Merge branch 'main' into redsun82/swift-case-variables

.github/workflows/check-change-note.yml

@@ -9,6 +9,8 @@ on:
       - "*/ql/lib/**/*.ql"
       - "*/ql/lib/**/*.qll"
       - "*/ql/lib/**/*.yml"
+      - "shared/**/*.ql"
+      - "shared/**/*.qll"
       - "!**/experimental/**"
       - "!ql/**"
       - ".github/workflows/check-change-note.yml"

.github/workflows/csharp-qltest.yml

@@ -91,7 +91,7 @@ jobs:
         run: |
           # Generate (Asp)NetCore stubs
           STUBS_PATH=stubs_output
-          python3 ql/src/Stubs/make_stubs_nuget.py webapp Swashbuckle.AspNetCore.Swagger 6.5.0 "$STUBS_PATH"
+          python3 scripts/stubs/make_stubs_nuget.py webapp Swashbuckle.AspNetCore.Swagger 6.5.0 "$STUBS_PATH"
           rm -rf ql/test/resources/stubs/_frameworks
           # Update existing stubs in the repo with the freshly generated ones
           mv "$STUBS_PATH/output/stubs/_frameworks" ql/test/resources/stubs/

.github/workflows/csv-coverage-pr-artifacts.yml

@@ -89,9 +89,32 @@ jobs:
       - name: Save PR number
         run: |
           mkdir -p pr
-          echo ${{ github.event.pull_request.number }} > pr/NR
+          echo ${PR_NUMBER} > pr/NR
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
       - name: Upload PR number
         uses: actions/upload-artifact@v3
         with:
           name: pr
           path: pr/
+      - name: Save comment ID (if it exists)
+        run: |
+          # Find the latest comment starting with COMMENT_PREFIX
+          COMMENT_PREFIX=":warning: The head of this PR and the base branch were compared for differences in the framework coverage reports."
+          COMMENT_ID=$(gh api "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" --paginate | jq --arg prefix "${COMMENT_PREFIX}" 'map(select(.body|startswith($prefix)) | .id) | max // empty')
+          if [[ -z ${COMMENT_ID} ]]
+          then
+            echo "Comment not found. Not uploading 'comment/ID' artifact."
+          else
+            mkdir -p comment
+            echo ${COMMENT_ID} > comment/ID
+          fi
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+      - name: Upload comment ID (if it exists)
+        uses: actions/upload-artifact@v3
+        with:
+          name: comment
+          path: comment/
+          if-no-files-found: ignore

codeql-workspace.yml

@@ -6,7 +6,7 @@ provide:
   - "*/ql/consistency-queries/qlpack.yml"
   - "*/ql/automodel/src/qlpack.yml"
   - "*/ql/automodel/test/qlpack.yml"
-  - "shared/*/qlpack.yml"
+  - "shared/**/qlpack.yml"
   - "cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/qlpack.yml"
   - "go/ql/config/legacy-support/qlpack.yml"
   - "go/build/codeql-extractor-go/codeql-extractor.yml"

cpp/downgrades/f79ce79e3b751aeeed59e594633ba5c07a27ef3e/upgrade.properties

@@ -0,0 +1,3 @@
+description: Introduce extractor version numbers
+compatibility: breaking
+extractor_version.rel: delete

cpp/ql/lib/change-notes/2023-10-24-remove-getlocation-from-folder.md

@@ -0,0 +1,4 @@
+---
+category: breaking
+---
+* The `Container` and `Folder` classes now derive from `ElementBase` instead of `Locatable`, and no longer expose the `getLocation` predicate. Use `getURL` instead.

cpp/ql/lib/qlpack.yml

@@ -7,6 +7,7 @@ library: true
 upgrades: upgrades
 dependencies:
   codeql/dataflow: ${workspace}
+  codeql/rangeanalysis: ${workspace}
   codeql/ssa: ${workspace}
   codeql/tutorial: ${workspace}
   codeql/util: ${workspace}

cpp/ql/lib/semmle/code/cpp/File.qll

@@ -32,7 +32,7 @@ private module Input implements InputSig {
 private module Impl = Make<Input>;
 
 /** A file or folder. */
-class Container extends Locatable, Impl::Container {
+class Container extends ElementBase, Impl::Container {
   override string toString() { result = Impl::Container.super.toString() }
 }
 
@@ -47,11 +47,6 @@ class Container extends Locatable, Impl::Container {
  * To get the full path, use `getAbsolutePath`.
  */
 class Folder extends Container, Impl::Folder {
-  override Location getLocation() {
-    result.getContainer() = this and
-    result.hasLocationInfo(_, 0, 0, 0, 0)
-  }
-
   override string getAPrimaryQlClass() { result = "Folder" }
 }
 
@@ -67,7 +62,7 @@ class Folder extends Container, Impl::Folder {
  * The base name further decomposes into the _stem_ and _extension_ -- see
  * `getStem` and `getExtension`. To get the full path, use `getAbsolutePath`.
  */
-class File extends Container, Impl::File {
+class File extends Container, Locatable, Impl::File {
   override string getAPrimaryQlClass() { result = "File" }
 
   override Location getLocation() {

cpp/ql/lib/semmle/code/cpp/internal/ExtractorVersion.qll

@@ -0,0 +1,15 @@
+/**
+ * INTERNAL: Do not use. Provides predicates for getting the CodeQL and frontend
+ * version used during database extraction.
+ */
+
+/** Get the extractor CodeQL version */
+string getExtractorCodeQLVersion() { extractor_version(result, _) }
+
+/** Get the extractor frontend version */
+string getExtractorFrontendVersion() { extractor_version(_, result) }
+
+predicate isExtractorFrontendVersion65OrHigher() {
+  // Version numbers we not included in the database before 6.5.
+  exists(getExtractorCodeQLVersion())
+}

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/ModelUtil.qll

@@ -31,26 +31,35 @@ DataFlow::Node callInput(CallInstruction call, FunctionInput input) {
   )
 }
 
+/**
+ * Gets the node that represents the output of `call` with kind `output` at
+ * indirection index `indirectionIndex`.
+ */
+private Node callOutputWithIndirectionIndex(
+  CallInstruction call, FunctionOutput output, int indirectionIndex
+) {
+  // The return value
+  simpleOutNode(result, call) and
+  output.isReturnValue() and
+  indirectionIndex = 0
+  or
+  // The side effect of a call on the value pointed to by an argument or qualifier
+  exists(int index |
+    result.(IndirectArgumentOutNode).getArgumentIndex() = index and
+    result.(IndirectArgumentOutNode).getIndirectionIndex() = indirectionIndex - 1 and
+    result.(IndirectArgumentOutNode).getCallInstruction() = call and
+    output.isParameterDerefOrQualifierObject(index, indirectionIndex - 1)
+  )
+  or
+  result = getIndirectReturnOutNode(call, indirectionIndex) and
+  output.isReturnValueDeref(indirectionIndex)
+}
+
 /**
  * Gets the instruction that holds the `output` for `call`.
  */
 Node callOutput(CallInstruction call, FunctionOutput output) {
-  // The return value
-  simpleOutNode(result, call) and
-  output.isReturnValue()
-  or
-  // The side effect of a call on the value pointed to by an argument or qualifier
-  exists(int index, int indirectionIndex |
-    result.(IndirectArgumentOutNode).getArgumentIndex() = index and
-    result.(IndirectArgumentOutNode).getIndirectionIndex() = indirectionIndex and
-    result.(IndirectArgumentOutNode).getCallInstruction() = call and
-    output.isParameterDerefOrQualifierObject(index, indirectionIndex)
-  )
-  or
-  exists(int ind |
-    result = getIndirectReturnOutNode(call, ind) and
-    output.isReturnValueDeref(ind)
-  )
+  result = callOutputWithIndirectionIndex(call, output, _)
 }
 
 DataFlow::Node callInput(CallInstruction call, FunctionInput input, int d) {
@@ -76,19 +85,15 @@ private IndirectReturnOutNode getIndirectReturnOutNode(CallInstruction call, int
  */
 bindingset[d]
 Node callOutput(CallInstruction call, FunctionOutput output, int d) {
-  exists(DataFlow::Node n | n = callOutput(call, output) and d > 0 |
+  exists(DataFlow::Node n, int indirectionIndex |
+    n = callOutputWithIndirectionIndex(call, output, indirectionIndex) and d > 0
+  |
     // The return value
-    result = getIndirectReturnOutNode(n.asInstruction(), d)
+    result = callOutputWithIndirectionIndex(call, output, indirectionIndex + d)
     or
     // If there isn't an indirect out node for the call with indirection `d` then
     // we conflate this with the underlying `CallInstruction`.
-    not exists(getIndirectReturnOutNode(call, d)) and
+    not exists(getIndirectReturnOutNode(call, indirectionIndex + d)) and
     n = result
-    or
-    // The side effect of a call on the value pointed to by an argument or qualifier
-    exists(Operand operand, int indirectionIndex |
-      Ssa::outNodeHasAddressAndIndex(n, operand, indirectionIndex) and
-      Ssa::outNodeHasAddressAndIndex(result, operand, indirectionIndex + d)
-    )
   )
 }

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternalsCommon.qll

@@ -228,7 +228,7 @@ private class PointerWrapperTypeIndirection extends Indirection instanceof Point
   override predicate isAdditionalDereference(Instruction deref, Operand address) {
     exists(CallInstruction call |
       operandForFullyConvertedCall(getAUse(deref), call) and
-      this = call.getStaticCallTarget().getClassAndName("operator*") and
+      this = call.getStaticCallTarget().getClassAndName(["operator*", "operator->", "get"]) and
       address = call.getThisArgumentOperand()
     )
   }

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedElement.qll

@@ -1,5 +1,6 @@
 private import cpp
 import semmle.code.cpp.ir.implementation.raw.IR
+private import semmle.code.cpp.internal.ExtractorVersion
 private import semmle.code.cpp.ir.IRConfiguration
 private import semmle.code.cpp.ir.implementation.Opcode
 private import semmle.code.cpp.ir.implementation.internal.OperandTag
@@ -362,10 +363,10 @@ predicate ignoreLoad(Expr expr) {
     expr instanceof FunctionAccess
     or
     // The load is duplicated from the operand.
-    expr instanceof ParenthesisExpr
+    isExtractorFrontendVersion65OrHigher() and expr instanceof ParenthesisExpr
     or
     // The load is duplicated from the right operand.
-    expr instanceof CommaExpr
+    isExtractorFrontendVersion65OrHigher() and expr instanceof CommaExpr
     or
     expr.(PointerDereferenceExpr).getOperand().getFullyConverted().getType().getUnspecifiedType()
       instanceof FunctionPointerType

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll

@@ -1,4 +1,5 @@
 private import cpp
+private import semmle.code.cpp.internal.ExtractorVersion
 private import semmle.code.cpp.ir.implementation.IRType
 private import semmle.code.cpp.ir.implementation.Opcode
 private import semmle.code.cpp.ir.implementation.internal.OperandTag
@@ -648,7 +649,21 @@ abstract class TranslatedCrementOperation extends TranslatedNonConstantExpr {
 class TranslatedPrefixCrementOperation extends TranslatedCrementOperation {
   override PrefixCrementOperation expr;
 
-  override Instruction getResult() { result = this.getUnloadedOperand().getResult() }
+  override Instruction getResult() {
+    // The following distinction is needed to work around extractor limitations
+    // in old versions of the extractor.
+    if expr.isPRValueCategory() and not isExtractorFrontendVersion65OrHigher()
+    then
+      // If this is C, then the result of a prefix crement is a prvalue for the
+      // new value assigned to the operand. If this is C++, then the result is
+      // an lvalue, but that lvalue is being loaded as part of this expression.
+      // EDG doesn't mark this as a load.
+      result = this.getInstruction(CrementOpTag())
+    else
+      // This is C++, where the result is an lvalue for the operand, and that
+      // lvalue is not being loaded as part of this expression.
+      result = this.getUnloadedOperand().getResult()
+  }
 }
 
 class TranslatedPostfixCrementOperation extends TranslatedCrementOperation {
@@ -1491,7 +1506,21 @@ class TranslatedAssignExpr extends TranslatedNonConstantExpr {
     result = this.getRightOperand().getFirstInstruction()
   }
 
-  final override Instruction getResult() { result = this.getLeftOperand().getResult() }
+  final override Instruction getResult() {
+    // The following distinction is needed to work around extractor limitations
+    // in old versions of the extractor.
+    if expr.isPRValueCategory() and not isExtractorFrontendVersion65OrHigher()
+    then
+      // If this is C, then the result of an assignment is a prvalue for the new
+      // value assigned to the left operand. If this is C++, then the result is
+      // an lvalue, but that lvalue is being loaded as part of this expression.
+      // EDG doesn't mark this as a load.
+      result = this.getRightOperand().getResult()
+    else
+      // This is C++, where the result is an lvalue for the left operand,
+      // and that lvalue is not being loaded as part of this expression.
+      result = this.getLeftOperand().getResult()
+  }
 
   final TranslatedExpr getLeftOperand() {
     result = getTranslatedExpr(expr.getLValue().getFullyConverted())
@@ -1617,7 +1646,21 @@ class TranslatedAssignOperation extends TranslatedNonConstantExpr {
     result = this.getRightOperand().getFirstInstruction()
   }
 
-  final override Instruction getResult() { result = this.getUnloadedLeftOperand().getResult() }
+  final override Instruction getResult() {
+    // The following distinction is needed to work around extractor limitations
+    // in old versions of the extractor.
+    if expr.isPRValueCategory() and not isExtractorFrontendVersion65OrHigher()
+    then
+      // If this is C, then the result of an assignment is a prvalue for the new
+      // value assigned to the left operand. If this is C++, then the result is
+      // an lvalue, but that lvalue is being loaded as part of this expression.
+      // EDG doesn't mark this as a load.
+      result = this.getStoredValue()
+    else
+      // This is C++, where the result is an lvalue for the left operand,
+      // and that lvalue is not being loaded as part of this expression.
+      result = this.getUnloadedLeftOperand().getResult()
+  }
 
   final TranslatedExpr getUnloadedLeftOperand() {
     result = this.getLoadedLeftOperand().getOperand()
@@ -2155,15 +2198,16 @@ abstract class TranslatedConditionalExpr extends TranslatedNonConstantExpr {
         not this.elseIsVoid() and tag = ConditionValueFalseStoreTag()
       ) and
       opcode instanceof Opcode::Store and
-      (
+      if isExtractorFrontendVersion65OrHigher()
+      then
         not expr.hasLValueToRValueConversion() and
         resultType = this.getResultType()
         or
         expr.hasLValueToRValueConversion() and
         resultType = getTypeForPRValue(expr.getType())
-      )
+      else resultType = this.getResultType()
       or
-      not expr.hasLValueToRValueConversion() and
+      (not expr.hasLValueToRValueConversion() or not isExtractorFrontendVersion65OrHigher()) and
       tag = ConditionValueResultLoadTag() and
       opcode instanceof Opcode::Load and
       resultType = this.getResultType()
@@ -2193,15 +2237,16 @@ abstract class TranslatedConditionalExpr extends TranslatedNonConstantExpr {
       )
       or
       tag = ConditionValueResultTempAddressTag() and
-      (
+      if isExtractorFrontendVersion65OrHigher()
+      then
         not expr.hasLValueToRValueConversion() and
         result = this.getInstruction(ConditionValueResultLoadTag())
         or
         expr.hasLValueToRValueConversion() and
         result = this.getParent().getChildSuccessor(this)
-      )
+      else result = this.getInstruction(ConditionValueResultLoadTag())
       or
-      not expr.hasLValueToRValueConversion() and
+      (not expr.hasLValueToRValueConversion() or not isExtractorFrontendVersion65OrHigher()) and
       tag = ConditionValueResultLoadTag() and
       result = this.getParent().getChildSuccessor(this)
     )
@@ -2230,7 +2275,7 @@ abstract class TranslatedConditionalExpr extends TranslatedNonConstantExpr {
         result = this.getElse().getResult()
       )
       or
-      not expr.hasLValueToRValueConversion() and
+      (not expr.hasLValueToRValueConversion() or not isExtractorFrontendVersion65OrHigher()) and
       tag = ConditionValueResultLoadTag() and
       operandTag instanceof AddressOperandTag and
       result = this.getInstruction(ConditionValueResultTempAddressTag())
@@ -2240,13 +2285,14 @@ abstract class TranslatedConditionalExpr extends TranslatedNonConstantExpr {
   final override predicate hasTempVariable(TempVariableTag tag, CppType type) {
     not this.resultIsVoid() and
     tag = ConditionValueTempVar() and
-    (
+    if isExtractorFrontendVersion65OrHigher()
+    then
       not expr.hasLValueToRValueConversion() and
       type = this.getResultType()
       or
       expr.hasLValueToRValueConversion() and
       type = getTypeForPRValue(expr.getType())
-    )
+    else type = this.getResultType()
   }
 
   final override IRVariable getInstructionVariable(InstructionTag tag) {
@@ -2261,13 +2307,14 @@ abstract class TranslatedConditionalExpr extends TranslatedNonConstantExpr {
 
   final override Instruction getResult() {
     not this.resultIsVoid() and
-    (
+    if isExtractorFrontendVersion65OrHigher()
+    then
       expr.hasLValueToRValueConversion() and
       result = this.getInstruction(ConditionValueResultTempAddressTag())
       or
       not expr.hasLValueToRValueConversion() and
       result = this.getInstruction(ConditionValueResultLoadTag())
-    )
+    else result = this.getInstruction(ConditionValueResultLoadTag())
   }
 
   override Instruction getChildSuccessor(TranslatedElement child) {
@@ -3226,9 +3273,19 @@ predicate exprNeedsCopyIfNotLoaded(Expr expr) {
   (
     expr instanceof AssignExpr
     or
-    expr instanceof AssignOperation
+    expr instanceof AssignOperation and
+    (
+      not expr.isPRValueCategory() // is C++
+      or
+      isExtractorFrontendVersion65OrHigher()
+    )
     or
-    expr instanceof PrefixCrementOperation
+    expr instanceof PrefixCrementOperation and
+    (
+      not expr.isPRValueCategory() // is C++
+      or
+      isExtractorFrontendVersion65OrHigher()
+    )
     or
     // Because the load is on the `e` in `e++`.
     expr instanceof PostfixCrementOperation

cpp/ql/lib/semmle/code/cpp/models/Models.qll

@@ -19,6 +19,7 @@ private import implementations.Strtok
 private import implementations.Strset
 private import implementations.Strcrement
 private import implementations.Strnextc
+private import implementations.Strtol
 private import implementations.StdContainer
 private import implementations.StdPair
 private import implementations.StdMap

cpp/ql/lib/semmle/code/cpp/models/implementations/Pure.qll

@@ -13,7 +13,7 @@ private class PureStrFunction extends AliasFunction, ArrayFunction, TaintFunctio
   PureStrFunction() {
     this.hasGlobalOrStdOrBslName([
         atoi(), "strcasestr", "strchnul", "strchr", "strchrnul", "strstr", "strpbrk", "strrchr",
-        "strspn", strtol(), strrev(), strcmp(), strlwr(), strupr()
+        "strspn", strrev(), strcmp(), strlwr(), strupr()
       ])
   }
 
@@ -70,8 +70,6 @@ private class PureStrFunction extends AliasFunction, ArrayFunction, TaintFunctio
 
 private string atoi() { result = ["atof", "atoi", "atol", "atoll"] }
 
-private string strtol() { result = ["strtod", "strtof", "strtol", "strtoll", "strtoq", "strtoul"] }
-
 private string strlwr() {
   result = ["_strlwr", "_wcslwr", "_mbslwr", "_strlwr_l", "_wcslwr_l", "_mbslwr_l"]
 }

cpp/ql/lib/semmle/code/cpp/models/implementations/Strtok.qll

@@ -32,6 +32,8 @@ private class Strtok extends ArrayFunction, AliasFunction, TaintFunction, SideEf
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     input.isParameter(0) and output.isReturnValue()
+    or
+    input.isParameterDeref(0) and output.isReturnValueDeref()
   }
 
   override predicate hasOnlySpecificReadSideEffects() { none() }

cpp/ql/lib/semmle/code/cpp/models/implementations/Strtol.qll

@@ -0,0 +1,54 @@
+import semmle.code.cpp.models.interfaces.ArrayFunction
+import semmle.code.cpp.models.interfaces.Taint
+import semmle.code.cpp.models.interfaces.Alias
+import semmle.code.cpp.models.interfaces.SideEffect
+
+private string strtol() { result = ["strtod", "strtof", "strtol", "strtoll", "strtoq", "strtoul"] }
+
+/**
+ * The standard function `strtol` and its assorted variants
+ */
+private class Strtol extends AliasFunction, ArrayFunction, TaintFunction, SideEffectFunction {
+  Strtol() { this.hasGlobalOrStdOrBslName(strtol()) }
+
+  override predicate hasArrayInput(int bufParam) {
+    // All the functions given by `strtol()` takes a `const char*` input as the first parameter
+    bufParam = 0
+  }
+
+  override predicate hasArrayWithNullTerminator(int bufParam) { bufParam = 0 }
+
+  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+    (
+      input.isParameter(0)
+      or
+      input.isParameterDeref(0)
+    ) and
+    output.isReturnValue()
+    or
+    input.isParameter(0) and
+    output.isParameterDeref(1)
+  }
+
+  override predicate parameterNeverEscapes(int i) {
+    // Parameter 0 does escape into parameter 1.
+    i = 1
+  }
+
+  override predicate parameterEscapesOnlyViaReturn(int i) { none() }
+
+  override predicate parameterIsAlwaysReturned(int i) { none() }
+
+  override predicate hasOnlySpecificReadSideEffects() { any() }
+
+  override predicate hasOnlySpecificWriteSideEffects() { any() }
+
+  override predicate hasSpecificReadSideEffect(ParameterIndex i, boolean buffer) {
+    i = 0 and
+    buffer = true
+  }
+
+  override predicate hasSpecificWriteSideEffect(ParameterIndex i, boolean buffer, boolean mustWrite) {
+    i = 1 and buffer = false and mustWrite = false
+  }
+}

cpp/ql/lib/semmle/code/cpp/rangeanalysis/new/internal/semantic/SemanticLocation.qll

@@ -8,6 +8,18 @@ class SemLocation instanceof Location {
    */
   string toString() { result = super.toString() }
 
+  /** Gets the 1-based line number (inclusive) where this location starts. */
+  int getStartLine() { result = super.getStartLine() }
+
+  /** Gets the 1-based column number (inclusive) where this location starts. */
+  int getStartColumn() { result = super.getStartColumn() }
+
+  /** Gets the 1-based line number (inclusive) where this location ends. */
+  int getEndLine() { result = super.getEndLine() }
+
+  /** Gets the 1-based column number (inclusive) where this location ends. */
+  int getEndColumn() { result = super.getEndColumn() }
+
   /**
    * Holds if this element is at the specified location.
    * The location spans column `startcolumn` of line `startline` to

cpp/ql/lib/semmle/code/cpp/rangeanalysis/new/internal/semantic/analysis/FloatDelta.qll

@@ -1,5 +1,7 @@
-private import RangeAnalysisStage
 private import RangeAnalysisImpl
+private import codeql.rangeanalysis.RangeAnalysis
+private import semmle.code.cpp.rangeanalysis.new.internal.semantic.SemanticExpr
+private import semmle.code.cpp.rangeanalysis.new.internal.semantic.SemanticType
 
 module FloatDelta implements DeltaSig {
   class Delta = float;
@@ -20,7 +22,7 @@ module FloatDelta implements DeltaSig {
   Delta fromFloat(float f) { result = f }
 }
 
-module FloatOverflow implements OverflowSig<FloatDelta> {
+module FloatOverflow implements OverflowSig<Sem, FloatDelta> {
   predicate semExprDoesNotOverflow(boolean positively, SemExpr expr) {
     exists(float lb, float ub, float delta |
       typeBounds(expr.getSemType(), lb, ub) and

cpp/ql/lib/semmle/code/cpp/rangeanalysis/new/internal/semantic/analysis/IntDelta.qll

@@ -1,29 +0,0 @@
-private import RangeAnalysisStage
-
-module IntDelta implements DeltaSig {
-  class Delta = int;
-
-  bindingset[d]
-  bindingset[result]
-  float toFloat(Delta d) { result = d }
-
-  bindingset[d]
-  bindingset[result]
-  int toInt(Delta d) { result = d }
-
-  bindingset[n]
-  bindingset[result]
-  Delta fromInt(int n) { result = n }
-
-  bindingset[f]
-  Delta fromFloat(float f) {
-    result =
-      min(float diff, float res |
-        diff = (res - f) and res = f.ceil()
-        or
-        diff = (f - res) and res = f.floor()
-      |
-        res order by diff
-      )
-  }
-}

cpp/ql/lib/semmle/code/cpp/rangeanalysis/new/internal/semantic/analysis/ModulusAnalysis.qll

@@ -12,11 +12,13 @@
 
 private import ModulusAnalysisSpecific::Private
 private import semmle.code.cpp.rangeanalysis.new.internal.semantic.Semantic
+private import semmle.code.cpp.rangeanalysis.new.internal.semantic.SemanticLocation
 private import ConstantAnalysis
 private import RangeUtils
-private import RangeAnalysisStage
+private import codeql.rangeanalysis.RangeAnalysis
+private import RangeAnalysisImpl
 
-module ModulusAnalysis<DeltaSig D, BoundSig<D> Bounds, UtilSig<D> U> {
+module ModulusAnalysis<DeltaSig D, BoundSig<SemLocation, Sem, D> Bounds, UtilSig<Sem, D> U> {
   pragma[nomagic]
   private predicate valueFlowStepSsaEqFlowCond(
     SemSsaReadPosition pos, SemSsaVariable v, SemExpr e, int delta

cpp/ql/lib/semmle/code/cpp/rangeanalysis/new/internal/semantic/analysis/RangeAnalysisConstantSpecific.qll

@@ -3,10 +3,11 @@
  */
 
 private import semmle.code.cpp.rangeanalysis.new.internal.semantic.Semantic
-private import RangeAnalysisStage
 private import semmle.code.cpp.rangeanalysis.new.internal.semantic.analysis.FloatDelta
+private import RangeAnalysisImpl
+private import codeql.rangeanalysis.RangeAnalysis
 
-module CppLangImplConstant implements LangSig<FloatDelta> {
+module CppLangImplConstant implements LangSig<Sem, FloatDelta> {
   /**
    * Holds if the specified expression should be excluded from the result of `ssaRead()`.
    *

cpp/ql/lib/semmle/code/cpp/rangeanalysis/new/internal/semantic/analysis/RangeAnalysisImpl.qll

@@ -1,13 +1,104 @@
-private import RangeAnalysisStage
 private import RangeAnalysisConstantSpecific
 private import RangeAnalysisRelativeSpecific
 private import semmle.code.cpp.rangeanalysis.new.internal.semantic.analysis.FloatDelta
 private import RangeUtils
+private import semmle.code.cpp.rangeanalysis.new.internal.semantic.SemanticExpr
+private import semmle.code.cpp.rangeanalysis.new.internal.semantic.SemanticCFG
+private import semmle.code.cpp.rangeanalysis.new.internal.semantic.SemanticGuard
 private import semmle.code.cpp.rangeanalysis.new.internal.semantic.SemanticBound as SemanticBound
 private import semmle.code.cpp.rangeanalysis.new.internal.semantic.SemanticLocation
 private import semmle.code.cpp.rangeanalysis.new.internal.semantic.SemanticSSA
+private import semmle.code.cpp.rangeanalysis.new.internal.semantic.SemanticType as SemanticType
+private import SemanticType
+private import codeql.rangeanalysis.RangeAnalysis
+private import ConstantAnalysis as ConstantAnalysis
 
-module ConstantBounds implements BoundSig<FloatDelta> {
+module Sem implements Semantic {
+  class Expr = SemExpr;
+
+  class ConstantIntegerExpr = ConstantAnalysis::SemConstantIntegerExpr;
+
+  class BinaryExpr = SemBinaryExpr;
+
+  class AddExpr = SemAddExpr;
+
+  class SubExpr = SemSubExpr;
+
+  class MulExpr = SemMulExpr;
+
+  class DivExpr = SemDivExpr;
+
+  class RemExpr = SemRemExpr;
+
+  class BitAndExpr = SemBitAndExpr;
+
+  class BitOrExpr = SemBitOrExpr;
+
+  class ShiftLeftExpr = SemShiftLeftExpr;
+
+  class ShiftRightExpr = SemShiftRightExpr;
+
+  class ShiftRightUnsignedExpr = SemShiftRightUnsignedExpr;
+
+  class RelationalExpr = SemRelationalExpr;
+
+  class UnaryExpr = SemUnaryExpr;
+
+  class ConvertExpr = SemConvertExpr;
+
+  class BoxExpr = SemBoxExpr;
+
+  class UnboxExpr = SemUnboxExpr;
+
+  class NegateExpr = SemNegateExpr;
+
+  class AddOneExpr = SemAddOneExpr;
+
+  class SubOneExpr = SemSubOneExpr;
+
+  class ConditionalExpr = SemConditionalExpr;
+
+  class BasicBlock = SemBasicBlock;
+
+  class Guard = SemGuard;
+
+  predicate implies_v2 = semImplies_v2/4;
+
+  predicate guardDirectlyControlsSsaRead = semGuardDirectlyControlsSsaRead/3;
+
+  class Type = SemType;
+
+  class IntegerType = SemIntegerType;
+
+  class FloatingPointType = SemFloatingPointType;
+
+  class AddressType = SemAddressType;
+
+  class SsaVariable = SemSsaVariable;
+
+  class SsaPhiNode = SemSsaPhiNode;
+
+  class SsaExplicitUpdate = SemSsaExplicitUpdate;
+
+  class SsaReadPosition = SemSsaReadPosition;
+
+  class SsaReadPositionPhiInputEdge = SemSsaReadPositionPhiInputEdge;
+
+  class SsaReadPositionBlock = SemSsaReadPositionBlock;
+
+  predicate backEdge = semBackEdge/3;
+
+  predicate conversionCannotOverflow(Type fromType, Type toType) {
+    SemanticType::conversionCannotOverflow(fromType, toType)
+  }
+}
+
+module SignAnalysis implements SignAnalysisSig<Sem> {
+  private import SignAnalysisCommon as SA
+  import SA::SignAnalysis<FloatDelta, Util>
+}
+
+module ConstantBounds implements BoundSig<SemLocation, Sem, FloatDelta> {
   class SemBound instanceof SemanticBound::SemBound {
     SemBound() {
       this instanceof SemanticBound::SemZeroBound
@@ -29,7 +120,7 @@ module ConstantBounds implements BoundSig<FloatDelta> {
   }
 }
 
-module RelativeBounds implements BoundSig<FloatDelta> {
+module RelativeBounds implements BoundSig<SemLocation, Sem, FloatDelta> {
   class SemBound instanceof SemanticBound::SemBound {
     SemBound() { not this instanceof SemanticBound::SemZeroBound }
 
@@ -47,13 +138,38 @@ module RelativeBounds implements BoundSig<FloatDelta> {
   }
 }
 
+module AllBounds implements BoundSig<SemLocation, Sem, FloatDelta> {
+  class SemBound instanceof SemanticBound::SemBound {
+    string toString() { result = super.toString() }
+
+    SemLocation getLocation() { result = super.getLocation() }
+
+    SemExpr getExpr(float delta) { result = super.getExpr(delta) }
+  }
+
+  class SemZeroBound extends SemBound instanceof SemanticBound::SemZeroBound { }
+
+  class SemSsaBound extends SemBound instanceof SemanticBound::SemSsaBound {
+    SemSsaVariable getAVariable() { result = this.(SemanticBound::SemSsaBound).getAVariable() }
+  }
+}
+
+private module ModulusAnalysisInstantiated implements ModulusAnalysisSig<Sem> {
+  class ModBound = AllBounds::SemBound;
+
+  private import semmle.code.cpp.rangeanalysis.new.internal.semantic.analysis.ModulusAnalysis as MA
+  import MA::ModulusAnalysis<FloatDelta, AllBounds, Util>
+}
+
+module Util = RangeUtil<FloatDelta, CppLangImplConstant>;
+
 module ConstantStage =
-  RangeStage<FloatDelta, ConstantBounds, FloatOverflow, CppLangImplConstant,
-    RangeUtil<FloatDelta, CppLangImplConstant>>;
+  RangeStage<SemLocation, Sem, FloatDelta, ConstantBounds, FloatOverflow, CppLangImplConstant,
+    SignAnalysis, ModulusAnalysisInstantiated, Util>;
 
 module RelativeStage =
-  RangeStage<FloatDelta, RelativeBounds, FloatOverflow, CppLangImplRelative,
-    RangeUtil<FloatDelta, CppLangImplRelative>>;
+  RangeStage<SemLocation, Sem, FloatDelta, RelativeBounds, FloatOverflow, CppLangImplRelative,
+    SignAnalysis, ModulusAnalysisInstantiated, Util>;
 
 private newtype TSemReason =
   TSemNoReason() or

cpp/ql/lib/semmle/code/cpp/rangeanalysis/new/internal/semantic/analysis/RangeAnalysisRelativeSpecific.qll

@@ -3,13 +3,12 @@
  */
 
 private import semmle.code.cpp.rangeanalysis.new.internal.semantic.Semantic
-private import RangeAnalysisStage
 private import semmle.code.cpp.rangeanalysis.new.internal.semantic.analysis.FloatDelta
-private import semmle.code.cpp.rangeanalysis.new.internal.semantic.analysis.IntDelta
 private import RangeAnalysisImpl
 private import semmle.code.cpp.rangeanalysis.RangeAnalysisUtils
+private import codeql.rangeanalysis.RangeAnalysis
 
-module CppLangImplRelative implements LangSig<FloatDelta> {
+module CppLangImplRelative implements LangSig<Sem, FloatDelta> {
   /**
    * Holds if the specified expression should be excluded from the result of `ssaRead()`.
    *

cpp/ql/lib/semmle/code/cpp/rangeanalysis/new/internal/semantic/analysis/RangeUtils.qll

@@ -4,10 +4,11 @@
 
 private import semmle.code.cpp.rangeanalysis.new.internal.semantic.Semantic
 private import RangeAnalysisRelativeSpecific
-private import RangeAnalysisStage as Range
+private import codeql.rangeanalysis.RangeAnalysis
+private import RangeAnalysisImpl
 private import ConstantAnalysis
 
-module RangeUtil<Range::DeltaSig D, Range::LangSig<D> Lang> implements Range::UtilSig<D> {
+module RangeUtil<DeltaSig D, LangSig<Sem, D> Lang> implements UtilSig<Sem, D> {
   /**
    * Gets an expression that equals `v - d`.
    */
@@ -138,27 +139,33 @@ module RangeUtil<Range::DeltaSig D, Range::LangSig<D> Lang> implements Range::Ut
     or
     not exists(Lang::getAlternateTypeForSsaVariable(var)) and result = var.getType()
   }
+
+  import Ranking
 }
 
-/**
- * Holds if `rix` is the number of input edges to `phi`.
- */
-predicate maxPhiInputRank(SemSsaPhiNode phi, int rix) {
-  rix = max(int r | rankedPhiInput(phi, _, _, r))
-}
+import Ranking
 
-/**
- * Holds if `inp` is an input to `phi` along `edge` and this input has index `r`
- * in an arbitrary 1-based numbering of the input edges to `phi`.
- */
-predicate rankedPhiInput(
-  SemSsaPhiNode phi, SemSsaVariable inp, SemSsaReadPositionPhiInputEdge edge, int r
-) {
-  edge.phiInput(phi, inp) and
-  edge =
-    rank[r](SemSsaReadPositionPhiInputEdge e |
-      e.phiInput(phi, _)
-    |
-      e order by e.getOrigBlock().getUniqueId()
-    )
+module Ranking {
+  /**
+   * Holds if `rix` is the number of input edges to `phi`.
+   */
+  predicate maxPhiInputRank(SemSsaPhiNode phi, int rix) {
+    rix = max(int r | rankedPhiInput(phi, _, _, r))
+  }
+
+  /**
+   * Holds if `inp` is an input to `phi` along `edge` and this input has index `r`
+   * in an arbitrary 1-based numbering of the input edges to `phi`.
+   */
+  predicate rankedPhiInput(
+    SemSsaPhiNode phi, SemSsaVariable inp, SemSsaReadPositionPhiInputEdge edge, int r
+  ) {
+    edge.phiInput(phi, inp) and
+    edge =
+      rank[r](SemSsaReadPositionPhiInputEdge e |
+        e.phiInput(phi, _)
+      |
+        e order by e.getOrigBlock().getUniqueId()
+      )
+  }
 }

cpp/ql/lib/semmle/code/cpp/rangeanalysis/new/internal/semantic/analysis/SignAnalysisCommon.qll

@@ -6,14 +6,15 @@
  * three-valued domain `{negative, zero, positive}`.
  */
 
-private import RangeAnalysisStage
+private import codeql.rangeanalysis.RangeAnalysis
+private import RangeAnalysisImpl
 private import SignAnalysisSpecific as Specific
 private import semmle.code.cpp.rangeanalysis.new.internal.semantic.Semantic
 private import ConstantAnalysis
 private import RangeUtils
 private import Sign
 
-module SignAnalysis<DeltaSig D, UtilSig<D> Utils> {
+module SignAnalysis<DeltaSig D, UtilSig<Sem, D> Utils> {
   /**
    * An SSA definition for which the analysis can compute the sign.
    *
@@ -507,4 +508,16 @@ module SignAnalysis<DeltaSig D, UtilSig<D> Utils> {
     not semExprSign(e) = TPos() and
     not semExprSign(e) = TZero()
   }
+
+  /**
+   * Holds if `e` may have positive values. This does not rule out the
+   * possibility for negative values.
+   */
+  predicate semMayBePositive(SemExpr e) { semExprSign(e) = TPos() }
+
+  /**
+   * Holds if `e` may have negative values. This does not rule out the
+   * possibility for positive values.
+   */
+  predicate semMayBeNegative(SemExpr e) { semExprSign(e) = TNeg() }
 }

cpp/ql/lib/semmlecode.cpp.dbscheme

@@ -197,6 +197,11 @@ svnchurn(
  * C++ dbscheme
  */
 
+extractor_version(
+    string codeql_version: string ref,
+    string frontend_version: string ref
+)
+
 @location = @location_stmt | @location_expr | @location_default ;
 
 /**

cpp/ql/lib/upgrades/5b388693c66db1e7dc2e76a90aa67a2b6eb74f0f/upgrade.properties

@@ -0,0 +1,2 @@
+description: Introduce extractor version numbers
+compatibility: full

cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-ir-consistency.expected

@@ -20,12 +20,8 @@ reverseRead
 argHasPostUpdate
 postWithInFlow
 | test.cpp:384:10:384:13 | memcpy output argument | PostUpdateNode should not be the target of local flow. |
-| test.cpp:384:10:384:13 | memcpy output argument | PostUpdateNode should not be the target of local flow. |
-| test.cpp:391:10:391:13 | memcpy output argument | PostUpdateNode should not be the target of local flow. |
 | test.cpp:391:10:391:13 | memcpy output argument | PostUpdateNode should not be the target of local flow. |
 | test.cpp:400:10:400:13 | memcpy output argument | PostUpdateNode should not be the target of local flow. |
-| test.cpp:400:10:400:13 | memcpy output argument | PostUpdateNode should not be the target of local flow. |
-| test.cpp:407:10:407:13 | memcpy output argument | PostUpdateNode should not be the target of local flow. |
 | test.cpp:407:10:407:13 | memcpy output argument | PostUpdateNode should not be the target of local flow. |
 viableImplInCallContextTooLarge
 uniqueParameterNodeAtPosition

cpp/ql/test/library-tests/dataflow/fields/dataflow-ir-consistency.expected

@@ -44,8 +44,6 @@ reverseRead
 argHasPostUpdate
 postWithInFlow
 | realistic.cpp:54:16:54:47 | memcpy output argument | PostUpdateNode should not be the target of local flow. |
-| realistic.cpp:54:16:54:47 | memcpy output argument | PostUpdateNode should not be the target of local flow. |
-| realistic.cpp:60:16:60:18 | memcpy output argument | PostUpdateNode should not be the target of local flow. |
 | realistic.cpp:60:16:60:18 | memcpy output argument | PostUpdateNode should not be the target of local flow. |
 viableImplInCallContextTooLarge
 uniqueParameterNodeAtPosition

cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected

@@ -2199,6 +2199,19 @@ WARNING: Module TaintTracking has been deprecated and may be removed in future (
 | map.cpp:436:55:436:59 | def | map.cpp:436:19:436:60 | call to pair | TAINT |
 | map.cpp:436:63:436:67 | first | map.cpp:436:7:436:67 | call to iterator |  |
 | map.cpp:437:7:437:9 | m35 | map.cpp:437:7:437:9 | call to unordered_map |  |
+| map.cpp:446:23:446:23 | call to map | map.cpp:448:3:448:3 | m |  |
+| map.cpp:446:23:446:23 | call to map | map.cpp:449:12:449:12 | m |  |
+| map.cpp:446:23:446:23 | call to map | map.cpp:451:1:451:1 | m |  |
+| map.cpp:447:12:447:26 | call to indirect_source | map.cpp:448:10:448:10 | p |  |
+| map.cpp:448:3:448:3 | m | map.cpp:448:4:448:4 | call to operator[] | TAINT |
+| map.cpp:448:3:448:3 | ref arg m | map.cpp:449:12:449:12 | m |  |
+| map.cpp:448:3:448:3 | ref arg m | map.cpp:451:1:451:1 | m |  |
+| map.cpp:448:3:448:10 | ... = ... | map.cpp:448:4:448:4 | call to operator[] [post update] |  |
+| map.cpp:448:4:448:4 | call to operator[] [post update] | map.cpp:448:3:448:3 | ref arg m | TAINT |
+| map.cpp:448:10:448:10 | p | map.cpp:448:3:448:10 | ... = ... |  |
+| map.cpp:449:12:449:12 | m | map.cpp:449:13:449:13 | call to operator[] | TAINT |
+| map.cpp:449:12:449:12 | ref arg m | map.cpp:451:1:451:1 | m |  |
+| map.cpp:449:13:449:13 | call to operator[] | map.cpp:450:8:450:8 | q |  |
 | movableclass.cpp:8:2:8:15 | this | movableclass.cpp:8:27:8:31 | constructor init of field v [pre-this] |  |
 | movableclass.cpp:8:21:8:22 | _v | movableclass.cpp:8:29:8:30 | _v |  |
 | movableclass.cpp:8:29:8:30 | _v | movableclass.cpp:8:27:8:31 | constructor init of field v | TAINT |
@@ -6609,6 +6622,27 @@ WARNING: Module TaintTracking has been deprecated and may be removed in future (
 | taint.cpp:711:13:711:13 | s | taint.cpp:711:2:711:8 | call to strncpy | TAINT |
 | taint.cpp:711:13:711:13 | s | taint.cpp:711:10:711:10 | ref arg d | TAINT |
 | taint.cpp:712:7:712:7 | ref arg d | taint.cpp:709:25:709:25 | d |  |
+| taint.cpp:718:17:718:31 | call to indirect_source | taint.cpp:720:27:720:32 | source |  |
+| taint.cpp:719:22:719:29 | ,.-;:_ | taint.cpp:720:35:720:39 | delim |  |
+| taint.cpp:719:22:719:29 | ,.-;:_ | taint.cpp:722:8:722:12 | delim |  |
+| taint.cpp:720:20:720:25 | call to strtok | taint.cpp:721:8:721:16 | tokenized |  |
+| taint.cpp:720:27:720:32 | source | taint.cpp:720:20:720:25 | call to strtok | TAINT |
+| taint.cpp:721:8:721:16 | tokenized | taint.cpp:721:7:721:16 | * ... | TAINT |
+| taint.cpp:722:8:722:12 | delim | taint.cpp:722:7:722:12 | * ... | TAINT |
+| taint.cpp:727:24:727:29 | source | taint.cpp:727:24:727:29 | source |  |
+| taint.cpp:727:24:727:29 | source | taint.cpp:729:18:729:23 | source |  |
+| taint.cpp:728:17:728:23 | 0 | taint.cpp:729:27:729:32 | endptr |  |
+| taint.cpp:728:17:728:23 | 0 | taint.cpp:731:7:731:12 | endptr |  |
+| taint.cpp:728:17:728:23 | 0 | taint.cpp:732:8:732:13 | endptr |  |
+| taint.cpp:729:11:729:16 | call to strtol | taint.cpp:730:7:730:7 | l |  |
+| taint.cpp:729:18:729:23 | source | taint.cpp:729:11:729:16 | call to strtol | TAINT |
+| taint.cpp:729:18:729:23 | source | taint.cpp:729:26:729:32 | ref arg & ... | TAINT |
+| taint.cpp:729:26:729:32 | ref arg & ... | taint.cpp:729:27:729:32 | endptr [inner post update] |  |
+| taint.cpp:729:26:729:32 | ref arg & ... | taint.cpp:731:7:731:12 | endptr |  |
+| taint.cpp:729:26:729:32 | ref arg & ... | taint.cpp:732:8:732:13 | endptr |  |
+| taint.cpp:729:27:729:32 | endptr | taint.cpp:729:26:729:32 | & ... |  |
+| taint.cpp:731:7:731:12 | ref arg endptr | taint.cpp:732:8:732:13 | endptr |  |
+| taint.cpp:732:8:732:13 | endptr | taint.cpp:732:7:732:13 | * ... | TAINT |
 | vector.cpp:16:43:16:49 | source1 | vector.cpp:17:26:17:32 | source1 |  |
 | vector.cpp:16:43:16:49 | source1 | vector.cpp:31:38:31:44 | source1 |  |
 | vector.cpp:17:21:17:33 | call to vector | vector.cpp:19:14:19:14 | v |  |

cpp/ql/test/library-tests/dataflow/taint-tests/map.cpp

@@ -436,3 +436,16 @@ void test_unordered_map()
 	sink(m35.emplace(std::pair<char *, char *>(source(), "def")).first); // $ MISSING: ast,ir
 	sink(m35); // $ MISSING: ast,ir
 }
+
+namespace {
+	int* indirect_source();
+	void indirect_sink(int*);
+}
+
+void test_indirect_taint() {
+  std::map<int, int*> m;
+  int* p = indirect_source();
+  m[1] = p;
+  int* q = m[1];
+  sink(q); // $ ir MISSING: ast
+}

cpp/ql/test/library-tests/dataflow/taint-tests/taint.cpp

@@ -710,4 +710,24 @@ void test_strncpy(char* d, char* s) {
 	argument_source(s);
 	strncpy(d, s, 16);
 	sink(d); // $ ast ir
+}
+
+char* indirect_source();
+
+void test_strtok_indirect() {
+	char *source = indirect_source();
+	const char* delim = ",.-;:_";
+	char* tokenized = strtok(source, delim);
+	sink(*tokenized); // $ ir MISSING: ast
+	sink(*delim);
+}
+
+long int strtol(const char*, char**, int);
+
+void test_strtol(char *source) {
+	char* endptr = nullptr;
+	long l = strtol(source, &endptr, 10);
+	sink(l); // $ ast,ir
+	sink(endptr); // $ ast,ir
+	sink(*endptr); // $ ast,ir
 }

cpp/ql/test/library-tests/dataflow/taint-tests/taint.ql

@@ -84,6 +84,8 @@ module IRTest {
       or
       source.asIndirectExpr().(FunctionCall).getTarget().getName() = "source"
       or
+      source.asIndirectExpr().(FunctionCall).getTarget().getName() = "indirect_source"
+      or
       source.asParameter().getName().matches("source%")
       or
       exists(FunctionCall fc |

cpp/ql/test/library-tests/ir/ir/PrintAST.expected

@@ -15938,6 +15938,44 @@ ir.cpp:
 # 2104|             Type = [CTypedefType,Size_t] size_t
 # 2104|             ValueCategory = prvalue(load)
 # 2105|     getStmt(6): [ReturnStmt] return ...
+# 2107| [TopLevelFunction] double strtod(char const*, char**)
+# 2107|   <params>: 
+# 2107|     getParameter(0): [Parameter] str
+# 2107|         Type = [PointerType] const char *
+# 2107|     getParameter(1): [Parameter] endptr
+# 2107|         Type = [PointerType] char **
+# 2109| [TopLevelFunction] char* test_strtod(char*)
+# 2109|   <params>: 
+# 2109|     getParameter(0): [Parameter] s
+# 2109|         Type = [CharPointerType] char *
+# 2109|   getEntryPoint(): [BlockStmt] { ... }
+# 2110|     getStmt(0): [DeclStmt] declaration
+# 2110|       getDeclarationEntry(0): [VariableDeclarationEntry] definition of end
+# 2110|           Type = [CharPointerType] char *
+# 2111|     getStmt(1): [DeclStmt] declaration
+# 2111|       getDeclarationEntry(0): [VariableDeclarationEntry] definition of d
+# 2111|           Type = [DoubleType] double
+# 2111|         getVariable().getInitializer(): [Initializer] initializer for d
+# 2111|           getExpr(): [FunctionCall] call to strtod
+# 2111|               Type = [DoubleType] double
+# 2111|               ValueCategory = prvalue
+# 2111|             getArgument(0): [VariableAccess] s
+# 2111|                 Type = [CharPointerType] char *
+# 2111|                 ValueCategory = prvalue(load)
+# 2111|             getArgument(1): [AddressOfExpr] & ...
+# 2111|                 Type = [PointerType] char **
+# 2111|                 ValueCategory = prvalue
+# 2111|               getOperand(): [VariableAccess] end
+# 2111|                   Type = [CharPointerType] char *
+# 2111|                   ValueCategory = lvalue
+# 2111|             getArgument(0).getFullyConverted(): [CStyleCast] (const char *)...
+# 2111|                 Conversion = [PointerConversion] pointer conversion
+# 2111|                 Type = [PointerType] const char *
+# 2111|                 ValueCategory = prvalue
+# 2112|     getStmt(2): [ReturnStmt] return ...
+# 2112|       getExpr(): [VariableAccess] end
+# 2112|           Type = [CharPointerType] char *
+# 2112|           ValueCategory = prvalue(load)
 perf-regression.cpp:
 #    4| [CopyAssignmentOperator] Big& Big::operator=(Big const&)
 #    4|   <params>: 

cpp/ql/test/library-tests/ir/ir/aliased_ir.expected

@@ -12333,6 +12333,40 @@ ir.cpp:
 # 2098|     v2098_8(void)                           = AliasedUse                      : ~m2104_8
 # 2098|     v2098_9(void)                           = ExitFunction                    : 
 
+# 2109| char* test_strtod(char*)
+# 2109|   Block 0
+# 2109|     v2109_1(void)           = EnterFunction                  : 
+# 2109|     m2109_2(unknown)        = AliasedDefinition              : 
+# 2109|     m2109_3(unknown)        = InitializeNonLocal             : 
+# 2109|     m2109_4(unknown)        = Chi                            : total:m2109_2, partial:m2109_3
+# 2109|     r2109_5(glval<char *>)  = VariableAddress[s]             : 
+# 2109|     m2109_6(char *)         = InitializeParameter[s]         : &:r2109_5
+# 2109|     r2109_7(char *)         = Load[s]                        : &:r2109_5, m2109_6
+# 2109|     m2109_8(unknown)        = InitializeIndirection[s]       : &:r2109_7
+# 2110|     r2110_1(glval<char *>)  = VariableAddress[end]           : 
+# 2110|     m2110_2(char *)         = Uninitialized[end]             : &:r2110_1
+# 2111|     r2111_1(glval<double>)  = VariableAddress[d]             : 
+# 2111|     r2111_2(glval<unknown>) = FunctionAddress[strtod]        : 
+# 2111|     r2111_3(glval<char *>)  = VariableAddress[s]             : 
+# 2111|     r2111_4(char *)         = Load[s]                        : &:r2111_3, m2109_6
+# 2111|     r2111_5(char *)         = Convert                        : r2111_4
+# 2111|     r2111_6(glval<char *>)  = VariableAddress[end]           : 
+# 2111|     r2111_7(char **)        = CopyValue                      : r2111_6
+# 2111|     r2111_8(double)         = Call[strtod]                   : func:r2111_2, 0:r2111_5, 1:r2111_7
+# 2111|     v2111_9(void)           = ^BufferReadSideEffect[0]       : &:r2111_5, ~m2109_8
+# 2111|     m2111_10(char *)        = ^IndirectMayWriteSideEffect[1] : &:r2111_7
+# 2111|     m2111_11(char *)        = Chi                            : total:m2110_2, partial:m2111_10
+# 2111|     m2111_12(double)        = Store[d]                       : &:r2111_1, r2111_8
+# 2112|     r2112_1(glval<char *>)  = VariableAddress[#return]       : 
+# 2112|     r2112_2(glval<char *>)  = VariableAddress[end]           : 
+# 2112|     r2112_3(char *)         = Load[end]                      : &:r2112_2, m2111_11
+# 2112|     m2112_4(char *)         = Store[#return]                 : &:r2112_1, r2112_3
+# 2109|     v2109_9(void)           = ReturnIndirection[s]           : &:r2109_7, m2109_8
+# 2109|     r2109_10(glval<char *>) = VariableAddress[#return]       : 
+# 2109|     v2109_11(void)          = ReturnValue                    : &:r2109_10, m2112_4
+# 2109|     v2109_12(void)          = AliasedUse                     : m2109_3
+# 2109|     v2109_13(void)          = ExitFunction                   : 
+
 perf-regression.cpp:
 #    6| void Big::Big()
 #    6|   Block 0

cpp/ql/test/library-tests/ir/ir/ir.cpp

@@ -2104,4 +2104,12 @@ void newArrayCorrectType(size_t n) {
   new int[n] { 0, 1, 2 };
 }
 
+double strtod (const char* str, char** endptr);
+
+char* test_strtod(char *s) {
+  char *end;
+  double d = strtod(s, &end);
+  return end;
+}
+
 // semmle-extractor-options: -std=c++17 --clang

cpp/ql/test/library-tests/ir/ir/operand_locations.expected

@@ -10004,6 +10004,36 @@
 | ir.cpp:2104:11:2104:11 | Address | &:r2104_2 |
 | ir.cpp:2104:11:2104:11 | Left | r2104_3 |
 | ir.cpp:2104:11:2104:11 | Load | m2098_6 |
+| ir.cpp:2109:7:2109:17 | Address | &:r2109_10 |
+| ir.cpp:2109:7:2109:17 | ChiPartial | partial:m2109_3 |
+| ir.cpp:2109:7:2109:17 | ChiTotal | total:m2109_2 |
+| ir.cpp:2109:7:2109:17 | Load | m2112_4 |
+| ir.cpp:2109:7:2109:17 | SideEffect | m2109_3 |
+| ir.cpp:2109:25:2109:25 | Address | &:r2109_5 |
+| ir.cpp:2109:25:2109:25 | Address | &:r2109_5 |
+| ir.cpp:2109:25:2109:25 | Address | &:r2109_7 |
+| ir.cpp:2109:25:2109:25 | Address | &:r2109_7 |
+| ir.cpp:2109:25:2109:25 | Load | m2109_6 |
+| ir.cpp:2109:25:2109:25 | SideEffect | m2109_8 |
+| ir.cpp:2110:9:2110:11 | Address | &:r2110_1 |
+| ir.cpp:2111:10:2111:10 | Address | &:r2111_1 |
+| ir.cpp:2111:14:2111:19 | CallTarget | func:r2111_2 |
+| ir.cpp:2111:14:2111:19 | StoreValue | r2111_8 |
+| ir.cpp:2111:21:2111:21 | Address | &:r2111_3 |
+| ir.cpp:2111:21:2111:21 | Address | &:r2111_5 |
+| ir.cpp:2111:21:2111:21 | Arg(0) | 0:r2111_5 |
+| ir.cpp:2111:21:2111:21 | Load | m2109_6 |
+| ir.cpp:2111:21:2111:21 | SideEffect | ~m2109_8 |
+| ir.cpp:2111:21:2111:21 | Unary | r2111_4 |
+| ir.cpp:2111:24:2111:27 | Address | &:r2111_7 |
+| ir.cpp:2111:24:2111:27 | Arg(1) | 1:r2111_7 |
+| ir.cpp:2111:24:2111:27 | ChiPartial | partial:m2111_10 |
+| ir.cpp:2111:24:2111:27 | ChiTotal | total:m2110_2 |
+| ir.cpp:2111:25:2111:27 | Unary | r2111_6 |
+| ir.cpp:2112:3:2112:13 | Address | &:r2112_1 |
+| ir.cpp:2112:10:2112:12 | Address | &:r2112_2 |
+| ir.cpp:2112:10:2112:12 | Load | m2111_11 |
+| ir.cpp:2112:10:2112:12 | StoreValue | r2112_3 |
 | perf-regression.cpp:6:3:6:5 | Address | &:r6_5 |
 | perf-regression.cpp:6:3:6:5 | Address | &:r6_5 |
 | perf-regression.cpp:6:3:6:5 | Address | &:r6_7 |

cpp/ql/test/library-tests/ir/ir/raw_ir.expected

@@ -11538,6 +11538,38 @@ ir.cpp:
 # 2098|     v2098_7(void)                          = AliasedUse                      : ~m?
 # 2098|     v2098_8(void)                          = ExitFunction                    : 
 
+# 2109| char* test_strtod(char*)
+# 2109|   Block 0
+# 2109|     v2109_1(void)           = EnterFunction                  : 
+# 2109|     mu2109_2(unknown)       = AliasedDefinition              : 
+# 2109|     mu2109_3(unknown)       = InitializeNonLocal             : 
+# 2109|     r2109_4(glval<char *>)  = VariableAddress[s]             : 
+# 2109|     mu2109_5(char *)        = InitializeParameter[s]         : &:r2109_4
+# 2109|     r2109_6(char *)         = Load[s]                        : &:r2109_4, ~m?
+# 2109|     mu2109_7(unknown)       = InitializeIndirection[s]       : &:r2109_6
+# 2110|     r2110_1(glval<char *>)  = VariableAddress[end]           : 
+# 2110|     mu2110_2(char *)        = Uninitialized[end]             : &:r2110_1
+# 2111|     r2111_1(glval<double>)  = VariableAddress[d]             : 
+# 2111|     r2111_2(glval<unknown>) = FunctionAddress[strtod]        : 
+# 2111|     r2111_3(glval<char *>)  = VariableAddress[s]             : 
+# 2111|     r2111_4(char *)         = Load[s]                        : &:r2111_3, ~m?
+# 2111|     r2111_5(char *)         = Convert                        : r2111_4
+# 2111|     r2111_6(glval<char *>)  = VariableAddress[end]           : 
+# 2111|     r2111_7(char **)        = CopyValue                      : r2111_6
+# 2111|     r2111_8(double)         = Call[strtod]                   : func:r2111_2, 0:r2111_5, 1:r2111_7
+# 2111|     v2111_9(void)           = ^BufferReadSideEffect[0]       : &:r2111_5, ~m?
+# 2111|     mu2111_10(char *)       = ^IndirectMayWriteSideEffect[1] : &:r2111_7
+# 2111|     mu2111_11(double)       = Store[d]                       : &:r2111_1, r2111_8
+# 2112|     r2112_1(glval<char *>)  = VariableAddress[#return]       : 
+# 2112|     r2112_2(glval<char *>)  = VariableAddress[end]           : 
+# 2112|     r2112_3(char *)         = Load[end]                      : &:r2112_2, ~m?
+# 2112|     mu2112_4(char *)        = Store[#return]                 : &:r2112_1, r2112_3
+# 2109|     v2109_8(void)           = ReturnIndirection[s]           : &:r2109_6, ~m?
+# 2109|     r2109_9(glval<char *>)  = VariableAddress[#return]       : 
+# 2109|     v2109_10(void)          = ReturnValue                    : &:r2109_9, ~m?
+# 2109|     v2109_11(void)          = AliasedUse                     : ~m?
+# 2109|     v2109_12(void)          = ExitFunction                   : 
+
 perf-regression.cpp:
 #    6| void Big::Big()
 #    6|   Block 0

cpp/ql/test/library-tests/ir/range-analysis/test.cpp

@@ -56,7 +56,7 @@
     while (f3_get(n)) n+=2;
 
     for (int i = 0; i < n; i += 2) {
-      range(i); // $ range=>=0 SPURIOUS: range="<=Phi: call to f3_get-1" range="<=Phi: call to f3_get-2"
+      range(i); // $ range=>=0 range="<=Phi: call to f3_get-2"
     }
   }
 
@@ -117,3 +117,16 @@ void test_sub(int x, int y, int n) {
     }
   }
 }
+
+void test_div(int x) {
+  if (3 <= x && x <= 7) {
+    range(x / 2); // $ range=>=1 range=<=3
+    range(x / 3); // $ range=>=1 range=<=2
+    range(x >> 2); // $ range=>=0 range=<=1
+  }
+  if (2 <= x && x <= 8) {
+    range(x / 2); // $ range=>=1 range=<=4
+    range(x / 3); // $ range=>=0 range=<=2
+    range(x >> 2); // $ range=>=0 range=<=2
+  }
+}

cpp/ql/test/query-tests/Critical/MemoryFreed/MemoryFreed.expected

@@ -97,6 +97,10 @@
 | test_free.cpp:260:9:260:9 | p |
 | test_free.cpp:263:12:263:12 | p |
 | test_free.cpp:269:7:269:11 | ... = ... |
+| test_free.cpp:277:11:277:13 | buf |
+| test_free.cpp:282:10:282:12 | buf |
+| test_free.cpp:288:8:288:10 | buf |
+| test_free.cpp:293:8:293:10 | buf |
 | virtual.cpp:18:10:18:10 | a |
 | virtual.cpp:19:10:19:10 | c |
 | virtual.cpp:38:10:38:10 | b |

cpp/ql/test/query-tests/Critical/MemoryFreed/UseAfterFree.expected

@@ -12,6 +12,10 @@ edges
 | test_free.cpp:233:14:233:15 | * ... | test_free.cpp:236:9:236:10 | * ... |
 | test_free.cpp:239:14:239:15 | * ... | test_free.cpp:241:9:241:10 | * ... |
 | test_free.cpp:245:10:245:11 | * ... | test_free.cpp:246:9:246:10 | * ... |
+| test_free.cpp:293:8:293:10 | buf | test_free.cpp:294:3:294:13 | ... = ... |
+| test_free.cpp:294:3:294:13 | ... = ... | test_free.cpp:294:5:294:7 | s indirection [post update] [buf] |
+| test_free.cpp:294:5:294:7 | s indirection [post update] [buf] | test_free.cpp:295:12:295:12 | s indirection [buf] |
+| test_free.cpp:295:12:295:12 | s indirection [buf] | test_free.cpp:295:14:295:16 | buf |
 nodes
 | test_free.cpp:11:10:11:10 | a | semmle.label | a |
 | test_free.cpp:12:5:12:5 | a | semmle.label | a |
@@ -38,6 +42,11 @@ nodes
 | test_free.cpp:241:9:241:10 | * ... | semmle.label | * ... |
 | test_free.cpp:245:10:245:11 | * ... | semmle.label | * ... |
 | test_free.cpp:246:9:246:10 | * ... | semmle.label | * ... |
+| test_free.cpp:293:8:293:10 | buf | semmle.label | buf |
+| test_free.cpp:294:3:294:13 | ... = ... | semmle.label | ... = ... |
+| test_free.cpp:294:5:294:7 | s indirection [post update] [buf] | semmle.label | s indirection [post update] [buf] |
+| test_free.cpp:295:12:295:12 | s indirection [buf] | semmle.label | s indirection [buf] |
+| test_free.cpp:295:14:295:16 | buf | semmle.label | buf |
 subpaths
 #select
 | test_free.cpp:12:5:12:5 | a | test_free.cpp:11:10:11:10 | a | test_free.cpp:12:5:12:5 | a | Memory may have been previously freed by $@. | test_free.cpp:11:5:11:8 | call to free | call to free |
@@ -53,3 +62,4 @@ subpaths
 | test_free.cpp:236:9:236:10 | * ... | test_free.cpp:233:14:233:15 | * ... | test_free.cpp:236:9:236:10 | * ... | Memory may have been previously freed by $@. | test_free.cpp:233:9:233:12 | call to free | call to free |
 | test_free.cpp:241:9:241:10 | * ... | test_free.cpp:239:14:239:15 | * ... | test_free.cpp:241:9:241:10 | * ... | Memory may have been previously freed by $@. | test_free.cpp:239:9:239:12 | call to free | call to free |
 | test_free.cpp:246:9:246:10 | * ... | test_free.cpp:245:10:245:11 | * ... | test_free.cpp:246:9:246:10 | * ... | Memory may have been previously freed by $@. | test_free.cpp:245:5:245:8 | call to free | call to free |
+| test_free.cpp:295:14:295:16 | buf | test_free.cpp:293:8:293:10 | buf | test_free.cpp:295:14:295:16 | buf | Memory may have been previously freed by $@. | test_free.cpp:293:3:293:6 | call to free | call to free |

cpp/ql/test/query-tests/Critical/MemoryFreed/test_free.cpp

@@ -267,4 +267,30 @@ void test_free_assign() {
 	void *a = malloc(10); 
 	void *b;
 	free(b = a); // GOOD 
+}
+
+struct MyStruct {
+  char* buf;
+};
+
+void test_free_struct(MyStruct* s) {
+  free(s->buf);
+  char c = s->buf[0]; // BAD [FALSE NEGATIVE]
+}
+
+void test_free_struct2(MyStruct s) {
+  free(s.buf);
+  char c = s.buf[0]; // BAD [FALSE NEGATIVE]
+}
+
+void test_free_struct3(MyStruct s) {
+  char* buf = s.buf;
+  free(buf);
+  char c = s.buf[0]; // BAD [FALSE NEGATIVE]
+}
+
+void test_free_struct4(char* buf, MyStruct s) {
+  free(buf);
+  s.buf = buf;
+  char c = s.buf[0]; // BAD
 }

csharp/extractor/Semmle.Extraction.CSharp.StubGenerator/StubVisitor.cs

@@ -186,7 +186,8 @@ internal sealed class StubVisitor : SymbolVisitor
                 }
                 break;
             case TypedConstantKind.Enum:
-                stubWriter.Write("throw null");
+                stubWriter.Write($"({c.Type!.GetQualifiedName()}) ");
+                stubWriter.Write(c.Value!.ToString());
                 break;
             case TypedConstantKind.Array:
                 stubWriter.Write("new []{");
@@ -200,7 +201,8 @@ internal sealed class StubVisitor : SymbolVisitor
     }
 
     private static readonly HashSet<string> attributeAllowList = new() {
-        "System.FlagsAttribute"
+        "System.FlagsAttribute",
+        "System.AttributeUsageAttribute"
     };
 
     private void StubAttribute(AttributeData a, string prefix)
@@ -219,6 +221,14 @@ internal sealed class StubVisitor : SymbolVisitor
         {
             stubWriter.Write("(");
             WriteCommaSep(a.ConstructorArguments, StubTypedConstant);
+            if (a.ConstructorArguments.Any() && a.NamedArguments.Any())
+                stubWriter.Write(",");
+            WriteCommaSep(a.NamedArguments, arg =>
+            {
+                stubWriter.Write(arg.Key);
+                stubWriter.Write(" = ");
+                StubTypedConstant(arg.Value);
+            });
             stubWriter.Write(")");
         }
         stubWriter.WriteLine("]");

csharp/extractor/Semmle.Extraction.CSharp/Entities/Attribute.cs

@@ -82,10 +82,16 @@ namespace Semmle.Extraction.CSharp.Entities
                 var paramName = Symbol.AttributeConstructor?.Parameters[i].Name;
                 var argSyntax = ctorArguments?.SingleOrDefault(a => a.NameColon is not null && a.NameColon.Name.Identifier.Text == paramName);
 
+                var isParamsParameter = false;
+
                 if (argSyntax is null &&                            // couldn't find named argument
                     ctorArguments?.Count > childIndex &&            // there're more arguments
                     ctorArguments[childIndex].NameColon is null)    // the argument is positional
                 {
+                    // The current argument is not named
+                    // so the previous ones were also not named
+                    // so the child index matches the parameter index.
+                    isParamsParameter = Symbol?.AttributeConstructor?.Parameters[childIndex].IsParams == true;
                     argSyntax = ctorArguments[childIndex];
                 }
 
@@ -94,6 +100,28 @@ namespace Semmle.Extraction.CSharp.Entities
                     argSyntax?.Expression,
                     this,
                     childIndex++);
+
+                if (isParamsParameter &&
+                    ctorArguments is not null)
+                {
+                    // The current argument is a params argument, so we're processing all the remaining arguments:
+                    while (childIndex < ctorArguments.Count)
+                    {
+                        if (ctorArguments[childIndex].Expression is null)
+                        {
+                            // This shouldn't happen
+                            continue;
+                        }
+
+                        CreateExpressionFromArgument(
+                            constructorArgument,
+                            ctorArguments[childIndex].Expression,
+                            this,
+                            childIndex);
+
+                        childIndex++;
+                    }
+                }
             }
 
             foreach (var namedArgument in Symbol.NamedArguments)

csharp/ql/lib/semmle/code/csharp/dataflow/Bound.qll

@@ -25,16 +25,8 @@ abstract class Bound extends TBound {
   /** Gets an expression that equals this bound. */
   Expr getExpr() { result = this.getExpr(0) }
 
-  /**
-   * Holds if this element is at the specified location.
-   * The location spans column `sc` of line `sl` to
-   * column `ec` of line `el` in file `path`.
-   * For more information, see
-   * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
-   */
-  predicate hasLocationInfo(string path, int sl, int sc, int el, int ec) {
-    path = "" and sl = 0 and sc = 0 and el = 0 and ec = 0
-  }
+  /** Gets the location of this bound. */
+  abstract Location getLocation();
 }
 
 /**
@@ -45,6 +37,8 @@ class ZeroBound extends Bound, TBoundZero {
   override string toString() { result = "0" }
 
   override Expr getExpr(int delta) { result.(ConstantIntegerExpr).getIntValue() = delta }
+
+  override Location getLocation() { result.hasLocationInfo("", 0, 0, 0, 0) }
 }
 
 /**
@@ -58,9 +52,7 @@ class SsaBound extends Bound, TBoundSsa {
 
   override Expr getExpr(int delta) { result = this.getSsa().getAUse() and delta = 0 }
 
-  override predicate hasLocationInfo(string path, int sl, int sc, int el, int ec) {
-    this.getSsa().getLocation().hasLocationInfo(path, sl, sc, el, ec)
-  }
+  override Location getLocation() { result = this.getSsa().getLocation() }
 }
 
 /**
@@ -72,7 +64,5 @@ class ExprBound extends Bound, TBoundExpr {
 
   override Expr getExpr(int delta) { this = TBoundExpr(result) and delta = 0 }
 
-  override predicate hasLocationInfo(string path, int sl, int sc, int el, int ec) {
-    this.getExpr().getLocation().hasLocationInfo(path, sl, sc, el, ec)
-  }
+  override Location getLocation() { result = this.getExpr().getLocation() }
 }

csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/BoundSpecific.qll

@@ -12,6 +12,8 @@ class SsaVariable = SU::SsaVariable;
 
 class Expr = CS::ControlFlow::Nodes::ExprNode;
 
+class Location = CS::Location;
+
 class IntegralType = CS::IntegralType;
 
 class ConstantIntegerExpr = CU::ConstantIntegerExpr;

csharp/ql/src/Stubs/AllStubsFromReference.ql

@@ -1,15 +0,0 @@
-/**
- * Tool to generate C# stubs from a qltest snapshot.
- */
-
-import csharp
-import Stubs
-
-/** All public declarations from assemblies. */
-class AllExternalPublicDeclarations extends GeneratedDeclaration {
-  AllExternalPublicDeclarations() { this.fromLibrary() }
-}
-
-from Assembly a
-select a.getFullName(), a.getName(), a.getVersion().toString(), a.getFile().getAbsolutePath(),
-  generatedCode(a)

csharp/ql/src/Stubs/AllStubsFromSource.ql

@@ -1,22 +0,0 @@
-/**
- * Tool to generate C# stubs from a qltest snapshot.
- */
-
-import csharp
-import Stubs
-
-/** All public declarations from source. */
-class AllDeclarations extends GeneratedDeclaration {
-  AllDeclarations() { not this.fromLibrary() }
-}
-
-/** Exclude types from these standard assemblies. */
-private class DefaultLibs extends ExcludedAssembly {
-  DefaultLibs() {
-    this.getName() = "System.Private.CoreLib" or
-    this.getName() = "mscorlib" or
-    this.getName() = "System.Runtime"
-  }
-}
-
-select concat(generatedCode(_) + "\n\n")

csharp/ql/src/Stubs/MinimalStubsFromSource.ql

@@ -1,41 +0,0 @@
-/**
- * Tool to generate C# stubs from a qltest snapshot.
- *
- * It finds all declarations used in the source code,
- * and generates minimal C# stubs containing those declarations
- * and their dependencies.
- */
-
-import csharp
-import Stubs
-
-/** Declarations used by source code. */
-class UsedInSource extends GeneratedDeclaration {
-  UsedInSource() {
-    (
-      this = any(Access a).getTarget()
-      or
-      this = any(Call c).getTarget()
-      or
-      this = any(TypeMention tm).getType()
-      or
-      exists(Virtualizable v | v.fromSource() |
-        this = v.getImplementee() or this = v.getOverridee()
-      )
-      or
-      this = any(Attribute a).getType().getAConstructor()
-    ) and
-    this.fromLibrary()
-  }
-}
-
-/** Exclude types from these standard assemblies. */
-private class DefaultLibs extends ExcludedAssembly {
-  DefaultLibs() {
-    this.getName() = "System.Private.CoreLib" or
-    this.getName() = "mscorlib" or
-    this.getName() = "System.Runtime"
-  }
-}
-
-select concat(generatedCode(_) + "\n\n")

csharp/ql/src/Stubs/Stubs.qll

@@ -1,965 +0,0 @@
-/**
- * Generates C# stubs for use in test code.
- *
- * Extend the abstract class `GeneratedDeclaration` with the declarations that should be generated.
- * This will generate stubs for all the required dependencies as well.
- *
- * Use
- * ```ql
- * select generatedCode()
- * ```
- * to retrieve the generated C# code.
- */
-
-import csharp
-private import semmle.code.csharp.commons.QualifiedName
-private import semmle.code.csharp.frameworks.System
-private import semmle.code.dotnet.DotNet as DotNet // added to handle VoidType as a ValueOrRefType
-
-/** An element that should be in the generated code. */
-abstract class GeneratedElement extends Element { }
-
-/** A member that should be in the generated code. */
-abstract class GeneratedMember extends Member, GeneratedElement { }
-
-/** Class representing all `struct`s, such as user defined ones and built-in ones, like `int`. */
-private class StructExt extends Type {
-  StructExt() {
-    this instanceof Struct or
-    this instanceof SimpleType or
-    this instanceof VoidType or
-    this instanceof SystemIntPtrType
-  }
-}
-
-/** A type that should be in the generated code. */
-abstract private class GeneratedType extends Type, GeneratedElement {
-  GeneratedType() {
-    (
-      this instanceof Interface
-      or
-      this instanceof Class
-      or
-      this instanceof StructExt
-      or
-      this instanceof Enum
-      or
-      this instanceof DelegateType
-    ) and
-    not this instanceof ConstructedType and
-    not this.getALocation() instanceof ExcludedAssembly
-  }
-
-  /**
-   * Holds if this type is defined in multiple assemblies, and at least one of
-   * them is in the `Microsoft.NETCore.App.Ref` folder. In this case, we only stub
-   * the type in the assembly in `Microsoft.NETCore.App.Ref`. In case there are
-   * multiple assemblies in this folder, then we prefer `System.Runtime`.
-   */
-  private predicate isDuplicate(Assembly assembly) {
-    // type exists in multiple assemblies
-    count(this.getALocation().(Assembly)) > 1 and
-    // at least one of them is in the `Microsoft.NETCore.App.Ref` folder
-    this.getALocation()
-        .(Assembly)
-        .getFile()
-        .getAbsolutePath()
-        .matches("%Microsoft.NETCore.App.Ref%") and
-    exists(int i |
-      i =
-        count(Assembly a |
-          this.getALocation() = a and
-          a.getFile().getAbsolutePath().matches("%Microsoft.NETCore.App.Ref%")
-        )
-    |
-      i = 1 and
-      // assemblies not in `Microsoft.NETCore.App.Ref` folder are considered duplicates
-      not assembly.getFile().getAbsolutePath().matches("%Microsoft.NETCore.App.Ref%")
-      or
-      i > 1 and
-      // one of the assemblies is named `System.Runtime`
-      this.getALocation().(Assembly).getName() = "System.Runtime" and
-      // all others are considered duplicates
-      assembly.getName() != "System.Runtime"
-    )
-  }
-
-  predicate isInAssembly(Assembly assembly) { this.getALocation() = assembly }
-
-  private string stubKeyword() {
-    this instanceof Interface and result = "interface"
-    or
-    this instanceof StructExt and result = "struct"
-    or
-    this instanceof Class and result = "class"
-    or
-    this instanceof Enum and result = "enum"
-    or
-    this instanceof DelegateType and result = "delegate"
-  }
-
-  private string stubAbstractModifier() {
-    if this.(Class).isAbstract() then result = "abstract " else result = ""
-  }
-
-  private string stubStaticModifier() {
-    if this.isStatic() then result = "static " else result = ""
-  }
-
-  private string stubPartialModifier() {
-    if
-      count(Assembly a | this.getALocation() = a) <= 1 or
-      this instanceof Enum
-    then result = ""
-    else result = "partial "
-  }
-
-  private string stubAttributes() {
-    if this.(ValueOrRefType).getAnAttribute().getType().hasQualifiedName("System", "FlagsAttribute")
-    then result = "[System.Flags]\n"
-    else result = ""
-  }
-
-  /** Gets the entire C# stub code for this type. */
-  pragma[nomagic]
-  final string getStub(Assembly assembly) {
-    this.isInAssembly(assembly) and
-    if this.isDuplicate(assembly)
-    then
-      result =
-        "/* Duplicate type '" + this.getName() + "' is not stubbed in this assembly '" +
-          assembly.toString() + "'. */\n\n"
-    else (
-      not this instanceof DelegateType and
-      result =
-        this.stubAttributes() + stubUnsafe(this) + stubAccessibility(this) +
-          this.stubAbstractModifier() + this.stubStaticModifier() + this.stubPartialModifier() +
-          this.stubKeyword() + " " + this.getUndecoratedName() + stubGenericArguments(this) +
-          this.stubBaseTypesString() + stubTypeParametersConstraints(this) + "\n{\n" +
-          this.stubPrivateConstructor() + this.stubMembers(assembly) + "}\n\n"
-      or
-      result =
-        this.stubAttributes() + stubUnsafe(this) + stubAccessibility(this) + this.stubKeyword() +
-          " " + stubClassName(this.(DelegateType).getReturnType()) + " " + this.getUndecoratedName()
-          + stubGenericArguments(this) + "(" + stubParameters(this) + ");\n\n"
-    )
-  }
-
-  private ValueOrRefType getAnInterestingBaseType() {
-    result = this.(ValueOrRefType).getABaseType() and
-    not result instanceof ObjectType and
-    not result.hasQualifiedName("System", "ValueType") and
-    (not result instanceof Interface or result.(Interface).isEffectivelyPublic())
-  }
-
-  private string stubBaseTypesString() {
-    if this instanceof Enum
-    then result = " : " + this.(Enum).getUnderlyingType().toStringWithTypes()
-    else
-      if exists(this.getAnInterestingBaseType())
-      then
-        result =
-          " : " +
-            concat(int i, ValueOrRefType t |
-              t = this.getAnInterestingBaseType() and
-              (if t instanceof Class then i = 0 else i = 1)
-            |
-              stubClassName(t), ", " order by i, t.getQualifiedName()
-            )
-      else result = ""
-  }
-
-  language[monotonicAggregates]
-  private string stubMembers(Assembly assembly) {
-    result =
-      concat(GeneratedMember m |
-        m = this.getAGeneratedMember(assembly)
-      |
-        stubMember(m, assembly)
-        order by
-          m.getQualifiedNameWithTypes(), stubExplicitImplementation(m)
-      )
-  }
-
-  string stubPrivateConstructor() {
-    if
-      this instanceof Interface
-      or
-      this.isStatic()
-      or
-      this.isAbstract()
-      or
-      exists(this.(ValueOrRefType).getAConstructor())
-      or
-      not exists(this.getAnInterestingBaseType())
-      or
-      not exists(this.getAnInterestingBaseType().getAConstructor())
-      or
-      exists(Constructor bc |
-        bc = this.getAnInterestingBaseType().getAConstructor() and
-        bc.getNumberOfParameters() = 0 and
-        not bc.isStatic()
-      )
-    then result = ""
-    else
-      result =
-        "    private " + this.getUndecoratedName() + "() : base(" +
-          stubDefaultArguments(getBaseConstructor(this), this) + ")" + " => throw null;\n"
-  }
-
-  private GeneratedMember getAGeneratedMember() { result.getDeclaringType() = this }
-
-  pragma[noinline]
-  private GeneratedMember getAGeneratedMember(Assembly assembly) {
-    result = this.getAGeneratedMember() and assembly = result.getALocation()
-  }
-
-  final Type getAGeneratedType() {
-    result = this.getAnInterestingBaseType()
-    or
-    result = this.getAGeneratedMember().(Callable).getReturnType()
-    or
-    result = this.getAGeneratedMember().(Callable).getAParameter().getType()
-    or
-    result = this.getAGeneratedMember().(Property).getType()
-    or
-    result = this.getAGeneratedMember().(Field).getType()
-  }
-}
-
-/**
- * A declaration that should be generated.
- * This is extended in client code to identify the actual
- * declarations that should be generated.
- */
-abstract class GeneratedDeclaration extends Modifiable {
-  GeneratedDeclaration() { this.isEffectivelyPublic() }
-}
-
-private class IndirectType extends GeneratedType {
-  IndirectType() {
-    this.(ValueOrRefType).getASubType() instanceof GeneratedType
-    or
-    this.(ValueOrRefType).getAChildType() instanceof GeneratedType
-    or
-    this.(UnboundGenericType).getAConstructedGeneric().getASubType() instanceof GeneratedType
-    or
-    exists(GeneratedType t |
-      this = getAContainedType(t.getAGeneratedType()).getUnboundDeclaration()
-    )
-    or
-    exists(GeneratedDeclaration decl |
-      decl.(Member).getDeclaringType().getUnboundDeclaration() = this
-    )
-  }
-}
-
-private class RootGeneratedType extends GeneratedType {
-  RootGeneratedType() { this = any(GeneratedDeclaration decl).getUnboundDeclaration() }
-}
-
-private Type getAContainedType(Type t) {
-  result = t
-  or
-  result = getAContainedType(t.(ConstructedType).getATypeArgument())
-}
-
-private class RootGeneratedMember extends GeneratedMember {
-  RootGeneratedMember() { this = any(GeneratedDeclaration d).getUnboundDeclaration() }
-}
-
-private predicate declarationExists(Virtualizable m) {
-  m instanceof GeneratedMember
-  or
-  m.getLocation() instanceof ExcludedAssembly
-}
-
-private class InheritedMember extends GeneratedMember, Virtualizable {
-  InheritedMember() {
-    declarationExists(this.getImplementee+())
-    or
-    declarationExists(this.getAnImplementor+())
-    or
-    declarationExists(this.getOverridee+())
-    or
-    declarationExists(this.getAnOverrider+())
-  }
-}
-
-private class ExtraGeneratedConstructor extends GeneratedMember, Constructor {
-  ExtraGeneratedConstructor() {
-    not this.isStatic() and
-    not this.isEffectivelyPublic() and
-    this.getDeclaringType() instanceof GeneratedType and
-    (
-      // if the base class has no 0 parameter constructor
-      not exists(Constructor c |
-        c = this.getDeclaringType().getBaseClass().getAMember() and
-        c.getNumberOfParameters() = 0 and
-        not c.isStatic()
-      )
-      or
-      // if this constructor might be called from a (generic) derived class
-      exists(Class c |
-        this.getDeclaringType() = c.getBaseClass().getUnboundDeclaration() and
-        this = getBaseConstructor(c).getUnboundDeclaration()
-      )
-    )
-  }
-}
-
-/** A namespace that contains at least one generated type. */
-private class GeneratedNamespace extends Namespace, GeneratedElement {
-  GeneratedNamespace() {
-    this.getATypeDeclaration() instanceof GeneratedType
-    or
-    this.getAChildNamespace() instanceof GeneratedNamespace
-  }
-
-  private string getPreamble() {
-    if this.isGlobalNamespace()
-    then result = ""
-    else result = "namespace " + this.getName() + "\n{\n"
-  }
-
-  private string getPostAmble() { if this.isGlobalNamespace() then result = "" else result = "}\n" }
-
-  final string getStubs(Assembly assembly) {
-    result =
-      this.getPreamble() + this.getTypeStubs(assembly) + this.getSubNamespaceStubs(assembly) +
-        this.getPostAmble()
-  }
-
-  /** Gets the `n`th generated child namespace, indexed from 0. */
-  pragma[nomagic]
-  final GeneratedNamespace getChildNamespace(int n) {
-    result.getParentNamespace() = this and
-    result.getName() =
-      rank[n + 1](GeneratedNamespace g | g.getParentNamespace() = this | g.getName())
-  }
-
-  final int getChildNamespaceCount() {
-    result = count(GeneratedNamespace g | g.getParentNamespace() = this)
-  }
-
-  private predicate isInAssembly(Assembly assembly) {
-    any(GeneratedType gt | gt.(DotNet::ValueOrRefType).getDeclaringNamespace() = this)
-        .isInAssembly(assembly)
-    or
-    this.getChildNamespace(_).isInAssembly(assembly)
-  }
-
-  language[monotonicAggregates]
-  string getSubNamespaceStubs(Assembly assembly) {
-    this.isInAssembly(assembly) and
-    result =
-      concat(GeneratedNamespace child, int i |
-        child = this.getChildNamespace(i) and child.isInAssembly(assembly)
-      |
-        child.getStubs(assembly) order by i
-      )
-  }
-
-  string getTypeStubs(Assembly assembly) {
-    this.isInAssembly(assembly) and
-    result =
-      concat(GeneratedType gt |
-        gt.(DotNet::ValueOrRefType).getDeclaringNamespace() = this and gt.isInAssembly(assembly)
-      |
-        gt.getStub(assembly) order by gt.getName()
-      )
-  }
-}
-
-/**
- * Specify assemblies to exclude.
- * Do not generate any types from these assemblies.
- */
-abstract class ExcludedAssembly extends Assembly { }
-
-private Virtualizable getAccessibilityDeclaringVirtualizable(Virtualizable v) {
-  if not v.isOverride()
-  then result = v
-  else
-    if not v.getOverridee().getLocation() instanceof ExcludedAssembly
-    then result = getAccessibilityDeclaringVirtualizable(v.getOverridee())
-    else result = v
-}
-
-private string stubAccessibility(Member m) {
-  if
-    m.getDeclaringType() instanceof Interface
-    or
-    exists(getExplicitImplementedInterface(m))
-    or
-    m instanceof Constructor and m.isStatic()
-  then result = ""
-  else
-    if m.isPublic()
-    then result = "public "
-    else
-      if m.isProtected()
-      then
-        if m.isPrivate() or getAccessibilityDeclaringVirtualizable(m).isPrivate()
-        then result = "protected private "
-        else
-          if m.isInternal() or getAccessibilityDeclaringVirtualizable(m).isInternal()
-          then result = "protected internal "
-          else result = "protected "
-      else
-        if m.isPrivate()
-        then result = "private "
-        else
-          if m.isInternal()
-          then result = "internal "
-          else result = "unknown-accessibility"
-}
-
-private string stubModifiers(Member m) {
-  result = stubUnsafe(m) + stubAccessibility(m) + stubStaticOrConst(m) + stubOverride(m)
-}
-
-private string stubUnsafe(Member m) {
-  if m.(Modifiable).isUnsafe() then result = "unsafe " else result = ""
-}
-
-private string stubStaticOrConst(Member m) {
-  if m.(Modifiable).isStatic()
-  then result = "static "
-  else
-    if m.(Modifiable).isConst()
-    then result = "const "
-    else result = ""
-}
-
-private string stubOverride(Member m) {
-  if m.getDeclaringType() instanceof Interface and not m.isStatic()
-  then result = ""
-  else
-    if m.(Virtualizable).isVirtual()
-    then result = "virtual "
-    else
-      if m.(Virtualizable).isAbstract()
-      then
-        if m.(Virtualizable).isOverride()
-        then result = "abstract override "
-        else result = "abstract "
-      else
-        if m.(Virtualizable).isOverride()
-        then result = "override "
-        else result = ""
-}
-
-private string stubQualifiedNamePrefix(ValueOrRefType t) {
-  if t.getParent() instanceof GlobalNamespace
-  then result = ""
-  else
-    if t.getParent() instanceof Namespace
-    then result = t.getDeclaringNamespace().getFullName() + "."
-    else result = stubClassName(t.getDeclaringType()) + "."
-}
-
-language[monotonicAggregates]
-private string stubClassName(Type t) {
-  if t instanceof ObjectType
-  then result = "object"
-  else
-    if t instanceof StringType
-    then result = "string"
-    else
-      if t instanceof IntType
-      then result = "int"
-      else
-        if t instanceof BoolType
-        then result = "bool"
-        else
-          if t instanceof VoidType
-          then result = "void"
-          else
-            if t instanceof FloatType
-            then result = "float"
-            else
-              if t instanceof DoubleType
-              then result = "double"
-              else
-                if t instanceof NullableType
-                then result = stubClassName(t.(NullableType).getUnderlyingType()) + "?"
-                else
-                  if t instanceof TypeParameter
-                  then result = t.getName()
-                  else
-                    if t instanceof ArrayType
-                    then result = stubClassName(t.(ArrayType).getElementType()) + "[]"
-                    else
-                      if t instanceof PointerType
-                      then result = stubClassName(t.(PointerType).getReferentType()) + "*"
-                      else
-                        if t instanceof TupleType
-                        then
-                          exists(TupleType tt | tt = t |
-                            if tt.getArity() < 2
-                            then result = stubClassName(tt.getUnderlyingType())
-                            else
-                              result =
-                                "(" +
-                                  concat(int i, Type element |
-                                    element = tt.getElementType(i)
-                                  |
-                                    stubClassName(element), "," order by i
-                                  ) + ")"
-                          )
-                        else
-                          if t instanceof FunctionPointerType
-                          then
-                            exists(
-                              FunctionPointerType fpt, CallingConvention callconvention,
-                              string calltext
-                            |
-                              fpt = t
-                            |
-                              callconvention = fpt.getCallingConvention() and
-                              (
-                                if callconvention instanceof UnmanagedCallingConvention
-                                then calltext = "unmanaged"
-                                else calltext = ""
-                              ) and
-                              result =
-                                "delegate* " + calltext + "<" +
-                                  concat(int i, Parameter p |
-                                    p = fpt.getParameter(i)
-                                  |
-                                    stubClassName(p.getType()) + "," order by i
-                                  ) + stubClassName(fpt.getReturnType()) + ">"
-                            )
-                          else
-                            if t instanceof ValueOrRefType
-                            then
-                              result =
-                                stubQualifiedNamePrefix(t) + t.getUndecoratedName() +
-                                  stubGenericArguments(t)
-                            else result = "<error>"
-}
-
-language[monotonicAggregates]
-private string stubGenericArguments(Type t) {
-  if t instanceof UnboundGenericType
-  then
-    result =
-      "<" +
-        concat(int n |
-          exists(t.(UnboundGenericType).getTypeParameter(n))
-        |
-          t.(UnboundGenericType).getTypeParameter(n).getName(), "," order by n
-        ) + ">"
-  else
-    if t instanceof ConstructedType
-    then
-      result =
-        "<" +
-          concat(int n |
-            exists(t.(ConstructedType).getTypeArgument(n))
-          |
-            stubClassName(t.(ConstructedType).getTypeArgument(n)), "," order by n
-          ) + ">"
-    else result = ""
-}
-
-private string stubGenericMethodParams(Method m) {
-  if m instanceof UnboundGenericMethod
-  then
-    result =
-      "<" +
-        concat(int n, TypeParameter param |
-          param = m.(UnboundGenericMethod).getTypeParameter(n)
-        |
-          param.getName(), "," order by n
-        ) + ">"
-  else result = ""
-}
-
-private string stubConstraints(TypeParameterConstraints tpc, int i) {
-  tpc.hasConstructorConstraint() and result = "new()" and i = 4
-  or
-  tpc.hasUnmanagedTypeConstraint() and result = "unmanaged" and i = 0
-  or
-  tpc.hasValueTypeConstraint() and
-  result = "struct" and
-  i = 0 and
-  not tpc.hasUnmanagedTypeConstraint() and
-  not stubClassName(tpc.getATypeConstraint().(Class)) = "System.Enum"
-  or
-  tpc.hasRefTypeConstraint() and result = "class" and i = 0
-  or
-  result = tpc.getATypeConstraint().(TypeParameter).getName() and i = 3
-  or
-  result = stubClassName(tpc.getATypeConstraint().(Interface)) and i = 2
-  or
-  result = stubClassName(tpc.getATypeConstraint().(Class)) and i = 1
-}
-
-private string stubTypeParameterConstraints(TypeParameter tp) {
-  if
-    tp.getDeclaringGeneric().(Virtualizable).isOverride() or
-    tp.getDeclaringGeneric().(Virtualizable).implementsExplicitInterface()
-  then
-    if tp.getConstraints().hasValueTypeConstraint()
-    then result = " where " + tp.getName() + ": struct"
-    else
-      if tp.getConstraints().hasRefTypeConstraint()
-      then result = " where " + tp.getName() + ": class"
-      else result = ""
-  else
-    exists(TypeParameterConstraints tpc | tpc = tp.getConstraints() |
-      result =
-        " where " + tp.getName() + ": " +
-          strictconcat(string s, int i | s = stubConstraints(tpc, i) | s, ", " order by i)
-    )
-}
-
-private string stubTypeParametersConstraints(Declaration d) {
-  if d instanceof UnboundGeneric
-  then
-    result =
-      concat(TypeParameter tp |
-        tp = d.(UnboundGeneric).getATypeParameter()
-      |
-        stubTypeParameterConstraints(tp), " "
-      )
-  else result = ""
-}
-
-private string stubImplementation(Virtualizable c) {
-  if c.isAbstract() then result = "" else result = " => throw null"
-}
-
-private predicate isKeyword(string s) {
-  s =
-    [
-      "abstract", "as", "base", "bool", "break", "byte", "case", "catch", "char", "checked",
-      "class", "const", "continue", "decimal", "default", "delegate", "do", "double", "else",
-      "enum", "event", "explicit", "extern", "false", "finally", "fixed", "float", "for", "foreach",
-      "goto", "if", "implicit", "in", "int", "interface", "internal", "is", "lock", "long",
-      "namespace", "new", "null", "object", "operator", "out", "override", "params", "private",
-      "protected", "public", "readonly", "ref", "return", "sbyte", "sealed", "short", "sizeof",
-      "stackalloc", "static", "string", "struct", "switch", "this", "throw", "true", "try",
-      "typeof", "uint", "ulong", "unchecked", "unsafe", "ushort", "using", "virtual", "void",
-      "volatile", "while"
-    ]
-}
-
-bindingset[s]
-private string escapeIfKeyword(string s) { if isKeyword(s) then result = "@" + s else result = s }
-
-private string stubParameters(Parameterizable p) {
-  result =
-    concat(int i, Parameter param |
-      param = p.getParameter(i) and not param.getType() instanceof ArglistType
-    |
-      stubParameterModifiers(param) + stubClassName(param.getType()) + " " +
-          escapeIfKeyword(param.getName()) + stubDefaultValue(param), ", "
-      order by
-        i
-    )
-}
-
-private string stubDefaultArguments(Constructor baseCtor, ValueOrRefType callingType) {
-  baseCtor = getBaseConstructor(callingType) and
-  baseCtor.getNumberOfParameters() > 0 and
-  result =
-    concat(int i, Parameter param |
-      param = baseCtor.getParameter(i) and not param.getType() instanceof ArglistType
-    |
-      "default(" + stubClassName(param.getType()) + ")", ", " order by i
-    )
-}
-
-private string stubParameterModifiers(Parameter p) {
-  if p.isOut()
-  then result = "out "
-  else
-    if p.isRef()
-    then result = "ref "
-    else
-      if p.isParams()
-      then result = "params "
-      else
-        if p.isIn()
-        then result = "" // Only C# 7.1 so ignore
-        else
-          if p.hasExtensionMethodModifier()
-          then result = "this "
-          else result = ""
-}
-
-private string stubDefaultValue(Parameter p) {
-  if p.hasDefaultValue()
-  then result = " = default(" + stubClassName(p.getType()) + ")"
-  else result = ""
-}
-
-private string stubEventAccessors(Event e) {
-  if exists(e.(Virtualizable).getExplicitlyImplementedInterface())
-  then result = " { add => throw null; remove => throw null; }"
-  else result = ";"
-}
-
-/**
- * Returns an interface that `c` explicitly implements, if either of the
- * following also holds.
- * (1) `c` is not static.
- * (2) `c` is static and an implementation of a generic with type constraints.
- * (3) `c` is static and there is another member with the same name
- * but different return type.
- *
- * We use these rules as explicit interfaces are needed in some cases
- * for compilation purposes (both to distinguish members but also to ensure
- * type constraints are satisfied). We can't always use explicit interface
- * implementation due to the generic math support, because then in some cases
- * we will only be able to access a static via a type variable with type
- * constraints (C# 11 language feature).
- */
-private Interface getExplicitImplementedInterface(Virtualizable c) {
-  result = unique(Interface i | i = c.getExplicitlyImplementedInterface()) and
-  (
-    not c.isStatic()
-    or
-    c.isStatic() and
-    (
-      not c instanceof Method
-      or
-      c instanceof Method and
-      (
-        exists(TypeParameter t | t = c.getImplementee().(UnboundGeneric).getATypeParameter() |
-          exists(t.getConstraints().getATypeConstraint())
-        )
-        or
-        exists(Member m |
-          (not m.isStatic() or m.(Method).getReturnType() != c.(Method).getReturnType()) and
-          m.getName() = c.getName() and
-          m.getDeclaringType() = c.getDeclaringType()
-        )
-      )
-    )
-  )
-}
-
-private string stubExplicitImplementation(Member c) {
-  if exists(getExplicitImplementedInterface(c))
-  then result = stubClassName(getExplicitImplementedInterface(c)) + "."
-  else result = ""
-}
-
-pragma[noinline]
-private string stubMethod(Method m, Assembly assembly) {
-  m instanceof GeneratedMember and
-  m.getALocation() = assembly and
-  if not m.getDeclaringType() instanceof Enum
-  then
-    result =
-      "    " + stubModifiers(m) + stubClassName(m.getReturnType()) + " " +
-        stubExplicitImplementation(m) + escapeIfKeyword(m.getUndecoratedName()) +
-        stubGenericMethodParams(m) + "(" + stubParameters(m) + ")" +
-        stubTypeParametersConstraints(m) + stubImplementation(m) + ";\n"
-  else result = "    // Stub generator skipped method: " + m.getName() + "\n"
-}
-
-pragma[noinline]
-private string stubOperator(Operator o, Assembly assembly) {
-  o instanceof GeneratedMember and
-  o.getALocation() = assembly and
-  if o instanceof ConversionOperator
-  then
-    result =
-      "    " + stubModifiers(o) + stubExplicit(o) + stubExplicitImplementation(o) + "operator " +
-        stubChecked(o) + stubClassName(o.getReturnType()) + "(" + stubParameters(o) + ")" +
-        stubImplementation(o) + ";\n"
-  else
-    if not o.getDeclaringType() instanceof Enum
-    then
-      result =
-        "    " + stubModifiers(o) + stubClassName(o.getReturnType()) + " " +
-          stubExplicitImplementation(o) + "operator " + o.getName() + "(" + stubParameters(o) + ")" +
-          stubImplementation(o) + ";\n"
-    else result = "    // Stub generator skipped operator: " + o.getName() + "\n"
-}
-
-pragma[noinline]
-private string stubEnumConstant(EnumConstant ec, Assembly assembly) {
-  ec instanceof GeneratedMember and
-  ec.getALocation() = assembly and
-  result = "    " + escapeIfKeyword(ec.getName()) + " = " + ec.getValue() + ",\n"
-}
-
-pragma[noinline]
-private string stubProperty(Property p, Assembly assembly) {
-  p instanceof GeneratedMember and
-  p.getALocation() = assembly and
-  result =
-    "    " + stubModifiers(p) + stubClassName(p.getType()) + " " + stubExplicitImplementation(p) +
-      escapeIfKeyword(p.getName()) + " { " + stubGetter(p) + stubSetter(p) + "}\n"
-}
-
-pragma[noinline]
-private string stubConstructor(Constructor c, Assembly assembly) {
-  c instanceof GeneratedMember and
-  c.getALocation() = assembly and
-  if c.getDeclaringType() instanceof Enum
-  then result = ""
-  else
-    if
-      not c.getDeclaringType() instanceof StructExt or
-      c.getNumberOfParameters() > 0
-    then
-      result =
-        "    " + stubModifiers(c) + escapeIfKeyword(c.getName()) + "(" + stubParameters(c) + ")" +
-          stubConstructorInitializer(c) + " => throw null;\n"
-    else result = "    // Stub generator skipped constructor \n"
-}
-
-pragma[noinline]
-private string stubIndexer(Indexer i, Assembly assembly) {
-  i instanceof GeneratedMember and
-  i.getALocation() = assembly and
-  result =
-    "    " + stubIndexerNameAttribute(i) + stubModifiers(i) + stubClassName(i.getType()) + " " +
-      stubExplicitImplementation(i) + "this[" + stubParameters(i) + "] { " + stubGetter(i) +
-      stubSetter(i) + "}\n"
-}
-
-pragma[noinline]
-private string stubField(Field f, Assembly assembly) {
-  f instanceof GeneratedMember and
-  f.getALocation() = assembly and
-  not f instanceof EnumConstant and // EnumConstants are already stubbed
-  exists(string impl |
-    (if f.isConst() then impl = " = default" else impl = "") and
-    result =
-      "    " + stubModifiers(f) + stubClassName(f.getType()) + " " + escapeIfKeyword(f.getName()) +
-        impl + ";\n"
-  )
-}
-
-pragma[noinline]
-private string stubEvent(Event e, Assembly assembly) {
-  e instanceof GeneratedMember and
-  e.getALocation() = assembly and
-  result =
-    "    " + stubModifiers(e) + "event " + stubClassName(e.getType()) + " " +
-      stubExplicitImplementation(e) + escapeIfKeyword(e.getName()) + stubEventAccessors(e) + "\n"
-}
-
-pragma[nomagic]
-private string stubMember(GeneratedMember m, Assembly assembly) {
-  result = stubMethod(m, assembly)
-  or
-  result = stubOperator(m, assembly)
-  or
-  result = stubEnumConstant(m, assembly)
-  or
-  result = stubProperty(m, assembly)
-  or
-  result = stubConstructor(m, assembly)
-  or
-  result = stubIndexer(m, assembly)
-  or
-  result = stubField(m, assembly)
-  or
-  result = stubEvent(m, assembly)
-  or
-  not m instanceof Method and
-  not m instanceof Operator and
-  not m instanceof EnumConstant and
-  not m instanceof Property and
-  not m instanceof Constructor and
-  not m instanceof Indexer and
-  not m instanceof Field and
-  not m instanceof Event and
-  m.getALocation() = assembly and
-  (
-    result = m.(GeneratedType).getStub(assembly) + "\n"
-    or
-    not m instanceof GeneratedType and
-    result = "    // ERR: Stub generator didn't handle member: " + m.getName() + "\n"
-  )
-}
-
-private string stubIndexerNameAttribute(Indexer i) {
-  if i.getName() != "Item"
-  then result = "[System.Runtime.CompilerServices.IndexerName(\"" + i.getName() + "\")]\n    "
-  else result = ""
-}
-
-private Constructor getBaseConstructor(ValueOrRefType type) {
-  result =
-    min(Constructor bc |
-      type.getBaseClass().getAMember() = bc and
-      // not the `static` constructor
-      not bc.isStatic() and
-      // not a `private` constructor, unless it's `private protected`, or if the derived class is nested
-      (not bc.isPrivate() or bc.isProtected() or bc.getDeclaringType() = type.getDeclaringType+())
-    |
-      bc order by bc.getNumberOfParameters(), stubParameters(bc)
-    )
-}
-
-private string stubConstructorInitializer(Constructor c) {
-  exists(Constructor baseCtor |
-    baseCtor = getBaseConstructor(c.getDeclaringType()) and
-    if baseCtor.getNumberOfParameters() = 0 or c.isStatic()
-    then result = ""
-    else result = " : base(" + stubDefaultArguments(baseCtor, c.getDeclaringType()) + ")"
-  )
-  or
-  // abstract base class might not have a constructor
-  not exists(Constructor baseCtor |
-    c.getDeclaringType().getBaseClass().getAMember() = baseCtor and not baseCtor.isStatic()
-  ) and
-  result = ""
-}
-
-private string stubExplicit(ConversionOperator op) {
-  op instanceof ImplicitConversionOperator and result = "implicit "
-  or
-  (
-    op instanceof ExplicitConversionOperator
-    or
-    op instanceof CheckedExplicitConversionOperator
-  ) and
-  result = "explicit "
-}
-
-private string stubChecked(Operator o) {
-  if o instanceof CheckedExplicitConversionOperator then result = "checked " else result = ""
-}
-
-private string stubGetter(DeclarationWithGetSetAccessors p) {
-  if exists(p.getGetter())
-  then if p.isAbstract() then result = "get; " else result = "get => throw null; "
-  else result = ""
-}
-
-private string stubSetter(DeclarationWithGetSetAccessors p) {
-  if exists(p.getSetter())
-  then if p.isAbstract() then result = "set; " else result = "set => throw null; "
-  else result = ""
-}
-
-private string stubSemmleExtractorOptions() {
-  result =
-    concat(string s |
-      exists(CommentLine comment |
-        s =
-          "// original-extractor-options:" +
-            comment.getText().regexpCapture("\\w*semmle-extractor-options:(.*)", 1) + "\n"
-      )
-    )
-}
-
-/** Gets the generated C# code. */
-string generatedCode(Assembly assembly) {
-  result =
-    "// This file contains auto-generated code.\n" //
-      + "// Generated from `" + assembly.getFullName() + "`.\n" //
-      + stubSemmleExtractorOptions() + "\n" //
-      + any(GeneratedNamespace ns | ns.isGlobalNamespace()).getStubs(assembly)
-}

csharp/ql/src/Stubs/make_stubs.py

@@ -1,96 +0,0 @@
-# Tool to generate 'stub.cs' files inside C# qltest projects.
-# The purpose of this is to stub out assemblies from the qltest case
-# so that the test is self-contained and will still run without them.
-#
-# To do this, it
-# 1. Performs a regular qltest to generate a snapshot
-# 2. Runs a QL query on the snapshot to find out which symbols are needed,
-#    then uses QL to generate a string of C# code.
-# 3. Re-runs the test to ensure that it still compiles and passes.
-
-import sys
-import os
-import subprocess
-import helpers
-
-print('Script to generate stub.cs files for C# qltest projects')
-
-if len(sys.argv) < 2:
-    print("Please supply a qltest directory.")
-    exit(1)
-
-testDir = sys.argv[1]
-
-if not os.path.isdir(testDir):
-    print("Directory", testDir, "does not exist")
-    exit(1)
-
-# Does it contain a .ql file and a .cs file?
-
-foundCS = False
-foundQL = False
-
-for file in os.listdir(testDir):
-    if file.endswith(".cs"):
-        foundCS = True
-    if file.endswith(".ql") or file.endswith(".qlref"):
-        foundQL = True
-
-if not foundQL:
-    print("Test directory does not contain .ql files. Please specify a working qltest directory.")
-    exit(1)
-
-if not foundCS:
-    print("Test directory does not contain .cs files. Please specify a working qltest directory.")
-    exit(1)
-
-csharpQueries = os.path.abspath(os.path.dirname(sys.argv[0]))
-outputFile = os.path.join(testDir, 'stubs.cs')
-bqrsFile = os.path.join(testDir, 'stubs.bqrs')
-
-print("Stubbing qltest in", testDir)
-
-if os.path.isfile(outputFile):
-    os.remove(outputFile)  # It would interfere with the test.
-    print("Removed previous", outputFile)
-
-helpers.run_cmd(['codeql', 'test', 'run', '--keep-databases', testDir],
-                "codeql test failed. Please fix up the test before proceeding.")
-
-dbDir = os.path.join(testDir, os.path.basename(testDir) + ".testproj")
-
-if not os.path.isdir(dbDir):
-    print("Expected database directory " + dbDir + " not found.")
-    exit(1)
-
-helpers.run_cmd(['codeql', 'query', 'run', os.path.join(
-    csharpQueries, 'MinimalStubsFromSource.ql'), '--database', dbDir, '--output', bqrsFile], 'Failed to run the query to generate output file.')
-
-helpers.run_cmd(['codeql', 'bqrs', 'decode', bqrsFile, '--output',
-                 outputFile, '--format=text', '--no-titles'], 'Failed to run the query to generate output file.')
-
-helpers.trim_output_file(outputFile)
-
-if os.path.isfile(bqrsFile):
-    os.remove(bqrsFile)  # Cleanup
-    print("Removed temp BQRS file", bqrsFile)
-
-cmd = ['codeql', 'test', 'run', testDir]
-print('Running ' + ' '.join(cmd))
-if subprocess.check_call(cmd):
-    print('\nTest failed. You may need to fix up', outputFile)
-    print('It may help to view', outputFile, ' in Visual Studio')
-    print("Next steps:")
-    print('1. Look at the compilation errors, and fix up',
-          outputFile, 'so that the test compiles')
-    print('2. Re-run codeql test run "' + testDir + '"')
-    print('3. git add "' + outputFile + '"')
-    exit(1)
-
-print("\nStub generation successful! Next steps:")
-print('1. Edit "semmle-extractor-options" in the .cs files to remove unused references')
-print('2. Re-run codeql test run "' + testDir + '"')
-print('3. git add "' + outputFile + '"')
-print('4. Commit your changes.')
-
-exit(0)

csharp/ql/test/library-tests/attributes/AttributeArguments.expected

@@ -90,6 +90,22 @@ arguments
 | attributes.cs:125:18:125:29 | [return: My3(...)] | 0 | attributes.cs:125:31:125:32 | 12 |
 | attributes.cs:128:10:128:21 | [My3(...)] | 0 | attributes.cs:128:23:128:24 | 13 |
 | attributes.cs:129:17:129:28 | [My3(...)] | 0 | attributes.cs:129:30:129:31 | 14 |
+| attributes.cs:141:6:141:11 | [Params(...)] | 0 | attributes.cs:141:13:141:15 | "a" |
+| attributes.cs:141:6:141:11 | [Params(...)] | 1 | attributes.cs:141:18:141:20 | "b" |
+| attributes.cs:141:6:141:11 | [Params(...)] | 2 | attributes.cs:141:23:141:23 | 1 |
+| attributes.cs:141:6:141:11 | [Params(...)] | 3 | attributes.cs:141:26:141:26 | 2 |
+| attributes.cs:141:6:141:11 | [Params(...)] | 4 | attributes.cs:141:29:141:29 | 3 |
+| attributes.cs:144:6:144:11 | [Params(...)] | 0 | attributes.cs:144:17:144:19 | "a" |
+| attributes.cs:144:6:144:11 | [Params(...)] | 1 | attributes.cs:144:26:144:28 | "b" |
+| attributes.cs:144:6:144:11 | [Params(...)] | 2 | attributes.cs:144:31:144:31 | 1 |
+| attributes.cs:144:6:144:11 | [Params(...)] | 3 | attributes.cs:144:34:144:34 | 2 |
+| attributes.cs:144:6:144:11 | [Params(...)] | 4 | attributes.cs:144:37:144:37 | 3 |
+| attributes.cs:147:6:147:11 | [Params(...)] | 0 | attributes.cs:147:35:147:37 | "a" |
+| attributes.cs:147:6:147:11 | [Params(...)] | 1 | attributes.cs:147:26:147:28 | "b" |
+| attributes.cs:147:6:147:11 | [Params(...)] | 2 | attributes.cs:147:19:147:19 | 1 |
+| attributes.cs:150:6:150:11 | [Params(...)] | 0 | attributes.cs:150:45:150:47 | "a" |
+| attributes.cs:150:6:150:11 | [Params(...)] | 1 | attributes.cs:150:36:150:38 | "b" |
+| attributes.cs:150:6:150:11 | [Params(...)] | 2 | attributes.cs:150:19:150:29 | array creation of type Int32[] |
 constructorArguments
 | Assembly1.dll:0:0:0:0 | [Custom(...)] | 0 | Assembly1.dll:0:0:0:0 | 1 |
 | Assembly1.dll:0:0:0:0 | [Custom(...)] | 0 | Assembly1.dll:0:0:0:0 | 3 |
@@ -170,6 +186,22 @@ constructorArguments
 | attributes.cs:125:18:125:29 | [return: My3(...)] | 0 | attributes.cs:125:31:125:32 | 12 |
 | attributes.cs:128:10:128:21 | [My3(...)] | 0 | attributes.cs:128:23:128:24 | 13 |
 | attributes.cs:129:17:129:28 | [My3(...)] | 0 | attributes.cs:129:30:129:31 | 14 |
+| attributes.cs:141:6:141:11 | [Params(...)] | 0 | attributes.cs:141:13:141:15 | "a" |
+| attributes.cs:141:6:141:11 | [Params(...)] | 1 | attributes.cs:141:18:141:20 | "b" |
+| attributes.cs:141:6:141:11 | [Params(...)] | 2 | attributes.cs:141:23:141:23 | 1 |
+| attributes.cs:141:6:141:11 | [Params(...)] | 3 | attributes.cs:141:26:141:26 | 2 |
+| attributes.cs:141:6:141:11 | [Params(...)] | 4 | attributes.cs:141:29:141:29 | 3 |
+| attributes.cs:144:6:144:11 | [Params(...)] | 0 | attributes.cs:144:17:144:19 | "a" |
+| attributes.cs:144:6:144:11 | [Params(...)] | 1 | attributes.cs:144:26:144:28 | "b" |
+| attributes.cs:144:6:144:11 | [Params(...)] | 2 | attributes.cs:144:31:144:31 | 1 |
+| attributes.cs:144:6:144:11 | [Params(...)] | 3 | attributes.cs:144:34:144:34 | 2 |
+| attributes.cs:144:6:144:11 | [Params(...)] | 4 | attributes.cs:144:37:144:37 | 3 |
+| attributes.cs:147:6:147:11 | [Params(...)] | 0 | attributes.cs:147:35:147:37 | "a" |
+| attributes.cs:147:6:147:11 | [Params(...)] | 1 | attributes.cs:147:26:147:28 | "b" |
+| attributes.cs:147:6:147:11 | [Params(...)] | 2 | attributes.cs:147:19:147:19 | 1 |
+| attributes.cs:150:6:150:11 | [Params(...)] | 0 | attributes.cs:150:45:150:47 | "a" |
+| attributes.cs:150:6:150:11 | [Params(...)] | 1 | attributes.cs:150:36:150:38 | "b" |
+| attributes.cs:150:6:150:11 | [Params(...)] | 2 | attributes.cs:150:19:150:29 | array creation of type Int32[] |
 namedArguments
 | Assembly1.dll:0:0:0:0 | [Custom(...)] | Prop2 | Assembly1.dll:0:0:0:0 | array creation of type Object[] |
 | Assembly1.dll:0:0:0:0 | [Custom(...)] | Prop2 | Assembly1.dll:0:0:0:0 | array creation of type Object[] |

csharp/ql/test/library-tests/attributes/AttributeElements.expected

@@ -32,6 +32,10 @@
 | attributes.cs:126:9:126:11 | get_Prop1 | attributes.cs:125:18:125:29 | [return: My3(...)] | My3Attribute |
 | attributes.cs:130:9:130:11 | set_Prop1 | attributes.cs:128:10:128:21 | [My3(...)] | My3Attribute |
 | attributes.cs:130:9:130:11 | value | attributes.cs:129:17:129:28 | [My3(...)] | My3Attribute |
+| attributes.cs:142:17:142:18 | M1 | attributes.cs:141:6:141:11 | [Params(...)] | Class1+ParamsAttribute |
+| attributes.cs:145:17:145:18 | M2 | attributes.cs:144:6:144:11 | [Params(...)] | Class1+ParamsAttribute |
+| attributes.cs:148:17:148:18 | M3 | attributes.cs:147:6:147:11 | [Params(...)] | Class1+ParamsAttribute |
+| attributes.cs:151:17:151:18 | M4 | attributes.cs:150:6:150:11 | [Params(...)] | Class1+ParamsAttribute |
 | attributes.dll:0:0:0:0 | attributes, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null | attributes.cs:10:12:10:24 | [assembly: AssemblyTitle(...)] | System.Reflection.AssemblyTitleAttribute |
 | attributes.dll:0:0:0:0 | attributes, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null | attributes.cs:11:12:11:30 | [assembly: AssemblyDescription(...)] | System.Reflection.AssemblyDescriptionAttribute |
 | attributes.dll:0:0:0:0 | attributes, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null | attributes.cs:12:12:12:32 | [assembly: AssemblyConfiguration(...)] | System.Reflection.AssemblyConfigurationAttribute |

csharp/ql/test/library-tests/attributes/PrintAst.expected

@@ -405,3 +405,59 @@ attributes.cs:
 #  130|           0: [AssignExpr] ... = ...
 #  130|             0: [FieldAccess] access to field p
 #  130|             1: [ParameterAccess] access to parameter value
+#  134| [Class] Class1
+#  136|   5: [Class] ParamsAttribute
+#-----|     3: (Base types)
+#  136|       0: [TypeMention] Attribute
+#  138|     4: [InstanceConstructor] ParamsAttribute
+#-----|       2: (Parameters)
+#  138|         0: [Parameter] s1
+#  138|           -1: [TypeMention] string
+#  138|         1: [Parameter] s2
+#  138|           -1: [TypeMention] string
+#  138|         2: [Parameter] args
+#  138|           -1: [TypeMention] Int32[]
+#  138|             1: [TypeMention] int
+#  138|       4: [BlockStmt] {...}
+#  142|   6: [Method] M1
+#  142|     -1: [TypeMention] Void
+#-----|     0: (Attributes)
+#  141|       1: [DefaultAttribute] [Params(...)]
+#  141|         -1: [TypeMention] ParamsAttribute
+#  141|         0: [StringLiteralUtf16] "a"
+#  141|         1: [StringLiteralUtf16] "b"
+#  141|         2: [IntLiteral] 1
+#  141|         3: [IntLiteral] 2
+#  141|         4: [IntLiteral] 3
+#  142|     4: [BlockStmt] {...}
+#  145|   7: [Method] M2
+#  145|     -1: [TypeMention] Void
+#-----|     0: (Attributes)
+#  144|       1: [DefaultAttribute] [Params(...)]
+#  144|         -1: [TypeMention] ParamsAttribute
+#  144|         0: [StringLiteralUtf16] "a"
+#  144|         1: [StringLiteralUtf16] "b"
+#  144|         2: [IntLiteral] 1
+#  144|         3: [IntLiteral] 2
+#  144|         4: [IntLiteral] 3
+#  145|     4: [BlockStmt] {...}
+#  148|   8: [Method] M3
+#  148|     -1: [TypeMention] Void
+#-----|     0: (Attributes)
+#  147|       1: [DefaultAttribute] [Params(...)]
+#  147|         -1: [TypeMention] ParamsAttribute
+#  147|         0: [StringLiteralUtf16] "a"
+#  147|         1: [StringLiteralUtf16] "b"
+#  147|         2: [IntLiteral] 1
+#  148|     4: [BlockStmt] {...}
+#  151|   9: [Method] M4
+#  151|     -1: [TypeMention] Void
+#-----|     0: (Attributes)
+#  150|       1: [DefaultAttribute] [Params(...)]
+#  150|         -1: [TypeMention] ParamsAttribute
+#  150|         0: [StringLiteralUtf16] "a"
+#  150|         1: [StringLiteralUtf16] "b"
+#  150|         2: [ArrayCreation] array creation of type Int32[]
+#  150|           -1: [ArrayInitializer] { ..., ... }
+#  150|             0: [IntLiteral] 1
+#  151|     4: [BlockStmt] {...}

csharp/ql/test/library-tests/attributes/attributes.cs

@@ -129,4 +129,24 @@ public class MyAttributeUsage
         [param: My3Attribute(14)]
         set { p = value; }
     }
+}
+
+class Class1
+{
+    public class ParamsAttribute : Attribute
+    {
+        public ParamsAttribute(string s1, string s2, params int[] args) { }
+    }
+
+    [Params("a", "b", 1, 2, 3)]
+    public void M1() { }
+
+    [Params(s1: "a", s2: "b", 1, 2, 3)]
+    public void M2() { }
+
+    [Params(args: 1, s2: "b", s1: "a")]
+    public void M3() { }
+
+    [Params(args: new[] { 1 }, s2: "b", s1: "a")]
+    public void M4() { }
 }

csharp/ql/test/query-tests/Stubs/All/AllStubs.qlref

@@ -1 +0,0 @@
-Stubs/AllStubsFromSource.ql

csharp/ql/test/query-tests/Stubs/All/Test.cs

@@ -1,249 +0,0 @@
-using System;
-
-namespace Test
-{
-    public class Class1
-    {
-        public struct Struct1
-        {
-            public ValueTuple<int> t1;
-            public (int, int) t2;
-
-            public int i;
-            public const int j = 42;
-
-            public void Method(Struct1 s = new Struct1()) => throw null;
-        }
-
-        public interface Interface1
-        {
-            void Method1();
-        }
-
-        internal protected interface Interface2
-        {
-            void Method2();
-            int this[int i] { get; }
-        }
-
-        private protected interface Interface3
-        {
-            void Method3();
-        }
-
-        public class Class11 : Interface1, Interface2, Interface3
-        {
-            public Class11(int i) => throw null;
-
-            public void Method1() => throw null;
-
-            void Interface2.Method2() => throw null;
-
-            int Interface2.this[int i] => throw null;
-
-            void Interface3.Method3() => throw null;
-        }
-
-        public delegate void Delegate1<T>(T i, int j);
-
-        public event Delegate1<int> Event1 { add { } remove { } }
-
-        public class Class12 : Class11
-        {
-            public Class12(int i, float j) : base(1) => throw null;
-        }
-
-        public class GenericType<T>
-        {
-            public class X { }
-        }
-
-        public GenericType<int>.X Prop { get; }
-
-        public abstract class Class13
-        {
-            protected internal virtual void M() => throw null;
-            public virtual void M1<T>() where T : Class13 => throw null;
-            public abstract void M2();
-        }
-
-        public abstract class Class14 : Class13
-        {
-            protected internal override void M() => throw null;
-            public override void M1<T>() => throw null;
-            public abstract override void M2();
-        }
-
-    }
-
-    internal class Class2
-    {
-        public void M() => throw null;
-    }
-
-    public class Class3
-    {
-        public object Item { get; set; }
-        [System.Runtime.CompilerServices.IndexerName("MyItem")]
-        public object this[string index] { get { return null; } set { } }
-    }
-
-    public class Class4
-    {
-        unsafe public void M(int* p) => throw null;
-    }
-
-    public interface IInterface1
-    {
-        void M1() => throw null;
-        void M2();
-    }
-
-    public class Class5 : IInterface1
-    {
-        public void M2() => throw null;
-    }
-
-    public class Class6<T> where T : class, IInterface1
-    {
-        public Class6(int i) => throw null;
-
-        public virtual void M1<T>() where T : class, IInterface1, new() => throw null;
-    }
-
-    public class Class7 : Class6<Class5>
-    {
-        public Class7(int i) : base(i) => throw null;
-
-        public override void M1<T>() where T : class => throw null;
-    }
-
-    public class Class8
-    {
-        public const int @this = 10;
-    }
-
-    public class Class9
-    {
-        private Class9(int i) => throw null;
-
-        public class Nested : Class9
-        {
-            internal Nested(int i) : base(i) => throw null;
-        }
-
-        public Class9.Nested NestedInstance { get; } = new Class9.Nested(1);
-    }
-
-    public class Class10
-    {
-        unsafe public void M1(delegate* unmanaged<System.IntPtr, void> f) => throw null;
-    }
-
-    public interface IInterface2<T> where T : IInterface2<T>
-    {
-        static abstract T operator +(T left, T right);
-        static virtual T operator -(T left, T right) => throw null;
-        static abstract T operator *(T left, T right);
-        static virtual T operator /(T left, T right) => throw null;
-        static abstract explicit operator short(T n);
-        static abstract explicit operator int(T n);
-        void M1();
-        void M2();
-    }
-
-    public interface IInterface3<T> where T : IInterface3<T>
-    {
-        static abstract T operator +(T left, T right);
-        static virtual T operator -(T left, T right) => throw null;
-        static abstract explicit operator short(T n);
-        void M1();
-    }
-
-    public class Class11 : IInterface2<Class11>, IInterface3<Class11>
-    {
-        public static Class11 operator +(Class11 left, Class11 right) => throw null;
-        public static Class11 operator -(Class11 left, Class11 right) => throw null;
-        static Class11 IInterface2<Class11>.operator *(Class11 left, Class11 right) => throw null;
-        static Class11 IInterface2<Class11>.operator /(Class11 left, Class11 right) => throw null;
-        public void M1() => throw null;
-        void IInterface2<Class11>.M2() => throw null;
-        public static explicit operator short(Class11 n) => 0;
-        static explicit IInterface2<Class11>.operator int(Class11 n) => 0;
-    }
-
-    public unsafe class MyUnsafeClass
-    {
-        public static void M1(delegate*<void> f) => throw null;
-        public static void M2(int*[] x) => throw null;
-        public static char* M3() => throw null;
-        public static void M4(int x) => throw null;
-    }
-
-    public enum Enum1
-    {
-        None1,
-        Some11,
-        Some12
-    }
-
-    public enum Enum2
-    {
-        None2 = 2,
-        Some21 = 1,
-        Some22 = 3
-    }
-
-    public enum Enum3
-    {
-        Some32,
-        Some31,
-        None3
-    }
-
-    public enum Enum4
-    {
-        Some41 = 7,
-        None4 = 2,
-        Some42 = 6
-    }
-
-    public enum EnumLong : long
-    {
-        Some = 223372036854775807,
-        None = 10
-    }
-}
-
-namespace A1
-{
-    namespace B1
-    {
-
-    }
-
-    public class C1 { }
-}
-
-namespace A2
-{
-    namespace B2
-    {
-        public class C2 { }
-    }
-}
-
-namespace A3
-{
-    public class C3 { }
-}
-
-namespace A4
-{
-    namespace B4
-    {
-        public class D4 { }
-    }
-
-    public class C4 { }
-}

csharp/ql/test/query-tests/Stubs/Minimal/MinimalStubsFromSource.qlref

@@ -1 +0,0 @@
-Stubs/MinimalStubsFromSource.ql

csharp/ql/test/query-tests/Stubs/Minimal/Test.cs

@@ -1,123 +0,0 @@
-using System;
-using System.IO;
-using System.Text;
-using System.Collections;
-using System.Collections.Generic;
-using System.Collections.Specialized;
-using System.Linq;
-using System.Runtime.Serialization;
-using System.Threading.Tasks;
-using System.Web;
-using System.Web.UI.WebControls;
-using System.Text.RegularExpressions;
-
-public class RegexHandler
-{
-    private static readonly string JAVA_CLASS_REGEX = "^(([a-z])+.)+[A-Z]([a-z])+$";
-
-    public void ProcessRequest()
-    {
-        string userInput = "";
-
-        // BAD:
-        // Artificial regexes
-        new Regex("^([a-z]+)+$").Match(userInput);
-        new Regex("^([a-z]*)*$").Replace(userInput, "");
-        // Known exponential blowup regex for e-mail address validation
-        // Problematic part is: ([a-zA-Z0-9]+))*
-        new Regex("^([a-zA-Z0-9])(([\\-.]|[_]+)?([a-zA-Z0-9]+))*(@){1}[a-z0-9]+[.]{1}(([a-z]{2,3})|([a-z]{2,3}[.]{1}[a-z]{2,3}))$").Match(userInput);
-        // Known exponential blowup regex for Java class name validation
-        // Problematic part is: (([a-z])+.)+
-        new Regex(JAVA_CLASS_REGEX).Match(userInput);
-        // Static use
-        Regex.Match(userInput, JAVA_CLASS_REGEX);
-        // GOOD:
-        new Regex("^(([a-b]+[c-z]+)+$").Match(userInput);
-        new Regex("^([a-z]+)+$", RegexOptions.IgnoreCase, TimeSpan.FromSeconds(1)).Match(userInput);
-        Regex.Match(userInput, JAVA_CLASS_REGEX, RegexOptions.IgnoreCase, TimeSpan.FromSeconds(1));
-        // Known possible FP.
-        new Regex("^[a-z0-9]+([_.-][a-z0-9]+)*$").Match(userInput);
-    }
-}
-
-// The only purpose of this class is to make sure the extractor extracts the
-// relevant library methods
-public class LibraryTypeDataFlow
-{
-    void M()
-    {
-        int i;
-        int.Parse("");
-        int.TryParse("", out i);
-
-        bool b;
-        bool.Parse("");
-        bool.TryParse("", out b);
-
-        Uri uri = null;
-        uri.ToString();
-
-        StringReader sr = new StringReader("");
-
-        string s = new string(new[] { 'a' });
-        string.Join("", "", "", "");
-
-        StringBuilder sb = new StringBuilder("");
-
-        Lazy<int> l = new Lazy<int>(() => 42);
-
-        IEnumerable ie = null;
-        ie.GetEnumerator();
-        ie.AsParallel();
-        ie.AsQueryable();
-        IEnumerable<int> ieint = null;
-        ieint.Select(x => x);
-        List<int> list = null;
-        list.Find(x => x > 0);
-        Stack<int> stack = null;
-        stack.Peek();
-        ArrayList al = null;
-        ArrayList.FixedSize(al);
-        SortedList sl = null;
-        sl.GetByIndex(0);
-
-        Convert.ToInt32("0");
-
-        DataContract dc = null;
-        s = dc.AString;
-
-        KeyValuePair<int, string> kvp = new KeyValuePair<int, string>(0, "");
-
-        IEnumerator ienum = null;
-        object o = ienum.Current;
-
-        IEnumerator<int> ienumint = null;
-        i = ienumint.Current;
-
-        var task = new Task(() => { });
-        Task.WhenAll<int>(null, null);
-        Task.WhenAny<int>(null, null);
-        Task.Factory.ContinueWhenAll((Task[])null, (Func<Task[], int>)null);
-
-        var task2 = new Task<int>(() => 42);
-        Task<string>.Factory.ContinueWhenAny<int>(new Task<int>[] { task2 }, t => t.Result.ToString());
-
-        Encoding.Unicode.GetString(Encoding.Unicode.GetBytes(""));
-
-        Path.Combine("", "");
-        Path.GetDirectoryName("");
-        Path.GetExtension("");
-        Path.GetFileName("");
-        Path.GetFileNameWithoutExtension("");
-        Path.GetPathRoot("");
-        HttpContextBase context = null;
-        string name = context.Request.QueryString["name"];
-    }
-
-    [DataContract]
-    public class DataContract
-    {
-        [DataMember]
-        public string AString { get; set; }
-    }
-}

csharp/ql/test/query-tests/Stubs/Minimal/options

@@ -1 +0,0 @@
-semmle-extractor-options: /r:System.Text.RegularExpressions.dll /r:System.Collections.Specialized.dll /r:System.Net.dll /r:System.Web.dll /r:System.Net.HttpListener.dll /r:System.Collections.Specialized.dll /r:System.Private.Uri.dll /r:System.Runtime.Extensions.dll /r:System.Linq.Parallel.dll /r:System.Collections.Concurrent.dll /r:System.Linq.Expressions.dll /r:System.Collections.dll /r:System.Linq.Queryable.dll /r:System.Linq.dll /r:System.Collections.NonGeneric.dll /r:System.ObjectModel.dll /r:System.ComponentModel.TypeConverter.dll /r:System.IO.Compression.dll /r:System.IO.Pipes.dll /r:System.Net.Primitives.dll /r:System.Net.Security.dll /r:System.Security.Cryptography.Primitives.dll /r:System.Text.RegularExpressions.dll ${testdir}/../../../resources/stubs/System.Web.cs /r:System.Runtime.Serialization.Primitives.dll

csharp/ql/test/query-tests/Stubs/References/Test.cs

@@ -1,6 +0,0 @@
-namespace Test
-{
-    public class Class1
-    {
-    }
-}

csharp/ql/test/query-tests/Stubs/References/files.expected

@@ -1 +0,0 @@
-| Test.cs:0:0:0:0 | Test.cs |

csharp/ql/test/query-tests/Stubs/References/files.ql

@@ -1,5 +0,0 @@
-import csharp
-
-from File f
-where f.fromSource()
-select f

csharp/ql/test/query-tests/Stubs/References/options

@@ -1,3 +0,0 @@
-semmle-extractor-options: --load-sources-from-project:../../../resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.AspNetCore.App.csproj
-semmle-extractor-options: /nostdlib
-semmle-extractor-options: /noconfig

csharp/ql/test/resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.AspNetCore.Authorization.cs

@@ -6,6 +6,7 @@ namespace Microsoft
     {
         namespace Authorization
         {
+            [System.AttributeUsage((System.AttributeTargets)68, AllowMultiple = false, Inherited = true)]
             public class AllowAnonymousAttribute : System.Attribute, Microsoft.AspNetCore.Authorization.IAllowAnonymous
             {
                 public AllowAnonymousAttribute() => throw null;
@@ -120,6 +121,7 @@ namespace Microsoft
                 public static System.Threading.Tasks.Task<Microsoft.AspNetCore.Authorization.AuthorizationResult> AuthorizeAsync(this Microsoft.AspNetCore.Authorization.IAuthorizationService service, System.Security.Claims.ClaimsPrincipal user, Microsoft.AspNetCore.Authorization.AuthorizationPolicy policy) => throw null;
                 public static System.Threading.Tasks.Task<Microsoft.AspNetCore.Authorization.AuthorizationResult> AuthorizeAsync(this Microsoft.AspNetCore.Authorization.IAuthorizationService service, System.Security.Claims.ClaimsPrincipal user, string policyName) => throw null;
             }
+            [System.AttributeUsage((System.AttributeTargets)68, AllowMultiple = true, Inherited = true)]
             public class AuthorizeAttribute : System.Attribute, Microsoft.AspNetCore.Authorization.IAuthorizeData
             {
                 public string AuthenticationSchemes { get => throw null; set { } }

csharp/ql/test/resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.AspNetCore.Components.Web.cs

@@ -6,6 +6,7 @@ namespace Microsoft
     {
         namespace Components
         {
+            [System.AttributeUsage((System.AttributeTargets)4, AllowMultiple = true, Inherited = true)]
             public sealed class BindInputElementAttribute : System.Attribute
             {
                 public string ChangeAttribute { get => throw null; }

csharp/ql/test/resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.AspNetCore.Components.cs

@@ -73,6 +73,7 @@ namespace Microsoft
                 public static bool TryConvertToTimeOnly(object obj, System.Globalization.CultureInfo culture, out System.TimeOnly value) => throw null;
                 public static bool TryConvertToTimeOnly(object obj, System.Globalization.CultureInfo culture, string format, out System.TimeOnly value) => throw null;
             }
+            [System.AttributeUsage((System.AttributeTargets)4, AllowMultiple = true, Inherited = true)]
             public sealed class BindElementAttribute : System.Attribute
             {
                 public string ChangeAttribute { get => throw null; }
@@ -81,11 +82,13 @@ namespace Microsoft
                 public string Suffix { get => throw null; }
                 public string ValueAttribute { get => throw null; }
             }
+            [System.AttributeUsage((System.AttributeTargets)128, AllowMultiple = false, Inherited = true)]
             public sealed class CascadingParameterAttribute : System.Attribute
             {
                 public CascadingParameterAttribute() => throw null;
                 public string Name { get => throw null; set { } }
             }
+            [System.AttributeUsage((System.AttributeTargets)4, AllowMultiple = true, Inherited = false)]
             public sealed class CascadingTypeParameterAttribute : System.Attribute
             {
                 public CascadingTypeParameterAttribute(string name) => throw null;
@@ -161,6 +164,7 @@ namespace Microsoft
                 public System.Threading.Tasks.Task SetParametersAsync(Microsoft.AspNetCore.Components.ParameterView parameters) => throw null;
                 public System.Type Type { get => throw null; set { } }
             }
+            [System.AttributeUsage((System.AttributeTargets)128, AllowMultiple = false)]
             public sealed class EditorRequiredAttribute : System.Attribute
             {
                 public EditorRequiredAttribute() => throw null;
@@ -300,6 +304,7 @@ namespace Microsoft
                 public static readonly Microsoft.AspNetCore.Components.EventCallbackWorkItem Empty;
                 public System.Threading.Tasks.Task InvokeAsync(object arg) => throw null;
             }
+            [System.AttributeUsage((System.AttributeTargets)4, AllowMultiple = true, Inherited = true)]
             public sealed class EventHandlerAttribute : System.Attribute
             {
                 public string AttributeName { get => throw null; }
@@ -336,6 +341,7 @@ namespace Microsoft
                     public Microsoft.AspNetCore.Components.PersistentComponentState State { get => throw null; }
                 }
             }
+            [System.AttributeUsage((System.AttributeTargets)128, AllowMultiple = false, Inherited = true)]
             public sealed class InjectAttribute : System.Attribute
             {
                 public InjectAttribute() => throw null;
@@ -345,6 +351,7 @@ namespace Microsoft
                 System.Threading.Tasks.Task<System.Collections.Generic.IDictionary<string, byte[]>> GetPersistedStateAsync();
                 System.Threading.Tasks.Task PersistStateAsync(System.Collections.Generic.IReadOnlyDictionary<string, byte[]> state);
             }
+            [System.AttributeUsage((System.AttributeTargets)4, AllowMultiple = false, Inherited = true)]
             public sealed class LayoutAttribute : System.Attribute
             {
                 public LayoutAttribute(System.Type layoutType) => throw null;
@@ -447,6 +454,7 @@ namespace Microsoft
                 protected OwningComponentBase() => throw null;
                 protected TService Service { get => throw null; }
             }
+            [System.AttributeUsage((System.AttributeTargets)128, AllowMultiple = false, Inherited = true)]
             public sealed class ParameterAttribute : System.Attribute
             {
                 public bool CaptureUnmatchedValues { get => throw null; set { } }
@@ -647,6 +655,7 @@ namespace Microsoft
                     Markup = 8,
                 }
             }
+            [System.AttributeUsage((System.AttributeTargets)4, AllowMultiple = true, Inherited = false)]
             public sealed class RouteAttribute : System.Attribute
             {
                 public RouteAttribute(string template) => throw null;
@@ -714,6 +723,7 @@ namespace Microsoft
                     public System.Threading.Tasks.Task SetParametersAsync(Microsoft.AspNetCore.Components.ParameterView parameters) => throw null;
                 }
             }
+            [System.AttributeUsage((System.AttributeTargets)128, AllowMultiple = false, Inherited = true)]
             public sealed class SupplyParameterFromQueryAttribute : System.Attribute
             {
                 public SupplyParameterFromQueryAttribute() => throw null;

csharp/ql/test/resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.AspNetCore.Cors.cs

@@ -25,10 +25,12 @@ namespace Microsoft
                 public CorsPolicyMetadata(Microsoft.AspNetCore.Cors.Infrastructure.CorsPolicy policy) => throw null;
                 public Microsoft.AspNetCore.Cors.Infrastructure.CorsPolicy Policy { get => throw null; }
             }
+            [System.AttributeUsage((System.AttributeTargets)68, AllowMultiple = false, Inherited = false)]
             public class DisableCorsAttribute : System.Attribute, Microsoft.AspNetCore.Cors.Infrastructure.ICorsMetadata, Microsoft.AspNetCore.Cors.Infrastructure.IDisableCorsAttribute
             {
                 public DisableCorsAttribute() => throw null;
             }
+            [System.AttributeUsage((System.AttributeTargets)68, AllowMultiple = false, Inherited = true)]
             public class EnableCorsAttribute : System.Attribute, Microsoft.AspNetCore.Cors.Infrastructure.ICorsMetadata, Microsoft.AspNetCore.Cors.Infrastructure.IEnableCorsAttribute
             {
                 public EnableCorsAttribute() => throw null;

csharp/ql/test/resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.AspNetCore.Hosting.Abstractions.cs

@@ -34,6 +34,7 @@ namespace Microsoft
                 public static bool IsProduction(this Microsoft.AspNetCore.Hosting.IHostingEnvironment hostingEnvironment) => throw null;
                 public static bool IsStaging(this Microsoft.AspNetCore.Hosting.IHostingEnvironment hostingEnvironment) => throw null;
             }
+            [System.AttributeUsage((System.AttributeTargets)1, Inherited = false, AllowMultiple = true)]
             public sealed class HostingStartupAttribute : System.Attribute
             {
                 public HostingStartupAttribute(System.Type hostingStartupType) => throw null;

csharp/ql/test/resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.AspNetCore.Http.Abstractions.cs

@@ -105,6 +105,7 @@ namespace Microsoft
         }
         namespace Http
         {
+            [System.AttributeUsage((System.AttributeTargets)2048, Inherited = false, AllowMultiple = false)]
             public sealed class AsParametersAttribute : System.Attribute
             {
                 public AsParametersAttribute() => throw null;

csharp/ql/test/resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.AspNetCore.Http.Extensions.cs

@@ -6,11 +6,13 @@ namespace Microsoft
     {
         namespace Http
         {
+            [System.AttributeUsage((System.AttributeTargets)64, Inherited = false, AllowMultiple = false)]
             public sealed class EndpointDescriptionAttribute : System.Attribute, Microsoft.AspNetCore.Http.Metadata.IEndpointDescriptionMetadata
             {
                 public EndpointDescriptionAttribute(string description) => throw null;
                 public string Description { get => throw null; }
             }
+            [System.AttributeUsage((System.AttributeTargets)64, Inherited = false, AllowMultiple = false)]
             public sealed class EndpointSummaryAttribute : System.Attribute, Microsoft.AspNetCore.Http.Metadata.IEndpointSummaryMetadata
             {
                 public EndpointSummaryAttribute(string summary) => throw null;
@@ -195,6 +197,7 @@ namespace Microsoft
                 public static void SetInt32(this Microsoft.AspNetCore.Http.ISession session, string key, int value) => throw null;
                 public static void SetString(this Microsoft.AspNetCore.Http.ISession session, string key, string value) => throw null;
             }
+            [System.AttributeUsage((System.AttributeTargets)4164, Inherited = false, AllowMultiple = false)]
             public sealed class TagsAttribute : System.Attribute, Microsoft.AspNetCore.Http.Metadata.ITagsMetadata
             {
                 public TagsAttribute(params string[] tags) => throw null;

csharp/ql/test/resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.AspNetCore.Mvc.Core.cs

@@ -67,6 +67,7 @@ namespace Microsoft
                 public string Location { get => throw null; set { } }
                 public override void OnFormatting(Microsoft.AspNetCore.Mvc.ActionContext context) => throw null;
             }
+            [System.AttributeUsage((System.AttributeTargets)64, AllowMultiple = true, Inherited = true)]
             public sealed class AcceptVerbsAttribute : System.Attribute, Microsoft.AspNetCore.Mvc.Routing.IActionHttpMethodProvider, Microsoft.AspNetCore.Mvc.Routing.IRouteTemplateProvider
             {
                 public AcceptVerbsAttribute(string method) => throw null;
@@ -80,6 +81,7 @@ namespace Microsoft
             }
             namespace ActionConstraints
             {
+                [System.AttributeUsage((System.AttributeTargets)64, AllowMultiple = false, Inherited = true)]
                 public abstract class ActionMethodSelectorAttribute : System.Attribute, Microsoft.AspNetCore.Mvc.ActionConstraints.IActionConstraint, Microsoft.AspNetCore.Mvc.ActionConstraints.IActionConstraintMetadata
                 {
                     public bool Accept(Microsoft.AspNetCore.Mvc.ActionConstraints.ActionConstraintContext context) => throw null;
@@ -96,10 +98,12 @@ namespace Microsoft
                     public int Order { get => throw null; }
                 }
             }
+            [System.AttributeUsage((System.AttributeTargets)128, AllowMultiple = false, Inherited = true)]
             public class ActionContextAttribute : System.Attribute
             {
                 public ActionContextAttribute() => throw null;
             }
+            [System.AttributeUsage((System.AttributeTargets)64, AllowMultiple = false, Inherited = true)]
             public sealed class ActionNameAttribute : System.Attribute
             {
                 public ActionNameAttribute(string name) => throw null;
@@ -138,15 +142,18 @@ namespace Microsoft
                 public bool SuppressMapClientErrors { get => throw null; set { } }
                 public bool SuppressModelStateInvalidFilter { get => throw null; set { } }
             }
+            [System.AttributeUsage((System.AttributeTargets)5, AllowMultiple = false, Inherited = true)]
             public class ApiControllerAttribute : Microsoft.AspNetCore.Mvc.ControllerAttribute, Microsoft.AspNetCore.Mvc.Infrastructure.IApiBehaviorMetadata, Microsoft.AspNetCore.Mvc.Filters.IFilterMetadata
             {
                 public ApiControllerAttribute() => throw null;
             }
+            [System.AttributeUsage((System.AttributeTargets)64, AllowMultiple = false, Inherited = true)]
             public sealed class ApiConventionMethodAttribute : System.Attribute
             {
                 public System.Type ConventionType { get => throw null; }
                 public ApiConventionMethodAttribute(System.Type conventionType, string methodName) => throw null;
             }
+            [System.AttributeUsage((System.AttributeTargets)5, AllowMultiple = true, Inherited = true)]
             public sealed class ApiConventionTypeAttribute : System.Attribute
             {
                 public System.Type ConventionType { get => throw null; }
@@ -159,6 +166,7 @@ namespace Microsoft
             }
             namespace ApiExplorer
             {
+                [System.AttributeUsage((System.AttributeTargets)2112, AllowMultiple = false, Inherited = false)]
                 public sealed class ApiConventionNameMatchAttribute : System.Attribute
                 {
                     public ApiConventionNameMatchAttribute(Microsoft.AspNetCore.Mvc.ApiExplorer.ApiConventionNameMatchBehavior matchBehavior) => throw null;
@@ -176,6 +184,7 @@ namespace Microsoft
                     public ApiConventionResult(System.Collections.Generic.IReadOnlyList<Microsoft.AspNetCore.Mvc.ApiExplorer.IApiResponseMetadataProvider> responseMetadataProviders) => throw null;
                     public System.Collections.Generic.IReadOnlyList<Microsoft.AspNetCore.Mvc.ApiExplorer.IApiResponseMetadataProvider> ResponseMetadataProviders { get => throw null; }
                 }
+                [System.AttributeUsage((System.AttributeTargets)2048, AllowMultiple = false, Inherited = false)]
                 public sealed class ApiConventionTypeMatchAttribute : System.Attribute
                 {
                     public ApiConventionTypeMatchAttribute(Microsoft.AspNetCore.Mvc.ApiExplorer.ApiConventionTypeMatchBehavior matchBehavior) => throw null;
@@ -216,6 +225,7 @@ namespace Microsoft
                     System.Collections.Generic.IReadOnlyList<string> GetSupportedContentTypes(string contentType, System.Type objectType);
                 }
             }
+            [System.AttributeUsage((System.AttributeTargets)68, AllowMultiple = false, Inherited = true)]
             public class ApiExplorerSettingsAttribute : System.Attribute, Microsoft.AspNetCore.Mvc.ApiExplorer.IApiDescriptionGroupNameProvider, Microsoft.AspNetCore.Mvc.ApiExplorer.IApiDescriptionVisibilityProvider
             {
                 public ApiExplorerSettingsAttribute() => throw null;
@@ -442,6 +452,7 @@ namespace Microsoft
                     protected ApplicationPart() => throw null;
                     public abstract string Name { get; }
                 }
+                [System.AttributeUsage((System.AttributeTargets)1, AllowMultiple = true)]
                 public sealed class ApplicationPartAttribute : System.Attribute
                 {
                     public string AssemblyName { get => throw null; }
@@ -494,12 +505,14 @@ namespace Microsoft
                     public NullApplicationPartFactory() => throw null;
                     public override System.Collections.Generic.IEnumerable<Microsoft.AspNetCore.Mvc.ApplicationParts.ApplicationPart> GetApplicationParts(System.Reflection.Assembly assembly) => throw null;
                 }
+                [System.AttributeUsage((System.AttributeTargets)1, AllowMultiple = false)]
                 public sealed class ProvideApplicationPartFactoryAttribute : System.Attribute
                 {
                     public ProvideApplicationPartFactoryAttribute(System.Type factoryType) => throw null;
                     public ProvideApplicationPartFactoryAttribute(string factoryTypeName) => throw null;
                     public System.Type GetFactoryType() => throw null;
                 }
+                [System.AttributeUsage((System.AttributeTargets)1, AllowMultiple = true)]
                 public sealed class RelatedAssemblyAttribute : System.Attribute
                 {
                     public string AssemblyFileName { get => throw null; }
@@ -507,6 +520,7 @@ namespace Microsoft
                     public static System.Collections.Generic.IReadOnlyList<System.Reflection.Assembly> GetRelatedAssemblies(System.Reflection.Assembly assembly, bool throwOnError) => throw null;
                 }
             }
+            [System.AttributeUsage((System.AttributeTargets)68, AllowMultiple = false, Inherited = true)]
             public class AreaAttribute : Microsoft.AspNetCore.Mvc.Routing.RouteValueAttribute
             {
                 public AreaAttribute(string areaName) : base(default(string), default(string)) => throw null;
@@ -541,6 +555,7 @@ namespace Microsoft
             {
                 public BadRequestResult() : base(default(int)) => throw null;
             }
+            [System.AttributeUsage((System.AttributeTargets)2052, AllowMultiple = false, Inherited = true)]
             public class BindAttribute : System.Attribute, Microsoft.AspNetCore.Mvc.ModelBinding.IModelNameProvider, Microsoft.AspNetCore.Mvc.ModelBinding.IPropertyFilterProvider
             {
                 public BindAttribute(params string[] include) => throw null;
@@ -549,11 +564,13 @@ namespace Microsoft
                 public string Prefix { get => throw null; set { } }
                 public System.Func<Microsoft.AspNetCore.Mvc.ModelBinding.ModelMetadata, bool> PropertyFilter { get => throw null; }
             }
+            [System.AttributeUsage((System.AttributeTargets)4, AllowMultiple = false, Inherited = true)]
             public class BindPropertiesAttribute : System.Attribute
             {
                 public BindPropertiesAttribute() => throw null;
                 public bool SupportsGet { get => throw null; set { } }
             }
+            [System.AttributeUsage((System.AttributeTargets)128, AllowMultiple = false, Inherited = true)]
             public class BindPropertyAttribute : System.Attribute, Microsoft.AspNetCore.Mvc.ModelBinding.IBinderTypeProviderMetadata, Microsoft.AspNetCore.Mvc.ModelBinding.IBindingSourceMetadata, Microsoft.AspNetCore.Mvc.ModelBinding.IModelNameProvider, Microsoft.AspNetCore.Mvc.ModelBinding.IRequestPredicateProvider
             {
                 public System.Type BinderType { get => throw null; set { } }
@@ -607,6 +624,7 @@ namespace Microsoft
             {
                 public ConflictResult() : base(default(int)) => throw null;
             }
+            [System.AttributeUsage((System.AttributeTargets)68, AllowMultiple = false, Inherited = true)]
             public class ConsumesAttribute : System.Attribute, Microsoft.AspNetCore.Http.Metadata.IAcceptsMetadata, Microsoft.AspNetCore.Mvc.ActionConstraints.IActionConstraint, Microsoft.AspNetCore.Mvc.ActionConstraints.IActionConstraintMetadata, Microsoft.AspNetCore.Mvc.ApiExplorer.IApiRequestMetadataProvider, Microsoft.AspNetCore.Mvc.Filters.IFilterMetadata, Microsoft.AspNetCore.Mvc.Filters.IResourceFilter
             {
                 public bool Accept(Microsoft.AspNetCore.Mvc.ActionConstraints.ActionConstraintContext context) => throw null;
@@ -630,6 +648,7 @@ namespace Microsoft
                 public override System.Threading.Tasks.Task ExecuteResultAsync(Microsoft.AspNetCore.Mvc.ActionContext context) => throw null;
                 public int? StatusCode { get => throw null; set { } }
             }
+            [System.AttributeUsage((System.AttributeTargets)4, AllowMultiple = false, Inherited = true)]
             public class ControllerAttribute : System.Attribute
             {
                 public ControllerAttribute() => throw null;
@@ -817,6 +836,7 @@ namespace Microsoft
                 public ControllerContext(Microsoft.AspNetCore.Mvc.ActionContext context) => throw null;
                 public virtual System.Collections.Generic.IList<Microsoft.AspNetCore.Mvc.ModelBinding.IValueProviderFactory> ValueProviderFactories { get => throw null; set { } }
             }
+            [System.AttributeUsage((System.AttributeTargets)128, AllowMultiple = false, Inherited = true)]
             public class ControllerContextAttribute : System.Attribute
             {
                 public ControllerContextAttribute() => throw null;
@@ -1237,6 +1257,7 @@ namespace Microsoft
                     protected abstract System.Collections.Generic.KeyValuePair<string, object> this[int index] { get; }
                 }
             }
+            [System.AttributeUsage((System.AttributeTargets)68, AllowMultiple = false, Inherited = true)]
             public class DisableRequestSizeLimitAttribute : System.Attribute, Microsoft.AspNetCore.Mvc.Filters.IFilterFactory, Microsoft.AspNetCore.Mvc.Filters.IFilterMetadata, Microsoft.AspNetCore.Mvc.Filters.IOrderedFilter, Microsoft.AspNetCore.Http.Metadata.IRequestSizeLimitMetadata
             {
                 public Microsoft.AspNetCore.Mvc.Filters.IFilterMetadata CreateInstance(System.IServiceProvider serviceProvider) => throw null;
@@ -1275,6 +1296,7 @@ namespace Microsoft
             }
             namespace Filters
             {
+                [System.AttributeUsage((System.AttributeTargets)68, AllowMultiple = true, Inherited = true)]
                 public abstract class ActionFilterAttribute : System.Attribute, Microsoft.AspNetCore.Mvc.Filters.IActionFilter, Microsoft.AspNetCore.Mvc.Filters.IAsyncActionFilter, Microsoft.AspNetCore.Mvc.Filters.IAsyncResultFilter, Microsoft.AspNetCore.Mvc.Filters.IFilterMetadata, Microsoft.AspNetCore.Mvc.Filters.IOrderedFilter, Microsoft.AspNetCore.Mvc.Filters.IResultFilter
                 {
                     protected ActionFilterAttribute() => throw null;
@@ -1286,6 +1308,7 @@ namespace Microsoft
                     public virtual System.Threading.Tasks.Task OnResultExecutionAsync(Microsoft.AspNetCore.Mvc.Filters.ResultExecutingContext context, Microsoft.AspNetCore.Mvc.Filters.ResultExecutionDelegate next) => throw null;
                     public int Order { get => throw null; set { } }
                 }
+                [System.AttributeUsage((System.AttributeTargets)68, AllowMultiple = true, Inherited = true)]
                 public abstract class ExceptionFilterAttribute : System.Attribute, Microsoft.AspNetCore.Mvc.Filters.IAsyncExceptionFilter, Microsoft.AspNetCore.Mvc.Filters.IExceptionFilter, Microsoft.AspNetCore.Mvc.Filters.IFilterMetadata, Microsoft.AspNetCore.Mvc.Filters.IOrderedFilter
                 {
                     protected ExceptionFilterAttribute() => throw null;
@@ -1313,6 +1336,7 @@ namespace Microsoft
                     public static readonly int Global;
                     public static readonly int Last;
                 }
+                [System.AttributeUsage((System.AttributeTargets)68, AllowMultiple = true, Inherited = true)]
                 public abstract class ResultFilterAttribute : System.Attribute, Microsoft.AspNetCore.Mvc.Filters.IAsyncResultFilter, Microsoft.AspNetCore.Mvc.Filters.IFilterMetadata, Microsoft.AspNetCore.Mvc.Filters.IOrderedFilter, Microsoft.AspNetCore.Mvc.Filters.IResultFilter
                 {
                     protected ResultFilterAttribute() => throw null;
@@ -1334,6 +1358,7 @@ namespace Microsoft
                 public override System.Threading.Tasks.Task ExecuteResultAsync(Microsoft.AspNetCore.Mvc.ActionContext context) => throw null;
                 public Microsoft.AspNetCore.Authentication.AuthenticationProperties Properties { get => throw null; set { } }
             }
+            [System.AttributeUsage((System.AttributeTargets)68, AllowMultiple = false, Inherited = true)]
             public class FormatFilterAttribute : System.Attribute, Microsoft.AspNetCore.Mvc.Filters.IFilterFactory, Microsoft.AspNetCore.Mvc.Filters.IFilterMetadata
             {
                 public Microsoft.AspNetCore.Mvc.Filters.IFilterMetadata CreateInstance(System.IServiceProvider serviceProvider) => throw null;
@@ -1471,6 +1496,7 @@ namespace Microsoft
                     public abstract System.Threading.Tasks.Task WriteResponseBodyAsync(Microsoft.AspNetCore.Mvc.Formatters.OutputFormatterWriteContext context, System.Text.Encoding selectedEncoding);
                 }
             }
+            [System.AttributeUsage((System.AttributeTargets)2176, AllowMultiple = false, Inherited = true)]
             public class FromBodyAttribute : System.Attribute, Microsoft.AspNetCore.Mvc.ModelBinding.IBindingSourceMetadata, Microsoft.AspNetCore.Http.Metadata.IFromBodyMetadata
             {
                 bool Microsoft.AspNetCore.Http.Metadata.IFromBodyMetadata.AllowEmpty { get => throw null; }
@@ -1478,30 +1504,35 @@ namespace Microsoft
                 public FromBodyAttribute() => throw null;
                 public Microsoft.AspNetCore.Mvc.ModelBinding.EmptyBodyBehavior EmptyBodyBehavior { get => throw null; set { } }
             }
+            [System.AttributeUsage((System.AttributeTargets)2176, AllowMultiple = false, Inherited = true)]
             public class FromFormAttribute : System.Attribute, Microsoft.AspNetCore.Mvc.ModelBinding.IBindingSourceMetadata, Microsoft.AspNetCore.Http.Metadata.IFromFormMetadata, Microsoft.AspNetCore.Mvc.ModelBinding.IModelNameProvider
             {
                 public Microsoft.AspNetCore.Mvc.ModelBinding.BindingSource BindingSource { get => throw null; }
                 public FromFormAttribute() => throw null;
                 public string Name { get => throw null; set { } }
             }
+            [System.AttributeUsage((System.AttributeTargets)2176, AllowMultiple = false, Inherited = true)]
             public class FromHeaderAttribute : System.Attribute, Microsoft.AspNetCore.Mvc.ModelBinding.IBindingSourceMetadata, Microsoft.AspNetCore.Http.Metadata.IFromHeaderMetadata, Microsoft.AspNetCore.Mvc.ModelBinding.IModelNameProvider
             {
                 public Microsoft.AspNetCore.Mvc.ModelBinding.BindingSource BindingSource { get => throw null; }
                 public FromHeaderAttribute() => throw null;
                 public string Name { get => throw null; set { } }
             }
+            [System.AttributeUsage((System.AttributeTargets)2176, AllowMultiple = false, Inherited = true)]
             public class FromQueryAttribute : System.Attribute, Microsoft.AspNetCore.Mvc.ModelBinding.IBindingSourceMetadata, Microsoft.AspNetCore.Http.Metadata.IFromQueryMetadata, Microsoft.AspNetCore.Mvc.ModelBinding.IModelNameProvider
             {
                 public Microsoft.AspNetCore.Mvc.ModelBinding.BindingSource BindingSource { get => throw null; }
                 public FromQueryAttribute() => throw null;
                 public string Name { get => throw null; set { } }
             }
+            [System.AttributeUsage((System.AttributeTargets)2176, AllowMultiple = false, Inherited = true)]
             public class FromRouteAttribute : System.Attribute, Microsoft.AspNetCore.Mvc.ModelBinding.IBindingSourceMetadata, Microsoft.AspNetCore.Http.Metadata.IFromRouteMetadata, Microsoft.AspNetCore.Mvc.ModelBinding.IModelNameProvider
             {
                 public Microsoft.AspNetCore.Mvc.ModelBinding.BindingSource BindingSource { get => throw null; }
                 public FromRouteAttribute() => throw null;
                 public string Name { get => throw null; set { } }
             }
+            [System.AttributeUsage((System.AttributeTargets)2176, AllowMultiple = false, Inherited = true)]
             public class FromServicesAttribute : System.Attribute, Microsoft.AspNetCore.Mvc.ModelBinding.IBindingSourceMetadata, Microsoft.AspNetCore.Http.Metadata.IFromServiceMetadata
             {
                 public Microsoft.AspNetCore.Mvc.ModelBinding.BindingSource BindingSource { get => throw null; }
@@ -1565,10 +1596,12 @@ namespace Microsoft
                     protected ActionDescriptorCollectionProvider() => throw null;
                     public abstract Microsoft.Extensions.Primitives.IChangeToken GetChangeToken();
                 }
+                [System.AttributeUsage((System.AttributeTargets)2176, AllowMultiple = false, Inherited = false)]
                 public sealed class ActionResultObjectValueAttribute : System.Attribute
                 {
                     public ActionResultObjectValueAttribute() => throw null;
                 }
+                [System.AttributeUsage((System.AttributeTargets)2048, AllowMultiple = false, Inherited = false)]
                 public sealed class ActionResultStatusCodeAttribute : System.Attribute
                 {
                     public ActionResultStatusCodeAttribute() => throw null;
@@ -1604,6 +1637,7 @@ namespace Microsoft
                     public DefaultOutputFormatterSelector(Microsoft.Extensions.Options.IOptions<Microsoft.AspNetCore.Mvc.MvcOptions> options, Microsoft.Extensions.Logging.ILoggerFactory loggerFactory) => throw null;
                     public override Microsoft.AspNetCore.Mvc.Formatters.IOutputFormatter SelectFormatter(Microsoft.AspNetCore.Mvc.Formatters.OutputFormatterCanWriteContext context, System.Collections.Generic.IList<Microsoft.AspNetCore.Mvc.Formatters.IOutputFormatter> formatters, Microsoft.AspNetCore.Mvc.Formatters.MediaTypeCollection contentTypes) => throw null;
                 }
+                [System.AttributeUsage((System.AttributeTargets)68, AllowMultiple = false, Inherited = true)]
                 public sealed class DefaultStatusCodeAttribute : System.Attribute
                 {
                     public DefaultStatusCodeAttribute(int statusCode) => throw null;
@@ -1813,6 +1847,7 @@ namespace Microsoft
                 public string Url { get => throw null; set { } }
                 public Microsoft.AspNetCore.Mvc.IUrlHelper UrlHelper { get => throw null; set { } }
             }
+            [System.AttributeUsage((System.AttributeTargets)68, AllowMultiple = true, Inherited = true)]
             public class MiddlewareFilterAttribute : System.Attribute, Microsoft.AspNetCore.Mvc.Filters.IFilterFactory, Microsoft.AspNetCore.Mvc.Filters.IFilterMetadata, Microsoft.AspNetCore.Mvc.Filters.IOrderedFilter
             {
                 public System.Type ConfigurationType { get => throw null; }
@@ -1821,6 +1856,7 @@ namespace Microsoft
                 public bool IsReusable { get => throw null; }
                 public int Order { get => throw null; set { } }
             }
+            [System.AttributeUsage((System.AttributeTargets)2204, AllowMultiple = false, Inherited = true)]
             public class ModelBinderAttribute : System.Attribute, Microsoft.AspNetCore.Mvc.ModelBinding.IBinderTypeProviderMetadata, Microsoft.AspNetCore.Mvc.ModelBinding.IBindingSourceMetadata, Microsoft.AspNetCore.Mvc.ModelBinding.IModelNameProvider
             {
                 public System.Type BinderType { get => throw null; set { } }
@@ -2065,6 +2101,7 @@ namespace Microsoft
                     Never = 1,
                     Required = 2,
                 }
+                [System.AttributeUsage((System.AttributeTargets)2180, AllowMultiple = false, Inherited = true)]
                 public class BindingBehaviorAttribute : System.Attribute
                 {
                     public Microsoft.AspNetCore.Mvc.ModelBinding.BindingBehavior Behavior { get => throw null; }
@@ -2078,10 +2115,12 @@ namespace Microsoft
                     public virtual Microsoft.AspNetCore.Mvc.ModelBinding.IValueProvider Filter(Microsoft.AspNetCore.Mvc.ModelBinding.BindingSource bindingSource) => throw null;
                     public abstract Microsoft.AspNetCore.Mvc.ModelBinding.ValueProviderResult GetValue(string key);
                 }
+                [System.AttributeUsage((System.AttributeTargets)2180, AllowMultiple = false, Inherited = true)]
                 public sealed class BindNeverAttribute : Microsoft.AspNetCore.Mvc.ModelBinding.BindingBehaviorAttribute
                 {
                     public BindNeverAttribute() : base(default(Microsoft.AspNetCore.Mvc.ModelBinding.BindingBehavior)) => throw null;
                 }
+                [System.AttributeUsage((System.AttributeTargets)2180, AllowMultiple = false, Inherited = true)]
                 public sealed class BindRequiredAttribute : Microsoft.AspNetCore.Mvc.ModelBinding.BindingBehaviorAttribute
                 {
                     public BindRequiredAttribute() : base(default(Microsoft.AspNetCore.Mvc.ModelBinding.BindingBehavior)) => throw null;
@@ -2583,6 +2622,7 @@ namespace Microsoft
                         public static void RemoveType<TModelValidatorProvider>(this System.Collections.Generic.IList<Microsoft.AspNetCore.Mvc.ModelBinding.Validation.IModelValidatorProvider> list) where TModelValidatorProvider : Microsoft.AspNetCore.Mvc.ModelBinding.Validation.IModelValidatorProvider => throw null;
                         public static void RemoveType(this System.Collections.Generic.IList<Microsoft.AspNetCore.Mvc.ModelBinding.Validation.IModelValidatorProvider> list, System.Type type) => throw null;
                     }
+                    [System.AttributeUsage((System.AttributeTargets)2180, AllowMultiple = false, Inherited = true)]
                     public sealed class ValidateNeverAttribute : System.Attribute, Microsoft.AspNetCore.Mvc.ModelBinding.Validation.IPropertyValidationFilter
                     {
                         public ValidateNeverAttribute() => throw null;
@@ -2633,6 +2673,7 @@ namespace Microsoft
                     public static void RemoveType(this System.Collections.Generic.IList<Microsoft.AspNetCore.Mvc.ModelBinding.IValueProviderFactory> list, System.Type type) => throw null;
                 }
             }
+            [System.AttributeUsage((System.AttributeTargets)4, AllowMultiple = false, Inherited = true)]
             public class ModelMetadataTypeAttribute : System.Attribute
             {
                 public ModelMetadataTypeAttribute(System.Type type) => throw null;
@@ -2676,14 +2717,17 @@ namespace Microsoft
             {
                 public NoContentResult() : base(default(int)) => throw null;
             }
+            [System.AttributeUsage((System.AttributeTargets)64, AllowMultiple = false, Inherited = true)]
             public sealed class NonActionAttribute : System.Attribute
             {
                 public NonActionAttribute() => throw null;
             }
+            [System.AttributeUsage((System.AttributeTargets)4, AllowMultiple = false, Inherited = true)]
             public sealed class NonControllerAttribute : System.Attribute
             {
                 public NonControllerAttribute() => throw null;
             }
+            [System.AttributeUsage((System.AttributeTargets)4, AllowMultiple = false, Inherited = true)]
             public class NonViewComponentAttribute : System.Attribute
             {
                 public NonViewComponentAttribute() => throw null;
@@ -2722,6 +2766,7 @@ namespace Microsoft
                 public override System.Threading.Tasks.Task ExecuteResultAsync(Microsoft.AspNetCore.Mvc.ActionContext context) => throw null;
                 public string FileName { get => throw null; set { } }
             }
+            [System.AttributeUsage((System.AttributeTargets)68, AllowMultiple = false, Inherited = true)]
             public class ProducesAttribute : System.Attribute, Microsoft.AspNetCore.Mvc.ApiExplorer.IApiResponseMetadataProvider, Microsoft.AspNetCore.Mvc.Filters.IFilterMetadata, Microsoft.AspNetCore.Mvc.Filters.IOrderedFilter, Microsoft.AspNetCore.Mvc.Filters.IResultFilter
             {
                 public Microsoft.AspNetCore.Mvc.Formatters.MediaTypeCollection ContentTypes { get => throw null; set { } }
@@ -2734,6 +2779,7 @@ namespace Microsoft
                 public int StatusCode { get => throw null; }
                 public System.Type Type { get => throw null; set { } }
             }
+            [System.AttributeUsage((System.AttributeTargets)64, AllowMultiple = false, Inherited = true)]
             public sealed class ProducesDefaultResponseTypeAttribute : System.Attribute, Microsoft.AspNetCore.Mvc.ApiExplorer.IApiDefaultResponseMetadataProvider, Microsoft.AspNetCore.Mvc.ApiExplorer.IApiResponseMetadataProvider, Microsoft.AspNetCore.Mvc.Filters.IFilterMetadata
             {
                 public ProducesDefaultResponseTypeAttribute() => throw null;
@@ -2742,11 +2788,13 @@ namespace Microsoft
                 public int StatusCode { get => throw null; }
                 public System.Type Type { get => throw null; }
             }
+            [System.AttributeUsage((System.AttributeTargets)69, AllowMultiple = false, Inherited = true)]
             public sealed class ProducesErrorResponseTypeAttribute : System.Attribute
             {
                 public ProducesErrorResponseTypeAttribute(System.Type type) => throw null;
                 public System.Type Type { get => throw null; }
             }
+            [System.AttributeUsage((System.AttributeTargets)68, AllowMultiple = true, Inherited = true)]
             public class ProducesResponseTypeAttribute : System.Attribute, Microsoft.AspNetCore.Mvc.ApiExplorer.IApiResponseMetadataProvider, Microsoft.AspNetCore.Mvc.Filters.IFilterMetadata
             {
                 public ProducesResponseTypeAttribute(int statusCode) => throw null;
@@ -2823,6 +2871,7 @@ namespace Microsoft
                 public Microsoft.AspNetCore.Routing.RouteValueDictionary RouteValues { get => throw null; set { } }
                 public Microsoft.AspNetCore.Mvc.IUrlHelper UrlHelper { get => throw null; set { } }
             }
+            [System.AttributeUsage((System.AttributeTargets)68, AllowMultiple = false, Inherited = true)]
             public class RequestFormLimitsAttribute : System.Attribute, Microsoft.AspNetCore.Mvc.Filters.IFilterFactory, Microsoft.AspNetCore.Mvc.Filters.IFilterMetadata, Microsoft.AspNetCore.Mvc.Filters.IOrderedFilter
             {
                 public bool BufferBody { get => throw null; set { } }
@@ -2840,6 +2889,7 @@ namespace Microsoft
                 public int ValueCountLimit { get => throw null; set { } }
                 public int ValueLengthLimit { get => throw null; set { } }
             }
+            [System.AttributeUsage((System.AttributeTargets)68, AllowMultiple = false, Inherited = true)]
             public class RequestSizeLimitAttribute : System.Attribute, Microsoft.AspNetCore.Mvc.Filters.IFilterFactory, Microsoft.AspNetCore.Mvc.Filters.IFilterMetadata, Microsoft.AspNetCore.Mvc.Filters.IOrderedFilter, Microsoft.AspNetCore.Http.Metadata.IRequestSizeLimitMetadata
             {
                 public Microsoft.AspNetCore.Mvc.Filters.IFilterMetadata CreateInstance(System.IServiceProvider serviceProvider) => throw null;
@@ -2848,6 +2898,7 @@ namespace Microsoft
                 long? Microsoft.AspNetCore.Http.Metadata.IRequestSizeLimitMetadata.MaxRequestBodySize { get => throw null; }
                 public int Order { get => throw null; set { } }
             }
+            [System.AttributeUsage((System.AttributeTargets)68, Inherited = true, AllowMultiple = false)]
             public class RequireHttpsAttribute : System.Attribute, Microsoft.AspNetCore.Mvc.Filters.IAuthorizationFilter, Microsoft.AspNetCore.Mvc.Filters.IFilterMetadata, Microsoft.AspNetCore.Mvc.Filters.IOrderedFilter
             {
                 public RequireHttpsAttribute() => throw null;
@@ -2856,6 +2907,7 @@ namespace Microsoft
                 public int Order { get => throw null; set { } }
                 public bool Permanent { get => throw null; set { } }
             }
+            [System.AttributeUsage((System.AttributeTargets)68, AllowMultiple = false, Inherited = true)]
             public class ResponseCacheAttribute : System.Attribute, Microsoft.AspNetCore.Mvc.Filters.IFilterFactory, Microsoft.AspNetCore.Mvc.Filters.IFilterMetadata, Microsoft.AspNetCore.Mvc.Filters.IOrderedFilter
             {
                 public string CacheProfileName { get => throw null; set { } }
@@ -2876,6 +2928,7 @@ namespace Microsoft
                 Client = 1,
                 None = 2,
             }
+            [System.AttributeUsage((System.AttributeTargets)68, AllowMultiple = true, Inherited = true)]
             public class RouteAttribute : System.Attribute, Microsoft.AspNetCore.Mvc.Routing.IRouteTemplateProvider
             {
                 public RouteAttribute(string template) => throw null;
@@ -2893,6 +2946,7 @@ namespace Microsoft
                     public object State { get => throw null; set { } }
                     public abstract System.Threading.Tasks.ValueTask<Microsoft.AspNetCore.Routing.RouteValueDictionary> TransformAsync(Microsoft.AspNetCore.Http.HttpContext httpContext, Microsoft.AspNetCore.Routing.RouteValueDictionary values);
                 }
+                [System.AttributeUsage((System.AttributeTargets)64, AllowMultiple = true, Inherited = true)]
                 public abstract class HttpMethodAttribute : System.Attribute, Microsoft.AspNetCore.Mvc.Routing.IActionHttpMethodProvider, Microsoft.AspNetCore.Mvc.Routing.IRouteTemplateProvider
                 {
                     public HttpMethodAttribute(System.Collections.Generic.IEnumerable<string> httpMethods) => throw null;
@@ -2927,6 +2981,7 @@ namespace Microsoft
                     public KnownRouteValueConstraint(Microsoft.AspNetCore.Mvc.Infrastructure.IActionDescriptorCollectionProvider actionDescriptorCollectionProvider) => throw null;
                     public bool Match(Microsoft.AspNetCore.Http.HttpContext httpContext, Microsoft.AspNetCore.Routing.IRouter route, string routeKey, Microsoft.AspNetCore.Routing.RouteValueDictionary values, Microsoft.AspNetCore.Routing.RouteDirection routeDirection) => throw null;
                 }
+                [System.AttributeUsage((System.AttributeTargets)68, AllowMultiple = true, Inherited = true)]
                 public abstract class RouteValueAttribute : System.Attribute, Microsoft.AspNetCore.Mvc.Routing.IRouteValueProvider
                 {
                     protected RouteValueAttribute(string routeKey, string routeValue) => throw null;
@@ -2968,6 +3023,7 @@ namespace Microsoft
                 public SerializableError() => throw null;
                 public SerializableError(Microsoft.AspNetCore.Mvc.ModelBinding.ModelStateDictionary modelState) => throw null;
             }
+            [System.AttributeUsage((System.AttributeTargets)68, AllowMultiple = true, Inherited = true)]
             public class ServiceFilterAttribute : System.Attribute, Microsoft.AspNetCore.Mvc.Filters.IFilterFactory, Microsoft.AspNetCore.Mvc.Filters.IFilterMetadata, Microsoft.AspNetCore.Mvc.Filters.IOrderedFilter
             {
                 public Microsoft.AspNetCore.Mvc.Filters.IFilterMetadata CreateInstance(System.IServiceProvider serviceProvider) => throw null;
@@ -3007,6 +3063,7 @@ namespace Microsoft
                 public int StatusCode { get => throw null; }
                 int? Microsoft.AspNetCore.Mvc.Infrastructure.IStatusCodeActionResult.StatusCode { get => throw null; }
             }
+            [System.AttributeUsage((System.AttributeTargets)68, AllowMultiple = true, Inherited = true)]
             public class TypeFilterAttribute : System.Attribute, Microsoft.AspNetCore.Mvc.Filters.IFilterFactory, Microsoft.AspNetCore.Mvc.Filters.IFilterMetadata, Microsoft.AspNetCore.Mvc.Filters.IOrderedFilter
             {
                 public object[] Arguments { get => throw null; set { } }

csharp/ql/test/resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.AspNetCore.Mvc.DataAnnotations.cs

@@ -53,6 +53,7 @@ namespace Microsoft
                     public abstract System.Collections.Generic.IEnumerable<System.ComponentModel.DataAnnotations.ValidationAttribute> GetValidationAttributes();
                 }
             }
+            [System.AttributeUsage((System.AttributeTargets)132, AllowMultiple = false, Inherited = true)]
             public sealed class HiddenInputAttribute : System.Attribute
             {
                 public HiddenInputAttribute() => throw null;

csharp/ql/test/resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.AspNetCore.Mvc.Razor.cs

@@ -79,6 +79,7 @@ namespace Microsoft
                     {
                         Microsoft.AspNetCore.Mvc.Razor.Compilation.IViewCompiler GetCompiler();
                     }
+                    [System.AttributeUsage((System.AttributeTargets)1, AllowMultiple = true)]
                     public class RazorViewAttribute : System.Attribute
                     {
                         public RazorViewAttribute(string path, System.Type viewType) => throw null;
@@ -107,6 +108,7 @@ namespace Microsoft
                 }
                 namespace Internal
                 {
+                    [System.AttributeUsage((System.AttributeTargets)128, AllowMultiple = false, Inherited = true)]
                     public class RazorInjectAttribute : System.Attribute
                     {
                         public RazorInjectAttribute() => throw null;

csharp/ql/test/resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.AspNetCore.Mvc.RazorPages.cs

@@ -400,6 +400,7 @@ namespace Microsoft
                         public abstract System.Threading.Tasks.Task<Microsoft.AspNetCore.Mvc.RazorPages.CompiledPageActionDescriptor> LoadAsync(Microsoft.AspNetCore.Mvc.RazorPages.PageActionDescriptor actionDescriptor);
                         public virtual System.Threading.Tasks.Task<Microsoft.AspNetCore.Mvc.RazorPages.CompiledPageActionDescriptor> LoadAsync(Microsoft.AspNetCore.Mvc.RazorPages.PageActionDescriptor actionDescriptor, Microsoft.AspNetCore.Http.EndpointMetadataCollection endpointMetadata) => throw null;
                     }
+                    [System.AttributeUsage((System.AttributeTargets)4, AllowMultiple = false, Inherited = true)]
                     public class PageModelAttribute : System.Attribute
                     {
                         public PageModelAttribute() => throw null;
@@ -464,6 +465,7 @@ namespace Microsoft
                     System.Action<Microsoft.AspNetCore.Mvc.RazorPages.PageContext, object> CreateModelDisposer(Microsoft.AspNetCore.Mvc.RazorPages.CompiledPageActionDescriptor descriptor);
                     System.Func<Microsoft.AspNetCore.Mvc.RazorPages.PageContext, object> CreateModelFactory(Microsoft.AspNetCore.Mvc.RazorPages.CompiledPageActionDescriptor descriptor);
                 }
+                [System.AttributeUsage((System.AttributeTargets)64, AllowMultiple = false, Inherited = true)]
                 public class NonHandlerAttribute : System.Attribute
                 {
                     public NonHandlerAttribute() => throw null;
@@ -604,6 +606,7 @@ namespace Microsoft
                     public virtual Microsoft.AspNetCore.Mvc.ViewFeatures.ViewDataDictionary ViewData { get => throw null; set { } }
                     public virtual System.Collections.Generic.IList<System.Func<Microsoft.AspNetCore.Mvc.Razor.IRazorPage>> ViewStartFactories { get => throw null; set { } }
                 }
+                [System.AttributeUsage((System.AttributeTargets)128, AllowMultiple = false, Inherited = true)]
                 public class PageContextAttribute : System.Attribute
                 {
                     public PageContextAttribute() => throw null;

csharp/ql/test/resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.AspNetCore.Mvc.ViewFeatures.cs

@@ -6,6 +6,7 @@ namespace Microsoft
     {
         namespace Mvc
         {
+            [System.AttributeUsage((System.AttributeTargets)68, AllowMultiple = false, Inherited = true)]
             public class AutoValidateAntiforgeryTokenAttribute : System.Attribute, Microsoft.AspNetCore.Mvc.Filters.IFilterFactory, Microsoft.AspNetCore.Mvc.Filters.IFilterMetadata, Microsoft.AspNetCore.Mvc.Filters.IOrderedFilter
             {
                 public Microsoft.AspNetCore.Mvc.Filters.IFilterMetadata CreateInstance(System.IServiceProvider serviceProvider) => throw null;
@@ -130,6 +131,7 @@ namespace Microsoft
                     public string ViewName { get => throw null; }
                 }
             }
+            [System.AttributeUsage((System.AttributeTargets)68, AllowMultiple = false, Inherited = true)]
             public class IgnoreAntiforgeryTokenAttribute : System.Attribute, Microsoft.AspNetCore.Mvc.ViewFeatures.IAntiforgeryPolicy, Microsoft.AspNetCore.Mvc.Filters.IFilterMetadata, Microsoft.AspNetCore.Mvc.Filters.IOrderedFilter
             {
                 public IgnoreAntiforgeryTokenAttribute() => throw null;
@@ -165,6 +167,7 @@ namespace Microsoft
                 public Microsoft.AspNetCore.Mvc.ViewFeatures.HtmlHelperOptions HtmlHelperOptions { get => throw null; set { } }
                 public System.Collections.Generic.IList<Microsoft.AspNetCore.Mvc.ViewEngines.IViewEngine> ViewEngines { get => throw null; }
             }
+            [System.AttributeUsage((System.AttributeTargets)128, AllowMultiple = false, Inherited = true)]
             public class PageRemoteAttribute : Microsoft.AspNetCore.Mvc.RemoteAttributeBase
             {
                 public PageRemoteAttribute() => throw null;
@@ -184,6 +187,7 @@ namespace Microsoft
                 public Microsoft.AspNetCore.Mvc.ViewEngines.IViewEngine ViewEngine { get => throw null; set { } }
                 public string ViewName { get => throw null; set { } }
             }
+            [System.AttributeUsage((System.AttributeTargets)128, AllowMultiple = false, Inherited = true)]
             public class RemoteAttribute : Microsoft.AspNetCore.Mvc.RemoteAttributeBase
             {
                 protected RemoteAttribute() => throw null;
@@ -193,6 +197,7 @@ namespace Microsoft
                 protected override string GetUrl(Microsoft.AspNetCore.Mvc.ModelBinding.Validation.ClientModelValidationContext context) => throw null;
                 protected string RouteName { get => throw null; set { } }
             }
+            [System.AttributeUsage((System.AttributeTargets)128, AllowMultiple = false, Inherited = true)]
             public abstract class RemoteAttributeBase : System.ComponentModel.DataAnnotations.ValidationAttribute, Microsoft.AspNetCore.Mvc.ModelBinding.Validation.IClientModelValidator
             {
                 public string AdditionalFields { get => throw null; set { } }
@@ -608,17 +613,20 @@ namespace Microsoft
                     public System.IO.TextWriter Writer { get => throw null; set { } }
                 }
             }
+            [System.AttributeUsage((System.AttributeTargets)68, AllowMultiple = false, Inherited = true)]
             public class SkipStatusCodePagesAttribute : System.Attribute, Microsoft.AspNetCore.Mvc.Filters.IFilterMetadata, Microsoft.AspNetCore.Mvc.Filters.IResourceFilter, Microsoft.AspNetCore.Http.Metadata.ISkipStatusCodePagesMetadata
             {
                 public SkipStatusCodePagesAttribute() => throw null;
                 public void OnResourceExecuted(Microsoft.AspNetCore.Mvc.Filters.ResourceExecutedContext context) => throw null;
                 public void OnResourceExecuting(Microsoft.AspNetCore.Mvc.Filters.ResourceExecutingContext context) => throw null;
             }
+            [System.AttributeUsage((System.AttributeTargets)128, Inherited = true, AllowMultiple = false)]
             public sealed class TempDataAttribute : System.Attribute
             {
                 public TempDataAttribute() => throw null;
                 public string Key { get => throw null; set { } }
             }
+            [System.AttributeUsage((System.AttributeTargets)68, AllowMultiple = false, Inherited = true)]
             public class ValidateAntiForgeryTokenAttribute : System.Attribute, Microsoft.AspNetCore.Mvc.Filters.IFilterFactory, Microsoft.AspNetCore.Mvc.Filters.IFilterMetadata, Microsoft.AspNetCore.Mvc.Filters.IOrderedFilter
             {
                 public Microsoft.AspNetCore.Mvc.Filters.IFilterMetadata CreateInstance(System.IServiceProvider serviceProvider) => throw null;
@@ -648,6 +656,7 @@ namespace Microsoft
                 public Microsoft.AspNetCore.Mvc.ViewFeatures.ViewDataDictionary ViewData { get => throw null; }
                 public Microsoft.AspNetCore.Mvc.ViewEngines.ICompositeViewEngine ViewEngine { get => throw null; set { } }
             }
+            [System.AttributeUsage((System.AttributeTargets)4, AllowMultiple = false, Inherited = true)]
             public class ViewComponentAttribute : System.Attribute
             {
                 public ViewComponentAttribute() => throw null;
@@ -762,6 +771,7 @@ namespace Microsoft
                     public Microsoft.AspNetCore.Mvc.ViewFeatures.ViewDataDictionary ViewData { get => throw null; }
                     public System.IO.TextWriter Writer { get => throw null; }
                 }
+                [System.AttributeUsage((System.AttributeTargets)128, AllowMultiple = false, Inherited = true)]
                 public class ViewComponentContextAttribute : System.Attribute
                 {
                     public ViewComponentContextAttribute() => throw null;
@@ -811,6 +821,7 @@ namespace Microsoft
                     public string ViewName { get => throw null; set { } }
                 }
             }
+            [System.AttributeUsage((System.AttributeTargets)128, Inherited = true, AllowMultiple = false)]
             public sealed class ViewDataAttribute : System.Attribute
             {
                 public ViewDataAttribute() => throw null;
@@ -1212,6 +1223,7 @@ namespace Microsoft
                     public virtual Microsoft.AspNetCore.Mvc.ViewEngines.ViewEngineResult FindView(Microsoft.AspNetCore.Mvc.ActionContext actionContext, Microsoft.AspNetCore.Mvc.PartialViewResult viewResult) => throw null;
                     protected Microsoft.Extensions.Logging.ILogger Logger { get => throw null; }
                 }
+                [System.AttributeUsage((System.AttributeTargets)68, AllowMultiple = false, Inherited = true)]
                 public class SaveTempDataAttribute : System.Attribute, Microsoft.AspNetCore.Mvc.Filters.IFilterFactory, Microsoft.AspNetCore.Mvc.Filters.IFilterMetadata, Microsoft.AspNetCore.Mvc.Filters.IOrderedFilter
                 {
                     public Microsoft.AspNetCore.Mvc.Filters.IFilterMetadata CreateInstance(System.IServiceProvider serviceProvider) => throw null;
@@ -1288,6 +1300,7 @@ namespace Microsoft
                     public ViewComponentResultExecutor(Microsoft.Extensions.Options.IOptions<Microsoft.AspNetCore.Mvc.MvcViewOptions> mvcHelperOptions, Microsoft.Extensions.Logging.ILoggerFactory loggerFactory, System.Text.Encodings.Web.HtmlEncoder htmlEncoder, Microsoft.AspNetCore.Mvc.ModelBinding.IModelMetadataProvider modelMetadataProvider, Microsoft.AspNetCore.Mvc.ViewFeatures.ITempDataDictionaryFactory tempDataDictionaryFactory, Microsoft.AspNetCore.Mvc.Infrastructure.IHttpResponseStreamWriterFactory writerFactory) => throw null;
                     public virtual System.Threading.Tasks.Task ExecuteAsync(Microsoft.AspNetCore.Mvc.ActionContext context, Microsoft.AspNetCore.Mvc.ViewComponentResult result) => throw null;
                 }
+                [System.AttributeUsage((System.AttributeTargets)128, AllowMultiple = false, Inherited = true)]
                 public class ViewContextAttribute : System.Attribute
                 {
                     public ViewContextAttribute() => throw null;
@@ -1334,6 +1347,7 @@ namespace Microsoft
                     public ViewDataDictionary(Microsoft.AspNetCore.Mvc.ViewFeatures.ViewDataDictionary source, object model) : base(default(Microsoft.AspNetCore.Mvc.ViewFeatures.ViewDataDictionary)) => throw null;
                     public TModel Model { get => throw null; set { } }
                 }
+                [System.AttributeUsage((System.AttributeTargets)128, AllowMultiple = false, Inherited = true)]
                 public class ViewDataDictionaryAttribute : System.Attribute
                 {
                     public ViewDataDictionaryAttribute() => throw null;

csharp/ql/test/resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.AspNetCore.OutputCaching.cs

@@ -39,6 +39,7 @@ namespace Microsoft
                 System.Threading.Tasks.ValueTask<byte[]> GetAsync(string key, System.Threading.CancellationToken cancellationToken);
                 System.Threading.Tasks.ValueTask SetAsync(string key, byte[] value, string[] tags, System.TimeSpan validFor, System.Threading.CancellationToken cancellationToken);
             }
+            [System.AttributeUsage((System.AttributeTargets)68, AllowMultiple = false, Inherited = true)]
             public sealed class OutputCacheAttribute : System.Attribute
             {
                 public OutputCacheAttribute() => throw null;

csharp/ql/test/resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.AspNetCore.RateLimiting.cs

@@ -24,10 +24,12 @@ namespace Microsoft
         }
         namespace RateLimiting
         {
+            [System.AttributeUsage((System.AttributeTargets)68, AllowMultiple = false, Inherited = true)]
             public sealed class DisableRateLimitingAttribute : System.Attribute
             {
                 public DisableRateLimitingAttribute() => throw null;
             }
+            [System.AttributeUsage((System.AttributeTargets)68, AllowMultiple = false, Inherited = true)]
             public sealed class EnableRateLimitingAttribute : System.Attribute
             {
                 public EnableRateLimitingAttribute(string policyName) => throw null;

csharp/ql/test/resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.AspNetCore.Razor.Runtime.cs

@@ -22,6 +22,7 @@ namespace Microsoft
                     public abstract System.Collections.Generic.IReadOnlyList<object> Metadata { get; }
                     public abstract System.Type Type { get; }
                 }
+                [System.AttributeUsage((System.AttributeTargets)5, AllowMultiple = true, Inherited = false)]
                 public sealed class RazorCompiledItemAttribute : System.Attribute
                 {
                     public RazorCompiledItemAttribute(System.Type type, string kind, string identifier) => throw null;
@@ -40,28 +41,33 @@ namespace Microsoft
                     protected System.Collections.Generic.IEnumerable<Microsoft.AspNetCore.Razor.Hosting.RazorCompiledItemAttribute> LoadAttributes(System.Reflection.Assembly assembly) => throw null;
                     public virtual System.Collections.Generic.IReadOnlyList<Microsoft.AspNetCore.Razor.Hosting.RazorCompiledItem> LoadItems(System.Reflection.Assembly assembly) => throw null;
                 }
+                [System.AttributeUsage((System.AttributeTargets)4, AllowMultiple = true, Inherited = true)]
                 public sealed class RazorCompiledItemMetadataAttribute : System.Attribute
                 {
                     public RazorCompiledItemMetadataAttribute(string key, string value) => throw null;
                     public string Key { get => throw null; }
                     public string Value { get => throw null; }
                 }
+                [System.AttributeUsage((System.AttributeTargets)1, AllowMultiple = false, Inherited = false)]
                 public sealed class RazorConfigurationNameAttribute : System.Attribute
                 {
                     public string ConfigurationName { get => throw null; }
                     public RazorConfigurationNameAttribute(string configurationName) => throw null;
                 }
+                [System.AttributeUsage((System.AttributeTargets)1, AllowMultiple = true, Inherited = false)]
                 public sealed class RazorExtensionAssemblyNameAttribute : System.Attribute
                 {
                     public string AssemblyName { get => throw null; }
                     public RazorExtensionAssemblyNameAttribute(string extensionName, string assemblyName) => throw null;
                     public string ExtensionName { get => throw null; }
                 }
+                [System.AttributeUsage((System.AttributeTargets)1, AllowMultiple = false, Inherited = false)]
                 public sealed class RazorLanguageVersionAttribute : System.Attribute
                 {
                     public RazorLanguageVersionAttribute(string languageVersion) => throw null;
                     public string LanguageVersion { get => throw null; }
                 }
+                [System.AttributeUsage((System.AttributeTargets)4, AllowMultiple = true, Inherited = true)]
                 public sealed class RazorSourceChecksumAttribute : System.Attribute, Microsoft.AspNetCore.Razor.Hosting.IRazorSourceChecksumMetadata
                 {
                     public string Checksum { get => throw null; }

csharp/ql/test/resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.AspNetCore.Razor.cs

@@ -24,6 +24,7 @@ namespace Microsoft
                     public override void Reinitialize() => throw null;
                     public override void WriteTo(System.IO.TextWriter writer, System.Text.Encodings.Web.HtmlEncoder encoder) => throw null;
                 }
+                [System.AttributeUsage((System.AttributeTargets)128, AllowMultiple = false, Inherited = false)]
                 public sealed class HtmlAttributeNameAttribute : System.Attribute
                 {
                     public HtmlAttributeNameAttribute() => throw null;
@@ -32,6 +33,7 @@ namespace Microsoft
                     public bool DictionaryAttributePrefixSet { get => throw null; }
                     public string Name { get => throw null; }
                 }
+                [System.AttributeUsage((System.AttributeTargets)128, AllowMultiple = false, Inherited = false)]
                 public sealed class HtmlAttributeNotBoundAttribute : System.Attribute
                 {
                     public HtmlAttributeNotBoundAttribute() => throw null;
@@ -43,6 +45,7 @@ namespace Microsoft
                     NoQuotes = 2,
                     Minimized = 3,
                 }
+                [System.AttributeUsage((System.AttributeTargets)4, AllowMultiple = true, Inherited = false)]
                 public sealed class HtmlTargetElementAttribute : System.Attribute
                 {
                     public string Attributes { get => throw null; set { } }
@@ -73,6 +76,7 @@ namespace Microsoft
                     public override unsafe bool TryEncodeUnicodeScalar(int unicodeScalar, char* buffer, int bufferLength, out int numberOfCharactersWritten) => throw null;
                     public override bool WillEncode(int unicodeScalar) => throw null;
                 }
+                [System.AttributeUsage((System.AttributeTargets)4, AllowMultiple = false, Inherited = false)]
                 public sealed class OutputElementHintAttribute : System.Attribute
                 {
                     public OutputElementHintAttribute(string outputElement) => throw null;
@@ -89,6 +93,7 @@ namespace Microsoft
                     public bool TryGetAttribute(string name, out Microsoft.AspNetCore.Razor.TagHelpers.TagHelperAttribute attribute) => throw null;
                     public bool TryGetAttributes(string name, out System.Collections.Generic.IReadOnlyList<Microsoft.AspNetCore.Razor.TagHelpers.TagHelperAttribute> attributes) => throw null;
                 }
+                [System.AttributeUsage((System.AttributeTargets)4, Inherited = false, AllowMultiple = false)]
                 public sealed class RestrictChildrenAttribute : System.Attribute
                 {
                     public System.Collections.Generic.IEnumerable<string> ChildTags { get => throw null; }

csharp/ql/test/resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.AspNetCore.Routing.cs

@@ -291,11 +291,13 @@ namespace Microsoft
                 public abstract Microsoft.Extensions.Primitives.IChangeToken GetChangeToken();
                 public virtual System.Collections.Generic.IReadOnlyList<Microsoft.AspNetCore.Http.Endpoint> GetGroupedEndpoints(Microsoft.AspNetCore.Routing.RouteGroupContext context) => throw null;
             }
+            [System.AttributeUsage((System.AttributeTargets)4164, Inherited = false, AllowMultiple = false)]
             public sealed class EndpointGroupNameAttribute : System.Attribute, Microsoft.AspNetCore.Routing.IEndpointGroupNameMetadata
             {
                 public EndpointGroupNameAttribute(string endpointGroupName) => throw null;
                 public string EndpointGroupName { get => throw null; }
             }
+            [System.AttributeUsage((System.AttributeTargets)4160, Inherited = false, AllowMultiple = false)]
             public sealed class EndpointNameAttribute : System.Attribute, Microsoft.AspNetCore.Routing.IEndpointNameMetadata
             {
                 public EndpointNameAttribute(string endpointName) => throw null;
@@ -306,11 +308,13 @@ namespace Microsoft
                 public EndpointNameMetadata(string endpointName) => throw null;
                 public string EndpointName { get => throw null; }
             }
+            [System.AttributeUsage((System.AttributeTargets)4164, AllowMultiple = false, Inherited = true)]
             public sealed class ExcludeFromDescriptionAttribute : System.Attribute, Microsoft.AspNetCore.Routing.IExcludeFromDescriptionMetadata
             {
                 public ExcludeFromDescriptionAttribute() => throw null;
                 public bool ExcludeFromDescription { get => throw null; }
             }
+            [System.AttributeUsage((System.AttributeTargets)68, AllowMultiple = false, Inherited = false)]
             public sealed class HostAttribute : System.Attribute, Microsoft.AspNetCore.Routing.IHostMetadata
             {
                 public HostAttribute(string host) => throw null;

csharp/ql/test/resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.AspNetCore.SignalR.Core.cs

@@ -240,6 +240,7 @@ namespace Microsoft
                 public HubMetadata(System.Type hubType) => throw null;
                 public System.Type HubType { get => throw null; }
             }
+            [System.AttributeUsage((System.AttributeTargets)64, AllowMultiple = false, Inherited = true)]
             public class HubMethodNameAttribute : System.Attribute
             {
                 public HubMethodNameAttribute(string name) => throw null;

csharp/ql/test/resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.Extensions.Configuration.Abstractions.cs

@@ -23,6 +23,7 @@ namespace Microsoft
                 public static string GetConnectionString(this Microsoft.Extensions.Configuration.IConfiguration configuration, string name) => throw null;
                 public static Microsoft.Extensions.Configuration.IConfigurationSection GetRequiredSection(this Microsoft.Extensions.Configuration.IConfiguration configuration, string key) => throw null;
             }
+            [System.AttributeUsage((System.AttributeTargets)128)]
             public sealed class ConfigurationKeyNameAttribute : System.Attribute
             {
                 public ConfigurationKeyNameAttribute(string name) => throw null;

csharp/ql/test/resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.Extensions.Configuration.UserSecrets.cs

@@ -13,6 +13,7 @@ namespace Microsoft
                     public PathHelper() => throw null;
                     public static string GetSecretsPathFromSecretsId(string userSecretsId) => throw null;
                 }
+                [System.AttributeUsage((System.AttributeTargets)1, Inherited = false, AllowMultiple = false)]
                 public class UserSecretsIdAttribute : System.Attribute
                 {
                     public UserSecretsIdAttribute(string userSecretId) => throw null;

csharp/ql/test/resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.Extensions.DependencyInjection.Abstractions.cs

@@ -14,6 +14,7 @@ namespace Microsoft
                 public static object GetServiceOrCreateInstance(System.IServiceProvider provider, System.Type type) => throw null;
                 public static T GetServiceOrCreateInstance<T>(System.IServiceProvider provider) => throw null;
             }
+            [System.AttributeUsage((System.AttributeTargets)32767)]
             public class ActivatorUtilitiesConstructorAttribute : System.Attribute
             {
                 public ActivatorUtilitiesConstructorAttribute() => throw null;

csharp/ql/test/resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.Extensions.Identity.Core.cs

@@ -341,6 +341,7 @@ namespace Microsoft
                 Success = 1,
                 SuccessRehashNeeded = 2,
             }
+            [System.AttributeUsage((System.AttributeTargets)128)]
             public class PersonalDataAttribute : System.Attribute
             {
                 public PersonalDataAttribute() => throw null;

csharp/ql/test/resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.Extensions.Localization.cs

@@ -23,6 +23,7 @@ namespace Microsoft
                 public LocalizationOptions() => throw null;
                 public string ResourcesPath { get => throw null; set { } }
             }
+            [System.AttributeUsage((System.AttributeTargets)1, AllowMultiple = false, Inherited = false)]
             public class ResourceLocationAttribute : System.Attribute
             {
                 public ResourceLocationAttribute(string resourceLocation) => throw null;
@@ -55,6 +56,7 @@ namespace Microsoft
                 public ResourceNamesCache() => throw null;
                 public System.Collections.Generic.IList<string> GetOrAdd(string name, System.Func<string, System.Collections.Generic.IList<string>> valueFactory) => throw null;
             }
+            [System.AttributeUsage((System.AttributeTargets)1, AllowMultiple = false, Inherited = false)]
             public class RootNamespaceAttribute : System.Attribute
             {
                 public RootNamespaceAttribute(string rootNamespace) => throw null;

csharp/ql/test/resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.Extensions.Logging.Abstractions.cs

@@ -167,6 +167,7 @@ namespace Microsoft
                 public static System.Func<Microsoft.Extensions.Logging.ILogger, T1, T2, T3, T4, T5, System.IDisposable> DefineScope<T1, T2, T3, T4, T5>(string formatString) => throw null;
                 public static System.Func<Microsoft.Extensions.Logging.ILogger, T1, T2, T3, T4, T5, T6, System.IDisposable> DefineScope<T1, T2, T3, T4, T5, T6>(string formatString) => throw null;
             }
+            [System.AttributeUsage((System.AttributeTargets)64)]
             public sealed class LoggerMessageAttribute : System.Attribute
             {
                 public LoggerMessageAttribute() => throw null;

csharp/ql/test/resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.Extensions.Logging.cs

@@ -93,6 +93,7 @@ namespace Microsoft
                 public static Microsoft.Extensions.Logging.ILoggingBuilder Configure(this Microsoft.Extensions.Logging.ILoggingBuilder builder, System.Action<Microsoft.Extensions.Logging.LoggerFactoryOptions> action) => throw null;
                 public static Microsoft.Extensions.Logging.ILoggingBuilder SetMinimumLevel(this Microsoft.Extensions.Logging.ILoggingBuilder builder, Microsoft.Extensions.Logging.LogLevel level) => throw null;
             }
+            [System.AttributeUsage((System.AttributeTargets)4, AllowMultiple = false, Inherited = false)]
             public class ProviderAliasAttribute : System.Attribute
             {
                 public string Alias { get => throw null; }

csharp/ql/test/resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.JSInterop.cs

@@ -145,6 +145,7 @@ namespace Microsoft
         {
             public static void InvokeVoid(this Microsoft.JSInterop.IJSInProcessRuntime jsRuntime, string identifier, params object[] args) => throw null;
         }
+        [System.AttributeUsage((System.AttributeTargets)64, AllowMultiple = true)]
         public sealed class JSInvokableAttribute : System.Attribute
         {
             public JSInvokableAttribute() => throw null;

csharp/ql/test/resources/stubs/_frameworks/Microsoft.NETCore.App/Microsoft.VisualBasic.Core.cs

@@ -49,6 +49,7 @@ namespace Microsoft
             public object this[object Index] { get => throw null; }
             public object this[string Key] { get => throw null; }
         }
+        [System.AttributeUsage((System.AttributeTargets)4, Inherited = false, AllowMultiple = false)]
         public sealed class ComClassAttribute : System.Attribute
         {
             public string ClassID { get => throw null; }
@@ -158,6 +159,7 @@ namespace Microsoft
                 public static decimal FromString(string Value, System.Globalization.NumberFormatInfo NumberFormat) => throw null;
                 public static decimal Parse(string Value, System.Globalization.NumberFormatInfo NumberFormat) => throw null;
             }
+            [System.AttributeUsage((System.AttributeTargets)4, AllowMultiple = false, Inherited = false)]
             public sealed class DesignerGeneratedAttribute : System.Attribute
             {
                 public DesignerGeneratedAttribute() => throw null;
@@ -290,10 +292,12 @@ namespace Microsoft
                 public static object SubtractObject(object Left, object Right) => throw null;
                 public static object XorObject(object Left, object Right) => throw null;
             }
+            [System.AttributeUsage((System.AttributeTargets)2048, Inherited = false, AllowMultiple = false)]
             public sealed class OptionCompareAttribute : System.Attribute
             {
                 public OptionCompareAttribute() => throw null;
             }
+            [System.AttributeUsage((System.AttributeTargets)4, Inherited = false, AllowMultiple = false)]
             public sealed class OptionTextAttribute : System.Attribute
             {
                 public OptionTextAttribute() => throw null;
@@ -318,6 +322,7 @@ namespace Microsoft
                 public static float FromString(string Value) => throw null;
                 public static float FromString(string Value, System.Globalization.NumberFormatInfo NumberFormat) => throw null;
             }
+            [System.AttributeUsage((System.AttributeTargets)4, Inherited = false, AllowMultiple = false)]
             public sealed class StandardModuleAttribute : System.Attribute
             {
                 public StandardModuleAttribute() => throw null;
@@ -870,6 +875,7 @@ namespace Microsoft
             FirstFourDays = 2,
             FirstFullWeek = 3,
         }
+        [System.AttributeUsage((System.AttributeTargets)4, AllowMultiple = false, Inherited = false)]
         public sealed class HideModuleNameAttribute : System.Attribute
         {
             public HideModuleNameAttribute() => throw null;
@@ -950,6 +956,7 @@ namespace Microsoft
             MsgBoxRight = 524288,
             MsgBoxRtlReading = 1048576,
         }
+        [System.AttributeUsage((System.AttributeTargets)4, AllowMultiple = false, Inherited = false)]
         public sealed class MyGroupCollectionAttribute : System.Attribute
         {
             public string CreateMethod { get => throw null; }
@@ -1078,6 +1085,7 @@ namespace Microsoft
             UserDefinedType = 36,
             Array = 8192,
         }
+        [System.AttributeUsage((System.AttributeTargets)256, Inherited = false, AllowMultiple = false)]
         public sealed class VBFixedArrayAttribute : System.Attribute
         {
             public int[] Bounds { get => throw null; }
@@ -1085,6 +1093,7 @@ namespace Microsoft
             public VBFixedArrayAttribute(int UpperBound1, int UpperBound2) => throw null;
             public int Length { get => throw null; }
         }
+        [System.AttributeUsage((System.AttributeTargets)256, Inherited = false, AllowMultiple = false)]
         public sealed class VBFixedStringAttribute : System.Attribute
         {
             public VBFixedStringAttribute(int Length) => throw null;

csharp/ql/test/resources/stubs/_frameworks/Microsoft.NETCore.App/System.ComponentModel.Annotations.cs

@@ -12,6 +12,7 @@ namespace System
                 public AssociatedMetadataTypeTypeDescriptionProvider(System.Type type, System.Type associatedMetadataType) => throw null;
                 public override System.ComponentModel.ICustomTypeDescriptor GetTypeDescriptor(System.Type objectType, object instance) => throw null;
             }
+            [System.AttributeUsage((System.AttributeTargets)384, AllowMultiple = false, Inherited = true)]
             public sealed class AssociationAttribute : System.Attribute
             {
                 public AssociationAttribute(string name, string thisKey, string otherKey) => throw null;
@@ -22,6 +23,7 @@ namespace System
                 public string ThisKey { get => throw null; }
                 public System.Collections.Generic.IEnumerable<string> ThisKeyMembers { get => throw null; }
             }
+            [System.AttributeUsage((System.AttributeTargets)128, AllowMultiple = false)]
             public class CompareAttribute : System.ComponentModel.DataAnnotations.ValidationAttribute
             {
                 public CompareAttribute(string otherProperty) => throw null;
@@ -31,15 +33,18 @@ namespace System
                 public string OtherPropertyDisplayName { get => throw null; }
                 public override bool RequiresValidationContext { get => throw null; }
             }
+            [System.AttributeUsage((System.AttributeTargets)384, AllowMultiple = false, Inherited = true)]
             public sealed class ConcurrencyCheckAttribute : System.Attribute
             {
                 public ConcurrencyCheckAttribute() => throw null;
             }
+            [System.AttributeUsage((System.AttributeTargets)2432, AllowMultiple = false)]
             public sealed class CreditCardAttribute : System.ComponentModel.DataAnnotations.DataTypeAttribute
             {
                 public CreditCardAttribute() : base(default(System.ComponentModel.DataAnnotations.DataType)) => throw null;
                 public override bool IsValid(object value) => throw null;
             }
+            [System.AttributeUsage((System.AttributeTargets)2500, AllowMultiple = true)]
             public sealed class CustomValidationAttribute : System.ComponentModel.DataAnnotations.ValidationAttribute
             {
                 public CustomValidationAttribute(System.Type validatorType, string method) => throw null;
@@ -68,6 +73,7 @@ namespace System
                 PostalCode = 15,
                 Upload = 16,
             }
+            [System.AttributeUsage((System.AttributeTargets)2496, AllowMultiple = false)]
             public class DataTypeAttribute : System.ComponentModel.DataAnnotations.ValidationAttribute
             {
                 public DataTypeAttribute(System.ComponentModel.DataAnnotations.DataType dataType) => throw null;
@@ -78,6 +84,7 @@ namespace System
                 public virtual string GetDataTypeName() => throw null;
                 public override bool IsValid(object value) => throw null;
             }
+            [System.AttributeUsage((System.AttributeTargets)2500, AllowMultiple = false)]
             public sealed class DisplayAttribute : System.Attribute
             {
                 public bool AutoGenerateField { get => throw null; set { } }
@@ -99,6 +106,7 @@ namespace System
                 public System.Type ResourceType { get => throw null; set { } }
                 public string ShortName { get => throw null; set { } }
             }
+            [System.AttributeUsage((System.AttributeTargets)4, Inherited = true, AllowMultiple = false)]
             public class DisplayColumnAttribute : System.Attribute
             {
                 public DisplayColumnAttribute(string displayColumn) => throw null;
@@ -108,6 +116,7 @@ namespace System
                 public string SortColumn { get => throw null; }
                 public bool SortDescending { get => throw null; }
             }
+            [System.AttributeUsage((System.AttributeTargets)384, AllowMultiple = false)]
             public class DisplayFormatAttribute : System.Attribute
             {
                 public bool ApplyFormatInEditMode { get => throw null; set { } }
@@ -119,23 +128,27 @@ namespace System
                 public string NullDisplayText { get => throw null; set { } }
                 public System.Type NullDisplayTextResourceType { get => throw null; set { } }
             }
+            [System.AttributeUsage((System.AttributeTargets)384, AllowMultiple = false, Inherited = true)]
             public sealed class EditableAttribute : System.Attribute
             {
                 public bool AllowEdit { get => throw null; }
                 public bool AllowInitialValue { get => throw null; set { } }
                 public EditableAttribute(bool allowEdit) => throw null;
             }
+            [System.AttributeUsage((System.AttributeTargets)2432, AllowMultiple = false)]
             public sealed class EmailAddressAttribute : System.ComponentModel.DataAnnotations.DataTypeAttribute
             {
                 public EmailAddressAttribute() : base(default(System.ComponentModel.DataAnnotations.DataType)) => throw null;
                 public override bool IsValid(object value) => throw null;
             }
+            [System.AttributeUsage((System.AttributeTargets)2496, AllowMultiple = false)]
             public sealed class EnumDataTypeAttribute : System.ComponentModel.DataAnnotations.DataTypeAttribute
             {
                 public EnumDataTypeAttribute(System.Type enumType) : base(default(System.ComponentModel.DataAnnotations.DataType)) => throw null;
                 public System.Type EnumType { get => throw null; }
                 public override bool IsValid(object value) => throw null;
             }
+            [System.AttributeUsage((System.AttributeTargets)2432, AllowMultiple = false)]
             public sealed class FileExtensionsAttribute : System.ComponentModel.DataAnnotations.DataTypeAttribute
             {
                 public FileExtensionsAttribute() : base(default(System.ComponentModel.DataAnnotations.DataType)) => throw null;
@@ -143,6 +156,7 @@ namespace System
                 public override string FormatErrorMessage(string name) => throw null;
                 public override bool IsValid(object value) => throw null;
             }
+            [System.AttributeUsage((System.AttributeTargets)384, AllowMultiple = false)]
             public sealed class FilterUIHintAttribute : System.Attribute
             {
                 public System.Collections.Generic.IDictionary<string, object> ControlParameters { get => throw null; }
@@ -158,10 +172,12 @@ namespace System
             {
                 System.Collections.Generic.IEnumerable<System.ComponentModel.DataAnnotations.ValidationResult> Validate(System.ComponentModel.DataAnnotations.ValidationContext validationContext);
             }
+            [System.AttributeUsage((System.AttributeTargets)384, AllowMultiple = false, Inherited = true)]
             public sealed class KeyAttribute : System.Attribute
             {
                 public KeyAttribute() => throw null;
             }
+            [System.AttributeUsage((System.AttributeTargets)2432, AllowMultiple = false)]
             public class MaxLengthAttribute : System.ComponentModel.DataAnnotations.ValidationAttribute
             {
                 public MaxLengthAttribute() => throw null;
@@ -170,11 +186,13 @@ namespace System
                 public override bool IsValid(object value) => throw null;
                 public int Length { get => throw null; }
             }
+            [System.AttributeUsage((System.AttributeTargets)4, AllowMultiple = false)]
             public sealed class MetadataTypeAttribute : System.Attribute
             {
                 public MetadataTypeAttribute(System.Type metadataClassType) => throw null;
                 public System.Type MetadataClassType { get => throw null; }
             }
+            [System.AttributeUsage((System.AttributeTargets)2432, AllowMultiple = false)]
             public class MinLengthAttribute : System.ComponentModel.DataAnnotations.ValidationAttribute
             {
                 public MinLengthAttribute(int length) => throw null;
@@ -182,11 +200,13 @@ namespace System
                 public override bool IsValid(object value) => throw null;
                 public int Length { get => throw null; }
             }
+            [System.AttributeUsage((System.AttributeTargets)2432, AllowMultiple = false)]
             public sealed class PhoneAttribute : System.ComponentModel.DataAnnotations.DataTypeAttribute
             {
                 public PhoneAttribute() : base(default(System.ComponentModel.DataAnnotations.DataType)) => throw null;
                 public override bool IsValid(object value) => throw null;
             }
+            [System.AttributeUsage((System.AttributeTargets)2432, AllowMultiple = false)]
             public class RangeAttribute : System.ComponentModel.DataAnnotations.ValidationAttribute
             {
                 public bool ConvertValueInInvariantCulture { get => throw null; set { } }
@@ -200,6 +220,7 @@ namespace System
                 public System.Type OperandType { get => throw null; }
                 public bool ParseLimitsInInvariantCulture { get => throw null; set { } }
             }
+            [System.AttributeUsage((System.AttributeTargets)2432, AllowMultiple = false)]
             public class RegularExpressionAttribute : System.ComponentModel.DataAnnotations.ValidationAttribute
             {
                 public RegularExpressionAttribute(string pattern) => throw null;
@@ -209,12 +230,14 @@ namespace System
                 public int MatchTimeoutInMilliseconds { get => throw null; set { } }
                 public string Pattern { get => throw null; }
             }
+            [System.AttributeUsage((System.AttributeTargets)2432, AllowMultiple = false)]
             public class RequiredAttribute : System.ComponentModel.DataAnnotations.ValidationAttribute
             {
                 public bool AllowEmptyStrings { get => throw null; set { } }
                 public RequiredAttribute() => throw null;
                 public override bool IsValid(object value) => throw null;
             }
+            [System.AttributeUsage((System.AttributeTargets)384, AllowMultiple = false)]
             public class ScaffoldColumnAttribute : System.Attribute
             {
                 public ScaffoldColumnAttribute(bool scaffold) => throw null;
@@ -222,6 +245,7 @@ namespace System
             }
             namespace Schema
             {
+                [System.AttributeUsage((System.AttributeTargets)384, AllowMultiple = false)]
                 public class ColumnAttribute : System.Attribute
                 {
                     public ColumnAttribute() => throw null;
@@ -230,10 +254,12 @@ namespace System
                     public int Order { get => throw null; set { } }
                     public string TypeName { get => throw null; set { } }
                 }
+                [System.AttributeUsage((System.AttributeTargets)4, AllowMultiple = false)]
                 public class ComplexTypeAttribute : System.Attribute
                 {
                     public ComplexTypeAttribute() => throw null;
                 }
+                [System.AttributeUsage((System.AttributeTargets)384, AllowMultiple = false)]
                 public class DatabaseGeneratedAttribute : System.Attribute
                 {
                     public DatabaseGeneratedAttribute(System.ComponentModel.DataAnnotations.Schema.DatabaseGeneratedOption databaseGeneratedOption) => throw null;
@@ -245,20 +271,24 @@ namespace System
                     Identity = 1,
                     Computed = 2,
                 }
+                [System.AttributeUsage((System.AttributeTargets)384, AllowMultiple = false)]
                 public class ForeignKeyAttribute : System.Attribute
                 {
                     public ForeignKeyAttribute(string name) => throw null;
                     public string Name { get => throw null; }
                 }
+                [System.AttributeUsage((System.AttributeTargets)384, AllowMultiple = false)]
                 public class InversePropertyAttribute : System.Attribute
                 {
                     public InversePropertyAttribute(string property) => throw null;
                     public string Property { get => throw null; }
                 }
+                [System.AttributeUsage((System.AttributeTargets)388, AllowMultiple = false)]
                 public class NotMappedAttribute : System.Attribute
                 {
                     public NotMappedAttribute() => throw null;
                 }
+                [System.AttributeUsage((System.AttributeTargets)4, AllowMultiple = false)]
                 public class TableAttribute : System.Attribute
                 {
                     public TableAttribute(string name) => throw null;
@@ -266,6 +296,7 @@ namespace System
                     public string Schema { get => throw null; set { } }
                 }
             }
+            [System.AttributeUsage((System.AttributeTargets)2432, AllowMultiple = false)]
             public class StringLengthAttribute : System.ComponentModel.DataAnnotations.ValidationAttribute
             {
                 public StringLengthAttribute(int maximumLength) => throw null;
@@ -274,10 +305,12 @@ namespace System
                 public int MaximumLength { get => throw null; }
                 public int MinimumLength { get => throw null; set { } }
             }
+            [System.AttributeUsage((System.AttributeTargets)384, AllowMultiple = false, Inherited = true)]
             public sealed class TimestampAttribute : System.Attribute
             {
                 public TimestampAttribute() => throw null;
             }
+            [System.AttributeUsage((System.AttributeTargets)384, AllowMultiple = true)]
             public class UIHintAttribute : System.Attribute
             {
                 public System.Collections.Generic.IDictionary<string, object> ControlParameters { get => throw null; }
@@ -289,6 +322,7 @@ namespace System
                 public string PresentationLayer { get => throw null; }
                 public string UIHint { get => throw null; }
             }
+            [System.AttributeUsage((System.AttributeTargets)2432, AllowMultiple = false)]
             public sealed class UrlAttribute : System.ComponentModel.DataAnnotations.DataTypeAttribute
             {
                 public UrlAttribute() : base(default(System.ComponentModel.DataAnnotations.DataType)) => throw null;