C#: Type-based pruning for data flow

csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll

@@ -7,6 +7,7 @@ private import DataFlowImplCommon::Public
 private import ControlFlowReachability
 private import DelegateDataFlow
 private import semmle.code.csharp.Caching
+private import semmle.code.csharp.Conversion
 private import semmle.code.csharp.ExprOrStmtParent
 private import semmle.code.csharp.Unification
 private import semmle.code.csharp.controlflow.Guards
@@ -325,6 +326,23 @@ private Type getCSharpType(DotNet::Type t) {
   result.matchesHandle(t)
 }
 
+pragma[noinline]
+private TypeParameter getATypeParameterSubType(DataFlowType t) {
+  not t instanceof Gvn::TypeParameterGvnType and
+  exists(Type t0 | t = Gvn::getGlobalValueNumber(t0) | implicitConversionRestricted(result, t0))
+}
+
+pragma[noinline]
+private DataFlowType getANonTypeParameterSubType(DataFlowType t) {
+  not t instanceof Gvn::TypeParameterGvnType and
+  not result instanceof Gvn::TypeParameterGvnType and
+  exists(Type t1, Type t2 |
+    implicitConversionRestricted(t1, t2) and
+    result = Gvn::getGlobalValueNumber(t1) and
+    t = Gvn::getGlobalValueNumber(t2)
+  )
+}
+
 /** A collection of cached types and predicates to be evaluated in the same stage. */
 cached
 private module Cached {
@@ -486,6 +504,28 @@ private module Cached {
       t0 instanceof ObjectType
     )
   }
+
+  /**
+   * Holds if GVNs `t1` and `t2` may have a common sub type. Neither `t1` nor
+   * `t2` are allowed to be type parameters.
+   */
+  cached
+  predicate commonSubType(DataFlowType t1, DataFlowType t2) {
+    not t1 instanceof Gvn::TypeParameterGvnType and
+    t1 = t2
+    or
+    getATypeParameterSubType(t1) = getATypeParameterSubType(t2)
+    or
+    getANonTypeParameterSubType(t1) = getANonTypeParameterSubType(t2)
+  }
+
+  cached
+  predicate commonSubTypeUnifiableLeft(DataFlowType t1, DataFlowType t2) {
+    exists(DataFlowType t |
+      Gvn::unifiable(t1, t) and
+      commonSubType(t, t2)
+    )
+  }
 }
 
 import Cached
@@ -596,7 +636,11 @@ private module ParameterNodes {
       result = this.getUnderlyingNode().getEnclosingCallable()
     }
 
-    override Type getType() { result = this.getUnderlyingNode().getType() }
+    override Type getType() {
+      // Taint tracking steps are allowed to change the type of the tracked object,
+      // so `result = this.getUnderlyingNode().getType()` is too restrictive
+      result instanceof ObjectType
+    }
 
     override Location getLocation() { result = this.getUnderlyingNode().getLocation() }
 
@@ -939,7 +983,9 @@ private module ReturnNodes {
       result = this.getUnderlyingNode().getEnclosingCallable()
     }
 
-    override Type getType() { result = this.getUnderlyingNode().getType() }
+    override Type getType() {
+      result = this.getUnderlyingNode().getEnclosingCallable().getReturnType()
+    }
 
     override Location getLocation() { result = this.getUnderlyingNode().getLocation() }
 
@@ -1130,7 +1176,11 @@ private module OutNodes {
 
     override Callable getEnclosingCallable() { result = cfn.getEnclosingCallable() }
 
-    override Type getType() { result = cfn.getElement().(Expr).getType() }
+    override Type getType() {
+      exists(ImplicitDelegateDataFlowCall c | c.getNode() = this |
+        result = c.getDelegateReturnType()
+      )
+    }
 
     override Location getLocation() { result = cfn.getLocation() }
 
@@ -1329,15 +1379,34 @@ predicate readStep = readStepImpl/3;
 /** Gets a string representation of a type returned by `getErasedRepr`. */
 string ppReprType(DataFlowType t) { result = t.toString() }
 
+private class DataFlowNullType extends DataFlowType {
+  DataFlowNullType() { this = Gvn::getGlobalValueNumber(any(NullType nt)) }
+
+  pragma[noinline]
+  predicate isConvertibleTo(DataFlowType t) {
+    defaultNullConversion(_, any(Type t0 | t = Gvn::getGlobalValueNumber(t0)))
+  }
+}
+
 /**
  * Holds if `t1` and `t2` are compatible, that is, whether data can flow from
  * a node of type `t1` to a node of type `t2`.
- *
- * Type-based pruning is disabled for now, so this is a stub implementation.
  */
-bindingset[t1, t2]
+pragma[inline]
 predicate compatibleTypes(DataFlowType t1, DataFlowType t2) {
-  any() // stub implementation
+  commonSubType(t1, t2)
+  or
+  commonSubTypeUnifiableLeft(t1, t2)
+  or
+  commonSubTypeUnifiableLeft(t2, t1)
+  or
+  t1.(DataFlowNullType).isConvertibleTo(t2)
+  or
+  t2.(DataFlowNullType).isConvertibleTo(t1)
+  or
+  t1 instanceof Gvn::TypeParameterGvnType
+  or
+  t2 instanceof Gvn::TypeParameterGvnType
 }
 
 /**
@@ -1384,8 +1453,19 @@ private module PostUpdateNodes {
 private import PostUpdateNodes
 
 /** A node that performs a type cast. */
-class CastNode extends ExprNode {
+class CastNode extends Node {
-  CastNode() { this.getExpr() instanceof CastExpr }
+  CastNode() {
+    this.asExpr() instanceof Cast
+    or
+    exists(Ssa::ExplicitDefinition def |
+      def = this.(SsaDefinitionNode).getDefinition() and
+      def.getADefinition() instanceof AssignableDefinitions::PatternDefinition
+    )
+    or
+    readStep(_, _, this)
+    or
+    storeStep(this, _, _)
+  }
 }
 
 class DataFlowExpr = DotNet::Expr;

csharp/ql/test/library-tests/dataflow/fields/A.cs

@@ -74,7 +74,7 @@ public class A
         }
         if (cc is C1)
         {
-            Sink(((C1)cc).a); // no flow, stopped by cast to C2 (FALSE POSITIVE, no type pruning yet)
+            Sink(((C1)cc).a); // no flow, stopped by cast to C2
         }
     }
 

csharp/ql/test/library-tests/dataflow/fields/FieldFlow.expected

@@ -19,10 +19,7 @@ edges
 | A.cs:57:16:57:16 | access to local variable a : A | A.cs:57:9:57:10 | [post] access to local variable c1 [a] : A |
 | A.cs:58:12:58:13 | access to local variable c1 [a] : A | A.cs:60:22:60:22 | c [a] : A |
 | A.cs:60:22:60:22 | c [a] : A | A.cs:64:19:64:23 | (...) ... [a] : A |
-| A.cs:60:22:60:22 | c [a] : A | A.cs:69:18:69:22 | (...) ... [a] : A |
 | A.cs:64:19:64:23 | (...) ... [a] : A | A.cs:64:18:64:26 | access to field a |
-| A.cs:69:18:69:22 | (...) ... [a] : A | A.cs:77:19:77:24 | (...) ... [a] : A |
-| A.cs:77:19:77:24 | (...) ... [a] : A | A.cs:77:18:77:27 | access to field a |
 | A.cs:83:9:83:9 | [post] access to parameter b [c] : C | A.cs:88:12:88:12 | [post] access to local variable b [c] : C |
 | A.cs:83:15:83:21 | object creation of type C : C | A.cs:83:9:83:9 | [post] access to parameter b [c] : C |
 | A.cs:88:12:88:12 | [post] access to local variable b [c] : C | A.cs:89:14:89:14 | access to local variable b [c] : C |
@@ -131,7 +128,6 @@ edges
 | F.cs:10:17:10:28 | object creation of type Object : Object | F.cs:11:24:11:24 | access to local variable o : Object |
 | F.cs:10:17:10:28 | object creation of type Object : Object | F.cs:15:26:15:26 | access to local variable o : Object |
 | F.cs:10:17:10:28 | object creation of type Object : Object | F.cs:19:32:19:32 | access to local variable o : Object |
-| F.cs:10:17:10:28 | object creation of type Object : Object | F.cs:23:32:23:32 | access to local variable o : Object |
 | F.cs:11:17:11:31 | call to method Create [Field1] : Object | F.cs:12:14:12:14 | access to local variable f [Field1] : Object |
 | F.cs:11:24:11:24 | access to local variable o : Object | F.cs:11:17:11:31 | call to method Create [Field1] : Object |
 | F.cs:12:14:12:14 | access to local variable f [Field1] : Object | F.cs:12:14:12:21 | access to field Field1 |
@@ -140,6 +136,7 @@ edges
 | F.cs:17:14:17:14 | access to local variable f [Field2] : Object | F.cs:17:14:17:21 | access to field Field2 |
 | F.cs:19:13:19:34 | object creation of type F [Field1] : Object | F.cs:20:14:20:14 | access to local variable f [Field1] : Object |
 | F.cs:19:32:19:32 | access to local variable o : Object | F.cs:19:13:19:34 | object creation of type F [Field1] : Object |
+| F.cs:19:32:19:32 | access to local variable o : Object | F.cs:23:32:23:32 | access to local variable o : Object |
 | F.cs:20:14:20:14 | access to local variable f [Field1] : Object | F.cs:20:14:20:21 | access to field Field1 |
 | F.cs:23:13:23:34 | object creation of type F [Field2] : Object | F.cs:25:14:25:14 | access to local variable f [Field2] : Object |
 | F.cs:23:32:23:32 | access to local variable o : Object | F.cs:23:13:23:34 | object creation of type F [Field2] : Object |
@@ -205,9 +202,6 @@ nodes
 | A.cs:60:22:60:22 | c [a] : A | semmle.label | c [a] : A |
 | A.cs:64:18:64:26 | access to field a | semmle.label | access to field a |
 | A.cs:64:19:64:23 | (...) ... [a] : A | semmle.label | (...) ... [a] : A |
-| A.cs:69:18:69:22 | (...) ... [a] : A | semmle.label | (...) ... [a] : A |
-| A.cs:77:18:77:27 | access to field a | semmle.label | access to field a |
-| A.cs:77:19:77:24 | (...) ... [a] : A | semmle.label | (...) ... [a] : A |
 | A.cs:83:9:83:9 | [post] access to parameter b [c] : C | semmle.label | [post] access to parameter b [c] : C |
 | A.cs:83:15:83:21 | object creation of type C : C | semmle.label | object creation of type C : C |
 | A.cs:88:12:88:12 | [post] access to local variable b [c] : C | semmle.label | [post] access to local variable b [c] : C |
@@ -384,7 +378,6 @@ nodes
 | A.cs:24:14:24:17 | access to field c | A.cs:22:25:22:32 | object creation of type C2 : C2 | A.cs:24:14:24:17 | access to field c | $@ | A.cs:22:25:22:32 | object creation of type C2 : C2 | object creation of type C2 : C2 |
 | A.cs:33:14:33:17 | access to field c | A.cs:31:29:31:36 | object creation of type C2 : C2 | A.cs:33:14:33:17 | access to field c | $@ | A.cs:31:29:31:36 | object creation of type C2 : C2 | object creation of type C2 : C2 |
 | A.cs:64:18:64:26 | access to field a | A.cs:55:17:55:23 | object creation of type A : A | A.cs:64:18:64:26 | access to field a | $@ | A.cs:55:17:55:23 | object creation of type A : A | object creation of type A : A |
-| A.cs:77:18:77:27 | access to field a | A.cs:55:17:55:23 | object creation of type A : A | A.cs:77:18:77:27 | access to field a | $@ | A.cs:55:17:55:23 | object creation of type A : A | object creation of type A : A |
 | A.cs:89:14:89:16 | access to field c | A.cs:83:15:83:21 | object creation of type C : C | A.cs:89:14:89:16 | access to field c | $@ | A.cs:83:15:83:21 | object creation of type C : C | object creation of type C : C |
 | A.cs:106:14:106:16 | access to field b | A.cs:98:30:98:36 | object creation of type B : B | A.cs:106:14:106:16 | access to field b | $@ | A.cs:98:30:98:36 | object creation of type B : B | object creation of type B : B |
 | A.cs:106:14:106:16 | access to field b | A.cs:104:17:104:23 | object creation of type B : B | A.cs:106:14:106:16 | access to field b | $@ | A.cs:104:17:104:23 | object creation of type B : B | object creation of type B : B |

csharp/ql/test/library-tests/dataflow/global/DataFlowEdges.expected

@@ -1222,22 +1222,22 @@
 | GlobalDataFlow.cs:80:13:80:85 | SSA def(sink13) : IEnumerable<String> | GlobalDataFlow.cs:81:15:81:20 | access to local variable sink13 : IEnumerable<String> |
 | GlobalDataFlow.cs:80:13:80:85 | SSA def(sink13) : IEnumerable<String> | GlobalDataFlow.cs:82:59:82:64 | access to local variable sink13 |
 | GlobalDataFlow.cs:80:13:80:85 | SSA def(sink13) : IEnumerable<String> | GlobalDataFlow.cs:82:59:82:64 | access to local variable sink13 : IEnumerable<String> |
-| GlobalDataFlow.cs:80:13:80:85 | SSA def(sink13) : T | GlobalDataFlow.cs:81:15:81:20 | access to local variable sink13 |
+| GlobalDataFlow.cs:80:13:80:85 | SSA def(sink13) : IEnumerable<T> | GlobalDataFlow.cs:81:15:81:20 | access to local variable sink13 |
-| GlobalDataFlow.cs:80:13:80:85 | SSA def(sink13) : T | GlobalDataFlow.cs:81:15:81:20 | access to local variable sink13 : T |
+| GlobalDataFlow.cs:80:13:80:85 | SSA def(sink13) : IEnumerable<T> | GlobalDataFlow.cs:81:15:81:20 | access to local variable sink13 : IEnumerable<T> |
-| GlobalDataFlow.cs:80:13:80:85 | SSA def(sink13) : T | GlobalDataFlow.cs:82:59:82:64 | access to local variable sink13 |
+| GlobalDataFlow.cs:80:13:80:85 | SSA def(sink13) : IEnumerable<T> | GlobalDataFlow.cs:82:59:82:64 | access to local variable sink13 |
-| GlobalDataFlow.cs:80:13:80:85 | SSA def(sink13) : T | GlobalDataFlow.cs:82:59:82:64 | access to local variable sink13 : T |
+| GlobalDataFlow.cs:80:13:80:85 | SSA def(sink13) : IEnumerable<T> | GlobalDataFlow.cs:82:59:82:64 | access to local variable sink13 : IEnumerable<T> |
 | GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : IEnumerable<String> | GlobalDataFlow.cs:80:13:80:85 | SSA def(sink13) |
 | GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : IEnumerable<String> | GlobalDataFlow.cs:80:13:80:85 | SSA def(sink13) : IEnumerable<String> |
 | GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : IEnumerable<String> | GlobalDataFlow.cs:81:15:81:20 | access to local variable sink13 |
 | GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : IEnumerable<String> | GlobalDataFlow.cs:81:15:81:20 | access to local variable sink13 : IEnumerable<String> |
 | GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : IEnumerable<String> | GlobalDataFlow.cs:82:59:82:64 | access to local variable sink13 |
 | GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : IEnumerable<String> | GlobalDataFlow.cs:82:59:82:64 | access to local variable sink13 : IEnumerable<String> |
-| GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : T | GlobalDataFlow.cs:80:13:80:85 | SSA def(sink13) |
+| GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : IEnumerable<T> | GlobalDataFlow.cs:80:13:80:85 | SSA def(sink13) |
-| GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : T | GlobalDataFlow.cs:80:13:80:85 | SSA def(sink13) : T |
+| GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : IEnumerable<T> | GlobalDataFlow.cs:80:13:80:85 | SSA def(sink13) : IEnumerable<T> |
-| GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : T | GlobalDataFlow.cs:81:15:81:20 | access to local variable sink13 |
+| GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : IEnumerable<T> | GlobalDataFlow.cs:81:15:81:20 | access to local variable sink13 |
-| GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : T | GlobalDataFlow.cs:81:15:81:20 | access to local variable sink13 : T |
+| GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : IEnumerable<T> | GlobalDataFlow.cs:81:15:81:20 | access to local variable sink13 : IEnumerable<T> |
-| GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : T | GlobalDataFlow.cs:82:59:82:64 | access to local variable sink13 |
+| GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : IEnumerable<T> | GlobalDataFlow.cs:82:59:82:64 | access to local variable sink13 |
-| GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : T | GlobalDataFlow.cs:82:59:82:64 | access to local variable sink13 : T |
+| GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : IEnumerable<T> | GlobalDataFlow.cs:82:59:82:64 | access to local variable sink13 : IEnumerable<T> |
 | GlobalDataFlow.cs:80:23:80:65 | (...) ... : IEnumerable<String> | GlobalDataFlow.cs:426:71:426:71 | e |
 | GlobalDataFlow.cs:80:23:80:65 | (...) ... : IEnumerable<String> | GlobalDataFlow.cs:426:71:426:71 | e : IEnumerable<String> |
 | GlobalDataFlow.cs:80:23:80:65 | (...) ... : String[] | GlobalDataFlow.cs:426:71:426:71 | e |
@@ -1260,8 +1260,8 @@
 | GlobalDataFlow.cs:80:84:80:84 | access to parameter x : String | GlobalDataFlow.cs:431:44:431:47 | delegate call : String |
 | GlobalDataFlow.cs:81:15:81:20 | access to local variable sink13 : IEnumerable<String> | GlobalDataFlow.cs:82:59:82:64 | access to local variable sink13 |
 | GlobalDataFlow.cs:81:15:81:20 | access to local variable sink13 : IEnumerable<String> | GlobalDataFlow.cs:82:59:82:64 | access to local variable sink13 : IEnumerable<String> |
-| GlobalDataFlow.cs:81:15:81:20 | access to local variable sink13 : T | GlobalDataFlow.cs:82:59:82:64 | access to local variable sink13 |
+| GlobalDataFlow.cs:81:15:81:20 | access to local variable sink13 : IEnumerable<T> | GlobalDataFlow.cs:82:59:82:64 | access to local variable sink13 |
-| GlobalDataFlow.cs:81:15:81:20 | access to local variable sink13 : T | GlobalDataFlow.cs:82:59:82:64 | access to local variable sink13 : T |
+| GlobalDataFlow.cs:81:15:81:20 | access to local variable sink13 : IEnumerable<T> | GlobalDataFlow.cs:82:59:82:64 | access to local variable sink13 : IEnumerable<T> |
 | GlobalDataFlow.cs:82:13:82:95 | SSA def(sink14) : IEnumerable<String> | GlobalDataFlow.cs:83:15:83:20 | access to local variable sink14 |
 | GlobalDataFlow.cs:82:13:82:95 | SSA def(sink14) : IEnumerable<String> | GlobalDataFlow.cs:83:15:83:20 | access to local variable sink14 : IEnumerable<String> |
 | GlobalDataFlow.cs:82:13:82:95 | SSA def(sink14) : IEnumerable<String> | GlobalDataFlow.cs:84:59:84:64 | access to local variable sink14 |
@@ -1388,8 +1388,6 @@
 | GlobalDataFlow.cs:88:22:88:70 | call to method Aggregate : String | GlobalDataFlow.cs:89:15:89:20 | access to local variable sink17 : String |
 | GlobalDataFlow.cs:88:39:88:40 | "" : String | GlobalDataFlow.cs:88:44:88:46 | acc |
 | GlobalDataFlow.cs:88:39:88:40 | "" : String | GlobalDataFlow.cs:88:44:88:46 | acc : String |
-| GlobalDataFlow.cs:88:43:88:61 | [output] (...) => ... : Func<String,String,String> | GlobalDataFlow.cs:88:64:88:64 | x |
-| GlobalDataFlow.cs:88:43:88:61 | [output] (...) => ... : Func<String,String,String> | GlobalDataFlow.cs:88:64:88:64 | x : Func<String,String,String> |
 | GlobalDataFlow.cs:88:43:88:61 | [output] (...) => ... : String | GlobalDataFlow.cs:88:64:88:64 | x |
 | GlobalDataFlow.cs:88:43:88:61 | [output] (...) => ... : String | GlobalDataFlow.cs:88:64:88:64 | x : String |
 | GlobalDataFlow.cs:88:44:88:46 | acc : String | GlobalDataFlow.cs:88:55:88:57 | access to parameter acc |
@@ -1430,8 +1428,6 @@
 | GlobalDataFlow.cs:90:75:90:80 | access to local variable sink14 : IEnumerable<String> | GlobalDataFlow.cs:122:20:122:25 | access to local variable sink14 : IEnumerable<String> |
 | GlobalDataFlow.cs:90:75:90:88 | call to method First : String | GlobalDataFlow.cs:90:92:90:94 | acc |
 | GlobalDataFlow.cs:90:75:90:88 | call to method First : String | GlobalDataFlow.cs:90:92:90:94 | acc : String |
-| GlobalDataFlow.cs:90:91:90:109 | [output] (...) => ... : Func<String,String,String> | GlobalDataFlow.cs:90:112:90:112 | x |
-| GlobalDataFlow.cs:90:91:90:109 | [output] (...) => ... : Func<String,String,String> | GlobalDataFlow.cs:90:112:90:112 | x : Func<String,String,String> |
 | GlobalDataFlow.cs:90:91:90:109 | [output] (...) => ... : String | GlobalDataFlow.cs:90:112:90:112 | x |
 | GlobalDataFlow.cs:90:91:90:109 | [output] (...) => ... : String | GlobalDataFlow.cs:90:112:90:112 | x : String |
 | GlobalDataFlow.cs:90:92:90:94 | acc : String | GlobalDataFlow.cs:90:103:90:105 | access to parameter acc |
@@ -1658,16 +1654,16 @@
 | GlobalDataFlow.cs:111:15:111:22 | access to local variable nonSink0 : T | GlobalDataFlow.cs:114:57:114:64 | access to local variable nonSink0 : T |
 | GlobalDataFlow.cs:112:13:112:90 | SSA def(nonSink1) : IEnumerable<String> | GlobalDataFlow.cs:113:15:113:22 | access to local variable nonSink1 |
 | GlobalDataFlow.cs:112:13:112:90 | SSA def(nonSink1) : IEnumerable<String> | GlobalDataFlow.cs:113:15:113:22 | access to local variable nonSink1 : IEnumerable<String> |
-| GlobalDataFlow.cs:112:13:112:90 | SSA def(nonSink1) : T | GlobalDataFlow.cs:113:15:113:22 | access to local variable nonSink1 |
+| GlobalDataFlow.cs:112:13:112:90 | SSA def(nonSink1) : IEnumerable<T> | GlobalDataFlow.cs:113:15:113:22 | access to local variable nonSink1 |
-| GlobalDataFlow.cs:112:13:112:90 | SSA def(nonSink1) : T | GlobalDataFlow.cs:113:15:113:22 | access to local variable nonSink1 : T |
+| GlobalDataFlow.cs:112:13:112:90 | SSA def(nonSink1) : IEnumerable<T> | GlobalDataFlow.cs:113:15:113:22 | access to local variable nonSink1 : IEnumerable<T> |
 | GlobalDataFlow.cs:112:24:112:90 | call to method SelectEven : IEnumerable<String> | GlobalDataFlow.cs:112:13:112:90 | SSA def(nonSink1) |
 | GlobalDataFlow.cs:112:24:112:90 | call to method SelectEven : IEnumerable<String> | GlobalDataFlow.cs:112:13:112:90 | SSA def(nonSink1) : IEnumerable<String> |
 | GlobalDataFlow.cs:112:24:112:90 | call to method SelectEven : IEnumerable<String> | GlobalDataFlow.cs:113:15:113:22 | access to local variable nonSink1 |
 | GlobalDataFlow.cs:112:24:112:90 | call to method SelectEven : IEnumerable<String> | GlobalDataFlow.cs:113:15:113:22 | access to local variable nonSink1 : IEnumerable<String> |
-| GlobalDataFlow.cs:112:24:112:90 | call to method SelectEven : T | GlobalDataFlow.cs:112:13:112:90 | SSA def(nonSink1) |
+| GlobalDataFlow.cs:112:24:112:90 | call to method SelectEven : IEnumerable<T> | GlobalDataFlow.cs:112:13:112:90 | SSA def(nonSink1) |
-| GlobalDataFlow.cs:112:24:112:90 | call to method SelectEven : T | GlobalDataFlow.cs:112:13:112:90 | SSA def(nonSink1) : T |
+| GlobalDataFlow.cs:112:24:112:90 | call to method SelectEven : IEnumerable<T> | GlobalDataFlow.cs:112:13:112:90 | SSA def(nonSink1) : IEnumerable<T> |
-| GlobalDataFlow.cs:112:24:112:90 | call to method SelectEven : T | GlobalDataFlow.cs:113:15:113:22 | access to local variable nonSink1 |
+| GlobalDataFlow.cs:112:24:112:90 | call to method SelectEven : IEnumerable<T> | GlobalDataFlow.cs:113:15:113:22 | access to local variable nonSink1 |
-| GlobalDataFlow.cs:112:24:112:90 | call to method SelectEven : T | GlobalDataFlow.cs:113:15:113:22 | access to local variable nonSink1 : T |
+| GlobalDataFlow.cs:112:24:112:90 | call to method SelectEven : IEnumerable<T> | GlobalDataFlow.cs:113:15:113:22 | access to local variable nonSink1 : IEnumerable<T> |
 | GlobalDataFlow.cs:112:25:112:70 | (...) ... : IEnumerable<String> | GlobalDataFlow.cs:426:71:426:71 | e |
 | GlobalDataFlow.cs:112:25:112:70 | (...) ... : IEnumerable<String> | GlobalDataFlow.cs:426:71:426:71 | e : IEnumerable<String> |
 | GlobalDataFlow.cs:112:25:112:70 | (...) ... : String[] | GlobalDataFlow.cs:426:71:426:71 | e |
@@ -1758,8 +1754,6 @@
 | GlobalDataFlow.cs:120:20:120:64 | call to method Aggregate : String | GlobalDataFlow.cs:121:15:121:22 | access to local variable nonSink0 : String |
 | GlobalDataFlow.cs:120:37:120:38 | "" : String | GlobalDataFlow.cs:120:42:120:44 | acc |
 | GlobalDataFlow.cs:120:37:120:38 | "" : String | GlobalDataFlow.cs:120:42:120:44 | acc : String |
-| GlobalDataFlow.cs:120:41:120:55 | [output] (...) => ... : Func<String,String,String> | GlobalDataFlow.cs:120:58:120:58 | x |
-| GlobalDataFlow.cs:120:41:120:55 | [output] (...) => ... : Func<String,String,String> | GlobalDataFlow.cs:120:58:120:58 | x : Func<String,String,String> |
 | GlobalDataFlow.cs:120:41:120:55 | [output] (...) => ... : String | GlobalDataFlow.cs:120:58:120:58 | x |
 | GlobalDataFlow.cs:120:41:120:55 | [output] (...) => ... : String | GlobalDataFlow.cs:120:58:120:58 | x : String |
 | GlobalDataFlow.cs:120:42:120:44 | acc : String | GlobalDataFlow.cs:120:53:120:55 | access to parameter acc |
@@ -1808,8 +1802,6 @@
 | GlobalDataFlow.cs:124:20:124:67 | call to method Aggregate : String | GlobalDataFlow.cs:130:23:130:30 | access to local variable nonSink0 : String |
 | GlobalDataFlow.cs:124:20:124:67 | call to method Aggregate : String | GlobalDataFlow.cs:139:28:139:35 | access to local variable nonSink0 |
 | GlobalDataFlow.cs:124:20:124:67 | call to method Aggregate : String | GlobalDataFlow.cs:139:28:139:35 | access to local variable nonSink0 : String |
-| GlobalDataFlow.cs:124:46:124:58 | [output] (...) => ... : Func<String,String,String> | GlobalDataFlow.cs:124:61:124:61 | x |
-| GlobalDataFlow.cs:124:46:124:58 | [output] (...) => ... : Func<String,String,String> | GlobalDataFlow.cs:124:61:124:61 | x : Func<String,String,String> |
 | GlobalDataFlow.cs:124:46:124:58 | [output] (...) => ... : String | GlobalDataFlow.cs:124:61:124:61 | x |
 | GlobalDataFlow.cs:124:46:124:58 | [output] (...) => ... : String | GlobalDataFlow.cs:124:61:124:61 | x : String |
 | GlobalDataFlow.cs:124:52:124:52 | s : String | GlobalDataFlow.cs:124:58:124:58 | access to parameter s |
@@ -2132,16 +2124,10 @@
 | GlobalDataFlow.cs:159:20:159:24 | SSA def(sink8) : String | GlobalDataFlow.cs:160:15:160:19 | access to local variable sink8 : String |
 | GlobalDataFlow.cs:161:13:161:31 | SSA def(sink12) : IEnumerable<String> | GlobalDataFlow.cs:162:15:162:20 | access to local variable sink12 |
 | GlobalDataFlow.cs:161:13:161:31 | SSA def(sink12) : IEnumerable<String> | GlobalDataFlow.cs:162:15:162:20 | access to local variable sink12 : IEnumerable<String> |
-| GlobalDataFlow.cs:161:13:161:31 | SSA def(sink12) : String | GlobalDataFlow.cs:162:15:162:20 | access to local variable sink12 |
-| GlobalDataFlow.cs:161:13:161:31 | SSA def(sink12) : String | GlobalDataFlow.cs:162:15:162:20 | access to local variable sink12 : String |
 | GlobalDataFlow.cs:161:22:161:31 | call to method OutYield : IEnumerable<String> | GlobalDataFlow.cs:161:13:161:31 | SSA def(sink12) |
 | GlobalDataFlow.cs:161:22:161:31 | call to method OutYield : IEnumerable<String> | GlobalDataFlow.cs:161:13:161:31 | SSA def(sink12) : IEnumerable<String> |
 | GlobalDataFlow.cs:161:22:161:31 | call to method OutYield : IEnumerable<String> | GlobalDataFlow.cs:162:15:162:20 | access to local variable sink12 |
 | GlobalDataFlow.cs:161:22:161:31 | call to method OutYield : IEnumerable<String> | GlobalDataFlow.cs:162:15:162:20 | access to local variable sink12 : IEnumerable<String> |
-| GlobalDataFlow.cs:161:22:161:31 | call to method OutYield : String | GlobalDataFlow.cs:161:13:161:31 | SSA def(sink12) |
-| GlobalDataFlow.cs:161:22:161:31 | call to method OutYield : String | GlobalDataFlow.cs:161:13:161:31 | SSA def(sink12) : String |
-| GlobalDataFlow.cs:161:22:161:31 | call to method OutYield : String | GlobalDataFlow.cs:162:15:162:20 | access to local variable sink12 |
-| GlobalDataFlow.cs:161:22:161:31 | call to method OutYield : String | GlobalDataFlow.cs:162:15:162:20 | access to local variable sink12 : String |
 | GlobalDataFlow.cs:161:22:161:31 | this access : DataFlow | GlobalDataFlow.cs:167:20:167:27 | this access |
 | GlobalDataFlow.cs:161:22:161:31 | this access : DataFlow | GlobalDataFlow.cs:167:20:167:27 | this access : DataFlow |
 | GlobalDataFlow.cs:161:22:161:31 | this access : DataFlow | GlobalDataFlow.cs:169:9:169:31 | this access |
@@ -2296,54 +2282,20 @@
 | GlobalDataFlow.cs:185:20:185:27 | delegate call : String | GlobalDataFlow.cs:185:9:185:27 | SSA def(nonSink0) : String |
 | GlobalDataFlow.cs:185:20:185:27 | delegate call : String | GlobalDataFlow.cs:186:15:186:22 | access to local variable nonSink0 |
 | GlobalDataFlow.cs:185:20:185:27 | delegate call : String | GlobalDataFlow.cs:186:15:186:22 | access to local variable nonSink0 : String |
-| GlobalDataFlow.cs:189:13:189:48 | SSA def(sink10) : Func<String> | GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 |
-| GlobalDataFlow.cs:189:13:189:48 | SSA def(sink10) : Func<String> | GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 : Func<String> |
 | GlobalDataFlow.cs:189:13:189:48 | SSA def(sink10) : Lazy<String> | GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 |
 | GlobalDataFlow.cs:189:13:189:48 | SSA def(sink10) : Lazy<String> | GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 : Lazy<String> |
 | GlobalDataFlow.cs:189:13:189:48 | SSA def(sink10) : String | GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 |
 | GlobalDataFlow.cs:189:13:189:48 | SSA def(sink10) : String | GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 : String |
-| GlobalDataFlow.cs:189:22:189:42 | object creation of type Lazy<String> : Func<String> | GlobalDataFlow.cs:189:13:189:48 | SSA def(sink10) |
-| GlobalDataFlow.cs:189:22:189:42 | object creation of type Lazy<String> : Func<String> | GlobalDataFlow.cs:189:13:189:48 | SSA def(sink10) : Func<String> |
-| GlobalDataFlow.cs:189:22:189:42 | object creation of type Lazy<String> : Func<String> | GlobalDataFlow.cs:189:22:189:48 | access to property Value |
-| GlobalDataFlow.cs:189:22:189:42 | object creation of type Lazy<String> : Func<String> | GlobalDataFlow.cs:189:22:189:48 | access to property Value : Func<String> |
-| GlobalDataFlow.cs:189:22:189:42 | object creation of type Lazy<String> : Func<String> | GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 |
-| GlobalDataFlow.cs:189:22:189:42 | object creation of type Lazy<String> : Func<String> | GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 : Func<String> |
 | GlobalDataFlow.cs:189:22:189:42 | object creation of type Lazy<String> : Lazy<String> | GlobalDataFlow.cs:189:13:189:48 | SSA def(sink10) |
 | GlobalDataFlow.cs:189:22:189:42 | object creation of type Lazy<String> : Lazy<String> | GlobalDataFlow.cs:189:13:189:48 | SSA def(sink10) : Lazy<String> |
-| GlobalDataFlow.cs:189:22:189:42 | object creation of type Lazy<String> : Lazy<String> | GlobalDataFlow.cs:189:22:189:48 | access to property Value |
-| GlobalDataFlow.cs:189:22:189:42 | object creation of type Lazy<String> : Lazy<String> | GlobalDataFlow.cs:189:22:189:48 | access to property Value : Lazy<String> |
 | GlobalDataFlow.cs:189:22:189:42 | object creation of type Lazy<String> : Lazy<String> | GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 |
 | GlobalDataFlow.cs:189:22:189:42 | object creation of type Lazy<String> : Lazy<String> | GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 : Lazy<String> |
-| GlobalDataFlow.cs:189:22:189:42 | object creation of type Lazy<String> : String | GlobalDataFlow.cs:189:13:189:48 | SSA def(sink10) |
-| GlobalDataFlow.cs:189:22:189:42 | object creation of type Lazy<String> : String | GlobalDataFlow.cs:189:13:189:48 | SSA def(sink10) : String |
-| GlobalDataFlow.cs:189:22:189:42 | object creation of type Lazy<String> : String | GlobalDataFlow.cs:189:22:189:48 | access to property Value |
-| GlobalDataFlow.cs:189:22:189:42 | object creation of type Lazy<String> : String | GlobalDataFlow.cs:189:22:189:48 | access to property Value : String |
-| GlobalDataFlow.cs:189:22:189:42 | object creation of type Lazy<String> : String | GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 |
-| GlobalDataFlow.cs:189:22:189:42 | object creation of type Lazy<String> : String | GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 : String |
-| GlobalDataFlow.cs:189:22:189:48 | access to property Value : Func<String> | GlobalDataFlow.cs:189:13:189:48 | SSA def(sink10) |
-| GlobalDataFlow.cs:189:22:189:48 | access to property Value : Func<String> | GlobalDataFlow.cs:189:13:189:48 | SSA def(sink10) : Func<String> |
-| GlobalDataFlow.cs:189:22:189:48 | access to property Value : Func<String> | GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 |
-| GlobalDataFlow.cs:189:22:189:48 | access to property Value : Func<String> | GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 : Func<String> |
-| GlobalDataFlow.cs:189:22:189:48 | access to property Value : Lazy<String> | GlobalDataFlow.cs:189:13:189:48 | SSA def(sink10) |
-| GlobalDataFlow.cs:189:22:189:48 | access to property Value : Lazy<String> | GlobalDataFlow.cs:189:13:189:48 | SSA def(sink10) : Lazy<String> |
-| GlobalDataFlow.cs:189:22:189:48 | access to property Value : Lazy<String> | GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 |
-| GlobalDataFlow.cs:189:22:189:48 | access to property Value : Lazy<String> | GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 : Lazy<String> |
 | GlobalDataFlow.cs:189:22:189:48 | access to property Value : String | GlobalDataFlow.cs:189:13:189:48 | SSA def(sink10) |
 | GlobalDataFlow.cs:189:22:189:48 | access to property Value : String | GlobalDataFlow.cs:189:13:189:48 | SSA def(sink10) : String |
 | GlobalDataFlow.cs:189:22:189:48 | access to property Value : String | GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 |
 | GlobalDataFlow.cs:189:22:189:48 | access to property Value : String | GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 : String |
-| GlobalDataFlow.cs:189:39:189:41 | [output] delegate creation of type Func<String> : Func<String> | GlobalDataFlow.cs:189:13:189:48 | SSA def(sink10) |
-| GlobalDataFlow.cs:189:39:189:41 | [output] delegate creation of type Func<String> : Func<String> | GlobalDataFlow.cs:189:13:189:48 | SSA def(sink10) : Func<String> |
-| GlobalDataFlow.cs:189:39:189:41 | [output] delegate creation of type Func<String> : Func<String> | GlobalDataFlow.cs:189:22:189:42 | object creation of type Lazy<String> |
-| GlobalDataFlow.cs:189:39:189:41 | [output] delegate creation of type Func<String> : Func<String> | GlobalDataFlow.cs:189:22:189:42 | object creation of type Lazy<String> : Func<String> |
-| GlobalDataFlow.cs:189:39:189:41 | [output] delegate creation of type Func<String> : Func<String> | GlobalDataFlow.cs:189:22:189:48 | access to property Value |
-| GlobalDataFlow.cs:189:39:189:41 | [output] delegate creation of type Func<String> : Func<String> | GlobalDataFlow.cs:189:22:189:48 | access to property Value : Func<String> |
-| GlobalDataFlow.cs:189:39:189:41 | [output] delegate creation of type Func<String> : Func<String> | GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 |
-| GlobalDataFlow.cs:189:39:189:41 | [output] delegate creation of type Func<String> : Func<String> | GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 : Func<String> |
 | GlobalDataFlow.cs:189:39:189:41 | [output] delegate creation of type Func<String> : String | GlobalDataFlow.cs:189:13:189:48 | SSA def(sink10) |
 | GlobalDataFlow.cs:189:39:189:41 | [output] delegate creation of type Func<String> : String | GlobalDataFlow.cs:189:13:189:48 | SSA def(sink10) : String |
-| GlobalDataFlow.cs:189:39:189:41 | [output] delegate creation of type Func<String> : String | GlobalDataFlow.cs:189:22:189:42 | object creation of type Lazy<String> |
-| GlobalDataFlow.cs:189:39:189:41 | [output] delegate creation of type Func<String> : String | GlobalDataFlow.cs:189:22:189:42 | object creation of type Lazy<String> : String |
 | GlobalDataFlow.cs:189:39:189:41 | [output] delegate creation of type Func<String> : String | GlobalDataFlow.cs:189:22:189:48 | access to property Value |
 | GlobalDataFlow.cs:189:39:189:41 | [output] delegate creation of type Func<String> : String | GlobalDataFlow.cs:189:22:189:48 | access to property Value : String |
 | GlobalDataFlow.cs:189:39:189:41 | [output] delegate creation of type Func<String> : String | GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 |
@@ -2354,54 +2306,20 @@
 | GlobalDataFlow.cs:189:39:189:41 | this access : DataFlow | GlobalDataFlow.cs:197:22:197:32 | this access : DataFlow |
 | GlobalDataFlow.cs:189:39:189:41 | this access : DataFlow | GlobalDataFlow.cs:201:20:201:33 | this access |
 | GlobalDataFlow.cs:189:39:189:41 | this access : DataFlow | GlobalDataFlow.cs:201:20:201:33 | this access : DataFlow |
-| GlobalDataFlow.cs:193:9:193:49 | SSA def(nonSink0) : Func<String> | GlobalDataFlow.cs:194:15:194:22 | access to local variable nonSink0 |
-| GlobalDataFlow.cs:193:9:193:49 | SSA def(nonSink0) : Func<String> | GlobalDataFlow.cs:194:15:194:22 | access to local variable nonSink0 : Func<String> |
 | GlobalDataFlow.cs:193:9:193:49 | SSA def(nonSink0) : Lazy<String> | GlobalDataFlow.cs:194:15:194:22 | access to local variable nonSink0 |
 | GlobalDataFlow.cs:193:9:193:49 | SSA def(nonSink0) : Lazy<String> | GlobalDataFlow.cs:194:15:194:22 | access to local variable nonSink0 : Lazy<String> |
 | GlobalDataFlow.cs:193:9:193:49 | SSA def(nonSink0) : String | GlobalDataFlow.cs:194:15:194:22 | access to local variable nonSink0 |
 | GlobalDataFlow.cs:193:9:193:49 | SSA def(nonSink0) : String | GlobalDataFlow.cs:194:15:194:22 | access to local variable nonSink0 : String |
-| GlobalDataFlow.cs:193:20:193:43 | object creation of type Lazy<String> : Func<String> | GlobalDataFlow.cs:193:9:193:49 | SSA def(nonSink0) |
-| GlobalDataFlow.cs:193:20:193:43 | object creation of type Lazy<String> : Func<String> | GlobalDataFlow.cs:193:9:193:49 | SSA def(nonSink0) : Func<String> |
-| GlobalDataFlow.cs:193:20:193:43 | object creation of type Lazy<String> : Func<String> | GlobalDataFlow.cs:193:20:193:49 | access to property Value |
-| GlobalDataFlow.cs:193:20:193:43 | object creation of type Lazy<String> : Func<String> | GlobalDataFlow.cs:193:20:193:49 | access to property Value : Func<String> |
-| GlobalDataFlow.cs:193:20:193:43 | object creation of type Lazy<String> : Func<String> | GlobalDataFlow.cs:194:15:194:22 | access to local variable nonSink0 |
-| GlobalDataFlow.cs:193:20:193:43 | object creation of type Lazy<String> : Func<String> | GlobalDataFlow.cs:194:15:194:22 | access to local variable nonSink0 : Func<String> |
 | GlobalDataFlow.cs:193:20:193:43 | object creation of type Lazy<String> : Lazy<String> | GlobalDataFlow.cs:193:9:193:49 | SSA def(nonSink0) |
 | GlobalDataFlow.cs:193:20:193:43 | object creation of type Lazy<String> : Lazy<String> | GlobalDataFlow.cs:193:9:193:49 | SSA def(nonSink0) : Lazy<String> |
-| GlobalDataFlow.cs:193:20:193:43 | object creation of type Lazy<String> : Lazy<String> | GlobalDataFlow.cs:193:20:193:49 | access to property Value |
-| GlobalDataFlow.cs:193:20:193:43 | object creation of type Lazy<String> : Lazy<String> | GlobalDataFlow.cs:193:20:193:49 | access to property Value : Lazy<String> |
 | GlobalDataFlow.cs:193:20:193:43 | object creation of type Lazy<String> : Lazy<String> | GlobalDataFlow.cs:194:15:194:22 | access to local variable nonSink0 |
 | GlobalDataFlow.cs:193:20:193:43 | object creation of type Lazy<String> : Lazy<String> | GlobalDataFlow.cs:194:15:194:22 | access to local variable nonSink0 : Lazy<String> |
-| GlobalDataFlow.cs:193:20:193:43 | object creation of type Lazy<String> : String | GlobalDataFlow.cs:193:9:193:49 | SSA def(nonSink0) |
-| GlobalDataFlow.cs:193:20:193:43 | object creation of type Lazy<String> : String | GlobalDataFlow.cs:193:9:193:49 | SSA def(nonSink0) : String |
-| GlobalDataFlow.cs:193:20:193:43 | object creation of type Lazy<String> : String | GlobalDataFlow.cs:193:20:193:49 | access to property Value |
-| GlobalDataFlow.cs:193:20:193:43 | object creation of type Lazy<String> : String | GlobalDataFlow.cs:193:20:193:49 | access to property Value : String |
-| GlobalDataFlow.cs:193:20:193:43 | object creation of type Lazy<String> : String | GlobalDataFlow.cs:194:15:194:22 | access to local variable nonSink0 |
-| GlobalDataFlow.cs:193:20:193:43 | object creation of type Lazy<String> : String | GlobalDataFlow.cs:194:15:194:22 | access to local variable nonSink0 : String |
-| GlobalDataFlow.cs:193:20:193:49 | access to property Value : Func<String> | GlobalDataFlow.cs:193:9:193:49 | SSA def(nonSink0) |
-| GlobalDataFlow.cs:193:20:193:49 | access to property Value : Func<String> | GlobalDataFlow.cs:193:9:193:49 | SSA def(nonSink0) : Func<String> |
-| GlobalDataFlow.cs:193:20:193:49 | access to property Value : Func<String> | GlobalDataFlow.cs:194:15:194:22 | access to local variable nonSink0 |
-| GlobalDataFlow.cs:193:20:193:49 | access to property Value : Func<String> | GlobalDataFlow.cs:194:15:194:22 | access to local variable nonSink0 : Func<String> |
-| GlobalDataFlow.cs:193:20:193:49 | access to property Value : Lazy<String> | GlobalDataFlow.cs:193:9:193:49 | SSA def(nonSink0) |
-| GlobalDataFlow.cs:193:20:193:49 | access to property Value : Lazy<String> | GlobalDataFlow.cs:193:9:193:49 | SSA def(nonSink0) : Lazy<String> |
-| GlobalDataFlow.cs:193:20:193:49 | access to property Value : Lazy<String> | GlobalDataFlow.cs:194:15:194:22 | access to local variable nonSink0 |
-| GlobalDataFlow.cs:193:20:193:49 | access to property Value : Lazy<String> | GlobalDataFlow.cs:194:15:194:22 | access to local variable nonSink0 : Lazy<String> |
 | GlobalDataFlow.cs:193:20:193:49 | access to property Value : String | GlobalDataFlow.cs:193:9:193:49 | SSA def(nonSink0) |
 | GlobalDataFlow.cs:193:20:193:49 | access to property Value : String | GlobalDataFlow.cs:193:9:193:49 | SSA def(nonSink0) : String |
 | GlobalDataFlow.cs:193:20:193:49 | access to property Value : String | GlobalDataFlow.cs:194:15:194:22 | access to local variable nonSink0 |
 | GlobalDataFlow.cs:193:20:193:49 | access to property Value : String | GlobalDataFlow.cs:194:15:194:22 | access to local variable nonSink0 : String |
-| GlobalDataFlow.cs:193:37:193:42 | [output] delegate creation of type Func<String> : Func<String> | GlobalDataFlow.cs:193:9:193:49 | SSA def(nonSink0) |
-| GlobalDataFlow.cs:193:37:193:42 | [output] delegate creation of type Func<String> : Func<String> | GlobalDataFlow.cs:193:9:193:49 | SSA def(nonSink0) : Func<String> |
-| GlobalDataFlow.cs:193:37:193:42 | [output] delegate creation of type Func<String> : Func<String> | GlobalDataFlow.cs:193:20:193:43 | object creation of type Lazy<String> |
-| GlobalDataFlow.cs:193:37:193:42 | [output] delegate creation of type Func<String> : Func<String> | GlobalDataFlow.cs:193:20:193:43 | object creation of type Lazy<String> : Func<String> |
-| GlobalDataFlow.cs:193:37:193:42 | [output] delegate creation of type Func<String> : Func<String> | GlobalDataFlow.cs:193:20:193:49 | access to property Value |
-| GlobalDataFlow.cs:193:37:193:42 | [output] delegate creation of type Func<String> : Func<String> | GlobalDataFlow.cs:193:20:193:49 | access to property Value : Func<String> |
-| GlobalDataFlow.cs:193:37:193:42 | [output] delegate creation of type Func<String> : Func<String> | GlobalDataFlow.cs:194:15:194:22 | access to local variable nonSink0 |
-| GlobalDataFlow.cs:193:37:193:42 | [output] delegate creation of type Func<String> : Func<String> | GlobalDataFlow.cs:194:15:194:22 | access to local variable nonSink0 : Func<String> |
 | GlobalDataFlow.cs:193:37:193:42 | [output] delegate creation of type Func<String> : String | GlobalDataFlow.cs:193:9:193:49 | SSA def(nonSink0) |
 | GlobalDataFlow.cs:193:37:193:42 | [output] delegate creation of type Func<String> : String | GlobalDataFlow.cs:193:9:193:49 | SSA def(nonSink0) : String |
-| GlobalDataFlow.cs:193:37:193:42 | [output] delegate creation of type Func<String> : String | GlobalDataFlow.cs:193:20:193:43 | object creation of type Lazy<String> |
-| GlobalDataFlow.cs:193:37:193:42 | [output] delegate creation of type Func<String> : String | GlobalDataFlow.cs:193:20:193:43 | object creation of type Lazy<String> : String |
 | GlobalDataFlow.cs:193:37:193:42 | [output] delegate creation of type Func<String> : String | GlobalDataFlow.cs:193:20:193:49 | access to property Value |
 | GlobalDataFlow.cs:193:37:193:42 | [output] delegate creation of type Func<String> : String | GlobalDataFlow.cs:193:20:193:49 | access to property Value : String |
 | GlobalDataFlow.cs:193:37:193:42 | [output] delegate creation of type Func<String> : String | GlobalDataFlow.cs:194:15:194:22 | access to local variable nonSink0 |
@@ -2944,12 +2862,12 @@
 | GlobalDataFlow.cs:328:9:328:26 | SSA def(x) : String | GlobalDataFlow.cs:159:20:159:24 | SSA def(sink8) : String |
 | GlobalDataFlow.cs:328:13:328:26 | "taint source" : String | GlobalDataFlow.cs:328:9:328:26 | SSA def(x) |
 | GlobalDataFlow.cs:328:13:328:26 | "taint source" : String | GlobalDataFlow.cs:328:9:328:26 | SSA def(x) : String |
-| GlobalDataFlow.cs:333:22:333:23 | "" : String | GlobalDataFlow.cs:161:22:161:31 | call to method OutYield |
+| GlobalDataFlow.cs:333:22:333:23 | "" : IEnumerable<String> | GlobalDataFlow.cs:161:22:161:31 | call to method OutYield |
-| GlobalDataFlow.cs:333:22:333:23 | "" : String | GlobalDataFlow.cs:161:22:161:31 | call to method OutYield : String |
+| GlobalDataFlow.cs:333:22:333:23 | "" : IEnumerable<String> | GlobalDataFlow.cs:161:22:161:31 | call to method OutYield : IEnumerable<String> |
-| GlobalDataFlow.cs:334:22:334:35 | "taint source" : String | GlobalDataFlow.cs:161:22:161:31 | call to method OutYield |
+| GlobalDataFlow.cs:334:22:334:35 | "taint source" : IEnumerable<String> | GlobalDataFlow.cs:161:22:161:31 | call to method OutYield |
-| GlobalDataFlow.cs:334:22:334:35 | "taint source" : String | GlobalDataFlow.cs:161:22:161:31 | call to method OutYield : String |
+| GlobalDataFlow.cs:334:22:334:35 | "taint source" : IEnumerable<String> | GlobalDataFlow.cs:161:22:161:31 | call to method OutYield : IEnumerable<String> |
-| GlobalDataFlow.cs:335:22:335:23 | "" : String | GlobalDataFlow.cs:161:22:161:31 | call to method OutYield |
+| GlobalDataFlow.cs:335:22:335:23 | "" : IEnumerable<String> | GlobalDataFlow.cs:161:22:161:31 | call to method OutYield |
-| GlobalDataFlow.cs:335:22:335:23 | "" : String | GlobalDataFlow.cs:161:22:161:31 | call to method OutYield : String |
+| GlobalDataFlow.cs:335:22:335:23 | "" : IEnumerable<String> | GlobalDataFlow.cs:161:22:161:31 | call to method OutYield : IEnumerable<String> |
 | GlobalDataFlow.cs:340:16:340:17 | "" : String | GlobalDataFlow.cs:167:20:167:27 | call to method NonOut |
 | GlobalDataFlow.cs:340:16:340:17 | "" : String | GlobalDataFlow.cs:167:20:167:27 | call to method NonOut : String |
 | GlobalDataFlow.cs:340:16:340:17 | "" : String | GlobalDataFlow.cs:193:37:193:42 | [output] delegate creation of type Func<String> |
@@ -2962,10 +2880,10 @@
 | GlobalDataFlow.cs:350:9:350:14 | SSA def(x) : String | GlobalDataFlow.cs:171:23:171:30 | SSA def(nonSink0) : String |
 | GlobalDataFlow.cs:350:13:350:14 | "" : String | GlobalDataFlow.cs:350:9:350:14 | SSA def(x) |
 | GlobalDataFlow.cs:350:13:350:14 | "" : String | GlobalDataFlow.cs:350:9:350:14 | SSA def(x) : String |
-| GlobalDataFlow.cs:355:22:355:23 | "" : String | GlobalDataFlow.cs:173:20:173:32 | call to method NonOutYield |
+| GlobalDataFlow.cs:355:22:355:23 | "" : IEnumerable<String> | GlobalDataFlow.cs:173:20:173:32 | call to method NonOutYield |
-| GlobalDataFlow.cs:355:22:355:23 | "" : String | GlobalDataFlow.cs:173:20:173:32 | call to method NonOutYield : String |
+| GlobalDataFlow.cs:355:22:355:23 | "" : IEnumerable<String> | GlobalDataFlow.cs:173:20:173:32 | call to method NonOutYield : IEnumerable<String> |
-| GlobalDataFlow.cs:356:22:356:23 | "" : String | GlobalDataFlow.cs:173:20:173:32 | call to method NonOutYield |
+| GlobalDataFlow.cs:356:22:356:23 | "" : IEnumerable<String> | GlobalDataFlow.cs:173:20:173:32 | call to method NonOutYield |
-| GlobalDataFlow.cs:356:22:356:23 | "" : String | GlobalDataFlow.cs:173:20:173:32 | call to method NonOutYield : String |
+| GlobalDataFlow.cs:356:22:356:23 | "" : IEnumerable<String> | GlobalDataFlow.cs:173:20:173:32 | call to method NonOutYield : IEnumerable<String> |
 | GlobalDataFlow.cs:359:36:359:36 | a : Action<String> | GlobalDataFlow.cs:361:9:361:9 | access to parameter a |
 | GlobalDataFlow.cs:359:36:359:36 | a : Action<String> | GlobalDataFlow.cs:361:9:361:9 | access to parameter a |
 | GlobalDataFlow.cs:359:36:359:36 | a : Action<String> | GlobalDataFlow.cs:361:9:361:9 | access to parameter a |
@@ -3328,10 +3246,10 @@
 | GlobalDataFlow.cs:431:17:431:19 | SSA def(i) : Int32 | GlobalDataFlow.cs:429:9:432:9 | SSA phi(i) : Int32 |
 | GlobalDataFlow.cs:431:17:431:19 | SSA def(i) : Int32 | GlobalDataFlow.cs:431:17:431:17 | access to local variable i |
 | GlobalDataFlow.cs:431:17:431:19 | SSA def(i) : Int32 | GlobalDataFlow.cs:431:17:431:17 | access to local variable i : Int32 |
-| GlobalDataFlow.cs:431:44:431:47 | delegate call : T | GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven |
+| GlobalDataFlow.cs:431:44:431:47 | delegate call : IEnumerable<T> | GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven |
-| GlobalDataFlow.cs:431:44:431:47 | delegate call : T | GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : T |
+| GlobalDataFlow.cs:431:44:431:47 | delegate call : IEnumerable<T> | GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : IEnumerable<T> |
-| GlobalDataFlow.cs:431:44:431:47 | delegate call : T | GlobalDataFlow.cs:112:24:112:90 | call to method SelectEven |
+| GlobalDataFlow.cs:431:44:431:47 | delegate call : IEnumerable<T> | GlobalDataFlow.cs:112:24:112:90 | call to method SelectEven |
-| GlobalDataFlow.cs:431:44:431:47 | delegate call : T | GlobalDataFlow.cs:112:24:112:90 | call to method SelectEven : T |
+| GlobalDataFlow.cs:431:44:431:47 | delegate call : IEnumerable<T> | GlobalDataFlow.cs:112:24:112:90 | call to method SelectEven : IEnumerable<T> |
 | GlobalDataFlow.cs:431:46:431:46 | access to local variable x : T | GlobalDataFlow.cs:80:79:80:79 | x |
 | GlobalDataFlow.cs:431:46:431:46 | access to local variable x : T | GlobalDataFlow.cs:80:79:80:79 | x : T |
 | GlobalDataFlow.cs:431:46:431:46 | access to local variable x : T | GlobalDataFlow.cs:112:84:112:84 | x |

csharp/ql/test/library-tests/dataflow/global/TaintTrackingPath.expected

@@ -139,9 +139,9 @@ edges
 | GlobalDataFlow.cs:78:30:78:34 | SSA def(sink3) : String | GlobalDataFlow.cs:79:15:79:19 | access to local variable sink3 |
 | GlobalDataFlow.cs:78:30:78:34 | SSA def(sink3) : String | GlobalDataFlow.cs:80:23:80:65 | (...) ... : IEnumerable<String> |
 | GlobalDataFlow.cs:78:30:78:34 | SSA def(sink3) : String | GlobalDataFlow.cs:135:29:135:33 | access to local variable sink3 : String |
-| GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : T | GlobalDataFlow.cs:81:15:81:20 | access to local variable sink13 |
+| GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : IEnumerable<T> | GlobalDataFlow.cs:81:15:81:20 | access to local variable sink13 |
-| GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : T | GlobalDataFlow.cs:82:23:82:74 | (...) ... : IEnumerable<String> |
+| GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : IEnumerable<T> | GlobalDataFlow.cs:82:23:82:74 | (...) ... : IEnumerable<String> |
-| GlobalDataFlow.cs:80:23:80:65 | (...) ... : IEnumerable<String> | GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : T |
+| GlobalDataFlow.cs:80:23:80:65 | (...) ... : IEnumerable<String> | GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : IEnumerable<T> |
 | GlobalDataFlow.cs:82:23:82:74 | (...) ... : IEnumerable<String> | GlobalDataFlow.cs:82:84:82:94 | [output] delegate creation of type Func<String,String> : T |
 | GlobalDataFlow.cs:82:23:82:74 | (...) ... : IEnumerable<String> | GlobalDataFlow.cs:292:31:292:40 | sinkParam8 : IEnumerable<String> |
 | GlobalDataFlow.cs:82:84:82:94 | [output] delegate creation of type Func<String,String> : T | GlobalDataFlow.cs:83:15:83:20 | access to local variable sink14 |
@@ -169,7 +169,7 @@ edges
 | GlobalDataFlow.cs:153:21:153:25 | call to method Out : String | GlobalDataFlow.cs:154:15:154:19 | access to local variable sink6 |
 | GlobalDataFlow.cs:156:20:156:24 | SSA def(sink7) : String | GlobalDataFlow.cs:157:15:157:19 | access to local variable sink7 |
 | GlobalDataFlow.cs:159:20:159:24 | SSA def(sink8) : String | GlobalDataFlow.cs:160:15:160:19 | access to local variable sink8 |
-| GlobalDataFlow.cs:161:22:161:31 | call to method OutYield : String | GlobalDataFlow.cs:162:15:162:20 | access to local variable sink12 |
+| GlobalDataFlow.cs:161:22:161:31 | call to method OutYield : IEnumerable<String> | GlobalDataFlow.cs:162:15:162:20 | access to local variable sink12 |
 | GlobalDataFlow.cs:163:22:163:43 | call to method TaintedParam : String | GlobalDataFlow.cs:164:15:164:20 | access to local variable sink23 |
 | GlobalDataFlow.cs:179:35:179:48 | "taint source" : String | GlobalDataFlow.cs:180:21:180:26 | delegate call : String |
 | GlobalDataFlow.cs:180:21:180:26 | delegate call : String | GlobalDataFlow.cs:181:15:181:19 | access to local variable sink9 |
@@ -208,8 +208,8 @@ edges
 | GlobalDataFlow.cs:323:13:323:26 | "taint source" : String | GlobalDataFlow.cs:323:9:323:26 | SSA def(x) : String |
 | GlobalDataFlow.cs:328:9:328:26 | SSA def(x) : String | GlobalDataFlow.cs:159:20:159:24 | SSA def(sink8) : String |
 | GlobalDataFlow.cs:328:13:328:26 | "taint source" : String | GlobalDataFlow.cs:328:9:328:26 | SSA def(x) : String |
-| GlobalDataFlow.cs:334:22:334:35 | "taint source" : String | GlobalDataFlow.cs:161:22:161:31 | call to method OutYield : String |
+| GlobalDataFlow.cs:334:22:334:35 | "taint source" : IEnumerable<String> | GlobalDataFlow.cs:161:22:161:31 | call to method OutYield : IEnumerable<String> |
-| GlobalDataFlow.cs:334:22:334:35 | "taint source" : String | GlobalDataFlow.cs:334:22:334:35 | "taint source" : String |
+| GlobalDataFlow.cs:334:22:334:35 | "taint source" : String | GlobalDataFlow.cs:334:22:334:35 | "taint source" : IEnumerable<String> |
 | GlobalDataFlow.cs:359:41:359:41 | x : String | GlobalDataFlow.cs:361:11:361:11 | access to parameter x : String |
 | GlobalDataFlow.cs:359:41:359:41 | x : String | GlobalDataFlow.cs:361:11:361:11 | access to parameter x : String |
 | GlobalDataFlow.cs:361:11:361:11 | access to parameter x : String | GlobalDataFlow.cs:53:15:53:15 | x : String |
@@ -332,7 +332,7 @@ nodes
 | GlobalDataFlow.cs:78:19:78:23 | access to local variable sink2 : String | semmle.label | access to local variable sink2 : String |
 | GlobalDataFlow.cs:78:30:78:34 | SSA def(sink3) : String | semmle.label | SSA def(sink3) : String |
 | GlobalDataFlow.cs:79:15:79:19 | access to local variable sink3 | semmle.label | access to local variable sink3 |
-| GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : T | semmle.label | call to method SelectEven : T |
+| GlobalDataFlow.cs:80:22:80:85 | call to method SelectEven : IEnumerable<T> | semmle.label | call to method SelectEven : IEnumerable<T> |
 | GlobalDataFlow.cs:80:23:80:65 | (...) ... : IEnumerable<String> | semmle.label | (...) ... : IEnumerable<String> |
 | GlobalDataFlow.cs:81:15:81:20 | access to local variable sink13 | semmle.label | access to local variable sink13 |
 | GlobalDataFlow.cs:82:23:82:74 | (...) ... : IEnumerable<String> | semmle.label | (...) ... : IEnumerable<String> |
@@ -366,7 +366,7 @@ nodes
 | GlobalDataFlow.cs:157:15:157:19 | access to local variable sink7 | semmle.label | access to local variable sink7 |
 | GlobalDataFlow.cs:159:20:159:24 | SSA def(sink8) : String | semmle.label | SSA def(sink8) : String |
 | GlobalDataFlow.cs:160:15:160:19 | access to local variable sink8 | semmle.label | access to local variable sink8 |
-| GlobalDataFlow.cs:161:22:161:31 | call to method OutYield : String | semmle.label | call to method OutYield : String |
+| GlobalDataFlow.cs:161:22:161:31 | call to method OutYield : IEnumerable<String> | semmle.label | call to method OutYield : IEnumerable<String> |
 | GlobalDataFlow.cs:162:15:162:20 | access to local variable sink12 | semmle.label | access to local variable sink12 |
 | GlobalDataFlow.cs:163:22:163:43 | call to method TaintedParam : String | semmle.label | call to method TaintedParam : String |
 | GlobalDataFlow.cs:164:15:164:20 | access to local variable sink23 | semmle.label | access to local variable sink23 |
@@ -417,7 +417,7 @@ nodes
 | GlobalDataFlow.cs:323:13:323:26 | "taint source" : String | semmle.label | "taint source" : String |
 | GlobalDataFlow.cs:328:9:328:26 | SSA def(x) : String | semmle.label | SSA def(x) : String |
 | GlobalDataFlow.cs:328:13:328:26 | "taint source" : String | semmle.label | "taint source" : String |
-| GlobalDataFlow.cs:334:22:334:35 | "taint source" : String | semmle.label | "taint source" : String |
+| GlobalDataFlow.cs:334:22:334:35 | "taint source" : IEnumerable<String> | semmle.label | "taint source" : IEnumerable<String> |
 | GlobalDataFlow.cs:334:22:334:35 | "taint source" : String | semmle.label | "taint source" : String |
 | GlobalDataFlow.cs:359:41:359:41 | x : String | semmle.label | x : String |
 | GlobalDataFlow.cs:359:41:359:41 | x : String | semmle.label | x : String |

csharp/ql/test/library-tests/dataflow/types/Types.cs

@@ -19,26 +19,26 @@ class Types
     static void M1()
     {
         new C().M(); // no flow
-        new C().CallM(); // no flow (FALSE POSITIVE)
+        new C().CallM(); // no flow
         M2(new C()); // flow
-        M3(new C()); // no flow (FALSE POSITIVE)
+        M3(new C()); // no flow
         M4(new C()); // flow
         M5(new C()); // flow
         M6(new C()); // flow
         M7(new C()); // flow
-        M8(new C()); // no flow (FALSE POSITIVE)
+        M8(new C()); // no flow
         M9(new C()); // flow
 
         new D().M(); // flow
         new D().CallM(); // flow
-        M2(new D()); // no flow (FALSE POSITIVE)
+        M2(new D()); // no flow
         M3(new D()); // flow
-        M4(new D()); // no flow (FALSE POSITIVE)
+        M4(new D()); // no flow
         M5(new D()); // flow
         M6(new D()); // flow
         M7(new D()); // flow
         M8(new D()); // flow
-        M9(new D()); // no flow (FALSE POSITIVE)
+        M9(new D()); // no flow
 
         object o = null; // flow
         Sink(o);
@@ -97,7 +97,7 @@ class Types
         {
             void M3()
             {
-                this.M2(new E1()); // no flow (FALSE POSITIVE)
+                this.M2(new E1()); // no flow
             }
 
             public override void M() { }

csharp/ql/test/library-tests/dataflow/types/Types.expected

@@ -1,101 +1,71 @@
 edges
-| Types.cs:7:21:7:25 | this : C | Types.cs:7:32:7:35 | this access : C |
 | Types.cs:7:21:7:25 | this : D | Types.cs:7:32:7:35 | this access : D |
-| Types.cs:7:32:7:35 | this access : C | Types.cs:16:30:16:30 | this : C |
 | Types.cs:7:32:7:35 | this access : D | Types.cs:16:30:16:30 | this : D |
-| Types.cs:16:30:16:30 | this : C | Types.cs:16:42:16:45 | this access |
 | Types.cs:16:30:16:30 | this : D | Types.cs:16:42:16:45 | this access |
-| Types.cs:22:9:22:15 | object creation of type C : C | Types.cs:7:21:7:25 | this : C |
 | Types.cs:23:12:23:18 | object creation of type C : C | Types.cs:47:22:47:22 | a : C |
-| Types.cs:24:12:24:18 | object creation of type C : C | Types.cs:53:22:53:22 | a : C |
 | Types.cs:25:12:25:18 | object creation of type C : C | Types.cs:63:22:63:22 | a : C |
 | Types.cs:26:12:26:18 | object creation of type C : C | Types.cs:65:25:65:25 | x : C |
 | Types.cs:27:12:27:18 | object creation of type C : C | Types.cs:67:25:67:25 | x : C |
 | Types.cs:28:12:28:18 | object creation of type C : C | Types.cs:69:25:69:25 | x : C |
-| Types.cs:29:12:29:18 | object creation of type C : C | Types.cs:71:25:71:25 | x : C |
 | Types.cs:30:12:30:18 | object creation of type C : C | Types.cs:77:22:77:22 | a : C |
 | Types.cs:32:9:32:15 | object creation of type D : D | Types.cs:16:30:16:30 | this : D |
 | Types.cs:33:9:33:15 | object creation of type D : D | Types.cs:7:21:7:25 | this : D |
-| Types.cs:34:12:34:18 | object creation of type D : D | Types.cs:47:22:47:22 | a : D |
 | Types.cs:35:12:35:18 | object creation of type D : D | Types.cs:53:22:53:22 | a : D |
-| Types.cs:36:12:36:18 | object creation of type D : D | Types.cs:63:22:63:22 | a : D |
 | Types.cs:37:12:37:18 | object creation of type D : D | Types.cs:65:25:65:25 | x : D |
 | Types.cs:38:12:38:18 | object creation of type D : D | Types.cs:67:25:67:25 | x : D |
 | Types.cs:39:12:39:18 | object creation of type D : D | Types.cs:69:25:69:25 | x : D |
 | Types.cs:40:12:40:18 | object creation of type D : D | Types.cs:71:25:71:25 | x : D |
-| Types.cs:41:12:41:18 | object creation of type D : D | Types.cs:77:22:77:22 | a : D |
 | Types.cs:43:20:43:23 | null : null | Types.cs:44:14:44:14 | access to local variable o |
-| Types.cs:47:22:47:22 | a : C | Types.cs:50:18:50:18 | access to local variable c |
+| Types.cs:47:22:47:22 | a : C | Types.cs:49:18:49:20 | SSA def(c) : C |
-| Types.cs:47:22:47:22 | a : D | Types.cs:50:18:50:18 | access to local variable c |
+| Types.cs:49:18:49:20 | SSA def(c) : C | Types.cs:50:18:50:18 | access to local variable c |
-| Types.cs:53:22:53:22 | a : C | Types.cs:58:22:58:22 | access to local variable d |
+| Types.cs:53:22:53:22 | a : D | Types.cs:57:18:57:20 | SSA def(d) : D |
-| Types.cs:53:22:53:22 | a : D | Types.cs:58:22:58:22 | access to local variable d |
+| Types.cs:57:18:57:20 | SSA def(d) : D | Types.cs:58:22:58:22 | access to local variable d |
 | Types.cs:63:22:63:22 | a : C | Types.cs:63:33:63:36 | (...) ... |
-| Types.cs:63:22:63:22 | a : D | Types.cs:63:33:63:36 | (...) ... |
 | Types.cs:65:25:65:25 | x : C | Types.cs:65:36:65:36 | access to parameter x |
 | Types.cs:65:25:65:25 | x : D | Types.cs:65:36:65:36 | access to parameter x |
 | Types.cs:67:25:67:25 | x : C | Types.cs:67:48:67:48 | access to parameter x |
 | Types.cs:67:25:67:25 | x : D | Types.cs:67:48:67:48 | access to parameter x |
 | Types.cs:69:25:69:25 | x : C | Types.cs:69:52:69:52 | access to parameter x |
 | Types.cs:69:25:69:25 | x : D | Types.cs:69:52:69:52 | access to parameter x |
-| Types.cs:71:25:71:25 | x : C | Types.cs:73:21:73:21 | (...) ... : C |
 | Types.cs:71:25:71:25 | x : D | Types.cs:73:21:73:21 | (...) ... : D |
-| Types.cs:73:21:73:21 | (...) ... : C | Types.cs:74:9:74:9 | access to local variable d : C |
 | Types.cs:73:21:73:21 | (...) ... : D | Types.cs:74:9:74:9 | access to local variable d : D |
-| Types.cs:74:9:74:9 | access to local variable d : C | Types.cs:16:30:16:30 | this : C |
 | Types.cs:74:9:74:9 | access to local variable d : D | Types.cs:16:30:16:30 | this : D |
-| Types.cs:77:22:77:22 | a : C | Types.cs:80:18:80:18 | access to local variable b |
+| Types.cs:77:22:77:22 | a : C | Types.cs:79:18:79:25 | SSA def(b) : C |
-| Types.cs:77:22:77:22 | a : D | Types.cs:80:18:80:18 | access to local variable b |
+| Types.cs:79:18:79:25 | SSA def(b) : C | Types.cs:80:18:80:18 | access to local variable b |
-| Types.cs:90:22:90:22 | e : E1 | Types.cs:92:26:92:26 | access to parameter e : E1 |
 | Types.cs:90:22:90:22 | e : E2 | Types.cs:92:26:92:26 | access to parameter e : E2 |
-| Types.cs:92:13:92:16 | [post] this access [Field] : E1 | Types.cs:93:13:93:16 | this access [Field] : E1 |
 | Types.cs:92:13:92:16 | [post] this access [Field] : E2 | Types.cs:93:13:93:16 | this access [Field] : E2 |
-| Types.cs:92:26:92:26 | access to parameter e : E1 | Types.cs:92:13:92:16 | [post] this access [Field] : E1 |
 | Types.cs:92:26:92:26 | access to parameter e : E2 | Types.cs:92:13:92:16 | [post] this access [Field] : E2 |
-| Types.cs:93:13:93:16 | this access [Field] : E1 | Types.cs:113:34:113:34 | this [Field] : E1 |
 | Types.cs:93:13:93:16 | this access [Field] : E2 | Types.cs:113:34:113:34 | this [Field] : E2 |
-| Types.cs:100:25:100:32 | object creation of type E1 : E1 | Types.cs:90:22:90:22 | e : E1 |
 | Types.cs:110:25:110:32 | object creation of type E2 : E2 | Types.cs:90:22:90:22 | e : E2 |
-| Types.cs:113:34:113:34 | this [Field] : E1 | Types.cs:115:22:115:25 | this access [Field] : E1 |
 | Types.cs:113:34:113:34 | this [Field] : E2 | Types.cs:115:22:115:25 | this access [Field] : E2 |
-| Types.cs:115:22:115:25 | this access [Field] : E1 | Types.cs:115:22:115:31 | access to field Field |
 | Types.cs:115:22:115:25 | this access [Field] : E2 | Types.cs:115:22:115:31 | access to field Field |
 nodes
-| Types.cs:7:21:7:25 | this : C | semmle.label | this : C |
 | Types.cs:7:21:7:25 | this : D | semmle.label | this : D |
-| Types.cs:7:32:7:35 | this access : C | semmle.label | this access : C |
 | Types.cs:7:32:7:35 | this access : D | semmle.label | this access : D |
-| Types.cs:16:30:16:30 | this : C | semmle.label | this : C |
 | Types.cs:16:30:16:30 | this : D | semmle.label | this : D |
 | Types.cs:16:42:16:45 | this access | semmle.label | this access |
-| Types.cs:22:9:22:15 | object creation of type C : C | semmle.label | object creation of type C : C |
 | Types.cs:23:12:23:18 | object creation of type C : C | semmle.label | object creation of type C : C |
-| Types.cs:24:12:24:18 | object creation of type C : C | semmle.label | object creation of type C : C |
 | Types.cs:25:12:25:18 | object creation of type C : C | semmle.label | object creation of type C : C |
 | Types.cs:26:12:26:18 | object creation of type C : C | semmle.label | object creation of type C : C |
 | Types.cs:27:12:27:18 | object creation of type C : C | semmle.label | object creation of type C : C |
 | Types.cs:28:12:28:18 | object creation of type C : C | semmle.label | object creation of type C : C |
-| Types.cs:29:12:29:18 | object creation of type C : C | semmle.label | object creation of type C : C |
 | Types.cs:30:12:30:18 | object creation of type C : C | semmle.label | object creation of type C : C |
 | Types.cs:32:9:32:15 | object creation of type D : D | semmle.label | object creation of type D : D |
 | Types.cs:33:9:33:15 | object creation of type D : D | semmle.label | object creation of type D : D |
-| Types.cs:34:12:34:18 | object creation of type D : D | semmle.label | object creation of type D : D |
 | Types.cs:35:12:35:18 | object creation of type D : D | semmle.label | object creation of type D : D |
-| Types.cs:36:12:36:18 | object creation of type D : D | semmle.label | object creation of type D : D |
 | Types.cs:37:12:37:18 | object creation of type D : D | semmle.label | object creation of type D : D |
 | Types.cs:38:12:38:18 | object creation of type D : D | semmle.label | object creation of type D : D |
 | Types.cs:39:12:39:18 | object creation of type D : D | semmle.label | object creation of type D : D |
 | Types.cs:40:12:40:18 | object creation of type D : D | semmle.label | object creation of type D : D |
-| Types.cs:41:12:41:18 | object creation of type D : D | semmle.label | object creation of type D : D |
 | Types.cs:43:20:43:23 | null : null | semmle.label | null : null |
 | Types.cs:44:14:44:14 | access to local variable o | semmle.label | access to local variable o |
 | Types.cs:47:22:47:22 | a : C | semmle.label | a : C |
-| Types.cs:47:22:47:22 | a : D | semmle.label | a : D |
+| Types.cs:49:18:49:20 | SSA def(c) : C | semmle.label | SSA def(c) : C |
 | Types.cs:50:18:50:18 | access to local variable c | semmle.label | access to local variable c |
-| Types.cs:53:22:53:22 | a : C | semmle.label | a : C |
 | Types.cs:53:22:53:22 | a : D | semmle.label | a : D |
+| Types.cs:57:18:57:20 | SSA def(d) : D | semmle.label | SSA def(d) : D |
 | Types.cs:58:22:58:22 | access to local variable d | semmle.label | access to local variable d |
 | Types.cs:63:22:63:22 | a : C | semmle.label | a : C |
-| Types.cs:63:22:63:22 | a : D | semmle.label | a : D |
 | Types.cs:63:33:63:36 | (...) ... | semmle.label | (...) ... |
 | Types.cs:65:25:65:25 | x : C | semmle.label | x : C |
 | Types.cs:65:25:65:25 | x : D | semmle.label | x : D |
@@ -106,50 +76,33 @@ nodes
 | Types.cs:69:25:69:25 | x : C | semmle.label | x : C |
 | Types.cs:69:25:69:25 | x : D | semmle.label | x : D |
 | Types.cs:69:52:69:52 | access to parameter x | semmle.label | access to parameter x |
-| Types.cs:71:25:71:25 | x : C | semmle.label | x : C |
 | Types.cs:71:25:71:25 | x : D | semmle.label | x : D |
-| Types.cs:73:21:73:21 | (...) ... : C | semmle.label | (...) ... : C |
 | Types.cs:73:21:73:21 | (...) ... : D | semmle.label | (...) ... : D |
-| Types.cs:74:9:74:9 | access to local variable d : C | semmle.label | access to local variable d : C |
 | Types.cs:74:9:74:9 | access to local variable d : D | semmle.label | access to local variable d : D |
 | Types.cs:77:22:77:22 | a : C | semmle.label | a : C |
-| Types.cs:77:22:77:22 | a : D | semmle.label | a : D |
+| Types.cs:79:18:79:25 | SSA def(b) : C | semmle.label | SSA def(b) : C |
 | Types.cs:80:18:80:18 | access to local variable b | semmle.label | access to local variable b |
-| Types.cs:90:22:90:22 | e : E1 | semmle.label | e : E1 |
 | Types.cs:90:22:90:22 | e : E2 | semmle.label | e : E2 |
-| Types.cs:92:13:92:16 | [post] this access [Field] : E1 | semmle.label | [post] this access [Field] : E1 |
 | Types.cs:92:13:92:16 | [post] this access [Field] : E2 | semmle.label | [post] this access [Field] : E2 |
-| Types.cs:92:26:92:26 | access to parameter e : E1 | semmle.label | access to parameter e : E1 |
 | Types.cs:92:26:92:26 | access to parameter e : E2 | semmle.label | access to parameter e : E2 |
-| Types.cs:93:13:93:16 | this access [Field] : E1 | semmle.label | this access [Field] : E1 |
 | Types.cs:93:13:93:16 | this access [Field] : E2 | semmle.label | this access [Field] : E2 |
-| Types.cs:100:25:100:32 | object creation of type E1 : E1 | semmle.label | object creation of type E1 : E1 |
 | Types.cs:110:25:110:32 | object creation of type E2 : E2 | semmle.label | object creation of type E2 : E2 |
-| Types.cs:113:34:113:34 | this [Field] : E1 | semmle.label | this [Field] : E1 |
 | Types.cs:113:34:113:34 | this [Field] : E2 | semmle.label | this [Field] : E2 |
-| Types.cs:115:22:115:25 | this access [Field] : E1 | semmle.label | this access [Field] : E1 |
 | Types.cs:115:22:115:25 | this access [Field] : E2 | semmle.label | this access [Field] : E2 |
 | Types.cs:115:22:115:31 | access to field Field | semmle.label | access to field Field |
 #select
-| Types.cs:22:9:22:15 | object creation of type C : C | Types.cs:16:42:16:45 | this access | Types.cs:16:42:16:45 | this access | $@ | Types.cs:16:42:16:45 | this access | this access |
 | Types.cs:23:12:23:18 | object creation of type C : C | Types.cs:50:18:50:18 | access to local variable c | Types.cs:50:18:50:18 | access to local variable c | $@ | Types.cs:50:18:50:18 | access to local variable c | access to local variable c |
-| Types.cs:24:12:24:18 | object creation of type C : C | Types.cs:58:22:58:22 | access to local variable d | Types.cs:58:22:58:22 | access to local variable d | $@ | Types.cs:58:22:58:22 | access to local variable d | access to local variable d |
 | Types.cs:25:12:25:18 | object creation of type C : C | Types.cs:63:33:63:36 | (...) ... | Types.cs:63:33:63:36 | (...) ... | $@ | Types.cs:63:33:63:36 | (...) ... | (...) ... |
 | Types.cs:26:12:26:18 | object creation of type C : C | Types.cs:65:36:65:36 | access to parameter x | Types.cs:65:36:65:36 | access to parameter x | $@ | Types.cs:65:36:65:36 | access to parameter x | access to parameter x |
 | Types.cs:27:12:27:18 | object creation of type C : C | Types.cs:67:48:67:48 | access to parameter x | Types.cs:67:48:67:48 | access to parameter x | $@ | Types.cs:67:48:67:48 | access to parameter x | access to parameter x |
 | Types.cs:28:12:28:18 | object creation of type C : C | Types.cs:69:52:69:52 | access to parameter x | Types.cs:69:52:69:52 | access to parameter x | $@ | Types.cs:69:52:69:52 | access to parameter x | access to parameter x |
-| Types.cs:29:12:29:18 | object creation of type C : C | Types.cs:16:42:16:45 | this access | Types.cs:16:42:16:45 | this access | $@ | Types.cs:16:42:16:45 | this access | this access |
 | Types.cs:30:12:30:18 | object creation of type C : C | Types.cs:80:18:80:18 | access to local variable b | Types.cs:80:18:80:18 | access to local variable b | $@ | Types.cs:80:18:80:18 | access to local variable b | access to local variable b |
 | Types.cs:32:9:32:15 | object creation of type D : D | Types.cs:16:42:16:45 | this access | Types.cs:16:42:16:45 | this access | $@ | Types.cs:16:42:16:45 | this access | this access |
 | Types.cs:33:9:33:15 | object creation of type D : D | Types.cs:16:42:16:45 | this access | Types.cs:16:42:16:45 | this access | $@ | Types.cs:16:42:16:45 | this access | this access |
-| Types.cs:34:12:34:18 | object creation of type D : D | Types.cs:50:18:50:18 | access to local variable c | Types.cs:50:18:50:18 | access to local variable c | $@ | Types.cs:50:18:50:18 | access to local variable c | access to local variable c |
 | Types.cs:35:12:35:18 | object creation of type D : D | Types.cs:58:22:58:22 | access to local variable d | Types.cs:58:22:58:22 | access to local variable d | $@ | Types.cs:58:22:58:22 | access to local variable d | access to local variable d |
-| Types.cs:36:12:36:18 | object creation of type D : D | Types.cs:63:33:63:36 | (...) ... | Types.cs:63:33:63:36 | (...) ... | $@ | Types.cs:63:33:63:36 | (...) ... | (...) ... |
 | Types.cs:37:12:37:18 | object creation of type D : D | Types.cs:65:36:65:36 | access to parameter x | Types.cs:65:36:65:36 | access to parameter x | $@ | Types.cs:65:36:65:36 | access to parameter x | access to parameter x |
 | Types.cs:38:12:38:18 | object creation of type D : D | Types.cs:67:48:67:48 | access to parameter x | Types.cs:67:48:67:48 | access to parameter x | $@ | Types.cs:67:48:67:48 | access to parameter x | access to parameter x |
 | Types.cs:39:12:39:18 | object creation of type D : D | Types.cs:69:52:69:52 | access to parameter x | Types.cs:69:52:69:52 | access to parameter x | $@ | Types.cs:69:52:69:52 | access to parameter x | access to parameter x |
 | Types.cs:40:12:40:18 | object creation of type D : D | Types.cs:16:42:16:45 | this access | Types.cs:16:42:16:45 | this access | $@ | Types.cs:16:42:16:45 | this access | this access |
-| Types.cs:41:12:41:18 | object creation of type D : D | Types.cs:80:18:80:18 | access to local variable b | Types.cs:80:18:80:18 | access to local variable b | $@ | Types.cs:80:18:80:18 | access to local variable b | access to local variable b |
 | Types.cs:43:20:43:23 | null : null | Types.cs:44:14:44:14 | access to local variable o | Types.cs:44:14:44:14 | access to local variable o | $@ | Types.cs:44:14:44:14 | access to local variable o | access to local variable o |
-| Types.cs:100:25:100:32 | object creation of type E1 : E1 | Types.cs:115:22:115:31 | access to field Field | Types.cs:115:22:115:31 | access to field Field | $@ | Types.cs:115:22:115:31 | access to field Field | access to field Field |
 | Types.cs:110:25:110:32 | object creation of type E2 : E2 | Types.cs:115:22:115:31 | access to field Field | Types.cs:115:22:115:31 | access to field Field | $@ | Types.cs:115:22:115:31 | access to field Field | access to field Field |

csharp/ql/test/query-tests/Security Features/CWE-078/CommandInjection.expected

@@ -1,13 +1,15 @@
 edges
-| CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:26:27:26:47 | ... + ... |
+| CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:25:32:25:51 | access to property Text : String |
-| CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:26:50:26:66 | ... + ... |
+| CommandInjection.cs:25:32:25:51 | access to property Text : String | CommandInjection.cs:26:27:26:47 | ... + ... |
-| CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:28:63:28:71 | access to local variable userInput |
+| CommandInjection.cs:25:32:25:51 | access to property Text : String | CommandInjection.cs:26:50:26:66 | ... + ... |
-| CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:28:74:28:82 | access to local variable userInput |
+| CommandInjection.cs:25:32:25:51 | access to property Text : String | CommandInjection.cs:28:63:28:71 | access to local variable userInput |
-| CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:32:39:32:47 | access to local variable userInput |
+| CommandInjection.cs:25:32:25:51 | access to property Text : String | CommandInjection.cs:28:74:28:82 | access to local variable userInput |
-| CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:33:40:33:48 | access to local variable userInput |
+| CommandInjection.cs:25:32:25:51 | access to property Text : String | CommandInjection.cs:32:39:32:47 | access to local variable userInput |
-| CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:34:47:34:55 | access to local variable userInput |
+| CommandInjection.cs:25:32:25:51 | access to property Text : String | CommandInjection.cs:33:40:33:48 | access to local variable userInput |
+| CommandInjection.cs:25:32:25:51 | access to property Text : String | CommandInjection.cs:34:47:34:55 | access to local variable userInput |
 nodes
 | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | semmle.label | access to field categoryTextBox : TextBox |
+| CommandInjection.cs:25:32:25:51 | access to property Text : String | semmle.label | access to property Text : String |
 | CommandInjection.cs:26:27:26:47 | ... + ... | semmle.label | ... + ... |
 | CommandInjection.cs:26:50:26:66 | ... + ... | semmle.label | ... + ... |
 | CommandInjection.cs:28:63:28:71 | access to local variable userInput | semmle.label | access to local variable userInput |

csharp/ql/test/query-tests/Security Features/CWE-089/SqlInjection.expected

@@ -1,12 +1,16 @@
 edges
-| SqlInjection.cs:38:21:38:35 | access to field categoryTextBox : TextBox | SqlInjection.cs:39:50:39:55 | access to local variable query1 |
+| SqlInjection.cs:38:21:38:35 | access to field categoryTextBox : TextBox | SqlInjection.cs:38:21:38:40 | access to property Text : String |
-| SqlInjection.cs:73:33:73:47 | access to field categoryTextBox : TextBox | SqlInjection.cs:74:56:74:61 | access to local variable query1 |
+| SqlInjection.cs:38:21:38:40 | access to property Text : String | SqlInjection.cs:39:50:39:55 | access to local variable query1 |
-| SqlInjection.cs:73:33:73:47 | access to field categoryTextBox : TextBox | SqlInjection.cs:75:55:75:60 | access to local variable query1 |
+| SqlInjection.cs:73:33:73:47 | access to field categoryTextBox : TextBox | SqlInjection.cs:73:33:73:52 | access to property Text : String |
+| SqlInjection.cs:73:33:73:52 | access to property Text : String | SqlInjection.cs:74:56:74:61 | access to local variable query1 |
+| SqlInjection.cs:73:33:73:52 | access to property Text : String | SqlInjection.cs:75:55:75:60 | access to local variable query1 |
 | SqlInjection.cs:87:21:87:29 | access to property Text : String | SqlInjection.cs:88:50:88:55 | access to local variable query1 |
 nodes
 | SqlInjection.cs:38:21:38:35 | access to field categoryTextBox : TextBox | semmle.label | access to field categoryTextBox : TextBox |
+| SqlInjection.cs:38:21:38:40 | access to property Text : String | semmle.label | access to property Text : String |
 | SqlInjection.cs:39:50:39:55 | access to local variable query1 | semmle.label | access to local variable query1 |
 | SqlInjection.cs:73:33:73:47 | access to field categoryTextBox : TextBox | semmle.label | access to field categoryTextBox : TextBox |
+| SqlInjection.cs:73:33:73:52 | access to property Text : String | semmle.label | access to property Text : String |
 | SqlInjection.cs:74:56:74:61 | access to local variable query1 | semmle.label | access to local variable query1 |
 | SqlInjection.cs:75:55:75:60 | access to local variable query1 | semmle.label | access to local variable query1 |
 | SqlInjection.cs:87:21:87:29 | access to property Text : String | semmle.label | access to property Text : String |

csharp/ql/test/query-tests/Security Features/CWE-807/ConditionalBypass.expected

@@ -1,23 +1,33 @@
 edges
 | ConditionalBypass.cs:14:26:14:48 | access to property QueryString : NameValueCollection | ConditionalBypass.cs:18:13:18:30 | ... == ... |
-| ConditionalBypass.cs:21:34:21:52 | access to property Cookies : HttpCookieCollection | ConditionalBypass.cs:24:13:24:45 | call to method Equals |
+| ConditionalBypass.cs:21:34:21:52 | access to property Cookies : HttpCookieCollection | ConditionalBypass.cs:24:13:24:29 | access to property Value : String |
-| ConditionalBypass.cs:21:34:21:52 | access to property Cookies : HttpCookieCollection | ConditionalBypass.cs:29:13:29:40 | ... == ... |
+| ConditionalBypass.cs:21:34:21:52 | access to property Cookies : HttpCookieCollection | ConditionalBypass.cs:29:13:29:29 | access to property Value : String |
-| ConditionalBypass.cs:44:32:44:66 | call to method GetHostByAddress : IPHostEntry | ConditionalBypass.cs:46:13:46:46 | ... == ... |
+| ConditionalBypass.cs:24:13:24:29 | access to property Value : String | ConditionalBypass.cs:24:13:24:45 | call to method Equals |
+| ConditionalBypass.cs:29:13:29:29 | access to property Value : String | ConditionalBypass.cs:29:13:29:40 | ... == ... |
+| ConditionalBypass.cs:44:32:44:66 | call to method GetHostByAddress : IPHostEntry | ConditionalBypass.cs:46:13:46:29 | access to property HostName : String |
 | ConditionalBypass.cs:44:32:44:66 | call to method GetHostByAddress : IPHostEntry | ConditionalBypass.cs:51:13:51:29 | access to property HostName |
-| ConditionalBypass.cs:72:34:72:52 | access to property Cookies : HttpCookieCollection | ConditionalBypass.cs:74:13:74:40 | ... == ... |
+| ConditionalBypass.cs:46:13:46:29 | access to property HostName : String | ConditionalBypass.cs:46:13:46:46 | ... == ... |
-| ConditionalBypass.cs:85:34:85:52 | access to property Cookies : HttpCookieCollection | ConditionalBypass.cs:86:13:86:40 | ... == ... |
+| ConditionalBypass.cs:72:34:72:52 | access to property Cookies : HttpCookieCollection | ConditionalBypass.cs:74:13:74:29 | access to property Value : String |
+| ConditionalBypass.cs:74:13:74:29 | access to property Value : String | ConditionalBypass.cs:74:13:74:40 | ... == ... |
+| ConditionalBypass.cs:85:34:85:52 | access to property Cookies : HttpCookieCollection | ConditionalBypass.cs:86:13:86:29 | access to property Value : String |
+| ConditionalBypass.cs:86:13:86:29 | access to property Value : String | ConditionalBypass.cs:86:13:86:40 | ... == ... |
 nodes
 | ConditionalBypass.cs:14:26:14:48 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection |
 | ConditionalBypass.cs:18:13:18:30 | ... == ... | semmle.label | ... == ... |
 | ConditionalBypass.cs:21:34:21:52 | access to property Cookies : HttpCookieCollection | semmle.label | access to property Cookies : HttpCookieCollection |
+| ConditionalBypass.cs:24:13:24:29 | access to property Value : String | semmle.label | access to property Value : String |
 | ConditionalBypass.cs:24:13:24:45 | call to method Equals | semmle.label | call to method Equals |
+| ConditionalBypass.cs:29:13:29:29 | access to property Value : String | semmle.label | access to property Value : String |
 | ConditionalBypass.cs:29:13:29:40 | ... == ... | semmle.label | ... == ... |
 | ConditionalBypass.cs:44:32:44:66 | call to method GetHostByAddress : IPHostEntry | semmle.label | call to method GetHostByAddress : IPHostEntry |
+| ConditionalBypass.cs:46:13:46:29 | access to property HostName : String | semmle.label | access to property HostName : String |
 | ConditionalBypass.cs:46:13:46:46 | ... == ... | semmle.label | ... == ... |
 | ConditionalBypass.cs:51:13:51:29 | access to property HostName | semmle.label | access to property HostName |
 | ConditionalBypass.cs:72:34:72:52 | access to property Cookies : HttpCookieCollection | semmle.label | access to property Cookies : HttpCookieCollection |
+| ConditionalBypass.cs:74:13:74:29 | access to property Value : String | semmle.label | access to property Value : String |
 | ConditionalBypass.cs:74:13:74:40 | ... == ... | semmle.label | ... == ... |
 | ConditionalBypass.cs:85:34:85:52 | access to property Cookies : HttpCookieCollection | semmle.label | access to property Cookies : HttpCookieCollection |
+| ConditionalBypass.cs:86:13:86:29 | access to property Value : String | semmle.label | access to property Value : String |
 | ConditionalBypass.cs:86:13:86:40 | ... == ... | semmle.label | ... == ... |
 #select
 | ConditionalBypass.cs:19:13:19:33 | call to method login | ConditionalBypass.cs:14:26:14:48 | access to property QueryString : NameValueCollection | ConditionalBypass.cs:18:13:18:30 | ... == ... | Sensitive method may not be executed depending on $@, which flows from $@. | ConditionalBypass.cs:18:13:18:30 | ... == ... | this condition | ConditionalBypass.cs:14:26:14:48 | access to property QueryString | user input |