByte(string) | argument 0 -> return (normal) | false |
+| System.Convert.ToByte(string, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.ToByte(string, int) | argument 0 -> return (normal) | false |
+| System.Convert.ToByte(uint) | argument 0 -> return (normal) | false |
+| System.Convert.ToByte(ulong) | argument 0 -> return (normal) | false |
+| System.Convert.ToByte(ushort) | argument 0 -> return (normal) | false |
+| System.Convert.ToChar(DateTime) | argument 0 -> return (normal) | false |
+| System.Convert.ToChar(bool) | argument 0 -> return (normal) | false |
+| System.Convert.ToChar(byte) | argument 0 -> return (normal) | false |
+| System.Convert.ToChar(char) | argument 0 -> return (normal) | false |
+| System.Convert.ToChar(decimal) | argument 0 -> return (normal) | false |
+| System.Convert.ToChar(double) | argument 0 -> return (normal) | false |
+| System.Convert.ToChar(float) | argument 0 -> return (normal) | false |
+| System.Convert.ToChar(int) | argument 0 -> return (normal) | false |
+| System.Convert.ToChar(long) | argument 0 -> return (normal) | false |
+| System.Convert.ToChar(object) | argument 0 -> return (normal) | false |
+| System.Convert.ToChar(object, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.ToChar(sbyte) | argument 0 -> return (normal) | false |
+| System.Convert.ToChar(short) | argument 0 -> return (normal) | false |
+| System.Convert.ToChar(string) | argument 0 -> return (normal) | false |
+| System.Convert.ToChar(string, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.ToChar(uint) | argument 0 -> return (normal) | false |
+| System.Convert.ToChar(ulong) | argument 0 -> return (normal) | false |
+| System.Convert.ToChar(ushort) | argument 0 -> return (normal) | false |
+| System.Convert.ToDateTime(DateTime) | argument 0 -> return (normal) | false |
+| System.Convert.ToDateTime(bool) | argument 0 -> return (normal) | false |
+| System.Convert.ToDateTime(byte) | argument 0 -> return (normal) | false |
+| System.Convert.ToDateTime(char) | argument 0 -> return (normal) | false |
+| System.Convert.ToDateTime(decimal) | argument 0 -> return (normal) | false |
+| System.Convert.ToDateTime(double) | argument 0 -> return (normal) | false |
+| System.Convert.ToDateTime(float) | argument 0 -> return (normal) | false |
+| System.Convert.ToDateTime(int) | argument 0 -> return (normal) | false |
+| System.Convert.ToDateTime(long) | argument 0 -> return (normal) | false |
+| System.Convert.ToDateTime(object) | argument 0 -> return (normal) | false |
+| System.Convert.ToDateTime(object, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.ToDateTime(sbyte) | argument 0 -> return (normal) | false |
+| System.Convert.ToDateTime(short) | argument 0 -> return (normal) | false |
+| System.Convert.ToDateTime(string) | argument 0 -> return (normal) | false |
+| System.Convert.ToDateTime(string, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.ToDateTime(uint) | argument 0 -> return (normal) | false |
+| System.Convert.ToDateTime(ulong) | argument 0 -> return (normal) | false |
+| System.Convert.ToDateTime(ushort) | argument 0 -> return (normal) | false |
+| System.Convert.ToDecimal(DateTime) | argument 0 -> return (normal) | false |
+| System.Convert.ToDecimal(bool) | argument 0 -> return (normal) | false |
+| System.Convert.ToDecimal(byte) | argument 0 -> return (normal) | false |
+| System.Convert.ToDecimal(char) | argument 0 -> return (normal) | false |
+| System.Convert.ToDecimal(decimal) | argument 0 -> return (normal) | false |
+| System.Convert.ToDecimal(double) | argument 0 -> return (normal) | false |
+| System.Convert.ToDecimal(float) | argument 0 -> return (normal) | false |
+| System.Convert.ToDecimal(int) | argument 0 -> return (normal) | false |
+| System.Convert.ToDecimal(long) | argument 0 -> return (normal) | false |
+| System.Convert.ToDecimal(object) | argument 0 -> return (normal) | false |
+| System.Convert.ToDecimal(object, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.ToDecimal(sbyte) | argument 0 -> return (normal) | false |
+| System.Convert.ToDecimal(short) | argument 0 -> return (normal) | false |
+| System.Convert.ToDecimal(string) | argument 0 -> return (normal) | false |
+| System.Convert.ToDecimal(string, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.ToDecimal(uint) | argument 0 -> return (normal) | false |
+| System.Convert.ToDecimal(ulong) | argument 0 -> return (normal) | false |
+| System.Convert.ToDecimal(ushort) | argument 0 -> return (normal) | false |
+| System.Convert.ToDouble(DateTime) | argument 0 -> return (normal) | false |
+| System.Convert.ToDouble(bool) | argument 0 -> return (normal) | false |
+| System.Convert.ToDouble(byte) | argument 0 -> return (normal) | false |
+| System.Convert.ToDouble(char) | argument 0 -> return (normal) | false |
+| System.Convert.ToDouble(decimal) | argument 0 -> return (normal) | false |
+| System.Convert.ToDouble(double) | argument 0 -> return (normal) | false |
+| System.Convert.ToDouble(float) | argument 0 -> return (normal) | false |
+| System.Convert.ToDouble(int) | argument 0 -> return (normal) | false |
+| System.Convert.ToDouble(long) | argument 0 -> return (normal) | false |
+| System.Convert.ToDouble(object) | argument 0 -> return (normal) | false |
+| System.Convert.ToDouble(object, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.ToDouble(sbyte) | argument 0 -> return (normal) | false |
+| System.Convert.ToDouble(short) | argument 0 -> return (normal) | false |
+| System.Convert.ToDouble(string) | argument 0 -> return (normal) | false |
+| System.Convert.ToDouble(string, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.ToDouble(uint) | argument 0 -> return (normal) | false |
+| System.Convert.ToDouble(ulong) | argument 0 -> return (normal) | false |
+| System.Convert.ToDouble(ushort) | argument 0 -> return (normal) | false |
+| System.Convert.ToHexString(Byte[]) | argument 0 -> return (normal) | false |
+| System.Convert.ToHexString(Byte[], int, int) | argument 0 -> return (normal) | false |
+| System.Convert.ToHexString(ReadOnlySpan<Byte>) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt16(DateTime) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt16(bool) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt16(byte) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt16(char) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt16(decimal) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt16(double) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt16(float) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt16(int) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt16(long) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt16(object) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt16(object, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt16(sbyte) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt16(short) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt16(string) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt16(string, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt16(string, int) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt16(uint) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt16(ulong) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt16(ushort) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt32(DateTime) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt32(bool) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt32(byte) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt32(char) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt32(decimal) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt32(double) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt32(float) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt32(int) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt32(long) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt32(object) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt32(object, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt32(sbyte) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt32(short) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt32(string) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt32(string, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt32(string, int) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt32(uint) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt32(ulong) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt32(ushort) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt64(DateTime) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt64(bool) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt64(byte) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt64(char) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt64(decimal) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt64(double) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt64(float) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt64(int) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt64(long) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt64(object) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt64(object, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt64(sbyte) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt64(short) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt64(string) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt64(string, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt64(string, int) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt64(uint) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt64(ulong) | argument 0 -> return (normal) | false |
+| System.Convert.ToInt64(ushort) | argument 0 -> return (normal) | false |
+| System.Convert.ToSByte(DateTime) | argument 0 -> return (normal) | false |
+| System.Convert.ToSByte(bool) | argument 0 -> return (normal) | false |
+| System.Convert.ToSByte(byte) | argument 0 -> return (normal) | false |
+| System.Convert.ToSByte(char) | argument 0 -> return (normal) | false |
+| System.Convert.ToSByte(decimal) | argument 0 -> return (normal) | false |
+| System.Convert.ToSByte(double) | argument 0 -> return (normal) | false |
+| System.Convert.ToSByte(float) | argument 0 -> return (normal) | false |
+| System.Convert.ToSByte(int) | argument 0 -> return (normal) | false |
+| System.Convert.ToSByte(long) | argument 0 -> return (normal) | false |
+| System.Convert.ToSByte(object) | argument 0 -> return (normal) | false |
+| System.Convert.ToSByte(object, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.ToSByte(sbyte) | argument 0 -> return (normal) | false |
+| System.Convert.ToSByte(short) | argument 0 -> return (normal) | false |
+| System.Convert.ToSByte(string) | argument 0 -> return (normal) | false |
+| System.Convert.ToSByte(string, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.ToSByte(string, int) | argument 0 -> return (normal) | false |
+| System.Convert.ToSByte(uint) | argument 0 -> return (normal) | false |
+| System.Convert.ToSByte(ulong) | argument 0 -> return (normal) | false |
+| System.Convert.ToSByte(ushort) | argument 0 -> return (normal) | false |
+| System.Convert.ToSingle(DateTime) | argument 0 -> return (normal) | false |
+| System.Convert.ToSingle(bool) | argument 0 -> return (normal) | false |
+| System.Convert.ToSingle(byte) | argument 0 -> return (normal) | false |
+| System.Convert.ToSingle(char) | argument 0 -> return (normal) | false |
+| System.Convert.ToSingle(decimal) | argument 0 -> return (normal) | false |
+| System.Convert.ToSingle(double) | argument 0 -> return (normal) | false |
+| System.Convert.ToSingle(float) | argument 0 -> return (normal) | false |
+| System.Convert.ToSingle(int) | argument 0 -> return (normal) | false |
+| System.Convert.ToSingle(long) | argument 0 -> return (normal) | false |
+| System.Convert.ToSingle(object) | argument 0 -> return (normal) | false |
+| System.Convert.ToSingle(object, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.ToSingle(sbyte) | argument 0 -> return (normal) | false |
+| System.Convert.ToSingle(short) | argument 0 -> return (normal) | false |
+| System.Convert.ToSingle(string) | argument 0 -> return (normal) | false |
+| System.Convert.ToSingle(string, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.ToSingle(uint) | argument 0 -> return (normal) | false |
+| System.Convert.ToSingle(ulong) | argument 0 -> return (normal) | false |
+| System.Convert.ToSingle(ushort) | argument 0 -> return (normal) | false |
+| System.Convert.ToString(DateTime) | argument 0 -> return (normal) | false |
+| System.Convert.ToString(DateTime, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.ToString(bool) | argument 0 -> return (normal) | false |
+| System.Convert.ToString(bool, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.ToString(byte) | argument 0 -> return (normal) | false |
+| System.Convert.ToString(byte, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.ToString(byte, int) | argument 0 -> return (normal) | false |
+| System.Convert.ToString(char) | argument 0 -> return (normal) | false |
+| System.Convert.ToString(char, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.ToString(decimal) | argument 0 -> return (normal) | false |
+| System.Convert.ToString(decimal, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.ToString(double) | argument 0 -> return (normal) | false |
+| System.Convert.ToString(double, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.ToString(float) | argument 0 -> return (normal) | false |
+| System.Convert.ToString(float, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.ToString(int) | argument 0 -> return (normal) | false |
+| System.Convert.ToString(int, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.ToString(int, int) | argument 0 -> return (normal) | false |
+| System.Convert.ToString(long) | argument 0 -> return (normal) | false |
+| System.Convert.ToString(long, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.ToString(long, int) | argument 0 -> return (normal) | false |
+| System.Convert.ToString(object) | argument 0 -> return (normal) | false |
+| System.Convert.ToString(object, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.ToString(sbyte) | argument 0 -> return (normal) | false |
+| System.Convert.ToString(sbyte, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.ToString(short) | argument 0 -> return (normal) | false |
+| System.Convert.ToString(short, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.ToString(short, int) | argument 0 -> return (normal) | false |
+| System.Convert.ToString(string) | argument 0 -> return (normal) | false |
+| System.Convert.ToString(string, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.ToString(uint) | argument 0 -> return (normal) | false |
+| System.Convert.ToString(uint, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.ToString(ulong) | argument 0 -> return (normal) | false |
+| System.Convert.ToString(ulong, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.ToString(ushort) | argument 0 -> return (normal) | false |
+| System.Convert.ToString(ushort, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt16(DateTime) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt16(bool) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt16(byte) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt16(char) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt16(decimal) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt16(double) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt16(float) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt16(int) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt16(long) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt16(object) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt16(object, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt16(sbyte) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt16(short) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt16(string) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt16(string, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt16(string, int) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt16(uint) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt16(ulong) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt16(ushort) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt32(DateTime) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt32(bool) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt32(byte) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt32(char) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt32(decimal) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt32(double) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt32(float) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt32(int) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt32(long) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt32(object) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt32(object, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt32(sbyte) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt32(short) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt32(string) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt32(string, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt32(string, int) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt32(uint) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt32(ulong) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt32(ushort) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt64(DateTime) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt64(bool) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt64(byte) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt64(char) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt64(decimal) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt64(double) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt64(float) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt64(int) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt64(long) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt64(object) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt64(object, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt64(sbyte) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt64(short) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt64(string) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt64(string, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt64(string, int) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt64(uint) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt64(ulong) | argument 0 -> return (normal) | false |
+| System.Convert.ToUInt64(ushort) | argument 0 -> return (normal) | false |
+| System.Convert.TryFromBase64Chars(ReadOnlySpan<Char>, Span<Byte>, out int) | argument 0 -> return (normal) | false |
+| System.Convert.TryFromBase64String(string, Span<Byte>, out int) | argument 0 -> return (normal) | false |
+| System.Convert.TryToBase64Chars(ReadOnlySpan<Byte>, Span<Char>, out int, Base64FormattingOptions) | argument 0 -> return (normal) | false |
+| System.Diagnostics.Tracing.CounterPayload.<get_ForEnumeration>d__51.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Diagnostics.Tracing.CounterPayload.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Diagnostics.Tracing.EventPayload.Add(KeyValuePair<String, Object>) | argument 0 -> element of argument -1 | true |
+| System.Diagnostics.Tracing.EventPayload.Add(KeyValuePair<String, Object>) | property Key of argument 0 -> property Key of element of argument -1 | true |
+| System.Diagnostics.Tracing.EventPayload.Add(KeyValuePair<String, Object>) | property Value of argument 0 -> property Value of element of argument -1 | true |
+| System.Diagnostics.Tracing.EventPayload.Add(string, object) | argument 0 -> property Key of element of argument -1 | true |
+| System.Diagnostics.Tracing.EventPayload.Add(string, object) | argument 1 -> property Value of element of argument -1 | true |
+| System.Diagnostics.Tracing.EventPayload.CopyTo(KeyValuePair<String,Object>[], int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Diagnostics.Tracing.EventPayload.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Diagnostics.Tracing.EventPayload.get_Item(string) | property Value of element of argument -1 -> return (normal) | true |
+| System.Diagnostics.Tracing.EventPayload.get_Keys() | property Key of element of argument -1 -> element of return (normal) | true |
+| System.Diagnostics.Tracing.EventPayload.get_Values() | property Value of element of argument -1 -> element of return (normal) | true |
+| System.Diagnostics.Tracing.EventPayload.set_Item(string, object) | argument 0 -> property Key of element of argument -1 | true |
+| System.Diagnostics.Tracing.EventPayload.set_Item(string, object) | argument 1 -> property Value of element of argument -1 | true |
+| System.Diagnostics.Tracing.IncrementingCounterPayload.<get_ForEnumeration>d__39.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Diagnostics.Tracing.IncrementingCounterPayload.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Dynamic.ExpandoObject.Add(KeyValuePair<String, Object>) | argument 0 -> element of argument -1 | true |
+| System.Dynamic.ExpandoObject.Add(KeyValuePair<String, Object>) | property Key of argument 0 -> property Key of element of argument -1 | true |
+| System.Dynamic.ExpandoObject.Add(KeyValuePair<String, Object>) | property Value of argument 0 -> property Value of element of argument -1 | true |
+| System.Dynamic.ExpandoObject.Add(string, object) | argument 0 -> property Key of element of argument -1 | true |
+| System.Dynamic.ExpandoObject.Add(string, object) | argument 1 -> property Value of element of argument -1 | true |
+| System.Dynamic.ExpandoObject.CopyTo(KeyValuePair<String,Object>[], int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Dynamic.ExpandoObject.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Dynamic.ExpandoObject.KeyCollection.Add(string) | argument 0 -> element of argument -1 | true |
+| System.Dynamic.ExpandoObject.KeyCollection.CopyTo(String[], int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Dynamic.ExpandoObject.KeyCollection.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Dynamic.ExpandoObject.MetaExpando.<GetDynamicMemberNames>d__6.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Dynamic.ExpandoObject.ValueCollection.Add(object) | argument 0 -> element of argument -1 | true |
+| System.Dynamic.ExpandoObject.ValueCollection.CopyTo(Object[], int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Dynamic.ExpandoObject.ValueCollection.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Dynamic.ExpandoObject.get_Item(string) | property Value of element of argument -1 -> return (normal) | true |
+| System.Dynamic.ExpandoObject.get_Keys() | property Key of element of argument -1 -> element of return (normal) | true |
+| System.Dynamic.ExpandoObject.get_Values() | property Value of element of argument -1 -> element of return (normal) | true |
+| System.Dynamic.ExpandoObject.set_Item(string, object) | argument 0 -> property Key of element of argument -1 | true |
+| System.Dynamic.ExpandoObject.set_Item(string, object) | argument 1 -> property Value of element of argument -1 | true |
+| System.Dynamic.Utils.ListProvider<>.Add(T) | argument 0 -> element of argument -1 | true |
+| System.Dynamic.Utils.ListProvider<>.CopyTo(T[], int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Dynamic.Utils.ListProvider<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Dynamic.Utils.ListProvider<>.Insert(int, T) | argument 1 -> element of argument -1 | true |
+| System.Dynamic.Utils.ListProvider<>.get_Item(int) | element of argument -1 -> return (normal) | true |
+| System.Dynamic.Utils.ListProvider<>.set_Item(int, T) | argument 1 -> element of argument -1 | true |
+| System.IO.BufferedStream.BeginRead(Byte[], int, int, AsyncCallback, object) | argument -1 -> return (out parameter 0) | false |
+| System.IO.BufferedStream.BeginWrite(Byte[], int, int, AsyncCallback, object) | argument 0 -> argument -1 | false |
+| System.IO.BufferedStream.CopyTo(Stream, int) | argument -1 -> return (out parameter 0) | false |
+| System.IO.BufferedStream.CopyToAsync(Stream, int, CancellationToken) | argument -1 -> return (out parameter 0) | false |
+| System.IO.BufferedStream.Read(Byte[], int, int) | argument -1 -> return (out parameter 0) | false |
+| System.IO.BufferedStream.ReadAsync(Byte[], int, int, CancellationToken) | argument -1 -> return (out parameter 0) | false |
+| System.IO.BufferedStream.Write(Byte[], int, int) | argument 0 -> argument -1 | false |
+| System.IO.BufferedStream.WriteAsync(Byte[], int, int, CancellationToken) | argument 0 -> argument -1 | false |
+| System.IO.Compression.CheckSumAndSizeWriteStream.Read(Byte[], int, int) | argument -1 -> return (out parameter 0) | false |
+| System.IO.Compression.CheckSumAndSizeWriteStream.Write(Byte[], int, int) | argument 0 -> argument -1 | false |
+| System.IO.Compression.DeflateManagedStream.BeginRead(Byte[], int, int, AsyncCallback, object) | argument -1 -> return (out parameter 0) | false |
+| System.IO.Compression.DeflateManagedStream.Read(Byte[], int, int) | argument -1 -> return (out parameter 0) | false |
+| System.IO.Compression.DeflateManagedStream.ReadAsync(Byte[], int, int, CancellationToken) | argument -1 -> return (out parameter 0) | false |
+| System.IO.Compression.DeflateManagedStream.Write(Byte[], int, int) | argument 0 -> argument -1 | false |
+| System.IO.Compression.DeflateStream.BeginRead(Byte[], int, int, AsyncCallback, object) | argument -1 -> return (out parameter 0) | false |
+| System.IO.Compression.DeflateStream.BeginWrite(Byte[], int, int, AsyncCallback, object) | argument 0 -> argument -1 | false |
+| System.IO.Compression.DeflateStream.CopyTo(Stream, int) | argument -1 -> return (out parameter 0) | false |
+| System.IO.Compression.DeflateStream.CopyToAsync(Stream, int, CancellationToken) | argument -1 -> return (out parameter 0) | false |
+| System.IO.Compression.DeflateStream.CopyToStream.Read(Byte[], int, int) | argument -1 -> return (out parameter 0) | false |
+| System.IO.Compression.DeflateStream.CopyToStream.Write(Byte[], int, int) | argument 0 -> argument -1 | false |
+| System.IO.Compression.DeflateStream.CopyToStream.WriteAsync(Byte[], int, int, CancellationToken) | argument 0 -> argument -1 | false |
+| System.IO.Compression.DeflateStream.DeflateStream(Stream, CompressionLevel) | argument 0 -> return (normal) | false |
+| System.IO.Compression.DeflateStream.DeflateStream(Stream, CompressionLevel, bool) | argument 0 -> return (normal) | false |
+| System.IO.Compression.DeflateStream.DeflateStream(Stream, CompressionMode) | argument 0 -> return (normal) | false |
+| System.IO.Compression.DeflateStream.DeflateStream(Stream, CompressionMode, bool) | argument 0 -> return (normal) | false |
+| System.IO.Compression.DeflateStream.Read(Byte[], int, int) | argument -1 -> return (out parameter 0) | false |
+| System.IO.Compression.DeflateStream.ReadAsync(Byte[], int, int, CancellationToken) | argument -1 -> return (out parameter 0) | false |
+| System.IO.Compression.DeflateStream.Write(Byte[], int, int) | argument 0 -> argument -1 | false |
+| System.IO.Compression.DeflateStream.WriteAsync(Byte[], int, int, CancellationToken) | argument 0 -> argument -1 | false |
+| System.IO.Compression.GZipStream.BeginRead(Byte[], int, int, AsyncCallback, object) | argument -1 -> return (out parameter 0) | false |
+| System.IO.Compression.GZipStream.BeginWrite(Byte[], int, int, AsyncCallback, object) | argument 0 -> argument -1 | false |
+| System.IO.Compression.GZipStream.CopyTo(Stream, int) | argument -1 -> return (out parameter 0) | false |
+| System.IO.Compression.GZipStream.CopyToAsync(Stream, int, CancellationToken) | argument -1 -> return (out parameter 0) | false |
+| System.IO.Compression.GZipStream.Read(Byte[], int, int) | argument -1 -> return (out parameter 0) | false |
+| System.IO.Compression.GZipStream.ReadAsync(Byte[], int, int, CancellationToken) | argument -1 -> return (out parameter 0) | false |
+| System.IO.Compression.GZipStream.Write(Byte[], int, int) | argument 0 -> argument -1 | false |
+| System.IO.Compression.GZipStream.WriteAsync(Byte[], int, int, CancellationToken) | argument 0 -> argument -1 | false |
+| System.IO.Compression.PositionPreservingWriteOnlyStreamWrapper.BeginWrite(Byte[], int, int, AsyncCallback, object) | argument 0 -> argument -1 | false |
+| System.IO.Compression.PositionPreservingWriteOnlyStreamWrapper.Read(Byte[], int, int) | argument -1 -> return (out parameter 0) | false |
+| System.IO.Compression.PositionPreservingWriteOnlyStreamWrapper.Write(Byte[], int, int) | argument 0 -> argument -1 | false |
+| System.IO.Compression.PositionPreservingWriteOnlyStreamWrapper.WriteAsync(Byte[], int, int, CancellationToken) | argument 0 -> argument -1 | false |
+| System.IO.Compression.SubReadStream.Read(Byte[], int, int) | argument -1 -> return (out parameter 0) | false |
+| System.IO.Compression.SubReadStream.Write(Byte[], int, int) | argument 0 -> argument -1 | false |
+| System.IO.Compression.WrappedStream.Read(Byte[], int, int) | argument -1 -> return (out parameter 0) | false |
+| System.IO.Compression.WrappedStream.Write(Byte[], int, int) | argument 0 -> argument -1 | false |
+| System.IO.Compression.ZipArchiveEntry.DirectToArchiveWriterStream.Read(Byte[], int, int) | argument -1 -> return (out parameter 0) | false |
+| System.IO.Compression.ZipArchiveEntry.DirectToArchiveWriterStream.Write(Byte[], int, int) | argument 0 -> argument -1 | false |
+| System.IO.FileStream.BeginRead(Byte[], int, int, AsyncCallback, object) | argument -1 -> return (out parameter 0) | false |
+| System.IO.FileStream.BeginWrite(Byte[], int, int, AsyncCallback, object) | argument 0 -> argument -1 | false |
+| System.IO.FileStream.CopyToAsync(Stream, int, CancellationToken) | argument -1 -> return (out parameter 0) | false |
+| System.IO.FileStream.Read(Byte[], int, int) | argument -1 -> return (out parameter 0) | false |
+| System.IO.FileStream.ReadAsync(Byte[], int, int, CancellationToken) | argument -1 -> return (out parameter 0) | false |
+| System.IO.FileStream.Write(Byte[], int, int) | argument 0 -> argument -1 | false |
+| System.IO.FileStream.WriteAsync(Byte[], int, int, CancellationToken) | argument 0 -> argument -1 | false |
+| System.IO.MemoryStream.CopyTo(Stream, int) | argument -1 -> return (out parameter 0) | false |
+| System.IO.MemoryStream.CopyToAsync(Stream, int, CancellationToken) | argument -1 -> return (out parameter 0) | false |
+| System.IO.MemoryStream.MemoryStream(Byte[]) | argument 0 -> return (normal) | false |
+| System.IO.MemoryStream.MemoryStream(Byte[], bool) | argument 0 -> return (normal) | false |
+| System.IO.MemoryStream.MemoryStream(Byte[], int, int) | argument 0 -> return (normal) | false |
+| System.IO.MemoryStream.MemoryStream(Byte[], int, int, bool) | argument 0 -> return (normal) | false |
+| System.IO.MemoryStream.MemoryStream(Byte[], int, int, bool, bool) | argument 0 -> return (normal) | false |
+| System.IO.MemoryStream.Read(Byte[], int, int) | argument -1 -> return (out parameter 0) | false |
+| System.IO.MemoryStream.ReadAsync(Byte[], int, int, CancellationToken) | argument -1 -> return (out parameter 0) | false |
+| System.IO.MemoryStream.ToArray() | argument -1 -> return (normal) | false |
+| System.IO.MemoryStream.Write(Byte[], int, int) | argument 0 -> argument -1 | false |
+| System.IO.MemoryStream.WriteAsync(Byte[], int, int, CancellationToken) | argument 0 -> argument -1 | false |
+| System.IO.Path.Combine(params String[]) | element of argument 0 -> return (normal) | false |
+| System.IO.Path.Combine(string, string) | argument 0 -> return (normal) | false |
+| System.IO.Path.Combine(string, string) | argument 1 -> return (normal) | false |
+| System.IO.Path.Combine(string, string, string) | argument 0 -> return (normal) | false |
+| System.IO.Path.Combine(string, string, string) | argument 1 -> return (normal) | false |
+| System.IO.Path.Combine(string, string, string) | argument 2 -> return (normal) | false |
+| System.IO.Path.Combine(string, string, string, string) | argument 0 -> return (normal) | false |
+| System.IO.Path.Combine(string, string, string, string) | argument 1 -> return (normal) | false |
+| System.IO.Path.Combine(string, string, string, string) | argument 2 -> return (normal) | false |
+| System.IO.Path.Combine(string, string, string, string) | argument 3 -> return (normal) | false |
+| System.IO.Path.GetDirectoryName(ReadOnlySpan<Char>) | argument 0 -> return (normal) | false |
+| System.IO.Path.GetDirectoryName(string) | argument 0 -> return (normal) | false |
+| System.IO.Path.GetExtension(ReadOnlySpan<Char>) | argument 0 -> return (normal) | false |
+| System.IO.Path.GetExtension(string) | argument 0 -> return (normal) | false |
+| System.IO.Path.GetFileName(ReadOnlySpan<Char>) | argument 0 -> return (normal) | false |
+| System.IO.Path.GetFileName(string) | argument 0 -> return (normal) | false |
+| System.IO.Path.GetFileNameWithoutExtension(ReadOnlySpan<Char>) | argument 0 -> return (normal) | false |
+| System.IO.Path.GetFileNameWithoutExtension(string) | argument 0 -> return (normal) | false |
+| System.IO.Path.GetFullPath(string) | argument 0 -> return (normal) | false |
+| System.IO.Path.GetFullPath(string, string) | argument 0 -> return (normal) | false |
+| System.IO.Path.GetPathRoot(ReadOnlySpan<Char>) | argument 0 -> return (normal) | false |
+| System.IO.Path.GetPathRoot(string) | argument 0 -> return (normal) | false |
+| System.IO.Path.GetRelativePath(string, string) | argument 1 -> return (normal) | false |
+| System.IO.Pipes.PipeStream.BeginRead(Byte[], int, int, AsyncCallback, object) | argument -1 -> return (out parameter 0) | false |
+| System.IO.Pipes.PipeStream.BeginWrite(Byte[], int, int, AsyncCallback, object) | argument 0 -> argument -1 | false |
+| System.IO.Pipes.PipeStream.Read(Byte[], int, int) | argument -1 -> return (out parameter 0) | false |
+| System.IO.Pipes.PipeStream.ReadAsync(Byte[], int, int, CancellationToken) | argument -1 -> return (out parameter 0) | false |
+| System.IO.Pipes.PipeStream.Write(Byte[], int, int) | argument 0 -> argument -1 | false |
+| System.IO.Pipes.PipeStream.WriteAsync(Byte[], int, int, CancellationToken) | argument 0 -> argument -1 | false |
+| System.IO.Stream.BeginRead(Byte[], int, int, AsyncCallback, object) | argument -1 -> return (out parameter 0) | false |
+| System.IO.Stream.BeginWrite(Byte[], int, int, AsyncCallback, object) | argument 0 -> argument -1 | false |
+| System.IO.Stream.CopyTo(Stream) | argument -1 -> return (out parameter 0) | false |
+| System.IO.Stream.CopyTo(Stream, int) | argument -1 -> return (out parameter 0) | false |
+| System.IO.Stream.CopyToAsync(Stream) | argument -1 -> return (out parameter 0) | false |
+| System.IO.Stream.CopyToAsync(Stream, CancellationToken) | argument -1 -> return (out parameter 0) | false |
+| System.IO.Stream.CopyToAsync(Stream, int) | argument -1 -> return (out parameter 0) | false |
+| System.IO.Stream.CopyToAsync(Stream, int, CancellationToken) | argument -1 -> return (out parameter 0) | false |
+| System.IO.Stream.NullStream.BeginRead(Byte[], int, int, AsyncCallback, object) | argument -1 -> return (out parameter 0) | false |
+| System.IO.Stream.NullStream.BeginWrite(Byte[], int, int, AsyncCallback, object) | argument 0 -> argument -1 | false |
+| System.IO.Stream.NullStream.CopyTo(Stream, int) | argument -1 -> return (out parameter 0) | false |
+| System.IO.Stream.NullStream.CopyToAsync(Stream, int, CancellationToken) | argument -1 -> return (out parameter 0) | false |
+| System.IO.Stream.NullStream.Read(Byte[], int, int) | argument -1 -> return (out parameter 0) | false |
+| System.IO.Stream.NullStream.ReadAsync(Byte[], int, int, CancellationToken) | argument -1 -> return (out parameter 0) | false |
+| System.IO.Stream.NullStream.Write(Byte[], int, int) | argument 0 -> argument -1 | false |
+| System.IO.Stream.NullStream.WriteAsync(Byte[], int, int, CancellationToken) | argument 0 -> argument -1 | false |
+| System.IO.Stream.Read(Byte[], int, int) | argument -1 -> return (out parameter 0) | false |
+| System.IO.Stream.ReadAsync(Byte[], int, int) | argument -1 -> return (out parameter 0) | false |
+| System.IO.Stream.ReadAsync(Byte[], int, int, CancellationToken) | argument -1 -> return (out parameter 0) | false |
+| System.IO.Stream.SyncStream.BeginRead(Byte[], int, int, AsyncCallback, object) | argument -1 -> return (out parameter 0) | false |
+| System.IO.Stream.SyncStream.BeginWrite(Byte[], int, int, AsyncCallback, object) | argument 0 -> argument -1 | false |
+| System.IO.Stream.SyncStream.Read(Byte[], int, int) | argument -1 -> return (out parameter 0) | false |
+| System.IO.Stream.SyncStream.Write(Byte[], int, int) | argument 0 -> argument -1 | false |
+| System.IO.Stream.Write(Byte[], int, int) | argument 0 -> argument -1 | false |
+| System.IO.Stream.WriteAsync(Byte[], int, int) | argument 0 -> argument -1 | false |
+| System.IO.Stream.WriteAsync(Byte[], int, int, CancellationToken) | argument 0 -> argument -1 | false |
+| System.IO.StringReader.Read() | argument -1 -> return (normal) | false |
+| System.IO.StringReader.Read(Char[], int, int) | argument -1 -> return (normal) | false |
+| System.IO.StringReader.Read(Span<Char>) | argument -1 -> return (normal) | false |
+| System.IO.StringReader.ReadAsync(Char[], int, int) | argument -1 -> return (normal) | false |
+| System.IO.StringReader.ReadAsync(Memory<Char>, CancellationToken) | argument -1 -> return (normal) | false |
+| System.IO.StringReader.ReadBlock(Span<Char>) | argument -1 -> return (normal) | false |
+| System.IO.StringReader.ReadBlockAsync(Char[], int, int) | argument -1 -> return (normal) | false |
+| System.IO.StringReader.ReadBlockAsync(Memory<Char>, CancellationToken) | argument -1 -> return (normal) | false |
+| System.IO.StringReader.ReadLine() | argument -1 -> return (normal) | false |
+| System.IO.StringReader.ReadLineAsync() | argument -1 -> return (normal) | false |
+| System.IO.StringReader.ReadToEnd() | argument -1 -> return (normal) | false |
+| System.IO.StringReader.ReadToEndAsync() | argument -1 -> return (normal) | false |
+| System.IO.StringReader.StringReader(string) | argument 0 -> return (normal) | false |
+| System.IO.TextReader.Read() | argument -1 -> return (normal) | false |
+| System.IO.TextReader.Read(Char[], int, int) | argument -1 -> return (normal) | false |
+| System.IO.TextReader.Read(Span<Char>) | argument -1 -> return (normal) | false |
+| System.IO.TextReader.ReadAsync(Char[], int, int) | argument -1 -> return (normal) | false |
+| System.IO.TextReader.ReadAsync(Memory<Char>, CancellationToken) | argument -1 -> return (normal) | false |
+| System.IO.TextReader.ReadAsyncInternal(Memory<Char>, CancellationToken) | argument -1 -> return (normal) | false |
+| System.IO.TextReader.ReadBlock(Char[], int, int) | argument -1 -> return (normal) | false |
+| System.IO.TextReader.ReadBlock(Span<Char>) | argument -1 -> return (normal) | false |
+| System.IO.TextReader.ReadBlockAsync(Char[], int, int) | argument -1 -> return (normal) | false |
+| System.IO.TextReader.ReadBlockAsync(Memory<Char>, CancellationToken) | argument -1 -> return (normal) | false |
+| System.IO.TextReader.ReadLine() | argument -1 -> return (normal) | false |
+| System.IO.TextReader.ReadLineAsync() | argument -1 -> return (normal) | false |
+| System.IO.TextReader.ReadToEnd() | argument -1 -> return (normal) | false |
+| System.IO.TextReader.ReadToEndAsync() | argument -1 -> return (normal) | false |
+| System.IO.UnmanagedMemoryStream.Read(Byte[], int, int) | argument -1 -> return (out parameter 0) | false |
+| System.IO.UnmanagedMemoryStream.ReadAsync(Byte[], int, int, CancellationToken) | argument -1 -> return (out parameter 0) | false |
+| System.IO.UnmanagedMemoryStream.Write(Byte[], int, int) | argument 0 -> argument -1 | false |
+| System.IO.UnmanagedMemoryStream.WriteAsync(Byte[], int, int, CancellationToken) | argument 0 -> argument -1 | false |
+| System.IO.UnmanagedMemoryStreamWrapper.CopyToAsync(Stream, int, CancellationToken) | argument -1 -> return (out parameter 0) | false |
+| System.IO.UnmanagedMemoryStreamWrapper.Read(Byte[], int, int) | argument -1 -> return (out parameter 0) | false |
+| System.IO.UnmanagedMemoryStreamWrapper.ReadAsync(Byte[], int, int, CancellationToken) | argument -1 -> return (out parameter 0) | false |
+| System.IO.UnmanagedMemoryStreamWrapper.ToArray() | argument -1 -> return (normal) | false |
+| System.IO.UnmanagedMemoryStreamWrapper.Write(Byte[], int, int) | argument 0 -> argument -1 | false |
+| System.IO.UnmanagedMemoryStreamWrapper.WriteAsync(Byte[], int, int, CancellationToken) | argument 0 -> argument -1 | false |
+| System.Int32.Parse(string) | argument 0 -> return (normal) | false |
+| System.Int32.Parse(string, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Int32.Parse(string, NumberStyles) | argument 0 -> return (normal) | false |
+| System.Int32.Parse(string, NumberStyles, IFormatProvider) | argument 0 -> return (normal) | false |
+| System.Int32.TryParse(string, NumberStyles, IFormatProvider, out int) | argument 0 -> return (normal) | false |
+| System.Int32.TryParse(string, NumberStyles, IFormatProvider, out int) | argument 0 -> return (out parameter 3) | false |
+| System.Int32.TryParse(string, out int) | argument 0 -> return (normal) | false |
+| System.Int32.TryParse(string, out int) | argument 0 -> return (out parameter 1) | false |
+| System.Lazy<>.Lazy(Func<T>) | return (normal) of argument 0 -> property Value of return (normal) | true |
+| System.Lazy<>.Lazy(Func<T>, LazyThreadSafetyMode) | return (normal) of argument 0 -> property Value of return (normal) | true |
+| System.Lazy<>.Lazy(Func<T>, bool) | return (normal) of argument 0 -> property Value of return (normal) | true |
+| System.Lazy<>.get_Value() | argument -1 -> return (normal) | false |
+| System.Linq.EmptyPartition<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.Enumerable.<CastIterator>d__64<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.Enumerable.<ExceptIterator>d__81<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.Enumerable.<GroupJoinIterator>d__98<,,,>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.Enumerable.<IntersectIterator>d__101<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.Enumerable.<JoinIterator>d__105<,,,>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.Enumerable.<OfTypeIterator>d__62<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.Enumerable.<SelectIterator>d__174<,>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.Enumerable.<SelectManyIterator>d__177<,>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.Enumerable.<SelectManyIterator>d__179<,,>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.Enumerable.<SelectManyIterator>d__181<,,>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.Enumerable.<SkipLastIterator>d__194<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.Enumerable.<SkipWhileIterator>d__190<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.Enumerable.<SkipWhileIterator>d__192<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.Enumerable.<TakeLastIterator>d__221<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.Enumerable.<TakeWhileIterator>d__217<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.Enumerable.<TakeWhileIterator>d__219<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.Enumerable.<WhereIterator>d__240<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.Enumerable.<ZipIterator>d__243<,>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.Enumerable.<ZipIterator>d__244<,,>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.Enumerable.Aggregate<TSource, TAccumulate, TResult>(IEnumerable<TSource>, TAccumulate, Func<TAccumulate, TSource, TAccumulate>, Func<TAccumulate, TResult>) | argument 1 -> parameter 0 of argument 2 | true |
+| System.Linq.Enumerable.Aggregate<TSource, TAccumulate, TResult>(IEnumerable<TSource>, TAccumulate, Func<TAccumulate, TSource, TAccumulate>, Func<TAccumulate, TResult>) | element of argument 0 -> parameter 1 of argument 2 | true |
+| System.Linq.Enumerable.Aggregate<TSource, TAccumulate, TResult>(IEnumerable<TSource>, TAccumulate, Func<TAccumulate, TSource, TAccumulate>, Func<TAccumulate, TResult>) | return (normal) of argument 2 -> parameter 0 of argument 3 | true |
+| System.Linq.Enumerable.Aggregate<TSource, TAccumulate, TResult>(IEnumerable<TSource>, TAccumulate, Func<TAccumulate, TSource, TAccumulate>, Func<TAccumulate, TResult>) | return (normal) of argument 3 -> return (normal) | true |
+| System.Linq.Enumerable.Aggregate<TSource, TAccumulate>(IEnumerable<TSource>, TAccumulate, Func<TAccumulate, TSource, TAccumulate>) | argument 1 -> parameter 0 of argument 2 | true |
+| System.Linq.Enumerable.Aggregate<TSource, TAccumulate>(IEnumerable<TSource>, TAccumulate, Func<TAccumulate, TSource, TAccumulate>) | element of argument 0 -> parameter 1 of argument 2 | true |
+| System.Linq.Enumerable.Aggregate<TSource, TAccumulate>(IEnumerable<TSource>, TAccumulate, Func<TAccumulate, TSource, TAccumulate>) | return (normal) of argument 2 -> return (normal) | true |
+| System.Linq.Enumerable.Aggregate<TSource>(IEnumerable<TSource>, Func<TSource, TSource, TSource>) | element of argument 0 -> parameter 1 of argument 1 | true |
+| System.Linq.Enumerable.Aggregate<TSource>(IEnumerable<TSource>, Func<TSource, TSource, TSource>) | return (normal) of argument 1 -> return (normal) | true |
+| System.Linq.Enumerable.All<TSource>(IEnumerable<TSource>, Func<TSource, Boolean>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Any<TSource>(IEnumerable<TSource>, Func<TSource, Boolean>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.AsEnumerable<TSource>(IEnumerable<TSource>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Enumerable.Average<TSource>(IEnumerable<TSource>, Func<TSource, Decimal>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Average<TSource>(IEnumerable<TSource>, Func<TSource, Double>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Average<TSource>(IEnumerable<TSource>, Func<TSource, Int32>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Average<TSource>(IEnumerable<TSource>, Func<TSource, Int64>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Average<TSource>(IEnumerable<TSource>, Func<TSource, Nullable<Decimal>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Average<TSource>(IEnumerable<TSource>, Func<TSource, Nullable<Double>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Average<TSource>(IEnumerable<TSource>, Func<TSource, Nullable<Int32>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Average<TSource>(IEnumerable<TSource>, Func<TSource, Nullable<Int64>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Average<TSource>(IEnumerable<TSource>, Func<TSource, Nullable<Single>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Average<TSource>(IEnumerable<TSource>, Func<TSource, Single>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Cast<TResult>(IEnumerable) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Enumerable.Concat<TSource>(IEnumerable<TSource>, IEnumerable<TSource>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Enumerable.Concat<TSource>(IEnumerable<TSource>, IEnumerable<TSource>) | element of argument 1 -> element of return (normal) | true |
+| System.Linq.Enumerable.Count<TSource>(IEnumerable<TSource>, Func<TSource, Boolean>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.DefaultIfEmpty<TSource>(IEnumerable<TSource>) | element of argument 0 -> return (normal) | true |
+| System.Linq.Enumerable.DefaultIfEmpty<TSource>(IEnumerable<TSource>, TSource) | argument 1 -> return (normal) | true |
+| System.Linq.Enumerable.DefaultIfEmpty<TSource>(IEnumerable<TSource>, TSource) | element of argument 0 -> return (normal) | true |
+| System.Linq.Enumerable.Distinct<TSource>(IEnumerable<TSource>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Enumerable.Distinct<TSource>(IEnumerable<TSource>, IEqualityComparer<TSource>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Enumerable.ElementAt<TSource>(IEnumerable<TSource>, int) | element of argument 0 -> return (normal) | true |
+| System.Linq.Enumerable.ElementAtOrDefault<TSource>(IEnumerable<TSource>, int) | element of argument 0 -> return (normal) | true |
+| System.Linq.Enumerable.Except<TSource>(IEnumerable<TSource>, IEnumerable<TSource>) | element of argument 0 -> return (normal) | true |
+| System.Linq.Enumerable.Except<TSource>(IEnumerable<TSource>, IEnumerable<TSource>, IEqualityComparer<TSource>) | element of argument 0 -> return (normal) | true |
+| System.Linq.Enumerable.First<TSource>(IEnumerable<TSource>) | element of argument 0 -> return (normal) | true |
+| System.Linq.Enumerable.First<TSource>(IEnumerable<TSource>, Func<TSource, Boolean>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.First<TSource>(IEnumerable<TSource>, Func<TSource, Boolean>) | element of argument 0 -> return (normal) | true |
+| System.Linq.Enumerable.FirstOrDefault<TSource>(IEnumerable<TSource>) | element of argument 0 -> return (normal) | true |
+| System.Linq.Enumerable.FirstOrDefault<TSource>(IEnumerable<TSource>, Func<TSource, Boolean>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.FirstOrDefault<TSource>(IEnumerable<TSource>, Func<TSource, Boolean>) | element of argument 0 -> return (normal) | true |
+| System.Linq.Enumerable.GroupBy<TSource, TKey, TElement, TResult>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, Func<TKey, IEnumerable<TElement>, TResult>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.GroupBy<TSource, TKey, TElement, TResult>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, Func<TKey, IEnumerable<TElement>, TResult>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.Enumerable.GroupBy<TSource, TKey, TElement, TResult>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, Func<TKey, IEnumerable<TElement>, TResult>) | return (normal) of argument 1 -> parameter 0 of argument 2 | true |
+| System.Linq.Enumerable.GroupBy<TSource, TKey, TElement, TResult>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, Func<TKey, IEnumerable<TElement>, TResult>) | return (normal) of argument 2 -> element of parameter 1 of argument 3 | true |
+| System.Linq.Enumerable.GroupBy<TSource, TKey, TElement, TResult>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, Func<TKey, IEnumerable<TElement>, TResult>) | return (normal) of argument 3 -> element of return (normal) | true |
+| System.Linq.Enumerable.GroupBy<TSource, TKey, TElement, TResult>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, Func<TKey, IEnumerable<TElement>, TResult>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.GroupBy<TSource, TKey, TElement, TResult>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, Func<TKey, IEnumerable<TElement>, TResult>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.Enumerable.GroupBy<TSource, TKey, TElement, TResult>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, Func<TKey, IEnumerable<TElement>, TResult>, IEqualityComparer<TKey>) | return (normal) of argument 1 -> parameter 0 of argument 2 | true |
+| System.Linq.Enumerable.GroupBy<TSource, TKey, TElement, TResult>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, Func<TKey, IEnumerable<TElement>, TResult>, IEqualityComparer<TKey>) | return (normal) of argument 2 -> element of parameter 1 of argument 3 | true |
+| System.Linq.Enumerable.GroupBy<TSource, TKey, TElement, TResult>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, Func<TKey, IEnumerable<TElement>, TResult>, IEqualityComparer<TKey>) | return (normal) of argument 3 -> element of return (normal) | true |
+| System.Linq.Enumerable.GroupBy<TSource, TKey, TElement>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.GroupBy<TSource, TKey, TElement>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.Enumerable.GroupBy<TSource, TKey, TElement>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>) | return (normal) of argument 2 -> element of return (normal) | true |
+| System.Linq.Enumerable.GroupBy<TSource, TKey, TElement>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.GroupBy<TSource, TKey, TElement>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.Enumerable.GroupBy<TSource, TKey, TElement>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, IEqualityComparer<TKey>) | return (normal) of argument 1 -> parameter 0 of argument 2 | true |
+| System.Linq.Enumerable.GroupBy<TSource, TKey, TResult>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TKey, IEnumerable<TSource>, TResult>) | argument 0 -> parameter 1 of argument 2 | true |
+| System.Linq.Enumerable.GroupBy<TSource, TKey, TResult>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TKey, IEnumerable<TSource>, TResult>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.GroupBy<TSource, TKey, TResult>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TKey, IEnumerable<TSource>, TResult>) | return (normal) of argument 1 -> parameter 0 of argument 2 | true |
+| System.Linq.Enumerable.GroupBy<TSource, TKey, TResult>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TKey, IEnumerable<TSource>, TResult>) | return (normal) of argument 2 -> element of return (normal) | true |
+| System.Linq.Enumerable.GroupBy<TSource, TKey, TResult>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TKey, IEnumerable<TSource>, TResult>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.GroupBy<TSource, TKey, TResult>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TKey, IEnumerable<TSource>, TResult>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.Enumerable.GroupBy<TSource, TKey, TResult>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TKey, IEnumerable<TSource>, TResult>, IEqualityComparer<TKey>) | return (normal) of argument 1 -> parameter 0 of argument 2 | true |
+| System.Linq.Enumerable.GroupBy<TSource, TKey>(IEnumerable<TSource>, Func<TSource, TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.GroupBy<TSource, TKey>(IEnumerable<TSource>, Func<TSource, TKey>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.GroupJoin<TOuter, TInner, TKey, TResult>(IEnumerable<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.Enumerable.GroupJoin<TOuter, TInner, TKey, TResult>(IEnumerable<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>) | element of argument 0 -> parameter 0 of argument 4 | true |
+| System.Linq.Enumerable.GroupJoin<TOuter, TInner, TKey, TResult>(IEnumerable<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>) | element of argument 1 -> parameter 0 of argument 3 | true |
+| System.Linq.Enumerable.GroupJoin<TOuter, TInner, TKey, TResult>(IEnumerable<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>) | element of argument 1 -> parameter 1 of argument 4 | true |
+| System.Linq.Enumerable.GroupJoin<TOuter, TInner, TKey, TResult>(IEnumerable<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>) | return (normal) of argument 4 -> element of return (normal) | true |
+| System.Linq.Enumerable.GroupJoin<TOuter, TInner, TKey, TResult>(IEnumerable<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.Enumerable.GroupJoin<TOuter, TInner, TKey, TResult>(IEnumerable<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 4 | true |
+| System.Linq.Enumerable.GroupJoin<TOuter, TInner, TKey, TResult>(IEnumerable<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>, IEqualityComparer<TKey>) | element of argument 1 -> parameter 0 of argument 3 | true |
+| System.Linq.Enumerable.GroupJoin<TOuter, TInner, TKey, TResult>(IEnumerable<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>, IEqualityComparer<TKey>) | element of argument 1 -> parameter 1 of argument 4 | true |
+| System.Linq.Enumerable.GroupJoin<TOuter, TInner, TKey, TResult>(IEnumerable<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>, IEqualityComparer<TKey>) | return (normal) of argument 4 -> element of return (normal) | true |
+| System.Linq.Enumerable.Intersect<TSource>(IEnumerable<TSource>, IEnumerable<TSource>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Enumerable.Intersect<TSource>(IEnumerable<TSource>, IEnumerable<TSource>) | element of argument 1 -> element of return (normal) | true |
+| System.Linq.Enumerable.Intersect<TSource>(IEnumerable<TSource>, IEnumerable<TSource>, IEqualityComparer<TSource>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Enumerable.Intersect<TSource>(IEnumerable<TSource>, IEnumerable<TSource>, IEqualityComparer<TSource>) | element of argument 1 -> element of return (normal) | true |
+| System.Linq.Enumerable.Iterator<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.Enumerable.Join<TOuter, TInner, TKey, TResult>(IEnumerable<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.Enumerable.Join<TOuter, TInner, TKey, TResult>(IEnumerable<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>) | element of argument 0 -> parameter 0 of argument 4 | true |
+| System.Linq.Enumerable.Join<TOuter, TInner, TKey, TResult>(IEnumerable<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>) | element of argument 1 -> parameter 0 of argument 3 | true |
+| System.Linq.Enumerable.Join<TOuter, TInner, TKey, TResult>(IEnumerable<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>) | element of argument 1 -> parameter 1 of argument 4 | true |
+| System.Linq.Enumerable.Join<TOuter, TInner, TKey, TResult>(IEnumerable<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>) | return (normal) of argument 4 -> element of return (normal) | true |
+| System.Linq.Enumerable.Join<TOuter, TInner, TKey, TResult>(IEnumerable<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.Enumerable.Join<TOuter, TInner, TKey, TResult>(IEnumerable<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 4 | true |
+| System.Linq.Enumerable.Join<TOuter, TInner, TKey, TResult>(IEnumerable<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>, IEqualityComparer<TKey>) | element of argument 1 -> parameter 0 of argument 3 | true |
+| System.Linq.Enumerable.Join<TOuter, TInner, TKey, TResult>(IEnumerable<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>, IEqualityComparer<TKey>) | element of argument 1 -> parameter 1 of argument 4 | true |
+| System.Linq.Enumerable.Join<TOuter, TInner, TKey, TResult>(IEnumerable<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>, IEqualityComparer<TKey>) | return (normal) of argument 4 -> element of return (normal) | true |
+| System.Linq.Enumerable.Last<TSource>(IEnumerable<TSource>) | element of argument 0 -> return (normal) | true |
+| System.Linq.Enumerable.Last<TSource>(IEnumerable<TSource>, Func<TSource, Boolean>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Last<TSource>(IEnumerable<TSource>, Func<TSource, Boolean>) | element of argument 0 -> return (normal) | true |
+| System.Linq.Enumerable.LastOrDefault<TSource>(IEnumerable<TSource>) | element of argument 0 -> return (normal) | true |
+| System.Linq.Enumerable.LastOrDefault<TSource>(IEnumerable<TSource>, Func<TSource, Boolean>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.LastOrDefault<TSource>(IEnumerable<TSource>, Func<TSource, Boolean>) | element of argument 0 -> return (normal) | true |
+| System.Linq.Enumerable.LongCount<TSource>(IEnumerable<TSource>, Func<TSource, Boolean>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Max<TSource, TResult>(IEnumerable<TSource>, Func<TSource, TResult>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Max<TSource>(IEnumerable<TSource>, Func<TSource, Decimal>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Max<TSource>(IEnumerable<TSource>, Func<TSource, Double>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Max<TSource>(IEnumerable<TSource>, Func<TSource, Int32>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Max<TSource>(IEnumerable<TSource>, Func<TSource, Int64>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Max<TSource>(IEnumerable<TSource>, Func<TSource, Nullable<Decimal>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Max<TSource>(IEnumerable<TSource>, Func<TSource, Nullable<Double>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Max<TSource>(IEnumerable<TSource>, Func<TSource, Nullable<Int32>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Max<TSource>(IEnumerable<TSource>, Func<TSource, Nullable<Int64>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Max<TSource>(IEnumerable<TSource>, Func<TSource, Nullable<Single>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Max<TSource>(IEnumerable<TSource>, Func<TSource, Single>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Min<TSource, TResult>(IEnumerable<TSource>, Func<TSource, TResult>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Min<TSource>(IEnumerable<TSource>, Func<TSource, Decimal>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Min<TSource>(IEnumerable<TSource>, Func<TSource, Double>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Min<TSource>(IEnumerable<TSource>, Func<TSource, Int32>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Min<TSource>(IEnumerable<TSource>, Func<TSource, Int64>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Min<TSource>(IEnumerable<TSource>, Func<TSource, Nullable<Decimal>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Min<TSource>(IEnumerable<TSource>, Func<TSource, Nullable<Double>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Min<TSource>(IEnumerable<TSource>, Func<TSource, Nullable<Int32>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Min<TSource>(IEnumerable<TSource>, Func<TSource, Nullable<Int64>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Min<TSource>(IEnumerable<TSource>, Func<TSource, Nullable<Single>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Min<TSource>(IEnumerable<TSource>, Func<TSource, Single>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.OfType<TResult>(IEnumerable) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Enumerable.OrderBy<TSource, TKey>(IEnumerable<TSource>, Func<TSource, TKey>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Enumerable.OrderBy<TSource, TKey>(IEnumerable<TSource>, Func<TSource, TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.OrderBy<TSource, TKey>(IEnumerable<TSource>, Func<TSource, TKey>, IComparer<TKey>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Enumerable.OrderBy<TSource, TKey>(IEnumerable<TSource>, Func<TSource, TKey>, IComparer<TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.OrderByDescending<TSource, TKey>(IEnumerable<TSource>, Func<TSource, TKey>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Enumerable.OrderByDescending<TSource, TKey>(IEnumerable<TSource>, Func<TSource, TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.OrderByDescending<TSource, TKey>(IEnumerable<TSource>, Func<TSource, TKey>, IComparer<TKey>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Enumerable.OrderByDescending<TSource, TKey>(IEnumerable<TSource>, Func<TSource, TKey>, IComparer<TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Reverse<TSource>(IEnumerable<TSource>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Enumerable.Select<TSource, TResult>(IEnumerable<TSource>, Func<TSource, Int32, TResult>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Select<TSource, TResult>(IEnumerable<TSource>, Func<TSource, Int32, TResult>) | return (normal) of argument 1 -> element of return (normal) | true |
+| System.Linq.Enumerable.Select<TSource, TResult>(IEnumerable<TSource>, Func<TSource, TResult>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Select<TSource, TResult>(IEnumerable<TSource>, Func<TSource, TResult>) | return (normal) of argument 1 -> element of return (normal) | true |
+| System.Linq.Enumerable.SelectMany<TSource, TCollection, TResult>(IEnumerable<TSource>, Func<TSource, IEnumerable<TCollection>>, Func<TSource, TCollection, TResult>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.SelectMany<TSource, TCollection, TResult>(IEnumerable<TSource>, Func<TSource, IEnumerable<TCollection>>, Func<TSource, TCollection, TResult>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.Enumerable.SelectMany<TSource, TCollection, TResult>(IEnumerable<TSource>, Func<TSource, IEnumerable<TCollection>>, Func<TSource, TCollection, TResult>) | element of return (normal) of argument 1 -> parameter 1 of argument 2 | true |
+| System.Linq.Enumerable.SelectMany<TSource, TCollection, TResult>(IEnumerable<TSource>, Func<TSource, IEnumerable<TCollection>>, Func<TSource, TCollection, TResult>) | return (normal) of argument 2 -> element of return (normal) | true |
+| System.Linq.Enumerable.SelectMany<TSource, TCollection, TResult>(IEnumerable<TSource>, Func<TSource, Int32, IEnumerable<TCollection>>, Func<TSource, TCollection, TResult>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.SelectMany<TSource, TCollection, TResult>(IEnumerable<TSource>, Func<TSource, Int32, IEnumerable<TCollection>>, Func<TSource, TCollection, TResult>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.Enumerable.SelectMany<TSource, TCollection, TResult>(IEnumerable<TSource>, Func<TSource, Int32, IEnumerable<TCollection>>, Func<TSource, TCollection, TResult>) | element of return (normal) of argument 1 -> parameter 1 of argument 2 | true |
+| System.Linq.Enumerable.SelectMany<TSource, TCollection, TResult>(IEnumerable<TSource>, Func<TSource, Int32, IEnumerable<TCollection>>, Func<TSource, TCollection, TResult>) | return (normal) of argument 2 -> element of return (normal) | true |
+| System.Linq.Enumerable.SelectMany<TSource, TResult>(IEnumerable<TSource>, Func<TSource, IEnumerable<TResult>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.SelectMany<TSource, TResult>(IEnumerable<TSource>, Func<TSource, IEnumerable<TResult>>) | return (normal) of argument 1 -> element of return (normal) | true |
+| System.Linq.Enumerable.SelectMany<TSource, TResult>(IEnumerable<TSource>, Func<TSource, Int32, IEnumerable<TResult>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.SelectMany<TSource, TResult>(IEnumerable<TSource>, Func<TSource, Int32, IEnumerable<TResult>>) | return (normal) of argument 1 -> element of return (normal) | true |
+| System.Linq.Enumerable.Single<TSource>(IEnumerable<TSource>) | element of argument 0 -> return (normal) | true |
+| System.Linq.Enumerable.Single<TSource>(IEnumerable<TSource>, Func<TSource, Boolean>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Single<TSource>(IEnumerable<TSource>, Func<TSource, Boolean>) | element of argument 0 -> return (normal) | true |
+| System.Linq.Enumerable.SingleOrDefault<TSource>(IEnumerable<TSource>) | element of argument 0 -> return (normal) | true |
+| System.Linq.Enumerable.SingleOrDefault<TSource>(IEnumerable<TSource>, Func<TSource, Boolean>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.SingleOrDefault<TSource>(IEnumerable<TSource>, Func<TSource, Boolean>) | element of argument 0 -> return (normal) | true |
+| System.Linq.Enumerable.Skip<TSource>(IEnumerable<TSource>, int) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Enumerable.SkipWhile<TSource>(IEnumerable<TSource>, Func<TSource, Boolean>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Enumerable.SkipWhile<TSource>(IEnumerable<TSource>, Func<TSource, Boolean>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.SkipWhile<TSource>(IEnumerable<TSource>, Func<TSource, Int32, Boolean>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Enumerable.SkipWhile<TSource>(IEnumerable<TSource>, Func<TSource, Int32, Boolean>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Sum<TSource>(IEnumerable<TSource>, Func<TSource, Decimal>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Sum<TSource>(IEnumerable<TSource>, Func<TSource, Double>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Sum<TSource>(IEnumerable<TSource>, Func<TSource, Int32>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Sum<TSource>(IEnumerable<TSource>, Func<TSource, Int64>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Sum<TSource>(IEnumerable<TSource>, Func<TSource, Nullable<Decimal>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Sum<TSource>(IEnumerable<TSource>, Func<TSource, Nullable<Double>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Sum<TSource>(IEnumerable<TSource>, Func<TSource, Nullable<Int32>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Sum<TSource>(IEnumerable<TSource>, Func<TSource, Nullable<Int64>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Sum<TSource>(IEnumerable<TSource>, Func<TSource, Nullable<Single>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Sum<TSource>(IEnumerable<TSource>, Func<TSource, Single>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Take<TSource>(IEnumerable<TSource>, int) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Enumerable.TakeWhile<TSource>(IEnumerable<TSource>, Func<TSource, Boolean>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Enumerable.TakeWhile<TSource>(IEnumerable<TSource>, Func<TSource, Boolean>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.TakeWhile<TSource>(IEnumerable<TSource>, Func<TSource, Int32, Boolean>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Enumerable.TakeWhile<TSource>(IEnumerable<TSource>, Func<TSource, Int32, Boolean>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.ThenBy<TSource, TKey>(IOrderedEnumerable<TSource>, Func<TSource, TKey>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Enumerable.ThenBy<TSource, TKey>(IOrderedEnumerable<TSource>, Func<TSource, TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.ThenBy<TSource, TKey>(IOrderedEnumerable<TSource>, Func<TSource, TKey>, IComparer<TKey>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Enumerable.ThenBy<TSource, TKey>(IOrderedEnumerable<TSource>, Func<TSource, TKey>, IComparer<TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.ThenByDescending<TSource, TKey>(IOrderedEnumerable<TSource>, Func<TSource, TKey>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Enumerable.ThenByDescending<TSource, TKey>(IOrderedEnumerable<TSource>, Func<TSource, TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.ThenByDescending<TSource, TKey>(IOrderedEnumerable<TSource>, Func<TSource, TKey>, IComparer<TKey>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Enumerable.ThenByDescending<TSource, TKey>(IOrderedEnumerable<TSource>, Func<TSource, TKey>, IComparer<TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.ToArray<TSource>(IEnumerable<TSource>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Enumerable.ToDictionary<TSource, TKey, TElement>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.ToDictionary<TSource, TKey, TElement>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.Enumerable.ToDictionary<TSource, TKey, TElement>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>) | return (normal) of argument 2 -> element of return (normal) | true |
+| System.Linq.Enumerable.ToDictionary<TSource, TKey, TElement>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.ToDictionary<TSource, TKey, TElement>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.Enumerable.ToDictionary<TSource, TKey, TElement>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, IEqualityComparer<TKey>) | return (normal) of argument 2 -> element of return (normal) | true |
+| System.Linq.Enumerable.ToDictionary<TSource, TKey>(IEnumerable<TSource>, Func<TSource, TKey>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Enumerable.ToDictionary<TSource, TKey>(IEnumerable<TSource>, Func<TSource, TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.ToDictionary<TSource, TKey>(IEnumerable<TSource>, Func<TSource, TKey>, IEqualityComparer<TKey>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Enumerable.ToDictionary<TSource, TKey>(IEnumerable<TSource>, Func<TSource, TKey>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.ToList<TSource>(IEnumerable<TSource>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Enumerable.ToLookup<TSource, TKey, TElement>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.ToLookup<TSource, TKey, TElement>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.Enumerable.ToLookup<TSource, TKey, TElement>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>) | return (normal) of argument 2 -> element of return (normal) | true |
+| System.Linq.Enumerable.ToLookup<TSource, TKey, TElement>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.ToLookup<TSource, TKey, TElement>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.Enumerable.ToLookup<TSource, TKey, TElement>(IEnumerable<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, IEqualityComparer<TKey>) | return (normal) of argument 2 -> element of return (normal) | true |
+| System.Linq.Enumerable.ToLookup<TSource, TKey>(IEnumerable<TSource>, Func<TSource, TKey>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Enumerable.ToLookup<TSource, TKey>(IEnumerable<TSource>, Func<TSource, TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.ToLookup<TSource, TKey>(IEnumerable<TSource>, Func<TSource, TKey>, IEqualityComparer<TKey>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Enumerable.ToLookup<TSource, TKey>(IEnumerable<TSource>, Func<TSource, TKey>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Union<TSource>(IEnumerable<TSource>, IEnumerable<TSource>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Enumerable.Union<TSource>(IEnumerable<TSource>, IEnumerable<TSource>) | element of argument 1 -> element of return (normal) | true |
+| System.Linq.Enumerable.Union<TSource>(IEnumerable<TSource>, IEnumerable<TSource>, IEqualityComparer<TSource>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Enumerable.Union<TSource>(IEnumerable<TSource>, IEnumerable<TSource>, IEqualityComparer<TSource>) | element of argument 1 -> element of return (normal) | true |
+| System.Linq.Enumerable.Where<TSource>(IEnumerable<TSource>, Func<TSource, Boolean>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Enumerable.Where<TSource>(IEnumerable<TSource>, Func<TSource, Boolean>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Where<TSource>(IEnumerable<TSource>, Func<TSource, Int32, Boolean>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Enumerable.Where<TSource>(IEnumerable<TSource>, Func<TSource, Int32, Boolean>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Enumerable.Zip<TFirst, TSecond, TResult>(IEnumerable<TFirst>, IEnumerable<TSecond>, Func<TFirst, TSecond, TResult>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.Enumerable.Zip<TFirst, TSecond, TResult>(IEnumerable<TFirst>, IEnumerable<TSecond>, Func<TFirst, TSecond, TResult>) | element of argument 1 -> parameter 1 of argument 2 | true |
+| System.Linq.Enumerable.Zip<TFirst, TSecond, TResult>(IEnumerable<TFirst>, IEnumerable<TSecond>, Func<TFirst, TSecond, TResult>) | return (normal) of argument 2 -> element of return (normal) | true |
+| System.Linq.EnumerableQuery<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.Expressions.BlockExpressionList.Add(Expression) | argument 0 -> element of argument -1 | true |
+| System.Linq.Expressions.BlockExpressionList.CopyTo(Expression[], int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Linq.Expressions.BlockExpressionList.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.Expressions.BlockExpressionList.Insert(int, Expression) | argument 1 -> element of argument -1 | true |
+| System.Linq.Expressions.BlockExpressionList.get_Item(int) | element of argument -1 -> return (normal) | true |
+| System.Linq.Expressions.BlockExpressionList.set_Item(int, Expression) | argument 1 -> element of argument -1 | true |
+| System.Linq.Expressions.Compiler.CompilerScope.<GetVariablesIncludingMerged>d__32.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.Expressions.Compiler.ParameterList.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.Expressions.Interpreter.InterpretedFrame.<GetStackTraceDebugInfo>d__29.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.GroupedEnumerable<,,>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.GroupedEnumerable<,>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.GroupedResultEnumerable<,,,>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.GroupedResultEnumerable<,,>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.Grouping<,>.Add(TElement) | argument 0 -> element of argument -1 | true |
+| System.Linq.Grouping<,>.CopyTo(TElement[], int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Linq.Grouping<,>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.Grouping<,>.Insert(int, TElement) | argument 1 -> element of argument -1 | true |
+| System.Linq.Grouping<,>.get_Item(int) | element of argument -1 -> return (normal) | true |
+| System.Linq.Grouping<,>.set_Item(int, TElement) | argument 1 -> element of argument -1 | true |
+| System.Linq.Lookup<,>.<ApplyResultSelector>d__19<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.Lookup<,>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.OrderedEnumerable<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.OrderedPartition<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.Parallel.CancellableEnumerable.<Wrap>d__0<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.Parallel.EnumerableWrapperWeakToStrong.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.Parallel.ExceptionAggregator.<WrapEnumerable>d__0<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.Parallel.ExceptionAggregator.<WrapQueryEnumerator>d__1<,>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.Parallel.GroupByGrouping<,>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.Parallel.ListChunk<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.Parallel.Lookup<,>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.Parallel.MergeExecutor<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.Parallel.OrderedGroupByGrouping<,,>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.Parallel.ParallelEnumerableWrapper.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.Parallel.PartitionerQueryOperator<>.<AsSequentialQuery>d__5.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.Parallel.QueryResults<>.Add(T) | argument 0 -> element of argument -1 | true |
+| System.Linq.Parallel.QueryResults<>.CopyTo(T[], int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Linq.Parallel.QueryResults<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.Parallel.QueryResults<>.Insert(int, T) | argument 1 -> element of argument -1 | true |
+| System.Linq.Parallel.QueryResults<>.get_Item(int) | element of argument -1 -> return (normal) | true |
+| System.Linq.Parallel.QueryResults<>.set_Item(int, T) | argument 1 -> element of argument -1 | true |
+| System.Linq.Parallel.RangeEnumerable.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.Parallel.ZipQueryOperator<,,>.<AsSequentialQuery>d__9.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.ParallelEnumerable.Aggregate<TSource, TAccumulate, TResult>(ParallelQuery<TSource>, TAccumulate, Func<TAccumulate, TSource, TAccumulate>, Func<TAccumulate, TResult>) | argument 1 -> parameter 0 of argument 2 | true |
+| System.Linq.ParallelEnumerable.Aggregate<TSource, TAccumulate, TResult>(ParallelQuery<TSource>, TAccumulate, Func<TAccumulate, TSource, TAccumulate>, Func<TAccumulate, TResult>) | element of argument 0 -> parameter 1 of argument 2 | true |
+| System.Linq.ParallelEnumerable.Aggregate<TSource, TAccumulate, TResult>(ParallelQuery<TSource>, TAccumulate, Func<TAccumulate, TSource, TAccumulate>, Func<TAccumulate, TResult>) | return (normal) of argument 2 -> parameter 0 of argument 3 | true |
+| System.Linq.ParallelEnumerable.Aggregate<TSource, TAccumulate, TResult>(ParallelQuery<TSource>, TAccumulate, Func<TAccumulate, TSource, TAccumulate>, Func<TAccumulate, TResult>) | return (normal) of argument 3 -> return (normal) | true |
+| System.Linq.ParallelEnumerable.Aggregate<TSource, TAccumulate>(ParallelQuery<TSource>, TAccumulate, Func<TAccumulate, TSource, TAccumulate>) | argument 1 -> parameter 0 of argument 2 | true |
+| System.Linq.ParallelEnumerable.Aggregate<TSource, TAccumulate>(ParallelQuery<TSource>, TAccumulate, Func<TAccumulate, TSource, TAccumulate>) | element of argument 0 -> parameter 1 of argument 2 | true |
+| System.Linq.ParallelEnumerable.Aggregate<TSource, TAccumulate>(ParallelQuery<TSource>, TAccumulate, Func<TAccumulate, TSource, TAccumulate>) | return (normal) of argument 2 -> return (normal) | true |
+| System.Linq.ParallelEnumerable.Aggregate<TSource>(ParallelQuery<TSource>, Func<TSource, TSource, TSource>) | element of argument 0 -> parameter 1 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Aggregate<TSource>(ParallelQuery<TSource>, Func<TSource, TSource, TSource>) | return (normal) of argument 1 -> return (normal) | true |
+| System.Linq.ParallelEnumerable.All<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Any<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.AsEnumerable<TSource>(ParallelQuery<TSource>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.Average<TSource>(ParallelQuery<TSource>, Func<TSource, Decimal>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Average<TSource>(ParallelQuery<TSource>, Func<TSource, Double>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Average<TSource>(ParallelQuery<TSource>, Func<TSource, Int32>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Average<TSource>(ParallelQuery<TSource>, Func<TSource, Int64>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Average<TSource>(ParallelQuery<TSource>, Func<TSource, Nullable<Decimal>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Average<TSource>(ParallelQuery<TSource>, Func<TSource, Nullable<Double>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Average<TSource>(ParallelQuery<TSource>, Func<TSource, Nullable<Int32>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Average<TSource>(ParallelQuery<TSource>, Func<TSource, Nullable<Int64>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Average<TSource>(ParallelQuery<TSource>, Func<TSource, Nullable<Single>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Average<TSource>(ParallelQuery<TSource>, Func<TSource, Single>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Cast<TResult>(ParallelQuery) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.Concat<TSource>(ParallelQuery<TSource>, IEnumerable<TSource>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.Concat<TSource>(ParallelQuery<TSource>, IEnumerable<TSource>) | element of argument 1 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.Concat<TSource>(ParallelQuery<TSource>, ParallelQuery<TSource>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.Concat<TSource>(ParallelQuery<TSource>, ParallelQuery<TSource>) | element of argument 1 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.Count<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.DefaultIfEmpty<TSource>(ParallelQuery<TSource>) | element of argument 0 -> return (normal) | true |
+| System.Linq.ParallelEnumerable.DefaultIfEmpty<TSource>(ParallelQuery<TSource>, TSource) | argument 1 -> return (normal) | true |
+| System.Linq.ParallelEnumerable.DefaultIfEmpty<TSource>(ParallelQuery<TSource>, TSource) | element of argument 0 -> return (normal) | true |
+| System.Linq.ParallelEnumerable.Distinct<TSource>(ParallelQuery<TSource>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.Distinct<TSource>(ParallelQuery<TSource>, IEqualityComparer<TSource>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.ElementAt<TSource>(ParallelQuery<TSource>, int) | element of argument 0 -> return (normal) | true |
+| System.Linq.ParallelEnumerable.ElementAtOrDefault<TSource>(ParallelQuery<TSource>, int) | element of argument 0 -> return (normal) | true |
+| System.Linq.ParallelEnumerable.Except<TSource>(ParallelQuery<TSource>, IEnumerable<TSource>) | element of argument 0 -> return (normal) | true |
+| System.Linq.ParallelEnumerable.Except<TSource>(ParallelQuery<TSource>, IEnumerable<TSource>, IEqualityComparer<TSource>) | element of argument 0 -> return (normal) | true |
+| System.Linq.ParallelEnumerable.Except<TSource>(ParallelQuery<TSource>, ParallelQuery<TSource>) | element of argument 0 -> return (normal) | true |
+| System.Linq.ParallelEnumerable.Except<TSource>(ParallelQuery<TSource>, ParallelQuery<TSource>, IEqualityComparer<TSource>) | element of argument 0 -> return (normal) | true |
+| System.Linq.ParallelEnumerable.First<TSource>(ParallelQuery<TSource>) | element of argument 0 -> return (normal) | true |
+| System.Linq.ParallelEnumerable.First<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.First<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | element of argument 0 -> return (normal) | true |
+| System.Linq.ParallelEnumerable.FirstOrDefault<TSource>(ParallelQuery<TSource>) | element of argument 0 -> return (normal) | true |
+| System.Linq.ParallelEnumerable.FirstOrDefault<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.FirstOrDefault<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | element of argument 0 -> return (normal) | true |
+| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TElement, TResult>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, Func<TKey, IEnumerable<TElement>, TResult>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TElement, TResult>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, Func<TKey, IEnumerable<TElement>, TResult>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TElement, TResult>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, Func<TKey, IEnumerable<TElement>, TResult>) | return (normal) of argument 1 -> parameter 0 of argument 2 | true |
+| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TElement, TResult>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, Func<TKey, IEnumerable<TElement>, TResult>) | return (normal) of argument 2 -> element of parameter 1 of argument 3 | true |
+| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TElement, TResult>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, Func<TKey, IEnumerable<TElement>, TResult>) | return (normal) of argument 3 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TElement, TResult>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, Func<TKey, IEnumerable<TElement>, TResult>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TElement, TResult>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, Func<TKey, IEnumerable<TElement>, TResult>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TElement, TResult>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, Func<TKey, IEnumerable<TElement>, TResult>, IEqualityComparer<TKey>) | return (normal) of argument 1 -> parameter 0 of argument 2 | true |
+| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TElement, TResult>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, Func<TKey, IEnumerable<TElement>, TResult>, IEqualityComparer<TKey>) | return (normal) of argument 2 -> element of parameter 1 of argument 3 | true |
+| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TElement, TResult>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, Func<TKey, IEnumerable<TElement>, TResult>, IEqualityComparer<TKey>) | return (normal) of argument 3 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TElement>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TElement>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TElement>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>) | return (normal) of argument 2 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TElement>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TElement>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TElement>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, IEqualityComparer<TKey>) | return (normal) of argument 1 -> parameter 0 of argument 2 | true |
+| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TResult>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TKey, IEnumerable<TSource>, TResult>) | argument 0 -> parameter 1 of argument 2 | true |
+| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TResult>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TKey, IEnumerable<TSource>, TResult>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TResult>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TKey, IEnumerable<TSource>, TResult>) | return (normal) of argument 1 -> parameter 0 of argument 2 | true |
+| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TResult>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TKey, IEnumerable<TSource>, TResult>) | return (normal) of argument 2 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TResult>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TKey, IEnumerable<TSource>, TResult>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TResult>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TKey, IEnumerable<TSource>, TResult>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey, TResult>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TKey, IEnumerable<TSource>, TResult>, IEqualityComparer<TKey>) | return (normal) of argument 1 -> parameter 0 of argument 2 | true |
+| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey>(ParallelQuery<TSource>, Func<TSource, TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.GroupBy<TSource, TKey>(ParallelQuery<TSource>, Func<TSource, TKey>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.GroupJoin<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.ParallelEnumerable.GroupJoin<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>) | element of argument 0 -> parameter 0 of argument 4 | true |
+| System.Linq.ParallelEnumerable.GroupJoin<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>) | element of argument 1 -> parameter 0 of argument 3 | true |
+| System.Linq.ParallelEnumerable.GroupJoin<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>) | element of argument 1 -> parameter 1 of argument 4 | true |
+| System.Linq.ParallelEnumerable.GroupJoin<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>) | return (normal) of argument 4 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.GroupJoin<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.ParallelEnumerable.GroupJoin<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 4 | true |
+| System.Linq.ParallelEnumerable.GroupJoin<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>, IEqualityComparer<TKey>) | element of argument 1 -> parameter 0 of argument 3 | true |
+| System.Linq.ParallelEnumerable.GroupJoin<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>, IEqualityComparer<TKey>) | element of argument 1 -> parameter 1 of argument 4 | true |
+| System.Linq.ParallelEnumerable.GroupJoin<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>, IEqualityComparer<TKey>) | return (normal) of argument 4 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.GroupJoin<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, ParallelQuery<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.ParallelEnumerable.GroupJoin<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, ParallelQuery<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>) | element of argument 0 -> parameter 0 of argument 4 | true |
+| System.Linq.ParallelEnumerable.GroupJoin<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, ParallelQuery<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>) | element of argument 1 -> parameter 0 of argument 3 | true |
+| System.Linq.ParallelEnumerable.GroupJoin<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, ParallelQuery<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>) | element of argument 1 -> parameter 1 of argument 4 | true |
+| System.Linq.ParallelEnumerable.GroupJoin<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, ParallelQuery<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>) | return (normal) of argument 4 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.GroupJoin<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, ParallelQuery<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.ParallelEnumerable.GroupJoin<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, ParallelQuery<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 4 | true |
+| System.Linq.ParallelEnumerable.GroupJoin<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, ParallelQuery<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>, IEqualityComparer<TKey>) | element of argument 1 -> parameter 0 of argument 3 | true |
+| System.Linq.ParallelEnumerable.GroupJoin<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, ParallelQuery<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>, IEqualityComparer<TKey>) | element of argument 1 -> parameter 1 of argument 4 | true |
+| System.Linq.ParallelEnumerable.GroupJoin<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, ParallelQuery<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, IEnumerable<TInner>, TResult>, IEqualityComparer<TKey>) | return (normal) of argument 4 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.Intersect<TSource>(ParallelQuery<TSource>, IEnumerable<TSource>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.Intersect<TSource>(ParallelQuery<TSource>, IEnumerable<TSource>) | element of argument 1 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.Intersect<TSource>(ParallelQuery<TSource>, IEnumerable<TSource>, IEqualityComparer<TSource>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.Intersect<TSource>(ParallelQuery<TSource>, IEnumerable<TSource>, IEqualityComparer<TSource>) | element of argument 1 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.Intersect<TSource>(ParallelQuery<TSource>, ParallelQuery<TSource>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.Intersect<TSource>(ParallelQuery<TSource>, ParallelQuery<TSource>) | element of argument 1 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.Intersect<TSource>(ParallelQuery<TSource>, ParallelQuery<TSource>, IEqualityComparer<TSource>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.Intersect<TSource>(ParallelQuery<TSource>, ParallelQuery<TSource>, IEqualityComparer<TSource>) | element of argument 1 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.Join<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.ParallelEnumerable.Join<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>) | element of argument 0 -> parameter 0 of argument 4 | true |
+| System.Linq.ParallelEnumerable.Join<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>) | element of argument 1 -> parameter 0 of argument 3 | true |
+| System.Linq.ParallelEnumerable.Join<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>) | element of argument 1 -> parameter 1 of argument 4 | true |
+| System.Linq.ParallelEnumerable.Join<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>) | return (normal) of argument 4 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.Join<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.ParallelEnumerable.Join<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 4 | true |
+| System.Linq.ParallelEnumerable.Join<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>, IEqualityComparer<TKey>) | element of argument 1 -> parameter 0 of argument 3 | true |
+| System.Linq.ParallelEnumerable.Join<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>, IEqualityComparer<TKey>) | element of argument 1 -> parameter 1 of argument 4 | true |
+| System.Linq.ParallelEnumerable.Join<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, IEnumerable<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>, IEqualityComparer<TKey>) | return (normal) of argument 4 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.Join<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, ParallelQuery<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.ParallelEnumerable.Join<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, ParallelQuery<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>) | element of argument 0 -> parameter 0 of argument 4 | true |
+| System.Linq.ParallelEnumerable.Join<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, ParallelQuery<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>) | element of argument 1 -> parameter 0 of argument 3 | true |
+| System.Linq.ParallelEnumerable.Join<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, ParallelQuery<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>) | element of argument 1 -> parameter 1 of argument 4 | true |
+| System.Linq.ParallelEnumerable.Join<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, ParallelQuery<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>) | return (normal) of argument 4 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.Join<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, ParallelQuery<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.ParallelEnumerable.Join<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, ParallelQuery<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 4 | true |
+| System.Linq.ParallelEnumerable.Join<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, ParallelQuery<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>, IEqualityComparer<TKey>) | element of argument 1 -> parameter 0 of argument 3 | true |
+| System.Linq.ParallelEnumerable.Join<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, ParallelQuery<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>, IEqualityComparer<TKey>) | element of argument 1 -> parameter 1 of argument 4 | true |
+| System.Linq.ParallelEnumerable.Join<TOuter, TInner, TKey, TResult>(ParallelQuery<TOuter>, ParallelQuery<TInner>, Func<TOuter, TKey>, Func<TInner, TKey>, Func<TOuter, TInner, TResult>, IEqualityComparer<TKey>) | return (normal) of argument 4 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.Last<TSource>(ParallelQuery<TSource>) | element of argument 0 -> return (normal) | true |
+| System.Linq.ParallelEnumerable.Last<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Last<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | element of argument 0 -> return (normal) | true |
+| System.Linq.ParallelEnumerable.LastOrDefault<TSource>(ParallelQuery<TSource>) | element of argument 0 -> return (normal) | true |
+| System.Linq.ParallelEnumerable.LastOrDefault<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.LastOrDefault<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | element of argument 0 -> return (normal) | true |
+| System.Linq.ParallelEnumerable.LongCount<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Max<TSource, TResult>(ParallelQuery<TSource>, Func<TSource, TResult>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Max<TSource>(ParallelQuery<TSource>, Func<TSource, Decimal>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Max<TSource>(ParallelQuery<TSource>, Func<TSource, Double>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Max<TSource>(ParallelQuery<TSource>, Func<TSource, Int32>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Max<TSource>(ParallelQuery<TSource>, Func<TSource, Int64>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Max<TSource>(ParallelQuery<TSource>, Func<TSource, Nullable<Decimal>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Max<TSource>(ParallelQuery<TSource>, Func<TSource, Nullable<Double>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Max<TSource>(ParallelQuery<TSource>, Func<TSource, Nullable<Int32>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Max<TSource>(ParallelQuery<TSource>, Func<TSource, Nullable<Int64>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Max<TSource>(ParallelQuery<TSource>, Func<TSource, Nullable<Single>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Max<TSource>(ParallelQuery<TSource>, Func<TSource, Single>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Min<TSource, TResult>(ParallelQuery<TSource>, Func<TSource, TResult>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Min<TSource>(ParallelQuery<TSource>, Func<TSource, Decimal>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Min<TSource>(ParallelQuery<TSource>, Func<TSource, Double>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Min<TSource>(ParallelQuery<TSource>, Func<TSource, Int32>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Min<TSource>(ParallelQuery<TSource>, Func<TSource, Int64>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Min<TSource>(ParallelQuery<TSource>, Func<TSource, Nullable<Decimal>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Min<TSource>(ParallelQuery<TSource>, Func<TSource, Nullable<Double>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Min<TSource>(ParallelQuery<TSource>, Func<TSource, Nullable<Int32>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Min<TSource>(ParallelQuery<TSource>, Func<TSource, Nullable<Int64>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Min<TSource>(ParallelQuery<TSource>, Func<TSource, Nullable<Single>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Min<TSource>(ParallelQuery<TSource>, Func<TSource, Single>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.OfType<TResult>(ParallelQuery) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.OrderBy<TSource, TKey>(ParallelQuery<TSource>, Func<TSource, TKey>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.OrderBy<TSource, TKey>(ParallelQuery<TSource>, Func<TSource, TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.OrderBy<TSource, TKey>(ParallelQuery<TSource>, Func<TSource, TKey>, IComparer<TKey>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.OrderBy<TSource, TKey>(ParallelQuery<TSource>, Func<TSource, TKey>, IComparer<TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.OrderByDescending<TSource, TKey>(ParallelQuery<TSource>, Func<TSource, TKey>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.OrderByDescending<TSource, TKey>(ParallelQuery<TSource>, Func<TSource, TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.OrderByDescending<TSource, TKey>(ParallelQuery<TSource>, Func<TSource, TKey>, IComparer<TKey>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.OrderByDescending<TSource, TKey>(ParallelQuery<TSource>, Func<TSource, TKey>, IComparer<TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Reverse<TSource>(ParallelQuery<TSource>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.Select<TSource, TResult>(ParallelQuery<TSource>, Func<TSource, Int32, TResult>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Select<TSource, TResult>(ParallelQuery<TSource>, Func<TSource, Int32, TResult>) | return (normal) of argument 1 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.Select<TSource, TResult>(ParallelQuery<TSource>, Func<TSource, TResult>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Select<TSource, TResult>(ParallelQuery<TSource>, Func<TSource, TResult>) | return (normal) of argument 1 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.SelectMany<TSource, TCollection, TResult>(ParallelQuery<TSource>, Func<TSource, IEnumerable<TCollection>>, Func<TSource, TCollection, TResult>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.SelectMany<TSource, TCollection, TResult>(ParallelQuery<TSource>, Func<TSource, IEnumerable<TCollection>>, Func<TSource, TCollection, TResult>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.ParallelEnumerable.SelectMany<TSource, TCollection, TResult>(ParallelQuery<TSource>, Func<TSource, IEnumerable<TCollection>>, Func<TSource, TCollection, TResult>) | element of return (normal) of argument 1 -> parameter 1 of argument 2 | true |
+| System.Linq.ParallelEnumerable.SelectMany<TSource, TCollection, TResult>(ParallelQuery<TSource>, Func<TSource, IEnumerable<TCollection>>, Func<TSource, TCollection, TResult>) | return (normal) of argument 2 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.SelectMany<TSource, TCollection, TResult>(ParallelQuery<TSource>, Func<TSource, Int32, IEnumerable<TCollection>>, Func<TSource, TCollection, TResult>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.SelectMany<TSource, TCollection, TResult>(ParallelQuery<TSource>, Func<TSource, Int32, IEnumerable<TCollection>>, Func<TSource, TCollection, TResult>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.ParallelEnumerable.SelectMany<TSource, TCollection, TResult>(ParallelQuery<TSource>, Func<TSource, Int32, IEnumerable<TCollection>>, Func<TSource, TCollection, TResult>) | element of return (normal) of argument 1 -> parameter 1 of argument 2 | true |
+| System.Linq.ParallelEnumerable.SelectMany<TSource, TCollection, TResult>(ParallelQuery<TSource>, Func<TSource, Int32, IEnumerable<TCollection>>, Func<TSource, TCollection, TResult>) | return (normal) of argument 2 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.SelectMany<TSource, TResult>(ParallelQuery<TSource>, Func<TSource, IEnumerable<TResult>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.SelectMany<TSource, TResult>(ParallelQuery<TSource>, Func<TSource, IEnumerable<TResult>>) | return (normal) of argument 1 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.SelectMany<TSource, TResult>(ParallelQuery<TSource>, Func<TSource, Int32, IEnumerable<TResult>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.SelectMany<TSource, TResult>(ParallelQuery<TSource>, Func<TSource, Int32, IEnumerable<TResult>>) | return (normal) of argument 1 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.Single<TSource>(ParallelQuery<TSource>) | element of argument 0 -> return (normal) | true |
+| System.Linq.ParallelEnumerable.Single<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Single<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | element of argument 0 -> return (normal) | true |
+| System.Linq.ParallelEnumerable.SingleOrDefault<TSource>(ParallelQuery<TSource>) | element of argument 0 -> return (normal) | true |
+| System.Linq.ParallelEnumerable.SingleOrDefault<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.SingleOrDefault<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | element of argument 0 -> return (normal) | true |
+| System.Linq.ParallelEnumerable.Skip<TSource>(ParallelQuery<TSource>, int) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.SkipWhile<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.SkipWhile<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.SkipWhile<TSource>(ParallelQuery<TSource>, Func<TSource, Int32, Boolean>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.SkipWhile<TSource>(ParallelQuery<TSource>, Func<TSource, Int32, Boolean>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Sum<TSource>(ParallelQuery<TSource>, Func<TSource, Decimal>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Sum<TSource>(ParallelQuery<TSource>, Func<TSource, Double>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Sum<TSource>(ParallelQuery<TSource>, Func<TSource, Int32>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Sum<TSource>(ParallelQuery<TSource>, Func<TSource, Int64>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Sum<TSource>(ParallelQuery<TSource>, Func<TSource, Nullable<Decimal>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Sum<TSource>(ParallelQuery<TSource>, Func<TSource, Nullable<Double>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Sum<TSource>(ParallelQuery<TSource>, Func<TSource, Nullable<Int32>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Sum<TSource>(ParallelQuery<TSource>, Func<TSource, Nullable<Int64>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Sum<TSource>(ParallelQuery<TSource>, Func<TSource, Nullable<Single>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Sum<TSource>(ParallelQuery<TSource>, Func<TSource, Single>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Take<TSource>(ParallelQuery<TSource>, int) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.TakeWhile<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.TakeWhile<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.TakeWhile<TSource>(ParallelQuery<TSource>, Func<TSource, Int32, Boolean>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.TakeWhile<TSource>(ParallelQuery<TSource>, Func<TSource, Int32, Boolean>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.ThenBy<TSource, TKey>(OrderedParallelQuery<TSource>, Func<TSource, TKey>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.ThenBy<TSource, TKey>(OrderedParallelQuery<TSource>, Func<TSource, TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.ThenBy<TSource, TKey>(OrderedParallelQuery<TSource>, Func<TSource, TKey>, IComparer<TKey>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.ThenBy<TSource, TKey>(OrderedParallelQuery<TSource>, Func<TSource, TKey>, IComparer<TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.ThenByDescending<TSource, TKey>(OrderedParallelQuery<TSource>, Func<TSource, TKey>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.ThenByDescending<TSource, TKey>(OrderedParallelQuery<TSource>, Func<TSource, TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.ThenByDescending<TSource, TKey>(OrderedParallelQuery<TSource>, Func<TSource, TKey>, IComparer<TKey>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.ThenByDescending<TSource, TKey>(OrderedParallelQuery<TSource>, Func<TSource, TKey>, IComparer<TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.ToArray<TSource>(ParallelQuery<TSource>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.ToDictionary<TSource, TKey, TElement>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.ToDictionary<TSource, TKey, TElement>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.ParallelEnumerable.ToDictionary<TSource, TKey, TElement>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>) | return (normal) of argument 2 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.ToDictionary<TSource, TKey, TElement>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.ToDictionary<TSource, TKey, TElement>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.ParallelEnumerable.ToDictionary<TSource, TKey, TElement>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, IEqualityComparer<TKey>) | return (normal) of argument 2 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.ToDictionary<TSource, TKey>(ParallelQuery<TSource>, Func<TSource, TKey>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.ToDictionary<TSource, TKey>(ParallelQuery<TSource>, Func<TSource, TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.ToDictionary<TSource, TKey>(ParallelQuery<TSource>, Func<TSource, TKey>, IEqualityComparer<TKey>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.ToDictionary<TSource, TKey>(ParallelQuery<TSource>, Func<TSource, TKey>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.ToList<TSource>(ParallelQuery<TSource>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.ToLookup<TSource, TKey, TElement>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.ToLookup<TSource, TKey, TElement>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.ParallelEnumerable.ToLookup<TSource, TKey, TElement>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>) | return (normal) of argument 2 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.ToLookup<TSource, TKey, TElement>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.ToLookup<TSource, TKey, TElement>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.ParallelEnumerable.ToLookup<TSource, TKey, TElement>(ParallelQuery<TSource>, Func<TSource, TKey>, Func<TSource, TElement>, IEqualityComparer<TKey>) | return (normal) of argument 2 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.ToLookup<TSource, TKey>(ParallelQuery<TSource>, Func<TSource, TKey>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.ToLookup<TSource, TKey>(ParallelQuery<TSource>, Func<TSource, TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.ToLookup<TSource, TKey>(ParallelQuery<TSource>, Func<TSource, TKey>, IEqualityComparer<TKey>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.ToLookup<TSource, TKey>(ParallelQuery<TSource>, Func<TSource, TKey>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Union<TSource>(ParallelQuery<TSource>, IEnumerable<TSource>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.Union<TSource>(ParallelQuery<TSource>, IEnumerable<TSource>) | element of argument 1 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.Union<TSource>(ParallelQuery<TSource>, IEnumerable<TSource>, IEqualityComparer<TSource>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.Union<TSource>(ParallelQuery<TSource>, IEnumerable<TSource>, IEqualityComparer<TSource>) | element of argument 1 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.Union<TSource>(ParallelQuery<TSource>, ParallelQuery<TSource>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.Union<TSource>(ParallelQuery<TSource>, ParallelQuery<TSource>) | element of argument 1 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.Union<TSource>(ParallelQuery<TSource>, ParallelQuery<TSource>, IEqualityComparer<TSource>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.Union<TSource>(ParallelQuery<TSource>, ParallelQuery<TSource>, IEqualityComparer<TSource>) | element of argument 1 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.Where<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.Where<TSource>(ParallelQuery<TSource>, Func<TSource, Boolean>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Where<TSource>(ParallelQuery<TSource>, Func<TSource, Int32, Boolean>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.Where<TSource>(ParallelQuery<TSource>, Func<TSource, Int32, Boolean>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.ParallelEnumerable.Zip<TFirst, TSecond, TResult>(ParallelQuery<TFirst>, IEnumerable<TSecond>, Func<TFirst, TSecond, TResult>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.ParallelEnumerable.Zip<TFirst, TSecond, TResult>(ParallelQuery<TFirst>, IEnumerable<TSecond>, Func<TFirst, TSecond, TResult>) | element of argument 1 -> parameter 1 of argument 2 | true |
+| System.Linq.ParallelEnumerable.Zip<TFirst, TSecond, TResult>(ParallelQuery<TFirst>, IEnumerable<TSecond>, Func<TFirst, TSecond, TResult>) | return (normal) of argument 2 -> element of return (normal) | true |
+| System.Linq.ParallelEnumerable.Zip<TFirst, TSecond, TResult>(ParallelQuery<TFirst>, ParallelQuery<TSecond>, Func<TFirst, TSecond, TResult>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.ParallelEnumerable.Zip<TFirst, TSecond, TResult>(ParallelQuery<TFirst>, ParallelQuery<TSecond>, Func<TFirst, TSecond, TResult>) | element of argument 1 -> parameter 1 of argument 2 | true |
+| System.Linq.ParallelEnumerable.Zip<TFirst, TSecond, TResult>(ParallelQuery<TFirst>, ParallelQuery<TSecond>, Func<TFirst, TSecond, TResult>) | return (normal) of argument 2 -> element of return (normal) | true |
+| System.Linq.ParallelQuery.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Linq.Queryable.Aggregate<TSource, TAccumulate, TResult>(IQueryable<TSource>, TAccumulate, Expression<Func<TAccumulate,TSource,TAccumulate>>, Expression<Func<TAccumulate,TResult>>) | argument 1 -> parameter 0 of argument 2 | true |
+| System.Linq.Queryable.Aggregate<TSource, TAccumulate, TResult>(IQueryable<TSource>, TAccumulate, Expression<Func<TAccumulate,TSource,TAccumulate>>, Expression<Func<TAccumulate,TResult>>) | element of argument 0 -> parameter 1 of argument 2 | true |
+| System.Linq.Queryable.Aggregate<TSource, TAccumulate, TResult>(IQueryable<TSource>, TAccumulate, Expression<Func<TAccumulate,TSource,TAccumulate>>, Expression<Func<TAccumulate,TResult>>) | return (normal) of argument 2 -> parameter 0 of argument 3 | true |
+| System.Linq.Queryable.Aggregate<TSource, TAccumulate, TResult>(IQueryable<TSource>, TAccumulate, Expression<Func<TAccumulate,TSource,TAccumulate>>, Expression<Func<TAccumulate,TResult>>) | return (normal) of argument 3 -> return (normal) | true |
+| System.Linq.Queryable.Aggregate<TSource, TAccumulate>(IQueryable<TSource>, TAccumulate, Expression<Func<TAccumulate,TSource,TAccumulate>>) | argument 1 -> parameter 0 of argument 2 | true |
+| System.Linq.Queryable.Aggregate<TSource, TAccumulate>(IQueryable<TSource>, TAccumulate, Expression<Func<TAccumulate,TSource,TAccumulate>>) | element of argument 0 -> parameter 1 of argument 2 | true |
+| System.Linq.Queryable.Aggregate<TSource, TAccumulate>(IQueryable<TSource>, TAccumulate, Expression<Func<TAccumulate,TSource,TAccumulate>>) | return (normal) of argument 2 -> return (normal) | true |
+| System.Linq.Queryable.Aggregate<TSource>(IQueryable<TSource>, Expression<Func<TSource,TSource,TSource>>) | element of argument 0 -> parameter 1 of argument 1 | true |
+| System.Linq.Queryable.Aggregate<TSource>(IQueryable<TSource>, Expression<Func<TSource,TSource,TSource>>) | return (normal) of argument 1 -> return (normal) | true |
+| System.Linq.Queryable.All<TSource>(IQueryable<TSource>, Expression<Func<TSource,Boolean>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.Any<TSource>(IQueryable<TSource>, Expression<Func<TSource,Boolean>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.AsQueryable(IEnumerable) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Queryable.AsQueryable<TElement>(IEnumerable<TElement>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Queryable.Average<TSource>(IQueryable<TSource>, Expression<Func<TSource,Decimal>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.Average<TSource>(IQueryable<TSource>, Expression<Func<TSource,Double>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.Average<TSource>(IQueryable<TSource>, Expression<Func<TSource,Int32>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.Average<TSource>(IQueryable<TSource>, Expression<Func<TSource,Int64>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.Average<TSource>(IQueryable<TSource>, Expression<Func<TSource,Nullable<Decimal>>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.Average<TSource>(IQueryable<TSource>, Expression<Func<TSource,Nullable<Double>>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.Average<TSource>(IQueryable<TSource>, Expression<Func<TSource,Nullable<Int32>>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.Average<TSource>(IQueryable<TSource>, Expression<Func<TSource,Nullable<Int64>>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.Average<TSource>(IQueryable<TSource>, Expression<Func<TSource,Nullable<Single>>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.Average<TSource>(IQueryable<TSource>, Expression<Func<TSource,Single>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.Cast<TResult>(IQueryable) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Queryable.Concat<TSource>(IQueryable<TSource>, IEnumerable<TSource>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Queryable.Concat<TSource>(IQueryable<TSource>, IEnumerable<TSource>) | element of argument 1 -> element of return (normal) | true |
+| System.Linq.Queryable.Count<TSource>(IQueryable<TSource>, Expression<Func<TSource,Boolean>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.DefaultIfEmpty<TSource>(IQueryable<TSource>) | element of argument 0 -> return (normal) | true |
+| System.Linq.Queryable.DefaultIfEmpty<TSource>(IQueryable<TSource>, TSource) | argument 1 -> return (normal) | true |
+| System.Linq.Queryable.DefaultIfEmpty<TSource>(IQueryable<TSource>, TSource) | element of argument 0 -> return (normal) | true |
+| System.Linq.Queryable.Distinct<TSource>(IQueryable<TSource>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Queryable.Distinct<TSource>(IQueryable<TSource>, IEqualityComparer<TSource>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Queryable.ElementAt<TSource>(IQueryable<TSource>, int) | element of argument 0 -> return (normal) | true |
+| System.Linq.Queryable.ElementAtOrDefault<TSource>(IQueryable<TSource>, int) | element of argument 0 -> return (normal) | true |
+| System.Linq.Queryable.Except<TSource>(IQueryable<TSource>, IEnumerable<TSource>) | element of argument 0 -> return (normal) | true |
+| System.Linq.Queryable.Except<TSource>(IQueryable<TSource>, IEnumerable<TSource>, IEqualityComparer<TSource>) | element of argument 0 -> return (normal) | true |
+| System.Linq.Queryable.First<TSource>(IQueryable<TSource>) | element of argument 0 -> return (normal) | true |
+| System.Linq.Queryable.First<TSource>(IQueryable<TSource>, Expression<Func<TSource,Boolean>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.First<TSource>(IQueryable<TSource>, Expression<Func<TSource,Boolean>>) | element of argument 0 -> return (normal) | true |
+| System.Linq.Queryable.FirstOrDefault<TSource>(IQueryable<TSource>) | element of argument 0 -> return (normal) | true |
+| System.Linq.Queryable.FirstOrDefault<TSource>(IQueryable<TSource>, Expression<Func<TSource,Boolean>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.FirstOrDefault<TSource>(IQueryable<TSource>, Expression<Func<TSource,Boolean>>) | element of argument 0 -> return (normal) | true |
+| System.Linq.Queryable.GroupBy<TSource, TKey, TElement, TResult>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, Expression<Func<TSource,TElement>>, Expression<Func<TKey,IEnumerable<TElement>,TResult>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.GroupBy<TSource, TKey, TElement, TResult>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, Expression<Func<TSource,TElement>>, Expression<Func<TKey,IEnumerable<TElement>,TResult>>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.Queryable.GroupBy<TSource, TKey, TElement, TResult>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, Expression<Func<TSource,TElement>>, Expression<Func<TKey,IEnumerable<TElement>,TResult>>) | return (normal) of argument 1 -> parameter 0 of argument 2 | true |
+| System.Linq.Queryable.GroupBy<TSource, TKey, TElement, TResult>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, Expression<Func<TSource,TElement>>, Expression<Func<TKey,IEnumerable<TElement>,TResult>>) | return (normal) of argument 2 -> element of parameter 1 of argument 3 | true |
+| System.Linq.Queryable.GroupBy<TSource, TKey, TElement, TResult>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, Expression<Func<TSource,TElement>>, Expression<Func<TKey,IEnumerable<TElement>,TResult>>) | return (normal) of argument 3 -> element of return (normal) | true |
+| System.Linq.Queryable.GroupBy<TSource, TKey, TElement, TResult>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, Expression<Func<TSource,TElement>>, Expression<Func<TKey,IEnumerable<TElement>,TResult>>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.GroupBy<TSource, TKey, TElement, TResult>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, Expression<Func<TSource,TElement>>, Expression<Func<TKey,IEnumerable<TElement>,TResult>>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.Queryable.GroupBy<TSource, TKey, TElement, TResult>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, Expression<Func<TSource,TElement>>, Expression<Func<TKey,IEnumerable<TElement>,TResult>>, IEqualityComparer<TKey>) | return (normal) of argument 1 -> parameter 0 of argument 2 | true |
+| System.Linq.Queryable.GroupBy<TSource, TKey, TElement, TResult>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, Expression<Func<TSource,TElement>>, Expression<Func<TKey,IEnumerable<TElement>,TResult>>, IEqualityComparer<TKey>) | return (normal) of argument 2 -> element of parameter 1 of argument 3 | true |
+| System.Linq.Queryable.GroupBy<TSource, TKey, TElement, TResult>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, Expression<Func<TSource,TElement>>, Expression<Func<TKey,IEnumerable<TElement>,TResult>>, IEqualityComparer<TKey>) | return (normal) of argument 3 -> element of return (normal) | true |
+| System.Linq.Queryable.GroupBy<TSource, TKey, TElement>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, Expression<Func<TSource,TElement>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.GroupBy<TSource, TKey, TElement>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, Expression<Func<TSource,TElement>>) | return (normal) of argument 2 -> element of return (normal) | true |
+| System.Linq.Queryable.GroupBy<TSource, TKey, TElement>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, Expression<Func<TSource,TElement>>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.GroupBy<TSource, TKey, TElement>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, Expression<Func<TSource,TElement>>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.Queryable.GroupBy<TSource, TKey, TElement>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, Expression<Func<TSource,TElement>>, IEqualityComparer<TKey>) | return (normal) of argument 1 -> parameter 0 of argument 2 | true |
+| System.Linq.Queryable.GroupBy<TSource, TKey, TResult>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, Expression<Func<TKey,IEnumerable<TSource>,TResult>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.GroupBy<TSource, TKey, TResult>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, Expression<Func<TKey,IEnumerable<TSource>,TResult>>) | return (normal) of argument 2 -> element of return (normal) | true |
+| System.Linq.Queryable.GroupBy<TSource, TKey, TResult>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, Expression<Func<TKey,IEnumerable<TSource>,TResult>>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.GroupBy<TSource, TKey, TResult>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, Expression<Func<TKey,IEnumerable<TSource>,TResult>>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.Queryable.GroupBy<TSource, TKey, TResult>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, Expression<Func<TKey,IEnumerable<TSource>,TResult>>, IEqualityComparer<TKey>) | return (normal) of argument 1 -> parameter 0 of argument 2 | true |
+| System.Linq.Queryable.GroupBy<TSource, TKey>(IQueryable<TSource>, Expression<Func<TSource,TKey>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.GroupBy<TSource, TKey>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.GroupJoin<TOuter, TInner, TKey, TResult>(IQueryable<TOuter>, IEnumerable<TInner>, Expression<Func<TOuter,TKey>>, Expression<Func<TInner,TKey>>, Expression<Func<TOuter,IEnumerable<TInner>,TResult>>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.Queryable.GroupJoin<TOuter, TInner, TKey, TResult>(IQueryable<TOuter>, IEnumerable<TInner>, Expression<Func<TOuter,TKey>>, Expression<Func<TInner,TKey>>, Expression<Func<TOuter,IEnumerable<TInner>,TResult>>) | element of argument 0 -> parameter 0 of argument 4 | true |
+| System.Linq.Queryable.GroupJoin<TOuter, TInner, TKey, TResult>(IQueryable<TOuter>, IEnumerable<TInner>, Expression<Func<TOuter,TKey>>, Expression<Func<TInner,TKey>>, Expression<Func<TOuter,IEnumerable<TInner>,TResult>>) | element of argument 1 -> parameter 0 of argument 3 | true |
+| System.Linq.Queryable.GroupJoin<TOuter, TInner, TKey, TResult>(IQueryable<TOuter>, IEnumerable<TInner>, Expression<Func<TOuter,TKey>>, Expression<Func<TInner,TKey>>, Expression<Func<TOuter,IEnumerable<TInner>,TResult>>) | element of argument 1 -> parameter 1 of argument 4 | true |
+| System.Linq.Queryable.GroupJoin<TOuter, TInner, TKey, TResult>(IQueryable<TOuter>, IEnumerable<TInner>, Expression<Func<TOuter,TKey>>, Expression<Func<TInner,TKey>>, Expression<Func<TOuter,IEnumerable<TInner>,TResult>>) | return (normal) of argument 4 -> element of return (normal) | true |
+| System.Linq.Queryable.GroupJoin<TOuter, TInner, TKey, TResult>(IQueryable<TOuter>, IEnumerable<TInner>, Expression<Func<TOuter,TKey>>, Expression<Func<TInner,TKey>>, Expression<Func<TOuter,IEnumerable<TInner>,TResult>>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.Queryable.GroupJoin<TOuter, TInner, TKey, TResult>(IQueryable<TOuter>, IEnumerable<TInner>, Expression<Func<TOuter,TKey>>, Expression<Func<TInner,TKey>>, Expression<Func<TOuter,IEnumerable<TInner>,TResult>>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 4 | true |
+| System.Linq.Queryable.GroupJoin<TOuter, TInner, TKey, TResult>(IQueryable<TOuter>, IEnumerable<TInner>, Expression<Func<TOuter,TKey>>, Expression<Func<TInner,TKey>>, Expression<Func<TOuter,IEnumerable<TInner>,TResult>>, IEqualityComparer<TKey>) | element of argument 1 -> parameter 0 of argument 3 | true |
+| System.Linq.Queryable.GroupJoin<TOuter, TInner, TKey, TResult>(IQueryable<TOuter>, IEnumerable<TInner>, Expression<Func<TOuter,TKey>>, Expression<Func<TInner,TKey>>, Expression<Func<TOuter,IEnumerable<TInner>,TResult>>, IEqualityComparer<TKey>) | element of argument 1 -> parameter 1 of argument 4 | true |
+| System.Linq.Queryable.GroupJoin<TOuter, TInner, TKey, TResult>(IQueryable<TOuter>, IEnumerable<TInner>, Expression<Func<TOuter,TKey>>, Expression<Func<TInner,TKey>>, Expression<Func<TOuter,IEnumerable<TInner>,TResult>>, IEqualityComparer<TKey>) | return (normal) of argument 4 -> element of return (normal) | true |
+| System.Linq.Queryable.Intersect<TSource>(IQueryable<TSource>, IEnumerable<TSource>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Queryable.Intersect<TSource>(IQueryable<TSource>, IEnumerable<TSource>) | element of argument 1 -> element of return (normal) | true |
+| System.Linq.Queryable.Intersect<TSource>(IQueryable<TSource>, IEnumerable<TSource>, IEqualityComparer<TSource>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Queryable.Intersect<TSource>(IQueryable<TSource>, IEnumerable<TSource>, IEqualityComparer<TSource>) | element of argument 1 -> element of return (normal) | true |
+| System.Linq.Queryable.Join<TOuter, TInner, TKey, TResult>(IQueryable<TOuter>, IEnumerable<TInner>, Expression<Func<TOuter,TKey>>, Expression<Func<TInner,TKey>>, Expression<Func<TOuter,TInner,TResult>>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.Queryable.Join<TOuter, TInner, TKey, TResult>(IQueryable<TOuter>, IEnumerable<TInner>, Expression<Func<TOuter,TKey>>, Expression<Func<TInner,TKey>>, Expression<Func<TOuter,TInner,TResult>>) | element of argument 0 -> parameter 0 of argument 4 | true |
+| System.Linq.Queryable.Join<TOuter, TInner, TKey, TResult>(IQueryable<TOuter>, IEnumerable<TInner>, Expression<Func<TOuter,TKey>>, Expression<Func<TInner,TKey>>, Expression<Func<TOuter,TInner,TResult>>) | element of argument 1 -> parameter 0 of argument 3 | true |
+| System.Linq.Queryable.Join<TOuter, TInner, TKey, TResult>(IQueryable<TOuter>, IEnumerable<TInner>, Expression<Func<TOuter,TKey>>, Expression<Func<TInner,TKey>>, Expression<Func<TOuter,TInner,TResult>>) | element of argument 1 -> parameter 1 of argument 4 | true |
+| System.Linq.Queryable.Join<TOuter, TInner, TKey, TResult>(IQueryable<TOuter>, IEnumerable<TInner>, Expression<Func<TOuter,TKey>>, Expression<Func<TInner,TKey>>, Expression<Func<TOuter,TInner,TResult>>) | return (normal) of argument 4 -> element of return (normal) | true |
+| System.Linq.Queryable.Join<TOuter, TInner, TKey, TResult>(IQueryable<TOuter>, IEnumerable<TInner>, Expression<Func<TOuter,TKey>>, Expression<Func<TInner,TKey>>, Expression<Func<TOuter,TInner,TResult>>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.Queryable.Join<TOuter, TInner, TKey, TResult>(IQueryable<TOuter>, IEnumerable<TInner>, Expression<Func<TOuter,TKey>>, Expression<Func<TInner,TKey>>, Expression<Func<TOuter,TInner,TResult>>, IEqualityComparer<TKey>) | element of argument 0 -> parameter 0 of argument 4 | true |
+| System.Linq.Queryable.Join<TOuter, TInner, TKey, TResult>(IQueryable<TOuter>, IEnumerable<TInner>, Expression<Func<TOuter,TKey>>, Expression<Func<TInner,TKey>>, Expression<Func<TOuter,TInner,TResult>>, IEqualityComparer<TKey>) | element of argument 1 -> parameter 0 of argument 3 | true |
+| System.Linq.Queryable.Join<TOuter, TInner, TKey, TResult>(IQueryable<TOuter>, IEnumerable<TInner>, Expression<Func<TOuter,TKey>>, Expression<Func<TInner,TKey>>, Expression<Func<TOuter,TInner,TResult>>, IEqualityComparer<TKey>) | element of argument 1 -> parameter 1 of argument 4 | true |
+| System.Linq.Queryable.Join<TOuter, TInner, TKey, TResult>(IQueryable<TOuter>, IEnumerable<TInner>, Expression<Func<TOuter,TKey>>, Expression<Func<TInner,TKey>>, Expression<Func<TOuter,TInner,TResult>>, IEqualityComparer<TKey>) | return (normal) of argument 4 -> element of return (normal) | true |
+| System.Linq.Queryable.Last<TSource>(IQueryable<TSource>) | element of argument 0 -> return (normal) | true |
+| System.Linq.Queryable.Last<TSource>(IQueryable<TSource>, Expression<Func<TSource,Boolean>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.Last<TSource>(IQueryable<TSource>, Expression<Func<TSource,Boolean>>) | element of argument 0 -> return (normal) | true |
+| System.Linq.Queryable.LastOrDefault<TSource>(IQueryable<TSource>) | element of argument 0 -> return (normal) | true |
+| System.Linq.Queryable.LastOrDefault<TSource>(IQueryable<TSource>, Expression<Func<TSource,Boolean>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.LastOrDefault<TSource>(IQueryable<TSource>, Expression<Func<TSource,Boolean>>) | element of argument 0 -> return (normal) | true |
+| System.Linq.Queryable.LongCount<TSource>(IQueryable<TSource>, Expression<Func<TSource,Boolean>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.Max<TSource, TResult>(IQueryable<TSource>, Expression<Func<TSource,TResult>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.Min<TSource, TResult>(IQueryable<TSource>, Expression<Func<TSource,TResult>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.OfType<TResult>(IQueryable) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Queryable.OrderBy<TSource, TKey>(IQueryable<TSource>, Expression<Func<TSource,TKey>>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Queryable.OrderBy<TSource, TKey>(IQueryable<TSource>, Expression<Func<TSource,TKey>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.OrderBy<TSource, TKey>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, IComparer<TKey>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Queryable.OrderBy<TSource, TKey>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, IComparer<TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.OrderByDescending<TSource, TKey>(IQueryable<TSource>, Expression<Func<TSource,TKey>>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Queryable.OrderByDescending<TSource, TKey>(IQueryable<TSource>, Expression<Func<TSource,TKey>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.OrderByDescending<TSource, TKey>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, IComparer<TKey>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Queryable.OrderByDescending<TSource, TKey>(IQueryable<TSource>, Expression<Func<TSource,TKey>>, IComparer<TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.Reverse<TSource>(IQueryable<TSource>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Queryable.Select<TSource, TResult>(IQueryable<TSource>, Expression<Func<TSource,Int32,TResult>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.Select<TSource, TResult>(IQueryable<TSource>, Expression<Func<TSource,Int32,TResult>>) | return (normal) of argument 1 -> element of return (normal) | true |
+| System.Linq.Queryable.Select<TSource, TResult>(IQueryable<TSource>, Expression<Func<TSource,TResult>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.Select<TSource, TResult>(IQueryable<TSource>, Expression<Func<TSource,TResult>>) | return (normal) of argument 1 -> element of return (normal) | true |
+| System.Linq.Queryable.SelectMany<TSource, TCollection, TResult>(IQueryable<TSource>, Expression<Func<TSource,IEnumerable<TCollection>>>, Expression<Func<TSource,TCollection,TResult>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.SelectMany<TSource, TCollection, TResult>(IQueryable<TSource>, Expression<Func<TSource,IEnumerable<TCollection>>>, Expression<Func<TSource,TCollection,TResult>>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.Queryable.SelectMany<TSource, TCollection, TResult>(IQueryable<TSource>, Expression<Func<TSource,IEnumerable<TCollection>>>, Expression<Func<TSource,TCollection,TResult>>) | element of return (normal) of argument 1 -> parameter 1 of argument 2 | true |
+| System.Linq.Queryable.SelectMany<TSource, TCollection, TResult>(IQueryable<TSource>, Expression<Func<TSource,IEnumerable<TCollection>>>, Expression<Func<TSource,TCollection,TResult>>) | return (normal) of argument 2 -> element of return (normal) | true |
+| System.Linq.Queryable.SelectMany<TSource, TCollection, TResult>(IQueryable<TSource>, Expression<Func<TSource,Int32,IEnumerable<TCollection>>>, Expression<Func<TSource,TCollection,TResult>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.SelectMany<TSource, TCollection, TResult>(IQueryable<TSource>, Expression<Func<TSource,Int32,IEnumerable<TCollection>>>, Expression<Func<TSource,TCollection,TResult>>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.Queryable.SelectMany<TSource, TCollection, TResult>(IQueryable<TSource>, Expression<Func<TSource,Int32,IEnumerable<TCollection>>>, Expression<Func<TSource,TCollection,TResult>>) | element of return (normal) of argument 1 -> parameter 1 of argument 2 | true |
+| System.Linq.Queryable.SelectMany<TSource, TCollection, TResult>(IQueryable<TSource>, Expression<Func<TSource,Int32,IEnumerable<TCollection>>>, Expression<Func<TSource,TCollection,TResult>>) | return (normal) of argument 2 -> element of return (normal) | true |
+| System.Linq.Queryable.SelectMany<TSource, TResult>(IQueryable<TSource>, Expression<Func<TSource,IEnumerable<TResult>>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.SelectMany<TSource, TResult>(IQueryable<TSource>, Expression<Func<TSource,IEnumerable<TResult>>>) | return (normal) of argument 1 -> element of return (normal) | true |
+| System.Linq.Queryable.SelectMany<TSource, TResult>(IQueryable<TSource>, Expression<Func<TSource,Int32,IEnumerable<TResult>>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.SelectMany<TSource, TResult>(IQueryable<TSource>, Expression<Func<TSource,Int32,IEnumerable<TResult>>>) | return (normal) of argument 1 -> element of return (normal) | true |
+| System.Linq.Queryable.Single<TSource>(IQueryable<TSource>) | element of argument 0 -> return (normal) | true |
+| System.Linq.Queryable.Single<TSource>(IQueryable<TSource>, Expression<Func<TSource,Boolean>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.Single<TSource>(IQueryable<TSource>, Expression<Func<TSource,Boolean>>) | element of argument 0 -> return (normal) | true |
+| System.Linq.Queryable.SingleOrDefault<TSource>(IQueryable<TSource>) | element of argument 0 -> return (normal) | true |
+| System.Linq.Queryable.SingleOrDefault<TSource>(IQueryable<TSource>, Expression<Func<TSource,Boolean>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.SingleOrDefault<TSource>(IQueryable<TSource>, Expression<Func<TSource,Boolean>>) | element of argument 0 -> return (normal) | true |
+| System.Linq.Queryable.Skip<TSource>(IQueryable<TSource>, int) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Queryable.SkipWhile<TSource>(IQueryable<TSource>, Expression<Func<TSource,Boolean>>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Queryable.SkipWhile<TSource>(IQueryable<TSource>, Expression<Func<TSource,Boolean>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.SkipWhile<TSource>(IQueryable<TSource>, Expression<Func<TSource,Int32,Boolean>>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Queryable.SkipWhile<TSource>(IQueryable<TSource>, Expression<Func<TSource,Int32,Boolean>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.Sum<TSource>(IQueryable<TSource>, Expression<Func<TSource,Decimal>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.Sum<TSource>(IQueryable<TSource>, Expression<Func<TSource,Double>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.Sum<TSource>(IQueryable<TSource>, Expression<Func<TSource,Int32>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.Sum<TSource>(IQueryable<TSource>, Expression<Func<TSource,Int64>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.Sum<TSource>(IQueryable<TSource>, Expression<Func<TSource,Nullable<Decimal>>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.Sum<TSource>(IQueryable<TSource>, Expression<Func<TSource,Nullable<Double>>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.Sum<TSource>(IQueryable<TSource>, Expression<Func<TSource,Nullable<Int32>>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.Sum<TSource>(IQueryable<TSource>, Expression<Func<TSource,Nullable<Int64>>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.Sum<TSource>(IQueryable<TSource>, Expression<Func<TSource,Nullable<Single>>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.Sum<TSource>(IQueryable<TSource>, Expression<Func<TSource,Single>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.Take<TSource>(IQueryable<TSource>, int) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Queryable.TakeWhile<TSource>(IQueryable<TSource>, Expression<Func<TSource,Boolean>>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Queryable.TakeWhile<TSource>(IQueryable<TSource>, Expression<Func<TSource,Boolean>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.TakeWhile<TSource>(IQueryable<TSource>, Expression<Func<TSource,Int32,Boolean>>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Queryable.TakeWhile<TSource>(IQueryable<TSource>, Expression<Func<TSource,Int32,Boolean>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.ThenBy<TSource, TKey>(IOrderedQueryable<TSource>, Expression<Func<TSource,TKey>>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Queryable.ThenBy<TSource, TKey>(IOrderedQueryable<TSource>, Expression<Func<TSource,TKey>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.ThenBy<TSource, TKey>(IOrderedQueryable<TSource>, Expression<Func<TSource,TKey>>, IComparer<TKey>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Queryable.ThenBy<TSource, TKey>(IOrderedQueryable<TSource>, Expression<Func<TSource,TKey>>, IComparer<TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.ThenByDescending<TSource, TKey>(IOrderedQueryable<TSource>, Expression<Func<TSource,TKey>>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Queryable.ThenByDescending<TSource, TKey>(IOrderedQueryable<TSource>, Expression<Func<TSource,TKey>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.ThenByDescending<TSource, TKey>(IOrderedQueryable<TSource>, Expression<Func<TSource,TKey>>, IComparer<TKey>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Queryable.ThenByDescending<TSource, TKey>(IOrderedQueryable<TSource>, Expression<Func<TSource,TKey>>, IComparer<TKey>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.Union<TSource>(IQueryable<TSource>, IEnumerable<TSource>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Queryable.Union<TSource>(IQueryable<TSource>, IEnumerable<TSource>) | element of argument 1 -> element of return (normal) | true |
+| System.Linq.Queryable.Union<TSource>(IQueryable<TSource>, IEnumerable<TSource>, IEqualityComparer<TSource>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Queryable.Union<TSource>(IQueryable<TSource>, IEnumerable<TSource>, IEqualityComparer<TSource>) | element of argument 1 -> element of return (normal) | true |
+| System.Linq.Queryable.Where<TSource>(IQueryable<TSource>, Expression<Func<TSource,Boolean>>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Queryable.Where<TSource>(IQueryable<TSource>, Expression<Func<TSource,Boolean>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.Where<TSource>(IQueryable<TSource>, Expression<Func<TSource,Int32,Boolean>>) | element of argument 0 -> element of return (normal) | true |
+| System.Linq.Queryable.Where<TSource>(IQueryable<TSource>, Expression<Func<TSource,Int32,Boolean>>) | element of argument 0 -> parameter 0 of argument 1 | true |
+| System.Linq.Queryable.Zip<TFirst, TSecond, TResult>(IQueryable<TFirst>, IEnumerable<TSecond>, Expression<Func<TFirst,TSecond,TResult>>) | element of argument 0 -> parameter 0 of argument 2 | true |
+| System.Linq.Queryable.Zip<TFirst, TSecond, TResult>(IQueryable<TFirst>, IEnumerable<TSecond>, Expression<Func<TFirst,TSecond,TResult>>) | element of argument 1 -> parameter 1 of argument 2 | true |
+| System.Linq.Queryable.Zip<TFirst, TSecond, TResult>(IQueryable<TFirst>, IEnumerable<TSecond>, Expression<Func<TFirst,TSecond,TResult>>) | return (normal) of argument 2 -> element of return (normal) | true |
+| System.Net.Cookie.get_Value() | argument -1 -> return (normal) | false |
+| System.Net.CookieCollection.Add(Cookie) | argument 0 -> element of argument -1 | true |
+| System.Net.CookieCollection.Add(CookieCollection) | argument 0 -> element of argument -1 | true |
+| System.Net.CookieCollection.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Net.CookieCollection.CopyTo(Cookie[], int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Net.CookieCollection.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Net.CredentialCache.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Net.HttpListenerPrefixCollection.Add(string) | argument 0 -> element of argument -1 | true |
+| System.Net.HttpListenerPrefixCollection.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Net.HttpListenerPrefixCollection.CopyTo(String[], int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Net.HttpListenerPrefixCollection.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Net.HttpRequestStream.BeginRead(Byte[], int, int, AsyncCallback, object) | argument -1 -> return (out parameter 0) | false |
+| System.Net.HttpRequestStream.BeginWrite(Byte[], int, int, AsyncCallback, object) | argument 0 -> argument -1 | false |
+| System.Net.HttpRequestStream.Read(Byte[], int, int) | argument -1 -> return (out parameter 0) | false |
+| System.Net.HttpRequestStream.Write(Byte[], int, int) | argument 0 -> argument -1 | false |
+| System.Net.HttpResponseStream.BeginRead(Byte[], int, int, AsyncCallback, object) | argument -1 -> return (out parameter 0) | false |
+| System.Net.HttpResponseStream.BeginWrite(Byte[], int, int, AsyncCallback, object) | argument 0 -> argument -1 | false |
+| System.Net.HttpResponseStream.Read(Byte[], int, int) | argument -1 -> return (out parameter 0) | false |
+| System.Net.HttpResponseStream.Write(Byte[], int, int) | argument 0 -> argument -1 | false |
+| System.Net.NetworkInformation.IPAddressCollection.Add(IPAddress) | argument 0 -> element of argument -1 | true |
+| System.Net.NetworkInformation.IPAddressCollection.CopyTo(IPAddress[], int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Net.NetworkInformation.IPAddressCollection.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Net.Security.CipherSuitesPolicy.<get_AllowedCipherSuites>d__6.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Net.Security.NegotiateStream.BeginRead(Byte[], int, int, AsyncCallback, object) | argument -1 -> return (out parameter 0) | false |
+| System.Net.Security.NegotiateStream.BeginWrite(Byte[], int, int, AsyncCallback, object) | argument 0 -> argument -1 | false |
+| System.Net.Security.NegotiateStream.Read(Byte[], int, int) | argument -1 -> return (out parameter 0) | false |
+| System.Net.Security.NegotiateStream.ReadAsync(Byte[], int, int, CancellationToken) | argument -1 -> return (out parameter 0) | false |
+| System.Net.Security.NegotiateStream.Write(Byte[], int, int) | argument 0 -> argument -1 | false |
+| System.Net.Security.NegotiateStream.WriteAsync(Byte[], int, int, CancellationToken) | argument 0 -> argument -1 | false |
+| System.Net.Security.SslStream.BeginRead(Byte[], int, int, AsyncCallback, object) | argument -1 -> return (out parameter 0) | false |
+| System.Net.Security.SslStream.BeginWrite(Byte[], int, int, AsyncCallback, object) | argument 0 -> argument -1 | false |
+| System.Net.Security.SslStream.Read(Byte[], int, int) | argument -1 -> return (out parameter 0) | false |
+| System.Net.Security.SslStream.ReadAsync(Byte[], int, int, CancellationToken) | argument -1 -> return (out parameter 0) | false |
+| System.Net.Security.SslStream.Write(Byte[], int, int) | argument 0 -> argument -1 | false |
+| System.Net.Security.SslStream.WriteAsync(Byte[], int, int, CancellationToken) | argument 0 -> argument -1 | false |
+| System.Net.WebUtility.HtmlEncode(string) | argument 0 -> return (normal) | false |
+| System.Net.WebUtility.HtmlEncode(string, TextWriter) | argument 0 -> return (normal) | false |
+| System.Net.WebUtility.UrlEncode(string) | argument 0 -> return (normal) | false |
+| System.Nullable<>.GetValueOrDefault() | property Value of argument -1 -> return (normal) | true |
+| System.Nullable<>.GetValueOrDefault(T) | argument 0 -> return (normal) | true |
+| System.Nullable<>.GetValueOrDefault(T) | property Value of argument -1 -> return (normal) | true |
+| System.Nullable<>.Nullable(T) | argument 0 -> property Value of return (normal) | true |
+| System.Nullable<>.get_HasValue() | property Value of argument -1 -> return (normal) | false |
+| System.Nullable<>.get_Value() | argument -1 -> return (normal) | false |
+| System.Reflection.TypeInfo.<GetDeclaredMethods>d__10.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Reflection.TypeInfo.<get_DeclaredNestedTypes>d__22.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Resources.ResourceFallbackManager.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Resources.ResourceReader.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Resources.ResourceSet.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Resources.RuntimeResourceSet.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Runtime.CompilerServices.ConditionalWeakTable<,>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Runtime.CompilerServices.ConfiguredTaskAwaitable<>.ConfiguredTaskAwaiter.GetResult() | property Result of field m_task of argument -1 -> return (normal) | true |
+| System.Runtime.CompilerServices.ConfiguredTaskAwaitable<>.GetAwaiter() | field m_configuredTaskAwaiter of argument -1 -> return (normal) | true |
+| System.Runtime.CompilerServices.ReadOnlyCollectionBuilder<>.Add(T) | argument 0 -> element of argument -1 | true |
+| System.Runtime.CompilerServices.ReadOnlyCollectionBuilder<>.Add(object) | argument 0 -> element of argument -1 | true |
+| System.Runtime.CompilerServices.ReadOnlyCollectionBuilder<>.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Runtime.CompilerServices.ReadOnlyCollectionBuilder<>.CopyTo(T[], int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Runtime.CompilerServices.ReadOnlyCollectionBuilder<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Runtime.CompilerServices.ReadOnlyCollectionBuilder<>.Insert(int, T) | argument 1 -> element of argument -1 | true |
+| System.Runtime.CompilerServices.ReadOnlyCollectionBuilder<>.Insert(int, object) | argument 1 -> element of argument -1 | true |
+| System.Runtime.CompilerServices.ReadOnlyCollectionBuilder<>.Reverse() | element of argument 0 -> element of return (normal) | true |
+| System.Runtime.CompilerServices.ReadOnlyCollectionBuilder<>.Reverse(int, int) | element of argument 0 -> element of return (normal) | true |
+| System.Runtime.CompilerServices.ReadOnlyCollectionBuilder<>.get_Item(int) | element of argument -1 -> return (normal) | true |
+| System.Runtime.CompilerServices.ReadOnlyCollectionBuilder<>.set_Item(int, T) | argument 1 -> element of argument -1 | true |
+| System.Runtime.CompilerServices.ReadOnlyCollectionBuilder<>.set_Item(int, object) | argument 1 -> element of argument -1 | true |
+| System.Runtime.CompilerServices.TaskAwaiter<>.GetResult() | property Result of field m_task of argument -1 -> return (normal) | true |
+| System.Runtime.InteropServices.MemoryMarshal.<ToEnumerable>d__15<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Runtime.Loader.AssemblyLoadContext.<get_All>d__83.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Runtime.Loader.AssemblyLoadContext.<get_Assemblies>d__53.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Runtime.Loader.LibraryNameVariation.<DetermineLibraryNameVariations>d__5.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Security.Cryptography.CryptoStream.BeginRead(Byte[], int, int, AsyncCallback, object) | argument -1 -> return (out parameter 0) | false |
+| System.Security.Cryptography.CryptoStream.BeginWrite(Byte[], int, int, AsyncCallback, object) | argument 0 -> argument -1 | false |
+| System.Security.Cryptography.CryptoStream.Read(Byte[], int, int) | argument -1 -> return (out parameter 0) | false |
+| System.Security.Cryptography.CryptoStream.ReadAsync(Byte[], int, int, CancellationToken) | argument -1 -> return (out parameter 0) | false |
+| System.Security.Cryptography.CryptoStream.Write(Byte[], int, int) | argument 0 -> argument -1 | false |
+| System.Security.Cryptography.CryptoStream.WriteAsync(Byte[], int, int, CancellationToken) | argument 0 -> argument -1 | false |
+| System.Security.PermissionSet.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Security.PermissionSet.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.String.Clone() | argument -1 -> return (normal) | true |
+| System.String.Concat(IEnumerable<String>) | element of argument 0 -> return (normal) | false |
+| System.String.Concat(ReadOnlySpan<Char>, ReadOnlySpan<Char>) | argument 0 -> return (normal) | false |
+| System.String.Concat(ReadOnlySpan<Char>, ReadOnlySpan<Char>) | argument 1 -> return (normal) | false |
+| System.String.Concat(ReadOnlySpan<Char>, ReadOnlySpan<Char>, ReadOnlySpan<Char>) | argument 0 -> return (normal) | false |
+| System.String.Concat(ReadOnlySpan<Char>, ReadOnlySpan<Char>, ReadOnlySpan<Char>) | argument 1 -> return (normal) | false |
+| System.String.Concat(ReadOnlySpan<Char>, ReadOnlySpan<Char>, ReadOnlySpan<Char>) | argument 2 -> return (normal) | false |
+| System.String.Concat(ReadOnlySpan<Char>, ReadOnlySpan<Char>, ReadOnlySpan<Char>, ReadOnlySpan<Char>) | argument 0 -> return (normal) | false |
+| System.String.Concat(ReadOnlySpan<Char>, ReadOnlySpan<Char>, ReadOnlySpan<Char>, ReadOnlySpan<Char>) | argument 1 -> return (normal) | false |
+| System.String.Concat(ReadOnlySpan<Char>, ReadOnlySpan<Char>, ReadOnlySpan<Char>, ReadOnlySpan<Char>) | argument 2 -> return (normal) | false |
+| System.String.Concat(ReadOnlySpan<Char>, ReadOnlySpan<Char>, ReadOnlySpan<Char>, ReadOnlySpan<Char>) | argument 3 -> return (normal) | false |
+| System.String.Concat(object) | argument 0 -> return (normal) | false |
+| System.String.Concat(object, object) | argument 0 -> return (normal) | false |
+| System.String.Concat(object, object) | argument 1 -> return (normal) | false |
+| System.String.Concat(object, object, object) | argument 0 -> return (normal) | false |
+| System.String.Concat(object, object, object) | argument 1 -> return (normal) | false |
+| System.String.Concat(object, object, object) | argument 2 -> return (normal) | false |
+| System.String.Concat(params Object[]) | element of argument 0 -> return (normal) | false |
+| System.String.Concat(params String[]) | element of argument 0 -> return (normal) | false |
+| System.String.Concat(string, string) | argument 0 -> return (normal) | false |
+| System.String.Concat(string, string) | argument 1 -> return (normal) | false |
+| System.String.Concat(string, string, string) | argument 0 -> return (normal) | false |
+| System.String.Concat(string, string, string) | argument 1 -> return (normal) | false |
+| System.String.Concat(string, string, string) | argument 2 -> return (normal) | false |
+| System.String.Concat(string, string, string, string) | argument 0 -> return (normal) | false |
+| System.String.Concat(string, string, string, string) | argument 1 -> return (normal) | false |
+| System.String.Concat(string, string, string, string) | argument 2 -> return (normal) | false |
+| System.String.Concat(string, string, string, string) | argument 3 -> return (normal) | false |
+| System.String.Concat<T>(IEnumerable<T>) | element of argument 0 -> return (normal) | false |
+| System.String.Copy(string) | argument 0 -> return (normal) | true |
+| System.String.Format(IFormatProvider, string, object) | argument 1 -> return (normal) | false |
+| System.String.Format(IFormatProvider, string, object) | argument 2 -> return (normal) | false |
+| System.String.Format(IFormatProvider, string, object, object) | argument 1 -> return (normal) | false |
+| System.String.Format(IFormatProvider, string, object, object) | argument 2 -> return (normal) | false |
+| System.String.Format(IFormatProvider, string, object, object) | argument 3 -> return (normal) | false |
+| System.String.Format(IFormatProvider, string, object, object, object) | argument 1 -> return (normal) | false |
+| System.String.Format(IFormatProvider, string, object, object, object) | argument 2 -> return (normal) | false |
+| System.String.Format(IFormatProvider, string, object, object, object) | argument 3 -> return (normal) | false |
+| System.String.Format(IFormatProvider, string, object, object, object) | argument 4 -> return (normal) | false |
+| System.String.Format(IFormatProvider, string, params Object[]) | argument 1 -> return (normal) | false |
+| System.String.Format(IFormatProvider, string, params Object[]) | element of argument 2 -> return (normal) | false |
+| System.String.Format(string, object) | argument 0 -> return (normal) | false |
+| System.String.Format(string, object) | argument 1 -> return (normal) | false |
+| System.String.Format(string, object, object) | argument 0 -> return (normal) | false |
+| System.String.Format(string, object, object) | argument 1 -> return (normal) | false |
+| System.String.Format(string, object, object) | argument 2 -> return (normal) | false |
+| System.String.Format(string, object, object, object) | argument 0 -> return (normal) | false |
+| System.String.Format(string, object, object, object) | argument 1 -> return (normal) | false |
+| System.String.Format(string, object, object, object) | argument 2 -> return (normal) | false |
+| System.String.Format(string, object, object, object) | argument 3 -> return (normal) | false |
+| System.String.Format(string, params Object[]) | argument 0 -> return (normal) | false |
+| System.String.Format(string, params Object[]) | element of argument 1 -> return (normal) | false |
+| System.String.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.String.Insert(int, string) | argument 1 -> return (normal) | false |
+| System.String.Insert(int, string) | argument -1 -> return (normal) | false |
+| System.String.Join(char, String[], int, int) | argument 0 -> return (normal) | false |
+| System.String.Join(char, String[], int, int) | element of argument 1 -> return (normal) | false |
+| System.String.Join(char, params Object[]) | argument 0 -> return (normal) | false |
+| System.String.Join(char, params Object[]) | element of argument 1 -> return (normal) | false |
+| System.String.Join(char, params String[]) | argument 0 -> return (normal) | false |
+| System.String.Join(char, params String[]) | element of argument 1 -> return (normal) | false |
+| System.String.Join(string, IEnumerable<String>) | argument 0 -> return (normal) | false |
+| System.String.Join(string, IEnumerable<String>) | element of argument 1 -> return (normal) | false |
+| System.String.Join(string, String[], int, int) | argument 0 -> return (normal) | false |
+| System.String.Join(string, String[], int, int) | element of argument 1 -> return (normal) | false |
+| System.String.Join(string, params Object[]) | argument 0 -> return (normal) | false |
+| System.String.Join(string, params Object[]) | element of argument 1 -> return (normal) | false |
+| System.String.Join(string, params String[]) | argument 0 -> return (normal) | false |
+| System.String.Join(string, params String[]) | element of argument 1 -> return (normal) | false |
+| System.String.Join<T>(char, IEnumerable<T>) | argument 0 -> return (normal) | false |
+| System.String.Join<T>(char, IEnumerable<T>) | element of argument 1 -> return (normal) | false |
+| System.String.Join<T>(string, IEnumerable<T>) | argument 0 -> return (normal) | false |
+| System.String.Join<T>(string, IEnumerable<T>) | element of argument 1 -> return (normal) | false |
+| System.String.Normalize() | argument -1 -> return (normal) | false |
+| System.String.Normalize(NormalizationForm) | argument -1 -> return (normal) | false |
+| System.String.PadLeft(int) | argument -1 -> return (normal) | false |
+| System.String.PadLeft(int, char) | argument -1 -> return (normal) | false |
+| System.String.PadRight(int) | argument -1 -> return (normal) | false |
+| System.String.PadRight(int, char) | argument -1 -> return (normal) | false |
+| System.String.Remove(int) | argument -1 -> return (normal) | false |
+| System.String.Remove(int, int) | argument -1 -> return (normal) | false |
+| System.String.Replace(char, char) | argument 1 -> return (normal) | false |
+| System.String.Replace(char, char) | argument -1 -> return (normal) | false |
+| System.String.Replace(string, string) | argument 1 -> return (normal) | false |
+| System.String.Replace(string, string) | argument -1 -> return (normal) | false |
+| System.String.Split(Char[], StringSplitOptions) | argument -1 -> element of return (normal) | false |
+| System.String.Split(Char[], int) | argument -1 -> element of return (normal) | false |
+| System.String.Split(Char[], int, StringSplitOptions) | argument -1 -> element of return (normal) | false |
+| System.String.Split(String[], StringSplitOptions) | argument -1 -> element of return (normal) | false |
+| System.String.Split(String[], int, StringSplitOptions) | argument -1 -> element of return (normal) | false |
+| System.String.Split(char, StringSplitOptions) | argument -1 -> element of return (normal) | false |
+| System.String.Split(char, int, StringSplitOptions) | argument -1 -> element of return (normal) | false |
+| System.String.Split(params Char[]) | argument -1 -> element of return (normal) | false |
+| System.String.Split(string, StringSplitOptions) | argument -1 -> element of return (normal) | false |
+| System.String.Split(string, int, StringSplitOptions) | argument -1 -> element of return (normal) | false |
+| System.String.String(Char[]) | element of argument 0 -> return (normal) | false |
+| System.String.String(Char[], int, int) | element of argument 0 -> return (normal) | false |
+| System.String.Substring(int) | argument -1 -> return (normal) | false |
+| System.String.Substring(int, int) | argument -1 -> return (normal) | false |
+| System.String.ToLower() | argument -1 -> return (normal) | false |
+| System.String.ToLower(CultureInfo) | argument -1 -> return (normal) | false |
+| System.String.ToLowerInvariant() | argument -1 -> return (normal) | false |
+| System.String.ToString() | argument -1 -> return (normal) | true |
+| System.String.ToString(IFormatProvider) | argument -1 -> return (normal) | true |
+| System.String.ToUpper() | argument -1 -> return (normal) | false |
+| System.String.ToUpper(CultureInfo) | argument -1 -> return (normal) | false |
+| System.String.ToUpperInvariant() | argument -1 -> return (normal) | false |
+| System.String.Trim() | argument -1 -> return (normal) | false |
+| System.String.Trim(char) | argument -1 -> return (normal) | false |
+| System.String.Trim(params Char[]) | argument -1 -> return (normal) | false |
+| System.String.TrimEnd() | argument -1 -> return (normal) | false |
+| System.String.TrimEnd(char) | argument -1 -> return (normal) | false |
+| System.String.TrimEnd(params Char[]) | argument -1 -> return (normal) | false |
+| System.String.TrimStart() | argument -1 -> return (normal) | false |
+| System.String.TrimStart(char) | argument -1 -> return (normal) | false |
+| System.String.TrimStart(params Char[]) | argument -1 -> return (normal) | false |
+| System.Text.Encoding.GetBytes(Char[]) | element of argument 0 -> return (normal) | false |
+| System.Text.Encoding.GetBytes(Char[], int, int) | element of argument 0 -> return (normal) | false |
+| System.Text.Encoding.GetBytes(Char[], int, int, Byte[], int) | element of argument 0 -> return (normal) | false |
+| System.Text.Encoding.GetBytes(ReadOnlySpan<Char>, Span<Byte>) | argument 0 -> return (normal) | false |
+| System.Text.Encoding.GetBytes(char*, int, byte*, int) | argument 0 -> return (normal) | false |
+| System.Text.Encoding.GetBytes(char*, int, byte*, int, EncoderNLS) | argument 0 -> return (normal) | false |
+| System.Text.Encoding.GetBytes(string) | argument 0 -> return (normal) | false |
+| System.Text.Encoding.GetBytes(string, int, int) | argument 0 -> return (normal) | false |
+| System.Text.Encoding.GetBytes(string, int, int, Byte[], int) | argument 0 -> return (normal) | false |
+| System.Text.Encoding.GetChars(Byte[]) | element of argument 0 -> return (normal) | false |
+| System.Text.Encoding.GetChars(Byte[], int, int) | element of argument 0 -> return (normal) | false |
+| System.Text.Encoding.GetChars(Byte[], int, int, Char[], int) | element of argument 0 -> return (normal) | false |
+| System.Text.Encoding.GetChars(ReadOnlySpan<Byte>, Span<Char>) | element of argument 0 -> return (normal) | false |
+| System.Text.Encoding.GetChars(byte*, int, char*, int) | element of argument 0 -> return (normal) | false |
+| System.Text.Encoding.GetChars(byte*, int, char*, int, DecoderNLS) | element of argument 0 -> return (normal) | false |
+| System.Text.Encoding.GetString(Byte[]) | element of argument 0 -> return (normal) | false |
+| System.Text.Encoding.GetString(Byte[], int, int) | element of argument 0 -> return (normal) | false |
+| System.Text.Encoding.GetString(ReadOnlySpan<Byte>) | element of argument 0 -> return (normal) | false |
+| System.Text.Encoding.GetString(byte*, int) | element of argument 0 -> return (normal) | false |
+| System.Text.RegularExpressions.CaptureCollection.Add(Capture) | argument 0 -> element of argument -1 | true |
+| System.Text.RegularExpressions.CaptureCollection.Add(object) | argument 0 -> element of argument -1 | true |
+| System.Text.RegularExpressions.CaptureCollection.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Text.RegularExpressions.CaptureCollection.CopyTo(Capture[], int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Text.RegularExpressions.CaptureCollection.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Text.RegularExpressions.CaptureCollection.Insert(int, Capture) | argument 1 -> element of argument -1 | true |
+| System.Text.RegularExpressions.CaptureCollection.Insert(int, object) | argument 1 -> element of argument -1 | true |
+| System.Text.RegularExpressions.CaptureCollection.get_Item(int) | element of argument -1 -> return (normal) | true |
+| System.Text.RegularExpressions.CaptureCollection.set_Item(int, Capture) | argument 1 -> element of argument -1 | true |
+| System.Text.RegularExpressions.CaptureCollection.set_Item(int, object) | argument 1 -> element of argument -1 | true |
+| System.Text.RegularExpressions.GroupCollection.<get_Keys>d__49.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Text.RegularExpressions.GroupCollection.<get_Values>d__51.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Text.RegularExpressions.GroupCollection.Add(Group) | argument 0 -> element of argument -1 | true |
+| System.Text.RegularExpressions.GroupCollection.Add(object) | argument 0 -> element of argument -1 | true |
+| System.Text.RegularExpressions.GroupCollection.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Text.RegularExpressions.GroupCollection.CopyTo(Group[], int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Text.RegularExpressions.GroupCollection.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Text.RegularExpressions.GroupCollection.Insert(int, Group) | argument 1 -> element of argument -1 | true |
+| System.Text.RegularExpressions.GroupCollection.Insert(int, object) | argument 1 -> element of argument -1 | true |
+| System.Text.RegularExpressions.GroupCollection.get_Item(int) | element of argument -1 -> return (normal) | true |
+| System.Text.RegularExpressions.GroupCollection.get_Item(string) | element of argument -1 -> return (normal) | true |
+| System.Text.RegularExpressions.GroupCollection.set_Item(int, Group) | argument 1 -> element of argument -1 | true |
+| System.Text.RegularExpressions.GroupCollection.set_Item(int, object) | argument 1 -> element of argument -1 | true |
+| System.Text.RegularExpressions.MatchCollection.Add(Match) | argument 0 -> element of argument -1 | true |
+| System.Text.RegularExpressions.MatchCollection.Add(object) | argument 0 -> element of argument -1 | true |
+| System.Text.RegularExpressions.MatchCollection.CopyTo(Array, int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Text.RegularExpressions.MatchCollection.CopyTo(Match[], int) | element of argument -1 -> element of return (out parameter 0) | true |
+| System.Text.RegularExpressions.MatchCollection.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Text.RegularExpressions.MatchCollection.Insert(int, Match) | argument 1 -> element of argument -1 | true |
+| System.Text.RegularExpressions.MatchCollection.Insert(int, object) | argument 1 -> element of argument -1 | true |
+| System.Text.RegularExpressions.MatchCollection.get_Item(int) | element of argument -1 -> return (normal) | true |
+| System.Text.RegularExpressions.MatchCollection.set_Item(int, Match) | argument 1 -> element of argument -1 | true |
+| System.Text.RegularExpressions.MatchCollection.set_Item(int, object) | argument 1 -> element of argument -1 | true |
+| System.Text.StringBuilder.Append(object) | argument 0 -> element of argument -1 | true |
+| System.Text.StringBuilder.Append(object) | argument 0 -> element of return (normal) | true |
+| System.Text.StringBuilder.Append(string) | argument 0 -> element of argument -1 | true |
+| System.Text.StringBuilder.Append(string) | argument 0 -> element of return (normal) | true |
+| System.Text.StringBuilder.Append(string, int, int) | argument 0 -> element of argument -1 | true |
+| System.Text.StringBuilder.Append(string, int, int) | argument 0 -> element of return (normal) | true |
+| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object) | argument 1 -> element of argument -1 | true |
+| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object) | argument 1 -> element of return (normal) | true |
+| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object) | argument 2 -> element of argument -1 | true |
+| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object) | argument 2 -> element of return (normal) | true |
+| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object) | argument 1 -> element of argument -1 | true |
+| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object) | argument 1 -> element of return (normal) | true |
+| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object) | argument 2 -> element of argument -1 | true |
+| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object) | argument 2 -> element of return (normal) | true |
+| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object) | argument 3 -> element of argument -1 | true |
+| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object) | argument 3 -> element of return (normal) | true |
+| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object, object) | argument 1 -> element of argument -1 | true |
+| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object, object) | argument 1 -> element of return (normal) | true |
+| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object, object) | argument 2 -> element of argument -1 | true |
+| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object, object) | argument 2 -> element of return (normal) | true |
+| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object, object) | argument 3 -> element of argument -1 | true |
+| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object, object) | argument 3 -> element of return (normal) | true |
+| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object, object) | argument 4 -> element of argument -1 | true |
+| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, object, object, object) | argument 4 -> element of return (normal) | true |
+| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, params Object[]) | argument 1 -> element of argument -1 | true |
+| System.Text.StringBuilder.AppendFormat(IFormatProvider, string, params Object[]) | argument 1 -> element of return (normal) | true |
+| System.Text.StringBuilder.AppendFormat(string, object) | argument 0 -> element of argument -1 | true |
+| System.Text.StringBuilder.AppendFormat(string, object) | argument 0 -> element of return (normal) | true |
+| System.Text.StringBuilder.AppendFormat(string, object) | argument 1 -> element of argument -1 | true |
+| System.Text.StringBuilder.AppendFormat(string, object) | argument 1 -> element of return (normal) | true |
+| System.Text.StringBuilder.AppendFormat(string, object, object) | argument 0 -> element of argument -1 | true |
+| System.Text.StringBuilder.AppendFormat(string, object, object) | argument 0 -> element of return (normal) | true |
+| System.Text.StringBuilder.AppendFormat(string, object, object) | argument 1 -> element of argument -1 | true |
+| System.Text.StringBuilder.AppendFormat(string, object, object) | argument 1 -> element of return (normal) | true |
+| System.Text.StringBuilder.AppendFormat(string, object, object) | argument 2 -> element of argument -1 | true |
+| System.Text.StringBuilder.AppendFormat(string, object, object) | argument 2 -> element of return (normal) | true |
+| System.Text.StringBuilder.AppendFormat(string, object, object, object) | argument 0 -> element of argument -1 | true |
+| System.Text.StringBuilder.AppendFormat(string, object, object, object) | argument 0 -> element of return (normal) | true |
+| System.Text.StringBuilder.AppendFormat(string, object, object, object) | argument 1 -> element of argument -1 | true |
+| System.Text.StringBuilder.AppendFormat(string, object, object, object) | argument 1 -> element of return (normal) | true |
+| System.Text.StringBuilder.AppendFormat(string, object, object, object) | argument 2 -> element of argument -1 | true |
+| System.Text.StringBuilder.AppendFormat(string, object, object, object) | argument 2 -> element of return (normal) | true |
+| System.Text.StringBuilder.AppendFormat(string, object, object, object) | argument 3 -> element of argument -1 | true |
+| System.Text.StringBuilder.AppendFormat(string, object, object, object) | argument 3 -> element of return (normal) | true |
+| System.Text.StringBuilder.AppendFormat(string, params Object[]) | argument 0 -> element of argument -1 | true |
+| System.Text.StringBuilder.AppendFormat(string, params Object[]) | argument 0 -> element of return (normal) | true |
+| System.Text.StringBuilder.AppendLine(string) | argument 0 -> element of argument -1 | true |
+| System.Text.StringBuilder.AppendLine(string) | argument 0 -> element of return (normal) | true |
+| System.Text.StringBuilder.StringBuilder(string) | argument 0 -> element of return (normal) | true |
+| System.Text.StringBuilder.StringBuilder(string, int) | argument 0 -> element of return (normal) | true |
+| System.Text.StringBuilder.StringBuilder(string, int, int, int) | argument 0 -> element of return (normal) | true |
+| System.Text.StringBuilder.ToString() | element of argument -1 -> return (normal) | false |
+| System.Text.StringBuilder.ToString(int, int) | element of argument -1 -> return (normal) | false |
+| System.Text.TranscodingStream.BeginRead(Byte[], int, int, AsyncCallback, object) | argument -1 -> return (out parameter 0) | false |
+| System.Text.TranscodingStream.BeginWrite(Byte[], int, int, AsyncCallback, object) | argument 0 -> argument -1 | false |
+| System.Text.TranscodingStream.Read(Byte[], int, int) | argument -1 -> return (out parameter 0) | false |
+| System.Text.TranscodingStream.ReadAsync(Byte[], int, int, CancellationToken) | argument -1 -> return (out parameter 0) | false |
+| System.Text.TranscodingStream.Write(Byte[], int, int) | argument 0 -> argument -1 | false |
+| System.Text.TranscodingStream.WriteAsync(Byte[], int, int, CancellationToken) | argument 0 -> argument -1 | false |
+| System.Threading.Tasks.SingleProducerSingleConsumerQueue<>.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Threading.Tasks.Task.ContinueWith(Action<Task, Object>, object) | argument 1 -> parameter 1 of argument 0 | true |
+| System.Threading.Tasks.Task.ContinueWith(Action<Task, Object>, object, CancellationToken) | argument 1 -> parameter 1 of argument 0 | true |
+| System.Threading.Tasks.Task.ContinueWith(Action<Task, Object>, object, CancellationToken, TaskContinuationOptions, TaskScheduler) | argument 1 -> parameter 1 of argument 0 | true |
+| System.Threading.Tasks.Task.ContinueWith(Action<Task, Object>, object, TaskContinuationOptions) | argument 1 -> parameter 1 of argument 0 | true |
+| System.Threading.Tasks.Task.ContinueWith(Action<Task, Object>, object, TaskScheduler) | argument 1 -> parameter 1 of argument 0 | true |
+| System.Threading.Tasks.Task.ContinueWith<TResult>(Func<Task, Object, TResult>, object) | argument 1 -> parameter 1 of argument 0 | true |
+| System.Threading.Tasks.Task.ContinueWith<TResult>(Func<Task, Object, TResult>, object) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.Task.ContinueWith<TResult>(Func<Task, Object, TResult>, object, CancellationToken) | argument 1 -> parameter 1 of argument 0 | true |
+| System.Threading.Tasks.Task.ContinueWith<TResult>(Func<Task, Object, TResult>, object, CancellationToken) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.Task.ContinueWith<TResult>(Func<Task, Object, TResult>, object, CancellationToken, TaskContinuationOptions, TaskScheduler) | argument 1 -> parameter 1 of argument 0 | true |
+| System.Threading.Tasks.Task.ContinueWith<TResult>(Func<Task, Object, TResult>, object, CancellationToken, TaskContinuationOptions, TaskScheduler) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.Task.ContinueWith<TResult>(Func<Task, Object, TResult>, object, TaskContinuationOptions) | argument 1 -> parameter 1 of argument 0 | true |
+| System.Threading.Tasks.Task.ContinueWith<TResult>(Func<Task, Object, TResult>, object, TaskContinuationOptions) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.Task.ContinueWith<TResult>(Func<Task, Object, TResult>, object, TaskScheduler) | argument 1 -> parameter 1 of argument 0 | true |
+| System.Threading.Tasks.Task.ContinueWith<TResult>(Func<Task, Object, TResult>, object, TaskScheduler) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.Task.ContinueWith<TResult>(Func<Task, TResult>) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.Task.ContinueWith<TResult>(Func<Task, TResult>, CancellationToken) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.Task.ContinueWith<TResult>(Func<Task, TResult>, CancellationToken, TaskContinuationOptions, TaskScheduler) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.Task.ContinueWith<TResult>(Func<Task, TResult>, TaskContinuationOptions) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.Task.ContinueWith<TResult>(Func<Task, TResult>, TaskScheduler) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.Task.FromResult<TResult>(TResult) | argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.Task.Run<TResult>(Func<TResult>) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.Task.Run<TResult>(Func<TResult>, CancellationToken) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.Task.Run<TResult>(Func<Task<TResult>>) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.Task.Run<TResult>(Func<Task<TResult>>, CancellationToken) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.Task.Task(Action<Object>, object) | argument 1 -> parameter 0 of argument 0 | true |
+| System.Threading.Tasks.Task.Task(Action<Object>, object, CancellationToken) | argument 1 -> parameter 0 of argument 0 | true |
+| System.Threading.Tasks.Task.Task(Action<Object>, object, CancellationToken, TaskCreationOptions) | argument 1 -> parameter 0 of argument 0 | true |
+| System.Threading.Tasks.Task.Task(Action<Object>, object, TaskCreationOptions) | argument 1 -> parameter 0 of argument 0 | true |
+| System.Threading.Tasks.Task.WhenAll<TResult>(IEnumerable<Task<TResult>>) | property Result of element of argument 0 -> element of property Result of return (normal) | true |
+| System.Threading.Tasks.Task.WhenAll<TResult>(params Task<TResult>[]) | property Result of element of argument 0 -> element of property Result of return (normal) | true |
+| System.Threading.Tasks.Task.WhenAny<TResult>(IEnumerable<Task<TResult>>) | property Result of element of argument 0 -> element of property Result of return (normal) | true |
+| System.Threading.Tasks.Task.WhenAny<TResult>(Task<TResult>, Task<TResult>) | property Result of element of argument 0 -> element of property Result of return (normal) | true |
+| System.Threading.Tasks.Task.WhenAny<TResult>(Task<TResult>, Task<TResult>) | property Result of element of argument 1 -> element of property Result of return (normal) | true |
+| System.Threading.Tasks.Task.WhenAny<TResult>(params Task<TResult>[]) | property Result of element of argument 0 -> element of property Result of return (normal) | true |
+| System.Threading.Tasks.Task<>.ConfigureAwait(bool) | argument -1 -> field m_task of field m_configuredTaskAwaiter of return (normal) | true |
+| System.Threading.Tasks.Task<>.ContinueWith(Action<Task<>, Object>, object) | argument 1 -> parameter 1 of argument 0 | true |
+| System.Threading.Tasks.Task<>.ContinueWith(Action<Task<>, Object>, object) | argument -1 -> parameter 0 of argument 0 | true |
+| System.Threading.Tasks.Task<>.ContinueWith(Action<Task<>, Object>, object, CancellationToken) | argument 1 -> parameter 1 of argument 0 | true |
+| System.Threading.Tasks.Task<>.ContinueWith(Action<Task<>, Object>, object, CancellationToken) | argument -1 -> parameter 0 of argument 0 | true |
+| System.Threading.Tasks.Task<>.ContinueWith(Action<Task<>, Object>, object, CancellationToken, TaskContinuationOptions, TaskScheduler) | argument 1 -> parameter 1 of argument 0 | true |
+| System.Threading.Tasks.Task<>.ContinueWith(Action<Task<>, Object>, object, CancellationToken, TaskContinuationOptions, TaskScheduler) | argument -1 -> parameter 0 of argument 0 | true |
+| System.Threading.Tasks.Task<>.ContinueWith(Action<Task<>, Object>, object, TaskContinuationOptions) | argument 1 -> parameter 1 of argument 0 | true |
+| System.Threading.Tasks.Task<>.ContinueWith(Action<Task<>, Object>, object, TaskContinuationOptions) | argument -1 -> parameter 0 of argument 0 | true |
+| System.Threading.Tasks.Task<>.ContinueWith(Action<Task<>, Object>, object, TaskScheduler) | argument 1 -> parameter 1 of argument 0 | true |
+| System.Threading.Tasks.Task<>.ContinueWith(Action<Task<>, Object>, object, TaskScheduler) | argument -1 -> parameter 0 of argument 0 | true |
+| System.Threading.Tasks.Task<>.ContinueWith(Action<Task<>>) | argument -1 -> parameter 0 of argument 0 | true |
+| System.Threading.Tasks.Task<>.ContinueWith(Action<Task<>>, CancellationToken) | argument -1 -> parameter 0 of argument 0 | true |
+| System.Threading.Tasks.Task<>.ContinueWith(Action<Task<>>, CancellationToken, TaskContinuationOptions, TaskScheduler) | argument -1 -> parameter 0 of argument 0 | true |
+| System.Threading.Tasks.Task<>.ContinueWith(Action<Task<>>, TaskContinuationOptions) | argument -1 -> parameter 0 of argument 0 | true |
+| System.Threading.Tasks.Task<>.ContinueWith(Action<Task<>>, TaskScheduler) | argument -1 -> parameter 0 of argument 0 | true |
+| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, Object, TNewResult>, object) | argument 1 -> parameter 1 of argument 0 | true |
+| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, Object, TNewResult>, object) | argument -1 -> parameter 0 of argument 0 | true |
+| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, Object, TNewResult>, object) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, Object, TNewResult>, object, CancellationToken) | argument 1 -> parameter 1 of argument 0 | true |
+| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, Object, TNewResult>, object, CancellationToken) | argument -1 -> parameter 0 of argument 0 | true |
+| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, Object, TNewResult>, object, CancellationToken) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, Object, TNewResult>, object, CancellationToken, TaskContinuationOptions, TaskScheduler) | argument 1 -> parameter 1 of argument 0 | true |
+| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, Object, TNewResult>, object, CancellationToken, TaskContinuationOptions, TaskScheduler) | argument -1 -> parameter 0 of argument 0 | true |
+| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, Object, TNewResult>, object, CancellationToken, TaskContinuationOptions, TaskScheduler) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, Object, TNewResult>, object, TaskContinuationOptions) | argument 1 -> parameter 1 of argument 0 | true |
+| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, Object, TNewResult>, object, TaskContinuationOptions) | argument -1 -> parameter 0 of argument 0 | true |
+| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, Object, TNewResult>, object, TaskContinuationOptions) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, Object, TNewResult>, object, TaskScheduler) | argument 1 -> parameter 1 of argument 0 | true |
+| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, Object, TNewResult>, object, TaskScheduler) | argument -1 -> parameter 0 of argument 0 | true |
+| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, Object, TNewResult>, object, TaskScheduler) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, TNewResult>) | argument -1 -> parameter 0 of argument 0 | true |
+| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, TNewResult>) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, TNewResult>, CancellationToken) | argument -1 -> parameter 0 of argument 0 | true |
+| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, TNewResult>, CancellationToken) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, TNewResult>, CancellationToken, TaskContinuationOptions, TaskScheduler) | argument -1 -> parameter 0 of argument 0 | true |
+| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, TNewResult>, CancellationToken, TaskContinuationOptions, TaskScheduler) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, TNewResult>, TaskContinuationOptions) | argument -1 -> parameter 0 of argument 0 | true |
+| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, TNewResult>, TaskContinuationOptions) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, TNewResult>, TaskScheduler) | argument -1 -> parameter 0 of argument 0 | true |
+| System.Threading.Tasks.Task<>.ContinueWith<TNewResult>(Func<Task<>, TNewResult>, TaskScheduler) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.Task<>.GetAwaiter() | argument -1 -> field m_task of return (normal) | true |
+| System.Threading.Tasks.Task<>.Task(Func<Object, TResult>, object) | argument 1 -> parameter 0 of argument 0 | true |
+| System.Threading.Tasks.Task<>.Task(Func<Object, TResult>, object) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.Task<>.Task(Func<Object, TResult>, object, CancellationToken) | argument 1 -> parameter 0 of argument 0 | true |
+| System.Threading.Tasks.Task<>.Task(Func<Object, TResult>, object, CancellationToken) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.Task<>.Task(Func<Object, TResult>, object, CancellationToken, TaskCreationOptions) | argument 1 -> parameter 0 of argument 0 | true |
+| System.Threading.Tasks.Task<>.Task(Func<Object, TResult>, object, CancellationToken, TaskCreationOptions) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.Task<>.Task(Func<Object, TResult>, object, TaskCreationOptions) | argument 1 -> parameter 0 of argument 0 | true |
+| System.Threading.Tasks.Task<>.Task(Func<Object, TResult>, object, TaskCreationOptions) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.Task<>.Task(Func<TResult>) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.Task<>.Task(Func<TResult>, CancellationToken) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.Task<>.Task(Func<TResult>, CancellationToken, TaskCreationOptions) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.Task<>.Task(Func<TResult>, TaskCreationOptions) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.Task<>.get_Result() | argument -1 -> return (normal) | false |
+| System.Threading.Tasks.TaskFactory.ContinueWhenAll<TAntecedentResult, TResult>(Task<TAntecedentResult>[], Func<Task, TResult>) | argument 0 -> parameter 0 of argument 1 | true |
+| System.Threading.Tasks.TaskFactory.ContinueWhenAll<TAntecedentResult, TResult>(Task<TAntecedentResult>[], Func<Task, TResult>) | return (normal) of argument 1 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory.ContinueWhenAll<TAntecedentResult, TResult>(Task<TAntecedentResult>[], Func<Task, TResult>, CancellationToken) | argument 0 -> parameter 0 of argument 1 | true |
+| System.Threading.Tasks.TaskFactory.ContinueWhenAll<TAntecedentResult, TResult>(Task<TAntecedentResult>[], Func<Task, TResult>, CancellationToken) | return (normal) of argument 1 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory.ContinueWhenAll<TAntecedentResult, TResult>(Task<TAntecedentResult>[], Func<Task, TResult>, CancellationToken, TaskContinuationOptions, TaskScheduler) | argument 0 -> parameter 0 of argument 1 | true |
+| System.Threading.Tasks.TaskFactory.ContinueWhenAll<TAntecedentResult, TResult>(Task<TAntecedentResult>[], Func<Task, TResult>, CancellationToken, TaskContinuationOptions, TaskScheduler) | return (normal) of argument 1 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory.ContinueWhenAll<TAntecedentResult, TResult>(Task<TAntecedentResult>[], Func<Task, TResult>, TaskContinuationOptions) | argument 0 -> parameter 0 of argument 1 | true |
+| System.Threading.Tasks.TaskFactory.ContinueWhenAll<TAntecedentResult, TResult>(Task<TAntecedentResult>[], Func<Task, TResult>, TaskContinuationOptions) | return (normal) of argument 1 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory.ContinueWhenAll<TAntecedentResult>(Task<TAntecedentResult>[], Action<Task>) | argument 0 -> parameter 0 of argument 1 | true |
+| System.Threading.Tasks.TaskFactory.ContinueWhenAll<TAntecedentResult>(Task<TAntecedentResult>[], Action<Task>, CancellationToken) | argument 0 -> parameter 0 of argument 1 | true |
+| System.Threading.Tasks.TaskFactory.ContinueWhenAll<TAntecedentResult>(Task<TAntecedentResult>[], Action<Task>, CancellationToken, TaskContinuationOptions, TaskScheduler) | argument 0 -> parameter 0 of argument 1 | true |
+| System.Threading.Tasks.TaskFactory.ContinueWhenAll<TAntecedentResult>(Task<TAntecedentResult>[], Action<Task>, TaskContinuationOptions) | argument 0 -> parameter 0 of argument 1 | true |
+| System.Threading.Tasks.TaskFactory.ContinueWhenAll<TResult>(Task[], Func<Task[], TResult>) | return (normal) of argument 1 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory.ContinueWhenAll<TResult>(Task[], Func<Task[], TResult>, CancellationToken) | return (normal) of argument 1 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory.ContinueWhenAll<TResult>(Task[], Func<Task[], TResult>, CancellationToken, TaskContinuationOptions, TaskScheduler) | return (normal) of argument 1 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory.ContinueWhenAll<TResult>(Task[], Func<Task[], TResult>, TaskContinuationOptions) | return (normal) of argument 1 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory.ContinueWhenAny<TAntecedentResult, TResult>(Task<TAntecedentResult>[], Func<Task<TAntecedentResult>, TResult>) | argument 0 -> parameter 0 of argument 1 | true |
+| System.Threading.Tasks.TaskFactory.ContinueWhenAny<TAntecedentResult, TResult>(Task<TAntecedentResult>[], Func<Task<TAntecedentResult>, TResult>) | return (normal) of argument 1 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory.ContinueWhenAny<TAntecedentResult, TResult>(Task<TAntecedentResult>[], Func<Task<TAntecedentResult>, TResult>, CancellationToken) | argument 0 -> parameter 0 of argument 1 | true |
+| System.Threading.Tasks.TaskFactory.ContinueWhenAny<TAntecedentResult, TResult>(Task<TAntecedentResult>[], Func<Task<TAntecedentResult>, TResult>, CancellationToken) | return (normal) of argument 1 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory.ContinueWhenAny<TAntecedentResult, TResult>(Task<TAntecedentResult>[], Func<Task<TAntecedentResult>, TResult>, CancellationToken, TaskContinuationOptions, TaskScheduler) | argument 0 -> parameter 0 of argument 1 | true |
+| System.Threading.Tasks.TaskFactory.ContinueWhenAny<TAntecedentResult, TResult>(Task<TAntecedentResult>[], Func<Task<TAntecedentResult>, TResult>, CancellationToken, TaskContinuationOptions, TaskScheduler) | return (normal) of argument 1 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory.ContinueWhenAny<TAntecedentResult, TResult>(Task<TAntecedentResult>[], Func<Task<TAntecedentResult>, TResult>, TaskContinuationOptions) | argument 0 -> parameter 0 of argument 1 | true |
+| System.Threading.Tasks.TaskFactory.ContinueWhenAny<TAntecedentResult, TResult>(Task<TAntecedentResult>[], Func<Task<TAntecedentResult>, TResult>, TaskContinuationOptions) | return (normal) of argument 1 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory.ContinueWhenAny<TAntecedentResult>(Task<TAntecedentResult>[], Action<Task<TAntecedentResult>>) | argument 0 -> parameter 0 of argument 1 | true |
+| System.Threading.Tasks.TaskFactory.ContinueWhenAny<TAntecedentResult>(Task<TAntecedentResult>[], Action<Task<TAntecedentResult>>, CancellationToken) | argument 0 -> parameter 0 of argument 1 | true |
+| System.Threading.Tasks.TaskFactory.ContinueWhenAny<TAntecedentResult>(Task<TAntecedentResult>[], Action<Task<TAntecedentResult>>, CancellationToken, TaskContinuationOptions, TaskScheduler) | argument 0 -> parameter 0 of argument 1 | true |
+| System.Threading.Tasks.TaskFactory.ContinueWhenAny<TAntecedentResult>(Task<TAntecedentResult>[], Action<Task<TAntecedentResult>>, TaskContinuationOptions) | argument 0 -> parameter 0 of argument 1 | true |
+| System.Threading.Tasks.TaskFactory.ContinueWhenAny<TResult>(Task[], Func<Task, TResult>) | return (normal) of argument 1 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory.ContinueWhenAny<TResult>(Task[], Func<Task, TResult>, CancellationToken) | return (normal) of argument 1 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory.ContinueWhenAny<TResult>(Task[], Func<Task, TResult>, CancellationToken, TaskContinuationOptions, TaskScheduler) | return (normal) of argument 1 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory.ContinueWhenAny<TResult>(Task[], Func<Task, TResult>, TaskContinuationOptions) | return (normal) of argument 1 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory.StartNew(Action<Object>, object) | argument 1 -> parameter 0 of argument 0 | true |
+| System.Threading.Tasks.TaskFactory.StartNew(Action<Object>, object, CancellationToken) | argument 1 -> parameter 0 of argument 0 | true |
+| System.Threading.Tasks.TaskFactory.StartNew(Action<Object>, object, CancellationToken, TaskCreationOptions, TaskScheduler) | argument 1 -> parameter 0 of argument 0 | true |
+| System.Threading.Tasks.TaskFactory.StartNew(Action<Object>, object, TaskCreationOptions) | argument 1 -> parameter 0 of argument 0 | true |
+| System.Threading.Tasks.TaskFactory.StartNew<TResult>(Func<Object, TResult>, object) | argument 1 -> parameter 0 of argument 0 | true |
+| System.Threading.Tasks.TaskFactory.StartNew<TResult>(Func<Object, TResult>, object) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory.StartNew<TResult>(Func<Object, TResult>, object, CancellationToken) | argument 1 -> parameter 0 of argument 0 | true |
+| System.Threading.Tasks.TaskFactory.StartNew<TResult>(Func<Object, TResult>, object, CancellationToken) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory.StartNew<TResult>(Func<Object, TResult>, object, CancellationToken, TaskCreationOptions, TaskScheduler) | argument 1 -> parameter 0 of argument 0 | true |
+| System.Threading.Tasks.TaskFactory.StartNew<TResult>(Func<Object, TResult>, object, CancellationToken, TaskCreationOptions, TaskScheduler) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory.StartNew<TResult>(Func<Object, TResult>, object, TaskCreationOptions) | argument 1 -> parameter 0 of argument 0 | true |
+| System.Threading.Tasks.TaskFactory.StartNew<TResult>(Func<Object, TResult>, object, TaskCreationOptions) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory.StartNew<TResult>(Func<TResult>) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory.StartNew<TResult>(Func<TResult>, CancellationToken) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory.StartNew<TResult>(Func<TResult>, CancellationToken, TaskCreationOptions, TaskScheduler) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory.StartNew<TResult>(Func<TResult>, TaskCreationOptions) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory<>.ContinueWhenAll(Task[], Func<Task[], TResult>) | return (normal) of argument 1 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory<>.ContinueWhenAll(Task[], Func<Task[], TResult>, CancellationToken) | return (normal) of argument 1 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory<>.ContinueWhenAll(Task[], Func<Task[], TResult>, CancellationToken, TaskContinuationOptions, TaskScheduler) | return (normal) of argument 1 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory<>.ContinueWhenAll(Task[], Func<Task[], TResult>, TaskContinuationOptions) | return (normal) of argument 1 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory<>.ContinueWhenAll<TAntecedentResult>(Task<TAntecedentResult>[], Func<Task, TResult>) | argument 0 -> parameter 0 of argument 1 | true |
+| System.Threading.Tasks.TaskFactory<>.ContinueWhenAll<TAntecedentResult>(Task<TAntecedentResult>[], Func<Task, TResult>) | return (normal) of argument 1 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory<>.ContinueWhenAll<TAntecedentResult>(Task<TAntecedentResult>[], Func<Task, TResult>, CancellationToken) | argument 0 -> parameter 0 of argument 1 | true |
+| System.Threading.Tasks.TaskFactory<>.ContinueWhenAll<TAntecedentResult>(Task<TAntecedentResult>[], Func<Task, TResult>, CancellationToken) | return (normal) of argument 1 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory<>.ContinueWhenAll<TAntecedentResult>(Task<TAntecedentResult>[], Func<Task, TResult>, CancellationToken, TaskContinuationOptions, TaskScheduler) | argument 0 -> parameter 0 of argument 1 | true |
+| System.Threading.Tasks.TaskFactory<>.ContinueWhenAll<TAntecedentResult>(Task<TAntecedentResult>[], Func<Task, TResult>, CancellationToken, TaskContinuationOptions, TaskScheduler) | return (normal) of argument 1 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory<>.ContinueWhenAll<TAntecedentResult>(Task<TAntecedentResult>[], Func<Task, TResult>, TaskContinuationOptions) | argument 0 -> parameter 0 of argument 1 | true |
+| System.Threading.Tasks.TaskFactory<>.ContinueWhenAll<TAntecedentResult>(Task<TAntecedentResult>[], Func<Task, TResult>, TaskContinuationOptions) | return (normal) of argument 1 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory<>.ContinueWhenAny(Task[], Func<Task, TResult>) | return (normal) of argument 1 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory<>.ContinueWhenAny(Task[], Func<Task, TResult>, CancellationToken) | return (normal) of argument 1 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory<>.ContinueWhenAny(Task[], Func<Task, TResult>, CancellationToken, TaskContinuationOptions, TaskScheduler) | return (normal) of argument 1 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory<>.ContinueWhenAny(Task[], Func<Task, TResult>, TaskContinuationOptions) | return (normal) of argument 1 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory<>.ContinueWhenAny<TAntecedentResult>(Task<TAntecedentResult>[], Func<Task<TAntecedentResult>, TResult>) | argument 0 -> parameter 0 of argument 1 | true |
+| System.Threading.Tasks.TaskFactory<>.ContinueWhenAny<TAntecedentResult>(Task<TAntecedentResult>[], Func<Task<TAntecedentResult>, TResult>) | return (normal) of argument 1 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory<>.ContinueWhenAny<TAntecedentResult>(Task<TAntecedentResult>[], Func<Task<TAntecedentResult>, TResult>, CancellationToken) | argument 0 -> parameter 0 of argument 1 | true |
+| System.Threading.Tasks.TaskFactory<>.ContinueWhenAny<TAntecedentResult>(Task<TAntecedentResult>[], Func<Task<TAntecedentResult>, TResult>, CancellationToken) | return (normal) of argument 1 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory<>.ContinueWhenAny<TAntecedentResult>(Task<TAntecedentResult>[], Func<Task<TAntecedentResult>, TResult>, CancellationToken, TaskContinuationOptions, TaskScheduler) | argument 0 -> parameter 0 of argument 1 | true |
+| System.Threading.Tasks.TaskFactory<>.ContinueWhenAny<TAntecedentResult>(Task<TAntecedentResult>[], Func<Task<TAntecedentResult>, TResult>, CancellationToken, TaskContinuationOptions, TaskScheduler) | return (normal) of argument 1 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory<>.ContinueWhenAny<TAntecedentResult>(Task<TAntecedentResult>[], Func<Task<TAntecedentResult>, TResult>, TaskContinuationOptions) | argument 0 -> parameter 0 of argument 1 | true |
+| System.Threading.Tasks.TaskFactory<>.ContinueWhenAny<TAntecedentResult>(Task<TAntecedentResult>[], Func<Task<TAntecedentResult>, TResult>, TaskContinuationOptions) | return (normal) of argument 1 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory<>.StartNew(Func<Object, TResult>, object) | argument 1 -> parameter 0 of argument 0 | true |
+| System.Threading.Tasks.TaskFactory<>.StartNew(Func<Object, TResult>, object) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory<>.StartNew(Func<Object, TResult>, object, CancellationToken) | argument 1 -> parameter 0 of argument 0 | true |
+| System.Threading.Tasks.TaskFactory<>.StartNew(Func<Object, TResult>, object, CancellationToken) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory<>.StartNew(Func<Object, TResult>, object, CancellationToken, TaskCreationOptions, TaskScheduler) | argument 1 -> parameter 0 of argument 0 | true |
+| System.Threading.Tasks.TaskFactory<>.StartNew(Func<Object, TResult>, object, CancellationToken, TaskCreationOptions, TaskScheduler) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory<>.StartNew(Func<Object, TResult>, object, TaskCreationOptions) | argument 1 -> parameter 0 of argument 0 | true |
+| System.Threading.Tasks.TaskFactory<>.StartNew(Func<Object, TResult>, object, TaskCreationOptions) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory<>.StartNew(Func<TResult>) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory<>.StartNew(Func<TResult>, CancellationToken) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory<>.StartNew(Func<TResult>, CancellationToken, TaskCreationOptions, TaskScheduler) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.TaskFactory<>.StartNew(Func<TResult>, TaskCreationOptions) | return (normal) of argument 0 -> property Result of return (normal) | true |
+| System.Threading.Tasks.ThreadPoolTaskScheduler.<FilterTasksFromWorkItems>d__6.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Threading.ThreadPool.<GetLocallyQueuedWorkItems>d__52.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Threading.ThreadPool.<GetQueuedWorkItems>d__51.GetEnumerator() | element of argument -1 -> property Current of return (normal) | true |
+| System.Tuple.Create<T1, T2, T3, T4, T5, T6, T7, T8>(T1, T2, T3, T4, T5, T6, T7, T8) | argument 0 -> property Item1 of return (normal) | true |
+| System.Tuple.Create<T1, T2, T3, T4, T5, T6, T7, T8>(T1, T2, T3, T4, T5, T6, T7, T8) | argument 1 -> property Item2 of return (normal) | true |
+| System.Tuple.Create<T1, T2, T3, T4, T5, T6, T7, T8>(T1, T2, T3, T4, T5, T6, T7, T8) | argument 2 -> property Item3 of return (normal) | true |
+| System.Tuple.Create<T1, T2, T3, T4, T5, T6, T7, T8>(T1, T2, T3, T4, T5, T6, T7, T8) | argument 3 -> property Item4 of return (normal) | true |
+| System.Tuple.Create<T1, T2, T3, T4, T5, T6, T7, T8>(T1, T2, T3, T4, T5, T6, T7, T8) | argument 4 -> property Item5 of return (normal) | true |
+| System.Tuple.Create<T1, T2, T3, T4, T5, T6, T7, T8>(T1, T2, T3, T4, T5, T6, T7, T8) | argument 5 -> property Item6 of return (normal) | true |
+| System.Tuple.Create<T1, T2, T3, T4, T5, T6, T7, T8>(T1, T2, T3, T4, T5, T6, T7, T8) | argument 6 -> property Item7 of return (normal) | true |
+| System.Tuple.Create<T1, T2, T3, T4, T5, T6, T7>(T1, T2, T3, T4, T5, T6, T7) | argument 0 -> property Item1 of return (normal) | true |
+| System.Tuple.Create<T1, T2, T3, T4, T5, T6, T7>(T1, T2, T3, T4, T5, T6, T7) | argument 1 -> property Item2 of return (normal) | true |
+| System.Tuple.Create<T1, T2, T3, T4, T5, T6, T7>(T1, T2, T3, T4, T5, T6, T7) | argument 2 -> property Item3 of return (normal) | true |
+| System.Tuple.Create<T1, T2, T3, T4, T5, T6, T7>(T1, T2, T3, T4, T5, T6, T7) | argument 3 -> property Item4 of return (normal) | true |
+| System.Tuple.Create<T1, T2, T3, T4, T5, T6, T7>(T1, T2, T3, T4, T5, T6, T7) | argument 4 -> property Item5 of return (normal) | true |
+| System.Tuple.Create<T1, T2, T3, T4, T5, T6, T7>(T1, T2, T3, T4, T5, T6, T7) | argument 5 -> property Item6 of return (normal) | true |
+| System.Tuple.Create<T1, T2, T3, T4, T5, T6, T7>(T1, T2, T3, T4, T5, T6, T7) | argument 6 -> property Item7 of return (normal) | true |
+| System.Tuple.Create<T1, T2, T3, T4, T5, T6>(T1, T2, T3, T4, T5, T6) | argument 0 -> property Item1 of return (normal) | true |
+| System.Tuple.Create<T1, T2, T3, T4, T5, T6>(T1, T2, T3, T4, T5, T6) | argument 1 -> property Item2 of return (normal) | true |
+| System.Tuple.Create<T1, T2, T3, T4, T5, T6>(T1, T2, T3, T4, T5, T6) | argument 2 -> property Item3 of return (normal) | true |
+| System.Tuple.Create<T1, T2, T3, T4, T5, T6>(T1, T2, T3, T4, T5, T6) | argument 3 -> property Item4 of return (normal) | true |
+| System.Tuple.Create<T1, T2, T3, T4, T5, T6>(T1, T2, T3, T4, T5, T6) | argument 4 -> property Item5 of return (normal) | true |
+| System.Tuple.Create<T1, T2, T3, T4, T5, T6>(T1, T2, T3, T4, T5, T6) | argument 5 -> property Item6 of return (normal) | true |
+| System.Tuple.Create<T1, T2, T3, T4, T5>(T1, T2, T3, T4, T5) | argument 0 -> property Item1 of return (normal) | true |
+| System.Tuple.Create<T1, T2, T3, T4, T5>(T1, T2, T3, T4, T5) | argument 1 -> property Item2 of return (normal) | true |
+| System.Tuple.Create<T1, T2, T3, T4, T5>(T1, T2, T3, T4, T5) | argument 2 -> property Item3 of return (normal) | true |
+| System.Tuple.Create<T1, T2, T3, T4, T5>(T1, T2, T3, T4, T5) | argument 3 -> property Item4 of return (normal) | true |
+| System.Tuple.Create<T1, T2, T3, T4, T5>(T1, T2, T3, T4, T5) | argument 4 -> property Item5 of return (normal) | true |
+| System.Tuple.Create<T1, T2, T3, T4>(T1, T2, T3, T4) | argument 0 -> property Item1 of return (normal) | true |
+| System.Tuple.Create<T1, T2, T3, T4>(T1, T2, T3, T4) | argument 1 -> property Item2 of return (normal) | true |
+| System.Tuple.Create<T1, T2, T3, T4>(T1, T2, T3, T4) | argument 2 -> property Item3 of return (normal) | true |
+| System.Tuple.Create<T1, T2, T3, T4>(T1, T2, T3, T4) | argument 3 -> property Item4 of return (normal) | true |
+| System.Tuple.Create<T1, T2, T3>(T1, T2, T3) | argument 0 -> property Item1 of return (normal) | true |
+| System.Tuple.Create<T1, T2, T3>(T1, T2, T3) | argument 1 -> property Item2 of return (normal) | true |
+| System.Tuple.Create<T1, T2, T3>(T1, T2, T3) | argument 2 -> property Item3 of return (normal) | true |
+| System.Tuple.Create<T1, T2>(T1, T2) | argument 0 -> property Item1 of return (normal) | true |
+| System.Tuple.Create<T1, T2>(T1, T2) | argument 1 -> property Item2 of return (normal) | true |
+| System.Tuple.Create<T1>(T1) | argument 0 -> property Item1 of return (normal) | true |
+| System.Tuple<,,,,,,,>.Tuple(T1, T2, T3, T4, T5, T6, T7, TRest) | argument 0 -> property Item1 of return (normal) | true |
+| System.Tuple<,,,,,,,>.Tuple(T1, T2, T3, T4, T5, T6, T7, TRest) | argument 1 -> property Item2 of return (normal) | true |
+| System.Tuple<,,,,,,,>.Tuple(T1, T2, T3, T4, T5, T6, T7, TRest) | argument 2 -> property Item3 of return (normal) | true |
+| System.Tuple<,,,,,,,>.Tuple(T1, T2, T3, T4, T5, T6, T7, TRest) | argument 3 -> property Item4 of return (normal) | true |
+| System.Tuple<,,,,,,,>.Tuple(T1, T2, T3, T4, T5, T6, T7, TRest) | argument 4 -> property Item5 of return (normal) | true |
+| System.Tuple<,,,,,,,>.Tuple(T1, T2, T3, T4, T5, T6, T7, TRest) | argument 5 -> property Item6 of return (normal) | true |
+| System.Tuple<,,,,,,,>.Tuple(T1, T2, T3, T4, T5, T6, T7, TRest) | argument 6 -> property Item7 of return (normal) | true |
+| System.Tuple<,,,,,,,>.get_Item(int) | property Item1 of argument -1 -> return (normal) | true |
+| System.Tuple<,,,,,,,>.get_Item(int) | property Item2 of argument -1 -> return (normal) | true |
+| System.Tuple<,,,,,,,>.get_Item(int) | property Item3 of argument -1 -> return (normal) | true |
+| System.Tuple<,,,,,,,>.get_Item(int) | property Item4 of argument -1 -> return (normal) | true |
+| System.Tuple<,,,,,,,>.get_Item(int) | property Item5 of argument -1 -> return (normal) | true |
+| System.Tuple<,,,,,,,>.get_Item(int) | property Item6 of argument -1 -> return (normal) | true |
+| System.Tuple<,,,,,,,>.get_Item(int) | property Item7 of argument -1 -> return (normal) | true |
+| System.Tuple<,,,,,,>.Tuple(T1, T2, T3, T4, T5, T6, T7) | argument 0 -> property Item1 of return (normal) | true |
+| System.Tuple<,,,,,,>.Tuple(T1, T2, T3, T4, T5, T6, T7) | argument 1 -> property Item2 of return (normal) | true |
+| System.Tuple<,,,,,,>.Tuple(T1, T2, T3, T4, T5, T6, T7) | argument 2 -> property Item3 of return (normal) | true |
+| System.Tuple<,,,,,,>.Tuple(T1, T2, T3, T4, T5, T6, T7) | argument 3 -> property Item4 of return (normal) | true |
+| System.Tuple<,,,,,,>.Tuple(T1, T2, T3, T4, T5, T6, T7) | argument 4 -> property Item5 of return (normal) | true |
+| System.Tuple<,,,,,,>.Tuple(T1, T2, T3, T4, T5, T6, T7) | argument 5 -> property Item6 of return (normal) | true |
+| System.Tuple<,,,,,,>.Tuple(T1, T2, T3, T4, T5, T6, T7) | argument 6 -> property Item7 of return (normal) | true |
+| System.Tuple<,,,,,,>.get_Item(int) | property Item1 of argument -1 -> return (normal) | true |
+| System.Tuple<,,,,,,>.get_Item(int) | property Item2 of argument -1 -> return (normal) | true |
+| System.Tuple<,,,,,,>.get_Item(int) | property Item3 of argument -1 -> return (normal) | true |
+| System.Tuple<,,,,,,>.get_Item(int) | property Item4 of argument -1 -> return (normal) | true |
+| System.Tuple<,,,,,,>.get_Item(int) | property Item5 of argument -1 -> return (normal) | true |
+| System.Tuple<,,,,,,>.get_Item(int) | property Item6 of argument -1 -> return (normal) | true |
+| System.Tuple<,,,,,,>.get_Item(int) | property Item7 of argument -1 -> return (normal) | true |
+| System.Tuple<,,,,,>.Tuple(T1, T2, T3, T4, T5, T6) | argument 0 -> property Item1 of return (normal) | true |
+| System.Tuple<,,,,,>.Tuple(T1, T2, T3, T4, T5, T6) | argument 1 -> property Item2 of return (normal) | true |
+| System.Tuple<,,,,,>.Tuple(T1, T2, T3, T4, T5, T6) | argument 2 -> property Item3 of return (normal) | true |
+| System.Tuple<,,,,,>.Tuple(T1, T2, T3, T4, T5, T6) | argument 3 -> property Item4 of return (normal) | true |
+| System.Tuple<,,,,,>.Tuple(T1, T2, T3, T4, T5, T6) | argument 4 -> property Item5 of return (normal) | true |
+| System.Tuple<,,,,,>.Tuple(T1, T2, T3, T4, T5, T6) | argument 5 -> property Item6 of return (normal) | true |
+| System.Tuple<,,,,,>.get_Item(int) | property Item1 of argument -1 -> return (normal) | true |
+| System.Tuple<,,,,,>.get_Item(int) | property Item2 of argument -1 -> return (normal) | true |
+| System.Tuple<,,,,,>.get_Item(int) | property Item3 of argument -1 -> return (normal) | true |
+| System.Tuple<,,,,,>.get_Item(int) | property Item4 of argument -1 -> return (normal) | true |
+| System.Tuple<,,,,,>.get_Item(int) | property Item5 of argument -1 -> return (normal) | true |
+| System.Tuple<,,,,,>.get_Item(int) | property Item6 of argument -1 -> return (normal) | true |
+| System.Tuple<,,,,>.Tuple(T1, T2, T3, T4, T5) | argument 0 -> property Item1 of return (normal) | true |
+| System.Tuple<,,,,>.Tuple(T1, T2, T3, T4, T5) | argument 1 -> property Item2 of return (normal) | true |
+| System.Tuple<,,,,>.Tuple(T1, T2, T3, T4, T5) | argument 2 -> property Item3 of return (normal) | true |
+| System.Tuple<,,,,>.Tuple(T1, T2, T3, T4, T5) | argument 3 -> property Item4 of return (normal) | true |
+| System.Tuple<,,,,>.Tuple(T1, T2, T3, T4, T5) | argument 4 -> property Item5 of return (normal) | true |
+| System.Tuple<,,,,>.get_Item(int) | property Item1 of argument -1 -> return (normal) | true |
+| System.Tuple<,,,,>.get_Item(int) | property Item2 of argument -1 -> return (normal) | true |
+| System.Tuple<,,,,>.get_Item(int) | property Item3 of argument -1 -> return (normal) | true |
+| System.Tuple<,,,,>.get_Item(int) | property Item4 of argument -1 -> return (normal) | true |
+| System.Tuple<,,,,>.get_Item(int) | property Item5 of argument -1 -> return (normal) | true |
+| System.Tuple<,,,>.Tuple(T1, T2, T3, T4) | argument 0 -> property Item1 of return (normal) | true |
+| System.Tuple<,,,>.Tuple(T1, T2, T3, T4) | argument 1 -> property Item2 of return (normal) | true |
+| System.Tuple<,,,>.Tuple(T1, T2, T3, T4) | argument 2 -> property Item3 of return (normal) | true |
+| System.Tuple<,,,>.Tuple(T1, T2, T3, T4) | argument 3 -> property Item4 of return (normal) | true |
+| System.Tuple<,,,>.get_Item(int) | property Item1 of argument -1 -> return (normal) | true |
+| System.Tuple<,,,>.get_Item(int) | property Item2 of argument -1 -> return (normal) | true |
+| System.Tuple<,,,>.get_Item(int) | property Item3 of argument -1 -> return (normal) | true |
+| System.Tuple<,,,>.get_Item(int) | property Item4 of argument -1 -> return (normal) | true |
+| System.Tuple<,,>.Tuple(T1, T2, T3) | argument 0 -> property Item1 of return (normal) | true |
+| System.Tuple<,,>.Tuple(T1, T2, T3) | argument 1 -> property Item2 of return (normal) | true |
+| System.Tuple<,,>.Tuple(T1, T2, T3) | argument 2 -> property Item3 of return (normal) | true |
+| System.Tuple<,,>.get_Item(int) | property Item1 of argument -1 -> return (normal) | true |
+| System.Tuple<,,>.get_Item(int) | property Item2 of argument -1 -> return (normal) | true |
+| System.Tuple<,,>.get_Item(int) | property Item3 of argument -1 -> return (normal) | true |
+| System.Tuple<,>.Tuple(T1, T2) | argument 0 -> property Item1 of return (normal) | true |
+| System.Tuple<,>.Tuple(T1, T2) | argument 1 -> property Item2 of return (normal) | true |
+| System.Tuple<,>.get_Item(int) | property Item1 of argument -1 -> return (normal) | true |
+| System.Tuple<,>.get_Item(int) | property Item2 of argument -1 -> return (normal) | true |
+| System.Tuple<>.Tuple(T1) | argument 0 -> property Item1 of return (normal) | true |
+| System.Tuple<>.get_Item(int) | property Item1 of argument -1 -> return (normal) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18, T19, T20, T21>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18,T19,T20,T21>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18, out T19, out T20, out T21) | property Item1 of argument 0 -> return (out parameter 1) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18, T19, T20, T21>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18,T19,T20,T21>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18, out T19, out T20, out T21) | property Item2 of argument 0 -> return (out parameter 2) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18, T19, T20, T21>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18,T19,T20,T21>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18, out T19, out T20, out T21) | property Item3 of argument 0 -> return (out parameter 3) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18, T19, T20, T21>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18,T19,T20,T21>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18, out T19, out T20, out T21) | property Item4 of argument 0 -> return (out parameter 4) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18, T19, T20, T21>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18,T19,T20,T21>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18, out T19, out T20, out T21) | property Item5 of argument 0 -> return (out parameter 5) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18, T19, T20, T21>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18,T19,T20,T21>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18, out T19, out T20, out T21) | property Item6 of argument 0 -> return (out parameter 6) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18, T19, T20, T21>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18,T19,T20,T21>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18, out T19, out T20, out T21) | property Item7 of argument 0 -> return (out parameter 7) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18, T19, T20>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18,T19,T20>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18, out T19, out T20) | property Item1 of argument 0 -> return (out parameter 1) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18, T19, T20>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18,T19,T20>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18, out T19, out T20) | property Item2 of argument 0 -> return (out parameter 2) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18, T19, T20>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18,T19,T20>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18, out T19, out T20) | property Item3 of argument 0 -> return (out parameter 3) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18, T19, T20>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18,T19,T20>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18, out T19, out T20) | property Item4 of argument 0 -> return (out parameter 4) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18, T19, T20>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18,T19,T20>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18, out T19, out T20) | property Item5 of argument 0 -> return (out parameter 5) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18, T19, T20>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18,T19,T20>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18, out T19, out T20) | property Item6 of argument 0 -> return (out parameter 6) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18, T19, T20>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18,T19,T20>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18, out T19, out T20) | property Item7 of argument 0 -> return (out parameter 7) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18, T19>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18,T19>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18, out T19) | property Item1 of argument 0 -> return (out parameter 1) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18, T19>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18,T19>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18, out T19) | property Item2 of argument 0 -> return (out parameter 2) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18, T19>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18,T19>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18, out T19) | property Item3 of argument 0 -> return (out parameter 3) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18, T19>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18,T19>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18, out T19) | property Item4 of argument 0 -> return (out parameter 4) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18, T19>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18,T19>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18, out T19) | property Item5 of argument 0 -> return (out parameter 5) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18, T19>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18,T19>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18, out T19) | property Item6 of argument 0 -> return (out parameter 6) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18, T19>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18,T19>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18, out T19) | property Item7 of argument 0 -> return (out parameter 7) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18) | property Item1 of argument 0 -> return (out parameter 1) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18) | property Item2 of argument 0 -> return (out parameter 2) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18) | property Item3 of argument 0 -> return (out parameter 3) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18) | property Item4 of argument 0 -> return (out parameter 4) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18) | property Item5 of argument 0 -> return (out parameter 5) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18) | property Item6 of argument 0 -> return (out parameter 6) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17, T18>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17,T18>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17, out T18) | property Item7 of argument 0 -> return (out parameter 7) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17) | property Item1 of argument 0 -> return (out parameter 1) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17) | property Item2 of argument 0 -> return (out parameter 2) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17) | property Item3 of argument 0 -> return (out parameter 3) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17) | property Item4 of argument 0 -> return (out parameter 4) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17) | property Item5 of argument 0 -> return (out parameter 5) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17) | property Item6 of argument 0 -> return (out parameter 6) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16, T17>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16,T17>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16, out T17) | property Item7 of argument 0 -> return (out parameter 7) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16) | property Item1 of argument 0 -> return (out parameter 1) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16) | property Item2 of argument 0 -> return (out parameter 2) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16) | property Item3 of argument 0 -> return (out parameter 3) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16) | property Item4 of argument 0 -> return (out parameter 4) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16) | property Item5 of argument 0 -> return (out parameter 5) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16) | property Item6 of argument 0 -> return (out parameter 6) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15,T16>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15, out T16) | property Item7 of argument 0 -> return (out parameter 7) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15) | property Item1 of argument 0 -> return (out parameter 1) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15) | property Item2 of argument 0 -> return (out parameter 2) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15) | property Item3 of argument 0 -> return (out parameter 3) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15) | property Item4 of argument 0 -> return (out parameter 4) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15) | property Item5 of argument 0 -> return (out parameter 5) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15) | property Item6 of argument 0 -> return (out parameter 6) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14,Tuple<T15>>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14, out T15) | property Item7 of argument 0 -> return (out parameter 7) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14) | property Item1 of argument 0 -> return (out parameter 1) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14) | property Item2 of argument 0 -> return (out parameter 2) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14) | property Item3 of argument 0 -> return (out parameter 3) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14) | property Item4 of argument 0 -> return (out parameter 4) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14) | property Item5 of argument 0 -> return (out parameter 5) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14) | property Item6 of argument 0 -> return (out parameter 6) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13,T14>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13, out T14) | property Item7 of argument 0 -> return (out parameter 7) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13) | property Item1 of argument 0 -> return (out parameter 1) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13) | property Item2 of argument 0 -> return (out parameter 2) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13) | property Item3 of argument 0 -> return (out parameter 3) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13) | property Item4 of argument 0 -> return (out parameter 4) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13) | property Item5 of argument 0 -> return (out parameter 5) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13) | property Item6 of argument 0 -> return (out parameter 6) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12,T13>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12, out T13) | property Item7 of argument 0 -> return (out parameter 7) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12) | property Item1 of argument 0 -> return (out parameter 1) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12) | property Item2 of argument 0 -> return (out parameter 2) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12) | property Item3 of argument 0 -> return (out parameter 3) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12) | property Item4 of argument 0 -> return (out parameter 4) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12) | property Item5 of argument 0 -> return (out parameter 5) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12) | property Item6 of argument 0 -> return (out parameter 6) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11,T12>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11, out T12) | property Item7 of argument 0 -> return (out parameter 7) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11) | property Item1 of argument 0 -> return (out parameter 1) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11) | property Item2 of argument 0 -> return (out parameter 2) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11) | property Item3 of argument 0 -> return (out parameter 3) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11) | property Item4 of argument 0 -> return (out parameter 4) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11) | property Item5 of argument 0 -> return (out parameter 5) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11) | property Item6 of argument 0 -> return (out parameter 6) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10,T11>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10, out T11) | property Item7 of argument 0 -> return (out parameter 7) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10) | property Item1 of argument 0 -> return (out parameter 1) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10) | property Item2 of argument 0 -> return (out parameter 2) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10) | property Item3 of argument 0 -> return (out parameter 3) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10) | property Item4 of argument 0 -> return (out parameter 4) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10) | property Item5 of argument 0 -> return (out parameter 5) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10) | property Item6 of argument 0 -> return (out parameter 6) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9,T10>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9, out T10) | property Item7 of argument 0 -> return (out parameter 7) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9) | property Item1 of argument 0 -> return (out parameter 1) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9) | property Item2 of argument 0 -> return (out parameter 2) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9) | property Item3 of argument 0 -> return (out parameter 3) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9) | property Item4 of argument 0 -> return (out parameter 4) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9) | property Item5 of argument 0 -> return (out parameter 5) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9) | property Item6 of argument 0 -> return (out parameter 6) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8, T9>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8,T9>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8, out T9) | property Item7 of argument 0 -> return (out parameter 7) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8) | property Item1 of argument 0 -> return (out parameter 1) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8) | property Item2 of argument 0 -> return (out parameter 2) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8) | property Item3 of argument 0 -> return (out parameter 3) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8) | property Item4 of argument 0 -> return (out parameter 4) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8) | property Item5 of argument 0 -> return (out parameter 5) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8) | property Item6 of argument 0 -> return (out parameter 6) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7, T8>(Tuple<T1, T2, T3, T4, T5, T6, T7, Tuple<T8>>, out T1, out T2, out T3, out T4, out T5, out T6, out T7, out T8) | property Item7 of argument 0 -> return (out parameter 7) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7>(Tuple<T1, T2, T3, T4, T5, T6, T7>, out T1, out T2, out T3, out T4, out T5, out T6, out T7) | property Item1 of argument 0 -> return (out parameter 1) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7>(Tuple<T1, T2, T3, T4, T5, T6, T7>, out T1, out T2, out T3, out T4, out T5, out T6, out T7) | property Item2 of argument 0 -> return (out parameter 2) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7>(Tuple<T1, T2, T3, T4, T5, T6, T7>, out T1, out T2, out T3, out T4, out T5, out T6, out T7) | property Item3 of argument 0 -> return (out parameter 3) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7>(Tuple<T1, T2, T3, T4, T5, T6, T7>, out T1, out T2, out T3, out T4, out T5, out T6, out T7) | property Item4 of argument 0 -> return (out parameter 4) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7>(Tuple<T1, T2, T3, T4, T5, T6, T7>, out T1, out T2, out T3, out T4, out T5, out T6, out T7) | property Item5 of argument 0 -> return (out parameter 5) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7>(Tuple<T1, T2, T3, T4, T5, T6, T7>, out T1, out T2, out T3, out T4, out T5, out T6, out T7) | property Item6 of argument 0 -> return (out parameter 6) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6, T7>(Tuple<T1, T2, T3, T4, T5, T6, T7>, out T1, out T2, out T3, out T4, out T5, out T6, out T7) | property Item7 of argument 0 -> return (out parameter 7) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6>(Tuple<T1, T2, T3, T4, T5, T6>, out T1, out T2, out T3, out T4, out T5, out T6) | property Item1 of argument 0 -> return (out parameter 1) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6>(Tuple<T1, T2, T3, T4, T5, T6>, out T1, out T2, out T3, out T4, out T5, out T6) | property Item2 of argument 0 -> return (out parameter 2) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6>(Tuple<T1, T2, T3, T4, T5, T6>, out T1, out T2, out T3, out T4, out T5, out T6) | property Item3 of argument 0 -> return (out parameter 3) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6>(Tuple<T1, T2, T3, T4, T5, T6>, out T1, out T2, out T3, out T4, out T5, out T6) | property Item4 of argument 0 -> return (out parameter 4) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6>(Tuple<T1, T2, T3, T4, T5, T6>, out T1, out T2, out T3, out T4, out T5, out T6) | property Item5 of argument 0 -> return (out parameter 5) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5, T6>(Tuple<T1, T2, T3, T4, T5, T6>, out T1, out T2, out T3, out T4, out T5, out T6) | property Item6 of argument 0 -> return (out parameter 6) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5>(Tuple<T1, T2, T3, T4, T5>, out T1, out T2, out T3, out T4, out T5) | property Item1 of argument 0 -> return (out parameter 1) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5>(Tuple<T1, T2, T3, T4, T5>, out T1, out T2, out T3, out T4, out T5) | property Item2 of argument 0 -> return (out parameter 2) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5>(Tuple<T1, T2, T3, T4, T5>, out T1, out T2, out T3, out T4, out T5) | property Item3 of argument 0 -> return (out parameter 3) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5>(Tuple<T1, T2, T3, T4, T5>, out T1, out T2, out T3, out T4, out T5) | property Item4 of argument 0 -> return (out parameter 4) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4, T5>(Tuple<T1, T2, T3, T4, T5>, out T1, out T2, out T3, out T4, out T5) | property Item5 of argument 0 -> return (out parameter 5) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4>(Tuple<T1, T2, T3, T4>, out T1, out T2, out T3, out T4) | property Item1 of argument 0 -> return (out parameter 1) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4>(Tuple<T1, T2, T3, T4>, out T1, out T2, out T3, out T4) | property Item2 of argument 0 -> return (out parameter 2) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4>(Tuple<T1, T2, T3, T4>, out T1, out T2, out T3, out T4) | property Item3 of argument 0 -> return (out parameter 3) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3, T4>(Tuple<T1, T2, T3, T4>, out T1, out T2, out T3, out T4) | property Item4 of argument 0 -> return (out parameter 4) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3>(Tuple<T1, T2, T3>, out T1, out T2, out T3) | property Item1 of argument 0 -> return (out parameter 1) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3>(Tuple<T1, T2, T3>, out T1, out T2, out T3) | property Item2 of argument 0 -> return (out parameter 2) | true |
+| System.TupleExtensions.Deconstruct<T1, T2, T3>(Tuple<T1, T2, T3>, out T1, out T2, out T3) | property Item3 of argument 0 -> return (out parameter 3) | true |
+| System.TupleExtensions.Deconstruct<T1, T2>(Tuple<T1, T2>, out T1, out T2) | property Item1 of argument 0 -> return (out parameter 1) | true |
+| System.TupleExtensions.Deconstruct<T1, T2>(Tuple<T1, T2>, out T1, out T2) | property Item2 of argument 0 -> return (out parameter 2) | true |
+| System.TupleExtensions.Deconstruct<T1>(Tuple<T1>, out T1) | property Item1 of argument 0 -> return (out parameter 1) | true |
+| System.Uri.ToString() | argument -1 -> return (normal) | false |
+| System.Uri.Uri(string) | argument 0 -> return (normal) | false |
+| System.Uri.Uri(string, UriKind) | argument 0 -> return (normal) | false |
+| System.Uri.Uri(string, bool) | argument 0 -> return (normal) | false |
+| System.Uri.get_OriginalString() | argument -1 -> return (normal) | false |
+| System.Uri.get_PathAndQuery() | argument -1 -> return (normal) | false |
+| System.Uri.get_Query() | argument -1 -> return (normal) | false |
+| System.ValueTuple<,,,,,,,>.ValueTuple(T1, T2, T3, T4, T5, T6, T7, TRest) | argument 0 -> field Item1 of return (normal) | true |
+| System.ValueTuple<,,,,,,,>.ValueTuple(T1, T2, T3, T4, T5, T6, T7, TRest) | argument 1 -> field Item2 of return (normal) | true |
+| System.ValueTuple<,,,,,,,>.ValueTuple(T1, T2, T3, T4, T5, T6, T7, TRest) | argument 2 -> field Item3 of return (normal) | true |
+| System.ValueTuple<,,,,,,,>.ValueTuple(T1, T2, T3, T4, T5, T6, T7, TRest) | argument 3 -> field Item4 of return (normal) | true |
+| System.ValueTuple<,,,,,,,>.ValueTuple(T1, T2, T3, T4, T5, T6, T7, TRest) | argument 4 -> field Item5 of return (normal) | true |
+| System.ValueTuple<,,,,,,,>.ValueTuple(T1, T2, T3, T4, T5, T6, T7, TRest) | argument 5 -> field Item6 of return (normal) | true |
+| System.ValueTuple<,,,,,,,>.ValueTuple(T1, T2, T3, T4, T5, T6, T7, TRest) | argument 6 -> field Item7 of return (normal) | true |
+| System.ValueTuple<,,,,,,,>.get_Item(int) | field Item1 of argument -1 -> return (normal) | true |
+| System.ValueTuple<,,,,,,,>.get_Item(int) | field Item2 of argument -1 -> return (normal) | true |
+| System.ValueTuple<,,,,,,,>.get_Item(int) | field Item3 of argument -1 -> return (normal) | true |
+| System.ValueTuple<,,,,,,,>.get_Item(int) | field Item4 of argument -1 -> return (normal) | true |
+| System.ValueTuple<,,,,,,,>.get_Item(int) | field Item5 of argument -1 -> return (normal) | true |
+| System.ValueTuple<,,,,,,,>.get_Item(int) | field Item6 of argument -1 -> return (normal) | true |
+| System.ValueTuple<,,,,,,,>.get_Item(int) | field Item7 of argument -1 -> return (normal) | true |
+| System.Web.HttpCookie.get_Value() | argument -1 -> return (normal) | false |
+| System.Web.HttpCookie.get_Values() | argument -1 -> return (normal) | false |
+| System.Web.HttpServerUtility.UrlEncode(string) | argument 0 -> return (normal) | false |
+| System.Web.HttpUtility.HtmlAttributeEncode(string) | argument 0 -> return (normal) | false |
+| System.Web.HttpUtility.HtmlEncode(object) | argument 0 -> return (normal) | false |
+| System.Web.HttpUtility.HtmlEncode(string) | argument 0 -> return (normal) | false |
+| System.Web.HttpUtility.UrlEncode(string) | argument 0 -> return (normal) | false |
+| System.Web.UI.WebControls.TextBox.get_Text() | argument -1 -> return (normal) | false |
diff --git a/csharp/ql/test/library-tests/dataflow/library/FlowSummaries.ql b/csharp/ql/test/library-tests/dataflow/library/FlowSummaries.ql
index 12eafa32a0f..0ff3ce7de04 100644
--- a/csharp/ql/test/library-tests/dataflow/library/FlowSummaries.ql
+++ b/csharp/ql/test/library-tests/dataflow/library/FlowSummaries.ql
@@ -1,6 +1,8 @@
 import semmle.code.csharp.dataflow.FlowSummary
-import semmle.code.csharp.dataflow.FlowSummary::TestOutput
+import semmle.code.csharp.dataflow.internal.FlowSummaryImpl::Private::TestOutput
 
-private class IncludeEFSummarizedCallable extends RelevantSummarizedCallable {
-  IncludeEFSummarizedCallable() { this instanceof SummarizedCallable }
+private class IncludeSummarizedCallable extends RelevantSummarizedCallable {
+  IncludeSummarizedCallable() { this instanceof SummarizedCallable }
+
+  override string getFullString() { result = this.(Callable).getQualifiedNameWithTypes() }
 }
diff --git a/csharp/ql/test/library-tests/dataflow/local/DataFlowStep.ql b/csharp/ql/test/library-tests/dataflow/local/DataFlowStep.ql
index f1fc98c459b..8f820cfea48 100644
--- a/csharp/ql/test/library-tests/dataflow/local/DataFlowStep.ql
+++ b/csharp/ql/test/library-tests/dataflow/local/DataFlowStep.ql
@@ -1,5 +1,5 @@
 import csharp
 
 from DataFlow::Node pred, DataFlow::Node succ
-where DataFlow::localFlowStep(pred, succ)
+where not pred.asExpr().fromLibrary() and DataFlow::localFlowStep(pred, succ)
 select pred, succ
diff --git a/csharp/ql/test/library-tests/dataflow/local/TaintTrackingStep.ql b/csharp/ql/test/library-tests/dataflow/local/TaintTrackingStep.ql
index 1866acfcda8..ffbdcd4dddf 100644
--- a/csharp/ql/test/library-tests/dataflow/local/TaintTrackingStep.ql
+++ b/csharp/ql/test/library-tests/dataflow/local/TaintTrackingStep.ql
@@ -1,5 +1,7 @@
 import csharp
 
 from DataFlow::Node pred, DataFlow::Node succ
-where TaintTracking::localTaintStep(pred, succ)
+where
+  not pred.asExpr().fromLibrary() and
+  TaintTracking::localTaintStep(pred, succ)
 select pred, succ
diff --git a/csharp/ql/test/library-tests/dataflow/modulusanalysis/ModulusAnalysis.ql b/csharp/ql/test/library-tests/dataflow/modulusanalysis/ModulusAnalysis.ql
index b07608ea009..02ffbc535ce 100644
--- a/csharp/ql/test/library-tests/dataflow/modulusanalysis/ModulusAnalysis.ql
+++ b/csharp/ql/test/library-tests/dataflow/modulusanalysis/ModulusAnalysis.ql
@@ -4,5 +4,7 @@ import semmle.code.csharp.dataflow.ModulusAnalysis
 import semmle.code.csharp.dataflow.Bound
 
 from ControlFlow::Nodes::ExprNode e, Bound b, int delta, int mod
-where exprModulus(e, b, delta, mod)
+where
+  not e.getExpr().fromLibrary() and
+  exprModulus(e, b, delta, mod)
 select e, b.toString(), delta, mod
diff --git a/csharp/ql/test/library-tests/dataflow/signanalysis/SignAnalysis.ql b/csharp/ql/test/library-tests/dataflow/signanalysis/SignAnalysis.ql
index 5427cdc631d..650d0f6bed4 100644
--- a/csharp/ql/test/library-tests/dataflow/signanalysis/SignAnalysis.ql
+++ b/csharp/ql/test/library-tests/dataflow/signanalysis/SignAnalysis.ql
@@ -18,4 +18,5 @@ string getASignString(ControlFlow::Nodes::ExprNode e) {
 }
 
 from ControlFlow::Nodes::ExprNode e
+where not e.getExpr().fromLibrary()
 select e, strictconcat(string s | s = getASignString(e) | s, " ")
diff --git a/csharp/ql/test/library-tests/dataflow/tuples/DataFlowStep.ql b/csharp/ql/test/library-tests/dataflow/tuples/DataFlowStep.ql
index f1fc98c459b..8f820cfea48 100644
--- a/csharp/ql/test/library-tests/dataflow/tuples/DataFlowStep.ql
+++ b/csharp/ql/test/library-tests/dataflow/tuples/DataFlowStep.ql
@@ -1,5 +1,5 @@
 import csharp
 
 from DataFlow::Node pred, DataFlow::Node succ
-where DataFlow::localFlowStep(pred, succ)
+where not pred.asExpr().fromLibrary() and DataFlow::localFlowStep(pred, succ)
 select pred, succ
diff --git a/csharp/ql/test/library-tests/dataflow/tuples/Tuples.expected b/csharp/ql/test/library-tests/dataflow/tuples/Tuples.expected
index 339c859a6ce..ae634781cd7 100644
--- a/csharp/ql/test/library-tests/dataflow/tuples/Tuples.expected
+++ b/csharp/ql/test/library-tests/dataflow/tuples/Tuples.expected
@@ -1,148 +1,148 @@
 edges
-| Tuples.cs:7:17:7:56 | (..., ...) [Item1] : String | Tuples.cs:8:9:8:23 | (..., ...) [Item1] : String |
-| Tuples.cs:7:17:7:56 | (..., ...) [Item1] : String | Tuples.cs:13:9:13:19 | (..., ...) [Item1] : String |
-| Tuples.cs:7:17:7:56 | (..., ...) [Item1] : String | Tuples.cs:18:9:18:22 | (..., ...) [Item1] : String |
-| Tuples.cs:7:17:7:56 | (..., ...) [Item1] : String | Tuples.cs:23:14:23:14 | access to local variable x [Item1] : String |
-| Tuples.cs:7:17:7:56 | (..., ...) [Item1] : String | Tuples.cs:24:14:24:14 | access to local variable x [Item1] : String |
-| Tuples.cs:7:17:7:56 | (..., ...) [Item2, Item2] : String | Tuples.cs:8:9:8:23 | (..., ...) [Item2, Item2] : String |
-| Tuples.cs:7:17:7:56 | (..., ...) [Item2, Item2] : String | Tuples.cs:13:9:13:19 | (..., ...) [Item2, Item2] : String |
-| Tuples.cs:7:17:7:56 | (..., ...) [Item2, Item2] : String | Tuples.cs:18:9:18:22 | (..., ...) [Item2, Item2] : String |
-| Tuples.cs:7:17:7:56 | (..., ...) [Item2, Item2] : String | Tuples.cs:26:14:26:14 | access to local variable x [Item2, Item2] : String |
-| Tuples.cs:7:21:7:34 | "taint source" : String | Tuples.cs:7:17:7:56 | (..., ...) [Item1] : String |
-| Tuples.cs:7:37:7:55 | (..., ...) [Item2] : String | Tuples.cs:7:17:7:56 | (..., ...) [Item2, Item2] : String |
-| Tuples.cs:7:41:7:54 | "taint source" : String | Tuples.cs:7:37:7:55 | (..., ...) [Item2] : String |
-| Tuples.cs:8:9:8:23 | (..., ...) [Item1] : String | Tuples.cs:8:9:8:27 | SSA def(a) : String |
-| Tuples.cs:8:9:8:23 | (..., ...) [Item2, Item2] : String | Tuples.cs:8:9:8:23 | (..., ...) [Item2] : String |
-| Tuples.cs:8:9:8:23 | (..., ...) [Item2] : String | Tuples.cs:8:9:8:27 | SSA def(c) : String |
+| Tuples.cs:7:17:7:56 | (..., ...) [field Item1] : String | Tuples.cs:8:9:8:23 | (..., ...) [field Item1] : String |
+| Tuples.cs:7:17:7:56 | (..., ...) [field Item1] : String | Tuples.cs:13:9:13:19 | (..., ...) [field Item1] : String |
+| Tuples.cs:7:17:7:56 | (..., ...) [field Item1] : String | Tuples.cs:18:9:18:22 | (..., ...) [field Item1] : String |
+| Tuples.cs:7:17:7:56 | (..., ...) [field Item1] : String | Tuples.cs:23:14:23:14 | access to local variable x [field Item1] : String |
+| Tuples.cs:7:17:7:56 | (..., ...) [field Item1] : String | Tuples.cs:24:14:24:14 | access to local variable x [field Item1] : String |
+| Tuples.cs:7:17:7:56 | (..., ...) [field Item2, field Item2] : String | Tuples.cs:8:9:8:23 | (..., ...) [field Item2, field Item2] : String |
+| Tuples.cs:7:17:7:56 | (..., ...) [field Item2, field Item2] : String | Tuples.cs:13:9:13:19 | (..., ...) [field Item2, field Item2] : String |
+| Tuples.cs:7:17:7:56 | (..., ...) [field Item2, field Item2] : String | Tuples.cs:18:9:18:22 | (..., ...) [field Item2, field Item2] : String |
+| Tuples.cs:7:17:7:56 | (..., ...) [field Item2, field Item2] : String | Tuples.cs:26:14:26:14 | access to local variable x [field Item2, field Item2] : String |
+| Tuples.cs:7:21:7:34 | "taint source" : String | Tuples.cs:7:17:7:56 | (..., ...) [field Item1] : String |
+| Tuples.cs:7:37:7:55 | (..., ...) [field Item2] : String | Tuples.cs:7:17:7:56 | (..., ...) [field Item2, field Item2] : String |
+| Tuples.cs:7:41:7:54 | "taint source" : String | Tuples.cs:7:37:7:55 | (..., ...) [field Item2] : String |
+| Tuples.cs:8:9:8:23 | (..., ...) [field Item1] : String | Tuples.cs:8:9:8:27 | SSA def(a) : String |
+| Tuples.cs:8:9:8:23 | (..., ...) [field Item2, field Item2] : String | Tuples.cs:8:9:8:23 | (..., ...) [field Item2] : String |
+| Tuples.cs:8:9:8:23 | (..., ...) [field Item2] : String | Tuples.cs:8:9:8:27 | SSA def(c) : String |
 | Tuples.cs:8:9:8:27 | SSA def(a) : String | Tuples.cs:9:14:9:14 | access to local variable a |
 | Tuples.cs:8:9:8:27 | SSA def(c) : String | Tuples.cs:11:14:11:14 | access to local variable c |
-| Tuples.cs:13:9:13:19 | (..., ...) [Item1] : String | Tuples.cs:13:9:13:23 | SSA def(a) : String |
-| Tuples.cs:13:9:13:19 | (..., ...) [Item2, Item2] : String | Tuples.cs:13:13:13:18 | (..., ...) [Item2] : String |
+| Tuples.cs:13:9:13:19 | (..., ...) [field Item1] : String | Tuples.cs:13:9:13:23 | SSA def(a) : String |
+| Tuples.cs:13:9:13:19 | (..., ...) [field Item2, field Item2] : String | Tuples.cs:13:13:13:18 | (..., ...) [field Item2] : String |
 | Tuples.cs:13:9:13:23 | SSA def(a) : String | Tuples.cs:14:14:14:14 | access to local variable a |
 | Tuples.cs:13:9:13:23 | SSA def(c) : String | Tuples.cs:16:14:16:14 | access to local variable c |
-| Tuples.cs:13:13:13:18 | (..., ...) [Item2] : String | Tuples.cs:13:9:13:23 | SSA def(c) : String |
-| Tuples.cs:18:9:18:22 | (..., ...) [Item1] : String | Tuples.cs:18:9:18:26 | SSA def(p) : String |
-| Tuples.cs:18:9:18:22 | (..., ...) [Item2, Item2] : String | Tuples.cs:18:9:18:26 | SSA def(q) [Item2] : String |
+| Tuples.cs:13:13:13:18 | (..., ...) [field Item2] : String | Tuples.cs:13:9:13:23 | SSA def(c) : String |
+| Tuples.cs:18:9:18:22 | (..., ...) [field Item1] : String | Tuples.cs:18:9:18:26 | SSA def(p) : String |
+| Tuples.cs:18:9:18:22 | (..., ...) [field Item2, field Item2] : String | Tuples.cs:18:9:18:26 | SSA def(q) [field Item2] : String |
 | Tuples.cs:18:9:18:26 | SSA def(p) : String | Tuples.cs:19:14:19:14 | access to local variable p |
-| Tuples.cs:18:9:18:26 | SSA def(q) [Item2] : String | Tuples.cs:21:14:21:14 | access to local variable q [Item2] : String |
-| Tuples.cs:21:14:21:14 | access to local variable q [Item2] : String | Tuples.cs:21:14:21:20 | access to field Item2 |
-| Tuples.cs:23:14:23:14 | access to local variable x [Item1] : String | Tuples.cs:23:14:23:20 | access to field Item1 |
-| Tuples.cs:24:14:24:14 | access to local variable x [Item1] : String | Tuples.cs:24:14:24:16 | access to field Item1 |
-| Tuples.cs:26:14:26:14 | access to local variable x [Item2, Item2] : String | Tuples.cs:26:14:26:20 | access to field Item2 [Item2] : String |
-| Tuples.cs:26:14:26:20 | access to field Item2 [Item2] : String | Tuples.cs:26:14:26:26 | access to field Item2 |
-| Tuples.cs:31:17:31:72 | (..., ...) [Item1] : String | Tuples.cs:32:14:32:14 | access to local variable x [Item1] : String |
-| Tuples.cs:31:17:31:72 | (..., ...) [Item10] : String | Tuples.cs:34:14:34:14 | access to local variable x [Item10] : String |
-| Tuples.cs:31:18:31:31 | "taint source" : String | Tuples.cs:31:17:31:72 | (..., ...) [Item1] : String |
-| Tuples.cs:31:58:31:71 | "taint source" : String | Tuples.cs:31:17:31:72 | (..., ...) [Item10] : String |
-| Tuples.cs:32:14:32:14 | access to local variable x [Item1] : String | Tuples.cs:32:14:32:20 | access to field Item1 |
-| Tuples.cs:34:14:34:14 | access to local variable x [Item10] : String | Tuples.cs:34:14:34:21 | access to field Item10 |
-| Tuples.cs:39:17:39:68 | (...) ... [Item1] : String | Tuples.cs:40:14:40:14 | access to local variable x [Item1] : String |
-| Tuples.cs:39:47:39:68 | (..., ...) [Item1] : String | Tuples.cs:39:17:39:68 | (...) ... [Item1] : String |
-| Tuples.cs:39:48:39:61 | "taint source" : String | Tuples.cs:39:47:39:68 | (..., ...) [Item1] : String |
-| Tuples.cs:40:14:40:14 | access to local variable x [Item1] : String | Tuples.cs:40:14:40:20 | access to field Item1 |
-| Tuples.cs:50:17:50:56 | (..., ...) [Item1] : String | Tuples.cs:53:18:53:57 | SSA def(t) [Item1] : String |
-| Tuples.cs:50:17:50:56 | (..., ...) [Item1] : String | Tuples.cs:58:18:58:35 | (..., ...) [Item1] : String |
-| Tuples.cs:50:17:50:56 | (..., ...) [Item1] : String | Tuples.cs:77:18:77:35 | (..., ...) [Item1] : String |
-| Tuples.cs:50:17:50:56 | (..., ...) [Item2, Item2] : String | Tuples.cs:53:18:53:57 | SSA def(t) [Item2, Item2] : String |
-| Tuples.cs:50:17:50:56 | (..., ...) [Item2, Item2] : String | Tuples.cs:58:18:58:35 | (..., ...) [Item2, Item2] : String |
-| Tuples.cs:50:17:50:56 | (..., ...) [Item2, Item2] : String | Tuples.cs:77:18:77:35 | (..., ...) [Item2, Item2] : String |
-| Tuples.cs:50:18:50:31 | "taint source" : String | Tuples.cs:50:17:50:56 | (..., ...) [Item1] : String |
-| Tuples.cs:50:34:50:52 | (..., ...) [Item2] : String | Tuples.cs:50:17:50:56 | (..., ...) [Item2, Item2] : String |
-| Tuples.cs:50:38:50:51 | "taint source" : String | Tuples.cs:50:34:50:52 | (..., ...) [Item2] : String |
-| Tuples.cs:53:18:53:57 | SSA def(t) [Item1] : String | Tuples.cs:54:22:54:22 | access to local variable t [Item1] : String |
-| Tuples.cs:53:18:53:57 | SSA def(t) [Item2, Item2] : String | Tuples.cs:55:22:55:22 | access to local variable t [Item2, Item2] : String |
-| Tuples.cs:54:22:54:22 | access to local variable t [Item1] : String | Tuples.cs:54:22:54:28 | access to field Item1 |
-| Tuples.cs:55:22:55:22 | access to local variable t [Item2, Item2] : String | Tuples.cs:55:22:55:28 | access to field Item2 [Item2] : String |
-| Tuples.cs:55:22:55:28 | access to field Item2 [Item2] : String | Tuples.cs:55:22:55:34 | access to field Item2 |
-| Tuples.cs:58:18:58:35 | (..., ...) [Item1] : String | Tuples.cs:58:23:58:23 | SSA def(a) : String |
-| Tuples.cs:58:18:58:35 | (..., ...) [Item2, Item2] : String | Tuples.cs:58:18:58:35 | (..., ...) [Item2] : String |
-| Tuples.cs:58:18:58:35 | (..., ...) [Item2] : String | Tuples.cs:58:30:58:30 | SSA def(c) : String |
+| Tuples.cs:18:9:18:26 | SSA def(q) [field Item2] : String | Tuples.cs:21:14:21:14 | access to local variable q [field Item2] : String |
+| Tuples.cs:21:14:21:14 | access to local variable q [field Item2] : String | Tuples.cs:21:14:21:20 | access to field Item2 |
+| Tuples.cs:23:14:23:14 | access to local variable x [field Item1] : String | Tuples.cs:23:14:23:20 | access to field Item1 |
+| Tuples.cs:24:14:24:14 | access to local variable x [field Item1] : String | Tuples.cs:24:14:24:16 | access to field Item1 |
+| Tuples.cs:26:14:26:14 | access to local variable x [field Item2, field Item2] : String | Tuples.cs:26:14:26:20 | access to field Item2 [field Item2] : String |
+| Tuples.cs:26:14:26:20 | access to field Item2 [field Item2] : String | Tuples.cs:26:14:26:26 | access to field Item2 |
+| Tuples.cs:31:17:31:72 | (..., ...) [field Item1] : String | Tuples.cs:32:14:32:14 | access to local variable x [field Item1] : String |
+| Tuples.cs:31:17:31:72 | (..., ...) [field Item10] : String | Tuples.cs:34:14:34:14 | access to local variable x [field Item10] : String |
+| Tuples.cs:31:18:31:31 | "taint source" : String | Tuples.cs:31:17:31:72 | (..., ...) [field Item1] : String |
+| Tuples.cs:31:58:31:71 | "taint source" : String | Tuples.cs:31:17:31:72 | (..., ...) [field Item10] : String |
+| Tuples.cs:32:14:32:14 | access to local variable x [field Item1] : String | Tuples.cs:32:14:32:20 | access to field Item1 |
+| Tuples.cs:34:14:34:14 | access to local variable x [field Item10] : String | Tuples.cs:34:14:34:21 | access to field Item10 |
+| Tuples.cs:39:17:39:68 | (...) ... [field Item1] : String | Tuples.cs:40:14:40:14 | access to local variable x [field Item1] : String |
+| Tuples.cs:39:47:39:68 | (..., ...) [field Item1] : String | Tuples.cs:39:17:39:68 | (...) ... [field Item1] : String |
+| Tuples.cs:39:48:39:61 | "taint source" : String | Tuples.cs:39:47:39:68 | (..., ...) [field Item1] : String |
+| Tuples.cs:40:14:40:14 | access to local variable x [field Item1] : String | Tuples.cs:40:14:40:20 | access to field Item1 |
+| Tuples.cs:50:17:50:56 | (..., ...) [field Item1] : String | Tuples.cs:53:18:53:57 | SSA def(t) [field Item1] : String |
+| Tuples.cs:50:17:50:56 | (..., ...) [field Item1] : String | Tuples.cs:58:18:58:35 | (..., ...) [field Item1] : String |
+| Tuples.cs:50:17:50:56 | (..., ...) [field Item1] : String | Tuples.cs:77:18:77:35 | (..., ...) [field Item1] : String |
+| Tuples.cs:50:17:50:56 | (..., ...) [field Item2, field Item2] : String | Tuples.cs:53:18:53:57 | SSA def(t) [field Item2, field Item2] : String |
+| Tuples.cs:50:17:50:56 | (..., ...) [field Item2, field Item2] : String | Tuples.cs:58:18:58:35 | (..., ...) [field Item2, field Item2] : String |
+| Tuples.cs:50:17:50:56 | (..., ...) [field Item2, field Item2] : String | Tuples.cs:77:18:77:35 | (..., ...) [field Item2, field Item2] : String |
+| Tuples.cs:50:18:50:31 | "taint source" : String | Tuples.cs:50:17:50:56 | (..., ...) [field Item1] : String |
+| Tuples.cs:50:34:50:52 | (..., ...) [field Item2] : String | Tuples.cs:50:17:50:56 | (..., ...) [field Item2, field Item2] : String |
+| Tuples.cs:50:38:50:51 | "taint source" : String | Tuples.cs:50:34:50:52 | (..., ...) [field Item2] : String |
+| Tuples.cs:53:18:53:57 | SSA def(t) [field Item1] : String | Tuples.cs:54:22:54:22 | access to local variable t [field Item1] : String |
+| Tuples.cs:53:18:53:57 | SSA def(t) [field Item2, field Item2] : String | Tuples.cs:55:22:55:22 | access to local variable t [field Item2, field Item2] : String |
+| Tuples.cs:54:22:54:22 | access to local variable t [field Item1] : String | Tuples.cs:54:22:54:28 | access to field Item1 |
+| Tuples.cs:55:22:55:22 | access to local variable t [field Item2, field Item2] : String | Tuples.cs:55:22:55:28 | access to field Item2 [field Item2] : String |
+| Tuples.cs:55:22:55:28 | access to field Item2 [field Item2] : String | Tuples.cs:55:22:55:34 | access to field Item2 |
+| Tuples.cs:58:18:58:35 | (..., ...) [field Item1] : String | Tuples.cs:58:23:58:23 | SSA def(a) : String |
+| Tuples.cs:58:18:58:35 | (..., ...) [field Item2, field Item2] : String | Tuples.cs:58:18:58:35 | (..., ...) [field Item2] : String |
+| Tuples.cs:58:18:58:35 | (..., ...) [field Item2] : String | Tuples.cs:58:30:58:30 | SSA def(c) : String |
 | Tuples.cs:58:23:58:23 | SSA def(a) : String | Tuples.cs:59:22:59:22 | access to local variable a |
 | Tuples.cs:58:30:58:30 | SSA def(c) : String | Tuples.cs:60:22:60:22 | access to local variable c |
-| Tuples.cs:77:18:77:35 | (..., ...) [Item1] : String | Tuples.cs:77:23:77:23 | SSA def(p) : String |
-| Tuples.cs:77:18:77:35 | (..., ...) [Item2, Item2] : String | Tuples.cs:77:18:77:35 | (..., ...) [Item2] : String |
-| Tuples.cs:77:18:77:35 | (..., ...) [Item2] : String | Tuples.cs:77:30:77:30 | SSA def(r) : String |
+| Tuples.cs:77:18:77:35 | (..., ...) [field Item1] : String | Tuples.cs:77:23:77:23 | SSA def(p) : String |
+| Tuples.cs:77:18:77:35 | (..., ...) [field Item2, field Item2] : String | Tuples.cs:77:18:77:35 | (..., ...) [field Item2] : String |
+| Tuples.cs:77:18:77:35 | (..., ...) [field Item2] : String | Tuples.cs:77:30:77:30 | SSA def(r) : String |
 | Tuples.cs:77:23:77:23 | SSA def(p) : String | Tuples.cs:79:18:79:18 | access to local variable p |
 | Tuples.cs:77:30:77:30 | SSA def(r) : String | Tuples.cs:80:18:80:18 | access to local variable r |
-| Tuples.cs:89:17:89:41 | object creation of type R1 [i] : String | Tuples.cs:90:14:90:14 | access to local variable r [i] : String |
-| Tuples.cs:89:24:89:37 | "taint source" : String | Tuples.cs:89:17:89:41 | object creation of type R1 [i] : String |
-| Tuples.cs:90:14:90:14 | access to local variable r [i] : String | Tuples.cs:90:14:90:16 | access to property i |
+| Tuples.cs:89:17:89:41 | object creation of type R1 [property i] : String | Tuples.cs:90:14:90:14 | access to local variable r [property i] : String |
+| Tuples.cs:89:24:89:37 | "taint source" : String | Tuples.cs:89:17:89:41 | object creation of type R1 [property i] : String |
+| Tuples.cs:90:14:90:14 | access to local variable r [property i] : String | Tuples.cs:90:14:90:16 | access to property i |
 nodes
-| Tuples.cs:7:17:7:56 | (..., ...) [Item1] : String | semmle.label | (..., ...) [Item1] : String |
-| Tuples.cs:7:17:7:56 | (..., ...) [Item2, Item2] : String | semmle.label | (..., ...) [Item2, Item2] : String |
+| Tuples.cs:7:17:7:56 | (..., ...) [field Item1] : String | semmle.label | (..., ...) [field Item1] : String |
+| Tuples.cs:7:17:7:56 | (..., ...) [field Item2, field Item2] : String | semmle.label | (..., ...) [field Item2, field Item2] : String |
 | Tuples.cs:7:21:7:34 | "taint source" : String | semmle.label | "taint source" : String |
-| Tuples.cs:7:37:7:55 | (..., ...) [Item2] : String | semmle.label | (..., ...) [Item2] : String |
+| Tuples.cs:7:37:7:55 | (..., ...) [field Item2] : String | semmle.label | (..., ...) [field Item2] : String |
 | Tuples.cs:7:41:7:54 | "taint source" : String | semmle.label | "taint source" : String |
-| Tuples.cs:8:9:8:23 | (..., ...) [Item1] : String | semmle.label | (..., ...) [Item1] : String |
-| Tuples.cs:8:9:8:23 | (..., ...) [Item2, Item2] : String | semmle.label | (..., ...) [Item2, Item2] : String |
-| Tuples.cs:8:9:8:23 | (..., ...) [Item2] : String | semmle.label | (..., ...) [Item2] : String |
+| Tuples.cs:8:9:8:23 | (..., ...) [field Item1] : String | semmle.label | (..., ...) [field Item1] : String |
+| Tuples.cs:8:9:8:23 | (..., ...) [field Item2, field Item2] : String | semmle.label | (..., ...) [field Item2, field Item2] : String |
+| Tuples.cs:8:9:8:23 | (..., ...) [field Item2] : String | semmle.label | (..., ...) [field Item2] : String |
 | Tuples.cs:8:9:8:27 | SSA def(a) : String | semmle.label | SSA def(a) : String |
 | Tuples.cs:8:9:8:27 | SSA def(c) : String | semmle.label | SSA def(c) : String |
 | Tuples.cs:9:14:9:14 | access to local variable a | semmle.label | access to local variable a |
 | Tuples.cs:11:14:11:14 | access to local variable c | semmle.label | access to local variable c |
-| Tuples.cs:13:9:13:19 | (..., ...) [Item1] : String | semmle.label | (..., ...) [Item1] : String |
-| Tuples.cs:13:9:13:19 | (..., ...) [Item2, Item2] : String | semmle.label | (..., ...) [Item2, Item2] : String |
+| Tuples.cs:13:9:13:19 | (..., ...) [field Item1] : String | semmle.label | (..., ...) [field Item1] : String |
+| Tuples.cs:13:9:13:19 | (..., ...) [field Item2, field Item2] : String | semmle.label | (..., ...) [field Item2, field Item2] : String |
 | Tuples.cs:13:9:13:23 | SSA def(a) : String | semmle.label | SSA def(a) : String |
 | Tuples.cs:13:9:13:23 | SSA def(c) : String | semmle.label | SSA def(c) : String |
-| Tuples.cs:13:13:13:18 | (..., ...) [Item2] : String | semmle.label | (..., ...) [Item2] : String |
+| Tuples.cs:13:13:13:18 | (..., ...) [field Item2] : String | semmle.label | (..., ...) [field Item2] : String |
 | Tuples.cs:14:14:14:14 | access to local variable a | semmle.label | access to local variable a |
 | Tuples.cs:16:14:16:14 | access to local variable c | semmle.label | access to local variable c |
-| Tuples.cs:18:9:18:22 | (..., ...) [Item1] : String | semmle.label | (..., ...) [Item1] : String |
-| Tuples.cs:18:9:18:22 | (..., ...) [Item2, Item2] : String | semmle.label | (..., ...) [Item2, Item2] : String |
+| Tuples.cs:18:9:18:22 | (..., ...) [field Item1] : String | semmle.label | (..., ...) [field Item1] : String |
+| Tuples.cs:18:9:18:22 | (..., ...) [field Item2, field Item2] : String | semmle.label | (..., ...) [field Item2, field Item2] : String |
 | Tuples.cs:18:9:18:26 | SSA def(p) : String | semmle.label | SSA def(p) : String |
-| Tuples.cs:18:9:18:26 | SSA def(q) [Item2] : String | semmle.label | SSA def(q) [Item2] : String |
+| Tuples.cs:18:9:18:26 | SSA def(q) [field Item2] : String | semmle.label | SSA def(q) [field Item2] : String |
 | Tuples.cs:19:14:19:14 | access to local variable p | semmle.label | access to local variable p |
-| Tuples.cs:21:14:21:14 | access to local variable q [Item2] : String | semmle.label | access to local variable q [Item2] : String |
+| Tuples.cs:21:14:21:14 | access to local variable q [field Item2] : String | semmle.label | access to local variable q [field Item2] : String |
 | Tuples.cs:21:14:21:20 | access to field Item2 | semmle.label | access to field Item2 |
-| Tuples.cs:23:14:23:14 | access to local variable x [Item1] : String | semmle.label | access to local variable x [Item1] : String |
+| Tuples.cs:23:14:23:14 | access to local variable x [field Item1] : String | semmle.label | access to local variable x [field Item1] : String |
 | Tuples.cs:23:14:23:20 | access to field Item1 | semmle.label | access to field Item1 |
-| Tuples.cs:24:14:24:14 | access to local variable x [Item1] : String | semmle.label | access to local variable x [Item1] : String |
+| Tuples.cs:24:14:24:14 | access to local variable x [field Item1] : String | semmle.label | access to local variable x [field Item1] : String |
 | Tuples.cs:24:14:24:16 | access to field Item1 | semmle.label | access to field Item1 |
-| Tuples.cs:26:14:26:14 | access to local variable x [Item2, Item2] : String | semmle.label | access to local variable x [Item2, Item2] : String |
-| Tuples.cs:26:14:26:20 | access to field Item2 [Item2] : String | semmle.label | access to field Item2 [Item2] : String |
+| Tuples.cs:26:14:26:14 | access to local variable x [field Item2, field Item2] : String | semmle.label | access to local variable x [field Item2, field Item2] : String |
+| Tuples.cs:26:14:26:20 | access to field Item2 [field Item2] : String | semmle.label | access to field Item2 [field Item2] : String |
 | Tuples.cs:26:14:26:26 | access to field Item2 | semmle.label | access to field Item2 |
-| Tuples.cs:31:17:31:72 | (..., ...) [Item1] : String | semmle.label | (..., ...) [Item1] : String |
-| Tuples.cs:31:17:31:72 | (..., ...) [Item10] : String | semmle.label | (..., ...) [Item10] : String |
+| Tuples.cs:31:17:31:72 | (..., ...) [field Item1] : String | semmle.label | (..., ...) [field Item1] : String |
+| Tuples.cs:31:17:31:72 | (..., ...) [field Item10] : String | semmle.label | (..., ...) [field Item10] : String |
 | Tuples.cs:31:18:31:31 | "taint source" : String | semmle.label | "taint source" : String |
 | Tuples.cs:31:58:31:71 | "taint source" : String | semmle.label | "taint source" : String |
-| Tuples.cs:32:14:32:14 | access to local variable x [Item1] : String | semmle.label | access to local variable x [Item1] : String |
+| Tuples.cs:32:14:32:14 | access to local variable x [field Item1] : String | semmle.label | access to local variable x [field Item1] : String |
 | Tuples.cs:32:14:32:20 | access to field Item1 | semmle.label | access to field Item1 |
-| Tuples.cs:34:14:34:14 | access to local variable x [Item10] : String | semmle.label | access to local variable x [Item10] : String |
+| Tuples.cs:34:14:34:14 | access to local variable x [field Item10] : String | semmle.label | access to local variable x [field Item10] : String |
 | Tuples.cs:34:14:34:21 | access to field Item10 | semmle.label | access to field Item10 |
-| Tuples.cs:39:17:39:68 | (...) ... [Item1] : String | semmle.label | (...) ... [Item1] : String |
-| Tuples.cs:39:47:39:68 | (..., ...) [Item1] : String | semmle.label | (..., ...) [Item1] : String |
+| Tuples.cs:39:17:39:68 | (...) ... [field Item1] : String | semmle.label | (...) ... [field Item1] : String |
+| Tuples.cs:39:47:39:68 | (..., ...) [field Item1] : String | semmle.label | (..., ...) [field Item1] : String |
 | Tuples.cs:39:48:39:61 | "taint source" : String | semmle.label | "taint source" : String |
-| Tuples.cs:40:14:40:14 | access to local variable x [Item1] : String | semmle.label | access to local variable x [Item1] : String |
+| Tuples.cs:40:14:40:14 | access to local variable x [field Item1] : String | semmle.label | access to local variable x [field Item1] : String |
 | Tuples.cs:40:14:40:20 | access to field Item1 | semmle.label | access to field Item1 |
-| Tuples.cs:50:17:50:56 | (..., ...) [Item1] : String | semmle.label | (..., ...) [Item1] : String |
-| Tuples.cs:50:17:50:56 | (..., ...) [Item2, Item2] : String | semmle.label | (..., ...) [Item2, Item2] : String |
+| Tuples.cs:50:17:50:56 | (..., ...) [field Item1] : String | semmle.label | (..., ...) [field Item1] : String |
+| Tuples.cs:50:17:50:56 | (..., ...) [field Item2, field Item2] : String | semmle.label | (..., ...) [field Item2, field Item2] : String |
 | Tuples.cs:50:18:50:31 | "taint source" : String | semmle.label | "taint source" : String |
-| Tuples.cs:50:34:50:52 | (..., ...) [Item2] : String | semmle.label | (..., ...) [Item2] : String |
+| Tuples.cs:50:34:50:52 | (..., ...) [field Item2] : String | semmle.label | (..., ...) [field Item2] : String |
 | Tuples.cs:50:38:50:51 | "taint source" : String | semmle.label | "taint source" : String |
-| Tuples.cs:53:18:53:57 | SSA def(t) [Item1] : String | semmle.label | SSA def(t) [Item1] : String |
-| Tuples.cs:53:18:53:57 | SSA def(t) [Item2, Item2] : String | semmle.label | SSA def(t) [Item2, Item2] : String |
-| Tuples.cs:54:22:54:22 | access to local variable t [Item1] : String | semmle.label | access to local variable t [Item1] : String |
+| Tuples.cs:53:18:53:57 | SSA def(t) [field Item1] : String | semmle.label | SSA def(t) [field Item1] : String |
+| Tuples.cs:53:18:53:57 | SSA def(t) [field Item2, field Item2] : String | semmle.label | SSA def(t) [field Item2, field Item2] : String |
+| Tuples.cs:54:22:54:22 | access to local variable t [field Item1] : String | semmle.label | access to local variable t [field Item1] : String |
 | Tuples.cs:54:22:54:28 | access to field Item1 | semmle.label | access to field Item1 |
-| Tuples.cs:55:22:55:22 | access to local variable t [Item2, Item2] : String | semmle.label | access to local variable t [Item2, Item2] : String |
-| Tuples.cs:55:22:55:28 | access to field Item2 [Item2] : String | semmle.label | access to field Item2 [Item2] : String |
+| Tuples.cs:55:22:55:22 | access to local variable t [field Item2, field Item2] : String | semmle.label | access to local variable t [field Item2, field Item2] : String |
+| Tuples.cs:55:22:55:28 | access to field Item2 [field Item2] : String | semmle.label | access to field Item2 [field Item2] : String |
 | Tuples.cs:55:22:55:34 | access to field Item2 | semmle.label | access to field Item2 |
-| Tuples.cs:58:18:58:35 | (..., ...) [Item1] : String | semmle.label | (..., ...) [Item1] : String |
-| Tuples.cs:58:18:58:35 | (..., ...) [Item2, Item2] : String | semmle.label | (..., ...) [Item2, Item2] : String |
-| Tuples.cs:58:18:58:35 | (..., ...) [Item2] : String | semmle.label | (..., ...) [Item2] : String |
+| Tuples.cs:58:18:58:35 | (..., ...) [field Item1] : String | semmle.label | (..., ...) [field Item1] : String |
+| Tuples.cs:58:18:58:35 | (..., ...) [field Item2, field Item2] : String | semmle.label | (..., ...) [field Item2, field Item2] : String |
+| Tuples.cs:58:18:58:35 | (..., ...) [field Item2] : String | semmle.label | (..., ...) [field Item2] : String |
 | Tuples.cs:58:23:58:23 | SSA def(a) : String | semmle.label | SSA def(a) : String |
 | Tuples.cs:58:30:58:30 | SSA def(c) : String | semmle.label | SSA def(c) : String |
 | Tuples.cs:59:22:59:22 | access to local variable a | semmle.label | access to local variable a |
 | Tuples.cs:60:22:60:22 | access to local variable c | semmle.label | access to local variable c |
-| Tuples.cs:77:18:77:35 | (..., ...) [Item1] : String | semmle.label | (..., ...) [Item1] : String |
-| Tuples.cs:77:18:77:35 | (..., ...) [Item2, Item2] : String | semmle.label | (..., ...) [Item2, Item2] : String |
-| Tuples.cs:77:18:77:35 | (..., ...) [Item2] : String | semmle.label | (..., ...) [Item2] : String |
+| Tuples.cs:77:18:77:35 | (..., ...) [field Item1] : String | semmle.label | (..., ...) [field Item1] : String |
+| Tuples.cs:77:18:77:35 | (..., ...) [field Item2, field Item2] : String | semmle.label | (..., ...) [field Item2, field Item2] : String |
+| Tuples.cs:77:18:77:35 | (..., ...) [field Item2] : String | semmle.label | (..., ...) [field Item2] : String |
 | Tuples.cs:77:23:77:23 | SSA def(p) : String | semmle.label | SSA def(p) : String |
 | Tuples.cs:77:30:77:30 | SSA def(r) : String | semmle.label | SSA def(r) : String |
 | Tuples.cs:79:18:79:18 | access to local variable p | semmle.label | access to local variable p |
 | Tuples.cs:80:18:80:18 | access to local variable r | semmle.label | access to local variable r |
-| Tuples.cs:89:17:89:41 | object creation of type R1 [i] : String | semmle.label | object creation of type R1 [i] : String |
+| Tuples.cs:89:17:89:41 | object creation of type R1 [property i] : String | semmle.label | object creation of type R1 [property i] : String |
 | Tuples.cs:89:24:89:37 | "taint source" : String | semmle.label | "taint source" : String |
-| Tuples.cs:90:14:90:14 | access to local variable r [i] : String | semmle.label | access to local variable r [i] : String |
+| Tuples.cs:90:14:90:14 | access to local variable r [property i] : String | semmle.label | access to local variable r [property i] : String |
 | Tuples.cs:90:14:90:16 | access to property i | semmle.label | access to property i |
 #select
 | Tuples.cs:7:21:7:34 | "taint source" : String | Tuples.cs:7:21:7:34 | "taint source" : String | Tuples.cs:9:14:9:14 | access to local variable a | $@ | Tuples.cs:9:14:9:14 | access to local variable a | access to local variable a |
diff --git a/csharp/ql/test/library-tests/dataflow/types/Types.expected b/csharp/ql/test/library-tests/dataflow/types/Types.expected
index 43b06fb7cba..93be8ab587a 100644
--- a/csharp/ql/test/library-tests/dataflow/types/Types.expected
+++ b/csharp/ql/test/library-tests/dataflow/types/Types.expected
@@ -33,23 +33,23 @@ edges
 | Types.cs:77:22:77:22 | a : C | Types.cs:79:18:79:25 | SSA def(b) : C |
 | Types.cs:79:18:79:25 | SSA def(b) : C | Types.cs:80:18:80:18 | access to local variable b |
 | Types.cs:90:22:90:22 | e : Types.E<D>.E2 | Types.cs:92:26:92:26 | access to parameter e : Types.E<D>.E2 |
-| Types.cs:92:13:92:16 | [post] this access [Field] : Types.E<D>.E2 | Types.cs:93:13:93:16 | this access [Field] : Types.E<D>.E2 |
-| Types.cs:92:26:92:26 | access to parameter e : Types.E<D>.E2 | Types.cs:92:13:92:16 | [post] this access [Field] : Types.E<D>.E2 |
-| Types.cs:93:13:93:16 | this access [Field] : Types.E<D>.E2 | Types.cs:113:34:113:34 | this [Field] : Types.E<D>.E2 |
+| Types.cs:92:13:92:16 | [post] this access [field Field] : Types.E<D>.E2 | Types.cs:93:13:93:16 | this access [field Field] : Types.E<D>.E2 |
+| Types.cs:92:26:92:26 | access to parameter e : Types.E<D>.E2 | Types.cs:92:13:92:16 | [post] this access [field Field] : Types.E<D>.E2 |
+| Types.cs:93:13:93:16 | this access [field Field] : Types.E<D>.E2 | Types.cs:113:34:113:34 | this [field Field] : Types.E<D>.E2 |
 | Types.cs:110:25:110:32 | object creation of type E2 : Types.E<D>.E2 | Types.cs:90:22:90:22 | e : Types.E<D>.E2 |
-| Types.cs:113:34:113:34 | this [Field] : Types.E<D>.E2 | Types.cs:115:22:115:25 | this access [Field] : Types.E<D>.E2 |
-| Types.cs:115:22:115:25 | this access [Field] : Types.E<D>.E2 | Types.cs:115:22:115:31 | access to field Field |
+| Types.cs:113:34:113:34 | this [field Field] : Types.E<D>.E2 | Types.cs:115:22:115:25 | this access [field Field] : Types.E<D>.E2 |
+| Types.cs:115:22:115:25 | this access [field Field] : Types.E<D>.E2 | Types.cs:115:22:115:31 | access to field Field |
 | Types.cs:120:25:120:31 | object creation of type A : A | Types.cs:122:30:122:30 | access to local variable a : A |
 | Types.cs:121:26:121:33 | object creation of type E2 : Types.E<D>.E2 | Types.cs:123:30:123:31 | access to local variable e2 : Types.E<D>.E2 |
 | Types.cs:122:30:122:30 | access to local variable a : A | Types.cs:122:22:122:31 | call to method Through |
 | Types.cs:123:30:123:31 | access to local variable e2 : Types.E<D>.E2 | Types.cs:123:22:123:32 | call to method Through |
-| Types.cs:138:21:138:25 | this [Field] : Object | Types.cs:138:32:138:35 | this access [Field] : Object |
-| Types.cs:138:32:138:35 | this access [Field] : Object | Types.cs:153:30:153:30 | this [Field] : Object |
-| Types.cs:144:13:144:13 | [post] access to parameter c [Field] : Object | Types.cs:145:13:145:13 | access to parameter c [Field] : Object |
-| Types.cs:144:23:144:34 | object creation of type Object : Object | Types.cs:144:13:144:13 | [post] access to parameter c [Field] : Object |
-| Types.cs:145:13:145:13 | access to parameter c [Field] : Object | Types.cs:138:21:138:25 | this [Field] : Object |
-| Types.cs:153:30:153:30 | this [Field] : Object | Types.cs:153:42:153:45 | this access [Field] : Object |
-| Types.cs:153:42:153:45 | this access [Field] : Object | Types.cs:153:42:153:51 | access to field Field |
+| Types.cs:138:21:138:25 | this [field Field] : Object | Types.cs:138:32:138:35 | this access [field Field] : Object |
+| Types.cs:138:32:138:35 | this access [field Field] : Object | Types.cs:153:30:153:30 | this [field Field] : Object |
+| Types.cs:144:13:144:13 | [post] access to parameter c [field Field] : Object | Types.cs:145:13:145:13 | access to parameter c [field Field] : Object |
+| Types.cs:144:23:144:34 | object creation of type Object : Object | Types.cs:144:13:144:13 | [post] access to parameter c [field Field] : Object |
+| Types.cs:145:13:145:13 | access to parameter c [field Field] : Object | Types.cs:138:21:138:25 | this [field Field] : Object |
+| Types.cs:153:30:153:30 | this [field Field] : Object | Types.cs:153:42:153:45 | this access [field Field] : Object |
+| Types.cs:153:42:153:45 | this access [field Field] : Object | Types.cs:153:42:153:51 | access to field Field |
 nodes
 | Types.cs:7:21:7:25 | this : D | semmle.label | this : D |
 | Types.cs:7:32:7:35 | this access : D | semmle.label | this access : D |
@@ -94,12 +94,12 @@ nodes
 | Types.cs:79:18:79:25 | SSA def(b) : C | semmle.label | SSA def(b) : C |
 | Types.cs:80:18:80:18 | access to local variable b | semmle.label | access to local variable b |
 | Types.cs:90:22:90:22 | e : Types.E<D>.E2 | semmle.label | e : Types.E<D>.E2 |
-| Types.cs:92:13:92:16 | [post] this access [Field] : Types.E<D>.E2 | semmle.label | [post] this access [Field] : Types.E<D>.E2 |
+| Types.cs:92:13:92:16 | [post] this access [field Field] : Types.E<D>.E2 | semmle.label | [post] this access [field Field] : Types.E<D>.E2 |
 | Types.cs:92:26:92:26 | access to parameter e : Types.E<D>.E2 | semmle.label | access to parameter e : Types.E<D>.E2 |
-| Types.cs:93:13:93:16 | this access [Field] : Types.E<D>.E2 | semmle.label | this access [Field] : Types.E<D>.E2 |
+| Types.cs:93:13:93:16 | this access [field Field] : Types.E<D>.E2 | semmle.label | this access [field Field] : Types.E<D>.E2 |
 | Types.cs:110:25:110:32 | object creation of type E2 : Types.E<D>.E2 | semmle.label | object creation of type E2 : Types.E<D>.E2 |
-| Types.cs:113:34:113:34 | this [Field] : Types.E<D>.E2 | semmle.label | this [Field] : Types.E<D>.E2 |
-| Types.cs:115:22:115:25 | this access [Field] : Types.E<D>.E2 | semmle.label | this access [Field] : Types.E<D>.E2 |
+| Types.cs:113:34:113:34 | this [field Field] : Types.E<D>.E2 | semmle.label | this [field Field] : Types.E<D>.E2 |
+| Types.cs:115:22:115:25 | this access [field Field] : Types.E<D>.E2 | semmle.label | this access [field Field] : Types.E<D>.E2 |
 | Types.cs:115:22:115:31 | access to field Field | semmle.label | access to field Field |
 | Types.cs:120:25:120:31 | object creation of type A : A | semmle.label | object creation of type A : A |
 | Types.cs:121:26:121:33 | object creation of type E2 : Types.E<D>.E2 | semmle.label | object creation of type E2 : Types.E<D>.E2 |
@@ -107,13 +107,13 @@ nodes
 | Types.cs:122:30:122:30 | access to local variable a : A | semmle.label | access to local variable a : A |
 | Types.cs:123:22:123:32 | call to method Through | semmle.label | call to method Through |
 | Types.cs:123:30:123:31 | access to local variable e2 : Types.E<D>.E2 | semmle.label | access to local variable e2 : Types.E<D>.E2 |
-| Types.cs:138:21:138:25 | this [Field] : Object | semmle.label | this [Field] : Object |
-| Types.cs:138:32:138:35 | this access [Field] : Object | semmle.label | this access [Field] : Object |
-| Types.cs:144:13:144:13 | [post] access to parameter c [Field] : Object | semmle.label | [post] access to parameter c [Field] : Object |
+| Types.cs:138:21:138:25 | this [field Field] : Object | semmle.label | this [field Field] : Object |
+| Types.cs:138:32:138:35 | this access [field Field] : Object | semmle.label | this access [field Field] : Object |
+| Types.cs:144:13:144:13 | [post] access to parameter c [field Field] : Object | semmle.label | [post] access to parameter c [field Field] : Object |
 | Types.cs:144:23:144:34 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
-| Types.cs:145:13:145:13 | access to parameter c [Field] : Object | semmle.label | access to parameter c [Field] : Object |
-| Types.cs:153:30:153:30 | this [Field] : Object | semmle.label | this [Field] : Object |
-| Types.cs:153:42:153:45 | this access [Field] : Object | semmle.label | this access [Field] : Object |
+| Types.cs:145:13:145:13 | access to parameter c [field Field] : Object | semmle.label | access to parameter c [field Field] : Object |
+| Types.cs:153:30:153:30 | this [field Field] : Object | semmle.label | this [field Field] : Object |
+| Types.cs:153:42:153:45 | this access [field Field] : Object | semmle.label | this access [field Field] : Object |
 | Types.cs:153:42:153:51 | access to field Field | semmle.label | access to field Field |
 #select
 | Types.cs:23:12:23:18 | object creation of type C : C | Types.cs:23:12:23:18 | object creation of type C : C | Types.cs:50:18:50:18 | access to local variable c | $@ | Types.cs:50:18:50:18 | access to local variable c | access to local variable c |
diff --git a/csharp/ql/test/library-tests/exprorstmtparent/Parameter.ql b/csharp/ql/test/library-tests/exprorstmtparent/Parameter.ql
index 3c12d5b870f..33f6eeb2b9d 100644
--- a/csharp/ql/test/library-tests/exprorstmtparent/Parameter.ql
+++ b/csharp/ql/test/library-tests/exprorstmtparent/Parameter.ql
@@ -1,4 +1,5 @@
 import csharp
 
 from Parameter p
+where p.fromSource()
 select p, p.getDefaultValue()
diff --git a/csharp/ql/test/library-tests/frameworks/EntityFramework/Dataflow.expected b/csharp/ql/test/library-tests/frameworks/EntityFramework/Dataflow.expected
index 7d0bd289f9c..d58177238b5 100644
--- a/csharp/ql/test/library-tests/frameworks/EntityFramework/Dataflow.expected
+++ b/csharp/ql/test/library-tests/frameworks/EntityFramework/Dataflow.expected
@@ -1,97 +1,97 @@
 edges
-| ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [Addresses, [], Street] : String | EntityFramework.cs:214:18:214:30 | access to property Addresses [[], Street] : String |
-| ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [Addresses, [], Street] : String | EntityFramework.cs:221:18:221:28 | access to property Persons [[], Addresses, [], Street] : String |
-| ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [PersonAddresses, [], Address, Street] : String | EntityFramework.cs:214:18:214:30 | access to property Addresses [[], Street] : String |
-| ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [PersonAddresses, [], Address, Street] : String | EntityFramework.cs:221:18:221:28 | access to property Persons [[], Addresses, [], Street] : String |
-| ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [PersonAddresses, [], Person, Name] : String | EntityFramework.cs:206:18:206:28 | access to property Persons [[], Name] : String |
-| ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [Persons, [], Addresses, [], Street] : String | EntityFramework.cs:214:18:214:30 | access to property Addresses [[], Street] : String |
-| ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [Persons, [], Addresses, [], Street] : String | EntityFramework.cs:221:18:221:28 | access to property Persons [[], Addresses, [], Street] : String |
-| ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [Persons, [], Name] : String | EntityFramework.cs:206:18:206:28 | access to property Persons [[], Name] : String |
-| ../../../resources/stubs/EntityFramework.cs:41:49:41:64 | this [Persons, [], Name] : String | EntityFramework.cs:206:18:206:28 | access to property Persons [[], Name] : String |
-| ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [Addresses, [], Street] : String | EntityFrameworkCore.cs:238:18:238:30 | access to property Addresses [[], Street] : String |
-| ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [Addresses, [], Street] : String | EntityFrameworkCore.cs:245:18:245:28 | access to property Persons [[], Addresses, [], Street] : String |
-| ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [PersonAddresses, [], Address, Street] : String | EntityFrameworkCore.cs:238:18:238:30 | access to property Addresses [[], Street] : String |
-| ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [PersonAddresses, [], Address, Street] : String | EntityFrameworkCore.cs:245:18:245:28 | access to property Persons [[], Addresses, [], Street] : String |
-| ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [PersonAddresses, [], Person, Name] : String | EntityFrameworkCore.cs:230:18:230:28 | access to property Persons [[], Name] : String |
-| ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [Persons, [], Addresses, [], Street] : String | EntityFrameworkCore.cs:238:18:238:30 | access to property Addresses [[], Street] : String |
-| ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [Persons, [], Addresses, [], Street] : String | EntityFrameworkCore.cs:245:18:245:28 | access to property Persons [[], Addresses, [], Street] : String |
-| ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [Persons, [], Name] : String | EntityFrameworkCore.cs:230:18:230:28 | access to property Persons [[], Name] : String |
-| ../../../resources/stubs/EntityFramework.cs:81:49:81:64 | this [Persons, [], Name] : String | EntityFrameworkCore.cs:230:18:230:28 | access to property Persons [[], Name] : String |
-| EntityFramework.cs:61:13:64:13 | { ..., ... } [Name] : String | EntityFramework.cs:68:29:68:30 | access to local variable p1 [Name] : String |
-| EntityFramework.cs:63:24:63:32 | "tainted" : String | EntityFramework.cs:61:13:64:13 | { ..., ... } [Name] : String |
-| EntityFramework.cs:68:13:68:15 | [post] access to local variable ctx [Persons, [], Name] : String | EntityFramework.cs:70:13:70:15 | access to local variable ctx [Persons, [], Name] : String |
-| EntityFramework.cs:68:13:68:23 | [post] access to property Persons [[], Name] : String | EntityFramework.cs:68:13:68:15 | [post] access to local variable ctx [Persons, [], Name] : String |
-| EntityFramework.cs:68:29:68:30 | access to local variable p1 [Name] : String | EntityFramework.cs:68:13:68:23 | [post] access to property Persons [[], Name] : String |
-| EntityFramework.cs:70:13:70:15 | access to local variable ctx [Persons, [], Name] : String | ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [Persons, [], Name] : String |
-| EntityFramework.cs:83:13:86:13 | { ..., ... } [Name] : String | EntityFramework.cs:90:29:90:30 | access to local variable p1 [Name] : String |
-| EntityFramework.cs:85:24:85:32 | "tainted" : String | EntityFramework.cs:83:13:86:13 | { ..., ... } [Name] : String |
-| EntityFramework.cs:90:13:90:15 | [post] access to local variable ctx [Persons, [], Name] : String | EntityFramework.cs:92:19:92:21 | access to local variable ctx [Persons, [], Name] : String |
-| EntityFramework.cs:90:13:90:23 | [post] access to property Persons [[], Name] : String | EntityFramework.cs:90:13:90:15 | [post] access to local variable ctx [Persons, [], Name] : String |
-| EntityFramework.cs:90:29:90:30 | access to local variable p1 [Name] : String | EntityFramework.cs:90:13:90:23 | [post] access to property Persons [[], Name] : String |
-| EntityFramework.cs:92:19:92:21 | access to local variable ctx [Persons, [], Name] : String | ../../../resources/stubs/EntityFramework.cs:41:49:41:64 | this [Persons, [], Name] : String |
-| EntityFramework.cs:105:13:108:13 | { ..., ... } [Name] : String | EntityFramework.cs:111:27:111:28 | access to local variable p1 [Name] : String |
-| EntityFramework.cs:107:24:107:32 | "tainted" : String | EntityFramework.cs:105:13:108:13 | { ..., ... } [Name] : String |
-| EntityFramework.cs:111:27:111:28 | access to local variable p1 [Name] : String | EntityFramework.cs:195:35:195:35 | p [Name] : String |
-| EntityFramework.cs:124:13:127:13 | { ..., ... } [Title] : String | EntityFramework.cs:131:18:131:19 | access to local variable p1 [Title] : String |
-| EntityFramework.cs:126:25:126:33 | "tainted" : String | EntityFramework.cs:124:13:127:13 | { ..., ... } [Title] : String |
-| EntityFramework.cs:131:18:131:19 | access to local variable p1 [Title] : String | EntityFramework.cs:131:18:131:25 | access to property Title |
-| EntityFramework.cs:143:13:150:13 | { ..., ... } [Addresses, [], Street] : String | EntityFramework.cs:151:29:151:30 | access to local variable p1 [Addresses, [], Street] : String |
-| EntityFramework.cs:144:29:149:17 | array creation of type Address[] [[], Street] : String | EntityFramework.cs:143:13:150:13 | { ..., ... } [Addresses, [], Street] : String |
-| EntityFramework.cs:144:35:149:17 | { ..., ... } [[], Street] : String | EntityFramework.cs:144:29:149:17 | array creation of type Address[] [[], Street] : String |
-| EntityFramework.cs:145:21:148:21 | object creation of type Address [Street] : String | EntityFramework.cs:144:35:149:17 | { ..., ... } [[], Street] : String |
-| EntityFramework.cs:145:33:148:21 | { ..., ... } [Street] : String | EntityFramework.cs:145:21:148:21 | object creation of type Address [Street] : String |
-| EntityFramework.cs:147:34:147:42 | "tainted" : String | EntityFramework.cs:145:33:148:21 | { ..., ... } [Street] : String |
-| EntityFramework.cs:151:13:151:15 | [post] access to local variable ctx [Persons, [], Addresses, [], Street] : String | EntityFramework.cs:152:13:152:15 | access to local variable ctx [Persons, [], Addresses, [], Street] : String |
-| EntityFramework.cs:151:13:151:15 | [post] access to local variable ctx [Persons, [], Addresses, [], Street] : String | EntityFramework.cs:156:13:156:15 | access to local variable ctx [Persons, [], Addresses, [], Street] : String |
-| EntityFramework.cs:151:13:151:15 | [post] access to local variable ctx [Persons, [], Addresses, [], Street] : String | EntityFramework.cs:164:13:164:15 | access to local variable ctx [Persons, [], Addresses, [], Street] : String |
-| EntityFramework.cs:151:13:151:15 | [post] access to local variable ctx [Persons, [], Addresses, [], Street] : String | EntityFramework.cs:168:13:168:15 | access to local variable ctx [Persons, [], Addresses, [], Street] : String |
-| EntityFramework.cs:151:13:151:23 | [post] access to property Persons [[], Addresses, [], Street] : String | EntityFramework.cs:151:13:151:15 | [post] access to local variable ctx [Persons, [], Addresses, [], Street] : String |
-| EntityFramework.cs:151:29:151:30 | access to local variable p1 [Addresses, [], Street] : String | EntityFramework.cs:151:13:151:23 | [post] access to property Persons [[], Addresses, [], Street] : String |
-| EntityFramework.cs:152:13:152:15 | access to local variable ctx [Persons, [], Addresses, [], Street] : String | ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [Persons, [], Addresses, [], Street] : String |
-| EntityFramework.cs:156:13:156:15 | access to local variable ctx [Persons, [], Addresses, [], Street] : String | ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [Persons, [], Addresses, [], Street] : String |
-| EntityFramework.cs:159:13:162:13 | { ..., ... } [Street] : String | EntityFramework.cs:163:31:163:32 | access to local variable a1 [Street] : String |
-| EntityFramework.cs:161:26:161:34 | "tainted" : String | EntityFramework.cs:159:13:162:13 | { ..., ... } [Street] : String |
-| EntityFramework.cs:163:13:163:15 | [post] access to local variable ctx [Addresses, [], Street] : String | EntityFramework.cs:164:13:164:15 | access to local variable ctx [Addresses, [], Street] : String |
-| EntityFramework.cs:163:13:163:15 | [post] access to local variable ctx [Addresses, [], Street] : String | EntityFramework.cs:168:13:168:15 | access to local variable ctx [Addresses, [], Street] : String |
-| EntityFramework.cs:163:13:163:25 | [post] access to property Addresses [[], Street] : String | EntityFramework.cs:163:13:163:15 | [post] access to local variable ctx [Addresses, [], Street] : String |
-| EntityFramework.cs:163:31:163:32 | access to local variable a1 [Street] : String | EntityFramework.cs:163:13:163:25 | [post] access to property Addresses [[], Street] : String |
-| EntityFramework.cs:164:13:164:15 | access to local variable ctx [Addresses, [], Street] : String | ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [Addresses, [], Street] : String |
-| EntityFramework.cs:164:13:164:15 | access to local variable ctx [Persons, [], Addresses, [], Street] : String | ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [Persons, [], Addresses, [], Street] : String |
-| EntityFramework.cs:168:13:168:15 | access to local variable ctx [Addresses, [], Street] : String | ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [Addresses, [], Street] : String |
-| EntityFramework.cs:168:13:168:15 | access to local variable ctx [Persons, [], Addresses, [], Street] : String | ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [Persons, [], Addresses, [], Street] : String |
-| EntityFramework.cs:175:13:178:13 | { ..., ... } [Name] : String | EntityFramework.cs:184:71:184:72 | access to local variable p1 [Name] : String |
-| EntityFramework.cs:177:24:177:32 | "tainted" : String | EntityFramework.cs:175:13:178:13 | { ..., ... } [Name] : String |
-| EntityFramework.cs:180:13:183:13 | { ..., ... } [Street] : String | EntityFramework.cs:184:85:184:86 | access to local variable a1 [Street] : String |
-| EntityFramework.cs:182:26:182:34 | "tainted" : String | EntityFramework.cs:180:13:183:13 | { ..., ... } [Street] : String |
-| EntityFramework.cs:184:60:184:88 | { ..., ... } [Address, Street] : String | EntityFramework.cs:185:37:185:53 | access to local variable personAddressMap1 [Address, Street] : String |
-| EntityFramework.cs:184:60:184:88 | { ..., ... } [Person, Name] : String | EntityFramework.cs:185:37:185:53 | access to local variable personAddressMap1 [Person, Name] : String |
-| EntityFramework.cs:184:71:184:72 | access to local variable p1 [Name] : String | EntityFramework.cs:184:60:184:88 | { ..., ... } [Person, Name] : String |
-| EntityFramework.cs:184:85:184:86 | access to local variable a1 [Street] : String | EntityFramework.cs:184:60:184:88 | { ..., ... } [Address, Street] : String |
-| EntityFramework.cs:185:13:185:15 | [post] access to local variable ctx [PersonAddresses, [], Address, Street] : String | EntityFramework.cs:186:13:186:15 | access to local variable ctx [PersonAddresses, [], Address, Street] : String |
-| EntityFramework.cs:185:13:185:15 | [post] access to local variable ctx [PersonAddresses, [], Address, Street] : String | EntityFramework.cs:192:13:192:15 | access to local variable ctx [PersonAddresses, [], Address, Street] : String |
-| EntityFramework.cs:185:13:185:15 | [post] access to local variable ctx [PersonAddresses, [], Person, Name] : String | EntityFramework.cs:186:13:186:15 | access to local variable ctx [PersonAddresses, [], Person, Name] : String |
-| EntityFramework.cs:185:13:185:15 | [post] access to local variable ctx [PersonAddresses, [], Person, Name] : String | EntityFramework.cs:192:13:192:15 | access to local variable ctx [PersonAddresses, [], Person, Name] : String |
-| EntityFramework.cs:185:13:185:31 | [post] access to property PersonAddresses [[], Address, Street] : String | EntityFramework.cs:185:13:185:15 | [post] access to local variable ctx [PersonAddresses, [], Address, Street] : String |
-| EntityFramework.cs:185:13:185:31 | [post] access to property PersonAddresses [[], Person, Name] : String | EntityFramework.cs:185:13:185:15 | [post] access to local variable ctx [PersonAddresses, [], Person, Name] : String |
-| EntityFramework.cs:185:37:185:53 | access to local variable personAddressMap1 [Address, Street] : String | EntityFramework.cs:185:13:185:31 | [post] access to property PersonAddresses [[], Address, Street] : String |
-| EntityFramework.cs:185:37:185:53 | access to local variable personAddressMap1 [Person, Name] : String | EntityFramework.cs:185:13:185:31 | [post] access to property PersonAddresses [[], Person, Name] : String |
-| EntityFramework.cs:186:13:186:15 | access to local variable ctx [PersonAddresses, [], Address, Street] : String | ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [PersonAddresses, [], Address, Street] : String |
-| EntityFramework.cs:186:13:186:15 | access to local variable ctx [PersonAddresses, [], Person, Name] : String | ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [PersonAddresses, [], Person, Name] : String |
-| EntityFramework.cs:192:13:192:15 | access to local variable ctx [PersonAddresses, [], Address, Street] : String | ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [PersonAddresses, [], Address, Street] : String |
-| EntityFramework.cs:192:13:192:15 | access to local variable ctx [PersonAddresses, [], Person, Name] : String | ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [PersonAddresses, [], Person, Name] : String |
-| EntityFramework.cs:195:35:195:35 | p [Name] : String | EntityFramework.cs:198:29:198:29 | access to parameter p [Name] : String |
-| EntityFramework.cs:198:13:198:15 | [post] access to local variable ctx [Persons, [], Name] : String | EntityFramework.cs:199:13:199:15 | access to local variable ctx [Persons, [], Name] : String |
-| EntityFramework.cs:198:13:198:23 | [post] access to property Persons [[], Name] : String | EntityFramework.cs:198:13:198:15 | [post] access to local variable ctx [Persons, [], Name] : String |
-| EntityFramework.cs:198:29:198:29 | access to parameter p [Name] : String | EntityFramework.cs:198:13:198:23 | [post] access to property Persons [[], Name] : String |
-| EntityFramework.cs:199:13:199:15 | access to local variable ctx [Persons, [], Name] : String | ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [Persons, [], Name] : String |
-| EntityFramework.cs:206:18:206:28 | access to property Persons [[], Name] : String | EntityFramework.cs:206:18:206:36 | call to method First [Name] : String |
-| EntityFramework.cs:206:18:206:36 | call to method First [Name] : String | EntityFramework.cs:206:18:206:41 | access to property Name |
-| EntityFramework.cs:214:18:214:30 | access to property Addresses [[], Street] : String | EntityFramework.cs:214:18:214:38 | call to method First [Street] : String |
-| EntityFramework.cs:214:18:214:38 | call to method First [Street] : String | EntityFramework.cs:214:18:214:45 | access to property Street |
-| EntityFramework.cs:221:18:221:28 | access to property Persons [[], Addresses, [], Street] : String | EntityFramework.cs:221:18:221:36 | call to method First [Addresses, [], Street] : String |
-| EntityFramework.cs:221:18:221:36 | call to method First [Addresses, [], Street] : String | EntityFramework.cs:221:18:221:46 | access to property Addresses [[], Street] : String |
-| EntityFramework.cs:221:18:221:46 | access to property Addresses [[], Street] : String | EntityFramework.cs:221:18:221:54 | call to method First [Street] : String |
-| EntityFramework.cs:221:18:221:54 | call to method First [Street] : String | EntityFramework.cs:221:18:221:61 | access to property Street |
+| ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [property Addresses, element, property Street] : String | EntityFramework.cs:214:18:214:30 | access to property Addresses [element, property Street] : String |
+| ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [property Addresses, element, property Street] : String | EntityFramework.cs:221:18:221:28 | access to property Persons [element, property Addresses, element, property Street] : String |
+| ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [property PersonAddresses, element, property Address, property Street] : String | EntityFramework.cs:214:18:214:30 | access to property Addresses [element, property Street] : String |
+| ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [property PersonAddresses, element, property Address, property Street] : String | EntityFramework.cs:221:18:221:28 | access to property Persons [element, property Addresses, element, property Street] : String |
+| ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [property PersonAddresses, element, property Person, property Name] : String | EntityFramework.cs:206:18:206:28 | access to property Persons [element, property Name] : String |
+| ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [property Persons, element, property Addresses, element, property Street] : String | EntityFramework.cs:214:18:214:30 | access to property Addresses [element, property Street] : String |
+| ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [property Persons, element, property Addresses, element, property Street] : String | EntityFramework.cs:221:18:221:28 | access to property Persons [element, property Addresses, element, property Street] : String |
+| ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [property Persons, element, property Name] : String | EntityFramework.cs:206:18:206:28 | access to property Persons [element, property Name] : String |
+| ../../../resources/stubs/EntityFramework.cs:41:49:41:64 | this [property Persons, element, property Name] : String | EntityFramework.cs:206:18:206:28 | access to property Persons [element, property Name] : String |
+| ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [property Addresses, element, property Street] : String | EntityFrameworkCore.cs:238:18:238:30 | access to property Addresses [element, property Street] : String |
+| ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [property Addresses, element, property Street] : String | EntityFrameworkCore.cs:245:18:245:28 | access to property Persons [element, property Addresses, element, property Street] : String |
+| ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [property PersonAddresses, element, property Address, property Street] : String | EntityFrameworkCore.cs:238:18:238:30 | access to property Addresses [element, property Street] : String |
+| ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [property PersonAddresses, element, property Address, property Street] : String | EntityFrameworkCore.cs:245:18:245:28 | access to property Persons [element, property Addresses, element, property Street] : String |
+| ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [property PersonAddresses, element, property Person, property Name] : String | EntityFrameworkCore.cs:230:18:230:28 | access to property Persons [element, property Name] : String |
+| ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [property Persons, element, property Addresses, element, property Street] : String | EntityFrameworkCore.cs:238:18:238:30 | access to property Addresses [element, property Street] : String |
+| ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [property Persons, element, property Addresses, element, property Street] : String | EntityFrameworkCore.cs:245:18:245:28 | access to property Persons [element, property Addresses, element, property Street] : String |
+| ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [property Persons, element, property Name] : String | EntityFrameworkCore.cs:230:18:230:28 | access to property Persons [element, property Name] : String |
+| ../../../resources/stubs/EntityFramework.cs:81:49:81:64 | this [property Persons, element, property Name] : String | EntityFrameworkCore.cs:230:18:230:28 | access to property Persons [element, property Name] : String |
+| EntityFramework.cs:61:13:64:13 | { ..., ... } [property Name] : String | EntityFramework.cs:68:29:68:30 | access to local variable p1 [property Name] : String |
+| EntityFramework.cs:63:24:63:32 | "tainted" : String | EntityFramework.cs:61:13:64:13 | { ..., ... } [property Name] : String |
+| EntityFramework.cs:68:13:68:15 | [post] access to local variable ctx [property Persons, element, property Name] : String | EntityFramework.cs:70:13:70:15 | access to local variable ctx [property Persons, element, property Name] : String |
+| EntityFramework.cs:68:13:68:23 | [post] access to property Persons [element, property Name] : String | EntityFramework.cs:68:13:68:15 | [post] access to local variable ctx [property Persons, element, property Name] : String |
+| EntityFramework.cs:68:29:68:30 | access to local variable p1 [property Name] : String | EntityFramework.cs:68:13:68:23 | [post] access to property Persons [element, property Name] : String |
+| EntityFramework.cs:70:13:70:15 | access to local variable ctx [property Persons, element, property Name] : String | ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [property Persons, element, property Name] : String |
+| EntityFramework.cs:83:13:86:13 | { ..., ... } [property Name] : String | EntityFramework.cs:90:29:90:30 | access to local variable p1 [property Name] : String |
+| EntityFramework.cs:85:24:85:32 | "tainted" : String | EntityFramework.cs:83:13:86:13 | { ..., ... } [property Name] : String |
+| EntityFramework.cs:90:13:90:15 | [post] access to local variable ctx [property Persons, element, property Name] : String | EntityFramework.cs:92:19:92:21 | access to local variable ctx [property Persons, element, property Name] : String |
+| EntityFramework.cs:90:13:90:23 | [post] access to property Persons [element, property Name] : String | EntityFramework.cs:90:13:90:15 | [post] access to local variable ctx [property Persons, element, property Name] : String |
+| EntityFramework.cs:90:29:90:30 | access to local variable p1 [property Name] : String | EntityFramework.cs:90:13:90:23 | [post] access to property Persons [element, property Name] : String |
+| EntityFramework.cs:92:19:92:21 | access to local variable ctx [property Persons, element, property Name] : String | ../../../resources/stubs/EntityFramework.cs:41:49:41:64 | this [property Persons, element, property Name] : String |
+| EntityFramework.cs:105:13:108:13 | { ..., ... } [property Name] : String | EntityFramework.cs:111:27:111:28 | access to local variable p1 [property Name] : String |
+| EntityFramework.cs:107:24:107:32 | "tainted" : String | EntityFramework.cs:105:13:108:13 | { ..., ... } [property Name] : String |
+| EntityFramework.cs:111:27:111:28 | access to local variable p1 [property Name] : String | EntityFramework.cs:195:35:195:35 | p [property Name] : String |
+| EntityFramework.cs:124:13:127:13 | { ..., ... } [property Title] : String | EntityFramework.cs:131:18:131:19 | access to local variable p1 [property Title] : String |
+| EntityFramework.cs:126:25:126:33 | "tainted" : String | EntityFramework.cs:124:13:127:13 | { ..., ... } [property Title] : String |
+| EntityFramework.cs:131:18:131:19 | access to local variable p1 [property Title] : String | EntityFramework.cs:131:18:131:25 | access to property Title |
+| EntityFramework.cs:143:13:150:13 | { ..., ... } [property Addresses, element, property Street] : String | EntityFramework.cs:151:29:151:30 | access to local variable p1 [property Addresses, element, property Street] : String |
+| EntityFramework.cs:144:29:149:17 | array creation of type Address[] [element, property Street] : String | EntityFramework.cs:143:13:150:13 | { ..., ... } [property Addresses, element, property Street] : String |
+| EntityFramework.cs:144:35:149:17 | { ..., ... } [element, property Street] : String | EntityFramework.cs:144:29:149:17 | array creation of type Address[] [element, property Street] : String |
+| EntityFramework.cs:145:21:148:21 | object creation of type Address [property Street] : String | EntityFramework.cs:144:35:149:17 | { ..., ... } [element, property Street] : String |
+| EntityFramework.cs:145:33:148:21 | { ..., ... } [property Street] : String | EntityFramework.cs:145:21:148:21 | object creation of type Address [property Street] : String |
+| EntityFramework.cs:147:34:147:42 | "tainted" : String | EntityFramework.cs:145:33:148:21 | { ..., ... } [property Street] : String |
+| EntityFramework.cs:151:13:151:15 | [post] access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String | EntityFramework.cs:152:13:152:15 | access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String |
+| EntityFramework.cs:151:13:151:15 | [post] access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String | EntityFramework.cs:156:13:156:15 | access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String |
+| EntityFramework.cs:151:13:151:15 | [post] access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String | EntityFramework.cs:164:13:164:15 | access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String |
+| EntityFramework.cs:151:13:151:15 | [post] access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String | EntityFramework.cs:168:13:168:15 | access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String |
+| EntityFramework.cs:151:13:151:23 | [post] access to property Persons [element, property Addresses, element, property Street] : String | EntityFramework.cs:151:13:151:15 | [post] access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String |
+| EntityFramework.cs:151:29:151:30 | access to local variable p1 [property Addresses, element, property Street] : String | EntityFramework.cs:151:13:151:23 | [post] access to property Persons [element, property Addresses, element, property Street] : String |
+| EntityFramework.cs:152:13:152:15 | access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String | ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [property Persons, element, property Addresses, element, property Street] : String |
+| EntityFramework.cs:156:13:156:15 | access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String | ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [property Persons, element, property Addresses, element, property Street] : String |
+| EntityFramework.cs:159:13:162:13 | { ..., ... } [property Street] : String | EntityFramework.cs:163:31:163:32 | access to local variable a1 [property Street] : String |
+| EntityFramework.cs:161:26:161:34 | "tainted" : String | EntityFramework.cs:159:13:162:13 | { ..., ... } [property Street] : String |
+| EntityFramework.cs:163:13:163:15 | [post] access to local variable ctx [property Addresses, element, property Street] : String | EntityFramework.cs:164:13:164:15 | access to local variable ctx [property Addresses, element, property Street] : String |
+| EntityFramework.cs:163:13:163:15 | [post] access to local variable ctx [property Addresses, element, property Street] : String | EntityFramework.cs:168:13:168:15 | access to local variable ctx [property Addresses, element, property Street] : String |
+| EntityFramework.cs:163:13:163:25 | [post] access to property Addresses [element, property Street] : String | EntityFramework.cs:163:13:163:15 | [post] access to local variable ctx [property Addresses, element, property Street] : String |
+| EntityFramework.cs:163:31:163:32 | access to local variable a1 [property Street] : String | EntityFramework.cs:163:13:163:25 | [post] access to property Addresses [element, property Street] : String |
+| EntityFramework.cs:164:13:164:15 | access to local variable ctx [property Addresses, element, property Street] : String | ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [property Addresses, element, property Street] : String |
+| EntityFramework.cs:164:13:164:15 | access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String | ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [property Persons, element, property Addresses, element, property Street] : String |
+| EntityFramework.cs:168:13:168:15 | access to local variable ctx [property Addresses, element, property Street] : String | ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [property Addresses, element, property Street] : String |
+| EntityFramework.cs:168:13:168:15 | access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String | ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [property Persons, element, property Addresses, element, property Street] : String |
+| EntityFramework.cs:175:13:178:13 | { ..., ... } [property Name] : String | EntityFramework.cs:184:71:184:72 | access to local variable p1 [property Name] : String |
+| EntityFramework.cs:177:24:177:32 | "tainted" : String | EntityFramework.cs:175:13:178:13 | { ..., ... } [property Name] : String |
+| EntityFramework.cs:180:13:183:13 | { ..., ... } [property Street] : String | EntityFramework.cs:184:85:184:86 | access to local variable a1 [property Street] : String |
+| EntityFramework.cs:182:26:182:34 | "tainted" : String | EntityFramework.cs:180:13:183:13 | { ..., ... } [property Street] : String |
+| EntityFramework.cs:184:60:184:88 | { ..., ... } [property Address, property Street] : String | EntityFramework.cs:185:37:185:53 | access to local variable personAddressMap1 [property Address, property Street] : String |
+| EntityFramework.cs:184:60:184:88 | { ..., ... } [property Person, property Name] : String | EntityFramework.cs:185:37:185:53 | access to local variable personAddressMap1 [property Person, property Name] : String |
+| EntityFramework.cs:184:71:184:72 | access to local variable p1 [property Name] : String | EntityFramework.cs:184:60:184:88 | { ..., ... } [property Person, property Name] : String |
+| EntityFramework.cs:184:85:184:86 | access to local variable a1 [property Street] : String | EntityFramework.cs:184:60:184:88 | { ..., ... } [property Address, property Street] : String |
+| EntityFramework.cs:185:13:185:15 | [post] access to local variable ctx [property PersonAddresses, element, property Address, property Street] : String | EntityFramework.cs:186:13:186:15 | access to local variable ctx [property PersonAddresses, element, property Address, property Street] : String |
+| EntityFramework.cs:185:13:185:15 | [post] access to local variable ctx [property PersonAddresses, element, property Address, property Street] : String | EntityFramework.cs:192:13:192:15 | access to local variable ctx [property PersonAddresses, element, property Address, property Street] : String |
+| EntityFramework.cs:185:13:185:15 | [post] access to local variable ctx [property PersonAddresses, element, property Person, property Name] : String | EntityFramework.cs:186:13:186:15 | access to local variable ctx [property PersonAddresses, element, property Person, property Name] : String |
+| EntityFramework.cs:185:13:185:15 | [post] access to local variable ctx [property PersonAddresses, element, property Person, property Name] : String | EntityFramework.cs:192:13:192:15 | access to local variable ctx [property PersonAddresses, element, property Person, property Name] : String |
+| EntityFramework.cs:185:13:185:31 | [post] access to property PersonAddresses [element, property Address, property Street] : String | EntityFramework.cs:185:13:185:15 | [post] access to local variable ctx [property PersonAddresses, element, property Address, property Street] : String |
+| EntityFramework.cs:185:13:185:31 | [post] access to property PersonAddresses [element, property Person, property Name] : String | EntityFramework.cs:185:13:185:15 | [post] access to local variable ctx [property PersonAddresses, element, property Person, property Name] : String |
+| EntityFramework.cs:185:37:185:53 | access to local variable personAddressMap1 [property Address, property Street] : String | EntityFramework.cs:185:13:185:31 | [post] access to property PersonAddresses [element, property Address, property Street] : String |
+| EntityFramework.cs:185:37:185:53 | access to local variable personAddressMap1 [property Person, property Name] : String | EntityFramework.cs:185:13:185:31 | [post] access to property PersonAddresses [element, property Person, property Name] : String |
+| EntityFramework.cs:186:13:186:15 | access to local variable ctx [property PersonAddresses, element, property Address, property Street] : String | ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [property PersonAddresses, element, property Address, property Street] : String |
+| EntityFramework.cs:186:13:186:15 | access to local variable ctx [property PersonAddresses, element, property Person, property Name] : String | ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [property PersonAddresses, element, property Person, property Name] : String |
+| EntityFramework.cs:192:13:192:15 | access to local variable ctx [property PersonAddresses, element, property Address, property Street] : String | ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [property PersonAddresses, element, property Address, property Street] : String |
+| EntityFramework.cs:192:13:192:15 | access to local variable ctx [property PersonAddresses, element, property Person, property Name] : String | ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [property PersonAddresses, element, property Person, property Name] : String |
+| EntityFramework.cs:195:35:195:35 | p [property Name] : String | EntityFramework.cs:198:29:198:29 | access to parameter p [property Name] : String |
+| EntityFramework.cs:198:13:198:15 | [post] access to local variable ctx [property Persons, element, property Name] : String | EntityFramework.cs:199:13:199:15 | access to local variable ctx [property Persons, element, property Name] : String |
+| EntityFramework.cs:198:13:198:23 | [post] access to property Persons [element, property Name] : String | EntityFramework.cs:198:13:198:15 | [post] access to local variable ctx [property Persons, element, property Name] : String |
+| EntityFramework.cs:198:29:198:29 | access to parameter p [property Name] : String | EntityFramework.cs:198:13:198:23 | [post] access to property Persons [element, property Name] : String |
+| EntityFramework.cs:199:13:199:15 | access to local variable ctx [property Persons, element, property Name] : String | ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [property Persons, element, property Name] : String |
+| EntityFramework.cs:206:18:206:28 | access to property Persons [element, property Name] : String | EntityFramework.cs:206:18:206:36 | call to method First [property Name] : String |
+| EntityFramework.cs:206:18:206:36 | call to method First [property Name] : String | EntityFramework.cs:206:18:206:41 | access to property Name |
+| EntityFramework.cs:214:18:214:30 | access to property Addresses [element, property Street] : String | EntityFramework.cs:214:18:214:38 | call to method First [property Street] : String |
+| EntityFramework.cs:214:18:214:38 | call to method First [property Street] : String | EntityFramework.cs:214:18:214:45 | access to property Street |
+| EntityFramework.cs:221:18:221:28 | access to property Persons [element, property Addresses, element, property Street] : String | EntityFramework.cs:221:18:221:36 | call to method First [property Addresses, element, property Street] : String |
+| EntityFramework.cs:221:18:221:36 | call to method First [property Addresses, element, property Street] : String | EntityFramework.cs:221:18:221:46 | access to property Addresses [element, property Street] : String |
+| EntityFramework.cs:221:18:221:46 | access to property Addresses [element, property Street] : String | EntityFramework.cs:221:18:221:54 | call to method First [property Street] : String |
+| EntityFramework.cs:221:18:221:54 | call to method First [property Street] : String | EntityFramework.cs:221:18:221:61 | access to property Street |
 | EntityFrameworkCore.cs:75:31:75:39 | "tainted" : String | EntityFrameworkCore.cs:76:18:76:28 | access to local variable taintSource |
 | EntityFrameworkCore.cs:75:31:75:39 | "tainted" : String | EntityFrameworkCore.cs:77:35:77:45 | access to local variable taintSource : String |
 | EntityFrameworkCore.cs:75:31:75:39 | "tainted" : String | EntityFrameworkCore.cs:78:32:78:42 | access to local variable taintSource : String |
@@ -99,166 +99,166 @@ edges
 | EntityFrameworkCore.cs:77:35:77:45 | access to local variable taintSource : String | EntityFrameworkCore.cs:77:18:77:46 | object creation of type RawSqlString : RawSqlString |
 | EntityFrameworkCore.cs:78:18:78:42 | call to operator implicit conversion : RawSqlString | EntityFrameworkCore.cs:78:18:78:42 | (...) ... |
 | EntityFrameworkCore.cs:78:32:78:42 | access to local variable taintSource : String | EntityFrameworkCore.cs:78:18:78:42 | call to operator implicit conversion : RawSqlString |
-| EntityFrameworkCore.cs:85:13:88:13 | { ..., ... } [Name] : String | EntityFrameworkCore.cs:92:29:92:30 | access to local variable p1 [Name] : String |
-| EntityFrameworkCore.cs:87:24:87:32 | "tainted" : String | EntityFrameworkCore.cs:85:13:88:13 | { ..., ... } [Name] : String |
-| EntityFrameworkCore.cs:92:13:92:15 | [post] access to local variable ctx [Persons, [], Name] : String | EntityFrameworkCore.cs:94:13:94:15 | access to local variable ctx [Persons, [], Name] : String |
-| EntityFrameworkCore.cs:92:13:92:23 | [post] access to property Persons [[], Name] : String | EntityFrameworkCore.cs:92:13:92:15 | [post] access to local variable ctx [Persons, [], Name] : String |
-| EntityFrameworkCore.cs:92:29:92:30 | access to local variable p1 [Name] : String | EntityFrameworkCore.cs:92:13:92:23 | [post] access to property Persons [[], Name] : String |
-| EntityFrameworkCore.cs:94:13:94:15 | access to local variable ctx [Persons, [], Name] : String | ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [Persons, [], Name] : String |
-| EntityFrameworkCore.cs:107:13:110:13 | { ..., ... } [Name] : String | EntityFrameworkCore.cs:114:29:114:30 | access to local variable p1 [Name] : String |
-| EntityFrameworkCore.cs:109:24:109:32 | "tainted" : String | EntityFrameworkCore.cs:107:13:110:13 | { ..., ... } [Name] : String |
-| EntityFrameworkCore.cs:114:13:114:15 | [post] access to local variable ctx [Persons, [], Name] : String | EntityFrameworkCore.cs:116:19:116:21 | access to local variable ctx [Persons, [], Name] : String |
-| EntityFrameworkCore.cs:114:13:114:23 | [post] access to property Persons [[], Name] : String | EntityFrameworkCore.cs:114:13:114:15 | [post] access to local variable ctx [Persons, [], Name] : String |
-| EntityFrameworkCore.cs:114:29:114:30 | access to local variable p1 [Name] : String | EntityFrameworkCore.cs:114:13:114:23 | [post] access to property Persons [[], Name] : String |
-| EntityFrameworkCore.cs:116:19:116:21 | access to local variable ctx [Persons, [], Name] : String | ../../../resources/stubs/EntityFramework.cs:81:49:81:64 | this [Persons, [], Name] : String |
-| EntityFrameworkCore.cs:129:13:132:13 | { ..., ... } [Name] : String | EntityFrameworkCore.cs:135:27:135:28 | access to local variable p1 [Name] : String |
-| EntityFrameworkCore.cs:131:24:131:32 | "tainted" : String | EntityFrameworkCore.cs:129:13:132:13 | { ..., ... } [Name] : String |
-| EntityFrameworkCore.cs:135:27:135:28 | access to local variable p1 [Name] : String | EntityFrameworkCore.cs:219:35:219:35 | p [Name] : String |
-| EntityFrameworkCore.cs:148:13:151:13 | { ..., ... } [Title] : String | EntityFrameworkCore.cs:155:18:155:19 | access to local variable p1 [Title] : String |
-| EntityFrameworkCore.cs:150:25:150:33 | "tainted" : String | EntityFrameworkCore.cs:148:13:151:13 | { ..., ... } [Title] : String |
-| EntityFrameworkCore.cs:155:18:155:19 | access to local variable p1 [Title] : String | EntityFrameworkCore.cs:155:18:155:25 | access to property Title |
-| EntityFrameworkCore.cs:167:13:174:13 | { ..., ... } [Addresses, [], Street] : String | EntityFrameworkCore.cs:175:29:175:30 | access to local variable p1 [Addresses, [], Street] : String |
-| EntityFrameworkCore.cs:168:29:173:17 | array creation of type Address[] [[], Street] : String | EntityFrameworkCore.cs:167:13:174:13 | { ..., ... } [Addresses, [], Street] : String |
-| EntityFrameworkCore.cs:168:35:173:17 | { ..., ... } [[], Street] : String | EntityFrameworkCore.cs:168:29:173:17 | array creation of type Address[] [[], Street] : String |
-| EntityFrameworkCore.cs:169:21:172:21 | object creation of type Address [Street] : String | EntityFrameworkCore.cs:168:35:173:17 | { ..., ... } [[], Street] : String |
-| EntityFrameworkCore.cs:169:33:172:21 | { ..., ... } [Street] : String | EntityFrameworkCore.cs:169:21:172:21 | object creation of type Address [Street] : String |
-| EntityFrameworkCore.cs:171:34:171:42 | "tainted" : String | EntityFrameworkCore.cs:169:33:172:21 | { ..., ... } [Street] : String |
-| EntityFrameworkCore.cs:175:13:175:15 | [post] access to local variable ctx [Persons, [], Addresses, [], Street] : String | EntityFrameworkCore.cs:176:13:176:15 | access to local variable ctx [Persons, [], Addresses, [], Street] : String |
-| EntityFrameworkCore.cs:175:13:175:15 | [post] access to local variable ctx [Persons, [], Addresses, [], Street] : String | EntityFrameworkCore.cs:180:13:180:15 | access to local variable ctx [Persons, [], Addresses, [], Street] : String |
-| EntityFrameworkCore.cs:175:13:175:15 | [post] access to local variable ctx [Persons, [], Addresses, [], Street] : String | EntityFrameworkCore.cs:188:13:188:15 | access to local variable ctx [Persons, [], Addresses, [], Street] : String |
-| EntityFrameworkCore.cs:175:13:175:15 | [post] access to local variable ctx [Persons, [], Addresses, [], Street] : String | EntityFrameworkCore.cs:192:13:192:15 | access to local variable ctx [Persons, [], Addresses, [], Street] : String |
-| EntityFrameworkCore.cs:175:13:175:23 | [post] access to property Persons [[], Addresses, [], Street] : String | EntityFrameworkCore.cs:175:13:175:15 | [post] access to local variable ctx [Persons, [], Addresses, [], Street] : String |
-| EntityFrameworkCore.cs:175:29:175:30 | access to local variable p1 [Addresses, [], Street] : String | EntityFrameworkCore.cs:175:13:175:23 | [post] access to property Persons [[], Addresses, [], Street] : String |
-| EntityFrameworkCore.cs:176:13:176:15 | access to local variable ctx [Persons, [], Addresses, [], Street] : String | ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [Persons, [], Addresses, [], Street] : String |
-| EntityFrameworkCore.cs:180:13:180:15 | access to local variable ctx [Persons, [], Addresses, [], Street] : String | ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [Persons, [], Addresses, [], Street] : String |
-| EntityFrameworkCore.cs:183:13:186:13 | { ..., ... } [Street] : String | EntityFrameworkCore.cs:187:31:187:32 | access to local variable a1 [Street] : String |
-| EntityFrameworkCore.cs:185:26:185:34 | "tainted" : String | EntityFrameworkCore.cs:183:13:186:13 | { ..., ... } [Street] : String |
-| EntityFrameworkCore.cs:187:13:187:15 | [post] access to local variable ctx [Addresses, [], Street] : String | EntityFrameworkCore.cs:188:13:188:15 | access to local variable ctx [Addresses, [], Street] : String |
-| EntityFrameworkCore.cs:187:13:187:15 | [post] access to local variable ctx [Addresses, [], Street] : String | EntityFrameworkCore.cs:192:13:192:15 | access to local variable ctx [Addresses, [], Street] : String |
-| EntityFrameworkCore.cs:187:13:187:25 | [post] access to property Addresses [[], Street] : String | EntityFrameworkCore.cs:187:13:187:15 | [post] access to local variable ctx [Addresses, [], Street] : String |
-| EntityFrameworkCore.cs:187:31:187:32 | access to local variable a1 [Street] : String | EntityFrameworkCore.cs:187:13:187:25 | [post] access to property Addresses [[], Street] : String |
-| EntityFrameworkCore.cs:188:13:188:15 | access to local variable ctx [Addresses, [], Street] : String | ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [Addresses, [], Street] : String |
-| EntityFrameworkCore.cs:188:13:188:15 | access to local variable ctx [Persons, [], Addresses, [], Street] : String | ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [Persons, [], Addresses, [], Street] : String |
-| EntityFrameworkCore.cs:192:13:192:15 | access to local variable ctx [Addresses, [], Street] : String | ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [Addresses, [], Street] : String |
-| EntityFrameworkCore.cs:192:13:192:15 | access to local variable ctx [Persons, [], Addresses, [], Street] : String | ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [Persons, [], Addresses, [], Street] : String |
-| EntityFrameworkCore.cs:199:13:202:13 | { ..., ... } [Name] : String | EntityFrameworkCore.cs:208:71:208:72 | access to local variable p1 [Name] : String |
-| EntityFrameworkCore.cs:201:24:201:32 | "tainted" : String | EntityFrameworkCore.cs:199:13:202:13 | { ..., ... } [Name] : String |
-| EntityFrameworkCore.cs:204:13:207:13 | { ..., ... } [Street] : String | EntityFrameworkCore.cs:208:85:208:86 | access to local variable a1 [Street] : String |
-| EntityFrameworkCore.cs:206:26:206:34 | "tainted" : String | EntityFrameworkCore.cs:204:13:207:13 | { ..., ... } [Street] : String |
-| EntityFrameworkCore.cs:208:60:208:88 | { ..., ... } [Address, Street] : String | EntityFrameworkCore.cs:209:37:209:53 | access to local variable personAddressMap1 [Address, Street] : String |
-| EntityFrameworkCore.cs:208:60:208:88 | { ..., ... } [Person, Name] : String | EntityFrameworkCore.cs:209:37:209:53 | access to local variable personAddressMap1 [Person, Name] : String |
-| EntityFrameworkCore.cs:208:71:208:72 | access to local variable p1 [Name] : String | EntityFrameworkCore.cs:208:60:208:88 | { ..., ... } [Person, Name] : String |
-| EntityFrameworkCore.cs:208:85:208:86 | access to local variable a1 [Street] : String | EntityFrameworkCore.cs:208:60:208:88 | { ..., ... } [Address, Street] : String |
-| EntityFrameworkCore.cs:209:13:209:15 | [post] access to local variable ctx [PersonAddresses, [], Address, Street] : String | EntityFrameworkCore.cs:210:13:210:15 | access to local variable ctx [PersonAddresses, [], Address, Street] : String |
-| EntityFrameworkCore.cs:209:13:209:15 | [post] access to local variable ctx [PersonAddresses, [], Address, Street] : String | EntityFrameworkCore.cs:216:13:216:15 | access to local variable ctx [PersonAddresses, [], Address, Street] : String |
-| EntityFrameworkCore.cs:209:13:209:15 | [post] access to local variable ctx [PersonAddresses, [], Person, Name] : String | EntityFrameworkCore.cs:210:13:210:15 | access to local variable ctx [PersonAddresses, [], Person, Name] : String |
-| EntityFrameworkCore.cs:209:13:209:15 | [post] access to local variable ctx [PersonAddresses, [], Person, Name] : String | EntityFrameworkCore.cs:216:13:216:15 | access to local variable ctx [PersonAddresses, [], Person, Name] : String |
-| EntityFrameworkCore.cs:209:13:209:31 | [post] access to property PersonAddresses [[], Address, Street] : String | EntityFrameworkCore.cs:209:13:209:15 | [post] access to local variable ctx [PersonAddresses, [], Address, Street] : String |
-| EntityFrameworkCore.cs:209:13:209:31 | [post] access to property PersonAddresses [[], Person, Name] : String | EntityFrameworkCore.cs:209:13:209:15 | [post] access to local variable ctx [PersonAddresses, [], Person, Name] : String |
-| EntityFrameworkCore.cs:209:37:209:53 | access to local variable personAddressMap1 [Address, Street] : String | EntityFrameworkCore.cs:209:13:209:31 | [post] access to property PersonAddresses [[], Address, Street] : String |
-| EntityFrameworkCore.cs:209:37:209:53 | access to local variable personAddressMap1 [Person, Name] : String | EntityFrameworkCore.cs:209:13:209:31 | [post] access to property PersonAddresses [[], Person, Name] : String |
-| EntityFrameworkCore.cs:210:13:210:15 | access to local variable ctx [PersonAddresses, [], Address, Street] : String | ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [PersonAddresses, [], Address, Street] : String |
-| EntityFrameworkCore.cs:210:13:210:15 | access to local variable ctx [PersonAddresses, [], Person, Name] : String | ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [PersonAddresses, [], Person, Name] : String |
-| EntityFrameworkCore.cs:216:13:216:15 | access to local variable ctx [PersonAddresses, [], Address, Street] : String | ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [PersonAddresses, [], Address, Street] : String |
-| EntityFrameworkCore.cs:216:13:216:15 | access to local variable ctx [PersonAddresses, [], Person, Name] : String | ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [PersonAddresses, [], Person, Name] : String |
-| EntityFrameworkCore.cs:219:35:219:35 | p [Name] : String | EntityFrameworkCore.cs:222:29:222:29 | access to parameter p [Name] : String |
-| EntityFrameworkCore.cs:222:13:222:15 | [post] access to local variable ctx [Persons, [], Name] : String | EntityFrameworkCore.cs:223:13:223:15 | access to local variable ctx [Persons, [], Name] : String |
-| EntityFrameworkCore.cs:222:13:222:23 | [post] access to property Persons [[], Name] : String | EntityFrameworkCore.cs:222:13:222:15 | [post] access to local variable ctx [Persons, [], Name] : String |
-| EntityFrameworkCore.cs:222:29:222:29 | access to parameter p [Name] : String | EntityFrameworkCore.cs:222:13:222:23 | [post] access to property Persons [[], Name] : String |
-| EntityFrameworkCore.cs:223:13:223:15 | access to local variable ctx [Persons, [], Name] : String | ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [Persons, [], Name] : String |
-| EntityFrameworkCore.cs:230:18:230:28 | access to property Persons [[], Name] : String | EntityFrameworkCore.cs:230:18:230:36 | call to method First [Name] : String |
-| EntityFrameworkCore.cs:230:18:230:36 | call to method First [Name] : String | EntityFrameworkCore.cs:230:18:230:41 | access to property Name |
-| EntityFrameworkCore.cs:238:18:238:30 | access to property Addresses [[], Street] : String | EntityFrameworkCore.cs:238:18:238:38 | call to method First [Street] : String |
-| EntityFrameworkCore.cs:238:18:238:38 | call to method First [Street] : String | EntityFrameworkCore.cs:238:18:238:45 | access to property Street |
-| EntityFrameworkCore.cs:245:18:245:28 | access to property Persons [[], Addresses, [], Street] : String | EntityFrameworkCore.cs:245:18:245:36 | call to method First [Addresses, [], Street] : String |
-| EntityFrameworkCore.cs:245:18:245:36 | call to method First [Addresses, [], Street] : String | EntityFrameworkCore.cs:245:18:245:46 | access to property Addresses [[], Street] : String |
-| EntityFrameworkCore.cs:245:18:245:46 | access to property Addresses [[], Street] : String | EntityFrameworkCore.cs:245:18:245:54 | call to method First [Street] : String |
-| EntityFrameworkCore.cs:245:18:245:54 | call to method First [Street] : String | EntityFrameworkCore.cs:245:18:245:61 | access to property Street |
+| EntityFrameworkCore.cs:85:13:88:13 | { ..., ... } [property Name] : String | EntityFrameworkCore.cs:92:29:92:30 | access to local variable p1 [property Name] : String |
+| EntityFrameworkCore.cs:87:24:87:32 | "tainted" : String | EntityFrameworkCore.cs:85:13:88:13 | { ..., ... } [property Name] : String |
+| EntityFrameworkCore.cs:92:13:92:15 | [post] access to local variable ctx [property Persons, element, property Name] : String | EntityFrameworkCore.cs:94:13:94:15 | access to local variable ctx [property Persons, element, property Name] : String |
+| EntityFrameworkCore.cs:92:13:92:23 | [post] access to property Persons [element, property Name] : String | EntityFrameworkCore.cs:92:13:92:15 | [post] access to local variable ctx [property Persons, element, property Name] : String |
+| EntityFrameworkCore.cs:92:29:92:30 | access to local variable p1 [property Name] : String | EntityFrameworkCore.cs:92:13:92:23 | [post] access to property Persons [element, property Name] : String |
+| EntityFrameworkCore.cs:94:13:94:15 | access to local variable ctx [property Persons, element, property Name] : String | ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [property Persons, element, property Name] : String |
+| EntityFrameworkCore.cs:107:13:110:13 | { ..., ... } [property Name] : String | EntityFrameworkCore.cs:114:29:114:30 | access to local variable p1 [property Name] : String |
+| EntityFrameworkCore.cs:109:24:109:32 | "tainted" : String | EntityFrameworkCore.cs:107:13:110:13 | { ..., ... } [property Name] : String |
+| EntityFrameworkCore.cs:114:13:114:15 | [post] access to local variable ctx [property Persons, element, property Name] : String | EntityFrameworkCore.cs:116:19:116:21 | access to local variable ctx [property Persons, element, property Name] : String |
+| EntityFrameworkCore.cs:114:13:114:23 | [post] access to property Persons [element, property Name] : String | EntityFrameworkCore.cs:114:13:114:15 | [post] access to local variable ctx [property Persons, element, property Name] : String |
+| EntityFrameworkCore.cs:114:29:114:30 | access to local variable p1 [property Name] : String | EntityFrameworkCore.cs:114:13:114:23 | [post] access to property Persons [element, property Name] : String |
+| EntityFrameworkCore.cs:116:19:116:21 | access to local variable ctx [property Persons, element, property Name] : String | ../../../resources/stubs/EntityFramework.cs:81:49:81:64 | this [property Persons, element, property Name] : String |
+| EntityFrameworkCore.cs:129:13:132:13 | { ..., ... } [property Name] : String | EntityFrameworkCore.cs:135:27:135:28 | access to local variable p1 [property Name] : String |
+| EntityFrameworkCore.cs:131:24:131:32 | "tainted" : String | EntityFrameworkCore.cs:129:13:132:13 | { ..., ... } [property Name] : String |
+| EntityFrameworkCore.cs:135:27:135:28 | access to local variable p1 [property Name] : String | EntityFrameworkCore.cs:219:35:219:35 | p [property Name] : String |
+| EntityFrameworkCore.cs:148:13:151:13 | { ..., ... } [property Title] : String | EntityFrameworkCore.cs:155:18:155:19 | access to local variable p1 [property Title] : String |
+| EntityFrameworkCore.cs:150:25:150:33 | "tainted" : String | EntityFrameworkCore.cs:148:13:151:13 | { ..., ... } [property Title] : String |
+| EntityFrameworkCore.cs:155:18:155:19 | access to local variable p1 [property Title] : String | EntityFrameworkCore.cs:155:18:155:25 | access to property Title |
+| EntityFrameworkCore.cs:167:13:174:13 | { ..., ... } [property Addresses, element, property Street] : String | EntityFrameworkCore.cs:175:29:175:30 | access to local variable p1 [property Addresses, element, property Street] : String |
+| EntityFrameworkCore.cs:168:29:173:17 | array creation of type Address[] [element, property Street] : String | EntityFrameworkCore.cs:167:13:174:13 | { ..., ... } [property Addresses, element, property Street] : String |
+| EntityFrameworkCore.cs:168:35:173:17 | { ..., ... } [element, property Street] : String | EntityFrameworkCore.cs:168:29:173:17 | array creation of type Address[] [element, property Street] : String |
+| EntityFrameworkCore.cs:169:21:172:21 | object creation of type Address [property Street] : String | EntityFrameworkCore.cs:168:35:173:17 | { ..., ... } [element, property Street] : String |
+| EntityFrameworkCore.cs:169:33:172:21 | { ..., ... } [property Street] : String | EntityFrameworkCore.cs:169:21:172:21 | object creation of type Address [property Street] : String |
+| EntityFrameworkCore.cs:171:34:171:42 | "tainted" : String | EntityFrameworkCore.cs:169:33:172:21 | { ..., ... } [property Street] : String |
+| EntityFrameworkCore.cs:175:13:175:15 | [post] access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String | EntityFrameworkCore.cs:176:13:176:15 | access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String |
+| EntityFrameworkCore.cs:175:13:175:15 | [post] access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String | EntityFrameworkCore.cs:180:13:180:15 | access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String |
+| EntityFrameworkCore.cs:175:13:175:15 | [post] access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String | EntityFrameworkCore.cs:188:13:188:15 | access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String |
+| EntityFrameworkCore.cs:175:13:175:15 | [post] access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String | EntityFrameworkCore.cs:192:13:192:15 | access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String |
+| EntityFrameworkCore.cs:175:13:175:23 | [post] access to property Persons [element, property Addresses, element, property Street] : String | EntityFrameworkCore.cs:175:13:175:15 | [post] access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String |
+| EntityFrameworkCore.cs:175:29:175:30 | access to local variable p1 [property Addresses, element, property Street] : String | EntityFrameworkCore.cs:175:13:175:23 | [post] access to property Persons [element, property Addresses, element, property Street] : String |
+| EntityFrameworkCore.cs:176:13:176:15 | access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String | ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [property Persons, element, property Addresses, element, property Street] : String |
+| EntityFrameworkCore.cs:180:13:180:15 | access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String | ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [property Persons, element, property Addresses, element, property Street] : String |
+| EntityFrameworkCore.cs:183:13:186:13 | { ..., ... } [property Street] : String | EntityFrameworkCore.cs:187:31:187:32 | access to local variable a1 [property Street] : String |
+| EntityFrameworkCore.cs:185:26:185:34 | "tainted" : String | EntityFrameworkCore.cs:183:13:186:13 | { ..., ... } [property Street] : String |
+| EntityFrameworkCore.cs:187:13:187:15 | [post] access to local variable ctx [property Addresses, element, property Street] : String | EntityFrameworkCore.cs:188:13:188:15 | access to local variable ctx [property Addresses, element, property Street] : String |
+| EntityFrameworkCore.cs:187:13:187:15 | [post] access to local variable ctx [property Addresses, element, property Street] : String | EntityFrameworkCore.cs:192:13:192:15 | access to local variable ctx [property Addresses, element, property Street] : String |
+| EntityFrameworkCore.cs:187:13:187:25 | [post] access to property Addresses [element, property Street] : String | EntityFrameworkCore.cs:187:13:187:15 | [post] access to local variable ctx [property Addresses, element, property Street] : String |
+| EntityFrameworkCore.cs:187:31:187:32 | access to local variable a1 [property Street] : String | EntityFrameworkCore.cs:187:13:187:25 | [post] access to property Addresses [element, property Street] : String |
+| EntityFrameworkCore.cs:188:13:188:15 | access to local variable ctx [property Addresses, element, property Street] : String | ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [property Addresses, element, property Street] : String |
+| EntityFrameworkCore.cs:188:13:188:15 | access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String | ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [property Persons, element, property Addresses, element, property Street] : String |
+| EntityFrameworkCore.cs:192:13:192:15 | access to local variable ctx [property Addresses, element, property Street] : String | ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [property Addresses, element, property Street] : String |
+| EntityFrameworkCore.cs:192:13:192:15 | access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String | ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [property Persons, element, property Addresses, element, property Street] : String |
+| EntityFrameworkCore.cs:199:13:202:13 | { ..., ... } [property Name] : String | EntityFrameworkCore.cs:208:71:208:72 | access to local variable p1 [property Name] : String |
+| EntityFrameworkCore.cs:201:24:201:32 | "tainted" : String | EntityFrameworkCore.cs:199:13:202:13 | { ..., ... } [property Name] : String |
+| EntityFrameworkCore.cs:204:13:207:13 | { ..., ... } [property Street] : String | EntityFrameworkCore.cs:208:85:208:86 | access to local variable a1 [property Street] : String |
+| EntityFrameworkCore.cs:206:26:206:34 | "tainted" : String | EntityFrameworkCore.cs:204:13:207:13 | { ..., ... } [property Street] : String |
+| EntityFrameworkCore.cs:208:60:208:88 | { ..., ... } [property Address, property Street] : String | EntityFrameworkCore.cs:209:37:209:53 | access to local variable personAddressMap1 [property Address, property Street] : String |
+| EntityFrameworkCore.cs:208:60:208:88 | { ..., ... } [property Person, property Name] : String | EntityFrameworkCore.cs:209:37:209:53 | access to local variable personAddressMap1 [property Person, property Name] : String |
+| EntityFrameworkCore.cs:208:71:208:72 | access to local variable p1 [property Name] : String | EntityFrameworkCore.cs:208:60:208:88 | { ..., ... } [property Person, property Name] : String |
+| EntityFrameworkCore.cs:208:85:208:86 | access to local variable a1 [property Street] : String | EntityFrameworkCore.cs:208:60:208:88 | { ..., ... } [property Address, property Street] : String |
+| EntityFrameworkCore.cs:209:13:209:15 | [post] access to local variable ctx [property PersonAddresses, element, property Address, property Street] : String | EntityFrameworkCore.cs:210:13:210:15 | access to local variable ctx [property PersonAddresses, element, property Address, property Street] : String |
+| EntityFrameworkCore.cs:209:13:209:15 | [post] access to local variable ctx [property PersonAddresses, element, property Address, property Street] : String | EntityFrameworkCore.cs:216:13:216:15 | access to local variable ctx [property PersonAddresses, element, property Address, property Street] : String |
+| EntityFrameworkCore.cs:209:13:209:15 | [post] access to local variable ctx [property PersonAddresses, element, property Person, property Name] : String | EntityFrameworkCore.cs:210:13:210:15 | access to local variable ctx [property PersonAddresses, element, property Person, property Name] : String |
+| EntityFrameworkCore.cs:209:13:209:15 | [post] access to local variable ctx [property PersonAddresses, element, property Person, property Name] : String | EntityFrameworkCore.cs:216:13:216:15 | access to local variable ctx [property PersonAddresses, element, property Person, property Name] : String |
+| EntityFrameworkCore.cs:209:13:209:31 | [post] access to property PersonAddresses [element, property Address, property Street] : String | EntityFrameworkCore.cs:209:13:209:15 | [post] access to local variable ctx [property PersonAddresses, element, property Address, property Street] : String |
+| EntityFrameworkCore.cs:209:13:209:31 | [post] access to property PersonAddresses [element, property Person, property Name] : String | EntityFrameworkCore.cs:209:13:209:15 | [post] access to local variable ctx [property PersonAddresses, element, property Person, property Name] : String |
+| EntityFrameworkCore.cs:209:37:209:53 | access to local variable personAddressMap1 [property Address, property Street] : String | EntityFrameworkCore.cs:209:13:209:31 | [post] access to property PersonAddresses [element, property Address, property Street] : String |
+| EntityFrameworkCore.cs:209:37:209:53 | access to local variable personAddressMap1 [property Person, property Name] : String | EntityFrameworkCore.cs:209:13:209:31 | [post] access to property PersonAddresses [element, property Person, property Name] : String |
+| EntityFrameworkCore.cs:210:13:210:15 | access to local variable ctx [property PersonAddresses, element, property Address, property Street] : String | ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [property PersonAddresses, element, property Address, property Street] : String |
+| EntityFrameworkCore.cs:210:13:210:15 | access to local variable ctx [property PersonAddresses, element, property Person, property Name] : String | ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [property PersonAddresses, element, property Person, property Name] : String |
+| EntityFrameworkCore.cs:216:13:216:15 | access to local variable ctx [property PersonAddresses, element, property Address, property Street] : String | ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [property PersonAddresses, element, property Address, property Street] : String |
+| EntityFrameworkCore.cs:216:13:216:15 | access to local variable ctx [property PersonAddresses, element, property Person, property Name] : String | ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [property PersonAddresses, element, property Person, property Name] : String |
+| EntityFrameworkCore.cs:219:35:219:35 | p [property Name] : String | EntityFrameworkCore.cs:222:29:222:29 | access to parameter p [property Name] : String |
+| EntityFrameworkCore.cs:222:13:222:15 | [post] access to local variable ctx [property Persons, element, property Name] : String | EntityFrameworkCore.cs:223:13:223:15 | access to local variable ctx [property Persons, element, property Name] : String |
+| EntityFrameworkCore.cs:222:13:222:23 | [post] access to property Persons [element, property Name] : String | EntityFrameworkCore.cs:222:13:222:15 | [post] access to local variable ctx [property Persons, element, property Name] : String |
+| EntityFrameworkCore.cs:222:29:222:29 | access to parameter p [property Name] : String | EntityFrameworkCore.cs:222:13:222:23 | [post] access to property Persons [element, property Name] : String |
+| EntityFrameworkCore.cs:223:13:223:15 | access to local variable ctx [property Persons, element, property Name] : String | ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [property Persons, element, property Name] : String |
+| EntityFrameworkCore.cs:230:18:230:28 | access to property Persons [element, property Name] : String | EntityFrameworkCore.cs:230:18:230:36 | call to method First [property Name] : String |
+| EntityFrameworkCore.cs:230:18:230:36 | call to method First [property Name] : String | EntityFrameworkCore.cs:230:18:230:41 | access to property Name |
+| EntityFrameworkCore.cs:238:18:238:30 | access to property Addresses [element, property Street] : String | EntityFrameworkCore.cs:238:18:238:38 | call to method First [property Street] : String |
+| EntityFrameworkCore.cs:238:18:238:38 | call to method First [property Street] : String | EntityFrameworkCore.cs:238:18:238:45 | access to property Street |
+| EntityFrameworkCore.cs:245:18:245:28 | access to property Persons [element, property Addresses, element, property Street] : String | EntityFrameworkCore.cs:245:18:245:36 | call to method First [property Addresses, element, property Street] : String |
+| EntityFrameworkCore.cs:245:18:245:36 | call to method First [property Addresses, element, property Street] : String | EntityFrameworkCore.cs:245:18:245:46 | access to property Addresses [element, property Street] : String |
+| EntityFrameworkCore.cs:245:18:245:46 | access to property Addresses [element, property Street] : String | EntityFrameworkCore.cs:245:18:245:54 | call to method First [property Street] : String |
+| EntityFrameworkCore.cs:245:18:245:54 | call to method First [property Street] : String | EntityFrameworkCore.cs:245:18:245:61 | access to property Street |
 nodes
-| ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [Addresses, [], Street] : String | semmle.label | this [Addresses, [], Street] : String |
-| ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [PersonAddresses, [], Address, Street] : String | semmle.label | this [PersonAddresses, [], Address, Street] : String |
-| ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [PersonAddresses, [], Person, Name] : String | semmle.label | this [PersonAddresses, [], Person, Name] : String |
-| ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [Persons, [], Addresses, [], Street] : String | semmle.label | this [Persons, [], Addresses, [], Street] : String |
-| ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [Persons, [], Name] : String | semmle.label | this [Persons, [], Name] : String |
-| ../../../resources/stubs/EntityFramework.cs:41:49:41:64 | this [Persons, [], Name] : String | semmle.label | this [Persons, [], Name] : String |
-| ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [Addresses, [], Street] : String | semmle.label | this [Addresses, [], Street] : String |
-| ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [PersonAddresses, [], Address, Street] : String | semmle.label | this [PersonAddresses, [], Address, Street] : String |
-| ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [PersonAddresses, [], Person, Name] : String | semmle.label | this [PersonAddresses, [], Person, Name] : String |
-| ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [Persons, [], Addresses, [], Street] : String | semmle.label | this [Persons, [], Addresses, [], Street] : String |
-| ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [Persons, [], Name] : String | semmle.label | this [Persons, [], Name] : String |
-| ../../../resources/stubs/EntityFramework.cs:81:49:81:64 | this [Persons, [], Name] : String | semmle.label | this [Persons, [], Name] : String |
-| EntityFramework.cs:61:13:64:13 | { ..., ... } [Name] : String | semmle.label | { ..., ... } [Name] : String |
+| ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [property Addresses, element, property Street] : String | semmle.label | this [property Addresses, element, property Street] : String |
+| ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [property PersonAddresses, element, property Address, property Street] : String | semmle.label | this [property PersonAddresses, element, property Address, property Street] : String |
+| ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [property PersonAddresses, element, property Person, property Name] : String | semmle.label | this [property PersonAddresses, element, property Person, property Name] : String |
+| ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [property Persons, element, property Addresses, element, property Street] : String | semmle.label | this [property Persons, element, property Addresses, element, property Street] : String |
+| ../../../resources/stubs/EntityFramework.cs:40:20:40:30 | this [property Persons, element, property Name] : String | semmle.label | this [property Persons, element, property Name] : String |
+| ../../../resources/stubs/EntityFramework.cs:41:49:41:64 | this [property Persons, element, property Name] : String | semmle.label | this [property Persons, element, property Name] : String |
+| ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [property Addresses, element, property Street] : String | semmle.label | this [property Addresses, element, property Street] : String |
+| ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [property PersonAddresses, element, property Address, property Street] : String | semmle.label | this [property PersonAddresses, element, property Address, property Street] : String |
+| ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [property PersonAddresses, element, property Person, property Name] : String | semmle.label | this [property PersonAddresses, element, property Person, property Name] : String |
+| ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [property Persons, element, property Addresses, element, property Street] : String | semmle.label | this [property Persons, element, property Addresses, element, property Street] : String |
+| ../../../resources/stubs/EntityFramework.cs:80:20:80:30 | this [property Persons, element, property Name] : String | semmle.label | this [property Persons, element, property Name] : String |
+| ../../../resources/stubs/EntityFramework.cs:81:49:81:64 | this [property Persons, element, property Name] : String | semmle.label | this [property Persons, element, property Name] : String |
+| EntityFramework.cs:61:13:64:13 | { ..., ... } [property Name] : String | semmle.label | { ..., ... } [property Name] : String |
 | EntityFramework.cs:63:24:63:32 | "tainted" : String | semmle.label | "tainted" : String |
-| EntityFramework.cs:68:13:68:15 | [post] access to local variable ctx [Persons, [], Name] : String | semmle.label | [post] access to local variable ctx [Persons, [], Name] : String |
-| EntityFramework.cs:68:13:68:23 | [post] access to property Persons [[], Name] : String | semmle.label | [post] access to property Persons [[], Name] : String |
-| EntityFramework.cs:68:29:68:30 | access to local variable p1 [Name] : String | semmle.label | access to local variable p1 [Name] : String |
-| EntityFramework.cs:70:13:70:15 | access to local variable ctx [Persons, [], Name] : String | semmle.label | access to local variable ctx [Persons, [], Name] : String |
-| EntityFramework.cs:83:13:86:13 | { ..., ... } [Name] : String | semmle.label | { ..., ... } [Name] : String |
+| EntityFramework.cs:68:13:68:15 | [post] access to local variable ctx [property Persons, element, property Name] : String | semmle.label | [post] access to local variable ctx [property Persons, element, property Name] : String |
+| EntityFramework.cs:68:13:68:23 | [post] access to property Persons [element, property Name] : String | semmle.label | [post] access to property Persons [element, property Name] : String |
+| EntityFramework.cs:68:29:68:30 | access to local variable p1 [property Name] : String | semmle.label | access to local variable p1 [property Name] : String |
+| EntityFramework.cs:70:13:70:15 | access to local variable ctx [property Persons, element, property Name] : String | semmle.label | access to local variable ctx [property Persons, element, property Name] : String |
+| EntityFramework.cs:83:13:86:13 | { ..., ... } [property Name] : String | semmle.label | { ..., ... } [property Name] : String |
 | EntityFramework.cs:85:24:85:32 | "tainted" : String | semmle.label | "tainted" : String |
-| EntityFramework.cs:90:13:90:15 | [post] access to local variable ctx [Persons, [], Name] : String | semmle.label | [post] access to local variable ctx [Persons, [], Name] : String |
-| EntityFramework.cs:90:13:90:23 | [post] access to property Persons [[], Name] : String | semmle.label | [post] access to property Persons [[], Name] : String |
-| EntityFramework.cs:90:29:90:30 | access to local variable p1 [Name] : String | semmle.label | access to local variable p1 [Name] : String |
-| EntityFramework.cs:92:19:92:21 | access to local variable ctx [Persons, [], Name] : String | semmle.label | access to local variable ctx [Persons, [], Name] : String |
-| EntityFramework.cs:105:13:108:13 | { ..., ... } [Name] : String | semmle.label | { ..., ... } [Name] : String |
+| EntityFramework.cs:90:13:90:15 | [post] access to local variable ctx [property Persons, element, property Name] : String | semmle.label | [post] access to local variable ctx [property Persons, element, property Name] : String |
+| EntityFramework.cs:90:13:90:23 | [post] access to property Persons [element, property Name] : String | semmle.label | [post] access to property Persons [element, property Name] : String |
+| EntityFramework.cs:90:29:90:30 | access to local variable p1 [property Name] : String | semmle.label | access to local variable p1 [property Name] : String |
+| EntityFramework.cs:92:19:92:21 | access to local variable ctx [property Persons, element, property Name] : String | semmle.label | access to local variable ctx [property Persons, element, property Name] : String |
+| EntityFramework.cs:105:13:108:13 | { ..., ... } [property Name] : String | semmle.label | { ..., ... } [property Name] : String |
 | EntityFramework.cs:107:24:107:32 | "tainted" : String | semmle.label | "tainted" : String |
-| EntityFramework.cs:111:27:111:28 | access to local variable p1 [Name] : String | semmle.label | access to local variable p1 [Name] : String |
-| EntityFramework.cs:124:13:127:13 | { ..., ... } [Title] : String | semmle.label | { ..., ... } [Title] : String |
+| EntityFramework.cs:111:27:111:28 | access to local variable p1 [property Name] : String | semmle.label | access to local variable p1 [property Name] : String |
+| EntityFramework.cs:124:13:127:13 | { ..., ... } [property Title] : String | semmle.label | { ..., ... } [property Title] : String |
 | EntityFramework.cs:126:25:126:33 | "tainted" : String | semmle.label | "tainted" : String |
-| EntityFramework.cs:131:18:131:19 | access to local variable p1 [Title] : String | semmle.label | access to local variable p1 [Title] : String |
+| EntityFramework.cs:131:18:131:19 | access to local variable p1 [property Title] : String | semmle.label | access to local variable p1 [property Title] : String |
 | EntityFramework.cs:131:18:131:25 | access to property Title | semmle.label | access to property Title |
-| EntityFramework.cs:143:13:150:13 | { ..., ... } [Addresses, [], Street] : String | semmle.label | { ..., ... } [Addresses, [], Street] : String |
-| EntityFramework.cs:144:29:149:17 | array creation of type Address[] [[], Street] : String | semmle.label | array creation of type Address[] [[], Street] : String |
-| EntityFramework.cs:144:35:149:17 | { ..., ... } [[], Street] : String | semmle.label | { ..., ... } [[], Street] : String |
-| EntityFramework.cs:145:21:148:21 | object creation of type Address [Street] : String | semmle.label | object creation of type Address [Street] : String |
-| EntityFramework.cs:145:33:148:21 | { ..., ... } [Street] : String | semmle.label | { ..., ... } [Street] : String |
+| EntityFramework.cs:143:13:150:13 | { ..., ... } [property Addresses, element, property Street] : String | semmle.label | { ..., ... } [property Addresses, element, property Street] : String |
+| EntityFramework.cs:144:29:149:17 | array creation of type Address[] [element, property Street] : String | semmle.label | array creation of type Address[] [element, property Street] : String |
+| EntityFramework.cs:144:35:149:17 | { ..., ... } [element, property Street] : String | semmle.label | { ..., ... } [element, property Street] : String |
+| EntityFramework.cs:145:21:148:21 | object creation of type Address [property Street] : String | semmle.label | object creation of type Address [property Street] : String |
+| EntityFramework.cs:145:33:148:21 | { ..., ... } [property Street] : String | semmle.label | { ..., ... } [property Street] : String |
 | EntityFramework.cs:147:34:147:42 | "tainted" : String | semmle.label | "tainted" : String |
-| EntityFramework.cs:151:13:151:15 | [post] access to local variable ctx [Persons, [], Addresses, [], Street] : String | semmle.label | [post] access to local variable ctx [Persons, [], Addresses, [], Street] : String |
-| EntityFramework.cs:151:13:151:23 | [post] access to property Persons [[], Addresses, [], Street] : String | semmle.label | [post] access to property Persons [[], Addresses, [], Street] : String |
-| EntityFramework.cs:151:29:151:30 | access to local variable p1 [Addresses, [], Street] : String | semmle.label | access to local variable p1 [Addresses, [], Street] : String |
-| EntityFramework.cs:152:13:152:15 | access to local variable ctx [Persons, [], Addresses, [], Street] : String | semmle.label | access to local variable ctx [Persons, [], Addresses, [], Street] : String |
-| EntityFramework.cs:156:13:156:15 | access to local variable ctx [Persons, [], Addresses, [], Street] : String | semmle.label | access to local variable ctx [Persons, [], Addresses, [], Street] : String |
-| EntityFramework.cs:159:13:162:13 | { ..., ... } [Street] : String | semmle.label | { ..., ... } [Street] : String |
+| EntityFramework.cs:151:13:151:15 | [post] access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String | semmle.label | [post] access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String |
+| EntityFramework.cs:151:13:151:23 | [post] access to property Persons [element, property Addresses, element, property Street] : String | semmle.label | [post] access to property Persons [element, property Addresses, element, property Street] : String |
+| EntityFramework.cs:151:29:151:30 | access to local variable p1 [property Addresses, element, property Street] : String | semmle.label | access to local variable p1 [property Addresses, element, property Street] : String |
+| EntityFramework.cs:152:13:152:15 | access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String | semmle.label | access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String |
+| EntityFramework.cs:156:13:156:15 | access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String | semmle.label | access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String |
+| EntityFramework.cs:159:13:162:13 | { ..., ... } [property Street] : String | semmle.label | { ..., ... } [property Street] : String |
 | EntityFramework.cs:161:26:161:34 | "tainted" : String | semmle.label | "tainted" : String |
-| EntityFramework.cs:163:13:163:15 | [post] access to local variable ctx [Addresses, [], Street] : String | semmle.label | [post] access to local variable ctx [Addresses, [], Street] : String |
-| EntityFramework.cs:163:13:163:25 | [post] access to property Addresses [[], Street] : String | semmle.label | [post] access to property Addresses [[], Street] : String |
-| EntityFramework.cs:163:31:163:32 | access to local variable a1 [Street] : String | semmle.label | access to local variable a1 [Street] : String |
-| EntityFramework.cs:164:13:164:15 | access to local variable ctx [Addresses, [], Street] : String | semmle.label | access to local variable ctx [Addresses, [], Street] : String |
-| EntityFramework.cs:164:13:164:15 | access to local variable ctx [Persons, [], Addresses, [], Street] : String | semmle.label | access to local variable ctx [Persons, [], Addresses, [], Street] : String |
-| EntityFramework.cs:168:13:168:15 | access to local variable ctx [Addresses, [], Street] : String | semmle.label | access to local variable ctx [Addresses, [], Street] : String |
-| EntityFramework.cs:168:13:168:15 | access to local variable ctx [Persons, [], Addresses, [], Street] : String | semmle.label | access to local variable ctx [Persons, [], Addresses, [], Street] : String |
-| EntityFramework.cs:175:13:178:13 | { ..., ... } [Name] : String | semmle.label | { ..., ... } [Name] : String |
+| EntityFramework.cs:163:13:163:15 | [post] access to local variable ctx [property Addresses, element, property Street] : String | semmle.label | [post] access to local variable ctx [property Addresses, element, property Street] : String |
+| EntityFramework.cs:163:13:163:25 | [post] access to property Addresses [element, property Street] : String | semmle.label | [post] access to property Addresses [element, property Street] : String |
+| EntityFramework.cs:163:31:163:32 | access to local variable a1 [property Street] : String | semmle.label | access to local variable a1 [property Street] : String |
+| EntityFramework.cs:164:13:164:15 | access to local variable ctx [property Addresses, element, property Street] : String | semmle.label | access to local variable ctx [property Addresses, element, property Street] : String |
+| EntityFramework.cs:164:13:164:15 | access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String | semmle.label | access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String |
+| EntityFramework.cs:168:13:168:15 | access to local variable ctx [property Addresses, element, property Street] : String | semmle.label | access to local variable ctx [property Addresses, element, property Street] : String |
+| EntityFramework.cs:168:13:168:15 | access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String | semmle.label | access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String |
+| EntityFramework.cs:175:13:178:13 | { ..., ... } [property Name] : String | semmle.label | { ..., ... } [property Name] : String |
 | EntityFramework.cs:177:24:177:32 | "tainted" : String | semmle.label | "tainted" : String |
-| EntityFramework.cs:180:13:183:13 | { ..., ... } [Street] : String | semmle.label | { ..., ... } [Street] : String |
+| EntityFramework.cs:180:13:183:13 | { ..., ... } [property Street] : String | semmle.label | { ..., ... } [property Street] : String |
 | EntityFramework.cs:182:26:182:34 | "tainted" : String | semmle.label | "tainted" : String |
-| EntityFramework.cs:184:60:184:88 | { ..., ... } [Address, Street] : String | semmle.label | { ..., ... } [Address, Street] : String |
-| EntityFramework.cs:184:60:184:88 | { ..., ... } [Person, Name] : String | semmle.label | { ..., ... } [Person, Name] : String |
-| EntityFramework.cs:184:71:184:72 | access to local variable p1 [Name] : String | semmle.label | access to local variable p1 [Name] : String |
-| EntityFramework.cs:184:85:184:86 | access to local variable a1 [Street] : String | semmle.label | access to local variable a1 [Street] : String |
-| EntityFramework.cs:185:13:185:15 | [post] access to local variable ctx [PersonAddresses, [], Address, Street] : String | semmle.label | [post] access to local variable ctx [PersonAddresses, [], Address, Street] : String |
-| EntityFramework.cs:185:13:185:15 | [post] access to local variable ctx [PersonAddresses, [], Person, Name] : String | semmle.label | [post] access to local variable ctx [PersonAddresses, [], Person, Name] : String |
-| EntityFramework.cs:185:13:185:31 | [post] access to property PersonAddresses [[], Address, Street] : String | semmle.label | [post] access to property PersonAddresses [[], Address, Street] : String |
-| EntityFramework.cs:185:13:185:31 | [post] access to property PersonAddresses [[], Person, Name] : String | semmle.label | [post] access to property PersonAddresses [[], Person, Name] : String |
-| EntityFramework.cs:185:37:185:53 | access to local variable personAddressMap1 [Address, Street] : String | semmle.label | access to local variable personAddressMap1 [Address, Street] : String |
-| EntityFramework.cs:185:37:185:53 | access to local variable personAddressMap1 [Person, Name] : String | semmle.label | access to local variable personAddressMap1 [Person, Name] : String |
-| EntityFramework.cs:186:13:186:15 | access to local variable ctx [PersonAddresses, [], Address, Street] : String | semmle.label | access to local variable ctx [PersonAddresses, [], Address, Street] : String |
-| EntityFramework.cs:186:13:186:15 | access to local variable ctx [PersonAddresses, [], Person, Name] : String | semmle.label | access to local variable ctx [PersonAddresses, [], Person, Name] : String |
-| EntityFramework.cs:192:13:192:15 | access to local variable ctx [PersonAddresses, [], Address, Street] : String | semmle.label | access to local variable ctx [PersonAddresses, [], Address, Street] : String |
-| EntityFramework.cs:192:13:192:15 | access to local variable ctx [PersonAddresses, [], Person, Name] : String | semmle.label | access to local variable ctx [PersonAddresses, [], Person, Name] : String |
-| EntityFramework.cs:195:35:195:35 | p [Name] : String | semmle.label | p [Name] : String |
-| EntityFramework.cs:198:13:198:15 | [post] access to local variable ctx [Persons, [], Name] : String | semmle.label | [post] access to local variable ctx [Persons, [], Name] : String |
-| EntityFramework.cs:198:13:198:23 | [post] access to property Persons [[], Name] : String | semmle.label | [post] access to property Persons [[], Name] : String |
-| EntityFramework.cs:198:29:198:29 | access to parameter p [Name] : String | semmle.label | access to parameter p [Name] : String |
-| EntityFramework.cs:199:13:199:15 | access to local variable ctx [Persons, [], Name] : String | semmle.label | access to local variable ctx [Persons, [], Name] : String |
-| EntityFramework.cs:206:18:206:28 | access to property Persons [[], Name] : String | semmle.label | access to property Persons [[], Name] : String |
-| EntityFramework.cs:206:18:206:36 | call to method First [Name] : String | semmle.label | call to method First [Name] : String |
+| EntityFramework.cs:184:60:184:88 | { ..., ... } [property Address, property Street] : String | semmle.label | { ..., ... } [property Address, property Street] : String |
+| EntityFramework.cs:184:60:184:88 | { ..., ... } [property Person, property Name] : String | semmle.label | { ..., ... } [property Person, property Name] : String |
+| EntityFramework.cs:184:71:184:72 | access to local variable p1 [property Name] : String | semmle.label | access to local variable p1 [property Name] : String |
+| EntityFramework.cs:184:85:184:86 | access to local variable a1 [property Street] : String | semmle.label | access to local variable a1 [property Street] : String |
+| EntityFramework.cs:185:13:185:15 | [post] access to local variable ctx [property PersonAddresses, element, property Address, property Street] : String | semmle.label | [post] access to local variable ctx [property PersonAddresses, element, property Address, property Street] : String |
+| EntityFramework.cs:185:13:185:15 | [post] access to local variable ctx [property PersonAddresses, element, property Person, property Name] : String | semmle.label | [post] access to local variable ctx [property PersonAddresses, element, property Person, property Name] : String |
+| EntityFramework.cs:185:13:185:31 | [post] access to property PersonAddresses [element, property Address, property Street] : String | semmle.label | [post] access to property PersonAddresses [element, property Address, property Street] : String |
+| EntityFramework.cs:185:13:185:31 | [post] access to property PersonAddresses [element, property Person, property Name] : String | semmle.label | [post] access to property PersonAddresses [element, property Person, property Name] : String |
+| EntityFramework.cs:185:37:185:53 | access to local variable personAddressMap1 [property Address, property Street] : String | semmle.label | access to local variable personAddressMap1 [property Address, property Street] : String |
+| EntityFramework.cs:185:37:185:53 | access to local variable personAddressMap1 [property Person, property Name] : String | semmle.label | access to local variable personAddressMap1 [property Person, property Name] : String |
+| EntityFramework.cs:186:13:186:15 | access to local variable ctx [property PersonAddresses, element, property Address, property Street] : String | semmle.label | access to local variable ctx [property PersonAddresses, element, property Address, property Street] : String |
+| EntityFramework.cs:186:13:186:15 | access to local variable ctx [property PersonAddresses, element, property Person, property Name] : String | semmle.label | access to local variable ctx [property PersonAddresses, element, property Person, property Name] : String |
+| EntityFramework.cs:192:13:192:15 | access to local variable ctx [property PersonAddresses, element, property Address, property Street] : String | semmle.label | access to local variable ctx [property PersonAddresses, element, property Address, property Street] : String |
+| EntityFramework.cs:192:13:192:15 | access to local variable ctx [property PersonAddresses, element, property Person, property Name] : String | semmle.label | access to local variable ctx [property PersonAddresses, element, property Person, property Name] : String |
+| EntityFramework.cs:195:35:195:35 | p [property Name] : String | semmle.label | p [property Name] : String |
+| EntityFramework.cs:198:13:198:15 | [post] access to local variable ctx [property Persons, element, property Name] : String | semmle.label | [post] access to local variable ctx [property Persons, element, property Name] : String |
+| EntityFramework.cs:198:13:198:23 | [post] access to property Persons [element, property Name] : String | semmle.label | [post] access to property Persons [element, property Name] : String |
+| EntityFramework.cs:198:29:198:29 | access to parameter p [property Name] : String | semmle.label | access to parameter p [property Name] : String |
+| EntityFramework.cs:199:13:199:15 | access to local variable ctx [property Persons, element, property Name] : String | semmle.label | access to local variable ctx [property Persons, element, property Name] : String |
+| EntityFramework.cs:206:18:206:28 | access to property Persons [element, property Name] : String | semmle.label | access to property Persons [element, property Name] : String |
+| EntityFramework.cs:206:18:206:36 | call to method First [property Name] : String | semmle.label | call to method First [property Name] : String |
 | EntityFramework.cs:206:18:206:41 | access to property Name | semmle.label | access to property Name |
-| EntityFramework.cs:214:18:214:30 | access to property Addresses [[], Street] : String | semmle.label | access to property Addresses [[], Street] : String |
-| EntityFramework.cs:214:18:214:38 | call to method First [Street] : String | semmle.label | call to method First [Street] : String |
+| EntityFramework.cs:214:18:214:30 | access to property Addresses [element, property Street] : String | semmle.label | access to property Addresses [element, property Street] : String |
+| EntityFramework.cs:214:18:214:38 | call to method First [property Street] : String | semmle.label | call to method First [property Street] : String |
 | EntityFramework.cs:214:18:214:45 | access to property Street | semmle.label | access to property Street |
-| EntityFramework.cs:221:18:221:28 | access to property Persons [[], Addresses, [], Street] : String | semmle.label | access to property Persons [[], Addresses, [], Street] : String |
-| EntityFramework.cs:221:18:221:36 | call to method First [Addresses, [], Street] : String | semmle.label | call to method First [Addresses, [], Street] : String |
-| EntityFramework.cs:221:18:221:46 | access to property Addresses [[], Street] : String | semmle.label | access to property Addresses [[], Street] : String |
-| EntityFramework.cs:221:18:221:54 | call to method First [Street] : String | semmle.label | call to method First [Street] : String |
+| EntityFramework.cs:221:18:221:28 | access to property Persons [element, property Addresses, element, property Street] : String | semmle.label | access to property Persons [element, property Addresses, element, property Street] : String |
+| EntityFramework.cs:221:18:221:36 | call to method First [property Addresses, element, property Street] : String | semmle.label | call to method First [property Addresses, element, property Street] : String |
+| EntityFramework.cs:221:18:221:46 | access to property Addresses [element, property Street] : String | semmle.label | access to property Addresses [element, property Street] : String |
+| EntityFramework.cs:221:18:221:54 | call to method First [property Street] : String | semmle.label | call to method First [property Street] : String |
 | EntityFramework.cs:221:18:221:61 | access to property Street | semmle.label | access to property Street |
 | EntityFrameworkCore.cs:75:31:75:39 | "tainted" : String | semmle.label | "tainted" : String |
 | EntityFrameworkCore.cs:76:18:76:28 | access to local variable taintSource | semmle.label | access to local variable taintSource |
@@ -268,78 +268,78 @@ nodes
 | EntityFrameworkCore.cs:78:18:78:42 | (...) ... | semmle.label | (...) ... |
 | EntityFrameworkCore.cs:78:18:78:42 | call to operator implicit conversion : RawSqlString | semmle.label | call to operator implicit conversion : RawSqlString |
 | EntityFrameworkCore.cs:78:32:78:42 | access to local variable taintSource : String | semmle.label | access to local variable taintSource : String |
-| EntityFrameworkCore.cs:85:13:88:13 | { ..., ... } [Name] : String | semmle.label | { ..., ... } [Name] : String |
+| EntityFrameworkCore.cs:85:13:88:13 | { ..., ... } [property Name] : String | semmle.label | { ..., ... } [property Name] : String |
 | EntityFrameworkCore.cs:87:24:87:32 | "tainted" : String | semmle.label | "tainted" : String |
-| EntityFrameworkCore.cs:92:13:92:15 | [post] access to local variable ctx [Persons, [], Name] : String | semmle.label | [post] access to local variable ctx [Persons, [], Name] : String |
-| EntityFrameworkCore.cs:92:13:92:23 | [post] access to property Persons [[], Name] : String | semmle.label | [post] access to property Persons [[], Name] : String |
-| EntityFrameworkCore.cs:92:29:92:30 | access to local variable p1 [Name] : String | semmle.label | access to local variable p1 [Name] : String |
-| EntityFrameworkCore.cs:94:13:94:15 | access to local variable ctx [Persons, [], Name] : String | semmle.label | access to local variable ctx [Persons, [], Name] : String |
-| EntityFrameworkCore.cs:107:13:110:13 | { ..., ... } [Name] : String | semmle.label | { ..., ... } [Name] : String |
+| EntityFrameworkCore.cs:92:13:92:15 | [post] access to local variable ctx [property Persons, element, property Name] : String | semmle.label | [post] access to local variable ctx [property Persons, element, property Name] : String |
+| EntityFrameworkCore.cs:92:13:92:23 | [post] access to property Persons [element, property Name] : String | semmle.label | [post] access to property Persons [element, property Name] : String |
+| EntityFrameworkCore.cs:92:29:92:30 | access to local variable p1 [property Name] : String | semmle.label | access to local variable p1 [property Name] : String |
+| EntityFrameworkCore.cs:94:13:94:15 | access to local variable ctx [property Persons, element, property Name] : String | semmle.label | access to local variable ctx [property Persons, element, property Name] : String |
+| EntityFrameworkCore.cs:107:13:110:13 | { ..., ... } [property Name] : String | semmle.label | { ..., ... } [property Name] : String |
 | EntityFrameworkCore.cs:109:24:109:32 | "tainted" : String | semmle.label | "tainted" : String |
-| EntityFrameworkCore.cs:114:13:114:15 | [post] access to local variable ctx [Persons, [], Name] : String | semmle.label | [post] access to local variable ctx [Persons, [], Name] : String |
-| EntityFrameworkCore.cs:114:13:114:23 | [post] access to property Persons [[], Name] : String | semmle.label | [post] access to property Persons [[], Name] : String |
-| EntityFrameworkCore.cs:114:29:114:30 | access to local variable p1 [Name] : String | semmle.label | access to local variable p1 [Name] : String |
-| EntityFrameworkCore.cs:116:19:116:21 | access to local variable ctx [Persons, [], Name] : String | semmle.label | access to local variable ctx [Persons, [], Name] : String |
-| EntityFrameworkCore.cs:129:13:132:13 | { ..., ... } [Name] : String | semmle.label | { ..., ... } [Name] : String |
+| EntityFrameworkCore.cs:114:13:114:15 | [post] access to local variable ctx [property Persons, element, property Name] : String | semmle.label | [post] access to local variable ctx [property Persons, element, property Name] : String |
+| EntityFrameworkCore.cs:114:13:114:23 | [post] access to property Persons [element, property Name] : String | semmle.label | [post] access to property Persons [element, property Name] : String |
+| EntityFrameworkCore.cs:114:29:114:30 | access to local variable p1 [property Name] : String | semmle.label | access to local variable p1 [property Name] : String |
+| EntityFrameworkCore.cs:116:19:116:21 | access to local variable ctx [property Persons, element, property Name] : String | semmle.label | access to local variable ctx [property Persons, element, property Name] : String |
+| EntityFrameworkCore.cs:129:13:132:13 | { ..., ... } [property Name] : String | semmle.label | { ..., ... } [property Name] : String |
 | EntityFrameworkCore.cs:131:24:131:32 | "tainted" : String | semmle.label | "tainted" : String |
-| EntityFrameworkCore.cs:135:27:135:28 | access to local variable p1 [Name] : String | semmle.label | access to local variable p1 [Name] : String |
-| EntityFrameworkCore.cs:148:13:151:13 | { ..., ... } [Title] : String | semmle.label | { ..., ... } [Title] : String |
+| EntityFrameworkCore.cs:135:27:135:28 | access to local variable p1 [property Name] : String | semmle.label | access to local variable p1 [property Name] : String |
+| EntityFrameworkCore.cs:148:13:151:13 | { ..., ... } [property Title] : String | semmle.label | { ..., ... } [property Title] : String |
 | EntityFrameworkCore.cs:150:25:150:33 | "tainted" : String | semmle.label | "tainted" : String |
-| EntityFrameworkCore.cs:155:18:155:19 | access to local variable p1 [Title] : String | semmle.label | access to local variable p1 [Title] : String |
+| EntityFrameworkCore.cs:155:18:155:19 | access to local variable p1 [property Title] : String | semmle.label | access to local variable p1 [property Title] : String |
 | EntityFrameworkCore.cs:155:18:155:25 | access to property Title | semmle.label | access to property Title |
-| EntityFrameworkCore.cs:167:13:174:13 | { ..., ... } [Addresses, [], Street] : String | semmle.label | { ..., ... } [Addresses, [], Street] : String |
-| EntityFrameworkCore.cs:168:29:173:17 | array creation of type Address[] [[], Street] : String | semmle.label | array creation of type Address[] [[], Street] : String |
-| EntityFrameworkCore.cs:168:35:173:17 | { ..., ... } [[], Street] : String | semmle.label | { ..., ... } [[], Street] : String |
-| EntityFrameworkCore.cs:169:21:172:21 | object creation of type Address [Street] : String | semmle.label | object creation of type Address [Street] : String |
-| EntityFrameworkCore.cs:169:33:172:21 | { ..., ... } [Street] : String | semmle.label | { ..., ... } [Street] : String |
+| EntityFrameworkCore.cs:167:13:174:13 | { ..., ... } [property Addresses, element, property Street] : String | semmle.label | { ..., ... } [property Addresses, element, property Street] : String |
+| EntityFrameworkCore.cs:168:29:173:17 | array creation of type Address[] [element, property Street] : String | semmle.label | array creation of type Address[] [element, property Street] : String |
+| EntityFrameworkCore.cs:168:35:173:17 | { ..., ... } [element, property Street] : String | semmle.label | { ..., ... } [element, property Street] : String |
+| EntityFrameworkCore.cs:169:21:172:21 | object creation of type Address [property Street] : String | semmle.label | object creation of type Address [property Street] : String |
+| EntityFrameworkCore.cs:169:33:172:21 | { ..., ... } [property Street] : String | semmle.label | { ..., ... } [property Street] : String |
 | EntityFrameworkCore.cs:171:34:171:42 | "tainted" : String | semmle.label | "tainted" : String |
-| EntityFrameworkCore.cs:175:13:175:15 | [post] access to local variable ctx [Persons, [], Addresses, [], Street] : String | semmle.label | [post] access to local variable ctx [Persons, [], Addresses, [], Street] : String |
-| EntityFrameworkCore.cs:175:13:175:23 | [post] access to property Persons [[], Addresses, [], Street] : String | semmle.label | [post] access to property Persons [[], Addresses, [], Street] : String |
-| EntityFrameworkCore.cs:175:29:175:30 | access to local variable p1 [Addresses, [], Street] : String | semmle.label | access to local variable p1 [Addresses, [], Street] : String |
-| EntityFrameworkCore.cs:176:13:176:15 | access to local variable ctx [Persons, [], Addresses, [], Street] : String | semmle.label | access to local variable ctx [Persons, [], Addresses, [], Street] : String |
-| EntityFrameworkCore.cs:180:13:180:15 | access to local variable ctx [Persons, [], Addresses, [], Street] : String | semmle.label | access to local variable ctx [Persons, [], Addresses, [], Street] : String |
-| EntityFrameworkCore.cs:183:13:186:13 | { ..., ... } [Street] : String | semmle.label | { ..., ... } [Street] : String |
+| EntityFrameworkCore.cs:175:13:175:15 | [post] access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String | semmle.label | [post] access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String |
+| EntityFrameworkCore.cs:175:13:175:23 | [post] access to property Persons [element, property Addresses, element, property Street] : String | semmle.label | [post] access to property Persons [element, property Addresses, element, property Street] : String |
+| EntityFrameworkCore.cs:175:29:175:30 | access to local variable p1 [property Addresses, element, property Street] : String | semmle.label | access to local variable p1 [property Addresses, element, property Street] : String |
+| EntityFrameworkCore.cs:176:13:176:15 | access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String | semmle.label | access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String |
+| EntityFrameworkCore.cs:180:13:180:15 | access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String | semmle.label | access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String |
+| EntityFrameworkCore.cs:183:13:186:13 | { ..., ... } [property Street] : String | semmle.label | { ..., ... } [property Street] : String |
 | EntityFrameworkCore.cs:185:26:185:34 | "tainted" : String | semmle.label | "tainted" : String |
-| EntityFrameworkCore.cs:187:13:187:15 | [post] access to local variable ctx [Addresses, [], Street] : String | semmle.label | [post] access to local variable ctx [Addresses, [], Street] : String |
-| EntityFrameworkCore.cs:187:13:187:25 | [post] access to property Addresses [[], Street] : String | semmle.label | [post] access to property Addresses [[], Street] : String |
-| EntityFrameworkCore.cs:187:31:187:32 | access to local variable a1 [Street] : String | semmle.label | access to local variable a1 [Street] : String |
-| EntityFrameworkCore.cs:188:13:188:15 | access to local variable ctx [Addresses, [], Street] : String | semmle.label | access to local variable ctx [Addresses, [], Street] : String |
-| EntityFrameworkCore.cs:188:13:188:15 | access to local variable ctx [Persons, [], Addresses, [], Street] : String | semmle.label | access to local variable ctx [Persons, [], Addresses, [], Street] : String |
-| EntityFrameworkCore.cs:192:13:192:15 | access to local variable ctx [Addresses, [], Street] : String | semmle.label | access to local variable ctx [Addresses, [], Street] : String |
-| EntityFrameworkCore.cs:192:13:192:15 | access to local variable ctx [Persons, [], Addresses, [], Street] : String | semmle.label | access to local variable ctx [Persons, [], Addresses, [], Street] : String |
-| EntityFrameworkCore.cs:199:13:202:13 | { ..., ... } [Name] : String | semmle.label | { ..., ... } [Name] : String |
+| EntityFrameworkCore.cs:187:13:187:15 | [post] access to local variable ctx [property Addresses, element, property Street] : String | semmle.label | [post] access to local variable ctx [property Addresses, element, property Street] : String |
+| EntityFrameworkCore.cs:187:13:187:25 | [post] access to property Addresses [element, property Street] : String | semmle.label | [post] access to property Addresses [element, property Street] : String |
+| EntityFrameworkCore.cs:187:31:187:32 | access to local variable a1 [property Street] : String | semmle.label | access to local variable a1 [property Street] : String |
+| EntityFrameworkCore.cs:188:13:188:15 | access to local variable ctx [property Addresses, element, property Street] : String | semmle.label | access to local variable ctx [property Addresses, element, property Street] : String |
+| EntityFrameworkCore.cs:188:13:188:15 | access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String | semmle.label | access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String |
+| EntityFrameworkCore.cs:192:13:192:15 | access to local variable ctx [property Addresses, element, property Street] : String | semmle.label | access to local variable ctx [property Addresses, element, property Street] : String |
+| EntityFrameworkCore.cs:192:13:192:15 | access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String | semmle.label | access to local variable ctx [property Persons, element, property Addresses, element, property Street] : String |
+| EntityFrameworkCore.cs:199:13:202:13 | { ..., ... } [property Name] : String | semmle.label | { ..., ... } [property Name] : String |
 | EntityFrameworkCore.cs:201:24:201:32 | "tainted" : String | semmle.label | "tainted" : String |
-| EntityFrameworkCore.cs:204:13:207:13 | { ..., ... } [Street] : String | semmle.label | { ..., ... } [Street] : String |
+| EntityFrameworkCore.cs:204:13:207:13 | { ..., ... } [property Street] : String | semmle.label | { ..., ... } [property Street] : String |
 | EntityFrameworkCore.cs:206:26:206:34 | "tainted" : String | semmle.label | "tainted" : String |
-| EntityFrameworkCore.cs:208:60:208:88 | { ..., ... } [Address, Street] : String | semmle.label | { ..., ... } [Address, Street] : String |
-| EntityFrameworkCore.cs:208:60:208:88 | { ..., ... } [Person, Name] : String | semmle.label | { ..., ... } [Person, Name] : String |
-| EntityFrameworkCore.cs:208:71:208:72 | access to local variable p1 [Name] : String | semmle.label | access to local variable p1 [Name] : String |
-| EntityFrameworkCore.cs:208:85:208:86 | access to local variable a1 [Street] : String | semmle.label | access to local variable a1 [Street] : String |
-| EntityFrameworkCore.cs:209:13:209:15 | [post] access to local variable ctx [PersonAddresses, [], Address, Street] : String | semmle.label | [post] access to local variable ctx [PersonAddresses, [], Address, Street] : String |
-| EntityFrameworkCore.cs:209:13:209:15 | [post] access to local variable ctx [PersonAddresses, [], Person, Name] : String | semmle.label | [post] access to local variable ctx [PersonAddresses, [], Person, Name] : String |
-| EntityFrameworkCore.cs:209:13:209:31 | [post] access to property PersonAddresses [[], Address, Street] : String | semmle.label | [post] access to property PersonAddresses [[], Address, Street] : String |
-| EntityFrameworkCore.cs:209:13:209:31 | [post] access to property PersonAddresses [[], Person, Name] : String | semmle.label | [post] access to property PersonAddresses [[], Person, Name] : String |
-| EntityFrameworkCore.cs:209:37:209:53 | access to local variable personAddressMap1 [Address, Street] : String | semmle.label | access to local variable personAddressMap1 [Address, Street] : String |
-| EntityFrameworkCore.cs:209:37:209:53 | access to local variable personAddressMap1 [Person, Name] : String | semmle.label | access to local variable personAddressMap1 [Person, Name] : String |
-| EntityFrameworkCore.cs:210:13:210:15 | access to local variable ctx [PersonAddresses, [], Address, Street] : String | semmle.label | access to local variable ctx [PersonAddresses, [], Address, Street] : String |
-| EntityFrameworkCore.cs:210:13:210:15 | access to local variable ctx [PersonAddresses, [], Person, Name] : String | semmle.label | access to local variable ctx [PersonAddresses, [], Person, Name] : String |
-| EntityFrameworkCore.cs:216:13:216:15 | access to local variable ctx [PersonAddresses, [], Address, Street] : String | semmle.label | access to local variable ctx [PersonAddresses, [], Address, Street] : String |
-| EntityFrameworkCore.cs:216:13:216:15 | access to local variable ctx [PersonAddresses, [], Person, Name] : String | semmle.label | access to local variable ctx [PersonAddresses, [], Person, Name] : String |
-| EntityFrameworkCore.cs:219:35:219:35 | p [Name] : String | semmle.label | p [Name] : String |
-| EntityFrameworkCore.cs:222:13:222:15 | [post] access to local variable ctx [Persons, [], Name] : String | semmle.label | [post] access to local variable ctx [Persons, [], Name] : String |
-| EntityFrameworkCore.cs:222:13:222:23 | [post] access to property Persons [[], Name] : String | semmle.label | [post] access to property Persons [[], Name] : String |
-| EntityFrameworkCore.cs:222:29:222:29 | access to parameter p [Name] : String | semmle.label | access to parameter p [Name] : String |
-| EntityFrameworkCore.cs:223:13:223:15 | access to local variable ctx [Persons, [], Name] : String | semmle.label | access to local variable ctx [Persons, [], Name] : String |
-| EntityFrameworkCore.cs:230:18:230:28 | access to property Persons [[], Name] : String | semmle.label | access to property Persons [[], Name] : String |
-| EntityFrameworkCore.cs:230:18:230:36 | call to method First [Name] : String | semmle.label | call to method First [Name] : String |
+| EntityFrameworkCore.cs:208:60:208:88 | { ..., ... } [property Address, property Street] : String | semmle.label | { ..., ... } [property Address, property Street] : String |
+| EntityFrameworkCore.cs:208:60:208:88 | { ..., ... } [property Person, property Name] : String | semmle.label | { ..., ... } [property Person, property Name] : String |
+| EntityFrameworkCore.cs:208:71:208:72 | access to local variable p1 [property Name] : String | semmle.label | access to local variable p1 [property Name] : String |
+| EntityFrameworkCore.cs:208:85:208:86 | access to local variable a1 [property Street] : String | semmle.label | access to local variable a1 [property Street] : String |
+| EntityFrameworkCore.cs:209:13:209:15 | [post] access to local variable ctx [property PersonAddresses, element, property Address, property Street] : String | semmle.label | [post] access to local variable ctx [property PersonAddresses, element, property Address, property Street] : String |
+| EntityFrameworkCore.cs:209:13:209:15 | [post] access to local variable ctx [property PersonAddresses, element, property Person, property Name] : String | semmle.label | [post] access to local variable ctx [property PersonAddresses, element, property Person, property Name] : String |
+| EntityFrameworkCore.cs:209:13:209:31 | [post] access to property PersonAddresses [element, property Address, property Street] : String | semmle.label | [post] access to property PersonAddresses [element, property Address, property Street] : String |
+| EntityFrameworkCore.cs:209:13:209:31 | [post] access to property PersonAddresses [element, property Person, property Name] : String | semmle.label | [post] access to property PersonAddresses [element, property Person, property Name] : String |
+| EntityFrameworkCore.cs:209:37:209:53 | access to local variable personAddressMap1 [property Address, property Street] : String | semmle.label | access to local variable personAddressMap1 [property Address, property Street] : String |
+| EntityFrameworkCore.cs:209:37:209:53 | access to local variable personAddressMap1 [property Person, property Name] : String | semmle.label | access to local variable personAddressMap1 [property Person, property Name] : String |
+| EntityFrameworkCore.cs:210:13:210:15 | access to local variable ctx [property PersonAddresses, element, property Address, property Street] : String | semmle.label | access to local variable ctx [property PersonAddresses, element, property Address, property Street] : String |
+| EntityFrameworkCore.cs:210:13:210:15 | access to local variable ctx [property PersonAddresses, element, property Person, property Name] : String | semmle.label | access to local variable ctx [property PersonAddresses, element, property Person, property Name] : String |
+| EntityFrameworkCore.cs:216:13:216:15 | access to local variable ctx [property PersonAddresses, element, property Address, property Street] : String | semmle.label | access to local variable ctx [property PersonAddresses, element, property Address, property Street] : String |
+| EntityFrameworkCore.cs:216:13:216:15 | access to local variable ctx [property PersonAddresses, element, property Person, property Name] : String | semmle.label | access to local variable ctx [property PersonAddresses, element, property Person, property Name] : String |
+| EntityFrameworkCore.cs:219:35:219:35 | p [property Name] : String | semmle.label | p [property Name] : String |
+| EntityFrameworkCore.cs:222:13:222:15 | [post] access to local variable ctx [property Persons, element, property Name] : String | semmle.label | [post] access to local variable ctx [property Persons, element, property Name] : String |
+| EntityFrameworkCore.cs:222:13:222:23 | [post] access to property Persons [element, property Name] : String | semmle.label | [post] access to property Persons [element, property Name] : String |
+| EntityFrameworkCore.cs:222:29:222:29 | access to parameter p [property Name] : String | semmle.label | access to parameter p [property Name] : String |
+| EntityFrameworkCore.cs:223:13:223:15 | access to local variable ctx [property Persons, element, property Name] : String | semmle.label | access to local variable ctx [property Persons, element, property Name] : String |
+| EntityFrameworkCore.cs:230:18:230:28 | access to property Persons [element, property Name] : String | semmle.label | access to property Persons [element, property Name] : String |
+| EntityFrameworkCore.cs:230:18:230:36 | call to method First [property Name] : String | semmle.label | call to method First [property Name] : String |
 | EntityFrameworkCore.cs:230:18:230:41 | access to property Name | semmle.label | access to property Name |
-| EntityFrameworkCore.cs:238:18:238:30 | access to property Addresses [[], Street] : String | semmle.label | access to property Addresses [[], Street] : String |
-| EntityFrameworkCore.cs:238:18:238:38 | call to method First [Street] : String | semmle.label | call to method First [Street] : String |
+| EntityFrameworkCore.cs:238:18:238:30 | access to property Addresses [element, property Street] : String | semmle.label | access to property Addresses [element, property Street] : String |
+| EntityFrameworkCore.cs:238:18:238:38 | call to method First [property Street] : String | semmle.label | call to method First [property Street] : String |
 | EntityFrameworkCore.cs:238:18:238:45 | access to property Street | semmle.label | access to property Street |
-| EntityFrameworkCore.cs:245:18:245:28 | access to property Persons [[], Addresses, [], Street] : String | semmle.label | access to property Persons [[], Addresses, [], Street] : String |
-| EntityFrameworkCore.cs:245:18:245:36 | call to method First [Addresses, [], Street] : String | semmle.label | call to method First [Addresses, [], Street] : String |
-| EntityFrameworkCore.cs:245:18:245:46 | access to property Addresses [[], Street] : String | semmle.label | access to property Addresses [[], Street] : String |
-| EntityFrameworkCore.cs:245:18:245:54 | call to method First [Street] : String | semmle.label | call to method First [Street] : String |
+| EntityFrameworkCore.cs:245:18:245:28 | access to property Persons [element, property Addresses, element, property Street] : String | semmle.label | access to property Persons [element, property Addresses, element, property Street] : String |
+| EntityFrameworkCore.cs:245:18:245:36 | call to method First [property Addresses, element, property Street] : String | semmle.label | call to method First [property Addresses, element, property Street] : String |
+| EntityFrameworkCore.cs:245:18:245:46 | access to property Addresses [element, property Street] : String | semmle.label | access to property Addresses [element, property Street] : String |
+| EntityFrameworkCore.cs:245:18:245:54 | call to method First [property Street] : String | semmle.label | call to method First [property Street] : String |
 | EntityFrameworkCore.cs:245:18:245:61 | access to property Street | semmle.label | access to property Street |
 #select
 | EntityFramework.cs:131:18:131:25 | access to property Title | EntityFramework.cs:126:25:126:33 | "tainted" : String | EntityFramework.cs:131:18:131:25 | access to property Title | $@ | EntityFramework.cs:126:25:126:33 | "tainted" : String | "tainted" : String |
diff --git a/csharp/ql/test/library-tests/frameworks/EntityFramework/FlowSummaries.expected b/csharp/ql/test/library-tests/frameworks/EntityFramework/FlowSummaries.expected
index 255b6ac988b..91b24479fbb 100644
--- a/csharp/ql/test/library-tests/frameworks/EntityFramework/FlowSummaries.expected
+++ b/csharp/ql/test/library-tests/frameworks/EntityFramework/FlowSummaries.expected
@@ -1,158 +1,134 @@
-| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | this parameter [Addresses, [], Id] -> jump to get_Addresses (return) [[], Id] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | this parameter [Addresses, [], Id] -> jump to get_PersonAddresses (return) [[], Address, Id] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | this parameter [Addresses, [], Id] -> jump to get_PersonAddresses (return) [[], Person, Addresses, [], Id] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | this parameter [Addresses, [], Id] -> jump to get_Persons (return) [[], Addresses, [], Id] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | this parameter [Addresses, [], Street] -> jump to get_Addresses (return) [[], Street] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | this parameter [Addresses, [], Street] -> jump to get_PersonAddresses (return) [[], Address, Street] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | this parameter [Addresses, [], Street] -> jump to get_PersonAddresses (return) [[], Person, Addresses, [], Street] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | this parameter [Addresses, [], Street] -> jump to get_Persons (return) [[], Addresses, [], Street] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | this parameter [PersonAddresses, [], Address, Id] -> jump to get_Addresses (return) [[], Id] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | this parameter [PersonAddresses, [], Address, Id] -> jump to get_PersonAddresses (return) [[], Address, Id] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | this parameter [PersonAddresses, [], Address, Id] -> jump to get_PersonAddresses (return) [[], Person, Addresses, [], Id] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | this parameter [PersonAddresses, [], Address, Id] -> jump to get_Persons (return) [[], Addresses, [], Id] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | this parameter [PersonAddresses, [], Address, Street] -> jump to get_Addresses (return) [[], Street] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | this parameter [PersonAddresses, [], Address, Street] -> jump to get_PersonAddresses (return) [[], Address, Street] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | this parameter [PersonAddresses, [], Address, Street] -> jump to get_PersonAddresses (return) [[], Person, Addresses, [], Street] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | this parameter [PersonAddresses, [], Address, Street] -> jump to get_Persons (return) [[], Addresses, [], Street] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | this parameter [PersonAddresses, [], AddressId] -> jump to get_PersonAddresses (return) [[], AddressId] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | this parameter [PersonAddresses, [], Id] -> jump to get_PersonAddresses (return) [[], Id] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | this parameter [PersonAddresses, [], Person, Id] -> jump to get_PersonAddresses (return) [[], Person, Id] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | this parameter [PersonAddresses, [], Person, Id] -> jump to get_Persons (return) [[], Id] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | this parameter [PersonAddresses, [], Person, Name] -> jump to get_PersonAddresses (return) [[], Person, Name] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | this parameter [PersonAddresses, [], Person, Name] -> jump to get_Persons (return) [[], Name] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | this parameter [PersonAddresses, [], PersonId] -> jump to get_PersonAddresses (return) [[], PersonId] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | this parameter [Persons, [], Addresses, [], Id] -> jump to get_Addresses (return) [[], Id] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | this parameter [Persons, [], Addresses, [], Id] -> jump to get_PersonAddresses (return) [[], Address, Id] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | this parameter [Persons, [], Addresses, [], Id] -> jump to get_PersonAddresses (return) [[], Person, Addresses, [], Id] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | this parameter [Persons, [], Addresses, [], Id] -> jump to get_Persons (return) [[], Addresses, [], Id] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | this parameter [Persons, [], Addresses, [], Street] -> jump to get_Addresses (return) [[], Street] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | this parameter [Persons, [], Addresses, [], Street] -> jump to get_PersonAddresses (return) [[], Address, Street] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | this parameter [Persons, [], Addresses, [], Street] -> jump to get_PersonAddresses (return) [[], Person, Addresses, [], Street] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | this parameter [Persons, [], Addresses, [], Street] -> jump to get_Persons (return) [[], Addresses, [], Street] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | this parameter [Persons, [], Id] -> jump to get_PersonAddresses (return) [[], Person, Id] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | this parameter [Persons, [], Id] -> jump to get_Persons (return) [[], Id] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | this parameter [Persons, [], Name] -> jump to get_PersonAddresses (return) [[], Person, Name] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | this parameter [Persons, [], Name] -> jump to get_Persons (return) [[], Name] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | this parameter [Addresses, [], Id] -> jump to get_Addresses (return) [[], Id] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | this parameter [Addresses, [], Id] -> jump to get_PersonAddresses (return) [[], Address, Id] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | this parameter [Addresses, [], Id] -> jump to get_PersonAddresses (return) [[], Person, Addresses, [], Id] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | this parameter [Addresses, [], Id] -> jump to get_Persons (return) [[], Addresses, [], Id] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | this parameter [Addresses, [], Street] -> jump to get_Addresses (return) [[], Street] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | this parameter [Addresses, [], Street] -> jump to get_PersonAddresses (return) [[], Address, Street] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | this parameter [Addresses, [], Street] -> jump to get_PersonAddresses (return) [[], Person, Addresses, [], Street] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | this parameter [Addresses, [], Street] -> jump to get_Persons (return) [[], Addresses, [], Street] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | this parameter [PersonAddresses, [], Address, Id] -> jump to get_Addresses (return) [[], Id] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | this parameter [PersonAddresses, [], Address, Id] -> jump to get_PersonAddresses (return) [[], Address, Id] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | this parameter [PersonAddresses, [], Address, Id] -> jump to get_PersonAddresses (return) [[], Person, Addresses, [], Id] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | this parameter [PersonAddresses, [], Address, Id] -> jump to get_Persons (return) [[], Addresses, [], Id] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | this parameter [PersonAddresses, [], Address, Street] -> jump to get_Addresses (return) [[], Street] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | this parameter [PersonAddresses, [], Address, Street] -> jump to get_PersonAddresses (return) [[], Address, Street] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | this parameter [PersonAddresses, [], Address, Street] -> jump to get_PersonAddresses (return) [[], Person, Addresses, [], Street] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | this parameter [PersonAddresses, [], Address, Street] -> jump to get_Persons (return) [[], Addresses, [], Street] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | this parameter [PersonAddresses, [], AddressId] -> jump to get_PersonAddresses (return) [[], AddressId] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | this parameter [PersonAddresses, [], Id] -> jump to get_PersonAddresses (return) [[], Id] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | this parameter [PersonAddresses, [], Person, Id] -> jump to get_PersonAddresses (return) [[], Person, Id] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | this parameter [PersonAddresses, [], Person, Id] -> jump to get_Persons (return) [[], Id] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | this parameter [PersonAddresses, [], Person, Name] -> jump to get_PersonAddresses (return) [[], Person, Name] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | this parameter [PersonAddresses, [], Person, Name] -> jump to get_Persons (return) [[], Name] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | this parameter [PersonAddresses, [], PersonId] -> jump to get_PersonAddresses (return) [[], PersonId] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | this parameter [Persons, [], Addresses, [], Id] -> jump to get_Addresses (return) [[], Id] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | this parameter [Persons, [], Addresses, [], Id] -> jump to get_PersonAddresses (return) [[], Address, Id] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | this parameter [Persons, [], Addresses, [], Id] -> jump to get_PersonAddresses (return) [[], Person, Addresses, [], Id] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | this parameter [Persons, [], Addresses, [], Id] -> jump to get_Persons (return) [[], Addresses, [], Id] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | this parameter [Persons, [], Addresses, [], Street] -> jump to get_Addresses (return) [[], Street] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | this parameter [Persons, [], Addresses, [], Street] -> jump to get_PersonAddresses (return) [[], Address, Street] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | this parameter [Persons, [], Addresses, [], Street] -> jump to get_PersonAddresses (return) [[], Person, Addresses, [], Street] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | this parameter [Persons, [], Addresses, [], Street] -> jump to get_Persons (return) [[], Addresses, [], Street] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | this parameter [Persons, [], Id] -> jump to get_PersonAddresses (return) [[], Person, Id] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | this parameter [Persons, [], Id] -> jump to get_Persons (return) [[], Id] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | this parameter [Persons, [], Name] -> jump to get_PersonAddresses (return) [[], Person, Name] | true |
-| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | this parameter [Persons, [], Name] -> jump to get_Persons (return) [[], Name] | true |
-| Microsoft.EntityFrameworkCore.DbSet<>.Add(T) | parameter 0 -> this parameter [[]] | true |
-| Microsoft.EntityFrameworkCore.DbSet<>.AddAsync(T) | parameter 0 -> this parameter [[]] | true |
-| Microsoft.EntityFrameworkCore.DbSet<>.AddRange(IEnumerable<T>) | parameter 0 [[]] -> this parameter [[]] | true |
-| Microsoft.EntityFrameworkCore.DbSet<>.AddRangeAsync(IEnumerable<T>) | parameter 0 [[]] -> this parameter [[]] | true |
-| Microsoft.EntityFrameworkCore.DbSet<>.Attach(T) | parameter 0 -> this parameter [[]] | true |
-| Microsoft.EntityFrameworkCore.DbSet<>.AttachRange(IEnumerable<T>) | parameter 0 [[]] -> this parameter [[]] | true |
-| Microsoft.EntityFrameworkCore.DbSet<>.Update(T) | parameter 0 -> this parameter [[]] | true |
-| Microsoft.EntityFrameworkCore.DbSet<>.UpdateRange(IEnumerable<T>) | parameter 0 [[]] -> this parameter [[]] | true |
-| Microsoft.EntityFrameworkCore.RawSqlString.RawSqlString(string) | parameter 0 -> return | false |
-| Microsoft.EntityFrameworkCore.RawSqlString.implicit conversion(string) | parameter 0 -> return | false |
-| System.Data.Entity.DbContext.SaveChanges() | this parameter [Addresses, [], Id] -> jump to get_Addresses (return) [[], Id] | true |
-| System.Data.Entity.DbContext.SaveChanges() | this parameter [Addresses, [], Id] -> jump to get_PersonAddresses (return) [[], Address, Id] | true |
-| System.Data.Entity.DbContext.SaveChanges() | this parameter [Addresses, [], Id] -> jump to get_PersonAddresses (return) [[], Person, Addresses, [], Id] | true |
-| System.Data.Entity.DbContext.SaveChanges() | this parameter [Addresses, [], Id] -> jump to get_Persons (return) [[], Addresses, [], Id] | true |
-| System.Data.Entity.DbContext.SaveChanges() | this parameter [Addresses, [], Street] -> jump to get_Addresses (return) [[], Street] | true |
-| System.Data.Entity.DbContext.SaveChanges() | this parameter [Addresses, [], Street] -> jump to get_PersonAddresses (return) [[], Address, Street] | true |
-| System.Data.Entity.DbContext.SaveChanges() | this parameter [Addresses, [], Street] -> jump to get_PersonAddresses (return) [[], Person, Addresses, [], Street] | true |
-| System.Data.Entity.DbContext.SaveChanges() | this parameter [Addresses, [], Street] -> jump to get_Persons (return) [[], Addresses, [], Street] | true |
-| System.Data.Entity.DbContext.SaveChanges() | this parameter [PersonAddresses, [], Address, Id] -> jump to get_Addresses (return) [[], Id] | true |
-| System.Data.Entity.DbContext.SaveChanges() | this parameter [PersonAddresses, [], Address, Id] -> jump to get_PersonAddresses (return) [[], Address, Id] | true |
-| System.Data.Entity.DbContext.SaveChanges() | this parameter [PersonAddresses, [], Address, Id] -> jump to get_PersonAddresses (return) [[], Person, Addresses, [], Id] | true |
-| System.Data.Entity.DbContext.SaveChanges() | this parameter [PersonAddresses, [], Address, Id] -> jump to get_Persons (return) [[], Addresses, [], Id] | true |
-| System.Data.Entity.DbContext.SaveChanges() | this parameter [PersonAddresses, [], Address, Street] -> jump to get_Addresses (return) [[], Street] | true |
-| System.Data.Entity.DbContext.SaveChanges() | this parameter [PersonAddresses, [], Address, Street] -> jump to get_PersonAddresses (return) [[], Address, Street] | true |
-| System.Data.Entity.DbContext.SaveChanges() | this parameter [PersonAddresses, [], Address, Street] -> jump to get_PersonAddresses (return) [[], Person, Addresses, [], Street] | true |
-| System.Data.Entity.DbContext.SaveChanges() | this parameter [PersonAddresses, [], Address, Street] -> jump to get_Persons (return) [[], Addresses, [], Street] | true |
-| System.Data.Entity.DbContext.SaveChanges() | this parameter [PersonAddresses, [], AddressId] -> jump to get_PersonAddresses (return) [[], AddressId] | true |
-| System.Data.Entity.DbContext.SaveChanges() | this parameter [PersonAddresses, [], Id] -> jump to get_PersonAddresses (return) [[], Id] | true |
-| System.Data.Entity.DbContext.SaveChanges() | this parameter [PersonAddresses, [], Person, Id] -> jump to get_PersonAddresses (return) [[], Person, Id] | true |
-| System.Data.Entity.DbContext.SaveChanges() | this parameter [PersonAddresses, [], Person, Id] -> jump to get_Persons (return) [[], Id] | true |
-| System.Data.Entity.DbContext.SaveChanges() | this parameter [PersonAddresses, [], Person, Name] -> jump to get_PersonAddresses (return) [[], Person, Name] | true |
-| System.Data.Entity.DbContext.SaveChanges() | this parameter [PersonAddresses, [], Person, Name] -> jump to get_Persons (return) [[], Name] | true |
-| System.Data.Entity.DbContext.SaveChanges() | this parameter [PersonAddresses, [], PersonId] -> jump to get_PersonAddresses (return) [[], PersonId] | true |
-| System.Data.Entity.DbContext.SaveChanges() | this parameter [Persons, [], Addresses, [], Id] -> jump to get_Addresses (return) [[], Id] | true |
-| System.Data.Entity.DbContext.SaveChanges() | this parameter [Persons, [], Addresses, [], Id] -> jump to get_PersonAddresses (return) [[], Address, Id] | true |
-| System.Data.Entity.DbContext.SaveChanges() | this parameter [Persons, [], Addresses, [], Id] -> jump to get_PersonAddresses (return) [[], Person, Addresses, [], Id] | true |
-| System.Data.Entity.DbContext.SaveChanges() | this parameter [Persons, [], Addresses, [], Id] -> jump to get_Persons (return) [[], Addresses, [], Id] | true |
-| System.Data.Entity.DbContext.SaveChanges() | this parameter [Persons, [], Addresses, [], Street] -> jump to get_Addresses (return) [[], Street] | true |
-| System.Data.Entity.DbContext.SaveChanges() | this parameter [Persons, [], Addresses, [], Street] -> jump to get_PersonAddresses (return) [[], Address, Street] | true |
-| System.Data.Entity.DbContext.SaveChanges() | this parameter [Persons, [], Addresses, [], Street] -> jump to get_PersonAddresses (return) [[], Person, Addresses, [], Street] | true |
-| System.Data.Entity.DbContext.SaveChanges() | this parameter [Persons, [], Addresses, [], Street] -> jump to get_Persons (return) [[], Addresses, [], Street] | true |
-| System.Data.Entity.DbContext.SaveChanges() | this parameter [Persons, [], Id] -> jump to get_PersonAddresses (return) [[], Person, Id] | true |
-| System.Data.Entity.DbContext.SaveChanges() | this parameter [Persons, [], Id] -> jump to get_Persons (return) [[], Id] | true |
-| System.Data.Entity.DbContext.SaveChanges() | this parameter [Persons, [], Name] -> jump to get_PersonAddresses (return) [[], Person, Name] | true |
-| System.Data.Entity.DbContext.SaveChanges() | this parameter [Persons, [], Name] -> jump to get_Persons (return) [[], Name] | true |
-| System.Data.Entity.DbContext.SaveChangesAsync() | this parameter [Addresses, [], Id] -> jump to get_Addresses (return) [[], Id] | true |
-| System.Data.Entity.DbContext.SaveChangesAsync() | this parameter [Addresses, [], Id] -> jump to get_PersonAddresses (return) [[], Address, Id] | true |
-| System.Data.Entity.DbContext.SaveChangesAsync() | this parameter [Addresses, [], Id] -> jump to get_PersonAddresses (return) [[], Person, Addresses, [], Id] | true |
-| System.Data.Entity.DbContext.SaveChangesAsync() | this parameter [Addresses, [], Id] -> jump to get_Persons (return) [[], Addresses, [], Id] | true |
-| System.Data.Entity.DbContext.SaveChangesAsync() | this parameter [Addresses, [], Street] -> jump to get_Addresses (return) [[], Street] | true |
-| System.Data.Entity.DbContext.SaveChangesAsync() | this parameter [Addresses, [], Street] -> jump to get_PersonAddresses (return) [[], Address, Street] | true |
-| System.Data.Entity.DbContext.SaveChangesAsync() | this parameter [Addresses, [], Street] -> jump to get_PersonAddresses (return) [[], Person, Addresses, [], Street] | true |
-| System.Data.Entity.DbContext.SaveChangesAsync() | this parameter [Addresses, [], Street] -> jump to get_Persons (return) [[], Addresses, [], Street] | true |
-| System.Data.Entity.DbContext.SaveChangesAsync() | this parameter [PersonAddresses, [], Address, Id] -> jump to get_Addresses (return) [[], Id] | true |
-| System.Data.Entity.DbContext.SaveChangesAsync() | this parameter [PersonAddresses, [], Address, Id] -> jump to get_PersonAddresses (return) [[], Address, Id] | true |
-| System.Data.Entity.DbContext.SaveChangesAsync() | this parameter [PersonAddresses, [], Address, Id] -> jump to get_PersonAddresses (return) [[], Person, Addresses, [], Id] | true |
-| System.Data.Entity.DbContext.SaveChangesAsync() | this parameter [PersonAddresses, [], Address, Id] -> jump to get_Persons (return) [[], Addresses, [], Id] | true |
-| System.Data.Entity.DbContext.SaveChangesAsync() | this parameter [PersonAddresses, [], Address, Street] -> jump to get_Addresses (return) [[], Street] | true |
-| System.Data.Entity.DbContext.SaveChangesAsync() | this parameter [PersonAddresses, [], Address, Street] -> jump to get_PersonAddresses (return) [[], Address, Street] | true |
-| System.Data.Entity.DbContext.SaveChangesAsync() | this parameter [PersonAddresses, [], Address, Street] -> jump to get_PersonAddresses (return) [[], Person, Addresses, [], Street] | true |
-| System.Data.Entity.DbContext.SaveChangesAsync() | this parameter [PersonAddresses, [], Address, Street] -> jump to get_Persons (return) [[], Addresses, [], Street] | true |
-| System.Data.Entity.DbContext.SaveChangesAsync() | this parameter [PersonAddresses, [], AddressId] -> jump to get_PersonAddresses (return) [[], AddressId] | true |
-| System.Data.Entity.DbContext.SaveChangesAsync() | this parameter [PersonAddresses, [], Id] -> jump to get_PersonAddresses (return) [[], Id] | true |
-| System.Data.Entity.DbContext.SaveChangesAsync() | this parameter [PersonAddresses, [], Person, Id] -> jump to get_PersonAddresses (return) [[], Person, Id] | true |
-| System.Data.Entity.DbContext.SaveChangesAsync() | this parameter [PersonAddresses, [], Person, Id] -> jump to get_Persons (return) [[], Id] | true |
-| System.Data.Entity.DbContext.SaveChangesAsync() | this parameter [PersonAddresses, [], Person, Name] -> jump to get_PersonAddresses (return) [[], Person, Name] | true |
-| System.Data.Entity.DbContext.SaveChangesAsync() | this parameter [PersonAddresses, [], Person, Name] -> jump to get_Persons (return) [[], Name] | true |
-| System.Data.Entity.DbContext.SaveChangesAsync() | this parameter [PersonAddresses, [], PersonId] -> jump to get_PersonAddresses (return) [[], PersonId] | true |
-| System.Data.Entity.DbContext.SaveChangesAsync() | this parameter [Persons, [], Addresses, [], Id] -> jump to get_Addresses (return) [[], Id] | true |
-| System.Data.Entity.DbContext.SaveChangesAsync() | this parameter [Persons, [], Addresses, [], Id] -> jump to get_PersonAddresses (return) [[], Address, Id] | true |
-| System.Data.Entity.DbContext.SaveChangesAsync() | this parameter [Persons, [], Addresses, [], Id] -> jump to get_PersonAddresses (return) [[], Person, Addresses, [], Id] | true |
-| System.Data.Entity.DbContext.SaveChangesAsync() | this parameter [Persons, [], Addresses, [], Id] -> jump to get_Persons (return) [[], Addresses, [], Id] | true |
-| System.Data.Entity.DbContext.SaveChangesAsync() | this parameter [Persons, [], Addresses, [], Street] -> jump to get_Addresses (return) [[], Street] | true |
-| System.Data.Entity.DbContext.SaveChangesAsync() | this parameter [Persons, [], Addresses, [], Street] -> jump to get_PersonAddresses (return) [[], Address, Street] | true |
-| System.Data.Entity.DbContext.SaveChangesAsync() | this parameter [Persons, [], Addresses, [], Street] -> jump to get_PersonAddresses (return) [[], Person, Addresses, [], Street] | true |
-| System.Data.Entity.DbContext.SaveChangesAsync() | this parameter [Persons, [], Addresses, [], Street] -> jump to get_Persons (return) [[], Addresses, [], Street] | true |
-| System.Data.Entity.DbContext.SaveChangesAsync() | this parameter [Persons, [], Id] -> jump to get_PersonAddresses (return) [[], Person, Id] | true |
-| System.Data.Entity.DbContext.SaveChangesAsync() | this parameter [Persons, [], Id] -> jump to get_Persons (return) [[], Id] | true |
-| System.Data.Entity.DbContext.SaveChangesAsync() | this parameter [Persons, [], Name] -> jump to get_PersonAddresses (return) [[], Person, Name] | true |
-| System.Data.Entity.DbContext.SaveChangesAsync() | this parameter [Persons, [], Name] -> jump to get_Persons (return) [[], Name] | true |
-| System.Data.Entity.DbSet<>.Add(T) | parameter 0 -> this parameter [[]] | true |
-| System.Data.Entity.DbSet<>.AddAsync(T) | parameter 0 -> this parameter [[]] | true |
-| System.Data.Entity.DbSet<>.AddRange(IEnumerable<T>) | parameter 0 [[]] -> this parameter [[]] | true |
-| System.Data.Entity.DbSet<>.AddRangeAsync(IEnumerable<T>) | parameter 0 [[]] -> this parameter [[]] | true |
-| System.Data.Entity.DbSet<>.Attach(T) | parameter 0 -> this parameter [[]] | true |
-| System.Data.Entity.DbSet<>.AttachRange(IEnumerable<T>) | parameter 0 [[]] -> this parameter [[]] | true |
-| System.Data.Entity.DbSet<>.Update(T) | parameter 0 -> this parameter [[]] | true |
-| System.Data.Entity.DbSet<>.UpdateRange(IEnumerable<T>) | parameter 0 [[]] -> this parameter [[]] | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | property AddressId of element of property PersonAddresses of argument -1 -> property AddressId of element of return (jump to get_PersonAddresses) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | property Id of element of property Addresses of argument -1 -> property Id of element of property Addresses of element of return (jump to get_Persons) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | property Id of element of property Addresses of argument -1 -> property Id of element of return (jump to get_Addresses) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | property Id of element of property Addresses of argument -1 -> property Id of property Address of element of return (jump to get_PersonAddresses) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | property Id of element of property Addresses of element of property Persons of argument -1 -> property Id of element of property Addresses of element of return (jump to get_Persons) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | property Id of element of property Addresses of element of property Persons of argument -1 -> property Id of element of return (jump to get_Addresses) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | property Id of element of property Addresses of element of property Persons of argument -1 -> property Id of property Address of element of return (jump to get_PersonAddresses) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | property Id of element of property PersonAddresses of argument -1 -> property Id of element of return (jump to get_PersonAddresses) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | property Id of element of property Persons of argument -1 -> property Id of element of return (jump to get_Persons) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | property Id of element of property Persons of argument -1 -> property Id of property Person of element of return (jump to get_PersonAddresses) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | property Id of property Address of element of property PersonAddresses of argument -1 -> property Id of element of property Addresses of element of return (jump to get_Persons) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | property Id of property Address of element of property PersonAddresses of argument -1 -> property Id of element of return (jump to get_Addresses) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | property Id of property Address of element of property PersonAddresses of argument -1 -> property Id of property Address of element of return (jump to get_PersonAddresses) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | property Id of property Person of element of property PersonAddresses of argument -1 -> property Id of element of return (jump to get_Persons) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | property Id of property Person of element of property PersonAddresses of argument -1 -> property Id of property Person of element of return (jump to get_PersonAddresses) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | property Name of element of property Persons of argument -1 -> property Name of element of return (jump to get_Persons) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | property Name of element of property Persons of argument -1 -> property Name of property Person of element of return (jump to get_PersonAddresses) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | property Name of property Person of element of property PersonAddresses of argument -1 -> property Name of element of return (jump to get_Persons) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | property Name of property Person of element of property PersonAddresses of argument -1 -> property Name of property Person of element of return (jump to get_PersonAddresses) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | property PersonId of element of property PersonAddresses of argument -1 -> property PersonId of element of return (jump to get_PersonAddresses) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | property Street of element of property Addresses of argument -1 -> property Street of element of property Addresses of element of return (jump to get_Persons) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | property Street of element of property Addresses of argument -1 -> property Street of element of return (jump to get_Addresses) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | property Street of element of property Addresses of argument -1 -> property Street of property Address of element of return (jump to get_PersonAddresses) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | property Street of element of property Addresses of element of property Persons of argument -1 -> property Street of element of property Addresses of element of return (jump to get_Persons) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | property Street of element of property Addresses of element of property Persons of argument -1 -> property Street of element of return (jump to get_Addresses) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | property Street of element of property Addresses of element of property Persons of argument -1 -> property Street of property Address of element of return (jump to get_PersonAddresses) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | property Street of property Address of element of property PersonAddresses of argument -1 -> property Street of element of property Addresses of element of return (jump to get_Persons) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | property Street of property Address of element of property PersonAddresses of argument -1 -> property Street of element of return (jump to get_Addresses) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChanges() | property Street of property Address of element of property PersonAddresses of argument -1 -> property Street of property Address of element of return (jump to get_PersonAddresses) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | property AddressId of element of property PersonAddresses of argument -1 -> property AddressId of element of return (jump to get_PersonAddresses) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | property Id of element of property Addresses of argument -1 -> property Id of element of property Addresses of element of return (jump to get_Persons) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | property Id of element of property Addresses of argument -1 -> property Id of element of return (jump to get_Addresses) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | property Id of element of property Addresses of argument -1 -> property Id of property Address of element of return (jump to get_PersonAddresses) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | property Id of element of property Addresses of element of property Persons of argument -1 -> property Id of element of property Addresses of element of return (jump to get_Persons) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | property Id of element of property Addresses of element of property Persons of argument -1 -> property Id of element of return (jump to get_Addresses) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | property Id of element of property Addresses of element of property Persons of argument -1 -> property Id of property Address of element of return (jump to get_PersonAddresses) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | property Id of element of property PersonAddresses of argument -1 -> property Id of element of return (jump to get_PersonAddresses) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | property Id of element of property Persons of argument -1 -> property Id of element of return (jump to get_Persons) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | property Id of element of property Persons of argument -1 -> property Id of property Person of element of return (jump to get_PersonAddresses) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | property Id of property Address of element of property PersonAddresses of argument -1 -> property Id of element of property Addresses of element of return (jump to get_Persons) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | property Id of property Address of element of property PersonAddresses of argument -1 -> property Id of element of return (jump to get_Addresses) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | property Id of property Address of element of property PersonAddresses of argument -1 -> property Id of property Address of element of return (jump to get_PersonAddresses) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | property Id of property Person of element of property PersonAddresses of argument -1 -> property Id of element of return (jump to get_Persons) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | property Id of property Person of element of property PersonAddresses of argument -1 -> property Id of property Person of element of return (jump to get_PersonAddresses) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | property Name of element of property Persons of argument -1 -> property Name of element of return (jump to get_Persons) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | property Name of element of property Persons of argument -1 -> property Name of property Person of element of return (jump to get_PersonAddresses) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | property Name of property Person of element of property PersonAddresses of argument -1 -> property Name of element of return (jump to get_Persons) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | property Name of property Person of element of property PersonAddresses of argument -1 -> property Name of property Person of element of return (jump to get_PersonAddresses) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | property PersonId of element of property PersonAddresses of argument -1 -> property PersonId of element of return (jump to get_PersonAddresses) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | property Street of element of property Addresses of argument -1 -> property Street of element of property Addresses of element of return (jump to get_Persons) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | property Street of element of property Addresses of argument -1 -> property Street of element of return (jump to get_Addresses) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | property Street of element of property Addresses of argument -1 -> property Street of property Address of element of return (jump to get_PersonAddresses) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | property Street of element of property Addresses of element of property Persons of argument -1 -> property Street of element of property Addresses of element of return (jump to get_Persons) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | property Street of element of property Addresses of element of property Persons of argument -1 -> property Street of element of return (jump to get_Addresses) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | property Street of element of property Addresses of element of property Persons of argument -1 -> property Street of property Address of element of return (jump to get_PersonAddresses) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | property Street of property Address of element of property PersonAddresses of argument -1 -> property Street of element of property Addresses of element of return (jump to get_Persons) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | property Street of property Address of element of property PersonAddresses of argument -1 -> property Street of element of return (jump to get_Addresses) | true |
+| Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync() | property Street of property Address of element of property PersonAddresses of argument -1 -> property Street of property Address of element of return (jump to get_PersonAddresses) | true |
+| Microsoft.EntityFrameworkCore.DbSet<>.Add(T) | argument 0 -> element of argument -1 | true |
+| Microsoft.EntityFrameworkCore.DbSet<>.AddAsync(T) | argument 0 -> element of argument -1 | true |
+| Microsoft.EntityFrameworkCore.DbSet<>.AddRange(IEnumerable<T>) | element of argument 0 -> element of argument -1 | true |
+| Microsoft.EntityFrameworkCore.DbSet<>.AddRangeAsync(IEnumerable<T>) | element of argument 0 -> element of argument -1 | true |
+| Microsoft.EntityFrameworkCore.DbSet<>.Attach(T) | argument 0 -> element of argument -1 | true |
+| Microsoft.EntityFrameworkCore.DbSet<>.AttachRange(IEnumerable<T>) | element of argument 0 -> element of argument -1 | true |
+| Microsoft.EntityFrameworkCore.DbSet<>.Update(T) | argument 0 -> element of argument -1 | true |
+| Microsoft.EntityFrameworkCore.DbSet<>.UpdateRange(IEnumerable<T>) | element of argument 0 -> element of argument -1 | true |
+| Microsoft.EntityFrameworkCore.RawSqlString.RawSqlString(string) | argument 0 -> return (normal) | false |
+| Microsoft.EntityFrameworkCore.RawSqlString.implicit conversion(string) | argument 0 -> return (normal) | false |
+| System.Data.Entity.DbContext.SaveChanges() | property AddressId of element of property PersonAddresses of argument -1 -> property AddressId of element of return (jump to get_PersonAddresses) | true |
+| System.Data.Entity.DbContext.SaveChanges() | property Id of element of property Addresses of argument -1 -> property Id of element of property Addresses of element of return (jump to get_Persons) | true |
+| System.Data.Entity.DbContext.SaveChanges() | property Id of element of property Addresses of argument -1 -> property Id of element of return (jump to get_Addresses) | true |
+| System.Data.Entity.DbContext.SaveChanges() | property Id of element of property Addresses of argument -1 -> property Id of property Address of element of return (jump to get_PersonAddresses) | true |
+| System.Data.Entity.DbContext.SaveChanges() | property Id of element of property Addresses of element of property Persons of argument -1 -> property Id of element of property Addresses of element of return (jump to get_Persons) | true |
+| System.Data.Entity.DbContext.SaveChanges() | property Id of element of property Addresses of element of property Persons of argument -1 -> property Id of element of return (jump to get_Addresses) | true |
+| System.Data.Entity.DbContext.SaveChanges() | property Id of element of property Addresses of element of property Persons of argument -1 -> property Id of property Address of element of return (jump to get_PersonAddresses) | true |
+| System.Data.Entity.DbContext.SaveChanges() | property Id of element of property PersonAddresses of argument -1 -> property Id of element of return (jump to get_PersonAddresses) | true |
+| System.Data.Entity.DbContext.SaveChanges() | property Id of element of property Persons of argument -1 -> property Id of element of return (jump to get_Persons) | true |
+| System.Data.Entity.DbContext.SaveChanges() | property Id of element of property Persons of argument -1 -> property Id of property Person of element of return (jump to get_PersonAddresses) | true |
+| System.Data.Entity.DbContext.SaveChanges() | property Id of property Address of element of property PersonAddresses of argument -1 -> property Id of element of property Addresses of element of return (jump to get_Persons) | true |
+| System.Data.Entity.DbContext.SaveChanges() | property Id of property Address of element of property PersonAddresses of argument -1 -> property Id of element of return (jump to get_Addresses) | true |
+| System.Data.Entity.DbContext.SaveChanges() | property Id of property Address of element of property PersonAddresses of argument -1 -> property Id of property Address of element of return (jump to get_PersonAddresses) | true |
+| System.Data.Entity.DbContext.SaveChanges() | property Id of property Person of element of property PersonAddresses of argument -1 -> property Id of element of return (jump to get_Persons) | true |
+| System.Data.Entity.DbContext.SaveChanges() | property Id of property Person of element of property PersonAddresses of argument -1 -> property Id of property Person of element of return (jump to get_PersonAddresses) | true |
+| System.Data.Entity.DbContext.SaveChanges() | property Name of element of property Persons of argument -1 -> property Name of element of return (jump to get_Persons) | true |
+| System.Data.Entity.DbContext.SaveChanges() | property Name of element of property Persons of argument -1 -> property Name of property Person of element of return (jump to get_PersonAddresses) | true |
+| System.Data.Entity.DbContext.SaveChanges() | property Name of property Person of element of property PersonAddresses of argument -1 -> property Name of element of return (jump to get_Persons) | true |
+| System.Data.Entity.DbContext.SaveChanges() | property Name of property Person of element of property PersonAddresses of argument -1 -> property Name of property Person of element of return (jump to get_PersonAddresses) | true |
+| System.Data.Entity.DbContext.SaveChanges() | property PersonId of element of property PersonAddresses of argument -1 -> property PersonId of element of return (jump to get_PersonAddresses) | true |
+| System.Data.Entity.DbContext.SaveChanges() | property Street of element of property Addresses of argument -1 -> property Street of element of property Addresses of element of return (jump to get_Persons) | true |
+| System.Data.Entity.DbContext.SaveChanges() | property Street of element of property Addresses of argument -1 -> property Street of element of return (jump to get_Addresses) | true |
+| System.Data.Entity.DbContext.SaveChanges() | property Street of element of property Addresses of argument -1 -> property Street of property Address of element of return (jump to get_PersonAddresses) | true |
+| System.Data.Entity.DbContext.SaveChanges() | property Street of element of property Addresses of element of property Persons of argument -1 -> property Street of element of property Addresses of element of return (jump to get_Persons) | true |
+| System.Data.Entity.DbContext.SaveChanges() | property Street of element of property Addresses of element of property Persons of argument -1 -> property Street of element of return (jump to get_Addresses) | true |
+| System.Data.Entity.DbContext.SaveChanges() | property Street of element of property Addresses of element of property Persons of argument -1 -> property Street of property Address of element of return (jump to get_PersonAddresses) | true |
+| System.Data.Entity.DbContext.SaveChanges() | property Street of property Address of element of property PersonAddresses of argument -1 -> property Street of element of property Addresses of element of return (jump to get_Persons) | true |
+| System.Data.Entity.DbContext.SaveChanges() | property Street of property Address of element of property PersonAddresses of argument -1 -> property Street of element of return (jump to get_Addresses) | true |
+| System.Data.Entity.DbContext.SaveChanges() | property Street of property Address of element of property PersonAddresses of argument -1 -> property Street of property Address of element of return (jump to get_PersonAddresses) | true |
+| System.Data.Entity.DbContext.SaveChangesAsync() | property AddressId of element of property PersonAddresses of argument -1 -> property AddressId of element of return (jump to get_PersonAddresses) | true |
+| System.Data.Entity.DbContext.SaveChangesAsync() | property Id of element of property Addresses of argument -1 -> property Id of element of property Addresses of element of return (jump to get_Persons) | true |
+| System.Data.Entity.DbContext.SaveChangesAsync() | property Id of element of property Addresses of argument -1 -> property Id of element of return (jump to get_Addresses) | true |
+| System.Data.Entity.DbContext.SaveChangesAsync() | property Id of element of property Addresses of argument -1 -> property Id of property Address of element of return (jump to get_PersonAddresses) | true |
+| System.Data.Entity.DbContext.SaveChangesAsync() | property Id of element of property Addresses of element of property Persons of argument -1 -> property Id of element of property Addresses of element of return (jump to get_Persons) | true |
+| System.Data.Entity.DbContext.SaveChangesAsync() | property Id of element of property Addresses of element of property Persons of argument -1 -> property Id of element of return (jump to get_Addresses) | true |
+| System.Data.Entity.DbContext.SaveChangesAsync() | property Id of element of property Addresses of element of property Persons of argument -1 -> property Id of property Address of element of return (jump to get_PersonAddresses) | true |
+| System.Data.Entity.DbContext.SaveChangesAsync() | property Id of element of property PersonAddresses of argument -1 -> property Id of element of return (jump to get_PersonAddresses) | true |
+| System.Data.Entity.DbContext.SaveChangesAsync() | property Id of element of property Persons of argument -1 -> property Id of element of return (jump to get_Persons) | true |
+| System.Data.Entity.DbContext.SaveChangesAsync() | property Id of element of property Persons of argument -1 -> property Id of property Person of element of return (jump to get_PersonAddresses) | true |
+| System.Data.Entity.DbContext.SaveChangesAsync() | property Id of property Address of element of property PersonAddresses of argument -1 -> property Id of element of property Addresses of element of return (jump to get_Persons) | true |
+| System.Data.Entity.DbContext.SaveChangesAsync() | property Id of property Address of element of property PersonAddresses of argument -1 -> property Id of element of return (jump to get_Addresses) | true |
+| System.Data.Entity.DbContext.SaveChangesAsync() | property Id of property Address of element of property PersonAddresses of argument -1 -> property Id of property Address of element of return (jump to get_PersonAddresses) | true |
+| System.Data.Entity.DbContext.SaveChangesAsync() | property Id of property Person of element of property PersonAddresses of argument -1 -> property Id of element of return (jump to get_Persons) | true |
+| System.Data.Entity.DbContext.SaveChangesAsync() | property Id of property Person of element of property PersonAddresses of argument -1 -> property Id of property Person of element of return (jump to get_PersonAddresses) | true |
+| System.Data.Entity.DbContext.SaveChangesAsync() | property Name of element of property Persons of argument -1 -> property Name of element of return (jump to get_Persons) | true |
+| System.Data.Entity.DbContext.SaveChangesAsync() | property Name of element of property Persons of argument -1 -> property Name of property Person of element of return (jump to get_PersonAddresses) | true |
+| System.Data.Entity.DbContext.SaveChangesAsync() | property Name of property Person of element of property PersonAddresses of argument -1 -> property Name of element of return (jump to get_Persons) | true |
+| System.Data.Entity.DbContext.SaveChangesAsync() | property Name of property Person of element of property PersonAddresses of argument -1 -> property Name of property Person of element of return (jump to get_PersonAddresses) | true |
+| System.Data.Entity.DbContext.SaveChangesAsync() | property PersonId of element of property PersonAddresses of argument -1 -> property PersonId of element of return (jump to get_PersonAddresses) | true |
+| System.Data.Entity.DbContext.SaveChangesAsync() | property Street of element of property Addresses of argument -1 -> property Street of element of property Addresses of element of return (jump to get_Persons) | true |
+| System.Data.Entity.DbContext.SaveChangesAsync() | property Street of element of property Addresses of argument -1 -> property Street of element of return (jump to get_Addresses) | true |
+| System.Data.Entity.DbContext.SaveChangesAsync() | property Street of element of property Addresses of argument -1 -> property Street of property Address of element of return (jump to get_PersonAddresses) | true |
+| System.Data.Entity.DbContext.SaveChangesAsync() | property Street of element of property Addresses of element of property Persons of argument -1 -> property Street of element of property Addresses of element of return (jump to get_Persons) | true |
+| System.Data.Entity.DbContext.SaveChangesAsync() | property Street of element of property Addresses of element of property Persons of argument -1 -> property Street of element of return (jump to get_Addresses) | true |
+| System.Data.Entity.DbContext.SaveChangesAsync() | property Street of element of property Addresses of element of property Persons of argument -1 -> property Street of property Address of element of return (jump to get_PersonAddresses) | true |
+| System.Data.Entity.DbContext.SaveChangesAsync() | property Street of property Address of element of property PersonAddresses of argument -1 -> property Street of element of property Addresses of element of return (jump to get_Persons) | true |
+| System.Data.Entity.DbContext.SaveChangesAsync() | property Street of property Address of element of property PersonAddresses of argument -1 -> property Street of element of return (jump to get_Addresses) | true |
+| System.Data.Entity.DbContext.SaveChangesAsync() | property Street of property Address of element of property PersonAddresses of argument -1 -> property Street of property Address of element of return (jump to get_PersonAddresses) | true |
+| System.Data.Entity.DbSet<>.Add(T) | argument 0 -> element of argument -1 | true |
+| System.Data.Entity.DbSet<>.AddAsync(T) | argument 0 -> element of argument -1 | true |
+| System.Data.Entity.DbSet<>.AddRange(IEnumerable<T>) | element of argument 0 -> element of argument -1 | true |
+| System.Data.Entity.DbSet<>.AddRangeAsync(IEnumerable<T>) | element of argument 0 -> element of argument -1 | true |
+| System.Data.Entity.DbSet<>.Attach(T) | argument 0 -> element of argument -1 | true |
+| System.Data.Entity.DbSet<>.AttachRange(IEnumerable<T>) | element of argument 0 -> element of argument -1 | true |
+| System.Data.Entity.DbSet<>.Update(T) | argument 0 -> element of argument -1 | true |
+| System.Data.Entity.DbSet<>.UpdateRange(IEnumerable<T>) | element of argument 0 -> element of argument -1 | true |
diff --git a/csharp/ql/test/library-tests/frameworks/EntityFramework/FlowSummaries.ql b/csharp/ql/test/library-tests/frameworks/EntityFramework/FlowSummaries.ql
index 598d8c0f20c..ff518640b00 100644
--- a/csharp/ql/test/library-tests/frameworks/EntityFramework/FlowSummaries.ql
+++ b/csharp/ql/test/library-tests/frameworks/EntityFramework/FlowSummaries.ql
@@ -1,6 +1,9 @@
-import semmle.code.csharp.dataflow.FlowSummary::TestOutput
+import semmle.code.csharp.dataflow.FlowSummary
+import semmle.code.csharp.dataflow.internal.FlowSummaryImpl::Private::TestOutput
 import semmle.code.csharp.frameworks.EntityFramework::EntityFramework
 
-private class IncludeEFSummarizedCallable extends RelevantSummarizedCallable {
-  IncludeEFSummarizedCallable() { this instanceof EFSummarizedCallable }
+private class IncludeSummarizedCallable extends RelevantSummarizedCallable {
+  IncludeSummarizedCallable() { this instanceof EFSummarizedCallable }
+
+  override string getFullString() { result = this.(Callable).getQualifiedNameWithTypes() }
 }
diff --git a/csharp/ql/test/library-tests/goto/Goto1.ql b/csharp/ql/test/library-tests/goto/Goto1.ql
index e7ee0b3ff8a..97dd1fa2af0 100644
--- a/csharp/ql/test/library-tests/goto/Goto1.ql
+++ b/csharp/ql/test/library-tests/goto/Goto1.ql
@@ -1,6 +1,7 @@
 import csharp
 
 query predicate edges(ControlFlow::Node node, ControlFlow::Node successor, string attr, string val) {
+  not node.getElement().fromLibrary() and
   exists(ControlFlow::SuccessorType t | successor = node.getASuccessorByType(t) |
     attr = "semmle.label" and
     val = t.toString()
diff --git a/csharp/ql/test/library-tests/parameters/Parameters.cs b/csharp/ql/test/library-tests/parameters/Parameters.cs
new file mode 100644
index 00000000000..b7cc3b001a9
--- /dev/null
+++ b/csharp/ql/test/library-tests/parameters/Parameters.cs
@@ -0,0 +1,17 @@
+public class Parameters
+{
+    public void M1(int a, object b, string c) => throw null;
+    public void M2(int a, object b = null, string c = "default string") => throw null;
+    public void M3(int a = 1, object b = null, string c = "null") => throw null;
+    public void M4(int a = default, object b = default) => throw null;
+    public void M5(int a = new int(), object b = default) => throw null;
+    public void M6(MyStruct s1, MyStruct s2 = default(MyStruct), MyStruct s3 = new MyStruct()) => throw null;
+    public void M7(MyEnum e1, MyEnum e2 = default(MyEnum), MyEnum e3 = new MyEnum(), MyEnum e4 = MyEnum.A, MyEnum e5 = (MyEnum)5) => throw null;
+
+    public void M8<T>(T t = default) => throw null;
+    public void M9<T>(T t = default) where T : struct => throw null;
+    public void M10<T>(T t = default) where T : class => throw null;
+
+    public struct MyStruct { }
+    public enum MyEnum { A = 1, B = 2 }
+}
\ No newline at end of file
diff --git a/csharp/ql/test/library-tests/parameters/Parameters.cs_ b/csharp/ql/test/library-tests/parameters/Parameters.cs_
new file mode 100644
index 00000000000..062c4b98b18
--- /dev/null
+++ b/csharp/ql/test/library-tests/parameters/Parameters.cs_
@@ -0,0 +1,17 @@
+public class ParametersDll
+{
+    public void M1(int a, object b, string c) => throw null;
+    public void M2(int a, object b = null, string c = "default string") => throw null;
+    public void M3(int a = 1, object b = null, string c = "null") => throw null;
+    public void M4(int a = default, object b = default) => throw null;
+    public void M5(int a = new int(), object b = default) => throw null;
+    public void M6(MyStruct s1, MyStruct s2 = default(MyStruct), MyStruct s3 = new MyStruct()) => throw null;
+    public void M7(MyEnum e1, MyEnum e2 = default(MyEnum), MyEnum e3 = new MyEnum(), MyEnum e4 = MyEnum.A, MyEnum e5 = (MyEnum)5) => throw null;
+
+    public void M8<T>(T t = default) => throw null;
+    public void M9<T>(T t = default) where T : struct => throw null;
+    public void M10<T>(T t = default) where T : class => throw null;
+
+    public struct MyStruct { }
+    public enum MyEnum { A = 1, B = 2 }
+}
\ No newline at end of file
diff --git a/csharp/ql/test/library-tests/parameters/Parameters.dll b/csharp/ql/test/library-tests/parameters/Parameters.dll
new file mode 100644
index 00000000000..cd48ebef015
Binary files /dev/null and b/csharp/ql/test/library-tests/parameters/Parameters.dll differ
diff --git a/csharp/ql/test/library-tests/parameters/Parameters.expected b/csharp/ql/test/library-tests/parameters/Parameters.expected
new file mode 100644
index 00000000000..864464167b9
--- /dev/null
+++ b/csharp/ql/test/library-tests/parameters/Parameters.expected
@@ -0,0 +1,50 @@
+noDefaultValue
+| Parameters.cs:3:17:3:18 | M1 | Parameters.cs:3:24:3:24 | a | 0 |
+| Parameters.cs:3:17:3:18 | M1 | Parameters.cs:3:34:3:34 | b | 1 |
+| Parameters.cs:3:17:3:18 | M1 | Parameters.cs:3:44:3:44 | c | 2 |
+| Parameters.cs:4:17:4:18 | M2 | Parameters.cs:4:24:4:24 | a | 0 |
+| Parameters.cs:8:17:8:18 | M6 | Parameters.cs:8:29:8:30 | s1 | 0 |
+| Parameters.cs:9:17:9:18 | M7 | Parameters.cs:9:27:9:28 | e1 | 0 |
+| Parameters.dll:0:0:0:0 | M1 | Parameters.dll:0:0:0:0 | a | 0 |
+| Parameters.dll:0:0:0:0 | M1 | Parameters.dll:0:0:0:0 | b | 1 |
+| Parameters.dll:0:0:0:0 | M1 | Parameters.dll:0:0:0:0 | c | 2 |
+| Parameters.dll:0:0:0:0 | M2 | Parameters.dll:0:0:0:0 | a | 0 |
+| Parameters.dll:0:0:0:0 | M6 | Parameters.dll:0:0:0:0 | s1 | 0 |
+| Parameters.dll:0:0:0:0 | M7 | Parameters.dll:0:0:0:0 | e1 | 0 |
+withDefaultValue
+| Parameters.cs:4:17:4:18 | M2 | Parameters.cs:4:34:4:34 | b | 1 | Parameters.cs:4:38:4:41 | null | null |
+| Parameters.cs:4:17:4:18 | M2 | Parameters.cs:4:51:4:51 | c | 2 | Parameters.cs:4:55:4:70 | "default string" | default string |
+| Parameters.cs:5:17:5:18 | M3 | Parameters.cs:5:24:5:24 | a | 0 | Parameters.cs:5:28:5:28 | 1 | 1 |
+| Parameters.cs:5:17:5:18 | M3 | Parameters.cs:5:38:5:38 | b | 1 | Parameters.cs:5:42:5:45 | null | null |
+| Parameters.cs:5:17:5:18 | M3 | Parameters.cs:5:55:5:55 | c | 2 | Parameters.cs:5:59:5:64 | "null" | null |
+| Parameters.cs:6:17:6:18 | M4 | Parameters.cs:6:24:6:24 | a | 0 | Parameters.cs:6:28:6:34 | (...) ... | 0 |
+| Parameters.cs:6:17:6:18 | M4 | Parameters.cs:6:44:6:44 | b | 1 | Parameters.cs:6:48:6:54 | default | null |
+| Parameters.cs:7:17:7:18 | M5 | Parameters.cs:7:24:7:24 | a | 0 | Parameters.cs:7:28:7:36 | object creation of type Int32 | 0 |
+| Parameters.cs:7:17:7:18 | M5 | Parameters.cs:7:46:7:46 | b | 1 | Parameters.cs:7:50:7:56 | default | null |
+| Parameters.cs:8:17:8:18 | M6 | Parameters.cs:8:42:8:43 | s2 | 1 | Parameters.cs:8:47:8:63 | default(...) | - |
+| Parameters.cs:8:17:8:18 | M6 | Parameters.cs:8:75:8:76 | s3 | 2 | Parameters.cs:8:80:8:93 | object creation of type MyStruct | - |
+| Parameters.cs:9:17:9:18 | M7 | Parameters.cs:9:38:9:39 | e2 | 1 | Parameters.cs:9:43:9:57 | default(...) | 0 |
+| Parameters.cs:9:17:9:18 | M7 | Parameters.cs:9:67:9:68 | e3 | 2 | Parameters.cs:9:72:9:83 | object creation of type MyEnum | 0 |
+| Parameters.cs:9:17:9:18 | M7 | Parameters.cs:9:93:9:94 | e4 | 3 | Parameters.cs:9:98:9:105 | access to constant A | 1 |
+| Parameters.cs:9:17:9:18 | M7 | Parameters.cs:9:115:9:116 | e5 | 4 | Parameters.cs:9:120:9:128 | (...) ... | 5 |
+| Parameters.cs:11:17:11:21 | M8 | Parameters.cs:11:25:11:25 | t | 0 | Parameters.cs:11:29:11:35 | (...) ... | - |
+| Parameters.cs:12:17:12:21 | M9 | Parameters.cs:12:25:12:25 | t | 0 | Parameters.cs:12:29:12:35 | (...) ... | - |
+| Parameters.cs:13:17:13:22 | M10 | Parameters.cs:13:26:13:26 | t | 0 | Parameters.cs:13:30:13:36 | (...) ... | null |
+| Parameters.dll:0:0:0:0 | M2 | Parameters.dll:0:0:0:0 | b | 1 | Parameters.dll:0:0:0:0 | default | null |
+| Parameters.dll:0:0:0:0 | M2 | Parameters.dll:0:0:0:0 | c | 2 | Parameters.dll:0:0:0:0 | "default string" | default string |
+| Parameters.dll:0:0:0:0 | M3 | Parameters.dll:0:0:0:0 | a | 0 | Parameters.dll:0:0:0:0 | 1 | 1 |
+| Parameters.dll:0:0:0:0 | M3 | Parameters.dll:0:0:0:0 | b | 1 | Parameters.dll:0:0:0:0 | default | null |
+| Parameters.dll:0:0:0:0 | M3 | Parameters.dll:0:0:0:0 | c | 2 | Parameters.dll:0:0:0:0 | "null" | null |
+| Parameters.dll:0:0:0:0 | M4 | Parameters.dll:0:0:0:0 | a | 0 | Parameters.dll:0:0:0:0 | 0 | 0 |
+| Parameters.dll:0:0:0:0 | M4 | Parameters.dll:0:0:0:0 | b | 1 | Parameters.dll:0:0:0:0 | default | null |
+| Parameters.dll:0:0:0:0 | M5 | Parameters.dll:0:0:0:0 | a | 0 | Parameters.dll:0:0:0:0 | 0 | 0 |
+| Parameters.dll:0:0:0:0 | M5 | Parameters.dll:0:0:0:0 | b | 1 | Parameters.dll:0:0:0:0 | default | null |
+| Parameters.dll:0:0:0:0 | M6 | Parameters.dll:0:0:0:0 | s2 | 1 | Parameters.dll:0:0:0:0 | default | - |
+| Parameters.dll:0:0:0:0 | M6 | Parameters.dll:0:0:0:0 | s3 | 2 | Parameters.dll:0:0:0:0 | default | - |
+| Parameters.dll:0:0:0:0 | M7 | Parameters.dll:0:0:0:0 | e2 | 1 | Parameters.dll:0:0:0:0 | (...) ... | 0 |
+| Parameters.dll:0:0:0:0 | M7 | Parameters.dll:0:0:0:0 | e3 | 2 | Parameters.dll:0:0:0:0 | (...) ... | 0 |
+| Parameters.dll:0:0:0:0 | M7 | Parameters.dll:0:0:0:0 | e4 | 3 | Parameters.dll:0:0:0:0 | (...) ... | 1 |
+| Parameters.dll:0:0:0:0 | M7 | Parameters.dll:0:0:0:0 | e5 | 4 | Parameters.dll:0:0:0:0 | (...) ... | 5 |
+| Parameters.dll:0:0:0:0 | M8 | Parameters.dll:0:0:0:0 | t | 0 | Parameters.dll:0:0:0:0 | default | - |
+| Parameters.dll:0:0:0:0 | M9 | Parameters.dll:0:0:0:0 | t | 0 | Parameters.dll:0:0:0:0 | default | - |
+| Parameters.dll:0:0:0:0 | M10 | Parameters.dll:0:0:0:0 | t | 0 | Parameters.dll:0:0:0:0 | default | null |
diff --git a/csharp/ql/test/library-tests/parameters/Parameters.ql b/csharp/ql/test/library-tests/parameters/Parameters.ql
new file mode 100644
index 00000000000..dca5c2d9006
--- /dev/null
+++ b/csharp/ql/test/library-tests/parameters/Parameters.ql
@@ -0,0 +1,19 @@
+import csharp
+
+private predicate fromTestLocation(Element e) {
+  e.fromSource() or e.getFile().getStem() = "Parameters"
+}
+
+query predicate noDefaultValue(Parameterizable container, Parameter p, int i) {
+  fromTestLocation(container) and
+  not p.hasDefaultValue() and
+  container.getParameter(i) = p
+}
+
+query predicate withDefaultValue(Parameterizable container, Parameter p, int i, Expr e, string value) {
+  fromTestLocation(container) and
+  p.hasDefaultValue() and
+  container.getParameter(i) = p and
+  p.getDefaultValue() = e and
+  if exists(e.getValue()) then value = e.getValue() else value = "-"
+}
diff --git a/csharp/ql/test/library-tests/standalone/controlflow/cfg.ql b/csharp/ql/test/library-tests/standalone/controlflow/cfg.ql
index 88a0a00c632..4936dc9b4cd 100644
--- a/csharp/ql/test/library-tests/standalone/controlflow/cfg.ql
+++ b/csharp/ql/test/library-tests/standalone/controlflow/cfg.ql
@@ -17,4 +17,6 @@ class UnknownLocalVariableDeclExpr extends LocalVariableDeclAndInitExpr {
   override string toString() { result = "(unknown type) " + this.getName() }
 }
 
-query predicate edges(ControlFlow::Node n1, ControlFlow::Node n2) { n2 = n1.getASuccessor() }
+query predicate edges(ControlFlow::Node n1, ControlFlow::Node n2) {
+  not n1.getElement().fromLibrary() and n2 = n1.getASuccessor()
+}
diff --git a/csharp/ql/test/query-tests/Metrics/Dependencies/ExternalDependencies/File1.cs b/csharp/ql/test/query-tests/Metrics/Dependencies/ExternalDependencies/File1.cs
deleted file mode 100644
index aff76d83b3f..00000000000
--- a/csharp/ql/test/query-tests/Metrics/Dependencies/ExternalDependencies/File1.cs
+++ /dev/null
@@ -1,30 +0,0 @@
-// semmle-extractor-options: /r:System.Collections.dll /r:System.Data.Common.dll /r:System.Runtime.Serialization.Primitives.dll /r:System.Private.Xml.dll /r:System.Xml.ReaderWriter.dll /r:System.Net.Primitives.dll /r:System.Net.Http.dll /r:System.Private.DataContractSerialization.dll /r:System.Runtime.Serialization.dll /r:System.ComponentModel.Primitives.dll
-
-using System.Collections.Generic;
-using System.Net.Http;
-using System.Xml;
-using System.Runtime.Serialization.Json;
-using System.Data;
-
-class C
-{
-    System.Net.Http.HttpClient client;
-    System.Xml.XmlReader reader;
-    IXmlJsonReaderInitializer init;
-
-    [DataSysDescription("")]
-    void Test()
-    {
-        client = new HttpClient();
-        var request = new HttpRequestMessage();
-        client.SendAsync(request);
-
-        Method<XmlReader>();
-    }
-
-    List<IXmlJsonReaderInitializer> initializerList;
-
-    void Method<T>()
-    {
-    }
-}
diff --git a/csharp/ql/test/query-tests/Metrics/Dependencies/ExternalDependencies/File2.cs b/csharp/ql/test/query-tests/Metrics/Dependencies/ExternalDependencies/File2.cs
deleted file mode 100644
index 8df4d961b26..00000000000
--- a/csharp/ql/test/query-tests/Metrics/Dependencies/ExternalDependencies/File2.cs
+++ /dev/null
@@ -1,5 +0,0 @@
-
-class D
-{
-    System.Net.Http.HttpClient client;
-}
diff --git a/csharp/ql/test/query-tests/Metrics/Files/FLinesOfDuplicatedCode/file1.cs b/csharp/ql/test/query-tests/Metrics/Files/FLinesOfDuplicatedCode/file1.cs
deleted file mode 100644
index a1af845b74d..00000000000
--- a/csharp/ql/test/query-tests/Metrics/Files/FLinesOfDuplicatedCode/file1.cs
+++ /dev/null
@@ -1,48 +0,0 @@
-// These are not counted as duplicates:
-
-using System;
-using System;
-using System;
-using System;
-using System;
-using System;
-using System;
-using System;
-using System;
-using System;
-
-class C1
-{
-    void f()
-    {
-        int a;
-        int b;
-        int c;
-        int d;
-        int e;
-        int f;
-        int g;
-        int h;
-        int i;
-        int j;
-        int k;
-    }
-}
-
-class C2
-{
-    void f()
-    {
-        int a;
-        int b;
-        int c;
-        int d;
-        int e;
-        int f;
-        int g;
-        int h;
-        int i;
-        int j;
-        int k;
-    }
-}
diff --git a/csharp/ql/test/query-tests/Metrics/Files/FLinesOfDuplicatedCode/file2.cs b/csharp/ql/test/query-tests/Metrics/Files/FLinesOfDuplicatedCode/file2.cs
deleted file mode 100644
index 2ac99295c6b..00000000000
--- a/csharp/ql/test/query-tests/Metrics/Files/FLinesOfDuplicatedCode/file2.cs
+++ /dev/null
@@ -1,30 +0,0 @@
-// These are not counted as duplicates:
-
-using System;
-using System;
-using System;
-using System;
-using System;
-using System;
-using System;
-using System;
-using System;
-
-class C3
-{
-    void f()
-    {
-        int a;
-        int b;
-        int c;
-        int d;
-        int e;
-        int f;
-        int g;
-        int h;
-        int i;
-        int j;
-        int k;
-    }
-}
-
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/StoredXSS/XSS.expected b/csharp/ql/test/query-tests/Security Features/CWE-079/StoredXSS/XSS.expected
index a661a86c71c..b4137bdb36d 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-079/StoredXSS/XSS.expected	
+++ b/csharp/ql/test/query-tests/Security Features/CWE-079/StoredXSS/XSS.expected	
@@ -1,12 +1,12 @@
 edges
-| XSS.cs:25:13:25:21 | [post] access to local variable userInput [[]] : String | XSS.cs:26:32:26:40 | access to local variable userInput [[]] : String |
-| XSS.cs:25:13:25:21 | [post] access to local variable userInput [[]] : String | XSS.cs:27:29:27:37 | access to local variable userInput [[]] : String |
-| XSS.cs:25:13:25:21 | [post] access to local variable userInput [[]] : String | XSS.cs:28:26:28:34 | access to local variable userInput [[]] : String |
+| XSS.cs:25:13:25:21 | [post] access to local variable userInput [element] : String | XSS.cs:26:32:26:40 | access to local variable userInput [element] : String |
+| XSS.cs:25:13:25:21 | [post] access to local variable userInput [element] : String | XSS.cs:27:29:27:37 | access to local variable userInput [element] : String |
+| XSS.cs:25:13:25:21 | [post] access to local variable userInput [element] : String | XSS.cs:28:26:28:34 | access to local variable userInput [element] : String |
 | XSS.cs:25:48:25:62 | access to field categoryTextBox : TextBox | XSS.cs:25:48:25:67 | access to property Text : String |
-| XSS.cs:25:48:25:67 | access to property Text : String | XSS.cs:25:13:25:21 | [post] access to local variable userInput [[]] : String |
-| XSS.cs:26:32:26:40 | access to local variable userInput [[]] : String | XSS.cs:26:32:26:51 | call to method ToString |
-| XSS.cs:27:29:27:37 | access to local variable userInput [[]] : String | XSS.cs:27:29:27:48 | call to method ToString |
-| XSS.cs:28:26:28:34 | access to local variable userInput [[]] : String | XSS.cs:28:26:28:45 | call to method ToString |
+| XSS.cs:25:48:25:67 | access to property Text : String | XSS.cs:25:13:25:21 | [post] access to local variable userInput [element] : String |
+| XSS.cs:26:32:26:40 | access to local variable userInput [element] : String | XSS.cs:26:32:26:51 | call to method ToString |
+| XSS.cs:27:29:27:37 | access to local variable userInput [element] : String | XSS.cs:27:29:27:48 | call to method ToString |
+| XSS.cs:28:26:28:34 | access to local variable userInput [element] : String | XSS.cs:28:26:28:45 | call to method ToString |
 | XSS.cs:37:27:37:53 | access to property QueryString : NameValueCollection | XSS.cs:38:36:38:39 | access to local variable name |
 | XSS.cs:57:27:57:65 | access to property QueryString : NameValueCollection | XSS.cs:59:22:59:25 | access to local variable name |
 | XSS.cs:75:27:75:53 | access to property QueryString : NameValueCollection | XSS.cs:76:36:76:39 | access to local variable name |
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-089/SqlInjection.cs b/csharp/ql/test/query-tests/Security Features/CWE-089/SqlInjection.cs
index 09a01281f79..f3593096e1e 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-089/SqlInjection.cs	
+++ b/csharp/ql/test/query-tests/Security Features/CWE-089/SqlInjection.cs	
@@ -1,4 +1,4 @@
-// semmle-extractor-options: /r:System.ComponentModel.Primitives.dll /r:System.ComponentModel.TypeConverter.dll /r:System.Data.Common.dll ${testdir}/../../../resources/stubs/EntityFramework.cs ${testdir}/../../../resources/stubs/System.Data.cs ${testdir}/../../../resources/stubs/System.Windows.cs
+// semmle-extractor-options: /r:System.ComponentModel.Primitives.dll /r:System.ComponentModel.TypeConverter.dll /r:System.Data.Common.dll ${testdir}/../../../resources/stubs/EntityFramework.cs ${testdir}/../../../resources/stubs/System.Data.cs ${testdir}/../../../resources/stubs/System.Windows.cs ${testdir}/../../../resources/stubs/Dapper.cs /r:System.Linq.Expressions.dll
 
 using System;
 
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-089/SqlInjection.expected b/csharp/ql/test/query-tests/Security Features/CWE-089/SqlInjection.expected
index 61dffee741f..2ad651f8c0e 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-089/SqlInjection.expected	
+++ b/csharp/ql/test/query-tests/Security Features/CWE-089/SqlInjection.expected	
@@ -5,6 +5,13 @@ edges
 | SqlInjection.cs:73:33:73:52 | access to property Text : String | SqlInjection.cs:74:56:74:61 | access to local variable query1 |
 | SqlInjection.cs:73:33:73:52 | access to property Text : String | SqlInjection.cs:75:55:75:60 | access to local variable query1 |
 | SqlInjection.cs:87:21:87:29 | access to property Text : String | SqlInjection.cs:88:50:88:55 | access to local variable query1 |
+| SqlInjectionDapper.cs:20:86:20:94 | access to property Text : String | SqlInjectionDapper.cs:21:55:21:59 | access to local variable query |
+| SqlInjectionDapper.cs:29:86:29:94 | access to property Text : String | SqlInjectionDapper.cs:30:66:30:70 | access to local variable query |
+| SqlInjectionDapper.cs:38:86:38:94 | access to property Text : String | SqlInjectionDapper.cs:39:63:39:67 | access to local variable query |
+| SqlInjectionDapper.cs:47:86:47:94 | access to property Text : String | SqlInjectionDapper.cs:49:47:49:51 | access to local variable query |
+| SqlInjectionDapper.cs:57:86:57:94 | access to property Text : String | SqlInjectionDapper.cs:58:42:58:46 | access to local variable query |
+| SqlInjectionDapper.cs:66:86:66:94 | access to property Text : String | SqlInjectionDapper.cs:67:42:67:46 | access to local variable query |
+| SqlInjectionDapper.cs:75:86:75:94 | access to property Text : String | SqlInjectionDapper.cs:77:52:77:56 | access to local variable query |
 nodes
 | SqlInjection.cs:38:21:38:35 | access to field categoryTextBox : TextBox | semmle.label | access to field categoryTextBox : TextBox |
 | SqlInjection.cs:38:21:38:40 | access to property Text : String | semmle.label | access to property Text : String |
@@ -15,8 +22,29 @@ nodes
 | SqlInjection.cs:75:55:75:60 | access to local variable query1 | semmle.label | access to local variable query1 |
 | SqlInjection.cs:87:21:87:29 | access to property Text : String | semmle.label | access to property Text : String |
 | SqlInjection.cs:88:50:88:55 | access to local variable query1 | semmle.label | access to local variable query1 |
+| SqlInjectionDapper.cs:20:86:20:94 | access to property Text : String | semmle.label | access to property Text : String |
+| SqlInjectionDapper.cs:21:55:21:59 | access to local variable query | semmle.label | access to local variable query |
+| SqlInjectionDapper.cs:29:86:29:94 | access to property Text : String | semmle.label | access to property Text : String |
+| SqlInjectionDapper.cs:30:66:30:70 | access to local variable query | semmle.label | access to local variable query |
+| SqlInjectionDapper.cs:38:86:38:94 | access to property Text : String | semmle.label | access to property Text : String |
+| SqlInjectionDapper.cs:39:63:39:67 | access to local variable query | semmle.label | access to local variable query |
+| SqlInjectionDapper.cs:47:86:47:94 | access to property Text : String | semmle.label | access to property Text : String |
+| SqlInjectionDapper.cs:49:47:49:51 | access to local variable query | semmle.label | access to local variable query |
+| SqlInjectionDapper.cs:57:86:57:94 | access to property Text : String | semmle.label | access to property Text : String |
+| SqlInjectionDapper.cs:58:42:58:46 | access to local variable query | semmle.label | access to local variable query |
+| SqlInjectionDapper.cs:66:86:66:94 | access to property Text : String | semmle.label | access to property Text : String |
+| SqlInjectionDapper.cs:67:42:67:46 | access to local variable query | semmle.label | access to local variable query |
+| SqlInjectionDapper.cs:75:86:75:94 | access to property Text : String | semmle.label | access to property Text : String |
+| SqlInjectionDapper.cs:77:52:77:56 | access to local variable query | semmle.label | access to local variable query |
 #select
 | SqlInjection.cs:39:50:39:55 | access to local variable query1 | SqlInjection.cs:38:21:38:35 | access to field categoryTextBox : TextBox | SqlInjection.cs:39:50:39:55 | access to local variable query1 | Query might include code from $@. | SqlInjection.cs:38:21:38:35 | access to field categoryTextBox : TextBox | this ASP.NET user input |
 | SqlInjection.cs:74:56:74:61 | access to local variable query1 | SqlInjection.cs:73:33:73:47 | access to field categoryTextBox : TextBox | SqlInjection.cs:74:56:74:61 | access to local variable query1 | Query might include code from $@. | SqlInjection.cs:73:33:73:47 | access to field categoryTextBox : TextBox | this ASP.NET user input |
 | SqlInjection.cs:75:55:75:60 | access to local variable query1 | SqlInjection.cs:73:33:73:47 | access to field categoryTextBox : TextBox | SqlInjection.cs:75:55:75:60 | access to local variable query1 | Query might include code from $@. | SqlInjection.cs:73:33:73:47 | access to field categoryTextBox : TextBox | this ASP.NET user input |
 | SqlInjection.cs:88:50:88:55 | access to local variable query1 | SqlInjection.cs:87:21:87:29 | access to property Text : String | SqlInjection.cs:88:50:88:55 | access to local variable query1 | Query might include code from $@. | SqlInjection.cs:87:21:87:29 | access to property Text : String | this TextBox text |
+| SqlInjectionDapper.cs:21:55:21:59 | access to local variable query | SqlInjectionDapper.cs:20:86:20:94 | access to property Text : String | SqlInjectionDapper.cs:21:55:21:59 | access to local variable query | Query might include code from $@. | SqlInjectionDapper.cs:20:86:20:94 | access to property Text : String | this TextBox text |
+| SqlInjectionDapper.cs:30:66:30:70 | access to local variable query | SqlInjectionDapper.cs:29:86:29:94 | access to property Text : String | SqlInjectionDapper.cs:30:66:30:70 | access to local variable query | Query might include code from $@. | SqlInjectionDapper.cs:29:86:29:94 | access to property Text : String | this TextBox text |
+| SqlInjectionDapper.cs:39:63:39:67 | access to local variable query | SqlInjectionDapper.cs:38:86:38:94 | access to property Text : String | SqlInjectionDapper.cs:39:63:39:67 | access to local variable query | Query might include code from $@. | SqlInjectionDapper.cs:38:86:38:94 | access to property Text : String | this TextBox text |
+| SqlInjectionDapper.cs:49:47:49:51 | access to local variable query | SqlInjectionDapper.cs:47:86:47:94 | access to property Text : String | SqlInjectionDapper.cs:49:47:49:51 | access to local variable query | Query might include code from $@. | SqlInjectionDapper.cs:47:86:47:94 | access to property Text : String | this TextBox text |
+| SqlInjectionDapper.cs:58:42:58:46 | access to local variable query | SqlInjectionDapper.cs:57:86:57:94 | access to property Text : String | SqlInjectionDapper.cs:58:42:58:46 | access to local variable query | Query might include code from $@. | SqlInjectionDapper.cs:57:86:57:94 | access to property Text : String | this TextBox text |
+| SqlInjectionDapper.cs:67:42:67:46 | access to local variable query | SqlInjectionDapper.cs:66:86:66:94 | access to property Text : String | SqlInjectionDapper.cs:67:42:67:46 | access to local variable query | Query might include code from $@. | SqlInjectionDapper.cs:66:86:66:94 | access to property Text : String | this TextBox text |
+| SqlInjectionDapper.cs:77:52:77:56 | access to local variable query | SqlInjectionDapper.cs:75:86:75:94 | access to property Text : String | SqlInjectionDapper.cs:77:52:77:56 | access to local variable query | Query might include code from $@. | SqlInjectionDapper.cs:75:86:75:94 | access to property Text : String | this TextBox text |
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-089/SqlInjectionDapper.cs b/csharp/ql/test/query-tests/Security Features/CWE-089/SqlInjectionDapper.cs
new file mode 100644
index 00000000000..ec54c70ddeb
--- /dev/null
+++ b/csharp/ql/test/query-tests/Security Features/CWE-089/SqlInjectionDapper.cs	
@@ -0,0 +1,95 @@
+using System;
+
+namespace Test
+{
+    using System.Data;
+    using System.Data.Entity;
+    using System.Data.SqlClient;
+    using System.Web.UI.WebControls;
+    using System.Threading.Tasks;
+    using Dapper;
+
+    class SqlInjectionDapper
+    {
+        string connectionString;
+
+        public void Bad01()
+        {
+            using (var connection = new SqlConnection(connectionString))
+            {
+                var query = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='" + box1.Text + "' ORDER BY PRICE";
+                var result = connection.Query<object>(query);
+            }
+        }
+
+        public async Task Bad02()
+        {
+            using (var connection = new SqlConnection(connectionString))
+            {
+                var query = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='" + box1.Text + "' ORDER BY PRICE";
+                var result = await connection.QueryAsync<object>(query);
+            }
+        }
+
+        public async Task Bad03()
+        {
+            using (var connection = new SqlConnection(connectionString))
+            {
+                var query = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='" + box1.Text + "' ORDER BY PRICE";
+                var result = await connection.QueryFirstAsync(query);
+            }
+        }
+
+        public async Task Bad04()
+        {
+            using (var connection = new SqlConnection(connectionString))
+            {
+                var query = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='" + box1.Text + "' ORDER BY PRICE";
+
+                await connection.ExecuteAsync(query);
+            }
+        }
+
+        public void Bad05()
+        {
+            using (var connection = new SqlConnection(connectionString))
+            {
+                var query = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='" + box1.Text + "' ORDER BY PRICE";
+                connection.ExecuteScalar(query);
+            }
+        }
+
+        public void Bad06()
+        {
+            using (var connection = new SqlConnection(connectionString))
+            {
+                var query = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='" + box1.Text + "' ORDER BY PRICE";
+                connection.ExecuteReader(query);
+            }
+        }
+
+        public async Task Bad07()
+        {
+            using (var connection = new SqlConnection(connectionString))
+            {
+                var query = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='" + box1.Text + "' ORDER BY PRICE";
+
+                var comDef = new CommandDefinition(query);
+                var result = await connection.QueryFirstAsync(comDef);
+            }
+        }
+
+        public async Task Ok07()
+        {
+            using (var connection = new SqlConnection(connectionString))
+            {
+                var query = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='" + box1.Text + "' ORDER BY PRICE";
+
+                var comDef = new CommandDefinition(query);
+                // no call to any query method
+            }
+        }
+
+        System.Windows.Forms.TextBox box1;
+    }
+}
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-338/InsecureRandomness.expected b/csharp/ql/test/query-tests/Security Features/CWE-338/InsecureRandomness.expected
index 138451c31dc..6b2615a85ce 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-338/InsecureRandomness.expected	
+++ b/csharp/ql/test/query-tests/Security Features/CWE-338/InsecureRandomness.expected	
@@ -1,11 +1,11 @@
 edges
-| InsecureRandomness.cs:28:13:28:16 | [post] access to local variable data [[]] : Int32 | InsecureRandomness.cs:29:57:29:60 | access to local variable data [[]] : Int32 |
-| InsecureRandomness.cs:28:23:28:43 | (...) ... : Int32 | InsecureRandomness.cs:28:13:28:16 | [post] access to local variable data [[]] : Int32 |
+| InsecureRandomness.cs:28:13:28:16 | [post] access to local variable data [element] : Int32 | InsecureRandomness.cs:29:57:29:60 | access to local variable data [element] : Int32 |
+| InsecureRandomness.cs:28:23:28:43 | (...) ... : Int32 | InsecureRandomness.cs:28:13:28:16 | [post] access to local variable data [element] : Int32 |
 | InsecureRandomness.cs:28:29:28:43 | call to method Next : Int32 | InsecureRandomness.cs:28:23:28:43 | (...) ... : Int32 |
-| InsecureRandomness.cs:29:13:29:18 | [post] access to local variable result [[]] : String | InsecureRandomness.cs:31:16:31:21 | access to local variable result [[]] : String |
-| InsecureRandomness.cs:29:27:29:61 | call to method GetString : String | InsecureRandomness.cs:29:13:29:18 | [post] access to local variable result [[]] : String |
-| InsecureRandomness.cs:29:57:29:60 | access to local variable data [[]] : Int32 | InsecureRandomness.cs:29:27:29:61 | call to method GetString : String |
-| InsecureRandomness.cs:31:16:31:21 | access to local variable result [[]] : String | InsecureRandomness.cs:31:16:31:32 | call to method ToString : String |
+| InsecureRandomness.cs:29:13:29:18 | [post] access to local variable result [element] : String | InsecureRandomness.cs:31:16:31:21 | access to local variable result [element] : String |
+| InsecureRandomness.cs:29:27:29:61 | call to method GetString : String | InsecureRandomness.cs:29:13:29:18 | [post] access to local variable result [element] : String |
+| InsecureRandomness.cs:29:57:29:60 | access to local variable data [element] : Int32 | InsecureRandomness.cs:29:27:29:61 | call to method GetString : String |
+| InsecureRandomness.cs:31:16:31:21 | access to local variable result [element] : String | InsecureRandomness.cs:31:16:31:32 | call to method ToString : String |
 | InsecureRandomness.cs:31:16:31:32 | call to method ToString : String | InsecureRandomness.cs:12:27:12:50 | call to method InsecureRandomString |
 | InsecureRandomness.cs:60:31:60:39 | call to method Next : Int32 | InsecureRandomness.cs:62:16:62:21 | access to local variable result : String |
 | InsecureRandomness.cs:62:16:62:21 | access to local variable result : String | InsecureRandomness.cs:62:16:62:32 | call to method ToString : String |
@@ -16,13 +16,13 @@ nodes
 | InsecureRandomness.cs:12:27:12:50 | call to method InsecureRandomString | semmle.label | call to method InsecureRandomString |
 | InsecureRandomness.cs:13:20:13:56 | call to method InsecureRandomStringFromSelection | semmle.label | call to method InsecureRandomStringFromSelection |
 | InsecureRandomness.cs:14:20:14:54 | call to method InsecureRandomStringFromIndexer | semmle.label | call to method InsecureRandomStringFromIndexer |
-| InsecureRandomness.cs:28:13:28:16 | [post] access to local variable data [[]] : Int32 | semmle.label | [post] access to local variable data [[]] : Int32 |
+| InsecureRandomness.cs:28:13:28:16 | [post] access to local variable data [element] : Int32 | semmle.label | [post] access to local variable data [element] : Int32 |
 | InsecureRandomness.cs:28:23:28:43 | (...) ... : Int32 | semmle.label | (...) ... : Int32 |
 | InsecureRandomness.cs:28:29:28:43 | call to method Next : Int32 | semmle.label | call to method Next : Int32 |
-| InsecureRandomness.cs:29:13:29:18 | [post] access to local variable result [[]] : String | semmle.label | [post] access to local variable result [[]] : String |
+| InsecureRandomness.cs:29:13:29:18 | [post] access to local variable result [element] : String | semmle.label | [post] access to local variable result [element] : String |
 | InsecureRandomness.cs:29:27:29:61 | call to method GetString : String | semmle.label | call to method GetString : String |
-| InsecureRandomness.cs:29:57:29:60 | access to local variable data [[]] : Int32 | semmle.label | access to local variable data [[]] : Int32 |
-| InsecureRandomness.cs:31:16:31:21 | access to local variable result [[]] : String | semmle.label | access to local variable result [[]] : String |
+| InsecureRandomness.cs:29:57:29:60 | access to local variable data [element] : Int32 | semmle.label | access to local variable data [element] : Int32 |
+| InsecureRandomness.cs:31:16:31:21 | access to local variable result [element] : String | semmle.label | access to local variable result [element] : String |
 | InsecureRandomness.cs:31:16:31:32 | call to method ToString : String | semmle.label | call to method ToString : String |
 | InsecureRandomness.cs:60:31:60:39 | call to method Next : Int32 | semmle.label | call to method Next : Int32 |
 | InsecureRandomness.cs:62:16:62:21 | access to local variable result : String | semmle.label | access to local variable result : String |
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-937/VulnerablePackage.expected b/csharp/ql/test/query-tests/Security Features/CWE-937/VulnerablePackage.expected
deleted file mode 100644
index 8aeb3d517e0..00000000000
--- a/csharp/ql/test/query-tests/Security Features/CWE-937/VulnerablePackage.expected	
+++ /dev/null
@@ -1,12 +0,0 @@
-| csproj.config:4:5:4:77 | System.Text.Encodings.Web 4.3.0 | Package 'System.Text.Encodings.Web 4.3.0' has vulnerability $@, and should be upgraded to version 4.3.1. | https://github.com/dotnet/corefx/issues/19535 | Microsoft Security Advisory 4021279 |
-| csproj.config:5:5:5:75 | system.text.encodings.web 4.3 | Package 'system.text.encodings.web 4.3' has vulnerability $@, and should be upgraded to version 4.3.1. | https://github.com/dotnet/corefx/issues/19535 | Microsoft Security Advisory 4021279 |
-| csproj.config:6:5:6:67 | System.Net.Http 4.1.1 | Package 'System.Net.Http 4.1.1' has vulnerability $@, and should be upgraded to version 4.1.2. | https://github.com/dotnet/corefx/issues/19535 | Microsoft Security Advisory 4021279 |
-| csproj.config:7:5:7:67 | System.Net.Http 4.1.2 | Package 'System.Net.Http 4.1.2' has vulnerability $@, and should be upgraded to version 4.3.4. | https://github.com/dotnet/announcements/issues/88 | CVE-2018-8292 |
-| csproj.config:8:5:8:70 | System.Private.Uri 4.3.0 | Package 'System.Private.Uri 4.3.0' has vulnerability $@, and should be upgraded to version 4.3.1. | https://github.com/dotnet/announcements/issues/97 | CVE-2019-0657 |
-| csproj.config:9:5:9:73 | Microsoft.NETCore.App 2.1.0 | Package 'Microsoft.NETCore.App 2.1.0' has vulnerability $@, and should be upgraded to version 2.1.8. | https://github.com/dotnet/announcements/issues/97 | CVE-2019-0657 |
-| csproj.config:10:5:10:73 | Microsoft.NETCore.App 2.2.1 | Package 'Microsoft.NETCore.App 2.2.1' has vulnerability $@, and should be upgraded to version 2.2.2. | https://github.com/dotnet/announcements/issues/97 | CVE-2019-0657 |
-| packages.config:9:3:9:79 | System.IO.Pipelines 4.5.0 | Package 'System.IO.Pipelines 4.5.0' has vulnerability $@, and should be upgraded to version 4.5.1. | https://github.com/aspnet/Announcements/issues/316 | CVE-2018-8409 |
-| packages.config:10:3:10:81 | System.IO.Pipelines 4.5.0.0 | Package 'System.IO.Pipelines 4.5.0.0' has vulnerability $@, and should be upgraded to version 4.5.1. | https://github.com/aspnet/Announcements/issues/316 | CVE-2018-8409 |
-| packages.config:11:3:11:84 | microsoft.aspnetcore.all 2.0.0 | Package 'microsoft.aspnetcore.all 2.0.0' has vulnerability $@, and should be upgraded to version 2.0.9. | https://github.com/aspnet/Announcements/issues/300 | ASPNETCore-Mar18 |
-| packages.config:11:3:11:84 | microsoft.aspnetcore.all 2.0.0 | Package 'microsoft.aspnetcore.all 2.0.0' has vulnerability $@, and should be upgraded to version 2.0.9. | https://github.com/aspnet/Announcements/issues/311 | ASPNETCore-July18 |
-| packages.config:12:3:12:84 | Microsoft.AspNetCore.All 2.0.8 | Package 'Microsoft.AspNetCore.All 2.0.8' has vulnerability $@, and should be upgraded to version 2.0.9. | https://github.com/aspnet/Announcements/issues/311 | ASPNETCore-July18 |
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-937/VulnerablePackage.qlref b/csharp/ql/test/query-tests/Security Features/CWE-937/VulnerablePackage.qlref
deleted file mode 100644
index fb8a73b25f9..00000000000
--- a/csharp/ql/test/query-tests/Security Features/CWE-937/VulnerablePackage.qlref	
+++ /dev/null
@@ -1 +0,0 @@
-Security Features/CWE-937/VulnerablePackage.ql
\ No newline at end of file
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-937/csproj.config b/csharp/ql/test/query-tests/Security Features/CWE-937/csproj.config
deleted file mode 100644
index 114d0631ba3..00000000000
--- a/csharp/ql/test/query-tests/Security Features/CWE-937/csproj.config	
+++ /dev/null
@@ -1,22 +0,0 @@
-<Project>
-  <ItemGroup>
-    <!-- These are BAD -->
-    <PackageReference Include="System.Text.Encodings.Web" Version="4.3.0" />
-    <PackageReference Include="system.text.encodings.web" Version="4.3" />
-    <PackageReference Include="System.Net.Http" Version="4.1.1" />
-    <PackageReference Include="System.Net.Http" Version="4.1.2" />
-    <PackageReference Include="System.Private.Uri" Version="4.3.0" />
-    <PackageReference Include="Microsoft.NETCore.App" Version="2.1.0" />
-    <PackageReference Include="Microsoft.NETCore.App" Version="2.2.1" />
-
-    <!-- These are GOOD -->
-    <PackageManagement Include="Microsoft.AspNetCore.All" Version="2.1.5" />
-    <PackageReference Include="System.Net.Http" Version="4.3.4" />
-    <PackageReference Include="System.Text.Encodings.Web" Version="4.2.9" />
-    <PackageReference Include="System.Text.Encodings.Web" Version="4.3.1" />
-    <PackageReference Include="System.Private.Uri" Version="4.3.1" />
-    <PackageReference Include="Microsoft.NETCore.App" Version="2.1.8" />
-    <PackageReference Include="Microsoft.NETCore.App" Version="2.2.2" />
-
-  </ItemGroup>
-</Project>
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-937/packages.config b/csharp/ql/test/query-tests/Security Features/CWE-937/packages.config
deleted file mode 100644
index 12f63f71043..00000000000
--- a/csharp/ql/test/query-tests/Security Features/CWE-937/packages.config	
+++ /dev/null
@@ -1,13 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<packages>
-  <!-- These are GOOD -->
-  <package id="System.IO.Pipelines" version="4.5.1" targetFramework="net45" />
-  <package id="System.IO.Pipelines" version="4.5.1.0" targetFramework="net45" />
-  <package id="Microsoft.AspNetCore.All" version="2.0.9" targetFramework="net45" />
-
-  <!-- These are BAD -->
-  <package id="System.IO.Pipelines" version="4.5.0" targetFramework="net45" />
-  <package id="System.IO.Pipelines" version="4.5.0.0" targetFramework="net45" />
-  <package id="microsoft.aspnetcore.all" version="2.0.0" targetFramework="net45" />
-  <package id="Microsoft.AspNetCore.All" version="2.0.8" targetFramework="net45" />
-</packages>
diff --git a/csharp/ql/test/query-tests/Stubs/MinimalStubsFromSource.expected b/csharp/ql/test/query-tests/Stubs/MinimalStubsFromSource.expected
index d2dd3037e3c..d4a68c97906 100644
--- a/csharp/ql/test/query-tests/Stubs/MinimalStubsFromSource.expected
+++ b/csharp/ql/test/query-tests/Stubs/MinimalStubsFromSource.expected
@@ -1 +1 @@
-| // This file contains auto-generated code.\n// original-extractor-options: /r:System.Text.RegularExpressions.dll /r:System.Collections.Specialized.dll /r:System.Net.dll /r:System.Web.dll /r:System.Net.HttpListener.dll /r:System.Collections.Specialized.dll /r:System.Private.Uri.dll /r:System.Runtime.Extensions.dll /r:System.Linq.Parallel.dll /r:System.Collections.Concurrent.dll /r:System.Linq.Expressions.dll /r:System.Collections.dll /r:System.Linq.Queryable.dll /r:System.Linq.dll /r:System.Collections.NonGeneric.dll /r:System.ObjectModel.dll /r:System.ComponentModel.TypeConverter.dll /r:System.IO.Compression.dll /r:System.IO.Pipes.dll /r:System.Net.Primitives.dll /r:System.Net.Security.dll /r:System.Security.Cryptography.Primitives.dll /r:System.Text.RegularExpressions.dll ${testdir}/../../resources/stubs/System.Web.cs /r:System.Runtime.Serialization.Primitives.dll\n\nnamespace System\n{\n// Generated from `System.Uri` in `System.Private.Uri, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class Uri : System.Runtime.Serialization.ISerializable\n{\n    public override bool Equals(object comparand) => throw null;\n    public override int GetHashCode() => throw null;\n    public override string ToString() => throw null;\n    void System.Runtime.Serialization.ISerializable.GetObjectData(System.Runtime.Serialization.SerializationInfo serializationInfo, System.Runtime.Serialization.StreamingContext streamingContext) => throw null;\n}\n\nnamespace Collections\n{\n// Generated from `System.Collections.Queue` in `System.Collections.NonGeneric, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class Queue : System.ICloneable, System.Collections.IEnumerable, System.Collections.ICollection\n{\n    public virtual System.Collections.IEnumerator GetEnumerator() => throw null;\n    public virtual bool IsSynchronized { get => throw null; }\n    public virtual int Count { get => throw null; }\n    public virtual object Clone() => throw null;\n    public virtual object SyncRoot { get => throw null; }\n    public virtual void CopyTo(System.Array array, int index) => throw null;\n}\n\n// Generated from `System.Collections.SortedList` in `System.Collections.NonGeneric, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class SortedList : System.ICloneable, System.Collections.IEnumerable, System.Collections.IDictionary, System.Collections.ICollection\n{\n    System.Collections.IEnumerator System.Collections.IEnumerable.GetEnumerator() => throw null;\n    public virtual System.Collections.ICollection Keys { get => throw null; }\n    public virtual System.Collections.ICollection Values { get => throw null; }\n    public virtual System.Collections.IDictionaryEnumerator GetEnumerator() => throw null;\n    public virtual bool Contains(object key) => throw null;\n    public virtual bool IsFixedSize { get => throw null; }\n    public virtual bool IsReadOnly { get => throw null; }\n    public virtual bool IsSynchronized { get => throw null; }\n    public virtual int Count { get => throw null; }\n    public virtual object Clone() => throw null;\n    public virtual object GetByIndex(int index) => throw null;\n    public virtual object SyncRoot { get => throw null; }\n    public virtual object this[object key] { get => throw null; set => throw null; }\n    public virtual void Add(object key, object value) => throw null;\n    public virtual void Clear() => throw null;\n    public virtual void CopyTo(System.Array array, int arrayIndex) => throw null;\n    public virtual void Remove(object key) => throw null;\n}\n\n// Generated from `System.Collections.Stack` in `System.Collections.NonGeneric, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class Stack : System.ICloneable, System.Collections.IEnumerable, System.Collections.ICollection\n{\n    public virtual System.Collections.IEnumerator GetEnumerator() => throw null;\n    public virtual bool IsSynchronized { get => throw null; }\n    public virtual int Count { get => throw null; }\n    public virtual object Clone() => throw null;\n    public virtual object SyncRoot { get => throw null; }\n    public virtual void CopyTo(System.Array array, int index) => throw null;\n}\n\nnamespace Concurrent\n{\n// Generated from `System.Collections.Concurrent.BlockingCollection<>` in `System.Collections.Concurrent, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class BlockingCollection<T> : System.IDisposable, System.Collections.IEnumerable, System.Collections.ICollection, System.Collections.Generic.IReadOnlyCollection<T>, System.Collections.Generic.IEnumerable<T>\n{\n    System.Collections.Generic.IEnumerator<T> System.Collections.Generic.IEnumerable<T>.GetEnumerator() => throw null;\n    System.Collections.IEnumerator System.Collections.IEnumerable.GetEnumerator() => throw null;\n    bool System.Collections.ICollection.IsSynchronized { get => throw null; }\n    object System.Collections.ICollection.SyncRoot { get => throw null; }\n    public int Count { get => throw null; }\n    public void Dispose() => throw null;\n    void System.Collections.ICollection.CopyTo(System.Array array, int index) => throw null;\n}\n\n// Generated from `System.Collections.Concurrent.BlockingCollectionDebugView<>` in `System.Collections.Concurrent, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nclass BlockingCollectionDebugView<T>\n{\n}\n\n// Generated from `System.Collections.Concurrent.IDictionaryDebugView<,>` in `System.Collections.Concurrent, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nclass IDictionaryDebugView<TKey,TValue>\n{\n}\n\n}\nnamespace Generic\n{\n// Generated from `System.Collections.Generic.CollectionDebugView<>` in `System.ObjectModel, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nclass CollectionDebugView<T>\n{\n}\n\n// Generated from `System.Collections.Generic.DictionaryDebugView<,>` in `System.ObjectModel, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nclass DictionaryDebugView<K,V>\n{\n}\n\n// Generated from `System.Collections.Generic.QueueDebugView<>` in `System.Collections, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nclass QueueDebugView<T>\n{\n}\n\n// Generated from `System.Collections.Generic.SortedSet<>` in `System.Collections, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class SortedSet<T> : System.Runtime.Serialization.ISerializable, System.Runtime.Serialization.IDeserializationCallback, System.Collections.IEnumerable, System.Collections.ICollection, System.Collections.Generic.ISet<T>, System.Collections.Generic.IReadOnlySet<T>, System.Collections.Generic.IReadOnlyCollection<T>, System.Collections.Generic.IEnumerable<T>, System.Collections.Generic.ICollection<T>\n{\n    System.Collections.Generic.IEnumerator<T> System.Collections.Generic.IEnumerable<T>.GetEnumerator() => throw null;\n    System.Collections.IEnumerator System.Collections.IEnumerable.GetEnumerator() => throw null;\n    bool System.Collections.Generic.ICollection<T>.IsReadOnly { get => throw null; }\n    bool System.Collections.ICollection.IsSynchronized { get => throw null; }\n    object System.Collections.ICollection.SyncRoot { get => throw null; }\n    public bool Add(T item) => throw null;\n    public bool IsProperSubsetOf(System.Collections.Generic.IEnumerable<T> other) => throw null;\n    public bool IsProperSupersetOf(System.Collections.Generic.IEnumerable<T> other) => throw null;\n    public bool IsSubsetOf(System.Collections.Generic.IEnumerable<T> other) => throw null;\n    public bool IsSupersetOf(System.Collections.Generic.IEnumerable<T> other) => throw null;\n    public bool Overlaps(System.Collections.Generic.IEnumerable<T> other) => throw null;\n    public bool Remove(T item) => throw null;\n    public bool SetEquals(System.Collections.Generic.IEnumerable<T> other) => throw null;\n    public int Count { get => throw null; }\n    public virtual bool Contains(T item) => throw null;\n    public virtual void Clear() => throw null;\n    public virtual void IntersectWith(System.Collections.Generic.IEnumerable<T> other) => throw null;\n    public void CopyTo(T[] array, int index) => throw null;\n    public void ExceptWith(System.Collections.Generic.IEnumerable<T> other) => throw null;\n    public void SymmetricExceptWith(System.Collections.Generic.IEnumerable<T> other) => throw null;\n    public void UnionWith(System.Collections.Generic.IEnumerable<T> other) => throw null;\n    void System.Collections.Generic.ICollection<T>.Add(T item) => throw null;\n    void System.Collections.ICollection.CopyTo(System.Array array, int index) => throw null;\n    void System.Runtime.Serialization.IDeserializationCallback.OnDeserialization(object sender) => throw null;\n    void System.Runtime.Serialization.ISerializable.GetObjectData(System.Runtime.Serialization.SerializationInfo info, System.Runtime.Serialization.StreamingContext context) => throw null;\n}\n\n// Generated from `System.Collections.Generic.Stack<>` in `System.Collections, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class Stack<T> : System.Collections.IEnumerable, System.Collections.ICollection, System.Collections.Generic.IReadOnlyCollection<T>, System.Collections.Generic.IEnumerable<T>\n{\n    System.Collections.Generic.IEnumerator<T> System.Collections.Generic.IEnumerable<T>.GetEnumerator() => throw null;\n    System.Collections.IEnumerator System.Collections.IEnumerable.GetEnumerator() => throw null;\n    bool System.Collections.ICollection.IsSynchronized { get => throw null; }\n    object System.Collections.ICollection.SyncRoot { get => throw null; }\n    public T Peek() => throw null;\n    public int Count { get => throw null; }\n    void System.Collections.ICollection.CopyTo(System.Array array, int arrayIndex) => throw null;\n}\n\n// Generated from `System.Collections.Generic.StackDebugView<>` in `System.Collections, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nclass StackDebugView<T>\n{\n}\n\n}\nnamespace Specialized\n{\n// Generated from `System.Collections.Specialized.NameObjectCollectionBase` in `System.Collections.Specialized, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nabstract public class NameObjectCollectionBase : System.Runtime.Serialization.ISerializable, System.Runtime.Serialization.IDeserializationCallback, System.Collections.IEnumerable, System.Collections.ICollection\n{\n    bool System.Collections.ICollection.IsSynchronized { get => throw null; }\n    object System.Collections.ICollection.SyncRoot { get => throw null; }\n    public virtual System.Collections.IEnumerator GetEnumerator() => throw null;\n    public virtual int Count { get => throw null; }\n    public virtual void GetObjectData(System.Runtime.Serialization.SerializationInfo info, System.Runtime.Serialization.StreamingContext context) => throw null;\n    public virtual void OnDeserialization(object sender) => throw null;\n    void System.Collections.ICollection.CopyTo(System.Array array, int index) => throw null;\n}\n\n// Generated from `System.Collections.Specialized.NameValueCollection` in `System.Collections.Specialized, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class NameValueCollection : System.Collections.Specialized.NameObjectCollectionBase\n{\n    public string this[string name] { get => throw null; set => throw null; }\n}\n\n}\n}\nnamespace ComponentModel\n{\n// Generated from `System.ComponentModel.ComponentConverter` in `System.ComponentModel.TypeConverter, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class ComponentConverter : System.ComponentModel.ReferenceConverter\n{\n}\n\n// Generated from `System.ComponentModel.DefaultEventAttribute` in `System.ComponentModel.TypeConverter, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class DefaultEventAttribute : System.Attribute\n{\n    public DefaultEventAttribute(string name) => throw null;\n    public override bool Equals(object obj) => throw null;\n    public override int GetHashCode() => throw null;\n}\n\n// Generated from `System.ComponentModel.DefaultPropertyAttribute` in `System.ComponentModel.TypeConverter, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class DefaultPropertyAttribute : System.Attribute\n{\n    public DefaultPropertyAttribute(string name) => throw null;\n    public override bool Equals(object obj) => throw null;\n    public override int GetHashCode() => throw null;\n}\n\n// Generated from `System.ComponentModel.INotifyPropertyChanged` in `System.ObjectModel, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic interface INotifyPropertyChanged\n{\n}\n\n// Generated from `System.ComponentModel.ReferenceConverter` in `System.ComponentModel.TypeConverter, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class ReferenceConverter : System.ComponentModel.TypeConverter\n{\n}\n\n// Generated from `System.ComponentModel.TypeConverterAttribute` in `System.ObjectModel, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class TypeConverterAttribute : System.Attribute\n{\n    public TypeConverterAttribute() => throw null;\n    public TypeConverterAttribute(System.Type type) => throw null;\n    public TypeConverterAttribute(string typeName) => throw null;\n    public override bool Equals(object obj) => throw null;\n    public override int GetHashCode() => throw null;\n}\n\n// Generated from `System.ComponentModel.TypeConverter` in `System.ComponentModel.TypeConverter, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class TypeConverter\n{\n}\n\n// Generated from `System.ComponentModel.TypeDescriptionProviderAttribute` in `System.ObjectModel, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class TypeDescriptionProviderAttribute : System.Attribute\n{\n    public TypeDescriptionProviderAttribute(System.Type type) => throw null;\n    public TypeDescriptionProviderAttribute(string typeName) => throw null;\n}\n\n// Generated from `System.ComponentModel.TypeDescriptionProvider` in `System.ComponentModel.TypeConverter, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nabstract public class TypeDescriptionProvider\n{\n}\n\n// Generated from `System.ComponentModel.TypeDescriptor` in `System.ComponentModel.TypeConverter, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class TypeDescriptor\n{\n}\n\nnamespace Design\n{\n// Generated from `System.ComponentModel.Design.DesignerOptionService` in `System.ComponentModel.TypeConverter, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nabstract public class DesignerOptionService : System.ComponentModel.Design.IDesignerOptionService\n{\n}\n\n// Generated from `System.ComponentModel.Design.IDesignerOptionService` in `System.ComponentModel.TypeConverter, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic interface IDesignerOptionService\n{\n}\n\n}\n}\nnamespace Dynamic\n{\n// Generated from `System.Dynamic.DynamicMetaObject` in `System.Linq.Expressions, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class DynamicMetaObject\n{\n}\n\n// Generated from `System.Dynamic.ExpandoObject` in `System.Linq.Expressions, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class ExpandoObject : System.Dynamic.IDynamicMetaObjectProvider, System.ComponentModel.INotifyPropertyChanged, System.Collections.IEnumerable, System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<string,object>>, System.Collections.Generic.IDictionary<string,object>, System.Collections.Generic.ICollection<System.Collections.Generic.KeyValuePair<string,object>>\n{\n    System.Collections.Generic.ICollection<object> System.Collections.Generic.IDictionary<string,object>.Values { get => throw null; }\n    System.Collections.Generic.ICollection<string> System.Collections.Generic.IDictionary<string,object>.Keys { get => throw null; }\n    System.Collections.Generic.IEnumerator<System.Collections.Generic.KeyValuePair<string,object>> System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<string,object>>.GetEnumerator() => throw null;\n    System.Collections.IEnumerator System.Collections.IEnumerable.GetEnumerator() => throw null;\n    bool System.Collections.Generic.ICollection<System.Collections.Generic.KeyValuePair<string,object>>.Contains(System.Collections.Generic.KeyValuePair<string,object> item) => throw null;\n    bool System.Collections.Generic.ICollection<System.Collections.Generic.KeyValuePair<string,object>>.IsReadOnly { get => throw null; }\n    bool System.Collections.Generic.ICollection<System.Collections.Generic.KeyValuePair<string,object>>.Remove(System.Collections.Generic.KeyValuePair<string,object> item) => throw null;\n    bool System.Collections.Generic.IDictionary<string,object>.ContainsKey(string key) => throw null;\n    bool System.Collections.Generic.IDictionary<string,object>.Remove(string key) => throw null;\n    bool System.Collections.Generic.IDictionary<string,object>.TryGetValue(string key, out object value) => throw null;\n    int System.Collections.Generic.ICollection<System.Collections.Generic.KeyValuePair<string,object>>.Count { get => throw null; }\n    object this[string key] { get => throw null; set => throw null; }\n    void System.Collections.Generic.ICollection<System.Collections.Generic.KeyValuePair<string,object>>.Add(System.Collections.Generic.KeyValuePair<string,object> item) => throw null;\n    void System.Collections.Generic.ICollection<System.Collections.Generic.KeyValuePair<string,object>>.Clear() => throw null;\n    void System.Collections.Generic.ICollection<System.Collections.Generic.KeyValuePair<string,object>>.CopyTo(System.Collections.Generic.KeyValuePair<string,object>[] array, int arrayIndex) => throw null;\n    void System.Collections.Generic.IDictionary<string,object>.Add(string key, object value) => throw null;\n}\n\n// Generated from `System.Dynamic.IDynamicMetaObjectProvider` in `System.Linq.Expressions, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic interface IDynamicMetaObjectProvider\n{\n}\n\nnamespace Utils\n{\n// Generated from `System.Dynamic.Utils.ListProvider<>` in `System.Linq.Expressions, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nabstract class ListProvider<T> : System.Collections.IEnumerable, System.Collections.Generic.IList<T>, System.Collections.Generic.IEnumerable<T>, System.Collections.Generic.ICollection<T> where T: class\n{\n    System.Collections.IEnumerator System.Collections.IEnumerable.GetEnumerator() => throw null;\n    public System.Collections.Generic.IEnumerator<T> GetEnumerator() => throw null;\n    public T this[int index] { get => throw null; set => throw null; }\n    public bool Contains(T item) => throw null;\n    public bool IsReadOnly { get => throw null; }\n    public bool Remove(T item) => throw null;\n    public int Count { get => throw null; }\n    public int IndexOf(T item) => throw null;\n    public void Add(T item) => throw null;\n    public void Clear() => throw null;\n    public void CopyTo(T[] array, int index) => throw null;\n    public void Insert(int index, T item) => throw null;\n    public void RemoveAt(int index) => throw null;\n}\n\n}\n}\nnamespace IO\n{\nnamespace Compression\n{\n// Generated from `System.IO.Compression.DeflateStream` in `System.IO.Compression, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089`\npublic class DeflateStream : System.IO.Stream\n{\n    protected override void Dispose(bool disposing) => throw null;\n    public override System.IAsyncResult BeginRead(System.Byte[] buffer, int offset, int count, System.AsyncCallback asyncCallback, object asyncState) => throw null;\n    public override System.IAsyncResult BeginWrite(System.Byte[] array, int offset, int count, System.AsyncCallback asyncCallback, object asyncState) => throw null;\n    public override System.Int64 Length { get => throw null; }\n    public override System.Int64 Position { get => throw null; set => throw null; }\n    public override System.Int64 Seek(System.Int64 offset, System.IO.SeekOrigin origin) => throw null;\n    public override System.Threading.Tasks.Task CopyToAsync(System.IO.Stream destination, int bufferSize, System.Threading.CancellationToken cancellationToken) => throw null;\n    public override System.Threading.Tasks.Task FlushAsync(System.Threading.CancellationToken cancellationToken) => throw null;\n    public override System.Threading.Tasks.Task WriteAsync(System.Byte[] array, int offset, int count, System.Threading.CancellationToken cancellationToken) => throw null;\n    public override System.Threading.Tasks.Task<int> ReadAsync(System.Byte[] array, int offset, int count, System.Threading.CancellationToken cancellationToken) => throw null;\n    public override System.Threading.Tasks.ValueTask DisposeAsync() => throw null;\n    public override System.Threading.Tasks.ValueTask WriteAsync(System.ReadOnlyMemory<System.Byte> buffer, System.Threading.CancellationToken cancellationToken) => throw null;\n    public override System.Threading.Tasks.ValueTask<int> ReadAsync(System.Memory<System.Byte> buffer, System.Threading.CancellationToken cancellationToken) => throw null;\n    public override bool CanRead { get => throw null; }\n    public override bool CanSeek { get => throw null; }\n    public override bool CanWrite { get => throw null; }\n    public override int EndRead(System.IAsyncResult asyncResult) => throw null;\n    public override int Read(System.Byte[] array, int offset, int count) => throw null;\n    public override int Read(System.Span<System.Byte> buffer) => throw null;\n    public override int ReadByte() => throw null;\n    public override void CopyTo(System.IO.Stream destination, int bufferSize) => throw null;\n    public override void EndWrite(System.IAsyncResult asyncResult) => throw null;\n    public override void Flush() => throw null;\n    public override void SetLength(System.Int64 value) => throw null;\n    public override void Write(System.Byte[] array, int offset, int count) => throw null;\n    public override void Write(System.ReadOnlySpan<System.Byte> buffer) => throw null;\n}\n\n}\n}\nnamespace Linq\n{\n// Generated from `System.Linq.Enumerable` in `System.Linq, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nstatic public class Enumerable\n{\n    public static System.Collections.Generic.IEnumerable<TResult> Select<TSource,TResult>(this System.Collections.Generic.IEnumerable<TSource> source, System.Func<TSource,TResult> selector) => throw null;\n}\n\n// Generated from `System.Linq.Grouping<,>` in `System.Linq, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class Grouping<TKey,TElement> : System.Linq.IGrouping<TKey,TElement>, System.Collections.IEnumerable, System.Collections.Generic.IList<TElement>, System.Collections.Generic.IEnumerable<TElement>, System.Collections.Generic.ICollection<TElement>\n{\n    System.Collections.IEnumerator System.Collections.IEnumerable.GetEnumerator() => throw null;\n    TElement this[int index] { get => throw null; set => throw null; }\n    bool System.Collections.Generic.ICollection<TElement>.Contains(TElement item) => throw null;\n    bool System.Collections.Generic.ICollection<TElement>.IsReadOnly { get => throw null; }\n    bool System.Collections.Generic.ICollection<TElement>.Remove(TElement item) => throw null;\n    int System.Collections.Generic.ICollection<TElement>.Count { get => throw null; }\n    int System.Collections.Generic.IList<TElement>.IndexOf(TElement item) => throw null;\n    public System.Collections.Generic.IEnumerator<TElement> GetEnumerator() => throw null;\n    void System.Collections.Generic.ICollection<TElement>.Add(TElement item) => throw null;\n    void System.Collections.Generic.ICollection<TElement>.Clear() => throw null;\n    void System.Collections.Generic.ICollection<TElement>.CopyTo(TElement[] array, int arrayIndex) => throw null;\n    void System.Collections.Generic.IList<TElement>.Insert(int index, TElement item) => throw null;\n    void System.Collections.Generic.IList<TElement>.RemoveAt(int index) => throw null;\n}\n\n// Generated from `System.Linq.IGrouping<,>` in `System.Linq, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic interface IGrouping<TKey,TElement> : System.Collections.IEnumerable, System.Collections.Generic.IEnumerable<TElement>\n{\n}\n\n// Generated from `System.Linq.IIListProvider<>` in `System.Linq, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\ninterface IIListProvider<TElement> : System.Collections.IEnumerable, System.Collections.Generic.IEnumerable<TElement>\n{\n}\n\n// Generated from `System.Linq.ILookup<,>` in `System.Linq, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic interface ILookup<TKey,TElement> : System.Collections.IEnumerable, System.Collections.Generic.IEnumerable<System.Linq.IGrouping<TKey,TElement>>\n{\n}\n\n// Generated from `System.Linq.IOrderedEnumerable<>` in `System.Linq, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic interface IOrderedEnumerable<TElement> : System.Collections.IEnumerable, System.Collections.Generic.IEnumerable<TElement>\n{\n}\n\n// Generated from `System.Linq.IPartition<>` in `System.Linq, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\ninterface IPartition<TElement> : System.Linq.IIListProvider<TElement>, System.Collections.IEnumerable, System.Collections.Generic.IEnumerable<TElement>\n{\n}\n\n// Generated from `System.Linq.IQueryable` in `System.Linq.Expressions, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic interface IQueryable : System.Collections.IEnumerable\n{\n}\n\n// Generated from `System.Linq.Lookup<,>` in `System.Linq, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class Lookup<TKey,TElement> : System.Linq.ILookup<TKey,TElement>, System.Linq.IIListProvider<System.Linq.IGrouping<TKey,TElement>>, System.Collections.IEnumerable, System.Collections.Generic.IEnumerable<System.Linq.IGrouping<TKey,TElement>>\n{\n    System.Collections.IEnumerator System.Collections.IEnumerable.GetEnumerator() => throw null;\n    public System.Collections.Generic.IEnumerator<System.Linq.IGrouping<TKey,TElement>> GetEnumerator() => throw null;\n}\n\n// Generated from `System.Linq.OrderedEnumerable<>` in `System.Linq, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nabstract class OrderedEnumerable<TElement> : System.Linq.IPartition<TElement>, System.Linq.IOrderedEnumerable<TElement>, System.Linq.IIListProvider<TElement>, System.Collections.IEnumerable, System.Collections.Generic.IEnumerable<TElement>\n{\n    System.Collections.IEnumerator System.Collections.IEnumerable.GetEnumerator() => throw null;\n    public System.Collections.Generic.IEnumerator<TElement> GetEnumerator() => throw null;\n}\n\n// Generated from `System.Linq.ParallelEnumerable` in `System.Linq.Parallel, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nstatic public class ParallelEnumerable\n{\n    public static System.Linq.ParallelQuery AsParallel(this System.Collections.IEnumerable source) => throw null;\n}\n\n// Generated from `System.Linq.ParallelQuery<>` in `System.Linq.Parallel, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class ParallelQuery<TSource> : System.Linq.ParallelQuery, System.Collections.IEnumerable, System.Collections.Generic.IEnumerable<TSource>\n{\n    public virtual System.Collections.Generic.IEnumerator<TSource> GetEnumerator() => throw null;\n}\n\n// Generated from `System.Linq.ParallelQuery` in `System.Linq.Parallel, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class ParallelQuery : System.Collections.IEnumerable\n{\n    System.Collections.IEnumerator System.Collections.IEnumerable.GetEnumerator() => throw null;\n}\n\n// Generated from `System.Linq.Queryable` in `System.Linq.Queryable, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nstatic public class Queryable\n{\n    public static System.Linq.IQueryable AsQueryable(this System.Collections.IEnumerable source) => throw null;\n}\n\n// Generated from `System.Linq.SystemLinq_GroupingDebugView<,>` in `System.Linq, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nclass SystemLinq_GroupingDebugView<TKey,TElement>\n{\n}\n\n// Generated from `System.Linq.SystemLinq_LookupDebugView<,>` in `System.Linq, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nclass SystemLinq_LookupDebugView<TKey,TElement>\n{\n}\n\nnamespace Expressions\n{\n// Generated from `System.Linq.Expressions.BlockExpressionList` in `System.Linq.Expressions, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nclass BlockExpressionList : System.Collections.IEnumerable, System.Collections.Generic.IList<System.Linq.Expressions.Expression>, System.Collections.Generic.IEnumerable<System.Linq.Expressions.Expression>, System.Collections.Generic.ICollection<System.Linq.Expressions.Expression>\n{\n    System.Collections.IEnumerator System.Collections.IEnumerable.GetEnumerator() => throw null;\n    public System.Collections.Generic.IEnumerator<System.Linq.Expressions.Expression> GetEnumerator() => throw null;\n    public System.Linq.Expressions.Expression this[int index] { get => throw null; set => throw null; }\n    public bool Contains(System.Linq.Expressions.Expression item) => throw null;\n    public bool IsReadOnly { get => throw null; }\n    public bool Remove(System.Linq.Expressions.Expression item) => throw null;\n    public int Count { get => throw null; }\n    public int IndexOf(System.Linq.Expressions.Expression item) => throw null;\n    public void Add(System.Linq.Expressions.Expression item) => throw null;\n    public void Clear() => throw null;\n    public void CopyTo(System.Linq.Expressions.Expression[] array, int index) => throw null;\n    public void Insert(int index, System.Linq.Expressions.Expression item) => throw null;\n    public void RemoveAt(int index) => throw null;\n}\n\n// Generated from `System.Linq.Expressions.Expression` in `System.Linq.Expressions, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nabstract public class Expression\n{\n    public override string ToString() => throw null;\n}\n\n// Generated from `System.Linq.Expressions.ParameterExpression` in `System.Linq.Expressions, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class ParameterExpression : System.Linq.Expressions.Expression\n{\n}\n\nnamespace Compiler\n{\n// Generated from `System.Linq.Expressions.Compiler.ParameterList` in `System.Linq.Expressions, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nclass ParameterList : System.Collections.IEnumerable, System.Collections.Generic.IReadOnlyList<System.Linq.Expressions.ParameterExpression>, System.Collections.Generic.IReadOnlyCollection<System.Linq.Expressions.ParameterExpression>, System.Collections.Generic.IEnumerable<System.Linq.Expressions.ParameterExpression>\n{\n    System.Collections.IEnumerator System.Collections.IEnumerable.GetEnumerator() => throw null;\n    public System.Collections.Generic.IEnumerator<System.Linq.Expressions.ParameterExpression> GetEnumerator() => throw null;\n    public System.Linq.Expressions.ParameterExpression this[int index] { get => throw null; }\n    public int Count { get => throw null; }\n}\n\n}\nnamespace Interpreter\n{\n// Generated from `System.Linq.Expressions.Interpreter.InstructionArray` in `System.Linq.Expressions, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nstruct InstructionArray\n{\n}\n\n// Generated from `System.Linq.Expressions.Interpreter.InstructionList` in `System.Linq.Expressions, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nclass InstructionList\n{\n}\n\n// Generated from `System.Linq.Expressions.Interpreter.InterpretedFrameInfo` in `System.Linq.Expressions, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nstruct InterpretedFrameInfo\n{\n    public override string ToString() => throw null;\n}\n\n// Generated from `System.Linq.Expressions.Interpreter.InterpretedFrame` in `System.Linq.Expressions, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nclass InterpretedFrame\n{\n}\n\n}\n}\nnamespace Parallel\n{\n// Generated from `System.Linq.Parallel.ListChunk<>` in `System.Linq.Parallel, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nclass ListChunk<TInputOutput> : System.Collections.IEnumerable, System.Collections.Generic.IEnumerable<TInputOutput>\n{\n    System.Collections.IEnumerator System.Collections.IEnumerable.GetEnumerator() => throw null;\n    public System.Collections.Generic.IEnumerator<TInputOutput> GetEnumerator() => throw null;\n}\n\n// Generated from `System.Linq.Parallel.Lookup<,>` in `System.Linq.Parallel, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nclass Lookup<TKey,TElement> : System.Linq.ILookup<TKey,TElement>, System.Collections.IEnumerable, System.Collections.Generic.IEnumerable<System.Linq.IGrouping<TKey,TElement>>\n{\n    System.Collections.IEnumerator System.Collections.IEnumerable.GetEnumerator() => throw null;\n    public System.Collections.Generic.IEnumerator<System.Linq.IGrouping<TKey,TElement>> GetEnumerator() => throw null;\n}\n\n// Generated from `System.Linq.Parallel.PartitionerQueryOperator<>` in `System.Linq.Parallel, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nclass PartitionerQueryOperator<TElement> : System.Linq.Parallel.QueryOperator<TElement>\n{\n}\n\n// Generated from `System.Linq.Parallel.QueryOperator<>` in `System.Linq.Parallel, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nabstract class QueryOperator<TOutput> : System.Linq.ParallelQuery<TOutput>\n{\n    public override System.Collections.Generic.IEnumerator<TOutput> GetEnumerator() => throw null;\n}\n\n// Generated from `System.Linq.Parallel.QueryResults<>` in `System.Linq.Parallel, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nabstract class QueryResults<T> : System.Collections.IEnumerable, System.Collections.Generic.IList<T>, System.Collections.Generic.IEnumerable<T>, System.Collections.Generic.ICollection<T>\n{\n    System.Collections.Generic.IEnumerator<T> System.Collections.Generic.IEnumerable<T>.GetEnumerator() => throw null;\n    System.Collections.IEnumerator System.Collections.IEnumerable.GetEnumerator() => throw null;\n    bool System.Collections.Generic.ICollection<T>.Contains(T item) => throw null;\n    bool System.Collections.Generic.ICollection<T>.IsReadOnly { get => throw null; }\n    bool System.Collections.Generic.ICollection<T>.Remove(T item) => throw null;\n    int System.Collections.Generic.IList<T>.IndexOf(T item) => throw null;\n    public T this[int index] { get => throw null; set => throw null; }\n    public int Count { get => throw null; }\n    void System.Collections.Generic.ICollection<T>.Add(T item) => throw null;\n    void System.Collections.Generic.ICollection<T>.Clear() => throw null;\n    void System.Collections.Generic.ICollection<T>.CopyTo(T[] array, int arrayIndex) => throw null;\n    void System.Collections.Generic.IList<T>.Insert(int index, T item) => throw null;\n    void System.Collections.Generic.IList<T>.RemoveAt(int index) => throw null;\n}\n\n// Generated from `System.Linq.Parallel.ZipQueryOperator<,,>` in `System.Linq.Parallel, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nclass ZipQueryOperator<TLeftInput,TRightInput,TOutput> : System.Linq.Parallel.QueryOperator<TOutput>\n{\n}\n\n}\n}\nnamespace Net\n{\n// Generated from `System.Net.CookieCollection` in `System.Net.Primitives, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class CookieCollection : System.Collections.IEnumerable, System.Collections.ICollection, System.Collections.Generic.IReadOnlyCollection<System.Net.Cookie>, System.Collections.Generic.IEnumerable<System.Net.Cookie>, System.Collections.Generic.ICollection<System.Net.Cookie>\n{\n    System.Collections.Generic.IEnumerator<System.Net.Cookie> System.Collections.Generic.IEnumerable<System.Net.Cookie>.GetEnumerator() => throw null;\n    public System.Collections.IEnumerator GetEnumerator() => throw null;\n    public bool Contains(System.Net.Cookie cookie) => throw null;\n    public bool IsReadOnly { get => throw null; }\n    public bool IsSynchronized { get => throw null; }\n    public bool Remove(System.Net.Cookie cookie) => throw null;\n    public int Count { get => throw null; }\n    public object SyncRoot { get => throw null; }\n    public void Add(System.Net.Cookie cookie) => throw null;\n    public void Clear() => throw null;\n    public void CopyTo(System.Array array, int index) => throw null;\n    public void CopyTo(System.Net.Cookie[] array, int index) => throw null;\n}\n\n// Generated from `System.Net.Cookie` in `System.Net.Primitives, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class Cookie\n{\n    public override bool Equals(object comparand) => throw null;\n    public override int GetHashCode() => throw null;\n    public override string ToString() => throw null;\n}\n\n// Generated from `System.Net.StreamFramer` in `System.Net.Security, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nclass StreamFramer\n{\n}\n\nnamespace Security\n{\n// Generated from `System.Net.Security.AuthenticatedStream` in `System.Net.Security, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nabstract public class AuthenticatedStream : System.IO.Stream\n{\n    protected override void Dispose(bool disposing) => throw null;\n    public override System.Threading.Tasks.ValueTask DisposeAsync() => throw null;\n}\n\n// Generated from `System.Net.Security.CipherSuitesPolicy` in `System.Net.Security, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class CipherSuitesPolicy\n{\n}\n\n// Generated from `System.Net.Security.NegotiateStream` in `System.Net.Security, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class NegotiateStream : System.Net.Security.AuthenticatedStream\n{\n    protected override void Dispose(bool disposing) => throw null;\n    public override System.IAsyncResult BeginRead(System.Byte[] buffer, int offset, int count, System.AsyncCallback asyncCallback, object asyncState) => throw null;\n    public override System.IAsyncResult BeginWrite(System.Byte[] buffer, int offset, int count, System.AsyncCallback asyncCallback, object asyncState) => throw null;\n    public override System.Int64 Length { get => throw null; }\n    public override System.Int64 Position { get => throw null; set => throw null; }\n    public override System.Int64 Seek(System.Int64 offset, System.IO.SeekOrigin origin) => throw null;\n    public override System.Threading.Tasks.Task FlushAsync(System.Threading.CancellationToken cancellationToken) => throw null;\n    public override System.Threading.Tasks.Task WriteAsync(System.Byte[] buffer, int offset, int count, System.Threading.CancellationToken cancellationToken) => throw null;\n    public override System.Threading.Tasks.Task<int> ReadAsync(System.Byte[] buffer, int offset, int count, System.Threading.CancellationToken cancellationToken) => throw null;\n    public override System.Threading.Tasks.ValueTask DisposeAsync() => throw null;\n    public override System.Threading.Tasks.ValueTask WriteAsync(System.ReadOnlyMemory<System.Byte> buffer, System.Threading.CancellationToken cancellationToken) => throw null;\n    public override System.Threading.Tasks.ValueTask<int> ReadAsync(System.Memory<System.Byte> buffer, System.Threading.CancellationToken cancellationToken) => throw null;\n    public override bool CanRead { get => throw null; }\n    public override bool CanSeek { get => throw null; }\n    public override bool CanTimeout { get => throw null; }\n    public override bool CanWrite { get => throw null; }\n    public override int EndRead(System.IAsyncResult asyncResult) => throw null;\n    public override int Read(System.Byte[] buffer, int offset, int count) => throw null;\n    public override int ReadTimeout { get => throw null; set => throw null; }\n    public override int WriteTimeout { get => throw null; set => throw null; }\n    public override void EndWrite(System.IAsyncResult asyncResult) => throw null;\n    public override void Flush() => throw null;\n    public override void SetLength(System.Int64 value) => throw null;\n    public override void Write(System.Byte[] buffer, int offset, int count) => throw null;\n}\n\n// Generated from `System.Net.Security.SslStream` in `System.Net.Security, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class SslStream : System.Net.Security.AuthenticatedStream\n{\n    protected override void Dispose(bool disposing) => throw null;\n    public override System.IAsyncResult BeginRead(System.Byte[] buffer, int offset, int count, System.AsyncCallback asyncCallback, object asyncState) => throw null;\n    public override System.IAsyncResult BeginWrite(System.Byte[] buffer, int offset, int count, System.AsyncCallback asyncCallback, object asyncState) => throw null;\n    public override System.Int64 Length { get => throw null; }\n    public override System.Int64 Position { get => throw null; set => throw null; }\n    public override System.Int64 Seek(System.Int64 offset, System.IO.SeekOrigin origin) => throw null;\n    public override System.Threading.Tasks.Task FlushAsync(System.Threading.CancellationToken cancellationToken) => throw null;\n    public override System.Threading.Tasks.Task WriteAsync(System.Byte[] buffer, int offset, int count, System.Threading.CancellationToken cancellationToken) => throw null;\n    public override System.Threading.Tasks.Task<int> ReadAsync(System.Byte[] buffer, int offset, int count, System.Threading.CancellationToken cancellationToken) => throw null;\n    public override System.Threading.Tasks.ValueTask DisposeAsync() => throw null;\n    public override System.Threading.Tasks.ValueTask WriteAsync(System.ReadOnlyMemory<System.Byte> buffer, System.Threading.CancellationToken cancellationToken) => throw null;\n    public override System.Threading.Tasks.ValueTask<int> ReadAsync(System.Memory<System.Byte> buffer, System.Threading.CancellationToken cancellationToken) => throw null;\n    public override bool CanRead { get => throw null; }\n    public override bool CanSeek { get => throw null; }\n    public override bool CanTimeout { get => throw null; }\n    public override bool CanWrite { get => throw null; }\n    public override int EndRead(System.IAsyncResult asyncResult) => throw null;\n    public override int Read(System.Byte[] buffer, int offset, int count) => throw null;\n    public override int ReadByte() => throw null;\n    public override int ReadTimeout { get => throw null; set => throw null; }\n    public override int WriteTimeout { get => throw null; set => throw null; }\n    public override void EndWrite(System.IAsyncResult asyncResult) => throw null;\n    public override void Flush() => throw null;\n    public override void SetLength(System.Int64 value) => throw null;\n    public override void Write(System.Byte[] buffer, int offset, int count) => throw null;\n}\n\n// Generated from `System.Net.Security.TlsCipherSuite` in `System.Net.Security, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic enum TlsCipherSuite\n{\n}\n\n}\n}\nnamespace Runtime\n{\nnamespace Serialization\n{\n// Generated from `System.Runtime.Serialization.DataContractAttribute` in `System.Runtime.Serialization.Primitives, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class DataContractAttribute : System.Attribute\n{\n    public DataContractAttribute() => throw null;\n}\n\n// Generated from `System.Runtime.Serialization.DataMemberAttribute` in `System.Runtime.Serialization.Primitives, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class DataMemberAttribute : System.Attribute\n{\n    public DataMemberAttribute() => throw null;\n}\n\n}\n}\nnamespace Text\n{\nnamespace RegularExpressions\n{\n// Generated from `System.Text.RegularExpressions.Capture` in `System.Text.RegularExpressions, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class Capture\n{\n    public override string ToString() => throw null;\n}\n\n// Generated from `System.Text.RegularExpressions.CollectionDebuggerProxy<>` in `System.Text.RegularExpressions, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nclass CollectionDebuggerProxy<T>\n{\n}\n\n// Generated from `System.Text.RegularExpressions.GroupCollection` in `System.Text.RegularExpressions, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class GroupCollection : System.Collections.IList, System.Collections.IEnumerable, System.Collections.ICollection, System.Collections.Generic.IReadOnlyList<System.Text.RegularExpressions.Group>, System.Collections.Generic.IReadOnlyDictionary<string,System.Text.RegularExpressions.Group>, System.Collections.Generic.IReadOnlyCollection<System.Text.RegularExpressions.Group>, System.Collections.Generic.IReadOnlyCollection<System.Collections.Generic.KeyValuePair<string,System.Text.RegularExpressions.Group>>, System.Collections.Generic.IList<System.Text.RegularExpressions.Group>, System.Collections.Generic.IEnumerable<System.Text.RegularExpressions.Group>, System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<string,System.Text.RegularExpressions.Group>>, System.Collections.Generic.ICollection<System.Text.RegularExpressions.Group>\n{\n    System.Collections.Generic.IEnumerator<System.Collections.Generic.KeyValuePair<string,System.Text.RegularExpressions.Group>> System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<string,System.Text.RegularExpressions.Group>>.GetEnumerator() => throw null;\n    System.Collections.Generic.IEnumerator<System.Text.RegularExpressions.Group> System.Collections.Generic.IEnumerable<System.Text.RegularExpressions.Group>.GetEnumerator() => throw null;\n    System.Text.RegularExpressions.Group this[int index] { get => throw null; set => throw null; }\n    bool System.Collections.Generic.ICollection<System.Text.RegularExpressions.Group>.Contains(System.Text.RegularExpressions.Group item) => throw null;\n    bool System.Collections.Generic.ICollection<System.Text.RegularExpressions.Group>.Remove(System.Text.RegularExpressions.Group item) => throw null;\n    bool System.Collections.IList.Contains(object value) => throw null;\n    bool System.Collections.IList.IsFixedSize { get => throw null; }\n    int System.Collections.Generic.IList<System.Text.RegularExpressions.Group>.IndexOf(System.Text.RegularExpressions.Group item) => throw null;\n    int System.Collections.IList.Add(object value) => throw null;\n    int System.Collections.IList.IndexOf(object value) => throw null;\n    object this[int index] { get => throw null; set => throw null; }\n    public System.Collections.Generic.IEnumerable<System.Text.RegularExpressions.Group> Values { get => throw null; }\n    public System.Collections.Generic.IEnumerable<string> Keys { get => throw null; }\n    public System.Collections.IEnumerator GetEnumerator() => throw null;\n    public System.Text.RegularExpressions.Group this[string groupname] { get => throw null; }\n    public bool ContainsKey(string key) => throw null;\n    public bool IsReadOnly { get => throw null; }\n    public bool IsSynchronized { get => throw null; }\n    public bool TryGetValue(string key, out System.Text.RegularExpressions.Group value) => throw null;\n    public int Count { get => throw null; }\n    public object SyncRoot { get => throw null; }\n    public void CopyTo(System.Array array, int arrayIndex) => throw null;\n    public void CopyTo(System.Text.RegularExpressions.Group[] array, int arrayIndex) => throw null;\n    void System.Collections.Generic.ICollection<System.Text.RegularExpressions.Group>.Add(System.Text.RegularExpressions.Group item) => throw null;\n    void System.Collections.Generic.ICollection<System.Text.RegularExpressions.Group>.Clear() => throw null;\n    void System.Collections.Generic.IList<System.Text.RegularExpressions.Group>.Insert(int index, System.Text.RegularExpressions.Group item) => throw null;\n    void System.Collections.Generic.IList<System.Text.RegularExpressions.Group>.RemoveAt(int index) => throw null;\n    void System.Collections.IList.Clear() => throw null;\n    void System.Collections.IList.Insert(int index, object value) => throw null;\n    void System.Collections.IList.Remove(object value) => throw null;\n    void System.Collections.IList.RemoveAt(int index) => throw null;\n}\n\n// Generated from `System.Text.RegularExpressions.Group` in `System.Text.RegularExpressions, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class Group : System.Text.RegularExpressions.Capture\n{\n}\n\n// Generated from `System.Text.RegularExpressions.Match` in `System.Text.RegularExpressions, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class Match : System.Text.RegularExpressions.Group\n{\n}\n\n// Generated from `System.Text.RegularExpressions.RegexOptions` in `System.Text.RegularExpressions, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\n[System.Flags]\npublic enum RegexOptions\n{\n    IgnoreCase,\n}\n\n// Generated from `System.Text.RegularExpressions.Regex` in `System.Text.RegularExpressions, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class Regex : System.Runtime.Serialization.ISerializable\n{\n    public Regex(string pattern) => throw null;\n    public Regex(string pattern, System.Text.RegularExpressions.RegexOptions options, System.TimeSpan matchTimeout) => throw null;\n    public System.Text.RegularExpressions.Match Match(string input) => throw null;\n    public override string ToString() => throw null;\n    public static System.Text.RegularExpressions.Match Match(string input, string pattern) => throw null;\n    public static System.Text.RegularExpressions.Match Match(string input, string pattern, System.Text.RegularExpressions.RegexOptions options, System.TimeSpan matchTimeout) => throw null;\n    public string Replace(string input, string replacement) => throw null;\n    void System.Runtime.Serialization.ISerializable.GetObjectData(System.Runtime.Serialization.SerializationInfo si, System.Runtime.Serialization.StreamingContext context) => throw null;\n}\n\n}\n}\nnamespace Timers\n{\n// Generated from `System.Timers.TimersDescriptionAttribute` in `System.ComponentModel.TypeConverter, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class TimersDescriptionAttribute\n{\n    public TimersDescriptionAttribute(string description) => throw null;\n}\n\n}\nnamespace Windows\n{\nnamespace Markup\n{\n// Generated from `System.Windows.Markup.ValueSerializerAttribute` in `System.ObjectModel, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class ValueSerializerAttribute : System.Attribute\n{\n    public ValueSerializerAttribute(System.Type valueSerializerType) => throw null;\n    public ValueSerializerAttribute(string valueSerializerTypeName) => throw null;\n}\n\n}\n}\n}\n |
+| // This file contains auto-generated code.\n// original-extractor-options: /r:System.Text.RegularExpressions.dll /r:System.Collections.Specialized.dll /r:System.Net.dll /r:System.Web.dll /r:System.Net.HttpListener.dll /r:System.Collections.Specialized.dll /r:System.Private.Uri.dll /r:System.Runtime.Extensions.dll /r:System.Linq.Parallel.dll /r:System.Collections.Concurrent.dll /r:System.Linq.Expressions.dll /r:System.Collections.dll /r:System.Linq.Queryable.dll /r:System.Linq.dll /r:System.Collections.NonGeneric.dll /r:System.ObjectModel.dll /r:System.ComponentModel.TypeConverter.dll /r:System.IO.Compression.dll /r:System.IO.Pipes.dll /r:System.Net.Primitives.dll /r:System.Net.Security.dll /r:System.Security.Cryptography.Primitives.dll /r:System.Text.RegularExpressions.dll ${testdir}/../../resources/stubs/System.Web.cs /r:System.Runtime.Serialization.Primitives.dll\n\nnamespace System\n{\n// Generated from `System.Uri` in `System.Private.Uri, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class Uri : System.Runtime.Serialization.ISerializable\n{\n    public override bool Equals(object comparand) => throw null;\n    public override int GetHashCode() => throw null;\n    public override string ToString() => throw null;\n    void System.Runtime.Serialization.ISerializable.GetObjectData(System.Runtime.Serialization.SerializationInfo serializationInfo, System.Runtime.Serialization.StreamingContext streamingContext) => throw null;\n}\n\nnamespace Collections\n{\n// Generated from `System.Collections.Queue` in `System.Collections.NonGeneric, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class Queue : System.ICloneable, System.Collections.IEnumerable, System.Collections.ICollection\n{\n    public virtual System.Collections.IEnumerator GetEnumerator() => throw null;\n    public virtual bool IsSynchronized { get => throw null; }\n    public virtual int Count { get => throw null; }\n    public virtual object Clone() => throw null;\n    public virtual object SyncRoot { get => throw null; }\n    public virtual void CopyTo(System.Array array, int index) => throw null;\n}\n\n// Generated from `System.Collections.SortedList` in `System.Collections.NonGeneric, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class SortedList : System.ICloneable, System.Collections.IEnumerable, System.Collections.IDictionary, System.Collections.ICollection\n{\n    System.Collections.IEnumerator System.Collections.IEnumerable.GetEnumerator() => throw null;\n    public virtual System.Collections.ICollection Keys { get => throw null; }\n    public virtual System.Collections.ICollection Values { get => throw null; }\n    public virtual System.Collections.IDictionaryEnumerator GetEnumerator() => throw null;\n    public virtual bool Contains(object key) => throw null;\n    public virtual bool IsFixedSize { get => throw null; }\n    public virtual bool IsReadOnly { get => throw null; }\n    public virtual bool IsSynchronized { get => throw null; }\n    public virtual int Count { get => throw null; }\n    public virtual object Clone() => throw null;\n    public virtual object GetByIndex(int index) => throw null;\n    public virtual object SyncRoot { get => throw null; }\n    public virtual object this[object key] { get => throw null; set => throw null; }\n    public virtual void Add(object key, object value) => throw null;\n    public virtual void Clear() => throw null;\n    public virtual void CopyTo(System.Array array, int arrayIndex) => throw null;\n    public virtual void Remove(object key) => throw null;\n}\n\n// Generated from `System.Collections.Stack` in `System.Collections.NonGeneric, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class Stack : System.ICloneable, System.Collections.IEnumerable, System.Collections.ICollection\n{\n    public virtual System.Collections.IEnumerator GetEnumerator() => throw null;\n    public virtual bool IsSynchronized { get => throw null; }\n    public virtual int Count { get => throw null; }\n    public virtual object Clone() => throw null;\n    public virtual object SyncRoot { get => throw null; }\n    public virtual void CopyTo(System.Array array, int index) => throw null;\n}\n\nnamespace Concurrent\n{\n// Generated from `System.Collections.Concurrent.BlockingCollection<>` in `System.Collections.Concurrent, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class BlockingCollection<T> : System.IDisposable, System.Collections.IEnumerable, System.Collections.ICollection, System.Collections.Generic.IReadOnlyCollection<T>, System.Collections.Generic.IEnumerable<T>\n{\n    System.Collections.Generic.IEnumerator<T> System.Collections.Generic.IEnumerable<T>.GetEnumerator() => throw null;\n    System.Collections.IEnumerator System.Collections.IEnumerable.GetEnumerator() => throw null;\n    bool System.Collections.ICollection.IsSynchronized { get => throw null; }\n    object System.Collections.ICollection.SyncRoot { get => throw null; }\n    public int Count { get => throw null; }\n    public void Dispose() => throw null;\n    void System.Collections.ICollection.CopyTo(System.Array array, int index) => throw null;\n}\n\n// Generated from `System.Collections.Concurrent.BlockingCollectionDebugView<>` in `System.Collections.Concurrent, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nclass BlockingCollectionDebugView<T>\n{\n}\n\n// Generated from `System.Collections.Concurrent.IDictionaryDebugView<,>` in `System.Collections.Concurrent, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nclass IDictionaryDebugView<TKey,TValue>\n{\n}\n\n}\nnamespace Generic\n{\n// Generated from `System.Collections.Generic.CollectionDebugView<>` in `System.ObjectModel, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nclass CollectionDebugView<T>\n{\n}\n\n// Generated from `System.Collections.Generic.DictionaryDebugView<,>` in `System.ObjectModel, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nclass DictionaryDebugView<K,V>\n{\n}\n\n// Generated from `System.Collections.Generic.QueueDebugView<>` in `System.Collections, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nclass QueueDebugView<T>\n{\n}\n\n// Generated from `System.Collections.Generic.SortedSet<>` in `System.Collections, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class SortedSet<T> : System.Runtime.Serialization.ISerializable, System.Runtime.Serialization.IDeserializationCallback, System.Collections.IEnumerable, System.Collections.ICollection, System.Collections.Generic.ISet<T>, System.Collections.Generic.IReadOnlySet<T>, System.Collections.Generic.IReadOnlyCollection<T>, System.Collections.Generic.IEnumerable<T>, System.Collections.Generic.ICollection<T>\n{\n    System.Collections.Generic.IEnumerator<T> System.Collections.Generic.IEnumerable<T>.GetEnumerator() => throw null;\n    System.Collections.IEnumerator System.Collections.IEnumerable.GetEnumerator() => throw null;\n    bool System.Collections.Generic.ICollection<T>.IsReadOnly { get => throw null; }\n    bool System.Collections.ICollection.IsSynchronized { get => throw null; }\n    object System.Collections.ICollection.SyncRoot { get => throw null; }\n    public bool Add(T item) => throw null;\n    public bool IsProperSubsetOf(System.Collections.Generic.IEnumerable<T> other) => throw null;\n    public bool IsProperSupersetOf(System.Collections.Generic.IEnumerable<T> other) => throw null;\n    public bool IsSubsetOf(System.Collections.Generic.IEnumerable<T> other) => throw null;\n    public bool IsSupersetOf(System.Collections.Generic.IEnumerable<T> other) => throw null;\n    public bool Overlaps(System.Collections.Generic.IEnumerable<T> other) => throw null;\n    public bool Remove(T item) => throw null;\n    public bool SetEquals(System.Collections.Generic.IEnumerable<T> other) => throw null;\n    public int Count { get => throw null; }\n    public virtual bool Contains(T item) => throw null;\n    public virtual void Clear() => throw null;\n    public virtual void IntersectWith(System.Collections.Generic.IEnumerable<T> other) => throw null;\n    public void CopyTo(T[] array, int index) => throw null;\n    public void ExceptWith(System.Collections.Generic.IEnumerable<T> other) => throw null;\n    public void SymmetricExceptWith(System.Collections.Generic.IEnumerable<T> other) => throw null;\n    public void UnionWith(System.Collections.Generic.IEnumerable<T> other) => throw null;\n    void System.Collections.Generic.ICollection<T>.Add(T item) => throw null;\n    void System.Collections.ICollection.CopyTo(System.Array array, int index) => throw null;\n    void System.Runtime.Serialization.IDeserializationCallback.OnDeserialization(object sender) => throw null;\n    void System.Runtime.Serialization.ISerializable.GetObjectData(System.Runtime.Serialization.SerializationInfo info, System.Runtime.Serialization.StreamingContext context) => throw null;\n}\n\n// Generated from `System.Collections.Generic.Stack<>` in `System.Collections, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class Stack<T> : System.Collections.IEnumerable, System.Collections.ICollection, System.Collections.Generic.IReadOnlyCollection<T>, System.Collections.Generic.IEnumerable<T>\n{\n    System.Collections.Generic.IEnumerator<T> System.Collections.Generic.IEnumerable<T>.GetEnumerator() => throw null;\n    System.Collections.IEnumerator System.Collections.IEnumerable.GetEnumerator() => throw null;\n    bool System.Collections.ICollection.IsSynchronized { get => throw null; }\n    object System.Collections.ICollection.SyncRoot { get => throw null; }\n    public T Peek() => throw null;\n    public int Count { get => throw null; }\n    void System.Collections.ICollection.CopyTo(System.Array array, int arrayIndex) => throw null;\n}\n\n// Generated from `System.Collections.Generic.StackDebugView<>` in `System.Collections, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nclass StackDebugView<T>\n{\n}\n\n}\nnamespace Specialized\n{\n// Generated from `System.Collections.Specialized.NameObjectCollectionBase` in `System.Collections.Specialized, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nabstract public class NameObjectCollectionBase : System.Runtime.Serialization.ISerializable, System.Runtime.Serialization.IDeserializationCallback, System.Collections.IEnumerable, System.Collections.ICollection\n{\n    bool System.Collections.ICollection.IsSynchronized { get => throw null; }\n    object System.Collections.ICollection.SyncRoot { get => throw null; }\n    public virtual System.Collections.IEnumerator GetEnumerator() => throw null;\n    public virtual int Count { get => throw null; }\n    public virtual void GetObjectData(System.Runtime.Serialization.SerializationInfo info, System.Runtime.Serialization.StreamingContext context) => throw null;\n    public virtual void OnDeserialization(object sender) => throw null;\n    void System.Collections.ICollection.CopyTo(System.Array array, int index) => throw null;\n}\n\n// Generated from `System.Collections.Specialized.NameValueCollection` in `System.Collections.Specialized, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class NameValueCollection : System.Collections.Specialized.NameObjectCollectionBase\n{\n    public string this[string name] { get => throw null; set => throw null; }\n}\n\n}\n}\nnamespace ComponentModel\n{\n// Generated from `System.ComponentModel.ComponentConverter` in `System.ComponentModel.TypeConverter, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class ComponentConverter : System.ComponentModel.ReferenceConverter\n{\n}\n\n// Generated from `System.ComponentModel.DefaultEventAttribute` in `System.ComponentModel.TypeConverter, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class DefaultEventAttribute : System.Attribute\n{\n    public DefaultEventAttribute(string name) => throw null;\n    public override bool Equals(object obj) => throw null;\n    public override int GetHashCode() => throw null;\n}\n\n// Generated from `System.ComponentModel.DefaultPropertyAttribute` in `System.ComponentModel.TypeConverter, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class DefaultPropertyAttribute : System.Attribute\n{\n    public DefaultPropertyAttribute(string name) => throw null;\n    public override bool Equals(object obj) => throw null;\n    public override int GetHashCode() => throw null;\n}\n\n// Generated from `System.ComponentModel.INotifyPropertyChanged` in `System.ObjectModel, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic interface INotifyPropertyChanged\n{\n}\n\n// Generated from `System.ComponentModel.ReferenceConverter` in `System.ComponentModel.TypeConverter, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class ReferenceConverter : System.ComponentModel.TypeConverter\n{\n}\n\n// Generated from `System.ComponentModel.TypeConverterAttribute` in `System.ObjectModel, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class TypeConverterAttribute : System.Attribute\n{\n    public TypeConverterAttribute() => throw null;\n    public TypeConverterAttribute(System.Type type) => throw null;\n    public TypeConverterAttribute(string typeName) => throw null;\n    public override bool Equals(object obj) => throw null;\n    public override int GetHashCode() => throw null;\n}\n\n// Generated from `System.ComponentModel.TypeConverter` in `System.ComponentModel.TypeConverter, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class TypeConverter\n{\n}\n\n// Generated from `System.ComponentModel.TypeDescriptionProviderAttribute` in `System.ObjectModel, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class TypeDescriptionProviderAttribute : System.Attribute\n{\n    public TypeDescriptionProviderAttribute(System.Type type) => throw null;\n    public TypeDescriptionProviderAttribute(string typeName) => throw null;\n}\n\n// Generated from `System.ComponentModel.TypeDescriptionProvider` in `System.ComponentModel.TypeConverter, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nabstract public class TypeDescriptionProvider\n{\n}\n\n// Generated from `System.ComponentModel.TypeDescriptor` in `System.ComponentModel.TypeConverter, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class TypeDescriptor\n{\n}\n\nnamespace Design\n{\n// Generated from `System.ComponentModel.Design.DesignerOptionService` in `System.ComponentModel.TypeConverter, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nabstract public class DesignerOptionService : System.ComponentModel.Design.IDesignerOptionService\n{\n}\n\n// Generated from `System.ComponentModel.Design.IDesignerOptionService` in `System.ComponentModel.TypeConverter, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic interface IDesignerOptionService\n{\n}\n\n}\n}\nnamespace Dynamic\n{\n// Generated from `System.Dynamic.DynamicMetaObject` in `System.Linq.Expressions, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class DynamicMetaObject\n{\n}\n\n// Generated from `System.Dynamic.ExpandoObject` in `System.Linq.Expressions, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class ExpandoObject : System.Dynamic.IDynamicMetaObjectProvider, System.ComponentModel.INotifyPropertyChanged, System.Collections.IEnumerable, System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<string,object>>, System.Collections.Generic.IDictionary<string,object>, System.Collections.Generic.ICollection<System.Collections.Generic.KeyValuePair<string,object>>\n{\n    System.Collections.Generic.ICollection<object> System.Collections.Generic.IDictionary<string,object>.Values { get => throw null; }\n    System.Collections.Generic.ICollection<string> System.Collections.Generic.IDictionary<string,object>.Keys { get => throw null; }\n    System.Collections.Generic.IEnumerator<System.Collections.Generic.KeyValuePair<string,object>> System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<string,object>>.GetEnumerator() => throw null;\n    System.Collections.IEnumerator System.Collections.IEnumerable.GetEnumerator() => throw null;\n    bool System.Collections.Generic.ICollection<System.Collections.Generic.KeyValuePair<string,object>>.Contains(System.Collections.Generic.KeyValuePair<string,object> item) => throw null;\n    bool System.Collections.Generic.ICollection<System.Collections.Generic.KeyValuePair<string,object>>.IsReadOnly { get => throw null; }\n    bool System.Collections.Generic.ICollection<System.Collections.Generic.KeyValuePair<string,object>>.Remove(System.Collections.Generic.KeyValuePair<string,object> item) => throw null;\n    bool System.Collections.Generic.IDictionary<string,object>.ContainsKey(string key) => throw null;\n    bool System.Collections.Generic.IDictionary<string,object>.Remove(string key) => throw null;\n    bool System.Collections.Generic.IDictionary<string,object>.TryGetValue(string key, out object value) => throw null;\n    int System.Collections.Generic.ICollection<System.Collections.Generic.KeyValuePair<string,object>>.Count { get => throw null; }\n    object this[string key] { get => throw null; set => throw null; }\n    void System.Collections.Generic.ICollection<System.Collections.Generic.KeyValuePair<string,object>>.Add(System.Collections.Generic.KeyValuePair<string,object> item) => throw null;\n    void System.Collections.Generic.ICollection<System.Collections.Generic.KeyValuePair<string,object>>.Clear() => throw null;\n    void System.Collections.Generic.ICollection<System.Collections.Generic.KeyValuePair<string,object>>.CopyTo(System.Collections.Generic.KeyValuePair<string,object>[] array, int arrayIndex) => throw null;\n    void System.Collections.Generic.IDictionary<string,object>.Add(string key, object value) => throw null;\n}\n\n// Generated from `System.Dynamic.IDynamicMetaObjectProvider` in `System.Linq.Expressions, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic interface IDynamicMetaObjectProvider\n{\n}\n\nnamespace Utils\n{\n// Generated from `System.Dynamic.Utils.ListProvider<>` in `System.Linq.Expressions, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nabstract class ListProvider<T> : System.Collections.IEnumerable, System.Collections.Generic.IList<T>, System.Collections.Generic.IEnumerable<T>, System.Collections.Generic.ICollection<T> where T: class\n{\n    System.Collections.IEnumerator System.Collections.IEnumerable.GetEnumerator() => throw null;\n    public System.Collections.Generic.IEnumerator<T> GetEnumerator() => throw null;\n    public T this[int index] { get => throw null; set => throw null; }\n    public bool Contains(T item) => throw null;\n    public bool IsReadOnly { get => throw null; }\n    public bool Remove(T item) => throw null;\n    public int Count { get => throw null; }\n    public int IndexOf(T item) => throw null;\n    public void Add(T item) => throw null;\n    public void Clear() => throw null;\n    public void CopyTo(T[] array, int index) => throw null;\n    public void Insert(int index, T item) => throw null;\n    public void RemoveAt(int index) => throw null;\n}\n\n}\n}\nnamespace IO\n{\nnamespace Compression\n{\n// Generated from `System.IO.Compression.DeflateStream` in `System.IO.Compression, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089`\npublic class DeflateStream : System.IO.Stream\n{\n    protected override void Dispose(bool disposing) => throw null;\n    public override System.IAsyncResult BeginRead(System.Byte[] buffer, int offset, int count, System.AsyncCallback asyncCallback, object asyncState) => throw null;\n    public override System.IAsyncResult BeginWrite(System.Byte[] array, int offset, int count, System.AsyncCallback asyncCallback, object asyncState) => throw null;\n    public override System.Int64 Length { get => throw null; }\n    public override System.Int64 Position { get => throw null; set => throw null; }\n    public override System.Int64 Seek(System.Int64 offset, System.IO.SeekOrigin origin) => throw null;\n    public override System.Threading.Tasks.Task CopyToAsync(System.IO.Stream destination, int bufferSize, System.Threading.CancellationToken cancellationToken) => throw null;\n    public override System.Threading.Tasks.Task FlushAsync(System.Threading.CancellationToken cancellationToken) => throw null;\n    public override System.Threading.Tasks.Task WriteAsync(System.Byte[] array, int offset, int count, System.Threading.CancellationToken cancellationToken) => throw null;\n    public override System.Threading.Tasks.Task<int> ReadAsync(System.Byte[] array, int offset, int count, System.Threading.CancellationToken cancellationToken) => throw null;\n    public override System.Threading.Tasks.ValueTask DisposeAsync() => throw null;\n    public override System.Threading.Tasks.ValueTask WriteAsync(System.ReadOnlyMemory<System.Byte> buffer, System.Threading.CancellationToken cancellationToken) => throw null;\n    public override System.Threading.Tasks.ValueTask<int> ReadAsync(System.Memory<System.Byte> buffer, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;\n    public override bool CanRead { get => throw null; }\n    public override bool CanSeek { get => throw null; }\n    public override bool CanWrite { get => throw null; }\n    public override int EndRead(System.IAsyncResult asyncResult) => throw null;\n    public override int Read(System.Byte[] array, int offset, int count) => throw null;\n    public override int Read(System.Span<System.Byte> buffer) => throw null;\n    public override int ReadByte() => throw null;\n    public override void CopyTo(System.IO.Stream destination, int bufferSize) => throw null;\n    public override void EndWrite(System.IAsyncResult asyncResult) => throw null;\n    public override void Flush() => throw null;\n    public override void SetLength(System.Int64 value) => throw null;\n    public override void Write(System.Byte[] array, int offset, int count) => throw null;\n    public override void Write(System.ReadOnlySpan<System.Byte> buffer) => throw null;\n}\n\n}\n}\nnamespace Linq\n{\n// Generated from `System.Linq.Enumerable` in `System.Linq, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nstatic public class Enumerable\n{\n    public static System.Collections.Generic.IEnumerable<TResult> Select<TSource,TResult>(this System.Collections.Generic.IEnumerable<TSource> source, System.Func<TSource,TResult> selector) => throw null;\n}\n\n// Generated from `System.Linq.Grouping<,>` in `System.Linq, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class Grouping<TKey,TElement> : System.Linq.IGrouping<TKey,TElement>, System.Collections.IEnumerable, System.Collections.Generic.IList<TElement>, System.Collections.Generic.IEnumerable<TElement>, System.Collections.Generic.ICollection<TElement>\n{\n    System.Collections.IEnumerator System.Collections.IEnumerable.GetEnumerator() => throw null;\n    TElement this[int index] { get => throw null; set => throw null; }\n    bool System.Collections.Generic.ICollection<TElement>.Contains(TElement item) => throw null;\n    bool System.Collections.Generic.ICollection<TElement>.IsReadOnly { get => throw null; }\n    bool System.Collections.Generic.ICollection<TElement>.Remove(TElement item) => throw null;\n    int System.Collections.Generic.ICollection<TElement>.Count { get => throw null; }\n    int System.Collections.Generic.IList<TElement>.IndexOf(TElement item) => throw null;\n    public System.Collections.Generic.IEnumerator<TElement> GetEnumerator() => throw null;\n    void System.Collections.Generic.ICollection<TElement>.Add(TElement item) => throw null;\n    void System.Collections.Generic.ICollection<TElement>.Clear() => throw null;\n    void System.Collections.Generic.ICollection<TElement>.CopyTo(TElement[] array, int arrayIndex) => throw null;\n    void System.Collections.Generic.IList<TElement>.Insert(int index, TElement item) => throw null;\n    void System.Collections.Generic.IList<TElement>.RemoveAt(int index) => throw null;\n}\n\n// Generated from `System.Linq.IGrouping<,>` in `System.Linq, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic interface IGrouping<TKey,TElement> : System.Collections.IEnumerable, System.Collections.Generic.IEnumerable<TElement>\n{\n}\n\n// Generated from `System.Linq.IIListProvider<>` in `System.Linq, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\ninterface IIListProvider<TElement> : System.Collections.IEnumerable, System.Collections.Generic.IEnumerable<TElement>\n{\n}\n\n// Generated from `System.Linq.ILookup<,>` in `System.Linq, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic interface ILookup<TKey,TElement> : System.Collections.IEnumerable, System.Collections.Generic.IEnumerable<System.Linq.IGrouping<TKey,TElement>>\n{\n}\n\n// Generated from `System.Linq.IOrderedEnumerable<>` in `System.Linq, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic interface IOrderedEnumerable<TElement> : System.Collections.IEnumerable, System.Collections.Generic.IEnumerable<TElement>\n{\n}\n\n// Generated from `System.Linq.IPartition<>` in `System.Linq, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\ninterface IPartition<TElement> : System.Linq.IIListProvider<TElement>, System.Collections.IEnumerable, System.Collections.Generic.IEnumerable<TElement>\n{\n}\n\n// Generated from `System.Linq.IQueryable` in `System.Linq.Expressions, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic interface IQueryable : System.Collections.IEnumerable\n{\n}\n\n// Generated from `System.Linq.Lookup<,>` in `System.Linq, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class Lookup<TKey,TElement> : System.Linq.ILookup<TKey,TElement>, System.Linq.IIListProvider<System.Linq.IGrouping<TKey,TElement>>, System.Collections.IEnumerable, System.Collections.Generic.IEnumerable<System.Linq.IGrouping<TKey,TElement>>\n{\n    System.Collections.IEnumerator System.Collections.IEnumerable.GetEnumerator() => throw null;\n    public System.Collections.Generic.IEnumerator<System.Linq.IGrouping<TKey,TElement>> GetEnumerator() => throw null;\n}\n\n// Generated from `System.Linq.OrderedEnumerable<>` in `System.Linq, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nabstract class OrderedEnumerable<TElement> : System.Linq.IPartition<TElement>, System.Linq.IOrderedEnumerable<TElement>, System.Linq.IIListProvider<TElement>, System.Collections.IEnumerable, System.Collections.Generic.IEnumerable<TElement>\n{\n    System.Collections.IEnumerator System.Collections.IEnumerable.GetEnumerator() => throw null;\n    public System.Collections.Generic.IEnumerator<TElement> GetEnumerator() => throw null;\n}\n\n// Generated from `System.Linq.ParallelEnumerable` in `System.Linq.Parallel, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nstatic public class ParallelEnumerable\n{\n    public static System.Linq.ParallelQuery AsParallel(this System.Collections.IEnumerable source) => throw null;\n}\n\n// Generated from `System.Linq.ParallelQuery<>` in `System.Linq.Parallel, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class ParallelQuery<TSource> : System.Linq.ParallelQuery, System.Collections.IEnumerable, System.Collections.Generic.IEnumerable<TSource>\n{\n    public virtual System.Collections.Generic.IEnumerator<TSource> GetEnumerator() => throw null;\n}\n\n// Generated from `System.Linq.ParallelQuery` in `System.Linq.Parallel, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class ParallelQuery : System.Collections.IEnumerable\n{\n    System.Collections.IEnumerator System.Collections.IEnumerable.GetEnumerator() => throw null;\n}\n\n// Generated from `System.Linq.Queryable` in `System.Linq.Queryable, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nstatic public class Queryable\n{\n    public static System.Linq.IQueryable AsQueryable(this System.Collections.IEnumerable source) => throw null;\n}\n\n// Generated from `System.Linq.SystemLinq_GroupingDebugView<,>` in `System.Linq, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nclass SystemLinq_GroupingDebugView<TKey,TElement>\n{\n}\n\n// Generated from `System.Linq.SystemLinq_LookupDebugView<,>` in `System.Linq, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nclass SystemLinq_LookupDebugView<TKey,TElement>\n{\n}\n\nnamespace Expressions\n{\n// Generated from `System.Linq.Expressions.BlockExpressionList` in `System.Linq.Expressions, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nclass BlockExpressionList : System.Collections.IEnumerable, System.Collections.Generic.IList<System.Linq.Expressions.Expression>, System.Collections.Generic.IEnumerable<System.Linq.Expressions.Expression>, System.Collections.Generic.ICollection<System.Linq.Expressions.Expression>\n{\n    System.Collections.IEnumerator System.Collections.IEnumerable.GetEnumerator() => throw null;\n    public System.Collections.Generic.IEnumerator<System.Linq.Expressions.Expression> GetEnumerator() => throw null;\n    public System.Linq.Expressions.Expression this[int index] { get => throw null; set => throw null; }\n    public bool Contains(System.Linq.Expressions.Expression item) => throw null;\n    public bool IsReadOnly { get => throw null; }\n    public bool Remove(System.Linq.Expressions.Expression item) => throw null;\n    public int Count { get => throw null; }\n    public int IndexOf(System.Linq.Expressions.Expression item) => throw null;\n    public void Add(System.Linq.Expressions.Expression item) => throw null;\n    public void Clear() => throw null;\n    public void CopyTo(System.Linq.Expressions.Expression[] array, int index) => throw null;\n    public void Insert(int index, System.Linq.Expressions.Expression item) => throw null;\n    public void RemoveAt(int index) => throw null;\n}\n\n// Generated from `System.Linq.Expressions.Expression` in `System.Linq.Expressions, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nabstract public class Expression\n{\n    public override string ToString() => throw null;\n}\n\n// Generated from `System.Linq.Expressions.ParameterExpression` in `System.Linq.Expressions, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class ParameterExpression : System.Linq.Expressions.Expression\n{\n}\n\nnamespace Compiler\n{\n// Generated from `System.Linq.Expressions.Compiler.ParameterList` in `System.Linq.Expressions, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nclass ParameterList : System.Collections.IEnumerable, System.Collections.Generic.IReadOnlyList<System.Linq.Expressions.ParameterExpression>, System.Collections.Generic.IReadOnlyCollection<System.Linq.Expressions.ParameterExpression>, System.Collections.Generic.IEnumerable<System.Linq.Expressions.ParameterExpression>\n{\n    System.Collections.IEnumerator System.Collections.IEnumerable.GetEnumerator() => throw null;\n    public System.Collections.Generic.IEnumerator<System.Linq.Expressions.ParameterExpression> GetEnumerator() => throw null;\n    public System.Linq.Expressions.ParameterExpression this[int index] { get => throw null; }\n    public int Count { get => throw null; }\n}\n\n}\nnamespace Interpreter\n{\n// Generated from `System.Linq.Expressions.Interpreter.InstructionArray` in `System.Linq.Expressions, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nstruct InstructionArray\n{\n}\n\n// Generated from `System.Linq.Expressions.Interpreter.InstructionList` in `System.Linq.Expressions, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nclass InstructionList\n{\n}\n\n// Generated from `System.Linq.Expressions.Interpreter.InterpretedFrameInfo` in `System.Linq.Expressions, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nstruct InterpretedFrameInfo\n{\n    public override string ToString() => throw null;\n}\n\n// Generated from `System.Linq.Expressions.Interpreter.InterpretedFrame` in `System.Linq.Expressions, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nclass InterpretedFrame\n{\n}\n\n}\n}\nnamespace Parallel\n{\n// Generated from `System.Linq.Parallel.ListChunk<>` in `System.Linq.Parallel, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nclass ListChunk<TInputOutput> : System.Collections.IEnumerable, System.Collections.Generic.IEnumerable<TInputOutput>\n{\n    System.Collections.IEnumerator System.Collections.IEnumerable.GetEnumerator() => throw null;\n    public System.Collections.Generic.IEnumerator<TInputOutput> GetEnumerator() => throw null;\n}\n\n// Generated from `System.Linq.Parallel.Lookup<,>` in `System.Linq.Parallel, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nclass Lookup<TKey,TElement> : System.Linq.ILookup<TKey,TElement>, System.Collections.IEnumerable, System.Collections.Generic.IEnumerable<System.Linq.IGrouping<TKey,TElement>>\n{\n    System.Collections.IEnumerator System.Collections.IEnumerable.GetEnumerator() => throw null;\n    public System.Collections.Generic.IEnumerator<System.Linq.IGrouping<TKey,TElement>> GetEnumerator() => throw null;\n}\n\n// Generated from `System.Linq.Parallel.PartitionerQueryOperator<>` in `System.Linq.Parallel, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nclass PartitionerQueryOperator<TElement> : System.Linq.Parallel.QueryOperator<TElement>\n{\n}\n\n// Generated from `System.Linq.Parallel.QueryOperator<>` in `System.Linq.Parallel, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nabstract class QueryOperator<TOutput> : System.Linq.ParallelQuery<TOutput>\n{\n    public override System.Collections.Generic.IEnumerator<TOutput> GetEnumerator() => throw null;\n}\n\n// Generated from `System.Linq.Parallel.QueryResults<>` in `System.Linq.Parallel, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nabstract class QueryResults<T> : System.Collections.IEnumerable, System.Collections.Generic.IList<T>, System.Collections.Generic.IEnumerable<T>, System.Collections.Generic.ICollection<T>\n{\n    System.Collections.Generic.IEnumerator<T> System.Collections.Generic.IEnumerable<T>.GetEnumerator() => throw null;\n    System.Collections.IEnumerator System.Collections.IEnumerable.GetEnumerator() => throw null;\n    bool System.Collections.Generic.ICollection<T>.Contains(T item) => throw null;\n    bool System.Collections.Generic.ICollection<T>.IsReadOnly { get => throw null; }\n    bool System.Collections.Generic.ICollection<T>.Remove(T item) => throw null;\n    int System.Collections.Generic.IList<T>.IndexOf(T item) => throw null;\n    public T this[int index] { get => throw null; set => throw null; }\n    public int Count { get => throw null; }\n    void System.Collections.Generic.ICollection<T>.Add(T item) => throw null;\n    void System.Collections.Generic.ICollection<T>.Clear() => throw null;\n    void System.Collections.Generic.ICollection<T>.CopyTo(T[] array, int arrayIndex) => throw null;\n    void System.Collections.Generic.IList<T>.Insert(int index, T item) => throw null;\n    void System.Collections.Generic.IList<T>.RemoveAt(int index) => throw null;\n}\n\n// Generated from `System.Linq.Parallel.ZipQueryOperator<,,>` in `System.Linq.Parallel, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nclass ZipQueryOperator<TLeftInput,TRightInput,TOutput> : System.Linq.Parallel.QueryOperator<TOutput>\n{\n}\n\n}\n}\nnamespace Net\n{\n// Generated from `System.Net.CookieCollection` in `System.Net.Primitives, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class CookieCollection : System.Collections.IEnumerable, System.Collections.ICollection, System.Collections.Generic.IReadOnlyCollection<System.Net.Cookie>, System.Collections.Generic.IEnumerable<System.Net.Cookie>, System.Collections.Generic.ICollection<System.Net.Cookie>\n{\n    System.Collections.Generic.IEnumerator<System.Net.Cookie> System.Collections.Generic.IEnumerable<System.Net.Cookie>.GetEnumerator() => throw null;\n    public System.Collections.IEnumerator GetEnumerator() => throw null;\n    public bool Contains(System.Net.Cookie cookie) => throw null;\n    public bool IsReadOnly { get => throw null; }\n    public bool IsSynchronized { get => throw null; }\n    public bool Remove(System.Net.Cookie cookie) => throw null;\n    public int Count { get => throw null; }\n    public object SyncRoot { get => throw null; }\n    public void Add(System.Net.Cookie cookie) => throw null;\n    public void Clear() => throw null;\n    public void CopyTo(System.Array array, int index) => throw null;\n    public void CopyTo(System.Net.Cookie[] array, int index) => throw null;\n}\n\n// Generated from `System.Net.Cookie` in `System.Net.Primitives, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class Cookie\n{\n    public override bool Equals(object comparand) => throw null;\n    public override int GetHashCode() => throw null;\n    public override string ToString() => throw null;\n}\n\n// Generated from `System.Net.StreamFramer` in `System.Net.Security, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nclass StreamFramer\n{\n}\n\nnamespace Security\n{\n// Generated from `System.Net.Security.AuthenticatedStream` in `System.Net.Security, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nabstract public class AuthenticatedStream : System.IO.Stream\n{\n    protected override void Dispose(bool disposing) => throw null;\n    public override System.Threading.Tasks.ValueTask DisposeAsync() => throw null;\n}\n\n// Generated from `System.Net.Security.CipherSuitesPolicy` in `System.Net.Security, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class CipherSuitesPolicy\n{\n}\n\n// Generated from `System.Net.Security.NegotiateStream` in `System.Net.Security, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class NegotiateStream : System.Net.Security.AuthenticatedStream\n{\n    protected override void Dispose(bool disposing) => throw null;\n    public override System.IAsyncResult BeginRead(System.Byte[] buffer, int offset, int count, System.AsyncCallback asyncCallback, object asyncState) => throw null;\n    public override System.IAsyncResult BeginWrite(System.Byte[] buffer, int offset, int count, System.AsyncCallback asyncCallback, object asyncState) => throw null;\n    public override System.Int64 Length { get => throw null; }\n    public override System.Int64 Position { get => throw null; set => throw null; }\n    public override System.Int64 Seek(System.Int64 offset, System.IO.SeekOrigin origin) => throw null;\n    public override System.Threading.Tasks.Task FlushAsync(System.Threading.CancellationToken cancellationToken) => throw null;\n    public override System.Threading.Tasks.Task WriteAsync(System.Byte[] buffer, int offset, int count, System.Threading.CancellationToken cancellationToken) => throw null;\n    public override System.Threading.Tasks.Task<int> ReadAsync(System.Byte[] buffer, int offset, int count, System.Threading.CancellationToken cancellationToken) => throw null;\n    public override System.Threading.Tasks.ValueTask DisposeAsync() => throw null;\n    public override System.Threading.Tasks.ValueTask WriteAsync(System.ReadOnlyMemory<System.Byte> buffer, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;\n    public override System.Threading.Tasks.ValueTask<int> ReadAsync(System.Memory<System.Byte> buffer, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;\n    public override bool CanRead { get => throw null; }\n    public override bool CanSeek { get => throw null; }\n    public override bool CanTimeout { get => throw null; }\n    public override bool CanWrite { get => throw null; }\n    public override int EndRead(System.IAsyncResult asyncResult) => throw null;\n    public override int Read(System.Byte[] buffer, int offset, int count) => throw null;\n    public override int ReadTimeout { get => throw null; set => throw null; }\n    public override int WriteTimeout { get => throw null; set => throw null; }\n    public override void EndWrite(System.IAsyncResult asyncResult) => throw null;\n    public override void Flush() => throw null;\n    public override void SetLength(System.Int64 value) => throw null;\n    public override void Write(System.Byte[] buffer, int offset, int count) => throw null;\n}\n\n// Generated from `System.Net.Security.SslStream` in `System.Net.Security, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class SslStream : System.Net.Security.AuthenticatedStream\n{\n    protected override void Dispose(bool disposing) => throw null;\n    public override System.IAsyncResult BeginRead(System.Byte[] buffer, int offset, int count, System.AsyncCallback asyncCallback, object asyncState) => throw null;\n    public override System.IAsyncResult BeginWrite(System.Byte[] buffer, int offset, int count, System.AsyncCallback asyncCallback, object asyncState) => throw null;\n    public override System.Int64 Length { get => throw null; }\n    public override System.Int64 Position { get => throw null; set => throw null; }\n    public override System.Int64 Seek(System.Int64 offset, System.IO.SeekOrigin origin) => throw null;\n    public override System.Threading.Tasks.Task FlushAsync(System.Threading.CancellationToken cancellationToken) => throw null;\n    public override System.Threading.Tasks.Task WriteAsync(System.Byte[] buffer, int offset, int count, System.Threading.CancellationToken cancellationToken) => throw null;\n    public override System.Threading.Tasks.Task<int> ReadAsync(System.Byte[] buffer, int offset, int count, System.Threading.CancellationToken cancellationToken) => throw null;\n    public override System.Threading.Tasks.ValueTask DisposeAsync() => throw null;\n    public override System.Threading.Tasks.ValueTask WriteAsync(System.ReadOnlyMemory<System.Byte> buffer, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;\n    public override System.Threading.Tasks.ValueTask<int> ReadAsync(System.Memory<System.Byte> buffer, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;\n    public override bool CanRead { get => throw null; }\n    public override bool CanSeek { get => throw null; }\n    public override bool CanTimeout { get => throw null; }\n    public override bool CanWrite { get => throw null; }\n    public override int EndRead(System.IAsyncResult asyncResult) => throw null;\n    public override int Read(System.Byte[] buffer, int offset, int count) => throw null;\n    public override int ReadByte() => throw null;\n    public override int ReadTimeout { get => throw null; set => throw null; }\n    public override int WriteTimeout { get => throw null; set => throw null; }\n    public override void EndWrite(System.IAsyncResult asyncResult) => throw null;\n    public override void Flush() => throw null;\n    public override void SetLength(System.Int64 value) => throw null;\n    public override void Write(System.Byte[] buffer, int offset, int count) => throw null;\n}\n\n// Generated from `System.Net.Security.TlsCipherSuite` in `System.Net.Security, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic enum TlsCipherSuite\n{\n}\n\n// Generated from `System.Net.Security.TlsFrameHelper` in `System.Net.Security, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nclass TlsFrameHelper\n{\n}\n\n}\n}\nnamespace Runtime\n{\nnamespace Serialization\n{\n// Generated from `System.Runtime.Serialization.DataContractAttribute` in `System.Runtime.Serialization.Primitives, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class DataContractAttribute : System.Attribute\n{\n    public DataContractAttribute() => throw null;\n}\n\n// Generated from `System.Runtime.Serialization.DataMemberAttribute` in `System.Runtime.Serialization.Primitives, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class DataMemberAttribute : System.Attribute\n{\n    public DataMemberAttribute() => throw null;\n}\n\n}\n}\nnamespace Text\n{\nnamespace RegularExpressions\n{\n// Generated from `System.Text.RegularExpressions.Capture` in `System.Text.RegularExpressions, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class Capture\n{\n    public override string ToString() => throw null;\n}\n\n// Generated from `System.Text.RegularExpressions.CollectionDebuggerProxy<>` in `System.Text.RegularExpressions, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\nclass CollectionDebuggerProxy<T>\n{\n}\n\n// Generated from `System.Text.RegularExpressions.GroupCollection` in `System.Text.RegularExpressions, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class GroupCollection : System.Collections.IList, System.Collections.IEnumerable, System.Collections.ICollection, System.Collections.Generic.IReadOnlyList<System.Text.RegularExpressions.Group>, System.Collections.Generic.IReadOnlyDictionary<string,System.Text.RegularExpressions.Group>, System.Collections.Generic.IReadOnlyCollection<System.Text.RegularExpressions.Group>, System.Collections.Generic.IReadOnlyCollection<System.Collections.Generic.KeyValuePair<string,System.Text.RegularExpressions.Group>>, System.Collections.Generic.IList<System.Text.RegularExpressions.Group>, System.Collections.Generic.IEnumerable<System.Text.RegularExpressions.Group>, System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<string,System.Text.RegularExpressions.Group>>, System.Collections.Generic.ICollection<System.Text.RegularExpressions.Group>\n{\n    System.Collections.Generic.IEnumerator<System.Collections.Generic.KeyValuePair<string,System.Text.RegularExpressions.Group>> System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<string,System.Text.RegularExpressions.Group>>.GetEnumerator() => throw null;\n    System.Collections.Generic.IEnumerator<System.Text.RegularExpressions.Group> System.Collections.Generic.IEnumerable<System.Text.RegularExpressions.Group>.GetEnumerator() => throw null;\n    System.Text.RegularExpressions.Group this[int index] { get => throw null; set => throw null; }\n    bool System.Collections.Generic.ICollection<System.Text.RegularExpressions.Group>.Contains(System.Text.RegularExpressions.Group item) => throw null;\n    bool System.Collections.Generic.ICollection<System.Text.RegularExpressions.Group>.Remove(System.Text.RegularExpressions.Group item) => throw null;\n    bool System.Collections.IList.Contains(object value) => throw null;\n    bool System.Collections.IList.IsFixedSize { get => throw null; }\n    int System.Collections.Generic.IList<System.Text.RegularExpressions.Group>.IndexOf(System.Text.RegularExpressions.Group item) => throw null;\n    int System.Collections.IList.Add(object value) => throw null;\n    int System.Collections.IList.IndexOf(object value) => throw null;\n    object this[int index] { get => throw null; set => throw null; }\n    public System.Collections.Generic.IEnumerable<System.Text.RegularExpressions.Group> Values { get => throw null; }\n    public System.Collections.Generic.IEnumerable<string> Keys { get => throw null; }\n    public System.Collections.IEnumerator GetEnumerator() => throw null;\n    public System.Text.RegularExpressions.Group this[string groupname] { get => throw null; }\n    public bool ContainsKey(string key) => throw null;\n    public bool IsReadOnly { get => throw null; }\n    public bool IsSynchronized { get => throw null; }\n    public bool TryGetValue(string key, out System.Text.RegularExpressions.Group value) => throw null;\n    public int Count { get => throw null; }\n    public object SyncRoot { get => throw null; }\n    public void CopyTo(System.Array array, int arrayIndex) => throw null;\n    public void CopyTo(System.Text.RegularExpressions.Group[] array, int arrayIndex) => throw null;\n    void System.Collections.Generic.ICollection<System.Text.RegularExpressions.Group>.Add(System.Text.RegularExpressions.Group item) => throw null;\n    void System.Collections.Generic.ICollection<System.Text.RegularExpressions.Group>.Clear() => throw null;\n    void System.Collections.Generic.IList<System.Text.RegularExpressions.Group>.Insert(int index, System.Text.RegularExpressions.Group item) => throw null;\n    void System.Collections.Generic.IList<System.Text.RegularExpressions.Group>.RemoveAt(int index) => throw null;\n    void System.Collections.IList.Clear() => throw null;\n    void System.Collections.IList.Insert(int index, object value) => throw null;\n    void System.Collections.IList.Remove(object value) => throw null;\n    void System.Collections.IList.RemoveAt(int index) => throw null;\n}\n\n// Generated from `System.Text.RegularExpressions.Group` in `System.Text.RegularExpressions, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class Group : System.Text.RegularExpressions.Capture\n{\n}\n\n// Generated from `System.Text.RegularExpressions.Match` in `System.Text.RegularExpressions, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class Match : System.Text.RegularExpressions.Group\n{\n}\n\n// Generated from `System.Text.RegularExpressions.RegexOptions` in `System.Text.RegularExpressions, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\n[System.Flags]\npublic enum RegexOptions\n{\n    IgnoreCase,\n}\n\n// Generated from `System.Text.RegularExpressions.Regex` in `System.Text.RegularExpressions, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class Regex : System.Runtime.Serialization.ISerializable\n{\n    public Regex(string pattern) => throw null;\n    public Regex(string pattern, System.Text.RegularExpressions.RegexOptions options, System.TimeSpan matchTimeout) => throw null;\n    public System.Text.RegularExpressions.Match Match(string input) => throw null;\n    public override string ToString() => throw null;\n    public static System.Text.RegularExpressions.Match Match(string input, string pattern) => throw null;\n    public static System.Text.RegularExpressions.Match Match(string input, string pattern, System.Text.RegularExpressions.RegexOptions options, System.TimeSpan matchTimeout) => throw null;\n    public string Replace(string input, string replacement) => throw null;\n    void System.Runtime.Serialization.ISerializable.GetObjectData(System.Runtime.Serialization.SerializationInfo si, System.Runtime.Serialization.StreamingContext context) => throw null;\n}\n\n}\n}\nnamespace Timers\n{\n// Generated from `System.Timers.TimersDescriptionAttribute` in `System.ComponentModel.TypeConverter, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class TimersDescriptionAttribute\n{\n    public TimersDescriptionAttribute(string description) => throw null;\n}\n\n}\nnamespace Windows\n{\nnamespace Markup\n{\n// Generated from `System.Windows.Markup.ValueSerializerAttribute` in `System.ObjectModel, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a`\npublic class ValueSerializerAttribute : System.Attribute\n{\n    public ValueSerializerAttribute(System.Type valueSerializerType) => throw null;\n    public ValueSerializerAttribute(string valueSerializerTypeName) => throw null;\n}\n\n}\n}\n}\n |
diff --git a/csharp/ql/test/resources/stubs/Dapper.cs b/csharp/ql/test/resources/stubs/Dapper.cs
new file mode 100644
index 00000000000..d96f1cd4ee6
--- /dev/null
+++ b/csharp/ql/test/resources/stubs/Dapper.cs
@@ -0,0 +1,34 @@
+// This file contains auto-generated code.
+// original-extractor-options: /r:Dapper.dll /r:System.Data.SqlClient.dll ...
+
+namespace Dapper
+{
+    // Generated from `Dapper.CommandDefinition` in `Dapper, Version=2.0.0.0, Culture=neutral, PublicKeyToken=null`
+    public struct CommandDefinition
+    {
+        public CommandDefinition(string commandText, object parameters = null, System.Data.IDbTransaction transaction = null, int? commandTimeout = null, System.Data.CommandType? commandType = null, Dapper.CommandFlags flags = CommandFlags.Buffered, System.Threading.CancellationToken cancellationToken = default) => throw null;
+    }
+
+    // Generated from `Dapper.CommandFlags` in `Dapper, Version=2.0.0.0, Culture=neutral, PublicKeyToken=null`
+    [System.Flags]
+    public enum CommandFlags
+    {
+        None = 0x0,
+        Buffered = 0x1,
+        Pipelined = 0x2,
+        NoCache = 0x4
+    }
+
+    // Generated from `Dapper.SqlMapper` in `Dapper, Version=2.0.0.0, Culture=neutral, PublicKeyToken=null`
+    static public class SqlMapper
+    {
+        public static System.Collections.Generic.IEnumerable<T> Query<T>(this System.Data.IDbConnection cnn, string sql, object param = null, System.Data.IDbTransaction transaction = null, bool buffered = true, int? commandTimeout = null, System.Data.CommandType? commandType = null) => throw null;
+        public static System.Data.IDataReader ExecuteReader(this System.Data.IDbConnection cnn, string sql, object param = null, System.Data.IDbTransaction transaction = null, int? commandTimeout = null, System.Data.CommandType? commandType = null) => throw null;
+        public static System.Threading.Tasks.Task<System.Collections.Generic.IEnumerable<T>> QueryAsync<T>(this System.Data.IDbConnection cnn, string sql, object param = null, System.Data.IDbTransaction transaction = null, int? commandTimeout = null, System.Data.CommandType? commandType = null) => throw null;
+        public static System.Threading.Tasks.Task<dynamic> QueryFirstAsync(this System.Data.IDbConnection cnn, Dapper.CommandDefinition command) => throw null;
+        public static System.Threading.Tasks.Task<dynamic> QueryFirstAsync(this System.Data.IDbConnection cnn, string sql, object param = null, System.Data.IDbTransaction transaction = null, int? commandTimeout = null, System.Data.CommandType? commandType = null) => throw null;
+        public static System.Threading.Tasks.Task<int> ExecuteAsync(this System.Data.IDbConnection cnn, string sql, object param = null, System.Data.IDbTransaction transaction = null, int? commandTimeout = null, System.Data.CommandType? commandType = null) => throw null;
+        public static object ExecuteScalar(this System.Data.IDbConnection cnn, string sql, object param = null, System.Data.IDbTransaction transaction = null, int? commandTimeout = null, System.Data.CommandType? commandType = null) => throw null;
+    }
+}
+
diff --git a/docs/codeql/codeql-cli/about-ql-packs.rst b/docs/codeql/codeql-cli/about-ql-packs.rst
index 200dadc173b..b3f3c13ed88 100644
--- a/docs/codeql/codeql-cli/about-ql-packs.rst
+++ b/docs/codeql/codeql-cli/about-ql-packs.rst
@@ -75,11 +75,11 @@ The following properties are supported in ``qlpack.yml`` files.
    * - ``name``
      - ``org-queries``
      - All packs
-     - The name of the QL pack defined using alphanumeric characters, hyphens, and periods. It must be unique as CodeQL cannot differentiate between QL packs with identical names. If you intend to    distribute the pack, prefix the name with your (or your organization's) name followed by a hyphen. Use the pack name to specify queries to run using ``database analyze`` and to define    dependencies between QL packs (see examples below).- '
+     - The name of the QL pack defined using alphanumeric characters, hyphens, and periods. It must be unique as CodeQL cannot differentiate between QL packs with identical names. If you intend to    distribute the pack, prefix the name with your (or your organization's) name followed by a hyphen. Use the pack name to specify queries to run using ``database analyze`` and to define    dependencies between QL packs (see examples below).
    * - ``version``
      - ``0.0.0``
      - All packs
-     - A version number for this QL pack. This field is not currently used by any commands, but may be required by future releases of CodeQL.
+     - A version number for this QL pack. This must be a valid semantic version that meets the `SemVer v2.0.0 specification <https://semver.org/spec/v2.0.0.html>`__.
    * - ``libraryPathDependencies``
      - ``codeql-javascript``
      - Optional
diff --git a/docs/codeql/codeql-cli/codeql-cli-reference.rst b/docs/codeql/codeql-cli/codeql-cli-reference.rst
index 75513a06b54..0c53121d379 100644
--- a/docs/codeql/codeql-cli/codeql-cli-reference.rst
+++ b/docs/codeql/codeql-cli/codeql-cli-reference.rst
@@ -21,11 +21,3 @@ Learn more about the files you can use when running CodeQL processes and the res
 - :doc:`SARIF output <sarif-output>`: CodeQL supports SARIF as an output format for sharing static analysis results.
 - :doc:`Exit codes <exit-codes>`: The CodeQL CLI reports the status of each command it runs as an exit code.
   This exit code provides information for subsequent commands or for other tools that rely on the CodeQL CLI.
-
-.. _cli-commands:
-
-CodeQL CLI manual
------------------
-
-To view detailed information about each CodeQL CLI command,
-including its usage and options, add the ``--help`` flag or visit the "`CodeQL CLI manual <../manual>`__."
diff --git a/docs/codeql/codeql-cli/creating-codeql-databases.rst b/docs/codeql/codeql-cli/creating-codeql-databases.rst
index 73fa4fb4818..4f7212050df 100644
--- a/docs/codeql/codeql-cli/creating-codeql-databases.rst
+++ b/docs/codeql/codeql-cli/creating-codeql-databases.rst
@@ -168,7 +168,7 @@ build steps, you may need to explicitly define each step in the command line.
    For Go, you should always use the CodeQL autobuilder. Install the Go
    toolchain (version 1.11 or later) and, if there are dependencies, the
    appropriate dependency manager (such as `dep
-   <https://golang.github.io/dep/>`__ or `Glide <http://glide.sh/>`__).
+   <https://golang.github.io/dep/>`__).
    
    Do not specify any build commands, as you will override the autobuilder
    invocation, which will create an empty database.  
diff --git a/docs/codeql/codeql-cli/getting-started-with-the-codeql-cli.rst b/docs/codeql/codeql-cli/getting-started-with-the-codeql-cli.rst
index cb4cd413f25..53d08e41d72 100644
--- a/docs/codeql/codeql-cli/getting-started-with-the-codeql-cli.rst
+++ b/docs/codeql/codeql-cli/getting-started-with-the-codeql-cli.rst
@@ -121,24 +121,24 @@ see ":doc:`About QL packs <about-ql-packs>`."
 
    There are different versions of the CodeQL queries available for different
    users. Check out the correct version for your use case:
+
+   - For the queries used on `LGTM.com <https://lgtm.com>`__, check out the
+     ``lgtm.com`` branch. You should use this branch for databases you've built
+     using the CodeQL CLI, fetched from code scanning on GitHub, or recently downloaded from LGTM.com.
+     The queries on the ``lgtm.com`` branch are more likely to be compatible 
+     with the ``latest`` CLI, so you'll be less likely to have to upgrade 
+     newly-created databases than if you use the ``main`` branch. Older databases 
+     may need to be upgraded before you can analyze them.
    
    - For the most up to date CodeQL queries, check out the ``main`` branch. 
      This branch represents the very latest version of CodeQL's analysis. Even
      databases created using the most recent version of the CLI may have to be
      upgraded before you can analyze them. For more information, see
      ":doc:`Upgrading CodeQL databases <upgrading-codeql-databases>`."
-    
-   - For the queries used on `LGTM.com <https://lgtm.com>`__, check out the
-     ``lgtm.com`` branch. You can run these queries on databases you've recently
-     downloaded from LGTM.com. Older databases may need to be upgraded before
-     you can analyze them. The queries on the ``lgtm.com`` branch are also more
-     likely to be compatible with the ``latest`` CLI, so you'll be less likely
-     to have to upgrade newly-created databases than if you use the ``main``
-     branch.
-           
+        
    - For the queries used in a particular LGTM Enterprise release, check out the
      branch tagged with the relevant release number. For example, the branch
-     tagged ``v1.23.0`` corresponds to LGTM Enterprise 1.23. You must use this
+     tagged ``v1.27.0`` corresponds to LGTM Enterprise 1.27. You must use this
      version if you want to upload data to LGTM Enterprise. For further
      information, see `Preparing CodeQL databases to upload to LGTM 
      <https://help.semmle.com/lgtm-enterprise/admin/help/prepare-database-upload.html>`__
diff --git a/docs/codeql/codeql-cli/index.rst b/docs/codeql/codeql-cli/index.rst
index 07ec8431235..d7a8a407364 100644
--- a/docs/codeql/codeql-cli/index.rst
+++ b/docs/codeql/codeql-cli/index.rst
@@ -18,4 +18,4 @@ CodeQL CLI
 
    using-the-codeql-cli
    codeql-cli-reference
-   
+   CodeQL CLI manual <https://codeql.github.com/docs/codeql-cli/manual>
diff --git a/docs/codeql/codeql-cli/testing-custom-queries.rst b/docs/codeql/codeql-cli/testing-custom-queries.rst
index 3890703a83d..7f347de8b1c 100644
--- a/docs/codeql/codeql-cli/testing-custom-queries.rst
+++ b/docs/codeql/codeql-cli/testing-custom-queries.rst
@@ -13,20 +13,6 @@ on the query and the expected results until the actual results and the expected
 results exactly match. This topic shows you how to create test files and execute
 tests on them using the ``test run`` subcommand.
 
-.. container:: toggle
-
-   .. container:: name
-
-      **Information for LGTM Enterprise 1.23 users**
-
-   CodeQL tests are a new feature in CodeQL CLI version 2.0.2.
-   
-   If you are an LGTM Enterprise 1.23 user, you should still use CodeQL CLI
-   version 2.0.1 to prepare databases to upload to your instance of LGTM. You
-   can use version 2.0.2 (or newer) to test your custom queries, but databases
-   created with versions newer than 2.0.1 are not compatible with LGTM
-   Enterprise 1.23. For more information, see ":ref:`Getting started with the CodeQL CLI <using-two-versions-of-the-codeql-cli>`."
-
 Setting up a test QL pack for custom queries
 --------------------------------------------
 
diff --git a/docs/codeql/codeql-cli/testing-query-help-files.rst b/docs/codeql/codeql-cli/testing-query-help-files.rst
index d8285eb57cc..ba5cf3901e7 100644
--- a/docs/codeql/codeql-cli/testing-query-help-files.rst
+++ b/docs/codeql/codeql-cli/testing-query-help-files.rst
@@ -38,7 +38,7 @@ where ``<qhelp|query|dir|suite>`` is one of:
 - the path to a ``.ql`` file.
 - the path to a directory containing queries and query help files.
 - the path to a query suite, or the name of a well-known query suite for a QL pack. 
-  For more information, see "`Creating CodeQL query suites <creating-codeql-query-suites.html#specifying-well-known-query-suites>`__."
+  For more information, see "`Creating CodeQL query suites <https://codeql.github.com/docs/codeql-cli/creating-codeql-query-suites#specifying-well-known-query-suites>`__."
 
 You must specify a ``--format`` option, which defines how the query help is rendered. 
 Currently, you must specify ``markdown`` to render the query help as markdown. 
diff --git a/docs/codeql/codeql-for-visual-studio-code/analyzing-your-projects.rst b/docs/codeql/codeql-for-visual-studio-code/analyzing-your-projects.rst
index 02ece5284fa..b9a275cfb41 100644
--- a/docs/codeql/codeql-for-visual-studio-code/analyzing-your-projects.rst
+++ b/docs/codeql/codeql-for-visual-studio-code/analyzing-your-projects.rst
@@ -14,7 +14,7 @@ To analyze a project, you need to add a :ref:`CodeQL database <codeql-database>`
 
 #. Open the CodeQL Databases view in the sidebar.
 
-#. Hover over the **Databases** title bar and click the appropriate icon to add your database. You can add a database from a local ZIP archive or folder, from a public URL, or from a project URL on LGTM.com.
+#. Hover over the **Databases** title bar and click the appropriate icon to add your database. You can add a database from a local ZIP archive or folder, from a public URL, or from a project slug or URL on LGTM.com.
 
    .. image:: ../images/codeql-for-visual-studio-code/choose-database.png
       :width: 350
diff --git a/docs/codeql/codeql-for-visual-studio-code/customizing-settings.rst b/docs/codeql/codeql-for-visual-studio-code/customizing-settings.rst
index fd61771831a..8197858d3ab 100644
--- a/docs/codeql/codeql-for-visual-studio-code/customizing-settings.rst
+++ b/docs/codeql/codeql-for-visual-studio-code/customizing-settings.rst
@@ -58,6 +58,11 @@ Configuring settings for testing queries
 
 To increase the number of threads used for testing queries, you can update the **Running Tests > Number Of Threads** setting.
 
+Configuring settings for telemetry and data collection
+--------------------------------------------------------
+
+You can configure whether the CodeQL extension collects telemetry data. This is disabled by default. For more information, see ":doc:`About telemetry in CodeQL for Visual Studio Code <about-telemetry-in-codeql-for-visual-studio-code>`."
+
 Further reading
 ----------------
 
diff --git a/docs/codeql/codeql-for-visual-studio-code/setting-up-codeql-in-visual-studio-code.rst b/docs/codeql/codeql-for-visual-studio-code/setting-up-codeql-in-visual-studio-code.rst
index cfc85fa23bd..93b070dba18 100644
--- a/docs/codeql/codeql-for-visual-studio-code/setting-up-codeql-in-visual-studio-code.rst
+++ b/docs/codeql/codeql-for-visual-studio-code/setting-up-codeql-in-visual-studio-code.rst
@@ -64,7 +64,7 @@ There are two ways to do this:
       **Click to show information for LGTM Enterprise users**
 
    Your local version of the CodeQL queries and libraries should match your version of LGTM Enterprise. For example, if you
-   use LGTM Enterprise 1.23, then you should clone the ``1.23.0`` branch of the `starter workspace <https://github.com/github/vscode-codeql-starter/>`__ (or the appropriate ``1.23.x`` branch, corresponding to each maintenance release).
+   use LGTM Enterprise 1.27, then you should clone the ``1.27.0`` branch of the `starter workspace <https://github.com/github/vscode-codeql-starter/>`__ (or the appropriate ``1.27.x`` branch, corresponding to each maintenance release).
    
    This ensures that the queries and libraries you write in VS Code also work in the query console on LGTM Enterprise.
 
diff --git a/docs/codeql/codeql-language-guides/analyzing-data-flow-in-python.rst b/docs/codeql/codeql-language-guides/analyzing-data-flow-in-python.rst
index 068e925534e..f5128e5eafd 100644
--- a/docs/codeql/codeql-language-guides/analyzing-data-flow-in-python.rst
+++ b/docs/codeql/codeql-language-guides/analyzing-data-flow-in-python.rst
@@ -99,6 +99,8 @@ Python has builtin functionality for reading and writing files, such as the func
 
 ➤ `See this in the query console on LGTM.com <https://lgtm.com/query/8635258505893505141/>`__. Two of the demo projects make use of this low-level API.
 
+Notice the use of the ``API`` module for referring to library functions. For more information, see ":doc:`Using API graphs in Python <using-api-graphs-in-python>`."
+
 Unfortunately this will only give the expression in the argument, not the values which could be passed to it. So we use local data flow to find all expressions that flow into the argument:
 
 .. code-block:: ql
diff --git a/docs/codeql/codeql-language-guides/codeql-for-python.rst b/docs/codeql/codeql-language-guides/codeql-for-python.rst
index 3504b1fb2c3..15b0c4a84f8 100644
--- a/docs/codeql/codeql-language-guides/codeql-for-python.rst
+++ b/docs/codeql/codeql-language-guides/codeql-for-python.rst
@@ -11,6 +11,7 @@ Experiment and learn how to write effective and efficient queries for CodeQL dat
    basic-query-for-python-code
    codeql-library-for-python
    analyzing-data-flow-in-python
+   using-api-graphs-in-python
    functions-in-python
    expressions-and-statements-in-python
    analyzing-control-flow-in-python
@@ -21,6 +22,8 @@ Experiment and learn how to write effective and efficient queries for CodeQL dat
 
 -  :doc:`Analyzing data flow in Python <analyzing-data-flow-in-python>`: You can use CodeQL to track the flow of data through a Python program to places where the data is used.
 
+-  :doc:`Using API graphs in Python <using-api-graphs-in-python>`: API graphs are a uniform interface for referring to functions, classes, and methods defined in external libraries.
+
 -  :doc:`Functions in Python <functions-in-python>`: You can use syntactic classes from the standard CodeQL library to find Python functions and identify calls to them.
 
 -  :doc:`Expressions and statements in Python <expressions-and-statements-in-python>`: You can use syntactic classes from the CodeQL library to explore how Python expressions and statements are used in a codebase.
diff --git a/docs/codeql/codeql-language-guides/codeql-library-for-python.rst b/docs/codeql/codeql-language-guides/codeql-library-for-python.rst
index 3f546dad1d0..204a6d22c3b 100644
--- a/docs/codeql/codeql-language-guides/codeql-library-for-python.rst
+++ b/docs/codeql/codeql-language-guides/codeql-library-for-python.rst
@@ -23,10 +23,9 @@ The CodeQL library for Python incorporates a large number of classes. Each class
 -  **Data flow** - classes that represent entities from the data flow graphs.
 -  **API graphs** - classes that represent entities from the API graphs.
 
-The first two categories are described below. See ":doc:`Analyzing data flow in Python <analyzing-data-flow-in-python>`" for a description of data flow and associated classes.
-
-..
-   and [TO COME IN FUTURE PR] for a description of API graphs and their use.
+The first two categories are described below. 
+For a description of data flow and associated classes, see ":doc:`Analyzing data flow in Python <analyzing-data-flow-in-python>`".
+For a description of API graphs and their use, see ":doc:`Using API graphs in Python <using-api-graphs-in-python>`."
 
 Syntactic classes
 -----------------
diff --git a/docs/codeql/codeql-language-guides/data-flow-cheat-sheet-for-javascript.rst b/docs/codeql/codeql-language-guides/data-flow-cheat-sheet-for-javascript.rst
index 92eb35d4d2e..1b2e5ca450b 100644
--- a/docs/codeql/codeql-language-guides/data-flow-cheat-sheet-for-javascript.rst
+++ b/docs/codeql/codeql-language-guides/data-flow-cheat-sheet-for-javascript.rst
@@ -63,7 +63,7 @@ Classes and member predicates in the ``DataFlow::`` module:
     - `getAnInstantiation <https://codeql.github.com/codeql-standard-libraries/javascript/semmle/javascript/dataflow/Sources.qll/predicate.Sources$SourceNode$getAnInstantiation.0.html>`__ -- find ``new``-calls with this as the callee
     - `getAnInvocation <https://codeql.github.com/codeql-standard-libraries/javascript/semmle/javascript/dataflow/Sources.qll/predicate.Sources$SourceNode$getAnInvocation.0.html>`__ -- find calls or ``new``-calls with this as the callee
     - `getAMethodCall <https://codeql.github.com/codeql-standard-libraries/javascript/semmle/javascript/dataflow/Sources.qll/predicate.Sources$SourceNode$getAMethodCall.1.html>`__ -- find method calls with this as the receiver
-    - `getAMemberCall <https://codeql.github.com/codeql-standard-libraries/javascript/semmle/javascript/dataflow/Sources.qll/predicate.Sources$SourceNode$getAMemberCall.1.html>`__ -- find calls with a member of this as the receiver
+    - `getAMemberCall <https://codeql.github.com/codeql-standard-libraries/javascript/semmle/javascript/dataflow/Sources.qll/predicate.Sources$SourceNode$getAMemberCall.1.html>`__ -- find calls with a member of this as the callee
     - `getAPropertyRead <https://codeql.github.com/codeql-standard-libraries/javascript/semmle/javascript/dataflow/Sources.qll/predicate.Sources$SourceNode$getAPropertyRead.1.html>`__ -- find property reads with this as the base
     - `getAPropertyWrite <https://codeql.github.com/codeql-standard-libraries/javascript/semmle/javascript/dataflow/Sources.qll/predicate.Sources$SourceNode$getAPropertyWrite.1.html>`__ -- find property writes with this as the base
     - `getAPropertySource <https://codeql.github.com/codeql-standard-libraries/javascript/semmle/javascript/dataflow/Sources.qll/predicate.Sources$SourceNode$getAPropertySource.1.html>`__ -- find nodes flowing into a property of this node
@@ -109,12 +109,14 @@ StringOps module
 - StringOps::`StartsWith <https://codeql.github.com/codeql-standard-libraries/javascript/semmle/javascript/StringOps.qll/type.StringOps$StringOps$StartsWith.html>`__ -- check if a string starts with something
 - StringOps::`EndsWith <https://codeql.github.com/codeql-standard-libraries/javascript/semmle/javascript/StringOps.qll/type.StringOps$StringOps$EndsWith.html>`__ -- check if a string ends with something
 - StringOps::`Includes <https://codeql.github.com/codeql-standard-libraries/javascript/semmle/javascript/StringOps.qll/type.StringOps$StringOps$Includes.html>`__ -- check if a string contains something
+- StringOps::`RegExpTest <https://codeql.github.com/codeql-standard-libraries/javascript/semmle/javascript/StringOps.qll/type.StringOps$StringOps$RegExpTest.html>`__ -- check if a string matches a RegExp
 
 Utility
 --------
 
 - `ExtendCall <https://codeql.github.com/codeql-standard-libraries/javascript/semmle/javascript/Extend.qll/type.Extend$ExtendCall.html>`__ -- call that copies properties from one object to another
 - `JsonParserCall <https://codeql.github.com/codeql-standard-libraries/javascript/semmle/javascript/JsonParsers.qll/type.JsonParsers$JsonParserCall.html>`__ -- call that deserializes a JSON string
+- `JsonStringifyCall <https://codeql.github.com/codeql-standard-libraries/javascript/semmle/javascript/JsonStringifiers.qll/type.JsonStringifiers$JsonStringifyCall.html>`__ -- call that serializes a JSON string
 - `PropertyProjection <https://codeql.github.com/codeql-standard-libraries/javascript/semmle/javascript/frameworks/PropertyProjection.qll/type.PropertyProjection$PropertyProjection.html>`__ -- call that extracts nested properties by name
 
 System and Network
@@ -128,7 +130,7 @@ System and Network
     - `FileSystemWriteAccess <https://codeql.github.com/codeql-standard-libraries/javascript/semmle/javascript/Concepts.qll/type.Concepts$FileSystemWriteAccess.html>`__ -- writing to the contents of a file
 - `PersistentReadAccess <https://codeql.github.com/codeql-standard-libraries/javascript/semmle/javascript/Concepts.qll/type.Concepts$PersistentReadAccess.html>`__ -- reading from persistent storage, like cookies
 - `PersistentWriteAccess <https://codeql.github.com/codeql-standard-libraries/javascript/semmle/javascript/Concepts.qll/type.Concepts$PersistentWriteAccess.html>`__ -- writing to persistent storage
-- `RemoteFlowSource <https://codeql.github.com/codeql-standard-libraries/javascript/semmle/javascript/security/dataflow/RemoteFlowSources.qll/type.RemoteFlowSources$RemoteFlowSource.html>`__ -- source of untrusted user input
+- `RemoteFlowSource <https://codeql.github.com/codeql-standard-libraries/javascript/semmle/javascript/security/dataflow/RemoteFlowSources.qll/type.RemoteFlowSources$Cached$RemoteFlowSource.html>`__ -- source of untrusted user input
 - `SystemCommandExecution <https://codeql.github.com/codeql-standard-libraries/javascript/semmle/javascript/Concepts.qll/type.Concepts$SystemCommandExecution.html>`__ -- execution of a system command
 
 Files
diff --git a/docs/codeql/codeql-language-guides/specifying-additional-remote-flow-sources-for-javascript.rst b/docs/codeql/codeql-language-guides/specifying-additional-remote-flow-sources-for-javascript.rst
index fabe58bf5c9..082a7e3fcb7 100644
--- a/docs/codeql/codeql-language-guides/specifying-additional-remote-flow-sources-for-javascript.rst
+++ b/docs/codeql/codeql-language-guides/specifying-additional-remote-flow-sources-for-javascript.rst
@@ -12,7 +12,7 @@ You can model potential sources of untrusted user input in your code without mak
    Specifying remote flow sources in external files is currently in beta and subject to change.
 
 As mentioned in the :doc:`Data flow cheat sheet for JavaScript <data-flow-cheat-sheet-for-javascript>`, the CodeQL libraries for JavaScript
-provide a class `RemoteFlowSource <https://codeql.github.com/codeql-standard-libraries/javascript/semmle/javascript/security/dataflow/RemoteFlowSources.qll/type.RemoteFlowSources$RemoteFlowSource.html>`__ to represent sources of untrusted user input, sometimes also referred to as remote flow
+provide a class `RemoteFlowSource <https://codeql.github.com/codeql-standard-libraries/javascript/semmle/javascript/security/dataflow/RemoteFlowSources.qll/type.RemoteFlowSources$Cached$RemoteFlowSource.html>`__ to represent sources of untrusted user input, sometimes also referred to as remote flow
 sources.
 
 To model a new source of untrusted input, such as a previously unmodelled library API, you can
diff --git a/docs/codeql/codeql-language-guides/using-api-graphs-in-python.rst b/docs/codeql/codeql-language-guides/using-api-graphs-in-python.rst
new file mode 100644
index 00000000000..24be065c912
--- /dev/null
+++ b/docs/codeql/codeql-language-guides/using-api-graphs-in-python.rst
@@ -0,0 +1,164 @@
+.. _using-api-graphs-in-python:
+
+Using API graphs in Python
+==========================
+
+API graphs are a uniform interface for referring to functions, classes, and methods defined in
+external libraries.
+
+About this article
+------------------
+
+This article describes how to use API graphs to reference classes and functions defined in library
+code. You can use API graphs to conveniently refer to external library functions when defining things like
+remote flow sources.
+
+
+Module imports
+--------------
+
+The most common entry point into the API graph will be the point where an external module or package is
+imported. For example, you can access the API graph node corresponding to the ``re`` library
+by using the ``API::moduleImport`` method defined in the ``semmle.python.ApiGraphs`` module, as the
+following snippet demonstrates.
+
+.. code-block:: ql
+
+    import python
+    import semmle.python.ApiGraphs
+
+    select API::moduleImport("re")
+
+➤ `See this in the query console on LGTM.com <https://lgtm.com/query/1876172022264324639/>`__.
+
+This query selects the API graph node corresponding to the ``re`` module. This node represents the fact that the ``re`` module has been imported rather than a specific location in the program where the import happens. Therefore, there will be at most one result per project, and it will not have a useful location, so you'll have to click `Show 1 non-source result` in order to see it.
+
+To find where the ``re`` module is referenced in the program, you can use the ``getAUse`` method. The following query selects all references to the ``re`` module in the current database.
+
+.. code-block:: ql
+
+    import python
+    import semmle.python.ApiGraphs
+
+    select API::moduleImport("re").getAUse()
+
+➤ `See this in the query console on LGTM.com <https://lgtm.com/query/8072356519514905526/>`__.
+
+Note that the ``getAUse`` method accounts for local flow, so that ``my_re_compile``
+in the following snippet is
+correctly recognized as a reference to the ``re.compile`` function.
+
+.. code-block:: python
+
+    from re import compile as re_compile
+
+    my_re_compile = re_compile
+
+    r = my_re_compile(".*")
+
+If you only require immediate uses, without taking local flow into account, then you can use
+the ``getAnImmediateUse`` method instead.
+
+Note that the given module name *must not* contain any dots. Thus, something like
+``API::moduleImport("flask.views")`` will not do what you expect. Instead, this should be decomposed
+into an access of the ``views`` member of the API graph node for ``flask``, as described in the next
+section.
+
+Accessing attributes
+--------------------
+
+Given a node in the API graph, you can access its attributes by using the ``getMember`` method. Using
+the above ``re.compile`` example, you can now find references to ``re.compile``.
+
+.. code-block:: ql
+
+    import python
+    import semmle.python.ApiGraphs
+
+    select API::moduleImport("re").getMember("compile").getAUse()
+
+➤ `See this in the query console on LGTM.com <https://lgtm.com/query/7970570434725297676/>`__.
+
+In addition to ``getMember``, you can use the ``getUnknownMember`` method to find references to API
+components where the name is not known statically. You can use the ``getAMember`` method to
+access all members, both known and unknown.
+
+Calls and class instantiations
+------------------------------
+
+To track instances of classes defined in external libraries, or the results of calling externally
+defined functions, you can use the ``getReturn`` method. The following snippet finds all places
+where the return value of ``re.compile`` is used:
+
+.. code-block:: ql
+
+    import python
+    import semmle.python.ApiGraphs
+
+    select API::moduleImport("re").getMember("compile").getReturn().getAUse()
+
+➤ `See this in the query console on LGTM.com <https://lgtm.com/query/4346050399960356921/>`__.
+
+Note that this includes all uses of the result of ``re.compile``, including those reachable via
+local flow. To get just the *calls* to ``re.compile``, you can use ``getAnImmediateUse`` instead of
+``getAUse``. As this is a common occurrence, you can use ``getACall`` instead of
+``getReturn`` followed by ``getAnImmediateUse``.
+
+➤ `See this in the query console on LGTM.com <https://lgtm.com/query/8143347716552092926/>`__.
+
+Note that the API graph does not distinguish between class instantiations and function calls. As far
+as it's concerned, both are simply places where an API graph node is called.
+
+Subclasses
+----------
+
+For many libraries, the main mode of usage is to extend one or more library classes. To track this
+in the API graph, you can use the ``getASubclass`` method to get the API graph node corresponding to
+all the immediate subclasses of this node. To find *all* subclasses, use ``*`` or ``+`` to apply the
+method repeatedly, as in ``getASubclass*``.
+
+Note that ``getASubclass`` does not account for any subclassing that takes place in library code
+that has not been extracted. Thus, it may be necessary to account for this in the models you write.
+For example, the ``flask.views.View`` class has a predefined subclass ``MethodView``. To find
+all subclasses of ``View``, you must explicitly include the subclasses of ``MethodView`` as well.
+
+.. code-block:: ql
+
+    import python
+    import semmle.python.ApiGraphs
+
+    API::Node viewClass() {
+      result =
+        API::moduleImport("flask").getMember("views").getMember(["View", "MethodView"]).getASubclass*()
+    }
+
+    select viewClass().getAUse()
+
+➤ `See this in the query console on LGTM.com <https://lgtm.com/query/288293322319747121/>`__.
+
+Note the use of the set literal ``["View", "MethodView"]`` to match both classes simultaneously.
+
+Built-in functions and classes
+------------------------------
+
+You can access built-in functions and classes using the ``API::builtin`` method, giving the name of
+the built-in as an argument.
+
+For example, to find all calls to the built-in ``open`` function, you can use the following snippet.
+
+.. code-block:: ql
+
+    import python
+    import semmle.python.ApiGraphs
+
+    select API::builtin("open").getACall()
+
+
+
+
+Further reading
+---------------
+
+
+.. include:: ../reusables/python-further-reading.rst
+.. include:: ../reusables/codeql-ref-tools-further-reading.rst
diff --git a/docs/codeql/ql-language-reference/annotations.rst b/docs/codeql/ql-language-reference/annotations.rst
index b3dabb42bfb..ec60e55bf9b 100644
--- a/docs/codeql/ql-language-reference/annotations.rst
+++ b/docs/codeql/ql-language-reference/annotations.rst
@@ -385,21 +385,23 @@ For more information, see ":ref:`monotonic-aggregates`."
 Binding sets
 ============
 
-**Available for**: |characteristic predicates|, |member predicates|, |non-member predicates|
+**Available for**: |classes|, |characteristic predicates|, |member predicates|, |non-member predicates|
 
 ``bindingset[...]``
 -------------------
 
-You can use this annotation to explicitly state the binding sets for a predicate. A binding set
-is a subset of the predicate's arguments such that, if those arguments are constrained to a
-finite set of values, then the predicate itself is finite (that is, it evaluates to a finite 
+You can use this annotation to explicitly state the binding sets for a predicate or class. A binding set
+is a subset of a predicate's or class body's arguments such that, if those arguments are constrained to a
+finite set of values, then the predicate or class itself is finite (that is, it evaluates to a finite 
 set of tuples).
 
-The ``bindingset`` annotation takes a comma-separated list of variables. Each variable must be
-an argument of the predicate, possibly including ``this`` (for characteristic predicates and 
-member predicates) and ``result`` (for predicates that return a result).
+The ``bindingset`` annotation takes a comma-separated list of variables.
 
-For more information, see ":ref:`predicate-binding`."
+- When you annotate a predicate, each variable must be an argument of the predicate, possibly including ``this``
+  (for characteristic predicates and member predicates) and ``result`` (for predicates that return a result). 
+  For more information, see ":ref:`predicate-binding`."
+- When you annotate a class, each variable must be ``this`` or a field in the class. 
+  Binding sets for classes are supported from release 2.3.0 of the CodeQL CLI, and release 1.26 of LGTM Enterprise.
 
 .. Links to use in substitutions
 
diff --git a/docs/codeql/support/conf.py b/docs/codeql/support/conf.py
index 45a8456ce9a..3d2f5d6cf81 100644
--- a/docs/codeql/support/conf.py
+++ b/docs/codeql/support/conf.py
@@ -16,7 +16,7 @@
 
 ##############################################################################
 #
-# Modified 22052019. 
+# Modified 22032021. 
 
 # The configuration values below are specific to the supported languages and frameworks project
 # To amend html_theme_options, update version/release number, or add more sphinx extensions,
@@ -41,9 +41,9 @@ project = u'Supported languages and frameworks for LGTM Enterprise'
 
 # The version info for this project, if different from version and release in main conf.py file.
 # The short X.Y version.
-version = u'1.26'
+version = u'1.27'
 # The full version, including alpha/beta/rc tags.
-release = u'1.26'
+release = u'1.27'
 
 # -- Project-specifc options for HTML output ----------------------------------------------
 
@@ -95,4 +95,4 @@ html_favicon = '../images/site/favicon.ico'
 
 # List of patterns, relative to source directory, that match files and
 # directories to ignore when looking for source files.
-exclude_patterns = ['read-me-project.rst', 'reusables/*']
\ No newline at end of file
+exclude_patterns = ['read-me-project.rst', 'reusables/*']
diff --git a/docs/codeql/support/framework-support.rst b/docs/codeql/support/framework-support.rst
index 37d54829475..d04293adfe5 100644
--- a/docs/codeql/support/framework-support.rst
+++ b/docs/codeql/support/framework-support.rst
@@ -10,6 +10,4 @@ The libraries and queries in version |version| have been explicitly checked agai
     If you're interested in other libraries or frameworks, you can extend the analysis to cover them. 
     For example, by extending the data flow libraries to include data sources and sinks for additional libraries or frameworks.
 
-.. There is currently no built-in support for libraries or frameworks for C/C++.
-
 .. include:: reusables/frameworks.rst
diff --git a/docs/codeql/support/reusables/frameworks.rst b/docs/codeql/support/reusables/frameworks.rst
index 3963d82fcec..22569cbdcc6 100644
--- a/docs/codeql/support/reusables/frameworks.rst
+++ b/docs/codeql/support/reusables/frameworks.rst
@@ -1,4 +1,15 @@
-.. There is currently no built-in support for libraries or frameworks for C/C++.
+C and C++ built-in support
+================================
+
+.. csv-table:: 
+   :header-rows: 1
+   :class: fullWidthTable
+   :widths: auto
+
+   Name, Category
+   `Bloomberg Standard Library <https://github.com/bloomberg/bde>`__, Utility library
+   `Berkeley socket API library <https://en.wikipedia.org/wiki/Berkeley_sockets#Socket_API_functions>`__, Network communicator
+   string.h, String library
 
 C# built-in support
 ================================
@@ -78,6 +89,9 @@ Java built-in support
    :widths: auto
 
    Name, Category
+   Apache Commons Lang, Utility library
+   Apache HTTP components, Network communicator
+   Guava, Utility and collections library
    Hibernate, Database
    iBatis / MyBatis, Database
    Java Persistence API (JPA), Database
@@ -126,7 +140,6 @@ JavaScript and TypeScript built-in support
    vue, HTML framework
 
 
-
 Python built-in support
 ====================================
 
diff --git a/docs/codeql/support/reusables/versions-compilers.rst b/docs/codeql/support/reusables/versions-compilers.rst
index 39e30bbc7cb..ff49b01a441 100644
--- a/docs/codeql/support/reusables/versions-compilers.rst
+++ b/docs/codeql/support/reusables/versions-compilers.rst
@@ -11,10 +11,12 @@
    Microsoft extensions (up to VS 2019),
 
    Arm Compiler 5 [2]_","``.cpp``, ``.c++``, ``.cxx``, ``.hpp``, ``.hh``, ``.h++``, ``.hxx``, ``.c``, ``.cc``, ``.h``"
-   C#,C# up to 8.0,"Microsoft Visual Studio up to 2019 with .NET up to 4.8,
+   C#,C# up to 9.0,"Microsoft Visual Studio up to 2019 with .NET up to 4.8,
 
-   .NET Core up to 3.1","``.sln``, ``.csproj``, ``.cs``, ``.cshtml``, ``.xaml``"
-   Go (aka Golang), "Go up to 1.15", "Go 1.11 or more recent", ``.go``
+   .NET Core up to 3.1
+
+   .NET 5","``.sln``, ``.csproj``, ``.cs``, ``.cshtml``, ``.xaml``"
+   Go (aka Golang), "Go up to 1.16", "Go 1.11 or more recent", ``.go``
    Java,"Java 7 to 15 [3]_","javac (OpenJDK and Oracle JDK),
 
    Eclipse compiler for Java (ECJ) [4]_",``.java``
@@ -28,5 +30,5 @@
     .. [2] Support for the Arm Compiler (armcc) is preliminary.
     .. [3] Builds that execute on Java 7 to 15 can be analyzed. The analysis understands Java 15 standard language features.
     .. [4] ECJ is supported when the build invokes it via the Maven Compiler plugin or the Takari Lifecycle plugin.
-    .. [5] JSX and Flow code, YAML, JSON, HTML, and XML files may also be analyzed with JavaScript files. 
-    .. [6] TypeScript analysis is performed by running the JavaScript extractor with TypeScript enabled. This is the default for LGTM.   
+    .. [5] JSX and Flow code, YAML, JSON, HTML, and XML files may also be analyzed with JavaScript files.
+    .. [6] TypeScript analysis is performed by running the JavaScript extractor with TypeScript enabled. This is the default for LGTM.
diff --git a/docs/codeql/writing-codeql-queries/creating-path-queries.rst b/docs/codeql/writing-codeql-queries/creating-path-queries.rst
index 11d72b8baf1..60723f488e1 100644
--- a/docs/codeql/writing-codeql-queries/creating-path-queries.rst
+++ b/docs/codeql/writing-codeql-queries/creating-path-queries.rst
@@ -55,10 +55,12 @@ You should use the following template:
      */
 
     import <language>
+    // For some languages (Java/C++/Python) you need to explicitly import the data flow library, such as
+    // import semmle.code.java.dataflow.DataFlow
     import DataFlow::PathGraph
     ...
 
-    from Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink
+    from MyConfiguration config, DataFlow::PathNode source, DataFlow::PathNode sink
     where config.hasFlowPath(source, sink)
     select sink.getNode(), source, sink, "<message>"
 
@@ -66,7 +68,7 @@ Where:
 
 - ``DataFlow::Pathgraph`` is the path graph module you need to import from the standard CodeQL libraries.
 - ``source`` and ``sink`` are nodes on the `path graph <https://en.wikipedia.org/wiki/Path_graph>`__, and ``DataFlow::PathNode`` is their type.
-- ``Configuration`` is a class containing the predicates which define how data may flow between the ``source`` and the ``sink``.
+- ``MyConfiguration`` is a class containing the predicates which define how data may flow between the ``source`` and the ``sink``.
 
 
 The following sections describe the main requirements for a valid path query.
diff --git a/docs/ql-libraries/dataflow/dataflow.md b/docs/ql-libraries/dataflow/dataflow.md
index 46ba27acccf..ea3379f3967 100644
--- a/docs/ql-libraries/dataflow/dataflow.md
+++ b/docs/ql-libraries/dataflow/dataflow.md
@@ -98,10 +98,6 @@ Recommendations:
   also work, but the upside of `use-use` steps is that sources defined in terms
   of variable reads just work out of the box. It also makes certain
   barrier-implementations simpler.
-* A predicate `DataFlowCallable Node::getEnclosingCallable()` is required, and in
-  order to ensure appropriate join-orders, it is important that the QL compiler knows
-  that this predicate is functional. It can therefore be necessary to enclose the body
-  of this predicate in a `unique` aggregate.
 
 The shared library does not use `localFlowStep` nor `localFlow` but users of
 `DataFlow.qll` may expect the existence of `DataFlow::localFlowStep` and
@@ -186,6 +182,45 @@ values, for example through `out` parameters in C#, the `ReturnKind` class can
 be defined and used to match up different kinds of `ReturnNode`s with the
 corresponding `OutNode`s.
 
+#### First-class functions
+
+For calls to first-class functions, the library supports built-in call resolution based on data flow between a function creation expression and a call. The interface that needs to be implemented is
+
+```ql
+class LambdaCallKind
+
+/** Holds if `creation` is an expression that creates a lambda of kind `kind` for `c`. */
+predicate lambdaCreation(Node creation, LambdaCallKind kind, DataFlowCallable c)
+
+/** Holds if `call` is a lambda call of kind `kind` where `receiver` is the lambda expression. */
+predicate lambdaCall(DataFlowCall call, LambdaCallKind kind, Node receiver)
+
+/** Extra data-flow steps needed for lambda flow analysis. */
+predicate additionalLambdaFlowStep(Node nodeFrom, Node nodeTo, boolean preservesValue)
+```
+
+with the semantics that `call` will resolve to `c` if there is a data-flow path from `creation` to `receiver`, with matching `kind`s.
+
+The implementation keeps track of a one-level call context, which means that we are able to handle situations like this:
+```csharp
+Apply(f, x) { f(x); }
+
+Apply(x => NonSink(x), "tainted"); // GOOD
+
+Apply(x => Sink(x), "not tainted"); // GOOD
+```
+
+However, since we only track one level the following example will have false-positive flow:
+```csharp
+Apply(f, x) { f(x); }
+
+ApplyWrapper(f, x) { Apply(f, x) }
+
+ApplyWrapper(x => NonSink(x), "tainted"); // GOOD (FALSE POSITIVE)
+
+ApplyWrapper(x => Sink(x), "not tainted"); // GOOD (FALSE POSITIVE)
+```
+
 ## Flow through global variables
 
 Flow through global variables are called jump-steps, since such flow steps
diff --git a/java/change-notes/2021-03-25-remove-legacy-code-duplication-library.md b/java/change-notes/2021-03-25-remove-legacy-code-duplication-library.md
new file mode 100644
index 00000000000..2a4ac2033ea
--- /dev/null
+++ b/java/change-notes/2021-03-25-remove-legacy-code-duplication-library.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* The legacy code duplication library has been removed.
diff --git a/java/change-notes/2021-03-25-remove-legacy-filter-queries.md b/java/change-notes/2021-03-25-remove-legacy-filter-queries.md
new file mode 100644
index 00000000000..e3e4b9b4b1e
--- /dev/null
+++ b/java/change-notes/2021-03-25-remove-legacy-filter-queries.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* Legacy filter queries have been removed.
diff --git a/java/change-notes/2021-04-14-membertype.md b/java/change-notes/2021-04-14-membertype.md
new file mode 100644
index 00000000000..910a5c91423
--- /dev/null
+++ b/java/change-notes/2021-04-14-membertype.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* A CodeQL class `MemberType` is introduced to describe nested classes. Its `getQualifiedName` method returns `$`-delimited nested type names (for example, `mypackage.Outer$Middle$Inner`), where previously the same type would be named differently depending on whether it was addressed as a `NestedType` or a `Member`.
diff --git a/java/ql/src/Likely Bugs/Likely Typos/StringBufferCharInit.ql b/java/ql/src/Likely Bugs/Likely Typos/StringBufferCharInit.ql
index c410c7745ee..d565c5bb7ad 100644
--- a/java/ql/src/Likely Bugs/Likely Typos/StringBufferCharInit.ql	
+++ b/java/ql/src/Likely Bugs/Likely Typos/StringBufferCharInit.ql	
@@ -13,12 +13,7 @@
 import java
 
 class NewStringBufferOrBuilder extends ClassInstanceExpr {
-  NewStringBufferOrBuilder() {
-    exists(Class c | c = this.getConstructedType() |
-      c.hasQualifiedName("java.lang", "StringBuilder") or
-      c.hasQualifiedName("java.lang", "StringBuffer")
-    )
-  }
+  NewStringBufferOrBuilder() { getConstructedType() instanceof StringBuildingType }
 
   string getName() { result = this.getConstructedType().getName() }
 }
diff --git a/java/ql/src/Metrics/Dependencies/ExternalDependencies.ql b/java/ql/src/Metrics/Dependencies/ExternalDependencies.ql
index 79fd9db7557..f3cb1b5ce9a 100644
--- a/java/ql/src/Metrics/Dependencies/ExternalDependencies.ql
+++ b/java/ql/src/Metrics/Dependencies/ExternalDependencies.ql
@@ -5,7 +5,6 @@
  * @kind treemap
  * @treemap.warnOn highValues
  * @metricType externalDependency
- * @precision medium
  * @id java/external-dependencies
  */
 
diff --git a/java/ql/src/Metrics/Files/FLinesOfCode.ql b/java/ql/src/Metrics/Files/FLinesOfCode.ql
index 45bea0faf4c..5c8436a18d8 100644
--- a/java/ql/src/Metrics/Files/FLinesOfCode.ql
+++ b/java/ql/src/Metrics/Files/FLinesOfCode.ql
@@ -5,7 +5,6 @@
  * @treemap.warnOn highValues
  * @metricType file
  * @metricAggregate avg sum max
- * @precision very-high
  * @id java/lines-of-code-in-files
  * @tags maintainability
  *       complexity
diff --git a/java/ql/src/Metrics/Files/FLinesOfComment.ql b/java/ql/src/Metrics/Files/FLinesOfComment.ql
index ee2c21f0d9f..da9560516a3 100644
--- a/java/ql/src/Metrics/Files/FLinesOfComment.ql
+++ b/java/ql/src/Metrics/Files/FLinesOfComment.ql
@@ -5,7 +5,6 @@
  * @treemap.warnOn lowValues
  * @metricType file
  * @metricAggregate avg sum max
- * @precision very-high
  * @id java/lines-of-comments-in-files
  * @tags maintainability
  *       documentation
diff --git a/java/ql/src/Metrics/Files/FLinesOfCommentedCode.ql b/java/ql/src/Metrics/Files/FLinesOfCommentedCode.ql
index d6fd316a2d9..62054ccfb87 100644
--- a/java/ql/src/Metrics/Files/FLinesOfCommentedCode.ql
+++ b/java/ql/src/Metrics/Files/FLinesOfCommentedCode.ql
@@ -5,7 +5,6 @@
  * @treemap.warnOn highValues
  * @metricType file
  * @metricAggregate avg sum max
- * @precision high
  * @id java/lines-of-commented-out-code-in-files
  * @tags maintainability
  *       documentation
diff --git a/java/ql/src/Metrics/Files/FLinesOfDuplicatedCode.ql b/java/ql/src/Metrics/Files/FLinesOfDuplicatedCode.ql
index f6e99fa6b4b..89277750efb 100644
--- a/java/ql/src/Metrics/Files/FLinesOfDuplicatedCode.ql
+++ b/java/ql/src/Metrics/Files/FLinesOfDuplicatedCode.ql
@@ -7,21 +7,13 @@
  * @treemap.warnOn highValues
  * @metricType file
  * @metricAggregate avg sum max
- * @precision high
  * @id java/duplicated-lines-in-files
  * @tags testability
  *       modularity
  */
 
-import external.CodeDuplication
+import java
 
 from File f, int n
-where
-  n =
-    count(int line |
-      exists(DuplicateBlock d | d.sourceFile() = f |
-        line in [d.sourceStartLine() .. d.sourceEndLine()] and
-        not whitelistedLineForDuplication(f, line)
-      )
-    )
+where none()
 select f, n order by n desc
diff --git a/java/ql/src/Metrics/Files/FLinesOfSimilarCode.ql b/java/ql/src/Metrics/Files/FLinesOfSimilarCode.ql
index f7de197055f..a15d673612a 100644
--- a/java/ql/src/Metrics/Files/FLinesOfSimilarCode.ql
+++ b/java/ql/src/Metrics/Files/FLinesOfSimilarCode.ql
@@ -11,15 +11,8 @@
  * @tags testability
  */
 
-import external.CodeDuplication
+import java
 
 from File f, int n
-where
-  n =
-    count(int line |
-      exists(SimilarBlock d | d.sourceFile() = f |
-        line in [d.sourceStartLine() .. d.sourceEndLine()] and
-        not whitelistedLineForDuplication(f, line)
-      )
-    )
+where none()
 select f, n order by n desc
diff --git a/java/ql/src/Metrics/Files/FNumberOfTests.ql b/java/ql/src/Metrics/Files/FNumberOfTests.ql
index dc9ed989ef8..c37a4f88298 100644
--- a/java/ql/src/Metrics/Files/FNumberOfTests.ql
+++ b/java/ql/src/Metrics/Files/FNumberOfTests.ql
@@ -5,7 +5,6 @@
  * @treemap.warnOn lowValues
  * @metricType file
  * @metricAggregate avg sum max
- * @precision medium
  * @id java/tests-in-files
  * @tags maintainability
  */
diff --git a/java/ql/src/Performance/InnerClassCouldBeStatic.ql b/java/ql/src/Performance/InnerClassCouldBeStatic.ql
index a18d801549d..5dba77761c6 100644
--- a/java/ql/src/Performance/InnerClassCouldBeStatic.ql
+++ b/java/ql/src/Performance/InnerClassCouldBeStatic.ql
@@ -100,8 +100,7 @@ predicate potentiallyStatic(InnerClass c) {
     m = a.getEnclosingCallable() and
     m.getDeclaringType() = c
   ) and
-  not c instanceof AnonymousClass and
-  not c instanceof LocalClass and
+  c instanceof MemberType and
   forall(
     InnerClass other // If nested and non-static, ...
   |
diff --git a/java/ql/src/Security/CWE/CWE-209/StackTraceExposure.ql b/java/ql/src/Security/CWE/CWE-209/StackTraceExposure.ql
index c9c1e2917c0..3426d9f6f62 100644
--- a/java/ql/src/Security/CWE/CWE-209/StackTraceExposure.ql
+++ b/java/ql/src/Security/CWE/CWE-209/StackTraceExposure.ql
@@ -79,8 +79,7 @@ predicate stackTraceExpr(Expr exception, MethodAccess stackTraceString) {
     printStackCall.getAnArgument() = printWriter and
     printStackCall.getQualifier() = exception and
     stackTraceString.getQualifier() = stringWriterVar.getAnAccess() and
-    stackTraceString.getMethod().getName() = "toString" and
-    stackTraceString.getMethod().getNumberOfParameters() = 0
+    stackTraceString.getMethod() instanceof ToStringMethod
   )
 }
 
diff --git a/java/ql/src/Security/CWE/CWE-327/MaybeBrokenCryptoAlgorithm.ql b/java/ql/src/Security/CWE/CWE-327/MaybeBrokenCryptoAlgorithm.ql
index efcd01548d8..7b026efb7ae 100644
--- a/java/ql/src/Security/CWE/CWE-327/MaybeBrokenCryptoAlgorithm.ql
+++ b/java/ql/src/Security/CWE/CWE-327/MaybeBrokenCryptoAlgorithm.ql
@@ -33,9 +33,8 @@ class InsecureAlgoLiteral extends ShortStringLiteral {
 }
 
 predicate objectToString(MethodAccess ma) {
-  exists(Method m |
+  exists(ToStringMethod m |
     m = ma.getMethod() and
-    m.hasName("toString") and
     m.getDeclaringType() instanceof TypeObject and
     variableTrack(ma.getQualifier()).getType().getErasure() instanceof TypeObject
   )
@@ -44,8 +43,7 @@ predicate objectToString(MethodAccess ma) {
 class StringContainer extends RefType {
   StringContainer() {
     this instanceof TypeString or
-    this.hasQualifiedName("java.lang", "StringBuilder") or
-    this.hasQualifiedName("java.lang", "StringBuffer") or
+    this instanceof StringBuildingType or
     this.hasQualifiedName("java.util", "StringTokenizer") or
     this.(Array).getComponentType() instanceof StringContainer
   }
diff --git a/java/ql/src/Security/CWE/CWE-798/HardcodedCredentialsApiCall.ql b/java/ql/src/Security/CWE/CWE-798/HardcodedCredentialsApiCall.ql
index 4fb3f14c993..c76527bc538 100644
--- a/java/ql/src/Security/CWE/CWE-798/HardcodedCredentialsApiCall.ql
+++ b/java/ql/src/Security/CWE/CWE-798/HardcodedCredentialsApiCall.ql
@@ -19,14 +19,14 @@ class HardcodedCredentialApiCallConfiguration extends DataFlow::Configuration {
 
   override predicate isSource(DataFlow::Node n) {
     n.asExpr() instanceof HardcodedExpr and
-    not n.asExpr().getEnclosingCallable().getName() = "toString"
+    not n.asExpr().getEnclosingCallable() instanceof ToStringMethod
   }
 
   override predicate isSink(DataFlow::Node n) { n.asExpr() instanceof CredentialsApiSink }
 
   override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
     node1.asExpr().getType() instanceof TypeString and
-    exists(MethodAccess ma | ma.getMethod().getName().regexpMatch("getBytes|toCharArray") |
+    exists(MethodAccess ma | ma.getMethod().hasName(["getBytes", "toCharArray"]) |
       node2.asExpr() = ma and
       ma.getQualifier() = node1.asExpr()
     )
diff --git a/java/ql/src/Violations of Best Practice/Undesirable Calls/CallsToStringToString.ql b/java/ql/src/Violations of Best Practice/Undesirable Calls/CallsToStringToString.ql
index 40a4e36d70c..c1395669405 100644
--- a/java/ql/src/Violations of Best Practice/Undesirable Calls/CallsToStringToString.ql	
+++ b/java/ql/src/Violations of Best Practice/Undesirable Calls/CallsToStringToString.ql	
@@ -10,9 +10,8 @@
 
 import java
 
-from MethodAccess ma, Method tostring
+from MethodAccess ma, ToStringMethod tostring
 where
-  tostring.hasName("toString") and
   tostring.getDeclaringType() instanceof TypeString and
   ma.getMethod() = tostring
 select ma, "Redundant call to 'toString' on a String object."
diff --git a/java/ql/src/Violations of Best Practice/Undesirable Calls/DefaultToString.ql b/java/ql/src/Violations of Best Practice/Undesirable Calls/DefaultToString.ql
index 7d9ef5b85f9..c6eaf5af2cb 100644
--- a/java/ql/src/Violations of Best Practice/Undesirable Calls/DefaultToString.ql	
+++ b/java/ql/src/Violations of Best Practice/Undesirable Calls/DefaultToString.ql	
@@ -14,20 +14,13 @@ import java
 import semmle.code.java.StringFormat
 
 predicate explicitToStringCall(Expr e) {
-  exists(MethodAccess ma, Method toString | toString = ma.getMethod() |
-    e = ma.getQualifier() and
-    toString.getName() = "toString" and
-    toString.getNumberOfParameters() = 0 and
-    not toString.isStatic()
+  exists(MethodAccess ma |
+    ma.getMethod() instanceof ToStringMethod and
+    e = ma.getQualifier()
   )
 }
 
-predicate directlyDeclaresToString(Class c) {
-  exists(Method m | m.getDeclaringType() = c |
-    m.getName() = "toString" and
-    m.getNumberOfParameters() = 0
-  )
-}
+predicate directlyDeclaresToString(Class c) { any(ToStringMethod m).getDeclaringType() = c }
 
 predicate inheritsObjectToString(Class t) {
   not directlyDeclaresToString(t.getSourceDeclaration()) and
diff --git a/java/ql/src/experimental/Security/CWE/CWE-016/InsecureSpringActuatorConfig.qhelp b/java/ql/src/experimental/Security/CWE/CWE-016/InsecureSpringActuatorConfig.qhelp
new file mode 100644
index 00000000000..e201156728a
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-016/InsecureSpringActuatorConfig.qhelp
@@ -0,0 +1,47 @@
+<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
+<qhelp>
+  <overview>
+    <p>Spring Boot is a popular framework that facilitates the development of stand-alone applications
+and micro services. Spring Boot Actuator helps to expose production-ready support features against 
+Spring Boot applications.</p>
+
+    <p>Endpoints of Spring Boot Actuator allow to monitor and interact with a Spring Boot application. 
+Exposing unprotected actuator endpoints through configuration files can lead to information disclosure 
+or even remote code execution vulnerability.</p>
+
+    <p>Rather than programmatically permitting endpoint requests or enforcing access control, frequently
+developers simply leave management endpoints publicly accessible in the application configuration file 
+<code>application.properties</code> without enforcing access control through Spring Security.</p>
+  </overview>
+
+  <recommendation>
+    <p>Declare the Spring Boot Starter Security module in XML configuration or programmatically enforce 
+security checks on management endpoints using Spring Security. Otherwise accessing management endpoints 
+on a different HTTP port other than the port that the web application is listening on also helps to 
+improve the security.</p>
+  </recommendation>
+
+  <example>
+    <p>The following examples show both 'BAD' and 'GOOD' configurations. In the 'BAD' configuration, 
+no security module is declared and sensitive management endpoints are exposed. In the 'GOOD' configuration, 
+security is enforced and only endpoints requiring exposure are exposed.</p>
+    <sample src="pom_good.xml" />
+    <sample src="pom_bad.xml" />
+    <sample src="application.properties" />
+  </example>
+
+  <references>
+    <li>
+      Spring Boot documentation:
+      <a href="https://docs.spring.io/spring-boot/docs/current/reference/html/production-ready-features.html">Spring Boot Actuator: Production-ready Features</a>
+    </li>
+    <li>
+      VERACODE Blog:
+      <a href="https://www.veracode.com/blog/research/exploiting-spring-boot-actuators">Exploiting Spring Boot Actuators</a>
+    </li>
+    <li>
+      HackerOne Report:
+      <a href="https://hackerone.com/reports/862589">Spring Actuator endpoints publicly available, leading to account takeover</a>
+    </li>
+  </references>
+</qhelp>
diff --git a/java/ql/src/experimental/Security/CWE/CWE-016/InsecureSpringActuatorConfig.ql b/java/ql/src/experimental/Security/CWE/CWE-016/InsecureSpringActuatorConfig.ql
new file mode 100644
index 00000000000..e6965959d13
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-016/InsecureSpringActuatorConfig.ql
@@ -0,0 +1,116 @@
+/**
+ * @name Insecure Spring Boot Actuator Configuration
+ * @description Exposed Spring Boot Actuator through configuration files without declarative or procedural
+ *              security enforcement leads to information leak or even remote code execution.
+ * @kind problem
+ * @id java/insecure-spring-actuator-config
+ * @tags security
+ *       external/cwe-016
+ */
+
+/*
+ * Note this query requires properties files to be indexed before it can produce results.
+ * If creating your own database with the CodeQL CLI, you should run
+ * `codeql database index-files --language=properties ...`
+ * If using lgtm.com, you should add `properties_files: true` to the index block of your
+ * lgtm.yml file (see https://lgtm.com/help/lgtm/java-extraction)
+ */
+
+import java
+import semmle.code.configfiles.ConfigFiles
+import semmle.code.xml.MavenPom
+
+/** The parent node of the `org.springframework.boot` group. */
+class SpringBootParent extends Parent {
+  SpringBootParent() { this.getGroup().getValue() = "org.springframework.boot" }
+}
+
+/** Class of Spring Boot dependencies. */
+class SpringBootPom extends Pom {
+  SpringBootPom() { this.getParentElement() instanceof SpringBootParent }
+
+  /** Holds if the Spring Boot Actuator module `spring-boot-starter-actuator` is used in the project. */
+  predicate isSpringBootActuatorUsed() {
+    this.getADependency().getArtifact().getValue() = "spring-boot-starter-actuator"
+  }
+
+  /**
+   * Holds if the Spring Boot Security module is used in the project, which brings in other security
+   * related libraries.
+   */
+  predicate isSpringBootSecurityUsed() {
+    this.getADependency().getArtifact().getValue() = "spring-boot-starter-security"
+  }
+}
+
+/** The properties file `application.properties`. */
+class ApplicationProperties extends ConfigPair {
+  ApplicationProperties() { this.getFile().getBaseName() = "application.properties" }
+}
+
+/** The configuration property `management.security.enabled`. */
+class ManagementSecurityConfig extends ApplicationProperties {
+  ManagementSecurityConfig() { this.getNameElement().getName() = "management.security.enabled" }
+
+  /** Gets the whitespace-trimmed value of this property. */
+  string getValue() { result = this.getValueElement().getValue().trim() }
+
+  /** Holds if `management.security.enabled` is set to `false`. */
+  predicate hasSecurityDisabled() { getValue() = "false" }
+
+  /** Holds if `management.security.enabled` is set to `true`. */
+  predicate hasSecurityEnabled() { getValue() = "true" }
+}
+
+/** The configuration property `management.endpoints.web.exposure.include`. */
+class ManagementEndPointInclude extends ApplicationProperties {
+  ManagementEndPointInclude() {
+    this.getNameElement().getName() = "management.endpoints.web.exposure.include"
+  }
+
+  /** Gets the whitespace-trimmed value of this property. */
+  string getValue() { result = this.getValueElement().getValue().trim() }
+}
+
+/**
+ * Holds if `ApplicationProperties` ap of a repository managed by `SpringBootPom` pom
+ * has a vulnerable configuration of Spring Boot Actuator management endpoints.
+ */
+predicate hasConfidentialEndPointExposed(SpringBootPom pom, ApplicationProperties ap) {
+  pom.isSpringBootActuatorUsed() and
+  not pom.isSpringBootSecurityUsed() and
+  ap.getFile()
+      .getParentContainer()
+      .getAbsolutePath()
+      .matches(pom.getFile().getParentContainer().getAbsolutePath() + "%") and // in the same sub-directory
+  exists(string springBootVersion | springBootVersion = pom.getParentElement().getVersionString() |
+    springBootVersion.regexpMatch("1\\.[0-4].*") and // version 1.0, 1.1, ..., 1.4
+    not exists(ManagementSecurityConfig me |
+      me.hasSecurityEnabled() and me.getFile() = ap.getFile()
+    )
+    or
+    springBootVersion.matches("1.5%") and // version 1.5
+    exists(ManagementSecurityConfig me | me.hasSecurityDisabled() and me.getFile() = ap.getFile())
+    or
+    springBootVersion.matches("2.%") and //version 2.x
+    exists(ManagementEndPointInclude mi |
+      mi.getFile() = ap.getFile() and
+      (
+        mi.getValue() = "*" // all endpoints are enabled
+        or
+        mi.getValue()
+            .matches([
+                "%dump%", "%trace%", "%logfile%", "%shutdown%", "%startup%", "%mappings%", "%env%",
+                "%beans%", "%sessions%"
+              ]) // confidential endpoints to check although all endpoints apart from '/health' and '/info' are considered sensitive by Spring
+      )
+    )
+  )
+}
+
+from SpringBootPom pom, ApplicationProperties ap, Dependency d
+where
+  hasConfidentialEndPointExposed(pom, ap) and
+  d = pom.getADependency() and
+  d.getArtifact().getValue() = "spring-boot-starter-actuator"
+select d, "Insecure configuration of Spring Boot Actuator exposes sensitive endpoints."
diff --git a/java/ql/src/experimental/Security/CWE/CWE-016/application.properties b/java/ql/src/experimental/Security/CWE/CWE-016/application.properties
new file mode 100644
index 00000000000..4f5defdd948
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-016/application.properties
@@ -0,0 +1,22 @@
+#management.endpoints.web.base-path=/admin
+
+
+#### BAD: All management endpoints are accessible #### 
+# vulnerable configuration (spring boot 1.0 - 1.4): exposes actuators by default
+
+# vulnerable configuration (spring boot 1.5+): requires value false to expose sensitive actuators
+management.security.enabled=false
+
+# vulnerable configuration (spring boot 2+): exposes health and info only by default, here overridden to expose everything
+management.endpoints.web.exposure.include=*
+
+
+#### GOOD: All management endpoints have access control #### 
+# safe configuration (spring boot 1.0 - 1.4): exposes actuators by default
+management.security.enabled=true
+
+# safe configuration (spring boot 1.5+): requires value false to expose sensitive actuators
+management.security.enabled=true
+
+# safe configuration (spring boot 2+): exposes health and info only by default, here overridden to expose one additional endpoint which we assume is intentional and safe.
+management.endpoints.web.exposure.include=beans,info,health
diff --git a/java/ql/src/experimental/Security/CWE/CWE-016/pom_bad.xml b/java/ql/src/experimental/Security/CWE/CWE-016/pom_bad.xml
new file mode 100644
index 00000000000..9dd5c9c188b
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-016/pom_bad.xml
@@ -0,0 +1,50 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+
+    <groupId>spring-boot-actuator-app</groupId>
+    <artifactId>spring-boot-actuator-app</artifactId>
+    <version>1.0-SNAPSHOT</version>
+
+    <properties>
+        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+        <maven.compiler.source>1.8</maven.compiler.source>
+        <maven.compiler.target>1.8</maven.compiler.target>
+    </properties>
+
+    <parent>
+        <groupId>org.springframework.boot</groupId>
+        <artifactId>spring-boot-starter-parent</artifactId>
+        <version>2.3.8.RELEASE</version>
+        <relativePath/>
+    </parent>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-web</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-actuator</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-devtools</artifactId>
+        </dependency>
+
+        <!-- BAD: No Spring Security enabled -->
+        <!-- dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-security</artifactId>
+        </dependency -->
+
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-test</artifactId>
+        </dependency>
+    </dependencies>
+
+</project>
\ No newline at end of file
diff --git a/java/ql/src/experimental/Security/CWE/CWE-016/pom_good.xml b/java/ql/src/experimental/Security/CWE/CWE-016/pom_good.xml
new file mode 100644
index 00000000000..89f577f21e5
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-016/pom_good.xml
@@ -0,0 +1,50 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+
+    <groupId>spring-boot-actuator-app</groupId>
+    <artifactId>spring-boot-actuator-app</artifactId>
+    <version>1.0-SNAPSHOT</version>
+
+    <properties>
+        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+        <maven.compiler.source>1.8</maven.compiler.source>
+        <maven.compiler.target>1.8</maven.compiler.target>
+    </properties>
+
+    <parent>
+        <groupId>org.springframework.boot</groupId>
+        <artifactId>spring-boot-starter-parent</artifactId>
+        <version>2.3.8.RELEASE</version>
+        <relativePath/>
+    </parent>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-web</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-actuator</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-devtools</artifactId>
+        </dependency>
+
+        <!-- GOOD: Enable Spring Security -->
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-security</artifactId>
+        </dependency>
+
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-test</artifactId>
+        </dependency>
+    </dependencies>
+
+</project>
\ No newline at end of file
diff --git a/java/ql/src/experimental/Security/CWE/CWE-036/OpenStream.ql b/java/ql/src/experimental/Security/CWE/CWE-036/OpenStream.ql
index 5835c3f17ef..871d6bb4737 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-036/OpenStream.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-036/OpenStream.ql
@@ -1,8 +1,13 @@
 /**
  * @name openStream called on URLs created from remote source
  * @description Calling openStream on URLs created from remote source
- * can lead to local file disclosure.
+ *              can lead to local file disclosure.
  * @kind path-problem
+ * @problem.severity warning
+ * @precision medium
+ * @id java/openstream-called-on-tainted-url
+ * @tags security
+ *       external/cwe/cwe-036
  */
 
 import java
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/FlowUtils.qll b/java/ql/src/experimental/Security/CWE/CWE-094/FlowUtils.qll
new file mode 100644
index 00000000000..5371c51aa8f
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/FlowUtils.qll
@@ -0,0 +1,14 @@
+import java
+import semmle.code.java.dataflow.FlowSources
+
+/**
+ * Holds if `fromNode` to `toNode` is a dataflow step that returns data from
+ * a bean by calling one of its getters.
+ */
+predicate hasGetterFlow(DataFlow::Node fromNode, DataFlow::Node toNode) {
+  exists(MethodAccess ma, Method m | ma.getMethod() = m |
+    m instanceof GetterMethod and
+    ma.getQualifier() = fromNode.asExpr() and
+    ma = toNode.asExpr()
+  )
+}
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjection.qhelp b/java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjection.qhelp
new file mode 100644
index 00000000000..9bf84f710dc
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjection.qhelp
@@ -0,0 +1,81 @@
+<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
+<qhelp>
+
+<overview>
+<p>
+Apache Groovy is a powerful, optionally typed and dynamic language, 
+with static-typing and static compilation capabilities.
+
+It integrates smoothly with any Java program, 
+and immediately delivers to your application powerful features, 
+including scripting capabilities, Domain-Specific Language authoring, 
+runtime and compile-time meta-programming and functional programming.
+
+If a Groovy script is built using attacker-controlled data, 
+and then evaluated, then it may allow the attacker to achieve RCE.
+</p>
+</overview>
+
+<recommendation>
+<p>
+It is generally recommended to avoid using untrusted input in a Groovy evaluation.
+If this is not possible, use a sandbox solution. Developers must also take care that Groovy
+compile-time metaprogramming can also lead to RCE: it is possible to achieve RCE by compiling
+a Groovy script (see the article "Abusing Meta Programming for Unauthenticated RCE!" linked below).
+
+Groovy's <code>SecureASTCustomizer</code> allows securing source code by controlling what code constructs are permitted. 
+This is typically done when using Groovy for its scripting or domain specific language (DSL) features.
+The fundamental problem is that Groovy is a dynamic language, yet <code>SecureASTCustomizer</code> works by looking at Groovy AST statically.
+
+This makes it very easy for an attacker to bypass many of the intended checks
+(see https://kohsuke.org/2012/04/27/groovy-secureastcustomizer-is-harmful/).
+Therefore, besides <code>SecureASTCustomizer</code>, runtime checks are also necessary before calling Groovy methods
+(see https://melix.github.io/blog/2015/03/sandboxing.html).
+
+It is also possible to use a block-list method, excluding unwanted classes from being loaded by the JVM. 
+This method is not always recommended, because block-lists can be bypassed by unexpected values.
+
+</p>
+</recommendation>
+
+<example>
+<p>
+The following example uses untrusted data to evaluate a Groovy script.
+</p>
+<sample src="GroovyInjectionBad.java" />
+
+<p>
+The following example uses classloader block-list approach to exclude loading dangerous classes.
+</p>
+<sample src="GroovyInjectionBlocklist.java" />
+
+</example>
+
+<references>
+<li>
+  Orange Tsai:
+  <a href="https://blog.orange.tw/2019/02/abusing-meta-programming-for-unauthenticated-rce.html">Abusing Meta Programming for Unauthenticated RCE!</a>.
+</li>
+<li>
+  Cédric Champeau:
+  <a href="https://melix.github.io/blog/2015/03/sandboxing.html">Improved sandboxing of Groovy scripts</a>.
+</li>
+<li>
+  Kohsuke Kawaguchi:
+  <a href="https://kohsuke.org/2012/04/27/groovy-secureastcustomizer-is-harmful/">Groovy SecureASTCustomizer is harmful</a>.
+</li>
+<li>
+  Welk1n:
+  <a href="https://github.com/welk1n/exploiting-groovy-in-Java/">Groovy Injection payloads</a>.
+</li>
+<li>
+  Charles Chan:
+  <a href="https://levelup.gitconnected.com/secure-groovy-script-execution-in-a-sandbox-ea39f80ee87/">Secure Groovy Script Execution in a Sandbox</a>.
+</li>
+<li>
+  Eugene:
+  <a href="https://stringconcat.com/en/scripting-and-sandboxing/">Scripting and sandboxing in a JVM environment</a>.
+</li>
+</references>
+
+</qhelp>
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjection.ql b/java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjection.ql
new file mode 100644
index 00000000000..0622c9cd7e3
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjection.ql
@@ -0,0 +1,20 @@
+/**
+ * @name Groovy Language injection
+ * @description Evaluation of a user-controlled Groovy script
+ *              may lead to arbitrary code execution.
+ * @kind path-problem
+ * @problem.severity error
+ * @precision high
+ * @id java/groovy-injection
+ * @tags security
+ *       external/cwe/cwe-094
+ */
+
+import java
+import DataFlow::PathGraph
+import GroovyInjectionLib
+
+from DataFlow::PathNode source, DataFlow::PathNode sink, GroovyInjectionConfig conf
+where conf.hasFlowPath(source, sink)
+select sink.getNode(), source, sink, "Groovy Injection from $@.", source.getNode(),
+  "this user input"
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjectionBad.java b/java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjectionBad.java
new file mode 100644
index 00000000000..8afe77d2a39
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjectionBad.java
@@ -0,0 +1,27 @@
+public class GroovyInjection {
+    void injectionViaClassLoader(HttpServletRequest request) {    
+        String script = request.getParameter("script");
+        final GroovyClassLoader classLoader = new GroovyClassLoader();
+        Class groovy = classLoader.parseClass(script);
+        GroovyObject groovyObj = (GroovyObject) groovy.newInstance();
+    }
+
+    void injectionViaEval(HttpServletRequest request) {
+        String script = request.getParameter("script");
+        Eval.me(script);
+    }
+
+    void injectionViaGroovyShell(HttpServletRequest request) {
+        GroovyShell shell = new GroovyShell();
+        String script = request.getParameter("script");
+        shell.evaluate(script);
+    }
+
+    void injectionViaGroovyShellGroovyCodeSource(HttpServletRequest request) {
+        GroovyShell shell = new GroovyShell();
+        String script = request.getParameter("script");
+        GroovyCodeSource gcs = new GroovyCodeSource(script, "test", "Test");
+        shell.evaluate(gcs);
+    }
+}
+
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjectionBlocklist.java b/java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjectionBlocklist.java
new file mode 100644
index 00000000000..61159a3137f
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjectionBlocklist.java
@@ -0,0 +1,17 @@
+public class SandboxGroovyClassLoader extends ClassLoader {
+    public SandboxGroovyClassLoader(ClassLoader parent) {
+        super(parent);
+    }
+
+    /* override `loadClass` here to prevent loading sensitive classes, such as `java.lang.Runtime`, `java.lang.ProcessBuilder`, `java.lang.System`, etc.  */
+    /* Note we must also block `groovy.transform.ASTTest`, `groovy.lang.GrabConfig` and `org.buildobjects.process.ProcBuilder` to prevent compile-time RCE. */
+
+    static void runWithSandboxGroovyClassLoader() throws Exception {
+        // GOOD: route all class-loading via sand-boxing classloader.
+        SandboxGroovyClassLoader classLoader = new GroovyClassLoader(new SandboxGroovyClassLoader());
+        
+        Class<?> scriptClass = classLoader.parseClass(untrusted.getQueryString());
+        Object scriptInstance = scriptClass.newInstance();
+        Object result = scriptClass.getDeclaredMethod("bar", new Class[]{}).invoke(scriptInstance, new Object[]{});
+    }
+}
\ No newline at end of file
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjectionLib.qll
new file mode 100644
index 00000000000..61ddb9b9a1a
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/GroovyInjectionLib.qll
@@ -0,0 +1,160 @@
+/**
+ * Provides classes and predicates for Groovy Code Injection
+ * taint-tracking configuration.
+ */
+
+import java
+import semmle.code.java.dataflow.FlowSources
+import semmle.code.java.dataflow.TaintTracking
+
+/** A data flow sink for Groovy expression injection vulnerabilities. */
+abstract private class GroovyInjectionSink extends DataFlow::ExprNode { }
+
+/**
+ * A taint-tracking configuration for unsafe user input
+ * that is used to evaluate a Groovy expression.
+ */
+class GroovyInjectionConfig extends TaintTracking::Configuration {
+  GroovyInjectionConfig() { this = "GroovyInjectionConfig" }
+
+  override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
+
+  override predicate isSink(DataFlow::Node sink) { sink instanceof GroovyInjectionSink }
+
+  override predicate isAdditionalTaintStep(DataFlow::Node fromNode, DataFlow::Node toNode) {
+    groovyCodeSourceTaintStep(fromNode, toNode)
+  }
+}
+
+/** The class `groovy.lang.GroovyShell`. */
+private class TypeGroovyShell extends RefType {
+  TypeGroovyShell() { this.hasQualifiedName("groovy.lang", "GroovyShell") }
+}
+
+/** The class `groovy.lang.GroovyCodeSource`. */
+private class TypeGroovyCodeSource extends RefType {
+  TypeGroovyCodeSource() { this.hasQualifiedName("groovy.lang", "GroovyCodeSource") }
+}
+
+/**
+ * Methods in the `GroovyShell` class that evaluate a Groovy expression.
+ */
+private class GroovyShellMethod extends Method {
+  GroovyShellMethod() {
+    this.getDeclaringType() instanceof TypeGroovyShell and
+    this.getName() in ["evaluate", "parse", "run"]
+  }
+}
+
+private class GroovyShellMethodAccess extends MethodAccess {
+  GroovyShellMethodAccess() { this.getMethod() instanceof GroovyShellMethod }
+}
+
+/**
+ * Holds if `fromNode` to `toNode` is a dataflow step from a tainted string to
+ * a `GroovyCodeSource` instance, i.e. `new GroovyCodeSource(tainted, ...)`.
+ */
+private predicate groovyCodeSourceTaintStep(DataFlow::Node fromNode, DataFlow::Node toNode) {
+  exists(ConstructorCall gcscc |
+    gcscc.getConstructedType() instanceof TypeGroovyCodeSource and
+    gcscc = toNode.asExpr() and
+    gcscc.getArgument(0) = fromNode.asExpr()
+  )
+}
+
+/**
+ * A sink for Groovy Injection via the `GroovyShell` class.
+ *
+ * ```
+ * GroovyShell gs = new GroovyShell();
+ * gs.evaluate(sink, ....)
+ * gs.run(sink, ....)
+ * gs.parse(sink,...)
+ * ```
+ */
+private class GroovyShellSink extends GroovyInjectionSink {
+  GroovyShellSink() {
+    exists(GroovyShellMethodAccess ma, Argument firstArg |
+      ma.getArgument(0) = firstArg and
+      firstArg = this.asExpr() and
+      (
+        firstArg.getType() instanceof TypeString or
+        firstArg.getType() instanceof TypeGroovyCodeSource
+      )
+    )
+  }
+}
+
+/** The class `groovy.util.Eval`. */
+private class TypeEval extends RefType {
+  TypeEval() { this.hasQualifiedName("groovy.util", "Eval") }
+}
+
+/**
+ * Methods in the `Eval` class that evaluate a Groovy expression.
+ */
+private class EvalMethod extends Method {
+  EvalMethod() {
+    this.getDeclaringType() instanceof TypeEval and
+    this.getName() in ["me", "x", "xy", "xyz"]
+  }
+}
+
+private class EvalMethodAccess extends MethodAccess {
+  EvalMethodAccess() { this.getMethod() instanceof EvalMethod }
+
+  Expr getArgumentExpr() { result = this.getArgument(this.getNumArgument() - 1) }
+}
+
+/**
+ * A sink for Groovy Injection via the `Eval` class.
+ *
+ * ```
+ * Eval.me(sink)
+ * Eval.me("p1", "p2", sink)
+ * Eval.x("p1", sink)
+ * Eval.xy("p1", "p2" sink)
+ * Eval.xyz("p1", "p2", "p3", sink)
+ * ```
+ */
+private class EvalSink extends GroovyInjectionSink {
+  EvalSink() { exists(EvalMethodAccess ma | ma.getArgumentExpr() = this.asExpr()) }
+}
+
+/** The class `groovy.lang.GroovyClassLoader`. */
+private class TypeGroovyClassLoader extends RefType {
+  TypeGroovyClassLoader() { this.hasQualifiedName("groovy.lang", "GroovyClassLoader") }
+}
+
+/**
+ * A method in the `GroovyClassLoader` class that evaluates a Groovy expression.
+ */
+private class GroovyClassLoaderParseClassMethod extends Method {
+  GroovyClassLoaderParseClassMethod() {
+    this.getDeclaringType() instanceof TypeGroovyClassLoader and
+    this.hasName("parseClass")
+  }
+}
+
+private class GroovyClassLoaderParseClassMethodAccess extends MethodAccess {
+  GroovyClassLoaderParseClassMethodAccess() {
+    this.getMethod() instanceof GroovyClassLoaderParseClassMethod
+  }
+}
+
+/**
+ * A sink for Groovy Injection via the `GroovyClassLoader` class.
+ *
+ * ```
+ * GroovyClassLoader classLoader = new GroovyClassLoader();
+ * Class groovy = classLoader.parseClass(script);
+ * ```
+ *
+ * Groovy supports compile-time metaprogramming, so just calling the `parseClass`
+ * method is enough to achieve RCE.
+ */
+private class GroovyClassLoadParseClassSink extends GroovyInjectionSink {
+  GroovyClassLoadParseClassSink() {
+    exists(GroovyClassLoaderParseClassMethodAccess ma | ma.getArgument(0) = this.asExpr())
+  }
+}
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoading.qhelp b/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoading.qhelp
new file mode 100644
index 00000000000..216bdeaebf3
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoading.qhelp
@@ -0,0 +1,42 @@
+<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
+<qhelp>
+  <overview>
+    <p>
+It is dangerous to load Dex libraries from shared world-writable storage spaces. A malicious actor can replace a dex file with a maliciously crafted file 
+which when loaded by the app can lead to code execution. 
+</p>
+  </overview>
+
+  <recommendation>
+    <p>
+      Loading a file from private storage instead of a world-writable one can prevent this issue,
+      because the attacker cannot access files stored there. 
+    </p>
+  </recommendation>
+
+  <example>
+    <p>
+      The following example loads a Dex file from a shared world-writable location. in this case, 
+      since the `/sdcard` directory is on external storage, anyone can read/write to the location. 
+      bypassing all Android security policies. Hence, this is insecure.
+    </p>
+    <sample src="InsecureDexLoadingBad.java" />
+
+    <p>
+    The next example loads a Dex file stored inside the app's private storage. 
+    This is not exploitable as nobody else except the app can access the data stored there.
+    </p>
+    <sample src="InsecureDexLoadingGood.java" />
+  </example>
+
+  <references>
+    <li>
+      Android Documentation:
+      <a href="https://developer.android.com/training/data-storage/">Data and file storage overview</a>.
+    </li>
+    <li>
+      Android Documentation:
+      <a href="https://developer.android.com/reference/dalvik/system/DexClassLoader">DexClassLoader</a>.
+    </li>
+  </references>
+</qhelp>
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoading.ql b/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoading.ql
new file mode 100644
index 00000000000..bae3ed63d70
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoading.ql
@@ -0,0 +1,20 @@
+/**
+ * @name Insecure loading of an Android Dex File
+ * @description Loading a DEX library located in a world-writable location such as
+ * an SD card can lead to arbitrary code execution vulnerabilities.
+ * @kind path-problem
+ * @problem.severity error
+ * @precision high
+ * @id java/android-insecure-dex-loading
+ * @tags security
+ *       external/cwe/cwe-094
+ */
+
+import java
+import InsecureDexLoading
+import DataFlow::PathGraph
+
+from DataFlow::PathNode source, DataFlow::PathNode sink, InsecureDexConfiguration conf
+where conf.hasFlowPath(source, sink)
+select sink.getNode(), source, sink, "Potential arbitrary code execution due to $@.",
+  source.getNode(), "a value loaded from a world-writable source."
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoading.qll b/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoading.qll
new file mode 100644
index 00000000000..0ee0954216e
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoading.qll
@@ -0,0 +1,100 @@
+import java
+import semmle.code.java.dataflow.FlowSources
+
+/**
+ * A taint-tracking configuration detecting unsafe use of a
+ * `DexClassLoader` by an Android app.
+ */
+class InsecureDexConfiguration extends TaintTracking::Configuration {
+  InsecureDexConfiguration() { this = "Insecure Dex File Load" }
+
+  override predicate isSource(DataFlow::Node source) { source instanceof InsecureDexSource }
+
+  override predicate isSink(DataFlow::Node sink) { sink instanceof InsecureDexSink }
+
+  override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
+    flowStep(pred, succ)
+  }
+}
+
+/** A data flow source for insecure Dex class loading vulnerabilities. */
+abstract class InsecureDexSource extends DataFlow::Node { }
+
+/** A data flow sink for insecure Dex class loading vulnerabilities. */
+abstract class InsecureDexSink extends DataFlow::Node { }
+
+private predicate flowStep(DataFlow::Node pred, DataFlow::Node succ) {
+  // propagate from a `java.io.File` via the `File.getAbsolutePath` call.
+  exists(MethodAccess m |
+    m.getMethod().getDeclaringType() instanceof TypeFile and
+    m.getMethod().hasName("getAbsolutePath") and
+    m.getQualifier() = pred.asExpr() and
+    m = succ.asExpr()
+  )
+  or
+  // propagate from a `java.io.File` via the `File.toString` call.
+  exists(MethodAccess m |
+    m.getMethod().getDeclaringType() instanceof TypeFile and
+    m.getMethod().hasName("toString") and
+    m.getQualifier() = pred.asExpr() and
+    m = succ.asExpr()
+  )
+  or
+  // propagate to newly created `File` if the parent directory of the new `File` is tainted
+  exists(ConstructorCall cc |
+    cc.getConstructedType() instanceof TypeFile and
+    cc.getArgument(0) = pred.asExpr() and
+    cc = succ.asExpr()
+  )
+}
+
+/**
+ * An argument to a `DexClassLoader` call taken as a sink for
+ * insecure Dex class loading vulnerabilities.
+ */
+private class DexClassLoader extends InsecureDexSink {
+  DexClassLoader() {
+    exists(ConstructorCall cc |
+      cc.getConstructedType().hasQualifiedName("dalvik.system", "DexClassLoader")
+    |
+      this.asExpr() = cc.getArgument(0)
+    )
+  }
+}
+
+/**
+ * A `File` instance which reads from an SD card
+ * taken as a source for insecure Dex class loading vulnerabilities.
+ */
+private class ExternalFile extends InsecureDexSource {
+  ExternalFile() {
+    exists(ConstructorCall cc, Argument a |
+      cc.getConstructedType() instanceof TypeFile and
+      a = cc.getArgument(0) and
+      a.(CompileTimeConstantExpr).getStringValue().matches("%sdcard%")
+    |
+      this.asExpr() = a
+    )
+  }
+}
+
+/**
+ * A directory or file which may be stored in an world writable directory
+ * taken as a source for insecure Dex class loading vulnerabilities.
+ */
+private class ExternalStorageDirSource extends InsecureDexSource {
+  ExternalStorageDirSource() {
+    exists(Method m |
+      m.getDeclaringType().hasQualifiedName("android.os", "Environment") and
+      m.hasName("getExternalStorageDirectory")
+      or
+      m.getDeclaringType().hasQualifiedName("android.content", "Context") and
+      m.hasName([
+          "getExternalFilesDir", "getExternalFilesDirs", "getExternalMediaDirs",
+          "getExternalCacheDir", "getExternalCacheDirs"
+        ])
+    |
+      this.asExpr() = m.getAReference()
+    )
+  }
+}
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoadingBad.java b/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoadingBad.java
new file mode 100644
index 00000000000..869b6bc571c
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoadingBad.java
@@ -0,0 +1,32 @@
+
+import android.app.Application;
+import android.content.Context;
+import android.content.pm.PackageInfo;
+import android.os.Bundle;
+
+import dalvik.system.DexClassLoader;
+import dalvik.system.DexFile;
+
+public class InsecureDexLoading extends Application {
+	@Override
+	public void onCreate() {
+		super.onCreate();
+		updateChecker();
+	}
+
+	private void updateChecker() {
+		try {
+			File file = new File("/sdcard/updater.apk");
+			if (file.exists() && file.isFile() && file.length() <= 1000) {
+				DexClassLoader cl = new DexClassLoader(file.getAbsolutePath(), getCacheDir().getAbsolutePath(), null,
+						getClassLoader());
+				int version = (int) cl.loadClass("my.package.class").getDeclaredMethod("myMethod").invoke(null);
+				if (Build.VERSION.SDK_INT < version) {
+					Toast.makeText(this, "Loaded Dex!", Toast.LENGTH_LONG).show();
+				}
+			}
+		} catch (Exception e) {
+			// ignore
+		}
+	}
+}
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoadingGood.java b/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoadingGood.java
new file mode 100644
index 00000000000..e45e3938f7b
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/InsecureDexLoadingGood.java
@@ -0,0 +1,23 @@
+public class SecureDexLoading extends Application {
+	@Override
+	public void onCreate() {
+		super.onCreate();
+		updateChecker();
+	}
+
+	private void updateChecker() {
+		try {
+			File file = new File(getCacheDir() + "/updater.apk");
+			if (file.exists() && file.isFile() && file.length() <= 1000) {
+				DexClassLoader cl = new DexClassLoader(file.getAbsolutePath(), getCacheDir().getAbsolutePath(), null,
+						getClassLoader());
+				int version = (int) cl.loadClass("my.package.class").getDeclaredMethod("myMethod").invoke(null);
+				if (Build.VERSION.SDK_INT < version) {
+					Toast.makeText(this, "Securely loaded Dex!", Toast.LENGTH_LONG).show();
+				}
+			}
+		} catch (Exception e) {
+			// ignore
+		}
+	}
+}
\ No newline at end of file
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjection.qhelp b/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjection.qhelp
new file mode 100644
index 00000000000..a8d3cd0fe70
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjection.qhelp
@@ -0,0 +1,61 @@
+<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
+<qhelp>
+
+<overview>
+<p>
+Jakarta Expression Language (EL) is an expression language for Java applications.
+There is a single language specification and multiple implementations
+such as Glassfish, Juel, Apache Commons EL, etc.
+The language allows invocation of methods available in the JVM.
+If an expression is built using attacker-controlled data,
+and then evaluated, it may allow the attacker to run arbitrary code.
+</p>
+</overview>
+
+<recommendation>
+<p>
+It is generally recommended to avoid using untrusted data in an EL expression.
+Before using untrusted data to build an EL expression, the data should be validated
+to ensure it is not evaluated as expression language. If the EL implementation offers
+configuring a sandbox for EL expressions, they should be run in a restrictive sandbox
+that allows accessing only explicitly allowed classes. If the EL implementation
+does not support sandboxing, consider using other expression language implementations
+with sandboxing capabilities such as Apache Commons JEXL or the Spring Expression Language.
+</p>
+</recommendation>
+
+<example>
+<p>
+The following example shows how untrusted data is used to build and run an expression
+using the JUEL interpreter:
+</p>
+<sample src="UnsafeExpressionEvaluationWithJuel.java" />
+
+<p>
+JUEL does not support running expressions in a sandbox. To prevent running arbitrary code,
+incoming data has to be checked before including it in an expression. The next example
+uses a Regex pattern to check whether a user tries to run an allowed expression or not:
+</p>
+<sample src="SaferExpressionEvaluationWithJuel.java" />
+
+</example>
+
+<references>
+<li>
+  Eclipse Foundation:
+  <a href="https://projects.eclipse.org/projects/ee4j.el">Jakarta Expression Language</a>.
+</li>
+<li>
+  Jakarta EE documentation:
+  <a href="https://javadoc.io/doc/jakarta.el/jakarta.el-api/latest/index.html">Jakarta Expression Language API</a>
+</li>
+<li>
+  OWASP:
+  <a href="https://owasp.org/www-community/vulnerabilities/Expression_Language_Injection">Expression Language Injection</a>.
+</li>
+<li>
+  JUEL:
+  <a href="http://juel.sourceforge.net">Home page</a>
+</li>
+</references>
+</qhelp>
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjection.ql b/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjection.ql
new file mode 100644
index 00000000000..8190ec3d61f
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjection.ql
@@ -0,0 +1,20 @@
+/**
+ * @name Jakarta Expression Language injection
+ * @description Evaluation of a user-controlled expression
+ *              may lead to arbitrary code execution.
+ * @kind path-problem
+ * @problem.severity error
+ * @precision high
+ * @id java/javaee-expression-injection
+ * @tags security
+ *       external/cwe/cwe-094
+ */
+
+import java
+import JakartaExpressionInjectionLib
+import DataFlow::PathGraph
+
+from DataFlow::PathNode source, DataFlow::PathNode sink, JakartaExpressionInjectionConfig conf
+where conf.hasFlowPath(source, sink)
+select sink.getNode(), source, sink, "Jakarta Expression Language injection from $@.",
+  source.getNode(), "this user input"
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjectionLib.qll
new file mode 100644
index 00000000000..43090974364
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/JakartaExpressionInjectionLib.qll
@@ -0,0 +1,108 @@
+import java
+import FlowUtils
+import semmle.code.java.dataflow.FlowSources
+import semmle.code.java.dataflow.TaintTracking
+
+/**
+ * A taint-tracking configuration for unsafe user input
+ * that is used to construct and evaluate an expression.
+ */
+class JakartaExpressionInjectionConfig extends TaintTracking::Configuration {
+  JakartaExpressionInjectionConfig() { this = "JakartaExpressionInjectionConfig" }
+
+  override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
+
+  override predicate isSink(DataFlow::Node sink) { sink instanceof ExpressionEvaluationSink }
+
+  override predicate isAdditionalTaintStep(DataFlow::Node fromNode, DataFlow::Node toNode) {
+    any(TaintPropagatingCall c).taintFlow(fromNode, toNode) or
+    hasGetterFlow(fromNode, toNode)
+  }
+}
+
+/**
+ * A sink for Expresssion Language injection vulnerabilities,
+ * i.e. method calls that run evaluation of an expression.
+ */
+private class ExpressionEvaluationSink extends DataFlow::ExprNode {
+  ExpressionEvaluationSink() {
+    exists(MethodAccess ma, Method m, Expr taintFrom |
+      ma.getMethod() = m and taintFrom = this.asExpr()
+    |
+      m.getDeclaringType() instanceof ValueExpression and
+      m.hasName(["getValue", "setValue"]) and
+      ma.getQualifier() = taintFrom
+      or
+      m.getDeclaringType() instanceof MethodExpression and
+      m.hasName("invoke") and
+      ma.getQualifier() = taintFrom
+      or
+      m.getDeclaringType() instanceof LambdaExpression and
+      m.hasName("invoke") and
+      ma.getQualifier() = taintFrom
+      or
+      m.getDeclaringType() instanceof ELProcessor and
+      m.hasName(["eval", "getValue", "setValue"]) and
+      ma.getArgument(0) = taintFrom
+      or
+      m.getDeclaringType() instanceof ELProcessor and
+      m.hasName("setVariable") and
+      ma.getArgument(1) = taintFrom
+    )
+  }
+}
+
+/**
+ * Defines method calls that propagate tainted expressions.
+ */
+private class TaintPropagatingCall extends Call {
+  Expr taintFromExpr;
+
+  TaintPropagatingCall() {
+    taintFromExpr = this.getArgument(1) and
+    (
+      exists(Method m | this.(MethodAccess).getMethod() = m |
+        m.getDeclaringType() instanceof ExpressionFactory and
+        m.hasName(["createValueExpression", "createMethodExpression"]) and
+        taintFromExpr.getType() instanceof TypeString
+      )
+      or
+      exists(Constructor c | this.(ConstructorCall).getConstructor() = c |
+        c.getDeclaringType() instanceof LambdaExpression and
+        taintFromExpr.getType() instanceof ValueExpression
+      )
+    )
+  }
+
+  /**
+   * Holds if `fromNode` to `toNode` is a dataflow step that propagates
+   * tainted data.
+   */
+  predicate taintFlow(DataFlow::Node fromNode, DataFlow::Node toNode) {
+    fromNode.asExpr() = taintFromExpr and toNode.asExpr() = this
+  }
+}
+
+private class JakartaType extends RefType {
+  JakartaType() { getPackage().hasName(["javax.el", "jakarta.el"]) }
+}
+
+private class ELProcessor extends JakartaType {
+  ELProcessor() { hasName("ELProcessor") }
+}
+
+private class ExpressionFactory extends JakartaType {
+  ExpressionFactory() { hasName("ExpressionFactory") }
+}
+
+private class ValueExpression extends JakartaType {
+  ValueExpression() { hasName("ValueExpression") }
+}
+
+private class MethodExpression extends JakartaType {
+  MethodExpression() { hasName("MethodExpression") }
+}
+
+private class LambdaExpression extends JakartaType {
+  LambdaExpression() { hasName("LambdaExpression") }
+}
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll
index 561d7e46ae9..89d7cb496a4 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/JexlInjectionLib.qll
@@ -1,4 +1,5 @@
 import java
+import FlowUtils
 import semmle.code.java.dataflow.FlowSources
 import semmle.code.java.dataflow.TaintTracking
 
@@ -16,7 +17,7 @@ class JexlInjectionConfig extends TaintTracking::Configuration {
 
   override predicate isAdditionalTaintStep(DataFlow::Node fromNode, DataFlow::Node toNode) {
     any(TaintPropagatingJexlMethodCall c).taintFlow(fromNode, toNode) or
-    returnsDataFromBean(fromNode, toNode)
+    hasGetterFlow(fromNode, toNode)
   }
 }
 
@@ -152,18 +153,6 @@ private predicate createsJexlEngine(DataFlow::Node fromNode, DataFlow::Node toNo
   )
 }
 
-/**
- * Holds if `fromNode` to `toNode` is a dataflow step that returns data from
- * a bean by calling one of its getters.
- */
-private predicate returnsDataFromBean(DataFlow::Node fromNode, DataFlow::Node toNode) {
-  exists(MethodAccess ma, Method m | ma.getMethod() = m |
-    m instanceof GetterMethod and
-    ma.getQualifier() = fromNode.asExpr() and
-    ma = toNode.asExpr()
-  )
-}
-
 /**
  * A methods in the `JexlEngine` class that gets or sets a property with a JEXL expression.
  */
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/SaferExpressionEvaluationWithJuel.java b/java/ql/src/experimental/Security/CWE/CWE-094/SaferExpressionEvaluationWithJuel.java
new file mode 100644
index 00000000000..3dfaaead68a
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/SaferExpressionEvaluationWithJuel.java
@@ -0,0 +1,10 @@
+String input = getRemoteUserInput();
+String pattern = "(inside|outside)\\.(temperature|humidity)";
+if (!input.matches(pattern)) {
+    throw new IllegalArgumentException("Unexpected expression");
+}
+String expression = "${" + input + "}";
+ExpressionFactory factory = new de.odysseus.el.ExpressionFactoryImpl();
+ValueExpression e = factory.createValueExpression(context, expression, Object.class);
+SimpleContext context = getContext();
+Object result = e.getValue(context);
diff --git a/java/ql/src/experimental/Security/CWE/CWE-094/UnsafeExpressionEvaluationWithJuel.java b/java/ql/src/experimental/Security/CWE/CWE-094/UnsafeExpressionEvaluationWithJuel.java
new file mode 100644
index 00000000000..27afa0fcb49
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-094/UnsafeExpressionEvaluationWithJuel.java
@@ -0,0 +1,5 @@
+String expression = "${" + getRemoteUserInput() + "}";
+ExpressionFactory factory = new de.odysseus.el.ExpressionFactoryImpl();
+ValueExpression e = factory.createValueExpression(context, expression, Object.class);
+SimpleContext context = getContext();
+Object result = e.getValue(context);
\ No newline at end of file
diff --git a/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.java b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.java
new file mode 100644
index 00000000000..48d80707ff8
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.java
@@ -0,0 +1,44 @@
+class SensitiveCookieNotHttpOnly {
+    // GOOD - Create a sensitive cookie with the `HttpOnly` flag set.
+    public void addCookie(String jwt_token, HttpServletRequest request, HttpServletResponse response) {
+        Cookie jwtCookie =new Cookie("jwt_token", jwt_token);
+        jwtCookie.setPath("/");
+        jwtCookie.setMaxAge(3600*24*7);
+        jwtCookie.setHttpOnly(true);
+        response.addCookie(jwtCookie);
+    }
+
+    // BAD - Create a sensitive cookie without the `HttpOnly` flag set.
+    public void addCookie2(String jwt_token, String userId, HttpServletRequest request, HttpServletResponse response) {
+        Cookie jwtCookie =new Cookie("jwt_token", jwt_token);
+        jwtCookie.setPath("/");
+        jwtCookie.setMaxAge(3600*24*7);
+        response.addCookie(jwtCookie);
+    }
+
+    // GOOD - Set a sensitive cookie header with the `HttpOnly` flag set.
+    public void addCookie3(String authId, HttpServletRequest request, HttpServletResponse response) {
+        response.addHeader("Set-Cookie", "token=" +authId + ";HttpOnly;Secure");
+    }
+
+    // BAD - Set a sensitive cookie header without the `HttpOnly` flag set.
+    public void addCookie4(String authId, HttpServletRequest request, HttpServletResponse response) {
+        response.addHeader("Set-Cookie", "token=" +authId + ";Secure");
+    }
+    
+    // GOOD - Set a sensitive cookie header using the class `javax.ws.rs.core.Cookie` with the `HttpOnly` flag set through string concatenation.
+    public void addCookie5(String accessKey, HttpServletRequest request, HttpServletResponse response) {
+        response.setHeader("Set-Cookie", new NewCookie("session-access-key", accessKey, "/", null, null, 0, true) + ";HttpOnly");
+    }
+
+    // BAD - Set a sensitive cookie header using the class `javax.ws.rs.core.Cookie` without the `HttpOnly` flag set.
+    public void addCookie6(String accessKey, HttpServletRequest request, HttpServletResponse response) {
+        response.setHeader("Set-Cookie", new NewCookie("session-access-key", accessKey, "/", null, null, 0, true).toString());
+    }
+
+    // GOOD - Set a sensitive cookie header using the class `javax.ws.rs.core.Cookie` with the `HttpOnly` flag set through the constructor.
+    public void addCookie7(String accessKey, HttpServletRequest request, HttpServletResponse response) {
+        NewCookie accessKeyCookie = new NewCookie("session-access-key", accessKey, "/", null, null, 0, true, true);
+        response.setHeader("Set-Cookie", accessKeyCookie.toString());
+    }
+}
diff --git a/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.qhelp b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.qhelp
new file mode 100644
index 00000000000..ee3e8a4181a
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.qhelp
@@ -0,0 +1,27 @@
+<!DOCTYPE qhelp SYSTEM "qhelp.dtd">
+<qhelp>
+
+  <overview>
+    <p>Cross-Site Scripting (XSS) is categorized as one of the OWASP Top 10 Security Vulnerabilities. The <code>HttpOnly</code> flag directs compatible browsers to prevent client-side script from accessing cookies. Including the <code>HttpOnly</code> flag in the Set-Cookie HTTP response header for a sensitive cookie helps mitigate the risk associated with XSS where an attacker's script code attempts to read the contents of a cookie and exfiltrate information obtained.</p>
+  </overview>
+
+  <recommendation>
+    <p>Use the <code>HttpOnly</code> flag when generating a cookie containing sensitive information to help mitigate the risk of client side script accessing the protected cookie.</p>
+  </recommendation>
+
+  <example>
+    <p>The following example shows two ways of generating sensitive cookies. In the 'BAD' cases, the <code>HttpOnly</code> flag is not set. In the 'GOOD' cases, the <code>HttpOnly</code> flag is set.</p>
+    <sample src="SensitiveCookieNotHttpOnly.java" />
+  </example>
+
+  <references>
+    <li>
+      PortSwigger:
+      <a href="https://portswigger.net/kb/issues/00500600_cookie-without-httponly-flag-set">Cookie without HttpOnly flag set</a>
+    </li>
+    <li>
+      OWASP:
+      <a href="https://owasp.org/www-community/HttpOnly">HttpOnly</a>
+    </li>
+  </references>
+</qhelp>
diff --git a/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
new file mode 100644
index 00000000000..4c0dc624d07
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
@@ -0,0 +1,221 @@
+/**
+ * @name Sensitive cookies without the HttpOnly response header set
+ * @description Sensitive cookies without the 'HttpOnly' flag set leaves session cookies vulnerable to
+ *              an XSS attack.
+ * @kind path-problem
+ * @id java/sensitive-cookie-not-httponly
+ * @tags security
+ *       external/cwe/cwe-1004
+ */
+
+/*
+ * Sketch of the structure of this query: we track cookie names that appear to be sensitive
+ * (e.g. `session` or `token`) to a `ServletResponse.addHeader(...)` or `.addCookie(...)`
+ * method that does not set the `httpOnly` flag. Subsidiary configurations
+ * `MatchesHttpOnlyConfiguration` and `SetHttpOnlyInCookieConfiguration` are used to establish
+ * when the `httpOnly` flag is likely to have been set, before configuration
+ * `MissingHttpOnlyConfiguration` establishes that a non-`httpOnly` cookie has a sensitive-seeming name.
+ */
+
+import java
+import semmle.code.java.dataflow.FlowSteps
+import semmle.code.java.frameworks.Servlets
+import semmle.code.java.dataflow.TaintTracking
+import semmle.code.java.dataflow.TaintTracking2
+import DataFlow::PathGraph
+
+/** Gets a regular expression for matching common names of sensitive cookies. */
+string getSensitiveCookieNameRegex() { result = "(?i).*(auth|session|token|key|credential).*" }
+
+/** Gets a regular expression for matching CSRF cookies. */
+string getCsrfCookieNameRegex() { result = "(?i).*(csrf).*" }
+
+/**
+ * Holds if a string is concatenated with the name of a sensitive cookie. Excludes CSRF cookies since
+ * they are special cookies implementing the Synchronizer Token Pattern that can be used in JavaScript.
+ */
+predicate isSensitiveCookieNameExpr(Expr expr) {
+  exists(string s | s = expr.(CompileTimeConstantExpr).getStringValue() |
+    s.regexpMatch(getSensitiveCookieNameRegex()) and not s.regexpMatch(getCsrfCookieNameRegex())
+  )
+  or
+  isSensitiveCookieNameExpr(expr.(AddExpr).getAnOperand())
+}
+
+/** A sensitive cookie name. */
+class SensitiveCookieNameExpr extends Expr {
+  SensitiveCookieNameExpr() { isSensitiveCookieNameExpr(this) }
+}
+
+/** A method call that sets a `Set-Cookie` header. */
+class SetCookieMethodAccess extends MethodAccess {
+  SetCookieMethodAccess() {
+    (
+      this.getMethod() instanceof ResponseAddHeaderMethod or
+      this.getMethod() instanceof ResponseSetHeaderMethod
+    ) and
+    this.getArgument(0).(CompileTimeConstantExpr).getStringValue().toLowerCase() = "set-cookie"
+  }
+}
+
+/**
+ * A taint configuration tracking flow from the text `httponly` to argument 1 of
+ * `SetCookieMethodAccess`.
+ */
+class MatchesHttpOnlyConfiguration extends TaintTracking2::Configuration {
+  MatchesHttpOnlyConfiguration() { this = "MatchesHttpOnlyConfiguration" }
+
+  override predicate isSource(DataFlow::Node source) {
+    source.asExpr().(CompileTimeConstantExpr).getStringValue().toLowerCase().matches("%httponly%")
+  }
+
+  override predicate isSink(DataFlow::Node sink) {
+    sink.asExpr() = any(SetCookieMethodAccess ma).getArgument(1)
+  }
+}
+
+/** A class descended from `javax.servlet.http.Cookie` or `javax/jakarta.ws.rs.core.Cookie`. */
+class CookieClass extends RefType {
+  CookieClass() {
+    this.getASupertype*()
+        .hasQualifiedName(["javax.servlet.http", "javax.ws.rs.core", "jakarta.ws.rs.core"], "Cookie")
+  }
+}
+
+/** Holds if `expr` is any boolean-typed expression other than literal `false`. */
+// Inlined because this could be a very large result set if computed out of context
+pragma[inline]
+predicate mayBeBooleanTrue(Expr expr) {
+  expr.getType() instanceof BooleanType and
+  not expr.(CompileTimeConstantExpr).getBooleanValue() = false
+}
+
+/** Holds if the method call may set the `HttpOnly` flag. */
+predicate setsCookieHttpOnly(MethodAccess ma) {
+  ma.getMethod().getName() = "setHttpOnly" and
+  // any use of setHttpOnly(x) where x isn't false is probably safe
+  mayBeBooleanTrue(ma.getArgument(0))
+}
+
+/** Holds if `ma` removes a cookie. */
+predicate removesCookie(MethodAccess ma) {
+  ma.getMethod().getName() = "setMaxAge" and
+  ma.getArgument(0).(IntegerLiteral).getIntValue() = 0
+}
+
+/**
+ * Holds if the MethodAccess `ma` is a test method call indicated by:
+ *    a) in a test directory such as `src/test/java`
+ *    b) in a test package whose name has the word `test`
+ *    c) in a test class whose name has the word `test`
+ *    d) in a test class implementing a test framework such as JUnit or TestNG
+ */
+predicate isTestMethod(MethodAccess ma) {
+  exists(Method m |
+    m = ma.getEnclosingCallable() and
+    (
+      m.getDeclaringType().getName().toLowerCase().matches("%test%") or // Simple check to exclude test classes to reduce FPs
+      m.getDeclaringType().getPackage().getName().toLowerCase().matches("%test%") or // Simple check to exclude classes in test packages to reduce FPs
+      exists(m.getLocation().getFile().getAbsolutePath().indexOf("/src/test/java")) or //  Match test directory structure of build tools like maven
+      m instanceof TestMethod // Test method of a test case implementing a test framework such as JUnit or TestNG
+    )
+  )
+}
+
+/**
+ * A taint configuration tracking flow of a method that sets the `HttpOnly` flag,
+ * or one that removes a cookie, to a `ServletResponse.addCookie` call.
+ */
+class SetHttpOnlyOrRemovesCookieConfiguration extends TaintTracking2::Configuration {
+  SetHttpOnlyOrRemovesCookieConfiguration() { this = "SetHttpOnlyOrRemovesCookieConfiguration" }
+
+  override predicate isSource(DataFlow::Node source) {
+    source.asExpr() =
+      any(MethodAccess ma | setsCookieHttpOnly(ma) or removesCookie(ma)).getQualifier()
+  }
+
+  override predicate isSink(DataFlow::Node sink) {
+    sink.asExpr() =
+      any(MethodAccess ma | ma.getMethod() instanceof ResponseAddCookieMethod).getArgument(0)
+  }
+}
+
+/**
+ * A cookie that is added to an HTTP response and which doesn't have `httpOnly` set, used as a sink
+ * in `MissingHttpOnlyConfiguration`.
+ */
+class CookieResponseSink extends DataFlow::ExprNode {
+  CookieResponseSink() {
+    exists(MethodAccess ma |
+      (
+        ma.getMethod() instanceof ResponseAddCookieMethod and
+        this.getExpr() = ma.getArgument(0) and
+        not exists(SetHttpOnlyOrRemovesCookieConfiguration cc | cc.hasFlowTo(this))
+        or
+        ma instanceof SetCookieMethodAccess and
+        this.getExpr() = ma.getArgument(1) and
+        not exists(MatchesHttpOnlyConfiguration cc | cc.hasFlowTo(this)) // response.addHeader("Set-Cookie", "token=" +authId + ";HttpOnly;Secure")
+      ) and
+      not isTestMethod(ma) // Test class or method
+    )
+  }
+}
+
+/** Holds if `cie` is an invocation of a JAX-RS `NewCookie` constructor that sets `HttpOnly` to true. */
+predicate setsHttpOnlyInNewCookie(ClassInstanceExpr cie) {
+  cie.getConstructedType().hasQualifiedName(["javax.ws.rs.core", "jakarta.ws.rs.core"], "NewCookie") and
+  (
+    cie.getNumArgument() = 6 and
+    mayBeBooleanTrue(cie.getArgument(5)) // NewCookie(Cookie cookie, String comment, int maxAge, Date expiry, boolean secure, boolean httpOnly)
+    or
+    cie.getNumArgument() = 8 and
+    cie.getArgument(6).getType() instanceof BooleanType and
+    mayBeBooleanTrue(cie.getArgument(7)) // NewCookie(String name, String value, String path, String domain, String comment, int maxAge, boolean secure, boolean httpOnly)
+    or
+    cie.getNumArgument() = 10 and
+    mayBeBooleanTrue(cie.getArgument(9)) // NewCookie(String name, String value, String path, String domain, int version, String comment, int maxAge, Date expiry, boolean secure, boolean httpOnly)
+  )
+}
+
+/**
+ * A taint configuration tracking flow from a sensitive cookie without the `HttpOnly` flag
+ * set to its HTTP response.
+ */
+class MissingHttpOnlyConfiguration extends TaintTracking::Configuration {
+  MissingHttpOnlyConfiguration() { this = "MissingHttpOnlyConfiguration" }
+
+  override predicate isSource(DataFlow::Node source) {
+    source.asExpr() instanceof SensitiveCookieNameExpr
+  }
+
+  override predicate isSink(DataFlow::Node sink) { sink instanceof CookieResponseSink }
+
+  override predicate isSanitizer(DataFlow::Node node) {
+    // JAX-RS's `new NewCookie("session-access-key", accessKey, "/", null, null, 0, true, true)` and similar
+    setsHttpOnlyInNewCookie(node.asExpr())
+  }
+
+  override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
+    exists(
+      ConstructorCall cc // new Cookie(...)
+    |
+      cc.getConstructedType() instanceof CookieClass and
+      pred.asExpr() = cc.getAnArgument() and
+      succ.asExpr() = cc
+    )
+    or
+    exists(
+      MethodAccess ma // cookie.toString()
+    |
+      ma.getMethod().getName() = "toString" and
+      ma.getQualifier().getType() instanceof CookieClass and
+      pred.asExpr() = ma.getQualifier() and
+      succ.asExpr() = ma
+    )
+  }
+}
+
+from DataFlow::PathNode source, DataFlow::PathNode sink, MissingHttpOnlyConfiguration c
+where c.hasFlowPath(source, sink)
+select sink.getNode(), source, sink, "$@ doesn't have the HttpOnly flag set.", source.getNode(),
+  "This sensitive cookie"
diff --git a/java/ql/src/experimental/Security/CWE/CWE-117/LogInjection.qhelp b/java/ql/src/experimental/Security/CWE/CWE-117/LogInjection.qhelp
new file mode 100644
index 00000000000..4ad7b2d5380
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-117/LogInjection.qhelp
@@ -0,0 +1,49 @@
+
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+
+<overview>
+
+<p>If unsanitized user input is written to a log entry, a malicious user may be able to forge new log entries.</p>
+
+<p>Forgery can occur if a user provides some input creating the appearance of multiple
+  log entries. This can include unescaped new-line characters, or HTML or other markup.</p>
+</overview>
+
+<recommendation>
+<p>
+User input should be suitably sanitized before it is logged.
+</p>
+<p>
+If the log entries are plain text then line breaks should be removed from user input, using for example
+<code>String replace(char oldChar, char newChar)</code> or similar. Care should also be taken that user input is clearly marked
+in log entries, and that a malicious user cannot cause confusion in other ways.
+</p>
+<p>
+For log entries that will be displayed in HTML, user input should be HTML encoded before being logged, to prevent forgery and
+other forms of HTML injection.
+</p>
+
+</recommendation>
+
+<example>
+  <p>In the example, a username, provided by the user, is logged using <code>logger.warn</code> (from  <code>org.slf4j.Logger</code>). 
+    In the first case (<code>/bad</code> endpoint), the username is logged without any sanitization.
+    If a malicious user provides <code>Guest'%0AUser:'Admin</code> as a username parameter, 
+    the log entry will be split into two separate lines, where the first line will be <code>User:'Guest'</code> and the second one will be <code>User:'Admin'</code>.
+</p>
+<sample src="LogInjectionBad.java" />
+
+<p> In the second case (<code>/good</code> endpoint), <code>matches()</code> is used to ensure the user input only has alphanumeric characters.
+  If a malicious user provides `Guest'%0AUser:'Admin` as a username parameter, 
+  the log entry will not be split into two separate lines, resulting in a single line <code>User:'Guest'User:'Admin'</code>.</p>
+
+<sample src="LogInjectionGood.java" />
+</example>
+
+<references>
+<li>OWASP: <a href="https://owasp.org/www-community/attacks/Log_Injection">Log Injection</a>.</li>
+</references>
+</qhelp>
diff --git a/java/ql/src/experimental/Security/CWE/CWE-117/LogInjection.ql b/java/ql/src/experimental/Security/CWE/CWE-117/LogInjection.ql
new file mode 100644
index 00000000000..7183c74b5bf
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-117/LogInjection.ql
@@ -0,0 +1,38 @@
+/**
+ * @name Log Injection
+ * @description Building log entries from user-controlled data is vulnerable to
+ *              insertion of forged log entries by a malicious user.
+ * @kind path-problem
+ * @problem.severity error
+ * @precision high
+ * @id java/log-injection
+ * @tags security
+ *       external/cwe/cwe-117
+ */
+
+import java
+import DataFlow::PathGraph
+import experimental.semmle.code.java.Logging
+import semmle.code.java.dataflow.FlowSources
+
+/**
+ * A taint-tracking configuration for tracking untrusted user input used in log entries.
+ */
+private class LogInjectionConfiguration extends TaintTracking::Configuration {
+  LogInjectionConfiguration() { this = "Log Injection" }
+
+  override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
+
+  override predicate isSink(DataFlow::Node sink) {
+    sink.asExpr() = any(LoggingCall c).getALogArgument()
+  }
+
+  override predicate isSanitizer(DataFlow::Node node) {
+    node.getType() instanceof BoxedType or node.getType() instanceof PrimitiveType
+  }
+}
+
+from LogInjectionConfiguration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
+where cfg.hasFlowPath(source, sink)
+select sink.getNode(), source, sink, "$@ flows to log entry.", source.getNode(),
+  "User-provided value"
diff --git a/java/ql/src/experimental/Security/CWE/CWE-117/LogInjectionBad.java b/java/ql/src/experimental/Security/CWE/CWE-117/LogInjectionBad.java
new file mode 100644
index 00000000000..620b9801631
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-117/LogInjectionBad.java
@@ -0,0 +1,24 @@
+package com.example.restservice;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+
+@RestController
+public class LogInjection {
+
+    private final Logger log = LoggerFactory.getLogger(LogInjection.class);
+
+    // /bad?username=Guest'%0AUser:'Admin
+    @GetMapping("/bad")
+    public String bad(@RequestParam(value = "username", defaultValue = "name") String username) {
+        log.warn("User:'{}'", username);
+        // The logging call above would result in multiple log entries as shown below:
+        // User:'Guest'
+        // User:'Admin'
+        return username;
+    }
+}
+
diff --git a/java/ql/src/experimental/Security/CWE/CWE-117/LogInjectionGood.java b/java/ql/src/experimental/Security/CWE/CWE-117/LogInjectionGood.java
new file mode 100644
index 00000000000..2ed683a2760
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-117/LogInjectionGood.java
@@ -0,0 +1,25 @@
+package com.example.restservice;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+
+@RestController
+public class LogInjection {
+
+    private final Logger log = LoggerFactory.getLogger(LogInjection.class);
+
+    // /good?username=Guest'%0AUser:'Admin
+    @GetMapping("/good")
+    public String good(@RequestParam(value = "username", defaultValue = "name") String username) {
+        // The regex check here, allows only alphanumeric characters to pass.
+        // Hence, does not result in log injection
+        if (username.matches("\w*")) {
+            log.warn("User:'{}'", username);
+            
+            return username;
+        }
+    }
+}
diff --git a/java/ql/src/experimental/Security/CWE/CWE-273/UnsafeCertTrust.ql b/java/ql/src/experimental/Security/CWE/CWE-273/UnsafeCertTrust.ql
index 3dca54a8de6..9efdcbf4c6e 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-273/UnsafeCertTrust.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-273/UnsafeCertTrust.ql
@@ -1,7 +1,12 @@
 /**
  * @name Unsafe certificate trust
- * @description Unsafe implementation of the interface X509TrustManager and SSLSocket/SSLEngine ignores all SSL certificate validation errors when establishing an HTTPS connection, thereby making the app vulnerable to man-in-the-middle attacks.
+ * @description Unsafe implementation of the interface X509TrustManager and
+ *              SSLSocket/SSLEngine ignores all SSL certificate validation
+ *              errors when establishing an HTTPS connection, thereby making
+ *              the app vulnerable to man-in-the-middle attacks.
  * @kind problem
+ * @problem.severity warning
+ * @precision medium
  * @id java/unsafe-cert-trust
  * @tags security
  *       external/cwe-273
diff --git a/java/ql/src/experimental/Security/CWE/CWE-295/JxBrowserWithoutCertValidation.ql b/java/ql/src/experimental/Security/CWE/CWE-295/JxBrowserWithoutCertValidation.ql
index aecffaf3f3b..f664f4ce953 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-295/JxBrowserWithoutCertValidation.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-295/JxBrowserWithoutCertValidation.ql
@@ -1,7 +1,11 @@
 /**
  * @name JxBrowser with disabled certificate validation
- * @description Insecure configuration of JxBrowser disables certificate validation making the app vulnerable to man-in-the-middle attacks.
+ * @description Insecure configuration of JxBrowser disables certificate
+ *              validation making the app vulnerable to man-in-the-middle
+ *              attacks.
  * @kind problem
+ * @problem.severity warning
+ * @precision medium
  * @id java/jxbrowser/disabled-certificate-validation
  * @tags security
  *       external/cwe/cwe-295
diff --git a/java/ql/src/experimental/Security/CWE/CWE-297/InsecureJavaMail.ql b/java/ql/src/experimental/Security/CWE/CWE-297/InsecureJavaMail.ql
index 6b9176ce034..c17c83448cb 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-297/InsecureJavaMail.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-297/InsecureJavaMail.ql
@@ -1,8 +1,12 @@
 /**
- * @id java/insecure-smtp-ssl
  * @name Insecure JavaMail SSL Configuration
- * @description Java application configured to use authenticated mail session over SSL does not validate the SSL certificate to properly ensure that it is actually associated with that host.
+ * @description Java application configured to use authenticated mail session
+ *              over SSL does not validate the SSL certificate to properly
+ *              ensure that it is actually associated with that host.
  * @kind problem
+ * @problem.severity warning
+ * @precision medium
+ * @id java/insecure-smtp-ssl
  * @tags security
  *       external/cwe-297
  */
diff --git a/java/ql/src/experimental/Security/CWE/CWE-297/InsecureLdapEndpoint.java b/java/ql/src/experimental/Security/CWE/CWE-297/InsecureLdapEndpoint.java
new file mode 100644
index 00000000000..6f7494f8811
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-297/InsecureLdapEndpoint.java
@@ -0,0 +1,18 @@
+public class InsecureLdapEndpoint {
+    public Hashtable<String, String> createConnectionEnv() {
+        Hashtable<String, String> env = new Hashtable<String, String>();
+        env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
+        env.put(Context.PROVIDER_URL, "ldaps://ad.your-server.com:636");
+
+        env.put(Context.SECURITY_AUTHENTICATION, "simple");
+        env.put(Context.SECURITY_PRINCIPAL, "username");
+        env.put(Context.SECURITY_CREDENTIALS, "secpassword");
+
+        // BAD - Test configuration with disabled SSL endpoint check.
+        {
+            System.setProperty("com.sun.jndi.ldap.object.disableEndpointIdentification", "true");
+        }
+
+        return env;
+    }
+}
diff --git a/java/ql/src/experimental/Security/CWE/CWE-297/InsecureLdapEndpoint.qhelp b/java/ql/src/experimental/Security/CWE/CWE-297/InsecureLdapEndpoint.qhelp
new file mode 100644
index 00000000000..50e1febf894
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-297/InsecureLdapEndpoint.qhelp
@@ -0,0 +1,40 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+
+<overview>
+<p>Java versions 8u181 or greater have enabled LDAPS endpoint identification by default. Nowadays 
+  infrastructure services like LDAP are commonly deployed behind load balancers therefore the LDAP 
+  server name can be different from the FQDN of the LDAPS endpoint. If a service certificate does not 
+  properly contain a matching DNS name as part of the certificate, Java will reject it by default.</p>
+<p>Instead of addressing the issue properly by having a compliant certificate deployed, frequently 
+  developers simply disable the LDAPS endpoint check.</p>
+<p>Failing to validate the certificate makes the SSL session susceptible to a man-in-the-middle attack. 
+  This query checks whether the LDAPS endpoint check is disabled in system properties.</p>
+</overview>
+
+<recommendation>
+<p>Replace any non-conforming LDAP server certificates to include a DNS name in the subjectAltName field 
+  of the certificate that matches the FQDN of the service.</p>
+</recommendation>
+
+<example>
+<p>The following two examples show two ways of configuring LDAPS endpoint. In the 'BAD' case, 
+  endpoint check is disabled. In the 'GOOD' case, endpoint check is left enabled through the 
+  default Java configuration.</p>
+<sample src="InsecureLdapEndpoint.java" />
+<sample src="InsecureLdapEndpoint2.java" />
+</example>
+
+<references>
+<li>
+  Oracle Java 8 Update 181 (8u181):
+  <a href="https://www.java.com/en/download/help/release_changes.html">Endpoint identification enabled on LDAPS connections</a>
+</li>
+<li>
+  IBM:
+  <a href="https://www.ibm.com/support/pages/how-do-i-fix-ldap-ssl-error-%E2%80%9Cjavasecuritycertcertificateexception-no-subject-alternative-names-present%E2%80%9D-websphere-application-server">Fix this LDAP SSL error</a>
+</li>
+</references>
+</qhelp>
diff --git a/java/ql/src/experimental/Security/CWE/CWE-297/InsecureLdapEndpoint.ql b/java/ql/src/experimental/Security/CWE/CWE-297/InsecureLdapEndpoint.ql
new file mode 100644
index 00000000000..9fa2fe596fd
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-297/InsecureLdapEndpoint.ql
@@ -0,0 +1,110 @@
+/**
+ * @name Insecure LDAPS Endpoint Configuration
+ * @description Java application configured to disable LDAPS endpoint
+ *              identification does not validate the SSL certificate to
+ *              properly ensure that it is actually associated with that host.
+ * @kind problem
+ * @problem.severity warning
+ * @precision medium
+ * @id java/insecure-ldaps-endpoint
+ * @tags security
+ *       external/cwe-297
+ */
+
+import java
+
+/** The method to set a system property. */
+class SetSystemPropertyMethod extends Method {
+  SetSystemPropertyMethod() {
+    this.hasName("setProperty") and
+    this.getDeclaringType().hasQualifiedName("java.lang", "System")
+  }
+}
+
+/** The class `java.util.Hashtable`. */
+class TypeHashtable extends Class {
+  TypeHashtable() { this.getSourceDeclaration().hasQualifiedName("java.util", "Hashtable") }
+}
+
+/**
+ * The method to set Java properties either through `setProperty` declared in the class `Properties`
+ * or `put` declared in its parent class `HashTable`.
+ */
+class SetPropertyMethod extends Method {
+  SetPropertyMethod() {
+    this.getDeclaringType().getAnAncestor() instanceof TypeHashtable and
+    this.hasName(["put", "setProperty"])
+  }
+}
+
+/** The `setProperties` method declared in `java.lang.System`. */
+class SetSystemPropertiesMethod extends Method {
+  SetSystemPropertiesMethod() {
+    this.hasName("setProperties") and
+    this.getDeclaringType().hasQualifiedName("java.lang", "System")
+  }
+}
+
+/**
+ * Holds if `Expr` expr is evaluated to the string literal
+ * `com.sun.jndi.ldap.object.disableEndpointIdentification`.
+ */
+predicate isPropertyDisableLdapEndpointId(Expr expr) {
+  expr.(CompileTimeConstantExpr).getStringValue() =
+    "com.sun.jndi.ldap.object.disableEndpointIdentification"
+  or
+  exists(Field f |
+    expr = f.getAnAccess() and
+    f.getAnAssignedValue().(StringLiteral).getValue() =
+      "com.sun.jndi.ldap.object.disableEndpointIdentification"
+  )
+}
+
+/** Holds if an expression is evaluated to the boolean value true. */
+predicate isBooleanTrue(Expr expr) {
+  expr.(CompileTimeConstantExpr).getStringValue() = "true" // "true"
+  or
+  expr.(BooleanLiteral).getBooleanValue() = true // true
+  or
+  exists(MethodAccess ma |
+    expr = ma and
+    ma.getMethod() instanceof ToStringMethod and
+    ma.getQualifier().(FieldAccess).getField().hasName("TRUE") and
+    ma.getQualifier()
+        .(FieldAccess)
+        .getField()
+        .getDeclaringType()
+        .hasQualifiedName("java.lang", "Boolean") // Boolean.TRUE.toString()
+  )
+}
+
+/** Holds if `ma` is in a test class or method. */
+predicate isTestMethod(MethodAccess ma) {
+  ma.getEnclosingCallable() instanceof TestMethod or
+  ma.getEnclosingCallable().getDeclaringType() instanceof TestClass or
+  ma.getEnclosingCallable().getDeclaringType().getPackage().getName().matches("%test%") or
+  ma.getEnclosingCallable().getDeclaringType().getName().toLowerCase().matches("%test%")
+}
+
+/** Holds if `MethodAccess` ma disables SSL endpoint check. */
+predicate isInsecureSSLEndpoint(MethodAccess ma) {
+  (
+    ma.getMethod() instanceof SetSystemPropertyMethod and
+    isPropertyDisableLdapEndpointId(ma.getArgument(0)) and
+    isBooleanTrue(ma.getArgument(1)) //com.sun.jndi.ldap.object.disableEndpointIdentification=true
+    or
+    ma.getMethod() instanceof SetSystemPropertiesMethod and
+    exists(MethodAccess ma2 |
+      ma2.getMethod() instanceof SetPropertyMethod and
+      isPropertyDisableLdapEndpointId(ma2.getArgument(0)) and
+      isBooleanTrue(ma2.getArgument(1)) and //com.sun.jndi.ldap.object.disableEndpointIdentification=true
+      ma2.getQualifier().(VarAccess).getVariable().getAnAccess() = ma.getArgument(0) // systemProps.setProperties(properties)
+    )
+  )
+}
+
+from MethodAccess ma
+where
+  isInsecureSSLEndpoint(ma) and
+  not isTestMethod(ma)
+select ma, "LDAPS configuration allows insecure endpoint identification"
diff --git a/java/ql/src/experimental/Security/CWE/CWE-297/InsecureLdapEndpoint2.java b/java/ql/src/experimental/Security/CWE/CWE-297/InsecureLdapEndpoint2.java
new file mode 100644
index 00000000000..2a5c3c87bc7
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-297/InsecureLdapEndpoint2.java
@@ -0,0 +1,17 @@
+public class InsecureLdapEndpoint2 {
+    public Hashtable<String, String> createConnectionEnv() {
+        Hashtable<String, String> env = new Hashtable<String, String>();
+        env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
+        env.put(Context.PROVIDER_URL, "ldaps://ad.your-server.com:636");
+
+        env.put(Context.SECURITY_AUTHENTICATION, "simple");
+        env.put(Context.SECURITY_PRINCIPAL, "username");
+        env.put(Context.SECURITY_CREDENTIALS, "secpassword");
+
+        // GOOD - No configuration to disable SSL endpoint check since it is enabled by default.
+        {
+        }
+
+        return env;
+    }
+}
diff --git a/java/ql/src/experimental/Security/CWE/CWE-312/CleartextStorageSharedPrefs.ql b/java/ql/src/experimental/Security/CWE/CWE-312/CleartextStorageSharedPrefs.ql
index fcfe3f82651..b10741c2048 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-312/CleartextStorageSharedPrefs.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-312/CleartextStorageSharedPrefs.ql
@@ -1,7 +1,11 @@
 /**
  * @name Cleartext storage of sensitive information using `SharedPreferences` on Android
- * @description Cleartext Storage of Sensitive Information using SharedPreferences on Android allows access for users with root privileges or unexpected exposure from chained vulnerabilities.
+ * @description Cleartext Storage of Sensitive Information using
+ *              SharedPreferences on Android allows access for users with root
+ *              privileges or unexpected exposure from chained vulnerabilities.
  * @kind problem
+ * @problem.severity warning
+ * @precision medium
  * @id java/android/cleartext-storage-shared-prefs
  * @tags security
  *       external/cwe/cwe-312
diff --git a/java/ql/src/experimental/Security/CWE/CWE-326/InsufficientKeySize.ql b/java/ql/src/experimental/Security/CWE/CWE-326/InsufficientKeySize.ql
index 41242a44805..155d05abfae 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-326/InsufficientKeySize.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-326/InsufficientKeySize.ql
@@ -2,6 +2,8 @@
  * @name Weak encryption: Insufficient key size
  * @description Finds uses of encryption algorithms with too small a key size
  * @kind problem
+ * @problem.severity warning
+ * @precision medium
  * @id java/insufficient-key-size
  * @tags security
  *       external/cwe/cwe-326
diff --git a/java/ql/src/experimental/Security/CWE/CWE-346/UnvalidatedCors.java b/java/ql/src/experimental/Security/CWE/CWE-346/UnvalidatedCors.java
new file mode 100644
index 00000000000..fd562d44f30
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-346/UnvalidatedCors.java
@@ -0,0 +1,45 @@
+import java.io.IOException;
+
+import javax.servlet.Filter;
+import javax.servlet.FilterChain;
+import javax.servlet.FilterConfig;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.commons.lang3.StringUtils;
+
+public class CorsFilter implements Filter {
+    public void init(FilterConfig filterConfig) throws ServletException {}
+
+    public void doFilter(ServletRequest req, ServletResponse res,
+            FilterChain chain) throws IOException, ServletException {
+        HttpServletRequest request = (HttpServletRequest) req;
+        HttpServletResponse response = (HttpServletResponse) res;
+        String url = request.getHeader("Origin");
+
+        if (!StringUtils.isEmpty(url)) {
+            String val = response.getHeader("Access-Control-Allow-Origin");
+
+            if (StringUtils.isEmpty(val)) {
+                response.addHeader("Access-Control-Allow-Origin", url); // BAD -> User controlled CORS header being set here.
+                response.addHeader("Access-Control-Allow-Credentials", "true");
+            }
+        }
+
+        if (!StringUtils.isEmpty(url)) {
+            List<String> checkorigins = Arrays.asList("www.example.com", "www.sub.example.com");
+
+            if (checkorigins.contains(url)) { // GOOD -> Origin is validated here.
+                response.addHeader("Access-Control-Allow-Origin", url);
+                response.addHeader("Access-Control-Allow-Credentials", "true");
+            }
+        }
+
+        chain.doFilter(req, res);
+    }
+
+    public void destroy() {}
+}
diff --git a/java/ql/src/experimental/Security/CWE/CWE-346/UnvalidatedCors.qhelp b/java/ql/src/experimental/Security/CWE/CWE-346/UnvalidatedCors.qhelp
new file mode 100644
index 00000000000..da98e896a60
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-346/UnvalidatedCors.qhelp
@@ -0,0 +1,76 @@
+<!DOCTYPE qhelp PUBLIC
+"-//Semmle//qhelp//EN"
+"qhelp.dtd">
+<qhelp>
+
+<overview>
+	<p>
+
+		A server can send the
+		<code>Access-Control-Allow-Credentials</code> CORS header to control
+		when a browser may send user credentials in Cross-Origin HTTP
+		requests.
+
+	</p>
+	<p>
+
+		When the <code>Access-Control-Allow-Credentials</code> header
+		is <code>true</code>, the <code>Access-Control-Allow-Origin</code>
+		header must have a value different from <code>*</code> in order
+		for browsers to accept the header. Therefore, to allow multiple origins
+		for cross-origin requests with credentials, the server must
+		dynamically compute the value of the
+		<code>Access-Control-Allow-Origin</code> header. Computing this
+		header value from information in the request to the server can
+		therefore potentially allow an attacker to control the origins that
+		the browser sends credentials to.
+
+	</p>
+
+
+
+</overview>
+
+<recommendation>
+	<p>
+
+		When the <code>Access-Control-Allow-Credentials</code> header
+		value is <code>true</code>, a dynamic computation of the
+		<code>Access-Control-Allow-Origin</code> header must involve
+		sanitization if it relies on user-controlled input.
+
+
+	</p>
+	<p>
+
+		Since the <code>null</code> origin is easy to obtain for an
+		attacker, it is never safe to use <code>null</code> as the value of
+		the <code>Access-Control-Allow-Origin</code> header when the
+		<code>Access-Control-Allow-Credentials</code> header value is
+		<code>true</code>.A null origin can be set by an attacker using a sandboxed iframe.
+		A more detailed explanation is available in the portswigger blogpost referenced below.
+
+	</p>
+</recommendation>
+
+<example>
+	<p>
+
+		In the example below, the server allows the browser to send
+		user credentials in a cross-origin request. The request header
+		<code>origins</code> controls the allowed origins for such a
+		Cross-Origin request.
+
+	</p>
+
+	<sample src="UnvalidatedCors.java"/>
+
+</example>
+
+<references>
+	<li>Mozilla Developer Network: <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin">CORS, Access-Control-Allow-Origin</a>.</li>
+	<li>Mozilla Developer Network: <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials">CORS, Access-Control-Allow-Credentials</a>.</li>
+	<li>PortSwigger: <a href="http://blog.portswigger.net/2016/10/exploiting-cors-misconfigurations-for.html">Exploiting CORS Misconfigurations for Bitcoins and Bounties</a></li>
+	<li>W3C: <a href="https://w3c.github.io/webappsec-cors-for-developers/#resources">CORS for developers, Advice for Resource Owners</a></li>
+</references>
+</qhelp>
diff --git a/java/ql/src/experimental/Security/CWE/CWE-346/UnvalidatedCors.ql b/java/ql/src/experimental/Security/CWE/CWE-346/UnvalidatedCors.ql
new file mode 100644
index 00000000000..c5a6c36d6a6
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-346/UnvalidatedCors.ql
@@ -0,0 +1,86 @@
+/**
+ * @name CORS is derived from untrusted input
+ * @description CORS header is derived from untrusted input, allowing a remote user to control which origins are trusted.
+ * @kind path-problem
+ * @problem.severity error
+ * @precision high
+ * @id java/unvalidated-cors-origin-set
+ * @tags security
+ *       external/cwe/cwe-346
+ */
+
+import java
+import semmle.code.java.dataflow.FlowSources
+import semmle.code.java.frameworks.Servlets
+import semmle.code.java.dataflow.TaintTracking
+import semmle.code.java.dataflow.TaintTracking2
+import DataFlow::PathGraph
+
+/**
+ *  Holds if `header` sets `Access-Control-Allow-Credentials` to `true`. This ensures fair chances of exploitability.
+ */
+private predicate setsAllowCredentials(MethodAccess header) {
+  (
+    header.getMethod() instanceof ResponseSetHeaderMethod or
+    header.getMethod() instanceof ResponseAddHeaderMethod
+  ) and
+  header.getArgument(0).(CompileTimeConstantExpr).getStringValue().toLowerCase() =
+    "access-control-allow-credentials" and
+  header.getArgument(1).(CompileTimeConstantExpr).getStringValue().toLowerCase() = "true"
+}
+
+private class CorsProbableCheckAccess extends MethodAccess {
+  CorsProbableCheckAccess() {
+    getMethod().hasName("contains") and
+    getMethod().getDeclaringType().getASourceSupertype*() instanceof CollectionType
+    or
+    getMethod().hasName("containsKey") and
+    getMethod().getDeclaringType().getASourceSupertype*() instanceof MapType
+    or
+    getMethod().hasName("equals") and
+    getQualifier().getType() instanceof TypeString
+  }
+}
+
+private Expr getAccessControlAllowOriginHeaderName() {
+  result.(CompileTimeConstantExpr).getStringValue().toLowerCase() = "access-control-allow-origin"
+}
+
+/**
+ * This taintflow2 configuration checks if there is a flow from source node towards CorsProbableCheckAccess methods.
+ */
+class CorsSourceReachesCheckConfig extends TaintTracking2::Configuration {
+  CorsSourceReachesCheckConfig() { this = "CorsOriginConfig" }
+
+  override predicate isSource(DataFlow::Node source) { any(CorsOriginConfig c).hasFlow(source, _) }
+
+  override predicate isSink(DataFlow::Node sink) {
+    sink.asExpr() = any(CorsProbableCheckAccess check).getAnArgument()
+  }
+}
+
+private class CorsOriginConfig extends TaintTracking::Configuration {
+  CorsOriginConfig() { this = "CorsOriginConfig" }
+
+  override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
+
+  override predicate isSink(DataFlow::Node sink) {
+    exists(MethodAccess corsHeader, MethodAccess allowCredentialsHeader |
+      (
+        corsHeader.getMethod() instanceof ResponseSetHeaderMethod or
+        corsHeader.getMethod() instanceof ResponseAddHeaderMethod
+      ) and
+      getAccessControlAllowOriginHeaderName() = corsHeader.getArgument(0) and
+      setsAllowCredentials(allowCredentialsHeader) and
+      corsHeader.getEnclosingCallable() = allowCredentialsHeader.getEnclosingCallable() and
+      sink.asExpr() = corsHeader.getArgument(1)
+    )
+  }
+}
+
+from
+  DataFlow::PathNode source, DataFlow::PathNode sink, CorsOriginConfig conf,
+  CorsSourceReachesCheckConfig sanconf
+where conf.hasFlowPath(source, sink) and not sanconf.hasFlow(source.getNode(), _)
+select sink.getNode(), source, sink, "CORS header is being set using user controlled value $@.",
+  source.getNode(), "user-provided value"
diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonStringLib.qll b/java/ql/src/experimental/Security/CWE/CWE-352/JsonStringLib.qll
new file mode 100644
index 00000000000..b8f1a13b119
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonStringLib.qll
@@ -0,0 +1,57 @@
+import java
+import semmle.code.java.dataflow.DataFlow
+import semmle.code.java.dataflow.FlowSources
+import DataFlow::PathGraph
+
+/** Json string type data. */
+abstract class JsonStringSource extends DataFlow::Node { }
+
+/**
+ * Convert to String using Gson library. *
+ *
+ * For example, in the method access `Gson.toJson(...)`,
+ * the `Object` type data is converted to the `String` type data.
+ */
+private class GsonString extends JsonStringSource {
+  GsonString() {
+    exists(MethodAccess ma, Method m | ma.getMethod() = m |
+      m.hasName("toJson") and
+      m.getDeclaringType().getASupertype*().hasQualifiedName("com.google.gson", "Gson") and
+      this.asExpr() = ma
+    )
+  }
+}
+
+/**
+ * Convert to String using Fastjson library.
+ *
+ * For example, in the method access `JSON.toJSONString(...)`,
+ * the `Object` type data is converted to the `String` type data.
+ */
+private class FastjsonString extends JsonStringSource {
+  FastjsonString() {
+    exists(MethodAccess ma, Method m | ma.getMethod() = m |
+      m.hasName("toJSONString") and
+      m.getDeclaringType().getASupertype*().hasQualifiedName("com.alibaba.fastjson", "JSON") and
+      this.asExpr() = ma
+    )
+  }
+}
+
+/**
+ * Convert to String using Jackson library.
+ *
+ * For example, in the method access `ObjectMapper.writeValueAsString(...)`,
+ * the `Object` type data is converted to the `String` type data.
+ */
+private class JacksonString extends JsonStringSource {
+  JacksonString() {
+    exists(MethodAccess ma, Method m | ma.getMethod() = m |
+      m.hasName("writeValueAsString") and
+      m.getDeclaringType()
+          .getASupertype*()
+          .hasQualifiedName("com.fasterxml.jackson.databind", "ObjectMapper") and
+      this.asExpr() = ma
+    )
+  }
+}
diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.java b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.java
new file mode 100644
index 00000000000..8f39efbc2b6
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.java
@@ -0,0 +1,161 @@
+import com.alibaba.fastjson.JSONObject;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.google.gson.Gson;
+import java.io.BufferedReader;
+import java.io.IOException;
+import java.io.InputStreamReader;
+import java.io.PrintWriter;
+import java.util.HashMap;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.multipart.MultipartFile;
+
+@Controller
+public class JsonpInjection {
+
+    private static HashMap hashMap = new HashMap();
+
+    static {
+        hashMap.put("username","admin");
+        hashMap.put("password","123456");
+    }
+
+    @GetMapping(value = "jsonp1")
+    @ResponseBody
+    public String bad1(HttpServletRequest request) {
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        Gson gson = new Gson();
+        String result = gson.toJson(hashMap);
+        resultStr = jsonpCallback + "(" + result + ")";
+        return resultStr;
+    }
+
+    @GetMapping(value = "jsonp2")
+    @ResponseBody
+    public String bad2(HttpServletRequest request) {
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        resultStr = jsonpCallback + "(" + JSONObject.toJSONString(hashMap) + ")";
+        return resultStr;
+    }
+
+    @GetMapping(value = "jsonp3")
+    @ResponseBody
+    public String bad3(HttpServletRequest request) {
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        String jsonStr = getJsonStr(hashMap);
+        resultStr = jsonpCallback + "(" + jsonStr + ")";
+        return resultStr;
+    }
+
+    @GetMapping(value = "jsonp4")
+    @ResponseBody
+    public String bad4(HttpServletRequest request) {
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        String restr = JSONObject.toJSONString(hashMap);
+        resultStr = jsonpCallback + "(" + restr + ");";
+        return resultStr;
+    }
+
+    @GetMapping(value = "jsonp5")
+    @ResponseBody
+    public void bad5(HttpServletRequest request,
+            HttpServletResponse response) throws Exception {
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        PrintWriter pw = null;
+        Gson gson = new Gson();
+        String result = gson.toJson(hashMap);
+        String resultStr = null;
+        pw = response.getWriter();
+        resultStr = jsonpCallback + "(" + result + ")";
+        pw.println(resultStr);
+    }
+
+    @GetMapping(value = "jsonp6")
+    @ResponseBody
+    public void bad6(HttpServletRequest request,
+            HttpServletResponse response) throws Exception {
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        PrintWriter pw = null;
+        ObjectMapper mapper = new ObjectMapper();
+        String result = mapper.writeValueAsString(hashMap);
+        String resultStr = null;
+        pw = response.getWriter();
+        resultStr = jsonpCallback + "(" + result + ")";
+        pw.println(resultStr);
+    }
+
+    @RequestMapping(value = "jsonp7", method = RequestMethod.GET)
+    @ResponseBody
+    public String bad7(HttpServletRequest request) {
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        Gson gson = new Gson();
+        String result = gson.toJson(hashMap);
+        resultStr = jsonpCallback + "(" + result + ")";
+        return resultStr;
+    }
+
+    @RequestMapping(value = "jsonp11")
+    @ResponseBody
+    public String good1(HttpServletRequest request) {
+        JSONObject parameterObj = readToJSONObect(request);
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        String restr = JSONObject.toJSONString(hashMap);
+        resultStr = jsonpCallback + "(" + restr + ");";
+        return resultStr;
+    }
+
+    @RequestMapping(value = "jsonp12")
+    @ResponseBody
+    public String good2(@RequestParam("file") MultipartFile file,HttpServletRequest request) {
+        if(null == file){
+            return "upload file error";
+        }
+        String fileName = file.getOriginalFilename();
+        System.out.println("file operations");
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        String restr = JSONObject.toJSONString(hashMap);
+        resultStr = jsonpCallback + "(" + restr + ");";
+        return resultStr;
+    }
+
+    public static JSONObject readToJSONObect(HttpServletRequest request){
+        String jsonText = readPostContent(request);
+        JSONObject jsonObj = JSONObject.parseObject(jsonText, JSONObject.class);
+        return jsonObj;
+    }
+
+    public static String readPostContent(HttpServletRequest request){
+        BufferedReader in= null;
+        String content = null;
+        String line = null;
+        try {
+            in = new BufferedReader(new InputStreamReader(request.getInputStream(),"UTF-8"));
+            StringBuilder buf = new StringBuilder();
+            while ((line = in.readLine()) != null) {
+                buf.append(line);
+            }
+            content = buf.toString();
+        } catch (IOException e) {
+            e.printStackTrace();
+        }
+        String uri = request.getRequestURI();
+        return content;
+    }
+
+    public static String getJsonStr(Object result) {
+        return JSONObject.toJSONString(result);
+    }
+}
\ No newline at end of file
diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp
new file mode 100644
index 00000000000..e8fb89d3989
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.qhelp
@@ -0,0 +1,37 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+<overview>
+<p>The software uses external input as the function name to wrap JSON data and returns it to the client as a request response. 
+When there is a cross-domain problem, this could lead to information leakage.</p>
+
+</overview>
+<recommendation>
+
+<p>Adding <code>Referer</code>/<code>Origin</code> or random <code>token</code> verification processing can effectively prevent the leakage of sensitive information.</p>
+
+</recommendation>
+<example>
+
+<p>The following examples show the bad case and the good case respectively. Bad cases, such as <code>bad1</code> to <code>bad7</code>, 
+will cause information leakage when there are cross-domain problems. In a good case, for example, in the <code>good1</code> 
+method and the <code>good2</code> method, When these two methods process the request, there must be a request body in the request, which does not meet the conditions of Jsonp injection.</p>
+
+<sample src="JsonpInjection.java" />
+
+</example>
+<references>
+
+<li>
+OWASPLondon20161124_JSON_Hijacking_Gareth_Heyes: 
+<a href="https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20161124_JSON_Hijacking_Gareth_Heyes.pdf">JSON hijacking</a>.
+</li>
+<li>
+Practical JSONP Injection:
+<a href="https://securitycafe.ro/2017/01/18/practical-jsonp-injection">
+  Completely controllable from the URL (GET variable)
+</a>.
+</li>
+</references>
+</qhelp>
diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql
new file mode 100644
index 00000000000..71ee842f162
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql
@@ -0,0 +1,45 @@
+/**
+ * @name JSONP Injection
+ * @description User-controlled callback function names that are not verified are vulnerable
+ *              to jsonp injection attacks.
+ * @kind path-problem
+ * @problem.severity error
+ * @precision high
+ * @id java/jsonp-injection
+ * @tags security
+ *       external/cwe/cwe-352
+ */
+
+import java
+import JsonpInjectionLib
+import semmle.code.java.dataflow.FlowSources
+import semmle.code.java.deadcode.WebEntryPoints
+import DataFlow::PathGraph
+
+/** Taint-tracking configuration tracing flow from get method request sources to output jsonp data. */
+class RequestResponseFlowConfig extends TaintTracking::Configuration {
+  RequestResponseFlowConfig() { this = "RequestResponseFlowConfig" }
+
+  override predicate isSource(DataFlow::Node source) {
+    source instanceof RemoteFlowSource and
+    any(RequestGetMethod m).polyCalls*(source.getEnclosingCallable())
+  }
+
+  override predicate isSink(DataFlow::Node sink) {
+    sink instanceof XssSink and
+    any(RequestGetMethod m).polyCalls*(sink.getEnclosingCallable())
+  }
+
+  override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
+    exists(MethodAccess ma |
+      isRequestGetParamMethod(ma) and pred.asExpr() = ma.getQualifier() and succ.asExpr() = ma
+    )
+  }
+}
+
+from DataFlow::PathNode source, DataFlow::PathNode sink, RequestResponseFlowConfig conf
+where
+  conf.hasFlowPath(source, sink) and
+  exists(JsonpInjectionFlowConfig jhfc | jhfc.hasFlowTo(sink.getNode()))
+select sink.getNode(), source, sink, "Jsonp response might include code from $@.", source.getNode(),
+  "this user input"
diff --git a/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
new file mode 100644
index 00000000000..6da4f87294a
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
@@ -0,0 +1,118 @@
+import java
+import DataFlow
+import JsonStringLib
+import semmle.code.java.security.XSS
+import semmle.code.java.dataflow.DataFlow
+import semmle.code.java.dataflow.DataFlow3
+import semmle.code.java.dataflow.FlowSources
+import semmle.code.java.frameworks.spring.SpringController
+
+/**
+ * A method that is called to handle an HTTP GET request.
+ */
+abstract class RequestGetMethod extends Method {
+  RequestGetMethod() {
+    not exists(MethodAccess ma |
+      // Exclude apparent GET handlers that read a request entity, because this likely indicates this is not in fact a GET handler.
+      // This is particularly a problem with Spring handlers, which can sometimes neglect to specify a request method.
+      // Even if it is in fact a GET handler, such a request method will be unusable in the context `<script src="...">`,
+      // which is the typical use-case for JSONP but cannot supply a request body.
+      ma.getMethod() instanceof ServletRequestGetBodyMethod and
+      this.polyCalls*(ma.getEnclosingCallable())
+    )
+  }
+}
+
+/** Override method of `doGet` of `Servlet` subclass. */
+private class ServletGetMethod extends RequestGetMethod {
+  ServletGetMethod() { isServletRequestMethod(this) and this.getName() = "doGet" }
+}
+
+/** The method of SpringController class processing `get` request. */
+abstract class SpringControllerGetMethod extends RequestGetMethod { }
+
+/** Method using `GetMapping` annotation in SpringController class. */
+class SpringControllerGetMappingGetMethod extends SpringControllerGetMethod {
+  SpringControllerGetMappingGetMethod() {
+    this.getAnAnnotation()
+        .getType()
+        .hasQualifiedName("org.springframework.web.bind.annotation", "GetMapping")
+  }
+}
+
+/** The method that uses the `RequestMapping` annotation in the SpringController class and only handles the get request. */
+class SpringControllerRequestMappingGetMethod extends SpringControllerGetMethod {
+  SpringControllerRequestMappingGetMethod() {
+    this.getAnAnnotation()
+        .getType()
+        .hasQualifiedName("org.springframework.web.bind.annotation", "RequestMapping") and
+    (
+      this.getAnAnnotation().getValue("method").(VarAccess).getVariable().getName() = "GET" or
+      this.getAnAnnotation().getValue("method").(ArrayInit).getSize() = 0 //Java code example: @RequestMapping(value = "test")
+    ) and
+    not this.getAParamType().getName() = "MultipartFile"
+  }
+}
+
+/**
+ * A concatenate expression using `(` and `)` or `);`.
+ *
+ * E.g: `functionName + "(" + json + ")"` or `functionName + "(" + json + ");"`
+ */
+class JsonpBuilderExpr extends AddExpr {
+  JsonpBuilderExpr() {
+    getRightOperand().(CompileTimeConstantExpr).getStringValue().regexpMatch("\\);?") and
+    getLeftOperand()
+        .(AddExpr)
+        .getLeftOperand()
+        .(AddExpr)
+        .getRightOperand()
+        .(CompileTimeConstantExpr)
+        .getStringValue() = "("
+  }
+
+  /** Get the jsonp function name of this expression. */
+  Expr getFunctionName() {
+    result = getLeftOperand().(AddExpr).getLeftOperand().(AddExpr).getLeftOperand()
+  }
+
+  /** Get the json data of this expression. */
+  Expr getJsonExpr() { result = getLeftOperand().(AddExpr).getRightOperand() }
+}
+
+/** A data flow configuration tracing flow from remote sources to jsonp function name. */
+class RemoteFlowConfig extends DataFlow2::Configuration {
+  RemoteFlowConfig() { this = "RemoteFlowConfig" }
+
+  override predicate isSource(DataFlow::Node src) { src instanceof RemoteFlowSource }
+
+  override predicate isSink(DataFlow::Node sink) {
+    exists(JsonpBuilderExpr jhe | jhe.getFunctionName() = sink.asExpr())
+  }
+}
+
+/** A data flow configuration tracing flow from json data into the argument `json` of JSONP-like string `someFunctionName + "(" + json + ")"`. */
+class JsonDataFlowConfig extends DataFlow2::Configuration {
+  JsonDataFlowConfig() { this = "JsonDataFlowConfig" }
+
+  override predicate isSource(DataFlow::Node src) { src instanceof JsonStringSource }
+
+  override predicate isSink(DataFlow::Node sink) {
+    exists(JsonpBuilderExpr jhe | jhe.getJsonExpr() = sink.asExpr())
+  }
+}
+
+/** Taint-tracking configuration tracing flow from probable jsonp data with a user-controlled function name to an outgoing HTTP entity. */
+class JsonpInjectionFlowConfig extends TaintTracking::Configuration {
+  JsonpInjectionFlowConfig() { this = "JsonpInjectionFlowConfig" }
+
+  override predicate isSource(DataFlow::Node src) {
+    exists(JsonpBuilderExpr jhe, JsonDataFlowConfig jdfc, RemoteFlowConfig rfc |
+      jhe = src.asExpr() and
+      jdfc.hasFlowTo(DataFlow::exprNode(jhe.getJsonExpr())) and
+      rfc.hasFlowTo(DataFlow::exprNode(jhe.getFunctionName()))
+    )
+  }
+
+  override predicate isSink(DataFlow::Node sink) { sink instanceof XssSink }
+}
diff --git a/java/ql/src/experimental/Security/CWE/CWE-489/EJBMain.ql b/java/ql/src/experimental/Security/CWE/CWE-489/EJBMain.ql
index 7723aea9ee2..6771311094b 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-489/EJBMain.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-489/EJBMain.ql
@@ -2,6 +2,8 @@
  * @name Main Method in Enterprise Java Bean
  * @description Java EE applications with a main method.
  * @kind problem
+ * @problem.severity warning
+ * @precision medium
  * @id java/main-method-in-enterprise-bean
  * @tags security
  *       external/cwe-489
diff --git a/java/ql/src/experimental/Security/CWE/CWE-489/WebComponentMain.ql b/java/ql/src/experimental/Security/CWE/CWE-489/WebComponentMain.ql
index bb96c726147..2a3dfcbd3ac 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-489/WebComponentMain.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-489/WebComponentMain.ql
@@ -2,6 +2,8 @@
  * @name Main Method in Java EE Web Components
  * @description Java EE web applications with a main method.
  * @kind problem
+ * @problem.severity warning
+ * @precision medium
  * @id java/main-method-in-web-components
  * @tags security
  *       external/cwe-489
diff --git a/java/ql/src/experimental/Security/CWE/CWE-502/SpringExporterUnsafeDeserialization.java b/java/ql/src/experimental/Security/CWE/CWE-502/SpringExporterUnsafeDeserialization.java
new file mode 100644
index 00000000000..a4c6dadf17c
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-502/SpringExporterUnsafeDeserialization.java
@@ -0,0 +1,24 @@
+@Configuration
+public class Server {
+
+    @Bean(name = "/account")
+    HttpInvokerServiceExporter accountService() {
+        HttpInvokerServiceExporter exporter = new HttpInvokerServiceExporter();
+        exporter.setService(new AccountServiceImpl());
+        exporter.setServiceInterface(AccountService.class);
+        return exporter;
+    }
+
+}
+
+class AccountServiceImpl implements AccountService {
+
+    @Override
+    public String echo(String data) {
+        return data;
+    }
+}
+
+interface AccountService {
+    String echo(String data);
+}
\ No newline at end of file
diff --git a/java/ql/src/experimental/Security/CWE/CWE-502/SpringExporterUnsafeDeserialization.xml b/java/ql/src/experimental/Security/CWE/CWE-502/SpringExporterUnsafeDeserialization.xml
new file mode 100644
index 00000000000..bf058cfffc1
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-502/SpringExporterUnsafeDeserialization.xml
@@ -0,0 +1,4 @@
+<bean name="/account" class="org.springframework.remoting.httpinvoker.HttpInvokerServiceExporter">
+    <property name="service" ref="accountService"/>
+    <property name="serviceInterface" value="AccountService"/>
+</bean>
\ No newline at end of file
diff --git a/java/ql/src/experimental/Security/CWE/CWE-502/UnsafeSpringExporterInConfigurationClass.qhelp b/java/ql/src/experimental/Security/CWE/CWE-502/UnsafeSpringExporterInConfigurationClass.qhelp
new file mode 100644
index 00000000000..8580092b8a1
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-502/UnsafeSpringExporterInConfigurationClass.qhelp
@@ -0,0 +1,8 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+  <include src="UnsafeSpringExporterQuery.inc.qhelp" />
+  <include src="UnsafeSpringExporterInConfigurationClassExample.inc.qhelp" />
+  <include src="UnsafeSpringExporterReferences.inc.qhelp" />
+</qhelp>
\ No newline at end of file
diff --git a/java/ql/src/experimental/Security/CWE/CWE-502/UnsafeSpringExporterInConfigurationClass.ql b/java/ql/src/experimental/Security/CWE/CWE-502/UnsafeSpringExporterInConfigurationClass.ql
new file mode 100644
index 00000000000..81b56ce0e52
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-502/UnsafeSpringExporterInConfigurationClass.ql
@@ -0,0 +1,58 @@
+/**
+ * @name Unsafe deserialization with Spring's remote service exporters.
+ * @description A Spring bean, which is based on RemoteInvocationSerializingExporter,
+ *              initializes an endpoint that uses ObjectInputStream to deserialize
+ *              incoming data. In the worst case, that may lead to remote code execution.
+ * @kind problem
+ * @problem.severity error
+ * @precision high
+ * @id java/unsafe-deserialization-spring-exporter-in-configuration-class
+ * @tags security
+ *       external/cwe/cwe-502
+ */
+
+import java
+import UnsafeSpringExporterLib
+
+/**
+ * Holds if `type` is a Spring configuration that declares beans.
+ */
+private predicate isConfiguration(RefType type) {
+  type.hasAnnotation("org.springframework.context.annotation", "Configuration") or
+  isConfigurationAnnotation(type.getAnAnnotation())
+}
+
+/**
+ * Holds if `annotation` is a Java annotations that declares a Spring configuration.
+ */
+private predicate isConfigurationAnnotation(Annotation annotation) {
+  isConfiguration(annotation.getType()) or
+  isConfigurationAnnotation(annotation.getType().getAnAnnotation())
+}
+
+/**
+ * A method that initializes a unsafe bean based on `RemoteInvocationSerializingExporter`.
+ */
+private class UnsafeBeanInitMethod extends Method {
+  string identifier;
+
+  UnsafeBeanInitMethod() {
+    isRemoteInvocationSerializingExporter(this.getReturnType()) and
+    isConfiguration(this.getDeclaringType()) and
+    exists(Annotation a | this.getAnAnnotation() = a |
+      a.getType().hasQualifiedName("org.springframework.context.annotation", "Bean") and
+      if a.getValue("name") instanceof StringLiteral
+      then identifier = a.getValue("name").(StringLiteral).getRepresentedString()
+      else identifier = this.getName()
+    )
+  }
+
+  /**
+   * Gets this bean's name if given by the `Bean` annotation, or this method's identifier otherwise.
+   */
+  string getBeanIdentifier() { result = identifier }
+}
+
+from UnsafeBeanInitMethod method
+select method,
+  "Unsafe deserialization in a Spring exporter bean '" + method.getBeanIdentifier() + "'"
diff --git a/java/ql/src/experimental/Security/CWE/CWE-502/UnsafeSpringExporterInConfigurationClassExample.inc.qhelp b/java/ql/src/experimental/Security/CWE/CWE-502/UnsafeSpringExporterInConfigurationClassExample.inc.qhelp
new file mode 100644
index 00000000000..ed33a03fabe
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-502/UnsafeSpringExporterInConfigurationClassExample.inc.qhelp
@@ -0,0 +1,14 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+
+<example>
+<p>
+The following example shows how a vulnerable HTTP endpoint can be defined
+using <code>HttpInvokerServiceExporter</code> and Spring annotations:
+</p>
+<sample src="SpringExporterUnsafeDeserialization.java" />
+</example>
+
+</qhelp>
\ No newline at end of file
diff --git a/java/ql/src/experimental/Security/CWE/CWE-502/UnsafeSpringExporterInXMLConfiguration.qhelp b/java/ql/src/experimental/Security/CWE/CWE-502/UnsafeSpringExporterInXMLConfiguration.qhelp
new file mode 100644
index 00000000000..76dda5842b3
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-502/UnsafeSpringExporterInXMLConfiguration.qhelp
@@ -0,0 +1,8 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+  <include src="UnsafeSpringExporterQuery.inc.qhelp" />
+  <include src="UnsafeSpringExporterInXMLConfigurationExample.inc.qhelp" />
+  <include src="UnsafeSpringExporterReferences.inc.qhelp" />
+</qhelp>
\ No newline at end of file
diff --git a/java/ql/src/experimental/Security/CWE/CWE-502/UnsafeSpringExporterInXMLConfiguration.ql b/java/ql/src/experimental/Security/CWE/CWE-502/UnsafeSpringExporterInXMLConfiguration.ql
new file mode 100644
index 00000000000..d7606587df3
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-502/UnsafeSpringExporterInXMLConfiguration.ql
@@ -0,0 +1,20 @@
+/**
+ * @name Unsafe deserialization with Spring's remote service exporters.
+ * @description A Spring bean, which is based on RemoteInvocationSerializingExporter,
+ *              initializes an endpoint that uses ObjectInputStream to deserialize
+ *              incoming data. In the worst case, that may lead to remote code execution.
+ * @kind problem
+ * @problem.severity error
+ * @precision high
+ * @id java/unsafe-deserialization-spring-exporter-in-xml-configuration
+ * @tags security
+ *       external/cwe/cwe-502
+ */
+
+import java
+import semmle.code.java.frameworks.spring.SpringBean
+import UnsafeSpringExporterLib
+
+from SpringBean bean
+where isRemoteInvocationSerializingExporter(bean.getClass())
+select bean, "Unsafe deserialization in a Spring exporter bean '" + bean.getBeanIdentifier() + "'"
diff --git a/java/ql/src/experimental/Security/CWE/CWE-502/UnsafeSpringExporterInXMLConfigurationExample.inc.qhelp b/java/ql/src/experimental/Security/CWE/CWE-502/UnsafeSpringExporterInXMLConfigurationExample.inc.qhelp
new file mode 100644
index 00000000000..bc18f4dc233
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-502/UnsafeSpringExporterInXMLConfigurationExample.inc.qhelp
@@ -0,0 +1,13 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+
+<example>
+<p>
+The following examples shows how a vulnerable HTTP endpoint can be defined in a Spring XML config:
+</p>
+<sample src="SpringExporterUnsafeDeserialization.xml" />
+</example>
+
+</qhelp>
\ No newline at end of file
diff --git a/java/ql/src/experimental/Security/CWE/CWE-502/UnsafeSpringExporterLib.qll b/java/ql/src/experimental/Security/CWE/CWE-502/UnsafeSpringExporterLib.qll
new file mode 100644
index 00000000000..f49ee44304f
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-502/UnsafeSpringExporterLib.qll
@@ -0,0 +1,9 @@
+import java
+
+/**
+ * Holds if `type` is `RemoteInvocationSerializingExporter`.
+ */
+predicate isRemoteInvocationSerializingExporter(RefType type) {
+  type.getASupertype*()
+      .hasQualifiedName("org.springframework.remoting.rmi", "RemoteInvocationSerializingExporter")
+}
diff --git a/java/ql/src/experimental/Security/CWE/CWE-502/UnsafeSpringExporterQuery.inc.qhelp b/java/ql/src/experimental/Security/CWE/CWE-502/UnsafeSpringExporterQuery.inc.qhelp
new file mode 100644
index 00000000000..732c5c7e545
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-502/UnsafeSpringExporterQuery.inc.qhelp
@@ -0,0 +1,41 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+
+<overview>
+<p>
+The Spring Framework provides an abstract base class <code>RemoteInvocationSerializingExporter</code>
+for creating remote service exporters.
+A Spring exporter, which is based on this class, deserializes incoming data using <code>ObjectInputStream</code>.
+Deserializing untrusted data is easily exploitable and in many cases allows an attacker
+to execute arbitrary code.
+</p>
+<p>
+The Spring Framework also provides <code>HttpInvokerServiceExporter</code>
+and <code>SimpleHttpInvokerServiceExporter</code> classes
+that extend <code>RemoteInvocationSerializingExporter</code>.
+</p>
+<p>
+These classes export specified beans as HTTP endpoints that deserialize data from an HTTP request
+using unsafe <code>ObjectInputStream</code>. If a remote attacker can reach such endpoints,
+it results in remote code execution in the worst case.
+</p>
+<p>
+CVE-2016-1000027 has been assigned to this issue in the Spring Framework.
+It is regarded as a design limitation, and can be mitigated but not fixed outright.
+</p>
+</overview>
+
+<recommendation>
+<p>
+Avoid using <code>HttpInvokerServiceExporter</code>, <code>SimpleHttpInvokerServiceExporter</code>
+and any other exporter that is based on <code>RemoteInvocationSerializingExporter</code>.
+Instead, use other message formats for API endpoints (for example, JSON),
+but make sure that the underlying deserialization mechanism is properly configured
+so that deserialization attacks are not possible. If the vulnerable exporters can not be replaced,
+consider using global deserialization filters introduced in JEP 290.
+</p>
+</recommendation>
+
+</qhelp>
\ No newline at end of file
diff --git a/java/ql/src/experimental/Security/CWE/CWE-502/UnsafeSpringExporterReferences.inc.qhelp b/java/ql/src/experimental/Security/CWE/CWE-502/UnsafeSpringExporterReferences.inc.qhelp
new file mode 100644
index 00000000000..94d269e35d0
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-502/UnsafeSpringExporterReferences.inc.qhelp
@@ -0,0 +1,37 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+
+<references>
+<li>
+OWASP:
+<a href="https://www.owasp.org/index.php/Deserialization_of_untrusted_data">Deserialization of untrusted data</a>.
+</li>
+<li>
+Spring Framework API documentation:
+<a href="https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/remoting/rmi/RemoteInvocationSerializingExporter.html">RemoteInvocationSerializingExporter class</a>
+</li>
+<li>
+Spring Framework API documentation:
+<a href="https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/remoting/httpinvoker/HttpInvokerServiceExporter.html">HttpInvokerServiceExporter class</a>
+</li>
+<li>
+National Vulnerability Database:
+<a href="https://nvd.nist.gov/vuln/detail/CVE-2016-1000027">CVE-2016-1000027</a>
+</li>
+<li>
+Tenable Research Advisory:
+<a href="https://www.tenable.com/security/research/tra-2016-20">[R2] Pivotal Spring Framework HttpInvokerServiceExporter readRemoteInvocation Method Untrusted Java Deserialization</a>
+</li>
+<li>
+Spring Framework bug tracker:
+<a href="https://github.com/spring-projects/spring-framework/issues/24434">Sonatype vulnerability CVE-2016-1000027 in Spring-web project</a>  
+</li>
+<li>
+OpenJDK:
+<a href="https://openjdk.java.net/jeps/290">JEP 290: Filter Incoming Serialization Data</a>
+</li>
+</references>
+
+</qhelp>
\ No newline at end of file
diff --git a/java/ql/src/experimental/Security/CWE/CWE-522/InsecureBasicAuth.ql b/java/ql/src/experimental/Security/CWE/CWE-522/InsecureBasicAuth.ql
index 3ec836a0117..97d2f6dad33 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-522/InsecureBasicAuth.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-522/InsecureBasicAuth.ql
@@ -1,7 +1,12 @@
 /**
  * @name Insecure basic authentication
- * @description Basic authentication only obfuscates username/password in Base64 encoding, which can be easily recognized and reversed. Transmission of sensitive information not over HTTPS is vulnerable to packet sniffing.
+ * @description Basic authentication only obfuscates username/password in
+ *              Base64 encoding, which can be easily recognized and reversed.
+ *              Transmission of sensitive information not over HTTPS is
+ *              vulnerable to packet sniffing.
  * @kind path-problem
+ * @problem.severity warning
+ * @precision medium
  * @id java/insecure-basic-auth
  * @tags security
  *       external/cwe-522
diff --git a/java/ql/src/experimental/Security/CWE/CWE-522/InsecureLdapAuth.ql b/java/ql/src/experimental/Security/CWE/CWE-522/InsecureLdapAuth.ql
index 8411a128c9c..4ce2b8b7134 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-522/InsecureLdapAuth.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-522/InsecureLdapAuth.ql
@@ -2,6 +2,8 @@
  * @name Insecure LDAP authentication
  * @description LDAP authentication with credentials sent in cleartext.
  * @kind path-problem
+ * @problem.severity warning
+ * @precision medium
  * @id java/insecure-ldap-auth
  * @tags security
  *       external/cwe-522
diff --git a/java/ql/src/experimental/Security/CWE/CWE-532/SensitiveInfoLog.ql b/java/ql/src/experimental/Security/CWE/CWE-532/SensitiveInfoLog.ql
index 15690b7c32b..968009d6fa1 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-532/SensitiveInfoLog.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-532/SensitiveInfoLog.ql
@@ -1,8 +1,11 @@
 /**
- * @id java/sensitiveinfo-in-logfile
  * @name Insertion of sensitive information into log files
- * @description Writing sensitive information to log files can give valuable guidance to an attacker or expose sensitive user information.
+ * @description Writing sensitive information to log files can give valuable
+ *              guidance to an attacker or expose sensitive user information.
  * @kind path-problem
+ * @problem.severity warning
+ * @precision medium
+ * @id java/sensitiveinfo-in-logfile
  * @tags security
  *       external/cwe-532
  */
@@ -10,6 +13,7 @@
 import java
 import semmle.code.java.dataflow.TaintTracking
 import semmle.code.java.security.SensitiveActions
+import experimental.semmle.code.java.Logging
 import DataFlow
 import PathGraph
 
@@ -27,38 +31,14 @@ class CredentialExpr extends Expr {
   }
 }
 
-/** Class of popular logging utilities * */
-class LoggerType extends RefType {
-  LoggerType() {
-    this.hasQualifiedName("org.apache.log4j", "Category") or //Log4J
-    this.hasQualifiedName("org.apache.logging.log4j", "Logger") or //Log4J 2
-    this.hasQualifiedName("org.slf4j", "Logger") or //SLF4j and Gradle Logging
-    this.hasQualifiedName("org.jboss.logging", "BasicLogger") or //JBoss Logging
-    this.hasQualifiedName("org.jboss.logging", "Logger") or //JBoss Logging (`org.jboss.logging.Logger` in some implementations like JBoss Application Server 4.0.4 did not implement `BasicLogger`)
-    this.hasQualifiedName("org.apache.commons.logging", "Log") or //Apache Commons Logging
-    this.hasQualifiedName("org.scijava.log", "Logger") //SciJava Logging
-  }
-}
-
-predicate isSensitiveLoggingSink(DataFlow::Node sink) {
-  exists(MethodAccess ma |
-    ma.getMethod().getDeclaringType() instanceof LoggerType and
-    (
-      ma.getMethod().hasName("debug") or
-      ma.getMethod().hasName("trace") or
-      ma.getMethod().hasName("debugf") or
-      ma.getMethod().hasName("debugv")
-    ) and //Check low priority log levels which are more likely to be real issues to reduce false positives
-    sink.asExpr() = ma.getAnArgument()
-  )
-}
-
 class LoggerConfiguration extends DataFlow::Configuration {
   LoggerConfiguration() { this = "Logger Configuration" }
 
   override predicate isSource(DataFlow::Node source) { source.asExpr() instanceof CredentialExpr }
 
-  override predicate isSink(DataFlow::Node sink) { isSensitiveLoggingSink(sink) }
+  override predicate isSink(DataFlow::Node sink) {
+    exists(LoggingCall c | sink.asExpr() = c.getALogArgument())
+  }
 
   override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
     TaintTracking::localTaintStep(node1, node2)
diff --git a/java/ql/src/experimental/Security/CWE/CWE-548/InsecureDirectoryConfig.ql b/java/ql/src/experimental/Security/CWE/CWE-548/InsecureDirectoryConfig.ql
index 08a456137d0..912df87c0b7 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-548/InsecureDirectoryConfig.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-548/InsecureDirectoryConfig.ql
@@ -1,7 +1,12 @@
 /**
  * @name Directories and files exposure
- * @description A directory listing provides an attacker with the complete index of all the resources located inside of the complete web directory, which could yield files containing sensitive information like source code and credentials to the attacker.
+ * @description A directory listing provides an attacker with the complete
+ *              index of all the resources located inside of the complete web
+ *              directory, which could yield files containing sensitive
+ *              information like source code and credentials to the attacker.
  * @kind problem
+ * @problem.severity warning
+ * @precision medium
  * @id java/server-directory-listing
  * @tags security
  *       external/cwe-548
diff --git a/java/ql/src/experimental/Security/CWE/CWE-555/CredentialsInPropertiesFile.qhelp b/java/ql/src/experimental/Security/CWE/CWE-555/CredentialsInPropertiesFile.qhelp
new file mode 100644
index 00000000000..5549f188f1f
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-555/CredentialsInPropertiesFile.qhelp
@@ -0,0 +1,45 @@
+<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
+<qhelp>
+  <overview>
+    <p>
+      Credentials management issues occur when credentials are stored in plaintext in 
+      an application's properties file. Common credentials include but are not limited 
+      to LDAP, mail, database, proxy account, and so on. Storing plaintext credentials 
+      in a properties file allows anyone who can read the file access to the protected 
+      resource. Good credentials management guidelines require that credentials never 
+      be stored in plaintext.
+    </p>
+  </overview>
+
+  <recommendation>
+    <p>
+      Credentials stored in properties files should be encrypted and recycled regularly. 
+      In a Java EE deployment scenario, utilities provided by application servers like 
+      keystores and password vaults can be used to encrypt and manage credentials.
+    </p>
+  </recommendation>
+
+  <example>
+    <p>
+      In the first example, the credentials for the LDAP and datasource properties are stored 
+      in cleartext in the properties file.
+    </p>
+
+    <p>
+      In the second example, the credentials for the LDAP and datasource properties are stored
+      in an encrypted format.
+    </p>
+    <sample src="configuration.properties" />
+  </example>
+
+  <references>
+    <li>
+      OWASP:
+      <a href="https://owasp.org/www-community/vulnerabilities/Password_Plaintext_Storage">Password Plaintext Storage</a>
+    </li>
+    <li>
+      Medium (Rajeev Shukla):
+      <a href="https://medium.com/@mail2rajeevshukla/hiding-encrypting-database-password-in-the-application-properties-34d59fe104eb">Encrypting database password in the application.properties file</a>
+    </li>
+  </references>
+</qhelp>
diff --git a/java/ql/src/experimental/Security/CWE/CWE-555/CredentialsInPropertiesFile.ql b/java/ql/src/experimental/Security/CWE/CWE-555/CredentialsInPropertiesFile.ql
new file mode 100644
index 00000000000..d4ebe902cf7
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-555/CredentialsInPropertiesFile.ql
@@ -0,0 +1,34 @@
+/**
+ * @name Cleartext Credentials in Properties File
+ * @description Finds cleartext credentials in Java properties files.
+ * @kind problem
+ * @id java/credentials-in-properties
+ * @tags security
+ *       external/cwe/cwe-555
+ *       external/cwe/cwe-256
+ *       external/cwe/cwe-260
+ */
+
+/*
+ * Note this query requires properties files to be indexed before it can produce results.
+ * If creating your own database with the CodeQL CLI, you should run
+ * `codeql database index-files --language=properties ...`
+ * If using lgtm.com, you should add `properties_files: true` to the index block of your
+ * lgtm.yml file (see https://lgtm.com/help/lgtm/java-extraction#customizing-index)
+ */
+
+import java
+import experimental.semmle.code.java.frameworks.CredentialsInPropertiesFile
+
+/**
+ * Holds if the credentials are in a non-production properties file indicated by:
+ *    a) in a non-production directory
+ *    b) with a non-production file name
+ */
+predicate isNonProdCredentials(CredentialsConfig cc) {
+  cc.getFile().getAbsolutePath().matches(["%dev%", "%test%", "%sample%"])
+}
+
+from CredentialsConfig cc
+where not isNonProdCredentials(cc)
+select cc, cc.getConfigDesc()
diff --git a/java/ql/src/experimental/Security/CWE/CWE-555/PasswordInConfigurationFile.ql b/java/ql/src/experimental/Security/CWE/CWE-555/PasswordInConfigurationFile.ql
index a8ed7ec538e..a50b02a908f 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-555/PasswordInConfigurationFile.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-555/PasswordInConfigurationFile.ql
@@ -2,6 +2,8 @@
  * @name Password in configuration file
  * @description Finds passwords in configuration files.
  * @kind problem
+ * @problem.severity warning
+ * @precision medium
  * @id java/password-in-configuration
  * @tags security
  *       external/cwe/cwe-555
diff --git a/java/ql/src/experimental/Security/CWE/CWE-555/configuration.properties b/java/ql/src/experimental/Security/CWE/CWE-555/configuration.properties
new file mode 100644
index 00000000000..55e8b0d86da
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-555/configuration.properties
@@ -0,0 +1,26 @@
+#***************************** LDAP Credentials *****************************************#
+ 
+ldap.ldapHost = ldap.example.com
+ldap.ldapPort = 636
+ldap.loginDN = cn=Directory Manager
+
+#### BAD: LDAP credentials are stored in cleartext #### 
+ldap.password = mysecpass
+
+#### GOOD: LDAP credentials are stored in the encrypted format #### 
+ldap.password = eFRZ3Cqo5zDJWMYLiaEupw==
+
+ldap.domain1 = example
+ldap.domain2 = com
+ldap.url= ldaps://ldap.example.com:636/dc=example,dc=com
+
+#*************************** MS SQL Database Connection **********************************# 
+datasource1.driverClassName = com.microsoft.sqlserver.jdbc.SQLServerDriver
+datasource1.url = jdbc:sqlserver://ms.example.com\\exampledb:1433;
+datasource1.username = sa
+
+#### BAD: Datasource credentials are stored in cleartext #### 
+datasource1.password = Passw0rd@123
+
+#### GOOD: Datasource credentials are stored in the encrypted format #### 
+datasource1.password = VvOgflYS1EUzJdVNDoBcnA==
diff --git a/java/ql/src/experimental/Security/CWE/CWE-598/SensitiveGetQuery.ql b/java/ql/src/experimental/Security/CWE/CWE-598/SensitiveGetQuery.ql
index bc9850cfddb..a9528ee2f9b 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-598/SensitiveGetQuery.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-598/SensitiveGetQuery.ql
@@ -2,6 +2,8 @@
  * @name Sensitive GET Query
  * @description Use of GET request method with sensitive query strings.
  * @kind path-problem
+ * @problem.severity warning
+ * @precision medium
  * @id java/sensitive-query-with-get
  * @tags security
  *       external/cwe-598
diff --git a/java/ql/src/experimental/Security/CWE/CWE-600/UncaughtServletException.ql b/java/ql/src/experimental/Security/CWE/CWE-600/UncaughtServletException.ql
index 1cab7856672..f3472e97be0 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-600/UncaughtServletException.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-600/UncaughtServletException.ql
@@ -1,7 +1,12 @@
 /**
  * @name Uncaught Servlet Exception
- * @description Uncaught exceptions in a servlet could leave a system in an unexpected state, possibly resulting in denial-of-service attacks or the exposure of sensitive information disclosed in stack traces.
+ * @description Uncaught exceptions in a servlet could leave a system in an
+ *              unexpected state, possibly resulting in denial-of-service
+ *              attacks or the exposure of sensitive information disclosed in
+ *              stack traces.
  * @kind path-problem
+ * @problem.severity warning
+ * @precision medium
  * @id java/uncaught-servlet-exception
  * @tags security
  *       external/cwe-600
diff --git a/java/ql/src/experimental/Security/CWE/CWE-652/XQueryInjection.java b/java/ql/src/experimental/Security/CWE/CWE-652/XQueryInjection.java
new file mode 100644
index 00000000000..1b6be030249
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-652/XQueryInjection.java
@@ -0,0 +1,70 @@
+import javax.servlet.http.HttpServletRequest;
+import javax.xml.namespace.QName;
+import javax.xml.xquery.XQConnection;
+import javax.xml.xquery.XQDataSource;
+import javax.xml.xquery.XQException;
+import javax.xml.xquery.XQItemType;
+import javax.xml.xquery.XQPreparedExpression;
+import javax.xml.xquery.XQResultSequence;
+import net.sf.saxon.xqj.SaxonXQDataSource;
+
+public void bad(HttpServletRequest request) throws XQException {
+    String name = request.getParameter("name");
+    XQDataSource ds = new SaxonXQDataSource();
+    XQConnection conn = ds.getConnection();
+    String query = "for $user in doc(\"users.xml\")/Users/User[name='" + name + "'] return $user/password";
+    XQPreparedExpression xqpe = conn.prepareExpression(query);
+    XQResultSequence result = xqpe.executeQuery();
+    while (result.next()){
+        System.out.println(result.getItemAsString(null));
+    }
+}
+
+public void bad1(HttpServletRequest request) throws XQException {
+    String name = request.getParameter("name");
+    XQDataSource xqds = new SaxonXQDataSource();
+    String query = "for $user in doc(\"users.xml\")/Users/User[name='" + name + "'] return $user/password";
+    XQConnection conn = xqds.getConnection();
+    XQExpression expr = conn.createExpression();
+    XQResultSequence result = expr.executeQuery(query);
+    while (result.next()){
+        System.out.println(result.getItemAsString(null));
+    }
+}
+
+public void bad2(HttpServletRequest request) throws XQException {
+    String name = request.getParameter("name");
+    XQDataSource xqds = new SaxonXQDataSource();
+    XQConnection conn = xqds.getConnection();
+    XQExpression expr = conn.createExpression();
+    //bad code
+    expr.executeCommand(name);
+}
+
+public void good(HttpServletRequest request) throws XQException {
+    String name = request.getParameter("name");
+    XQDataSource ds = new SaxonXQDataSource();
+    XQConnection conn = ds.getConnection();
+    String query = "declare variable $name as xs:string external;"
+            + " for $user in doc(\"users.xml\")/Users/User[name=$name] return $user/password";
+    XQPreparedExpression xqpe = conn.prepareExpression(query);
+    xqpe.bindString(new QName("name"), name, conn.createAtomicType(XQItemType.XQBASETYPE_STRING));
+    XQResultSequence result = xqpe.executeQuery();
+    while (result.next()){
+        System.out.println(result.getItemAsString(null));
+    }
+}
+
+public void good1(HttpServletRequest request) throws XQException {
+    String name = request.getParameter("name");
+    String query = "declare variable $name as xs:string external;"
+            + " for $user in doc(\"users.xml\")/Users/User[name=$name] return $user/password";
+    XQDataSource xqds = new SaxonXQDataSource();
+    XQConnection conn = xqds.getConnection();
+    XQExpression expr = conn.createExpression();
+    expr.bindString(new QName("name"), name, conn.createAtomicType(XQItemType.XQBASETYPE_STRING));
+    XQResultSequence result = expr.executeQuery(query);
+    while (result.next()){
+        System.out.println(result.getItemAsString(null));
+    }
+}
\ No newline at end of file
diff --git a/java/ql/src/experimental/Security/CWE/CWE-652/XQueryInjection.qhelp b/java/ql/src/experimental/Security/CWE/CWE-652/XQueryInjection.qhelp
new file mode 100644
index 00000000000..1ca6e780627
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-652/XQueryInjection.qhelp
@@ -0,0 +1,33 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+<overview>
+<p>The software uses external input to dynamically construct an XQuery expression which is then used to retrieve data from an XML database. 
+However, the input is not neutralized, or is incorrectly neutralized, which allows an attacker to control the structure of the query.</p>
+
+</overview>
+<recommendation>
+
+<p>Use parameterized queries. This will help ensure the program retains control of the query structure.</p>
+
+</recommendation>
+<example>
+
+<p>The following example compares building a query by string concatenation (bad) vs. using  <code>bindString</code> to parameterize the query (good).</p>
+
+<sample src="XQueryInjection.java" />
+
+</example>
+<references>
+
+<li>Balisage: 
+<a href="https://www.balisage.net/Proceedings/vol7/html/Vlist02/BalisageVol7-Vlist02.html">XQuery Injection</a>.</li>
+
+
+
+<!--  LocalWords:  CWE
+ -->
+
+</references>
+</qhelp>
diff --git a/java/ql/src/experimental/Security/CWE/CWE-652/XQueryInjection.ql b/java/ql/src/experimental/Security/CWE/CWE-652/XQueryInjection.ql
new file mode 100644
index 00000000000..0bb85272f08
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-652/XQueryInjection.ql
@@ -0,0 +1,43 @@
+/**
+ * @name XQuery query built from user-controlled sources
+ * @description Building an XQuery query from user-controlled sources is vulnerable to insertion of
+ *              malicious XQuery code by the user.
+ * @kind path-problem
+ * @problem.severity error
+ * @precision high
+ * @id java/xquery-injection
+ * @tags security
+ *       external/cwe/cwe-652
+ */
+
+import java
+import semmle.code.java.dataflow.FlowSources
+import XQueryInjectionLib
+import DataFlow::PathGraph
+
+/**
+ * A taint-tracking configuration tracing flow from remote sources, through an XQuery parser, to its eventual execution.
+ */
+class XQueryInjectionConfig extends TaintTracking::Configuration {
+  XQueryInjectionConfig() { this = "XQueryInjectionConfig" }
+
+  override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
+
+  override predicate isSink(DataFlow::Node sink) {
+    sink.asExpr() = any(XQueryPreparedExecuteCall xpec).getPreparedExpression() or
+    sink.asExpr() = any(XQueryExecuteCall xec).getExecuteQueryArgument() or
+    sink.asExpr() = any(XQueryExecuteCommandCall xecc).getExecuteCommandArgument()
+  }
+
+  /**
+   * Holds if taint from the input `pred` to a `prepareExpression` call flows to the returned prepared expression `succ`.
+   */
+  override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
+    exists(XQueryParserCall parser | pred.asExpr() = parser.getInput() and succ.asExpr() = parser)
+  }
+}
+
+from DataFlow::PathNode source, DataFlow::PathNode sink, XQueryInjectionConfig conf
+where conf.hasFlowPath(source, sink)
+select sink.getNode(), source, sink, "XQuery query might include code from $@.", source.getNode(),
+  "this user input"
diff --git a/java/ql/src/experimental/Security/CWE/CWE-652/XQueryInjectionLib.qll b/java/ql/src/experimental/Security/CWE/CWE-652/XQueryInjectionLib.qll
new file mode 100644
index 00000000000..2a4019f2c9a
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-652/XQueryInjectionLib.qll
@@ -0,0 +1,68 @@
+import java
+
+/** A call to `XQConnection.prepareExpression`. */
+class XQueryParserCall extends MethodAccess {
+  XQueryParserCall() {
+    exists(Method m |
+      this.getMethod() = m and
+      m.getDeclaringType()
+          .getASourceSupertype*()
+          .hasQualifiedName("javax.xml.xquery", "XQConnection") and
+      m.hasName("prepareExpression")
+    )
+  }
+
+  /**
+   * Returns the first parameter of the `prepareExpression` method, which provides
+   * the string, stream or reader to be compiled into a prepared expression.
+   */
+  Expr getInput() { result = this.getArgument(0) }
+}
+
+/** A call to `XQPreparedExpression.executeQuery`. */
+class XQueryPreparedExecuteCall extends MethodAccess {
+  XQueryPreparedExecuteCall() {
+    exists(Method m |
+      this.getMethod() = m and
+      m.hasName("executeQuery") and
+      m.getDeclaringType()
+          .getASourceSupertype*()
+          .hasQualifiedName("javax.xml.xquery", "XQPreparedExpression")
+    )
+  }
+
+  /** Return this prepared expression. */
+  Expr getPreparedExpression() { result = this.getQualifier() }
+}
+
+/** A call to `XQExpression.executeQuery`. */
+class XQueryExecuteCall extends MethodAccess {
+  XQueryExecuteCall() {
+    exists(Method m |
+      this.getMethod() = m and
+      m.hasName("executeQuery") and
+      m.getDeclaringType()
+          .getASourceSupertype*()
+          .hasQualifiedName("javax.xml.xquery", "XQExpression")
+    )
+  }
+
+  /** Return this execute query argument. */
+  Expr getExecuteQueryArgument() { result = this.getArgument(0) }
+}
+
+/** A call to `XQExpression.executeCommand`. */
+class XQueryExecuteCommandCall extends MethodAccess {
+  XQueryExecuteCommandCall() {
+    exists(Method m |
+      this.getMethod() = m and
+      m.hasName("executeCommand") and
+      m.getDeclaringType()
+          .getASourceSupertype*()
+          .hasQualifiedName("javax.xml.xquery", "XQExpression")
+    )
+  }
+
+  /** Return this execute command argument. */
+  Expr getExecuteCommandArgument() { result = this.getArgument(0) }
+}
diff --git a/java/ql/src/experimental/Security/CWE/CWE-749/UnsafeAndroidAccess.ql b/java/ql/src/experimental/Security/CWE/CWE-749/UnsafeAndroidAccess.ql
index bd69eecf2c4..24755e64f13 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-749/UnsafeAndroidAccess.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-749/UnsafeAndroidAccess.ql
@@ -1,8 +1,11 @@
 /**
  * @name Unsafe resource fetching in Android webview
- * @id java/android/unsafe-android-webview-fetch
- * @description JavaScript rendered inside WebViews can access any protected application file and web resource from any origin
+ * @description JavaScript rendered inside WebViews can access any protected
+ *              application file and web resource from any origin
  * @kind path-problem
+ * @problem.severity warning
+ * @precision medium
+ * @id java/android/unsafe-android-webview-fetch
  * @tags security
  *       external/cwe/cwe-749
  *       external/cwe/cwe-079
diff --git a/java/ql/src/experimental/Security/CWE/CWE-755/NFEAndroidDoS.ql b/java/ql/src/experimental/Security/CWE/CWE-755/NFEAndroidDoS.ql
index 879399be26c..b737c460fa9 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-755/NFEAndroidDoS.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-755/NFEAndroidDoS.ql
@@ -1,8 +1,13 @@
 /**
  * @name Local Android DoS Caused By NumberFormatException
- * @id java/android/nfe-local-android-dos
- * @description NumberFormatException thrown but not caught by an Android application that allows external inputs can crash the application, constituting a local Denial of Service (DoS) attack.
+ * @description NumberFormatException thrown but not caught by an Android
+ *              application that allows external inputs can crash the
+ *              application, constituting a local Denial of Service (DoS)
+ *              attack.
  * @kind path-problem
+ * @problem.severity warning
+ * @precision medium
+ * @id java/android/nfe-local-android-dos
  * @tags security
  *       external/cwe/cwe-755
  */
diff --git a/java/ql/src/experimental/Security/CWE/CWE-759/HashWithoutSalt.java b/java/ql/src/experimental/Security/CWE/CWE-759/HashWithoutSalt.java
new file mode 100644
index 00000000000..91d39eb5798
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-759/HashWithoutSalt.java
@@ -0,0 +1,14 @@
+public class HashWithoutSalt {
+	// BAD - Hash without a salt.
+	public void getSHA256Hash(String password) throws NoSuchAlgorithmException {
+		MessageDigest md = MessageDigest.getInstance("SHA-256");
+		byte[] messageDigest = md.digest(password.getBytes());
+	}
+
+	// GOOD - Hash with a salt.
+	public void getSHA256Hash(String password, byte[] salt) throws NoSuchAlgorithmException {
+		MessageDigest md = MessageDigest.getInstance("SHA-256");
+		md.update(salt);
+		byte[] messageDigest = md.digest(password.getBytes());
+	}
+}
\ No newline at end of file
diff --git a/java/ql/src/experimental/Security/CWE/CWE-759/HashWithoutSalt.qhelp b/java/ql/src/experimental/Security/CWE/CWE-759/HashWithoutSalt.qhelp
new file mode 100644
index 00000000000..3418645bc97
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-759/HashWithoutSalt.qhelp
@@ -0,0 +1,29 @@
+<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
+<qhelp>
+
+  <overview>
+    <p>In cryptography, a salt is some random data used as an additional input to a one-way function that hashes a password or pass-phrase. It makes dictionary attacks more difficult.</p>
+
+    <p>Without a salt, it is much easier for attackers to pre-compute the hash value using dictionary attack techniques such as rainbow tables to crack passwords.</p>
+  </overview>
+
+  <recommendation>
+    <p>Use a long random salt of at least 32 bytes then use the combination of password and salt to hash a password or password phrase.</p>
+  </recommendation>
+
+  <example>
+    <p>The following example shows two ways of hashing. In the 'BAD' case, no salt is provided. In the 'GOOD' case, a salt is provided.</p>
+    <sample src="HashWithoutSalt.java" />
+  </example>
+
+  <references>
+    <li>
+      DZone:
+      <a href="https://dzone.com/articles/a-look-at-java-cryptography">A Look at Java Cryptography</a>
+    </li>
+    <li>
+      CWE:
+      <a href="https://cwe.mitre.org/data/definitions/759.html">CWE-759: Use of a One-Way Hash without a Salt</a>
+    </li>
+  </references>
+</qhelp>
diff --git a/java/ql/src/experimental/Security/CWE/CWE-759/HashWithoutSalt.ql b/java/ql/src/experimental/Security/CWE/CWE-759/HashWithoutSalt.ql
new file mode 100644
index 00000000000..736fe100c39
--- /dev/null
+++ b/java/ql/src/experimental/Security/CWE/CWE-759/HashWithoutSalt.ql
@@ -0,0 +1,190 @@
+/**
+ * @name Use of a hash function without a salt
+ * @description Hashed passwords without a salt are vulnerable to dictionary attacks.
+ * @kind path-problem
+ * @problem.severity warning
+ * @precision low
+ * @id java/hash-without-salt
+ * @tags security
+ *       external/cwe-759
+ */
+
+import java
+import semmle.code.java.dataflow.TaintTracking
+import DataFlow::PathGraph
+
+/**
+ * Gets a regular expression for matching common names of variables
+ * that indicate the value being held is a password.
+ */
+string getPasswordRegex() { result = "(?i).*pass(wd|word|code|phrase).*" }
+
+/** Finds variables that hold password information judging by their names. */
+class PasswordVarExpr extends VarAccess {
+  PasswordVarExpr() {
+    exists(string name | name = this.getVariable().getName().toLowerCase() |
+      name.regexpMatch(getPasswordRegex()) and not name.matches("%hash%") // Exclude variable names such as `passwordHash` since their values were already hashed
+    )
+  }
+}
+
+/** Holds if `Expr` e is a direct or indirect operand of `ae`. */
+predicate hasAddExprAncestor(AddExpr ae, Expr e) { ae.getAnOperand+() = e }
+
+/** The Java class `java.security.MessageDigest`. */
+class MessageDigest extends RefType {
+  MessageDigest() { this.hasQualifiedName("java.security", "MessageDigest") }
+}
+
+/** The method call `MessageDigest.getInstance(...)` */
+class MDConstructor extends StaticMethodAccess {
+  MDConstructor() {
+    exists(Method m | m = this.getMethod() |
+      m.getDeclaringType() instanceof MessageDigest and
+      m.hasName("getInstance")
+    )
+  }
+}
+
+/** The method `digest()` declared in `java.security.MessageDigest`. */
+class MDDigestMethod extends Method {
+  MDDigestMethod() {
+    this.getDeclaringType() instanceof MessageDigest and
+    this.hasName("digest")
+  }
+}
+
+/** The method `update()` declared in `java.security.MessageDigest`. */
+class MDUpdateMethod extends Method {
+  MDUpdateMethod() {
+    this.getDeclaringType() instanceof MessageDigest and
+    this.hasName("update")
+  }
+}
+
+/** The hashing method that could taint the input. */
+class MDHashMethodAccess extends MethodAccess {
+  MDHashMethodAccess() {
+    (
+      this.getMethod() instanceof MDDigestMethod or
+      this.getMethod() instanceof MDUpdateMethod
+    ) and
+    this.getNumArgument() != 0
+  }
+}
+
+/**
+ * Holds if `MethodAccess` ma is a method access of `MDHashMethodAccess` or
+ * invokes a method access of `MDHashMethodAccess` directly or indirectly.
+ */
+predicate isHashAccess(MethodAccess ma) {
+  ma instanceof MDHashMethodAccess
+  or
+  exists(MethodAccess mca |
+    ma.getMethod().calls(mca.getMethod()) and
+    isHashAccess(mca) and
+    DataFlow::localExprFlow(ma.getMethod().getAParameter().getAnAccess(), mca.getAnArgument())
+  )
+}
+
+/**
+ * Holds if there is a second method access that satisfies `isHashAccess` whose qualifier or argument
+ * is the same as the method call `ma` that satisfies `isHashAccess`.
+ */
+predicate hasAnotherHashCall(MethodAccess ma) {
+  isHashAccess(ma) and
+  exists(MethodAccess ma2, VarAccess va |
+    ma2 != ma and
+    isHashAccess(ma2) and
+    not va.getVariable().getType() instanceof PrimitiveType and
+    (
+      ma.getQualifier() = va and
+      ma2.getQualifier() = va.getVariable().getAnAccess()
+      or
+      ma.getQualifier() = va and
+      ma2.getAnArgument() = va.getVariable().getAnAccess()
+      or
+      ma.getAnArgument() = va and
+      ma2.getQualifier() = va.getVariable().getAnAccess()
+      or
+      ma.getAnArgument() = va and
+      ma2.getAnArgument() = va.getVariable().getAnAccess()
+    )
+  )
+}
+
+/**
+ * Holds if `MethodAccess` ma is part of a call graph that satisfies `isHashAccess`
+ * but is not at the top of the call hierarchy.
+ */
+predicate hasHashAncestor(MethodAccess ma) {
+  exists(MethodAccess mpa |
+    mpa.getMethod().calls(ma.getMethod()) and
+    isHashAccess(mpa) and
+    DataFlow::localExprFlow(mpa.getMethod().getAParameter().getAnAccess(), ma.getAnArgument())
+  )
+}
+
+/** Holds if `MethodAccess` ma is a hashing call without a sibling node making another hashing call. */
+predicate isSingleHashMethodCall(MethodAccess ma) {
+  isHashAccess(ma) and not hasAnotherHashCall(ma)
+}
+
+/** Holds if `MethodAccess` ma is a single hashing call that is not invoked by a wrapper method. */
+predicate isSink(MethodAccess ma) { isSingleHashMethodCall(ma) and not hasHashAncestor(ma) }
+
+/** Sink of hashing calls. */
+class HashWithoutSaltSink extends DataFlow::ExprNode {
+  HashWithoutSaltSink() {
+    exists(MethodAccess ma |
+      this.asExpr() = ma.getAnArgument() and
+      isSink(ma)
+    )
+  }
+}
+
+/**
+ * Taint configuration tracking flow from an expression whose name suggests it holds password data
+ * to a method call that generates a hash without a salt.
+ */
+class HashWithoutSaltConfiguration extends TaintTracking::Configuration {
+  HashWithoutSaltConfiguration() { this = "HashWithoutSaltConfiguration" }
+
+  override predicate isSource(DataFlow::Node source) { source.asExpr() instanceof PasswordVarExpr }
+
+  override predicate isSink(DataFlow::Node sink) { sink instanceof HashWithoutSaltSink }
+
+  /**
+   * Holds if a password is concatenated with a salt then hashed together through the call `System.arraycopy(password.getBytes(), ...)`, for example,
+   *  `System.arraycopy(password.getBytes(), 0, allBytes, 0, password.getBytes().length);`
+   *  `System.arraycopy(salt, 0, allBytes, password.getBytes().length, salt.length);`
+   *  `byte[] messageDigest = md.digest(allBytes);`
+   * Or the password is concatenated with a salt as a string.
+   */
+  override predicate isSanitizer(DataFlow::Node node) {
+    exists(MethodAccess ma |
+      ma.getMethod().getDeclaringType().hasQualifiedName("java.lang", "System") and
+      ma.getMethod().hasName("arraycopy") and
+      ma.getArgument(0) = node.asExpr()
+    ) // System.arraycopy(password.getBytes(), ...)
+    or
+    exists(AddExpr e | hasAddExprAncestor(e, node.asExpr())) // password+salt
+    or
+    exists(ConditionalExpr ce | ce.getAChildExpr() = node.asExpr()) // useSalt?password+":"+salt:password
+    or
+    exists(MethodAccess ma |
+      ma.getMethod().getDeclaringType().hasQualifiedName("java.lang", "StringBuilder") and
+      ma.getMethod().hasName("append") and
+      ma.getArgument(0) = node.asExpr() // stringBuilder.append(password).append(salt)
+    )
+    or
+    exists(MethodAccess ma |
+      ma.getQualifier().(VarAccess).getVariable().getType() instanceof Interface and
+      ma.getAnArgument() = node.asExpr() // Method access of interface type variables requires runtime determination thus not handled
+    )
+  }
+}
+
+from DataFlow::PathNode source, DataFlow::PathNode sink, HashWithoutSaltConfiguration cc
+where cc.hasFlowPath(source, sink)
+select sink, source, sink, "$@ is hashed without a salt.", source, "The password"
diff --git a/java/ql/src/experimental/Security/CWE/CWE-927/SensitiveBroadcast.ql b/java/ql/src/experimental/Security/CWE/CWE-927/SensitiveBroadcast.ql
index 785a0f5c91c..2396392f6c9 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-927/SensitiveBroadcast.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-927/SensitiveBroadcast.ql
@@ -1,8 +1,12 @@
 /**
  * @name Broadcasting sensitive data to all Android applications
- * @id java/sensitive-broadcast
- * @description An Android application uses implicit intents to broadcast sensitive data to all applications without specifying any receiver permission.
+ * @description An Android application uses implicit intents to broadcast
+ *              sensitive data to all applications without specifying any
+ *              receiver permission.
  * @kind path-problem
+ * @problem.severity warning
+ * @precision medium
+ * @id java/sensitive-broadcast
  * @tags security
  *       external/cwe-927
  */
diff --git a/java/ql/src/experimental/Security/CWE/CWE-939/IncorrectURLVerification.ql b/java/ql/src/experimental/Security/CWE/CWE-939/IncorrectURLVerification.ql
index 87b87b029f4..70156684b41 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-939/IncorrectURLVerification.ql
+++ b/java/ql/src/experimental/Security/CWE/CWE-939/IncorrectURLVerification.ql
@@ -1,8 +1,12 @@
 /**
- * @id java/incorrect-url-verification
  * @name Incorrect URL verification
- * @description Apps that rely on URL parsing to verify that a given URL is pointing to a trusted server are susceptible to wrong ways of URL parsing and verification.
+ * @description Apps that rely on URL parsing to verify that a given URL is
+ *              pointing to a trusted server are susceptible to wrong ways of
+ *              URL parsing and verification.
  * @kind problem
+ * @problem.severity warning
+ * @precision medium
+ * @id java/incorrect-url-verification
  * @tags security
  *       external/cwe-939
  */
diff --git a/java/ql/src/experimental/semmle/code/java/Logging.qll b/java/ql/src/experimental/semmle/code/java/Logging.qll
new file mode 100644
index 00000000000..b3444972710
--- /dev/null
+++ b/java/ql/src/experimental/semmle/code/java/Logging.qll
@@ -0,0 +1,35 @@
+/**
+ * Provides classes and predicates for working with loggers.
+ */
+
+import java
+
+/** Models a call to a logging method. */
+class LoggingCall extends MethodAccess {
+  LoggingCall() {
+    exists(RefType t, Method m |
+      t.hasQualifiedName("org.apache.log4j", "Category") or // Log4j 1
+      t.hasQualifiedName("org.apache.logging.log4j", ["Logger", "LogBuilder"]) or // Log4j 2
+      t.hasQualifiedName("org.apache.commons.logging", "Log") or
+      // JBoss Logging (`org.jboss.logging.Logger` in some implementations like JBoss Application Server 4.0.4 did not implement `BasicLogger`)
+      t.hasQualifiedName("org.jboss.logging", ["BasicLogger", "Logger"]) or
+      t.hasQualifiedName("org.slf4j.spi", "LoggingEventBuilder") or
+      t.hasQualifiedName("org.slf4j", "Logger") or
+      t.hasQualifiedName("org.scijava.log", "Logger") or
+      t.hasQualifiedName("com.google.common.flogger", "LoggingApi") or
+      t.hasQualifiedName("java.lang", "System$Logger") or
+      t.hasQualifiedName("java.util.logging", "Logger") or
+      t.hasQualifiedName("android.util", "Log")
+    |
+      (
+        m.getDeclaringType().getASourceSupertype*() = t or
+        m.getDeclaringType().extendsOrImplements*(t)
+      ) and
+      m.getReturnType() instanceof VoidType and
+      this = m.getAReference()
+    )
+  }
+
+  /** Returns an argument which would be logged by this call. */
+  Argument getALogArgument() { result = this.getArgument(_) }
+}
diff --git a/java/ql/src/experimental/semmle/code/java/frameworks/CredentialsInPropertiesFile.qll b/java/ql/src/experimental/semmle/code/java/frameworks/CredentialsInPropertiesFile.qll
new file mode 100644
index 00000000000..1190e13a9a1
--- /dev/null
+++ b/java/ql/src/experimental/semmle/code/java/frameworks/CredentialsInPropertiesFile.qll
@@ -0,0 +1,63 @@
+/**
+ * Provides classes for analyzing properties files.
+ */
+
+import java
+import semmle.code.configfiles.ConfigFiles
+import semmle.code.java.dataflow.FlowSources
+import semmle.code.java.frameworks.Properties
+
+private string possibleSecretName() {
+  result =
+    [
+      "%password%", "%passwd%", "%account%", "%accnt%", "%credential%", "%token%", "%secret%",
+      "%access%key%"
+    ]
+}
+
+private string possibleEncryptedSecretName() { result = ["%hashed%", "%encrypted%", "%crypt%"] }
+
+/** Holds if the value is not cleartext credentials. */
+bindingset[value]
+predicate isNotCleartextCredentials(string value) {
+  value = "" // Empty string
+  or
+  value.length() < 7 // Typical credentials are no less than 6 characters
+  or
+  value.matches("% %") // Sentences containing spaces
+  or
+  value.regexpMatch(".*[^a-zA-Z\\d]{3,}.*") // Contain repeated non-alphanumeric characters such as a fake password pass**** or ????
+  or
+  value.matches("@%") // Starts with the "@" sign
+  or
+  value.regexpMatch("\\$\\{.*\\}") // Variable placeholder ${credentials}
+  or
+  value.matches("%=") // A basic check of encrypted credentials ending with padding characters
+  or
+  value.matches("ENC(%)") // Encrypted value
+  or
+  // Could be a message property for UI display or fake passwords, e.g. login.password_expired=Your current password has expired.
+  value.toLowerCase().matches(possibleSecretName())
+}
+
+/** A configuration property that appears to contain a cleartext secret. */
+class CredentialsConfig extends ConfigPair {
+  CredentialsConfig() {
+    this.getNameElement().getName().trim().toLowerCase().matches(possibleSecretName()) and
+    not this.getNameElement().getName().trim().toLowerCase().matches(possibleEncryptedSecretName()) and
+    not isNotCleartextCredentials(this.getValueElement().getValue().trim())
+  }
+
+  /** Gets the whitespace-trimmed name of this property. */
+  string getName() { result = this.getNameElement().getName().trim() }
+
+  /** Gets the whitespace-trimmed value of this property. */
+  string getValue() { result = this.getValueElement().getValue().trim() }
+
+  /** Returns a description of this vulnerability. */
+  string getConfigDesc() {
+    result =
+      "Plaintext credentials " + this.getName() + " have cleartext value " + this.getValue() +
+        " in properties file"
+  }
+}
diff --git a/java/ql/src/external/CodeDuplication.qll b/java/ql/src/external/CodeDuplication.qll
deleted file mode 100644
index 98782463a0e..00000000000
--- a/java/ql/src/external/CodeDuplication.qll
+++ /dev/null
@@ -1,268 +0,0 @@
-import java
-
-private string relativePath(File file) { result = file.getRelativePath().replaceAll("\\", "/") }
-
-cached
-private predicate tokenLocation(File file, int sl, int sc, int ec, int el, Copy copy, int index) {
-  file = copy.sourceFile() and
-  tokens(copy, index, sl, sc, ec, el)
-}
-
-class Copy extends @duplication_or_similarity {
-  private int lastToken() { result = max(int i | tokens(this, i, _, _, _, _) | i) }
-
-  int tokenStartingAt(Location loc) {
-    tokenLocation(loc.getFile(), loc.getStartLine(), loc.getStartColumn(), _, _, this, result)
-  }
-
-  int tokenEndingAt(Location loc) {
-    tokenLocation(loc.getFile(), _, _, loc.getEndLine(), loc.getEndColumn(), this, result)
-  }
-
-  int sourceStartLine() { tokens(this, 0, result, _, _, _) }
-
-  int sourceStartColumn() { tokens(this, 0, _, result, _, _) }
-
-  int sourceEndLine() { tokens(this, lastToken(), _, _, result, _) }
-
-  int sourceEndColumn() { tokens(this, lastToken(), _, _, _, result) }
-
-  int sourceLines() { result = this.sourceEndLine() + 1 - this.sourceStartLine() }
-
-  int getEquivalenceClass() { duplicateCode(this, _, result) or similarCode(this, _, result) }
-
-  File sourceFile() {
-    exists(string name | duplicateCode(this, name, _) or similarCode(this, name, _) |
-      name.replaceAll("\\", "/") = relativePath(result)
-    )
-  }
-
-  predicate hasLocationInfo(
-    string filepath, int startline, int startcolumn, int endline, int endcolumn
-  ) {
-    sourceFile().getAbsolutePath() = filepath and
-    startline = sourceStartLine() and
-    startcolumn = sourceStartColumn() and
-    endline = sourceEndLine() and
-    endcolumn = sourceEndColumn()
-  }
-
-  string toString() { none() }
-}
-
-class DuplicateBlock extends Copy, @duplication {
-  override string toString() { result = "Duplicate code: " + sourceLines() + " duplicated lines." }
-}
-
-class SimilarBlock extends Copy, @similarity {
-  override string toString() {
-    result = "Similar code: " + sourceLines() + " almost duplicated lines."
-  }
-}
-
-Method sourceMethod() { hasLocation(result, _) and numlines(result, _, _, _) }
-
-int numberOfSourceMethods(Class c) {
-  result = count(Method m | m = sourceMethod() and m.getDeclaringType() = c)
-}
-
-private predicate blockCoversStatement(int equivClass, int first, int last, Stmt stmt) {
-  exists(DuplicateBlock b, Location loc |
-    stmt.getLocation() = loc and
-    first = b.tokenStartingAt(loc) and
-    last = b.tokenEndingAt(loc) and
-    b.getEquivalenceClass() = equivClass
-  )
-}
-
-private Stmt statementInMethod(Method m) {
-  result.getEnclosingCallable() = m and
-  not result instanceof BlockStmt
-}
-
-private predicate duplicateStatement(Method m1, Method m2, Stmt s1, Stmt s2) {
-  exists(int equivClass, int first, int last |
-    s1 = statementInMethod(m1) and
-    s2 = statementInMethod(m2) and
-    blockCoversStatement(equivClass, first, last, s1) and
-    blockCoversStatement(equivClass, first, last, s2) and
-    s1 != s2 and
-    m1 != m2
-  )
-}
-
-predicate duplicateStatements(Method m1, Method m2, int duplicate, int total) {
-  duplicate = strictcount(Stmt s | duplicateStatement(m1, m2, s, _)) and
-  total = strictcount(statementInMethod(m1))
-}
-
-/**
- * Pairs of methods that are identical.
- */
-predicate duplicateMethod(Method m, Method other) {
-  exists(int total | duplicateStatements(m, other, total, total))
-}
-
-predicate similarLines(File f, int line) {
-  exists(SimilarBlock b | b.sourceFile() = f and line in [b.sourceStartLine() .. b.sourceEndLine()])
-}
-
-private predicate similarLinesPerEquivalenceClass(int equivClass, int lines, File f) {
-  lines =
-    strictsum(SimilarBlock b, int toSum |
-      (b.sourceFile() = f and b.getEquivalenceClass() = equivClass) and
-      toSum = b.sourceLines()
-    |
-      toSum
-    )
-}
-
-pragma[noopt]
-private predicate similarLinesCovered(File f, int coveredLines, File otherFile) {
-  exists(int numLines | numLines = f.getTotalNumberOfLines() |
-    exists(int coveredApprox |
-      coveredApprox =
-        strictsum(int num |
-          exists(int equivClass |
-            similarLinesPerEquivalenceClass(equivClass, num, f) and
-            similarLinesPerEquivalenceClass(equivClass, num, otherFile) and
-            f != otherFile
-          )
-        ) and
-      exists(int n, int product | product = coveredApprox * 100 and n = product / numLines | n > 75)
-    ) and
-    exists(int notCovered |
-      notCovered = count(int j | j in [1 .. numLines] and not similarLines(f, j)) and
-      coveredLines = numLines - notCovered
-    )
-  )
-}
-
-predicate duplicateLines(File f, int line) {
-  exists(DuplicateBlock b |
-    b.sourceFile() = f and line in [b.sourceStartLine() .. b.sourceEndLine()]
-  )
-}
-
-private predicate duplicateLinesPerEquivalenceClass(int equivClass, int lines, File f) {
-  lines =
-    strictsum(DuplicateBlock b, int toSum |
-      (b.sourceFile() = f and b.getEquivalenceClass() = equivClass) and
-      toSum = b.sourceLines()
-    |
-      toSum
-    )
-}
-
-pragma[noopt]
-private predicate duplicateLinesCovered(File f, int coveredLines, File otherFile) {
-  exists(int numLines | numLines = f.getTotalNumberOfLines() |
-    exists(int coveredApprox |
-      coveredApprox =
-        strictsum(int num |
-          exists(int equivClass |
-            duplicateLinesPerEquivalenceClass(equivClass, num, f) and
-            duplicateLinesPerEquivalenceClass(equivClass, num, otherFile) and
-            f != otherFile
-          )
-        ) and
-      exists(int n, int product | product = coveredApprox * 100 and n = product / numLines | n > 75)
-    ) and
-    exists(int notCovered |
-      notCovered = count(int j | j in [1 .. numLines] and not duplicateLines(f, j)) and
-      coveredLines = numLines - notCovered
-    )
-  )
-}
-
-predicate similarFiles(File f, File other, int percent) {
-  exists(int covered, int total |
-    similarLinesCovered(f, covered, other) and
-    total = f.getTotalNumberOfLines() and
-    covered * 100 / total = percent and
-    percent > 80
-  ) and
-  not duplicateFiles(f, other, _)
-}
-
-predicate duplicateFiles(File f, File other, int percent) {
-  exists(int covered, int total |
-    duplicateLinesCovered(f, covered, other) and
-    total = f.getTotalNumberOfLines() and
-    covered * 100 / total = percent and
-    percent > 70
-  )
-}
-
-predicate duplicateAnonymousClass(AnonymousClass c, AnonymousClass other) {
-  exists(int numDup |
-    numDup =
-      strictcount(Method m1 |
-        exists(Method m2 |
-          duplicateMethod(m1, m2) and
-          m1 = sourceMethod() and
-          m1.getDeclaringType() = c and
-          m2.getDeclaringType() = other and
-          c != other
-        )
-      ) and
-    numDup = numberOfSourceMethods(c) and
-    numDup = numberOfSourceMethods(other) and
-    forall(Type t | c.getASupertype() = t | t = other.getASupertype())
-  )
-}
-
-pragma[noopt]
-predicate mostlyDuplicateClassBase(Class c, Class other, int numDup, int total) {
-  numDup =
-    strictcount(Method m1 |
-      exists(Method m2 |
-        duplicateMethod(m1, m2) and
-        m1 = sourceMethod() and
-        m1.getDeclaringType() = c and
-        m2.getDeclaringType() = other and
-        other instanceof Class and
-        c != other
-      )
-    ) and
-  total = numberOfSourceMethods(c) and
-  exists(int n, int product | product = 100 * numDup and n = product / total | n > 80)
-}
-
-predicate mostlyDuplicateClass(Class c, Class other, string message) {
-  exists(int numDup, int total |
-    mostlyDuplicateClassBase(c, other, numDup, total) and
-    not c instanceof AnonymousClass and
-    not other instanceof AnonymousClass and
-    (
-      total != numDup and
-      exists(string s1, string s2, string s3, string name |
-        s1 = " out of " and
-        s2 = " methods in " and
-        s3 = " are duplicated in $@." and
-        name = c.getName()
-      |
-        message = numDup + s1 + total + s2 + name + s3
-      )
-      or
-      total = numDup and
-      exists(string s1, string s2, string name |
-        s1 = "All methods in " and s2 = " are identical in $@." and name = c.getName()
-      |
-        message = s1 + name + s2
-      )
-    )
-  )
-}
-
-predicate fileLevelDuplication(File f, File other) {
-  similarFiles(f, other, _) or duplicateFiles(f, other, _)
-}
-
-predicate classLevelDuplication(Class c, Class other) {
-  duplicateAnonymousClass(c, other) or mostlyDuplicateClass(c, other, _)
-}
-
-predicate whitelistedLineForDuplication(File f, int line) {
-  exists(Import i | i.getFile() = f and i.getLocation().getStartLine() = line)
-}
diff --git a/java/ql/src/external/DefectFilter.qll b/java/ql/src/external/DefectFilter.qll
deleted file mode 100644
index d3296315f65..00000000000
--- a/java/ql/src/external/DefectFilter.qll
+++ /dev/null
@@ -1,55 +0,0 @@
-/** Provides a class for working with defect query results stored in dashboard databases. */
-
-import java
-
-/**
- * Holds if `id` in the opaque identifier of a result reported by query `queryPath`,
- * such that `message` is the associated message and the location of the result spans
- * column `startcolumn` of line `startline` to column `endcolumn` of line `endline`
- * in file `filepath`.
- *
- * For more information, see [Locations](https://help.semmle.com/QL/learn-ql/ql/locations.html).
- */
-external predicate defectResults(
-  int id, string queryPath, string file, int startline, int startcol, int endline, int endcol,
-  string message
-);
-
-/**
- * A defect query result stored in a dashboard database.
- */
-class DefectResult extends int {
-  DefectResult() { defectResults(this, _, _, _, _, _, _, _) }
-
-  /** Gets the path of the query that reported the result. */
-  string getQueryPath() { defectResults(this, result, _, _, _, _, _, _) }
-
-  /** Gets the file in which this query result was reported. */
-  File getFile() {
-    exists(string path | defectResults(this, _, path, _, _, _, _, _) |
-      result.getAbsolutePath() = path
-    )
-  }
-
-  /** Gets the line on which the location of this query result starts. */
-  int getStartLine() { defectResults(this, _, _, result, _, _, _, _) }
-
-  /** Gets the column on which the location of this query result starts. */
-  int getStartColumn() { defectResults(this, _, _, _, result, _, _, _) }
-
-  /** Gets the line on which the location of this query result ends. */
-  int getEndLine() { defectResults(this, _, _, _, _, result, _, _) }
-
-  /** Gets the column on which the location of this query result ends. */
-  int getEndColumn() { defectResults(this, _, _, _, _, _, result, _) }
-
-  /** Gets the message associated with this query result. */
-  string getMessage() { defectResults(this, _, _, _, _, _, _, result) }
-
-  /** Gets the URL corresponding to the location of this query result. */
-  string getURL() {
-    result =
-      "file://" + getFile().getAbsolutePath() + ":" + getStartLine() + ":" + getStartColumn() + ":" +
-        getEndLine() + ":" + getEndColumn()
-  }
-}
diff --git a/java/ql/src/external/DuplicateAnonymous.ql b/java/ql/src/external/DuplicateAnonymous.ql
index 1be9ff3922f..880abfc3a69 100644
--- a/java/ql/src/external/DuplicateAnonymous.ql
+++ b/java/ql/src/external/DuplicateAnonymous.ql
@@ -15,11 +15,8 @@
  */
 
 import java
-import CodeDuplication
 
 from AnonymousClass c, AnonymousClass other
-where
-  duplicateAnonymousClass(c, other) and
-  not fileLevelDuplication(c.getCompilationUnit(), other.getCompilationUnit())
+where none()
 select c, "Anonymous class is identical to $@.", other,
   "another anonymous class in " + other.getFile().getStem()
diff --git a/java/ql/src/external/DuplicateBlock.ql b/java/ql/src/external/DuplicateBlock.ql
index 0e4c5d7eb93..cc515904039 100644
--- a/java/ql/src/external/DuplicateBlock.ql
+++ b/java/ql/src/external/DuplicateBlock.ql
@@ -8,16 +8,10 @@
  * @id java/duplicate-block
  */
 
-import CodeDuplication
+import java
 
-from DuplicateBlock d, DuplicateBlock other, int lines, File otherFile, int otherLine
-where
-  lines = d.sourceLines() and
-  lines > 10 and
-  other.getEquivalenceClass() = d.getEquivalenceClass() and
-  other != d and
-  otherFile = other.sourceFile() and
-  otherLine = other.sourceStartLine()
+from BlockStmt d, int lines, File otherFile, int otherLine
+where none()
 select d,
   "Duplicate code: " + lines + " lines are duplicated at " + otherFile.getStem() + ":" + otherLine +
     "."
diff --git a/java/ql/src/external/DuplicateMethod.ql b/java/ql/src/external/DuplicateMethod.ql
index 4ec8740e475..f7fc59e7fda 100644
--- a/java/ql/src/external/DuplicateMethod.ql
+++ b/java/ql/src/external/DuplicateMethod.ql
@@ -16,19 +16,8 @@
  */
 
 import java
-import CodeDuplication
-
-predicate relevant(Method m) {
-  m.getNumberOfLinesOfCode() > 5 and not m.getName().matches("get%")
-  or
-  m.getNumberOfLinesOfCode() > 10
-}
 
 from Method m, Method other
-where
-  duplicateMethod(m, other) and
-  relevant(m) and
-  not fileLevelDuplication(m.getCompilationUnit(), other.getCompilationUnit()) and
-  not classLevelDuplication(m.getDeclaringType(), other.getDeclaringType())
+where none()
 select m, "Method " + m.getName() + " is duplicated in $@.", other,
   other.getDeclaringType().getQualifiedName()
diff --git a/java/ql/src/external/MetricFilter.qll b/java/ql/src/external/MetricFilter.qll
deleted file mode 100644
index cffcae2e425..00000000000
--- a/java/ql/src/external/MetricFilter.qll
+++ /dev/null
@@ -1,44 +0,0 @@
-import java
-
-external predicate metricResults(
-  int id, string queryPath, string file, int startline, int startcol, int endline, int endcol,
-  float value
-);
-
-class MetricResult extends int {
-  MetricResult() { metricResults(this, _, _, _, _, _, _, _) }
-
-  string getQueryPath() { metricResults(this, result, _, _, _, _, _, _) }
-
-  File getFile() {
-    exists(string path |
-      metricResults(this, _, path, _, _, _, _, _) and result.getAbsolutePath() = path
-    )
-  }
-
-  int getStartLine() { metricResults(this, _, _, result, _, _, _, _) }
-
-  int getStartColumn() { metricResults(this, _, _, _, result, _, _, _) }
-
-  int getEndLine() { metricResults(this, _, _, _, _, result, _, _) }
-
-  int getEndColumn() { metricResults(this, _, _, _, _, _, result, _) }
-
-  predicate hasMatchingLocation() { exists(this.getMatchingLocation()) }
-
-  Location getMatchingLocation() {
-    result.getFile() = this.getFile() and
-    result.getStartLine() = this.getStartLine() and
-    result.getEndLine() = this.getEndLine() and
-    result.getStartColumn() = this.getStartColumn() and
-    result.getEndColumn() = this.getEndColumn()
-  }
-
-  float getValue() { metricResults(this, _, _, _, _, _, _, result) }
-
-  string getURL() {
-    result =
-      "file://" + getFile().getAbsolutePath() + ":" + getStartLine() + ":" + getStartColumn() + ":" +
-        getEndLine() + ":" + getEndColumn()
-  }
-}
diff --git a/java/ql/src/external/MostlyDuplicateClass.ql b/java/ql/src/external/MostlyDuplicateClass.ql
index 864c44384c6..d5683a5fbba 100644
--- a/java/ql/src/external/MostlyDuplicateClass.ql
+++ b/java/ql/src/external/MostlyDuplicateClass.ql
@@ -16,10 +16,7 @@
  */
 
 import java
-import CodeDuplication
 
 from Class c, string message, Class link
-where
-  mostlyDuplicateClass(c, link, message) and
-  not fileLevelDuplication(c.getCompilationUnit(), _)
+where none()
 select c, message, link, link.getQualifiedName()
diff --git a/java/ql/src/external/MostlyDuplicateFile.ql b/java/ql/src/external/MostlyDuplicateFile.ql
index 86dfa725c25..ccdeddf1890 100644
--- a/java/ql/src/external/MostlyDuplicateFile.ql
+++ b/java/ql/src/external/MostlyDuplicateFile.ql
@@ -16,9 +16,8 @@
  */
 
 import java
-import CodeDuplication
 
 from File f, File other, int percent
-where duplicateFiles(f, other, percent)
+where none()
 select f, percent + "% of the lines in " + f.getStem() + " are copies of lines in $@.", other,
   other.getStem()
diff --git a/java/ql/src/external/MostlyDuplicateMethod.ql b/java/ql/src/external/MostlyDuplicateMethod.ql
index 2f47c9ea373..db576ad9696 100644
--- a/java/ql/src/external/MostlyDuplicateMethod.ql
+++ b/java/ql/src/external/MostlyDuplicateMethod.ql
@@ -16,17 +16,8 @@
  */
 
 import java
-import CodeDuplication
 
-from Method m, int covered, int total, Method other, int percent
-where
-  duplicateStatements(m, other, covered, total) and
-  covered != total and
-  m.getMetrics().getNumberOfLinesOfCode() > 5 and
-  covered * 100 / total = percent and
-  percent > 80 and
-  not duplicateMethod(m, other) and
-  not classLevelDuplication(m.getDeclaringType(), other.getDeclaringType()) and
-  not fileLevelDuplication(m.getCompilationUnit(), other.getCompilationUnit())
+from Method m, Method other, int percent
+where none()
 select m, percent + "% of the statements in " + m.getName() + " are duplicated in $@.", other,
   other.getDeclaringType().getName() + "." + other.getStringSignature()
diff --git a/java/ql/src/external/MostlySimilarFile.ql b/java/ql/src/external/MostlySimilarFile.ql
index 5b0ab87c91a..4b56a09a4de 100644
--- a/java/ql/src/external/MostlySimilarFile.ql
+++ b/java/ql/src/external/MostlySimilarFile.ql
@@ -16,9 +16,8 @@
  */
 
 import java
-import CodeDuplication
 
 from File f, File other, int percent
-where similarFiles(f, other, percent)
+where none()
 select f, percent + "% of the lines in " + f.getStem() + " are similar to lines in $@.", other,
   other.getStem()
diff --git a/java/ql/src/filters/FromSource.ql b/java/ql/src/filters/FromSource.ql
deleted file mode 100644
index 5d655c4954e..00000000000
--- a/java/ql/src/filters/FromSource.ql
+++ /dev/null
@@ -1,15 +0,0 @@
-/**
- * @name Filter: only keep results from source
- * @description Shows how to filter for only certain files
- * @kind problem
- * @id java/source-filter
- */
-
-import java
-import external.DefectFilter
-
-from DefectResult res, CompilationUnit cu
-where
-  cu = res.getFile() and
-  cu.fromSource()
-select res, res.getMessage()
diff --git a/java/ql/src/filters/NotGenerated.ql b/java/ql/src/filters/NotGenerated.ql
deleted file mode 100644
index d20e8ca5e58..00000000000
--- a/java/ql/src/filters/NotGenerated.ql
+++ /dev/null
@@ -1,13 +0,0 @@
-/**
- * @name Filter: non-generated files
- * @description Only keep results that aren't in generated files
- * @kind problem
- * @id java/not-generated-file-filter
- */
-
-import java
-import external.DefectFilter
-
-from DefectResult res
-where not res.getFile() instanceof GeneratedFile
-select res, res.getMessage()
diff --git a/java/ql/src/filters/NotGeneratedForMetric.ql b/java/ql/src/filters/NotGeneratedForMetric.ql
deleted file mode 100644
index 8d424cea687..00000000000
--- a/java/ql/src/filters/NotGeneratedForMetric.ql
+++ /dev/null
@@ -1,13 +0,0 @@
-/**
- * @name Metric Filter: non-generated files
- * @description Only keep metric results that aren't in generated files
- * @kind treemap
- * @id java/not-generated-file-metric-filter
- */
-
-import java
-import external.MetricFilter
-
-from MetricResult res
-where not res.getFile() instanceof GeneratedFile
-select res, res.getValue()
diff --git a/java/ql/src/filters/SuppressionComment.ql b/java/ql/src/filters/SuppressionComment.ql
deleted file mode 100644
index 85bb2627c5e..00000000000
--- a/java/ql/src/filters/SuppressionComment.ql
+++ /dev/null
@@ -1,52 +0,0 @@
-/**
- * @name Filter: Suppression comments
- * @description Recognise comments containing `NOSEMMLE` as suppression comments
- *              when they appear on a line containing an alert or the
- *              immediately preceding line. As further customisations,
- *              `NOSEMMLE(some text)` will only suppress alerts where the
- *              message contains "some text", and `NOSEMMLE/some regex/` will
- *              only suppress alerts where the message contains a match of the
- *              regex. No special way of escaping `)` or `/` in the suppression
- *              comment argument is provided.
- * @kind problem
- * @id java/nosemmle-suppression-comment-filter
- */
-
-import java
-import external.DefectFilter
-
-class SuppressionComment extends Javadoc {
-  SuppressionComment() { this.getAChild*().getText().matches("%NOSEMMLE%") }
-
-  private string getASuppressionDirective() {
-    result = this.getAChild*().getText().regexpFind("\\bNOSEMMLE\\b(\\([^)]+?\\)|/[^/]+?/|)", _, 0)
-  }
-
-  private string getAnActualSubstringArg() {
-    result = this.getASuppressionDirective().regexpCapture("NOSEMMLE\\((.*)\\)", 1)
-  }
-
-  private string getAnActualRegexArg() {
-    result = ".*" + this.getASuppressionDirective().regexpCapture("NOSEMMLE/(.*)/", 1) + ".*"
-  }
-
-  private string getASuppressionRegex() {
-    result = getAnActualRegexArg()
-    or
-    exists(string substring | substring = getAnActualSubstringArg() |
-      result = "\\Q" + substring.replaceAll("\\E", "\\E\\\\E\\Q") + "\\E"
-    )
-    or
-    result = ".*" and getASuppressionDirective() = "NOSEMMLE"
-  }
-
-  predicate suppresses(DefectResult res) {
-    this.getFile() = res.getFile() and
-    res.getEndLine() - this.getLocation().getEndLine() in [0 .. 2] and
-    res.getMessage().regexpMatch(this.getASuppressionRegex())
-  }
-}
-
-from DefectResult res
-where not exists(SuppressionComment s | s.suppresses(res))
-select res, res.getMessage()
diff --git a/java/ql/src/meta/frameworks/Coverage.ql b/java/ql/src/meta/frameworks/Coverage.ql
new file mode 100644
index 00000000000..ca0f78d99f1
--- /dev/null
+++ b/java/ql/src/meta/frameworks/Coverage.ql
@@ -0,0 +1,14 @@
+/**
+ * @name Framework coverage
+ * @description The number of API endpoints covered by CSV models sorted by
+ *              package and source-, sink-, and summary-kind.
+ * @kind table
+ * @id java/meta/framework-coverage
+ */
+
+import java
+import semmle.code.java.dataflow.ExternalFlow
+
+from string package, int pkgs, string kind, string part, int n
+where modelCoverage(package, pkgs, kind, part, n)
+select package, pkgs, kind, part, n
diff --git a/java/ql/src/semmle/code/FileSystem.qll b/java/ql/src/semmle/code/FileSystem.qll
index 28015d3ba4d..13908d547dc 100755
--- a/java/ql/src/semmle/code/FileSystem.qll
+++ b/java/ql/src/semmle/code/FileSystem.qll
@@ -159,6 +159,8 @@ class Folder extends Container, @folder {
 
   /** Gets the URL of this folder. */
   override string getURL() { result = "folder://" + getAbsolutePath() }
+
+  override string getAPrimaryQlClass() { result = "Folder" }
 }
 
 /**
@@ -171,6 +173,8 @@ class File extends Container, @file {
 
   /** Gets the URL of this file. */
   override string getURL() { result = "file://" + this.getAbsolutePath() + ":0:0:0:0" }
+
+  override string getAPrimaryQlClass() { result = "File" }
 }
 
 /**
@@ -204,4 +208,6 @@ class JarFile extends File {
   string getManifestEntryAttribute(string entry, string key) {
     jarManifestEntries(this, entry, key, result)
   }
+
+  override string getAPrimaryQlClass() { result = "JarFile" }
 }
diff --git a/java/ql/src/semmle/code/java/Exception.qll b/java/ql/src/semmle/code/java/Exception.qll
index 242478aa6c8..1e6cb54be0f 100755
--- a/java/ql/src/semmle/code/java/Exception.qll
+++ b/java/ql/src/semmle/code/java/Exception.qll
@@ -27,4 +27,6 @@ class Exception extends Element, @exception {
   override predicate hasName(string name) { this.getType().hasName(name) }
 
   override string toString() { result = this.getType().toString() }
+
+  override string getAPrimaryQlClass() { result = "Exception" }
 }
diff --git a/java/ql/src/semmle/code/java/Expr.qll b/java/ql/src/semmle/code/java/Expr.qll
index 43ad6634fc1..46186b4ee70 100755
--- a/java/ql/src/semmle/code/java/Expr.qll
+++ b/java/ql/src/semmle/code/java/Expr.qll
@@ -638,7 +638,21 @@ class BooleanLiteral extends Literal, @booleanliteral {
   override string getAPrimaryQlClass() { result = "BooleanLiteral" }
 }
 
-/** An integer literal. For example, `23`. */
+/**
+ * An integer literal. For example, `23`.
+ *
+ * An integer literal can never be negative except when:
+ * - It is written in binary, octal or hexadecimal notation
+ * - It is written in decimal notation, has the value `2147483648` and is preceded
+ *   by a minus; in this case the value of the IntegerLiteral is -2147483648 and
+ *   the preceding minus will *not* be modeled as `MinusExpr`.
+ *
+ * In all other cases the preceding minus, if any, will be modeled as a separate
+ * `MinusExpr`.
+ *
+ * The last exception is necessary because `2147483648` on its own would not be
+ * a valid integer literal (and could also not be parsed as CodeQL `int`).
+ */
 class IntegerLiteral extends Literal, @integerliteral {
   /** Gets the int representation of this literal. */
   int getIntValue() { result = getValue().toInt() }
@@ -646,18 +660,55 @@ class IntegerLiteral extends Literal, @integerliteral {
   override string getAPrimaryQlClass() { result = "IntegerLiteral" }
 }
 
-/** A long literal. For example, `23l`. */
+/**
+ * A long literal. For example, `23L`.
+ *
+ * A long literal can never be negative except when:
+ * - It is written in binary, octal or hexadecimal notation
+ * - It is written in decimal notation, has the value `9223372036854775808` and
+ *   is preceded by a minus; in this case the value of the LongLiteral is
+ *   -9223372036854775808 and the preceding minus will *not* be modeled as
+ *   `MinusExpr`.
+ *
+ * In all other cases the preceding minus, if any, will be modeled as a separate
+ * `MinusExpr`.
+ *
+ * The last exception is necessary because `9223372036854775808` on its own
+ * would not be a valid long literal.
+ */
 class LongLiteral extends Literal, @longliteral {
   override string getAPrimaryQlClass() { result = "LongLiteral" }
 }
 
-/** A floating point literal. For example, `4.2f`. */
+/**
+ * A float literal. For example, `4.2f`.
+ *
+ * A float literal is never negative; a preceding minus, if any, will always
+ * be modeled as separate `MinusExpr`.
+ */
 class FloatingPointLiteral extends Literal, @floatingpointliteral {
+  /**
+   * Gets the value of this literal as CodeQL 64-bit `float`. The value will
+   * be parsed as Java 32-bit `float` and then converted to a CodeQL `float`.
+   */
+  float getFloatValue() { result = getValue().toFloat() }
+
   override string getAPrimaryQlClass() { result = "FloatingPointLiteral" }
 }
 
-/** A double literal. For example, `4.2`. */
+/**
+ * A double literal. For example, `4.2`.
+ *
+ * A double literal is never negative; a preceding minus, if any, will always
+ * be modeled as separate `MinusExpr`.
+ */
 class DoubleLiteral extends Literal, @doubleliteral {
+  /**
+   * Gets the value of this literal as CodeQL 64-bit `float`. The result will
+   * have the same effective value as the Java `double` literal.
+   */
+  float getDoubleValue() { result = getValue().toFloat() }
+
   override string getAPrimaryQlClass() { result = "DoubleLiteral" }
 }
 
@@ -1757,7 +1808,7 @@ class WildcardTypeAccess extends Expr, @wildcardtypeaccess {
  * This includes method calls, constructor and super constructor invocations,
  * and constructors invoked through class instantiation.
  */
-class Call extends Top, @caller {
+class Call extends ExprParent, @caller {
   /** Gets an argument supplied in this call. */
   /*abstract*/ Expr getAnArgument() { none() }
 
diff --git a/java/ql/src/semmle/code/java/JDK.qll b/java/ql/src/semmle/code/java/JDK.qll
index 3b71396c920..7bc072e177c 100644
--- a/java/ql/src/semmle/code/java/JDK.qll
+++ b/java/ql/src/semmle/code/java/JDK.qll
@@ -46,6 +46,11 @@ class TypeStringBuilder extends Class {
   TypeStringBuilder() { this.hasQualifiedName("java.lang", "StringBuilder") }
 }
 
+/** Class `java.lang.StringBuffer` or `java.lang.StringBuilder`. */
+class StringBuildingType extends Class {
+  StringBuildingType() { this instanceof TypeStringBuffer or this instanceof TypeStringBuilder }
+}
+
 /** The class `java.lang.System`. */
 class TypeSystem extends Class {
   TypeSystem() { this.hasQualifiedName("java.lang", "System") }
@@ -348,7 +353,7 @@ class EqualsMethod extends Method {
 class HashCodeMethod extends Method {
   HashCodeMethod() {
     this.hasName("hashCode") and
-    this.getNumberOfParameters() = 0
+    this.hasNoParameters()
   }
 }
 
@@ -360,6 +365,14 @@ class CloneMethod extends Method {
   }
 }
 
+/** A method with the same signature as `java.lang.Object.toString`. */
+class ToStringMethod extends Method {
+  ToStringMethod() {
+    this.hasName("toString") and
+    this.hasNoParameters()
+  }
+}
+
 /**
  * The public static `main` method, with a single formal parameter
  * of type `String[]` and return type `void`.
diff --git a/java/ql/src/semmle/code/java/Modifier.qll b/java/ql/src/semmle/code/java/Modifier.qll
index 8c48ffb117a..7fb9f982616 100755
--- a/java/ql/src/semmle/code/java/Modifier.qll
+++ b/java/ql/src/semmle/code/java/Modifier.qll
@@ -8,6 +8,8 @@ import Element
 class Modifier extends Element, @modifier {
   /** Gets the element to which this modifier applies. */
   Element getElement() { hasModifier(result, this) }
+
+  override string getAPrimaryQlClass() { result = "Modifier" }
 }
 
 /** An element of the Java syntax tree that may have a modifier. */
diff --git a/java/ql/src/semmle/code/java/Package.qll b/java/ql/src/semmle/code/java/Package.qll
index 6cb41ca559f..466c97e561d 100755
--- a/java/ql/src/semmle/code/java/Package.qll
+++ b/java/ql/src/semmle/code/java/Package.qll
@@ -29,4 +29,6 @@ class Package extends Element, Annotatable, @package {
    * since packages do not have locations.
    */
   string getURL() { result = "file://:0:0:0:0" }
+
+  override string getAPrimaryQlClass() { result = "Package" }
 }
diff --git a/java/ql/src/semmle/code/java/PrintAst.qll b/java/ql/src/semmle/code/java/PrintAst.qll
index 4e219603024..6a74c15316c 100644
--- a/java/ql/src/semmle/code/java/PrintAst.qll
+++ b/java/ql/src/semmle/code/java/PrintAst.qll
@@ -433,9 +433,7 @@ final class ClassInterfaceNode extends ElementNode {
     or
     result.(FieldDeclaration).getAField().getDeclaringType() = ty
     or
-    result.(NestedType).getEnclosingType().getSourceDeclaration() = ty and
-    not result instanceof AnonymousClass and
-    not result instanceof LocalClass
+    result.(MemberType).getEnclosingType().getSourceDeclaration() = ty
     or
     isInitBlock(ty, result)
   }
diff --git a/java/ql/src/semmle/code/java/StringFormat.qll b/java/ql/src/semmle/code/java/StringFormat.qll
index 000a074f31d..aa77feafeb9 100644
--- a/java/ql/src/semmle/code/java/StringFormat.qll
+++ b/java/ql/src/semmle/code/java/StringFormat.qll
@@ -210,10 +210,7 @@ private predicate printMethod(Method m, int i) {
     (t.hasQualifiedName("java.io", "PrintWriter") or t.hasQualifiedName("java.io", "PrintStream")) and
     (m.hasName("print") or m.hasName("println"))
     or
-    (
-      t.hasQualifiedName("java.lang", "StringBuilder") or
-      t.hasQualifiedName("java.lang", "StringBuffer")
-    ) and
+    t instanceof StringBuildingType and
     (m.hasName("append") or m.hasName("insert"))
     or
     t instanceof TypeString and m.hasName("valueOf")
diff --git a/java/ql/src/semmle/code/java/Type.qll b/java/ql/src/semmle/code/java/Type.qll
index 10d9b8b3a31..5eaa52ee548 100755
--- a/java/ql/src/semmle/code/java/Type.qll
+++ b/java/ql/src/semmle/code/java/Type.qll
@@ -517,7 +517,12 @@ class RefType extends Type, Annotatable, Modifiable, @reftype {
   /** Holds if this is a top-level type, which is not nested inside any other types. */
   predicate isTopLevel() { this instanceof TopLevelType }
 
-  /** Holds if this type is declared in a specified package with the specified name. */
+  /**
+   * Holds if this type is declared in a specified package with the specified name.
+   *
+   * For nested types the name of the nested type is prefixed with a `$` and appended
+   * to the name of the enclosing type, which might be a nested type as well.
+   */
   predicate hasQualifiedName(string package, string type) {
     this.getPackage().hasName(package) and type = this.nestedName()
   }
@@ -532,7 +537,12 @@ class RefType extends Type, Annotatable, Modifiable, @reftype {
   }
 
   /**
-   * Gets the qualified name of this type.
+   * Gets the qualified name of this type, consisting of the package name followed by
+   * a `.` and the name of this type.
+   *
+   * For nested types the name of the nested type is prefixed with a `$` and appended
+   * to the name of the enclosing type, which might be a nested type as well. For example:
+   * `java.lang.Thread$State`.
    */
   string getQualifiedName() {
     exists(string pkgName | pkgName = getPackage().getName() |
@@ -540,7 +550,13 @@ class RefType extends Type, Annotatable, Modifiable, @reftype {
     )
   }
 
-  /** Gets the nested name of this type. */
+  /**
+   * Gets the nested name of this type.
+   *
+   * If this type is not a nested type, the result is the same as `getName()`.
+   * Otherwise the name of the nested type is prefixed with a `$` and appended to
+   * the name of the enclosing type, which might be a nested type as well.
+   */
   string nestedName() {
     not this instanceof NestedType and result = this.getName()
     or
@@ -788,6 +804,21 @@ class NestedType extends RefType {
   }
 }
 
+/**
+ * A nested type which is a direct member of the enclosing type,
+ * that is, neither an anonymous nor local class.
+ */
+class MemberType extends NestedType, Member {
+  /**
+   * Gets the qualified name of this member type.
+   *
+   * The qualified name consists of the package name, a `.`, the name of the declaring
+   * type (which might be a nested or member type as well), followed by a `$` and the
+   * name of this member type. For example: `java.lang.Thread$State`.
+   */
+  override string getQualifiedName() { result = NestedType.super.getQualifiedName() }
+}
+
 /**
  * A class declared within another type.
  *
@@ -797,8 +828,9 @@ class NestedType extends RefType {
 class NestedClass extends NestedType, Class { }
 
 /**
- * An inner class is a nested class that is neither
- * explicitly nor implicitly declared static.
+ * An inner class is a nested class that is neither explicitly nor
+ * implicitly declared static. This includes anonymous and local
+ * classes.
  */
 class InnerClass extends NestedClass {
   InnerClass() { not this.isStatic() }
diff --git a/java/ql/src/semmle/code/java/Variable.qll b/java/ql/src/semmle/code/java/Variable.qll
index e038f98beaf..439ee5d3f6b 100755
--- a/java/ql/src/semmle/code/java/Variable.qll
+++ b/java/ql/src/semmle/code/java/Variable.qll
@@ -53,6 +53,8 @@ class LocalVariableDecl extends @localvar, LocalScopeVariable {
 
   /** Gets the initializer expression of this local variable declaration. */
   override Expr getInitializer() { result = getDeclExpr().getInit() }
+
+  override string getAPrimaryQlClass() { result = "LocalVariableDecl" }
 }
 
 /** A formal parameter of a callable. */
diff --git a/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll b/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
index 28808bc722d..7d70017c6d8 100644
--- a/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
+++ b/java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll
@@ -32,26 +32,30 @@
  * 7. The `input` column specifies how data enters the element selected by the
  *    first 6 columns, and the `output` column specifies how data leaves the
  *    element selected by the first 6 columns. An `input` can be either "",
- *    "Argument", "Argument[n]", "ReturnValue":
+ *    "Argument[n]", "Argument[n1..n2]", "ReturnValue":
  *    - "": Selects a write to the selected element in case this is a field.
- *    - "Argument": Selects any argument in a call to the selected element.
- *    - "Argument[n]": Similar to "Argument" but restricted to a specific numbered
- *      argument (zero-indexed, and `-1` specifies the qualifier).
+ *    - "Argument[n]": Selects an argument in a call to the selected element.
+ *      The arguments are zero-indexed, and `-1` specifies the qualifier.
+ *    - "Argument[n1..n2]": Similar to "Argument[n]" but select any argument in
+ *      the given range. The range is inclusive at both ends.
  *    - "ReturnValue": Selects a value being returned by the selected element.
  *      This requires that the selected element is a method with a body.
  *
- *    An `output` can be either "", "Argument", "Argument[n]", "Parameter",
- *    "Parameter[n]", or "ReturnValue":
+ *    An `output` can be either "", "Argument[n]", "Argument[n1..n2]", "Parameter",
+ *    "Parameter[n]", "Parameter[n1..n2]", or "ReturnValue":
  *    - "": Selects a read of a selected field, or a selected parameter.
- *    - "Argument": Selects the post-update value of an argument in a call to the
+ *    - "Argument[n]": Selects the post-update value of an argument in a call to the
  *      selected element. That is, the value of the argument after the call returns.
- *    - "Argument[n]": Similar to "Argument" but restricted to a specific numbered
- *      argument (zero-indexed, and `-1` specifies the qualifier).
+ *      The arguments are zero-indexed, and `-1` specifies the qualifier.
+ *    - "Argument[n1..n2]": Similar to "Argument[n]" but select any argument in
+ *      the given range. The range is inclusive at both ends.
  *    - "Parameter": Selects the value of a parameter of the selected element.
  *      "Parameter" is also allowed in case the selected element is already a
  *      parameter itself.
  *    - "Parameter[n]": Similar to "Parameter" but restricted to a specific
  *      numbered parameter (zero-indexed, and `-1` specifies the value of `this`).
+ *    - "Parameter[n1..n2]": Similar to "Parameter[n]" but selects any parameter
+ *      in the given range. The range is inclusive at both ends.
  *    - "ReturnValue": Selects the return value of a call to the selected element.
  * 8. The `kind` column is a tag that can be referenced from QL to determine to
  *    which classes the interpreted elements should be added. For example, for
@@ -63,6 +67,7 @@
 import java
 private import semmle.code.java.dataflow.DataFlow::DataFlow
 private import internal.DataFlowPrivate
+private import FlowSummary
 
 /**
  * A module importing the frameworks that provide external flow data,
@@ -368,6 +373,60 @@ private predicate summaryModel(
   )
 }
 
+private predicate relevantPackage(string package) {
+  sourceModel(package, _, _, _, _, _, _, _) or
+  sinkModel(package, _, _, _, _, _, _, _) or
+  summaryModel(package, _, _, _, _, _, _, _, _)
+}
+
+private predicate packageLink(string shortpkg, string longpkg) {
+  relevantPackage(shortpkg) and
+  relevantPackage(longpkg) and
+  longpkg.prefix(longpkg.indexOf(".")) = shortpkg
+}
+
+private predicate canonicalPackage(string package) {
+  relevantPackage(package) and not packageLink(_, package)
+}
+
+private predicate canonicalPkgLink(string package, string subpkg) {
+  canonicalPackage(package) and
+  (subpkg = package or packageLink(package, subpkg))
+}
+
+/**
+ * Holds if CSV framework coverage of `package` is `n` api endpoints of the
+ * kind `(kind, part)`.
+ */
+predicate modelCoverage(string package, int pkgs, string kind, string part, int n) {
+  pkgs = strictcount(string subpkg | canonicalPkgLink(package, subpkg)) and
+  (
+    part = "source" and
+    n =
+      strictcount(string subpkg, string type, boolean subtypes, string name, string signature,
+        string ext, string output |
+        canonicalPkgLink(package, subpkg) and
+        sourceModel(subpkg, type, subtypes, name, signature, ext, output, kind)
+      )
+    or
+    part = "sink" and
+    n =
+      strictcount(string subpkg, string type, boolean subtypes, string name, string signature,
+        string ext, string input |
+        canonicalPkgLink(package, subpkg) and
+        sinkModel(subpkg, type, subtypes, name, signature, ext, input, kind)
+      )
+    or
+    part = "summary" and
+    n =
+      strictcount(string subpkg, string type, boolean subtypes, string name, string signature,
+        string ext, string input, string output |
+        canonicalPkgLink(package, subpkg) and
+        summaryModel(subpkg, type, subtypes, name, signature, ext, input, output, kind)
+      )
+  )
+}
+
 /** Provides a query predicate to check the CSV data for validation errors. */
 module CsvValidation {
   /** Holds if some row in a CSV-based flow model appears to contain typos. */
@@ -401,7 +460,8 @@ module CsvValidation {
       summaryModel(_, _, _, _, _, _, input, _, _) and pred = "summary"
     |
       specSplit(input, part, _) and
-      not part.regexpMatch("|Argument|ReturnValue") and
+      not part.regexpMatch("|ReturnValue|ArrayElement|Element|MapKey|MapValue") and
+      not (part = "Argument" and pred = "sink") and
       not parseArg(part, _) and
       msg = "Unrecognized input specification \"" + part + "\" in " + pred + " model."
     )
@@ -412,7 +472,8 @@ module CsvValidation {
       summaryModel(_, _, _, _, _, _, _, output, _) and pred = "summary"
     |
       specSplit(output, part, _) and
-      not part.regexpMatch("|Argument|Parameter|ReturnValue") and
+      not part.regexpMatch("|ReturnValue|ArrayElement|Element|MapKey|MapValue") and
+      not (part = ["Argument", "Parameter"] and pred = "source") and
       not parseArg(part, _) and
       not parseParam(part, _) and
       msg = "Unrecognized output specification \"" + part + "\" in " + pred + " model."
@@ -554,11 +615,29 @@ private string getLast(string s) {
 }
 
 private predicate parseParam(string c, int n) {
-  specSplit(_, c, _) and c.regexpCapture("Parameter\\[([-0-9]+)\\]", 1).toInt() = n
+  specSplit(_, c, _) and
+  (
+    c.regexpCapture("Parameter\\[([-0-9]+)\\]", 1).toInt() = n
+    or
+    exists(int n1, int n2 |
+      c.regexpCapture("Parameter\\[([-0-9]+)\\.\\.([0-9]+)\\]", 1).toInt() = n1 and
+      c.regexpCapture("Parameter\\[([-0-9]+)\\.\\.([0-9]+)\\]", 2).toInt() = n2 and
+      n = [n1 .. n2]
+    )
+  )
 }
 
 private predicate parseArg(string c, int n) {
-  specSplit(_, c, _) and c.regexpCapture("Argument\\[([-0-9]+)\\]", 1).toInt() = n
+  specSplit(_, c, _) and
+  (
+    c.regexpCapture("Argument\\[([-0-9]+)\\]", 1).toInt() = n
+    or
+    exists(int n1, int n2 |
+      c.regexpCapture("Argument\\[([-0-9]+)\\.\\.([0-9]+)\\]", 1).toInt() = n1 and
+      c.regexpCapture("Argument\\[([-0-9]+)\\.\\.([0-9]+)\\]", 2).toInt() = n2 and
+      n = [n1 .. n2]
+    )
+  )
 }
 
 private predicate inputNeedsReference(string c) {
@@ -599,6 +678,75 @@ private predicate summaryElementRef(Top ref, string input, string output, string
   )
 }
 
+private SummaryComponent interpretComponent(string c) {
+  specSplit(_, c, _) and
+  (
+    exists(int pos | parseArg(c, pos) and result = SummaryComponent::argument(pos))
+    or
+    exists(int pos | parseParam(c, pos) and result = SummaryComponent::parameter(pos))
+    or
+    c = "ReturnValue" and result = SummaryComponent::return()
+    or
+    c = "ArrayElement" and result = SummaryComponent::content(any(ArrayContent c0))
+    or
+    c = "Element" and result = SummaryComponent::content(any(CollectionContent c0))
+    or
+    c = "MapKey" and result = SummaryComponent::content(any(MapKeyContent c0))
+    or
+    c = "MapValue" and result = SummaryComponent::content(any(MapValueContent c0))
+  )
+}
+
+private predicate interpretSpec(string spec, int idx, SummaryComponentStack stack) {
+  exists(string c |
+    summaryElement(_, spec, _, _) or
+    summaryElement(_, _, spec, _)
+  |
+    len(spec, idx + 1) and
+    specSplit(spec, c, idx) and
+    stack = SummaryComponentStack::singleton(interpretComponent(c))
+  )
+  or
+  exists(SummaryComponent head, SummaryComponentStack tail |
+    interpretSpec(spec, idx, head, tail) and
+    stack = SummaryComponentStack::push(head, tail)
+  )
+}
+
+private predicate interpretSpec(
+  string output, int idx, SummaryComponent head, SummaryComponentStack tail
+) {
+  exists(string c |
+    interpretSpec(output, idx + 1, tail) and
+    specSplit(output, c, idx) and
+    head = interpretComponent(c)
+  )
+}
+
+private class MkStack extends RequiredSummaryComponentStack {
+  MkStack() { interpretSpec(_, _, _, this) }
+
+  override predicate required(SummaryComponent c) { interpretSpec(_, _, c, this) }
+}
+
+private class SummarizedCallableExternal extends SummarizedCallable {
+  SummarizedCallableExternal() { summaryElement(this, _, _, _) }
+
+  override predicate propagatesFlow(
+    SummaryComponentStack input, SummaryComponentStack output, boolean preservesValue
+  ) {
+    exists(string inSpec, string outSpec, string kind |
+      summaryElement(this, inSpec, outSpec, kind) and
+      interpretSpec(inSpec, 0, input) and
+      interpretSpec(outSpec, 0, output)
+    |
+      kind = "value" and preservesValue = true
+      or
+      kind = "taint" and preservesValue = false
+    )
+  }
+}
+
 private newtype TAstOrNode =
   TAst(Top t) or
   TNode(Node n)
@@ -685,15 +833,3 @@ predicate sinkNode(Node node, string kind) {
     interpretInput(input, 0, ref, TNode(node))
   )
 }
-
-/**
- * Holds if `node1` to `node2` is specified as a flow step with the given kind
- * in a CSV flow model.
- */
-predicate summaryStep(Node node1, Node node2, string kind) {
-  exists(Top ref, string input, string output |
-    summaryElementRef(ref, input, output, kind) and
-    interpretInput(input, 0, ref, TNode(node1)) and
-    interpretOutput(output, 0, ref, TNode(node2))
-  )
-}
diff --git a/java/ql/src/semmle/code/java/dataflow/FlowSteps.qll b/java/ql/src/semmle/code/java/dataflow/FlowSteps.qll
index 60308f44f65..d30cca6afe6 100644
--- a/java/ql/src/semmle/code/java/dataflow/FlowSteps.qll
+++ b/java/ql/src/semmle/code/java/dataflow/FlowSteps.qll
@@ -152,8 +152,7 @@ private class NumberTaintPreservingCallable extends TaintPreservingCallable {
 
 /** Holds for the types `StringBuilder`, `StringBuffer`, and `StringWriter`. */
 private predicate stringBuilderType(RefType t) {
-  t.hasQualifiedName("java.lang", "StringBuilder") or
-  t.hasQualifiedName("java.lang", "StringBuffer") or
+  t instanceof StringBuildingType or
   t.hasQualifiedName("java.io", "StringWriter")
 }
 
diff --git a/java/ql/src/semmle/code/java/dataflow/FlowSummary.qll b/java/ql/src/semmle/code/java/dataflow/FlowSummary.qll
new file mode 100644
index 00000000000..0f222d5caa2
--- /dev/null
+++ b/java/ql/src/semmle/code/java/dataflow/FlowSummary.qll
@@ -0,0 +1,51 @@
+/**
+ * Provides classes and predicates for definining flow summaries.
+ */
+
+import java
+private import internal.FlowSummaryImpl as Impl
+private import internal.DataFlowDispatch
+private import internal.DataFlowPrivate
+
+// import all instances of SummarizedCallable below
+private module Summaries {
+  private import semmle.code.java.dataflow.ExternalFlow
+}
+
+class SummaryComponent = Impl::Public::SummaryComponent;
+
+/** Provides predicates for constructing summary components. */
+module SummaryComponent {
+  import Impl::Public::SummaryComponent
+
+  /** Gets a summary component that represents a qualifier. */
+  SummaryComponent qualifier() { result = argument(-1) }
+
+  /** Gets a summary component for field `f`. */
+  SummaryComponent field(Field f) { result = content(any(FieldContent c | c.getField() = f)) }
+
+  /** Gets a summary component that represents the return value of a call. */
+  SummaryComponent return() { result = return(_) }
+}
+
+class SummaryComponentStack = Impl::Public::SummaryComponentStack;
+
+/** Provides predicates for constructing stacks of summary components. */
+module SummaryComponentStack {
+  import Impl::Public::SummaryComponentStack
+
+  /** Gets a singleton stack representing a qualifier. */
+  SummaryComponentStack qualifier() { result = singleton(SummaryComponent::qualifier()) }
+
+  /** Gets a stack representing a field `f` of `object`. */
+  SummaryComponentStack fieldOf(Field f, SummaryComponentStack object) {
+    result = push(SummaryComponent::field(f), object)
+  }
+
+  /** Gets a singleton stack representing a (normal) return. */
+  SummaryComponentStack return() { result = singleton(SummaryComponent::return()) }
+}
+
+class SummarizedCallable = Impl::Public::SummarizedCallable;
+
+class RequiredSummaryComponentStack = Impl::Public::RequiredSummaryComponentStack;
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowDispatch.qll b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowDispatch.qll
index ba99bffbf5f..3a98ed62847 100644
--- a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowDispatch.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowDispatch.qll
@@ -2,9 +2,17 @@ private import java
 private import DataFlowPrivate
 private import DataFlowUtil
 private import semmle.code.java.dataflow.InstanceAccess
-import semmle.code.java.dispatch.VirtualDispatch
+private import semmle.code.java.dataflow.FlowSummary
+private import semmle.code.java.dispatch.VirtualDispatch as VirtualDispatch
 
 private module DispatchImpl {
+  /** Gets a viable implementation of the target of the given `Call`. */
+  Callable viableCallable(Call c) {
+    result = VirtualDispatch::viableCallable(c)
+    or
+    result.(SummarizedCallable) = c.getCallee().getSourceDeclaration()
+  }
+
   /**
    * Holds if the set of viable implementations that can be called by `ma`
    * might be improved by knowing the call context. This is the case if the
@@ -12,7 +20,7 @@ private module DispatchImpl {
    */
   private predicate mayBenefitFromCallContext(MethodAccess ma, Callable c, int i) {
     exists(Parameter p |
-      2 <= strictcount(viableImpl(ma)) and
+      2 <= strictcount(VirtualDispatch::viableImpl(ma)) and
       ma.getQualifier().(VarAccess).getVariable() = p and
       p.getPosition() = i and
       c.getAParameter() = p and
@@ -21,7 +29,7 @@ private module DispatchImpl {
     )
     or
     exists(OwnInstanceAccess ia |
-      2 <= strictcount(viableImpl(ma)) and
+      2 <= strictcount(VirtualDispatch::viableImpl(ma)) and
       (ia.isExplicit(ma.getQualifier()) or ia.isImplicitMethodQualifier(ma)) and
       i = -1 and
       c = ma.getEnclosingCallable()
@@ -41,6 +49,12 @@ private module DispatchImpl {
     )
   }
 
+  private RefType getPreciseType(Expr e) {
+    result = e.(FunctionalExpr).getConstructedType()
+    or
+    not e instanceof FunctionalExpr and result = e.getType()
+  }
+
   /**
    * Holds if the `i`th argument of `ctx` has type `t` and `ctx` is a
    * relevant call context.
@@ -54,8 +68,8 @@ private module DispatchImpl {
         or
         ctx.getArgument(i) = arg
       |
-        src = variableTrack(arg) and
-        srctype = src.getType() and
+        src = VirtualDispatch::variableTrack(arg) and
+        srctype = getPreciseType(src) and
         if src instanceof ClassInstanceExpr then exact = true else exact = false
       )
       or
@@ -67,11 +81,9 @@ private module DispatchImpl {
         if ctx instanceof ClassInstanceExpr then exact = true else exact = false
       )
     |
-      exists(TypeVariable v | v = srctype |
-        t = v.getUpperBoundType+() and not t instanceof TypeVariable
-      )
+      t = srctype.(BoundedType).getAnUltimateUpperBoundType()
       or
-      t = srctype and not srctype instanceof TypeVariable
+      t = srctype and not srctype instanceof BoundedType
     )
   }
 
@@ -89,18 +101,18 @@ private module DispatchImpl {
    * restricted to those `ma`s for which a context might make a difference.
    */
   Method viableImplInCallContext(MethodAccess ma, Call ctx) {
-    result = viableImpl(ma) and
+    result = VirtualDispatch::viableImpl(ma) and
     exists(int i, Callable c, Method def, RefType t, boolean exact |
       mayBenefitFromCallContext(ma, c, i) and
       c = viableCallable(ctx) and
       contextArgHasType(ctx, i, t, exact) and
       ma.getMethod() = def
     |
-      exact = true and result = exactMethodImpl(def, t.getSourceDeclaration())
+      exact = true and result = VirtualDispatch::exactMethodImpl(def, t.getSourceDeclaration())
       or
       exact = false and
       exists(RefType t2 |
-        result = viableMethodImpl(def, t.getSourceDeclaration(), t2) and
+        result = VirtualDispatch::viableMethodImpl(def, t.getSourceDeclaration(), t2) and
         not failsUnification(t, t2)
       )
     )
@@ -113,7 +125,7 @@ private module DispatchImpl {
 
   pragma[noinline]
   private predicate unificationTargetRight(ParameterizedType t2, GenericType g) {
-    exists(viableMethodImpl(_, _, t2)) and t2.getGenericType() = g
+    exists(VirtualDispatch::viableMethodImpl(_, _, t2)) and t2.getGenericType() = g
   }
 
   private predicate unificationTargets(Type t1, Type t2) {
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl.qll b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl.qll
index 8b446d28b86..9498e51e7e6 100644
--- a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl.qll
@@ -2133,11 +2133,8 @@ private module Stage4 {
 
   bindingset[node, cc, config]
   private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl2.qll b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl2.qll
index 8b446d28b86..9498e51e7e6 100644
--- a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl2.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl2.qll
@@ -2133,11 +2133,8 @@ private module Stage4 {
 
   bindingset[node, cc, config]
   private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl3.qll b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl3.qll
index 8b446d28b86..9498e51e7e6 100644
--- a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl3.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl3.qll
@@ -2133,11 +2133,8 @@ private module Stage4 {
 
   bindingset[node, cc, config]
   private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl4.qll b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl4.qll
index 8b446d28b86..9498e51e7e6 100644
--- a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl4.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl4.qll
@@ -2133,11 +2133,8 @@ private module Stage4 {
 
   bindingset[node, cc, config]
   private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl5.qll b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl5.qll
index 8b446d28b86..9498e51e7e6 100644
--- a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl5.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl5.qll
@@ -2133,11 +2133,8 @@ private module Stage4 {
 
   bindingset[node, cc, config]
   private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImplCommon.qll b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImplCommon.qll
index 1319f972037..a51c20c2288 100644
--- a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImplCommon.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImplCommon.qll
@@ -26,15 +26,243 @@ predicate accessPathCostLimits(int apLimit, int tupleLimit) {
   tupleLimit = 1000
 }
 
+/**
+ * Provides a simple data-flow analysis for resolving lambda calls. The analysis
+ * currently excludes read-steps, store-steps, and flow-through.
+ *
+ * The analysis uses non-linear recursion: When computing a flow path in or out
+ * of a call, we use the results of the analysis recursively to resolve lamba
+ * calls. For this reason, we cannot reuse the code from `DataFlowImpl.qll` directly.
+ */
+private module LambdaFlow {
+  private predicate viableParamNonLambda(DataFlowCall call, int i, ParameterNode p) {
+    p.isParameterOf(viableCallable(call), i)
+  }
+
+  private predicate viableParamLambda(DataFlowCall call, int i, ParameterNode p) {
+    p.isParameterOf(viableCallableLambda(call, _), i)
+  }
+
+  private predicate viableParamArgNonLambda(DataFlowCall call, ParameterNode p, ArgumentNode arg) {
+    exists(int i |
+      viableParamNonLambda(call, i, p) and
+      arg.argumentOf(call, i)
+    )
+  }
+
+  private predicate viableParamArgLambda(DataFlowCall call, ParameterNode p, ArgumentNode arg) {
+    exists(int i |
+      viableParamLambda(call, i, p) and
+      arg.argumentOf(call, i)
+    )
+  }
+
+  private newtype TReturnPositionSimple =
+    TReturnPositionSimple0(DataFlowCallable c, ReturnKind kind) {
+      exists(ReturnNode ret |
+        c = getNodeEnclosingCallable(ret) and
+        kind = ret.getKind()
+      )
+    }
+
+  pragma[noinline]
+  private TReturnPositionSimple getReturnPositionSimple(ReturnNode ret, ReturnKind kind) {
+    result = TReturnPositionSimple0(getNodeEnclosingCallable(ret), kind)
+  }
+
+  pragma[nomagic]
+  private TReturnPositionSimple viableReturnPosNonLambda(DataFlowCall call, ReturnKind kind) {
+    result = TReturnPositionSimple0(viableCallable(call), kind)
+  }
+
+  pragma[nomagic]
+  private TReturnPositionSimple viableReturnPosLambda(
+    DataFlowCall call, DataFlowCallOption lastCall, ReturnKind kind
+  ) {
+    result = TReturnPositionSimple0(viableCallableLambda(call, lastCall), kind)
+  }
+
+  private predicate viableReturnPosOutNonLambda(
+    DataFlowCall call, TReturnPositionSimple pos, OutNode out
+  ) {
+    exists(ReturnKind kind |
+      pos = viableReturnPosNonLambda(call, kind) and
+      out = getAnOutNode(call, kind)
+    )
+  }
+
+  private predicate viableReturnPosOutLambda(
+    DataFlowCall call, DataFlowCallOption lastCall, TReturnPositionSimple pos, OutNode out
+  ) {
+    exists(ReturnKind kind |
+      pos = viableReturnPosLambda(call, lastCall, kind) and
+      out = getAnOutNode(call, kind)
+    )
+  }
+
+  /**
+   * Holds if data can flow (inter-procedurally) from `node` (of type `t`) to
+   * the lambda call `lambdaCall`.
+   *
+   * The parameter `toReturn` indicates whether the path from `node` to
+   * `lambdaCall` goes through a return, and `toJump` whether the path goes
+   * through a jump step.
+   *
+   * The call context `lastCall` records the last call on the path from `node`
+   * to `lambdaCall`, if any. That is, `lastCall` is able to target the enclosing
+   * callable of `lambdaCall`.
+   */
+  pragma[nomagic]
+  predicate revLambdaFlow(
+    DataFlowCall lambdaCall, LambdaCallKind kind, Node node, DataFlowType t, boolean toReturn,
+    boolean toJump, DataFlowCallOption lastCall
+  ) {
+    revLambdaFlow0(lambdaCall, kind, node, t, toReturn, toJump, lastCall) and
+    if node instanceof CastNode or node instanceof ArgumentNode or node instanceof ReturnNode
+    then compatibleTypes(t, getNodeType(node))
+    else any()
+  }
+
+  pragma[nomagic]
+  predicate revLambdaFlow0(
+    DataFlowCall lambdaCall, LambdaCallKind kind, Node node, DataFlowType t, boolean toReturn,
+    boolean toJump, DataFlowCallOption lastCall
+  ) {
+    lambdaCall(lambdaCall, kind, node) and
+    t = getNodeType(node) and
+    toReturn = false and
+    toJump = false and
+    lastCall = TDataFlowCallNone()
+    or
+    // local flow
+    exists(Node mid, DataFlowType t0 |
+      revLambdaFlow(lambdaCall, kind, mid, t0, toReturn, toJump, lastCall)
+    |
+      simpleLocalFlowStep(node, mid) and
+      t = t0
+      or
+      exists(boolean preservesValue |
+        additionalLambdaFlowStep(node, mid, preservesValue) and
+        getNodeEnclosingCallable(node) = getNodeEnclosingCallable(mid)
+      |
+        preservesValue = false and
+        t = getNodeType(node)
+        or
+        preservesValue = true and
+        t = t0
+      )
+    )
+    or
+    // jump step
+    exists(Node mid, DataFlowType t0 |
+      revLambdaFlow(lambdaCall, kind, mid, t0, _, _, _) and
+      toReturn = false and
+      toJump = true and
+      lastCall = TDataFlowCallNone()
+    |
+      jumpStep(node, mid) and
+      t = t0
+      or
+      exists(boolean preservesValue |
+        additionalLambdaFlowStep(node, mid, preservesValue) and
+        getNodeEnclosingCallable(node) != getNodeEnclosingCallable(mid)
+      |
+        preservesValue = false and
+        t = getNodeType(node)
+        or
+        preservesValue = true and
+        t = t0
+      )
+    )
+    or
+    // flow into a callable
+    exists(ParameterNode p, DataFlowCallOption lastCall0, DataFlowCall call |
+      revLambdaFlowIn(lambdaCall, kind, p, t, toJump, lastCall0) and
+      (
+        if lastCall0 = TDataFlowCallNone() and toJump = false
+        then lastCall = TDataFlowCallSome(call)
+        else lastCall = lastCall0
+      ) and
+      toReturn = false
+    |
+      viableParamArgNonLambda(call, p, node)
+      or
+      viableParamArgLambda(call, p, node) // non-linear recursion
+    )
+    or
+    // flow out of a callable
+    exists(TReturnPositionSimple pos |
+      revLambdaFlowOut(lambdaCall, kind, pos, t, toJump, lastCall) and
+      getReturnPositionSimple(node, node.(ReturnNode).getKind()) = pos and
+      toReturn = true
+    )
+  }
+
+  pragma[nomagic]
+  predicate revLambdaFlowOutLambdaCall(
+    DataFlowCall lambdaCall, LambdaCallKind kind, OutNode out, DataFlowType t, boolean toJump,
+    DataFlowCall call, DataFlowCallOption lastCall
+  ) {
+    revLambdaFlow(lambdaCall, kind, out, t, _, toJump, lastCall) and
+    exists(ReturnKindExt rk |
+      out = rk.getAnOutNode(call) and
+      lambdaCall(call, _, _)
+    )
+  }
+
+  pragma[nomagic]
+  predicate revLambdaFlowOut(
+    DataFlowCall lambdaCall, LambdaCallKind kind, TReturnPositionSimple pos, DataFlowType t,
+    boolean toJump, DataFlowCallOption lastCall
+  ) {
+    exists(DataFlowCall call, OutNode out |
+      revLambdaFlow(lambdaCall, kind, out, t, _, toJump, lastCall) and
+      viableReturnPosOutNonLambda(call, pos, out)
+      or
+      // non-linear recursion
+      revLambdaFlowOutLambdaCall(lambdaCall, kind, out, t, toJump, call, lastCall) and
+      viableReturnPosOutLambda(call, _, pos, out)
+    )
+  }
+
+  pragma[nomagic]
+  predicate revLambdaFlowIn(
+    DataFlowCall lambdaCall, LambdaCallKind kind, ParameterNode p, DataFlowType t, boolean toJump,
+    DataFlowCallOption lastCall
+  ) {
+    revLambdaFlow(lambdaCall, kind, p, t, false, toJump, lastCall)
+  }
+}
+
+private DataFlowCallable viableCallableExt(DataFlowCall call) {
+  result = viableCallable(call)
+  or
+  result = viableCallableLambda(call, _)
+}
+
 cached
 private module Cached {
+  /**
+   * Gets a viable target for the lambda call `call`.
+   *
+   * `lastCall` records the call required to reach `call` in order for the result
+   * to be a viable target, if any.
+   */
+  cached
+  DataFlowCallable viableCallableLambda(DataFlowCall call, DataFlowCallOption lastCall) {
+    exists(Node creation, LambdaCallKind kind |
+      LambdaFlow::revLambdaFlow(call, kind, creation, _, _, _, lastCall) and
+      lambdaCreation(creation, kind, result)
+    )
+  }
+
   /**
    * Holds if `p` is the `i`th parameter of a viable dispatch target of `call`.
    * The instance parameter is considered to have index `-1`.
    */
   pragma[nomagic]
   private predicate viableParam(DataFlowCall call, int i, ParameterNode p) {
-    p.isParameterOf(viableCallable(call), i)
+    p.isParameterOf(viableCallableExt(call), i)
   }
 
   /**
@@ -52,7 +280,7 @@ private module Cached {
 
   pragma[nomagic]
   private ReturnPosition viableReturnPos(DataFlowCall call, ReturnKindExt kind) {
-    viableCallable(call) = result.getCallable() and
+    viableCallableExt(call) = result.getCallable() and
     kind = result.getKind()
   }
 
@@ -317,6 +545,35 @@ private module Cached {
 
   cached
   private module DispatchWithCallContext {
+    /**
+     * Holds if the set of viable implementations that can be called by `call`
+     * might be improved by knowing the call context.
+     */
+    pragma[nomagic]
+    private predicate mayBenefitFromCallContextExt(DataFlowCall call, DataFlowCallable callable) {
+      mayBenefitFromCallContext(call, callable)
+      or
+      callable = call.getEnclosingCallable() and
+      exists(viableCallableLambda(call, TDataFlowCallSome(_)))
+    }
+
+    /**
+     * Gets a viable dispatch target of `call` in the context `ctx`. This is
+     * restricted to those `call`s for which a context might make a difference.
+     */
+    pragma[nomagic]
+    private DataFlowCallable viableImplInCallContextExt(DataFlowCall call, DataFlowCall ctx) {
+      result = viableImplInCallContext(call, ctx)
+      or
+      result = viableCallableLambda(call, TDataFlowCallSome(ctx))
+      or
+      exists(DataFlowCallable enclosing |
+        mayBenefitFromCallContextExt(call, enclosing) and
+        enclosing = viableCallableExt(ctx) and
+        result = viableCallableLambda(call, TDataFlowCallNone())
+      )
+    }
+
     /**
      * Holds if the call context `ctx` reduces the set of viable run-time
      * dispatch targets of call `call` in `c`.
@@ -324,10 +581,10 @@ private module Cached {
     cached
     predicate reducedViableImplInCallContext(DataFlowCall call, DataFlowCallable c, DataFlowCall ctx) {
       exists(int tgts, int ctxtgts |
-        mayBenefitFromCallContext(call, c) and
-        c = viableCallable(ctx) and
-        ctxtgts = count(viableImplInCallContext(call, ctx)) and
-        tgts = strictcount(viableCallable(call)) and
+        mayBenefitFromCallContextExt(call, c) and
+        c = viableCallableExt(ctx) and
+        ctxtgts = count(viableImplInCallContextExt(call, ctx)) and
+        tgts = strictcount(viableCallableExt(call)) and
         ctxtgts < tgts
       )
     }
@@ -339,7 +596,7 @@ private module Cached {
      */
     cached
     DataFlowCallable prunedViableImplInCallContext(DataFlowCall call, DataFlowCall ctx) {
-      result = viableImplInCallContext(call, ctx) and
+      result = viableImplInCallContextExt(call, ctx) and
       reducedViableImplInCallContext(call, _, ctx)
     }
 
@@ -351,10 +608,10 @@ private module Cached {
     cached
     predicate reducedViableImplInReturn(DataFlowCallable c, DataFlowCall call) {
       exists(int tgts, int ctxtgts |
-        mayBenefitFromCallContext(call, _) and
-        c = viableCallable(call) and
-        ctxtgts = count(DataFlowCall ctx | c = viableImplInCallContext(call, ctx)) and
-        tgts = strictcount(DataFlowCall ctx | viableCallable(ctx) = call.getEnclosingCallable()) and
+        mayBenefitFromCallContextExt(call, _) and
+        c = viableCallableExt(call) and
+        ctxtgts = count(DataFlowCall ctx | c = viableImplInCallContextExt(call, ctx)) and
+        tgts = strictcount(DataFlowCall ctx | viableCallableExt(ctx) = call.getEnclosingCallable()) and
         ctxtgts < tgts
       )
     }
@@ -367,7 +624,7 @@ private module Cached {
      */
     cached
     DataFlowCallable prunedViableImplInCallContextReverse(DataFlowCall call, DataFlowCall ctx) {
-      result = viableImplInCallContext(call, ctx) and
+      result = viableImplInCallContextExt(call, ctx) and
       reducedViableImplInReturn(result, call)
     }
   }
@@ -481,6 +738,11 @@ private module Cached {
     TBooleanNone() or
     TBooleanSome(boolean b) { b = true or b = false }
 
+  cached
+  newtype TDataFlowCallOption =
+    TDataFlowCallNone() or
+    TDataFlowCallSome(DataFlowCall call)
+
   cached
   newtype TTypedContent = MkTypedContent(Content c, DataFlowType t) { store(_, c, _, _, t) }
 
@@ -777,7 +1039,7 @@ ReturnPosition getReturnPosition(ReturnNodeExt ret) {
 
 bindingset[cc, callable]
 predicate resolveReturn(CallContext cc, DataFlowCallable callable, DataFlowCall call) {
-  cc instanceof CallContextAny and callable = viableCallable(call)
+  cc instanceof CallContextAny and callable = viableCallableExt(call)
   or
   exists(DataFlowCallable c0, DataFlowCall call0 |
     call0.getEnclosingCallable() = callable and
@@ -791,14 +1053,14 @@ DataFlowCallable resolveCall(DataFlowCall call, CallContext cc) {
   exists(DataFlowCall ctx | cc = TSpecificCall(ctx) |
     if reducedViableImplInCallContext(call, _, ctx)
     then result = prunedViableImplInCallContext(call, ctx)
-    else result = viableCallable(call)
+    else result = viableCallableExt(call)
   )
   or
-  result = viableCallable(call) and cc instanceof CallContextSomeCall
+  result = viableCallableExt(call) and cc instanceof CallContextSomeCall
   or
-  result = viableCallable(call) and cc instanceof CallContextAny
+  result = viableCallableExt(call) and cc instanceof CallContextAny
   or
-  result = viableCallable(call) and cc instanceof CallContextReturn
+  result = viableCallableExt(call) and cc instanceof CallContextReturn
 }
 
 predicate read = readStep/3;
@@ -812,6 +1074,19 @@ class BooleanOption extends TBooleanOption {
   }
 }
 
+/** An optional `DataFlowCall`. */
+class DataFlowCallOption extends TDataFlowCallOption {
+  string toString() {
+    this = TDataFlowCallNone() and
+    result = "(none)"
+    or
+    exists(DataFlowCall call |
+      this = TDataFlowCallSome(call) and
+      result = call.toString()
+    )
+  }
+}
+
 /** Content tagged with the type of a containing object. */
 class TypedContent extends MkTypedContent {
   private Content c;
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowNodes.qll b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowNodes.qll
new file mode 100644
index 00000000000..552849c2c34
--- /dev/null
+++ b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowNodes.qll
@@ -0,0 +1,445 @@
+private import java
+private import semmle.code.java.dataflow.InstanceAccess
+private import semmle.code.java.dataflow.FlowSummary
+private import semmle.code.java.dataflow.TypeFlow
+private import DataFlowPrivate
+private import FlowSummaryImpl as FlowSummaryImpl
+
+cached
+private module Cached {
+  cached
+  newtype TNode =
+    TExprNode(Expr e) {
+      not e.getType() instanceof VoidType and
+      not e.getParent*() instanceof Annotation
+    } or
+    TExplicitParameterNode(Parameter p) {
+      exists(p.getCallable().getBody()) or p.getCallable() instanceof SummarizedCallable
+    } or
+    TImplicitVarargsArray(Call c) {
+      c.getCallee().isVarargs() and
+      not exists(Argument arg | arg.getCall() = c and arg.isExplicitVarargsArray())
+    } or
+    TInstanceParameterNode(Callable c) {
+      (exists(c.getBody()) or c instanceof SummarizedCallable) and
+      not c.isStatic()
+    } or
+    TImplicitInstanceAccess(InstanceAccessExt ia) { not ia.isExplicit(_) } or
+    TMallocNode(ClassInstanceExpr cie) or
+    TExplicitExprPostUpdate(Expr e) {
+      explicitInstanceArgument(_, e)
+      or
+      e instanceof Argument and not e.getType() instanceof ImmutableType
+      or
+      exists(FieldAccess fa | fa.getField() instanceof InstanceField and e = fa.getQualifier())
+      or
+      exists(ArrayAccess aa | e = aa.getArray())
+    } or
+    TImplicitExprPostUpdate(InstanceAccessExt ia) {
+      implicitInstanceArgument(_, ia)
+      or
+      exists(FieldAccess fa |
+        fa.getField() instanceof InstanceField and ia.isImplicitFieldQualifier(fa)
+      )
+    } or
+    TSummaryInternalNode(SummarizedCallable c, FlowSummaryImpl::Private::SummaryNodeState state) {
+      FlowSummaryImpl::Private::summaryNodeRange(c, state)
+    }
+
+  cached
+  predicate summaryOutNodeCached(DataFlowCall c, Node out) {
+    FlowSummaryImpl::Private::summaryOutNode(c, out, _)
+  }
+
+  cached
+  predicate summaryArgumentNodeCached(DataFlowCall c, Node arg, int i) {
+    FlowSummaryImpl::Private::summaryArgumentNode(c, arg, i)
+  }
+
+  cached
+  predicate summaryPostUpdateNodeCached(Node post, ParameterNode pre) {
+    FlowSummaryImpl::Private::summaryPostUpdateNode(post, pre)
+  }
+
+  cached
+  predicate summaryReturnNodeCached(Node ret) {
+    FlowSummaryImpl::Private::summaryReturnNode(ret, _)
+  }
+}
+
+private import Cached
+
+private predicate explicitInstanceArgument(Call call, Expr instarg) {
+  call instanceof MethodAccess and
+  instarg = call.getQualifier() and
+  not call.getCallee().isStatic()
+}
+
+private predicate implicitInstanceArgument(Call call, InstanceAccessExt ia) {
+  ia.isImplicitMethodQualifier(call) or
+  ia.isImplicitThisConstructorArgument(call)
+}
+
+module Public {
+  /**
+   * An element, viewed as a node in a data flow graph. Either an expression,
+   * a parameter, or an implicit varargs array creation.
+   */
+  class Node extends TNode {
+    /** Gets a textual representation of this element. */
+    string toString() { none() }
+
+    /** Gets the source location for this element. */
+    Location getLocation() { none() }
+
+    /** Gets the expression corresponding to this node, if any. */
+    Expr asExpr() { result = this.(ExprNode).getExpr() }
+
+    /** Gets the parameter corresponding to this node, if any. */
+    Parameter asParameter() { result = this.(ExplicitParameterNode).getParameter() }
+
+    /** Gets the type of this node. */
+    Type getType() {
+      result = this.asExpr().getType()
+      or
+      result = this.asParameter().getType()
+      or
+      exists(Parameter p |
+        result = p.getType() and
+        p.isVarargs() and
+        p = this.(ImplicitVarargsArray).getCall().getCallee().getAParameter()
+      )
+      or
+      result = this.(InstanceParameterNode).getCallable().getDeclaringType()
+      or
+      result = this.(ImplicitInstanceAccess).getInstanceAccess().getType()
+      or
+      result = this.(MallocNode).getClassInstanceExpr().getType()
+      or
+      result = this.(ImplicitPostUpdateNode).getPreUpdateNode().getType()
+    }
+
+    /** Gets the callable in which this node occurs. */
+    Callable getEnclosingCallable() {
+      result = this.asExpr().getEnclosingCallable() or
+      result = this.asParameter().getCallable() or
+      result = this.(ImplicitVarargsArray).getCall().getEnclosingCallable() or
+      result = this.(InstanceParameterNode).getCallable() or
+      result = this.(ImplicitInstanceAccess).getInstanceAccess().getEnclosingCallable() or
+      result = this.(MallocNode).getClassInstanceExpr().getEnclosingCallable() or
+      result = this.(ImplicitPostUpdateNode).getPreUpdateNode().getEnclosingCallable() or
+      this = TSummaryInternalNode(result, _)
+    }
+
+    private Type getImprovedTypeBound() {
+      exprTypeFlow(this.asExpr(), result, _) or
+      result = this.(ImplicitPostUpdateNode).getPreUpdateNode().getImprovedTypeBound()
+    }
+
+    /**
+     * Gets an upper bound on the type of this node.
+     */
+    Type getTypeBound() {
+      result = getImprovedTypeBound()
+      or
+      result = getType() and not exists(getImprovedTypeBound())
+    }
+
+    /**
+     * Holds if this element is at the specified location.
+     * The location spans column `startcolumn` of line `startline` to
+     * column `endcolumn` of line `endline` in file `filepath`.
+     * For more information, see
+     * [Locations](https://help.semmle.com/QL/learn-ql/ql/locations.html).
+     */
+    predicate hasLocationInfo(
+      string filepath, int startline, int startcolumn, int endline, int endcolumn
+    ) {
+      getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+    }
+  }
+
+  /**
+   * An expression, viewed as a node in a data flow graph.
+   */
+  class ExprNode extends Node, TExprNode {
+    Expr expr;
+
+    ExprNode() { this = TExprNode(expr) }
+
+    override string toString() { result = expr.toString() }
+
+    override Location getLocation() { result = expr.getLocation() }
+
+    /** Gets the expression corresponding to this node. */
+    Expr getExpr() { result = expr }
+  }
+
+  /** Gets the node corresponding to `e`. */
+  ExprNode exprNode(Expr e) { result.getExpr() = e }
+
+  /** An explicit or implicit parameter. */
+  abstract class ParameterNode extends Node {
+    /**
+     * Holds if this node is the parameter of `c` at the specified (zero-based)
+     * position. The implicit `this` parameter is considered to have index `-1`.
+     */
+    abstract predicate isParameterOf(Callable c, int pos);
+  }
+
+  /**
+   * A parameter, viewed as a node in a data flow graph.
+   */
+  class ExplicitParameterNode extends ParameterNode, TExplicitParameterNode {
+    Parameter param;
+
+    ExplicitParameterNode() { this = TExplicitParameterNode(param) }
+
+    override string toString() { result = param.toString() }
+
+    override Location getLocation() { result = param.getLocation() }
+
+    /** Gets the parameter corresponding to this node. */
+    Parameter getParameter() { result = param }
+
+    override predicate isParameterOf(Callable c, int pos) { c.getParameter(pos) = param }
+  }
+
+  /** Gets the node corresponding to `p`. */
+  ExplicitParameterNode parameterNode(Parameter p) { result.getParameter() = p }
+
+  /**
+   * An implicit varargs array creation expression.
+   *
+   * A call `f(x1, x2)` to a method `f(A... xs)` desugars to `f(new A[]{x1, x2})`,
+   * and this node corresponds to such an implicit array creation.
+   */
+  class ImplicitVarargsArray extends Node, TImplicitVarargsArray {
+    Call call;
+
+    ImplicitVarargsArray() { this = TImplicitVarargsArray(call) }
+
+    override string toString() { result = "new ..[] { .. }" }
+
+    override Location getLocation() { result = call.getLocation() }
+
+    /** Gets the call containing this varargs array creation argument. */
+    Call getCall() { result = call }
+  }
+
+  /**
+   * An instance parameter for an instance method or constructor.
+   */
+  class InstanceParameterNode extends ParameterNode, TInstanceParameterNode {
+    Callable callable;
+
+    InstanceParameterNode() { this = TInstanceParameterNode(callable) }
+
+    override string toString() { result = "parameter this" }
+
+    override Location getLocation() { result = callable.getLocation() }
+
+    /** Gets the callable containing this `this` parameter. */
+    Callable getCallable() { result = callable }
+
+    override predicate isParameterOf(Callable c, int pos) { callable = c and pos = -1 }
+  }
+
+  /**
+   * An implicit read of `this` or `A.this`.
+   */
+  class ImplicitInstanceAccess extends Node, TImplicitInstanceAccess {
+    InstanceAccessExt ia;
+
+    ImplicitInstanceAccess() { this = TImplicitInstanceAccess(ia) }
+
+    override string toString() { result = ia.toString() }
+
+    override Location getLocation() { result = ia.getLocation() }
+
+    /** Gets the instance access corresponding to this node. */
+    InstanceAccessExt getInstanceAccess() { result = ia }
+  }
+
+  /**
+   * A node associated with an object after an operation that might have
+   * changed its state.
+   *
+   * This can be either the argument to a callable after the callable returns
+   * (which might have mutated the argument), or the qualifier of a field after
+   * an update to the field.
+   *
+   * Nodes corresponding to AST elements, for example `ExprNode`, usually refer
+   * to the value before the update with the exception of `ClassInstanceExpr`,
+   * which represents the value after the constructor has run.
+   */
+  abstract class PostUpdateNode extends Node {
+    /**
+     * Gets the node before the state update.
+     */
+    abstract Node getPreUpdateNode();
+  }
+
+  /**
+   * Gets the node that occurs as the qualifier of `fa`.
+   */
+  Node getFieldQualifier(FieldAccess fa) {
+    fa.getField() instanceof InstanceField and
+    (
+      result.asExpr() = fa.getQualifier() or
+      result.(ImplicitInstanceAccess).getInstanceAccess().isImplicitFieldQualifier(fa)
+    )
+  }
+
+  /** Gets the instance argument of a non-static call. */
+  Node getInstanceArgument(Call call) {
+    result.(MallocNode).getClassInstanceExpr() = call or
+    explicitInstanceArgument(call, result.asExpr()) or
+    implicitInstanceArgument(call, result.(ImplicitInstanceAccess).getInstanceAccess())
+  }
+}
+
+private import Public
+
+private class NewExpr extends PostUpdateNode, TExprNode {
+  NewExpr() { exists(ClassInstanceExpr cie | this = TExprNode(cie)) }
+
+  override Node getPreUpdateNode() { this = TExprNode(result.(MallocNode).getClassInstanceExpr()) }
+}
+
+/**
+ * A `PostUpdateNode` that is not a `ClassInstanceExpr`.
+ */
+abstract private class ImplicitPostUpdateNode extends PostUpdateNode {
+  override Location getLocation() { result = getPreUpdateNode().getLocation() }
+
+  override string toString() { result = getPreUpdateNode().toString() + " [post update]" }
+}
+
+private class ExplicitExprPostUpdate extends ImplicitPostUpdateNode, TExplicitExprPostUpdate {
+  override Node getPreUpdateNode() { this = TExplicitExprPostUpdate(result.asExpr()) }
+}
+
+private class ImplicitExprPostUpdate extends ImplicitPostUpdateNode, TImplicitExprPostUpdate {
+  override Node getPreUpdateNode() {
+    this = TImplicitExprPostUpdate(result.(ImplicitInstanceAccess).getInstanceAccess())
+  }
+}
+
+module Private {
+  /**
+   * A data flow node that occurs as the argument of a call and is passed as-is
+   * to the callable. Arguments that are wrapped in an implicit varargs array
+   * creation are not included, but the implicitly created array is.
+   * Instance arguments are also included.
+   */
+  class ArgumentNode extends Node {
+    ArgumentNode() {
+      exists(Argument arg | this.asExpr() = arg | not arg.isVararg())
+      or
+      this instanceof ImplicitVarargsArray
+      or
+      this = getInstanceArgument(_)
+      or
+      this.(SummaryNode).isArgumentOf(_, _)
+    }
+
+    /**
+     * Holds if this argument occurs at the given position in the given call.
+     * The instance argument is considered to have index `-1`.
+     */
+    predicate argumentOf(DataFlowCall call, int pos) {
+      exists(Argument arg | this.asExpr() = arg | call = arg.getCall() and pos = arg.getPosition())
+      or
+      call = this.(ImplicitVarargsArray).getCall() and
+      pos = call.getCallee().getNumberOfParameters() - 1
+      or
+      pos = -1 and this = getInstanceArgument(call)
+      or
+      this.(SummaryNode).isArgumentOf(call, pos)
+    }
+
+    /** Gets the call in which this node is an argument. */
+    DataFlowCall getCall() { this.argumentOf(result, _) }
+  }
+
+  /** A data flow node that occurs as the result of a `ReturnStmt`. */
+  class ReturnNode extends Node {
+    ReturnNode() {
+      exists(ReturnStmt ret | this.asExpr() = ret.getResult()) or
+      this.(SummaryNode).isReturn()
+    }
+
+    /** Gets the kind of this returned value. */
+    ReturnKind getKind() { any() }
+  }
+
+  /** A data flow node that represents the output of a call. */
+  class OutNode extends Node {
+    OutNode() {
+      this.asExpr() instanceof MethodAccess
+      or
+      this.(SummaryNode).isOut(_)
+    }
+
+    /** Gets the underlying call. */
+    DataFlowCall getCall() {
+      result = this.asExpr()
+      or
+      this.(SummaryNode).isOut(result)
+    }
+  }
+
+  /**
+   * A data-flow node used to model flow summaries.
+   */
+  class SummaryNode extends Node, TSummaryInternalNode {
+    private SummarizedCallable c;
+    private FlowSummaryImpl::Private::SummaryNodeState state;
+
+    SummaryNode() { this = TSummaryInternalNode(c, state) }
+
+    override Location getLocation() { result = c.getLocation() }
+
+    override string toString() { result = "[summary] " + state + " in " + c }
+
+    /** Holds if this summary node is the `i`th argument of `call`. */
+    predicate isArgumentOf(DataFlowCall call, int i) { summaryArgumentNodeCached(call, this, i) }
+
+    /** Holds if this summary node is a return node. */
+    predicate isReturn() { summaryReturnNodeCached(this) }
+
+    /** Holds if this summary node is an out node for `call`. */
+    predicate isOut(DataFlowCall call) { summaryOutNodeCached(call, this) }
+  }
+
+  SummaryNode getSummaryNode(SummarizedCallable c, FlowSummaryImpl::Private::SummaryNodeState state) {
+    result = TSummaryInternalNode(c, state)
+  }
+}
+
+private import Private
+
+/**
+ * A node that corresponds to the value of a `ClassInstanceExpr` before the
+ * constructor has run.
+ */
+private class MallocNode extends Node, TMallocNode {
+  ClassInstanceExpr cie;
+
+  MallocNode() { this = TMallocNode(cie) }
+
+  override string toString() { result = cie.toString() + " [pre constructor]" }
+
+  override Location getLocation() { result = cie.getLocation() }
+
+  ClassInstanceExpr getClassInstanceExpr() { result = cie }
+}
+
+private class SummaryPostUpdateNode extends SummaryNode, PostUpdateNode {
+  private Node pre;
+
+  SummaryPostUpdateNode() { summaryPostUpdateNodeCached(this, pre) }
+
+  override Node getPreUpdateNode() { result = pre }
+}
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowPrivate.qll b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowPrivate.qll
index c38d0df4e57..23d84c10c9f 100644
--- a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowPrivate.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowPrivate.qll
@@ -4,7 +4,8 @@ private import DataFlowImplCommon
 private import DataFlowDispatch
 private import semmle.code.java.controlflow.Guards
 private import semmle.code.java.dataflow.SSA
-private import semmle.code.java.dataflow.TypeFlow
+private import FlowSummaryImpl as FlowSummaryImpl
+import DataFlowNodes::Private
 
 private newtype TReturnKind = TNormalReturnKind()
 
@@ -26,54 +27,6 @@ OutNode getAnOutNode(DataFlowCall call, ReturnKind kind) {
   kind = TNormalReturnKind()
 }
 
-/**
- * A data flow node that occurs as the argument of a call and is passed as-is
- * to the callable. Arguments that are wrapped in an implicit varargs array
- * creation are not included, but the implicitly created array is.
- * Instance arguments are also included.
- */
-class ArgumentNode extends Node {
-  ArgumentNode() {
-    exists(Argument arg | this.asExpr() = arg | not arg.isVararg())
-    or
-    this instanceof ImplicitVarargsArray
-    or
-    this = getInstanceArgument(_)
-  }
-
-  /**
-   * Holds if this argument occurs at the given position in the given call.
-   * The instance argument is considered to have index `-1`.
-   */
-  predicate argumentOf(DataFlowCall call, int pos) {
-    exists(Argument arg | this.asExpr() = arg | call = arg.getCall() and pos = arg.getPosition())
-    or
-    call = this.(ImplicitVarargsArray).getCall() and
-    pos = call.getCallee().getNumberOfParameters() - 1
-    or
-    pos = -1 and this = getInstanceArgument(call)
-  }
-
-  /** Gets the call in which this node is an argument. */
-  DataFlowCall getCall() { this.argumentOf(result, _) }
-}
-
-/** A data flow node that occurs as the result of a `ReturnStmt`. */
-class ReturnNode extends ExprNode {
-  ReturnNode() { exists(ReturnStmt ret | this.getExpr() = ret.getResult()) }
-
-  /** Gets the kind of this returned value. */
-  ReturnKind getKind() { any() }
-}
-
-/** A data flow node that represents the output of a call. */
-class OutNode extends ExprNode {
-  OutNode() { this.getExpr() instanceof MethodAccess }
-
-  /** Gets the underlying call. */
-  DataFlowCall getCall() { result = this.getExpr() }
-}
-
 /**
  * Holds if data can flow from `node1` to `node2` through a static field.
  */
@@ -131,8 +84,10 @@ private predicate instanceFieldAssign(Expr src, FieldAccess fa) {
 
 private newtype TContent =
   TFieldContent(InstanceField f) or
+  TArrayContent() or
   TCollectionContent() or
-  TArrayContent()
+  TMapKeyContent() or
+  TMapValueContent()
 
 /**
  * A reference contained in an object. Examples include instance fields, the
@@ -147,7 +102,7 @@ class Content extends TContent {
   }
 }
 
-private class FieldContent extends Content, TFieldContent {
+class FieldContent extends Content, TFieldContent {
   InstanceField f;
 
   FieldContent() { this = TFieldContent(f) }
@@ -161,12 +116,20 @@ private class FieldContent extends Content, TFieldContent {
   }
 }
 
-private class CollectionContent extends Content, TCollectionContent {
-  override string toString() { result = "collection" }
+class ArrayContent extends Content, TArrayContent {
+  override string toString() { result = "[]" }
 }
 
-private class ArrayContent extends Content, TArrayContent {
-  override string toString() { result = "array" }
+class CollectionContent extends Content, TCollectionContent {
+  override string toString() { result = "<element>" }
+}
+
+class MapKeyContent extends Content, TMapKeyContent {
+  override string toString() { result = "<map.key>" }
+}
+
+class MapValueContent extends Content, TMapValueContent {
+  override string toString() { result = "<map.value>" }
 }
 
 /**
@@ -180,6 +143,8 @@ predicate storeStep(Node node1, Content f, PostUpdateNode node2) {
     node2.getPreUpdateNode() = getFieldQualifier(fa) and
     f.(FieldContent).getField() = fa.getField()
   )
+  or
+  FlowSummaryImpl::Private::Steps::summaryStoreStep(node1, f, node2)
 }
 
 /**
@@ -205,6 +170,8 @@ predicate readStep(Node node1, Content f, Node node2) {
     node1.asExpr() = get.getQualifier() and
     node2.asExpr() = get
   )
+  or
+  FlowSummaryImpl::Private::Steps::summaryReadStep(node1, f, node2)
 }
 
 /**
@@ -213,7 +180,14 @@ predicate readStep(Node node1, Content f, Node node2) {
  * in `x.f = newValue`.
  */
 predicate clearsContent(Node n, Content c) {
-  n = any(PostUpdateNode pun | storeStep(_, c, pun)).getPreUpdateNode()
+  c instanceof FieldContent and
+  (
+    n = any(PostUpdateNode pun | storeStep(_, c, pun)).getPreUpdateNode()
+    or
+    FlowSummaryImpl::Private::Steps::summaryStoresIntoArg(c, n)
+  )
+  or
+  FlowSummaryImpl::Private::Steps::summaryClearsContent(n, c)
 }
 
 /**
@@ -221,7 +195,7 @@ predicate clearsContent(Node n, Content c) {
  * possible flow. A single type is used for all numeric types to account for
  * numeric conversions, and otherwise the erasure is used.
  */
-private DataFlowType getErasedRepr(Type t) {
+DataFlowType getErasedRepr(Type t) {
   exists(Type e | e = t.getErasure() |
     if e instanceof NumericOrCharType
     then result.(BoxedType).getPrimitiveType().getName() = "double"
@@ -235,7 +209,11 @@ private DataFlowType getErasedRepr(Type t) {
 }
 
 pragma[noinline]
-DataFlowType getNodeType(Node n) { result = getErasedRepr(n.getTypeBound()) }
+DataFlowType getNodeType(Node n) {
+  result = getErasedRepr(n.getTypeBound())
+  or
+  result = FlowSummaryImpl::Private::summaryNodeType(n)
+}
 
 /** Gets a string representation of a type returned by `getErasedRepr`. */
 string ppReprType(Type t) {
@@ -337,4 +315,15 @@ predicate isImmutableOrUnobservable(Node n) {
 }
 
 /** Holds if `n` should be hidden from path explanations. */
-predicate nodeIsHidden(Node n) { none() }
+predicate nodeIsHidden(Node n) { n instanceof SummaryNode }
+
+class LambdaCallKind = Unit;
+
+/** Holds if `creation` is an expression that creates a lambda of kind `kind` for `c`. */
+predicate lambdaCreation(Node creation, LambdaCallKind kind, DataFlowCallable c) { none() }
+
+/** Holds if `call` is a lambda call of kind `kind` where `receiver` is the lambda expression. */
+predicate lambdaCall(DataFlowCall call, LambdaCallKind kind, Node receiver) { none() }
+
+/** Extra data-flow steps needed for lamba flow analysis. */
+predicate additionalLambdaFlowStep(Node nodeFrom, Node nodeTo, boolean preservesValue) { none() }
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowUtil.qll b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowUtil.qll
index 53f6e08bc90..47743caf668 100644
--- a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowUtil.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowUtil.qll
@@ -5,284 +5,13 @@
 private import java
 private import DataFlowPrivate
 private import semmle.code.java.dataflow.SSA
-private import semmle.code.java.dataflow.TypeFlow
 private import semmle.code.java.controlflow.Guards
 private import semmle.code.java.dataflow.ExternalFlow
 private import semmle.code.java.dataflow.FlowSteps
+private import semmle.code.java.dataflow.FlowSummary
 import semmle.code.java.dataflow.InstanceAccess
-
-cached
-private newtype TNode =
-  TExprNode(Expr e) {
-    not e.getType() instanceof VoidType and
-    not e.getParent*() instanceof Annotation
-  } or
-  TExplicitParameterNode(Parameter p) { exists(p.getCallable().getBody()) } or
-  TImplicitVarargsArray(Call c) {
-    c.getCallee().isVarargs() and
-    not exists(Argument arg | arg.getCall() = c and arg.isExplicitVarargsArray())
-  } or
-  TInstanceParameterNode(Callable c) { exists(c.getBody()) and not c.isStatic() } or
-  TImplicitInstanceAccess(InstanceAccessExt ia) { not ia.isExplicit(_) } or
-  TMallocNode(ClassInstanceExpr cie) or
-  TExplicitExprPostUpdate(Expr e) {
-    explicitInstanceArgument(_, e)
-    or
-    e instanceof Argument and not e.getType() instanceof ImmutableType
-    or
-    exists(FieldAccess fa | fa.getField() instanceof InstanceField and e = fa.getQualifier())
-    or
-    exists(ArrayAccess aa | e = aa.getArray())
-  } or
-  TImplicitExprPostUpdate(InstanceAccessExt ia) {
-    implicitInstanceArgument(_, ia)
-    or
-    exists(FieldAccess fa |
-      fa.getField() instanceof InstanceField and ia.isImplicitFieldQualifier(fa)
-    )
-  }
-
-/**
- * An element, viewed as a node in a data flow graph. Either an expression,
- * a parameter, or an implicit varargs array creation.
- */
-class Node extends TNode {
-  /** Gets a textual representation of this element. */
-  string toString() { none() }
-
-  /** Gets the source location for this element. */
-  Location getLocation() { none() }
-
-  /** Gets the expression corresponding to this node, if any. */
-  Expr asExpr() { result = this.(ExprNode).getExpr() }
-
-  /** Gets the parameter corresponding to this node, if any. */
-  Parameter asParameter() { result = this.(ExplicitParameterNode).getParameter() }
-
-  /** Gets the type of this node. */
-  Type getType() {
-    result = this.asExpr().getType()
-    or
-    result = this.asParameter().getType()
-    or
-    exists(Parameter p |
-      result = p.getType() and
-      p.isVarargs() and
-      p = this.(ImplicitVarargsArray).getCall().getCallee().getAParameter()
-    )
-    or
-    result = this.(InstanceParameterNode).getCallable().getDeclaringType()
-    or
-    result = this.(ImplicitInstanceAccess).getInstanceAccess().getType()
-    or
-    result = this.(MallocNode).getClassInstanceExpr().getType()
-    or
-    result = this.(ImplicitPostUpdateNode).getPreUpdateNode().getType()
-  }
-
-  private Callable getEnclosingCallableImpl() {
-    result = this.asExpr().getEnclosingCallable() or
-    result = this.asParameter().getCallable() or
-    result = this.(ImplicitVarargsArray).getCall().getEnclosingCallable() or
-    result = this.(InstanceParameterNode).getCallable() or
-    result = this.(ImplicitInstanceAccess).getInstanceAccess().getEnclosingCallable() or
-    result = this.(MallocNode).getClassInstanceExpr().getEnclosingCallable() or
-    result = this.(ImplicitPostUpdateNode).getPreUpdateNode().getEnclosingCallableImpl()
-  }
-
-  /** Gets the callable in which this node occurs. */
-  Callable getEnclosingCallable() {
-    result = unique(DataFlowCallable c | c = this.getEnclosingCallableImpl() | c)
-  }
-
-  private Type getImprovedTypeBound() {
-    exprTypeFlow(this.asExpr(), result, _) or
-    result = this.(ImplicitPostUpdateNode).getPreUpdateNode().getImprovedTypeBound()
-  }
-
-  /**
-   * Gets an upper bound on the type of this node.
-   */
-  Type getTypeBound() {
-    result = getImprovedTypeBound()
-    or
-    result = getType() and not exists(getImprovedTypeBound())
-  }
-
-  /**
-   * Holds if this element is at the specified location.
-   * The location spans column `startcolumn` of line `startline` to
-   * column `endcolumn` of line `endline` in file `filepath`.
-   * For more information, see
-   * [Locations](https://help.semmle.com/QL/learn-ql/ql/locations.html).
-   */
-  predicate hasLocationInfo(
-    string filepath, int startline, int startcolumn, int endline, int endcolumn
-  ) {
-    getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
-  }
-}
-
-/**
- * An expression, viewed as a node in a data flow graph.
- */
-class ExprNode extends Node, TExprNode {
-  Expr expr;
-
-  ExprNode() { this = TExprNode(expr) }
-
-  override string toString() { result = expr.toString() }
-
-  override Location getLocation() { result = expr.getLocation() }
-
-  /** Gets the expression corresponding to this node. */
-  Expr getExpr() { result = expr }
-}
-
-/** Gets the node corresponding to `e`. */
-ExprNode exprNode(Expr e) { result.getExpr() = e }
-
-/** An explicit or implicit parameter. */
-abstract class ParameterNode extends Node {
-  /**
-   * Holds if this node is the parameter of `c` at the specified (zero-based)
-   * position. The implicit `this` parameter is considered to have index `-1`.
-   */
-  abstract predicate isParameterOf(Callable c, int pos);
-}
-
-/**
- * A parameter, viewed as a node in a data flow graph.
- */
-class ExplicitParameterNode extends ParameterNode, TExplicitParameterNode {
-  Parameter param;
-
-  ExplicitParameterNode() { this = TExplicitParameterNode(param) }
-
-  override string toString() { result = param.toString() }
-
-  override Location getLocation() { result = param.getLocation() }
-
-  /** Gets the parameter corresponding to this node. */
-  Parameter getParameter() { result = param }
-
-  override predicate isParameterOf(Callable c, int pos) { c.getParameter(pos) = param }
-}
-
-/** Gets the node corresponding to `p`. */
-ExplicitParameterNode parameterNode(Parameter p) { result.getParameter() = p }
-
-/**
- * An implicit varargs array creation expression.
- *
- * A call `f(x1, x2)` to a method `f(A... xs)` desugars to `f(new A[]{x1, x2})`,
- * and this node corresponds to such an implicit array creation.
- */
-class ImplicitVarargsArray extends Node, TImplicitVarargsArray {
-  Call call;
-
-  ImplicitVarargsArray() { this = TImplicitVarargsArray(call) }
-
-  override string toString() { result = "new ..[] { .. }" }
-
-  override Location getLocation() { result = call.getLocation() }
-
-  /** Gets the call containing this varargs array creation argument. */
-  Call getCall() { result = call }
-}
-
-/**
- * An instance parameter for an instance method or constructor.
- */
-class InstanceParameterNode extends ParameterNode, TInstanceParameterNode {
-  Callable callable;
-
-  InstanceParameterNode() { this = TInstanceParameterNode(callable) }
-
-  override string toString() { result = "parameter this" }
-
-  override Location getLocation() { result = callable.getLocation() }
-
-  /** Gets the callable containing this `this` parameter. */
-  Callable getCallable() { result = callable }
-
-  override predicate isParameterOf(Callable c, int pos) { callable = c and pos = -1 }
-}
-
-/**
- * An implicit read of `this` or `A.this`.
- */
-class ImplicitInstanceAccess extends Node, TImplicitInstanceAccess {
-  InstanceAccessExt ia;
-
-  ImplicitInstanceAccess() { this = TImplicitInstanceAccess(ia) }
-
-  override string toString() { result = ia.toString() }
-
-  override Location getLocation() { result = ia.getLocation() }
-
-  InstanceAccessExt getInstanceAccess() { result = ia }
-}
-
-/**
- * A node that corresponds to the value of a `ClassInstanceExpr` before the
- * constructor has run.
- */
-private class MallocNode extends Node, TMallocNode {
-  ClassInstanceExpr cie;
-
-  MallocNode() { this = TMallocNode(cie) }
-
-  override string toString() { result = cie.toString() + " [pre constructor]" }
-
-  override Location getLocation() { result = cie.getLocation() }
-
-  ClassInstanceExpr getClassInstanceExpr() { result = cie }
-}
-
-/**
- * A node associated with an object after an operation that might have
- * changed its state.
- *
- * This can be either the argument to a callable after the callable returns
- * (which might have mutated the argument), or the qualifier of a field after
- * an update to the field.
- *
- * Nodes corresponding to AST elements, for example `ExprNode`, usually refer
- * to the value before the update with the exception of `ClassInstanceExpr`,
- * which represents the value after the constructor has run.
- */
-abstract class PostUpdateNode extends Node {
-  /**
-   * Gets the node before the state update.
-   */
-  abstract Node getPreUpdateNode();
-}
-
-private class NewExpr extends PostUpdateNode, TExprNode {
-  NewExpr() { exists(ClassInstanceExpr cie | this = TExprNode(cie)) }
-
-  override Node getPreUpdateNode() { this = TExprNode(result.(MallocNode).getClassInstanceExpr()) }
-}
-
-/**
- * A `PostUpdateNode` that is not a `ClassInstanceExpr`.
- */
-abstract private class ImplicitPostUpdateNode extends PostUpdateNode {
-  override Location getLocation() { result = getPreUpdateNode().getLocation() }
-
-  override string toString() { result = getPreUpdateNode().toString() + " [post update]" }
-}
-
-private class ExplicitExprPostUpdate extends ImplicitPostUpdateNode, TExplicitExprPostUpdate {
-  override Node getPreUpdateNode() { this = TExplicitExprPostUpdate(result.asExpr()) }
-}
-
-private class ImplicitExprPostUpdate extends ImplicitPostUpdateNode, TImplicitExprPostUpdate {
-  override Node getPreUpdateNode() {
-    this = TImplicitExprPostUpdate(result.(ImplicitInstanceAccess).getInstanceAccess())
-  }
-}
+private import FlowSummaryImpl as FlowSummaryImpl
+import DataFlowNodes::Public
 
 /** Holds if `n` is an access to an unqualified `this` at `cfgnode`. */
 private predicate thisAccess(Node n, ControlFlowNode cfgnode) {
@@ -367,7 +96,13 @@ predicate hasNonlocalValue(FieldRead fr) {
 /**
  * Holds if data can flow from `node1` to `node2` in one local step.
  */
-predicate localFlowStep(Node node1, Node node2) { simpleLocalFlowStep(node1, node2) }
+predicate localFlowStep(Node node1, Node node2) {
+  simpleLocalFlowStep(node1, node2)
+  or
+  // Simple flow through library code is included in the exposed local
+  // step relation, even though flow is technically inter-procedural
+  FlowSummaryImpl::Private::Steps::summaryThroughStep(node1, node2, true)
+}
 
 /**
  * INTERNAL: do not use.
@@ -407,41 +142,22 @@ predicate simpleLocalFlowStep(Node node1, Node node2) {
   or
   node2.asExpr().(AssignExpr).getSource() = node1.asExpr()
   or
-  summaryStep(node1, node2, "value")
-  or
   exists(MethodAccess ma, ValuePreservingMethod m, int argNo |
     ma.getCallee().getSourceDeclaration() = m and m.returnsValue(argNo)
   |
     node2.asExpr() = ma and
     node1.(ArgumentNode).argumentOf(ma, argNo)
   )
-}
-
-/**
- * Gets the node that occurs as the qualifier of `fa`.
- */
-Node getFieldQualifier(FieldAccess fa) {
-  fa.getField() instanceof InstanceField and
-  (
-    result.asExpr() = fa.getQualifier() or
-    result.(ImplicitInstanceAccess).getInstanceAccess().isImplicitFieldQualifier(fa)
-  )
-}
-
-private predicate explicitInstanceArgument(Call call, Expr instarg) {
-  call instanceof MethodAccess and instarg = call.getQualifier() and not call.getCallee().isStatic()
-}
-
-private predicate implicitInstanceArgument(Call call, InstanceAccessExt ia) {
-  ia.isImplicitMethodQualifier(call) or
-  ia.isImplicitThisConstructorArgument(call)
-}
-
-/** Gets the instance argument of a non-static call. */
-Node getInstanceArgument(Call call) {
-  result.(MallocNode).getClassInstanceExpr() = call or
-  explicitInstanceArgument(call, result.asExpr()) or
-  implicitInstanceArgument(call, result.(ImplicitInstanceAccess).getInstanceAccess())
+  or
+  FlowSummaryImpl::Private::Steps::summaryLocalStep(node1, node2, true)
+  or
+  // If flow through a method updates a parameter from some input A, and that
+  // parameter also is returned through B, then we'd like a combined flow from A
+  // to B as well. As an example, this simplifies modeling of fluent methods:
+  // for `StringBuilder.append(x)` with a specified value flow from qualifier to
+  // return value and taint flow from argument 0 to the qualifier, then this
+  // allows us to infer taint flow from argument 0 to the return value.
+  node1.(SummaryNode).(PostUpdateNode).getPreUpdateNode().(ParameterNode) = node2
 }
 
 /**
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll b/java/ql/src/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll
new file mode 100644
index 00000000000..3c8c94c913c
--- /dev/null
+++ b/java/ql/src/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll
@@ -0,0 +1,674 @@
+/**
+ * Provides classes and predicates for defining flow summaries.
+ *
+ * The definitions in this file are language-independent, and language-specific
+ * definitions are passed in via the `DataFlowImplSpecific` and
+ * `FlowSummaryImplSpecific` modules.
+ */
+
+private import FlowSummaryImplSpecific
+private import DataFlowImplSpecific::Private
+private import DataFlowImplSpecific::Public
+
+/** Provides classes and predicates for defining flow summaries. */
+module Public {
+  private import Private
+
+  /**
+   * A component used in a flow summary.
+   *
+   * Either a parameter or an argument at a given position, a specific
+   * content type, or a return kind.
+   */
+  class SummaryComponent extends TSummaryComponent {
+    /** Gets a textual representation of this summary component. */
+    string toString() {
+      exists(Content c | this = TContentSummaryComponent(c) and result = c.toString())
+      or
+      exists(int i | this = TParameterSummaryComponent(i) and result = "parameter " + i)
+      or
+      exists(int i | this = TArgumentSummaryComponent(i) and result = "argument " + i)
+      or
+      exists(ReturnKind rk | this = TReturnSummaryComponent(rk) and result = "return (" + rk + ")")
+    }
+  }
+
+  /** Provides predicates for constructing summary components. */
+  module SummaryComponent {
+    /** Gets a summary component for content `c`. */
+    SummaryComponent content(Content c) { result = TContentSummaryComponent(c) }
+
+    /** Gets a summary component for parameter `i`. */
+    SummaryComponent parameter(int i) { result = TParameterSummaryComponent(i) }
+
+    /** Gets a summary component for argument `i`. */
+    SummaryComponent argument(int i) { result = TArgumentSummaryComponent(i) }
+
+    /** Gets a summary component for a return of kind `rk`. */
+    SummaryComponent return(ReturnKind rk) { result = TReturnSummaryComponent(rk) }
+  }
+
+  /**
+   * A (non-empty) stack of summary components.
+   *
+   * A stack is used to represent where data is read from (input) or where it
+   * is written to (output). For example, an input stack `[Field f, Argument 0]`
+   * means that data is read from field `f` from the `0`th argument, while an
+   * output stack `[Field g, Return]` means that data is written to the field
+   * `g` of the returned object.
+   */
+  class SummaryComponentStack extends TSummaryComponentStack {
+    /** Gets the head of this stack. */
+    SummaryComponent head() {
+      this = TSingletonSummaryComponentStack(result) or
+      this = TConsSummaryComponentStack(result, _)
+    }
+
+    /** Gets the tail of this stack, if any. */
+    SummaryComponentStack tail() { this = TConsSummaryComponentStack(_, result) }
+
+    /** Gets the length of this stack. */
+    int length() {
+      this = TSingletonSummaryComponentStack(_) and result = 1
+      or
+      result = 1 + this.tail().length()
+    }
+
+    /** Gets the stack obtained by dropping the first `i` elements, if any. */
+    SummaryComponentStack drop(int i) {
+      i = 0 and result = this
+      or
+      result = this.tail().drop(i - 1)
+    }
+
+    /** Holds if this stack contains summary component `c`. */
+    predicate contains(SummaryComponent c) { c = this.drop(_).head() }
+
+    /** Gets a textual representation of this stack. */
+    string toString() {
+      exists(SummaryComponent head, SummaryComponentStack tail |
+        head = this.head() and
+        tail = this.tail() and
+        result = head + " of " + tail
+      )
+      or
+      exists(SummaryComponent c |
+        this = TSingletonSummaryComponentStack(c) and
+        result = c.toString()
+      )
+    }
+  }
+
+  /** Provides predicates for constructing stacks of summary components. */
+  module SummaryComponentStack {
+    /** Gets a singleton stack containing `c`. */
+    SummaryComponentStack singleton(SummaryComponent c) {
+      result = TSingletonSummaryComponentStack(c)
+    }
+
+    /**
+     * Gets the stack obtained by pushing `head` onto `tail`.
+     *
+     * Make sure to override `RequiredSummaryComponentStack::required()` in order
+     * to ensure that the constructed stack exists.
+     */
+    SummaryComponentStack push(SummaryComponent head, SummaryComponentStack tail) {
+      result = TConsSummaryComponentStack(head, tail)
+    }
+
+    /** Gets a singleton stack for argument `i`. */
+    SummaryComponentStack argument(int i) { result = singleton(SummaryComponent::argument(i)) }
+
+    /** Gets a singleton stack representing a return of kind `rk`. */
+    SummaryComponentStack return(ReturnKind rk) { result = singleton(SummaryComponent::return(rk)) }
+  }
+
+  /**
+   * A class that exists for QL technical reasons only (the IPA type used
+   * to represent component stacks needs to be bounded).
+   */
+  abstract class RequiredSummaryComponentStack extends SummaryComponentStack {
+    /**
+     * Holds if the stack obtained by pushing `head` onto `tail` is required.
+     */
+    abstract predicate required(SummaryComponent c);
+  }
+
+  /** A callable with a flow summary. */
+  abstract class SummarizedCallable extends DataFlowCallable {
+    /**
+     * Holds if data may flow from `input` to `output` through this callable.
+     *
+     * `preservesValue` indicates whether this is a value-preserving step
+     * or a taint-step.
+     *
+     * Input specifications are restricted to stacks that end with
+     * `SummaryComponent::argument(_)`, preceded by zero or more
+     * `SummaryComponent::return(_)` or `SummaryComponent::content(_)` components.
+     *
+     * Output specifications are restricted to stacks that end with
+     * `SummaryComponent::return(_)` or `SummaryComponent::argument(_)`.
+     *
+     * Output stacks ending with `SummaryComponent::return(_)` can be preceded by zero
+     * or more `SummaryComponent::content(_)` components.
+     *
+     * Output stacks ending with `SummaryComponent::argument(_)` can be preceded by an
+     * optional `SummaryComponent::parameter(_)` component, which in turn can be preceded
+     * by zero or more `SummaryComponent::content(_)` components.
+     */
+    pragma[nomagic]
+    predicate propagatesFlow(
+      SummaryComponentStack input, SummaryComponentStack output, boolean preservesValue
+    ) {
+      none()
+    }
+
+    /**
+     * Holds if values stored inside `content` are cleared on objects passed as
+     * the `i`th argument to this callable.
+     */
+    pragma[nomagic]
+    predicate clearsContent(int i, Content content) { none() }
+  }
+}
+
+/**
+ * Provides predicates for compiling flow summaries down to atomic local steps,
+ * read steps, and store steps.
+ */
+module Private {
+  private import Public
+  private import DataFlowImplCommon as DataFlowImplCommon
+
+  newtype TSummaryComponent =
+    TContentSummaryComponent(Content c) or
+    TParameterSummaryComponent(int i) { parameterPosition(i) } or
+    TArgumentSummaryComponent(int i) { parameterPosition(i) } or
+    TReturnSummaryComponent(ReturnKind rk)
+
+  newtype TSummaryComponentStack =
+    TSingletonSummaryComponentStack(SummaryComponent c) or
+    TConsSummaryComponentStack(SummaryComponent head, SummaryComponentStack tail) {
+      tail.(RequiredSummaryComponentStack).required(head)
+    }
+
+  pragma[nomagic]
+  private predicate summary(
+    SummarizedCallable c, SummaryComponentStack input, SummaryComponentStack output,
+    boolean preservesValue
+  ) {
+    c.propagatesFlow(input, output, preservesValue)
+  }
+
+  private newtype TSummaryNodeState =
+    TSummaryNodeInputState(SummaryComponentStack s) {
+      exists(SummaryComponentStack input |
+        summary(_, input, _, _) and
+        s = input.drop(_)
+      )
+    } or
+    TSummaryNodeOutputState(SummaryComponentStack s) {
+      exists(SummaryComponentStack output |
+        summary(_, _, output, _) and
+        s = output.drop(_)
+      )
+    }
+
+  /**
+   * A state used to break up (complex) flow summaries into atomic flow steps.
+   * For a flow summary
+   *
+   * ```ql
+   * propagatesFlow(
+   *   SummaryComponentStack input, SummaryComponentStack output, boolean preservesValue
+   * )
+   * ```
+   *
+   * the following states are used:
+   *
+   * - `TSummaryNodeInputState(SummaryComponentStack s)`:
+   *   this state represents that the components in `s` _have been read_ from the
+   *   input.
+   * - `TSummaryNodeOutputState(SummaryComponentStack s)`:
+   *   this state represents that the components in `s` _remain to be written_ to
+   *   the output.
+   */
+  class SummaryNodeState extends TSummaryNodeState {
+    /** Holds if this state is a valid input state for `c`. */
+    pragma[nomagic]
+    predicate isInputState(SummarizedCallable c, SummaryComponentStack s) {
+      this = TSummaryNodeInputState(s) and
+      exists(SummaryComponentStack input |
+        summary(c, input, _, _) and
+        s = input.drop(_)
+      )
+    }
+
+    /** Holds if this state is a valid output state for `c`. */
+    pragma[nomagic]
+    predicate isOutputState(SummarizedCallable c, SummaryComponentStack s) {
+      this = TSummaryNodeOutputState(s) and
+      exists(SummaryComponentStack output |
+        summary(c, _, output, _) and
+        s = output.drop(_)
+      )
+    }
+
+    /** Gets a textual representation of this state. */
+    string toString() {
+      exists(SummaryComponentStack s |
+        this = TSummaryNodeInputState(s) and
+        result = "read: " + s
+      )
+      or
+      exists(SummaryComponentStack s |
+        this = TSummaryNodeOutputState(s) and
+        result = "to write: " + s
+      )
+    }
+  }
+
+  /**
+   * Holds if `state` represents having read the `i`th argument for `c`. In this case
+   * we are not synthesizing a data-flow node, but instead assume that a relevant
+   * parameter node already exists.
+   */
+  private predicate parameterReadState(SummarizedCallable c, SummaryNodeState state, int i) {
+    state.isInputState(c, SummaryComponentStack::argument(i))
+  }
+
+  /**
+   * Holds if a synthesized summary node is needed for the state `state` in summarized
+   * callable `c`.
+   */
+  predicate summaryNodeRange(SummarizedCallable c, SummaryNodeState state) {
+    state.isInputState(c, _) and
+    not parameterReadState(c, state, _)
+    or
+    state.isOutputState(c, _)
+  }
+
+  pragma[noinline]
+  private Node summaryNodeInputState(SummarizedCallable c, SummaryComponentStack s) {
+    exists(SummaryNodeState state | state.isInputState(c, s) |
+      result = summaryNode(c, state)
+      or
+      exists(int i |
+        parameterReadState(c, state, i) and
+        result.(ParameterNode).isParameterOf(c, i)
+      )
+    )
+  }
+
+  pragma[noinline]
+  private Node summaryNodeOutputState(SummarizedCallable c, SummaryComponentStack s) {
+    exists(SummaryNodeState state |
+      state.isOutputState(c, s) and
+      result = summaryNode(c, state)
+    )
+  }
+
+  /**
+   * Holds if a write targets `post`, which is a post-update node for the `i`th
+   * parameter of `c`.
+   */
+  private predicate isParameterPostUpdate(Node post, SummarizedCallable c, int i) {
+    post = summaryNodeOutputState(c, SummaryComponentStack::argument(i))
+  }
+
+  /** Holds if a parameter node is required for the `i`th parameter of `c`. */
+  predicate summaryParameterNodeRange(SummarizedCallable c, int i) {
+    parameterReadState(c, _, i)
+    or
+    isParameterPostUpdate(_, c, i)
+  }
+
+  private predicate callbackOutput(
+    SummarizedCallable c, SummaryComponentStack s, Node receiver, ReturnKind rk
+  ) {
+    any(SummaryNodeState state).isInputState(c, s) and
+    s.head() = TReturnSummaryComponent(rk) and
+    receiver = summaryNodeInputState(c, s.drop(1))
+  }
+
+  private Node pre(Node post) {
+    summaryPostUpdateNode(post, result)
+    or
+    not summaryPostUpdateNode(post, _) and
+    result = post
+  }
+
+  private predicate callbackInput(
+    SummarizedCallable c, SummaryComponentStack s, Node receiver, int i
+  ) {
+    any(SummaryNodeState state).isOutputState(c, s) and
+    s.head() = TParameterSummaryComponent(i) and
+    receiver = pre(summaryNodeOutputState(c, s.drop(1)))
+  }
+
+  /** Holds if a call targeting `receiver` should be synthesized inside `c`. */
+  predicate summaryCallbackRange(SummarizedCallable c, Node receiver) {
+    callbackOutput(c, _, receiver, _)
+    or
+    callbackInput(c, _, receiver, _)
+  }
+
+  /**
+   * Gets the type of synthesized summary node `n`.
+   *
+   * The type is computed based on the language-specific predicates
+   * `getContentType()`, `getReturnType()`, `getCallbackParameterType()`, and
+   * `getCallbackReturnType()`.
+   */
+  DataFlowType summaryNodeType(Node n) {
+    exists(Node pre |
+      summaryPostUpdateNode(n, pre) and
+      result = getNodeType(pre)
+    )
+    or
+    exists(SummarizedCallable c, SummaryComponentStack s, SummaryComponent head | head = s.head() |
+      n = summaryNodeInputState(c, s) and
+      (
+        exists(Content cont |
+          head = TContentSummaryComponent(cont) and result = getContentType(cont)
+        )
+        or
+        exists(ReturnKind rk |
+          head = TReturnSummaryComponent(rk) and
+          result = getCallbackReturnType(getNodeType(summaryNodeInputState(c, s.drop(1))), rk)
+        )
+      )
+      or
+      n = summaryNodeOutputState(c, s) and
+      (
+        exists(Content cont |
+          head = TContentSummaryComponent(cont) and result = getContentType(cont)
+        )
+        or
+        s.length() = 1 and
+        exists(ReturnKind rk |
+          head = TReturnSummaryComponent(rk) and
+          result = getReturnType(c, rk)
+        )
+        or
+        exists(int i | head = TParameterSummaryComponent(i) |
+          result = getCallbackParameterType(getNodeType(summaryNodeOutputState(c, s.drop(1))), i)
+        )
+      )
+    )
+  }
+
+  /** Holds if summary node `out` contains output of kind `rk` from call `c`. */
+  predicate summaryOutNode(DataFlowCall c, Node out, ReturnKind rk) {
+    exists(SummarizedCallable callable, SummaryComponentStack s, Node receiver |
+      callbackOutput(callable, s, receiver, rk) and
+      out = summaryNodeInputState(callable, s) and
+      c = summaryDataFlowCall(receiver)
+    )
+  }
+
+  /** Holds if summary node `arg` is the `i`th argument of call `c`. */
+  predicate summaryArgumentNode(DataFlowCall c, Node arg, int i) {
+    exists(SummarizedCallable callable, SummaryComponentStack s, Node receiver |
+      callbackInput(callable, s, receiver, i) and
+      arg = summaryNodeOutputState(callable, s) and
+      c = summaryDataFlowCall(receiver)
+    )
+  }
+
+  /** Holds if summary node `post` is a post-update node with pre-update node `pre`. */
+  predicate summaryPostUpdateNode(Node post, ParameterNode pre) {
+    exists(SummarizedCallable c, int i |
+      isParameterPostUpdate(post, c, i) and
+      pre.isParameterOf(c, i)
+    )
+  }
+
+  /** Holds if summary node `ret` is a return node of kind `rk`. */
+  predicate summaryReturnNode(Node ret, ReturnKind rk) {
+    exists(SummarizedCallable callable, SummaryComponentStack s |
+      ret = summaryNodeOutputState(callable, s) and
+      s = TSingletonSummaryComponentStack(TReturnSummaryComponent(rk))
+    )
+  }
+
+  /** Provides a compilation of flow summaries to atomic data-flow steps. */
+  module Steps {
+    /**
+     * Holds if there is a local step from `pred` to `succ`, which is synthesized
+     * from a flow summary.
+     */
+    predicate summaryLocalStep(Node pred, Node succ, boolean preservesValue) {
+      exists(
+        SummarizedCallable c, SummaryComponentStack inputContents,
+        SummaryComponentStack outputContents
+      |
+        summary(c, inputContents, outputContents, preservesValue) and
+        pred = summaryNodeInputState(c, inputContents) and
+        succ = summaryNodeOutputState(c, outputContents)
+      )
+    }
+
+    /**
+     * Holds if there is a read step of content `c` from `pred` to `succ`, which
+     * is synthesized from a flow summary.
+     */
+    predicate summaryReadStep(Node pred, Content c, Node succ) {
+      exists(SummarizedCallable sc, SummaryComponentStack s |
+        pred = summaryNodeInputState(sc, s.drop(1)) and
+        succ = summaryNodeInputState(sc, s) and
+        SummaryComponent::content(c) = s.head()
+      )
+    }
+
+    /**
+     * Holds if there is a store step of content `c` from `pred` to `succ`, which
+     * is synthesized from a flow summary.
+     */
+    predicate summaryStoreStep(Node pred, Content c, Node succ) {
+      exists(SummarizedCallable sc, SummaryComponentStack s |
+        pred = summaryNodeOutputState(sc, s) and
+        succ = summaryNodeOutputState(sc, s.drop(1)) and
+        SummaryComponent::content(c) = s.head()
+      )
+    }
+
+    /**
+     * Holds if values stored inside content `c` are cleared when passed as
+     * input of type `input` in `call`.
+     */
+    predicate summaryClearsContent(ArgumentNode arg, Content c) {
+      exists(DataFlowCall call, int i |
+        viableCallable(call).(SummarizedCallable).clearsContent(i, c) and
+        arg.argumentOf(call, i)
+      )
+    }
+
+    pragma[nomagic]
+    private ParameterNode summaryArgParam(
+      ArgumentNode arg, DataFlowImplCommon::ReturnKindExt rk, DataFlowImplCommon::OutNodeExt out
+    ) {
+      exists(DataFlowCall call, int pos, SummarizedCallable callable |
+        arg.argumentOf(call, pos) and
+        viableCallable(call) = callable and
+        result.isParameterOf(callable, pos) and
+        out = rk.getAnOutNode(call)
+      )
+    }
+
+    /**
+     * Holds if `arg` flows to `out` using a simple flow summary, that is, a flow
+     * summary without reads and stores.
+     *
+     * NOTE: This step should not be used in global data-flow/taint-tracking, but may
+     * be useful to include in the exposed local data-flow/taint-tracking relations.
+     */
+    predicate summaryThroughStep(ArgumentNode arg, Node out, boolean preservesValue) {
+      exists(DataFlowImplCommon::ReturnKindExt rk, DataFlowImplCommon::ReturnNodeExt ret |
+        summaryLocalStep(summaryArgParam(arg, rk, out), ret, preservesValue) and
+        ret.getKind() = rk
+      )
+    }
+
+    /**
+     * Holds if there is a read(+taint) of `c` from `arg` to `out` using a
+     * flow summary.
+     *
+     * NOTE: This step should not be used in global data-flow/taint-tracking, but may
+     * be useful to include in the exposed local data-flow/taint-tracking relations.
+     */
+    predicate summaryGetterStep(ArgumentNode arg, Content c, Node out) {
+      exists(DataFlowImplCommon::ReturnKindExt rk, Node mid, DataFlowImplCommon::ReturnNodeExt ret |
+        summaryReadStep(summaryArgParam(arg, rk, out), c, mid) and
+        summaryLocalStep(mid, ret, _) and
+        ret.getKind() = rk
+      )
+    }
+
+    /**
+     * Holds if there is a (taint+)store of `arg` into content `c` of `out` using a
+     * flow summary.
+     *
+     * NOTE: This step should not be used in global data-flow/taint-tracking, but may
+     * be useful to include in the exposed local data-flow/taint-tracking relations.
+     */
+    predicate summarySetterStep(ArgumentNode arg, Content c, Node out) {
+      exists(DataFlowImplCommon::ReturnKindExt rk, Node mid, DataFlowImplCommon::ReturnNodeExt ret |
+        summaryLocalStep(summaryArgParam(arg, rk, out), mid, _) and
+        summaryStoreStep(mid, c, ret) and
+        ret.getKind() = rk
+      )
+    }
+
+    /**
+     * Holds if data is written into content `c` of argument `arg` using a flow summary.
+     *
+     * Depending on the type of `c`, this predicate may be relevant to include in the
+     * definition of `clearsContent()`.
+     */
+    predicate summaryStoresIntoArg(Content c, Node arg) {
+      exists(
+        DataFlowImplCommon::ParamUpdateReturnKind rk, DataFlowImplCommon::ReturnNodeExt ret,
+        PostUpdateNode out
+      |
+        exists(DataFlowCall call, SummarizedCallable callable |
+          DataFlowImplCommon::getNodeEnclosingCallable(ret) = callable and
+          viableCallable(call) = callable and
+          summaryStoreStep(_, c, ret) and
+          ret.getKind() = pragma[only_bind_into](rk) and
+          out = rk.getAnOutNode(call) and
+          arg = out.getPreUpdateNode()
+        )
+      )
+    }
+  }
+
+  /**
+   * Provides a means of translating externally (e.g., CSV) defined flow
+   * summaries into a `SummarizedCallable`s.
+   */
+  module External {
+    /**
+     * Provides a means of translating an externally (e.g., CSV) defined flow
+     * summary into a `SummarizedCallable`.
+     */
+    abstract class ExternalSummaryCompilation extends string {
+      bindingset[this]
+      ExternalSummaryCompilation() { any() }
+
+      /** Holds if this flow summary is for callable `c`. */
+      abstract predicate callable(DataFlowCallable c, boolean preservesValue);
+
+      /** Holds if the `i`th input component is `c`. */
+      abstract predicate input(int i, SummaryComponent c);
+
+      /** Holds if the `i`th output component is `c`. */
+      abstract predicate output(int i, SummaryComponent c);
+
+      /**
+       * Holds if the input components starting from index `i` translate into `suffix`.
+       */
+      final predicate translateInput(int i, SummaryComponentStack suffix) {
+        exists(SummaryComponent comp | this.input(i, comp) |
+          i = max(int j | this.input(j, _)) and
+          suffix = TSingletonSummaryComponentStack(comp)
+          or
+          exists(TSummaryComponent head, SummaryComponentStack tail |
+            this.translateInputCons(i, head, tail) and
+            suffix = TConsSummaryComponentStack(head, tail)
+          )
+        )
+      }
+
+      final predicate translateInputCons(int i, SummaryComponent head, SummaryComponentStack tail) {
+        this.input(i, head) and
+        this.translateInput(i + 1, tail)
+      }
+
+      /**
+       * Holds if the output components starting from index `i` translate into `suffix`.
+       */
+      predicate translateOutput(int i, SummaryComponentStack suffix) {
+        exists(SummaryComponent comp | this.output(i, comp) |
+          i = max(int j | this.output(j, _)) and
+          suffix = TSingletonSummaryComponentStack(comp)
+          or
+          exists(TSummaryComponent head, SummaryComponentStack tail |
+            this.translateOutputCons(i, head, tail) and
+            suffix = TConsSummaryComponentStack(head, tail)
+          )
+        )
+      }
+
+      predicate translateOutputCons(int i, SummaryComponent head, SummaryComponentStack tail) {
+        this.output(i, head) and
+        this.translateOutput(i + 1, tail)
+      }
+    }
+
+    private class ExternalRequiredSummaryComponentStack extends RequiredSummaryComponentStack {
+      private SummaryComponent head;
+
+      ExternalRequiredSummaryComponentStack() {
+        any(ExternalSummaryCompilation s).translateInputCons(_, head, this) or
+        any(ExternalSummaryCompilation s).translateOutputCons(_, head, this)
+      }
+
+      override predicate required(SummaryComponent c) { c = head }
+    }
+
+    class ExternalSummarizedCallableAdaptor extends SummarizedCallable {
+      ExternalSummarizedCallableAdaptor() { any(ExternalSummaryCompilation s).callable(this, _) }
+
+      override predicate propagatesFlow(
+        SummaryComponentStack input, SummaryComponentStack output, boolean preservesValue
+      ) {
+        exists(ExternalSummaryCompilation s |
+          s.callable(this, preservesValue) and
+          s.translateInput(0, input) and
+          s.translateOutput(0, output)
+        )
+      }
+    }
+  }
+
+  /** Provides a query predicate for outputting a set of relevant flow summaries. */
+  module TestOutput {
+    /** A flow summary to include in the `summary/3` query predicate. */
+    abstract class RelevantSummarizedCallable extends SummarizedCallable {
+      /** Gets the string representation of this callable used by `summary/3`. */
+      string getFullString() { result = this.toString() }
+    }
+
+    /** A query predicate for outputting flow summaries in QL tests. */
+    query predicate summary(string callable, string flow, boolean preservesValue) {
+      exists(
+        RelevantSummarizedCallable c, SummaryComponentStack input, SummaryComponentStack output
+      |
+        callable = c.getFullString() and
+        c.propagatesFlow(input, output, preservesValue) and
+        flow = input + " -> " + output
+      )
+    }
+  }
+}
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/FlowSummaryImplSpecific.qll b/java/ql/src/semmle/code/java/dataflow/internal/FlowSummaryImplSpecific.qll
new file mode 100644
index 00000000000..dae0571f0fa
--- /dev/null
+++ b/java/ql/src/semmle/code/java/dataflow/internal/FlowSummaryImplSpecific.qll
@@ -0,0 +1,51 @@
+/**
+ * Provides Java specific classes and predicates for definining flow summaries.
+ */
+
+private import java
+private import DataFlowPrivate
+private import DataFlowUtil
+private import FlowSummaryImpl::Private
+private import FlowSummaryImpl::Public
+
+private module FlowSummaries {
+  private import semmle.code.java.dataflow.FlowSummary as F
+}
+
+/** Holds is `i` is a valid parameter position. */
+predicate parameterPosition(int i) { i in [-1 .. any(Parameter p).getPosition()] }
+
+/** Gets the synthesized summary data-flow node for the given values. */
+Node summaryNode(SummarizedCallable c, SummaryNodeState state) { result = getSummaryNode(c, state) }
+
+/** Gets the synthesized data-flow call for `receiver`. */
+DataFlowCall summaryDataFlowCall(Node receiver) { none() }
+
+/** Gets the type of content `c`. */
+DataFlowType getContentType(Content c) {
+  result = getErasedRepr(c.(FieldContent).getField().getType())
+  or
+  c instanceof CollectionContent and
+  result instanceof TypeObject
+  or
+  c instanceof ArrayContent and
+  result instanceof TypeObject
+}
+
+/** Gets the return type of kind `rk` for callable `c`. */
+DataFlowType getReturnType(SummarizedCallable c, ReturnKind rk) {
+  result = getErasedRepr(c.getReturnType()) and
+  exists(rk)
+}
+
+/**
+ * Gets the type of the `i`th parameter in a synthesized call that targets a
+ * callback of type `t`.
+ */
+DataFlowType getCallbackParameterType(DataFlowType t, int i) { none() }
+
+/**
+ * Gets the return type of kind `rk` in a synthesized call that targets a
+ * callback of type `t`.
+ */
+DataFlowType getCallbackReturnType(DataFlowType t, ReturnKind rk) { none() }
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll b/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll
index f8e11e8c770..9dc5d8f24b7 100644
--- a/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll
@@ -13,6 +13,7 @@ private import semmle.code.java.frameworks.Networking
 private import semmle.code.java.dataflow.ExternalFlow
 private import semmle.code.java.dataflow.internal.DataFlowPrivate
 import semmle.code.java.dataflow.FlowSteps
+private import FlowSummaryImpl as FlowSummaryImpl
 
 /**
  * Holds if taint can flow from `src` to `sink` in zero or more
@@ -33,7 +34,10 @@ predicate localExprTaint(Expr src, Expr sink) {
  */
 predicate localTaintStep(DataFlow::Node src, DataFlow::Node sink) {
   DataFlow::localFlowStep(src, sink) or
-  localAdditionalTaintStep(src, sink)
+  localAdditionalTaintStep(src, sink) or
+  // Simple flow through library code is included in the exposed local
+  // step relation, even though flow is technically inter-procedural
+  FlowSummaryImpl::Private::Steps::summaryThroughStep(src, sink, false)
 }
 
 /**
@@ -42,51 +46,19 @@ predicate localTaintStep(DataFlow::Node src, DataFlow::Node sink) {
  * different objects.
  */
 predicate localAdditionalTaintStep(DataFlow::Node src, DataFlow::Node sink) {
-  localAdditionalBasicTaintStep(src, sink)
-  or
-  composedValueAndTaintModelStep(src, sink)
-}
-
-private predicate localAdditionalBasicTaintStep(DataFlow::Node src, DataFlow::Node sink) {
   localAdditionalTaintExprStep(src.asExpr(), sink.asExpr())
   or
   localAdditionalTaintUpdateStep(src.asExpr(),
     sink.(DataFlow::PostUpdateNode).getPreUpdateNode().asExpr())
   or
-  summaryStep(src, sink, "taint") and
-  not summaryStep(src, sink, "value")
-  or
   exists(Argument arg |
     src.asExpr() = arg and
     arg.isVararg() and
     sink.(DataFlow::ImplicitVarargsArray).getCall() = arg.getCall()
   )
-}
-
-/**
- * Holds if an additional step from `src` to `sink` through a call can be inferred from the
- * combination of a value-preserving step providing an alias between an input and the output
- * and a taint step from `src` to one the aliased nodes. For example, if we know that `f(a, b)` returns
- * the exact value of `a` and also propagates taint from `b` to its result, then we also know that
- * `a` is tainted after `f` completes, and vice versa.
- */
-private predicate composedValueAndTaintModelStep(ArgumentNode src, DataFlow::Node sink) {
-  exists(Call call, ArgumentNode valueSource, DataFlow::PostUpdateNode valueSourcePost |
-    src.argumentOf(call, _) and
-    valueSource.argumentOf(call, _) and
-    src != valueSource and
-    valueSourcePost.getPreUpdateNode() = valueSource and
-    DataFlow::localFlowStep(valueSource, DataFlow::exprNode(call)) and
-    (
-      // in-x -value-> out-y and in-z -taint-> out-y ==> in-z -taint-> in-x
-      localAdditionalBasicTaintStep(src, DataFlow::exprNode(call)) and
-      sink = valueSourcePost
-      or
-      // in-x -value-> out-y and in-z -taint-> in-x ==> in-z -taint-> out-y
-      localAdditionalBasicTaintStep(src, valueSourcePost) and
-      sink = DataFlow::exprNode(call)
-    )
-  )
+  or
+  FlowSummaryImpl::Private::Steps::summaryLocalStep(src, sink, false) and
+  not FlowSummaryImpl::Private::Steps::summaryLocalStep(src, sink, true)
 }
 
 /**
@@ -552,10 +524,7 @@ module StringBuilderVarModule {
    * build up a query using string concatenation.
    */
   class StringBuilderVar extends LocalVariableDecl {
-    StringBuilderVar() {
-      this.getType() instanceof TypeStringBuilder or
-      this.getType() instanceof TypeStringBuffer
-    }
+    StringBuilderVar() { getType() instanceof StringBuildingType }
 
     /**
      * Gets a call that adds something to this string builder, from the argument at the given index.
diff --git a/java/ql/src/semmle/code/java/dispatch/ObjFlow.qll b/java/ql/src/semmle/code/java/dispatch/ObjFlow.qll
index 52ee910ae1d..9ec77acf2c7 100644
--- a/java/ql/src/semmle/code/java/dispatch/ObjFlow.qll
+++ b/java/ql/src/semmle/code/java/dispatch/ObjFlow.qll
@@ -194,7 +194,7 @@ private predicate source(RefType t, ObjNode n) {
 private predicate sink(ObjNode n) {
   exists(MethodAccess toString |
     toString.getQualifier() = n.asExpr() and
-    toString.getMethod().hasName("toString")
+    toString.getMethod() instanceof ToStringMethod
   ) and
   n.getTypeBound().getErasure() instanceof TypeObject
 }
diff --git a/java/ql/src/semmle/code/java/frameworks/ApacheHttp.qll b/java/ql/src/semmle/code/java/frameworks/ApacheHttp.qll
index 2dc1077cb4e..8378f1e7260 100644
--- a/java/ql/src/semmle/code/java/frameworks/ApacheHttp.qll
+++ b/java/ql/src/semmle/code/java/frameworks/ApacheHttp.qll
@@ -149,9 +149,8 @@ private class ApacheHttpFlowStep extends SummaryModelCsv {
         "org.apache.hc.core5.http.message;RequestLine;true;getMethod;();;Argument[-1];ReturnValue;taint",
         "org.apache.hc.core5.http.message;RequestLine;true;getUri;();;Argument[-1];ReturnValue;taint",
         "org.apache.hc.core5.http.message;RequestLine;true;toString;();;Argument[-1];ReturnValue;taint",
-        "org.apache.hc.core5.http.message;RequestLine;true;RequestLine;(HttpRequest);;Argument[0];ReturnValue;taint",
-        "org.apache.hc.core5.http.message;RequestLine;true;RequestLine;(String,String,ProtocolVersion);;Argument[1];ReturnValue;taint",
-        "org.apache.hc.core5.http.message;RequestLine;true;RequestLine;(String,String,ProtocolVersion);;Argument[1];ReturnValue;taint",
+        "org.apache.hc.core5.http.message;RequestLine;true;RequestLine;(HttpRequest);;Argument[0];Argument[-1];taint",
+        "org.apache.hc.core5.http.message;RequestLine;true;RequestLine;(String,String,ProtocolVersion);;Argument[1];Argument[-1];taint",
         "org.apache.hc.core5.function;Supplier;true;get;();;Argument[-1];ReturnValue;taint",
         "org.apache.hc.core5.net;URIAuthority;true;getHostName;();;Argument[-1];ReturnValue;taint",
         "org.apache.hc.core5.net;URIAuthority;true;toString;();;Argument[-1];ReturnValue;taint",
@@ -181,16 +180,16 @@ private class ApacheHttpFlowStep extends SummaryModelCsv {
         "org.apache.hc.core5.http.io.entity;HttpEntities;true;withTrailers;;;Argument[0];ReturnValue;taint",
         "org.apache.http.entity;BasicHttpEntity;true;setContent;(InputStream);;Argument[0];Argument[-1];taint",
         "org.apache.http.entity;BufferedHttpEntity;true;BufferedHttpEntity;(HttpEntity);;Argument[0];ReturnValue;taint",
-        "org.apache.http.entity;ByteArrayEntity;true;ByteArrayEntity;;;Argument[0];ReturnValue;taint",
+        "org.apache.http.entity;ByteArrayEntity;true;ByteArrayEntity;;;Argument[0];Argument[-1];taint",
         "org.apache.http.entity;HttpEntityWrapper;true;HttpEntityWrapper;(HttpEntity);;Argument[0];ReturnValue;taint",
         "org.apache.http.entity;InputStreamEntity;true;InputStreamEntity;;;Argument[0];ReturnValue;taint",
-        "org.apache.http.entity;StringEntity;true;StringEntity;;;Argument[0];ReturnValue;taint",
+        "org.apache.http.entity;StringEntity;true;StringEntity;;;Argument[0];Argument[-1];taint",
         "org.apache.hc.core5.http.io.entity;BasicHttpEntity;true;BasicHttpEntity;;;Argument[0];ReturnValue;taint",
         "org.apache.hc.core5.http.io.entity;BufferedHttpEntity;true;BufferedHttpEntity;(HttpEntity);;Argument[0];ReturnValue;taint",
-        "org.apache.hc.core5.http.io.entity;ByteArrayEntity;true;ByteArrayEntity;;;Argument[0];ReturnValue;taint",
+        "org.apache.hc.core5.http.io.entity;ByteArrayEntity;true;ByteArrayEntity;;;Argument[0];Argument[-1];taint",
         "org.apache.hc.core5.http.io.entity;HttpEntityWrapper;true;HttpEntityWrapper;(HttpEntity);;Argument[0];ReturnValue;taint",
         "org.apache.hc.core5.http.io.entity;InputStreamEntity;true;InputStreamEntity;;;Argument[0];ReturnValue;taint",
-        "org.apache.hc.core5.http.io.entity;StringEntity;true;StringEntity;;;Argument[0];ReturnValue;taint",
+        "org.apache.hc.core5.http.io.entity;StringEntity;true;StringEntity;;;Argument[0];Argument[-1];taint",
         "org.apache.http.util;ByteArrayBuffer;true;append;(byte[],int,int);;Argument[0];Argument[-1];taint",
         "org.apache.http.util;ByteArrayBuffer;true;append;(char[],int,int);;Argument[0];Argument[-1];taint",
         "org.apache.http.util;ByteArrayBuffer;true;append;(CharArrayBuffer,int,int);;Argument[0];Argument[-1];taint",
diff --git a/java/ql/src/semmle/code/java/frameworks/apache/Lang.qll b/java/ql/src/semmle/code/java/frameworks/apache/Lang.qll
index 0b64361c018..670014e0f8f 100644
--- a/java/ql/src/semmle/code/java/frameworks/apache/Lang.qll
+++ b/java/ql/src/semmle/code/java/frameworks/apache/Lang.qll
@@ -14,15 +14,6 @@ class TypeApacheRandomStringUtils extends Class {
   }
 }
 
-/**
- * The class `org.apache.commons.lang.ArrayUtils` or `org.apache.commons.lang3.ArrayUtils`.
- */
-class TypeApacheArrayUtils extends Class {
-  TypeApacheArrayUtils() {
-    hasQualifiedName(["org.apache.commons.lang", "org.apache.commons.lang3"], "ArrayUtils")
-  }
-}
-
 /**
  * The method `deserialize` in either `org.apache.commons.lang.SerializationUtils`
  * or `org.apache.commons.lang3.SerializationUtils`.
@@ -37,179 +28,402 @@ class MethodApacheSerializationUtilsDeserialize extends Method {
 }
 
 /**
- * A taint preserving method on `org.apache.commons.lang.ArrayUtils` or `org.apache.commons.lang3.ArrayUtils`
+ * Taint-propagating models for `ArrayUtils`.
  */
-private class ApacheLangArrayUtilsTaintPreservingMethod extends TaintPreservingCallable {
-  ApacheLangArrayUtilsTaintPreservingMethod() {
-    this.getDeclaringType() instanceof TypeApacheArrayUtils
-  }
-
-  override predicate returnsTaintFrom(int src) {
-    this.hasName(["addAll", "addFirst"]) and
-    src = [0 .. getNumberOfParameters() - 1]
-    or
-    this.hasName([
-        "clone", "nullToEmpty", "remove", "removeAll", "removeElement", "removeElements", "reverse",
-        "shift", "shuffle", "subarray", "swap", "toArray", "toMap", "toObject", "toPrimitive",
-        "toString", "toStringArray"
-      ]) and
-    src = 0
-    or
-    this.hasName("add") and
-    this.getNumberOfParameters() = 2 and
-    src = [0, 1]
-    or
-    this.hasName("add") and
-    this.getNumberOfParameters() = 3 and
-    src = [0, 2]
+private class ApacheArrayUtilsModel extends SummaryModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "org.apache.commons.lang3;ArrayUtils;false;add;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;ArrayUtils;false;add;;;Argument[2];ReturnValue;taint",
+        "org.apache.commons.lang3;ArrayUtils;false;add;(java.lang.Object[],java.lang.Object);;Argument[1];ReturnValue;taint",
+        "org.apache.commons.lang3;ArrayUtils;false;add;(boolean[],boolean);;Argument[1];ReturnValue;taint",
+        "org.apache.commons.lang3;ArrayUtils;false;add;(byte[],byte);;Argument[1];ReturnValue;taint",
+        "org.apache.commons.lang3;ArrayUtils;false;add;(char[],char);;Argument[1];ReturnValue;taint",
+        "org.apache.commons.lang3;ArrayUtils;false;add;(double[],double);;Argument[1];ReturnValue;taint",
+        "org.apache.commons.lang3;ArrayUtils;false;add;(float[],float);;Argument[1];ReturnValue;taint",
+        "org.apache.commons.lang3;ArrayUtils;false;add;(int[],int);;Argument[1];ReturnValue;taint",
+        "org.apache.commons.lang3;ArrayUtils;false;add;(long[],long);;Argument[1];ReturnValue;taint",
+        "org.apache.commons.lang3;ArrayUtils;false;add;(short[],short);;Argument[1];ReturnValue;taint",
+        "org.apache.commons.lang3;ArrayUtils;false;addAll;;;Argument[0..1];ReturnValue;taint",
+        "org.apache.commons.lang3;ArrayUtils;false;addFirst;;;Argument[0..1];ReturnValue;taint",
+        "org.apache.commons.lang3;ArrayUtils;false;clone;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;ArrayUtils;false;get;(java.lang.Object[],int,java.lang.Object);;Argument[2];ReturnValue;taint",
+        "org.apache.commons.lang3;ArrayUtils;false;get;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;ArrayUtils;false;insert;;;Argument[1];ReturnValue;taint",
+        "org.apache.commons.lang3;ArrayUtils;false;insert;;;Argument[2];ReturnValue;taint",
+        "org.apache.commons.lang3;ArrayUtils;false;insert;;;Argument[3];ReturnValue;taint",
+        "org.apache.commons.lang3;ArrayUtils;false;nullToEmpty;(java.lang.Object[],java.lang.Class);;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;ArrayUtils;false;nullToEmpty;(java.lang.String[]);;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;ArrayUtils;false;remove;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;ArrayUtils;false;removeAll;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;ArrayUtils;false;removeAllOccurences;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;ArrayUtils;false;removeAllOccurrences;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;ArrayUtils;false;removeElement;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;ArrayUtils;false;removeElements;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;ArrayUtils;false;subarray;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;ArrayUtils;false;toArray;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;ArrayUtils;false;toMap;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;ArrayUtils;false;toObject;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;ArrayUtils;false;toPrimitive;;;Argument[0..1];ReturnValue;taint"
+      ]
   }
 }
 
-private Type getAnExcludedParameterType() {
-  result instanceof PrimitiveType or
-  result.(RefType).hasQualifiedName("java.nio.charset", "Charset") or
-  result.(RefType).hasQualifiedName("java.util", "Locale")
-}
-
-private class ApacheStringUtilsTaintPreservingMethod extends TaintPreservingCallable {
-  ApacheStringUtilsTaintPreservingMethod() {
-    this.getDeclaringType().hasQualifiedName("org.apache.commons.lang3", "StringUtils") and
-    this.hasName([
-        "abbreviate", "abbreviateMiddle", "appendIfMissing", "appendIfMissingIgnoreCase",
-        "capitalize", "center", "chomp", "chop", "defaultIfBlank", "defaultIfEmpty",
-        "defaultString", "deleteWhitespace", "difference", "firstNonBlank", "firstNonEmpty",
-        "getBytes", "getCommonPrefix", "getDigits", "getIfBlank", "getIfEmpty", "join", "joinWith",
-        "left", "leftPad", "lowerCase", "mid", "normalizeSpace", "overlay", "prependIfMissing",
-        "prependIfMissingIgnoreCase", "remove", "removeAll", "removeEnd", "removeEndIgnoreCase",
-        "removeFirst", "removeIgnoreCase", "removePattern", "removeStart", "removeStartIgnoreCase",
-        "repeat", "replace", "replaceAll", "replaceChars", "replaceEach", "replaceEachRepeatedly",
-        "replaceFirst", "replaceIgnoreCase", "replaceOnce", "replaceOnceIgnoreCase",
-        "replacePattern", "reverse", "reverseDelimited", "right", "rightPad", "rotate", "split",
-        "splitByCharacterType", "splitByCharacterTypeCamelCase", "splitByWholeSeparator",
-        "splitByWholeSeparatorPreserveAllTokens", "splitPreserveAllTokens", "strip", "stripAccents",
-        "stripAll", "stripEnd", "stripStart", "stripToEmpty", "stripToNull", "substring",
-        "substringAfter", "substringAfterLast", "substringBefore", "substringBeforeLast",
-        "substringBetween", "substringsBetween", "swapCase", "toCodePoints", "toEncodedString",
-        "toRootLowerCase", "toRootUpperCase", "toString", "trim", "trimToEmpty", "trimToNull",
-        "truncate", "uncapitalize", "unwrap", "upperCase", "valueOf", "wrap", "wrapIfMissing"
-      ])
-  }
-
-  private predicate isExcludedParameter(int arg) {
-    this.getName().matches(["appendIfMissing%", "prependIfMissing%"]) and arg = [2, 3]
-    or
-    this.getName().matches(["remove%", "split%", "substring%", "strip%"]) and
-    arg = [1 .. getNumberOfParameters() - 1]
-    or
-    this.getName().matches(["chomp", "getBytes", "replace%", "toString", "unwrap"]) and arg = 1
-    or
-    this.getName() = "join" and
-    // Exclude joins of types that render numerically (char[] and non-primitive arrays
-    // are still considered taint sources)
-    exists(PrimitiveType pt |
-      this.getParameterType(arg).(Array).getComponentType() = pt and
-      not pt instanceof CharacterType
-    ) and
-    arg = 0
-  }
-
-  override predicate returnsTaintFrom(int arg) {
-    arg = [0 .. getNumberOfParameters() - 1] and
-    not this.getParameterType(arg) = getAnExcludedParameterType() and
-    not isExcludedParameter(arg)
+private class ApacheStringUtilsModel extends SummaryModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "org.apache.commons.lang3;StringUtils;false;abbreviate;(java.lang.String,java.lang.String,int);;Argument[1];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;abbreviate;(java.lang.String,java.lang.String,int,int);;Argument[1];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;abbreviate;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;abbreviateMiddle;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;abbreviateMiddle;;;Argument[1];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;appendIfMissing;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;appendIfMissing;;;Argument[1];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;appendIfMissingIgnoreCase;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;appendIfMissingIgnoreCase;;;Argument[1];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;capitalize;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;center;(java.lang.String,int,java.lang.String);;Argument[2];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;center;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;chomp;(java.lang.String);;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;chomp;(java.lang.String,java.lang.String);;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;chop;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;defaultIfBlank;;;Argument[0..1];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;defaultIfEmpty;;;Argument[0..1];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;defaultString;;;Argument[0..1];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;deleteWhitespace;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;difference;;;Argument[0..1];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;firstNonBlank;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;firstNonEmpty;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;getBytes;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;getCommonPrefix;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;getDigits;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;getIfBlank;;;Argument[0..1];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;getIfEmpty;;;Argument[0..1];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;join;(char[],char);;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;join;(char[],char,int,int);;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;join;(java.lang.Iterable,char);;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;join;(java.lang.Iterable,java.lang.String);;Argument[0..1];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;join;(java.lang.Object[]);;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;join;(java.lang.Object[],char);;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;join;(java.lang.Object[],char,int,int);;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;join;(java.lang.Object[],java.lang.String);;Argument[0..1];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;join;(java.lang.Object[],java.lang.String,int,int);;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;join;(java.lang.Object[],java.lang.String,int,int);;Argument[1];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;join;(java.util.Iterator,char);;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;join;(java.util.Iterator,java.lang.String);;Argument[0..1];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;join;(java.util.List,char,int,int);;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;join;(java.util.List,java.lang.String,int,int);;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;join;(java.util.List,java.lang.String,int,int);;Argument[1];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;joinWith;;;Argument[0..1];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;left;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;leftPad;(java.lang.String,int,java.lang.String);;Argument[2];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;leftPad;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;lowerCase;(java.lang.String);;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;lowerCase;(java.lang.String,java.util.Locale);;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;mid;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;normalizeSpace;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;overlay;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;overlay;;;Argument[1];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;prependIfMissing;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;prependIfMissing;;;Argument[1];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;prependIfMissingIgnoreCase;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;prependIfMissingIgnoreCase;;;Argument[1];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;remove;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;removeAll;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;removeEnd;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;removeEndIgnoreCase;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;removeFirst;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;removeIgnoreCase;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;removePattern;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;removeStart;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;removeStartIgnoreCase;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;repeat;(java.lang.String,java.lang.String,int);;Argument[1];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;repeat;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;replace;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;replace;;;Argument[2];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;replaceAll;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;replaceAll;;;Argument[2];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;replaceChars;(java.lang.String,java.lang.String,java.lang.String);;Argument[2];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;replaceChars;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;replaceEach;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;replaceEach;;;Argument[2];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;replaceEachRepeatedly;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;replaceEachRepeatedly;;;Argument[2];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;replaceFirst;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;replaceFirst;;;Argument[2];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;replaceIgnoreCase;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;replaceIgnoreCase;;;Argument[2];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;replaceOnce;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;replaceOnce;;;Argument[2];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;replaceOnceIgnoreCase;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;replaceOnceIgnoreCase;;;Argument[2];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;replacePattern;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;replacePattern;;;Argument[2];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;reverse;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;reverseDelimited;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;right;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;rightPad;(java.lang.String,int,java.lang.String);;Argument[2];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;rightPad;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;rotate;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;split;(java.lang.String);;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;split;(java.lang.String,char);;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;split;(java.lang.String,java.lang.String);;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;split;(java.lang.String,java.lang.String,int);;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;splitByCharacterType;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;splitByCharacterTypeCamelCase;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;splitByWholeSeparator;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;splitByWholeSeparatorPreserveAllTokens;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;splitPreserveAllTokens;(java.lang.String);;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;splitPreserveAllTokens;(java.lang.String,char);;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;splitPreserveAllTokens;(java.lang.String,java.lang.String);;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;splitPreserveAllTokens;(java.lang.String,java.lang.String,int);;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;strip;(java.lang.String);;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;strip;(java.lang.String,java.lang.String);;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;stripAccents;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;stripAll;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;stripEnd;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;stripStart;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;stripToEmpty;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;stripToNull;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;substring;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;substringAfter;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;substringAfterLast;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;substringBefore;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;substringBeforeLast;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;substringBetween;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;substringsBetween;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;swapCase;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;toCodePoints;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;toEncodedString;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;toRootLowerCase;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;toRootUpperCase;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;toString;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;trim;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;trimToEmpty;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;trimToNull;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;truncate;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;uncapitalize;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;unwrap;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;upperCase;(java.lang.String);;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;upperCase;(java.lang.String,java.util.Locale);;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;valueOf;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;wrap;(java.lang.String,char);;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;wrap;(java.lang.String,java.lang.String);;Argument[0..1];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;wrapIfMissing;(java.lang.String,char);;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3;StringUtils;false;wrapIfMissing;(java.lang.String,java.lang.String);;Argument[0..1];ReturnValue;taint"
+      ]
   }
 }
 
-/**
- * A method declared on Apache Commons Lang's `StrBuilder`, or the same class or its
- * renamed version `TextStringBuilder` in Commons Text.
- */
-class ApacheStrBuilderCallable extends Callable {
-  ApacheStrBuilderCallable() {
-    this.getDeclaringType().hasQualifiedName("org.apache.commons.lang3.text", "StrBuilder") or
-    this.getDeclaringType()
-        .hasQualifiedName("org.apache.commons.text", ["StrBuilder", "TextStringBuilder"])
-  }
-}
-
-/**
- * An Apache Commons Lang `StrBuilder` method that adds taint to the `StrBuilder`.
- */
-private class ApacheStrBuilderTaintingMethod extends ApacheStrBuilderCallable,
-  TaintPreservingCallable {
-  ApacheStrBuilderTaintingMethod() {
-    this instanceof Constructor
-    or
-    this.hasName([
-        "append", "appendAll", "appendFixedWidthPadLeft", "appendFixedWidthPadRight", "appendln",
-        "appendSeparator", "appendWithSeparators", "insert", "readFrom", "replace", "replaceAll",
-        "replaceFirst"
-      ])
-  }
-
-  private predicate consumesTaintFromAllArgs() {
-    // Specifically the append[ln](String, Object...) overloads also consume taint from their other arguments:
-    this.getName() in ["appendAll", "appendWithSeparators"]
-    or
-    this.getName() = ["append", "appendln"] and this.getAParameter().isVarargs()
-    or
-    this.getName() = "appendSeparator" and this.getParameterType(1) instanceof TypeString
-  }
-
-  override predicate transfersTaint(int fromArg, int toArg) {
-    // Taint the qualifier
-    toArg = -1 and
-    (
-      this.getName().matches(["append%", "readFrom"]) and fromArg = 0
-      or
-      this.getName() = "insert" and fromArg = 1
-      or
-      this.getName().matches("replace%") and
-      (
-        if this.getParameterType(0).(PrimitiveType).getName() = "int"
-        then fromArg = 2
-        else fromArg = 1
-      )
-      or
-      this.consumesTaintFromAllArgs() and fromArg in [0 .. this.getNumberOfParameters() - 1]
-    )
-  }
-
-  override predicate returnsTaintFrom(int arg) { this instanceof Constructor and arg = 0 }
-}
-
-/**
- * An Apache Commons Lang `StrBuilder` method that returns taint from the `StrBuilder`.
- */
-private class ApacheStrBuilderTaintGetter extends ApacheStrBuilderCallable, TaintPreservingCallable {
-  ApacheStrBuilderTaintGetter() {
-    // Taint getters:
-    this.hasName([
-        "asReader", "asTokenizer", "build", "getChars", "leftString", "midString", "rightString",
-        "subSequence", "substring", "toCharArray", "toString", "toStringBuffer", "toStringBuilder"
-      ])
-    or
-    // Fluent methods that return an alias of `this`:
-    this.getReturnType() = this.getDeclaringType()
-  }
-
-  override predicate returnsTaintFrom(int arg) { arg = -1 }
-}
-
-/**
- * An Apache Commons Lang `StrBuilder` method that writes taint from the `StrBuilder` to some parameter.
- */
-private class ApacheStrBuilderTaintWriter extends ApacheStrBuilderCallable, TaintPreservingCallable {
-  ApacheStrBuilderTaintWriter() { this.hasName(["appendTo", "getChars"]) }
-
-  override predicate transfersTaint(int fromArg, int toArg) {
-    fromArg = -1 and
-    // appendTo(Readable) and getChars(char[])
-    if this.getNumberOfParameters() = 1
-    then toArg = 0
-    else
-      // getChars(int, int, char[], int)
-      toArg = 2
+private class ApacheStrBuilderModel extends SummaryModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "org.apache.commons.lang3.text;StrBuilder;false;StrBuilder;(java.lang.String);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;append;(char[]);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;append;(char[],int,int);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;append;(java.lang.CharSequence);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;append;(java.lang.CharSequence,int,int);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;append;(java.lang.Object);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;append;(java.lang.String);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;append;(java.lang.String,int,int);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;append;(java.lang.String,java.lang.Object[]);;Argument[0..1];Argument[-1];taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;append;(java.lang.StringBuffer);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;append;(java.lang.StringBuffer,int,int);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;append;(java.lang.StringBuilder);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;append;(java.lang.StringBuilder,int,int);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;append;(java.nio.CharBuffer);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;append;(java.nio.CharBuffer,int,int);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;append;(org.apache.commons.lang3.text.StrBuilder);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;append;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;appendAll;;;Argument[0];Argument[-1];taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;appendAll;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;appendFixedWidthPadLeft;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;appendFixedWidthPadLeft;;;Argument[0];Argument[-1];taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;appendFixedWidthPadRight;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;appendFixedWidthPadRight;;;Argument[0];Argument[-1];taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;appendSeparator;(java.lang.String);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;appendSeparator;(java.lang.String,int);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;appendSeparator;(java.lang.String,java.lang.String);;Argument[0..1];Argument[-1];taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;appendSeparator;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;appendTo;;;Argument[-1];Argument[0];taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;appendWithSeparators;;;Argument[0..1];Argument[-1];taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;appendWithSeparators;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;appendln;(char[]);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;appendln;(char[],int,int);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;appendln;(java.lang.Object);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;appendln;(java.lang.String);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;appendln;(java.lang.String,int,int);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;appendln;(java.lang.String,java.lang.Object[]);;Argument[0..1];Argument[-1];taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;appendln;(java.lang.StringBuffer);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;appendln;(java.lang.StringBuffer,int,int);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;appendln;(java.lang.StringBuilder);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;appendln;(java.lang.StringBuilder,int,int);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;appendln;(org.apache.commons.lang3.text.StrBuilder);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;appendln;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;asReader;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;asTokenizer;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;build;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;getChars;(char[]);;Argument[-1];Argument[0];taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;getChars;(char[]);;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;getChars;(int,int,char[],int);;Argument[-1];Argument[2];taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;insert;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;insert;;;Argument[1];Argument[-1];taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;leftString;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;midString;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;readFrom;;;Argument[0];Argument[-1];taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;replace;(int,int,java.lang.String);;Argument[2];Argument[-1];taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;replace;(org.apache.commons.lang3.text.StrMatcher,java.lang.String,int,int,int);;Argument[1];Argument[-1];taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;replace;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;replaceAll;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;replaceAll;;;Argument[1];Argument[-1];taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;replaceFirst;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;replaceFirst;;;Argument[1];Argument[-1];taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;rightString;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;subSequence;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;substring;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;toCharArray;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;toString;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;toStringBuffer;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.lang3.text;StrBuilder;false;toStringBuilder;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;StrBuilder;false;StrBuilder;(java.lang.String);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;StrBuilder;false;append;(char[]);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;StrBuilder;false;append;(char[],int,int);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;StrBuilder;false;append;(java.lang.CharSequence);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;StrBuilder;false;append;(java.lang.CharSequence,int,int);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;StrBuilder;false;append;(java.lang.Object);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;StrBuilder;false;append;(java.lang.String);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;StrBuilder;false;append;(java.lang.String,int,int);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;StrBuilder;false;append;(java.lang.String,java.lang.Object[]);;Argument[0..1];Argument[-1];taint",
+        "org.apache.commons.text;StrBuilder;false;append;(java.lang.StringBuffer);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;StrBuilder;false;append;(java.lang.StringBuffer,int,int);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;StrBuilder;false;append;(java.lang.StringBuilder);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;StrBuilder;false;append;(java.lang.StringBuilder,int,int);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;StrBuilder;false;append;(java.nio.CharBuffer);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;StrBuilder;false;append;(java.nio.CharBuffer,int,int);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;StrBuilder;false;append;(org.apache.commons.text.StrBuilder);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;StrBuilder;false;append;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;StrBuilder;false;appendAll;;;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;StrBuilder;false;appendAll;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;StrBuilder;false;appendFixedWidthPadLeft;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;StrBuilder;false;appendFixedWidthPadLeft;;;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;StrBuilder;false;appendFixedWidthPadRight;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;StrBuilder;false;appendFixedWidthPadRight;;;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;StrBuilder;false;appendSeparator;(java.lang.String);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;StrBuilder;false;appendSeparator;(java.lang.String,int);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;StrBuilder;false;appendSeparator;(java.lang.String,java.lang.String);;Argument[0..1];Argument[-1];taint",
+        "org.apache.commons.text;StrBuilder;false;appendSeparator;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;StrBuilder;false;appendTo;;;Argument[-1];Argument[0];taint",
+        "org.apache.commons.text;StrBuilder;false;appendWithSeparators;;;Argument[0..1];Argument[-1];taint",
+        "org.apache.commons.text;StrBuilder;false;appendWithSeparators;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;StrBuilder;false;appendln;(char[]);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;StrBuilder;false;appendln;(char[],int,int);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;StrBuilder;false;appendln;(java.lang.Object);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;StrBuilder;false;appendln;(java.lang.String);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;StrBuilder;false;appendln;(java.lang.String,int,int);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;StrBuilder;false;appendln;(java.lang.String,java.lang.Object[]);;Argument[0..1];Argument[-1];taint",
+        "org.apache.commons.text;StrBuilder;false;appendln;(java.lang.StringBuffer);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;StrBuilder;false;appendln;(java.lang.StringBuffer,int,int);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;StrBuilder;false;appendln;(java.lang.StringBuilder);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;StrBuilder;false;appendln;(java.lang.StringBuilder,int,int);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;StrBuilder;false;appendln;(org.apache.commons.text.StrBuilder);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;StrBuilder;false;appendln;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;StrBuilder;false;asReader;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;StrBuilder;false;asTokenizer;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;StrBuilder;false;build;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;StrBuilder;false;getChars;(char[]);;Argument[-1];Argument[0];taint",
+        "org.apache.commons.text;StrBuilder;false;getChars;(char[]);;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;StrBuilder;false;getChars;(int,int,char[],int);;Argument[-1];Argument[2];taint",
+        "org.apache.commons.text;StrBuilder;false;insert;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;StrBuilder;false;insert;;;Argument[1];Argument[-1];taint",
+        "org.apache.commons.text;StrBuilder;false;leftString;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;StrBuilder;false;midString;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;StrBuilder;false;readFrom;;;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;StrBuilder;false;replace;(int,int,java.lang.String);;Argument[2];Argument[-1];taint",
+        "org.apache.commons.text;StrBuilder;false;replace;(org.apache.commons.text.StrMatcher,java.lang.String,int,int,int);;Argument[1];Argument[-1];taint",
+        "org.apache.commons.text;StrBuilder;false;replace;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;StrBuilder;false;replaceAll;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;StrBuilder;false;replaceAll;;;Argument[1];Argument[-1];taint",
+        "org.apache.commons.text;StrBuilder;false;replaceFirst;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;StrBuilder;false;replaceFirst;;;Argument[1];Argument[-1];taint",
+        "org.apache.commons.text;StrBuilder;false;rightString;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;StrBuilder;false;subSequence;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;StrBuilder;false;substring;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;StrBuilder;false;toCharArray;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;StrBuilder;false;toString;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;StrBuilder;false;toStringBuffer;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;StrBuilder;false;toStringBuilder;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;TextStringBuilder;false;TextStringBuilder;(java.lang.String);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;TextStringBuilder;false;TextStringBuilder;(java.lang.CharSequence);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;TextStringBuilder;false;append;(char[]);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;TextStringBuilder;false;append;(char[],int,int);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;TextStringBuilder;false;append;(java.lang.CharSequence);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;TextStringBuilder;false;append;(java.lang.CharSequence,int,int);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;TextStringBuilder;false;append;(java.lang.Object);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;TextStringBuilder;false;append;(java.lang.String);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;TextStringBuilder;false;append;(java.lang.String,int,int);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;TextStringBuilder;false;append;(java.lang.String,java.lang.Object[]);;Argument[0..1];Argument[-1];taint",
+        "org.apache.commons.text;TextStringBuilder;false;append;(java.lang.StringBuffer);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;TextStringBuilder;false;append;(java.lang.StringBuffer,int,int);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;TextStringBuilder;false;append;(java.lang.StringBuilder);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;TextStringBuilder;false;append;(java.lang.StringBuilder,int,int);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;TextStringBuilder;false;append;(java.nio.CharBuffer);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;TextStringBuilder;false;append;(java.nio.CharBuffer,int,int);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;TextStringBuilder;false;append;(org.apache.commons.text.TextStringBuilder);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;TextStringBuilder;false;append;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;TextStringBuilder;false;appendAll;;;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;TextStringBuilder;false;appendAll;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;TextStringBuilder;false;appendFixedWidthPadLeft;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;TextStringBuilder;false;appendFixedWidthPadLeft;;;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;TextStringBuilder;false;appendFixedWidthPadRight;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;TextStringBuilder;false;appendFixedWidthPadRight;;;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;TextStringBuilder;false;appendSeparator;(java.lang.String);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;TextStringBuilder;false;appendSeparator;(java.lang.String,int);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;TextStringBuilder;false;appendSeparator;(java.lang.String,java.lang.String);;Argument[0..1];Argument[-1];taint",
+        "org.apache.commons.text;TextStringBuilder;false;appendSeparator;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;TextStringBuilder;false;appendTo;;;Argument[-1];Argument[0];taint",
+        "org.apache.commons.text;TextStringBuilder;false;appendWithSeparators;;;Argument[0..1];Argument[-1];taint",
+        "org.apache.commons.text;TextStringBuilder;false;appendWithSeparators;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;TextStringBuilder;false;appendln;(char[]);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;TextStringBuilder;false;appendln;(char[],int,int);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;TextStringBuilder;false;appendln;(java.lang.Object);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;TextStringBuilder;false;appendln;(java.lang.String);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;TextStringBuilder;false;appendln;(java.lang.String,int,int);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;TextStringBuilder;false;appendln;(java.lang.String,java.lang.Object[]);;Argument[0..1];Argument[-1];taint",
+        "org.apache.commons.text;TextStringBuilder;false;appendln;(java.lang.StringBuffer);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;TextStringBuilder;false;appendln;(java.lang.StringBuffer,int,int);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;TextStringBuilder;false;appendln;(java.lang.StringBuilder);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;TextStringBuilder;false;appendln;(java.lang.StringBuilder,int,int);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;TextStringBuilder;false;appendln;(org.apache.commons.text.TextStringBuilder);;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;TextStringBuilder;false;appendln;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;TextStringBuilder;false;asReader;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;TextStringBuilder;false;asTokenizer;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;TextStringBuilder;false;build;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;TextStringBuilder;false;getChars;(char[]);;Argument[-1];Argument[0];taint",
+        "org.apache.commons.text;TextStringBuilder;false;getChars;(char[]);;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;TextStringBuilder;false;getChars;(int,int,char[],int);;Argument[-1];Argument[2];taint",
+        "org.apache.commons.text;TextStringBuilder;false;insert;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;TextStringBuilder;false;insert;;;Argument[1];Argument[-1];taint",
+        "org.apache.commons.text;TextStringBuilder;false;leftString;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;TextStringBuilder;false;midString;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;TextStringBuilder;false;readFrom;;;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;TextStringBuilder;false;replace;(int,int,java.lang.String);;Argument[2];Argument[-1];taint",
+        "org.apache.commons.text;TextStringBuilder;false;replace;(org.apache.commons.text.matcher.StringMatcher,java.lang.String,int,int,int);;Argument[1];Argument[-1];taint",
+        "org.apache.commons.text;TextStringBuilder;false;replace;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;TextStringBuilder;false;replaceAll;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;TextStringBuilder;false;replaceAll;;;Argument[1];Argument[-1];taint",
+        "org.apache.commons.text;TextStringBuilder;false;replaceFirst;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;TextStringBuilder;false;replaceFirst;;;Argument[1];Argument[-1];taint",
+        "org.apache.commons.text;TextStringBuilder;false;rightString;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;TextStringBuilder;false;subSequence;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;TextStringBuilder;false;substring;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;TextStringBuilder;false;toCharArray;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;TextStringBuilder;false;toString;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;TextStringBuilder;false;toStringBuffer;;;Argument[-1];ReturnValue;taint",
+        "org.apache.commons.text;TextStringBuilder;false;toStringBuilder;;;Argument[-1];ReturnValue;taint"
+      ]
   }
 }
 
@@ -223,28 +437,28 @@ private class ApacheWordUtilsModel extends SummaryModelCsv {
         "org.apache.commons.lang3.text;WordUtils;false;wrap;;;Argument[0];ReturnValue;taint",
         "org.apache.commons.lang3.text;WordUtils;false;wrap;(java.lang.String,int,java.lang.String,boolean);;Argument[2];ReturnValue;taint",
         "org.apache.commons.lang3.text;WordUtils;false;wrap;(java.lang.String,int,java.lang.String,boolean,java.lang.String);;Argument[2];ReturnValue;taint",
-        "org.apache.commons.lang3.text;WordUtils;false;uncapitalize;(java.lang.String);;Argument;ReturnValue;taint",
+        "org.apache.commons.lang3.text;WordUtils;false;uncapitalize;(java.lang.String);;Argument[0];ReturnValue;taint",
         "org.apache.commons.lang3.text;WordUtils;false;uncapitalize;(java.lang.String,char[]);;Argument[0];ReturnValue;taint",
-        "org.apache.commons.lang3.text;WordUtils;false;swapCase;;;Argument;ReturnValue;taint",
-        "org.apache.commons.lang3.text;WordUtils;false;capitalize;(java.lang.String);;Argument;ReturnValue;taint",
+        "org.apache.commons.lang3.text;WordUtils;false;swapCase;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3.text;WordUtils;false;capitalize;(java.lang.String);;Argument[0];ReturnValue;taint",
         "org.apache.commons.lang3.text;WordUtils;false;capitalize;(java.lang.String,char[]);;Argument[0];ReturnValue;taint",
-        "org.apache.commons.lang3.text;WordUtils;false;initials;(java.lang.String);;Argument;ReturnValue;taint",
+        "org.apache.commons.lang3.text;WordUtils;false;initials;(java.lang.String);;Argument[0];ReturnValue;taint",
         "org.apache.commons.lang3.text;WordUtils;false;initials;(java.lang.String,char[]);;Argument[0];ReturnValue;taint",
-        "org.apache.commons.lang3.text;WordUtils;false;capitalizeFully;(java.lang.String);;Argument;ReturnValue;taint",
+        "org.apache.commons.lang3.text;WordUtils;false;capitalizeFully;(java.lang.String);;Argument[0];ReturnValue;taint",
         "org.apache.commons.lang3.text;WordUtils;false;capitalizeFully;(java.lang.String,char[]);;Argument[0];ReturnValue;taint",
         "org.apache.commons.text;WordUtils;false;wrap;;;Argument[0];ReturnValue;taint",
         "org.apache.commons.text;WordUtils;false;wrap;(java.lang.String,int,java.lang.String,boolean);;Argument[2];ReturnValue;taint",
         "org.apache.commons.text;WordUtils;false;wrap;(java.lang.String,int,java.lang.String,boolean,java.lang.String);;Argument[2];ReturnValue;taint",
-        "org.apache.commons.text;WordUtils;false;uncapitalize;(java.lang.String);;Argument;ReturnValue;taint",
+        "org.apache.commons.text;WordUtils;false;uncapitalize;(java.lang.String);;Argument[0];ReturnValue;taint",
         "org.apache.commons.text;WordUtils;false;uncapitalize;(java.lang.String,char[]);;Argument[0];ReturnValue;taint",
-        "org.apache.commons.text;WordUtils;false;swapCase;;;Argument;ReturnValue;taint",
-        "org.apache.commons.text;WordUtils;false;capitalize;(java.lang.String);;Argument;ReturnValue;taint",
+        "org.apache.commons.text;WordUtils;false;swapCase;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.text;WordUtils;false;capitalize;(java.lang.String);;Argument[0];ReturnValue;taint",
         "org.apache.commons.text;WordUtils;false;capitalize;(java.lang.String,char[]);;Argument[0];ReturnValue;taint",
         "org.apache.commons.text;WordUtils;false;abbreviate;;;Argument[0];ReturnValue;taint",
         "org.apache.commons.text;WordUtils;false;abbreviate;;;Argument[3];ReturnValue;taint",
-        "org.apache.commons.text;WordUtils;false;initials;(java.lang.String);;Argument;ReturnValue;taint",
+        "org.apache.commons.text;WordUtils;false;initials;(java.lang.String);;Argument[0];ReturnValue;taint",
         "org.apache.commons.text;WordUtils;false;initials;(java.lang.String,char[]);;Argument[0];ReturnValue;taint",
-        "org.apache.commons.text;WordUtils;false;capitalizeFully;(java.lang.String);;Argument;ReturnValue;taint",
+        "org.apache.commons.text;WordUtils;false;capitalizeFully;(java.lang.String);;Argument[0];ReturnValue;taint",
         "org.apache.commons.text;WordUtils;false;capitalizeFully;(java.lang.String,char[]);;Argument[0];ReturnValue;taint"
       ]
   }
@@ -257,11 +471,11 @@ private class ApacheStrTokenizerModel extends SummaryModelCsv {
   override predicate row(string row) {
     row =
       [
-        "org.apache.commons.lang3.text;StrTokenizer;false;StrTokenizer;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3.text;StrTokenizer;false;StrTokenizer;;;Argument[0];Argument[-1];taint",
         "org.apache.commons.lang3.text;StrTokenizer;false;clone;;;Argument[-1];ReturnValue;taint",
         "org.apache.commons.lang3.text;StrTokenizer;false;toString;;;Argument[-1];ReturnValue;taint",
-        "org.apache.commons.lang3.text;StrTokenizer;false;reset;;;Argument;ReturnValue;taint",
-        "org.apache.commons.lang3.text;StrTokenizer;false;reset;;;Argument;Argument[-1];taint",
+        "org.apache.commons.lang3.text;StrTokenizer;false;reset;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3.text;StrTokenizer;false;reset;;;Argument[0];Argument[-1];taint",
         "org.apache.commons.lang3.text;StrTokenizer;false;next;;;Argument[-1];ReturnValue;taint",
         "org.apache.commons.lang3.text;StrTokenizer;false;getContent;;;Argument[-1];ReturnValue;taint",
         "org.apache.commons.lang3.text;StrTokenizer;false;previous;;;Argument[-1];ReturnValue;taint",
@@ -269,13 +483,13 @@ private class ApacheStrTokenizerModel extends SummaryModelCsv {
         "org.apache.commons.lang3.text;StrTokenizer;false;getTokenArray;;;Argument[-1];ReturnValue;taint",
         "org.apache.commons.lang3.text;StrTokenizer;false;previousToken;;;Argument[-1];ReturnValue;taint",
         "org.apache.commons.lang3.text;StrTokenizer;false;nextToken;;;Argument[-1];ReturnValue;taint",
-        "org.apache.commons.lang3.text;StrTokenizer;false;getTSVInstance;;;Argument;ReturnValue;taint",
-        "org.apache.commons.lang3.text;StrTokenizer;false;getCSVInstance;;;Argument;ReturnValue;taint",
-        "org.apache.commons.text;StrTokenizer;false;StrTokenizer;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3.text;StrTokenizer;false;getTSVInstance;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3.text;StrTokenizer;false;getCSVInstance;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.text;StrTokenizer;false;StrTokenizer;;;Argument[0];Argument[-1];taint",
         "org.apache.commons.text;StrTokenizer;false;clone;;;Argument[-1];ReturnValue;taint",
         "org.apache.commons.text;StrTokenizer;false;toString;;;Argument[-1];ReturnValue;taint",
-        "org.apache.commons.text;StrTokenizer;false;reset;;;Argument;ReturnValue;taint",
-        "org.apache.commons.text;StrTokenizer;false;reset;;;Argument;Argument[-1];taint",
+        "org.apache.commons.text;StrTokenizer;false;reset;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.text;StrTokenizer;false;reset;;;Argument[0];Argument[-1];taint",
         "org.apache.commons.text;StrTokenizer;false;next;;;Argument[-1];ReturnValue;taint",
         "org.apache.commons.text;StrTokenizer;false;getContent;;;Argument[-1];ReturnValue;taint",
         "org.apache.commons.text;StrTokenizer;false;previous;;;Argument[-1];ReturnValue;taint",
@@ -283,13 +497,13 @@ private class ApacheStrTokenizerModel extends SummaryModelCsv {
         "org.apache.commons.text;StrTokenizer;false;getTokenArray;;;Argument[-1];ReturnValue;taint",
         "org.apache.commons.text;StrTokenizer;false;previousToken;;;Argument[-1];ReturnValue;taint",
         "org.apache.commons.text;StrTokenizer;false;nextToken;;;Argument[-1];ReturnValue;taint",
-        "org.apache.commons.text;StrTokenizer;false;getTSVInstance;;;Argument;ReturnValue;taint",
-        "org.apache.commons.text;StrTokenizer;false;getCSVInstance;;;Argument;ReturnValue;taint",
-        "org.apache.commons.text;StringTokenizer;false;StringTokenizer;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.text;StrTokenizer;false;getTSVInstance;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.text;StrTokenizer;false;getCSVInstance;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.text;StringTokenizer;false;StringTokenizer;;;Argument[0];Argument[-1];taint",
         "org.apache.commons.text;StringTokenizer;false;clone;;;Argument[-1];ReturnValue;taint",
         "org.apache.commons.text;StringTokenizer;false;toString;;;Argument[-1];ReturnValue;taint",
-        "org.apache.commons.text;StringTokenizer;false;reset;;;Argument;ReturnValue;taint",
-        "org.apache.commons.text;StringTokenizer;false;reset;;;Argument;Argument[-1];taint",
+        "org.apache.commons.text;StringTokenizer;false;reset;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.text;StringTokenizer;false;reset;;;Argument[0];Argument[-1];taint",
         "org.apache.commons.text;StringTokenizer;false;next;;;Argument[-1];ReturnValue;taint",
         "org.apache.commons.text;StringTokenizer;false;getContent;;;Argument[-1];ReturnValue;taint",
         "org.apache.commons.text;StringTokenizer;false;previous;;;Argument[-1];ReturnValue;taint",
@@ -297,8 +511,8 @@ private class ApacheStrTokenizerModel extends SummaryModelCsv {
         "org.apache.commons.text;StringTokenizer;false;getTokenArray;;;Argument[-1];ReturnValue;taint",
         "org.apache.commons.text;StringTokenizer;false;previousToken;;;Argument[-1];ReturnValue;taint",
         "org.apache.commons.text;StringTokenizer;false;nextToken;;;Argument[-1];ReturnValue;taint",
-        "org.apache.commons.text;StringTokenizer;false;getTSVInstance;;;Argument;ReturnValue;taint",
-        "org.apache.commons.text;StringTokenizer;false;getCSVInstance;;;Argument;ReturnValue;taint"
+        "org.apache.commons.text;StringTokenizer;false;getTSVInstance;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.text;StringTokenizer;false;getCSVInstance;;;Argument[0];ReturnValue;taint"
       ]
   }
 }
@@ -311,9 +525,9 @@ private class ApacheStrLookupModel extends SummaryModelCsv {
     row =
       [
         "org.apache.commons.lang3.text;StrLookup;false;lookup;;;Argument[-1];ReturnValue;taint",
-        "org.apache.commons.lang3.text;StrLookup;false;mapLookup;;;Argument;ReturnValue;taint",
+        "org.apache.commons.lang3.text;StrLookup;false;mapLookup;;;Argument[0];ReturnValue;taint",
         "org.apache.commons.text.lookup;StringLookup;true;lookup;;;Argument[-1];ReturnValue;taint",
-        "org.apache.commons.text.lookup;StringLookupFactory;false;mapStringLookup;;;Argument;ReturnValue;taint"
+        "org.apache.commons.text.lookup;StringLookupFactory;false;mapStringLookup;;;Argument[0];ReturnValue;taint"
       ]
   }
 }
@@ -325,53 +539,53 @@ private class ApacheStrSubstitutorModel extends SummaryModelCsv {
   override predicate row(string row) {
     row =
       [
-        "org.apache.commons.lang3.text;StrSubstitutor;false;StrSubstitutor;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3.text;StrSubstitutor;false;StrSubstitutor;;;Argument[0];Argument[-1];taint",
         "org.apache.commons.lang3.text;StrSubstitutor;false;replace;;;Argument[-1];ReturnValue;taint",
-        "org.apache.commons.lang3.text;StrSubstitutor;false;replace;(java.lang.Object);;Argument;ReturnValue;taint",
-        "org.apache.commons.lang3.text;StrSubstitutor;false;replace;(char[]);;Argument;ReturnValue;taint",
+        "org.apache.commons.lang3.text;StrSubstitutor;false;replace;(java.lang.Object);;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3.text;StrSubstitutor;false;replace;(char[]);;Argument[0];ReturnValue;taint",
         "org.apache.commons.lang3.text;StrSubstitutor;false;replace;(char[],int,int);;Argument[0];ReturnValue;taint",
-        "org.apache.commons.lang3.text;StrSubstitutor;false;replace;(java.lang.CharSequence);;Argument;ReturnValue;taint",
+        "org.apache.commons.lang3.text;StrSubstitutor;false;replace;(java.lang.CharSequence);;Argument[0];ReturnValue;taint",
         "org.apache.commons.lang3.text;StrSubstitutor;false;replace;(java.lang.CharSequence,int,int);;Argument[0];ReturnValue;taint",
-        "org.apache.commons.lang3.text;StrSubstitutor;false;replace;(java.lang.String);;Argument;ReturnValue;taint",
-        "org.apache.commons.lang3.text;StrSubstitutor;false;replace;(org.apache.commons.lang3.text.StrBuilder);;Argument;ReturnValue;taint",
-        "org.apache.commons.lang3.text;StrSubstitutor;false;replace;(java.lang.StringBuffer);;Argument;ReturnValue;taint",
+        "org.apache.commons.lang3.text;StrSubstitutor;false;replace;(java.lang.String);;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3.text;StrSubstitutor;false;replace;(org.apache.commons.lang3.text.StrBuilder);;Argument[0];ReturnValue;taint",
+        "org.apache.commons.lang3.text;StrSubstitutor;false;replace;(java.lang.StringBuffer);;Argument[0];ReturnValue;taint",
         "org.apache.commons.lang3.text;StrSubstitutor;false;replace;(java.lang.StringBuffer,int,int);;Argument[0];ReturnValue;taint",
         "org.apache.commons.lang3.text;StrSubstitutor;false;replace;(java.lang.String,int,int);;Argument[0];ReturnValue;taint",
         "org.apache.commons.lang3.text;StrSubstitutor;false;replace;(org.apache.commons.lang3.text.StrBuilder,int,int);;Argument[0];ReturnValue;taint",
-        "org.apache.commons.lang3.text;StrSubstitutor;false;replace;(java.lang.Object,java.util.Map);;Argument;ReturnValue;taint",
+        "org.apache.commons.lang3.text;StrSubstitutor;false;replace;(java.lang.Object,java.util.Map);;Argument[0..1];ReturnValue;taint",
         "org.apache.commons.lang3.text;StrSubstitutor;false;replace;(java.lang.Object,java.util.Map,java.lang.String,java.lang.String);;Argument[0];ReturnValue;taint",
         "org.apache.commons.lang3.text;StrSubstitutor;false;replace;(java.lang.Object,java.util.Map,java.lang.String,java.lang.String);;Argument[1];ReturnValue;taint",
-        "org.apache.commons.lang3.text;StrSubstitutor;false;replace;(java.lang.Object,java.util.Properties);;Argument;ReturnValue;taint",
-        "org.apache.commons.lang3.text;StrSubstitutor;false;setVariableResolver;;;Argument;Argument[-1];taint",
-        "org.apache.commons.lang3.text;StrSubstitutor;false;replaceIn;(org.apache.commons.lang3.text.StrBuilder);;Argument[-1];Argument;taint",
-        "org.apache.commons.lang3.text;StrSubstitutor;false;replaceIn;(java.lang.StringBuffer);;Argument[-1];Argument;taint",
+        "org.apache.commons.lang3.text;StrSubstitutor;false;replace;(java.lang.Object,java.util.Properties);;Argument[0..1];ReturnValue;taint",
+        "org.apache.commons.lang3.text;StrSubstitutor;false;setVariableResolver;;;Argument[0];Argument[-1];taint",
+        "org.apache.commons.lang3.text;StrSubstitutor;false;replaceIn;(org.apache.commons.lang3.text.StrBuilder);;Argument[-1];Argument[0];taint",
+        "org.apache.commons.lang3.text;StrSubstitutor;false;replaceIn;(java.lang.StringBuffer);;Argument[-1];Argument[0];taint",
         "org.apache.commons.lang3.text;StrSubstitutor;false;replaceIn;(java.lang.StringBuffer,int,int);;Argument[-1];Argument[0];taint",
-        "org.apache.commons.lang3.text;StrSubstitutor;false;replaceIn;(java.lang.StringBuilder);;Argument[-1];Argument;taint",
+        "org.apache.commons.lang3.text;StrSubstitutor;false;replaceIn;(java.lang.StringBuilder);;Argument[-1];Argument[0];taint",
         "org.apache.commons.lang3.text;StrSubstitutor;false;replaceIn;(java.lang.StringBuilder,int,int);;Argument[-1];Argument[0];taint",
         "org.apache.commons.lang3.text;StrSubstitutor;false;replaceIn;(org.apache.commons.lang3.text.StrBuilder,int,int);;Argument[-1];Argument[0];taint",
-        "org.apache.commons.text;StringSubstitutor;false;StringSubstitutor;;;Argument[0];ReturnValue;taint",
+        "org.apache.commons.text;StringSubstitutor;false;StringSubstitutor;;;Argument[0];Argument[-1];taint",
         "org.apache.commons.text;StringSubstitutor;false;replace;;;Argument[-1];ReturnValue;taint",
-        "org.apache.commons.text;StringSubstitutor;false;replace;(java.lang.Object);;Argument;ReturnValue;taint",
-        "org.apache.commons.text;StringSubstitutor;false;replace;(char[]);;Argument;ReturnValue;taint",
+        "org.apache.commons.text;StringSubstitutor;false;replace;(java.lang.Object);;Argument[0];ReturnValue;taint",
+        "org.apache.commons.text;StringSubstitutor;false;replace;(char[]);;Argument[0];ReturnValue;taint",
         "org.apache.commons.text;StringSubstitutor;false;replace;(char[],int,int);;Argument[0];ReturnValue;taint",
-        "org.apache.commons.text;StringSubstitutor;false;replace;(java.lang.CharSequence);;Argument;ReturnValue;taint",
+        "org.apache.commons.text;StringSubstitutor;false;replace;(java.lang.CharSequence);;Argument[0];ReturnValue;taint",
         "org.apache.commons.text;StringSubstitutor;false;replace;(java.lang.CharSequence,int,int);;Argument[0];ReturnValue;taint",
-        "org.apache.commons.text;StringSubstitutor;false;replace;(java.lang.String);;Argument;ReturnValue;taint",
-        "org.apache.commons.text;StringSubstitutor;false;replace;(java.lang.StringBuffer);;Argument;ReturnValue;taint",
+        "org.apache.commons.text;StringSubstitutor;false;replace;(java.lang.String);;Argument[0];ReturnValue;taint",
+        "org.apache.commons.text;StringSubstitutor;false;replace;(java.lang.StringBuffer);;Argument[0];ReturnValue;taint",
         "org.apache.commons.text;StringSubstitutor;false;replace;(java.lang.StringBuffer,int,int);;Argument[0];ReturnValue;taint",
         "org.apache.commons.text;StringSubstitutor;false;replace;(java.lang.String,int,int);;Argument[0];ReturnValue;taint",
-        "org.apache.commons.text;StringSubstitutor;false;replace;(java.lang.Object,java.util.Map);;Argument;ReturnValue;taint",
+        "org.apache.commons.text;StringSubstitutor;false;replace;(java.lang.Object,java.util.Map);;Argument[0..1];ReturnValue;taint",
         "org.apache.commons.text;StringSubstitutor;false;replace;(java.lang.Object,java.util.Map,java.lang.String,java.lang.String);;Argument[0];ReturnValue;taint",
         "org.apache.commons.text;StringSubstitutor;false;replace;(java.lang.Object,java.util.Map,java.lang.String,java.lang.String);;Argument[1];ReturnValue;taint",
-        "org.apache.commons.text;StringSubstitutor;false;replace;(java.lang.Object,java.util.Properties);;Argument;ReturnValue;taint",
-        "org.apache.commons.text;StringSubstitutor;false;replace;(org.apache.commons.text.TextStringBuilder);;Argument;ReturnValue;taint",
+        "org.apache.commons.text;StringSubstitutor;false;replace;(java.lang.Object,java.util.Properties);;Argument[0..1];ReturnValue;taint",
+        "org.apache.commons.text;StringSubstitutor;false;replace;(org.apache.commons.text.TextStringBuilder);;Argument[0];ReturnValue;taint",
         "org.apache.commons.text;StringSubstitutor;false;replace;(org.apache.commons.text.TextStringBuilder,int,int);;Argument[0];ReturnValue;taint",
-        "org.apache.commons.text;StringSubstitutor;false;setVariableResolver;;;Argument;Argument[-1];taint",
-        "org.apache.commons.text;StringSubstitutor;false;replaceIn;(java.lang.StringBuffer);;Argument[-1];Argument;taint",
+        "org.apache.commons.text;StringSubstitutor;false;setVariableResolver;;;Argument[0];Argument[-1];taint",
+        "org.apache.commons.text;StringSubstitutor;false;replaceIn;(java.lang.StringBuffer);;Argument[-1];Argument[0];taint",
         "org.apache.commons.text;StringSubstitutor;false;replaceIn;(java.lang.StringBuffer,int,int);;Argument[-1];Argument[0];taint",
-        "org.apache.commons.text;StringSubstitutor;false;replaceIn;(java.lang.StringBuilder);;Argument[-1];Argument;taint",
+        "org.apache.commons.text;StringSubstitutor;false;replaceIn;(java.lang.StringBuilder);;Argument[-1];Argument[0];taint",
         "org.apache.commons.text;StringSubstitutor;false;replaceIn;(java.lang.StringBuilder,int,int);;Argument[-1];Argument[0];taint",
-        "org.apache.commons.text;StringSubstitutor;false;replaceIn;(org.apache.commons.text.TextStringBuilder);;Argument[-1];Argument;taint",
+        "org.apache.commons.text;StringSubstitutor;false;replaceIn;(org.apache.commons.text.TextStringBuilder);;Argument[-1];Argument[0];taint",
         "org.apache.commons.text;StringSubstitutor;false;replaceIn;(org.apache.commons.text.TextStringBuilder,int,int);;Argument[-1];Argument[0];taint"
       ]
   }
@@ -406,18 +620,18 @@ private class ApacheObjectUtilsModel extends SummaryModelCsv {
       [
         // Note all the functions annotated with `taint` flow really should have `value` flow,
         // but we don't support value-preserving varargs functions at the moment.
-        "org.apache.commons.lang3;ObjectUtils;false;clone;;;Argument;ReturnValue;value",
-        "org.apache.commons.lang3;ObjectUtils;false;cloneIfPossible;;;Argument;ReturnValue;value",
-        "org.apache.commons.lang3;ObjectUtils;false;CONST;;;Argument;ReturnValue;value",
-        "org.apache.commons.lang3;ObjectUtils;false;CONST_BYTE;;;Argument;ReturnValue;value",
-        "org.apache.commons.lang3;ObjectUtils;false;CONST_SHORT;;;Argument;ReturnValue;value",
-        "org.apache.commons.lang3;ObjectUtils;false;defaultIfNull;;;Argument;ReturnValue;value",
-        "org.apache.commons.lang3;ObjectUtils;false;firstNonNull;;;Argument;ReturnValue;taint",
+        "org.apache.commons.lang3;ObjectUtils;false;clone;;;Argument[0];ReturnValue;value",
+        "org.apache.commons.lang3;ObjectUtils;false;cloneIfPossible;;;Argument[0];ReturnValue;value",
+        "org.apache.commons.lang3;ObjectUtils;false;CONST;;;Argument[0];ReturnValue;value",
+        "org.apache.commons.lang3;ObjectUtils;false;CONST_BYTE;;;Argument[0];ReturnValue;value",
+        "org.apache.commons.lang3;ObjectUtils;false;CONST_SHORT;;;Argument[0];ReturnValue;value",
+        "org.apache.commons.lang3;ObjectUtils;false;defaultIfNull;;;Argument[0..1];ReturnValue;value",
+        "org.apache.commons.lang3;ObjectUtils;false;firstNonNull;;;ArrayElement of Argument[0];ReturnValue;value",
         "org.apache.commons.lang3;ObjectUtils;false;getIfNull;;;Argument[0];ReturnValue;value",
-        "org.apache.commons.lang3;ObjectUtils;false;max;;;Argument;ReturnValue;taint",
-        "org.apache.commons.lang3;ObjectUtils;false;median;;;Argument;ReturnValue;taint",
-        "org.apache.commons.lang3;ObjectUtils;false;min;;;Argument;ReturnValue;taint",
-        "org.apache.commons.lang3;ObjectUtils;false;mode;;;Argument;ReturnValue;taint",
+        "org.apache.commons.lang3;ObjectUtils;false;max;;;ArrayElement of Argument[0];ReturnValue;value",
+        "org.apache.commons.lang3;ObjectUtils;false;median;;;ArrayElement of Argument[0];ReturnValue;value",
+        "org.apache.commons.lang3;ObjectUtils;false;min;;;ArrayElement of Argument[0];ReturnValue;value",
+        "org.apache.commons.lang3;ObjectUtils;false;mode;;;ArrayElement of Argument[0];ReturnValue;value",
         "org.apache.commons.lang3;ObjectUtils;false;requireNonEmpty;;;Argument[0];ReturnValue;value",
         "org.apache.commons.lang3;ObjectUtils;false;toString;(Object,String);;Argument[1];ReturnValue;value"
       ]
diff --git a/java/ql/src/semmle/code/java/frameworks/guava/Base.qll b/java/ql/src/semmle/code/java/frameworks/guava/Base.qll
index ebcfe35a6b9..194d723caf5 100644
--- a/java/ql/src/semmle/code/java/frameworks/guava/Base.qll
+++ b/java/ql/src/semmle/code/java/frameworks/guava/Base.qll
@@ -13,7 +13,8 @@ private class GuavaBaseCsv extends SummaryModelCsv {
         "com.google.common.base;Strings;false;padStart;(String,int,char);;Argument[0];ReturnValue;taint",
         "com.google.common.base;Strings;false;padEnd;(String,int,char);;Argument[0];ReturnValue;taint",
         "com.google.common.base;Strings;false;repeat;(String,int);;Argument[0];ReturnValue;taint",
-        "com.google.common.base;Strings;false;lenientFormat;(String,Object[]);;Argument;ReturnValue;taint",
+        "com.google.common.base;Strings;false;lenientFormat;(String,Object[]);;Argument[0];ReturnValue;taint",
+        "com.google.common.base;Strings;false;lenientFormat;(String,Object[]);;ArrayElement of Argument[1];ReturnValue;taint",
         "com.google.common.base;Joiner;false;on;(String);;Argument[0];ReturnValue;taint",
         "com.google.common.base;Joiner;false;skipNulls;();;Argument[-1];ReturnValue;taint",
         "com.google.common.base;Joiner;false;useForNull;(String);;Argument[-1];ReturnValue;taint",
@@ -22,14 +23,14 @@ private class GuavaBaseCsv extends SummaryModelCsv {
         "com.google.common.base;Joiner;false;withKeyValueSeparator;(String);;Argument[-1];ReturnValue;taint",
         "com.google.common.base;Joiner;false;withKeyValueSeparator;(char);;Argument[-1];ReturnValue;taint",
         // Note: The signatures of some of the appendTo methods involve collection flow
-        "com.google.common.base;Joiner;false;appendTo;;;Argument;Argument[0];taint",
+        "com.google.common.base;Joiner;false;appendTo;;;Argument[-1..3];Argument[0];taint",
         "com.google.common.base;Joiner;false;appendTo;;;Argument[0];ReturnValue;value",
-        "com.google.common.base;Joiner;false;join;;;Argument;ReturnValue;taint",
+        "com.google.common.base;Joiner;false;join;;;Argument[-1..2];ReturnValue;taint",
         "com.google.common.base;Joiner$MapJoiner;false;useForNull;(String);;Argument[0];ReturnValue;taint",
         "com.google.common.base;Joiner$MapJoiner;false;useForNull;(String);;Argument[-1];ReturnValue;taint",
-        "com.google.common.base;Joiner$MapJoiner;false;appendTo;;;Argument;Argument[0];taint",
+        "com.google.common.base;Joiner$MapJoiner;false;appendTo;;;Argument[1];Argument[0];taint",
         "com.google.common.base;Joiner$MapJoiner;false;appendTo;;;Argument[0];ReturnValue;value",
-        "com.google.common.base;Joiner$MapJoiner;false;join;;;Argument;ReturnValue;taint",
+        "com.google.common.base;Joiner$MapJoiner;false;join;;;Argument[-1..0];ReturnValue;taint",
         "com.google.common.base;Splitter;false;split;(CharSequence);;Argument[0];ReturnValue;taint",
         "com.google.common.base;Splitter;false;splitToList;(CharSequence);;Argument[0];ReturnValue;taint",
         "com.google.common.base;Splitter;false;splitToStream;(CharSequence);;Argument[0];ReturnValue;taint",
diff --git a/java/ql/src/semmle/code/java/frameworks/guava/IO.qll b/java/ql/src/semmle/code/java/frameworks/guava/IO.qll
index 2a4a0342808..fac9ab9d48d 100644
--- a/java/ql/src/semmle/code/java/frameworks/guava/IO.qll
+++ b/java/ql/src/semmle/code/java/frameworks/guava/IO.qll
@@ -61,7 +61,7 @@ private class GuavaIoCsv extends SummaryModelCsv {
         "com.google.common.io;Files;false;simplifyPath;(String);;Argument[0];ReturnValue;taint",
         "com.google.common.io;MoreFiles;false;getFileExtension;(Path);;Argument[0];ReturnValue;taint",
         "com.google.common.io;MoreFiles;false;getNameWithoutExtension;(Path);;Argument[0];ReturnValue;taint",
-        "com.google.common.io;LineReader;false;LineReader;(Readable);;Argument[0];ReturnValue;taint",
+        "com.google.common.io;LineReader;false;LineReader;(Readable);;Argument[0];Argument[-1];taint",
         "com.google.common.io;LineReader;true;readLine;();;Argument[-1];ReturnValue;taint",
         "com.google.common.io;ByteArrayDataOutput;true;toByteArray;();;Argument[-1];ReturnValue;taint",
         "com.google.common.io;ByteArrayDataOutput;true;write;(byte[]);;Argument[0];Argument[-1];taint",
diff --git a/java/ql/src/semmle/code/java/frameworks/play/Play.qll b/java/ql/src/semmle/code/java/frameworks/play/Play.qll
index 0498ba9317c..96c45cb2244 100644
--- a/java/ql/src/semmle/code/java/frameworks/play/Play.qll
+++ b/java/ql/src/semmle/code/java/frameworks/play/Play.qll
@@ -44,14 +44,8 @@ class PlayAddCsrfTokenAnnotation extends Annotation {
 /**
  * The type `play.libs.F.Promise<Result>`.
  */
-class PlayAsyncResultPromise extends Member {
-  PlayAsyncResultPromise() {
-    exists(Class c |
-      c.hasQualifiedName("play.libs", "F") and
-      this = c.getAMember() and
-      this.getQualifiedName() = "F.Promise<Result>"
-    )
-  }
+class PlayAsyncResultPromise extends MemberType {
+  PlayAsyncResultPromise() { hasQualifiedName("play.libs", "F$Promise<Result>") }
 }
 
 /**
diff --git a/java/ql/src/semmle/code/java/security/ControlledString.qll b/java/ql/src/semmle/code/java/security/ControlledString.qll
index c9f036b0ea6..3779c2c1009 100644
--- a/java/ql/src/semmle/code/java/security/ControlledString.qll
+++ b/java/ql/src/semmle/code/java/security/ControlledString.qll
@@ -8,7 +8,8 @@ import semmle.code.java.Expr
 import semmle.code.java.security.Validation
 
 /**
- * Holds if `method` is a `toString()` method on a boxed type. These never return special characters.
+ * Holds if `method` is a `toString()` method on a boxed type, with or without parameters.
+ * These never return special characters.
  */
 private predicate boxedToString(Method method) {
   method.getDeclaringType() instanceof BoxedType and
@@ -44,11 +45,9 @@ private predicate controlledStringProp(Expr src, Expr dest) {
   exists(AddExpr concatOp | concatOp = dest | src = concatOp.getAnOperand())
   or
   // `toString()` on a safe string is safe.
-  exists(MethodAccess toStringCall, Method toString |
+  exists(MethodAccess toStringCall |
     src = toStringCall.getQualifier() and
-    toString = toStringCall.getMethod() and
-    toString.hasName("toString") and
-    toString.getNumberOfParameters() = 0 and
+    toStringCall.getMethod() instanceof ToStringMethod and
     dest = toStringCall
   )
 }
diff --git a/java/ql/test/experimental/query-tests/security/CWE-016/InsecureSpringActuatorConfig.expected b/java/ql/test/experimental/query-tests/security/CWE-016/InsecureSpringActuatorConfig.expected
new file mode 100644
index 00000000000..48630293985
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-016/InsecureSpringActuatorConfig.expected
@@ -0,0 +1 @@
+| pom.xml:29:9:32:22 | dependency | Insecure configuration of Spring Boot Actuator exposes sensitive endpoints. |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-016/InsecureSpringActuatorConfig.qlref b/java/ql/test/experimental/query-tests/security/CWE-016/InsecureSpringActuatorConfig.qlref
new file mode 100644
index 00000000000..9cd12d5e4fb
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-016/InsecureSpringActuatorConfig.qlref
@@ -0,0 +1 @@
+experimental/Security/CWE/CWE-016/InsecureSpringActuatorConfig.ql
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-016/SensitiveInfo.java b/java/ql/test/experimental/query-tests/security/CWE-016/SensitiveInfo.java
new file mode 100644
index 00000000000..a3ff69c1b81
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-016/SensitiveInfo.java
@@ -0,0 +1,13 @@
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RequestMapping;
+
+@Controller
+public class SensitiveInfo {
+	@RequestMapping
+	public void handleLogin(@RequestParam String username, @RequestParam String password) throws Exception {
+		if (!username.equals("") && password.equals("")) {
+			//Blank processing
+		}
+	}
+}
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-016/application.properties b/java/ql/test/experimental/query-tests/security/CWE-016/application.properties
new file mode 100644
index 00000000000..797906a3ca3
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-016/application.properties
@@ -0,0 +1,14 @@
+#management.endpoints.web.base-path=/admin
+
+# vulnerable configuration (spring boot 1.0 - 1.4): exposes actuators by default
+
+# vulnerable configuration (spring boot 1.5+): requires value false to expose sensitive actuators
+management.security.enabled=false
+
+# vulnerable configuration (spring boot 2+): exposes health and info only by default, here overridden to expose everything
+management.endpoints.web.exposure.include=*
+management.endpoints.web.exposure.exclude=beans
+
+management.endpoint.shutdown.enabled=true
+
+management.endpoint.health.show-details=when_authorized
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-016/pom.xml b/java/ql/test/experimental/query-tests/security/CWE-016/pom.xml
new file mode 100644
index 00000000000..a9d5fa920c8
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-016/pom.xml
@@ -0,0 +1,47 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+
+    <groupId>spring-boot-actuator-app</groupId>
+    <artifactId>spring-boot-actuator-app</artifactId>
+    <version>1.0-SNAPSHOT</version>
+
+    <properties>
+        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+        <maven.compiler.source>1.8</maven.compiler.source>
+        <maven.compiler.target>1.8</maven.compiler.target>
+    </properties>
+
+    <parent>
+        <groupId>org.springframework.boot</groupId>
+        <artifactId>spring-boot-starter-parent</artifactId>
+        <version>2.3.8.RELEASE</version>
+        <relativePath/>
+    </parent>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-web</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-actuator</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-devtools</artifactId>
+        </dependency>
+        <!-- dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-security</artifactId>
+        </dependency -->
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-test</artifactId>
+        </dependency>
+    </dependencies>
+
+</project>
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-074/XsltInjection.expected b/java/ql/test/experimental/query-tests/security/CWE-074/XsltInjection.expected
index ece3ed7d17f..680252d4d37 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-074/XsltInjection.expected
+++ b/java/ql/test/experimental/query-tests/security/CWE-074/XsltInjection.expected
@@ -1,48 +1,81 @@
 edges
-| XsltInjection.java:30:44:30:66 | getInputStream(...) : InputStream | XsltInjection.java:31:5:31:59 | newTransformer(...) |
-| XsltInjection.java:35:66:35:88 | getInputStream(...) : InputStream | XsltInjection.java:36:5:36:74 | newTransformer(...) |
-| XsltInjection.java:40:45:40:70 | param : String | XsltInjection.java:43:5:43:59 | newTransformer(...) |
-| XsltInjection.java:47:54:47:76 | getInputStream(...) : InputStream | XsltInjection.java:48:5:48:74 | newTransformer(...) |
-| XsltInjection.java:52:82:52:104 | getInputStream(...) : InputStream | XsltInjection.java:53:5:53:59 | newTransformer(...) |
+| XsltInjection.java:30:27:30:67 | new StreamSource(...) : StreamSource | XsltInjection.java:31:5:31:59 | newTransformer(...) |
+| XsltInjection.java:30:44:30:66 | getInputStream(...) : InputStream | XsltInjection.java:30:27:30:67 | new StreamSource(...) : StreamSource |
+| XsltInjection.java:35:27:35:90 | new StreamSource(...) : StreamSource | XsltInjection.java:36:5:36:74 | newTransformer(...) |
+| XsltInjection.java:35:44:35:89 | new InputStreamReader(...) : InputStreamReader | XsltInjection.java:35:27:35:90 | new StreamSource(...) : StreamSource |
+| XsltInjection.java:35:66:35:88 | getInputStream(...) : InputStream | XsltInjection.java:35:44:35:89 | new InputStreamReader(...) : InputStreamReader |
+| XsltInjection.java:40:45:40:70 | param : String | XsltInjection.java:42:61:42:64 | xslt : String |
+| XsltInjection.java:42:27:42:66 | new StreamSource(...) : StreamSource | XsltInjection.java:43:5:43:59 | newTransformer(...) |
+| XsltInjection.java:42:44:42:65 | new StringReader(...) : StringReader | XsltInjection.java:42:27:42:66 | new StreamSource(...) : StreamSource |
+| XsltInjection.java:42:61:42:64 | xslt : String | XsltInjection.java:42:44:42:65 | new StringReader(...) : StringReader |
+| XsltInjection.java:47:24:47:78 | new SAXSource(...) : SAXSource | XsltInjection.java:48:5:48:74 | newTransformer(...) |
+| XsltInjection.java:47:38:47:77 | new InputSource(...) : InputSource | XsltInjection.java:47:24:47:78 | new SAXSource(...) : SAXSource |
+| XsltInjection.java:47:54:47:76 | getInputStream(...) : InputStream | XsltInjection.java:47:38:47:77 | new InputSource(...) : InputSource |
+| XsltInjection.java:52:24:52:107 | new SAXSource(...) : SAXSource | XsltInjection.java:53:5:53:59 | newTransformer(...) |
+| XsltInjection.java:52:44:52:106 | new InputSource(...) : InputSource | XsltInjection.java:52:24:52:107 | new SAXSource(...) : SAXSource |
+| XsltInjection.java:52:60:52:105 | new InputStreamReader(...) : InputStreamReader | XsltInjection.java:52:44:52:106 | new InputSource(...) : InputSource |
+| XsltInjection.java:52:82:52:104 | getInputStream(...) : InputStream | XsltInjection.java:52:60:52:105 | new InputStreamReader(...) : InputStreamReader |
 | XsltInjection.java:57:91:57:113 | getInputStream(...) : InputStream | XsltInjection.java:58:5:58:59 | newTransformer(...) |
-| XsltInjection.java:62:120:62:142 | getInputStream(...) : InputStream | XsltInjection.java:63:5:63:74 | newTransformer(...) |
+| XsltInjection.java:62:98:62:143 | new InputStreamReader(...) : InputStreamReader | XsltInjection.java:63:5:63:74 | newTransformer(...) |
+| XsltInjection.java:62:120:62:142 | getInputStream(...) : InputStream | XsltInjection.java:62:98:62:143 | new InputStreamReader(...) : InputStreamReader |
 | XsltInjection.java:67:102:67:124 | getInputStream(...) : InputStream | XsltInjection.java:68:5:68:59 | newTransformer(...) |
-| XsltInjection.java:72:44:72:66 | getInputStream(...) : InputStream | XsltInjection.java:76:5:76:34 | newTransformer(...) |
-| XsltInjection.java:80:44:80:66 | getInputStream(...) : InputStream | XsltInjection.java:83:5:83:34 | newTransformer(...) |
-| XsltInjection.java:87:44:87:66 | getInputStream(...) : InputStream | XsltInjection.java:90:5:90:35 | load(...) |
-| XsltInjection.java:87:44:87:66 | getInputStream(...) : InputStream | XsltInjection.java:91:5:91:37 | load30(...) |
-| XsltInjection.java:87:44:87:66 | getInputStream(...) : InputStream | XsltInjection.java:92:5:92:37 | load30(...) |
-| XsltInjection.java:87:44:87:66 | getInputStream(...) : InputStream | XsltInjection.java:93:5:93:37 | load30(...) |
-| XsltInjection.java:87:44:87:66 | getInputStream(...) : InputStream | XsltInjection.java:94:5:94:37 | load30(...) |
-| XsltInjection.java:87:44:87:66 | getInputStream(...) : InputStream | XsltInjection.java:95:5:95:37 | load30(...) |
-| XsltInjection.java:87:44:87:66 | getInputStream(...) : InputStream | XsltInjection.java:96:5:96:37 | load30(...) |
-| XsltInjection.java:87:44:87:66 | getInputStream(...) : InputStream | XsltInjection.java:97:5:97:37 | load30(...) |
-| XsltInjection.java:87:44:87:66 | getInputStream(...) : InputStream | XsltInjection.java:98:5:98:37 | load30(...) |
-| XsltInjection.java:87:44:87:66 | getInputStream(...) : InputStream | XsltInjection.java:99:5:99:37 | load30(...) |
-| XsltInjection.java:103:36:103:61 | param : String | XsltInjection.java:108:5:108:46 | load(...) |
-| XsltInjection.java:103:36:103:61 | param : String | XsltInjection.java:110:5:110:50 | load(...) |
-| XsltInjection.java:105:44:105:66 | getInputStream(...) : InputStream | XsltInjection.java:109:5:109:49 | load(...) |
+| XsltInjection.java:72:27:72:67 | new StreamSource(...) : StreamSource | XsltInjection.java:76:5:76:34 | newTransformer(...) |
+| XsltInjection.java:72:44:72:66 | getInputStream(...) : InputStream | XsltInjection.java:72:27:72:67 | new StreamSource(...) : StreamSource |
+| XsltInjection.java:80:27:80:67 | new StreamSource(...) : StreamSource | XsltInjection.java:83:5:83:34 | newTransformer(...) |
+| XsltInjection.java:80:44:80:66 | getInputStream(...) : InputStream | XsltInjection.java:80:27:80:67 | new StreamSource(...) : StreamSource |
+| XsltInjection.java:87:27:87:67 | new StreamSource(...) : StreamSource | XsltInjection.java:90:5:90:35 | load(...) |
+| XsltInjection.java:87:27:87:67 | new StreamSource(...) : StreamSource | XsltInjection.java:91:5:91:37 | load30(...) |
+| XsltInjection.java:87:27:87:67 | new StreamSource(...) : StreamSource | XsltInjection.java:92:5:92:37 | load30(...) |
+| XsltInjection.java:87:27:87:67 | new StreamSource(...) : StreamSource | XsltInjection.java:93:5:93:37 | load30(...) |
+| XsltInjection.java:87:27:87:67 | new StreamSource(...) : StreamSource | XsltInjection.java:94:5:94:37 | load30(...) |
+| XsltInjection.java:87:27:87:67 | new StreamSource(...) : StreamSource | XsltInjection.java:95:5:95:37 | load30(...) |
+| XsltInjection.java:87:27:87:67 | new StreamSource(...) : StreamSource | XsltInjection.java:96:5:96:37 | load30(...) |
+| XsltInjection.java:87:27:87:67 | new StreamSource(...) : StreamSource | XsltInjection.java:97:5:97:37 | load30(...) |
+| XsltInjection.java:87:27:87:67 | new StreamSource(...) : StreamSource | XsltInjection.java:98:5:98:37 | load30(...) |
+| XsltInjection.java:87:27:87:67 | new StreamSource(...) : StreamSource | XsltInjection.java:99:5:99:37 | load30(...) |
+| XsltInjection.java:87:44:87:66 | getInputStream(...) : InputStream | XsltInjection.java:87:27:87:67 | new StreamSource(...) : StreamSource |
+| XsltInjection.java:103:36:103:61 | param : String | XsltInjection.java:104:23:104:27 | param : String |
+| XsltInjection.java:104:15:104:28 | new URI(...) : URI | XsltInjection.java:108:5:108:46 | load(...) |
+| XsltInjection.java:104:15:104:28 | new URI(...) : URI | XsltInjection.java:110:5:110:50 | load(...) |
+| XsltInjection.java:104:23:104:27 | param : String | XsltInjection.java:104:15:104:28 | new URI(...) : URI |
+| XsltInjection.java:105:27:105:67 | new StreamSource(...) : StreamSource | XsltInjection.java:109:5:109:49 | load(...) |
+| XsltInjection.java:105:44:105:66 | getInputStream(...) : InputStream | XsltInjection.java:105:27:105:67 | new StreamSource(...) : StreamSource |
 nodes
+| XsltInjection.java:30:27:30:67 | new StreamSource(...) : StreamSource | semmle.label | new StreamSource(...) : StreamSource |
 | XsltInjection.java:30:44:30:66 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | XsltInjection.java:31:5:31:59 | newTransformer(...) | semmle.label | newTransformer(...) |
+| XsltInjection.java:35:27:35:90 | new StreamSource(...) : StreamSource | semmle.label | new StreamSource(...) : StreamSource |
+| XsltInjection.java:35:44:35:89 | new InputStreamReader(...) : InputStreamReader | semmle.label | new InputStreamReader(...) : InputStreamReader |
 | XsltInjection.java:35:66:35:88 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | XsltInjection.java:36:5:36:74 | newTransformer(...) | semmle.label | newTransformer(...) |
 | XsltInjection.java:40:45:40:70 | param : String | semmle.label | param : String |
+| XsltInjection.java:42:27:42:66 | new StreamSource(...) : StreamSource | semmle.label | new StreamSource(...) : StreamSource |
+| XsltInjection.java:42:44:42:65 | new StringReader(...) : StringReader | semmle.label | new StringReader(...) : StringReader |
+| XsltInjection.java:42:61:42:64 | xslt : String | semmle.label | xslt : String |
 | XsltInjection.java:43:5:43:59 | newTransformer(...) | semmle.label | newTransformer(...) |
+| XsltInjection.java:47:24:47:78 | new SAXSource(...) : SAXSource | semmle.label | new SAXSource(...) : SAXSource |
+| XsltInjection.java:47:38:47:77 | new InputSource(...) : InputSource | semmle.label | new InputSource(...) : InputSource |
 | XsltInjection.java:47:54:47:76 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | XsltInjection.java:48:5:48:74 | newTransformer(...) | semmle.label | newTransformer(...) |
+| XsltInjection.java:52:24:52:107 | new SAXSource(...) : SAXSource | semmle.label | new SAXSource(...) : SAXSource |
+| XsltInjection.java:52:44:52:106 | new InputSource(...) : InputSource | semmle.label | new InputSource(...) : InputSource |
+| XsltInjection.java:52:60:52:105 | new InputStreamReader(...) : InputStreamReader | semmle.label | new InputStreamReader(...) : InputStreamReader |
 | XsltInjection.java:52:82:52:104 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | XsltInjection.java:53:5:53:59 | newTransformer(...) | semmle.label | newTransformer(...) |
 | XsltInjection.java:57:91:57:113 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | XsltInjection.java:58:5:58:59 | newTransformer(...) | semmle.label | newTransformer(...) |
+| XsltInjection.java:62:98:62:143 | new InputStreamReader(...) : InputStreamReader | semmle.label | new InputStreamReader(...) : InputStreamReader |
 | XsltInjection.java:62:120:62:142 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | XsltInjection.java:63:5:63:74 | newTransformer(...) | semmle.label | newTransformer(...) |
 | XsltInjection.java:67:102:67:124 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | XsltInjection.java:68:5:68:59 | newTransformer(...) | semmle.label | newTransformer(...) |
+| XsltInjection.java:72:27:72:67 | new StreamSource(...) : StreamSource | semmle.label | new StreamSource(...) : StreamSource |
 | XsltInjection.java:72:44:72:66 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | XsltInjection.java:76:5:76:34 | newTransformer(...) | semmle.label | newTransformer(...) |
+| XsltInjection.java:80:27:80:67 | new StreamSource(...) : StreamSource | semmle.label | new StreamSource(...) : StreamSource |
 | XsltInjection.java:80:44:80:66 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | XsltInjection.java:83:5:83:34 | newTransformer(...) | semmle.label | newTransformer(...) |
+| XsltInjection.java:87:27:87:67 | new StreamSource(...) : StreamSource | semmle.label | new StreamSource(...) : StreamSource |
 | XsltInjection.java:87:44:87:66 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | XsltInjection.java:90:5:90:35 | load(...) | semmle.label | load(...) |
 | XsltInjection.java:91:5:91:37 | load30(...) | semmle.label | load30(...) |
@@ -55,6 +88,9 @@ nodes
 | XsltInjection.java:98:5:98:37 | load30(...) | semmle.label | load30(...) |
 | XsltInjection.java:99:5:99:37 | load30(...) | semmle.label | load30(...) |
 | XsltInjection.java:103:36:103:61 | param : String | semmle.label | param : String |
+| XsltInjection.java:104:15:104:28 | new URI(...) : URI | semmle.label | new URI(...) : URI |
+| XsltInjection.java:104:23:104:27 | param : String | semmle.label | param : String |
+| XsltInjection.java:105:27:105:67 | new StreamSource(...) : StreamSource | semmle.label | new StreamSource(...) : StreamSource |
 | XsltInjection.java:105:44:105:66 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | XsltInjection.java:108:5:108:46 | load(...) | semmle.label | load(...) |
 | XsltInjection.java:109:5:109:49 | load(...) | semmle.label | load(...) |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-094/GroovyClassLoaderTest.java b/java/ql/test/experimental/query-tests/security/CWE-094/GroovyClassLoaderTest.java
new file mode 100644
index 00000000000..6e3ccab34fd
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-094/GroovyClassLoaderTest.java
@@ -0,0 +1,39 @@
+import groovy.lang.GroovyClassLoader;
+import groovy.lang.GroovyCodeSource;
+import groovy.lang.GroovyObject;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+
+public class GroovyClassLoaderTest extends HttpServlet {
+
+    protected void doGet(HttpServletRequest request, HttpServletResponse response)
+            throws ServletException, IOException {
+        try {
+            String script = request.getParameter("script");
+            final GroovyClassLoader classLoader = new GroovyClassLoader();
+            Class groovy = classLoader.parseClass(script);
+            GroovyObject groovyObj = (GroovyObject) groovy.newInstance();
+
+        } catch (Exception e) {
+            // Ignore
+        }
+    }
+
+    protected void doPost(HttpServletRequest request, HttpServletResponse response)
+            throws ServletException, IOException {
+        try {
+            String script = request.getParameter("script");
+            final GroovyClassLoader classLoader = new GroovyClassLoader();
+            GroovyCodeSource gcs = new GroovyCodeSource(script, "test", "Test");
+            Class groovy = classLoader.parseClass(gcs);
+            GroovyObject groovyObj = (GroovyObject) groovy.newInstance();
+        } catch (Exception e) {
+            // Ignore
+        }
+    }
+}
+
diff --git a/java/ql/test/experimental/query-tests/security/CWE-094/GroovyEvalTest.java b/java/ql/test/experimental/query-tests/security/CWE-094/GroovyEvalTest.java
new file mode 100644
index 00000000000..ff76af2d3fd
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-094/GroovyEvalTest.java
@@ -0,0 +1,41 @@
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+import groovy.util.Eval;
+
+public class GroovyEvalTest extends HttpServlet {
+
+    protected void doGet(HttpServletRequest request, HttpServletResponse response)
+            throws ServletException, IOException {
+        String script = request.getParameter("script");
+        Eval.me(script);
+    }
+
+    protected void doPost(HttpServletRequest request, HttpServletResponse response)
+            throws ServletException, IOException {
+        String script = request.getParameter("script");
+        Eval.me("test", "result", script);
+    }
+
+    protected void doPut(HttpServletRequest request, HttpServletResponse response)
+            throws ServletException, IOException {
+        String script = request.getParameter("script");
+        Eval.x("result2", script);
+
+    }
+
+    protected void doDelete(HttpServletRequest request, HttpServletResponse response)
+            throws ServletException, IOException {
+        String script = request.getParameter("script");
+        Eval.xy("result3", "result4", script);
+    }
+
+    protected void doPatch(HttpServletRequest request, HttpServletResponse response)
+            throws ServletException, IOException {
+        String script = request.getParameter("script");
+        Eval.xyz("result3", "result4", "aaa", script);
+    }
+}
+
diff --git a/java/ql/test/experimental/query-tests/security/CWE-094/GroovyInjection.expected b/java/ql/test/experimental/query-tests/security/CWE-094/GroovyInjection.expected
new file mode 100644
index 00000000000..12593ae32c5
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-094/GroovyInjection.expected
@@ -0,0 +1,73 @@
+edges
+| ../../../stubs/groovy-all-3.0.7/groovy/util/Eval.java:22:29:22:51 | expression : String | ../../../stubs/groovy-all-3.0.7/groovy/util/Eval.java:23:31:23:40 | expression |
+| ../../../stubs/groovy-all-3.0.7/groovy/util/Eval.java:30:44:30:66 | expression : String | ../../../stubs/groovy-all-3.0.7/groovy/util/Eval.java:31:27:31:36 | expression |
+| GroovyClassLoaderTest.java:16:29:16:58 | getParameter(...) : String | GroovyClassLoaderTest.java:18:51:18:56 | script |
+| GroovyClassLoaderTest.java:29:29:29:58 | getParameter(...) : String | GroovyClassLoaderTest.java:32:51:32:53 | gcs |
+| GroovyEvalTest.java:12:25:12:54 | getParameter(...) : String | GroovyEvalTest.java:13:17:13:22 | script |
+| GroovyEvalTest.java:12:25:12:54 | getParameter(...) : String | GroovyEvalTest.java:13:17:13:22 | script : String |
+| GroovyEvalTest.java:13:17:13:22 | script : String | ../../../stubs/groovy-all-3.0.7/groovy/util/Eval.java:22:29:22:51 | expression : String |
+| GroovyEvalTest.java:18:25:18:54 | getParameter(...) : String | GroovyEvalTest.java:19:35:19:40 | script |
+| GroovyEvalTest.java:24:25:24:54 | getParameter(...) : String | GroovyEvalTest.java:25:27:25:32 | script |
+| GroovyEvalTest.java:24:25:24:54 | getParameter(...) : String | GroovyEvalTest.java:25:27:25:32 | script : String |
+| GroovyEvalTest.java:25:27:25:32 | script : String | ../../../stubs/groovy-all-3.0.7/groovy/util/Eval.java:30:44:30:66 | expression : String |
+| GroovyEvalTest.java:31:25:31:54 | getParameter(...) : String | GroovyEvalTest.java:32:39:32:44 | script |
+| GroovyEvalTest.java:37:25:37:54 | getParameter(...) : String | GroovyEvalTest.java:38:47:38:52 | script |
+| GroovyShellTest.java:15:25:15:54 | getParameter(...) : String | GroovyShellTest.java:16:24:16:29 | script |
+| GroovyShellTest.java:22:25:22:54 | getParameter(...) : String | GroovyShellTest.java:23:24:23:29 | script |
+| GroovyShellTest.java:29:25:29:54 | getParameter(...) : String | GroovyShellTest.java:30:24:30:29 | script |
+| GroovyShellTest.java:36:25:36:54 | getParameter(...) : String | GroovyShellTest.java:37:19:37:24 | script |
+| GroovyShellTest.java:43:25:43:54 | getParameter(...) : String | GroovyShellTest.java:45:19:45:21 | gcs |
+| GroovyShellTest.java:51:25:51:54 | getParameter(...) : String | GroovyShellTest.java:53:24:53:26 | gcs |
+| GroovyShellTest.java:59:25:59:54 | getParameter(...) : String | GroovyShellTest.java:60:21:60:26 | script |
+nodes
+| ../../../stubs/groovy-all-3.0.7/groovy/util/Eval.java:22:29:22:51 | expression : String | semmle.label | expression : String |
+| ../../../stubs/groovy-all-3.0.7/groovy/util/Eval.java:23:31:23:40 | expression | semmle.label | expression |
+| ../../../stubs/groovy-all-3.0.7/groovy/util/Eval.java:30:44:30:66 | expression : String | semmle.label | expression : String |
+| ../../../stubs/groovy-all-3.0.7/groovy/util/Eval.java:31:27:31:36 | expression | semmle.label | expression |
+| GroovyClassLoaderTest.java:16:29:16:58 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| GroovyClassLoaderTest.java:18:51:18:56 | script | semmle.label | script |
+| GroovyClassLoaderTest.java:29:29:29:58 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| GroovyClassLoaderTest.java:32:51:32:53 | gcs | semmle.label | gcs |
+| GroovyEvalTest.java:12:25:12:54 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| GroovyEvalTest.java:13:17:13:22 | script | semmle.label | script |
+| GroovyEvalTest.java:13:17:13:22 | script : String | semmle.label | script : String |
+| GroovyEvalTest.java:18:25:18:54 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| GroovyEvalTest.java:19:35:19:40 | script | semmle.label | script |
+| GroovyEvalTest.java:24:25:24:54 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| GroovyEvalTest.java:25:27:25:32 | script | semmle.label | script |
+| GroovyEvalTest.java:25:27:25:32 | script : String | semmle.label | script : String |
+| GroovyEvalTest.java:31:25:31:54 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| GroovyEvalTest.java:32:39:32:44 | script | semmle.label | script |
+| GroovyEvalTest.java:37:25:37:54 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| GroovyEvalTest.java:38:47:38:52 | script | semmle.label | script |
+| GroovyShellTest.java:15:25:15:54 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| GroovyShellTest.java:16:24:16:29 | script | semmle.label | script |
+| GroovyShellTest.java:22:25:22:54 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| GroovyShellTest.java:23:24:23:29 | script | semmle.label | script |
+| GroovyShellTest.java:29:25:29:54 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| GroovyShellTest.java:30:24:30:29 | script | semmle.label | script |
+| GroovyShellTest.java:36:25:36:54 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| GroovyShellTest.java:37:19:37:24 | script | semmle.label | script |
+| GroovyShellTest.java:43:25:43:54 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| GroovyShellTest.java:45:19:45:21 | gcs | semmle.label | gcs |
+| GroovyShellTest.java:51:25:51:54 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| GroovyShellTest.java:53:24:53:26 | gcs | semmle.label | gcs |
+| GroovyShellTest.java:59:25:59:54 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| GroovyShellTest.java:60:21:60:26 | script | semmle.label | script |
+#select
+| ../../../stubs/groovy-all-3.0.7/groovy/util/Eval.java:23:31:23:40 | expression | GroovyEvalTest.java:12:25:12:54 | getParameter(...) : String | ../../../stubs/groovy-all-3.0.7/groovy/util/Eval.java:23:31:23:40 | expression | Groovy Injection from $@. | GroovyEvalTest.java:12:25:12:54 | getParameter(...) | this user input |
+| ../../../stubs/groovy-all-3.0.7/groovy/util/Eval.java:31:27:31:36 | expression | GroovyEvalTest.java:24:25:24:54 | getParameter(...) : String | ../../../stubs/groovy-all-3.0.7/groovy/util/Eval.java:31:27:31:36 | expression | Groovy Injection from $@. | GroovyEvalTest.java:24:25:24:54 | getParameter(...) | this user input |
+| GroovyClassLoaderTest.java:18:51:18:56 | script | GroovyClassLoaderTest.java:16:29:16:58 | getParameter(...) : String | GroovyClassLoaderTest.java:18:51:18:56 | script | Groovy Injection from $@. | GroovyClassLoaderTest.java:16:29:16:58 | getParameter(...) | this user input |
+| GroovyClassLoaderTest.java:32:51:32:53 | gcs | GroovyClassLoaderTest.java:29:29:29:58 | getParameter(...) : String | GroovyClassLoaderTest.java:32:51:32:53 | gcs | Groovy Injection from $@. | GroovyClassLoaderTest.java:29:29:29:58 | getParameter(...) | this user input |
+| GroovyEvalTest.java:13:17:13:22 | script | GroovyEvalTest.java:12:25:12:54 | getParameter(...) : String | GroovyEvalTest.java:13:17:13:22 | script | Groovy Injection from $@. | GroovyEvalTest.java:12:25:12:54 | getParameter(...) | this user input |
+| GroovyEvalTest.java:19:35:19:40 | script | GroovyEvalTest.java:18:25:18:54 | getParameter(...) : String | GroovyEvalTest.java:19:35:19:40 | script | Groovy Injection from $@. | GroovyEvalTest.java:18:25:18:54 | getParameter(...) | this user input |
+| GroovyEvalTest.java:25:27:25:32 | script | GroovyEvalTest.java:24:25:24:54 | getParameter(...) : String | GroovyEvalTest.java:25:27:25:32 | script | Groovy Injection from $@. | GroovyEvalTest.java:24:25:24:54 | getParameter(...) | this user input |
+| GroovyEvalTest.java:32:39:32:44 | script | GroovyEvalTest.java:31:25:31:54 | getParameter(...) : String | GroovyEvalTest.java:32:39:32:44 | script | Groovy Injection from $@. | GroovyEvalTest.java:31:25:31:54 | getParameter(...) | this user input |
+| GroovyEvalTest.java:38:47:38:52 | script | GroovyEvalTest.java:37:25:37:54 | getParameter(...) : String | GroovyEvalTest.java:38:47:38:52 | script | Groovy Injection from $@. | GroovyEvalTest.java:37:25:37:54 | getParameter(...) | this user input |
+| GroovyShellTest.java:16:24:16:29 | script | GroovyShellTest.java:15:25:15:54 | getParameter(...) : String | GroovyShellTest.java:16:24:16:29 | script | Groovy Injection from $@. | GroovyShellTest.java:15:25:15:54 | getParameter(...) | this user input |
+| GroovyShellTest.java:23:24:23:29 | script | GroovyShellTest.java:22:25:22:54 | getParameter(...) : String | GroovyShellTest.java:23:24:23:29 | script | Groovy Injection from $@. | GroovyShellTest.java:22:25:22:54 | getParameter(...) | this user input |
+| GroovyShellTest.java:30:24:30:29 | script | GroovyShellTest.java:29:25:29:54 | getParameter(...) : String | GroovyShellTest.java:30:24:30:29 | script | Groovy Injection from $@. | GroovyShellTest.java:29:25:29:54 | getParameter(...) | this user input |
+| GroovyShellTest.java:37:19:37:24 | script | GroovyShellTest.java:36:25:36:54 | getParameter(...) : String | GroovyShellTest.java:37:19:37:24 | script | Groovy Injection from $@. | GroovyShellTest.java:36:25:36:54 | getParameter(...) | this user input |
+| GroovyShellTest.java:45:19:45:21 | gcs | GroovyShellTest.java:43:25:43:54 | getParameter(...) : String | GroovyShellTest.java:45:19:45:21 | gcs | Groovy Injection from $@. | GroovyShellTest.java:43:25:43:54 | getParameter(...) | this user input |
+| GroovyShellTest.java:53:24:53:26 | gcs | GroovyShellTest.java:51:25:51:54 | getParameter(...) : String | GroovyShellTest.java:53:24:53:26 | gcs | Groovy Injection from $@. | GroovyShellTest.java:51:25:51:54 | getParameter(...) | this user input |
+| GroovyShellTest.java:60:21:60:26 | script | GroovyShellTest.java:59:25:59:54 | getParameter(...) : String | GroovyShellTest.java:60:21:60:26 | script | Groovy Injection from $@. | GroovyShellTest.java:59:25:59:54 | getParameter(...) | this user input |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-094/GroovyInjection.qlref b/java/ql/test/experimental/query-tests/security/CWE-094/GroovyInjection.qlref
new file mode 100644
index 00000000000..0ec7e1bc543
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-094/GroovyInjection.qlref
@@ -0,0 +1 @@
+experimental/Security/CWE/CWE-094/GroovyInjection.ql
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-094/GroovyShellTest.java b/java/ql/test/experimental/query-tests/security/CWE-094/GroovyShellTest.java
new file mode 100644
index 00000000000..541aaf40250
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-094/GroovyShellTest.java
@@ -0,0 +1,63 @@
+import groovy.lang.GroovyCodeSource;
+import groovy.lang.GroovyShell;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+
+public class GroovyShellTest extends HttpServlet {
+
+    protected void doGet(HttpServletRequest request, HttpServletResponse response)
+            throws ServletException, IOException {
+        GroovyShell shell = new GroovyShell();
+        String script = request.getParameter("script");
+        shell.evaluate(script);
+    }
+
+    protected void doPost(HttpServletRequest request, HttpServletResponse response)
+            throws ServletException, IOException {
+        GroovyShell shell = new GroovyShell();
+        String script = request.getParameter("script");
+        shell.evaluate(script, "test");
+    }
+
+    protected void doPut(HttpServletRequest request, HttpServletResponse response)
+            throws ServletException, IOException {
+        GroovyShell shell = new GroovyShell();
+        String script = request.getParameter("script");
+        shell.evaluate(script, "test", "test2");
+    }
+
+    protected void doOptions(HttpServletRequest request, HttpServletResponse response)
+            throws ServletException, IOException {
+        GroovyShell shell = new GroovyShell();
+        String script = request.getParameter("script");
+        shell.run(script, "_", new String[]{});
+    }
+
+    protected void doHead(HttpServletRequest request, HttpServletResponse response)
+            throws ServletException, IOException {
+        GroovyShell shell = new GroovyShell();
+        String script = request.getParameter("script");
+        GroovyCodeSource gcs = new GroovyCodeSource(script, "test", "Test");
+        shell.run(gcs, new String[]{});
+    }
+
+    protected void doDelete(HttpServletRequest request, HttpServletResponse response)
+            throws ServletException, IOException {
+        GroovyShell shell = new GroovyShell();
+        String script = request.getParameter("script");
+        GroovyCodeSource gcs = new GroovyCodeSource(script, "test", "Test");
+        shell.evaluate(gcs);
+    }
+
+    protected void doPatch(HttpServletRequest request, HttpServletResponse response)
+            throws ServletException, IOException {
+        GroovyShell shell = new GroovyShell();
+        String script = request.getParameter("script");
+        shell.parse(script);
+    }
+}
+
diff --git a/java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.expected b/java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.expected
new file mode 100644
index 00000000000..b4f4e1f696b
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.expected
@@ -0,0 +1,48 @@
+edges
+| JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:23:54:23:58 | bytes [post update] : byte[] |
+| JakartaExpressionInjection.java:23:54:23:58 | bytes [post update] : byte[] | JakartaExpressionInjection.java:25:31:25:40 | expression : String |
+| JakartaExpressionInjection.java:25:31:25:40 | expression : String | JakartaExpressionInjection.java:32:24:32:33 | expression : String |
+| JakartaExpressionInjection.java:25:31:25:40 | expression : String | JakartaExpressionInjection.java:40:24:40:33 | expression : String |
+| JakartaExpressionInjection.java:25:31:25:40 | expression : String | JakartaExpressionInjection.java:48:24:48:33 | expression : String |
+| JakartaExpressionInjection.java:25:31:25:40 | expression : String | JakartaExpressionInjection.java:59:24:59:33 | expression : String |
+| JakartaExpressionInjection.java:25:31:25:40 | expression : String | JakartaExpressionInjection.java:67:24:67:33 | expression : String |
+| JakartaExpressionInjection.java:25:31:25:40 | expression : String | JakartaExpressionInjection.java:75:24:75:33 | expression : String |
+| JakartaExpressionInjection.java:25:31:25:40 | expression : String | JakartaExpressionInjection.java:85:24:85:33 | expression : String |
+| JakartaExpressionInjection.java:25:31:25:40 | expression : String | JakartaExpressionInjection.java:95:24:95:33 | expression : String |
+| JakartaExpressionInjection.java:32:24:32:33 | expression : String | JakartaExpressionInjection.java:34:28:34:37 | expression |
+| JakartaExpressionInjection.java:40:24:40:33 | expression : String | JakartaExpressionInjection.java:42:32:42:41 | expression |
+| JakartaExpressionInjection.java:48:24:48:33 | expression : String | JakartaExpressionInjection.java:53:13:53:28 | lambdaExpression |
+| JakartaExpressionInjection.java:59:24:59:33 | expression : String | JakartaExpressionInjection.java:61:32:61:41 | expression |
+| JakartaExpressionInjection.java:67:24:67:33 | expression : String | JakartaExpressionInjection.java:69:43:69:52 | expression |
+| JakartaExpressionInjection.java:75:24:75:33 | expression : String | JakartaExpressionInjection.java:79:13:79:13 | e |
+| JakartaExpressionInjection.java:85:24:85:33 | expression : String | JakartaExpressionInjection.java:89:13:89:13 | e |
+| JakartaExpressionInjection.java:95:24:95:33 | expression : String | JakartaExpressionInjection.java:99:13:99:13 | e |
+nodes
+| JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| JakartaExpressionInjection.java:23:54:23:58 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
+| JakartaExpressionInjection.java:25:31:25:40 | expression : String | semmle.label | expression : String |
+| JakartaExpressionInjection.java:32:24:32:33 | expression : String | semmle.label | expression : String |
+| JakartaExpressionInjection.java:34:28:34:37 | expression | semmle.label | expression |
+| JakartaExpressionInjection.java:40:24:40:33 | expression : String | semmle.label | expression : String |
+| JakartaExpressionInjection.java:42:32:42:41 | expression | semmle.label | expression |
+| JakartaExpressionInjection.java:48:24:48:33 | expression : String | semmle.label | expression : String |
+| JakartaExpressionInjection.java:53:13:53:28 | lambdaExpression | semmle.label | lambdaExpression |
+| JakartaExpressionInjection.java:59:24:59:33 | expression : String | semmle.label | expression : String |
+| JakartaExpressionInjection.java:61:32:61:41 | expression | semmle.label | expression |
+| JakartaExpressionInjection.java:67:24:67:33 | expression : String | semmle.label | expression : String |
+| JakartaExpressionInjection.java:69:43:69:52 | expression | semmle.label | expression |
+| JakartaExpressionInjection.java:75:24:75:33 | expression : String | semmle.label | expression : String |
+| JakartaExpressionInjection.java:79:13:79:13 | e | semmle.label | e |
+| JakartaExpressionInjection.java:85:24:85:33 | expression : String | semmle.label | expression : String |
+| JakartaExpressionInjection.java:89:13:89:13 | e | semmle.label | e |
+| JakartaExpressionInjection.java:95:24:95:33 | expression : String | semmle.label | expression : String |
+| JakartaExpressionInjection.java:99:13:99:13 | e | semmle.label | e |
+#select
+| JakartaExpressionInjection.java:34:28:34:37 | expression | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:34:28:34:37 | expression | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) | this user input |
+| JakartaExpressionInjection.java:42:32:42:41 | expression | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:42:32:42:41 | expression | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) | this user input |
+| JakartaExpressionInjection.java:53:13:53:28 | lambdaExpression | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:53:13:53:28 | lambdaExpression | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) | this user input |
+| JakartaExpressionInjection.java:61:32:61:41 | expression | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:61:32:61:41 | expression | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) | this user input |
+| JakartaExpressionInjection.java:69:43:69:52 | expression | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:69:43:69:52 | expression | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) | this user input |
+| JakartaExpressionInjection.java:79:13:79:13 | e | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:79:13:79:13 | e | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) | this user input |
+| JakartaExpressionInjection.java:89:13:89:13 | e | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:89:13:89:13 | e | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) | this user input |
+| JakartaExpressionInjection.java:99:13:99:13 | e | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:99:13:99:13 | e | Jakarta Expression Language injection from $@. | JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) | this user input |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.java b/java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.java
new file mode 100644
index 00000000000..ae5b6a8d5e4
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.java
@@ -0,0 +1,103 @@
+import java.io.IOException;
+import java.net.ServerSocket;
+import java.net.Socket;
+import java.util.ArrayList;
+import java.util.function.Consumer;
+
+import javax.el.ELContext;
+import javax.el.ELManager;
+import javax.el.ELProcessor;
+import javax.el.ExpressionFactory;
+import javax.el.LambdaExpression;
+import javax.el.MethodExpression;
+import javax.el.StandardELContext;
+import javax.el.ValueExpression;
+
+public class JakartaExpressionInjection {
+    
+    // calls a consumer with a string received from a socket
+    private static void testWithSocket(Consumer<String> action) throws IOException {
+        try (ServerSocket serverSocket = new ServerSocket(0)) {
+            try (Socket socket = serverSocket.accept()) {
+                byte[] bytes = new byte[1024];
+                int n = socket.getInputStream().read(bytes);
+                String expression = new String(bytes, 0, n);
+                action.accept(expression);
+            }
+        }
+    }
+
+    // BAD (untrusted input to ELProcessor.eval)
+    private static void testWithELProcessorEval() throws IOException {
+        testWithSocket(expression -> {
+            ELProcessor processor = new ELProcessor();
+            processor.eval(expression);
+        });
+    }
+
+    // BAD (untrusted input to ELProcessor.getValue)
+    private static void testWithELProcessorGetValue() throws IOException {
+        testWithSocket(expression -> {   
+            ELProcessor processor = new ELProcessor();
+            processor.getValue(expression, Object.class);
+        });
+    }
+
+    // BAD (untrusted input to LambdaExpression.invoke)
+    private static void testWithLambdaExpressionInvoke() throws IOException {
+        testWithSocket(expression -> {
+            ExpressionFactory factory = ELManager.getExpressionFactory();
+            StandardELContext context = new StandardELContext(factory);
+            ValueExpression valueExpression = factory.createValueExpression(context, expression, Object.class);
+            LambdaExpression lambdaExpression = new LambdaExpression(new ArrayList<>(), valueExpression);
+            lambdaExpression.invoke(context, new Object[0]);
+        });
+    }
+
+    // BAD (untrusted input to ELProcessor.setValue)
+    private static void testWithELProcessorSetValue() throws IOException {
+        testWithSocket(expression -> {
+            ELProcessor processor = new ELProcessor();
+            processor.setValue(expression, new Object());
+        });
+    }
+
+    // BAD (untrusted input to ELProcessor.setVariable)
+    private static void testWithELProcessorSetVariable() throws IOException {
+        testWithSocket(expression -> {
+            ELProcessor processor = new ELProcessor();
+            processor.setVariable("test", expression);
+        });
+    }
+
+    // BAD (untrusted input to ValueExpression.getValue when it was created by JUEL)
+    private static void testWithJuelValueExpressionGetValue() throws IOException {
+        testWithSocket(expression -> {
+            ExpressionFactory factory = new de.odysseus.el.ExpressionFactoryImpl();
+            ELContext context = new de.odysseus.el.util.SimpleContext();
+            ValueExpression e = factory.createValueExpression(context, expression, Object.class);
+            e.getValue(context);
+        });
+    }
+
+    // BAD (untrusted input to ValueExpression.setValue when it was created by JUEL)
+    private static void testWithJuelValueExpressionSetValue() throws IOException {
+        testWithSocket(expression -> {
+            ExpressionFactory factory = new de.odysseus.el.ExpressionFactoryImpl();
+            ELContext context = new de.odysseus.el.util.SimpleContext();
+            ValueExpression e = factory.createValueExpression(context, expression, Object.class);
+            e.setValue(context, new Object());
+        });
+    }
+
+    // BAD (untrusted input to MethodExpression.invoke when it was created by JUEL)
+    private static void testWithJuelMethodExpressionInvoke() throws IOException {
+        testWithSocket(expression -> {
+            ExpressionFactory factory = new de.odysseus.el.ExpressionFactoryImpl();
+            ELContext context = new de.odysseus.el.util.SimpleContext();
+            MethodExpression e = factory.createMethodExpression(context, expression, Object.class, new Class[0]);
+            e.invoke(context, new Object[0]);
+        });
+    }
+
+}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.qlref b/java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.qlref
new file mode 100644
index 00000000000..3154ee5ccad
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.qlref
@@ -0,0 +1 @@
+experimental/Security/CWE/CWE-094/JakartaExpressionInjection.ql
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-094/JexlInjection.expected b/java/ql/test/experimental/query-tests/security/CWE-094/JexlInjection.expected
index 8140928cf21..f42f083578e 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-094/JexlInjection.expected
+++ b/java/ql/test/experimental/query-tests/security/CWE-094/JexlInjection.expected
@@ -8,7 +8,8 @@ edges
 | Jexl2Injection.java:54:73:54:87 | jexlExpr : String | Jexl2Injection.java:57:9:57:35 | parse(...) |
 | Jexl2Injection.java:60:72:60:86 | jexlExpr : String | Jexl2Injection.java:63:9:63:35 | parse(...) |
 | Jexl2Injection.java:66:73:66:87 | jexlExpr : String | Jexl2Injection.java:69:9:69:44 | createTemplate(...) |
-| Jexl2Injection.java:76:25:76:47 | getInputStream(...) : InputStream | Jexl2Injection.java:78:31:78:38 | jexlExpr : String |
+| Jexl2Injection.java:76:25:76:47 | getInputStream(...) : InputStream | Jexl2Injection.java:76:54:76:58 | bytes [post update] : byte[] |
+| Jexl2Injection.java:76:54:76:58 | bytes [post update] : byte[] | Jexl2Injection.java:78:31:78:38 | jexlExpr : String |
 | Jexl2Injection.java:78:31:78:38 | jexlExpr : String | Jexl2Injection.java:86:24:86:56 | jexlExpr : String |
 | Jexl2Injection.java:78:31:78:38 | jexlExpr : String | Jexl2Injection.java:90:24:90:68 | jexlExpr : String |
 | Jexl2Injection.java:78:31:78:38 | jexlExpr : String | Jexl2Injection.java:94:24:94:52 | jexlExpr : String |
@@ -46,7 +47,8 @@ edges
 | Jexl3Injection.java:66:73:66:87 | jexlExpr : String | Jexl3Injection.java:69:9:69:39 | createExpression(...) |
 | Jexl3Injection.java:72:72:72:86 | jexlExpr : String | Jexl3Injection.java:75:9:75:37 | createTemplate(...) |
 | Jexl3Injection.java:78:54:78:68 | jexlExpr : String | Jexl3Injection.java:84:13:84:13 | e |
-| Jexl3Injection.java:94:25:94:47 | getInputStream(...) : InputStream | Jexl3Injection.java:96:31:96:38 | jexlExpr : String |
+| Jexl3Injection.java:94:25:94:47 | getInputStream(...) : InputStream | Jexl3Injection.java:94:54:94:58 | bytes [post update] : byte[] |
+| Jexl3Injection.java:94:54:94:58 | bytes [post update] : byte[] | Jexl3Injection.java:96:31:96:38 | jexlExpr : String |
 | Jexl3Injection.java:96:31:96:38 | jexlExpr : String | Jexl3Injection.java:104:24:104:56 | jexlExpr : String |
 | Jexl3Injection.java:96:31:96:38 | jexlExpr : String | Jexl3Injection.java:108:24:108:68 | jexlExpr : String |
 | Jexl3Injection.java:96:31:96:38 | jexlExpr : String | Jexl3Injection.java:112:24:112:52 | jexlExpr : String |
@@ -103,6 +105,7 @@ nodes
 | Jexl2Injection.java:66:73:66:87 | jexlExpr : String | semmle.label | jexlExpr : String |
 | Jexl2Injection.java:69:9:69:44 | createTemplate(...) | semmle.label | createTemplate(...) |
 | Jexl2Injection.java:76:25:76:47 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| Jexl2Injection.java:76:54:76:58 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
 | Jexl2Injection.java:78:31:78:38 | jexlExpr : String | semmle.label | jexlExpr : String |
 | Jexl2Injection.java:86:24:86:56 | jexlExpr : String | semmle.label | jexlExpr : String |
 | Jexl2Injection.java:86:24:86:56 | jexlExpr : String | semmle.label | jexlExpr : String |
@@ -143,6 +146,7 @@ nodes
 | Jexl3Injection.java:78:54:78:68 | jexlExpr : String | semmle.label | jexlExpr : String |
 | Jexl3Injection.java:84:13:84:13 | e | semmle.label | e |
 | Jexl3Injection.java:94:25:94:47 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| Jexl3Injection.java:94:54:94:58 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
 | Jexl3Injection.java:96:31:96:38 | jexlExpr : String | semmle.label | jexlExpr : String |
 | Jexl3Injection.java:104:24:104:56 | jexlExpr : String | semmle.label | jexlExpr : String |
 | Jexl3Injection.java:104:24:104:56 | jexlExpr : String | semmle.label | jexlExpr : String |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-094/MvelInjection.expected b/java/ql/test/experimental/query-tests/security/CWE-094/MvelInjection.expected
index b2325fa78a4..545da956f8e 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-094/MvelInjection.expected
+++ b/java/ql/test/experimental/query-tests/security/CWE-094/MvelInjection.expected
@@ -10,7 +10,9 @@ edges
 | MvelInjection.java:77:40:77:51 | read(...) : String | MvelInjection.java:77:7:77:52 | compileTemplate(...) |
 | MvelInjection.java:81:54:81:65 | read(...) : String | MvelInjection.java:82:29:82:46 | compile(...) |
 | MvelInjection.java:86:58:86:69 | read(...) : String | MvelInjection.java:88:32:88:41 | expression |
-| MvelInjection.java:92:27:92:49 | getInputStream(...) : InputStream | MvelInjection.java:95:14:95:36 | new String(...) : String |
+| MvelInjection.java:92:27:92:49 | getInputStream(...) : InputStream | MvelInjection.java:94:15:94:16 | is : InputStream |
+| MvelInjection.java:94:15:94:16 | is : InputStream | MvelInjection.java:94:23:94:27 | bytes [post update] : byte[] |
+| MvelInjection.java:94:23:94:27 | bytes [post update] : byte[] | MvelInjection.java:95:14:95:36 | new String(...) : String |
 | MvelInjection.java:95:14:95:36 | new String(...) : String | MvelInjection.java:25:15:25:26 | read(...) |
 | MvelInjection.java:95:14:95:36 | new String(...) : String | MvelInjection.java:29:54:29:65 | read(...) : String |
 | MvelInjection.java:95:14:95:36 | new String(...) : String | MvelInjection.java:34:58:34:69 | read(...) : String |
@@ -46,6 +48,8 @@ nodes
 | MvelInjection.java:86:58:86:69 | read(...) : String | semmle.label | read(...) : String |
 | MvelInjection.java:88:32:88:41 | expression | semmle.label | expression |
 | MvelInjection.java:92:27:92:49 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| MvelInjection.java:94:15:94:16 | is : InputStream | semmle.label | is : InputStream |
+| MvelInjection.java:94:23:94:27 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
 | MvelInjection.java:95:14:95:36 | new String(...) : String | semmle.label | new String(...) : String |
 #select
 | MvelInjection.java:25:15:25:26 | read(...) | MvelInjection.java:92:27:92:49 | getInputStream(...) : InputStream | MvelInjection.java:25:15:25:26 | read(...) | MVEL injection from $@. | MvelInjection.java:92:27:92:49 | getInputStream(...) | this user input |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-094/SpelInjection.expected b/java/ql/test/experimental/query-tests/security/CWE-094/SpelInjection.expected
index 263d6be6c32..83d1725237a 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-094/SpelInjection.expected
+++ b/java/ql/test/experimental/query-tests/security/CWE-094/SpelInjection.expected
@@ -1,22 +1,46 @@
 edges
-| SpelInjection.java:15:22:15:44 | getInputStream(...) : InputStream | SpelInjection.java:23:5:23:14 | expression |
-| SpelInjection.java:27:22:27:44 | getInputStream(...) : InputStream | SpelInjection.java:34:5:34:14 | expression |
-| SpelInjection.java:38:22:38:44 | getInputStream(...) : InputStream | SpelInjection.java:48:5:48:14 | expression |
-| SpelInjection.java:52:22:52:44 | getInputStream(...) : InputStream | SpelInjection.java:59:5:59:14 | expression |
-| SpelInjection.java:63:22:63:44 | getInputStream(...) : InputStream | SpelInjection.java:70:5:70:14 | expression |
-| SpelInjection.java:74:22:74:44 | getInputStream(...) : InputStream | SpelInjection.java:83:5:83:14 | expression |
+| SpelInjection.java:15:22:15:44 | getInputStream(...) : InputStream | SpelInjection.java:18:13:18:14 | in : InputStream |
+| SpelInjection.java:18:13:18:14 | in : InputStream | SpelInjection.java:18:21:18:25 | bytes [post update] : byte[] |
+| SpelInjection.java:18:21:18:25 | bytes [post update] : byte[] | SpelInjection.java:23:5:23:14 | expression |
+| SpelInjection.java:27:22:27:44 | getInputStream(...) : InputStream | SpelInjection.java:30:13:30:14 | in : InputStream |
+| SpelInjection.java:30:13:30:14 | in : InputStream | SpelInjection.java:30:21:30:25 | bytes [post update] : byte[] |
+| SpelInjection.java:30:21:30:25 | bytes [post update] : byte[] | SpelInjection.java:34:5:34:14 | expression |
+| SpelInjection.java:38:22:38:44 | getInputStream(...) : InputStream | SpelInjection.java:41:13:41:14 | in : InputStream |
+| SpelInjection.java:41:13:41:14 | in : InputStream | SpelInjection.java:41:21:41:25 | bytes [post update] : byte[] |
+| SpelInjection.java:41:21:41:25 | bytes [post update] : byte[] | SpelInjection.java:48:5:48:14 | expression |
+| SpelInjection.java:52:22:52:44 | getInputStream(...) : InputStream | SpelInjection.java:55:13:55:14 | in : InputStream |
+| SpelInjection.java:55:13:55:14 | in : InputStream | SpelInjection.java:55:21:55:25 | bytes [post update] : byte[] |
+| SpelInjection.java:55:21:55:25 | bytes [post update] : byte[] | SpelInjection.java:59:5:59:14 | expression |
+| SpelInjection.java:63:22:63:44 | getInputStream(...) : InputStream | SpelInjection.java:66:13:66:14 | in : InputStream |
+| SpelInjection.java:66:13:66:14 | in : InputStream | SpelInjection.java:66:21:66:25 | bytes [post update] : byte[] |
+| SpelInjection.java:66:21:66:25 | bytes [post update] : byte[] | SpelInjection.java:70:5:70:14 | expression |
+| SpelInjection.java:74:22:74:44 | getInputStream(...) : InputStream | SpelInjection.java:77:13:77:14 | in : InputStream |
+| SpelInjection.java:77:13:77:14 | in : InputStream | SpelInjection.java:77:21:77:25 | bytes [post update] : byte[] |
+| SpelInjection.java:77:21:77:25 | bytes [post update] : byte[] | SpelInjection.java:83:5:83:14 | expression |
 nodes
 | SpelInjection.java:15:22:15:44 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| SpelInjection.java:18:13:18:14 | in : InputStream | semmle.label | in : InputStream |
+| SpelInjection.java:18:21:18:25 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
 | SpelInjection.java:23:5:23:14 | expression | semmle.label | expression |
 | SpelInjection.java:27:22:27:44 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| SpelInjection.java:30:13:30:14 | in : InputStream | semmle.label | in : InputStream |
+| SpelInjection.java:30:21:30:25 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
 | SpelInjection.java:34:5:34:14 | expression | semmle.label | expression |
 | SpelInjection.java:38:22:38:44 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| SpelInjection.java:41:13:41:14 | in : InputStream | semmle.label | in : InputStream |
+| SpelInjection.java:41:21:41:25 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
 | SpelInjection.java:48:5:48:14 | expression | semmle.label | expression |
 | SpelInjection.java:52:22:52:44 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| SpelInjection.java:55:13:55:14 | in : InputStream | semmle.label | in : InputStream |
+| SpelInjection.java:55:21:55:25 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
 | SpelInjection.java:59:5:59:14 | expression | semmle.label | expression |
 | SpelInjection.java:63:22:63:44 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| SpelInjection.java:66:13:66:14 | in : InputStream | semmle.label | in : InputStream |
+| SpelInjection.java:66:21:66:25 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
 | SpelInjection.java:70:5:70:14 | expression | semmle.label | expression |
 | SpelInjection.java:74:22:74:44 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| SpelInjection.java:77:13:77:14 | in : InputStream | semmle.label | in : InputStream |
+| SpelInjection.java:77:21:77:25 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
 | SpelInjection.java:83:5:83:14 | expression | semmle.label | expression |
 #select
 | SpelInjection.java:23:5:23:14 | expression | SpelInjection.java:15:22:15:44 | getInputStream(...) : InputStream | SpelInjection.java:23:5:23:14 | expression | SpEL injection from $@. | SpelInjection.java:15:22:15:44 | getInputStream(...) | this user input |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-094/options b/java/ql/test/experimental/query-tests/security/CWE-094/options
index a8e30ce30b4..18e3518fc97 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-094/options
+++ b/java/ql/test/experimental/query-tests/security/CWE-094/options
@@ -1,2 +1,2 @@
-//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/springframework-5.2.3:${testdir}/../../../../stubs/mvel2-2.4.7:${testdir}/../../../../stubs/jsr223-api:${testdir}/../../../../stubs/apache-commons-jexl-2.1.1:${testdir}/../../../../stubs/apache-commons-jexl-3.1:${testdir}/../../../../stubs/scriptengine
+//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/springframework-5.2.3:${testdir}/../../../../stubs/mvel2-2.4.7:${testdir}/../../../../stubs/jsr223-api:${testdir}/../../../../stubs/apache-commons-jexl-2.1.1:${testdir}/../../../../stubs/apache-commons-jexl-3.1:${testdir}/../../../../stubs/scriptengine:${testdir}/../../../../stubs/java-ee-el:${testdir}/../../../../stubs/juel-2.2:${testdir}/../../../stubs/groovy-all-3.0.7:${testdir}/../../../../stubs/servlet-api-2.4
 
diff --git a/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.expected b/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.expected
new file mode 100644
index 00000000000..6c23f5d44e9
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.expected
@@ -0,0 +1,51 @@
+edges
+| SensitiveCookieNotHttpOnly.java:24:33:24:43 | "jwt_token" : String | SensitiveCookieNotHttpOnly.java:25:39:25:52 | tokenCookieStr : String |
+| SensitiveCookieNotHttpOnly.java:24:33:24:43 | "jwt_token" : String | SensitiveCookieNotHttpOnly.java:31:28:31:36 | jwtCookie |
+| SensitiveCookieNotHttpOnly.java:25:28:25:64 | new Cookie(...) : Cookie | SensitiveCookieNotHttpOnly.java:31:28:31:36 | jwtCookie |
+| SensitiveCookieNotHttpOnly.java:25:39:25:52 | tokenCookieStr : String | SensitiveCookieNotHttpOnly.java:25:28:25:64 | new Cookie(...) : Cookie |
+| SensitiveCookieNotHttpOnly.java:42:42:42:49 | "token=" : String | SensitiveCookieNotHttpOnly.java:42:42:42:69 | ... + ... |
+| SensitiveCookieNotHttpOnly.java:42:42:42:57 | ... + ... : String | SensitiveCookieNotHttpOnly.java:42:42:42:69 | ... + ... |
+| SensitiveCookieNotHttpOnly.java:52:56:52:75 | "session-access-key" : String | SensitiveCookieNotHttpOnly.java:52:42:52:124 | toString(...) |
+| SensitiveCookieNotHttpOnly.java:63:51:63:70 | "session-access-key" : String | SensitiveCookieNotHttpOnly.java:65:42:65:47 | keyStr |
+| SensitiveCookieNotHttpOnly.java:70:28:70:35 | "token=" : String | SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString |
+| SensitiveCookieNotHttpOnly.java:70:28:70:43 | ... + ... : String | SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString |
+| SensitiveCookieNotHttpOnly.java:70:28:70:55 | ... + ... : String | SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString |
+| SensitiveCookieNotHttpOnly.java:88:35:88:51 | "Presto-UI-Token" : String | SensitiveCookieNotHttpOnly.java:89:36:89:51 | PRESTO_UI_COOKIE : String |
+| SensitiveCookieNotHttpOnly.java:88:35:88:51 | "Presto-UI-Token" : String | SensitiveCookieNotHttpOnly.java:91:16:91:21 | cookie : Cookie |
+| SensitiveCookieNotHttpOnly.java:89:25:89:57 | new Cookie(...) : Cookie | SensitiveCookieNotHttpOnly.java:91:16:91:21 | cookie : Cookie |
+| SensitiveCookieNotHttpOnly.java:89:36:89:51 | PRESTO_UI_COOKIE : String | SensitiveCookieNotHttpOnly.java:89:25:89:57 | new Cookie(...) : Cookie |
+| SensitiveCookieNotHttpOnly.java:91:16:91:21 | cookie : Cookie | SensitiveCookieNotHttpOnly.java:110:25:110:64 | createAuthenticationCookie(...) : Cookie |
+| SensitiveCookieNotHttpOnly.java:110:25:110:64 | createAuthenticationCookie(...) : Cookie | SensitiveCookieNotHttpOnly.java:111:28:111:33 | cookie |
+nodes
+| SensitiveCookieNotHttpOnly.java:24:33:24:43 | "jwt_token" : String | semmle.label | "jwt_token" : String |
+| SensitiveCookieNotHttpOnly.java:25:28:25:64 | new Cookie(...) : Cookie | semmle.label | new Cookie(...) : Cookie |
+| SensitiveCookieNotHttpOnly.java:25:39:25:52 | tokenCookieStr : String | semmle.label | tokenCookieStr : String |
+| SensitiveCookieNotHttpOnly.java:31:28:31:36 | jwtCookie | semmle.label | jwtCookie |
+| SensitiveCookieNotHttpOnly.java:42:42:42:49 | "token=" : String | semmle.label | "token=" : String |
+| SensitiveCookieNotHttpOnly.java:42:42:42:57 | ... + ... : String | semmle.label | ... + ... : String |
+| SensitiveCookieNotHttpOnly.java:42:42:42:69 | ... + ... | semmle.label | ... + ... |
+| SensitiveCookieNotHttpOnly.java:52:42:52:124 | toString(...) | semmle.label | toString(...) |
+| SensitiveCookieNotHttpOnly.java:52:56:52:75 | "session-access-key" : String | semmle.label | "session-access-key" : String |
+| SensitiveCookieNotHttpOnly.java:63:51:63:70 | "session-access-key" : String | semmle.label | "session-access-key" : String |
+| SensitiveCookieNotHttpOnly.java:65:42:65:47 | keyStr | semmle.label | keyStr |
+| SensitiveCookieNotHttpOnly.java:70:28:70:35 | "token=" : String | semmle.label | "token=" : String |
+| SensitiveCookieNotHttpOnly.java:70:28:70:43 | ... + ... : String | semmle.label | ... + ... : String |
+| SensitiveCookieNotHttpOnly.java:70:28:70:55 | ... + ... : String | semmle.label | ... + ... : String |
+| SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString | semmle.label | secString |
+| SensitiveCookieNotHttpOnly.java:88:35:88:51 | "Presto-UI-Token" : String | semmle.label | "Presto-UI-Token" : String |
+| SensitiveCookieNotHttpOnly.java:89:25:89:57 | new Cookie(...) : Cookie | semmle.label | new Cookie(...) : Cookie |
+| SensitiveCookieNotHttpOnly.java:89:36:89:51 | PRESTO_UI_COOKIE : String | semmle.label | PRESTO_UI_COOKIE : String |
+| SensitiveCookieNotHttpOnly.java:91:16:91:21 | cookie : Cookie | semmle.label | cookie : Cookie |
+| SensitiveCookieNotHttpOnly.java:110:25:110:64 | createAuthenticationCookie(...) : Cookie | semmle.label | createAuthenticationCookie(...) : Cookie |
+| SensitiveCookieNotHttpOnly.java:111:28:111:33 | cookie | semmle.label | cookie |
+#select
+| SensitiveCookieNotHttpOnly.java:31:28:31:36 | jwtCookie | SensitiveCookieNotHttpOnly.java:24:33:24:43 | "jwt_token" : String | SensitiveCookieNotHttpOnly.java:31:28:31:36 | jwtCookie | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:24:33:24:43 | "jwt_token" | This sensitive cookie |
+| SensitiveCookieNotHttpOnly.java:42:42:42:69 | ... + ... | SensitiveCookieNotHttpOnly.java:42:42:42:49 | "token=" : String | SensitiveCookieNotHttpOnly.java:42:42:42:69 | ... + ... | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:42:42:42:49 | "token=" | This sensitive cookie |
+| SensitiveCookieNotHttpOnly.java:42:42:42:69 | ... + ... | SensitiveCookieNotHttpOnly.java:42:42:42:57 | ... + ... : String | SensitiveCookieNotHttpOnly.java:42:42:42:69 | ... + ... | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:42:42:42:57 | ... + ... | This sensitive cookie |
+| SensitiveCookieNotHttpOnly.java:42:42:42:69 | ... + ... | SensitiveCookieNotHttpOnly.java:42:42:42:69 | ... + ... | SensitiveCookieNotHttpOnly.java:42:42:42:69 | ... + ... | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:42:42:42:69 | ... + ... | This sensitive cookie |
+| SensitiveCookieNotHttpOnly.java:52:42:52:124 | toString(...) | SensitiveCookieNotHttpOnly.java:52:56:52:75 | "session-access-key" : String | SensitiveCookieNotHttpOnly.java:52:42:52:124 | toString(...) | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:52:56:52:75 | "session-access-key" | This sensitive cookie |
+| SensitiveCookieNotHttpOnly.java:65:42:65:47 | keyStr | SensitiveCookieNotHttpOnly.java:63:51:63:70 | "session-access-key" : String | SensitiveCookieNotHttpOnly.java:65:42:65:47 | keyStr | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:63:51:63:70 | "session-access-key" | This sensitive cookie |
+| SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString | SensitiveCookieNotHttpOnly.java:70:28:70:35 | "token=" : String | SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:70:28:70:35 | "token=" | This sensitive cookie |
+| SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString | SensitiveCookieNotHttpOnly.java:70:28:70:43 | ... + ... : String | SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:70:28:70:43 | ... + ... | This sensitive cookie |
+| SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString | SensitiveCookieNotHttpOnly.java:70:28:70:55 | ... + ... : String | SensitiveCookieNotHttpOnly.java:71:42:71:50 | secString | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:70:28:70:55 | ... + ... | This sensitive cookie |
+| SensitiveCookieNotHttpOnly.java:111:28:111:33 | cookie | SensitiveCookieNotHttpOnly.java:88:35:88:51 | "Presto-UI-Token" : String | SensitiveCookieNotHttpOnly.java:111:28:111:33 | cookie | $@ doesn't have the HttpOnly flag set. | SensitiveCookieNotHttpOnly.java:88:35:88:51 | "Presto-UI-Token" | This sensitive cookie |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.java b/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.java
new file mode 100644
index 00000000000..627575c8403
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.java
@@ -0,0 +1,164 @@
+import java.io.IOException;
+
+import javax.servlet.http.Cookie;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.servlet.ServletException;
+
+import javax.ws.rs.core.NewCookie;
+
+import org.springframework.security.web.csrf.CsrfToken;
+
+class SensitiveCookieNotHttpOnly {
+    // GOOD - Tests adding a sensitive cookie with the `HttpOnly` flag set.
+    public void addCookie(String jwt_token, HttpServletRequest request, HttpServletResponse response) {
+        Cookie jwtCookie = new Cookie("jwt_token", jwt_token);
+        jwtCookie.setPath("/");
+        jwtCookie.setMaxAge(3600*24*7);
+        jwtCookie.setHttpOnly(true);
+        response.addCookie(jwtCookie);
+    }
+
+    // BAD - Tests adding a sensitive cookie without the `HttpOnly` flag set.
+    public void addCookie2(String jwt_token, String userId, HttpServletRequest request, HttpServletResponse response) {
+        String tokenCookieStr = "jwt_token";
+        Cookie jwtCookie = new Cookie(tokenCookieStr, jwt_token);
+        Cookie userIdCookie = new Cookie("user_id", userId);
+        jwtCookie.setPath("/");
+        userIdCookie.setPath("/");
+        jwtCookie.setMaxAge(3600*24*7);
+        userIdCookie.setMaxAge(3600*24*7);
+        response.addCookie(jwtCookie);
+        response.addCookie(userIdCookie);
+    }
+
+    // GOOD - Tests set a sensitive cookie header with the `HttpOnly` flag set.
+    public void addCookie3(String authId, HttpServletRequest request, HttpServletResponse response) {
+        response.addHeader("Set-Cookie", "token=" +authId + ";HttpOnly;Secure");
+    }
+
+    // BAD - Tests set a sensitive cookie header without the `HttpOnly` flag set.
+    public void addCookie4(String authId, HttpServletRequest request, HttpServletResponse response) {
+        response.addHeader("Set-Cookie", "token=" +authId + ";Secure");
+    }
+    
+    // GOOD - Tests set a sensitive cookie header using the class `javax.ws.rs.core.Cookie` with the `HttpOnly` flag set through string concatenation.
+    public void addCookie5(String accessKey, HttpServletRequest request, HttpServletResponse response) {
+        response.setHeader("Set-Cookie", new NewCookie("session-access-key", accessKey, "/", null, null, 0, true) + ";HttpOnly");
+    }
+
+    // BAD - Tests set a sensitive cookie header using the class `javax.ws.rs.core.Cookie` without the `HttpOnly` flag set.
+    public void addCookie6(String accessKey, HttpServletRequest request, HttpServletResponse response) {
+        response.setHeader("Set-Cookie", new NewCookie("session-access-key", accessKey, "/", null, null, 0, true).toString());
+    }
+
+    // GOOD - Tests set a sensitive cookie header using the class `javax.ws.rs.core.Cookie` with the `HttpOnly` flag set through the constructor.
+    public void addCookie7(String accessKey, HttpServletRequest request, HttpServletResponse response) {
+        NewCookie accessKeyCookie = new NewCookie("session-access-key", accessKey, "/", null, null, 0, true, true);
+        response.setHeader("Set-Cookie", accessKeyCookie.toString());
+    }
+
+    // BAD - Tests set a sensitive cookie header using the class `javax.ws.rs.core.Cookie` without the `HttpOnly` flag set.
+    public void addCookie8(String accessKey, HttpServletRequest request, HttpServletResponse response) {
+        NewCookie accessKeyCookie = new NewCookie("session-access-key", accessKey, "/", null, 0, null, 86400, true);
+        String keyStr = accessKeyCookie.toString();
+        response.setHeader("Set-Cookie", keyStr);
+    }
+
+    // BAD - Tests set a sensitive cookie header using a variable without the `HttpOnly` flag set.
+    public void addCookie9(String authId, HttpServletRequest request, HttpServletResponse response) {
+        String secString = "token=" +authId + ";Secure";
+        response.addHeader("Set-Cookie", secString);
+    }
+
+    // GOOD - Tests set a sensitive cookie header with the `HttpOnly` flag set using `String.format(...)`.
+    public void addCookie10(HttpServletRequest request, HttpServletResponse response) {
+        response.addHeader("SET-COOKIE", String.format("%s=%s;HttpOnly", "sessionkey", request.getSession().getAttribute("sessionkey")));
+    }
+
+    public Cookie createHttpOnlyAuthenticationCookie(HttpServletRequest request, String jwt) {
+        String PRESTO_UI_COOKIE = "Presto-UI-Token";
+        Cookie cookie = new Cookie(PRESTO_UI_COOKIE, jwt);
+        cookie.setHttpOnly(true);
+        cookie.setPath("/ui");
+        return cookie;
+    }
+
+    public Cookie createAuthenticationCookie(HttpServletRequest request, String jwt) {
+        String PRESTO_UI_COOKIE = "Presto-UI-Token";
+        Cookie cookie = new Cookie(PRESTO_UI_COOKIE, jwt);
+        cookie.setPath("/ui");
+        return cookie;
+    }
+
+    public Cookie removeAuthenticationCookie(HttpServletRequest request, String jwt) {
+        String PRESTO_UI_COOKIE = "Presto-UI-Token";
+        Cookie cookie = new Cookie(PRESTO_UI_COOKIE, jwt);
+        cookie.setPath("/ui");
+        cookie.setMaxAge(0);
+        return cookie;
+    }
+
+    // GOOD - Tests set a sensitive cookie header with the `HttpOnly` flag set using a wrapper method.
+    public void addCookie11(HttpServletRequest request, HttpServletResponse response, String jwt) {
+        Cookie cookie = createHttpOnlyAuthenticationCookie(request, jwt);
+        response.addCookie(cookie);
+    }
+
+    // BAD - Tests set a sensitive cookie header without the `HttpOnly` flag set using a wrapper method.
+    public void addCookie12(HttpServletRequest request, HttpServletResponse response, String jwt) {
+        Cookie cookie = createAuthenticationCookie(request, jwt);
+        response.addCookie(cookie);
+    }
+
+    // GOOD - Tests remove a sensitive cookie header without the `HttpOnly` flag set using a wrapper method.
+    public void addCookie13(HttpServletRequest request, HttpServletResponse response, String jwt) {
+        Cookie cookie = removeAuthenticationCookie(request, jwt);
+        response.addCookie(cookie);
+    }
+
+    private Cookie createCookie(String name, String value, Boolean httpOnly){
+        Cookie cookie = null;
+        cookie = new Cookie(name, value);
+        cookie.setDomain("/");
+        cookie.setHttpOnly(httpOnly);
+
+        //for production https
+        cookie.setSecure(true);
+
+        cookie.setMaxAge(60*60*24*30);
+        cookie.setPath("/");
+
+        return cookie;
+    }
+
+    // GOOD - Tests set a sensitive cookie header with the `HttpOnly` flag set through a boolean variable using a wrapper method.
+    public void addCookie14(HttpServletRequest request, HttpServletResponse response, String refreshToken) {
+        response.addCookie(createCookie("refresh_token", refreshToken, true));
+    }
+
+    // BAD (but not detected) - Tests set a sensitive cookie header with the `HttpOnly` flag not set through a boolean variable using a wrapper method.
+    // This example is missed because the `cookie.setHttpOnly` call in `createCookie` is thought to maybe set the HTTP-only flag, and the `cookie`
+    // object flows to this `addCookie` call.
+    public void addCookie15(HttpServletRequest request, HttpServletResponse response, String refreshToken) {
+        response.addCookie(createCookie("refresh_token", refreshToken, false));
+    }
+
+    // GOOD - CSRF token doesn't need to have the `HttpOnly` flag set.
+    public void addCsrfCookie(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
+        // Spring put the CSRF token in session attribute "_csrf"
+        CsrfToken csrfToken = (CsrfToken) request.getAttribute("_csrf");
+    
+        // Send the cookie only if the token has changed
+        String actualToken = request.getHeader("X-CSRF-TOKEN");
+        if (actualToken == null || !actualToken.equals(csrfToken.getToken())) {
+            // Session cookie that can be used by AngularJS
+            String pCookieName = "CSRF-TOKEN";
+            Cookie cookie = new Cookie(pCookieName, csrfToken.getToken());
+            cookie.setMaxAge(-1);
+            cookie.setHttpOnly(false);
+            cookie.setPath("/");
+            response.addCookie(cookie);
+        }
+    }
+}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.qlref b/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.qlref
new file mode 100644
index 00000000000..cc2baaf6f7b
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-1004/SensitiveCookieNotHttpOnly.qlref
@@ -0,0 +1 @@
+experimental/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql
diff --git a/java/ql/test/experimental/query-tests/security/CWE-1004/options b/java/ql/test/experimental/query-tests/security/CWE-1004/options
new file mode 100644
index 00000000000..d61a358d97f
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-1004/options
@@ -0,0 +1 @@
+// semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/servlet-api-2.4:${testdir}/../../../../stubs/jsr311-api-1.1.1:${testdir}/../../../../stubs/springframework-5.2.3
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-297/InsecureLdapEndpoint.expected b/java/ql/test/experimental/query-tests/security/CWE-297/InsecureLdapEndpoint.expected
new file mode 100644
index 00000000000..f37e49e30e0
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-297/InsecureLdapEndpoint.expected
@@ -0,0 +1,5 @@
+| InsecureLdapEndpoint.java:19:9:19:92 | setProperty(...) | LDAPS configuration allows insecure endpoint identification |
+| InsecureLdapEndpoint.java:50:9:50:40 | setProperties(...) | LDAPS configuration allows insecure endpoint identification |
+| InsecureLdapEndpoint.java:68:9:68:40 | setProperties(...) | LDAPS configuration allows insecure endpoint identification |
+| InsecureLdapEndpoint.java:84:9:84:94 | setProperty(...) | LDAPS configuration allows insecure endpoint identification |
+| InsecureLdapEndpoint.java:102:9:102:40 | setProperties(...) | LDAPS configuration allows insecure endpoint identification |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-297/InsecureLdapEndpoint.java b/java/ql/test/experimental/query-tests/security/CWE-297/InsecureLdapEndpoint.java
new file mode 100644
index 00000000000..72f6bee118a
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-297/InsecureLdapEndpoint.java
@@ -0,0 +1,106 @@
+import java.util.Hashtable;
+import java.util.Properties;
+import javax.naming.Context;
+
+public class InsecureLdapEndpoint {
+    private static String PROP_DISABLE_LDAP_ENDPOINT_IDENTIFICATION = "com.sun.jndi.ldap.object.disableEndpointIdentification";
+
+    // BAD - Test configuration with disabled LDAPS endpoint check using `System.setProperty()`.
+    public Hashtable<String, String> createConnectionEnv() {
+        Hashtable<String, String> env = new Hashtable<String, String>();
+        env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
+        env.put(Context.PROVIDER_URL, "ldaps://ad.your-server.com:636");
+
+        env.put(Context.SECURITY_AUTHENTICATION, "simple");
+        env.put(Context.SECURITY_PRINCIPAL, "username");
+        env.put(Context.SECURITY_CREDENTIALS, "secpassword");
+
+        // Disable SSL endpoint check
+        System.setProperty("com.sun.jndi.ldap.object.disableEndpointIdentification", "true");
+
+        return env;
+    }
+
+    // GOOD - Test configuration without disabling LDAPS endpoint check.
+    public Hashtable<String, String> createConnectionEnv2() {
+        Hashtable<String, String> env = new Hashtable<String, String>();
+        env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
+        env.put(Context.PROVIDER_URL, "ldaps://ad.your-server.com:636");
+
+        env.put(Context.SECURITY_AUTHENTICATION, "simple");
+        env.put(Context.SECURITY_PRINCIPAL, "username");
+        env.put(Context.SECURITY_CREDENTIALS, "secpassword");
+
+        return env;
+    }
+
+    // BAD - Test configuration with disabled LDAPS endpoint check using `System.setProperties()`.
+    public Hashtable<String, String> createConnectionEnv3() {
+        Hashtable<String, String> env = new Hashtable<String, String>();
+        env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
+        env.put(Context.PROVIDER_URL, "ldaps://ad.your-server.com:636");
+
+        env.put(Context.SECURITY_AUTHENTICATION, "simple");
+        env.put(Context.SECURITY_PRINCIPAL, "username");
+        env.put(Context.SECURITY_CREDENTIALS, "secpassword");
+
+        // Disable SSL endpoint check
+        Properties properties = new Properties();
+        properties.setProperty("com.sun.jndi.ldap.object.disableEndpointIdentification", "true");
+        System.setProperties(properties);
+
+        return env;
+    }
+
+    // BAD - Test configuration with disabled LDAPS endpoint check using `HashTable.put()`.
+    public Hashtable<String, String> createConnectionEnv4() {
+        Hashtable<String, String> env = new Hashtable<String, String>();
+        env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
+        env.put(Context.PROVIDER_URL, "ldaps://ad.your-server.com:636");
+
+        env.put(Context.SECURITY_AUTHENTICATION, "simple");
+        env.put(Context.SECURITY_PRINCIPAL, "username");
+        env.put(Context.SECURITY_CREDENTIALS, "secpassword");
+
+        // Disable SSL endpoint check
+        Properties properties = new Properties();
+        properties.put("com.sun.jndi.ldap.object.disableEndpointIdentification", "true");
+        System.setProperties(properties);
+
+        return env;
+    }
+
+    // BAD - Test configuration with disabled LDAPS endpoint check using the `TRUE` boolean field.
+    public Hashtable<String, String> createConnectionEnv5() {
+        Hashtable<String, String> env = new Hashtable<String, String>();
+        env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
+        env.put(Context.PROVIDER_URL, "ldaps://ad.your-server.com:636");
+
+        env.put(Context.SECURITY_AUTHENTICATION, "simple");
+        env.put(Context.SECURITY_PRINCIPAL, "username");
+        env.put(Context.SECURITY_CREDENTIALS, "secpassword");
+
+        // Disable SSL endpoint check
+        System.setProperty(PROP_DISABLE_LDAP_ENDPOINT_IDENTIFICATION, Boolean.TRUE.toString());
+
+        return env;
+    }
+
+    // BAD - Test configuration with disabled LDAPS endpoint check using a boolean value.
+    public Hashtable<String, String> createConnectionEnv6() {
+        Hashtable<String, String> env = new Hashtable<String, String>();
+        env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
+        env.put(Context.PROVIDER_URL, "ldaps://ad.your-server.com:636");
+
+        env.put(Context.SECURITY_AUTHENTICATION, "simple");
+        env.put(Context.SECURITY_PRINCIPAL, "username");
+        env.put(Context.SECURITY_CREDENTIALS, "secpassword");
+
+        // Disable SSL endpoint check
+        Properties properties = new Properties();
+        properties.put("com.sun.jndi.ldap.object.disableEndpointIdentification", true);
+        System.setProperties(properties);
+
+        return env;
+    }
+}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-297/InsecureLdapEndpoint.qlref b/java/ql/test/experimental/query-tests/security/CWE-297/InsecureLdapEndpoint.qlref
new file mode 100644
index 00000000000..1c4d99bb6a3
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-297/InsecureLdapEndpoint.qlref
@@ -0,0 +1 @@
+experimental/Security/CWE/CWE-297/InsecureLdapEndpoint.ql
diff --git a/java/ql/test/experimental/query-tests/security/CWE-346/UnvalidatedCors.expected b/java/ql/test/experimental/query-tests/security/CWE-346/UnvalidatedCors.expected
new file mode 100644
index 00000000000..d215f034fd2
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-346/UnvalidatedCors.expected
@@ -0,0 +1,7 @@
+edges
+| UnvalidatedCors.java:21:22:21:48 | getHeader(...) : String | UnvalidatedCors.java:27:67:27:69 | url |
+nodes
+| UnvalidatedCors.java:21:22:21:48 | getHeader(...) : String | semmle.label | getHeader(...) : String |
+| UnvalidatedCors.java:27:67:27:69 | url | semmle.label | url |
+#select
+| UnvalidatedCors.java:27:67:27:69 | url | UnvalidatedCors.java:21:22:21:48 | getHeader(...) : String | UnvalidatedCors.java:27:67:27:69 | url | CORS header is being set using user controlled value $@. | UnvalidatedCors.java:21:22:21:48 | getHeader(...) | user-provided value |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-346/UnvalidatedCors.java b/java/ql/test/experimental/query-tests/security/CWE-346/UnvalidatedCors.java
new file mode 100644
index 00000000000..9ec3c8466be
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-346/UnvalidatedCors.java
@@ -0,0 +1,37 @@
+import java.io.IOException;
+
+import javax.servlet.Filter;
+import javax.servlet.FilterChain;
+import javax.servlet.FilterConfig;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.commons.lang3.StringUtils;
+
+public class UnvalidatedCors implements Filter {
+    public void init(FilterConfig filterConfig) throws ServletException {}
+
+    public void doFilter(ServletRequest req, ServletResponse res,
+            FilterChain chain) throws IOException, ServletException {
+        HttpServletRequest request = (HttpServletRequest) req;
+        HttpServletResponse response = (HttpServletResponse) res;
+        String url = request.getHeader("Origin");
+
+        if (!StringUtils.isEmpty(url)) {
+            String val = response.getHeader("Access-Control-Allow-Origin");
+
+            if (StringUtils.isEmpty(val)) {
+                response.addHeader("Access-Control-Allow-Origin", url);
+                response.addHeader("Access-Control-Allow-Credentials", "true");
+            }
+        }
+
+        chain.doFilter(req, res);
+    }
+
+    public void destroy() {}
+}
+
diff --git a/java/ql/test/experimental/query-tests/security/CWE-346/UnvalidatedCors.qlref b/java/ql/test/experimental/query-tests/security/CWE-346/UnvalidatedCors.qlref
new file mode 100644
index 00000000000..c41004f565c
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-346/UnvalidatedCors.qlref
@@ -0,0 +1 @@
+experimental/Security/CWE/CWE-346/UnvalidatedCors.ql
diff --git a/java/ql/test/experimental/query-tests/security/CWE-346/options b/java/ql/test/experimental/query-tests/security/CWE-346/options
new file mode 100644
index 00000000000..d105d863eb4
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-346/options
@@ -0,0 +1 @@
+//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/servlet-api-2.4:${testdir}/../../../../stubs/apache-commons-lang3-3.7
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpController.java b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpController.java
new file mode 100644
index 00000000000..c7fd850bb09
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpController.java
@@ -0,0 +1,161 @@
+import com.alibaba.fastjson.JSONObject;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.google.gson.Gson;
+import java.io.BufferedReader;
+import java.io.IOException;
+import java.io.InputStreamReader;
+import java.io.PrintWriter;
+import java.util.HashMap;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.multipart.MultipartFile;
+
+@Controller
+public class JsonpController {
+
+    private static HashMap hashMap = new HashMap();
+
+    static {
+        hashMap.put("username","admin");
+        hashMap.put("password","123456");
+    }
+
+    @GetMapping(value = "jsonp1")
+    @ResponseBody
+    public String bad1(HttpServletRequest request) {
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        Gson gson = new Gson();
+        String result = gson.toJson(hashMap);
+        resultStr = jsonpCallback + "(" + result + ")";
+        return resultStr;
+    }
+
+    @GetMapping(value = "jsonp2")
+    @ResponseBody
+    public String bad2(HttpServletRequest request) {
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        resultStr = jsonpCallback + "(" + JSONObject.toJSONString(hashMap) + ")";
+        return resultStr;
+    }
+
+    @GetMapping(value = "jsonp3")
+    @ResponseBody
+    public String bad3(HttpServletRequest request) {
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        String jsonStr = getJsonStr(hashMap);
+        resultStr = jsonpCallback + "(" + jsonStr + ")";
+        return resultStr;
+    }
+
+    @GetMapping(value = "jsonp4")
+    @ResponseBody
+    public String bad4(HttpServletRequest request) {
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        String restr = JSONObject.toJSONString(hashMap);
+        resultStr = jsonpCallback + "(" + restr + ");";
+        return resultStr;
+    }
+
+    @GetMapping(value = "jsonp5")
+    @ResponseBody
+    public void bad5(HttpServletRequest request,
+            HttpServletResponse response) throws Exception {
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        PrintWriter pw = null;
+        Gson gson = new Gson();
+        String result = gson.toJson(hashMap);
+        String resultStr = null;
+        pw = response.getWriter();
+        resultStr = jsonpCallback + "(" + result + ")";
+        pw.println(resultStr);
+    }
+
+    @GetMapping(value = "jsonp6")
+    @ResponseBody
+    public void bad6(HttpServletRequest request,
+            HttpServletResponse response) throws Exception {
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        PrintWriter pw = null;
+        ObjectMapper mapper = new ObjectMapper();
+        String result = mapper.writeValueAsString(hashMap);
+        String resultStr = null;
+        pw = response.getWriter();
+        resultStr = jsonpCallback + "(" + result + ")";
+        pw.println(resultStr);
+    }
+
+    @RequestMapping(value = "jsonp7", method = RequestMethod.GET)
+    @ResponseBody
+    public String bad7(HttpServletRequest request) {
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        Gson gson = new Gson();
+        String result = gson.toJson(hashMap);
+        resultStr = jsonpCallback + "(" + result + ")";
+        return resultStr;
+    }
+
+    @RequestMapping(value = "jsonp11")
+    @ResponseBody
+    public String good1(HttpServletRequest request) {
+        JSONObject parameterObj = readToJSONObect(request);
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        String restr = JSONObject.toJSONString(hashMap);
+        resultStr = jsonpCallback + "(" + restr + ");";
+        return resultStr;
+    }
+
+    @RequestMapping(value = "jsonp12")
+    @ResponseBody
+    public String good2(@RequestParam("file") MultipartFile file,HttpServletRequest request) {
+        if(null == file){
+            return "upload file error";
+        }
+        String fileName = file.getOriginalFilename();
+        System.out.println("file operations");
+        String resultStr = null;
+        String jsonpCallback = request.getParameter("jsonpCallback");
+        String restr = JSONObject.toJSONString(hashMap);
+        resultStr = jsonpCallback + "(" + restr + ");";
+        return resultStr;
+    }
+
+    public static JSONObject readToJSONObect(HttpServletRequest request){
+        String jsonText = readPostContent(request);
+        JSONObject jsonObj = JSONObject.parseObject(jsonText, JSONObject.class);
+        return jsonObj;
+    }
+
+    public static String readPostContent(HttpServletRequest request){
+        BufferedReader in= null;
+        String content = null;
+        String line = null;
+        try {
+            in = new BufferedReader(new InputStreamReader(request.getInputStream(),"UTF-8"));
+            StringBuilder buf = new StringBuilder();
+            while ((line = in.readLine()) != null) {
+                buf.append(line);
+            }
+            content = buf.toString();
+        } catch (IOException e) {
+            e.printStackTrace();
+        }
+        String uri = request.getRequestURI();
+        return content;
+    }
+
+    public static String getJsonStr(Object result) {
+        return JSONObject.toJSONString(result);
+    }
+}
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection.expected b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection.expected
new file mode 100644
index 00000000000..14912328a1e
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection.expected
@@ -0,0 +1,58 @@
+edges
+| JsonpController.java:33:32:33:68 | getParameter(...) : String | JsonpController.java:37:16:37:24 | resultStr |
+| JsonpController.java:36:21:36:54 | ... + ... : String | JsonpController.java:37:16:37:24 | resultStr |
+| JsonpController.java:44:32:44:68 | getParameter(...) : String | JsonpController.java:46:16:46:24 | resultStr |
+| JsonpController.java:45:21:45:80 | ... + ... : String | JsonpController.java:46:16:46:24 | resultStr |
+| JsonpController.java:53:32:53:68 | getParameter(...) : String | JsonpController.java:56:16:56:24 | resultStr |
+| JsonpController.java:55:21:55:55 | ... + ... : String | JsonpController.java:56:16:56:24 | resultStr |
+| JsonpController.java:63:32:63:68 | getParameter(...) : String | JsonpController.java:66:16:66:24 | resultStr |
+| JsonpController.java:65:21:65:54 | ... + ... : String | JsonpController.java:66:16:66:24 | resultStr |
+| JsonpController.java:73:32:73:68 | getParameter(...) : String | JsonpController.java:80:20:80:28 | resultStr |
+| JsonpController.java:79:21:79:54 | ... + ... : String | JsonpController.java:80:20:80:28 | resultStr |
+| JsonpController.java:87:32:87:68 | getParameter(...) : String | JsonpController.java:94:20:94:28 | resultStr |
+| JsonpController.java:93:21:93:54 | ... + ... : String | JsonpController.java:94:20:94:28 | resultStr |
+| JsonpController.java:101:32:101:68 | getParameter(...) : String | JsonpController.java:105:16:105:24 | resultStr |
+| JsonpController.java:104:21:104:54 | ... + ... : String | JsonpController.java:105:16:105:24 | resultStr |
+| JsonpController.java:115:21:115:54 | ... + ... : String | JsonpController.java:116:16:116:24 | resultStr |
+| JsonpController.java:130:21:130:54 | ... + ... : String | JsonpController.java:131:16:131:24 | resultStr |
+nodes
+| JsonpController.java:33:32:33:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:36:21:36:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:37:16:37:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:37:16:37:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:44:32:44:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:45:21:45:80 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:46:16:46:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:46:16:46:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:53:32:53:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:55:21:55:55 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:56:16:56:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:56:16:56:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:63:32:63:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:65:21:65:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:66:16:66:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:66:16:66:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:73:32:73:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:79:21:79:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:80:20:80:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:80:20:80:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:87:32:87:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:93:21:93:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:94:20:94:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:94:20:94:28 | resultStr | semmle.label | resultStr |
+| JsonpController.java:101:32:101:68 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| JsonpController.java:104:21:104:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:105:16:105:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:105:16:105:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:115:21:115:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:116:16:116:24 | resultStr | semmle.label | resultStr |
+| JsonpController.java:130:21:130:54 | ... + ... : String | semmle.label | ... + ... : String |
+| JsonpController.java:131:16:131:24 | resultStr | semmle.label | resultStr |
+#select
+| JsonpController.java:37:16:37:24 | resultStr | JsonpController.java:33:32:33:68 | getParameter(...) : String | JsonpController.java:37:16:37:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:33:32:33:68 | getParameter(...) | this user input |
+| JsonpController.java:46:16:46:24 | resultStr | JsonpController.java:44:32:44:68 | getParameter(...) : String | JsonpController.java:46:16:46:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:44:32:44:68 | getParameter(...) | this user input |
+| JsonpController.java:56:16:56:24 | resultStr | JsonpController.java:53:32:53:68 | getParameter(...) : String | JsonpController.java:56:16:56:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:53:32:53:68 | getParameter(...) | this user input |
+| JsonpController.java:66:16:66:24 | resultStr | JsonpController.java:63:32:63:68 | getParameter(...) : String | JsonpController.java:66:16:66:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:63:32:63:68 | getParameter(...) | this user input |
+| JsonpController.java:80:20:80:28 | resultStr | JsonpController.java:73:32:73:68 | getParameter(...) : String | JsonpController.java:80:20:80:28 | resultStr | Jsonp response might include code from $@. | JsonpController.java:73:32:73:68 | getParameter(...) | this user input |
+| JsonpController.java:94:20:94:28 | resultStr | JsonpController.java:87:32:87:68 | getParameter(...) : String | JsonpController.java:94:20:94:28 | resultStr | Jsonp response might include code from $@. | JsonpController.java:87:32:87:68 | getParameter(...) | this user input |
+| JsonpController.java:105:16:105:24 | resultStr | JsonpController.java:101:32:101:68 | getParameter(...) : String | JsonpController.java:105:16:105:24 | resultStr | Jsonp response might include code from $@. | JsonpController.java:101:32:101:68 | getParameter(...) | this user input |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection.qlref b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection.qlref
new file mode 100644
index 00000000000..3f5fc450669
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-352/JsonpInjection.qlref
@@ -0,0 +1 @@
+experimental/Security/CWE/CWE-352/JsonpInjection.ql
diff --git a/java/ql/test/experimental/query-tests/security/CWE-352/options b/java/ql/test/experimental/query-tests/security/CWE-352/options
new file mode 100644
index 00000000000..5e5f10f6945
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-352/options
@@ -0,0 +1 @@
+  //semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/apache-http-4.4.13/:${testdir}/../../../../stubs/servlet-api-2.4:${testdir}/../../../../stubs/fastjson-1.2.74/:${testdir}/../../../../stubs/gson-2.8.6/:${testdir}/../../../../stubs/jackson-databind-2.10/:${testdir}/../../../../stubs/springframework-5.2.3/
diff --git a/java/ql/test/experimental/query-tests/security/CWE-502/SpringExporterUnsafeDeserialization.java b/java/ql/test/experimental/query-tests/security/CWE-502/SpringExporterUnsafeDeserialization.java
new file mode 100644
index 00000000000..2bca24ee370
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-502/SpringExporterUnsafeDeserialization.java
@@ -0,0 +1,79 @@
+import org.springframework.boot.SpringBootConfiguration;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.remoting.httpinvoker.HttpInvokerServiceExporter;
+import org.springframework.remoting.rmi.RemoteInvocationSerializingExporter;
+
+@Configuration
+public class SpringExporterUnsafeDeserialization {
+
+    @Bean(name = "/unsafeHttpInvokerServiceExporter")
+    HttpInvokerServiceExporter unsafeHttpInvokerServiceExporter() {
+        HttpInvokerServiceExporter exporter = new HttpInvokerServiceExporter();
+        exporter.setService(new AccountServiceImpl());
+        exporter.setServiceInterface(AccountService.class);
+        return exporter;
+    }
+
+    @Bean(name = "/unsafeCustomeRemoteInvocationSerializingExporter")
+    RemoteInvocationSerializingExporter unsafeCustomeRemoteInvocationSerializingExporter() {
+        return new CustomeRemoteInvocationSerializingExporter();
+    }
+
+    HttpInvokerServiceExporter notABean() {
+        HttpInvokerServiceExporter exporter = new HttpInvokerServiceExporter();
+        exporter.setService(new AccountServiceImpl());
+        exporter.setServiceInterface(AccountService.class);
+        return exporter;
+    }
+}
+
+@SpringBootApplication
+class SpringBootTestApplication {
+
+    @Bean(name = "/unsafeHttpInvokerServiceExporter")
+    HttpInvokerServiceExporter unsafeHttpInvokerServiceExporter() {
+        HttpInvokerServiceExporter exporter = new HttpInvokerServiceExporter();
+        exporter.setService(new AccountServiceImpl());
+        exporter.setServiceInterface(AccountService.class);
+        return exporter;
+    }
+}
+
+@SpringBootConfiguration
+class SpringBootTestConfiguration {
+
+    @Bean(name = "/unsafeHttpInvokerServiceExporter")
+    HttpInvokerServiceExporter unsafeHttpInvokerServiceExporter() {
+        HttpInvokerServiceExporter exporter = new HttpInvokerServiceExporter();
+        exporter.setService(new AccountServiceImpl());
+        exporter.setServiceInterface(AccountService.class);
+        return exporter;
+    }
+}
+
+class CustomeRemoteInvocationSerializingExporter extends RemoteInvocationSerializingExporter {}
+
+class NotAConfiguration {
+
+    @Bean(name = "/notAnEndpoint")
+    HttpInvokerServiceExporter notAnEndpoint() {
+        HttpInvokerServiceExporter exporter = new HttpInvokerServiceExporter();
+        exporter.setService(new AccountServiceImpl());
+        exporter.setServiceInterface(AccountService.class);
+        return exporter;
+    }
+}
+
+class AccountServiceImpl implements AccountService {
+
+    @Override
+    public String echo(String data) {
+        return data;
+    }
+}
+
+interface AccountService {
+    String echo(String data);
+}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-502/UnsafeSpringExporterInConfigurationClass.expected b/java/ql/test/experimental/query-tests/security/CWE-502/UnsafeSpringExporterInConfigurationClass.expected
new file mode 100644
index 00000000000..2155d805e80
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-502/UnsafeSpringExporterInConfigurationClass.expected
@@ -0,0 +1,4 @@
+| SpringExporterUnsafeDeserialization.java:12:32:12:63 | unsafeHttpInvokerServiceExporter | Unsafe deserialization in a Spring exporter bean '/unsafeHttpInvokerServiceExporter' |
+| SpringExporterUnsafeDeserialization.java:20:41:20:88 | unsafeCustomeRemoteInvocationSerializingExporter | Unsafe deserialization in a Spring exporter bean '/unsafeCustomeRemoteInvocationSerializingExporter' |
+| SpringExporterUnsafeDeserialization.java:36:32:36:63 | unsafeHttpInvokerServiceExporter | Unsafe deserialization in a Spring exporter bean '/unsafeHttpInvokerServiceExporter' |
+| SpringExporterUnsafeDeserialization.java:48:32:48:63 | unsafeHttpInvokerServiceExporter | Unsafe deserialization in a Spring exporter bean '/unsafeHttpInvokerServiceExporter' |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-502/UnsafeSpringExporterInConfigurationClass.qlref b/java/ql/test/experimental/query-tests/security/CWE-502/UnsafeSpringExporterInConfigurationClass.qlref
new file mode 100644
index 00000000000..823c7735ec5
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-502/UnsafeSpringExporterInConfigurationClass.qlref
@@ -0,0 +1 @@
+experimental/Security/CWE/CWE-502/UnsafeSpringExporterInConfigurationClass.ql
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-502/UnsafeSpringExporterInXMLConfiguration.expected b/java/ql/test/experimental/query-tests/security/CWE-502/UnsafeSpringExporterInXMLConfiguration.expected
new file mode 100644
index 00000000000..edcb3668557
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-502/UnsafeSpringExporterInXMLConfiguration.expected
@@ -0,0 +1,2 @@
+| beans.xml:10:5:13:12 | /unsafeBooking | Unsafe deserialization in a Spring exporter bean '/unsafeBooking' |
+| beans.xml:15:5:18:12 | org.springframework.remoting.httpinvoker.HttpInvokerServiceExporter | Unsafe deserialization in a Spring exporter bean 'org.springframework.remoting.httpinvoker.HttpInvokerServiceExporter' |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-502/UnsafeSpringExporterInXMLConfiguration.qlref b/java/ql/test/experimental/query-tests/security/CWE-502/UnsafeSpringExporterInXMLConfiguration.qlref
new file mode 100644
index 00000000000..46024a0b6b3
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-502/UnsafeSpringExporterInXMLConfiguration.qlref
@@ -0,0 +1 @@
+experimental/Security/CWE/CWE-502/UnsafeSpringExporterInXMLConfiguration.ql
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-502/beans.xml b/java/ql/test/experimental/query-tests/security/CWE-502/beans.xml
new file mode 100644
index 00000000000..bdb4e5fa651
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-502/beans.xml
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+       xmlns:context="http://www.springframework.org/schema/context"
+       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+	http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd">
+
+    <bean id="anotherBookingService" class="com.gypsyengineer.server.CabBookingServiceImpl"/>
+
+    <bean name="/unsafeBooking" class="org.springframework.remoting.httpinvoker.HttpInvokerServiceExporter">
+        <property name="service" ref="anotherBookingService"/>
+        <property name="serviceInterface" value="com.gypsyengineer.api.CabBookingService"/>
+    </bean>
+
+    <bean class="org.springframework.remoting.httpinvoker.HttpInvokerServiceExporter">
+        <property name="service" ref="anotherBookingService"/>
+        <property name="serviceInterface" value="com.gypsyengineer.api.CabBookingService"/>
+    </bean>
+</beans>
diff --git a/java/ql/test/experimental/query-tests/security/CWE-502/options b/java/ql/test/experimental/query-tests/security/CWE-502/options
new file mode 100644
index 00000000000..31b8e3f6935
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-502/options
@@ -0,0 +1 @@
+//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/springframework-5.2.3
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-522/InsecureBasicAuth.expected b/java/ql/test/experimental/query-tests/security/CWE-522/InsecureBasicAuth.expected
index 92cf245968e..6a4ee5fdddd 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-522/InsecureBasicAuth.expected
+++ b/java/ql/test/experimental/query-tests/security/CWE-522/InsecureBasicAuth.expected
@@ -1,8 +1,14 @@
 edges
 | InsecureBasicAuth.java:20:39:20:52 | ... + ... : String | InsecureBasicAuth.java:28:3:28:6 | post |
 | InsecureBasicAuth.java:35:19:35:64 | "http://www.example.com:8000/payment/retrieve" : String | InsecureBasicAuth.java:38:3:38:5 | get |
+| InsecureBasicAuth.java:45:19:45:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" : String | InsecureBasicAuth.java:46:50:46:55 | uriStr : String |
 | InsecureBasicAuth.java:45:19:45:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" : String | InsecureBasicAuth.java:54:3:54:6 | post |
+| InsecureBasicAuth.java:46:39:46:56 | create(...) : URI | InsecureBasicAuth.java:54:3:54:6 | post |
+| InsecureBasicAuth.java:46:50:46:55 | uriStr : String | InsecureBasicAuth.java:46:39:46:56 | create(...) : URI |
+| InsecureBasicAuth.java:61:19:61:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" : String | InsecureBasicAuth.java:62:21:62:26 | uriStr : String |
 | InsecureBasicAuth.java:61:19:61:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" : String | InsecureBasicAuth.java:71:3:71:6 | post |
+| InsecureBasicAuth.java:62:13:62:27 | new URI(...) : URI | InsecureBasicAuth.java:71:3:71:6 | post |
+| InsecureBasicAuth.java:62:21:62:26 | uriStr : String | InsecureBasicAuth.java:62:13:62:27 | new URI(...) : URI |
 | InsecureBasicAuth.java:78:47:78:52 | "http" : String | InsecureBasicAuth.java:86:3:86:6 | post |
 | InsecureBasicAuth.java:93:19:93:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" : String | InsecureBasicAuth.java:102:3:102:6 | post |
 | InsecureBasicAuth.java:109:19:109:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" : String | InsecureBasicAuth.java:119:3:119:6 | post |
@@ -16,8 +22,12 @@ nodes
 | InsecureBasicAuth.java:35:19:35:64 | "http://www.example.com:8000/payment/retrieve" : String | semmle.label | "http://www.example.com:8000/payment/retrieve" : String |
 | InsecureBasicAuth.java:38:3:38:5 | get | semmle.label | get |
 | InsecureBasicAuth.java:45:19:45:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" : String | semmle.label | "http://www.example.com/rest/getuser.do?uid=abcdx" : String |
+| InsecureBasicAuth.java:46:39:46:56 | create(...) : URI | semmle.label | create(...) : URI |
+| InsecureBasicAuth.java:46:50:46:55 | uriStr : String | semmle.label | uriStr : String |
 | InsecureBasicAuth.java:54:3:54:6 | post | semmle.label | post |
 | InsecureBasicAuth.java:61:19:61:68 | "http://www.example.com/rest/getuser.do?uid=abcdx" : String | semmle.label | "http://www.example.com/rest/getuser.do?uid=abcdx" : String |
+| InsecureBasicAuth.java:62:13:62:27 | new URI(...) : URI | semmle.label | new URI(...) : URI |
+| InsecureBasicAuth.java:62:21:62:26 | uriStr : String | semmle.label | uriStr : String |
 | InsecureBasicAuth.java:71:3:71:6 | post | semmle.label | post |
 | InsecureBasicAuth.java:78:47:78:52 | "http" : String | semmle.label | "http" : String |
 | InsecureBasicAuth.java:86:3:86:6 | post | semmle.label | post |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.expected b/java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.expected
new file mode 100644
index 00000000000..b857d58634b
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.expected
@@ -0,0 +1,5 @@
+| configuration.properties:6:1:6:25 | ldap.password=mysecpass | Plaintext credentials ldap.password have cleartext value mysecpass in properties file |
+| configuration.properties:18:1:18:35 | datasource1.password=Passw0rd@123 | Plaintext credentials datasource1.password have cleartext value Passw0rd@123 in properties file |
+| configuration.properties:25:1:25:31 | mail.password=MysecPWxWa@1993 | Plaintext credentials mail.password have cleartext value MysecPWxWa@1993 in properties file |
+| configuration.properties:33:1:33:50 | com.example.aws.s3.access_key=AKMAMQPBYMCD6YSAYCBA | Plaintext credentials com.example.aws.s3.access_key have cleartext value AKMAMQPBYMCD6YSAYCBA in properties file |
+| configuration.properties:34:1:34:70 | com.example.aws.s3.secret_key=8lMPSfWzZq+wcWtck5+QPLOJDZzE783pS09/IO3k | Plaintext credentials com.example.aws.s3.secret_key have cleartext value 8lMPSfWzZq+wcWtck5+QPLOJDZzE783pS09/IO3k in properties file |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.ql b/java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.ql
new file mode 100644
index 00000000000..d72743f3799
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-555/CredentialsInPropertiesFile.ql
@@ -0,0 +1,10 @@
+/*
+ * Note this is similar to src/experimental/Security/CWE/CWE-555/CredentialsInPropertiesFile.ql
+ * except we do not filter out test files.
+ */
+
+import java
+import experimental.semmle.code.java.frameworks.CredentialsInPropertiesFile
+
+from CredentialsConfig cc
+select cc, cc.getConfigDesc()
diff --git a/java/ql/test/experimental/query-tests/security/CWE-555/configuration.properties b/java/ql/test/experimental/query-tests/security/CWE-555/configuration.properties
new file mode 100644
index 00000000000..a044161f097
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-555/configuration.properties
@@ -0,0 +1,37 @@
+#***************************** LDAP Credentials *****************************************#
+ldap.ldapHost = ldap.example.com
+ldap.ldapPort = 636
+ldap.loginDN = cn=Directory Manager
+#### BAD: LDAP credentials are stored in cleartext #### 
+ldap.password = mysecpass
+#### GOOD: LDAP credentials are stored in the encrypted format #### 
+ldap.password = eFRZ3Cqo5zDJWMYLiaEupw==
+ldap.domain1 = example
+ldap.domain2 = com
+ldap.url= ldaps://ldap.example.com:636/dc=example,dc=com
+
+#*************************** MS SQL Database Connection **********************************# 
+datasource1.driverClassName = com.microsoft.sqlserver.jdbc.SQLServerDriver
+datasource1.url = jdbc:sqlserver://ms.example.com\\exampledb:1433;
+datasource1.username = sa
+#### BAD: Datasource credentials are stored in cleartext #### 
+datasource1.password = Passw0rd@123
+#### GOOD: Datasource credentials are stored in the encrypted format #### 
+datasource1.password = VvOgflYS1EUzJdVNDoBcnA==
+
+#*************************** Mail Connection **********************************# 
+mail.username = test@example.com
+#### BAD: Mail credentials are stored in cleartext #### 
+mail.password = MysecPWxWa@1993
+#### GOOD: Mail credentials are stored in the encrypted format #### 
+mail.password = M*********@1993
+
+#*************************** AWS S3 Connection **********************************# 
+com.example.aws.s3.bucket_name=com-bucket-1
+com.example.aws.s3.directory_name=com-directory-1
+#### BAD: Access keys are stored in properties file in cleartext #### 
+com.example.aws.s3.access_key=AKMAMQPBYMCD6YSAYCBA
+com.example.aws.s3.secret_key=8lMPSfWzZq+wcWtck5+QPLOJDZzE783pS09/IO3k
+#### GOOD: Access keys are not stored in properties file #### 
+com.example.aws.s3.access_key=${ENV:AWS_ACCESS_KEY_ID}
+com.example.aws.s3.secret_key=${ENV:AWS_SECRET_ACCESS_KEY}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-555/messages.properties b/java/ql/test/experimental/query-tests/security/CWE-555/messages.properties
new file mode 100644
index 00000000000..27a244c6071
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-555/messages.properties
@@ -0,0 +1,9 @@
+# GOOD: UI display messages; not credentials
+prompt.username=Username
+prompt.password=Password
+
+forgot_password.error=Please enter a valid email address.
+reset_password.error=Passwords must match and not be empty.
+
+login.password_expired=Your current password has expired. Please reset your password.
+login.login_failure=Unable to verify username or password. Please try again.
diff --git a/java/ql/test/experimental/query-tests/security/CWE-652/XQueryInjection.expected b/java/ql/test/experimental/query-tests/security/CWE-652/XQueryInjection.expected
new file mode 100644
index 00000000000..919bc3c58d1
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-652/XQueryInjection.expected
@@ -0,0 +1,61 @@
+edges
+| XQueryInjection.java:45:23:45:50 | getParameter(...) : String | XQueryInjection.java:51:35:51:38 | xqpe |
+| XQueryInjection.java:59:23:59:50 | getParameter(...) : String | XQueryInjection.java:65:53:65:57 | query |
+| XQueryInjection.java:73:32:73:59 | nameStr : String | XQueryInjection.java:79:35:79:38 | xqpe |
+| XQueryInjection.java:86:33:86:60 | nameStr : String | XQueryInjection.java:92:53:92:57 | query |
+| XQueryInjection.java:100:28:100:51 | getInputStream(...) : ServletInputStream | XQueryInjection.java:104:35:104:38 | xqpe |
+| XQueryInjection.java:112:28:112:51 | getInputStream(...) : ServletInputStream | XQueryInjection.java:116:53:116:56 | name |
+| XQueryInjection.java:124:28:124:51 | getInputStream(...) : ServletInputStream | XQueryInjection.java:125:70:125:73 | name : ServletInputStream |
+| XQueryInjection.java:125:29:125:75 | new BufferedReader(...) : BufferedReader | XQueryInjection.java:129:35:129:38 | xqpe |
+| XQueryInjection.java:125:48:125:74 | new InputStreamReader(...) : InputStreamReader | XQueryInjection.java:125:29:125:75 | new BufferedReader(...) : BufferedReader |
+| XQueryInjection.java:125:70:125:73 | name : ServletInputStream | XQueryInjection.java:125:48:125:74 | new InputStreamReader(...) : InputStreamReader |
+| XQueryInjection.java:137:28:137:51 | getInputStream(...) : ServletInputStream | XQueryInjection.java:138:70:138:73 | name : ServletInputStream |
+| XQueryInjection.java:138:29:138:75 | new BufferedReader(...) : BufferedReader | XQueryInjection.java:142:53:142:54 | br |
+| XQueryInjection.java:138:48:138:74 | new InputStreamReader(...) : InputStreamReader | XQueryInjection.java:138:29:138:75 | new BufferedReader(...) : BufferedReader |
+| XQueryInjection.java:138:70:138:73 | name : ServletInputStream | XQueryInjection.java:138:48:138:74 | new InputStreamReader(...) : InputStreamReader |
+| XQueryInjection.java:150:23:150:50 | getParameter(...) : String | XQueryInjection.java:155:29:155:32 | name |
+| XQueryInjection.java:157:26:157:49 | getInputStream(...) : ServletInputStream | XQueryInjection.java:158:70:158:71 | is : ServletInputStream |
+| XQueryInjection.java:158:29:158:73 | new BufferedReader(...) : BufferedReader | XQueryInjection.java:159:29:159:30 | br |
+| XQueryInjection.java:158:48:158:72 | new InputStreamReader(...) : InputStreamReader | XQueryInjection.java:158:29:158:73 | new BufferedReader(...) : BufferedReader |
+| XQueryInjection.java:158:70:158:71 | is : ServletInputStream | XQueryInjection.java:158:48:158:72 | new InputStreamReader(...) : InputStreamReader |
+nodes
+| XQueryInjection.java:45:23:45:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| XQueryInjection.java:51:35:51:38 | xqpe | semmle.label | xqpe |
+| XQueryInjection.java:59:23:59:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| XQueryInjection.java:65:53:65:57 | query | semmle.label | query |
+| XQueryInjection.java:73:32:73:59 | nameStr : String | semmle.label | nameStr : String |
+| XQueryInjection.java:79:35:79:38 | xqpe | semmle.label | xqpe |
+| XQueryInjection.java:86:33:86:60 | nameStr : String | semmle.label | nameStr : String |
+| XQueryInjection.java:92:53:92:57 | query | semmle.label | query |
+| XQueryInjection.java:100:28:100:51 | getInputStream(...) : ServletInputStream | semmle.label | getInputStream(...) : ServletInputStream |
+| XQueryInjection.java:104:35:104:38 | xqpe | semmle.label | xqpe |
+| XQueryInjection.java:112:28:112:51 | getInputStream(...) : ServletInputStream | semmle.label | getInputStream(...) : ServletInputStream |
+| XQueryInjection.java:116:53:116:56 | name | semmle.label | name |
+| XQueryInjection.java:124:28:124:51 | getInputStream(...) : ServletInputStream | semmle.label | getInputStream(...) : ServletInputStream |
+| XQueryInjection.java:125:29:125:75 | new BufferedReader(...) : BufferedReader | semmle.label | new BufferedReader(...) : BufferedReader |
+| XQueryInjection.java:125:48:125:74 | new InputStreamReader(...) : InputStreamReader | semmle.label | new InputStreamReader(...) : InputStreamReader |
+| XQueryInjection.java:125:70:125:73 | name : ServletInputStream | semmle.label | name : ServletInputStream |
+| XQueryInjection.java:129:35:129:38 | xqpe | semmle.label | xqpe |
+| XQueryInjection.java:137:28:137:51 | getInputStream(...) : ServletInputStream | semmle.label | getInputStream(...) : ServletInputStream |
+| XQueryInjection.java:138:29:138:75 | new BufferedReader(...) : BufferedReader | semmle.label | new BufferedReader(...) : BufferedReader |
+| XQueryInjection.java:138:48:138:74 | new InputStreamReader(...) : InputStreamReader | semmle.label | new InputStreamReader(...) : InputStreamReader |
+| XQueryInjection.java:138:70:138:73 | name : ServletInputStream | semmle.label | name : ServletInputStream |
+| XQueryInjection.java:142:53:142:54 | br | semmle.label | br |
+| XQueryInjection.java:150:23:150:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| XQueryInjection.java:155:29:155:32 | name | semmle.label | name |
+| XQueryInjection.java:157:26:157:49 | getInputStream(...) : ServletInputStream | semmle.label | getInputStream(...) : ServletInputStream |
+| XQueryInjection.java:158:29:158:73 | new BufferedReader(...) : BufferedReader | semmle.label | new BufferedReader(...) : BufferedReader |
+| XQueryInjection.java:158:48:158:72 | new InputStreamReader(...) : InputStreamReader | semmle.label | new InputStreamReader(...) : InputStreamReader |
+| XQueryInjection.java:158:70:158:71 | is : ServletInputStream | semmle.label | is : ServletInputStream |
+| XQueryInjection.java:159:29:159:30 | br | semmle.label | br |
+#select
+| XQueryInjection.java:51:35:51:38 | xqpe | XQueryInjection.java:45:23:45:50 | getParameter(...) : String | XQueryInjection.java:51:35:51:38 | xqpe | XQuery query might include code from $@. | XQueryInjection.java:45:23:45:50 | getParameter(...) | this user input |
+| XQueryInjection.java:65:53:65:57 | query | XQueryInjection.java:59:23:59:50 | getParameter(...) : String | XQueryInjection.java:65:53:65:57 | query | XQuery query might include code from $@. | XQueryInjection.java:59:23:59:50 | getParameter(...) | this user input |
+| XQueryInjection.java:79:35:79:38 | xqpe | XQueryInjection.java:73:32:73:59 | nameStr : String | XQueryInjection.java:79:35:79:38 | xqpe | XQuery query might include code from $@. | XQueryInjection.java:73:32:73:59 | nameStr | this user input |
+| XQueryInjection.java:92:53:92:57 | query | XQueryInjection.java:86:33:86:60 | nameStr : String | XQueryInjection.java:92:53:92:57 | query | XQuery query might include code from $@. | XQueryInjection.java:86:33:86:60 | nameStr | this user input |
+| XQueryInjection.java:104:35:104:38 | xqpe | XQueryInjection.java:100:28:100:51 | getInputStream(...) : ServletInputStream | XQueryInjection.java:104:35:104:38 | xqpe | XQuery query might include code from $@. | XQueryInjection.java:100:28:100:51 | getInputStream(...) | this user input |
+| XQueryInjection.java:116:53:116:56 | name | XQueryInjection.java:112:28:112:51 | getInputStream(...) : ServletInputStream | XQueryInjection.java:116:53:116:56 | name | XQuery query might include code from $@. | XQueryInjection.java:112:28:112:51 | getInputStream(...) | this user input |
+| XQueryInjection.java:129:35:129:38 | xqpe | XQueryInjection.java:124:28:124:51 | getInputStream(...) : ServletInputStream | XQueryInjection.java:129:35:129:38 | xqpe | XQuery query might include code from $@. | XQueryInjection.java:124:28:124:51 | getInputStream(...) | this user input |
+| XQueryInjection.java:142:53:142:54 | br | XQueryInjection.java:137:28:137:51 | getInputStream(...) : ServletInputStream | XQueryInjection.java:142:53:142:54 | br | XQuery query might include code from $@. | XQueryInjection.java:137:28:137:51 | getInputStream(...) | this user input |
+| XQueryInjection.java:155:29:155:32 | name | XQueryInjection.java:150:23:150:50 | getParameter(...) : String | XQueryInjection.java:155:29:155:32 | name | XQuery query might include code from $@. | XQueryInjection.java:150:23:150:50 | getParameter(...) | this user input |
+| XQueryInjection.java:159:29:159:30 | br | XQueryInjection.java:157:26:157:49 | getInputStream(...) : ServletInputStream | XQueryInjection.java:159:29:159:30 | br | XQuery query might include code from $@. | XQueryInjection.java:157:26:157:49 | getInputStream(...) | this user input |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-652/XQueryInjection.java b/java/ql/test/experimental/query-tests/security/CWE-652/XQueryInjection.java
new file mode 100644
index 00000000000..d8df8057cc6
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-652/XQueryInjection.java
@@ -0,0 +1,195 @@
+package com.vuln.v2.controller;
+
+import java.io.BufferedReader;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import javax.servlet.http.HttpServletRequest;
+import javax.xml.namespace.QName;
+import javax.xml.xquery.XQConnection;
+import javax.xml.xquery.XQDataSource;
+import javax.xml.xquery.XQException;
+import javax.xml.xquery.XQExpression;
+import javax.xml.xquery.XQItemType;
+import javax.xml.xquery.XQPreparedExpression;
+import javax.xml.xquery.XQResultSequence;
+import net.sf.saxon.xqj.SaxonXQDataSource;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+
+@Controller
+public class XQueryInjection {
+
+    public static void main(String[] args) throws Exception {
+        XQDataSource xqds = new SaxonXQDataSource();
+        XQConnection conn;
+        try {
+            String name = "admin";
+            String query = "declare variable $name as xs:string external;"
+                    + " for $user in doc(\"users.xml\")/Users/User[name=$name] return $user/password";
+            conn = xqds.getConnection();
+            XQExpression expr = conn.createExpression();
+            expr.bindString(new QName("name"), name,
+                    conn.createAtomicType(XQItemType.XQBASETYPE_STRING));
+            XQResultSequence result = expr.executeQuery(query);
+            while (result.next()) {
+                System.out.println(result.getItemAsString(null));
+            }
+        } catch (XQException e) {
+            e.printStackTrace();
+        }
+    }
+
+    @RequestMapping
+    public void testRequestbad(HttpServletRequest request) throws Exception {
+        String name = request.getParameter("name");
+        XQDataSource ds = new SaxonXQDataSource();
+        XQConnection conn = ds.getConnection();
+        String query = "for $user in doc(\"users.xml\")/Users/User[name='" + name
+                + "'] return $user/password";
+        XQPreparedExpression xqpe = conn.prepareExpression(query);
+        XQResultSequence result = xqpe.executeQuery();
+        while (result.next()) {
+            System.out.println(result.getItemAsString(null));
+        }
+    }
+
+    @RequestMapping
+    public void testRequestbad1(HttpServletRequest request) throws Exception {
+        String name = request.getParameter("name");
+        XQDataSource xqds = new SaxonXQDataSource();
+        String query = "for $user in doc(\"users.xml\")/Users/User[name='" + name
+                + "'] return $user/password";
+        XQConnection conn = xqds.getConnection();
+        XQExpression expr = conn.createExpression();
+        XQResultSequence result = expr.executeQuery(query);
+        while (result.next()) {
+            System.out.println(result.getItemAsString(null));
+        }
+    }
+
+
+    @RequestMapping
+    public void testStringtbad(@RequestParam String nameStr) throws XQException {
+        XQDataSource ds = new SaxonXQDataSource();
+        XQConnection conn = ds.getConnection();
+        String query = "for $user in doc(\"users.xml\")/Users/User[name='" + nameStr
+                + "'] return $user/password";
+        XQPreparedExpression xqpe = conn.prepareExpression(query);
+        XQResultSequence result = xqpe.executeQuery();
+        while (result.next()) {
+            System.out.println(result.getItemAsString(null));
+        }
+    }
+
+    @RequestMapping
+    public void testStringtbad1(@RequestParam String nameStr) throws XQException {
+        XQDataSource xqds = new SaxonXQDataSource();
+        String query = "for $user in doc(\"users.xml\")/Users/User[name='" + nameStr
+                + "'] return $user/password";
+        XQConnection conn = xqds.getConnection();
+        XQExpression expr = conn.createExpression();
+        XQResultSequence result = expr.executeQuery(query);
+        while (result.next()) {
+            System.out.println(result.getItemAsString(null));
+        }
+    }
+
+    @RequestMapping
+    public void testInputStreambad(HttpServletRequest request) throws Exception {
+        InputStream name = request.getInputStream();
+        XQDataSource ds = new SaxonXQDataSource();
+        XQConnection conn = ds.getConnection();
+        XQPreparedExpression xqpe = conn.prepareExpression(name);
+        XQResultSequence result = xqpe.executeQuery();
+        while (result.next()) {
+            System.out.println(result.getItemAsString(null));
+        }
+    }
+
+    @RequestMapping
+    public void testInputStreambad1(HttpServletRequest request) throws Exception {
+        InputStream name = request.getInputStream();
+        XQDataSource xqds = new SaxonXQDataSource();
+        XQConnection conn = xqds.getConnection();
+        XQExpression expr = conn.createExpression();
+        XQResultSequence result = expr.executeQuery(name);
+        while (result.next()) {
+            System.out.println(result.getItemAsString(null));
+        }
+    }
+
+    @RequestMapping
+    public void testReaderbad(HttpServletRequest request) throws Exception {
+        InputStream name = request.getInputStream();
+        BufferedReader br = new BufferedReader(new InputStreamReader(name));
+        XQDataSource ds = new SaxonXQDataSource();
+        XQConnection conn = ds.getConnection();
+        XQPreparedExpression xqpe = conn.prepareExpression(br);
+        XQResultSequence result = xqpe.executeQuery();
+        while (result.next()) {
+            System.out.println(result.getItemAsString(null));
+        }
+    }
+
+    @RequestMapping
+    public void testReaderbad1(HttpServletRequest request) throws Exception {
+        InputStream name = request.getInputStream();
+        BufferedReader br = new BufferedReader(new InputStreamReader(name));
+        XQDataSource xqds = new SaxonXQDataSource();
+        XQConnection conn = xqds.getConnection();
+        XQExpression expr = conn.createExpression();
+        XQResultSequence result = expr.executeQuery(br);
+        while (result.next()) {
+            System.out.println(result.getItemAsString(null));
+        }
+    }
+
+    @RequestMapping
+    public void testExecuteCommandbad(HttpServletRequest request) throws Exception {
+        String name = request.getParameter("name");
+        XQDataSource xqds = new SaxonXQDataSource();
+        XQConnection conn = xqds.getConnection();
+        XQExpression expr = conn.createExpression();
+        //bad code
+        expr.executeCommand(name);
+        //bad code
+        InputStream is = request.getInputStream();
+        BufferedReader br = new BufferedReader(new InputStreamReader(is));
+        expr.executeCommand(br);
+        expr.close();
+    }
+
+    @RequestMapping
+    public void good(HttpServletRequest request) throws XQException {
+        String name = request.getParameter("name");
+        XQDataSource ds = new SaxonXQDataSource();
+        XQConnection conn = ds.getConnection();
+        String query = "declare variable $name as xs:string external;"
+                + " for $user in doc(\"users.xml\")/Users/User[name=$name] return $user/password";
+        XQPreparedExpression xqpe = conn.prepareExpression(query);
+        xqpe.bindString(new QName("name"), name,
+                conn.createAtomicType(XQItemType.XQBASETYPE_STRING));
+        XQResultSequence result = xqpe.executeQuery();
+        while (result.next()) {
+            System.out.println(result.getItemAsString(null));
+        }
+    }
+
+    @RequestMapping
+    public void good1(HttpServletRequest request) throws XQException {
+        String name = request.getParameter("name");
+        String query = "declare variable $name as xs:string external;"
+                + " for $user in doc(\"users.xml\")/Users/User[name=$name] return $user/password";
+        XQDataSource xqds = new SaxonXQDataSource();
+        XQConnection conn = xqds.getConnection();
+        XQExpression expr = conn.createExpression();
+        expr.bindString(new QName("name"), name,
+                conn.createAtomicType(XQItemType.XQBASETYPE_STRING));
+        XQResultSequence result = expr.executeQuery(query);
+        while (result.next()) {
+            System.out.println(result.getItemAsString(null));
+        }
+    }
+}
+
diff --git a/java/ql/test/experimental/query-tests/security/CWE-652/XQueryInjection.qlref b/java/ql/test/experimental/query-tests/security/CWE-652/XQueryInjection.qlref
new file mode 100644
index 00000000000..dd59ba7582f
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-652/XQueryInjection.qlref
@@ -0,0 +1 @@
+experimental/Security/CWE/CWE-652/XQueryInjection.ql
diff --git a/java/ql/test/experimental/query-tests/security/CWE-652/options b/java/ql/test/experimental/query-tests/security/CWE-652/options
new file mode 100644
index 00000000000..98e36c19267
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-652/options
@@ -0,0 +1 @@
+//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/apache-http-4.4.13/:${testdir}/../../../../stubs/servlet-api-2.4:${testdir}/../../../../stubs/saxon-xqj-9.x/:${testdir}/../../../../stubs/springframework-5.2.3/
diff --git a/java/ql/test/experimental/query-tests/security/CWE-759/HASH.java b/java/ql/test/experimental/query-tests/security/CWE-759/HASH.java
new file mode 100644
index 00000000000..ed4da313244
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-759/HASH.java
@@ -0,0 +1,11 @@
+import java.security.NoSuchAlgorithmException;
+
+public interface HASH {
+  void init() throws NoSuchAlgorithmException;
+
+  int getBlockSize();
+
+  void update(byte[] foo, int start, int len) throws NoSuchAlgorithmException;
+
+  byte[] digest() throws NoSuchAlgorithmException;
+}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-759/HashWithoutSalt.expected b/java/ql/test/experimental/query-tests/security/CWE-759/HashWithoutSalt.expected
new file mode 100644
index 00000000000..b7a5ea8ee4a
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-759/HashWithoutSalt.expected
@@ -0,0 +1,19 @@
+edges
+| HashWithoutSalt.java:10:36:10:43 | password : String | HashWithoutSalt.java:10:36:10:54 | getBytes(...) |
+| HashWithoutSalt.java:25:13:25:20 | password : String | HashWithoutSalt.java:25:13:25:31 | getBytes(...) |
+| HashWithoutSalt.java:93:22:93:29 | password : String | HashWithoutSalt.java:94:17:94:25 | passBytes |
+| HashWithoutSalt.java:111:22:111:29 | password : String | HashWithoutSalt.java:112:18:112:26 | passBytes |
+nodes
+| HashWithoutSalt.java:10:36:10:43 | password : String | semmle.label | password : String |
+| HashWithoutSalt.java:10:36:10:54 | getBytes(...) | semmle.label | getBytes(...) |
+| HashWithoutSalt.java:25:13:25:20 | password : String | semmle.label | password : String |
+| HashWithoutSalt.java:25:13:25:31 | getBytes(...) | semmle.label | getBytes(...) |
+| HashWithoutSalt.java:93:22:93:29 | password : String | semmle.label | password : String |
+| HashWithoutSalt.java:94:17:94:25 | passBytes | semmle.label | passBytes |
+| HashWithoutSalt.java:111:22:111:29 | password : String | semmle.label | password : String |
+| HashWithoutSalt.java:112:18:112:26 | passBytes | semmle.label | passBytes |
+#select
+| HashWithoutSalt.java:10:36:10:54 | getBytes(...) | HashWithoutSalt.java:10:36:10:43 | password : String | HashWithoutSalt.java:10:36:10:54 | getBytes(...) | $@ is hashed without a salt. | HashWithoutSalt.java:10:36:10:43 | password : String | The password |
+| HashWithoutSalt.java:25:13:25:31 | getBytes(...) | HashWithoutSalt.java:25:13:25:20 | password : String | HashWithoutSalt.java:25:13:25:31 | getBytes(...) | $@ is hashed without a salt. | HashWithoutSalt.java:25:13:25:20 | password : String | The password |
+| HashWithoutSalt.java:94:17:94:25 | passBytes | HashWithoutSalt.java:93:22:93:29 | password : String | HashWithoutSalt.java:94:17:94:25 | passBytes | $@ is hashed without a salt. | HashWithoutSalt.java:93:22:93:29 | password : String | The password |
+| HashWithoutSalt.java:112:18:112:26 | passBytes | HashWithoutSalt.java:111:22:111:29 | password : String | HashWithoutSalt.java:112:18:112:26 | passBytes | $@ is hashed without a salt. | HashWithoutSalt.java:111:22:111:29 | password : String | The password |
diff --git a/java/ql/test/experimental/query-tests/security/CWE-759/HashWithoutSalt.java b/java/ql/test/experimental/query-tests/security/CWE-759/HashWithoutSalt.java
new file mode 100644
index 00000000000..48911486db1
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-759/HashWithoutSalt.java
@@ -0,0 +1,147 @@
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.security.SecureRandom;
+import java.util.Base64;
+
+public class HashWithoutSalt {
+	// BAD - Hash without a salt.
+	public String getSHA256Hash(String password) throws NoSuchAlgorithmException {
+		MessageDigest md = MessageDigest.getInstance("SHA-256");
+		byte[] messageDigest = md.digest(password.getBytes());
+		return Base64.getEncoder().encodeToString(messageDigest);
+	}
+
+	// GOOD - Hash with a salt.
+	public String getSHA256Hash(String password, byte[] salt) throws NoSuchAlgorithmException {
+		MessageDigest md = MessageDigest.getInstance("SHA-256");
+		md.update(salt);
+		byte[] messageDigest = md.digest(password.getBytes());
+		return Base64.getEncoder().encodeToString(messageDigest);
+	}
+
+	// BAD - Hash without a salt.
+	public String getSHA256Hash2(String password) throws NoSuchAlgorithmException {
+		MessageDigest md = MessageDigest.getInstance("SHA-256");
+		md.update(password.getBytes());
+		byte[] messageDigest = md.digest();
+		return Base64.getEncoder().encodeToString(messageDigest);
+	}
+
+	// GOOD - Hash with a salt.
+	public String getSHA256Hash2(String password, byte[] salt) throws NoSuchAlgorithmException {
+		MessageDigest md = MessageDigest.getInstance("SHA-256");
+		md.update(salt);
+		md.update(password.getBytes());
+		byte[] messageDigest = md.digest();
+		return Base64.getEncoder().encodeToString(messageDigest);
+	}
+
+	// GOOD - Hash with a salt concatenated with the password.
+	public String getSHA256Hash3(String password, byte[] salt) throws NoSuchAlgorithmException {
+		MessageDigest md = MessageDigest.getInstance("SHA-256");
+	
+		byte[] passBytes = password.getBytes();
+		byte[] allBytes = new byte[passBytes.length + salt.length];
+		System.arraycopy(passBytes, 0, allBytes, 0, passBytes.length);
+		System.arraycopy(salt, 0, allBytes, passBytes.length, salt.length);
+		byte[] messageDigest = md.digest(allBytes);	
+	
+		byte[] cipherBytes = new byte[32 + salt.length]; // SHA-256 is 32 bytes long			
+		System.arraycopy(messageDigest, 0, cipherBytes, 0, 32);
+		System.arraycopy(salt, 0, cipherBytes, 32, salt.length);
+		return Base64.getEncoder().encodeToString(cipherBytes);
+	}
+
+	// GOOD - Hash with a given salt stored somewhere else.
+	public String getSHA256Hash(String password, String salt) throws NoSuchAlgorithmException {
+		MessageDigest alg = MessageDigest.getInstance("SHA-256");
+		String payload = password+":"+salt;
+		return Base64.getEncoder().encodeToString(alg.digest(payload.getBytes(java.nio.charset.StandardCharsets.UTF_8)));
+	}
+
+	// GOOD - Hash with a given salt stored somewhere else.
+	public String getSHA256Hash2(String password, String salt, boolean useSalt) throws NoSuchAlgorithmException {
+		MessageDigest alg = MessageDigest.getInstance("SHA-256");
+		String payload = useSalt?password+":"+salt:password;
+		return Base64.getEncoder().encodeToString(alg.digest(payload.getBytes(java.nio.charset.StandardCharsets.UTF_8)));
+	}
+
+	// GOOD - Hash with a salt for a variable named passwordHash, whose value is a hash used as an input for a hashing function.
+	public String getSHA256Hash3(String passwordHash) throws NoSuchAlgorithmException {
+		MessageDigest md = MessageDigest.getInstance("SHA-256");
+		byte[] messageDigest = md.digest(passwordHash.getBytes());
+		return Base64.getEncoder().encodeToString(messageDigest);
+	}
+
+	public void update(SHA256 sha256, byte[] foo, int start, int len) throws NoSuchAlgorithmException {
+		sha256.update(foo, start, len);
+	}
+
+	// GOOD - Invoking a wrapper implementation through qualifier with a salt.
+	public String getWrapperSHA256Hash(String password) throws NoSuchAlgorithmException, ClassNotFoundException, IllegalAccessException, InstantiationException {
+		SHA256 sha256 = new SHA256();
+		byte[] salt = getSalt();
+		byte[] passBytes = password.getBytes();
+		sha256.update(passBytes, 0, passBytes.length);
+		sha256.update(salt, 0, salt.length);
+		return Base64.getEncoder().encodeToString(sha256.digest());
+	}
+
+	// BAD - Invoking a wrapper implementation through qualifier without a salt.
+	public String getWrapperSHA256Hash2(String password) throws NoSuchAlgorithmException, ClassNotFoundException, IllegalAccessException, InstantiationException {
+		SHA256 sha256 = new SHA256();
+		byte[] passBytes = password.getBytes();
+		sha256.update(passBytes, 0, passBytes.length);
+		return Base64.getEncoder().encodeToString(sha256.digest());
+	}
+
+	// GOOD - Invoking a wrapper implementation through qualifier and argument with a salt.
+	public String getWrapperSHA256Hash3(String password) throws NoSuchAlgorithmException {
+		SHA256 sha256 = new SHA256();
+		byte[] salt = getSalt();
+		byte[] passBytes = password.getBytes();
+		sha256.update(passBytes, 0, passBytes.length);
+		update(sha256, salt, 0, salt.length);
+		return Base64.getEncoder().encodeToString(sha256.digest());
+	}
+
+	// BAD - Invoking a wrapper implementation through argument without a salt.
+	public String getWrapperSHA256Hash4(String password) throws NoSuchAlgorithmException {
+		SHA256 sha256 = new SHA256();
+		byte[] passBytes = password.getBytes();
+		update(sha256, passBytes, 0, passBytes.length);
+		return Base64.getEncoder().encodeToString(sha256.digest());
+	}
+
+	// GOOD - Invoking a wrapper implementation through argument with a salt.
+	public String getWrapperSHA256Hash5(String password) throws NoSuchAlgorithmException {
+		SHA256 sha256 = new SHA256();
+		byte[] salt = getSalt();
+		byte[] passBytes = password.getBytes();
+		update(sha256, passBytes, 0, passBytes.length);
+		update(sha256, salt, 0, salt.length);
+		return Base64.getEncoder().encodeToString(sha256.digest());
+	}
+
+	// BAD - Invoke a wrapper implementation with a salt, which is not detected with an interface type variable.
+	public String getSHA512Hash8(byte[] passphrase) throws NoSuchAlgorithmException, ClassNotFoundException, IllegalAccessException, InstantiationException {
+		Class c = Class.forName("SHA512");
+		HASH sha512 = (HASH) (c.newInstance());
+		byte[] tmp = new byte[4];
+		byte[] key = new byte[32 * 2];
+		for (int i = 0; i < 2; i++) {
+			sha512.init();
+			tmp[3] = (byte) i;
+			sha512.update(passphrase, 0, passphrase.length);
+			System.arraycopy(sha512.digest(), 0, key, i * 32, 32);
+		}
+		return Base64.getEncoder().encodeToString(key);
+	}
+
+	public static byte[] getSalt() throws NoSuchAlgorithmException {
+		SecureRandom sr = SecureRandom.getInstance("SHA1PRNG");
+		byte[] salt = new byte[16];
+		sr.nextBytes(salt);
+		return salt;
+	}
+}
diff --git a/java/ql/test/experimental/query-tests/security/CWE-759/HashWithoutSalt.qlref b/java/ql/test/experimental/query-tests/security/CWE-759/HashWithoutSalt.qlref
new file mode 100644
index 00000000000..a8233ca37d2
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-759/HashWithoutSalt.qlref
@@ -0,0 +1 @@
+experimental/Security/CWE/CWE-759/HashWithoutSalt.ql
diff --git a/java/ql/test/experimental/query-tests/security/CWE-759/SHA256.java b/java/ql/test/experimental/query-tests/security/CWE-759/SHA256.java
new file mode 100644
index 00000000000..53532c66f8c
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-759/SHA256.java
@@ -0,0 +1,21 @@
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+
+public class SHA256 implements HASH {
+  MessageDigest md;
+  public int getBlockSize() {return 32;}
+  public void init() throws NoSuchAlgorithmException {
+    try { md = MessageDigest.getInstance("SHA-256"); }
+    catch (Exception e){
+      System.err.println(e);
+    }
+  }
+
+  public void update(byte[] foo, int start, int len) throws NoSuchAlgorithmException {
+    md.update(foo, start, len);
+  }
+
+  public byte[] digest() throws NoSuchAlgorithmException {
+    return md.digest();
+  }
+}
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-759/SHA512.java b/java/ql/test/experimental/query-tests/security/CWE-759/SHA512.java
new file mode 100644
index 00000000000..ec41fbf2d1a
--- /dev/null
+++ b/java/ql/test/experimental/query-tests/security/CWE-759/SHA512.java
@@ -0,0 +1,21 @@
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+
+public class SHA512 implements HASH {
+  MessageDigest md;
+  public int getBlockSize() {return 32;}
+  public void init() throws NoSuchAlgorithmException {
+    try { md = MessageDigest.getInstance("SHA-512"); }
+    catch (Exception e){
+      System.err.println(e);
+    }
+  }
+
+  public void update(byte[] foo, int start, int len) throws NoSuchAlgorithmException {
+    md.update(foo, start, len);
+  }
+
+  public byte[] digest() throws NoSuchAlgorithmException {
+    return md.digest();
+  }
+}
\ No newline at end of file
diff --git a/java/ql/test/experimental/query-tests/security/CWE-918/RequestForgery.expected b/java/ql/test/experimental/query-tests/security/CWE-918/RequestForgery.expected
index 1d2cae77dfe..f6c7072a519 100644
--- a/java/ql/test/experimental/query-tests/security/CWE-918/RequestForgery.expected
+++ b/java/ql/test/experimental/query-tests/security/CWE-918/RequestForgery.expected
@@ -1,5 +1,6 @@
 edges
 | JaxWsSSRF.java:21:22:21:48 | getParameter(...) : String | JaxWsSSRF.java:22:23:22:25 | url |
+| RequestForgery2.java:23:27:23:53 | getParameter(...) : String | RequestForgery2.java:25:31:25:34 | sink : String |
 | RequestForgery2.java:23:27:23:53 | getParameter(...) : String | RequestForgery2.java:55:32:55:35 | url1 |
 | RequestForgery2.java:23:27:23:53 | getParameter(...) : String | RequestForgery2.java:58:32:58:35 | url1 |
 | RequestForgery2.java:23:27:23:53 | getParameter(...) : String | RequestForgery2.java:59:30:59:33 | url1 |
@@ -7,6 +8,12 @@ edges
 | RequestForgery2.java:23:27:23:53 | getParameter(...) : String | RequestForgery2.java:64:59:64:61 | uri |
 | RequestForgery2.java:23:27:23:53 | getParameter(...) : String | RequestForgery2.java:67:43:67:45 | uri |
 | RequestForgery2.java:23:27:23:53 | getParameter(...) : String | RequestForgery2.java:69:29:69:32 | uri2 |
+| RequestForgery2.java:25:23:25:35 | new URI(...) : URI | RequestForgery2.java:64:59:64:61 | uri |
+| RequestForgery2.java:25:23:25:35 | new URI(...) : URI | RequestForgery2.java:67:43:67:45 | uri |
+| RequestForgery2.java:25:31:25:34 | sink : String | RequestForgery2.java:25:23:25:35 | new URI(...) : URI |
+| RequestForgery.java:19:23:19:58 | new URI(...) : URI | RequestForgery.java:22:52:22:54 | uri |
+| RequestForgery.java:19:23:19:58 | new URI(...) : URI | RequestForgery.java:27:57:27:59 | uri |
+| RequestForgery.java:19:31:19:57 | getParameter(...) : String | RequestForgery.java:19:23:19:58 | new URI(...) : URI |
 | RequestForgery.java:19:31:19:57 | getParameter(...) : String | RequestForgery.java:22:52:22:54 | uri |
 | RequestForgery.java:19:31:19:57 | getParameter(...) : String | RequestForgery.java:27:57:27:59 | uri |
 | SpringSSRF.java:26:33:26:60 | getParameter(...) : String | SpringSSRF.java:32:47:32:67 | ... + ... |
@@ -15,13 +22,17 @@ edges
 | SpringSSRF.java:26:33:26:60 | getParameter(...) : String | SpringSSRF.java:45:47:45:60 | fooResourceUrl |
 | SpringSSRF.java:26:33:26:60 | getParameter(...) : String | SpringSSRF.java:54:59:54:72 | fooResourceUrl |
 | SpringSSRF.java:26:33:26:60 | getParameter(...) : String | SpringSSRF.java:58:74:58:96 | new URI(...) |
+| SpringSSRF.java:26:33:26:60 | getParameter(...) : String | SpringSSRF.java:58:82:58:95 | fooResourceUrl : String |
 | SpringSSRF.java:26:33:26:60 | getParameter(...) : String | SpringSSRF.java:62:57:62:70 | fooResourceUrl |
 | SpringSSRF.java:26:33:26:60 | getParameter(...) : String | SpringSSRF.java:66:48:66:61 | fooResourceUrl |
 | SpringSSRF.java:26:33:26:60 | getParameter(...) : String | SpringSSRF.java:69:30:69:43 | fooResourceUrl |
+| SpringSSRF.java:58:82:58:95 | fooResourceUrl : String | SpringSSRF.java:58:74:58:96 | new URI(...) |
 nodes
 | JaxWsSSRF.java:21:22:21:48 | getParameter(...) : String | semmle.label | getParameter(...) : String |
 | JaxWsSSRF.java:22:23:22:25 | url | semmle.label | url |
 | RequestForgery2.java:23:27:23:53 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| RequestForgery2.java:25:23:25:35 | new URI(...) : URI | semmle.label | new URI(...) : URI |
+| RequestForgery2.java:25:31:25:34 | sink : String | semmle.label | sink : String |
 | RequestForgery2.java:55:32:55:35 | url1 | semmle.label | url1 |
 | RequestForgery2.java:58:32:58:35 | url1 | semmle.label | url1 |
 | RequestForgery2.java:59:30:59:33 | url1 | semmle.label | url1 |
@@ -29,6 +40,7 @@ nodes
 | RequestForgery2.java:64:59:64:61 | uri | semmle.label | uri |
 | RequestForgery2.java:67:43:67:45 | uri | semmle.label | uri |
 | RequestForgery2.java:69:29:69:32 | uri2 | semmle.label | uri2 |
+| RequestForgery.java:19:23:19:58 | new URI(...) : URI | semmle.label | new URI(...) : URI |
 | RequestForgery.java:19:31:19:57 | getParameter(...) : String | semmle.label | getParameter(...) : String |
 | RequestForgery.java:22:52:22:54 | uri | semmle.label | uri |
 | RequestForgery.java:27:57:27:59 | uri | semmle.label | uri |
@@ -39,6 +51,7 @@ nodes
 | SpringSSRF.java:45:47:45:60 | fooResourceUrl | semmle.label | fooResourceUrl |
 | SpringSSRF.java:54:59:54:72 | fooResourceUrl | semmle.label | fooResourceUrl |
 | SpringSSRF.java:58:74:58:96 | new URI(...) | semmle.label | new URI(...) |
+| SpringSSRF.java:58:82:58:95 | fooResourceUrl : String | semmle.label | fooResourceUrl : String |
 | SpringSSRF.java:62:57:62:70 | fooResourceUrl | semmle.label | fooResourceUrl |
 | SpringSSRF.java:66:48:66:61 | fooResourceUrl | semmle.label | fooResourceUrl |
 | SpringSSRF.java:69:30:69:43 | fooResourceUrl | semmle.label | fooResourceUrl |
diff --git a/java/ql/test/experimental/stubs/groovy-all-3.0.7/groovy/lang/GroovyClassLoader.java b/java/ql/test/experimental/stubs/groovy-all-3.0.7/groovy/lang/GroovyClassLoader.java
new file mode 100644
index 00000000000..aed97667742
--- /dev/null
+++ b/java/ql/test/experimental/stubs/groovy-all-3.0.7/groovy/lang/GroovyClassLoader.java
@@ -0,0 +1,32 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+package groovy.lang;
+
+public class GroovyClassLoader {
+    public GroovyClassLoader() {
+    }
+
+    public Class parseClass(String text) {
+        return null;
+    }
+
+    public Class parseClass(GroovyCodeSource gcs) {
+        return null;
+    }
+}
diff --git a/java/ql/test/experimental/stubs/groovy-all-3.0.7/groovy/lang/GroovyCodeSource.java b/java/ql/test/experimental/stubs/groovy-all-3.0.7/groovy/lang/GroovyCodeSource.java
new file mode 100644
index 00000000000..901043e5046
--- /dev/null
+++ b/java/ql/test/experimental/stubs/groovy-all-3.0.7/groovy/lang/GroovyCodeSource.java
@@ -0,0 +1,23 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+package groovy.lang;
+
+public class GroovyCodeSource {
+    public GroovyCodeSource(String script, String param1, String param2) {}
+}
diff --git a/java/ql/test/experimental/stubs/groovy-all-3.0.7/groovy/lang/GroovyObject.java b/java/ql/test/experimental/stubs/groovy-all-3.0.7/groovy/lang/GroovyObject.java
new file mode 100644
index 00000000000..1302502a091
--- /dev/null
+++ b/java/ql/test/experimental/stubs/groovy-all-3.0.7/groovy/lang/GroovyObject.java
@@ -0,0 +1,21 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+package groovy.lang;
+
+public interface GroovyObject {}
diff --git a/java/ql/test/experimental/stubs/groovy-all-3.0.7/groovy/lang/GroovyShell.java b/java/ql/test/experimental/stubs/groovy-all-3.0.7/groovy/lang/GroovyShell.java
new file mode 100644
index 00000000000..13df0777e03
--- /dev/null
+++ b/java/ql/test/experimental/stubs/groovy-all-3.0.7/groovy/lang/GroovyShell.java
@@ -0,0 +1,66 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+package groovy.lang;
+
+import java.util.*;
+
+public class GroovyShell {
+
+    public GroovyShell() {}
+
+    public Object evaluate(GroovyCodeSource codeSource) {
+        return null;
+    }
+
+    public Object evaluate(String scriptText) {
+        return null;
+    }
+
+    public Object evaluate(String scriptText, String fileName) {
+        return null;
+    }
+
+    public Object evaluate(String scriptText, final String fileName, final String codeBase) {
+        return null;
+    }
+
+    public Object run(String scriptText, String fileName, List<String> list) {
+        return null;
+    }
+
+    public Object run(String scriptText, String fileName, String[] args) {
+        return null;
+    }
+
+    public Object run(GroovyCodeSource source, List<String> args) {
+        return null;
+    }
+
+    public Object run(GroovyCodeSource source, String[] args) {
+        return null;
+    }
+
+    public Script parse(String scriptText) {
+        return null;
+    }
+
+    public Script parse(final String scriptText, final String fileName) {
+        return null;
+    }
+}
diff --git a/java/ql/test/experimental/stubs/groovy-all-3.0.7/groovy/lang/Script.java b/java/ql/test/experimental/stubs/groovy-all-3.0.7/groovy/lang/Script.java
new file mode 100644
index 00000000000..4a49fc4f904
--- /dev/null
+++ b/java/ql/test/experimental/stubs/groovy-all-3.0.7/groovy/lang/Script.java
@@ -0,0 +1,22 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+package groovy.lang;
+
+public abstract class Script {
+}
\ No newline at end of file
diff --git a/java/ql/test/experimental/stubs/groovy-all-3.0.7/groovy/util/Eval.java b/java/ql/test/experimental/stubs/groovy-all-3.0.7/groovy/util/Eval.java
new file mode 100644
index 00000000000..857ec361e1a
--- /dev/null
+++ b/java/ql/test/experimental/stubs/groovy-all-3.0.7/groovy/util/Eval.java
@@ -0,0 +1,41 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+package groovy.util;
+
+public class Eval {
+    public static Object me(final String expression) {
+        return me(null, null, expression);
+    }
+
+    public static Object me(final String symbol, final Object object, final String expression) {
+        return null;
+    }
+
+    public static Object x(final Object x, final String expression) {
+        return me("x", x, expression);
+    }
+
+    public static Object xy(final Object x, final Object y, final String expression) {
+        return null;
+    }
+
+    public static Object xyz(final Object x, final Object y, final Object z, final String expression) {
+        return null;
+    }
+}
diff --git a/java/ql/test/library-tests/dataflow/external-models/steps.expected b/java/ql/test/library-tests/dataflow/external-models/steps.expected
index f7e0c0fb23e..02548a949c8 100644
--- a/java/ql/test/library-tests/dataflow/external-models/steps.expected
+++ b/java/ql/test/library-tests/dataflow/external-models/steps.expected
@@ -1,10 +1,10 @@
 invalidModelRow
 #select
-| C.java:6:16:6:19 | arg1 | C.java:6:5:6:20 | stepArgRes(...) | qltest |
-| C.java:10:16:10:21 | argIn1 | C.java:10:24:10:30 | argOut1 [post update] | qltest |
-| C.java:13:16:13:21 | argIn2 | C.java:13:24:13:30 | argOut2 [post update] | qltest |
-| C.java:16:17:16:20 | arg2 | C.java:16:5:16:21 | this <.method> [post update] | qltest |
-| C.java:18:22:18:25 | arg3 | C.java:18:5:18:8 | this [post update] | qltest |
-| C.java:20:5:20:8 | this | C.java:20:5:20:22 | stepQualRes(...) | qltest |
-| C.java:21:5:21:17 | this <.method> | C.java:21:5:21:17 | stepQualRes(...) | qltest |
-| C.java:24:5:24:23 | this <.method> | C.java:24:17:24:22 | argOut [post update] | qltest |
+| C.java:6:16:6:19 | arg1 | C.java:6:5:6:20 | stepArgRes(...) |
+| C.java:10:16:10:21 | argIn1 | C.java:10:24:10:30 | argOut1 [post update] |
+| C.java:13:16:13:21 | argIn2 | C.java:13:24:13:30 | argOut2 [post update] |
+| C.java:16:17:16:20 | arg2 | C.java:16:5:16:21 | this <.method> [post update] |
+| C.java:18:22:18:25 | arg3 | C.java:18:5:18:8 | this [post update] |
+| C.java:20:5:20:8 | this | C.java:20:5:20:22 | stepQualRes(...) |
+| C.java:21:5:21:17 | this <.method> | C.java:21:5:21:17 | stepQualRes(...) |
+| C.java:24:5:24:23 | this <.method> | C.java:24:17:24:22 | argOut [post update] |
diff --git a/java/ql/test/library-tests/dataflow/external-models/steps.ql b/java/ql/test/library-tests/dataflow/external-models/steps.ql
index 441d5eeca2b..58edd018587 100644
--- a/java/ql/test/library-tests/dataflow/external-models/steps.ql
+++ b/java/ql/test/library-tests/dataflow/external-models/steps.ql
@@ -1,6 +1,7 @@
 import java
 import semmle.code.java.dataflow.DataFlow
 import semmle.code.java.dataflow.ExternalFlow
+import semmle.code.java.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl
 import CsvValidation
 
 class SummaryModelTest extends SummaryModelCsv {
@@ -8,15 +9,15 @@ class SummaryModelTest extends SummaryModelCsv {
     row =
       [
         //"package;type;overrides;name;signature;ext;inputspec;outputspec;kind",
-        "my.qltest;C;false;stepArgRes;(Object);;Argument[0];ReturnValue;qltest",
-        "my.qltest;C;false;stepArgArg;(Object,Object);;Argument[0];Argument[1];qltest",
-        "my.qltest;C;false;stepArgQual;(Object);;Argument[0];Argument[-1];qltest",
-        "my.qltest;C;false;stepQualRes;();;Argument[-1];ReturnValue;qltest",
-        "my.qltest;C;false;stepQualArg;(Object);;Argument[-1];Argument[0];qltest"
+        "my.qltest;C;false;stepArgRes;(Object);;Argument[0];ReturnValue;taint",
+        "my.qltest;C;false;stepArgArg;(Object,Object);;Argument[0];Argument[1];taint",
+        "my.qltest;C;false;stepArgQual;(Object);;Argument[0];Argument[-1];taint",
+        "my.qltest;C;false;stepQualRes;();;Argument[-1];ReturnValue;taint",
+        "my.qltest;C;false;stepQualArg;(Object);;Argument[-1];Argument[0];taint"
       ]
   }
 }
 
-from DataFlow::Node node1, DataFlow::Node node2, string kind
-where summaryStep(node1, node2, kind)
-select node1, node2, kind
+from DataFlow::Node node1, DataFlow::Node node2
+where FlowSummaryImpl::Private::Steps::summaryThroughStep(node1, node2, false)
+select node1, node2
diff --git a/java/ql/test/library-tests/dataflow/lambda/Executor.java b/java/ql/test/library-tests/dataflow/lambda/Executor.java
new file mode 100644
index 00000000000..93f5e04221d
--- /dev/null
+++ b/java/ql/test/library-tests/dataflow/lambda/Executor.java
@@ -0,0 +1,63 @@
+import java.lang.Runtime;
+import java.util.function.Function;
+
+public class Executor {
+
+    private static final Processor<String> processor = new Processor<String>();
+
+    private static String source() { return "taint"; }
+
+    public static void main(String[] args) {
+        exec1(source());
+        exec2(source());
+        exec3(source());
+        exec4(source());
+        exec5(source());
+    }
+
+    private static void exec1(String command){
+        command = process(s->s.toUpperCase(),command);
+        exec(command);
+    }
+
+    private static void exec2(String command){
+        command = process(s->"Taint stops here.",command);
+        exec(command);
+    }
+
+    private static void exec3(String command){
+        command = processor.process(s->s.toUpperCase(),command);
+        exec(command);
+    }
+
+    private static void exec4(String command){
+        command = processor.process(s->"Taint stops here.",command);
+        exec_b(command);
+    }
+
+    private static void exec5(String command){
+        command = processor.process(s->s.toUpperCase(),command);
+        exec_b(command);
+    }
+
+    public static String process(Function<String, String> fun, String command){
+        return processor.process(fun, command);
+    }
+
+    private static void exec(String command){
+        command = process(s->s.trim(),command);
+        try {
+            Runtime.getRuntime().exec(command);
+        }
+        catch(Exception e) {}
+    }
+
+    private static void exec_b(String command){
+        command = processor.process(s->s.trim(),command);
+        try {
+            Runtime.getRuntime().exec(command);
+        }
+        catch(Exception e) {}
+    }
+}
+
diff --git a/java/ql/test/library-tests/dataflow/lambda/Processor.java b/java/ql/test/library-tests/dataflow/lambda/Processor.java
new file mode 100644
index 00000000000..c632519041c
--- /dev/null
+++ b/java/ql/test/library-tests/dataflow/lambda/Processor.java
@@ -0,0 +1,9 @@
+import java.util.function.Function;
+
+public class Processor<T> {
+
+    public <R> R process(Function<T,R> function, T arg) {
+        return function.apply(arg);
+    }
+}
+
diff --git a/java/ql/test/library-tests/dataflow/lambda/StringProcessor.java b/java/ql/test/library-tests/dataflow/lambda/StringProcessor.java
new file mode 100644
index 00000000000..abe92ce5ca7
--- /dev/null
+++ b/java/ql/test/library-tests/dataflow/lambda/StringProcessor.java
@@ -0,0 +1,30 @@
+import java.util.function.Function;
+
+public class StringProcessor {
+
+    private static final Processor<String> processor = new Processor<String>();
+
+    public static void main(String[] args) {
+        String command = args[0];  
+        lambdaExec(command);
+    }
+
+    public static void lambdaExec(String command){
+        processor.process(s->exec(s), command);
+    }
+
+    public static String lambdaUnrelated(String command){
+        return processor.process(s->s+"not related to anything", command);
+    }
+
+    public static String exec(String command){
+        try {
+            command = processor.process(s->s.trim(), command);
+            Runtime.getRuntime().exec(command);
+            return "Executed: "+command;
+        } catch(Exception e) {
+            return null;
+        }
+    } 
+}
+
diff --git a/java/ql/test/library-tests/dataflow/lambda/flow.expected b/java/ql/test/library-tests/dataflow/lambda/flow.expected
new file mode 100644
index 00000000000..3b467de204b
--- /dev/null
+++ b/java/ql/test/library-tests/dataflow/lambda/flow.expected
@@ -0,0 +1,8 @@
+| Executor.java:11:15:11:22 | source(...) | Executor.java:50:39:50:45 | command |
+| Executor.java:11:15:11:22 | source(...) | StringProcessor.java:23:39:23:45 | command |
+| Executor.java:12:15:12:22 | source(...) | Executor.java:50:39:50:45 | command |
+| Executor.java:12:15:12:22 | source(...) | StringProcessor.java:23:39:23:45 | command |
+| Executor.java:13:15:13:22 | source(...) | Executor.java:50:39:50:45 | command |
+| Executor.java:13:15:13:22 | source(...) | StringProcessor.java:23:39:23:45 | command |
+| Executor.java:15:15:15:22 | source(...) | Executor.java:58:39:58:45 | command |
+| StringProcessor.java:8:26:8:29 | args | StringProcessor.java:23:39:23:45 | command |
diff --git a/java/ql/test/library-tests/dataflow/lambda/flow.ql b/java/ql/test/library-tests/dataflow/lambda/flow.ql
new file mode 100644
index 00000000000..dc8d1c7d4b0
--- /dev/null
+++ b/java/ql/test/library-tests/dataflow/lambda/flow.ql
@@ -0,0 +1,24 @@
+import java
+import semmle.code.java.dataflow.TaintTracking
+
+class Conf extends TaintTracking::Configuration {
+  Conf() { this = "qltest lambda" }
+
+  override predicate isSource(DataFlow::Node src) {
+    src.asExpr().(VarAccess).getVariable().hasName("args")
+    or
+    src.asExpr().(MethodAccess).getMethod().hasName("source")
+  }
+
+  override predicate isSink(DataFlow::Node sink) {
+    sink.asExpr().(Argument).getCall() =
+      any(MethodAccess ma |
+        ma.getMethod().hasName("exec") and
+        ma.getQualifier().(MethodAccess).getMethod().hasName("getRuntime")
+      )
+  }
+}
+
+from DataFlow::Node src, DataFlow::Node sink, Conf c
+where c.hasFlow(src, sink)
+select src, sink
diff --git a/java/ql/test/library-tests/dataflow/local-additional-taint/localAdditionalTaintStep.ql b/java/ql/test/library-tests/dataflow/local-additional-taint/localAdditionalTaintStep.ql
index e8cd912e58a..1520ea7347d 100644
--- a/java/ql/test/library-tests/dataflow/local-additional-taint/localAdditionalTaintStep.ql
+++ b/java/ql/test/library-tests/dataflow/local-additional-taint/localAdditionalTaintStep.ql
@@ -1,6 +1,12 @@
 import semmle.code.java.dataflow.DataFlow
 import semmle.code.java.dataflow.internal.TaintTrackingUtil
+import semmle.code.java.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl
 
 from DataFlow::Node src, DataFlow::Node sink
-where localAdditionalTaintStep(src, sink)
+where
+  (
+    localAdditionalTaintStep(src, sink) or
+    FlowSummaryImpl::Private::Steps::summaryThroughStep(src, sink, false)
+  ) and
+  not FlowSummaryImpl::Private::Steps::summaryLocalStep(src, sink, false)
 select src, sink
diff --git a/java/ql/test/library-tests/dataflow/records/options b/java/ql/test/library-tests/dataflow/records/options
index 81817b37785..fc57fe025b9 100644
--- a/java/ql/test/library-tests/dataflow/records/options
+++ b/java/ql/test/library-tests/dataflow/records/options
@@ -1 +1 @@
-//semmle-extractor-options: --javac-args --enable-preview -source 15 -target 15
+//semmle-extractor-options: --javac-args -source 16 -target 16
diff --git a/java/ql/test/library-tests/dataflow/taint-format/options b/java/ql/test/library-tests/dataflow/taint-format/options
deleted file mode 100644
index 81817b37785..00000000000
--- a/java/ql/test/library-tests/dataflow/taint-format/options
+++ /dev/null
@@ -1 +0,0 @@
-//semmle-extractor-options: --javac-args --enable-preview -source 15 -target 15
diff --git a/java/ql/test/library-tests/frameworks/apache-commons-lang3/ArrayUtilsTest.java b/java/ql/test/library-tests/frameworks/apache-commons-lang3/ArrayUtilsTest.java
new file mode 100644
index 00000000000..73773a8d61c
--- /dev/null
+++ b/java/ql/test/library-tests/frameworks/apache-commons-lang3/ArrayUtilsTest.java
@@ -0,0 +1,75 @@
+import org.apache.commons.lang3.ArrayUtils;
+import java.io.StringReader;
+import java.nio.CharBuffer;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Locale;
+
+class ArrayUtilsTest {
+    String taint() { return "tainted"; }
+
+    private static class IntSource {
+      static int taint() { return 0; }
+    }
+
+    void sink(Object o) {}
+
+    void test() throws Exception {
+
+      // All methods of this class copy the input array, so the incoming array should not be assigned taint.
+      String[] alreadyTainted = new String[] { taint() };
+      String[] clean = new String[] { "Untainted" };
+
+      sink(ArrayUtils.add(clean, 0, taint())); // $hasTaintFlow
+      sink(ArrayUtils.add(alreadyTainted, 0, "clean")); // $hasTaintFlow
+      sink(ArrayUtils.add(clean, IntSource.taint(), "clean")); // Index argument does not contribute taint
+      sink(ArrayUtils.add(clean, taint())); // $hasTaintFlow
+      sink(ArrayUtils.add(alreadyTainted, "clean")); // $hasTaintFlow
+      sink(ArrayUtils.addAll(clean, "clean", taint())); // $hasTaintFlow
+      sink(ArrayUtils.addAll(clean, taint(), "clean")); // $hasTaintFlow
+      sink(ArrayUtils.addAll(alreadyTainted, "clean", "also clean")); // $hasTaintFlow
+      sink(ArrayUtils.addFirst(clean, taint())); // $hasTaintFlow
+      sink(ArrayUtils.addFirst(alreadyTainted, "clean")); // $hasTaintFlow
+      sink(ArrayUtils.clone(alreadyTainted)); // $hasTaintFlow
+      sink(ArrayUtils.get(alreadyTainted, 0)); // $hasTaintFlow
+      sink(ArrayUtils.get(clean, IntSource.taint())); // Index argument does not contribute taint
+      sink(ArrayUtils.get(alreadyTainted, 0, "default value")); // $hasTaintFlow
+      sink(ArrayUtils.get(clean, IntSource.taint(), "default value")); // Index argument does not contribute taint
+      sink(ArrayUtils.get(clean, 0, taint())); // $hasTaintFlow
+      sink(ArrayUtils.insert(IntSource.taint(), clean, "value1", "value2")); // Index argument does not contribute taint
+      sink(ArrayUtils.insert(0, alreadyTainted, "value1", "value2")); // $hasTaintFlow
+      sink(ArrayUtils.insert(0, clean, taint(), "value2")); // $hasTaintFlow
+      sink(ArrayUtils.insert(0, clean, "value1", taint())); // $hasTaintFlow
+      sink(ArrayUtils.nullToEmpty(alreadyTainted)); // $hasTaintFlow
+      sink(ArrayUtils.nullToEmpty(alreadyTainted, String[].class)); // $hasTaintFlow
+      sink(ArrayUtils.remove(alreadyTainted, 0)); // $hasTaintFlow
+      sink(ArrayUtils.remove(clean, IntSource.taint())); // Index argument does not contribute taint
+      sink(ArrayUtils.removeAll(alreadyTainted, 0, 1)); // $hasTaintFlow
+      sink(ArrayUtils.removeAll(clean, IntSource.taint(), 1)); // Index argument does not contribute taint
+      sink(ArrayUtils.removeAll(clean, 0, IntSource.taint())); // Index argument does not contribute taint
+      sink(ArrayUtils.removeAllOccurences(clean, taint())); // Removed argument does not contribute taint
+      sink(ArrayUtils.removeAllOccurences(alreadyTainted, "value to remove")); // $hasTaintFlow
+      sink(ArrayUtils.removeAllOccurrences(clean, taint())); // Removed argument does not contribute taint
+      sink(ArrayUtils.removeAllOccurrences(alreadyTainted, "value to remove")); // $hasTaintFlow
+      sink(ArrayUtils.removeElement(clean, taint())); // Removed argument does not contribute taint
+      sink(ArrayUtils.removeElement(alreadyTainted, "value to remove")); // $hasTaintFlow
+      sink(ArrayUtils.removeElements(alreadyTainted, 0, 1)); // $hasTaintFlow
+      sink(ArrayUtils.removeElements(clean, IntSource.taint(), 1)); // Index argument does not contribute taint
+      sink(ArrayUtils.removeElements(clean, 0, IntSource.taint())); // Index argument does not contribute taint
+      sink(ArrayUtils.subarray(alreadyTainted, 0, 0)); // $hasTaintFlow
+      sink(ArrayUtils.subarray(clean, IntSource.taint(), IntSource.taint())); // Index arguments do not contribute taint
+      sink(ArrayUtils.toArray("clean", taint())); // $hasTaintFlow
+      sink(ArrayUtils.toArray(taint(), "clean")); // $hasTaintFlow
+      sink(ArrayUtils.toMap(alreadyTainted).get("key")); // $hasTaintFlow
+
+      // Check that none of the above had an effect on `clean`:
+      sink(clean);
+
+      int[] taintedInts = new int[] { IntSource.taint() };
+      Integer[] taintedBoxedInts = ArrayUtils.toObject(taintedInts);
+      sink(taintedBoxedInts); // $hasTaintFlow
+      sink(ArrayUtils.toPrimitive(taintedBoxedInts)); // $hasTaintFlow
+      sink(ArrayUtils.toPrimitive(new Integer[] {}, IntSource.taint())); // $hasTaintFlow
+
+    }
+  }
\ No newline at end of file
diff --git a/java/ql/test/library-tests/frameworks/apache-commons-lang3/ObjectUtilsTest.java b/java/ql/test/library-tests/frameworks/apache-commons-lang3/ObjectUtilsTest.java
index d586b887290..58ee4d262e6 100644
--- a/java/ql/test/library-tests/frameworks/apache-commons-lang3/ObjectUtilsTest.java
+++ b/java/ql/test/library-tests/frameworks/apache-commons-lang3/ObjectUtilsTest.java
@@ -17,22 +17,22 @@ public class ObjectUtilsTest {
     sink(ObjectUtils.CONST_BYTE(IntSource.taint())); // $hasValueFlow
     sink(ObjectUtils.defaultIfNull(taint(), null)); // $hasValueFlow
     sink(ObjectUtils.defaultIfNull(null, taint())); // $hasValueFlow
-    sink(ObjectUtils.firstNonNull(taint(), null, null)); // $hasTaintFlow $MISSING:hasValueFlow
-    sink(ObjectUtils.firstNonNull(null, taint(), null)); // $hasTaintFlow $MISSING:hasValueFlow
-    sink(ObjectUtils.firstNonNull(null, null, taint())); // $hasTaintFlow $MISSING:hasValueFlow
+    sink(ObjectUtils.firstNonNull(taint(), null, null)); // $ MISSING:hasValueFlow
+    sink(ObjectUtils.firstNonNull(null, taint(), null)); // $ MISSING:hasValueFlow
+    sink(ObjectUtils.firstNonNull(null, null, taint())); // $ MISSING:hasValueFlow
     sink(ObjectUtils.getIfNull(taint(), null)); // $hasValueFlow
-    sink(ObjectUtils.max(taint(), null, null)); // $hasTaintFlow $MISSING:hasValueFlow
-    sink(ObjectUtils.max(null, taint(), null)); // $hasTaintFlow $MISSING:hasValueFlow
-    sink(ObjectUtils.max(null, null, taint())); // $hasTaintFlow $MISSING:hasValueFlow
-    sink(ObjectUtils.median(taint(), null, null)); // $hasTaintFlow $MISSING:hasValueFlow
-    sink(ObjectUtils.median((String)null, taint(), null)); // $hasTaintFlow $MISSING:hasValueFlow
-    sink(ObjectUtils.median((String)null, null, taint())); // $hasTaintFlow $MISSING:hasValueFlow
-    sink(ObjectUtils.min(taint(), null, null)); // $hasTaintFlow $MISSING:hasValueFlow
-    sink(ObjectUtils.min(null, taint(), null)); // $hasTaintFlow $MISSING:hasValueFlow
-    sink(ObjectUtils.min(null, null, taint())); // $hasTaintFlow $MISSING:hasValueFlow
-    sink(ObjectUtils.mode(taint(), null, null)); // $hasTaintFlow $MISSING:hasValueFlow
-    sink(ObjectUtils.mode(null, taint(), null)); // $hasTaintFlow $MISSING:hasValueFlow
-    sink(ObjectUtils.mode(null, null, taint())); // $hasTaintFlow $MISSING:hasValueFlow
+    sink(ObjectUtils.max(taint(), null, null)); // $ MISSING:hasValueFlow
+    sink(ObjectUtils.max(null, taint(), null)); // $ MISSING:hasValueFlow
+    sink(ObjectUtils.max(null, null, taint())); // $ MISSING:hasValueFlow
+    sink(ObjectUtils.median(taint(), null, null)); // $ MISSING:hasValueFlow
+    sink(ObjectUtils.median((String)null, taint(), null)); // $ MISSING:hasValueFlow
+    sink(ObjectUtils.median((String)null, null, taint())); // $ MISSING:hasValueFlow
+    sink(ObjectUtils.min(taint(), null, null)); // $ MISSING:hasValueFlow
+    sink(ObjectUtils.min(null, taint(), null)); // $ MISSING:hasValueFlow
+    sink(ObjectUtils.min(null, null, taint())); // $ MISSING:hasValueFlow
+    sink(ObjectUtils.mode(taint(), null, null)); // $ MISSING:hasValueFlow
+    sink(ObjectUtils.mode(null, taint(), null)); // $ MISSING:hasValueFlow
+    sink(ObjectUtils.mode(null, null, taint())); // $ MISSING:hasValueFlow
     sink(ObjectUtils.requireNonEmpty(taint(), "message")); // $hasValueFlow
     sink(ObjectUtils.requireNonEmpty("not null", taint())); // GOOD (message doesn't propagate to the return)
     sink(ObjectUtils.toString(taint(), "default string")); // GOOD (first argument is stringified)
diff --git a/java/ql/test/library-tests/frameworks/guava/TestBase.java b/java/ql/test/library-tests/frameworks/guava/TestBase.java
index c2c3beecdf2..9ce907f4551 100644
--- a/java/ql/test/library-tests/frameworks/guava/TestBase.java
+++ b/java/ql/test/library-tests/frameworks/guava/TestBase.java
@@ -18,7 +18,7 @@ class TestBase {
         sink(Strings.lenientFormat(x, 3)); // $numTaintFlow=1
         sink(Strings.commonPrefix(x, "abc")); 
         sink(Strings.commonSuffix(x, "cde")); 
-        sink(Strings.lenientFormat("%s = %s", x, 3)); // $numTaintFlow=1
+        sink(Strings.lenientFormat("%s = %s", x, 3)); // $ MISSING:numTaintFlow=1
     }
 
     void test2() {
@@ -60,4 +60,4 @@ class TestBase {
     void test4() {
         sink(Preconditions.checkNotNull(taint())); // $numTaintFlow=1
     }
-}
\ No newline at end of file
+}
diff --git a/java/ql/test/library-tests/literals-numeric/NumericLiterals.java b/java/ql/test/library-tests/literals-numeric/NumericLiterals.java
new file mode 100644
index 00000000000..02f2fbfcc6b
--- /dev/null
+++ b/java/ql/test/library-tests/literals-numeric/NumericLiterals.java
@@ -0,0 +1,16 @@
+class NumericLiterals {    
+	void negativeLiterals() {
+		float f = -1f;
+		double d = -1d;
+		int i1 = -2147483647;
+		int i2 = -2147483648; // CodeQL models minus as part of literal
+		int i3 = -0b10000000000000000000000000000000; // binary
+		int i4 = -020000000000; // octal
+		int i5 = -0x80000000; // hex
+		long l1 = -9223372036854775807L;
+		long l2 = -9223372036854775808L; // CodeQL models minus as part of literal
+		long l3 = -0b1000000000000000000000000000000000000000000000000000000000000000L; // binary
+		long l4 = -01000000000000000000000L; // octal
+		long l5 = -0x8000000000000000L; // hex
+	}
+}
diff --git a/java/ql/test/library-tests/literals-numeric/negativeNumericLiteral.expected b/java/ql/test/library-tests/literals-numeric/negativeNumericLiteral.expected
new file mode 100644
index 00000000000..95100f259dd
--- /dev/null
+++ b/java/ql/test/library-tests/literals-numeric/negativeNumericLiteral.expected
@@ -0,0 +1,12 @@
+| NumericLiterals.java:3:14:3:15 | 1f | 1.0 | NumericLiterals.java:3:13:3:15 | -... |
+| NumericLiterals.java:4:15:4:16 | 1d | 1.0 | NumericLiterals.java:4:14:4:16 | -... |
+| NumericLiterals.java:5:13:5:22 | 2147483647 | 2147483647 | NumericLiterals.java:5:12:5:22 | -... |
+| NumericLiterals.java:6:12:6:22 | -2147483648 | -2147483648 | NumericLiterals.java:6:7:6:22 | i2 |
+| NumericLiterals.java:7:13:7:46 | 0b10000000000000000000000000000000 | -2147483648 | NumericLiterals.java:7:12:7:46 | -... |
+| NumericLiterals.java:8:13:8:24 | 020000000000 | -2147483648 | NumericLiterals.java:8:12:8:24 | -... |
+| NumericLiterals.java:9:13:9:22 | 0x80000000 | -2147483648 | NumericLiterals.java:9:12:9:22 | -... |
+| NumericLiterals.java:10:14:10:33 | 9223372036854775807L | 9223372036854775807 | NumericLiterals.java:10:13:10:33 | -... |
+| NumericLiterals.java:11:13:11:33 | -9223372036854775808L | -9223372036854775808 | NumericLiterals.java:11:8:11:33 | l2 |
+| NumericLiterals.java:12:14:12:80 | 0b1000000000000000000000000000000000000000000000000000000000000000L | -9223372036854775808 | NumericLiterals.java:12:13:12:80 | -... |
+| NumericLiterals.java:13:14:13:37 | 01000000000000000000000L | -9223372036854775808 | NumericLiterals.java:13:13:13:37 | -... |
+| NumericLiterals.java:14:14:14:32 | 0x8000000000000000L | -9223372036854775808 | NumericLiterals.java:14:13:14:32 | -... |
diff --git a/java/ql/test/library-tests/literals-numeric/negativeNumericLiteral.ql b/java/ql/test/library-tests/literals-numeric/negativeNumericLiteral.ql
new file mode 100644
index 00000000000..0fbb3989c7a
--- /dev/null
+++ b/java/ql/test/library-tests/literals-numeric/negativeNumericLiteral.ql
@@ -0,0 +1,9 @@
+import java
+
+from Literal l
+where
+  l instanceof IntegerLiteral or
+  l instanceof LongLiteral or
+  l instanceof FloatingPointLiteral or
+  l instanceof DoubleLiteral
+select l, l.getValue(), l.getParent()
diff --git a/java/ql/test/library-tests/literals/literalBoolean.expected b/java/ql/test/library-tests/literals/literalBoolean.expected
index 73460f4206b..bfc9f1a043f 100644
--- a/java/ql/test/library-tests/literals/literalBoolean.expected
+++ b/java/ql/test/library-tests/literals/literalBoolean.expected
@@ -1 +1,3 @@
-| literals/Literals.java:11:22:11:25 | true |
\ No newline at end of file
+| literals/Literals.java:11:22:11:25 | true | true | true |
+| literals/Literals.java:16:3:16:6 | true | true | true |
+| literals/Literals.java:17:3:17:7 | false | false | false |
diff --git a/java/ql/test/library-tests/literals/literalBoolean.ql b/java/ql/test/library-tests/literals/literalBoolean.ql
index bddc59b40a2..811d0a9aae8 100644
--- a/java/ql/test/library-tests/literals/literalBoolean.ql
+++ b/java/ql/test/library-tests/literals/literalBoolean.ql
@@ -2,4 +2,4 @@ import semmle.code.java.Expr
 
 from BooleanLiteral lit
 where lit.getCompilationUnit().fromSource()
-select lit
+select lit, lit.getValue(), lit.getBooleanValue()
diff --git a/java/ql/test/library-tests/literals/literalChar.expected b/java/ql/test/library-tests/literals/literalChar.expected
index c6ab2b79a5e..00eb45eff57 100644
--- a/java/ql/test/library-tests/literals/literalChar.expected
+++ b/java/ql/test/library-tests/literals/literalChar.expected
@@ -1 +1,10 @@
-| literals/Literals.java:12:22:12:24 | 'x' |
+| literals/Literals.java:12:22:12:24 | 'x' | x |
+| literals/Literals.java:21:3:21:5 | 'a' | a |
+| literals/Literals.java:22:3:22:10 | '\\u0061' | a |
+| literals/Literals.java:23:3:23:10 | '\\u0000' | \u0000 |
+| literals/Literals.java:24:3:24:6 | '\\0' | \u0000 |
+| literals/Literals.java:25:3:25:6 | '\\n' | \n |
+| literals/Literals.java:26:3:26:6 | '\\0' | \u0000 |
+| literals/Literals.java:27:3:27:6 | '\\\\' | \\ |
+| literals/Literals.java:28:3:28:6 | '\\'' | ' |
+| literals/Literals.java:29:3:29:8 | '\\123' | S |
diff --git a/java/ql/test/library-tests/literals/literalChar.ql b/java/ql/test/library-tests/literals/literalChar.ql
index 2253c5bb21e..104e2c03dc4 100644
--- a/java/ql/test/library-tests/literals/literalChar.ql
+++ b/java/ql/test/library-tests/literals/literalChar.ql
@@ -1,4 +1,4 @@
 import semmle.code.java.Expr
 
 from CharacterLiteral lit
-select lit
+select lit, lit.getValue()
diff --git a/java/ql/test/library-tests/literals/literalDouble.expected b/java/ql/test/library-tests/literals/literalDouble.expected
index 8a6d6e3e483..ba64bdd8446 100644
--- a/java/ql/test/library-tests/literals/literalDouble.expected
+++ b/java/ql/test/library-tests/literals/literalDouble.expected
@@ -1 +1,16 @@
-| literals/Literals.java:10:22:10:27 | 456.0D |
+| literals/Literals.java:10:22:10:27 | 456.0D | 456.0 | 456.0 |
+| literals/Literals.java:33:3:33:5 | 0.0 | 0.0 | 0.0 |
+| literals/Literals.java:34:3:34:4 | 0d | 0.0 | 0.0 |
+| literals/Literals.java:35:3:35:5 | .0d | 0.0 | 0.0 |
+| literals/Literals.java:36:3:36:4 | .0 | 0.0 | 0.0 |
+| literals/Literals.java:37:4:37:6 | 0.d | 0.0 | 0.0 |
+| literals/Literals.java:38:4:38:6 | 0.d | 0.0 | 0.0 |
+| literals/Literals.java:39:3:39:22 | 1.234567890123456789 | 1.2345678901234567 | 1.2345678901234567 |
+| literals/Literals.java:40:3:40:24 | 1.55555555555555555555 | 1.5555555555555556 | 1.5555555555555556 |
+| literals/Literals.java:42:3:42:5 | 1e1 | 10.0 | 10.0 |
+| literals/Literals.java:43:3:43:24 | 1.7976931348623157E308 | 1.7976931348623157E308 | 1.7976931348623157E308 |
+| literals/Literals.java:44:4:44:25 | 1.7976931348623157E308 | 1.7976931348623157E308 | 1.7976931348623157E308 |
+| literals/Literals.java:45:3:45:28 | 0x1.f_ffff_ffff_ffffP+1023 | 1.7976931348623157E308 | 1.7976931348623157E308 |
+| literals/Literals.java:46:3:46:10 | 4.9e-324 | 4.9E-324 | 4.9E-324 |
+| literals/Literals.java:47:3:47:28 | 0x0.0_0000_0000_0001P-1022 | 4.9E-324 | 4.9E-324 |
+| literals/Literals.java:48:3:48:13 | 0x1.0P-1074 | 4.9E-324 | 4.9E-324 |
diff --git a/java/ql/test/library-tests/literals/literalDouble.ql b/java/ql/test/library-tests/literals/literalDouble.ql
index 28c30eb439b..a3766e9676c 100644
--- a/java/ql/test/library-tests/literals/literalDouble.ql
+++ b/java/ql/test/library-tests/literals/literalDouble.ql
@@ -1,4 +1,4 @@
 import semmle.code.java.Expr
 
 from DoubleLiteral lit
-select lit
+select lit, lit.getValue(), lit.getDoubleValue()
diff --git a/java/ql/test/library-tests/literals/literalFloat.expected b/java/ql/test/library-tests/literals/literalFloat.expected
index d421532944b..f6221533fdb 100644
--- a/java/ql/test/library-tests/literals/literalFloat.expected
+++ b/java/ql/test/library-tests/literals/literalFloat.expected
@@ -1 +1,16 @@
-| literals/Literals.java:9:22:9:27 | 123.0F |
+| literals/Literals.java:9:22:9:27 | 123.0F | 123.0 | 123.0 |
+| literals/Literals.java:52:3:52:6 | 0.0f | 0.0 | 0.0 |
+| literals/Literals.java:53:3:53:4 | 0f | 0.0 | 0.0 |
+| literals/Literals.java:54:3:54:5 | .0f | 0.0 | 0.0 |
+| literals/Literals.java:55:4:55:6 | 0.f | 0.0 | 0.0 |
+| literals/Literals.java:56:4:56:6 | 0.f | 0.0 | 0.0 |
+| literals/Literals.java:57:3:57:10 | 1_0_0.0f | 100.0 | 100.0 |
+| literals/Literals.java:58:3:58:23 | 1.234567890123456789f | 1.2345679 | 1.2345679 |
+| literals/Literals.java:59:3:59:25 | 1.55555555555555555555f | 1.5555556 | 1.5555556 |
+| literals/Literals.java:61:3:61:6 | 1e1f | 10.0 | 10.0 |
+| literals/Literals.java:62:3:62:15 | 3.4028235e38f | 3.4028235E38 | 3.4028235E38 |
+| literals/Literals.java:63:4:63:16 | 3.4028235e38f | 3.4028235E38 | 3.4028235E38 |
+| literals/Literals.java:64:3:64:18 | 0x1.fffffeP+127f | 3.4028235E38 | 3.4028235E38 |
+| literals/Literals.java:65:3:65:10 | 1.4e-45f | 1.4E-45 | 1.4E-45 |
+| literals/Literals.java:66:3:66:18 | 0x0.000002P-126f | 1.4E-45 | 1.4E-45 |
+| literals/Literals.java:67:3:67:13 | 0x1.0P-149f | 1.4E-45 | 1.4E-45 |
diff --git a/java/ql/test/library-tests/literals/literalFloat.ql b/java/ql/test/library-tests/literals/literalFloat.ql
index e9d18be607a..6a4a9093225 100644
--- a/java/ql/test/library-tests/literals/literalFloat.ql
+++ b/java/ql/test/library-tests/literals/literalFloat.ql
@@ -1,4 +1,4 @@
 import semmle.code.java.Expr
 
 from FloatingPointLiteral lit
-select lit
+select lit, lit.getValue(), lit.getFloatValue()
diff --git a/java/ql/test/library-tests/literals/literalInteger.expected b/java/ql/test/library-tests/literals/literalInteger.expected
index 1f31642509a..40c6a89cd98 100644
--- a/java/ql/test/library-tests/literals/literalInteger.expected
+++ b/java/ql/test/library-tests/literals/literalInteger.expected
@@ -1,8 +1,20 @@
-| literals/Literals.java:7:22:7:24 | 123 |
-| literals/Literals.java:14:16:14:26 | -2147483648 |
-| literals/Literals.java:16:21:16:30 | 2147483647 |
-| literals/Literals.java:18:20:18:29 | 0x80000000 |
-| literals/Literals.java:20:10:20:11 | 23 |
-| literals/Literals.java:20:15:20:16 | 19 |
-| literals/Literals.java:21:10:21:11 | 23 |
-| literals/Literals.java:21:15:21:16 | 19 |
+| literals/Literals.java:7:22:7:24 | 123 | 123 | 123 |
+| literals/Literals.java:71:3:71:3 | 0 | 0 | 0 |
+| literals/Literals.java:72:3:72:5 | 0_0 | 0 | 0 |
+| literals/Literals.java:73:3:73:7 | 0___0 | 0 | 0 |
+| literals/Literals.java:74:3:74:6 | 0_12 | 10 | 10 |
+| literals/Literals.java:75:3:75:7 | 0X012 | 18 | 18 |
+| literals/Literals.java:76:3:76:10 | 0xaBcDeF | 11259375 | 11259375 |
+| literals/Literals.java:77:3:77:6 | 0B11 | 3 | 3 |
+| literals/Literals.java:78:3:78:12 | 0x80000000 | -2147483648 | -2147483648 |
+| literals/Literals.java:79:3:79:12 | 2147483647 | 2147483647 | 2147483647 |
+| literals/Literals.java:80:3:80:13 | -2147483648 | -2147483648 | -2147483648 |
+| literals/Literals.java:82:3:82:13 | 0x7fff_ffff | 2147483647 | 2147483647 |
+| literals/Literals.java:83:3:83:16 | 0177_7777_7777 | 2147483647 | 2147483647 |
+| literals/Literals.java:84:3:84:43 | 0b0111_1111_1111_1111_1111_1111_1111_1111 | 2147483647 | 2147483647 |
+| literals/Literals.java:85:3:85:13 | 0x8000_0000 | -2147483648 | -2147483648 |
+| literals/Literals.java:86:3:86:16 | 0200_0000_0000 | -2147483648 | -2147483648 |
+| literals/Literals.java:87:3:87:43 | 0b1000_0000_0000_0000_0000_0000_0000_0000 | -2147483648 | -2147483648 |
+| literals/Literals.java:88:3:88:13 | 0xffff_ffff | -1 | -1 |
+| literals/Literals.java:89:3:89:16 | 0377_7777_7777 | -1 | -1 |
+| literals/Literals.java:90:3:90:43 | 0b1111_1111_1111_1111_1111_1111_1111_1111 | -1 | -1 |
diff --git a/java/ql/test/library-tests/literals/literalInteger.ql b/java/ql/test/library-tests/literals/literalInteger.ql
index b654370a192..264f5b77b99 100644
--- a/java/ql/test/library-tests/literals/literalInteger.ql
+++ b/java/ql/test/library-tests/literals/literalInteger.ql
@@ -1,4 +1,4 @@
 import semmle.code.java.Expr
 
 from IntegerLiteral lit
-select lit
+select lit, lit.getValue(), lit.getIntValue()
diff --git a/java/ql/test/library-tests/literals/literalLong.expected b/java/ql/test/library-tests/literals/literalLong.expected
index 4caf96df7cb..f46c55f9f37 100644
--- a/java/ql/test/library-tests/literals/literalLong.expected
+++ b/java/ql/test/library-tests/literals/literalLong.expected
@@ -1,4 +1,20 @@
-| literals/Literals.java:8:22:8:25 | 456L |
-| literals/Literals.java:15:18:15:38 | -9223372036854775808l |
-| literals/Literals.java:17:23:17:42 | 9223372036854775807l |
-| literals/Literals.java:19:22:19:40 | 0x8000000000000000L |
+| literals/Literals.java:8:22:8:25 | 456L | 456 |
+| literals/Literals.java:94:3:94:4 | 0l | 0 |
+| literals/Literals.java:95:3:95:4 | 0L | 0 |
+| literals/Literals.java:96:3:96:6 | 0_0L | 0 |
+| literals/Literals.java:97:3:97:8 | 0___0L | 0 |
+| literals/Literals.java:98:3:98:7 | 0_12L | 10 |
+| literals/Literals.java:99:3:99:8 | 0X012L | 18 |
+| literals/Literals.java:100:3:100:11 | 0xaBcDeFL | 11259375 |
+| literals/Literals.java:101:3:101:7 | 0B11L | 3 |
+| literals/Literals.java:102:3:102:22 | 9223372036854775807L | 9223372036854775807 |
+| literals/Literals.java:103:3:103:23 | -9223372036854775808L | -9223372036854775808 |
+| literals/Literals.java:105:3:105:24 | 0x7fff_ffff_ffff_ffffL | 9223372036854775807 |
+| literals/Literals.java:106:3:106:30 | 07_7777_7777_7777_7777_7777L | 9223372036854775807 |
+| literals/Literals.java:107:3:107:84 | 0b0111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111L | 9223372036854775807 |
+| literals/Literals.java:108:3:108:24 | 0x8000_0000_0000_0000L | -9223372036854775808 |
+| literals/Literals.java:109:3:109:31 | 010_0000_0000_0000_0000_0000L | -9223372036854775808 |
+| literals/Literals.java:110:3:110:84 | 0b1000_0000_0000_0000_0000_0000_0000_0000_0000_0000_0000_0000_0000_0000_0000_0000L | -9223372036854775808 |
+| literals/Literals.java:111:3:111:24 | 0xffff_ffff_ffff_ffffL | -1 |
+| literals/Literals.java:112:3:112:31 | 017_7777_7777_7777_7777_7777L | -1 |
+| literals/Literals.java:113:3:113:84 | 0b1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111L | -1 |
diff --git a/java/ql/test/library-tests/literals/literalLong.ql b/java/ql/test/library-tests/literals/literalLong.ql
index 9f0c5a789c9..54109369b3a 100644
--- a/java/ql/test/library-tests/literals/literalLong.ql
+++ b/java/ql/test/library-tests/literals/literalLong.ql
@@ -1,4 +1,4 @@
 import semmle.code.java.Expr
 
 from LongLiteral lit
-select lit
+select lit, lit.getValue()
diff --git a/java/ql/test/library-tests/literals/literalString.expected b/java/ql/test/library-tests/literals/literalString.expected
index addd494a5b1..bf980e80bf6 100644
--- a/java/ql/test/library-tests/literals/literalString.expected
+++ b/java/ql/test/library-tests/literals/literalString.expected
@@ -1,6 +1,20 @@
-| literals/Literals.java:6:22:6:37 | "literal string" |
-| literals/Literals.java:22:22:22:38 | "hello" + "world" |
-| literals/Literals.java:23:24:23:47 | "hello" + ", " + "world" |
-| literals/Literals.java:24:23:24:52 | "hello" + ", " + "world" + "!" |
-| literals/Literals.java:25:22:25:36 | "hello,\\tworld" |
-| literals/Literals.java:26:30:26:48 | "hello,\\u0009world" |
+| literals/Literals.java:6:22:6:37 | "literal string" | literal string | literal string |
+| literals/Literals.java:117:3:117:19 | "hello" + "world" | helloworld | helloworld |
+| literals/Literals.java:118:3:118:17 | "hello,\\tworld" | hello,\tworld | hello,\tworld |
+| literals/Literals.java:119:3:119:21 | "hello,\\u0009world" | hello,\tworld | hello,\tworld |
+| literals/Literals.java:120:3:120:10 | "\\u0061" | a | a |
+| literals/Literals.java:121:3:121:6 | "\\0" | \u0000 | \u0000 |
+| literals/Literals.java:122:3:122:9 | "\\0000" | \u00000 | \u00000 |
+| literals/Literals.java:123:3:123:6 | "\\"" | " | " |
+| literals/Literals.java:124:3:124:6 | "\\'" | ' | ' |
+| literals/Literals.java:125:3:125:6 | "\\n" | \n | \n |
+| literals/Literals.java:126:3:126:6 | "\\\\" | \\ | \\ |
+| literals/Literals.java:127:3:127:13 | "test \\123" | test S | test S |
+| literals/Literals.java:128:3:128:9 | "\\1234" | S4 | S4 |
+| literals/Literals.java:129:3:129:13 | "\\u0061567" | a567 | a567 |
+| literals/Literals.java:130:3:130:13 | "\\u1234567" | \u1234567 | \u1234567 |
+| literals/Literals.java:131:3:131:18 | "\\uaBcDeF\\u0aB1" | \uabcdeF\u0ab1 | \uabcdeF\u0ab1 |
+| literals/Literals.java:132:3:132:16 | "\\uD800\\uDC00" | \ud800\udc00 | \ud800\udc00 |
+| literals/Literals.java:134:3:134:10 | "\\uD800" | ? | ? |
+| literals/Literals.java:135:3:135:10 | "\\uDC00" | ? | ? |
+| literals/Literals.java:136:3:136:31 | "hello\\uD800hello\\uDC00world" | hello?hello?world | hello?hello?world |
diff --git a/java/ql/test/library-tests/literals/literalString.ql b/java/ql/test/library-tests/literals/literalString.ql
index e69d4f89b6b..e2128e54e0e 100644
--- a/java/ql/test/library-tests/literals/literalString.ql
+++ b/java/ql/test/library-tests/literals/literalString.ql
@@ -2,4 +2,4 @@ import semmle.code.java.Expr
 
 from StringLiteral lit
 where lit.getFile().(CompilationUnit).fromSource()
-select lit
+select lit, lit.getValue(), lit.getRepresentedString()
diff --git a/java/ql/test/library-tests/literals/literals/Literals.java b/java/ql/test/library-tests/literals/literals/Literals.java
index 82b21ae2763..082310acb80 100644
--- a/java/ql/test/library-tests/literals/literals/Literals.java
+++ b/java/ql/test/library-tests/literals/literals/Literals.java
@@ -11,17 +11,128 @@ public class Literals {
 		System.out.println(true);
 		System.out.println('x');
 	}
-	int min_int = -2147483648;
-	long min_long = -9223372036854775808l;
-	int neg_max_int = -2147483647;
-	long neg_max_long = -9223372036854775807l;
-	int alt_min_int = 0x80000000;
-	long alt_min_long = 0x8000000000000000L;
-	int i = 23 + 19;
-	int j = 23  +19;
-	String twostrings = "hello" + "world";
-	String threestrings = "hello" + ", " + "world";
-	String fourstrings = "hello" + ", " + "world" + "!";
-	String escape_seq = "hello,\tworld";
-	String unicode_escape_seq = "hello,\u0009world";
+
+	boolean[] booleans = {
+		true,
+		false
+	};
+
+	char[] chars = {
+		'a',
+		'\u0061', // 'a'
+		'\u0000',
+		'\0',
+		'\n',
+		'\0',
+		'\\',
+		'\'',
+		'\123' // octal escape sequence for 'S'
+	};
+
+	double[] doubles = {
+		0.0,
+		0d,
+		.0d,
+		.0,
+		-0.d,
+		+0.d,
+		1.234567890123456789,
+		1.55555555555555555555,
+		// From the JLS
+		1e1,
+		1.7976931348623157E308,
+		-1.7976931348623157E308,
+		0x1.f_ffff_ffff_ffffP+1023,
+		4.9e-324,
+		0x0.0_0000_0000_0001P-1022,
+		0x1.0P-1074
+	};
+
+	float[] floats = {
+		0.0f,
+		0f,
+		.0f,
+		-0.f,
+		+0.f,
+		1_0_0.0f,
+		1.234567890123456789f,
+		1.55555555555555555555f,
+		// From the JLS
+		1e1f,
+		3.4028235e38f,
+		-3.4028235e38f,
+		0x1.fffffeP+127f,
+		1.4e-45f,
+		0x0.000002P-126f,
+		0x1.0P-149f
+	};
+
+	int[] ints = {
+		0,
+		0_0,
+		0___0,
+		0_12, // octal
+		0X012, // hex
+		0xaBcDeF, // hex
+		0B11, // binary
+		0x80000000,
+		2147483647,
+		-2147483648,
+		// From the JLS
+		0x7fff_ffff,
+		0177_7777_7777, // octal
+		0b0111_1111_1111_1111_1111_1111_1111_1111, // binary
+		0x8000_0000,
+		0200_0000_0000,
+		0b1000_0000_0000_0000_0000_0000_0000_0000,
+		0xffff_ffff,
+		0377_7777_7777,
+		0b1111_1111_1111_1111_1111_1111_1111_1111
+	};
+
+	long[] longs = {
+		0l,
+		0L,
+		0_0L,
+		0___0L,
+		0_12L, // octal
+		0X012L, // hex
+		0xaBcDeFL, // hex
+		0B11L, // binary
+		9223372036854775807L,
+		-9223372036854775808L,
+		// From the JLS
+		0x7fff_ffff_ffff_ffffL,
+		07_7777_7777_7777_7777_7777L, // octal
+		0b0111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111L, // binary
+		0x8000_0000_0000_0000L,
+		010_0000_0000_0000_0000_0000L,
+		0b1000_0000_0000_0000_0000_0000_0000_0000_0000_0000_0000_0000_0000_0000_0000_0000L,
+		0xffff_ffff_ffff_ffffL,
+		017_7777_7777_7777_7777_7777L,
+		0b1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111L
+	};
+
+	String[] strings = {
+		"hello" + "world", // two separate literals
+		"hello,\tworld",
+		"hello,\u0009world",
+		"\u0061", // 'a'
+		"\0",
+		"\0000",
+		"\"",
+		"\'",
+		"\n",
+		"\\",
+		"test \123", // octal escape sequence for 'S'
+		"\1234", // octal escape followed by '4'
+		"\u0061567", // escape sequence for 'a' followed by "567"
+		"\u1234567", // '\u1234' followed by "567"
+		"\uaBcDeF\u0aB1", // '\uABCD' followed by "eF" followed by '\u0AB1'
+		"\uD800\uDC00", // surrogate pair
+		// Unpaired surrogates
+		"\uD800",
+		"\uDC00",
+		"hello\uD800hello\uDC00world"
+	};
 }
diff --git a/java/ql/test/library-tests/printAst/options b/java/ql/test/library-tests/printAst/options
index 81817b37785..e41003a6e3c 100644
--- a/java/ql/test/library-tests/printAst/options
+++ b/java/ql/test/library-tests/printAst/options
@@ -1 +1 @@
-//semmle-extractor-options: --javac-args --enable-preview -source 15 -target 15
+//semmle-extractor-options: --javac-args --enable-preview -source 16 -target 16
diff --git a/java/ql/test/library-tests/ssa/options b/java/ql/test/library-tests/ssa/options
index 81817b37785..e41003a6e3c 100644
--- a/java/ql/test/library-tests/ssa/options
+++ b/java/ql/test/library-tests/ssa/options
@@ -1 +1 @@
-//semmle-extractor-options: --javac-args --enable-preview -source 15 -target 15
+//semmle-extractor-options: --javac-args --enable-preview -source 16 -target 16
diff --git a/java/ql/test/query-tests/StringFormat/options b/java/ql/test/query-tests/StringFormat/options
deleted file mode 100644
index 81817b37785..00000000000
--- a/java/ql/test/query-tests/StringFormat/options
+++ /dev/null
@@ -1 +0,0 @@
-//semmle-extractor-options: --javac-args --enable-preview -source 15 -target 15
diff --git a/java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.expected b/java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.expected
index 2f761c646ea..138f05d2986 100644
--- a/java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.expected
+++ b/java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.expected
@@ -2,12 +2,27 @@ edges
 | Test.java:19:18:19:38 | getHostName(...) : String | Test.java:24:20:24:23 | temp |
 | Test.java:19:18:19:38 | getHostName(...) : String | Test.java:27:21:27:24 | temp |
 | Test.java:19:18:19:38 | getHostName(...) : String | Test.java:30:44:30:47 | temp |
+| Test.java:19:18:19:38 | getHostName(...) : String | Test.java:34:21:34:24 | temp |
+| Test.java:79:33:79:99 | new BufferedReader(...) : BufferedReader | Test.java:80:31:80:32 | br : BufferedReader |
+| Test.java:79:52:79:98 | new InputStreamReader(...) : InputStreamReader | Test.java:79:33:79:99 | new BufferedReader(...) : BufferedReader |
+| Test.java:79:74:79:97 | getInputStream(...) : ServletInputStream | Test.java:79:52:79:98 | new InputStreamReader(...) : InputStreamReader |
+| Test.java:80:31:80:32 | br : BufferedReader | Test.java:80:31:80:43 | readLine(...) : String |
+| Test.java:80:31:80:43 | readLine(...) : String | Test.java:82:67:82:81 | ... + ... |
 nodes
 | Test.java:19:18:19:38 | getHostName(...) : String | semmle.label | getHostName(...) : String |
 | Test.java:24:20:24:23 | temp | semmle.label | temp |
 | Test.java:27:21:27:24 | temp | semmle.label | temp |
 | Test.java:30:44:30:47 | temp | semmle.label | temp |
+| Test.java:34:21:34:24 | temp | semmle.label | temp |
+| Test.java:79:33:79:99 | new BufferedReader(...) : BufferedReader | semmle.label | new BufferedReader(...) : BufferedReader |
+| Test.java:79:52:79:98 | new InputStreamReader(...) : InputStreamReader | semmle.label | new InputStreamReader(...) : InputStreamReader |
+| Test.java:79:74:79:97 | getInputStream(...) : ServletInputStream | semmle.label | getInputStream(...) : ServletInputStream |
+| Test.java:80:31:80:32 | br : BufferedReader | semmle.label | br : BufferedReader |
+| Test.java:80:31:80:43 | readLine(...) : String | semmle.label | readLine(...) : String |
+| Test.java:82:67:82:81 | ... + ... | semmle.label | ... + ... |
 #select
 | Test.java:24:11:24:24 | new File(...) | Test.java:19:18:19:38 | getHostName(...) : String | Test.java:24:20:24:23 | temp | $@ flows to here and is used in a path. | Test.java:19:18:19:38 | getHostName(...) | User-provided value |
 | Test.java:27:11:27:25 | get(...) | Test.java:19:18:19:38 | getHostName(...) : String | Test.java:27:21:27:24 | temp | $@ flows to here and is used in a path. | Test.java:19:18:19:38 | getHostName(...) | User-provided value |
 | Test.java:30:11:30:48 | getPath(...) | Test.java:19:18:19:38 | getHostName(...) : String | Test.java:30:44:30:47 | temp | $@ flows to here and is used in a path. | Test.java:19:18:19:38 | getHostName(...) | User-provided value |
+| Test.java:34:12:34:25 | new File(...) | Test.java:19:18:19:38 | getHostName(...) : String | Test.java:34:21:34:24 | temp | $@ flows to here and is used in a path. | Test.java:19:18:19:38 | getHostName(...) | User-provided value |
+| Test.java:82:52:82:88 | new FileWriter(...) | Test.java:79:74:79:97 | getInputStream(...) : ServletInputStream | Test.java:82:67:82:81 | ... + ... | $@ flows to here and is used in a path. | Test.java:79:74:79:97 | getInputStream(...) | User-provided value |
diff --git a/java/ql/test/query-tests/security/CWE-022/semmle/tests/Test.java b/java/ql/test/query-tests/security/CWE-022/semmle/tests/Test.java
index 21f218eca05..a0a6694c061 100644
--- a/java/ql/test/query-tests/security/CWE-022/semmle/tests/Test.java
+++ b/java/ql/test/query-tests/security/CWE-022/semmle/tests/Test.java
@@ -3,10 +3,10 @@
 package test.cwe22.semmle.tests;
 
 
+import javax.servlet.http.*;
+import javax.servlet.ServletException;
 
-
-import java.io.IOException;
-import java.io.File;
+import java.io.*;
 import java.net.InetAddress;
 import java.nio.file.Path;
 import java.nio.file.Paths;
@@ -28,6 +28,11 @@ class Test {
 					
 			// BAD: construct a path with user input
 			path = FileSystems.getDefault().getPath(temp);
+
+			// BAD: insufficient check
+			if (temp.startsWith("/some_safe_dir/")) {
+				file = new File(temp);
+			}
 	}
 	
 	void doGet2(InetAddress address)
@@ -68,4 +73,13 @@ class Test {
 			return false;
 		return true;
 	}
+
+    public class MyServlet extends HttpServlet {
+        public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
+            BufferedReader br = new BufferedReader(new InputStreamReader(request.getInputStream()));
+            String filename = br.readLine();
+            // BAD: construct a file path with user input
+            BufferedWriter bw = new BufferedWriter(new FileWriter("dir/"+filename, true));
+        }
+    }
 }
diff --git a/java/ql/test/query-tests/security/CWE-022/semmle/tests/ZipSlip.expected b/java/ql/test/query-tests/security/CWE-022/semmle/tests/ZipSlip.expected
index 6b27b1ec84c..59e4d879d23 100644
--- a/java/ql/test/query-tests/security/CWE-022/semmle/tests/ZipSlip.expected
+++ b/java/ql/test/query-tests/security/CWE-022/semmle/tests/ZipSlip.expected
@@ -1,9 +1,16 @@
 edges
+| ZipTest.java:7:19:7:33 | getName(...) : String | ZipTest.java:8:31:8:34 | name : String |
 | ZipTest.java:7:19:7:33 | getName(...) : String | ZipTest.java:9:48:9:51 | file |
 | ZipTest.java:7:19:7:33 | getName(...) : String | ZipTest.java:10:49:10:52 | file |
 | ZipTest.java:7:19:7:33 | getName(...) : String | ZipTest.java:11:36:11:39 | file |
+| ZipTest.java:8:17:8:35 | new File(...) : File | ZipTest.java:9:48:9:51 | file |
+| ZipTest.java:8:17:8:35 | new File(...) : File | ZipTest.java:10:49:10:52 | file |
+| ZipTest.java:8:17:8:35 | new File(...) : File | ZipTest.java:11:36:11:39 | file |
+| ZipTest.java:8:31:8:34 | name : String | ZipTest.java:8:17:8:35 | new File(...) : File |
 nodes
 | ZipTest.java:7:19:7:33 | getName(...) : String | semmle.label | getName(...) : String |
+| ZipTest.java:8:17:8:35 | new File(...) : File | semmle.label | new File(...) : File |
+| ZipTest.java:8:31:8:34 | name : String | semmle.label | name : String |
 | ZipTest.java:9:48:9:51 | file | semmle.label | file |
 | ZipTest.java:10:49:10:52 | file | semmle.label | file |
 | ZipTest.java:11:36:11:39 | file | semmle.label | file |
diff --git a/java/ql/test/query-tests/security/CWE-022/semmle/tests/options b/java/ql/test/query-tests/security/CWE-022/semmle/tests/options
new file mode 100644
index 00000000000..a41b28dc245
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-022/semmle/tests/options
@@ -0,0 +1 @@
+// semmle-extractor-options: --javac-args -cp ${testdir}/../../../../../stubs/servlet-api-2.4
diff --git a/java/ql/test/query-tests/security/CWE-113/semmle/tests/ResponseSplitting.expected b/java/ql/test/query-tests/security/CWE-113/semmle/tests/ResponseSplitting.expected
index 4a1a172bbf5..1b4efe7781e 100644
--- a/java/ql/test/query-tests/security/CWE-113/semmle/tests/ResponseSplitting.expected
+++ b/java/ql/test/query-tests/security/CWE-113/semmle/tests/ResponseSplitting.expected
@@ -1,6 +1,8 @@
 edges
-| ResponseSplitting.java:22:39:22:66 | getParameter(...) : String | ResponseSplitting.java:23:23:23:28 | cookie |
+| ResponseSplitting.java:22:20:22:67 | new Cookie(...) : Cookie | ResponseSplitting.java:23:23:23:28 | cookie |
+| ResponseSplitting.java:22:39:22:66 | getParameter(...) : String | ResponseSplitting.java:22:20:22:67 | new Cookie(...) : Cookie |
 nodes
+| ResponseSplitting.java:22:20:22:67 | new Cookie(...) : Cookie | semmle.label | new Cookie(...) : Cookie |
 | ResponseSplitting.java:22:39:22:66 | getParameter(...) : String | semmle.label | getParameter(...) : String |
 | ResponseSplitting.java:23:23:23:28 | cookie | semmle.label | cookie |
 | ResponseSplitting.java:28:38:28:72 | getParameter(...) | semmle.label | getParameter(...) |
diff --git a/java/ql/test/query-tests/security/CWE-190/semmle/tests/ArithmeticTaintedLocal.expected b/java/ql/test/query-tests/security/CWE-190/semmle/tests/ArithmeticTaintedLocal.expected
index 178de2e3dcd..637b605a06f 100644
--- a/java/ql/test/query-tests/security/CWE-190/semmle/tests/ArithmeticTaintedLocal.expected
+++ b/java/ql/test/query-tests/security/CWE-190/semmle/tests/ArithmeticTaintedLocal.expected
@@ -1,13 +1,23 @@
 edges
-| ArithmeticTainted.java:17:46:17:54 | System.in : InputStream | ArithmeticTainted.java:32:17:32:20 | data |
-| ArithmeticTainted.java:17:46:17:54 | System.in : InputStream | ArithmeticTainted.java:40:17:40:20 | data |
-| ArithmeticTainted.java:17:46:17:54 | System.in : InputStream | ArithmeticTainted.java:50:17:50:20 | data |
-| ArithmeticTainted.java:17:46:17:54 | System.in : InputStream | ArithmeticTainted.java:64:20:64:23 | data : Number |
-| ArithmeticTainted.java:17:46:17:54 | System.in : InputStream | ArithmeticTainted.java:95:37:95:40 | data |
-| ArithmeticTainted.java:17:46:17:54 | System.in : InputStream | ArithmeticTainted.java:118:9:118:12 | data : Number |
-| ArithmeticTainted.java:17:46:17:54 | System.in : InputStream | ArithmeticTainted.java:119:10:119:13 | data : Number |
-| ArithmeticTainted.java:17:46:17:54 | System.in : InputStream | ArithmeticTainted.java:120:10:120:13 | data : Number |
-| ArithmeticTainted.java:17:46:17:54 | System.in : InputStream | ArithmeticTainted.java:121:10:121:13 | data : Number |
+| ArithmeticTainted.java:17:24:17:64 | new InputStreamReader(...) : InputStreamReader | ArithmeticTainted.java:18:40:18:56 | readerInputStream : InputStreamReader |
+| ArithmeticTainted.java:17:24:17:64 | new InputStreamReader(...) : InputStreamReader | ArithmeticTainted.java:18:40:18:56 | readerInputStream : InputStreamReader |
+| ArithmeticTainted.java:17:46:17:54 | System.in : InputStream | ArithmeticTainted.java:17:24:17:64 | new InputStreamReader(...) : InputStreamReader |
+| ArithmeticTainted.java:17:46:17:54 | System.in : InputStream | ArithmeticTainted.java:17:24:17:64 | new InputStreamReader(...) : InputStreamReader |
+| ArithmeticTainted.java:18:21:18:57 | new BufferedReader(...) : BufferedReader | ArithmeticTainted.java:19:26:19:39 | readerBuffered : BufferedReader |
+| ArithmeticTainted.java:18:21:18:57 | new BufferedReader(...) : BufferedReader | ArithmeticTainted.java:19:26:19:39 | readerBuffered : BufferedReader |
+| ArithmeticTainted.java:18:40:18:56 | readerInputStream : InputStreamReader | ArithmeticTainted.java:18:21:18:57 | new BufferedReader(...) : BufferedReader |
+| ArithmeticTainted.java:18:40:18:56 | readerInputStream : InputStreamReader | ArithmeticTainted.java:18:21:18:57 | new BufferedReader(...) : BufferedReader |
+| ArithmeticTainted.java:19:26:19:39 | readerBuffered : BufferedReader | ArithmeticTainted.java:19:26:19:50 | readLine(...) : String |
+| ArithmeticTainted.java:19:26:19:39 | readerBuffered : BufferedReader | ArithmeticTainted.java:19:26:19:50 | readLine(...) : String |
+| ArithmeticTainted.java:19:26:19:50 | readLine(...) : String | ArithmeticTainted.java:32:17:32:20 | data |
+| ArithmeticTainted.java:19:26:19:50 | readLine(...) : String | ArithmeticTainted.java:40:17:40:20 | data |
+| ArithmeticTainted.java:19:26:19:50 | readLine(...) : String | ArithmeticTainted.java:50:17:50:20 | data |
+| ArithmeticTainted.java:19:26:19:50 | readLine(...) : String | ArithmeticTainted.java:64:20:64:23 | data : Number |
+| ArithmeticTainted.java:19:26:19:50 | readLine(...) : String | ArithmeticTainted.java:95:37:95:40 | data |
+| ArithmeticTainted.java:19:26:19:50 | readLine(...) : String | ArithmeticTainted.java:118:9:118:12 | data : Number |
+| ArithmeticTainted.java:19:26:19:50 | readLine(...) : String | ArithmeticTainted.java:119:10:119:13 | data : Number |
+| ArithmeticTainted.java:19:26:19:50 | readLine(...) : String | ArithmeticTainted.java:120:10:120:13 | data : Number |
+| ArithmeticTainted.java:19:26:19:50 | readLine(...) : String | ArithmeticTainted.java:121:10:121:13 | data : Number |
 | ArithmeticTainted.java:64:4:64:10 | tainted [post update] [dat] : Number | ArithmeticTainted.java:66:18:66:24 | tainted [dat] : Number |
 | ArithmeticTainted.java:64:20:64:23 | data : Number | ArithmeticTainted.java:64:4:64:10 | tainted [post update] [dat] : Number |
 | ArithmeticTainted.java:66:18:66:24 | tainted [dat] : Number | ArithmeticTainted.java:66:18:66:34 | getData(...) : Number |
@@ -21,8 +31,18 @@ edges
 | ArithmeticTainted.java:133:27:133:34 | data : Number | ArithmeticTainted.java:135:3:135:6 | data |
 | ArithmeticTainted.java:137:27:137:34 | data : Number | ArithmeticTainted.java:139:5:139:8 | data |
 nodes
+| ArithmeticTainted.java:17:24:17:64 | new InputStreamReader(...) : InputStreamReader | semmle.label | new InputStreamReader(...) : InputStreamReader |
+| ArithmeticTainted.java:17:24:17:64 | new InputStreamReader(...) : InputStreamReader | semmle.label | new InputStreamReader(...) : InputStreamReader |
 | ArithmeticTainted.java:17:46:17:54 | System.in : InputStream | semmle.label | System.in : InputStream |
 | ArithmeticTainted.java:17:46:17:54 | System.in : InputStream | semmle.label | System.in : InputStream |
+| ArithmeticTainted.java:18:21:18:57 | new BufferedReader(...) : BufferedReader | semmle.label | new BufferedReader(...) : BufferedReader |
+| ArithmeticTainted.java:18:21:18:57 | new BufferedReader(...) : BufferedReader | semmle.label | new BufferedReader(...) : BufferedReader |
+| ArithmeticTainted.java:18:40:18:56 | readerInputStream : InputStreamReader | semmle.label | readerInputStream : InputStreamReader |
+| ArithmeticTainted.java:18:40:18:56 | readerInputStream : InputStreamReader | semmle.label | readerInputStream : InputStreamReader |
+| ArithmeticTainted.java:19:26:19:39 | readerBuffered : BufferedReader | semmle.label | readerBuffered : BufferedReader |
+| ArithmeticTainted.java:19:26:19:39 | readerBuffered : BufferedReader | semmle.label | readerBuffered : BufferedReader |
+| ArithmeticTainted.java:19:26:19:50 | readLine(...) : String | semmle.label | readLine(...) : String |
+| ArithmeticTainted.java:19:26:19:50 | readLine(...) : String | semmle.label | readLine(...) : String |
 | ArithmeticTainted.java:32:17:32:20 | data | semmle.label | data |
 | ArithmeticTainted.java:40:17:40:20 | data | semmle.label | data |
 | ArithmeticTainted.java:50:17:50:20 | data | semmle.label | data |
diff --git a/java/ql/test/query-tests/security/CWE-502/UnsafeDeserialization.expected b/java/ql/test/query-tests/security/CWE-502/UnsafeDeserialization.expected
index f575a093d6e..2af8369c111 100644
--- a/java/ql/test/query-tests/security/CWE-502/UnsafeDeserialization.expected
+++ b/java/ql/test/query-tests/security/CWE-502/UnsafeDeserialization.expected
@@ -1,40 +1,74 @@
 edges
+| A.java:13:31:13:51 | getInputStream(...) : InputStream | A.java:14:50:14:60 | inputStream : InputStream |
 | A.java:13:31:13:51 | getInputStream(...) : InputStream | A.java:15:12:15:13 | in |
+| A.java:14:28:14:61 | new ObjectInputStream(...) : ObjectInputStream | A.java:15:12:15:13 | in |
+| A.java:14:50:14:60 | inputStream : InputStream | A.java:14:28:14:61 | new ObjectInputStream(...) : ObjectInputStream |
+| A.java:19:31:19:51 | getInputStream(...) : InputStream | A.java:20:50:20:60 | inputStream : InputStream |
 | A.java:19:31:19:51 | getInputStream(...) : InputStream | A.java:21:12:21:13 | in |
-| A.java:25:31:25:51 | getInputStream(...) : InputStream | A.java:27:12:27:12 | d |
-| A.java:32:31:32:51 | getInputStream(...) : InputStream | A.java:34:23:34:28 | reader |
-| A.java:39:29:39:49 | getInputStream(...) : InputStream | A.java:40:28:40:32 | input |
-| A.java:39:29:39:49 | getInputStream(...) : InputStream | A.java:41:34:41:38 | input |
-| A.java:39:29:39:49 | getInputStream(...) : InputStream | A.java:42:40:42:44 | input |
+| A.java:20:28:20:61 | new ObjectInputStream(...) : ObjectInputStream | A.java:21:12:21:13 | in |
+| A.java:20:50:20:60 | inputStream : InputStream | A.java:20:28:20:61 | new ObjectInputStream(...) : ObjectInputStream |
+| A.java:25:31:25:51 | getInputStream(...) : InputStream | A.java:26:35:26:45 | inputStream : InputStream |
+| A.java:26:20:26:46 | new XMLDecoder(...) : XMLDecoder | A.java:27:12:27:12 | d |
+| A.java:26:35:26:45 | inputStream : InputStream | A.java:26:20:26:46 | new XMLDecoder(...) : XMLDecoder |
+| A.java:32:31:32:51 | getInputStream(...) : InputStream | A.java:33:43:33:53 | inputStream : InputStream |
+| A.java:33:21:33:54 | new InputStreamReader(...) : InputStreamReader | A.java:34:23:34:28 | reader |
+| A.java:33:43:33:53 | inputStream : InputStream | A.java:33:21:33:54 | new InputStreamReader(...) : InputStreamReader |
+| A.java:39:19:39:50 | new Input(...) : Input | A.java:40:28:40:32 | input |
+| A.java:39:19:39:50 | new Input(...) : Input | A.java:41:34:41:38 | input |
+| A.java:39:19:39:50 | new Input(...) : Input | A.java:42:40:42:44 | input |
+| A.java:39:29:39:49 | getInputStream(...) : InputStream | A.java:39:19:39:50 | new Input(...) : Input |
 | A.java:60:25:60:45 | getInputStream(...) : InputStream | A.java:61:26:61:30 | input |
 | A.java:60:25:60:45 | getInputStream(...) : InputStream | A.java:62:30:62:34 | input |
-| A.java:60:25:60:45 | getInputStream(...) : InputStream | A.java:63:28:63:55 | new InputStreamReader(...) |
+| A.java:60:25:60:45 | getInputStream(...) : InputStream | A.java:63:50:63:54 | input : InputStream |
 | A.java:60:25:60:45 | getInputStream(...) : InputStream | A.java:64:24:64:28 | input |
-| A.java:60:25:60:45 | getInputStream(...) : InputStream | A.java:65:24:65:51 | new InputStreamReader(...) |
+| A.java:60:25:60:45 | getInputStream(...) : InputStream | A.java:65:46:65:50 | input : InputStream |
+| A.java:63:50:63:54 | input : InputStream | A.java:63:28:63:55 | new InputStreamReader(...) |
+| A.java:65:46:65:50 | input : InputStream | A.java:65:24:65:51 | new InputStreamReader(...) |
 | A.java:70:25:70:45 | getInputStream(...) : InputStream | A.java:71:26:71:30 | input |
 | A.java:70:25:70:45 | getInputStream(...) : InputStream | A.java:72:30:72:34 | input |
-| A.java:70:25:70:45 | getInputStream(...) : InputStream | A.java:73:28:73:55 | new InputStreamReader(...) |
+| A.java:70:25:70:45 | getInputStream(...) : InputStream | A.java:73:50:73:54 | input : InputStream |
 | A.java:70:25:70:45 | getInputStream(...) : InputStream | A.java:74:24:74:28 | input |
-| A.java:70:25:70:45 | getInputStream(...) : InputStream | A.java:75:24:75:51 | new InputStreamReader(...) |
+| A.java:70:25:70:45 | getInputStream(...) : InputStream | A.java:75:46:75:50 | input : InputStream |
+| A.java:73:50:73:54 | input : InputStream | A.java:73:28:73:55 | new InputStreamReader(...) |
+| A.java:75:46:75:50 | input : InputStream | A.java:75:24:75:51 | new InputStreamReader(...) |
 | A.java:90:25:90:45 | getInputStream(...) : InputStream | A.java:91:26:91:30 | input |
 | A.java:90:25:90:45 | getInputStream(...) : InputStream | A.java:92:30:92:34 | input |
-| A.java:90:25:90:45 | getInputStream(...) : InputStream | A.java:93:28:93:55 | new InputStreamReader(...) |
+| A.java:90:25:90:45 | getInputStream(...) : InputStream | A.java:93:50:93:54 | input : InputStream |
 | A.java:90:25:90:45 | getInputStream(...) : InputStream | A.java:94:24:94:28 | input |
-| A.java:90:25:90:45 | getInputStream(...) : InputStream | A.java:95:24:95:51 | new InputStreamReader(...) |
+| A.java:90:25:90:45 | getInputStream(...) : InputStream | A.java:95:46:95:50 | input : InputStream |
+| A.java:93:50:93:54 | input : InputStream | A.java:93:28:93:55 | new InputStreamReader(...) |
+| A.java:95:46:95:50 | input : InputStream | A.java:95:24:95:51 | new InputStreamReader(...) |
 | B.java:7:31:7:51 | getInputStream(...) : InputStream | B.java:8:29:8:39 | inputStream |
-| B.java:12:31:12:51 | getInputStream(...) : InputStream | B.java:15:23:15:27 | bytes |
-| B.java:19:31:19:51 | getInputStream(...) : InputStream | B.java:23:29:23:29 | s |
-| B.java:27:31:27:51 | getInputStream(...) : InputStream | B.java:31:23:31:23 | s |
+| B.java:12:31:12:51 | getInputStream(...) : InputStream | B.java:14:5:14:15 | inputStream : InputStream |
+| B.java:14:5:14:15 | inputStream : InputStream | B.java:14:22:14:26 | bytes [post update] : byte[] |
+| B.java:14:22:14:26 | bytes [post update] : byte[] | B.java:15:23:15:27 | bytes |
+| B.java:19:31:19:51 | getInputStream(...) : InputStream | B.java:21:5:21:15 | inputStream : InputStream |
+| B.java:21:5:21:15 | inputStream : InputStream | B.java:21:22:21:26 | bytes [post update] : byte[] |
+| B.java:21:22:21:26 | bytes [post update] : byte[] | B.java:23:29:23:29 | s |
+| B.java:27:31:27:51 | getInputStream(...) : InputStream | B.java:29:5:29:15 | inputStream : InputStream |
+| B.java:29:5:29:15 | inputStream : InputStream | B.java:29:22:29:26 | bytes [post update] : byte[] |
+| B.java:29:22:29:26 | bytes [post update] : byte[] | B.java:31:23:31:23 | s |
 | TestMessageBodyReader.java:20:55:20:78 | entityStream : InputStream | TestMessageBodyReader.java:22:18:22:52 | new ObjectInputStream(...) |
+| TestMessageBodyReader.java:20:55:20:78 | entityStream : InputStream | TestMessageBodyReader.java:22:40:22:51 | entityStream : InputStream |
+| TestMessageBodyReader.java:22:40:22:51 | entityStream : InputStream | TestMessageBodyReader.java:22:18:22:52 | new ObjectInputStream(...) |
 nodes
 | A.java:13:31:13:51 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| A.java:14:28:14:61 | new ObjectInputStream(...) : ObjectInputStream | semmle.label | new ObjectInputStream(...) : ObjectInputStream |
+| A.java:14:50:14:60 | inputStream : InputStream | semmle.label | inputStream : InputStream |
 | A.java:15:12:15:13 | in | semmle.label | in |
 | A.java:19:31:19:51 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| A.java:20:28:20:61 | new ObjectInputStream(...) : ObjectInputStream | semmle.label | new ObjectInputStream(...) : ObjectInputStream |
+| A.java:20:50:20:60 | inputStream : InputStream | semmle.label | inputStream : InputStream |
 | A.java:21:12:21:13 | in | semmle.label | in |
 | A.java:25:31:25:51 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| A.java:26:20:26:46 | new XMLDecoder(...) : XMLDecoder | semmle.label | new XMLDecoder(...) : XMLDecoder |
+| A.java:26:35:26:45 | inputStream : InputStream | semmle.label | inputStream : InputStream |
 | A.java:27:12:27:12 | d | semmle.label | d |
 | A.java:32:31:32:51 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| A.java:33:21:33:54 | new InputStreamReader(...) : InputStreamReader | semmle.label | new InputStreamReader(...) : InputStreamReader |
+| A.java:33:43:33:53 | inputStream : InputStream | semmle.label | inputStream : InputStream |
 | A.java:34:23:34:28 | reader | semmle.label | reader |
+| A.java:39:19:39:50 | new Input(...) : Input | semmle.label | new Input(...) : Input |
 | A.java:39:29:39:49 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | A.java:40:28:40:32 | input | semmle.label | input |
 | A.java:41:34:41:38 | input | semmle.label | input |
@@ -43,30 +77,43 @@ nodes
 | A.java:61:26:61:30 | input | semmle.label | input |
 | A.java:62:30:62:34 | input | semmle.label | input |
 | A.java:63:28:63:55 | new InputStreamReader(...) | semmle.label | new InputStreamReader(...) |
+| A.java:63:50:63:54 | input : InputStream | semmle.label | input : InputStream |
 | A.java:64:24:64:28 | input | semmle.label | input |
 | A.java:65:24:65:51 | new InputStreamReader(...) | semmle.label | new InputStreamReader(...) |
+| A.java:65:46:65:50 | input : InputStream | semmle.label | input : InputStream |
 | A.java:70:25:70:45 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | A.java:71:26:71:30 | input | semmle.label | input |
 | A.java:72:30:72:34 | input | semmle.label | input |
 | A.java:73:28:73:55 | new InputStreamReader(...) | semmle.label | new InputStreamReader(...) |
+| A.java:73:50:73:54 | input : InputStream | semmle.label | input : InputStream |
 | A.java:74:24:74:28 | input | semmle.label | input |
 | A.java:75:24:75:51 | new InputStreamReader(...) | semmle.label | new InputStreamReader(...) |
+| A.java:75:46:75:50 | input : InputStream | semmle.label | input : InputStream |
 | A.java:90:25:90:45 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | A.java:91:26:91:30 | input | semmle.label | input |
 | A.java:92:30:92:34 | input | semmle.label | input |
 | A.java:93:28:93:55 | new InputStreamReader(...) | semmle.label | new InputStreamReader(...) |
+| A.java:93:50:93:54 | input : InputStream | semmle.label | input : InputStream |
 | A.java:94:24:94:28 | input | semmle.label | input |
 | A.java:95:24:95:51 | new InputStreamReader(...) | semmle.label | new InputStreamReader(...) |
+| A.java:95:46:95:50 | input : InputStream | semmle.label | input : InputStream |
 | B.java:7:31:7:51 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | B.java:8:29:8:39 | inputStream | semmle.label | inputStream |
 | B.java:12:31:12:51 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| B.java:14:5:14:15 | inputStream : InputStream | semmle.label | inputStream : InputStream |
+| B.java:14:22:14:26 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
 | B.java:15:23:15:27 | bytes | semmle.label | bytes |
 | B.java:19:31:19:51 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| B.java:21:5:21:15 | inputStream : InputStream | semmle.label | inputStream : InputStream |
+| B.java:21:22:21:26 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
 | B.java:23:29:23:29 | s | semmle.label | s |
 | B.java:27:31:27:51 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| B.java:29:5:29:15 | inputStream : InputStream | semmle.label | inputStream : InputStream |
+| B.java:29:22:29:26 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
 | B.java:31:23:31:23 | s | semmle.label | s |
 | TestMessageBodyReader.java:20:55:20:78 | entityStream : InputStream | semmle.label | entityStream : InputStream |
 | TestMessageBodyReader.java:22:18:22:52 | new ObjectInputStream(...) | semmle.label | new ObjectInputStream(...) |
+| TestMessageBodyReader.java:22:40:22:51 | entityStream : InputStream | semmle.label | entityStream : InputStream |
 #select
 | A.java:15:12:15:26 | readObject(...) | A.java:13:31:13:51 | getInputStream(...) : InputStream | A.java:15:12:15:13 | in | Unsafe deserialization of $@. | A.java:13:31:13:51 | getInputStream(...) | user input |
 | A.java:21:12:21:28 | readUnshared(...) | A.java:19:31:19:51 | getInputStream(...) : InputStream | A.java:21:12:21:13 | in | Unsafe deserialization of $@. | A.java:19:31:19:51 | getInputStream(...) | user input |
diff --git a/java/ql/test/query-tests/security/CWE-611/SAXSourceTests.java b/java/ql/test/query-tests/security/CWE-611/SAXSourceTests.java
new file mode 100644
index 00000000000..06a4b5a43f3
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-611/SAXSourceTests.java
@@ -0,0 +1,41 @@
+import java.net.Socket;
+
+import javax.xml.parsers.SAXParser;
+import javax.xml.parsers.SAXParserFactory;
+import javax.xml.transform.sax.SAXSource;
+import javax.xml.bind.JAXBContext;
+import javax.xml.bind.Unmarshaller;
+
+import org.xml.sax.InputSource;
+import org.xml.sax.XMLReader;
+import org.xml.sax.helpers.XMLReaderFactory;
+
+public class SAXSourceTests {
+
+  public void unsafeSource(Socket sock) throws Exception {
+    XMLReader reader = XMLReaderFactory.createXMLReader();
+    SAXSource source = new SAXSource(reader, new InputSource(sock.getInputStream()));
+    JAXBContext jc = JAXBContext.newInstance(Object.class);
+    Unmarshaller um = jc.createUnmarshaller();
+    um.unmarshal(source); // BAD
+  }
+
+  public void explicitlySafeSource1(Socket sock) throws Exception {
+    XMLReader reader = XMLReaderFactory.createXMLReader();
+    reader.setFeature("http://xml.org/sax/features/external-general-entities", false);
+    reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+    reader.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd",false);
+    SAXSource source = new SAXSource(reader, new InputSource(sock.getInputStream())); // GOOD
+  }
+
+  public void createdSafeSource(Socket sock) throws Exception {
+    SAXParserFactory factory = SAXParserFactory.newInstance();
+    factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
+    factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+    factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+    SAXParser parser = factory.newSAXParser();
+    XMLReader reader = parser.getXMLReader();
+    SAXSource source = new SAXSource(parser.getXMLReader(), new InputSource(sock.getInputStream())); // GOOD
+    SAXSource source2 = new SAXSource(reader, new InputSource(sock.getInputStream())); // GOOD
+  }
+}
diff --git a/java/ql/test/query-tests/security/CWE-611/UnmarshallerTests.java b/java/ql/test/query-tests/security/CWE-611/UnmarshallerTests.java
new file mode 100644
index 00000000000..f29018d599a
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-611/UnmarshallerTests.java
@@ -0,0 +1,30 @@
+import java.net.Socket;
+
+import javax.xml.bind.JAXBContext;
+import javax.xml.bind.Unmarshaller;
+import javax.xml.parsers.SAXParserFactory;
+import javax.xml.transform.Source;
+import javax.xml.transform.sax.SAXSource;
+
+import org.xml.sax.InputSource;
+
+public class UnmarshallerTests {
+
+  public void safeUnmarshal(Socket sock) throws Exception {
+    SAXParserFactory spf = SAXParserFactory.newInstance();
+    spf.setFeature("http://xml.org/sax/features/external-general-entities", false);
+    spf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+    spf.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+    JAXBContext jc = JAXBContext.newInstance(Object.class);
+    Source xmlSource = new SAXSource(spf.newSAXParser().getXMLReader(), new InputSource(sock.getInputStream()));
+    Unmarshaller um = jc.createUnmarshaller();
+    um.unmarshal(xmlSource); //safe
+  }
+
+  public void unsafeUnmarshal(Socket sock) throws Exception {
+    SAXParserFactory spf = SAXParserFactory.newInstance();
+    JAXBContext jc = JAXBContext.newInstance(Object.class);
+    Unmarshaller um = jc.createUnmarshaller();
+    um.unmarshal(sock.getInputStream()); //unsafe
+  }
+}
diff --git a/java/ql/test/query-tests/security/CWE-611/XXE.expected b/java/ql/test/query-tests/security/CWE-611/XXE.expected
index 4cdedb8d0aa..e2fcffee125 100644
--- a/java/ql/test/query-tests/security/CWE-611/XXE.expected
+++ b/java/ql/test/query-tests/security/CWE-611/XXE.expected
@@ -1,29 +1,46 @@
 edges
-| DocumentBuilderTests.java:93:51:93:71 | getInputStream(...) : InputStream | DocumentBuilderTests.java:94:16:94:38 | getInputSource(...) |
-| DocumentBuilderTests.java:100:41:100:61 | getInputStream(...) : InputStream | DocumentBuilderTests.java:101:16:101:52 | sourceToInputSource(...) |
-| DocumentBuilderTests.java:100:41:100:61 | getInputStream(...) : InputStream | DocumentBuilderTests.java:102:16:102:38 | getInputStream(...) |
+| DocumentBuilderTests.java:93:21:93:73 | new SAXSource(...) : SAXSource | DocumentBuilderTests.java:94:16:94:21 | source : SAXSource |
+| DocumentBuilderTests.java:93:35:93:72 | new InputSource(...) : InputSource | DocumentBuilderTests.java:93:21:93:73 | new SAXSource(...) : SAXSource |
+| DocumentBuilderTests.java:93:51:93:71 | getInputStream(...) : InputStream | DocumentBuilderTests.java:93:35:93:72 | new InputSource(...) : InputSource |
+| DocumentBuilderTests.java:94:16:94:21 | source : SAXSource | DocumentBuilderTests.java:94:16:94:38 | getInputSource(...) |
+| DocumentBuilderTests.java:100:24:100:62 | new StreamSource(...) : StreamSource | DocumentBuilderTests.java:101:46:101:51 | source : StreamSource |
+| DocumentBuilderTests.java:100:24:100:62 | new StreamSource(...) : StreamSource | DocumentBuilderTests.java:102:16:102:21 | source : StreamSource |
+| DocumentBuilderTests.java:100:41:100:61 | getInputStream(...) : InputStream | DocumentBuilderTests.java:100:24:100:62 | new StreamSource(...) : StreamSource |
+| DocumentBuilderTests.java:101:46:101:51 | source : StreamSource | DocumentBuilderTests.java:101:16:101:52 | sourceToInputSource(...) |
+| DocumentBuilderTests.java:102:16:102:21 | source : StreamSource | DocumentBuilderTests.java:102:16:102:38 | getInputStream(...) |
+| SAXSourceTests.java:17:24:17:84 | new SAXSource(...) : SAXSource | SAXSourceTests.java:20:18:20:23 | source |
+| SAXSourceTests.java:17:46:17:83 | new InputSource(...) : InputSource | SAXSourceTests.java:17:24:17:84 | new SAXSource(...) : SAXSource |
+| SAXSourceTests.java:17:62:17:82 | getInputStream(...) : InputStream | SAXSourceTests.java:17:46:17:83 | new InputSource(...) : InputSource |
 | SchemaTests.java:12:56:12:76 | getInputStream(...) : InputStream | SchemaTests.java:12:39:12:77 | new StreamSource(...) |
 | SchemaTests.java:25:56:25:76 | getInputStream(...) : InputStream | SchemaTests.java:25:39:25:77 | new StreamSource(...) |
 | SchemaTests.java:31:56:31:76 | getInputStream(...) : InputStream | SchemaTests.java:31:39:31:77 | new StreamSource(...) |
 | SchemaTests.java:38:56:38:76 | getInputStream(...) : InputStream | SchemaTests.java:38:39:38:77 | new StreamSource(...) |
 | SchemaTests.java:45:56:45:76 | getInputStream(...) : InputStream | SchemaTests.java:45:39:45:77 | new StreamSource(...) |
 | SimpleXMLTests.java:24:63:24:83 | getInputStream(...) : InputStream | SimpleXMLTests.java:24:41:24:84 | new InputStreamReader(...) |
-| SimpleXMLTests.java:30:5:30:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:31:41:31:53 | new String(...) |
-| SimpleXMLTests.java:37:5:37:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:38:41:38:53 | new String(...) |
+| SimpleXMLTests.java:30:5:30:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:30:32:30:32 | b [post update] : byte[] |
+| SimpleXMLTests.java:30:32:30:32 | b [post update] : byte[] | SimpleXMLTests.java:31:41:31:53 | new String(...) |
+| SimpleXMLTests.java:37:5:37:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:37:32:37:32 | b [post update] : byte[] |
+| SimpleXMLTests.java:37:32:37:32 | b [post update] : byte[] | SimpleXMLTests.java:38:41:38:53 | new String(...) |
 | SimpleXMLTests.java:43:63:43:83 | getInputStream(...) : InputStream | SimpleXMLTests.java:43:41:43:84 | new InputStreamReader(...) |
 | SimpleXMLTests.java:68:59:68:79 | getInputStream(...) : InputStream | SimpleXMLTests.java:68:37:68:80 | new InputStreamReader(...) |
 | SimpleXMLTests.java:73:59:73:79 | getInputStream(...) : InputStream | SimpleXMLTests.java:73:37:73:80 | new InputStreamReader(...) |
 | SimpleXMLTests.java:78:48:78:68 | getInputStream(...) : InputStream | SimpleXMLTests.java:78:26:78:69 | new InputStreamReader(...) |
 | SimpleXMLTests.java:83:48:83:68 | getInputStream(...) : InputStream | SimpleXMLTests.java:83:26:83:69 | new InputStreamReader(...) |
-| SimpleXMLTests.java:89:5:89:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:90:37:90:49 | new String(...) |
-| SimpleXMLTests.java:96:5:96:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:97:37:97:49 | new String(...) |
-| SimpleXMLTests.java:103:5:103:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:104:26:104:38 | new String(...) |
-| SimpleXMLTests.java:110:5:110:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:111:26:111:38 | new String(...) |
+| SimpleXMLTests.java:89:5:89:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:89:32:89:32 | b [post update] : byte[] |
+| SimpleXMLTests.java:89:32:89:32 | b [post update] : byte[] | SimpleXMLTests.java:90:37:90:49 | new String(...) |
+| SimpleXMLTests.java:96:5:96:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:96:32:96:32 | b [post update] : byte[] |
+| SimpleXMLTests.java:96:32:96:32 | b [post update] : byte[] | SimpleXMLTests.java:97:37:97:49 | new String(...) |
+| SimpleXMLTests.java:103:5:103:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:103:32:103:32 | b [post update] : byte[] |
+| SimpleXMLTests.java:103:32:103:32 | b [post update] : byte[] | SimpleXMLTests.java:104:26:104:38 | new String(...) |
+| SimpleXMLTests.java:110:5:110:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:110:32:110:32 | b [post update] : byte[] |
+| SimpleXMLTests.java:110:32:110:32 | b [post update] : byte[] | SimpleXMLTests.java:111:26:111:38 | new String(...) |
 | SimpleXMLTests.java:119:44:119:64 | getInputStream(...) : InputStream | SimpleXMLTests.java:119:22:119:65 | new InputStreamReader(...) |
 | SimpleXMLTests.java:129:44:129:64 | getInputStream(...) : InputStream | SimpleXMLTests.java:129:22:129:65 | new InputStreamReader(...) |
 | SimpleXMLTests.java:139:44:139:64 | getInputStream(...) : InputStream | SimpleXMLTests.java:139:22:139:65 | new InputStreamReader(...) |
-| SimpleXMLTests.java:145:5:145:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:146:22:146:34 | new String(...) |
-| SimpleXMLTests.java:152:5:152:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:153:22:153:34 | new String(...) |
+| SimpleXMLTests.java:145:5:145:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:145:32:145:32 | b [post update] : byte[] |
+| SimpleXMLTests.java:145:32:145:32 | b [post update] : byte[] | SimpleXMLTests.java:146:22:146:34 | new String(...) |
+| SimpleXMLTests.java:152:5:152:25 | getInputStream(...) : InputStream | SimpleXMLTests.java:152:32:152:32 | b [post update] : byte[] |
+| SimpleXMLTests.java:152:32:152:32 | b [post update] : byte[] | SimpleXMLTests.java:153:22:153:34 | new String(...) |
 | TransformerTests.java:20:44:20:64 | getInputStream(...) : InputStream | TransformerTests.java:20:27:20:65 | new StreamSource(...) |
 | TransformerTests.java:21:40:21:60 | getInputStream(...) : InputStream | TransformerTests.java:21:23:21:61 | new StreamSource(...) |
 | TransformerTests.java:71:44:71:64 | getInputStream(...) : InputStream | TransformerTests.java:71:27:71:65 | new StreamSource(...) |
@@ -39,7 +56,8 @@ edges
 | TransformerTests.java:122:38:122:58 | getInputStream(...) : InputStream | TransformerTests.java:122:21:122:59 | new StreamSource(...) |
 | TransformerTests.java:129:38:129:58 | getInputStream(...) : InputStream | TransformerTests.java:129:21:129:59 | new StreamSource(...) |
 | TransformerTests.java:136:38:136:58 | getInputStream(...) : InputStream | TransformerTests.java:136:21:136:59 | new StreamSource(...) |
-| TransformerTests.java:141:48:141:68 | getInputStream(...) : InputStream | TransformerTests.java:141:18:141:70 | new SAXSource(...) |
+| TransformerTests.java:141:32:141:69 | new InputSource(...) : InputSource | TransformerTests.java:141:18:141:70 | new SAXSource(...) |
+| TransformerTests.java:141:48:141:68 | getInputStream(...) : InputStream | TransformerTests.java:141:32:141:69 | new InputSource(...) : InputSource |
 | XMLReaderTests.java:16:34:16:54 | getInputStream(...) : InputStream | XMLReaderTests.java:16:18:16:55 | new InputSource(...) |
 | XMLReaderTests.java:56:34:56:54 | getInputStream(...) : InputStream | XMLReaderTests.java:56:18:56:55 | new InputSource(...) |
 | XMLReaderTests.java:63:34:63:54 | getInputStream(...) : InputStream | XMLReaderTests.java:63:18:63:55 | new InputSource(...) |
@@ -57,10 +75,16 @@ nodes
 | DocumentBuilderTests.java:71:19:71:39 | getInputStream(...) | semmle.label | getInputStream(...) |
 | DocumentBuilderTests.java:79:19:79:39 | getInputStream(...) | semmle.label | getInputStream(...) |
 | DocumentBuilderTests.java:87:19:87:39 | getInputStream(...) | semmle.label | getInputStream(...) |
+| DocumentBuilderTests.java:93:21:93:73 | new SAXSource(...) : SAXSource | semmle.label | new SAXSource(...) : SAXSource |
+| DocumentBuilderTests.java:93:35:93:72 | new InputSource(...) : InputSource | semmle.label | new InputSource(...) : InputSource |
 | DocumentBuilderTests.java:93:51:93:71 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| DocumentBuilderTests.java:94:16:94:21 | source : SAXSource | semmle.label | source : SAXSource |
 | DocumentBuilderTests.java:94:16:94:38 | getInputSource(...) | semmle.label | getInputSource(...) |
+| DocumentBuilderTests.java:100:24:100:62 | new StreamSource(...) : StreamSource | semmle.label | new StreamSource(...) : StreamSource |
 | DocumentBuilderTests.java:100:41:100:61 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | DocumentBuilderTests.java:101:16:101:52 | sourceToInputSource(...) | semmle.label | sourceToInputSource(...) |
+| DocumentBuilderTests.java:101:46:101:51 | source : StreamSource | semmle.label | source : StreamSource |
+| DocumentBuilderTests.java:102:16:102:21 | source : StreamSource | semmle.label | source : StreamSource |
 | DocumentBuilderTests.java:102:16:102:38 | getInputStream(...) | semmle.label | getInputStream(...) |
 | SAXBuilderTests.java:8:19:8:39 | getInputStream(...) | semmle.label | getInputStream(...) |
 | SAXBuilderTests.java:20:19:20:39 | getInputStream(...) | semmle.label | getInputStream(...) |
@@ -78,6 +102,10 @@ nodes
 | SAXReaderTests.java:45:17:45:37 | getInputStream(...) | semmle.label | getInputStream(...) |
 | SAXReaderTests.java:53:17:53:37 | getInputStream(...) | semmle.label | getInputStream(...) |
 | SAXReaderTests.java:61:17:61:37 | getInputStream(...) | semmle.label | getInputStream(...) |
+| SAXSourceTests.java:17:24:17:84 | new SAXSource(...) : SAXSource | semmle.label | new SAXSource(...) : SAXSource |
+| SAXSourceTests.java:17:46:17:83 | new InputSource(...) : InputSource | semmle.label | new InputSource(...) : InputSource |
+| SAXSourceTests.java:17:62:17:82 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| SAXSourceTests.java:20:18:20:23 | source | semmle.label | source |
 | SchemaTests.java:12:39:12:77 | new StreamSource(...) | semmle.label | new StreamSource(...) |
 | SchemaTests.java:12:56:12:76 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | SchemaTests.java:25:39:25:77 | new StreamSource(...) | semmle.label | new StreamSource(...) |
@@ -93,8 +121,10 @@ nodes
 | SimpleXMLTests.java:24:41:24:84 | new InputStreamReader(...) | semmle.label | new InputStreamReader(...) |
 | SimpleXMLTests.java:24:63:24:83 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | SimpleXMLTests.java:30:5:30:25 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| SimpleXMLTests.java:30:32:30:32 | b [post update] : byte[] | semmle.label | b [post update] : byte[] |
 | SimpleXMLTests.java:31:41:31:53 | new String(...) | semmle.label | new String(...) |
 | SimpleXMLTests.java:37:5:37:25 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| SimpleXMLTests.java:37:32:37:32 | b [post update] : byte[] | semmle.label | b [post update] : byte[] |
 | SimpleXMLTests.java:38:41:38:53 | new String(...) | semmle.label | new String(...) |
 | SimpleXMLTests.java:43:41:43:84 | new InputStreamReader(...) | semmle.label | new InputStreamReader(...) |
 | SimpleXMLTests.java:43:63:43:83 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
@@ -111,12 +141,16 @@ nodes
 | SimpleXMLTests.java:83:26:83:69 | new InputStreamReader(...) | semmle.label | new InputStreamReader(...) |
 | SimpleXMLTests.java:83:48:83:68 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | SimpleXMLTests.java:89:5:89:25 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| SimpleXMLTests.java:89:32:89:32 | b [post update] : byte[] | semmle.label | b [post update] : byte[] |
 | SimpleXMLTests.java:90:37:90:49 | new String(...) | semmle.label | new String(...) |
 | SimpleXMLTests.java:96:5:96:25 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| SimpleXMLTests.java:96:32:96:32 | b [post update] : byte[] | semmle.label | b [post update] : byte[] |
 | SimpleXMLTests.java:97:37:97:49 | new String(...) | semmle.label | new String(...) |
 | SimpleXMLTests.java:103:5:103:25 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| SimpleXMLTests.java:103:32:103:32 | b [post update] : byte[] | semmle.label | b [post update] : byte[] |
 | SimpleXMLTests.java:104:26:104:38 | new String(...) | semmle.label | new String(...) |
 | SimpleXMLTests.java:110:5:110:25 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| SimpleXMLTests.java:110:32:110:32 | b [post update] : byte[] | semmle.label | b [post update] : byte[] |
 | SimpleXMLTests.java:111:26:111:38 | new String(...) | semmle.label | new String(...) |
 | SimpleXMLTests.java:115:22:115:42 | getInputStream(...) | semmle.label | getInputStream(...) |
 | SimpleXMLTests.java:119:22:119:65 | new InputStreamReader(...) | semmle.label | new InputStreamReader(...) |
@@ -128,8 +162,10 @@ nodes
 | SimpleXMLTests.java:139:22:139:65 | new InputStreamReader(...) | semmle.label | new InputStreamReader(...) |
 | SimpleXMLTests.java:139:44:139:64 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | SimpleXMLTests.java:145:5:145:25 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| SimpleXMLTests.java:145:32:145:32 | b [post update] : byte[] | semmle.label | b [post update] : byte[] |
 | SimpleXMLTests.java:146:22:146:34 | new String(...) | semmle.label | new String(...) |
 | SimpleXMLTests.java:152:5:152:25 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| SimpleXMLTests.java:152:32:152:32 | b [post update] : byte[] | semmle.label | b [post update] : byte[] |
 | SimpleXMLTests.java:153:22:153:34 | new String(...) | semmle.label | new String(...) |
 | TransformerTests.java:20:27:20:65 | new StreamSource(...) | semmle.label | new StreamSource(...) |
 | TransformerTests.java:20:44:20:64 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
@@ -162,7 +198,9 @@ nodes
 | TransformerTests.java:136:21:136:59 | new StreamSource(...) | semmle.label | new StreamSource(...) |
 | TransformerTests.java:136:38:136:58 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | TransformerTests.java:141:18:141:70 | new SAXSource(...) | semmle.label | new SAXSource(...) |
+| TransformerTests.java:141:32:141:69 | new InputSource(...) : InputSource | semmle.label | new InputSource(...) : InputSource |
 | TransformerTests.java:141:48:141:68 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
+| UnmarshallerTests.java:28:18:28:38 | getInputStream(...) | semmle.label | getInputStream(...) |
 | XMLReaderTests.java:16:18:16:55 | new InputSource(...) | semmle.label | new InputSource(...) |
 | XMLReaderTests.java:16:34:16:54 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
 | XMLReaderTests.java:56:18:56:55 | new InputSource(...) | semmle.label | new InputSource(...) |
@@ -220,6 +258,7 @@ nodes
 | SAXReaderTests.java:45:17:45:37 | getInputStream(...) | SAXReaderTests.java:45:17:45:37 | getInputStream(...) | SAXReaderTests.java:45:17:45:37 | getInputStream(...) | Unsafe parsing of XML file from $@. | SAXReaderTests.java:45:17:45:37 | getInputStream(...) | user input |
 | SAXReaderTests.java:53:17:53:37 | getInputStream(...) | SAXReaderTests.java:53:17:53:37 | getInputStream(...) | SAXReaderTests.java:53:17:53:37 | getInputStream(...) | Unsafe parsing of XML file from $@. | SAXReaderTests.java:53:17:53:37 | getInputStream(...) | user input |
 | SAXReaderTests.java:61:17:61:37 | getInputStream(...) | SAXReaderTests.java:61:17:61:37 | getInputStream(...) | SAXReaderTests.java:61:17:61:37 | getInputStream(...) | Unsafe parsing of XML file from $@. | SAXReaderTests.java:61:17:61:37 | getInputStream(...) | user input |
+| SAXSourceTests.java:20:18:20:23 | source | SAXSourceTests.java:17:62:17:82 | getInputStream(...) : InputStream | SAXSourceTests.java:20:18:20:23 | source | Unsafe parsing of XML file from $@. | SAXSourceTests.java:17:62:17:82 | getInputStream(...) | user input |
 | SchemaTests.java:12:39:12:77 | new StreamSource(...) | SchemaTests.java:12:56:12:76 | getInputStream(...) : InputStream | SchemaTests.java:12:39:12:77 | new StreamSource(...) | Unsafe parsing of XML file from $@. | SchemaTests.java:12:56:12:76 | getInputStream(...) | user input |
 | SchemaTests.java:25:39:25:77 | new StreamSource(...) | SchemaTests.java:25:56:25:76 | getInputStream(...) : InputStream | SchemaTests.java:25:39:25:77 | new StreamSource(...) | Unsafe parsing of XML file from $@. | SchemaTests.java:25:56:25:76 | getInputStream(...) | user input |
 | SchemaTests.java:31:39:31:77 | new StreamSource(...) | SchemaTests.java:31:56:31:76 | getInputStream(...) : InputStream | SchemaTests.java:31:39:31:77 | new StreamSource(...) | Unsafe parsing of XML file from $@. | SchemaTests.java:31:56:31:76 | getInputStream(...) | user input |
@@ -267,6 +306,7 @@ nodes
 | TransformerTests.java:129:21:129:59 | new StreamSource(...) | TransformerTests.java:129:38:129:58 | getInputStream(...) : InputStream | TransformerTests.java:129:21:129:59 | new StreamSource(...) | Unsafe parsing of XML file from $@. | TransformerTests.java:129:38:129:58 | getInputStream(...) | user input |
 | TransformerTests.java:136:21:136:59 | new StreamSource(...) | TransformerTests.java:136:38:136:58 | getInputStream(...) : InputStream | TransformerTests.java:136:21:136:59 | new StreamSource(...) | Unsafe parsing of XML file from $@. | TransformerTests.java:136:38:136:58 | getInputStream(...) | user input |
 | TransformerTests.java:141:18:141:70 | new SAXSource(...) | TransformerTests.java:141:48:141:68 | getInputStream(...) : InputStream | TransformerTests.java:141:18:141:70 | new SAXSource(...) | Unsafe parsing of XML file from $@. | TransformerTests.java:141:48:141:68 | getInputStream(...) | user input |
+| UnmarshallerTests.java:28:18:28:38 | getInputStream(...) | UnmarshallerTests.java:28:18:28:38 | getInputStream(...) | UnmarshallerTests.java:28:18:28:38 | getInputStream(...) | Unsafe parsing of XML file from $@. | UnmarshallerTests.java:28:18:28:38 | getInputStream(...) | user input |
 | XMLReaderTests.java:16:18:16:55 | new InputSource(...) | XMLReaderTests.java:16:34:16:54 | getInputStream(...) : InputStream | XMLReaderTests.java:16:18:16:55 | new InputSource(...) | Unsafe parsing of XML file from $@. | XMLReaderTests.java:16:34:16:54 | getInputStream(...) | user input |
 | XMLReaderTests.java:56:18:56:55 | new InputSource(...) | XMLReaderTests.java:56:34:56:54 | getInputStream(...) : InputStream | XMLReaderTests.java:56:18:56:55 | new InputSource(...) | Unsafe parsing of XML file from $@. | XMLReaderTests.java:56:34:56:54 | getInputStream(...) | user input |
 | XMLReaderTests.java:63:18:63:55 | new InputSource(...) | XMLReaderTests.java:63:34:63:54 | getInputStream(...) : InputStream | XMLReaderTests.java:63:18:63:55 | new InputSource(...) | Unsafe parsing of XML file from $@. | XMLReaderTests.java:63:34:63:54 | getInputStream(...) | user input |
diff --git a/java/ql/test/query-tests/security/CWE-611/options b/java/ql/test/query-tests/security/CWE-611/options
index 6bfedccfc25..89b9a39f7ce 100644
--- a/java/ql/test/query-tests/security/CWE-611/options
+++ b/java/ql/test/query-tests/security/CWE-611/options
@@ -1 +1 @@
-//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/jdom-1.1.3:${testdir}/../../../stubs/dom4j-2.1.1:${testdir}/../../../stubs/simple-xml-2.7.1
+//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/jdom-1.1.3:${testdir}/../../../stubs/dom4j-2.1.1:${testdir}/../../../stubs/simple-xml-2.7.1:${testdir}/../../../stubs/jaxb-api-2.3.1
diff --git a/java/ql/test/query-tests/security/CWE-681/semmle/tests/NumericCastTaintedLocal.expected b/java/ql/test/query-tests/security/CWE-681/semmle/tests/NumericCastTaintedLocal.expected
index 0be574cad70..90e1b421f97 100644
--- a/java/ql/test/query-tests/security/CWE-681/semmle/tests/NumericCastTaintedLocal.expected
+++ b/java/ql/test/query-tests/security/CWE-681/semmle/tests/NumericCastTaintedLocal.expected
@@ -1,7 +1,15 @@
 edges
-| Test.java:11:28:11:36 | System.in : InputStream | Test.java:21:22:21:25 | data |
+| Test.java:10:36:11:47 | new BufferedReader(...) : BufferedReader | Test.java:12:26:12:39 | readerBuffered : BufferedReader |
+| Test.java:11:6:11:46 | new InputStreamReader(...) : InputStreamReader | Test.java:10:36:11:47 | new BufferedReader(...) : BufferedReader |
+| Test.java:11:28:11:36 | System.in : InputStream | Test.java:11:6:11:46 | new InputStreamReader(...) : InputStreamReader |
+| Test.java:12:26:12:39 | readerBuffered : BufferedReader | Test.java:12:26:12:50 | readLine(...) : String |
+| Test.java:12:26:12:50 | readLine(...) : String | Test.java:21:22:21:25 | data |
 nodes
+| Test.java:10:36:11:47 | new BufferedReader(...) : BufferedReader | semmle.label | new BufferedReader(...) : BufferedReader |
+| Test.java:11:6:11:46 | new InputStreamReader(...) : InputStreamReader | semmle.label | new InputStreamReader(...) : InputStreamReader |
 | Test.java:11:28:11:36 | System.in : InputStream | semmle.label | System.in : InputStream |
+| Test.java:12:26:12:39 | readerBuffered : BufferedReader | semmle.label | readerBuffered : BufferedReader |
+| Test.java:12:26:12:50 | readLine(...) : String | semmle.label | readLine(...) : String |
 | Test.java:21:22:21:25 | data | semmle.label | data |
 #select
 | Test.java:21:17:21:25 | (...)... | Test.java:11:28:11:36 | System.in : InputStream | Test.java:21:22:21:25 | data | $@ flows to here and is cast to a narrower type, potentially causing truncation. | Test.java:11:28:11:36 | System.in | User-provided value |
diff --git a/java/ql/test/stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/ArrayUtils.java b/java/ql/test/stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/ArrayUtils.java
new file mode 100644
index 00000000000..d57fe87b9a8
--- /dev/null
+++ b/java/ql/test/stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/ArrayUtils.java
@@ -0,0 +1,1383 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.commons.lang3;
+
+import java.lang.reflect.Array;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.lang.reflect.Type;
+import java.util.Arrays;
+import java.util.BitSet;
+import java.util.Comparator;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Random;
+
+
+public class ArrayUtils {
+    public static boolean[] add(final boolean[] array, final boolean element) {
+      return null;
+    }
+
+    public static boolean[] add(final boolean[] array, final int index, final boolean element) {
+      return null;
+    }
+
+    public static byte[] add(final byte[] array, final byte element) {
+      return null;
+    }
+
+    public static byte[] add(final byte[] array, final int index, final byte element) {
+      return null;
+    }
+
+    public static char[] add(final char[] array, final char element) {
+      return null;
+    }
+
+    public static char[] add(final char[] array, final int index, final char element) {
+      return null;
+    }
+
+    public static double[] add(final double[] array, final double element) {
+      return null;
+    }
+
+    public static double[] add(final double[] array, final int index, final double element) {
+      return null;
+    }
+
+    public static float[] add(final float[] array, final float element) {
+      return null;
+    }
+
+    public static float[] add(final float[] array, final int index, final float element) {
+      return null;
+    }
+
+    public static int[] add(final int[] array, final int element) {
+      return null;
+    }
+
+    public static int[] add(final int[] array, final int index, final int element) {
+      return null;
+    }
+
+    public static long[] add(final long[] array, final int index, final long element) {
+      return null;
+    }
+
+    public static long[] add(final long[] array, final long element) {
+      return null;
+    }
+
+    public static short[] add(final short[] array, final int index, final short element) {
+      return null;
+    }
+
+    public static short[] add(final short[] array, final short element) {
+      return null;
+    }
+
+    public static <T> T[] add(final T[] array, final int index, final T element) {
+      return null;
+    }
+
+    public static <T> T[] add(final T[] array, final T element) {
+      return null;
+    }
+
+    public static boolean[] addAll(final boolean[] array1, final boolean... array2) {
+      return null;
+    }
+
+    public static byte[] addAll(final byte[] array1, final byte... array2) {
+      return null;
+    }
+
+    public static char[] addAll(final char[] array1, final char... array2) {
+      return null;
+    }
+
+    public static double[] addAll(final double[] array1, final double... array2) {
+      return null;
+    }
+
+    public static float[] addAll(final float[] array1, final float... array2) {
+      return null;
+    }
+
+    public static int[] addAll(final int[] array1, final int... array2) {
+      return null;
+    }
+
+    public static long[] addAll(final long[] array1, final long... array2) {
+      return null;
+    }
+
+    public static short[] addAll(final short[] array1, final short... array2) {
+      return null;
+    }
+
+    public static <T> T[] addAll(final T[] array1, @SuppressWarnings("unchecked") final T... array2) {
+      return null;
+    }
+
+    public static boolean[] addFirst(final boolean[] array, final boolean element) {
+      return null;
+    }
+
+    public static byte[] addFirst(final byte[] array, final byte element) {
+      return null;
+    }
+
+    public static char[] addFirst(final char[] array, final char element) {
+      return null;
+    }
+
+    public static double[] addFirst(final double[] array, final double element) {
+      return null;
+    }
+
+    public static float[] addFirst(final float[] array, final float element) {
+      return null;
+    }
+
+    public static int[] addFirst(final int[] array, final int element) {
+      return null;
+    }
+
+    public static long[] addFirst(final long[] array, final long element) {
+      return null;
+    }
+
+    public static short[] addFirst(final short[] array, final short element) {
+      return null;
+    }
+
+    public static <T> T[] addFirst(final T[] array, final T element) {
+      return null;
+    }
+
+    public static boolean[] clone(final boolean[] array) {
+      return null;
+    }
+
+    public static byte[] clone(final byte[] array) {
+      return null;
+    }
+
+    public static char[] clone(final char[] array) {
+      return null;
+    }
+
+    public static double[] clone(final double[] array) {
+      return null;
+    }
+
+    public static float[] clone(final float[] array) {
+      return null;
+    }
+
+    public static int[] clone(final int[] array) {
+      return null;
+    }
+
+    public static long[] clone(final long[] array) {
+      return null;
+    }
+
+    public static short[] clone(final short[] array) {
+      return null;
+    }
+
+    public static <T> T[] clone(final T[] array) {
+      return null;
+    }
+
+    public static boolean contains(final boolean[] array, final boolean valueToFind) {
+      return false;
+    }
+
+    public static boolean contains(final byte[] array, final byte valueToFind) {
+      return false;
+    }
+
+    public static boolean contains(final char[] array, final char valueToFind) {
+      return false;
+    }
+
+    public static boolean contains(final double[] array, final double valueToFind) {
+      return false;
+    }
+
+    public static boolean contains(final double[] array, final double valueToFind, final double tolerance) {
+      return false;
+    }
+
+    public static boolean contains(final float[] array, final float valueToFind) {
+      return false;
+    }
+
+    public static boolean contains(final int[] array, final int valueToFind) {
+      return false;
+    }
+
+    public static boolean contains(final long[] array, final long valueToFind) {
+      return false;
+    }
+
+    public static boolean contains(final Object[] array, final Object objectToFind) {
+      return false;
+    }
+
+    public static boolean contains(final short[] array, final short valueToFind) {
+      return false;
+    }
+
+    public static <T> T get(final T[] array, final int index) {
+      return null;
+    }
+
+    public static <T> T get(final T[] array, final int index, final T defaultValue) {
+      return null;
+    }
+
+    public static int getLength(final Object array) {
+      return 0;
+    }
+
+    public static int hashCode(final Object array) {
+      return 0;
+    }
+
+    public static BitSet indexesOf(final boolean[] array, final boolean valueToFind) {
+      return null;
+    }
+
+    public static BitSet indexesOf(final boolean[] array, final boolean valueToFind, int startIndex) {
+      return null;
+    }
+
+    public static BitSet indexesOf(final byte[] array, final byte valueToFind) {
+      return null;
+    }
+
+    public static BitSet indexesOf(final byte[] array, final byte valueToFind, int startIndex) {
+      return null;
+    }
+
+    public static BitSet indexesOf(final char[] array, final char valueToFind) {
+      return null;
+    }
+
+    public static BitSet indexesOf(final char[] array, final char valueToFind, int startIndex) {
+      return null;
+    }
+
+    public static BitSet indexesOf(final double[] array, final double valueToFind) {
+      return null;
+    }
+
+    public static BitSet indexesOf(final double[] array, final double valueToFind, final double tolerance) {
+      return null;
+    }
+
+    public static BitSet indexesOf(final double[] array, final double valueToFind, int startIndex) {
+      return null;
+    }
+
+    public static BitSet indexesOf(final double[] array, final double valueToFind, int startIndex, final double tolerance) {
+      return null;
+    }
+
+    public static BitSet indexesOf(final float[] array, final float valueToFind) {
+      return null;
+    }
+
+    public static BitSet indexesOf(final float[] array, final float valueToFind, int startIndex) {
+      return null;
+    }
+
+    public static BitSet indexesOf(final int[] array, final int valueToFind) {
+      return null;
+    }
+
+    public static BitSet indexesOf(final int[] array, final int valueToFind, int startIndex) {
+      return null;
+    }
+
+    public static BitSet indexesOf(final long[] array, final long valueToFind) {
+      return null;
+    }
+
+    public static BitSet indexesOf(final long[] array, final long valueToFind, int startIndex) {
+      return null;
+    }
+
+    public static BitSet indexesOf(final Object[] array, final Object objectToFind) {
+      return null;
+    }
+
+    public static BitSet indexesOf(final Object[] array, final Object objectToFind, int startIndex) {
+      return null;
+    }
+
+    public static BitSet indexesOf(final short[] array, final short valueToFind) {
+      return null;
+    }
+
+    public static BitSet indexesOf(final short[] array, final short valueToFind, int startIndex) {
+      return null;
+    }
+
+    public static int indexOf(final boolean[] array, final boolean valueToFind) {
+      return 0;
+    }
+
+    public static int indexOf(final boolean[] array, final boolean valueToFind, int startIndex) {
+      return 0;
+    }
+
+    public static int indexOf(final byte[] array, final byte valueToFind) {
+      return 0;
+    }
+
+    public static int indexOf(final byte[] array, final byte valueToFind, int startIndex) {
+      return 0;
+    }
+
+    public static int indexOf(final char[] array, final char valueToFind) {
+      return 0;
+    }
+
+    public static int indexOf(final char[] array, final char valueToFind, int startIndex) {
+      return 0;
+    }
+
+    public static int indexOf(final double[] array, final double valueToFind) {
+      return 0;
+    }
+
+    public static int indexOf(final double[] array, final double valueToFind, final double tolerance) {
+      return 0;
+    }
+
+    public static int indexOf(final double[] array, final double valueToFind, int startIndex) {
+      return 0;
+    }
+
+    public static int indexOf(final double[] array, final double valueToFind, int startIndex, final double tolerance) {
+      return 0;
+    }
+
+    public static int indexOf(final float[] array, final float valueToFind) {
+      return 0;
+    }
+
+    public static int indexOf(final float[] array, final float valueToFind, int startIndex) {
+      return 0;
+    }
+
+    public static int indexOf(final int[] array, final int valueToFind) {
+      return 0;
+    }
+
+public static int indexOf(final int[] array, final int valueToFind, int startIndex) {
+  return 0;
+}
+
+    public static int indexOf(final long[] array, final long valueToFind) {
+      return 0;
+    }
+
+    public static int indexOf(final long[] array, final long valueToFind, int startIndex) {
+      return 0;
+    }
+
+    public static int indexOf(final Object[] array, final Object objectToFind) {
+      return 0;
+    }
+
+    public static int indexOf(final Object[] array, final Object objectToFind, int startIndex) {
+      return 0;
+    }
+
+    public static int indexOf(final short[] array, final short valueToFind) {
+      return 0;
+    }
+
+    public static int indexOf(final short[] array, final short valueToFind, int startIndex) {
+      return 0;
+    }
+
+    public static boolean[] insert(final int index, final boolean[] array, final boolean... values) {
+      return null;
+    }
+
+    public static byte[] insert(final int index, final byte[] array, final byte... values) {
+      return null;
+    }
+
+    public static char[] insert(final int index, final char[] array, final char... values) {
+      return null;
+    }
+
+    public static double[] insert(final int index, final double[] array, final double... values) {
+      return null;
+    }
+
+    public static float[] insert(final int index, final float[] array, final float... values) {
+      return null;
+    }
+
+    public static int[] insert(final int index, final int[] array, final int... values) {
+      return null;
+    }
+
+    public static long[] insert(final int index, final long[] array, final long... values) {
+      return null;
+    }
+
+    public static short[] insert(final int index, final short[] array, final short... values) {
+      return null;
+    }
+
+    public static <T> T[] insert(final int index, final T[] array, final T... values) {
+      return null;
+    }
+
+    public static <T> boolean isArrayIndexValid(final T[] array, final int index) {
+      return false;
+    }
+
+    public static boolean isEmpty(final boolean[] array) {
+      return false;
+    }
+
+    public static boolean isEmpty(final byte[] array) {
+      return false;
+    }
+
+    public static boolean isEmpty(final char[] array) {
+      return false;
+    }
+
+    public static boolean isEmpty(final double[] array) {
+      return false;
+    }
+
+    public static boolean isEmpty(final float[] array) {
+      return false;
+    }
+
+    public static boolean isEmpty(final int[] array) {
+      return false;
+    }
+
+    public static boolean isEmpty(final long[] array) {
+      return false;
+    }
+
+    public static boolean isEmpty(final Object[] array) {
+      return false;
+    }
+
+    public static boolean isEmpty(final short[] array) {
+      return false;
+    }
+
+    public static boolean isEquals(final Object array1, final Object array2) {
+      return false;
+    }
+
+    public static boolean isNotEmpty(final boolean[] array) {
+      return false;
+    }
+
+    public static boolean isNotEmpty(final byte[] array) {
+      return false;
+    }
+
+    public static boolean isNotEmpty(final char[] array) {
+      return false;
+    }
+
+    public static boolean isNotEmpty(final double[] array) {
+      return false;
+    }
+
+    public static boolean isNotEmpty(final float[] array) {
+      return false;
+    }
+
+    public static boolean isNotEmpty(final int[] array) {
+      return false;
+    }
+
+    public static boolean isNotEmpty(final long[] array) {
+      return false;
+    }
+
+    public static boolean isNotEmpty(final short[] array) {
+      return false;
+    }
+
+     public static <T> boolean isNotEmpty(final T[] array) {
+       return false;
+     }
+
+    public static boolean isSameLength(final boolean[] array1, final boolean[] array2) {
+      return false;
+    }
+
+    public static boolean isSameLength(final byte[] array1, final byte[] array2) {
+      return false;
+    }
+
+    public static boolean isSameLength(final char[] array1, final char[] array2) {
+      return false;
+    }
+
+    public static boolean isSameLength(final double[] array1, final double[] array2) {
+      return false;
+    }
+
+    public static boolean isSameLength(final float[] array1, final float[] array2) {
+      return false;
+    }
+
+    public static boolean isSameLength(final int[] array1, final int[] array2) {
+      return false;
+    }
+
+    public static boolean isSameLength(final long[] array1, final long[] array2) {
+      return false;
+    }
+
+    public static boolean isSameLength(final Object array1, final Object array2) {
+      return false;
+    }
+
+    public static boolean isSameLength(final Object[] array1, final Object[] array2) {
+      return false;
+    }
+
+    public static boolean isSameLength(final short[] array1, final short[] array2) {
+      return false;
+    }
+
+    public static boolean isSameType(final Object array1, final Object array2) {
+      return false;
+    }
+
+    public static boolean isSorted(final boolean[] array) {
+      return false;
+    }
+
+    public static boolean isSorted(final byte[] array) {
+      return false;
+    }
+
+    public static boolean isSorted(final char[] array) {
+      return false;
+    }
+
+    public static boolean isSorted(final double[] array) {
+      return false;
+    }
+
+    public static boolean isSorted(final float[] array) {
+      return false;
+    }
+
+    public static boolean isSorted(final int[] array) {
+      return false;
+    }
+
+    public static boolean isSorted(final long[] array) {
+      return false;
+    }
+
+    public static boolean isSorted(final short[] array) {
+      return false;
+    }
+
+    public static <T extends Comparable<? super T>> boolean isSorted(final T[] array) {
+      return false;
+    }
+
+    public static <T> boolean isSorted(final T[] array, final Comparator<T> comparator) {
+      return false;
+    }
+
+    public static int lastIndexOf(final boolean[] array, final boolean valueToFind) {
+      return 0;
+    }
+
+    public static int lastIndexOf(final boolean[] array, final boolean valueToFind, int startIndex) {
+      return 0;
+    }
+
+    public static int lastIndexOf(final byte[] array, final byte valueToFind) {
+      return 0;
+    }
+
+    public static int lastIndexOf(final byte[] array, final byte valueToFind, int startIndex) {
+      return 0;
+    }
+
+    public static int lastIndexOf(final char[] array, final char valueToFind) {
+      return 0;
+    }
+
+    public static int lastIndexOf(final char[] array, final char valueToFind, int startIndex) {
+      return 0;
+    }
+
+    public static int lastIndexOf(final double[] array, final double valueToFind) {
+      return 0;
+    }
+
+    public static int lastIndexOf(final double[] array, final double valueToFind, final double tolerance) {
+      return 0;
+    }
+
+    public static int lastIndexOf(final double[] array, final double valueToFind, int startIndex) {
+      return 0;
+    }
+
+    public static int lastIndexOf(final double[] array, final double valueToFind, int startIndex, final double tolerance) {
+      return 0;
+    }
+
+    public static int lastIndexOf(final float[] array, final float valueToFind) {
+      return 0;
+    }
+
+    public static int lastIndexOf(final float[] array, final float valueToFind, int startIndex) {
+      return 0;
+    }
+
+    public static int lastIndexOf(final int[] array, final int valueToFind) {
+      return 0;
+    }
+
+    public static int lastIndexOf(final int[] array, final int valueToFind, int startIndex) {
+      return 0;
+    }
+
+    public static int lastIndexOf(final long[] array, final long valueToFind) {
+      return 0;
+    }
+
+    public static int lastIndexOf(final long[] array, final long valueToFind, int startIndex) {
+      return 0;
+    }
+
+    public static int lastIndexOf(final Object[] array, final Object objectToFind) {
+      return 0;
+    }
+
+    public static int lastIndexOf(final Object[] array, final Object objectToFind, int startIndex) {
+      return 0;
+    }
+
+    public static int lastIndexOf(final short[] array, final short valueToFind) {
+      return 0;
+    }
+
+    public static int lastIndexOf(final short[] array, final short valueToFind, int startIndex) {
+      return 0;
+    }
+
+    public static boolean[] nullToEmpty(final boolean[] array) {
+      return null;
+    }
+
+    public static Boolean[] nullToEmpty(final Boolean[] array) {
+      return null;
+    }
+
+    public static byte[] nullToEmpty(final byte[] array) {
+      return null;
+    }
+
+    public static Byte[] nullToEmpty(final Byte[] array) {
+      return null;
+    }
+
+    public static char[] nullToEmpty(final char[] array) {
+      return null;
+    }
+
+    public static Character[] nullToEmpty(final Character[] array) {
+      return null;
+    }
+
+    public static Class<?>[] nullToEmpty(final Class<?>[] array) {
+      return null;
+    }
+
+    public static double[] nullToEmpty(final double[] array) {
+      return null;
+    }
+
+    public static Double[] nullToEmpty(final Double[] array) {
+      return null;
+    }
+
+    public static float[] nullToEmpty(final float[] array) {
+      return null;
+    }
+
+    public static Float[] nullToEmpty(final Float[] array) {
+      return null;
+    }
+
+    public static int[] nullToEmpty(final int[] array) {
+      return null;
+    }
+
+    public static Integer[] nullToEmpty(final Integer[] array) {
+      return null;
+    }
+
+    public static long[] nullToEmpty(final long[] array) {
+      return null;
+    }
+
+    public static Long[] nullToEmpty(final Long[] array) {
+      return null;
+    }
+
+    public static Object[] nullToEmpty(final Object[] array) {
+      return null;
+    }
+
+    public static short[] nullToEmpty(final short[] array) {
+      return null;
+    }
+
+    public static Short[] nullToEmpty(final Short[] array) {
+      return null;
+    }
+
+    public static String[] nullToEmpty(final String[] array) {
+      return null;
+    }
+
+    public static <T> T[] nullToEmpty(final T[] array, final Class<T[]> type) {
+      return null;
+    }
+
+    public static boolean[] remove(final boolean[] array, final int index) {
+      return null;
+    }
+
+    public static byte[] remove(final byte[] array, final int index) {
+      return null;
+    }
+
+    public static char[] remove(final char[] array, final int index) {
+      return null;
+    }
+
+    public static double[] remove(final double[] array, final int index) {
+      return null;
+    }
+
+    public static float[] remove(final float[] array, final int index) {
+      return null;
+    }
+
+    public static int[] remove(final int[] array, final int index) {
+      return null;
+    }
+
+    public static long[] remove(final long[] array, final int index) {
+      return null;
+    }
+
+    public static short[] remove(final short[] array, final int index) {
+      return null;
+    }
+
+    public static <T> T[] remove(final T[] array, final int index) {
+      return null;
+    }
+
+    public static boolean[] removeAll(final boolean[] array, final int... indices) {
+      return null;
+    }
+
+    public static byte[] removeAll(final byte[] array, final int... indices) {
+      return null;
+    }
+
+    public static char[] removeAll(final char[] array, final int... indices) {
+      return null;
+    }
+
+    public static double[] removeAll(final double[] array, final int... indices) {
+      return null;
+    }
+
+    public static float[] removeAll(final float[] array, final int... indices) {
+      return null;
+    }
+
+    public static int[] removeAll(final int[] array, final int... indices) {
+      return null;
+    }
+
+    public static long[] removeAll(final long[] array, final int... indices) {
+      return null;
+    }
+
+    public static short[] removeAll(final short[] array, final int... indices) {
+      return null;
+    }
+
+    public static <T> T[] removeAll(final T[] array, final int... indices) {
+      return null;
+    }
+
+    public static boolean[] removeAllOccurences(final boolean[] array, final boolean element) {
+      return null;
+    }
+
+    public static byte[] removeAllOccurences(final byte[] array, final byte element) {
+      return null;
+    }
+
+    public static char[] removeAllOccurences(final char[] array, final char element) {
+      return null;
+    }
+
+    public static double[] removeAllOccurences(final double[] array, final double element) {
+      return null;
+    }
+
+    public static float[] removeAllOccurences(final float[] array, final float element) {
+      return null;
+    }
+
+    public static int[] removeAllOccurences(final int[] array, final int element) {
+      return null;
+    }
+
+    public static long[] removeAllOccurences(final long[] array, final long element) {
+      return null;
+    }
+
+    public static short[] removeAllOccurences(final short[] array, final short element) {
+      return null;
+    }
+
+    public static <T> T[] removeAllOccurences(final T[] array, final T element) {
+      return null;
+    }
+
+    public static boolean[] removeAllOccurrences(final boolean[] array, final boolean element) {
+      return null;
+    }
+
+    public static byte[] removeAllOccurrences(final byte[] array, final byte element) {
+      return null;
+    }
+
+    public static char[] removeAllOccurrences(final char[] array, final char element) {
+      return null;
+    }
+
+    public static double[] removeAllOccurrences(final double[] array, final double element) {
+      return null;
+    }
+
+    public static float[] removeAllOccurrences(final float[] array, final float element) {
+      return null;
+    }
+
+    public static int[] removeAllOccurrences(final int[] array, final int element) {
+      return null;
+    }
+
+    public static long[] removeAllOccurrences(final long[] array, final long element) {
+      return null;
+    }
+
+    public static short[] removeAllOccurrences(final short[] array, final short element) {
+      return null;
+    }
+
+    public static <T> T[] removeAllOccurrences(final T[] array, final T element) {
+      return null;
+    }
+
+    public static boolean[] removeElement(final boolean[] array, final boolean element) {
+      return null;
+    }
+
+    public static byte[] removeElement(final byte[] array, final byte element) {
+      return null;
+    }
+
+    public static char[] removeElement(final char[] array, final char element) {
+      return null;
+    }
+
+    public static double[] removeElement(final double[] array, final double element) {
+      return null;
+    }
+
+    public static float[] removeElement(final float[] array, final float element) {
+      return null;
+    }
+
+    public static int[] removeElement(final int[] array, final int element) {
+      return null;
+    }
+
+    public static long[] removeElement(final long[] array, final long element) {
+      return null;
+    }
+
+    public static short[] removeElement(final short[] array, final short element) {
+      return null;
+    }
+
+    public static <T> T[] removeElement(final T[] array, final Object element) {
+      return null;
+    }
+
+    public static boolean[] removeElements(final boolean[] array, final boolean... values) {
+      return null;
+    }
+
+    public static byte[] removeElements(final byte[] array, final byte... values) {
+      return null;
+    }
+
+    public static char[] removeElements(final char[] array, final char... values) {
+      return null;
+    }
+
+    public static double[] removeElements(final double[] array, final double... values) {
+      return null;
+    }
+
+    public static float[] removeElements(final float[] array, final float... values) {
+      return null;
+    }
+
+    public static int[] removeElements(final int[] array, final int... values) {
+      return null;
+    }
+
+    public static long[] removeElements(final long[] array, final long... values) {
+      return null;
+    }
+
+    public static short[] removeElements(final short[] array, final short... values) {
+      return null;
+    }
+
+    public static <T> T[] removeElements(final T[] array, final T... values) {
+      return null;
+    }
+
+    public static void reverse(final boolean[] array) {
+    }
+
+    public static void reverse(final boolean[] array, final int startIndexInclusive, final int endIndexExclusive) {
+    }
+
+    public static void reverse(final byte[] array) {
+    }
+
+    public static void reverse(final byte[] array, final int startIndexInclusive, final int endIndexExclusive) {
+    }
+
+    public static void reverse(final char[] array) {
+    }
+
+    public static void reverse(final char[] array, final int startIndexInclusive, final int endIndexExclusive) {
+    }
+
+    public static void reverse(final double[] array) {
+    }
+
+    public static void reverse(final double[] array, final int startIndexInclusive, final int endIndexExclusive) {
+    }
+
+    public static void reverse(final float[] array) {
+    }
+
+    public static void reverse(final float[] array, final int startIndexInclusive, final int endIndexExclusive) {
+    }
+
+    public static void reverse(final int[] array) {
+    }
+
+    public static void reverse(final int[] array, final int startIndexInclusive, final int endIndexExclusive) {
+    }
+
+    public static void reverse(final long[] array) {
+    }
+
+    public static void reverse(final long[] array, final int startIndexInclusive, final int endIndexExclusive) {
+    }
+
+    public static void reverse(final Object[] array) {
+    }
+
+    public static void reverse(final Object[] array, final int startIndexInclusive, final int endIndexExclusive) {
+    }
+
+    public static void reverse(final short[] array) {
+    }
+
+    public static void reverse(final short[] array, final int startIndexInclusive, final int endIndexExclusive) {
+    }
+
+    public static void shift(final boolean[] array, final int offset) {
+    }
+
+    public static void shift(final boolean[] array, int startIndexInclusive, int endIndexExclusive, int offset) {
+    }
+
+    public static void shift(final byte[] array, final int offset) {
+    }
+
+    public static void shift(final byte[] array, int startIndexInclusive, int endIndexExclusive, int offset) {
+    }
+
+    public static void shift(final char[] array, final int offset) {
+    }
+
+    public static void shift(final char[] array, int startIndexInclusive, int endIndexExclusive, int offset) {
+    }
+
+    public static void shift(final double[] array, final int offset) {
+    }
+
+    public static void shift(final double[] array, int startIndexInclusive, int endIndexExclusive, int offset) {
+    }
+
+    public static void shift(final float[] array, final int offset) {
+    }
+
+    public static void shift(final float[] array, int startIndexInclusive, int endIndexExclusive, int offset) {
+    }
+
+    public static void shift(final int[] array, final int offset) {
+    }
+
+    public static void shift(final int[] array, int startIndexInclusive, int endIndexExclusive, int offset) {
+    }
+
+    public static void shift(final long[] array, final int offset) {
+    }
+
+    public static void shift(final long[] array, int startIndexInclusive, int endIndexExclusive, int offset) {
+    }
+
+    public static void shift(final Object[] array, final int offset) {
+    }
+
+    public static void shift(final Object[] array, int startIndexInclusive, int endIndexExclusive, int offset) {
+    }
+
+    public static void shift(final short[] array, final int offset) {
+    }
+
+    public static void shift(final short[] array, int startIndexInclusive, int endIndexExclusive, int offset) {
+    }
+
+    public static void shuffle(final boolean[] array) {
+    }
+
+    public static void shuffle(final boolean[] array, final Random random) {
+    }
+
+    public static void shuffle(final byte[] array) {
+    }
+
+    public static void shuffle(final byte[] array, final Random random) {
+    }
+
+    public static void shuffle(final char[] array) {
+    }
+
+    public static void shuffle(final char[] array, final Random random) {
+    }
+
+    public static void shuffle(final double[] array) {
+    }
+
+    public static void shuffle(final double[] array, final Random random) {
+    }
+
+    public static void shuffle(final float[] array) {
+    }
+
+    public static void shuffle(final float[] array, final Random random) {
+    }
+
+    public static void shuffle(final int[] array) {
+    }
+
+    public static void shuffle(final int[] array, final Random random) {
+    }
+
+    public static void shuffle(final long[] array) {
+    }
+
+    public static void shuffle(final long[] array, final Random random) {
+    }
+
+    public static void shuffle(final Object[] array) {
+    }
+
+    public static void shuffle(final Object[] array, final Random random) {
+    }
+
+    public static void shuffle(final short[] array) {
+    }
+
+    public static void shuffle(final short[] array, final Random random) {
+    }
+
+    public static boolean[] subarray(final boolean[] array, int startIndexInclusive, int endIndexExclusive) {
+      return null;
+    }
+
+    public static byte[] subarray(final byte[] array, int startIndexInclusive, int endIndexExclusive) {
+      return null;
+    }
+
+    public static char[] subarray(final char[] array, int startIndexInclusive, int endIndexExclusive) {
+      return null;
+    }
+
+    public static double[] subarray(final double[] array, int startIndexInclusive, int endIndexExclusive) {
+      return null;
+    }
+
+    public static float[] subarray(final float[] array, int startIndexInclusive, int endIndexExclusive) {
+      return null;
+    }
+
+    public static int[] subarray(final int[] array, int startIndexInclusive, int endIndexExclusive) {
+      return null;
+    }
+
+    public static long[] subarray(final long[] array, int startIndexInclusive, int endIndexExclusive) {
+      return null;
+    }
+
+    public static short[] subarray(final short[] array, int startIndexInclusive, int endIndexExclusive) {
+      return null;
+    }
+
+    public static <T> T[] subarray(final T[] array, int startIndexInclusive, int endIndexExclusive) {
+      return null;
+    }
+
+    public static void swap(final boolean[] array, final int offset1, final int offset2) {
+    }
+
+    public static void swap(final boolean[] array, int offset1, int offset2, int len) {
+    }
+
+    public static void swap(final byte[] array, final int offset1, final int offset2) {
+    }
+
+    public static void swap(final byte[] array, int offset1, int offset2, int len) {
+    }
+
+    public static void swap(final char[] array, final int offset1, final int offset2) {
+    }
+
+    public static void swap(final char[] array, int offset1, int offset2, int len) {
+    }
+
+    public static void swap(final double[] array, final int offset1, final int offset2) {
+    }
+
+    public static void swap(final double[] array,  int offset1, int offset2, int len) {
+    }
+
+    public static void swap(final float[] array, final int offset1, final int offset2) {
+    }
+
+    public static void swap(final float[] array, int offset1, int offset2, int len) {
+    }
+
+    public static void swap(final int[] array, final int offset1, final int offset2) {
+    }
+
+    public static void swap(final int[] array,  int offset1, int offset2, int len) {
+    }
+
+    public static void swap(final long[] array, final int offset1, final int offset2) {
+    }
+
+    public static void swap(final long[] array,  int offset1, int offset2, int len) {
+    }
+
+    public static void swap(final Object[] array, final int offset1, final int offset2) {
+    }
+
+    public static void swap(final Object[] array,  int offset1, int offset2, int len) {
+    }
+
+    public static void swap(final short[] array, final int offset1, final int offset2) {
+    }
+
+        public static void swap(final short[] array,  int offset1, int offset2, int len) {
+        }
+
+    public static <T> T[] toArray(@SuppressWarnings("unchecked") final T... items) {
+      return null;
+    }
+
+    public static Map<Object, Object> toMap(final Object[] array) {
+      return null;
+    }
+
+    public static Boolean[] toObject(final boolean[] array) {
+      return null;
+    }
+
+    public static Byte[] toObject(final byte[] array) {
+      return null;
+    }
+
+    public static Character[] toObject(final char[] array) {
+      return null;
+    }
+
+    public static Double[] toObject(final double[] array) {
+      return null;
+    }
+
+    public static Float[] toObject(final float[] array) {
+      return null;
+    }
+
+    public static Integer[] toObject(final int[] array) {
+      return null;
+    }
+
+    public static Long[] toObject(final long[] array) {
+      return null;
+    }
+
+    public static Short[] toObject(final short[] array) {
+      return null;
+    }
+
+    public static boolean[] toPrimitive(final Boolean[] array) {
+      return null;
+    }
+
+    public static boolean[] toPrimitive(final Boolean[] array, final boolean valueForNull) {
+      return null;
+    }
+
+    public static byte[] toPrimitive(final Byte[] array) {
+      return null;
+    }
+
+    public static byte[] toPrimitive(final Byte[] array, final byte valueForNull) {
+      return null;
+    }
+
+    public static char[] toPrimitive(final Character[] array) {
+      return null;
+    }
+
+    public static char[] toPrimitive(final Character[] array, final char valueForNull) {
+      return null;
+    }
+
+    public static double[] toPrimitive(final Double[] array) {
+      return null;
+    }
+
+    public static double[] toPrimitive(final Double[] array, final double valueForNull) {
+      return null;
+    }
+
+    public static float[] toPrimitive(final Float[] array) {
+      return null;
+    }
+
+    public static float[] toPrimitive(final Float[] array, final float valueForNull) {
+      return null;
+    }
+
+    public static int[] toPrimitive(final Integer[] array) {
+      return null;
+    }
+
+    public static int[] toPrimitive(final Integer[] array, final int valueForNull) {
+      return null;
+    }
+
+    public static long[] toPrimitive(final Long[] array) {
+      return null;
+    }
+
+    public static long[] toPrimitive(final Long[] array, final long valueForNull) {
+      return null;
+    }
+
+    public static Object toPrimitive(final Object array) {
+      return null;
+    }
+
+    public static short[] toPrimitive(final Short[] array) {
+      return null;
+    }
+
+    public static short[] toPrimitive(final Short[] array, final short valueForNull) {
+      return null;
+    }
+
+    public static String toString(final Object array) {
+      return null;
+    }
+
+    public static String toString(final Object array, final String stringIfNull) {
+      return null;
+    }
+
+    public static String[] toStringArray(final Object[] array) {
+      return null;
+    }
+
+    public static String[] toStringArray(final Object[] array, final String valueForNullElements) {
+      return null;
+    }
+
+    public ArrayUtils() {
+    }
+
+}
diff --git a/java/ql/test/stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/StringUtils.java b/java/ql/test/stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/StringUtils.java
index 800b62a545b..7238d237522 100644
--- a/java/ql/test/stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/StringUtils.java
+++ b/java/ql/test/stubs/apache-commons-lang3-3.7/org/apache/commons/lang3/StringUtils.java
@@ -960,4 +960,4 @@ public class StringUtils {
     public StringUtils() {
     }
 
-}
+}
\ No newline at end of file
diff --git a/java/ql/test/stubs/fastjson-1.2.74/com/alibaba/fastjson/JSON.java b/java/ql/test/stubs/fastjson-1.2.74/com/alibaba/fastjson/JSON.java
index b71e890e9b7..99e2873d375 100644
--- a/java/ql/test/stubs/fastjson-1.2.74/com/alibaba/fastjson/JSON.java
+++ b/java/ql/test/stubs/fastjson-1.2.74/com/alibaba/fastjson/JSON.java
@@ -26,6 +26,10 @@ import com.alibaba.fastjson.parser.*;
 import com.alibaba.fastjson.parser.deserializer.ParseProcess;
 
 public abstract class JSON {
+    public static String toJSONString(Object object) {
+        return null;
+    }
+
     public static Object parse(String text) {
         return null;
     }
diff --git a/java/ql/test/stubs/gson-2.8.6/com/google/gson/Gson.java b/java/ql/test/stubs/gson-2.8.6/com/google/gson/Gson.java
new file mode 100644
index 00000000000..bbe53dc2a5f
--- /dev/null
+++ b/java/ql/test/stubs/gson-2.8.6/com/google/gson/Gson.java
@@ -0,0 +1,7 @@
+package com.google.gson;
+
+public final class Gson {
+    public String toJson(Object src) {
+        return null;
+    }
+}
diff --git a/java/ql/test/stubs/java-ee-el/javax/el/ELContext.java b/java/ql/test/stubs/java-ee-el/javax/el/ELContext.java
new file mode 100644
index 00000000000..ce3840c69c8
--- /dev/null
+++ b/java/ql/test/stubs/java-ee-el/javax/el/ELContext.java
@@ -0,0 +1,3 @@
+package javax.el;
+
+public class ELContext {}
diff --git a/java/ql/test/stubs/java-ee-el/javax/el/ELManager.java b/java/ql/test/stubs/java-ee-el/javax/el/ELManager.java
new file mode 100644
index 00000000000..7d24f739a3f
--- /dev/null
+++ b/java/ql/test/stubs/java-ee-el/javax/el/ELManager.java
@@ -0,0 +1,5 @@
+package javax.el;
+
+public class ELManager {
+    public static ExpressionFactory getExpressionFactory() { return null; }
+}
\ No newline at end of file
diff --git a/java/ql/test/stubs/java-ee-el/javax/el/ELProcessor.java b/java/ql/test/stubs/java-ee-el/javax/el/ELProcessor.java
new file mode 100644
index 00000000000..95895fabc64
--- /dev/null
+++ b/java/ql/test/stubs/java-ee-el/javax/el/ELProcessor.java
@@ -0,0 +1,8 @@
+package javax.el;
+
+public class ELProcessor {
+    public Object eval(String expression) { return null; }
+    public Object getValue(String expression, Class<?> expectedType) { return null; }
+    public void setValue(String expression, Object value) {}
+    public void setVariable(String var, String expression) {}
+}
diff --git a/java/ql/test/stubs/java-ee-el/javax/el/ExpressionFactory.java b/java/ql/test/stubs/java-ee-el/javax/el/ExpressionFactory.java
new file mode 100644
index 00000000000..31ff79169ac
--- /dev/null
+++ b/java/ql/test/stubs/java-ee-el/javax/el/ExpressionFactory.java
@@ -0,0 +1,17 @@
+package javax.el;
+
+public class ExpressionFactory {
+    public MethodExpression createMethodExpression(ELContext context, String expression, Class<?> expectedReturnType,
+            Class<?>[] expectedParamTypes) {
+
+        return null;
+    }
+
+    public ValueExpression createValueExpression(ELContext context, String expression, Class<?> expectedType) {
+        return null;
+    }
+
+    public ValueExpression createValueExpression(Object instance, Class<?> expectedType) {
+        return null;
+    }
+}
diff --git a/java/ql/test/stubs/java-ee-el/javax/el/LambdaExpression.java b/java/ql/test/stubs/java-ee-el/javax/el/LambdaExpression.java
new file mode 100644
index 00000000000..4be01e9d2e4
--- /dev/null
+++ b/java/ql/test/stubs/java-ee-el/javax/el/LambdaExpression.java
@@ -0,0 +1,8 @@
+package javax.el;
+
+import java.util.List;
+
+public class LambdaExpression {
+    public LambdaExpression(List<String> formalParameters, ValueExpression expression) {}
+    public Object invoke(Object... args) { return null; }
+}
diff --git a/java/ql/test/stubs/java-ee-el/javax/el/MethodExpression.java b/java/ql/test/stubs/java-ee-el/javax/el/MethodExpression.java
new file mode 100644
index 00000000000..ac50ece80e3
--- /dev/null
+++ b/java/ql/test/stubs/java-ee-el/javax/el/MethodExpression.java
@@ -0,0 +1,5 @@
+package javax.el;
+
+public class MethodExpression {
+    public Object invoke(ELContext context, Object[] params) { return null; }
+}
diff --git a/java/ql/test/stubs/java-ee-el/javax/el/StandardELContext.java b/java/ql/test/stubs/java-ee-el/javax/el/StandardELContext.java
new file mode 100644
index 00000000000..22e3f2a9fc1
--- /dev/null
+++ b/java/ql/test/stubs/java-ee-el/javax/el/StandardELContext.java
@@ -0,0 +1,5 @@
+package javax.el;
+
+public class StandardELContext extends ELContext {
+    public StandardELContext(ExpressionFactory factory) {}
+}
diff --git a/java/ql/test/stubs/java-ee-el/javax/el/ValueExpression.java b/java/ql/test/stubs/java-ee-el/javax/el/ValueExpression.java
new file mode 100644
index 00000000000..9a231215640
--- /dev/null
+++ b/java/ql/test/stubs/java-ee-el/javax/el/ValueExpression.java
@@ -0,0 +1,6 @@
+package javax.el;
+
+public class ValueExpression {
+    public Object getValue(ELContext context) { return null; }
+    public void setValue(ELContext context, Object value) {}
+}
diff --git a/java/ql/test/stubs/jaxb-api-2.3.1/javax/xml/bind/JAXBContext.java b/java/ql/test/stubs/jaxb-api-2.3.1/javax/xml/bind/JAXBContext.java
new file mode 100644
index 00000000000..b588264557d
--- /dev/null
+++ b/java/ql/test/stubs/jaxb-api-2.3.1/javax/xml/bind/JAXBContext.java
@@ -0,0 +1,33 @@
+package javax.xml.bind;
+
+import java.util.Map;
+
+abstract public class JAXBContext {
+  protected JAXBContext() { }
+
+//  public static final String JAXB_CONTEXT_FACTORY;
+//
+//  public Binder<Node> createBinder() { return null; }
+//
+//  public Binder<T> createBinder(Class<T> p0) { return null; }
+//
+//  public JAXBIntrospector createJAXBIntrospector() { return null; }
+//
+//  abstract public Marshaller createMarshaller();
+
+  abstract public Unmarshaller createUnmarshaller();
+
+//  abstract public Validator createValidator();
+//
+//  public void generateSchema(SchemaOutputResolver p0) { }
+
+  public static JAXBContext newInstance(Class... p0) { return null; }
+
+  public static JAXBContext newInstance(Class<?>[] p0, Map<String,?> p1) { return null; }
+
+  public static JAXBContext newInstance(String p0) { return null; }
+
+  public static JAXBContext newInstance(String p0, ClassLoader p1) { return null; }
+
+  public static JAXBContext newInstance(String p0, ClassLoader p1, Map<String,?> p2) { return null; }
+}
diff --git a/java/ql/test/stubs/jaxb-api-2.3.1/javax/xml/bind/Unmarshaller.java b/java/ql/test/stubs/jaxb-api-2.3.1/javax/xml/bind/Unmarshaller.java
new file mode 100644
index 00000000000..6781205fe89
--- /dev/null
+++ b/java/ql/test/stubs/jaxb-api-2.3.1/javax/xml/bind/Unmarshaller.java
@@ -0,0 +1,76 @@
+package javax.xml.bind;
+
+import java.net.URL;
+import java.io.Reader;
+import java.io.InputStream;
+import java.io.File;
+import javax.xml.transform.Source;
+
+abstract public interface Unmarshaller {
+  abstract public static class Listener {
+    public Listener() { }
+  
+    public void afterUnmarshal(Object p0, Object p1) { }
+  
+    public void beforeUnmarshal(Object p0, Object p1) { }
+  }
+
+//  abstract public A getAdapter(Class<A> p0);
+//
+//  abstract public AttachmentUnmarshaller getAttachmentUnmarshaller();
+//
+//  abstract public ValidationEventHandler getEventHandler();
+//
+//  abstract public Listener getListener();
+
+  abstract public Object getProperty(String p0);
+
+//  abstract public Schema getSchema();
+//
+//  abstract public UnmarshallerHandler getUnmarshallerHandler();
+
+  abstract public boolean isValidating();
+
+//  abstract public void setAdapter(Class<A> p0, A p1);
+//
+//  abstract public void setAdapter(XmlAdapter p0);
+//
+//  abstract public void setAttachmentUnmarshaller(AttachmentUnmarshaller p0);
+//
+//  abstract public void setEventHandler(ValidationEventHandler p0);
+//
+//  abstract public void setListener(Listener p0);
+//
+//  abstract public void setProperty(String p0, Object p1);
+//
+//  abstract public void setSchema(Schema p0);
+
+  abstract public void setValidating(boolean p0);
+
+  abstract public Object unmarshal(File p0);
+
+  abstract public Object unmarshal(InputStream p0);
+
+  abstract public Object unmarshal(Reader p0);
+
+  abstract public Object unmarshal(URL p0);
+
+//  abstract public Object unmarshal(XMLEventReader p0);
+//
+//  abstract public JAXBElement<T> unmarshal(XMLEventReader p0, Class<T> p1);
+//
+//  abstract public Object unmarshal(XMLStreamReader p0);
+//
+//  abstract public JAXBElement<T> unmarshal(XMLStreamReader p0, Class<T> p1);
+
+  abstract public Object unmarshal(Source p0);
+
+//  abstract public JAXBElement<T> unmarshal(Source p0, Class<T> p1);
+//
+//  abstract public Object unmarshal(Node p0);
+//
+//  abstract public JAXBElement<T> unmarshal(Node p0, Class<T> p1);
+//
+//  abstract public Object unmarshal(InputSource p0);
+}
+
diff --git a/java/ql/test/stubs/jsr311-api-1.1.1/javax/ws/rs/core/Cookie.java b/java/ql/test/stubs/jsr311-api-1.1.1/javax/ws/rs/core/Cookie.java
new file mode 100644
index 00000000000..6853f72ecd8
--- /dev/null
+++ b/java/ql/test/stubs/jsr311-api-1.1.1/javax/ws/rs/core/Cookie.java
@@ -0,0 +1,154 @@
+/*
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
+ *
+ * Copyright (c) 2010-2015 Oracle and/or its affiliates. All rights reserved.
+ *
+ * The contents of this file are subject to the terms of either the GNU
+ * General Public License Version 2 only ("GPL") or the Common Development
+ * and Distribution License("CDDL") (collectively, the "License").  You
+ * may not use this file except in compliance with the License.  You can
+ * obtain a copy of the License at
+ * http://glassfish.java.net/public/CDDL+GPL_1_1.html
+ * or packager/legal/LICENSE.txt.  See the License for the specific
+ * language governing permissions and limitations under the License.
+ *
+ * When distributing the software, include this License Header Notice in each
+ * file and include the License file at packager/legal/LICENSE.txt.
+ *
+ * GPL Classpath Exception:
+ * Oracle designates this particular file as subject to the "Classpath"
+ * exception as provided by Oracle in the GPL Version 2 section of the License
+ * file that accompanied this code.
+ *
+ * Modifications:
+ * If applicable, add the following below the License Header, with the fields
+ * enclosed by brackets [] replaced by your own identifying information:
+ * "Portions Copyright [year] [name of copyright owner]"
+ *
+ * Contributor(s):
+ * If you wish your version of this file to be governed by only the CDDL or
+ * only the GPL Version 2, indicate your decision by adding "[Contributor]
+ * elects to include this software in this distribution under the [CDDL or GPL
+ * Version 2] license."  If you don't indicate a single choice of license, a
+ * recipient has the option to distribute your version of this file under
+ * either the CDDL, the GPL Version 2 or to extend the choice of license to
+ * its licensees as provided above.  However, if you add GPL Version 2 code
+ * and therefore, elected the GPL Version 2 license, then the option applies
+ * only if the new code is made subject to such option by the copyright
+ * holder.
+ */
+
+package javax.ws.rs.core;
+
+/**
+ * Represents the value of a HTTP cookie, transferred in a request.
+ * RFC 2109 specifies the legal characters for name,
+ * value, path and domain. The default version of 1 corresponds to RFC 2109.
+ *
+ * @author Paul Sandoz
+ * @author Marc Hadley
+ * @see <a href="http://www.ietf.org/rfc/rfc2109.txt">IETF RFC 2109</a>
+ * @since 1.0
+ */
+public class Cookie {
+
+    /**
+     * Cookies using the default version correspond to RFC 2109.
+     */
+    public static final int DEFAULT_VERSION = 1;
+
+    /**
+     * Create a new instance.
+     *
+     * @param name    the name of the cookie.
+     * @param value   the value of the cookie.
+     * @param path    the URI path for which the cookie is valid.
+     * @param domain  the host domain for which the cookie is valid.
+     * @param version the version of the specification to which the cookie complies.
+     * @throws IllegalArgumentException if name is {@code null}.
+     */
+    public Cookie(final String name, final String value, final String path, final String domain, final int version)
+            throws IllegalArgumentException {
+    }
+
+    /**
+     * Create a new instance.
+     *
+     * @param name   the name of the cookie.
+     * @param value  the value of the cookie.
+     * @param path   the URI path for which the cookie is valid.
+     * @param domain the host domain for which the cookie is valid.
+     * @throws IllegalArgumentException if name is {@code null}.
+     */
+    public Cookie(final String name, final String value, final String path, final String domain)
+            throws IllegalArgumentException {
+    }
+
+    /**
+     * Create a new instance.
+     *
+     * @param name  the name of the cookie.
+     * @param value the value of the cookie.
+     * @throws IllegalArgumentException if name is {@code null}.
+     */
+    public Cookie(final String name, final String value)
+            throws IllegalArgumentException {
+    }
+
+    /**
+     * Creates a new instance of {@code Cookie} by parsing the supplied string.
+     *
+     * @param value the cookie string.
+     * @return the newly created {@code Cookie}.
+     * @throws IllegalArgumentException if the supplied string cannot be parsed
+     *                                  or is {@code null}.
+     */
+    public static Cookie valueOf(final String value) {
+        return null;
+    }
+
+    /**
+     * Get the name of the cookie.
+     *
+     * @return the cookie name.
+     */
+    public String getName() {
+        return null;
+    }
+
+    /**
+     * Get the value of the cookie.
+     *
+     * @return the cookie value.
+     */
+    public String getValue() {
+        return null;
+    }
+
+    /**
+     * Get the version of the cookie.
+     *
+     * @return the cookie version.
+     */
+    public int getVersion() {
+        return -1;
+    }
+
+    /**
+     * Get the domain of the cookie.
+     *
+     * @return the cookie domain.
+     */
+    public String getDomain() {
+        return null;
+    }
+
+    /**
+     * Get the path of the cookie.
+     *
+     * @return the cookie path.
+     */
+    public String getPath() {
+        return null;
+    }
+}
diff --git a/java/ql/test/stubs/jsr311-api-1.1.1/javax/ws/rs/core/NewCookie.java b/java/ql/test/stubs/jsr311-api-1.1.1/javax/ws/rs/core/NewCookie.java
new file mode 100644
index 00000000000..046bb15da12
--- /dev/null
+++ b/java/ql/test/stubs/jsr311-api-1.1.1/javax/ws/rs/core/NewCookie.java
@@ -0,0 +1,314 @@
+/*
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
+ *
+ * Copyright (c) 2010-2015 Oracle and/or its affiliates. All rights reserved.
+ *
+ * The contents of this file are subject to the terms of either the GNU
+ * General Public License Version 2 only ("GPL") or the Common Development
+ * and Distribution License("CDDL") (collectively, the "License").  You
+ * may not use this file except in compliance with the License.  You can
+ * obtain a copy of the License at
+ * http://glassfish.java.net/public/CDDL+GPL_1_1.html
+ * or packager/legal/LICENSE.txt.  See the License for the specific
+ * language governing permissions and limitations under the License.
+ *
+ * When distributing the software, include this License Header Notice in each
+ * file and include the License file at packager/legal/LICENSE.txt.
+ *
+ * GPL Classpath Exception:
+ * Oracle designates this particular file as subject to the "Classpath"
+ * exception as provided by Oracle in the GPL Version 2 section of the License
+ * file that accompanied this code.
+ *
+ * Modifications:
+ * If applicable, add the following below the License Header, with the fields
+ * enclosed by brackets [] replaced by your own identifying information:
+ * "Portions Copyright [year] [name of copyright owner]"
+ *
+ * Contributor(s):
+ * If you wish your version of this file to be governed by only the CDDL or
+ * only the GPL Version 2, indicate your decision by adding "[Contributor]
+ * elects to include this software in this distribution under the [CDDL or GPL
+ * Version 2] license."  If you don't indicate a single choice of license, a
+ * recipient has the option to distribute your version of this file under
+ * either the CDDL, the GPL Version 2 or to extend the choice of license to
+ * its licensees as provided above.  However, if you add GPL Version 2 code
+ * and therefore, elected the GPL Version 2 license, then the option applies
+ * only if the new code is made subject to such option by the copyright
+ * holder.
+ */
+
+package javax.ws.rs.core;
+
+import java.util.Date;
+
+/**
+ * Used to create a new HTTP cookie, transferred in a response.
+ *
+ * @author Paul Sandoz
+ * @author Marc Hadley
+ * @see <a href="http://www.ietf.org/rfc/rfc2109.txt">IETF RFC 2109</a>
+ * @since 1.0
+ */
+public class NewCookie extends Cookie {
+
+    /**
+     * Specifies that the cookie expires with the current application/browser session.
+     */
+    public static final int DEFAULT_MAX_AGE = -1;
+
+    /**
+     * Create a new instance.
+     *
+     * @param name  the name of the cookie.
+     * @param value the value of the cookie.
+     * @throws IllegalArgumentException if name is {@code null}.
+     */
+    public NewCookie(String name, String value) {
+        super("", "");
+    }
+
+    /**
+     * Create a new instance.
+     *
+     * @param name    the name of the cookie.
+     * @param value   the value of the cookie.
+     * @param path    the URI path for which the cookie is valid.
+     * @param domain  the host domain for which the cookie is valid.
+     * @param comment the comment.
+     * @param maxAge  the maximum age of the cookie in seconds.
+     * @param secure  specifies whether the cookie will only be sent over a secure connection.
+     * @throws IllegalArgumentException if name is {@code null}.
+     */
+    public NewCookie(String name,
+                     String value,
+                     String path,
+                     String domain,
+                     String comment,
+                     int maxAge,
+                     boolean secure) {
+        super("", "");
+    }
+
+    /**
+     * Create a new instance.
+     *
+     * @param name     the name of the cookie.
+     * @param value    the value of the cookie.
+     * @param path     the URI path for which the cookie is valid.
+     * @param domain   the host domain for which the cookie is valid.
+     * @param comment  the comment.
+     * @param maxAge   the maximum age of the cookie in seconds.
+     * @param secure   specifies whether the cookie will only be sent over a secure connection.
+     * @param httpOnly if {@code true} make the cookie HTTP only, i.e. only visible as part of an HTTP request.
+     * @throws IllegalArgumentException if name is {@code null}.
+     * @since 2.0
+     */
+    public NewCookie(String name,
+                     String value,
+                     String path,
+                     String domain,
+                     String comment,
+                     int maxAge,
+                     boolean secure,
+                     boolean httpOnly) {
+        super("", "");
+    }
+
+    /**
+     * Create a new instance.
+     *
+     * @param name    the name of the cookie
+     * @param value   the value of the cookie
+     * @param path    the URI path for which the cookie is valid
+     * @param domain  the host domain for which the cookie is valid
+     * @param version the version of the specification to which the cookie complies
+     * @param comment the comment
+     * @param maxAge  the maximum age of the cookie in seconds
+     * @param secure  specifies whether the cookie will only be sent over a secure connection
+     * @throws IllegalArgumentException if name is {@code null}.
+     */
+    public NewCookie(String name,
+                     String value,
+                     String path,
+                     String domain,
+                     int version,
+                     String comment,
+                     int maxAge,
+                     boolean secure) {
+        super("", "");
+    }
+
+    /**
+     * Create a new instance.
+     *
+     * @param name     the name of the cookie
+     * @param value    the value of the cookie
+     * @param path     the URI path for which the cookie is valid
+     * @param domain   the host domain for which the cookie is valid
+     * @param version  the version of the specification to which the cookie complies
+     * @param comment  the comment
+     * @param maxAge   the maximum age of the cookie in seconds
+     * @param expiry   the cookie expiry date.
+     * @param secure   specifies whether the cookie will only be sent over a secure connection
+     * @param httpOnly if {@code true} make the cookie HTTP only, i.e. only visible as part of an HTTP request.
+     * @throws IllegalArgumentException if name is {@code null}.
+     * @since 2.0
+     */
+    public NewCookie(String name,
+                     String value,
+                     String path,
+                     String domain,
+                     int version,
+                     String comment,
+                     int maxAge,
+                     Date expiry,
+                     boolean secure,
+                     boolean httpOnly) {
+        super("", "");
+    }
+
+    /**
+     * Create a new instance copying the information in the supplied cookie.
+     *
+     * @param cookie the cookie to clone.
+     * @throws IllegalArgumentException if cookie is {@code null}.
+     */
+    public NewCookie(Cookie cookie) {
+        super("", "");
+    }
+
+    /**
+     * Create a new instance supplementing the information in the supplied cookie.
+     *
+     * @param cookie  the cookie to clone.
+     * @param comment the comment.
+     * @param maxAge  the maximum age of the cookie in seconds.
+     * @param secure  specifies whether the cookie will only be sent over a secure connection.
+     * @throws IllegalArgumentException if cookie is {@code null}.
+     */
+    public NewCookie(Cookie cookie, String comment, int maxAge, boolean secure) {
+        super("", "");
+    }
+
+    /**
+     * Create a new instance supplementing the information in the supplied cookie.
+     *
+     * @param cookie   the cookie to clone.
+     * @param comment  the comment.
+     * @param maxAge   the maximum age of the cookie in seconds.
+     * @param expiry   the cookie expiry date.
+     * @param secure   specifies whether the cookie will only be sent over a secure connection.
+     * @param httpOnly if {@code true} make the cookie HTTP only, i.e. only visible as part of an HTTP request.
+     * @throws IllegalArgumentException if cookie is {@code null}.
+     * @since 2.0
+     */
+    public NewCookie(Cookie cookie, String comment, int maxAge, Date expiry, boolean secure, boolean httpOnly) {
+        super("", "");
+    }
+
+    /**
+     * Creates a new instance of NewCookie by parsing the supplied string.
+     *
+     * @param value the cookie string.
+     * @return the newly created {@code NewCookie}.
+     * @throws IllegalArgumentException if the supplied string cannot be parsed
+     *                                  or is {@code null}.
+     */
+    public static NewCookie valueOf(String value) {
+        return null;
+    }
+
+    /**
+     * Get the comment associated with the cookie.
+     *
+     * @return the comment or null if none set
+     */
+    public String getComment() {
+        return null;
+    }
+
+    /**
+     * Get the maximum age of the the cookie in seconds. Cookies older than
+     * the maximum age are discarded. A cookie can be unset by sending a new
+     * cookie with maximum age of 0 since it will overwrite any existing cookie
+     * and then be immediately discarded. The default value of {@code -1} indicates
+     * that the cookie will be discarded at the end of the browser/application session.
+     * <p>
+     * Note that it is recommended to use {@code Max-Age} to control cookie
+     * expiration, however some browsers do not understand {@code Max-Age}, in which case
+     * setting {@link #getExpiry()} Expires} parameter may be necessary.
+     * </p>
+     *
+     * @return the maximum age in seconds.
+     * @see #getExpiry()
+     */
+    public int getMaxAge() {
+        return -1;
+    }
+
+    /**
+     * Get the cookie expiry date. Cookies whose expiry date has passed are discarded.
+     * A cookie can be unset by setting a new cookie with an expiry date in the past,
+     * typically the lowest possible date that can be set.
+     * <p>
+     * Note that it is recommended to use {@link #getMaxAge() Max-Age} to control cookie
+     * expiration, however some browsers do not understand {@code Max-Age}, in which case
+     * setting {@code Expires} parameter may be necessary.
+     * </p>
+     *
+     * @return cookie expiry date or {@code null} if no expiry date was set.
+     * @see #getMaxAge()
+     * @since 2.0
+     */
+    public Date getExpiry() {
+        return null;
+    }
+
+    /**
+     * Whether the cookie will only be sent over a secure connection. Defaults
+     * to {@code false}.
+     *
+     * @return {@code true} if the cookie will only be sent over a secure connection,
+     *         {@code false} otherwise.
+     */
+    public boolean isSecure() {
+        return false;
+    }
+
+    /**
+     * Returns {@code true} if this cookie contains the {@code HttpOnly} attribute.
+     * This means that the cookie should not be accessible to scripting engines,
+     * like javascript.
+     *
+     * @return {@code true} if this cookie should be considered http only, {@code false}
+     *         otherwise.
+     * @since 2.0
+     */
+    public boolean isHttpOnly() {
+        return false;
+    }
+
+    /**
+     * Obtain a new instance of a {@link Cookie} with the same name, value, path,
+     * domain and version as this {@code NewCookie}. This method can be used to
+     * obtain an object that can be compared for equality with another {@code Cookie};
+     * since a {@code Cookie} will never compare equal to a {@code NewCookie}.
+     *
+     * @return a {@link Cookie}
+     */
+    public Cookie toCookie() {
+        return null;
+    }
+
+    /**
+     * Convert the cookie to a string suitable for use as the value of the
+     * corresponding HTTP header.
+     *
+     * @return a stringified cookie.
+     */
+    @Override
+    public String toString() {
+        return null;
+    }    
+}
\ No newline at end of file
diff --git a/java/ql/test/stubs/juel-2.2/de/odysseus/el/ExpressionFactoryImpl.java b/java/ql/test/stubs/juel-2.2/de/odysseus/el/ExpressionFactoryImpl.java
new file mode 100644
index 00000000000..a555cf88dee
--- /dev/null
+++ b/java/ql/test/stubs/juel-2.2/de/odysseus/el/ExpressionFactoryImpl.java
@@ -0,0 +1,5 @@
+package de.odysseus.el;
+
+import javax.el.ExpressionFactory;
+
+public class ExpressionFactoryImpl extends ExpressionFactory {}
diff --git a/java/ql/test/stubs/juel-2.2/de/odysseus/el/util/SimpleContext.java b/java/ql/test/stubs/juel-2.2/de/odysseus/el/util/SimpleContext.java
new file mode 100644
index 00000000000..aa4f449e5fa
--- /dev/null
+++ b/java/ql/test/stubs/juel-2.2/de/odysseus/el/util/SimpleContext.java
@@ -0,0 +1,5 @@
+package de.odysseus.el.util;
+
+import javax.el.ELContext;
+
+public class SimpleContext extends ELContext {}
diff --git a/java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQConnection.java b/java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQConnection.java
new file mode 100644
index 00000000000..dce756e9646
--- /dev/null
+++ b/java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQConnection.java
@@ -0,0 +1,21 @@
+package javax.xml.xquery;
+
+import java.io.InputStream;
+import java.io.Reader;
+
+public interface XQConnection extends XQDataFactory {
+
+    XQExpression createExpression() throws XQException;
+    
+    XQPreparedExpression prepareExpression(String var1) throws XQException;
+
+    XQPreparedExpression prepareExpression(String var1, XQStaticContext var2) throws XQException;
+
+    XQPreparedExpression prepareExpression(Reader var1) throws XQException;
+
+    XQPreparedExpression prepareExpression(Reader var1, XQStaticContext var2) throws XQException;
+
+    XQPreparedExpression prepareExpression(InputStream var1) throws XQException;
+
+    XQPreparedExpression prepareExpression(InputStream var1, XQStaticContext var2) throws XQException;
+}
diff --git a/java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQDataFactory.java b/java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQDataFactory.java
new file mode 100644
index 00000000000..6bc2dbade6d
--- /dev/null
+++ b/java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQDataFactory.java
@@ -0,0 +1,5 @@
+package javax.xml.xquery;
+
+public interface XQDataFactory {
+    XQItemType createAtomicType(int var1) throws XQException;
+}
diff --git a/java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQDataSource.java b/java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQDataSource.java
new file mode 100644
index 00000000000..7f981a1ff00
--- /dev/null
+++ b/java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQDataSource.java
@@ -0,0 +1,5 @@
+package javax.xml.xquery;
+
+public interface XQDataSource {
+  XQConnection getConnection() throws XQException;
+}
diff --git a/java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQDynamicContext.java b/java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQDynamicContext.java
new file mode 100644
index 00000000000..c5058a2f866
--- /dev/null
+++ b/java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQDynamicContext.java
@@ -0,0 +1,7 @@
+package javax.xml.xquery;
+
+import javax.xml.namespace.QName;
+
+public interface XQDynamicContext {
+    void bindString(QName var1, String var2, XQItemType var3) throws XQException;
+}
diff --git a/java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQException.java b/java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQException.java
new file mode 100644
index 00000000000..4d81c322327
--- /dev/null
+++ b/java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQException.java
@@ -0,0 +1,3 @@
+package javax.xml.xquery;
+
+public class XQException extends Exception {}
diff --git a/java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQExpression.java b/java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQExpression.java
new file mode 100644
index 00000000000..5f2e9235bc5
--- /dev/null
+++ b/java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQExpression.java
@@ -0,0 +1,25 @@
+package javax.xml.xquery;
+
+import java.io.InputStream;
+import java.io.Reader;
+
+public interface XQExpression extends XQDynamicContext {
+
+    void cancel() throws XQException;
+
+    boolean isClosed();
+
+    void close() throws XQException;
+
+    void executeCommand(String var1) throws XQException;
+
+    void executeCommand(Reader var1) throws XQException;
+
+    XQResultSequence executeQuery(String var1) throws XQException;
+
+    XQResultSequence executeQuery(Reader var1) throws XQException;
+
+    XQResultSequence executeQuery(InputStream var1) throws XQException;
+
+    XQStaticContext getStaticContext() throws XQException;
+}
\ No newline at end of file
diff --git a/java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQItemAccessor.java b/java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQItemAccessor.java
new file mode 100644
index 00000000000..b52f5c16461
--- /dev/null
+++ b/java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQItemAccessor.java
@@ -0,0 +1,7 @@
+package javax.xml.xquery;
+
+import java.util.Properties;
+
+public interface XQItemAccessor {
+    String getItemAsString(Properties var1) throws XQException;
+}
diff --git a/java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQItemType.java b/java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQItemType.java
new file mode 100644
index 00000000000..b6c9cb896b0
--- /dev/null
+++ b/java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQItemType.java
@@ -0,0 +1,68 @@
+package javax.xml.xquery;
+
+public interface XQItemType extends XQSequenceType {
+    int XQITEMKIND_ATOMIC = 1;
+    int XQITEMKIND_ATTRIBUTE = 2;
+    int XQITEMKIND_COMMENT = 3;
+    int XQITEMKIND_DOCUMENT = 4;
+    int XQITEMKIND_DOCUMENT_ELEMENT = 5;
+    int XQITEMKIND_DOCUMENT_SCHEMA_ELEMENT = 6;
+    int XQITEMKIND_ELEMENT = 7;
+    int XQITEMKIND_ITEM = 8;
+    int XQITEMKIND_NODE = 9;
+    int XQITEMKIND_PI = 10;
+    int XQITEMKIND_TEXT = 11;
+    int XQITEMKIND_SCHEMA_ELEMENT = 12;
+    int XQITEMKIND_SCHEMA_ATTRIBUTE = 13;
+    int XQBASETYPE_UNTYPED = 1;
+    int XQBASETYPE_ANYTYPE = 2;
+    int XQBASETYPE_ANYSIMPLETYPE = 3;
+    int XQBASETYPE_ANYATOMICTYPE = 4;
+    int XQBASETYPE_UNTYPEDATOMIC = 5;
+    int XQBASETYPE_DAYTIMEDURATION = 6;
+    int XQBASETYPE_YEARMONTHDURATION = 7;
+    int XQBASETYPE_ANYURI = 8;
+    int XQBASETYPE_BASE64BINARY = 9;
+    int XQBASETYPE_BOOLEAN = 10;
+    int XQBASETYPE_DATE = 11;
+    int XQBASETYPE_INT = 12;
+    int XQBASETYPE_INTEGER = 13;
+    int XQBASETYPE_SHORT = 14;
+    int XQBASETYPE_LONG = 15;
+    int XQBASETYPE_DATETIME = 16;
+    int XQBASETYPE_DECIMAL = 17;
+    int XQBASETYPE_DOUBLE = 18;
+    int XQBASETYPE_DURATION = 19;
+    int XQBASETYPE_FLOAT = 20;
+    int XQBASETYPE_GDAY = 21;
+    int XQBASETYPE_GMONTH = 22;
+    int XQBASETYPE_GMONTHDAY = 23;
+    int XQBASETYPE_GYEAR = 24;
+    int XQBASETYPE_GYEARMONTH = 25;
+    int XQBASETYPE_HEXBINARY = 26;
+    int XQBASETYPE_NOTATION = 27;
+    int XQBASETYPE_QNAME = 28;
+    int XQBASETYPE_STRING = 29;
+    int XQBASETYPE_TIME = 30;
+    int XQBASETYPE_BYTE = 31;
+    int XQBASETYPE_NONPOSITIVE_INTEGER = 32;
+    int XQBASETYPE_NONNEGATIVE_INTEGER = 33;
+    int XQBASETYPE_NEGATIVE_INTEGER = 34;
+    int XQBASETYPE_POSITIVE_INTEGER = 35;
+    int XQBASETYPE_UNSIGNED_LONG = 36;
+    int XQBASETYPE_UNSIGNED_INT = 37;
+    int XQBASETYPE_UNSIGNED_SHORT = 38;
+    int XQBASETYPE_UNSIGNED_BYTE = 39;
+    int XQBASETYPE_NORMALIZED_STRING = 40;
+    int XQBASETYPE_TOKEN = 41;
+    int XQBASETYPE_LANGUAGE = 42;
+    int XQBASETYPE_NAME = 43;
+    int XQBASETYPE_NCNAME = 44;
+    int XQBASETYPE_NMTOKEN = 45;
+    int XQBASETYPE_ID = 46;
+    int XQBASETYPE_IDREF = 47;
+    int XQBASETYPE_ENTITY = 48;
+    int XQBASETYPE_IDREFS = 49;
+    int XQBASETYPE_ENTITIES = 50;
+    int XQBASETYPE_NMTOKENS = 51;
+}
diff --git a/java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQPreparedExpression.java b/java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQPreparedExpression.java
new file mode 100644
index 00000000000..3ab5024c1e6
--- /dev/null
+++ b/java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQPreparedExpression.java
@@ -0,0 +1,5 @@
+package javax.xml.xquery;
+
+public interface XQPreparedExpression extends XQDynamicContext {
+    XQResultSequence executeQuery() throws XQException;
+}
diff --git a/java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQResultSequence.java b/java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQResultSequence.java
new file mode 100644
index 00000000000..c7cd24e8561
--- /dev/null
+++ b/java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQResultSequence.java
@@ -0,0 +1,3 @@
+package javax.xml.xquery;
+
+public interface XQResultSequence extends XQSequence {}
diff --git a/java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQSequence.java b/java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQSequence.java
new file mode 100644
index 00000000000..b872795a759
--- /dev/null
+++ b/java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQSequence.java
@@ -0,0 +1,5 @@
+package javax.xml.xquery;
+
+public interface XQSequence extends XQItemAccessor {
+    boolean next() throws XQException;
+}
diff --git a/java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQSequenceType.java b/java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQSequenceType.java
new file mode 100644
index 00000000000..17d908f9e1c
--- /dev/null
+++ b/java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQSequenceType.java
@@ -0,0 +1,3 @@
+package javax.xml.xquery;
+
+public interface XQSequenceType {}
diff --git a/java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQStaticContext.java b/java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQStaticContext.java
new file mode 100644
index 00000000000..60911d4fb72
--- /dev/null
+++ b/java/ql/test/stubs/saxon-xqj-9.x/javax/xml/xquery/XQStaticContext.java
@@ -0,0 +1,3 @@
+package javax.xml.xquery;
+
+public interface XQStaticContext {}
diff --git a/java/ql/test/stubs/saxon-xqj-9.x/net/sf/saxon/Configuration.java b/java/ql/test/stubs/saxon-xqj-9.x/net/sf/saxon/Configuration.java
new file mode 100644
index 00000000000..bfd8bf1ff58
--- /dev/null
+++ b/java/ql/test/stubs/saxon-xqj-9.x/net/sf/saxon/Configuration.java
@@ -0,0 +1,6 @@
+package net.sf.saxon;
+
+import java.io.Serializable;
+
+
+public class Configuration implements Serializable, SourceResolver {}
diff --git a/java/ql/test/stubs/saxon-xqj-9.x/net/sf/saxon/SourceResolver.java b/java/ql/test/stubs/saxon-xqj-9.x/net/sf/saxon/SourceResolver.java
new file mode 100644
index 00000000000..aa2e2b2fe4d
--- /dev/null
+++ b/java/ql/test/stubs/saxon-xqj-9.x/net/sf/saxon/SourceResolver.java
@@ -0,0 +1,3 @@
+package net.sf.saxon;
+
+public interface SourceResolver {}
diff --git a/java/ql/test/stubs/saxon-xqj-9.x/net/sf/saxon/xqj/Closable.java b/java/ql/test/stubs/saxon-xqj-9.x/net/sf/saxon/xqj/Closable.java
new file mode 100644
index 00000000000..91245a31fc9
--- /dev/null
+++ b/java/ql/test/stubs/saxon-xqj-9.x/net/sf/saxon/xqj/Closable.java
@@ -0,0 +1,3 @@
+package net.sf.saxon.xqj;
+
+public abstract class Closable {}
diff --git a/java/ql/test/stubs/saxon-xqj-9.x/net/sf/saxon/xqj/SaxonXQConnection.java b/java/ql/test/stubs/saxon-xqj-9.x/net/sf/saxon/xqj/SaxonXQConnection.java
new file mode 100644
index 00000000000..0263588e8b4
--- /dev/null
+++ b/java/ql/test/stubs/saxon-xqj-9.x/net/sf/saxon/xqj/SaxonXQConnection.java
@@ -0,0 +1,46 @@
+package net.sf.saxon.xqj;
+
+import java.io.Reader;
+import net.sf.saxon.Configuration;
+import javax.xml.xquery.XQConnection;
+import javax.xml.xquery.XQPreparedExpression;
+import javax.xml.xquery.XQException;
+import javax.xml.xquery.XQExpression;
+import javax.xml.xquery.XQStaticContext;
+import java.io.InputStream;
+
+public class SaxonXQConnection extends SaxonXQDataFactory  implements XQConnection {
+    
+    private SaxonXQStaticContext staticContext;
+   
+    SaxonXQConnection(SaxonXQDataSource dataSource) {
+    }
+
+    public XQExpression createExpression() throws XQException {
+        return null;
+    }
+
+    public XQPreparedExpression prepareExpression(InputStream xquery) throws XQException {
+        return null;
+    }
+    
+    public XQPreparedExpression prepareExpression(InputStream xquery, XQStaticContext properties) throws XQException {
+        return null;
+    }
+
+    public XQPreparedExpression prepareExpression(Reader xquery) throws XQException {
+        return null;
+    }
+
+    public XQPreparedExpression prepareExpression(Reader xquery, XQStaticContext properties){
+        return null;
+    }
+
+    public XQPreparedExpression prepareExpression(String xquery) throws XQException {
+        return null;
+    }
+
+    public XQPreparedExpression prepareExpression(String xquery, XQStaticContext properties) throws XQException {
+        return null;
+    }
+}
diff --git a/java/ql/test/stubs/saxon-xqj-9.x/net/sf/saxon/xqj/SaxonXQDataFactory.java b/java/ql/test/stubs/saxon-xqj-9.x/net/sf/saxon/xqj/SaxonXQDataFactory.java
new file mode 100644
index 00000000000..2ea1a82541e
--- /dev/null
+++ b/java/ql/test/stubs/saxon-xqj-9.x/net/sf/saxon/xqj/SaxonXQDataFactory.java
@@ -0,0 +1,11 @@
+package net.sf.saxon.xqj;
+
+import javax.xml.xquery.XQException;
+import javax.xml.xquery.XQDataFactory;
+import javax.xml.xquery.XQItemType;
+
+public abstract class SaxonXQDataFactory extends Closable implements XQDataFactory { 
+    public XQItemType createAtomicType(int baseType) throws XQException {
+        return null;
+    }
+}
diff --git a/java/ql/test/stubs/saxon-xqj-9.x/net/sf/saxon/xqj/SaxonXQDataSource.java b/java/ql/test/stubs/saxon-xqj-9.x/net/sf/saxon/xqj/SaxonXQDataSource.java
new file mode 100644
index 00000000000..7e2549b6fe8
--- /dev/null
+++ b/java/ql/test/stubs/saxon-xqj-9.x/net/sf/saxon/xqj/SaxonXQDataSource.java
@@ -0,0 +1,12 @@
+package net.sf.saxon.xqj;
+
+import javax.xml.xquery.XQDataSource;
+import javax.xml.xquery.XQException;
+import javax.xml.xquery.XQConnection;
+
+public class SaxonXQDataSource implements XQDataSource {
+
+    public XQConnection getConnection() throws XQException {
+        return new SaxonXQConnection(this);
+    }
+}
diff --git a/java/ql/test/stubs/saxon-xqj-9.x/net/sf/saxon/xqj/SaxonXQStaticContext.java b/java/ql/test/stubs/saxon-xqj-9.x/net/sf/saxon/xqj/SaxonXQStaticContext.java
new file mode 100644
index 00000000000..e5e19b6ae1f
--- /dev/null
+++ b/java/ql/test/stubs/saxon-xqj-9.x/net/sf/saxon/xqj/SaxonXQStaticContext.java
@@ -0,0 +1,5 @@
+package net.sf.saxon.xqj;
+
+import javax.xml.xquery.XQStaticContext;
+
+public class SaxonXQStaticContext implements XQStaticContext {}
diff --git a/java/ql/test/stubs/servlet-api-2.4/javax/servlet/Filter.java b/java/ql/test/stubs/servlet-api-2.4/javax/servlet/Filter.java
new file mode 100644
index 00000000000..47fb902a3d6
--- /dev/null
+++ b/java/ql/test/stubs/servlet-api-2.4/javax/servlet/Filter.java
@@ -0,0 +1,11 @@
+package javax.servlet;
+
+import java.io.IOException;
+
+public interface Filter {
+    default public void init(FilterConfig filterConfig) throws ServletException {}
+    public void doFilter(ServletRequest request, ServletResponse response,
+                         FilterChain chain)
+            throws IOException, ServletException;
+    default public void destroy() {}
+}
diff --git a/java/ql/test/stubs/servlet-api-2.4/javax/servlet/FilterChain.java b/java/ql/test/stubs/servlet-api-2.4/javax/servlet/FilterChain.java
new file mode 100644
index 00000000000..b9f9708be56
--- /dev/null
+++ b/java/ql/test/stubs/servlet-api-2.4/javax/servlet/FilterChain.java
@@ -0,0 +1,7 @@
+package javax.servlet;
+
+import java.io.IOException;
+
+public interface FilterChain {
+   public void doFilter(ServletRequest request, ServletResponse response) throws IOException, ServletException;
+}
diff --git a/java/ql/test/stubs/servlet-api-2.4/javax/servlet/FilterConfig.java b/java/ql/test/stubs/servlet-api-2.4/javax/servlet/FilterConfig.java
new file mode 100644
index 00000000000..85d172231e9
--- /dev/null
+++ b/java/ql/test/stubs/servlet-api-2.4/javax/servlet/FilterConfig.java
@@ -0,0 +1,10 @@
+package javax.servlet;
+
+import java.util.Enumeration;
+
+public interface FilterConfig {
+    public String getFilterName();
+    public ServletContext getServletContext();
+    public String getInitParameter(String name);
+    public Enumeration<String> getInitParameterNames();
+}
diff --git a/java/ql/test/stubs/servlet-api-2.4/javax/servlet/http/Cookie.java b/java/ql/test/stubs/servlet-api-2.4/javax/servlet/http/Cookie.java
index d8348e13e2e..53d3058f921 100644
--- a/java/ql/test/stubs/servlet-api-2.4/javax/servlet/http/Cookie.java
+++ b/java/ql/test/stubs/servlet-api-2.4/javax/servlet/http/Cookie.java
@@ -24,61 +24,61 @@
 package javax.servlet.http;
 
 public class Cookie implements Cloneable {
-    private String name; // NAME= ... "$Name" style is reserved
-    private String value; // value of NAME
-    private String comment; // ;Comment=VALUE ... describes cookie's use
-    private String domain; // ;Domain=VALUE ... domain that sees cookie
-    private int maxAge = -1; // ;Max-Age=VALUE ... cookies auto-expire
-    private String path; // ;Path=VALUE ... URLs that see the cookie
-    private boolean secure; // ;Secure ... e.g. use SSL
-    private int version = 0; // ;Version=1 ... means RFC 2109++ style
 
     public Cookie(String name, String value) {
-        this.name = name;
-        this.value = value;
     }
     public void setComment(String purpose) {
-        comment = purpose;
     }
     public String getComment() {
-        return comment;
+        return null;
     }
     public void setDomain(String pattern) {
-        domain = pattern.toLowerCase(); // IE allegedly needs this
     }
     public String getDomain() {
-        return domain;
+        return null;
     }
     public void setMaxAge(int expiry) {
-        maxAge = expiry;
     }
     public int getMaxAge() {
-        return maxAge;
+        return -1;
     }
     public void setPath(String uri) {
-        path = uri;
     }
     public String getPath() {
-        return path;
+        return null;
     }
     public void setSecure(boolean flag) {
-        secure = flag;
     }
     public boolean getSecure() {
-        return secure;
+        return false;
     }
     public String getName() {
-        return name;
+        return null;
     }
     public void setValue(String newValue) {
-        value = newValue;
     }
     public String getValue() {
-        return value;
+        return null;
     }
     public int getVersion() {
-        return version;
+        return -1;
     }
     public void setVersion(int v) {
     }
+    public void setHttpOnly(boolean isHttpOnly) {
+    }
+    public boolean isHttpOnly() {
+        return false;
+    }
+
+    /**
+     * Convert the cookie to a string suitable for use as the value of the
+     * corresponding HTTP header.
+     *
+     * @return a stringified cookie.
+     */
+    @Override
+    public String toString() {
+        return null;
+    }    
 }
diff --git a/java/ql/test/stubs/servlet-api-2.4/javax/servlet/http/HttpServletResponse.java b/java/ql/test/stubs/servlet-api-2.4/javax/servlet/http/HttpServletResponse.java
index 2971e023390..162ac0db3cc 100644
--- a/java/ql/test/stubs/servlet-api-2.4/javax/servlet/http/HttpServletResponse.java
+++ b/java/ql/test/stubs/servlet-api-2.4/javax/servlet/http/HttpServletResponse.java
@@ -24,6 +24,7 @@
 package javax.servlet.http;
 
 import java.io.IOException;
+import java.util.Collection;
 import javax.servlet.ServletResponse;
 
 public interface HttpServletResponse extends ServletResponse {
@@ -44,6 +45,11 @@ public interface HttpServletResponse extends ServletResponse {
     public void addIntHeader(String name, int value);
     public void setStatus(int sc);
     public void setStatus(int sc, String sm);
+    public int getStatus();
+    public String getHeader(String name);
+    public Collection<String> getHeaders(String name);
+    public Collection<String> getHeaderNames();
+
 
     public static final int SC_CONTINUE = 100;
     public static final int SC_SWITCHING_PROTOCOLS = 101;
diff --git a/java/ql/test/stubs/springframework-5.2.3/org/springframework/boot/SpringBootConfiguration.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/boot/SpringBootConfiguration.java
new file mode 100644
index 00000000000..483c5cc5606
--- /dev/null
+++ b/java/ql/test/stubs/springframework-5.2.3/org/springframework/boot/SpringBootConfiguration.java
@@ -0,0 +1,10 @@
+package org.springframework.boot;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Target;
+
+import org.springframework.context.annotation.Configuration;
+
+@Target(ElementType.TYPE)
+@Configuration
+public @interface SpringBootConfiguration {}
\ No newline at end of file
diff --git a/java/ql/test/stubs/springframework-5.2.3/org/springframework/boot/autoconfigure/SpringBootApplication.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/boot/autoconfigure/SpringBootApplication.java
new file mode 100644
index 00000000000..38bbc35733e
--- /dev/null
+++ b/java/ql/test/stubs/springframework-5.2.3/org/springframework/boot/autoconfigure/SpringBootApplication.java
@@ -0,0 +1,12 @@
+package org.springframework.boot.autoconfigure;
+
+import java.lang.annotation.Target;
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Inherited;
+
+import org.springframework.boot.SpringBootConfiguration;
+
+@Target(ElementType.TYPE)
+@Inherited
+@SpringBootConfiguration
+public @interface SpringBootApplication {}
\ No newline at end of file
diff --git a/java/ql/test/stubs/springframework-5.2.3/org/springframework/context/annotation/Bean.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/context/annotation/Bean.java
new file mode 100644
index 00000000000..24d7be0f817
--- /dev/null
+++ b/java/ql/test/stubs/springframework-5.2.3/org/springframework/context/annotation/Bean.java
@@ -0,0 +1,10 @@
+package org.springframework.context.annotation;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Target;
+
+@Target({ElementType.METHOD, ElementType.ANNOTATION_TYPE})
+public @interface Bean {
+
+	String[] name() default {};
+}
\ No newline at end of file
diff --git a/java/ql/test/stubs/springframework-5.2.3/org/springframework/context/annotation/Configuration.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/context/annotation/Configuration.java
new file mode 100644
index 00000000000..0024b3ba833
--- /dev/null
+++ b/java/ql/test/stubs/springframework-5.2.3/org/springframework/context/annotation/Configuration.java
@@ -0,0 +1,7 @@
+package org.springframework.context.annotation;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Target;
+
+@Target(ElementType.TYPE)
+public @interface Configuration {}
\ No newline at end of file
diff --git a/java/ql/test/stubs/springframework-5.2.3/org/springframework/core/annotation/AliasFor.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/core/annotation/AliasFor.java
new file mode 100644
index 00000000000..edfe917400b
--- /dev/null
+++ b/java/ql/test/stubs/springframework-5.2.3/org/springframework/core/annotation/AliasFor.java
@@ -0,0 +1,21 @@
+package org.springframework.core.annotation;
+
+import java.lang.annotation.Annotation;
+import java.lang.annotation.Documented;
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+@Retention(RetentionPolicy.RUNTIME)
+@Target({ElementType.METHOD})
+@Documented
+public @interface AliasFor {
+    @AliasFor("attribute")
+    String value() default "";
+
+    @AliasFor("value")
+    String attribute() default "";
+ 
+    Class<? extends Annotation> annotation() default Annotation.class;
+}
diff --git a/java/ql/test/stubs/springframework-5.2.3/org/springframework/remoting/httpinvoker/HttpInvokerServiceExporter.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/remoting/httpinvoker/HttpInvokerServiceExporter.java
new file mode 100644
index 00000000000..5eb56c0897b
--- /dev/null
+++ b/java/ql/test/stubs/springframework-5.2.3/org/springframework/remoting/httpinvoker/HttpInvokerServiceExporter.java
@@ -0,0 +1,8 @@
+package org.springframework.remoting.httpinvoker;
+
+public class HttpInvokerServiceExporter extends org.springframework.remoting.rmi.RemoteInvocationSerializingExporter {
+
+    public void setService(Object service) {}
+
+    public void setServiceInterface(Class clazz) {}
+}
\ No newline at end of file
diff --git a/java/ql/test/stubs/springframework-5.2.3/org/springframework/remoting/rmi/RemoteInvocationSerializingExporter.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/remoting/rmi/RemoteInvocationSerializingExporter.java
new file mode 100644
index 00000000000..5449b83ba86
--- /dev/null
+++ b/java/ql/test/stubs/springframework-5.2.3/org/springframework/remoting/rmi/RemoteInvocationSerializingExporter.java
@@ -0,0 +1,3 @@
+package org.springframework.remoting.rmi;
+
+public abstract class RemoteInvocationSerializingExporter {}
diff --git a/java/ql/test/stubs/springframework-5.2.3/org/springframework/security/web/csrf/CsrfToken.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/security/web/csrf/CsrfToken.java
new file mode 100644
index 00000000000..bc59a2e496a
--- /dev/null
+++ b/java/ql/test/stubs/springframework-5.2.3/org/springframework/security/web/csrf/CsrfToken.java
@@ -0,0 +1,50 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.web.csrf;
+
+import java.io.Serializable;
+
+/**
+ * Provides the information about an expected CSRF token.
+ *
+ * @author Rob Winch
+ * @since 3.2
+ * @see DefaultCsrfToken
+ */
+public interface CsrfToken extends Serializable {
+
+	/**
+	 * Gets the HTTP header that the CSRF is populated on the response and can be placed
+	 * on requests instead of the parameter. Cannot be null.
+	 * @return the HTTP header that the CSRF is populated on the response and can be
+	 * placed on requests instead of the parameter
+	 */
+	String getHeaderName();
+
+	/**
+	 * Gets the HTTP parameter name that should contain the token. Cannot be null.
+	 * @return the HTTP parameter name that should contain the token.
+	 */
+	String getParameterName();
+
+	/**
+	 * Gets the token value. Cannot be null.
+	 * @return the token value
+	 */
+	String getToken();
+
+}
diff --git a/java/ql/test/stubs/springframework-5.2.3/org/springframework/stereotype/Controller.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/stereotype/Controller.java
index 0bfb67d99c1..a4a49fffb90 100644
--- a/java/ql/test/stubs/springframework-5.2.3/org/springframework/stereotype/Controller.java
+++ b/java/ql/test/stubs/springframework-5.2.3/org/springframework/stereotype/Controller.java
@@ -1,9 +1,15 @@
 package org.springframework.stereotype;
 
-import java.lang.annotation.*;
+import java.lang.annotation.Documented;
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
 
-@Target(value=ElementType.TYPE)
-@Retention(value=RetentionPolicy.RUNTIME)
+@Target({ElementType.TYPE})
+@Retention(RetentionPolicy.RUNTIME)
 @Documented
 @Component
-public @interface Controller { }
+public @interface Controller {
+    String value() default "";
+}
diff --git a/java/ql/test/stubs/springframework-5.2.3/org/springframework/web/bind/annotation/GetMapping.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/web/bind/annotation/GetMapping.java
new file mode 100644
index 00000000000..541c7cd4e21
--- /dev/null
+++ b/java/ql/test/stubs/springframework-5.2.3/org/springframework/web/bind/annotation/GetMapping.java
@@ -0,0 +1,51 @@
+package org.springframework.web.bind.annotation;
+
+import java.lang.annotation.Documented;
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+import org.springframework.core.annotation.AliasFor;
+
+@Target({ElementType.METHOD})
+@Retention(RetentionPolicy.RUNTIME)
+@Documented
+@RequestMapping(
+    method = {RequestMethod.GET}
+)
+public @interface GetMapping {
+    @AliasFor(
+        annotation = RequestMapping.class
+    )
+    String name() default "";
+
+    @AliasFor(
+        annotation = RequestMapping.class
+    )
+    String[] value() default {};
+
+    @AliasFor(
+        annotation = RequestMapping.class
+    )
+    String[] path() default {};
+
+    @AliasFor(
+        annotation = RequestMapping.class
+    )
+    String[] params() default {};
+
+    @AliasFor(
+        annotation = RequestMapping.class
+    )
+    String[] headers() default {};
+
+    @AliasFor(
+        annotation = RequestMapping.class
+    )
+    String[] consumes() default {};
+
+    @AliasFor(
+        annotation = RequestMapping.class
+    )
+    String[] produces() default {};
+}
diff --git a/java/ql/test/stubs/springframework-5.2.3/org/springframework/web/bind/annotation/Mapping.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/web/bind/annotation/Mapping.java
new file mode 100644
index 00000000000..5f269bbcbb8
--- /dev/null
+++ b/java/ql/test/stubs/springframework-5.2.3/org/springframework/web/bind/annotation/Mapping.java
@@ -0,0 +1,4 @@
+package org.springframework.web.bind.annotation;
+
+public @interface Mapping {
+}
diff --git a/java/ql/test/stubs/springframework-5.2.3/org/springframework/web/bind/annotation/RequestMapping.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/web/bind/annotation/RequestMapping.java
index 73ff8d1b03a..093065ca5f1 100644
--- a/java/ql/test/stubs/springframework-5.2.3/org/springframework/web/bind/annotation/RequestMapping.java
+++ b/java/ql/test/stubs/springframework-5.2.3/org/springframework/web/bind/annotation/RequestMapping.java
@@ -1,11 +1,32 @@
 package org.springframework.web.bind.annotation;
 
-import java.lang.annotation.*;
+import java.lang.annotation.Documented;
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+import org.springframework.core.annotation.AliasFor;
 
 @Target(value={ElementType.METHOD,ElementType.TYPE})
 @Retention(value=RetentionPolicy.RUNTIME)
 @Documented
+@Mapping
 public @interface RequestMapping {
+    String name() default "";
+
+    @AliasFor("path")
+    String[] value() default {};
+
+    @AliasFor("value")
+    String[] path() default {};
 
     RequestMethod[] method() default {};
+
+    String[] params() default {};
+
+    String[] headers() default {};
+
+    String[] consumes() default {};
+
+    String[] produces() default {};
 }
diff --git a/java/ql/test/stubs/springframework-5.2.3/org/springframework/web/bind/annotation/RequestParam.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/web/bind/annotation/RequestParam.java
index 5ae52ad123f..56094811c37 100644
--- a/java/ql/test/stubs/springframework-5.2.3/org/springframework/web/bind/annotation/RequestParam.java
+++ b/java/ql/test/stubs/springframework-5.2.3/org/springframework/web/bind/annotation/RequestParam.java
@@ -1,8 +1,23 @@
 package org.springframework.web.bind.annotation;
 
-import java.lang.annotation.*;
+import java.lang.annotation.Documented;
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+import org.springframework.core.annotation.AliasFor;
 
-@Target(value=ElementType.PARAMETER)
-@Retention(value=RetentionPolicy.RUNTIME)
+@Target({ElementType.PARAMETER})
+@Retention(RetentionPolicy.RUNTIME)
 @Documented
-public @interface RequestParam { }
+public @interface RequestParam {
+    @AliasFor("name")
+    String value() default "";
+
+    @AliasFor("value")
+    String name() default "";
+
+    boolean required() default true;
+
+    String defaultValue() default "\n\t\t\n\t\t\n\ue000\ue001\ue002\n\t\t\t\t\n";
+}
diff --git a/java/ql/test/stubs/springframework-5.2.3/org/springframework/web/bind/annotation/ResponseBody.java b/java/ql/test/stubs/springframework-5.2.3/org/springframework/web/bind/annotation/ResponseBody.java
new file mode 100644
index 00000000000..4f21b6daaaf
--- /dev/null
+++ b/java/ql/test/stubs/springframework-5.2.3/org/springframework/web/bind/annotation/ResponseBody.java
@@ -0,0 +1,13 @@
+package org.springframework.web.bind.annotation;
+
+import java.lang.annotation.Documented;
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+@Target({ElementType.TYPE, ElementType.METHOD})
+@Retention(RetentionPolicy.RUNTIME)
+@Documented
+public @interface ResponseBody {
+}
diff --git a/javascript/change-notes/2021-03-17-koa-route.md b/javascript/change-notes/2021-03-17-koa-route.md
new file mode 100644
index 00000000000..15b1d862c9a
--- /dev/null
+++ b/javascript/change-notes/2021-03-17-koa-route.md
@@ -0,0 +1,5 @@
+lgtm,codescanning
+* Route handlers registered using koa routing libraries are recognized as a source of remote user input. 
+  Affected packages are
+    [koa-route](https://www.npmjs.com/package/koa-route), and
+    [koa-router](https://www.npmjs.com/package/koa-router)
diff --git a/javascript/change-notes/2021-03-17-puppeteer.md b/javascript/change-notes/2021-03-17-puppeteer.md
new file mode 100644
index 00000000000..84e8fadd9b7
--- /dev/null
+++ b/javascript/change-notes/2021-03-17-puppeteer.md
@@ -0,0 +1,4 @@
+lgtm,codescanning
+* URIs used in the puppeteer library are now recognized as sinks for `js/request-forgery`.
+  Affected packages are
+    [puppeteer](https://www.npmjs.com/package/puppeteer)
\ No newline at end of file
diff --git a/javascript/change-notes/2021-03-19-async-execute.md b/javascript/change-notes/2021-03-19-async-execute.md
new file mode 100644
index 00000000000..4f7e9240bc3
--- /dev/null
+++ b/javascript/change-notes/2021-03-19-async-execute.md
@@ -0,0 +1,4 @@
+lgtm,codescanning
+* The command injection security queries now recognize additional sinks.
+  Affected packages are
+    [async-execute](https://npmjs.com/package/async-execute)
diff --git a/javascript/change-notes/2021-03-23-accessor-calls.md b/javascript/change-notes/2021-03-23-accessor-calls.md
new file mode 100644
index 00000000000..080a73c7abb
--- /dev/null
+++ b/javascript/change-notes/2021-03-23-accessor-calls.md
@@ -0,0 +1,3 @@
+lgtm,codescanning
+* Calls to property accessors are now analyzed on par with regular function calls,
+  leading to more results from queries that rely on data flow.
diff --git a/javascript/change-notes/2021-03-25-remove-legacy-code-duplication-library.md b/javascript/change-notes/2021-03-25-remove-legacy-code-duplication-library.md
new file mode 100644
index 00000000000..2a4ac2033ea
--- /dev/null
+++ b/javascript/change-notes/2021-03-25-remove-legacy-code-duplication-library.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* The legacy code duplication library has been removed.
diff --git a/javascript/change-notes/2021-03-25-remove-legacy-filter-queries.md b/javascript/change-notes/2021-03-25-remove-legacy-filter-queries.md
new file mode 100644
index 00000000000..e3e4b9b4b1e
--- /dev/null
+++ b/javascript/change-notes/2021-03-25-remove-legacy-filter-queries.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* Legacy filter queries have been removed.
diff --git a/javascript/change-notes/2021-03-29-misc-steps.md b/javascript/change-notes/2021-03-29-misc-steps.md
new file mode 100644
index 00000000000..02617ae056b
--- /dev/null
+++ b/javascript/change-notes/2021-03-29-misc-steps.md
@@ -0,0 +1,6 @@
+lgtm,codescanning
+* The `lodash-es` package is now recognized as a variant of `lodash`.
+* Taint is now propagated through the `babel.transform` function.
+* Improved data flow through React applications using `redux-form` or `react-router`.
+* Base64 decoding using the `react-native-base64` package is now recognized.
+* An expression of form `o[o.length] = y` is now recognized as appending to an array.
diff --git a/javascript/change-notes/2021-03-29-pg-promise.md b/javascript/change-notes/2021-03-29-pg-promise.md
new file mode 100644
index 00000000000..bde661be5b8
--- /dev/null
+++ b/javascript/change-notes/2021-03-29-pg-promise.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* SQL injection sinks from the `pg-promise` library are now recognized.
diff --git a/javascript/change-notes/2021-03-30-sql-models.md b/javascript/change-notes/2021-03-30-sql-models.md
new file mode 100644
index 00000000000..2ceaf8dc7a7
--- /dev/null
+++ b/javascript/change-notes/2021-03-30-sql-models.md
@@ -0,0 +1,3 @@
+lgtm,codescanning
+* The SQL library models for `mysql`, `mysql2`, `mssql`, `pg`, `sqlite3`, `sequelize`, and `@google-cloud/spanner` have improved,
+  leading to more SQL injection sinks.
diff --git a/javascript/change-notes/2021-04-01-tsconfig-file-inclusion-handling.md b/javascript/change-notes/2021-04-01-tsconfig-file-inclusion-handling.md
new file mode 100644
index 00000000000..7eacc308c9a
--- /dev/null
+++ b/javascript/change-notes/2021-04-01-tsconfig-file-inclusion-handling.md
@@ -0,0 +1,5 @@
+lgtm,codescanning
+* Fixed a bug which caused some imports to be resolved incorrectly
+  for projects containing multiple `tsconfig.json` files.
+* Fixed a bug which could cause some files in the `node_modules` folder
+  to be extracted even though they should be excluded.
diff --git a/javascript/change-notes/2021-04-08-redux.md b/javascript/change-notes/2021-04-08-redux.md
new file mode 100644
index 00000000000..91a3b95e63c
--- /dev/null
+++ b/javascript/change-notes/2021-04-08-redux.md
@@ -0,0 +1,3 @@
+lgtm,codescanning
+* Support for Redux has improved. The security queries can now track taint through reducer functions and state managed by Redux.
+  Affected packages are `redux`, `react-redux`, `@reduxjs/toolkit`, `redux-actions`, `redux-persist`, `reduce-reducers`, `redux-immutable`, and `immer`.
diff --git a/javascript/change-notes/2021-04-12-disabling-certificate-validation.md b/javascript/change-notes/2021-04-12-disabling-certificate-validation.md
new file mode 100644
index 00000000000..e289c5f7276
--- /dev/null
+++ b/javascript/change-notes/2021-04-12-disabling-certificate-validation.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* The query "Disabling certificate validation" (`js/disabling-certificate-validation`) has been improved to recognize many more request libraries.
diff --git a/javascript/change-notes/2021-04-15-typescript-template-literal-type-crash.md b/javascript/change-notes/2021-04-15-typescript-template-literal-type-crash.md
new file mode 100644
index 00000000000..e08dbd54dd6
--- /dev/null
+++ b/javascript/change-notes/2021-04-15-typescript-template-literal-type-crash.md
@@ -0,0 +1,3 @@
+lgtm,codescanning
+* Fixed a bug that could cause extraction to fail when extracting a TypeScript
+  code base containing a template literal type without substitutions.
diff --git a/javascript/extractor/src/com/semmle/js/extractor/AutoBuild.java b/javascript/extractor/src/com/semmle/js/extractor/AutoBuild.java
index 505c45832e2..94319e4998c 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/AutoBuild.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/AutoBuild.java
@@ -407,7 +407,7 @@ public class AutoBuild {
     // codeql-javascript-*.json files
     patterns.add("**/.eslintrc*");
     patterns.add("**/package.json");
-    patterns.add("**/tsconfig.json");
+    patterns.add("**/tsconfig*.json");
     patterns.add("**/codeql-javascript-*.json");
 
     // include any explicitly specified extensions
diff --git a/javascript/extractor/src/com/semmle/js/extractor/Main.java b/javascript/extractor/src/com/semmle/js/extractor/Main.java
index 7b5df6946d4..7c5a8a25984 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/Main.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/Main.java
@@ -43,7 +43,7 @@ public class Main {
    * A version identifier that should be updated every time the extractor changes in such a way that
    * it may produce different tuples for the same file under the same {@link ExtractorConfig}.
    */
-  public static final String EXTRACTOR_VERSION = "2021-03-08";
+  public static final String EXTRACTOR_VERSION = "2021-03-19";
 
   public static final Pattern NEWLINE = Pattern.compile("\n");
 
diff --git a/javascript/extractor/src/com/semmle/js/parser/ParsedProject.java b/javascript/extractor/src/com/semmle/js/parser/ParsedProject.java
index 34315111ba6..45fc5c03fe6 100644
--- a/javascript/extractor/src/com/semmle/js/parser/ParsedProject.java
+++ b/javascript/extractor/src/com/semmle/js/parser/ParsedProject.java
@@ -21,7 +21,7 @@ public class ParsedProject {
 
   /** Absolute paths to the files included in this project. */
   public Set<File> getOwnFiles() {
-    return allFiles;
+    return ownFiles;
   }
 
   /** Absolute paths to the files included in or referenced by this project. */
diff --git a/javascript/extractor/src/com/semmle/ts/extractor/TypeScriptASTConverter.java b/javascript/extractor/src/com/semmle/ts/extractor/TypeScriptASTConverter.java
index 36d4f888618..f8ad99915c9 100644
--- a/javascript/extractor/src/com/semmle/ts/extractor/TypeScriptASTConverter.java
+++ b/javascript/extractor/src/com/semmle/ts/extractor/TypeScriptASTConverter.java
@@ -5,7 +5,6 @@ import java.util.Collections;
 import java.util.List;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
-import java.util.stream.Collectors;
 
 import com.google.gson.JsonArray;
 import com.google.gson.JsonElement;
@@ -1001,10 +1000,10 @@ public class TypeScriptASTConverter {
   private Node convertConditionalType(JsonObject node, SourceLocation loc) throws ParseError {
     return new ConditionalTypeExpr(
         loc,
-        convertChild(node, "checkType"),
-        convertChild(node, "extendsType"),
-        convertChild(node, "trueType"),
-        convertChild(node, "falseType"));
+        convertChildAsType(node, "checkType"),
+        convertChildAsType(node, "extendsType"),
+        convertChildAsType(node, "trueType"),
+        convertChildAsType(node, "falseType"));
   }
 
   private SourceLocation getSourceRange(Position from, Position to) {
@@ -1613,6 +1612,10 @@ public class TypeScriptASTConverter {
         literal = new Literal(loc, arg.getTokenType(), "-" + arg.getValue());
       }
     }
+    if (literal instanceof TemplateLiteral) {
+      // A LiteralType containing a NoSubstitutionTemplateLiteral must produce a TemplateLiteralTypeExpr
+      return new TemplateLiteralTypeExpr(literal.getLoc(), new ArrayList<>(), ((TemplateLiteral)literal).getQuasis());
+    }
     return literal;
   }
 
@@ -1842,7 +1845,7 @@ public class TypeScriptASTConverter {
   }
 
   private Node convertOptionalType(JsonObject node, SourceLocation loc) throws ParseError {
-    return new OptionalTypeExpr(loc, convertChild(node, "type"));
+    return new OptionalTypeExpr(loc, convertChildAsType(node, "type"));
   }
 
   private ITypeExpression asType(Node node) {
diff --git a/javascript/extractor/tests/ts/output/trap/importNonStrings.ts.trap b/javascript/extractor/tests/ts/output/trap/importNonStrings.ts.trap
index c5fc95ddcb8..af044be98c8 100644
--- a/javascript/extractor/tests/ts/output/trap/importNonStrings.ts.trap
+++ b/javascript/extractor/tests/ts/output/trap/importNonStrings.ts.trap
@@ -9,34 +9,249 @@ hasLocation(#10000,#10002)
 #20000=@"global_scope"
 scopes(#20000,0)
 #20001=@"script;{#10000},1,1"
+#20002=*
+lines(#20002,#20001,"type X = import(3);","
+")
+#20003=@"loc,{#10000},1,1,1,19"
+locations_default(#20003,#10000,1,1,1,19)
+hasLocation(#20002,#20003)
+#20004=*
+lines(#20004,#20001,"type Y = import(`Foo`);","
+")
+#20005=@"loc,{#10000},2,1,2,23"
+locations_default(#20005,#10000,2,1,2,23)
+hasLocation(#20004,#20005)
+#20006=*
+lines(#20006,#20001,"type Z = import(Y);","
+")
+#20007=@"loc,{#10000},3,1,3,19"
+locations_default(#20007,#10000,3,1,3,19)
+hasLocation(#20006,#20007)
+numlines(#20001,3,3,0)
+#20008=*
+tokeninfo(#20008,7,#20001,0,"type")
+#20009=@"loc,{#10000},1,1,1,4"
+locations_default(#20009,#10000,1,1,1,4)
+hasLocation(#20008,#20009)
+#20010=*
+tokeninfo(#20010,6,#20001,1,"X")
+#20011=@"loc,{#10000},1,6,1,6"
+locations_default(#20011,#10000,1,6,1,6)
+hasLocation(#20010,#20011)
+#20012=*
+tokeninfo(#20012,8,#20001,2,"=")
+#20013=@"loc,{#10000},1,8,1,8"
+locations_default(#20013,#10000,1,8,1,8)
+hasLocation(#20012,#20013)
+#20014=*
+tokeninfo(#20014,7,#20001,3,"import")
+#20015=@"loc,{#10000},1,10,1,15"
+locations_default(#20015,#10000,1,10,1,15)
+hasLocation(#20014,#20015)
+#20016=*
+tokeninfo(#20016,8,#20001,4,"(")
+#20017=@"loc,{#10000},1,16,1,16"
+locations_default(#20017,#10000,1,16,1,16)
+hasLocation(#20016,#20017)
+#20018=*
+tokeninfo(#20018,3,#20001,5,"3")
+#20019=@"loc,{#10000},1,17,1,17"
+locations_default(#20019,#10000,1,17,1,17)
+hasLocation(#20018,#20019)
+#20020=*
+tokeninfo(#20020,8,#20001,6,")")
+#20021=@"loc,{#10000},1,18,1,18"
+locations_default(#20021,#10000,1,18,1,18)
+hasLocation(#20020,#20021)
+#20022=*
+tokeninfo(#20022,8,#20001,7,";")
+#20023=@"loc,{#10000},1,19,1,19"
+locations_default(#20023,#10000,1,19,1,19)
+hasLocation(#20022,#20023)
+#20024=*
+tokeninfo(#20024,7,#20001,8,"type")
+#20025=@"loc,{#10000},2,1,2,4"
+locations_default(#20025,#10000,2,1,2,4)
+hasLocation(#20024,#20025)
+#20026=*
+tokeninfo(#20026,6,#20001,9,"Y")
+#20027=@"loc,{#10000},2,6,2,6"
+locations_default(#20027,#10000,2,6,2,6)
+hasLocation(#20026,#20027)
+#20028=*
+tokeninfo(#20028,8,#20001,10,"=")
+#20029=@"loc,{#10000},2,8,2,8"
+locations_default(#20029,#10000,2,8,2,8)
+hasLocation(#20028,#20029)
+#20030=*
+tokeninfo(#20030,7,#20001,11,"import")
+#20031=@"loc,{#10000},2,10,2,15"
+locations_default(#20031,#10000,2,10,2,15)
+hasLocation(#20030,#20031)
+#20032=*
+tokeninfo(#20032,8,#20001,12,"(")
+#20033=@"loc,{#10000},2,16,2,16"
+locations_default(#20033,#10000,2,16,2,16)
+hasLocation(#20032,#20033)
+#20034=*
+tokeninfo(#20034,4,#20001,13,"`Foo`")
+#20035=@"loc,{#10000},2,17,2,21"
+locations_default(#20035,#10000,2,17,2,21)
+hasLocation(#20034,#20035)
+#20036=*
+tokeninfo(#20036,8,#20001,14,")")
+#20037=@"loc,{#10000},2,22,2,22"
+locations_default(#20037,#10000,2,22,2,22)
+hasLocation(#20036,#20037)
+#20038=*
+tokeninfo(#20038,8,#20001,15,";")
+#20039=@"loc,{#10000},2,23,2,23"
+locations_default(#20039,#10000,2,23,2,23)
+hasLocation(#20038,#20039)
+#20040=*
+tokeninfo(#20040,7,#20001,16,"type")
+#20041=@"loc,{#10000},3,1,3,4"
+locations_default(#20041,#10000,3,1,3,4)
+hasLocation(#20040,#20041)
+#20042=*
+tokeninfo(#20042,6,#20001,17,"Z")
+#20043=@"loc,{#10000},3,6,3,6"
+locations_default(#20043,#10000,3,6,3,6)
+hasLocation(#20042,#20043)
+#20044=*
+tokeninfo(#20044,8,#20001,18,"=")
+#20045=@"loc,{#10000},3,8,3,8"
+locations_default(#20045,#10000,3,8,3,8)
+hasLocation(#20044,#20045)
+#20046=*
+tokeninfo(#20046,7,#20001,19,"import")
+#20047=@"loc,{#10000},3,10,3,15"
+locations_default(#20047,#10000,3,10,3,15)
+hasLocation(#20046,#20047)
+#20048=*
+tokeninfo(#20048,8,#20001,20,"(")
+#20049=@"loc,{#10000},3,16,3,16"
+locations_default(#20049,#10000,3,16,3,16)
+hasLocation(#20048,#20049)
+#20050=*
+tokeninfo(#20050,6,#20001,21,"Y")
+#20051=@"loc,{#10000},3,17,3,17"
+locations_default(#20051,#10000,3,17,3,17)
+hasLocation(#20050,#20051)
+#20052=*
+tokeninfo(#20052,8,#20001,22,")")
+#20053=@"loc,{#10000},3,18,3,18"
+locations_default(#20053,#10000,3,18,3,18)
+hasLocation(#20052,#20053)
+#20054=*
+tokeninfo(#20054,8,#20001,23,";")
+#20055=@"loc,{#10000},3,19,3,19"
+locations_default(#20055,#10000,3,19,3,19)
+hasLocation(#20054,#20055)
+#20056=*
+tokeninfo(#20056,0,#20001,24,"")
+#20057=@"loc,{#10000},4,1,4,0"
+locations_default(#20057,#10000,4,1,4,0)
+hasLocation(#20056,#20057)
 toplevels(#20001,0)
-#20002=@"loc,{#10000},1,1,1,1"
-locations_default(#20002,#10000,1,1,1,1)
-hasLocation(#20001,#20002)
-#20003=*
-js_parse_errors(#20003,#20001,"Error: Unsupported syntax in import","type Y = import(`Foo`);
-")
-#20004=@"loc,{#10000},2,10,2,10"
-locations_default(#20004,#10000,2,10,2,10)
-hasLocation(#20003,#20004)
-#20005=*
-lines(#20005,#20001,"type X = import(3);","
-")
-#20006=@"loc,{#10000},1,1,1,19"
-locations_default(#20006,#10000,1,1,1,19)
-hasLocation(#20005,#20006)
-#20007=*
-lines(#20007,#20001,"type Y = import(`Foo`);","
-")
-#20008=@"loc,{#10000},2,1,2,23"
-locations_default(#20008,#10000,2,1,2,23)
-hasLocation(#20007,#20008)
-#20009=*
-lines(#20009,#20001,"type Z = import(Y);","
-")
-#20010=@"loc,{#10000},3,1,3,19"
-locations_default(#20010,#10000,3,1,3,19)
-hasLocation(#20009,#20010)
-numlines(#20001,3,0,0)
-numlines(#10000,3,0,0)
+#20058=@"loc,{#10000},1,1,4,0"
+locations_default(#20058,#10000,1,1,4,0)
+hasLocation(#20001,#20058)
+#20059=@"local_type_name;{X};{#20000}"
+local_type_names(#20059,"X",#20000)
+#20060=@"local_type_name;{Y};{#20000}"
+local_type_names(#20060,"Y",#20000)
+#20061=@"local_type_name;{Z};{#20000}"
+local_type_names(#20061,"Z",#20000)
+#20062=*
+stmts(#20062,35,#20001,0,"type X = import(3);")
+hasLocation(#20062,#20003)
+stmt_containers(#20062,#20001)
+#20063=*
+typeexprs(#20063,1,#20062,0,"X")
+hasLocation(#20063,#20011)
+enclosing_stmt(#20063,#20062)
+expr_containers(#20063,#20001)
+literals("X","X",#20063)
+typedecl(#20063,#20059)
+#20064=*
+typeexprs(#20064,30,#20062,1,"import(3)")
+#20065=@"loc,{#10000},1,10,1,18"
+locations_default(#20065,#10000,1,10,1,18)
+hasLocation(#20064,#20065)
+enclosing_stmt(#20064,#20062)
+expr_containers(#20064,#20001)
+#20066=*
+typeexprs(#20066,4,#20064,0,"3")
+hasLocation(#20066,#20019)
+enclosing_stmt(#20066,#20062)
+expr_containers(#20066,#20001)
+literals("3","3",#20066)
+#20067=*
+stmts(#20067,35,#20001,1,"type Y  ... `Foo`);")
+hasLocation(#20067,#20005)
+stmt_containers(#20067,#20001)
+#20068=*
+typeexprs(#20068,1,#20067,0,"Y")
+hasLocation(#20068,#20027)
+enclosing_stmt(#20068,#20067)
+expr_containers(#20068,#20001)
+literals("Y","Y",#20068)
+typedecl(#20068,#20060)
+#20069=*
+typeexprs(#20069,30,#20067,1,"import(`Foo`)")
+#20070=@"loc,{#10000},2,10,2,22"
+locations_default(#20070,#10000,2,10,2,22)
+hasLocation(#20069,#20070)
+enclosing_stmt(#20069,#20067)
+expr_containers(#20069,#20001)
+#20071=*
+typeexprs(#20071,37,#20069,0,"`Foo`")
+hasLocation(#20071,#20035)
+enclosing_stmt(#20071,#20067)
+expr_containers(#20071,#20001)
+#20072=*
+typeexprs(#20072,3,#20071,0,"`Foo`")
+hasLocation(#20072,#20035)
+enclosing_stmt(#20072,#20067)
+expr_containers(#20072,#20001)
+literals("Foo","Foo",#20072)
+#20073=*
+stmts(#20073,35,#20001,2,"type Z = import(Y);")
+hasLocation(#20073,#20007)
+stmt_containers(#20073,#20001)
+#20074=*
+typeexprs(#20074,1,#20073,0,"Z")
+hasLocation(#20074,#20043)
+enclosing_stmt(#20074,#20073)
+expr_containers(#20074,#20001)
+literals("Z","Z",#20074)
+typedecl(#20074,#20061)
+#20075=*
+typeexprs(#20075,30,#20073,1,"import(Y)")
+#20076=@"loc,{#10000},3,10,3,18"
+locations_default(#20076,#10000,3,10,3,18)
+hasLocation(#20075,#20076)
+enclosing_stmt(#20075,#20073)
+expr_containers(#20075,#20001)
+#20077=*
+typeexprs(#20077,0,#20075,0,"Y")
+hasLocation(#20077,#20051)
+enclosing_stmt(#20077,#20073)
+expr_containers(#20077,#20001)
+literals("Y","Y",#20077)
+typebind(#20077,#20060)
+#20078=*
+entry_cfg_node(#20078,#20001)
+#20079=@"loc,{#10000},1,1,1,0"
+locations_default(#20079,#10000,1,1,1,0)
+hasLocation(#20078,#20079)
+#20080=*
+exit_cfg_node(#20080,#20001)
+hasLocation(#20080,#20057)
+successor(#20073,#20080)
+successor(#20067,#20073)
+successor(#20062,#20067)
+successor(#20078,#20062)
+numlines(#10000,3,3,0)
 filetype(#10000,"typescript")
diff --git a/javascript/ql/examples/queries/dataflow/BackendIdor/BackendIdor.ql b/javascript/ql/examples/queries/dataflow/BackendIdor/BackendIdor.ql
index 020516406af..3f7e555738e 100644
--- a/javascript/ql/examples/queries/dataflow/BackendIdor/BackendIdor.ql
+++ b/javascript/ql/examples/queries/dataflow/BackendIdor/BackendIdor.ql
@@ -3,6 +3,7 @@
  * @description Finds cases where the 'userId' field in a request to another service
  *              is an arbitrary user-controlled value, indicating lack of authentication.
  * @kind path-problem
+ * @problem.severity error
  * @tags security
  * @id js/examples/backend-idor
  */
diff --git a/javascript/ql/examples/queries/dataflow/DecodingAfterSanitization/DecodingAfterSanitization.ql b/javascript/ql/examples/queries/dataflow/DecodingAfterSanitization/DecodingAfterSanitization.ql
index b8954582b62..d21cc4531fc 100644
--- a/javascript/ql/examples/queries/dataflow/DecodingAfterSanitization/DecodingAfterSanitization.ql
+++ b/javascript/ql/examples/queries/dataflow/DecodingAfterSanitization/DecodingAfterSanitization.ql
@@ -3,6 +3,7 @@
  * @description Tracks the return value of 'escapeHtml' into 'decodeURI', indicating
  *              an ineffective sanitization attempt.
  * @kind path-problem
+ * @problem.severity error
  * @tags security
  * @id js/examples/decoding-after-sanitization
  */
diff --git a/javascript/ql/examples/queries/dataflow/DecodingAfterSanitization/DecodingAfterSanitizationGeneralized.ql b/javascript/ql/examples/queries/dataflow/DecodingAfterSanitization/DecodingAfterSanitizationGeneralized.ql
index 69b4d9d3bd7..49ffd3bbed5 100644
--- a/javascript/ql/examples/queries/dataflow/DecodingAfterSanitization/DecodingAfterSanitizationGeneralized.ql
+++ b/javascript/ql/examples/queries/dataflow/DecodingAfterSanitization/DecodingAfterSanitizationGeneralized.ql
@@ -3,6 +3,7 @@
  * @description Tracks the return value of an HTML sanitizer into an escape-sequence decoder,
  *              indicating an ineffective sanitization attempt.
  * @kind path-problem
+ * @problem.severity error
  * @tags security
  * @id js/examples/decoding-after-sanitization-generalized
  */
diff --git a/javascript/ql/examples/queries/dataflow/EvalTaint/EvalTaint.ql b/javascript/ql/examples/queries/dataflow/EvalTaint/EvalTaint.ql
index 2668fd2c3b1..72208237445 100644
--- a/javascript/ql/examples/queries/dataflow/EvalTaint/EvalTaint.ql
+++ b/javascript/ql/examples/queries/dataflow/EvalTaint/EvalTaint.ql
@@ -2,6 +2,7 @@
  * @name Taint-tracking to 'eval' calls
  * @description Tracks user-controlled values into 'eval' calls (special case of js/code-injection).
  * @kind problem
+ * @problem.severity error
  * @tags security
  * @id js/examples/eval-taint
  */
diff --git a/javascript/ql/examples/queries/dataflow/EvalTaint/EvalTaintPath.ql b/javascript/ql/examples/queries/dataflow/EvalTaint/EvalTaintPath.ql
index e449c61073d..1b07ed151bd 100644
--- a/javascript/ql/examples/queries/dataflow/EvalTaint/EvalTaintPath.ql
+++ b/javascript/ql/examples/queries/dataflow/EvalTaint/EvalTaintPath.ql
@@ -3,6 +3,7 @@
  * @description Tracks user-controlled values into 'eval' calls (special case of js/code-injection),
  *              and generates a visualizable path from the source to the sink.
  * @kind path-problem
+ * @problem.severity error
  * @tags security
  * @id js/examples/eval-taint-path
  */
diff --git a/javascript/ql/examples/queries/dataflow/InformationDisclosure/InformationDisclosure.ql b/javascript/ql/examples/queries/dataflow/InformationDisclosure/InformationDisclosure.ql
index e279ff79782..07a942967b1 100644
--- a/javascript/ql/examples/queries/dataflow/InformationDisclosure/InformationDisclosure.ql
+++ b/javascript/ql/examples/queries/dataflow/InformationDisclosure/InformationDisclosure.ql
@@ -3,6 +3,7 @@
  * @description Tracks values from an 'authKey' property into a postMessage call with unrestricted origin,
  *              indicating a leak of sensitive information.
  * @kind path-problem
+ * @problem.severity warning
  * @tags security
  * @id js/examples/information-disclosure
  */
diff --git a/javascript/ql/examples/queries/dataflow/StoredXss/StoredXss.ql b/javascript/ql/examples/queries/dataflow/StoredXss/StoredXss.ql
index 2a00a49c020..86ecf59e673 100644
--- a/javascript/ql/examples/queries/dataflow/StoredXss/StoredXss.ql
+++ b/javascript/ql/examples/queries/dataflow/StoredXss/StoredXss.ql
@@ -2,6 +2,7 @@
  * @name Extension of standard query: Stored XSS
  * @description Extends the standard Stored XSS query with an additional source.
  * @kind path-problem
+ * @problem.severity error
  * @tags security
  * @id js/examples/stored-xss
  */
diff --git a/javascript/ql/examples/queries/dataflow/StoredXss/StoredXssTypeTracking.ql b/javascript/ql/examples/queries/dataflow/StoredXss/StoredXssTypeTracking.ql
index 340ae61f7f0..bca026cc2ae 100644
--- a/javascript/ql/examples/queries/dataflow/StoredXss/StoredXssTypeTracking.ql
+++ b/javascript/ql/examples/queries/dataflow/StoredXss/StoredXssTypeTracking.ql
@@ -3,6 +3,7 @@
  * @description Extends the standard Stored XSS query with an additional source,
  *              using TrackedNode to track MySQL connections globally.
  * @kind path-problem
+ * @problem.severity error
  * @tags security
  * @id js/examples/stored-xss-trackednode
  */
diff --git a/javascript/ql/examples/queries/dataflow/TemplateInjection/TemplateInjection.ql b/javascript/ql/examples/queries/dataflow/TemplateInjection/TemplateInjection.ql
index c15022adc62..2286fdc2121 100644
--- a/javascript/ql/examples/queries/dataflow/TemplateInjection/TemplateInjection.ql
+++ b/javascript/ql/examples/queries/dataflow/TemplateInjection/TemplateInjection.ql
@@ -2,6 +2,7 @@
  * @name Template injection
  * @description Tracks user-controlled values to an unescaped lodash template placeholder.
  * @kind path-problem
+ * @problem.severity error
  * @tags security
  * @id js/examples/template-injection
  */
diff --git a/javascript/ql/src/Comments/FCommentedOutCode.ql b/javascript/ql/src/Comments/FCommentedOutCode.ql
index a8364bb55fe..d18abda9648 100644
--- a/javascript/ql/src/Comments/FCommentedOutCode.ql
+++ b/javascript/ql/src/Comments/FCommentedOutCode.ql
@@ -5,7 +5,6 @@
  * @treemap.warnOn highValues
  * @metricType file
  * @metricAggregate avg sum max
- * @precision high
  * @id js/lines-of-commented-out-code-in-files
  * @tags maintainability
  */
diff --git a/javascript/ql/src/Declarations/UnusedVariable.ql b/javascript/ql/src/Declarations/UnusedVariable.ql
index 90c3948b634..73879557159 100644
--- a/javascript/ql/src/Declarations/UnusedVariable.ql
+++ b/javascript/ql/src/Declarations/UnusedVariable.ql
@@ -65,8 +65,8 @@ predicate isReactForJSX(UnusedLocal v) {
       v.getName() =
         tsconfig
             .getPropValue("compilerOptions")
-            .(JSONObject)
-            .getPropStringValue(["jsxFactory", "jsxFragmentFactory"])
+            .getPropValue(["jsxFactory", "jsxFragmentFactory"])
+            .getStringValue()
     )
   )
 }
diff --git a/javascript/ql/src/Metrics/Dependencies/ExternalDependencies.ql b/javascript/ql/src/Metrics/Dependencies/ExternalDependencies.ql
index d0d2782893a..b4bc082a8f9 100644
--- a/javascript/ql/src/Metrics/Dependencies/ExternalDependencies.ql
+++ b/javascript/ql/src/Metrics/Dependencies/ExternalDependencies.ql
@@ -6,7 +6,6 @@
  * @kind treemap
  * @treemap.warnOn highValues
  * @metricType externalDependency
- * @precision medium
  * @id js/external-dependencies
  */
 
diff --git a/javascript/ql/src/Metrics/FCommentRatio.ql b/javascript/ql/src/Metrics/FCommentRatio.ql
index cf0d4201c05..c87b78b05a6 100644
--- a/javascript/ql/src/Metrics/FCommentRatio.ql
+++ b/javascript/ql/src/Metrics/FCommentRatio.ql
@@ -5,7 +5,6 @@
  * @treemap.warnOn lowValues
  * @metricType file
  * @metricAggregate avg max
- * @precision very-high
  * @tags maintainability
  * @id js/comment-ratio-per-file
  */
diff --git a/javascript/ql/src/Metrics/FCyclomaticComplexity.ql b/javascript/ql/src/Metrics/FCyclomaticComplexity.ql
index 5c34a1919b7..220122e99bc 100644
--- a/javascript/ql/src/Metrics/FCyclomaticComplexity.ql
+++ b/javascript/ql/src/Metrics/FCyclomaticComplexity.ql
@@ -5,7 +5,6 @@
  * @treemap.warnOn highValues
  * @metricType file
  * @metricAggregate avg max
- * @precision very-high
  * @tags testability
  * @id js/cyclomatic-complexity-per-file
  */
diff --git a/javascript/ql/src/Metrics/FFunctions.ql b/javascript/ql/src/Metrics/FFunctions.ql
index d74cbcde7f3..6ca79978625 100644
--- a/javascript/ql/src/Metrics/FFunctions.ql
+++ b/javascript/ql/src/Metrics/FFunctions.ql
@@ -5,7 +5,6 @@
  * @treemap.warnOn highValues
  * @metricType file
  * @metricAggregate avg sum max
- * @precision very-high
  * @id js/functions-per-file
  */
 
diff --git a/javascript/ql/src/Metrics/FLines.ql b/javascript/ql/src/Metrics/FLines.ql
index 4fdd2ab9458..697e7d8dc78 100644
--- a/javascript/ql/src/Metrics/FLines.ql
+++ b/javascript/ql/src/Metrics/FLines.ql
@@ -5,7 +5,6 @@
  * @treemap.warnOn highValues
  * @metricType file
  * @metricAggregate avg sum max
- * @precision very-high
  * @id js/lines-per-file
  */
 
diff --git a/javascript/ql/src/Metrics/FLinesOfCode.ql b/javascript/ql/src/Metrics/FLinesOfCode.ql
index 52fb8447ef0..69165507f95 100644
--- a/javascript/ql/src/Metrics/FLinesOfCode.ql
+++ b/javascript/ql/src/Metrics/FLinesOfCode.ql
@@ -6,7 +6,6 @@
  * @treemap.warnOn highValues
  * @metricType file
  * @metricAggregate avg sum max
- * @precision very-high
  * @id js/lines-of-code-in-files
  * @tags maintainability
  */
diff --git a/javascript/ql/src/Metrics/FLinesOfComment.ql b/javascript/ql/src/Metrics/FLinesOfComment.ql
index 6eb8b1594c3..34e7ad23931 100644
--- a/javascript/ql/src/Metrics/FLinesOfComment.ql
+++ b/javascript/ql/src/Metrics/FLinesOfComment.ql
@@ -5,7 +5,6 @@
  * @treemap.warnOn lowValues
  * @metricType file
  * @metricAggregate avg sum max
- * @precision very-high
  * @id js/lines-of-comments-in-files
  * @tags documentation
  */
diff --git a/javascript/ql/src/Metrics/FLinesOfDuplicatedCode.ql b/javascript/ql/src/Metrics/FLinesOfDuplicatedCode.ql
index 59bb0b337fb..3789a0508f3 100644
--- a/javascript/ql/src/Metrics/FLinesOfDuplicatedCode.ql
+++ b/javascript/ql/src/Metrics/FLinesOfDuplicatedCode.ql
@@ -7,34 +7,14 @@
  * @treemap.warnOn highValues
  * @metricType file
  * @metricAggregate avg sum max
- * @precision high
  * @id js/duplicated-lines-in-files
  * @tags testability
  *       duplicate-code
  *       non-attributable
  */
 
-import external.CodeDuplication
-
-/**
- * Holds if line `l` of file `f` should be excluded from duplicated code detection.
- *
- * Currently, only lines on which an import declaration occurs are excluded.
- */
-predicate whitelistedLineForDuplication(File f, int l) {
-  exists(ImportDeclaration i | i.getFile() = f and i.getLocation().getStartLine() = l)
-}
-
-/**
- * Holds if line `l` of file `f` belongs to a block of lines that is duplicated somewhere else.
- */
-predicate dupLine(int l, File f) {
-  exists(DuplicateBlock d | d.sourceFile() = f |
-    l in [d.sourceStartLine() .. d.sourceEndLine()] and
-    not whitelistedLineForDuplication(f, l)
-  )
-}
+import javascript
 
 from File f, int n
-where n = count(int l | dupLine(l, f))
+where none()
 select f, n order by n desc
diff --git a/javascript/ql/src/Metrics/FLinesOfSimilarCode.ql b/javascript/ql/src/Metrics/FLinesOfSimilarCode.ql
index be6685af968..48e0b00449b 100644
--- a/javascript/ql/src/Metrics/FLinesOfSimilarCode.ql
+++ b/javascript/ql/src/Metrics/FLinesOfSimilarCode.ql
@@ -8,23 +8,14 @@
  * @treemap.warnOn highValues
  * @metricType file
  * @metricAggregate avg sum max
- * @precision high
  * @id js/similar-lines-in-files
  * @tags testability
  *       duplicate-code
  *       non-attributable
  */
 
-import external.CodeDuplication
-
-/**
- * Holds if line `l` of file `f` belong to a block of lines that is similar to a block
- * of lines appearing somewhere else.
- */
-predicate simLine(int l, File f) {
-  exists(SimilarBlock d | d.sourceFile() = f | l in [d.sourceStartLine() .. d.sourceEndLine()])
-}
+import javascript
 
 from File f, int n
-where n = count(int l | simLine(l, f))
+where none()
 select f, n order by n desc
diff --git a/javascript/ql/src/Metrics/FNumberOfStatements.ql b/javascript/ql/src/Metrics/FNumberOfStatements.ql
index 8346e46b72d..1eaa701ee4e 100644
--- a/javascript/ql/src/Metrics/FNumberOfStatements.ql
+++ b/javascript/ql/src/Metrics/FNumberOfStatements.ql
@@ -5,7 +5,6 @@
  * @treemap.warnOn highValues
  * @metricType file
  * @metricAggregate avg sum max
- * @precision very-high
  * @id js/statements-per-file
  */
 
diff --git a/javascript/ql/src/Metrics/FNumberOfTests.ql b/javascript/ql/src/Metrics/FNumberOfTests.ql
index df1ef983ddc..96e2c52ce19 100644
--- a/javascript/ql/src/Metrics/FNumberOfTests.ql
+++ b/javascript/ql/src/Metrics/FNumberOfTests.ql
@@ -5,7 +5,6 @@
  * @treemap.warnOn lowValues
  * @metricType file
  * @metricAggregate avg sum max
- * @precision medium
  * @id js/test-in-files
  */
 
diff --git a/javascript/ql/src/Metrics/FUseOfES6.ql b/javascript/ql/src/Metrics/FUseOfES6.ql
index 65bcfe84413..e683cc23629 100644
--- a/javascript/ql/src/Metrics/FUseOfES6.ql
+++ b/javascript/ql/src/Metrics/FUseOfES6.ql
@@ -6,7 +6,6 @@
  * @treemap.warnOn highValues
  * @metricType file
  * @metricAggregate avg sum max
- * @precision very-high
  * @id js/es20xx-features-per-file
  */
 
diff --git a/javascript/ql/src/Metrics/FunCyclomaticComplexity.ql b/javascript/ql/src/Metrics/FunCyclomaticComplexity.ql
index 8856f16d29a..12284dfb55c 100644
--- a/javascript/ql/src/Metrics/FunCyclomaticComplexity.ql
+++ b/javascript/ql/src/Metrics/FunCyclomaticComplexity.ql
@@ -5,7 +5,6 @@
  * @treemap.warnOn highValues
  * @metricType callable
  * @metricAggregate avg max sum
- * @precision very-high
  * @tags testability
  * @id js/cyclomatic-complexity-per-function
  */
diff --git a/javascript/ql/src/Metrics/FunLinesOfCode.ql b/javascript/ql/src/Metrics/FunLinesOfCode.ql
index 590ad76c765..5b3dc55cfea 100644
--- a/javascript/ql/src/Metrics/FunLinesOfCode.ql
+++ b/javascript/ql/src/Metrics/FunLinesOfCode.ql
@@ -5,7 +5,6 @@
  * @treemap.warnOn highValues
  * @metricType callable
  * @metricAggregate avg sum max
- * @precision very-high
  * @tags maintainability
  * @id js/lines-of-code-per-function
  */
diff --git a/javascript/ql/src/Security/CWE-078/UnsafeShellCommandConstruction.ql b/javascript/ql/src/Security/CWE-078/UnsafeShellCommandConstruction.ql
index f5d5113634d..1b4d5523ba4 100644
--- a/javascript/ql/src/Security/CWE-078/UnsafeShellCommandConstruction.ql
+++ b/javascript/ql/src/Security/CWE-078/UnsafeShellCommandConstruction.ql
@@ -18,6 +18,6 @@ import DataFlow::PathGraph
 
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink, Sink sinkNode
 where cfg.hasFlowPath(source, sink) and sinkNode = sink.getNode()
-select sinkNode.getAlertLocation(), source, sink, "$@ based on library input is later used in $@.",
-  sinkNode.getAlertLocation(), sinkNode.getSinkType(), sinkNode.getCommandExecution(),
-  "shell command"
+select sinkNode.getAlertLocation(), source, sink, "$@ based on $@ is later used in $@.",
+  sinkNode.getAlertLocation(), sinkNode.getSinkType(), source.getNode(), "library input",
+  sinkNode.getCommandExecution(), "shell command"
diff --git a/javascript/ql/src/Security/CWE-295/DisablingCertificateValidation.ql b/javascript/ql/src/Security/CWE-295/DisablingCertificateValidation.ql
index 6855ec2519d..f18ff4a3535 100644
--- a/javascript/ql/src/Security/CWE-295/DisablingCertificateValidation.ql
+++ b/javascript/ql/src/Security/CWE-295/DisablingCertificateValidation.ql
@@ -16,7 +16,7 @@ import javascript
  */
 DataFlow::ObjectLiteralNode tlsOptions() {
   exists(DataFlow::InvokeNode invk | result.flowsTo(invk.getAnArgument()) |
-    invk instanceof NodeJSLib::NodeJSClientRequest
+    invk instanceof ClientRequest
     or
     invk = DataFlow::moduleMember("https", "Agent").getAnInstantiation()
     or
diff --git a/javascript/ql/src/Security/CWE-327/BadRandomness.ql b/javascript/ql/src/Security/CWE-327/BadRandomness.ql
index 84f720571da..1168af1d448 100644
--- a/javascript/ql/src/Security/CWE-327/BadRandomness.ql
+++ b/javascript/ql/src/Security/CWE-327/BadRandomness.ql
@@ -87,11 +87,6 @@ private DataFlow::Node goodRandom(DataFlow::TypeTracker t, DataFlow::SourceNode
   or
   exists(DataFlow::TypeTracker t2 | t = t2.smallstep(goodRandom(t2, source), result))
   or
-  // re-using the collection steps for `Set`.
-  exists(DataFlow::TypeTracker t2 |
-    result = CollectionsTypeTracking::collectionStep(goodRandom(t2, source), t, t2)
-  )
-  or
   InsecureRandomness::isAdditionalTaintStep(goodRandom(t.continue(), source), result) and
   // bit shifts and multiplication by powers of two are generally used for constructing larger numbers from smaller numbers.
   not exists(BinaryExpr binop | binop = result.asExpr() |
diff --git a/javascript/ql/src/Summary/LinesOfCode.ql b/javascript/ql/src/Summary/LinesOfCode.ql
new file mode 100644
index 00000000000..9f89e0e2163
--- /dev/null
+++ b/javascript/ql/src/Summary/LinesOfCode.ql
@@ -0,0 +1,11 @@
+/**
+ * @id js/summary/lines-of-code
+ * @name Total lines of JavaScript and TypeScript code in the database
+ * @description The total number of lines of JavaScript or TypeScript code across all files checked into the repository, except in `node_modules`. This is a useful metric of the size of a database. For all files that were seen during extraction, this query counts the lines of code, excluding whitespace or comments.
+ * @kind metric
+ * @tags summary
+ */
+
+import javascript
+
+select sum(File f | not f.getATopLevel().isExterns() | f.getNumberOfLinesOfCode())
diff --git a/javascript/ql/src/experimental/Security/CWE-094/UntrustedCheckout.ql b/javascript/ql/src/experimental/Security/CWE-094/UntrustedCheckout.ql
index 62a0d743152..5227d433088 100644
--- a/javascript/ql/src/experimental/Security/CWE-094/UntrustedCheckout.ql
+++ b/javascript/ql/src/experimental/Security/CWE-094/UntrustedCheckout.ql
@@ -6,7 +6,7 @@
  * @kind problem
  * @problem.severity warning
  * @precision low
- * @id js/actions/pull_request_target
+ * @id js/actions/pull-request-target
  * @tags actions
  *       security
  *       external/cwe/cwe-094
diff --git a/javascript/ql/src/experimental/Summaries/ExtractFlowStepSummaries.ql b/javascript/ql/src/experimental/Summaries/ExtractFlowStepSummaries.ql
index 14f51f07646..36be3c03606 100644
--- a/javascript/ql/src/experimental/Summaries/ExtractFlowStepSummaries.ql
+++ b/javascript/ql/src/experimental/Summaries/ExtractFlowStepSummaries.ql
@@ -5,7 +5,7 @@
  *              user-controlled exit node of portal `p1` to an escaping entry node of portal `p2`,
  *              and have label `lbl2` at that point. Moreover, the path from `p1` to `p2` contains
  *              no sanitizers specified by configuration `cfg`.
- * @kind flow-step-summary
+ * @kind table
  * @id js/step-summary-extraction
  */
 
diff --git a/javascript/ql/src/experimental/Summaries/ExtractSinkSummaries.ql b/javascript/ql/src/experimental/Summaries/ExtractSinkSummaries.ql
index ddc1c950740..af998563be4 100644
--- a/javascript/ql/src/experimental/Summaries/ExtractSinkSummaries.ql
+++ b/javascript/ql/src/experimental/Summaries/ExtractSinkSummaries.ql
@@ -3,7 +3,7 @@
  * @description Extracts sink summaries, that is, tuples `(p, lbl, cfg)` representing the fact
  *              that data with flow label `lbl` may flow from a user-controlled exit node of portal
  *              `p` to a known sink for configuration `cfg`.
- * @kind sink-summary
+ * @kind table
  * @id js/sink-summary-extraction
  */
 
diff --git a/javascript/ql/src/experimental/Summaries/ExtractSourceSummaries.ql b/javascript/ql/src/experimental/Summaries/ExtractSourceSummaries.ql
index 86741b692b8..6e0b8e1c622 100644
--- a/javascript/ql/src/experimental/Summaries/ExtractSourceSummaries.ql
+++ b/javascript/ql/src/experimental/Summaries/ExtractSourceSummaries.ql
@@ -3,7 +3,7 @@
  * @description Extracts source summaries, that is, tuples `(p, lbl, cfg)` representing the fact
  *              that data may flow from a known source for configuration `cfg` to an escaping entry
  *              node of portal `p`, and have flow label `lbl` at that point.
- * @kind source-summary
+ * @kind table
  * @id js/source-summary-extraction
  */
 
diff --git a/javascript/ql/src/external/CodeDuplication.qll b/javascript/ql/src/external/CodeDuplication.qll
deleted file mode 100644
index bd9a0481a8a..00000000000
--- a/javascript/ql/src/external/CodeDuplication.qll
+++ /dev/null
@@ -1,367 +0,0 @@
-/** Provides classes for detecting duplicate or similar code. */
-
-import semmle.javascript.Files
-
-/** Gets the relative path of `file`, with backslashes replaced by forward slashes. */
-private string relativePath(File file) { result = file.getRelativePath().replaceAll("\\", "/") }
-
-/**
- * Holds if the `index`-th token of block `copy` is in file `file`, spanning
- * column `sc` of line `sl` to column `ec` of line `el`.
- *
- * For more information, see [Locations](https://help.semmle.com/QL/learn-ql/ql/locations.html).
- */
-pragma[noinline]
-private predicate tokenLocation(File file, int sl, int sc, int ec, int el, Copy copy, int index) {
-  file = copy.sourceFile() and
-  tokens(copy, index, sl, sc, ec, el)
-}
-
-/** A token block used for detection of duplicate and similar code. */
-class Copy extends @duplication_or_similarity {
-  /** Gets the index of the last token in this block. */
-  private int lastToken() { result = max(int i | tokens(this, i, _, _, _, _) | i) }
-
-  /** Gets the index of the token in this block starting at the location `loc`, if any. */
-  int tokenStartingAt(Location loc) {
-    tokenLocation(loc.getFile(), loc.getStartLine(), loc.getStartColumn(), _, _, this, result)
-  }
-
-  /** Gets the index of the token in this block ending at the location `loc`, if any. */
-  int tokenEndingAt(Location loc) {
-    tokenLocation(loc.getFile(), _, _, loc.getEndLine(), loc.getEndColumn(), this, result)
-  }
-
-  /** Gets the line on which the first token in this block starts. */
-  int sourceStartLine() { tokens(this, 0, result, _, _, _) }
-
-  /** Gets the column on which the first token in this block starts. */
-  int sourceStartColumn() { tokens(this, 0, _, result, _, _) }
-
-  /** Gets the line on which the last token in this block ends. */
-  int sourceEndLine() { tokens(this, this.lastToken(), _, _, result, _) }
-
-  /** Gets the column on which the last token in this block ends. */
-  int sourceEndColumn() { tokens(this, this.lastToken(), _, _, _, result) }
-
-  /** Gets the number of lines containing at least (part of) one token in this block. */
-  int sourceLines() { result = this.sourceEndLine() + 1 - this.sourceStartLine() }
-
-  /** Gets an opaque identifier for the equivalence class of this block. */
-  int getEquivalenceClass() { duplicateCode(this, _, result) or similarCode(this, _, result) }
-
-  /** Gets the source file in which this block appears. */
-  File sourceFile() {
-    exists(string name | duplicateCode(this, name, _) or similarCode(this, name, _) |
-      name.replaceAll("\\", "/") = relativePath(result)
-    )
-  }
-
-  /**
-   * Holds if this element is at the specified location.
-   * The location spans column `startcolumn` of line `startline` to
-   * column `endcolumn` of line `endline` in file `filepath`.
-   * For more information, see
-   * [Locations](https://help.semmle.com/QL/learn-ql/ql/locations.html).
-   */
-  predicate hasLocationInfo(
-    string filepath, int startline, int startcolumn, int endline, int endcolumn
-  ) {
-    sourceFile().getAbsolutePath() = filepath and
-    startline = sourceStartLine() and
-    startcolumn = sourceStartColumn() and
-    endline = sourceEndLine() and
-    endcolumn = sourceEndColumn()
-  }
-
-  /** Gets a textual representation of this element. */
-  string toString() { none() }
-
-  /**
-   * Gets a block that extends this one, that is, its first token is also
-   * covered by this block, but they are not the same block.
-   */
-  Copy extendingBlock() {
-    exists(File file, int sl, int sc, int ec, int el |
-      tokenLocation(file, sl, sc, ec, el, this, _) and
-      tokenLocation(file, sl, sc, ec, el, result, 0)
-    ) and
-    this != result
-  }
-}
-
-/**
- * Holds if there is a sequence of `SimilarBlock`s `start1, ..., end1` and another sequence
- * `start2, ..., end2` such that each block extends the previous one and corresponding blocks
- * have the same equivalence class, with `start` being the equivalence class of `start1` and
- * `start2`, and `end` the equivalence class of `end1` and `end2`.
- */
-predicate similar_extension(
-  SimilarBlock start1, SimilarBlock start2, SimilarBlock end1, SimilarBlock end2, int start, int end
-) {
-  start1.getEquivalenceClass() = start and
-  start2.getEquivalenceClass() = start and
-  end1.getEquivalenceClass() = end and
-  end2.getEquivalenceClass() = end and
-  start1 != start2 and
-  (
-    end1 = start1 and end2 = start2
-    or
-    similar_extension(start1.extendingBlock(), start2.extendingBlock(), end1, end2, _, end)
-  )
-}
-
-/**
- * Holds if there is a sequence of `DuplicateBlock`s `start1, ..., end1` and another sequence
- * `start2, ..., end2` such that each block extends the previous one and corresponding blocks
- * have the same equivalence class, with `start` being the equivalence class of `start1` and
- * `start2`, and `end` the equivalence class of `end1` and `end2`.
- */
-predicate duplicate_extension(
-  DuplicateBlock start1, DuplicateBlock start2, DuplicateBlock end1, DuplicateBlock end2, int start,
-  int end
-) {
-  start1.getEquivalenceClass() = start and
-  start2.getEquivalenceClass() = start and
-  end1.getEquivalenceClass() = end and
-  end2.getEquivalenceClass() = end and
-  start1 != start2 and
-  (
-    end1 = start1 and end2 = start2
-    or
-    duplicate_extension(start1.extendingBlock(), start2.extendingBlock(), end1, end2, _, end)
-  )
-}
-
-/** A block of duplicated code. */
-class DuplicateBlock extends Copy, @duplication {
-  override string toString() { result = "Duplicate code: " + sourceLines() + " duplicated lines." }
-}
-
-/** A block of similar code. */
-class SimilarBlock extends Copy, @similarity {
-  override string toString() {
-    result = "Similar code: " + sourceLines() + " almost duplicated lines."
-  }
-}
-
-/** Holds if statement `s` is in function or toplevel `sc`. */
-private predicate stmtInContainer(Stmt s, StmtContainer sc) {
-  s.getContainer() = sc and
-  not s instanceof BlockStmt
-}
-
-/**
- * Holds if `stmt1` and `stmt2` are duplicate statements in function or toplevel `sc1` and `sc2`,
- * respectively, where `sc1` and `sc2` are not the same.
- */
-predicate duplicateStatement(StmtContainer sc1, StmtContainer sc2, Stmt stmt1, Stmt stmt2) {
-  exists(int equivstart, int equivend, int first, int last |
-    stmtInContainer(stmt1, sc1) and
-    stmtInContainer(stmt2, sc2) and
-    duplicateCoversStatement(equivstart, equivend, first, last, stmt1) and
-    duplicateCoversStatement(equivstart, equivend, first, last, stmt2) and
-    stmt1 != stmt2 and
-    sc1 != sc2
-  )
-}
-
-/**
- * Holds if statement `stmt` is covered by a sequence of `DuplicateBlock`s, where `first`
- * is the index of the token in the first block that starts at the beginning of `stmt`,
- * while `last` is the index of the token in the last block that ends at the end of `stmt`,
- * and `equivstart` and `equivend` are the equivalence classes of the first and the last
- * block, respectively.
- */
-private predicate duplicateCoversStatement(
-  int equivstart, int equivend, int first, int last, Stmt stmt
-) {
-  exists(DuplicateBlock b1, DuplicateBlock b2, Location loc |
-    stmt.getLocation() = loc and
-    first = b1.tokenStartingAt(loc) and
-    last = b2.tokenEndingAt(loc) and
-    b1.getEquivalenceClass() = equivstart and
-    b2.getEquivalenceClass() = equivend and
-    duplicate_extension(b1, _, b2, _, equivstart, equivend)
-  )
-}
-
-/**
- * Holds if `sc1` is a function or toplevel with `total` lines, and `sc2` is a function or
- * toplevel that has `duplicate` lines in common with `sc1`.
- */
-private predicate duplicateStatements(StmtContainer sc1, StmtContainer sc2, int duplicate, int total) {
-  duplicate = strictcount(Stmt stmt | duplicateStatement(sc1, sc2, stmt, _)) and
-  total = strictcount(Stmt stmt | stmtInContainer(stmt, sc1))
-}
-
-/**
- * Holds if `sc` and `other` are functions or toplevels where `percent` is the percentage
- * of lines they have in common, which is greater than 90%.
- */
-predicate duplicateContainers(StmtContainer sc, StmtContainer other, float percent) {
-  exists(int total, int duplicate | duplicateStatements(sc, other, duplicate, total) |
-    percent = 100.0 * duplicate / total and
-    percent > 90.0
-  )
-}
-
-/**
- * Holds if `stmt1` and `stmt2` are similar statements in function or toplevel `sc1` and `sc2`,
- * respectively, where `sc1` and `sc2` are not the same.
- */
-private predicate similarStatement(StmtContainer sc1, StmtContainer sc2, Stmt stmt1, Stmt stmt2) {
-  exists(int start, int end, int first, int last |
-    stmtInContainer(stmt1, sc1) and
-    stmtInContainer(stmt2, sc2) and
-    similarCoversStatement(start, end, first, last, stmt1) and
-    similarCoversStatement(start, end, first, last, stmt2) and
-    stmt1 != stmt2 and
-    sc1 != sc2
-  )
-}
-
-/**
- * Holds if statement `stmt` is covered by a sequence of `SimilarBlock`s, where `first`
- * is the index of the token in the first block that starts at the beginning of `stmt`,
- * while `last` is the index of the token in the last block that ends at the end of `stmt`,
- * and `equivstart` and `equivend` are the equivalence classes of the first and the last
- * block, respectively.
- */
-private predicate similarCoversStatement(
-  int equivstart, int equivend, int first, int last, Stmt stmt
-) {
-  exists(SimilarBlock b1, SimilarBlock b2, Location loc |
-    stmt.getLocation() = loc and
-    first = b1.tokenStartingAt(loc) and
-    last = b2.tokenEndingAt(loc) and
-    b1.getEquivalenceClass() = equivstart and
-    b2.getEquivalenceClass() = equivend and
-    similar_extension(b1, _, b2, _, equivstart, equivend)
-  )
-}
-
-/**
- * Holds if `sc1` is a function or toplevel with `total` lines, and `sc2` is a function or
- * toplevel that has `similar` similar lines to `sc1`.
- */
-private predicate similarStatements(StmtContainer sc1, StmtContainer sc2, int similar, int total) {
-  similar = strictcount(Stmt stmt | similarStatement(sc1, sc2, stmt, _)) and
-  total = strictcount(Stmt stmt | stmtInContainer(stmt, sc1))
-}
-
-/**
- * Holds if `sc` and `other` are functions or toplevels where `percent` is the percentage
- * of similar lines between the two, which is greater than 90%.
- */
-predicate similarContainers(StmtContainer sc, StmtContainer other, float percent) {
-  exists(int total, int similar | similarStatements(sc, other, similar, total) |
-    percent = 100.0 * similar / total and
-    percent > 90.0
-  )
-}
-
-/**
- * INTERNAL: do not use.
- *
- * Holds if `line` in `f` is similar to a line somewhere else.
- */
-predicate similarLines(File f, int line) {
-  exists(SimilarBlock b | b.sourceFile() = f and line in [b.sourceStartLine() .. b.sourceEndLine()])
-}
-
-private predicate similarLinesPerEquivalenceClass(int equivClass, int lines, File f) {
-  lines =
-    strictsum(SimilarBlock b, int toSum |
-      (b.sourceFile() = f and b.getEquivalenceClass() = equivClass) and
-      toSum = b.sourceLines()
-    |
-      toSum
-    )
-}
-
-/** Holds if `coveredLines` lines of `f` are similar to lines in `otherFile`. */
-pragma[noopt]
-private predicate similarLinesCovered(File f, int coveredLines, File otherFile) {
-  exists(int numLines | numLines = f.getNumberOfLines() |
-    exists(int coveredApprox |
-      coveredApprox =
-        strictsum(int num |
-          exists(int equivClass |
-            similarLinesPerEquivalenceClass(equivClass, num, f) and
-            similarLinesPerEquivalenceClass(equivClass, num, otherFile) and
-            f != otherFile
-          )
-        ) and
-      exists(int n, int product | product = coveredApprox * 100 and n = product / numLines | n > 75)
-    ) and
-    exists(int notCovered |
-      notCovered = count(int j | j in [1 .. numLines] and not similarLines(f, j)) and
-      coveredLines = numLines - notCovered
-    )
-  )
-}
-
-/**
- * INTERNAL: do not use.
- *
- * Holds if `line` in `f` is duplicated by a line somewhere else.
- */
-predicate duplicateLines(File f, int line) {
-  exists(DuplicateBlock b |
-    b.sourceFile() = f and line in [b.sourceStartLine() .. b.sourceEndLine()]
-  )
-}
-
-private predicate duplicateLinesPerEquivalenceClass(int equivClass, int lines, File f) {
-  lines =
-    strictsum(DuplicateBlock b, int toSum |
-      (b.sourceFile() = f and b.getEquivalenceClass() = equivClass) and
-      toSum = b.sourceLines()
-    |
-      toSum
-    )
-}
-
-/** Holds if `coveredLines` lines of `f` are duplicates of lines in `otherFile`. */
-pragma[noopt]
-private predicate duplicateLinesCovered(File f, int coveredLines, File otherFile) {
-  exists(int numLines | numLines = f.getNumberOfLines() |
-    exists(int coveredApprox |
-      coveredApprox =
-        strictsum(int num |
-          exists(int equivClass |
-            duplicateLinesPerEquivalenceClass(equivClass, num, f) and
-            duplicateLinesPerEquivalenceClass(equivClass, num, otherFile) and
-            f != otherFile
-          )
-        ) and
-      exists(int n, int product | product = coveredApprox * 100 and n = product / numLines | n > 75)
-    ) and
-    exists(int notCovered |
-      notCovered = count(int j | j in [1 .. numLines] and not duplicateLines(f, j)) and
-      coveredLines = numLines - notCovered
-    )
-  )
-}
-
-/** Holds if most of `f` (`percent`%) is similar to `other`. */
-predicate similarFiles(File f, File other, int percent) {
-  exists(int covered, int total |
-    similarLinesCovered(f, covered, other) and
-    total = f.getNumberOfLines() and
-    covered * 100 / total = percent and
-    percent > 80
-  ) and
-  not duplicateFiles(f, other, _)
-}
-
-/** Holds if most of `f` (`percent`%) is duplicated by `other`. */
-predicate duplicateFiles(File f, File other, int percent) {
-  exists(int covered, int total |
-    duplicateLinesCovered(f, covered, other) and
-    total = f.getNumberOfLines() and
-    covered * 100 / total = percent and
-    percent > 70
-  )
-}
diff --git a/javascript/ql/src/external/DuplicateFunction.ql b/javascript/ql/src/external/DuplicateFunction.ql
index a59741a3670..91468f85d95 100644
--- a/javascript/ql/src/external/DuplicateFunction.ql
+++ b/javascript/ql/src/external/DuplicateFunction.ql
@@ -16,15 +16,10 @@
  */
 
 import javascript
-import CodeDuplication
 import semmle.javascript.RestrictedLocations
 
 from Function f, Function g, float percent
-where
-  duplicateContainers(f, g, percent) and
-  f.getNumBodyStmt() > 5 and
-  not duplicateContainers(f.getEnclosingStmt().getContainer(), g.getEnclosingStmt().getContainer(),
-    _)
+where none()
 select f.(FirstLineOf),
   percent.floor() + "% of statements in " + f.describe() + " are duplicated in $@.",
   g.(FirstLineOf), g.describe()
diff --git a/javascript/ql/src/external/DuplicateToplevel.ql b/javascript/ql/src/external/DuplicateToplevel.ql
index 07d0c5a3d87..160617ea87b 100644
--- a/javascript/ql/src/external/DuplicateToplevel.ql
+++ b/javascript/ql/src/external/DuplicateToplevel.ql
@@ -16,12 +16,9 @@
  */
 
 import javascript
-import CodeDuplication
 import semmle.javascript.RestrictedLocations
 
 from TopLevel one, TopLevel another, float percent
-where
-  duplicateContainers(one, another, percent) and
-  one.getNumLines() > 5
+where none()
 select one.(FirstLineOf), percent.floor() + "% of statements in this script are duplicated in $@.",
   another.(FirstLineOf), "another script"
diff --git a/javascript/ql/src/external/SimilarFunction.ql b/javascript/ql/src/external/SimilarFunction.ql
index 13437dffc54..c946899a87d 100644
--- a/javascript/ql/src/external/SimilarFunction.ql
+++ b/javascript/ql/src/external/SimilarFunction.ql
@@ -16,16 +16,10 @@
  */
 
 import javascript
-import CodeDuplication
 import semmle.javascript.RestrictedLocations
 
 from Function f, Function g, float percent
-where
-  similarContainers(f, g, percent) and
-  f.getNumBodyStmt() > 5 and
-  not duplicateContainers(f, g, _) and
-  not duplicateContainers(f.getEnclosingStmt().getContainer(), g.getEnclosingStmt().getContainer(),
-    _)
+where none()
 select f.(FirstLineOf),
   percent.floor() + "% of statements in " + f.describe() + " are similar to statements in $@.",
   g.(FirstLineOf), g.describe()
diff --git a/javascript/ql/src/external/SimilarToplevel.ql b/javascript/ql/src/external/SimilarToplevel.ql
index c9cbba38be0..aa8d5b36dbe 100644
--- a/javascript/ql/src/external/SimilarToplevel.ql
+++ b/javascript/ql/src/external/SimilarToplevel.ql
@@ -16,14 +16,10 @@
  */
 
 import javascript
-import CodeDuplication
 import semmle.javascript.RestrictedLocations
 
 from TopLevel one, TopLevel another, float percent
-where
-  similarContainers(one, another, percent) and
-  one.getNumChildStmt() > 5 and
-  not duplicateContainers(one, another, _)
+where none()
 select one.(FirstLineOf),
   percent.floor() + "% of statements in this script are similar to statements in $@.",
   another.(FirstLineOf), "another script"
diff --git a/javascript/ql/src/filters/FilterFrameworks.ql b/javascript/ql/src/filters/FilterFrameworks.ql
deleted file mode 100644
index ba21a3f596b..00000000000
--- a/javascript/ql/src/filters/FilterFrameworks.ql
+++ /dev/null
@@ -1,14 +0,0 @@
-/**
- * @name Filter out framework code
- * @description Only keep results in non-framework code
- * @kind problem
- * @problem.severity warning
- * @id js/not-framework-file-filter
- */
-
-import FilterFrameworks
-import external.DefectFilter
-
-from DefectResult defres
-where nonFrameworkFile(defres.getFile())
-select defres, defres.getMessage()
diff --git a/javascript/ql/src/filters/FilterFrameworks.qll b/javascript/ql/src/filters/FilterFrameworks.qll
deleted file mode 100644
index d2e94305a94..00000000000
--- a/javascript/ql/src/filters/FilterFrameworks.qll
+++ /dev/null
@@ -1,7 +0,0 @@
-import semmle.javascript.dependencies.FrameworkLibraries
-
-/**
- * Holds if file `f` does not contain a framework library.
- */
-pragma[nomagic]
-predicate nonFrameworkFile(File f) { not exists(FrameworkLibraryInstance fl | fl.getFile() = f) }
diff --git a/javascript/ql/src/filters/FilterFrameworksForMetric.ql b/javascript/ql/src/filters/FilterFrameworksForMetric.ql
deleted file mode 100644
index 5c65e055614..00000000000
--- a/javascript/ql/src/filters/FilterFrameworksForMetric.ql
+++ /dev/null
@@ -1,14 +0,0 @@
-/**
- * @name Filter out framework code
- * @description Only keep results in non-framework code
- * @kind treemap
- * @id js/not-framework-file-metric-filter
- * @metricType file
- */
-
-import FilterFrameworks
-import external.MetricFilter
-
-from MetricResult res
-where nonFrameworkFile(res.getFile())
-select res, res.getValue()
diff --git a/javascript/ql/src/filters/FilterGenerated.ql b/javascript/ql/src/filters/FilterGenerated.ql
deleted file mode 100644
index 5fe34572f31..00000000000
--- a/javascript/ql/src/filters/FilterGenerated.ql
+++ /dev/null
@@ -1,15 +0,0 @@
-/**
- * @name Filter out generated files
- * @description Only keep results from files that do not look like they are minified,
- *              generated by a module bundler or by Emscripten, or contain a source
- *              mapping comment.
- * @kind problem
- * @id js/not-generated-file-filter
- */
-
-import semmle.javascript.GeneratedCode
-import external.DefectFilter
-
-from DefectResult defres
-where not isGeneratedCode(defres.getFile())
-select defres, defres.getMessage()
diff --git a/javascript/ql/src/filters/FilterGeneratedForMetric.ql b/javascript/ql/src/filters/FilterGeneratedForMetric.ql
deleted file mode 100644
index 71f5026de39..00000000000
--- a/javascript/ql/src/filters/FilterGeneratedForMetric.ql
+++ /dev/null
@@ -1,16 +0,0 @@
-/**
- * @name Filter out generated files
- * @description Only keep results from files that do not look like they are minified,
- *              generated by a module bundler or by Emscripten, or contain a source
- *              mapping comment.
- * @kind treemap
- * @id js/not-generated-file-metric-filter
- * @metricType file
- */
-
-import semmle.javascript.GeneratedCode
-import external.MetricFilter
-
-from MetricResult res
-where not isGeneratedCode(res.getFile())
-select res, res.getValue()
diff --git a/javascript/ql/src/filters/FilterMinified.ql b/javascript/ql/src/filters/FilterMinified.ql
deleted file mode 100644
index 8eff17ba7dc..00000000000
--- a/javascript/ql/src/filters/FilterMinified.ql
+++ /dev/null
@@ -1,13 +0,0 @@
-/**
- * @name Filter out minified files
- * @description Only keep results from files that are not minified.
- * @kind problem
- * @id js/not-minified-file-filter
- */
-
-import javascript
-import external.DefectFilter
-
-from DefectResult defres
-where not defres.getFile().getATopLevel().isMinified()
-select defres, defres.getMessage()
diff --git a/javascript/ql/src/filters/FilterMinifiedForMetric.ql b/javascript/ql/src/filters/FilterMinifiedForMetric.ql
deleted file mode 100644
index 002e0b86c54..00000000000
--- a/javascript/ql/src/filters/FilterMinifiedForMetric.ql
+++ /dev/null
@@ -1,14 +0,0 @@
-/**
- * @name Filter out minified files
- * @description Only keep results from files that are not minified.
- * @kind treemap
- * @id js/not-minified-file-metric-filter
- * @metricType file
- */
-
-import javascript
-import external.MetricFilter
-
-from MetricResult res
-where not res.getFile().getATopLevel().isMinified()
-select res, res.getValue()
diff --git a/javascript/ql/src/javascript.qll b/javascript/ql/src/javascript.qll
index b3664fce00e..b565a7cd21f 100644
--- a/javascript/ql/src/javascript.qll
+++ b/javascript/ql/src/javascript.qll
@@ -102,8 +102,10 @@ import semmle.javascript.frameworks.Next
 import semmle.javascript.frameworks.NoSQL
 import semmle.javascript.frameworks.PkgCloud
 import semmle.javascript.frameworks.PropertyProjection
+import semmle.javascript.frameworks.Puppeteer
 import semmle.javascript.frameworks.React
 import semmle.javascript.frameworks.ReactNative
+import semmle.javascript.frameworks.Redux
 import semmle.javascript.frameworks.Request
 import semmle.javascript.frameworks.RxJS
 import semmle.javascript.frameworks.ServerLess
diff --git a/javascript/ql/src/meta/Consistency.ql b/javascript/ql/src/meta/Consistency.ql
index 61ee64b035f..b87c256f609 100644
--- a/javascript/ql/src/meta/Consistency.ql
+++ b/javascript/ql/src/meta/Consistency.ql
@@ -4,7 +4,6 @@
  *              in the documentation, queries that rely on the contract may yield unexpected
  *              results.
  * @kind table
- * @problem.severity error
  * @id js/consistency/api-contracts
  * @tags consistency
  */
diff --git a/javascript/ql/src/meta/alerts/CallGraph.ql b/javascript/ql/src/meta/alerts/CallGraph.ql
index ea86e7b474a..364d81e32c9 100644
--- a/javascript/ql/src/meta/alerts/CallGraph.ql
+++ b/javascript/ql/src/meta/alerts/CallGraph.ql
@@ -10,6 +10,9 @@
 
 import javascript
 
-from DataFlow::InvokeNode invoke, Function f
-where invoke.getACallee() = f
-select invoke, "Call to $@", f, f.describe()
+from DataFlow::Node invoke, Function f, string kind
+where
+  invoke.(DataFlow::InvokeNode).getACallee() = f and kind = "Call"
+  or
+  invoke.(DataFlow::PropRef).getAnAccessorCallee().getFunction() = f and kind = "Accessor call"
+select invoke, kind + " to $@", f, f.describe()
diff --git a/javascript/ql/src/meta/alerts/ImportGraph.ql b/javascript/ql/src/meta/alerts/ImportGraph.ql
new file mode 100644
index 00000000000..66173389bd2
--- /dev/null
+++ b/javascript/ql/src/meta/alerts/ImportGraph.ql
@@ -0,0 +1,15 @@
+/**
+ * @name Import graph
+ * @description An edge in the import graph.
+ * @kind problem
+ * @problem.severity recommendation
+ * @id js/meta/alerts/import-graph
+ * @tags meta
+ * @precision very-low
+ */
+
+import javascript
+
+from Import imprt, Module target
+where target = imprt.getImportedModule()
+select imprt, "Import targeting $@", target, target.getFile().getRelativePath()
diff --git a/javascript/ql/src/meta/analysis-quality/TaintSteps.ql b/javascript/ql/src/meta/analysis-quality/TaintSteps.ql
index 0d136b111b8..be16675f849 100644
--- a/javascript/ql/src/meta/analysis-quality/TaintSteps.ql
+++ b/javascript/ql/src/meta/analysis-quality/TaintSteps.ql
@@ -15,17 +15,17 @@ predicate relevantStep(DataFlow::Node pred, DataFlow::Node succ) {
   (
     TaintTracking::sharedTaintStep(pred, succ)
     or
-    any(DataFlow::AdditionalFlowStep cfg).step(pred, succ)
+    DataFlow::SharedFlowStep::step(pred, succ)
     or
-    any(DataFlow::AdditionalFlowStep cfg).step(pred, succ, _, _)
+    DataFlow::SharedFlowStep::step(pred, succ, _, _)
     or
-    any(DataFlow::AdditionalFlowStep cfg).loadStep(pred, succ, _)
+    DataFlow::SharedFlowStep::loadStep(pred, succ, _)
     or
-    any(DataFlow::AdditionalFlowStep cfg).storeStep(pred, succ, _)
+    DataFlow::SharedFlowStep::storeStep(pred, succ, _)
     or
-    any(DataFlow::AdditionalFlowStep cfg).loadStoreStep(pred, succ, _, _)
+    DataFlow::SharedFlowStep::loadStoreStep(pred, succ, _, _)
     or
-    any(DataFlow::AdditionalFlowStep cfg).loadStoreStep(pred, succ, _)
+    DataFlow::SharedFlowStep::loadStoreStep(pred, succ, _)
   ) and
   not pred.getFile() instanceof IgnoredFile and
   not succ.getFile() instanceof IgnoredFile
diff --git a/javascript/ql/src/semmle/javascript/ApiGraphs.qll b/javascript/ql/src/semmle/javascript/ApiGraphs.qll
index 6c8c9533557..385dc1e76d3 100644
--- a/javascript/ql/src/semmle/javascript/ApiGraphs.qll
+++ b/javascript/ql/src/semmle/javascript/ApiGraphs.qll
@@ -313,10 +313,7 @@ module API {
   module Node {
     /** Gets a node whose type has the given qualified name. */
     Node ofType(string moduleName, string exportedName) {
-      exists(TypeName tn |
-        tn.hasQualifiedName(moduleName, exportedName) and
-        result = Impl::MkCanonicalNameUse(tn).(Node).getInstance()
-      )
+      result = Impl::MkTypeUse(moduleName, exportedName).(Node).getInstance()
     }
   }
 
@@ -377,13 +374,13 @@ module API {
             exists(SSA::implicitInit([nm.getModuleVariable(), nm.getExportsVariable()]))
           )
         )
-        or
-        m = any(CanonicalName n | isDefined(n)).getExternalModuleName()
       } or
       MkModuleImport(string m) {
         imports(_, m)
         or
-        m = any(CanonicalName n | isUsed(n)).getExternalModuleName()
+        any(TypeAnnotation n).hasQualifiedName(m, _)
+        or
+        any(Type t).hasUnderlyingType(m, _)
       } or
       MkClassInstance(DataFlow::ClassNode cls) { cls = trackDefNode(_) and hasSemantics(cls) } or
       MkAsyncFuncResult(DataFlow::FunctionNode f) {
@@ -391,27 +388,11 @@ module API {
       } or
       MkDef(DataFlow::Node nd) { rhs(_, _, nd) } or
       MkUse(DataFlow::Node nd) { use(_, _, nd) } or
-      /**
-       * A TypeScript canonical name that is defined somewhere, and that isn't a module root.
-       * (Module roots are represented by `MkModuleExport` nodes instead.)
-       *
-       * For most purposes, you probably want to use the `mkCanonicalNameDef` predicate instead of
-       * this constructor.
-       */
-      MkCanonicalNameDef(CanonicalName n) {
-        not n.isRoot() and
-        isDefined(n)
-      } or
-      /**
-       * A TypeScript canonical name that is used somewhere, and that isn't a module root.
-       * (Module roots are represented by `MkModuleImport` nodes instead.)
-       *
-       * For most purposes, you probably want to use the `mkCanonicalNameUse` predicate instead of
-       * this constructor.
-       */
-      MkCanonicalNameUse(CanonicalName n) {
-        not n.isRoot() and
-        isUsed(n)
+      /** A use of a TypeScript type. */
+      MkTypeUse(string moduleName, string exportName) {
+        any(TypeAnnotation n).hasQualifiedName(moduleName, exportName)
+        or
+        any(Type t).hasUnderlyingType(moduleName, exportName)
       } or
       MkSyntheticCallbackArg(DataFlow::Node src, int bound, DataFlow::InvokeNode nd) {
         trackUseNode(src, true, bound).flowsTo(nd.getCalleeNode())
@@ -420,10 +401,9 @@ module API {
     class TDef = MkModuleDef or TNonModuleDef;
 
     class TNonModuleDef =
-      MkModuleExport or MkClassInstance or MkAsyncFuncResult or MkDef or MkCanonicalNameDef or
-          MkSyntheticCallbackArg;
+      MkModuleExport or MkClassInstance or MkAsyncFuncResult or MkDef or MkSyntheticCallbackArg;
 
-    class TUse = MkModuleUse or MkModuleImport or MkUse or MkCanonicalNameUse;
+    class TUse = MkModuleUse or MkModuleImport or MkUse or MkTypeUse;
 
     private predicate hasSemantics(DataFlow::Node nd) { not nd.getTopLevel().isExterns() }
 
@@ -446,34 +426,6 @@ module API {
       )
     }
 
-    private predicate isUsed(CanonicalName n) {
-      exists(n.(TypeName).getAnAccess()) or
-      exists(n.(Namespace).getAnAccess())
-    }
-
-    private predicate isDefined(CanonicalName n) {
-      exists(ASTNode def |
-        def = n.(TypeName).getADefinition() or
-        def = n.(Namespace).getADefinition()
-      |
-        not def.isAmbient()
-      )
-    }
-
-    /** An API-graph node representing definitions of the canonical name `cn`. */
-    private TApiNode mkCanonicalNameDef(CanonicalName cn) {
-      if cn.isModuleRoot()
-      then result = MkModuleExport(cn.getExternalModuleName())
-      else result = MkCanonicalNameDef(cn)
-    }
-
-    /** An API-graph node representing uses of the canonical name `cn`. */
-    private TApiNode mkCanonicalNameUse(CanonicalName cn) {
-      if cn.isModuleRoot()
-      then result = MkModuleImport(cn.getExternalModuleName())
-      else result = MkCanonicalNameUse(cn)
-    }
-
     /**
      * Holds if `rhs` is the right-hand side of a definition of a node that should have an
      * incoming edge from `base` labeled `lbl` in the API graph.
@@ -577,11 +529,6 @@ module API {
       exists(string m | nd = MkModuleExport(m) | exports(m, rhs))
       or
       nd = MkDef(rhs)
-      or
-      exists(CanonicalName n | nd = MkCanonicalNameDef(n) |
-        rhs = n.(Namespace).getADefinition().flow() or
-        rhs = n.(CanonicalFunctionName).getADefinition().flow()
-      )
     }
 
     /**
@@ -633,10 +580,10 @@ module API {
           ref = cls.getConstructor().getParameter(i)
         )
         or
-        exists(TypeName tn |
-          base = MkCanonicalNameUse(tn) and
+        exists(string moduleName, string exportName |
+          base = MkTypeUse(moduleName, exportName) and
           lbl = Label::instance() and
-          ref = getANodeWithType(tn)
+          ref.(DataFlow::SourceNode).hasUnderlyingType(moduleName, exportName)
         )
         or
         exists(DataFlow::InvokeNode call |
@@ -653,11 +600,11 @@ module API {
     cached
     predicate use(TApiNode nd, DataFlow::Node ref) {
       exists(string m, Module mod | nd = MkModuleDef(m) and mod = importableModule(m) |
-        ref.(ModuleAsSourceNode).getModule() = mod
+        ref.(ModuleVarNode).getModule() = mod
       )
       or
       exists(string m, Module mod | nd = MkModuleExport(m) and mod = importableModule(m) |
-        ref.(ExportsAsSourceNode).getModule() = mod
+        ref.(ExportsVarNode).getModule() = mod
         or
         exists(DataFlow::Node base | use(MkModuleDef(m), base) |
           ref = trackUseNode(base).getAPropertyRead("exports")
@@ -676,8 +623,6 @@ module API {
       )
       or
       nd = MkUse(ref)
-      or
-      exists(CanonicalName n | nd = MkCanonicalNameUse(n) | ref.asExpr() = n.getAnAccess())
     }
 
     /** Holds if module `m` exports `rhs`. */
@@ -782,9 +727,9 @@ module API {
       or
       // additional backwards step from `require('m')` to `exports` or `module.exports` in m
       exists(Import imp | imp.getImportedModuleNode() = trackDefNode(nd, t.continue()) |
-        result.(ExportsAsSourceNode).getModule() = imp.getImportedModule()
+        result.(ExportsVarNode).getModule() = imp.getImportedModule()
         or
-        exists(ModuleAsSourceNode mod |
+        exists(ModuleVarNode mod |
           mod.getModule() = imp.getImportedModule() and
           result = mod.(DataFlow::SourceNode).getAPropertyRead("exports")
         )
@@ -832,13 +777,6 @@ module API {
       result = awaited(call, DataFlow::TypeTracker::end())
     }
 
-    private DataFlow::SourceNode getANodeWithType(TypeName tn) {
-      exists(string moduleName, string typeName |
-        tn.hasQualifiedName(moduleName, typeName) and
-        result.hasUnderlyingType(moduleName, typeName)
-      )
-    }
-
     /**
      * Holds if there is an edge from `pred` to `succ` in the API graph that is labeled with `lbl`.
      */
@@ -879,11 +817,10 @@ module API {
         succ = MkClassInstance(trackDefNode(def))
       )
       or
-      exists(CanonicalName cn1, string n, CanonicalName cn2 |
-        pred in [mkCanonicalNameDef(cn1), mkCanonicalNameUse(cn1)] and
-        cn2 = cn1.getChild(n) and
-        lbl = Label::member(n) and
-        succ in [mkCanonicalNameDef(cn2), mkCanonicalNameUse(cn2)]
+      exists(string moduleName, string exportName |
+        pred = MkModuleImport(moduleName) and
+        lbl = Label::member(exportName) and
+        succ = MkTypeUse(moduleName, exportName)
       )
       or
       exists(DataFlow::Node nd, DataFlow::FunctionNode f |
@@ -987,7 +924,7 @@ private module Label {
       result = member(pn) and
       // only consider properties with alphanumeric(-ish) names, excluding special properties
       // and properties whose names look like they are meant to be internal
-      pn.regexpMatch("(?!prototype$|__)[a-zA-Z_$][\\w\\-.$]*")
+      pn.regexpMatch("(?!prototype$|__)[\\w_$][\\w\\-.$]*")
     )
     or
     not exists(pr.getPropertyName()) and
@@ -1027,31 +964,44 @@ private module Label {
   string promised() { result = "promised" }
 }
 
+private class NodeModuleSourcesNodes extends DataFlow::SourceNode::Range {
+  Variable v;
+
+  NodeModuleSourcesNodes() {
+    exists(NodeModule m |
+      this = DataFlow::ssaDefinitionNode(SSA::implicitInit(v)) and
+      v = [m.getModuleVariable(), m.getExportsVariable()]
+    )
+  }
+
+  Variable getVariable() { result = v }
+}
+
 /**
- * A CommonJS/AMD `module` variable, considered as a source node.
+ * A CommonJS/AMD `module` variable.
  */
-private class ModuleAsSourceNode extends DataFlow::SourceNode::Range {
+private class ModuleVarNode extends DataFlow::Node {
   Module m;
 
-  ModuleAsSourceNode() {
-    this = DataFlow::ssaDefinitionNode(SSA::implicitInit(m.(NodeModule).getModuleVariable()))
+  ModuleVarNode() {
+    this.(NodeModuleSourcesNodes).getVariable() = m.(NodeModule).getModuleVariable()
     or
-    this = DataFlow::parameterNode(m.(AmdModule).getDefine().getModuleParameter())
+    DataFlow::parameterNode(this, m.(AmdModule).getDefine().getModuleParameter())
   }
 
   Module getModule() { result = m }
 }
 
 /**
- * A CommonJS/AMD `exports` variable, considered as a source node.
+ * A CommonJS/AMD `exports` variable.
  */
-private class ExportsAsSourceNode extends DataFlow::SourceNode::Range {
+private class ExportsVarNode extends DataFlow::Node {
   Module m;
 
-  ExportsAsSourceNode() {
-    this = DataFlow::ssaDefinitionNode(SSA::implicitInit(m.(NodeModule).getExportsVariable()))
+  ExportsVarNode() {
+    this.(NodeModuleSourcesNodes).getVariable() = m.(NodeModule).getExportsVariable()
     or
-    this = DataFlow::parameterNode(m.(AmdModule).getDefine().getExportsParameter())
+    DataFlow::parameterNode(this, m.(AmdModule).getDefine().getExportsParameter())
   }
 
   Module getModule() { result = m }
diff --git a/javascript/ql/src/semmle/javascript/Arrays.qll b/javascript/ql/src/semmle/javascript/Arrays.qll
index a61ff57475e..e33d62437ba 100644
--- a/javascript/ql/src/semmle/javascript/Arrays.qll
+++ b/javascript/ql/src/semmle/javascript/Arrays.qll
@@ -84,16 +84,17 @@ private module ArrayDataFlow {
    * A step modelling the creation of an Array using the `Array.from(x)` method.
    * The step copies the elements of the argument (set, array, or iterator elements) into the resulting array.
    */
-  private class ArrayFrom extends DataFlow::AdditionalFlowStep, DataFlow::CallNode {
-    ArrayFrom() { this = DataFlow::globalVarRef("Array").getAMemberCall("from") }
-
+  private class ArrayFrom extends DataFlow::SharedFlowStep {
     override predicate loadStoreStep(
       DataFlow::Node pred, DataFlow::Node succ, string fromProp, string toProp
     ) {
-      pred = this.getArgument(0) and
-      succ = this and
-      fromProp = arrayLikeElement() and
-      toProp = arrayElement()
+      exists(DataFlow::CallNode call |
+        call = DataFlow::globalVarRef("Array").getAMemberCall("from") and
+        pred = call.getArgument(0) and
+        succ = call and
+        fromProp = arrayLikeElement() and
+        toProp = arrayElement()
+      )
     }
   }
 
@@ -103,55 +104,45 @@ private module ArrayDataFlow {
    *
    * Such a step can occur both with the `push` and `unshift` methods, or when creating a new array.
    */
-  private class ArrayCopySpread extends DataFlow::AdditionalFlowStep {
-    DataFlow::Node spreadArgument; // the spread argument containing the elements to be copied.
-    DataFlow::Node base; // the object where the elements should be copied to.
-
-    ArrayCopySpread() {
-      exists(DataFlow::MethodCallNode mcn | mcn = this |
-        mcn.getMethodName() = ["push", "unshift"] and
-        spreadArgument = mcn.getASpreadArgument() and
-        base = mcn.getReceiver().getALocalSource()
-      )
-      or
-      spreadArgument = this.(DataFlow::ArrayCreationNode).getASpreadArgument() and
-      base = this
-    }
-
+  private class ArrayCopySpread extends DataFlow::SharedFlowStep {
     override predicate loadStoreStep(
       DataFlow::Node pred, DataFlow::Node succ, string fromProp, string toProp
     ) {
-      pred = spreadArgument and
-      succ = base and
       fromProp = arrayLikeElement() and
-      toProp = arrayElement()
+      toProp = arrayElement() and
+      (
+        exists(DataFlow::MethodCallNode mcn |
+          mcn.getMethodName() = ["push", "unshift"] and
+          pred = mcn.getASpreadArgument() and
+          succ = mcn.getReceiver().getALocalSource()
+        )
+        or
+        pred = succ.(DataFlow::ArrayCreationNode).getASpreadArgument()
+      )
     }
   }
 
   /**
    * A step for storing an element on an array using `arr.push(e)` or `arr.unshift(e)`.
    */
-  private class ArrayAppendStep extends DataFlow::AdditionalFlowStep, DataFlow::MethodCallNode {
-    ArrayAppendStep() {
-      this.getMethodName() = "push" or
-      this.getMethodName() = "unshift"
-    }
-
+  private class ArrayAppendStep extends DataFlow::SharedFlowStep {
     override predicate storeStep(DataFlow::Node element, DataFlow::SourceNode obj, string prop) {
       prop = arrayElement() and
-      element = this.getAnArgument() and
-      obj.getAMethodCall() = this
+      exists(DataFlow::MethodCallNode call |
+        call.getMethodName() = ["push", "unshift"] and
+        element = call.getAnArgument() and
+        obj.getAMethodCall() = call
+      )
     }
   }
 
   /**
-   * A step for reading/writing an element from an array inside a for-loop.
-   * E.g. a read from `foo[i]` to `bar` in `for(var i = 0; i < arr.length; i++) {bar = foo[i]}`.
+   * A node that reads or writes an element from an array inside a for-loop.
    */
-  private class ArrayIndexingStep extends DataFlow::AdditionalFlowStep, DataFlow::Node {
+  private class ArrayIndexingAccess extends DataFlow::Node {
     DataFlow::PropRef read;
 
-    ArrayIndexingStep() {
+    ArrayIndexingAccess() {
       read = this and
       TTNumber() =
         unique(InferredType type | type = read.getPropertyNameExpr().flow().analyze().getAType()) and
@@ -162,17 +153,27 @@ private module ArrayDataFlow {
         i.getVariable().getADefinition().(VariableDeclarator).getDeclStmt() = init
       )
     }
+  }
 
+  /**
+   * A step for reading/writing an element from an array inside a for-loop.
+   * E.g. a read from `foo[i]` to `bar` in `for(var i = 0; i < arr.length; i++) {bar = foo[i]}`.
+   */
+  private class ArrayIndexingStep extends DataFlow::SharedFlowStep {
     override predicate loadStep(DataFlow::Node obj, DataFlow::Node element, string prop) {
-      prop = arrayElement() and
-      obj = this.(DataFlow::PropRead).getBase() and
-      element = this
+      exists(ArrayIndexingAccess access |
+        prop = arrayElement() and
+        obj = access.(DataFlow::PropRead).getBase() and
+        element = access
+      )
     }
 
     override predicate storeStep(DataFlow::Node element, DataFlow::SourceNode obj, string prop) {
-      prop = arrayElement() and
-      element = this.(DataFlow::PropWrite).getRhs() and
-      this = obj.getAPropertyWrite()
+      exists(ArrayIndexingAccess access |
+        prop = arrayElement() and
+        element = access.(DataFlow::PropWrite).getRhs() and
+        access = obj.getAPropertyWrite()
+      )
     }
   }
 
@@ -180,16 +181,14 @@ private module ArrayDataFlow {
    * A step for retrieving an element from an array using `.pop()` or `.shift()`.
    * E.g. `array.pop()`.
    */
-  private class ArrayPopStep extends DataFlow::AdditionalFlowStep, DataFlow::MethodCallNode {
-    ArrayPopStep() {
-      getMethodName() = "pop" or
-      getMethodName() = "shift"
-    }
-
+  private class ArrayPopStep extends DataFlow::SharedFlowStep {
     override predicate loadStep(DataFlow::Node obj, DataFlow::Node element, string prop) {
-      prop = arrayElement() and
-      obj = this.getReceiver() and
-      element = this
+      exists(DataFlow::MethodCallNode call |
+        call.getMethodName() = ["pop", "shift"] and
+        prop = arrayElement() and
+        obj = call.getReceiver() and
+        element = call
+      )
     }
   }
 
@@ -235,12 +234,12 @@ private module ArrayDataFlow {
   /**
    * A step for creating an array and storing the elements in the array.
    */
-  private class ArrayCreationStep extends DataFlow::AdditionalFlowStep, DataFlow::ArrayCreationNode {
+  private class ArrayCreationStep extends DataFlow::SharedFlowStep {
     override predicate storeStep(DataFlow::Node element, DataFlow::SourceNode obj, string prop) {
-      exists(int i |
-        element = this.getElement(i) and
-        obj = this and
-        if this = any(PromiseAllCreation c).getArrayNode()
+      exists(DataFlow::ArrayCreationNode array, int i |
+        element = array.getElement(i) and
+        obj = array and
+        if array = any(PromiseAllCreation c).getArrayNode()
         then prop = arrayElement(i)
         else prop = arrayElement()
       )
@@ -251,13 +250,14 @@ private module ArrayDataFlow {
    * A step modelling that `splice` can insert elements into an array.
    * For example in `array.splice(i, del, e)`: if `e` is tainted, then so is `array
    */
-  private class ArraySpliceStep extends DataFlow::AdditionalFlowStep, DataFlow::MethodCallNode {
-    ArraySpliceStep() { this.getMethodName() = "splice" }
-
+  private class ArraySpliceStep extends DataFlow::SharedFlowStep {
     override predicate storeStep(DataFlow::Node element, DataFlow::SourceNode obj, string prop) {
-      prop = arrayElement() and
-      element = getArgument(2) and
-      this = obj.getAMethodCall()
+      exists(DataFlow::MethodCallNode call |
+        call.getMethodName() = "splice" and
+        prop = arrayElement() and
+        element = call.getArgument(2) and
+        call = obj.getAMethodCall()
+      )
     }
   }
 
@@ -265,42 +265,27 @@ private module ArrayDataFlow {
    * A step for modelling `concat`.
    * For example in `e = arr1.concat(arr2, arr3)`: if any of the `arr` is tainted, then so is `e`.
    */
-  private class ArrayConcatStep extends DataFlow::AdditionalFlowStep, DataFlow::MethodCallNode {
-    ArrayConcatStep() { this.getMethodName() = "concat" }
-
+  private class ArrayConcatStep extends DataFlow::SharedFlowStep {
     override predicate loadStoreStep(DataFlow::Node pred, DataFlow::Node succ, string prop) {
-      prop = arrayElement() and
-      (pred = this.getReceiver() or pred = this.getAnArgument()) and
-      succ = this
+      exists(DataFlow::MethodCallNode call |
+        call.getMethodName() = "concat" and
+        prop = arrayElement() and
+        (pred = call.getReceiver() or pred = call.getAnArgument()) and
+        succ = call
+      )
     }
   }
 
   /**
    * A step for modelling that elements from an array `arr` also appear in the result from calling `slice`/`splice`/`filter`.
    */
-  private class ArraySliceStep extends DataFlow::AdditionalFlowStep, DataFlow::MethodCallNode {
-    ArraySliceStep() {
-      this.getMethodName() = "slice" or
-      this.getMethodName() = "splice" or
-      this.getMethodName() = "filter"
-    }
-
+  private class ArraySliceStep extends DataFlow::SharedFlowStep {
     override predicate loadStoreStep(DataFlow::Node pred, DataFlow::Node succ, string prop) {
-      prop = arrayElement() and
-      pred = this.getReceiver() and
-      succ = this
-    }
-  }
-
-  /**
-   * A step for modelling `for of` iteration on arrays.
-   */
-  private class ForOfStep extends PreCallGraphStep {
-    override predicate loadStep(DataFlow::Node obj, DataFlow::Node e, string prop) {
-      exists(ForOfStmt forOf |
-        obj = forOf.getIterationDomain().flow() and
-        e = DataFlow::lvalueNode(forOf.getLValue()) and
-        prop = arrayElement()
+      exists(DataFlow::MethodCallNode call |
+        call.getMethodName() = ["slice", "splice", "filter"] and
+        prop = arrayElement() and
+        pred = call.getReceiver() and
+        succ = call
       )
     }
   }
diff --git a/javascript/ql/src/semmle/javascript/Base64.qll b/javascript/ql/src/semmle/javascript/Base64.qll
index 639dab85b29..f2e91a7060c 100644
--- a/javascript/ql/src/semmle/javascript/Base64.qll
+++ b/javascript/ql/src/semmle/javascript/Base64.qll
@@ -150,7 +150,8 @@ private class NpmBase64Encode extends Base64::Encode::Range, DataFlow::CallNode
       enc = DataFlow::moduleMember("base64url", "toBase64") or
       enc = DataFlow::moduleMember("js-base64", "Base64").getAPropertyRead("encode") or
       enc = DataFlow::moduleMember("js-base64", "Base64").getAPropertyRead("encodeURI") or
-      enc = DataFlow::moduleMember("urlsafe-base64", "encode")
+      enc = DataFlow::moduleMember("urlsafe-base64", "encode") or
+      enc = DataFlow::moduleMember("react-native-base64", ["encode", "encodeFromByteArray"])
     |
       this = enc.getACall()
     )
@@ -186,7 +187,8 @@ private class NpmBase64Decode extends Base64::Decode::Range, DataFlow::CallNode
       dec = DataFlow::moduleMember("base64url", "decode") or
       dec = DataFlow::moduleMember("base64url", "fromBase64") or
       dec = DataFlow::moduleMember("js-base64", "Base64").getAPropertyRead("decode") or
-      dec = DataFlow::moduleMember("urlsafe-base64", "decode")
+      dec = DataFlow::moduleMember("urlsafe-base64", "decode") or
+      dec = DataFlow::moduleMember("react-native-base64", "decode")
     |
       this = dec.getACall()
     )
diff --git a/javascript/ql/src/semmle/javascript/BasicBlocks.qll b/javascript/ql/src/semmle/javascript/BasicBlocks.qll
index c0868605dc3..d0dc634586c 100644
--- a/javascript/ql/src/semmle/javascript/BasicBlocks.qll
+++ b/javascript/ql/src/semmle/javascript/BasicBlocks.qll
@@ -307,7 +307,7 @@ class ReachableBasicBlock extends BasicBlock {
   /**
    * Holds if this basic block strictly dominates `bb`.
    */
-  cached
+  pragma[inline]
   predicate strictlyDominates(ReachableBasicBlock bb) { bbIDominates+(this, bb) }
 
   /**
@@ -315,15 +315,13 @@ class ReachableBasicBlock extends BasicBlock {
    *
    * This predicate is reflexive: each reachable basic block dominates itself.
    */
-  predicate dominates(ReachableBasicBlock bb) {
-    bb = this or
-    strictlyDominates(bb)
-  }
+  pragma[inline]
+  predicate dominates(ReachableBasicBlock bb) { bbIDominates*(this, bb) }
 
   /**
    * Holds if this basic block strictly post-dominates `bb`.
    */
-  cached
+  pragma[inline]
   predicate strictlyPostDominates(ReachableBasicBlock bb) { bbIPostDominates+(this, bb) }
 
   /**
@@ -331,10 +329,8 @@ class ReachableBasicBlock extends BasicBlock {
    *
    * This predicate is reflexive: each reachable basic block post-dominates itself.
    */
-  predicate postDominates(ReachableBasicBlock bb) {
-    bb = this or
-    strictlyPostDominates(bb)
-  }
+  pragma[inline]
+  predicate postDominates(ReachableBasicBlock bb) { bbIPostDominates*(this, bb) }
 }
 
 /**
diff --git a/javascript/ql/src/semmle/javascript/Collections.qll b/javascript/ql/src/semmle/javascript/Collections.qll
index de51afc77ef..69849d18caf 100644
--- a/javascript/ql/src/semmle/javascript/Collections.qll
+++ b/javascript/ql/src/semmle/javascript/Collections.qll
@@ -6,32 +6,30 @@
 
 import javascript
 private import semmle.javascript.dataflow.internal.StepSummary
+private import semmle.javascript.dataflow.internal.PreCallGraphStep
 private import DataFlow::PseudoProperties
 
 /**
- * A pseudo-property used in a data-flow/type-tracking step for collections.
+ * DEPRECATED. Exists only to support other deprecated elements.
  *
- * By extending `TypeTrackingPseudoProperty` the class enables the use of the collection related pseudo-properties in type-tracking predicates.
+ * Type-tracking now automatically determines the set of pseudo-properties to include
+ * ased on which properties are contributed by `SharedTaintStep`s.
  */
-private class PseudoProperty extends TypeTrackingPseudoProperty {
+deprecated private class PseudoProperty extends string {
   PseudoProperty() {
     this = [arrayLikeElement(), "1"] or // the "1" is required for the `ForOfStep`.
-    this = any(CollectionDataFlow::MapSet step).getAPseudoProperty()
-  }
-
-  override PseudoProperty getLoadStoreToProp() {
-    exists(CollectionFlowStep step | step.loadStore(_, _, this, result))
+    this =
+      [
+        mapValue(any(DataFlow::CallNode c | c.getCalleeName() = "set").getArgument(0)),
+        mapValueAll()
+      ]
   }
 }
 
 /**
- * An `AdditionalFlowStep` used to model a data-flow step related to standard library collections.
- *
- * The `loadStep`/`storeStep`/`loadStoreStep` methods are overloaded such that the new predicates
- * `load`/`store`/`loadStore` can be used in the `CollectionsTypeTracking` module.
- * (Thereby avoiding naming conflicts with a "cousin" `AdditionalFlowStep` implementation.)
+ * DEPRECATED. Use `SharedFlowStep` or `SharedTaintTrackingStep` instead.
  */
-abstract class CollectionFlowStep extends DataFlow::AdditionalFlowStep {
+abstract deprecated class CollectionFlowStep extends DataFlow::AdditionalFlowStep {
   final override predicate step(DataFlow::Node pred, DataFlow::Node succ) { none() }
 
   final override predicate step(
@@ -84,27 +82,28 @@ abstract class CollectionFlowStep extends DataFlow::AdditionalFlowStep {
 }
 
 /**
- * Provides predicates and clases for type-tracking collections.
+ * DEPRECATED. These steps are now included in the default type tracking steps,
+ * in most cases one can simply use those instead.
  */
-module CollectionsTypeTracking {
+deprecated module CollectionsTypeTracking {
   /**
    * Gets the result from a single step through a collection, from `pred` to `result` summarized by `summary`.
    */
   pragma[inline]
   DataFlow::SourceNode collectionStep(DataFlow::Node pred, StepSummary summary) {
-    exists(CollectionFlowStep step, PseudoProperty field |
+    exists(PseudoProperty field |
       summary = LoadStep(field) and
-      step.load(pred, result, field) and
+      DataFlow::SharedTypeTrackingStep::loadStep(pred, result, field) and
       not field = mapValueUnknownKey() // prune unknown reads in type-tracking
       or
       summary = StoreStep(field) and
-      step.store(pred, result, field)
+      DataFlow::SharedTypeTrackingStep::storeStep(pred, result, field)
       or
       summary = CopyStep(field) and
-      step.loadStore(pred, result, field)
+      DataFlow::SharedTypeTrackingStep::loadStoreStep(pred, result, field)
       or
       exists(PseudoProperty toField | summary = LoadStoreStep(field, toField) |
-        step.loadStore(pred, result, field, toField)
+        DataFlow::SharedTypeTrackingStep::loadStoreStep(pred, result, field, toField)
       )
     )
   }
@@ -129,74 +128,71 @@ private module CollectionDataFlow {
   /**
    * A step for `Set.add()` method, which adds an element to a Set.
    */
-  private class SetAdd extends CollectionFlowStep, DataFlow::MethodCallNode {
-    SetAdd() { this.getMethodName() = "add" }
-
-    override predicate store(DataFlow::Node element, DataFlow::SourceNode obj, PseudoProperty prop) {
-      this = obj.getAMethodCall() and
-      element = this.getArgument(0) and
-      prop = setElement()
+  private class SetAdd extends PreCallGraphStep {
+    override predicate storeStep(DataFlow::Node element, DataFlow::SourceNode obj, string prop) {
+      exists(DataFlow::MethodCallNode call |
+        call = obj.getAMethodCall("add") and
+        element = call.getArgument(0) and
+        prop = setElement()
+      )
     }
   }
 
   /**
    * A step for the `Set` constructor, which copies any elements from the first argument into the resulting set.
    */
-  private class SetConstructor extends CollectionFlowStep, DataFlow::NewNode {
-    SetConstructor() { this = DataFlow::globalVarRef("Set").getAnInstantiation() }
-
-    override predicate loadStore(
-      DataFlow::Node pred, DataFlow::Node succ, PseudoProperty fromProp, PseudoProperty toProp
+  private class SetConstructor extends PreCallGraphStep {
+    override predicate loadStoreStep(
+      DataFlow::Node pred, DataFlow::SourceNode succ, string fromProp, string toProp
     ) {
-      pred = this.getArgument(0) and
-      succ = this and
-      fromProp = arrayLikeElement() and
-      toProp = setElement()
+      exists(DataFlow::NewNode invoke |
+        invoke = DataFlow::globalVarRef("Set").getAnInstantiation() and
+        pred = invoke.getArgument(0) and
+        succ = invoke and
+        fromProp = arrayLikeElement() and
+        toProp = setElement()
+      )
     }
   }
 
   /**
-   * A step for a `for of` statement on a Map, Set, or Iterator.
-   * For Sets and iterators the l-value are the elements of the set/iterator.
-   * For Maps the l-value is a tuple containing a key and a value.
+   * A step for modelling `for of` iteration on arrays, maps, sets, and iterators.
+   *
+   * For sets and iterators the l-value are the elements of the set/iterator.
+   * For maps the l-value is a tuple containing a key and a value.
    */
-  // This is partially duplicated behavior with the `for of` step for Arrays (`ArrayDataFlow::ForOfStep`).
-  // This duplication is required for the type-tracking steps defined in `CollectionsTypeTracking`.
-  private class ForOfStep extends CollectionFlowStep, DataFlow::ValueNode {
-    ForOfStmt forOf;
-    DataFlow::Node element;
-
-    ForOfStep() {
-      this.asExpr() = forOf.getIterationDomain() and
-      element = DataFlow::lvalueNode(forOf.getLValue())
+  private class ForOfStep extends PreCallGraphStep {
+    override predicate loadStep(DataFlow::Node obj, DataFlow::Node e, string prop) {
+      exists(ForOfStmt forOf |
+        obj = forOf.getIterationDomain().flow() and
+        e = DataFlow::lvalueNode(forOf.getLValue()) and
+        prop = arrayLikeElement()
+      )
     }
 
-    override predicate load(DataFlow::Node obj, DataFlow::Node e, PseudoProperty prop) {
-      obj = this and
-      e = element and
-      prop = arrayLikeElement()
-    }
-
-    override predicate loadStore(
-      DataFlow::Node pred, DataFlow::Node succ, PseudoProperty fromProp, PseudoProperty toProp
+    override predicate loadStoreStep(
+      DataFlow::Node pred, DataFlow::SourceNode succ, string fromProp, string toProp
     ) {
-      pred = this and
-      succ = element and
-      fromProp = mapValueAll() and
-      toProp = "1"
+      exists(ForOfStmt forOf |
+        pred = forOf.getIterationDomain().flow() and
+        succ = DataFlow::lvalueNode(forOf.getLValue()) and
+        fromProp = mapValueAll() and
+        toProp = "1"
+      )
     }
   }
 
   /**
    * A step for a call to `forEach` on a Set or Map.
    */
-  private class SetMapForEach extends CollectionFlowStep, DataFlow::MethodCallNode {
-    SetMapForEach() { this.getMethodName() = "forEach" }
-
-    override predicate load(DataFlow::Node obj, DataFlow::Node element, PseudoProperty prop) {
-      obj = this.getReceiver() and
-      element = this.getCallback(0).getParameter(0) and
-      prop = [setElement(), mapValueAll()]
+  private class SetMapForEach extends PreCallGraphStep {
+    override predicate loadStep(DataFlow::Node obj, DataFlow::Node element, string prop) {
+      exists(DataFlow::MethodCallNode call |
+        call.getMethodName() = "forEach" and
+        obj = call.getReceiver() and
+        element = call.getCallback(0).getParameter(0) and
+        prop = [setElement(), mapValueAll()]
+      )
     }
   }
 
@@ -204,14 +200,15 @@ private module CollectionDataFlow {
    * A call to the `get` method on a Map.
    * If the key of the call to `get` has a known string value, then only the value corresponding to that key will be retrieved. (The known string value is encoded as part of the pseudo-property)
    */
-  private class MapGet extends CollectionFlowStep, DataFlow::MethodCallNode {
-    MapGet() { this.getMethodName() = "get" }
-
-    override predicate load(DataFlow::Node obj, DataFlow::Node element, PseudoProperty prop) {
-      obj = this.getReceiver() and
-      element = this and
-      // reading the join of known and unknown values
-      (prop = mapValue(this.getArgument(0)) or prop = mapValueUnknownKey())
+  private class MapGet extends PreCallGraphStep {
+    override predicate loadStep(DataFlow::Node obj, DataFlow::Node element, string prop) {
+      exists(DataFlow::MethodCallNode call |
+        call.getMethodName() = "get" and
+        obj = call.getReceiver() and
+        element = call and
+        // reading the join of known and unknown values
+        (prop = mapValue(call.getArgument(0)) or prop = mapValueUnknownKey())
+      )
     }
   }
 
@@ -223,56 +220,47 @@ private module CollectionDataFlow {
    * Otherwise the value will be stored into a pseudo-property corresponding to values with unknown keys.
    * The value will additionally be stored into a pseudo-property corresponding to all values.
    */
-  class MapSet extends CollectionFlowStep, DataFlow::MethodCallNode {
-    MapSet() { this.getMethodName() = "set" }
-
-    override predicate store(DataFlow::Node element, DataFlow::SourceNode obj, PseudoProperty prop) {
-      this = obj.getAMethodCall() and
-      element = this.getArgument(1) and
-      prop = getAPseudoProperty()
+  class MapSet extends PreCallGraphStep {
+    override predicate storeStep(DataFlow::Node element, DataFlow::SourceNode obj, string prop) {
+      exists(DataFlow::MethodCallNode call |
+        call = obj.getAMethodCall("set") and
+        element = call.getArgument(1) and
+        prop = [mapValue(call.getArgument(0)), mapValueAll()]
+      )
     }
-
-    /**
-     * Gets a pseudo-property used to store an element in a map.
-     * The pseudo-property represents both values where the key is a known string value (which is encoded in the pseudo-property),
-     * and values where the key is unknown.
-     *
-     * Additionally, all elements are stored into the pseudo-property `mapValueAll()`.
-     *
-     * The return-type is `string` as this predicate is used to define which pseudo-properties exist.
-     */
-    string getAPseudoProperty() { result = [mapValue(this.getArgument(0)), mapValueAll()] }
   }
 
   /**
    * A step for a call to `values` on a Map or a Set.
    */
-  private class MapAndSetValues extends CollectionFlowStep, DataFlow::MethodCallNode {
-    MapAndSetValues() { this.getMethodName() = "values" }
-
-    override predicate loadStore(
-      DataFlow::Node pred, DataFlow::Node succ, PseudoProperty fromProp, PseudoProperty toProp
+  private class MapAndSetValues extends PreCallGraphStep {
+    override predicate loadStoreStep(
+      DataFlow::Node pred, DataFlow::SourceNode succ, string fromProp, string toProp
     ) {
-      pred = this.getReceiver() and
-      succ = this and
-      fromProp = [mapValueAll(), setElement()] and
-      toProp = iteratorElement()
+      exists(DataFlow::MethodCallNode call |
+        call.getMethodName() = "values" and
+        pred = call.getReceiver() and
+        succ = call and
+        fromProp = [mapValueAll(), setElement()] and
+        toProp = iteratorElement()
+      )
     }
   }
 
   /**
    * A step for a call to `keys` on a Set.
    */
-  private class SetKeys extends CollectionFlowStep, DataFlow::MethodCallNode {
-    SetKeys() { this.getMethodName() = "keys" }
-
-    override predicate loadStore(
-      DataFlow::Node pred, DataFlow::Node succ, PseudoProperty fromProp, PseudoProperty toProp
+  private class SetKeys extends PreCallGraphStep {
+    override predicate loadStoreStep(
+      DataFlow::Node pred, DataFlow::SourceNode succ, string fromProp, string toProp
     ) {
-      pred = this.getReceiver() and
-      succ = this and
-      fromProp = setElement() and
-      toProp = iteratorElement()
+      exists(DataFlow::MethodCallNode call |
+        call.getMethodName() = "keys" and
+        pred = call.getReceiver() and
+        succ = call and
+        fromProp = setElement() and
+        toProp = iteratorElement()
+      )
     }
   }
 }
diff --git a/javascript/ql/src/semmle/javascript/DOM.qll b/javascript/ql/src/semmle/javascript/DOM.qll
index 84ea28d26f0..73e06441b28 100644
--- a/javascript/ql/src/semmle/javascript/DOM.qll
+++ b/javascript/ql/src/semmle/javascript/DOM.qll
@@ -315,6 +315,11 @@ module DOM {
       )
     }
 
+    private InferredType getArgumentTypeFromJQueryMethodGet(JQuery::MethodCall call) {
+      call.getMethodName() = "get" and
+      result = call.getArgument(0).analyze().getAType()
+    }
+
     private class DefaultRange extends Range {
       DefaultRange() {
         this.asExpr().(VarAccess).getVariable() instanceof DOMGlobalVariable
@@ -344,7 +349,7 @@ module DOM {
         or
         exists(JQuery::MethodCall call | this = call and call.getMethodName() = "get" |
           call.getNumArgument() = 1 and
-          unique(InferredType t | t = call.getArgument(0).analyze().getAType()) = TTNumber()
+          unique(InferredType t | t = getArgumentTypeFromJQueryMethodGet(call)) = TTNumber()
         )
         or
         // A `this` node from a callback given to a `$().each(callback)` call.
diff --git a/javascript/ql/src/semmle/javascript/GlobalAccessPaths.qll b/javascript/ql/src/semmle/javascript/GlobalAccessPaths.qll
index 68b343b3578..57cf0dcee5e 100644
--- a/javascript/ql/src/semmle/javascript/GlobalAccessPaths.qll
+++ b/javascript/ql/src/semmle/javascript/GlobalAccessPaths.qll
@@ -305,6 +305,7 @@ module AccessPath {
    * }
    * ```
    */
+  pragma[inline]
   DataFlow::Node getAReferenceTo(Root root, string path) {
     path = fromReference(result, root) and
     not root.isGlobal()
@@ -327,6 +328,7 @@ module AccessPath {
    * })(NS = NS || {});
    * ```
    */
+  pragma[inline]
   DataFlow::Node getAReferenceTo(string path) {
     path = fromReference(result, DataFlow::globalAccessPathRootPseudoNode())
   }
@@ -347,6 +349,7 @@ module AccessPath {
    * }
    * ```
    */
+  pragma[inline]
   DataFlow::Node getAnAssignmentTo(Root root, string path) {
     path = fromRhs(result, root) and
     not root.isGlobal()
@@ -367,6 +370,7 @@ module AccessPath {
    *  })(foo = foo || {});
    * ```
    */
+  pragma[inline]
   DataFlow::Node getAnAssignmentTo(string path) {
     path = fromRhs(result, DataFlow::globalAccessPathRootPseudoNode())
   }
@@ -376,6 +380,7 @@ module AccessPath {
    *
    * See `getAReferenceTo` and `getAnAssignmentTo` for more details.
    */
+  pragma[inline]
   DataFlow::Node getAReferenceOrAssignmentTo(string path) {
     result = getAReferenceTo(path)
     or
@@ -387,6 +392,7 @@ module AccessPath {
    *
    * See `getAReferenceTo` and `getAnAssignmentTo` for more details.
    */
+  pragma[inline]
   DataFlow::Node getAReferenceOrAssignmentTo(Root root, string path) {
     result = getAReferenceTo(root, path)
     or
diff --git a/javascript/ql/src/semmle/javascript/HtmlSanitizers.qll b/javascript/ql/src/semmle/javascript/HtmlSanitizers.qll
index 870cde4bbce..25e8b1ad74c 100644
--- a/javascript/ql/src/semmle/javascript/HtmlSanitizers.qll
+++ b/javascript/ql/src/semmle/javascript/HtmlSanitizers.qll
@@ -16,51 +16,53 @@ abstract class HtmlSanitizerCall extends DataFlow::CallNode {
   abstract DataFlow::Node getInput();
 }
 
+pragma[noinline]
+private DataFlow::SourceNode htmlSanitizerFunction() {
+  result = DataFlow::moduleMember("ent", "encode")
+  or
+  result = DataFlow::moduleMember("entities", "encodeHTML")
+  or
+  result = DataFlow::moduleMember("entities", "encodeXML")
+  or
+  result = DataFlow::moduleMember("escape-goat", "escape")
+  or
+  result = DataFlow::moduleMember("he", "encode")
+  or
+  result = DataFlow::moduleMember("he", "escape")
+  or
+  result = DataFlow::moduleImport("sanitize-html")
+  or
+  result = DataFlow::moduleMember("sanitizer", "escape")
+  or
+  result = DataFlow::moduleMember("sanitizer", "sanitize")
+  or
+  result = DataFlow::moduleMember("validator", "escape")
+  or
+  result = DataFlow::moduleImport("xss")
+  or
+  result = DataFlow::moduleMember("xss-filters", _)
+  or
+  result = LodashUnderscore::member("escape")
+  or
+  exists(DataFlow::PropRead read | read = result |
+    read.getPropertyName() = "sanitize" and
+    read.getBase().asExpr().(VarAccess).getName() = "DOMPurify"
+  )
+  or
+  exists(string name | name = "encode" or name = "encodeNonUTF" |
+    result = DataFlow::moduleMember("html-entities", _).getAnInstantiation().getAPropertyRead(name) or
+    result = DataFlow::moduleMember("html-entities", _).getAPropertyRead(name)
+  )
+  or
+  result = Closure::moduleImport("goog.string.htmlEscape")
+}
+
 /**
  * Matches HTML sanitizers from known NPM packages as well as home-made sanitizers (matched by name).
  */
 private class DefaultHtmlSanitizerCall extends HtmlSanitizerCall {
   DefaultHtmlSanitizerCall() {
-    exists(DataFlow::SourceNode callee | this = callee.getACall() |
-      callee = DataFlow::moduleMember("ent", "encode")
-      or
-      callee = DataFlow::moduleMember("entities", "encodeHTML")
-      or
-      callee = DataFlow::moduleMember("entities", "encodeXML")
-      or
-      callee = DataFlow::moduleMember("escape-goat", "escape")
-      or
-      callee = DataFlow::moduleMember("he", "encode")
-      or
-      callee = DataFlow::moduleMember("he", "escape")
-      or
-      callee = DataFlow::moduleImport("sanitize-html")
-      or
-      callee = DataFlow::moduleMember("sanitizer", "escape")
-      or
-      callee = DataFlow::moduleMember("sanitizer", "sanitize")
-      or
-      callee = DataFlow::moduleMember("validator", "escape")
-      or
-      callee = DataFlow::moduleImport("xss")
-      or
-      callee = DataFlow::moduleMember("xss-filters", _)
-      or
-      callee = LodashUnderscore::member("escape")
-      or
-      exists(DataFlow::PropRead read | read = callee |
-        read.getPropertyName() = "sanitize" and
-        read.getBase().asExpr().(VarAccess).getName() = "DOMPurify"
-      )
-      or
-      exists(string name | name = "encode" or name = "encodeNonUTF" |
-        callee =
-          DataFlow::moduleMember("html-entities", _).getAnInstantiation().getAPropertyRead(name) or
-        callee = DataFlow::moduleMember("html-entities", _).getAPropertyRead(name)
-      )
-      or
-      callee = Closure::moduleImport("goog.string.htmlEscape")
-    )
+    this = htmlSanitizerFunction().getACall()
     or
     // Match home-made sanitizers by name.
     exists(string calleeName | calleeName = getCalleeName() |
diff --git a/javascript/ql/src/semmle/javascript/JSDoc.qll b/javascript/ql/src/semmle/javascript/JSDoc.qll
index bee65bc9ab3..e7fb681da2a 100644
--- a/javascript/ql/src/semmle/javascript/JSDoc.qll
+++ b/javascript/ql/src/semmle/javascript/JSDoc.qll
@@ -144,7 +144,7 @@ class JSDocParamTag extends JSDocTag {
   /** Gets the parameter this tag refers to, if it can be determined. */
   Variable getDocumentedParameter() {
     exists(Parameterized parm | parm.getDocumentation() = getParent() |
-      result = parm.getParameterVariable(getName())
+      result = pragma[only_bind_out](parm).getParameterVariable(getName())
     )
   }
 }
diff --git a/javascript/ql/src/semmle/javascript/JSON.qll b/javascript/ql/src/semmle/javascript/JSON.qll
index f0f4f59e98e..ed3f6f69637 100644
--- a/javascript/ql/src/semmle/javascript/JSON.qll
+++ b/javascript/ql/src/semmle/javascript/JSON.qll
@@ -41,6 +41,21 @@ class JSONValue extends @json_value, Locatable {
     )
   }
 
+  /** If this is an object, gets the value of property `name`. */
+  JSONValue getPropValue(string name) { json_properties(this, name, result) }
+
+  /** If this is an array, gets the value of the `i`th element. */
+  JSONValue getElementValue(int i) { result = this.(JSONArray).getChild(i) }
+
+  /** If this is a string constant, gets the value of the string. */
+  string getStringValue() { result = this.(JSONString).getValue() }
+
+  /** If this is an integer constant, gets its numeric value. */
+  int getIntValue() { result = this.(JSONNumber).getValue().toInt() }
+
+  /** If this is a boolean constant, gets its boolean value. */
+  boolean getBooleanValue() { result.toString() = this.(JSONBoolean).getValue() }
+
   override string getAPrimaryQlClass() { result = "JSONValue" }
 }
 
@@ -129,13 +144,10 @@ class JSONString extends @json_string, JSONPrimitiveValue {
  * ```
  */
 class JSONArray extends @json_array, JSONValue {
-  /** Gets the value of the `i`th element of this array. */
-  JSONValue getElementValue(int i) { result = getChild(i) }
+  override string getAPrimaryQlClass() { result = "JSONArray" }
 
   /** Gets the string value of the `i`th element of this array. */
-  string getElementStringValue(int i) { result = getElementValue(i).(JSONString).getValue() }
-
-  override string getAPrimaryQlClass() { result = "JSONArray" }
+  string getElementStringValue(int i) { result = getElementValue(i).getStringValue() }
 }
 
 /**
@@ -148,13 +160,10 @@ class JSONArray extends @json_array, JSONValue {
  * ```
  */
 class JSONObject extends @json_object, JSONValue {
-  /** Gets the value of property `name` of this object. */
-  JSONValue getPropValue(string name) { json_properties(this, name, result) }
+  override string getAPrimaryQlClass() { result = "JSONObject" }
 
   /** Gets the string value of property `name` of this object. */
-  string getPropStringValue(string name) { result = getPropValue(name).(JSONString).getValue() }
-
-  override string getAPrimaryQlClass() { result = "JSONObject" }
+  string getPropStringValue(string name) { result = getPropValue(name).getStringValue() }
 }
 
 /**
diff --git a/javascript/ql/src/semmle/javascript/NPM.qll b/javascript/ql/src/semmle/javascript/NPM.qll
index 24d3072fae1..8c46cd5901b 100644
--- a/javascript/ql/src/semmle/javascript/NPM.qll
+++ b/javascript/ql/src/semmle/javascript/NPM.qll
@@ -40,9 +40,7 @@ class PackageJSON extends JSONObject {
   ContributorInfo getAuthor() { result = getPropValue("author") }
 
   /** Gets information for a contributor to this package. */
-  ContributorInfo getAContributor() {
-    result = getPropValue("contributors").(JSONArray).getElementValue(_)
-  }
+  ContributorInfo getAContributor() { result = getPropValue("contributors").getElementValue(_) }
 
   /** Gets the array of files for this package. */
   JSONArray getFiles() { result = getPropValue("files") }
@@ -51,19 +49,19 @@ class PackageJSON extends JSONObject {
   string getAFile() { result = getFiles().getElementStringValue(_) }
 
   /** Gets the main module of this package. */
-  string getMain() { result = getPropStringValue("main") }
+  string getMain() { result = MainModulePath::of(this).getValue() }
 
   /** Gets the path of a command defined for this package. */
   string getBin(string cmd) {
     cmd = getPackageName() and result = getPropStringValue("bin")
     or
-    result = getPropValue("bin").(JSONObject).getPropStringValue(cmd)
+    result = getPropValue("bin").getPropValue(cmd).getStringValue()
   }
 
   /** Gets a manual page for this package. */
   string getAManFile() {
     result = getPropStringValue("man") or
-    result = getPropValue("man").(JSONArray).getElementStringValue(_)
+    result = getPropValue("man").getElementValue(_).getStringValue()
   }
 
   /** Gets information about the directories of this package. */
@@ -191,12 +189,12 @@ class BugTrackerInfo extends JSONValue {
 
   /** Gets the bug tracker URL. */
   string getUrl() {
-    result = this.(JSONObject).getPropStringValue("url") or
-    result = this.(JSONString).getValue()
+    result = this.getPropValue("url").getStringValue() or
+    result = this.getStringValue()
   }
 
   /** Gets the bug reporting email address. */
-  string getEmail() { result = this.(JSONObject).getPropStringValue("email") }
+  string getEmail() { result = this.getPropValue("email").getStringValue() }
 }
 
 /**
@@ -206,7 +204,7 @@ class ContributorInfo extends JSONValue {
   ContributorInfo() {
     exists(PackageJSON pkg |
       this = pkg.getPropValue("author") or
-      this = pkg.getPropValue("contributors").(JSONArray).getElementValue(_)
+      this = pkg.getPropValue("contributors").getElementValue(_)
     ) and
     (this instanceof JSONObject or this instanceof JSONString)
   }
@@ -217,24 +215,24 @@ class ContributorInfo extends JSONValue {
    * homepage URL.
    */
   private string parseInfo(int group) {
-    result = this.(JSONString).getValue().regexpCapture("(.*?)(?: <(.*?)>)?(?: \\((.*)?\\))", group)
+    result = this.getStringValue().regexpCapture("(.*?)(?: <(.*?)>)?(?: \\((.*)?\\))", group)
   }
 
   /** Gets the contributor's name. */
   string getName() {
-    result = this.(JSONObject).getPropStringValue("name") or
+    result = this.getPropValue("name").getStringValue() or
     result = parseInfo(1)
   }
 
   /** Gets the contributor's email address. */
   string getEmail() {
-    result = this.(JSONObject).getPropStringValue("email") or
+    result = this.getPropValue("email").getStringValue() or
     result = parseInfo(2)
   }
 
   /** Gets the contributor's homepage URL. */
   string getUrl() {
-    result = this.(JSONObject).getPropStringValue("url") or
+    result = this.getPropValue("url").getStringValue() or
     result = parseInfo(3)
   }
 }
diff --git a/javascript/ql/src/semmle/javascript/NodeJS.qll b/javascript/ql/src/semmle/javascript/NodeJS.qll
index 4c98c4fbefe..f80391a1ad3 100644
--- a/javascript/ql/src/semmle/javascript/NodeJS.qll
+++ b/javascript/ql/src/semmle/javascript/NodeJS.qll
@@ -202,6 +202,42 @@ private class RequireVariable extends Variable {
  */
 private predicate moduleInFile(Module m, File f) { m.getFile() = f }
 
+private predicate isModuleModule(DataFlow::Node nd) {
+  exists(ImportDeclaration imp |
+    imp.getImportedPath().getValue() = "module" and
+    nd =
+      [
+        DataFlow::destructuredModuleImportNode(imp),
+        DataFlow::valueNode(imp.getASpecifier().(ImportNamespaceSpecifier))
+      ]
+  )
+  or
+  isModuleModule(nd.getAPredecessor())
+}
+
+private predicate isCreateRequire(DataFlow::Node nd) {
+  exists(PropAccess prop |
+    isModuleModule(prop.getBase().flow()) and
+    prop.getPropertyName() = "createRequire" and
+    nd = prop.flow()
+  )
+  or
+  exists(PropertyPattern prop |
+    isModuleModule(prop.getObjectPattern().flow()) and
+    prop.getName() = "createRequire" and
+    nd = prop.getValuePattern().flow()
+  )
+  or
+  exists(ImportDeclaration decl, NamedImportSpecifier spec |
+    decl.getImportedPath().getValue() = "module" and
+    spec = decl.getASpecifier() and
+    spec.getImportedName() = "createRequire" and
+    nd = spec.flow()
+  )
+  or
+  isCreateRequire(nd.getAPredecessor())
+}
+
 /**
  * Holds if `nd` may refer to `require`, either directly or modulo local data flow.
  */
@@ -215,16 +251,11 @@ private predicate isRequire(DataFlow::Node nd) {
   or
   // `import { createRequire } from 'module';`.
   // specialized to ES2015 modules to avoid recursion in the `DataFlow::moduleImport()` predicate and to avoid
-  // negative recursion between `Import.getImportedModuleNode()` and `Import.getImportedModule()`.
-  exists(ImportDeclaration imp, DataFlow::SourceNode baseObj |
-    imp.getImportedPath().getValue() = "module"
-  |
-    baseObj =
-      [
-        DataFlow::destructuredModuleImportNode(imp),
-        DataFlow::valueNode(imp.getASpecifier().(ImportNamespaceSpecifier))
-      ] and
-    nd = baseObj.getAPropertyRead("createRequire").getACall()
+  // negative recursion between `Import.getImportedModuleNode()` and `Import.getImportedModule()`, and
+  // to avoid depending on `SourceNode` as this would make `SourceNode::Range` recursive.
+  exists(CallExpr call |
+    isCreateRequire(call.getCallee().flow()) and
+    nd = call.flow()
   )
 }
 
diff --git a/javascript/ql/src/semmle/javascript/NodeModuleResolutionImpl.qll b/javascript/ql/src/semmle/javascript/NodeModuleResolutionImpl.qll
index 01b01f1ac04..a8d56b63c58 100644
--- a/javascript/ql/src/semmle/javascript/NodeModuleResolutionImpl.qll
+++ b/javascript/ql/src/semmle/javascript/NodeModuleResolutionImpl.qll
@@ -80,6 +80,13 @@ File tryExtensions(Folder dir, string basename, int priority) {
   )
 }
 
+/**
+ * Gets `name` without a file extension.
+ * Or `name`, if `name` has no file extension.
+ */
+bindingset[name]
+private string getStem(string name) { result = name.regexpCapture("(.+?)(?:\\.([^.]+))?", 1) }
+
 /**
  * Gets the main module described by `pkg` with the given `priority`.
  */
@@ -90,14 +97,37 @@ File resolveMainModule(PackageJSON pkg, int priority) {
     result = tryExtensions(main.resolve(), "index", priority)
     or
     not exists(main.resolve()) and
-    not exists(main.getExtension()) and
     exists(int n | n = main.getNumComponent() |
-      result = tryExtensions(main.resolveUpTo(n - 1), main.getComponent(n - 1), priority)
+      result = tryExtensions(main.resolveUpTo(n - 1), getStem(main.getComponent(n - 1)), priority)
     )
   )
   or
-  result =
-    tryExtensions(pkg.getFile().getParentContainer(), "index", priority - prioritiesPerCandidate())
+  exists(Folder folder | folder = pkg.getFile().getParentContainer() |
+    result =
+      tryExtensions([folder, folder.getChildContainer(["src", "lib"])], "index",
+        priority - prioritiesPerCandidate())
+  )
+  or
+  // if there is no main module, then we look for files that are explicitly included in the published package.
+  exists(PathExpr file |
+    // `FilesPath` only exists if there is no main module for a given package.
+    file = FilesPath::of(pkg) and priority = 100 // fixing the priority, because there might be multiple files in the package.
+  |
+    result = file.resolve()
+    or
+    result = min(int i, File f | f = tryExtensions(file.resolve(), "index", i) | f order by i)
+    or
+    // resolve "file.js" to e.g. "file.ts".
+    not exists(file.resolve()) and
+    exists(int n | n = file.getNumComponent() |
+      result =
+        min(int i, File res |
+          res = tryExtensions(file.resolveUpTo(n - 1), getStem(file.getComponent(n - 1)), i)
+        |
+          res order by i
+        )
+    )
+  )
 }
 
 /**
@@ -123,3 +153,31 @@ class MainModulePath extends PathExpr, @json_string {
 module MainModulePath {
   MainModulePath of(PackageJSON pkg) { result.getPackageJSON() = pkg }
 }
+
+/**
+ * A JSON string in a `package.json` file specifying a file that should be included in the published package.
+ * These files are often imported directly from a client when a "main" module is not specified.
+ * For performance reasons this only exists if there is no "main" field in the `package.json` file.
+ */
+private class FilesPath extends PathExpr, @json_string {
+  PackageJSON pkg;
+
+  FilesPath() {
+    this = pkg.getPropValue("files").(JSONArray).getElementValue(_) and
+    not exists(MainModulePath::of(pkg))
+  }
+
+  /** Gets the `package.json` file in which this path occurs. */
+  PackageJSON getPackageJSON() { result = pkg }
+
+  override string getValue() { result = this.(JSONString).getValue() }
+
+  override Folder getAdditionalSearchRoot(int priority) {
+    priority = 0 and
+    result = pkg.getFile().getParentContainer()
+  }
+}
+
+private module FilesPath {
+  FilesPath of(PackageJSON pkg) { result.getPackageJSON() = pkg }
+}
diff --git a/javascript/ql/src/semmle/javascript/PackageExports.qll b/javascript/ql/src/semmle/javascript/PackageExports.qll
index bdb0c297411..c6658534459 100644
--- a/javascript/ql/src/semmle/javascript/PackageExports.qll
+++ b/javascript/ql/src/semmle/javascript/PackageExports.qll
@@ -17,33 +17,12 @@ DataFlow::ParameterNode getALibraryInputParameter() {
 }
 
 /**
- * Gets the number of occurrences of "/" in `path`.
- */
-bindingset[path]
-private int countSlashes(string path) { result = count(path.splitAt("/")) - 1 }
-
-/**
- * Gets the topmost named package.json that appears in the project.
- *
- * There can be multiple results if the there exists multiple package.json that are equally deeply nested in the folder structure.
- * Results are limited to package.json files that are at most nested 2 directories deep.
- */
-PackageJSON getTopmostPackageJSON() {
-  result =
-    min(PackageJSON j |
-      countSlashes(j.getFile().getRelativePath()) <= 3 and
-      exists(j.getPackageName())
-    |
-      j order by countSlashes(j.getFile().getRelativePath())
-    )
-}
-
-/**
- * Gets a value exported by the main module from one of the topmost `package.json` files (see `getTopmostPackageJSON`).
+ * Gets a value exported by the main module from a named `package.json` file.
  * The value is either directly the `module.exports` value, a nested property of `module.exports`, or a method on an exported class.
  */
 private DataFlow::Node getAValueExportedByPackage() {
-  result = getAnExportFromModule(getTopmostPackageJSON().getMainModule())
+  result =
+    getAnExportFromModule(any(PackageJSON pack | exists(pack.getPackageName())).getMainModule())
   or
   result = getAValueExportedByPackage().(DataFlow::PropWrite).getRhs()
   or
@@ -70,6 +49,58 @@ private DataFlow::Node getAValueExportedByPackage() {
     result = cla.getAStaticMethod() or
     result = cla.getConstructor()
   )
+  or
+  // *****
+  // Common styles of transforming exported objects.
+  // *****
+  //
+  // Object.defineProperties
+  exists(DataFlow::MethodCallNode call |
+    call = DataFlow::globalVarRef("Object").getAMethodCall("defineProperties") and
+    [call, call.getArgument(0)] = getAValueExportedByPackage() and
+    result = call.getArgument(any(int i | i > 0))
+  )
+  or
+  // Object.defineProperty
+  exists(CallToObjectDefineProperty call |
+    [call, call.getBaseObject()] = getAValueExportedByPackage()
+  |
+    result = call.getPropertyDescriptor().getALocalSource().getAPropertyReference("value")
+    or
+    result =
+      call.getPropertyDescriptor()
+          .getALocalSource()
+          .getAPropertyReference("get")
+          .(DataFlow::FunctionNode)
+          .getAReturn()
+  )
+  or
+  // Object.assign and friends
+  exists(ExtendCall assign |
+    getAValueExportedByPackage() = [assign, assign.getDestinationOperand()] and
+    result = assign.getASourceOperand()
+  )
+  or
+  // Array.prototype.{map, reduce, entries, values}
+  exists(DataFlow::MethodCallNode map |
+    map.getMethodName() = ["map", "reduce", "entries", "values"] and
+    map = getAValueExportedByPackage()
+  |
+    result = map.getArgument(0).getABoundFunctionValue(_).getAReturn()
+    or
+    // assuming that the receiver of the call is somehow exported
+    result = map.getReceiver()
+  )
+  or
+  // Object.{fromEntries, freeze, seal, entries, values}
+  exists(DataFlow::MethodCallNode freeze |
+    freeze =
+      DataFlow::globalVarRef("Object")
+          .getAMethodCall(["fromEntries", "freeze", "seal", "entries", "values"])
+  |
+    freeze = getAValueExportedByPackage() and
+    result = freeze.getArgument(0)
+  )
 }
 
 /**
diff --git a/javascript/ql/src/semmle/javascript/Paths.qll b/javascript/ql/src/semmle/javascript/Paths.qll
index 6c25f8795d9..64ff25c3220 100644
--- a/javascript/ql/src/semmle/javascript/Paths.qll
+++ b/javascript/ql/src/semmle/javascript/Paths.qll
@@ -141,29 +141,7 @@ abstract class PathString extends string {
    * components of this path refers to when resolved relative to the
    * given `root` folder.
    */
-  Path resolveUpTo(int n, Folder root) {
-    n = 0 and result.getContainer() = root and root = getARootFolder()
-    or
-    exists(Path base, string next | next = getComponent(this, n - 1, base, root) |
-      // handle empty components and the special "." folder
-      (next = "" or next = ".") and
-      result = base
-      or
-      // handle the special ".." folder
-      next = ".." and result = base.(ConsPath).getParent()
-      or
-      // special handling for Windows drive letters when resolving absolute path:
-      // the extractor populates "C:/" as a folder that has path "C:/" but name ""
-      n = 1 and
-      next.regexpMatch("[A-Za-z]:") and
-      root.getBaseName() = "" and
-      root.toString() = next.toUpperCase() + "/" and
-      result = base
-      or
-      // default case
-      result = TConsPath(base, next)
-    )
-  }
+  Path resolveUpTo(int n, Folder root) { result = resolveUpTo(this, n, root, _) }
 
   /**
    * Gets the absolute path that this path refers to when resolved relative to
@@ -172,16 +150,57 @@ abstract class PathString extends string {
   Path resolve(Folder root) { result = resolveUpTo(getNumComponent(), root) }
 }
 
+/**
+ * Gets the absolute path that the sub-path consisting of the first `n`
+ * components of this path refers to when resolved relative to the
+ * given `root` folder.
+ */
+private Path resolveUpTo(PathString p, int n, Folder root, boolean inTS) {
+  n = 0 and result.getContainer() = root and root = p.getARootFolder() and inTS = false
+  or
+  exists(Path base, string next | next = getComponent(p, n - 1, base, root, inTS) |
+    // handle empty components and the special "." folder
+    (next = "" or next = ".") and
+    result = base
+    or
+    // handle the special ".." folder
+    next = ".." and result = base.(ConsPath).getParent()
+    or
+    // special handling for Windows drive letters when resolving absolute path:
+    // the extractor populates "C:/" as a folder that has path "C:/" but name ""
+    n = 1 and
+    next.regexpMatch("[A-Za-z]:") and
+    root.getBaseName() = "" and
+    root.toString() = next.toUpperCase() + "/" and
+    result = base
+    or
+    // default case
+    result = TConsPath(base, next)
+  )
+}
+
 /**
  * Gets the `i`th component of the path `str`, where `base` is the resolved path one level up.
  * Supports that the root directory might be compiled output from TypeScript.
+ * `inTS` is true if the result is TypeScript that is compiled into the path specified by `str`.
  */
-private string getComponent(PathString str, int n, Path base, Folder root) {
-  base = str.resolveUpTo(n, root) and
-  (
-    result = str.getComponent(n)
-    or
-    result = TypeScriptOutDir::getOriginalTypeScriptFolder(str.getComponent(n), base.getContainer())
+private string getComponent(PathString str, int n, Path base, Folder root, boolean inTS) {
+  exists(boolean prevTS |
+    base = resolveUpTo(str, n, root, prevTS) and
+    (
+      result = str.getComponent(n) and prevTS = inTS
+      or
+      // If we are in a TypeScript source folder, try to replace file endings with ".ts" or ".tsx"
+      n = str.getNumComponent() - 1 and
+      prevTS = true and
+      inTS = prevTS and
+      result = str.getComponent(n).regexpCapture("^(.*)\\.js$", 1) + "." + ["ts", "tsx"]
+      or
+      prevTS = false and
+      inTS = true and
+      result =
+        TypeScriptOutDir::getOriginalTypeScriptFolder(str.getComponent(n), base.getContainer())
+    )
   )
 }
 
@@ -194,21 +213,29 @@ private module TypeScriptOutDir {
    */
   string getOriginalTypeScriptFolder(string outdir, Folder parent) {
     exists(JSONObject tsconfig |
-      tsconfig.getFile().getBaseName() = "tsconfig.json" and
-      tsconfig.isTopLevel() and
-      tsconfig.getFile().getParentContainer() = parent
-    |
-      outdir =
-        tsconfig
-            .getPropValue("compilerOptions")
-            .(JSONObject)
-            .getPropValue("outDir")
-            .(JSONString)
-            .getValue() and
-      result = getEffectiveRootDirFromTSConfig(tsconfig)
+      outdir = removeLeadingSlash(getOutDir(tsconfig, parent)) and
+      result = removeLeadingSlash(getEffectiveRootDirFromTSConfig(tsconfig))
     )
   }
 
+  /**
+   * Removes a leading dot and/or slash from `raw`.
+   */
+  bindingset[raw]
+  private string removeLeadingSlash(string raw) {
+    result = raw.regexpCapture("^\\.?/?([\\w.\\-]+)$", 1)
+  }
+
+  /**
+   * Gets the `outDir` option from a tsconfig file from the folder `parent`.
+   */
+  private string getOutDir(JSONObject tsconfig, Folder parent) {
+    tsconfig.getFile().getBaseName().regexpMatch("tsconfig.*\\.json") and
+    tsconfig.isTopLevel() and
+    tsconfig.getFile().getParentContainer() = parent and
+    result = tsconfig.getPropValue("compilerOptions").getPropValue("outDir").getStringValue()
+  }
+
   /**
    * Gets the directory that contains the TypeScript source files.
    * Based on the tsconfig.json file `tsconfig`.
@@ -248,12 +275,7 @@ private module TypeScriptOutDir {
   pragma[inline]
   private string getARootDirFromInclude(JSONObject tsconfig) {
     result =
-      getRootFolderFromPath(tsconfig
-            .getPropValue("include")
-            .(JSONArray)
-            .getElementValue(_)
-            .(JSONString)
-            .getValue())
+      getRootFolderFromPath(tsconfig.getPropValue("include").getElementValue(_).getStringValue())
   }
 
   /**
@@ -261,13 +283,7 @@ private module TypeScriptOutDir {
    */
   pragma[inline]
   private string getRootDir(JSONObject tsconfig) {
-    result =
-      tsconfig
-          .getPropValue("compilerOptions")
-          .(JSONObject)
-          .getPropValue("rootDir")
-          .(JSONString)
-          .getValue()
+    result = tsconfig.getPropValue("compilerOptions").getPropValue("rootDir").getStringValue()
   }
 }
 
diff --git a/javascript/ql/src/semmle/javascript/Promises.qll b/javascript/ql/src/semmle/javascript/Promises.qll
index b7fd4897d35..9190473201e 100644
--- a/javascript/ql/src/semmle/javascript/Promises.qll
+++ b/javascript/ql/src/semmle/javascript/Promises.qll
@@ -214,13 +214,6 @@ module PromiseTypeTracking {
       result = PromiseTypeTracking::promiseStep(mid, summary)
     )
   }
-
-  /**
-   * A class enabling the use of the `resolveField` as a pseudo-property in type-tracking predicates.
-   */
-  private class ResolveFieldAsTypeTrackingProperty extends TypeTrackingPseudoProperty {
-    ResolveFieldAsTypeTrackingProperty() { this = Promises::valueProp() }
-  }
 }
 
 private import semmle.javascript.dataflow.internal.PreCallGraphStep
@@ -596,6 +589,7 @@ private module ClosurePromise {
    * A promise created by a call `goog.Promise.resolve(value)`.
    */
   private class ResolvedClosurePromiseDefinition extends ResolvedPromiseDefinition {
+    pragma[noinline]
     ResolvedClosurePromiseDefinition() {
       this = Closure::moduleImport("goog.Promise.resolve").getACall()
     }
diff --git a/javascript/ql/src/semmle/javascript/RangeAnalysis.qll b/javascript/ql/src/semmle/javascript/RangeAnalysis.qll
index 57932f9b509..28f8b59c3fe 100644
--- a/javascript/ql/src/semmle/javascript/RangeAnalysis.qll
+++ b/javascript/ql/src/semmle/javascript/RangeAnalysis.qll
@@ -606,10 +606,10 @@ module RangeAnalysis {
         cfg2BB = cfg2.getBasicBlock() and
         cfg2RBB = cfg2BB.(ReachableBasicBlock) and
         (
-          cfg1RBB.strictlyDominates(cfg2BB) and
+          cfg2BB.getImmediateDominator+() = cfg1RBB and
           cfg = cfg2
           or
-          cfg2RBB.strictlyDominates(cfg1RBB) and
+          cfg1BB.getImmediateDominator+() = cfg2BB and
           cfg = cfg1
         )
       )
@@ -681,7 +681,7 @@ module RangeAnalysis {
       midBB = midcfg.getBasicBlock() and
       midRBB = midBB.(ReachableBasicBlock) and
       cfgBB = cfg.getBasicBlock() and
-      midRBB.strictlyDominates(cfgBB)
+      cfgBB.getImmediateDominator+() = midRBB
     )
   }
 
diff --git a/javascript/ql/src/semmle/javascript/StandardLibrary.qll b/javascript/ql/src/semmle/javascript/StandardLibrary.qll
index 5a019ee9a69..9ca2bf1725f 100644
--- a/javascript/ql/src/semmle/javascript/StandardLibrary.qll
+++ b/javascript/ql/src/semmle/javascript/StandardLibrary.qll
@@ -74,23 +74,13 @@ private class ArrayIterationCallbackAsPartialInvoke extends DataFlow::PartialInv
  * A flow step propagating the exception thrown from a callback to a method whose name coincides
  * a built-in Array iteration method, such as `forEach` or `map`.
  */
-private class IteratorExceptionStep extends DataFlow::MethodCallNode, DataFlow::AdditionalFlowStep {
-  IteratorExceptionStep() {
-    exists(string name | name = getMethodName() |
-      name = "forEach" or
-      name = "each" or
-      name = "map" or
-      name = "filter" or
-      name = "some" or
-      name = "every" or
-      name = "fold" or
-      name = "reduce"
-    )
-  }
-
+private class IteratorExceptionStep extends DataFlow::SharedFlowStep {
   override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
-    pred = getAnArgument().(DataFlow::FunctionNode).getExceptionalReturn() and
-    succ = this.getExceptionalReturn()
+    exists(DataFlow::MethodCallNode call |
+      call.getMethodName() = ["forEach", "each", "map", "filter", "some", "every", "fold", "reduce"] and
+      pred = call.getAnArgument().(DataFlow::FunctionNode).getExceptionalReturn() and
+      succ = call.getExceptionalReturn()
+    )
   }
 }
 
diff --git a/javascript/ql/src/semmle/javascript/StringConcatenation.qll b/javascript/ql/src/semmle/javascript/StringConcatenation.qll
index 941e6f6b908..0ed53929622 100644
--- a/javascript/ql/src/semmle/javascript/StringConcatenation.qll
+++ b/javascript/ql/src/semmle/javascript/StringConcatenation.qll
@@ -55,12 +55,8 @@ module StringConcatenation {
     exists(DataFlow::MethodCallNode call |
       node = call and
       call.getMethodName() = "concat" and
-      not (
-        exists(DataFlow::ArrayCreationNode array |
-          array.flowsTo(call.getAnArgument()) or array.flowsTo(call.getReceiver())
-        )
-        or
-        DataFlow::reflectiveCallNode(_) = call
+      not exists(DataFlow::ArrayCreationNode array |
+        array.flowsTo(call.getAnArgument()) or array.flowsTo(call.getReceiver())
       ) and
       (
         n = 0 and
diff --git a/javascript/ql/src/semmle/javascript/Unit.qll b/javascript/ql/src/semmle/javascript/Unit.qll
new file mode 100644
index 00000000000..dbc59f541e6
--- /dev/null
+++ b/javascript/ql/src/semmle/javascript/Unit.qll
@@ -0,0 +1,10 @@
+/** Provides the `Unit` class. */
+
+/** The unit type. */
+private newtype TUnit = TMkUnit()
+
+/** The trivial type with a single element. */
+class Unit extends TUnit {
+  /** Gets a textual representation of this element. */
+  string toString() { result = "Unit" }
+}
diff --git a/javascript/ql/src/semmle/javascript/dataflow/Configuration.qll b/javascript/ql/src/semmle/javascript/dataflow/Configuration.qll
index 9c4587d1414..b4842026e24 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/Configuration.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/Configuration.qll
@@ -72,7 +72,7 @@ private import javascript
 private import internal.FlowSteps
 private import internal.AccessPaths
 private import internal.CallGraphs
-private import internal.Unit
+private import semmle.javascript.Unit
 private import semmle.javascript.internal.CachedStages
 
 /**
@@ -544,6 +544,12 @@ abstract class LabeledBarrierGuardNode extends BarrierGuardNode {
 }
 
 /**
+ * DEPRECATED. Subclasses should extend `SharedFlowStep` instead, unless the subclass
+ * is part of a query, in which case it should be moved into the `isAdditionalFlowStep` predicate
+ * of the relevant data-flow configuration.
+ * Other uses of the predicate in this class should instead reference the predicates in the
+ * `SharedFlowStep::` module, such as `SharedFlowStep::step`.
+ *
  * A data flow edge that should be added to all data flow configurations in
  * addition to standard data flow edges.
  *
@@ -551,19 +557,19 @@ abstract class LabeledBarrierGuardNode extends BarrierGuardNode {
  * of the standard library. Override `Configuration::isAdditionalFlowStep`
  * for analysis-specific flow steps.
  */
-cached
-abstract class AdditionalFlowStep extends DataFlow::Node {
+deprecated class AdditionalFlowStep = LegacyAdditionalFlowStep;
+
+// Internal version of AdditionalFlowStep that we can reference without deprecation warnings.
+abstract private class LegacyAdditionalFlowStep extends DataFlow::Node {
   /**
    * Holds if `pred` &rarr; `succ` should be considered a data flow edge.
    */
-  cached
   predicate step(DataFlow::Node pred, DataFlow::Node succ) { none() }
 
   /**
    * Holds if `pred` &rarr; `succ` should be considered a data flow edge
    * transforming values with label `predlbl` to have label `succlbl`.
    */
-  cached
   predicate step(
     DataFlow::Node pred, DataFlow::Node succ, DataFlow::FlowLabel predlbl,
     DataFlow::FlowLabel succlbl
@@ -577,7 +583,6 @@ abstract class AdditionalFlowStep extends DataFlow::Node {
    * Holds if `pred` should be stored in the object `succ` under the property `prop`.
    * The object `succ` must be a `DataFlow::SourceNode` for the object wherein the value is stored.
    */
-  cached
   predicate storeStep(DataFlow::Node pred, DataFlow::SourceNode succ, string prop) { none() }
 
   /**
@@ -585,7 +590,6 @@ abstract class AdditionalFlowStep extends DataFlow::Node {
    *
    * Holds if the property `prop` of the object `pred` should be loaded into `succ`.
    */
-  cached
   predicate loadStep(DataFlow::Node pred, DataFlow::Node succ, string prop) { none() }
 
   /**
@@ -593,7 +597,6 @@ abstract class AdditionalFlowStep extends DataFlow::Node {
    *
    * Holds if the property `prop` should be copied from the object `pred` to the object `succ`.
    */
-  cached
   predicate loadStoreStep(DataFlow::Node pred, DataFlow::Node succ, string prop) { none() }
 
   /**
@@ -601,12 +604,10 @@ abstract class AdditionalFlowStep extends DataFlow::Node {
    *
    * Holds if the property `loadProp` should be copied from the object `pred` to the property `storeProp` of object `succ`.
    */
-  cached
   predicate loadStoreStep(
     DataFlow::Node pred, DataFlow::Node succ, string loadProp, string storeProp
   ) {
-    loadProp = storeProp and
-    loadStoreStep(pred, succ, loadProp)
+    none()
   }
 }
 
@@ -636,28 +637,133 @@ class SharedFlowStep extends Unit {
   ) {
     none()
   }
+
+  /**
+   * Holds if `pred` should be stored in the object `succ` under the property `prop`.
+   * The object `succ` must be a `DataFlow::SourceNode` for the object wherein the value is stored.
+   */
+  predicate storeStep(DataFlow::Node pred, DataFlow::SourceNode succ, string prop) { none() }
+
+  /**
+   * Holds if the property `prop` of the object `pred` should be loaded into `succ`.
+   */
+  predicate loadStep(DataFlow::Node pred, DataFlow::Node succ, string prop) { none() }
+
+  /**
+   * Holds if the property `prop` should be copied from the object `pred` to the object `succ`.
+   */
+  predicate loadStoreStep(DataFlow::Node pred, DataFlow::Node succ, string prop) { none() }
+
+  /**
+   * Holds if the property `loadProp` should be copied from the object `pred` to the property `storeProp` of object `succ`.
+   */
+  predicate loadStoreStep(
+    DataFlow::Node pred, DataFlow::Node succ, string loadProp, string storeProp
+  ) {
+    none()
+  }
 }
 
 /**
- * Contributes subclasses of `SharedFlowStep` to `AdditionalFlowStep`.
- *
- * This is a placeholder until we migrate to the `SharedFlowStep` class and deprecate `AdditionalFlowStep`.
+ * Contains predicates for accessing the steps contributed by `SharedFlowStep` subclasses.
  */
-private class SharedStepAsAdditionalFlowStep extends AdditionalFlowStep {
-  SharedStepAsAdditionalFlowStep() {
-    any(SharedFlowStep st).step(_, this) or
-    any(SharedFlowStep st).step(_, this, _, _)
+cached
+module SharedFlowStep {
+  cached
+  private module Internal {
+    // Forces this to be part of the `FlowSteps` stage.
+    // We use a public predicate in a private module to avoid warnings about this being unused.
+    cached
+    predicate forceStage() { Stages::FlowSteps::ref() }
   }
 
+  /**
+   * Holds if `pred` &rarr; `succ` should be considered a data flow edge.
+   */
+  cached
+  predicate step(DataFlow::Node pred, DataFlow::Node succ) {
+    any(SharedFlowStep s).step(pred, succ)
+  }
+
+  /**
+   * Holds if `pred` &rarr; `succ` should be considered a data flow edge
+   * transforming values with label `predlbl` to have label `succlbl`.
+   */
+  cached
+  predicate step(
+    DataFlow::Node pred, DataFlow::Node succ, DataFlow::FlowLabel predlbl,
+    DataFlow::FlowLabel succlbl
+  ) {
+    any(SharedFlowStep s).step(pred, succ, predlbl, succlbl)
+  }
+
+  /**
+   * Holds if `pred` should be stored in the object `succ` under the property `prop`.
+   * The object `succ` must be a `DataFlow::SourceNode` for the object wherein the value is stored.
+   */
+  cached
+  predicate storeStep(DataFlow::Node pred, DataFlow::SourceNode succ, string prop) {
+    any(SharedFlowStep s).storeStep(pred, succ, prop)
+  }
+
+  /**
+   * Holds if the property `prop` of the object `pred` should be loaded into `succ`.
+   */
+  cached
+  predicate loadStep(DataFlow::Node pred, DataFlow::Node succ, string prop) {
+    any(SharedFlowStep s).loadStep(pred, succ, prop)
+  }
+
+  /**
+   * Holds if the property `prop` should be copied from the object `pred` to the object `succ`.
+   */
+  cached
+  predicate loadStoreStep(DataFlow::Node pred, DataFlow::Node succ, string prop) {
+    any(SharedFlowStep s).loadStoreStep(pred, succ, prop)
+  }
+
+  /**
+   * Holds if the property `loadProp` should be copied from the object `pred` to the property `storeProp` of object `succ`.
+   */
+  cached
+  predicate loadStoreStep(
+    DataFlow::Node pred, DataFlow::Node succ, string loadProp, string storeProp
+  ) {
+    any(SharedFlowStep s).loadStoreStep(pred, succ, loadProp, storeProp)
+  }
+}
+
+/**
+ * Contributes subclasses of `AdditionalFlowStep` to `SharedFlowStep`.
+ */
+private class AdditionalFlowStepAsSharedStep extends SharedFlowStep {
   override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
-    any(SharedFlowStep st).step(pred, succ) and succ = this
+    any(LegacyAdditionalFlowStep s).step(pred, succ)
   }
 
   override predicate step(
     DataFlow::Node pred, DataFlow::Node succ, DataFlow::FlowLabel predlbl,
     DataFlow::FlowLabel succlbl
   ) {
-    any(SharedFlowStep st).step(pred, succ, predlbl, succlbl) and succ = this
+    any(LegacyAdditionalFlowStep s).step(pred, succ, predlbl, succlbl)
+  }
+
+  override predicate storeStep(DataFlow::Node pred, DataFlow::SourceNode succ, string prop) {
+    any(LegacyAdditionalFlowStep s).storeStep(pred, succ, prop)
+  }
+
+  override predicate loadStep(DataFlow::Node pred, DataFlow::Node succ, string prop) {
+    any(LegacyAdditionalFlowStep s).loadStep(pred, succ, prop)
+  }
+
+  override predicate loadStoreStep(DataFlow::Node pred, DataFlow::Node succ, string prop) {
+    any(LegacyAdditionalFlowStep s).loadStoreStep(pred, succ, prop)
+  }
+
+  override predicate loadStoreStep(
+    DataFlow::Node pred, DataFlow::Node succ, string loadProp, string storeProp
+  ) {
+    any(LegacyAdditionalFlowStep s).loadStoreStep(pred, succ, loadProp, storeProp)
   }
 }
 
@@ -666,7 +772,7 @@ private class SharedStepAsAdditionalFlowStep extends AdditionalFlowStep {
  *
  * A pseudo-property represents the location where some value is stored in an object.
  *
- * For use with load/store steps in `DataFlow::AdditionalFlowStep` and TypeTracking.
+ * For use with load/store steps in `DataFlow::SharedFlowStep` and TypeTracking.
  */
 module PseudoProperties {
   bindingset[s]
@@ -782,13 +888,12 @@ abstract class AdditionalSink extends DataFlow::Node {
  * Additional flow step to model flow from import specifiers into the SSA variable
  * corresponding to the imported variable.
  */
-private class FlowStepThroughImport extends AdditionalFlowStep, DataFlow::ValueNode {
-  override ImportSpecifier astNode;
-
+private class FlowStepThroughImport extends SharedFlowStep {
   override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
-    Stages::FlowSteps::ref() and
-    pred = this and
-    succ = DataFlow::ssaDefinitionNode(SSA::definition(astNode))
+    exists(ImportSpecifier specifier |
+      pred = DataFlow::valueNode(specifier) and
+      succ = DataFlow::ssaDefinitionNode(SSA::definition(specifier))
+    )
   }
 }
 
@@ -1202,7 +1307,7 @@ private predicate reachesReturn(
 private predicate isAdditionalLoadStep(
   DataFlow::Node pred, DataFlow::Node succ, string prop, DataFlow::Configuration cfg
 ) {
-  any(AdditionalFlowStep s).loadStep(pred, succ, prop)
+  SharedFlowStep::loadStep(pred, succ, prop)
   or
   cfg.isAdditionalLoadStep(pred, succ, prop)
 }
@@ -1213,7 +1318,7 @@ private predicate isAdditionalLoadStep(
 private predicate isAdditionalStoreStep(
   DataFlow::Node pred, DataFlow::Node succ, string prop, DataFlow::Configuration cfg
 ) {
-  any(AdditionalFlowStep s).storeStep(pred, succ, prop)
+  SharedFlowStep::storeStep(pred, succ, prop)
   or
   cfg.isAdditionalStoreStep(pred, succ, prop)
 }
@@ -1225,13 +1330,13 @@ private predicate isAdditionalLoadStoreStep(
   DataFlow::Node pred, DataFlow::Node succ, string loadProp, string storeProp,
   DataFlow::Configuration cfg
 ) {
-  any(AdditionalFlowStep s).loadStoreStep(pred, succ, loadProp, storeProp)
+  SharedFlowStep::loadStoreStep(pred, succ, loadProp, storeProp)
   or
   cfg.isAdditionalLoadStoreStep(pred, succ, loadProp, storeProp)
   or
   loadProp = storeProp and
   (
-    any(AdditionalFlowStep s).loadStoreStep(pred, succ, loadProp)
+    SharedFlowStep::loadStoreStep(pred, succ, loadProp)
     or
     cfg.isAdditionalLoadStoreStep(pred, succ, loadProp)
   )
@@ -1356,19 +1461,20 @@ private predicate summarizedHigherOrderCall(
   DataFlow::Node arg, DataFlow::Node cb, int i, DataFlow::Configuration cfg, PathSummary summary
 ) {
   exists(
-    Function f, DataFlow::InvokeNode outer, DataFlow::InvokeNode inner, int j,
-    DataFlow::Node innerArg, DataFlow::SourceNode cbParm, PathSummary oldSummary
+    Function f, DataFlow::InvokeNode inner, int j, DataFlow::Node innerArg,
+    DataFlow::SourceNode cbParm, PathSummary oldSummary
   |
     // Captured flow does not need to be summarized - it is handled by the local case in `higherOrderCall`.
-    not arg = DataFlow::capturedVariableNode(_) and
-    summarizedHigherOrderCallAux(f, outer, arg, innerArg, cfg, oldSummary, cbParm, inner, j, cb)
+    not arg = DataFlow::capturedVariableNode(_)
   |
     // direct higher-order call
-    cbParm.flowsTo(inner.getCalleeNode()) and
+    summarizedHigherOrderCallAux(f, arg, innerArg, cfg, oldSummary, cbParm, inner, j, cb) and
+    inner = cbParm.getAnInvocation() and
     i = j and
     summary = oldSummary
     or
     // indirect higher-order call
+    summarizedHigherOrderCallAux(f, arg, innerArg, cfg, oldSummary, cbParm, inner, j, cb) and
     exists(DataFlow::Node cbArg, PathSummary newSummary |
       cbParm.flowsTo(cbArg) and
       summarizedHigherOrderCall(innerArg, cbArg, i, cfg, newSummary) and
@@ -1382,14 +1488,17 @@ private predicate summarizedHigherOrderCall(
  */
 pragma[noinline]
 private predicate summarizedHigherOrderCallAux(
-  Function f, DataFlow::InvokeNode outer, DataFlow::Node arg, DataFlow::Node innerArg,
-  DataFlow::Configuration cfg, PathSummary oldSummary, DataFlow::SourceNode cbParm,
-  DataFlow::InvokeNode inner, int j, DataFlow::Node cb
+  Function f, DataFlow::Node arg, DataFlow::Node innerArg, DataFlow::Configuration cfg,
+  PathSummary oldSummary, DataFlow::SourceNode cbParm, DataFlow::InvokeNode inner, int j,
+  DataFlow::Node cb
 ) {
-  reachableFromInput(f, outer, arg, innerArg, cfg, oldSummary) and
-  // Only track actual parameter flow.
-  argumentPassing(outer, cb, f, cbParm) and
-  innerArg = inner.getArgument(j)
+  exists(DataFlow::Node outer1, DataFlow::Node outer2 |
+    reachableFromInput(f, outer1, arg, innerArg, cfg, oldSummary) and
+    outer1 = pragma[only_bind_into](outer2) and
+    // Only track actual parameter flow.
+    argumentPassing(outer2, cb, f, cbParm) and
+    innerArg = inner.getArgument(j)
+  )
 }
 
 /**
diff --git a/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll b/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll
index 6f861f1556c..7e43df8382b 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll
@@ -96,6 +96,7 @@ module DataFlow {
     predicate accessesGlobal(string g) { globalVarRef(g).flowsTo(this) }
 
     /** Holds if this node may evaluate to the string `s`, possibly through local data flow. */
+    pragma[nomagic]
     predicate mayHaveStringValue(string s) {
       getAPredecessor().mayHaveStringValue(s)
       or
@@ -492,6 +493,7 @@ module DataFlow {
      * Gets the data flow node corresponding to the base object
      * whose property is read from or written to.
      */
+    cached
     abstract Node getBase();
 
     /**
@@ -531,6 +533,13 @@ module DataFlow {
     predicate isPrivateField() {
       getPropertyName().charAt(0) = "#" and getPropertyNameExpr() instanceof Label
     }
+
+    /**
+     * Gets an accessor (`get` or `set` method) that may be invoked by this property reference.
+     */
+    final DataFlow::FunctionNode getAnAccessorCallee() {
+      result = CallGraph::getAnAccessorCallee(this)
+    }
   }
 
   /**
@@ -588,7 +597,10 @@ module DataFlow {
 
     PropLValueAsPropWrite() { astNode instanceof LValue }
 
-    override Node getBase() { result = valueNode(astNode.getBase()) }
+    override Node getBase() {
+      result = valueNode(astNode.getBase()) and
+      Stages::DataFlowStage::ref()
+    }
 
     override Expr getPropertyNameExpr() { result = astNode.getPropertyNameExpr() }
 
@@ -717,7 +729,7 @@ module DataFlow {
     override ParameterField prop;
 
     override Node getBase() {
-      result = thisNode(prop.getDeclaringClass().getConstructor().getBody())
+      thisNode(result, prop.getDeclaringClass().getConstructor().getBody())
     }
 
     override Expr getPropertyNameExpr() {
@@ -751,7 +763,7 @@ module DataFlow {
     }
 
     override Node getBase() {
-      result = thisNode(prop.getDeclaringClass().getConstructor().getBody())
+      thisNode(result, prop.getDeclaringClass().getConstructor().getBody())
     }
 
     override Expr getPropertyNameExpr() { result = prop.getNameExpr() }
@@ -1672,4 +1684,59 @@ module DataFlow {
   import TypeTracking
 
   predicate localTaintStep = TaintTracking::localTaintStep/2;
+
+  /**
+   * Holds if the function in `succ` forwards all its arguments to a call to `pred` and returns
+   * its result. This can thus be seen as a step `pred -> succ` used for tracking function values
+   * through "wrapper functions", since the `succ` function partially replicates behavior of `pred`.
+   *
+   * Examples:
+   * ```js
+   * function f(x) {
+   *   return g(x); // step: g -> f
+   * }
+   *
+   * function doExec(x) {
+   *   console.log(x);
+   *   return exec(x); // step: exec -> doExec
+   * }
+   *
+   * function doEither(x, y) {
+   *   if (x > y) {
+   *     return foo(x, y); // step: foo -> doEither
+   *   } else {
+   *     return bar(x, y); // step: bar -> doEither
+   *   }
+   * }
+   *
+   * function wrapWithLogging(f) {
+   *   return (x) => {
+   *     console.log(x);
+   *     return f(x); // step: f -> anonymous function
+   *   }
+   * }
+   * wrapWithLogging(g); // step: g -> wrapWithLogging(g)
+   * ```
+   */
+  predicate functionForwardingStep(DataFlow::Node pred, DataFlow::Node succ) {
+    exists(DataFlow::FunctionNode function, DataFlow::CallNode call |
+      call.flowsTo(function.getReturnNode()) and
+      forall(int i | exists([call.getArgument(i), function.getParameter(i)]) |
+        function.getParameter(i).flowsTo(call.getArgument(i))
+      ) and
+      pred = call.getCalleeNode() and
+      succ = function
+    )
+    or
+    // Given a generic wrapper function like,
+    //
+    //   function wrap(f) { return (x, y) => f(x, y) };
+    //
+    // add steps through calls to that function: `g -> wrap(g)`
+    exists(DataFlow::FunctionNode wrapperFunction, SourceNode param, Node paramUse |
+      FlowSteps::argumentPassing(succ, pred, wrapperFunction.getFunction(), param) and
+      param.flowsTo(paramUse) and
+      functionForwardingStep(paramUse, wrapperFunction.getReturnNode().getALocalSource())
+    )
+  }
 }
diff --git a/javascript/ql/src/semmle/javascript/dataflow/Nodes.qll b/javascript/ql/src/semmle/javascript/dataflow/Nodes.qll
index 3111cbe81ae..9c8d13582c3 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/Nodes.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/Nodes.qll
@@ -59,18 +59,16 @@ class ParameterNode extends DataFlow::SourceNode {
  * ```
  */
 class InvokeNode extends DataFlow::SourceNode {
-  DataFlow::Impl::InvokeNodeDef impl;
-
-  InvokeNode() { this = impl }
+  InvokeNode() { this instanceof DataFlow::Impl::InvokeNodeDef }
 
   /** Gets the syntactic invoke expression underlying this function invocation. */
-  InvokeExpr getInvokeExpr() { result = impl.getInvokeExpr() }
+  InvokeExpr getInvokeExpr() { result = this.(DataFlow::Impl::InvokeNodeDef).getInvokeExpr() }
 
   /** Gets the name of the function or method being invoked, if it can be determined. */
-  string getCalleeName() { result = impl.getCalleeName() }
+  string getCalleeName() { result = this.(DataFlow::Impl::InvokeNodeDef).getCalleeName() }
 
   /** Gets the data flow node specifying the function to be called. */
-  DataFlow::Node getCalleeNode() { result = impl.getCalleeNode() }
+  DataFlow::Node getCalleeNode() { result = this.(DataFlow::Impl::InvokeNodeDef).getCalleeNode() }
 
   /**
    * Gets the data flow node corresponding to the `i`th argument of this invocation.
@@ -91,10 +89,10 @@ class InvokeNode extends DataFlow::SourceNode {
    * but the position of `z` cannot be determined, hence there are no first and second
    * argument nodes.
    */
-  DataFlow::Node getArgument(int i) { result = impl.getArgument(i) }
+  DataFlow::Node getArgument(int i) { result = this.(DataFlow::Impl::InvokeNodeDef).getArgument(i) }
 
   /** Gets the data flow node corresponding to an argument of this invocation. */
-  DataFlow::Node getAnArgument() { result = impl.getAnArgument() }
+  DataFlow::Node getAnArgument() { result = this.(DataFlow::Impl::InvokeNodeDef).getAnArgument() }
 
   /** Gets the data flow node corresponding to the last argument of this invocation. */
   DataFlow::Node getLastArgument() { result = getArgument(getNumArgument() - 1) }
@@ -111,10 +109,12 @@ class InvokeNode extends DataFlow::SourceNode {
    * ```
    *  .
    */
-  DataFlow::Node getASpreadArgument() { result = impl.getASpreadArgument() }
+  DataFlow::Node getASpreadArgument() {
+    result = this.(DataFlow::Impl::InvokeNodeDef).getASpreadArgument()
+  }
 
   /** Gets the number of arguments of this invocation, if it can be determined. */
-  int getNumArgument() { result = impl.getNumArgument() }
+  int getNumArgument() { result = this.(DataFlow::Impl::InvokeNodeDef).getNumArgument() }
 
   Function getEnclosingFunction() { result = getBasicBlock().getContainer() }
 
@@ -256,14 +256,14 @@ class InvokeNode extends DataFlow::SourceNode {
  * ```
  */
 class CallNode extends InvokeNode {
-  override DataFlow::Impl::CallNodeDef impl;
+  CallNode() { this instanceof DataFlow::Impl::CallNodeDef }
 
   /**
    * Gets the data flow node corresponding to the receiver expression of this method call.
    *
    * For example, the receiver of `x.m()` is `x`.
    */
-  DataFlow::Node getReceiver() { result = impl.getReceiver() }
+  DataFlow::Node getReceiver() { result = this.(DataFlow::Impl::CallNodeDef).getReceiver() }
 }
 
 /**
@@ -277,10 +277,10 @@ class CallNode extends InvokeNode {
  * ```
  */
 class MethodCallNode extends CallNode {
-  override DataFlow::Impl::MethodCallNodeDef impl;
+  MethodCallNode() { this instanceof DataFlow::Impl::MethodCallNodeDef }
 
   /** Gets the name of the invoked method, if it can be determined. */
-  string getMethodName() { result = impl.getMethodName() }
+  string getMethodName() { result = this.(DataFlow::Impl::MethodCallNodeDef).getMethodName() }
 
   /**
    * Holds if this data flow node calls method `methodName` on receiver node `receiver`.
@@ -300,7 +300,7 @@ class MethodCallNode extends CallNode {
  * ```
  */
 class NewNode extends InvokeNode {
-  override DataFlow::Impl::NewNodeDef impl;
+  NewNode() { this instanceof DataFlow::Impl::NewNodeDef }
 }
 
 /**
@@ -546,6 +546,16 @@ class ObjectLiteralNode extends DataFlow::ValueNode, DataFlow::SourceNode {
   DataFlow::Node getASpreadProperty() {
     result = astNode.getAProperty().(SpreadProperty).getInit().(SpreadElement).getOperand().flow()
   }
+
+  /** Gets the property getter of the given name, installed on this object literal. */
+  DataFlow::FunctionNode getPropertyGetter(string name) {
+    result = astNode.getPropertyByName(name).(PropertyGetter).getInit().flow()
+  }
+
+  /** Gets the property setter of the given name, installed on this object literal. */
+  DataFlow::FunctionNode getPropertySetter(string name) {
+    result = astNode.getPropertyByName(name).(PropertySetter).getInit().flow()
+  }
 }
 
 /**
diff --git a/javascript/ql/src/semmle/javascript/dataflow/Sources.qll b/javascript/ql/src/semmle/javascript/dataflow/Sources.qll
index 01b624580b2..e6d76898d26 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/Sources.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/Sources.qll
@@ -34,7 +34,11 @@ private import semmle.javascript.internal.CachedStages
  * ```
  */
 class SourceNode extends DataFlow::Node {
-  SourceNode() { this instanceof SourceNode::Range }
+  SourceNode() {
+    this instanceof SourceNode::Range
+    or
+    none() and this instanceof SourceNode::Internal::RecursionGuard
+  }
 
   /**
    * Holds if this node flows into `sink` in zero or more local (that is,
@@ -48,6 +52,11 @@ class SourceNode extends DataFlow::Node {
    */
   predicate flowsToExpr(Expr sink) { flowsTo(DataFlow::valueNode(sink)) }
 
+  /**
+   * Gets a node into which data may flow from this node in zero or more local steps.
+   */
+  DataFlow::Node getALocalUse() { flowsTo(result) }
+
   /**
    * Gets a reference (read or write) of property `propName` on this node.
    */
@@ -329,6 +338,12 @@ module SourceNode {
       DataFlow::functionReturnNode(this, _)
     }
   }
+
+  /** INTERNAL. DO NOT USE. */
+  module Internal {
+    /** An empty class that some tests are using to enforce that SourceNode is non-recursive. */
+    abstract class RecursionGuard extends DataFlow::Node { }
+  }
 }
 
 deprecated class DefaultSourceNode extends SourceNode {
diff --git a/javascript/ql/src/semmle/javascript/dataflow/TaintTracking.qll b/javascript/ql/src/semmle/javascript/dataflow/TaintTracking.qll
index de41392cada..251a691501e 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/TaintTracking.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/TaintTracking.qll
@@ -15,7 +15,7 @@
 
 import javascript
 private import semmle.javascript.dataflow.internal.FlowSteps as FlowSteps
-private import semmle.javascript.dataflow.internal.Unit
+private import semmle.javascript.Unit
 private import semmle.javascript.dataflow.InferredTypes
 private import semmle.javascript.internal.CachedStages
 
@@ -584,22 +584,26 @@ module TaintTracking {
 
   /**
    * A taint propagating data flow edge for assignments of the form `o[k] = v`, where
-   * `k` is not a constant and `o` refers to some object literal; in this case, we consider
-   * taint to flow from `v` to that object literal.
+   * one of the following holds:
    *
-   * The rationale for this heuristic is that if properties of `o` are accessed by
-   * computed (that is, non-constant) names, then `o` is most likely being treated as
-   * a map, not as a real object. In this case, it makes sense to consider the entire
-   * map to be tainted as soon as one of its entries is.
+   * - `k` is not a constant and `o` refers to some object literal. The rationale
+   *   here is that `o` is most likely being used like a dictionary object.
+   *
+   * - `k` refers to `o.length`, that is, the assignment is of form `o[o.length] = v`.
+   *   In this case, the assignment behaves like `o.push(v)`.
    */
-  private class DictionaryTaintStep extends SharedTaintStep {
+  private class ComputedPropWriteTaintStep extends SharedTaintStep {
     override predicate heapStep(DataFlow::Node pred, DataFlow::Node succ) {
-      exists(AssignExpr assgn, IndexExpr idx, DataFlow::ObjectLiteralNode obj |
+      exists(AssignExpr assgn, IndexExpr idx, DataFlow::SourceNode obj |
         assgn.getTarget() = idx and
         obj.flowsToExpr(idx.getBase()) and
         not exists(idx.getPropertyName()) and
         pred = DataFlow::valueNode(assgn.getRhs()) and
         succ = obj
+      |
+        obj instanceof DataFlow::ObjectLiteralNode
+        or
+        obj.getAPropertyRead("length").flowsToExpr(idx.getPropertyNameExpr())
       )
     }
   }
@@ -738,7 +742,10 @@ module TaintTracking {
   pragma[nomagic]
   private DataFlow::MethodCallNode execMethodCall() {
     result.getMethodName() = "exec" and
-    result.getReceiver().analyze().getAType() = TTRegExp()
+    exists(DataFlow::AnalyzedNode analyzed |
+      pragma[only_bind_into](analyzed) = result.getReceiver().analyze() and
+      analyzed.getAType() = TTRegExp()
+    )
   }
 
   /**
@@ -759,7 +766,10 @@ module TaintTracking {
   pragma[nomagic]
   private DataFlow::MethodCallNode matchMethodCall() {
     result.getMethodName() = "match" and
-    result.getArgument(0).analyze().getAType() = TTRegExp()
+    exists(DataFlow::AnalyzedNode analyzed |
+      pragma[only_bind_into](analyzed) = result.getArgument(0).analyze() and
+      analyzed.getAType() = TTRegExp()
+    )
   }
 
   /**
@@ -828,13 +838,13 @@ module TaintTracking {
   /**
    * A taint propagating data flow edge arising from URL parameter parsing.
    */
-  private class UrlSearchParamsTaintStep extends DataFlow::AdditionalFlowStep, DataFlow::ValueNode {
+  private class UrlSearchParamsTaintStep extends DataFlow::SharedFlowStep {
     /**
      * Holds if `succ` is a `URLSearchParams` providing access to the
      * parameters encoded in `pred`.
      */
     override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
-      isUrlSearchParams(succ, pred) and succ = this
+      isUrlSearchParams(succ, pred)
     }
 
     /**
@@ -847,17 +857,14 @@ module TaintTracking {
      *    which can be accessed using a `get` or `getAll` call. (See getableUrlPseudoProperty())
      */
     override predicate storeStep(DataFlow::Node pred, DataFlow::SourceNode succ, string prop) {
-      succ = this and
-      (
-        prop = ["searchParams", "hash", "search", hiddenUrlPseudoProperty()] and
-        exists(DataFlow::NewNode newUrl | succ = newUrl |
-          newUrl = DataFlow::globalVarRef("URL").getAnInstantiation() and
-          pred = newUrl.getArgument(0)
-        )
-        or
-        prop = getableUrlPseudoProperty() and
-        isUrlSearchParams(succ, pred)
+      prop = ["searchParams", "hash", "search", hiddenUrlPseudoProperty()] and
+      exists(DataFlow::NewNode newUrl | succ = newUrl |
+        newUrl = DataFlow::globalVarRef("URL").getAnInstantiation() and
+        pred = newUrl.getArgument(0)
       )
+      or
+      prop = getableUrlPseudoProperty() and
+      isUrlSearchParams(succ, pred)
     }
 
     /**
@@ -869,7 +876,6 @@ module TaintTracking {
     override predicate loadStoreStep(
       DataFlow::Node pred, DataFlow::Node succ, string loadProp, string storeProp
     ) {
-      succ = this and
       loadProp = hiddenUrlPseudoProperty() and
       storeProp = getableUrlPseudoProperty() and
       exists(DataFlow::PropRead read | read = succ |
@@ -884,7 +890,6 @@ module TaintTracking {
      * This step is used to load the value stored in the pseudo-property `getableUrlPseudoProperty()`.
      */
     override predicate loadStep(DataFlow::Node pred, DataFlow::Node succ, string prop) {
-      succ = this and
       prop = getableUrlPseudoProperty() and
       // this is a call to `get` or `getAll` on a `URLSearchParams` object
       exists(string m, DataFlow::MethodCallNode call | call = succ |
diff --git a/javascript/ql/src/semmle/javascript/dataflow/TrackedNodes.qll b/javascript/ql/src/semmle/javascript/dataflow/TrackedNodes.qll
index 1080d5f4dc6..28d9a432341 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/TrackedNodes.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/TrackedNodes.qll
@@ -102,7 +102,7 @@ private module NodeTracking {
   predicate localFlowStep(DataFlow::Node pred, DataFlow::Node succ) {
     pred = succ.getAPredecessor()
     or
-    any(DataFlow::AdditionalFlowStep afs).step(pred, succ)
+    DataFlow::SharedFlowStep::step(pred, succ)
     or
     localExceptionStep(pred, succ)
   }
diff --git a/javascript/ql/src/semmle/javascript/dataflow/TypeTracking.qll b/javascript/ql/src/semmle/javascript/dataflow/TypeTracking.qll
index 0996fc5c0ac..88d13ce9d77 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/TypeTracking.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/TypeTracking.qll
@@ -9,6 +9,7 @@
 private import javascript
 private import internal.FlowSteps
 private import internal.StepSummary
+private import semmle.javascript.Unit
 private import semmle.javascript.internal.CachedStages
 
 private newtype TTypeTracker = MkTypeTracker(Boolean hasCall, OptionalPropertyName prop)
@@ -252,6 +253,12 @@ class TypeBackTracker extends TTypeBackTracker {
    */
   predicate start() { hasReturn = false and prop = "" }
 
+  /**
+   * Holds if this is the starting point of type backtracking, and the value is in the property named `propName`.
+   * The type tracking only ends after the property has been stored.
+   */
+  predicate isInProp(PropertyName propName) { hasReturn = false and prop = propName }
+
   /**
    * Holds if this is the end point of type tracking.
    */
@@ -328,6 +335,89 @@ module TypeBackTracker {
 }
 
 /**
+ * A data flow edge that should be followed by type tracking.
+ *
+ * Unlike `SharedFlowStep`, this type of edge does not affect
+ * the local data flow graph, and is not used by data-flow configurations.
+ *
+ * Note: For performance reasons, all subclasses of this class should be part
+ * of the standard library. For query-specific steps, consider including the
+ * custom steps in the type-tracking predicate itself.
+ */
+class SharedTypeTrackingStep extends Unit {
+  /**
+   * Holds if type-tracking should step from `pred` to `succ`.
+   */
+  predicate step(DataFlow::Node pred, DataFlow::Node succ) { none() }
+
+  /**
+   * Holds if type-tracking should step from `pred` into the `prop` property of `succ`.
+   */
+  predicate storeStep(DataFlow::Node pred, DataFlow::SourceNode succ, string prop) { none() }
+
+  /**
+   * Holds if type-tracking should step from the `prop` property of `pred` to `succ`.
+   */
+  predicate loadStep(DataFlow::Node pred, DataFlow::Node succ, string prop) { none() }
+
+  /**
+   * Holds if type-tracking should step from the `prop` property of `pred` to the same property in `succ`.
+   */
+  predicate loadStoreStep(DataFlow::Node pred, DataFlow::SourceNode succ, string prop) { none() }
+
+  /**
+   * Holds if type-tracking should step from the `loadProp` property of `pred` to the `storeProp` property in `succ`.
+   */
+  predicate loadStoreStep(
+    DataFlow::Node pred, DataFlow::SourceNode succ, string loadProp, string storeProp
+  ) {
+    none()
+  }
+}
+
+/** Provides access to the steps contributed by subclasses of `SharedTypeTrackingStep`. */
+module SharedTypeTrackingStep {
+  /**
+   * Holds if type-tracking should step from `pred` to `succ`.
+   */
+  predicate step(DataFlow::Node pred, DataFlow::Node succ) {
+    any(SharedTypeTrackingStep s).step(pred, succ)
+  }
+
+  /**
+   * Holds if type-tracking should step from `pred` into the `prop` property of `succ`.
+   */
+  predicate storeStep(DataFlow::Node pred, DataFlow::SourceNode succ, string prop) {
+    any(SharedTypeTrackingStep s).storeStep(pred, succ, prop)
+  }
+
+  /**
+   * Holds if type-tracking should step from the `prop` property of `pred` to `succ`.
+   */
+  predicate loadStep(DataFlow::Node pred, DataFlow::Node succ, string prop) {
+    any(SharedTypeTrackingStep s).loadStep(pred, succ, prop)
+  }
+
+  /**
+   * Holds if type-tracking should step from the `prop` property of `pred` to the same property in `succ`.
+   */
+  predicate loadStoreStep(DataFlow::Node pred, DataFlow::SourceNode succ, string prop) {
+    any(SharedTypeTrackingStep s).loadStoreStep(pred, succ, prop)
+  }
+
+  /**
+   * Holds if type-tracking should step from the `loadProp` property of `pred` to the `storeProp` property in `succ`.
+   */
+  predicate loadStoreStep(
+    DataFlow::Node pred, DataFlow::SourceNode succ, string loadProp, string storeProp
+  ) {
+    any(SharedTypeTrackingStep s).loadStoreStep(pred, succ, loadProp, storeProp)
+  }
+}
+
+/**
+ * DEPRECATED. Use `SharedTypeTrackingStep` instead.
+ *
  * A data flow edge that should be followed by type tracking.
  *
  * Unlike `AdditionalFlowStep`, this type of edge does not affect
@@ -337,7 +427,10 @@ module TypeBackTracker {
  * of the standard library. For query-specific steps, consider including the
  * custom steps in the type-tracking predicate itself.
  */
-abstract class AdditionalTypeTrackingStep extends DataFlow::Node {
+deprecated class AdditionalTypeTrackingStep = LegacyTypeTrackingStep;
+
+// Internal version of AdditionalTypeTrackingStep that we can reference without deprecation warnings.
+abstract private class LegacyTypeTrackingStep extends DataFlow::Node {
   /**
    * Holds if type-tracking should step from `pred` to `succ`.
    */
@@ -358,3 +451,21 @@ abstract class AdditionalTypeTrackingStep extends DataFlow::Node {
    */
   predicate loadStoreStep(DataFlow::Node pred, DataFlow::SourceNode succ, string prop) { none() }
 }
+
+private class LegacyStepAsSharedTypeTrackingStep extends SharedTypeTrackingStep {
+  override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
+    any(LegacyTypeTrackingStep s).step(pred, succ)
+  }
+
+  override predicate storeStep(DataFlow::Node pred, DataFlow::SourceNode succ, string prop) {
+    any(LegacyTypeTrackingStep s).storeStep(pred, succ, prop)
+  }
+
+  override predicate loadStep(DataFlow::Node pred, DataFlow::Node succ, string prop) {
+    any(LegacyTypeTrackingStep s).loadStep(pred, succ, prop)
+  }
+
+  override predicate loadStoreStep(DataFlow::Node pred, DataFlow::SourceNode succ, string prop) {
+    any(LegacyTypeTrackingStep s).loadStoreStep(pred, succ, prop)
+  }
+}
diff --git a/javascript/ql/src/semmle/javascript/dataflow/internal/CallGraphs.qll b/javascript/ql/src/semmle/javascript/dataflow/internal/CallGraphs.qll
index 433cbc2004b..0863cf8a895 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/internal/CallGraphs.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/internal/CallGraphs.qll
@@ -162,4 +162,46 @@ module CallGraph {
       )
     )
   }
+
+  /** Holds if a property setter named `name` exists in a class. */
+  private predicate isSetterName(string name) {
+    exists(any(DataFlow::ClassNode cls).getInstanceMember(name, DataFlow::MemberKind::setter()))
+  }
+
+  /**
+   * Gets a property write that assigns to the property `name` on an instance of this class,
+   * and `name` is the name of a property setter.
+   */
+  private DataFlow::PropWrite getAnInstanceMemberAssignment(DataFlow::ClassNode cls, string name) {
+    isSetterName(name) and // restrict size of predicate
+    result = cls.getAnInstanceReference().getAPropertyWrite(name)
+    or
+    exists(DataFlow::ClassNode subclass |
+      result = getAnInstanceMemberAssignment(subclass, name) and
+      not exists(subclass.getInstanceMember(name, DataFlow::MemberKind::setter())) and
+      cls = subclass.getADirectSuperClass()
+    )
+  }
+
+  /**
+   * Gets a getter or setter invoked as a result of the given property access.
+   */
+  cached
+  DataFlow::FunctionNode getAnAccessorCallee(DataFlow::PropRef ref) {
+    exists(DataFlow::ClassNode cls, string name |
+      ref = cls.getAnInstanceMemberAccess(name) and
+      result = cls.getInstanceMember(name, DataFlow::MemberKind::getter())
+      or
+      ref = getAnInstanceMemberAssignment(cls, name) and
+      result = cls.getInstanceMember(name, DataFlow::MemberKind::setter())
+    )
+    or
+    exists(DataFlow::ObjectLiteralNode object, string name |
+      ref = object.getAPropertyRead(name) and
+      result = object.getPropertyGetter(name)
+      or
+      ref = object.getAPropertyWrite(name) and
+      result = object.getPropertySetter(name)
+    )
+  }
 }
diff --git a/javascript/ql/src/semmle/javascript/dataflow/internal/FlowSteps.qll b/javascript/ql/src/semmle/javascript/dataflow/internal/FlowSteps.qll
index 4b9158d3575..baf6420f5c1 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/internal/FlowSteps.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/internal/FlowSteps.qll
@@ -25,7 +25,9 @@ predicate shouldTrackProperties(AbstractValue obj) {
  */
 pragma[noinline]
 predicate returnExpr(Function f, DataFlow::Node source, DataFlow::Node sink) {
-  sink.asExpr() = f.getAReturnedExpr() and source = sink
+  sink.asExpr() = f.getAReturnedExpr() and
+  source = sink and
+  not f = any(SetterMethodDeclaration decl).getBody()
 }
 
 /**
@@ -39,9 +41,9 @@ predicate localFlowStep(
 ) {
   pred = succ.getAPredecessor() and predlbl = succlbl
   or
-  any(DataFlow::AdditionalFlowStep afs).step(pred, succ) and predlbl = succlbl
+  DataFlow::SharedFlowStep::step(pred, succ) and predlbl = succlbl
   or
-  any(DataFlow::AdditionalFlowStep afs).step(pred, succ, predlbl, succlbl)
+  DataFlow::SharedFlowStep::step(pred, succ, predlbl, succlbl)
   or
   exists(boolean vp | configuration.isAdditionalFlowStep(pred, succ, vp) |
     vp = true and
@@ -120,7 +122,11 @@ private module CachedSteps {
    * Holds if `invk` may invoke `f`.
    */
   cached
-  predicate calls(DataFlow::InvokeNode invk, Function f) { f = invk.getACallee(0) }
+  predicate calls(DataFlow::SourceNode invk, Function f) {
+    f = invk.(DataFlow::InvokeNode).getACallee(0)
+    or
+    f = invk.(DataFlow::PropRef).getAnAccessorCallee().getFunction()
+  }
 
   private predicate callsBoundInternal(
     DataFlow::InvokeNode invk, Function f, int boundArgs, boolean contextDependent
@@ -177,11 +183,11 @@ private module CachedSteps {
    */
   cached
   predicate argumentPassing(
-    DataFlow::InvokeNode invk, DataFlow::ValueNode arg, Function f, DataFlow::SourceNode parm
+    DataFlow::SourceNode invk, DataFlow::Node arg, Function f, DataFlow::SourceNode parm
   ) {
     calls(invk, f) and
     (
-      exists(int i | arg = invk.getArgument(i) |
+      exists(int i | arg = invk.(DataFlow::InvokeNode).getArgument(i) |
         exists(Parameter p |
           f.getParameter(i) = p and
           not p.isRestParameter() and
@@ -193,12 +199,19 @@ private module CachedSteps {
       or
       arg = invk.(DataFlow::CallNode).getReceiver() and
       parm = DataFlow::thisNode(f)
+      or
+      arg = invk.(DataFlow::PropRef).getBase() and
+      parm = DataFlow::thisNode(f)
+      or
+      arg = invk.(DataFlow::PropWrite).getRhs() and
+      parm = DataFlow::parameterNode(f.getParameter(0))
     )
     or
-    exists(DataFlow::Node callback, int i, Parameter p |
+    exists(DataFlow::Node callback, int i, Parameter p, Function target |
       invk.(DataFlow::PartialInvokeNode).isPartialArgument(callback, arg, i) and
       partiallyCalls(invk, callback, f) and
-      f.getParameter(i) = p and
+      f = pragma[only_bind_into](target) and
+      target.getParameter(i) = p and
       not p.isRestParameter() and
       parm = DataFlow::parameterNode(p)
     )
@@ -213,7 +226,7 @@ private module CachedSteps {
       callsBound(invk, f, boundArgs) and
       f.getParameter(boundArgs + i) = p and
       not p.isRestParameter() and
-      arg = invk.getArgument(i) and
+      arg = invk.(DataFlow::InvokeNode).getArgument(i) and
       parm = DataFlow::parameterNode(p)
     )
   }
diff --git a/javascript/ql/src/semmle/javascript/dataflow/internal/PreCallGraphStep.qll b/javascript/ql/src/semmle/javascript/dataflow/internal/PreCallGraphStep.qll
index 5b800f3f717..18db549300a 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/internal/PreCallGraphStep.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/internal/PreCallGraphStep.qll
@@ -4,19 +4,14 @@
  */
 
 private import javascript
+private import semmle.javascript.Unit
 private import semmle.javascript.internal.CachedStages
 
-private newtype TUnit = MkUnit()
-
-private class Unit extends TUnit {
-  string toString() { result = "unit" }
-}
-
 /**
  * Internal extension point for adding flow edges prior to call graph construction
  * and type tracking.
  *
- * Steps added here will be added to both `AdditionalFlowStep` and `AdditionalTypeTrackingStep`.
+ * Steps added here will be added to both `SharedFlowStep` and `SharedTypeTrackingStep`.
  *
  * Contributing steps that rely on type tracking will lead to negative recursion.
  */
@@ -40,6 +35,15 @@ class PreCallGraphStep extends Unit {
    * Holds if there is a step from the `prop` property of `pred` to the same property in `succ`.
    */
   predicate loadStoreStep(DataFlow::Node pred, DataFlow::SourceNode succ, string prop) { none() }
+
+  /**
+   * Holds if there is a step from the `loadProp` property of `pred` to the `storeProp` property in `succ`.
+   */
+  predicate loadStoreStep(
+    DataFlow::Node pred, DataFlow::SourceNode succ, string loadProp, string storeProp
+  ) {
+    none()
+  }
 }
 
 module PreCallGraphStep {
@@ -75,62 +79,61 @@ module PreCallGraphStep {
   predicate loadStoreStep(DataFlow::Node pred, DataFlow::SourceNode succ, string prop) {
     any(PreCallGraphStep s).loadStoreStep(pred, succ, prop)
   }
-}
 
-private class NodeWithPreCallGraphStep extends DataFlow::Node {
-  NodeWithPreCallGraphStep() {
-    PreCallGraphStep::step(this, _)
-    or
-    PreCallGraphStep::storeStep(this, _, _)
-    or
-    PreCallGraphStep::loadStep(this, _, _)
-    or
-    PreCallGraphStep::loadStoreStep(this, _, _)
+  /**
+   * Holds if there is a step from the `loadProp` property of `pred` to the `storeProp` property in `succ`.
+   */
+  predicate loadStoreStep(
+    DataFlow::Node pred, DataFlow::SourceNode succ, string loadProp, string storeProp
+  ) {
+    any(PreCallGraphStep s).loadStoreStep(pred, succ, loadProp, storeProp)
   }
 }
 
-private class AdditionalFlowStepFromPreCallGraph extends NodeWithPreCallGraphStep,
-  DataFlow::AdditionalFlowStep {
+private class SharedFlowStepFromPreCallGraph extends DataFlow::SharedFlowStep {
   override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
-    pred = this and
-    PreCallGraphStep::step(this, succ)
+    PreCallGraphStep::step(pred, succ)
   }
 
   override predicate storeStep(DataFlow::Node pred, DataFlow::SourceNode succ, string prop) {
-    pred = this and
-    PreCallGraphStep::storeStep(this, succ, prop)
+    PreCallGraphStep::storeStep(pred, succ, prop)
   }
 
   override predicate loadStep(DataFlow::Node pred, DataFlow::Node succ, string prop) {
-    pred = this and
-    PreCallGraphStep::loadStep(this, succ, prop)
+    PreCallGraphStep::loadStep(pred, succ, prop)
   }
 
   override predicate loadStoreStep(DataFlow::Node pred, DataFlow::Node succ, string prop) {
-    pred = this and
-    PreCallGraphStep::loadStoreStep(this, succ, prop)
+    PreCallGraphStep::loadStoreStep(pred, succ, prop)
+  }
+
+  override predicate loadStoreStep(
+    DataFlow::Node pred, DataFlow::Node succ, string loadProp, string storeProp
+  ) {
+    PreCallGraphStep::loadStoreStep(pred, succ, loadProp, storeProp)
   }
 }
 
-private class AdditionalTypeTrackingStepFromPreCallGraph extends NodeWithPreCallGraphStep,
-  DataFlow::AdditionalTypeTrackingStep {
+private class SharedTypeTrackingStepFromPreCallGraph extends DataFlow::SharedTypeTrackingStep {
   override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
-    pred = this and
-    PreCallGraphStep::step(this, succ)
+    PreCallGraphStep::step(pred, succ)
   }
 
   override predicate storeStep(DataFlow::Node pred, DataFlow::SourceNode succ, string prop) {
-    pred = this and
-    PreCallGraphStep::storeStep(this, succ, prop)
+    PreCallGraphStep::storeStep(pred, succ, prop)
   }
 
   override predicate loadStep(DataFlow::Node pred, DataFlow::Node succ, string prop) {
-    pred = this and
-    PreCallGraphStep::loadStep(this, succ, prop)
+    PreCallGraphStep::loadStep(pred, succ, prop)
   }
 
   override predicate loadStoreStep(DataFlow::Node pred, DataFlow::SourceNode succ, string prop) {
-    pred = this and
-    PreCallGraphStep::loadStoreStep(this, succ, prop)
+    PreCallGraphStep::loadStoreStep(pred, succ, prop)
+  }
+
+  override predicate loadStoreStep(
+    DataFlow::Node pred, DataFlow::SourceNode succ, string loadProp, string storeProp
+  ) {
+    PreCallGraphStep::loadStoreStep(pred, succ, loadProp, storeProp)
   }
 }
diff --git a/javascript/ql/src/semmle/javascript/dataflow/internal/StepSummary.qll b/javascript/ql/src/semmle/javascript/dataflow/internal/StepSummary.qll
index 13450438e52..5869444053f 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/internal/StepSummary.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/internal/StepSummary.qll
@@ -1,50 +1,66 @@
 import javascript
 private import semmle.javascript.dataflow.TypeTracking
+private import semmle.javascript.internal.CachedStages
 private import FlowSteps
 
-class PropertyName extends string {
-  PropertyName() {
-    this = any(DataFlow::PropRef pr).getPropertyName()
-    or
-    AccessPath::isAssignedInUniqueFile(this)
-    or
-    exists(AccessPath::getAnAssignmentTo(_, this))
-    or
-    this instanceof TypeTrackingPseudoProperty
+cached
+private module Cached {
+  cached
+  module Public {
+    cached
+    predicate forceStage() { Stages::TypeTracking::ref() }
+
+    cached
+    class PropertyName extends string {
+      cached
+      PropertyName() {
+        this = any(DataFlow::PropRef pr).getPropertyName()
+        or
+        AccessPath::isAssignedInUniqueFile(this)
+        or
+        exists(AccessPath::getAnAssignmentTo(_, this))
+        or
+        SharedTypeTrackingStep::loadStep(_, _, this)
+        or
+        SharedTypeTrackingStep::storeStep(_, _, this)
+        or
+        SharedTypeTrackingStep::loadStoreStep(_, _, this, _)
+        or
+        SharedTypeTrackingStep::loadStoreStep(_, _, _, this)
+      }
+    }
+
+    /**
+     * A description of a step on an inter-procedural data flow path.
+     */
+    cached
+    newtype TStepSummary =
+      LevelStep() or
+      CallStep() or
+      ReturnStep() or
+      StoreStep(PropertyName prop) or
+      LoadStep(PropertyName prop) or
+      CopyStep(PropertyName prop) or
+      LoadStoreStep(PropertyName fromProp, PropertyName toProp) {
+        SharedTypeTrackingStep::loadStoreStep(_, _, fromProp, toProp)
+      }
+  }
+
+  /**
+   * INTERNAL: Use `SourceNode.track()` or `SourceNode.backtrack()` instead.
+   */
+  cached
+  predicate step(DataFlow::SourceNode pred, DataFlow::SourceNode succ, StepSummary summary) {
+    exists(DataFlow::Node mid | pred.flowsTo(mid) | StepSummary::smallstep(mid, succ, summary))
   }
 }
 
+import Cached::Public
+
 class OptionalPropertyName extends string {
   OptionalPropertyName() { this instanceof PropertyName or this = "" }
 }
 
-/**
- * A pseudo-property that can be used in type-tracking.
- */
-abstract class TypeTrackingPseudoProperty extends string {
-  bindingset[this]
-  TypeTrackingPseudoProperty() { any() }
-
-  /**
-   * Gets a property name that `this` can be copied to in a `LoadStoreStep(this, result)`.
-   */
-  string getLoadStoreToProp() { none() }
-}
-
-/**
- * A description of a step on an inter-procedural data flow path.
- */
-newtype TStepSummary =
-  LevelStep() or
-  CallStep() or
-  ReturnStep() or
-  StoreStep(PropertyName prop) or
-  LoadStep(PropertyName prop) or
-  CopyStep(PropertyName prop) or
-  LoadStoreStep(PropertyName fromProp, PropertyName toProp) {
-    exists(TypeTrackingPseudoProperty prop | fromProp = prop and toProp = prop.getLoadStoreToProp())
-  }
-
 /**
  * INTERNAL: Use `TypeTracker` or `TypeBackTracker` instead.
  *
@@ -75,10 +91,7 @@ module StepSummary {
   /**
    * INTERNAL: Use `SourceNode.track()` or `SourceNode.backtrack()` instead.
    */
-  cached
-  predicate step(DataFlow::SourceNode pred, DataFlow::SourceNode succ, StepSummary summary) {
-    exists(DataFlow::Node mid | pred.flowsTo(mid) | smallstep(mid, succ, summary))
-  }
+  predicate step = Cached::step/3;
 
   /**
    * INTERNAL: Use `TypeBackTracker.smallstep()` instead.
@@ -111,17 +124,22 @@ module StepSummary {
       basicLoadStep(pred, succ, prop) and
       summary = LoadStep(prop)
       or
-      any(AdditionalTypeTrackingStep st).storeStep(pred, succ, prop) and
+      SharedTypeTrackingStep::storeStep(pred, succ, prop) and
       summary = StoreStep(prop)
       or
-      any(AdditionalTypeTrackingStep st).loadStep(pred, succ, prop) and
+      SharedTypeTrackingStep::loadStep(pred, succ, prop) and
       summary = LoadStep(prop)
       or
-      any(AdditionalTypeTrackingStep st).loadStoreStep(pred, succ, prop) and
+      SharedTypeTrackingStep::loadStoreStep(pred, succ, prop) and
       summary = CopyStep(prop)
     )
     or
-    any(AdditionalTypeTrackingStep st).step(pred, succ) and
+    exists(string fromProp, string toProp |
+      SharedTypeTrackingStep::loadStoreStep(pred, succ, fromProp, toProp) and
+      summary = LoadStoreStep(fromProp, toProp)
+    )
+    or
+    SharedTypeTrackingStep::step(pred, succ) and
     summary = LevelStep()
     or
     // Store to global access path
diff --git a/javascript/ql/src/semmle/javascript/dataflow/internal/Unit.qll b/javascript/ql/src/semmle/javascript/dataflow/internal/Unit.qll
deleted file mode 100644
index 21018c2f60c..00000000000
--- a/javascript/ql/src/semmle/javascript/dataflow/internal/Unit.qll
+++ /dev/null
@@ -1,9 +0,0 @@
-private newtype TUnit = MkUnit()
-
-/**
- * A class with only one instance.
- */
-class Unit extends TUnit {
-  /** Gets a textual representation of this element. */
-  final string toString() { result = "Unit" }
-}
diff --git a/javascript/ql/src/semmle/javascript/dependencies/Dependencies.qll b/javascript/ql/src/semmle/javascript/dependencies/Dependencies.qll
index 76dee0a820d..a4766f7dc27 100644
--- a/javascript/ql/src/semmle/javascript/dependencies/Dependencies.qll
+++ b/javascript/ql/src/semmle/javascript/dependencies/Dependencies.qll
@@ -127,18 +127,22 @@ class ExternalNPMDependency extends NPMDependency {
     exists(PackageDependencies pkgdeps | this = pkgdeps.getPropValue(result))
   }
 
-  override string getVersion() {
+  private string getVersionNumber() {
     exists(string versionRange | versionRange = this.(JSONString).getValue() |
       // extract a concrete version from the version range; currently,
       // we handle exact versions as well as `<=`, `>=`, `~` and `^` ranges
       result = versionRange.regexpCapture("(?:[><]=|[=~^])?v?(\\d+(\\.\\d+){1,2})", 1)
-      or
-      // if no version is specified, report version `unknown`
-      result = "unknown" and
-      (versionRange = "" or versionRange = "*")
     )
   }
 
+  override string getVersion() {
+    result = getVersionNumber()
+    or
+    // if no version is specified or could not be parsed, report version `unknown`
+    not exists(getVersionNumber()) and
+    result = "unknown"
+  }
+
   override Import getAnImport() {
     exists(int depth | depth = importsDependency(result, getDeclaringPackage(), this) |
       // restrict to those results for which this is the closest matching dependency
diff --git a/javascript/ql/src/semmle/javascript/frameworks/AngularJS/ServiceDefinitions.qll b/javascript/ql/src/semmle/javascript/frameworks/AngularJS/ServiceDefinitions.qll
index efd54236029..fe7885b435e 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/AngularJS/ServiceDefinitions.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/AngularJS/ServiceDefinitions.qll
@@ -297,34 +297,29 @@ abstract private class CustomSpecialServiceDefinition extends CustomServiceDefin
 /**
  * Holds if `mce` defines a service of type `moduleMethodName` with name `serviceName` using the `factoryFunction` as the factory function.
  */
+bindingset[moduleMethodName]
 private predicate isCustomServiceDefinitionOnModule(
   DataFlow::CallNode mce, string moduleMethodName, string serviceName,
-  DataFlow::SourceNode factoryFunction
+  DataFlow::Node factoryArgument
 ) {
   mce = moduleRef(_).getAMethodCall(moduleMethodName) and
-  (
-    moduleMethodName = "controller" or
-    moduleMethodName = "filter" or
-    moduleMethodName = "directive" or
-    moduleMethodName = "component" or
-    moduleMethodName = "animation"
-  ) and
   mce.getArgument(0).asExpr().mayHaveStringValue(serviceName) and
-  factoryFunction.flowsTo(mce.getArgument(1))
+  factoryArgument = mce.getArgument(1)
 }
 
+pragma[inline]
 private predicate isCustomServiceDefinitionOnProvider(
   DataFlow::CallNode mce, string providerName, string providerMethodName, string serviceName,
-  DataFlow::SourceNode factoryFunction
+  DataFlow::Node factoryArgument
 ) {
   mce = builtinServiceRef(providerName).getAMethodCall(providerMethodName) and
   (
     mce.getNumArgument() = 1 and
-    factoryFunction.flowsTo(mce.getOptionArgument(0, serviceName))
+    factoryArgument = mce.getOptionArgument(0, serviceName)
     or
     mce.getNumArgument() = 2 and
     mce.getArgument(0).asExpr().mayHaveStringValue(serviceName) and
-    factoryFunction.flowsTo(mce.getArgument(1))
+    factoryArgument = mce.getArgument(1)
   )
 }
 
@@ -333,7 +328,7 @@ private predicate isCustomServiceDefinitionOnProvider(
  */
 class ControllerDefinition extends CustomSpecialServiceDefinition {
   string name;
-  DataFlow::SourceNode factoryFunction;
+  DataFlow::Node factoryFunction;
 
   ControllerDefinition() {
     isCustomServiceDefinitionOnModule(this, "controller", name, factoryFunction) or
@@ -343,9 +338,9 @@ class ControllerDefinition extends CustomSpecialServiceDefinition {
 
   override string getName() { result = name }
 
-  override DataFlow::SourceNode getAService() { result = factoryFunction }
+  override DataFlow::SourceNode getAService() { result = factoryFunction.getALocalSource() }
 
-  override DataFlow::SourceNode getAFactoryFunction() { result = factoryFunction }
+  override DataFlow::SourceNode getAFactoryFunction() { result = factoryFunction.getALocalSource() }
 }
 
 /**
@@ -353,7 +348,7 @@ class ControllerDefinition extends CustomSpecialServiceDefinition {
  */
 class FilterDefinition extends CustomSpecialServiceDefinition {
   string name;
-  DataFlow::SourceNode factoryFunction;
+  DataFlow::Node factoryFunction;
 
   FilterDefinition() {
     isCustomServiceDefinitionOnModule(this, "filter", name, factoryFunction) or
@@ -364,12 +359,12 @@ class FilterDefinition extends CustomSpecialServiceDefinition {
 
   override DataFlow::SourceNode getAService() {
     exists(InjectableFunction f |
-      f = factoryFunction and
+      f = factoryFunction.getALocalSource() and
       result.flowsToExpr(f.asFunction().getAReturnedExpr())
     )
   }
 
-  override DataFlow::SourceNode getAFactoryFunction() { result = factoryFunction }
+  override DataFlow::SourceNode getAFactoryFunction() { result = factoryFunction.getALocalSource() }
 }
 
 /**
@@ -377,7 +372,7 @@ class FilterDefinition extends CustomSpecialServiceDefinition {
  */
 class DirectiveDefinition extends CustomSpecialServiceDefinition {
   string name;
-  DataFlow::SourceNode factoryFunction;
+  DataFlow::Node factoryFunction;
 
   DirectiveDefinition() {
     isCustomServiceDefinitionOnModule(this, "directive", name, factoryFunction) or
@@ -393,7 +388,7 @@ class DirectiveDefinition extends CustomSpecialServiceDefinition {
     )
   }
 
-  override DataFlow::SourceNode getAFactoryFunction() { result = factoryFunction }
+  override DataFlow::SourceNode getAFactoryFunction() { result = factoryFunction.getALocalSource() }
 }
 
 private class CustomDirectiveControllerDependencyInjection extends DependencyInjection {
@@ -416,7 +411,7 @@ private class CustomDirectiveControllerDependencyInjection extends DependencyInj
  */
 class ComponentDefinition extends CustomSpecialServiceDefinition {
   string name;
-  DataFlow::SourceNode config;
+  DataFlow::Node config;
 
   ComponentDefinition() {
     isCustomServiceDefinitionOnModule(this, "component", name, config) or
@@ -435,7 +430,7 @@ class ComponentDefinition extends CustomSpecialServiceDefinition {
   override DataFlow::SourceNode getAFactoryFunction() { none() }
 
   /** Gets the configuration object for the defined component. */
-  DataFlow::SourceNode getConfig() { result = config }
+  DataFlow::SourceNode getConfig() { result = config.getALocalSource() }
 }
 
 /**
@@ -443,7 +438,7 @@ class ComponentDefinition extends CustomSpecialServiceDefinition {
  */
 class AnimationDefinition extends CustomSpecialServiceDefinition {
   string name;
-  DataFlow::SourceNode factoryFunction;
+  DataFlow::Node factoryFunction;
 
   AnimationDefinition() {
     isCustomServiceDefinitionOnModule(this, "animation", name, factoryFunction) or
@@ -454,12 +449,12 @@ class AnimationDefinition extends CustomSpecialServiceDefinition {
 
   override DataFlow::SourceNode getAService() {
     exists(InjectableFunction f |
-      f = factoryFunction and
+      f = factoryFunction.getALocalSource() and
       result.flowsToExpr(f.asFunction().getAReturnedExpr())
     )
   }
 
-  override DataFlow::SourceNode getAFactoryFunction() { result = factoryFunction }
+  override DataFlow::SourceNode getAFactoryFunction() { result = factoryFunction.getALocalSource() }
 }
 
 /**
@@ -500,7 +495,7 @@ private class LinkFunctionWithScopeInjection extends ServiceRequest {
 class InjectableFunctionServiceRequest extends ServiceRequest {
   InjectableFunction injectedFunction;
 
-  InjectableFunctionServiceRequest() { DataFlow::valueNode(this) = injectedFunction }
+  InjectableFunctionServiceRequest() { injectedFunction.getAstNode() = this }
 
   /**
    * Gets the function of this request.
@@ -589,7 +584,7 @@ class ServiceRecipeDefinition extends RecipeDefinition {
 
     exists(InjectableFunction f |
       f = getAFactoryFunction() and
-      result = DataFlow::valueNode(f.asFunction())
+      result.getAstNode() = f.asFunction()
     )
   }
 }
diff --git a/javascript/ql/src/semmle/javascript/frameworks/Babel.qll b/javascript/ql/src/semmle/javascript/frameworks/Babel.qll
index 4a66fdd6d10..bdacce9142b 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/Babel.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/Babel.qll
@@ -24,9 +24,9 @@ module Babel {
         plugins = getPropValue("plugins") and
         result = plugins.getElementValue(_)
       |
-        result.(JSONString).getValue() = pluginName
+        result.getStringValue() = pluginName
         or
-        result.(JSONArray).getElementStringValue(0) = pluginName
+        result.getElementValue(0).getStringValue() = pluginName
       )
     }
 
@@ -67,7 +67,7 @@ module Babel {
     JSONValue getOptions() { result = this.(JSONArray).getElementValue(1) }
 
     /** Gets a named option from the option object, if present. */
-    JSONValue getOption(string name) { result = getOptions().(JSONObject).getPropValue(name) }
+    JSONValue getOption(string name) { result = getOptions().getPropValue(name) }
 
     /** Holds if this plugin applies to `tl`. */
     predicate appliesTo(TopLevel tl) { cfg.appliesTo(tl) }
@@ -186,6 +186,22 @@ module Babel {
     TransformReactJsxConfig() { pluginName = "transform-react-jsx" }
 
     /** Gets the name of the variable used to create JSX elements. */
-    string getJsxFactoryVariableName() { result = getOption("pragma").(JSONString).getValue() }
+    string getJsxFactoryVariableName() { result = getOption("pragma").getStringValue() }
+  }
+
+  /**
+   * A taint step through a call to the Babel `transform` function.
+   */
+  private class TransformTaintStep extends TaintTracking::SharedTaintStep {
+    override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
+      exists(API::CallNode call |
+        call =
+          API::moduleImport(["@babel/standalone", "@babel/core"])
+              .getMember(["transform", "transformSync", "transformAsync"])
+              .getACall() and
+        pred = call.getArgument(0) and
+        succ = [call, call.getParameter(2).getParameter(0).getAnImmediateUse()]
+      )
+    }
   }
 }
diff --git a/javascript/ql/src/semmle/javascript/frameworks/ComposedFunctions.qll b/javascript/ql/src/semmle/javascript/frameworks/ComposedFunctions.qll
index 9e4de6cd4dc..8da2286ad79 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/ComposedFunctions.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/ComposedFunctions.qll
@@ -88,7 +88,7 @@ module FunctionCompositionCall {
     RightToLeft() {
       this = DataFlow::moduleImport(["compose-function"]).getACall()
       or
-      this = DataFlow::moduleMember(["redux", "ramda"], "compose").getACall()
+      this = DataFlow::moduleMember(["redux", "ramda", "@reduxjs/toolkit"], "compose").getACall()
       or
       this = LodashUnderscore::member("flowRight").getACall()
     }
diff --git a/javascript/ql/src/semmle/javascript/frameworks/EventEmitter.qll b/javascript/ql/src/semmle/javascript/frameworks/EventEmitter.qll
index 4db64ad0ab7..f044d69524d 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/EventEmitter.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/EventEmitter.qll
@@ -194,26 +194,22 @@ module EventDispatch {
 }
 
 /**
- * A taint-step that models data-flow between event handlers and event dispatchers.
+ * A flow-step that models data-flow between event handlers and event dispatchers.
  */
-private class EventEmitterTaintStep extends DataFlow::AdditionalFlowStep {
-  EventRegistration reg;
-  EventDispatch dispatch;
-
-  EventEmitterTaintStep() {
-    this = dispatch and
-    reg = dispatch.getAReceiver() and
-    not dispatch.getChannel() != reg.getChannel()
-  }
-
+private class EventEmitterFlowStep extends DataFlow::SharedFlowStep {
   override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
-    exists(int i | i >= 0 |
-      pred = dispatch.getSentItem(i) and
-      succ = reg.getReceivedItem(i)
+    exists(EventRegistration reg, EventDispatch dispatch |
+      reg = dispatch.getAReceiver() and
+      not dispatch.getChannel() != reg.getChannel()
+    |
+      exists(int i | i >= 0 |
+        pred = dispatch.getSentItem(i) and
+        succ = reg.getReceivedItem(i)
+      )
+      or
+      dispatch = reg.getAReturnDispatch() and
+      pred = reg.getAReturnedValue() and
+      succ = dispatch
     )
-    or
-    dispatch = reg.getAReturnDispatch() and
-    pred = reg.getAReturnedValue() and
-    succ = dispatch
   }
 }
diff --git a/javascript/ql/src/semmle/javascript/frameworks/Express.qll b/javascript/ql/src/semmle/javascript/frameworks/Express.qll
index bd1249e9268..17bfed8afda 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/Express.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/Express.qll
@@ -688,8 +688,7 @@ module Express {
     override RouteHandler getRouteHandler() { result = rh }
 
     override Expr getNameExpr() {
-      exists(DataFlow::PropWrite write |
-        getAHeaderSource().flowsTo(write.getBase()) and
+      exists(DataFlow::PropWrite write | getAHeaderSource().getAPropertyWrite() = write |
         result = write.getPropertyNameExpr()
       )
     }
diff --git a/javascript/ql/src/semmle/javascript/frameworks/Fastify.qll b/javascript/ql/src/semmle/javascript/frameworks/Fastify.qll
index cca2ec8122b..3e96cea462c 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/Fastify.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/Fastify.qll
@@ -283,8 +283,7 @@ module Fastify {
     override RouteHandler getRouteHandler() { result = rh }
 
     override Expr getNameExpr() {
-      exists(DataFlow::PropWrite write |
-        this.getAHeaderSource().flowsTo(write.getBase()) and
+      exists(DataFlow::PropWrite write | getAHeaderSource().getAPropertyWrite() = write |
         result = write.getPropertyNameExpr()
       )
     }
diff --git a/javascript/ql/src/semmle/javascript/frameworks/HTTP.qll b/javascript/ql/src/semmle/javascript/frameworks/HTTP.qll
index 225c9b2de53..435ea94fd72 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/HTTP.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/HTTP.qll
@@ -6,6 +6,7 @@ import javascript
 private import semmle.javascript.DynamicPropertyAccess
 private import semmle.javascript.dataflow.internal.StepSummary
 private import semmle.javascript.dataflow.internal.CallGraphs
+private import DataFlow::PseudoProperties as PseudoProperties
 
 module HTTP {
   /**
@@ -689,33 +690,30 @@ module HTTP {
       isDecoratedCall(result, candidate)
     }
 
+    private string mapValueProp() {
+      result = [PseudoProperties::mapValueAll(), PseudoProperties::mapValueUnknownKey()]
+    }
+
     /**
      * A collection that contains one or more route potential handlers.
      */
-    private class ContainerCollection extends HTTP::RouteHandlerCandidateContainer::Range {
+    private class ContainerCollection extends HTTP::RouteHandlerCandidateContainer::Range,
+      DataFlow::NewNode {
       ContainerCollection() {
         this = DataFlow::globalVarRef("Map").getAnInstantiation() and // restrict to Map for now
-        exists(
-          CollectionFlowStep store, DataFlow::Node storeTo, DataFlow::Node input,
-          RouteHandlerCandidate candidate
-        |
-          this.flowsTo(storeTo) and
-          store.store(input, storeTo, _) and
-          candidate.flowsTo(input)
+        exists(DataFlow::Node use |
+          DataFlow::SharedTypeTrackingStep::storeStep(use, this, mapValueProp()) and
+          use.getALocalSource() instanceof RouteHandlerCandidate
         )
       }
 
       override DataFlow::SourceNode getRouteHandler(DataFlow::SourceNode access) {
-        result instanceof RouteHandlerCandidate and
-        exists(
-          DataFlow::Node input, TypeTrackingPseudoProperty key, CollectionFlowStep store,
-          CollectionFlowStep load, DataFlow::Node storeTo, DataFlow::Node loadFrom
-        |
-          this.flowsTo(storeTo) and
-          store.store(input, storeTo, key) and
+        exists(DataFlow::Node input, string key, DataFlow::Node loadFrom |
           getAPossiblyDecoratedHandler(result).flowsTo(input) and
+          DataFlow::SharedTypeTrackingStep::storeStep(input, this, key) and
           ref(this).flowsTo(loadFrom) and
-          load.load(loadFrom, access, key)
+          DataFlow::SharedTypeTrackingStep::loadStep(loadFrom, access,
+            [key, PseudoProperties::mapValueAll()])
         )
       }
     }
diff --git a/javascript/ql/src/semmle/javascript/frameworks/Immutable.qll b/javascript/ql/src/semmle/javascript/frameworks/Immutable.qll
index 16cf7de2cc0..c039199bbd4 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/Immutable.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/Immutable.qll
@@ -164,22 +164,15 @@ private module Immutable {
   /**
    * A dataflow step for an immutable collection.
    */
-  class ImmutableConstructionStep extends DataFlow::AdditionalFlowStep {
-    ImmutableConstructionStep() { this = [loadStep(_, _), storeStep(_, _), step(_)] }
-
+  class ImmutableConstructionStep extends DataFlow::SharedFlowStep {
     override predicate loadStep(DataFlow::Node pred, DataFlow::Node succ, string prop) {
-      this = loadStep(pred, prop) and
-      succ = this
+      succ = loadStep(pred, prop)
     }
 
     override predicate storeStep(DataFlow::Node pred, DataFlow::SourceNode succ, string prop) {
-      this = storeStep(pred, prop) and
-      succ = this
+      succ = storeStep(pred, prop)
     }
 
-    override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
-      this = step(pred) and
-      succ = this
-    }
+    override predicate step(DataFlow::Node pred, DataFlow::Node succ) { succ = step(pred) }
   }
 }
diff --git a/javascript/ql/src/semmle/javascript/frameworks/Koa.qll b/javascript/ql/src/semmle/javascript/frameworks/Koa.qll
index 325afacea10..59d256cdba2 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/Koa.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/Koa.qll
@@ -36,18 +36,11 @@ module Koa {
   /**
    * A Koa route handler.
    */
-  class RouteHandler extends HTTP::Servers::StandardRouteHandler, DataFlow::ValueNode {
-    Function function;
-
-    RouteHandler() {
-      function = astNode and
-      any(RouteSetup setup).getARouteHandler() = this
-    }
-
+  abstract class RouteHandler extends HTTP::Servers::StandardRouteHandler, DataFlow::SourceNode {
     /**
      * Gets the parameter of the route handler that contains the context object.
      */
-    Parameter getContextParameter() { result = function.getParameter(0) }
+    Parameter getContextParameter() { result = getAFunctionValue().getFunction().getParameter(0) }
 
     /**
      * Gets an expression that contains the "context" object of
@@ -70,6 +63,35 @@ module Koa {
      * object of a route handler invocation.
      */
     Expr getARequestOrContextExpr() { result = getARequestExpr() or result = getAContextExpr() }
+
+    /**
+     * Gets a reference to a request parameter defined by this route handler.
+     */
+    DataFlow::Node getARequestParameterAccess() {
+      none() // overriden in subclasses.
+    }
+
+    /**
+     * Gets a dataflow node that can be given to a `RouteSetup` to register the handler.
+     */
+    abstract DataFlow::SourceNode getARouteHandlerRegistrationObject();
+  }
+
+  /**
+   * A koa route handler registered directly with a route-setup.
+   * Like:
+   * ```JavaScript
+   * var route = require('koa-route');
+   * var app = new Koa();
+   * app.use((context, next) => {
+   *     ...
+   * });
+   * ```
+   */
+  private class StandardRouteHandler extends RouteHandler {
+    StandardRouteHandler() { any(RouteSetup setup).getARouteHandler() = this }
+
+    override DataFlow::SourceNode getARouteHandlerRegistrationObject() { result = this }
   }
 
   /**
@@ -100,6 +122,77 @@ module Koa {
     }
   }
 
+  /**
+   * A Koa route handler registered using a routing library.
+   *
+   * Example of what that could look like:
+   * ```JavaScript
+   * const router = require('koa-router')();
+   * const Koa = require('koa');
+   * const app = new Koa();
+   * router.get('/', async (ctx, next) => {
+   *    // route handler stuff
+   * });
+   * app.use(router.routes());
+   * ```
+   */
+  private class RoutedRouteHandler extends RouteHandler {
+    DataFlow::InvokeNode router;
+    DataFlow::MethodCallNode call;
+
+    RoutedRouteHandler() {
+      router = DataFlow::moduleImport(["@koa/router", "koa-router"]).getAnInvocation() and
+      call =
+        router
+            .getAChainedMethodCall([
+                "use", "get", "post", "put", "link", "unlink", "delete", "del", "head", "options",
+                "patch", "all"
+              ]) and
+      this.flowsTo(call.getArgument(any(int i | i >= 1)))
+    }
+
+    override DataFlow::SourceNode getARouteHandlerRegistrationObject() {
+      result = call
+      or
+      result = router.getAMethodCall("routes")
+    }
+  }
+
+  /**
+   * A route handler registered using the `koa-route` library.
+   *
+   * Example of how `koa-route` can be used:
+   * ```JavaScript
+   * var route = require('koa-route');
+   * var Koa = require('koa');
+   * var app = new Koa();
+   *
+   * app.use(route.get('/pets', (context, param1, param2, param3, ...params) => {
+   *    // route handler stuff
+   * }));
+   */
+  class KoaRouteHandler extends RouteHandler {
+    DataFlow::CallNode call;
+
+    KoaRouteHandler() {
+      call =
+        DataFlow::moduleMember("koa-route",
+          [
+            "all", "acl", "bind", "checkout", "connect", "copy", "delete", "del", "get", "head",
+            "link", "lock", "msearch", "merge", "mkactivity", "mkcalendar", "mkcol", "move",
+            "notify", "options", "patch", "post", "propfind", "proppatch", "purge", "put", "rebind",
+            "report", "search", "subscribe", "trace", "unbind", "unlink", "unlock", "unsubscribe"
+          ]).getACall() and
+      this.flowsTo(call.getArgument(1))
+    }
+
+    override DataFlow::Node getARequestParameterAccess() {
+      result = call.getABoundCallbackParameter(1, any(int i | i >= 1))
+    }
+
+    override DataFlow::SourceNode getARouteHandlerRegistrationObject() { result = call }
+  }
+
   /**
    * A Koa request source, that is, an access to the `request` property
    * of a context object.
@@ -189,6 +282,9 @@ module Koa {
       kind = "parameter" and
       this = getAQueryParameterAccess(rh)
       or
+      kind = "parameter" and
+      this = rh.getARequestParameterAccess()
+      or
       exists(Expr e | rh.getARequestOrContextExpr() = e |
         // `ctx.request.url`, `ctx.request.originalUrl`, or `ctx.request.href`
         exists(string propName |
@@ -202,6 +298,10 @@ module Koa {
           propName = "href"
         )
         or
+        // params, when handler is registered by `koa-router` or similar.
+        kind = "parameter" and
+        this.asExpr().(PropAccess).accesses(e, "params")
+        or
         // `ctx.request.body`
         e instanceof RequestExpr and
         kind = "body" and
@@ -285,7 +385,13 @@ module Koa {
       getMethodName() = "use"
     }
 
-    override DataFlow::SourceNode getARouteHandler() { result.flowsToExpr(getArgument(0)) }
+    override DataFlow::SourceNode getARouteHandler() {
+      // `StandardRouteHandler` uses this predicate in it's charpred, so making this predicate return a `RouteHandler` would give an empty recursion.
+      result.flowsToExpr(getArgument(0))
+      or
+      // For the route-handlers that does not depend on this predicate in their charpred.
+      result.(RouteHandler).getARouteHandlerRegistrationObject().flowsToExpr(getArgument(0))
+    }
 
     override Expr getServer() { result = server }
   }
diff --git a/javascript/ql/src/semmle/javascript/frameworks/LodashUnderscore.qll b/javascript/ql/src/semmle/javascript/frameworks/LodashUnderscore.qll
index 49bb8806fe7..c05dbc3a8d6 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/LodashUnderscore.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/LodashUnderscore.qll
@@ -21,11 +21,9 @@ module LodashUnderscore {
     string name;
 
     DefaultMember() {
-      this = DataFlow::moduleMember("underscore", name)
+      this = DataFlow::moduleMember(["underscore", "lodash", "lodash-es"], name)
       or
-      this = DataFlow::moduleMember("lodash", name)
-      or
-      this = DataFlow::moduleImport("lodash/" + name)
+      this = DataFlow::moduleImport(["lodash/", "lodash-es/"] + name)
       or
       this = DataFlow::moduleImport("lodash." + name.toLowerCase()) and isLodashMember(name)
       or
@@ -360,9 +358,9 @@ module LodashUnderscore {
   /**
    * A data flow step propagating an exception thrown from a callback to a Lodash/Underscore function.
    */
-  private class ExceptionStep extends DataFlow::CallNode, DataFlow::AdditionalFlowStep {
-    ExceptionStep() {
-      exists(string name | this = member(name).getACall() |
+  private class ExceptionStep extends DataFlow::SharedFlowStep {
+    override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
+      exists(DataFlow::CallNode call, string name |
         // Members ending with By, With, or While indicate that they are a variant of
         // another function that takes a callback.
         name.matches("%By") or
@@ -386,13 +384,12 @@ module LodashUnderscore {
         name = "replace" or
         name = "some" or
         name = "transform"
+      |
+        call = member(name).getACall() and
+        pred = call.getAnArgument().(DataFlow::FunctionNode).getExceptionalReturn() and
+        succ = call.getExceptionalReturn()
       )
     }
-
-    override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
-      pred = getAnArgument().(DataFlow::FunctionNode).getExceptionalReturn() and
-      succ = this.getExceptionalReturn()
-    }
   }
 
   /**
diff --git a/javascript/ql/src/semmle/javascript/frameworks/Next.qll b/javascript/ql/src/semmle/javascript/frameworks/Next.qll
index 27f85924f16..3ad0486e805 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/Next.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/Next.qll
@@ -126,37 +126,28 @@ module NextJS {
   /**
    * A step modelling the flow from the server-computed props object to the default exported function that renders the page.
    */
-  class NextJSStaticPropsStep extends DataFlow::AdditionalFlowStep, DataFlow::FunctionNode {
-    Module pageModule;
-
-    NextJSStaticPropsStep() {
-      pageModule = getAPagesModule() and
-      this = pageModule.getAnExportedValue("default").getAFunctionValue()
-    }
-
+  class NextJSStaticPropsStep extends DataFlow::SharedFlowStep {
     override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
-      pred = getAPropsSource(pageModule) and
-      succ = this.getParameter(0)
+      exists(Module pageModule, DataFlow::FunctionNode function |
+        pageModule = getAPagesModule() and
+        function = pageModule.getAnExportedValue("default").getAFunctionValue() and
+        pred = getAPropsSource(pageModule) and
+        succ = function.getParameter(0)
+      )
     }
   }
 
   /**
    * A step modelling the flow from the server-computed props object to the default exported React component that renders the page.
    */
-  class NextJSStaticReactComponentPropsStep extends DataFlow::AdditionalFlowStep,
-    DataFlow::ValueNode {
-    Module pageModule;
-    ReactComponent component;
-
-    NextJSStaticReactComponentPropsStep() {
-      pageModule = getAPagesModule() and
-      this.getAstNode() = component and
-      this = pageModule.getAnExportedValue("default").getALocalSource()
-    }
-
+  class NextJSStaticReactComponentPropsStep extends DataFlow::SharedFlowStep {
     override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
-      pred = getAPropsSource(pageModule) and
-      succ = component.getADirectPropsAccess()
+      exists(Module pageModule, ReactComponent component |
+        pageModule = getAPagesModule() and
+        pageModule.getAnExportedValue("default").getALocalSource() = DataFlow::valueNode(component) and
+        pred = getAPropsSource(pageModule) and
+        succ = component.getADirectPropsAccess()
+      )
     }
   }
 
diff --git a/javascript/ql/src/semmle/javascript/frameworks/NodeJSLib.qll b/javascript/ql/src/semmle/javascript/frameworks/NodeJSLib.qll
index d05c2194c94..bb9b0870a8b 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/NodeJSLib.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/NodeJSLib.qll
@@ -478,6 +478,28 @@ module NodeJSLib {
               DataFlow::moduleImport("util-promisifyall")
             ].getACall()
         )
+        or
+        // const fs = require('fs');
+        // let fs_copy = methods.reduce((obj, method) => {
+        //  obj[method] = fs[method];
+        //  return obj;
+        // }, {});
+        t.continue() = t2 and
+        exists(
+          DataFlow::MethodCallNode call, DataFlow::ParameterNode obj, DataFlow::SourceNode method
+        |
+          call.getMethodName() = "reduce" and
+          result = call and
+          obj = call.getABoundCallbackParameter(0, 0) and
+          obj.flowsTo(any(DataFlow::FunctionNode f).getAReturn()) and
+          exists(DataFlow::PropWrite write, DataFlow::PropRead read |
+            write = obj.getAPropertyWrite() and
+            method.flowsToExpr(write.getPropertyNameExpr()) and
+            method.flowsToExpr(read.getPropertyNameExpr()) and
+            read.getBase().getALocalSource() = fsModule(t2) and
+            write.getRhs() = maybePromisified(read)
+          )
+        )
       )
     }
   }
@@ -646,8 +668,6 @@ module NodeJSLib {
     }
   }
 
-  private import semmle.javascript.PackageExports as Exports
-
   /**
    * A direct step from an named export to a property-read reading the exported value.
    */
diff --git a/javascript/ql/src/semmle/javascript/frameworks/PropertyProjection.qll b/javascript/ql/src/semmle/javascript/frameworks/PropertyProjection.qll
index 1217c8de3db..e3fe62be164 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/PropertyProjection.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/PropertyProjection.qll
@@ -75,10 +75,6 @@ private DataFlow::SourceNode getASimplePropertyProjectionCallee(
 ) {
   singleton = false and
   (
-    result = LodashUnderscore::member("pick") and
-    objectIndex = 0 and
-    selectorIndex = [1 .. max(result.getACall().getNumArgument())]
-    or
     result = LodashUnderscore::member("pickBy") and
     objectIndex = 0 and
     selectorIndex = 1
@@ -131,6 +127,19 @@ private class SimplePropertyProjection extends PropertyProjection::Range {
   override predicate isSingletonProjection() { singleton = true }
 }
 
+/**
+ * A property projection with a variable number of selector indices.
+ */
+private class VarArgsPropertyProjection extends PropertyProjection::Range {
+  VarArgsPropertyProjection() { this = LodashUnderscore::member("pick").getACall() }
+
+  override DataFlow::Node getObject() { result = getArgument(0) }
+
+  override DataFlow::Node getASelector() { result = getArgument(any(int i | i > 0)) }
+
+  override predicate isSingletonProjection() { none() }
+}
+
 /**
  * A taint step for a property projection.
  */
diff --git a/javascript/ql/src/semmle/javascript/frameworks/Puppeteer.qll b/javascript/ql/src/semmle/javascript/frameworks/Puppeteer.qll
new file mode 100644
index 00000000000..84c2351b600
--- /dev/null
+++ b/javascript/ql/src/semmle/javascript/frameworks/Puppeteer.qll
@@ -0,0 +1,95 @@
+/**
+ * Provides classes and predicates for reasoning about [puppeteer](https://www.npmjs.com/package/puppeteer).
+ */
+
+import javascript
+
+/**
+ * Classes and predicates modelling the [puppeteer](https://www.npmjs.com/package/puppeteer) library.
+ */
+module Puppeteer {
+  /**
+   * A reference to a module import of puppeteer.
+   */
+  private API::Node puppeteer() { result = API::moduleImport(["puppeteer", "puppeteer-core"]) }
+
+  /**
+   * A reference to a `Browser` from puppeteer.
+   */
+  private API::Node browser() {
+    result = API::Node::ofType("puppeteer", "Browser")
+    or
+    result = puppeteer().getMember(["launch", "connect"]).getReturn().getPromised()
+    or
+    result = [page(), context(), target()].getMember("browser").getReturn()
+  }
+
+  /**
+   * A reference to a `Page` from puppeteer.
+   */
+  API::Node page() {
+    result = API::Node::ofType("puppeteer", "Page")
+    or
+    result = [browser(), context()].getMember("newPage").getReturn().getPromised()
+    or
+    result = [browser(), context()].getMember("pages").getReturn().getPromised().getUnknownMember()
+    or
+    result = target().getMember("page").getReturn().getPromised()
+  }
+
+  /**
+   * A reference to a `Target` from puppeteer.
+   */
+  private API::Node target() {
+    result = API::Node::ofType("puppeteer", "Target")
+    or
+    result = [page(), browser()].getMember("target").getReturn()
+    or
+    result = context().getMember("targets").getReturn().getUnknownMember()
+    or
+    result = target().getMember("opener").getReturn()
+  }
+
+  /**
+   * A reference to a `BrowserContext` from puppeteer.
+   */
+  private API::Node context() {
+    result = API::Node::ofType("puppeteer", "BrowserContext")
+    or
+    result = [page(), target()].getMember("browserContext").getReturn()
+    or
+    result = browser().getMember("browserContexts").getReturn().getUnknownMember()
+    or
+    result = browser().getMember("createIncognitoBrowserContext").getReturn().getPromised()
+    or
+    result = browser().getMember("defaultBrowserContext").getReturn()
+  }
+
+  /**
+   * A call requesting a `Page` to navigate to some url, seen as a `ClientRequest`.
+   */
+  private class PuppeteerGotoCall extends ClientRequest::Range, API::InvokeNode {
+    PuppeteerGotoCall() { this = page().getMember("goto").getACall() }
+
+    override DataFlow::Node getUrl() { result = getArgument(0) }
+
+    override DataFlow::Node getHost() { none() }
+
+    override DataFlow::Node getADataNode() { none() }
+  }
+
+  /**
+   * A call requesting a `Page` to load a stylesheet or script, seen as a `ClientRequest`.
+   */
+  private class PuppeteerLoadResourceCall extends ClientRequest::Range, API::InvokeNode {
+    PuppeteerLoadResourceCall() {
+      this = page().getMember(["addStyleTag", "addScriptTag"]).getACall()
+    }
+
+    override DataFlow::Node getUrl() { result = getParameter(0).getMember("url").getARhs() }
+
+    override DataFlow::Node getHost() { none() }
+
+    override DataFlow::Node getADataNode() { none() }
+  }
+}
diff --git a/javascript/ql/src/semmle/javascript/frameworks/React.qll b/javascript/ql/src/semmle/javascript/frameworks/React.qll
index 5adbcaeab14..784bd03a29c 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/React.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/React.qll
@@ -691,15 +691,22 @@ private DataFlow::SourceNode reactRouterDom() {
   result = DataFlow::moduleImport("react-router-dom")
 }
 
+private DataFlow::SourceNode reactRouterMatchObject() {
+  result = reactRouterDom().getAMemberCall(["useRouteMatch", "matchPath"])
+  or
+  exists(ReactComponent c |
+    dependedOnByReactRouterClient(c.getTopLevel()) and
+    result = c.getAPropRead("match")
+  )
+}
+
 private class ReactRouterSource extends ClientSideRemoteFlowSource {
   ClientSideRemoteFlowKind kind;
 
   ReactRouterSource() {
     this = reactRouterDom().getAMemberCall("useParams") and kind.isPath()
     or
-    exists(string prop |
-      this = reactRouterDom().getAMemberCall("useRouteMatch").getAPropertyRead(prop)
-    |
+    exists(string prop | this = reactRouterMatchObject().getAPropertyRead(prop) |
       prop = "params" and kind.isPath()
       or
       prop = "url" and kind.isUrl()
@@ -713,9 +720,6 @@ private class ReactRouterSource extends ClientSideRemoteFlowSource {
 
 /**
  * Holds if `mod` transitively depends on `react-router-dom`.
- *
- * We assume any React component in such a file may be used in a context where react-router
- * injects the `location` property in its `props` object.
  */
 private predicate dependsOnReactRouter(Module mod) {
   mod.getAnImport().getImportedPath().getValue() = "react-router-dom"
@@ -723,6 +727,18 @@ private predicate dependsOnReactRouter(Module mod) {
   dependsOnReactRouter(mod.getAnImportedModule())
 }
 
+/**
+ * Holds if `mod` is imported from a module that transitively depends on `react-router-dom`.
+ *
+ * We assume any React component in such a file may be used in a context where react-router
+ * injects the `location` and `match` properties in its `props` object.
+ */
+private predicate dependedOnByReactRouterClient(Module mod) {
+  dependsOnReactRouter(mod)
+  or
+  dependedOnByReactRouterClient(any(Module m | m.getAnImportedModule() = mod))
+}
+
 /**
  * A reference to the DOM location obtained through `react-router-dom`
  *
@@ -740,7 +756,7 @@ private class ReactRouterLocationSource extends DOM::LocationSource::Range {
     this = reactRouterDom().getAMemberCall("useLocation")
     or
     exists(ReactComponent component |
-      dependsOnReactRouter(component.getTopLevel()) and
+      dependedOnByReactRouterClient(component.getTopLevel()) and
       this = component.getAPropRead("location")
     )
   }
@@ -759,6 +775,8 @@ private DataFlow::SourceNode higherOrderComponentBuilder() {
   or
   result = DataFlow::moduleMember(["react-hot-loader", "react-hot-loader/root"], "hot").getACall()
   or
+  result = DataFlow::moduleMember("redux-form", "reduxForm").getACall()
+  or
   result = reactRouterDom().getAPropertyRead("withRouter")
   or
   exists(FunctionCompositionCall compose |
diff --git a/javascript/ql/src/semmle/javascript/frameworks/Redux.qll b/javascript/ql/src/semmle/javascript/frameworks/Redux.qll
new file mode 100644
index 00000000000..ad3f985c397
--- /dev/null
+++ b/javascript/ql/src/semmle/javascript/frameworks/Redux.qll
@@ -0,0 +1,1246 @@
+/**
+ * Provides classes and predicates for reasoning about data flow through the redux package.
+ */
+
+import javascript
+private import semmle.javascript.dataflow.internal.PreCallGraphStep
+private import semmle.javascript.Unit
+
+/**
+ * Provides classes and predicates for reasoning about data flow through the redux package.
+ */
+module Redux {
+  /**
+   * To avoid mixing up the state between independent Redux apps that live in a monorepo,
+   * we do a heuristic program slicing based on `package.json` files. For most projects this has no effect.
+   */
+  private module ProgramSlicing {
+    /** Gets the innermost `package.json` file in a directory containing the given file. */
+    private PackageJSON getPackageJson(Container f) {
+      f = result.getFile().getParentContainer()
+      or
+      not exists(f.getFile("package.json")) and
+      result = getPackageJson(f.getParentContainer())
+    }
+
+    private predicate packageDependsOn(PackageJSON importer, PackageJSON dependency) {
+      importer.getADependenciesObject("").getADependency(dependency.getPackageName(), _)
+    }
+
+    /** A package that can be considered an entry point for a Redux app. */
+    private PackageJSON entryPointPackage() {
+      result = getPackageJson(any(StoreCreation c).getFile())
+      or
+      // Any package that imports a store-creating package is considered a potential entry point.
+      packageDependsOn(result, entryPointPackage())
+    }
+
+    pragma[nomagic]
+    private predicate arePackagesInSameReduxApp(PackageJSON a, PackageJSON b) {
+      exists(PackageJSON entry |
+        entry = entryPointPackage() and
+        packageDependsOn*(entry, a) and
+        packageDependsOn*(entry, b)
+      )
+    }
+
+    /** Holds if the two files are considered to be part of the same Redux app. */
+    pragma[inline]
+    predicate areFilesInSameReduxApp(File a, File b) {
+      not exists(PackageJSON pkg)
+      or
+      arePackagesInSameReduxApp(getPackageJson(a), getPackageJson(b))
+    }
+  }
+
+  /**
+   * Creation of a redux store, usually via a call to `createStore`.
+   */
+  class StoreCreation extends DataFlow::SourceNode {
+    StoreCreation::Range range;
+
+    StoreCreation() { this = range }
+
+    /** Gets a reference to the store. */
+    DataFlow::SourceNode ref() { result = asApiNode().getAUse() }
+
+    /** Gets an API node that refers to this store creation. */
+    API::Node asApiNode() { result.getAnImmediateUse() = this }
+
+    /** Gets the data flow node holding the root reducer for this store. */
+    DataFlow::Node getReducerArg() { result = range.getReducerArg() }
+
+    /** Gets a data flow node referring to the root reducer. */
+    DataFlow::SourceNode getAReducerSource() { result = getReducerArg().(ReducerArg).getASource() }
+  }
+
+  /** Companion module to the `StoreCreation` class. */
+  module StoreCreation {
+    /**
+     * Creation of a redux store. Additional `StoreCreation` instances can be generated by subclassing this class.
+     */
+    abstract class Range extends DataFlow::SourceNode {
+      /** Gets the data flow node holding the root reducer for this store. */
+      abstract DataFlow::Node getReducerArg();
+    }
+
+    private class CreateStore extends DataFlow::CallNode, Range {
+      CreateStore() {
+        this = API::moduleImport(["redux", "@reduxjs/toolkit"]).getMember("createStore").getACall()
+      }
+
+      override DataFlow::Node getReducerArg() { result = getArgument(0) }
+    }
+
+    private class ToolkitStore extends API::CallNode, Range {
+      ToolkitStore() {
+        this = API::moduleImport("@reduxjs/toolkit").getMember("configureStore").getACall()
+      }
+
+      override DataFlow::Node getReducerArg() {
+        result = getParameter(0).getMember("reducer").getARhs()
+      }
+    }
+  }
+
+  /** An API node that is a source of the Redux root state. */
+  abstract private class RootStateSource extends API::Node { }
+
+  /** Gets an API node referring to the Redux root state. */
+  private API::Node rootState() {
+    result instanceof RootStateSource
+    or
+    stateStep(rootState().getAUse(), result.getAnImmediateUse())
+  }
+
+  /**
+   * Gets an API node referring to the given (non-empty) access path within the Redux state.
+   */
+  private API::Node rootStateAccessPath(string accessPath) {
+    result = rootState().getMember(accessPath)
+    or
+    exists(string base, string prop |
+      result = rootStateAccessPath(base).getMember(prop) and
+      accessPath = joinAccessPaths(base, prop)
+    )
+    or
+    stateStep(rootStateAccessPath(accessPath).getAUse(), result.getAnImmediateUse())
+  }
+
+  /**
+   * Combines two state access paths, while disallowing unbounded growth of access paths.
+   */
+  bindingset[base, prop]
+  private string joinAccessPaths(string base, string prop) {
+    result = base + "." + prop and
+    // Allow at most two occurrences of a given property name in the path
+    // (one in the base, plus the one we're appending now).
+    count(base.indexOf("." + prop + ".")) <= 1
+  }
+
+  /**
+   * Creation of a reducer function that delegates to one or more other reducer functions.
+   *
+   * Delegating reducers can delegate specific parts of the state object (`getStateHandlerArg`),
+   * actions of a specific type (`getActionHandlerArg`), or everything (`getAPlainHandlerArg`).
+   */
+  abstract class DelegatingReducer extends DataFlow::SourceNode {
+    /**
+     * Gets a data flow node holding a reducer to which handling of `state.prop` is delegated.
+     *
+     * For example, gets the `fn` in `combineReducers({foo: fn})` with `prop` bound to `foo`.
+     *
+     * The delegating reducer should behave as a function of this form:
+     * ```js
+     * function outer(state, action) {
+     *   return {
+     *     prop: inner(state.prop, action),
+     *     ...
+     *   }
+     * }
+     * ```
+     */
+    DataFlow::Node getStateHandlerArg(string prop) { none() }
+
+    /**
+     * Gets a data flow node holding a reducer to which actions of the given type are delegated.
+     *
+     * For example, gets the `fn` in `handleAction(a, fn)` with `actionType` bound to `a`.
+     *
+     * The `actionType` node may refer an action creator or a string value corresponding to `action.type`.
+     */
+    DataFlow::Node getActionHandlerArg(DataFlow::Node actionType) { none() }
+
+    /**
+     * Gets a data flow node holding a reducer to which every request is forwarded (for the
+     * purpose of this model).
+     *
+     * For example, gets the `fn` in `persistReducer(config, fn)`.
+     */
+    DataFlow::Node getAPlainHandlerArg() { none() }
+
+    /** Gets the use site of this reducer. */
+    final ReducerArg getUseSite() { result.getASource() = this }
+  }
+
+  private module DelegatingReducer {
+    private API::Node combineReducers() {
+      result =
+        API::moduleImport(["redux", "redux-immutable", "@reduxjs/toolkit"])
+            .getMember("combineReducers")
+    }
+
+    /**
+     * A call to `combineReducers`, which delegates properties of `state` to individual sub-reducers.
+     */
+    private class CombineReducers extends API::CallNode, DelegatingReducer {
+      CombineReducers() { this = combineReducers().getACall() }
+
+      override DataFlow::Node getStateHandlerArg(string prop) {
+        result = getParameter(0).getMember(prop).getARhs()
+      }
+    }
+
+    /**
+     * An object literal flowing into a nested property in a `combineReducers` object, such as the `{ bar }` object in:
+     * ```js
+     * combineReducers({ foo: { bar } })
+     * ```
+     *
+     * Although the object itself is clearly not a function, we use the object to model the corresponding reducer function created by `combineReducers`.
+     */
+    private class NestedCombineReducers extends DelegatingReducer, DataFlow::ObjectLiteralNode {
+      NestedCombineReducers() {
+        this = combineReducers().getParameter(0).getAMember+().getAValueReachingRhs()
+      }
+
+      override DataFlow::Node getStateHandlerArg(string prop) {
+        result = getAPropertyWrite(prop).getRhs()
+      }
+    }
+
+    /**
+     * A call to `handleActions`, creating a reducer function that dispatched based on the action type:
+     *
+     * ```js
+     * let reducer = handleActions({
+     *   actionType1: (state, action) => { ... },
+     *   actionType2: (state, action) => { ... },
+     * })
+     * ```
+     */
+    private class HandleActions extends API::CallNode, DelegatingReducer {
+      HandleActions() {
+        this =
+          API::moduleImport(["redux-actions", "redux-ts-utils"])
+              .getMember("handleActions")
+              .getACall()
+      }
+
+      override DataFlow::Node getActionHandlerArg(DataFlow::Node actionType) {
+        exists(DataFlow::PropWrite write |
+          result = getParameter(0).getAMember().getARhs() and
+          write.getRhs() = result and
+          actionType = write.getPropertyNameExpr().flow()
+        )
+      }
+    }
+
+    /**
+     * A call to `handleAction`, creating a reducer function that only handles a given action type:
+     *
+     * ```js
+     * let reducer = handleAction('actionType', (state, action) => { ... });
+     * ```
+     */
+    private class HandleAction extends API::CallNode, DelegatingReducer {
+      HandleAction() {
+        this =
+          API::moduleImport(["redux-actions", "redux-ts-utils"])
+              .getMember("handleAction")
+              .getACall()
+      }
+
+      override DataFlow::Node getActionHandlerArg(DataFlow::Node actionType) {
+        actionType = getArgument(0) and
+        result = getArgument(1)
+      }
+    }
+
+    /**
+     * A call to `persistReducer`, which we model as a plain wrapper around another reducer.
+     */
+    private class PersistReducer extends DataFlow::CallNode, DelegatingReducer {
+      PersistReducer() {
+        this = API::moduleImport("redux-persist").getMember("persistReducer").getACall()
+      }
+
+      override DataFlow::Node getAPlainHandlerArg() { result = getArgument(1) }
+    }
+
+    /**
+     * A call to `immer` or `immer.produce`, which we model as a plain wrapper around another reducer.
+     */
+    private class ImmerProduce extends DataFlow::CallNode, DelegatingReducer {
+      ImmerProduce() {
+        this = API::moduleImport("immer").getACall()
+        or
+        this = API::moduleImport("immer").getMember("produce").getACall()
+      }
+
+      override DataFlow::Node getAPlainHandlerArg() { result = getArgument(0) }
+    }
+
+    /**
+     * A call to `reduce-reducers`, modelled as a reducer that dispatches to an arbitrary subreducer.
+     *
+     * In reality, this function chains together all of the reducers, but in practice it is only used
+     * when the reducers handle a disjoint set of action types, which makes it behave as if it
+     * dispatched to just one of them.
+     *
+     * For example:
+     * ```js
+     * let reducer = reduceReducers([
+     *   handleAction('action1', (state, action) => { ... }),
+     *   handleAction('action2', (state, action) => { ... }),
+     * ]);
+     * ```
+     */
+    private class ReduceReducers extends DataFlow::CallNode, DelegatingReducer {
+      ReduceReducers() {
+        this = API::moduleImport("reduce-reducers").getACall() or
+        this =
+          API::moduleImport(["redux-actions", "redux-ts-utils"])
+              .getMember("reduceReducers")
+              .getACall()
+      }
+
+      override DataFlow::Node getAPlainHandlerArg() {
+        result = getAnArgument()
+        or
+        result = getArgument(0).getALocalSource().(DataFlow::ArrayCreationNode).getAnElement()
+      }
+    }
+
+    /**
+     * A call to `createReducer`, for example:
+     *
+     * ```js
+     * let reducer = createReducer(initialState, (builder) => {
+     *   builder
+     *     .addCase(actionType1, (state, action) => { ... })
+     *     .addCase(actionType2, (state, action) => { ... });
+     * });
+     * ```
+     */
+    private class CreateReducer extends API::CallNode, DelegatingReducer {
+      CreateReducer() {
+        this = API::moduleImport("@reduxjs/toolkit").getMember("createReducer").getACall()
+      }
+
+      private API::Node getABuilderRef() {
+        result = getParameter(1).getParameter(0)
+        or
+        result = getABuilderRef().getAMember().getReturn()
+      }
+
+      override DataFlow::Node getActionHandlerArg(DataFlow::Node actionType) {
+        exists(API::CallNode addCase |
+          addCase = getABuilderRef().getMember("addCase").getACall() and
+          actionType = addCase.getArgument(0) and
+          result = addCase.getArgument(1)
+        )
+      }
+    }
+
+    /**
+     * A reducer created by a call to `createSlice`. Note that `createSlice` creates both
+     * reducers and actions; this class models the reducers only.
+     *
+     * For example:
+     * ```js
+     * let slice = createSlice({
+     *   name: 'mySlice',
+     *   reducers: {
+     *     actionType1: (state, action) => { ... },
+     *     actionType2: (state, action) => { ... },
+     *   },
+     *   extraReducers: (builder) => {
+     *     builder.addCase('actionType3', (state, action) => { ... })
+     *   }
+     * });
+     * export default slice.reducer;
+     * export const { actionType1, actionType2 } = slice.actions;
+     * ```
+     */
+    private class CreateSliceReducer extends DelegatingReducer {
+      API::CallNode call;
+
+      CreateSliceReducer() {
+        call = API::moduleImport("@reduxjs/toolkit").getMember("createSlice").getACall() and
+        this = call.getReturn().getMember("reducer").getAnImmediateUse()
+      }
+
+      private API::Node getABuilderRef() {
+        result = call.getParameter(0).getMember("extraReducers").getParameter(0)
+        or
+        result = getABuilderRef().getAMember().getReturn()
+      }
+
+      override DataFlow::Node getActionHandlerArg(DataFlow::Node actionType) {
+        exists(string name |
+          result = call.getParameter(0).getMember("reducers").getMember(name).getARhs() and
+          actionType = call.getReturn().getMember("actions").getMember(name).getAnImmediateUse()
+        )
+        or
+        // Properties of 'extraReducers':
+        //   { extraReducers: { [action]: reducer }}
+        exists(DataFlow::PropWrite write |
+          result = call.getParameter(0).getMember("extraReducers").getAMember().getARhs() and
+          write.getRhs() = result and
+          actionType = write.getPropertyNameExpr().flow()
+        )
+        or
+        // Builder callback to 'extraReducers':
+        //   extraReducers: builder => builder.addCase(action, reducer)
+        exists(API::CallNode addCase |
+          addCase = getABuilderRef().getMember("addCase").getACall() and
+          actionType = addCase.getArgument(0) and
+          result = addCase.getArgument(1)
+        )
+      }
+    }
+  }
+
+  /**
+   * A function for creating and dispatching action objects of shape `{type, payload}`.
+   *
+   * In the simplest case, an action creator is a function, which, for some string `T` behaves as the function `x => {type: T, payload: x}`.
+   *
+   * An action creator may have a middleware function `f`, which makes it behave as the function `x => {type: T, payload: f(x)}` (that is,
+   * the function `f` converts the argument into the actual payload).
+   *
+   * Some action creators dispatch the action to a store, while for others, the value is returned and it is simply assumed to be dispatched
+   * at some point. We model all action creators as if they dispatch the action they create.
+   */
+  class ActionCreator extends DataFlow::SourceNode {
+    ActionCreator::Range range;
+
+    ActionCreator() { this = range }
+
+    /** Gets the `type` property of actions created by this action creator, if it is known. */
+    string getTypeTag() { result = range.getTypeTag() }
+
+    /**
+     * Gets the middleware function that transforms arguments passed to this function into the
+     * action payload.
+     *
+     * Not every action creator has a middleware function; in such cases the first argument is
+     * treated as the action payload.
+     *
+     * If `async` is true, the middlware function returns a promise whose value eventually becomes
+     * the action payload. Otherwise, the return value is the payload itself.
+     */
+    DataFlow::FunctionNode getMiddlewareFunction(boolean async) {
+      result = range.getMiddlewareFunction(async)
+    }
+
+    /** Gets a data flow node referring to this action creator. */
+    private DataFlow::SourceNode ref(DataFlow::TypeTracker t) {
+      t.start() and
+      result = this
+      or
+      // x -> bindActionCreators({ x, ... })
+      exists(BindActionCreatorsCall bind, string prop |
+        ref(t.continue()).flowsTo(bind.getParameter(0).getMember(prop).getARhs()) and
+        result = bind.getReturn().getMember(prop).getAnImmediateUse()
+      )
+      or
+      // x -> combineActions(x, ...)
+      exists(API::CallNode combiner |
+        combiner =
+          API::moduleImport(["redux-actions", "redux-ts-utils"])
+              .getMember("combineActions")
+              .getACall() and
+        ref(t.continue()).flowsTo(combiner.getAnArgument()) and
+        result = combiner
+      )
+      or
+      // x -> x.fulfilled, for async action creators
+      result = ref(t.continue()).getAPropertyRead("fulfilled")
+      or
+      // follow flow through mapDispatchToProps
+      ReactRedux::dispatchToPropsStep(ref(t.continue()).getALocalUse(), result)
+      or
+      exists(DataFlow::TypeTracker t2 | result = ref(t2).track(t2, t))
+    }
+
+    /** Gets a data flow node referring to this action creator. */
+    DataFlow::SourceNode ref() { result = ref(DataFlow::TypeTracker::end()) }
+
+    /**
+     * Gets a block that is executed when a check has determined that `action` originated from this action creator.
+     */
+    private ReachableBasicBlock getASuccessfulTypeCheckBlock(DataFlow::SourceNode action) {
+      action = getAnUntypedActionInReducer() and
+      result = getASuccessfulTypeCheckBlock(action, getTypeTag())
+      or
+      // some action creators implement a .match method for this purpose
+      exists(ConditionGuardNode guard, DataFlow::CallNode call |
+        call = ref().getAMethodCall("match") and
+        guard.getTest() = call.asExpr() and
+        action.flowsTo(call.getArgument(0)) and
+        guard.getOutcome() = true and
+        result = guard.getBasicBlock()
+      )
+    }
+
+    /**
+     * Gets a reducer that handles the type of action created by this action creator, for example:
+     * ```js
+     * handleAction(TYPE, (state, action) => { ... action.payload ... })
+     * ```
+     *
+     * Does not include reducers that perform their own action type checking.
+     */
+    DataFlow::FunctionNode getAReducerFunction() {
+      exists(ReducerArg reducer |
+        reducer.isTypeTagHandler(getTypeTag())
+        or
+        reducer.isActionTypeHandler(ref().getALocalUse())
+      |
+        result = reducer.getASource()
+      )
+    }
+
+    /** Gets a data flow node referring a payload of this action (usually in the reducer function). */
+    DataFlow::SourceNode getAPayloadReference() {
+      // `if (action.type === TYPE) { ... action.payload ... }`
+      exists(DataFlow::SourceNode actionSrc |
+        actionSrc = getAnUntypedActionInReducer() and
+        result = actionSrc.getAPropertyRead("payload") and
+        getASuccessfulTypeCheckBlock(actionSrc).dominates(result.getBasicBlock())
+      )
+      or
+      result = getAReducerFunction().getParameter(1).getAPropertyRead("payload")
+    }
+
+    /** Gets a data flow node referring to the first argument of the action creator invocation. */
+    DataFlow::SourceNode getAMetaArgReference() {
+      exists(ReducerArg reducer |
+        reducer.isActionTypeHandler(ref().getAPropertyRead(["fulfilled", "rejected", "pending"])) and
+        result =
+          reducer
+              .getASource()
+              .(DataFlow::FunctionNode)
+              .getParameter(1)
+              .getAPropertyRead("meta")
+              .getAPropertyRead("arg")
+      )
+    }
+  }
+
+  /** Companion module to the `ActionCreator` class. */
+  module ActionCreator {
+    /** A function for creating and dispatching action objects of shape `{type, payload}`. */
+    abstract class Range extends DataFlow::SourceNode {
+      /** Gets the `type` property of actions created by this action creator */
+      abstract string getTypeTag();
+
+      /** Gets the function transforming arguments into the action payload. */
+      DataFlow::FunctionNode getMiddlewareFunction(boolean async) { none() }
+    }
+
+    /**
+     * An action creator made using `createAction`:
+     * ```js
+     * let action1 = createAction('action1');
+     * let action2 = createAction('action2', (x,y) => { x, y });
+     * ```
+     */
+    private class SingleAction extends Range, API::CallNode {
+      SingleAction() {
+        this =
+          API::moduleImport(["@reduxjs/toolkit", "redux-actions", "redux-ts-utils"])
+              .getMember("createAction")
+              .getACall()
+      }
+
+      override string getTypeTag() { getArgument(0).mayHaveStringValue(result) }
+
+      override DataFlow::FunctionNode getMiddlewareFunction(boolean async) {
+        result = getCallback(1) and async = false
+      }
+    }
+
+    /**
+     * One of the action creators made by a call to `createActions`:
+     * ```js
+     * let { actionOne, actionTwo } = createActions({
+     *   ACTION_ONE: (x, y) => { x, y },
+     *   ACTION_TWO: (x, y) => { x, y },
+     * })
+     * ```
+     */
+    class MultiAction extends Range {
+      API::CallNode createActions;
+      string name;
+
+      MultiAction() {
+        createActions = API::moduleImport("redux-actions").getMember("createActions").getACall() and
+        this = createActions.getReturn().getMember(name).getAnImmediateUse()
+      }
+
+      override DataFlow::FunctionNode getMiddlewareFunction(boolean async) {
+        result.flowsTo(createActions.getParameter(0).getMember(getTypeTag()).getARhs()) and
+        async = false
+      }
+
+      override string getTypeTag() {
+        result = name.regexpReplaceAll("([a-z])([A-Z])", "$1_$2").toUpperCase()
+      }
+    }
+
+    /**
+     * An action creator made by a call to `createSlice`. Note that `createSlice` creates both
+     * reducers and actions; this class models the action creators.
+     *
+     * ```js
+     * let slice = createSlice({
+     *   name: 'mySlice',
+     *   reducers: {
+     *     actionType1: (state, action) => { ... },
+     *     actionType2: (state, action) => { ... },
+     *   },
+     * });
+     * export const { actionType1, actionType2 } = slice.actions;
+     * ```
+     */
+    private class CreateSliceAction extends Range {
+      API::CallNode call;
+      string actionName;
+
+      CreateSliceAction() {
+        call = API::moduleImport("@reduxjs/toolkit").getMember("createSlice").getACall() and
+        this = call.getReturn().getMember("actions").getMember(actionName).getAnImmediateUse()
+      }
+
+      override string getTypeTag() {
+        exists(string prefix |
+          call.getParameter(0).getMember("name").getARhs().mayHaveStringValue(prefix) and
+          result = prefix + "/" + actionName
+        )
+      }
+    }
+
+    /**
+     * An action creator made by a call to `createAsyncThunk`:
+     * ```js
+     * const fetchUserId = createAsyncThunk('fetchUserId', async (id) => {
+     *   return (await fetchUserId(id)).data;
+     * });
+     * ```
+     */
+    private class CreateAsyncThunk extends Range, API::CallNode {
+      CreateAsyncThunk() {
+        this = API::moduleImport("@reduxjs/toolkit").getMember("createAsyncThunk").getACall()
+      }
+
+      override DataFlow::FunctionNode getMiddlewareFunction(boolean async) {
+        async = true and
+        result = getParameter(1).getAValueReachingRhs()
+      }
+
+      override string getTypeTag() { getArgument(0).mayHaveStringValue(result) }
+    }
+  }
+
+  /**
+   * Gets the type tag of an action creator reaching `node`.
+   */
+  private string getAnActionTypeTag(DataFlow::SourceNode node) {
+    exists(ActionCreator action |
+      node = action.ref() and
+      result = action.getTypeTag()
+    )
+  }
+
+  /** Gets the type tag of an action reaching `node`, or the string value of `node`. */
+  // Inlined to avoid duplicating `mayHaveStringValue`
+  pragma[inline]
+  private string getATypeTagFromNode(DataFlow::Node node) {
+    node.mayHaveStringValue(result)
+    or
+    node.asExpr().(Label).getName() = result
+    or
+    result = getAnActionTypeTag(node.getALocalSource())
+  }
+
+  /** A data flow node that is used as a reducer. */
+  class ReducerArg extends DataFlow::Node {
+    ReducerArg() {
+      this = any(StoreCreation c).getReducerArg()
+      or
+      this = any(DelegatingReducer r).getStateHandlerArg(_)
+      or
+      this = any(DelegatingReducer r).getActionHandlerArg(_)
+    }
+
+    /** Gets a data flow node that flows to this reducer argument. */
+    DataFlow::SourceNode getASource(DataFlow::TypeBackTracker t) {
+      t.start() and
+      result = getALocalSource()
+      or
+      // Step through forwarding functions
+      DataFlow::functionForwardingStep(result.getALocalUse(), getASource(t.continue()))
+      or
+      // Step through library functions like `redux-persist`
+      result.getALocalUse() = getASource(t.continue()).(DelegatingReducer).getAPlainHandlerArg()
+      or
+      // Step through function composition (usually composed with various state "enhancer" functions)
+      exists(FunctionCompositionCall compose, DataFlow::CallNode call |
+        getASource(t.continue()) = call and
+        call = compose.getACall() and
+        result.getALocalUse() = [compose.getAnOperandNode(), call.getAnArgument()]
+      )
+      or
+      exists(DataFlow::TypeBackTracker t2 | result = getASource(t2).backtrack(t2, t))
+    }
+
+    /** Gets a data flow node that flows to this reducer argument. */
+    DataFlow::SourceNode getASource() { result = getASource(DataFlow::TypeBackTracker::end()) }
+
+    /**
+     * Holds if the actions dispatched to this reducer have the given type, that is,
+     * it is created by an action creator that flows to `actionType`, or has `action.type` set to
+     * the string value of `actionType`.
+     */
+    predicate isActionTypeHandler(DataFlow::Node actionType) {
+      exists(DelegatingReducer r |
+        this = r.getActionHandlerArg(actionType)
+        or
+        this = r.getStateHandlerArg(_) and
+        r.getUseSite().isActionTypeHandler(actionType)
+      )
+    }
+
+    /**
+     * Holds if the actions dispatched to this reducer have the given `action.type` value.
+     */
+    predicate isTypeTagHandler(string actionType) {
+      exists(DataFlow::Node node |
+        isActionTypeHandler(node) and
+        actionType = getATypeTagFromNode(node)
+      )
+    }
+
+    /**
+     * Holds if this reducer operates on the root state, as opposed to some access path within the state.
+     */
+    predicate isRootStateHandler() {
+      this = any(StoreCreation c).getReducerArg()
+      or
+      exists(DelegatingReducer r |
+        this = r.getActionHandlerArg(_) and
+        r.getUseSite().isRootStateHandler()
+      )
+    }
+  }
+
+  /**
+   * A source of the `dispatch` function, used as starting point for `getADispatchFunctionNode`.
+   */
+  abstract private class DispatchFunctionSource extends API::Node { }
+
+  /**
+   * A value that is dispatched, that is, flows to the first argument of `dispatch`
+   * (but where the call to `dispatch` is not necessarily explicit in the code).
+   *
+   * Used as starting point for `getADispatchedValueNode`.
+   */
+  abstract private class DispatchedValueSink extends API::Node { }
+
+  /** Gets an API node referring to the Redux `dispatch` function. */
+  API::Node getADispatchFunctionNode() {
+    result instanceof DispatchFunctionSource
+    or
+    result = getADispatchedValueNode().getParameter(0)
+  }
+
+  /** Gets an API node corresponding to a value being passed to the `dispatch` function. */
+  API::Node getADispatchedValueNode() {
+    result instanceof DispatchedValueSink
+    or
+    result = getADispatchFunctionNode().getParameter(0)
+  }
+
+  private class StoreDispatchSource extends DispatchFunctionSource {
+    StoreDispatchSource() { this = any(StoreCreation c).asApiNode().getMember("dispatch") }
+  }
+
+  /** Gets the `action` parameter of a reducer that isn't behind an implied type guard. */
+  DataFlow::SourceNode getAnUntypedActionInReducer() {
+    exists(ReducerArg reducer |
+      not reducer.isTypeTagHandler(_) and
+      result = reducer.getASource().(DataFlow::FunctionNode).getParameter(1)
+    )
+  }
+
+  /** A call to `bindActionCreators` */
+  private class BindActionCreatorsCall extends API::CallNode {
+    BindActionCreatorsCall() {
+      this =
+        API::moduleImport(["redux", "@reduxjs/toolkit"]).getMember("bindActionCreators").getACall()
+    }
+  }
+
+  /** The return value of a function flowing into `bindActionCreators`, seen as a value that is dispatched. */
+  private class BindActionDispatchSink extends DispatchedValueSink {
+    BindActionDispatchSink() {
+      this = any(BindActionCreatorsCall c).getParameter(0).getAMember().getReturn()
+    }
+  }
+
+  /**
+   * Holds if `pred -> succ` is step from an action creation to its use in a reducer function.
+   */
+  predicate actionToReducerStep(DataFlow::Node pred, DataFlow::Node succ) {
+    // Actions created by an action creator library
+    exists(ActionCreator action |
+      exists(DataFlow::CallNode call | call = action.ref().getACall() |
+        exists(int i |
+          pred = call.getArgument(i) and
+          succ = action.getMiddlewareFunction(_).getParameter(i)
+        )
+        or
+        not exists(action.getMiddlewareFunction(_)) and
+        pred = call.getArgument(0) and
+        succ = action.getAPayloadReference()
+        or
+        pred = call.getArgument(0) and
+        succ = action.getAMetaArgReference()
+      )
+      or
+      pred = action.getMiddlewareFunction(false).getReturnNode() and
+      succ = action.getAPayloadReference()
+    )
+    or
+    // Manually created and dispatched actions
+    exists(string actionType, string prop, DataFlow::SourceNode actionSrc |
+      actionSrc = getAnUntypedActionInReducer() and
+      pred = getAManuallyDispatchedValue(actionType).getAPropertyWrite(prop).getRhs() and
+      succ = actionSrc.getAPropertyRead(prop)
+    |
+      getASuccessfulTypeCheckBlock(actionSrc, actionType).dominates(succ.getBasicBlock())
+      or
+      exists(ReducerArg reducer |
+        reducer.isTypeTagHandler(actionType) and
+        actionSrc = reducer.getASource().(DataFlow::FunctionNode).getParameter(1)
+      )
+    )
+  }
+
+  /** Holds if `pred -> succ` is a step from the promise of an action payload to its use in a reducer function. */
+  predicate actionToReducerPromiseStep(DataFlow::Node pred, DataFlow::SourceNode succ) {
+    exists(ActionCreator action |
+      pred = action.getMiddlewareFunction(true).getReturnNode() and
+      succ = action.getAPayloadReference()
+    )
+  }
+
+  private class ActionToReducerStep extends DataFlow::SharedFlowStep {
+    override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
+      actionToReducerStep(pred, succ)
+    }
+
+    override predicate loadStep(DataFlow::Node pred, DataFlow::Node succ, string prop) {
+      actionToReducerPromiseStep(pred, succ) and prop = Promises::valueProp()
+    }
+  }
+
+  /** Gets the access path which `reducer` operates on. */
+  string getAffectedStateAccessPath(ReducerArg reducer) {
+    exists(DelegatingReducer r |
+      exists(string prop | reducer = r.getStateHandlerArg(prop) |
+        result = joinAccessPaths(getAffectedStateAccessPath(r.getUseSite()), prop)
+        or
+        r.getUseSite().isRootStateHandler() and
+        result = prop
+      )
+      or
+      reducer = r.getActionHandlerArg(_) and
+      result = getAffectedStateAccessPath(r.getUseSite())
+    )
+  }
+
+  /**
+   * Holds if `pred -> succ` should be a step from a reducer to a state access affected by the reducer.
+   */
+  predicate reducerToStateStep(DataFlow::Node pred, DataFlow::Node succ) {
+    reducerToStateStepAux(pred, succ) and
+    ProgramSlicing::areFilesInSameReduxApp(pred.getFile(), succ.getFile())
+  }
+
+  /**
+   * Holds if `pred -> succ` should be a step from a reducer to a state access affected by the reducer.
+   *
+   * This is a helper predicate for `reducerToStateStep` without the program-slicing check.
+   */
+  pragma[nomagic]
+  private predicate reducerToStateStepAux(DataFlow::Node pred, DataFlow::SourceNode succ) {
+    exists(ReducerArg reducer, DataFlow::FunctionNode function, string accessPath |
+      function = reducer.getASource() and
+      accessPath = getAffectedStateAccessPath(reducer)
+    |
+      pred = function.getReturnNode() and
+      succ = rootStateAccessPath(accessPath).getAnImmediateUse()
+      or
+      exists(string suffix, DataFlow::SourceNode base |
+        base = [function.getParameter(0), function.getReturnNode().getALocalSource()] and
+        pred = AccessPath::getAnAssignmentTo(base, suffix) and
+        succ = rootStateAccessPath(accessPath + "." + suffix).getAnImmediateUse()
+      )
+    )
+    or
+    exists(
+      ReducerArg reducer, DataFlow::FunctionNode function, string suffix, DataFlow::SourceNode base
+    |
+      function = reducer.getASource() and
+      reducer.isRootStateHandler() and
+      base = [function.getParameter(0), function.getReturnNode().getALocalSource()] and
+      pred = AccessPath::getAnAssignmentTo(base, suffix) and
+      succ = rootStateAccessPath(suffix).getAnImmediateUse()
+    )
+  }
+
+  private class ReducerToStateStep extends DataFlow::SharedFlowStep {
+    override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
+      reducerToStateStep(pred, succ)
+    }
+  }
+
+  /**
+   * Gets a dispatched object literal with a property `type: actionType`.
+   */
+  private DataFlow::ObjectLiteralNode getAManuallyDispatchedValue(string actionType) {
+    result.getAPropertyWrite("type").getRhs().mayHaveStringValue(actionType) and
+    result = getADispatchedValueNode().getAValueReachingRhs()
+  }
+
+  /**
+   * Gets the block to be executed after a check has determined that `action.type` is `actionType`,
+   * or the entry block of a closure dominated by such a check.
+   */
+  private ReachableBasicBlock getASuccessfulTypeCheckBlock(
+    DataFlow::SourceNode action, string actionType
+  ) {
+    action = getAnUntypedActionInReducer() and
+    (
+      exists(MembershipCandidate candidate, ConditionGuardNode guard |
+        action.getAPropertyRead("type").flowsTo(candidate) and
+        candidate.getAMemberString() = actionType and
+        guard.getTest() = candidate.getTest().asExpr() and
+        guard.getOutcome() = candidate.getTestPolarity() and
+        result = guard.getBasicBlock()
+      )
+      or
+      exists(SwitchStmt switch, SwitchCase case |
+        action.getAPropertyRead("type").flowsTo(switch.getExpr().flow()) and
+        case = switch.getACase() and
+        case.getExpr().mayHaveStringValue(actionType) and
+        result = getCaseBlock(case)
+      )
+    )
+    or
+    exists(Function f |
+      getASuccessfulTypeCheckBlock(action, actionType)
+          .dominates(f.(ControlFlowNode).getBasicBlock()) and
+      result = f.getEntryBB()
+    )
+  }
+
+  /** Gets the block to execute when `case` matches sucessfully. */
+  private BasicBlock getCaseBlock(SwitchCase case) {
+    result = case.getBodyStmt(0).getBasicBlock()
+    or
+    not exists(case.getABodyStmt()) and
+    exists(SwitchStmt stmt, int i |
+      stmt.getCase(i) = case and
+      result = getCaseBlock(stmt.getCase(i + 1))
+    )
+  }
+
+  /**
+   * Defines a flow step to be used for propagating tracking access to `state`.
+   *
+   * A `SharedFlowStep` is generated for these steps as well.
+   * It is distinct from `SharedFlowStep` to avoid recursion between that and the propagation of `state`.
+   */
+  private class StateStep extends Unit {
+    abstract predicate step(DataFlow::Node pred, DataFlow::Node succ);
+  }
+
+  private predicate stateStep(DataFlow::Node pred, DataFlow::Node succ) {
+    any(StateStep s).step(pred, succ)
+  }
+
+  private class StateStepAsFlowStep extends DataFlow::SharedFlowStep {
+    override predicate step(DataFlow::Node pred, DataFlow::Node succ) { stateStep(pred, succ) }
+  }
+
+  /**
+   * Model of the `react-redux` package.
+   */
+  private module ReactRedux {
+    /** Gets an API node referring to the `useSelector` function. */
+    API::Node useSelector() { result = API::moduleImport("react-redux").getMember("useSelector") }
+
+    /**
+     * Step out of a `useSelector` call, such as from `state.x` to the result of `useSelector(state => state.x)`.
+     */
+    class UseSelectorStep extends StateStep {
+      override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
+        exists(API::CallNode call |
+          call = useSelector().getACall() and
+          pred = call.getParameter(0).getReturn().getARhs() and
+          succ = call
+        )
+      }
+    }
+
+    /** The argument to a `useSelector` callback, seen as a root state reference. */
+    class UseSelectorStateSource extends RootStateSource {
+      UseSelectorStateSource() { this = useSelector().getParameter(0).getParameter(0) }
+    }
+
+    /** A call to `useDispatch`, as a source of the `dispatch` function. */
+    private class UseDispatchFunctionSource extends DispatchFunctionSource {
+      UseDispatchFunctionSource() {
+        this = API::moduleImport("react-redux").getMember("useDispatch").getReturn()
+      }
+    }
+
+    /**
+     * A call to `connect()`, typically as part of a code pattern like the following:
+     * ```js
+     * let withConnect = connect(mapStateToProps, mapDispatchToProps);
+     * let MyAwesomeComponent = compose(withConnect, otherStuff)(MyComponent);
+     * ```
+     */
+    abstract private class ConnectCall extends API::CallNode {
+      /** Gets the API node corresponding to the `mapStateToProps` argument. */
+      abstract API::Node getMapStateToProps();
+
+      /** Gets the API node corresponding to the `mapDispatchToProps` argument. */
+      abstract API::Node getMapDispatchToProps();
+
+      /**
+       * Gets a function whose first argument becomes the React component to connect.
+       */
+      DataFlow::SourceNode getAComponentTransformer() {
+        result = this
+        or
+        exists(FunctionCompositionCall compose |
+          getAComponentTransformer().flowsTo(compose.getAnOperandNode()) and
+          result = compose
+        )
+      }
+
+      /**
+       * Gets a data-flow node that should flow to `props.name` via the `mapDispatchToProps` function.
+       */
+      DataFlow::Node getDispatchPropNode(string name) {
+        // Implicitly bound by bindActionCreators:
+        //
+        //   const mapDispatchToProps = { foo }
+        //
+        result = getMapDispatchToProps().getMember(name).getARhs()
+        or
+        //
+        //   const mapDispatchToProps = dispatch => ( { foo } )
+        //
+        result = getMapDispatchToProps().getReturn().getMember(name).getARhs()
+        or
+        // Explicitly bound by bindActionCreators:
+        //
+        //   const mapDispatchToProps = dispatch => bindActionCreators({ foo }, dispatch);
+        //
+        exists(BindActionCreatorsCall bind |
+          bind.flowsTo(getMapDispatchToProps().getReturn().getARhs()) and
+          result = bind.getOptionArgument(0, name)
+        )
+      }
+
+      /**
+       * Gets the React component decorated by this call, if one can be determined.
+       */
+      ReactComponent getReactComponent() {
+        exists(DataFlow::SourceNode component | component = result.getAComponentCreatorReference() |
+          component.flowsTo(getAComponentTransformer().getACall().getArgument(0))
+          or
+          component.(DataFlow::ClassNode).getADecorator() = getAComponentTransformer()
+        )
+      }
+    }
+
+    /** A call to `connect`. */
+    private class RealConnectFunction extends ConnectCall {
+      RealConnectFunction() {
+        this = API::moduleImport("react-redux").getMember("connect").getACall()
+      }
+
+      override API::Node getMapStateToProps() { result = getParameter(0) }
+
+      override API::Node getMapDispatchToProps() { result = getParameter(1) }
+    }
+
+    /**
+     * An API entry point corresponding to a `connect` function which we couldn't recognize exactly.
+     *
+     * The `connect` call is recognized based on an argument being named either `mapStateToProps` or `mapDispatchToProps`.
+     * Used to catch cases where the `connect` function was not recognized by API graphs (usually because of it being
+     * wrapped in another function, which API graphs won't look through).
+     */
+    private class HeuristicConnectEntryPoint extends API::EntryPoint {
+      HeuristicConnectEntryPoint() { this = "react-redux-connect" }
+
+      override DataFlow::Node getARhs() { none() }
+
+      override DataFlow::SourceNode getAUse() {
+        exists(DataFlow::CallNode call |
+          call.getAnArgument().asExpr().(Identifier).getName() =
+            ["mapStateToProps", "mapDispatchToProps"] and
+          // exclude genuine calls to avoid duplication
+          not call = DataFlow::moduleMember("react-redux", "connect").getACall() and
+          result = call.getCalleeNode().getALocalSource()
+        )
+      }
+    }
+
+    /** A heuristic call to `connect`, recognized by it taking arguments named `mapStateToProps` and `mapDispatchToProps`. */
+    private class HeuristicConnectFunction extends ConnectCall {
+      HeuristicConnectFunction() {
+        this = API::root().getASuccessor(any(HeuristicConnectEntryPoint e)).getACall()
+      }
+
+      override API::Node getMapStateToProps() {
+        result = getAParameter() and
+        result.getARhs().asExpr().(Identifier).getName() = "mapStateToProps"
+      }
+
+      override API::Node getMapDispatchToProps() {
+        result = getAParameter() and
+        result.getARhs().asExpr().(Identifier).getName() = "mapDispatchToProps"
+      }
+    }
+
+    /**
+     * A step from the return value of `mapStateToProps` to a `props` access.
+     */
+    private class StateToPropsStep extends StateStep {
+      override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
+        exists(ConnectCall call |
+          pred = call.getMapStateToProps().getReturn().getARhs() and
+          succ = call.getReactComponent().getADirectPropsAccess()
+        )
+      }
+    }
+
+    /**
+     * Holds if `pred -> succ` is a step from `mapDispatchToProps` to a `props` property access.
+     */
+    predicate dispatchToPropsStep(DataFlow::Node pred, DataFlow::Node succ) {
+      exists(ConnectCall call, string member |
+        pred = call.getDispatchPropNode(member) and
+        succ = call.getReactComponent().getAPropRead(member)
+      )
+    }
+
+    /** The first argument to `mapDispatchToProps` as a source of the `dispatch` function */
+    private class MapDispatchToPropsArg extends DispatchFunctionSource {
+      MapDispatchToPropsArg() { this = any(ConnectCall c).getMapDispatchToProps().getParameter(0) }
+    }
+
+    /** If `mapDispatchToProps` is an object, each method's return value is dispatched. */
+    private class MapDispatchToPropsMember extends DispatchedValueSink {
+      MapDispatchToPropsMember() {
+        this = any(ConnectCall c).getMapDispatchToProps().getAMember().getReturn()
+      }
+    }
+
+    /** The first argument to `mapStateToProps` as an access to the root state. */
+    private class MapStateToPropsStateSource extends RootStateSource {
+      MapStateToPropsStateSource() {
+        this = any(ConnectCall c).getMapStateToProps().getParameter(0)
+      }
+    }
+  }
+
+  private module Reselect {
+    /**
+     * A call to `createSelector`.
+     *
+     * Such calls have two forms. The single-argument version is simply a memoized function wrapper:
+     *
+     * ```js
+     *   createSelector(state => state.foo)
+     * ```
+     *
+     * If multiple arguments are used, each callback independently maps over the state, and last
+     * callback collects all the intermediate results into the final result:
+     *
+     * ```js
+     *   createSelector(
+     *     state => state.foo,
+     *     state => state.bar,
+     *     ([foo, bar]) => {...}
+     *   )
+     * ```
+     *
+     * Although selectors can work on any data, not just the Redux state, they are in practice only used
+     * with the state.
+     */
+    class CreateSelectorCall extends API::CallNode {
+      CreateSelectorCall() {
+        this =
+          API::moduleImport(["reselect", "@reduxjs/toolkit"]).getMember("createSelector").getACall()
+      }
+
+      /** Gets the `i`th selector callback, that is, a callback other than the result function. */
+      API::Node getSelectorFunction(int i) {
+        // When there are multiple callbacks, exclude the last one
+        result = getParameter(i) and
+        (i = 0 or i < getNumArgument() - 1)
+        or
+        // Selector functions may be given as an array
+        exists(DataFlow::ArrayCreationNode array |
+          array.flowsTo(getArgument(0)) and
+          result.getAUse() = array.getElement(i)
+        )
+      }
+    }
+
+    /** The state argument to a selector */
+    private class SelectorStateArg extends RootStateSource {
+      SelectorStateArg() { this = any(CreateSelectorCall c).getSelectorFunction(_).getParameter(0) }
+    }
+
+    /** A flow step between the callbacks of `createSelector` or out of its final selector. */
+    private class CreateSelectorStep extends StateStep {
+      override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
+        // Return value of `i`th callback flows to the `i`th parameter of the last callback.
+        exists(CreateSelectorCall call, int index |
+          call.getNumArgument() > 1 and
+          pred = call.getSelectorFunction(index).getReturn().getARhs() and
+          succ = call.getLastParameter().getParameter(index).getAnImmediateUse()
+        )
+        or
+        // The result of the last callback is the final result
+        exists(CreateSelectorCall call |
+          pred = call.getLastParameter().getReturn().getARhs() and
+          succ = call
+        )
+      }
+    }
+  }
+}
diff --git a/javascript/ql/src/semmle/javascript/frameworks/SQL.qll b/javascript/ql/src/semmle/javascript/frameworks/SQL.qll
index c94750e5b3d..ce702decc96 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/SQL.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/SQL.qll
@@ -28,30 +28,52 @@ module SQL {
  * Provides classes modelling the (API compatible) `mysql` and `mysql2` packages.
  */
 private module MySql {
+  private string moduleName() { result = ["mysql", "mysql2", "mysql2/promise"] }
+
   /** Gets the package name `mysql` or `mysql2`. */
-  API::Node mysql() { result = API::moduleImport(["mysql", "mysql2"]) }
+  API::Node mysql() { result = API::moduleImport(moduleName()) }
 
   /** Gets a reference to `mysql.createConnection`. */
-  API::Node createConnection() { result = mysql().getMember("createConnection") }
+  API::Node createConnection() {
+    result = mysql().getMember(["createConnection", "createConnectionPromise"])
+  }
 
   /** Gets a reference to `mysql.createPool`. */
-  API::Node createPool() { result = mysql().getMember("createPool") }
+  API::Node createPool() { result = mysql().getMember(["createPool", "createPoolCluster"]) }
 
   /** Gets a node that contains a MySQL pool created using `mysql.createPool()`. */
-  API::Node pool() { result = createPool().getReturn() }
+  API::Node pool() {
+    result = createPool().getReturn()
+    or
+    result = pool().getMember("on").getReturn()
+    or
+    result = API::Node::ofType(moduleName(), ["Pool", "PoolCluster"])
+  }
 
   /** Gets a data flow node that contains a freshly created MySQL connection instance. */
   API::Node connection() {
     result = createConnection().getReturn()
     or
+    result = createConnection().getReturn().getPromised()
+    or
     result = pool().getMember("getConnection").getParameter(0).getParameter(1)
+    or
+    result = pool().getMember("getConnection").getPromised()
+    or
+    exists(API::CallNode call |
+      call = pool().getMember("on").getACall() and
+      call.getArgument(0).getStringValue() = ["connection", "acquire", "release"] and
+      result = call.getParameter(1).getParameter(0)
+    )
+    or
+    result = API::Node::ofType(moduleName(), ["Connection", "PoolConnection"])
   }
 
   /** A call to the MySql `query` method. */
   private class QueryCall extends DatabaseAccess, DataFlow::MethodCallNode {
     QueryCall() {
       exists(API::Node recv | recv = pool() or recv = connection() |
-        this = recv.getMember("query").getACall()
+        this = recv.getMember(["query", "execute"]).getACall()
       )
     }
 
@@ -93,11 +115,17 @@ private module MySql {
 }
 
 /**
- * Provides classes modelling the `pg` package.
+ * Provides classes modelling the PostgreSQL packages, such as `pg` and `pg-promise`.
  */
 private module Postgres {
+  API::Node pg() {
+    result = API::moduleImport("pg")
+    or
+    result = pgpMain().getMember("pg")
+  }
+
   /** Gets a reference to the `Client` constructor in the `pg` package, for example `require('pg').Client`. */
-  API::Node newClient() { result = API::moduleImport("pg").getMember("Client") }
+  API::Node newClient() { result = pg().getMember("Client") }
 
   /** Gets a freshly created Postgres client instance. */
   API::Node client() {
@@ -105,19 +133,42 @@ private module Postgres {
     or
     // pool.connect(function(err, client) { ... })
     result = pool().getMember("connect").getParameter(0).getParameter(1)
+    or
+    // await pool.connect()
+    result = pool().getMember("connect").getReturn().getPromised()
+    or
+    result = pgpConnection().getMember("client")
+    or
+    exists(API::CallNode call |
+      call = pool().getMember("on").getACall() and
+      call.getArgument(0).getStringValue() = ["connect", "acquire"] and
+      result = call.getParameter(1).getParameter(0)
+    )
+    or
+    result = client().getMember("on").getReturn()
+    or
+    result = API::Node::ofType("pg", ["Client", "PoolClient"])
   }
 
   /** Gets a constructor that when invoked constructs a new connection pool. */
   API::Node newPool() {
     // new require('pg').Pool()
-    result = API::moduleImport("pg").getMember("Pool")
+    result = pg().getMember("Pool")
     or
     // new require('pg-pool')
     result = API::moduleImport("pg-pool")
   }
 
-  /** Gets an expression that constructs a new connection pool. */
-  API::Node pool() { result = newPool().getInstance() }
+  /** Gets an API node that refers to a connection pool. */
+  API::Node pool() {
+    result = newPool().getInstance()
+    or
+    result = pgpDatabase().getMember("$pool")
+    or
+    result = pool().getMember("on").getReturn()
+    or
+    result = API::Node::ofType("pg", "Pool")
+  }
 
   /** A call to the Postgres `query` method. */
   private class QueryCall extends DatabaseAccess, DataFlow::MethodCallNode {
@@ -128,7 +179,11 @@ private module Postgres {
 
   /** An expression that is passed to the `query` method and hence interpreted as SQL. */
   class QueryString extends SQL::SqlString {
-    QueryString() { this = any(QueryCall qc).getAQueryArgument().asExpr() }
+    QueryString() {
+      this = any(QueryCall qc).getAQueryArgument().asExpr()
+      or
+      this = API::moduleImport("pg-cursor").getParameter(0).getARhs().asExpr()
+    }
   }
 
   /** An expression that is passed as user name or password when creating a client or a pool. */
@@ -137,17 +192,142 @@ private module Postgres {
 
     Credentials() {
       exists(string prop |
-        this = [newClient(), newPool()].getParameter(0).getMember(prop).getARhs().asExpr() and
-        (
-          prop = "user" and kind = "user name"
-          or
-          prop = "password" and kind = prop
-        )
+        this = [newClient(), newPool()].getParameter(0).getMember(prop).getARhs().asExpr()
+        or
+        this = pgPromise().getParameter(0).getMember(prop).getARhs().asExpr()
+      |
+        prop = "user" and kind = "user name"
+        or
+        prop = "password" and kind = prop
       )
     }
 
     override string getCredentialsKind() { result = kind }
   }
+
+  /** Gets a node referring to the `pg-promise` library (which is not itself a Promise). */
+  API::Node pgPromise() { result = API::moduleImport("pg-promise") }
+
+  /** Gets an initialized `pg-promise` library. */
+  API::Node pgpMain() {
+    result = pgPromise().getReturn()
+    or
+    result = API::Node::ofType("pg-promise", "IMain")
+  }
+
+  /** Gets a database from `pg-promise`. */
+  API::Node pgpDatabase() {
+    result = pgpMain().getReturn()
+    or
+    result = API::Node::ofType("pg-promise", "IDatabase")
+  }
+
+  /** Gets a connection created from a `pg-promise` database. */
+  API::Node pgpConnection() {
+    result = pgpDatabase().getMember("connect").getReturn().getPromised()
+    or
+    result = API::Node::ofType("pg-promise", "IConnected")
+  }
+
+  /** Gets a `pg-promise` task object. */
+  API::Node pgpTask() {
+    exists(API::Node taskMethod |
+      taskMethod = pgpObject().getMember(["task", "taskIf", "tx", "txIf"])
+    |
+      result = taskMethod.getParameter([0, 1]).getParameter(0)
+      or
+      result = taskMethod.getParameter(0).getMember("cnd").getParameter(0)
+    )
+    or
+    result = API::Node::ofType("pg-promise", "ITask")
+  }
+
+  /** Gets a `pg-promise` object which supports querying (database, connection, or task). */
+  API::Node pgpObject() {
+    result = [pgpDatabase(), pgpConnection(), pgpTask()]
+    or
+    result = API::Node::ofType("pg-promise", "IBaseProtocol")
+  }
+
+  private string pgpQueryMethodName() {
+    result =
+      [
+        "any", "each", "many", "manyOrNone", "map", "multi", "multiResult", "none", "one",
+        "oneOrNone", "query", "result"
+      ]
+  }
+
+  /** A call that executes a SQL query via `pg-promise`. */
+  private class PgPromiseQueryCall extends DatabaseAccess, DataFlow::MethodCallNode {
+    PgPromiseQueryCall() { this = pgpObject().getMember(pgpQueryMethodName()).getACall() }
+
+    /** Gets an argument interpreted as a SQL string, not including raw interpolation variables. */
+    private DataFlow::Node getADirectQueryArgument() {
+      result = getArgument(0)
+      or
+      result = getOptionArgument(0, "text")
+    }
+
+    /**
+     * Gets an interpolation parameter whose value is interpreted literally, or is not escaped appropriately for its context.
+     *
+     * For example, the following are raw placeholders: $1:raw, $1^, ${prop}:raw, $(prop)^
+     */
+    private string getARawParameterName() {
+      exists(string sqlString, string placeholderRegexp, string regexp |
+        placeholderRegexp = "\\$(\\d+|[{(\\[/]\\w+[})\\]/])" and // For example: $1 or ${prop}
+        sqlString = getADirectQueryArgument().getStringValue()
+      |
+        // Match $1:raw or ${prop}:raw
+        regexp = placeholderRegexp + "(:raw|\\^)" and
+        result =
+          sqlString
+              .regexpFind(regexp, _, _)
+              .regexpCapture(regexp, 1)
+              .regexpReplaceAll("[^\\w\\d]", "")
+        or
+        // Match $1:value or ${prop}:value unless enclosed by single quotes (:value prevents breaking out of single quotes)
+        regexp = placeholderRegexp + "(:value|\\#)" and
+        result =
+          sqlString
+              .regexpReplaceAll("'[^']*'", "''")
+              .regexpFind(regexp, _, _)
+              .regexpCapture(regexp, 1)
+              .regexpReplaceAll("[^\\w\\d]", "")
+      )
+    }
+
+    /** Gets the argument holding the values to plug into placeholders. */
+    private DataFlow::Node getValues() {
+      result = getArgument(1)
+      or
+      result = getOptionArgument(0, "values")
+    }
+
+    /** Gets a value that is plugged into a raw placeholder variable, making it a sink for SQL injection. */
+    private DataFlow::Node getARawValue() {
+      result = getValues() and getARawParameterName() = "1" // Special case: if the argument is not an array or object, it's just plugged into $1
+      or
+      exists(DataFlow::SourceNode values | values = getValues().getALocalSource() |
+        result = values.getAPropertyWrite(getARawParameterName()).getRhs()
+        or
+        // Array literals do not have PropWrites with property names so handle them separately,
+        // and also translate to 0-based indexing.
+        result = values.(DataFlow::ArrayCreationNode).getElement(getARawParameterName().toInt() - 1)
+      )
+    }
+
+    override DataFlow::Node getAQueryArgument() {
+      result = getADirectQueryArgument()
+      or
+      result = getARawValue()
+    }
+  }
+
+  /** An expression that is interpreted as SQL by `pg-promise`. */
+  class PgPromiseQueryString extends SQL::SqlString {
+    PgPromiseQueryString() { this = any(PgPromiseQueryCall qc).getAQueryArgument().asExpr() }
+  }
 }
 
 /**
@@ -162,24 +342,17 @@ private module Sqlite {
   }
 
   /** Gets an expression that constructs a Sqlite database instance. */
-  API::Node newDb() {
+  API::Node database() {
     // new require('sqlite3').Database()
     result = sqlite().getMember("Database").getInstance()
+    or
+    result = API::Node::ofType("sqlite3", "Database")
   }
 
   /** A call to a Sqlite query method. */
   private class QueryCall extends DatabaseAccess, DataFlow::MethodCallNode {
     QueryCall() {
-      exists(string meth |
-        meth = "all" or
-        meth = "each" or
-        meth = "exec" or
-        meth = "get" or
-        meth = "prepare" or
-        meth = "run"
-      |
-        this = newDb().getMember(meth).getACall()
-      )
+      this = database().getMember(["all", "each", "exec", "get", "prepare", "run"]).getACall()
     }
 
     override DataFlow::Node getAQueryArgument() { result = getArgument(0) }
@@ -198,15 +371,32 @@ private module MsSql {
   /** Gets a reference to the `mssql` module. */
   API::Node mssql() { result = API::moduleImport("mssql") }
 
-  /** Gets an expression that creates a request object. */
-  API::Node request() {
-    // new require('mssql').Request()
-    result = mssql().getMember("Request").getInstance()
+  /** Gets a node referring to an instance of the given class. */
+  API::Node mssqlClass(string name) {
+    result = mssql().getMember(name).getInstance()
     or
-    // request.input(...)
-    result = request().getMember("input").getReturn()
+    result = API::Node::ofType("mssql", name)
   }
 
+  /** Gets an API node referring to a Request object. */
+  API::Node request() {
+    result = mssqlClass("Request")
+    or
+    result = request().getMember(["input", "replaceInput", "output", "replaceOutput"]).getReturn()
+    or
+    result = [transaction(), pool()].getMember("request").getReturn()
+  }
+
+  /** Gets an API node referring to a Transaction object. */
+  API::Node transaction() {
+    result = mssqlClass("Transaction")
+    or
+    result = pool().getMember("transaction").getReturn()
+  }
+
+  /** Gets a API node referring to a ConnectionPool object. */
+  API::Node pool() { result = mssqlClass("ConnectionPool") }
+
   /** A tagged template evaluated as a query. */
   private class QueryTemplateExpr extends DatabaseAccess, DataFlow::ValueNode {
     override TaggedTemplateExpr astNode;
@@ -222,7 +412,7 @@ private module MsSql {
 
   /** A call to a MsSql query method. */
   private class QueryCall extends DatabaseAccess, DataFlow::MethodCallNode {
-    QueryCall() { this = request().getMember(["query", "batch"]).getACall() }
+    QueryCall() { this = [mssql(), request()].getMember(["query", "batch"]).getACall() }
 
     override DataFlow::Node getAQueryArgument() { result = getArgument(0) }
   }
@@ -273,22 +463,34 @@ private module MsSql {
  * Provides classes modelling the `sequelize` package.
  */
 private module Sequelize {
-  /** Gets an import of the `sequelize` module. */
-  API::Node sequelize() { result = API::moduleImport("sequelize") }
+  /** Gets an import of the `sequelize` module or one that re-exports it. */
+  API::Node sequelize() { result = API::moduleImport(["sequelize", "sequelize-typescript"]) }
 
   /** Gets an expression that creates an instance of the `Sequelize` class. */
-  API::Node newSequelize() { result = sequelize().getInstance() }
+  API::Node instance() {
+    result = [sequelize(), sequelize().getMember("Sequelize")].getInstance()
+    or
+    result = API::Node::ofType(["sequelize", "sequelize-typescript"], ["Sequelize", "default"])
+  }
 
   /** A call to `Sequelize.query`. */
   private class QueryCall extends DatabaseAccess, DataFlow::MethodCallNode {
-    QueryCall() { this = newSequelize().getMember("query").getACall() }
+    QueryCall() { this = instance().getMember("query").getACall() }
 
-    override DataFlow::Node getAQueryArgument() { result = getArgument(0) }
+    override DataFlow::Node getAQueryArgument() {
+      result = getArgument(0)
+      or
+      result = getOptionArgument(0, "query")
+    }
   }
 
   /** An expression that is passed to `Sequelize.query` method and hence interpreted as SQL. */
   class QueryString extends SQL::SqlString {
-    QueryString() { this = any(QueryCall qc).getAQueryArgument().asExpr() }
+    QueryString() {
+      this = any(QueryCall qc).getAQueryArgument().asExpr()
+      or
+      this = sequelize().getMember(["literal", "asIs"]).getParameter(0).getARhs().asExpr()
+    }
   }
 
   /**
@@ -341,6 +543,8 @@ private module Spanner {
   API::Node database() {
     result =
       spanner().getReturn().getMember("instance").getReturn().getMember("database").getReturn()
+    or
+    result = API::Node::ofType("@google-cloud/spanner", "Database")
   }
 
   /**
@@ -348,61 +552,81 @@ private module Spanner {
    */
   API::Node v1SpannerClient() {
     result = spanner().getMember("v1").getMember("SpannerClient").getInstance()
+    or
+    result = API::Node::ofType("@google-cloud/spanner", "v1.SpannerClient")
   }
 
   /**
    * Gets a node that refers to a transaction object.
    */
   API::Node transaction() {
-    result = database().getMember("runTransaction").getParameter(0).getParameter(1)
+    result =
+      database()
+          .getMember(["runTransaction", "runTransactionAsync"])
+          .getParameter([0, 1])
+          .getParameter(1)
+    or
+    result = API::Node::ofType("@google-cloud/spanner", "Transaction")
+  }
+
+  /** Gets an API node referring to a `BatchTransaction` object. */
+  API::Node batchTransaction() {
+    result = database().getMember("batchTransaction").getReturn()
+    or
+    result = database().getMember("createBatchTransaction").getReturn().getPromised()
+    or
+    result = API::Node::ofType("@google-cloud/spanner", "BatchTransaction")
   }
 
   /**
    * A call to a Spanner method that executes a SQL query.
    */
-  abstract class SqlExecution extends DatabaseAccess, DataFlow::InvokeNode {
-    /**
-     * Gets the position of the query argument; default is zero, which can be overridden
-     * by subclasses.
-     */
-    int getQueryArgumentPosition() { result = 0 }
+  abstract class SqlExecution extends DatabaseAccess, DataFlow::InvokeNode { }
+
+  /**
+   * A SQL execution that takes the input directly in the first argument or in the `sql` option.
+   */
+  class SqlExecutionDirect extends SqlExecution {
+    SqlExecutionDirect() {
+      this = database().getMember(["run", "runPartitionedUpdate", "runStream"]).getACall()
+      or
+      this = transaction().getMember(["run", "runStream", "runUpdate"]).getACall()
+      or
+      this = batchTransaction().getMember("createQueryPartitions").getACall()
+    }
 
     override DataFlow::Node getAQueryArgument() {
-      result = getArgument(getQueryArgumentPosition()) or
-      result = getOptionArgument(getQueryArgumentPosition(), "sql")
+      result = getArgument(0)
+      or
+      result = getOptionArgument(0, "sql")
     }
   }
 
   /**
-   * A call to `Database.run`, `Database.runPartitionedUpdate` or `Database.runStream`.
+   * A SQL execution that takes an array of SQL strings or { sql: string } objects.
    */
-  class DatabaseRunCall extends SqlExecution {
-    DatabaseRunCall() {
-      this = database().getMember(["run", "runPartitionedUpdate", "runStream"]).getACall()
+  class SqlExecutionBatch extends SqlExecution, API::CallNode {
+    SqlExecutionBatch() { this = transaction().getMember("batchUpdate").getACall() }
+
+    override DataFlow::Node getAQueryArgument() {
+      // just use the whole array as the query argument, as arrays becomes tainted if one of the elements
+      // are tainted
+      result = getArgument(0)
+      or
+      result = getParameter(0).getUnknownMember().getMember("sql").getARhs()
     }
   }
 
   /**
-   * A call to `Transaction.run`, `Transaction.runStream` or `Transaction.runUpdate`.
+   * A SQL execution that only takes the input in the `sql` option, and do not accept query strings
+   * directly.
    */
-  class TransactionRunCall extends SqlExecution {
-    TransactionRunCall() {
-      this = transaction().getMember(["run", "runStream", "runUpdate"]).getACall()
-    }
-  }
-
-  /**
-   * A call to `v1.SpannerClient.executeSql` or `v1.SpannerClient.executeStreamingSql`.
-   */
-  class ExecuteSqlCall extends SqlExecution {
-    ExecuteSqlCall() {
+  class SqlExecutionWithOption extends SqlExecution {
+    SqlExecutionWithOption() {
       this = v1SpannerClient().getMember(["executeSql", "executeStreamingSql"]).getACall()
     }
 
-    override DataFlow::Node getAQueryArgument() {
-      // `executeSql` and `executeStreamingSql` do not accept query strings directly
-      result = getOptionArgument(0, "sql")
-    }
+    override DataFlow::Node getAQueryArgument() { result = getOptionArgument(0, "sql") }
   }
 
   /**
diff --git a/javascript/ql/src/semmle/javascript/frameworks/SocketIO.qll b/javascript/ql/src/semmle/javascript/frameworks/SocketIO.qll
index a7ba74dfcd2..639d76da2dd 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/SocketIO.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/SocketIO.qll
@@ -268,9 +268,11 @@ module SocketIO {
 
     /** Gets the `i`th parameter through which data is received from a client. */
     override DataFlow::SourceNode getReceivedItem(int i) {
-      exists(DataFlow::FunctionNode cb | cb = getListener() and result = cb.getParameter(i) |
+      exists(DataFlow::FunctionNode cb |
+        cb = getListener() and
+        result = cb.getParameter(i) and
         // exclude last parameter if it looks like a callback
-        result != cb.getLastParameter() or not exists(result.getAnInvocation())
+        not (result = cb.getLastParameter() and exists(result.getAnInvocation()))
       )
     }
 
diff --git a/javascript/ql/src/semmle/javascript/frameworks/SystemCommandExecutors.qll b/javascript/ql/src/semmle/javascript/frameworks/SystemCommandExecutors.qll
index 913f7fd7205..ce445cfd174 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/SystemCommandExecutors.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/SystemCommandExecutors.qll
@@ -43,9 +43,15 @@ private predicate execApi(string mod, int cmdArg, int optionsArg, boolean shell)
   )
   or
   shell = true and
-  mod = "exec" and
-  optionsArg = -2 and
-  cmdArg = 0
+  (
+    mod = "exec" and
+    optionsArg = -2 and
+    cmdArg = 0
+    or
+    mod = "async-execute" and
+    optionsArg = 1 and
+    cmdArg = 0
+  )
 }
 
 private class SystemCommandExecutors extends SystemCommandExecution, DataFlow::InvokeNode {
diff --git a/javascript/ql/src/semmle/javascript/frameworks/WebSocket.qll b/javascript/ql/src/semmle/javascript/frameworks/WebSocket.qll
index 8d4cb9b7126..f40011ef105 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/WebSocket.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/WebSocket.qll
@@ -81,7 +81,7 @@ module ClientWebSocket {
   /**
    * A client WebSocket instance.
    */
-  class ClientSocket extends EventEmitter::Range, DataFlow::SourceNode {
+  class ClientSocket extends EventEmitter::Range, DataFlow::NewNode, ClientRequest::Range {
     SocketClass socketClass;
 
     ClientSocket() { this = socketClass.getAnInstantiation() }
@@ -90,6 +90,26 @@ module ClientWebSocket {
      * Gets the WebSocket library name.
      */
     LibraryName getLibrary() { result = socketClass.getLibrary() }
+
+    override DataFlow::Node getUrl() { result = getArgument(0) }
+
+    override DataFlow::Node getHost() { none() }
+
+    override DataFlow::Node getADataNode() {
+      exists(SendNode send |
+        send.getEmitter() = this and
+        result = send.getSentItem(_)
+      )
+    }
+
+    override DataFlow::Node getAResponseDataNode(string responseType, boolean promise) {
+      responseType = "json" and
+      promise = false and
+      exists(WebSocketReceiveNode receiver |
+        receiver.getEmitter() = this and
+        result = receiver.getReceivedItem(_)
+      )
+    }
   }
 
   /**
@@ -180,20 +200,21 @@ module ServerWebSocket {
     result = DataFlow::moduleImport("sockjs").getAMemberCall("createServer")
   }
 
+  /**
+   * Gets a `socket.on("connection", (msg, req) => {})` call.
+   */
+  private DataFlow::CallNode getAConnectionCall(LibraryName library) {
+    result = getAServer(library).getAMemberCall(EventEmitter::on()) and
+    result.getArgument(0).mayHaveStringValue("connection")
+  }
+
   /**
    * A server WebSocket instance.
    */
   class ServerSocket extends EventEmitter::Range, DataFlow::SourceNode {
     LibraryName library;
 
-    ServerSocket() {
-      exists(DataFlow::CallNode onCall |
-        onCall = getAServer(library).getAMemberCall(EventEmitter::on()) and
-        onCall.getArgument(0).mayHaveStringValue("connection")
-      |
-        this = onCall.getCallback(1).getParameter(0)
-      )
-    }
+    ServerSocket() { this = getAConnectionCall(library).getCallback(1).getParameter(0) }
 
     /**
      * Gets the name of the library that created this server socket.
@@ -201,6 +222,51 @@ module ServerWebSocket {
     LibraryName getLibrary() { result = library }
   }
 
+  /**
+   * A `socket.on("connection", (msg, req) => {})` call seen as a HTTP route handler.
+   * `req` is a `HTTP::IncomingMessage` instance.
+   */
+  class ConnectionCallAsRouteHandler extends HTTP::RouteHandler, DataFlow::CallNode {
+    ConnectionCallAsRouteHandler() { this = getAConnectionCall(_) }
+
+    override HTTP::HeaderDefinition getAResponseHeader(string name) { none() }
+  }
+
+  /**
+   * The `req` parameter of a `socket.on("connection", (msg, req) => {})` call.
+   */
+  class ServerHTTPRequest extends HTTP::Servers::RequestSource {
+    ConnectionCallAsRouteHandler handler;
+
+    ServerHTTPRequest() { this = handler.getCallback(1).getParameter(1) }
+
+    override HTTP::RouteHandler getRouteHandler() { result = handler }
+  }
+
+  /**
+   * An access user-controlled HTTP request input in a request to a WebSocket server.
+   */
+  class WebSocketRequestInput extends HTTP::RequestInputAccess {
+    ServerHTTPRequest request;
+    string kind;
+
+    WebSocketRequestInput() {
+      kind = "url" and
+      this = request.ref().getAPropertyRead("url")
+      or
+      kind = "header" and
+      this = request.ref().getAPropertyRead(["headers", "rawHeaders"]).getAPropertyRead()
+      or
+      // req.headers.cookie
+      kind = "cookie" and
+      this = request.ref().getAPropertyRead("headers").getAPropertyRead("cookie")
+    }
+
+    override string getKind() { result = kind }
+
+    override HTTP::RouteHandler getRouteHandler() { result = request.getRouteHandler() }
+  }
+
   /**
    * A message sent from a WebSocket server.
    */
diff --git a/javascript/ql/src/semmle/javascript/frameworks/XmlParsers.qll b/javascript/ql/src/semmle/javascript/frameworks/XmlParsers.qll
index 1e6677ff9e1..94bf5b09363 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/XmlParsers.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/XmlParsers.qll
@@ -2,7 +2,9 @@
  * Provides classes for working with XML parser APIs.
  */
 
-import javascript as js
+private import javascript as js
+private import js::DataFlow as DataFlow
+private import js::API as API
 
 module XML {
   /**
@@ -12,9 +14,9 @@ module XML {
     /** Internal general entity. */
     InternalEntity() or
     /** External general entity, either parsed or unparsed. */
-    ExternalEntity(boolean parsed) { parsed = true or parsed = false } or
+    ExternalEntity(boolean parsed) { parsed = [true, false] } or
     /** Parameter entity, either internal or external. */
-    ParameterEntity(boolean external) { external = true or external = false }
+    ParameterEntity(boolean external) { external = [true, false] }
 
   /**
    * A call to an XML parsing function.
@@ -27,16 +29,19 @@ module XML {
     abstract predicate resolvesEntities(EntityKind kind);
 
     /** Gets a reference to a value resulting from parsing the XML. */
-    js::DataFlow::Node getAResult() { none() }
+    DataFlow::Node getAResult() { none() }
   }
 
   /**
    * An invocation of `libxmljs.parseXml` or `libxmljs.parseXmlString`.
    */
   class LibXmlJsParserInvocation extends ParserInvocation {
+    API::CallNode call;
+
     LibXmlJsParserInvocation() {
       exists(string m |
-        this = js::DataFlow::moduleMember("libxmljs", m).getACall().asExpr() and
+        call = API::moduleImport("libxmljs").getMember(m).getACall() and
+        this = call.asExpr() and
         m.matches("parseXml%")
       )
     }
@@ -53,24 +58,67 @@ module XML {
         noent.mayHaveBooleanValue(true)
       )
     }
-  }
 
-  /**
-   * Gets a call to method `methodName` on an instance of class `className` from module `modName`.
-   */
-  private js::MethodCallExpr moduleMethodCall(string modName, string className, string methodName) {
-    exists(js::DataFlow::ModuleImportNode mod |
-      mod.getPath() = modName and
-      result = mod.getAConstructorInvocation(className).getAMethodCall(methodName).asExpr()
-    )
+    /**
+     * A document from the `libxmljs` library.
+     * The API is based on https://github.com/DefinitelyTyped/DefinitelyTyped/blob/master/types/libxmljs/index.d.ts
+     */
+    private API::Node doc() {
+      result = call.getReturn()
+      or
+      result = doc().getMember("encoding").getReturn()
+      or
+      result = element().getMember("doc").getReturn()
+      or
+      result = element().getMember("parent").getReturn()
+    }
+
+    /**
+     * An `Element` from the `libxmljs` library.
+     */
+    private API::Node element() {
+      result = doc().getMember(["child", "get", "node", "root"]).getReturn()
+      or
+      result = [doc(), element()].getMember(["childNodes", "find"]).getReturn().getAMember()
+      or
+      result =
+        element()
+            .getMember([
+                "parent", "prevSibling", "nextSibling", "remove", "clone", "node", "child",
+                "prevElement", "nextElement"
+              ])
+            .getReturn()
+    }
+
+    /**
+     * An `Attr` from the `libxmljs` library.
+     */
+    private API::Node attr() {
+      result = element().getMember("attr").getReturn()
+      or
+      result = element().getMember("attrs").getReturn().getAMember()
+    }
+
+    override DataFlow::Node getAResult() {
+      result = [doc(), element(), attr()].getAnImmediateUse()
+      or
+      result = element().getMember(["name", "text"]).getACall()
+      or
+      result = attr().getMember(["name", "value"]).getACall()
+      or
+      result = element().getMember("namespace").getReturn().getMember(["href", "prefix"]).getACall()
+    }
   }
 
   /**
    * An invocation of `libxmljs.SaxParser.parseString`.
    */
   class LibXmlJsSaxParserInvocation extends ParserInvocation {
+    API::Node parser;
+
     LibXmlJsSaxParserInvocation() {
-      this = moduleMethodCall("libxmljs", "SaxParser", "parseString")
+      parser = API::moduleImport("libxmljs").getMember("SaxParser").getInstance() and
+      this = parser.getMember("parseString").getACall().asExpr()
     }
 
     override js::Expr getSourceArgument() { result = getArgument(0) }
@@ -79,14 +127,21 @@ module XML {
       // entities are resolved by default
       any()
     }
+
+    override DataFlow::Node getAResult() {
+      result = parser.getMember("on").getACall().getABoundCallbackParameter(1, _)
+    }
   }
 
   /**
    * An invocation of `libxmljs.SaxPushParser.push`.
    */
   class LibXmlJsSaxPushParserInvocation extends ParserInvocation {
+    API::Node parser;
+
     LibXmlJsSaxPushParserInvocation() {
-      this = moduleMethodCall("libxmljs", "SaxPushParser", "push")
+      parser = API::moduleImport("libxmljs").getMember("SaxPushParser").getInstance() and
+      this = parser.getMember("push").getACall().asExpr()
     }
 
     override js::Expr getSourceArgument() { result = getArgument(0) }
@@ -95,17 +150,21 @@ module XML {
       // entities are resolved by default
       any()
     }
+
+    override DataFlow::Node getAResult() {
+      result = parser.getMember("on").getACall().getABoundCallbackParameter(1, _)
+    }
   }
 
   /**
    * An invocation of `expat.Parser.parse` or `expat.Parser.write`.
    */
   class ExpatParserInvocation extends ParserInvocation {
-    js::DataFlow::NewNode parser;
+    API::Node parser;
 
     ExpatParserInvocation() {
-      parser = js::DataFlow::moduleMember("node-expat", "Parser").getAnInstantiation() and
-      this = parser.getAMemberCall(["parse", "write"]).asExpr()
+      parser = API::moduleImport("node-expat").getMember("Parser").getInstance() and
+      this = parser.getMember(["parse", "write"]).getACall().asExpr()
     }
 
     override js::Expr getSourceArgument() { result = getArgument(0) }
@@ -115,8 +174,8 @@ module XML {
       kind = InternalEntity()
     }
 
-    override js::DataFlow::Node getAResult() {
-      result = parser.getAMemberCall("on").getABoundCallbackParameter(1, _)
+    override DataFlow::Node getAResult() {
+      result = parser.getMember("on").getACall().getABoundCallbackParameter(1, _)
     }
   }
 
@@ -125,17 +184,22 @@ module XML {
    */
   private class DOMParserXmlParserInvocation extends XML::ParserInvocation {
     DOMParserXmlParserInvocation() {
-      exists(js::DataFlow::GlobalVarRefNode domparser |
-        domparser.getName() = "DOMParser" and
-        this = domparser.getAnInstantiation().getAMethodCall("parseFromString").asExpr() and
-        // type contains the string `xml`, that is, it's not `text/html`
-        getArgument(1).mayHaveStringValue(any(string tp | tp.matches("%xml%")))
-      )
+      this =
+        DataFlow::globalVarRef("DOMParser")
+            .getAnInstantiation()
+            .getAMethodCall("parseFromString")
+            .asExpr() and
+      // type contains the string `xml`, that is, it's not `text/html`
+      getArgument(1).mayHaveStringValue(any(string tp | tp.matches("%xml%")))
     }
 
     override js::Expr getSourceArgument() { result = getArgument(0) }
 
     override predicate resolvesEntities(XML::EntityKind kind) { kind = InternalEntity() }
+
+    // The result is an XMLDocument (https://developer.mozilla.org/en-US/docs/Web/API/XMLDocument).
+    // The API of the XMLDocument is not modelled.
+    override DataFlow::Node getAResult() { result.asExpr() = this }
   }
 
   /**
@@ -143,8 +207,8 @@ module XML {
    */
   private class IELegacyXmlParserInvocation extends XML::ParserInvocation {
     IELegacyXmlParserInvocation() {
-      exists(js::DataFlow::NewNode activeXObject, string activeXType |
-        activeXObject = js::DataFlow::globalVarRef("ActiveXObject").getAnInstantiation() and
+      exists(DataFlow::NewNode activeXObject, string activeXType |
+        activeXObject = DataFlow::globalVarRef("ActiveXObject").getAnInstantiation() and
         activeXObject.getArgument(0).asExpr().mayHaveStringValue(activeXType) and
         activeXType.regexpMatch("Microsoft\\.XMLDOM|Msxml.*\\.DOMDocument.*") and
         this = activeXObject.getAMethodCall("loadXML").asExpr()
@@ -173,10 +237,10 @@ module XML {
    * An invocation of `xml2js`.
    */
   private class Xml2JSInvocation extends XML::ParserInvocation {
-    js::DataFlow::CallNode call;
+    API::CallNode call;
 
     Xml2JSInvocation() {
-      exists(js::API::Node imp | imp = js::API::moduleImport("xml2js") |
+      exists(API::Node imp | imp = API::moduleImport("xml2js") |
         call = [imp, imp.getMember("Parser").getInstance()].getMember("parseString").getACall() and
         this = call.asExpr()
       )
@@ -189,7 +253,7 @@ module XML {
       none()
     }
 
-    override js::DataFlow::Node getAResult() {
+    override DataFlow::Node getAResult() {
       result = call.getABoundCallbackParameter(call.getNumArgument() - 1, 1)
     }
   }
@@ -198,10 +262,10 @@ module XML {
    * An invocation of `sax`.
    */
   private class SaxInvocation extends XML::ParserInvocation {
-    js::DataFlow::InvokeNode parser;
+    API::InvokeNode parser;
 
     SaxInvocation() {
-      exists(js::API::Node imp | imp = js::API::moduleImport("sax") |
+      exists(API::Node imp | imp = API::moduleImport("sax") |
         parser = imp.getMember("parser").getACall()
         or
         parser = imp.getMember("SAXParser").getAnInstantiation()
@@ -216,13 +280,13 @@ module XML {
       none()
     }
 
-    override js::DataFlow::Node getAResult() {
+    override DataFlow::Node getAResult() {
       result =
         parser
-            .getAPropertyWrite(any(string s | s.matches("on%")))
-            .getRhs()
-            .getAFunctionValue()
+            .getReturn()
+            .getMember(any(string s | s.matches("on%")))
             .getAParameter()
+            .getAnImmediateUse()
     }
   }
 
@@ -232,7 +296,8 @@ module XML {
   private class XmlJSInvocation extends XML::ParserInvocation {
     XmlJSInvocation() {
       this =
-        js::DataFlow::moduleMember("xml-js", ["xml2json", "xml2js", "json2xml", "js2xml"])
+        API::moduleImport("xml-js")
+            .getMember(["xml2json", "xml2js", "json2xml", "js2xml"])
             .getACall()
             .asExpr()
     }
@@ -244,18 +309,18 @@ module XML {
       none()
     }
 
-    override js::DataFlow::Node getAResult() { result.asExpr() = this }
+    override DataFlow::Node getAResult() { result.asExpr() = this }
   }
 
   /**
    * An invocation of `htmlparser2`.
    */
   private class HtmlParser2Invocation extends XML::ParserInvocation {
-    js::DataFlow::NewNode parser;
+    API::NewNode parser;
 
     HtmlParser2Invocation() {
-      parser = js::DataFlow::moduleMember("htmlparser2", "Parser").getAnInstantiation() and
-      this = parser.getAMemberCall("write").asExpr()
+      parser = API::moduleImport("htmlparser2").getMember("Parser").getAnInstantiation() and
+      this = parser.getReturn().getMember("write").getACall().asExpr()
     }
 
     override js::Expr getSourceArgument() { result = getArgument(0) }
@@ -265,7 +330,7 @@ module XML {
       none()
     }
 
-    override js::DataFlow::Node getAResult() {
+    override DataFlow::Node getAResult() {
       result =
         parser
             .getArgument(0)
@@ -277,7 +342,7 @@ module XML {
   }
 
   private class XMLParserTaintStep extends js::TaintTracking::SharedTaintStep {
-    override predicate deserializeStep(js::DataFlow::Node pred, js::DataFlow::Node succ) {
+    override predicate deserializeStep(DataFlow::Node pred, DataFlow::Node succ) {
       exists(XML::ParserInvocation parser |
         pred.asExpr() = parser.getSourceArgument() and
         succ = parser.getAResult()
diff --git a/javascript/ql/src/semmle/javascript/internal/CachedStages.qll b/javascript/ql/src/semmle/javascript/internal/CachedStages.qll
index b5a2a5ac3ef..6980a6eef7f 100644
--- a/javascript/ql/src/semmle/javascript/internal/CachedStages.qll
+++ b/javascript/ql/src/semmle/javascript/internal/CachedStages.qll
@@ -133,6 +133,8 @@ module Stages {
       exists(any(DataFlow::Node node).toString())
       or
       exists(any(AccessPath a).getAnInstanceIn(_))
+      or
+      exists(any(DataFlow::PropRef ref).getBase())
     }
   }
 
@@ -219,7 +221,7 @@ module Stages {
       or
       AccessPath::DominatingPaths::hasDominatingWrite(_)
       or
-      any(DataFlow::AdditionalFlowStep s).step(_, _)
+      DataFlow::SharedFlowStep::step(_, _)
     }
   }
 
diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/DOM.qll b/javascript/ql/src/semmle/javascript/security/dataflow/DOM.qll
index d9484d9575b..204f04e9c52 100644
--- a/javascript/ql/src/semmle/javascript/security/dataflow/DOM.qll
+++ b/javascript/ql/src/semmle/javascript/security/dataflow/DOM.qll
@@ -156,6 +156,12 @@ private module PersistentWebStorage {
     result = DataFlow::globalVarRef(kind)
   }
 
+  pragma[noinline]
+  WriteAccess getAWriteByName(string name, string kind) {
+    result.getKey() = name and
+    result.getKind() = kind
+  }
+
   /**
    * A read access.
    */
@@ -165,8 +171,10 @@ private module PersistentWebStorage {
     ReadAccess() { this = webStorage(kind).getAMethodCall("getItem") }
 
     override PersistentWriteAccess getAWrite() {
-      getArgument(0).mayHaveStringValue(result.(WriteAccess).getKey()) and
-      result.(WriteAccess).getKind() = kind
+      exists(string name |
+        getArgument(0).mayHaveStringValue(name) and
+        result = getAWriteByName(name, kind)
+      )
     }
   }
 
diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/ExternalAPIUsedWithUntrustedDataCustomizations.qll b/javascript/ql/src/semmle/javascript/security/dataflow/ExternalAPIUsedWithUntrustedDataCustomizations.qll
index 9b1a582fd9d..f9eaa7c7ce7 100644
--- a/javascript/ql/src/semmle/javascript/security/dataflow/ExternalAPIUsedWithUntrustedDataCustomizations.qll
+++ b/javascript/ql/src/semmle/javascript/security/dataflow/ExternalAPIUsedWithUntrustedDataCustomizations.qll
@@ -255,15 +255,12 @@ module ExternalAPIUsedWithUntrustedData {
       not exists(DataFlow::Node arg |
         arg = this.getAnArgument() and not arg instanceof DeepObjectSink
       |
-        TaintTracking::sharedTaintStep(arg, _)
-        or
-        exists(DataFlow::AdditionalFlowStep s |
-          s.step(arg, _) or
-          s.step(arg, _, _, _) or
-          s.loadStep(arg, _, _) or
-          s.storeStep(arg, _, _) or
-          s.loadStoreStep(arg, _, _)
-        )
+        TaintTracking::sharedTaintStep(arg, _) or
+        DataFlow::SharedFlowStep::step(arg, _) or
+        DataFlow::SharedFlowStep::step(arg, _, _, _) or
+        DataFlow::SharedFlowStep::loadStep(arg, _, _) or
+        DataFlow::SharedFlowStep::storeStep(arg, _, _) or
+        DataFlow::SharedFlowStep::loadStoreStep(arg, _, _)
       )
     }
 
diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/PrototypePollutingAssignment.qll b/javascript/ql/src/semmle/javascript/security/dataflow/PrototypePollutingAssignment.qll
index 85dde941e37..c6fc119190e 100644
--- a/javascript/ql/src/semmle/javascript/security/dataflow/PrototypePollutingAssignment.qll
+++ b/javascript/ql/src/semmle/javascript/security/dataflow/PrototypePollutingAssignment.qll
@@ -100,10 +100,10 @@ module PrototypePollutingAssignment {
     // users wouldn't bother to call Object.create in that case.
     result = DataFlow::globalVarRef("Object").getAMemberCall("create")
     or
-    // Allow use of AdditionalFlowSteps to track a bit further
+    // Allow use of SharedFlowSteps to track a bit further
     exists(DataFlow::Node mid |
       prototypeLessObject(t.continue()).flowsTo(mid) and
-      any(DataFlow::AdditionalFlowStep s).step(mid, result)
+      DataFlow::SharedFlowStep::step(mid, result)
     )
     or
     exists(DataFlow::TypeTracker t2 | result = prototypeLessObject(t2).track(t2, t))
diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/RemoteFlowSources.qll b/javascript/ql/src/semmle/javascript/security/dataflow/RemoteFlowSources.qll
index c5a39772cf4..89574f4886b 100644
--- a/javascript/ql/src/semmle/javascript/security/dataflow/RemoteFlowSources.qll
+++ b/javascript/ql/src/semmle/javascript/security/dataflow/RemoteFlowSources.qll
@@ -108,7 +108,7 @@ private class RemoteFlowSourceAccessPath extends JSONString {
     exists(JSONObject specs |
       specs.isTopLevel() and
       this.getFile().getBaseName() = "codeql-javascript-remote-flow-sources.json" and
-      this = specs.getPropValue(sourceType).(JSONArray).getElementValue(_) and
+      this = specs.getPropValue(sourceType).getElementValue(_) and
       this.getValue().regexpMatch("window(\\.\\w+)+")
     )
   }
diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/RequestForgery.qll b/javascript/ql/src/semmle/javascript/security/dataflow/RequestForgery.qll
index 5aa37c83e0b..99c5300469b 100644
--- a/javascript/ql/src/semmle/javascript/security/dataflow/RequestForgery.qll
+++ b/javascript/ql/src/semmle/javascript/security/dataflow/RequestForgery.qll
@@ -31,5 +31,9 @@ module RequestForgery {
     override predicate isSanitizerEdge(DataFlow::Node source, DataFlow::Node sink) {
       sanitizingPrefixEdge(source, sink)
     }
+
+    override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
+      isAdditionalRequestForgeryStep(pred, succ)
+    }
   }
 }
diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/RequestForgeryCustomizations.qll b/javascript/ql/src/semmle/javascript/security/dataflow/RequestForgeryCustomizations.qll
index 52d75ad450a..b3c1a539082 100644
--- a/javascript/ql/src/semmle/javascript/security/dataflow/RequestForgeryCustomizations.qll
+++ b/javascript/ql/src/semmle/javascript/security/dataflow/RequestForgeryCustomizations.qll
@@ -59,4 +59,14 @@ module RequestForgery {
 
     override string getKind() { result = kind }
   }
+
+  /**
+   * Holds if there is a taint step from `pred` to `succ` for request forgery.
+   */
+  predicate isAdditionalRequestForgeryStep(DataFlow::Node pred, DataFlow::Node succ) {
+    exists(DataFlow::NewNode url | url = DataFlow::globalVarRef("URL").getAnInstantiation() |
+      succ = url and
+      pred = url.getArgument(0)
+    )
+  }
 }
diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/ShellCommandInjectionFromEnvironmentCustomizations.qll b/javascript/ql/src/semmle/javascript/security/dataflow/ShellCommandInjectionFromEnvironmentCustomizations.qll
index 4528376b1c8..178c396ad8c 100644
--- a/javascript/ql/src/semmle/javascript/security/dataflow/ShellCommandInjectionFromEnvironmentCustomizations.qll
+++ b/javascript/ql/src/semmle/javascript/security/dataflow/ShellCommandInjectionFromEnvironmentCustomizations.qll
@@ -55,4 +55,14 @@ module ShellCommandInjectionFromEnvironment {
   class ShellCommandSink extends Sink, DataFlow::ValueNode {
     ShellCommandSink() { any(SystemCommandExecution sys).isShellInterpreted(this) }
   }
+
+  /**
+   * A string-concatenation leaf that is surrounded by quotes, seen as a sanitizer for command-injection.
+   */
+  class QuotingConcatSanitizer extends Sanitizer, StringOps::ConcatenationLeaf {
+    QuotingConcatSanitizer() {
+      this.getNextLeaf().getStringValue().regexpMatch("(\"|').*") and
+      this.getPreviousLeaf().getStringValue().regexpMatch(".*(\"|')")
+    }
+  }
 }
diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/TaintedPathCustomizations.qll b/javascript/ql/src/semmle/javascript/security/dataflow/TaintedPathCustomizations.qll
index 0d7bd73886a..ebc877e0e25 100644
--- a/javascript/ql/src/semmle/javascript/security/dataflow/TaintedPathCustomizations.qll
+++ b/javascript/ql/src/semmle/javascript/security/dataflow/TaintedPathCustomizations.qll
@@ -636,6 +636,20 @@ module TaintedPath {
     SendPathSink() { this = DataFlow::moduleImport("send").getACall().getArgument(1) }
   }
 
+  /**
+   * A path argument given to a `Page` in puppeteer, specifying where a pdf/screenshot should be saved.
+   */
+  private class PuppeteerPath extends TaintedPath::Sink {
+    PuppeteerPath() {
+      this =
+        Puppeteer::page()
+            .getMember(["pdf", "screenshot"])
+            .getParameter(0)
+            .getMember("path")
+            .getARhs()
+    }
+  }
+
   /**
    * Holds if there is a step `src -> dst` mapping `srclabel` to `dstlabel` relevant for path traversal vulnerabilities.
    */
diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/UnsafeShellCommandConstructionCustomizations.qll b/javascript/ql/src/semmle/javascript/security/dataflow/UnsafeShellCommandConstructionCustomizations.qll
index 32eda1db8de..20b69168474 100644
--- a/javascript/ql/src/semmle/javascript/security/dataflow/UnsafeShellCommandConstructionCustomizations.qll
+++ b/javascript/ql/src/semmle/javascript/security/dataflow/UnsafeShellCommandConstructionCustomizations.qll
@@ -53,7 +53,12 @@ module UnsafeShellCommandConstruction {
   class ExternalInputSource extends Source, DataFlow::ParameterNode {
     ExternalInputSource() {
       this = Exports::getALibraryInputParameter() and
-      not this.getName() = ["cmd", "command"] // looks to be on purpose.
+      not (
+        // looks to be on purpose.
+        this.getName() = ["cmd", "command"]
+        or
+        this.getName().regexpMatch(".*(Cmd|Command)$") // ends with "Cmd" or "Command"
+      )
     }
   }
 
@@ -70,6 +75,12 @@ module UnsafeShellCommandConstruction {
     exists(DataFlow::TypeBackTracker t2 |
       t2 = t.smallstep(result, isExecutedAsShellCommand(t2, sys))
     )
+    or
+    exists(DataFlow::TypeBackTracker t2, StringOps::ConcatenationRoot prev |
+      t = t2.continue() and
+      isExecutedAsShellCommand(t2, sys) = prev and
+      result = prev.getALeaf()
+    )
   }
 
   /**
@@ -143,6 +154,74 @@ module UnsafeShellCommandConstruction {
     override DataFlow::Node getAlertLocation() { result = this }
   }
 
+  /**
+   * Gets a node that ends up in an array that is ultimately executed as a shell script by `sys`.
+   */
+  private DataFlow::SourceNode endsInShellExecutedArray(
+    DataFlow::TypeBackTracker t, SystemCommandExecution sys
+  ) {
+    t.start() and
+    result = sys.getArgumentList().getALocalSource() and
+    // the array gets joined to a string when `shell` is set to true.
+    sys.getOptionsArg()
+        .getALocalSource()
+        .getAPropertyWrite("shell")
+        .getRhs()
+        .asExpr()
+        .(BooleanLiteral)
+        .getValue() = "true"
+    or
+    exists(DataFlow::TypeBackTracker t2 |
+      result = endsInShellExecutedArray(t2, sys).backtrack(t2, t)
+    )
+  }
+
+  /**
+   * An argument to a command invocation where the `shell` option is set to true.
+   */
+  class ShellTrueCommandExecutionSink extends Sink {
+    SystemCommandExecution sys;
+
+    ShellTrueCommandExecutionSink() {
+      // `shell` is set to true. That means string-concatenation happens behind the scenes.
+      // We just assume that a `shell` option in any library means the same thing as it does in NodeJS.
+      exists(DataFlow::SourceNode arr |
+        arr = endsInShellExecutedArray(DataFlow::TypeBackTracker::end(), sys)
+      |
+        this = arr.(DataFlow::ArrayCreationNode).getAnElement()
+        or
+        this = arr.getAMethodCall(["push", "unshift"]).getAnArgument()
+      )
+    }
+
+    override string getSinkType() { result = "Shell argument" }
+
+    override SystemCommandExecution getCommandExecution() { result = sys }
+
+    override DataFlow::Node getAlertLocation() { result = this }
+  }
+
+  /**
+   * A joined path (`path.{resolve/join}(..)`) that is later executed as a shell command.
+   * Joining a path is similar to string concatenation that automatically inserts slashes.
+   */
+  class JoinedPathEndingInCommandExecutionSink extends Sink {
+    DataFlow::MethodCallNode joinCall;
+    SystemCommandExecution sys;
+
+    JoinedPathEndingInCommandExecutionSink() {
+      this = joinCall.getAnArgument() and
+      joinCall = DataFlow::moduleMember("path", ["resolve", "join"]).getACall() and
+      joinCall = isExecutedAsShellCommand(DataFlow::TypeBackTracker::end(), sys)
+    }
+
+    override string getSinkType() { result = "Path concatenation" }
+
+    override SystemCommandExecution getCommandExecution() { result = sys }
+
+    override DataFlow::Node getAlertLocation() { result = this }
+  }
+
   /**
    * A sanitizer like: "'"+name.replace(/'/g,"'\\''")+"'"
    * Which sanitizes on Unix.
diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/Xss.qll b/javascript/ql/src/semmle/javascript/security/dataflow/Xss.qll
index bf8ad71ec99..6a7bd111a9f 100644
--- a/javascript/ql/src/semmle/javascript/security/dataflow/Xss.qll
+++ b/javascript/ql/src/semmle/javascript/security/dataflow/Xss.qll
@@ -211,7 +211,7 @@ module DomBasedXss {
       exists(JQuery::MethodCall call |
         call.interpretsArgumentAsHtml(this) and
         call.interpretsArgumentAsSelector(this) and
-        analyze().getAType() = TTString()
+        pragma[only_bind_out](analyze()).getAType() = TTString()
       )
     }
 
diff --git a/javascript/ql/test/ApiGraphs/typed/NodeOfType.expected b/javascript/ql/test/ApiGraphs/typed/NodeOfType.expected
index 4513f16cfc3..09fd4b89242 100644
--- a/javascript/ql/test/ApiGraphs/typed/NodeOfType.expected
+++ b/javascript/ql/test/ApiGraphs/typed/NodeOfType.expected
@@ -1,3 +1,4 @@
 | mongodb | Collection | index.ts:14:3:14:17 | getCollection() |
 | mongoose | Model | index.ts:22:3:22:20 | getMongooseModel() |
 | mongoose | Query | index.ts:23:3:23:20 | getMongooseQuery() |
+| puppeteer | Browser | index.ts:30:22:30:33 | this.browser |
diff --git a/javascript/ql/test/ApiGraphs/typed/index.ts b/javascript/ql/test/ApiGraphs/typed/index.ts
index 8f1338d95c2..0b35d1582d9 100644
--- a/javascript/ql/test/ApiGraphs/typed/index.ts
+++ b/javascript/ql/test/ApiGraphs/typed/index.ts
@@ -22,3 +22,11 @@ app.post("/find", (req, res) => {
   getMongooseModel().find({ id: v }); /* def (parameter 0 (member find (instance (member Model (member exports (module mongoose)))))) */
   getMongooseQuery().find({ id: v }); /* def (parameter 0 (member find (instance (member Query (member exports (module mongoose)))))) */
 });
+
+import * as puppeteer from 'puppeteer';
+class Renderer {
+    private browser: puppeteer.Browser;
+    foo(): void {
+        const page = this.browser.newPage(); /* use (instance (member Browser (member exports (module puppeteer)))) */
+    }
+}
\ No newline at end of file
diff --git a/javascript/ql/test/library-tests/NPM/src/package.json b/javascript/ql/test/library-tests/NPM/src/package.json
index fcf5f3ca356..094bcc81bea 100644
--- a/javascript/ql/test/library-tests/NPM/src/package.json
+++ b/javascript/ql/test/library-tests/NPM/src/package.json
@@ -7,7 +7,9 @@
       "web": "http://mine.com"
   }],
   "dependencies": {
-      "esprima": "*"
+      "esprima": "*",
+      "something": "1.2.3-alpha.beta",
+      "foo": "! garbage string we \nreally can't parse %"
   },
   "devDependencies": {
       "mocha": "1.0"
diff --git a/javascript/ql/test/library-tests/NPM/tests.expected b/javascript/ql/test/library-tests/NPM/tests.expected
index 58f7c0647a9..696500f8163 100644
--- a/javascript/ql/test/library-tests/NPM/tests.expected
+++ b/javascript/ql/test/library-tests/NPM/tests.expected
@@ -1,6 +1,8 @@
 dependencies
-| src/package.json:1:1:18:1 | {\\n  "na ... "\\n  }\\n} | esprima | * |
-| src/package.json:1:1:18:1 | {\\n  "na ... "\\n  }\\n} | mocha | 1.0 |
+| src/package.json:1:1:20:1 | {\\n  "na ... "\\n  }\\n} | esprima | * |
+| src/package.json:1:1:20:1 | {\\n  "na ... "\\n  }\\n} | foo | ! garbage string we \nreally can't parse % |
+| src/package.json:1:1:20:1 | {\\n  "na ... "\\n  }\\n} | mocha | 1.0 |
+| src/package.json:1:1:20:1 | {\\n  "na ... "\\n  }\\n} | something | 1.2.3-alpha.beta |
 importedFile
 | src/lib/tst2.js:1:1:1:13 | require("..") | src/index.js:0:0:0:0 | src/index.js |
 | src/node_modules/nested/tst3.js:1:1:1:29 | require ... odule') | src/node_modules/third-party-module/fancy.js:0:0:0:0 | src/node_modules/third-party-module/fancy.js |
@@ -29,16 +31,27 @@ modules
 | src/node_modules/third-party-module | third-party-module | src/node_modules/third-party-module/fancy.js:1:1:4:0 | <toplevel> |
 npm
 | src/node_modules/third-party-module/package.json:1:1:5:1 | {\\n  "na ... y.js"\\n} | third-party-module | 23.4.0 |
-| src/package.json:1:1:18:1 | {\\n  "na ... "\\n  }\\n} | test-package | 0.1.0 |
+| src/package.json:1:1:20:1 | {\\n  "na ... "\\n  }\\n} | test-package | 0.1.0 |
 getMainModule
 | src/node_modules/b/package.json:1:1:4:1 | {\\n  "na ... "lib"\\n} | b | src/node_modules/b/lib/index.js:1:1:2:0 | <toplevel> |
 | src/node_modules/c/package.json:1:1:4:1 | {\\n  "na ... src/"\\n} | c | src/node_modules/c/src/index.js:1:1:2:0 | <toplevel> |
 | src/node_modules/d/package.json:1:1:4:1 | {\\n  "na ... main"\\n} | d | src/node_modules/d/main.js:1:1:2:0 | <toplevel> |
 | src/node_modules/third-party-module/package.json:1:1:5:1 | {\\n  "na ... y.js"\\n} | third-party-module | src/node_modules/third-party-module/fancy.js:1:1:4:0 | <toplevel> |
-| src/package.json:1:1:18:1 | {\\n  "na ... "\\n  }\\n} | test-package | src/index.js:1:1:4:0 | <toplevel> |
+| src/package.json:1:1:20:1 | {\\n  "na ... "\\n  }\\n} | test-package | src/index.js:1:1:4:0 | <toplevel> |
 packageJSON
 | src/node_modules/b/package.json:1:1:4:1 | {\\n  "na ... "lib"\\n} |
 | src/node_modules/c/package.json:1:1:4:1 | {\\n  "na ... src/"\\n} |
 | src/node_modules/d/package.json:1:1:4:1 | {\\n  "na ... main"\\n} |
 | src/node_modules/third-party-module/package.json:1:1:5:1 | {\\n  "na ... y.js"\\n} |
-| src/package.json:1:1:18:1 | {\\n  "na ... "\\n  }\\n} |
+| src/package.json:1:1:20:1 | {\\n  "na ... "\\n  }\\n} |
+dependencyInfo
+| src/index.js:1:1:4:0 | <toplevel> | test-package | 0.1.0 |
+| src/lib/tst2.js:1:1:1:14 | <toplevel> | test-package | 0.1.0 |
+| src/lib/tst.js:1:1:4:0 | <toplevel> | test-package | 0.1.0 |
+| src/node_modules/third-party-module/fancy.js:1:1:4:0 | <toplevel> | third-party-module | 23.4.0 |
+| src/package.json:10:18:10:20 | "*" | esprima | unknown |
+| src/package.json:11:20:11:37 | "1.2.3-alpha.beta" | something | unknown |
+| src/package.json:12:14:12:57 | "! garb ... arse %" | foo | unknown |
+| src/package.json:15:16:15:20 | "1.0" | mocha | 1.0 |
+| src/tst2.js:1:1:1:13 | <toplevel> | test-package | 0.1.0 |
+| src/tst.js:1:1:2:38 | <toplevel> | test-package | 0.1.0 |
diff --git a/javascript/ql/test/library-tests/NPM/tests.ql b/javascript/ql/test/library-tests/NPM/tests.ql
index 9e4fa0c961d..52714084a81 100644
--- a/javascript/ql/test/library-tests/NPM/tests.ql
+++ b/javascript/ql/test/library-tests/NPM/tests.ql
@@ -1,4 +1,5 @@
 import javascript
+import semmle.javascript.dependencies.Dependencies
 
 query predicate dependencies(PackageJSON pkgjson, string pkg, string version) {
   pkgjson.declaresDependency(pkg, version)
@@ -24,3 +25,7 @@ query predicate getMainModule(PackageJSON pkg, string name, Module mod) {
 }
 
 query predicate packageJSON(PackageJSON json) { any() }
+
+query predicate dependencyInfo(Dependency dep, string name, string version) {
+  dep.info(name, version)
+}
diff --git a/javascript/ql/test/library-tests/PackageExports/tests.expected b/javascript/ql/test/library-tests/PackageExports/tests.expected
index 648226a0d13..1d46e149521 100644
--- a/javascript/ql/test/library-tests/PackageExports/tests.expected
+++ b/javascript/ql/test/library-tests/PackageExports/tests.expected
@@ -1,6 +1,3 @@
-getTopmostPackageJSON
-| absent_main/package.json:1:1:4:1 | {\\n    " ... t.js"\\n} |
-| lib1/package.json:1:1:4:1 | {\\n    " ... n.js"\\n} |
 getALibraryInputParameter
 | lib1/foo.js:3:44:3:44 | d |
 | lib1/main.js:6:17:6:17 | a |
diff --git a/javascript/ql/test/library-tests/PackageExports/tests.ql b/javascript/ql/test/library-tests/PackageExports/tests.ql
index 1a23e8d24d9..08ce8bcd068 100644
--- a/javascript/ql/test/library-tests/PackageExports/tests.ql
+++ b/javascript/ql/test/library-tests/PackageExports/tests.ql
@@ -1,8 +1,6 @@
 import javascript
 import semmle.javascript.PackageExports as Exports
 
-query PackageJSON getTopmostPackageJSON() { result = Exports::getTopmostPackageJSON() }
-
 query DataFlow::Node getALibraryInputParameter() { result = Exports::getALibraryInputParameter() }
 
 query DataFlow::Node getAnExportedValue(Module mod, string name) {
diff --git a/javascript/ql/test/library-tests/RecursionPrevention/SourceNodeRange.expected b/javascript/ql/test/library-tests/RecursionPrevention/SourceNodeRange.expected
new file mode 100644
index 00000000000..59f6fd6e79b
--- /dev/null
+++ b/javascript/ql/test/library-tests/RecursionPrevention/SourceNodeRange.expected
@@ -0,0 +1 @@
+| Success |
diff --git a/javascript/ql/test/library-tests/RecursionPrevention/SourceNodeRange.ql b/javascript/ql/test/library-tests/RecursionPrevention/SourceNodeRange.ql
new file mode 100644
index 00000000000..03549a97873
--- /dev/null
+++ b/javascript/ql/test/library-tests/RecursionPrevention/SourceNodeRange.ql
@@ -0,0 +1,14 @@
+/**
+ * Test that fails to compile if the domain of `SourceNode::Range` depends on `SourceNode` (recursively).
+ *
+ * This tests adds a negative dependency `SourceNode --!--> SourceNode::Range`
+ * so that the undesired edge `SourceNode::Range --> SourceNode` completes a negative cycle.
+ */
+
+import javascript
+
+class BadSourceNodeRange extends DataFlow::SourceNode::Internal::RecursionGuard {
+  BadSourceNodeRange() { not this instanceof DataFlow::SourceNode::Range }
+}
+
+select "Success"
diff --git a/javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected b/javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected
index 3195bfc7d8c..8eae0bb62aa 100644
--- a/javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected
+++ b/javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected
@@ -11,6 +11,7 @@ typeInferenceMismatch
 | array-mutation.js:27:16:27:23 | source() | array-mutation.js:28:8:28:8 | g |
 | array-mutation.js:31:33:31:40 | source() | array-mutation.js:32:8:32:8 | h |
 | array-mutation.js:35:36:35:43 | source() | array-mutation.js:36:8:36:8 | i |
+| array-mutation.js:39:17:39:24 | source() | array-mutation.js:40:8:40:8 | j |
 | booleanOps.js:2:11:2:18 | source() | booleanOps.js:4:8:4:8 | x |
 | booleanOps.js:2:11:2:18 | source() | booleanOps.js:13:10:13:10 | x |
 | booleanOps.js:2:11:2:18 | source() | booleanOps.js:19:10:19:10 | x |
@@ -66,6 +67,16 @@ typeInferenceMismatch
 | exceptions.js:144:9:144:16 | source() | exceptions.js:132:8:132:27 | returnThrownSource() |
 | exceptions.js:150:13:150:20 | source() | exceptions.js:153:10:153:10 | e |
 | exceptions.js:158:13:158:20 | source() | exceptions.js:161:10:161:10 | e |
+| getters-and-setters.js:6:20:6:27 | source() | getters-and-setters.js:9:10:9:18 | new C().x |
+| getters-and-setters.js:6:20:6:27 | source() | getters-and-setters.js:13:18:13:20 | c.x |
+| getters-and-setters.js:27:15:27:22 | source() | getters-and-setters.js:23:18:23:18 | v |
+| getters-and-setters.js:47:23:47:30 | source() | getters-and-setters.js:45:14:45:16 | c.x |
+| getters-and-setters.js:60:20:60:27 | source() | getters-and-setters.js:66:10:66:14 | obj.x |
+| getters-and-setters.js:67:13:67:20 | source() | getters-and-setters.js:63:18:63:22 | value |
+| getters-and-setters.js:79:20:79:27 | source() | getters-and-setters.js:88:10:88:18 | new C().x |
+| getters-and-setters.js:79:20:79:27 | source() | getters-and-setters.js:92:14:92:16 | c.x |
+| getters-and-setters.js:79:20:79:27 | source() | getters-and-setters.js:100:10:100:22 | getX(new C()) |
+| getters-and-setters.js:89:17:89:24 | source() | getters-and-setters.js:82:18:82:22 | value |
 | importedReactComponent.jsx:4:40:4:47 | source() | exportedReactComponent.jsx:2:10:2:19 | props.text |
 | indexOf.js:4:11:4:18 | source() | indexOf.js:9:10:9:10 | x |
 | json-stringify.js:2:16:2:23 | source() | json-stringify.js:5:8:5:29 | JSON.st ... source) |
@@ -155,3 +166,7 @@ typeInferenceMismatch
 | xml.js:23:18:23:25 | source() | xml.js:20:14:20:17 | attr |
 | xml.js:26:27:26:34 | source() | xml.js:26:10:26:39 | convert ... (), {}) |
 | xml.js:34:18:34:25 | source() | xml.js:31:18:31:21 | name |
+| xml.js:41:15:41:22 | source() | xml.js:44:10:44:22 | gchild.text() |
+| xml.js:41:15:41:22 | source() | xml.js:49:10:49:34 | child.a ... value() |
+| xml.js:41:15:41:22 | source() | xml.js:52:10:52:34 | child2. ... .name() |
+| xml.js:41:15:41:22 | source() | xml.js:58:12:58:14 | str |
diff --git a/javascript/ql/test/library-tests/TaintTracking/DataFlowTracking.expected b/javascript/ql/test/library-tests/TaintTracking/DataFlowTracking.expected
index 34a6b30bdce..c269ebc1a18 100644
--- a/javascript/ql/test/library-tests/TaintTracking/DataFlowTracking.expected
+++ b/javascript/ql/test/library-tests/TaintTracking/DataFlowTracking.expected
@@ -41,6 +41,16 @@
 | exceptions.js:144:9:144:16 | source() | exceptions.js:132:8:132:27 | returnThrownSource() |
 | exceptions.js:150:13:150:20 | source() | exceptions.js:153:10:153:10 | e |
 | exceptions.js:158:13:158:20 | source() | exceptions.js:161:10:161:10 | e |
+| getters-and-setters.js:6:20:6:27 | source() | getters-and-setters.js:9:10:9:18 | new C().x |
+| getters-and-setters.js:6:20:6:27 | source() | getters-and-setters.js:13:18:13:20 | c.x |
+| getters-and-setters.js:27:15:27:22 | source() | getters-and-setters.js:23:18:23:18 | v |
+| getters-and-setters.js:47:23:47:30 | source() | getters-and-setters.js:45:14:45:16 | c.x |
+| getters-and-setters.js:60:20:60:27 | source() | getters-and-setters.js:66:10:66:14 | obj.x |
+| getters-and-setters.js:67:13:67:20 | source() | getters-and-setters.js:63:18:63:22 | value |
+| getters-and-setters.js:79:20:79:27 | source() | getters-and-setters.js:88:10:88:18 | new C().x |
+| getters-and-setters.js:79:20:79:27 | source() | getters-and-setters.js:92:14:92:16 | c.x |
+| getters-and-setters.js:79:20:79:27 | source() | getters-and-setters.js:100:10:100:22 | getX(new C()) |
+| getters-and-setters.js:89:17:89:24 | source() | getters-and-setters.js:82:18:82:22 | value |
 | indexOf.js:4:11:4:18 | source() | indexOf.js:9:10:9:10 | x |
 | indexOf.js:4:11:4:18 | source() | indexOf.js:13:10:13:10 | x |
 | nested-props.js:4:13:4:20 | source() | nested-props.js:5:10:5:14 | obj.x |
diff --git a/javascript/ql/test/library-tests/TaintTracking/array-mutation.js b/javascript/ql/test/library-tests/TaintTracking/array-mutation.js
index 17657915625..cc581d34a25 100644
--- a/javascript/ql/test/library-tests/TaintTracking/array-mutation.js
+++ b/javascript/ql/test/library-tests/TaintTracking/array-mutation.js
@@ -34,4 +34,8 @@ function test(x, y) {
   let i = [];
   Array.prototype.unshift.apply(i, source());
   sink(i); // NOT OK
+
+  let j = [];
+  j[j.length] = source();
+  sink(j); // NOT OK
 }
diff --git a/javascript/ql/test/library-tests/TaintTracking/getters-and-setters.js b/javascript/ql/test/library-tests/TaintTracking/getters-and-setters.js
new file mode 100644
index 00000000000..4fae44d083c
--- /dev/null
+++ b/javascript/ql/test/library-tests/TaintTracking/getters-and-setters.js
@@ -0,0 +1,102 @@
+import * as dummy from 'dummy';
+
+function testGetterSource() {
+    class C {
+        get x() {
+            return source();
+        }
+    };
+    sink(new C().x); // NOT OK
+
+    function indirection(c) {
+        if (c) {
+            sink(c.x); // NOT OK
+        }
+    }
+    indirection(new C());
+    indirection(null);
+}
+
+function testSetterSink() {
+    class C {
+        set x(v) {
+            sink(v); // NOT OK
+        }
+    };
+    function indirection(c) {
+        c.x = source();
+    }
+    indirection(new C());
+    indirection(null);
+}
+
+function testFlowThroughGetter() {
+    class C {
+        constructor(x) {
+            this._x = x;
+        }
+
+        get x() {
+            return this._x;
+        }
+    };
+
+    function indirection(c) {
+        sink(c.x); // NOT OK
+    }
+    indirection(new C(source()));
+    indirection(null);
+
+    function getX(c) {
+        return c.x;
+    }
+    sink(getX(new C(source()))); // NOT OK - but not flagged
+    getX(null);
+}
+
+function testFlowThroughObjectLiteralAccessors() {
+    let obj = {
+        get x() {
+            return source();
+        },
+        set y(value) {
+            sink(value); // NOT OK
+        }
+    };
+    sink(obj.x); // NOT OK
+    obj.y = source();
+
+    function indirection(c) {
+        sink(c.x); // NOT OK - but not currently flagged
+    }
+    indirection(obj);
+    indirection(null);
+}
+
+function testFlowThroughSubclass() {
+    class Base {
+        get x() {
+            return source();
+        }
+        set y(value) {
+            sink(value); // NOT OK
+        }
+    };
+    class C extends Base {
+    }
+
+    sink(new C().x); // NOT OK
+    new C().y = source();
+
+    function indirection(c) {
+        sink(c.x); // NOT OK
+    }
+    indirection(new C());
+    indirection(null);
+
+    function getX(c) {
+        return c.x;
+    }
+    sink(getX(new C())); // NOT OK - but not flagged
+    getX(null);
+}
diff --git a/javascript/ql/test/library-tests/TaintTracking/xml.js b/javascript/ql/test/library-tests/TaintTracking/xml.js
index 8e3785d4a2b..b1c6ab37ad3 100644
--- a/javascript/ql/test/library-tests/TaintTracking/xml.js
+++ b/javascript/ql/test/library-tests/TaintTracking/xml.js
@@ -34,4 +34,27 @@
     parser.write(source());
     parser.end();
 
-})();
\ No newline at end of file
+})();
+
+(function () {
+    var libxml = require("libxmljs");
+    var xml = source();
+    var xmlDoc = libxml.parseXmlString(xml);
+    var gchild = xmlDoc.get('//grandchild');
+    sink(gchild.text()); // NOT OK
+
+    var children = xmlDoc.root().childNodes();
+    var child = children[0];
+
+    sink(child.attr('foo').value()); // NOT OK
+
+    var child2 = xmlDoc.root().child()
+    sink(child2.attr('foo').name()); // NOT OK
+
+    const SaxPushParser = libxml.SaxPushParser;
+    var parser = new SaxPushParser();
+    parser.push(xml);
+    parser.on('characters', function (str) {
+      sink(str); // NOT OK
+    })    
+});
\ No newline at end of file
diff --git a/javascript/ql/test/library-tests/TypeScript/BaseUrl/A/index.ts b/javascript/ql/test/library-tests/TypeScript/BaseUrl/A/index.ts
new file mode 100644
index 00000000000..dabdd5becb1
--- /dev/null
+++ b/javascript/ql/test/library-tests/TypeScript/BaseUrl/A/index.ts
@@ -0,0 +1 @@
+import { Foo } from "../B/src/foo";
diff --git a/javascript/ql/test/library-tests/TypeScript/BaseUrl/A/tsconfig.json b/javascript/ql/test/library-tests/TypeScript/BaseUrl/A/tsconfig.json
new file mode 100644
index 00000000000..a1aaa6366d3
--- /dev/null
+++ b/javascript/ql/test/library-tests/TypeScript/BaseUrl/A/tsconfig.json
@@ -0,0 +1,3 @@
+{
+    "include": ["."]
+}
\ No newline at end of file
diff --git a/javascript/ql/test/library-tests/TypeScript/BaseUrl/B/src/foo.ts b/javascript/ql/test/library-tests/TypeScript/BaseUrl/B/src/foo.ts
new file mode 100644
index 00000000000..8787337fec4
--- /dev/null
+++ b/javascript/ql/test/library-tests/TypeScript/BaseUrl/B/src/foo.ts
@@ -0,0 +1,3 @@
+import { Bar } from "lib/bar";
+
+export class Foo {}
diff --git a/javascript/ql/test/library-tests/TypeScript/BaseUrl/B/src/lib/bar.ts b/javascript/ql/test/library-tests/TypeScript/BaseUrl/B/src/lib/bar.ts
new file mode 100644
index 00000000000..004c1e2fce3
--- /dev/null
+++ b/javascript/ql/test/library-tests/TypeScript/BaseUrl/B/src/lib/bar.ts
@@ -0,0 +1,3 @@
+import { Foo } from "foo";
+
+export class Bar {}
diff --git a/javascript/ql/test/library-tests/TypeScript/BaseUrl/B/tsconfig.json b/javascript/ql/test/library-tests/TypeScript/BaseUrl/B/tsconfig.json
new file mode 100644
index 00000000000..9a40e581b22
--- /dev/null
+++ b/javascript/ql/test/library-tests/TypeScript/BaseUrl/B/tsconfig.json
@@ -0,0 +1,6 @@
+{
+    "include": ["."],
+    "compilerOptions": {
+        "baseUrl": "./src"
+    }
+}
\ No newline at end of file
diff --git a/javascript/ql/test/library-tests/TypeScript/BaseUrl/test.expected b/javascript/ql/test/library-tests/TypeScript/BaseUrl/test.expected
new file mode 100644
index 00000000000..e8d11eba315
--- /dev/null
+++ b/javascript/ql/test/library-tests/TypeScript/BaseUrl/test.expected
@@ -0,0 +1,3 @@
+| A/index.ts:1:1:1:35 | import  ... c/foo"; | B/src/foo.ts:1:1:4:0 | <toplevel> |
+| B/src/foo.ts:1:1:1:30 | import  ... b/bar"; | B/src/lib/bar.ts:1:1:4:0 | <toplevel> |
+| B/src/lib/bar.ts:1:1:1:26 | import  ...  "foo"; | B/src/foo.ts:1:1:4:0 | <toplevel> |
diff --git a/javascript/ql/test/library-tests/TypeScript/BaseUrl/test.ql b/javascript/ql/test/library-tests/TypeScript/BaseUrl/test.ql
new file mode 100644
index 00000000000..659ccda1dea
--- /dev/null
+++ b/javascript/ql/test/library-tests/TypeScript/BaseUrl/test.ql
@@ -0,0 +1,3 @@
+import javascript
+
+query Module getImportedModule(Import imprt) { result = imprt.getImportedModule() }
diff --git a/javascript/ql/test/library-tests/TypeScript/BaseUrl/tsconfig.json b/javascript/ql/test/library-tests/TypeScript/BaseUrl/tsconfig.json
new file mode 100644
index 00000000000..9e26dfeeb6e
--- /dev/null
+++ b/javascript/ql/test/library-tests/TypeScript/BaseUrl/tsconfig.json
@@ -0,0 +1 @@
+{}
\ No newline at end of file
diff --git a/javascript/ql/test/library-tests/TypeScript/ImportOutDir/slashAndExtension/index.js b/javascript/ql/test/library-tests/TypeScript/ImportOutDir/slashAndExtension/index.js
new file mode 100644
index 00000000000..905a92e15a4
--- /dev/null
+++ b/javascript/ql/test/library-tests/TypeScript/ImportOutDir/slashAndExtension/index.js
@@ -0,0 +1,2 @@
+var foo1 = require('./lib/index.js');
+var foo2 = require('./src/index.ts');
\ No newline at end of file
diff --git a/javascript/ql/test/library-tests/TypeScript/ImportOutDir/slashAndExtension/package.json b/javascript/ql/test/library-tests/TypeScript/ImportOutDir/slashAndExtension/package.json
new file mode 100644
index 00000000000..4c8d1a457cb
--- /dev/null
+++ b/javascript/ql/test/library-tests/TypeScript/ImportOutDir/slashAndExtension/package.json
@@ -0,0 +1,4 @@
+{
+    "name": "foo",
+    "main": "./lib/index.js"
+}
\ No newline at end of file
diff --git a/javascript/ql/test/library-tests/TypeScript/ImportOutDir/slashAndExtension/src/index.ts b/javascript/ql/test/library-tests/TypeScript/ImportOutDir/slashAndExtension/src/index.ts
new file mode 100644
index 00000000000..06f1c250ccd
--- /dev/null
+++ b/javascript/ql/test/library-tests/TypeScript/ImportOutDir/slashAndExtension/src/index.ts
@@ -0,0 +1 @@
+export default class Foo {}
\ No newline at end of file
diff --git a/javascript/ql/test/library-tests/TypeScript/ImportOutDir/slashAndExtension/tsconfig.json b/javascript/ql/test/library-tests/TypeScript/ImportOutDir/slashAndExtension/tsconfig.json
new file mode 100644
index 00000000000..0ae78b4a7cb
--- /dev/null
+++ b/javascript/ql/test/library-tests/TypeScript/ImportOutDir/slashAndExtension/tsconfig.json
@@ -0,0 +1,8 @@
+{
+    "extends": "./tsconfig",
+    "compilerOptions": {
+        "module": "commonjs",
+        "rootDir": "./src",
+        "outDir": "./lib"
+    }
+}
\ No newline at end of file
diff --git a/javascript/ql/test/library-tests/TypeScript/ImportOutDir/tests.expected b/javascript/ql/test/library-tests/TypeScript/ImportOutDir/tests.expected
index 4050e660521..af67932f33d 100644
--- a/javascript/ql/test/library-tests/TypeScript/ImportOutDir/tests.expected
+++ b/javascript/ql/test/library-tests/TypeScript/ImportOutDir/tests.expected
@@ -1,3 +1,4 @@
+resolveableImport
 | nonUniqueInclude/index.js:1:12:1:38 | require ... oo.js') | nonUniqueInclude/src/foo.ts:1:1:1:27 | <toplevel> |
 | nonUniqueInclude/index.js:2:12:2:39 | require ... oo.js') | nonUniqueInclude/src2/foo.ts:1:1:1:27 | <toplevel> |
 | nonUniqueInclude/index.js:3:12:3:34 | require ... oo.ts') | nonUniqueInclude/src/foo.ts:1:1:1:27 | <toplevel> |
@@ -10,3 +11,7 @@
 | simpleOutDir/index.js:2:12:2:36 | require ... ex.ts') | simpleOutDir/src/index.ts:1:1:1:27 | <toplevel> |
 | simpleOutDir/index.js:4:12:4:33 | require ... index') | simpleOutDir/src/index.ts:1:1:1:27 | <toplevel> |
 | simpleOutDir/index.js:5:12:5:33 | require ... index') | simpleOutDir/src/index.ts:1:1:1:27 | <toplevel> |
+| slashAndExtension/index.js:1:12:1:36 | require ... ex.js') | slashAndExtension/src/index.ts:1:1:1:27 | <toplevel> |
+| slashAndExtension/index.js:2:12:2:36 | require ... ex.ts') | slashAndExtension/src/index.ts:1:1:1:27 | <toplevel> |
+getMain
+| slashAndExtension/package.json:1:1:4:1 | {\\n    " ... x.js"\\n} | slashAndExtension/src/index.ts:1:1:1:27 | <toplevel> |
diff --git a/javascript/ql/test/library-tests/TypeScript/ImportOutDir/tests.ql b/javascript/ql/test/library-tests/TypeScript/ImportOutDir/tests.ql
index 35d4a969236..450989f717b 100644
--- a/javascript/ql/test/library-tests/TypeScript/ImportOutDir/tests.ql
+++ b/javascript/ql/test/library-tests/TypeScript/ImportOutDir/tests.ql
@@ -5,3 +5,5 @@ query predicate resolveableImport(Import imp, Module mod) {
   not imp.getTopLevel().isExterns() and
   not mod.getTopLevel().isExterns()
 }
+
+query Module getMain(PackageJSON json) { result = json.getMainModule() }
diff --git a/javascript/ql/test/library-tests/TypeScript/RegressionTests/ImportSelf/test.expected b/javascript/ql/test/library-tests/TypeScript/RegressionTests/ImportSelf/test.expected
index 200517fd84d..6e38d3a0038 100644
--- a/javascript/ql/test/library-tests/TypeScript/RegressionTests/ImportSelf/test.expected
+++ b/javascript/ql/test/library-tests/TypeScript/RegressionTests/ImportSelf/test.expected
@@ -2,11 +2,3 @@
 | bar.ts:1:10:1:10 | A | any |
 | bar.ts:1:19:1:29 | "@blah/foo" | any |
 | bar.ts:3:5:3:5 | x | any |
-| node_modules/@blah/foo/index.d.ts:1:8:1:15 | FooArray | typeof FooArray in library-tests/TypeScript/RegressionTests/ImportSelf/node_modules/@blah/foo/index.d.ts |
-| node_modules/@blah/foo/index.d.ts:1:20:1:20 | A | any |
-| node_modules/@blah/foo/index.d.ts:1:20:1:20 | A | any |
-| node_modules/@blah/foo/index.d.ts:1:29:1:39 | '@blah/foo' | any |
-| node_modules/@blah/foo/index.d.ts:3:11:3:18 | FooArray | typeof FooArray in library-tests/TypeScript/RegressionTests/ImportSelf/node_modules/@blah/foo/index.d.ts |
-| node_modules/@blah/foo/index.d.ts:4:12:4:15 | blah | () => void |
-| node_modules/@blah/foo/index.d.ts:8:10:8:10 | A | any |
-| node_modules/@blah/foo/index.d.ts:8:10:8:10 | A | any |
diff --git a/javascript/ql/test/library-tests/TypeScript/RegressionTests/TemplateTypes/TemplateTypes.expected b/javascript/ql/test/library-tests/TypeScript/RegressionTests/TemplateTypes/TemplateTypes.expected
new file mode 100644
index 00000000000..e713b3e4804
--- /dev/null
+++ b/javascript/ql/test/library-tests/TypeScript/RegressionTests/TemplateTypes/TemplateTypes.expected
@@ -0,0 +1,6 @@
+| tst.ts:2:11:2:21 | `foo ${T1}` |
+| tst.ts:4:45:4:49 | `foo` |
+| tst.ts:4:53:4:57 | `bar` |
+| tst.ts:5:46:5:50 | `foo` |
+| tst.ts:5:54:5:63 | `bar ${K}` |
+| tst.ts:7:15:7:19 | `foo` |
diff --git a/javascript/ql/test/library-tests/TypeScript/RegressionTests/TemplateTypes/TemplateTypes.ql b/javascript/ql/test/library-tests/TypeScript/RegressionTests/TemplateTypes/TemplateTypes.ql
new file mode 100644
index 00000000000..f08f5a201dd
--- /dev/null
+++ b/javascript/ql/test/library-tests/TypeScript/RegressionTests/TemplateTypes/TemplateTypes.ql
@@ -0,0 +1,3 @@
+import javascript
+
+query TemplateLiteralTypeExpr literalType() { any() }
diff --git a/javascript/ql/test/library-tests/TypeScript/RegressionTests/TemplateTypes/tsconfig.json b/javascript/ql/test/library-tests/TypeScript/RegressionTests/TemplateTypes/tsconfig.json
new file mode 100644
index 00000000000..82194fc7ab0
--- /dev/null
+++ b/javascript/ql/test/library-tests/TypeScript/RegressionTests/TemplateTypes/tsconfig.json
@@ -0,0 +1,3 @@
+{
+    "include": ["."]
+}
diff --git a/javascript/ql/test/library-tests/TypeScript/RegressionTests/TemplateTypes/tst.ts b/javascript/ql/test/library-tests/TypeScript/RegressionTests/TemplateTypes/tst.ts
new file mode 100644
index 00000000000..21718ea3b34
--- /dev/null
+++ b/javascript/ql/test/library-tests/TypeScript/RegressionTests/TemplateTypes/tst.ts
@@ -0,0 +1,7 @@
+type T1 = 'foo' | 'bar';
+type T2 = `foo ${T1}`;
+
+type FooToBar<K extends string> = K extends `foo` ? `bar` : K;
+type FooToBar2<K extends string> = K extends `foo` ? `bar ${K}` : K;
+
+type Tuple = [`foo`?];
diff --git a/javascript/ql/test/library-tests/TypeScript/RegressionTests/TraceResolution/test.expected b/javascript/ql/test/library-tests/TypeScript/RegressionTests/TraceResolution/test.expected
index ec7a2343e6b..dc21f343569 100644
--- a/javascript/ql/test/library-tests/TypeScript/RegressionTests/TraceResolution/test.expected
+++ b/javascript/ql/test/library-tests/TypeScript/RegressionTests/TraceResolution/test.expected
@@ -1,4 +1,3 @@
-| node_modules/@types/foo/index.d.ts:1:17:1:19 | foo | () => any |
 | test.ts:1:10:1:12 | foo | () => any |
 | test.ts:1:10:1:12 | foo | () => any |
 | test.ts:1:21:1:25 | "foo" | any |
diff --git a/javascript/ql/test/library-tests/frameworks/ClientRequests/ClientRequests.expected b/javascript/ql/test/library-tests/frameworks/ClientRequests/ClientRequests.expected
index 2bf2d305cb0..e448b888e12 100644
--- a/javascript/ql/test/library-tests/frameworks/ClientRequests/ClientRequests.expected
+++ b/javascript/ql/test/library-tests/frameworks/ClientRequests/ClientRequests.expected
@@ -5,6 +5,9 @@ test_ClientRequest
 | apollo.js:17:1:17:34 | new Pre ... yurl"}) |
 | apollo.js:20:1:20:77 | createN ... phql'}) |
 | apollo.js:23:1:23:31 | new Web ... wsUri}) |
+| puppeteer.ts:6:11:6:42 | page.go ... e.com') |
+| puppeteer.ts:8:5:8:61 | page.ad ... css" }) |
+| puppeteer.ts:18:30:18:50 | page.go ... estUrl) |
 | tst.js:11:5:11:16 | request(url) |
 | tst.js:13:5:13:20 | request.get(url) |
 | tst.js:15:5:15:23 | request.delete(url) |
@@ -83,6 +86,7 @@ test_ClientRequest
 | tst.js:269:13:269:48 | httpPro ... ptions) |
 | tst.js:271:3:271:61 | proxy.w ... 080' }) |
 | tst.js:274:1:283:2 | httpPro ... true\\n}) |
+| tst.js:286:20:286:55 | new Web ... :8080') |
 test_getADataNode
 | tst.js:53:5:53:23 | axios({data: data}) | tst.js:53:18:53:21 | data |
 | tst.js:57:5:57:39 | axios.p ... data2}) | tst.js:57:19:57:23 | data1 |
@@ -121,6 +125,7 @@ test_getADataNode
 | tst.js:249:1:251:2 | form.su ... e();\\n}) | tst.js:246:26:246:43 | Buffer.from("foo") |
 | tst.js:249:1:251:2 | form.su ... e();\\n}) | tst.js:247:24:247:68 | request ... o.png') |
 | tst.js:257:1:262:2 | form.su ... rs()\\n}) | tst.js:255:25:255:35 | 'new_value' |
+| tst.js:286:20:286:55 | new Web ... :8080') | tst.js:288:21:288:35 | 'Hello Server!' |
 test_getHost
 | tst.js:87:5:87:39 | http.ge ...  host}) | tst.js:87:34:87:37 | host |
 | tst.js:89:5:89:23 | axios({host: host}) | tst.js:89:18:89:21 | host |
@@ -136,6 +141,9 @@ test_getUrl
 | apollo.js:17:1:17:34 | new Pre ... yurl"}) | apollo.js:17:26:17:32 | "myurl" |
 | apollo.js:20:1:20:77 | createN ... phql'}) | apollo.js:20:30:20:75 | 'https: ... raphql' |
 | apollo.js:23:1:23:31 | new Web ... wsUri}) | apollo.js:23:25:23:29 | wsUri |
+| puppeteer.ts:6:11:6:42 | page.go ... e.com') | puppeteer.ts:6:21:6:41 | 'https: ... le.com' |
+| puppeteer.ts:8:5:8:61 | page.ad ... css" }) | puppeteer.ts:8:29:8:58 | "http:/ ... le.css" |
+| puppeteer.ts:18:30:18:50 | page.go ... estUrl) | puppeteer.ts:18:40:18:49 | requestUrl |
 | tst.js:11:5:11:16 | request(url) | tst.js:11:13:11:15 | url |
 | tst.js:13:5:13:20 | request.get(url) | tst.js:13:17:13:19 | url |
 | tst.js:15:5:15:23 | request.delete(url) | tst.js:15:20:15:22 | url |
@@ -218,6 +226,7 @@ test_getUrl
 | tst.js:267:1:267:61 | httpPro ... 9000'}) | tst.js:267:37:267:59 | 'http:/ ... t:9000' |
 | tst.js:271:3:271:61 | proxy.w ... 080' }) | tst.js:271:33:271:58 | 'http:/ ... m:8080' |
 | tst.js:274:1:283:2 | httpPro ... true\\n}) | tst.js:275:13:281:5 | {\\n      ... ,\\n    } |
+| tst.js:286:20:286:55 | new Web ... :8080') | tst.js:286:34:286:54 | 'ws://l ... t:8080' |
 test_getAResponseDataNode
 | tst.js:19:5:19:23 | requestPromise(url) | tst.js:19:5:19:23 | requestPromise(url) | text | true |
 | tst.js:21:5:21:23 | superagent.get(url) | tst.js:21:5:21:23 | superagent.get(url) | stream | true |
@@ -284,3 +293,4 @@ test_getAResponseDataNode
 | tst.js:231:5:233:6 | needle. ... \\n    }) | tst.js:231:50:231:53 | body | json | false |
 | tst.js:235:5:237:6 | needle. ... \\n    }) | tst.js:235:67:235:70 | resp | fetch.response | false |
 | tst.js:235:5:237:6 | needle. ... \\n    }) | tst.js:235:73:235:76 | body | json | false |
+| tst.js:286:20:286:55 | new Web ... :8080') | tst.js:291:44:291:53 | event.data | json | false |
diff --git a/javascript/ql/test/library-tests/frameworks/ClientRequests/puppeteer.ts b/javascript/ql/test/library-tests/frameworks/ClientRequests/puppeteer.ts
new file mode 100644
index 00000000000..5f630f1a691
--- /dev/null
+++ b/javascript/ql/test/library-tests/frameworks/ClientRequests/puppeteer.ts
@@ -0,0 +1,20 @@
+import * as puppeteer from 'puppeteer';
+
+(async () => {
+    const browser = await puppeteer.launch();
+    const page = await browser.newPage();
+    await page.goto('https://example.com');
+
+    page.addStyleTag({ url: "http://example.org/style.css" })
+})();
+
+class Renderer {
+    private browser: puppeteer.Browser;
+    constructor(browser: puppeteer.Browser) {
+        this.browser = browser;
+    }
+    async foo(requestUrl: string): Promise<void> {
+        const page = await this.browser.newPage();
+        let response = await page.goto(requestUrl);
+    }
+}
\ No newline at end of file
diff --git a/javascript/ql/test/library-tests/frameworks/ClientRequests/tsconfig.json b/javascript/ql/test/library-tests/frameworks/ClientRequests/tsconfig.json
new file mode 100644
index 00000000000..9e26dfeeb6e
--- /dev/null
+++ b/javascript/ql/test/library-tests/frameworks/ClientRequests/tsconfig.json
@@ -0,0 +1 @@
+{}
\ No newline at end of file
diff --git a/javascript/ql/test/library-tests/frameworks/ClientRequests/tst.js b/javascript/ql/test/library-tests/frameworks/ClientRequests/tst.js
index 4003fd1b0a3..bc15565c072 100644
--- a/javascript/ql/test/library-tests/frameworks/ClientRequests/tst.js
+++ b/javascript/ql/test/library-tests/frameworks/ClientRequests/tst.js
@@ -280,4 +280,14 @@ httpProxy.createProxyServer({
         passphrase: 'password',
     },
     changeOrigin: true
-}).listen(8000);
\ No newline at end of file
+}).listen(8000);
+
+function webSocket() {
+    const socket = new WebSocket('ws://localhost:8080');
+    socket.addEventListener('open', function (event) {
+        socket.send('Hello Server!');
+    });
+    socket.addEventListener('message', function (event) {
+        console.log("Data from server: " + event.data);
+    });
+}
\ No newline at end of file
diff --git a/javascript/ql/test/library-tests/frameworks/Collections/test.expected b/javascript/ql/test/library-tests/frameworks/Collections/test.expected
index c391fbf4f79..9edf3093caa 100644
--- a/javascript/ql/test/library-tests/frameworks/Collections/test.expected
+++ b/javascript/ql/test/library-tests/frameworks/Collections/test.expected
@@ -26,3 +26,6 @@ typeTracking
 | tst.js:2:16:2:23 | source() | tst.js:37:14:37:14 | e |
 | tst.js:2:16:2:23 | source() | tst.js:45:14:45:14 | e |
 | tst.js:2:16:2:23 | source() | tst.js:53:8:53:21 | map.get("key") |
+| tst.js:2:16:2:23 | source() | tst.js:59:8:59:22 | map2.get("foo") |
+| tst.js:2:16:2:23 | source() | tst.js:64:8:64:26 | map3.get(unknown()) |
+| tst.js:2:16:2:23 | source() | tst.js:69:8:69:26 | map3.get(unknown()) |
diff --git a/javascript/ql/test/library-tests/frameworks/Collections/test.ql b/javascript/ql/test/library-tests/frameworks/Collections/test.ql
index 61da4ade4ab..9e3561fa844 100644
--- a/javascript/ql/test/library-tests/frameworks/Collections/test.ql
+++ b/javascript/ql/test/library-tests/frameworks/Collections/test.ql
@@ -22,10 +22,6 @@ DataFlow::SourceNode trackSource(DataFlow::TypeTracker t, DataFlow::SourceNode s
   start = result
   or
   exists(DataFlow::TypeTracker t2 | t = t2.step(trackSource(t2, start), result))
-  or
-  exists(DataFlow::TypeTracker t2 |
-    result = CollectionsTypeTracking::collectionStep(trackSource(t2, start), t, t2)
-  )
 }
 
 query DataFlow::SourceNode typeTracking(DataFlow::Node start) {
diff --git a/javascript/ql/test/library-tests/frameworks/Collections/tst.js b/javascript/ql/test/library-tests/frameworks/Collections/tst.js
index bc7b52081d0..e5d84ddfd65 100644
--- a/javascript/ql/test/library-tests/frameworks/Collections/tst.js
+++ b/javascript/ql/test/library-tests/frameworks/Collections/tst.js
@@ -54,17 +54,17 @@
   sink(map.get("nonExistingKey")); // OK. 
 
   // unknown write, known read
-  var map2 = new map();
+  var map2 = new Map();
   map2.set(unknown(), source); 
-  sink(map2.get("foo")); // NOT OK (for data-flow). OK for type-tracking.
+  sink(map2.get("foo")); // NOT OK (for data-flow).
 
   // unknown write, unknown read
-  var map3 = new map();
+  var map3 = new Map();
   map3.set(unknown(), source); 
-  sink(map3.get(unknown())); // NOT OK (for data-flow). OK for type-tracking.
+  sink(map3.get(unknown())); // NOT OK (for data-flow).
 
   // known write, unknown read
-  var map4 = new map();
+  var map4 = new Map();
   map4.set("foo", source); 
-  sink(map3.get(unknown())); // NOT OK (for data-flow). OK for type-tracking.
+  sink(map3.get(unknown())); // NOT OK (for data-flow).
 })();
diff --git a/javascript/ql/test/library-tests/frameworks/Electron/tests.expected b/javascript/ql/test/library-tests/frameworks/Electron/tests.expected
index 4741bea1469..3050fb8fa53 100644
--- a/javascript/ql/test/library-tests/frameworks/Electron/tests.expected
+++ b/javascript/ql/test/library-tests/frameworks/Electron/tests.expected
@@ -15,8 +15,6 @@ browserObject
 | electron.js:62:13:62:59 | new Bro ... 1500 }) |
 | electron.js:63:3:63:5 | win |
 | electron.js:65:18:65:20 | win |
-| electronTs.d.ts:2:16:2:28 | BrowserWindow |
-| electronTs.d.ts:3:16:3:26 | BrowserView |
 | electronTs.ts:3:12:3:13 | bw |
 | electronTs.ts:3:40:3:41 | bv |
 | electronTs.ts:4:3:4:4 | bw |
diff --git a/javascript/ql/test/library-tests/frameworks/Electron/tests.ql b/javascript/ql/test/library-tests/frameworks/Electron/tests.ql
index 536760f5447..d8684c7d5c1 100644
--- a/javascript/ql/test/library-tests/frameworks/Electron/tests.ql
+++ b/javascript/ql/test/library-tests/frameworks/Electron/tests.ql
@@ -9,7 +9,7 @@ query predicate clientRequest_getADataNode(Electron::ElectronClientRequest cr, D
 query predicate clientRequest(Electron::ElectronClientRequest cr) { any() }
 
 query predicate ipcFlow(DataFlow::Node pred, DataFlow::Node succ) {
-  exists(DataFlow::AdditionalFlowStep afs | afs.step(pred, succ))
+  DataFlow::SharedFlowStep::step(pred, succ)
 }
 
 query predicate remoteFlowSources(RemoteFlowSource source) { any() }
diff --git a/javascript/ql/test/library-tests/frameworks/EventEmitter/test.expected b/javascript/ql/test/library-tests/frameworks/EventEmitter/test.expected
index 4918d26fa9f..5ebd5c8a069 100644
--- a/javascript/ql/test/library-tests/frameworks/EventEmitter/test.expected
+++ b/javascript/ql/test/library-tests/frameworks/EventEmitter/test.expected
@@ -1,4 +1,4 @@
-taintSteps
+flowSteps
 | customEmitter.js:5:20:5:24 | "bar" | customEmitter.js:6:19:6:22 | data |
 | customEmitter.js:12:21:12:25 | "baz" | customEmitter.js:13:23:13:26 | data |
 | customEmitter.js:12:21:12:25 | "baz" | customEmitter.js:22:14:22:18 | yData |
diff --git a/javascript/ql/test/library-tests/frameworks/EventEmitter/test.ql b/javascript/ql/test/library-tests/frameworks/EventEmitter/test.ql
index 9b0f16161c4..9c53c7d7dcc 100644
--- a/javascript/ql/test/library-tests/frameworks/EventEmitter/test.ql
+++ b/javascript/ql/test/library-tests/frameworks/EventEmitter/test.ql
@@ -1,7 +1,7 @@
 import javascript
 
-query predicate taintSteps(DataFlow::Node pred, DataFlow::Node succ) {
-  exists(DataFlow::AdditionalFlowStep step | step.step(pred, succ))
+query predicate flowSteps(DataFlow::Node pred, DataFlow::Node succ) {
+  DataFlow::SharedFlowStep::step(pred, succ)
 }
 
 query predicate eventEmitter(EventEmitter e) { any() }
diff --git a/javascript/ql/test/library-tests/frameworks/ReactJS/importedComponent.jsx b/javascript/ql/test/library-tests/frameworks/ReactJS/importedComponent.jsx
index edc333528a7..d94acf59abe 100644
--- a/javascript/ql/test/library-tests/frameworks/ReactJS/importedComponent.jsx
+++ b/javascript/ql/test/library-tests/frameworks/ReactJS/importedComponent.jsx
@@ -1,5 +1,5 @@
 import { MyComponent } from "./exportedComponent";
 
-export function render(color) {
+export function render({color, location}) {
     return <MyComponent color={color}/>
 }
diff --git a/javascript/ql/test/library-tests/frameworks/ReactJS/tests.expected b/javascript/ql/test/library-tests/frameworks/ReactJS/tests.expected
index fba8084a937..f64d386b45b 100644
--- a/javascript/ql/test/library-tests/frameworks/ReactJS/tests.expected
+++ b/javascript/ql/test/library-tests/frameworks/ReactJS/tests.expected
@@ -16,6 +16,7 @@ test_ReactComponent_getInstanceMethod
 | es5.js:18:33:22:1 | {\\n  ren ... ;\\n  }\\n} | render | es5.js:19:11:21:3 | functio ... 1>;\\n  } |
 | es6.js:1:1:8:1 | class H ... ;\\n  }\\n} | render | es6.js:2:9:4:3 | () {\\n   ... v>;\\n  } |
 | exportedComponent.jsx:1:8:3:1 | functio ... r}}/>\\n} | render | exportedComponent.jsx:1:8:3:1 | functio ... r}}/>\\n} |
+| importedComponent.jsx:3:8:5:1 | functio ... or}/>\\n} | render | importedComponent.jsx:3:8:5:1 | functio ... or}/>\\n} |
 | plainfn.js:1:1:3:1 | functio ... div>;\\n} | render | plainfn.js:1:1:3:1 | functio ... div>;\\n} |
 | plainfn.js:5:1:7:1 | functio ... iv");\\n} | render | plainfn.js:5:1:7:1 | functio ... iv");\\n} |
 | plainfn.js:9:1:12:1 | functio ... rn x;\\n} | render | plainfn.js:9:1:12:1 | functio ... rn x;\\n} |
@@ -97,6 +98,7 @@ test_ReactComponent_ref
 | es6.js:14:1:20:1 | class H ...     }\\n} | es6.js:17:9:17:12 | this |
 | es6.js:14:1:20:1 | class H ...     }\\n} | es6.js:18:9:18:12 | this |
 | exportedComponent.jsx:1:8:3:1 | functio ... r}}/>\\n} | exportedComponent.jsx:1:8:1:7 | this |
+| importedComponent.jsx:3:8:5:1 | functio ... or}/>\\n} | importedComponent.jsx:3:8:3:7 | this |
 | namedImport.js:3:1:3:28 | class C ... nent {} | namedImport.js:3:27:3:26 | this |
 | namedImport.js:5:1:5:20 | class D extends C {} | namedImport.js:5:19:5:18 | this |
 | plainfn.js:1:1:3:1 | functio ... div>;\\n} | plainfn.js:1:1:1:0 | this |
@@ -198,6 +200,7 @@ test_ReactComponent_getADirectPropsSource
 | es6.js:1:1:8:1 | class H ... ;\\n  }\\n} | es6.js:1:37:1:36 | args |
 | es6.js:1:1:8:1 | class H ... ;\\n  }\\n} | es6.js:3:24:3:33 | this.props |
 | exportedComponent.jsx:1:8:3:1 | functio ... r}}/>\\n} | exportedComponent.jsx:1:29:1:33 | props |
+| importedComponent.jsx:3:8:5:1 | functio ... or}/>\\n} | importedComponent.jsx:3:24:3:40 | {color, location} |
 | namedImport.js:3:1:3:28 | class C ... nent {} | namedImport.js:3:27:3:26 | args |
 | namedImport.js:5:1:5:20 | class D extends C {} | namedImport.js:5:19:5:18 | args |
 | plainfn.js:1:1:3:1 | functio ... div>;\\n} | plainfn.js:1:16:1:20 | props |
@@ -236,6 +239,7 @@ test_ReactComponent
 | es6.js:1:1:8:1 | class H ... ;\\n  }\\n} |
 | es6.js:14:1:20:1 | class H ...     }\\n} |
 | exportedComponent.jsx:1:8:3:1 | functio ... r}}/>\\n} |
+| importedComponent.jsx:3:8:5:1 | functio ... or}/>\\n} |
 | namedImport.js:3:1:3:28 | class C ... nent {} |
 | namedImport.js:5:1:5:20 | class D extends C {} |
 | plainfn.js:1:1:3:1 | functio ... div>;\\n} |
@@ -264,6 +268,8 @@ test_ReactComponent_getAPropRead
 | es5.js:18:33:22:1 | {\\n  ren ... ;\\n  }\\n} | name | es5.js:20:24:20:38 | this.props.name |
 | es6.js:1:1:8:1 | class H ... ;\\n  }\\n} | name | es6.js:3:24:3:38 | this.props.name |
 | exportedComponent.jsx:1:8:3:1 | functio ... r}}/>\\n} | color | exportedComponent.jsx:2:32:2:42 | props.color |
+| importedComponent.jsx:3:8:5:1 | functio ... or}/>\\n} | color | importedComponent.jsx:3:25:3:29 | color |
+| importedComponent.jsx:3:8:5:1 | functio ... or}/>\\n} | location | importedComponent.jsx:3:32:3:39 | location |
 | plainfn.js:1:1:3:1 | functio ... div>;\\n} | name | plainfn.js:2:22:2:31 | props.name |
 | preact.js:1:1:7:1 | class H ...     }\\n} | name | preact.js:3:9:3:18 | props.name |
 | probably-a-component.js:1:1:6:1 | class H ...     }\\n} | name | probably-a-component.js:3:9:3:23 | this.props.name |
@@ -288,6 +294,9 @@ test_JSXname
 | thisAccesses.js:60:19:60:41 | <this.n ... s.name> | thisAccesses.js:60:20:60:28 | this.name | this.name | dot |
 | thisAccesses.js:61:19:61:41 | <this.t ... s.this> | thisAccesses.js:61:20:61:28 | this.this | this.this | dot |
 | thisAccesses_importedMappers.js:13:16:13:21 | <div/> | thisAccesses_importedMappers.js:13:17:13:19 | div | div | Identifier |
+| use-react-router.jsx:5:17:5:87 | <Router ... Router> | use-react-router.jsx:5:18:5:23 | Router | Router | Identifier |
+| use-react-router.jsx:5:25:5:78 | <Route> ... /Route> | use-react-router.jsx:5:26:5:30 | Route | Route | Identifier |
+| use-react-router.jsx:5:32:5:70 | <Import ... ponent> | use-react-router.jsx:5:33:5:49 | ImportedComponent | ImportedComponent | Identifier |
 | useHigherOrderComponent.jsx:5:12:5:39 | <SomeCo ... "red"/> | useHigherOrderComponent.jsx:5:13:5:25 | SomeComponent | SomeComponent | Identifier |
 | useHigherOrderComponent.jsx:11:12:11:46 | <LazyLo ... lazy"/> | useHigherOrderComponent.jsx:11:13:11:31 | LazyLoadedComponent | LazyLoadedComponent | Identifier |
 | useHigherOrderComponent.jsx:17:12:17:48 | <LazyLo ... azy2"/> | useHigherOrderComponent.jsx:17:13:17:32 | LazyLoadedComponent2 | LazyLoadedComponent2 | Identifier |
@@ -298,3 +307,5 @@ test_JSXName_this
 | statePropertyWrites.js:38:12:38:45 | <div>He ... }</div> | statePropertyWrites.js:38:24:38:27 | this |
 | thisAccesses.js:60:19:60:41 | <this.n ... s.name> | thisAccesses.js:60:20:60:23 | this |
 | thisAccesses.js:61:19:61:41 | <this.t ... s.this> | thisAccesses.js:61:20:61:23 | this |
+locationSource
+| importedComponent.jsx:3:32:3:39 | location |
diff --git a/javascript/ql/test/library-tests/frameworks/ReactJS/tests.ql b/javascript/ql/test/library-tests/frameworks/ReactJS/tests.ql
index 5289aa02249..b97e69b2526 100644
--- a/javascript/ql/test/library-tests/frameworks/ReactJS/tests.ql
+++ b/javascript/ql/test/library-tests/frameworks/ReactJS/tests.ql
@@ -9,3 +9,5 @@ import ReactComponent_getACandidatePropsValue
 import ReactComponent
 import ReactComponent_getAPropRead
 import ReactName
+
+query DataFlow::SourceNode locationSource() { result = DOM::locationSource() }
diff --git a/javascript/ql/test/library-tests/frameworks/ReactJS/use-react-router.jsx b/javascript/ql/test/library-tests/frameworks/ReactJS/use-react-router.jsx
new file mode 100644
index 00000000000..044c7f5e492
--- /dev/null
+++ b/javascript/ql/test/library-tests/frameworks/ReactJS/use-react-router.jsx
@@ -0,0 +1,5 @@
+import * as ReactDOM from "react-dom"
+import { Route, Router } from "react-router-dom";
+import ImportedComponent from "./importedComponent";
+
+ReactDOM.render(<Router><Route><ImportedComponent></ImportedComponent></Route></Router>);
diff --git a/javascript/ql/test/library-tests/frameworks/Redux/exportedReducer.js b/javascript/ql/test/library-tests/frameworks/Redux/exportedReducer.js
new file mode 100644
index 00000000000..4331d0f2157
--- /dev/null
+++ b/javascript/ql/test/library-tests/frameworks/Redux/exportedReducer.js
@@ -0,0 +1,13 @@
+import { combineReducers } from 'redux';
+
+export default (state, action) => {
+    return state;
+};
+
+export function notAReducer(notState, notAction) {
+    console.log(notState, notAction);
+}
+
+export const nestedReducer = combineReducers({
+    inner: (state, action) => state
+});
diff --git a/javascript/ql/test/library-tests/frameworks/Redux/react-redux.jsx b/javascript/ql/test/library-tests/frameworks/Redux/react-redux.jsx
new file mode 100644
index 00000000000..e1843b5bc92
--- /dev/null
+++ b/javascript/ql/test/library-tests/frameworks/Redux/react-redux.jsx
@@ -0,0 +1,99 @@
+import * as React from 'react';
+import { connect, useDispatch } from 'react-redux';
+import * as rt from '@reduxjs/toolkit';
+
+const toolkitAction = rt.createAction('toolkitAction', (x) => {
+    return {
+        toolkitValue: x
+    }
+});
+const toolkitReducer = rt.createReducer({}, builder => {
+    builder
+        .addCase(toolkitAction, (state, action) => {
+            return {
+                value: action.payload.toolkitValue,
+                ...state
+            };
+        })
+        .addCase(asyncAction.fulfilled, (state, action) => {
+            return {
+                asyncValue: action.payload.x,
+                ...state
+            };
+        });
+});
+
+function manualAction(x) {
+    return {
+        type: 'manualAction',
+        payload: x
+    }
+}
+function manualReducer(state, action) {
+    switch (action.type) {
+        case 'manualAction': {
+            return { ...state, manualValue: action.payload };
+        }
+    }
+    if (action.type === 'manualAction') {
+        return { ...state, manualValue2: action.payload };
+    }
+    if (action.type === 'manualAction') {
+        return {
+            ...state,
+            manualValue3: [1, 2, 3].map(x => {
+                return action.payload + x;
+            })
+        };
+    }
+    return state;
+}
+const asyncAction = rt.createAsyncThunk('asyncAction', (x) => {
+    return new Promise((resolve) => {
+        setTimeout(() => {
+            resolve({ x });
+        }, 10)
+    });
+});
+
+const store = rt.createStore(rt.combineReducers({
+    toolkit: toolkitReducer,
+    manual: manualReducer,
+}));
+
+function MyComponent(props) {
+    let dispatch = useDispatch();
+    const clickHandler = React.useCallback(() => {
+        props.toolkitAction(source());
+        props.manualAction(source()); // not currently propagated as functions are not type-tracked
+        dispatch(manualAction(source()));
+        dispatch(asyncAction(source()));
+    });
+
+    sink(props.propFromToolkitAction); // NOT OK
+    sink(props.propFromManualAction); // NOT OK
+    sink(props.propFromManualAction2); // NOT OK
+    sink(props.propFromManualAction3); // NOT OK
+    sink(props.propFromAsync); // NOT OK
+
+    return <button onClick={{clickHandler}}/>
+}
+
+function mapStateToProps(state) {
+    return {
+        propFromToolkitAction: state.toolkit.value,
+        propFromAsync: state.toolkit.asyncValue,
+        propFromManualAction: state.manual.manualValue,
+        propFromManualAction2: state.manual.manualValue2,
+        propFromManualAction3: state.manual.manualValue3,
+    }
+}
+
+const mapDispatchToProps = { toolkitAction, manualAction };
+
+const ConnectedComponent = connect(mapStateToProps, mapDispatchToProps)(MyComponent);
+
+function connectLike(f, g) {
+    return c => somethingWeirdAndComplicated(f, g)(c);
+}
+const ConnectedComponent2 = connectLike(mapStateToProps, mapDispatchToProps)(MyComponent);
diff --git a/javascript/ql/test/library-tests/frameworks/Redux/test.expected b/javascript/ql/test/library-tests/frameworks/Redux/test.expected
new file mode 100644
index 00000000000..36964685247
--- /dev/null
+++ b/javascript/ql/test/library-tests/frameworks/Redux/test.expected
@@ -0,0 +1,165 @@
+reducerArg
+| exportedReducer.js:12:12:12:35 | (state, ... > state |
+| react-redux.jsx:12:33:17:9 | (state, ...       } |
+| react-redux.jsx:18:41:23:9 | (state, ...       } |
+| react-redux.jsx:59:30:62:2 | rt.comb ... cer,\\n}) |
+| react-redux.jsx:60:14:60:27 | toolkitReducer |
+| react-redux.jsx:61:13:61:25 | manualReducer |
+| trivial.js:10:10:10:33 | (state, ... > state |
+| trivial.js:11:10:13:5 | {\\n      ... ,\\n    } |
+| trivial.js:12:14:12:37 | (state, ... > state |
+| trivial.js:16:10:16:33 | (state, ... > state |
+| trivial.js:17:10:19:5 | {\\n      ... ,\\n    } |
+| trivial.js:18:14:18:37 | (state, ... > state |
+| trivial.js:22:10:22:33 | (state, ... > state |
+| trivial.js:23:10:25:5 | {\\n      ... ,\\n    } |
+| trivial.js:24:14:24:37 | (state, ... > state |
+| trivial.js:29:16:29:39 | (state, ... > state |
+| trivial.js:32:73:32:96 | (state, ... > state |
+| trivial.js:46:33:46:56 | (state, ... > state |
+| trivial.js:47:33:47:56 | (state, ... > state |
+| trivial.js:130:14:130:46 | wrapper ...  state) |
+| trivial.js:133:45:133:66 | combine ... Reducer |
+| trivial.js:134:56:134:79 | (state, ... > state |
+| trivial.js:136:14:136:37 | (state, ... > state |
+isActionTypeHandler
+| react-redux.jsx:12:18:12:30 | toolkitAction | react-redux.jsx:12:33:17:9 | (state, ...       } |
+| react-redux.jsx:18:18:18:38 | asyncAc ... lfilled | react-redux.jsx:18:41:23:9 | (state, ...       } |
+| trivial.js:29:5:29:13 | fooAction | trivial.js:29:16:29:39 | (state, ... > state |
+| trivial.js:32:60:32:70 | 'fooAction' | trivial.js:32:73:32:96 | (state, ... > state |
+| trivial.js:46:18:46:30 | toolkitAction | trivial.js:46:33:46:56 | (state, ... > state |
+| trivial.js:47:18:47:30 | toolkitAction | trivial.js:47:33:47:56 | (state, ... > state |
+isTypeTagHandler
+| asyncAction | react-redux.jsx:18:41:23:9 | (state, ...       } |
+| counter/increment | trivial.js:46:33:46:56 | (state, ... > state |
+| counter/increment | trivial.js:47:33:47:56 | (state, ... > state |
+| fooAction | trivial.js:29:16:29:39 | (state, ... > state |
+| fooAction | trivial.js:32:73:32:96 | (state, ... > state |
+| toolkitAction | react-redux.jsx:12:33:17:9 | (state, ...       } |
+isRootStateHandler
+| react-redux.jsx:59:30:62:2 | rt.comb ... cer,\\n}) |
+| trivial.js:133:45:133:66 | combine ... Reducer |
+| trivial.js:134:56:134:79 | (state, ... > state |
+| trivial.js:136:14:136:37 | (state, ... > state |
+delegatingReducer
+| exportedReducer.js:11:30:13:2 | combine ... tate\\n}) |
+| react-redux.jsx:10:24:24:2 | rt.crea ...  });\\n}) |
+| react-redux.jsx:59:30:62:2 | rt.comb ... cer,\\n}) |
+| trivial.js:9:22:14:2 | require ...    }\\n}) |
+| trivial.js:11:10:13:5 | {\\n      ... ,\\n    } |
+| trivial.js:15:26:20:2 | require ...    }\\n}) |
+| trivial.js:17:10:19:5 | {\\n      ... ,\\n    } |
+| trivial.js:21:24:26:2 | require ...    }\\n}) |
+| trivial.js:23:10:25:5 | {\\n      ... ,\\n    } |
+| trivial.js:28:23:30:2 | require ... ate,\\n}) |
+| trivial.js:32:22:32:97 | require ...  state) |
+| trivial.js:34:24:34:88 | require ...  state) |
+| trivial.js:36:15:36:56 | require ...  state) |
+| trivial.js:37:22:37:71 | require ...  state) |
+| trivial.js:39:25:39:76 | require ...  state) |
+| trivial.js:40:25:40:96 | require ... cers1]) |
+| trivial.js:41:25:41:89 | require ...  state) |
+| trivial.js:42:25:42:109 | require ... cers1]) |
+| trivial.js:44:23:48:2 | require ... ate)\\n}) |
+| trivial.js:129:32:131:2 | require ... te),\\n}) |
+getStateHandlerArg
+| exportedReducer.js:11:30:13:2 | combine ... tate\\n}) | inner | exportedReducer.js:12:12:12:35 | (state, ... > state |
+| react-redux.jsx:59:30:62:2 | rt.comb ... cer,\\n}) | manual | react-redux.jsx:61:13:61:25 | manualReducer |
+| react-redux.jsx:59:30:62:2 | rt.comb ... cer,\\n}) | toolkit | react-redux.jsx:60:14:60:27 | toolkitReducer |
+| trivial.js:9:22:14:2 | require ...    }\\n}) | bar | trivial.js:11:10:13:5 | {\\n      ... ,\\n    } |
+| trivial.js:9:22:14:2 | require ...    }\\n}) | foo | trivial.js:10:10:10:33 | (state, ... > state |
+| trivial.js:11:10:13:5 | {\\n      ... ,\\n    } | baz | trivial.js:12:14:12:37 | (state, ... > state |
+| trivial.js:15:26:20:2 | require ...    }\\n}) | bar | trivial.js:17:10:19:5 | {\\n      ... ,\\n    } |
+| trivial.js:15:26:20:2 | require ...    }\\n}) | foo | trivial.js:16:10:16:33 | (state, ... > state |
+| trivial.js:17:10:19:5 | {\\n      ... ,\\n    } | baz | trivial.js:18:14:18:37 | (state, ... > state |
+| trivial.js:21:24:26:2 | require ...    }\\n}) | bar | trivial.js:23:10:25:5 | {\\n      ... ,\\n    } |
+| trivial.js:21:24:26:2 | require ...    }\\n}) | foo | trivial.js:22:10:22:33 | (state, ... > state |
+| trivial.js:23:10:25:5 | {\\n      ... ,\\n    } | baz | trivial.js:24:14:24:37 | (state, ... > state |
+| trivial.js:129:32:131:2 | require ... te),\\n}) | wrapped | trivial.js:130:14:130:46 | wrapper ...  state) |
+getActionHandlerArg
+| react-redux.jsx:10:24:24:2 | rt.crea ...  });\\n}) | react-redux.jsx:12:18:12:30 | toolkitAction | react-redux.jsx:12:33:17:9 | (state, ...       } |
+| react-redux.jsx:10:24:24:2 | rt.crea ...  });\\n}) | react-redux.jsx:18:18:18:38 | asyncAc ... lfilled | react-redux.jsx:18:41:23:9 | (state, ...       } |
+| trivial.js:28:23:30:2 | require ... ate,\\n}) | trivial.js:29:5:29:13 | fooAction | trivial.js:29:16:29:39 | (state, ... > state |
+| trivial.js:32:22:32:97 | require ...  state) | trivial.js:32:60:32:70 | 'fooAction' | trivial.js:32:73:32:96 | (state, ... > state |
+| trivial.js:44:23:48:2 | require ... ate)\\n}) | trivial.js:46:18:46:30 | toolkitAction | trivial.js:46:33:46:56 | (state, ... > state |
+| trivial.js:44:23:48:2 | require ... ate)\\n}) | trivial.js:47:18:47:30 | toolkitAction | trivial.js:47:33:47:56 | (state, ... > state |
+getAPlainHandlerArg
+| trivial.js:36:15:36:56 | require ...  state) | trivial.js:36:32:36:55 | (state, ... > state |
+| trivial.js:37:22:37:71 | require ...  state) | trivial.js:37:47:37:70 | (state, ... > state |
+| trivial.js:39:25:39:76 | require ...  state) | trivial.js:39:52:39:75 | (state, ... > state |
+| trivial.js:40:25:40:96 | require ... cers1]) | trivial.js:40:52:40:95 | [(state ... ucers1] |
+| trivial.js:40:25:40:96 | require ... cers1]) | trivial.js:40:53:40:76 | (state, ... > state |
+| trivial.js:40:25:40:96 | require ... cers1]) | trivial.js:40:79:40:94 | reducerReducers1 |
+| trivial.js:41:25:41:89 | require ...  state) | trivial.js:41:65:41:88 | (state, ... > state |
+| trivial.js:42:25:42:109 | require ... cers1]) | trivial.js:42:65:42:108 | [(state ... ucers1] |
+| trivial.js:42:25:42:109 | require ... cers1]) | trivial.js:42:66:42:89 | (state, ... > state |
+| trivial.js:42:25:42:109 | require ... cers1]) | trivial.js:42:92:42:107 | reducerReducers1 |
+getUseSite
+| react-redux.jsx:10:24:24:2 | rt.crea ...  });\\n}) | react-redux.jsx:60:14:60:27 | toolkitReducer |
+| react-redux.jsx:59:30:62:2 | rt.comb ... cer,\\n}) | react-redux.jsx:59:30:62:2 | rt.comb ... cer,\\n}) |
+| trivial.js:11:10:13:5 | {\\n      ... ,\\n    } | trivial.js:11:10:13:5 | {\\n      ... ,\\n    } |
+| trivial.js:17:10:19:5 | {\\n      ... ,\\n    } | trivial.js:17:10:19:5 | {\\n      ... ,\\n    } |
+| trivial.js:23:10:25:5 | {\\n      ... ,\\n    } | trivial.js:23:10:25:5 | {\\n      ... ,\\n    } |
+| trivial.js:129:32:131:2 | require ... te),\\n}) | trivial.js:133:45:133:66 | combine ... Reducer |
+storeCreation
+| react-redux.jsx:59:15:62:3 | rt.crea ... er,\\n})) |
+| trivial.js:133:16:133:67 | require ... educer) |
+| trivial.js:134:16:134:80 | require ...  state) |
+| trivial.js:135:16:137:2 | require ... tate\\n}) |
+taintFlow
+| react-redux.jsx:67:29:67:36 | source() | react-redux.jsx:73:10:73:36 | props.p ... tAction |
+| react-redux.jsx:69:31:69:38 | source() | react-redux.jsx:74:10:74:35 | props.p ... lAction |
+| react-redux.jsx:69:31:69:38 | source() | react-redux.jsx:75:10:75:36 | props.p ... Action2 |
+| react-redux.jsx:69:31:69:38 | source() | react-redux.jsx:76:10:76:36 | props.p ... Action3 |
+| react-redux.jsx:70:30:70:37 | source() | react-redux.jsx:77:10:77:28 | props.propFromAsync |
+reactComponentRef
+| react-redux.jsx:64:1:80:1 | functio ... r}}/>\\n} | react-redux.jsx:64:1:80:1 | functio ... r}}/>\\n} |
+| react-redux.jsx:64:1:80:1 | functio ... r}}/>\\n} | react-redux.jsx:94:28:94:84 | connect ... ponent) |
+| react-redux.jsx:64:1:80:1 | functio ... r}}/>\\n} | react-redux.jsx:97:12:97:12 | c |
+getAffectedStateAccessPath
+| react-redux.jsx:12:33:17:9 | (state, ...       } | toolkit |
+| react-redux.jsx:18:41:23:9 | (state, ...       } | toolkit |
+| react-redux.jsx:60:14:60:27 | toolkitReducer | toolkit |
+| react-redux.jsx:61:13:61:25 | manualReducer | manual |
+| trivial.js:130:14:130:46 | wrapper ...  state) | wrapped |
+getADispatchFunctionNode
+| react-redux.jsx:65:20:65:32 | use (return (member useDispatch (member exports (module react-redux)))) |
+getADispatchedValueNode
+| react-redux.jsx:27:12:30:5 | def (return (member manualAction (parameter 1 (react-redux-connect)))) |
+| react-redux.jsx:69:18:69:39 | def (parameter 0 (return (member useDispatch (member exports (module react-redux))))) |
+| react-redux.jsx:70:18:70:38 | def (parameter 0 (return (member useDispatch (member exports (module react-redux))))) |
+getAnUntypedActionInReducer
+| exportedReducer.js:12:20:12:25 | action |
+| react-redux.jsx:32:31:32:36 | action |
+| trivial.js:10:18:10:23 | action |
+| trivial.js:12:22:12:27 | action |
+| trivial.js:16:18:16:23 | action |
+| trivial.js:18:22:18:27 | action |
+| trivial.js:22:18:22:23 | action |
+| trivial.js:24:22:24:27 | action |
+| trivial.js:124:20:124:25 | action |
+| trivial.js:130:30:130:35 | action |
+| trivial.js:134:64:134:69 | action |
+| trivial.js:136:22:136:27 | action |
+actionToReducerStep
+| react-redux.jsx:5:56:9:1 | return of anonymous function | react-redux.jsx:14:24:14:37 | action.payload |
+| react-redux.jsx:29:18:29:18 | x | react-redux.jsx:35:45:35:58 | action.payload |
+| react-redux.jsx:29:18:29:18 | x | react-redux.jsx:39:42:39:55 | action.payload |
+| react-redux.jsx:29:18:29:18 | x | react-redux.jsx:45:24:45:37 | action.payload |
+| react-redux.jsx:67:29:67:36 | source() | react-redux.jsx:5:57:5:57 | x |
+| react-redux.jsx:70:30:70:37 | source() | react-redux.jsx:51:57:51:57 | x |
+actionToReducerPromiseStep
+| react-redux.jsx:51:56:57:1 | return of anonymous function | react-redux.jsx:20:29:20:42 | action.payload |
+reducerToStateStep
+| react-redux.jsx:12:33:17:9 | return of anonymous function | react-redux.jsx:84:32:84:44 | state.toolkit |
+| react-redux.jsx:12:33:17:9 | return of anonymous function | react-redux.jsx:85:24:85:36 | state.toolkit |
+| react-redux.jsx:14:24:14:50 | action. ... itValue | react-redux.jsx:84:32:84:50 | state.toolkit.value |
+| react-redux.jsx:18:41:23:9 | return of anonymous function | react-redux.jsx:84:32:84:44 | state.toolkit |
+| react-redux.jsx:18:41:23:9 | return of anonymous function | react-redux.jsx:85:24:85:36 | state.toolkit |
+| react-redux.jsx:20:29:20:44 | action.payload.x | react-redux.jsx:85:24:85:47 | state.t ... ncValue |
+| react-redux.jsx:32:1:50:1 | return of function manualReducer | react-redux.jsx:86:31:86:42 | state.manual |
+| react-redux.jsx:32:1:50:1 | return of function manualReducer | react-redux.jsx:87:32:87:43 | state.manual |
+| react-redux.jsx:32:1:50:1 | return of function manualReducer | react-redux.jsx:88:32:88:43 | state.manual |
+| react-redux.jsx:35:45:35:58 | action.payload | react-redux.jsx:86:31:86:54 | state.m ... alValue |
+| react-redux.jsx:39:42:39:55 | action.payload | react-redux.jsx:87:32:87:56 | state.m ... lValue2 |
+| react-redux.jsx:44:27:46:14 | [1, 2,  ...      }) | react-redux.jsx:88:32:88:56 | state.m ... lValue3 |
diff --git a/javascript/ql/test/library-tests/frameworks/Redux/test.ql b/javascript/ql/test/library-tests/frameworks/Redux/test.ql
new file mode 100644
index 00000000000..2faffdbd5d0
--- /dev/null
+++ b/javascript/ql/test/library-tests/frameworks/Redux/test.ql
@@ -0,0 +1,65 @@
+import javascript
+
+query predicate getAffectedStateAccessPath = Redux::getAffectedStateAccessPath/1;
+
+query Redux::ReducerArg reducerArg() { any() }
+
+query Redux::ReducerArg isActionTypeHandler(DataFlow::Node actionType) {
+  result.isActionTypeHandler(actionType)
+}
+
+query Redux::ReducerArg isTypeTagHandler(string typeTag) { result.isTypeTagHandler(typeTag) }
+
+query Redux::ReducerArg isRootStateHandler() { result.isRootStateHandler() }
+
+query Redux::DelegatingReducer delegatingReducer() { any() }
+
+query DataFlow::Node getStateHandlerArg(Redux::DelegatingReducer reducer, string prop) {
+  result = reducer.getStateHandlerArg(prop)
+}
+
+query DataFlow::Node getActionHandlerArg(Redux::DelegatingReducer reducer, DataFlow::Node actionType) {
+  result = reducer.getActionHandlerArg(actionType)
+}
+
+query DataFlow::Node getAPlainHandlerArg(Redux::DelegatingReducer reducer) {
+  result = reducer.getAPlainHandlerArg()
+}
+
+query Redux::ReducerArg getUseSite(Redux::DelegatingReducer reducer) {
+  result = reducer.getUseSite()
+}
+
+query predicate getADispatchFunctionNode = Redux::getADispatchFunctionNode/0;
+
+query predicate getADispatchedValueNode = Redux::getADispatchedValueNode/0;
+
+query predicate getAnUntypedActionInReducer = Redux::getAnUntypedActionInReducer/0;
+
+query predicate actionToReducerStep = Redux::actionToReducerStep/2;
+
+query predicate actionToReducerPromiseStep = Redux::actionToReducerPromiseStep/2;
+
+query predicate reducerToStateStep = Redux::reducerToStateStep/2;
+
+query Redux::StoreCreation storeCreation() { any() }
+
+class BasicTaint extends TaintTracking::Configuration {
+  BasicTaint() { this = "BasicTaint" }
+
+  override predicate isSource(DataFlow::Node node) {
+    node.(DataFlow::CallNode).getCalleeName() = "source"
+  }
+
+  override predicate isSink(DataFlow::Node node) {
+    node = any(DataFlow::CallNode call | call.getCalleeName() = "sink").getAnArgument()
+  }
+}
+
+query predicate taintFlow(DataFlow::Node source, DataFlow::Node sink) {
+  any(BasicTaint cfg).hasFlow(source, sink)
+}
+
+query DataFlow::SourceNode reactComponentRef(ReactComponent component) {
+  result = component.getAComponentCreatorReference()
+}
diff --git a/javascript/ql/test/library-tests/frameworks/Redux/trivial.js b/javascript/ql/test/library-tests/frameworks/Redux/trivial.js
new file mode 100644
index 00000000000..8e431b04ed8
--- /dev/null
+++ b/javascript/ql/test/library-tests/frameworks/Redux/trivial.js
@@ -0,0 +1,137 @@
+// This file contains a lot of trivial reducers and actions, simply to test that
+// the Redux model recognizes them, but no data flow passes through them.
+
+const toolkitAction = require('@reduxjs/toolkit').createAction('counter/increment');
+const toolkitAsyncAction = require('@reduxjs/toolkit').createAsyncThunk('async-action', async (arg) => {
+    return await (await fetch(arg)).json();
+})
+
+const reduxCombine = require('redux').combineReducers({
+    foo: (state, action) => state,
+    bar: {
+        baz: (state, action) => state,
+    }
+});
+const immutableCombine = require('redux-immutable').combineReducers({
+    foo: (state, action) => state,
+    bar: {
+        baz: (state, action) => state,
+    }
+});
+const toolkitCombine = require('@reduxjs/toolkit').combineReducers({
+    foo: (state, action) => state,
+    bar: {
+        baz: (state, action) => state,
+    }
+});
+
+const handleActions = require('redux-actions').handleActions({
+    fooAction: (state, action) => state,
+});
+
+const handleAction = require('redux-actions').handleAction('fooAction', (state, action) => state);
+
+const persistReducer = require('redux-persist').persistReducer((state, action) => state);
+
+const immer = require('immer')((state, action) => state);
+const immerProduce = require('immer').produce((state, action) => state);
+
+const reduceReducers1 = require('reduce-reducers')((state, action) => state);
+const reduceReducers2 = require('reduce-reducers')([(state, action) => state, reducerReducers1]);
+const reduceReducers3 = require('redux-actions').reduceReducers((state, action) => state);
+const reduceReducers4 = require('redux-actions').reduceReducers([(state, action) => state, reducerReducers1]);
+
+const createReducer = require('@reduxjs/toolkit').createReducer(0, builder => {
+    builder
+        .addCase(toolkitAction, (state, action) => state)
+        .addCase(toolkitAction, (state, action) => state)
+});
+
+function createSlice1() {
+    const { increment } = require('@reduxjs/toolkit').createSlice({
+        name: 'counter1',
+        initialState: 0,
+        reducers: {
+            increment(state, action) {
+                return state;
+            }
+        },
+        extraReducers: {
+            [toolkitAction]: (state, action) => {
+                return state;
+            },
+            [toolkitAsyncAction.fulfilled]: (state, action) => {
+                action.meta.arg;
+                return state;
+            },
+            [toolkitAsyncAction.rejected]: (state, action) => {
+                action.meta.arg;
+                return state;
+            },
+            [toolkitAsyncAction.pending]: (state, action) => {
+                action.meta.arg;
+                return state;
+            }
+        }
+    });
+    return increment;
+}
+
+function createSlice2() {
+    const { increment } = require('@reduxjs/toolkit').createSlice({
+        name: 'counter2',
+        initialState: 0,
+        reducers: {
+            increment(state, action) {
+                return state;
+            }
+        },
+        extraReducers: builder => {
+            builder
+                .addCase(toolkitAction, (state, action) => state)
+                .addCase(toolkitAsyncAction.fulfilled, (state, action) => {
+                    action.meta.arg;
+                    return state;
+                });
+        }
+    });
+    return increment;
+}
+
+let importedReducers = combineReducers({
+    foo: {
+        bar: {
+            baz: (state, action) => state
+        },
+        baloon: require('./exportedReducer'),
+    },
+    nestedReducer: require('./exportedReducer').nestedReducer
+});
+
+const reduxActions = require('redux-actions').createAction('reduxActionsCreateAction');
+const tsUtils = require('redux-ts-utils').createAction('tsUtilCreateAction');
+
+const { fooAction2, barAction2 } = require('redux-actions').createActions({
+    foo1Action2(x, y) {
+        return { x, y }
+    },
+    barAction2(x) {
+        return { x }
+    }
+});
+
+function wrapper(fn) {
+    return (state, action) => {
+        console.log('hello');
+        return fn(state, action);
+    }
+}
+const combinedWrappedReducer = require('redux').combineReducers({
+    wrapped: wrapper((state, action) => state),
+});
+
+const store1 = require('redux').createStore(combinedWrappedReducer);
+const store2 = require('@reduxjs/toolkit').createStore((state, action) => state);
+const store3 = require('@reduxjs/toolkit').configureStore({
+    reducer: (state, action) => state
+});
diff --git a/javascript/ql/test/library-tests/frameworks/SQL/Credentials.expected b/javascript/ql/test/library-tests/frameworks/SQL/Credentials.expected
index a7d4af58a90..190d8a51982 100644
--- a/javascript/ql/test/library-tests/frameworks/SQL/Credentials.expected
+++ b/javascript/ql/test/library-tests/frameworks/SQL/Credentials.expected
@@ -6,6 +6,7 @@
 | mysql1.js:7:14:7:21 | 'secret' | password |
 | mysql1a.js:10:9:10:12 | 'me' | user name |
 | mysql1a.js:11:13:11:20 | 'secret' | password |
+| mysql2-promise.js:8:9:8:14 | 'root' | user name |
 | mysql2.js:7:21:7:25 | 'bob' | user name |
 | mysql2.js:8:21:8:28 | 'secret' | password |
 | mysql2tst.js:8:9:8:14 | 'root' | user name |
diff --git a/javascript/ql/test/library-tests/frameworks/SQL/SqlString.expected b/javascript/ql/test/library-tests/frameworks/SQL/SqlString.expected
index b2e0cc4b046..81338e00140 100644
--- a/javascript/ql/test/library-tests/frameworks/SQL/SqlString.expected
+++ b/javascript/ql/test/library-tests/frameworks/SQL/SqlString.expected
@@ -1,28 +1,47 @@
 | mssql1.js:7:40:7:72 | select  ... e id =  |
 | mssql1.js:7:75:7:79 | value |
+| mssql1.js:10:19:10:30 | 'SELECT 123' |
 | mssql2.js:5:15:5:34 | 'select 1 as number' |
 | mssql2.js:13:15:13:66 | 'create ...  table' |
 | mssql2.js:22:24:22:43 | 'select 1 as number' |
 | mssql2.js:29:30:29:81 | 'create ...  table' |
+| mssql-types.ts:7:31:7:42 | 'SELECT 123' |
 | mysql1.js:13:18:13:43 | 'SELECT ... lution' |
 | mysql1.js:18:18:22:1 | {\\n    s ... vid']\\n} |
 | mysql1a.js:17:18:17:43 | 'SELECT ... lution' |
+| mysql2-promise.js:14:3:14:62 | 'SELECT ... ` > 45' |
+| mysql2-promise.js:23:3:23:56 | 'SELECT ... e` > ?' |
+| mysql2-promise.js:31:19:31:39 | 'SELECT ...  users' |
+| mysql2-promise.js:32:21:32:41 | 'SELECT ...  users' |
+| mysql2-types.ts:4:16:4:36 | 'SELECT ...  users' |
 | mysql2.js:12:12:12:37 | 'SELECT ... lution' |
 | mysql2tst.js:14:3:14:62 | 'SELECT ... ` > 45' |
 | mysql2tst.js:23:3:23:56 | 'SELECT ... e` > ?' |
+| mysql2tst.js:31:19:31:39 | 'SELECT ...  users' |
+| mysql2tst.js:32:21:32:41 | 'SELECT ...  users' |
 | mysql3.js:14:20:14:52 | 'SELECT ... etable' |
+| mysql3.js:26:14:26:31 | 'SELECT something' |
 | mysql4.js:14:18:14:20 | sql |
 | mysqlImport.js:3:18:5:1 | {\\n    s ... = ?',\\n} |
 | postgres1.js:37:21:37:24 | text |
 | postgres2.js:30:16:30:41 | 'SELECT ... number' |
+| postgres2.js:43:15:43:26 | 'SELECT 123' |
+| postgres2.js:46:15:46:47 | new Cur ... users') |
+| postgres2.js:46:26:46:46 | 'SELECT ...  users' |
 | postgres3.js:15:16:15:40 | 'SELECT ... s name' |
 | postgres5.js:8:21:8:25 | query |
+| postgres-types.ts:4:18:4:29 | 'SELECT 123' |
 | postgresImport.js:4:18:4:43 | 'SELECT ... number' |
 | sequelize2.js:10:17:10:118 | 'SELECT ... Y name' |
+| sequelize2.js:12:17:15:1 | {\\n  que ... [123]\\n} |
+| sequelize2.js:13:10:13:20 | 'SELECT $1' |
+| sequelize2.js:17:31:17:41 | '123 + 345' |
+| sequelize-types.ts:7:24:7:35 | 'SELECT 123' |
 | sequelize.js:8:17:8:118 | 'SELECT ... Y name' |
 | sequelizeImport.js:3:17:3:118 | 'SELECT ... Y name' |
 | spanner2.js:5:26:5:35 | "SQL code" |
 | spanner2.js:7:35:7:44 | "SQL code" |
+| spanner-types.ts:4:12:4:23 | 'SELECT 123' |
 | spanner.js:6:8:6:17 | "SQL code" |
 | spanner.js:7:8:7:26 | { sql: "SQL code" } |
 | spanner.js:7:15:7:24 | "SQL code" |
@@ -41,7 +60,11 @@
 | spanner.js:18:16:18:25 | "SQL code" |
 | spanner.js:19:16:19:34 | { sql: "SQL code" } |
 | spanner.js:19:23:19:32 | "SQL code" |
+| spanner.js:23:12:23:23 | 'SELECT 123' |
+| spanner.js:26:12:26:38 | 'UPDATE ... = @baz' |
+| spanner.js:31:18:31:24 | queries |
 | spannerImport.js:4:8:4:17 | "SQL code" |
+| sqlite-types.ts:4:12:4:49 | "UPDATE ... id = ?" |
 | sqlite.js:7:8:7:45 | "UPDATE ... id = ?" |
 | sqliteArray.js:6:12:6:49 | "UPDATE ... id = ?" |
 | sqliteImport.js:2:8:2:44 | "UPDATE ... id = ?" |
diff --git a/javascript/ql/test/library-tests/frameworks/SQL/mssql-types.ts b/javascript/ql/test/library-tests/frameworks/SQL/mssql-types.ts
new file mode 100644
index 00000000000..243812e799c
--- /dev/null
+++ b/javascript/ql/test/library-tests/frameworks/SQL/mssql-types.ts
@@ -0,0 +1,9 @@
+import { ConnectionPool } from "mssql";
+
+class Foo {
+  constructor(private pool: ConnectionPool) {}
+
+  doSomething() {
+    this.pool.request().query('SELECT 123');
+  }
+}
diff --git a/javascript/ql/test/library-tests/frameworks/SQL/mssql1.js b/javascript/ql/test/library-tests/frameworks/SQL/mssql1.js
index 39a340ccf83..8f8bf1f0914 100644
--- a/javascript/ql/test/library-tests/frameworks/SQL/mssql1.js
+++ b/javascript/ql/test/library-tests/frameworks/SQL/mssql1.js
@@ -6,6 +6,8 @@ async () => {
         const pool = await sql.connect('mssql://username:password@localhost/database')
         const result = await sql.query`select * from mytable where id = ${value}`
         console.dir(result)
+
+        sql.query('SELECT 123');
     } catch (err) {
         // ... error checks 
     }
diff --git a/javascript/ql/test/library-tests/frameworks/SQL/mysql2-promise.js b/javascript/ql/test/library-tests/frameworks/SQL/mysql2-promise.js
new file mode 100644
index 00000000000..6e40c5cafbc
--- /dev/null
+++ b/javascript/ql/test/library-tests/frameworks/SQL/mysql2-promise.js
@@ -0,0 +1,32 @@
+// Adapted from the documentation of https://github.com/sidorares/node-mysql2,
+// which is licensed under the MIT license; see file node-mysql2-License.
+const mysql = require('mysql2/promise');
+ 
+// create the connection to database
+const connection = await mysql.createConnection({
+  host: 'localhost',
+  user: 'root',
+  database: 'test'
+});
+ 
+// simple query
+connection.query(
+  'SELECT * FROM `table` WHERE `name` = "Page" AND `age` > 45',
+  function(err, results, fields) {
+    console.log(results); // results contains rows returned by server
+    console.log(fields); // fields contains extra meta data about results, if available
+  }
+);
+ 
+// with placeholder
+connection.query(
+  'SELECT * FROM `table` WHERE `name` = ? AND `age` > ?',
+  ['Page', 45],
+  function(err, results) {
+    console.log(results);
+  }
+);
+
+const conn2 = await mysql.createConnectionPromise();
+await conn2.query('SELECT * FROM users');
+await conn2.execute('SELECT * FROM users');
diff --git a/javascript/ql/test/library-tests/frameworks/SQL/mysql2-types.ts b/javascript/ql/test/library-tests/frameworks/SQL/mysql2-types.ts
new file mode 100644
index 00000000000..dba89f2ca47
--- /dev/null
+++ b/javascript/ql/test/library-tests/frameworks/SQL/mysql2-types.ts
@@ -0,0 +1,5 @@
+import { Connection } from "mysql2";
+
+export function doSomething(conn: Connection) {
+    conn.query('SELECT * FROM users');
+}
diff --git a/javascript/ql/test/library-tests/frameworks/SQL/mysql2tst.js b/javascript/ql/test/library-tests/frameworks/SQL/mysql2tst.js
index c066aa8e92e..9121096f77d 100644
--- a/javascript/ql/test/library-tests/frameworks/SQL/mysql2tst.js
+++ b/javascript/ql/test/library-tests/frameworks/SQL/mysql2tst.js
@@ -26,3 +26,7 @@ connection.query(
     console.log(results);
   }
 );
+
+const conn2 = await mysql.createConnectionPromise();
+await conn2.query('SELECT * FROM users');
+await conn2.execute('SELECT * FROM users');
diff --git a/javascript/ql/test/library-tests/frameworks/SQL/mysql3.js b/javascript/ql/test/library-tests/frameworks/SQL/mysql3.js
index 63ac500d067..554777abcb1 100644
--- a/javascript/ql/test/library-tests/frameworks/SQL/mysql3.js
+++ b/javascript/ql/test/library-tests/frameworks/SQL/mysql3.js
@@ -21,3 +21,7 @@ pool.getConnection(function(err, connection) {
     // Don't use the connection here, it has been returned to the pool. 
   });
 });
+
+pool.on('connection', conn => {
+  conn.query('SELECT something');
+});
diff --git a/javascript/ql/test/library-tests/frameworks/SQL/postgres-types.ts b/javascript/ql/test/library-tests/frameworks/SQL/postgres-types.ts
new file mode 100644
index 00000000000..00817e5d63e
--- /dev/null
+++ b/javascript/ql/test/library-tests/frameworks/SQL/postgres-types.ts
@@ -0,0 +1,5 @@
+import { Client } from "pg";
+
+function submitSomething(client: Client) {
+    client.query('SELECT 123');
+}
diff --git a/javascript/ql/test/library-tests/frameworks/SQL/postgres2.js b/javascript/ql/test/library-tests/frameworks/SQL/postgres2.js
index 611f4e286af..fd449ae8765 100644
--- a/javascript/ql/test/library-tests/frameworks/SQL/postgres2.js
+++ b/javascript/ql/test/library-tests/frameworks/SQL/postgres2.js
@@ -38,3 +38,9 @@ pool.connect(function(err, client, done) {
     //output: 1 
   });
 });
+
+let client2 = await pool.connect();
+client2.query('SELECT 123');
+
+const Cursor = require('pg-cursor');
+client2.query(new Cursor('SELECT * from users'));
diff --git a/javascript/ql/test/library-tests/frameworks/SQL/sequelize-types.ts b/javascript/ql/test/library-tests/frameworks/SQL/sequelize-types.ts
new file mode 100644
index 00000000000..2591048bdb5
--- /dev/null
+++ b/javascript/ql/test/library-tests/frameworks/SQL/sequelize-types.ts
@@ -0,0 +1,9 @@
+import Sequelize from 'sequelize';
+
+export class Foo {
+    constructor(private seq: Sequelize) {}
+
+    method() {
+        this.seq.query('SELECT 123');
+    }
+}
diff --git a/javascript/ql/test/library-tests/frameworks/SQL/sequelize2.js b/javascript/ql/test/library-tests/frameworks/SQL/sequelize2.js
index 194a921ffdd..9fa7392cad6 100644
--- a/javascript/ql/test/library-tests/frameworks/SQL/sequelize2.js
+++ b/javascript/ql/test/library-tests/frameworks/SQL/sequelize2.js
@@ -9,3 +9,9 @@ const sequelize = new Sequelize('database', {
 });
 sequelize.query('SELECT * FROM Products WHERE (name LIKE \'%' + criteria + '%\') AND deletedAt IS NULL) ORDER BY name');
 
+sequelize.query({
+  query: 'SELECT $1',
+  values: [123]
+});
+
+let value = Sequelize.literal('123 + 345');
diff --git a/javascript/ql/test/library-tests/frameworks/SQL/spanner-types.ts b/javascript/ql/test/library-tests/frameworks/SQL/spanner-types.ts
new file mode 100644
index 00000000000..8dceca56e60
--- /dev/null
+++ b/javascript/ql/test/library-tests/frameworks/SQL/spanner-types.ts
@@ -0,0 +1,5 @@
+import { Database } from "@google-cloud/spanner";
+
+export function doSomething(db: Database) {
+    db.run('SELECT 123');
+}
diff --git a/javascript/ql/test/library-tests/frameworks/SQL/spanner.js b/javascript/ql/test/library-tests/frameworks/SQL/spanner.js
index a27c52d82fd..8396745f7e6 100644
--- a/javascript/ql/test/library-tests/frameworks/SQL/spanner.js
+++ b/javascript/ql/test/library-tests/frameworks/SQL/spanner.js
@@ -17,6 +17,18 @@ db.runTransaction((err, tx) => {
   tx.runStream({ sql: "SQL code" });
   tx.runUpdate("SQL code");
   tx.runUpdate({ sql: "SQL code" });
+
+  const queries = [
+    {
+      sql: 'SELECT 123',
+    },
+    {
+      sql: 'UPDATE foo SET bar = @baz',
+      params: {key: 'baz', value: '123'}
+    }
+  ];
+  
+  tx.batchUpdate(queries, () => {});
 });
 
 exports.instance = instance;
diff --git a/javascript/ql/test/library-tests/frameworks/SQL/sqlite-types.ts b/javascript/ql/test/library-tests/frameworks/SQL/sqlite-types.ts
new file mode 100644
index 00000000000..9356cf0bda5
--- /dev/null
+++ b/javascript/ql/test/library-tests/frameworks/SQL/sqlite-types.ts
@@ -0,0 +1,5 @@
+import { Database } from "sqlite3";
+
+export function doSomething(db: Database) {
+    db.run("UPDATE tbl SET name = ? WHERE id = ?", "bar", 2);
+}
diff --git a/javascript/ql/test/library-tests/frameworks/SocketIO/AdditionalFlowStep.qll b/javascript/ql/test/library-tests/frameworks/SocketIO/AdditionalFlowStep.qll
index 5cc19dee55c..26fd1693140 100644
--- a/javascript/ql/test/library-tests/frameworks/SocketIO/AdditionalFlowStep.qll
+++ b/javascript/ql/test/library-tests/frameworks/SocketIO/AdditionalFlowStep.qll
@@ -1,5 +1,5 @@
 import javascript
 
 query predicate test_AdditionalFlowStep(DataFlow::Node pred, DataFlow::Node succ) {
-  exists(DataFlow::AdditionalFlowStep step | step.step(pred, succ) | any())
+  DataFlow::SharedFlowStep::step(pred, succ)
 }
diff --git a/javascript/ql/test/library-tests/frameworks/WebSocket/test.expected b/javascript/ql/test/library-tests/frameworks/WebSocket/test.expected
index c3942b8660b..96c5aedb737 100644
--- a/javascript/ql/test/library-tests/frameworks/WebSocket/test.expected
+++ b/javascript/ql/test/library-tests/frameworks/WebSocket/test.expected
@@ -21,7 +21,7 @@ serverSend
 serverReceive
 | server.js:7:3:9:4 | ws.on(' ... );\\n\\t\\t}) |
 | sockjs.js:9:5:12:6 | conn.on ... \\n    }) |
-taintStep
+flowSteps
 | browser.js:5:15:5:32 | 'Hi from browser!' | server.js:7:38:7:44 | message |
 | browser.js:21:13:21:18 | 'test' | sockjs.js:9:31:9:37 | message |
 | client.js:7:11:7:27 | 'Hi from client!' | server.js:7:38:7:44 | message |
diff --git a/javascript/ql/test/library-tests/frameworks/WebSocket/test.ql b/javascript/ql/test/library-tests/frameworks/WebSocket/test.ql
index dd2165e37c9..fb658c2f195 100644
--- a/javascript/ql/test/library-tests/frameworks/WebSocket/test.ql
+++ b/javascript/ql/test/library-tests/frameworks/WebSocket/test.ql
@@ -12,8 +12,8 @@ query ServerWebSocket::SendNode serverSend() { any() }
 
 query ServerWebSocket::ReceiveNode serverReceive() { any() }
 
-query predicate taintStep(DataFlow::Node pred, DataFlow::Node succ) {
-  any(DataFlow::AdditionalFlowStep s).step(pred, succ)
+query predicate flowSteps(DataFlow::Node pred, DataFlow::Node succ) {
+  DataFlow::SharedFlowStep::step(pred, succ)
 }
 
 query RemoteFlowSource remoteFlow() { any() }
diff --git a/javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.expected b/javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.expected
index 7e4ab1a0427..5d8806c0501 100644
--- a/javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.expected
@@ -2168,6 +2168,127 @@ nodes
 | other-fs-libraries.js:42:53:42:56 | path |
 | other-fs-libraries.js:42:53:42:56 | path |
 | other-fs-libraries.js:42:53:42:56 | path |
+| other-fs-libraries.js:49:7:49:48 | path |
+| other-fs-libraries.js:49:7:49:48 | path |
+| other-fs-libraries.js:49:7:49:48 | path |
+| other-fs-libraries.js:49:7:49:48 | path |
+| other-fs-libraries.js:49:7:49:48 | path |
+| other-fs-libraries.js:49:7:49:48 | path |
+| other-fs-libraries.js:49:7:49:48 | path |
+| other-fs-libraries.js:49:7:49:48 | path |
+| other-fs-libraries.js:49:7:49:48 | path |
+| other-fs-libraries.js:49:7:49:48 | path |
+| other-fs-libraries.js:49:7:49:48 | path |
+| other-fs-libraries.js:49:7:49:48 | path |
+| other-fs-libraries.js:49:7:49:48 | path |
+| other-fs-libraries.js:49:7:49:48 | path |
+| other-fs-libraries.js:49:7:49:48 | path |
+| other-fs-libraries.js:49:7:49:48 | path |
+| other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:14:49:43 | url.par ... ).query |
+| other-fs-libraries.js:49:14:49:43 | url.par ... ).query |
+| other-fs-libraries.js:49:14:49:43 | url.par ... ).query |
+| other-fs-libraries.js:49:14:49:43 | url.par ... ).query |
+| other-fs-libraries.js:49:14:49:43 | url.par ... ).query |
+| other-fs-libraries.js:49:14:49:43 | url.par ... ).query |
+| other-fs-libraries.js:49:14:49:43 | url.par ... ).query |
+| other-fs-libraries.js:49:14:49:43 | url.par ... ).query |
+| other-fs-libraries.js:49:14:49:43 | url.par ... ).query |
+| other-fs-libraries.js:49:14:49:43 | url.par ... ).query |
+| other-fs-libraries.js:49:14:49:43 | url.par ... ).query |
+| other-fs-libraries.js:49:14:49:43 | url.par ... ).query |
+| other-fs-libraries.js:49:14:49:43 | url.par ... ).query |
+| other-fs-libraries.js:49:14:49:43 | url.par ... ).query |
+| other-fs-libraries.js:49:14:49:43 | url.par ... ).query |
+| other-fs-libraries.js:49:14:49:43 | url.par ... ).query |
+| other-fs-libraries.js:49:14:49:48 | url.par ... ry.path |
+| other-fs-libraries.js:49:14:49:48 | url.par ... ry.path |
+| other-fs-libraries.js:49:14:49:48 | url.par ... ry.path |
+| other-fs-libraries.js:49:14:49:48 | url.par ... ry.path |
+| other-fs-libraries.js:49:14:49:48 | url.par ... ry.path |
+| other-fs-libraries.js:49:14:49:48 | url.par ... ry.path |
+| other-fs-libraries.js:49:14:49:48 | url.par ... ry.path |
+| other-fs-libraries.js:49:14:49:48 | url.par ... ry.path |
+| other-fs-libraries.js:49:14:49:48 | url.par ... ry.path |
+| other-fs-libraries.js:49:14:49:48 | url.par ... ry.path |
+| other-fs-libraries.js:49:14:49:48 | url.par ... ry.path |
+| other-fs-libraries.js:49:14:49:48 | url.par ... ry.path |
+| other-fs-libraries.js:49:14:49:48 | url.par ... ry.path |
+| other-fs-libraries.js:49:14:49:48 | url.par ... ry.path |
+| other-fs-libraries.js:49:14:49:48 | url.par ... ry.path |
+| other-fs-libraries.js:49:14:49:48 | url.par ... ry.path |
+| other-fs-libraries.js:49:24:49:30 | req.url |
+| other-fs-libraries.js:49:24:49:30 | req.url |
+| other-fs-libraries.js:49:24:49:30 | req.url |
+| other-fs-libraries.js:49:24:49:30 | req.url |
+| other-fs-libraries.js:49:24:49:30 | req.url |
+| other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:52:24:52:27 | path |
+| pupeteer.js:5:9:5:71 | tainted |
+| pupeteer.js:5:9:5:71 | tainted |
+| pupeteer.js:5:9:5:71 | tainted |
+| pupeteer.js:5:19:5:71 | "dir/"  ... t.data" |
+| pupeteer.js:5:19:5:71 | "dir/"  ... t.data" |
+| pupeteer.js:5:19:5:71 | "dir/"  ... t.data" |
+| pupeteer.js:5:28:5:53 | parseTo ... t).name |
+| pupeteer.js:5:28:5:53 | parseTo ... t).name |
+| pupeteer.js:5:28:5:53 | parseTo ... t).name |
+| pupeteer.js:5:28:5:53 | parseTo ... t).name |
+| pupeteer.js:9:28:9:34 | tainted |
+| pupeteer.js:9:28:9:34 | tainted |
+| pupeteer.js:9:28:9:34 | tainted |
+| pupeteer.js:9:28:9:34 | tainted |
+| pupeteer.js:13:37:13:43 | tainted |
+| pupeteer.js:13:37:13:43 | tainted |
+| pupeteer.js:13:37:13:43 | tainted |
+| pupeteer.js:13:37:13:43 | tainted |
 | tainted-access-paths.js:6:7:6:48 | path |
 | tainted-access-paths.js:6:7:6:48 | path |
 | tainted-access-paths.js:6:7:6:48 | path |
@@ -6403,6 +6524,171 @@ edges
 | other-fs-libraries.js:38:24:38:30 | req.url | other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
 | other-fs-libraries.js:38:24:38:30 | req.url | other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
 | other-fs-libraries.js:38:24:38:30 | req.url | other-fs-libraries.js:38:14:38:37 | url.par ... , true) |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:51:19:51:22 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:49:7:49:48 | path | other-fs-libraries.js:52:24:52:27 | path |
+| other-fs-libraries.js:49:14:49:37 | url.par ... , true) | other-fs-libraries.js:49:14:49:43 | url.par ... ).query |
+| other-fs-libraries.js:49:14:49:37 | url.par ... , true) | other-fs-libraries.js:49:14:49:43 | url.par ... ).query |
+| other-fs-libraries.js:49:14:49:37 | url.par ... , true) | other-fs-libraries.js:49:14:49:43 | url.par ... ).query |
+| other-fs-libraries.js:49:14:49:37 | url.par ... , true) | other-fs-libraries.js:49:14:49:43 | url.par ... ).query |
+| other-fs-libraries.js:49:14:49:37 | url.par ... , true) | other-fs-libraries.js:49:14:49:43 | url.par ... ).query |
+| other-fs-libraries.js:49:14:49:37 | url.par ... , true) | other-fs-libraries.js:49:14:49:43 | url.par ... ).query |
+| other-fs-libraries.js:49:14:49:37 | url.par ... , true) | other-fs-libraries.js:49:14:49:43 | url.par ... ).query |
+| other-fs-libraries.js:49:14:49:37 | url.par ... , true) | other-fs-libraries.js:49:14:49:43 | url.par ... ).query |
+| other-fs-libraries.js:49:14:49:37 | url.par ... , true) | other-fs-libraries.js:49:14:49:43 | url.par ... ).query |
+| other-fs-libraries.js:49:14:49:37 | url.par ... , true) | other-fs-libraries.js:49:14:49:43 | url.par ... ).query |
+| other-fs-libraries.js:49:14:49:37 | url.par ... , true) | other-fs-libraries.js:49:14:49:43 | url.par ... ).query |
+| other-fs-libraries.js:49:14:49:37 | url.par ... , true) | other-fs-libraries.js:49:14:49:43 | url.par ... ).query |
+| other-fs-libraries.js:49:14:49:37 | url.par ... , true) | other-fs-libraries.js:49:14:49:43 | url.par ... ).query |
+| other-fs-libraries.js:49:14:49:37 | url.par ... , true) | other-fs-libraries.js:49:14:49:43 | url.par ... ).query |
+| other-fs-libraries.js:49:14:49:37 | url.par ... , true) | other-fs-libraries.js:49:14:49:43 | url.par ... ).query |
+| other-fs-libraries.js:49:14:49:37 | url.par ... , true) | other-fs-libraries.js:49:14:49:43 | url.par ... ).query |
+| other-fs-libraries.js:49:14:49:43 | url.par ... ).query | other-fs-libraries.js:49:14:49:48 | url.par ... ry.path |
+| other-fs-libraries.js:49:14:49:43 | url.par ... ).query | other-fs-libraries.js:49:14:49:48 | url.par ... ry.path |
+| other-fs-libraries.js:49:14:49:43 | url.par ... ).query | other-fs-libraries.js:49:14:49:48 | url.par ... ry.path |
+| other-fs-libraries.js:49:14:49:43 | url.par ... ).query | other-fs-libraries.js:49:14:49:48 | url.par ... ry.path |
+| other-fs-libraries.js:49:14:49:43 | url.par ... ).query | other-fs-libraries.js:49:14:49:48 | url.par ... ry.path |
+| other-fs-libraries.js:49:14:49:43 | url.par ... ).query | other-fs-libraries.js:49:14:49:48 | url.par ... ry.path |
+| other-fs-libraries.js:49:14:49:43 | url.par ... ).query | other-fs-libraries.js:49:14:49:48 | url.par ... ry.path |
+| other-fs-libraries.js:49:14:49:43 | url.par ... ).query | other-fs-libraries.js:49:14:49:48 | url.par ... ry.path |
+| other-fs-libraries.js:49:14:49:43 | url.par ... ).query | other-fs-libraries.js:49:14:49:48 | url.par ... ry.path |
+| other-fs-libraries.js:49:14:49:43 | url.par ... ).query | other-fs-libraries.js:49:14:49:48 | url.par ... ry.path |
+| other-fs-libraries.js:49:14:49:43 | url.par ... ).query | other-fs-libraries.js:49:14:49:48 | url.par ... ry.path |
+| other-fs-libraries.js:49:14:49:43 | url.par ... ).query | other-fs-libraries.js:49:14:49:48 | url.par ... ry.path |
+| other-fs-libraries.js:49:14:49:43 | url.par ... ).query | other-fs-libraries.js:49:14:49:48 | url.par ... ry.path |
+| other-fs-libraries.js:49:14:49:43 | url.par ... ).query | other-fs-libraries.js:49:14:49:48 | url.par ... ry.path |
+| other-fs-libraries.js:49:14:49:43 | url.par ... ).query | other-fs-libraries.js:49:14:49:48 | url.par ... ry.path |
+| other-fs-libraries.js:49:14:49:43 | url.par ... ).query | other-fs-libraries.js:49:14:49:48 | url.par ... ry.path |
+| other-fs-libraries.js:49:14:49:48 | url.par ... ry.path | other-fs-libraries.js:49:7:49:48 | path |
+| other-fs-libraries.js:49:14:49:48 | url.par ... ry.path | other-fs-libraries.js:49:7:49:48 | path |
+| other-fs-libraries.js:49:14:49:48 | url.par ... ry.path | other-fs-libraries.js:49:7:49:48 | path |
+| other-fs-libraries.js:49:14:49:48 | url.par ... ry.path | other-fs-libraries.js:49:7:49:48 | path |
+| other-fs-libraries.js:49:14:49:48 | url.par ... ry.path | other-fs-libraries.js:49:7:49:48 | path |
+| other-fs-libraries.js:49:14:49:48 | url.par ... ry.path | other-fs-libraries.js:49:7:49:48 | path |
+| other-fs-libraries.js:49:14:49:48 | url.par ... ry.path | other-fs-libraries.js:49:7:49:48 | path |
+| other-fs-libraries.js:49:14:49:48 | url.par ... ry.path | other-fs-libraries.js:49:7:49:48 | path |
+| other-fs-libraries.js:49:14:49:48 | url.par ... ry.path | other-fs-libraries.js:49:7:49:48 | path |
+| other-fs-libraries.js:49:14:49:48 | url.par ... ry.path | other-fs-libraries.js:49:7:49:48 | path |
+| other-fs-libraries.js:49:14:49:48 | url.par ... ry.path | other-fs-libraries.js:49:7:49:48 | path |
+| other-fs-libraries.js:49:14:49:48 | url.par ... ry.path | other-fs-libraries.js:49:7:49:48 | path |
+| other-fs-libraries.js:49:14:49:48 | url.par ... ry.path | other-fs-libraries.js:49:7:49:48 | path |
+| other-fs-libraries.js:49:14:49:48 | url.par ... ry.path | other-fs-libraries.js:49:7:49:48 | path |
+| other-fs-libraries.js:49:14:49:48 | url.par ... ry.path | other-fs-libraries.js:49:7:49:48 | path |
+| other-fs-libraries.js:49:14:49:48 | url.par ... ry.path | other-fs-libraries.js:49:7:49:48 | path |
+| other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:49:14:49:37 | url.par ... , true) |
+| pupeteer.js:5:9:5:71 | tainted | pupeteer.js:9:28:9:34 | tainted |
+| pupeteer.js:5:9:5:71 | tainted | pupeteer.js:9:28:9:34 | tainted |
+| pupeteer.js:5:9:5:71 | tainted | pupeteer.js:9:28:9:34 | tainted |
+| pupeteer.js:5:9:5:71 | tainted | pupeteer.js:9:28:9:34 | tainted |
+| pupeteer.js:5:9:5:71 | tainted | pupeteer.js:9:28:9:34 | tainted |
+| pupeteer.js:5:9:5:71 | tainted | pupeteer.js:9:28:9:34 | tainted |
+| pupeteer.js:5:9:5:71 | tainted | pupeteer.js:13:37:13:43 | tainted |
+| pupeteer.js:5:9:5:71 | tainted | pupeteer.js:13:37:13:43 | tainted |
+| pupeteer.js:5:9:5:71 | tainted | pupeteer.js:13:37:13:43 | tainted |
+| pupeteer.js:5:9:5:71 | tainted | pupeteer.js:13:37:13:43 | tainted |
+| pupeteer.js:5:9:5:71 | tainted | pupeteer.js:13:37:13:43 | tainted |
+| pupeteer.js:5:9:5:71 | tainted | pupeteer.js:13:37:13:43 | tainted |
+| pupeteer.js:5:19:5:71 | "dir/"  ... t.data" | pupeteer.js:5:9:5:71 | tainted |
+| pupeteer.js:5:19:5:71 | "dir/"  ... t.data" | pupeteer.js:5:9:5:71 | tainted |
+| pupeteer.js:5:19:5:71 | "dir/"  ... t.data" | pupeteer.js:5:9:5:71 | tainted |
+| pupeteer.js:5:28:5:53 | parseTo ... t).name | pupeteer.js:5:19:5:71 | "dir/"  ... t.data" |
+| pupeteer.js:5:28:5:53 | parseTo ... t).name | pupeteer.js:5:19:5:71 | "dir/"  ... t.data" |
+| pupeteer.js:5:28:5:53 | parseTo ... t).name | pupeteer.js:5:19:5:71 | "dir/"  ... t.data" |
+| pupeteer.js:5:28:5:53 | parseTo ... t).name | pupeteer.js:5:19:5:71 | "dir/"  ... t.data" |
+| pupeteer.js:5:28:5:53 | parseTo ... t).name | pupeteer.js:5:19:5:71 | "dir/"  ... t.data" |
+| pupeteer.js:5:28:5:53 | parseTo ... t).name | pupeteer.js:5:19:5:71 | "dir/"  ... t.data" |
 | tainted-access-paths.js:6:7:6:48 | path | tainted-access-paths.js:8:19:8:22 | path |
 | tainted-access-paths.js:6:7:6:48 | path | tainted-access-paths.js:8:19:8:22 | path |
 | tainted-access-paths.js:6:7:6:48 | path | tainted-access-paths.js:8:19:8:22 | path |
@@ -8007,6 +8293,10 @@ edges
 | other-fs-libraries.js:40:35:40:38 | path | other-fs-libraries.js:38:24:38:30 | req.url | other-fs-libraries.js:40:35:40:38 | path | This path depends on $@. | other-fs-libraries.js:38:24:38:30 | req.url | a user-provided value |
 | other-fs-libraries.js:41:50:41:53 | path | other-fs-libraries.js:38:24:38:30 | req.url | other-fs-libraries.js:41:50:41:53 | path | This path depends on $@. | other-fs-libraries.js:38:24:38:30 | req.url | a user-provided value |
 | other-fs-libraries.js:42:53:42:56 | path | other-fs-libraries.js:38:24:38:30 | req.url | other-fs-libraries.js:42:53:42:56 | path | This path depends on $@. | other-fs-libraries.js:38:24:38:30 | req.url | a user-provided value |
+| other-fs-libraries.js:51:19:51:22 | path | other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:51:19:51:22 | path | This path depends on $@. | other-fs-libraries.js:49:24:49:30 | req.url | a user-provided value |
+| other-fs-libraries.js:52:24:52:27 | path | other-fs-libraries.js:49:24:49:30 | req.url | other-fs-libraries.js:52:24:52:27 | path | This path depends on $@. | other-fs-libraries.js:49:24:49:30 | req.url | a user-provided value |
+| pupeteer.js:9:28:9:34 | tainted | pupeteer.js:5:28:5:53 | parseTo ... t).name | pupeteer.js:9:28:9:34 | tainted | This path depends on $@. | pupeteer.js:5:28:5:53 | parseTo ... t).name | a user-provided value |
+| pupeteer.js:13:37:13:43 | tainted | pupeteer.js:5:28:5:53 | parseTo ... t).name | pupeteer.js:13:37:13:43 | tainted | This path depends on $@. | pupeteer.js:5:28:5:53 | parseTo ... t).name | a user-provided value |
 | tainted-access-paths.js:8:19:8:22 | path | tainted-access-paths.js:6:24:6:30 | req.url | tainted-access-paths.js:8:19:8:22 | path | This path depends on $@. | tainted-access-paths.js:6:24:6:30 | req.url | a user-provided value |
 | tainted-access-paths.js:12:19:12:25 | obj.sub | tainted-access-paths.js:6:24:6:30 | req.url | tainted-access-paths.js:12:19:12:25 | obj.sub | This path depends on $@. | tainted-access-paths.js:6:24:6:30 | req.url | a user-provided value |
 | tainted-access-paths.js:26:19:26:26 | obj.sub3 | tainted-access-paths.js:6:24:6:30 | req.url | tainted-access-paths.js:26:19:26:26 | obj.sub3 | This path depends on $@. | tainted-access-paths.js:6:24:6:30 | req.url | a user-provided value |
diff --git a/javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/my-async-fs-module.js b/javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/my-async-fs-module.js
new file mode 100644
index 00000000000..f39b9a4efe8
--- /dev/null
+++ b/javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/my-async-fs-module.js
@@ -0,0 +1,14 @@
+const fs = require('fs');
+const {promisify} = require('bluebird');
+
+const methods = [
+  'readFile',
+  'writeFile',
+  'readFileSync',
+  'writeFileSync'
+];
+
+module.exports = methods.reduce((obj, method) => {
+  obj[method] = promisify(fs[method]);
+  return obj;
+}, {});
diff --git a/javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/other-fs-libraries.js b/javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/other-fs-libraries.js
index 793cfd53142..14c9e357492 100644
--- a/javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/other-fs-libraries.js
+++ b/javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/other-fs-libraries.js
@@ -41,3 +41,13 @@ http.createServer(function(req, res) {
   require("bluebird").promisify(fs.readFileSync)(path); // NOT OK
   require("bluebird").promisifyAll(fs).readFileSync(path); // NOT OK
 });
+
+
+const asyncFS = require("./my-async-fs-module");
+
+http.createServer(function(req, res) {
+  var path = url.parse(req.url, true).query.path;
+
+  fs.readFileSync(path); // NOT OK
+  asyncFS.readFileSync(path); // NOT OK
+});
diff --git a/javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/pupeteer.js b/javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/pupeteer.js
new file mode 100644
index 00000000000..363b2f014c7
--- /dev/null
+++ b/javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/pupeteer.js
@@ -0,0 +1,18 @@
+const puppeteer = require('puppeteer');
+const parseTorrent = require('parse-torrent');
+
+(async () => {
+    let tainted = "dir/" + parseTorrent(torrent).name + ".torrent.data";
+
+    const browser = await puppeteer.launch();
+    const page = await browser.newPage();
+    await page.pdf({ path: tainted, format: 'a4' });
+
+    const pages = await browser.pages();
+    for (let i = 0; i < something(); i++) {
+        pages[i].screenshot({ path: tainted });
+    }
+
+    await browser.close();
+})();
+
diff --git a/javascript/ql/test/query-tests/Security/CWE-078/UnsafeShellCommandConstruction.expected b/javascript/ql/test/query-tests/Security/CWE-078/UnsafeShellCommandConstruction.expected
index 2d707e1a693..421e24aed71 100644
--- a/javascript/ql/test/query-tests/Security/CWE-078/UnsafeShellCommandConstruction.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-078/UnsafeShellCommandConstruction.expected
@@ -205,6 +205,67 @@ nodes
 | lib/lib.js:405:39:405:42 | name |
 | lib/lib.js:406:22:406:25 | name |
 | lib/lib.js:406:22:406:25 | name |
+| lib/lib.js:414:40:414:43 | name |
+| lib/lib.js:414:40:414:43 | name |
+| lib/lib.js:415:22:415:25 | name |
+| lib/lib.js:415:22:415:25 | name |
+| lib/lib.js:417:28:417:31 | name |
+| lib/lib.js:417:28:417:31 | name |
+| lib/lib.js:418:25:418:28 | name |
+| lib/lib.js:418:25:418:28 | name |
+| lib/lib.js:419:32:419:35 | name |
+| lib/lib.js:419:32:419:35 | name |
+| lib/lib.js:420:29:420:32 | name |
+| lib/lib.js:420:29:420:32 | name |
+| lib/lib.js:424:24:424:27 | name |
+| lib/lib.js:424:24:424:27 | name |
+| lib/lib.js:426:11:426:14 | name |
+| lib/lib.js:426:11:426:14 | name |
+| lib/lib.js:428:28:428:51 | (name ? ... ' : '') |
+| lib/lib.js:428:28:428:57 | (name ? ... ) + '-' |
+| lib/lib.js:428:29:428:50 | name ?  ... :' : '' |
+| lib/lib.js:428:36:428:39 | name |
+| lib/lib.js:428:36:428:45 | name + ':' |
+| lib/lib.js:431:23:431:26 | last |
+| lib/lib.js:436:19:436:22 | last |
+| lib/lib.js:436:19:436:22 | last |
+| lib/lib.js:441:39:441:42 | name |
+| lib/lib.js:441:39:441:42 | name |
+| lib/lib.js:442:24:442:27 | name |
+| lib/lib.js:442:24:442:27 | name |
+| lib/lib.js:446:20:446:23 | name |
+| lib/lib.js:446:20:446:23 | name |
+| lib/lib.js:447:25:447:28 | name |
+| lib/lib.js:447:25:447:28 | name |
+| lib/lib.js:477:33:477:38 | config |
+| lib/lib.js:477:33:477:38 | config |
+| lib/lib.js:478:27:478:32 | config |
+| lib/lib.js:478:27:478:46 | config.installedPath |
+| lib/lib.js:478:27:478:46 | config.installedPath |
+| lib/lib.js:482:40:482:43 | name |
+| lib/lib.js:482:40:482:43 | name |
+| lib/lib.js:483:30:483:33 | name |
+| lib/lib.js:483:30:483:33 | name |
+| lib/subLib2/compiled-file.ts:3:26:3:29 | name |
+| lib/subLib2/compiled-file.ts:3:26:3:29 | name |
+| lib/subLib2/compiled-file.ts:4:25:4:28 | name |
+| lib/subLib2/compiled-file.ts:4:25:4:28 | name |
+| lib/subLib2/special-file.js:3:28:3:31 | name |
+| lib/subLib2/special-file.js:3:28:3:31 | name |
+| lib/subLib2/special-file.js:4:22:4:25 | name |
+| lib/subLib2/special-file.js:4:22:4:25 | name |
+| lib/subLib3/my-file.ts:3:28:3:31 | name |
+| lib/subLib3/my-file.ts:3:28:3:31 | name |
+| lib/subLib3/my-file.ts:4:22:4:25 | name |
+| lib/subLib3/my-file.ts:4:22:4:25 | name |
+| lib/subLib/index.js:3:28:3:31 | name |
+| lib/subLib/index.js:3:28:3:31 | name |
+| lib/subLib/index.js:4:22:4:25 | name |
+| lib/subLib/index.js:4:22:4:25 | name |
+| lib/subLib/index.js:7:32:7:35 | name |
+| lib/subLib/index.js:7:32:7:35 | name |
+| lib/subLib/index.js:8:22:8:25 | name |
+| lib/subLib/index.js:8:22:8:25 | name |
 edges
 | lib/lib2.js:3:28:3:31 | name | lib/lib2.js:4:22:4:25 | name |
 | lib/lib2.js:3:28:3:31 | name | lib/lib2.js:4:22:4:25 | name |
@@ -444,61 +505,151 @@ edges
 | lib/lib.js:405:39:405:42 | name | lib/lib.js:406:22:406:25 | name |
 | lib/lib.js:405:39:405:42 | name | lib/lib.js:406:22:406:25 | name |
 | lib/lib.js:405:39:405:42 | name | lib/lib.js:406:22:406:25 | name |
+| lib/lib.js:414:40:414:43 | name | lib/lib.js:415:22:415:25 | name |
+| lib/lib.js:414:40:414:43 | name | lib/lib.js:415:22:415:25 | name |
+| lib/lib.js:414:40:414:43 | name | lib/lib.js:415:22:415:25 | name |
+| lib/lib.js:414:40:414:43 | name | lib/lib.js:415:22:415:25 | name |
+| lib/lib.js:414:40:414:43 | name | lib/lib.js:417:28:417:31 | name |
+| lib/lib.js:414:40:414:43 | name | lib/lib.js:417:28:417:31 | name |
+| lib/lib.js:414:40:414:43 | name | lib/lib.js:417:28:417:31 | name |
+| lib/lib.js:414:40:414:43 | name | lib/lib.js:417:28:417:31 | name |
+| lib/lib.js:414:40:414:43 | name | lib/lib.js:418:25:418:28 | name |
+| lib/lib.js:414:40:414:43 | name | lib/lib.js:418:25:418:28 | name |
+| lib/lib.js:414:40:414:43 | name | lib/lib.js:418:25:418:28 | name |
+| lib/lib.js:414:40:414:43 | name | lib/lib.js:418:25:418:28 | name |
+| lib/lib.js:414:40:414:43 | name | lib/lib.js:419:32:419:35 | name |
+| lib/lib.js:414:40:414:43 | name | lib/lib.js:419:32:419:35 | name |
+| lib/lib.js:414:40:414:43 | name | lib/lib.js:419:32:419:35 | name |
+| lib/lib.js:414:40:414:43 | name | lib/lib.js:419:32:419:35 | name |
+| lib/lib.js:414:40:414:43 | name | lib/lib.js:420:29:420:32 | name |
+| lib/lib.js:414:40:414:43 | name | lib/lib.js:420:29:420:32 | name |
+| lib/lib.js:414:40:414:43 | name | lib/lib.js:420:29:420:32 | name |
+| lib/lib.js:414:40:414:43 | name | lib/lib.js:420:29:420:32 | name |
+| lib/lib.js:414:40:414:43 | name | lib/lib.js:424:24:424:27 | name |
+| lib/lib.js:414:40:414:43 | name | lib/lib.js:424:24:424:27 | name |
+| lib/lib.js:414:40:414:43 | name | lib/lib.js:424:24:424:27 | name |
+| lib/lib.js:414:40:414:43 | name | lib/lib.js:424:24:424:27 | name |
+| lib/lib.js:414:40:414:43 | name | lib/lib.js:426:11:426:14 | name |
+| lib/lib.js:414:40:414:43 | name | lib/lib.js:426:11:426:14 | name |
+| lib/lib.js:414:40:414:43 | name | lib/lib.js:426:11:426:14 | name |
+| lib/lib.js:414:40:414:43 | name | lib/lib.js:426:11:426:14 | name |
+| lib/lib.js:414:40:414:43 | name | lib/lib.js:428:36:428:39 | name |
+| lib/lib.js:414:40:414:43 | name | lib/lib.js:428:36:428:39 | name |
+| lib/lib.js:428:28:428:51 | (name ? ... ' : '') | lib/lib.js:428:28:428:57 | (name ? ... ) + '-' |
+| lib/lib.js:428:28:428:57 | (name ? ... ) + '-' | lib/lib.js:431:23:431:26 | last |
+| lib/lib.js:428:29:428:50 | name ?  ... :' : '' | lib/lib.js:428:28:428:51 | (name ? ... ' : '') |
+| lib/lib.js:428:36:428:39 | name | lib/lib.js:428:36:428:45 | name + ':' |
+| lib/lib.js:428:36:428:45 | name + ':' | lib/lib.js:428:29:428:50 | name ?  ... :' : '' |
+| lib/lib.js:431:23:431:26 | last | lib/lib.js:436:19:436:22 | last |
+| lib/lib.js:431:23:431:26 | last | lib/lib.js:436:19:436:22 | last |
+| lib/lib.js:441:39:441:42 | name | lib/lib.js:442:24:442:27 | name |
+| lib/lib.js:441:39:441:42 | name | lib/lib.js:442:24:442:27 | name |
+| lib/lib.js:441:39:441:42 | name | lib/lib.js:442:24:442:27 | name |
+| lib/lib.js:441:39:441:42 | name | lib/lib.js:442:24:442:27 | name |
+| lib/lib.js:446:20:446:23 | name | lib/lib.js:447:25:447:28 | name |
+| lib/lib.js:446:20:446:23 | name | lib/lib.js:447:25:447:28 | name |
+| lib/lib.js:446:20:446:23 | name | lib/lib.js:447:25:447:28 | name |
+| lib/lib.js:446:20:446:23 | name | lib/lib.js:447:25:447:28 | name |
+| lib/lib.js:477:33:477:38 | config | lib/lib.js:478:27:478:32 | config |
+| lib/lib.js:477:33:477:38 | config | lib/lib.js:478:27:478:32 | config |
+| lib/lib.js:478:27:478:32 | config | lib/lib.js:478:27:478:46 | config.installedPath |
+| lib/lib.js:478:27:478:32 | config | lib/lib.js:478:27:478:46 | config.installedPath |
+| lib/lib.js:482:40:482:43 | name | lib/lib.js:483:30:483:33 | name |
+| lib/lib.js:482:40:482:43 | name | lib/lib.js:483:30:483:33 | name |
+| lib/lib.js:482:40:482:43 | name | lib/lib.js:483:30:483:33 | name |
+| lib/lib.js:482:40:482:43 | name | lib/lib.js:483:30:483:33 | name |
+| lib/subLib2/compiled-file.ts:3:26:3:29 | name | lib/subLib2/compiled-file.ts:4:25:4:28 | name |
+| lib/subLib2/compiled-file.ts:3:26:3:29 | name | lib/subLib2/compiled-file.ts:4:25:4:28 | name |
+| lib/subLib2/compiled-file.ts:3:26:3:29 | name | lib/subLib2/compiled-file.ts:4:25:4:28 | name |
+| lib/subLib2/compiled-file.ts:3:26:3:29 | name | lib/subLib2/compiled-file.ts:4:25:4:28 | name |
+| lib/subLib2/special-file.js:3:28:3:31 | name | lib/subLib2/special-file.js:4:22:4:25 | name |
+| lib/subLib2/special-file.js:3:28:3:31 | name | lib/subLib2/special-file.js:4:22:4:25 | name |
+| lib/subLib2/special-file.js:3:28:3:31 | name | lib/subLib2/special-file.js:4:22:4:25 | name |
+| lib/subLib2/special-file.js:3:28:3:31 | name | lib/subLib2/special-file.js:4:22:4:25 | name |
+| lib/subLib3/my-file.ts:3:28:3:31 | name | lib/subLib3/my-file.ts:4:22:4:25 | name |
+| lib/subLib3/my-file.ts:3:28:3:31 | name | lib/subLib3/my-file.ts:4:22:4:25 | name |
+| lib/subLib3/my-file.ts:3:28:3:31 | name | lib/subLib3/my-file.ts:4:22:4:25 | name |
+| lib/subLib3/my-file.ts:3:28:3:31 | name | lib/subLib3/my-file.ts:4:22:4:25 | name |
+| lib/subLib/index.js:3:28:3:31 | name | lib/subLib/index.js:4:22:4:25 | name |
+| lib/subLib/index.js:3:28:3:31 | name | lib/subLib/index.js:4:22:4:25 | name |
+| lib/subLib/index.js:3:28:3:31 | name | lib/subLib/index.js:4:22:4:25 | name |
+| lib/subLib/index.js:3:28:3:31 | name | lib/subLib/index.js:4:22:4:25 | name |
+| lib/subLib/index.js:7:32:7:35 | name | lib/subLib/index.js:8:22:8:25 | name |
+| lib/subLib/index.js:7:32:7:35 | name | lib/subLib/index.js:8:22:8:25 | name |
+| lib/subLib/index.js:7:32:7:35 | name | lib/subLib/index.js:8:22:8:25 | name |
+| lib/subLib/index.js:7:32:7:35 | name | lib/subLib/index.js:8:22:8:25 | name |
 #select
-| lib/lib2.js:4:10:4:25 | "rm -rf " + name | lib/lib2.js:3:28:3:31 | name | lib/lib2.js:4:22:4:25 | name | $@ based on library input is later used in $@. | lib/lib2.js:4:10:4:25 | "rm -rf " + name | String concatenation | lib/lib2.js:4:2:4:26 | cp.exec ... + name) | shell command |
-| lib/lib2.js:8:10:8:25 | "rm -rf " + name | lib/lib2.js:7:32:7:35 | name | lib/lib2.js:8:22:8:25 | name | $@ based on library input is later used in $@. | lib/lib2.js:8:10:8:25 | "rm -rf " + name | String concatenation | lib/lib2.js:8:2:8:26 | cp.exec ... + name) | shell command |
-| lib/lib.js:4:10:4:25 | "rm -rf " + name | lib/lib.js:3:28:3:31 | name | lib/lib.js:4:22:4:25 | name | $@ based on library input is later used in $@. | lib/lib.js:4:10:4:25 | "rm -rf " + name | String concatenation | lib/lib.js:4:2:4:26 | cp.exec ... + name) | shell command |
-| lib/lib.js:11:10:11:25 | "rm -rf " + name | lib/lib.js:10:32:10:35 | name | lib/lib.js:11:22:11:25 | name | $@ based on library input is later used in $@. | lib/lib.js:11:10:11:25 | "rm -rf " + name | String concatenation | lib/lib.js:11:2:11:26 | cp.exec ... + name) | shell command |
-| lib/lib.js:15:10:15:25 | "rm -rf " + name | lib/lib.js:14:36:14:39 | name | lib/lib.js:15:22:15:25 | name | $@ based on library input is later used in $@. | lib/lib.js:15:10:15:25 | "rm -rf " + name | String concatenation | lib/lib.js:15:2:15:26 | cp.exec ... + name) | shell command |
-| lib/lib.js:20:10:20:25 | "rm -rf " + name | lib/lib.js:19:34:19:37 | name | lib/lib.js:20:22:20:25 | name | $@ based on library input is later used in $@. | lib/lib.js:20:10:20:25 | "rm -rf " + name | String concatenation | lib/lib.js:20:2:20:26 | cp.exec ... + name) | shell command |
-| lib/lib.js:27:10:27:25 | "rm -rf " + name | lib/lib.js:26:35:26:38 | name | lib/lib.js:27:22:27:25 | name | $@ based on library input is later used in $@. | lib/lib.js:27:10:27:25 | "rm -rf " + name | String concatenation | lib/lib.js:27:2:27:26 | cp.exec ... + name) | shell command |
-| lib/lib.js:35:11:35:26 | "rm -rf " + name | lib/lib.js:34:14:34:17 | name | lib/lib.js:35:23:35:26 | name | $@ based on library input is later used in $@. | lib/lib.js:35:11:35:26 | "rm -rf " + name | String concatenation | lib/lib.js:35:3:35:27 | cp.exec ... + name) | shell command |
-| lib/lib.js:38:11:38:26 | "rm -rf " + name | lib/lib.js:37:13:37:16 | name | lib/lib.js:38:23:38:26 | name | $@ based on library input is later used in $@. | lib/lib.js:38:11:38:26 | "rm -rf " + name | String concatenation | lib/lib.js:38:3:38:27 | cp.exec ... + name) | shell command |
-| lib/lib.js:41:11:41:26 | "rm -rf " + name | lib/lib.js:40:6:40:9 | name | lib/lib.js:41:23:41:26 | name | $@ based on library input is later used in $@. | lib/lib.js:41:11:41:26 | "rm -rf " + name | String concatenation | lib/lib.js:41:3:41:27 | cp.exec ... + name) | shell command |
-| lib/lib.js:50:35:50:50 | "rm -rf " + name | lib/lib.js:49:31:49:34 | name | lib/lib.js:50:47:50:50 | name | $@ based on library input is later used in $@. | lib/lib.js:50:35:50:50 | "rm -rf " + name | String concatenation | lib/lib.js:50:2:50:51 | require ... + name) | shell command |
-| lib/lib.js:54:13:54:28 | "rm -rf " + name | lib/lib.js:53:33:53:36 | name | lib/lib.js:54:25:54:28 | name | $@ based on library input is later used in $@. | lib/lib.js:54:13:54:28 | "rm -rf " + name | String concatenation | lib/lib.js:55:2:55:14 | cp.exec(cmd1) | shell command |
-| lib/lib.js:57:13:57:28 | "rm -rf " + name | lib/lib.js:53:33:53:36 | name | lib/lib.js:57:25:57:28 | name | $@ based on library input is later used in $@. | lib/lib.js:57:13:57:28 | "rm -rf " + name | String concatenation | lib/lib.js:59:3:59:14 | cp.exec(cmd) | shell command |
-| lib/lib.js:65:10:65:25 | "rm -rf " + name | lib/lib.js:64:41:64:44 | name | lib/lib.js:65:22:65:25 | name | $@ based on library input is later used in $@. | lib/lib.js:65:10:65:25 | "rm -rf " + name | String concatenation | lib/lib.js:65:2:65:26 | cp.exec ... + name) | shell command |
-| lib/lib.js:71:10:71:31 | "cat /f ...  + name | lib/lib.js:64:41:64:44 | name | lib/lib.js:71:28:71:31 | name | $@ based on library input is later used in $@. | lib/lib.js:71:10:71:31 | "cat /f ...  + name | String concatenation | lib/lib.js:71:2:71:32 | cp.exec ... + name) | shell command |
-| lib/lib.js:73:10:73:31 | "cat \\" ...  + "\\"" | lib/lib.js:64:41:64:44 | name | lib/lib.js:73:21:73:24 | name | $@ based on library input is later used in $@. | lib/lib.js:73:10:73:31 | "cat \\" ...  + "\\"" | String concatenation | lib/lib.js:73:2:73:32 | cp.exec ... + "\\"") | shell command |
-| lib/lib.js:75:10:75:29 | "cat '" + name + "'" | lib/lib.js:64:41:64:44 | name | lib/lib.js:75:20:75:23 | name | $@ based on library input is later used in $@. | lib/lib.js:75:10:75:29 | "cat '" + name + "'" | String concatenation | lib/lib.js:75:2:75:30 | cp.exec ...  + "'") | shell command |
-| lib/lib.js:77:10:77:37 | "cat '/ ... e + "'" | lib/lib.js:64:41:64:44 | name | lib/lib.js:77:28:77:31 | name | $@ based on library input is later used in $@. | lib/lib.js:77:10:77:37 | "cat '/ ... e + "'" | String concatenation | lib/lib.js:77:2:77:38 | cp.exec ...  + "'") | shell command |
-| lib/lib.js:83:10:83:25 | "rm -rf " + name | lib/lib.js:82:35:82:38 | name | lib/lib.js:83:22:83:25 | name | $@ based on library input is later used in $@. | lib/lib.js:83:10:83:25 | "rm -rf " + name | String concatenation | lib/lib.js:83:2:83:26 | cp.exec ... + name) | shell command |
-| lib/lib.js:86:13:86:16 | name | lib/lib.js:82:35:82:38 | name | lib/lib.js:86:13:86:16 | name | $@ based on library input is later used in $@. | lib/lib.js:86:13:86:16 | name | Array element | lib/lib.js:87:2:87:25 | cp.exec ... n(" ")) | shell command |
-| lib/lib.js:89:21:89:24 | name | lib/lib.js:82:35:82:38 | name | lib/lib.js:89:21:89:24 | name | $@ based on library input is later used in $@. | lib/lib.js:89:21:89:24 | name | Array element | lib/lib.js:89:2:89:36 | cp.exec ... n(" ")) | shell command |
-| lib/lib.js:91:21:91:38 | "\\"" + name + "\\"" | lib/lib.js:82:35:82:38 | name | lib/lib.js:91:21:91:38 | "\\"" + name + "\\"" | $@ based on library input is later used in $@. | lib/lib.js:91:21:91:38 | "\\"" + name + "\\"" | Array element | lib/lib.js:91:2:91:50 | cp.exec ... n(" ")) | shell command |
-| lib/lib.js:98:35:98:38 | name | lib/lib.js:97:35:97:38 | name | lib/lib.js:98:35:98:38 | name | $@ based on library input is later used in $@. | lib/lib.js:98:35:98:38 | name | Formatted string | lib/lib.js:98:2:98:40 | cp.exec ...  name)) | shell command |
-| lib/lib.js:100:37:100:40 | name | lib/lib.js:97:35:97:38 | name | lib/lib.js:100:37:100:40 | name | $@ based on library input is later used in $@. | lib/lib.js:100:37:100:40 | name | Formatted string | lib/lib.js:100:2:100:42 | cp.exec ...  name)) | shell command |
-| lib/lib.js:102:46:102:49 | name | lib/lib.js:97:35:97:38 | name | lib/lib.js:102:46:102:49 | name | $@ based on library input is later used in $@. | lib/lib.js:102:46:102:49 | name | Formatted string | lib/lib.js:102:2:102:51 | cp.exec ...  name)) | shell command |
-| lib/lib.js:108:41:108:44 | name | lib/lib.js:97:35:97:38 | name | lib/lib.js:108:41:108:44 | name | $@ based on library input is later used in $@. | lib/lib.js:108:41:108:44 | name | Formatted string | lib/lib.js:108:2:108:46 | cp.exec ...  name)) | shell command |
-| lib/lib.js:112:10:112:25 | "rm -rf " + name | lib/lib.js:111:34:111:37 | name | lib/lib.js:112:22:112:25 | name | $@ based on library input is later used in $@. | lib/lib.js:112:10:112:25 | "rm -rf " + name | String concatenation | lib/lib.js:112:2:112:26 | cp.exec ... + name) | shell command |
-| lib/lib.js:121:10:121:25 | "rm -rf " + name | lib/lib.js:120:33:120:36 | name | lib/lib.js:121:22:121:25 | name | $@ based on library input is later used in $@. | lib/lib.js:121:10:121:25 | "rm -rf " + name | String concatenation | lib/lib.js:121:2:121:26 | cp.exec ... + name) | shell command |
-| lib/lib.js:131:11:131:26 | "rm -rf " + name | lib/lib.js:130:6:130:9 | name | lib/lib.js:131:23:131:26 | name | $@ based on library input is later used in $@. | lib/lib.js:131:11:131:26 | "rm -rf " + name | String concatenation | lib/lib.js:131:3:131:27 | cp.exec ... + name) | shell command |
-| lib/lib.js:149:12:149:27 | "rm -rf " + name | lib/lib.js:148:37:148:40 | name | lib/lib.js:149:24:149:27 | name | $@ based on library input is later used in $@. | lib/lib.js:149:12:149:27 | "rm -rf " + name | String concatenation | lib/lib.js:152:2:152:23 | cp.spaw ... gs, cb) | shell command |
-| lib/lib.js:161:13:161:28 | "rm -rf " + name | lib/lib.js:155:38:155:41 | name | lib/lib.js:161:25:161:28 | name | $@ based on library input is later used in $@. | lib/lib.js:161:13:161:28 | "rm -rf " + name | String concatenation | lib/lib.js:163:2:167:2 | cp.spaw ... t' }\\n\\t) | shell command |
-| lib/lib.js:173:10:173:23 | "fo \| " + name | lib/lib.js:170:41:170:44 | name | lib/lib.js:173:20:173:23 | name | $@ based on library input is later used in $@. | lib/lib.js:173:10:173:23 | "fo \| " + name | String concatenation | lib/lib.js:173:2:173:24 | cp.exec ... + name) | shell command |
-| lib/lib.js:182:10:182:27 | "rm -rf " + broken | lib/lib.js:177:38:177:41 | name | lib/lib.js:182:22:182:27 | broken | $@ based on library input is later used in $@. | lib/lib.js:182:10:182:27 | "rm -rf " + broken | String concatenation | lib/lib.js:182:2:182:28 | cp.exec ... broken) | shell command |
-| lib/lib.js:187:10:187:25 | "rm -rf " + name | lib/lib.js:186:34:186:37 | name | lib/lib.js:187:22:187:25 | name | $@ based on library input is later used in $@. | lib/lib.js:187:10:187:25 | "rm -rf " + name | String concatenation | lib/lib.js:187:2:187:26 | cp.exec ... + name) | shell command |
-| lib/lib.js:190:11:190:26 | "rm -rf " + name | lib/lib.js:186:34:186:37 | name | lib/lib.js:190:23:190:26 | name | $@ based on library input is later used in $@. | lib/lib.js:190:11:190:26 | "rm -rf " + name | String concatenation | lib/lib.js:190:3:190:27 | cp.exec ... + name) | shell command |
-| lib/lib.js:197:10:197:25 | "rm -rf " + name | lib/lib.js:196:45:196:48 | name | lib/lib.js:197:22:197:25 | name | $@ based on library input is later used in $@. | lib/lib.js:197:10:197:25 | "rm -rf " + name | String concatenation | lib/lib.js:197:2:197:26 | cp.exec ... + name) | shell command |
-| lib/lib.js:200:11:200:26 | "rm -rf " + name | lib/lib.js:196:45:196:48 | name | lib/lib.js:200:23:200:26 | name | $@ based on library input is later used in $@. | lib/lib.js:200:11:200:26 | "rm -rf " + name | String concatenation | lib/lib.js:200:3:200:27 | cp.exec ... + name) | shell command |
-| lib/lib.js:207:10:207:25 | "rm -rf " + name | lib/lib.js:206:45:206:48 | name | lib/lib.js:207:22:207:25 | name | $@ based on library input is later used in $@. | lib/lib.js:207:10:207:25 | "rm -rf " + name | String concatenation | lib/lib.js:207:2:207:26 | cp.exec ... + name) | shell command |
-| lib/lib.js:212:11:212:26 | "rm -rf " + name | lib/lib.js:206:45:206:48 | name | lib/lib.js:212:23:212:26 | name | $@ based on library input is later used in $@. | lib/lib.js:212:11:212:26 | "rm -rf " + name | String concatenation | lib/lib.js:212:3:212:27 | cp.exec ... + name) | shell command |
-| lib/lib.js:217:10:217:25 | "rm -rf " + name | lib/lib.js:216:39:216:42 | name | lib/lib.js:217:22:217:25 | name | $@ based on library input is later used in $@. | lib/lib.js:217:10:217:25 | "rm -rf " + name | String concatenation | lib/lib.js:217:2:217:26 | cp.exec ... + name) | shell command |
-| lib/lib.js:220:11:220:26 | "rm -rf " + name | lib/lib.js:216:39:216:42 | name | lib/lib.js:220:23:220:26 | name | $@ based on library input is later used in $@. | lib/lib.js:220:11:220:26 | "rm -rf " + name | String concatenation | lib/lib.js:220:3:220:27 | cp.exec ... + name) | shell command |
-| lib/lib.js:224:10:224:25 | "rm -rf " + name | lib/lib.js:216:39:216:42 | name | lib/lib.js:224:22:224:25 | name | $@ based on library input is later used in $@. | lib/lib.js:224:10:224:25 | "rm -rf " + name | String concatenation | lib/lib.js:224:2:224:26 | cp.exec ... + name) | shell command |
-| lib/lib.js:228:10:228:25 | "rm -rf " + name | lib/lib.js:227:39:227:42 | name | lib/lib.js:228:22:228:25 | name | $@ based on library input is later used in $@. | lib/lib.js:228:10:228:25 | "rm -rf " + name | String concatenation | lib/lib.js:228:2:228:26 | cp.exec ... + name) | shell command |
-| lib/lib.js:236:10:236:25 | "rm -rf " + name | lib/lib.js:227:39:227:42 | name | lib/lib.js:236:22:236:25 | name | $@ based on library input is later used in $@. | lib/lib.js:236:10:236:25 | "rm -rf " + name | String concatenation | lib/lib.js:236:2:236:26 | cp.exec ... + name) | shell command |
-| lib/lib.js:249:10:249:25 | "rm -rf " + name | lib/lib.js:248:42:248:45 | name | lib/lib.js:249:22:249:25 | name | $@ based on library input is later used in $@. | lib/lib.js:249:10:249:25 | "rm -rf " + name | String concatenation | lib/lib.js:249:2:249:26 | cp.exec ... + name) | shell command |
-| lib/lib.js:258:10:258:25 | "rm -rf " + name | lib/lib.js:257:35:257:38 | name | lib/lib.js:258:22:258:25 | name | $@ based on library input is later used in $@. | lib/lib.js:258:10:258:25 | "rm -rf " + name | String concatenation | lib/lib.js:258:2:258:26 | cp.exec ... + name) | shell command |
-| lib/lib.js:261:11:261:33 | "rm -rf ...  + name | lib/lib.js:257:35:257:38 | name | lib/lib.js:261:30:261:33 | name | $@ based on library input is later used in $@. | lib/lib.js:261:11:261:33 | "rm -rf ...  + name | String concatenation | lib/lib.js:261:3:261:34 | cp.exec ... + name) | shell command |
-| lib/lib.js:268:10:268:32 | "rm -rf ... version | lib/lib.js:267:46:267:48 | obj | lib/lib.js:268:22:268:32 | obj.version | $@ based on library input is later used in $@. | lib/lib.js:268:10:268:32 | "rm -rf ... version | String concatenation | lib/lib.js:268:2:268:33 | cp.exec ... ersion) | shell command |
-| lib/lib.js:277:11:277:30 | "rm -rf " + opts.bla | lib/lib.js:276:8:276:11 | opts | lib/lib.js:277:23:277:30 | opts.bla | $@ based on library input is later used in $@. | lib/lib.js:277:11:277:30 | "rm -rf " + opts.bla | String concatenation | lib/lib.js:277:3:277:31 | cp.exec ... ts.bla) | shell command |
-| lib/lib.js:308:11:308:26 | "rm -rf " + name | lib/lib.js:307:39:307:42 | name | lib/lib.js:308:23:308:26 | name | $@ based on library input is later used in $@. | lib/lib.js:308:11:308:26 | "rm -rf " + name | String concatenation | lib/lib.js:308:3:308:27 | cp.exec ... + name) | shell command |
-| lib/lib.js:315:10:315:25 | "rm -rf " + name | lib/lib.js:314:40:314:43 | name | lib/lib.js:315:22:315:25 | name | $@ based on library input is later used in $@. | lib/lib.js:315:10:315:25 | "rm -rf " + name | String concatenation | lib/lib.js:315:2:315:26 | cp.exec ... + name) | shell command |
-| lib/lib.js:320:11:320:26 | "rm -rf " + name | lib/lib.js:314:40:314:43 | name | lib/lib.js:320:23:320:26 | name | $@ based on library input is later used in $@. | lib/lib.js:320:11:320:26 | "rm -rf " + name | String concatenation | lib/lib.js:320:3:320:27 | cp.exec ... + name) | shell command |
-| lib/lib.js:325:12:325:51 | "MyWind ... " + arg | lib/lib.js:324:40:324:42 | arg | lib/lib.js:325:49:325:51 | arg | $@ based on library input is later used in $@. | lib/lib.js:325:12:325:51 | "MyWind ... " + arg | String concatenation | lib/lib.js:326:2:326:13 | cp.exec(cmd) | shell command |
-| lib/lib.js:340:10:340:26 | "rm -rf " + id(n) | lib/lib.js:339:39:339:39 | n | lib/lib.js:340:22:340:26 | id(n) | $@ based on library input is later used in $@. | lib/lib.js:340:10:340:26 | "rm -rf " + id(n) | String concatenation | lib/lib.js:340:2:340:27 | cp.exec ...  id(n)) | shell command |
-| lib/lib.js:351:10:351:27 | "rm -rf " + unsafe | lib/lib.js:349:29:349:34 | unsafe | lib/lib.js:351:22:351:27 | unsafe | $@ based on library input is later used in $@. | lib/lib.js:351:10:351:27 | "rm -rf " + unsafe | String concatenation | lib/lib.js:351:2:351:28 | cp.exec ... unsafe) | shell command |
-| lib/lib.js:366:17:366:56 | "learn  ... + model | lib/lib.js:360:20:360:23 | opts | lib/lib.js:366:28:366:42 | this.learn_args | $@ based on library input is later used in $@. | lib/lib.js:366:17:366:56 | "learn  ... + model | String concatenation | lib/lib.js:367:3:367:18 | cp.exec(command) | shell command |
-| lib/lib.js:406:10:406:25 | "rm -rf " + name | lib/lib.js:405:39:405:42 | name | lib/lib.js:406:22:406:25 | name | $@ based on library input is later used in $@. | lib/lib.js:406:10:406:25 | "rm -rf " + name | String concatenation | lib/lib.js:406:2:406:26 | cp.exec ... + name) | shell command |
+| lib/lib2.js:4:10:4:25 | "rm -rf " + name | lib/lib2.js:3:28:3:31 | name | lib/lib2.js:4:22:4:25 | name | $@ based on $@ is later used in $@. | lib/lib2.js:4:10:4:25 | "rm -rf " + name | String concatenation | lib/lib2.js:3:28:3:31 | name | library input | lib/lib2.js:4:2:4:26 | cp.exec ... + name) | shell command |
+| lib/lib2.js:8:10:8:25 | "rm -rf " + name | lib/lib2.js:7:32:7:35 | name | lib/lib2.js:8:22:8:25 | name | $@ based on $@ is later used in $@. | lib/lib2.js:8:10:8:25 | "rm -rf " + name | String concatenation | lib/lib2.js:7:32:7:35 | name | library input | lib/lib2.js:8:2:8:26 | cp.exec ... + name) | shell command |
+| lib/lib.js:4:10:4:25 | "rm -rf " + name | lib/lib.js:3:28:3:31 | name | lib/lib.js:4:22:4:25 | name | $@ based on $@ is later used in $@. | lib/lib.js:4:10:4:25 | "rm -rf " + name | String concatenation | lib/lib.js:3:28:3:31 | name | library input | lib/lib.js:4:2:4:26 | cp.exec ... + name) | shell command |
+| lib/lib.js:11:10:11:25 | "rm -rf " + name | lib/lib.js:10:32:10:35 | name | lib/lib.js:11:22:11:25 | name | $@ based on $@ is later used in $@. | lib/lib.js:11:10:11:25 | "rm -rf " + name | String concatenation | lib/lib.js:10:32:10:35 | name | library input | lib/lib.js:11:2:11:26 | cp.exec ... + name) | shell command |
+| lib/lib.js:15:10:15:25 | "rm -rf " + name | lib/lib.js:14:36:14:39 | name | lib/lib.js:15:22:15:25 | name | $@ based on $@ is later used in $@. | lib/lib.js:15:10:15:25 | "rm -rf " + name | String concatenation | lib/lib.js:14:36:14:39 | name | library input | lib/lib.js:15:2:15:26 | cp.exec ... + name) | shell command |
+| lib/lib.js:20:10:20:25 | "rm -rf " + name | lib/lib.js:19:34:19:37 | name | lib/lib.js:20:22:20:25 | name | $@ based on $@ is later used in $@. | lib/lib.js:20:10:20:25 | "rm -rf " + name | String concatenation | lib/lib.js:19:34:19:37 | name | library input | lib/lib.js:20:2:20:26 | cp.exec ... + name) | shell command |
+| lib/lib.js:27:10:27:25 | "rm -rf " + name | lib/lib.js:26:35:26:38 | name | lib/lib.js:27:22:27:25 | name | $@ based on $@ is later used in $@. | lib/lib.js:27:10:27:25 | "rm -rf " + name | String concatenation | lib/lib.js:26:35:26:38 | name | library input | lib/lib.js:27:2:27:26 | cp.exec ... + name) | shell command |
+| lib/lib.js:35:11:35:26 | "rm -rf " + name | lib/lib.js:34:14:34:17 | name | lib/lib.js:35:23:35:26 | name | $@ based on $@ is later used in $@. | lib/lib.js:35:11:35:26 | "rm -rf " + name | String concatenation | lib/lib.js:34:14:34:17 | name | library input | lib/lib.js:35:3:35:27 | cp.exec ... + name) | shell command |
+| lib/lib.js:38:11:38:26 | "rm -rf " + name | lib/lib.js:37:13:37:16 | name | lib/lib.js:38:23:38:26 | name | $@ based on $@ is later used in $@. | lib/lib.js:38:11:38:26 | "rm -rf " + name | String concatenation | lib/lib.js:37:13:37:16 | name | library input | lib/lib.js:38:3:38:27 | cp.exec ... + name) | shell command |
+| lib/lib.js:41:11:41:26 | "rm -rf " + name | lib/lib.js:40:6:40:9 | name | lib/lib.js:41:23:41:26 | name | $@ based on $@ is later used in $@. | lib/lib.js:41:11:41:26 | "rm -rf " + name | String concatenation | lib/lib.js:40:6:40:9 | name | library input | lib/lib.js:41:3:41:27 | cp.exec ... + name) | shell command |
+| lib/lib.js:50:35:50:50 | "rm -rf " + name | lib/lib.js:49:31:49:34 | name | lib/lib.js:50:47:50:50 | name | $@ based on $@ is later used in $@. | lib/lib.js:50:35:50:50 | "rm -rf " + name | String concatenation | lib/lib.js:49:31:49:34 | name | library input | lib/lib.js:50:2:50:51 | require ... + name) | shell command |
+| lib/lib.js:54:13:54:28 | "rm -rf " + name | lib/lib.js:53:33:53:36 | name | lib/lib.js:54:25:54:28 | name | $@ based on $@ is later used in $@. | lib/lib.js:54:13:54:28 | "rm -rf " + name | String concatenation | lib/lib.js:53:33:53:36 | name | library input | lib/lib.js:55:2:55:14 | cp.exec(cmd1) | shell command |
+| lib/lib.js:57:13:57:28 | "rm -rf " + name | lib/lib.js:53:33:53:36 | name | lib/lib.js:57:25:57:28 | name | $@ based on $@ is later used in $@. | lib/lib.js:57:13:57:28 | "rm -rf " + name | String concatenation | lib/lib.js:53:33:53:36 | name | library input | lib/lib.js:59:3:59:14 | cp.exec(cmd) | shell command |
+| lib/lib.js:65:10:65:25 | "rm -rf " + name | lib/lib.js:64:41:64:44 | name | lib/lib.js:65:22:65:25 | name | $@ based on $@ is later used in $@. | lib/lib.js:65:10:65:25 | "rm -rf " + name | String concatenation | lib/lib.js:64:41:64:44 | name | library input | lib/lib.js:65:2:65:26 | cp.exec ... + name) | shell command |
+| lib/lib.js:71:10:71:31 | "cat /f ...  + name | lib/lib.js:64:41:64:44 | name | lib/lib.js:71:28:71:31 | name | $@ based on $@ is later used in $@. | lib/lib.js:71:10:71:31 | "cat /f ...  + name | String concatenation | lib/lib.js:64:41:64:44 | name | library input | lib/lib.js:71:2:71:32 | cp.exec ... + name) | shell command |
+| lib/lib.js:73:10:73:31 | "cat \\" ...  + "\\"" | lib/lib.js:64:41:64:44 | name | lib/lib.js:73:21:73:24 | name | $@ based on $@ is later used in $@. | lib/lib.js:73:10:73:31 | "cat \\" ...  + "\\"" | String concatenation | lib/lib.js:64:41:64:44 | name | library input | lib/lib.js:73:2:73:32 | cp.exec ... + "\\"") | shell command |
+| lib/lib.js:75:10:75:29 | "cat '" + name + "'" | lib/lib.js:64:41:64:44 | name | lib/lib.js:75:20:75:23 | name | $@ based on $@ is later used in $@. | lib/lib.js:75:10:75:29 | "cat '" + name + "'" | String concatenation | lib/lib.js:64:41:64:44 | name | library input | lib/lib.js:75:2:75:30 | cp.exec ...  + "'") | shell command |
+| lib/lib.js:77:10:77:37 | "cat '/ ... e + "'" | lib/lib.js:64:41:64:44 | name | lib/lib.js:77:28:77:31 | name | $@ based on $@ is later used in $@. | lib/lib.js:77:10:77:37 | "cat '/ ... e + "'" | String concatenation | lib/lib.js:64:41:64:44 | name | library input | lib/lib.js:77:2:77:38 | cp.exec ...  + "'") | shell command |
+| lib/lib.js:83:10:83:25 | "rm -rf " + name | lib/lib.js:82:35:82:38 | name | lib/lib.js:83:22:83:25 | name | $@ based on $@ is later used in $@. | lib/lib.js:83:10:83:25 | "rm -rf " + name | String concatenation | lib/lib.js:82:35:82:38 | name | library input | lib/lib.js:83:2:83:26 | cp.exec ... + name) | shell command |
+| lib/lib.js:86:13:86:16 | name | lib/lib.js:82:35:82:38 | name | lib/lib.js:86:13:86:16 | name | $@ based on $@ is later used in $@. | lib/lib.js:86:13:86:16 | name | Array element | lib/lib.js:82:35:82:38 | name | library input | lib/lib.js:87:2:87:25 | cp.exec ... n(" ")) | shell command |
+| lib/lib.js:89:21:89:24 | name | lib/lib.js:82:35:82:38 | name | lib/lib.js:89:21:89:24 | name | $@ based on $@ is later used in $@. | lib/lib.js:89:21:89:24 | name | Array element | lib/lib.js:82:35:82:38 | name | library input | lib/lib.js:89:2:89:36 | cp.exec ... n(" ")) | shell command |
+| lib/lib.js:91:21:91:38 | "\\"" + name + "\\"" | lib/lib.js:82:35:82:38 | name | lib/lib.js:91:21:91:38 | "\\"" + name + "\\"" | $@ based on $@ is later used in $@. | lib/lib.js:91:21:91:38 | "\\"" + name + "\\"" | Array element | lib/lib.js:82:35:82:38 | name | library input | lib/lib.js:91:2:91:50 | cp.exec ... n(" ")) | shell command |
+| lib/lib.js:98:35:98:38 | name | lib/lib.js:97:35:97:38 | name | lib/lib.js:98:35:98:38 | name | $@ based on $@ is later used in $@. | lib/lib.js:98:35:98:38 | name | Formatted string | lib/lib.js:97:35:97:38 | name | library input | lib/lib.js:98:2:98:40 | cp.exec ...  name)) | shell command |
+| lib/lib.js:100:37:100:40 | name | lib/lib.js:97:35:97:38 | name | lib/lib.js:100:37:100:40 | name | $@ based on $@ is later used in $@. | lib/lib.js:100:37:100:40 | name | Formatted string | lib/lib.js:97:35:97:38 | name | library input | lib/lib.js:100:2:100:42 | cp.exec ...  name)) | shell command |
+| lib/lib.js:102:46:102:49 | name | lib/lib.js:97:35:97:38 | name | lib/lib.js:102:46:102:49 | name | $@ based on $@ is later used in $@. | lib/lib.js:102:46:102:49 | name | Formatted string | lib/lib.js:97:35:97:38 | name | library input | lib/lib.js:102:2:102:51 | cp.exec ...  name)) | shell command |
+| lib/lib.js:108:41:108:44 | name | lib/lib.js:97:35:97:38 | name | lib/lib.js:108:41:108:44 | name | $@ based on $@ is later used in $@. | lib/lib.js:108:41:108:44 | name | Formatted string | lib/lib.js:97:35:97:38 | name | library input | lib/lib.js:108:2:108:46 | cp.exec ...  name)) | shell command |
+| lib/lib.js:112:10:112:25 | "rm -rf " + name | lib/lib.js:111:34:111:37 | name | lib/lib.js:112:22:112:25 | name | $@ based on $@ is later used in $@. | lib/lib.js:112:10:112:25 | "rm -rf " + name | String concatenation | lib/lib.js:111:34:111:37 | name | library input | lib/lib.js:112:2:112:26 | cp.exec ... + name) | shell command |
+| lib/lib.js:121:10:121:25 | "rm -rf " + name | lib/lib.js:120:33:120:36 | name | lib/lib.js:121:22:121:25 | name | $@ based on $@ is later used in $@. | lib/lib.js:121:10:121:25 | "rm -rf " + name | String concatenation | lib/lib.js:120:33:120:36 | name | library input | lib/lib.js:121:2:121:26 | cp.exec ... + name) | shell command |
+| lib/lib.js:131:11:131:26 | "rm -rf " + name | lib/lib.js:130:6:130:9 | name | lib/lib.js:131:23:131:26 | name | $@ based on $@ is later used in $@. | lib/lib.js:131:11:131:26 | "rm -rf " + name | String concatenation | lib/lib.js:130:6:130:9 | name | library input | lib/lib.js:131:3:131:27 | cp.exec ... + name) | shell command |
+| lib/lib.js:149:12:149:27 | "rm -rf " + name | lib/lib.js:148:37:148:40 | name | lib/lib.js:149:24:149:27 | name | $@ based on $@ is later used in $@. | lib/lib.js:149:12:149:27 | "rm -rf " + name | String concatenation | lib/lib.js:148:37:148:40 | name | library input | lib/lib.js:152:2:152:23 | cp.spaw ... gs, cb) | shell command |
+| lib/lib.js:161:13:161:28 | "rm -rf " + name | lib/lib.js:155:38:155:41 | name | lib/lib.js:161:25:161:28 | name | $@ based on $@ is later used in $@. | lib/lib.js:161:13:161:28 | "rm -rf " + name | String concatenation | lib/lib.js:155:38:155:41 | name | library input | lib/lib.js:163:2:167:2 | cp.spaw ... t' }\\n\\t) | shell command |
+| lib/lib.js:173:10:173:23 | "fo \| " + name | lib/lib.js:170:41:170:44 | name | lib/lib.js:173:20:173:23 | name | $@ based on $@ is later used in $@. | lib/lib.js:173:10:173:23 | "fo \| " + name | String concatenation | lib/lib.js:170:41:170:44 | name | library input | lib/lib.js:173:2:173:24 | cp.exec ... + name) | shell command |
+| lib/lib.js:182:10:182:27 | "rm -rf " + broken | lib/lib.js:177:38:177:41 | name | lib/lib.js:182:22:182:27 | broken | $@ based on $@ is later used in $@. | lib/lib.js:182:10:182:27 | "rm -rf " + broken | String concatenation | lib/lib.js:177:38:177:41 | name | library input | lib/lib.js:182:2:182:28 | cp.exec ... broken) | shell command |
+| lib/lib.js:187:10:187:25 | "rm -rf " + name | lib/lib.js:186:34:186:37 | name | lib/lib.js:187:22:187:25 | name | $@ based on $@ is later used in $@. | lib/lib.js:187:10:187:25 | "rm -rf " + name | String concatenation | lib/lib.js:186:34:186:37 | name | library input | lib/lib.js:187:2:187:26 | cp.exec ... + name) | shell command |
+| lib/lib.js:190:11:190:26 | "rm -rf " + name | lib/lib.js:186:34:186:37 | name | lib/lib.js:190:23:190:26 | name | $@ based on $@ is later used in $@. | lib/lib.js:190:11:190:26 | "rm -rf " + name | String concatenation | lib/lib.js:186:34:186:37 | name | library input | lib/lib.js:190:3:190:27 | cp.exec ... + name) | shell command |
+| lib/lib.js:197:10:197:25 | "rm -rf " + name | lib/lib.js:196:45:196:48 | name | lib/lib.js:197:22:197:25 | name | $@ based on $@ is later used in $@. | lib/lib.js:197:10:197:25 | "rm -rf " + name | String concatenation | lib/lib.js:196:45:196:48 | name | library input | lib/lib.js:197:2:197:26 | cp.exec ... + name) | shell command |
+| lib/lib.js:200:11:200:26 | "rm -rf " + name | lib/lib.js:196:45:196:48 | name | lib/lib.js:200:23:200:26 | name | $@ based on $@ is later used in $@. | lib/lib.js:200:11:200:26 | "rm -rf " + name | String concatenation | lib/lib.js:196:45:196:48 | name | library input | lib/lib.js:200:3:200:27 | cp.exec ... + name) | shell command |
+| lib/lib.js:207:10:207:25 | "rm -rf " + name | lib/lib.js:206:45:206:48 | name | lib/lib.js:207:22:207:25 | name | $@ based on $@ is later used in $@. | lib/lib.js:207:10:207:25 | "rm -rf " + name | String concatenation | lib/lib.js:206:45:206:48 | name | library input | lib/lib.js:207:2:207:26 | cp.exec ... + name) | shell command |
+| lib/lib.js:212:11:212:26 | "rm -rf " + name | lib/lib.js:206:45:206:48 | name | lib/lib.js:212:23:212:26 | name | $@ based on $@ is later used in $@. | lib/lib.js:212:11:212:26 | "rm -rf " + name | String concatenation | lib/lib.js:206:45:206:48 | name | library input | lib/lib.js:212:3:212:27 | cp.exec ... + name) | shell command |
+| lib/lib.js:217:10:217:25 | "rm -rf " + name | lib/lib.js:216:39:216:42 | name | lib/lib.js:217:22:217:25 | name | $@ based on $@ is later used in $@. | lib/lib.js:217:10:217:25 | "rm -rf " + name | String concatenation | lib/lib.js:216:39:216:42 | name | library input | lib/lib.js:217:2:217:26 | cp.exec ... + name) | shell command |
+| lib/lib.js:220:11:220:26 | "rm -rf " + name | lib/lib.js:216:39:216:42 | name | lib/lib.js:220:23:220:26 | name | $@ based on $@ is later used in $@. | lib/lib.js:220:11:220:26 | "rm -rf " + name | String concatenation | lib/lib.js:216:39:216:42 | name | library input | lib/lib.js:220:3:220:27 | cp.exec ... + name) | shell command |
+| lib/lib.js:224:10:224:25 | "rm -rf " + name | lib/lib.js:216:39:216:42 | name | lib/lib.js:224:22:224:25 | name | $@ based on $@ is later used in $@. | lib/lib.js:224:10:224:25 | "rm -rf " + name | String concatenation | lib/lib.js:216:39:216:42 | name | library input | lib/lib.js:224:2:224:26 | cp.exec ... + name) | shell command |
+| lib/lib.js:228:10:228:25 | "rm -rf " + name | lib/lib.js:227:39:227:42 | name | lib/lib.js:228:22:228:25 | name | $@ based on $@ is later used in $@. | lib/lib.js:228:10:228:25 | "rm -rf " + name | String concatenation | lib/lib.js:227:39:227:42 | name | library input | lib/lib.js:228:2:228:26 | cp.exec ... + name) | shell command |
+| lib/lib.js:236:10:236:25 | "rm -rf " + name | lib/lib.js:227:39:227:42 | name | lib/lib.js:236:22:236:25 | name | $@ based on $@ is later used in $@. | lib/lib.js:236:10:236:25 | "rm -rf " + name | String concatenation | lib/lib.js:227:39:227:42 | name | library input | lib/lib.js:236:2:236:26 | cp.exec ... + name) | shell command |
+| lib/lib.js:249:10:249:25 | "rm -rf " + name | lib/lib.js:248:42:248:45 | name | lib/lib.js:249:22:249:25 | name | $@ based on $@ is later used in $@. | lib/lib.js:249:10:249:25 | "rm -rf " + name | String concatenation | lib/lib.js:248:42:248:45 | name | library input | lib/lib.js:249:2:249:26 | cp.exec ... + name) | shell command |
+| lib/lib.js:258:10:258:25 | "rm -rf " + name | lib/lib.js:257:35:257:38 | name | lib/lib.js:258:22:258:25 | name | $@ based on $@ is later used in $@. | lib/lib.js:258:10:258:25 | "rm -rf " + name | String concatenation | lib/lib.js:257:35:257:38 | name | library input | lib/lib.js:258:2:258:26 | cp.exec ... + name) | shell command |
+| lib/lib.js:261:11:261:33 | "rm -rf ...  + name | lib/lib.js:257:35:257:38 | name | lib/lib.js:261:30:261:33 | name | $@ based on $@ is later used in $@. | lib/lib.js:261:11:261:33 | "rm -rf ...  + name | String concatenation | lib/lib.js:257:35:257:38 | name | library input | lib/lib.js:261:3:261:34 | cp.exec ... + name) | shell command |
+| lib/lib.js:268:10:268:32 | "rm -rf ... version | lib/lib.js:267:46:267:48 | obj | lib/lib.js:268:22:268:32 | obj.version | $@ based on $@ is later used in $@. | lib/lib.js:268:10:268:32 | "rm -rf ... version | String concatenation | lib/lib.js:267:46:267:48 | obj | library input | lib/lib.js:268:2:268:33 | cp.exec ... ersion) | shell command |
+| lib/lib.js:277:11:277:30 | "rm -rf " + opts.bla | lib/lib.js:276:8:276:11 | opts | lib/lib.js:277:23:277:30 | opts.bla | $@ based on $@ is later used in $@. | lib/lib.js:277:11:277:30 | "rm -rf " + opts.bla | String concatenation | lib/lib.js:276:8:276:11 | opts | library input | lib/lib.js:277:3:277:31 | cp.exec ... ts.bla) | shell command |
+| lib/lib.js:308:11:308:26 | "rm -rf " + name | lib/lib.js:307:39:307:42 | name | lib/lib.js:308:23:308:26 | name | $@ based on $@ is later used in $@. | lib/lib.js:308:11:308:26 | "rm -rf " + name | String concatenation | lib/lib.js:307:39:307:42 | name | library input | lib/lib.js:308:3:308:27 | cp.exec ... + name) | shell command |
+| lib/lib.js:315:10:315:25 | "rm -rf " + name | lib/lib.js:314:40:314:43 | name | lib/lib.js:315:22:315:25 | name | $@ based on $@ is later used in $@. | lib/lib.js:315:10:315:25 | "rm -rf " + name | String concatenation | lib/lib.js:314:40:314:43 | name | library input | lib/lib.js:315:2:315:26 | cp.exec ... + name) | shell command |
+| lib/lib.js:320:11:320:26 | "rm -rf " + name | lib/lib.js:314:40:314:43 | name | lib/lib.js:320:23:320:26 | name | $@ based on $@ is later used in $@. | lib/lib.js:320:11:320:26 | "rm -rf " + name | String concatenation | lib/lib.js:314:40:314:43 | name | library input | lib/lib.js:320:3:320:27 | cp.exec ... + name) | shell command |
+| lib/lib.js:325:12:325:51 | "MyWind ... " + arg | lib/lib.js:324:40:324:42 | arg | lib/lib.js:325:49:325:51 | arg | $@ based on $@ is later used in $@. | lib/lib.js:325:12:325:51 | "MyWind ... " + arg | String concatenation | lib/lib.js:324:40:324:42 | arg | library input | lib/lib.js:326:2:326:13 | cp.exec(cmd) | shell command |
+| lib/lib.js:340:10:340:26 | "rm -rf " + id(n) | lib/lib.js:339:39:339:39 | n | lib/lib.js:340:22:340:26 | id(n) | $@ based on $@ is later used in $@. | lib/lib.js:340:10:340:26 | "rm -rf " + id(n) | String concatenation | lib/lib.js:339:39:339:39 | n | library input | lib/lib.js:340:2:340:27 | cp.exec ...  id(n)) | shell command |
+| lib/lib.js:351:10:351:27 | "rm -rf " + unsafe | lib/lib.js:349:29:349:34 | unsafe | lib/lib.js:351:22:351:27 | unsafe | $@ based on $@ is later used in $@. | lib/lib.js:351:10:351:27 | "rm -rf " + unsafe | String concatenation | lib/lib.js:349:29:349:34 | unsafe | library input | lib/lib.js:351:2:351:28 | cp.exec ... unsafe) | shell command |
+| lib/lib.js:366:17:366:56 | "learn  ... + model | lib/lib.js:360:20:360:23 | opts | lib/lib.js:366:28:366:42 | this.learn_args | $@ based on $@ is later used in $@. | lib/lib.js:366:17:366:56 | "learn  ... + model | String concatenation | lib/lib.js:360:20:360:23 | opts | library input | lib/lib.js:367:3:367:18 | cp.exec(command) | shell command |
+| lib/lib.js:406:10:406:25 | "rm -rf " + name | lib/lib.js:405:39:405:42 | name | lib/lib.js:406:22:406:25 | name | $@ based on $@ is later used in $@. | lib/lib.js:406:10:406:25 | "rm -rf " + name | String concatenation | lib/lib.js:405:39:405:42 | name | library input | lib/lib.js:406:2:406:26 | cp.exec ... + name) | shell command |
+| lib/lib.js:415:10:415:25 | "rm -rf " + name | lib/lib.js:414:40:414:43 | name | lib/lib.js:415:22:415:25 | name | $@ based on $@ is later used in $@. | lib/lib.js:415:10:415:25 | "rm -rf " + name | String concatenation | lib/lib.js:414:40:414:43 | name | library input | lib/lib.js:415:2:415:26 | cp.exec ... + name) | shell command |
+| lib/lib.js:417:28:417:31 | name | lib/lib.js:414:40:414:43 | name | lib/lib.js:417:28:417:31 | name | $@ based on $@ is later used in $@. | lib/lib.js:417:28:417:31 | name | Shell argument | lib/lib.js:414:40:414:43 | name | library input | lib/lib.js:417:2:417:66 | cp.exec ...  => {}) | shell command |
+| lib/lib.js:418:25:418:28 | name | lib/lib.js:414:40:414:43 | name | lib/lib.js:418:25:418:28 | name | $@ based on $@ is later used in $@. | lib/lib.js:418:25:418:28 | name | Shell argument | lib/lib.js:414:40:414:43 | name | library input | lib/lib.js:418:2:418:45 | cp.spaw ...  true}) | shell command |
+| lib/lib.js:419:32:419:35 | name | lib/lib.js:414:40:414:43 | name | lib/lib.js:419:32:419:35 | name | $@ based on $@ is later used in $@. | lib/lib.js:419:32:419:35 | name | Shell argument | lib/lib.js:414:40:414:43 | name | library input | lib/lib.js:419:2:419:52 | cp.exec ...  true}) | shell command |
+| lib/lib.js:420:29:420:32 | name | lib/lib.js:414:40:414:43 | name | lib/lib.js:420:29:420:32 | name | $@ based on $@ is later used in $@. | lib/lib.js:420:29:420:32 | name | Shell argument | lib/lib.js:414:40:414:43 | name | library input | lib/lib.js:420:2:420:49 | cp.spaw ...  true}) | shell command |
+| lib/lib.js:424:24:424:27 | name | lib/lib.js:414:40:414:43 | name | lib/lib.js:424:24:424:27 | name | $@ based on $@ is later used in $@. | lib/lib.js:424:24:424:27 | name | Shell argument | lib/lib.js:414:40:414:43 | name | library input | lib/lib.js:424:2:424:40 | spawn(" ... WN_OPT) | shell command |
+| lib/lib.js:426:11:426:14 | name | lib/lib.js:414:40:414:43 | name | lib/lib.js:426:11:426:14 | name | $@ based on $@ is later used in $@. | lib/lib.js:426:11:426:14 | name | Shell argument | lib/lib.js:414:40:414:43 | name | library input | lib/lib.js:427:2:427:28 | spawn(" ... WN_OPT) | shell command |
+| lib/lib.js:436:19:436:22 | last | lib/lib.js:414:40:414:43 | name | lib/lib.js:436:19:436:22 | last | $@ based on $@ is later used in $@. | lib/lib.js:436:19:436:22 | last | Shell argument | lib/lib.js:414:40:414:43 | name | library input | lib/lib.js:428:2:428:70 | spawn(" ... WN_OPT) | shell command |
+| lib/lib.js:442:12:442:27 | "rm -rf " + name | lib/lib.js:441:39:441:42 | name | lib/lib.js:442:24:442:27 | name | $@ based on $@ is later used in $@. | lib/lib.js:442:12:442:27 | "rm -rf " + name | String concatenation | lib/lib.js:441:39:441:42 | name | library input | lib/lib.js:442:2:442:28 | asyncEx ... + name) | shell command |
+| lib/lib.js:447:13:447:28 | "rm -rf " + name | lib/lib.js:446:20:446:23 | name | lib/lib.js:447:25:447:28 | name | $@ based on $@ is later used in $@. | lib/lib.js:447:13:447:28 | "rm -rf " + name | String concatenation | lib/lib.js:446:20:446:23 | name | library input | lib/lib.js:447:3:447:29 | asyncEx ... + name) | shell command |
+| lib/lib.js:478:27:478:46 | config.installedPath | lib/lib.js:477:33:477:38 | config | lib/lib.js:478:27:478:46 | config.installedPath | $@ based on $@ is later used in $@. | lib/lib.js:478:27:478:46 | config.installedPath | Path concatenation | lib/lib.js:477:33:477:38 | config | library input | lib/lib.js:479:12:479:20 | exec(cmd) | shell command |
+| lib/lib.js:483:13:483:33 | ' my na ...  + name | lib/lib.js:482:40:482:43 | name | lib/lib.js:483:30:483:33 | name | $@ based on $@ is later used in $@. | lib/lib.js:483:13:483:33 | ' my na ...  + name | String concatenation | lib/lib.js:482:40:482:43 | name | library input | lib/lib.js:485:2:485:20 | cp.exec(cmd + args) | shell command |
+| lib/subLib2/compiled-file.ts:4:13:4:28 | "rm -rf " + name | lib/subLib2/compiled-file.ts:3:26:3:29 | name | lib/subLib2/compiled-file.ts:4:25:4:28 | name | $@ based on $@ is later used in $@. | lib/subLib2/compiled-file.ts:4:13:4:28 | "rm -rf " + name | String concatenation | lib/subLib2/compiled-file.ts:3:26:3:29 | name | library input | lib/subLib2/compiled-file.ts:4:5:4:29 | cp.exec ... + name) | shell command |
+| lib/subLib2/special-file.js:4:10:4:25 | "rm -rf " + name | lib/subLib2/special-file.js:3:28:3:31 | name | lib/subLib2/special-file.js:4:22:4:25 | name | $@ based on $@ is later used in $@. | lib/subLib2/special-file.js:4:10:4:25 | "rm -rf " + name | String concatenation | lib/subLib2/special-file.js:3:28:3:31 | name | library input | lib/subLib2/special-file.js:4:2:4:26 | cp.exec ... + name) | shell command |
+| lib/subLib3/my-file.ts:4:10:4:25 | "rm -rf " + name | lib/subLib3/my-file.ts:3:28:3:31 | name | lib/subLib3/my-file.ts:4:22:4:25 | name | $@ based on $@ is later used in $@. | lib/subLib3/my-file.ts:4:10:4:25 | "rm -rf " + name | String concatenation | lib/subLib3/my-file.ts:3:28:3:31 | name | library input | lib/subLib3/my-file.ts:4:2:4:26 | cp.exec ... + name) | shell command |
+| lib/subLib/index.js:4:10:4:25 | "rm -rf " + name | lib/subLib/index.js:3:28:3:31 | name | lib/subLib/index.js:4:22:4:25 | name | $@ based on $@ is later used in $@. | lib/subLib/index.js:4:10:4:25 | "rm -rf " + name | String concatenation | lib/subLib/index.js:3:28:3:31 | name | library input | lib/subLib/index.js:4:2:4:26 | cp.exec ... + name) | shell command |
+| lib/subLib/index.js:8:10:8:25 | "rm -rf " + name | lib/subLib/index.js:7:32:7:35 | name | lib/subLib/index.js:8:22:8:25 | name | $@ based on $@ is later used in $@. | lib/subLib/index.js:8:10:8:25 | "rm -rf " + name | String concatenation | lib/subLib/index.js:7:32:7:35 | name | library input | lib/subLib/index.js:8:2:8:26 | cp.exec ... + name) | shell command |
diff --git a/javascript/ql/test/query-tests/Security/CWE-078/UselessUseOfCat.expected b/javascript/ql/test/query-tests/Security/CWE-078/UselessUseOfCat.expected
index 7a7e22fb332..1d72d7acba1 100644
--- a/javascript/ql/test/query-tests/Security/CWE-078/UselessUseOfCat.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-078/UselessUseOfCat.expected
@@ -53,6 +53,8 @@ syncCommand
 | command-line-parameter-command-injection.js:20:2:20:30 | cp.exec ... + arg0) |
 | command-line-parameter-command-injection.js:26:2:26:51 | cp.exec ... tion"`) |
 | command-line-parameter-command-injection.js:27:2:27:58 | cp.exec ... tion"`) |
+| lib/lib.js:419:2:419:52 | cp.exec ...  true}) |
+| lib/lib.js:420:2:420:49 | cp.spaw ...  true}) |
 | other.js:7:5:7:36 | require ... nc(cmd) |
 | other.js:9:5:9:35 | require ... nc(cmd) |
 | other.js:12:5:12:30 | require ... nc(cmd) |
@@ -61,6 +63,7 @@ syncCommand
 | tst_shell-command-injection-from-environment.js:5:2:5:62 | cp.exec ... emp")]) |
 | tst_shell-command-injection-from-environment.js:6:2:6:54 | cp.exec ... temp")) |
 | tst_shell-command-injection-from-environment.js:9:2:9:58 | execa.s ... temp")) |
+| tst_shell-command-injection-from-environment.js:12:2:12:34 | execa.s ... + safe) |
 | uselesscat.js:16:1:16:29 | execSyn ... uinfo') |
 | uselesscat.js:18:1:18:26 | execSyn ... path}`) |
 | uselesscat.js:20:1:20:36 | execSyn ... wc -l') |
@@ -100,6 +103,13 @@ options
 | lib/lib.js:152:2:152:23 | cp.spaw ... gs, cb) | lib/lib.js:152:21:152:22 | cb |
 | lib/lib.js:159:2:159:23 | cp.spaw ... gs, cb) | lib/lib.js:159:21:159:22 | cb |
 | lib/lib.js:163:2:167:2 | cp.spaw ... t' }\\n\\t) | lib/lib.js:166:3:166:22 | { stdio: 'inherit' } |
+| lib/lib.js:417:2:417:66 | cp.exec ...  => {}) | lib/lib.js:417:35:417:47 | {shell: true} |
+| lib/lib.js:418:2:418:45 | cp.spaw ...  true}) | lib/lib.js:418:32:418:44 | {shell: true} |
+| lib/lib.js:419:2:419:52 | cp.exec ...  true}) | lib/lib.js:419:39:419:51 | {shell: true} |
+| lib/lib.js:420:2:420:49 | cp.spaw ...  true}) | lib/lib.js:420:36:420:48 | {shell: true} |
+| lib/lib.js:424:2:424:40 | spawn(" ... WN_OPT) | lib/lib.js:424:31:424:39 | SPAWN_OPT |
+| lib/lib.js:427:2:427:28 | spawn(" ... WN_OPT) | lib/lib.js:427:19:427:27 | SPAWN_OPT |
+| lib/lib.js:428:2:428:70 | spawn(" ... WN_OPT) | lib/lib.js:428:61:428:69 | SPAWN_OPT |
 | uselesscat.js:28:1:28:39 | execSyn ...  1000}) | uselesscat.js:28:28:28:38 | {uid: 1000} |
 | uselesscat.js:30:1:30:64 | exec('c ... t) { }) | uselesscat.js:30:26:30:38 | { cwd: './' } |
 | uselesscat.js:34:1:34:54 | execSyn ... utf8'}) | uselesscat.js:34:36:34:53 | {encoding: 'utf8'} |
diff --git a/javascript/ql/test/query-tests/Security/CWE-078/lib/lib.js b/javascript/ql/test/query-tests/Security/CWE-078/lib/lib.js
index d1a885438ff..6b053d64366 100644
--- a/javascript/ql/test/query-tests/Security/CWE-078/lib/lib.js
+++ b/javascript/ql/test/query-tests/Security/CWE-078/lib/lib.js
@@ -408,3 +408,84 @@ module.exports.sanitizer3 = function (name) {
 	var sanitized = yetAnohterSanitizer(name);
 	cp.exec("rm -rf " + sanitized); // OK
 }
+
+const cp = require("child_process");
+const spawn = cp.spawn;
+module.exports.shellOption = function (name) {
+	cp.exec("rm -rf " + name); // NOT OK
+
+	cp.execFile("rm", ["-rf", name], {shell: true}, (err, out) => {}); // NOT OK
+	cp.spawn("rm", ["-rf", name], {shell: true}); // NOT OK
+	cp.execFileSync("rm", ["-rf", name], {shell: true}); // NOT OK
+	cp.spawnSync("rm", ["-rf", name], {shell: true}); // NOT OK
+
+	const SPAWN_OPT = {shell: true};
+
+	spawn("rm", ["first", name], SPAWN_OPT); // NOT OK
+	var arr = [];
+	arr.push(name); // NOT OK
+	spawn("rm", arr, SPAWN_OPT); 
+	spawn("rm", build("node", (name ? name + ':' : '') + '-'), SPAWN_OPT);  // This is bad, but the alert location is down in `build`.
+}
+
+function build(first, last) {
+	var arr = [];
+	if (something() === 'gm')
+		arr.push('convert');
+	first && arr.push(first);
+	last && arr.push(last); // NOT OK
+	return arr;
+};
+
+var asyncExec = require("async-execute");
+module.exports.asyncStuff = function (name) {
+	asyncExec("rm -rf " + name); // NOT OK
+}
+
+const myFuncs = {
+	myFunc: function (name) {
+		asyncExec("rm -rf " + name); // NOT OK
+	}
+};
+
+module.exports.blabity = {};
+
+Object.defineProperties(
+	module.exports.blabity,
+	Object.assign(
+		{},
+		Object.entries(myFuncs).reduce(
+			(props, [ key, value ]) => Object.assign(
+				props,
+				{
+					[key]: {
+						value,
+						configurable: true,
+					},
+				},
+			),
+			{}
+		)
+	)
+);
+
+const path = require('path');
+const {promisify} = require('util');
+
+const exec = promisify(require('child_process').exec);
+
+module.exports = function check(config) {
+    const cmd = path.join(config.installedPath, 'myBinary -v'); // NOT OK
+    return exec(cmd);
+}
+
+module.exports.splitConcat = function (name) {
+	let args = ' my name is ' + name; // NOT OK
+	let cmd = 'echo';
+	cp.exec(cmd + args);
+}
+
+module.exports.myCommand = function (myCommand) {
+	let cmd = `cd ${cwd} ; ${myCommand}`; // OK - the parameter name suggests that it is purposely a shell command.
+	cp.exec(cmd);
+}
\ No newline at end of file
diff --git a/javascript/ql/test/query-tests/Security/CWE-078/lib/subLib/index.js b/javascript/ql/test/query-tests/Security/CWE-078/lib/subLib/index.js
index c101df07d02..325a652c9b5 100644
--- a/javascript/ql/test/query-tests/Security/CWE-078/lib/subLib/index.js
+++ b/javascript/ql/test/query-tests/Security/CWE-078/lib/subLib/index.js
@@ -1,7 +1,7 @@
 var cp = require("child_process")
 
 module.exports = function (name) {
-	cp.exec("rm -rf " + name); // OK - this file belongs in a sub-"module", and is not the primary exported module.
+	cp.exec("rm -rf " + name); // NOT OK - functions exported as part of a submodule are also flagged.
 };
 
 module.exports.foo = function (name) {
diff --git a/javascript/ql/test/query-tests/Security/CWE-078/lib/subLib2/compiled-file.ts b/javascript/ql/test/query-tests/Security/CWE-078/lib/subLib2/compiled-file.ts
new file mode 100644
index 00000000000..1e945f15e72
--- /dev/null
+++ b/javascript/ql/test/query-tests/Security/CWE-078/lib/subLib2/compiled-file.ts
@@ -0,0 +1,5 @@
+var cp = require("child_process")
+
+export default function (name) {
+    cp.exec("rm -rf " + name); // NOT OK - the "files" directory points to this file.
+}
diff --git a/javascript/ql/test/query-tests/Security/CWE-078/lib/subLib2/package.json b/javascript/ql/test/query-tests/Security/CWE-078/lib/subLib2/package.json
new file mode 100644
index 00000000000..45c7a0534f4
--- /dev/null
+++ b/javascript/ql/test/query-tests/Security/CWE-078/lib/subLib2/package.json
@@ -0,0 +1,9 @@
+{
+  "name": "my-sub-lib2",
+  "version": "0.0.7",
+  "files": [
+    "special-file.js",
+    "compiled-file.js",
+    "compiled-file"
+  ]
+}
\ No newline at end of file
diff --git a/javascript/ql/test/query-tests/Security/CWE-078/lib/subLib2/special-file.js b/javascript/ql/test/query-tests/Security/CWE-078/lib/subLib2/special-file.js
new file mode 100644
index 00000000000..c46fed33181
--- /dev/null
+++ b/javascript/ql/test/query-tests/Security/CWE-078/lib/subLib2/special-file.js
@@ -0,0 +1,5 @@
+var cp = require("child_process")
+
+module.exports = function (name) {
+	cp.exec("rm -rf " + name); // NOT OK - the "files" directory points to this file.
+};
\ No newline at end of file
diff --git a/javascript/ql/test/query-tests/Security/CWE-078/lib/subLib3/my-file.ts b/javascript/ql/test/query-tests/Security/CWE-078/lib/subLib3/my-file.ts
new file mode 100644
index 00000000000..9fa88413cc8
--- /dev/null
+++ b/javascript/ql/test/query-tests/Security/CWE-078/lib/subLib3/my-file.ts
@@ -0,0 +1,5 @@
+var cp = require("child_process")
+
+module.exports = function (name) {
+	cp.exec("rm -rf " + name); // NOT OK - functions exported as part of a submodule are also flagged.
+};
diff --git a/javascript/ql/test/query-tests/Security/CWE-078/lib/subLib3/package.json b/javascript/ql/test/query-tests/Security/CWE-078/lib/subLib3/package.json
new file mode 100644
index 00000000000..2804217e9ba
--- /dev/null
+++ b/javascript/ql/test/query-tests/Security/CWE-078/lib/subLib3/package.json
@@ -0,0 +1,5 @@
+{
+  "name": "my-sub-lib",
+  "version": "0.0.7",
+  "main": "./my-file.js"
+}
\ No newline at end of file
diff --git a/javascript/ql/test/query-tests/Security/CWE-078/tst_shell-command-injection-from-environment.js b/javascript/ql/test/query-tests/Security/CWE-078/tst_shell-command-injection-from-environment.js
index a4c7860993f..0d610b1e9dd 100644
--- a/javascript/ql/test/query-tests/Security/CWE-078/tst_shell-command-injection-from-environment.js
+++ b/javascript/ql/test/query-tests/Security/CWE-078/tst_shell-command-injection-from-environment.js
@@ -7,4 +7,7 @@ var cp = require('child_process'),
 
 	execa.shell('rm -rf ' + path.join(__dirname, "temp")); // NOT OK
 	execa.shellSync('rm -rf ' + path.join(__dirname, "temp")); // NOT OK
+
+	const safe = "\"" + path.join(__dirname, "temp") + "\"";
+	execa.shellSync('rm -rf ' + safe); // OK
 });
diff --git a/javascript/ql/test/query-tests/Security/CWE-089/untyped/DatabaseAccesses.expected b/javascript/ql/test/query-tests/Security/CWE-089/untyped/DatabaseAccesses.expected
index 5bf367a4c18..6252e53b5ab 100644
--- a/javascript/ql/test/query-tests/Security/CWE-089/untyped/DatabaseAccesses.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-089/untyped/DatabaseAccesses.expected
@@ -37,6 +37,28 @@
 | mongoose.js:97:2:97:52 | Documen ... query)) |
 | mongoose.js:99:2:99:50 | Documen ... query)) |
 | mongoose.js:113:2:113:53 | Documen ... () { }) |
+| pg-promise-types.ts:8:5:8:22 | this.db.one(taint) |
+| pg-promise.js:9:3:9:15 | db.any(query) |
+| pg-promise.js:10:3:10:16 | db.many(query) |
+| pg-promise.js:11:3:11:22 | db.manyOrNone(query) |
+| pg-promise.js:12:3:12:15 | db.map(query) |
+| pg-promise.js:13:3:13:17 | db.multi(query) |
+| pg-promise.js:14:3:14:23 | db.mult ... (query) |
+| pg-promise.js:15:3:15:16 | db.none(query) |
+| pg-promise.js:16:3:16:15 | db.one(query) |
+| pg-promise.js:17:3:17:21 | db.oneOrNone(query) |
+| pg-promise.js:18:3:18:17 | db.query(query) |
+| pg-promise.js:19:3:19:18 | db.result(query) |
+| pg-promise.js:21:3:23:4 | db.one( ... OK\\n  }) |
+| pg-promise.js:24:3:27:4 | db.one( ... OK\\n  }) |
+| pg-promise.js:28:3:31:4 | db.one( ... er\\n  }) |
+| pg-promise.js:32:3:35:4 | db.one( ... OK\\n  }) |
+| pg-promise.js:36:3:43:4 | db.one( ...  ]\\n  }) |
+| pg-promise.js:44:3:50:4 | db.one( ...  }\\n  }) |
+| pg-promise.js:51:3:58:4 | db.one( ...  }\\n  }) |
+| pg-promise.js:60:14:60:25 | t.one(query) |
+| pg-promise.js:63:17:63:28 | t.one(query) |
+| pg-promise.js:64:10:64:21 | t.one(query) |
 | socketio.js:11:5:11:54 | db.run( ... ndle}`) |
 | tst2.js:7:3:7:62 | sql.que ... ms.id}` |
 | tst2.js:9:3:9:85 | new sql ...  + "'") |
diff --git a/javascript/ql/test/query-tests/Security/CWE-089/untyped/SqlInjection.expected b/javascript/ql/test/query-tests/Security/CWE-089/untyped/SqlInjection.expected
index 427e2fb853c..ac856dabb7b 100644
--- a/javascript/ql/test/query-tests/Security/CWE-089/untyped/SqlInjection.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-089/untyped/SqlInjection.expected
@@ -206,6 +206,70 @@ nodes
 | mongooseModelClient.js:12:22:12:29 | req.body |
 | mongooseModelClient.js:12:22:12:29 | req.body |
 | mongooseModelClient.js:12:22:12:32 | req.body.id |
+| pg-promise-types.ts:7:9:7:28 | taint |
+| pg-promise-types.ts:7:17:7:28 | req.params.x |
+| pg-promise-types.ts:7:17:7:28 | req.params.x |
+| pg-promise-types.ts:8:17:8:21 | taint |
+| pg-promise-types.ts:8:17:8:21 | taint |
+| pg-promise.js:6:7:7:55 | query |
+| pg-promise.js:6:15:7:55 | "SELECT ...  PRICE" |
+| pg-promise.js:7:16:7:34 | req.params.category |
+| pg-promise.js:7:16:7:34 | req.params.category |
+| pg-promise.js:9:10:9:14 | query |
+| pg-promise.js:9:10:9:14 | query |
+| pg-promise.js:10:11:10:15 | query |
+| pg-promise.js:10:11:10:15 | query |
+| pg-promise.js:11:17:11:21 | query |
+| pg-promise.js:11:17:11:21 | query |
+| pg-promise.js:12:10:12:14 | query |
+| pg-promise.js:12:10:12:14 | query |
+| pg-promise.js:13:12:13:16 | query |
+| pg-promise.js:13:12:13:16 | query |
+| pg-promise.js:14:18:14:22 | query |
+| pg-promise.js:14:18:14:22 | query |
+| pg-promise.js:15:11:15:15 | query |
+| pg-promise.js:15:11:15:15 | query |
+| pg-promise.js:16:10:16:14 | query |
+| pg-promise.js:16:10:16:14 | query |
+| pg-promise.js:17:16:17:20 | query |
+| pg-promise.js:17:16:17:20 | query |
+| pg-promise.js:18:12:18:16 | query |
+| pg-promise.js:18:12:18:16 | query |
+| pg-promise.js:19:13:19:17 | query |
+| pg-promise.js:19:13:19:17 | query |
+| pg-promise.js:22:11:22:15 | query |
+| pg-promise.js:22:11:22:15 | query |
+| pg-promise.js:30:13:30:25 | req.params.id |
+| pg-promise.js:30:13:30:25 | req.params.id |
+| pg-promise.js:30:13:30:25 | req.params.id |
+| pg-promise.js:34:13:34:25 | req.params.id |
+| pg-promise.js:34:13:34:25 | req.params.id |
+| pg-promise.js:34:13:34:25 | req.params.id |
+| pg-promise.js:38:13:42:5 | [\\n      ... n\\n    ] |
+| pg-promise.js:38:13:42:5 | [\\n      ... n\\n    ] |
+| pg-promise.js:39:7:39:19 | req.params.id |
+| pg-promise.js:39:7:39:19 | req.params.id |
+| pg-promise.js:39:7:39:19 | req.params.id |
+| pg-promise.js:40:7:40:21 | req.params.name |
+| pg-promise.js:40:7:40:21 | req.params.name |
+| pg-promise.js:40:7:40:21 | req.params.name |
+| pg-promise.js:41:7:41:20 | req.params.foo |
+| pg-promise.js:41:7:41:20 | req.params.foo |
+| pg-promise.js:47:11:47:23 | req.params.id |
+| pg-promise.js:47:11:47:23 | req.params.id |
+| pg-promise.js:47:11:47:23 | req.params.id |
+| pg-promise.js:54:11:54:23 | req.params.id |
+| pg-promise.js:54:11:54:23 | req.params.id |
+| pg-promise.js:54:11:54:23 | req.params.id |
+| pg-promise.js:56:14:56:29 | req.params.title |
+| pg-promise.js:56:14:56:29 | req.params.title |
+| pg-promise.js:56:14:56:29 | req.params.title |
+| pg-promise.js:60:20:60:24 | query |
+| pg-promise.js:60:20:60:24 | query |
+| pg-promise.js:63:23:63:27 | query |
+| pg-promise.js:63:23:63:27 | query |
+| pg-promise.js:64:16:64:20 | query |
+| pg-promise.js:64:16:64:20 | query |
 | redis.js:10:16:10:23 | req.body |
 | redis.js:10:16:10:23 | req.body |
 | redis.js:10:16:10:27 | req.body.key |
@@ -553,6 +617,62 @@ edges
 | mongooseModelClient.js:12:22:12:29 | req.body | mongooseModelClient.js:12:22:12:32 | req.body.id |
 | mongooseModelClient.js:12:22:12:32 | req.body.id | mongooseModelClient.js:12:16:12:34 | { id: req.body.id } |
 | mongooseModelClient.js:12:22:12:32 | req.body.id | mongooseModelClient.js:12:16:12:34 | { id: req.body.id } |
+| pg-promise-types.ts:7:9:7:28 | taint | pg-promise-types.ts:8:17:8:21 | taint |
+| pg-promise-types.ts:7:9:7:28 | taint | pg-promise-types.ts:8:17:8:21 | taint |
+| pg-promise-types.ts:7:17:7:28 | req.params.x | pg-promise-types.ts:7:9:7:28 | taint |
+| pg-promise-types.ts:7:17:7:28 | req.params.x | pg-promise-types.ts:7:9:7:28 | taint |
+| pg-promise.js:6:7:7:55 | query | pg-promise.js:9:10:9:14 | query |
+| pg-promise.js:6:7:7:55 | query | pg-promise.js:9:10:9:14 | query |
+| pg-promise.js:6:7:7:55 | query | pg-promise.js:10:11:10:15 | query |
+| pg-promise.js:6:7:7:55 | query | pg-promise.js:10:11:10:15 | query |
+| pg-promise.js:6:7:7:55 | query | pg-promise.js:11:17:11:21 | query |
+| pg-promise.js:6:7:7:55 | query | pg-promise.js:11:17:11:21 | query |
+| pg-promise.js:6:7:7:55 | query | pg-promise.js:12:10:12:14 | query |
+| pg-promise.js:6:7:7:55 | query | pg-promise.js:12:10:12:14 | query |
+| pg-promise.js:6:7:7:55 | query | pg-promise.js:13:12:13:16 | query |
+| pg-promise.js:6:7:7:55 | query | pg-promise.js:13:12:13:16 | query |
+| pg-promise.js:6:7:7:55 | query | pg-promise.js:14:18:14:22 | query |
+| pg-promise.js:6:7:7:55 | query | pg-promise.js:14:18:14:22 | query |
+| pg-promise.js:6:7:7:55 | query | pg-promise.js:15:11:15:15 | query |
+| pg-promise.js:6:7:7:55 | query | pg-promise.js:15:11:15:15 | query |
+| pg-promise.js:6:7:7:55 | query | pg-promise.js:16:10:16:14 | query |
+| pg-promise.js:6:7:7:55 | query | pg-promise.js:16:10:16:14 | query |
+| pg-promise.js:6:7:7:55 | query | pg-promise.js:17:16:17:20 | query |
+| pg-promise.js:6:7:7:55 | query | pg-promise.js:17:16:17:20 | query |
+| pg-promise.js:6:7:7:55 | query | pg-promise.js:18:12:18:16 | query |
+| pg-promise.js:6:7:7:55 | query | pg-promise.js:18:12:18:16 | query |
+| pg-promise.js:6:7:7:55 | query | pg-promise.js:19:13:19:17 | query |
+| pg-promise.js:6:7:7:55 | query | pg-promise.js:19:13:19:17 | query |
+| pg-promise.js:6:7:7:55 | query | pg-promise.js:22:11:22:15 | query |
+| pg-promise.js:6:7:7:55 | query | pg-promise.js:22:11:22:15 | query |
+| pg-promise.js:6:7:7:55 | query | pg-promise.js:60:20:60:24 | query |
+| pg-promise.js:6:7:7:55 | query | pg-promise.js:60:20:60:24 | query |
+| pg-promise.js:6:7:7:55 | query | pg-promise.js:63:23:63:27 | query |
+| pg-promise.js:6:7:7:55 | query | pg-promise.js:63:23:63:27 | query |
+| pg-promise.js:6:7:7:55 | query | pg-promise.js:64:16:64:20 | query |
+| pg-promise.js:6:7:7:55 | query | pg-promise.js:64:16:64:20 | query |
+| pg-promise.js:6:15:7:55 | "SELECT ...  PRICE" | pg-promise.js:6:7:7:55 | query |
+| pg-promise.js:7:16:7:34 | req.params.category | pg-promise.js:6:15:7:55 | "SELECT ...  PRICE" |
+| pg-promise.js:7:16:7:34 | req.params.category | pg-promise.js:6:15:7:55 | "SELECT ...  PRICE" |
+| pg-promise.js:30:13:30:25 | req.params.id | pg-promise.js:30:13:30:25 | req.params.id |
+| pg-promise.js:34:13:34:25 | req.params.id | pg-promise.js:34:13:34:25 | req.params.id |
+| pg-promise.js:39:7:39:19 | req.params.id | pg-promise.js:38:13:42:5 | [\\n      ... n\\n    ] |
+| pg-promise.js:39:7:39:19 | req.params.id | pg-promise.js:38:13:42:5 | [\\n      ... n\\n    ] |
+| pg-promise.js:39:7:39:19 | req.params.id | pg-promise.js:38:13:42:5 | [\\n      ... n\\n    ] |
+| pg-promise.js:39:7:39:19 | req.params.id | pg-promise.js:38:13:42:5 | [\\n      ... n\\n    ] |
+| pg-promise.js:39:7:39:19 | req.params.id | pg-promise.js:39:7:39:19 | req.params.id |
+| pg-promise.js:40:7:40:21 | req.params.name | pg-promise.js:38:13:42:5 | [\\n      ... n\\n    ] |
+| pg-promise.js:40:7:40:21 | req.params.name | pg-promise.js:38:13:42:5 | [\\n      ... n\\n    ] |
+| pg-promise.js:40:7:40:21 | req.params.name | pg-promise.js:38:13:42:5 | [\\n      ... n\\n    ] |
+| pg-promise.js:40:7:40:21 | req.params.name | pg-promise.js:38:13:42:5 | [\\n      ... n\\n    ] |
+| pg-promise.js:40:7:40:21 | req.params.name | pg-promise.js:40:7:40:21 | req.params.name |
+| pg-promise.js:41:7:41:20 | req.params.foo | pg-promise.js:38:13:42:5 | [\\n      ... n\\n    ] |
+| pg-promise.js:41:7:41:20 | req.params.foo | pg-promise.js:38:13:42:5 | [\\n      ... n\\n    ] |
+| pg-promise.js:41:7:41:20 | req.params.foo | pg-promise.js:38:13:42:5 | [\\n      ... n\\n    ] |
+| pg-promise.js:41:7:41:20 | req.params.foo | pg-promise.js:38:13:42:5 | [\\n      ... n\\n    ] |
+| pg-promise.js:47:11:47:23 | req.params.id | pg-promise.js:47:11:47:23 | req.params.id |
+| pg-promise.js:54:11:54:23 | req.params.id | pg-promise.js:54:11:54:23 | req.params.id |
+| pg-promise.js:56:14:56:29 | req.params.title | pg-promise.js:56:14:56:29 | req.params.title |
 | redis.js:10:16:10:23 | req.body | redis.js:10:16:10:27 | req.body.key |
 | redis.js:10:16:10:23 | req.body | redis.js:10:16:10:27 | req.body.key |
 | redis.js:10:16:10:23 | req.body | redis.js:10:16:10:27 | req.body.key |
@@ -665,6 +785,32 @@ edges
 | mongooseJsonParse.js:23:19:23:23 | query | mongooseJsonParse.js:20:30:20:43 | req.query.data | mongooseJsonParse.js:23:19:23:23 | query | This query depends on $@. | mongooseJsonParse.js:20:30:20:43 | req.query.data | a user-provided value |
 | mongooseModelClient.js:11:16:11:24 | { id: v } | mongooseModelClient.js:10:22:10:29 | req.body | mongooseModelClient.js:11:16:11:24 | { id: v } | This query depends on $@. | mongooseModelClient.js:10:22:10:29 | req.body | a user-provided value |
 | mongooseModelClient.js:12:16:12:34 | { id: req.body.id } | mongooseModelClient.js:12:22:12:29 | req.body | mongooseModelClient.js:12:16:12:34 | { id: req.body.id } | This query depends on $@. | mongooseModelClient.js:12:22:12:29 | req.body | a user-provided value |
+| pg-promise-types.ts:8:17:8:21 | taint | pg-promise-types.ts:7:17:7:28 | req.params.x | pg-promise-types.ts:8:17:8:21 | taint | This query depends on $@. | pg-promise-types.ts:7:17:7:28 | req.params.x | a user-provided value |
+| pg-promise.js:9:10:9:14 | query | pg-promise.js:7:16:7:34 | req.params.category | pg-promise.js:9:10:9:14 | query | This query depends on $@. | pg-promise.js:7:16:7:34 | req.params.category | a user-provided value |
+| pg-promise.js:10:11:10:15 | query | pg-promise.js:7:16:7:34 | req.params.category | pg-promise.js:10:11:10:15 | query | This query depends on $@. | pg-promise.js:7:16:7:34 | req.params.category | a user-provided value |
+| pg-promise.js:11:17:11:21 | query | pg-promise.js:7:16:7:34 | req.params.category | pg-promise.js:11:17:11:21 | query | This query depends on $@. | pg-promise.js:7:16:7:34 | req.params.category | a user-provided value |
+| pg-promise.js:12:10:12:14 | query | pg-promise.js:7:16:7:34 | req.params.category | pg-promise.js:12:10:12:14 | query | This query depends on $@. | pg-promise.js:7:16:7:34 | req.params.category | a user-provided value |
+| pg-promise.js:13:12:13:16 | query | pg-promise.js:7:16:7:34 | req.params.category | pg-promise.js:13:12:13:16 | query | This query depends on $@. | pg-promise.js:7:16:7:34 | req.params.category | a user-provided value |
+| pg-promise.js:14:18:14:22 | query | pg-promise.js:7:16:7:34 | req.params.category | pg-promise.js:14:18:14:22 | query | This query depends on $@. | pg-promise.js:7:16:7:34 | req.params.category | a user-provided value |
+| pg-promise.js:15:11:15:15 | query | pg-promise.js:7:16:7:34 | req.params.category | pg-promise.js:15:11:15:15 | query | This query depends on $@. | pg-promise.js:7:16:7:34 | req.params.category | a user-provided value |
+| pg-promise.js:16:10:16:14 | query | pg-promise.js:7:16:7:34 | req.params.category | pg-promise.js:16:10:16:14 | query | This query depends on $@. | pg-promise.js:7:16:7:34 | req.params.category | a user-provided value |
+| pg-promise.js:17:16:17:20 | query | pg-promise.js:7:16:7:34 | req.params.category | pg-promise.js:17:16:17:20 | query | This query depends on $@. | pg-promise.js:7:16:7:34 | req.params.category | a user-provided value |
+| pg-promise.js:18:12:18:16 | query | pg-promise.js:7:16:7:34 | req.params.category | pg-promise.js:18:12:18:16 | query | This query depends on $@. | pg-promise.js:7:16:7:34 | req.params.category | a user-provided value |
+| pg-promise.js:19:13:19:17 | query | pg-promise.js:7:16:7:34 | req.params.category | pg-promise.js:19:13:19:17 | query | This query depends on $@. | pg-promise.js:7:16:7:34 | req.params.category | a user-provided value |
+| pg-promise.js:22:11:22:15 | query | pg-promise.js:7:16:7:34 | req.params.category | pg-promise.js:22:11:22:15 | query | This query depends on $@. | pg-promise.js:7:16:7:34 | req.params.category | a user-provided value |
+| pg-promise.js:30:13:30:25 | req.params.id | pg-promise.js:30:13:30:25 | req.params.id | pg-promise.js:30:13:30:25 | req.params.id | This query depends on $@. | pg-promise.js:30:13:30:25 | req.params.id | a user-provided value |
+| pg-promise.js:34:13:34:25 | req.params.id | pg-promise.js:34:13:34:25 | req.params.id | pg-promise.js:34:13:34:25 | req.params.id | This query depends on $@. | pg-promise.js:34:13:34:25 | req.params.id | a user-provided value |
+| pg-promise.js:38:13:42:5 | [\\n      ... n\\n    ] | pg-promise.js:39:7:39:19 | req.params.id | pg-promise.js:38:13:42:5 | [\\n      ... n\\n    ] | This query depends on $@. | pg-promise.js:39:7:39:19 | req.params.id | a user-provided value |
+| pg-promise.js:38:13:42:5 | [\\n      ... n\\n    ] | pg-promise.js:40:7:40:21 | req.params.name | pg-promise.js:38:13:42:5 | [\\n      ... n\\n    ] | This query depends on $@. | pg-promise.js:40:7:40:21 | req.params.name | a user-provided value |
+| pg-promise.js:38:13:42:5 | [\\n      ... n\\n    ] | pg-promise.js:41:7:41:20 | req.params.foo | pg-promise.js:38:13:42:5 | [\\n      ... n\\n    ] | This query depends on $@. | pg-promise.js:41:7:41:20 | req.params.foo | a user-provided value |
+| pg-promise.js:39:7:39:19 | req.params.id | pg-promise.js:39:7:39:19 | req.params.id | pg-promise.js:39:7:39:19 | req.params.id | This query depends on $@. | pg-promise.js:39:7:39:19 | req.params.id | a user-provided value |
+| pg-promise.js:40:7:40:21 | req.params.name | pg-promise.js:40:7:40:21 | req.params.name | pg-promise.js:40:7:40:21 | req.params.name | This query depends on $@. | pg-promise.js:40:7:40:21 | req.params.name | a user-provided value |
+| pg-promise.js:47:11:47:23 | req.params.id | pg-promise.js:47:11:47:23 | req.params.id | pg-promise.js:47:11:47:23 | req.params.id | This query depends on $@. | pg-promise.js:47:11:47:23 | req.params.id | a user-provided value |
+| pg-promise.js:54:11:54:23 | req.params.id | pg-promise.js:54:11:54:23 | req.params.id | pg-promise.js:54:11:54:23 | req.params.id | This query depends on $@. | pg-promise.js:54:11:54:23 | req.params.id | a user-provided value |
+| pg-promise.js:56:14:56:29 | req.params.title | pg-promise.js:56:14:56:29 | req.params.title | pg-promise.js:56:14:56:29 | req.params.title | This query depends on $@. | pg-promise.js:56:14:56:29 | req.params.title | a user-provided value |
+| pg-promise.js:60:20:60:24 | query | pg-promise.js:7:16:7:34 | req.params.category | pg-promise.js:60:20:60:24 | query | This query depends on $@. | pg-promise.js:7:16:7:34 | req.params.category | a user-provided value |
+| pg-promise.js:63:23:63:27 | query | pg-promise.js:7:16:7:34 | req.params.category | pg-promise.js:63:23:63:27 | query | This query depends on $@. | pg-promise.js:7:16:7:34 | req.params.category | a user-provided value |
+| pg-promise.js:64:16:64:20 | query | pg-promise.js:7:16:7:34 | req.params.category | pg-promise.js:64:16:64:20 | query | This query depends on $@. | pg-promise.js:7:16:7:34 | req.params.category | a user-provided value |
 | redis.js:10:16:10:27 | req.body.key | redis.js:10:16:10:23 | req.body | redis.js:10:16:10:27 | req.body.key | This query depends on $@. | redis.js:10:16:10:23 | req.body | a user-provided value |
 | redis.js:18:16:18:18 | key | redis.js:12:15:12:22 | req.body | redis.js:18:16:18:18 | key | This query depends on $@. | redis.js:12:15:12:22 | req.body | a user-provided value |
 | redis.js:19:43:19:45 | key | redis.js:12:15:12:22 | req.body | redis.js:19:43:19:45 | key | This query depends on $@. | redis.js:12:15:12:22 | req.body | a user-provided value |
diff --git a/javascript/ql/test/query-tests/Security/CWE-089/untyped/pg-promise-types.ts b/javascript/ql/test/query-tests/Security/CWE-089/untyped/pg-promise-types.ts
new file mode 100644
index 00000000000..eaf46ad8cf8
--- /dev/null
+++ b/javascript/ql/test/query-tests/Security/CWE-089/untyped/pg-promise-types.ts
@@ -0,0 +1,13 @@
+import { IDatabase } from "pg-promise";
+
+export class Foo {
+  db: IDatabase;
+
+  onRequest(req, res) {
+    let taint = req.params.x;
+    this.db.one(taint); // NOT OK
+    res.end();
+  }
+}
+
+require('express')().get('/foo', (req, res) => new Foo().onRequest(req, res));
diff --git a/javascript/ql/test/query-tests/Security/CWE-089/untyped/pg-promise.js b/javascript/ql/test/query-tests/Security/CWE-089/untyped/pg-promise.js
new file mode 100644
index 00000000000..07d92a753ec
--- /dev/null
+++ b/javascript/ql/test/query-tests/Security/CWE-089/untyped/pg-promise.js
@@ -0,0 +1,66 @@
+const pgp = require('pg-promise')();
+
+require('express')().get('/foo', (req, res) => {
+  const db = pgp(process.env['DB_CONNECTION_STRING']);
+
+  var query = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='"
+             + req.params.category + "' ORDER BY PRICE";
+  
+  db.any(query); // NOT OK
+  db.many(query); // NOT OK
+  db.manyOrNone(query); // NOT OK
+  db.map(query); // NOT OK
+  db.multi(query); // NOT OK
+  db.multiResult(query); // NOT OK
+  db.none(query); // NOT OK
+  db.one(query); // NOT OK
+  db.oneOrNone(query); // NOT OK
+  db.query(query); // NOT OK
+  db.result(query); // NOT OK
+  
+  db.one({
+    text: query // NOT OK
+  });
+  db.one({
+    text: 'SELECT * FROM news where id = $1', // OK
+    values: req.params.id, // OK
+  });
+  db.one({
+    text: 'SELECT * FROM news where id = $1:raw',
+    values: req.params.id, // NOT OK - interpreted as raw parameter
+  });
+  db.one({
+    text: 'SELECT * FROM news where id = $1^',
+    values: req.params.id, // NOT OK
+  });
+  db.one({
+    text: 'SELECT * FROM news where id = $1:raw AND name = $2:raw AND foo = $3',
+    values: [
+      req.params.id, // NOT OK
+      req.params.name, // NOT OK
+      req.params.foo, // OK - not using raw interpolation
+    ]
+  });
+  db.one({
+    text: 'SELECT * FROM news where id = ${id}:raw AND name = ${name}',
+    values: {
+      id: req.params.id, // NOT OK
+      name: req.params.name, // OK - not using raw interpolation
+    }
+  });
+  db.one({
+    text: "SELECT * FROM news where id = ${id}:value AND name LIKE '%${name}:value%' AND title LIKE \"%${title}:value%\"",
+    values: {
+      id: req.params.id, // NOT OK
+      name: req.params.name, // OK - :value cannot break out of single quotes
+      title: req.params.title, // NOT OK - enclosed by wrong type of quote
+    }
+  });
+  db.task(t => {
+      return t.one(query); // NOT OK
+  });
+  db.task(
+    { cnd: t => t.one(query) }, // NOT OK
+    t => t.one(query) // NOT OK
+  );
+});
diff --git a/javascript/ql/test/query-tests/Security/CWE-295/DisablingCertificateValidation.expected b/javascript/ql/test/query-tests/Security/CWE-295/DisablingCertificateValidation.expected
index d028c5b3b30..9b21e2f5d8b 100644
--- a/javascript/ql/test/query-tests/Security/CWE-295/DisablingCertificateValidation.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-295/DisablingCertificateValidation.expected
@@ -1,3 +1,4 @@
+| tst2.js:8:5:8:29 | rejectU ... : false | Disabling certificate validation is strongly discouraged. |
 | tst.js:15:3:15:27 | rejectU ... : false | Disabling certificate validation is strongly discouraged. |
 | tst.js:18:1:18:40 | process ... HORIZED | Disabling certificate validation is strongly discouraged. |
 | tst.js:21:3:21:27 | rejectU ... : false | Disabling certificate validation is strongly discouraged. |
diff --git a/javascript/ql/test/query-tests/Security/CWE-295/tst2.js b/javascript/ql/test/query-tests/Security/CWE-295/tst2.js
new file mode 100644
index 00000000000..50f5ae27714
--- /dev/null
+++ b/javascript/ql/test/query-tests/Security/CWE-295/tst2.js
@@ -0,0 +1,24 @@
+const request = require('request');
+
+let requestOptions = {
+    headers: {
+        "content-type": "application/json",
+        "accept": "application/json"
+    },
+    rejectUnauthorized: false,
+    requestCert: true,
+    agent: false
+}
+
+module.exports.post = (url, requestBody, apiContext) => {
+    Object.assign(requestOptions, {
+        body: JSON.stringify(requestBody),
+        headers : Object.assign(requestOptions.headers, apiContext)
+    })
+
+    return request.post(url, requestOptions).then((res) => {
+        return Promise.resolve(res.body);
+    }).catch((err) => {
+        return Promise.resolve(err);
+    })
+}
\ No newline at end of file
diff --git a/javascript/ql/test/query-tests/Security/CWE-918/RequestForgery.expected b/javascript/ql/test/query-tests/Security/CWE-918/RequestForgery.expected
index 06a55b512a0..cdad8e001ac 100644
--- a/javascript/ql/test/query-tests/Security/CWE-918/RequestForgery.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-918/RequestForgery.expected
@@ -57,6 +57,37 @@ nodes
 | tst.js:74:29:74:35 | req.url |
 | tst.js:76:19:76:25 | tainted |
 | tst.js:76:19:76:25 | tainted |
+| tst.js:83:38:83:43 | param1 |
+| tst.js:83:38:83:43 | param1 |
+| tst.js:84:19:84:24 | param1 |
+| tst.js:84:19:84:24 | param1 |
+| tst.js:90:19:90:28 | ctx.params |
+| tst.js:90:19:90:28 | ctx.params |
+| tst.js:90:19:90:32 | ctx.params.foo |
+| tst.js:90:19:90:32 | ctx.params.foo |
+| tst.js:92:19:92:28 | ctx.params |
+| tst.js:92:19:92:28 | ctx.params |
+| tst.js:92:19:92:32 | ctx.params.foo |
+| tst.js:92:19:92:32 | ctx.params.foo |
+| tst.js:98:9:98:52 | tainted |
+| tst.js:98:19:98:42 | url.par ... , true) |
+| tst.js:98:19:98:48 | url.par ... ).query |
+| tst.js:98:19:98:52 | url.par ... ery.url |
+| tst.js:98:29:98:35 | req.url |
+| tst.js:98:29:98:35 | req.url |
+| tst.js:100:19:100:25 | tainted |
+| tst.js:100:19:100:25 | tainted |
+| tst.js:108:11:108:27 | url |
+| tst.js:108:17:108:27 | request.url |
+| tst.js:108:17:108:27 | request.url |
+| tst.js:109:27:109:29 | url |
+| tst.js:109:27:109:29 | url |
+| tst.js:115:11:115:42 | url |
+| tst.js:115:17:115:42 | new URL ... , base) |
+| tst.js:115:25:115:35 | request.url |
+| tst.js:115:25:115:35 | request.url |
+| tst.js:117:27:117:29 | url |
+| tst.js:117:27:117:29 | url |
 edges
 | tst.js:14:9:14:52 | tainted | tst.js:18:13:18:19 | tainted |
 | tst.js:14:9:14:52 | tainted | tst.js:18:13:18:19 | tainted |
@@ -113,6 +144,34 @@ edges
 | tst.js:74:19:74:52 | url.par ... ery.url | tst.js:74:9:74:52 | tainted |
 | tst.js:74:29:74:35 | req.url | tst.js:74:19:74:42 | url.par ... , true) |
 | tst.js:74:29:74:35 | req.url | tst.js:74:19:74:42 | url.par ... , true) |
+| tst.js:83:38:83:43 | param1 | tst.js:84:19:84:24 | param1 |
+| tst.js:83:38:83:43 | param1 | tst.js:84:19:84:24 | param1 |
+| tst.js:83:38:83:43 | param1 | tst.js:84:19:84:24 | param1 |
+| tst.js:83:38:83:43 | param1 | tst.js:84:19:84:24 | param1 |
+| tst.js:90:19:90:28 | ctx.params | tst.js:90:19:90:32 | ctx.params.foo |
+| tst.js:90:19:90:28 | ctx.params | tst.js:90:19:90:32 | ctx.params.foo |
+| tst.js:90:19:90:28 | ctx.params | tst.js:90:19:90:32 | ctx.params.foo |
+| tst.js:90:19:90:28 | ctx.params | tst.js:90:19:90:32 | ctx.params.foo |
+| tst.js:92:19:92:28 | ctx.params | tst.js:92:19:92:32 | ctx.params.foo |
+| tst.js:92:19:92:28 | ctx.params | tst.js:92:19:92:32 | ctx.params.foo |
+| tst.js:92:19:92:28 | ctx.params | tst.js:92:19:92:32 | ctx.params.foo |
+| tst.js:92:19:92:28 | ctx.params | tst.js:92:19:92:32 | ctx.params.foo |
+| tst.js:98:9:98:52 | tainted | tst.js:100:19:100:25 | tainted |
+| tst.js:98:9:98:52 | tainted | tst.js:100:19:100:25 | tainted |
+| tst.js:98:19:98:42 | url.par ... , true) | tst.js:98:19:98:48 | url.par ... ).query |
+| tst.js:98:19:98:48 | url.par ... ).query | tst.js:98:19:98:52 | url.par ... ery.url |
+| tst.js:98:19:98:52 | url.par ... ery.url | tst.js:98:9:98:52 | tainted |
+| tst.js:98:29:98:35 | req.url | tst.js:98:19:98:42 | url.par ... , true) |
+| tst.js:98:29:98:35 | req.url | tst.js:98:19:98:42 | url.par ... , true) |
+| tst.js:108:11:108:27 | url | tst.js:109:27:109:29 | url |
+| tst.js:108:11:108:27 | url | tst.js:109:27:109:29 | url |
+| tst.js:108:17:108:27 | request.url | tst.js:108:11:108:27 | url |
+| tst.js:108:17:108:27 | request.url | tst.js:108:11:108:27 | url |
+| tst.js:115:11:115:42 | url | tst.js:117:27:117:29 | url |
+| tst.js:115:11:115:42 | url | tst.js:117:27:117:29 | url |
+| tst.js:115:17:115:42 | new URL ... , base) | tst.js:115:11:115:42 | url |
+| tst.js:115:25:115:35 | request.url | tst.js:115:17:115:42 | new URL ... , base) |
+| tst.js:115:25:115:35 | request.url | tst.js:115:17:115:42 | new URL ... , base) |
 #select
 | tst.js:18:5:18:20 | request(tainted) | tst.js:14:29:14:35 | req.url | tst.js:18:13:18:19 | tainted | The $@ of this request depends on $@. | tst.js:18:13:18:19 | tainted | URL | tst.js:14:29:14:35 | req.url | a user-provided value |
 | tst.js:20:5:20:24 | request.get(tainted) | tst.js:14:29:14:35 | req.url | tst.js:20:17:20:23 | tainted | The $@ of this request depends on $@. | tst.js:20:17:20:23 | tainted | URL | tst.js:14:29:14:35 | req.url | a user-provided value |
@@ -130,3 +189,9 @@ edges
 | tst.js:64:3:64:38 | client. ... inted}) | tst.js:58:29:58:35 | req.url | tst.js:64:30:64:36 | tainted | The $@ of this request depends on $@. | tst.js:64:30:64:36 | tainted | URL | tst.js:58:29:58:35 | req.url | a user-provided value |
 | tst.js:68:3:68:38 | client. ... inted}) | tst.js:58:29:58:35 | req.url | tst.js:68:30:68:36 | tainted | The $@ of this request depends on $@. | tst.js:68:30:68:36 | tainted | URL | tst.js:58:29:58:35 | req.url | a user-provided value |
 | tst.js:76:5:76:26 | JSDOM.f ... ainted) | tst.js:74:29:74:35 | req.url | tst.js:76:19:76:25 | tainted | The $@ of this request depends on $@. | tst.js:76:19:76:25 | tainted | URL | tst.js:74:29:74:35 | req.url | a user-provided value |
+| tst.js:84:5:84:25 | JSDOM.f ... param1) | tst.js:83:38:83:43 | param1 | tst.js:84:19:84:24 | param1 | The $@ of this request depends on $@. | tst.js:84:19:84:24 | param1 | URL | tst.js:83:38:83:43 | param1 | a user-provided value |
+| tst.js:90:5:90:33 | JSDOM.f ... ms.foo) | tst.js:90:19:90:28 | ctx.params | tst.js:90:19:90:32 | ctx.params.foo | The $@ of this request depends on $@. | tst.js:90:19:90:32 | ctx.params.foo | URL | tst.js:90:19:90:28 | ctx.params | a user-provided value |
+| tst.js:92:5:92:33 | JSDOM.f ... ms.foo) | tst.js:92:19:92:28 | ctx.params | tst.js:92:19:92:32 | ctx.params.foo | The $@ of this request depends on $@. | tst.js:92:19:92:32 | ctx.params.foo | URL | tst.js:92:19:92:28 | ctx.params | a user-provided value |
+| tst.js:100:5:100:26 | new Web ... ainted) | tst.js:98:29:98:35 | req.url | tst.js:100:19:100:25 | tainted | The $@ of this request depends on $@. | tst.js:100:19:100:25 | tainted | URL | tst.js:98:29:98:35 | req.url | a user-provided value |
+| tst.js:109:20:109:30 | new ws(url) | tst.js:108:17:108:27 | request.url | tst.js:109:27:109:29 | url | The $@ of this request depends on $@. | tst.js:109:27:109:29 | url | URL | tst.js:108:17:108:27 | request.url | a user-provided value |
+| tst.js:117:20:117:30 | new ws(url) | tst.js:115:25:115:35 | request.url | tst.js:117:27:117:29 | url | The $@ of this request depends on $@. | tst.js:117:27:117:29 | url | URL | tst.js:115:25:115:35 | request.url | a user-provided value |
diff --git a/javascript/ql/test/query-tests/Security/CWE-918/tst.js b/javascript/ql/test/query-tests/Security/CWE-918/tst.js
index d5951f648b4..23f1e5b4dc7 100644
--- a/javascript/ql/test/query-tests/Security/CWE-918/tst.js
+++ b/javascript/ql/test/query-tests/Security/CWE-918/tst.js
@@ -74,4 +74,46 @@ var server = http.createServer(async function(req, res) {
     var tainted = url.parse(req.url, true).query.url;
 
     JSDOM.fromURL(tainted); // NOT OK
-});
\ No newline at end of file
+});
+
+var route = require('koa-route');
+var Koa = require('koa');
+var app = new Koa();
+
+app.use(route.get('/pets', (context, param1, param2, param3) => { 
+    JSDOM.fromURL(param1); // NOT OK
+}));
+
+const router = require('koa-router')();
+const app = new Koa();
+router.get('/', async (ctx, next) => {
+    JSDOM.fromURL(ctx.params.foo); // NOT OK
+}).post('/', async (ctx, next) => {
+    JSDOM.fromURL(ctx.params.foo); // NOT OK
+});
+app.use(router.routes());
+
+import {JSDOM} from "jsdom";
+var server = http.createServer(async function(req, res) {
+    var tainted = url.parse(req.url, true).query.url;
+
+    new WebSocket(tainted); // NOT OK
+});
+
+
+import * as ws from 'ws';
+
+new ws.Server({ port: 8080 }).on('connection', function(socket, request) {
+  socket.on('message', function(message) {
+    const url = request.url;
+    const socket = new ws(url);
+  });
+});
+
+new ws.Server({ port: 8080 }).on('connection', function (socket, request) {
+  socket.on('message', function (message) {
+    const url = new URL(request.url, base);
+    const target = new URL(url.pathname, base);
+    const socket = new ws(url);
+  });
+});
diff --git a/javascript/ql/test/query-tests/Summary/LinesOfCode.expected b/javascript/ql/test/query-tests/Summary/LinesOfCode.expected
new file mode 100644
index 00000000000..0c89049708a
--- /dev/null
+++ b/javascript/ql/test/query-tests/Summary/LinesOfCode.expected
@@ -0,0 +1 @@
+| 12 |
diff --git a/javascript/ql/test/query-tests/Summary/LinesOfCode.qlref b/javascript/ql/test/query-tests/Summary/LinesOfCode.qlref
new file mode 100644
index 00000000000..ac8650d6dcc
--- /dev/null
+++ b/javascript/ql/test/query-tests/Summary/LinesOfCode.qlref
@@ -0,0 +1 @@
+Summary/LinesOfCode.ql
\ No newline at end of file
diff --git a/javascript/ql/test/query-tests/Summary/src/.eslintrc.yml b/javascript/ql/test/query-tests/Summary/src/.eslintrc.yml
new file mode 100644
index 00000000000..2b4028c44b8
--- /dev/null
+++ b/javascript/ql/test/query-tests/Summary/src/.eslintrc.yml
@@ -0,0 +1,2 @@
+rules:
+  semi: error
diff --git a/javascript/ql/test/query-tests/Summary/src/externs.js b/javascript/ql/test/query-tests/Summary/src/externs.js
new file mode 100644
index 00000000000..c8e9cec9bc4
--- /dev/null
+++ b/javascript/ql/test/query-tests/Summary/src/externs.js
@@ -0,0 +1,8 @@
+/**
+ * @externs
+ */
+
+// Should not be counted
+
+function Object() {}
+function String() {}
\ No newline at end of file
diff --git a/javascript/ql/test/query-tests/Summary/src/javascript_file.js b/javascript/ql/test/query-tests/Summary/src/javascript_file.js
new file mode 100644
index 00000000000..e80d023d0d8
--- /dev/null
+++ b/javascript/ql/test/query-tests/Summary/src/javascript_file.js
@@ -0,0 +1,7 @@
+function foo(x) {
+    return x;
+}
+
+function bar(y) {
+    return y;
+}
diff --git a/javascript/ql/test/query-tests/Summary/src/package.json b/javascript/ql/test/query-tests/Summary/src/package.json
new file mode 100644
index 00000000000..9ab61fa5ee4
--- /dev/null
+++ b/javascript/ql/test/query-tests/Summary/src/package.json
@@ -0,0 +1,6 @@
+{
+    "private": true,
+    "devDependencies": {
+        "typescript": "*"
+    }
+}
diff --git a/javascript/ql/test/query-tests/Summary/src/typescript_file.ts b/javascript/ql/test/query-tests/Summary/src/typescript_file.ts
new file mode 100644
index 00000000000..e922c80dfdb
--- /dev/null
+++ b/javascript/ql/test/query-tests/Summary/src/typescript_file.ts
@@ -0,0 +1,7 @@
+export interface Foo {
+    x: number;
+}
+
+export function getX(f: Foo) {
+    return f.x;
+}
diff --git a/javascript/ql/test/query-tests/external/DuplicateFunction/DuplicateFunction.expected b/javascript/ql/test/query-tests/external/DuplicateFunction/DuplicateFunction.expected
index 10e41c8dde4..e69de29bb2d 100644
--- a/javascript/ql/test/query-tests/external/DuplicateFunction/DuplicateFunction.expected
+++ b/javascript/ql/test/query-tests/external/DuplicateFunction/DuplicateFunction.expected
@@ -1,6 +0,0 @@
-| d/tst.js:1:1:1:14 | functio ... s[1];\\n} | 100% of statements in function f are duplicated in $@. | d/tst.js:12:1:12:14 | functio ... s[1];\\n} | function g |
-| d/tst.js:1:1:1:14 | functio ... s[1];\\n} | 100% of statements in function f are duplicated in $@. | d/tst.js:23:10:23:21 | functio ... s[1];\\n} | function g2 |
-| d/tst.js:12:1:12:14 | functio ... s[1];\\n} | 100% of statements in function g are duplicated in $@. | d/tst.js:1:1:1:14 | functio ... s[1];\\n} | function f |
-| d/tst.js:12:1:12:14 | functio ... s[1];\\n} | 100% of statements in function g are duplicated in $@. | d/tst.js:23:10:23:21 | functio ... s[1];\\n} | function g2 |
-| d/tst.js:23:10:23:21 | functio ... s[1];\\n} | 100% of statements in function g2 are duplicated in $@. | d/tst.js:1:1:1:14 | functio ... s[1];\\n} | function f |
-| d/tst.js:23:10:23:21 | functio ... s[1];\\n} | 100% of statements in function g2 are duplicated in $@. | d/tst.js:12:1:12:14 | functio ... s[1];\\n} | function g |
diff --git a/javascript/ql/test/query-tests/external/DuplicateToplevel/DuplicateToplevel.expected b/javascript/ql/test/query-tests/external/DuplicateToplevel/DuplicateToplevel.expected
index b2430574fdd..e69de29bb2d 100644
--- a/javascript/ql/test/query-tests/external/DuplicateToplevel/DuplicateToplevel.expected
+++ b/javascript/ql/test/query-tests/external/DuplicateToplevel/DuplicateToplevel.expected
@@ -1,6 +0,0 @@
-| a.js:1:1:1:1 | <toplevel> | 90% of statements in this script are duplicated in $@. | e.js:1:1:1:1 | <toplevel> | another script |
-| a.js:1:1:1:1 | <toplevel> | 100% of statements in this script are duplicated in $@. | b.js:1:1:1:1 | <toplevel> | another script |
-| b.js:1:1:1:1 | <toplevel> | 90% of statements in this script are duplicated in $@. | e.js:1:1:1:1 | <toplevel> | another script |
-| b.js:1:1:1:1 | <toplevel> | 100% of statements in this script are duplicated in $@. | a.js:1:1:1:1 | <toplevel> | another script |
-| e.js:1:1:1:1 | <toplevel> | 90% of statements in this script are duplicated in $@. | a.js:1:1:1:1 | <toplevel> | another script |
-| e.js:1:1:1:1 | <toplevel> | 90% of statements in this script are duplicated in $@. | b.js:1:1:1:1 | <toplevel> | another script |
diff --git a/javascript/ql/test/query-tests/external/SimilarFunction/SimilarFunction.expected b/javascript/ql/test/query-tests/external/SimilarFunction/SimilarFunction.expected
index 264dab311e9..e69de29bb2d 100644
--- a/javascript/ql/test/query-tests/external/SimilarFunction/SimilarFunction.expected
+++ b/javascript/ql/test/query-tests/external/SimilarFunction/SimilarFunction.expected
@@ -1,4 +0,0 @@
-| tst.js:1:1:1:18 | functio ...  = x;\\n} | 92% of statements in function f are similar to statements in $@. | tst.js:17:1:17:18 | functio ...  = a;\\n} | function g |
-| tst.js:1:1:1:18 | functio ...  = x;\\n} | 92% of statements in function f are similar to statements in $@. | tst.js:33:9:33:24 | functio ...  = a;\\n} | function h |
-| tst.js:17:1:17:18 | functio ...  = a;\\n} | 92% of statements in function g are similar to statements in $@. | tst.js:1:1:1:18 | functio ...  = x;\\n} | function f |
-| tst.js:33:9:33:24 | functio ...  = a;\\n} | 92% of statements in function h are similar to statements in $@. | tst.js:1:1:1:18 | functio ...  = x;\\n} | function f |
diff --git a/javascript/ql/test/query-tests/external/SimilarToplevel/SimilarToplevel.expected b/javascript/ql/test/query-tests/external/SimilarToplevel/SimilarToplevel.expected
index 6f2458e0950..e69de29bb2d 100644
--- a/javascript/ql/test/query-tests/external/SimilarToplevel/SimilarToplevel.expected
+++ b/javascript/ql/test/query-tests/external/SimilarToplevel/SimilarToplevel.expected
@@ -1 +0,0 @@
-| a.js:1:1:1:7 | <toplevel> | 94% of statements in this script are similar to statements in $@. | b.js:1:1:1:7 | <toplevel> | another script |
diff --git a/python/change-notes/2021-03-12-small-api-enhancements.md b/python/change-notes/2021-03-12-small-api-enhancements.md
new file mode 100644
index 00000000000..8d3c5c67b5f
--- /dev/null
+++ b/python/change-notes/2021-03-12-small-api-enhancements.md
@@ -0,0 +1,3 @@
+lgtm,codescanning
+* The class ParameterNode now extends LocalSourceNode, thus making methods like flowsTo available.
+* The new predicate `parameterNode` can now be used to map from a `Parameter` to a data-flow node.
diff --git a/python/change-notes/2021-03-18-yaml-handle-C-based-loaders.md b/python/change-notes/2021-03-18-yaml-handle-C-based-loaders.md
new file mode 100644
index 00000000000..054d10dbb0b
--- /dev/null
+++ b/python/change-notes/2021-03-18-yaml-handle-C-based-loaders.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* Improved modeling of the `PyYAML` PyPI package, so we now correctly treat `CSafeLoader` and `CBaseLoader` as being safe loaders that can not lead to code execution.
diff --git a/python/change-notes/2021-03-22-django-queryset-chains.md b/python/change-notes/2021-03-22-django-queryset-chains.md
new file mode 100644
index 00000000000..116a7573360
--- /dev/null
+++ b/python/change-notes/2021-03-22-django-queryset-chains.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* Improved modeling of `django` to recognize QuerySet chains such as `User.objects.using("db-name").exclude(username="admin").extra("some sql")`. This can lead to new results for `py/sql-injection`.
diff --git a/python/change-notes/2021-03-22-getacall-callcfgnode.md b/python/change-notes/2021-03-22-getacall-callcfgnode.md
new file mode 100644
index 00000000000..95b32f1903f
--- /dev/null
+++ b/python/change-notes/2021-03-22-getacall-callcfgnode.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* The `API::Node::getACall` method now has the more specific return type `DataFlow::CallCfgNode`, which improves the ease of use when working with calls to API functions.
diff --git a/python/change-notes/2021-03-23-django-forms-fields-classes.md b/python/change-notes/2021-03-23-django-forms-fields-classes.md
new file mode 100644
index 00000000000..b45764da8a6
--- /dev/null
+++ b/python/change-notes/2021-03-23-django-forms-fields-classes.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* Improved modeling of `django` to recognize sources of remote user input (`RemoteFlowSource`) in Django forms (`django.forms.Form`) and fields (`django.forms.Field`) subclasses.
diff --git a/python/change-notes/2021-03-25-remove-legacy.md b/python/change-notes/2021-03-25-remove-legacy.md
new file mode 100644
index 00000000000..32ef43e9216
--- /dev/null
+++ b/python/change-notes/2021-03-25-remove-legacy.md
@@ -0,0 +1,3 @@
+lgtm,codescanning
+* The legacy code duplication library has been removed.
+* Legacy filter queries have been removed.
diff --git a/python/change-notes/2021-04-13-pep249-api-graphs.md b/python/change-notes/2021-04-13-pep249-api-graphs.md
new file mode 100644
index 00000000000..fb8e2f0b1fb
--- /dev/null
+++ b/python/change-notes/2021-04-13-pep249-api-graphs.md
@@ -0,0 +1,4 @@
+lgtm,codescanning
+* Modeling of libraries supporting PEP249 has been changed to use API graphs. When defining new
+  models, the relevant extension point is now `PEP249ModuleApiNode` in the `PEP249` module, instead
+  of `PEP249Module`. The latter class has now been deprecated.
diff --git a/python/change-notes/2021-04-13-werkzeug-api-graphs.md b/python/change-notes/2021-04-13-werkzeug-api-graphs.md
new file mode 100644
index 00000000000..041e5a31a2b
--- /dev/null
+++ b/python/change-notes/2021-04-13-werkzeug-api-graphs.md
@@ -0,0 +1,5 @@
+lgtm,codescanning
+* The Werkzeug model has been changed to use API graphs. When defining new models for classes based
+  on the `MultiDict` and `FileStorage` classes in `werkzeug.datastructures`, the relevant extension
+  points are now the two `InstanceSourceApiNode` classes in the `semmle.python.frameworks.Werkzeug`
+  module, instead of `InstanceSource`. The latter classes have now been deprecated.
diff --git a/python/ql/src/Filters/NotGenerated.ql b/python/ql/src/Filters/NotGenerated.ql
deleted file mode 100644
index e1efbfd42e3..00000000000
--- a/python/ql/src/Filters/NotGenerated.ql
+++ /dev/null
@@ -1,14 +0,0 @@
-/**
- * @name Filter: non-generated files
- * @description Only keep results that aren't (or don't appear to be) generated.
- * @kind problem
- * @id py/not-generated-file-filter
- */
-
-import python
-import external.DefectFilter
-import semmle.python.filters.GeneratedCode
-
-from DefectResult res
-where not exists(GeneratedFile f | res.getFile() = f)
-select res, res.getMessage()
diff --git a/python/ql/src/Filters/NotTest.ql b/python/ql/src/Filters/NotTest.ql
deleted file mode 100644
index 56650e4ff15..00000000000
--- a/python/ql/src/Filters/NotTest.ql
+++ /dev/null
@@ -1,14 +0,0 @@
-/**
- * @name Filter: non-test files
- * @description Only keep results that aren't in tests
- * @kind problem
- * @id py/not-test-file-filter
- */
-
-import python
-import external.DefectFilter
-import semmle.python.filters.Tests
-
-from DefectResult res
-where not exists(TestScope s | contains(s.getLocation(), res))
-select res, res.getMessage()
diff --git a/python/ql/src/Lexical/FCommentedOutCode.ql b/python/ql/src/Lexical/FCommentedOutCode.ql
index e988f4074c7..a0ab7f01c99 100644
--- a/python/ql/src/Lexical/FCommentedOutCode.ql
+++ b/python/ql/src/Lexical/FCommentedOutCode.ql
@@ -4,7 +4,6 @@
  * @kind treemap
  * @treemap.warnOn highValues
  * @metricType file
- * @precision high
  * @tags maintainability
  * @id py/lines-of-commented-out-code-in-files
  */
diff --git a/python/ql/src/Metrics/Dependencies/ExternalDependencies.ql b/python/ql/src/Metrics/Dependencies/ExternalDependencies.ql
index 5efec24c7b6..a810211e631 100644
--- a/python/ql/src/Metrics/Dependencies/ExternalDependencies.ql
+++ b/python/ql/src/Metrics/Dependencies/ExternalDependencies.ql
@@ -5,7 +5,6 @@
  * @kind treemap
  * @treemap.warnOn highValues
  * @metricType externalDependency
- * @precision medium
  * @id py/external-dependencies
  */
 
diff --git a/python/ql/src/Metrics/FLinesOfCode.ql b/python/ql/src/Metrics/FLinesOfCode.ql
index a46698c7087..84c952f9267 100644
--- a/python/ql/src/Metrics/FLinesOfCode.ql
+++ b/python/ql/src/Metrics/FLinesOfCode.ql
@@ -6,7 +6,6 @@
  * @treemap.warnOn highValues
  * @metricType file
  * @metricAggregate avg sum max
- * @precision very-high
  * @tags maintainability
  * @id py/lines-of-code-in-files
  */
diff --git a/python/ql/src/Metrics/FLinesOfComments.ql b/python/ql/src/Metrics/FLinesOfComments.ql
index b426a0b25f3..18a234eef67 100644
--- a/python/ql/src/Metrics/FLinesOfComments.ql
+++ b/python/ql/src/Metrics/FLinesOfComments.ql
@@ -6,7 +6,6 @@
  * @treemap.warnOn lowValues
  * @metricType file
  * @metricAggregate avg sum max
- * @precision very-high
  * @id py/lines-of-comments-in-files
  */
 
diff --git a/python/ql/src/Metrics/FLinesOfDuplicatedCode.ql b/python/ql/src/Metrics/FLinesOfDuplicatedCode.ql
index 3b503f697d1..54a45e986df 100644
--- a/python/ql/src/Metrics/FLinesOfDuplicatedCode.ql
+++ b/python/ql/src/Metrics/FLinesOfDuplicatedCode.ql
@@ -7,21 +7,12 @@
  * @treemap.warnOn highValues
  * @metricType file
  * @metricAggregate avg sum max
- * @precision high
  * @tags testability
  * @id py/duplicated-lines-in-files
  */
 
 import python
-import external.CodeDuplication
 
 from File f, int n
-where
-  n =
-    count(int line |
-      exists(DuplicateBlock d | d.sourceFile() = f |
-        line in [d.sourceStartLine() .. d.sourceEndLine()] and
-        not allowlistedLineForDuplication(f, line)
-      )
-    )
+where none()
 select f, n order by n desc
diff --git a/python/ql/src/Metrics/FLinesOfSimilarCode.ql b/python/ql/src/Metrics/FLinesOfSimilarCode.ql
index 714286a8047..354d3d2644b 100644
--- a/python/ql/src/Metrics/FLinesOfSimilarCode.ql
+++ b/python/ql/src/Metrics/FLinesOfSimilarCode.ql
@@ -7,21 +7,12 @@
  * @treemap.warnOn highValues
  * @metricType file
  * @metricAggregate avg sum max
- * @precision high
  * @tags testability
  * @id py/similar-lines-in-files
  */
 
 import python
-import external.CodeDuplication
 
 from File f, int n
-where
-  n =
-    count(int line |
-      exists(SimilarBlock d | d.sourceFile() = f |
-        line in [d.sourceStartLine() .. d.sourceEndLine()] and
-        not allowlistedLineForDuplication(f, line)
-      )
-    )
+where none()
 select f, n order by n desc
diff --git a/python/ql/src/Metrics/FNumberOfTests.ql b/python/ql/src/Metrics/FNumberOfTests.ql
index 34a76c70d33..65711993bb1 100644
--- a/python/ql/src/Metrics/FNumberOfTests.ql
+++ b/python/ql/src/Metrics/FNumberOfTests.ql
@@ -5,7 +5,6 @@
  * @treemap.warnOn lowValues
  * @metricType file
  * @metricAggregate avg sum max
- * @precision medium
  * @id py/tests-in-files
  */
 
diff --git a/python/ql/src/experimental/Classes/NamingConventionsClasses.qhelp b/python/ql/src/experimental/Classes/NamingConventionsClasses.qhelp
new file mode 100644
index 00000000000..a928668dc6f
--- /dev/null
+++ b/python/ql/src/experimental/Classes/NamingConventionsClasses.qhelp
@@ -0,0 +1,30 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+
+
+<overview>
+<p>A class name that begins with a lowercase letter does not follow standard
+naming conventions. This decreases code readability. For example, <code>class background</code>.
+</p>
+
+</overview>
+<recommendation>
+
+<p>
+Write the class name beginning with an uppercase letter. For example, <code>class Background</code>.
+</p>
+
+</recommendation>
+
+<references>
+
+<li>
+  Guido van Rossum, Barry Warsaw, Nick Coghlan <em>PEP 8 -- Style Guide for Python Code</em>
+  <a href="https://www.python.org/dev/peps/pep-0008/#class-names">Python Class Names</a>
+</li>
+
+</references>
+
+</qhelp>
diff --git a/python/ql/src/experimental/Classes/NamingConventionsClasses.ql b/python/ql/src/experimental/Classes/NamingConventionsClasses.ql
new file mode 100644
index 00000000000..0ab11b4197c
--- /dev/null
+++ b/python/ql/src/experimental/Classes/NamingConventionsClasses.ql
@@ -0,0 +1,28 @@
+/**
+ * @name Misnamed class
+ * @description A class name that begins with a lowercase letter decreases readability.
+ * @kind problem
+ * @problem.severity recommendation
+ * @id py/misnamed-class
+ * @tags maintainability
+ */
+
+import python
+
+predicate lower_case_class(Class c) {
+  exists(string first_char |
+    first_char = c.getName().prefix(1) and
+    not first_char = first_char.toUpperCase()
+  )
+}
+
+from Class c
+where
+  c.inSource() and
+  lower_case_class(c) and
+  not exists(Class c1 |
+    c1 != c and
+    c1.getLocation().getFile() = c.getLocation().getFile() and
+    lower_case_class(c1)
+  )
+select c, "Class names should start in uppercase."
diff --git a/python/ql/src/experimental/Functions/NamingConventionsFunctions.qhelp b/python/ql/src/experimental/Functions/NamingConventionsFunctions.qhelp
new file mode 100644
index 00000000000..b4ff738782c
--- /dev/null
+++ b/python/ql/src/experimental/Functions/NamingConventionsFunctions.qhelp
@@ -0,0 +1,30 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+
+
+<overview>
+<p>A function name that begins with an uppercase letter does not follow standard
+naming conventions. This decreases code readability. For example, <code>Jump</code>.
+</p>
+
+</overview>
+<recommendation>
+
+<p>
+Write the function name beginning with an lowercase letter. For example, <code>jump</code>.
+</p>
+
+</recommendation>
+
+<references>
+
+<li>
+  Guido van Rossum, Barry Warsaw, Nick Coghlan <em>PEP 8 -- Style Guide for Python Code</em>
+  <a href="https://www.python.org/dev/peps/pep-0008/#function-and-variable-names">Python Function and Variable Names</a>
+</li>
+
+</references>
+
+</qhelp>
diff --git a/python/ql/src/experimental/Functions/NamingConventionsFunctions.ql b/python/ql/src/experimental/Functions/NamingConventionsFunctions.ql
new file mode 100644
index 00000000000..dcfe280c0bf
--- /dev/null
+++ b/python/ql/src/experimental/Functions/NamingConventionsFunctions.ql
@@ -0,0 +1,28 @@
+/**
+ * @name Misnamed function
+ * @description A function name that begins with an uppercase letter decreases readability.
+ * @kind problem
+ * @problem.severity recommendation
+ * @id py/misnamed-function
+ * @tags maintainability
+ */
+
+import python
+
+predicate upper_case_function(Function func) {
+  exists(string first_char |
+    first_char = func.getName().prefix(1) and
+    not first_char = first_char.toLowerCase()
+  )
+}
+
+from Function func
+where
+  func.inSource() and
+  upper_case_function(func) and
+  not exists(Function func1 |
+    func1 != func and
+    func1.getLocation().getFile() = func.getLocation().getFile() and
+    upper_case_function(func1)
+  )
+select func, "Function names should start in lowercase."
diff --git a/python/ql/src/experimental/Security-old-dataflow/CVE-2018-1281/BindToAllInterfaces.ql b/python/ql/src/experimental/Security-old-dataflow/CVE-2018-1281/BindToAllInterfaces.ql
index 012e606f6e2..e7c25b02e41 100644
--- a/python/ql/src/experimental/Security-old-dataflow/CVE-2018-1281/BindToAllInterfaces.ql
+++ b/python/ql/src/experimental/Security-old-dataflow/CVE-2018-1281/BindToAllInterfaces.ql
@@ -3,6 +3,8 @@
  * @description Binding a socket to all interfaces opens it up to traffic from any IPv4 address
  * and is therefore associated with security risks.
  * @kind problem
+ * @id py/old/bind-socket-all-network-interfaces
+ * @problem.severity error
  */
 
 import python
diff --git a/python/ql/src/experimental/Security-old-dataflow/CWE-022/PathInjection.ql b/python/ql/src/experimental/Security-old-dataflow/CWE-022/PathInjection.ql
index 10dc5a8353b..f14473e3268 100644
--- a/python/ql/src/experimental/Security-old-dataflow/CWE-022/PathInjection.ql
+++ b/python/ql/src/experimental/Security-old-dataflow/CWE-022/PathInjection.ql
@@ -2,6 +2,8 @@
  * @name OLD QUERY: Uncontrolled data used in path expression
  * @description Accessing paths influenced by users can allow an attacker to access unexpected resources.
  * @kind path-problem
+ * @problem.severity error
+ * @id py/old/path-injection
  */
 
 import python
diff --git a/python/ql/src/experimental/Security-old-dataflow/CWE-078/CommandInjection.ql b/python/ql/src/experimental/Security-old-dataflow/CWE-078/CommandInjection.ql
index 71c836ba8dc..8a7e8d96012 100755
--- a/python/ql/src/experimental/Security-old-dataflow/CWE-078/CommandInjection.ql
+++ b/python/ql/src/experimental/Security-old-dataflow/CWE-078/CommandInjection.ql
@@ -3,6 +3,8 @@
  * @description Using externally controlled strings in a command line may allow a malicious
  *              user to change the meaning of the command.
  * @kind path-problem
+ * @problem.severity error
+ * @id py/old/command-line-injection
  */
 
 import python
diff --git a/python/ql/src/experimental/Security-old-dataflow/CWE-079/ReflectedXss.ql b/python/ql/src/experimental/Security-old-dataflow/CWE-079/ReflectedXss.ql
index a3d5b6ed9fc..5301920a779 100644
--- a/python/ql/src/experimental/Security-old-dataflow/CWE-079/ReflectedXss.ql
+++ b/python/ql/src/experimental/Security-old-dataflow/CWE-079/ReflectedXss.ql
@@ -3,6 +3,8 @@
  * @description Writing user input directly to a web page
  *              allows for a cross-site scripting vulnerability.
  * @kind path-problem
+ * @problem.severity error
+ * @id py/old/reflective-xss
  */
 
 import python
diff --git a/python/ql/src/experimental/Security-old-dataflow/CWE-089/SqlInjection.ql b/python/ql/src/experimental/Security-old-dataflow/CWE-089/SqlInjection.ql
index 821b52235e1..303391d34ff 100755
--- a/python/ql/src/experimental/Security-old-dataflow/CWE-089/SqlInjection.ql
+++ b/python/ql/src/experimental/Security-old-dataflow/CWE-089/SqlInjection.ql
@@ -3,6 +3,8 @@
  * @description Building a SQL query from user-controlled sources is vulnerable to insertion of
  *              malicious SQL code by the user.
  * @kind path-problem
+ * @problem.severity error
+ * @id py/old/sql-injection
  */
 
 import python
diff --git a/python/ql/src/experimental/Security-old-dataflow/CWE-094/CodeInjection.ql b/python/ql/src/experimental/Security-old-dataflow/CWE-094/CodeInjection.ql
index 697f6616997..4155208beed 100644
--- a/python/ql/src/experimental/Security-old-dataflow/CWE-094/CodeInjection.ql
+++ b/python/ql/src/experimental/Security-old-dataflow/CWE-094/CodeInjection.ql
@@ -1,8 +1,10 @@
 /**
  * @name Code injection
- * @description Interpreting unsanitized user input as code allows a malicious user arbitrary
+ * @description OLD QUERY: Interpreting unsanitized user input as code allows a malicious user arbitrary
  *              code execution.
  * @kind path-problem
+ * @problem.severity error
+ * @id py/old/code-injection
  */
 
 import python
diff --git a/python/ql/src/experimental/Security-old-dataflow/CWE-326/WeakCrypto.ql b/python/ql/src/experimental/Security-old-dataflow/CWE-326/WeakCrypto.ql
index 27c1fcce429..efd9e968bda 100644
--- a/python/ql/src/experimental/Security-old-dataflow/CWE-326/WeakCrypto.ql
+++ b/python/ql/src/experimental/Security-old-dataflow/CWE-326/WeakCrypto.ql
@@ -1,12 +1,9 @@
 /**
- * @name Use of weak cryptographic key
+ * @name OLD QUERY: Use of weak cryptographic key
  * @description Use of a cryptographic key that is too small may allow the encryption to be broken.
  * @kind problem
  * @problem.severity error
- * @precision high
- * @id py/weak-crypto-key
- * @tags security
- *       external/cwe/cwe-326
+ * @id py/old/weak-crypto-key
  */
 
 import python
diff --git a/python/ql/src/experimental/Security-old-dataflow/CWE-502/UnsafeDeserialization.ql b/python/ql/src/experimental/Security-old-dataflow/CWE-502/UnsafeDeserialization.ql
index 7e43c3b1497..32f01f7e3b6 100644
--- a/python/ql/src/experimental/Security-old-dataflow/CWE-502/UnsafeDeserialization.ql
+++ b/python/ql/src/experimental/Security-old-dataflow/CWE-502/UnsafeDeserialization.ql
@@ -2,6 +2,8 @@
  * @name OLD QUERY: Deserializing untrusted input
  * @description Deserializing user-controlled data may allow attackers to execute arbitrary code.
  * @kind path-problem
+ * @id py/old/unsafe-deserialization
+ * @problem.severity error
  */
 
 import python
diff --git a/python/ql/src/experimental/Security-old-dataflow/CWE-601/UrlRedirect.ql b/python/ql/src/experimental/Security-old-dataflow/CWE-601/UrlRedirect.ql
index f5c5491608d..91c422cd327 100644
--- a/python/ql/src/experimental/Security-old-dataflow/CWE-601/UrlRedirect.ql
+++ b/python/ql/src/experimental/Security-old-dataflow/CWE-601/UrlRedirect.ql
@@ -3,6 +3,8 @@
  * @description URL redirection based on unvalidated user input
  *              may cause redirection to malicious web sites.
  * @kind path-problem
+ * @problem.severity error
+ * @id py/old/url-redirection
  */
 
 import python
diff --git a/python/ql/src/experimental/semmle/python/Concepts.qll b/python/ql/src/experimental/semmle/python/Concepts.qll
new file mode 100644
index 00000000000..904b7967ee8
--- /dev/null
+++ b/python/ql/src/experimental/semmle/python/Concepts.qll
@@ -0,0 +1,15 @@
+/**
+ * This version resides in the experimental area and provides a space for
+ * external contributors to place new concepts, keeping to our preferred
+ * structure while remaining in the experimental area.
+ *
+ * Provides abstract classes representing generic concepts such as file system
+ * access or system command execution, for which individual framework libraries
+ * provide concrete subclasses.
+ */
+
+private import python
+private import semmle.python.dataflow.new.DataFlow
+private import semmle.python.dataflow.new.RemoteFlowSources
+private import semmle.python.dataflow.new.TaintTracking
+private import experimental.semmle.python.Frameworks
diff --git a/python/ql/src/experimental/semmle/python/Frameworks.qll b/python/ql/src/experimental/semmle/python/Frameworks.qll
new file mode 100644
index 00000000000..ca1dd04e57d
--- /dev/null
+++ b/python/ql/src/experimental/semmle/python/Frameworks.qll
@@ -0,0 +1,5 @@
+/**
+ * Helper file that imports all framework modeling.
+ */
+
+private import experimental.semmle.python.frameworks.Stdlib
diff --git a/python/ql/src/experimental/semmle/python/frameworks/Stdlib.qll b/python/ql/src/experimental/semmle/python/frameworks/Stdlib.qll
new file mode 100644
index 00000000000..420caf0d73b
--- /dev/null
+++ b/python/ql/src/experimental/semmle/python/frameworks/Stdlib.qll
@@ -0,0 +1,11 @@
+/**
+ * Provides classes modeling security-relevant aspects of the standard libraries.
+ * Note: some modeling is done internally in the dataflow/taint tracking implementation.
+ */
+
+private import python
+private import semmle.python.dataflow.new.DataFlow
+private import semmle.python.dataflow.new.TaintTracking
+private import semmle.python.dataflow.new.RemoteFlowSources
+private import experimental.semmle.python.Concepts
+private import semmle.python.ApiGraphs
diff --git a/python/ql/src/external/CodeDuplication.qll b/python/ql/src/external/CodeDuplication.qll
deleted file mode 100644
index 01ab28d955b..00000000000
--- a/python/ql/src/external/CodeDuplication.qll
+++ /dev/null
@@ -1,273 +0,0 @@
-/** Provides classes for detecting duplicate or similar code. */
-
-import python
-
-/** Gets the relative path of `file`, with backslashes replaced by forward slashes. */
-private string relativePath(File file) { result = file.getRelativePath().replaceAll("\\", "/") }
-
-/**
- * Holds if the `index`-th token of block `copy` is in file `file`, spanning
- * column `sc` of line `sl` to column `ec` of line `el`.
- *
- * For more information, see [Locations](https://help.semmle.com/QL/learn-ql/ql/locations.html).
- */
-pragma[noinline, nomagic]
-private predicate tokenLocation(File file, int sl, int sc, int ec, int el, Copy copy, int index) {
-  file = copy.sourceFile() and
-  tokens(copy, index, sl, sc, ec, el)
-}
-
-/** A token block used for detection of duplicate and similar code. */
-class Copy extends @duplication_or_similarity {
-  private int lastToken() { result = max(int i | tokens(this, i, _, _, _, _) | i) }
-
-  /** Gets the index of the token in this block starting at the location `loc`, if any. */
-  int tokenStartingAt(Location loc) {
-    tokenLocation(loc.getFile(), loc.getStartLine(), loc.getStartColumn(), _, _, this, result)
-  }
-
-  /** Gets the index of the token in this block ending at the location `loc`, if any. */
-  int tokenEndingAt(Location loc) {
-    tokenLocation(loc.getFile(), _, _, loc.getEndLine(), loc.getEndColumn(), this, result)
-  }
-
-  /** Gets the line on which the first token in this block starts. */
-  int sourceStartLine() { tokens(this, 0, result, _, _, _) }
-
-  /** Gets the column on which the first token in this block starts. */
-  int sourceStartColumn() { tokens(this, 0, _, result, _, _) }
-
-  /** Gets the line on which the last token in this block ends. */
-  int sourceEndLine() { tokens(this, this.lastToken(), _, _, result, _) }
-
-  /** Gets the column on which the last token in this block ends. */
-  int sourceEndColumn() { tokens(this, this.lastToken(), _, _, _, result) }
-
-  /** Gets the number of lines containing at least (part of) one token in this block. */
-  int sourceLines() { result = this.sourceEndLine() + 1 - this.sourceStartLine() }
-
-  /** Gets an opaque identifier for the equivalence class of this block. */
-  int getEquivalenceClass() { duplicateCode(this, _, result) or similarCode(this, _, result) }
-
-  /** Gets the source file in which this block appears. */
-  File sourceFile() {
-    exists(string name | duplicateCode(this, name, _) or similarCode(this, name, _) |
-      name.replaceAll("\\", "/") = relativePath(result)
-    )
-  }
-
-  /**
-   * Holds if this element is at the specified location.
-   * The location spans column `startcolumn` of line `startline` to
-   * column `endcolumn` of line `endline` in file `filepath`.
-   * For more information, see
-   * [Locations](https://help.semmle.com/QL/learn-ql/ql/locations.html).
-   */
-  predicate hasLocationInfo(
-    string filepath, int startline, int startcolumn, int endline, int endcolumn
-  ) {
-    sourceFile().getAbsolutePath() = filepath and
-    startline = sourceStartLine() and
-    startcolumn = sourceStartColumn() and
-    endline = sourceEndLine() and
-    endcolumn = sourceEndColumn()
-  }
-
-  /** Gets a textual representation of this element. */
-  string toString() { result = "Copy" }
-
-  /**
-   * Gets a block that extends this one, that is, its first token is also
-   * covered by this block, but they are not the same block.
-   */
-  Copy extendingBlock() {
-    exists(File file, int sl, int sc, int ec, int el |
-      tokenLocation(file, sl, sc, ec, el, this, _) and
-      tokenLocation(file, sl, sc, ec, el, result, 0)
-    ) and
-    this != result
-  }
-}
-
-/**
- * Holds if there is a sequence of `SimilarBlock`s `start1, ..., end1` and another sequence
- * `start2, ..., end2` such that each block extends the previous one and corresponding blocks
- * have the same equivalence class, with `start` being the equivalence class of `start1` and
- * `start2`, and `end` the equivalence class of `end1` and `end2`.
- */
-predicate similar_extension(
-  SimilarBlock start1, SimilarBlock start2, SimilarBlock ext1, SimilarBlock ext2, int start, int ext
-) {
-  start1.getEquivalenceClass() = start and
-  start2.getEquivalenceClass() = start and
-  ext1.getEquivalenceClass() = ext and
-  ext2.getEquivalenceClass() = ext and
-  start1 != start2 and
-  (
-    ext1 = start1 and ext2 = start2
-    or
-    similar_extension(start1.extendingBlock(), start2.extendingBlock(), ext1, ext2, _, ext)
-  )
-}
-
-/**
- * Holds if there is a sequence of `DuplicateBlock`s `start1, ..., end1` and another sequence
- * `start2, ..., end2` such that each block extends the previous one and corresponding blocks
- * have the same equivalence class, with `start` being the equivalence class of `start1` and
- * `start2`, and `end` the equivalence class of `end1` and `end2`.
- */
-predicate duplicate_extension(
-  DuplicateBlock start1, DuplicateBlock start2, DuplicateBlock ext1, DuplicateBlock ext2, int start,
-  int ext
-) {
-  start1.getEquivalenceClass() = start and
-  start2.getEquivalenceClass() = start and
-  ext1.getEquivalenceClass() = ext and
-  ext2.getEquivalenceClass() = ext and
-  start1 != start2 and
-  (
-    ext1 = start1 and ext2 = start2
-    or
-    duplicate_extension(start1.extendingBlock(), start2.extendingBlock(), ext1, ext2, _, ext)
-  )
-}
-
-/** A block of duplicated code. */
-class DuplicateBlock extends Copy, @duplication {
-  override string toString() { result = "Duplicate code: " + sourceLines() + " duplicated lines." }
-}
-
-/** A block of similar code. */
-class SimilarBlock extends Copy, @similarity {
-  override string toString() {
-    result = "Similar code: " + sourceLines() + " almost duplicated lines."
-  }
-}
-
-/**
- * Holds if `stmt1` and `stmt2` are duplicate statements in function or toplevel `sc1` and `sc2`,
- * respectively, where `scope1` and `scope2` are not the same.
- */
-predicate duplicateStatement(Scope scope1, Scope scope2, Stmt stmt1, Stmt stmt2) {
-  exists(int equivstart, int equivend, int first, int last |
-    scope1.contains(stmt1) and
-    scope2.contains(stmt2) and
-    duplicateCoversStatement(equivstart, equivend, first, last, stmt1) and
-    duplicateCoversStatement(equivstart, equivend, first, last, stmt2) and
-    stmt1 != stmt2 and
-    scope1 != scope2
-  )
-}
-
-/**
- * Holds if statement `stmt` is covered by a sequence of `DuplicateBlock`s, where `first`
- * is the index of the token in the first block that starts at the beginning of `stmt`,
- * while `last` is the index of the token in the last block that ends at the end of `stmt`,
- * and `equivstart` and `equivend` are the equivalence classes of the first and the last
- * block, respectively.
- */
-private predicate duplicateCoversStatement(
-  int equivstart, int equivend, int first, int last, Stmt stmt
-) {
-  exists(DuplicateBlock b1, DuplicateBlock b2, Location startloc, Location endloc |
-    stmt.getLocation() = startloc and
-    stmt.getLastStatement().getLocation() = endloc and
-    first = b1.tokenStartingAt(startloc) and
-    last = b2.tokenEndingAt(endloc) and
-    b1.getEquivalenceClass() = equivstart and
-    b2.getEquivalenceClass() = equivend and
-    duplicate_extension(b1, _, b2, _, equivstart, equivend)
-  )
-}
-
-/**
- * Holds if `sc1` is a function or toplevel with `total` lines, and `scope2` is a function or
- * toplevel that has `duplicate` lines in common with `scope1`.
- */
-predicate duplicateStatements(Scope scope1, Scope scope2, int duplicate, int total) {
-  duplicate = strictcount(Stmt stmt | duplicateStatement(scope1, scope2, stmt, _)) and
-  total = strictcount(Stmt stmt | scope1.contains(stmt))
-}
-
-/**
- * Find pairs of scopes that are identical or almost identical
- */
-predicate duplicateScopes(Scope s, Scope other, float percent, string message) {
-  exists(int total, int duplicate | duplicateStatements(s, other, duplicate, total) |
-    percent = 100.0 * duplicate / total and
-    percent >= 80.0 and
-    if duplicate = total
-    then message = "All " + total + " statements in " + s.getName() + " are identical in $@."
-    else
-      message =
-        duplicate + " out of " + total + " statements in " + s.getName() + " are duplicated in $@."
-  )
-}
-
-/**
- * Holds if `stmt1` and `stmt2` are similar statements in function or toplevel `scope1` and `scope2`,
- * respectively, where `scope1` and `scope2` are not the same.
- */
-private predicate similarStatement(Scope scope1, Scope scope2, Stmt stmt1, Stmt stmt2) {
-  exists(int start, int end, int first, int last |
-    scope1.contains(stmt1) and
-    scope2.contains(stmt2) and
-    similarCoversStatement(start, end, first, last, stmt1) and
-    similarCoversStatement(start, end, first, last, stmt2) and
-    stmt1 != stmt2 and
-    scope1 != scope2
-  )
-}
-
-/**
- * Holds if statement `stmt` is covered by a sequence of `SimilarBlock`s, where `first`
- * is the index of the token in the first block that starts at the beginning of `stmt`,
- * while `last` is the index of the token in the last block that ends at the end of `stmt`,
- * and `equivstart` and `equivend` are the equivalence classes of the first and the last
- * block, respectively.
- */
-private predicate similarCoversStatement(
-  int equivstart, int equivend, int first, int last, Stmt stmt
-) {
-  exists(SimilarBlock b1, SimilarBlock b2, Location startloc, Location endloc |
-    stmt.getLocation() = startloc and
-    stmt.getLastStatement().getLocation() = endloc and
-    first = b1.tokenStartingAt(startloc) and
-    last = b2.tokenEndingAt(endloc) and
-    b1.getEquivalenceClass() = equivstart and
-    b2.getEquivalenceClass() = equivend and
-    similar_extension(b1, _, b2, _, equivstart, equivend)
-  )
-}
-
-/**
- * Holds if `sc1` is a function or toplevel with `total` lines, and `scope2` is a function or
- * toplevel that has `similar` similar lines to `scope1`.
- */
-private predicate similarStatements(Scope scope1, Scope scope2, int similar, int total) {
-  similar = strictcount(Stmt stmt | similarStatement(scope1, scope2, stmt, _)) and
-  total = strictcount(Stmt stmt | scope1.contains(stmt))
-}
-
-/**
- * Find pairs of scopes that are similar
- */
-predicate similarScopes(Scope s, Scope other, float percent, string message) {
-  exists(int total, int similar | similarStatements(s, other, similar, total) |
-    percent = 100.0 * similar / total and
-    percent >= 80.0 and
-    if similar = total
-    then message = "All statements in " + s.getName() + " are similar in $@."
-    else
-      message =
-        similar + " out of " + total + " statements in " + s.getName() + " are similar in $@."
-  )
-}
-
-/**
- * Holds if the line is acceptable as a duplicate.
- * This is true for blocks of import statements.
- */
-predicate allowlistedLineForDuplication(File f, int line) {
-  exists(ImportingStmt i | i.getLocation().getFile() = f and i.getLocation().getStartLine() = line)
-}
diff --git a/python/ql/src/external/DuplicateBlock.ql b/python/ql/src/external/DuplicateBlock.ql
index 90067fa834c..89c61040cc2 100644
--- a/python/ql/src/external/DuplicateBlock.ql
+++ b/python/ql/src/external/DuplicateBlock.ql
@@ -16,19 +16,7 @@
  */
 
 import python
-import CodeDuplication
 
-predicate sorted_by_location(DuplicateBlock x, DuplicateBlock y) {
-  if x.sourceFile() = y.sourceFile()
-  then x.sourceStartLine() < y.sourceStartLine()
-  else x.sourceFile().getAbsolutePath() < y.sourceFile().getAbsolutePath()
-}
-
-from DuplicateBlock d, DuplicateBlock other
-where
-  d.sourceLines() > 10 and
-  other.getEquivalenceClass() = d.getEquivalenceClass() and
-  sorted_by_location(other, d)
-select d,
-  "Duplicate code: " + d.sourceLines() + " lines are duplicated at " +
-    other.sourceFile().getShortName() + ":" + other.sourceStartLine().toString()
+from BasicBlock d
+where none()
+select d, "Duplicate code: " + "-1" + " lines are duplicated at " + "<file>" + ":" + "-1"
diff --git a/python/ql/src/external/DuplicateFunction.ql b/python/ql/src/external/DuplicateFunction.ql
index 4583eede278..56f0c0761ae 100644
--- a/python/ql/src/external/DuplicateFunction.ql
+++ b/python/ql/src/external/DuplicateFunction.ql
@@ -16,15 +16,7 @@
  */
 
 import python
-import CodeDuplication
 
-predicate relevant(Function m) { m.getMetrics().getNumberOfLinesOfCode() > 5 }
-
-from Function m, Function other, string message, int percent
-where
-  duplicateScopes(m, other, percent, message) and
-  relevant(m) and
-  percent > 95.0 and
-  not duplicateScopes(m.getEnclosingModule(), other.getEnclosingModule(), _, _) and
-  not duplicateScopes(m.getScope(), other.getScope(), _, _)
+from Function m, Function other, string message
+where none()
 select m, message, other, other.getName()
diff --git a/python/ql/src/external/MostlyDuplicateClass.ql b/python/ql/src/external/MostlyDuplicateClass.ql
index 2e530fef4d0..2932611ba6f 100644
--- a/python/ql/src/external/MostlyDuplicateClass.ql
+++ b/python/ql/src/external/MostlyDuplicateClass.ql
@@ -16,11 +16,7 @@
  */
 
 import python
-import CodeDuplication
 
 from Class c, Class other, string message
-where
-  duplicateScopes(c, other, _, message) and
-  count(c.getAStmt()) > 3 and
-  not duplicateScopes(c.getEnclosingModule(), _, _, _)
+where none()
 select c, message, other, other.getName()
diff --git a/python/ql/src/external/MostlyDuplicateFile.ql b/python/ql/src/external/MostlyDuplicateFile.ql
index 274d3758b1d..c11c21dba87 100644
--- a/python/ql/src/external/MostlyDuplicateFile.ql
+++ b/python/ql/src/external/MostlyDuplicateFile.ql
@@ -16,8 +16,7 @@
  */
 
 import python
-import CodeDuplication
 
-from Module m, Module other, int percent, string message
-where duplicateScopes(m, other, percent, message)
+from Module m, Module other, string message
+where none()
 select m, message, other, other.getName()
diff --git a/python/ql/src/external/MostlySimilarFile.ql b/python/ql/src/external/MostlySimilarFile.ql
index bad174f8fc5..eae859aaecf 100644
--- a/python/ql/src/external/MostlySimilarFile.ql
+++ b/python/ql/src/external/MostlySimilarFile.ql
@@ -16,8 +16,7 @@
  */
 
 import python
-import CodeDuplication
 
 from Module m, Module other, string message
-where similarScopes(m, other, _, message)
+where none()
 select m, message, other, other.getName()
diff --git a/python/ql/src/external/SimilarFunction.ql b/python/ql/src/external/SimilarFunction.ql
index 509790c89af..84f75c9a489 100644
--- a/python/ql/src/external/SimilarFunction.ql
+++ b/python/ql/src/external/SimilarFunction.ql
@@ -16,16 +16,7 @@
  */
 
 import python
-import CodeDuplication
 
-predicate relevant(Function m) { m.getMetrics().getNumberOfLinesOfCode() > 10 }
-
-from Function m, Function other, string message, int percent
-where
-  similarScopes(m, other, percent, message) and
-  relevant(m) and
-  percent > 95.0 and
-  not duplicateScopes(m, other, _, _) and
-  not duplicateScopes(m.getEnclosingModule(), other.getEnclosingModule(), _, _) and
-  not duplicateScopes(m.getScope(), other.getScope(), _, _)
+from Function m, Function other, string message
+where none()
 select m, message, other, other.getName()
diff --git a/python/ql/src/semmle/python/ApiGraphs.qll b/python/ql/src/semmle/python/ApiGraphs.qll
index b05a8910530..5f1fbbb9626 100644
--- a/python/ql/src/semmle/python/ApiGraphs.qll
+++ b/python/ql/src/semmle/python/ApiGraphs.qll
@@ -6,7 +6,7 @@
  * directed and labeled; they specify how the components represented by nodes relate to each other.
  */
 
-import python
+private import python
 import semmle.python.dataflow.new.DataFlow
 
 /**
@@ -55,7 +55,7 @@ module API {
     /**
      * Gets a call to the function represented by this API component.
      */
-    DataFlow::Node getACall() { result = getReturn().getAnImmediateUse() }
+    DataFlow::CallCfgNode getACall() { result = getReturn().getAnImmediateUse() }
 
     /**
      * Gets a node representing member `m` of this API component.
@@ -363,7 +363,7 @@ module API {
           n.isGlobal() and
           n.isLoad() and
           name = n.getId() and
-          name = any(Builtins::Builtin b).getName()
+          name in [any(Builtins::Builtin b).getName(), "None", "True", "False"]
         )
     }
 
diff --git a/python/ql/src/semmle/python/Concepts.qll b/python/ql/src/semmle/python/Concepts.qll
index 0e5814d203b..d8e65cb2e09 100644
--- a/python/ql/src/semmle/python/Concepts.qll
+++ b/python/ql/src/semmle/python/Concepts.qll
@@ -563,7 +563,9 @@ module Cryptography {
     /** Provides classes for modeling new key-pair generation APIs. */
     module KeyGeneration {
       /** Gets a back-reference to the keysize argument `arg` that was used to generate a new key-pair. */
-      DataFlow::LocalSourceNode keysizeBacktracker(DataFlow::TypeBackTracker t, DataFlow::Node arg) {
+      private DataFlow::LocalSourceNode keysizeBacktracker(
+        DataFlow::TypeBackTracker t, DataFlow::Node arg
+      ) {
         t.start() and
         arg = any(KeyGeneration::Range r).getKeySizeArg() and
         result = arg.getALocalSource()
diff --git a/python/ql/src/semmle/python/Files.qll b/python/ql/src/semmle/python/Files.qll
index ef6484fbdc6..6eb6b2a18ac 100644
--- a/python/ql/src/semmle/python/Files.qll
+++ b/python/ql/src/semmle/python/Files.qll
@@ -72,6 +72,33 @@ class File extends Container {
    * are specified to be extracted.
    */
   string getContents() { file_contents(this, result) }
+
+  /** Holds if this file is likely to get executed directly, and thus act as an entry point for execution. */
+  predicate isPossibleEntryPoint() {
+    // Only consider files in the source code, and not things like the standard library
+    exists(this.getRelativePath()) and
+    (
+      // The file doesn't have the extension `.py` but still contains Python statements
+      not this.getExtension().matches("py%") and
+      exists(Stmt s | s.getLocation().getFile() = this)
+      or
+      // The file contains the usual `if __name__ == '__main__':` construction
+      exists(If i, Name name, StrConst main, Cmpop op |
+        i.getScope().(Module).getFile() = this and
+        op instanceof Eq and
+        i.getTest().(Compare).compares(name, op, main) and
+        name.getId() = "__name__" and
+        main.getText() = "__main__"
+      )
+      or
+      // The file contains a `#!` line referencing the python interpreter
+      exists(Comment c |
+        c.getLocation().getFile() = this and
+        c.getLocation().getStartLine() = 1 and
+        c.getText().regexpMatch("^#! */.*python(2|3)?[ \\\\t]*$")
+      )
+    )
+  }
 }
 
 private predicate occupied_line(File f, int n) {
diff --git a/python/ql/src/semmle/python/Module.qll b/python/ql/src/semmle/python/Module.qll
index fcf1c0b2925..1e9d76bf1d8 100644
--- a/python/ql/src/semmle/python/Module.qll
+++ b/python/ql/src/semmle/python/Module.qll
@@ -129,7 +129,11 @@ class Module extends Module_, Scope, AstNode {
       a.defines(all) and
       a.getScope() = this and
       all.getId() = "__all__" and
-      a.getValue().(List).getAnElt().(StrConst).getText() = name
+      (
+        a.getValue().(List).getAnElt().(StrConst).getText() = name
+        or
+        a.getValue().(Tuple).getAnElt().(StrConst).getText() = name
+      )
     )
   }
 
@@ -201,11 +205,31 @@ private string moduleNameFromBase(Container file) {
   file instanceof File and result = file.getStem()
 }
 
+/**
+ * Holds if `file` may be transitively imported from a file that may serve as the entry point of
+ * the execution.
+ */
+private predicate transitively_imported_from_entry_point(File file) {
+  file.getExtension().matches("%py%") and
+  exists(File importer |
+    importer.getParent() = file.getParent() and
+    exists(ImportExpr i | i.getLocation().getFile() = importer and i.getName() = file.getStem())
+  |
+    importer.isPossibleEntryPoint() or transitively_imported_from_entry_point(importer)
+  )
+}
+
 string moduleNameFromFile(Container file) {
   exists(string basename |
     basename = moduleNameFromBase(file) and
-    legalShortName(basename) and
+    legalShortName(basename)
+  |
     result = moduleNameFromFile(file.getParent()) + "." + basename
+    or
+    // If `file` is a transitive import of a file that's executed directly, we allow references
+    // to it by its `basename`.
+    transitively_imported_from_entry_point(file) and
+    result = basename
   )
   or
   isPotentialSourcePackage(file) and
diff --git a/python/ql/src/semmle/python/dataflow/new/TypeTracker.qll b/python/ql/src/semmle/python/dataflow/new/TypeTracker.qll
index b6c4bdb06ea..d4ce5f606ac 100644
--- a/python/ql/src/semmle/python/dataflow/new/TypeTracker.qll
+++ b/python/ql/src/semmle/python/dataflow/new/TypeTracker.qll
@@ -180,7 +180,7 @@ private newtype TTypeTracker = MkTypeTracker(Boolean hasCall, OptionalAttributeN
  * It is recommended that all uses of this type are written in the following form,
  * for tracking some type `myType`:
  * ```
- * DataFlow::LocalSourceNode myType(DataFlow::TypeTracker t) {
+ * private DataFlow::LocalSourceNode myType(DataFlow::TypeTracker t) {
  *   t.start() and
  *   result = < source of myType >
  *   or
@@ -341,7 +341,7 @@ private newtype TTypeBackTracker = MkTypeBackTracker(Boolean hasReturn, Optional
  * for back-tracking some callback type `myCallback`:
  *
  * ```
- * DataFlow::LocalSourceNode myCallback(DataFlow::TypeBackTracker t) {
+ * private DataFlow::LocalSourceNode myCallback(DataFlow::TypeBackTracker t) {
  *   t.start() and
  *   result = (< some API call >).getArgument(< n >).getALocalSource()
  *   or
diff --git a/python/ql/src/semmle/python/dataflow/new/internal/Attributes.qll b/python/ql/src/semmle/python/dataflow/new/internal/Attributes.qll
index 1bd5f961a36..6270e35aa9f 100644
--- a/python/ql/src/semmle/python/dataflow/new/internal/Attributes.qll
+++ b/python/ql/src/semmle/python/dataflow/new/internal/Attributes.qll
@@ -3,6 +3,7 @@
 import DataFlowUtil
 import DataFlowPublic
 private import DataFlowPrivate
+private import semmle.python.types.Builtins
 
 /**
  * A data flow node that reads or writes an attribute of an object.
@@ -84,8 +85,6 @@ private class AttributeAssignmentAsAttrWrite extends AttrWrite, CfgNode {
   override string getAttributeName() { result = node.getName() }
 }
 
-import semmle.python.types.Builtins
-
 /** Represents `CallNode`s that may refer to calls to built-in functions or classes. */
 private class BuiltInCallNode extends CallNode {
   string name;
diff --git a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl.qll b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl.qll
index 8b446d28b86..9498e51e7e6 100644
--- a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl.qll
+++ b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl.qll
@@ -2133,11 +2133,8 @@ private module Stage4 {
 
   bindingset[node, cc, config]
   private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and
diff --git a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl2.qll b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl2.qll
index 8b446d28b86..9498e51e7e6 100644
--- a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl2.qll
+++ b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl2.qll
@@ -2133,11 +2133,8 @@ private module Stage4 {
 
   bindingset[node, cc, config]
   private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and
diff --git a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl3.qll b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl3.qll
index 8b446d28b86..9498e51e7e6 100644
--- a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl3.qll
+++ b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl3.qll
@@ -2133,11 +2133,8 @@ private module Stage4 {
 
   bindingset[node, cc, config]
   private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and
diff --git a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl4.qll b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl4.qll
index 8b446d28b86..9498e51e7e6 100644
--- a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl4.qll
+++ b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl4.qll
@@ -2133,11 +2133,8 @@ private module Stage4 {
 
   bindingset[node, cc, config]
   private LocalCc getLocalCc(Node node, Cc cc, Configuration config) {
-    exists(Cc cc0 |
-      cc = pragma[only_bind_into](cc0) and
-      localFlowEntry(node, config) and
-      result = getLocalCallContext(cc0, getNodeEnclosingCallable(node))
-    )
+    localFlowEntry(node, config) and
+    result = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(node))
   }
 
   private predicate localStep(
@@ -3132,7 +3129,7 @@ private predicate pathStep(PathNodeMid mid, Node node, CallContext cc, SummaryCt
     conf = mid.getConfiguration() and
     cc = mid.getCallContext() and
     sc = mid.getSummaryCtx() and
-    localCC = getLocalCallContext(cc, getNodeEnclosingCallable(midnode)) and
+    localCC = getLocalCallContext(pragma[only_bind_out](cc), getNodeEnclosingCallable(midnode)) and
     ap0 = mid.getAp()
   |
     localFlowBigStep(midnode, node, true, _, conf, localCC) and
diff --git a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImplCommon.qll b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImplCommon.qll
index 1319f972037..a51c20c2288 100644
--- a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImplCommon.qll
+++ b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowImplCommon.qll
@@ -26,15 +26,243 @@ predicate accessPathCostLimits(int apLimit, int tupleLimit) {
   tupleLimit = 1000
 }
 
+/**
+ * Provides a simple data-flow analysis for resolving lambda calls. The analysis
+ * currently excludes read-steps, store-steps, and flow-through.
+ *
+ * The analysis uses non-linear recursion: When computing a flow path in or out
+ * of a call, we use the results of the analysis recursively to resolve lamba
+ * calls. For this reason, we cannot reuse the code from `DataFlowImpl.qll` directly.
+ */
+private module LambdaFlow {
+  private predicate viableParamNonLambda(DataFlowCall call, int i, ParameterNode p) {
+    p.isParameterOf(viableCallable(call), i)
+  }
+
+  private predicate viableParamLambda(DataFlowCall call, int i, ParameterNode p) {
+    p.isParameterOf(viableCallableLambda(call, _), i)
+  }
+
+  private predicate viableParamArgNonLambda(DataFlowCall call, ParameterNode p, ArgumentNode arg) {
+    exists(int i |
+      viableParamNonLambda(call, i, p) and
+      arg.argumentOf(call, i)
+    )
+  }
+
+  private predicate viableParamArgLambda(DataFlowCall call, ParameterNode p, ArgumentNode arg) {
+    exists(int i |
+      viableParamLambda(call, i, p) and
+      arg.argumentOf(call, i)
+    )
+  }
+
+  private newtype TReturnPositionSimple =
+    TReturnPositionSimple0(DataFlowCallable c, ReturnKind kind) {
+      exists(ReturnNode ret |
+        c = getNodeEnclosingCallable(ret) and
+        kind = ret.getKind()
+      )
+    }
+
+  pragma[noinline]
+  private TReturnPositionSimple getReturnPositionSimple(ReturnNode ret, ReturnKind kind) {
+    result = TReturnPositionSimple0(getNodeEnclosingCallable(ret), kind)
+  }
+
+  pragma[nomagic]
+  private TReturnPositionSimple viableReturnPosNonLambda(DataFlowCall call, ReturnKind kind) {
+    result = TReturnPositionSimple0(viableCallable(call), kind)
+  }
+
+  pragma[nomagic]
+  private TReturnPositionSimple viableReturnPosLambda(
+    DataFlowCall call, DataFlowCallOption lastCall, ReturnKind kind
+  ) {
+    result = TReturnPositionSimple0(viableCallableLambda(call, lastCall), kind)
+  }
+
+  private predicate viableReturnPosOutNonLambda(
+    DataFlowCall call, TReturnPositionSimple pos, OutNode out
+  ) {
+    exists(ReturnKind kind |
+      pos = viableReturnPosNonLambda(call, kind) and
+      out = getAnOutNode(call, kind)
+    )
+  }
+
+  private predicate viableReturnPosOutLambda(
+    DataFlowCall call, DataFlowCallOption lastCall, TReturnPositionSimple pos, OutNode out
+  ) {
+    exists(ReturnKind kind |
+      pos = viableReturnPosLambda(call, lastCall, kind) and
+      out = getAnOutNode(call, kind)
+    )
+  }
+
+  /**
+   * Holds if data can flow (inter-procedurally) from `node` (of type `t`) to
+   * the lambda call `lambdaCall`.
+   *
+   * The parameter `toReturn` indicates whether the path from `node` to
+   * `lambdaCall` goes through a return, and `toJump` whether the path goes
+   * through a jump step.
+   *
+   * The call context `lastCall` records the last call on the path from `node`
+   * to `lambdaCall`, if any. That is, `lastCall` is able to target the enclosing
+   * callable of `lambdaCall`.
+   */
+  pragma[nomagic]
+  predicate revLambdaFlow(
+    DataFlowCall lambdaCall, LambdaCallKind kind, Node node, DataFlowType t, boolean toReturn,
+    boolean toJump, DataFlowCallOption lastCall
+  ) {
+    revLambdaFlow0(lambdaCall, kind, node, t, toReturn, toJump, lastCall) and
+    if node instanceof CastNode or node instanceof ArgumentNode or node instanceof ReturnNode
+    then compatibleTypes(t, getNodeType(node))
+    else any()
+  }
+
+  pragma[nomagic]
+  predicate revLambdaFlow0(
+    DataFlowCall lambdaCall, LambdaCallKind kind, Node node, DataFlowType t, boolean toReturn,
+    boolean toJump, DataFlowCallOption lastCall
+  ) {
+    lambdaCall(lambdaCall, kind, node) and
+    t = getNodeType(node) and
+    toReturn = false and
+    toJump = false and
+    lastCall = TDataFlowCallNone()
+    or
+    // local flow
+    exists(Node mid, DataFlowType t0 |
+      revLambdaFlow(lambdaCall, kind, mid, t0, toReturn, toJump, lastCall)
+    |
+      simpleLocalFlowStep(node, mid) and
+      t = t0
+      or
+      exists(boolean preservesValue |
+        additionalLambdaFlowStep(node, mid, preservesValue) and
+        getNodeEnclosingCallable(node) = getNodeEnclosingCallable(mid)
+      |
+        preservesValue = false and
+        t = getNodeType(node)
+        or
+        preservesValue = true and
+        t = t0
+      )
+    )
+    or
+    // jump step
+    exists(Node mid, DataFlowType t0 |
+      revLambdaFlow(lambdaCall, kind, mid, t0, _, _, _) and
+      toReturn = false and
+      toJump = true and
+      lastCall = TDataFlowCallNone()
+    |
+      jumpStep(node, mid) and
+      t = t0
+      or
+      exists(boolean preservesValue |
+        additionalLambdaFlowStep(node, mid, preservesValue) and
+        getNodeEnclosingCallable(node) != getNodeEnclosingCallable(mid)
+      |
+        preservesValue = false and
+        t = getNodeType(node)
+        or
+        preservesValue = true and
+        t = t0
+      )
+    )
+    or
+    // flow into a callable
+    exists(ParameterNode p, DataFlowCallOption lastCall0, DataFlowCall call |
+      revLambdaFlowIn(lambdaCall, kind, p, t, toJump, lastCall0) and
+      (
+        if lastCall0 = TDataFlowCallNone() and toJump = false
+        then lastCall = TDataFlowCallSome(call)
+        else lastCall = lastCall0
+      ) and
+      toReturn = false
+    |
+      viableParamArgNonLambda(call, p, node)
+      or
+      viableParamArgLambda(call, p, node) // non-linear recursion
+    )
+    or
+    // flow out of a callable
+    exists(TReturnPositionSimple pos |
+      revLambdaFlowOut(lambdaCall, kind, pos, t, toJump, lastCall) and
+      getReturnPositionSimple(node, node.(ReturnNode).getKind()) = pos and
+      toReturn = true
+    )
+  }
+
+  pragma[nomagic]
+  predicate revLambdaFlowOutLambdaCall(
+    DataFlowCall lambdaCall, LambdaCallKind kind, OutNode out, DataFlowType t, boolean toJump,
+    DataFlowCall call, DataFlowCallOption lastCall
+  ) {
+    revLambdaFlow(lambdaCall, kind, out, t, _, toJump, lastCall) and
+    exists(ReturnKindExt rk |
+      out = rk.getAnOutNode(call) and
+      lambdaCall(call, _, _)
+    )
+  }
+
+  pragma[nomagic]
+  predicate revLambdaFlowOut(
+    DataFlowCall lambdaCall, LambdaCallKind kind, TReturnPositionSimple pos, DataFlowType t,
+    boolean toJump, DataFlowCallOption lastCall
+  ) {
+    exists(DataFlowCall call, OutNode out |
+      revLambdaFlow(lambdaCall, kind, out, t, _, toJump, lastCall) and
+      viableReturnPosOutNonLambda(call, pos, out)
+      or
+      // non-linear recursion
+      revLambdaFlowOutLambdaCall(lambdaCall, kind, out, t, toJump, call, lastCall) and
+      viableReturnPosOutLambda(call, _, pos, out)
+    )
+  }
+
+  pragma[nomagic]
+  predicate revLambdaFlowIn(
+    DataFlowCall lambdaCall, LambdaCallKind kind, ParameterNode p, DataFlowType t, boolean toJump,
+    DataFlowCallOption lastCall
+  ) {
+    revLambdaFlow(lambdaCall, kind, p, t, false, toJump, lastCall)
+  }
+}
+
+private DataFlowCallable viableCallableExt(DataFlowCall call) {
+  result = viableCallable(call)
+  or
+  result = viableCallableLambda(call, _)
+}
+
 cached
 private module Cached {
+  /**
+   * Gets a viable target for the lambda call `call`.
+   *
+   * `lastCall` records the call required to reach `call` in order for the result
+   * to be a viable target, if any.
+   */
+  cached
+  DataFlowCallable viableCallableLambda(DataFlowCall call, DataFlowCallOption lastCall) {
+    exists(Node creation, LambdaCallKind kind |
+      LambdaFlow::revLambdaFlow(call, kind, creation, _, _, _, lastCall) and
+      lambdaCreation(creation, kind, result)
+    )
+  }
+
   /**
    * Holds if `p` is the `i`th parameter of a viable dispatch target of `call`.
    * The instance parameter is considered to have index `-1`.
    */
   pragma[nomagic]
   private predicate viableParam(DataFlowCall call, int i, ParameterNode p) {
-    p.isParameterOf(viableCallable(call), i)
+    p.isParameterOf(viableCallableExt(call), i)
   }
 
   /**
@@ -52,7 +280,7 @@ private module Cached {
 
   pragma[nomagic]
   private ReturnPosition viableReturnPos(DataFlowCall call, ReturnKindExt kind) {
-    viableCallable(call) = result.getCallable() and
+    viableCallableExt(call) = result.getCallable() and
     kind = result.getKind()
   }
 
@@ -317,6 +545,35 @@ private module Cached {
 
   cached
   private module DispatchWithCallContext {
+    /**
+     * Holds if the set of viable implementations that can be called by `call`
+     * might be improved by knowing the call context.
+     */
+    pragma[nomagic]
+    private predicate mayBenefitFromCallContextExt(DataFlowCall call, DataFlowCallable callable) {
+      mayBenefitFromCallContext(call, callable)
+      or
+      callable = call.getEnclosingCallable() and
+      exists(viableCallableLambda(call, TDataFlowCallSome(_)))
+    }
+
+    /**
+     * Gets a viable dispatch target of `call` in the context `ctx`. This is
+     * restricted to those `call`s for which a context might make a difference.
+     */
+    pragma[nomagic]
+    private DataFlowCallable viableImplInCallContextExt(DataFlowCall call, DataFlowCall ctx) {
+      result = viableImplInCallContext(call, ctx)
+      or
+      result = viableCallableLambda(call, TDataFlowCallSome(ctx))
+      or
+      exists(DataFlowCallable enclosing |
+        mayBenefitFromCallContextExt(call, enclosing) and
+        enclosing = viableCallableExt(ctx) and
+        result = viableCallableLambda(call, TDataFlowCallNone())
+      )
+    }
+
     /**
      * Holds if the call context `ctx` reduces the set of viable run-time
      * dispatch targets of call `call` in `c`.
@@ -324,10 +581,10 @@ private module Cached {
     cached
     predicate reducedViableImplInCallContext(DataFlowCall call, DataFlowCallable c, DataFlowCall ctx) {
       exists(int tgts, int ctxtgts |
-        mayBenefitFromCallContext(call, c) and
-        c = viableCallable(ctx) and
-        ctxtgts = count(viableImplInCallContext(call, ctx)) and
-        tgts = strictcount(viableCallable(call)) and
+        mayBenefitFromCallContextExt(call, c) and
+        c = viableCallableExt(ctx) and
+        ctxtgts = count(viableImplInCallContextExt(call, ctx)) and
+        tgts = strictcount(viableCallableExt(call)) and
         ctxtgts < tgts
       )
     }
@@ -339,7 +596,7 @@ private module Cached {
      */
     cached
     DataFlowCallable prunedViableImplInCallContext(DataFlowCall call, DataFlowCall ctx) {
-      result = viableImplInCallContext(call, ctx) and
+      result = viableImplInCallContextExt(call, ctx) and
       reducedViableImplInCallContext(call, _, ctx)
     }
 
@@ -351,10 +608,10 @@ private module Cached {
     cached
     predicate reducedViableImplInReturn(DataFlowCallable c, DataFlowCall call) {
       exists(int tgts, int ctxtgts |
-        mayBenefitFromCallContext(call, _) and
-        c = viableCallable(call) and
-        ctxtgts = count(DataFlowCall ctx | c = viableImplInCallContext(call, ctx)) and
-        tgts = strictcount(DataFlowCall ctx | viableCallable(ctx) = call.getEnclosingCallable()) and
+        mayBenefitFromCallContextExt(call, _) and
+        c = viableCallableExt(call) and
+        ctxtgts = count(DataFlowCall ctx | c = viableImplInCallContextExt(call, ctx)) and
+        tgts = strictcount(DataFlowCall ctx | viableCallableExt(ctx) = call.getEnclosingCallable()) and
         ctxtgts < tgts
       )
     }
@@ -367,7 +624,7 @@ private module Cached {
      */
     cached
     DataFlowCallable prunedViableImplInCallContextReverse(DataFlowCall call, DataFlowCall ctx) {
-      result = viableImplInCallContext(call, ctx) and
+      result = viableImplInCallContextExt(call, ctx) and
       reducedViableImplInReturn(result, call)
     }
   }
@@ -481,6 +738,11 @@ private module Cached {
     TBooleanNone() or
     TBooleanSome(boolean b) { b = true or b = false }
 
+  cached
+  newtype TDataFlowCallOption =
+    TDataFlowCallNone() or
+    TDataFlowCallSome(DataFlowCall call)
+
   cached
   newtype TTypedContent = MkTypedContent(Content c, DataFlowType t) { store(_, c, _, _, t) }
 
@@ -777,7 +1039,7 @@ ReturnPosition getReturnPosition(ReturnNodeExt ret) {
 
 bindingset[cc, callable]
 predicate resolveReturn(CallContext cc, DataFlowCallable callable, DataFlowCall call) {
-  cc instanceof CallContextAny and callable = viableCallable(call)
+  cc instanceof CallContextAny and callable = viableCallableExt(call)
   or
   exists(DataFlowCallable c0, DataFlowCall call0 |
     call0.getEnclosingCallable() = callable and
@@ -791,14 +1053,14 @@ DataFlowCallable resolveCall(DataFlowCall call, CallContext cc) {
   exists(DataFlowCall ctx | cc = TSpecificCall(ctx) |
     if reducedViableImplInCallContext(call, _, ctx)
     then result = prunedViableImplInCallContext(call, ctx)
-    else result = viableCallable(call)
+    else result = viableCallableExt(call)
   )
   or
-  result = viableCallable(call) and cc instanceof CallContextSomeCall
+  result = viableCallableExt(call) and cc instanceof CallContextSomeCall
   or
-  result = viableCallable(call) and cc instanceof CallContextAny
+  result = viableCallableExt(call) and cc instanceof CallContextAny
   or
-  result = viableCallable(call) and cc instanceof CallContextReturn
+  result = viableCallableExt(call) and cc instanceof CallContextReturn
 }
 
 predicate read = readStep/3;
@@ -812,6 +1074,19 @@ class BooleanOption extends TBooleanOption {
   }
 }
 
+/** An optional `DataFlowCall`. */
+class DataFlowCallOption extends TDataFlowCallOption {
+  string toString() {
+    this = TDataFlowCallNone() and
+    result = "(none)"
+    or
+    exists(DataFlowCall call |
+      this = TDataFlowCallSome(call) and
+      result = call.toString()
+    )
+  }
+}
+
 /** Content tagged with the type of a containing object. */
 class TypedContent extends MkTypedContent {
   private Content c;
diff --git a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPrivate.qll b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPrivate.qll
index 958a434eeb1..9b0a8267270 100644
--- a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPrivate.qll
+++ b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPrivate.qll
@@ -1517,10 +1517,13 @@ predicate forReadStep(CfgNode nodeFrom, Content c, Node nodeTo) {
     or
     c instanceof SetElementContent
     or
-    c instanceof TupleElementContent
+    c = small_tuple()
   )
 }
 
+pragma[noinline]
+TupleElementContent small_tuple() { result.getIndex() <= 7 }
+
 /**
  * Holds if `nodeTo` is a read of an attribute (corresponding to `c`) of the object in `nodeFrom`.
  *
@@ -1605,3 +1608,14 @@ int accessPathLimit() { result = 5 }
 
 /** Holds if `n` should be hidden from path explanations. */
 predicate nodeIsHidden(Node n) { none() }
+
+class LambdaCallKind = Unit;
+
+/** Holds if `creation` is an expression that creates a lambda of kind `kind` for `c`. */
+predicate lambdaCreation(Node creation, LambdaCallKind kind, DataFlowCallable c) { none() }
+
+/** Holds if `call` is a lambda call of kind `kind` where `receiver` is the lambda expression. */
+predicate lambdaCall(DataFlowCall call, LambdaCallKind kind, Node receiver) { none() }
+
+/** Extra data-flow steps needed for lamba flow analysis. */
+predicate additionalLambdaFlowStep(Node nodeFrom, Node nodeTo, boolean preservesValue) { none() }
diff --git a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPublic.qll b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPublic.qll
index 7b75fd70f2a..6a397175ab1 100644
--- a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPublic.qll
+++ b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPublic.qll
@@ -6,6 +6,7 @@ private import python
 private import DataFlowPrivate
 import semmle.python.dataflow.new.TypeTracker
 import Attributes
+import LocalSources
 private import semmle.python.essa.SsaCompute
 
 /**
@@ -135,7 +136,7 @@ class Node extends TNode {
   LocalSourceNode backtrack(TypeBackTracker t2, TypeBackTracker t) { t2 = t.step(result, this) }
 
   /**
-   * Gets a local source node from which data may flow to this node in zero or more local steps.
+   * Gets a local source node from which data may flow to this node in zero or more local data-flow steps.
    */
   LocalSourceNode getALocalSource() { result.flowsTo(this) }
 }
@@ -179,7 +180,7 @@ class CfgNode extends Node, TCfgNode {
 }
 
 /** A data-flow node corresponding to a `CallNode` in the control-flow graph. */
-class CallCfgNode extends CfgNode {
+class CallCfgNode extends CfgNode, LocalSourceNode {
   override CallNode node;
 
   /**
@@ -215,7 +216,7 @@ ExprNode exprNode(DataFlowExpr e) { result.getNode().getNode() = e }
  * The value of a parameter at function entry, viewed as a node in a data
  * flow graph.
  */
-class ParameterNode extends CfgNode {
+class ParameterNode extends CfgNode, LocalSourceNode {
   ParameterDefinition def;
 
   ParameterNode() {
@@ -237,6 +238,9 @@ class ParameterNode extends CfgNode {
   Parameter getParameter() { result = def.getParameter() }
 }
 
+/** Gets a node corresponding to parameter `p`. */
+ParameterNode parameterNode(Parameter p) { result.getParameter() = p }
+
 /** A data flow node that represents a call argument. */
 class ArgumentNode extends Node {
   ArgumentNode() { this = any(DataFlowCall c).getArg(_) }
@@ -467,103 +471,6 @@ class BarrierGuard extends GuardNode {
   }
 }
 
-/**
- * A data flow node that is a source of local flow. This includes things like
- * - Expressions
- * - Function parameters
- */
-class LocalSourceNode extends Node {
-  LocalSourceNode() {
-    not simpleLocalFlowStep+(any(CfgNode n), this) and
-    not this instanceof ModuleVariableNode
-    or
-    this = any(ModuleVariableNode mvn).getARead()
-  }
-
-  /** Holds if this `LocalSourceNode` can flow to `nodeTo` in one or more local flow steps. */
-  pragma[inline]
-  predicate flowsTo(Node nodeTo) { Cached::hasLocalSource(nodeTo, this) }
-
-  /**
-   * Gets a reference (read or write) of attribute `attrName` on this node.
-   */
-  AttrRef getAnAttributeReference(string attrName) { Cached::namedAttrRef(this, attrName, result) }
-
-  /**
-   * Gets a read of attribute `attrName` on this node.
-   */
-  AttrRead getAnAttributeRead(string attrName) { result = getAnAttributeReference(attrName) }
-
-  /**
-   * Gets a reference (read or write) of any attribute on this node.
-   */
-  AttrRef getAnAttributeReference() {
-    Cached::namedAttrRef(this, _, result)
-    or
-    Cached::dynamicAttrRef(this, result)
-  }
-
-  /**
-   * Gets a read of any attribute on this node.
-   */
-  AttrRead getAnAttributeRead() { result = getAnAttributeReference() }
-
-  /**
-   * Gets a call to this node.
-   */
-  CallCfgNode getACall() { Cached::call(this, result) }
-}
-
-cached
-private module Cached {
-  /**
-   * Holds if `source` is a `LocalSourceNode` that can reach `sink` via local flow steps.
-   *
-   * The slightly backwards parametering ordering is to force correct indexing.
-   */
-  cached
-  predicate hasLocalSource(Node sink, Node source) {
-    // Declaring `source` to be a `SourceNode` currently causes a redundant check in the
-    // recursive case, so instead we check it explicitly here.
-    source = sink and
-    source instanceof LocalSourceNode
-    or
-    exists(Node mid |
-      hasLocalSource(mid, source) and
-      simpleLocalFlowStep(mid, sink)
-    )
-  }
-
-  /**
-   * Holds if `base` flows to the base of `ref` and `ref` has attribute name `attr`.
-   */
-  cached
-  predicate namedAttrRef(LocalSourceNode base, string attr, AttrRef ref) {
-    base.flowsTo(ref.getObject()) and
-    ref.getAttributeName() = attr
-  }
-
-  /**
-   * Holds if `base` flows to the base of `ref` and `ref` has no known attribute name.
-   */
-  cached
-  predicate dynamicAttrRef(LocalSourceNode base, AttrRef ref) {
-    base.flowsTo(ref.getObject()) and
-    not exists(ref.getAttributeName())
-  }
-
-  /**
-   * Holds if `func` flows to the callee of `call`.
-   */
-  cached
-  predicate call(LocalSourceNode func, CallCfgNode call) {
-    exists(CfgNode n |
-      func.flowsTo(n) and
-      n = call.getFunction()
-    )
-  }
-}
-
 /**
  * Algebraic datatype for tracking data content associated with values.
  * Content can be collection elements or object attributes.
diff --git a/python/ql/src/semmle/python/dataflow/new/internal/LocalSources.qll b/python/ql/src/semmle/python/dataflow/new/internal/LocalSources.qll
new file mode 100644
index 00000000000..7aa311df76b
--- /dev/null
+++ b/python/ql/src/semmle/python/dataflow/new/internal/LocalSources.qll
@@ -0,0 +1,135 @@
+/**
+ * Provides support for intra-procedural tracking of a customizable
+ * set of data flow nodes.
+ *
+ * Note that unlike `TypeTracker.qll`, this library only performs
+ * local tracking within a function.
+ */
+
+import python
+import DataFlowPublic
+private import DataFlowPrivate
+
+private predicate comes_from_cfgnode(Node node) {
+  exists(CfgNode first, Node second |
+    simpleLocalFlowStep(first, second) and
+    simpleLocalFlowStep*(second, node)
+  )
+}
+
+/**
+ * A data flow node that is a source of local flow. This includes things like
+ * - Expressions
+ * - Function parameters
+ *
+ *
+ * Local source nodes and the `flowsTo` relation should be thought of in terms of the reference
+ * semantics of the underlying object. For instance, in the following snippet of code
+ *
+ * ```python
+ *     x = []
+ *     x.append(1)
+ *     x.append(2)
+ * ```
+ *
+ * the local source node corresponding to the occurrences of `x` is the empty list that is assigned to `x`
+ * originally. Even though the two `append` calls modify the value of `x`, they do not change the fact that
+ * `x` still points to the same object. If, however, we next do `x = x + [3]`, then the expression `x + [3]`
+ * will be the new local source of what `x` now points to.
+ */
+class LocalSourceNode extends Node {
+  cached
+  LocalSourceNode() {
+    not comes_from_cfgnode(this) and
+    not this instanceof ModuleVariableNode and
+    // Currently, we create synthetic post-update nodes for
+    // - arguments to calls that may modify said argument
+    // - direct reads a writes of object attributes
+    // Both of these preserve the identity of the underlying pointer, and hence we exclude these as
+    // local source nodes.
+    // We do, however, allow the post-update nodes that arise from object creation (which are non-synthetic).
+    not this instanceof SyntheticPostUpdateNode
+    or
+    this = any(ModuleVariableNode mvn).getARead()
+  }
+
+  /** Holds if this `LocalSourceNode` can flow to `nodeTo` in one or more local flow steps. */
+  pragma[inline]
+  predicate flowsTo(Node nodeTo) { Cached::hasLocalSource(nodeTo, this) }
+
+  /**
+   * Gets a reference (read or write) of attribute `attrName` on this node.
+   */
+  AttrRef getAnAttributeReference(string attrName) { Cached::namedAttrRef(this, attrName, result) }
+
+  /**
+   * Gets a read of attribute `attrName` on this node.
+   */
+  AttrRead getAnAttributeRead(string attrName) { result = getAnAttributeReference(attrName) }
+
+  /**
+   * Gets a reference (read or write) of any attribute on this node.
+   */
+  AttrRef getAnAttributeReference() {
+    Cached::namedAttrRef(this, _, result)
+    or
+    Cached::dynamicAttrRef(this, result)
+  }
+
+  /**
+   * Gets a read of any attribute on this node.
+   */
+  AttrRead getAnAttributeRead() { result = getAnAttributeReference() }
+
+  /**
+   * Gets a call to this node.
+   */
+  CallCfgNode getACall() { Cached::call(this, result) }
+}
+
+cached
+private module Cached {
+  /**
+   * Holds if `source` is a `LocalSourceNode` that can reach `sink` via local flow steps.
+   *
+   * The slightly backwards parametering ordering is to force correct indexing.
+   */
+  cached
+  predicate hasLocalSource(Node sink, LocalSourceNode source) {
+    source = sink
+    or
+    exists(Node second |
+      simpleLocalFlowStep(source, second) and
+      simpleLocalFlowStep*(second, sink)
+    )
+  }
+
+  /**
+   * Holds if `base` flows to the base of `ref` and `ref` has attribute name `attr`.
+   */
+  cached
+  predicate namedAttrRef(LocalSourceNode base, string attr, AttrRef ref) {
+    base.flowsTo(ref.getObject()) and
+    ref.getAttributeName() = attr
+  }
+
+  /**
+   * Holds if `base` flows to the base of `ref` and `ref` has no known attribute name.
+   */
+  cached
+  predicate dynamicAttrRef(LocalSourceNode base, AttrRef ref) {
+    base.flowsTo(ref.getObject()) and
+    not exists(ref.getAttributeName())
+  }
+
+  /**
+   * Holds if `func` flows to the callee of `call`.
+   */
+  cached
+  predicate call(LocalSourceNode func, CallCfgNode call) {
+    exists(CfgNode n |
+      func.flowsTo(n) and
+      n = call.getFunction()
+    )
+  }
+}
diff --git a/python/ql/src/semmle/python/frameworks/Cryptography.qll b/python/ql/src/semmle/python/frameworks/Cryptography.qll
index ec929e78836..3396d7dfa55 100644
--- a/python/ql/src/semmle/python/frameworks/Cryptography.qll
+++ b/python/ql/src/semmle/python/frameworks/Cryptography.qll
@@ -76,11 +76,11 @@ private module CryptographyModel {
     }
 
     /** Gets a reference to a predefined curve class instance with a specific key size (in bits), as well as the origin of the class. */
-    private DataFlow::Node curveClassInstanceWithKeySize(
+    private DataFlow::LocalSourceNode curveClassInstanceWithKeySize(
       DataFlow::TypeTracker t, int keySize, DataFlow::Node origin
     ) {
       t.start() and
-      result.asCfgNode().(CallNode).getFunction() = curveClassWithKeySize(keySize).asCfgNode() and
+      result.(DataFlow::CallCfgNode).getFunction() = curveClassWithKeySize(keySize) and
       origin = result
       or
       // Due to bad performance when using normal setup with we have inlined that code and forced a join
@@ -102,7 +102,7 @@ private module CryptographyModel {
 
     /** Gets a reference to a predefined curve class instance with a specific key size (in bits), as well as the origin of the class. */
     DataFlow::Node curveClassInstanceWithKeySize(int keySize, DataFlow::Node origin) {
-      result = curveClassInstanceWithKeySize(DataFlow::TypeTracker::end(), keySize, origin)
+      curveClassInstanceWithKeySize(DataFlow::TypeTracker::end(), keySize, origin).flowsTo(result)
     }
   }
 
diff --git a/python/ql/src/semmle/python/frameworks/Dill.qll b/python/ql/src/semmle/python/frameworks/Dill.qll
index d105bd47603..94af905756b 100644
--- a/python/ql/src/semmle/python/frameworks/Dill.qll
+++ b/python/ql/src/semmle/python/frameworks/Dill.qll
@@ -7,50 +7,19 @@ private import python
 private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.dataflow.new.RemoteFlowSources
 private import semmle.python.Concepts
-
-private module Dill {
-  /** Gets a reference to the `dill` module. */
-  private DataFlow::Node dill(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("dill")
-    or
-    exists(DataFlow::TypeTracker t2 | result = dill(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `dill` module. */
-  DataFlow::Node dill() { result = dill(DataFlow::TypeTracker::end()) }
-
-  /** Provides models for the `dill` module. */
-  module dill {
-    /** Gets a reference to the `dill.loads` function. */
-    private DataFlow::Node loads(DataFlow::TypeTracker t) {
-      t.start() and
-      result = DataFlow::importNode("dill.loads")
-      or
-      t.startInAttr("loads") and
-      result = dill()
-      or
-      exists(DataFlow::TypeTracker t2 | result = loads(t2).track(t2, t))
-    }
-
-    /** Gets a reference to the `dill.loads` function. */
-    DataFlow::Node loads() { result = loads(DataFlow::TypeTracker::end()) }
-  }
-}
+private import semmle.python.ApiGraphs
 
 /**
  * A call to `dill.loads`
  * See https://pypi.org/project/dill/ (which currently refers you
  * to https://docs.python.org/3/library/pickle.html#pickle.loads)
  */
-private class DillLoadsCall extends Decoding::Range, DataFlow::CfgNode {
-  override CallNode node;
-
-  DillLoadsCall() { node.getFunction() = Dill::dill::loads().asCfgNode() }
+private class DillLoadsCall extends Decoding::Range, DataFlow::CallCfgNode {
+  DillLoadsCall() { this = API::moduleImport("dill").getMember("loads").getACall() }
 
   override predicate mayExecuteInput() { any() }
 
-  override DataFlow::Node getAnInput() { result.asCfgNode() = node.getArg(0) }
+  override DataFlow::Node getAnInput() { result = this.getArg(0) }
 
   override DataFlow::Node getOutput() { result = this }
 
diff --git a/python/ql/src/semmle/python/frameworks/Django.qll b/python/ql/src/semmle/python/frameworks/Django.qll
index 9f56bd5a299..23c0a814a7a 100644
--- a/python/ql/src/semmle/python/frameworks/Django.qll
+++ b/python/ql/src/semmle/python/frameworks/Django.qll
@@ -8,6 +8,7 @@ private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.dataflow.new.RemoteFlowSources
 private import semmle.python.dataflow.new.TaintTracking
 private import semmle.python.Concepts
+private import semmle.python.ApiGraphs
 private import semmle.python.frameworks.PEP249
 private import semmle.python.regex
 
@@ -16,58 +17,288 @@ private import semmle.python.regex
  * See https://www.djangoproject.com/.
  */
 private module Django {
+  /** Provides models for the `django.views` module */
+  module Views {
+    /**
+     * Provides models for the `django.views.generic.View` class and subclasses.
+     *
+     * See
+     *  - https://docs.djangoproject.com/en/3.1/topics/class-based-views/
+     *  - https://docs.djangoproject.com/en/3.1/ref/class-based-views/
+     */
+    module View {
+      /**
+       * An `API::Node` representing the `django.views.generic.View` class or any subclass
+       * that has explicitly been modeled in the CodeQL libraries.
+       */
+      abstract class ModeledSubclass extends API::Node {
+        override string toString() { result = this.(API::Node).toString() }
+      }
+
+      /** A Django view subclass in the `django` package. */
+      private class DjangoViewSubclassesInDjango extends ModeledSubclass {
+        DjangoViewSubclassesInDjango() {
+          exists(string moduleName, string className |
+            // canonical definition
+            this =
+              API::moduleImport("django")
+                  .getMember("views")
+                  .getMember("generic")
+                  .getMember(moduleName)
+                  .getMember(className)
+            or
+            // aliases from `django.views.generic`
+            this =
+              API::moduleImport("django")
+                  .getMember("views")
+                  .getMember("generic")
+                  .getMember(className)
+          |
+            moduleName = "base" and
+            className in ["RedirectView", "TemplateView", "View"]
+            or
+            moduleName = "dates" and
+            className in [
+                "ArchiveIndexView", "DateDetailView", "DayArchiveView", "MonthArchiveView",
+                "TodayArchiveView", "WeekArchiveView", "YearArchiveView"
+              ]
+            or
+            moduleName = "detail" and
+            className = "DetailView"
+            or
+            moduleName = "edit" and
+            className in ["CreateView", "DeleteView", "FormView", "UpdateView"]
+            or
+            moduleName = "list" and
+            className = "ListView"
+          )
+          or
+          // `django.views.View` alias
+          this = API::moduleImport("django").getMember("views").getMember("View")
+        }
+      }
+
+      /** Gets a reference to the `django.views.generic.View` class or any subclass. */
+      API::Node subclassRef() { result = any(ModeledSubclass subclass).getASubclass*() }
+    }
+  }
+
+  /** Provides models for django forms (defined in the `django.forms` module) */
+  module Forms {
+    /**
+     * Provides models for the `django.forms.forms.BaseForm` class and subclasses. This
+     * is usually used by the `django.forms.forms.Form` class, which is also available
+     * under the more commonly used alias `django.forms.Form`.
+     *
+     * See https://docs.djangoproject.com/en/3.1/ref/forms/api/
+     */
+    module Form {
+      /**
+       * An `API::Node` representing the `django.forms.forms.BaseForm` class or any subclass
+       * that has explicitly been modeled in the CodeQL libraries.
+       */
+      abstract class ModeledSubclass extends API::Node {
+        override string toString() { result = this.(API::Node).toString() }
+      }
+
+      /** A Django form subclass in the `django` package. */
+      private class DjangoFormSubclassesInDjango extends ModeledSubclass {
+        DjangoFormSubclassesInDjango() {
+          // canonical definition
+          this =
+            API::moduleImport("django")
+                .getMember("forms")
+                .getMember("forms")
+                .getMember(["BaseForm", "Form"])
+          or
+          this =
+            API::moduleImport("django")
+                .getMember("forms")
+                .getMember("models")
+                .getMember(["BaseModelForm", "ModelForm"])
+          or
+          // aliases from `django.forms`
+          this =
+            API::moduleImport("django")
+                .getMember("forms")
+                .getMember(["BaseForm", "Form", "BaseModelForm", "ModelForm"])
+          or
+          // other Form subclasses defined in Django
+          this =
+            API::moduleImport("django")
+                .getMember("contrib")
+                .getMember("admin")
+                .getMember("forms")
+                .getMember(["AdminAuthenticationForm", "AdminPasswordChangeForm"])
+          or
+          this =
+            API::moduleImport("django")
+                .getMember("contrib")
+                .getMember("admin")
+                .getMember("helpers")
+                .getMember("ActionForm")
+          or
+          this =
+            API::moduleImport("django")
+                .getMember("contrib")
+                .getMember("admin")
+                .getMember("views")
+                .getMember("main")
+                .getMember("ChangeListSearchForm")
+          or
+          this =
+            API::moduleImport("django")
+                .getMember("contrib")
+                .getMember("auth")
+                .getMember("forms")
+                .getMember([
+                    "PasswordResetForm", "UserChangeForm", "SetPasswordForm",
+                    "AdminPasswordChangeForm", "PasswordChangeForm", "AuthenticationForm",
+                    "UserCreationForm"
+                  ])
+          or
+          this =
+            API::moduleImport("django")
+                .getMember("contrib")
+                .getMember("flatpages")
+                .getMember("forms")
+                .getMember("FlatpageForm")
+          or
+          this =
+            API::moduleImport("django")
+                .getMember("forms")
+                .getMember("formsets")
+                .getMember("ManagementForm")
+          or
+          this =
+            API::moduleImport("django")
+                .getMember("forms")
+                .getMember("models")
+                .getMember(["ModelForm", "BaseModelForm"])
+        }
+      }
+
+      /** Gets a reference to the `django.forms.forms.BaseForm` class or any subclass. */
+      API::Node subclassRef() { result = any(ModeledSubclass subclass).getASubclass*() }
+    }
+
+    /**
+     * Provides models for the `django.forms.fields.Field` class and subclasses. This is
+     * also available under the more commonly used alias `django.forms.Field`.
+     *
+     * See https://docs.djangoproject.com/en/3.1/ref/forms/fields/
+     */
+    module Field {
+      /**
+       * An `API::Node` representing the `django.forms.fields.Field` class or any subclass
+       * that has explicitly been modeled in the CodeQL libraries.
+       */
+      abstract class ModeledSubclass extends API::Node {
+        override string toString() { result = this.(API::Node).toString() }
+      }
+
+      /** A Django field subclass in the `django` package. */
+      private class DjangoFieldSubclassesInDjango extends ModeledSubclass {
+        DjangoFieldSubclassesInDjango() {
+          exists(string moduleName, string className |
+            // canonical definition
+            this =
+              API::moduleImport("django")
+                  .getMember("forms")
+                  .getMember(moduleName)
+                  .getMember(className)
+            or
+            // aliases from `django.forms`
+            this = API::moduleImport("django").getMember("forms").getMember(className)
+          |
+            moduleName = "fields" and
+            className in [
+                "Field",
+                // Known subclasses
+                "BooleanField", "IntegerField", "CharField", "SlugField", "DateTimeField",
+                "EmailField", "DateField", "TimeField", "DurationField", "DecimalField",
+                "FloatField", "GenericIPAddressField", "UUIDField", "JSONField", "FilePathField",
+                "NullBooleanField", "URLField", "TypedChoiceField", "FileField", "ImageField",
+                "RegexField", "ChoiceField", "MultipleChoiceField", "ComboField", "MultiValueField",
+                "SplitDateTimeField", "TypedMultipleChoiceField", "BaseTemporalField"
+              ]
+            or
+            // Known subclasses from `django.forms.models`
+            moduleName = "models" and
+            className in ["ModelChoiceField", "ModelMultipleChoiceField", "InlineForeignKeyField"]
+          )
+          or
+          // other Field subclasses defined in Django
+          this =
+            API::moduleImport("django")
+                .getMember("contrib")
+                .getMember("auth")
+                .getMember("forms")
+                .getMember(["ReadOnlyPasswordHashField", "UsernameField"])
+          or
+          this =
+            API::moduleImport("django")
+                .getMember("contrib")
+                .getMember("gis")
+                .getMember("forms")
+                .getMember("fields")
+                .getMember([
+                    "GeometryCollectionField", "GeometryField", "LineStringField",
+                    "MultiLineStringField", "MultiPointField", "MultiPolygonField", "PointField",
+                    "PolygonField"
+                  ])
+          or
+          this =
+            API::moduleImport("django")
+                .getMember("contrib")
+                .getMember("postgres")
+                .getMember("forms")
+                .getMember("array")
+                .getMember(["SimpleArrayField", "SplitArrayField"])
+          or
+          this =
+            API::moduleImport("django")
+                .getMember("contrib")
+                .getMember("postgres")
+                .getMember("forms")
+                .getMember("hstore")
+                .getMember("HStoreField")
+          or
+          this =
+            API::moduleImport("django")
+                .getMember("contrib")
+                .getMember("postgres")
+                .getMember("forms")
+                .getMember("ranges")
+                .getMember([
+                    "BaseRangeField", "DateRangeField", "DateTimeRangeField", "DecimalRangeField",
+                    "IntegerRangeField"
+                  ])
+          or
+          this =
+            API::moduleImport("django")
+                .getMember("forms")
+                .getMember("models")
+                .getMember(["InlineForeignKeyField", "ModelChoiceField", "ModelMultipleChoiceField"])
+        }
+      }
+
+      /** Gets a reference to the `django.forms.fields.Field` class or any subclass. */
+      API::Node subclassRef() { result = any(ModeledSubclass subclass).getASubclass*() }
+    }
+  }
+}
+
+/**
+ * Provides models for the `django` PyPI package (that we are not quite ready to publicly expose yet).
+ * See https://www.djangoproject.com/.
+ */
+private module PrivateDjango {
   // ---------------------------------------------------------------------------
   // django
   // ---------------------------------------------------------------------------
   /** Gets a reference to the `django` module. */
-  private DataFlow::Node django(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("django")
-    or
-    exists(DataFlow::TypeTracker t2 | result = django(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `django` module. */
-  DataFlow::Node django() { result = django(DataFlow::TypeTracker::end()) }
-
-  /**
-   * Gets a reference to the attribute `attr_name` of the `django` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private DataFlow::Node django_attr(DataFlow::TypeTracker t, string attr_name) {
-    attr_name in ["db", "urls", "http", "conf", "views", "shortcuts"] and
-    (
-      t.start() and
-      result = DataFlow::importNode("django" + "." + attr_name)
-      or
-      t.startInAttr(attr_name) and
-      result = DataFlow::importNode("django")
-    )
-    or
-    // Due to bad performance when using normal setup with `django_attr(t2, attr_name).track(t2, t)`
-    // we have inlined that code and forced a join
-    exists(DataFlow::TypeTracker t2 |
-      exists(DataFlow::StepSummary summary |
-        django_attr_first_join(t2, attr_name, result, summary) and
-        t = t2.append(summary)
-      )
-    )
-  }
-
-  pragma[nomagic]
-  private predicate django_attr_first_join(
-    DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res, DataFlow::StepSummary summary
-  ) {
-    DataFlow::StepSummary::step(django_attr(t2, attr_name), res, summary)
-  }
-
-  /**
-   * Gets a reference to the attribute `attr_name` of the `django` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private DataFlow::Node django_attr(string attr_name) {
-    result = django_attr(DataFlow::TypeTracker::end(), attr_name)
-  }
+  API::Node django() { result = API::moduleImport("django") }
 
   /** Provides models for the `django` module. */
   module django {
@@ -75,163 +306,101 @@ private module Django {
     // django.db
     // -------------------------------------------------------------------------
     /** Gets a reference to the `django.db` module. */
-    DataFlow::Node db() { result = django_attr("db") }
+    API::Node db() { result = django().getMember("db") }
 
-    class DjangoDb extends PEP249Module {
-      DjangoDb() { this = db() }
+    /**
+     * `django.db` implements PEP249, providing ways to execute SQL statements against a database.
+     */
+    private class DjangoDb extends PEP249ModuleApiNode {
+      DjangoDb() { this = API::moduleImport("django").getMember("db") }
     }
 
     /** Provides models for the `django.db` module. */
     module db {
       /** Gets a reference to the `django.db.connection` object. */
-      private DataFlow::Node connection(DataFlow::TypeTracker t) {
-        t.start() and
-        result = DataFlow::importNode("django.db.connection")
-        or
-        t.startInAttr("connection") and
-        result = db()
-        or
-        exists(DataFlow::TypeTracker t2 | result = connection(t2).track(t2, t))
-      }
-
-      /** Gets a reference to the `django.db.connection` object. */
-      DataFlow::Node connection() { result = connection(DataFlow::TypeTracker::end()) }
+      API::Node connection() { result = db().getMember("connection") }
 
       class DjangoDbConnection extends Connection::InstanceSource {
-        DjangoDbConnection() { this = connection() }
+        DjangoDbConnection() { this = connection().getAUse() }
       }
 
       // -------------------------------------------------------------------------
       // django.db.models
       // -------------------------------------------------------------------------
-      // NOTE: The modelling of django models is currently fairly incomplete.
-      // It does not fully take `Model`s, `Manager`s, `and QuerySet`s into account.
-      // It simply identifies some common dangerous cases.
       /** Gets a reference to the `django.db.models` module. */
-      private DataFlow::Node models(DataFlow::TypeTracker t) {
-        t.start() and
-        result = DataFlow::importNode("django.db.models")
-        or
-        t.startInAttr("models") and
-        result = django()
-        or
-        exists(DataFlow::TypeTracker t2 | result = models(t2).track(t2, t))
-      }
-
-      /** Gets a reference to the `django.db.models` module. */
-      DataFlow::Node models() { result = models(DataFlow::TypeTracker::end()) }
+      API::Node models() { result = db().getMember("models") }
 
       /** Provides models for the `django.db.models` module. */
       module models {
-        /** Provides models for the `django.db.models.Model` class. */
+        /**
+         * Provides models for the `django.db.models.Model` class and subclasses.
+         *
+         * See https://docs.djangoproject.com/en/3.1/topics/db/models/.
+         */
         module Model {
-          /** Gets a reference to the `django.db.models.Model` class. */
-          private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-            t.start() and
-            result = DataFlow::importNode("django.db.models.Model")
-            or
-            t.startInAttr("Model") and
-            result = models()
-            or
-            // subclass
-            result.asExpr().(ClassExpr).getABase() = classRef(t.continue()).asExpr()
-            or
-            exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
+          /** Gets a reference to the `flask.views.View` class or any subclass. */
+          API::Node subclassRef() {
+            result =
+              API::moduleImport("django")
+                  .getMember("db")
+                  .getMember("models")
+                  .getMember("Model")
+                  .getASubclass*()
           }
-
-          /** Gets a reference to the `django.db.models.Model` class. */
-          DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
-        }
-
-        /** Gets a reference to the `objects` object of a django model. */
-        private DataFlow::Node objects(DataFlow::TypeTracker t) {
-          t.startInAttr("objects") and
-          result = Model::classRef()
-          or
-          exists(DataFlow::TypeTracker t2 | result = objects(t2).track(t2, t))
-        }
-
-        /** Gets a reference to the `objects` object of a model. */
-        DataFlow::Node objects() { result = objects(DataFlow::TypeTracker::end()) }
-
-        /**
-         * Gets a reference to the attribute `attr_name` of an `objects` object.
-         * WARNING: Only holds for a few predefined attributes.
-         */
-        private DataFlow::Node objects_attr(DataFlow::TypeTracker t, string attr_name) {
-          attr_name in ["annotate", "extra", "raw"] and
-          t.startInAttr(attr_name) and
-          result = objects()
-          or
-          // Due to bad performance when using normal setup with `objects_attr(t2, attr_name).track(t2, t)`
-          // we have inlined that code and forced a join
-          exists(DataFlow::TypeTracker t2 |
-            exists(DataFlow::StepSummary summary |
-              objects_attr_first_join(t2, attr_name, result, summary) and
-              t = t2.append(summary)
-            )
-          )
-        }
-
-        pragma[nomagic]
-        private predicate objects_attr_first_join(
-          DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,
-          DataFlow::StepSummary summary
-        ) {
-          DataFlow::StepSummary::step(objects_attr(t2, attr_name), res, summary)
         }
 
         /**
-         * Gets a reference to the attribute `attr_name` of an `objects` object.
-         * WARNING: Only holds for a few predefined attributes.
+         * Gets a reference to the Manager (django.db.models.Manager) for a django Model,
+         * accessed by `<ModelName>.objects`.
          */
-        DataFlow::Node objects_attr(string attr_name) {
-          result = objects_attr(DataFlow::TypeTracker::end(), attr_name)
+        API::Node manager() { result = Model::subclassRef().getMember("objects") }
+
+        /**
+         * Gets a method with `name` that returns a QuerySet.
+         * This method can originate on a QuerySet or a Manager.
+         *
+         * See https://docs.djangoproject.com/en/3.1/ref/models/querysets/
+         */
+        API::Node querySetReturningMethod(string name) {
+          name in [
+              "none", "all", "filter", "exclude", "complex_filter", "union", "intersection",
+              "difference", "select_for_update", "select_related", "prefetch_related", "order_by",
+              "distinct", "reverse", "defer", "only", "using", "annotate", "extra", "raw",
+              "datetimes", "dates", "values", "values_list"
+            ] and
+          result = [manager(), querySet()].getMember(name)
         }
 
-        /** Gets a reference to the `django.db.models.expressions` module. */
-        private DataFlow::Node expressions(DataFlow::TypeTracker t) {
-          t.start() and
-          result = DataFlow::importNode("django.db.models.expressions")
-          or
-          t.startInAttr("expressions") and
-          result = models()
-          or
-          exists(DataFlow::TypeTracker t2 | result = expressions(t2).track(t2, t))
-        }
+        /**
+         * Gets a reference to a QuerySet (django.db.models.query.QuerySet).
+         *
+         * See https://docs.djangoproject.com/en/3.1/ref/models/querysets/
+         */
+        API::Node querySet() { result = querySetReturningMethod(_).getReturn() }
 
         /** Gets a reference to the `django.db.models.expressions` module. */
-        DataFlow::Node expressions() { result = expressions(DataFlow::TypeTracker::end()) }
+        API::Node expressions() { result = models().getMember("expressions") }
 
         /** Provides models for the `django.db.models.expressions` module. */
         module expressions {
           /** Provides models for the `django.db.models.expressions.RawSQL` class. */
           module RawSQL {
-            /** Gets a reference to the `django.db.models.expressions.RawSQL` class. */
-            private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-              t.start() and
-              result = DataFlow::importNode("django.db.models.expressions.RawSQL")
-              or
-              t.start() and
-              result = DataFlow::importNode("django.db.models.RawSQL") // Commonly used alias
-              or
-              t.startInAttr("RawSQL") and
-              result = expressions()
-              or
-              exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
-            }
-
             /**
              * Gets a reference to the `django.db.models.expressions.RawSQL` class.
              */
-            DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
+            API::Node classRef() {
+              result = expressions().getMember("RawSQL")
+              or
+              // Commonly used alias
+              result = models().getMember("RawSQL")
+            }
 
             /** Gets an instance of the `django.db.models.expressions.RawSQL` class. */
-            private DataFlow::Node instance(DataFlow::TypeTracker t, ControlFlowNode sql) {
+            private DataFlow::LocalSourceNode instance(DataFlow::TypeTracker t, ControlFlowNode sql) {
               t.start() and
-              exists(CallNode c | result.asCfgNode() = c |
-                c.getFunction() = classRef().asCfgNode() and
-                c.getArg(0) = sql
+              exists(DataFlow::CallCfgNode c | result = c |
+                c = classRef().getACall() and
+                c.getArg(0).asCfgNode() = sql
               )
               or
               exists(DataFlow::TypeTracker t2 | result = instance(t2, sql).track(t2, t))
@@ -239,7 +408,7 @@ private module Django {
 
             /** Gets an instance of the `django.db.models.expressions.RawSQL` class. */
             DataFlow::Node instance(ControlFlowNode sql) {
-              result = instance(DataFlow::TypeTracker::end(), sql)
+              instance(DataFlow::TypeTracker::end(), sql).flowsTo(result)
             }
           }
         }
@@ -253,14 +422,13 @@ private module Django {
      *
      * See https://docs.djangoproject.com/en/3.1/ref/models/querysets/#annotate
      */
-    private class ObjectsAnnotate extends SqlExecution::Range, DataFlow::CfgNode {
-      override CallNode node;
+    private class ObjectsAnnotate extends SqlExecution::Range, DataFlow::CallCfgNode {
       ControlFlowNode sql;
 
       ObjectsAnnotate() {
-        node.getFunction() = django::db::models::objects_attr("annotate").asCfgNode() and
-        django::db::models::expressions::RawSQL::instance(sql).asCfgNode() in [
-            node.getArg(_), node.getArgByName(_)
+        this = django::db::models::querySetReturningMethod("annotate").getACall() and
+        django::db::models::expressions::RawSQL::instance(sql) in [
+            this.getArg(_), this.getArgByName(_)
           ]
       }
 
@@ -274,12 +442,10 @@ private module Django {
      * - https://docs.djangoproject.com/en/3.1/topics/db/sql/#django.db.models.Manager.raw
      * - https://docs.djangoproject.com/en/3.1/ref/models/querysets/#raw
      */
-    private class ObjectsRaw extends SqlExecution::Range, DataFlow::CfgNode {
-      override CallNode node;
+    private class ObjectsRaw extends SqlExecution::Range, DataFlow::CallCfgNode {
+      ObjectsRaw() { this = django::db::models::querySetReturningMethod("raw").getACall() }
 
-      ObjectsRaw() { node.getFunction() = django::db::models::objects_attr("raw").asCfgNode() }
-
-      override DataFlow::Node getSql() { result.asCfgNode() = node.getArg(0) }
+      override DataFlow::Node getSql() { result = this.getArg(0) }
     }
 
     /**
@@ -287,14 +453,13 @@ private module Django {
      *
      * See https://docs.djangoproject.com/en/3.1/ref/models/querysets/#extra
      */
-    private class ObjectsExtra extends SqlExecution::Range, DataFlow::CfgNode {
-      override CallNode node;
-
-      ObjectsExtra() { node.getFunction() = django::db::models::objects_attr("extra").asCfgNode() }
+    private class ObjectsExtra extends SqlExecution::Range, DataFlow::CallCfgNode {
+      ObjectsExtra() { this = django::db::models::querySetReturningMethod("extra").getACall() }
 
       override DataFlow::Node getSql() {
-        result.asCfgNode() =
-          [node.getArg([0, 1, 3, 4]), node.getArgByName(["select", "where", "tables", "order_by"])]
+        result in [
+            this.getArg([0, 1, 3, 4]), this.getArgByName(["select", "where", "tables", "order_by"])
+          ]
       }
     }
 
@@ -302,112 +467,45 @@ private module Django {
     // django.urls
     // -------------------------------------------------------------------------
     /** Gets a reference to the `django.urls` module. */
-    DataFlow::Node urls() { result = django_attr("urls") }
+    API::Node urls() { result = django().getMember("urls") }
 
     /** Provides models for the `django.urls` module */
     module urls {
-      /**
-       * Gets a reference to the attribute `attr_name` of the `urls` module.
-       * WARNING: Only holds for a few predefined attributes.
-       */
-      private DataFlow::Node urls_attr(DataFlow::TypeTracker t, string attr_name) {
-        attr_name in ["path", "re_path"] and
-        (
-          t.start() and
-          result = DataFlow::importNode("django.urls" + "." + attr_name)
-          or
-          t.startInAttr(attr_name) and
-          result = DataFlow::importNode("django.urls")
-          or
-          t.startInAttr(attr_name) and
-          result = django::urls()
-        )
-        or
-        // Due to bad performance when using normal setup with `urls_attr(t2, attr_name).track(t2, t)`
-        // we have inlined that code and forced a join
-        exists(DataFlow::TypeTracker t2 |
-          exists(DataFlow::StepSummary summary |
-            urls_attr_first_join(t2, attr_name, result, summary) and
-            t = t2.append(summary)
-          )
-        )
-      }
-
-      pragma[nomagic]
-      private predicate urls_attr_first_join(
-        DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,
-        DataFlow::StepSummary summary
-      ) {
-        DataFlow::StepSummary::step(urls_attr(t2, attr_name), res, summary)
-      }
-
-      /**
-       * Gets a reference to the attribute `attr_name` of the `urls` module.
-       * WARNING: Only holds for a few predefined attributes.
-       */
-      private DataFlow::Node urls_attr(string attr_name) {
-        result = urls_attr(DataFlow::TypeTracker::end(), attr_name)
-      }
-
       /**
        * Gets a reference to the `django.urls.path` function.
        * See https://docs.djangoproject.com/en/3.0/ref/urls/#path
        */
-      DataFlow::Node path() { result = urls_attr("path") }
+      API::Node path() { result = urls().getMember("path") }
 
       /**
        * Gets a reference to the `django.urls.re_path` function.
        * See https://docs.djangoproject.com/en/3.0/ref/urls/#re_path
        */
-      DataFlow::Node re_path() { result = urls_attr("re_path") }
+      API::Node re_path() { result = urls().getMember("re_path") }
     }
 
     // -------------------------------------------------------------------------
     // django.conf
     // -------------------------------------------------------------------------
     /** Gets a reference to the `django.conf` module. */
-    DataFlow::Node conf() { result = django_attr("conf") }
+    API::Node conf() { result = django().getMember("conf") }
 
     /** Provides models for the `django.conf` module */
     module conf {
-      // -------------------------------------------------------------------------
-      // django.conf.urls
-      // -------------------------------------------------------------------------
-      /** Gets a reference to the `django.conf.urls` module. */
-      private DataFlow::Node urls(DataFlow::TypeTracker t) {
-        t.start() and
-        result = DataFlow::importNode("django.conf.urls")
-        or
-        t.startInAttr("urls") and
-        result = conf()
-        or
-        exists(DataFlow::TypeTracker t2 | result = urls(t2).track(t2, t))
-      }
-
-      // NOTE: had to rename due to shadowing rules in QL
-      /** Gets a reference to the `django.conf.urls` module. */
-      DataFlow::Node conf_urls() { result = urls(DataFlow::TypeTracker::end()) }
-
-      // NOTE: had to rename due to shadowing rules in QL
-      /** Provides models for the `django.conf.urls` module */
       module conf_urls {
-        /** Gets a reference to the `django.conf.urls.url` function. */
-        private DataFlow::Node url(DataFlow::TypeTracker t) {
-          t.start() and
-          result = DataFlow::importNode("django.conf.urls.url")
-          or
-          t.startInAttr("url") and
-          result = conf_urls()
-          or
-          exists(DataFlow::TypeTracker t2 | result = url(t2).track(t2, t))
-        }
+        // -------------------------------------------------------------------------
+        // django.conf.urls
+        // -------------------------------------------------------------------------
+        // NOTE: had to rename due to shadowing rules in QL
+        /** Gets a reference to the `django.conf.urls` module. */
+        API::Node conf_urls() { result = conf().getMember("urls") }
 
         /**
          * Gets a reference to the `django.conf.urls.url` function.
          *
          * See https://docs.djangoproject.com/en/1.11/ref/urls/#django.conf.urls.url
          */
-        DataFlow::Node url() { result = url(DataFlow::TypeTracker::end()) }
+        API::Node url() { result = conf_urls().getMember("url") }
       }
     }
 
@@ -415,109 +513,18 @@ private module Django {
     // django.http
     // -------------------------------------------------------------------------
     /** Gets a reference to the `django.http` module. */
-    DataFlow::Node http() { result = django_attr("http") }
+    API::Node http() { result = django().getMember("http") }
 
     /** Provides models for the `django.http` module */
     module http {
-      /**
-       * Gets a reference to the attribute `attr_name` of the `django.http` module.
-       * WARNING: Only holds for a few predefined attributes.
-       */
-      private DataFlow::Node http_attr(DataFlow::TypeTracker t, string attr_name) {
-        attr_name in [
-            // request
-            "request", "HttpRequest",
-            // response
-            "response", "HttpResponse",
-            // HttpResponse subclasses
-            "HttpResponseRedirect", "HttpResponsePermanentRedirect", "HttpResponseNotModified",
-            "HttpResponseBadRequest", "HttpResponseNotFound", "HttpResponseForbidden",
-            "HttpResponseNotAllowed", "HttpResponseGone", "HttpResponseServerError", "JsonResponse",
-            // HttpResponse-like classes
-            "StreamingHttpResponse", "FileResponse"
-          ] and
-        (
-          t.start() and
-          result = DataFlow::importNode("django.http" + "." + attr_name)
-          or
-          t.startInAttr(attr_name) and
-          result = django::http()
-        )
-        or
-        // Due to bad performance when using normal setup with `http_attr(t2, attr_name).track(t2, t)`
-        // we have inlined that code and forced a join
-        exists(DataFlow::TypeTracker t2 |
-          exists(DataFlow::StepSummary summary |
-            http_attr_first_join(t2, attr_name, result, summary) and
-            t = t2.append(summary)
-          )
-        )
-      }
-
-      pragma[nomagic]
-      private predicate http_attr_first_join(
-        DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,
-        DataFlow::StepSummary summary
-      ) {
-        DataFlow::StepSummary::step(http_attr(t2, attr_name), res, summary)
-      }
-
-      /**
-       * Gets a reference to the attribute `attr_name` of the `django.http` module.
-       * WARNING: Only holds for a few predefined attributes.
-       */
-      private DataFlow::Node http_attr(string attr_name) {
-        result = http_attr(DataFlow::TypeTracker::end(), attr_name)
-      }
-
       // ---------------------------------------------------------------------------
       // django.http.request
       // ---------------------------------------------------------------------------
       /** Gets a reference to the `django.http.request` module. */
-      DataFlow::Node request() { result = http_attr("request") }
+      API::Node request() { result = http().getMember("request") }
 
       /** Provides models for the `django.http.request` module. */
       module request {
-        /**
-         * Gets a reference to the attribute `attr_name` of the `django.http.request` module.
-         * WARNING: Only holds for a few predefined attributes.
-         */
-        private DataFlow::Node request_attr(DataFlow::TypeTracker t, string attr_name) {
-          attr_name in ["HttpRequest"] and
-          (
-            t.start() and
-            result = DataFlow::importNode("django.http.request" + "." + attr_name)
-            or
-            t.startInAttr(attr_name) and
-            result = django::http::request()
-          )
-          or
-          // Due to bad performance when using normal setup with `request_attr(t2, attr_name).track(t2, t)`
-          // we have inlined that code and forced a join
-          exists(DataFlow::TypeTracker t2 |
-            exists(DataFlow::StepSummary summary |
-              request_attr_first_join(t2, attr_name, result, summary) and
-              t = t2.append(summary)
-            )
-          )
-        }
-
-        pragma[nomagic]
-        private predicate request_attr_first_join(
-          DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,
-          DataFlow::StepSummary summary
-        ) {
-          DataFlow::StepSummary::step(request_attr(t2, attr_name), res, summary)
-        }
-
-        /**
-         * Gets a reference to the attribute `attr_name` of the `django.http.request` module.
-         * WARNING: Only holds for a few predefined attributes.
-         */
-        private DataFlow::Node request_attr(string attr_name) {
-          result = request_attr(DataFlow::TypeTracker::end(), attr_name)
-        }
-
         /**
          * Provides models for the `django.http.request.HttpRequest` class
          *
@@ -525,20 +532,13 @@ private module Django {
          */
         module HttpRequest {
           /** Gets a reference to the `django.http.request.HttpRequest` class. */
-          private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-            t.start() and
-            result = request_attr("HttpRequest")
+          API::Node classRef() {
+            result = request().getMember("HttpRequest")
             or
             // handle django.http.HttpRequest alias
-            t.start() and
-            result = http_attr("HttpRequest")
-            or
-            exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
+            result = http().getMember("HttpRequest")
           }
 
-          /** Gets a reference to the `django.http.request.HttpRequest` class. */
-          DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
-
           /**
            * A source of instances of `django.http.request.HttpRequest`, extend this class to model new instances.
            *
@@ -552,7 +552,7 @@ private module Django {
           abstract class InstanceSource extends DataFlow::Node { }
 
           /** Gets a reference to an instance of `django.http.request.HttpRequest`. */
-          private DataFlow::Node instance(DataFlow::TypeTracker t) {
+          private DataFlow::LocalSourceNode instance(DataFlow::TypeTracker t) {
             t.start() and
             result instanceof InstanceSource
             or
@@ -560,7 +560,7 @@ private module Django {
           }
 
           /** Gets a reference to an instance of `django.http.request.HttpRequest`. */
-          DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+          DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
         }
       }
 
@@ -568,82 +568,25 @@ private module Django {
       // django.http.response
       // -------------------------------------------------------------------------
       /** Gets a reference to the `django.http.response` module. */
-      DataFlow::Node response() { result = http_attr("response") }
+      API::Node response() { result = http().getMember("response") }
 
       /** Provides models for the `django.http.response` module */
       module response {
-        /**
-         * Gets a reference to the attribute `attr_name` of the `django.http.response` module.
-         * WARNING: Only holds for a few predefined attributes.
-         */
-        private DataFlow::Node response_attr(DataFlow::TypeTracker t, string attr_name) {
-          attr_name in [
-              "HttpResponse",
-              // HttpResponse subclasses
-              "HttpResponseRedirect", "HttpResponsePermanentRedirect", "HttpResponseNotModified",
-              "HttpResponseBadRequest", "HttpResponseNotFound", "HttpResponseForbidden",
-              "HttpResponseNotAllowed", "HttpResponseGone", "HttpResponseServerError",
-              "JsonResponse",
-              // HttpResponse-like classes
-              "StreamingHttpResponse", "FileResponse"
-            ] and
-          (
-            t.start() and
-            result = DataFlow::importNode("django.http.response" + "." + attr_name)
-            or
-            t.startInAttr(attr_name) and
-            result = response()
-          )
-          or
-          // Due to bad performance when using normal setup with `response_attr(t2, attr_name).track(t2, t)`
-          // we have inlined that code and forced a join
-          exists(DataFlow::TypeTracker t2 |
-            exists(DataFlow::StepSummary summary |
-              response_attr_first_join(t2, attr_name, result, summary) and
-              t = t2.append(summary)
-            )
-          )
-        }
-
-        pragma[nomagic]
-        private predicate response_attr_first_join(
-          DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,
-          DataFlow::StepSummary summary
-        ) {
-          DataFlow::StepSummary::step(response_attr(t2, attr_name), res, summary)
-        }
-
-        /**
-         * Gets a reference to the attribute `attr_name` of the `django.http.response` module.
-         * WARNING: Only holds for a few predefined attributes.
-         */
-        private DataFlow::Node response_attr(string attr_name) {
-          result = response_attr(DataFlow::TypeTracker::end(), attr_name)
-        }
-
         /**
          * Provides models for the `django.http.response.HttpResponse` class
          *
          * See https://docs.djangoproject.com/en/3.1/ref/request-response/#django.http.HttpResponse.
          */
         module HttpResponse {
-          /** Gets a reference to the `django.http.response.HttpResponse` class. */
-          private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-            t.start() and
-            result = response_attr("HttpResponse")
+          API::Node baseClassRef() {
+            result = response().getMember("HttpResponse")
             or
             // Handle `django.http.HttpResponse` alias
-            t.start() and
-            result = http_attr("HttpResponse")
-            or
-            // subclass
-            result.asExpr().(ClassExpr).getABase() = classRef(t.continue()).asExpr()
-            or
-            exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
+            result = http().getMember("HttpResponse")
           }
 
           /** Gets a reference to the `django.http.response.HttpResponse` class. */
-          DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
+          API::Node classRef() { result = baseClassRef().getASubclass*() }
 
           /**
            * A source of instances of `django.http.response.HttpResponse`, extend this class to model new instances.
@@ -658,10 +601,8 @@ private module Django {
           }
 
           /** A direct instantiation of `django.http.response.HttpResponse`. */
-          private class ClassInstantiation extends InstanceSource, DataFlow::CfgNode {
-            override CallNode node;
-
-            ClassInstantiation() { node.getFunction() = classRef().asCfgNode() }
+          private class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {
+            ClassInstantiation() { this = classRef().getACall() }
 
             override DataFlow::Node getBody() {
               result.asCfgNode() in [node.getArg(0), node.getArgByName("content")]
@@ -676,7 +617,7 @@ private module Django {
           }
 
           /** Gets a reference to an instance of `django.http.response.HttpResponse`. */
-          private DataFlow::Node instance(DataFlow::TypeTracker t) {
+          private DataFlow::LocalSourceNode instance(DataFlow::TypeTracker t) {
             t.start() and
             result instanceof InstanceSource
             or
@@ -684,7 +625,7 @@ private module Django {
           }
 
           /** Gets a reference to an instance of `django.http.response.HttpResponse`. */
-          DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+          DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
         }
 
         // ---------------------------------------------------------------------------
@@ -698,22 +639,15 @@ private module Django {
          */
         module HttpResponseRedirect {
           /** Gets a reference to the `django.http.response.HttpResponseRedirect` class. */
-          private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-            t.start() and
-            result = response_attr("HttpResponseRedirect")
+          API::Node baseClassRef() {
+            result = response().getMember("HttpResponseRedirect")
             or
             // Handle `django.http.HttpResponseRedirect` alias
-            t.start() and
-            result = http_attr("HttpResponseRedirect")
-            or
-            // subclass
-            result.asExpr().(ClassExpr).getABase() = classRef(t.continue()).asExpr()
-            or
-            exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
+            result = http().getMember("HttpResponseRedirect")
           }
 
-          /** Gets a reference to the `django.http.response.HttpResponseRedirect` class. */
-          DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
+          /** Gets a reference to a subclass of the `django.http.response.HttpResponseRedirect` class. */
+          API::Node classRef() { result = baseClassRef().getASubclass*() }
 
           /**
            * A source of instances of `django.http.response.HttpResponseRedirect`, extend this class to model new instances.
@@ -728,10 +662,8 @@ private module Django {
             HTTP::Server::HttpRedirectResponse::Range, DataFlow::Node { }
 
           /** A direct instantiation of `django.http.response.HttpResponseRedirect`. */
-          private class ClassInstantiation extends InstanceSource, DataFlow::CfgNode {
-            override CallNode node;
-
-            ClassInstantiation() { node.getFunction() = classRef().asCfgNode() }
+          private class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {
+            ClassInstantiation() { this = classRef().getACall() }
 
             override DataFlow::Node getBody() {
               // note that even though browsers like Chrome usually doesn't fetch the
@@ -751,7 +683,7 @@ private module Django {
           }
 
           /** Gets a reference to an instance of `django.http.response.HttpResponseRedirect`. */
-          private DataFlow::Node instance(DataFlow::TypeTracker t) {
+          private DataFlow::LocalSourceNode instance(DataFlow::TypeTracker t) {
             t.start() and
             result instanceof InstanceSource
             or
@@ -759,7 +691,7 @@ private module Django {
           }
 
           /** Gets a reference to an instance of `django.http.response.HttpResponseRedirect`. */
-          DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+          DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
         }
 
         /**
@@ -769,22 +701,15 @@ private module Django {
          */
         module HttpResponsePermanentRedirect {
           /** Gets a reference to the `django.http.response.HttpResponsePermanentRedirect` class. */
-          private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-            t.start() and
-            result = response_attr("HttpResponsePermanentRedirect")
+          API::Node baseClassRef() {
+            result = response().getMember("HttpResponsePermanentRedirect")
             or
             // Handle `django.http.HttpResponsePermanentRedirect` alias
-            t.start() and
-            result = http_attr("HttpResponsePermanentRedirect")
-            or
-            // subclass
-            result.asExpr().(ClassExpr).getABase() = classRef(t.continue()).asExpr()
-            or
-            exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
+            result = http().getMember("HttpResponsePermanentRedirect")
           }
 
           /** Gets a reference to the `django.http.response.HttpResponsePermanentRedirect` class. */
-          DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
+          API::Node classRef() { result = baseClassRef().getASubclass*() }
 
           /**
            * A source of instances of `django.http.response.HttpResponsePermanentRedirect`, extend this class to model new instances.
@@ -799,10 +724,8 @@ private module Django {
             HTTP::Server::HttpRedirectResponse::Range, DataFlow::Node { }
 
           /** A direct instantiation of `django.http.response.HttpResponsePermanentRedirect`. */
-          private class ClassInstantiation extends InstanceSource, DataFlow::CfgNode {
-            override CallNode node;
-
-            ClassInstantiation() { node.getFunction() = classRef().asCfgNode() }
+          private class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {
+            ClassInstantiation() { this = classRef().getACall() }
 
             override DataFlow::Node getBody() {
               // note that even though browsers like Chrome usually doesn't fetch the
@@ -822,7 +745,7 @@ private module Django {
           }
 
           /** Gets a reference to an instance of `django.http.response.HttpResponsePermanentRedirect`. */
-          private DataFlow::Node instance(DataFlow::TypeTracker t) {
+          private DataFlow::LocalSourceNode instance(DataFlow::TypeTracker t) {
             t.start() and
             result instanceof InstanceSource
             or
@@ -830,7 +753,7 @@ private module Django {
           }
 
           /** Gets a reference to an instance of `django.http.response.HttpResponsePermanentRedirect`. */
-          DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+          DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
         }
 
         /**
@@ -840,23 +763,16 @@ private module Django {
          */
         module HttpResponseNotModified {
           /** Gets a reference to the `django.http.response.HttpResponseNotModified` class. */
-          private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-            t.start() and
-            result = response_attr("HttpResponseNotModified")
+          API::Node baseClassRef() {
+            result = response().getMember("HttpResponseNotModified")
             or
             // TODO: remove/expand this part of the template as needed
             // Handle `django.http.HttpResponseNotModified` alias
-            t.start() and
-            result = http_attr("HttpResponseNotModified")
-            or
-            // subclass
-            result.asExpr().(ClassExpr).getABase() = classRef(t.continue()).asExpr()
-            or
-            exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
+            result = http().getMember("HttpResponseNotModified")
           }
 
           /** Gets a reference to the `django.http.response.HttpResponseNotModified` class. */
-          DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
+          API::Node classRef() { result = baseClassRef().getASubclass*() }
 
           /**
            * A source of instances of `django.http.response.HttpResponseNotModified`, extend this class to model new instances.
@@ -870,10 +786,8 @@ private module Django {
           abstract class InstanceSource extends HttpResponse::InstanceSource, DataFlow::Node { }
 
           /** A direct instantiation of `django.http.response.HttpResponseNotModified`. */
-          private class ClassInstantiation extends InstanceSource, DataFlow::CfgNode {
-            override CallNode node;
-
-            ClassInstantiation() { node.getFunction() = classRef().asCfgNode() }
+          private class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {
+            ClassInstantiation() { this = classRef().getACall() }
 
             override DataFlow::Node getBody() { none() }
 
@@ -884,7 +798,7 @@ private module Django {
           }
 
           /** Gets a reference to an instance of `django.http.response.HttpResponseNotModified`. */
-          private DataFlow::Node instance(DataFlow::TypeTracker t) {
+          private DataFlow::LocalSourceNode instance(DataFlow::TypeTracker t) {
             t.start() and
             result instanceof InstanceSource
             or
@@ -892,7 +806,7 @@ private module Django {
           }
 
           /** Gets a reference to an instance of `django.http.response.HttpResponseNotModified`. */
-          DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+          DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
         }
 
         /**
@@ -902,22 +816,15 @@ private module Django {
          */
         module HttpResponseBadRequest {
           /** Gets a reference to the `django.http.response.HttpResponseBadRequest` class. */
-          private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-            t.start() and
-            result = response_attr("HttpResponseBadRequest")
+          API::Node baseClassRef() {
+            result = response().getMember("HttpResponseBadRequest")
             or
             // Handle `django.http.HttpResponseBadRequest` alias
-            t.start() and
-            result = http_attr("HttpResponseBadRequest")
-            or
-            // subclass
-            result.asExpr().(ClassExpr).getABase() = classRef(t.continue()).asExpr()
-            or
-            exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
+            result = http().getMember("HttpResponseBadRequest")
           }
 
           /** Gets a reference to the `django.http.response.HttpResponseBadRequest` class. */
-          DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
+          API::Node classRef() { result = baseClassRef().getASubclass*() }
 
           /**
            * A source of instances of `django.http.response.HttpResponseBadRequest`, extend this class to model new instances.
@@ -931,10 +838,8 @@ private module Django {
           abstract class InstanceSource extends HttpResponse::InstanceSource, DataFlow::Node { }
 
           /** A direct instantiation of `django.http.response.HttpResponseBadRequest`. */
-          private class ClassInstantiation extends InstanceSource, DataFlow::CfgNode {
-            override CallNode node;
-
-            ClassInstantiation() { node.getFunction() = classRef().asCfgNode() }
+          private class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {
+            ClassInstantiation() { this = classRef().getACall() }
 
             override DataFlow::Node getBody() {
               result.asCfgNode() in [node.getArg(0), node.getArgByName("content")]
@@ -947,7 +852,7 @@ private module Django {
           }
 
           /** Gets a reference to an instance of `django.http.response.HttpResponseBadRequest`. */
-          private DataFlow::Node instance(DataFlow::TypeTracker t) {
+          private DataFlow::LocalSourceNode instance(DataFlow::TypeTracker t) {
             t.start() and
             result instanceof InstanceSource
             or
@@ -955,7 +860,7 @@ private module Django {
           }
 
           /** Gets a reference to an instance of `django.http.response.HttpResponseBadRequest`. */
-          DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+          DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
         }
 
         /**
@@ -965,22 +870,15 @@ private module Django {
          */
         module HttpResponseNotFound {
           /** Gets a reference to the `django.http.response.HttpResponseNotFound` class. */
-          private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-            t.start() and
-            result = response_attr("HttpResponseNotFound")
+          API::Node baseClassRef() {
+            result = response().getMember("HttpResponseNotFound")
             or
             // Handle `django.http.HttpResponseNotFound` alias
-            t.start() and
-            result = http_attr("HttpResponseNotFound")
-            or
-            // subclass
-            result.asExpr().(ClassExpr).getABase() = classRef(t.continue()).asExpr()
-            or
-            exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
+            result = http().getMember("HttpResponseNotFound")
           }
 
           /** Gets a reference to the `django.http.response.HttpResponseNotFound` class. */
-          DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
+          API::Node classRef() { result = baseClassRef().getASubclass*() }
 
           /**
            * A source of instances of `django.http.response.HttpResponseNotFound`, extend this class to model new instances.
@@ -994,10 +892,8 @@ private module Django {
           abstract class InstanceSource extends HttpResponse::InstanceSource, DataFlow::Node { }
 
           /** A direct instantiation of `django.http.response.HttpResponseNotFound`. */
-          private class ClassInstantiation extends InstanceSource, DataFlow::CfgNode {
-            override CallNode node;
-
-            ClassInstantiation() { node.getFunction() = classRef().asCfgNode() }
+          private class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {
+            ClassInstantiation() { this = classRef().getACall() }
 
             override DataFlow::Node getBody() {
               result.asCfgNode() in [node.getArg(0), node.getArgByName("content")]
@@ -1010,7 +906,7 @@ private module Django {
           }
 
           /** Gets a reference to an instance of `django.http.response.HttpResponseNotFound`. */
-          private DataFlow::Node instance(DataFlow::TypeTracker t) {
+          private DataFlow::LocalSourceNode instance(DataFlow::TypeTracker t) {
             t.start() and
             result instanceof InstanceSource
             or
@@ -1018,7 +914,7 @@ private module Django {
           }
 
           /** Gets a reference to an instance of `django.http.response.HttpResponseNotFound`. */
-          DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+          DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
         }
 
         /**
@@ -1028,22 +924,15 @@ private module Django {
          */
         module HttpResponseForbidden {
           /** Gets a reference to the `django.http.response.HttpResponseForbidden` class. */
-          private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-            t.start() and
-            result = response_attr("HttpResponseForbidden")
+          API::Node baseClassRef() {
+            result = response().getMember("HttpResponseForbidden")
             or
             // Handle `django.http.HttpResponseForbidden` alias
-            t.start() and
-            result = http_attr("HttpResponseForbidden")
-            or
-            // subclass
-            result.asExpr().(ClassExpr).getABase() = classRef(t.continue()).asExpr()
-            or
-            exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
+            result = http().getMember("HttpResponseForbidden")
           }
 
           /** Gets a reference to the `django.http.response.HttpResponseForbidden` class. */
-          DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
+          API::Node classRef() { result = baseClassRef().getASubclass*() }
 
           /**
            * A source of instances of `django.http.response.HttpResponseForbidden`, extend this class to model new instances.
@@ -1057,10 +946,8 @@ private module Django {
           abstract class InstanceSource extends HttpResponse::InstanceSource, DataFlow::Node { }
 
           /** A direct instantiation of `django.http.response.HttpResponseForbidden`. */
-          private class ClassInstantiation extends InstanceSource, DataFlow::CfgNode {
-            override CallNode node;
-
-            ClassInstantiation() { node.getFunction() = classRef().asCfgNode() }
+          private class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {
+            ClassInstantiation() { this = classRef().getACall() }
 
             override DataFlow::Node getBody() {
               result.asCfgNode() in [node.getArg(0), node.getArgByName("content")]
@@ -1073,7 +960,7 @@ private module Django {
           }
 
           /** Gets a reference to an instance of `django.http.response.HttpResponseForbidden`. */
-          private DataFlow::Node instance(DataFlow::TypeTracker t) {
+          private DataFlow::LocalSourceNode instance(DataFlow::TypeTracker t) {
             t.start() and
             result instanceof InstanceSource
             or
@@ -1081,7 +968,7 @@ private module Django {
           }
 
           /** Gets a reference to an instance of `django.http.response.HttpResponseForbidden`. */
-          DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+          DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
         }
 
         /**
@@ -1091,22 +978,15 @@ private module Django {
          */
         module HttpResponseNotAllowed {
           /** Gets a reference to the `django.http.response.HttpResponseNotAllowed` class. */
-          private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-            t.start() and
-            result = response_attr("HttpResponseNotAllowed")
+          API::Node baseClassRef() {
+            result = response().getMember("HttpResponseNotAllowed")
             or
             // Handle `django.http.HttpResponseNotAllowed` alias
-            t.start() and
-            result = http_attr("HttpResponseNotAllowed")
-            or
-            // subclass
-            result.asExpr().(ClassExpr).getABase() = classRef(t.continue()).asExpr()
-            or
-            exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
+            result = http().getMember("HttpResponseNotAllowed")
           }
 
           /** Gets a reference to the `django.http.response.HttpResponseNotAllowed` class. */
-          DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
+          API::Node classRef() { result = baseClassRef().getASubclass*() }
 
           /**
            * A source of instances of `django.http.response.HttpResponseNotAllowed`, extend this class to model new instances.
@@ -1120,10 +1000,8 @@ private module Django {
           abstract class InstanceSource extends HttpResponse::InstanceSource, DataFlow::Node { }
 
           /** A direct instantiation of `django.http.response.HttpResponseNotAllowed`. */
-          private class ClassInstantiation extends InstanceSource, DataFlow::CfgNode {
-            override CallNode node;
-
-            ClassInstantiation() { node.getFunction() = classRef().asCfgNode() }
+          private class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {
+            ClassInstantiation() { this = classRef().getACall() }
 
             override DataFlow::Node getBody() {
               // First argument is permitted methods
@@ -1137,7 +1015,7 @@ private module Django {
           }
 
           /** Gets a reference to an instance of `django.http.response.HttpResponseNotAllowed`. */
-          private DataFlow::Node instance(DataFlow::TypeTracker t) {
+          private DataFlow::LocalSourceNode instance(DataFlow::TypeTracker t) {
             t.start() and
             result instanceof InstanceSource
             or
@@ -1145,7 +1023,7 @@ private module Django {
           }
 
           /** Gets a reference to an instance of `django.http.response.HttpResponseNotAllowed`. */
-          DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+          DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
         }
 
         /**
@@ -1155,22 +1033,15 @@ private module Django {
          */
         module HttpResponseGone {
           /** Gets a reference to the `django.http.response.HttpResponseGone` class. */
-          private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-            t.start() and
-            result = response_attr("HttpResponseGone")
+          API::Node baseClassRef() {
+            result = response().getMember("HttpResponseGone")
             or
             // Handle `django.http.HttpResponseGone` alias
-            t.start() and
-            result = http_attr("HttpResponseGone")
-            or
-            // subclass
-            result.asExpr().(ClassExpr).getABase() = classRef(t.continue()).asExpr()
-            or
-            exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
+            result = http().getMember("HttpResponseGone")
           }
 
           /** Gets a reference to the `django.http.response.HttpResponseGone` class. */
-          DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
+          API::Node classRef() { result = baseClassRef().getASubclass*() }
 
           /**
            * A source of instances of `django.http.response.HttpResponseGone`, extend this class to model new instances.
@@ -1184,10 +1055,8 @@ private module Django {
           abstract class InstanceSource extends HttpResponse::InstanceSource, DataFlow::Node { }
 
           /** A direct instantiation of `django.http.response.HttpResponseGone`. */
-          private class ClassInstantiation extends InstanceSource, DataFlow::CfgNode {
-            override CallNode node;
-
-            ClassInstantiation() { node.getFunction() = classRef().asCfgNode() }
+          private class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {
+            ClassInstantiation() { this = classRef().getACall() }
 
             override DataFlow::Node getBody() {
               result.asCfgNode() in [node.getArg(0), node.getArgByName("content")]
@@ -1200,7 +1069,7 @@ private module Django {
           }
 
           /** Gets a reference to an instance of `django.http.response.HttpResponseGone`. */
-          private DataFlow::Node instance(DataFlow::TypeTracker t) {
+          private DataFlow::LocalSourceNode instance(DataFlow::TypeTracker t) {
             t.start() and
             result instanceof InstanceSource
             or
@@ -1208,7 +1077,7 @@ private module Django {
           }
 
           /** Gets a reference to an instance of `django.http.response.HttpResponseGone`. */
-          DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+          DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
         }
 
         /**
@@ -1218,22 +1087,15 @@ private module Django {
          */
         module HttpResponseServerError {
           /** Gets a reference to the `django.http.response.HttpResponseServerError` class. */
-          private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-            t.start() and
-            result = response_attr("HttpResponseServerError")
+          API::Node baseClassRef() {
+            result = response().getMember("HttpResponseServerError")
             or
             // Handle `django.http.HttpResponseServerError` alias
-            t.start() and
-            result = http_attr("HttpResponseServerError")
-            or
-            // subclass
-            result.asExpr().(ClassExpr).getABase() = classRef(t.continue()).asExpr()
-            or
-            exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
+            result = http().getMember("HttpResponseServerError")
           }
 
           /** Gets a reference to the `django.http.response.HttpResponseServerError` class. */
-          DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
+          API::Node classRef() { result = baseClassRef().getASubclass*() }
 
           /**
            * A source of instances of `django.http.response.HttpResponseServerError`, extend this class to model new instances.
@@ -1247,10 +1109,8 @@ private module Django {
           abstract class InstanceSource extends HttpResponse::InstanceSource, DataFlow::Node { }
 
           /** A direct instantiation of `django.http.response.HttpResponseServerError`. */
-          private class ClassInstantiation extends InstanceSource, DataFlow::CfgNode {
-            override CallNode node;
-
-            ClassInstantiation() { node.getFunction() = classRef().asCfgNode() }
+          private class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {
+            ClassInstantiation() { this = classRef().getACall() }
 
             override DataFlow::Node getBody() {
               result.asCfgNode() in [node.getArg(0), node.getArgByName("content")]
@@ -1263,7 +1123,7 @@ private module Django {
           }
 
           /** Gets a reference to an instance of `django.http.response.HttpResponseServerError`. */
-          private DataFlow::Node instance(DataFlow::TypeTracker t) {
+          private DataFlow::LocalSourceNode instance(DataFlow::TypeTracker t) {
             t.start() and
             result instanceof InstanceSource
             or
@@ -1271,7 +1131,7 @@ private module Django {
           }
 
           /** Gets a reference to an instance of `django.http.response.HttpResponseServerError`. */
-          DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+          DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
         }
 
         /**
@@ -1281,22 +1141,15 @@ private module Django {
          */
         module JsonResponse {
           /** Gets a reference to the `django.http.response.JsonResponse` class. */
-          private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-            t.start() and
-            result = response_attr("JsonResponse")
+          API::Node baseClassRef() {
+            result = response().getMember("JsonResponse")
             or
             // Handle `django.http.JsonResponse` alias
-            t.start() and
-            result = http_attr("JsonResponse")
-            or
-            // subclass
-            result.asExpr().(ClassExpr).getABase() = classRef(t.continue()).asExpr()
-            or
-            exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
+            result = http().getMember("JsonResponse")
           }
 
           /** Gets a reference to the `django.http.response.JsonResponse` class. */
-          DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
+          API::Node classRef() { result = baseClassRef().getASubclass*() }
 
           /**
            * A source of instances of `django.http.response.JsonResponse`, extend this class to model new instances.
@@ -1310,10 +1163,8 @@ private module Django {
           abstract class InstanceSource extends HttpResponse::InstanceSource, DataFlow::Node { }
 
           /** A direct instantiation of `django.http.response.JsonResponse`. */
-          private class ClassInstantiation extends InstanceSource, DataFlow::CfgNode {
-            override CallNode node;
-
-            ClassInstantiation() { node.getFunction() = classRef().asCfgNode() }
+          private class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {
+            ClassInstantiation() { this = classRef().getACall() }
 
             override DataFlow::Node getBody() {
               result.asCfgNode() in [node.getArg(0), node.getArgByName("data")]
@@ -1326,7 +1177,7 @@ private module Django {
           }
 
           /** Gets a reference to an instance of `django.http.response.JsonResponse`. */
-          private DataFlow::Node instance(DataFlow::TypeTracker t) {
+          private DataFlow::LocalSourceNode instance(DataFlow::TypeTracker t) {
             t.start() and
             result instanceof InstanceSource
             or
@@ -1334,7 +1185,7 @@ private module Django {
           }
 
           /** Gets a reference to an instance of `django.http.response.JsonResponse`. */
-          DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+          DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
         }
 
         // ---------------------------------------------------------------------------
@@ -1347,22 +1198,15 @@ private module Django {
          */
         module StreamingHttpResponse {
           /** Gets a reference to the `django.http.response.StreamingHttpResponse` class. */
-          private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-            t.start() and
-            result = response_attr("StreamingHttpResponse")
+          API::Node baseClassRef() {
+            result = response().getMember("StreamingHttpResponse")
             or
             // Handle `django.http.StreamingHttpResponse` alias
-            t.start() and
-            result = http_attr("StreamingHttpResponse")
-            or
-            // subclass
-            result.asExpr().(ClassExpr).getABase() = classRef(t.continue()).asExpr()
-            or
-            exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
+            result = http().getMember("StreamingHttpResponse")
           }
 
           /** Gets a reference to the `django.http.response.StreamingHttpResponse` class. */
-          DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
+          API::Node classRef() { result = baseClassRef().getASubclass*() }
 
           /**
            * A source of instances of `django.http.response.StreamingHttpResponse`, extend this class to model new instances.
@@ -1376,10 +1220,8 @@ private module Django {
           abstract class InstanceSource extends HttpResponse::InstanceSource, DataFlow::Node { }
 
           /** A direct instantiation of `django.http.response.StreamingHttpResponse`. */
-          private class ClassInstantiation extends InstanceSource, DataFlow::CfgNode {
-            override CallNode node;
-
-            ClassInstantiation() { node.getFunction() = classRef().asCfgNode() }
+          private class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {
+            ClassInstantiation() { this = classRef().getACall() }
 
             override DataFlow::Node getBody() {
               result.asCfgNode() in [node.getArg(0), node.getArgByName("streaming_content")]
@@ -1392,7 +1234,7 @@ private module Django {
           }
 
           /** Gets a reference to an instance of `django.http.response.StreamingHttpResponse`. */
-          private DataFlow::Node instance(DataFlow::TypeTracker t) {
+          private DataFlow::LocalSourceNode instance(DataFlow::TypeTracker t) {
             t.start() and
             result instanceof InstanceSource
             or
@@ -1400,7 +1242,7 @@ private module Django {
           }
 
           /** Gets a reference to an instance of `django.http.response.StreamingHttpResponse`. */
-          DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+          DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
         }
 
         /**
@@ -1410,22 +1252,15 @@ private module Django {
          */
         module FileResponse {
           /** Gets a reference to the `django.http.response.FileResponse` class. */
-          private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-            t.start() and
-            result = response_attr("FileResponse")
+          API::Node baseClassRef() {
+            result = response().getMember("FileResponse")
             or
             // Handle `django.http.FileResponse` alias
-            t.start() and
-            result = http_attr("FileResponse")
-            or
-            // subclass
-            result.asExpr().(ClassExpr).getABase() = classRef(t.continue()).asExpr()
-            or
-            exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
+            result = http().getMember("FileResponse")
           }
 
           /** Gets a reference to the `django.http.response.FileResponse` class. */
-          DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
+          API::Node classRef() { result = baseClassRef().getASubclass*() }
 
           /**
            * A source of instances of `django.http.response.FileResponse`, extend this class to model new instances.
@@ -1439,10 +1274,8 @@ private module Django {
           abstract class InstanceSource extends HttpResponse::InstanceSource, DataFlow::Node { }
 
           /** A direct instantiation of `django.http.response.FileResponse`. */
-          private class ClassInstantiation extends InstanceSource, DataFlow::CfgNode {
-            override CallNode node;
-
-            ClassInstantiation() { node.getFunction() = classRef().asCfgNode() }
+          private class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {
+            ClassInstantiation() { this = classRef().getACall() }
 
             override DataFlow::Node getBody() {
               result.asCfgNode() in [node.getArg(0), node.getArgByName("streaming_content")]
@@ -1458,7 +1291,7 @@ private module Django {
           }
 
           /** Gets a reference to an instance of `django.http.response.FileResponse`. */
-          private DataFlow::Node instance(DataFlow::TypeTracker t) {
+          private DataFlow::LocalSourceNode instance(DataFlow::TypeTracker t) {
             t.start() and
             result instanceof InstanceSource
             or
@@ -1466,7 +1299,7 @@ private module Django {
           }
 
           /** Gets a reference to an instance of `django.http.response.FileResponse`. */
-          DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+          DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
         }
 
         /** Gets a reference to the `django.http.response.HttpResponse.write` function. */
@@ -1509,472 +1342,26 @@ private module Django {
       }
     }
 
-    // -------------------------------------------------------------------------
-    // django.views
-    // -------------------------------------------------------------------------
-    /** Gets a reference to the `django.views` module. */
-    DataFlow::Node views() { result = django_attr("views") }
-
-    /** Provides models for the `django.views` module */
-    module views {
-      /**
-       * Gets a reference to the attribute `attr_name` of the `django.views` module.
-       * WARNING: Only holds for a few predefined attributes.
-       */
-      private DataFlow::Node views_attr(DataFlow::TypeTracker t, string attr_name) {
-        // for 1.11.x, see: https://github.com/django/django/blob/stable/1.11.x/django/views/__init__.py
-        attr_name in ["generic", "View"] and
-        (
-          t.start() and
-          result = DataFlow::importNode("django.views" + "." + attr_name)
-          or
-          t.startInAttr(attr_name) and
-          result = views()
-        )
-        or
-        // Due to bad performance when using normal setup with `views_attr(t2, attr_name).track(t2, t)`
-        // we have inlined that code and forced a join
-        exists(DataFlow::TypeTracker t2 |
-          exists(DataFlow::StepSummary summary |
-            views_attr_first_join(t2, attr_name, result, summary) and
-            t = t2.append(summary)
-          )
-        )
-      }
-
-      pragma[nomagic]
-      private predicate views_attr_first_join(
-        DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,
-        DataFlow::StepSummary summary
-      ) {
-        DataFlow::StepSummary::step(views_attr(t2, attr_name), res, summary)
-      }
-
-      /**
-       * Gets a reference to the attribute `attr_name` of the `django.views` module.
-       * WARNING: Only holds for a few predefined attributes.
-       */
-      private DataFlow::Node views_attr(string attr_name) {
-        result = views_attr(DataFlow::TypeTracker::end(), attr_name)
-      }
-
-      // -------------------------------------------------------------------------
-      // django.views.generic
-      // -------------------------------------------------------------------------
-      /** Gets a reference to the `django.views.generic` module. */
-      DataFlow::Node generic() { result = views_attr("generic") }
-
-      /** Provides models for the `django.views.generic` module */
-      module generic {
-        /**
-         * Gets a reference to the attribute `attr_name` of the `django.views.generic` module.
-         * WARNING: Only holds for a few predefined attributes.
-         */
-        private DataFlow::Node generic_attr(DataFlow::TypeTracker t, string attr_name) {
-          // for 3.1.x see: https://github.com/django/django/blob/stable/3.1.x/django/views/generic/__init__.py
-          // same for 1.11.x see: https://github.com/django/django/blob/stable/1.11.x/django/views/generic/__init__.py
-          attr_name in [
-              "View", "TemplateView", "RedirectView", "ArchiveIndexView", "YearArchiveView",
-              "MonthArchiveView", "WeekArchiveView", "DayArchiveView", "TodayArchiveView",
-              "DateDetailView", "DetailView", "FormView", "CreateView", "UpdateView", "DeleteView",
-              "ListView", "GenericViewError",
-              // modules
-              "base", "dates", "detail", "edit", "list"
-            ] and
-          (
-            t.start() and
-            result = DataFlow::importNode("django.views.generic" + "." + attr_name)
-            or
-            t.startInAttr(attr_name) and
-            result = generic()
-          )
-          or
-          // Due to bad performance when using normal setup with `generic_attr(t2, attr_name).track(t2, t)`
-          // we have inlined that code and forced a join
-          exists(DataFlow::TypeTracker t2 |
-            exists(DataFlow::StepSummary summary |
-              generic_attr_first_join(t2, attr_name, result, summary) and
-              t = t2.append(summary)
-            )
-          )
-        }
-
-        pragma[nomagic]
-        private predicate generic_attr_first_join(
-          DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,
-          DataFlow::StepSummary summary
-        ) {
-          DataFlow::StepSummary::step(generic_attr(t2, attr_name), res, summary)
-        }
-
-        /**
-         * Gets a reference to the attribute `attr_name` of the `django.views.generic` module.
-         * WARNING: Only holds for a few predefined attributes.
-         */
-        private DataFlow::Node generic_attr(string attr_name) {
-          result = generic_attr(DataFlow::TypeTracker::end(), attr_name)
-        }
-
-        // -------------------------------------------------------------------------
-        // django.views.generic.base
-        // -------------------------------------------------------------------------
-        /** Gets a reference to the `django.views.generic.base` module. */
-        DataFlow::Node base() { result = generic_attr("base") }
-
-        /** Provides models for the `django.views.generic.base` module */
-        module base {
-          /**
-           * Gets a reference to the attribute `attr_name` of the `django.views.generic.base` module.
-           * WARNING: Only holds for a few predefined attributes.
-           */
-          private DataFlow::Node base_attr(DataFlow::TypeTracker t, string attr_name) {
-            attr_name in ["RedirectView", "TemplateView", "View"] and
-            (
-              t.start() and
-              result = DataFlow::importNode("django.views.generic.base" + "." + attr_name)
-              or
-              t.startInAttr(attr_name) and
-              result = base()
-            )
-            or
-            // Due to bad performance when using normal setup with `base_attr(t2, attr_name).track(t2, t)`
-            // we have inlined that code and forced a join
-            exists(DataFlow::TypeTracker t2 |
-              exists(DataFlow::StepSummary summary |
-                base_attr_first_join(t2, attr_name, result, summary) and
-                t = t2.append(summary)
-              )
-            )
-          }
-
-          pragma[nomagic]
-          private predicate base_attr_first_join(
-            DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,
-            DataFlow::StepSummary summary
-          ) {
-            DataFlow::StepSummary::step(base_attr(t2, attr_name), res, summary)
-          }
-
-          /**
-           * Gets a reference to the attribute `attr_name` of the `django.views.generic.base` module.
-           * WARNING: Only holds for a few predefined attributes.
-           */
-          DataFlow::Node base_attr(string attr_name) {
-            result = base_attr(DataFlow::TypeTracker::end(), attr_name)
-          }
-        }
-
-        // -------------------------------------------------------------------------
-        // django.views.generic.dates
-        // -------------------------------------------------------------------------
-        /** Gets a reference to the `django.views.generic.dates` module. */
-        DataFlow::Node dates() { result = generic_attr("dates") }
-
-        /** Provides models for the `django.views.generic.dates` module */
-        module dates {
-          /**
-           * Gets a reference to the attribute `attr_name` of the `django.views.generic.dates` module.
-           * WARNING: Only holds for a few predefined attributes.
-           */
-          private DataFlow::Node dates_attr(DataFlow::TypeTracker t, string attr_name) {
-            attr_name in [
-                "ArchiveIndexView", "DateDetailView", "DayArchiveView", "MonthArchiveView",
-                "TodayArchiveView", "WeekArchiveView", "YearArchiveView"
-              ] and
-            (
-              t.start() and
-              result = DataFlow::importNode("django.views.generic.dates" + "." + attr_name)
-              or
-              t.startInAttr(attr_name) and
-              result = dates()
-            )
-            or
-            // Due to bad performance when using normal setup with `dates_attr(t2, attr_name).track(t2, t)`
-            // we have inlined that code and forced a join
-            exists(DataFlow::TypeTracker t2 |
-              exists(DataFlow::StepSummary summary |
-                dates_attr_first_join(t2, attr_name, result, summary) and
-                t = t2.append(summary)
-              )
-            )
-          }
-
-          pragma[nomagic]
-          private predicate dates_attr_first_join(
-            DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,
-            DataFlow::StepSummary summary
-          ) {
-            DataFlow::StepSummary::step(dates_attr(t2, attr_name), res, summary)
-          }
-
-          /**
-           * Gets a reference to the attribute `attr_name` of the `django.views.generic.dates` module.
-           * WARNING: Only holds for a few predefined attributes.
-           */
-          DataFlow::Node dates_attr(string attr_name) {
-            result = dates_attr(DataFlow::TypeTracker::end(), attr_name)
-          }
-        }
-
-        // -------------------------------------------------------------------------
-        // django.views.generic.detail
-        // -------------------------------------------------------------------------
-        /** Gets a reference to the `django.views.generic.detail` module. */
-        DataFlow::Node detail() { result = generic_attr("detail") }
-
-        /** Provides models for the `django.views.generic.detail` module */
-        module detail {
-          /**
-           * Gets a reference to the attribute `attr_name` of the `django.views.generic.detail` module.
-           * WARNING: Only holds for a few predefined attributes.
-           */
-          private DataFlow::Node detail_attr(DataFlow::TypeTracker t, string attr_name) {
-            attr_name in ["DetailView"] and
-            (
-              t.start() and
-              result = DataFlow::importNode("django.views.generic.detail" + "." + attr_name)
-              or
-              t.startInAttr(attr_name) and
-              result = detail()
-            )
-            or
-            // Due to bad performance when using normal setup with `detail_attr(t2, attr_name).track(t2, t)`
-            // we have inlined that code and forced a join
-            exists(DataFlow::TypeTracker t2 |
-              exists(DataFlow::StepSummary summary |
-                detail_attr_first_join(t2, attr_name, result, summary) and
-                t = t2.append(summary)
-              )
-            )
-          }
-
-          pragma[nomagic]
-          private predicate detail_attr_first_join(
-            DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,
-            DataFlow::StepSummary summary
-          ) {
-            DataFlow::StepSummary::step(detail_attr(t2, attr_name), res, summary)
-          }
-
-          /**
-           * Gets a reference to the attribute `attr_name` of the `django.views.generic.detail` module.
-           * WARNING: Only holds for a few predefined attributes.
-           */
-          DataFlow::Node detail_attr(string attr_name) {
-            result = detail_attr(DataFlow::TypeTracker::end(), attr_name)
-          }
-        }
-
-        // -------------------------------------------------------------------------
-        // django.views.generic.edit
-        // -------------------------------------------------------------------------
-        /** Gets a reference to the `django.views.generic.edit` module. */
-        DataFlow::Node edit() { result = generic_attr("edit") }
-
-        /** Provides models for the `django.views.generic.edit` module */
-        module edit {
-          /**
-           * Gets a reference to the attribute `attr_name` of the `django.views.generic.edit` module.
-           * WARNING: Only holds for a few predefined attributes.
-           */
-          private DataFlow::Node edit_attr(DataFlow::TypeTracker t, string attr_name) {
-            attr_name in ["CreateView", "DeleteView", "FormView", "UpdateView"] and
-            (
-              t.start() and
-              result = DataFlow::importNode("django.views.generic.edit" + "." + attr_name)
-              or
-              t.startInAttr(attr_name) and
-              result = edit()
-            )
-            or
-            // Due to bad performance when using normal setup with `edit_attr(t2, attr_name).track(t2, t)`
-            // we have inlined that code and forced a join
-            exists(DataFlow::TypeTracker t2 |
-              exists(DataFlow::StepSummary summary |
-                edit_attr_first_join(t2, attr_name, result, summary) and
-                t = t2.append(summary)
-              )
-            )
-          }
-
-          pragma[nomagic]
-          private predicate edit_attr_first_join(
-            DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,
-            DataFlow::StepSummary summary
-          ) {
-            DataFlow::StepSummary::step(edit_attr(t2, attr_name), res, summary)
-          }
-
-          /**
-           * Gets a reference to the attribute `attr_name` of the `django.views.generic.edit` module.
-           * WARNING: Only holds for a few predefined attributes.
-           */
-          DataFlow::Node edit_attr(string attr_name) {
-            result = edit_attr(DataFlow::TypeTracker::end(), attr_name)
-          }
-        }
-
-        // -------------------------------------------------------------------------
-        // django.views.generic.list
-        // -------------------------------------------------------------------------
-        /** Gets a reference to the `django.views.generic.list` module. */
-        DataFlow::Node list() { result = generic_attr("list") }
-
-        /** Provides models for the `django.views.generic.list` module */
-        module list {
-          /**
-           * Gets a reference to the attribute `attr_name` of the `django.views.generic.list` module.
-           * WARNING: Only holds for a few predefined attributes.
-           */
-          private DataFlow::Node list_attr(DataFlow::TypeTracker t, string attr_name) {
-            attr_name in ["ListView"] and
-            (
-              t.start() and
-              result = DataFlow::importNode("django.views.generic.list" + "." + attr_name)
-              or
-              t.startInAttr(attr_name) and
-              result = list()
-            )
-            or
-            // Due to bad performance when using normal setup with `list_attr(t2, attr_name).track(t2, t)`
-            // we have inlined that code and forced a join
-            exists(DataFlow::TypeTracker t2 |
-              exists(DataFlow::StepSummary summary |
-                list_attr_first_join(t2, attr_name, result, summary) and
-                t = t2.append(summary)
-              )
-            )
-          }
-
-          pragma[nomagic]
-          private predicate list_attr_first_join(
-            DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,
-            DataFlow::StepSummary summary
-          ) {
-            DataFlow::StepSummary::step(list_attr(t2, attr_name), res, summary)
-          }
-
-          /**
-           * Gets a reference to the attribute `attr_name` of the `django.views.generic.list` module.
-           * WARNING: Only holds for a few predefined attributes.
-           */
-          DataFlow::Node list_attr(string attr_name) {
-            result = list_attr(DataFlow::TypeTracker::end(), attr_name)
-          }
-        }
-
-        /**
-         * Provides models for the `django.views.generic.View` class and subclasses.
-         *
-         * See
-         *  - https://docs.djangoproject.com/en/3.1/topics/class-based-views/
-         *  - https://docs.djangoproject.com/en/3.1/ref/class-based-views/
-         */
-        module View {
-          /** Gets a reference to the `django.views.generic.View` class or any subclass. */
-          private DataFlow::Node subclassRef(DataFlow::TypeTracker t) {
-            t.start() and
-            result =
-              generic_attr([
-                  "View",
-                  // Known Views
-                  "TemplateView", "RedirectView", "ArchiveIndexView", "YearArchiveView",
-                  "MonthArchiveView", "WeekArchiveView", "DayArchiveView", "TodayArchiveView",
-                  "DateDetailView", "DetailView", "FormView", "CreateView", "UpdateView",
-                  "DeleteView", "ListView"
-                ])
-            or
-            // aliases
-            t.start() and
-            (
-              // django.views.View
-              result = views_attr("View")
-              or
-              // django.views.generic.base.*
-              result = base::base_attr(_)
-              or
-              // django.views.generic.dates.*
-              result = dates::dates_attr(_)
-              or
-              // django.views.generic.detail.*
-              result = detail::detail_attr(_)
-              or
-              // django.views.generic.edit.*
-              result = edit::edit_attr(_)
-              or
-              // django.views.generic.list.*
-              result = list::list_attr(_)
-            )
-            or
-            // subclasses in project code
-            result.asExpr().(ClassExpr).getABase() = subclassRef(t.continue()).asExpr()
-            or
-            exists(DataFlow::TypeTracker t2 | result = subclassRef(t2).track(t2, t))
-          }
-
-          /** Gets a reference to the `django.views.generic.View` class or any subclass. */
-          DataFlow::Node subclassRef() { result = subclassRef(DataFlow::TypeTracker::end()) }
-        }
-      }
-    }
-
     // -------------------------------------------------------------------------
     // django.shortcuts
     // -------------------------------------------------------------------------
     /** Gets a reference to the `django.shortcuts` module. */
-    DataFlow::Node shortcuts() { result = django_attr("shortcuts") }
+    API::Node shortcuts() { result = django().getMember("shortcuts") }
 
     /** Provides models for the `django.shortcuts` module */
     module shortcuts {
-      /**
-       * Gets a reference to the attribute `attr_name` of the `django.shortcuts` module.
-       * WARNING: Only holds for a few predefined attributes.
-       */
-      private DataFlow::Node shortcuts_attr(DataFlow::TypeTracker t, string attr_name) {
-        attr_name in ["redirect"] and
-        (
-          t.start() and
-          result = DataFlow::importNode("django.shortcuts" + "." + attr_name)
-          or
-          t.startInAttr(attr_name) and
-          result = shortcuts()
-        )
-        or
-        // Due to bad performance when using normal setup with `shortcuts_attr(t2, attr_name).track(t2, t)`
-        // we have inlined that code and forced a join
-        exists(DataFlow::TypeTracker t2 |
-          exists(DataFlow::StepSummary summary |
-            shortcuts_attr_first_join(t2, attr_name, result, summary) and
-            t = t2.append(summary)
-          )
-        )
-      }
-
-      pragma[nomagic]
-      private predicate shortcuts_attr_first_join(
-        DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,
-        DataFlow::StepSummary summary
-      ) {
-        DataFlow::StepSummary::step(shortcuts_attr(t2, attr_name), res, summary)
-      }
-
-      /**
-       * Gets a reference to the attribute `attr_name` of the `django.shortcuts` module.
-       * WARNING: Only holds for a few predefined attributes.
-       */
-      private DataFlow::Node shortcuts_attr(string attr_name) {
-        result = shortcuts_attr(DataFlow::TypeTracker::end(), attr_name)
-      }
-
       /**
        * Gets a reference to the `django.shortcuts.redirect` function
        *
        * See https://docs.djangoproject.com/en/3.1/topics/http/shortcuts/#redirect
        */
-      DataFlow::Node redirect() { result = shortcuts_attr("redirect") }
+      API::Node redirect() { result = shortcuts().getMember("redirect") }
     }
   }
 
+  // ---------------------------------------------------------------------------
+  // Helpers
+  // ---------------------------------------------------------------------------
   /**
    * Gets the last decorator call for the function `func`, if `func` has decorators.
    */
@@ -1983,6 +1370,96 @@ private module Django {
     not exists(Call other_decorator | other_decorator.getArg(0) = result)
   }
 
+  /** Adds the `getASelfRef` member predicate when modeling a class. */
+  abstract private class SelfRefMixin extends Class {
+    /**
+     * Gets a reference to instances of this class, originating from a self parameter of
+     * a method defined on this class.
+     *
+     * Note: TODO: This doesn't take MRO into account
+     * Note: TODO: This doesn't take staticmethod/classmethod into account
+     */
+    private DataFlow::LocalSourceNode getASelfRef(DataFlow::TypeTracker t) {
+      t.start() and
+      result.(DataFlow::ParameterNode).getParameter() = this.getAMethod().getArg(0)
+      or
+      exists(DataFlow::TypeTracker t2 | result = this.getASelfRef(t2).track(t2, t))
+    }
+
+    /**
+     * Gets a reference to instances of this class, originating from a self parameter of
+     * a method defined on this class.
+     *
+     * Note: TODO: This doesn't take MRO into account
+     * Note: TODO: This doesn't take staticmethod/classmethod into account
+     */
+    DataFlow::Node getASelfRef() { this.getASelfRef(DataFlow::TypeTracker::end()).flowsTo(result) }
+  }
+
+  // ---------------------------------------------------------------------------
+  // Form and form field modeling
+  // ---------------------------------------------------------------------------
+  /**
+   * A class that is a subclass of the `django.forms.Form` class,
+   * thereby handling user input.
+   */
+  class DjangoFormClass extends Class, SelfRefMixin {
+    DjangoFormClass() { this.getABase() = Django::Forms::Form::subclassRef().getAUse().asExpr() }
+  }
+
+  /**
+   * A source of cleaned_data (either the return value from `super().clean()`, or a reference to `self.cleaned_data`)
+   *
+   * See https://docs.djangoproject.com/en/3.1/ref/forms/validation/#form-and-field-validation
+   */
+  private class DjangoFormCleanedData extends RemoteFlowSource::Range, DataFlow::Node {
+    DjangoFormCleanedData() {
+      exists(DjangoFormClass cls, Function meth |
+        cls.getAMethod() = meth and
+        (
+          this = API::builtin("super").getReturn().getMember("clean").getACall() and
+          this.getScope() = meth
+          or
+          this.(DataFlow::AttrRead).getAttributeName() = "cleaned_data" and
+          this.(DataFlow::AttrRead).getObject() = cls.getASelfRef()
+        )
+      )
+    }
+
+    override string getSourceType() {
+      result = "django.forms.Field subclass, value parameter in method"
+    }
+  }
+
+  /**
+   * A class that is a subclass of the `django.forms.Field` class,
+   * thereby handling user input.
+   */
+  class DjangoFormFieldClass extends Class {
+    DjangoFormFieldClass() {
+      this.getABase() = Django::Forms::Field::subclassRef().getAUse().asExpr()
+    }
+  }
+
+  /**
+   * A parameter in a method on a `DjangoFormFieldClass` that receives the user-supplied value for this field.
+   *
+   * See https://docs.djangoproject.com/en/3.1/ref/forms/validation/#form-and-field-validation
+   */
+  private class DjangoFormFieldValueParam extends RemoteFlowSource::Range, DataFlow::ParameterNode {
+    DjangoFormFieldValueParam() {
+      exists(DjangoFormFieldClass cls, Function meth |
+        cls.getAMethod() = meth and
+        meth.getName() in ["to_python", "validate", "run_validators", "clean"] and
+        this.getParameter() = meth.getArg(1)
+      )
+    }
+
+    override string getSourceType() {
+      result = "django.forms.Field subclass, value parameter in method"
+    }
+  }
+
   // ---------------------------------------------------------------------------
   // routing modeling
   // ---------------------------------------------------------------------------
@@ -1993,7 +1470,9 @@ private module Django {
    * route, but currently it just tracks all functions, since we can't do type-tracking
    * backwards yet (TODO).
    */
-  private DataFlow::Node djangoRouteHandlerFunctionTracker(DataFlow::TypeTracker t, Function func) {
+  private DataFlow::LocalSourceNode djangoRouteHandlerFunctionTracker(
+    DataFlow::TypeTracker t, Function func
+  ) {
     t.start() and
     (
       not exists(func.getADecorator()) and
@@ -2021,7 +1500,7 @@ private module Django {
    * backwards yet (TODO).
    */
   private DataFlow::Node djangoRouteHandlerFunctionTracker(Function func) {
-    result = djangoRouteHandlerFunctionTracker(DataFlow::TypeTracker::end(), func)
+    djangoRouteHandlerFunctionTracker(DataFlow::TypeTracker::end(), func).flowsTo(result)
   }
 
   /**
@@ -2034,7 +1513,7 @@ private module Django {
    */
   class DjangoViewClassHelper extends Class {
     /** Gets a reference to this class. */
-    private DataFlow::Node getARef(DataFlow::TypeTracker t) {
+    private DataFlow::LocalSourceNode getARef(DataFlow::TypeTracker t) {
       t.start() and
       result.asExpr().(ClassExpr) = this.getParent()
       or
@@ -2042,10 +1521,10 @@ private module Django {
     }
 
     /** Gets a reference to this class. */
-    DataFlow::Node getARef() { result = this.getARef(DataFlow::TypeTracker::end()) }
+    DataFlow::Node getARef() { this.getARef(DataFlow::TypeTracker::end()).flowsTo(result) }
 
     /** Gets a reference to the `as_view` classmethod of this class. */
-    private DataFlow::Node asViewRef(DataFlow::TypeTracker t) {
+    private DataFlow::LocalSourceNode asViewRef(DataFlow::TypeTracker t) {
       t.startInAttr("as_view") and
       result = this.getARef()
       or
@@ -2053,10 +1532,10 @@ private module Django {
     }
 
     /** Gets a reference to the `as_view` classmethod of this class. */
-    DataFlow::Node asViewRef() { result = this.asViewRef(DataFlow::TypeTracker::end()) }
+    DataFlow::Node asViewRef() { this.asViewRef(DataFlow::TypeTracker::end()).flowsTo(result) }
 
     /** Gets a reference to the result of calling the `as_view` classmethod of this class. */
-    private DataFlow::Node asViewResult(DataFlow::TypeTracker t) {
+    private DataFlow::LocalSourceNode asViewResult(DataFlow::TypeTracker t) {
       t.start() and
       result.asCfgNode().(CallNode).getFunction() = this.asViewRef().asCfgNode()
       or
@@ -2064,11 +1543,11 @@ private module Django {
     }
 
     /** Gets a reference to the result of calling the `as_view` classmethod of this class. */
-    DataFlow::Node asViewResult() { result = asViewResult(DataFlow::TypeTracker::end()) }
+    DataFlow::Node asViewResult() { asViewResult(DataFlow::TypeTracker::end()).flowsTo(result) }
   }
 
   /** A class that we consider a django View class. */
-  abstract class DjangoViewClass extends DjangoViewClassHelper {
+  abstract class DjangoViewClass extends DjangoViewClassHelper, SelfRefMixin {
     /** Gets a function that could handle incoming requests, if any. */
     Function getARequestHandler() {
       // TODO: This doesn't handle attribute assignment. Should be OK, but analysis is not as complete as with
@@ -2080,29 +1559,6 @@ private module Django {
         result.getName() = "get_redirect_url"
       )
     }
-
-    /**
-     * Gets a reference to instances of this class, originating from a self parameter of
-     * a method defined on this class.
-     *
-     * Note: TODO: This doesn't take MRO into account
-     * Note: TODO: This doesn't take staticmethod/classmethod into account
-     */
-    private DataFlow::Node getASelfRef(DataFlow::TypeTracker t) {
-      t.start() and
-      result.(DataFlow::ParameterNode).getParameter() = this.getAMethod().getArg(0)
-      or
-      exists(DataFlow::TypeTracker t2 | result = this.getASelfRef(t2).track(t2, t))
-    }
-
-    /**
-     * Gets a reference to instances of this class, originating from a self parameter of
-     * a method defined on this class.
-     *
-     * Note: TODO: This doesn't take MRO into account
-     * Note: TODO: This doesn't take staticmethod/classmethod into account
-     */
-    DataFlow::Node getASelfRef() { result = this.getASelfRef(DataFlow::TypeTracker::end()) }
   }
 
   /**
@@ -2121,7 +1577,7 @@ private module Django {
    */
   class DjangoViewClassFromSuperClass extends DjangoViewClass {
     DjangoViewClassFromSuperClass() {
-      this.getABase() = django::views::generic::View::subclassRef().asExpr()
+      this.getABase() = Django::Views::View::subclassRef().getAUse().asExpr()
     }
   }
 
@@ -2227,10 +1683,8 @@ private module Django {
    *
    * See https://docs.djangoproject.com/en/3.0/ref/urls/#path
    */
-  private class DjangoUrlsPathCall extends DjangoRouteSetup {
-    override CallNode node;
-
-    DjangoUrlsPathCall() { node.getFunction() = django::urls::path().asCfgNode() }
+  private class DjangoUrlsPathCall extends DjangoRouteSetup, DataFlow::CallCfgNode {
+    DjangoUrlsPathCall() { this = django::urls::path().getACall() }
 
     override DataFlow::Node getUrlPatternArg() {
       result.asCfgNode() = [node.getArg(0), node.getArgByName("route")]
@@ -2313,11 +1767,9 @@ private module Django {
    *
    * See https://docs.djangoproject.com/en/3.0/ref/urls/#re_path
    */
-  private class DjangoUrlsRePathCall extends DjangoRegexRouteSetup {
-    override CallNode node;
-
+  private class DjangoUrlsRePathCall extends DjangoRegexRouteSetup, DataFlow::CallCfgNode {
     DjangoUrlsRePathCall() {
-      node.getFunction() = django::urls::re_path().asCfgNode() and
+      this = django::urls::re_path().getACall() and
       // `django.conf.urls.url` (which we support directly with
       // `DjangoConfUrlsUrlCall`), is implemented in Django 2+ as backward compatibility
       // using `django.urls.re_path`. See
@@ -2348,10 +1800,8 @@ private module Django {
    *
    * See https://docs.djangoproject.com/en/1.11/ref/urls/#django.conf.urls.url
    */
-  private class DjangoConfUrlsUrlCall extends DjangoRegexRouteSetup {
-    override CallNode node;
-
-    DjangoConfUrlsUrlCall() { node.getFunction() = django::conf::conf_urls::url().asCfgNode() }
+  private class DjangoConfUrlsUrlCall extends DjangoRegexRouteSetup, DataFlow::CallCfgNode {
+    DjangoConfUrlsUrlCall() { this = django::conf::conf_urls::url().getACall() }
 
     override DataFlow::Node getUrlPatternArg() {
       result.asCfgNode() = [node.getArg(0), node.getArgByName("regex")]
@@ -2393,7 +1843,7 @@ private module Django {
     }
 
     override string getSourceType() {
-      result = "django.http.request.HttpRequest (attribute on self in View class)"
+      result = "django HttpRequest from self.request in View class"
     }
   }
 
@@ -2413,7 +1863,7 @@ private module Django {
     }
 
     override string getSourceType() {
-      result = "django routed param from attribute on self in View class"
+      result = "django routed param from self.args/kwargs in View class"
     }
   }
 
@@ -2459,10 +1909,8 @@ private module Django {
    * See https://docs.djangoproject.com/en/3.1/topics/http/shortcuts/#redirect
    */
   private class DjangoShortcutsRedirectCall extends HTTP::Server::HttpRedirectResponse::Range,
-    DataFlow::CfgNode {
-    override CallNode node;
-
-    DjangoShortcutsRedirectCall() { node.getFunction() = django::shortcuts::redirect().asCfgNode() }
+    DataFlow::CallCfgNode {
+    DjangoShortcutsRedirectCall() { this = django::shortcuts::redirect().getACall() }
 
     /**
      * Gets the data-flow node that specifies the location of this HTTP redirect response.
diff --git a/python/ql/src/semmle/python/frameworks/Fabric.qll b/python/ql/src/semmle/python/frameworks/Fabric.qll
index 764dce0de80..2319b9e1d70 100644
--- a/python/ql/src/semmle/python/frameworks/Fabric.qll
+++ b/python/ql/src/semmle/python/frameworks/Fabric.qll
@@ -11,6 +11,7 @@ private import python
 private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.dataflow.new.RemoteFlowSources
 private import semmle.python.Concepts
+private import semmle.python.ApiGraphs
 
 /**
  * Provides classes modeling security-relevant aspects of the `fabric` PyPI package, for
@@ -20,54 +21,7 @@ private import semmle.python.Concepts
  */
 private module FabricV1 {
   /** Gets a reference to the `fabric` module. */
-  private DataFlow::Node fabric(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("fabric")
-    or
-    exists(DataFlow::TypeTracker t2 | result = fabric(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `fabric` module. */
-  DataFlow::Node fabric() { result = fabric(DataFlow::TypeTracker::end()) }
-
-  /**
-   * Gets a reference to the attribute `attr_name` of the `fabric` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private DataFlow::Node fabric_attr(DataFlow::TypeTracker t, string attr_name) {
-    attr_name in ["api"] and
-    (
-      t.start() and
-      result = DataFlow::importNode("fabric" + "." + attr_name)
-      or
-      t.startInAttr(attr_name) and
-      result = fabric()
-    )
-    or
-    // Due to bad performance when using normal setup with `fabric_attr(t2, attr_name).track(t2, t)`
-    // we have inlined that code and forced a join
-    exists(DataFlow::TypeTracker t2 |
-      exists(DataFlow::StepSummary summary |
-        fabric_attr_first_join(t2, attr_name, result, summary) and
-        t = t2.append(summary)
-      )
-    )
-  }
-
-  pragma[nomagic]
-  private predicate fabric_attr_first_join(
-    DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res, DataFlow::StepSummary summary
-  ) {
-    DataFlow::StepSummary::step(fabric_attr(t2, attr_name), res, summary)
-  }
-
-  /**
-   * Gets a reference to the attribute `attr_name` of the `fabric` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private DataFlow::Node fabric_attr(string attr_name) {
-    result = fabric_attr(DataFlow::TypeTracker::end(), attr_name)
-  }
+  API::Node fabric() { result = API::moduleImport("fabric") }
 
   /** Provides models for the `fabric` module. */
   module fabric {
@@ -75,50 +29,10 @@ private module FabricV1 {
     // fabric.api
     // -------------------------------------------------------------------------
     /** Gets a reference to the `fabric.api` module. */
-    DataFlow::Node api() { result = fabric_attr("api") }
+    API::Node api() { result = fabric().getMember("api") }
 
     /** Provides models for the `fabric.api` module */
     module api {
-      /**
-       * Gets a reference to the attribute `attr_name` of the `fabric.api` module.
-       * WARNING: Only holds for a few predefined attributes.
-       */
-      private DataFlow::Node api_attr(DataFlow::TypeTracker t, string attr_name) {
-        attr_name in ["run", "local", "sudo"] and
-        (
-          t.start() and
-          result = DataFlow::importNode("fabric.api" + "." + attr_name)
-          or
-          t.startInAttr(attr_name) and
-          result = api()
-        )
-        or
-        // Due to bad performance when using normal setup with `api_attr(t2, attr_name).track(t2, t)`
-        // we have inlined that code and forced a join
-        exists(DataFlow::TypeTracker t2 |
-          exists(DataFlow::StepSummary summary |
-            api_attr_first_join(t2, attr_name, result, summary) and
-            t = t2.append(summary)
-          )
-        )
-      }
-
-      pragma[nomagic]
-      private predicate api_attr_first_join(
-        DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,
-        DataFlow::StepSummary summary
-      ) {
-        DataFlow::StepSummary::step(api_attr(t2, attr_name), res, summary)
-      }
-
-      /**
-       * Gets a reference to the attribute `attr_name` of the `fabric.api` module.
-       * WARNING: Only holds for a few predefined attributes.
-       */
-      private DataFlow::Node api_attr(string attr_name) {
-        result = api_attr(DataFlow::TypeTracker::end(), attr_name)
-      }
-
       /**
        * A call to either
        * - `fabric.api.local`
@@ -130,12 +44,8 @@ private module FabricV1 {
        * - https://docs.fabfile.org/en/1.14/api/core/operations.html#fabric.operations.sudo
        */
       private class FabricApiLocalRunSudoCall extends SystemCommandExecution::Range,
-        DataFlow::CfgNode {
-        override CallNode node;
-
-        FabricApiLocalRunSudoCall() {
-          node.getFunction() = api_attr(["local", "run", "sudo"]).asCfgNode()
-        }
+        DataFlow::CallCfgNode {
+        FabricApiLocalRunSudoCall() { this = api().getMember(["local", "run", "sudo"]).getACall() }
 
         override DataFlow::Node getCommand() {
           result.asCfgNode() = [node.getArg(0), node.getArgByName("command")]
@@ -153,61 +63,7 @@ private module FabricV1 {
  */
 private module FabricV2 {
   /** Gets a reference to the `fabric` module. */
-  private DataFlow::Node fabric(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("fabric")
-    or
-    exists(DataFlow::TypeTracker t2 | result = fabric(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `fabric` module. */
-  DataFlow::Node fabric() { result = fabric(DataFlow::TypeTracker::end()) }
-
-  /**
-   * Gets a reference to the attribute `attr_name` of the `fabric` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private DataFlow::Node fabric_attr(DataFlow::TypeTracker t, string attr_name) {
-    attr_name in [
-        // connection.py
-        "connection", "Connection",
-        // group.py
-        "group", "SerialGroup", "ThreadingGroup",
-        // tasks.py
-        "tasks", "task"
-      ] and
-    (
-      t.start() and
-      result = DataFlow::importNode("fabric" + "." + attr_name)
-      or
-      t.startInAttr(attr_name) and
-      result = fabric()
-    )
-    or
-    // Due to bad performance when using normal setup with `fabric_attr(t2, attr_name).track(t2, t)`
-    // we have inlined that code and forced a join
-    exists(DataFlow::TypeTracker t2 |
-      exists(DataFlow::StepSummary summary |
-        fabric_attr_first_join(t2, attr_name, result, summary) and
-        t = t2.append(summary)
-      )
-    )
-  }
-
-  pragma[nomagic]
-  private predicate fabric_attr_first_join(
-    DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res, DataFlow::StepSummary summary
-  ) {
-    DataFlow::StepSummary::step(fabric_attr(t2, attr_name), res, summary)
-  }
-
-  /**
-   * Gets a reference to the attribute `attr_name` of the `fabric` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private DataFlow::Node fabric_attr(string attr_name) {
-    result = fabric_attr(DataFlow::TypeTracker::end(), attr_name)
-  }
+  API::Node fabric() { result = API::moduleImport("fabric") }
 
   /** Provides models for the `fabric` module. */
   module fabric {
@@ -215,50 +71,10 @@ private module FabricV2 {
     // fabric.connection
     // -------------------------------------------------------------------------
     /** Gets a reference to the `fabric.connection` module. */
-    DataFlow::Node connection() { result = fabric_attr("connection") }
+    API::Node connection() { result = fabric().getMember("connection") }
 
     /** Provides models for the `fabric.connection` module */
     module connection {
-      /**
-       * Gets a reference to the attribute `attr_name` of the `fabric.connection` module.
-       * WARNING: Only holds for a few predefined attributes.
-       */
-      private DataFlow::Node connection_attr(DataFlow::TypeTracker t, string attr_name) {
-        attr_name in ["Connection"] and
-        (
-          t.start() and
-          result = DataFlow::importNode("fabric.connection" + "." + attr_name)
-          or
-          t.startInAttr(attr_name) and
-          result = connection()
-        )
-        or
-        // Due to bad performance when using normal setup with `connection_attr(t2, attr_name).track(t2, t)`
-        // we have inlined that code and forced a join
-        exists(DataFlow::TypeTracker t2 |
-          exists(DataFlow::StepSummary summary |
-            connection_attr_first_join(t2, attr_name, result, summary) and
-            t = t2.append(summary)
-          )
-        )
-      }
-
-      pragma[nomagic]
-      private predicate connection_attr_first_join(
-        DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,
-        DataFlow::StepSummary summary
-      ) {
-        DataFlow::StepSummary::step(connection_attr(t2, attr_name), res, summary)
-      }
-
-      /**
-       * Gets a reference to the attribute `attr_name` of the `fabric.connection` module.
-       * WARNING: Only holds for a few predefined attributes.
-       */
-      private DataFlow::Node connection_attr(string attr_name) {
-        result = connection_attr(DataFlow::TypeTracker::end(), attr_name)
-      }
-
       /**
        * Provides models for the `fabric.connection.Connection` class
        *
@@ -266,20 +82,12 @@ private module FabricV2 {
        */
       module Connection {
         /** Gets a reference to the `fabric.connection.Connection` class. */
-        private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-          t.start() and
-          result = connection_attr("Connection")
+        API::Node classRef() {
+          result = fabric().getMember("Connection")
           or
-          // handle `fabric.Connection` alias
-          t.start() and
-          result = fabric_attr("Connection")
-          or
-          exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
+          result = connection().getMember("Connection")
         }
 
-        /** Gets a reference to the `fabric.connection.Connection` class. */
-        DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
-
         /**
          * A source of instances of `fabric.connection.Connection`, extend this class to model new instances.
          *
@@ -289,16 +97,14 @@ private module FabricV2 {
          *
          * Use the predicate `Connection::instance()` to get references to instances of `fabric.connection.Connection`.
          */
-        abstract class InstanceSource extends DataFlow::Node { }
+        abstract class InstanceSource extends DataFlow::LocalSourceNode { }
 
-        private class ClassInstantiation extends InstanceSource, DataFlow::CfgNode {
-          override CallNode node;
-
-          ClassInstantiation() { node.getFunction() = classRef().asCfgNode() }
+        private class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {
+          ClassInstantiation() { this = classRef().getACall() }
         }
 
         /** Gets a reference to an instance of `fabric.connection.Connection`. */
-        private DataFlow::Node instance(DataFlow::TypeTracker t) {
+        private DataFlow::LocalSourceNode instance(DataFlow::TypeTracker t) {
           t.start() and
           result instanceof InstanceSource
           or
@@ -306,7 +112,7 @@ private module FabricV2 {
         }
 
         /** Gets a reference to an instance of `fabric.connection.Connection`. */
-        DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+        DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
 
         /**
          * Gets a reference to either `run`, `sudo`, or `local` method on a
@@ -317,7 +123,7 @@ private module FabricV2 {
          * - https://docs.fabfile.org/en/2.5/api/connection.html#fabric.connection.Connection.sudo
          * - https://docs.fabfile.org/en/2.5/api/connection.html#fabric.connection.Connection.local
          */
-        private DataFlow::Node instanceRunMethods(DataFlow::TypeTracker t) {
+        private DataFlow::LocalSourceNode instanceRunMethods(DataFlow::TypeTracker t) {
           t.startInAttr(["run", "sudo", "local"]) and
           result = instance()
           or
@@ -334,7 +140,7 @@ private module FabricV2 {
          * - https://docs.fabfile.org/en/2.5/api/connection.html#fabric.connection.Connection.local
          */
         DataFlow::Node instanceRunMethods() {
-          result = instanceRunMethods(DataFlow::TypeTracker::end())
+          instanceRunMethods(DataFlow::TypeTracker::end()).flowsTo(result)
         }
       }
     }
@@ -347,11 +153,9 @@ private module FabricV2 {
      * - https://docs.fabfile.org/en/2.5/api/connection.html#fabric.connection.Connection.local
      */
     private class FabricConnectionRunSudoLocalCall extends SystemCommandExecution::Range,
-      DataFlow::CfgNode {
-      override CallNode node;
-
+      DataFlow::CallCfgNode {
       FabricConnectionRunSudoLocalCall() {
-        node.getFunction() = fabric::connection::Connection::instanceRunMethods().asCfgNode()
+        this.getFunction() = fabric::connection::Connection::instanceRunMethods()
       }
 
       override DataFlow::Node getCommand() {
@@ -363,34 +167,19 @@ private module FabricV2 {
     // fabric.tasks
     // -------------------------------------------------------------------------
     /** Gets a reference to the `fabric.tasks` module. */
-    DataFlow::Node tasks() { result = fabric_attr("tasks") }
+    API::Node tasks() { result = fabric().getMember("tasks") }
 
     /** Provides models for the `fabric.tasks` module */
     module tasks {
       /** Gets a reference to the `fabric.tasks.task` decorator. */
-      private DataFlow::Node task(DataFlow::TypeTracker t) {
-        t.start() and
-        result = DataFlow::importNode("fabric.tasks.task")
-        or
-        t.startInAttr("task") and
-        result = tasks()
-        or
-        // Handle `fabric.task` alias
-        t.startInAttr("task") and
-        result = fabric()
-        or
-        exists(DataFlow::TypeTracker t2 | result = task(t2).track(t2, t))
-      }
-
-      /** Gets a reference to the `fabric.tasks.task` decorator. */
-      DataFlow::Node task() { result = task(DataFlow::TypeTracker::end()) }
+      API::Node task() { result in [tasks().getMember("task"), fabric().getMember("task")] }
     }
 
     class FabricTaskFirstParamConnectionInstance extends fabric::connection::Connection::InstanceSource,
       DataFlow::ParameterNode {
       FabricTaskFirstParamConnectionInstance() {
         exists(Function func |
-          func.getADecorator() = fabric::tasks::task().asExpr() and
+          func.getADecorator() = fabric::tasks::task().getAUse().asExpr() and
           this.getParameter() = func.getArg(0)
         )
       }
@@ -400,50 +189,10 @@ private module FabricV2 {
     // fabric.group
     // -------------------------------------------------------------------------
     /** Gets a reference to the `fabric.group` module. */
-    DataFlow::Node group() { result = fabric_attr("group") }
+    API::Node group() { result = fabric().getMember("group") }
 
     /** Provides models for the `fabric.group` module */
     module group {
-      /**
-       * Gets a reference to the attribute `attr_name` of the `fabric.group` module.
-       * WARNING: Only holds for a few predefined attributes.
-       */
-      private DataFlow::Node group_attr(DataFlow::TypeTracker t, string attr_name) {
-        attr_name in ["SerialGroup", "ThreadingGroup"] and
-        (
-          t.start() and
-          result = DataFlow::importNode("fabric.group" + "." + attr_name)
-          or
-          t.startInAttr(attr_name) and
-          result = group()
-        )
-        or
-        // Due to bad performance when using normal setup with `group_attr(t2, attr_name).track(t2, t)`
-        // we have inlined that code and forced a join
-        exists(DataFlow::TypeTracker t2 |
-          exists(DataFlow::StepSummary summary |
-            group_attr_first_join(t2, attr_name, result, summary) and
-            t = t2.append(summary)
-          )
-        )
-      }
-
-      pragma[nomagic]
-      private predicate group_attr_first_join(
-        DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,
-        DataFlow::StepSummary summary
-      ) {
-        DataFlow::StepSummary::step(group_attr(t2, attr_name), res, summary)
-      }
-
-      /**
-       * Gets a reference to the attribute `attr_name` of the `fabric.group` module.
-       * WARNING: Only holds for a few predefined attributes.
-       */
-      private DataFlow::Node group_attr(string attr_name) {
-        result = group_attr(DataFlow::TypeTracker::end(), attr_name)
-      }
-
       /**
        * Provides models for the `fabric.group.Group` class and its subclasses.
        *
@@ -465,41 +214,20 @@ private module FabricV2 {
          *
          * Use `Group::subclassInstance()` predicate to get references to an instance of a subclass of `fabric.group.Group`.
          */
-        abstract class SubclassInstanceSource extends DataFlow::Node { }
-
-        /** Gets a reference to an instance of a subclass of `fabric.group.Group`. */
-        private DataFlow::Node subclassInstance(DataFlow::TypeTracker t) {
-          t.start() and
-          result instanceof SubclassInstanceSource
-          or
-          exists(DataFlow::TypeTracker t2 | result = subclassInstance(t2).track(t2, t))
+        abstract class ModeledSubclass extends API::Node {
+          /** Gets a string representation of this element. */
+          override string toString() { result = this.(API::Node).toString() }
         }
 
         /** Gets a reference to an instance of a subclass of `fabric.group.Group`. */
-        DataFlow::Node subclassInstance() {
-          result = subclassInstance(DataFlow::TypeTracker::end())
-        }
+        API::Node subclassInstance() { result = any(ModeledSubclass m).getASubclass*().getReturn() }
 
         /**
          * Gets a reference to the `run` method on an instance of a subclass of `fabric.group.Group`.
          *
          * See https://docs.fabfile.org/en/2.5/api/group.html#fabric.group.Group.run
          */
-        private DataFlow::Node subclassInstanceRunMethod(DataFlow::TypeTracker t) {
-          t.startInAttr("run") and
-          result = subclassInstance()
-          or
-          exists(DataFlow::TypeTracker t2 | result = subclassInstanceRunMethod(t2).track(t2, t))
-        }
-
-        /**
-         * Gets a reference to the `run` method on an instance of a subclass of `fabric.group.Group`.
-         *
-         * See https://docs.fabfile.org/en/2.5/api/group.html#fabric.group.Group.run
-         */
-        DataFlow::Node subclassInstanceRunMethod() {
-          result = subclassInstanceRunMethod(DataFlow::TypeTracker::end())
-        }
+        API::Node subclassInstanceRunMethod() { result = subclassInstance().getMember("run") }
       }
 
       /**
@@ -507,12 +235,8 @@ private module FabricV2 {
        *
        * See https://docs.fabfile.org/en/2.5/api/group.html#fabric.group.Group.run
        */
-      private class FabricGroupRunCall extends SystemCommandExecution::Range, DataFlow::CfgNode {
-        override CallNode node;
-
-        FabricGroupRunCall() {
-          node.getFunction() = fabric::group::Group::subclassInstanceRunMethod().asCfgNode()
-        }
+      private class FabricGroupRunCall extends SystemCommandExecution::Range, DataFlow::CallCfgNode {
+        FabricGroupRunCall() { this = fabric::group::Group::subclassInstanceRunMethod().getACall() }
 
         override DataFlow::Node getCommand() {
           result.asCfgNode() = [node.getArg(0), node.getArgByName("command")]
@@ -525,25 +249,12 @@ private module FabricV2 {
        * See https://docs.fabfile.org/en/2.5/api/group.html#fabric.group.SerialGroup.
        */
       module SerialGroup {
-        /** Gets a reference to the `fabric.group.SerialGroup` class. */
-        private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-          t.start() and
-          result = group_attr("SerialGroup")
-          or
-          // Handle `fabric.SerialGroup` alias
-          t.start() and
-          result = fabric_attr("SerialGroup")
-          or
-          exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
-        }
-
-        /** Gets a reference to the `fabric.group.SerialGroup` class. */
-        private DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
-
-        private class ClassInstantiation extends Group::SubclassInstanceSource, DataFlow::CfgNode {
-          override CallNode node;
-
-          ClassInstantiation() { node.getFunction() = classRef().asCfgNode() }
+        private class ClassInstantiation extends Group::ModeledSubclass {
+          ClassInstantiation() {
+            this = group().getMember("SerialGroup")
+            or
+            this = fabric().getMember("SerialGroup")
+          }
         }
       }
 
@@ -553,25 +264,12 @@ private module FabricV2 {
        * See https://docs.fabfile.org/en/2.5/api/group.html#fabric.group.ThreadingGroup.
        */
       module ThreadingGroup {
-        /** Gets a reference to the `fabric.group.ThreadingGroup` class. */
-        private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-          t.start() and
-          result = group_attr("ThreadingGroup")
-          or
-          // Handle `fabric.ThreadingGroup` alias
-          t.start() and
-          result = fabric_attr("ThreadingGroup")
-          or
-          exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
-        }
-
-        /** Gets a reference to the `fabric.group.ThreadingGroup` class. */
-        DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
-
-        private class ClassInstantiation extends Group::SubclassInstanceSource, DataFlow::CfgNode {
-          override CallNode node;
-
-          ClassInstantiation() { node.getFunction() = classRef().asCfgNode() }
+        private class ClassInstantiation extends Group::ModeledSubclass {
+          ClassInstantiation() {
+            this = group().getMember("ThreadingGroup")
+            or
+            this = fabric().getMember("ThreadingGroup")
+          }
         }
       }
     }
diff --git a/python/ql/src/semmle/python/frameworks/Flask.qll b/python/ql/src/semmle/python/frameworks/Flask.qll
index 8b045c2ee83..b4c5b5dcf8b 100644
--- a/python/ql/src/semmle/python/frameworks/Flask.qll
+++ b/python/ql/src/semmle/python/frameworks/Flask.qll
@@ -401,13 +401,15 @@ module Flask {
     }
   }
 
-  private class RequestAttrMultiDict extends Werkzeug::werkzeug::datastructures::MultiDict::InstanceSource {
+  private class RequestAttrMultiDict extends Werkzeug::werkzeug::datastructures::MultiDict::InstanceSourceApiNode {
     string attr_name;
 
     RequestAttrMultiDict() {
       attr_name in ["args", "values", "form", "files"] and
-      this = request().getMember(attr_name).getAnImmediateUse()
+      this = request().getMember(attr_name)
     }
+
+    override string toString() { result = this.(API::Node).toString() }
   }
 
   private class RequestAttrFiles extends RequestAttrMultiDict {
diff --git a/python/ql/src/semmle/python/frameworks/Invoke.qll b/python/ql/src/semmle/python/frameworks/Invoke.qll
index 02db1cb5db2..6330d0c631f 100644
--- a/python/ql/src/semmle/python/frameworks/Invoke.qll
+++ b/python/ql/src/semmle/python/frameworks/Invoke.qll
@@ -6,6 +6,7 @@
 private import python
 private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.Concepts
+private import semmle.python.ApiGraphs
 
 /**
  * Provides models for the `invoke` PyPI package.
@@ -16,102 +17,44 @@ private module Invoke {
   // invoke
   // ---------------------------------------------------------------------------
   /** Gets a reference to the `invoke` module. */
-  private DataFlow::Node invoke(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("invoke")
-    or
-    exists(DataFlow::TypeTracker t2 | result = invoke(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `invoke` module. */
-  DataFlow::Node invoke() { result = invoke(DataFlow::TypeTracker::end()) }
-
-  /**
-   * Gets a reference to the attribute `attr_name` of the `invoke` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private DataFlow::Node invoke_attr(DataFlow::TypeTracker t, string attr_name) {
-    attr_name in ["run", "sudo", "context", "Context", "task"] and
-    (
-      t.start() and
-      result = DataFlow::importNode("invoke." + attr_name)
-      or
-      t.startInAttr(attr_name) and
-      result = DataFlow::importNode("invoke")
-    )
-    or
-    // Due to bad performance when using normal setup with `invoke_attr(t2, attr_name).track(t2, t)`
-    // we have inlined that code and forced a join
-    exists(DataFlow::TypeTracker t2 |
-      exists(DataFlow::StepSummary summary |
-        invoke_attr_first_join(t2, attr_name, result, summary) and
-        t = t2.append(summary)
-      )
-    )
-  }
-
-  pragma[nomagic]
-  private predicate invoke_attr_first_join(
-    DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res, DataFlow::StepSummary summary
-  ) {
-    DataFlow::StepSummary::step(invoke_attr(t2, attr_name), res, summary)
-  }
-
-  /**
-   * Gets a reference to the attribute `attr_name` of the `invoke` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private DataFlow::Node invoke_attr(string attr_name) {
-    result = invoke_attr(DataFlow::TypeTracker::end(), attr_name)
-  }
+  API::Node invoke() { result = API::moduleImport("invoke") }
 
   /** Provides models for the `invoke` module. */
   module invoke {
     /** Gets a reference to the `invoke.context` module. */
-    DataFlow::Node context() { result = invoke_attr("context") }
+    API::Node context() { result = invoke().getMember("context") }
 
     /** Provides models for the `invoke.context` module */
     module context {
       /** Provides models for the `invoke.context.Context` class */
       module Context {
         /** Gets a reference to the `invoke.context.Context` class. */
-        private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-          t.start() and
-          result = DataFlow::importNode("invoke.context.Context")
+        API::Node classRef() {
+          result = API::moduleImport("invoke").getMember("context").getMember("Context")
           or
-          t.startInAttr("Context") and
-          result = invoke::context()
-          or
-          // handle invoke.Context alias
-          t.start() and
-          result = invoke_attr("Context")
-          or
-          exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
+          result = API::moduleImport("invoke").getMember("Context")
         }
 
-        /** Gets a reference to the `invoke.context.Context` class. */
-        DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
-
         /** Gets a reference to an instance of `invoke.context.Context`. */
-        private DataFlow::Node instance(DataFlow::TypeTracker t) {
+        private DataFlow::LocalSourceNode instance(DataFlow::TypeTracker t) {
           t.start() and
-          result.asCfgNode().(CallNode).getFunction() =
-            invoke::context::Context::classRef().asCfgNode()
-          or
-          t.start() and
-          exists(Function func |
-            func.getADecorator() = invoke_attr("task").asExpr() and
-            result.(DataFlow::ParameterNode).getParameter() = func.getArg(0)
+          (
+            result = invoke::context::Context::classRef().getACall()
+            or
+            exists(Function func |
+              func.getADecorator() = invoke().getMember("task").getAUse().asExpr() and
+              result.(DataFlow::ParameterNode).getParameter() = func.getArg(0)
+            )
           )
           or
           exists(DataFlow::TypeTracker t2 | result = instance(t2).track(t2, t))
         }
 
         /** Gets a reference to an instance of `invoke.context.Context`. */
-        DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+        DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
 
         /** Gets a reference to the `run` or `sudo` methods on a `invoke.context.Context` instance. */
-        private DataFlow::Node instanceRunMethods(DataFlow::TypeTracker t) {
+        private DataFlow::LocalSourceNode instanceRunMethods(DataFlow::TypeTracker t) {
           t.startInAttr(["run", "sudo"]) and
           result = invoke::context::Context::instance()
           or
@@ -120,7 +63,7 @@ private module Invoke {
 
         /** Gets a reference to the `run` or `sudo` methods on a `invoke.context.Context` instance. */
         DataFlow::Node instanceRunMethods() {
-          result = instanceRunMethods(DataFlow::TypeTracker::end())
+          instanceRunMethods(DataFlow::TypeTracker::end()).flowsTo(result)
         }
       }
     }
@@ -131,15 +74,10 @@ private module Invoke {
    * - `invoke.run` or `invoke.sudo` functions (http://docs.pyinvoke.org/en/stable/api/__init__.html)
    * - `run` or `sudo` methods on a `invoke.context.Context` instance (http://docs.pyinvoke.org/en/stable/api/context.html#invoke.context.Context.run)
    */
-  private class InvokeRunCommandCall extends SystemCommandExecution::Range, DataFlow::CfgNode {
-    override CallNode node;
-
+  private class InvokeRunCommandCall extends SystemCommandExecution::Range, DataFlow::CallCfgNode {
     InvokeRunCommandCall() {
-      exists(DataFlow::Node callFunction | node.getFunction() = callFunction.asCfgNode() |
-        callFunction = invoke_attr(["run", "sudo"])
-        or
-        callFunction = invoke::context::Context::instanceRunMethods()
-      )
+      this = invoke().getMember(["run", "sudo"]).getACall() or
+      this.getFunction() = invoke::context::Context::instanceRunMethods()
     }
 
     override DataFlow::Node getCommand() {
diff --git a/python/ql/src/semmle/python/frameworks/MySQLdb.qll b/python/ql/src/semmle/python/frameworks/MySQLdb.qll
index 7013c6f5d02..b36bf87c7d9 100644
--- a/python/ql/src/semmle/python/frameworks/MySQLdb.qll
+++ b/python/ql/src/semmle/python/frameworks/MySQLdb.qll
@@ -9,6 +9,7 @@ private import python
 private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.dataflow.new.RemoteFlowSources
 private import semmle.python.Concepts
+private import semmle.python.ApiGraphs
 private import PEP249
 
 /**
@@ -21,19 +22,8 @@ private module MySQLdb {
   // ---------------------------------------------------------------------------
   // MySQLdb
   // ---------------------------------------------------------------------------
-  /** Gets a reference to the `MySQLdb` module. */
-  private DataFlow::Node moduleMySQLdb(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("MySQLdb")
-    or
-    exists(DataFlow::TypeTracker t2 | result = moduleMySQLdb(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `MySQLdb` module. */
-  DataFlow::Node moduleMySQLdb() { result = moduleMySQLdb(DataFlow::TypeTracker::end()) }
-
   /** MySQLdb implements PEP 249, providing ways to execute SQL statements against a database. */
-  class MySQLdb extends PEP249Module {
-    MySQLdb() { this = moduleMySQLdb() }
+  class MySQLdb extends PEP249ModuleApiNode {
+    MySQLdb() { this = API::moduleImport("MySQLdb") }
   }
 }
diff --git a/python/ql/src/semmle/python/frameworks/MysqlConnectorPython.qll b/python/ql/src/semmle/python/frameworks/MysqlConnectorPython.qll
index 1722bdcb51e..97cd4fd162c 100644
--- a/python/ql/src/semmle/python/frameworks/MysqlConnectorPython.qll
+++ b/python/ql/src/semmle/python/frameworks/MysqlConnectorPython.qll
@@ -9,6 +9,7 @@ private import python
 private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.dataflow.new.RemoteFlowSources
 private import semmle.python.Concepts
+private import semmle.python.ApiGraphs
 private import PEP249
 
 /**
@@ -21,64 +22,14 @@ private module MysqlConnectorPython {
   // ---------------------------------------------------------------------------
   // mysql
   // ---------------------------------------------------------------------------
-  /** Gets a reference to the `mysql` module. */
-  private DataFlow::Node mysql(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("mysql")
-    or
-    exists(DataFlow::TypeTracker t2 | result = mysql(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `mysql` module. */
-  DataFlow::Node mysql() { result = mysql(DataFlow::TypeTracker::end()) }
-
-  /**
-   * Gets a reference to the attribute `attr_name` of the `mysql` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private DataFlow::Node mysql_attr(DataFlow::TypeTracker t, string attr_name) {
-    attr_name in ["connector"] and
-    (
-      t.start() and
-      result = DataFlow::importNode("mysql" + "." + attr_name)
-      or
-      t.startInAttr(attr_name) and
-      result = mysql()
-    )
-    or
-    // Due to bad performance when using normal setup with `mysql_attr(t2, attr_name).track(t2, t)`
-    // we have inlined that code and forced a join
-    exists(DataFlow::TypeTracker t2 |
-      exists(DataFlow::StepSummary summary |
-        mysql_attr_first_join(t2, attr_name, result, summary) and
-        t = t2.append(summary)
-      )
-    )
-  }
-
-  pragma[nomagic]
-  private predicate mysql_attr_first_join(
-    DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res, DataFlow::StepSummary summary
-  ) {
-    DataFlow::StepSummary::step(mysql_attr(t2, attr_name), res, summary)
-  }
-
-  /**
-   * Gets a reference to the attribute `attr_name` of the `mysql` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private DataFlow::Node mysql_attr(string attr_name) {
-    result = mysql_attr(DataFlow::TypeTracker::end(), attr_name)
-  }
-
   /** Provides models for the `mysql` module. */
   module mysql {
     /**
      * The mysql.connector module
      * See https://dev.mysql.com/doc/connector-python/en/connector-python-example-connecting.html
      */
-    class MysqlConnector extends PEP249Module {
-      MysqlConnector() { this = mysql_attr("connector") }
+    class MysqlConnector extends PEP249ModuleApiNode {
+      MysqlConnector() { this = API::moduleImport("mysql").getMember("connector") }
     }
   }
 }
diff --git a/python/ql/src/semmle/python/frameworks/PEP249.qll b/python/ql/src/semmle/python/frameworks/PEP249.qll
index 1a5d888949f..f2b21d08e7c 100644
--- a/python/ql/src/semmle/python/frameworks/PEP249.qll
+++ b/python/ql/src/semmle/python/frameworks/PEP249.qll
@@ -7,20 +7,26 @@ private import python
 private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.dataflow.new.RemoteFlowSources
 private import semmle.python.Concepts
+private import semmle.python.ApiGraphs
 
-/** A module implementing PEP 249. Extend this class for implementations. */
-abstract class PEP249Module extends DataFlow::Node { }
+/**
+ * A module implementing PEP 249. Extend this class for implementations.
+ *
+ * DEPRECATED: Extend `PEP249ModuleApiNode` instead.
+ */
+abstract deprecated class PEP249Module extends DataFlow::Node { }
 
-/** Gets a reference to a connect call. */
-private DataFlow::Node connect(DataFlow::TypeTracker t) {
-  t.startInAttr("connect") and
-  result instanceof PEP249Module
-  or
-  exists(DataFlow::TypeTracker t2 | result = connect(t2).track(t2, t))
+/**
+ * An abstract class encompassing API graph nodes that implement PEP 249.
+ * Extend this class for implementations.
+ */
+abstract class PEP249ModuleApiNode extends API::Node {
+  /** Gets a string representation of this element. */
+  override string toString() { result = this.(API::Node).toString() }
 }
 
 /** Gets a reference to a connect call. */
-DataFlow::Node connect() { result = connect(DataFlow::TypeTracker::end()) }
+DataFlow::Node connect() { result = any(PEP249ModuleApiNode a).getMember("connect").getAUse() }
 
 /**
  * Provides models for the `db.Connection` class
@@ -43,10 +49,8 @@ module Connection {
   abstract class InstanceSource extends DataFlow::Node { }
 
   /** A direct instantiation of `db.Connection`. */
-  private class ClassInstantiation extends InstanceSource, DataFlow::CfgNode {
-    override CallNode node;
-
-    ClassInstantiation() { node.getFunction() = connect().asCfgNode() }
+  private class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {
+    ClassInstantiation() { this.getFunction() = connect() }
   }
 
   /** Gets a reference to an instance of `db.Connection`. */
@@ -115,10 +119,8 @@ private DataFlow::Node execute(DataFlow::TypeTracker t) {
 DataFlow::Node execute() { result = execute(DataFlow::TypeTracker::end()) }
 
 /** A call to the `execute` method on a cursor (or on a connection). */
-private class ExecuteCall extends SqlExecution::Range, DataFlow::CfgNode {
-  override CallNode node;
-
-  ExecuteCall() { node.getFunction() = execute().asCfgNode() }
+private class ExecuteCall extends SqlExecution::Range, DataFlow::CallCfgNode {
+  ExecuteCall() { this.getFunction() = execute() }
 
   override DataFlow::Node getSql() {
     result.asCfgNode() in [node.getArg(0), node.getArgByName("sql")]
diff --git a/python/ql/src/semmle/python/frameworks/Psycopg2.qll b/python/ql/src/semmle/python/frameworks/Psycopg2.qll
index 96beee3f011..1cc20026801 100644
--- a/python/ql/src/semmle/python/frameworks/Psycopg2.qll
+++ b/python/ql/src/semmle/python/frameworks/Psycopg2.qll
@@ -9,6 +9,7 @@ private import python
 private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.dataflow.new.RemoteFlowSources
 private import semmle.python.Concepts
+private import semmle.python.ApiGraphs
 private import PEP249
 
 /**
@@ -21,19 +22,8 @@ private module Psycopg2 {
   // ---------------------------------------------------------------------------
   // Psycopg
   // ---------------------------------------------------------------------------
-  /** Gets a reference to the `psycopg2` module. */
-  private DataFlow::Node psycopg2(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("psycopg2")
-    or
-    exists(DataFlow::TypeTracker t2 | result = psycopg2(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `psycopg2` module. */
-  DataFlow::Node psycopg2() { result = psycopg2(DataFlow::TypeTracker::end()) }
-
   /** psycopg2 implements PEP 249, providing ways to execute SQL statements against a database. */
-  class Psycopg2 extends PEP249Module {
-    Psycopg2() { this = psycopg2() }
+  class Psycopg2 extends PEP249ModuleApiNode {
+    Psycopg2() { this = API::moduleImport("psycopg2") }
   }
 }
diff --git a/python/ql/src/semmle/python/frameworks/PyMySQL.qll b/python/ql/src/semmle/python/frameworks/PyMySQL.qll
index 954d2f690dd..c078302b73f 100644
--- a/python/ql/src/semmle/python/frameworks/PyMySQL.qll
+++ b/python/ql/src/semmle/python/frameworks/PyMySQL.qll
@@ -7,6 +7,7 @@ private import python
 private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.dataflow.new.RemoteFlowSources
 private import semmle.python.Concepts
+private import semmle.python.ApiGraphs
 private import PEP249
 
 /**
@@ -14,19 +15,8 @@ private import PEP249
  * See https://pypi.org/project/PyMySQL/
  */
 private module PyMySQL {
-  /** Gets a reference to the `pymysql` module. */
-  private DataFlow::Node pymysql(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("pymysql")
-    or
-    exists(DataFlow::TypeTracker t2 | result = pymysql(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `pymysql` module. */
-  DataFlow::Node pymysql() { result = pymysql(DataFlow::TypeTracker::end()) }
-
   /** PyMySQL implements PEP 249, providing ways to execute SQL statements against a database. */
-  class PyMySQLPEP249 extends PEP249Module {
-    PyMySQLPEP249() { this = pymysql() }
+  class PyMySQLPEP249 extends PEP249ModuleApiNode {
+    PyMySQLPEP249() { this = API::moduleImport("pymysql") }
   }
 }
diff --git a/python/ql/src/semmle/python/frameworks/Stdlib.qll b/python/ql/src/semmle/python/frameworks/Stdlib.qll
index 2626d1585ff..01df130d0db 100644
--- a/python/ql/src/semmle/python/frameworks/Stdlib.qll
+++ b/python/ql/src/semmle/python/frameworks/Stdlib.qll
@@ -17,121 +17,17 @@ private module Stdlib {
   // os
   // ---------------------------------------------------------------------------
   /** Gets a reference to the `os` module. */
-  private DataFlow::Node os(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("os")
-    or
-    exists(DataFlow::TypeTracker t2 | result = os(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `os` module. */
-  DataFlow::Node os() { result = os(DataFlow::TypeTracker::end()) }
-
-  /**
-   * Gets a reference to the attribute `attr_name` of the `os` module.
-   * WARNING: Only holds for a few predefined attributes.
-   *
-   * For example, using `attr_name = "system"` will get all uses of `os.system`.
-   */
-  private DataFlow::Node os_attr(DataFlow::TypeTracker t, string attr_name) {
-    attr_name in [
-        "system", "popen", "popen2", "popen3", "popen4",
-        // exec
-        "execl", "execle", "execlp", "execlpe", "execv", "execve", "execvp", "execvpe",
-        // spawn
-        "spawnl", "spawnle", "spawnlp", "spawnlpe", "spawnv", "spawnve", "spawnvp", "spawnvpe",
-        "posix_spawn", "posix_spawnp",
-        // modules
-        "path"
-      ] and
-    (
-      t.start() and
-      result = DataFlow::importNode("os." + attr_name)
-      or
-      t.startInAttr(attr_name) and
-      result = DataFlow::importNode("os")
-    )
-    or
-    // Due to bad performance when using normal setup with `os_attr(t2, attr_name).track(t2, t)`
-    // we have inlined that code and forced a join
-    exists(DataFlow::TypeTracker t2 |
-      exists(DataFlow::StepSummary summary |
-        os_attr_first_join(t2, attr_name, result, summary) and
-        t = t2.append(summary)
-      )
-    )
-  }
-
-  pragma[nomagic]
-  private predicate os_attr_first_join(
-    DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res, DataFlow::StepSummary summary
-  ) {
-    DataFlow::StepSummary::step(os_attr(t2, attr_name), res, summary)
-  }
-
-  /**
-   * Gets a reference to the attribute `attr_name` of the `os` module.
-   * WARNING: Only holds for a few predefined attributes.
-   *
-   * For example, using `"system"` will get all uses of `os.system`.
-   */
-  private DataFlow::Node os_attr(string attr_name) {
-    result = os_attr(DataFlow::TypeTracker::end(), attr_name)
-  }
+  API::Node os() { result = API::moduleImport("os") }
 
   /** Provides models for the `os` module. */
   module os {
     /** Gets a reference to the `os.path` module. */
-    DataFlow::Node path() { result = os_attr("path") }
+    API::Node path() { result = os().getMember("path") }
 
     /** Provides models for the `os.path` module */
     module path {
-      /**
-       * Gets a reference to the attribute `attr_name` of the `os.path` module.
-       * WARNING: Only holds for a few predefined attributes.
-       *
-       * For example, using `attr_name = "join"` will get all uses of `os.path.join`.
-       */
-      private DataFlow::Node path_attr(DataFlow::TypeTracker t, string attr_name) {
-        attr_name in ["join", "normpath", "realpath", "abspath"] and
-        (
-          t.start() and
-          result = DataFlow::importNode("os.path." + attr_name)
-          or
-          t.startInAttr(attr_name) and
-          result = os::path()
-        )
-        or
-        // Due to bad performance when using normal setup with `path_attr(t2, attr_name).track(t2, t)`
-        // we have inlined that code and forced a join
-        exists(DataFlow::TypeTracker t2 |
-          exists(DataFlow::StepSummary summary |
-            path_attr_first_join(t2, attr_name, result, summary) and
-            t = t2.append(summary)
-          )
-        )
-      }
-
-      pragma[nomagic]
-      private predicate path_attr_first_join(
-        DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,
-        DataFlow::StepSummary summary
-      ) {
-        DataFlow::StepSummary::step(path_attr(t2, attr_name), res, summary)
-      }
-
-      /**
-       * Gets a reference to the attribute `attr_name` of the `os.path` module.
-       * WARNING: Only holds for a few predefined attributes.
-       *
-       * For example, using `attr_name = "join"` will get all uses of `os.path.join`.
-       */
-      DataFlow::Node path_attr(string attr_name) {
-        result = path_attr(DataFlow::TypeTracker::end(), attr_name)
-      }
-
       /** Gets a reference to the `os.path.join` function. */
-      DataFlow::Node join() { result = path_attr("join") }
+      API::Node join() { result = path().getMember("join") }
     }
   }
 
@@ -139,10 +35,8 @@ private module Stdlib {
    * A call to `os.path.normpath`.
    * See https://docs.python.org/3/library/os.path.html#os.path.normpath
    */
-  private class OsPathNormpathCall extends Path::PathNormalization::Range, DataFlow::CfgNode {
-    override CallNode node;
-
-    OsPathNormpathCall() { node.getFunction() = os::path::path_attr("normpath").asCfgNode() }
+  private class OsPathNormpathCall extends Path::PathNormalization::Range, DataFlow::CallCfgNode {
+    OsPathNormpathCall() { this = os::path().getMember("normpath").getACall() }
 
     DataFlow::Node getPathArg() {
       result.asCfgNode() in [node.getArg(0), node.getArgByName("path")]
@@ -163,10 +57,8 @@ private module Stdlib {
    * A call to `os.path.abspath`.
    * See https://docs.python.org/3/library/os.path.html#os.path.abspath
    */
-  private class OsPathAbspathCall extends Path::PathNormalization::Range, DataFlow::CfgNode {
-    override CallNode node;
-
-    OsPathAbspathCall() { node.getFunction() = os::path::path_attr("abspath").asCfgNode() }
+  private class OsPathAbspathCall extends Path::PathNormalization::Range, DataFlow::CallCfgNode {
+    OsPathAbspathCall() { this = os::path().getMember("abspath").getACall() }
 
     DataFlow::Node getPathArg() {
       result.asCfgNode() in [node.getArg(0), node.getArgByName("path")]
@@ -187,10 +79,8 @@ private module Stdlib {
    * A call to `os.path.realpath`.
    * See https://docs.python.org/3/library/os.path.html#os.path.realpath
    */
-  private class OsPathRealpathCall extends Path::PathNormalization::Range, DataFlow::CfgNode {
-    override CallNode node;
-
-    OsPathRealpathCall() { node.getFunction() = os::path::path_attr("realpath").asCfgNode() }
+  private class OsPathRealpathCall extends Path::PathNormalization::Range, DataFlow::CallCfgNode {
+    OsPathRealpathCall() { this = os::path().getMember("realpath").getACall() }
 
     DataFlow::Node getPathArg() {
       result.asCfgNode() in [node.getArg(0), node.getArgByName("path")]
@@ -211,10 +101,8 @@ private module Stdlib {
    * A call to `os.system`.
    * See https://docs.python.org/3/library/os.html#os.system
    */
-  private class OsSystemCall extends SystemCommandExecution::Range, DataFlow::CfgNode {
-    override CallNode node;
-
-    OsSystemCall() { node.getFunction() = os_attr("system").asCfgNode() }
+  private class OsSystemCall extends SystemCommandExecution::Range, DataFlow::CallCfgNode {
+    OsSystemCall() { this = os().getMember("system").getACall() }
 
     override DataFlow::Node getCommand() { result.asCfgNode() = node.getArg(0) }
   }
@@ -227,13 +115,12 @@ private module Stdlib {
    * Although deprecated since version 2.6, they still work in 2.7.
    * See https://docs.python.org/2.7/library/os.html#os.popen2
    */
-  private class OsPopenCall extends SystemCommandExecution::Range, DataFlow::CfgNode {
-    override CallNode node;
+  private class OsPopenCall extends SystemCommandExecution::Range, DataFlow::CallCfgNode {
     string name;
 
     OsPopenCall() {
       name in ["popen", "popen2", "popen3", "popen4"] and
-      node.getFunction() = os_attr(name).asCfgNode()
+      this = os().getMember(name).getACall()
     }
 
     override DataFlow::Node getCommand() {
@@ -248,13 +135,11 @@ private module Stdlib {
    * A call to any of the `os.exec*` functions
    * See https://docs.python.org/3.8/library/os.html#os.execl
    */
-  private class OsExecCall extends SystemCommandExecution::Range, DataFlow::CfgNode {
-    override CallNode node;
-
+  private class OsExecCall extends SystemCommandExecution::Range, DataFlow::CallCfgNode {
     OsExecCall() {
       exists(string name |
         name in ["execl", "execle", "execlp", "execlpe", "execv", "execve", "execvp", "execvpe"] and
-        node.getFunction() = os_attr(name).asCfgNode()
+        this = os().getMember(name).getACall()
       )
     }
 
@@ -265,15 +150,13 @@ private module Stdlib {
    * A call to any of the `os.spawn*` functions
    * See https://docs.python.org/3.8/library/os.html#os.spawnl
    */
-  private class OsSpawnCall extends SystemCommandExecution::Range, DataFlow::CfgNode {
-    override CallNode node;
-
+  private class OsSpawnCall extends SystemCommandExecution::Range, DataFlow::CallCfgNode {
     OsSpawnCall() {
       exists(string name |
         name in [
             "spawnl", "spawnle", "spawnlp", "spawnlpe", "spawnv", "spawnve", "spawnvp", "spawnvpe"
           ] and
-        node.getFunction() = os_attr(name).asCfgNode()
+        this = os().getMember(name).getACall()
       )
     }
 
@@ -284,10 +167,8 @@ private module Stdlib {
    * A call to any of the `os.posix_spawn*` functions
    * See https://docs.python.org/3.8/library/os.html#os.posix_spawn
    */
-  private class OsPosixSpawnCall extends SystemCommandExecution::Range, DataFlow::CfgNode {
-    override CallNode node;
-
-    OsPosixSpawnCall() { node.getFunction() = os_attr(["posix_spawn", "posix_spawnp"]).asCfgNode() }
+  private class OsPosixSpawnCall extends SystemCommandExecution::Range, DataFlow::CallCfgNode {
+    OsPosixSpawnCall() { this = os().getMember(["posix_spawn", "posix_spawnp"]).getACall() }
 
     override DataFlow::Node getCommand() { result.asCfgNode() = node.getArg(0) }
   }
@@ -297,7 +178,7 @@ private module Stdlib {
     override predicate step(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
       exists(CallNode call |
         nodeTo.asCfgNode() = call and
-        call.getFunction() = os::path::join().asCfgNode() and
+        call = os::path::join().getACall().asCfgNode() and
         call.getAnArg() = nodeFrom.asCfgNode()
       )
       // TODO: Handle pathlib (like we do for os.path.join)
@@ -308,70 +189,17 @@ private module Stdlib {
   // subprocess
   // ---------------------------------------------------------------------------
   /** Gets a reference to the `subprocess` module. */
-  private DataFlow::Node subprocess(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("subprocess")
-    or
-    exists(DataFlow::TypeTracker t2 | result = subprocess(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `subprocess` module. */
-  DataFlow::Node subprocess() { result = subprocess(DataFlow::TypeTracker::end()) }
-
-  /**
-   * Gets a reference to the attribute `attr_name` of the `subprocess` module.
-   * WARNING: Only holds for a few predefined attributes.
-   *
-   * For example, using `attr_name = "Popen"` will get all uses of `subprocess.Popen`.
-   */
-  private DataFlow::Node subprocess_attr(DataFlow::TypeTracker t, string attr_name) {
-    attr_name in ["Popen", "call", "check_call", "check_output", "run"] and
-    (
-      t.start() and
-      result = DataFlow::importNode("subprocess." + attr_name)
-      or
-      t.startInAttr(attr_name) and
-      result = subprocess()
-    )
-    or
-    // Due to bad performance when using normal setup with `subprocess_attr(t2, attr_name).track(t2, t)`
-    // we have inlined that code and forced a join
-    exists(DataFlow::TypeTracker t2 |
-      exists(DataFlow::StepSummary summary |
-        subprocess_attr_first_join(t2, attr_name, result, summary) and
-        t = t2.append(summary)
-      )
-    )
-  }
-
-  pragma[nomagic]
-  private predicate subprocess_attr_first_join(
-    DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res, DataFlow::StepSummary summary
-  ) {
-    DataFlow::StepSummary::step(subprocess_attr(t2, attr_name), res, summary)
-  }
-
-  /**
-   * Gets a reference to the attribute `attr_name` of the `subprocess` module.
-   * WARNING: Only holds for a few predefined attributes.
-   *
-   * For example, using `attr_name = "Popen"` will get all uses of `subprocess.Popen`.
-   */
-  private DataFlow::Node subprocess_attr(string attr_name) {
-    result = subprocess_attr(DataFlow::TypeTracker::end(), attr_name)
-  }
+  API::Node subprocess() { result = API::moduleImport("subprocess") }
 
   /**
    * A call to `subprocess.Popen` or helper functions (call, check_call, check_output, run)
    * See https://docs.python.org/3.8/library/subprocess.html#subprocess.Popen
    */
-  private class SubprocessPopenCall extends SystemCommandExecution::Range, DataFlow::CfgNode {
-    override CallNode node;
-
+  private class SubprocessPopenCall extends SystemCommandExecution::Range, DataFlow::CallCfgNode {
     SubprocessPopenCall() {
       exists(string name |
         name in ["Popen", "call", "check_call", "check_output", "run"] and
-        node.getFunction() = subprocess_attr(name).asCfgNode()
+        this = subprocess().getMember(name).getACall()
       )
     }
 
@@ -442,46 +270,16 @@ private module Stdlib {
   // ---------------------------------------------------------------------------
   // marshal
   // ---------------------------------------------------------------------------
-  /** Gets a reference to the `marshal` module. */
-  private DataFlow::Node marshal(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("marshal")
-    or
-    exists(DataFlow::TypeTracker t2 | result = marshal(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `marshal` module. */
-  DataFlow::Node marshal() { result = marshal(DataFlow::TypeTracker::end()) }
-
-  /** Provides models for the `marshal` module. */
-  module marshal {
-    /** Gets a reference to the `marshal.loads` function. */
-    private DataFlow::Node loads(DataFlow::TypeTracker t) {
-      t.start() and
-      result = DataFlow::importNode("marshal.loads")
-      or
-      t.startInAttr("loads") and
-      result = marshal()
-      or
-      exists(DataFlow::TypeTracker t2 | result = loads(t2).track(t2, t))
-    }
-
-    /** Gets a reference to the `marshal.loads` function. */
-    DataFlow::Node loads() { result = loads(DataFlow::TypeTracker::end()) }
-  }
-
   /**
    * A call to `marshal.loads`
    * See https://docs.python.org/3/library/marshal.html#marshal.loads
    */
-  private class MarshalLoadsCall extends Decoding::Range, DataFlow::CfgNode {
-    override CallNode node;
-
-    MarshalLoadsCall() { node.getFunction() = marshal::loads().asCfgNode() }
+  private class MarshalLoadsCall extends Decoding::Range, DataFlow::CallCfgNode {
+    MarshalLoadsCall() { this = API::moduleImport("marshal").getMember("loads").getACall() }
 
     override predicate mayExecuteInput() { any() }
 
-    override DataFlow::Node getAnInput() { result.asCfgNode() = node.getArg(0) }
+    override DataFlow::Node getAnInput() { result = this.getArg(0) }
 
     override DataFlow::Node getOutput() { result = this }
 
@@ -491,48 +289,27 @@ private module Stdlib {
   // ---------------------------------------------------------------------------
   // pickle
   // ---------------------------------------------------------------------------
-  private string pickleModuleName() { result in ["pickle", "cPickle", "_pickle"] }
-
   /** Gets a reference to the `pickle` module. */
-  private DataFlow::Node pickle(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode(pickleModuleName())
-    or
-    exists(DataFlow::TypeTracker t2 | result = pickle(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `pickle` module. */
-  DataFlow::Node pickle() { result = pickle(DataFlow::TypeTracker::end()) }
+  DataFlow::Node pickle() { result = API::moduleImport(["pickle", "cPickle", "_pickle"]).getAUse() }
 
   /** Provides models for the `pickle` module. */
   module pickle {
     /** Gets a reference to the `pickle.loads` function. */
-    private DataFlow::Node loads(DataFlow::TypeTracker t) {
-      t.start() and
-      result = DataFlow::importNode(pickleModuleName() + ".loads")
-      or
-      t.startInAttr("loads") and
-      result = pickle()
-      or
-      exists(DataFlow::TypeTracker t2 | result = loads(t2).track(t2, t))
+    DataFlow::Node loads() {
+      result = API::moduleImport(["pickle", "cPickle", "_pickle"]).getMember("loads").getAUse()
     }
-
-    /** Gets a reference to the `pickle.loads` function. */
-    DataFlow::Node loads() { result = loads(DataFlow::TypeTracker::end()) }
   }
 
   /**
    * A call to `pickle.loads`
    * See https://docs.python.org/3/library/pickle.html#pickle.loads
    */
-  private class PickleLoadsCall extends Decoding::Range, DataFlow::CfgNode {
-    override CallNode node;
-
-    PickleLoadsCall() { node.getFunction() = pickle::loads().asCfgNode() }
+  private class PickleLoadsCall extends Decoding::Range, DataFlow::CallCfgNode {
+    PickleLoadsCall() { this.getFunction() = pickle::loads() }
 
     override predicate mayExecuteInput() { any() }
 
-    override DataFlow::Node getAnInput() { result.asCfgNode() = node.getArg(0) }
+    override DataFlow::Node getAnInput() { result = this.getArg(0) }
 
     override DataFlow::Node getOutput() { result = this }
 
@@ -543,70 +320,17 @@ private module Stdlib {
   // popen2
   // ---------------------------------------------------------------------------
   /** Gets a reference to the `popen2` module (only available in Python 2). */
-  private DataFlow::Node popen2(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("popen2")
-    or
-    exists(DataFlow::TypeTracker t2 | result = popen2(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `popen2` module (only available in Python 2). */
-  DataFlow::Node popen2() { result = popen2(DataFlow::TypeTracker::end()) }
-
-  /**
-   * Gets a reference to the attribute `attr_name` of the `popen2` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private DataFlow::Node popen2_attr(DataFlow::TypeTracker t, string attr_name) {
-    attr_name in [
-        "popen2", "popen3", "popen4",
-        // classes
-        "Popen3", "Popen4"
-      ] and
-    (
-      t.start() and
-      result = DataFlow::importNode("popen2." + attr_name)
-      or
-      t.startInAttr(attr_name) and
-      result = DataFlow::importNode("popen2")
-    )
-    or
-    // Due to bad performance when using normal setup with `popen2_attr(t2, attr_name).track(t2, t)`
-    // we have inlined that code and forced a join
-    exists(DataFlow::TypeTracker t2 |
-      exists(DataFlow::StepSummary summary |
-        popen2_attr_first_join(t2, attr_name, result, summary) and
-        t = t2.append(summary)
-      )
-    )
-  }
-
-  pragma[nomagic]
-  private predicate popen2_attr_first_join(
-    DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res, DataFlow::StepSummary summary
-  ) {
-    DataFlow::StepSummary::step(popen2_attr(t2, attr_name), res, summary)
-  }
-
-  /**
-   * Gets a reference to the attribute `attr_name` of the `popen2` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private DataFlow::Node popen2_attr(string attr_name) {
-    result = popen2_attr(DataFlow::TypeTracker::end(), attr_name)
-  }
+  API::Node popen2() { result = API::moduleImport("popen2") }
 
   /**
    * A call to any of the `popen.popen*` functions, or instantiation of a `popen.Popen*` class.
    * See https://docs.python.org/2.7/library/popen2.html
    */
-  private class Popen2PopenCall extends SystemCommandExecution::Range, DataFlow::CfgNode {
-    override CallNode node;
-
+  private class Popen2PopenCall extends SystemCommandExecution::Range, DataFlow::CallCfgNode {
     Popen2PopenCall() {
       exists(string name |
         name in ["popen2", "popen3", "popen4", "Popen3", "Popen4"] and
-        node.getFunction() = popen2_attr(name).asCfgNode()
+        this = popen2().getMember(name).getACall()
       )
     }
 
@@ -619,63 +343,14 @@ private module Stdlib {
   // platform
   // ---------------------------------------------------------------------------
   /** Gets a reference to the `platform` module. */
-  private DataFlow::Node platform(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("platform")
-    or
-    exists(DataFlow::TypeTracker t2 | result = platform(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `platform` module. */
-  DataFlow::Node platform() { result = platform(DataFlow::TypeTracker::end()) }
-
-  /**
-   * Gets a reference to the attribute `attr_name` of the `platform` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private DataFlow::Node platform_attr(DataFlow::TypeTracker t, string attr_name) {
-    attr_name in ["popen"] and
-    (
-      t.start() and
-      result = DataFlow::importNode("platform." + attr_name)
-      or
-      t.startInAttr(attr_name) and
-      result = DataFlow::importNode("platform")
-    )
-    or
-    // Due to bad performance when using normal setup with `platform_attr(t2, attr_name).track(t2, t)`
-    // we have inlined that code and forced a join
-    exists(DataFlow::TypeTracker t2 |
-      exists(DataFlow::StepSummary summary |
-        platform_attr_first_join(t2, attr_name, result, summary) and
-        t = t2.append(summary)
-      )
-    )
-  }
-
-  pragma[nomagic]
-  private predicate platform_attr_first_join(
-    DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res, DataFlow::StepSummary summary
-  ) {
-    DataFlow::StepSummary::step(platform_attr(t2, attr_name), res, summary)
-  }
-
-  /**
-   * Gets a reference to the attribute `attr_name` of the `platform` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private DataFlow::Node platform_attr(string attr_name) {
-    result = platform_attr(DataFlow::TypeTracker::end(), attr_name)
-  }
+  API::Node platform() { result = API::moduleImport("platform") }
 
   /**
    * A call to the `platform.popen` function.
    * See https://docs.python.org/2.7/library/platform.html#platform.popen
    */
-  private class PlatformPopenCall extends SystemCommandExecution::Range, DataFlow::CfgNode {
-    override CallNode node;
-
-    PlatformPopenCall() { node.getFunction() = platform_attr("popen").asCfgNode() }
+  private class PlatformPopenCall extends SystemCommandExecution::Range, DataFlow::CallCfgNode {
+    PlatformPopenCall() { this = platform().getMember("popen").getACall() }
 
     override DataFlow::Node getCommand() {
       result.asCfgNode() in [node.getArg(0), node.getArgByName("cmd")]
@@ -753,72 +428,18 @@ private module Stdlib {
   // base64
   // ---------------------------------------------------------------------------
   /** Gets a reference to the `base64` module. */
-  private DataFlow::Node base64(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("base64")
-    or
-    exists(DataFlow::TypeTracker t2 | result = base64(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `base64` module. */
-  DataFlow::Node base64() { result = base64(DataFlow::TypeTracker::end()) }
-
-  /**
-   * Gets a reference to the attribute `attr_name` of the `base64` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private DataFlow::Node base64_attr(DataFlow::TypeTracker t, string attr_name) {
-    attr_name in [
-        "b64encode", "b64decode", "standard_b64encode", "standard_b64decode", "urlsafe_b64encode",
-        "urlsafe_b64decode", "b32encode", "b32decode", "b16encode", "b16decode", "encodestring",
-        "decodestring", "a85encode", "a85decode", "b85encode", "b85decode", "encodebytes",
-        "decodebytes"
-      ] and
-    (
-      t.start() and
-      result = DataFlow::importNode("base64" + "." + attr_name)
-      or
-      t.startInAttr(attr_name) and
-      result = base64()
-    )
-    or
-    // Due to bad performance when using normal setup with `base64_attr(t2, attr_name).track(t2, t)`
-    // we have inlined that code and forced a join
-    exists(DataFlow::TypeTracker t2 |
-      exists(DataFlow::StepSummary summary |
-        base64_attr_first_join(t2, attr_name, result, summary) and
-        t = t2.append(summary)
-      )
-    )
-  }
-
-  pragma[nomagic]
-  private predicate base64_attr_first_join(
-    DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res, DataFlow::StepSummary summary
-  ) {
-    DataFlow::StepSummary::step(base64_attr(t2, attr_name), res, summary)
-  }
-
-  /**
-   * Gets a reference to the attribute `attr_name` of the `base64` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private DataFlow::Node base64_attr(string attr_name) {
-    result = base64_attr(DataFlow::TypeTracker::end(), attr_name)
-  }
+  API::Node base64() { result = API::moduleImport("base64") }
 
   /** A call to any of the encode functions in the `base64` module. */
-  private class Base64EncodeCall extends Encoding::Range, DataFlow::CfgNode {
-    override CallNode node;
+  private class Base64EncodeCall extends Encoding::Range, DataFlow::CallCfgNode {
+    string name;
 
     Base64EncodeCall() {
-      exists(string name |
-        name in [
-            "b64encode", "standard_b64encode", "urlsafe_b64encode", "b32encode", "b16encode",
-            "encodestring", "a85encode", "b85encode", "encodebytes"
-          ] and
-        node.getFunction() = base64_attr(name).asCfgNode()
-      )
+      name in [
+          "b64encode", "standard_b64encode", "urlsafe_b64encode", "b32encode", "b16encode",
+          "encodestring", "a85encode", "b85encode", "encodebytes"
+        ] and
+      this = base64().getMember(name).getACall()
     }
 
     override DataFlow::Node getAnInput() { result.asCfgNode() = node.getArg(0) }
@@ -826,35 +447,31 @@ private module Stdlib {
     override DataFlow::Node getOutput() { result = this }
 
     override string getFormat() {
-      exists(string name | node.getFunction() = base64_attr(name).asCfgNode() |
-        name in [
-            "b64encode", "standard_b64encode", "urlsafe_b64encode", "encodestring", "encodebytes"
-          ] and
-        result = "Base64"
-        or
-        name = "b32encode" and result = "Base32"
-        or
-        name = "b16encode" and result = "Base16"
-        or
-        name = "a85encode" and result = "Ascii85"
-        or
-        name = "b85encode" and result = "Base85"
-      )
+      name in [
+          "b64encode", "standard_b64encode", "urlsafe_b64encode", "encodestring", "encodebytes"
+        ] and
+      result = "Base64"
+      or
+      name = "b32encode" and result = "Base32"
+      or
+      name = "b16encode" and result = "Base16"
+      or
+      name = "a85encode" and result = "Ascii85"
+      or
+      name = "b85encode" and result = "Base85"
     }
   }
 
   /** A call to any of the decode functions in the `base64` module. */
-  private class Base64DecodeCall extends Decoding::Range, DataFlow::CfgNode {
-    override CallNode node;
+  private class Base64DecodeCall extends Decoding::Range, DataFlow::CallCfgNode {
+    string name;
 
     Base64DecodeCall() {
-      exists(string name |
-        name in [
-            "b64decode", "standard_b64decode", "urlsafe_b64decode", "b32decode", "b16decode",
-            "decodestring", "a85decode", "b85decode", "decodebytes"
-          ] and
-        node.getFunction() = base64_attr(name).asCfgNode()
-      )
+      name in [
+          "b64decode", "standard_b64decode", "urlsafe_b64decode", "b32decode", "b16decode",
+          "decodestring", "a85decode", "b85decode", "decodebytes"
+        ] and
+      this = base64().getMember(name).getACall()
     }
 
     override predicate mayExecuteInput() { none() }
@@ -864,20 +481,18 @@ private module Stdlib {
     override DataFlow::Node getOutput() { result = this }
 
     override string getFormat() {
-      exists(string name | node.getFunction() = base64_attr(name).asCfgNode() |
-        name in [
-            "b64decode", "standard_b64decode", "urlsafe_b64decode", "decodestring", "decodebytes"
-          ] and
-        result = "Base64"
-        or
-        name = "b32decode" and result = "Base32"
-        or
-        name = "b16decode" and result = "Base16"
-        or
-        name = "a85decode" and result = "Ascii85"
-        or
-        name = "b85decode" and result = "Base85"
-      )
+      name in [
+          "b64decode", "standard_b64decode", "urlsafe_b64decode", "decodestring", "decodebytes"
+        ] and
+      result = "Base64"
+      or
+      name = "b32decode" and result = "Base32"
+      or
+      name = "b16decode" and result = "Base16"
+      or
+      name = "a85decode" and result = "Ascii85"
+      or
+      name = "b85decode" and result = "Base85"
     }
   }
 
@@ -885,63 +500,14 @@ private module Stdlib {
   // json
   // ---------------------------------------------------------------------------
   /** Gets a reference to the `json` module. */
-  private DataFlow::Node json(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("json")
-    or
-    exists(DataFlow::TypeTracker t2 | result = json(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `json` module. */
-  DataFlow::Node json() { result = json(DataFlow::TypeTracker::end()) }
-
-  /**
-   * Gets a reference to the attribute `attr_name` of the `json` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private DataFlow::Node json_attr(DataFlow::TypeTracker t, string attr_name) {
-    attr_name in ["loads", "dumps"] and
-    (
-      t.start() and
-      result = DataFlow::importNode("json" + "." + attr_name)
-      or
-      t.startInAttr(attr_name) and
-      result = json()
-    )
-    or
-    // Due to bad performance when using normal setup with `json_attr(t2, attr_name).track(t2, t)`
-    // we have inlined that code and forced a join
-    exists(DataFlow::TypeTracker t2 |
-      exists(DataFlow::StepSummary summary |
-        json_attr_first_join(t2, attr_name, result, summary) and
-        t = t2.append(summary)
-      )
-    )
-  }
-
-  pragma[nomagic]
-  private predicate json_attr_first_join(
-    DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res, DataFlow::StepSummary summary
-  ) {
-    DataFlow::StepSummary::step(json_attr(t2, attr_name), res, summary)
-  }
-
-  /**
-   * Gets a reference to the attribute `attr_name` of the `json` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private DataFlow::Node json_attr(string attr_name) {
-    result = json_attr(DataFlow::TypeTracker::end(), attr_name)
-  }
+  API::Node json() { result = API::moduleImport("json") }
 
   /**
    * A call to `json.loads`
    * See https://docs.python.org/3/library/json.html#json.loads
    */
-  private class JsonLoadsCall extends Decoding::Range, DataFlow::CfgNode {
-    override CallNode node;
-
-    JsonLoadsCall() { node.getFunction() = json_attr("loads").asCfgNode() }
+  private class JsonLoadsCall extends Decoding::Range, DataFlow::CallCfgNode {
+    JsonLoadsCall() { this = json().getMember("loads").getACall() }
 
     override predicate mayExecuteInput() { none() }
 
@@ -956,10 +522,8 @@ private module Stdlib {
    * A call to `json.dumps`
    * See https://docs.python.org/3/library/json.html#json.dumps
    */
-  private class JsonDumpsCall extends Encoding::Range, DataFlow::CfgNode {
-    override CallNode node;
-
-    JsonDumpsCall() { node.getFunction() = json_attr("dumps").asCfgNode() }
+  private class JsonDumpsCall extends Encoding::Range, DataFlow::CallCfgNode {
+    JsonDumpsCall() { this = json().getMember("dumps").getACall() }
 
     override DataFlow::Node getAnInput() { result.asCfgNode() = node.getArg(0) }
 
@@ -972,15 +536,7 @@ private module Stdlib {
   // cgi
   // ---------------------------------------------------------------------------
   /** Gets a reference to the `cgi` module. */
-  private DataFlow::Node cgi(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("cgi")
-    or
-    exists(DataFlow::TypeTracker t2 | result = cgi(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `cgi` module. */
-  DataFlow::Node cgi() { result = cgi(DataFlow::TypeTracker::end()) }
+  API::Node cgi() { result = API::moduleImport("cgi") }
 
   /** Provides models for the `cgi` module. */
   module cgi {
@@ -991,15 +547,7 @@ private module Stdlib {
      */
     module FieldStorage {
       /** Gets a reference to the `cgi.FieldStorage` class. */
-      private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-        t.startInAttr("FieldStorage") and
-        result = cgi()
-        or
-        exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
-      }
-
-      /** Gets a reference to the `cgi.FieldStorage` class. */
-      DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
+      API::Node classRef() { result = cgi().getMember("FieldStorage") }
 
       /**
        * A source of instances of `cgi.FieldStorage`, extend this class to model new instances.
@@ -1020,145 +568,86 @@ private module Stdlib {
        * if it turns out to be a problem, we'll have to refine.
        */
       private class ClassInstantiation extends InstanceSource, RemoteFlowSource::Range,
-        DataFlow::CfgNode {
-        override CallNode node;
-
-        ClassInstantiation() { node.getFunction() = classRef().asCfgNode() }
+        DataFlow::CallCfgNode {
+        ClassInstantiation() { this = classRef().getACall() }
 
         override string getSourceType() { result = "cgi.FieldStorage" }
       }
 
       /** Gets a reference to an instance of `cgi.FieldStorage`. */
-      private DataFlow::Node instance(DataFlow::TypeTracker t) {
-        t.start() and
-        result instanceof InstanceSource
-        or
-        exists(DataFlow::TypeTracker t2 | result = instance(t2).track(t2, t))
-      }
-
-      /** Gets a reference to an instance of `cgi.FieldStorage`. */
-      DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+      API::Node instance() { result = classRef().getReturn() }
 
       /** Gets a reference to the `getvalue` method on a `cgi.FieldStorage` instance. */
-      private DataFlow::Node getvalueRef(DataFlow::TypeTracker t) {
-        t.startInAttr("getvalue") and
-        result = instance()
-        or
-        exists(DataFlow::TypeTracker t2 | result = getvalueRef(t2).track(t2, t))
-      }
-
-      /** Gets a reference to the `getvalue` method on a `cgi.FieldStorage` instance. */
-      DataFlow::Node getvalueRef() { result = getvalueRef(DataFlow::TypeTracker::end()) }
+      API::Node getvalueRef() { result = instance().getMember("getvalue") }
 
       /** Gets a reference to the result of calling the `getvalue` method on a `cgi.FieldStorage` instance. */
-      private DataFlow::Node getvalueResult(DataFlow::TypeTracker t) {
-        t.start() and
-        result.asCfgNode().(CallNode).getFunction() = getvalueRef().asCfgNode()
-        or
-        exists(DataFlow::TypeTracker t2 | result = getvalueResult(t2).track(t2, t))
-      }
-
-      /** Gets a reference to the result of calling the `getvalue` method on a `cgi.FieldStorage` instance. */
-      DataFlow::Node getvalueResult() { result = getvalueResult(DataFlow::TypeTracker::end()) }
+      API::Node getvalueResult() { result = getvalueRef().getReturn() }
 
       /** Gets a reference to the `getfirst` method on a `cgi.FieldStorage` instance. */
-      private DataFlow::Node getfirstRef(DataFlow::TypeTracker t) {
-        t.startInAttr("getfirst") and
-        result = instance()
-        or
-        exists(DataFlow::TypeTracker t2 | result = getfirstRef(t2).track(t2, t))
-      }
-
-      /** Gets a reference to the `getfirst` method on a `cgi.FieldStorage` instance. */
-      DataFlow::Node getfirstRef() { result = getfirstRef(DataFlow::TypeTracker::end()) }
+      API::Node getfirstRef() { result = instance().getMember("getfirst") }
 
       /** Gets a reference to the result of calling the `getfirst` method on a `cgi.FieldStorage` instance. */
-      private DataFlow::Node getfirstResult(DataFlow::TypeTracker t) {
-        t.start() and
-        result.asCfgNode().(CallNode).getFunction() = getfirstRef().asCfgNode()
-        or
-        exists(DataFlow::TypeTracker t2 | result = getfirstResult(t2).track(t2, t))
-      }
-
-      /** Gets a reference to the result of calling the `getfirst` method on a `cgi.FieldStorage` instance. */
-      DataFlow::Node getfirstResult() { result = getfirstResult(DataFlow::TypeTracker::end()) }
+      API::Node getfirstResult() { result = getfirstRef().getReturn() }
 
       /** Gets a reference to the `getlist` method on a `cgi.FieldStorage` instance. */
-      private DataFlow::Node getlistRef(DataFlow::TypeTracker t) {
-        t.startInAttr("getlist") and
-        result = instance()
-        or
-        exists(DataFlow::TypeTracker t2 | result = getlistRef(t2).track(t2, t))
-      }
-
-      /** Gets a reference to the `getlist` method on a `cgi.FieldStorage` instance. */
-      DataFlow::Node getlistRef() { result = getlistRef(DataFlow::TypeTracker::end()) }
+      API::Node getlistRef() { result = instance().getMember("getlist") }
 
       /** Gets a reference to the result of calling the `getlist` method on a `cgi.FieldStorage` instance. */
-      private DataFlow::Node getlistResult(DataFlow::TypeTracker t) {
-        t.start() and
-        result.asCfgNode().(CallNode).getFunction() = getlistRef().asCfgNode()
-        or
-        exists(DataFlow::TypeTracker t2 | result = getlistResult(t2).track(t2, t))
-      }
-
-      /** Gets a reference to the result of calling the `getlist` method on a `cgi.FieldStorage` instance. */
-      DataFlow::Node getlistResult() { result = getlistResult(DataFlow::TypeTracker::end()) }
+      API::Node getlistResult() { result = getlistRef().getReturn() }
 
       /** Gets a reference to a list of fields. */
-      private DataFlow::Node fieldList(DataFlow::TypeTracker t) {
+      private DataFlow::LocalSourceNode fieldList(DataFlow::TypeTracker t) {
         t.start() and
-        (
-          result = getlistResult()
-          or
-          result = getvalueResult()
-          or
-          // TODO: Should have better handling of subscripting
-          result.asCfgNode().(SubscriptNode).getObject() = instance().asCfgNode()
-        )
+        // TODO: Should have better handling of subscripting
+        result.asCfgNode().(SubscriptNode).getObject() = instance().getAUse().asCfgNode()
         or
         exists(DataFlow::TypeTracker t2 | result = fieldList(t2).track(t2, t))
       }
 
       /** Gets a reference to a list of fields. */
-      DataFlow::Node fieldList() { result = fieldList(DataFlow::TypeTracker::end()) }
+      DataFlow::Node fieldList() {
+        result = getlistResult().getAUse() or
+        result = getvalueResult().getAUse() or
+        fieldList(DataFlow::TypeTracker::end()).flowsTo(result)
+      }
 
       /** Gets a reference to a field. */
-      private DataFlow::Node field(DataFlow::TypeTracker t) {
+      private DataFlow::LocalSourceNode field(DataFlow::TypeTracker t) {
         t.start() and
-        (
-          result = getfirstResult()
-          or
-          result = getvalueResult()
-          or
-          // TODO: Should have better handling of subscripting
-          result.asCfgNode().(SubscriptNode).getObject() = [instance(), fieldList()].asCfgNode()
-        )
+        // TODO: Should have better handling of subscripting
+        result.asCfgNode().(SubscriptNode).getObject() =
+          [instance().getAUse(), fieldList()].asCfgNode()
         or
         exists(DataFlow::TypeTracker t2 | result = field(t2).track(t2, t))
       }
 
       /** Gets a reference to a field. */
-      DataFlow::Node field() { result = field(DataFlow::TypeTracker::end()) }
+      DataFlow::Node field() {
+        result = getfirstResult().getAUse()
+        or
+        result = getvalueResult().getAUse()
+        or
+        field(DataFlow::TypeTracker::end()).flowsTo(result)
+      }
 
       private class AdditionalTaintStep extends TaintTracking::AdditionalTaintStep {
         override predicate step(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
           // Methods
           nodeFrom = nodeTo.(DataFlow::AttrRead).getObject() and
-          nodeFrom = instance() and
-          nodeTo in [getvalueRef(), getfirstRef(), getlistRef()]
+          nodeFrom = instance().getAUse() and
+          nodeTo = [getvalueRef(), getfirstRef(), getlistRef()].getAUse()
           or
           nodeFrom.asCfgNode() = nodeTo.asCfgNode().(CallNode).getFunction() and
           (
-            nodeFrom = getvalueRef() and nodeTo = getvalueResult()
+            nodeFrom = getvalueRef().getAUse() and nodeTo = getvalueResult().getAnImmediateUse()
             or
-            nodeFrom = getfirstRef() and nodeTo = getfirstResult()
+            nodeFrom = getfirstRef().getAUse() and nodeTo = getfirstResult().getAnImmediateUse()
             or
-            nodeFrom = getlistRef() and nodeTo = getlistResult()
+            nodeFrom = getlistRef().getAUse() and nodeTo = getlistResult().getAnImmediateUse()
           )
           or
           // Indexing
-          nodeFrom in [instance(), fieldList()] and
+          nodeFrom in [instance().getAUse(), fieldList()] and
           nodeTo.asCfgNode().(SubscriptNode).getObject() = nodeFrom.asCfgNode()
           or
           // Attributes on Field
@@ -1175,15 +664,7 @@ private module Stdlib {
   // BaseHTTPServer (Python 2 only)
   // ---------------------------------------------------------------------------
   /** Gets a reference to the `BaseHTTPServer` module. */
-  private DataFlow::Node baseHTTPServer(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("BaseHTTPServer")
-    or
-    exists(DataFlow::TypeTracker t2 | result = baseHTTPServer(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `BaseHTTPServer` module. */
-  DataFlow::Node baseHTTPServer() { result = baseHTTPServer(DataFlow::TypeTracker::end()) }
+  API::Node baseHTTPServer() { result = API::moduleImport("BaseHTTPServer") }
 
   /** Provides models for the `BaseHTTPServer` module. */
   module BaseHTTPServer {
@@ -1192,18 +673,7 @@ private module Stdlib {
      */
     module BaseHTTPRequestHandler {
       /** Gets a reference to the `BaseHTTPServer.BaseHTTPRequestHandler` class. */
-      private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-        t.start() and
-        result = DataFlow::importNode("BaseHTTPServer" + "." + "BaseHTTPRequestHandler")
-        or
-        t.startInAttr("BaseHTTPRequestHandler") and
-        result = baseHTTPServer()
-        or
-        exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
-      }
-
-      /** Gets a reference to the `BaseHTTPServer.BaseHTTPRequestHandler` class. */
-      DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
+      API::Node classRef() { result = baseHTTPServer().getMember("BaseHTTPRequestHandler") }
     }
   }
 
@@ -1211,15 +681,7 @@ private module Stdlib {
   // SimpleHTTPServer (Python 2 only)
   // ---------------------------------------------------------------------------
   /** Gets a reference to the `SimpleHTTPServer` module. */
-  private DataFlow::Node simpleHTTPServer(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("SimpleHTTPServer")
-    or
-    exists(DataFlow::TypeTracker t2 | result = simpleHTTPServer(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `SimpleHTTPServer` module. */
-  DataFlow::Node simpleHTTPServer() { result = simpleHTTPServer(DataFlow::TypeTracker::end()) }
+  API::Node simpleHTTPServer() { result = API::moduleImport("SimpleHTTPServer") }
 
   /** Provides models for the `SimpleHTTPServer` module. */
   module SimpleHTTPServer {
@@ -1228,18 +690,7 @@ private module Stdlib {
      */
     module SimpleHTTPRequestHandler {
       /** Gets a reference to the `SimpleHTTPServer.SimpleHTTPRequestHandler` class. */
-      private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-        t.start() and
-        result = DataFlow::importNode("SimpleHTTPServer" + "." + "SimpleHTTPRequestHandler")
-        or
-        t.startInAttr("SimpleHTTPRequestHandler") and
-        result = simpleHTTPServer()
-        or
-        exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
-      }
-
-      /** Gets a reference to the `SimpleHTTPServer.SimpleHTTPRequestHandler` class. */
-      DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
+      API::Node classRef() { result = simpleHTTPServer().getMember("SimpleHTTPRequestHandler") }
     }
   }
 
@@ -1247,15 +698,7 @@ private module Stdlib {
   // CGIHTTPServer (Python 2 only)
   // ---------------------------------------------------------------------------
   /** Gets a reference to the `CGIHTTPServer` module. */
-  private DataFlow::Node cgiHTTPServer(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("CGIHTTPServer")
-    or
-    exists(DataFlow::TypeTracker t2 | result = cgiHTTPServer(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `CGIHTTPServer` module. */
-  DataFlow::Node cgiHTTPServer() { result = cgiHTTPServer(DataFlow::TypeTracker::end()) }
+  API::Node cgiHTTPServer() { result = API::moduleImport("CGIHTTPServer") }
 
   /** Provides models for the `CGIHTTPServer` module. */
   module CGIHTTPServer {
@@ -1264,18 +707,7 @@ private module Stdlib {
      */
     module CGIHTTPRequestHandler {
       /** Gets a reference to the `CGIHTTPServer.CGIHTTPRequestHandler` class. */
-      private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-        t.start() and
-        result = DataFlow::importNode("CGIHTTPServer" + "." + "CGIHTTPRequestHandler")
-        or
-        t.startInAttr("CGIHTTPRequestHandler") and
-        result = cgiHTTPServer()
-        or
-        exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
-      }
-
-      /** Gets a reference to the `CGIHTTPServer.CGIHTTPRequestHandler` class. */
-      DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
+      API::Node classRef() { result = cgiHTTPServer().getMember("CGIHTTPRequestHandler") }
     }
   }
 
@@ -1283,54 +715,7 @@ private module Stdlib {
   // http (Python 3 only)
   // ---------------------------------------------------------------------------
   /** Gets a reference to the `http` module. */
-  private DataFlow::Node http(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("http")
-    or
-    exists(DataFlow::TypeTracker t2 | result = http(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `http` module. */
-  DataFlow::Node http() { result = http(DataFlow::TypeTracker::end()) }
-
-  /**
-   * Gets a reference to the attribute `attr_name` of the `http` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private DataFlow::Node http_attr(DataFlow::TypeTracker t, string attr_name) {
-    attr_name in ["server"] and
-    (
-      t.start() and
-      result = DataFlow::importNode("http" + "." + attr_name)
-      or
-      t.startInAttr(attr_name) and
-      result = http()
-    )
-    or
-    // Due to bad performance when using normal setup with `http_attr(t2, attr_name).track(t2, t)`
-    // we have inlined that code and forced a join
-    exists(DataFlow::TypeTracker t2 |
-      exists(DataFlow::StepSummary summary |
-        http_attr_first_join(t2, attr_name, result, summary) and
-        t = t2.append(summary)
-      )
-    )
-  }
-
-  pragma[nomagic]
-  private predicate http_attr_first_join(
-    DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res, DataFlow::StepSummary summary
-  ) {
-    DataFlow::StepSummary::step(http_attr(t2, attr_name), res, summary)
-  }
-
-  /**
-   * Gets a reference to the attribute `attr_name` of the `http` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private DataFlow::Node http_attr(string attr_name) {
-    result = http_attr(DataFlow::TypeTracker::end(), attr_name)
-  }
+  API::Node http() { result = API::moduleImport("http") }
 
   /** Provides models for the `http` module. */
   module http {
@@ -1338,50 +723,10 @@ private module Stdlib {
     // http.server
     // -------------------------------------------------------------------------
     /** Gets a reference to the `http.server` module. */
-    DataFlow::Node server() { result = http_attr("server") }
+    API::Node server() { result = http().getMember("server") }
 
     /** Provides models for the `http.server` module */
     module server {
-      /**
-       * Gets a reference to the attribute `attr_name` of the `http.server` module.
-       * WARNING: Only holds for a few predefined attributes.
-       */
-      private DataFlow::Node server_attr(DataFlow::TypeTracker t, string attr_name) {
-        attr_name in ["BaseHTTPRequestHandler", "SimpleHTTPRequestHandler", "CGIHTTPRequestHandler"] and
-        (
-          t.start() and
-          result = DataFlow::importNode("http.server" + "." + attr_name)
-          or
-          t.startInAttr(attr_name) and
-          result = server()
-        )
-        or
-        // Due to bad performance when using normal setup with `server_attr(t2, attr_name).track(t2, t)`
-        // we have inlined that code and forced a join
-        exists(DataFlow::TypeTracker t2 |
-          exists(DataFlow::StepSummary summary |
-            server_attr_first_join(t2, attr_name, result, summary) and
-            t = t2.append(summary)
-          )
-        )
-      }
-
-      pragma[nomagic]
-      private predicate server_attr_first_join(
-        DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,
-        DataFlow::StepSummary summary
-      ) {
-        DataFlow::StepSummary::step(server_attr(t2, attr_name), res, summary)
-      }
-
-      /**
-       * Gets a reference to the attribute `attr_name` of the `http.server` module.
-       * WARNING: Only holds for a few predefined attributes.
-       */
-      private DataFlow::Node server_attr(string attr_name) {
-        result = server_attr(DataFlow::TypeTracker::end(), attr_name)
-      }
-
       /**
        * Provides models for the `http.server.BaseHTTPRequestHandler` class (Python 3 only).
        *
@@ -1389,7 +734,7 @@ private module Stdlib {
        */
       module BaseHTTPRequestHandler {
         /** Gets a reference to the `http.server.BaseHTTPRequestHandler` class. */
-        DataFlow::Node classRef() { result = server_attr("BaseHTTPRequestHandler") }
+        API::Node classRef() { result = server().getMember("BaseHTTPRequestHandler") }
       }
 
       /**
@@ -1399,7 +744,7 @@ private module Stdlib {
        */
       module SimpleHTTPRequestHandler {
         /** Gets a reference to the `http.server.SimpleHTTPRequestHandler` class. */
-        DataFlow::Node classRef() { result = server_attr("SimpleHTTPRequestHandler") }
+        API::Node classRef() { result = server().getMember("SimpleHTTPRequestHandler") }
       }
 
       /**
@@ -1409,7 +754,7 @@ private module Stdlib {
        */
       module CGIHTTPRequestHandler {
         /** Gets a reference to the `http.server.CGIHTTPRequestHandler` class. */
-        DataFlow::Node classRef() { result = server_attr("CGIHTTPRequestHandler") }
+        API::Node classRef() { result = server().getMember("CGIHTTPRequestHandler") }
       }
     }
   }
@@ -1423,35 +768,23 @@ private module Stdlib {
    */
   private module HTTPRequestHandler {
     /** Gets a reference to the `BaseHTTPRequestHandler` class or any subclass. */
-    private DataFlow::Node subclassRef(DataFlow::TypeTracker t) {
-      // Python 2
-      t.start() and
-      result in [
+    API::Node subclassRef() {
+      result =
+        [
+          // Python 2
           BaseHTTPServer::BaseHTTPRequestHandler::classRef(),
           SimpleHTTPServer::SimpleHTTPRequestHandler::classRef(),
-          CGIHTTPServer::CGIHTTPRequestHandler::classRef()
-        ]
-      or
-      // Python 3
-      t.start() and
-      result in [
+          CGIHTTPServer::CGIHTTPRequestHandler::classRef(),
+          // Python 3
           http::server::BaseHTTPRequestHandler::classRef(),
           http::server::SimpleHTTPRequestHandler::classRef(),
           http::server::CGIHTTPRequestHandler::classRef()
-        ]
-      or
-      // subclasses in project code
-      result.asExpr().(ClassExpr).getABase() = subclassRef(t.continue()).asExpr()
-      or
-      exists(DataFlow::TypeTracker t2 | result = subclassRef(t2).track(t2, t))
+        ].getASubclass*()
     }
 
-    /** Gets a reference to the `BaseHTTPRequestHandler` class or any subclass. */
-    DataFlow::Node subclassRef() { result = subclassRef(DataFlow::TypeTracker::end()) }
-
     /** A HTTPRequestHandler class definition (most likely in project code). */
     class HTTPRequestHandlerClassDef extends Class {
-      HTTPRequestHandlerClassDef() { this.getParent() = subclassRef().asExpr() }
+      HTTPRequestHandlerClassDef() { this.getParent() = subclassRef().getAUse().asExpr() }
     }
 
     /**
@@ -1475,7 +808,7 @@ private module Stdlib {
     }
 
     /** Gets a reference to an instance of the `BaseHTTPRequestHandler` class or any subclass. */
-    private DataFlow::Node instance(DataFlow::TypeTracker t) {
+    private DataFlow::LocalSourceNode instance(DataFlow::TypeTracker t) {
       t.start() and
       result instanceof InstanceSource
       or
@@ -1483,7 +816,7 @@ private module Stdlib {
     }
 
     /** Gets a reference to an instance of the `BaseHTTPRequestHandler` class or any subclass. */
-    DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+    DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
 
     private class AdditionalTaintStep extends TaintTracking::AdditionalTaintStep {
       override predicate step(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
@@ -1523,24 +856,13 @@ private module Stdlib {
   // ---------------------------------------------------------------------------
   // sqlite3
   // ---------------------------------------------------------------------------
-  /** Gets a reference to the `sqlite3` module. */
-  private DataFlow::Node sqlite3(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("sqlite3")
-    or
-    exists(DataFlow::TypeTracker t2 | result = sqlite3(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `sqlite3` module. */
-  DataFlow::Node sqlite3() { result = sqlite3(DataFlow::TypeTracker::end()) }
-
   /**
    * sqlite3 implements PEP 249, providing ways to execute SQL statements against a database.
    *
    * See https://devdocs.io/python~3.9/library/sqlite3
    */
-  class Sqlite3 extends PEP249Module {
-    Sqlite3() { this = sqlite3() }
+  class Sqlite3 extends PEP249ModuleApiNode {
+    Sqlite3() { this = API::moduleImport("sqlite3") }
   }
 }
 
diff --git a/python/ql/src/semmle/python/frameworks/Tornado.qll b/python/ql/src/semmle/python/frameworks/Tornado.qll
index a43edcaca90..f82e093cb94 100644
--- a/python/ql/src/semmle/python/frameworks/Tornado.qll
+++ b/python/ql/src/semmle/python/frameworks/Tornado.qll
@@ -8,6 +8,7 @@ private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.dataflow.new.RemoteFlowSources
 private import semmle.python.dataflow.new.TaintTracking
 private import semmle.python.Concepts
+private import semmle.python.ApiGraphs
 private import semmle.python.regex
 
 /**
@@ -19,54 +20,7 @@ private module Tornado {
   // tornado
   // ---------------------------------------------------------------------------
   /** Gets a reference to the `tornado` module. */
-  private DataFlow::Node tornado(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("tornado")
-    or
-    exists(DataFlow::TypeTracker t2 | result = tornado(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `tornado` module. */
-  DataFlow::Node tornado() { result = tornado(DataFlow::TypeTracker::end()) }
-
-  /**
-   * Gets a reference to the attribute `attr_name` of the `tornado` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private DataFlow::Node tornado_attr(DataFlow::TypeTracker t, string attr_name) {
-    attr_name in ["web", "httputil"] and
-    (
-      t.start() and
-      result = DataFlow::importNode("tornado" + "." + attr_name)
-      or
-      t.startInAttr(attr_name) and
-      result = tornado()
-    )
-    or
-    // Due to bad performance when using normal setup with `tornado_attr(t2, attr_name).track(t2, t)`
-    // we have inlined that code and forced a join
-    exists(DataFlow::TypeTracker t2 |
-      exists(DataFlow::StepSummary summary |
-        tornado_attr_first_join(t2, attr_name, result, summary) and
-        t = t2.append(summary)
-      )
-    )
-  }
-
-  pragma[nomagic]
-  private predicate tornado_attr_first_join(
-    DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res, DataFlow::StepSummary summary
-  ) {
-    DataFlow::StepSummary::step(tornado_attr(t2, attr_name), res, summary)
-  }
-
-  /**
-   * Gets a reference to the attribute `attr_name` of the `tornado` module.
-   * WARNING: Only holds for a few predefined attributes.
-   */
-  private DataFlow::Node tornado_attr(string attr_name) {
-    result = tornado_attr(DataFlow::TypeTracker::end(), attr_name)
-  }
+  API::Node tornado() { result = API::moduleImport("tornado") }
 
   /** Provides models for the `tornado` module. */
   module tornado {
@@ -74,50 +28,10 @@ private module Tornado {
     // tornado.web
     // -------------------------------------------------------------------------
     /** Gets a reference to the `tornado.web` module. */
-    DataFlow::Node web() { result = tornado_attr("web") }
+    API::Node web() { result = tornado().getMember("web") }
 
     /** Provides models for the `tornado.web` module */
     module web {
-      /**
-       * Gets a reference to the attribute `attr_name` of the `tornado.web` module.
-       * WARNING: Only holds for a few predefined attributes.
-       */
-      private DataFlow::Node web_attr(DataFlow::TypeTracker t, string attr_name) {
-        attr_name in ["RequestHandler", "Application"] and
-        (
-          t.start() and
-          result = DataFlow::importNode("tornado.web" + "." + attr_name)
-          or
-          t.startInAttr(attr_name) and
-          result = web()
-        )
-        or
-        // Due to bad performance when using normal setup with `web_attr(t2, attr_name).track(t2, t)`
-        // we have inlined that code and forced a join
-        exists(DataFlow::TypeTracker t2 |
-          exists(DataFlow::StepSummary summary |
-            web_attr_first_join(t2, attr_name, result, summary) and
-            t = t2.append(summary)
-          )
-        )
-      }
-
-      pragma[nomagic]
-      private predicate web_attr_first_join(
-        DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,
-        DataFlow::StepSummary summary
-      ) {
-        DataFlow::StepSummary::step(web_attr(t2, attr_name), res, summary)
-      }
-
-      /**
-       * Gets a reference to the attribute `attr_name` of the `tornado.web` module.
-       * WARNING: Only holds for a few predefined attributes.
-       */
-      private DataFlow::Node web_attr(string attr_name) {
-        result = web_attr(DataFlow::TypeTracker::end(), attr_name)
-      }
-
       /**
        * Provides models for the `tornado.web.RequestHandler` class and subclasses.
        *
@@ -125,22 +39,11 @@ private module Tornado {
        */
       module RequestHandler {
         /** Gets a reference to the `tornado.web.RequestHandler` class or any subclass. */
-        private DataFlow::Node subclassRef(DataFlow::TypeTracker t) {
-          t.start() and
-          result = web_attr("RequestHandler")
-          or
-          // subclasses in project code
-          result.asExpr().(ClassExpr).getABase() = subclassRef(t.continue()).asExpr()
-          or
-          exists(DataFlow::TypeTracker t2 | result = subclassRef(t2).track(t2, t))
-        }
-
-        /** Gets a reference to the `tornado.web.RequestHandler` class or any subclass. */
-        DataFlow::Node subclassRef() { result = subclassRef(DataFlow::TypeTracker::end()) }
+        API::Node subclassRef() { result = web().getMember("RequestHandler").getASubclass*() }
 
         /** A RequestHandler class (most likely in project code). */
         class RequestHandlerClass extends Class {
-          RequestHandlerClass() { this.getParent() = subclassRef().asExpr() }
+          RequestHandlerClass() { this.getParent() = subclassRef().getAUse().asExpr() }
 
           /** Gets a function that could handle incoming requests, if any. */
           Function getARequestHandler() {
@@ -151,7 +54,7 @@ private module Tornado {
           }
 
           /** Gets a reference to this class. */
-          private DataFlow::Node getARef(DataFlow::TypeTracker t) {
+          private DataFlow::LocalSourceNode getARef(DataFlow::TypeTracker t) {
             t.start() and
             result.asExpr().(ClassExpr) = this.getParent()
             or
@@ -159,7 +62,7 @@ private module Tornado {
           }
 
           /** Gets a reference to this class. */
-          DataFlow::Node getARef() { result = this.getARef(DataFlow::TypeTracker::end()) }
+          DataFlow::Node getARef() { this.getARef(DataFlow::TypeTracker::end()).flowsTo(result) }
         }
 
         /**
@@ -171,7 +74,7 @@ private module Tornado {
          *
          * Use the predicate `RequestHandler::instance()` to get references to instances of the `tornado.web.RequestHandler` class or any subclass.
          */
-        abstract class InstanceSource extends DataFlow::Node { }
+        abstract class InstanceSource extends DataFlow::LocalSourceNode { }
 
         /** The `self` parameter in a method on the `tornado.web.RequestHandler` class or any subclass. */
         private class SelfParam extends InstanceSource, RemoteFlowSource::Range,
@@ -184,7 +87,7 @@ private module Tornado {
         }
 
         /** Gets a reference to an instance of the `tornado.web.RequestHandler` class or any subclass. */
-        private DataFlow::Node instance(DataFlow::TypeTracker t) {
+        private DataFlow::LocalSourceNode instance(DataFlow::TypeTracker t) {
           t.start() and
           result instanceof InstanceSource
           or
@@ -192,10 +95,10 @@ private module Tornado {
         }
 
         /** Gets a reference to an instance of the `tornado.web.RequestHandler` class or any subclass. */
-        DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+        DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
 
         /** Gets a reference to one of the methods `get_argument`, `get_body_argument`, `get_query_argument`. */
-        private DataFlow::Node argumentMethod(DataFlow::TypeTracker t) {
+        private DataFlow::LocalSourceNode argumentMethod(DataFlow::TypeTracker t) {
           t.startInAttr(["get_argument", "get_body_argument", "get_query_argument"]) and
           result = instance()
           or
@@ -203,10 +106,12 @@ private module Tornado {
         }
 
         /** Gets a reference to one of the methods `get_argument`, `get_body_argument`, `get_query_argument`. */
-        DataFlow::Node argumentMethod() { result = argumentMethod(DataFlow::TypeTracker::end()) }
+        DataFlow::Node argumentMethod() {
+          argumentMethod(DataFlow::TypeTracker::end()).flowsTo(result)
+        }
 
         /** Gets a reference to one of the methods `get_arguments`, `get_body_arguments`, `get_query_arguments`. */
-        private DataFlow::Node argumentsMethod(DataFlow::TypeTracker t) {
+        private DataFlow::LocalSourceNode argumentsMethod(DataFlow::TypeTracker t) {
           t.startInAttr(["get_arguments", "get_body_arguments", "get_query_arguments"]) and
           result = instance()
           or
@@ -214,10 +119,12 @@ private module Tornado {
         }
 
         /** Gets a reference to one of the methods `get_arguments`, `get_body_arguments`, `get_query_arguments`. */
-        DataFlow::Node argumentsMethod() { result = argumentsMethod(DataFlow::TypeTracker::end()) }
+        DataFlow::Node argumentsMethod() {
+          argumentsMethod(DataFlow::TypeTracker::end()).flowsTo(result)
+        }
 
         /** Gets a reference the `redirect` method. */
-        private DataFlow::Node redirectMethod(DataFlow::TypeTracker t) {
+        private DataFlow::LocalSourceNode redirectMethod(DataFlow::TypeTracker t) {
           t.startInAttr("redirect") and
           result = instance()
           or
@@ -225,10 +132,12 @@ private module Tornado {
         }
 
         /** Gets a reference the `redirect` method. */
-        DataFlow::Node redirectMethod() { result = redirectMethod(DataFlow::TypeTracker::end()) }
+        DataFlow::Node redirectMethod() {
+          redirectMethod(DataFlow::TypeTracker::end()).flowsTo(result)
+        }
 
         /** Gets a reference to the `write` method. */
-        private DataFlow::Node writeMethod(DataFlow::TypeTracker t) {
+        private DataFlow::LocalSourceNode writeMethod(DataFlow::TypeTracker t) {
           t.startInAttr("write") and
           result = instance()
           or
@@ -236,7 +145,7 @@ private module Tornado {
         }
 
         /** Gets a reference to the `write` method. */
-        DataFlow::Node writeMethod() { result = writeMethod(DataFlow::TypeTracker::end()) }
+        DataFlow::Node writeMethod() { writeMethod(DataFlow::TypeTracker::end()).flowsTo(result) }
 
         private class AdditionalTaintStep extends TaintTracking::AdditionalTaintStep {
           override predicate step(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
@@ -279,15 +188,7 @@ private module Tornado {
        */
       module Application {
         /** Gets a reference to the `tornado.web.Application` class. */
-        private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-          t.start() and
-          result = web_attr("Application")
-          or
-          exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
-        }
-
-        /** Gets a reference to the `tornado.web.Application` class. */
-        DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
+        API::Node classRef() { result = web().getMember("Application") }
 
         /**
          * A source of instances of `tornado.web.Application`, extend this class to model new instances.
@@ -298,17 +199,15 @@ private module Tornado {
          *
          * Use the predicate `Application::instance()` to get references to instances of `tornado.web.Application`.
          */
-        abstract class InstanceSource extends DataFlow::Node { }
+        abstract class InstanceSource extends DataFlow::LocalSourceNode { }
 
         /** A direct instantiation of `tornado.web.Application`. */
-        class ClassInstantiation extends InstanceSource, DataFlow::CfgNode {
-          override CallNode node;
-
-          ClassInstantiation() { node.getFunction() = classRef().asCfgNode() }
+        class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {
+          ClassInstantiation() { this = classRef().getACall() }
         }
 
         /** Gets a reference to an instance of `tornado.web.Application`. */
-        private DataFlow::Node instance(DataFlow::TypeTracker t) {
+        private DataFlow::LocalSourceNode instance(DataFlow::TypeTracker t) {
           t.start() and
           result instanceof InstanceSource
           or
@@ -316,10 +215,10 @@ private module Tornado {
         }
 
         /** Gets a reference to an instance of `tornado.web.Application`. */
-        DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+        DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
 
         /** Gets a reference to the `add_handlers` method. */
-        private DataFlow::Node add_handlers(DataFlow::TypeTracker t) {
+        private DataFlow::LocalSourceNode add_handlers(DataFlow::TypeTracker t) {
           t.startInAttr("add_handlers") and
           result = instance()
           or
@@ -327,7 +226,7 @@ private module Tornado {
         }
 
         /** Gets a reference to the `add_handlers` method. */
-        DataFlow::Node add_handlers() { result = add_handlers(DataFlow::TypeTracker::end()) }
+        DataFlow::Node add_handlers() { add_handlers(DataFlow::TypeTracker::end()).flowsTo(result) }
       }
     }
 
@@ -335,50 +234,10 @@ private module Tornado {
     // tornado.httputil
     // -------------------------------------------------------------------------
     /** Gets a reference to the `tornado.httputil` module. */
-    DataFlow::Node httputil() { result = tornado_attr("httputil") }
+    API::Node httputil() { result = tornado().getMember("httputil") }
 
     /** Provides models for the `tornado.httputil` module */
     module httputil {
-      /**
-       * Gets a reference to the attribute `attr_name` of the `tornado.httputil` module.
-       * WARNING: Only holds for a few predefined attributes.
-       */
-      private DataFlow::Node httputil_attr(DataFlow::TypeTracker t, string attr_name) {
-        attr_name in ["HTTPServerRequest"] and
-        (
-          t.start() and
-          result = DataFlow::importNode("tornado.httputil" + "." + attr_name)
-          or
-          t.startInAttr(attr_name) and
-          result = httputil()
-        )
-        or
-        // Due to bad performance when using normal setup with `httputil_attr(t2, attr_name).track(t2, t)`
-        // we have inlined that code and forced a join
-        exists(DataFlow::TypeTracker t2 |
-          exists(DataFlow::StepSummary summary |
-            httputil_attr_first_join(t2, attr_name, result, summary) and
-            t = t2.append(summary)
-          )
-        )
-      }
-
-      pragma[nomagic]
-      private predicate httputil_attr_first_join(
-        DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,
-        DataFlow::StepSummary summary
-      ) {
-        DataFlow::StepSummary::step(httputil_attr(t2, attr_name), res, summary)
-      }
-
-      /**
-       * Gets a reference to the attribute `attr_name` of the `tornado.httputil` module.
-       * WARNING: Only holds for a few predefined attributes.
-       */
-      private DataFlow::Node httputil_attr(string attr_name) {
-        result = httputil_attr(DataFlow::TypeTracker::end(), attr_name)
-      }
-
       /**
        * Provides models for the `tornado.httputil.HttpServerRequest` class
        *
@@ -386,15 +245,7 @@ private module Tornado {
        */
       module HttpServerRequest {
         /** Gets a reference to the `tornado.httputil.HttpServerRequest` class. */
-        private DataFlow::Node classRef(DataFlow::TypeTracker t) {
-          t.start() and
-          result = httputil_attr("HttpServerRequest")
-          or
-          exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
-        }
-
-        /** Gets a reference to the `tornado.httputil.HttpServerRequest` class. */
-        DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
+        API::Node classRef() { result = httputil().getMember("HttpServerRequest") }
 
         /**
          * A source of instances of `tornado.httputil.HttpServerRequest`, extend this class to model new instances.
@@ -405,17 +256,15 @@ private module Tornado {
          *
          * Use the predicate `HttpServerRequest::instance()` to get references to instances of `tornado.httputil.HttpServerRequest`.
          */
-        abstract class InstanceSource extends DataFlow::Node { }
+        abstract class InstanceSource extends DataFlow::LocalSourceNode { }
 
         /** A direct instantiation of `tornado.httputil.HttpServerRequest`. */
-        private class ClassInstantiation extends InstanceSource, DataFlow::CfgNode {
-          override CallNode node;
-
-          ClassInstantiation() { node.getFunction() = classRef().asCfgNode() }
+        private class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {
+          ClassInstantiation() { this = classRef().getACall() }
         }
 
         /** Gets a reference to an instance of `tornado.httputil.HttpServerRequest`. */
-        private DataFlow::Node instance(DataFlow::TypeTracker t) {
+        private DataFlow::LocalSourceNode instance(DataFlow::TypeTracker t) {
           t.start() and
           result instanceof InstanceSource
           or
@@ -423,10 +272,10 @@ private module Tornado {
         }
 
         /** Gets a reference to an instance of `tornado.httputil.HttpServerRequest`. */
-        DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+        DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
 
         /** Gets a reference to the `full_url` method. */
-        private DataFlow::Node full_url(DataFlow::TypeTracker t) {
+        private DataFlow::LocalSourceNode full_url(DataFlow::TypeTracker t) {
           t.startInAttr("full_url") and
           result = instance()
           or
@@ -434,7 +283,7 @@ private module Tornado {
         }
 
         /** Gets a reference to the `full_url` method. */
-        DataFlow::Node full_url() { result = full_url(DataFlow::TypeTracker::end()) }
+        DataFlow::Node full_url() { full_url(DataFlow::TypeTracker::end()).flowsTo(result) }
 
         private class AdditionalTaintStep extends TaintTracking::AdditionalTaintStep {
           override predicate step(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
@@ -576,11 +425,9 @@ private module Tornado {
    * See https://www.tornadoweb.org/en/stable/web.html?highlight=write#tornado.web.RequestHandler.redirect
    */
   private class TornadoRequestHandlerRedirectCall extends HTTP::Server::HttpRedirectResponse::Range,
-    DataFlow::CfgNode {
-    override CallNode node;
-
+    DataFlow::CallCfgNode {
     TornadoRequestHandlerRedirectCall() {
-      node.getFunction() = tornado::web::RequestHandler::redirectMethod().asCfgNode()
+      this.getFunction() = tornado::web::RequestHandler::redirectMethod()
     }
 
     override DataFlow::Node getRedirectLocation() {
@@ -600,11 +447,9 @@ private module Tornado {
    * See https://www.tornadoweb.org/en/stable/web.html?highlight=write#tornado.web.RequestHandler.write
    */
   private class TornadoRequestHandlerWriteCall extends HTTP::Server::HttpResponse::Range,
-    DataFlow::CfgNode {
-    override CallNode node;
-
+    DataFlow::CallCfgNode {
     TornadoRequestHandlerWriteCall() {
-      node.getFunction() = tornado::web::RequestHandler::writeMethod().asCfgNode()
+      this.getFunction() = tornado::web::RequestHandler::writeMethod()
     }
 
     override DataFlow::Node getBody() {
diff --git a/python/ql/src/semmle/python/frameworks/Werkzeug.qll b/python/ql/src/semmle/python/frameworks/Werkzeug.qll
index 172c9468252..63b8067b266 100644
--- a/python/ql/src/semmle/python/frameworks/Werkzeug.qll
+++ b/python/ql/src/semmle/python/frameworks/Werkzeug.qll
@@ -5,6 +5,7 @@
 private import python
 private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.dataflow.new.TaintTracking
+private import semmle.python.ApiGraphs
 
 /**
  * Provides models for the `Werkzeug` PyPI package.
@@ -23,6 +24,9 @@ module Werkzeug {
        * See https://werkzeug.palletsprojects.com/en/1.0.x/datastructures/#werkzeug.datastructures.MultiDict.
        */
       module MultiDict {
+        /** DEPRECATED. Use `InstanceSourceApiNode` instead. */
+        abstract deprecated class InstanceSource extends DataFlow::Node { }
+
         /**
          * A source of instances of `werkzeug.datastructures.MultiDict`, extend this class to model new instances.
          *
@@ -32,37 +36,16 @@ module Werkzeug {
          *
          * Use the predicate `MultiDict::instance()` to get references to instances of `werkzeug.datastructures.MultiDict`.
          */
-        abstract class InstanceSource extends DataFlow::Node { }
-
-        /** Gets a reference to an instance of `werkzeug.datastructures.MultiDict`. */
-        private DataFlow::Node instance(DataFlow::TypeTracker t) {
-          t.start() and
-          result instanceof InstanceSource
-          or
-          exists(DataFlow::TypeTracker t2 | result = instance(t2).track(t2, t))
-        }
-
-        /** Gets a reference to an instance of `werkzeug.datastructures.MultiDict`. */
-        DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+        abstract class InstanceSourceApiNode extends API::Node { }
 
         /**
          * Gets a reference to the `getlist` method on an instance of `werkzeug.datastructures.MultiDict`.
          *
          * See https://werkzeug.palletsprojects.com/en/1.0.x/datastructures/#werkzeug.datastructures.Headers.getlist
          */
-        private DataFlow::Node getlist(DataFlow::TypeTracker t) {
-          t.startInAttr("getlist") and
-          result = instance()
-          or
-          exists(DataFlow::TypeTracker t2 | result = getlist(t2).track(t2, t))
+        DataFlow::Node getlist() {
+          result = any(InstanceSourceApiNode a).getMember("getlist").getAUse()
         }
-
-        /**
-         * Gets a reference to the `getlist` method on an instance of `werkzeug.datastructures.MultiDict`.
-         *
-         * See https://werkzeug.palletsprojects.com/en/1.0.x/datastructures/#werkzeug.datastructures.Headers.getlist
-         */
-        DataFlow::Node getlist() { result = getlist(DataFlow::TypeTracker::end()) }
       }
 
       /**
@@ -71,6 +54,9 @@ module Werkzeug {
        * See https://werkzeug.palletsprojects.com/en/1.0.x/datastructures/#werkzeug.datastructures.FileStorage.
        */
       module FileStorage {
+        /** DEPRECATED. Use `InstanceSourceApiNode` instead. */
+        abstract deprecated class InstanceSource extends DataFlow::Node { }
+
         /**
          * A source of instances of `werkzeug.datastructures.FileStorage`, extend this class to model new instances.
          *
@@ -80,18 +66,10 @@ module Werkzeug {
          *
          * Use the predicate `FileStorage::instance()` to get references to instances of `werkzeug.datastructures.FileStorage`.
          */
-        abstract class InstanceSource extends DataFlow::Node { }
+        abstract class InstanceSourceApiNode extends API::Node { }
 
         /** Gets a reference to an instance of `werkzeug.datastructures.FileStorage`. */
-        private DataFlow::Node instance(DataFlow::TypeTracker t) {
-          t.start() and
-          result instanceof InstanceSource
-          or
-          exists(DataFlow::TypeTracker t2 | result = instance(t2).track(t2, t))
-        }
-
-        /** Gets a reference to an instance of `werkzeug.datastructures.FileStorage`. */
-        DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+        DataFlow::Node instance() { result = any(InstanceSourceApiNode a).getAUse() }
       }
     }
   }
diff --git a/python/ql/src/semmle/python/frameworks/Yaml.qll b/python/ql/src/semmle/python/frameworks/Yaml.qll
index 7e9d7f100e9..f7ac0a9fda7 100644
--- a/python/ql/src/semmle/python/frameworks/Yaml.qll
+++ b/python/ql/src/semmle/python/frameworks/Yaml.qll
@@ -1,119 +1,72 @@
 /**
- * Provides classes modeling security-relevant aspects of the PyYAML package
- * https://pyyaml.org/wiki/PyYAMLDocumentation (obtained via `import yaml`).
+ * Provides classes modeling security-relevant aspects of the PyYAML package (obtained
+ * via `import yaml`)
+ *
+ * See
+ * - https://pyyaml.org/wiki/PyYAMLDocumentation
+ * - https://pyyaml.docsforge.com/master/documentation/
  */
 
 private import python
 private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.dataflow.new.RemoteFlowSources
 private import semmle.python.Concepts
-
-private module Yaml {
-  /** Gets a reference to the `yaml` module. */
-  private DataFlow::Node yaml(DataFlow::TypeTracker t) {
-    t.start() and
-    result = DataFlow::importNode("yaml")
-    or
-    exists(DataFlow::TypeTracker t2 | result = yaml(t2).track(t2, t))
-  }
-
-  /** Gets a reference to the `yaml` module. */
-  DataFlow::Node yaml() { result = yaml(DataFlow::TypeTracker::end()) }
-
-  /** Provides models for the `yaml` module. */
-  module yaml {
-    /**
-     * Gets a reference to the attribute `attr_name` of the `yaml` module.
-     * WARNING: Only holds for a few predefined attributes.
-     *
-     * For example, using `attr_name = "load"` will get all uses of `yaml.load`.
-     */
-    private DataFlow::Node yaml_attr(DataFlow::TypeTracker t, string attr_name) {
-      attr_name in [
-          // functions
-          "load", "load_all", "full_load", "full_load_all", "unsafe_load", "unsafe_load_all",
-          "safe_load", "safe_load_all",
-          // Classes
-          "SafeLoader", "BaseLoader"
-        ] and
-      (
-        t.start() and
-        result = DataFlow::importNode("yaml." + attr_name)
-        or
-        t.startInAttr(attr_name) and
-        result = yaml()
-      )
-      or
-      // Due to bad performance when using normal setup with `yaml_attr(t2, attr_name).track(t2, t)`
-      // we have inlined that code and forced a join
-      exists(DataFlow::TypeTracker t2 |
-        exists(DataFlow::StepSummary summary |
-          yaml_attr_first_join(t2, attr_name, result, summary) and
-          t = t2.append(summary)
-        )
-      )
-    }
-
-    pragma[nomagic]
-    private predicate yaml_attr_first_join(
-      DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res, DataFlow::StepSummary summary
-    ) {
-      DataFlow::StepSummary::step(yaml_attr(t2, attr_name), res, summary)
-    }
-
-    /**
-     * Gets a reference to the attribute `attr_name` of the `yaml` module.
-     * WARNING: Only holds for a few predefined attributes.
-     *
-     * For example, using `attr_name = "load"` will get all uses of `yaml.load`.
-     */
-    DataFlow::Node yaml_attr(string attr_name) {
-      result = yaml_attr(DataFlow::TypeTracker::end(), attr_name)
-    }
-  }
-}
+private import semmle.python.ApiGraphs
 
 /**
- * A call to any of the loading functions in `yaml` (`load`, `load_all`, `full_load`,
- * `full_load_all`, `unsafe_load`, `unsafe_load_all`, `safe_load`, `safe_load_all`)
+ * Provides classes modeling security-relevant aspects of the PyYAML package (obtained
+ * via `import yaml`)
  *
- * See https://pyyaml.org/wiki/PyYAMLDocumentation (you will have to scroll down).
+ * See
+ * - https://pyyaml.org/wiki/PyYAMLDocumentation
+ * - https://pyyaml.docsforge.com/master/documentation/
  */
-private class YamlLoadCall extends Decoding::Range, DataFlow::CfgNode {
-  override CallNode node;
-  string func_name;
-
-  YamlLoadCall() {
-    func_name in [
-        "load", "load_all", "full_load", "full_load_all", "unsafe_load", "unsafe_load_all",
-        "safe_load", "safe_load_all"
-      ] and
-    node.getFunction() = Yaml::yaml::yaml_attr(func_name).asCfgNode()
-  }
-
+private module Yaml {
   /**
-   * This function was thought safe from the 5.1 release in 2017, when the default loader was changed to `FullLoader`.
-   * In 2020 new exploits were found, meaning it's not safe. The Current plan is to change the default to `SafeLoader` in release 6.0
-   * (as explained in https://github.com/yaml/pyyaml/issues/420#issuecomment-696752389).
-   * Until 6.0 is released, we will mark `yaml.load` as possibly leading to arbitrary code execution.
-   * See https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation for more details.
+   * A call to any of the loading functions in `yaml` (`load`, `load_all`, `full_load`,
+   * `full_load_all`, `unsafe_load`, `unsafe_load_all`, `safe_load`, `safe_load_all`)
+   *
+   * See https://pyyaml.org/wiki/PyYAMLDocumentation (you will have to scroll down).
    */
-  override predicate mayExecuteInput() {
-    func_name in ["full_load", "full_load_all", "unsafe_load", "unsafe_load_all"]
-    or
-    func_name in ["load", "load_all"] and
-    // If the `Loader` is not set to either `SafeLoader` or `BaseLoader` or not set at all,
-    // then the default loader will be used, which is not safe.
-    not exists(DataFlow::Node loader_arg |
-      loader_arg.asCfgNode() in [node.getArg(1), node.getArgByName("Loader")]
-    |
-      loader_arg = Yaml::yaml::yaml_attr(["SafeLoader", "BaseLoader"])
-    )
+  private class YamlLoadCall extends Decoding::Range, DataFlow::CallCfgNode {
+    override CallNode node;
+    string func_name;
+
+    YamlLoadCall() {
+      func_name in [
+          "load", "load_all", "full_load", "full_load_all", "unsafe_load", "unsafe_load_all",
+          "safe_load", "safe_load_all"
+        ] and
+      this = API::moduleImport("yaml").getMember(func_name).getACall()
+    }
+
+    /**
+     * This function was thought safe from the 5.1 release in 2017, when the default loader was changed to `FullLoader`.
+     * In 2020 new exploits were found, meaning it's not safe. The Current plan is to change the default to `SafeLoader` in release 6.0
+     * (as explained in https://github.com/yaml/pyyaml/issues/420#issuecomment-696752389).
+     * Until 6.0 is released, we will mark `yaml.load` as possibly leading to arbitrary code execution.
+     * See https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation for more details.
+     */
+    override predicate mayExecuteInput() {
+      func_name in ["full_load", "full_load_all", "unsafe_load", "unsafe_load_all"]
+      or
+      func_name in ["load", "load_all"] and
+      // If the `Loader` is not set to either `SafeLoader` or `BaseLoader` or not set at all,
+      // then the default loader will be used, which is not safe.
+      not exists(DataFlow::Node loader_arg |
+        loader_arg in [this.getArg(1), this.getArgByName("Loader")]
+      |
+        loader_arg =
+          API::moduleImport("yaml")
+              .getMember(["SafeLoader", "BaseLoader", "CSafeLoader", "CBaseLoader"])
+              .getAUse()
+      )
+    }
+
+    override DataFlow::Node getAnInput() { result = this.getArg(0) }
+
+    override DataFlow::Node getOutput() { result = this }
+
+    override string getFormat() { result = "YAML" }
   }
-
-  override DataFlow::Node getAnInput() { result.asCfgNode() = node.getArg(0) }
-
-  override DataFlow::Node getOutput() { result = this }
-
-  override string getFormat() { result = "YAML" }
 }
diff --git a/python/ql/src/semmle/python/objects/Classes.qll b/python/ql/src/semmle/python/objects/Classes.qll
index 2f092dd4483..249fb331466 100644
--- a/python/ql/src/semmle/python/objects/Classes.qll
+++ b/python/ql/src/semmle/python/objects/Classes.qll
@@ -61,8 +61,8 @@ abstract class ClassObjectInternal extends ObjectInternal {
   pragma[noinline]
   override predicate binds(ObjectInternal instance, string name, ObjectInternal descriptor) {
     instance = this and
-    PointsToInternal::attributeRequired(this, name) and
-    this.lookup(name, descriptor, _) and
+    PointsToInternal::attributeRequired(this, pragma[only_bind_into](name)) and
+    this.lookup(pragma[only_bind_into](name), descriptor, _) and
     descriptor.isDescriptor() = true
   }
 
diff --git a/python/ql/src/semmle/python/objects/Constants.qll b/python/ql/src/semmle/python/objects/Constants.qll
index d2ba2f44655..941f631b9b3 100644
--- a/python/ql/src/semmle/python/objects/Constants.qll
+++ b/python/ql/src/semmle/python/objects/Constants.qll
@@ -34,9 +34,11 @@ abstract class ConstantObjectInternal extends ObjectInternal {
 
   pragma[noinline]
   override predicate attribute(string name, ObjectInternal value, CfgOrigin origin) {
-    PointsToInternal::attributeRequired(this, name) and
+    PointsToInternal::attributeRequired(pragma[only_bind_into](this), pragma[only_bind_into](name)) and
     exists(ObjectInternal cls_attr, CfgOrigin attr_orig |
-      this.getClass().(ClassObjectInternal).lookup(name, cls_attr, attr_orig) and
+      this.getClass()
+          .(ClassObjectInternal)
+          .lookup(pragma[only_bind_into](name), cls_attr, attr_orig) and
       cls_attr.isDescriptor() = true and
       cls_attr.descriptorGetInstance(this, value, origin)
     )
diff --git a/python/ql/src/semmle/python/objects/Instances.qll b/python/ql/src/semmle/python/objects/Instances.qll
index bbde0b1a5f5..9569fa1a25d 100644
--- a/python/ql/src/semmle/python/objects/Instances.qll
+++ b/python/ql/src/semmle/python/objects/Instances.qll
@@ -30,18 +30,19 @@ abstract class InstanceObject extends ObjectInternal {
 
   pragma[noinline]
   private predicate classAttribute(string name, ObjectInternal cls_attr) {
-    PointsToInternal::attributeRequired(this, name) and
-    this.getClass().(ClassObjectInternal).lookup(name, cls_attr, _)
+    PointsToInternal::attributeRequired(this, pragma[only_bind_into](name)) and
+    this.getClass().(ClassObjectInternal).lookup(pragma[only_bind_into](name), cls_attr, _)
   }
 
   pragma[noinline]
   private predicate selfAttribute(string name, ObjectInternal value, CfgOrigin origin) {
-    PointsToInternal::attributeRequired(this, name) and
+    PointsToInternal::attributeRequired(this, pragma[only_bind_into](name)) and
     exists(EssaVariable self, PythonFunctionObjectInternal init, Context callee |
       this.initializer(init, callee) and
       self_variable_reaching_init_exit(self) and
       self.getScope() = init.getScope() and
-      AttributePointsTo::variableAttributePointsTo(self, callee, name, value, origin)
+      AttributePointsTo::variableAttributePointsTo(self, callee, pragma[only_bind_into](name),
+        value, origin)
     )
   }
 
@@ -316,9 +317,11 @@ class UnknownInstanceInternal extends TUnknownInstance, ObjectInternal {
 
   pragma[noinline]
   override predicate attribute(string name, ObjectInternal value, CfgOrigin origin) {
-    PointsToInternal::attributeRequired(this, name) and
+    PointsToInternal::attributeRequired(this, pragma[only_bind_into](name)) and
     exists(ObjectInternal cls_attr, CfgOrigin attr_orig |
-      this.getClass().(ClassObjectInternal).lookup(name, cls_attr, attr_orig)
+      this.getClass()
+          .(ClassObjectInternal)
+          .lookup(pragma[only_bind_into](name), cls_attr, attr_orig)
     |
       cls_attr.isDescriptor() = false and value = cls_attr and origin = attr_orig
       or
@@ -456,8 +459,8 @@ class SuperInstance extends TSuperInstance, ObjectInternal {
   /* Helper for `attribute` */
   pragma[noinline]
   private predicate attribute_descriptor(string name, ObjectInternal cls_attr, CfgOrigin attr_orig) {
-    PointsToInternal::attributeRequired(this, name) and
-    this.lookup(name, cls_attr, attr_orig)
+    PointsToInternal::attributeRequired(this, pragma[only_bind_into](name)) and
+    this.lookup(pragma[only_bind_into](name), cls_attr, attr_orig)
   }
 
   private predicate lookup(string name, ObjectInternal value, CfgOrigin origin) {
diff --git a/python/ql/src/semmle/python/pointsto/PointsTo.qll b/python/ql/src/semmle/python/pointsto/PointsTo.qll
index 9614b02d2f6..9706c6846f3 100644
--- a/python/ql/src/semmle/python/pointsto/PointsTo.qll
+++ b/python/ql/src/semmle/python/pointsto/PointsTo.qll
@@ -524,6 +524,7 @@ module PointsToInternal {
     )
   }
 
+  pragma[noinline]
   private boolean ssa_filter_definition_bool(
     PyEdgeRefinement def, PointsToContext context, ObjectInternal value, ControlFlowNode origin
   ) {
diff --git a/python/ql/src/semmle/python/pointsto/PointsToContext.qll b/python/ql/src/semmle/python/pointsto/PointsToContext.qll
index 8b4178c796f..15b28d9cdb0 100644
--- a/python/ql/src/semmle/python/pointsto/PointsToContext.qll
+++ b/python/ql/src/semmle/python/pointsto/PointsToContext.qll
@@ -184,7 +184,11 @@ class PointsToContext extends TPointsToContext {
 
   /** Holds if this context can apply to the CFG node `n`. */
   pragma[inline]
-  predicate appliesTo(ControlFlowNode n) { this.appliesToScope(n.getScope()) }
+  predicate appliesTo(ControlFlowNode n) {
+    exists(Scope s |
+      this.appliesToScope(pragma[only_bind_into](s)) and pragma[only_bind_into](s) = n.getScope()
+    )
+  }
 
   /** Holds if this context is a call context. */
   predicate isCall() { this = TCallContext(_, _, _) }
diff --git a/python/ql/test/3/library-tests/modules/entry_point/hash_bang/main.py b/python/ql/test/3/library-tests/modules/entry_point/hash_bang/main.py
new file mode 100755
index 00000000000..ad619e5cbd8
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/hash_bang/main.py
@@ -0,0 +1,7 @@
+#! /usr/bin/python3
+print(__file__)
+import module
+import package
+import namespace_package
+import namespace_package.namespace_package_main
+print(module.message)
diff --git a/python/ql/test/3/library-tests/modules/entry_point/hash_bang/module.py b/python/ql/test/3/library-tests/modules/entry_point/hash_bang/module.py
new file mode 100644
index 00000000000..36206ca60b7
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/hash_bang/module.py
@@ -0,0 +1,2 @@
+print(__file__.split("entry_point")[1])
+message = "Hello world!"
diff --git a/python/ql/test/3/library-tests/modules/entry_point/hash_bang/namespace_package/namespace_package_main.py b/python/ql/test/3/library-tests/modules/entry_point/hash_bang/namespace_package/namespace_package_main.py
new file mode 100644
index 00000000000..5db80f18a27
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/hash_bang/namespace_package/namespace_package_main.py
@@ -0,0 +1,2 @@
+print(__file__.split("entry_point")[1])
+import namespace_package.namespace_package_module
diff --git a/python/ql/test/3/library-tests/modules/entry_point/hash_bang/namespace_package/namespace_package_module.py b/python/ql/test/3/library-tests/modules/entry_point/hash_bang/namespace_package/namespace_package_module.py
new file mode 100644
index 00000000000..567a23d59ce
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/hash_bang/namespace_package/namespace_package_module.py
@@ -0,0 +1 @@
+print(__file__.split("entry_point")[1])
diff --git a/python/ql/test/3/library-tests/modules/entry_point/hash_bang/package/__init__.py b/python/ql/test/3/library-tests/modules/entry_point/hash_bang/package/__init__.py
new file mode 100644
index 00000000000..ca14a9f5804
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/hash_bang/package/__init__.py
@@ -0,0 +1,2 @@
+print(__file__.split("entry_point")[1])
+from . import package_main
diff --git a/python/ql/test/3/library-tests/modules/entry_point/hash_bang/package/package_main.py b/python/ql/test/3/library-tests/modules/entry_point/hash_bang/package/package_main.py
new file mode 100644
index 00000000000..158b12678e3
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/hash_bang/package/package_main.py
@@ -0,0 +1,2 @@
+print(__file__.split("entry_point")[1])
+from . import package_module
diff --git a/python/ql/test/3/library-tests/modules/entry_point/hash_bang/package/package_module.py b/python/ql/test/3/library-tests/modules/entry_point/hash_bang/package/package_module.py
new file mode 100644
index 00000000000..567a23d59ce
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/hash_bang/package/package_module.py
@@ -0,0 +1 @@
+print(__file__.split("entry_point")[1])
diff --git a/python/ql/test/3/library-tests/modules/entry_point/modules.expected b/python/ql/test/3/library-tests/modules/entry_point/modules.expected
new file mode 100644
index 00000000000..cdc743a360d
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/modules.expected
@@ -0,0 +1,14 @@
+| module | hash_bang/module.py:0:0:0:0 | Module module |
+| module | name_main/module.py:0:0:0:0 | Module module |
+| package | hash_bang/package:0:0:0:0 | Package package |
+| package | name_main/package:0:0:0:0 | Package package |
+| package | no_py_extension/package:0:0:0:0 | Package package |
+| package.__init__ | hash_bang/package/__init__.py:0:0:0:0 | Module package.__init__ |
+| package.__init__ | name_main/package/__init__.py:0:0:0:0 | Module package.__init__ |
+| package.__init__ | no_py_extension/package/__init__.py:0:0:0:0 | Module package.__init__ |
+| package.package_main | hash_bang/package/package_main.py:0:0:0:0 | Module package.package_main |
+| package.package_main | name_main/package/package_main.py:0:0:0:0 | Module package.package_main |
+| package.package_main | no_py_extension/package/package_main.py:0:0:0:0 | Module package.package_main |
+| package.package_module | hash_bang/package/package_module.py:0:0:0:0 | Module package.package_module |
+| package.package_module | name_main/package/package_module.py:0:0:0:0 | Module package.package_module |
+| package.package_module | no_py_extension/package/package_module.py:0:0:0:0 | Module package.package_module |
diff --git a/python/ql/test/3/library-tests/modules/entry_point/modules.ql b/python/ql/test/3/library-tests/modules/entry_point/modules.ql
new file mode 100644
index 00000000000..10c390e8616
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/modules.ql
@@ -0,0 +1,4 @@
+import python
+
+from Module m
+select m.getName(), m
diff --git a/python/ql/test/3/library-tests/modules/entry_point/name_main/main.py b/python/ql/test/3/library-tests/modules/entry_point/name_main/main.py
new file mode 100755
index 00000000000..08ec212383b
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/name_main/main.py
@@ -0,0 +1,8 @@
+print(__file__)
+import module
+import package
+import namespace_package
+import namespace_package.namespace_package_main
+
+if __name__ == '__main__':
+   print(module.message)
diff --git a/python/ql/test/3/library-tests/modules/entry_point/name_main/module.py b/python/ql/test/3/library-tests/modules/entry_point/name_main/module.py
new file mode 100644
index 00000000000..36206ca60b7
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/name_main/module.py
@@ -0,0 +1,2 @@
+print(__file__.split("entry_point")[1])
+message = "Hello world!"
diff --git a/python/ql/test/3/library-tests/modules/entry_point/name_main/namespace_package/namespace_package_main.py b/python/ql/test/3/library-tests/modules/entry_point/name_main/namespace_package/namespace_package_main.py
new file mode 100644
index 00000000000..5db80f18a27
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/name_main/namespace_package/namespace_package_main.py
@@ -0,0 +1,2 @@
+print(__file__.split("entry_point")[1])
+import namespace_package.namespace_package_module
diff --git a/python/ql/test/3/library-tests/modules/entry_point/name_main/namespace_package/namespace_package_module.py b/python/ql/test/3/library-tests/modules/entry_point/name_main/namespace_package/namespace_package_module.py
new file mode 100644
index 00000000000..567a23d59ce
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/name_main/namespace_package/namespace_package_module.py
@@ -0,0 +1 @@
+print(__file__.split("entry_point")[1])
diff --git a/python/ql/test/3/library-tests/modules/entry_point/name_main/package/__init__.py b/python/ql/test/3/library-tests/modules/entry_point/name_main/package/__init__.py
new file mode 100644
index 00000000000..ca14a9f5804
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/name_main/package/__init__.py
@@ -0,0 +1,2 @@
+print(__file__.split("entry_point")[1])
+from . import package_main
diff --git a/python/ql/test/3/library-tests/modules/entry_point/name_main/package/package_main.py b/python/ql/test/3/library-tests/modules/entry_point/name_main/package/package_main.py
new file mode 100644
index 00000000000..158b12678e3
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/name_main/package/package_main.py
@@ -0,0 +1,2 @@
+print(__file__.split("entry_point")[1])
+from . import package_module
diff --git a/python/ql/test/3/library-tests/modules/entry_point/name_main/package/package_module.py b/python/ql/test/3/library-tests/modules/entry_point/name_main/package/package_module.py
new file mode 100644
index 00000000000..567a23d59ce
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/name_main/package/package_module.py
@@ -0,0 +1 @@
+print(__file__.split("entry_point")[1])
diff --git a/python/ql/test/3/library-tests/modules/entry_point/no_py_extension/main.secretpy b/python/ql/test/3/library-tests/modules/entry_point/no_py_extension/main.secretpy
new file mode 100755
index 00000000000..e2673d4da78
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/no_py_extension/main.secretpy
@@ -0,0 +1,6 @@
+print(__file__)
+import module
+import package
+import namespace_package
+import namespace_package.namespace_package_main
+print(module.message)
diff --git a/python/ql/test/3/library-tests/modules/entry_point/no_py_extension/module.py b/python/ql/test/3/library-tests/modules/entry_point/no_py_extension/module.py
new file mode 100644
index 00000000000..36206ca60b7
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/no_py_extension/module.py
@@ -0,0 +1,2 @@
+print(__file__.split("entry_point")[1])
+message = "Hello world!"
diff --git a/python/ql/test/3/library-tests/modules/entry_point/no_py_extension/namespace_package/namespace_package_main.py b/python/ql/test/3/library-tests/modules/entry_point/no_py_extension/namespace_package/namespace_package_main.py
new file mode 100644
index 00000000000..5db80f18a27
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/no_py_extension/namespace_package/namespace_package_main.py
@@ -0,0 +1,2 @@
+print(__file__.split("entry_point")[1])
+import namespace_package.namespace_package_module
diff --git a/python/ql/test/3/library-tests/modules/entry_point/no_py_extension/namespace_package/namespace_package_module.py b/python/ql/test/3/library-tests/modules/entry_point/no_py_extension/namespace_package/namespace_package_module.py
new file mode 100644
index 00000000000..567a23d59ce
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/no_py_extension/namespace_package/namespace_package_module.py
@@ -0,0 +1 @@
+print(__file__.split("entry_point")[1])
diff --git a/python/ql/test/3/library-tests/modules/entry_point/no_py_extension/package/__init__.py b/python/ql/test/3/library-tests/modules/entry_point/no_py_extension/package/__init__.py
new file mode 100644
index 00000000000..ca14a9f5804
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/no_py_extension/package/__init__.py
@@ -0,0 +1,2 @@
+print(__file__.split("entry_point")[1])
+from . import package_main
diff --git a/python/ql/test/3/library-tests/modules/entry_point/no_py_extension/package/package_main.py b/python/ql/test/3/library-tests/modules/entry_point/no_py_extension/package/package_main.py
new file mode 100644
index 00000000000..158b12678e3
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/no_py_extension/package/package_main.py
@@ -0,0 +1,2 @@
+print(__file__.split("entry_point")[1])
+from . import package_module
diff --git a/python/ql/test/3/library-tests/modules/entry_point/no_py_extension/package/package_module.py b/python/ql/test/3/library-tests/modules/entry_point/no_py_extension/package/package_module.py
new file mode 100644
index 00000000000..567a23d59ce
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/no_py_extension/package/package_module.py
@@ -0,0 +1 @@
+print(__file__.split("entry_point")[1])
diff --git a/python/ql/test/3/library-tests/modules/entry_point/options b/python/ql/test/3/library-tests/modules/entry_point/options
new file mode 100644
index 00000000000..6beceeb08ed
--- /dev/null
+++ b/python/ql/test/3/library-tests/modules/entry_point/options
@@ -0,0 +1 @@
+semmle-extractor-options: --lang=3 --path bogus -R . --filter=include:**/*.secretpy
diff --git a/python/ql/test/experimental/dataflow/typetracking/moduleattr.ql b/python/ql/test/experimental/dataflow/typetracking/moduleattr.ql
index b546dc7491d..0a0d5df105f 100644
--- a/python/ql/test/experimental/dataflow/typetracking/moduleattr.ql
+++ b/python/ql/test/experimental/dataflow/typetracking/moduleattr.ql
@@ -2,7 +2,7 @@ import python
 import semmle.python.dataflow.new.DataFlow
 import semmle.python.dataflow.new.TypeTracker
 
-DataFlow::LocalSourceNode module_tracker(TypeTracker t) {
+private DataFlow::LocalSourceNode module_tracker(TypeTracker t) {
   t.start() and
   result = DataFlow::importNode("module")
   or
@@ -13,7 +13,7 @@ query DataFlow::Node module_tracker() {
   module_tracker(DataFlow::TypeTracker::end()).flowsTo(result)
 }
 
-DataFlow::LocalSourceNode module_attr_tracker(TypeTracker t) {
+private DataFlow::LocalSourceNode module_attr_tracker(TypeTracker t) {
   t.startInAttr("attr") and
   result = module_tracker()
   or
diff --git a/python/ql/test/experimental/dataflow/typetracking/tracked.ql b/python/ql/test/experimental/dataflow/typetracking/tracked.ql
index 91ffe7e47c1..3d46c05e456 100644
--- a/python/ql/test/experimental/dataflow/typetracking/tracked.ql
+++ b/python/ql/test/experimental/dataflow/typetracking/tracked.ql
@@ -6,7 +6,7 @@ import TestUtilities.InlineExpectationsTest
 // -----------------------------------------------------------------------------
 // tracked
 // -----------------------------------------------------------------------------
-DataFlow::LocalSourceNode tracked(TypeTracker t) {
+private DataFlow::LocalSourceNode tracked(TypeTracker t) {
   t.start() and
   result.asCfgNode() = any(NameNode n | n.getId() = "tracked")
   or
@@ -34,14 +34,14 @@ class TrackedTest extends InlineExpectationsTest {
 // -----------------------------------------------------------------------------
 // int + str
 // -----------------------------------------------------------------------------
-DataFlow::LocalSourceNode int_type(TypeTracker t) {
+private DataFlow::LocalSourceNode int_type(TypeTracker t) {
   t.start() and
   result.asCfgNode() = any(CallNode c | c.getFunction().(NameNode).getId() = "int")
   or
   exists(TypeTracker t2 | result = int_type(t2).track(t2, t))
 }
 
-DataFlow::LocalSourceNode string_type(TypeTracker t) {
+private DataFlow::LocalSourceNode string_type(TypeTracker t) {
   t.start() and
   result.asCfgNode() = any(CallNode c | c.getFunction().(NameNode).getId() = "str")
   or
@@ -83,7 +83,7 @@ class TrackedStringTest extends InlineExpectationsTest {
 // -----------------------------------------------------------------------------
 // tracked_self
 // -----------------------------------------------------------------------------
-DataFlow::LocalSourceNode tracked_self(TypeTracker t) {
+private DataFlow::LocalSourceNode tracked_self(TypeTracker t) {
   t.start() and
   exists(Function f |
     f.isMethod() and
diff --git a/python/ql/test/experimental/library-tests/frameworks/flask/TestTaint.expected b/python/ql/test/experimental/library-tests/frameworks/flask/TestTaint.expected
deleted file mode 100644
index 8c3b4ea57c9..00000000000
--- a/python/ql/test/experimental/library-tests/frameworks/flask/TestTaint.expected
+++ /dev/null
@@ -1,98 +0,0 @@
-| taint_test.py:6 | ok   | test_taint | name |
-| taint_test.py:6 | ok   | test_taint | number |
-| taint_test.py:7 | ok   | test_taint | foo |
-| taint_test.py:14 | ok   | test_taint | request.environ |
-| taint_test.py:15 | ok   | test_taint | request.environ.get(..) |
-| taint_test.py:17 | ok   | test_taint | request.path |
-| taint_test.py:18 | ok   | test_taint | request.full_path |
-| taint_test.py:19 | ok   | test_taint | request.base_url |
-| taint_test.py:20 | ok   | test_taint | request.url |
-| taint_test.py:23 | fail | test_taint | request.accept_charsets.best |
-| taint_test.py:24 | fail | test_taint | request.accept_charsets.best_match(..) |
-| taint_test.py:25 | ok   | test_taint | request.accept_charsets[0] |
-| taint_test.py:26 | ok   | test_taint | request.accept_encodings |
-| taint_test.py:27 | ok   | test_taint | request.accept_languages |
-| taint_test.py:28 | ok   | test_taint | request.accept_mimetypes |
-| taint_test.py:31 | ok   | test_taint | request.access_control_request_headers |
-| taint_test.py:33 | ok   | test_taint | request.access_control_request_method |
-| taint_test.py:35 | ok   | test_taint | request.access_route |
-| taint_test.py:36 | ok   | test_taint | request.access_route[0] |
-| taint_test.py:39 | ok   | test_taint | request.args |
-| taint_test.py:40 | ok   | test_taint | request.args['key'] |
-| taint_test.py:41 | ok   | test_taint | request.args.getlist(..) |
-| taint_test.py:44 | ok   | test_taint | request.authorization |
-| taint_test.py:45 | ok   | test_taint | request.authorization['username'] |
-| taint_test.py:46 | fail | test_taint | request.authorization.username |
-| taint_test.py:49 | ok   | test_taint | request.cache_control |
-| taint_test.py:51 | fail | test_taint | request.cache_control.max_age |
-| taint_test.py:52 | fail | test_taint | request.cache_control.max_stale |
-| taint_test.py:53 | fail | test_taint | request.cache_control.min_fresh |
-| taint_test.py:55 | ok   | test_taint | request.content_encoding |
-| taint_test.py:57 | ok   | test_taint | request.content_md5 |
-| taint_test.py:59 | ok   | test_taint | request.content_type |
-| taint_test.py:62 | ok   | test_taint | request.cookies |
-| taint_test.py:63 | ok   | test_taint | request.cookies['key'] |
-| taint_test.py:65 | ok   | test_taint | request.data |
-| taint_test.py:68 | ok   | test_taint | request.files |
-| taint_test.py:69 | ok   | test_taint | request.files['key'] |
-| taint_test.py:70 | fail | test_taint | request.files['key'].filename |
-| taint_test.py:71 | fail | test_taint | request.files['key'].stream |
-| taint_test.py:72 | ok   | test_taint | request.files.getlist(..) |
-| taint_test.py:73 | fail | test_taint | request.files.getlist(..)[0].filename |
-| taint_test.py:74 | fail | test_taint | request.files.getlist(..)[0].stream |
-| taint_test.py:77 | ok   | test_taint | request.form |
-| taint_test.py:78 | ok   | test_taint | request.form['key'] |
-| taint_test.py:79 | ok   | test_taint | request.form.getlist(..) |
-| taint_test.py:81 | ok   | test_taint | request.get_data() |
-| taint_test.py:83 | ok   | test_taint | request.get_json() |
-| taint_test.py:84 | ok   | test_taint | request.get_json()['foo'] |
-| taint_test.py:85 | ok   | test_taint | request.get_json()['foo']['bar'] |
-| taint_test.py:89 | ok   | test_taint | request.headers |
-| taint_test.py:90 | ok   | test_taint | request.headers['key'] |
-| taint_test.py:91 | fail | test_taint | request.headers.get_all(..) |
-| taint_test.py:92 | fail | test_taint | request.headers.getlist(..) |
-| taint_test.py:93 | ok   | test_taint | list(..) |
-| taint_test.py:94 | fail | test_taint | request.headers.to_wsgi_list() |
-| taint_test.py:96 | ok   | test_taint | request.json |
-| taint_test.py:97 | ok   | test_taint | request.json['foo'] |
-| taint_test.py:98 | ok   | test_taint | request.json['foo']['bar'] |
-| taint_test.py:100 | ok   | test_taint | request.method |
-| taint_test.py:102 | ok   | test_taint | request.mimetype |
-| taint_test.py:104 | ok   | test_taint | request.mimetype_params |
-| taint_test.py:106 | ok   | test_taint | request.origin |
-| taint_test.py:109 | ok   | test_taint | request.pragma |
-| taint_test.py:111 | ok   | test_taint | request.query_string |
-| taint_test.py:113 | ok   | test_taint | request.referrer |
-| taint_test.py:115 | ok   | test_taint | request.remote_addr |
-| taint_test.py:117 | ok   | test_taint | request.remote_user |
-| taint_test.py:120 | ok   | test_taint | request.stream |
-| taint_test.py:121 | ok   | test_taint | request.input_stream |
-| taint_test.py:123 | ok   | test_taint | request.url |
-| taint_test.py:125 | ok   | test_taint | request.user_agent |
-| taint_test.py:128 | ok   | test_taint | request.values |
-| taint_test.py:129 | ok   | test_taint | request.values['key'] |
-| taint_test.py:130 | ok   | test_taint | request.values.getlist(..) |
-| taint_test.py:133 | ok   | test_taint | request.view_args |
-| taint_test.py:134 | ok   | test_taint | request.view_args['key'] |
-| taint_test.py:138 | ok   | test_taint | request.script_root |
-| taint_test.py:139 | ok   | test_taint | request.url_root |
-| taint_test.py:143 | ok   | test_taint | request.charset |
-| taint_test.py:144 | ok   | test_taint | request.url_charset |
-| taint_test.py:148 | ok   | test_taint | request.date |
-| taint_test.py:151 | ok   | test_taint | request.endpoint |
-| taint_test.py:156 | ok   | test_taint | request.host |
-| taint_test.py:157 | ok   | test_taint | request.host_url |
-| taint_test.py:159 | ok   | test_taint | request.scheme |
-| taint_test.py:161 | ok   | test_taint | request.script_root |
-| taint_test.py:169 | ok   | test_taint | request.args |
-| taint_test.py:170 | ok   | test_taint | a |
-| taint_test.py:171 | ok   | test_taint | b |
-| taint_test.py:173 | ok   | test_taint | request.args['key'] |
-| taint_test.py:174 | ok   | test_taint | a['key'] |
-| taint_test.py:175 | ok   | test_taint | b['key'] |
-| taint_test.py:177 | ok   | test_taint | request.args.getlist(..) |
-| taint_test.py:178 | ok   | test_taint | a.getlist(..) |
-| taint_test.py:179 | ok   | test_taint | b.getlist(..) |
-| taint_test.py:180 | ok   | test_taint | gl(..) |
-| taint_test.py:187 | ok   | test_taint | req.path |
-| taint_test.py:188 | ok   | test_taint | gd() |
diff --git a/python/ql/test/experimental/library-tests/frameworks/yaml/Decoding.py b/python/ql/test/experimental/library-tests/frameworks/yaml/Decoding.py
deleted file mode 100644
index 816d91d9068..00000000000
--- a/python/ql/test/experimental/library-tests/frameworks/yaml/Decoding.py
+++ /dev/null
@@ -1,16 +0,0 @@
-import yaml
-from yaml import SafeLoader
-
-yaml.load(payload)  # $decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML decodeMayExecuteInput
-yaml.load(payload, SafeLoader)  # $ decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML
-yaml.load(payload, Loader=SafeLoader)  # $decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML
-yaml.load(payload, Loader=yaml.BaseLoader)  # $decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML
-
-yaml.safe_load(payload) # $ decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML
-yaml.unsafe_load(payload) # $ decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML decodeMayExecuteInput
-yaml.full_load(payload) # $ decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML decodeMayExecuteInput
-
-yaml.load_all(payload) # $ decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML decodeMayExecuteInput
-yaml.safe_load_all(payload) # $ decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML
-yaml.unsafe_load_all(payload) # $ decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML decodeMayExecuteInput
-yaml.full_load_all(payload) # $ decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML decodeMayExecuteInput
diff --git a/python/ql/test/experimental/query-tests/Classes/Naming/NamingConventionsClasses.expected b/python/ql/test/experimental/query-tests/Classes/Naming/NamingConventionsClasses.expected
new file mode 100644
index 00000000000..8e6dea7fce4
--- /dev/null
+++ b/python/ql/test/experimental/query-tests/Classes/Naming/NamingConventionsClasses.expected
@@ -0,0 +1 @@
+| NamingConventionsClasses.py:2:1:2:14 | Class badName | Class names should start in uppercase. |
diff --git a/python/ql/test/experimental/query-tests/Classes/Naming/NamingConventionsClasses.py b/python/ql/test/experimental/query-tests/Classes/Naming/NamingConventionsClasses.py
new file mode 100644
index 00000000000..c07bdb57234
--- /dev/null
+++ b/python/ql/test/experimental/query-tests/Classes/Naming/NamingConventionsClasses.py
@@ -0,0 +1,11 @@
+# BAD, do not start class or interface name with lowercase letter
+class badName:
+
+    def hello(self):
+        print("hello")
+
+# Good, class name starts with capital letter
+class GoodName:
+
+    def hello(self):
+        print("hello")
\ No newline at end of file
diff --git a/python/ql/test/experimental/query-tests/Classes/Naming/NamingConventionsClasses.qlref b/python/ql/test/experimental/query-tests/Classes/Naming/NamingConventionsClasses.qlref
new file mode 100644
index 00000000000..7ed945d782c
--- /dev/null
+++ b/python/ql/test/experimental/query-tests/Classes/Naming/NamingConventionsClasses.qlref
@@ -0,0 +1 @@
+experimental/Classes/NamingConventionsClasses.ql
\ No newline at end of file
diff --git a/python/ql/test/experimental/query-tests/Functions/general/NamingConventionsFunctions.expected b/python/ql/test/experimental/query-tests/Functions/general/NamingConventionsFunctions.expected
new file mode 100644
index 00000000000..d87fe6c16f3
--- /dev/null
+++ b/python/ql/test/experimental/query-tests/Functions/general/NamingConventionsFunctions.expected
@@ -0,0 +1 @@
+| NamingConventionsFunctions.py:4:5:4:25 | Function HelloWorld | Function names should start in lowercase. |
diff --git a/python/ql/test/experimental/query-tests/Functions/general/NamingConventionsFunctions.py b/python/ql/test/experimental/query-tests/Functions/general/NamingConventionsFunctions.py
new file mode 100644
index 00000000000..fb3e89ab8e9
--- /dev/null
+++ b/python/ql/test/experimental/query-tests/Functions/general/NamingConventionsFunctions.py
@@ -0,0 +1,9 @@
+class Test:
+
+    # BAD, do not start function name with uppercase letter
+    def HelloWorld(self):
+        print("hello world")
+
+    # GOOD, function name starts with lowercase letter
+    def hello_world(self):
+        print("hello world")
\ No newline at end of file
diff --git a/python/ql/test/experimental/query-tests/Functions/general/NamingConventionsFunctions.qlref b/python/ql/test/experimental/query-tests/Functions/general/NamingConventionsFunctions.qlref
new file mode 100644
index 00000000000..0204694de0a
--- /dev/null
+++ b/python/ql/test/experimental/query-tests/Functions/general/NamingConventionsFunctions.qlref
@@ -0,0 +1 @@
+experimental/Functions/NamingConventionsFunctions.ql
\ No newline at end of file
diff --git a/python/ql/test/library-tests/DuplicateCode/Duplicate.expected b/python/ql/test/library-tests/DuplicateCode/Duplicate.expected
deleted file mode 100644
index 5c7717546d6..00000000000
--- a/python/ql/test/library-tests/DuplicateCode/Duplicate.expected
+++ /dev/null
@@ -1,2 +0,0 @@
-| Duplicate code: 34 duplicated lines. | Duplicate code: 34 duplicated lines. | duplicate_test.py | 9 | 42 |
-| Duplicate code: 80 duplicated lines. | Duplicate code: 80 duplicated lines. | duplicate_test.py | 84 | 163 |
diff --git a/python/ql/test/library-tests/DuplicateCode/Duplicate.ql b/python/ql/test/library-tests/DuplicateCode/Duplicate.ql
deleted file mode 100644
index a8f04593ea3..00000000000
--- a/python/ql/test/library-tests/DuplicateCode/Duplicate.ql
+++ /dev/null
@@ -1,23 +0,0 @@
-/**
- * @name Duplicate
- * @description Insert description here...
- * @kind table
- * @problem.severity warning
- */
-
-import python
-import external.CodeDuplication
-
-predicate lexically_sorted(DuplicateBlock dup1, DuplicateBlock dup2) {
-  dup1.sourceFile().getAbsolutePath() < dup2.sourceFile().getAbsolutePath()
-  or
-  dup1.sourceFile().getAbsolutePath() = dup2.sourceFile().getAbsolutePath() and
-  dup1.sourceStartLine() < dup2.sourceStartLine()
-}
-
-from DuplicateBlock dup1, DuplicateBlock dup2
-where
-  dup1.getEquivalenceClass() = dup2.getEquivalenceClass() and
-  lexically_sorted(dup1, dup2)
-select dup1.toString(), dup2.toString(), dup1.sourceFile().getShortName(), dup1.sourceStartLine(),
-  dup1.sourceEndLine()
diff --git a/python/ql/test/library-tests/DuplicateCode/DuplicateStatements.expected b/python/ql/test/library-tests/DuplicateCode/DuplicateStatements.expected
deleted file mode 100644
index e69de29bb2d..00000000000
diff --git a/python/ql/test/library-tests/DuplicateCode/DuplicateStatements.ql b/python/ql/test/library-tests/DuplicateCode/DuplicateStatements.ql
deleted file mode 100644
index ca297eb3718..00000000000
--- a/python/ql/test/library-tests/DuplicateCode/DuplicateStatements.ql
+++ /dev/null
@@ -1,26 +0,0 @@
-/**
- * @name DuplicateStatements
- * @description Insert description here...
- * @kind problem
- * @problem.severity warning
- */
-
-import python
-import external.CodeDuplication
-
-predicate mostlyDuplicateFunction(Function f) {
-  exists(int covered, int total, Function other, int percent |
-    duplicateStatements(f, other, covered, total) and
-    covered != total and
-    total > 5 and
-    covered * 100 / total = percent and
-    percent > 80 and
-    not exists(Scope s | s = f.getScope*() | duplicateScopes(s, _, _, _))
-  )
-}
-
-from Stmt s
-where
-  mostlyDuplicateFunction(s.getScope()) and
-  not duplicateStatement(s.getScope(), _, s, _)
-select s.toString(), s.getLocation().toString()
diff --git a/python/ql/test/library-tests/DuplicateCode/Similar.expected b/python/ql/test/library-tests/DuplicateCode/Similar.expected
deleted file mode 100644
index 34e0b8f745c..00000000000
--- a/python/ql/test/library-tests/DuplicateCode/Similar.expected
+++ /dev/null
@@ -1,23 +0,0 @@
-| duplicate_test.py:9:1:20:17 | Similar code: 12 almost duplicated lines. | duplicate_test.py:47:1:58:17 | Similar code: 12 almost duplicated lines. | duplicate_test.py | 9 | 20 |
-| duplicate_test.py:9:1:20:17 | Similar code: 12 almost duplicated lines. | duplicate_test.py:249:1:260:17 | Similar code: 12 almost duplicated lines. | duplicate_test.py | 9 | 20 |
-| duplicate_test.py:9:1:20:17 | Similar code: 12 almost duplicated lines. | duplicate_test.py:287:1:298:17 | Similar code: 12 almost duplicated lines. | duplicate_test.py | 9 | 20 |
-| duplicate_test.py:14:8:25:13 | Similar code: 12 almost duplicated lines. | duplicate_test.py:52:8:63:13 | Similar code: 12 almost duplicated lines. | duplicate_test.py | 14 | 25 |
-| duplicate_test.py:14:8:25:13 | Similar code: 12 almost duplicated lines. | duplicate_test.py:254:8:265:13 | Similar code: 12 almost duplicated lines. | duplicate_test.py | 14 | 25 |
-| duplicate_test.py:20:28:42:31 | Similar code: 23 almost duplicated lines. | duplicate_test.py:58:28:80:31 | Similar code: 23 almost duplicated lines. | duplicate_test.py | 20 | 42 |
-| duplicate_test.py:20:28:42:31 | Similar code: 23 almost duplicated lines. | duplicate_test.py:260:28:282:31 | Similar code: 23 almost duplicated lines. | duplicate_test.py | 20 | 42 |
-| duplicate_test.py:20:28:42:31 | Similar code: 23 almost duplicated lines. | duplicate_test.py:296:40:318:31 | Similar code: 23 almost duplicated lines. | duplicate_test.py | 20 | 42 |
-| duplicate_test.py:36:1:47:0 | Similar code: 12 almost duplicated lines. | duplicate_test.py:74:1:84:0 | Similar code: 11 almost duplicated lines. | duplicate_test.py | 36 | 47 |
-| duplicate_test.py:36:1:47:0 | Similar code: 12 almost duplicated lines. | duplicate_test.py:276:1:287:0 | Similar code: 12 almost duplicated lines. | duplicate_test.py | 36 | 47 |
-| duplicate_test.py:36:22:56:26 | Similar code: 21 almost duplicated lines. | duplicate_test.py:276:21:296:26 | Similar code: 21 almost duplicated lines. | duplicate_test.py | 36 | 56 |
-| duplicate_test.py:42:22:57:9 | Similar code: 16 almost duplicated lines. | duplicate_test.py:245:20:259:9 | Similar code: 15 almost duplicated lines. | duplicate_test.py | 42 | 57 |
-| duplicate_test.py:42:22:57:9 | Similar code: 16 almost duplicated lines. | duplicate_test.py:282:22:297:9 | Similar code: 16 almost duplicated lines. | duplicate_test.py | 42 | 57 |
-| duplicate_test.py:47:1:58:17 | Similar code: 12 almost duplicated lines. | duplicate_test.py:249:1:260:17 | Similar code: 12 almost duplicated lines. | duplicate_test.py | 47 | 58 |
-| duplicate_test.py:47:1:58:17 | Similar code: 12 almost duplicated lines. | duplicate_test.py:287:1:298:17 | Similar code: 12 almost duplicated lines. | duplicate_test.py | 47 | 58 |
-| duplicate_test.py:52:8:63:13 | Similar code: 12 almost duplicated lines. | duplicate_test.py:254:8:265:13 | Similar code: 12 almost duplicated lines. | duplicate_test.py | 52 | 63 |
-| duplicate_test.py:58:28:80:31 | Similar code: 23 almost duplicated lines. | duplicate_test.py:260:28:282:31 | Similar code: 23 almost duplicated lines. | duplicate_test.py | 58 | 80 |
-| duplicate_test.py:58:28:80:31 | Similar code: 23 almost duplicated lines. | duplicate_test.py:296:40:318:31 | Similar code: 23 almost duplicated lines. | duplicate_test.py | 58 | 80 |
-| duplicate_test.py:74:1:84:0 | Similar code: 11 almost duplicated lines. | duplicate_test.py:276:1:287:0 | Similar code: 12 almost duplicated lines. | duplicate_test.py | 74 | 84 |
-| duplicate_test.py:82:25:163:24 | Similar code: 82 almost duplicated lines. | duplicate_test.py:163:24:245:24 | Similar code: 83 almost duplicated lines. | duplicate_test.py | 82 | 163 |
-| duplicate_test.py:245:20:259:9 | Similar code: 15 almost duplicated lines. | duplicate_test.py:282:22:297:9 | Similar code: 16 almost duplicated lines. | duplicate_test.py | 245 | 259 |
-| duplicate_test.py:249:1:260:17 | Similar code: 12 almost duplicated lines. | duplicate_test.py:287:1:298:17 | Similar code: 12 almost duplicated lines. | duplicate_test.py | 249 | 260 |
-| duplicate_test.py:260:28:282:31 | Similar code: 23 almost duplicated lines. | duplicate_test.py:296:40:318:31 | Similar code: 23 almost duplicated lines. | duplicate_test.py | 260 | 282 |
diff --git a/python/ql/test/library-tests/DuplicateCode/Similar.ql b/python/ql/test/library-tests/DuplicateCode/Similar.ql
deleted file mode 100644
index 3f9a99c8ecf..00000000000
--- a/python/ql/test/library-tests/DuplicateCode/Similar.ql
+++ /dev/null
@@ -1,22 +0,0 @@
-/**
- * @name Similar
- * @description Insert description here...
- * @kind table
- * @problem.severity warning
- */
-
-import python
-import external.CodeDuplication
-
-predicate lexically_sorted(SimilarBlock dup1, SimilarBlock dup2) {
-  dup1.sourceFile().getAbsolutePath() < dup2.sourceFile().getAbsolutePath()
-  or
-  dup1.sourceFile().getAbsolutePath() = dup2.sourceFile().getAbsolutePath() and
-  dup1.sourceStartLine() < dup2.sourceStartLine()
-}
-
-from SimilarBlock dup1, SimilarBlock dup2
-where
-  dup1.getEquivalenceClass() = dup2.getEquivalenceClass() and
-  lexically_sorted(dup1, dup2)
-select dup1, dup2, dup1.sourceFile().getShortName(), dup1.sourceStartLine(), dup1.sourceEndLine()
diff --git a/python/ql/test/library-tests/DuplicateCode/duplicate_test.py b/python/ql/test/library-tests/DuplicateCode/duplicate_test.py
deleted file mode 100644
index a382fdefcef..00000000000
--- a/python/ql/test/library-tests/DuplicateCode/duplicate_test.py
+++ /dev/null
@@ -1,321 +0,0 @@
-#Code Duplication
-
-
-#Exact duplication of function
-
-#Code copied from stdlib, copyright PSF.
-#See http://www.python.org/download/releases/2.7/license/
-
-def dis(x=None):
-    """Disassemble classes, methods, functions, or code.
-
-    With no argument, disassemble the last traceback.
-
-    """
-    if x is None:
-        distb()
-        return
-    if isinstance(x, types.InstanceType):
-        x = x.__class__
-    if hasattr(x, 'im_func'):
-        x = x.im_func
-    if hasattr(x, 'func_code'):
-        x = x.func_code
-    if hasattr(x, '__dict__'):
-        items = x.__dict__.items()
-        items.sort()
-        for name, x1 in items:
-            if isinstance(x1, _have_code):
-                print "Disassembly of %s:" % name
-                try:
-                    dis(x1)
-                except TypeError, msg:
-                    print "Sorry:", msg
-                print
-    elif hasattr(x, 'co_code'):
-        disassemble(x)
-    elif isinstance(x, str):
-        disassemble_string(x)
-    else:
-        raise TypeError, \
-              "don't know how to disassemble %s objects" % \
-              type(x).__name__
-
-
-#And duplicate version
-
-def dis2(x=None):
-    """Disassemble classes, methods, functions, or code.
-
-    With no argument, disassemble the last traceback.
-
-    """
-    if x is None:
-        distb()
-        return
-    if isinstance(x, types.InstanceType):
-        x = x.__class__
-    if hasattr(x, 'im_func'):
-        x = x.im_func
-    if hasattr(x, 'func_code'):
-        x = x.func_code
-    if hasattr(x, '__dict__'):
-        items = x.__dict__.items()
-        items.sort()
-        for name, x1 in items:
-            if isinstance(x1, _have_code):
-                print "Disassembly of %s:" % name
-                try:
-                    dis(x1)
-                except TypeError, msg:
-                    print "Sorry:", msg
-                print
-    elif hasattr(x, 'co_code'):
-        disassemble(x)
-    elif isinstance(x, str):
-        disassemble_string(x)
-    else:
-        raise TypeError, \
-              "don't know how to disassemble %s objects" % \
-              type(x).__name__
-
-#Exactly duplicate class
-
-class Popen3:
-    """Class representing a child process.  Normally, instances are created
-    internally by the functions popen2() and popen3()."""
-
-    sts = -1                    # Child not completed yet
-
-    def __init__(self, cmd, capturestderr=False, bufsize=-1):
-        """The parameter 'cmd' is the shell command to execute in a
-        sub-process.  On UNIX, 'cmd' may be a sequence, in which case arguments
-        will be passed directly to the program without shell intervention (as
-        with os.spawnv()).  If 'cmd' is a string it will be passed to the shell
-        (as with os.system()).   The 'capturestderr' flag, if true, specifies
-        that the object should capture standard error output of the child
-        process.  The default is false.  If the 'bufsize' parameter is
-        specified, it specifies the size of the I/O buffers to/from the child
-        process."""
-        _cleanup()
-        self.cmd = cmd
-        p2cread, p2cwrite = os.pipe()
-        c2pread, c2pwrite = os.pipe()
-        if capturestderr:
-            errout, errin = os.pipe()
-        self.pid = os.fork()
-        if self.pid == 0:
-            # Child
-            os.dup2(p2cread, 0)
-            os.dup2(c2pwrite, 1)
-            if capturestderr:
-                os.dup2(errin, 2)
-            self._run_child(cmd)
-        os.close(p2cread)
-        self.tochild = os.fdopen(p2cwrite, 'w', bufsize)
-        os.close(c2pwrite)
-        self.fromchild = os.fdopen(c2pread, 'r', bufsize)
-        if capturestderr:
-            os.close(errin)
-            self.childerr = os.fdopen(errout, 'r', bufsize)
-        else:
-            self.childerr = None
-
-    def __del__(self):
-        # In case the child hasn't been waited on, check if it's done.
-        self.poll(_deadstate=sys.maxint)
-        if self.sts < 0:
-            if _active is not None:
-                # Child is still running, keep us alive until we can wait on it.
-                _active.append(self)
-
-    def _run_child(self, cmd):
-        if isinstance(cmd, basestring):
-            cmd = ['/bin/sh', '-c', cmd]
-        os.closerange(3, MAXFD)
-        try:
-            os.execvp(cmd[0], cmd)
-        finally:
-            os._exit(1)
-
-    def poll(self, _deadstate=None):
-        """Return the exit status of the child process if it has finished,
-        or -1 if it hasn't finished yet."""
-        if self.sts < 0:
-            try:
-                pid, sts = os.waitpid(self.pid, os.WNOHANG)
-                # pid will be 0 if self.pid hasn't terminated
-                if pid == self.pid:
-                    self.sts = sts
-            except os.error:
-                if _deadstate is not None:
-                    self.sts = _deadstate
-        return self.sts
-
-    def wait(self):
-        """Wait for and return the exit status of the child process."""
-        if self.sts < 0:
-            pid, sts = os.waitpid(self.pid, 0)
-            # This used to be a test, but it is believed to be
-            # always true, so I changed it to an assertion - mvl
-            assert pid == self.pid
-            self.sts = sts
-        return self.sts
-
-
-class Popen3Again:
-    """Class representing a child process.  Normally, instances are created
-    internally by the functions popen2() and popen3()."""
-
-    sts = -1                    # Child not completed yet
-
-    def __init__(self, cmd, capturestderr=False, bufsize=-1):
-        """The parameter 'cmd' is the shell command to execute in a
-        sub-process.  On UNIX, 'cmd' may be a sequence, in which case arguments
-        will be passed directly to the program without shell intervention (as
-        with os.spawnv()).  If 'cmd' is a string it will be passed to the shell
-        (as with os.system()).   The 'capturestderr' flag, if true, specifies
-        that the object should capture standard error output of the child
-        process.  The default is false.  If the 'bufsize' parameter is
-        specified, it specifies the size of the I/O buffers to/from the child
-        process."""
-        _cleanup()
-        self.cmd = cmd
-        p2cread, p2cwrite = os.pipe()
-        c2pread, c2pwrite = os.pipe()
-        if capturestderr:
-            errout, errin = os.pipe()
-        self.pid = os.fork()
-        if self.pid == 0:
-            # Child
-            os.dup2(p2cread, 0)
-            os.dup2(c2pwrite, 1)
-            if capturestderr:
-                os.dup2(errin, 2)
-            self._run_child(cmd)
-        os.close(p2cread)
-        self.tochild = os.fdopen(p2cwrite, 'w', bufsize)
-        os.close(c2pwrite)
-        self.fromchild = os.fdopen(c2pread, 'r', bufsize)
-        if capturestderr:
-            os.close(errin)
-            self.childerr = os.fdopen(errout, 'r', bufsize)
-        else:
-            self.childerr = None
-
-    def __del__(self):
-        # In case the child hasn't been waited on, check if it's done.
-        self.poll(_deadstate=sys.maxint)
-        if self.sts < 0:
-            if _active is not None:
-                # Child is still running, keep us alive until we can wait on it.
-                _active.append(self)
-
-    def _run_child(self, cmd):
-        if isinstance(cmd, basestring):
-            cmd = ['/bin/sh', '-c', cmd]
-        os.closerange(3, MAXFD)
-        try:
-            os.execvp(cmd[0], cmd)
-        finally:
-            os._exit(1)
-
-    def poll(self, _deadstate=None):
-        """Return the exit status of the child process if it has finished,
-        or -1 if it hasn't finished yet."""
-        if self.sts < 0:
-            try:
-                pid, sts = os.waitpid(self.pid, os.WNOHANG)
-                # pid will be 0 if self.pid hasn't terminated
-                if pid == self.pid:
-                    self.sts = sts
-            except os.error:
-                if _deadstate is not None:
-                    self.sts = _deadstate
-        return self.sts
-
-    def wait(self):
-        """Wait for and return the exit status of the child process."""
-        if self.sts < 0:
-            pid, sts = os.waitpid(self.pid, 0)
-            # This used to be a test, but it is believed to be
-            # always true, so I changed it to an assertion - mvl
-            assert pid == self.pid
-            self.sts = sts
-        return self.sts
-
-#Duplicate function with identifiers changed
-
-def dis3(y=None):
-    """frobnicate classes, methods, functions, or code.
-
-    With no argument, frobnicate the last traceback.
-
-    """
-    if y is None:
-        distb()
-        return
-    if isinstance(y, types.InstanceType):
-        y = y.__class__
-    if hasattr(y, 'im_func'):
-        y = y.im_func
-    if hasattr(y, 'func_code'):
-        y = y.func_code
-    if hasattr(y, '__dict__'):
-        items = y.__dict__.items()
-        items.sort()
-        for name, y1 in items:
-            if isinstance(y1, _have_code):
-                print "Disassembly of %s:" % name
-                try:
-                    dis(y1)
-                except TypeError, msg:
-                    print "Sorry:", msg
-                print
-    elif hasattr(y, 'co_code'):
-        frobnicate(y)
-    elif isinstance(y, str):
-        frobnicate_string(y)
-    else:
-        raise TypeError, \
-              "don't know how to frobnicate %s objects" % \
-              type(y).__name__
-
-
-#Mostly similar function with changed identifiers
-
-def dis5(z=None):
-    """splat classes, methods, functions, or code.
-
-    With no argument, splat the last traceback.
-
-    """
-    if z is None:
-        distb()
-        return
-    if isinstance(z, types.InstanceType):
-        z = z.__class__
-    if hasattr(y, 'func_code'):
-        y = y.func_code
-    if hasattr(z, '__dict__'):
-        items = z.__dict__.items()
-        items.sort()
-        for name, z1 in items:
-            if isinstance(z1, _have_code):
-                print "Disassembly of %s:" % name
-                try:
-                    dis(z1)
-                except TypeError, msg:
-                    print "Sorry:", msg
-                print
-    elif hasattr(z, 'co_code'):
-        splat(z)
-    elif isinstance(z, str):
-        splat_string(z)
-    else:
-        raise TypeError, \
-              "don't know how to splat %s objects" % \
-              type(z).__name__
-
-
-
diff --git a/python/ql/test/experimental/library-tests/frameworks/crypto/ConceptsTest.expected b/python/ql/test/library-tests/frameworks/crypto/ConceptsTest.expected
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/crypto/ConceptsTest.expected
rename to python/ql/test/library-tests/frameworks/crypto/ConceptsTest.expected
diff --git a/python/ql/test/experimental/library-tests/frameworks/crypto/ConceptsTest.ql b/python/ql/test/library-tests/frameworks/crypto/ConceptsTest.ql
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/crypto/ConceptsTest.ql
rename to python/ql/test/library-tests/frameworks/crypto/ConceptsTest.ql
diff --git a/python/ql/test/experimental/library-tests/frameworks/crypto/test_dsa.py b/python/ql/test/library-tests/frameworks/crypto/test_dsa.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/crypto/test_dsa.py
rename to python/ql/test/library-tests/frameworks/crypto/test_dsa.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/crypto/test_ec.py b/python/ql/test/library-tests/frameworks/crypto/test_ec.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/crypto/test_ec.py
rename to python/ql/test/library-tests/frameworks/crypto/test_ec.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/crypto/test_rsa.py b/python/ql/test/library-tests/frameworks/crypto/test_rsa.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/crypto/test_rsa.py
rename to python/ql/test/library-tests/frameworks/crypto/test_rsa.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/cryptodome/ConceptsTest.expected b/python/ql/test/library-tests/frameworks/cryptodome/ConceptsTest.expected
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/cryptodome/ConceptsTest.expected
rename to python/ql/test/library-tests/frameworks/cryptodome/ConceptsTest.expected
diff --git a/python/ql/test/experimental/library-tests/frameworks/cryptodome/ConceptsTest.ql b/python/ql/test/library-tests/frameworks/cryptodome/ConceptsTest.ql
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/cryptodome/ConceptsTest.ql
rename to python/ql/test/library-tests/frameworks/cryptodome/ConceptsTest.ql
diff --git a/python/ql/test/experimental/library-tests/frameworks/cryptodome/test_dsa.py b/python/ql/test/library-tests/frameworks/cryptodome/test_dsa.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/cryptodome/test_dsa.py
rename to python/ql/test/library-tests/frameworks/cryptodome/test_dsa.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/cryptodome/test_ec.py b/python/ql/test/library-tests/frameworks/cryptodome/test_ec.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/cryptodome/test_ec.py
rename to python/ql/test/library-tests/frameworks/cryptodome/test_ec.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/cryptodome/test_rsa.py b/python/ql/test/library-tests/frameworks/cryptodome/test_rsa.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/cryptodome/test_rsa.py
rename to python/ql/test/library-tests/frameworks/cryptodome/test_rsa.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/cryptography/ConceptsTest.expected b/python/ql/test/library-tests/frameworks/cryptography/ConceptsTest.expected
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/cryptography/ConceptsTest.expected
rename to python/ql/test/library-tests/frameworks/cryptography/ConceptsTest.expected
diff --git a/python/ql/test/experimental/library-tests/frameworks/cryptography/ConceptsTest.ql b/python/ql/test/library-tests/frameworks/cryptography/ConceptsTest.ql
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/cryptography/ConceptsTest.ql
rename to python/ql/test/library-tests/frameworks/cryptography/ConceptsTest.ql
diff --git a/python/ql/test/experimental/library-tests/frameworks/cryptography/test_dsa.py b/python/ql/test/library-tests/frameworks/cryptography/test_dsa.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/cryptography/test_dsa.py
rename to python/ql/test/library-tests/frameworks/cryptography/test_dsa.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/cryptography/test_ec.py b/python/ql/test/library-tests/frameworks/cryptography/test_ec.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/cryptography/test_ec.py
rename to python/ql/test/library-tests/frameworks/cryptography/test_ec.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/cryptography/test_rsa.py b/python/ql/test/library-tests/frameworks/cryptography/test_rsa.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/cryptography/test_rsa.py
rename to python/ql/test/library-tests/frameworks/cryptography/test_rsa.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/dill/ConceptsTest.expected b/python/ql/test/library-tests/frameworks/dill/ConceptsTest.expected
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/dill/ConceptsTest.expected
rename to python/ql/test/library-tests/frameworks/dill/ConceptsTest.expected
diff --git a/python/ql/test/experimental/library-tests/frameworks/dill/ConceptsTest.ql b/python/ql/test/library-tests/frameworks/dill/ConceptsTest.ql
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/dill/ConceptsTest.ql
rename to python/ql/test/library-tests/frameworks/dill/ConceptsTest.ql
diff --git a/python/ql/test/experimental/library-tests/frameworks/dill/Decoding.py b/python/ql/test/library-tests/frameworks/dill/Decoding.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/dill/Decoding.py
rename to python/ql/test/library-tests/frameworks/dill/Decoding.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/django-v1/ConceptsTest.expected b/python/ql/test/library-tests/frameworks/django-v1/ConceptsTest.expected
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/django-v1/ConceptsTest.expected
rename to python/ql/test/library-tests/frameworks/django-v1/ConceptsTest.expected
diff --git a/python/ql/test/experimental/library-tests/frameworks/django-v1/ConceptsTest.ql b/python/ql/test/library-tests/frameworks/django-v1/ConceptsTest.ql
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/django-v1/ConceptsTest.ql
rename to python/ql/test/library-tests/frameworks/django-v1/ConceptsTest.ql
diff --git a/python/ql/test/experimental/library-tests/frameworks/django-v1/routing_test.py b/python/ql/test/library-tests/frameworks/django-v1/routing_test.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/django-v1/routing_test.py
rename to python/ql/test/library-tests/frameworks/django-v1/routing_test.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/ConceptsTest.expected b/python/ql/test/library-tests/frameworks/django-v2-v3/ConceptsTest.expected
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/django-v2-v3/ConceptsTest.expected
rename to python/ql/test/library-tests/frameworks/django-v2-v3/ConceptsTest.expected
diff --git a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/ConceptsTest.ql b/python/ql/test/library-tests/frameworks/django-v2-v3/ConceptsTest.ql
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/django-v2-v3/ConceptsTest.ql
rename to python/ql/test/library-tests/frameworks/django-v2-v3/ConceptsTest.ql
diff --git a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/README.md b/python/ql/test/library-tests/frameworks/django-v2-v3/README.md
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/django-v2-v3/README.md
rename to python/ql/test/library-tests/frameworks/django-v2-v3/README.md
diff --git a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/TestTaint.expected b/python/ql/test/library-tests/frameworks/django-v2-v3/TestTaint.expected
similarity index 90%
rename from python/ql/test/experimental/library-tests/frameworks/django-v2-v3/TestTaint.expected
rename to python/ql/test/library-tests/frameworks/django-v2-v3/TestTaint.expected
index 0602985a392..0888473f41c 100644
--- a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/TestTaint.expected
+++ b/python/ql/test/library-tests/frameworks/django-v2-v3/TestTaint.expected
@@ -1,4 +1,15 @@
 | response_test.py:61 | ok   | get_redirect_url | foo |
+| taint_forms.py:6 | ok   | to_python | value |
+| taint_forms.py:9 | ok   | validate | value |
+| taint_forms.py:12 | ok   | run_validators | value |
+| taint_forms.py:15 | ok   | clean | value |
+| taint_forms.py:33 | ok   | clean | cleaned_data |
+| taint_forms.py:34 | ok   | clean | cleaned_data["key"] |
+| taint_forms.py:35 | ok   | clean | cleaned_data.get(..) |
+| taint_forms.py:39 | ok   | clean | self.cleaned_data |
+| taint_forms.py:40 | ok   | clean | self.cleaned_data["key"] |
+| taint_forms.py:41 | ok   | clean | self.cleaned_data.get(..) |
+| taint_forms.py:46 | ok   | clean_foo | self.cleaned_data |
 | taint_test.py:8 | ok   | test_taint | bar |
 | taint_test.py:8 | ok   | test_taint | foo |
 | taint_test.py:9 | ok   | test_taint | baz |
diff --git a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/TestTaint.ql b/python/ql/test/library-tests/frameworks/django-v2-v3/TestTaint.ql
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/django-v2-v3/TestTaint.ql
rename to python/ql/test/library-tests/frameworks/django-v2-v3/TestTaint.ql
diff --git a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/dummy_import.py b/python/ql/test/library-tests/frameworks/django-v2-v3/dummy_import.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/django-v2-v3/dummy_import.py
rename to python/ql/test/library-tests/frameworks/django-v2-v3/dummy_import.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/manage.py b/python/ql/test/library-tests/frameworks/django-v2-v3/manage.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/django-v2-v3/manage.py
rename to python/ql/test/library-tests/frameworks/django-v2-v3/manage.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/options b/python/ql/test/library-tests/frameworks/django-v2-v3/options
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/django-v2-v3/options
rename to python/ql/test/library-tests/frameworks/django-v2-v3/options
diff --git a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/response_test.py b/python/ql/test/library-tests/frameworks/django-v2-v3/response_test.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/django-v2-v3/response_test.py
rename to python/ql/test/library-tests/frameworks/django-v2-v3/response_test.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/routing_test.py b/python/ql/test/library-tests/frameworks/django-v2-v3/routing_test.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/django-v2-v3/routing_test.py
rename to python/ql/test/library-tests/frameworks/django-v2-v3/routing_test.py
diff --git a/python/ql/test/library-tests/frameworks/django-v2-v3/taint_forms.py b/python/ql/test/library-tests/frameworks/django-v2-v3/taint_forms.py
new file mode 100644
index 00000000000..5cc9c830e7c
--- /dev/null
+++ b/python/ql/test/library-tests/frameworks/django-v2-v3/taint_forms.py
@@ -0,0 +1,46 @@
+import django.forms
+
+
+class MyField(django.forms.Field):
+    def to_python(self, value):
+        ensure_tainted(value)
+
+    def validate(self, value):
+        ensure_tainted(value)
+
+    def run_validators(self, value):
+        ensure_tainted(value)
+
+    def clean(self, value):
+        ensure_tainted(value)
+
+        # # Base definition of `clean` looks like the following, so there is actually
+        # # _data flow_ from the methods, but we will ignore for simplicity.
+        # value = self.to_python(value)
+        # self.validate(value)
+        # self.run_validators(value)
+        # return value
+
+
+class MyForm(django.forms.Form):
+
+    foo = MyField()
+
+    def clean(self):
+        cleaned_data = super().clean()
+
+        ensure_tainted(
+            cleaned_data,
+            cleaned_data["key"],
+            cleaned_data.get("key"),
+        )
+
+        ensure_tainted(
+            self.cleaned_data,
+            self.cleaned_data["key"],
+            self.cleaned_data.get("key"),
+        )
+
+    def clean_foo(self):
+        # This method is supposed to clean the `foo` field in context of this form.
+        ensure_tainted(self.cleaned_data)
diff --git a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/taint_test.py b/python/ql/test/library-tests/frameworks/django-v2-v3/taint_test.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/django-v2-v3/taint_test.py
rename to python/ql/test/library-tests/frameworks/django-v2-v3/taint_test.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/testapp/__init__.py b/python/ql/test/library-tests/frameworks/django-v2-v3/testapp/__init__.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/django-v2-v3/testapp/__init__.py
rename to python/ql/test/library-tests/frameworks/django-v2-v3/testapp/__init__.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/testapp/admin.py b/python/ql/test/library-tests/frameworks/django-v2-v3/testapp/admin.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/django-v2-v3/testapp/admin.py
rename to python/ql/test/library-tests/frameworks/django-v2-v3/testapp/admin.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/testapp/apps.py b/python/ql/test/library-tests/frameworks/django-v2-v3/testapp/apps.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/django-v2-v3/testapp/apps.py
rename to python/ql/test/library-tests/frameworks/django-v2-v3/testapp/apps.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/testapp/migrations/__init__.py b/python/ql/test/library-tests/frameworks/django-v2-v3/testapp/migrations/__init__.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/django-v2-v3/testapp/migrations/__init__.py
rename to python/ql/test/library-tests/frameworks/django-v2-v3/testapp/migrations/__init__.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/testapp/models.py b/python/ql/test/library-tests/frameworks/django-v2-v3/testapp/models.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/django-v2-v3/testapp/models.py
rename to python/ql/test/library-tests/frameworks/django-v2-v3/testapp/models.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/testapp/tests.py b/python/ql/test/library-tests/frameworks/django-v2-v3/testapp/tests.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/django-v2-v3/testapp/tests.py
rename to python/ql/test/library-tests/frameworks/django-v2-v3/testapp/tests.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/testapp/urls.py b/python/ql/test/library-tests/frameworks/django-v2-v3/testapp/urls.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/django-v2-v3/testapp/urls.py
rename to python/ql/test/library-tests/frameworks/django-v2-v3/testapp/urls.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/testapp/views.py b/python/ql/test/library-tests/frameworks/django-v2-v3/testapp/views.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/django-v2-v3/testapp/views.py
rename to python/ql/test/library-tests/frameworks/django-v2-v3/testapp/views.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/testproj/__init__.py b/python/ql/test/library-tests/frameworks/django-v2-v3/testproj/__init__.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/django-v2-v3/testproj/__init__.py
rename to python/ql/test/library-tests/frameworks/django-v2-v3/testproj/__init__.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/testproj/asgi.py b/python/ql/test/library-tests/frameworks/django-v2-v3/testproj/asgi.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/django-v2-v3/testproj/asgi.py
rename to python/ql/test/library-tests/frameworks/django-v2-v3/testproj/asgi.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/testproj/settings.py b/python/ql/test/library-tests/frameworks/django-v2-v3/testproj/settings.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/django-v2-v3/testproj/settings.py
rename to python/ql/test/library-tests/frameworks/django-v2-v3/testproj/settings.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/testproj/urls.py b/python/ql/test/library-tests/frameworks/django-v2-v3/testproj/urls.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/django-v2-v3/testproj/urls.py
rename to python/ql/test/library-tests/frameworks/django-v2-v3/testproj/urls.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/testproj/wsgi.py b/python/ql/test/library-tests/frameworks/django-v2-v3/testproj/wsgi.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/django-v2-v3/testproj/wsgi.py
rename to python/ql/test/library-tests/frameworks/django-v2-v3/testproj/wsgi.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/django/ConceptsTest.expected b/python/ql/test/library-tests/frameworks/django/ConceptsTest.expected
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/django/ConceptsTest.expected
rename to python/ql/test/library-tests/frameworks/django/ConceptsTest.expected
diff --git a/python/ql/test/experimental/library-tests/frameworks/django/ConceptsTest.ql b/python/ql/test/library-tests/frameworks/django/ConceptsTest.ql
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/django/ConceptsTest.ql
rename to python/ql/test/library-tests/frameworks/django/ConceptsTest.ql
diff --git a/python/ql/test/experimental/library-tests/frameworks/django/SqlExecution.py b/python/ql/test/library-tests/frameworks/django/SqlExecution.py
similarity index 88%
rename from python/ql/test/experimental/library-tests/frameworks/django/SqlExecution.py
rename to python/ql/test/library-tests/frameworks/django/SqlExecution.py
index 67a6ee81a5d..449983fc898 100644
--- a/python/ql/test/experimental/library-tests/frameworks/django/SqlExecution.py
+++ b/python/ql/test/library-tests/frameworks/django/SqlExecution.py
@@ -27,3 +27,6 @@ def test_model():
 
     raw = RawSQL("so raw")
     User.objects.annotate(val=raw)  # $getSql="so raw"
+
+    # chaining QuerySet calls
+    User.objects.using("db-name").exclude(username="admin").extra("some sql") # $ getSql="some sql"
diff --git a/python/ql/test/experimental/library-tests/frameworks/fabric/ConceptsTest.expected b/python/ql/test/library-tests/frameworks/fabric/ConceptsTest.expected
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/fabric/ConceptsTest.expected
rename to python/ql/test/library-tests/frameworks/fabric/ConceptsTest.expected
diff --git a/python/ql/test/experimental/library-tests/frameworks/fabric/ConceptsTest.ql b/python/ql/test/library-tests/frameworks/fabric/ConceptsTest.ql
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/fabric/ConceptsTest.ql
rename to python/ql/test/library-tests/frameworks/fabric/ConceptsTest.ql
diff --git a/python/ql/test/experimental/library-tests/frameworks/fabric/TestTaint.expected b/python/ql/test/library-tests/frameworks/fabric/TestTaint.expected
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/fabric/TestTaint.expected
rename to python/ql/test/library-tests/frameworks/fabric/TestTaint.expected
diff --git a/python/ql/test/experimental/library-tests/frameworks/fabric/TestTaint.ql b/python/ql/test/library-tests/frameworks/fabric/TestTaint.ql
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/fabric/TestTaint.ql
rename to python/ql/test/library-tests/frameworks/fabric/TestTaint.ql
diff --git a/python/ql/test/experimental/library-tests/frameworks/fabric/fabric_v1_execute.py b/python/ql/test/library-tests/frameworks/fabric/fabric_v1_execute.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/fabric/fabric_v1_execute.py
rename to python/ql/test/library-tests/frameworks/fabric/fabric_v1_execute.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/fabric/fabric_v1_test.py b/python/ql/test/library-tests/frameworks/fabric/fabric_v1_test.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/fabric/fabric_v1_test.py
rename to python/ql/test/library-tests/frameworks/fabric/fabric_v1_test.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/fabric/fabric_v2_test.py b/python/ql/test/library-tests/frameworks/fabric/fabric_v2_test.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/fabric/fabric_v2_test.py
rename to python/ql/test/library-tests/frameworks/fabric/fabric_v2_test.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/flask/ConceptsTest.expected b/python/ql/test/library-tests/frameworks/flask/ConceptsTest.expected
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/flask/ConceptsTest.expected
rename to python/ql/test/library-tests/frameworks/flask/ConceptsTest.expected
diff --git a/python/ql/test/experimental/library-tests/frameworks/flask/ConceptsTest.ql b/python/ql/test/library-tests/frameworks/flask/ConceptsTest.ql
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/flask/ConceptsTest.ql
rename to python/ql/test/library-tests/frameworks/flask/ConceptsTest.ql
diff --git a/python/ql/test/library-tests/frameworks/flask/TestTaint.expected b/python/ql/test/library-tests/frameworks/flask/TestTaint.expected
new file mode 100644
index 00000000000..1d514b934e2
--- /dev/null
+++ b/python/ql/test/library-tests/frameworks/flask/TestTaint.expected
@@ -0,0 +1,106 @@
+| taint_test.py:6 | ok   | test_taint | name |
+| taint_test.py:6 | ok   | test_taint | number |
+| taint_test.py:7 | ok   | test_taint | foo |
+| taint_test.py:14 | ok   | test_taint | request.environ |
+| taint_test.py:15 | ok   | test_taint | request.environ.get(..) |
+| taint_test.py:17 | ok   | test_taint | request.path |
+| taint_test.py:18 | ok   | test_taint | request.full_path |
+| taint_test.py:19 | ok   | test_taint | request.base_url |
+| taint_test.py:20 | ok   | test_taint | request.url |
+| taint_test.py:23 | fail | test_taint | request.accept_charsets.best |
+| taint_test.py:24 | fail | test_taint | request.accept_charsets.best_match(..) |
+| taint_test.py:25 | ok   | test_taint | request.accept_charsets[0] |
+| taint_test.py:26 | ok   | test_taint | request.accept_encodings |
+| taint_test.py:27 | ok   | test_taint | request.accept_languages |
+| taint_test.py:28 | ok   | test_taint | request.accept_mimetypes |
+| taint_test.py:31 | ok   | test_taint | request.access_control_request_headers |
+| taint_test.py:33 | ok   | test_taint | request.access_control_request_method |
+| taint_test.py:35 | ok   | test_taint | request.access_route |
+| taint_test.py:36 | ok   | test_taint | request.access_route[0] |
+| taint_test.py:39 | ok   | test_taint | request.args |
+| taint_test.py:40 | ok   | test_taint | request.args['key'] |
+| taint_test.py:41 | ok   | test_taint | request.args.get(..) |
+| taint_test.py:42 | ok   | test_taint | request.args.getlist(..) |
+| taint_test.py:45 | ok   | test_taint | request.authorization |
+| taint_test.py:46 | ok   | test_taint | request.authorization['username'] |
+| taint_test.py:47 | fail | test_taint | request.authorization.username |
+| taint_test.py:50 | ok   | test_taint | request.cache_control |
+| taint_test.py:52 | fail | test_taint | request.cache_control.max_age |
+| taint_test.py:53 | fail | test_taint | request.cache_control.max_stale |
+| taint_test.py:54 | fail | test_taint | request.cache_control.min_fresh |
+| taint_test.py:56 | ok   | test_taint | request.content_encoding |
+| taint_test.py:58 | ok   | test_taint | request.content_md5 |
+| taint_test.py:60 | ok   | test_taint | request.content_type |
+| taint_test.py:63 | ok   | test_taint | request.cookies |
+| taint_test.py:64 | ok   | test_taint | request.cookies['key'] |
+| taint_test.py:66 | ok   | test_taint | request.data |
+| taint_test.py:69 | ok   | test_taint | request.files |
+| taint_test.py:70 | ok   | test_taint | request.files['key'] |
+| taint_test.py:71 | fail | test_taint | request.files['key'].filename |
+| taint_test.py:72 | fail | test_taint | request.files['key'].stream |
+| taint_test.py:73 | ok   | test_taint | request.files.get(..) |
+| taint_test.py:74 | fail | test_taint | request.files.get(..).filename |
+| taint_test.py:75 | fail | test_taint | request.files.get(..).stream |
+| taint_test.py:76 | ok   | test_taint | request.files.getlist(..) |
+| taint_test.py:77 | fail | test_taint | request.files.getlist(..)[0].filename |
+| taint_test.py:78 | fail | test_taint | request.files.getlist(..)[0].stream |
+| taint_test.py:81 | ok   | test_taint | request.form |
+| taint_test.py:82 | ok   | test_taint | request.form['key'] |
+| taint_test.py:83 | ok   | test_taint | request.form.get(..) |
+| taint_test.py:84 | ok   | test_taint | request.form.getlist(..) |
+| taint_test.py:86 | ok   | test_taint | request.get_data() |
+| taint_test.py:88 | ok   | test_taint | request.get_json() |
+| taint_test.py:89 | ok   | test_taint | request.get_json()['foo'] |
+| taint_test.py:90 | ok   | test_taint | request.get_json()['foo']['bar'] |
+| taint_test.py:94 | ok   | test_taint | request.headers |
+| taint_test.py:95 | ok   | test_taint | request.headers['key'] |
+| taint_test.py:96 | ok   | test_taint | request.headers.get(..) |
+| taint_test.py:97 | fail | test_taint | request.headers.get_all(..) |
+| taint_test.py:98 | fail | test_taint | request.headers.getlist(..) |
+| taint_test.py:99 | ok   | test_taint | list(..) |
+| taint_test.py:100 | fail | test_taint | request.headers.to_wsgi_list() |
+| taint_test.py:102 | ok   | test_taint | request.json |
+| taint_test.py:103 | ok   | test_taint | request.json['foo'] |
+| taint_test.py:104 | ok   | test_taint | request.json['foo']['bar'] |
+| taint_test.py:106 | ok   | test_taint | request.method |
+| taint_test.py:108 | ok   | test_taint | request.mimetype |
+| taint_test.py:110 | ok   | test_taint | request.mimetype_params |
+| taint_test.py:112 | ok   | test_taint | request.origin |
+| taint_test.py:115 | ok   | test_taint | request.pragma |
+| taint_test.py:117 | ok   | test_taint | request.query_string |
+| taint_test.py:119 | ok   | test_taint | request.referrer |
+| taint_test.py:121 | ok   | test_taint | request.remote_addr |
+| taint_test.py:123 | ok   | test_taint | request.remote_user |
+| taint_test.py:126 | ok   | test_taint | request.stream |
+| taint_test.py:127 | ok   | test_taint | request.input_stream |
+| taint_test.py:129 | ok   | test_taint | request.url |
+| taint_test.py:131 | ok   | test_taint | request.user_agent |
+| taint_test.py:134 | ok   | test_taint | request.values |
+| taint_test.py:135 | ok   | test_taint | request.values['key'] |
+| taint_test.py:136 | ok   | test_taint | request.values.get(..) |
+| taint_test.py:137 | ok   | test_taint | request.values.getlist(..) |
+| taint_test.py:140 | ok   | test_taint | request.view_args |
+| taint_test.py:141 | ok   | test_taint | request.view_args['key'] |
+| taint_test.py:142 | ok   | test_taint | request.view_args.get(..) |
+| taint_test.py:146 | ok   | test_taint | request.script_root |
+| taint_test.py:147 | ok   | test_taint | request.url_root |
+| taint_test.py:151 | ok   | test_taint | request.charset |
+| taint_test.py:152 | ok   | test_taint | request.url_charset |
+| taint_test.py:156 | ok   | test_taint | request.date |
+| taint_test.py:159 | ok   | test_taint | request.endpoint |
+| taint_test.py:164 | ok   | test_taint | request.host |
+| taint_test.py:165 | ok   | test_taint | request.host_url |
+| taint_test.py:167 | ok   | test_taint | request.scheme |
+| taint_test.py:169 | ok   | test_taint | request.script_root |
+| taint_test.py:177 | ok   | test_taint | request.args |
+| taint_test.py:178 | ok   | test_taint | a |
+| taint_test.py:179 | ok   | test_taint | b |
+| taint_test.py:181 | ok   | test_taint | request.args['key'] |
+| taint_test.py:182 | ok   | test_taint | a['key'] |
+| taint_test.py:183 | ok   | test_taint | b['key'] |
+| taint_test.py:185 | ok   | test_taint | request.args.getlist(..) |
+| taint_test.py:186 | ok   | test_taint | a.getlist(..) |
+| taint_test.py:187 | ok   | test_taint | b.getlist(..) |
+| taint_test.py:188 | ok   | test_taint | gl(..) |
+| taint_test.py:195 | ok   | test_taint | req.path |
+| taint_test.py:196 | ok   | test_taint | gd() |
diff --git a/python/ql/test/experimental/library-tests/frameworks/flask/TestTaint.ql b/python/ql/test/library-tests/frameworks/flask/TestTaint.ql
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/flask/TestTaint.ql
rename to python/ql/test/library-tests/frameworks/flask/TestTaint.ql
diff --git a/python/ql/test/experimental/library-tests/frameworks/flask/external_blueprint.py b/python/ql/test/library-tests/frameworks/flask/external_blueprint.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/flask/external_blueprint.py
rename to python/ql/test/library-tests/frameworks/flask/external_blueprint.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/flask/old_test.py b/python/ql/test/library-tests/frameworks/flask/old_test.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/flask/old_test.py
rename to python/ql/test/library-tests/frameworks/flask/old_test.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/flask/response_test.py b/python/ql/test/library-tests/frameworks/flask/response_test.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/flask/response_test.py
rename to python/ql/test/library-tests/frameworks/flask/response_test.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/flask/routing_test.py b/python/ql/test/library-tests/frameworks/flask/routing_test.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/flask/routing_test.py
rename to python/ql/test/library-tests/frameworks/flask/routing_test.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/flask/taint_test.py b/python/ql/test/library-tests/frameworks/flask/taint_test.py
similarity index 96%
rename from python/ql/test/experimental/library-tests/frameworks/flask/taint_test.py
rename to python/ql/test/library-tests/frameworks/flask/taint_test.py
index 31c0c7e6121..986bbcfec79 100644
--- a/python/ql/test/experimental/library-tests/frameworks/flask/taint_test.py
+++ b/python/ql/test/library-tests/frameworks/flask/taint_test.py
@@ -38,6 +38,7 @@ def test_taint(name = "World!", number="0", foo="foo"):  # $requestHandler route
         # By default werkzeug.datastructures.ImmutableMultiDict -- although can be changed :\
         request.args,
         request.args['key'],
+        request.args.get('key'),
         request.args.getlist('key'),
 
         # werkzeug.datastructures.Authorization (a dict, with some properties)
@@ -69,6 +70,9 @@ def test_taint(name = "World!", number="0", foo="foo"):  # $requestHandler route
         request.files['key'],
         request.files['key'].filename,
         request.files['key'].stream,
+        request.files.get('key'),
+        request.files.get('key').filename,
+        request.files.get('key').stream,
         request.files.getlist('key'),
         request.files.getlist('key')[0].filename,
         request.files.getlist('key')[0].stream,
@@ -76,6 +80,7 @@ def test_taint(name = "World!", number="0", foo="foo"):  # $requestHandler route
         # By default werkzeug.datastructures.ImmutableMultiDict -- although can be changed :\
         request.form,
         request.form['key'],
+        request.form.get('key'),
         request.form.getlist('key'),
 
         request.get_data(),
@@ -88,6 +93,7 @@ def test_taint(name = "World!", number="0", foo="foo"):  # $requestHandler route
         # which has same interface as werkzeug.datastructures.Headers
         request.headers,
         request.headers['key'],
+        request.headers.get('key'),
         request.headers.get_all('key'),
         request.headers.getlist('key'),
         list(request.headers), # (k, v) list
@@ -127,11 +133,13 @@ def test_taint(name = "World!", number="0", foo="foo"):  # $requestHandler route
         # werkzeug.datastructures.CombinedMultiDict, which is basically just a werkzeug.datastructures.MultiDict
         request.values,
         request.values['key'],
+        request.values.get('key'),
         request.values.getlist('key'),
 
         # dict
         request.view_args,
         request.view_args['key'],
+        request.view_args.get('key'),
     )
 
     ensure_not_tainted(
diff --git a/python/ql/test/experimental/library-tests/frameworks/invoke/ConceptsTest.expected b/python/ql/test/library-tests/frameworks/invoke/ConceptsTest.expected
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/invoke/ConceptsTest.expected
rename to python/ql/test/library-tests/frameworks/invoke/ConceptsTest.expected
diff --git a/python/ql/test/experimental/library-tests/frameworks/invoke/ConceptsTest.ql b/python/ql/test/library-tests/frameworks/invoke/ConceptsTest.ql
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/invoke/ConceptsTest.ql
rename to python/ql/test/library-tests/frameworks/invoke/ConceptsTest.ql
diff --git a/python/ql/test/experimental/library-tests/frameworks/invoke/invoke_test.py b/python/ql/test/library-tests/frameworks/invoke/invoke_test.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/invoke/invoke_test.py
rename to python/ql/test/library-tests/frameworks/invoke/invoke_test.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/modeling-example/NaiveModel.expected b/python/ql/test/library-tests/frameworks/modeling-example/NaiveModel.expected
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/modeling-example/NaiveModel.expected
rename to python/ql/test/library-tests/frameworks/modeling-example/NaiveModel.expected
diff --git a/python/ql/test/experimental/library-tests/frameworks/modeling-example/NaiveModel.ql b/python/ql/test/library-tests/frameworks/modeling-example/NaiveModel.ql
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/modeling-example/NaiveModel.ql
rename to python/ql/test/library-tests/frameworks/modeling-example/NaiveModel.ql
diff --git a/python/ql/test/experimental/library-tests/frameworks/modeling-example/ProperModel.expected b/python/ql/test/library-tests/frameworks/modeling-example/ProperModel.expected
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/modeling-example/ProperModel.expected
rename to python/ql/test/library-tests/frameworks/modeling-example/ProperModel.expected
diff --git a/python/ql/test/experimental/library-tests/frameworks/modeling-example/ProperModel.ql b/python/ql/test/library-tests/frameworks/modeling-example/ProperModel.ql
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/modeling-example/ProperModel.ql
rename to python/ql/test/library-tests/frameworks/modeling-example/ProperModel.ql
diff --git a/python/ql/test/experimental/library-tests/frameworks/modeling-example/README.md b/python/ql/test/library-tests/frameworks/modeling-example/README.md
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/modeling-example/README.md
rename to python/ql/test/library-tests/frameworks/modeling-example/README.md
diff --git a/python/ql/test/experimental/library-tests/frameworks/modeling-example/SharedCode.qll b/python/ql/test/library-tests/frameworks/modeling-example/SharedCode.qll
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/modeling-example/SharedCode.qll
rename to python/ql/test/library-tests/frameworks/modeling-example/SharedCode.qll
diff --git a/python/ql/test/experimental/library-tests/frameworks/modeling-example/test.py b/python/ql/test/library-tests/frameworks/modeling-example/test.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/modeling-example/test.py
rename to python/ql/test/library-tests/frameworks/modeling-example/test.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/mysql-connector-python/ConceptsTest.expected b/python/ql/test/library-tests/frameworks/mysql-connector-python/ConceptsTest.expected
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/mysql-connector-python/ConceptsTest.expected
rename to python/ql/test/library-tests/frameworks/mysql-connector-python/ConceptsTest.expected
diff --git a/python/ql/test/experimental/library-tests/frameworks/mysql-connector-python/ConceptsTest.ql b/python/ql/test/library-tests/frameworks/mysql-connector-python/ConceptsTest.ql
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/mysql-connector-python/ConceptsTest.ql
rename to python/ql/test/library-tests/frameworks/mysql-connector-python/ConceptsTest.ql
diff --git a/python/ql/test/experimental/library-tests/frameworks/mysql-connector-python/pep249.py b/python/ql/test/library-tests/frameworks/mysql-connector-python/pep249.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/mysql-connector-python/pep249.py
rename to python/ql/test/library-tests/frameworks/mysql-connector-python/pep249.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/mysqldb/ConceptsTest.expected b/python/ql/test/library-tests/frameworks/mysqldb/ConceptsTest.expected
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/mysqldb/ConceptsTest.expected
rename to python/ql/test/library-tests/frameworks/mysqldb/ConceptsTest.expected
diff --git a/python/ql/test/experimental/library-tests/frameworks/mysqldb/ConceptsTest.ql b/python/ql/test/library-tests/frameworks/mysqldb/ConceptsTest.ql
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/mysqldb/ConceptsTest.ql
rename to python/ql/test/library-tests/frameworks/mysqldb/ConceptsTest.ql
diff --git a/python/ql/test/experimental/library-tests/frameworks/mysqldb/pep249.py b/python/ql/test/library-tests/frameworks/mysqldb/pep249.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/mysqldb/pep249.py
rename to python/ql/test/library-tests/frameworks/mysqldb/pep249.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/pymysql/ConceptsTest.expected b/python/ql/test/library-tests/frameworks/pymysql/ConceptsTest.expected
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/pymysql/ConceptsTest.expected
rename to python/ql/test/library-tests/frameworks/pymysql/ConceptsTest.expected
diff --git a/python/ql/test/experimental/library-tests/frameworks/pymysql/ConceptsTest.ql b/python/ql/test/library-tests/frameworks/pymysql/ConceptsTest.ql
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/pymysql/ConceptsTest.ql
rename to python/ql/test/library-tests/frameworks/pymysql/ConceptsTest.ql
diff --git a/python/ql/test/experimental/library-tests/frameworks/pymysql/pep249.py b/python/ql/test/library-tests/frameworks/pymysql/pep249.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/pymysql/pep249.py
rename to python/ql/test/library-tests/frameworks/pymysql/pep249.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/stdlib-py2/CodeExecution.py b/python/ql/test/library-tests/frameworks/stdlib-py2/CodeExecution.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/stdlib-py2/CodeExecution.py
rename to python/ql/test/library-tests/frameworks/stdlib-py2/CodeExecution.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/stdlib-py2/ConceptsTest.expected b/python/ql/test/library-tests/frameworks/stdlib-py2/ConceptsTest.expected
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/stdlib-py2/ConceptsTest.expected
rename to python/ql/test/library-tests/frameworks/stdlib-py2/ConceptsTest.expected
diff --git a/python/ql/test/experimental/library-tests/frameworks/stdlib-py2/ConceptsTest.ql b/python/ql/test/library-tests/frameworks/stdlib-py2/ConceptsTest.ql
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/stdlib-py2/ConceptsTest.ql
rename to python/ql/test/library-tests/frameworks/stdlib-py2/ConceptsTest.ql
diff --git a/python/ql/test/experimental/library-tests/frameworks/stdlib-py2/SystemCommandExecution.py b/python/ql/test/library-tests/frameworks/stdlib-py2/SystemCommandExecution.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/stdlib-py2/SystemCommandExecution.py
rename to python/ql/test/library-tests/frameworks/stdlib-py2/SystemCommandExecution.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/stdlib-py2/options b/python/ql/test/library-tests/frameworks/stdlib-py2/options
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/stdlib-py2/options
rename to python/ql/test/library-tests/frameworks/stdlib-py2/options
diff --git a/python/ql/test/experimental/library-tests/frameworks/stdlib-py3/CodeExecution.py b/python/ql/test/library-tests/frameworks/stdlib-py3/CodeExecution.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/stdlib-py3/CodeExecution.py
rename to python/ql/test/library-tests/frameworks/stdlib-py3/CodeExecution.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/stdlib-py3/ConceptsTest.expected b/python/ql/test/library-tests/frameworks/stdlib-py3/ConceptsTest.expected
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/stdlib-py3/ConceptsTest.expected
rename to python/ql/test/library-tests/frameworks/stdlib-py3/ConceptsTest.expected
diff --git a/python/ql/test/experimental/library-tests/frameworks/stdlib-py3/ConceptsTest.ql b/python/ql/test/library-tests/frameworks/stdlib-py3/ConceptsTest.ql
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/stdlib-py3/ConceptsTest.ql
rename to python/ql/test/library-tests/frameworks/stdlib-py3/ConceptsTest.ql
diff --git a/python/ql/test/experimental/library-tests/frameworks/stdlib-py3/Decoding.py b/python/ql/test/library-tests/frameworks/stdlib-py3/Decoding.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/stdlib-py3/Decoding.py
rename to python/ql/test/library-tests/frameworks/stdlib-py3/Decoding.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/stdlib-py3/Encoding.py b/python/ql/test/library-tests/frameworks/stdlib-py3/Encoding.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/stdlib-py3/Encoding.py
rename to python/ql/test/library-tests/frameworks/stdlib-py3/Encoding.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/stdlib-py3/options b/python/ql/test/library-tests/frameworks/stdlib-py3/options
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/stdlib-py3/options
rename to python/ql/test/library-tests/frameworks/stdlib-py3/options
diff --git a/python/ql/test/experimental/library-tests/frameworks/stdlib/CodeExecution.py b/python/ql/test/library-tests/frameworks/stdlib/CodeExecution.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/stdlib/CodeExecution.py
rename to python/ql/test/library-tests/frameworks/stdlib/CodeExecution.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/stdlib/CodeExecutionPossibleFP1.py b/python/ql/test/library-tests/frameworks/stdlib/CodeExecutionPossibleFP1.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/stdlib/CodeExecutionPossibleFP1.py
rename to python/ql/test/library-tests/frameworks/stdlib/CodeExecutionPossibleFP1.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/stdlib/CodeExecutionPossibleFP2.py b/python/ql/test/library-tests/frameworks/stdlib/CodeExecutionPossibleFP2.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/stdlib/CodeExecutionPossibleFP2.py
rename to python/ql/test/library-tests/frameworks/stdlib/CodeExecutionPossibleFP2.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/stdlib/CodeExecutionPossibleFP3.py b/python/ql/test/library-tests/frameworks/stdlib/CodeExecutionPossibleFP3.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/stdlib/CodeExecutionPossibleFP3.py
rename to python/ql/test/library-tests/frameworks/stdlib/CodeExecutionPossibleFP3.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/stdlib/ConceptsTest.expected b/python/ql/test/library-tests/frameworks/stdlib/ConceptsTest.expected
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/stdlib/ConceptsTest.expected
rename to python/ql/test/library-tests/frameworks/stdlib/ConceptsTest.expected
diff --git a/python/ql/test/experimental/library-tests/frameworks/stdlib/ConceptsTest.ql b/python/ql/test/library-tests/frameworks/stdlib/ConceptsTest.ql
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/stdlib/ConceptsTest.ql
rename to python/ql/test/library-tests/frameworks/stdlib/ConceptsTest.ql
diff --git a/python/ql/test/experimental/library-tests/frameworks/stdlib/Decoding.py b/python/ql/test/library-tests/frameworks/stdlib/Decoding.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/stdlib/Decoding.py
rename to python/ql/test/library-tests/frameworks/stdlib/Decoding.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/stdlib/Encoding.py b/python/ql/test/library-tests/frameworks/stdlib/Encoding.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/stdlib/Encoding.py
rename to python/ql/test/library-tests/frameworks/stdlib/Encoding.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/stdlib/FileSystemAccess.py b/python/ql/test/library-tests/frameworks/stdlib/FileSystemAccess.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/stdlib/FileSystemAccess.py
rename to python/ql/test/library-tests/frameworks/stdlib/FileSystemAccess.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/stdlib/PathNormalization.py b/python/ql/test/library-tests/frameworks/stdlib/PathNormalization.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/stdlib/PathNormalization.py
rename to python/ql/test/library-tests/frameworks/stdlib/PathNormalization.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/stdlib/SafeAccessCheck.py b/python/ql/test/library-tests/frameworks/stdlib/SafeAccessCheck.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/stdlib/SafeAccessCheck.py
rename to python/ql/test/library-tests/frameworks/stdlib/SafeAccessCheck.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/stdlib/SystemCommandExecution.py b/python/ql/test/library-tests/frameworks/stdlib/SystemCommandExecution.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/stdlib/SystemCommandExecution.py
rename to python/ql/test/library-tests/frameworks/stdlib/SystemCommandExecution.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/stdlib/TestTaint.expected b/python/ql/test/library-tests/frameworks/stdlib/TestTaint.expected
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/stdlib/TestTaint.expected
rename to python/ql/test/library-tests/frameworks/stdlib/TestTaint.expected
diff --git a/python/ql/test/experimental/library-tests/frameworks/stdlib/TestTaint.ql b/python/ql/test/library-tests/frameworks/stdlib/TestTaint.ql
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/stdlib/TestTaint.ql
rename to python/ql/test/library-tests/frameworks/stdlib/TestTaint.ql
diff --git a/python/ql/test/experimental/library-tests/frameworks/stdlib/http_server.py b/python/ql/test/library-tests/frameworks/stdlib/http_server.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/stdlib/http_server.py
rename to python/ql/test/library-tests/frameworks/stdlib/http_server.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/stdlib/pep249.py b/python/ql/test/library-tests/frameworks/stdlib/pep249.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/stdlib/pep249.py
rename to python/ql/test/library-tests/frameworks/stdlib/pep249.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/tornado/ConceptsTest.expected b/python/ql/test/library-tests/frameworks/tornado/ConceptsTest.expected
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/tornado/ConceptsTest.expected
rename to python/ql/test/library-tests/frameworks/tornado/ConceptsTest.expected
diff --git a/python/ql/test/experimental/library-tests/frameworks/tornado/ConceptsTest.ql b/python/ql/test/library-tests/frameworks/tornado/ConceptsTest.ql
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/tornado/ConceptsTest.ql
rename to python/ql/test/library-tests/frameworks/tornado/ConceptsTest.ql
diff --git a/python/ql/test/experimental/library-tests/frameworks/tornado/README.md b/python/ql/test/library-tests/frameworks/tornado/README.md
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/tornado/README.md
rename to python/ql/test/library-tests/frameworks/tornado/README.md
diff --git a/python/ql/test/experimental/library-tests/frameworks/tornado/TestTaint.expected b/python/ql/test/library-tests/frameworks/tornado/TestTaint.expected
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/tornado/TestTaint.expected
rename to python/ql/test/library-tests/frameworks/tornado/TestTaint.expected
diff --git a/python/ql/test/experimental/library-tests/frameworks/tornado/TestTaint.ql b/python/ql/test/library-tests/frameworks/tornado/TestTaint.ql
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/tornado/TestTaint.ql
rename to python/ql/test/library-tests/frameworks/tornado/TestTaint.ql
diff --git a/python/ql/test/experimental/library-tests/frameworks/tornado/basic.py b/python/ql/test/library-tests/frameworks/tornado/basic.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/tornado/basic.py
rename to python/ql/test/library-tests/frameworks/tornado/basic.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/tornado/options b/python/ql/test/library-tests/frameworks/tornado/options
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/tornado/options
rename to python/ql/test/library-tests/frameworks/tornado/options
diff --git a/python/ql/test/experimental/library-tests/frameworks/tornado/response_test.py b/python/ql/test/library-tests/frameworks/tornado/response_test.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/tornado/response_test.py
rename to python/ql/test/library-tests/frameworks/tornado/response_test.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/tornado/routing_test.py b/python/ql/test/library-tests/frameworks/tornado/routing_test.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/tornado/routing_test.py
rename to python/ql/test/library-tests/frameworks/tornado/routing_test.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/tornado/taint_test.py b/python/ql/test/library-tests/frameworks/tornado/taint_test.py
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/tornado/taint_test.py
rename to python/ql/test/library-tests/frameworks/tornado/taint_test.py
diff --git a/python/ql/test/experimental/library-tests/frameworks/yaml/ConceptsTest.expected b/python/ql/test/library-tests/frameworks/yaml/ConceptsTest.expected
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/yaml/ConceptsTest.expected
rename to python/ql/test/library-tests/frameworks/yaml/ConceptsTest.expected
diff --git a/python/ql/test/experimental/library-tests/frameworks/yaml/ConceptsTest.ql b/python/ql/test/library-tests/frameworks/yaml/ConceptsTest.ql
similarity index 100%
rename from python/ql/test/experimental/library-tests/frameworks/yaml/ConceptsTest.ql
rename to python/ql/test/library-tests/frameworks/yaml/ConceptsTest.ql
diff --git a/python/ql/test/library-tests/frameworks/yaml/Decoding.py b/python/ql/test/library-tests/frameworks/yaml/Decoding.py
new file mode 100644
index 00000000000..987ea76552a
--- /dev/null
+++ b/python/ql/test/library-tests/frameworks/yaml/Decoding.py
@@ -0,0 +1,37 @@
+import yaml
+
+# Unsafe:
+yaml.load(payload)  # $decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML decodeMayExecuteInput
+yaml.load(payload, yaml.Loader)  # $decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML decodeMayExecuteInput
+yaml.unsafe_load(payload) # $ decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML decodeMayExecuteInput
+yaml.full_load(payload) # $ decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML decodeMayExecuteInput
+
+# Safe:
+yaml.load(payload, yaml.SafeLoader)  # $ decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML
+yaml.load(payload, Loader=yaml.SafeLoader)  # $decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML
+yaml.load(payload, yaml.BaseLoader)  # $decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML
+yaml.safe_load(payload) # $ decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML
+
+################################################################################
+# load_all variants
+################################################################################
+
+# Unsafe:
+yaml.load_all(payload) # $ decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML decodeMayExecuteInput
+yaml.unsafe_load_all(payload) # $ decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML decodeMayExecuteInput
+yaml.full_load_all(payload) # $ decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML decodeMayExecuteInput
+
+# Safe:
+yaml.safe_load_all(payload) # $ decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML
+
+################################################################################
+# C-based loaders with `libyaml`
+################################################################################
+
+# Unsafe:
+yaml.load(payload, yaml.CLoader)  # $ decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML decodeMayExecuteInput
+yaml.load(payload, yaml.CFullLoader)  # $ decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML decodeMayExecuteInput
+
+# Safe:
+yaml.load(payload, yaml.CSafeLoader)  # $decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML
+yaml.load(payload, yaml.CBaseLoader)  # $decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML
diff --git a/python/ql/test/library-tests/modules/__all__/DeclaredInAll.expected b/python/ql/test/library-tests/modules/__all__/DeclaredInAll.expected
new file mode 100644
index 00000000000..86591566217
--- /dev/null
+++ b/python/ql/test/library-tests/modules/__all__/DeclaredInAll.expected
@@ -0,0 +1,5 @@
+| all_dynamic.py:0:0:0:0 | Module all_dynamic | foo |
+| all_list.py:0:0:0:0 | Module all_list | bar |
+| all_list.py:0:0:0:0 | Module all_list | foo |
+| all_tuple.py:0:0:0:0 | Module all_tuple | bar |
+| all_tuple.py:0:0:0:0 | Module all_tuple | foo |
diff --git a/python/ql/test/library-tests/modules/__all__/DeclaredInAll.ql b/python/ql/test/library-tests/modules/__all__/DeclaredInAll.ql
new file mode 100644
index 00000000000..69f9d32f856
--- /dev/null
+++ b/python/ql/test/library-tests/modules/__all__/DeclaredInAll.ql
@@ -0,0 +1,5 @@
+import python
+
+from Module mod, string name
+where mod.declaredInAll(name)
+select mod, name
diff --git a/python/ql/test/library-tests/modules/__all__/all_dynamic.py b/python/ql/test/library-tests/modules/__all__/all_dynamic.py
new file mode 100644
index 00000000000..5213418328d
--- /dev/null
+++ b/python/ql/test/library-tests/modules/__all__/all_dynamic.py
@@ -0,0 +1,8 @@
+foo = "foo"
+bar = "bar"
+baz = "baz"
+
+
+__all__ = ["foo"]
+
+__all__ += ["bar"]
diff --git a/python/ql/test/library-tests/modules/__all__/all_indirect.py b/python/ql/test/library-tests/modules/__all__/all_indirect.py
new file mode 100644
index 00000000000..ddc4ec94a16
--- /dev/null
+++ b/python/ql/test/library-tests/modules/__all__/all_indirect.py
@@ -0,0 +1,9 @@
+# I (@RasmusWL) have not seen anyone use this pattern in real code,
+# so this example is only included for completeness.
+foo = "foo"
+bar = "bar"
+baz = "baz"
+
+
+temp = ["foo", "bar"]
+__all__ = temp
diff --git a/python/ql/test/library-tests/modules/__all__/all_list.py b/python/ql/test/library-tests/modules/__all__/all_list.py
new file mode 100644
index 00000000000..d2ecda63db4
--- /dev/null
+++ b/python/ql/test/library-tests/modules/__all__/all_list.py
@@ -0,0 +1,6 @@
+foo = "foo"
+bar = "bar"
+baz = "baz"
+
+
+__all__ = ["foo", "bar"]
diff --git a/python/ql/test/library-tests/modules/__all__/all_set.py b/python/ql/test/library-tests/modules/__all__/all_set.py
new file mode 100644
index 00000000000..bbd7d0d4c59
--- /dev/null
+++ b/python/ql/test/library-tests/modules/__all__/all_set.py
@@ -0,0 +1,6 @@
+foo = "foo"
+bar = "bar"
+baz = "baz"
+
+
+__all__ = {"foo", "bar"}
diff --git a/python/ql/test/library-tests/modules/__all__/all_tuple.py b/python/ql/test/library-tests/modules/__all__/all_tuple.py
new file mode 100644
index 00000000000..b06def5ddb7
--- /dev/null
+++ b/python/ql/test/library-tests/modules/__all__/all_tuple.py
@@ -0,0 +1,6 @@
+foo = "foo"
+bar = "bar"
+baz = "baz"
+
+
+__all__ = ("foo", "bar")
diff --git a/python/ql/test/library-tests/modules/__all__/main.py b/python/ql/test/library-tests/modules/__all__/main.py
new file mode 100644
index 00000000000..85a642ebc21
--- /dev/null
+++ b/python/ql/test/library-tests/modules/__all__/main.py
@@ -0,0 +1,90 @@
+# This file showcases how imports work with `__all__`.
+#
+# TL;DR; in `from <module> import *`, if `__all__` is defined in `<module>`, then only
+# the names in `__all__` will be imported -- otherwise all names that doesn't begin with
+# an underscore will be imported.
+#
+# If `__all__` is defined, `__all__` must be a sequence for `from <module> import *` to work.
+#
+# https://docs.python.org/3/reference/simple_stmts.html#the-import-statement
+# https://docs.python.org/3/glossary.html#term-sequence
+
+print("import *")
+print("---")
+
+from no_all import *
+print("no_all.py")
+print("  foo={!r}".format(foo))
+print("  bar={!r}".format(bar))
+print("  baz={!r}".format(baz))
+try:
+    print("  _qux={!r}".format(_qux))
+except NameError:
+    print("  _qux not imported")
+del foo, bar, baz
+
+from all_list import *
+print("all_list.py")
+print("  foo={!r}".format(foo))
+print("  bar={!r}".format(bar))
+try:
+    print("  baz={!r}".format(baz))
+except NameError:
+    print("  baz not imported")
+del foo, bar
+
+from all_tuple import *
+print("all_tuple.py")
+print("  foo={!r}".format(foo))
+print("  bar={!r}".format(bar))
+try:
+    print("  baz={!r}".format(baz))
+except NameError:
+    print("  baz not imported")
+del foo, bar
+
+from all_dynamic import *
+print("all_dynamic.py")
+print("  foo={!r}".format(foo))
+print("  bar={!r}".format(bar))
+try:
+    print("  baz={!r}".format(baz))
+except NameError:
+    print("  baz not imported")
+del foo, bar
+
+from all_indirect import *
+print("all_indirect.py")
+print("  foo={!r}".format(foo))
+print("  bar={!r}".format(bar))
+try:
+    print("  baz={!r}".format(baz))
+except NameError:
+    print("  baz not imported")
+del foo, bar
+
+# Example of wrong definition of `__all__`, where it is not a sequence.
+try:
+    from all_set import *
+except TypeError as e:
+    assert str(e) == "'set' object does not support indexing"
+    print("from all_set import * could not be imported:", e)
+
+print("")
+print("Direct reference on module")
+print("---")
+# Direct reference always works, no matter how `__all__` is set.
+import no_all
+import all_list
+import all_tuple
+import all_dynamic
+import all_indirect
+import all_set
+
+for mod in [no_all, all_list, all_tuple, all_dynamic, all_indirect, all_set]:
+    print("{}.py".format(mod.__name__))
+    print("  foo={!r}".format(mod.foo))
+    print("  bar={!r}".format(mod.bar))
+    print("  baz={!r}".format(mod.baz))
+
+print("\nspecial: no_all._qux={!r}".format(no_all._qux))
diff --git a/python/ql/test/library-tests/modules/__all__/no_all.py b/python/ql/test/library-tests/modules/__all__/no_all.py
new file mode 100644
index 00000000000..d295c9c8af4
--- /dev/null
+++ b/python/ql/test/library-tests/modules/__all__/no_all.py
@@ -0,0 +1,5 @@
+foo = "foo"
+bar = "bar"
+baz = "baz"
+# When `__all__` is not defined, names starting with underscore is not imported with `from <module> import *`
+_qux = "qux"
diff --git a/python/ql/test/query-tests/UselessCode/DuplicateCode/DuplicateBlock.expected b/python/ql/test/query-tests/UselessCode/DuplicateCode/DuplicateBlock.expected
deleted file mode 100644
index 9234fea78c7..00000000000
--- a/python/ql/test/query-tests/UselessCode/DuplicateCode/DuplicateBlock.expected
+++ /dev/null
@@ -1,8 +0,0 @@
-| duplicate_test.py:47:9:60:17 | Duplicate code: 14 duplicated lines. | Duplicate code: 14 lines are duplicated at duplicate_test.py:9 |
-| duplicate_test.py:56:18:66:25 | Duplicate code: 11 duplicated lines. | Duplicate code: 11 lines are duplicated at duplicate_test.py:18 |
-| duplicate_test.py:61:24:80:32 | Duplicate code: 20 duplicated lines. | Duplicate code: 20 lines are duplicated at duplicate_test.py:23 |
-| duplicate_test.py:166:18:245:24 | Duplicate code: 80 duplicated lines. | Duplicate code: 80 lines are duplicated at duplicate_test.py:84 |
-| duplicate_test.py:287:9:300:17 | Duplicate code: 14 duplicated lines. | Duplicate code: 14 lines are duplicated at duplicate_test.py:9 |
-| duplicate_test.py:287:9:300:17 | Duplicate code: 14 duplicated lines. | Duplicate code: 14 lines are duplicated at duplicate_test.py:47 |
-| duplicate_test.py:299:22:318:32 | Duplicate code: 20 duplicated lines. | Duplicate code: 20 lines are duplicated at duplicate_test.py:23 |
-| duplicate_test.py:299:22:318:32 | Duplicate code: 20 duplicated lines. | Duplicate code: 20 lines are duplicated at duplicate_test.py:61 |
diff --git a/python/ql/test/query-tests/UselessCode/DuplicateCode/DuplicateBlock.qlref b/python/ql/test/query-tests/UselessCode/DuplicateCode/DuplicateBlock.qlref
deleted file mode 100644
index 6e6d439a040..00000000000
--- a/python/ql/test/query-tests/UselessCode/DuplicateCode/DuplicateBlock.qlref
+++ /dev/null
@@ -1 +0,0 @@
-external/DuplicateBlock.ql
diff --git a/python/ql/test/query-tests/UselessCode/DuplicateCode/DuplicateFunction.expected b/python/ql/test/query-tests/UselessCode/DuplicateCode/DuplicateFunction.expected
deleted file mode 100644
index c85079e3811..00000000000
--- a/python/ql/test/query-tests/UselessCode/DuplicateCode/DuplicateFunction.expected
+++ /dev/null
@@ -1,4 +0,0 @@
-| duplicate_test.py:9:1:9:16 | Function dis | All 26 statements in dis are identical in $@. | duplicate_test.py:47:1:47:17 | Function dis2 | dis2 |
-| duplicate_test.py:47:1:47:17 | Function dis2 | All 26 statements in dis2 are identical in $@. | duplicate_test.py:9:1:9:16 | Function dis | dis |
-| duplicate_test.py:287:1:287:17 | Function dis4 | All 24 statements in dis4 are identical in $@. | duplicate_test.py:9:1:9:16 | Function dis | dis |
-| duplicate_test.py:287:1:287:17 | Function dis4 | All 24 statements in dis4 are identical in $@. | duplicate_test.py:47:1:47:17 | Function dis2 | dis2 |
diff --git a/python/ql/test/query-tests/UselessCode/DuplicateCode/DuplicateFunction.qlref b/python/ql/test/query-tests/UselessCode/DuplicateCode/DuplicateFunction.qlref
deleted file mode 100644
index bb7e3a45417..00000000000
--- a/python/ql/test/query-tests/UselessCode/DuplicateCode/DuplicateFunction.qlref
+++ /dev/null
@@ -1 +0,0 @@
-external/DuplicateFunction.ql
diff --git a/python/ql/test/query-tests/UselessCode/DuplicateCode/MostlyDuplicateClass.expected b/python/ql/test/query-tests/UselessCode/DuplicateCode/MostlyDuplicateClass.expected
deleted file mode 100644
index e628b371944..00000000000
--- a/python/ql/test/query-tests/UselessCode/DuplicateCode/MostlyDuplicateClass.expected
+++ /dev/null
@@ -1,2 +0,0 @@
-| duplicate_test.py:84:1:84:13 | Class Popen3 | All 55 statements in Popen3 are identical in $@. | duplicate_test.py:166:1:166:18 | Class Popen3Again | Popen3Again |
-| duplicate_test.py:166:1:166:18 | Class Popen3Again | All 55 statements in Popen3Again are identical in $@. | duplicate_test.py:84:1:84:13 | Class Popen3 | Popen3 |
diff --git a/python/ql/test/query-tests/UselessCode/DuplicateCode/MostlyDuplicateClass.qlref b/python/ql/test/query-tests/UselessCode/DuplicateCode/MostlyDuplicateClass.qlref
deleted file mode 100644
index 4af1d7b760b..00000000000
--- a/python/ql/test/query-tests/UselessCode/DuplicateCode/MostlyDuplicateClass.qlref
+++ /dev/null
@@ -1 +0,0 @@
-external/MostlyDuplicateClass.ql
diff --git a/python/ql/test/query-tests/UselessCode/DuplicateCode/MostlyDuplicateFile.expected b/python/ql/test/query-tests/UselessCode/DuplicateCode/MostlyDuplicateFile.expected
deleted file mode 100644
index e69de29bb2d..00000000000
diff --git a/python/ql/test/query-tests/UselessCode/DuplicateCode/MostlyDuplicateFile.qlref b/python/ql/test/query-tests/UselessCode/DuplicateCode/MostlyDuplicateFile.qlref
deleted file mode 100644
index ae06f160dec..00000000000
--- a/python/ql/test/query-tests/UselessCode/DuplicateCode/MostlyDuplicateFile.qlref
+++ /dev/null
@@ -1 +0,0 @@
-external/MostlyDuplicateFile.ql
diff --git a/python/ql/test/query-tests/UselessCode/DuplicateCode/MostlySimilarFile.expected b/python/ql/test/query-tests/UselessCode/DuplicateCode/MostlySimilarFile.expected
deleted file mode 100644
index e69de29bb2d..00000000000
diff --git a/python/ql/test/query-tests/UselessCode/DuplicateCode/MostlySimilarFile.qlref b/python/ql/test/query-tests/UselessCode/DuplicateCode/MostlySimilarFile.qlref
deleted file mode 100644
index f8d493b0a55..00000000000
--- a/python/ql/test/query-tests/UselessCode/DuplicateCode/MostlySimilarFile.qlref
+++ /dev/null
@@ -1 +0,0 @@
-external/MostlySimilarFile.ql
diff --git a/python/ql/test/query-tests/UselessCode/DuplicateCode/SimilarFunction.expected b/python/ql/test/query-tests/UselessCode/DuplicateCode/SimilarFunction.expected
deleted file mode 100644
index 55408a91345..00000000000
--- a/python/ql/test/query-tests/UselessCode/DuplicateCode/SimilarFunction.expected
+++ /dev/null
@@ -1,12 +0,0 @@
-| duplicate_test.py:9:1:9:16 | Function dis | All statements in dis are similar in $@. | duplicate_test.py:249:1:249:17 | Function dis3 | dis3 |
-| duplicate_test.py:9:1:9:16 | Function dis | All statements in dis are similar in $@. | duplicate_test.py:323:1:323:17 | Function dis5 | dis5 |
-| duplicate_test.py:47:1:47:17 | Function dis2 | All statements in dis2 are similar in $@. | duplicate_test.py:249:1:249:17 | Function dis3 | dis3 |
-| duplicate_test.py:47:1:47:17 | Function dis2 | All statements in dis2 are similar in $@. | duplicate_test.py:323:1:323:17 | Function dis5 | dis5 |
-| duplicate_test.py:249:1:249:17 | Function dis3 | All statements in dis3 are similar in $@. | duplicate_test.py:9:1:9:16 | Function dis | dis |
-| duplicate_test.py:249:1:249:17 | Function dis3 | All statements in dis3 are similar in $@. | duplicate_test.py:47:1:47:17 | Function dis2 | dis2 |
-| duplicate_test.py:249:1:249:17 | Function dis3 | All statements in dis3 are similar in $@. | duplicate_test.py:323:1:323:17 | Function dis5 | dis5 |
-| duplicate_test.py:287:1:287:17 | Function dis4 | All statements in dis4 are similar in $@. | duplicate_test.py:249:1:249:17 | Function dis3 | dis3 |
-| duplicate_test.py:287:1:287:17 | Function dis4 | All statements in dis4 are similar in $@. | duplicate_test.py:323:1:323:17 | Function dis5 | dis5 |
-| duplicate_test.py:323:1:323:17 | Function dis5 | All statements in dis5 are similar in $@. | duplicate_test.py:9:1:9:16 | Function dis | dis |
-| duplicate_test.py:323:1:323:17 | Function dis5 | All statements in dis5 are similar in $@. | duplicate_test.py:47:1:47:17 | Function dis2 | dis2 |
-| duplicate_test.py:323:1:323:17 | Function dis5 | All statements in dis5 are similar in $@. | duplicate_test.py:249:1:249:17 | Function dis3 | dis3 |
diff --git a/python/ql/test/query-tests/UselessCode/DuplicateCode/SimilarFunction.qlref b/python/ql/test/query-tests/UselessCode/DuplicateCode/SimilarFunction.qlref
deleted file mode 100644
index 665253817d7..00000000000
--- a/python/ql/test/query-tests/UselessCode/DuplicateCode/SimilarFunction.qlref
+++ /dev/null
@@ -1 +0,0 @@
-external/SimilarFunction.ql
diff --git a/python/ql/test/query-tests/UselessCode/DuplicateCode/duplicate_test.py b/python/ql/test/query-tests/UselessCode/DuplicateCode/duplicate_test.py
deleted file mode 100644
index cebfd7aca8a..00000000000
--- a/python/ql/test/query-tests/UselessCode/DuplicateCode/duplicate_test.py
+++ /dev/null
@@ -1,358 +0,0 @@
-#Code Duplication
-
-
-#Exact duplication of function
-
-#Code copied from stdlib, copyright PSF.
-#See http://www.python.org/download/releases/2.7/license/
-
-def dis(x=None):
-    """Disassemble classes, methods, functions, or code.
-
-    With no argument, disassemble the last traceback.
-
-    """
-    if x is None:
-        distb()
-        return
-    if isinstance(x, types.InstanceType):
-        x = x.__class__
-    if hasattr(x, 'im_func'):
-        x = x.im_func
-    if hasattr(x, 'func_code'):
-        x = x.func_code
-    if hasattr(x, '__dict__'):
-        items = x.__dict__.items()
-        items.sort()
-        for name, x1 in items:
-            if isinstance(x1, _have_code):
-                print("Disassembly of %s:" % name)
-                try:
-                    dis(x1)
-                except TypeError(msg):
-                    print("Sorry:", msg)
-                print()
-    elif hasattr(x, 'co_code'):
-        disassemble(x)
-    elif isinstance(x, str):
-        disassemble_string(x)
-    else:
-        raise TypeError(
-              "don't know how to disassemble %s objects" %
-              type(x).__name__)
-
-
-#And duplicate version
-
-def dis2(x=None):
-    """Disassemble classes, methods, functions, or code.
-
-    With no argument, disassemble the last traceback.
-
-    """
-    if x is None:
-        distb()
-        return
-    if isinstance(x, types.InstanceType):
-        x = x.__class__
-    if hasattr(x, 'im_func'):
-        x = x.im_func
-    if hasattr(x, 'func_code'):
-        x = x.func_code
-    if hasattr(x, '__dict__'):
-        items = x.__dict__.items()
-        items.sort()
-        for name, x1 in items:
-            if isinstance(x1, _have_code):
-                print("Disassembly of %s:" % name)
-                try:
-                    dis(x1)
-                except TypeError(msg):
-                    print("Sorry:", msg)
-                print()
-    elif hasattr(x, 'co_code'):
-        disassemble(x)
-    elif isinstance(x, str):
-        disassemble_string(x)
-    else:
-        raise TypeError(
-              "don't know how to disassemble %s objects" %
-              type(x).__name__)
-
-#Exactly duplicate class
-
-class Popen3:
-    """Class representing a child process.  Normally, instances are created
-    internally by the functions popen2() and popen3()."""
-
-    sts = -1                    # Child not completed yet
-
-    def __init__(self, cmd, capturestderr=False, bufsize=-1):
-        """The parameter 'cmd' is the shell command to execute in a
-        sub-process.  On UNIX, 'cmd' may be a sequence, in which case arguments
-        will be passed directly to the program without shell intervention (as
-        with os.spawnv()).  If 'cmd' is a string it will be passed to the shell
-        (as with os.system()).   The 'capturestderr' flag, if true, specifies
-        that the object should capture standard error output of the child
-        process.  The default is false.  If the 'bufsize' parameter is
-        specified, it specifies the size of the I/O buffers to/from the child
-        process."""
-        _cleanup()
-        self.cmd = cmd
-        p2cread, p2cwrite = os.pipe()
-        c2pread, c2pwrite = os.pipe()
-        if capturestderr:
-            errout, errin = os.pipe()
-        self.pid = os.fork()
-        if self.pid == 0:
-            # Child
-            os.dup2(p2cread, 0)
-            os.dup2(c2pwrite, 1)
-            if capturestderr:
-                os.dup2(errin, 2)
-            self._run_child(cmd)
-        os.close(p2cread)
-        self.tochild = os.fdopen(p2cwrite, 'w', bufsize)
-        os.close(c2pwrite)
-        self.fromchild = os.fdopen(c2pread, 'r', bufsize)
-        if capturestderr:
-            os.close(errin)
-            self.childerr = os.fdopen(errout, 'r', bufsize)
-        else:
-            self.childerr = None
-
-    def __del__(self):
-        # In case the child hasn't been waited on, check if it's done.
-        self.poll(_deadstate=sys.maxint)
-        if self.sts < 0:
-            if _active is not None:
-                # Child is still running, keep us alive until we can wait on it.
-                _active.append(self)
-
-    def _run_child(self, cmd):
-        if isinstance(cmd, basestring):
-            cmd = ['/bin/sh', '-c', cmd]
-        os.closerange(3, MAXFD)
-        try:
-            os.execvp(cmd[0], cmd)
-        finally:
-            os._exit(1)
-
-    def poll(self, _deadstate=None):
-        """Return the exit status of the child process if it has finished,
-        or -1 if it hasn't finished yet."""
-        if self.sts < 0:
-            try:
-                pid, sts = os.waitpid(self.pid, os.WNOHANG)
-                # pid will be 0 if self.pid hasn't terminated
-                if pid == self.pid:
-                    self.sts = sts
-            except os.error:
-                if _deadstate is not None:
-                    self.sts = _deadstate
-        return self.sts
-
-    def wait(self):
-        """Wait for and return the exit status of the child process."""
-        if self.sts < 0:
-            pid, sts = os.waitpid(self.pid, 0)
-            # This used to be a test, but it is believed to be
-            # always true, so I changed it to an assertion - mvl
-            assert pid == self.pid
-            self.sts = sts
-        return self.sts
-
-
-class Popen3Again:
-    """Class representing a child process.  Normally, instances are created
-    internally by the functions popen2() and popen3()."""
-
-    sts = -1                    # Child not completed yet
-
-    def __init__(self, cmd, capturestderr=False, bufsize=-1):
-        """The parameter 'cmd' is the shell command to execute in a
-        sub-process.  On UNIX, 'cmd' may be a sequence, in which case arguments
-        will be passed directly to the program without shell intervention (as
-        with os.spawnv()).  If 'cmd' is a string it will be passed to the shell
-        (as with os.system()).   The 'capturestderr' flag, if true, specifies
-        that the object should capture standard error output of the child
-        process.  The default is false.  If the 'bufsize' parameter is
-        specified, it specifies the size of the I/O buffers to/from the child
-        process."""
-        _cleanup()
-        self.cmd = cmd
-        p2cread, p2cwrite = os.pipe()
-        c2pread, c2pwrite = os.pipe()
-        if capturestderr:
-            errout, errin = os.pipe()
-        self.pid = os.fork()
-        if self.pid == 0:
-            # Child
-            os.dup2(p2cread, 0)
-            os.dup2(c2pwrite, 1)
-            if capturestderr:
-                os.dup2(errin, 2)
-            self._run_child(cmd)
-        os.close(p2cread)
-        self.tochild = os.fdopen(p2cwrite, 'w', bufsize)
-        os.close(c2pwrite)
-        self.fromchild = os.fdopen(c2pread, 'r', bufsize)
-        if capturestderr:
-            os.close(errin)
-            self.childerr = os.fdopen(errout, 'r', bufsize)
-        else:
-            self.childerr = None
-
-    def __del__(self):
-        # In case the child hasn't been waited on, check if it's done.
-        self.poll(_deadstate=sys.maxint)
-        if self.sts < 0:
-            if _active is not None:
-                # Child is still running, keep us alive until we can wait on it.
-                _active.append(self)
-
-    def _run_child(self, cmd):
-        if isinstance(cmd, basestring):
-            cmd = ['/bin/sh', '-c', cmd]
-        os.closerange(3, MAXFD)
-        try:
-            os.execvp(cmd[0], cmd)
-        finally:
-            os._exit(1)
-
-    def poll(self, _deadstate=None):
-        """Return the exit status of the child process if it has finished,
-        or -1 if it hasn't finished yet."""
-        if self.sts < 0:
-            try:
-                pid, sts = os.waitpid(self.pid, os.WNOHANG)
-                # pid will be 0 if self.pid hasn't terminated
-                if pid == self.pid:
-                    self.sts = sts
-            except os.error:
-                if _deadstate is not None:
-                    self.sts = _deadstate
-        return self.sts
-
-    def wait(self):
-        """Wait for and return the exit status of the child process."""
-        if self.sts < 0:
-            pid, sts = os.waitpid(self.pid, 0)
-            # This used to be a test, but it is believed to be
-            # always true, so I changed it to an assertion - mvl
-            assert pid == self.pid
-            self.sts = sts
-        return self.sts
-
-#Duplicate function with identifiers changed
-
-def dis3(y=None):
-    """frobnicate classes, methods, functions, or code.
-
-    With no argument, frobnicate the last traceback.
-
-    """
-    if y is None:
-        distb()
-        return
-    if isinstance(y, types.InstanceType):
-        y = y.__class__
-    if hasattr(y, 'im_func'):
-        y = y.im_func
-    if hasattr(y, 'func_code'):
-        y = y.func_code
-    if hasattr(y, '__dict__'):
-        items = y.__dict__.items()
-        items.sort()
-        for name, y1 in items:
-            if isinstance(y1, _have_code):
-                print("Disassembly of %s:" % name)
-                try:
-                    dis(y1)
-                except TypeError(msg):
-                    print("Sorry:", msg)
-                print()
-    elif hasattr(y, 'co_code'):
-        frobnicate(y)
-    elif isinstance(y, str):
-        frobnicate_string(y)
-    else:
-        raise TypeError(
-              "don't know how to frobnicate %s objects" %
-              type(y).__name__)
-
-
-#Mostly similar function
-
-def dis4(x=None):
-    """Disassemble classes, methods, functions, or code.
-
-    With no argument, disassemble the last traceback.
-
-    """
-    if x is None:
-        distb()
-        return
-    if isinstance(x, types.InstanceType):
-        x = x.__class__
-    if hasattr(x, 'im_func'):
-        x = x.im_func
-    if hasattr(x, '__dict__'):
-        items = x.__dict__.items()
-        items.sort()
-        for name, x1 in items:
-            if isinstance(x1, _have_code):
-                print("Disassembly of %s:" % name)
-                try:
-                    dis(x1)
-                except TypeError(msg):
-                    print("Sorry:", msg)
-                print()
-    elif hasattr(x, 'co_code'):
-        disassemble(x)
-    elif isinstance(x, str):
-        disassemble_string(x)
-    else:
-        raise TypeError(
-              "don't know how to disassemble %s objects" %
-              type(x).__name__)
-
-
-#Similar function with changed identifiers
-
-def dis5(z=None):
-    """splat classes, methods, functions, or code.
-
-    With no argument, splat the last traceback.
-
-    """
-    if z is None:
-        distb()
-        return
-    if isinstance(z, types.InstanceType):
-        z = z.__class__
-    if hasattr(z, 'im_func'):
-        z = z.im_func
-    if hasattr(y, 'func_code'):
-        y = y.func_code
-    if hasattr(z, '__dict__'):
-        items = z.__dict__.items()
-        items.sort()
-        for name, z1 in items:
-            if isinstance(z1, _have_code):
-                print("Disassembly of %s:" % name)
-                try:
-                    dis(z1)
-                except TypeError(msg):
-                    print("Sorry:", msg)
-                print()
-    elif hasattr(z, 'co_code'):
-        splat(z)
-    elif isinstance(z, str):
-        splat_string(z)
-    else:
-        raise TypeError(
-              "don't know how to splat %s objects" %
-              type(z).__name__)
-
-
diff --git a/python/ql/test/query-tests/UselessCode/DuplicateCode/similar.py b/python/ql/test/query-tests/UselessCode/DuplicateCode/similar.py
deleted file mode 100644
index 8f36c5e65ed..00000000000
--- a/python/ql/test/query-tests/UselessCode/DuplicateCode/similar.py
+++ /dev/null
@@ -1,63 +0,0 @@
-
-
-def original(the_ast):
-    def walk(node, in_function, in_name_main):
-        def flags():
-            return in_function * 2 + in_name_main
-        if isinstance(node, ast.Module):
-            for import_node in walk(node.body, in_function, in_name_main):
-                yield import_node
-        elif isinstance(node, ast.ImportFrom):
-            aliases = [ Alias(a.name, a.asname) for a in node.names]
-            yield FromImport(node.level, node.module, aliases, flags())
-        elif isinstance(node, ast.Import):
-            aliases = [ Alias(a.name, a.asname) for a in node.names]
-            yield Import(aliases, flags())
-        elif isinstance(node, ast.FunctionDef):
-            for _, child in ast.iter_fields(node):
-                for import_node in walk(child, True, in_name_main):
-                    yield import_node
-        elif isinstance(node, list):
-            for n in node:
-                for import_node in walk(n, in_function, in_name_main):
-                    yield import_node
-    return list(walk(the_ast, False, False))
-
-def similar_1(the_ast):
-    def walk(node, in_function, in_name_main):
-        def flags():
-            return in_function * 2 + in_name_main
-        if isinstance(node, ast.Module):
-            for import_node in walk(node.body, in_function, in_name_main):
-                yield import_node
-        elif isinstance(node, ast.ImportFrom):
-            aliases = [ Alias(a.name, a.asname) for a in node.names]
-            yield FromImport(node.level, node.module, aliases, flags())
-        elif isinstance(node, ast.Import):
-            aliases = [ Alias(a.name, a.asname) for a in node.names]
-            yield Import(aliases, flags())
-        elif isinstance(node, ast.FunctionDef):
-            for _, child in ast.iter_fields(node):
-                for import_node in walk(child, True, in_name_main):
-                    yield import_node
-    return list(walk(the_ast, False, False))
-
-def similar_2(the_ast):
-    def walk(node, in_function, in_name_main):
-        def flags():
-            return in_function * 2 + in_name_main
-        if isinstance(node, ast.Module):
-            for import_node in walk(node.body, in_function, in_name_main):
-                yield import_node
-        elif isinstance(node, ast.Import):
-            aliases = [ Alias(a.name, a.asname) for a in node.names]
-            yield Import(aliases, flags())
-        elif isinstance(node, ast.FunctionDef):
-            for _, child in ast.iter_fields(node):
-                for import_node in walk(child, True, in_name_main):
-                    yield import_node
-        elif isinstance(node, list):
-            for n in node:
-                for import_node in walk(n, in_function, in_name_main):
-                    yield import_node
-    return list(walk(the_ast, False, False))