From 5a77128a8bcf9b090d76b6dc09cf53f0ecd20815 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Mon, 23 Mar 2026 11:27:05 +0000
Subject: [PATCH 001/185] C++: Disable cpp/implicit-function-declaration on BMN
databases.
---
.../Underspecified Functions/ImplicitFunctionDeclaration.ql | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql b/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql
index 6a55557cf70..007ef71a163 100644
--- a/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql
+++ b/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql
@@ -17,6 +17,11 @@ import TooFewArguments
import TooManyArguments
import semmle.code.cpp.commons.Exclusions
+/*
+ * This query is not compatible with build mode: none databases, and has
+ * no results on those databases.
+ */
+
predicate locInfo(Locatable e, File file, int line, int col) {
e.getFile() = file and
e.getLocation().getStartLine() = line and
@@ -39,6 +44,7 @@ predicate isCompiledAsC(File f) {
from FunctionDeclarationEntry fdeIm, FunctionCall fc
where
isCompiledAsC(fdeIm.getFile()) and
+ not any(Compilation c).buildModeNone() and
not isFromMacroDefinition(fc) and
fdeIm.isImplicit() and
sameLocation(fdeIm, fc) and
From 39056e44771373f23bcd8a561bbf60a6c0122e60 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Mon, 23 Mar 2026 12:28:12 +0000
Subject: [PATCH 002/185] C++: Change note.
---
.../change-notes/2026-03-23-implicit-function-declaration.md | 4 ++++
1 file changed, 4 insertions(+)
create mode 100644 cpp/ql/src/change-notes/2026-03-23-implicit-function-declaration.md
diff --git a/cpp/ql/src/change-notes/2026-03-23-implicit-function-declaration.md b/cpp/ql/src/change-notes/2026-03-23-implicit-function-declaration.md
new file mode 100644
index 00000000000..8c2c431ec24
--- /dev/null
+++ b/cpp/ql/src/change-notes/2026-03-23-implicit-function-declaration.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The "Implicit function declaration" (`cpp/implicit-function-declaration`) query no longer produces results on `build mode: none` databases. These results were found to be very noisy and fundamentally imprecise in this mode.
From 55d16e8781602f1e6542e3b4bd6d38c7d2250975 Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Wed, 25 Mar 2026 10:58:16 +0100
Subject: [PATCH 003/185] Remove false-positive `command-injection` sink model
for `step-security/harden-runner`
The `allowed-endpoints` input only flows to `execFileSync("echo", [content])`
(no shell) and `fs.writeFileSync` (JSON config), neither of which is a
command injection vector.
Fixes https://github.com/github/codeql/issues/21568
---
.../ql/lib/ext/manual/step-security_harden-runner.model.yml | 6 ------
1 file changed, 6 deletions(-)
delete mode 100644 actions/ql/lib/ext/manual/step-security_harden-runner.model.yml
diff --git a/actions/ql/lib/ext/manual/step-security_harden-runner.model.yml b/actions/ql/lib/ext/manual/step-security_harden-runner.model.yml
deleted file mode 100644
index 129c8beb020..00000000000
--- a/actions/ql/lib/ext/manual/step-security_harden-runner.model.yml
+++ /dev/null
@@ -1,6 +0,0 @@
-extensions:
- - addsTo:
- pack: codeql/actions-all
- extensible: actionsSinkModel
- data:
- - ["step-security/harden-runner", "*", "input.allowed-endpoints", "command-injection", "manual"]
From e8075455913cfcfc05dfb02d882396c08ed24c8d Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Thu, 26 Mar 2026 09:08:34 +0100
Subject: [PATCH 004/185] Remove false positive `docker/build-push-action`
`context` sink model
The `context` input is passed as a single array element through
`docker/actions-toolkit` and `@actions/exec` all the way to
`child_process.spawn()`, which does not perform shell splitting.
No code injection is possible.
Fixes https://github.com/github/codeql/issues/21428
---
.../ql/lib/ext/manual/docker_build-push-action.model.yml | 6 ------
1 file changed, 6 deletions(-)
delete mode 100644 actions/ql/lib/ext/manual/docker_build-push-action.model.yml
diff --git a/actions/ql/lib/ext/manual/docker_build-push-action.model.yml b/actions/ql/lib/ext/manual/docker_build-push-action.model.yml
deleted file mode 100644
index 116c231c30a..00000000000
--- a/actions/ql/lib/ext/manual/docker_build-push-action.model.yml
+++ /dev/null
@@ -1,6 +0,0 @@
-extensions:
- - addsTo:
- pack: codeql/actions-all
- extensible: actionsSinkModel
- data:
- - ["docker/build-push-action", "*", "input.context", "code-injection", "manual"]
\ No newline at end of file
From e0bc18c22866b5808817754bd820d1da53478214 Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Thu, 26 Mar 2026 09:11:25 +0100
Subject: [PATCH 005/185] Add changenote for false positive sink model removals
---
.../change-notes/2026-03-26-remove-false-positive-sinks.md | 4 ++++
1 file changed, 4 insertions(+)
create mode 100644 actions/ql/lib/change-notes/2026-03-26-remove-false-positive-sinks.md
diff --git a/actions/ql/lib/change-notes/2026-03-26-remove-false-positive-sinks.md b/actions/ql/lib/change-notes/2026-03-26-remove-false-positive-sinks.md
new file mode 100644
index 00000000000..20ccc6d6c02
--- /dev/null
+++ b/actions/ql/lib/change-notes/2026-03-26-remove-false-positive-sinks.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Removed false positive injection sink models for the `context` input of `docker/build-push-action` and the `allowed-endpoints` input of `step-security/harden-runner`.
From 824d004a2700080b8fb4bb3d2e3a02f85fd8e30a Mon Sep 17 00:00:00 2001
From: Taus
Date: Thu, 26 Mar 2026 14:40:54 +0000
Subject: [PATCH 006/185] Python: Convert BindToAllInterfaces test to inline
expectations
---
.../Security/CVE-2018-1281/BindToAllInterfaces.qlref | 3 ++-
.../Security/CVE-2018-1281/BindToAllInterfaces_test.py | 10 +++++-----
2 files changed, 7 insertions(+), 6 deletions(-)
diff --git a/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces.qlref b/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces.qlref
index f06cc3d869d..6396fd91863 100644
--- a/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces.qlref
+++ b/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces.qlref
@@ -1 +1,2 @@
-Security/CVE-2018-1281/BindToAllInterfaces.ql
\ No newline at end of file
+query: Security/CVE-2018-1281/BindToAllInterfaces.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
\ No newline at end of file
diff --git a/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces_test.py b/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces_test.py
index bbab44d8103..93ed0364a29 100644
--- a/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces_test.py
+++ b/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces_test.py
@@ -2,11 +2,11 @@ import socket
# binds to all interfaces, insecure
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-s.bind(('0.0.0.0', 31137))
+s.bind(('0.0.0.0', 31137)) # $ Alert[py/bind-socket-all-network-interfaces]
# binds to all interfaces, insecure
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-s.bind(('', 4040))
+s.bind(('', 4040)) # $ Alert[py/bind-socket-all-network-interfaces]
# binds only to a dedicated interface, secure
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
@@ -14,13 +14,13 @@ s.bind(('84.68.10.12', 8080))
# binds to all interfaces, insecure
ALL_LOCALS = "0.0.0.0"
-s.bind((ALL_LOCALS, 9090))
+s.bind((ALL_LOCALS, 9090)) # $ Alert[py/bind-socket-all-network-interfaces]
# binds to all interfaces, insecure
tup = (ALL_LOCALS, 8080)
-s.bind(tup)
+s.bind(tup) # $ Alert[py/bind-socket-all-network-interfaces]
# IPv6
s = socket.socket(socket.AF_INET6, socket.SOCK_STREAM)
-s.bind(("::", 8080)) # NOT OK
+s.bind(("::", 8080)) # $ Alert[py/bind-socket-all-network-interfaces]
From 1ecd9e83b8566c9028cec3d33097f157a2b3bde1 Mon Sep 17 00:00:00 2001
From: Taus
Date: Thu, 26 Mar 2026 14:51:59 +0000
Subject: [PATCH 007/185] Python: Add test cases for BindToAllInterfaces FNs
Adds test cases from github/codeql#21582 demonstrating false negatives:
- Address stored in class attribute (`self.bind_addr`)
- `os.environ.get` with insecure default value
- `gevent.socket` (alternative socket module)
---
.../CVE-2018-1281/BindToAllInterfaces_test.py | 32 +++++++++++++++++++
1 file changed, 32 insertions(+)
diff --git a/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces_test.py b/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces_test.py
index 93ed0364a29..5a13aa9c4e3 100644
--- a/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces_test.py
+++ b/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces_test.py
@@ -24,3 +24,35 @@ s.bind(tup) # $ Alert[py/bind-socket-all-network-interfaces]
# IPv6
s = socket.socket(socket.AF_INET6, socket.SOCK_STREAM)
s.bind(("::", 8080)) # $ Alert[py/bind-socket-all-network-interfaces]
+
+
+# FN cases from https://github.com/github/codeql/issues/21582
+
+# Address stored in a class attribute
+class Server:
+ def __init__(self):
+ self.bind_addr = '0.0.0.0'
+ self.port = 31137
+
+ def start(self):
+ s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+ s.bind((self.bind_addr, self.port)) # $ MISSING: Alert[py/bind-socket-all-network-interfaces]
+
+server = Server()
+server.start()
+
+# os.environ.get with insecure default
+import os
+host = os.environ.get('APP_HOST', '0.0.0.0')
+s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+s.bind((host, 8080)) # $ MISSING: Alert[py/bind-socket-all-network-interfaces]
+
+# gevent.socket (alternative socket module)
+from gevent import socket as gsocket
+gs = gsocket.socket(gsocket.AF_INET, gsocket.SOCK_STREAM)
+gs.bind(('0.0.0.0', 31137)) # $ MISSING: Alert[py/bind-socket-all-network-interfaces]
+
+# eventlet.green.socket (another alternative socket module)
+from eventlet.green import socket as esocket
+es = esocket.socket(esocket.AF_INET, esocket.SOCK_STREAM)
+es.bind(('0.0.0.0', 31137)) # $ MISSING: Alert[py/bind-socket-all-network-interfaces]
From c439fc5d4519e8688115bc297a818f3420279e3e Mon Sep 17 00:00:00 2001
From: Taus
Date: Thu, 26 Mar 2026 14:53:18 +0000
Subject: [PATCH 008/185] Python: Replace type tracking with global data-flow
This takes care of most of the false negatives from the preceding
commit.
Additionally, we add models for some known wrappers of `socket.socket`
from the `gevent` and `eventlet` packages.
---
.../python/frameworks/Eventlet.model.yml | 9 ++++
.../semmle/python/frameworks/Gevent.model.yml | 7 +++
.../semmle/python/frameworks/Stdlib.model.yml | 4 ++
.../CVE-2018-1281/BindToAllInterfaces.ql | 53 ++++++-------------
.../BindToAllInterfaces.expected | 4 ++
.../CVE-2018-1281/BindToAllInterfaces_test.py | 8 +--
shared/mad/codeql/mad/ModelValidation.qll | 2 +-
7 files changed, 44 insertions(+), 43 deletions(-)
create mode 100644 python/ql/lib/semmle/python/frameworks/Eventlet.model.yml
create mode 100644 python/ql/lib/semmle/python/frameworks/Gevent.model.yml
diff --git a/python/ql/lib/semmle/python/frameworks/Eventlet.model.yml b/python/ql/lib/semmle/python/frameworks/Eventlet.model.yml
new file mode 100644
index 00000000000..f60b9218819
--- /dev/null
+++ b/python/ql/lib/semmle/python/frameworks/Eventlet.model.yml
@@ -0,0 +1,9 @@
+extensions:
+ - addsTo:
+ pack: codeql/python-all
+ extensible: typeModel
+ data:
+ # See https://eventlet.readthedocs.io/en/latest/patching.html
+ - ['socket.socket', 'eventlet', 'Member[green].Member[socket].Member[socket].ReturnValue']
+ # eventlet also re-exports as eventlet.socket for convenience
+ - ['socket.socket', 'eventlet', 'Member[socket].Member[socket].ReturnValue']
diff --git a/python/ql/lib/semmle/python/frameworks/Gevent.model.yml b/python/ql/lib/semmle/python/frameworks/Gevent.model.yml
new file mode 100644
index 00000000000..974ecedd073
--- /dev/null
+++ b/python/ql/lib/semmle/python/frameworks/Gevent.model.yml
@@ -0,0 +1,7 @@
+extensions:
+ - addsTo:
+ pack: codeql/python-all
+ extensible: typeModel
+ data:
+ # See https://www.gevent.org/api/gevent.socket.html
+ - ['socket.socket', 'gevent', 'Member[socket].Member[socket].ReturnValue']
diff --git a/python/ql/lib/semmle/python/frameworks/Stdlib.model.yml b/python/ql/lib/semmle/python/frameworks/Stdlib.model.yml
index a01bf1b40ba..5b50dff313e 100644
--- a/python/ql/lib/semmle/python/frameworks/Stdlib.model.yml
+++ b/python/ql/lib/semmle/python/frameworks/Stdlib.model.yml
@@ -27,6 +27,8 @@ extensions:
extensible: sinkModel
data:
- ["zipfile.ZipFile","Member[extractall].Argument[0,path:]", "path-injection"]
+ # See https://docs.python.org/3/library/socket.html#socket.socket.bind
+ - ["socket.socket", "Member[bind].Argument[0,address:]", "bind-socket-all-interfaces"]
- addsTo:
pack: codeql/python-all
@@ -184,6 +186,8 @@ extensions:
pack: codeql/python-all
extensible: typeModel
data:
+ # See https://docs.python.org/3/library/socket.html#socket.socket
+ - ['socket.socket', 'socket', 'Member[socket].ReturnValue']
# See https://docs.python.org/3/library/urllib.parse.html#urllib.parse.urlparse
- ["urllib.parse.ParseResult~Subclass", 'urllib', 'Member[parse].Member[urlparse]']
diff --git a/python/ql/src/Security/CVE-2018-1281/BindToAllInterfaces.ql b/python/ql/src/Security/CVE-2018-1281/BindToAllInterfaces.ql
index 5e2e27b3bf4..39d0c6b6237 100644
--- a/python/ql/src/Security/CVE-2018-1281/BindToAllInterfaces.ql
+++ b/python/ql/src/Security/CVE-2018-1281/BindToAllInterfaces.ql
@@ -14,7 +14,8 @@
import python
import semmle.python.dataflow.new.DataFlow
-import semmle.python.ApiGraphs
+import semmle.python.dataflow.new.TaintTracking
+private import semmle.python.frameworks.data.ModelsAsData
/** Gets a hostname that can be used to bind to all interfaces. */
private string vulnerableHostname() {
@@ -26,45 +27,21 @@ private string vulnerableHostname() {
]
}
-/** Gets a reference to a hostname that can be used to bind to all interfaces. */
-private DataFlow::TypeTrackingNode vulnerableHostnameRef(DataFlow::TypeTracker t, string hostname) {
- t.start() and
- exists(StringLiteral allInterfacesStringLiteral | hostname = vulnerableHostname() |
- allInterfacesStringLiteral.getText() = hostname and
- result.asExpr() = allInterfacesStringLiteral
- )
- or
- exists(DataFlow::TypeTracker t2 | result = vulnerableHostnameRef(t2, hostname).track(t2, t))
+private module BindToAllInterfacesConfig implements DataFlow::ConfigSig {
+ predicate isSource(DataFlow::Node source) {
+ source.asExpr().(StringLiteral).getText() = vulnerableHostname()
+ }
+
+ predicate isSink(DataFlow::Node sink) {
+ ModelOutput::sinkNode(sink, "bind-socket-all-interfaces")
+ }
}
-/** Gets a reference to a hostname that can be used to bind to all interfaces. */
-DataFlow::Node vulnerableHostnameRef(string hostname) {
- vulnerableHostnameRef(DataFlow::TypeTracker::end(), hostname).flowsTo(result)
-}
+private module BindToAllInterfacesFlow = TaintTracking::Global;
-/** Gets a reference to a tuple for which the first element is a hostname that can be used to bind to all interfaces. */
-private DataFlow::TypeTrackingNode vulnerableAddressTuple(DataFlow::TypeTracker t, string hostname) {
- t.start() and
- result.asExpr() = any(Tuple tup | tup.getElt(0) = vulnerableHostnameRef(hostname).asExpr())
- or
- exists(DataFlow::TypeTracker t2 | result = vulnerableAddressTuple(t2, hostname).track(t2, t))
-}
-
-/** Gets a reference to a tuple for which the first element is a hostname that can be used to bind to all interfaces. */
-DataFlow::Node vulnerableAddressTuple(string hostname) {
- vulnerableAddressTuple(DataFlow::TypeTracker::end(), hostname).flowsTo(result)
-}
-
-/**
- * Gets an instance of `socket.socket` using _some_ address family.
- *
- * See https://docs.python.org/3/library/socket.html
- */
-API::Node socketInstance() { result = API::moduleImport("socket").getMember("socket").getReturn() }
-
-from DataFlow::CallCfgNode bindCall, DataFlow::Node addressArg, string hostname
+from DataFlow::Node source, DataFlow::Node sink, DataFlow::CallCfgNode bindCall, string hostname
where
- bindCall = socketInstance().getMember("bind").getACall() and
- addressArg = bindCall.getArg(0) and
- addressArg = vulnerableAddressTuple(hostname)
+ BindToAllInterfacesFlow::flow(source, sink) and
+ bindCall.getArg(0) = sink and
+ hostname = source.asExpr().(StringLiteral).getText()
select bindCall.asExpr(), "'" + hostname + "' binds a socket to all interfaces."
diff --git a/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces.expected b/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces.expected
index 86c67af4eae..d657c2f14db 100644
--- a/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces.expected
+++ b/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces.expected
@@ -3,3 +3,7 @@
| BindToAllInterfaces_test.py:17:1:17:26 | Attribute() | '0.0.0.0' binds a socket to all interfaces. |
| BindToAllInterfaces_test.py:21:1:21:11 | Attribute() | '0.0.0.0' binds a socket to all interfaces. |
| BindToAllInterfaces_test.py:26:1:26:20 | Attribute() | '::' binds a socket to all interfaces. |
+| BindToAllInterfaces_test.py:39:9:39:43 | Attribute() | '0.0.0.0' binds a socket to all interfaces. |
+| BindToAllInterfaces_test.py:48:1:48:20 | Attribute() | '0.0.0.0' binds a socket to all interfaces. |
+| BindToAllInterfaces_test.py:53:1:53:27 | Attribute() | '0.0.0.0' binds a socket to all interfaces. |
+| BindToAllInterfaces_test.py:58:1:58:27 | Attribute() | '0.0.0.0' binds a socket to all interfaces. |
diff --git a/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces_test.py b/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces_test.py
index 5a13aa9c4e3..8d5d7998101 100644
--- a/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces_test.py
+++ b/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces_test.py
@@ -36,7 +36,7 @@ class Server:
def start(self):
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
- s.bind((self.bind_addr, self.port)) # $ MISSING: Alert[py/bind-socket-all-network-interfaces]
+ s.bind((self.bind_addr, self.port)) # $ Alert[py/bind-socket-all-network-interfaces]
server = Server()
server.start()
@@ -45,14 +45,14 @@ server.start()
import os
host = os.environ.get('APP_HOST', '0.0.0.0')
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-s.bind((host, 8080)) # $ MISSING: Alert[py/bind-socket-all-network-interfaces]
+s.bind((host, 8080)) # $ Alert[py/bind-socket-all-network-interfaces]
# gevent.socket (alternative socket module)
from gevent import socket as gsocket
gs = gsocket.socket(gsocket.AF_INET, gsocket.SOCK_STREAM)
-gs.bind(('0.0.0.0', 31137)) # $ MISSING: Alert[py/bind-socket-all-network-interfaces]
+gs.bind(('0.0.0.0', 31137)) # $ Alert[py/bind-socket-all-network-interfaces]
# eventlet.green.socket (another alternative socket module)
from eventlet.green import socket as esocket
es = esocket.socket(esocket.AF_INET, esocket.SOCK_STREAM)
-es.bind(('0.0.0.0', 31137)) # $ MISSING: Alert[py/bind-socket-all-network-interfaces]
+es.bind(('0.0.0.0', 31137)) # $ Alert[py/bind-socket-all-network-interfaces]
diff --git a/shared/mad/codeql/mad/ModelValidation.qll b/shared/mad/codeql/mad/ModelValidation.qll
index 042fb4200dd..5eaa78626ab 100644
--- a/shared/mad/codeql/mad/ModelValidation.qll
+++ b/shared/mad/codeql/mad/ModelValidation.qll
@@ -48,7 +48,7 @@ module KindValidation {
// CPP-only currently
"remote-sink",
// Python-only currently, but may be shared in the future
- "prompt-injection"
+ "bind-socket-all-interfaces", "prompt-injection"
]
or
this.matches([
From c0ce6699a535488181d122316c04609e8afd9735 Mon Sep 17 00:00:00 2001
From: Taus
Date: Thu, 26 Mar 2026 15:10:59 +0000
Subject: [PATCH 009/185] Python: Add change note
---
.../2026-03-26-improve-bind-all-interfaces-query.md | 5 +++++
1 file changed, 5 insertions(+)
create mode 100644 python/ql/src/change-notes/2026-03-26-improve-bind-all-interfaces-query.md
diff --git a/python/ql/src/change-notes/2026-03-26-improve-bind-all-interfaces-query.md b/python/ql/src/change-notes/2026-03-26-improve-bind-all-interfaces-query.md
new file mode 100644
index 00000000000..b4b5464b503
--- /dev/null
+++ b/python/ql/src/change-notes/2026-03-26-improve-bind-all-interfaces-query.md
@@ -0,0 +1,5 @@
+---
+category: minorAnalysis
+---
+
+- The `py/bind-socket-all-network-interfaces` query now uses the global data-flow library, leading to better precision and more results. Also, wrappers of `socket.socket` in the `eventlet` and `gevent` libraries are now also recognised as socket binding operations.
From b8a8a160c5e481b5bd52372515a4d942aecb0975 Mon Sep 17 00:00:00 2001
From: Tom Hvitved
Date: Mon, 19 Jan 2026 14:53:10 +0100
Subject: [PATCH 010/185] Rust: More type inference tests
---
.../PathResolutionConsistency.expected | 1 +
.../library-tests/type-inference/closure.rs | 87 +++
.../test/library-tests/type-inference/main.rs | 24 +
.../type-inference/regressions.rs | 49 ++
.../type-inference/type-inference.expected | 571 +++++++++++++++---
5 files changed, 648 insertions(+), 84 deletions(-)
diff --git a/rust/ql/test/library-tests/type-inference/CONSISTENCY/PathResolutionConsistency.expected b/rust/ql/test/library-tests/type-inference/CONSISTENCY/PathResolutionConsistency.expected
index 2ac439e085b..ffc2576a05e 100644
--- a/rust/ql/test/library-tests/type-inference/CONSISTENCY/PathResolutionConsistency.expected
+++ b/rust/ql/test/library-tests/type-inference/CONSISTENCY/PathResolutionConsistency.expected
@@ -2,3 +2,4 @@ multipleResolvedTargets
| main.rs:2223:9:2223:31 | ... .my_add(...) |
| main.rs:2225:9:2225:29 | ... .my_add(...) |
| main.rs:2740:13:2740:17 | x.f() |
+| regressions.rs:179:17:179:27 | ... + ... |
diff --git a/rust/ql/test/library-tests/type-inference/closure.rs b/rust/ql/test/library-tests/type-inference/closure.rs
index cc756a6b267..cbcf154563a 100644
--- a/rust/ql/test/library-tests/type-inference/closure.rs
+++ b/rust/ql/test/library-tests/type-inference/closure.rs
@@ -152,3 +152,90 @@ mod dyn_fn_once {
let _r2 = apply_boxed(Box::new(|_: i64| true), 3); // $ target=apply_boxed target=new type=_r2:bool
}
}
+
+mod closure_infer_param {
+ fn apply1 i64>(f: F, a: i64) -> i64 {
+ f(a)
+ }
+
+ fn apply2(f: impl Fn(i64) -> i64, a: i64) -> i64 {
+ f(a)
+ }
+
+ fn apply3(f: &dyn Fn(i64) -> i64, a: i64) -> i64 {
+ f(a)
+ }
+
+ fn apply4 i64>(mut f: F, a: i64) -> i64 {
+ f(a)
+ }
+
+ fn apply5(f: &mut dyn FnMut(i64) -> i64, a: i64) -> i64 {
+ f(a)
+ }
+
+ fn apply6(f: impl Fn(T) -> i64, a: T) -> i64 {
+ f(a)
+ }
+
+ fn apply7 i64>(mut f: F, a: T) -> i64 {
+ f(a)
+ }
+
+ fn test() {
+ let f = |x| x; // $ MISSING: type=x:i64
+ let _r = apply1(f, 1i64); // $ target=apply1
+
+ let f = |x| x; // $ MISSING: type=x:i64
+ let _r = apply2(f, 2i64); // $ target=apply2
+
+ let f = |x| x; // $ MISSING: type=x:i64
+ let _r = apply3(&f, 3i64); // $ target=apply3
+
+ let f = |x| x; // $ MISSING: type=x:i64
+ let _r = apply4(f, 4i64); // $ target=apply4
+
+ let mut f = |x| x; // $ MISSING: type=x:i64
+ let _r = apply5(&mut f, 5i64); // $ target=apply5
+
+ let f = |x| x; // $ MISSING: type=x:i64
+ let _r = apply6(f, 6i64); // $ target=apply6
+
+ let f = |x| x; // $ MISSING: type=x:i64
+ let _r = apply7(f, 7i64); // $ target=apply7
+ }
+}
+
+mod implicit_deref {
+ use std::ops::Deref;
+
+ struct S(T);
+
+ impl Deref for S {
+ type Target = dyn Fn(T) -> bool;
+
+ fn deref(&self) -> &Self::Target {
+ &|_| false
+ }
+ }
+
+ pub fn test() {
+ let x = 0i64;
+ let v = Default::default(); // $ MISSING: type=v:i64 target=default
+ let s = S(v);
+ let _ret = s(x); // $ MISSING: type=_ret:bool
+
+ let x = 0i32;
+ let v = Default::default(); // $ MISSING: type=v:i32 target=default
+ let s = S(v);
+ let s_ref = &s;
+ let _ret = s_ref(x); // $ MISSING: type=_ret:bool
+
+ // The call below is not an implicit deref, instead it will target
+ // `impl FnOnce for &F` from
+ // https://doc.rust-lang.org/std/ops/trait.FnOnce.html#impl-FnOnce%3CA%3E-for-%26F
+ // and we currently cannot handle inferring the output type
+ let c = |x| x; // $ MISSING: type=x:i64
+ (&c)(x); // $ MISSING: type=_:i64
+ }
+}
diff --git a/rust/ql/test/library-tests/type-inference/main.rs b/rust/ql/test/library-tests/type-inference/main.rs
index 6c9f2c801d5..3e3d9f85108 100644
--- a/rust/ql/test/library-tests/type-inference/main.rs
+++ b/rust/ql/test/library-tests/type-inference/main.rs
@@ -2759,6 +2759,30 @@ mod dereference;
mod dyn_type;
mod regressions;
+mod arg_trait_bounds {
+ struct Gen(T);
+
+ trait Container {
+ fn get_input(&self) -> T;
+ }
+
+ fn my_get>(c: &T) -> bool {
+ c.get_input() == 42 // $ target=get_input target=eq
+ }
+
+ impl Container for Gen {
+ fn get_input(&self) -> GT {
+ self.0 // $ fieldof=Gen
+ }
+ }
+
+ fn test() {
+ let v = Default::default(); // $ MISSING: type=v:i64 target=default
+ let g = Gen(v);
+ let _ = my_get(&g); // $ target=my_get
+ }
+}
+
fn main() {
field_access::f(); // $ target=f
method_impl::f(); // $ target=f
diff --git a/rust/ql/test/library-tests/type-inference/regressions.rs b/rust/ql/test/library-tests/type-inference/regressions.rs
index e1b47479f5d..21ab5fc24a0 100644
--- a/rust/ql/test/library-tests/type-inference/regressions.rs
+++ b/rust/ql/test/library-tests/type-inference/regressions.rs
@@ -130,3 +130,52 @@ mod regression4 {
}
}
}
+
+mod regression5 {
+ struct S1;
+ struct S2(T2);
+
+ impl From<&S1> for S2 {
+ fn from(_: &S1) -> Self {
+ S2(S1)
+ }
+ }
+
+ impl From for S2 {
+ fn from(t: T) -> Self {
+ S2(t)
+ }
+ }
+
+ fn foo() -> S2 {
+ let x = S1.into(); // $ target=into
+ x
+ }
+}
+
+mod regression6 {
+ use std::ops::Add;
+ struct S(T);
+
+ impl Add for S {
+ type Output = Self;
+
+ // add1
+ fn add(self, _rhs: Self) -> Self::Output {
+ self
+ }
+ }
+
+ impl Add for S {
+ type Output = Self;
+
+ // add2
+ fn add(self, _rhs: T) -> Self::Output {
+ self
+ }
+ }
+
+ fn foo() {
+ let x = S(0) + S(1); // $ target=add1 $ SPURIOUS: target=add2 type=x:T.T.i32
+ }
+}
diff --git a/rust/ql/test/library-tests/type-inference/type-inference.expected b/rust/ql/test/library-tests/type-inference/type-inference.expected
index 1e2c753b242..0beb4a4ffb6 100644
--- a/rust/ql/test/library-tests/type-inference/type-inference.expected
+++ b/rust/ql/test/library-tests/type-inference/type-inference.expected
@@ -661,6 +661,104 @@ inferCertainType
| closure.rs:152:31:152:53 | ...::new(...) | A | {EXTERNAL LOCATION} | Global |
| closure.rs:152:41:152:41 | _ | | {EXTERNAL LOCATION} | i64 |
| closure.rs:152:49:152:52 | true | | {EXTERNAL LOCATION} | bool |
+| closure.rs:157:34:157:34 | f | | closure.rs:157:15:157:31 | F |
+| closure.rs:157:40:157:40 | a | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:157:55:159:5 | { ... } | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:158:9:158:9 | f | | closure.rs:157:15:157:31 | F |
+| closure.rs:158:11:158:11 | a | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:161:15:161:15 | f | | closure.rs:161:18:161:36 | impl ... |
+| closure.rs:161:39:161:39 | a | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:161:54:163:5 | { ... } | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:162:9:162:9 | f | | closure.rs:161:18:161:36 | impl ... |
+| closure.rs:162:11:162:11 | a | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:165:15:165:15 | f | | {EXTERNAL LOCATION} | & |
+| closure.rs:165:15:165:15 | f | TRef | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:165:15:165:15 | f | TRef.dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:165:15:165:15 | f | TRef.dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
+| closure.rs:165:15:165:15 | f | TRef.dyn(Output) | {EXTERNAL LOCATION} | i64 |
+| closure.rs:165:39:165:39 | a | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:165:54:167:5 | { ... } | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:166:9:166:9 | f | | {EXTERNAL LOCATION} | & |
+| closure.rs:166:9:166:9 | f | TRef | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:166:9:166:9 | f | TRef.dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:166:9:166:9 | f | TRef.dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
+| closure.rs:166:9:166:9 | f | TRef.dyn(Output) | {EXTERNAL LOCATION} | i64 |
+| closure.rs:166:11:166:11 | a | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:169:41:169:41 | f | | closure.rs:169:15:169:34 | F |
+| closure.rs:169:47:169:47 | a | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:169:62:171:5 | { ... } | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:170:9:170:9 | f | | closure.rs:169:15:169:34 | F |
+| closure.rs:170:11:170:11 | a | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:173:15:173:15 | f | | {EXTERNAL LOCATION} | &mut |
+| closure.rs:173:15:173:15 | f | TRefMut | {EXTERNAL LOCATION} | dyn FnMut |
+| closure.rs:173:15:173:15 | f | TRefMut.dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:173:15:173:15 | f | TRefMut.dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
+| closure.rs:173:15:173:15 | f | TRefMut.dyn(Output) | {EXTERNAL LOCATION} | i64 |
+| closure.rs:173:46:173:46 | a | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:173:61:175:5 | { ... } | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:174:9:174:9 | f | | {EXTERNAL LOCATION} | &mut |
+| closure.rs:174:9:174:9 | f | TRefMut | {EXTERNAL LOCATION} | dyn FnMut |
+| closure.rs:174:9:174:9 | f | TRefMut.dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:174:9:174:9 | f | TRefMut.dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
+| closure.rs:174:9:174:9 | f | TRefMut.dyn(Output) | {EXTERNAL LOCATION} | i64 |
+| closure.rs:174:11:174:11 | a | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:177:18:177:18 | f | | closure.rs:177:21:177:37 | impl ... |
+| closure.rs:177:40:177:40 | a | | closure.rs:177:15:177:15 | T |
+| closure.rs:177:53:179:5 | { ... } | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:178:9:178:9 | f | | closure.rs:177:21:177:37 | impl ... |
+| closure.rs:178:11:178:11 | a | | closure.rs:177:15:177:15 | T |
+| closure.rs:181:42:181:42 | f | | closure.rs:181:18:181:35 | F |
+| closure.rs:181:48:181:48 | a | | closure.rs:181:15:181:15 | T |
+| closure.rs:181:61:183:5 | { ... } | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:182:9:182:9 | f | | closure.rs:181:18:181:35 | F |
+| closure.rs:182:11:182:11 | a | | closure.rs:181:15:181:15 | T |
+| closure.rs:185:15:206:5 | { ... } | | {EXTERNAL LOCATION} | () |
+| closure.rs:187:13:187:14 | _r | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:187:18:187:32 | apply1(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:187:28:187:31 | 1i64 | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:190:13:190:14 | _r | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:190:18:190:32 | apply2(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:190:28:190:31 | 2i64 | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:193:13:193:14 | _r | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:193:18:193:33 | apply3(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:193:25:193:26 | &f | | {EXTERNAL LOCATION} | & |
+| closure.rs:193:29:193:32 | 3i64 | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:196:13:196:14 | _r | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:196:18:196:32 | apply4(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:196:28:196:31 | 4i64 | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:199:13:199:14 | _r | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:199:18:199:37 | apply5(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:199:25:199:30 | &mut f | | {EXTERNAL LOCATION} | &mut |
+| closure.rs:199:33:199:36 | 5i64 | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:202:13:202:14 | _r | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:202:18:202:32 | apply6(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:202:28:202:31 | 6i64 | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:205:13:205:14 | _r | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:205:18:205:32 | apply7(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:205:28:205:31 | 7i64 | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:217:18:217:22 | SelfParam | | {EXTERNAL LOCATION} | & |
+| closure.rs:217:18:217:22 | SelfParam | TRef | closure.rs:212:5:212:19 | S |
+| closure.rs:217:18:217:22 | SelfParam | TRef.T | closure.rs:214:10:214:10 | T |
+| closure.rs:217:42:219:9 | { ... } | | {EXTERNAL LOCATION} | & |
+| closure.rs:217:42:219:9 | { ... } | TRef | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:217:42:219:9 | { ... } | TRef.dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:217:42:219:9 | { ... } | TRef.dyn(Args).T0 | closure.rs:214:10:214:10 | T |
+| closure.rs:217:42:219:9 | { ... } | TRef.dyn(Output) | {EXTERNAL LOCATION} | bool |
+| closure.rs:218:13:218:22 | &... | | {EXTERNAL LOCATION} | & |
+| closure.rs:218:18:218:22 | false | | {EXTERNAL LOCATION} | bool |
+| closure.rs:222:19:240:5 | { ... } | | {EXTERNAL LOCATION} | () |
+| closure.rs:223:13:223:13 | x | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:223:17:223:20 | 0i64 | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:226:22:226:22 | x | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:228:13:228:13 | x | | {EXTERNAL LOCATION} | i32 |
+| closure.rs:228:17:228:20 | 0i32 | | {EXTERNAL LOCATION} | i32 |
+| closure.rs:231:13:231:17 | s_ref | | {EXTERNAL LOCATION} | & |
+| closure.rs:231:21:231:22 | &s | | {EXTERNAL LOCATION} | & |
+| closure.rs:232:20:232:24 | s_ref | | {EXTERNAL LOCATION} | & |
+| closure.rs:232:26:232:26 | x | | {EXTERNAL LOCATION} | i32 |
+| closure.rs:239:9:239:12 | (...) | | {EXTERNAL LOCATION} | & |
+| closure.rs:239:10:239:11 | &c | | {EXTERNAL LOCATION} | & |
+| closure.rs:239:14:239:14 | x | | {EXTERNAL LOCATION} | i32 |
| dereference.rs:13:14:13:18 | SelfParam | | {EXTERNAL LOCATION} | & |
| dereference.rs:13:14:13:18 | SelfParam | TRef | dereference.rs:5:1:7:1 | MyIntPointer |
| dereference.rs:13:29:15:5 | { ... } | | {EXTERNAL LOCATION} | & |
@@ -3715,48 +3813,65 @@ inferCertainType
| main.rs:2747:21:2747:21 | y | | {EXTERNAL LOCATION} | & |
| main.rs:2750:13:2750:13 | y | | {EXTERNAL LOCATION} | usize |
| main.rs:2751:23:2751:23 | y | | {EXTERNAL LOCATION} | usize |
-| main.rs:2762:11:2797:1 | { ... } | | {EXTERNAL LOCATION} | () |
-| main.rs:2763:5:2763:21 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2764:5:2764:20 | ...::f(...) | | main.rs:72:5:72:21 | Foo |
-| main.rs:2765:5:2765:60 | ...::g(...) | | main.rs:72:5:72:21 | Foo |
-| main.rs:2765:20:2765:38 | ...::Foo {...} | | main.rs:72:5:72:21 | Foo |
-| main.rs:2765:41:2765:59 | ...::Foo {...} | | main.rs:72:5:72:21 | Foo |
-| main.rs:2766:5:2766:35 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2767:5:2767:41 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2768:5:2768:45 | ...::test(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2769:5:2769:30 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2770:5:2770:21 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2771:5:2771:27 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2772:5:2772:32 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2773:5:2773:23 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2774:5:2774:36 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2775:5:2775:35 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2776:5:2776:29 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2777:5:2777:23 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2778:5:2778:24 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2779:5:2779:17 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2780:5:2780:18 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2781:5:2781:15 | ...::f(...) | | {EXTERNAL LOCATION} | dyn Future |
-| main.rs:2781:5:2781:15 | ...::f(...) | dyn(Output) | {EXTERNAL LOCATION} | () |
-| main.rs:2782:5:2782:19 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2783:5:2783:17 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2784:5:2784:14 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2785:5:2785:27 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2786:5:2786:15 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2787:5:2787:43 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2788:5:2788:15 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2789:5:2789:17 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2790:5:2790:28 | ...::test(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2791:5:2791:23 | ...::test(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2792:5:2792:41 | ...::test_all_patterns(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2793:5:2793:49 | ...::box_patterns(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2794:5:2794:20 | ...::test(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2795:5:2795:20 | ...::f(...) | | {EXTERNAL LOCATION} | Box |
-| main.rs:2795:5:2795:20 | ...::f(...) | A | {EXTERNAL LOCATION} | Global |
-| main.rs:2795:5:2795:20 | ...::f(...) | T | main.rs:2547:5:2549:5 | dyn MyTrait |
-| main.rs:2795:5:2795:20 | ...::f(...) | T.dyn(T) | {EXTERNAL LOCATION} | i32 |
-| main.rs:2795:16:2795:19 | true | | {EXTERNAL LOCATION} | bool |
-| main.rs:2796:5:2796:23 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2766:22:2766:26 | SelfParam | | {EXTERNAL LOCATION} | & |
+| main.rs:2766:22:2766:26 | SelfParam | TRef | main.rs:2765:5:2767:5 | Self [trait Container] |
+| main.rs:2769:34:2769:34 | c | | {EXTERNAL LOCATION} | & |
+| main.rs:2769:34:2769:34 | c | TRef | main.rs:2769:15:2769:31 | T |
+| main.rs:2769:49:2771:5 | { ... } | | {EXTERNAL LOCATION} | bool |
+| main.rs:2770:9:2770:9 | c | | {EXTERNAL LOCATION} | & |
+| main.rs:2770:9:2770:9 | c | TRef | main.rs:2769:15:2769:31 | T |
+| main.rs:2774:22:2774:26 | SelfParam | | {EXTERNAL LOCATION} | & |
+| main.rs:2774:22:2774:26 | SelfParam | TRef | main.rs:2763:5:2763:21 | Gen |
+| main.rs:2774:22:2774:26 | SelfParam | TRef.T | main.rs:2773:10:2773:17 | GT |
+| main.rs:2774:35:2776:9 | { ... } | | main.rs:2773:10:2773:17 | GT |
+| main.rs:2775:13:2775:16 | self | | {EXTERNAL LOCATION} | & |
+| main.rs:2775:13:2775:16 | self | TRef | main.rs:2763:5:2763:21 | Gen |
+| main.rs:2775:13:2775:16 | self | TRef.T | main.rs:2773:10:2773:17 | GT |
+| main.rs:2779:15:2783:5 | { ... } | | {EXTERNAL LOCATION} | () |
+| main.rs:2782:17:2782:26 | my_get(...) | | {EXTERNAL LOCATION} | bool |
+| main.rs:2782:24:2782:25 | &g | | {EXTERNAL LOCATION} | & |
+| main.rs:2786:11:2821:1 | { ... } | | {EXTERNAL LOCATION} | () |
+| main.rs:2787:5:2787:21 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2788:5:2788:20 | ...::f(...) | | main.rs:72:5:72:21 | Foo |
+| main.rs:2789:5:2789:60 | ...::g(...) | | main.rs:72:5:72:21 | Foo |
+| main.rs:2789:20:2789:38 | ...::Foo {...} | | main.rs:72:5:72:21 | Foo |
+| main.rs:2789:41:2789:59 | ...::Foo {...} | | main.rs:72:5:72:21 | Foo |
+| main.rs:2790:5:2790:35 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2791:5:2791:41 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2792:5:2792:45 | ...::test(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2793:5:2793:30 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2794:5:2794:21 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2795:5:2795:27 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2796:5:2796:32 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2797:5:2797:23 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2798:5:2798:36 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2799:5:2799:35 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2800:5:2800:29 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2801:5:2801:23 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2802:5:2802:24 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2803:5:2803:17 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2804:5:2804:18 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2805:5:2805:15 | ...::f(...) | | {EXTERNAL LOCATION} | dyn Future |
+| main.rs:2805:5:2805:15 | ...::f(...) | dyn(Output) | {EXTERNAL LOCATION} | () |
+| main.rs:2806:5:2806:19 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2807:5:2807:17 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2808:5:2808:14 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2809:5:2809:27 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2810:5:2810:15 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2811:5:2811:43 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2812:5:2812:15 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2813:5:2813:17 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2814:5:2814:28 | ...::test(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2815:5:2815:23 | ...::test(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2816:5:2816:41 | ...::test_all_patterns(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2817:5:2817:49 | ...::box_patterns(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2818:5:2818:20 | ...::test(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2819:5:2819:20 | ...::f(...) | | {EXTERNAL LOCATION} | Box |
+| main.rs:2819:5:2819:20 | ...::f(...) | A | {EXTERNAL LOCATION} | Global |
+| main.rs:2819:5:2819:20 | ...::f(...) | T | main.rs:2547:5:2549:5 | dyn MyTrait |
+| main.rs:2819:5:2819:20 | ...::f(...) | T.dyn(T) | {EXTERNAL LOCATION} | i32 |
+| main.rs:2819:16:2819:19 | true | | {EXTERNAL LOCATION} | bool |
+| main.rs:2820:5:2820:23 | ...::f(...) | | {EXTERNAL LOCATION} | () |
| overloading.rs:4:19:4:23 | SelfParam | | {EXTERNAL LOCATION} | & |
| overloading.rs:4:19:4:23 | SelfParam | TRef | overloading.rs:2:5:11:5 | Self [trait FirstTrait] |
| overloading.rs:4:34:6:9 | { ... } | | {EXTERNAL LOCATION} | bool |
@@ -5092,6 +5207,32 @@ inferCertainType
| regressions.rs:127:9:130:9 | { ... } | | {EXTERNAL LOCATION} | () |
| regressions.rs:128:24:128:27 | self | | regressions.rs:121:5:121:19 | S |
| regressions.rs:128:24:128:27 | self | T | regressions.rs:123:10:123:10 | T |
+| regressions.rs:139:17:139:17 | _ | | {EXTERNAL LOCATION} | & |
+| regressions.rs:139:17:139:17 | _ | TRef | regressions.rs:135:5:135:14 | S1 |
+| regressions.rs:139:33:141:9 | { ... } | | regressions.rs:136:5:136:22 | S2 |
+| regressions.rs:139:33:141:9 | { ... } | T2 | regressions.rs:135:5:135:14 | S1 |
+| regressions.rs:145:17:145:17 | t | | regressions.rs:144:10:144:10 | T |
+| regressions.rs:145:31:147:9 | { ... } | | regressions.rs:136:5:136:22 | S2 |
+| regressions.rs:145:31:147:9 | { ... } | T2 | regressions.rs:144:10:144:10 | T |
+| regressions.rs:146:16:146:16 | t | | regressions.rs:144:10:144:10 | T |
+| regressions.rs:150:24:153:5 | { ... } | | regressions.rs:136:5:136:22 | S2 |
+| regressions.rs:150:24:153:5 | { ... } | T2 | regressions.rs:135:5:135:14 | S1 |
+| regressions.rs:164:16:164:19 | SelfParam | | regressions.rs:158:5:158:19 | S |
+| regressions.rs:164:16:164:19 | SelfParam | T | regressions.rs:160:10:160:10 | T |
+| regressions.rs:164:22:164:25 | _rhs | | regressions.rs:158:5:158:19 | S |
+| regressions.rs:164:22:164:25 | _rhs | T | regressions.rs:160:10:160:10 | T |
+| regressions.rs:164:50:166:9 | { ... } | | regressions.rs:158:5:158:19 | S |
+| regressions.rs:164:50:166:9 | { ... } | T | regressions.rs:160:10:160:10 | T |
+| regressions.rs:165:13:165:16 | self | | regressions.rs:158:5:158:19 | S |
+| regressions.rs:165:13:165:16 | self | T | regressions.rs:160:10:160:10 | T |
+| regressions.rs:173:16:173:19 | SelfParam | | regressions.rs:158:5:158:19 | S |
+| regressions.rs:173:16:173:19 | SelfParam | T | regressions.rs:169:10:169:10 | T |
+| regressions.rs:173:22:173:25 | _rhs | | regressions.rs:169:10:169:10 | T |
+| regressions.rs:173:47:175:9 | { ... } | | regressions.rs:158:5:158:19 | S |
+| regressions.rs:173:47:175:9 | { ... } | T | regressions.rs:169:10:169:10 | T |
+| regressions.rs:174:13:174:16 | self | | regressions.rs:158:5:158:19 | S |
+| regressions.rs:174:13:174:16 | self | T | regressions.rs:169:10:169:10 | T |
+| regressions.rs:178:14:180:5 | { ... } | | {EXTERNAL LOCATION} | () |
inferType
| associated_types.rs:5:15:5:18 | SelfParam | | associated_types.rs:1:1:2:21 | Wrapper |
| associated_types.rs:5:15:5:18 | SelfParam | A | associated_types.rs:4:6:4:6 | A |
@@ -6385,6 +6526,190 @@ inferType
| closure.rs:152:41:152:41 | _ | | {EXTERNAL LOCATION} | i64 |
| closure.rs:152:49:152:52 | true | | {EXTERNAL LOCATION} | bool |
| closure.rs:152:56:152:56 | 3 | | {EXTERNAL LOCATION} | i32 |
+| closure.rs:157:34:157:34 | f | | closure.rs:157:15:157:31 | F |
+| closure.rs:157:40:157:40 | a | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:157:55:159:5 | { ... } | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:158:9:158:9 | f | | closure.rs:157:15:157:31 | F |
+| closure.rs:158:9:158:12 | f(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:158:11:158:11 | a | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:161:15:161:15 | f | | closure.rs:161:18:161:36 | impl ... |
+| closure.rs:161:39:161:39 | a | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:161:54:163:5 | { ... } | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:162:9:162:9 | f | | closure.rs:161:18:161:36 | impl ... |
+| closure.rs:162:9:162:12 | f(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:162:11:162:11 | a | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:165:15:165:15 | f | | {EXTERNAL LOCATION} | & |
+| closure.rs:165:15:165:15 | f | TRef | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:165:15:165:15 | f | TRef.dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:165:15:165:15 | f | TRef.dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
+| closure.rs:165:15:165:15 | f | TRef.dyn(Output) | {EXTERNAL LOCATION} | i64 |
+| closure.rs:165:39:165:39 | a | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:165:54:167:5 | { ... } | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:166:9:166:9 | f | | {EXTERNAL LOCATION} | & |
+| closure.rs:166:9:166:9 | f | TRef | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:166:9:166:9 | f | TRef.dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:166:9:166:9 | f | TRef.dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
+| closure.rs:166:9:166:9 | f | TRef.dyn(Output) | {EXTERNAL LOCATION} | i64 |
+| closure.rs:166:9:166:12 | f(...) | | {EXTERNAL LOCATION} | F::Output[FnOnce] |
+| closure.rs:166:9:166:12 | f(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:166:11:166:11 | a | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:169:41:169:41 | f | | closure.rs:169:15:169:34 | F |
+| closure.rs:169:47:169:47 | a | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:169:62:171:5 | { ... } | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:170:9:170:9 | f | | closure.rs:169:15:169:34 | F |
+| closure.rs:170:9:170:12 | f(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:170:11:170:11 | a | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:173:15:173:15 | f | | {EXTERNAL LOCATION} | &mut |
+| closure.rs:173:15:173:15 | f | TRefMut | {EXTERNAL LOCATION} | dyn FnMut |
+| closure.rs:173:15:173:15 | f | TRefMut.dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:173:15:173:15 | f | TRefMut.dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
+| closure.rs:173:15:173:15 | f | TRefMut.dyn(Output) | {EXTERNAL LOCATION} | i64 |
+| closure.rs:173:46:173:46 | a | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:173:61:175:5 | { ... } | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:174:9:174:9 | f | | {EXTERNAL LOCATION} | &mut |
+| closure.rs:174:9:174:9 | f | TRefMut | {EXTERNAL LOCATION} | dyn FnMut |
+| closure.rs:174:9:174:9 | f | TRefMut.dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:174:9:174:9 | f | TRefMut.dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
+| closure.rs:174:9:174:9 | f | TRefMut.dyn(Output) | {EXTERNAL LOCATION} | i64 |
+| closure.rs:174:9:174:12 | f(...) | | {EXTERNAL LOCATION} | F::Output[FnOnce] |
+| closure.rs:174:9:174:12 | f(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:174:11:174:11 | a | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:177:18:177:18 | f | | closure.rs:177:21:177:37 | impl ... |
+| closure.rs:177:40:177:40 | a | | closure.rs:177:15:177:15 | T |
+| closure.rs:177:53:179:5 | { ... } | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:178:9:178:9 | f | | closure.rs:177:21:177:37 | impl ... |
+| closure.rs:178:9:178:12 | f(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:178:11:178:11 | a | | closure.rs:177:15:177:15 | T |
+| closure.rs:181:42:181:42 | f | | closure.rs:181:18:181:35 | F |
+| closure.rs:181:48:181:48 | a | | closure.rs:181:15:181:15 | T |
+| closure.rs:181:61:183:5 | { ... } | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:182:9:182:9 | f | | closure.rs:181:18:181:35 | F |
+| closure.rs:182:9:182:12 | f(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:182:11:182:11 | a | | closure.rs:181:15:181:15 | T |
+| closure.rs:185:15:206:5 | { ... } | | {EXTERNAL LOCATION} | () |
+| closure.rs:186:13:186:13 | f | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:186:13:186:13 | f | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:186:17:186:21 | \|...\| x | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:186:17:186:21 | \|...\| x | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:187:13:187:14 | _r | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:187:18:187:32 | apply1(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:187:25:187:25 | f | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:187:25:187:25 | f | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:187:28:187:31 | 1i64 | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:189:13:189:13 | f | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:189:13:189:13 | f | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:189:17:189:21 | \|...\| x | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:189:17:189:21 | \|...\| x | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:190:13:190:14 | _r | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:190:18:190:32 | apply2(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:190:25:190:25 | f | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:190:25:190:25 | f | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:190:28:190:31 | 2i64 | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:192:13:192:13 | f | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:192:13:192:13 | f | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:192:17:192:21 | \|...\| x | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:192:17:192:21 | \|...\| x | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:193:13:193:14 | _r | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:193:18:193:33 | apply3(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:193:25:193:26 | &f | | {EXTERNAL LOCATION} | & |
+| closure.rs:193:25:193:26 | &f | TRef | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:193:25:193:26 | &f | TRef.dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:193:26:193:26 | f | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:193:26:193:26 | f | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:193:29:193:32 | 3i64 | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:195:13:195:13 | f | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:195:13:195:13 | f | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:195:17:195:21 | \|...\| x | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:195:17:195:21 | \|...\| x | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:196:13:196:14 | _r | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:196:18:196:32 | apply4(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:196:25:196:25 | f | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:196:25:196:25 | f | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:196:28:196:31 | 4i64 | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:198:17:198:17 | f | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:198:17:198:17 | f | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:198:21:198:25 | \|...\| x | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:198:21:198:25 | \|...\| x | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:199:13:199:14 | _r | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:199:18:199:37 | apply5(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:199:25:199:30 | &mut f | | {EXTERNAL LOCATION} | &mut |
+| closure.rs:199:25:199:30 | &mut f | TRefMut | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:199:25:199:30 | &mut f | TRefMut.dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:199:30:199:30 | f | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:199:30:199:30 | f | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:199:33:199:36 | 5i64 | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:201:13:201:13 | f | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:201:13:201:13 | f | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:201:17:201:21 | \|...\| x | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:201:17:201:21 | \|...\| x | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:202:13:202:14 | _r | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:202:18:202:32 | apply6(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:202:25:202:25 | f | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:202:25:202:25 | f | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:202:28:202:31 | 6i64 | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:204:13:204:13 | f | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:204:13:204:13 | f | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:204:17:204:21 | \|...\| x | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:204:17:204:21 | \|...\| x | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:205:13:205:14 | _r | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:205:18:205:32 | apply7(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:205:25:205:25 | f | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:205:25:205:25 | f | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:205:28:205:31 | 7i64 | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:217:18:217:22 | SelfParam | | {EXTERNAL LOCATION} | & |
+| closure.rs:217:18:217:22 | SelfParam | TRef | closure.rs:212:5:212:19 | S |
+| closure.rs:217:18:217:22 | SelfParam | TRef.T | closure.rs:214:10:214:10 | T |
+| closure.rs:217:42:219:9 | { ... } | | {EXTERNAL LOCATION} | & |
+| closure.rs:217:42:219:9 | { ... } | TRef | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:217:42:219:9 | { ... } | TRef.dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:217:42:219:9 | { ... } | TRef.dyn(Args).T0 | closure.rs:214:10:214:10 | T |
+| closure.rs:217:42:219:9 | { ... } | TRef.dyn(Output) | {EXTERNAL LOCATION} | bool |
+| closure.rs:218:13:218:22 | &... | | {EXTERNAL LOCATION} | & |
+| closure.rs:218:13:218:22 | &... | TRef | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:218:13:218:22 | &... | TRef.dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:218:13:218:22 | &... | TRef.dyn(Args).T0 | closure.rs:214:10:214:10 | T |
+| closure.rs:218:13:218:22 | &... | TRef.dyn(Output) | {EXTERNAL LOCATION} | bool |
+| closure.rs:218:14:218:22 | \|...\| false | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:218:14:218:22 | \|...\| false | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:218:14:218:22 | \|...\| false | dyn(Args).T0 | closure.rs:214:10:214:10 | T |
+| closure.rs:218:14:218:22 | \|...\| false | dyn(Output) | {EXTERNAL LOCATION} | bool |
+| closure.rs:218:15:218:15 | _ | | closure.rs:214:10:214:10 | T |
+| closure.rs:218:18:218:22 | false | | {EXTERNAL LOCATION} | bool |
+| closure.rs:222:19:240:5 | { ... } | | {EXTERNAL LOCATION} | () |
+| closure.rs:223:13:223:13 | x | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:223:17:223:20 | 0i64 | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:225:13:225:13 | s | | closure.rs:212:5:212:19 | S |
+| closure.rs:225:17:225:20 | S(...) | | closure.rs:212:5:212:19 | S |
+| closure.rs:226:20:226:20 | s | | closure.rs:212:5:212:19 | S |
+| closure.rs:226:22:226:22 | x | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:228:13:228:13 | x | | {EXTERNAL LOCATION} | i32 |
+| closure.rs:228:17:228:20 | 0i32 | | {EXTERNAL LOCATION} | i32 |
+| closure.rs:230:13:230:13 | s | | closure.rs:212:5:212:19 | S |
+| closure.rs:230:17:230:20 | S(...) | | closure.rs:212:5:212:19 | S |
+| closure.rs:231:13:231:17 | s_ref | | {EXTERNAL LOCATION} | & |
+| closure.rs:231:13:231:17 | s_ref | TRef | closure.rs:212:5:212:19 | S |
+| closure.rs:231:21:231:22 | &s | | {EXTERNAL LOCATION} | & |
+| closure.rs:231:21:231:22 | &s | TRef | closure.rs:212:5:212:19 | S |
+| closure.rs:231:22:231:22 | s | | closure.rs:212:5:212:19 | S |
+| closure.rs:232:13:232:16 | _ret | | {EXTERNAL LOCATION} | F::Output[FnOnce] |
+| closure.rs:232:20:232:24 | s_ref | | {EXTERNAL LOCATION} | & |
+| closure.rs:232:20:232:24 | s_ref | TRef | closure.rs:212:5:212:19 | S |
+| closure.rs:232:20:232:27 | s_ref(...) | | {EXTERNAL LOCATION} | F::Output[FnOnce] |
+| closure.rs:232:26:232:26 | x | | {EXTERNAL LOCATION} | i32 |
+| closure.rs:238:13:238:13 | c | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:238:13:238:13 | c | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:238:17:238:21 | \|...\| x | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:238:17:238:21 | \|...\| x | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:239:9:239:12 | (...) | | {EXTERNAL LOCATION} | & |
+| closure.rs:239:9:239:12 | (...) | TRef | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:239:9:239:12 | (...) | TRef.dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:239:9:239:15 | ...(...) | | {EXTERNAL LOCATION} | F::Output[FnOnce] |
+| closure.rs:239:10:239:11 | &c | | {EXTERNAL LOCATION} | & |
+| closure.rs:239:10:239:11 | &c | TRef | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:239:10:239:11 | &c | TRef.dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:239:11:239:11 | c | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:239:11:239:11 | c | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:239:14:239:14 | x | | {EXTERNAL LOCATION} | i32 |
| dereference.rs:13:14:13:18 | SelfParam | | {EXTERNAL LOCATION} | & |
| dereference.rs:13:14:13:18 | SelfParam | TRef | dereference.rs:5:1:7:1 | MyIntPointer |
| dereference.rs:13:29:15:5 | { ... } | | {EXTERNAL LOCATION} | & |
@@ -12316,48 +12641,74 @@ inferType
| main.rs:2751:17:2751:17 | x | | {EXTERNAL LOCATION} | i32 |
| main.rs:2751:17:2751:24 | x.max(...) | | {EXTERNAL LOCATION} | i32 |
| main.rs:2751:23:2751:23 | y | | {EXTERNAL LOCATION} | usize |
-| main.rs:2762:11:2797:1 | { ... } | | {EXTERNAL LOCATION} | () |
-| main.rs:2763:5:2763:21 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2764:5:2764:20 | ...::f(...) | | main.rs:72:5:72:21 | Foo |
-| main.rs:2765:5:2765:60 | ...::g(...) | | main.rs:72:5:72:21 | Foo |
-| main.rs:2765:20:2765:38 | ...::Foo {...} | | main.rs:72:5:72:21 | Foo |
-| main.rs:2765:41:2765:59 | ...::Foo {...} | | main.rs:72:5:72:21 | Foo |
-| main.rs:2766:5:2766:35 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2767:5:2767:41 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2768:5:2768:45 | ...::test(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2769:5:2769:30 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2770:5:2770:21 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2771:5:2771:27 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2772:5:2772:32 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2773:5:2773:23 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2774:5:2774:36 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2775:5:2775:35 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2776:5:2776:29 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2777:5:2777:23 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2778:5:2778:24 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2779:5:2779:17 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2780:5:2780:18 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2781:5:2781:15 | ...::f(...) | | {EXTERNAL LOCATION} | dyn Future |
-| main.rs:2781:5:2781:15 | ...::f(...) | dyn(Output) | {EXTERNAL LOCATION} | () |
-| main.rs:2782:5:2782:19 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2783:5:2783:17 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2784:5:2784:14 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2785:5:2785:27 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2786:5:2786:15 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2787:5:2787:43 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2788:5:2788:15 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2789:5:2789:17 | ...::f(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2790:5:2790:28 | ...::test(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2791:5:2791:23 | ...::test(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2792:5:2792:41 | ...::test_all_patterns(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2793:5:2793:49 | ...::box_patterns(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2794:5:2794:20 | ...::test(...) | | {EXTERNAL LOCATION} | () |
-| main.rs:2795:5:2795:20 | ...::f(...) | | {EXTERNAL LOCATION} | Box |
-| main.rs:2795:5:2795:20 | ...::f(...) | A | {EXTERNAL LOCATION} | Global |
-| main.rs:2795:5:2795:20 | ...::f(...) | T | main.rs:2547:5:2549:5 | dyn MyTrait |
-| main.rs:2795:5:2795:20 | ...::f(...) | T.dyn(T) | {EXTERNAL LOCATION} | i32 |
-| main.rs:2795:16:2795:19 | true | | {EXTERNAL LOCATION} | bool |
-| main.rs:2796:5:2796:23 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2766:22:2766:26 | SelfParam | | {EXTERNAL LOCATION} | & |
+| main.rs:2766:22:2766:26 | SelfParam | TRef | main.rs:2765:5:2767:5 | Self [trait Container] |
+| main.rs:2769:34:2769:34 | c | | {EXTERNAL LOCATION} | & |
+| main.rs:2769:34:2769:34 | c | TRef | main.rs:2769:15:2769:31 | T |
+| main.rs:2769:49:2771:5 | { ... } | | {EXTERNAL LOCATION} | bool |
+| main.rs:2770:9:2770:9 | c | | {EXTERNAL LOCATION} | & |
+| main.rs:2770:9:2770:9 | c | TRef | main.rs:2769:15:2769:31 | T |
+| main.rs:2770:9:2770:21 | c.get_input() | | {EXTERNAL LOCATION} | i64 |
+| main.rs:2770:9:2770:27 | ... == ... | | {EXTERNAL LOCATION} | bool |
+| main.rs:2770:26:2770:27 | 42 | | {EXTERNAL LOCATION} | i32 |
+| main.rs:2774:22:2774:26 | SelfParam | | {EXTERNAL LOCATION} | & |
+| main.rs:2774:22:2774:26 | SelfParam | TRef | main.rs:2763:5:2763:21 | Gen |
+| main.rs:2774:22:2774:26 | SelfParam | TRef.T | main.rs:2773:10:2773:17 | GT |
+| main.rs:2774:35:2776:9 | { ... } | | main.rs:2773:10:2773:17 | GT |
+| main.rs:2775:13:2775:16 | self | | {EXTERNAL LOCATION} | & |
+| main.rs:2775:13:2775:16 | self | TRef | main.rs:2763:5:2763:21 | Gen |
+| main.rs:2775:13:2775:16 | self | TRef.T | main.rs:2773:10:2773:17 | GT |
+| main.rs:2775:13:2775:18 | self.0 | | main.rs:2773:10:2773:17 | GT |
+| main.rs:2779:15:2783:5 | { ... } | | {EXTERNAL LOCATION} | () |
+| main.rs:2781:13:2781:13 | g | | main.rs:2763:5:2763:21 | Gen |
+| main.rs:2781:17:2781:22 | Gen(...) | | main.rs:2763:5:2763:21 | Gen |
+| main.rs:2782:13:2782:13 | _ | | {EXTERNAL LOCATION} | bool |
+| main.rs:2782:17:2782:26 | my_get(...) | | {EXTERNAL LOCATION} | bool |
+| main.rs:2782:24:2782:25 | &g | | {EXTERNAL LOCATION} | & |
+| main.rs:2782:24:2782:25 | &g | TRef | main.rs:2763:5:2763:21 | Gen |
+| main.rs:2782:25:2782:25 | g | | main.rs:2763:5:2763:21 | Gen |
+| main.rs:2786:11:2821:1 | { ... } | | {EXTERNAL LOCATION} | () |
+| main.rs:2787:5:2787:21 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2788:5:2788:20 | ...::f(...) | | main.rs:72:5:72:21 | Foo |
+| main.rs:2789:5:2789:60 | ...::g(...) | | main.rs:72:5:72:21 | Foo |
+| main.rs:2789:20:2789:38 | ...::Foo {...} | | main.rs:72:5:72:21 | Foo |
+| main.rs:2789:41:2789:59 | ...::Foo {...} | | main.rs:72:5:72:21 | Foo |
+| main.rs:2790:5:2790:35 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2791:5:2791:41 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2792:5:2792:45 | ...::test(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2793:5:2793:30 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2794:5:2794:21 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2795:5:2795:27 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2796:5:2796:32 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2797:5:2797:23 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2798:5:2798:36 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2799:5:2799:35 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2800:5:2800:29 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2801:5:2801:23 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2802:5:2802:24 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2803:5:2803:17 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2804:5:2804:18 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2805:5:2805:15 | ...::f(...) | | {EXTERNAL LOCATION} | dyn Future |
+| main.rs:2805:5:2805:15 | ...::f(...) | dyn(Output) | {EXTERNAL LOCATION} | () |
+| main.rs:2806:5:2806:19 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2807:5:2807:17 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2808:5:2808:14 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2809:5:2809:27 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2810:5:2810:15 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2811:5:2811:43 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2812:5:2812:15 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2813:5:2813:17 | ...::f(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2814:5:2814:28 | ...::test(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2815:5:2815:23 | ...::test(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2816:5:2816:41 | ...::test_all_patterns(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2817:5:2817:49 | ...::box_patterns(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2818:5:2818:20 | ...::test(...) | | {EXTERNAL LOCATION} | () |
+| main.rs:2819:5:2819:20 | ...::f(...) | | {EXTERNAL LOCATION} | Box |
+| main.rs:2819:5:2819:20 | ...::f(...) | A | {EXTERNAL LOCATION} | Global |
+| main.rs:2819:5:2819:20 | ...::f(...) | T | main.rs:2547:5:2549:5 | dyn MyTrait |
+| main.rs:2819:5:2819:20 | ...::f(...) | T.dyn(T) | {EXTERNAL LOCATION} | i32 |
+| main.rs:2819:16:2819:19 | true | | {EXTERNAL LOCATION} | bool |
+| main.rs:2820:5:2820:23 | ...::f(...) | | {EXTERNAL LOCATION} | () |
| overloading.rs:4:19:4:23 | SelfParam | | {EXTERNAL LOCATION} | & |
| overloading.rs:4:19:4:23 | SelfParam | TRef | overloading.rs:2:5:11:5 | Self [trait FirstTrait] |
| overloading.rs:4:34:6:9 | { ... } | | {EXTERNAL LOCATION} | bool |
@@ -15158,4 +15509,56 @@ inferType
| regressions.rs:128:24:128:27 | self | T | regressions.rs:123:10:123:10 | T |
| regressions.rs:129:13:129:13 | s | | regressions.rs:123:10:123:10 | T |
| regressions.rs:129:13:129:17 | s.m() | | {EXTERNAL LOCATION} | () |
+| regressions.rs:139:17:139:17 | _ | | {EXTERNAL LOCATION} | & |
+| regressions.rs:139:17:139:17 | _ | TRef | regressions.rs:135:5:135:14 | S1 |
+| regressions.rs:139:33:141:9 | { ... } | | regressions.rs:136:5:136:22 | S2 |
+| regressions.rs:139:33:141:9 | { ... } | T2 | regressions.rs:135:5:135:14 | S1 |
+| regressions.rs:140:13:140:18 | S2(...) | | regressions.rs:136:5:136:22 | S2 |
+| regressions.rs:140:13:140:18 | S2(...) | T2 | regressions.rs:135:5:135:14 | S1 |
+| regressions.rs:140:16:140:17 | S1 | | regressions.rs:135:5:135:14 | S1 |
+| regressions.rs:145:17:145:17 | t | | regressions.rs:144:10:144:10 | T |
+| regressions.rs:145:31:147:9 | { ... } | | regressions.rs:136:5:136:22 | S2 |
+| regressions.rs:145:31:147:9 | { ... } | T2 | regressions.rs:144:10:144:10 | T |
+| regressions.rs:146:13:146:17 | S2(...) | | regressions.rs:136:5:136:22 | S2 |
+| regressions.rs:146:13:146:17 | S2(...) | T2 | regressions.rs:144:10:144:10 | T |
+| regressions.rs:146:16:146:16 | t | | regressions.rs:144:10:144:10 | T |
+| regressions.rs:150:24:153:5 | { ... } | | regressions.rs:136:5:136:22 | S2 |
+| regressions.rs:150:24:153:5 | { ... } | T2 | regressions.rs:135:5:135:14 | S1 |
+| regressions.rs:151:13:151:13 | x | | regressions.rs:136:5:136:22 | S2 |
+| regressions.rs:151:13:151:13 | x | T2 | regressions.rs:135:5:135:14 | S1 |
+| regressions.rs:151:17:151:18 | S1 | | regressions.rs:135:5:135:14 | S1 |
+| regressions.rs:151:17:151:25 | S1.into() | | regressions.rs:136:5:136:22 | S2 |
+| regressions.rs:151:17:151:25 | S1.into() | T2 | regressions.rs:135:5:135:14 | S1 |
+| regressions.rs:152:9:152:9 | x | | regressions.rs:136:5:136:22 | S2 |
+| regressions.rs:152:9:152:9 | x | T2 | regressions.rs:135:5:135:14 | S1 |
+| regressions.rs:164:16:164:19 | SelfParam | | regressions.rs:158:5:158:19 | S |
+| regressions.rs:164:16:164:19 | SelfParam | T | regressions.rs:160:10:160:10 | T |
+| regressions.rs:164:22:164:25 | _rhs | | regressions.rs:158:5:158:19 | S |
+| regressions.rs:164:22:164:25 | _rhs | T | regressions.rs:160:10:160:10 | T |
+| regressions.rs:164:50:166:9 | { ... } | | regressions.rs:158:5:158:19 | S |
+| regressions.rs:164:50:166:9 | { ... } | T | regressions.rs:160:10:160:10 | T |
+| regressions.rs:165:13:165:16 | self | | regressions.rs:158:5:158:19 | S |
+| regressions.rs:165:13:165:16 | self | T | regressions.rs:160:10:160:10 | T |
+| regressions.rs:173:16:173:19 | SelfParam | | regressions.rs:158:5:158:19 | S |
+| regressions.rs:173:16:173:19 | SelfParam | T | regressions.rs:169:10:169:10 | T |
+| regressions.rs:173:22:173:25 | _rhs | | regressions.rs:169:10:169:10 | T |
+| regressions.rs:173:47:175:9 | { ... } | | regressions.rs:158:5:158:19 | S |
+| regressions.rs:173:47:175:9 | { ... } | T | regressions.rs:169:10:169:10 | T |
+| regressions.rs:174:13:174:16 | self | | regressions.rs:158:5:158:19 | S |
+| regressions.rs:174:13:174:16 | self | T | regressions.rs:169:10:169:10 | T |
+| regressions.rs:178:14:180:5 | { ... } | | {EXTERNAL LOCATION} | () |
+| regressions.rs:179:13:179:13 | x | | regressions.rs:158:5:158:19 | S |
+| regressions.rs:179:13:179:13 | x | T | {EXTERNAL LOCATION} | i32 |
+| regressions.rs:179:13:179:13 | x | T | regressions.rs:158:5:158:19 | S |
+| regressions.rs:179:13:179:13 | x | T.T | {EXTERNAL LOCATION} | i32 |
+| regressions.rs:179:17:179:20 | S(...) | | regressions.rs:158:5:158:19 | S |
+| regressions.rs:179:17:179:20 | S(...) | T | {EXTERNAL LOCATION} | i32 |
+| regressions.rs:179:17:179:27 | ... + ... | | regressions.rs:158:5:158:19 | S |
+| regressions.rs:179:17:179:27 | ... + ... | T | {EXTERNAL LOCATION} | i32 |
+| regressions.rs:179:17:179:27 | ... + ... | T | regressions.rs:158:5:158:19 | S |
+| regressions.rs:179:17:179:27 | ... + ... | T.T | {EXTERNAL LOCATION} | i32 |
+| regressions.rs:179:19:179:19 | 0 | | {EXTERNAL LOCATION} | i32 |
+| regressions.rs:179:24:179:27 | S(...) | | regressions.rs:158:5:158:19 | S |
+| regressions.rs:179:24:179:27 | S(...) | T | {EXTERNAL LOCATION} | i32 |
+| regressions.rs:179:26:179:26 | 1 | | {EXTERNAL LOCATION} | i32 |
testFailures
From c9832c330af360b4204971cb1c250b7633da0c1d Mon Sep 17 00:00:00 2001
From: Taus
Date: Thu, 26 Mar 2026 20:13:55 +0000
Subject: [PATCH 011/185] Python: Convert BindToAllInterfaces to path-problem
Now that we're using global data-flow, we might as well make use of the
fact that we know where the source is.
---
.../CVE-2018-1281/BindToAllInterfaces.ql | 16 +++--
.../BindToAllInterfaces.expected | 72 ++++++++++++++++---
.../CVE-2018-1281/BindToAllInterfaces_test.py | 6 +-
3 files changed, 75 insertions(+), 19 deletions(-)
diff --git a/python/ql/src/Security/CVE-2018-1281/BindToAllInterfaces.ql b/python/ql/src/Security/CVE-2018-1281/BindToAllInterfaces.ql
index 39d0c6b6237..2b62b184fd4 100644
--- a/python/ql/src/Security/CVE-2018-1281/BindToAllInterfaces.ql
+++ b/python/ql/src/Security/CVE-2018-1281/BindToAllInterfaces.ql
@@ -2,7 +2,7 @@
* @name Binding a socket to all network interfaces
* @description Binding a socket to all interfaces opens it up to traffic from any IPv4 address
* and is therefore associated with security risks.
- * @kind problem
+ * @kind path-problem
* @tags security
* external/cwe/cwe-200
* @problem.severity error
@@ -16,6 +16,7 @@ import python
import semmle.python.dataflow.new.DataFlow
import semmle.python.dataflow.new.TaintTracking
private import semmle.python.frameworks.data.ModelsAsData
+import BindToAllInterfacesFlow::PathGraph
/** Gets a hostname that can be used to bind to all interfaces. */
private string vulnerableHostname() {
@@ -39,9 +40,10 @@ private module BindToAllInterfacesConfig implements DataFlow::ConfigSig {
private module BindToAllInterfacesFlow = TaintTracking::Global;
-from DataFlow::Node source, DataFlow::Node sink, DataFlow::CallCfgNode bindCall, string hostname
-where
- BindToAllInterfacesFlow::flow(source, sink) and
- bindCall.getArg(0) = sink and
- hostname = source.asExpr().(StringLiteral).getText()
-select bindCall.asExpr(), "'" + hostname + "' binds a socket to all interfaces."
+private import BindToAllInterfacesFlow
+
+from PathNode source, PathNode sink
+where flowPath(source, sink)
+select sink.getNode(), source, sink,
+ "Binding a socket to all interfaces (using $@) is a security risk.", source.getNode(),
+ "'" + source.getNode().asExpr().(StringLiteral).getText() + "'"
diff --git a/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces.expected b/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces.expected
index d657c2f14db..0b96b2df650 100644
--- a/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces.expected
+++ b/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces.expected
@@ -1,9 +1,63 @@
-| BindToAllInterfaces_test.py:5:1:5:26 | Attribute() | '0.0.0.0' binds a socket to all interfaces. |
-| BindToAllInterfaces_test.py:9:1:9:18 | Attribute() | '' binds a socket to all interfaces. |
-| BindToAllInterfaces_test.py:17:1:17:26 | Attribute() | '0.0.0.0' binds a socket to all interfaces. |
-| BindToAllInterfaces_test.py:21:1:21:11 | Attribute() | '0.0.0.0' binds a socket to all interfaces. |
-| BindToAllInterfaces_test.py:26:1:26:20 | Attribute() | '::' binds a socket to all interfaces. |
-| BindToAllInterfaces_test.py:39:9:39:43 | Attribute() | '0.0.0.0' binds a socket to all interfaces. |
-| BindToAllInterfaces_test.py:48:1:48:20 | Attribute() | '0.0.0.0' binds a socket to all interfaces. |
-| BindToAllInterfaces_test.py:53:1:53:27 | Attribute() | '0.0.0.0' binds a socket to all interfaces. |
-| BindToAllInterfaces_test.py:58:1:58:27 | Attribute() | '0.0.0.0' binds a socket to all interfaces. |
+#select
+| BindToAllInterfaces_test.py:5:9:5:24 | ControlFlowNode for Tuple | BindToAllInterfaces_test.py:5:9:5:17 | ControlFlowNode for StringLiteral | BindToAllInterfaces_test.py:5:9:5:24 | ControlFlowNode for Tuple | Binding a socket to all interfaces (using $@) is a security risk. | BindToAllInterfaces_test.py:5:9:5:17 | ControlFlowNode for StringLiteral | '0.0.0.0' |
+| BindToAllInterfaces_test.py:9:9:9:16 | ControlFlowNode for Tuple | BindToAllInterfaces_test.py:9:9:9:10 | ControlFlowNode for StringLiteral | BindToAllInterfaces_test.py:9:9:9:16 | ControlFlowNode for Tuple | Binding a socket to all interfaces (using $@) is a security risk. | BindToAllInterfaces_test.py:9:9:9:10 | ControlFlowNode for StringLiteral | '' |
+| BindToAllInterfaces_test.py:17:9:17:24 | ControlFlowNode for Tuple | BindToAllInterfaces_test.py:16:14:16:22 | ControlFlowNode for StringLiteral | BindToAllInterfaces_test.py:17:9:17:24 | ControlFlowNode for Tuple | Binding a socket to all interfaces (using $@) is a security risk. | BindToAllInterfaces_test.py:16:14:16:22 | ControlFlowNode for StringLiteral | '0.0.0.0' |
+| BindToAllInterfaces_test.py:21:8:21:10 | ControlFlowNode for tup | BindToAllInterfaces_test.py:16:14:16:22 | ControlFlowNode for StringLiteral | BindToAllInterfaces_test.py:21:8:21:10 | ControlFlowNode for tup | Binding a socket to all interfaces (using $@) is a security risk. | BindToAllInterfaces_test.py:16:14:16:22 | ControlFlowNode for StringLiteral | '0.0.0.0' |
+| BindToAllInterfaces_test.py:26:9:26:18 | ControlFlowNode for Tuple | BindToAllInterfaces_test.py:26:9:26:12 | ControlFlowNode for StringLiteral | BindToAllInterfaces_test.py:26:9:26:18 | ControlFlowNode for Tuple | Binding a socket to all interfaces (using $@) is a security risk. | BindToAllInterfaces_test.py:26:9:26:12 | ControlFlowNode for StringLiteral | '::' |
+| BindToAllInterfaces_test.py:39:17:39:41 | ControlFlowNode for Tuple | BindToAllInterfaces_test.py:34:26:34:34 | ControlFlowNode for StringLiteral | BindToAllInterfaces_test.py:39:17:39:41 | ControlFlowNode for Tuple | Binding a socket to all interfaces (using $@) is a security risk. | BindToAllInterfaces_test.py:34:26:34:34 | ControlFlowNode for StringLiteral | '0.0.0.0' |
+| BindToAllInterfaces_test.py:48:9:48:18 | ControlFlowNode for Tuple | BindToAllInterfaces_test.py:46:35:46:43 | ControlFlowNode for StringLiteral | BindToAllInterfaces_test.py:48:9:48:18 | ControlFlowNode for Tuple | Binding a socket to all interfaces (using $@) is a security risk. | BindToAllInterfaces_test.py:46:35:46:43 | ControlFlowNode for StringLiteral | '0.0.0.0' |
+| BindToAllInterfaces_test.py:53:10:53:25 | ControlFlowNode for Tuple | BindToAllInterfaces_test.py:53:10:53:18 | ControlFlowNode for StringLiteral | BindToAllInterfaces_test.py:53:10:53:25 | ControlFlowNode for Tuple | Binding a socket to all interfaces (using $@) is a security risk. | BindToAllInterfaces_test.py:53:10:53:18 | ControlFlowNode for StringLiteral | '0.0.0.0' |
+| BindToAllInterfaces_test.py:58:10:58:25 | ControlFlowNode for Tuple | BindToAllInterfaces_test.py:58:10:58:18 | ControlFlowNode for StringLiteral | BindToAllInterfaces_test.py:58:10:58:25 | ControlFlowNode for Tuple | Binding a socket to all interfaces (using $@) is a security risk. | BindToAllInterfaces_test.py:58:10:58:18 | ControlFlowNode for StringLiteral | '0.0.0.0' |
+edges
+| BindToAllInterfaces_test.py:5:9:5:17 | ControlFlowNode for StringLiteral | BindToAllInterfaces_test.py:5:9:5:24 | ControlFlowNode for Tuple | provenance | Sink:MaD:63 |
+| BindToAllInterfaces_test.py:9:9:9:10 | ControlFlowNode for StringLiteral | BindToAllInterfaces_test.py:9:9:9:16 | ControlFlowNode for Tuple | provenance | Sink:MaD:63 |
+| BindToAllInterfaces_test.py:16:1:16:10 | ControlFlowNode for ALL_LOCALS | BindToAllInterfaces_test.py:17:9:17:24 | ControlFlowNode for Tuple | provenance | Sink:MaD:63 |
+| BindToAllInterfaces_test.py:16:1:16:10 | ControlFlowNode for ALL_LOCALS | BindToAllInterfaces_test.py:20:1:20:3 | ControlFlowNode for tup | provenance | |
+| BindToAllInterfaces_test.py:16:14:16:22 | ControlFlowNode for StringLiteral | BindToAllInterfaces_test.py:16:1:16:10 | ControlFlowNode for ALL_LOCALS | provenance | |
+| BindToAllInterfaces_test.py:20:1:20:3 | ControlFlowNode for tup | BindToAllInterfaces_test.py:21:8:21:10 | ControlFlowNode for tup | provenance | Sink:MaD:63 |
+| BindToAllInterfaces_test.py:26:9:26:12 | ControlFlowNode for StringLiteral | BindToAllInterfaces_test.py:26:9:26:18 | ControlFlowNode for Tuple | provenance | Sink:MaD:63 |
+| BindToAllInterfaces_test.py:33:18:33:21 | ControlFlowNode for self [Return] [Attribute bind_addr] | BindToAllInterfaces_test.py:41:10:41:17 | ControlFlowNode for Server() [Attribute bind_addr] | provenance | |
+| BindToAllInterfaces_test.py:34:9:34:12 | [post] ControlFlowNode for self [Attribute bind_addr] | BindToAllInterfaces_test.py:33:18:33:21 | ControlFlowNode for self [Return] [Attribute bind_addr] | provenance | |
+| BindToAllInterfaces_test.py:34:26:34:34 | ControlFlowNode for StringLiteral | BindToAllInterfaces_test.py:34:9:34:12 | [post] ControlFlowNode for self [Attribute bind_addr] | provenance | |
+| BindToAllInterfaces_test.py:37:15:37:18 | ControlFlowNode for self [Attribute bind_addr] | BindToAllInterfaces_test.py:39:17:39:20 | ControlFlowNode for self [Attribute bind_addr] | provenance | |
+| BindToAllInterfaces_test.py:39:17:39:20 | ControlFlowNode for self [Attribute bind_addr] | BindToAllInterfaces_test.py:39:17:39:30 | ControlFlowNode for Attribute | provenance | |
+| BindToAllInterfaces_test.py:39:17:39:30 | ControlFlowNode for Attribute | BindToAllInterfaces_test.py:39:17:39:41 | ControlFlowNode for Tuple | provenance | Sink:MaD:63 |
+| BindToAllInterfaces_test.py:41:1:41:6 | ControlFlowNode for server [Attribute bind_addr] | BindToAllInterfaces_test.py:42:1:42:6 | ControlFlowNode for server [Attribute bind_addr] | provenance | |
+| BindToAllInterfaces_test.py:41:10:41:17 | ControlFlowNode for Server() [Attribute bind_addr] | BindToAllInterfaces_test.py:41:1:41:6 | ControlFlowNode for server [Attribute bind_addr] | provenance | |
+| BindToAllInterfaces_test.py:42:1:42:6 | ControlFlowNode for server [Attribute bind_addr] | BindToAllInterfaces_test.py:37:15:37:18 | ControlFlowNode for self [Attribute bind_addr] | provenance | |
+| BindToAllInterfaces_test.py:46:1:46:4 | ControlFlowNode for host | BindToAllInterfaces_test.py:48:9:48:18 | ControlFlowNode for Tuple | provenance | Sink:MaD:63 |
+| BindToAllInterfaces_test.py:46:8:46:44 | ControlFlowNode for Attribute() | BindToAllInterfaces_test.py:46:1:46:4 | ControlFlowNode for host | provenance | |
+| BindToAllInterfaces_test.py:46:35:46:43 | ControlFlowNode for StringLiteral | BindToAllInterfaces_test.py:46:8:46:44 | ControlFlowNode for Attribute() | provenance | dict.get |
+| BindToAllInterfaces_test.py:53:10:53:18 | ControlFlowNode for StringLiteral | BindToAllInterfaces_test.py:53:10:53:25 | ControlFlowNode for Tuple | provenance | Sink:MaD:63 |
+| BindToAllInterfaces_test.py:58:10:58:18 | ControlFlowNode for StringLiteral | BindToAllInterfaces_test.py:58:10:58:25 | ControlFlowNode for Tuple | provenance | Sink:MaD:63 |
+nodes
+| BindToAllInterfaces_test.py:5:9:5:17 | ControlFlowNode for StringLiteral | semmle.label | ControlFlowNode for StringLiteral |
+| BindToAllInterfaces_test.py:5:9:5:24 | ControlFlowNode for Tuple | semmle.label | ControlFlowNode for Tuple |
+| BindToAllInterfaces_test.py:9:9:9:10 | ControlFlowNode for StringLiteral | semmle.label | ControlFlowNode for StringLiteral |
+| BindToAllInterfaces_test.py:9:9:9:16 | ControlFlowNode for Tuple | semmle.label | ControlFlowNode for Tuple |
+| BindToAllInterfaces_test.py:16:1:16:10 | ControlFlowNode for ALL_LOCALS | semmle.label | ControlFlowNode for ALL_LOCALS |
+| BindToAllInterfaces_test.py:16:14:16:22 | ControlFlowNode for StringLiteral | semmle.label | ControlFlowNode for StringLiteral |
+| BindToAllInterfaces_test.py:17:9:17:24 | ControlFlowNode for Tuple | semmle.label | ControlFlowNode for Tuple |
+| BindToAllInterfaces_test.py:20:1:20:3 | ControlFlowNode for tup | semmle.label | ControlFlowNode for tup |
+| BindToAllInterfaces_test.py:21:8:21:10 | ControlFlowNode for tup | semmle.label | ControlFlowNode for tup |
+| BindToAllInterfaces_test.py:26:9:26:12 | ControlFlowNode for StringLiteral | semmle.label | ControlFlowNode for StringLiteral |
+| BindToAllInterfaces_test.py:26:9:26:18 | ControlFlowNode for Tuple | semmle.label | ControlFlowNode for Tuple |
+| BindToAllInterfaces_test.py:33:18:33:21 | ControlFlowNode for self [Return] [Attribute bind_addr] | semmle.label | ControlFlowNode for self [Return] [Attribute bind_addr] |
+| BindToAllInterfaces_test.py:34:9:34:12 | [post] ControlFlowNode for self [Attribute bind_addr] | semmle.label | [post] ControlFlowNode for self [Attribute bind_addr] |
+| BindToAllInterfaces_test.py:34:26:34:34 | ControlFlowNode for StringLiteral | semmle.label | ControlFlowNode for StringLiteral |
+| BindToAllInterfaces_test.py:37:15:37:18 | ControlFlowNode for self [Attribute bind_addr] | semmle.label | ControlFlowNode for self [Attribute bind_addr] |
+| BindToAllInterfaces_test.py:39:17:39:20 | ControlFlowNode for self [Attribute bind_addr] | semmle.label | ControlFlowNode for self [Attribute bind_addr] |
+| BindToAllInterfaces_test.py:39:17:39:30 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| BindToAllInterfaces_test.py:39:17:39:41 | ControlFlowNode for Tuple | semmle.label | ControlFlowNode for Tuple |
+| BindToAllInterfaces_test.py:41:1:41:6 | ControlFlowNode for server [Attribute bind_addr] | semmle.label | ControlFlowNode for server [Attribute bind_addr] |
+| BindToAllInterfaces_test.py:41:10:41:17 | ControlFlowNode for Server() [Attribute bind_addr] | semmle.label | ControlFlowNode for Server() [Attribute bind_addr] |
+| BindToAllInterfaces_test.py:42:1:42:6 | ControlFlowNode for server [Attribute bind_addr] | semmle.label | ControlFlowNode for server [Attribute bind_addr] |
+| BindToAllInterfaces_test.py:46:1:46:4 | ControlFlowNode for host | semmle.label | ControlFlowNode for host |
+| BindToAllInterfaces_test.py:46:8:46:44 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
+| BindToAllInterfaces_test.py:46:35:46:43 | ControlFlowNode for StringLiteral | semmle.label | ControlFlowNode for StringLiteral |
+| BindToAllInterfaces_test.py:48:9:48:18 | ControlFlowNode for Tuple | semmle.label | ControlFlowNode for Tuple |
+| BindToAllInterfaces_test.py:53:10:53:18 | ControlFlowNode for StringLiteral | semmle.label | ControlFlowNode for StringLiteral |
+| BindToAllInterfaces_test.py:53:10:53:25 | ControlFlowNode for Tuple | semmle.label | ControlFlowNode for Tuple |
+| BindToAllInterfaces_test.py:58:10:58:18 | ControlFlowNode for StringLiteral | semmle.label | ControlFlowNode for StringLiteral |
+| BindToAllInterfaces_test.py:58:10:58:25 | ControlFlowNode for Tuple | semmle.label | ControlFlowNode for Tuple |
+subpaths
diff --git a/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces_test.py b/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces_test.py
index 8d5d7998101..3c267ff2f29 100644
--- a/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces_test.py
+++ b/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces_test.py
@@ -13,7 +13,7 @@ s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.bind(('84.68.10.12', 8080))
# binds to all interfaces, insecure
-ALL_LOCALS = "0.0.0.0"
+ALL_LOCALS = "0.0.0.0" # $ Source
s.bind((ALL_LOCALS, 9090)) # $ Alert[py/bind-socket-all-network-interfaces]
# binds to all interfaces, insecure
@@ -31,7 +31,7 @@ s.bind(("::", 8080)) # $ Alert[py/bind-socket-all-network-interfaces]
# Address stored in a class attribute
class Server:
def __init__(self):
- self.bind_addr = '0.0.0.0'
+ self.bind_addr = '0.0.0.0' # $ Source
self.port = 31137
def start(self):
@@ -43,7 +43,7 @@ server.start()
# os.environ.get with insecure default
import os
-host = os.environ.get('APP_HOST', '0.0.0.0')
+host = os.environ.get('APP_HOST', '0.0.0.0') # $ Source
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.bind((host, 8080)) # $ Alert[py/bind-socket-all-network-interfaces]
From 10fddc7b960879d188e58cdf02a9a532cd844cea Mon Sep 17 00:00:00 2001
From: Owen Mansel-Chan
Date: Thu, 26 Mar 2026 11:40:11 +0000
Subject: [PATCH 012/185] Add barriers and barrier guards to MaD format
explanations
---
cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll | 10 +++++++++-
.../code/csharp/dataflow/internal/ExternalFlow.qll | 11 +++++++++--
go/ql/lib/semmle/go/dataflow/ExternalFlow.qll | 10 +++++++++-
.../ql/lib/semmle/code/java/dataflow/ExternalFlow.qll | 11 +++++++++--
.../frameworks/data/internal/ApiGraphModels.qll | 7 ++++++-
.../frameworks/data/internal/ApiGraphModels.qll | 7 ++++++-
.../ruby/frameworks/data/internal/ApiGraphModels.qll | 7 ++++++-
.../codeql/rust/dataflow/internal/ModelsAsData.qll | 11 +++++++++--
8 files changed, 63 insertions(+), 11 deletions(-)
diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
index 7cf3b937ac5..1ec501a85dd 100644
--- a/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
@@ -10,6 +10,10 @@
* `namespace; type; subtypes; name; signature; ext; input; kind`
* - Summaries:
* `namespace; type; subtypes; name; signature; ext; input; output; kind`
+ * - Barriers:
+ * `namespace; type; subtypes; name; signature; ext; output; kind; provenance`
+ * - BarrierGuards:
+ * `namespace; type; subtypes; name; signature; ext; input; acceptingvalue; kind; provenance`
*
* The interpretation of a row is similar to API-graphs with a left-to-right
* reading.
@@ -86,7 +90,11 @@
* value, and
* - flow from the _second_ indirection of the 0th argument to the first
* indirection of the return value, etc.
- * 8. The `kind` column is a tag that can be referenced from QL to determine to
+ * 8. The `acceptingvalue` column of barrier guard models specifies the condition
+ * under which the guard accepts or blocks flow. It can be one of "true" or
+ * "false". In the future "no-exception", "not-zero", "null", "not-null" may be
+ * supported.
+ * 9. The `kind` column is a tag that can be referenced from QL to determine to
* which classes the interpreted elements should be added. For example, for
* sources "remote" indicates a default remote flow source, and for summaries
* "taint" indicates a default additional taint step and "value" indicates a
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll
index 024e9cf119d..2b4264fc432 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll
@@ -11,6 +11,10 @@
* `namespace; type; subtypes; name; signature; ext; input; kind; provenance`
* - Summaries:
* `namespace; type; subtypes; name; signature; ext; input; output; kind; provenance`
+ * - Barriers:
+ * `namespace; type; subtypes; name; signature; ext; output; kind; provenance`
+ * - BarrierGuards:
+ * `namespace; type; subtypes; name; signature; ext; input; acceptingvalue; kind; provenance`
* - Neutrals:
* `namespace; type; name; signature; kind; provenance`
* A neutral is used to indicate that a callable is neutral with respect to flow (no summary), source (is not a source) or sink (is not a sink).
@@ -69,14 +73,17 @@
* - "Field[f]": Selects the contents of field `f`.
* - "Property[p]": Selects the contents of property `p`.
*
- * 8. The `kind` column is a tag that can be referenced from QL to determine to
+ * 8. The `acceptingvalue` column of barrier guard models specifies the condition
+ * under which the guard accepts or blocks flow. It can be one of "true" or
+ * "false", "no-exception", "not-zero", "null", "not-null".
+ * 9. The `kind` column is a tag that can be referenced from QL to determine to
* which classes the interpreted elements should be added. For example, for
* sources "remote" indicates a default remote flow source, and for summaries
* "taint" indicates a default additional taint step and "value" indicates a
* globally applicable value-preserving step. For neutrals the kind can be `summary`,
* `source` or `sink` to indicate that the neutral is neutral with respect to
* flow (no summary), source (is not a source) or sink (is not a sink).
- * 9. The `provenance` column is a tag to indicate the origin and verification of a model.
+ * 10. The `provenance` column is a tag to indicate the origin and verification of a model.
* The format is {origin}-{verification} or just "manual" where the origin describes
* the origin of the model and verification describes how the model has been verified.
* Some examples are:
diff --git a/go/ql/lib/semmle/go/dataflow/ExternalFlow.qll b/go/ql/lib/semmle/go/dataflow/ExternalFlow.qll
index e1170aeda24..3812b3df449 100644
--- a/go/ql/lib/semmle/go/dataflow/ExternalFlow.qll
+++ b/go/ql/lib/semmle/go/dataflow/ExternalFlow.qll
@@ -11,6 +11,10 @@
* `package; type; subtypes; name; signature; ext; input; kind; provenance`
* - Summaries:
* `package; type; subtypes; name; signature; ext; input; output; kind; provenance`
+ * - Barriers:
+ * `package; type; subtypes; name; signature; ext; output; kind; provenance`
+ * - BarrierGuards:
+ * `package; type; subtypes; name; signature; ext; input; acceptingvalue; kind; provenance`
* - Neutrals:
* `package; type; name; signature; kind; provenance`
* A neutral is used to indicate that a callable is neutral with respect to flow (no summary), source (is not a source) or sink (is not a sink).
@@ -78,7 +82,11 @@
* - "MapValue": Selects a value in a map.
* - "Dereference": Selects the value referenced by a pointer.
*
- * 8. The `kind` column is a tag that can be referenced from QL to determine to
+ * 8. The `acceptingvalue` column of barrier guard models specifies the condition
+ * under which the guard accepts or blocks flow. It can be one of "true" or
+ * "false". In the future "no-exception", "not-zero", "null", "not-null" may be
+ * supported.
+ * 9. The `kind` column is a tag that can be referenced from QL to determine to
* which classes the interpreted elements should be added. For example, for
* sources "remote" indicates a default remote flow source, and for summaries
* "taint" indicates a default additional taint step and "value" indicates a
diff --git a/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll b/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll
index 1536c81aa08..45db15897f7 100644
--- a/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll
+++ b/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll
@@ -11,6 +11,10 @@
* `package; type; subtypes; name; signature; ext; input; kind; provenance`
* - Summaries:
* `package; type; subtypes; name; signature; ext; input; output; kind; provenance`
+ * - Barriers:
+ * `package; type; subtypes; name; signature; ext; output; kind; provenance`
+ * - BarrierGuards:
+ * `package; type; subtypes; name; signature; ext; input; acceptingvalue; kind; provenance`
* - Neutrals:
* `package; type; name; signature; kind; provenance`
* A neutral is used to indicate that a callable is neutral with respect to flow (no summary), source (is not a source) or sink (is not a sink).
@@ -69,14 +73,17 @@
* in the given range. The range is inclusive at both ends.
* - "ReturnValue": Selects the return value of a call to the selected element.
* - "Element": Selects the collection elements of the selected element.
- * 8. The `kind` column is a tag that can be referenced from QL to determine to
+ * 8. The `acceptingvalue` column of barrier guard models specifies the condition
+ * under which the guard accepts or blocks flow. It can be one of "true" or
+ * "false", "no-exception", "not-zero", "null", "not-null".
+ * 9. The `kind` column is a tag that can be referenced from QL to determine to
* which classes the interpreted elements should be added. For example, for
* sources "remote" indicates a default remote flow source, and for summaries
* "taint" indicates a default additional taint step and "value" indicates a
* globally applicable value-preserving step. For neutrals the kind can be `summary`,
* `source` or `sink` to indicate that the neutral is neutral with respect to
* flow (no summary), source (is not a source) or sink (is not a sink).
- * 9. The `provenance` column is a tag to indicate the origin and verification of a model.
+ * 10. The `provenance` column is a tag to indicate the origin and verification of a model.
* The format is {origin}-{verification} or just "manual" where the origin describes
* the origin of the model and verification describes how the model has been verified.
* Some examples are:
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModels.qll b/javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModels.qll
index 60fe40e716d..34bf3267522 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModels.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModels.qll
@@ -10,6 +10,10 @@
* `type, path, kind`
* - Summaries:
* `type, path, input, output, kind`
+ * - Barriers:
+ * `type, path, kind`
+ * - BarrierGuards:
+ * `type, path, branch, kind`
* - Types:
* `type1, type2, path`
*
@@ -42,7 +46,8 @@
* 3. The `input` and `output` columns specify how data enters and leaves the element selected by the
* first `(type, path)` tuple. Both strings are `.`-separated access paths
* of the same syntax as the `path` column.
- * 4. The `kind` column is a tag that can be referenced from QL to determine to
+ * 4. The `branch` column of barrier guard models specifies which branch of the guard is blocking flow. It can be "true" or "false".
+ * 5. The `kind` column is a tag that can be referenced from QL to determine to
* which classes the interpreted elements should be added. For example, for
* sources `"remote"` indicates a default remote flow source, and for summaries
* `"taint"` indicates a default additional taint step and `"value"` indicates a
diff --git a/python/ql/lib/semmle/python/frameworks/data/internal/ApiGraphModels.qll b/python/ql/lib/semmle/python/frameworks/data/internal/ApiGraphModels.qll
index 60fe40e716d..34bf3267522 100644
--- a/python/ql/lib/semmle/python/frameworks/data/internal/ApiGraphModels.qll
+++ b/python/ql/lib/semmle/python/frameworks/data/internal/ApiGraphModels.qll
@@ -10,6 +10,10 @@
* `type, path, kind`
* - Summaries:
* `type, path, input, output, kind`
+ * - Barriers:
+ * `type, path, kind`
+ * - BarrierGuards:
+ * `type, path, branch, kind`
* - Types:
* `type1, type2, path`
*
@@ -42,7 +46,8 @@
* 3. The `input` and `output` columns specify how data enters and leaves the element selected by the
* first `(type, path)` tuple. Both strings are `.`-separated access paths
* of the same syntax as the `path` column.
- * 4. The `kind` column is a tag that can be referenced from QL to determine to
+ * 4. The `branch` column of barrier guard models specifies which branch of the guard is blocking flow. It can be "true" or "false".
+ * 5. The `kind` column is a tag that can be referenced from QL to determine to
* which classes the interpreted elements should be added. For example, for
* sources `"remote"` indicates a default remote flow source, and for summaries
* `"taint"` indicates a default additional taint step and `"value"` indicates a
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/data/internal/ApiGraphModels.qll b/ruby/ql/lib/codeql/ruby/frameworks/data/internal/ApiGraphModels.qll
index 60fe40e716d..34bf3267522 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/data/internal/ApiGraphModels.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/data/internal/ApiGraphModels.qll
@@ -10,6 +10,10 @@
* `type, path, kind`
* - Summaries:
* `type, path, input, output, kind`
+ * - Barriers:
+ * `type, path, kind`
+ * - BarrierGuards:
+ * `type, path, branch, kind`
* - Types:
* `type1, type2, path`
*
@@ -42,7 +46,8 @@
* 3. The `input` and `output` columns specify how data enters and leaves the element selected by the
* first `(type, path)` tuple. Both strings are `.`-separated access paths
* of the same syntax as the `path` column.
- * 4. The `kind` column is a tag that can be referenced from QL to determine to
+ * 4. The `branch` column of barrier guard models specifies which branch of the guard is blocking flow. It can be "true" or "false".
+ * 5. The `kind` column is a tag that can be referenced from QL to determine to
* which classes the interpreted elements should be added. For example, for
* sources `"remote"` indicates a default remote flow source, and for summaries
* `"taint"` indicates a default additional taint step and `"value"` indicates a
diff --git a/rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll b/rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll
index 4d28dd8de81..a21d50ed8ad 100644
--- a/rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll
+++ b/rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll
@@ -9,6 +9,10 @@
* `path; input; kind; provenance`
* - Summaries:
* `path; input; output; kind; provenance`
+ * - Barriers:
+ * `path; output; kind; provenance`
+ * - BarrierGuards:
+ * `path; input; branch; kind; provenance`
*
* The interpretation of a row is similar to API-graphs with a left-to-right
* reading.
@@ -34,12 +38,15 @@
* - `Field[i]`: the `i`th element of a tuple.
* - `Reference`: the referenced value.
* - `Future`: the value being computed asynchronously.
- * 3. The `kind` column is a tag that can be referenced from QL to determine to
+ * 3. The `branch` column of barrier guard models specifies which branch of the
+ * guard is blocking flow. It can be "true" or "false". In the future
+ * "no-exception", "not-zero", "null", "not-null" may be supported.
+ * 4. The `kind` column is a tag that can be referenced from QL to determine to
* which classes the interpreted elements should be added. For example, for
* sources `"remote"` indicates a default remote flow source, and for summaries
* `"taint"` indicates a default additional taint step and `"value"` indicates a
* globally applicable value-preserving step.
- * 4. The `provenance` column is mainly used internally, and should be set to `"manual"` for
+ * 5. The `provenance` column is mainly used internally, and should be set to `"manual"` for
* all custom models.
*/
From 61b13d570272fe63c193a1b6b2158cf20a959883 Mon Sep 17 00:00:00 2001
From: Owen Mansel-Chan
Date: Thu, 26 Mar 2026 11:40:42 +0000
Subject: [PATCH 013/185] C++: Add provenance to MaD format explanation
---
cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
index 1ec501a85dd..b36c37d8114 100644
--- a/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
@@ -99,6 +99,15 @@
* sources "remote" indicates a default remote flow source, and for summaries
* "taint" indicates a default additional taint step and "value" indicates a
* globally applicable value-preserving step.
+ * 10. The `provenance` column is a tag to indicate the origin and verification of a model.
+ * The format is {origin}-{verification} or just "manual" where the origin describes
+ * the origin of the model and verification describes how the model has been verified.
+ * Some examples are:
+ * - "df-generated": The model has been generated by the model generator tool.
+ * - "df-manual": The model has been generated by the model generator and verified by a human.
+ * - "manual": The model has been written by hand.
+ * This information is used in a heuristic for dataflow analysis to determine, if a
+ * model or source code should be used for determining flow.
*/
import cpp
From 805d2ec46cbe4c5aae54c817f59811f1595b250b Mon Sep 17 00:00:00 2001
From: Owen Mansel-Chan
Date: Thu, 26 Mar 2026 11:41:59 +0000
Subject: [PATCH 014/185] Go: Add provenance to MaD format explanation
---
go/ql/lib/semmle/go/dataflow/ExternalFlow.qll | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/go/ql/lib/semmle/go/dataflow/ExternalFlow.qll b/go/ql/lib/semmle/go/dataflow/ExternalFlow.qll
index 3812b3df449..23e08ce5cbf 100644
--- a/go/ql/lib/semmle/go/dataflow/ExternalFlow.qll
+++ b/go/ql/lib/semmle/go/dataflow/ExternalFlow.qll
@@ -91,6 +91,15 @@
* sources "remote" indicates a default remote flow source, and for summaries
* "taint" indicates a default additional taint step and "value" indicates a
* globally applicable value-preserving step.
+ * 10. The `provenance` column is a tag to indicate the origin and verification of a model.
+ * The format is {origin}-{verification} or just "manual" where the origin describes
+ * the origin of the model and verification describes how the model has been verified.
+ * Some examples are:
+ * - "df-generated": The model has been generated by the model generator tool.
+ * - "df-manual": The model has been generated by the model generator and verified by a human.
+ * - "manual": The model has been written by hand.
+ * This information is used in a heuristic for dataflow analysis to determine, if a
+ * model or source code should be used for determining flow.
*/
overlay[local?]
module;
From df842665b7156aa20de94972d39698a74326462b Mon Sep 17 00:00:00 2001
From: Owen Mansel-Chan
Date: Thu, 26 Mar 2026 11:42:13 +0000
Subject: [PATCH 015/185] Rust: Add neutrals to MaD format explanation
---
rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll | 3 +++
1 file changed, 3 insertions(+)
diff --git a/rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll b/rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll
index a21d50ed8ad..a43495ac784 100644
--- a/rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll
+++ b/rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll
@@ -13,6 +13,9 @@
* `path; output; kind; provenance`
* - BarrierGuards:
* `path; input; branch; kind; provenance`
+ * - Neutrals:
+ * `package; type; name; signature; kind; provenance`
+ * A neutral is used to indicate that a callable is neutral with respect to flow (no summary), source (is not a source) or sink (is not a sink).
*
* The interpretation of a row is similar to API-graphs with a left-to-right
* reading.
From e680d49c93334f38134c1e7da000e0e18db42fc3 Mon Sep 17 00:00:00 2001
From: Owen Mansel-Chan
Date: Thu, 26 Mar 2026 12:08:54 +0000
Subject: [PATCH 016/185] Shared: document extensible relations rather than CSV
---
cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll | 2 +-
.../lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll | 2 +-
go/ql/lib/semmle/go/dataflow/ExternalFlow.qll | 2 +-
java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll | 2 +-
4 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
index b36c37d8114..df1765ec07c 100644
--- a/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
@@ -3,7 +3,7 @@
*
* Provides classes and predicates for dealing with flow models specified in CSV format.
*
- * The CSV specification has the following columns:
+ * The extensible relations have the following columns:
* - Sources:
* `namespace; type; subtypes; name; signature; ext; output; kind`
* - Sinks:
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll
index 2b4264fc432..95b9578e4f3 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll
@@ -4,7 +4,7 @@
* Provides classes and predicates for dealing with MaD flow models specified
* in data extensions and CSV format.
*
- * The CSV specification has the following columns:
+ * The extensible relations have the following columns:
* - Sources:
* `namespace; type; subtypes; name; signature; ext; output; kind; provenance`
* - Sinks:
diff --git a/go/ql/lib/semmle/go/dataflow/ExternalFlow.qll b/go/ql/lib/semmle/go/dataflow/ExternalFlow.qll
index 23e08ce5cbf..05379c620fb 100644
--- a/go/ql/lib/semmle/go/dataflow/ExternalFlow.qll
+++ b/go/ql/lib/semmle/go/dataflow/ExternalFlow.qll
@@ -4,7 +4,7 @@
* Provides classes and predicates for dealing with flow models specified
* in data extensions and CSV format.
*
- * The CSV specification has the following columns:
+ * The extensible relations have the following columns:
* - Sources:
* `package; type; subtypes; name; signature; ext; output; kind; provenance`
* - Sinks:
diff --git a/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll b/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll
index 45db15897f7..8f6d1a7855a 100644
--- a/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll
+++ b/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll
@@ -4,7 +4,7 @@
* Provides classes and predicates for dealing with flow models specified
* in data extensions and CSV format.
*
- * The CSV specification has the following columns:
+ * The extensible relations have the following columns:
* - Sources:
* `package; type; subtypes; name; signature; ext; output; kind; provenance`
* - Sinks:
From 886a16bfad664c67da64f4136a3079009a38bd11 Mon Sep 17 00:00:00 2001
From: Owen Mansel-Chan
Date: Thu, 26 Mar 2026 12:09:11 +0000
Subject: [PATCH 017/185] C++: Add provenance column
---
cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
index df1765ec07c..ed40d391917 100644
--- a/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
@@ -5,11 +5,11 @@
*
* The extensible relations have the following columns:
* - Sources:
- * `namespace; type; subtypes; name; signature; ext; output; kind`
+ * `namespace; type; subtypes; name; signature; ext; output; kind; provenance`
* - Sinks:
- * `namespace; type; subtypes; name; signature; ext; input; kind`
+ * `namespace; type; subtypes; name; signature; ext; input; kind; provenance`
* - Summaries:
- * `namespace; type; subtypes; name; signature; ext; input; output; kind`
+ * `namespace; type; subtypes; name; signature; ext; input; output; kind; provenance`
* - Barriers:
* `namespace; type; subtypes; name; signature; ext; output; kind; provenance`
* - BarrierGuards:
From 5451424e751d102f492d4f7298518afd20cdf6e6 Mon Sep 17 00:00:00 2001
From: Owen Mansel-Chan
Date: Fri, 27 Mar 2026 09:46:20 +0000
Subject: [PATCH 018/185] Rust: Fix columns for neutrals
---
rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll b/rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll
index a43495ac784..cc7dd9963ea 100644
--- a/rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll
+++ b/rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll
@@ -14,7 +14,7 @@
* - BarrierGuards:
* `path; input; branch; kind; provenance`
* - Neutrals:
- * `package; type; name; signature; kind; provenance`
+ * `path; kind; provenance`
* A neutral is used to indicate that a callable is neutral with respect to flow (no summary), source (is not a source) or sink (is not a sink).
*
* The interpretation of a row is similar to API-graphs with a left-to-right
From 6dc98cfd01862aaab594d3d4d246036c3ea38689 Mon Sep 17 00:00:00 2001
From: Tom Hvitved
Date: Mon, 19 Jan 2026 14:53:22 +0100
Subject: [PATCH 019/185] Rust: Infer argument types based on trait bounds on
parameters
---
.../typeinference/BlanketImplementation.qll | 2 +-
.../internal/typeinference/TypeInference.qll | 283 +++++++------
.../internal/typeinference/TypeMention.qll | 2 +-
.../library-tests/type-inference/closure.rs | 26 +-
.../test/library-tests/type-inference/main.rs | 4 +-
.../type-inference/regressions.rs | 2 +-
.../type-inference/type-inference.expected | 375 ++++++++++++++++--
.../test/utils-tests/modelgenerator/option.rs | 4 +-
.../typeinference/internal/TypeInference.qll | 197 +++++++--
9 files changed, 653 insertions(+), 242 deletions(-)
diff --git a/rust/ql/lib/codeql/rust/internal/typeinference/BlanketImplementation.qll b/rust/ql/lib/codeql/rust/internal/typeinference/BlanketImplementation.qll
index 97dbf2d8f3a..26e8bdea4e0 100644
--- a/rust/ql/lib/codeql/rust/internal/typeinference/BlanketImplementation.qll
+++ b/rust/ql/lib/codeql/rust/internal/typeinference/BlanketImplementation.qll
@@ -134,7 +134,7 @@ module SatisfiesBlanketConstraint<
exists(ArgumentTypeAndBlanketOffset ato, Trait traitBound |
ato = MkArgumentTypeAndBlanketOffset(at, _) and
SatisfiesBlanketConstraintInput::relevantConstraint(ato, impl, traitBound) and
- SatisfiesBlanketConstraint::satisfiesConstraintType(ato, TTrait(traitBound), _, _)
+ SatisfiesBlanketConstraint::satisfiesConstraint(ato, TTrait(traitBound), _, _)
)
or
exists(TypeParam blanketTypeParam |
diff --git a/rust/ql/lib/codeql/rust/internal/typeinference/TypeInference.qll b/rust/ql/lib/codeql/rust/internal/typeinference/TypeInference.qll
index 0f9afcd06bb..c6a268be126 100644
--- a/rust/ql/lib/codeql/rust/internal/typeinference/TypeInference.qll
+++ b/rust/ql/lib/codeql/rust/internal/typeinference/TypeInference.qll
@@ -467,6 +467,41 @@ private predicate isPanicMacroCall(MacroExpr me) {
me.getMacroCall().resolveMacro().(MacroRules).getName().getText() = "panic"
}
+// Due to "binding modes" the type of the pattern is not necessarily the
+// same as the type of the initializer. However, when the pattern is an
+// identifier pattern, its type is guaranteed to be the same as the type of the
+// initializer.
+private predicate identLetStmt(LetStmt let, IdentPat lhs, Expr rhs) {
+ let.getPat() = lhs and
+ let.getInitializer() = rhs
+}
+
+/**
+ * Gets the root type of a closure.
+ *
+ * We model closures as `dyn Fn` trait object types. A closure might implement
+ * only `Fn`, `FnMut`, or `FnOnce`. But since `Fn` is a subtrait of the others,
+ * giving closures the type `dyn Fn` works well in practice -- even if not
+ * entirely accurate.
+ */
+private DynTraitType closureRootType() {
+ result = TDynTraitType(any(FnTrait t)) // always exists because of the mention in `builtins/mentions.rs`
+}
+
+/** Gets the path to a closure's return type. */
+private TypePath closureReturnPath() {
+ result =
+ TypePath::singleton(TDynTraitTypeParameter(any(FnTrait t), any(FnOnceTrait t).getOutputType()))
+}
+
+/** Gets the path to a closure's `index`th parameter type, where the arity is `arity`. */
+pragma[nomagic]
+private TypePath closureParameterPath(int arity, int index) {
+ result =
+ TypePath::cons(TDynTraitTypeParameter(_, any(FnTrait t).getTypeParam()),
+ TypePath::singleton(getTupleTypeParameter(arity, index)))
+}
+
/** Module for inferring certain type information. */
module CertainTypeInference {
pragma[nomagic]
@@ -544,11 +579,7 @@ module CertainTypeInference {
// is not a certain type equality.
exists(LetStmt let |
not let.hasTypeRepr() and
- // Due to "binding modes" the type of the pattern is not necessarily the
- // same as the type of the initializer. The pattern being an identifier
- // pattern is sufficient to ensure that this is not the case.
- let.getPat().(IdentPat) = n1 and
- let.getInitializer() = n2
+ identLetStmt(let, n1, n2)
)
or
exists(LetExpr let |
@@ -572,6 +603,21 @@ module CertainTypeInference {
)
else prefix2.isEmpty()
)
+ or
+ exists(CallExprImpl::DynamicCallExpr dce, TupleType tt, int i |
+ n1 = dce.getArgList() and
+ tt.getArity() = dce.getNumberOfSyntacticArguments() and
+ n2 = dce.getSyntacticPositionalArgument(i) and
+ prefix1 = TypePath::singleton(tt.getPositionalTypeParameter(i)) and
+ prefix2.isEmpty()
+ )
+ or
+ exists(ClosureExpr ce, int index |
+ n1 = ce and
+ n2 = ce.getParam(index).getPat() and
+ prefix1 = closureParameterPath(ce.getNumberOfParams(), index) and
+ prefix2.isEmpty()
+ )
}
pragma[nomagic]
@@ -636,6 +682,10 @@ module CertainTypeInference {
path.isEmpty() and
result instanceof NeverType
or
+ n instanceof ClosureExpr and
+ path.isEmpty() and
+ result = closureRootType()
+ or
infersCertainTypeAt(n, path, result.getATypeParameter())
}
@@ -835,17 +885,6 @@ private predicate typeEquality(AstNode n1, TypePath prefix1, AstNode n2, TypePat
n1.(ArrayRepeatExpr).getRepeatOperand() = n2 and
prefix1 = TypePath::singleton(getArrayTypeParameter()) and
prefix2.isEmpty()
- or
- exists(ClosureExpr ce, int index |
- n1 = ce and
- n2 = ce.getParam(index).getPat() and
- prefix1 = closureParameterPath(ce.getNumberOfParams(), index) and
- prefix2.isEmpty()
- )
- or
- n1.(ClosureExpr).getClosureBody() = n2 and
- prefix1 = closureReturnPath() and
- prefix2.isEmpty()
}
/**
@@ -881,6 +920,9 @@ private predicate lubCoercion(AstNode parent, AstNode child, TypePath prefix) {
strictcount(Expr e | bodyReturns(parent, e)) > 1 and
prefix.isEmpty()
or
+ parent = any(ClosureExpr ce | not ce.hasRetType() and ce.getClosureBody() = child) and
+ prefix = closureReturnPath()
+ or
exists(Struct s |
child = [parent.(RangeExpr).getStart(), parent.(RangeExpr).getEnd()] and
prefix = TypePath::singleton(TTypeParamTypeParameter(s.getGenericParamList().getATypeParam())) and
@@ -888,6 +930,19 @@ private predicate lubCoercion(AstNode parent, AstNode child, TypePath prefix) {
)
}
+private Type inferUnknownTypeFromAnnotation(AstNode n, TypePath path) {
+ inferType(n, path) = TUnknownType() and
+ // Normally, these are coercion sites, but in case a type is unknown we
+ // allow for type information to flow from the type annotation.
+ exists(TypeMention tm | result = tm.getTypeAt(path) |
+ tm = any(LetStmt let | identLetStmt(let, _, n)).getTypeRepr()
+ or
+ tm = any(ClosureExpr ce | n = ce.getBody()).getRetType().getTypeRepr()
+ or
+ tm = getReturnTypeMention(any(Function f | n = f.getBody()))
+ )
+}
+
/**
* Holds if the type tree of `n1` at `prefix1` should be equal to the type tree
* of `n2` at `prefix2`, but type information should only propagate from `n1` to
@@ -1545,12 +1600,14 @@ private module AssocFunctionResolution {
*
* This is either:
*
- * 1. `AssocFunctionCallMethodCallExpr`: a method call, `x.m()`;
- * 2. `AssocFunctionCallIndexExpr`: an index expression, `x[i]`, which is [syntactic sugar][1]
+ * 1. `MethodCallExprAssocFunctionCall`: a method call, `x.m()`;
+ * 2. `IndexExprAssocFunctionCall`: an index expression, `x[i]`, which is [syntactic sugar][1]
* for `*x.index(i)`;
- * 3. `AssocFunctionCallCallExpr`: a qualified function call, `Q::f(x)`; or
- * 4. `AssocFunctionCallOperation`: an operation expression, `x + y`, which is syntactic sugar
+ * 3. `CallExprAssocFunctionCall`: a qualified function call, `Q::f(x)`; or
+ * 4. `OperationAssocFunctionCall`: an operation expression, `x + y`, which is syntactic sugar
* for `Add::add(x, y)`.
+ * 5. `DynamicAssocFunctionCall`: a call to a closure, `c(x)`, which is syntactic sugar for
+ * `c.call_once(x)`, `c.call_mut(x)`, or `c.call(x)`.
*
* Note that only in case 1 and 2 is auto-dereferencing and borrowing allowed.
*
@@ -1567,7 +1624,7 @@ private module AssocFunctionResolution {
pragma[nomagic]
abstract predicate hasNameAndArity(string name, int arity);
- abstract Expr getNonReturnNodeAt(FunctionPosition pos);
+ abstract AstNode getNonReturnNodeAt(FunctionPosition pos);
AstNode getNodeAt(FunctionPosition pos) {
result = this.getNonReturnNodeAt(pos)
@@ -2101,7 +2158,7 @@ private module AssocFunctionResolution {
}
}
- private class AssocFunctionCallMethodCallExpr extends AssocFunctionCall instanceof MethodCallExpr {
+ private class MethodCallExprAssocFunctionCall extends AssocFunctionCall instanceof MethodCallExpr {
override predicate hasNameAndArity(string name, int arity) {
name = super.getIdentifier().getText() and
arity = super.getNumberOfSyntacticArguments()
@@ -2121,7 +2178,7 @@ private module AssocFunctionResolution {
override Trait getTrait() { none() }
}
- private class AssocFunctionCallIndexExpr extends AssocFunctionCall, IndexExpr {
+ private class IndexExprAssocFunctionCall extends AssocFunctionCall, IndexExpr {
private predicate isInMutableContext() {
// todo: does not handle all cases yet
VariableImpl::assignmentOperationDescendant(_, this)
@@ -2151,8 +2208,8 @@ private module AssocFunctionResolution {
}
}
- private class AssocFunctionCallCallExpr extends AssocFunctionCall, CallExpr {
- AssocFunctionCallCallExpr() {
+ private class CallExprAssocFunctionCall extends AssocFunctionCall, CallExpr {
+ CallExprAssocFunctionCall() {
exists(getCallExprPathQualifier(this)) and
// even if a target cannot be resolved by path resolution, it may still
// be possible to resolve a blanket implementation (so not `forex`)
@@ -2184,7 +2241,7 @@ private module AssocFunctionResolution {
override Trait getTrait() { result = getCallExprTraitQualifier(this) }
}
- final class AssocFunctionCallOperation extends AssocFunctionCall, Operation {
+ final class OperationAssocFunctionCall extends AssocFunctionCall, Operation {
override predicate hasNameAndArity(string name, int arity) {
this.isOverloaded(_, name, _) and
arity = this.getNumberOfOperands()
@@ -2242,6 +2299,29 @@ private module AssocFunctionResolution {
override Trait getTrait() { this.isOverloaded(result, _, _) }
}
+ private class DynamicAssocFunctionCall extends AssocFunctionCall instanceof CallExprImpl::DynamicCallExpr
+ {
+ pragma[nomagic]
+ override predicate hasNameAndArity(string name, int arity) {
+ name = "call_once" and // todo: handle call_mut and call
+ arity = 2 // args are passed in a tuple
+ }
+
+ override predicate hasReceiver() { any() }
+
+ override AstNode getNonReturnNodeAt(FunctionPosition pos) {
+ pos.asPosition() = 0 and
+ result = super.getFunction()
+ or
+ pos.asPosition() = 1 and
+ result = super.getArgList()
+ }
+
+ override predicate supportsAutoDerefAndBorrow() { any() }
+
+ override Trait getTrait() { result instanceof AnyFnTrait }
+ }
+
pragma[nomagic]
private AssocFunctionDeclaration getAssocFunctionSuccessor(
ImplOrTraitItemNode i, string name, int arity
@@ -2445,7 +2525,7 @@ private module AssocFunctionResolution {
) {
exists(CallDerefCand cdc, TypePath exprPath |
cdc = MkCallDerefCand(afc, selfPos, derefChain) and
- CallSatisfiesDerefConstraint::satisfiesConstraintTypeThrough(cdc, impl, _, exprPath, result) and
+ CallSatisfiesDerefConstraint::satisfiesConstraintThrough(cdc, impl, _, exprPath, result) and
exprPath.isCons(getDerefTargetTypeParameter(), path)
)
}
@@ -3198,7 +3278,7 @@ private module OperationMatchingInput implements MatchingInputSig {
}
}
- class Access extends AssocFunctionResolution::AssocFunctionCallOperation {
+ class Access extends AssocFunctionResolution::OperationAssocFunctionCall {
Type getTypeArgument(TypeArgumentPosition apos, TypePath path) { none() }
pragma[nomagic]
@@ -3566,7 +3646,7 @@ private module AwaitSatisfiesType = SatisfiesType type of pattern (loop variable)
exists(ForExpr fe, TypePath exprPath, AssociatedTypeTypeParameter tp |
n = fe.getPat() and
- ForIterableSatisfiesType::satisfiesConstraintType(fe.getIterable(), _, exprPath, result) and
+ ForIterableSatisfiesType::satisfiesConstraint(fe.getIterable(), _, exprPath, result) and
exprPath.isCons(tp, path)
|
tp = getIntoIteratorItemTypeParameter()
@@ -3744,130 +3824,36 @@ private Type inferForLoopExprType(AstNode n, TypePath path) {
)
}
-/**
- * An invoked expression, the target of a call that is either a local variable
- * or a non-path expression. This means that the expression denotes a
- * first-class function.
- */
-final private class InvokedClosureExpr extends Expr {
- private CallExprImpl::DynamicCallExpr call;
-
- InvokedClosureExpr() { call.getFunction() = this }
-
- Type getTypeAt(TypePath path) { result = inferType(this, path) }
-
- CallExpr getCall() { result = call }
-}
-
-private module InvokedClosureSatisfiesTypeInput implements SatisfiesTypeInputSig
-{
- predicate relevantConstraint(InvokedClosureExpr term, Type constraint) {
- exists(term) and
- constraint.(TraitType).getTrait() instanceof FnOnceTrait
- }
-}
-
-private module InvokedClosureSatisfiesType =
- SatisfiesType;
-
-/** Gets the type of `ce` when viewed as an implementation of `FnOnce`. */
-private Type invokedClosureFnTypeAt(InvokedClosureExpr ce, TypePath path) {
- InvokedClosureSatisfiesType::satisfiesConstraintType(ce, _, path, result)
-}
-
-/**
- * Gets the root type of a closure.
- *
- * We model closures as `dyn Fn` trait object types. A closure might implement
- * only `Fn`, `FnMut`, or `FnOnce`. But since `Fn` is a subtrait of the others,
- * giving closures the type `dyn Fn` works well in practice -- even if not
- * entirely accurate.
- */
-private DynTraitType closureRootType() {
- result = TDynTraitType(any(FnTrait t)) // always exists because of the mention in `builtins/mentions.rs`
-}
-
-/** Gets the path to a closure's return type. */
-private TypePath closureReturnPath() {
- result =
- TypePath::singleton(TDynTraitTypeParameter(any(FnTrait t), any(FnOnceTrait t).getOutputType()))
-}
-
-/** Gets the path to a closure with arity `arity`'s `index`th parameter type. */
pragma[nomagic]
-private TypePath closureParameterPath(int arity, int index) {
- result =
- TypePath::cons(TDynTraitTypeParameter(_, any(FnTrait t).getTypeParam()),
- TypePath::singleton(getTupleTypeParameter(arity, index)))
-}
-
-/** Gets the path to the return type of the `FnOnce` trait. */
-private TypePath fnReturnPath() {
- result = TypePath::singleton(getAssociatedTypeTypeParameter(any(FnOnceTrait t).getOutputType()))
-}
-
-/**
- * Gets the path to the parameter type of the `FnOnce` trait with arity `arity`
- * and index `index`.
- */
-pragma[nomagic]
-private TypePath fnParameterPath(int arity, int index) {
- result =
- TypePath::cons(TTypeParamTypeParameter(any(FnOnceTrait t).getTypeParam()),
- TypePath::singleton(getTupleTypeParameter(arity, index)))
-}
-
-pragma[nomagic]
-private Type inferDynamicCallExprType(Expr n, TypePath path) {
- exists(InvokedClosureExpr ce |
- // Propagate the function's return type to the call expression
- exists(TypePath path0 | result = invokedClosureFnTypeAt(ce, path0) |
- n = ce.getCall() and
- path = path0.stripPrefix(fnReturnPath())
+private Type inferClosureExprType(AstNode n, TypePath path) {
+ exists(ClosureExpr ce |
+ n = ce and
+ (
+ path = TypePath::singleton(TDynTraitTypeParameter(_, any(FnTrait t).getTypeParam())) and
+ result.(TupleType).getArity() = ce.getNumberOfParams()
or
- // Propagate the function's parameter type to the arguments
- exists(int index |
- n = ce.getCall().getSyntacticPositionalArgument(index) and
- path =
- path0.stripPrefix(fnParameterPath(ce.getCall().getArgList().getNumberOfArgs(), index))
+ exists(TypePath path0 |
+ result = ce.getRetType().getTypeRepr().(TypeMention).getTypeAt(path0) and
+ path = closureReturnPath().append(path0)
)
)
or
- // _If_ the invoked expression has the type of a closure, then we propagate
- // the surrounding types into the closure.
- exists(int arity, TypePath path0 | ce.getTypeAt(TypePath::nil()) = closureRootType() |
- // Propagate the type of arguments to the parameter types of closure
- exists(int index, ArgList args |
- n = ce and
- args = ce.getCall().getArgList() and
- arity = args.getNumberOfArgs() and
- result = inferType(args.getArg(index), path0) and
- path = closureParameterPath(arity, index).append(path0)
- )
- or
- // Propagate the type of the call expression to the return type of the closure
- n = ce and
- arity = ce.getCall().getArgList().getNumberOfArgs() and
- result = inferType(ce.getCall(), path0) and
- path = closureReturnPath().append(path0)
+ exists(Param p |
+ p = ce.getAParam() and
+ not p.hasTypeRepr() and
+ n = p.getPat() and
+ result = TUnknownType() and
+ path.isEmpty()
)
)
}
pragma[nomagic]
-private Type inferClosureExprType(AstNode n, TypePath path) {
- exists(ClosureExpr ce |
- n = ce and
- path.isEmpty() and
- result = closureRootType()
- or
- n = ce and
- path = TypePath::singleton(TDynTraitTypeParameter(_, any(FnTrait t).getTypeParam())) and
- result.(TupleType).getArity() = ce.getNumberOfParams()
- or
- // Propagate return type annotation to body
- n = ce.getClosureBody() and
- result = ce.getRetType().getTypeRepr().(TypeMention).getTypeAt(path)
+private TupleType inferArgList(ArgList args, TypePath path) {
+ exists(CallExprImpl::DynamicCallExpr dce |
+ args = dce.getArgList() and
+ result.getArity() = dce.getNumberOfSyntacticArguments() and
+ path.isEmpty()
)
}
@@ -3915,7 +3901,8 @@ private module Cached {
or
i instanceof ImplItemNode and dispatch = false
|
- result = call.(AssocFunctionResolution::AssocFunctionCall).resolveCallTarget(i, _, _, _)
+ result = call.(AssocFunctionResolution::AssocFunctionCall).resolveCallTarget(i, _, _, _) and
+ not call instanceof CallExprImpl::DynamicCallExpr
)
}
@@ -4023,11 +4010,13 @@ private module Cached {
or
result = inferForLoopExprType(n, path)
or
- result = inferDynamicCallExprType(n, path)
- or
result = inferClosureExprType(n, path)
or
+ result = inferArgList(n, path)
+ or
result = inferDeconstructionPatType(n, path)
+ or
+ result = inferUnknownTypeFromAnnotation(n, path)
)
}
}
diff --git a/rust/ql/lib/codeql/rust/internal/typeinference/TypeMention.qll b/rust/ql/lib/codeql/rust/internal/typeinference/TypeMention.qll
index 70dfbeda848..c4650f97c34 100644
--- a/rust/ql/lib/codeql/rust/internal/typeinference/TypeMention.qll
+++ b/rust/ql/lib/codeql/rust/internal/typeinference/TypeMention.qll
@@ -769,7 +769,7 @@ private Type getPathConcreteAssocTypeAt(Path path, TypePath typePath) {
TypeAlias alias, TypePath path0
|
pathConcreteTypeAssocType(path, tm, trait, traitOrTmTrait, alias) and
- PathSatisfiesConstraint::satisfiesConstraintTypeThrough(tm, impl, traitOrTmTrait, path0, result) and
+ PathSatisfiesConstraint::satisfiesConstraintThrough(tm, impl, traitOrTmTrait, path0, result) and
path0.isCons(TAssociatedTypeTypeParameter(trait, alias), typePath)
)
}
diff --git a/rust/ql/test/library-tests/type-inference/closure.rs b/rust/ql/test/library-tests/type-inference/closure.rs
index cbcf154563a..fbef401bb08 100644
--- a/rust/ql/test/library-tests/type-inference/closure.rs
+++ b/rust/ql/test/library-tests/type-inference/closure.rs
@@ -63,7 +63,7 @@ mod fn_once_trait {
};
let _r = apply(f, true); // $ target=apply type=_r:i64
- let f = |x| x + 1; // $ MISSING: type=x:i64 target=add
+ let f = |x| x + 1; // $ type=x:i64 $ MISSING: target=add
let _r2 = apply_two(f); // $ target=apply_two certainType=_r2:i64
}
}
@@ -100,7 +100,7 @@ mod fn_mut_trait {
};
let _r = apply(f, true); // $ target=apply type=_r:i64
- let f = |x| x + 1; // $ MISSING: type=x:i64 target=add
+ let f = |x| x + 1; // $ type=x:i64 $ MISSING: target=add
let _r2 = apply_two(f); // $ target=apply_two certainType=_r2:i64
}
}
@@ -137,7 +137,7 @@ mod fn_trait {
};
let _r = apply(f, true); // $ target=apply type=_r:i64
- let f = |x| x + 1; // $ MISSING: type=x:i64 target=add
+ let f = |x| x + 1; // $ type=x:i64 $ MISSING: target=add
let _r2 = apply_two(f); // $ target=apply_two certainType=_r2:i64
}
}
@@ -183,25 +183,25 @@ mod closure_infer_param {
}
fn test() {
- let f = |x| x; // $ MISSING: type=x:i64
+ let f = |x| x; // $ type=x:i64
let _r = apply1(f, 1i64); // $ target=apply1
- let f = |x| x; // $ MISSING: type=x:i64
+ let f = |x| x; // $ type=x:i64
let _r = apply2(f, 2i64); // $ target=apply2
- let f = |x| x; // $ MISSING: type=x:i64
+ let f = |x| x; // $ type=x:i64
let _r = apply3(&f, 3i64); // $ target=apply3
- let f = |x| x; // $ MISSING: type=x:i64
+ let f = |x| x; // $ type=x:i64
let _r = apply4(f, 4i64); // $ target=apply4
let mut f = |x| x; // $ MISSING: type=x:i64
let _r = apply5(&mut f, 5i64); // $ target=apply5
- let f = |x| x; // $ MISSING: type=x:i64
+ let f = |x| x; // $ type=x:i64
let _r = apply6(f, 6i64); // $ target=apply6
- let f = |x| x; // $ MISSING: type=x:i64
+ let f = |x| x; // $ type=x:i64
let _r = apply7(f, 7i64); // $ target=apply7
}
}
@@ -221,15 +221,15 @@ mod implicit_deref {
pub fn test() {
let x = 0i64;
- let v = Default::default(); // $ MISSING: type=v:i64 target=default
+ let v = Default::default(); // $ type=v:i64 target=default
let s = S(v);
- let _ret = s(x); // $ MISSING: type=_ret:bool
+ let _ret = s(x); // $ type=_ret:bool
let x = 0i32;
- let v = Default::default(); // $ MISSING: type=v:i32 target=default
+ let v = Default::default(); // $ type=v:i32 target=default
let s = S(v);
let s_ref = &s;
- let _ret = s_ref(x); // $ MISSING: type=_ret:bool
+ let _ret = s_ref(x); // $ type=_ret:bool
// The call below is not an implicit deref, instead it will target
// `impl FnOnce for &F` from
diff --git a/rust/ql/test/library-tests/type-inference/main.rs b/rust/ql/test/library-tests/type-inference/main.rs
index 3e3d9f85108..ecb4816ebb0 100644
--- a/rust/ql/test/library-tests/type-inference/main.rs
+++ b/rust/ql/test/library-tests/type-inference/main.rs
@@ -2259,7 +2259,7 @@ mod loops {
// for loops with arrays
for i in [1, 2, 3] {} // $ type=i:i32
- for i in [1, 2, 3].map(|x| x + 1) {} // $ target=map MISSING: type=i:i32
+ for i in [1, 2, 3].map(|x| x + 1) {} // $ target=map target=add type=i:i32
for i in [1, 2, 3].into_iter() {} // $ target=into_iter type=i:i32
let vals1 = [1u8, 2, 3]; // $ type=vals1:TArray.u8
@@ -2777,7 +2777,7 @@ mod arg_trait_bounds {
}
fn test() {
- let v = Default::default(); // $ MISSING: type=v:i64 target=default
+ let v = Default::default(); // $ type=v:i64 target=default
let g = Gen(v);
let _ = my_get(&g); // $ target=my_get
}
diff --git a/rust/ql/test/library-tests/type-inference/regressions.rs b/rust/ql/test/library-tests/type-inference/regressions.rs
index 21ab5fc24a0..5c830bb3db2 100644
--- a/rust/ql/test/library-tests/type-inference/regressions.rs
+++ b/rust/ql/test/library-tests/type-inference/regressions.rs
@@ -149,7 +149,7 @@ mod regression5 {
fn foo() -> S2 {
let x = S1.into(); // $ target=into
- x
+ x // $ SPURIOUS: type=x:T2.TRef.S1 -- happens because we currently do not consider the two `impl` blocks to be siblings
}
}
diff --git a/rust/ql/test/library-tests/type-inference/type-inference.expected b/rust/ql/test/library-tests/type-inference/type-inference.expected
index 0beb4a4ffb6..4be70359842 100644
--- a/rust/ql/test/library-tests/type-inference/type-inference.expected
+++ b/rust/ql/test/library-tests/type-inference/type-inference.expected
@@ -545,6 +545,14 @@ inferCertainType
| blanket_impl.rs:299:47:299:67 | "SELECT * FROM users" | | {EXTERNAL LOCATION} | & |
| blanket_impl.rs:299:47:299:67 | "SELECT * FROM users" | TRef | {EXTERNAL LOCATION} | str |
| closure.rs:4:19:31:5 | { ... } | | {EXTERNAL LOCATION} | () |
+| closure.rs:6:13:6:22 | my_closure | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:6:13:6:22 | my_closure | dyn(Args) | {EXTERNAL LOCATION} | (T_2) |
+| closure.rs:6:13:6:22 | my_closure | dyn(Args).T0 | {EXTERNAL LOCATION} | bool |
+| closure.rs:6:13:6:22 | my_closure | dyn(Args).T1 | {EXTERNAL LOCATION} | bool |
+| closure.rs:6:26:6:38 | \|...\| ... | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:6:26:6:38 | \|...\| ... | dyn(Args) | {EXTERNAL LOCATION} | (T_2) |
+| closure.rs:6:26:6:38 | \|...\| ... | dyn(Args).T0 | {EXTERNAL LOCATION} | bool |
+| closure.rs:6:26:6:38 | \|...\| ... | dyn(Args).T1 | {EXTERNAL LOCATION} | bool |
| closure.rs:6:27:6:27 | a | | {EXTERNAL LOCATION} | bool |
| closure.rs:6:30:6:30 | b | | {EXTERNAL LOCATION} | bool |
| closure.rs:6:33:6:33 | a | | {EXTERNAL LOCATION} | bool |
@@ -552,19 +560,47 @@ inferCertainType
| closure.rs:6:38:6:38 | b | | {EXTERNAL LOCATION} | bool |
| closure.rs:8:13:8:13 | x | | {EXTERNAL LOCATION} | i64 |
| closure.rs:8:22:8:25 | 1i64 | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:9:13:9:19 | add_one | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:9:23:9:34 | \|...\| ... | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:9:31:9:34 | 1i64 | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:10:18:10:24 | add_one | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:10:25:10:27 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:10:25:10:27 | ArgList | T0 | {EXTERNAL LOCATION} | i64 |
| closure.rs:10:26:10:26 | x | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:14:13:14:20 | add_zero | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:14:13:14:20 | add_zero | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:14:13:14:20 | add_zero | dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
+| closure.rs:14:24:14:33 | \|...\| n | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:14:24:14:33 | \|...\| n | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:14:24:14:33 | \|...\| n | dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
| closure.rs:14:25:14:25 | n | | {EXTERNAL LOCATION} | i64 |
| closure.rs:14:33:14:33 | n | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:15:18:15:25 | add_zero | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:15:18:15:25 | add_zero | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:15:18:15:25 | add_zero | dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
+| closure.rs:17:13:17:21 | _get_bool | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:17:25:21:9 | \|...\| ... | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:24:13:24:14 | id | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:24:18:24:22 | \|...\| b | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:25:18:25:19 | id | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:25:20:25:25 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:25:20:25:25 | ArgList | T0 | {EXTERNAL LOCATION} | bool |
| closure.rs:25:21:25:24 | true | | {EXTERNAL LOCATION} | bool |
+| closure.rs:28:13:28:15 | id2 | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:28:19:28:23 | \|...\| b | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:30:13:30:15 | _b2 | | {EXTERNAL LOCATION} | bool |
+| closure.rs:30:25:30:27 | id2 | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:35:44:35:44 | f | | closure.rs:35:20:35:41 | F |
| closure.rs:35:50:37:5 | { ... } | | {EXTERNAL LOCATION} | () |
| closure.rs:36:23:36:23 | f | | closure.rs:35:20:35:41 | F |
+| closure.rs:36:24:36:29 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:36:24:36:29 | ArgList | T0 | {EXTERNAL LOCATION} | bool |
| closure.rs:36:25:36:28 | true | | {EXTERNAL LOCATION} | bool |
| closure.rs:39:45:39:45 | f | | closure.rs:39:28:39:42 | F |
| closure.rs:39:51:41:5 | { ... } | | {EXTERNAL LOCATION} | () |
| closure.rs:40:23:40:23 | f | | closure.rs:39:28:39:42 | F |
+| closure.rs:40:24:40:29 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:40:24:40:29 | ArgList | T0 | {EXTERNAL LOCATION} | bool |
| closure.rs:40:25:40:28 | true | | {EXTERNAL LOCATION} | bool |
| closure.rs:43:46:43:46 | f | | closure.rs:43:22:43:43 | F |
| closure.rs:43:52:46:5 | { ... } | | {EXTERNAL LOCATION} | () |
@@ -573,23 +609,41 @@ inferCertainType
| closure.rs:48:45:48:45 | a | | closure.rs:48:14:48:14 | A |
| closure.rs:48:56:50:5 | { ... } | | closure.rs:48:17:48:17 | B |
| closure.rs:49:9:49:9 | f | | closure.rs:48:20:48:36 | F |
+| closure.rs:49:10:49:12 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:49:10:49:12 | ArgList | T0 | closure.rs:48:14:48:14 | A |
| closure.rs:49:11:49:11 | a | | closure.rs:48:14:48:14 | A |
| closure.rs:52:18:52:18 | f | | closure.rs:52:21:52:43 | impl ... |
| closure.rs:52:53:54:5 | { ... } | | {EXTERNAL LOCATION} | i64 |
| closure.rs:53:9:53:9 | f | | closure.rs:52:21:52:43 | impl ... |
| closure.rs:56:15:68:5 | { ... } | | {EXTERNAL LOCATION} | () |
+| closure.rs:57:13:57:13 | f | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:57:13:57:13 | f | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:57:13:57:13 | f | dyn(Args).T0 | {EXTERNAL LOCATION} | bool |
+| closure.rs:57:17:63:9 | \|...\| ... | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:57:17:63:9 | \|...\| ... | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:57:17:63:9 | \|...\| ... | dyn(Args).T0 | {EXTERNAL LOCATION} | bool |
| closure.rs:57:18:57:18 | x | | {EXTERNAL LOCATION} | bool |
| closure.rs:58:16:58:16 | x | | {EXTERNAL LOCATION} | bool |
+| closure.rs:64:24:64:24 | f | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:64:24:64:24 | f | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:64:24:64:24 | f | dyn(Args).T0 | {EXTERNAL LOCATION} | bool |
| closure.rs:64:27:64:30 | true | | {EXTERNAL LOCATION} | bool |
+| closure.rs:66:13:66:13 | f | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:66:17:66:25 | \|...\| ... | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:67:13:67:15 | _r2 | | {EXTERNAL LOCATION} | i64 |
| closure.rs:67:19:67:30 | apply_two(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:67:29:67:29 | f | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:72:47:72:47 | f | | closure.rs:72:20:72:40 | F |
| closure.rs:72:53:74:5 | { ... } | | {EXTERNAL LOCATION} | () |
| closure.rs:73:23:73:23 | f | | closure.rs:72:20:72:40 | F |
+| closure.rs:73:24:73:29 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:73:24:73:29 | ArgList | T0 | {EXTERNAL LOCATION} | bool |
| closure.rs:73:25:73:28 | true | | {EXTERNAL LOCATION} | bool |
| closure.rs:76:48:76:48 | f | | closure.rs:76:28:76:41 | F |
| closure.rs:76:54:78:5 | { ... } | | {EXTERNAL LOCATION} | () |
| closure.rs:77:23:77:23 | f | | closure.rs:76:28:76:41 | F |
+| closure.rs:77:24:77:29 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:77:24:77:29 | ArgList | T0 | {EXTERNAL LOCATION} | bool |
| closure.rs:77:25:77:28 | true | | {EXTERNAL LOCATION} | bool |
| closure.rs:80:49:80:49 | f | | closure.rs:80:22:80:42 | F |
| closure.rs:80:55:83:5 | { ... } | | {EXTERNAL LOCATION} | () |
@@ -598,23 +652,41 @@ inferCertainType
| closure.rs:85:48:85:48 | a | | closure.rs:85:14:85:14 | A |
| closure.rs:85:59:87:5 | { ... } | | closure.rs:85:17:85:17 | B |
| closure.rs:86:9:86:9 | f | | closure.rs:85:20:85:35 | F |
+| closure.rs:86:10:86:12 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:86:10:86:12 | ArgList | T0 | closure.rs:85:14:85:14 | A |
| closure.rs:86:11:86:11 | a | | closure.rs:85:14:85:14 | A |
| closure.rs:89:22:89:22 | f | | closure.rs:89:25:89:46 | impl ... |
| closure.rs:89:56:91:5 | { ... } | | {EXTERNAL LOCATION} | i64 |
| closure.rs:90:9:90:9 | f | | closure.rs:89:25:89:46 | impl ... |
| closure.rs:93:15:105:5 | { ... } | | {EXTERNAL LOCATION} | () |
+| closure.rs:94:13:94:13 | f | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:94:13:94:13 | f | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:94:13:94:13 | f | dyn(Args).T0 | {EXTERNAL LOCATION} | bool |
+| closure.rs:94:17:100:9 | \|...\| ... | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:94:17:100:9 | \|...\| ... | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:94:17:100:9 | \|...\| ... | dyn(Args).T0 | {EXTERNAL LOCATION} | bool |
| closure.rs:94:18:94:18 | x | | {EXTERNAL LOCATION} | bool |
| closure.rs:95:16:95:16 | x | | {EXTERNAL LOCATION} | bool |
+| closure.rs:101:24:101:24 | f | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:101:24:101:24 | f | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:101:24:101:24 | f | dyn(Args).T0 | {EXTERNAL LOCATION} | bool |
| closure.rs:101:27:101:30 | true | | {EXTERNAL LOCATION} | bool |
+| closure.rs:103:13:103:13 | f | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:103:17:103:25 | \|...\| ... | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:104:13:104:15 | _r2 | | {EXTERNAL LOCATION} | i64 |
| closure.rs:104:19:104:30 | apply_two(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:104:29:104:29 | f | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:109:40:109:40 | f | | closure.rs:109:20:109:37 | F |
| closure.rs:109:46:111:5 | { ... } | | {EXTERNAL LOCATION} | () |
| closure.rs:110:23:110:23 | f | | closure.rs:109:20:109:37 | F |
+| closure.rs:110:24:110:29 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:110:24:110:29 | ArgList | T0 | {EXTERNAL LOCATION} | bool |
| closure.rs:110:25:110:28 | true | | {EXTERNAL LOCATION} | bool |
| closure.rs:113:41:113:41 | f | | closure.rs:113:28:113:38 | F |
| closure.rs:113:47:115:5 | { ... } | | {EXTERNAL LOCATION} | () |
| closure.rs:114:23:114:23 | f | | closure.rs:113:28:113:38 | F |
+| closure.rs:114:24:114:29 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:114:24:114:29 | ArgList | T0 | {EXTERNAL LOCATION} | bool |
| closure.rs:114:25:114:28 | true | | {EXTERNAL LOCATION} | bool |
| closure.rs:117:42:117:42 | f | | closure.rs:117:22:117:39 | F |
| closure.rs:117:48:120:5 | { ... } | | {EXTERNAL LOCATION} | () |
@@ -623,16 +695,30 @@ inferCertainType
| closure.rs:122:41:122:41 | a | | closure.rs:122:14:122:14 | A |
| closure.rs:122:52:124:5 | { ... } | | closure.rs:122:17:122:17 | B |
| closure.rs:123:9:123:9 | f | | closure.rs:122:20:122:32 | F |
+| closure.rs:123:10:123:12 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:123:10:123:12 | ArgList | T0 | closure.rs:122:14:122:14 | A |
| closure.rs:123:11:123:11 | a | | closure.rs:122:14:122:14 | A |
| closure.rs:126:18:126:18 | f | | closure.rs:126:21:126:39 | impl ... |
| closure.rs:126:49:128:5 | { ... } | | {EXTERNAL LOCATION} | i64 |
| closure.rs:127:9:127:9 | f | | closure.rs:126:21:126:39 | impl ... |
| closure.rs:130:15:142:5 | { ... } | | {EXTERNAL LOCATION} | () |
+| closure.rs:131:13:131:13 | f | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:131:13:131:13 | f | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:131:13:131:13 | f | dyn(Args).T0 | {EXTERNAL LOCATION} | bool |
+| closure.rs:131:17:137:9 | \|...\| ... | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:131:17:137:9 | \|...\| ... | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:131:17:137:9 | \|...\| ... | dyn(Args).T0 | {EXTERNAL LOCATION} | bool |
| closure.rs:131:18:131:18 | x | | {EXTERNAL LOCATION} | bool |
| closure.rs:132:16:132:16 | x | | {EXTERNAL LOCATION} | bool |
+| closure.rs:138:24:138:24 | f | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:138:24:138:24 | f | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:138:24:138:24 | f | dyn(Args).T0 | {EXTERNAL LOCATION} | bool |
| closure.rs:138:27:138:30 | true | | {EXTERNAL LOCATION} | bool |
+| closure.rs:140:13:140:13 | f | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:140:17:140:25 | \|...\| ... | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:141:13:141:15 | _r2 | | {EXTERNAL LOCATION} | i64 |
| closure.rs:141:19:141:30 | apply_two(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:141:29:141:29 | f | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:146:54:146:54 | f | | {EXTERNAL LOCATION} | Box |
| closure.rs:146:54:146:54 | f | A | {EXTERNAL LOCATION} | Global |
| closure.rs:146:54:146:54 | f | T | closure.rs:146:26:146:51 | F |
@@ -641,6 +727,8 @@ inferCertainType
| closure.rs:147:9:147:9 | f | | {EXTERNAL LOCATION} | Box |
| closure.rs:147:9:147:9 | f | A | {EXTERNAL LOCATION} | Global |
| closure.rs:147:9:147:9 | f | T | closure.rs:146:26:146:51 | F |
+| closure.rs:147:10:147:14 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:147:10:147:14 | ArgList | T0 | closure.rs:146:20:146:20 | A |
| closure.rs:147:11:147:13 | arg | | closure.rs:146:20:146:20 | A |
| closure.rs:150:30:150:30 | f | | {EXTERNAL LOCATION} | Box |
| closure.rs:150:30:150:30 | f | A | {EXTERNAL LOCATION} | Global |
@@ -659,17 +747,24 @@ inferCertainType
| closure.rs:151:34:151:36 | arg | | closure.rs:150:24:150:24 | A |
| closure.rs:152:31:152:53 | ...::new(...) | | {EXTERNAL LOCATION} | Box |
| closure.rs:152:31:152:53 | ...::new(...) | A | {EXTERNAL LOCATION} | Global |
+| closure.rs:152:40:152:52 | \|...\| true | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:152:40:152:52 | \|...\| true | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:152:40:152:52 | \|...\| true | dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
| closure.rs:152:41:152:41 | _ | | {EXTERNAL LOCATION} | i64 |
| closure.rs:152:49:152:52 | true | | {EXTERNAL LOCATION} | bool |
| closure.rs:157:34:157:34 | f | | closure.rs:157:15:157:31 | F |
| closure.rs:157:40:157:40 | a | | {EXTERNAL LOCATION} | i64 |
| closure.rs:157:55:159:5 | { ... } | | {EXTERNAL LOCATION} | i64 |
| closure.rs:158:9:158:9 | f | | closure.rs:157:15:157:31 | F |
+| closure.rs:158:10:158:12 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:158:10:158:12 | ArgList | T0 | {EXTERNAL LOCATION} | i64 |
| closure.rs:158:11:158:11 | a | | {EXTERNAL LOCATION} | i64 |
| closure.rs:161:15:161:15 | f | | closure.rs:161:18:161:36 | impl ... |
| closure.rs:161:39:161:39 | a | | {EXTERNAL LOCATION} | i64 |
| closure.rs:161:54:163:5 | { ... } | | {EXTERNAL LOCATION} | i64 |
| closure.rs:162:9:162:9 | f | | closure.rs:161:18:161:36 | impl ... |
+| closure.rs:162:10:162:12 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:162:10:162:12 | ArgList | T0 | {EXTERNAL LOCATION} | i64 |
| closure.rs:162:11:162:11 | a | | {EXTERNAL LOCATION} | i64 |
| closure.rs:165:15:165:15 | f | | {EXTERNAL LOCATION} | & |
| closure.rs:165:15:165:15 | f | TRef | {EXTERNAL LOCATION} | dyn Fn |
@@ -683,11 +778,15 @@ inferCertainType
| closure.rs:166:9:166:9 | f | TRef.dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
| closure.rs:166:9:166:9 | f | TRef.dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
| closure.rs:166:9:166:9 | f | TRef.dyn(Output) | {EXTERNAL LOCATION} | i64 |
+| closure.rs:166:10:166:12 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:166:10:166:12 | ArgList | T0 | {EXTERNAL LOCATION} | i64 |
| closure.rs:166:11:166:11 | a | | {EXTERNAL LOCATION} | i64 |
| closure.rs:169:41:169:41 | f | | closure.rs:169:15:169:34 | F |
| closure.rs:169:47:169:47 | a | | {EXTERNAL LOCATION} | i64 |
| closure.rs:169:62:171:5 | { ... } | | {EXTERNAL LOCATION} | i64 |
| closure.rs:170:9:170:9 | f | | closure.rs:169:15:169:34 | F |
+| closure.rs:170:10:170:12 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:170:10:170:12 | ArgList | T0 | {EXTERNAL LOCATION} | i64 |
| closure.rs:170:11:170:11 | a | | {EXTERNAL LOCATION} | i64 |
| closure.rs:173:15:173:15 | f | | {EXTERNAL LOCATION} | &mut |
| closure.rs:173:15:173:15 | f | TRefMut | {EXTERNAL LOCATION} | dyn FnMut |
@@ -701,40 +800,67 @@ inferCertainType
| closure.rs:174:9:174:9 | f | TRefMut.dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
| closure.rs:174:9:174:9 | f | TRefMut.dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
| closure.rs:174:9:174:9 | f | TRefMut.dyn(Output) | {EXTERNAL LOCATION} | i64 |
+| closure.rs:174:10:174:12 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:174:10:174:12 | ArgList | T0 | {EXTERNAL LOCATION} | i64 |
| closure.rs:174:11:174:11 | a | | {EXTERNAL LOCATION} | i64 |
| closure.rs:177:18:177:18 | f | | closure.rs:177:21:177:37 | impl ... |
| closure.rs:177:40:177:40 | a | | closure.rs:177:15:177:15 | T |
| closure.rs:177:53:179:5 | { ... } | | {EXTERNAL LOCATION} | i64 |
| closure.rs:178:9:178:9 | f | | closure.rs:177:21:177:37 | impl ... |
+| closure.rs:178:10:178:12 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:178:10:178:12 | ArgList | T0 | closure.rs:177:15:177:15 | T |
| closure.rs:178:11:178:11 | a | | closure.rs:177:15:177:15 | T |
| closure.rs:181:42:181:42 | f | | closure.rs:181:18:181:35 | F |
| closure.rs:181:48:181:48 | a | | closure.rs:181:15:181:15 | T |
| closure.rs:181:61:183:5 | { ... } | | {EXTERNAL LOCATION} | i64 |
| closure.rs:182:9:182:9 | f | | closure.rs:181:18:181:35 | F |
+| closure.rs:182:10:182:12 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:182:10:182:12 | ArgList | T0 | closure.rs:181:15:181:15 | T |
| closure.rs:182:11:182:11 | a | | closure.rs:181:15:181:15 | T |
| closure.rs:185:15:206:5 | { ... } | | {EXTERNAL LOCATION} | () |
+| closure.rs:186:13:186:13 | f | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:186:17:186:21 | \|...\| x | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:187:13:187:14 | _r | | {EXTERNAL LOCATION} | i64 |
| closure.rs:187:18:187:32 | apply1(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:187:25:187:25 | f | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:187:28:187:31 | 1i64 | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:189:13:189:13 | f | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:189:17:189:21 | \|...\| x | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:190:13:190:14 | _r | | {EXTERNAL LOCATION} | i64 |
| closure.rs:190:18:190:32 | apply2(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:190:25:190:25 | f | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:190:28:190:31 | 2i64 | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:192:13:192:13 | f | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:192:17:192:21 | \|...\| x | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:193:13:193:14 | _r | | {EXTERNAL LOCATION} | i64 |
| closure.rs:193:18:193:33 | apply3(...) | | {EXTERNAL LOCATION} | i64 |
| closure.rs:193:25:193:26 | &f | | {EXTERNAL LOCATION} | & |
+| closure.rs:193:26:193:26 | f | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:193:29:193:32 | 3i64 | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:195:13:195:13 | f | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:195:17:195:21 | \|...\| x | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:196:13:196:14 | _r | | {EXTERNAL LOCATION} | i64 |
| closure.rs:196:18:196:32 | apply4(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:196:25:196:25 | f | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:196:28:196:31 | 4i64 | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:198:17:198:17 | f | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:198:21:198:25 | \|...\| x | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:199:13:199:14 | _r | | {EXTERNAL LOCATION} | i64 |
| closure.rs:199:18:199:37 | apply5(...) | | {EXTERNAL LOCATION} | i64 |
| closure.rs:199:25:199:30 | &mut f | | {EXTERNAL LOCATION} | &mut |
+| closure.rs:199:30:199:30 | f | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:199:33:199:36 | 5i64 | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:201:13:201:13 | f | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:201:17:201:21 | \|...\| x | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:202:13:202:14 | _r | | {EXTERNAL LOCATION} | i64 |
| closure.rs:202:18:202:32 | apply6(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:202:25:202:25 | f | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:202:28:202:31 | 6i64 | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:204:13:204:13 | f | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:204:17:204:21 | \|...\| x | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:205:13:205:14 | _r | | {EXTERNAL LOCATION} | i64 |
| closure.rs:205:18:205:32 | apply7(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:205:25:205:25 | f | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:205:28:205:31 | 7i64 | | {EXTERNAL LOCATION} | i64 |
| closure.rs:217:18:217:22 | SelfParam | | {EXTERNAL LOCATION} | & |
| closure.rs:217:18:217:22 | SelfParam | TRef | closure.rs:212:5:212:19 | S |
@@ -745,19 +871,29 @@ inferCertainType
| closure.rs:217:42:219:9 | { ... } | TRef.dyn(Args).T0 | closure.rs:214:10:214:10 | T |
| closure.rs:217:42:219:9 | { ... } | TRef.dyn(Output) | {EXTERNAL LOCATION} | bool |
| closure.rs:218:13:218:22 | &... | | {EXTERNAL LOCATION} | & |
+| closure.rs:218:14:218:22 | \|...\| false | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:218:18:218:22 | false | | {EXTERNAL LOCATION} | bool |
| closure.rs:222:19:240:5 | { ... } | | {EXTERNAL LOCATION} | () |
| closure.rs:223:13:223:13 | x | | {EXTERNAL LOCATION} | i64 |
| closure.rs:223:17:223:20 | 0i64 | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:226:21:226:23 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:226:21:226:23 | ArgList | T0 | {EXTERNAL LOCATION} | i64 |
| closure.rs:226:22:226:22 | x | | {EXTERNAL LOCATION} | i64 |
| closure.rs:228:13:228:13 | x | | {EXTERNAL LOCATION} | i32 |
| closure.rs:228:17:228:20 | 0i32 | | {EXTERNAL LOCATION} | i32 |
| closure.rs:231:13:231:17 | s_ref | | {EXTERNAL LOCATION} | & |
| closure.rs:231:21:231:22 | &s | | {EXTERNAL LOCATION} | & |
| closure.rs:232:20:232:24 | s_ref | | {EXTERNAL LOCATION} | & |
+| closure.rs:232:25:232:27 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:232:25:232:27 | ArgList | T0 | {EXTERNAL LOCATION} | i32 |
| closure.rs:232:26:232:26 | x | | {EXTERNAL LOCATION} | i32 |
+| closure.rs:238:13:238:13 | c | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:238:17:238:21 | \|...\| x | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:239:9:239:12 | (...) | | {EXTERNAL LOCATION} | & |
| closure.rs:239:10:239:11 | &c | | {EXTERNAL LOCATION} | & |
+| closure.rs:239:11:239:11 | c | | {EXTERNAL LOCATION} | dyn Fn |
+| closure.rs:239:13:239:15 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:239:13:239:15 | ArgList | T0 | {EXTERNAL LOCATION} | i32 |
| closure.rs:239:14:239:14 | x | | {EXTERNAL LOCATION} | i32 |
| dereference.rs:13:14:13:18 | SelfParam | | {EXTERNAL LOCATION} | & |
| dereference.rs:13:14:13:18 | SelfParam | TRef | dereference.rs:5:1:7:1 | MyIntPointer |
@@ -2357,6 +2493,7 @@ inferCertainType
| main.rs:1340:40:1345:5 | { ... } | | {EXTERNAL LOCATION} | Result |
| main.rs:1340:40:1345:5 | { ... } | E | main.rs:1320:5:1321:14 | S2 |
| main.rs:1340:40:1345:5 | { ... } | T | main.rs:1317:5:1318:14 | S1 |
+| main.rs:1343:24:1343:28 | \|...\| s | | {EXTERNAL LOCATION} | dyn Fn |
| main.rs:1349:30:1349:34 | input | | {EXTERNAL LOCATION} | Result |
| main.rs:1349:30:1349:34 | input | E | main.rs:1317:5:1318:14 | S1 |
| main.rs:1349:30:1349:34 | input | T | main.rs:1349:20:1349:27 | T |
@@ -2366,6 +2503,7 @@ inferCertainType
| main.rs:1350:21:1350:25 | input | | {EXTERNAL LOCATION} | Result |
| main.rs:1350:21:1350:25 | input | E | main.rs:1317:5:1318:14 | S1 |
| main.rs:1350:21:1350:25 | input | T | main.rs:1349:20:1349:27 | T |
+| main.rs:1351:49:1354:9 | \|...\| ... | | {EXTERNAL LOCATION} | dyn Fn |
| main.rs:1352:22:1352:27 | "{:?}\\n" | | {EXTERNAL LOCATION} | & |
| main.rs:1352:22:1352:27 | "{:?}\\n" | TRef | {EXTERNAL LOCATION} | str |
| main.rs:1352:22:1352:30 | ...::_print(...) | | {EXTERNAL LOCATION} | () |
@@ -3280,6 +3418,7 @@ inferCertainType
| main.rs:2261:28:2261:29 | { ... } | | {EXTERNAL LOCATION} | () |
| main.rs:2262:9:2262:44 | for ... in ... { ... } | | {EXTERNAL LOCATION} | () |
| main.rs:2262:18:2262:26 | [...] | | {EXTERNAL LOCATION} | [;] |
+| main.rs:2262:32:2262:40 | \|...\| ... | | {EXTERNAL LOCATION} | dyn Fn |
| main.rs:2262:43:2262:44 | { ... } | | {EXTERNAL LOCATION} | () |
| main.rs:2263:9:2263:41 | for ... in ... { ... } | | {EXTERNAL LOCATION} | () |
| main.rs:2263:18:2263:26 | [...] | | {EXTERNAL LOCATION} | [;] |
@@ -6192,6 +6331,8 @@ inferType
| closure.rs:10:18:10:24 | add_one | dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
| closure.rs:10:18:10:24 | add_one | dyn(Output) | {EXTERNAL LOCATION} | i64 |
| closure.rs:10:18:10:27 | add_one(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:10:25:10:27 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:10:25:10:27 | ArgList | T0 | {EXTERNAL LOCATION} | i64 |
| closure.rs:10:26:10:26 | x | | {EXTERNAL LOCATION} | i64 |
| closure.rs:13:13:13:13 | x | | {EXTERNAL LOCATION} | i64 |
| closure.rs:13:17:13:34 | ...::default(...) | | {EXTERNAL LOCATION} | i64 |
@@ -6211,6 +6352,8 @@ inferType
| closure.rs:15:18:15:25 | add_zero | dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
| closure.rs:15:18:15:25 | add_zero | dyn(Output) | {EXTERNAL LOCATION} | i64 |
| closure.rs:15:18:15:28 | add_zero(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:15:26:15:28 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:15:26:15:28 | ArgList | T0 | {EXTERNAL LOCATION} | i64 |
| closure.rs:15:27:15:27 | x | | {EXTERNAL LOCATION} | i64 |
| closure.rs:17:13:17:21 | _get_bool | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:17:13:17:21 | _get_bool | dyn(Args) | {EXTERNAL LOCATION} | () |
@@ -6238,6 +6381,8 @@ inferType
| closure.rs:25:18:25:19 | id | dyn(Args).T0 | {EXTERNAL LOCATION} | bool |
| closure.rs:25:18:25:19 | id | dyn(Output) | {EXTERNAL LOCATION} | bool |
| closure.rs:25:18:25:25 | id(...) | | {EXTERNAL LOCATION} | bool |
+| closure.rs:25:20:25:25 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:25:20:25:25 | ArgList | T0 | {EXTERNAL LOCATION} | bool |
| closure.rs:25:21:25:24 | true | | {EXTERNAL LOCATION} | bool |
| closure.rs:28:13:28:15 | id2 | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:28:13:28:15 | id2 | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
@@ -6257,18 +6402,24 @@ inferType
| closure.rs:30:25:30:27 | id2 | dyn(Args).T0 | {EXTERNAL LOCATION} | bool |
| closure.rs:30:25:30:27 | id2 | dyn(Output) | {EXTERNAL LOCATION} | bool |
| closure.rs:30:25:30:32 | id2(...) | | {EXTERNAL LOCATION} | bool |
+| closure.rs:30:28:30:32 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:30:28:30:32 | ArgList | T0 | {EXTERNAL LOCATION} | bool |
| closure.rs:30:29:30:31 | arg | | {EXTERNAL LOCATION} | bool |
| closure.rs:35:44:35:44 | f | | closure.rs:35:20:35:41 | F |
| closure.rs:35:50:37:5 | { ... } | | {EXTERNAL LOCATION} | () |
| closure.rs:36:13:36:19 | _return | | {EXTERNAL LOCATION} | i64 |
| closure.rs:36:23:36:23 | f | | closure.rs:35:20:35:41 | F |
| closure.rs:36:23:36:29 | f(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:36:24:36:29 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:36:24:36:29 | ArgList | T0 | {EXTERNAL LOCATION} | bool |
| closure.rs:36:25:36:28 | true | | {EXTERNAL LOCATION} | bool |
| closure.rs:39:45:39:45 | f | | closure.rs:39:28:39:42 | F |
| closure.rs:39:51:41:5 | { ... } | | {EXTERNAL LOCATION} | () |
| closure.rs:40:13:40:19 | _return | | {EXTERNAL LOCATION} | () |
| closure.rs:40:23:40:23 | f | | closure.rs:39:28:39:42 | F |
| closure.rs:40:23:40:29 | f(...) | | {EXTERNAL LOCATION} | () |
+| closure.rs:40:24:40:29 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:40:24:40:29 | ArgList | T0 | {EXTERNAL LOCATION} | bool |
| closure.rs:40:25:40:28 | true | | {EXTERNAL LOCATION} | bool |
| closure.rs:43:46:43:46 | f | | closure.rs:43:22:43:43 | F |
| closure.rs:43:52:46:5 | { ... } | | {EXTERNAL LOCATION} | () |
@@ -6276,74 +6427,77 @@ inferType
| closure.rs:44:19:44:36 | ...::default(...) | | {EXTERNAL LOCATION} | bool |
| closure.rs:45:9:45:9 | f | | closure.rs:43:22:43:43 | F |
| closure.rs:45:9:45:14 | f(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:45:10:45:14 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:45:10:45:14 | ArgList | T0 | {EXTERNAL LOCATION} | bool |
| closure.rs:45:11:45:13 | arg | | {EXTERNAL LOCATION} | bool |
| closure.rs:48:39:48:39 | f | | closure.rs:48:20:48:36 | F |
| closure.rs:48:45:48:45 | a | | closure.rs:48:14:48:14 | A |
| closure.rs:48:56:50:5 | { ... } | | closure.rs:48:17:48:17 | B |
| closure.rs:49:9:49:9 | f | | closure.rs:48:20:48:36 | F |
| closure.rs:49:9:49:12 | f(...) | | closure.rs:48:17:48:17 | B |
+| closure.rs:49:10:49:12 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:49:10:49:12 | ArgList | T0 | closure.rs:48:14:48:14 | A |
| closure.rs:49:11:49:11 | a | | closure.rs:48:14:48:14 | A |
| closure.rs:52:18:52:18 | f | | closure.rs:52:21:52:43 | impl ... |
| closure.rs:52:53:54:5 | { ... } | | {EXTERNAL LOCATION} | i64 |
| closure.rs:53:9:53:9 | f | | closure.rs:52:21:52:43 | impl ... |
| closure.rs:53:9:53:12 | f(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:53:10:53:12 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:53:10:53:12 | ArgList | T0 | {EXTERNAL LOCATION} | i32 |
| closure.rs:53:11:53:11 | 2 | | {EXTERNAL LOCATION} | i32 |
-| closure.rs:53:11:53:11 | 2 | | {EXTERNAL LOCATION} | i64 |
| closure.rs:56:15:68:5 | { ... } | | {EXTERNAL LOCATION} | () |
| closure.rs:57:13:57:13 | f | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:57:13:57:13 | f | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
| closure.rs:57:13:57:13 | f | dyn(Args).T0 | {EXTERNAL LOCATION} | bool |
-| closure.rs:57:13:57:13 | f | dyn(Output) | {EXTERNAL LOCATION} | i32 |
| closure.rs:57:13:57:13 | f | dyn(Output) | {EXTERNAL LOCATION} | i64 |
| closure.rs:57:17:63:9 | \|...\| ... | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:57:17:63:9 | \|...\| ... | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
| closure.rs:57:17:63:9 | \|...\| ... | dyn(Args).T0 | {EXTERNAL LOCATION} | bool |
-| closure.rs:57:17:63:9 | \|...\| ... | dyn(Output) | {EXTERNAL LOCATION} | i32 |
| closure.rs:57:17:63:9 | \|...\| ... | dyn(Output) | {EXTERNAL LOCATION} | i64 |
| closure.rs:57:18:57:18 | x | | {EXTERNAL LOCATION} | bool |
| closure.rs:57:34:63:9 | { ... } | | {EXTERNAL LOCATION} | i32 |
-| closure.rs:57:34:63:9 | { ... } | | {EXTERNAL LOCATION} | i64 |
| closure.rs:58:13:62:13 | if x {...} else {...} | | {EXTERNAL LOCATION} | i32 |
-| closure.rs:58:13:62:13 | if x {...} else {...} | | {EXTERNAL LOCATION} | i64 |
| closure.rs:58:16:58:16 | x | | {EXTERNAL LOCATION} | bool |
| closure.rs:58:18:60:13 | { ... } | | {EXTERNAL LOCATION} | i32 |
-| closure.rs:58:18:60:13 | { ... } | | {EXTERNAL LOCATION} | i64 |
| closure.rs:59:17:59:17 | 1 | | {EXTERNAL LOCATION} | i32 |
-| closure.rs:59:17:59:17 | 1 | | {EXTERNAL LOCATION} | i64 |
| closure.rs:60:20:62:13 | { ... } | | {EXTERNAL LOCATION} | i32 |
-| closure.rs:60:20:62:13 | { ... } | | {EXTERNAL LOCATION} | i64 |
| closure.rs:61:17:61:17 | 0 | | {EXTERNAL LOCATION} | i32 |
-| closure.rs:61:17:61:17 | 0 | | {EXTERNAL LOCATION} | i64 |
-| closure.rs:64:13:64:14 | _r | | {EXTERNAL LOCATION} | i32 |
| closure.rs:64:13:64:14 | _r | | {EXTERNAL LOCATION} | i64 |
-| closure.rs:64:18:64:31 | apply(...) | | {EXTERNAL LOCATION} | i32 |
| closure.rs:64:18:64:31 | apply(...) | | {EXTERNAL LOCATION} | i64 |
| closure.rs:64:24:64:24 | f | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:64:24:64:24 | f | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
| closure.rs:64:24:64:24 | f | dyn(Args).T0 | {EXTERNAL LOCATION} | bool |
-| closure.rs:64:24:64:24 | f | dyn(Output) | {EXTERNAL LOCATION} | i32 |
| closure.rs:64:24:64:24 | f | dyn(Output) | {EXTERNAL LOCATION} | i64 |
| closure.rs:64:27:64:30 | true | | {EXTERNAL LOCATION} | bool |
| closure.rs:66:13:66:13 | f | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:66:13:66:13 | f | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:66:13:66:13 | f | dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
| closure.rs:66:17:66:25 | \|...\| ... | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:66:17:66:25 | \|...\| ... | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:66:17:66:25 | \|...\| ... | dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
+| closure.rs:66:18:66:18 | x | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:66:21:66:21 | x | | {EXTERNAL LOCATION} | i64 |
| closure.rs:66:25:66:25 | 1 | | {EXTERNAL LOCATION} | i32 |
| closure.rs:67:13:67:15 | _r2 | | {EXTERNAL LOCATION} | i64 |
| closure.rs:67:19:67:30 | apply_two(...) | | {EXTERNAL LOCATION} | i64 |
| closure.rs:67:29:67:29 | f | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:67:29:67:29 | f | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:67:29:67:29 | f | dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
| closure.rs:72:47:72:47 | f | | closure.rs:72:20:72:40 | F |
| closure.rs:72:53:74:5 | { ... } | | {EXTERNAL LOCATION} | () |
| closure.rs:73:13:73:19 | _return | | {EXTERNAL LOCATION} | i64 |
| closure.rs:73:23:73:23 | f | | closure.rs:72:20:72:40 | F |
| closure.rs:73:23:73:29 | f(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:73:24:73:29 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:73:24:73:29 | ArgList | T0 | {EXTERNAL LOCATION} | bool |
| closure.rs:73:25:73:28 | true | | {EXTERNAL LOCATION} | bool |
| closure.rs:76:48:76:48 | f | | closure.rs:76:28:76:41 | F |
| closure.rs:76:54:78:5 | { ... } | | {EXTERNAL LOCATION} | () |
| closure.rs:77:13:77:19 | _return | | {EXTERNAL LOCATION} | () |
| closure.rs:77:23:77:23 | f | | closure.rs:76:28:76:41 | F |
| closure.rs:77:23:77:29 | f(...) | | {EXTERNAL LOCATION} | () |
+| closure.rs:77:24:77:29 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:77:24:77:29 | ArgList | T0 | {EXTERNAL LOCATION} | bool |
| closure.rs:77:25:77:28 | true | | {EXTERNAL LOCATION} | bool |
| closure.rs:80:49:80:49 | f | | closure.rs:80:22:80:42 | F |
| closure.rs:80:55:83:5 | { ... } | | {EXTERNAL LOCATION} | () |
@@ -6351,74 +6505,77 @@ inferType
| closure.rs:81:19:81:36 | ...::default(...) | | {EXTERNAL LOCATION} | bool |
| closure.rs:82:9:82:9 | f | | closure.rs:80:22:80:42 | F |
| closure.rs:82:9:82:14 | f(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:82:10:82:14 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:82:10:82:14 | ArgList | T0 | {EXTERNAL LOCATION} | bool |
| closure.rs:82:11:82:13 | arg | | {EXTERNAL LOCATION} | bool |
| closure.rs:85:42:85:42 | f | | closure.rs:85:20:85:35 | F |
| closure.rs:85:48:85:48 | a | | closure.rs:85:14:85:14 | A |
| closure.rs:85:59:87:5 | { ... } | | closure.rs:85:17:85:17 | B |
| closure.rs:86:9:86:9 | f | | closure.rs:85:20:85:35 | F |
| closure.rs:86:9:86:12 | f(...) | | closure.rs:85:17:85:17 | B |
+| closure.rs:86:10:86:12 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:86:10:86:12 | ArgList | T0 | closure.rs:85:14:85:14 | A |
| closure.rs:86:11:86:11 | a | | closure.rs:85:14:85:14 | A |
| closure.rs:89:22:89:22 | f | | closure.rs:89:25:89:46 | impl ... |
| closure.rs:89:56:91:5 | { ... } | | {EXTERNAL LOCATION} | i64 |
| closure.rs:90:9:90:9 | f | | closure.rs:89:25:89:46 | impl ... |
| closure.rs:90:9:90:12 | f(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:90:10:90:12 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:90:10:90:12 | ArgList | T0 | {EXTERNAL LOCATION} | i32 |
| closure.rs:90:11:90:11 | 2 | | {EXTERNAL LOCATION} | i32 |
-| closure.rs:90:11:90:11 | 2 | | {EXTERNAL LOCATION} | i64 |
| closure.rs:93:15:105:5 | { ... } | | {EXTERNAL LOCATION} | () |
| closure.rs:94:13:94:13 | f | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:94:13:94:13 | f | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
| closure.rs:94:13:94:13 | f | dyn(Args).T0 | {EXTERNAL LOCATION} | bool |
-| closure.rs:94:13:94:13 | f | dyn(Output) | {EXTERNAL LOCATION} | i32 |
| closure.rs:94:13:94:13 | f | dyn(Output) | {EXTERNAL LOCATION} | i64 |
| closure.rs:94:17:100:9 | \|...\| ... | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:94:17:100:9 | \|...\| ... | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
| closure.rs:94:17:100:9 | \|...\| ... | dyn(Args).T0 | {EXTERNAL LOCATION} | bool |
-| closure.rs:94:17:100:9 | \|...\| ... | dyn(Output) | {EXTERNAL LOCATION} | i32 |
| closure.rs:94:17:100:9 | \|...\| ... | dyn(Output) | {EXTERNAL LOCATION} | i64 |
| closure.rs:94:18:94:18 | x | | {EXTERNAL LOCATION} | bool |
| closure.rs:94:34:100:9 | { ... } | | {EXTERNAL LOCATION} | i32 |
-| closure.rs:94:34:100:9 | { ... } | | {EXTERNAL LOCATION} | i64 |
| closure.rs:95:13:99:13 | if x {...} else {...} | | {EXTERNAL LOCATION} | i32 |
-| closure.rs:95:13:99:13 | if x {...} else {...} | | {EXTERNAL LOCATION} | i64 |
| closure.rs:95:16:95:16 | x | | {EXTERNAL LOCATION} | bool |
| closure.rs:95:18:97:13 | { ... } | | {EXTERNAL LOCATION} | i32 |
-| closure.rs:95:18:97:13 | { ... } | | {EXTERNAL LOCATION} | i64 |
| closure.rs:96:17:96:17 | 1 | | {EXTERNAL LOCATION} | i32 |
-| closure.rs:96:17:96:17 | 1 | | {EXTERNAL LOCATION} | i64 |
| closure.rs:97:20:99:13 | { ... } | | {EXTERNAL LOCATION} | i32 |
-| closure.rs:97:20:99:13 | { ... } | | {EXTERNAL LOCATION} | i64 |
| closure.rs:98:17:98:17 | 0 | | {EXTERNAL LOCATION} | i32 |
-| closure.rs:98:17:98:17 | 0 | | {EXTERNAL LOCATION} | i64 |
-| closure.rs:101:13:101:14 | _r | | {EXTERNAL LOCATION} | i32 |
| closure.rs:101:13:101:14 | _r | | {EXTERNAL LOCATION} | i64 |
-| closure.rs:101:18:101:31 | apply(...) | | {EXTERNAL LOCATION} | i32 |
| closure.rs:101:18:101:31 | apply(...) | | {EXTERNAL LOCATION} | i64 |
| closure.rs:101:24:101:24 | f | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:101:24:101:24 | f | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
| closure.rs:101:24:101:24 | f | dyn(Args).T0 | {EXTERNAL LOCATION} | bool |
-| closure.rs:101:24:101:24 | f | dyn(Output) | {EXTERNAL LOCATION} | i32 |
| closure.rs:101:24:101:24 | f | dyn(Output) | {EXTERNAL LOCATION} | i64 |
| closure.rs:101:27:101:30 | true | | {EXTERNAL LOCATION} | bool |
| closure.rs:103:13:103:13 | f | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:103:13:103:13 | f | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:103:13:103:13 | f | dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
| closure.rs:103:17:103:25 | \|...\| ... | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:103:17:103:25 | \|...\| ... | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:103:17:103:25 | \|...\| ... | dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
+| closure.rs:103:18:103:18 | x | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:103:21:103:21 | x | | {EXTERNAL LOCATION} | i64 |
| closure.rs:103:25:103:25 | 1 | | {EXTERNAL LOCATION} | i32 |
| closure.rs:104:13:104:15 | _r2 | | {EXTERNAL LOCATION} | i64 |
| closure.rs:104:19:104:30 | apply_two(...) | | {EXTERNAL LOCATION} | i64 |
| closure.rs:104:29:104:29 | f | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:104:29:104:29 | f | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:104:29:104:29 | f | dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
| closure.rs:109:40:109:40 | f | | closure.rs:109:20:109:37 | F |
| closure.rs:109:46:111:5 | { ... } | | {EXTERNAL LOCATION} | () |
| closure.rs:110:13:110:19 | _return | | {EXTERNAL LOCATION} | i64 |
| closure.rs:110:23:110:23 | f | | closure.rs:109:20:109:37 | F |
| closure.rs:110:23:110:29 | f(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:110:24:110:29 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:110:24:110:29 | ArgList | T0 | {EXTERNAL LOCATION} | bool |
| closure.rs:110:25:110:28 | true | | {EXTERNAL LOCATION} | bool |
| closure.rs:113:41:113:41 | f | | closure.rs:113:28:113:38 | F |
| closure.rs:113:47:115:5 | { ... } | | {EXTERNAL LOCATION} | () |
| closure.rs:114:13:114:19 | _return | | {EXTERNAL LOCATION} | () |
| closure.rs:114:23:114:23 | f | | closure.rs:113:28:113:38 | F |
| closure.rs:114:23:114:29 | f(...) | | {EXTERNAL LOCATION} | () |
+| closure.rs:114:24:114:29 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:114:24:114:29 | ArgList | T0 | {EXTERNAL LOCATION} | bool |
| closure.rs:114:25:114:28 | true | | {EXTERNAL LOCATION} | bool |
| closure.rs:117:42:117:42 | f | | closure.rs:117:22:117:39 | F |
| closure.rs:117:48:120:5 | { ... } | | {EXTERNAL LOCATION} | () |
@@ -6426,63 +6583,62 @@ inferType
| closure.rs:118:19:118:36 | ...::default(...) | | {EXTERNAL LOCATION} | bool |
| closure.rs:119:9:119:9 | f | | closure.rs:117:22:117:39 | F |
| closure.rs:119:9:119:14 | f(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:119:10:119:14 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:119:10:119:14 | ArgList | T0 | {EXTERNAL LOCATION} | bool |
| closure.rs:119:11:119:13 | arg | | {EXTERNAL LOCATION} | bool |
| closure.rs:122:35:122:35 | f | | closure.rs:122:20:122:32 | F |
| closure.rs:122:41:122:41 | a | | closure.rs:122:14:122:14 | A |
| closure.rs:122:52:124:5 | { ... } | | closure.rs:122:17:122:17 | B |
| closure.rs:123:9:123:9 | f | | closure.rs:122:20:122:32 | F |
| closure.rs:123:9:123:12 | f(...) | | closure.rs:122:17:122:17 | B |
+| closure.rs:123:10:123:12 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:123:10:123:12 | ArgList | T0 | closure.rs:122:14:122:14 | A |
| closure.rs:123:11:123:11 | a | | closure.rs:122:14:122:14 | A |
| closure.rs:126:18:126:18 | f | | closure.rs:126:21:126:39 | impl ... |
| closure.rs:126:49:128:5 | { ... } | | {EXTERNAL LOCATION} | i64 |
| closure.rs:127:9:127:9 | f | | closure.rs:126:21:126:39 | impl ... |
| closure.rs:127:9:127:12 | f(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:127:10:127:12 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:127:10:127:12 | ArgList | T0 | {EXTERNAL LOCATION} | i32 |
| closure.rs:127:11:127:11 | 2 | | {EXTERNAL LOCATION} | i32 |
-| closure.rs:127:11:127:11 | 2 | | {EXTERNAL LOCATION} | i64 |
| closure.rs:130:15:142:5 | { ... } | | {EXTERNAL LOCATION} | () |
| closure.rs:131:13:131:13 | f | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:131:13:131:13 | f | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
| closure.rs:131:13:131:13 | f | dyn(Args).T0 | {EXTERNAL LOCATION} | bool |
-| closure.rs:131:13:131:13 | f | dyn(Output) | {EXTERNAL LOCATION} | i32 |
| closure.rs:131:13:131:13 | f | dyn(Output) | {EXTERNAL LOCATION} | i64 |
| closure.rs:131:17:137:9 | \|...\| ... | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:131:17:137:9 | \|...\| ... | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
| closure.rs:131:17:137:9 | \|...\| ... | dyn(Args).T0 | {EXTERNAL LOCATION} | bool |
-| closure.rs:131:17:137:9 | \|...\| ... | dyn(Output) | {EXTERNAL LOCATION} | i32 |
| closure.rs:131:17:137:9 | \|...\| ... | dyn(Output) | {EXTERNAL LOCATION} | i64 |
| closure.rs:131:18:131:18 | x | | {EXTERNAL LOCATION} | bool |
| closure.rs:131:34:137:9 | { ... } | | {EXTERNAL LOCATION} | i32 |
-| closure.rs:131:34:137:9 | { ... } | | {EXTERNAL LOCATION} | i64 |
| closure.rs:132:13:136:13 | if x {...} else {...} | | {EXTERNAL LOCATION} | i32 |
-| closure.rs:132:13:136:13 | if x {...} else {...} | | {EXTERNAL LOCATION} | i64 |
| closure.rs:132:16:132:16 | x | | {EXTERNAL LOCATION} | bool |
| closure.rs:132:18:134:13 | { ... } | | {EXTERNAL LOCATION} | i32 |
-| closure.rs:132:18:134:13 | { ... } | | {EXTERNAL LOCATION} | i64 |
| closure.rs:133:17:133:17 | 1 | | {EXTERNAL LOCATION} | i32 |
-| closure.rs:133:17:133:17 | 1 | | {EXTERNAL LOCATION} | i64 |
| closure.rs:134:20:136:13 | { ... } | | {EXTERNAL LOCATION} | i32 |
-| closure.rs:134:20:136:13 | { ... } | | {EXTERNAL LOCATION} | i64 |
| closure.rs:135:17:135:17 | 0 | | {EXTERNAL LOCATION} | i32 |
-| closure.rs:135:17:135:17 | 0 | | {EXTERNAL LOCATION} | i64 |
-| closure.rs:138:13:138:14 | _r | | {EXTERNAL LOCATION} | i32 |
| closure.rs:138:13:138:14 | _r | | {EXTERNAL LOCATION} | i64 |
-| closure.rs:138:18:138:31 | apply(...) | | {EXTERNAL LOCATION} | i32 |
| closure.rs:138:18:138:31 | apply(...) | | {EXTERNAL LOCATION} | i64 |
| closure.rs:138:24:138:24 | f | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:138:24:138:24 | f | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
| closure.rs:138:24:138:24 | f | dyn(Args).T0 | {EXTERNAL LOCATION} | bool |
-| closure.rs:138:24:138:24 | f | dyn(Output) | {EXTERNAL LOCATION} | i32 |
| closure.rs:138:24:138:24 | f | dyn(Output) | {EXTERNAL LOCATION} | i64 |
| closure.rs:138:27:138:30 | true | | {EXTERNAL LOCATION} | bool |
| closure.rs:140:13:140:13 | f | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:140:13:140:13 | f | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:140:13:140:13 | f | dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
| closure.rs:140:17:140:25 | \|...\| ... | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:140:17:140:25 | \|...\| ... | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:140:17:140:25 | \|...\| ... | dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
+| closure.rs:140:18:140:18 | x | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:140:21:140:21 | x | | {EXTERNAL LOCATION} | i64 |
| closure.rs:140:25:140:25 | 1 | | {EXTERNAL LOCATION} | i32 |
| closure.rs:141:13:141:15 | _r2 | | {EXTERNAL LOCATION} | i64 |
| closure.rs:141:19:141:30 | apply_two(...) | | {EXTERNAL LOCATION} | i64 |
| closure.rs:141:29:141:29 | f | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:141:29:141:29 | f | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:141:29:141:29 | f | dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
| closure.rs:146:54:146:54 | f | | {EXTERNAL LOCATION} | Box |
| closure.rs:146:54:146:54 | f | A | {EXTERNAL LOCATION} | Global |
| closure.rs:146:54:146:54 | f | T | closure.rs:146:26:146:51 | F |
@@ -6492,7 +6648,8 @@ inferType
| closure.rs:147:9:147:9 | f | A | {EXTERNAL LOCATION} | Global |
| closure.rs:147:9:147:9 | f | T | closure.rs:146:26:146:51 | F |
| closure.rs:147:9:147:14 | f(...) | | closure.rs:146:23:146:23 | B |
-| closure.rs:147:9:147:14 | f(...) | | {EXTERNAL LOCATION} | F::Output[FnOnce] |
+| closure.rs:147:10:147:14 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:147:10:147:14 | ArgList | T0 | closure.rs:146:20:146:20 | A |
| closure.rs:147:11:147:13 | arg | | closure.rs:146:20:146:20 | A |
| closure.rs:150:30:150:30 | f | | {EXTERNAL LOCATION} | Box |
| closure.rs:150:30:150:30 | f | A | {EXTERNAL LOCATION} | Global |
@@ -6531,12 +6688,16 @@ inferType
| closure.rs:157:55:159:5 | { ... } | | {EXTERNAL LOCATION} | i64 |
| closure.rs:158:9:158:9 | f | | closure.rs:157:15:157:31 | F |
| closure.rs:158:9:158:12 | f(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:158:10:158:12 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:158:10:158:12 | ArgList | T0 | {EXTERNAL LOCATION} | i64 |
| closure.rs:158:11:158:11 | a | | {EXTERNAL LOCATION} | i64 |
| closure.rs:161:15:161:15 | f | | closure.rs:161:18:161:36 | impl ... |
| closure.rs:161:39:161:39 | a | | {EXTERNAL LOCATION} | i64 |
| closure.rs:161:54:163:5 | { ... } | | {EXTERNAL LOCATION} | i64 |
| closure.rs:162:9:162:9 | f | | closure.rs:161:18:161:36 | impl ... |
| closure.rs:162:9:162:12 | f(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:162:10:162:12 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:162:10:162:12 | ArgList | T0 | {EXTERNAL LOCATION} | i64 |
| closure.rs:162:11:162:11 | a | | {EXTERNAL LOCATION} | i64 |
| closure.rs:165:15:165:15 | f | | {EXTERNAL LOCATION} | & |
| closure.rs:165:15:165:15 | f | TRef | {EXTERNAL LOCATION} | dyn Fn |
@@ -6550,14 +6711,17 @@ inferType
| closure.rs:166:9:166:9 | f | TRef.dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
| closure.rs:166:9:166:9 | f | TRef.dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
| closure.rs:166:9:166:9 | f | TRef.dyn(Output) | {EXTERNAL LOCATION} | i64 |
-| closure.rs:166:9:166:12 | f(...) | | {EXTERNAL LOCATION} | F::Output[FnOnce] |
| closure.rs:166:9:166:12 | f(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:166:10:166:12 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:166:10:166:12 | ArgList | T0 | {EXTERNAL LOCATION} | i64 |
| closure.rs:166:11:166:11 | a | | {EXTERNAL LOCATION} | i64 |
| closure.rs:169:41:169:41 | f | | closure.rs:169:15:169:34 | F |
| closure.rs:169:47:169:47 | a | | {EXTERNAL LOCATION} | i64 |
| closure.rs:169:62:171:5 | { ... } | | {EXTERNAL LOCATION} | i64 |
| closure.rs:170:9:170:9 | f | | closure.rs:169:15:169:34 | F |
| closure.rs:170:9:170:12 | f(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:170:10:170:12 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:170:10:170:12 | ArgList | T0 | {EXTERNAL LOCATION} | i64 |
| closure.rs:170:11:170:11 | a | | {EXTERNAL LOCATION} | i64 |
| closure.rs:173:15:173:15 | f | | {EXTERNAL LOCATION} | &mut |
| closure.rs:173:15:173:15 | f | TRefMut | {EXTERNAL LOCATION} | dyn FnMut |
@@ -6571,60 +6735,99 @@ inferType
| closure.rs:174:9:174:9 | f | TRefMut.dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
| closure.rs:174:9:174:9 | f | TRefMut.dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
| closure.rs:174:9:174:9 | f | TRefMut.dyn(Output) | {EXTERNAL LOCATION} | i64 |
-| closure.rs:174:9:174:12 | f(...) | | {EXTERNAL LOCATION} | F::Output[FnOnce] |
| closure.rs:174:9:174:12 | f(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:174:10:174:12 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:174:10:174:12 | ArgList | T0 | {EXTERNAL LOCATION} | i64 |
| closure.rs:174:11:174:11 | a | | {EXTERNAL LOCATION} | i64 |
| closure.rs:177:18:177:18 | f | | closure.rs:177:21:177:37 | impl ... |
| closure.rs:177:40:177:40 | a | | closure.rs:177:15:177:15 | T |
| closure.rs:177:53:179:5 | { ... } | | {EXTERNAL LOCATION} | i64 |
| closure.rs:178:9:178:9 | f | | closure.rs:177:21:177:37 | impl ... |
| closure.rs:178:9:178:12 | f(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:178:10:178:12 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:178:10:178:12 | ArgList | T0 | closure.rs:177:15:177:15 | T |
| closure.rs:178:11:178:11 | a | | closure.rs:177:15:177:15 | T |
| closure.rs:181:42:181:42 | f | | closure.rs:181:18:181:35 | F |
| closure.rs:181:48:181:48 | a | | closure.rs:181:15:181:15 | T |
| closure.rs:181:61:183:5 | { ... } | | {EXTERNAL LOCATION} | i64 |
| closure.rs:182:9:182:9 | f | | closure.rs:181:18:181:35 | F |
| closure.rs:182:9:182:12 | f(...) | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:182:10:182:12 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:182:10:182:12 | ArgList | T0 | closure.rs:181:15:181:15 | T |
| closure.rs:182:11:182:11 | a | | closure.rs:181:15:181:15 | T |
| closure.rs:185:15:206:5 | { ... } | | {EXTERNAL LOCATION} | () |
| closure.rs:186:13:186:13 | f | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:186:13:186:13 | f | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:186:13:186:13 | f | dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
+| closure.rs:186:13:186:13 | f | dyn(Output) | {EXTERNAL LOCATION} | i64 |
| closure.rs:186:17:186:21 | \|...\| x | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:186:17:186:21 | \|...\| x | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:186:17:186:21 | \|...\| x | dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
+| closure.rs:186:17:186:21 | \|...\| x | dyn(Output) | {EXTERNAL LOCATION} | i64 |
+| closure.rs:186:18:186:18 | x | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:186:21:186:21 | x | | {EXTERNAL LOCATION} | i64 |
| closure.rs:187:13:187:14 | _r | | {EXTERNAL LOCATION} | i64 |
| closure.rs:187:18:187:32 | apply1(...) | | {EXTERNAL LOCATION} | i64 |
| closure.rs:187:25:187:25 | f | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:187:25:187:25 | f | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:187:25:187:25 | f | dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
+| closure.rs:187:25:187:25 | f | dyn(Output) | {EXTERNAL LOCATION} | i64 |
| closure.rs:187:28:187:31 | 1i64 | | {EXTERNAL LOCATION} | i64 |
| closure.rs:189:13:189:13 | f | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:189:13:189:13 | f | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:189:13:189:13 | f | dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
+| closure.rs:189:13:189:13 | f | dyn(Output) | {EXTERNAL LOCATION} | i64 |
| closure.rs:189:17:189:21 | \|...\| x | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:189:17:189:21 | \|...\| x | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:189:17:189:21 | \|...\| x | dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
+| closure.rs:189:17:189:21 | \|...\| x | dyn(Output) | {EXTERNAL LOCATION} | i64 |
+| closure.rs:189:18:189:18 | x | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:189:21:189:21 | x | | {EXTERNAL LOCATION} | i64 |
| closure.rs:190:13:190:14 | _r | | {EXTERNAL LOCATION} | i64 |
| closure.rs:190:18:190:32 | apply2(...) | | {EXTERNAL LOCATION} | i64 |
| closure.rs:190:25:190:25 | f | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:190:25:190:25 | f | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:190:25:190:25 | f | dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
+| closure.rs:190:25:190:25 | f | dyn(Output) | {EXTERNAL LOCATION} | i64 |
| closure.rs:190:28:190:31 | 2i64 | | {EXTERNAL LOCATION} | i64 |
| closure.rs:192:13:192:13 | f | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:192:13:192:13 | f | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:192:13:192:13 | f | dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
+| closure.rs:192:13:192:13 | f | dyn(Output) | {EXTERNAL LOCATION} | i64 |
| closure.rs:192:17:192:21 | \|...\| x | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:192:17:192:21 | \|...\| x | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:192:17:192:21 | \|...\| x | dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
+| closure.rs:192:17:192:21 | \|...\| x | dyn(Output) | {EXTERNAL LOCATION} | i64 |
+| closure.rs:192:18:192:18 | x | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:192:21:192:21 | x | | {EXTERNAL LOCATION} | i64 |
| closure.rs:193:13:193:14 | _r | | {EXTERNAL LOCATION} | i64 |
| closure.rs:193:18:193:33 | apply3(...) | | {EXTERNAL LOCATION} | i64 |
| closure.rs:193:25:193:26 | &f | | {EXTERNAL LOCATION} | & |
| closure.rs:193:25:193:26 | &f | TRef | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:193:25:193:26 | &f | TRef.dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:193:25:193:26 | &f | TRef.dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
+| closure.rs:193:25:193:26 | &f | TRef.dyn(Output) | {EXTERNAL LOCATION} | i64 |
| closure.rs:193:26:193:26 | f | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:193:26:193:26 | f | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:193:26:193:26 | f | dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
+| closure.rs:193:26:193:26 | f | dyn(Output) | {EXTERNAL LOCATION} | i64 |
| closure.rs:193:29:193:32 | 3i64 | | {EXTERNAL LOCATION} | i64 |
| closure.rs:195:13:195:13 | f | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:195:13:195:13 | f | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:195:13:195:13 | f | dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
+| closure.rs:195:13:195:13 | f | dyn(Output) | {EXTERNAL LOCATION} | i64 |
| closure.rs:195:17:195:21 | \|...\| x | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:195:17:195:21 | \|...\| x | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:195:17:195:21 | \|...\| x | dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
+| closure.rs:195:17:195:21 | \|...\| x | dyn(Output) | {EXTERNAL LOCATION} | i64 |
+| closure.rs:195:18:195:18 | x | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:195:21:195:21 | x | | {EXTERNAL LOCATION} | i64 |
| closure.rs:196:13:196:14 | _r | | {EXTERNAL LOCATION} | i64 |
| closure.rs:196:18:196:32 | apply4(...) | | {EXTERNAL LOCATION} | i64 |
| closure.rs:196:25:196:25 | f | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:196:25:196:25 | f | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:196:25:196:25 | f | dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
+| closure.rs:196:25:196:25 | f | dyn(Output) | {EXTERNAL LOCATION} | i64 |
| closure.rs:196:28:196:31 | 4i64 | | {EXTERNAL LOCATION} | i64 |
| closure.rs:198:17:198:17 | f | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:198:17:198:17 | f | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
@@ -6640,21 +6843,37 @@ inferType
| closure.rs:199:33:199:36 | 5i64 | | {EXTERNAL LOCATION} | i64 |
| closure.rs:201:13:201:13 | f | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:201:13:201:13 | f | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:201:13:201:13 | f | dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
+| closure.rs:201:13:201:13 | f | dyn(Output) | {EXTERNAL LOCATION} | i64 |
| closure.rs:201:17:201:21 | \|...\| x | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:201:17:201:21 | \|...\| x | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:201:17:201:21 | \|...\| x | dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
+| closure.rs:201:17:201:21 | \|...\| x | dyn(Output) | {EXTERNAL LOCATION} | i64 |
+| closure.rs:201:18:201:18 | x | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:201:21:201:21 | x | | {EXTERNAL LOCATION} | i64 |
| closure.rs:202:13:202:14 | _r | | {EXTERNAL LOCATION} | i64 |
| closure.rs:202:18:202:32 | apply6(...) | | {EXTERNAL LOCATION} | i64 |
| closure.rs:202:25:202:25 | f | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:202:25:202:25 | f | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:202:25:202:25 | f | dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
+| closure.rs:202:25:202:25 | f | dyn(Output) | {EXTERNAL LOCATION} | i64 |
| closure.rs:202:28:202:31 | 6i64 | | {EXTERNAL LOCATION} | i64 |
| closure.rs:204:13:204:13 | f | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:204:13:204:13 | f | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:204:13:204:13 | f | dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
+| closure.rs:204:13:204:13 | f | dyn(Output) | {EXTERNAL LOCATION} | i64 |
| closure.rs:204:17:204:21 | \|...\| x | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:204:17:204:21 | \|...\| x | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:204:17:204:21 | \|...\| x | dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
+| closure.rs:204:17:204:21 | \|...\| x | dyn(Output) | {EXTERNAL LOCATION} | i64 |
+| closure.rs:204:18:204:18 | x | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:204:21:204:21 | x | | {EXTERNAL LOCATION} | i64 |
| closure.rs:205:13:205:14 | _r | | {EXTERNAL LOCATION} | i64 |
| closure.rs:205:18:205:32 | apply7(...) | | {EXTERNAL LOCATION} | i64 |
| closure.rs:205:25:205:25 | f | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:205:25:205:25 | f | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:205:25:205:25 | f | dyn(Args).T0 | {EXTERNAL LOCATION} | i64 |
+| closure.rs:205:25:205:25 | f | dyn(Output) | {EXTERNAL LOCATION} | i64 |
| closure.rs:205:28:205:31 | 7i64 | | {EXTERNAL LOCATION} | i64 |
| closure.rs:217:18:217:22 | SelfParam | | {EXTERNAL LOCATION} | & |
| closure.rs:217:18:217:22 | SelfParam | TRef | closure.rs:212:5:212:19 | S |
@@ -6678,37 +6897,72 @@ inferType
| closure.rs:222:19:240:5 | { ... } | | {EXTERNAL LOCATION} | () |
| closure.rs:223:13:223:13 | x | | {EXTERNAL LOCATION} | i64 |
| closure.rs:223:17:223:20 | 0i64 | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:224:13:224:13 | v | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:224:17:224:34 | ...::default(...) | | {EXTERNAL LOCATION} | i64 |
| closure.rs:225:13:225:13 | s | | closure.rs:212:5:212:19 | S |
+| closure.rs:225:13:225:13 | s | T | {EXTERNAL LOCATION} | i64 |
| closure.rs:225:17:225:20 | S(...) | | closure.rs:212:5:212:19 | S |
+| closure.rs:225:17:225:20 | S(...) | T | {EXTERNAL LOCATION} | i64 |
+| closure.rs:225:19:225:19 | v | | {EXTERNAL LOCATION} | i64 |
+| closure.rs:226:13:226:16 | _ret | | {EXTERNAL LOCATION} | bool |
| closure.rs:226:20:226:20 | s | | closure.rs:212:5:212:19 | S |
+| closure.rs:226:20:226:20 | s | T | {EXTERNAL LOCATION} | i64 |
+| closure.rs:226:20:226:23 | s(...) | | {EXTERNAL LOCATION} | bool |
+| closure.rs:226:21:226:23 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:226:21:226:23 | ArgList | T0 | {EXTERNAL LOCATION} | i64 |
| closure.rs:226:22:226:22 | x | | {EXTERNAL LOCATION} | i64 |
| closure.rs:228:13:228:13 | x | | {EXTERNAL LOCATION} | i32 |
| closure.rs:228:17:228:20 | 0i32 | | {EXTERNAL LOCATION} | i32 |
+| closure.rs:229:13:229:13 | v | | {EXTERNAL LOCATION} | i32 |
+| closure.rs:229:17:229:34 | ...::default(...) | | {EXTERNAL LOCATION} | i32 |
| closure.rs:230:13:230:13 | s | | closure.rs:212:5:212:19 | S |
+| closure.rs:230:13:230:13 | s | T | {EXTERNAL LOCATION} | i32 |
| closure.rs:230:17:230:20 | S(...) | | closure.rs:212:5:212:19 | S |
+| closure.rs:230:17:230:20 | S(...) | T | {EXTERNAL LOCATION} | i32 |
+| closure.rs:230:19:230:19 | v | | {EXTERNAL LOCATION} | i32 |
| closure.rs:231:13:231:17 | s_ref | | {EXTERNAL LOCATION} | & |
| closure.rs:231:13:231:17 | s_ref | TRef | closure.rs:212:5:212:19 | S |
+| closure.rs:231:13:231:17 | s_ref | TRef.T | {EXTERNAL LOCATION} | i32 |
| closure.rs:231:21:231:22 | &s | | {EXTERNAL LOCATION} | & |
| closure.rs:231:21:231:22 | &s | TRef | closure.rs:212:5:212:19 | S |
+| closure.rs:231:21:231:22 | &s | TRef.T | {EXTERNAL LOCATION} | i32 |
| closure.rs:231:22:231:22 | s | | closure.rs:212:5:212:19 | S |
-| closure.rs:232:13:232:16 | _ret | | {EXTERNAL LOCATION} | F::Output[FnOnce] |
+| closure.rs:231:22:231:22 | s | T | {EXTERNAL LOCATION} | i32 |
+| closure.rs:232:13:232:16 | _ret | | {EXTERNAL LOCATION} | bool |
| closure.rs:232:20:232:24 | s_ref | | {EXTERNAL LOCATION} | & |
| closure.rs:232:20:232:24 | s_ref | TRef | closure.rs:212:5:212:19 | S |
-| closure.rs:232:20:232:27 | s_ref(...) | | {EXTERNAL LOCATION} | F::Output[FnOnce] |
+| closure.rs:232:20:232:24 | s_ref | TRef.T | {EXTERNAL LOCATION} | i32 |
+| closure.rs:232:20:232:27 | s_ref(...) | | {EXTERNAL LOCATION} | bool |
+| closure.rs:232:25:232:27 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:232:25:232:27 | ArgList | T0 | {EXTERNAL LOCATION} | i32 |
| closure.rs:232:26:232:26 | x | | {EXTERNAL LOCATION} | i32 |
| closure.rs:238:13:238:13 | c | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:238:13:238:13 | c | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:238:13:238:13 | c | dyn(Args).T0 | {EXTERNAL LOCATION} | i32 |
+| closure.rs:238:13:238:13 | c | dyn(Output) | {EXTERNAL LOCATION} | i32 |
| closure.rs:238:17:238:21 | \|...\| x | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:238:17:238:21 | \|...\| x | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:238:17:238:21 | \|...\| x | dyn(Args).T0 | {EXTERNAL LOCATION} | i32 |
+| closure.rs:238:17:238:21 | \|...\| x | dyn(Output) | {EXTERNAL LOCATION} | i32 |
+| closure.rs:238:18:238:18 | x | | {EXTERNAL LOCATION} | i32 |
+| closure.rs:238:21:238:21 | x | | {EXTERNAL LOCATION} | i32 |
| closure.rs:239:9:239:12 | (...) | | {EXTERNAL LOCATION} | & |
| closure.rs:239:9:239:12 | (...) | TRef | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:239:9:239:12 | (...) | TRef.dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
-| closure.rs:239:9:239:15 | ...(...) | | {EXTERNAL LOCATION} | F::Output[FnOnce] |
+| closure.rs:239:9:239:12 | (...) | TRef.dyn(Args).T0 | {EXTERNAL LOCATION} | i32 |
+| closure.rs:239:9:239:12 | (...) | TRef.dyn(Output) | {EXTERNAL LOCATION} | i32 |
+| closure.rs:239:9:239:15 | ...(...) | | {EXTERNAL LOCATION} | i32 |
| closure.rs:239:10:239:11 | &c | | {EXTERNAL LOCATION} | & |
| closure.rs:239:10:239:11 | &c | TRef | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:239:10:239:11 | &c | TRef.dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:239:10:239:11 | &c | TRef.dyn(Args).T0 | {EXTERNAL LOCATION} | i32 |
+| closure.rs:239:10:239:11 | &c | TRef.dyn(Output) | {EXTERNAL LOCATION} | i32 |
| closure.rs:239:11:239:11 | c | | {EXTERNAL LOCATION} | dyn Fn |
| closure.rs:239:11:239:11 | c | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:239:11:239:11 | c | dyn(Args).T0 | {EXTERNAL LOCATION} | i32 |
+| closure.rs:239:11:239:11 | c | dyn(Output) | {EXTERNAL LOCATION} | i32 |
+| closure.rs:239:13:239:15 | ArgList | | {EXTERNAL LOCATION} | (T_1) |
+| closure.rs:239:13:239:15 | ArgList | T0 | {EXTERNAL LOCATION} | i32 |
| closure.rs:239:14:239:14 | x | | {EXTERNAL LOCATION} | i32 |
| dereference.rs:13:14:13:18 | SelfParam | | {EXTERNAL LOCATION} | & |
| dereference.rs:13:14:13:18 | SelfParam | TRef | dereference.rs:5:1:7:1 | MyIntPointer |
@@ -9783,14 +10037,21 @@ inferType
| main.rs:1341:28:1341:41 | ...::Ok(...) | | {EXTERNAL LOCATION} | Result |
| main.rs:1341:28:1341:41 | ...::Ok(...) | T | main.rs:1317:5:1318:14 | S1 |
| main.rs:1341:39:1341:40 | S1 | | main.rs:1317:5:1318:14 | S1 |
+| main.rs:1343:13:1343:13 | y | | main.rs:1317:5:1318:14 | S1 |
| main.rs:1343:17:1343:17 | x | | {EXTERNAL LOCATION} | Result |
| main.rs:1343:17:1343:17 | x | T | {EXTERNAL LOCATION} | Result |
| main.rs:1343:17:1343:17 | x | T.T | main.rs:1317:5:1318:14 | S1 |
| main.rs:1343:17:1343:18 | TryExpr | | {EXTERNAL LOCATION} | Result |
| main.rs:1343:17:1343:18 | TryExpr | T | main.rs:1317:5:1318:14 | S1 |
| main.rs:1343:17:1343:29 | ... .map(...) | | {EXTERNAL LOCATION} | Result |
+| main.rs:1343:17:1343:29 | ... .map(...) | T | main.rs:1317:5:1318:14 | S1 |
+| main.rs:1343:17:1343:30 | TryExpr | | main.rs:1317:5:1318:14 | S1 |
| main.rs:1343:24:1343:28 | \|...\| s | | {EXTERNAL LOCATION} | dyn Fn |
| main.rs:1343:24:1343:28 | \|...\| s | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| main.rs:1343:24:1343:28 | \|...\| s | dyn(Args).T0 | main.rs:1317:5:1318:14 | S1 |
+| main.rs:1343:24:1343:28 | \|...\| s | dyn(Output) | main.rs:1317:5:1318:14 | S1 |
+| main.rs:1343:25:1343:25 | s | | main.rs:1317:5:1318:14 | S1 |
+| main.rs:1343:28:1343:28 | s | | main.rs:1317:5:1318:14 | S1 |
| main.rs:1344:9:1344:22 | ...::Ok(...) | | {EXTERNAL LOCATION} | Result |
| main.rs:1344:9:1344:22 | ...::Ok(...) | E | main.rs:1320:5:1321:14 | S2 |
| main.rs:1344:9:1344:22 | ...::Ok(...) | T | main.rs:1317:5:1318:14 | S1 |
@@ -9806,26 +10067,36 @@ inferType
| main.rs:1350:21:1350:25 | input | E | main.rs:1317:5:1318:14 | S1 |
| main.rs:1350:21:1350:25 | input | T | main.rs:1349:20:1349:27 | T |
| main.rs:1350:21:1350:26 | TryExpr | | main.rs:1349:20:1349:27 | T |
+| main.rs:1351:13:1351:18 | mapped | | main.rs:1349:20:1349:27 | T |
| main.rs:1351:22:1351:38 | ...::Ok(...) | | {EXTERNAL LOCATION} | Result |
| main.rs:1351:22:1351:38 | ...::Ok(...) | E | main.rs:1317:5:1318:14 | S1 |
| main.rs:1351:22:1351:38 | ...::Ok(...) | T | main.rs:1349:20:1349:27 | T |
| main.rs:1351:22:1354:10 | ... .and_then(...) | | {EXTERNAL LOCATION} | Result |
| main.rs:1351:22:1354:10 | ... .and_then(...) | E | main.rs:1317:5:1318:14 | S1 |
+| main.rs:1351:22:1354:10 | ... .and_then(...) | T | main.rs:1349:20:1349:27 | T |
+| main.rs:1351:22:1354:11 | TryExpr | | main.rs:1349:20:1349:27 | T |
| main.rs:1351:33:1351:37 | value | | main.rs:1349:20:1349:27 | T |
| main.rs:1351:49:1354:9 | \|...\| ... | | {EXTERNAL LOCATION} | dyn Fn |
| main.rs:1351:49:1354:9 | \|...\| ... | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| main.rs:1351:49:1354:9 | \|...\| ... | dyn(Args).T0 | main.rs:1349:20:1349:27 | T |
| main.rs:1351:49:1354:9 | \|...\| ... | dyn(Output) | {EXTERNAL LOCATION} | Result |
| main.rs:1351:49:1354:9 | \|...\| ... | dyn(Output).E | main.rs:1317:5:1318:14 | S1 |
+| main.rs:1351:49:1354:9 | \|...\| ... | dyn(Output).T | main.rs:1349:20:1349:27 | T |
+| main.rs:1351:50:1351:50 | v | | main.rs:1349:20:1349:27 | T |
| main.rs:1351:53:1354:9 | { ... } | | {EXTERNAL LOCATION} | Result |
| main.rs:1351:53:1354:9 | { ... } | E | main.rs:1317:5:1318:14 | S1 |
+| main.rs:1351:53:1354:9 | { ... } | T | main.rs:1349:20:1349:27 | T |
| main.rs:1352:13:1352:31 | MacroExpr | | {EXTERNAL LOCATION} | () |
| main.rs:1352:22:1352:27 | "{:?}\\n" | | {EXTERNAL LOCATION} | & |
| main.rs:1352:22:1352:27 | "{:?}\\n" | TRef | {EXTERNAL LOCATION} | str |
| main.rs:1352:22:1352:30 | ...::_print(...) | | {EXTERNAL LOCATION} | () |
| main.rs:1352:22:1352:30 | { ... } | | {EXTERNAL LOCATION} | () |
| main.rs:1352:22:1352:30 | { ... } | | {EXTERNAL LOCATION} | () |
+| main.rs:1352:30:1352:30 | v | | main.rs:1349:20:1349:27 | T |
| main.rs:1353:13:1353:34 | ...::Ok::<...>(...) | | {EXTERNAL LOCATION} | Result |
| main.rs:1353:13:1353:34 | ...::Ok::<...>(...) | E | main.rs:1317:5:1318:14 | S1 |
+| main.rs:1353:13:1353:34 | ...::Ok::<...>(...) | T | main.rs:1349:20:1349:27 | T |
+| main.rs:1353:33:1353:33 | v | | main.rs:1349:20:1349:27 | T |
| main.rs:1355:9:1355:23 | ...::Err(...) | | {EXTERNAL LOCATION} | Result |
| main.rs:1355:9:1355:23 | ...::Err(...) | E | main.rs:1317:5:1318:14 | S1 |
| main.rs:1355:9:1355:23 | ...::Err(...) | T | main.rs:1349:20:1349:27 | T |
@@ -11396,14 +11667,21 @@ inferType
| main.rs:2261:25:2261:25 | 3 | | {EXTERNAL LOCATION} | i32 |
| main.rs:2261:28:2261:29 | { ... } | | {EXTERNAL LOCATION} | () |
| main.rs:2262:9:2262:44 | for ... in ... { ... } | | {EXTERNAL LOCATION} | () |
+| main.rs:2262:13:2262:13 | i | | {EXTERNAL LOCATION} | i32 |
| main.rs:2262:18:2262:26 | [...] | | {EXTERNAL LOCATION} | [;] |
| main.rs:2262:18:2262:26 | [...] | TArray | {EXTERNAL LOCATION} | i32 |
| main.rs:2262:18:2262:41 | ... .map(...) | | {EXTERNAL LOCATION} | [;] |
+| main.rs:2262:18:2262:41 | ... .map(...) | TArray | {EXTERNAL LOCATION} | i32 |
| main.rs:2262:19:2262:19 | 1 | | {EXTERNAL LOCATION} | i32 |
| main.rs:2262:22:2262:22 | 2 | | {EXTERNAL LOCATION} | i32 |
| main.rs:2262:25:2262:25 | 3 | | {EXTERNAL LOCATION} | i32 |
| main.rs:2262:32:2262:40 | \|...\| ... | | {EXTERNAL LOCATION} | dyn Fn |
| main.rs:2262:32:2262:40 | \|...\| ... | dyn(Args) | {EXTERNAL LOCATION} | (T_1) |
+| main.rs:2262:32:2262:40 | \|...\| ... | dyn(Args).T0 | {EXTERNAL LOCATION} | i32 |
+| main.rs:2262:32:2262:40 | \|...\| ... | dyn(Output) | {EXTERNAL LOCATION} | i32 |
+| main.rs:2262:33:2262:33 | x | | {EXTERNAL LOCATION} | i32 |
+| main.rs:2262:36:2262:36 | x | | {EXTERNAL LOCATION} | i32 |
+| main.rs:2262:36:2262:40 | ... + ... | | {EXTERNAL LOCATION} | i32 |
| main.rs:2262:40:2262:40 | 1 | | {EXTERNAL LOCATION} | i32 |
| main.rs:2262:43:2262:44 | { ... } | | {EXTERNAL LOCATION} | () |
| main.rs:2263:9:2263:41 | for ... in ... { ... } | | {EXTERNAL LOCATION} | () |
@@ -12660,13 +12938,20 @@ inferType
| main.rs:2775:13:2775:16 | self | TRef.T | main.rs:2773:10:2773:17 | GT |
| main.rs:2775:13:2775:18 | self.0 | | main.rs:2773:10:2773:17 | GT |
| main.rs:2779:15:2783:5 | { ... } | | {EXTERNAL LOCATION} | () |
+| main.rs:2780:13:2780:13 | v | | {EXTERNAL LOCATION} | i64 |
+| main.rs:2780:17:2780:34 | ...::default(...) | | {EXTERNAL LOCATION} | i64 |
| main.rs:2781:13:2781:13 | g | | main.rs:2763:5:2763:21 | Gen |
+| main.rs:2781:13:2781:13 | g | T | {EXTERNAL LOCATION} | i64 |
| main.rs:2781:17:2781:22 | Gen(...) | | main.rs:2763:5:2763:21 | Gen |
+| main.rs:2781:17:2781:22 | Gen(...) | T | {EXTERNAL LOCATION} | i64 |
+| main.rs:2781:21:2781:21 | v | | {EXTERNAL LOCATION} | i64 |
| main.rs:2782:13:2782:13 | _ | | {EXTERNAL LOCATION} | bool |
| main.rs:2782:17:2782:26 | my_get(...) | | {EXTERNAL LOCATION} | bool |
| main.rs:2782:24:2782:25 | &g | | {EXTERNAL LOCATION} | & |
| main.rs:2782:24:2782:25 | &g | TRef | main.rs:2763:5:2763:21 | Gen |
+| main.rs:2782:24:2782:25 | &g | TRef.T | {EXTERNAL LOCATION} | i64 |
| main.rs:2782:25:2782:25 | g | | main.rs:2763:5:2763:21 | Gen |
+| main.rs:2782:25:2782:25 | g | T | {EXTERNAL LOCATION} | i64 |
| main.rs:2786:11:2821:1 | { ... } | | {EXTERNAL LOCATION} | () |
| main.rs:2787:5:2787:21 | ...::f(...) | | {EXTERNAL LOCATION} | () |
| main.rs:2788:5:2788:20 | ...::f(...) | | main.rs:72:5:72:21 | Foo |
@@ -15525,12 +15810,18 @@ inferType
| regressions.rs:150:24:153:5 | { ... } | | regressions.rs:136:5:136:22 | S2 |
| regressions.rs:150:24:153:5 | { ... } | T2 | regressions.rs:135:5:135:14 | S1 |
| regressions.rs:151:13:151:13 | x | | regressions.rs:136:5:136:22 | S2 |
+| regressions.rs:151:13:151:13 | x | T2 | {EXTERNAL LOCATION} | & |
| regressions.rs:151:13:151:13 | x | T2 | regressions.rs:135:5:135:14 | S1 |
+| regressions.rs:151:13:151:13 | x | T2.TRef | regressions.rs:135:5:135:14 | S1 |
| regressions.rs:151:17:151:18 | S1 | | regressions.rs:135:5:135:14 | S1 |
| regressions.rs:151:17:151:25 | S1.into() | | regressions.rs:136:5:136:22 | S2 |
+| regressions.rs:151:17:151:25 | S1.into() | T2 | {EXTERNAL LOCATION} | & |
| regressions.rs:151:17:151:25 | S1.into() | T2 | regressions.rs:135:5:135:14 | S1 |
+| regressions.rs:151:17:151:25 | S1.into() | T2.TRef | regressions.rs:135:5:135:14 | S1 |
| regressions.rs:152:9:152:9 | x | | regressions.rs:136:5:136:22 | S2 |
+| regressions.rs:152:9:152:9 | x | T2 | {EXTERNAL LOCATION} | & |
| regressions.rs:152:9:152:9 | x | T2 | regressions.rs:135:5:135:14 | S1 |
+| regressions.rs:152:9:152:9 | x | T2.TRef | regressions.rs:135:5:135:14 | S1 |
| regressions.rs:164:16:164:19 | SelfParam | | regressions.rs:158:5:158:19 | S |
| regressions.rs:164:16:164:19 | SelfParam | T | regressions.rs:160:10:160:10 | T |
| regressions.rs:164:22:164:25 | _rhs | | regressions.rs:158:5:158:19 | S |
diff --git a/rust/ql/test/utils-tests/modelgenerator/option.rs b/rust/ql/test/utils-tests/modelgenerator/option.rs
index 701073564b1..afe76e2088e 100644
--- a/rust/ql/test/utils-tests/modelgenerator/option.rs
+++ b/rust/ql/test/utils-tests/modelgenerator/option.rs
@@ -149,6 +149,8 @@ impl MyOption {
// summary=::map;Argument[0].ReturnValue;ReturnValue.Field[test::option::MyOption::MySome(0)];value;dfc-generated
// summary=::map;Argument[self].Field[test::option::MyOption::MySome(0)];Argument[0].Parameter[0];value;dfc-generated
+ // The spurious model below happens because `f` incorrectly resolves to the closure passed in from `as_deref`
+ // SPURIOUS-summary=::map;Argument[self].Field[test::option::MyOption::MySome(0)].Reference;ReturnValue.Field[test::option::MyOption::MySome(0)].Reference;taint;dfc-generated
pub fn map(self, f: F) -> MyOption
where
F: FnOnce(T) -> U,
@@ -217,7 +219,7 @@ impl MyOption {
}
}
- // MISSING: `Deref` trait
+ // summary=::as_deref;Argument[self].Reference.Field[test::option::MyOption::MySome(0)];ReturnValue.Field[test::option::MyOption::MySome(0)].Reference;taint;dfc-generated
pub fn as_deref(&self) -> MyOption<&T::Target>
where
T: Deref,
diff --git a/shared/typeinference/codeql/typeinference/internal/TypeInference.qll b/shared/typeinference/codeql/typeinference/internal/TypeInference.qll
index 0b23b08aad6..888ca65fa98 100644
--- a/shared/typeinference/codeql/typeinference/internal/TypeInference.qll
+++ b/shared/typeinference/codeql/typeinference/internal/TypeInference.qll
@@ -964,7 +964,7 @@ module Make1 Input1> {
/**
* Holds if `term` does not satisfy `constraint`.
*
- * This predicate is an approximation of `not hasConstraintMention(term, constraint)`.
+ * This predicate is an approximation of `not hasConstraintMention(term, _, _, constraint, _, _)`.
*/
pragma[nomagic]
private predicate hasNotConstraintMention(
@@ -1072,7 +1072,7 @@ module Make1 Input1> {
}
pragma[nomagic]
- private predicate satisfiesConstraintTypeMention1(
+ private predicate satisfiesConstraint0(
Term term, Constraint constraint, TypeAbstraction abs, TypeMention sub, TypePath path,
Type t
) {
@@ -1100,37 +1100,55 @@ module Make1 Input1> {
}
pragma[inline]
- private predicate satisfiesConstraintTypeMentionInline(
- Term term, Constraint constraint, TypeAbstraction abs, TypePath path,
- TypePath pathToTypeParamInSub
+ private predicate satisfiesConstraintInline(
+ Term term, Constraint constraint, TypeAbstraction abs, TypePath pathToTypeParamInConstraint,
+ TypePath pathToTypeParamInSub, TypeParameter tp
) {
- exists(TypeMention sub, TypeParameter tp |
- satisfiesConstraintTypeMention1(term, constraint, abs, sub, path, tp) and
+ exists(TypeMention sub |
+ satisfiesConstraint0(term, constraint, abs, sub, pathToTypeParamInConstraint, tp) and
tp = abs.getATypeParameter() and
sub.getTypeAt(pathToTypeParamInSub) = tp
)
}
+ /**
+ * Holds if `term` satisfies the constraint `constraint` with _some_ type
+ * parameter at `pathToTypeParamInConstraint`, and the type parameter occurs
+ * at `pathToTypeParamInSub` in a satisfying condition.
+ *
+ * Example:
+ *
+ * ```rust
+ * struct MyThing { ... }
+ *
+ * trait MyTrait { ... }
+ *
+ * impl MyTrait for MyThing { ... }
+ *
+ * fn foo>(x: T) { ... }
+ *
+ * let x = MyThing(Default::default());
+ * foo(x);
+ * ```
+ *
+ * At `term` = `foo(x)`, we have `constraint = MyTrait`, and because of the
+ * `impl` block, `pathToTypeParamInConstraint` = `"B"`, and
+ * `pathToTypeParamInSub` = `"A"`.
+ */
pragma[nomagic]
- private predicate satisfiesConstraintTypeMention(
- Term term, Constraint constraint, TypePath path, TypePath pathToTypeParamInSub
- ) {
- satisfiesConstraintTypeMentionInline(term, constraint, _, path, pathToTypeParamInSub)
- }
-
- pragma[nomagic]
- private predicate satisfiesConstraintTypeMentionThrough(
- Term term, Constraint constraint, TypeAbstraction abs, TypePath path,
+ predicate satisfiesConstraintAtTypeParameter(
+ Term term, Constraint constraint, TypePath pathToTypeParamInConstraint,
TypePath pathToTypeParamInSub
) {
- satisfiesConstraintTypeMentionInline(term, constraint, abs, path, pathToTypeParamInSub)
+ satisfiesConstraintInline(term, constraint, _, pathToTypeParamInConstraint,
+ pathToTypeParamInSub, _)
}
pragma[inline]
- private predicate satisfiesConstraintTypeNonTypeParamInline(
+ private predicate satisfiesConstraintNonTypeParamInline(
Term term, TypeAbstraction abs, Constraint constraint, TypePath path, Type t
) {
- satisfiesConstraintTypeMention1(term, constraint, abs, _, path, t) and
+ satisfiesConstraint0(term, constraint, abs, _, path, t) and
not t = abs.getATypeParameter()
}
@@ -1142,15 +1160,14 @@ module Make1 Input1> {
}
/**
- * Holds if the type tree at `term` satisfies the constraint `constraint`
- * with the type `t` at `path`.
+ * Holds if `term` satisfies the constraint `constraint` with the type `t` at `path`.
*/
pragma[nomagic]
- predicate satisfiesConstraintType(Term term, Constraint constraint, TypePath path, Type t) {
- satisfiesConstraintTypeNonTypeParamInline(term, _, constraint, path, t)
+ predicate satisfiesConstraint(Term term, Constraint constraint, TypePath path, Type t) {
+ satisfiesConstraintNonTypeParamInline(term, _, constraint, path, t)
or
exists(TypePath prefix0, TypePath pathToTypeParamInSub, TypePath suffix |
- satisfiesConstraintTypeMention(term, constraint, prefix0, pathToTypeParamInSub) and
+ satisfiesConstraintAtTypeParameter(term, constraint, prefix0, pathToTypeParamInSub) and
getTypeAt(term, pathToTypeParamInSub.appendInverse(suffix)) = t and
path = prefix0.append(suffix)
)
@@ -1159,25 +1176,34 @@ module Make1 Input1> {
t = getTypeAt(term, path)
}
+ pragma[nomagic]
+ private predicate satisfiesConstraintThrough0(
+ Term term, Constraint constraint, TypeAbstraction abs, TypePath pathToTypeParamInConstraint,
+ TypePath pathToTypeParamInSub
+ ) {
+ satisfiesConstraintInline(term, constraint, abs, pathToTypeParamInConstraint,
+ pathToTypeParamInSub, _)
+ }
+
/**
- * Holds if the type tree at `term` satisfies the constraint `constraint`
- * through `abs` with the type `t` at `path`.
+ * Holds if `term` satisfies the constraint `constraint` through `abs` with
+ * the type `t` at `path`.
*/
pragma[nomagic]
- predicate satisfiesConstraintTypeThrough(
+ predicate satisfiesConstraintThrough(
Term term, TypeAbstraction abs, Constraint constraint, TypePath path, Type t
) {
- satisfiesConstraintTypeNonTypeParamInline(term, abs, constraint, path, t)
+ satisfiesConstraintNonTypeParamInline(term, abs, constraint, path, t)
or
exists(TypePath prefix0, TypePath pathToTypeParamInSub, TypePath suffix |
- satisfiesConstraintTypeMentionThrough(term, constraint, abs, prefix0, pathToTypeParamInSub) and
+ satisfiesConstraintThrough0(term, constraint, abs, prefix0, pathToTypeParamInSub) and
getTypeAt(term, pathToTypeParamInSub.appendInverse(suffix)) = t and
path = prefix0.append(suffix)
)
}
/**
- * Holds if the type tree at `term` does _not_ satisfy the constraint `constraint`.
+ * Holds if `term` does _not_ satisfy the constraint `constraint`.
*
* This is an approximation of `not satisfiesConstraintType(term, constraint, _, _)`,
* but defined without a negative occurrence of `satisfiesConstraintType`.
@@ -1495,7 +1521,7 @@ module Make1 Input1> {
TypeMention constraint
) {
target = a.getTarget(e) and
- typeParameterConstraintHasTypeParameter(target, apos, path, constraint, _, _)
+ typeParameterHasConstraint(target, apos, _, path, constraint)
}
private newtype TRelevantAccess =
@@ -1556,13 +1582,40 @@ module Make1 Input1> {
SatisfiesTypeParameterConstraintInput>;
pragma[nomagic]
- predicate satisfiesConstraintType(
+ predicate satisfiesConstraintAtTypeParameter(
+ Access a, AccessEnvironment e, Declaration target, AccessPosition apos, TypePath prefix,
+ TypeMention constraint, TypePath pathToTypeParamInConstraint,
+ TypePath pathToTypeParamInSub
+ ) {
+ exists(RelevantAccess ra |
+ ra = MkRelevantAccess(a, apos, e, prefix) and
+ SatisfiesTypeParameterConstraint::satisfiesConstraintAtTypeParameter(ra, constraint,
+ pathToTypeParamInConstraint, pathToTypeParamInSub) and
+ constraint = ra.getConstraint(target)
+ )
+ }
+
+ pragma[nomagic]
+ predicate satisfiesConstraint(
Access a, AccessEnvironment e, Declaration target, AccessPosition apos, TypePath prefix,
TypeMention constraint, TypePath path, Type t
) {
exists(RelevantAccess ra |
ra = MkRelevantAccess(a, apos, e, prefix) and
- SatisfiesTypeParameterConstraint::satisfiesConstraintType(ra, constraint, path, t) and
+ SatisfiesTypeParameterConstraint::satisfiesConstraint(ra, constraint, path, t) and
+ constraint = ra.getConstraint(target)
+ )
+ }
+
+ pragma[nomagic]
+ predicate satisfiesConstraintThrough(
+ Access a, AccessEnvironment e, Declaration target, AccessPosition apos, TypePath prefix,
+ TypeAbstraction abs, TypeMention constraint, TypePath path, Type t
+ ) {
+ exists(RelevantAccess ra |
+ ra = MkRelevantAccess(a, apos, e, prefix) and
+ SatisfiesTypeParameterConstraint::satisfiesConstraintThrough(ra, abs, constraint, path,
+ t) and
constraint = ra.getConstraint(target)
)
}
@@ -1707,7 +1760,7 @@ module Make1 Input1> {
not exists(getTypeArgument(a, target, tp, _)) and
exists(TypeMention constraint, AccessPosition apos, TypePath pathToTp, TypePath pathToTp2 |
typeParameterConstraintHasTypeParameter(target, apos, pathToTp2, constraint, pathToTp, tp) and
- AccessConstraint::satisfiesConstraintType(a, e, target, apos, pathToTp2, constraint,
+ AccessConstraint::satisfiesConstraint(a, e, target, apos, pathToTp2, constraint,
pathToTp.appendInverse(path), t)
)
}
@@ -1785,6 +1838,82 @@ module Make1 Input1> {
not result instanceof TypeParameter
)
)
+ or
+ exists(
+ Declaration target, TypePath prefix, TypeMention constraint,
+ TypePath pathToTypeParamInConstraint, TypePath pathToTypeParamInSub
+ |
+ AccessConstraint::satisfiesConstraintAtTypeParameter(a, e, target, apos, prefix,
+ constraint, pathToTypeParamInConstraint, pathToTypeParamInSub)
+ |
+ exists(TypePath suffix |
+ /*
+ * Example:
+ *
+ * ```rust
+ * struct MyThing { ... }
+ *
+ * trait MyTrait { ... }
+ *
+ * impl MyTrait for MyThing { ... }
+ *
+ * fn foo>(x: T) { ... }
+ *
+ * let x = MyThing(Default::default());
+ * foo(x);
+ * ```
+ *
+ * At `term` = `foo(x)`, we have
+ * - `constraint = MyTrait`,
+ * - `pathToTypeParamInConstraint` = `"B"`,
+ * - `pathToTypeParamInSub` = `"A"`,
+ * - `prefix` = `suffix` = `""`, and
+ * - `result` = `i32`.
+ *
+ * That is, it allows us to infer that the type of `x` is `MyThing`.
+ */
+
+ result = constraint.getTypeAt(pathToTypeParamInConstraint.appendInverse(suffix)) and
+ not result instanceof TypeParameter and
+ path = prefix.append(pathToTypeParamInSub.append(suffix))
+ )
+ or
+ exists(TypeParameter tp, TypePath suffix, TypePath mid, TypePath pathToTp |
+ /*
+ * Example:
+ *
+ * ```rust
+ * struct MyThing { ... }
+ *
+ * trait MyTrait { ... }
+ *
+ * impl MyTrait for MyThing { ... }
+ *
+ * fn bar>(x: T1, y: T2) {}
+ *
+ * let x : i32 = ...;
+ * let y = MyThing(Default::default());
+ * bar(x, y);
+ * ```
+ *
+ * At `term` = `bar(x, y)`, we have
+ * - `constraint = MyTrait`,
+ * - `pathToTypeParamInConstraint` = `"B"`,
+ * - `pathToTypeParamInSub` = `"A"`,
+ * - `prefix` = `suffix` = `mid` = `""`,
+ * - `tp = T1`,
+ * - `pathToTp` = `"B"`, and
+ * - `result` = `i32`.
+ *
+ * That is, it allows us to infer that the type of `y` is `MyThing`.
+ */
+
+ typeMatch(a, e, target, suffix, result, tp) and
+ typeParameterConstraintHasTypeParameter(target, apos, _, constraint, pathToTp, tp) and
+ pathToTp = pathToTypeParamInConstraint.appendInverse(mid) and
+ path = prefix.append(pathToTypeParamInSub.append(mid).append(suffix))
+ )
+ )
}
}
From b3285c6ae2274aaa456a2fe152945f38bd16f8af Mon Sep 17 00:00:00 2001
From: Owen Mansel-Chan
Date: Fri, 27 Mar 2026 11:35:22 +0000
Subject: [PATCH 020/185] Make description of `acceptingvalue` column clearer
---
cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll | 5 ++---
.../semmle/code/csharp/dataflow/internal/ExternalFlow.qll | 4 ++--
go/ql/lib/semmle/go/dataflow/ExternalFlow.qll | 5 ++---
java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll | 4 ++--
4 files changed, 8 insertions(+), 10 deletions(-)
diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
index ed40d391917..3fe9f6aaedf 100644
--- a/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
@@ -91,9 +91,8 @@
* - flow from the _second_ indirection of the 0th argument to the first
* indirection of the return value, etc.
* 8. The `acceptingvalue` column of barrier guard models specifies the condition
- * under which the guard accepts or blocks flow. It can be one of "true" or
- * "false". In the future "no-exception", "not-zero", "null", "not-null" may be
- * supported.
+ * under which the guard blocks flow. It can be one of "true" or "false". In
+ * the future "no-exception", "not-zero", "null", "not-null" may be supported.
* 9. The `kind` column is a tag that can be referenced from QL to determine to
* which classes the interpreted elements should be added. For example, for
* sources "remote" indicates a default remote flow source, and for summaries
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll
index 95b9578e4f3..17cdcc1bf0b 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll
@@ -74,8 +74,8 @@
* - "Property[p]": Selects the contents of property `p`.
*
* 8. The `acceptingvalue` column of barrier guard models specifies the condition
- * under which the guard accepts or blocks flow. It can be one of "true" or
- * "false", "no-exception", "not-zero", "null", "not-null".
+ * under which the guard blocks flow. It can be one of "true" or "false". In
+ * the future "no-exception", "not-zero", "null", "not-null" may be supported.
* 9. The `kind` column is a tag that can be referenced from QL to determine to
* which classes the interpreted elements should be added. For example, for
* sources "remote" indicates a default remote flow source, and for summaries
diff --git a/go/ql/lib/semmle/go/dataflow/ExternalFlow.qll b/go/ql/lib/semmle/go/dataflow/ExternalFlow.qll
index 05379c620fb..0ad28bac533 100644
--- a/go/ql/lib/semmle/go/dataflow/ExternalFlow.qll
+++ b/go/ql/lib/semmle/go/dataflow/ExternalFlow.qll
@@ -83,9 +83,8 @@
* - "Dereference": Selects the value referenced by a pointer.
*
* 8. The `acceptingvalue` column of barrier guard models specifies the condition
- * under which the guard accepts or blocks flow. It can be one of "true" or
- * "false". In the future "no-exception", "not-zero", "null", "not-null" may be
- * supported.
+ * under which the guard blocks flow. It can be one of "true" or "false". In
+ * the future "no-exception", "not-zero", "null", "not-null" may be supported.
* 9. The `kind` column is a tag that can be referenced from QL to determine to
* which classes the interpreted elements should be added. For example, for
* sources "remote" indicates a default remote flow source, and for summaries
diff --git a/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll b/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll
index 8f6d1a7855a..6ad4a5938a3 100644
--- a/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll
+++ b/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll
@@ -74,8 +74,8 @@
* - "ReturnValue": Selects the return value of a call to the selected element.
* - "Element": Selects the collection elements of the selected element.
* 8. The `acceptingvalue` column of barrier guard models specifies the condition
- * under which the guard accepts or blocks flow. It can be one of "true" or
- * "false", "no-exception", "not-zero", "null", "not-null".
+ * under which the guard blocks flow. It can be one of "true" or "false". In
+ * the future "no-exception", "not-zero", "null", "not-null" may be supported.
* 9. The `kind` column is a tag that can be referenced from QL to determine to
* which classes the interpreted elements should be added. For example, for
* sources "remote" indicates a default remote flow source, and for summaries
From 60f9ce4ce7485269027caefacd2fa5ee73099d90 Mon Sep 17 00:00:00 2001
From: Taus
Date: Fri, 20 Mar 2026 13:55:58 +0000
Subject: [PATCH 021/185] Python: Port UnreachableCode.ql
---
python/ql/src/Statements/UnreachableCode.ql | 8 ++------
1 file changed, 2 insertions(+), 6 deletions(-)
diff --git a/python/ql/src/Statements/UnreachableCode.ql b/python/ql/src/Statements/UnreachableCode.ql
index 55582ed2f06..200e073cff6 100644
--- a/python/ql/src/Statements/UnreachableCode.ql
+++ b/python/ql/src/Statements/UnreachableCode.ql
@@ -13,7 +13,7 @@
*/
import python
-private import LegacyPointsTo
+private import semmle.python.ApiGraphs
predicate typing_import(ImportingStmt is) {
exists(Module m |
@@ -34,11 +34,7 @@ predicate unique_yield(Stmt s) {
/** Holds if `contextlib.suppress` may be used in the same scope as `s` */
predicate suppression_in_scope(Stmt s) {
exists(With w |
- w.getContextExpr()
- .(Call)
- .getFunc()
- .(ExprWithPointsTo)
- .pointsTo(Value::named("contextlib.suppress")) and
+ w.getContextExpr() = API::moduleImport("contextlib").getMember("suppress").getACall().asExpr() and
w.getScope() = s.getScope()
)
}
From 0ea80ac184013820dbd2da2e5b4ba24c8ea92f3d Mon Sep 17 00:00:00 2001
From: Taus
Date: Fri, 20 Feb 2026 15:03:15 +0000
Subject: [PATCH 022/185] Python: Port UnusedExceptionObject.ql
Depending on whether other queries depend on this, we may end up moving
the exception utility functions to a more central location.
---
.../src/Statements/UnusedExceptionObject.ql | 46 +++++++++++++++++--
1 file changed, 42 insertions(+), 4 deletions(-)
diff --git a/python/ql/src/Statements/UnusedExceptionObject.ql b/python/ql/src/Statements/UnusedExceptionObject.ql
index 9a6a3650b7e..890cdc963ac 100644
--- a/python/ql/src/Statements/UnusedExceptionObject.ql
+++ b/python/ql/src/Statements/UnusedExceptionObject.ql
@@ -12,11 +12,49 @@
*/
import python
-private import LegacyPointsTo
+private import semmle.python.dataflow.new.internal.DataFlowDispatch
+private import semmle.python.dataflow.new.internal.Builtins
+private import semmle.python.ApiGraphs
-from Call call, ClassValue ex
+/**
+ * Holds if `cls` is a user-defined exception class, i.e. it transitively
+ * extends one of the builtin exception base classes.
+ */
+predicate isUserDefinedExceptionClass(Class cls) {
+ cls.getABase() =
+ API::builtin(["BaseException", "Exception"]).getAValueReachableFromSource().asExpr()
+ or
+ isUserDefinedExceptionClass(getADirectSuperclass(cls))
+}
+
+/**
+ * Gets the name of a builtin exception class.
+ */
+string getBuiltinExceptionName() {
+ result = Builtins::getBuiltinName() and
+ (
+ result.matches("%Error") or
+ result.matches("%Exception") or
+ result.matches("%Warning") or
+ result =
+ ["GeneratorExit", "KeyboardInterrupt", "StopIteration", "StopAsyncIteration", "SystemExit"]
+ )
+}
+
+/**
+ * Holds if `call` is an instantiation of an exception class.
+ */
+predicate isExceptionInstantiation(Call call) {
+ exists(Class cls |
+ classTracker(cls).asExpr() = call.getFunc() and
+ isUserDefinedExceptionClass(cls)
+ )
+ or
+ call.getFunc() = API::builtin(getBuiltinExceptionName()).getAValueReachableFromSource().asExpr()
+}
+
+from Call call
where
- call.getFunc().(ExprWithPointsTo).pointsTo(ex) and
- ex.getASuperType() = ClassValue::exception() and
+ isExceptionInstantiation(call) and
exists(ExprStmt s | s.getValue() = call)
select call, "Instantiating an exception, but not raising it, has no effect."
From 47d24632e64859e00eeeb043231604ebb8c58a3d Mon Sep 17 00:00:00 2001
From: Taus
Date: Fri, 20 Feb 2026 14:54:19 +0000
Subject: [PATCH 023/185] Python: Port ShouldUseWithStatement.ql
Only trivial test changes.
---
python/ql/src/Statements/ShouldUseWithStatement.ql | 14 ++++----------
.../general/ShouldUseWithStatement.expected | 2 +-
2 files changed, 5 insertions(+), 11 deletions(-)
diff --git a/python/ql/src/Statements/ShouldUseWithStatement.ql b/python/ql/src/Statements/ShouldUseWithStatement.ql
index eb5cf9237d5..20bf053f6da 100644
--- a/python/ql/src/Statements/ShouldUseWithStatement.ql
+++ b/python/ql/src/Statements/ShouldUseWithStatement.ql
@@ -13,7 +13,7 @@
*/
import python
-private import LegacyPointsTo
+private import semmle.python.dataflow.new.internal.DataFlowDispatch
predicate calls_close(Call c) { exists(Attribute a | c.getFunc() = a and a.getName() = "close") }
@@ -23,18 +23,12 @@ predicate only_stmt_in_finally(Try t, Call c) {
)
}
-predicate points_to_context_manager(ControlFlowNodeWithPointsTo f, ClassValue cls) {
- forex(Value v | f.pointsTo(v) | v.getClass() = cls) and
- cls.isContextManager()
-}
-
-from Call close, Try t, ClassValue cls
+from Call close, Try t, Class cls
where
only_stmt_in_finally(t, close) and
calls_close(close) and
- exists(ControlFlowNode f | f = close.getFunc().getAFlowNode().(AttrNode).getObject() |
- points_to_context_manager(f, cls)
- )
+ classInstanceTracker(cls).asExpr() = close.getFunc().(Attribute).getObject() and
+ DuckTyping::isContextManager(cls)
select close,
"Instance of context-manager class $@ is closed in a finally block. Consider using 'with' statement.",
cls, cls.getName()
diff --git a/python/ql/test/query-tests/Statements/general/ShouldUseWithStatement.expected b/python/ql/test/query-tests/Statements/general/ShouldUseWithStatement.expected
index d062717bbf2..50ff6cc1f91 100644
--- a/python/ql/test/query-tests/Statements/general/ShouldUseWithStatement.expected
+++ b/python/ql/test/query-tests/Statements/general/ShouldUseWithStatement.expected
@@ -1 +1 @@
-| test.py:168:9:168:17 | Attribute() | Instance of context-manager class $@ is closed in a finally block. Consider using 'with' statement. | test.py:151:1:151:17 | class CM | CM |
+| test.py:168:9:168:17 | Attribute() | Instance of context-manager class $@ is closed in a finally block. Consider using 'with' statement. | test.py:151:1:151:17 | Class CM | CM |
From bb9873dc8fff136f5e119400ca9cc67f08d0cdb2 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Fri, 27 Mar 2026 16:40:45 +0000
Subject: [PATCH 024/185] C++: Increase the query precision to high.
---
.../Underspecified Functions/ImplicitFunctionDeclaration.ql | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql b/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql
index 007ef71a163..0cf6c8b3714 100644
--- a/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql
+++ b/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql
@@ -5,7 +5,7 @@
* may lead to unpredictable behavior.
* @kind problem
* @problem.severity warning
- * @precision medium
+ * @precision high
* @id cpp/implicit-function-declaration
* @tags correctness
* maintainability
From 50681a3c42fb901cd231e0988c1f3047acbff075 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Fri, 27 Mar 2026 16:47:31 +0000
Subject: [PATCH 025/185] C++: Add note to the .qhelp.
---
.../ImplicitFunctionDeclaration.qhelp | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.qhelp b/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.qhelp
index 6ff60d38341..d9b5a022077 100644
--- a/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.qhelp
+++ b/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.qhelp
@@ -14,6 +14,9 @@ function may behave unpredictably.
This may indicate a misspelled function name, or that the required header containing
the function declaration has not been included.
+Note: This query is not compatible with build mode: none databases, and produces
+no results on those databases.
+
Provide an explicit declaration of the function before invoking it.
@@ -26,4 +29,4 @@ the function declaration has not been included.
SEI CERT C Coding Standard: DCL31-C. Declare identifiers before using them
-
\ No newline at end of file
+
From 4f74d421b9095e06a8642a5615c48f0a0094d7aa Mon Sep 17 00:00:00 2001
From: Taus
Date: Fri, 27 Mar 2026 14:11:14 +0000
Subject: [PATCH 026/185] Python: Exclude `AF_UNIX` sockets from
BindToAllInterfaces
Looking at the results of the the previous DCA run, there was a bunch of
false positives where `bind` was being used with a `AF_UNIX` socket (a
filesystem path encoded as a string), not a `(host, port)` tuple. These
results should be excluded from the query, as they are not vulnerable.
Ideally, we would just add `.TupleElement[0]` to the MaD sink, except we
don't actually support this in Python MaD...
So, instead I opted for a more low-tech solution: check that the
argument in question flows from a tuple in the local scope.
This eliminates a bunch of false positives on `python/cpython` leaving
behind four true positive results.
---
.../Security/CVE-2018-1281/BindToAllInterfaces.ql | 14 +++++++++++++-
.../CVE-2018-1281/BindToAllInterfaces.expected | 1 +
.../CVE-2018-1281/BindToAllInterfaces_test.py | 4 ++++
3 files changed, 18 insertions(+), 1 deletion(-)
diff --git a/python/ql/src/Security/CVE-2018-1281/BindToAllInterfaces.ql b/python/ql/src/Security/CVE-2018-1281/BindToAllInterfaces.ql
index 2b62b184fd4..75c145ec0ac 100644
--- a/python/ql/src/Security/CVE-2018-1281/BindToAllInterfaces.ql
+++ b/python/ql/src/Security/CVE-2018-1281/BindToAllInterfaces.ql
@@ -42,8 +42,20 @@ private module BindToAllInterfacesFlow = TaintTracking::Global
Date: Fri, 27 Mar 2026 17:04:05 +0000
Subject: [PATCH 027/185] C++: Update change note.
---
.../src/change-notes/2026-03-23-implicit-function-declaration.md | 1 +
1 file changed, 1 insertion(+)
diff --git a/cpp/ql/src/change-notes/2026-03-23-implicit-function-declaration.md b/cpp/ql/src/change-notes/2026-03-23-implicit-function-declaration.md
index 8c2c431ec24..4fc4808f40c 100644
--- a/cpp/ql/src/change-notes/2026-03-23-implicit-function-declaration.md
+++ b/cpp/ql/src/change-notes/2026-03-23-implicit-function-declaration.md
@@ -1,4 +1,5 @@
---
category: minorAnalysis
---
+* The "Implicit function declaration" (`cpp/implicit-function-declaration`) query has been promoted to `@precision high`.
* The "Implicit function declaration" (`cpp/implicit-function-declaration`) query no longer produces results on `build mode: none` databases. These results were found to be very noisy and fundamentally imprecise in this mode.
From a9cce1c0fa75b167c549b46ab350d7970929750a Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Fri, 27 Mar 2026 17:32:03 +0000
Subject: [PATCH 028/185] C++: Undo increasing query precision.
---
.../Underspecified Functions/ImplicitFunctionDeclaration.ql | 2 +-
.../change-notes/2026-03-23-implicit-function-declaration.md | 1 -
2 files changed, 1 insertion(+), 2 deletions(-)
diff --git a/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql b/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql
index 0cf6c8b3714..007ef71a163 100644
--- a/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql
+++ b/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql
@@ -5,7 +5,7 @@
* may lead to unpredictable behavior.
* @kind problem
* @problem.severity warning
- * @precision high
+ * @precision medium
* @id cpp/implicit-function-declaration
* @tags correctness
* maintainability
diff --git a/cpp/ql/src/change-notes/2026-03-23-implicit-function-declaration.md b/cpp/ql/src/change-notes/2026-03-23-implicit-function-declaration.md
index 4fc4808f40c..8c2c431ec24 100644
--- a/cpp/ql/src/change-notes/2026-03-23-implicit-function-declaration.md
+++ b/cpp/ql/src/change-notes/2026-03-23-implicit-function-declaration.md
@@ -1,5 +1,4 @@
---
category: minorAnalysis
---
-* The "Implicit function declaration" (`cpp/implicit-function-declaration`) query has been promoted to `@precision high`.
* The "Implicit function declaration" (`cpp/implicit-function-declaration`) query no longer produces results on `build mode: none` databases. These results were found to be very noisy and fundamentally imprecise in this mode.
From a7fdc4b5435e38cffb68fa425cbdec62939091bb Mon Sep 17 00:00:00 2001
From: Owen Mansel-Chan
Date: Fri, 27 Mar 2026 22:15:45 +0000
Subject: [PATCH 029/185] Replace `acceptingvalue` with `acceptingValue`
---
.../semmle/code/cpp/dataflow/ExternalFlow.qll | 16 +++++++--------
.../internal/ExternalFlowExtensions.qll | 2 +-
.../cpp/dataflow/internal/FlowSummaryImpl.qll | 4 ++--
.../csharp/dataflow/internal/ExternalFlow.qll | 18 ++++++++---------
.../internal/ExternalFlowExtensions.qll | 2 +-
.../dataflow/internal/FlowSummaryImpl.qll | 4 ++--
go/ql/lib/semmle/go/dataflow/ExternalFlow.qll | 18 ++++++++---------
.../internal/ExternalFlowExtensions.qll | 2 +-
.../go/dataflow/internal/FlowSummaryImpl.qll | 4 ++--
.../code/java/dataflow/ExternalFlow.qll | 18 ++++++++---------
.../internal/ExternalFlowExtensions.qll | 2 +-
.../dataflow/internal/FlowSummaryImpl.qll | 4 ++--
.../rust/dataflow/internal/DataFlowImpl.qll | 6 +++---
.../dataflow/internal/FlowSummaryImpl.qll | 20 +++++++++----------
shared/mad/codeql/mad/static/ModelsAsData.qll | 12 +++++------
.../dataflow/internal/FlowSummaryImpl.qll | 2 +-
16 files changed, 67 insertions(+), 67 deletions(-)
diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
index 3fe9f6aaedf..e97b6d044d7 100644
--- a/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
@@ -13,7 +13,7 @@
* - Barriers:
* `namespace; type; subtypes; name; signature; ext; output; kind; provenance`
* - BarrierGuards:
- * `namespace; type; subtypes; name; signature; ext; input; acceptingvalue; kind; provenance`
+ * `namespace; type; subtypes; name; signature; ext; input; acceptingValue; kind; provenance`
*
* The interpretation of a row is similar to API-graphs with a left-to-right
* reading.
@@ -90,7 +90,7 @@
* value, and
* - flow from the _second_ indirection of the 0th argument to the first
* indirection of the return value, etc.
- * 8. The `acceptingvalue` column of barrier guard models specifies the condition
+ * 8. The `acceptingValue` column of barrier guard models specifies the condition
* under which the guard blocks flow. It can be one of "true" or "false". In
* the future "no-exception", "not-zero", "null", "not-null" may be supported.
* 9. The `kind` column is a tag that can be referenced from QL to determine to
@@ -1089,13 +1089,13 @@ private module Cached {
private predicate barrierGuardChecks(IRGuardCondition g, Expr e, boolean gv, TKindModelPair kmp) {
exists(
- SourceSinkInterpretationInput::InterpretNode n, Public::AcceptingValue acceptingvalue,
+ SourceSinkInterpretationInput::InterpretNode n, Public::AcceptingValue acceptingValue,
string kind, string model
|
- isBarrierGuardNode(n, acceptingvalue, kind, model) and
+ isBarrierGuardNode(n, acceptingValue, kind, model) and
n.asNode().asExpr() = e and
kmp = TMkPair(kind, model) and
- gv = convertAcceptingValue(acceptingvalue).asBooleanValue() and
+ gv = convertAcceptingValue(acceptingValue).asBooleanValue() and
n.asNode().(Private::ArgumentNode).getCall().asCallInstruction() = g
)
}
@@ -1112,14 +1112,14 @@ private module Cached {
) {
exists(
SourceSinkInterpretationInput::InterpretNode interpretNode,
- Public::AcceptingValue acceptingvalue, string kind, string model, int indirectionIndex,
+ Public::AcceptingValue acceptingValue, string kind, string model, int indirectionIndex,
Private::ArgumentNode arg
|
- isBarrierGuardNode(interpretNode, acceptingvalue, kind, model) and
+ isBarrierGuardNode(interpretNode, acceptingValue, kind, model) and
arg = interpretNode.asNode() and
arg.asIndirectExpr(indirectionIndex) = e and
kmp = MkKindModelPairIntPair(TMkPair(kind, model), indirectionIndex) and
- gv = convertAcceptingValue(acceptingvalue).asBooleanValue() and
+ gv = convertAcceptingValue(acceptingValue).asBooleanValue() and
arg.getCall().asCallInstruction() = g
)
}
diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/ExternalFlowExtensions.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/ExternalFlowExtensions.qll
index 1a572c221d9..22c74c2aa71 100644
--- a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/ExternalFlowExtensions.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/ExternalFlowExtensions.qll
@@ -33,7 +33,7 @@ extensible predicate barrierModel(
*/
extensible predicate barrierGuardModel(
string namespace, string type, boolean subtypes, string name, string signature, string ext,
- string input, string acceptingvalue, string kind, string provenance, QlBuiltins::ExtensionId madId
+ string input, string acceptingValue, string kind, string provenance, QlBuiltins::ExtensionId madId
);
/**
diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll
index cce1b80e7fc..d91dc41febe 100644
--- a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll
@@ -162,13 +162,13 @@ module SourceSinkInterpretationInput implements
}
predicate barrierGuardElement(
- Element e, string input, Public::AcceptingValue acceptingvalue, string kind,
+ Element e, string input, Public::AcceptingValue acceptingValue, string kind,
Public::Provenance provenance, string model
) {
exists(
string package, string type, boolean subtypes, string name, string signature, string ext
|
- barrierGuardModel(package, type, subtypes, name, signature, ext, input, acceptingvalue, kind,
+ barrierGuardModel(package, type, subtypes, name, signature, ext, input, acceptingValue, kind,
provenance, model) and
e = interpretElement(package, type, subtypes, name, signature, ext)
)
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll
index 17cdcc1bf0b..f8cec8c4d9f 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll
@@ -14,7 +14,7 @@
* - Barriers:
* `namespace; type; subtypes; name; signature; ext; output; kind; provenance`
* - BarrierGuards:
- * `namespace; type; subtypes; name; signature; ext; input; acceptingvalue; kind; provenance`
+ * `namespace; type; subtypes; name; signature; ext; input; acceptingValue; kind; provenance`
* - Neutrals:
* `namespace; type; name; signature; kind; provenance`
* A neutral is used to indicate that a callable is neutral with respect to flow (no summary), source (is not a source) or sink (is not a sink).
@@ -73,7 +73,7 @@
* - "Field[f]": Selects the contents of field `f`.
* - "Property[p]": Selects the contents of property `p`.
*
- * 8. The `acceptingvalue` column of barrier guard models specifies the condition
+ * 8. The `acceptingValue` column of barrier guard models specifies the condition
* under which the guard blocks flow. It can be one of "true" or "false". In
* the future "no-exception", "not-zero", "null", "not-null" may be supported.
* 9. The `kind` column is a tag that can be referenced from QL to determine to
@@ -237,11 +237,11 @@ module ModelValidation {
result = "Unrecognized provenance description \"" + provenance + "\" in " + pred + " model."
)
or
- exists(string acceptingvalue |
- barrierGuardModel(_, _, _, _, _, _, _, acceptingvalue, _, _, _) and
- invalidAcceptingValue(acceptingvalue) and
+ exists(string acceptingValue |
+ barrierGuardModel(_, _, _, _, _, _, _, acceptingValue, _, _, _) and
+ invalidAcceptingValue(acceptingValue) and
result =
- "Unrecognized accepting value description \"" + acceptingvalue +
+ "Unrecognized accepting value description \"" + acceptingValue +
"\" in barrier guard model."
)
}
@@ -489,13 +489,13 @@ private module Cached {
private predicate barrierGuardChecks(Guard g, Expr e, GuardValue gv, TKindModelPair kmp) {
exists(
- SourceSinkInterpretationInput::InterpretNode n, AcceptingValue acceptingvalue, string kind,
+ SourceSinkInterpretationInput::InterpretNode n, AcceptingValue acceptingValue, string kind,
string model
|
- isBarrierGuardNode(n, acceptingvalue, kind, model) and
+ isBarrierGuardNode(n, acceptingValue, kind, model) and
n.asNode().asExpr() = e and
kmp = TMkPair(kind, model) and
- gv = convertAcceptingValue(acceptingvalue)
+ gv = convertAcceptingValue(acceptingValue)
|
g.(Call).getAnArgument() = e or g.(QualifiableExpr).getQualifier() = e
)
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlowExtensions.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlowExtensions.qll
index 3461f0a5186..cd438ece284 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlowExtensions.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlowExtensions.qll
@@ -33,7 +33,7 @@ extensible predicate barrierModel(
*/
extensible predicate barrierGuardModel(
string namespace, string type, boolean subtypes, string name, string signature, string ext,
- string input, string acceptingvalue, string kind, string provenance, QlBuiltins::ExtensionId madId
+ string input, string acceptingValue, string kind, string provenance, QlBuiltins::ExtensionId madId
);
/**
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll
index 6f9b621ff40..4b79ed5feca 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll
@@ -253,13 +253,13 @@ module SourceSinkInterpretationInput implements
}
predicate barrierGuardElement(
- Element e, string input, Public::AcceptingValue acceptingvalue, string kind,
+ Element e, string input, Public::AcceptingValue acceptingValue, string kind,
Public::Provenance provenance, string model
) {
exists(
string namespace, string type, boolean subtypes, string name, string signature, string ext
|
- barrierGuardModel(namespace, type, subtypes, name, signature, ext, input, acceptingvalue,
+ barrierGuardModel(namespace, type, subtypes, name, signature, ext, input, acceptingValue,
kind, provenance, model) and
e = interpretElement(namespace, type, subtypes, name, signature, ext, _)
)
diff --git a/go/ql/lib/semmle/go/dataflow/ExternalFlow.qll b/go/ql/lib/semmle/go/dataflow/ExternalFlow.qll
index 0ad28bac533..f0dc0cf0ca2 100644
--- a/go/ql/lib/semmle/go/dataflow/ExternalFlow.qll
+++ b/go/ql/lib/semmle/go/dataflow/ExternalFlow.qll
@@ -14,7 +14,7 @@
* - Barriers:
* `package; type; subtypes; name; signature; ext; output; kind; provenance`
* - BarrierGuards:
- * `package; type; subtypes; name; signature; ext; input; acceptingvalue; kind; provenance`
+ * `package; type; subtypes; name; signature; ext; input; acceptingValue; kind; provenance`
* - Neutrals:
* `package; type; name; signature; kind; provenance`
* A neutral is used to indicate that a callable is neutral with respect to flow (no summary), source (is not a source) or sink (is not a sink).
@@ -82,7 +82,7 @@
* - "MapValue": Selects a value in a map.
* - "Dereference": Selects the value referenced by a pointer.
*
- * 8. The `acceptingvalue` column of barrier guard models specifies the condition
+ * 8. The `acceptingValue` column of barrier guard models specifies the condition
* under which the guard blocks flow. It can be one of "true" or "false". In
* the future "no-exception", "not-zero", "null", "not-null" may be supported.
* 9. The `kind` column is a tag that can be referenced from QL to determine to
@@ -266,11 +266,11 @@ module ModelValidation {
result = "Unrecognized provenance description \"" + provenance + "\" in " + pred + " model."
)
or
- exists(string acceptingvalue |
- barrierGuardModel(_, _, _, _, _, _, _, acceptingvalue, _, _, _) and
- invalidAcceptingValue(acceptingvalue) and
+ exists(string acceptingValue |
+ barrierGuardModel(_, _, _, _, _, _, _, acceptingValue, _, _, _) and
+ invalidAcceptingValue(acceptingValue) and
result =
- "Unrecognized accepting value description \"" + acceptingvalue +
+ "Unrecognized accepting value description \"" + acceptingValue +
"\" in barrier guard model."
)
}
@@ -478,13 +478,13 @@ private module Cached {
private predicate barrierGuardChecks(DataFlow::Node g, Expr e, boolean gv, TKindModelPair kmp) {
exists(
- SourceSinkInterpretationInput::InterpretNode n, Public::AcceptingValue acceptingvalue,
+ SourceSinkInterpretationInput::InterpretNode n, Public::AcceptingValue acceptingValue,
string kind, string model
|
- isBarrierGuardNode(n, acceptingvalue, kind, model) and
+ isBarrierGuardNode(n, acceptingValue, kind, model) and
n.asNode().asExpr() = e and
kmp = TMkPair(kind, model) and
- gv = convertAcceptingValue(acceptingvalue)
+ gv = convertAcceptingValue(acceptingValue)
|
g.asExpr().(CallExpr).getAnArgument() = e // TODO: qualifier?
)
diff --git a/go/ql/lib/semmle/go/dataflow/internal/ExternalFlowExtensions.qll b/go/ql/lib/semmle/go/dataflow/internal/ExternalFlowExtensions.qll
index 5d43cf674c1..ab2a241e14a 100644
--- a/go/ql/lib/semmle/go/dataflow/internal/ExternalFlowExtensions.qll
+++ b/go/ql/lib/semmle/go/dataflow/internal/ExternalFlowExtensions.qll
@@ -35,7 +35,7 @@ extensible predicate barrierModel(
*/
extensible predicate barrierGuardModel(
string package, string type, boolean subtypes, string name, string signature, string ext,
- string input, string acceptingvalue, string kind, string provenance, QlBuiltins::ExtensionId madId
+ string input, string acceptingValue, string kind, string provenance, QlBuiltins::ExtensionId madId
);
/**
diff --git a/go/ql/lib/semmle/go/dataflow/internal/FlowSummaryImpl.qll b/go/ql/lib/semmle/go/dataflow/internal/FlowSummaryImpl.qll
index 240665bd492..ff727286c3b 100644
--- a/go/ql/lib/semmle/go/dataflow/internal/FlowSummaryImpl.qll
+++ b/go/ql/lib/semmle/go/dataflow/internal/FlowSummaryImpl.qll
@@ -174,13 +174,13 @@ module SourceSinkInterpretationInput implements
}
predicate barrierGuardElement(
- Element e, string input, Public::AcceptingValue acceptingvalue, string kind,
+ Element e, string input, Public::AcceptingValue acceptingValue, string kind,
Public::Provenance provenance, string model
) {
exists(
string package, string type, boolean subtypes, string name, string signature, string ext
|
- barrierGuardModel(package, type, subtypes, name, signature, ext, input, acceptingvalue, kind,
+ barrierGuardModel(package, type, subtypes, name, signature, ext, input, acceptingValue, kind,
provenance, model) and
e = interpretElement(package, type, subtypes, name, signature, ext)
)
diff --git a/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll b/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll
index 6ad4a5938a3..a6a9347ca03 100644
--- a/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll
+++ b/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll
@@ -14,7 +14,7 @@
* - Barriers:
* `package; type; subtypes; name; signature; ext; output; kind; provenance`
* - BarrierGuards:
- * `package; type; subtypes; name; signature; ext; input; acceptingvalue; kind; provenance`
+ * `package; type; subtypes; name; signature; ext; input; acceptingValue; kind; provenance`
* - Neutrals:
* `package; type; name; signature; kind; provenance`
* A neutral is used to indicate that a callable is neutral with respect to flow (no summary), source (is not a source) or sink (is not a sink).
@@ -73,7 +73,7 @@
* in the given range. The range is inclusive at both ends.
* - "ReturnValue": Selects the return value of a call to the selected element.
* - "Element": Selects the collection elements of the selected element.
- * 8. The `acceptingvalue` column of barrier guard models specifies the condition
+ * 8. The `acceptingValue` column of barrier guard models specifies the condition
* under which the guard blocks flow. It can be one of "true" or "false". In
* the future "no-exception", "not-zero", "null", "not-null" may be supported.
* 9. The `kind` column is a tag that can be referenced from QL to determine to
@@ -365,11 +365,11 @@ module ModelValidation {
result = "Unrecognized provenance description \"" + provenance + "\" in " + pred + " model."
)
or
- exists(string acceptingvalue |
- barrierGuardModel(_, _, _, _, _, _, _, acceptingvalue, _, _, _) and
- invalidAcceptingValue(acceptingvalue) and
+ exists(string acceptingValue |
+ barrierGuardModel(_, _, _, _, _, _, _, acceptingValue, _, _, _) and
+ invalidAcceptingValue(acceptingValue) and
result =
- "Unrecognized accepting value description \"" + acceptingvalue +
+ "Unrecognized accepting value description \"" + acceptingValue +
"\" in barrier guard model."
)
}
@@ -590,13 +590,13 @@ private module Cached {
private predicate barrierGuardChecks(Guard g, Expr e, GuardValue gv, TKindModelPair kmp) {
exists(
- SourceSinkInterpretationInput::InterpretNode n, AcceptingValue acceptingvalue, string kind,
+ SourceSinkInterpretationInput::InterpretNode n, AcceptingValue acceptingValue, string kind,
string model
|
- isBarrierGuardNode(n, acceptingvalue, kind, model) and
+ isBarrierGuardNode(n, acceptingValue, kind, model) and
n.asNode().asExpr() = e and
kmp = TMkPair(kind, model) and
- gv = convertAcceptingValue(acceptingvalue)
+ gv = convertAcceptingValue(acceptingValue)
|
g.(Call).getAnArgument() = e or g.(MethodCall).getQualifier() = e
)
diff --git a/java/ql/lib/semmle/code/java/dataflow/internal/ExternalFlowExtensions.qll b/java/ql/lib/semmle/code/java/dataflow/internal/ExternalFlowExtensions.qll
index be474ad4535..3c6b003876d 100644
--- a/java/ql/lib/semmle/code/java/dataflow/internal/ExternalFlowExtensions.qll
+++ b/java/ql/lib/semmle/code/java/dataflow/internal/ExternalFlowExtensions.qll
@@ -35,7 +35,7 @@ extensible predicate barrierModel(
*/
extensible predicate barrierGuardModel(
string package, string type, boolean subtypes, string name, string signature, string ext,
- string input, string acceptingvalue, string kind, string provenance, QlBuiltins::ExtensionId madId
+ string input, string acceptingValue, string kind, string provenance, QlBuiltins::ExtensionId madId
);
/**
diff --git a/java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll b/java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll
index 64fa30c7d91..453b7ccae11 100644
--- a/java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll
+++ b/java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll
@@ -282,7 +282,7 @@ module SourceSinkInterpretationInput implements
}
predicate barrierGuardElement(
- Element e, string input, Public::AcceptingValue acceptingvalue, string kind,
+ Element e, string input, Public::AcceptingValue acceptingValue, string kind,
Public::Provenance provenance, string model
) {
exists(
@@ -290,7 +290,7 @@ module SourceSinkInterpretationInput implements
SourceOrSinkElement baseBarrier, string originalInput
|
barrierGuardModel(namespace, type, subtypes, name, signature, ext, originalInput,
- acceptingvalue, kind, provenance, model) and
+ acceptingValue, kind, provenance, model) and
baseBarrier = interpretElement(namespace, type, subtypes, name, signature, ext, _) and
(
e = baseBarrier and input = originalInput
diff --git a/rust/ql/lib/codeql/rust/dataflow/internal/DataFlowImpl.qll b/rust/ql/lib/codeql/rust/dataflow/internal/DataFlowImpl.qll
index 27773758fc4..7c1fdd8cf78 100644
--- a/rust/ql/lib/codeql/rust/dataflow/internal/DataFlowImpl.qll
+++ b/rust/ql/lib/codeql/rust/dataflow/internal/DataFlowImpl.qll
@@ -1183,12 +1183,12 @@ private module Cached {
exists(
FlowSummaryImpl::Public::BarrierGuardElement b,
FlowSummaryImpl::Private::SummaryComponentStack stack,
- FlowSummaryImpl::Public::AcceptingValue acceptingvalue, string kind, string model
+ FlowSummaryImpl::Public::AcceptingValue acceptingValue, string kind, string model
|
- FlowSummaryImpl::Private::barrierGuardSpec(b, stack, acceptingvalue, kind, model) and
+ FlowSummaryImpl::Private::barrierGuardSpec(b, stack, acceptingValue, kind, model) and
e = FlowSummaryImpl::StepsInput::getSinkNode(b, stack.headOfSingleton()).asExpr() and
kmp = TMkPair(kind, model) and
- gv = convertAcceptingValue(acceptingvalue) and
+ gv = convertAcceptingValue(acceptingValue) and
g = b.getCall()
)
}
diff --git a/shared/dataflow/codeql/dataflow/internal/FlowSummaryImpl.qll b/shared/dataflow/codeql/dataflow/internal/FlowSummaryImpl.qll
index 8b25c54bfa0..0c6e42d9066 100644
--- a/shared/dataflow/codeql/dataflow/internal/FlowSummaryImpl.qll
+++ b/shared/dataflow/codeql/dataflow/internal/FlowSummaryImpl.qll
@@ -2189,10 +2189,10 @@ module Make<
not exists(interpretComponent(c))
}
- /** Holds if `acceptingvalue` is not a valid barrier guard accepting-value. */
- bindingset[acceptingvalue]
- predicate invalidAcceptingValue(string acceptingvalue) {
- not acceptingvalue instanceof AcceptingValue
+ /** Holds if `acceptingValue` is not a valid barrier guard accepting-value. */
+ bindingset[acceptingValue]
+ predicate invalidAcceptingValue(string acceptingValue) {
+ not acceptingValue instanceof AcceptingValue
}
/** Holds if `provenance` is not a valid provenance value. */
@@ -2242,10 +2242,10 @@ module Make<
/**
* Holds if an external barrier guard specification exists for `n` with input
- * specification `input`, accepting value `acceptingvalue`, and kind `kind`.
+ * specification `input`, accepting value `acceptingValue`, and kind `kind`.
*/
predicate barrierGuardElement(
- Element n, string input, AcceptingValue acceptingvalue, string kind,
+ Element n, string input, AcceptingValue acceptingValue, string kind,
Provenance provenance, string model
);
@@ -2371,11 +2371,11 @@ module Make<
}
private predicate barrierGuardElementRef(
- InterpretNode ref, SourceSinkAccessPath input, AcceptingValue acceptingvalue, string kind,
+ InterpretNode ref, SourceSinkAccessPath input, AcceptingValue acceptingValue, string kind,
string model
) {
exists(SourceOrSinkElement e |
- barrierGuardElement(e, input, acceptingvalue, kind, _, model) and
+ barrierGuardElement(e, input, acceptingValue, kind, _, model) and
if inputNeedsReferenceExt(input.getToken(0))
then e = ref.getCallTarget()
else e = ref.asElement()
@@ -2518,10 +2518,10 @@ module Make<
* given kind in a MaD flow model.
*/
predicate isBarrierGuardNode(
- InterpretNode node, AcceptingValue acceptingvalue, string kind, string model
+ InterpretNode node, AcceptingValue acceptingValue, string kind, string model
) {
exists(InterpretNode ref, SourceSinkAccessPath input |
- barrierGuardElementRef(ref, input, acceptingvalue, kind, model) and
+ barrierGuardElementRef(ref, input, acceptingValue, kind, model) and
interpretInput(input, input.getNumToken(), ref, node)
)
}
diff --git a/shared/mad/codeql/mad/static/ModelsAsData.qll b/shared/mad/codeql/mad/static/ModelsAsData.qll
index 84daaa9b6c8..4b58a23186a 100644
--- a/shared/mad/codeql/mad/static/ModelsAsData.qll
+++ b/shared/mad/codeql/mad/static/ModelsAsData.qll
@@ -31,7 +31,7 @@ signature module ExtensionsSig {
*/
predicate barrierGuardModel(
string namespace, string type, boolean subtypes, string name, string signature, string ext,
- string input, string acceptingvalue, string kind, string provenance,
+ string input, string acceptingValue, string kind, string provenance,
QlBuiltins::ExtensionId madId
);
@@ -142,14 +142,14 @@ module ModelsAsData {
or
exists(
string namespace, string type, boolean subtypes, string name, string signature, string ext,
- string input, string acceptingvalue, string kind, string provenance
+ string input, string acceptingValue, string kind, string provenance
|
Extensions::barrierGuardModel(namespace, type, subtypes, name, signature, ext, input,
- acceptingvalue, kind, provenance, madId)
+ acceptingValue, kind, provenance, madId)
|
model =
"Barrier Guard: " + namespace + "; " + type + "; " + subtypes + "; " + name + "; " +
- signature + "; " + ext + "; " + input + "; " + acceptingvalue + "; " + kind + "; " +
+ signature + "; " + ext + "; " + input + "; " + acceptingValue + "; " + kind + "; " +
provenance
)
or
@@ -241,12 +241,12 @@ module ModelsAsData {
/** Holds if a barrier guard model exists for the given parameters. */
predicate barrierGuardModel(
string namespace, string type, boolean subtypes, string name, string signature, string ext,
- string input, string acceptingvalue, string kind, string provenance, string model
+ string input, string acceptingValue, string kind, string provenance, string model
) {
exists(string namespaceOrGroup, QlBuiltins::ExtensionId madId |
namespace = getNamespace(namespaceOrGroup) and
Extensions::barrierGuardModel(namespaceOrGroup, type, subtypes, name, signature, ext, input,
- acceptingvalue, kind, provenance, madId) and
+ acceptingValue, kind, provenance, madId) and
model = "MaD:" + madId.toString()
)
}
diff --git a/swift/ql/lib/codeql/swift/dataflow/internal/FlowSummaryImpl.qll b/swift/ql/lib/codeql/swift/dataflow/internal/FlowSummaryImpl.qll
index c1ddb7f781f..3a096fe3d57 100644
--- a/swift/ql/lib/codeql/swift/dataflow/internal/FlowSummaryImpl.qll
+++ b/swift/ql/lib/codeql/swift/dataflow/internal/FlowSummaryImpl.qll
@@ -168,7 +168,7 @@ module SourceSinkInterpretationInput implements
}
predicate barrierGuardElement(
- Element n, string input, Public::AcceptingValue acceptingvalue, string kind,
+ Element n, string input, Public::AcceptingValue acceptingValue, string kind,
Public::Provenance provenance, string model
) {
none()
From c5ef1f6342bbc04bf34f95abc397df1089617d2c Mon Sep 17 00:00:00 2001
From: Taus
Date: Fri, 20 Mar 2026 13:56:07 +0000
Subject: [PATCH 030/185] Python: Port UseOfExit.ql
---
python/ql/src/Statements/UseOfExit.ql | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/python/ql/src/Statements/UseOfExit.ql b/python/ql/src/Statements/UseOfExit.ql
index 437ff93b537..2310a839f67 100644
--- a/python/ql/src/Statements/UseOfExit.ql
+++ b/python/ql/src/Statements/UseOfExit.ql
@@ -12,10 +12,12 @@
*/
import python
-private import LegacyPointsTo
+private import semmle.python.ApiGraphs
from CallNode call, string name
-where call.getFunction().(ControlFlowNodeWithPointsTo).pointsTo(Value::siteQuitter(name))
+where
+ name = ["exit", "quit"] and
+ call = API::builtin(name).getACall().asCfgNode()
select call,
"The '" + name +
"' site.Quitter object may not exist if the 'site' module is not loaded or is modified."
From 37aac059640e804b4b7550279d5f2bfa1812c211 Mon Sep 17 00:00:00 2001
From: Owen Mansel-Chan
Date: Fri, 27 Mar 2026 22:39:10 +0000
Subject: [PATCH 031/185] Replace `branch` with `acceptingValue`
---
.../data/internal/ApiGraphModels.qll | 26 +++++++++----------
.../internal/ApiGraphModelsExtensions.qll | 6 ++---
.../data/internal/ApiGraphModels.qll | 26 +++++++++----------
.../internal/ApiGraphModelsExtensions.qll | 6 ++---
.../data/internal/ApiGraphModels.qll | 26 +++++++++----------
.../internal/ApiGraphModelsExtensions.qll | 6 ++---
.../rust/dataflow/internal/ModelsAsData.qll | 21 ++++++++-------
.../dataflow/internal/FlowSummaryImpl.qll | 16 ++++++------
8 files changed, 67 insertions(+), 66 deletions(-)
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModels.qll b/javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModels.qll
index 34bf3267522..155fb4b7c78 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModels.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModels.qll
@@ -13,7 +13,7 @@
* - Barriers:
* `type, path, kind`
* - BarrierGuards:
- * `type, path, branch, kind`
+ * `type, path, acceptingValue, kind`
* - Types:
* `type1, type2, path`
*
@@ -46,7 +46,7 @@
* 3. The `input` and `output` columns specify how data enters and leaves the element selected by the
* first `(type, path)` tuple. Both strings are `.`-separated access paths
* of the same syntax as the `path` column.
- * 4. The `branch` column of barrier guard models specifies which branch of the guard is blocking flow. It can be "true" or "false".
+ * 4. The `acceptingValue` column of barrier guard models specifies which branch of the guard is blocking flow. It can be "true" or "false".
* 5. The `kind` column is a tag that can be referenced from QL to determine to
* which classes the interpreted elements should be added. For example, for
* sources `"remote"` indicates a default remote flow source, and for summaries
@@ -360,11 +360,11 @@ private predicate barrierModel(string type, string path, string kind, string mod
/** Holds if a barrier guard model exists for the given parameters. */
private predicate barrierGuardModel(
- string type, string path, string branch, string kind, string model
+ string type, string path, string acceptingValue, string kind, string model
) {
// No deprecation adapter for barrier models, they were not around back then.
exists(QlBuiltins::ExtensionId madId |
- Extensions::barrierGuardModel(type, path, branch, kind, madId) and
+ Extensions::barrierGuardModel(type, path, acceptingValue, kind, madId) and
model = "MaD:" + madId.toString()
)
}
@@ -788,16 +788,16 @@ module ModelOutput {
}
/**
- * Holds if a barrier model contributed `barrier` with the given `kind` for the given `branch`.
+ * Holds if a barrier model contributed `barrier` with the given `kind` for the given `acceptingValue`.
*/
cached
- API::Node getABarrierGuardNode(string kind, boolean branch, string model) {
- exists(string type, string path, string branch_str |
- branch = true and branch_str = "true"
+ API::Node getABarrierGuardNode(string kind, boolean acceptingValue, string model) {
+ exists(string type, string path, string acceptingValue_str |
+ acceptingValue = true and acceptingValue_str = "true"
or
- branch = false and branch_str = "false"
+ acceptingValue = false and acceptingValue_str = "false"
|
- barrierGuardModel(type, path, branch_str, kind, model) and
+ barrierGuardModel(type, path, acceptingValue_str, kind, model) and
result = getNodeFromPath(type, path)
)
}
@@ -861,12 +861,12 @@ module ModelOutput {
API::Node getABarrierNode(string kind) { result = getABarrierNode(kind, _) }
/**
- * Holds if an external model contributed `barrier-guard` with the given `kind` and `branch`.
+ * Holds if an external model contributed `barrier-guard` with the given `kind` and `acceptingValue`.
*
* INTERNAL: Do not use.
*/
- API::Node getABarrierGuardNode(string kind, boolean branch) {
- result = getABarrierGuardNode(kind, branch, _)
+ API::Node getABarrierGuardNode(string kind, boolean acceptingValue) {
+ result = getABarrierGuardNode(kind, acceptingValue, _)
}
/**
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModelsExtensions.qll b/javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModelsExtensions.qll
index 2a644aabb95..8d8a4f5fd88 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModelsExtensions.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModelsExtensions.qll
@@ -33,11 +33,11 @@ extensible predicate barrierModel(
* of the given `kind` and `madId` is the data extension row number.
* `path` is assumed to lead to a parameter of a call (possibly `self`), and
* the call is guarding the parameter.
- * `branch` is either `true` or `false`, indicating which branch of the guard
- * is protecting the parameter.
+ * `acceptingValue` is either `true` or `false`, indicating which branch of
+ * the guard is protecting the parameter.
*/
extensible predicate barrierGuardModel(
- string type, string path, string branch, string kind, QlBuiltins::ExtensionId madId
+ string type, string path, string acceptingValue, string kind, QlBuiltins::ExtensionId madId
);
/**
diff --git a/python/ql/lib/semmle/python/frameworks/data/internal/ApiGraphModels.qll b/python/ql/lib/semmle/python/frameworks/data/internal/ApiGraphModels.qll
index 34bf3267522..155fb4b7c78 100644
--- a/python/ql/lib/semmle/python/frameworks/data/internal/ApiGraphModels.qll
+++ b/python/ql/lib/semmle/python/frameworks/data/internal/ApiGraphModels.qll
@@ -13,7 +13,7 @@
* - Barriers:
* `type, path, kind`
* - BarrierGuards:
- * `type, path, branch, kind`
+ * `type, path, acceptingValue, kind`
* - Types:
* `type1, type2, path`
*
@@ -46,7 +46,7 @@
* 3. The `input` and `output` columns specify how data enters and leaves the element selected by the
* first `(type, path)` tuple. Both strings are `.`-separated access paths
* of the same syntax as the `path` column.
- * 4. The `branch` column of barrier guard models specifies which branch of the guard is blocking flow. It can be "true" or "false".
+ * 4. The `acceptingValue` column of barrier guard models specifies which branch of the guard is blocking flow. It can be "true" or "false".
* 5. The `kind` column is a tag that can be referenced from QL to determine to
* which classes the interpreted elements should be added. For example, for
* sources `"remote"` indicates a default remote flow source, and for summaries
@@ -360,11 +360,11 @@ private predicate barrierModel(string type, string path, string kind, string mod
/** Holds if a barrier guard model exists for the given parameters. */
private predicate barrierGuardModel(
- string type, string path, string branch, string kind, string model
+ string type, string path, string acceptingValue, string kind, string model
) {
// No deprecation adapter for barrier models, they were not around back then.
exists(QlBuiltins::ExtensionId madId |
- Extensions::barrierGuardModel(type, path, branch, kind, madId) and
+ Extensions::barrierGuardModel(type, path, acceptingValue, kind, madId) and
model = "MaD:" + madId.toString()
)
}
@@ -788,16 +788,16 @@ module ModelOutput {
}
/**
- * Holds if a barrier model contributed `barrier` with the given `kind` for the given `branch`.
+ * Holds if a barrier model contributed `barrier` with the given `kind` for the given `acceptingValue`.
*/
cached
- API::Node getABarrierGuardNode(string kind, boolean branch, string model) {
- exists(string type, string path, string branch_str |
- branch = true and branch_str = "true"
+ API::Node getABarrierGuardNode(string kind, boolean acceptingValue, string model) {
+ exists(string type, string path, string acceptingValue_str |
+ acceptingValue = true and acceptingValue_str = "true"
or
- branch = false and branch_str = "false"
+ acceptingValue = false and acceptingValue_str = "false"
|
- barrierGuardModel(type, path, branch_str, kind, model) and
+ barrierGuardModel(type, path, acceptingValue_str, kind, model) and
result = getNodeFromPath(type, path)
)
}
@@ -861,12 +861,12 @@ module ModelOutput {
API::Node getABarrierNode(string kind) { result = getABarrierNode(kind, _) }
/**
- * Holds if an external model contributed `barrier-guard` with the given `kind` and `branch`.
+ * Holds if an external model contributed `barrier-guard` with the given `kind` and `acceptingValue`.
*
* INTERNAL: Do not use.
*/
- API::Node getABarrierGuardNode(string kind, boolean branch) {
- result = getABarrierGuardNode(kind, branch, _)
+ API::Node getABarrierGuardNode(string kind, boolean acceptingValue) {
+ result = getABarrierGuardNode(kind, acceptingValue, _)
}
/**
diff --git a/python/ql/lib/semmle/python/frameworks/data/internal/ApiGraphModelsExtensions.qll b/python/ql/lib/semmle/python/frameworks/data/internal/ApiGraphModelsExtensions.qll
index 2a644aabb95..8d8a4f5fd88 100644
--- a/python/ql/lib/semmle/python/frameworks/data/internal/ApiGraphModelsExtensions.qll
+++ b/python/ql/lib/semmle/python/frameworks/data/internal/ApiGraphModelsExtensions.qll
@@ -33,11 +33,11 @@ extensible predicate barrierModel(
* of the given `kind` and `madId` is the data extension row number.
* `path` is assumed to lead to a parameter of a call (possibly `self`), and
* the call is guarding the parameter.
- * `branch` is either `true` or `false`, indicating which branch of the guard
- * is protecting the parameter.
+ * `acceptingValue` is either `true` or `false`, indicating which branch of
+ * the guard is protecting the parameter.
*/
extensible predicate barrierGuardModel(
- string type, string path, string branch, string kind, QlBuiltins::ExtensionId madId
+ string type, string path, string acceptingValue, string kind, QlBuiltins::ExtensionId madId
);
/**
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/data/internal/ApiGraphModels.qll b/ruby/ql/lib/codeql/ruby/frameworks/data/internal/ApiGraphModels.qll
index 34bf3267522..155fb4b7c78 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/data/internal/ApiGraphModels.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/data/internal/ApiGraphModels.qll
@@ -13,7 +13,7 @@
* - Barriers:
* `type, path, kind`
* - BarrierGuards:
- * `type, path, branch, kind`
+ * `type, path, acceptingValue, kind`
* - Types:
* `type1, type2, path`
*
@@ -46,7 +46,7 @@
* 3. The `input` and `output` columns specify how data enters and leaves the element selected by the
* first `(type, path)` tuple. Both strings are `.`-separated access paths
* of the same syntax as the `path` column.
- * 4. The `branch` column of barrier guard models specifies which branch of the guard is blocking flow. It can be "true" or "false".
+ * 4. The `acceptingValue` column of barrier guard models specifies which branch of the guard is blocking flow. It can be "true" or "false".
* 5. The `kind` column is a tag that can be referenced from QL to determine to
* which classes the interpreted elements should be added. For example, for
* sources `"remote"` indicates a default remote flow source, and for summaries
@@ -360,11 +360,11 @@ private predicate barrierModel(string type, string path, string kind, string mod
/** Holds if a barrier guard model exists for the given parameters. */
private predicate barrierGuardModel(
- string type, string path, string branch, string kind, string model
+ string type, string path, string acceptingValue, string kind, string model
) {
// No deprecation adapter for barrier models, they were not around back then.
exists(QlBuiltins::ExtensionId madId |
- Extensions::barrierGuardModel(type, path, branch, kind, madId) and
+ Extensions::barrierGuardModel(type, path, acceptingValue, kind, madId) and
model = "MaD:" + madId.toString()
)
}
@@ -788,16 +788,16 @@ module ModelOutput {
}
/**
- * Holds if a barrier model contributed `barrier` with the given `kind` for the given `branch`.
+ * Holds if a barrier model contributed `barrier` with the given `kind` for the given `acceptingValue`.
*/
cached
- API::Node getABarrierGuardNode(string kind, boolean branch, string model) {
- exists(string type, string path, string branch_str |
- branch = true and branch_str = "true"
+ API::Node getABarrierGuardNode(string kind, boolean acceptingValue, string model) {
+ exists(string type, string path, string acceptingValue_str |
+ acceptingValue = true and acceptingValue_str = "true"
or
- branch = false and branch_str = "false"
+ acceptingValue = false and acceptingValue_str = "false"
|
- barrierGuardModel(type, path, branch_str, kind, model) and
+ barrierGuardModel(type, path, acceptingValue_str, kind, model) and
result = getNodeFromPath(type, path)
)
}
@@ -861,12 +861,12 @@ module ModelOutput {
API::Node getABarrierNode(string kind) { result = getABarrierNode(kind, _) }
/**
- * Holds if an external model contributed `barrier-guard` with the given `kind` and `branch`.
+ * Holds if an external model contributed `barrier-guard` with the given `kind` and `acceptingValue`.
*
* INTERNAL: Do not use.
*/
- API::Node getABarrierGuardNode(string kind, boolean branch) {
- result = getABarrierGuardNode(kind, branch, _)
+ API::Node getABarrierGuardNode(string kind, boolean acceptingValue) {
+ result = getABarrierGuardNode(kind, acceptingValue, _)
}
/**
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/data/internal/ApiGraphModelsExtensions.qll b/ruby/ql/lib/codeql/ruby/frameworks/data/internal/ApiGraphModelsExtensions.qll
index 2a644aabb95..8d8a4f5fd88 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/data/internal/ApiGraphModelsExtensions.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/data/internal/ApiGraphModelsExtensions.qll
@@ -33,11 +33,11 @@ extensible predicate barrierModel(
* of the given `kind` and `madId` is the data extension row number.
* `path` is assumed to lead to a parameter of a call (possibly `self`), and
* the call is guarding the parameter.
- * `branch` is either `true` or `false`, indicating which branch of the guard
- * is protecting the parameter.
+ * `acceptingValue` is either `true` or `false`, indicating which branch of
+ * the guard is protecting the parameter.
*/
extensible predicate barrierGuardModel(
- string type, string path, string branch, string kind, QlBuiltins::ExtensionId madId
+ string type, string path, string acceptingValue, string kind, QlBuiltins::ExtensionId madId
);
/**
diff --git a/rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll b/rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll
index cc7dd9963ea..2b3ecf51fe4 100644
--- a/rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll
+++ b/rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll
@@ -12,7 +12,7 @@
* - Barriers:
* `path; output; kind; provenance`
* - BarrierGuards:
- * `path; input; branch; kind; provenance`
+ * `path; input; acceptingValue; kind; provenance`
* - Neutrals:
* `path; kind; provenance`
* A neutral is used to indicate that a callable is neutral with respect to flow (no summary), source (is not a source) or sink (is not a sink).
@@ -41,7 +41,7 @@
* - `Field[i]`: the `i`th element of a tuple.
* - `Reference`: the referenced value.
* - `Future`: the value being computed asynchronously.
- * 3. The `branch` column of barrier guard models specifies which branch of the
+ * 3. The `acceptingValue` column of barrier guard models specifies which branch of the
* guard is blocking flow. It can be "true" or "false". In the future
* "no-exception", "not-zero", "null", "not-null" may be supported.
* 4. The `kind` column is a tag that can be referenced from QL to determine to
@@ -124,11 +124,12 @@ extensible predicate barrierModel(
* extension row number.
*
* The value referred to by `input` is assumed to lead to an argument of a call
- * (possibly `self`), and the call is guarding the argument. `branch` is either `true`
- * or `false`, indicating which branch of the guard is protecting the argument.
+ * (possibly `self`), and the call is guarding the argument.
+ * `acceptingValue` is either `true` or `false`, indicating which branch of
+ * the guard is protecting the parameter.
*/
extensible predicate barrierGuardModel(
- string path, string input, string branch, string kind, string provenance,
+ string path, string input, string acceptingValue, string kind, string provenance,
QlBuiltins::ExtensionId madId
);
@@ -163,9 +164,9 @@ predicate interpretModelForTest(QlBuiltins::ExtensionId madId, string model) {
model = "Barrier: " + path + "; " + output + "; " + kind
)
or
- exists(string path, string input, string branch, string kind |
- barrierGuardModel(path, input, branch, kind, _, madId) and
- model = "Barrier guard: " + path + "; " + input + "; " + branch + "; " + kind
+ exists(string path, string input, string acceptingValue, string kind |
+ barrierGuardModel(path, input, acceptingValue, kind, _, madId) and
+ model = "Barrier guard: " + path + "; " + input + "; " + acceptingValue + "; " + kind
)
}
@@ -275,10 +276,10 @@ private class FlowBarrierGuardFromModel extends FlowBarrierGuard::Range {
}
override predicate isBarrierGuard(
- string input, string branch, string kind, Provenance provenance, string model
+ string input, string acceptingValue, string kind, Provenance provenance, string model
) {
exists(QlBuiltins::ExtensionId madId |
- barrierGuardModel(path, input, branch, kind, provenance, madId) and
+ barrierGuardModel(path, input, acceptingValue, kind, provenance, madId) and
model = "MaD:" + madId.toString()
)
}
diff --git a/shared/dataflow/codeql/dataflow/internal/FlowSummaryImpl.qll b/shared/dataflow/codeql/dataflow/internal/FlowSummaryImpl.qll
index 0c6e42d9066..ce980724778 100644
--- a/shared/dataflow/codeql/dataflow/internal/FlowSummaryImpl.qll
+++ b/shared/dataflow/codeql/dataflow/internal/FlowSummaryImpl.qll
@@ -388,11 +388,11 @@ module Make<
/**
* Holds if this element is a flow barrier guard of kind `kind`, for data
- * flowing in as described by `input`, when `this` evaluates to `branch`.
+ * flowing in as described by `input`, when `this` evaluates to `acceptingValue`.
*/
pragma[nomagic]
abstract predicate isBarrierGuard(
- string input, string branch, string kind, Provenance provenance, string model
+ string input, string acceptingValue, string kind, Provenance provenance, string model
);
}
@@ -764,10 +764,10 @@ module Make<
}
private predicate isRelevantBarrierGuard(
- BarrierGuardElement e, string input, string branch, string kind, Provenance provenance,
- string model
+ BarrierGuardElement e, string input, string acceptingValue, string kind,
+ Provenance provenance, string model
) {
- e.isBarrierGuard(input, branch, kind, provenance, model) and
+ e.isBarrierGuard(input, acceptingValue, kind, provenance, model) and
(
provenance.isManual()
or
@@ -1588,11 +1588,11 @@ module Make<
* Holds if `barrierGuard` is a relevant barrier guard element with input specification `inSpec`.
*/
predicate barrierGuardSpec(
- BarrierGuardElement barrierGuard, SummaryComponentStack inSpec, string branch, string kind,
- string model
+ BarrierGuardElement barrierGuard, SummaryComponentStack inSpec, string acceptingValue,
+ string kind, string model
) {
exists(string input |
- isRelevantBarrierGuard(barrierGuard, input, branch, kind, _, model) and
+ isRelevantBarrierGuard(barrierGuard, input, acceptingValue, kind, _, model) and
External::interpretSpec(input, inSpec)
)
}
From 187f7c7bcf95097648230c34a7cf7d857dc0aeea Mon Sep 17 00:00:00 2001
From: Taus
Date: Fri, 27 Mar 2026 22:44:39 +0000
Subject: [PATCH 032/185] Python: Move isNetworkBind check into isSink
---
.../CVE-2018-1281/BindToAllInterfaces.ql | 20 ++++++-------------
.../BindToAllInterfaces.expected | 1 -
2 files changed, 6 insertions(+), 15 deletions(-)
diff --git a/python/ql/src/Security/CVE-2018-1281/BindToAllInterfaces.ql b/python/ql/src/Security/CVE-2018-1281/BindToAllInterfaces.ql
index 75c145ec0ac..14c17edc359 100644
--- a/python/ql/src/Security/CVE-2018-1281/BindToAllInterfaces.ql
+++ b/python/ql/src/Security/CVE-2018-1281/BindToAllInterfaces.ql
@@ -34,7 +34,11 @@ private module BindToAllInterfacesConfig implements DataFlow::ConfigSig {
}
predicate isSink(DataFlow::Node sink) {
- ModelOutput::sinkNode(sink, "bind-socket-all-interfaces")
+ ModelOutput::sinkNode(sink, "bind-socket-all-interfaces") and
+ // Network socket addresses are tuples like (host, port), so we require
+ // the bind() argument to originate from a tuple expression. This excludes
+ // AF_UNIX sockets, which pass a plain string path to bind().
+ any(DataFlow::LocalSourceNode n | n.asExpr() instanceof Tuple).flowsTo(sink)
}
}
@@ -42,20 +46,8 @@ private module BindToAllInterfacesFlow = TaintTracking::Global
Date: Fri, 27 Mar 2026 23:46:50 +0100
Subject: [PATCH 033/185] Python: Update change note
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---
.../2026-03-26-improve-bind-all-interfaces-query.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/python/ql/src/change-notes/2026-03-26-improve-bind-all-interfaces-query.md b/python/ql/src/change-notes/2026-03-26-improve-bind-all-interfaces-query.md
index b4b5464b503..bc78b2b6f77 100644
--- a/python/ql/src/change-notes/2026-03-26-improve-bind-all-interfaces-query.md
+++ b/python/ql/src/change-notes/2026-03-26-improve-bind-all-interfaces-query.md
@@ -2,4 +2,4 @@
category: minorAnalysis
---
-- The `py/bind-socket-all-network-interfaces` query now uses the global data-flow library, leading to better precision and more results. Also, wrappers of `socket.socket` in the `eventlet` and `gevent` libraries are now also recognised as socket binding operations.
+- The `py/bind-socket-all-network-interfaces` query now uses the global data-flow library, leading to better precision and more results. Also, wrappers of `socket.socket` in the `eventlet` and `gevent` libraries are now also recognized as socket binding operations.
From 9c095bc580b5fd4d0f44362faf8680d5e25f2a4d Mon Sep 17 00:00:00 2001
From: Michael Nebel
Date: Fri, 27 Mar 2026 12:49:03 +0100
Subject: [PATCH 034/185] C#: Deprecate get[L|R]Value predicates.
---
csharp/ql/lib/Linq/Helpers.qll | 2 +-
csharp/ql/lib/definitions.qll | 2 +-
.../ql/lib/semmle/code/csharp/Assignable.qll | 16 +++++-----
csharp/ql/lib/semmle/code/csharp/PrintAst.qll | 4 +--
csharp/ql/lib/semmle/code/csharp/Property.qll | 4 +--
.../semmle/code/csharp/controlflow/Guards.qll | 6 ++--
.../internal/ControlFlowGraphImpl.qll | 2 +-
.../semmle/code/csharp/dataflow/Nullness.qll | 2 +-
.../dataflow/internal/DataFlowPrivate.qll | 16 +++++-----
.../code/csharp/dataflow/internal/SsaImpl.qll | 2 +-
.../internal/rangeanalysis/RangeUtils.qll | 16 ++++++----
.../rangeanalysis/SignAnalysisSpecific.qll | 4 +--
.../internal/rangeanalysis/SsaUtils.qll | 2 +-
.../semmle/code/csharp/dispatch/Dispatch.qll | 2 +-
.../lib/semmle/code/csharp/exprs/Access.qll | 2 +-
.../semmle/code/csharp/exprs/Assignment.qll | 32 ++++++++++++++-----
.../ql/lib/semmle/code/csharp/exprs/Call.qll | 6 ++--
.../lib/semmle/code/csharp/exprs/Creation.qll | 2 +-
.../ql/lib/semmle/code/csharp/exprs/Expr.qll | 2 +-
.../lib/semmle/code/csharp/frameworks/Moq.qll | 2 +-
.../lib/semmle/code/csharp/frameworks/Sql.qll | 4 +--
.../csharp/security/auth/SecureCookies.qll | 20 ++++++------
.../dataflow/UnsafeDeserializationQuery.qll | 6 ++--
.../csharp/security/xml/InsecureXMLQuery.qll | 10 +++---
csharp/ql/src/Dead Code/NonAssignedFields.ql | 6 ++--
.../ql/src/Language Abuse/ForeachCapture.ql | 18 +++++------
.../MissedTernaryOpportunity.ql | 2 +-
.../Collections/WriteOnlyContainer.ql | 5 +--
csharp/ql/src/Likely Bugs/SelfAssignment.ql | 6 ++--
csharp/ql/src/Linq/BadMultipleIteration.ql | 2 +-
.../Performance/StringConcatenationInLoop.ql | 4 +--
.../CWE-1004/CookieWithoutHttpOnly.ql | 10 +++---
.../CWE-327/InsecureSQLConnection.ql | 4 +--
.../CWE-614/CookieWithoutSecure.ql | 10 +++---
.../CookieWithOverlyBroadDomain.ql | 6 ++--
.../CookieWithOverlyBroadPath.ql | 4 +--
.../HeaderCheckingDisabled.ql | 4 +--
.../Security Features/InsecureRandomness.ql | 8 ++---
.../Security Features/InsufficientKeySize.ql | 2 +-
.../src/Security Features/PersistentCookie.ql | 4 +--
csharp/ql/src/Telemetry/DatabaseQuality.qll | 8 ++---
.../CWE-759/HashWithoutSalt.ql | 4 +--
.../assignments/AssignOperation.ql | 2 +-
.../conversion/pointer/Pointer.ql | 4 +--
.../ql/test/library-tests/csharp10/lambda.ql | 2 +-
.../test/library-tests/csharp11/operators.ql | 4 +--
.../csharp6/MemberInitializer.ql | 2 +-
csharp/ql/test/library-tests/enums/Enums11.ql | 2 +-
.../expressions/AddEventExpr1.ql | 2 +-
.../expressions/AnonymousMethod1.ql | 2 +-
.../expressions/AnonymousMethod2.ql | 2 +-
.../expressions/AnonymousMethod3.ql | 2 +-
.../expressions/AnonymousMethod4.ql | 2 +-
.../expressions/AnonymousMethod5.ql | 2 +-
.../expressions/AnonymousObjectCreation1.ql | 6 ++--
.../expressions/AnonymousObjectCreation2.ql | 6 ++--
.../expressions/AnonymousObjectCreation3.ql | 6 ++--
.../expressions/AnonymousObjectCreation4.ql | 2 +-
.../expressions/ArrayCreation1.ql | 4 +--
.../expressions/ArrayCreation10.ql | 4 +--
.../expressions/ArrayCreation2.ql | 4 +--
.../expressions/ArrayCreation3.ql | 4 +--
.../expressions/ArrayCreation4.ql | 4 +--
.../expressions/ArrayCreation5.ql | 4 +--
.../expressions/ArrayCreation6.ql | 4 +--
.../expressions/ArrayCreation7.ql | 4 +--
.../expressions/ArrayCreation8.ql | 4 +--
.../expressions/ArrayCreation9.ql | 4 +--
.../test/library-tests/expressions/Lambda1.ql | 2 +-
.../test/library-tests/expressions/Lambda2.ql | 2 +-
.../test/library-tests/expressions/Lambda3.ql | 2 +-
.../test/library-tests/expressions/Lambda4.ql | 2 +-
.../test/library-tests/expressions/Lambda5.ql | 2 +-
.../test/library-tests/expressions/Lambda6.ql | 2 +-
.../expressions/ObjectCreation10.ql | 2 +-
.../expressions/ObjectCreation11.ql | 2 +-
.../expressions/ObjectCreation4.ql | 8 ++---
.../expressions/ObjectCreation5.ql | 8 ++---
.../expressions/ObjectCreation6.ql | 8 ++---
.../expressions/ObjectCreation7.ql | 8 ++---
.../expressions/RemoveEventExpr1.ql | 2 +-
81 files changed, 216 insertions(+), 195 deletions(-)
diff --git a/csharp/ql/lib/Linq/Helpers.qll b/csharp/ql/lib/Linq/Helpers.qll
index d490868f453..912b12b9457 100644
--- a/csharp/ql/lib/Linq/Helpers.qll
+++ b/csharp/ql/lib/Linq/Helpers.qll
@@ -77,7 +77,7 @@ predicate missedAllOpportunity(ForeachStmtGenericEnumerable fes) {
// The then case of the if assigns false to something and breaks out of the loop.
exists(Assignment a, BoolLiteral bl |
a = is.getThen().getAChild*() and
- bl = a.getRValue() and
+ bl = a.getRightOperand() and
bl.toString() = "false"
) and
is.getThen().getAChild*() instanceof BreakStmt
diff --git a/csharp/ql/lib/definitions.qll b/csharp/ql/lib/definitions.qll
index 4feaf20629c..d4f2540bbef 100644
--- a/csharp/ql/lib/definitions.qll
+++ b/csharp/ql/lib/definitions.qll
@@ -96,7 +96,7 @@ private class MethodUse extends Use, QualifiableExpr {
private class AccessUse extends Access, Use {
AccessUse() {
not this.getTarget().(Parameter).getCallable() instanceof Accessor and
- not this = any(LocalVariableDeclAndInitExpr d).getLValue() and
+ not this = any(LocalVariableDeclAndInitExpr d).getLeftOperand() and
not this.isImplicit() and
not this instanceof MethodAccess and // handled by `MethodUse`
not this instanceof TypeAccess and // handled by `TypeMentionUse`
diff --git a/csharp/ql/lib/semmle/code/csharp/Assignable.qll b/csharp/ql/lib/semmle/code/csharp/Assignable.qll
index a0e575218ad..7075626aa3b 100644
--- a/csharp/ql/lib/semmle/code/csharp/Assignable.qll
+++ b/csharp/ql/lib/semmle/code/csharp/Assignable.qll
@@ -235,7 +235,7 @@ private class RefArg extends AssignableAccess {
module AssignableInternal {
private predicate tupleAssignmentDefinition(AssignExpr ae, Expr leaf) {
exists(TupleExpr te |
- ae.getLValue() = te and
+ ae.getLeftOperand() = te and
te.getAnArgument+() = leaf and
// `leaf` is either an assignable access or a local variable declaration
not leaf instanceof TupleExpr
@@ -249,8 +249,8 @@ module AssignableInternal {
*/
private predicate tupleAssignmentPair(AssignExpr ae, Expr left, Expr right) {
tupleAssignmentDefinition(ae, _) and
- left = ae.getLValue() and
- right = ae.getRValue()
+ left = ae.getLeftOperand() and
+ right = ae.getRightOperand()
or
exists(TupleExpr l, TupleExpr r, int i | tupleAssignmentPair(ae, l, r) |
left = l.getArgument(i) and
@@ -291,7 +291,7 @@ module AssignableInternal {
cached
newtype TAssignableDefinition =
TAssignmentDefinition(Assignment a) {
- not a.getLValue() instanceof TupleExpr and
+ not a.getLeftOperand() instanceof TupleExpr and
not a instanceof AssignCallOperation and
not a instanceof AssignCoalesceExpr
} or
@@ -358,7 +358,7 @@ module AssignableInternal {
// Not defined by dispatch in order to avoid too conservative negative recursion error
cached
AssignableAccess getTargetAccess(AssignableDefinition def) {
- def = TAssignmentDefinition(any(Assignment a | a.getLValue() = result))
+ def = TAssignmentDefinition(any(Assignment a | a.getLeftOperand() = result))
or
def = TTupleAssignmentDefinition(_, result)
or
@@ -381,8 +381,8 @@ module AssignableInternal {
tupleAssignmentPair(ae, ac, result)
)
or
- exists(Assignment ass | ac = ass.getLValue() |
- result = ass.getRValue() and
+ exists(Assignment ass | ac = ass.getLeftOperand() |
+ result = ass.getRightOperand() and
not ass instanceof AssignOperation
)
or
@@ -527,7 +527,7 @@ module AssignableDefinitions {
Assignment getAssignment() { result = a }
override Expr getSource() {
- result = a.getRValue() and
+ result = a.getRightOperand() and
not a instanceof AddOrRemoveEventExpr
}
diff --git a/csharp/ql/lib/semmle/code/csharp/PrintAst.qll b/csharp/ql/lib/semmle/code/csharp/PrintAst.qll
index 1ac96c85e78..1fab6b0f8c4 100644
--- a/csharp/ql/lib/semmle/code/csharp/PrintAst.qll
+++ b/csharp/ql/lib/semmle/code/csharp/PrintAst.qll
@@ -343,10 +343,10 @@ final class AssignmentNode extends ControlFlowElementNode {
result.(TypeMentionNode).getTarget() = controlFlowElement
or
childIndex = 0 and
- result.(ElementNode).getElement() = assignment.getLValue()
+ result.(ElementNode).getElement() = assignment.getLeftOperand()
or
childIndex = 1 and
- result.(ElementNode).getElement() = assignment.getRValue()
+ result.(ElementNode).getElement() = assignment.getRightOperand()
}
}
diff --git a/csharp/ql/lib/semmle/code/csharp/Property.qll b/csharp/ql/lib/semmle/code/csharp/Property.qll
index bbd4fdd9d8e..c9a338d0359 100644
--- a/csharp/ql/lib/semmle/code/csharp/Property.qll
+++ b/csharp/ql/lib/semmle/code/csharp/Property.qll
@@ -535,8 +535,8 @@ class Setter extends Accessor, @setter {
exists(AssignExpr assign |
this.getStatementBody().getNumberOfStmts() = 1 and
assign.getParent() = this.getStatementBody().getAChild() and
- assign.getLValue() = result.getAnAccess() and
- assign.getRValue() = accessToValue()
+ assign.getLeftOperand() = result.getAnAccess() and
+ assign.getRightOperand() = accessToValue()
)
}
diff --git a/csharp/ql/lib/semmle/code/csharp/controlflow/Guards.qll b/csharp/ql/lib/semmle/code/csharp/controlflow/Guards.qll
index 03a5aa7e2b7..6c1eb8c06eb 100644
--- a/csharp/ql/lib/semmle/code/csharp/controlflow/Guards.qll
+++ b/csharp/ql/lib/semmle/code/csharp/controlflow/Guards.qll
@@ -136,7 +136,7 @@ private module GuardsInput implements
IdExpr() { this instanceof AssignExpr or this instanceof CastExpr }
Expr getEqualChildExpr() {
- result = this.(AssignExpr).getRValue()
+ result = this.(AssignExpr).getRightOperand()
or
result = this.(CastExpr).getExpr()
}
@@ -836,7 +836,7 @@ module Internal {
/** Holds if expression `e2` is a `null` value whenever `e1` is. */
predicate nullValueImpliedUnary(Expr e1, Expr e2) {
- e1 = e2.(AssignExpr).getRValue()
+ e1 = e2.(AssignExpr).getRightOperand()
or
e1 = e2.(Cast).getExpr()
or
@@ -923,7 +923,7 @@ module Internal {
/** Holds if expression `e2` is a non-`null` value whenever `e1` is. */
predicate nonNullValueImpliedUnary(Expr e1, Expr e2) {
e1 = e2.(CastExpr).getExpr() or
- e1 = e2.(AssignExpr).getRValue() or
+ e1 = e2.(AssignExpr).getRightOperand() or
e1 = e2.(NullCoalescingOperation).getAnOperand()
}
diff --git a/csharp/ql/lib/semmle/code/csharp/controlflow/internal/ControlFlowGraphImpl.qll b/csharp/ql/lib/semmle/code/csharp/controlflow/internal/ControlFlowGraphImpl.qll
index e29e92d26eb..dc2c7477a35 100644
--- a/csharp/ql/lib/semmle/code/csharp/controlflow/internal/ControlFlowGraphImpl.qll
+++ b/csharp/ql/lib/semmle/code/csharp/controlflow/internal/ControlFlowGraphImpl.qll
@@ -521,7 +521,7 @@ module Expressions {
// ```
// need special treatment, because the accesses `[0]`, `[1]`, and `[2]`
// have no qualifier.
- this = any(MemberInitializer mi).getLValue()
+ this = any(MemberInitializer mi).getLeftOperand()
) and
not exists(AssignableDefinitions::OutRefDefinition def | def.getTargetAccess() = this)
}
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/Nullness.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/Nullness.qll
index a82779eaa5d..3d690ee1ac4 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/Nullness.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/Nullness.qll
@@ -31,7 +31,7 @@ private Expr maybeNullExpr(Expr reason) {
or
result instanceof AsExpr and reason = result
or
- result.(AssignExpr).getRValue() = maybeNullExpr(reason)
+ result.(AssignExpr).getRightOperand() = maybeNullExpr(reason)
or
result.(CastExpr).getExpr() = maybeNullExpr(reason)
or
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
index 109c27de67b..5554b8cdbd7 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
@@ -528,7 +528,7 @@ module LocalFlow {
e2 =
any(AssignExpr ae |
ae.getParent() = any(ControlFlowElement cfe | not cfe instanceof ExprStmt) and
- e1 = ae.getRValue()
+ e1 = ae.getRightOperand()
)
or
e1 = e2.(ObjectCreation).getInitializer()
@@ -554,7 +554,7 @@ module LocalFlow {
e2 = we
)
or
- exists(AssignExpr ae | ae.getLValue().(TupleExpr) = e2 and ae.getRValue() = e1)
+ exists(AssignExpr ae | ae.getLeftOperand().(TupleExpr) = e2 and ae.getRightOperand() = e1)
or
exists(ControlFlowElement cfe | cfe = e2.(TupleExpr).(PatternExpr).getPatternMatch() |
cfe.(IsExpr).getExpr() = e1
@@ -795,7 +795,7 @@ private predicate fieldOrPropertyStore(ContentSet c, Expr src, Expr q, boolean p
q = we and
mi = we.getInitializer().getAMemberInitializer() and
f = mi.getInitializedMember() and
- src = mi.getRValue() and
+ src = mi.getRightOperand() and
postUpdate = false
)
or
@@ -804,7 +804,7 @@ private predicate fieldOrPropertyStore(ContentSet c, Expr src, Expr q, boolean p
mi = q.(ObjectInitializer).getAMemberInitializer() and
q.getParent() instanceof ObjectCreation and
f = mi.getInitializedMember() and
- src = mi.getRValue() and
+ src = mi.getRightOperand() and
postUpdate = false
)
or
@@ -879,8 +879,8 @@ private predicate arrayStore(Expr src, Expr a, boolean postUpdate) {
// Member initializer, `new C { Array = { [i] = src } }`
exists(MemberInitializer mi |
mi = a.(ObjectInitializer).getAMemberInitializer() and
- mi.getLValue() instanceof ArrayAccess and
- mi.getRValue() = src and
+ mi.getLeftOperand() instanceof ArrayAccess and
+ mi.getRightOperand() = src and
postUpdate = false
)
}
@@ -2582,7 +2582,7 @@ module PostUpdateNodes {
call.getExpr() = init.(CollectionInitializer).getAnElementInitializer()
or
// E.g. `new Dictionary() { [0] = "a", [1] = "b" }`
- call.getExpr() = init.(ObjectInitializer).getAMemberInitializer().getLValue()
+ call.getExpr() = init.(ObjectInitializer).getAMemberInitializer().getLeftOperand()
)
}
@@ -2795,7 +2795,7 @@ predicate additionalLambdaFlowStep(Node nodeFrom, Node nodeTo, boolean preserves
preservesValue = true
or
exists(AddEventExpr aee |
- nodeFrom.asExpr() = aee.getRValue() and
+ nodeFrom.asExpr() = aee.getRightOperand() and
nodeTo.asExpr().(EventRead).getTarget() = aee.getTarget() and
preservesValue = false
)
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/SsaImpl.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/SsaImpl.qll
index 2809f8187b9..83593a5df36 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/SsaImpl.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/SsaImpl.qll
@@ -337,7 +337,7 @@ private module CallGraph {
pred = succ.(DelegateCreation).getArgument()
or
exists(AddEventExpr ae | succ.(EventAccess).getTarget() = ae.getTarget() |
- pred = ae.getRValue()
+ pred = ae.getRightOperand()
)
}
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/RangeUtils.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/RangeUtils.qll
index 46153f18dae..171f2d2f59e 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/RangeUtils.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/RangeUtils.qll
@@ -21,7 +21,7 @@ private module Impl {
/** Holds if SSA definition `def` equals `e + delta`. */
predicate ssaUpdateStep(ExplicitDefinition def, ExprNode e, int delta) {
exists(ControlFlow::Node cfn | cfn = def.getControlFlowNode() |
- e = cfn.(ExprNode::Assignment).getRValue() and
+ e = cfn.(ExprNode::Assignment).getRightOperand() and
delta = 0 and
not cfn instanceof ExprNode::AssignOperation
or
@@ -39,7 +39,7 @@ private module Impl {
/** Holds if `e1 + delta` equals `e2`. */
predicate valueFlowStep(ExprNode e2, ExprNode e1, int delta) {
- e2.(ExprNode::AssignExpr).getRValue() = e1 and delta = 0
+ e2.(ExprNode::AssignExpr).getRightOperand() = e1 and delta = 0
or
e2.(ExprNode::UnaryPlusExpr).getOperand() = e1 and delta = 0
or
@@ -207,13 +207,13 @@ module ExprNode {
override CS::Assignment e;
/** Gets the left operand of this assignment. */
- ExprNode getLValue() {
- result = unique(ExprNode res | hasChild(e, e.getLValue(), this, res) | res)
+ ExprNode getLeftOperand() {
+ result = unique(ExprNode res | hasChild(e, e.getLeftOperand(), this, res) | res)
}
/** Gets the right operand of this assignment. */
- ExprNode getRValue() {
- result = unique(ExprNode res | hasChild(e, e.getRValue(), this, res) | res)
+ ExprNode getRightOperand() {
+ result = unique(ExprNode res | hasChild(e, e.getRightOperand(), this, res) | res)
}
}
@@ -225,6 +225,10 @@ module ExprNode {
/** A compound assignment operation. */
class AssignOperation extends Assignment, BinaryOperation {
override CS::AssignOperation e;
+
+ override ExprNode getLeftOperand() { result = Assignment.super.getLeftOperand() }
+
+ override ExprNode getRightOperand() { result = Assignment.super.getRightOperand() }
}
/** A unary operation. */
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/SignAnalysisSpecific.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/SignAnalysisSpecific.qll
index d59d7958765..f64eceda134 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/SignAnalysisSpecific.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/SignAnalysisSpecific.qll
@@ -168,7 +168,7 @@ private module Impl {
/** Returned an expression that is assigned to `f`. */
ExprNode getAssignedValueToField(Field f) {
result.getExpr() in [
- f.getAnAssignedValue(), any(AssignOperation a | a.getLValue() = f.getAnAccess())
+ f.getAnAssignedValue(), any(AssignOperation a | a.getLeftOperand() = f.getAnAccess())
]
}
@@ -231,7 +231,7 @@ private module Impl {
/** Returns a sub expression of `e` for expression types where the sign depends on the child. */
ExprNode getASubExprWithSameSign(ExprNode e) {
exists(Expr e_, Expr child | hasChild(e_, child, e, result) |
- child = e_.(AssignExpr).getRValue() or
+ child = e_.(AssignExpr).getRightOperand() or
child = e_.(UnaryPlusExpr).getOperand() or
child = e_.(PostIncrExpr).getOperand() or
child = e_.(PostDecrExpr).getOperand() or
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/SsaUtils.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/SsaUtils.qll
index 89117d90ba7..cf4b44239e9 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/SsaUtils.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/SsaUtils.qll
@@ -55,5 +55,5 @@ ExprNode ssaRead(Definition v, int delta) {
or
v.(ExplicitDefinition).getControlFlowNode().(ExprNode::Assignment) = result and delta = 0
or
- result.(ExprNode::AssignExpr).getRValue() = ssaRead(v, delta)
+ result.(ExprNode::AssignExpr).getRightOperand() = ssaRead(v, delta)
}
diff --git a/csharp/ql/lib/semmle/code/csharp/dispatch/Dispatch.qll b/csharp/ql/lib/semmle/code/csharp/dispatch/Dispatch.qll
index f7f6c7a50be..770fab65f54 100644
--- a/csharp/ql/lib/semmle/code/csharp/dispatch/Dispatch.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dispatch/Dispatch.qll
@@ -1348,7 +1348,7 @@ private module Internal {
any(DynamicMemberAccess dma | this = TDispatchDynamicEventAccess(_, dma, _)).getQualifier()
}
- override Expr getArgument(int i) { i = 0 and result = this.getCall().getRValue() }
+ override Expr getArgument(int i) { i = 0 and result = this.getCall().getRightOperand() }
}
/** A call to a constructor using dynamic types. */
diff --git a/csharp/ql/lib/semmle/code/csharp/exprs/Access.qll b/csharp/ql/lib/semmle/code/csharp/exprs/Access.qll
index 84375bc7013..d9fb16f0974 100644
--- a/csharp/ql/lib/semmle/code/csharp/exprs/Access.qll
+++ b/csharp/ql/lib/semmle/code/csharp/exprs/Access.qll
@@ -112,7 +112,7 @@ class BaseAccess extends Access, @base_access_expr {
class MemberAccess extends Access, QualifiableExpr, @member_access_expr {
override predicate hasImplicitThisQualifier() {
QualifiableExpr.super.hasImplicitThisQualifier() and
- not exists(MemberInitializer mi | mi.getLValue() = this)
+ not exists(MemberInitializer mi | mi.getLeftOperand() = this)
}
override Member getQualifiedDeclaration() { result = this.getTarget() }
diff --git a/csharp/ql/lib/semmle/code/csharp/exprs/Assignment.qll b/csharp/ql/lib/semmle/code/csharp/exprs/Assignment.qll
index 467149011d2..8c7dd80da24 100644
--- a/csharp/ql/lib/semmle/code/csharp/exprs/Assignment.qll
+++ b/csharp/ql/lib/semmle/code/csharp/exprs/Assignment.qll
@@ -20,14 +20,22 @@ class Assignment extends BinaryOperation, @assign_expr {
expr_parent(_, 1, this)
}
- /** Gets the left operand of this assignment. */
- Expr getLValue() { result = this.getLeftOperand() }
+ /**
+ * DEPRECATED: Use `getLeftOperand` instead.
+ *
+ * Gets the left operand of this assignment.
+ */
+ deprecated Expr getLValue() { result = this.getLeftOperand() }
- /** Gets the right operand of this assignment. */
- Expr getRValue() { result = this.getRightOperand() }
+ /**
+ * DEPRECATED: Use `getRightOperand` instead.
+ *
+ * Gets the right operand of this assignment.
+ */
+ deprecated Expr getRValue() { result = this.getRightOperand() }
/** Gets the variable being assigned to, if any. */
- Variable getTargetVariable() { result.getAnAccess() = this.getLValue() }
+ Variable getTargetVariable() { result.getAnAccess() = this.getLeftOperand() }
override string getOperator() { none() }
}
@@ -40,7 +48,12 @@ class LocalVariableDeclAndInitExpr extends LocalVariableDeclExpr, Assignment {
override LocalVariable getTargetVariable() { result = this.getVariable() }
- override LocalVariableAccess getLValue() { result = Assignment.super.getLValue() }
+ /**
+ * DEPRECATED: Use `getLeftOperand` instead.
+ */
+ deprecated override LocalVariableAccess getLValue() { result = this.getLeftOperand() }
+
+ override LocalVariableAccess getLeftOperand() { result = Assignment.super.getLeftOperand() }
override string toString() { result = LocalVariableDeclExpr.super.toString() + " = ..." }
@@ -223,9 +236,12 @@ deprecated class AssignUnsighedRightShiftExpr = AssignUnsignedRightShiftExpr;
*/
class AddOrRemoveEventExpr extends AssignOperation, @assign_event_expr {
/** Gets the event targeted by this event assignment. */
- Event getTarget() { result = this.getLValue().getTarget() }
+ Event getTarget() { result = this.getLeftOperand().getTarget() }
- override EventAccess getLValue() { result = this.getChild(0) }
+ /**
+ * DEPRECATED: Use `getLeftOperand` instead.
+ */
+ deprecated override EventAccess getLValue() { result = this.getLeftOperand() }
override EventAccess getLeftOperand() { result = this.getChild(0) }
}
diff --git a/csharp/ql/lib/semmle/code/csharp/exprs/Call.qll b/csharp/ql/lib/semmle/code/csharp/exprs/Call.qll
index 0d9e414a5c4..272a8e0caae 100644
--- a/csharp/ql/lib/semmle/code/csharp/exprs/Call.qll
+++ b/csharp/ql/lib/semmle/code/csharp/exprs/Call.qll
@@ -773,7 +773,7 @@ class EventCall extends AccessorCall, EventAccessExpr {
override EventAccessor getTarget() {
exists(Event e, AddOrRemoveEventExpr aoree |
e = this.getEvent() and
- aoree.getLValue() = this
+ aoree.getLeftOperand() = this
|
aoree instanceof AddEventExpr and result = e.getAddEventAccessor()
or
@@ -784,8 +784,8 @@ class EventCall extends AccessorCall, EventAccessExpr {
override Expr getArgument(int i) {
i = 0 and
exists(AddOrRemoveEventExpr aoree |
- aoree.getLValue() = this and
- result = aoree.getRValue()
+ aoree.getLeftOperand() = this and
+ result = aoree.getRightOperand()
)
}
diff --git a/csharp/ql/lib/semmle/code/csharp/exprs/Creation.qll b/csharp/ql/lib/semmle/code/csharp/exprs/Creation.qll
index 0e16e0da9c3..19ff9fac53b 100644
--- a/csharp/ql/lib/semmle/code/csharp/exprs/Creation.qll
+++ b/csharp/ql/lib/semmle/code/csharp/exprs/Creation.qll
@@ -95,7 +95,7 @@ class MemberInitializer extends AssignExpr {
MemberInitializer() { this.getParent() instanceof ObjectInitializer }
/** Gets the initialized member. */
- Member getInitializedMember() { result.getAnAccess() = this.getLValue() }
+ Member getInitializedMember() { result.getAnAccess() = this.getLeftOperand() }
override string getAPrimaryQlClass() { result = "MemberInitializer" }
}
diff --git a/csharp/ql/lib/semmle/code/csharp/exprs/Expr.qll b/csharp/ql/lib/semmle/code/csharp/exprs/Expr.qll
index 66764d06479..36eda82531c 100644
--- a/csharp/ql/lib/semmle/code/csharp/exprs/Expr.qll
+++ b/csharp/ql/lib/semmle/code/csharp/exprs/Expr.qll
@@ -1099,7 +1099,7 @@ class QualifiableExpr extends Expr, @qualifiable_expr {
}
private Expr getAnAssignOrForeachChild() {
- result = any(AssignExpr e).getLValue()
+ result = any(AssignExpr e).getLeftOperand()
or
result = any(ForeachStmt fs).getVariableDeclTuple()
or
diff --git a/csharp/ql/lib/semmle/code/csharp/frameworks/Moq.qll b/csharp/ql/lib/semmle/code/csharp/frameworks/Moq.qll
index 9ab9a026fd2..0beec9a84b2 100644
--- a/csharp/ql/lib/semmle/code/csharp/frameworks/Moq.qll
+++ b/csharp/ql/lib/semmle/code/csharp/frameworks/Moq.qll
@@ -41,6 +41,6 @@ class ReturnedByMockObject extends ObjectCreation {
* Gets a value used to initialize a member of this object creation.
*/
Expr getAMemberInitializationValue() {
- result = this.getInitializer().(ObjectInitializer).getAMemberInitializer().getRValue()
+ result = this.getInitializer().(ObjectInitializer).getAMemberInitializer().getRightOperand()
}
}
diff --git a/csharp/ql/lib/semmle/code/csharp/frameworks/Sql.qll b/csharp/ql/lib/semmle/code/csharp/frameworks/Sql.qll
index 6b1eb7b67fb..58d6d68bf0e 100644
--- a/csharp/ql/lib/semmle/code/csharp/frameworks/Sql.qll
+++ b/csharp/ql/lib/semmle/code/csharp/frameworks/Sql.qll
@@ -17,14 +17,14 @@ abstract class SqlExpr extends Expr {
class CommandTextAssignmentSqlExpr extends SqlExpr, AssignExpr {
CommandTextAssignmentSqlExpr() {
exists(Property p, SystemDataIDbCommandInterface i, Property text |
- p = this.getLValue().(PropertyAccess).getTarget() and
+ p = this.getLeftOperand().(PropertyAccess).getTarget() and
text = i.getCommandTextProperty()
|
p.overridesOrImplementsOrEquals(text)
)
}
- override Expr getSql() { result = this.getRValue() }
+ override Expr getSql() { result = this.getRightOperand() }
}
/** A construction of an unknown `IDbCommand` object. */
diff --git a/csharp/ql/lib/semmle/code/csharp/security/auth/SecureCookies.qll b/csharp/ql/lib/semmle/code/csharp/security/auth/SecureCookies.qll
index 56b6294949b..e7cb6d8e308 100644
--- a/csharp/ql/lib/semmle/code/csharp/security/auth/SecureCookies.qll
+++ b/csharp/ql/lib/semmle/code/csharp/security/auth/SecureCookies.qll
@@ -100,20 +100,20 @@ Expr getAValueForCookiePolicyProp(string prop) {
Expr getAValueForProp(ObjectCreation create, Assignment a, string prop) {
// values set in object init
exists(MemberInitializer init, Expr src, PropertyAccess pa |
- a.getLValue() = pa and
+ a.getLeftOperand() = pa and
pa.getTarget().hasName(prop) and
init = create.getInitializer().(ObjectInitializer).getAMemberInitializer() and
- init.getLValue() = pa and
- DataFlow::localExprFlow(src, init.getRValue()) and
+ init.getLeftOperand() = pa and
+ DataFlow::localExprFlow(src, init.getRightOperand()) and
result = src
)
or
// values set on var that create is assigned to
exists(Expr src, PropertyAccess pa |
- a.getLValue() = pa and
+ a.getLeftOperand() = pa and
pa.getTarget().hasName(prop) and
DataFlow::localExprFlow(create, pa.getQualifier()) and
- DataFlow::localExprFlow(src, a.getRValue()) and
+ DataFlow::localExprFlow(src, a.getRightOperand()) and
result = src
)
}
@@ -138,15 +138,15 @@ private module OnAppendCookieTrackingConfig impl
exists(PropertyWrite pw, Assignment delegateAssign, Callable c |
pw.getProperty().getName() = "OnAppendCookie" and
pw.getProperty().getDeclaringType() instanceof MicrosoftAspNetCoreBuilderCookiePolicyOptions and
- delegateAssign.getLValue() = pw and
+ delegateAssign.getLeftOperand() = pw and
(
exists(LambdaExpr lambda |
- delegateAssign.getRValue() = lambda and
+ delegateAssign.getRightOperand() = lambda and
lambda = c
)
or
exists(DelegateCreation delegate |
- delegateAssign.getRValue() = delegate and
+ delegateAssign.getRightOperand() = delegate and
delegate.getArgument().(CallableAccess).getTarget() = c
)
) and
@@ -159,9 +159,9 @@ private module OnAppendCookieTrackingConfig impl
exists(PropertyWrite pw, Assignment a |
pw.getProperty().getDeclaringType() instanceof MicrosoftAspNetCoreHttpCookieOptions and
pw.getProperty().getName() = getPropertyName() and
- a.getLValue() = pw and
+ a.getLeftOperand() = pw and
exists(Expr val |
- DataFlow::localExprFlow(val, a.getRValue()) and
+ DataFlow::localExprFlow(val, a.getRightOperand()) and
val.getValue() = "true"
) and
sink.asExpr() = pw.getQualifier()
diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/UnsafeDeserializationQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/UnsafeDeserializationQuery.qll
index 5b2bd407a5c..3c8911ef807 100644
--- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/UnsafeDeserializationQuery.qll
+++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/UnsafeDeserializationQuery.qll
@@ -126,16 +126,16 @@ private module TypeNameTrackingConfig implements DataFlow::ConfigSig {
or
node1.getType() instanceof TypeNameHandlingEnum and
exists(PropertyWrite pw, Property p, Assignment a |
- a.getLValue() = pw and
+ a.getLeftOperand() = pw and
pw.getProperty() = p and
p.getDeclaringType() instanceof JsonSerializerSettingsClass and
p.hasName("TypeNameHandling") and
(
- node1.asExpr() = a.getRValue() and
+ node1.asExpr() = a.getRightOperand() and
node2.asExpr() = pw.getQualifier()
or
exists(ObjectInitializer oi |
- node1.asExpr() = oi.getAMemberInitializer().getRValue() and
+ node1.asExpr() = oi.getAMemberInitializer().getRightOperand() and
node2.asExpr() = oi
)
)
diff --git a/csharp/ql/lib/semmle/code/csharp/security/xml/InsecureXMLQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/xml/InsecureXMLQuery.qll
index 1abeaf797b0..765dc2adf54 100644
--- a/csharp/ql/lib/semmle/code/csharp/security/xml/InsecureXMLQuery.qll
+++ b/csharp/ql/lib/semmle/code/csharp/security/xml/InsecureXMLQuery.qll
@@ -84,15 +84,15 @@ private Expr getAValueForProp(ObjectCreation create, string prop) {
// values set in object init
exists(MemberInitializer init |
init = create.getInitializer().(ObjectInitializer).getAMemberInitializer() and
- init.getLValue().(PropertyAccess).getTarget().hasName(prop) and
- result = init.getRValue()
+ init.getLeftOperand().(PropertyAccess).getTarget().hasName(prop) and
+ result = init.getRightOperand()
)
or
// values set on var that create is assigned to
exists(Assignment propAssign |
- DataFlow::localExprFlow(create, propAssign.getLValue().(PropertyAccess).getQualifier()) and
- propAssign.getLValue().(PropertyAccess).getTarget().hasName(prop) and
- result = propAssign.getRValue()
+ DataFlow::localExprFlow(create, propAssign.getLeftOperand().(PropertyAccess).getQualifier()) and
+ propAssign.getLeftOperand().(PropertyAccess).getTarget().hasName(prop) and
+ result = propAssign.getRightOperand()
)
}
diff --git a/csharp/ql/src/Dead Code/NonAssignedFields.ql b/csharp/ql/src/Dead Code/NonAssignedFields.ql
index 83aa889b77c..b9e86809749 100644
--- a/csharp/ql/src/Dead Code/NonAssignedFields.ql
+++ b/csharp/ql/src/Dead Code/NonAssignedFields.ql
@@ -84,9 +84,9 @@ where
not f.getDeclaringType() instanceof Enum and
not f.getType() instanceof Struct and
not exists(Assignment ae, Field g |
- ae.getLValue().(FieldAccess).getTarget() = g and
+ ae.getLeftOperand().(FieldAccess).getTarget() = g and
g.getUnboundDeclaration() = f and
- not ae.getRValue() instanceof NullLiteral
+ not ae.getRightOperand() instanceof NullLiteral
) and
not exists(MethodCall mc, int i, Field g |
exists(Parameter p | mc.getTarget().getParameter(i) = p | p.isOut() or p.isRef()) and
@@ -101,7 +101,7 @@ where
not init instanceof NullLiteral
) and
not exists(AssignOperation ua, Field g |
- ua.getLValue().(FieldAccess).getTarget() = g and
+ ua.getLeftOperand().(FieldAccess).getTarget() = g and
g.getUnboundDeclaration() = f
) and
not exists(MutatorOperation op |
diff --git a/csharp/ql/src/Language Abuse/ForeachCapture.ql b/csharp/ql/src/Language Abuse/ForeachCapture.ql
index 03f1f99a044..2ed24b42eba 100644
--- a/csharp/ql/src/Language Abuse/ForeachCapture.ql
+++ b/csharp/ql/src/Language Abuse/ForeachCapture.ql
@@ -60,16 +60,16 @@ module LambdaDataFlow {
}
Element getAssignmentTarget(Expr e) {
- exists(Assignment a | a.getRValue() = e |
- result = a.getLValue().(PropertyAccess).getTarget() or
- result = a.getLValue().(FieldAccess).getTarget() or
- result = a.getLValue().(LocalVariableAccess).getTarget() or
- result = a.getLValue().(EventAccess).getTarget()
+ exists(Assignment a | a.getRightOperand() = e |
+ result = a.getLeftOperand().(PropertyAccess).getTarget() or
+ result = a.getLeftOperand().(FieldAccess).getTarget() or
+ result = a.getLeftOperand().(LocalVariableAccess).getTarget() or
+ result = a.getLeftOperand().(EventAccess).getTarget()
)
or
exists(AddEventExpr aee |
- e = aee.getRValue() and
- result = aee.getLValue().getTarget()
+ e = aee.getRightOperand() and
+ result = aee.getLeftOperand().getTarget()
)
or
result = getCollectionAssignmentTarget(e)
@@ -97,8 +97,8 @@ Element getCollectionAssignmentTarget(Expr e) {
// Store values using indexer
exists(IndexerAccess ia, AssignExpr ae |
ia.getQualifier() = result.(Variable).getAnAccess() and
- ia = ae.getLValue() and
- e = ae.getRValue()
+ ia = ae.getLeftOperand() and
+ e = ae.getRightOperand()
)
}
diff --git a/csharp/ql/src/Language Abuse/MissedTernaryOpportunity.ql b/csharp/ql/src/Language Abuse/MissedTernaryOpportunity.ql
index bd7492b8583..01d6baa9573 100644
--- a/csharp/ql/src/Language Abuse/MissedTernaryOpportunity.ql
+++ b/csharp/ql/src/Language Abuse/MissedTernaryOpportunity.ql
@@ -15,7 +15,7 @@ import csharp
import semmle.code.csharp.commons.StructuralComparison
private Expr getAssignedExpr(Stmt stmt) {
- result = stmt.stripSingletonBlocks().(ExprStmt).getExpr().(AssignExpr).getLValue()
+ result = stmt.stripSingletonBlocks().(ExprStmt).getExpr().(AssignExpr).getLeftOperand()
}
from IfStmt is, string what
diff --git a/csharp/ql/src/Likely Bugs/Collections/WriteOnlyContainer.ql b/csharp/ql/src/Likely Bugs/Collections/WriteOnlyContainer.ql
index 5fcb140e679..046099213cc 100644
--- a/csharp/ql/src/Likely Bugs/Collections/WriteOnlyContainer.ql
+++ b/csharp/ql/src/Likely Bugs/Collections/WriteOnlyContainer.ql
@@ -23,9 +23,10 @@ where
) and
forex(Access a | a = v.getAnAccess() |
a = any(ModifierMethodCall m).getQualifier() or
- a = any(AssignExpr ass | ass.getRValue() instanceof ObjectCreation).getLValue() or
+ a = any(AssignExpr ass | ass.getRightOperand() instanceof ObjectCreation).getLeftOperand() or
a =
- any(LocalVariableDeclAndInitExpr ass | ass.getRValue() instanceof ObjectCreation).getLValue()
+ any(LocalVariableDeclAndInitExpr ass | ass.getRightOperand() instanceof ObjectCreation)
+ .getLeftOperand()
) and
not v = any(ForeachStmt fs).getVariable() and
not v = any(BindingPatternExpr vpe).getVariableDeclExpr().getVariable() and
diff --git a/csharp/ql/src/Likely Bugs/SelfAssignment.ql b/csharp/ql/src/Likely Bugs/SelfAssignment.ql
index f01a1378242..6e51b87a779 100644
--- a/csharp/ql/src/Likely Bugs/SelfAssignment.ql
+++ b/csharp/ql/src/Likely Bugs/SelfAssignment.ql
@@ -19,7 +19,7 @@ private predicate candidate(AssignExpr ae) {
not ae instanceof MemberInitializer and
// Enum field initializers are never self assignments. `enum E { A = 42 }`
not ae.getParent().(Field).getDeclaringType() instanceof Enum and
- forall(Expr e | e = ae.getLValue().getAChildExpr*() |
+ forall(Expr e | e = ae.getLeftOperand().getAChildExpr*() |
// Non-trivial property accesses may have side-effects,
// so these are not considered
e instanceof PropertyAccess implies e instanceof TrivialPropertyAccess
@@ -28,7 +28,7 @@ private predicate candidate(AssignExpr ae) {
private predicate selfAssignExpr(AssignExpr ae) {
candidate(ae) and
- sameGvn(ae.getLValue(), ae.getRValue())
+ sameGvn(ae.getLeftOperand(), ae.getRightOperand())
}
private Declaration getDeclaration(Expr e) {
@@ -40,5 +40,5 @@ private Declaration getDeclaration(Expr e) {
}
from AssignExpr ae, Declaration target
-where selfAssignExpr(ae) and target = getDeclaration(ae.getLValue())
+where selfAssignExpr(ae) and target = getDeclaration(ae.getLeftOperand())
select ae, "This assignment assigns $@ to itself.", target, target.getName()
diff --git a/csharp/ql/src/Linq/BadMultipleIteration.ql b/csharp/ql/src/Linq/BadMultipleIteration.ql
index 8146bbf167d..0f9e335e225 100644
--- a/csharp/ql/src/Linq/BadMultipleIteration.ql
+++ b/csharp/ql/src/Linq/BadMultipleIteration.ql
@@ -50,7 +50,7 @@ predicate potentiallyConsumingAccess(VariableAccess va) {
Expr sequenceSource(IEnumerableSequence seq) {
result = seq.getInitializer()
or
- exists(Assignment a | a.getLValue() = seq.getAnAccess() and result = a.getRValue())
+ exists(Assignment a | a.getLeftOperand() = seq.getAnAccess() and result = a.getRightOperand())
}
from IEnumerableSequence seq, VariableAccess va
diff --git a/csharp/ql/src/Performance/StringConcatenationInLoop.ql b/csharp/ql/src/Performance/StringConcatenationInLoop.ql
index 3b3228588a4..d27b99e7bdd 100644
--- a/csharp/ql/src/Performance/StringConcatenationInLoop.ql
+++ b/csharp/ql/src/Performance/StringConcatenationInLoop.ql
@@ -24,7 +24,7 @@ class StringCat extends AddExpr {
*/
predicate isSelfConcatAssignExpr(AssignExpr e, Variable v) {
exists(VariableAccess use |
- stringCatContains(e.getRValue(), use) and
+ stringCatContains(e.getRightOperand(), use) and
use.getTarget() = e.getTargetVariable() and
v = use.getTarget()
)
@@ -41,7 +41,7 @@ predicate stringCatContains(StringCat expr, Expr child) {
* where `v` is a simple variable (and not, for example, a property).
*/
predicate isConcatExpr(AssignAddExpr e, Variable v) {
- e.getLValue().getType() instanceof StringType and
+ e.getLeftOperand().getType() instanceof StringType and
v = e.getTargetVariable()
}
diff --git a/csharp/ql/src/Security Features/CWE-1004/CookieWithoutHttpOnly.ql b/csharp/ql/src/Security Features/CWE-1004/CookieWithoutHttpOnly.ql
index dcc520540bb..f72de01b5db 100644
--- a/csharp/ql/src/Security Features/CWE-1004/CookieWithoutHttpOnly.ql
+++ b/csharp/ql/src/Security Features/CWE-1004/CookieWithoutHttpOnly.ql
@@ -27,8 +27,8 @@ predicate cookieAppendHttpOnlyByDefault() {
predicate httpOnlyFalse(ObjectCreation oc) {
exists(Assignment a |
- getAValueForProp(oc, a, "HttpOnly") = a.getRValue() and
- a.getRValue().getValue() = "false"
+ getAValueForProp(oc, a, "HttpOnly") = a.getRightOperand() and
+ a.getRightOperand().getValue() = "false"
)
}
@@ -100,8 +100,8 @@ predicate nonHttpOnlyCookieBuilderAssignment(Assignment a, Expr val) {
MicrosoftAspNetCoreAuthenticationCookiesCookieAuthenticationOptions
) and
pw.getProperty().getName() = "HttpOnly" and
- a.getLValue() = pw and
- DataFlow::localExprFlow(val, a.getRValue())
+ a.getLeftOperand() = pw and
+ DataFlow::localExprFlow(val, a.getRightOperand())
)
}
@@ -111,7 +111,7 @@ where
nonHttpOnlyCookieCall(httpOnlySink)
or
exists(Assignment a |
- httpOnlySink = a.getRValue() and
+ httpOnlySink = a.getRightOperand() and
nonHttpOnlyCookieBuilderAssignment(a, _)
)
)
diff --git a/csharp/ql/src/Security Features/CWE-327/InsecureSQLConnection.ql b/csharp/ql/src/Security Features/CWE-327/InsecureSQLConnection.ql
index 330ad1c1c32..a1dd249faba 100644
--- a/csharp/ql/src/Security Features/CWE-327/InsecureSQLConnection.ql
+++ b/csharp/ql/src/Security Features/CWE-327/InsecureSQLConnection.ql
@@ -35,8 +35,8 @@ module InsecureSqlConnectionConfig implements DataFlow::ConfigSig {
) and
not exists(MemberInitializer mi |
mi = oc.getInitializer().(ObjectInitializer).getAMemberInitializer() and
- mi.getLValue().(PropertyAccess).getTarget().getName() = "Encrypt" and
- mi.getRValue().(BoolLiteral).getValue() = "true"
+ mi.getLeftOperand().(PropertyAccess).getTarget().getName() = "Encrypt" and
+ mi.getRightOperand().(BoolLiteral).getValue() = "true"
)
)
}
diff --git a/csharp/ql/src/Security Features/CWE-614/CookieWithoutSecure.ql b/csharp/ql/src/Security Features/CWE-614/CookieWithoutSecure.ql
index ce1f75d627c..1149b4bcad2 100644
--- a/csharp/ql/src/Security Features/CWE-614/CookieWithoutSecure.ql
+++ b/csharp/ql/src/Security Features/CWE-614/CookieWithoutSecure.ql
@@ -31,8 +31,8 @@ predicate cookieAppendSecureByDefault() {
predicate secureFalse(ObjectCreation oc) {
exists(Assignment a |
- getAValueForProp(oc, a, "Secure") = a.getRValue() and
- a.getRValue().getValue() = "false"
+ getAValueForProp(oc, a, "Secure") = a.getRightOperand() and
+ a.getRightOperand().getValue() = "false"
)
}
@@ -96,8 +96,8 @@ predicate insecureSecurePolicyAssignment(Assignment a, Expr val) {
MicrosoftAspNetCoreAuthenticationCookiesCookieAuthenticationOptions
) and
pw.getProperty().getName() = "SecurePolicy" and
- a.getLValue() = pw and
- DataFlow::localExprFlow(val, a.getRValue()) and
+ a.getLeftOperand() = pw and
+ DataFlow::localExprFlow(val, a.getRightOperand()) and
val.getValue() = "2" // None
)
}
@@ -107,7 +107,7 @@ where
insecureCookieCall(secureSink)
or
exists(Assignment a |
- secureSink = a.getRValue() and
+ secureSink = a.getRightOperand() and
insecureSecurePolicyAssignment(a, _)
)
select secureSink, "Cookie attribute 'Secure' is not set to true."
diff --git a/csharp/ql/src/Security Features/CookieWithOverlyBroadDomain.ql b/csharp/ql/src/Security Features/CookieWithOverlyBroadDomain.ql
index 9c6e6935186..59a6340104a 100644
--- a/csharp/ql/src/Security Features/CookieWithOverlyBroadDomain.ql
+++ b/csharp/ql/src/Security Features/CookieWithOverlyBroadDomain.ql
@@ -14,11 +14,11 @@ import csharp
from Assignment a, PropertyAccess pa
where
- a.getLValue() = pa and
+ a.getLeftOperand() = pa and
pa.getTarget().hasName("Domain") and
pa.getTarget().getDeclaringType().hasFullyQualifiedName("System.Web", "HttpCookie") and
(
- a.getRValue().getValue().regexpReplaceAll("[^.]", "").length() < 2 or
- a.getRValue().getValue().matches(".%")
+ a.getRightOperand().getValue().regexpReplaceAll("[^.]", "").length() < 2 or
+ a.getRightOperand().getValue().matches(".%")
)
select a, "Overly broad domain for cookie."
diff --git a/csharp/ql/src/Security Features/CookieWithOverlyBroadPath.ql b/csharp/ql/src/Security Features/CookieWithOverlyBroadPath.ql
index 6690cac47d2..d659f7c8dc5 100644
--- a/csharp/ql/src/Security Features/CookieWithOverlyBroadPath.ql
+++ b/csharp/ql/src/Security Features/CookieWithOverlyBroadPath.ql
@@ -14,8 +14,8 @@ import csharp
from Assignment a, PropertyAccess pa
where
- a.getLValue() = pa and
+ a.getLeftOperand() = pa and
pa.getTarget().hasName("Path") and
pa.getTarget().getDeclaringType().hasFullyQualifiedName("System.Web", "HttpCookie") and
- a.getRValue().getValue() = "/"
+ a.getRightOperand().getValue() = "/"
select a, "Overly broad path for cookie."
diff --git a/csharp/ql/src/Security Features/HeaderCheckingDisabled.ql b/csharp/ql/src/Security Features/HeaderCheckingDisabled.ql
index 7a3a5fdc4f2..bc9bf289c2d 100644
--- a/csharp/ql/src/Security Features/HeaderCheckingDisabled.ql
+++ b/csharp/ql/src/Security Features/HeaderCheckingDisabled.ql
@@ -17,12 +17,12 @@ from Element l
where
// header checking is disabled programmatically in the code
exists(Assignment a, PropertyAccess pa |
- a.getLValue() = pa and
+ a.getLeftOperand() = pa and
pa.getTarget().hasName("EnableHeaderChecking") and
pa.getTarget()
.getDeclaringType()
.hasFullyQualifiedName("System.Web.Configuration", "HttpRuntimeSection") and
- a.getRValue().getValue() = "false" and
+ a.getRightOperand().getValue() = "false" and
a = l
)
or
diff --git a/csharp/ql/src/Security Features/InsecureRandomness.ql b/csharp/ql/src/Security Features/InsecureRandomness.ql
index 8237afdff13..649969a2778 100644
--- a/csharp/ql/src/Security Features/InsecureRandomness.ql
+++ b/csharp/ql/src/Security Features/InsecureRandomness.ql
@@ -89,10 +89,10 @@ module Random {
e = any(SensitiveLibraryParameter v).getAnAssignedArgument()
or
// Assignment operation, e.g. += or similar
- exists(AssignOperation ao | ao.getRValue() = e |
- ao.getLValue() = any(SensitiveVariable v).getAnAccess() or
- ao.getLValue() = any(SensitiveProperty v).getAnAccess() or
- ao.getLValue() = any(SensitiveLibraryParameter v).getAnAccess()
+ exists(AssignOperation ao | ao.getRightOperand() = e |
+ ao.getLeftOperand() = any(SensitiveVariable v).getAnAccess() or
+ ao.getLeftOperand() = any(SensitiveProperty v).getAnAccess() or
+ ao.getLeftOperand() = any(SensitiveLibraryParameter v).getAnAccess()
)
)
}
diff --git a/csharp/ql/src/Security Features/InsufficientKeySize.ql b/csharp/ql/src/Security Features/InsufficientKeySize.ql
index 94ae6b9286f..02be9125835 100644
--- a/csharp/ql/src/Security Features/InsufficientKeySize.ql
+++ b/csharp/ql/src/Security Features/InsufficientKeySize.ql
@@ -20,7 +20,7 @@ predicate incorrectUseOfRC2(Assignment e, string msg) {
.getDeclaringType()
.hasFullyQualifiedName("System.Security.Cryptography", "RC2CryptoServiceProvider")
) and
- e.getRValue().getValue().toInt() < 128 and
+ e.getRightOperand().getValue().toInt() < 128 and
msg = "Key size should be at least 128 bits for RC2 encryption."
}
diff --git a/csharp/ql/src/Security Features/PersistentCookie.ql b/csharp/ql/src/Security Features/PersistentCookie.ql
index 7f9861213fc..edc97b464e5 100644
--- a/csharp/ql/src/Security Features/PersistentCookie.ql
+++ b/csharp/ql/src/Security Features/PersistentCookie.ql
@@ -52,8 +52,8 @@ class FutureDateExpr extends MethodCall {
from Assignment a, PropertyAccess pa, FutureDateExpr fde
where
- a.getLValue() = pa and
- a.getRValue() = fde and
+ a.getLeftOperand() = pa and
+ a.getRightOperand() = fde and
pa.getTarget().hasName("Expires") and
pa.getTarget().getDeclaringType().hasFullyQualifiedName("System.Web", "HttpCookie") and
(fde.timeIsNotClear() or fde.getTimeInSecond() > 300) // 5 minutes max
diff --git a/csharp/ql/src/Telemetry/DatabaseQuality.qll b/csharp/ql/src/Telemetry/DatabaseQuality.qll
index ca2ab3e7e16..ad7ac682bf5 100644
--- a/csharp/ql/src/Telemetry/DatabaseQuality.qll
+++ b/csharp/ql/src/Telemetry/DatabaseQuality.qll
@@ -27,7 +27,7 @@ module CallTargetStats implements StatsSig {
p = c.getProperty() and
not p.getAnAccessor() instanceof Setter and
assign = c.getParent() and
- assign.getLValue() = c and
+ assign.getLeftOperand() = c and
assign.getParent() instanceof Property
)
}
@@ -36,7 +36,7 @@ module CallTargetStats implements StatsSig {
exists(Property p, AssignExpr assign |
p = c.getProperty() and
assign = c.getParent() and
- assign.getLValue() = c and
+ assign.getLeftOperand() = c and
assign.getParent() instanceof ObjectInitializer and
assign.getParent().getParent() instanceof AnonymousObjectCreation
)
@@ -46,8 +46,8 @@ module CallTargetStats implements StatsSig {
exists(Property p, AssignExpr assign |
p = c.getProperty() and
assign = c.getParent() and
- assign.getLValue() = c and
- assign.getRValue() instanceof ObjectOrCollectionInitializer
+ assign.getLeftOperand() = c and
+ assign.getRightOperand() instanceof ObjectOrCollectionInitializer
)
}
diff --git a/csharp/ql/src/experimental/Security Features/CWE-759/HashWithoutSalt.ql b/csharp/ql/src/experimental/Security Features/CWE-759/HashWithoutSalt.ql
index d43050c2deb..0dc8fc362d6 100644
--- a/csharp/ql/src/experimental/Security Features/CWE-759/HashWithoutSalt.ql
+++ b/csharp/ql/src/experimental/Security Features/CWE-759/HashWithoutSalt.ql
@@ -187,10 +187,10 @@ module HashWithoutSaltConfig implements DataFlow::ConfigSig {
or
// a salt or key is included in subclasses of `KeyedHashAlgorithm`
exists(MethodCall mc, Assignment a, ObjectCreation oc |
- a.getRValue() = oc and
+ a.getRightOperand() = oc and
oc.getObjectType().getABaseType+() instanceof KeyedHashAlgorithm and
mc.getTarget() instanceof HashMethod and
- a.getLValue() = mc.getQualifier().(VariableAccess).getTarget().getAnAccess() and
+ a.getLeftOperand() = mc.getQualifier().(VariableAccess).getTarget().getAnAccess() and
mc.getArgument(0) = node.asExpr()
)
}
diff --git a/csharp/ql/test/library-tests/assignments/AssignOperation.ql b/csharp/ql/test/library-tests/assignments/AssignOperation.ql
index 2ca3b11a831..2fa23ed0a9f 100644
--- a/csharp/ql/test/library-tests/assignments/AssignOperation.ql
+++ b/csharp/ql/test/library-tests/assignments/AssignOperation.ql
@@ -1,4 +1,4 @@
import csharp
from AssignOperation ao
-select ao, ao.getLValue(), ao.getRValue()
+select ao, ao.getLeftOperand(), ao.getRightOperand()
diff --git a/csharp/ql/test/library-tests/conversion/pointer/Pointer.ql b/csharp/ql/test/library-tests/conversion/pointer/Pointer.ql
index 69e7db8c1cf..450ed9940a8 100644
--- a/csharp/ql/test/library-tests/conversion/pointer/Pointer.ql
+++ b/csharp/ql/test/library-tests/conversion/pointer/Pointer.ql
@@ -1,5 +1,5 @@
import csharp
from Assignment a
-select a.getLocation(), a.getLValue().getType().toString(), a.getRValue().getType().toString(),
- a.getRValue().toString()
+select a.getLocation(), a.getLeftOperand().getType().toString(),
+ a.getRightOperand().getType().toString(), a.getRightOperand().toString()
diff --git a/csharp/ql/test/library-tests/csharp10/lambda.ql b/csharp/ql/test/library-tests/csharp10/lambda.ql
index 3cfec302b52..55c7faac049 100644
--- a/csharp/ql/test/library-tests/csharp10/lambda.ql
+++ b/csharp/ql/test/library-tests/csharp10/lambda.ql
@@ -3,7 +3,7 @@ import csharp
private predicate getLambda(
LocalVariableDeclAndInitExpr e, string type, LocalVariable v, LambdaExpr lexp
) {
- lexp = e.getRValue() and
+ lexp = e.getRightOperand() and
v = e.getTargetVariable() and
type = e.getType().toStringWithTypes()
}
diff --git a/csharp/ql/test/library-tests/csharp11/operators.ql b/csharp/ql/test/library-tests/csharp11/operators.ql
index 607efac0c26..f1543e2d744 100644
--- a/csharp/ql/test/library-tests/csharp11/operators.ql
+++ b/csharp/ql/test/library-tests/csharp11/operators.ql
@@ -14,8 +14,8 @@ query predicate assignbitwise(
AssignBitwiseOperation op, Expr left, Expr right, string name, string qlclass
) {
op.getFile().getStem() = "Operators" and
- left = op.getLValue() and
- right = op.getRValue() and
+ left = op.getLeftOperand() and
+ right = op.getRightOperand() and
name = op.getOperator() and
qlclass = op.getAPrimaryQlClass()
}
diff --git a/csharp/ql/test/library-tests/csharp6/MemberInitializer.ql b/csharp/ql/test/library-tests/csharp6/MemberInitializer.ql
index f3ef63fe225..1895792f07c 100644
--- a/csharp/ql/test/library-tests/csharp6/MemberInitializer.ql
+++ b/csharp/ql/test/library-tests/csharp6/MemberInitializer.ql
@@ -12,7 +12,7 @@ query predicate indexerCalls(IndexerCall indexer, int arg, Expr value) {
query predicate elementAssignments(
ElementWrite write, Assignment assignment, int index, Expr indexer
) {
- write = assignment.getLValue() and indexer = write.getIndex(index)
+ write = assignment.getLeftOperand() and indexer = write.getIndex(index)
}
query predicate arrayQualifiers(ElementAccess access, Expr qualifier) {
diff --git a/csharp/ql/test/library-tests/enums/Enums11.ql b/csharp/ql/test/library-tests/enums/Enums11.ql
index 36b2c005a21..f6133517f7d 100644
--- a/csharp/ql/test/library-tests/enums/Enums11.ql
+++ b/csharp/ql/test/library-tests/enums/Enums11.ql
@@ -6,7 +6,7 @@ import csharp
from Expr e
where
- exists(Assignment a | a.getRValue() = e |
+ exists(Assignment a | a.getRightOperand() = e |
a.getParent().(Field).getDeclaringType() instanceof Enum
)
select e, e.getValue()
diff --git a/csharp/ql/test/library-tests/expressions/AddEventExpr1.ql b/csharp/ql/test/library-tests/expressions/AddEventExpr1.ql
index 48f6b41e19d..e3c1530fb1a 100644
--- a/csharp/ql/test/library-tests/expressions/AddEventExpr1.ql
+++ b/csharp/ql/test/library-tests/expressions/AddEventExpr1.ql
@@ -9,5 +9,5 @@ where
c.hasName("LoginDialog") and
e.getEnclosingCallable() = c and
e.getTarget().hasName("Click") and
- e.getLValue().getQualifier().(FieldAccess).getTarget().hasName("OkButton")
+ e.getLeftOperand().getQualifier().(FieldAccess).getTarget().hasName("OkButton")
select c, e
diff --git a/csharp/ql/test/library-tests/expressions/AnonymousMethod1.ql b/csharp/ql/test/library-tests/expressions/AnonymousMethod1.ql
index 2c8268e87e1..74e9d3cb1ff 100644
--- a/csharp/ql/test/library-tests/expressions/AnonymousMethod1.ql
+++ b/csharp/ql/test/library-tests/expressions/AnonymousMethod1.ql
@@ -6,7 +6,7 @@ import csharp
from Assignment assign, AnonymousMethodExpr e
where
- assign.getLValue().(VariableAccess).getTarget().hasName("f7") and
+ assign.getLeftOperand().(VariableAccess).getTarget().hasName("f7") and
e.getParent+() = assign and
e.getNumberOfParameters() = 1 and
e.getParameter(0).getType() instanceof IntType and
diff --git a/csharp/ql/test/library-tests/expressions/AnonymousMethod2.ql b/csharp/ql/test/library-tests/expressions/AnonymousMethod2.ql
index e9fbbf01a10..8f0390b0f82 100644
--- a/csharp/ql/test/library-tests/expressions/AnonymousMethod2.ql
+++ b/csharp/ql/test/library-tests/expressions/AnonymousMethod2.ql
@@ -6,7 +6,7 @@ import csharp
from Assignment assign, AnonymousMethodExpr e, Parameter p, ParameterAccess pa
where
- assign.getLValue().(VariableAccess).getTarget().hasName("f7") and
+ assign.getLeftOperand().(VariableAccess).getTarget().hasName("f7") and
e.getParent+() = assign and
e.getNumberOfParameters() = 1 and
p = e.getParameter(0) and
diff --git a/csharp/ql/test/library-tests/expressions/AnonymousMethod3.ql b/csharp/ql/test/library-tests/expressions/AnonymousMethod3.ql
index e4c2e9ae9ba..46d8907319d 100644
--- a/csharp/ql/test/library-tests/expressions/AnonymousMethod3.ql
+++ b/csharp/ql/test/library-tests/expressions/AnonymousMethod3.ql
@@ -6,7 +6,7 @@ import csharp
from Assignment assign, AnonymousMethodExpr e
where
- assign.getLValue().(VariableAccess).getTarget().hasName("f7") and
+ assign.getLeftOperand().(VariableAccess).getTarget().hasName("f7") and
e.getParent+() = assign and
e.getNumberOfParameters() = 1 and
e.getType().(DelegateType).getReturnType() instanceof IntType
diff --git a/csharp/ql/test/library-tests/expressions/AnonymousMethod4.ql b/csharp/ql/test/library-tests/expressions/AnonymousMethod4.ql
index 4d424b65b84..cca81c6b04e 100644
--- a/csharp/ql/test/library-tests/expressions/AnonymousMethod4.ql
+++ b/csharp/ql/test/library-tests/expressions/AnonymousMethod4.ql
@@ -6,7 +6,7 @@ import csharp
from Assignment assign, AnonymousMethodExpr e
where
- assign.getLValue().(VariableAccess).getTarget().hasName("f8") and
+ assign.getLeftOperand().(VariableAccess).getTarget().hasName("f8") and
e.getParent+() = assign and
e.hasNoParameters()
select e, e
diff --git a/csharp/ql/test/library-tests/expressions/AnonymousMethod5.ql b/csharp/ql/test/library-tests/expressions/AnonymousMethod5.ql
index cbc6ac82ca7..577d810dfad 100644
--- a/csharp/ql/test/library-tests/expressions/AnonymousMethod5.ql
+++ b/csharp/ql/test/library-tests/expressions/AnonymousMethod5.ql
@@ -6,7 +6,7 @@ import csharp
from Assignment assign, AnonymousMethodExpr e, LocalVariableAccess va
where
- assign.getLValue().(VariableAccess).getTarget().hasName("f8") and
+ assign.getLeftOperand().(VariableAccess).getTarget().hasName("f8") and
e.getParent+() = assign and
e.hasNoParameters() and
va.getEnclosingStmt().getParent+() = e.getBody() and
diff --git a/csharp/ql/test/library-tests/expressions/AnonymousObjectCreation1.ql b/csharp/ql/test/library-tests/expressions/AnonymousObjectCreation1.ql
index 74d8cd27a94..c717aa260e0 100644
--- a/csharp/ql/test/library-tests/expressions/AnonymousObjectCreation1.ql
+++ b/csharp/ql/test/library-tests/expressions/AnonymousObjectCreation1.ql
@@ -6,11 +6,11 @@ import csharp
from Assignment assign, AnonymousObjectCreation o, Assignment a, Property p
where
- assign.getLValue().(VariableAccess).getTarget().hasName("list2") and
+ assign.getLeftOperand().(VariableAccess).getTarget().hasName("list2") and
o.getParent+() = assign and
o.getInitializer().getMemberInitializer(0) = a and
- a.getRValue().getValue() = "2" and
- p = a.getLValue().(PropertyAccess).getTarget() and
+ a.getRightOperand().getValue() = "2" and
+ p = a.getLeftOperand().(PropertyAccess).getTarget() and
p.hasName("i") and
p.getDeclaringType() = o.getObjectType()
select o
diff --git a/csharp/ql/test/library-tests/expressions/AnonymousObjectCreation2.ql b/csharp/ql/test/library-tests/expressions/AnonymousObjectCreation2.ql
index 5f9e16564b4..d55bf89d606 100644
--- a/csharp/ql/test/library-tests/expressions/AnonymousObjectCreation2.ql
+++ b/csharp/ql/test/library-tests/expressions/AnonymousObjectCreation2.ql
@@ -6,11 +6,11 @@ import csharp
from Assignment assign, AnonymousObjectCreation o, Assignment a, Property p
where
- assign.getLValue().(VariableAccess).getTarget().hasName("contacts2") and
+ assign.getLeftOperand().(VariableAccess).getTarget().hasName("contacts2") and
o.getParent+() = assign and
o.getInitializer().getMemberInitializer(0) = a and
- a.getRValue().getValue() = "Chris Smith" and
- p = a.getLValue().(PropertyAccess).getTarget() and
+ a.getRightOperand().getValue() = "Chris Smith" and
+ p = a.getLeftOperand().(PropertyAccess).getTarget() and
p.hasName("Name") and
p.getDeclaringType() = o.getObjectType()
select o, p.getType().toString()
diff --git a/csharp/ql/test/library-tests/expressions/AnonymousObjectCreation3.ql b/csharp/ql/test/library-tests/expressions/AnonymousObjectCreation3.ql
index afa9ca0d3b2..6033bfed38a 100644
--- a/csharp/ql/test/library-tests/expressions/AnonymousObjectCreation3.ql
+++ b/csharp/ql/test/library-tests/expressions/AnonymousObjectCreation3.ql
@@ -6,11 +6,11 @@ import csharp
from Assignment assign, AnonymousObjectCreation o, Assignment a, Property p
where
- assign.getLValue().(VariableAccess).getTarget().hasName("contacts2") and
+ assign.getLeftOperand().(VariableAccess).getTarget().hasName("contacts2") and
o.getParent+() = assign and
o.getInitializer().getMemberInitializer(1) = a and
- a.getRValue() instanceof ArrayCreation and
- p = a.getLValue().(PropertyAccess).getTarget() and
+ a.getRightOperand() instanceof ArrayCreation and
+ p = a.getLeftOperand().(PropertyAccess).getTarget() and
p.hasName("PhoneNumbers") and
p.getDeclaringType() = o.getObjectType()
select o, p.getType().getName()
diff --git a/csharp/ql/test/library-tests/expressions/AnonymousObjectCreation4.ql b/csharp/ql/test/library-tests/expressions/AnonymousObjectCreation4.ql
index b6354d1f493..a52278839f2 100644
--- a/csharp/ql/test/library-tests/expressions/AnonymousObjectCreation4.ql
+++ b/csharp/ql/test/library-tests/expressions/AnonymousObjectCreation4.ql
@@ -8,7 +8,7 @@ from
Assignment assign, AnonymousObjectCreation o, Assignment a, AnonymousObjectCreation p,
Assignment b
where
- assign.getLValue().(VariableAccess).getTarget().hasName("contacts2") and
+ assign.getLeftOperand().(VariableAccess).getTarget().hasName("contacts2") and
o.getParent+() = assign and
o.getInitializer().getMemberInitializer(1) = a and
p.getParent+() = assign and
diff --git a/csharp/ql/test/library-tests/expressions/ArrayCreation1.ql b/csharp/ql/test/library-tests/expressions/ArrayCreation1.ql
index fba7a403615..6f728347bff 100644
--- a/csharp/ql/test/library-tests/expressions/ArrayCreation1.ql
+++ b/csharp/ql/test/library-tests/expressions/ArrayCreation1.ql
@@ -6,8 +6,8 @@ import csharp
from Assignment a, ArrayCreation e, ArrayInitializer i
where
- a.getLValue().(VariableAccess).getTarget().hasName("is1") and
- e = a.getRValue() and
+ a.getLeftOperand().(VariableAccess).getTarget().hasName("is1") and
+ e = a.getRightOperand() and
not e.isImplicitlyTyped() and
i = e.getInitializer() and
e.isImplicitlySized() and
diff --git a/csharp/ql/test/library-tests/expressions/ArrayCreation10.ql b/csharp/ql/test/library-tests/expressions/ArrayCreation10.ql
index d8a1df12867..951ca22c0c2 100644
--- a/csharp/ql/test/library-tests/expressions/ArrayCreation10.ql
+++ b/csharp/ql/test/library-tests/expressions/ArrayCreation10.ql
@@ -6,9 +6,9 @@ import csharp
from Assignment a, ArrayCreation e, CastExpr cast
where
- a.getLValue().(VariableAccess).getTarget().hasName("os") and
+ a.getLeftOperand().(VariableAccess).getTarget().hasName("os") and
e.getEnclosingCallable().hasName("MainElementAccess") and
- e = a.getRValue() and
+ e = a.getRightOperand() and
not e.isImplicitlyTyped() and
e.isImplicitlySized() and
e.getArrayType().getDimension() = 1 and
diff --git a/csharp/ql/test/library-tests/expressions/ArrayCreation2.ql b/csharp/ql/test/library-tests/expressions/ArrayCreation2.ql
index ae56d579839..88ce79bc91e 100644
--- a/csharp/ql/test/library-tests/expressions/ArrayCreation2.ql
+++ b/csharp/ql/test/library-tests/expressions/ArrayCreation2.ql
@@ -6,8 +6,8 @@ import csharp
from Assignment a, ArrayCreation e, ArrayInitializer i
where
- a.getLValue().(VariableAccess).getTarget().hasName("is2") and
- e = a.getRValue() and
+ a.getLeftOperand().(VariableAccess).getTarget().hasName("is2") and
+ e = a.getRightOperand() and
not e.isImplicitlyTyped() and
i = e.getInitializer() and
e.getNumberOfLengthArguments() = 2 and
diff --git a/csharp/ql/test/library-tests/expressions/ArrayCreation3.ql b/csharp/ql/test/library-tests/expressions/ArrayCreation3.ql
index efe626dab08..0da55f86479 100644
--- a/csharp/ql/test/library-tests/expressions/ArrayCreation3.ql
+++ b/csharp/ql/test/library-tests/expressions/ArrayCreation3.ql
@@ -6,8 +6,8 @@ import csharp
from Assignment a, ArrayCreation e
where
- a.getLValue().(VariableAccess).getTarget().hasName("is3") and
- e = a.getRValue() and
+ a.getLeftOperand().(VariableAccess).getTarget().hasName("is3") and
+ e = a.getRightOperand() and
not e.isImplicitlyTyped() and
not e.hasInitializer() and
e.getNumberOfLengthArguments() = 1 and
diff --git a/csharp/ql/test/library-tests/expressions/ArrayCreation4.ql b/csharp/ql/test/library-tests/expressions/ArrayCreation4.ql
index 2a0dd531283..b79ec3f7bd6 100644
--- a/csharp/ql/test/library-tests/expressions/ArrayCreation4.ql
+++ b/csharp/ql/test/library-tests/expressions/ArrayCreation4.ql
@@ -6,8 +6,8 @@ import csharp
from Assignment a, ArrayCreation e
where
- a.getLValue().(VariableAccess).getTarget().hasName("is4") and
- e = a.getRValue() and
+ a.getLeftOperand().(VariableAccess).getTarget().hasName("is4") and
+ e = a.getRightOperand() and
not e.isImplicitlyTyped() and
not e.hasInitializer() and
e.getNumberOfLengthArguments() = 2 and
diff --git a/csharp/ql/test/library-tests/expressions/ArrayCreation5.ql b/csharp/ql/test/library-tests/expressions/ArrayCreation5.ql
index 04c29cafba8..88df5bef175 100644
--- a/csharp/ql/test/library-tests/expressions/ArrayCreation5.ql
+++ b/csharp/ql/test/library-tests/expressions/ArrayCreation5.ql
@@ -6,8 +6,8 @@ import csharp
from Assignment a, ArrayCreation e, int i
where
- a.getLValue().(VariableAccess).getTarget().hasName("is5") and
- e = a.getRValue() and
+ a.getLeftOperand().(VariableAccess).getTarget().hasName("is5") and
+ e = a.getRightOperand() and
e.isImplicitlyTyped() and
e.isImplicitlySized() and
e.getArrayType().getDimension() = 1 and
diff --git a/csharp/ql/test/library-tests/expressions/ArrayCreation6.ql b/csharp/ql/test/library-tests/expressions/ArrayCreation6.ql
index 7ca6bbe9668..237900bbe7c 100644
--- a/csharp/ql/test/library-tests/expressions/ArrayCreation6.ql
+++ b/csharp/ql/test/library-tests/expressions/ArrayCreation6.ql
@@ -6,8 +6,8 @@ import csharp
from Assignment a, ArrayCreation e
where
- a.getLValue().(VariableAccess).getTarget().hasName("is6") and
- e = a.getRValue() and
+ a.getLeftOperand().(VariableAccess).getTarget().hasName("is6") and
+ e = a.getRightOperand() and
e.isImplicitlyTyped() and
e.isImplicitlySized() and
e.getArrayType().getDimension() = 1 and
diff --git a/csharp/ql/test/library-tests/expressions/ArrayCreation7.ql b/csharp/ql/test/library-tests/expressions/ArrayCreation7.ql
index e34253a4f02..a466195a0b1 100644
--- a/csharp/ql/test/library-tests/expressions/ArrayCreation7.ql
+++ b/csharp/ql/test/library-tests/expressions/ArrayCreation7.ql
@@ -6,8 +6,8 @@ import csharp
from Assignment a, ArrayCreation e
where
- a.getLValue().(VariableAccess).getTarget().hasName("is7") and
- e = a.getRValue() and
+ a.getLeftOperand().(VariableAccess).getTarget().hasName("is7") and
+ e = a.getRightOperand() and
e.isImplicitlyTyped() and
e.isImplicitlySized() and
e.getArrayType().getDimension() = 1 and
diff --git a/csharp/ql/test/library-tests/expressions/ArrayCreation8.ql b/csharp/ql/test/library-tests/expressions/ArrayCreation8.ql
index cc1fd366db1..8eb810247c0 100644
--- a/csharp/ql/test/library-tests/expressions/ArrayCreation8.ql
+++ b/csharp/ql/test/library-tests/expressions/ArrayCreation8.ql
@@ -6,8 +6,8 @@ import csharp
from Assignment a, ArrayCreation e
where
- a.getLValue().(VariableAccess).getTarget().hasName("contacts2") and
- e = a.getRValue() and
+ a.getLeftOperand().(VariableAccess).getTarget().hasName("contacts2") and
+ e = a.getRightOperand() and
e.isImplicitlyTyped() and
e.isImplicitlySized() and
e.getArrayType().getDimension() = 1 and
diff --git a/csharp/ql/test/library-tests/expressions/ArrayCreation9.ql b/csharp/ql/test/library-tests/expressions/ArrayCreation9.ql
index fc4b561c170..55ba1d1edb1 100644
--- a/csharp/ql/test/library-tests/expressions/ArrayCreation9.ql
+++ b/csharp/ql/test/library-tests/expressions/ArrayCreation9.ql
@@ -6,8 +6,8 @@ import csharp
from Assignment a, ArrayCreation e
where
- a.getLValue().(VariableAccess).getTarget().hasName("t") and
- e = a.getRValue() and
+ a.getLeftOperand().(VariableAccess).getTarget().hasName("t") and
+ e = a.getRightOperand() and
e.isImplicitlyTyped() and
e.isImplicitlySized() and
e.getArrayType().getDimension() = 1 and
diff --git a/csharp/ql/test/library-tests/expressions/Lambda1.ql b/csharp/ql/test/library-tests/expressions/Lambda1.ql
index f4787c584f3..4e4d17b9d24 100644
--- a/csharp/ql/test/library-tests/expressions/Lambda1.ql
+++ b/csharp/ql/test/library-tests/expressions/Lambda1.ql
@@ -6,7 +6,7 @@ import csharp
from Assignment assign, LambdaExpr e
where
- assign.getLValue().(VariableAccess).getTarget().hasName("f1") and
+ assign.getLeftOperand().(VariableAccess).getTarget().hasName("f1") and
e.getParent+() = assign and
e.getNumberOfParameters() = 1 and
e.getParameter(0).getType() instanceof ShortType and
diff --git a/csharp/ql/test/library-tests/expressions/Lambda2.ql b/csharp/ql/test/library-tests/expressions/Lambda2.ql
index 5fff4bd2cf6..ff5c06ec670 100644
--- a/csharp/ql/test/library-tests/expressions/Lambda2.ql
+++ b/csharp/ql/test/library-tests/expressions/Lambda2.ql
@@ -6,7 +6,7 @@ import csharp
from Assignment assign, LambdaExpr e
where
- assign.getLValue().(VariableAccess).getTarget().hasName("f2") and
+ assign.getLeftOperand().(VariableAccess).getTarget().hasName("f2") and
e.getParent+() = assign and
e.getNumberOfParameters() = 1 and
e.getParameter(0).getType() instanceof IntType and
diff --git a/csharp/ql/test/library-tests/expressions/Lambda3.ql b/csharp/ql/test/library-tests/expressions/Lambda3.ql
index 32aa919cd20..46d3a411b36 100644
--- a/csharp/ql/test/library-tests/expressions/Lambda3.ql
+++ b/csharp/ql/test/library-tests/expressions/Lambda3.ql
@@ -6,7 +6,7 @@ import csharp
from Assignment assign, LambdaExpr e
where
- assign.getLValue().(VariableAccess).getTarget().hasName("f3") and
+ assign.getLeftOperand().(VariableAccess).getTarget().hasName("f3") and
e.getParent+() = assign and
e.getNumberOfParameters() = 1 and
e.getParameter(0).getType() instanceof IntType and
diff --git a/csharp/ql/test/library-tests/expressions/Lambda4.ql b/csharp/ql/test/library-tests/expressions/Lambda4.ql
index ca7eb7a4207..69ac40ad932 100644
--- a/csharp/ql/test/library-tests/expressions/Lambda4.ql
+++ b/csharp/ql/test/library-tests/expressions/Lambda4.ql
@@ -6,7 +6,7 @@ import csharp
from Assignment assign, LambdaExpr e
where
- assign.getLValue().(VariableAccess).getTarget().hasName("f4") and
+ assign.getLeftOperand().(VariableAccess).getTarget().hasName("f4") and
e.getParent+() = assign and
e.getNumberOfParameters() = 1 and
e.getParameter(0).getType() instanceof IntType and
diff --git a/csharp/ql/test/library-tests/expressions/Lambda5.ql b/csharp/ql/test/library-tests/expressions/Lambda5.ql
index cc577aa85cb..3836ca4effd 100644
--- a/csharp/ql/test/library-tests/expressions/Lambda5.ql
+++ b/csharp/ql/test/library-tests/expressions/Lambda5.ql
@@ -6,7 +6,7 @@ import csharp
from Assignment assign, LambdaExpr e
where
- assign.getLValue().(VariableAccess).getTarget().hasName("f5") and
+ assign.getLeftOperand().(VariableAccess).getTarget().hasName("f5") and
e.getParent+() = assign and
e.getNumberOfParameters() = 2 and
e.getParameter(0).getType() instanceof IntType and
diff --git a/csharp/ql/test/library-tests/expressions/Lambda6.ql b/csharp/ql/test/library-tests/expressions/Lambda6.ql
index c584e4f6c09..4a6ee312834 100644
--- a/csharp/ql/test/library-tests/expressions/Lambda6.ql
+++ b/csharp/ql/test/library-tests/expressions/Lambda6.ql
@@ -6,7 +6,7 @@ import csharp
from Assignment assign, LambdaExpr e
where
- assign.getLValue().(VariableAccess).getTarget().hasName("f6") and
+ assign.getLeftOperand().(VariableAccess).getTarget().hasName("f6") and
e.getParent+() = assign and
e.getNumberOfParameters() = 0 and
e.getType().(DelegateType).hasName("Unit") and
diff --git a/csharp/ql/test/library-tests/expressions/ObjectCreation10.ql b/csharp/ql/test/library-tests/expressions/ObjectCreation10.ql
index abd4a9d6ec6..971654a95b3 100644
--- a/csharp/ql/test/library-tests/expressions/ObjectCreation10.ql
+++ b/csharp/ql/test/library-tests/expressions/ObjectCreation10.ql
@@ -6,7 +6,7 @@ import csharp
from Assignment a, CollectionInitializer i
where
- a.getLValue().(VariableAccess).getTarget().hasName("list1") and
+ a.getLeftOperand().(VariableAccess).getTarget().hasName("list1") and
i.getParent+() = a and
i.getElementInitializer(0).getArgument(0) instanceof AssignExpr
select i.getAChild+()
diff --git a/csharp/ql/test/library-tests/expressions/ObjectCreation11.ql b/csharp/ql/test/library-tests/expressions/ObjectCreation11.ql
index c874735c300..0265579ff67 100644
--- a/csharp/ql/test/library-tests/expressions/ObjectCreation11.ql
+++ b/csharp/ql/test/library-tests/expressions/ObjectCreation11.ql
@@ -6,7 +6,7 @@ import csharp
from Assignment a, CollectionInitializer i, AnonymousObjectCreation o
where
- a.getLValue().(VariableAccess).getTarget().hasName("list2") and
+ a.getLeftOperand().(VariableAccess).getTarget().hasName("list2") and
i.getParent+() = a and
i.getElementInitializer(0).getArgument(0) = o
select i, o
diff --git a/csharp/ql/test/library-tests/expressions/ObjectCreation4.ql b/csharp/ql/test/library-tests/expressions/ObjectCreation4.ql
index 5812397b11b..6ec3e2ec327 100644
--- a/csharp/ql/test/library-tests/expressions/ObjectCreation4.ql
+++ b/csharp/ql/test/library-tests/expressions/ObjectCreation4.ql
@@ -15,9 +15,9 @@ where
cc.hasName("Point") and
i = e.getInitializer() and
a = i.getMemberInitializer(0) and
- a.getLValue().(PropertyAccess).getTarget().hasName("X") and
- a.getRValue().getValue() = "0" and
+ a.getLeftOperand().(PropertyAccess).getTarget().hasName("X") and
+ a.getRightOperand().getValue() = "0" and
b = i.getMemberInitializer(1) and
- b.getLValue().(PropertyAccess).getTarget().hasName("Y") and
- b.getRValue().getValue() = "1"
+ b.getLeftOperand().(PropertyAccess).getTarget().hasName("Y") and
+ b.getRightOperand().getValue() = "1"
select e, i, a, b
diff --git a/csharp/ql/test/library-tests/expressions/ObjectCreation5.ql b/csharp/ql/test/library-tests/expressions/ObjectCreation5.ql
index cf31f518ec7..e130da484d7 100644
--- a/csharp/ql/test/library-tests/expressions/ObjectCreation5.ql
+++ b/csharp/ql/test/library-tests/expressions/ObjectCreation5.ql
@@ -15,10 +15,10 @@ where
cc.hasName("Point") and
i = e.getInitializer() and
a = i.getMemberInitializer(0) and
- a.getLValue().(PropertyAccess).getTarget().hasName("X") and
- a.getRValue().getValue() = "2" and
+ a.getLeftOperand().(PropertyAccess).getTarget().hasName("X") and
+ a.getRightOperand().getValue() = "2" and
b = i.getMemberInitializer(1) and
- b.getLValue().(PropertyAccess).getTarget().hasName("Y") and
- b.getRValue().getValue() = "3" and
+ b.getLeftOperand().(PropertyAccess).getTarget().hasName("Y") and
+ b.getRightOperand().getValue() = "3" and
i.getNumberOfMemberInitializers() = 2
select i, a, b
diff --git a/csharp/ql/test/library-tests/expressions/ObjectCreation6.ql b/csharp/ql/test/library-tests/expressions/ObjectCreation6.ql
index 11e771890ca..529607c8d4b 100644
--- a/csharp/ql/test/library-tests/expressions/ObjectCreation6.ql
+++ b/csharp/ql/test/library-tests/expressions/ObjectCreation6.ql
@@ -15,10 +15,10 @@ where
cc.hasName("Rectangle") and
i = e.getInitializer() and
a = i.getMemberInitializer(0) and
- a.getLValue().(PropertyAccess).getTarget().hasName("P1") and
- a.getRValue() instanceof ObjectCreation and
+ a.getLeftOperand().(PropertyAccess).getTarget().hasName("P1") and
+ a.getRightOperand() instanceof ObjectCreation and
b = i.getMemberInitializer(1) and
- b.getLValue().(PropertyAccess).getTarget().hasName("P2") and
- b.getRValue() instanceof ObjectCreation and
+ b.getLeftOperand().(PropertyAccess).getTarget().hasName("P2") and
+ b.getRightOperand() instanceof ObjectCreation and
i.getNumberOfMemberInitializers() = 2
select i, a, b
diff --git a/csharp/ql/test/library-tests/expressions/ObjectCreation7.ql b/csharp/ql/test/library-tests/expressions/ObjectCreation7.ql
index ccb17515525..404011f1896 100644
--- a/csharp/ql/test/library-tests/expressions/ObjectCreation7.ql
+++ b/csharp/ql/test/library-tests/expressions/ObjectCreation7.ql
@@ -15,10 +15,10 @@ where
cc.hasName("Rectangle2") and
i = e.getInitializer() and
a = i.getMemberInitializer(0) and
- a.getLValue().(PropertyAccess).getTarget().hasName("P1") and
- a.getRValue() instanceof ObjectInitializer and
+ a.getLeftOperand().(PropertyAccess).getTarget().hasName("P1") and
+ a.getRightOperand() instanceof ObjectInitializer and
b = i.getMemberInitializer(1) and
- b.getLValue().(PropertyAccess).getTarget().hasName("P2") and
- b.getRValue() instanceof ObjectInitializer and
+ b.getLeftOperand().(PropertyAccess).getTarget().hasName("P2") and
+ b.getRightOperand() instanceof ObjectInitializer and
i.getNumberOfMemberInitializers() = 2
select m, e
diff --git a/csharp/ql/test/library-tests/expressions/RemoveEventExpr1.ql b/csharp/ql/test/library-tests/expressions/RemoveEventExpr1.ql
index 95b223ed6f4..991fdd6e492 100644
--- a/csharp/ql/test/library-tests/expressions/RemoveEventExpr1.ql
+++ b/csharp/ql/test/library-tests/expressions/RemoveEventExpr1.ql
@@ -9,5 +9,5 @@ where
c.hasName("LoginDialog") and
e.getEnclosingCallable() = c and
e.getTarget().hasName("Click") and
- e.getLValue().getQualifier().(FieldAccess).getTarget().hasName("CancelButton")
+ e.getLeftOperand().getQualifier().(FieldAccess).getTarget().hasName("CancelButton")
select c, e
From 6d5aff4822bd625355d6b16ea04ced168f0ceaf2 Mon Sep 17 00:00:00 2001
From: Michael Nebel
Date: Wed, 1 Apr 2026 13:17:52 +0200
Subject: [PATCH 035/185] C#: Add change-note.
---
csharp/ql/lib/change-notes/2026-04-01-getlrvalue.md | 4 ++++
1 file changed, 4 insertions(+)
create mode 100644 csharp/ql/lib/change-notes/2026-04-01-getlrvalue.md
diff --git a/csharp/ql/lib/change-notes/2026-04-01-getlrvalue.md b/csharp/ql/lib/change-notes/2026-04-01-getlrvalue.md
new file mode 100644
index 00000000000..da1a3d62148
--- /dev/null
+++ b/csharp/ql/lib/change-notes/2026-04-01-getlrvalue.md
@@ -0,0 +1,4 @@
+---
+category: deprecated
+---
+* The predicates `get[L|R]Value` in the class `Assignment` have been deprecated. Use `get[Left|Right]Operand` instead.
From 4d8b782695fdec2dc2058f6112a1bbebfb02d660 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen
Date: Thu, 2 Apr 2026 10:56:09 +0100
Subject: [PATCH 036/185] Shared: Also expose dataflow stage 1's forward flow
predicate.
---
.../dataflow/internal/DataFlowImplStage1.qll | 17 ++++++++++++++++-
1 file changed, 16 insertions(+), 1 deletion(-)
diff --git a/shared/dataflow/codeql/dataflow/internal/DataFlowImplStage1.qll b/shared/dataflow/codeql/dataflow/internal/DataFlowImplStage1.qll
index 426576d3ace..e9c92844fb7 100644
--- a/shared/dataflow/codeql/dataflow/internal/DataFlowImplStage1.qll
+++ b/shared/dataflow/codeql/dataflow/internal/DataFlowImplStage1.qll
@@ -91,6 +91,10 @@ module MakeImplStage1 Lang> {
class ApNil extends Ap;
+ predicate fwdFlow(Nd node);
+
+ predicate fwdFlow(Nd node, Ap ap);
+
predicate revFlow(Nd node);
predicate revFlow(Nd node, Ap ap);
@@ -634,7 +638,7 @@ module MakeImplStage1 Lang> {
)
}
- private predicate fwdFlow(NodeEx node) { fwdFlow(node, _) }
+ predicate fwdFlow(NodeEx node) { fwdFlow(node, _) }
pragma[nomagic]
private predicate fwdFlowReadSet(ContentSet c, NodeEx node, Cc cc) {
@@ -1291,6 +1295,13 @@ module MakeImplStage1 Lang> {
import Stage1
import Stage1Common
+ predicate fwdFlow(Nd node) { Stage1::fwdFlow(node) }
+
+ predicate fwdFlow(Nd node, Ap ap) {
+ Stage1::fwdFlow(node) and
+ exists(ap)
+ }
+
predicate revFlow(NodeEx node, Ap ap) { Stage1::revFlow(node) and exists(ap) }
predicate toNormalSinkNode = toNormalSinkNodeEx/1;
@@ -1395,6 +1406,10 @@ module MakeImplStage1 Lang> {
import Stage1Common
+ predicate fwdFlow(Nd node) { Stage1::fwdFlow(node.getNodeEx()) }
+
+ predicate fwdFlow(Nd node, Ap ap) { Stage1::fwdFlow(node.getNodeEx()) and exists(ap) }
+
predicate revFlow(Nd node) { Stage1::revFlow(node.getNodeEx()) }
predicate revFlow(Nd node, Ap ap) { Stage1::revFlow(node.getNodeEx()) and exists(ap) }
From 84c01bc255b549f9b34fece46a588c3e1205f6d6 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Thu, 2 Apr 2026 11:26:39 +0100
Subject: [PATCH 037/185] C++: Upgrade query precision.
---
cpp/ql/src/Likely Bugs/Format/WrongTypeFormatArguments.ql | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/cpp/ql/src/Likely Bugs/Format/WrongTypeFormatArguments.ql b/cpp/ql/src/Likely Bugs/Format/WrongTypeFormatArguments.ql
index 7f0a4833cb5..5842b9474f7 100644
--- a/cpp/ql/src/Likely Bugs/Format/WrongTypeFormatArguments.ql
+++ b/cpp/ql/src/Likely Bugs/Format/WrongTypeFormatArguments.ql
@@ -5,7 +5,7 @@
* @kind problem
* @problem.severity error
* @security-severity 7.5
- * @precision medium
+ * @precision high
* @id cpp/wrong-type-format-argument
* @tags reliability
* correctness
From fca567f6ea98abe390b446701fa82ff5c386b7d9 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Thu, 2 Apr 2026 11:26:21 +0100
Subject: [PATCH 038/185] C++: Change note.
---
.../src/change-notes/2026-04-02-wrong-type-format-argument.md | 4 ++++
1 file changed, 4 insertions(+)
create mode 100644 cpp/ql/src/change-notes/2026-04-02-wrong-type-format-argument.md
diff --git a/cpp/ql/src/change-notes/2026-04-02-wrong-type-format-argument.md b/cpp/ql/src/change-notes/2026-04-02-wrong-type-format-argument.md
new file mode 100644
index 00000000000..f8b9085dacc
--- /dev/null
+++ b/cpp/ql/src/change-notes/2026-04-02-wrong-type-format-argument.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The "Wrong type of arguments to formatting function" (`cpp/wrong-type-format-argument`) query has been upgraded to `high` precision. This query will now run in the default code scanning suite.
From b41a4ff5e4c06ac0e2308786bf82490e00b232a3 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Thu, 2 Apr 2026 11:28:19 +0100
Subject: [PATCH 039/185] C++: Upgrade query precision.
---
cpp/ql/src/Likely Bugs/Arithmetic/IntMultToLong.ql | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/IntMultToLong.ql b/cpp/ql/src/Likely Bugs/Arithmetic/IntMultToLong.ql
index 6747d177c80..b05bd637dc2 100644
--- a/cpp/ql/src/Likely Bugs/Arithmetic/IntMultToLong.ql
+++ b/cpp/ql/src/Likely Bugs/Arithmetic/IntMultToLong.ql
@@ -5,7 +5,7 @@
* @kind problem
* @problem.severity warning
* @security-severity 8.1
- * @precision medium
+ * @precision high
* @id cpp/integer-multiplication-cast-to-long
* @tags reliability
* security
From 909b55a40a2e4a85ce4ea04ff8d6a179c0b6399e Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Thu, 2 Apr 2026 11:28:34 +0100
Subject: [PATCH 040/185] C++: Change note.
---
.../2026-04-02-integer-multiplication-cast-to-long.md | 4 ++++
1 file changed, 4 insertions(+)
create mode 100644 cpp/ql/src/change-notes/2026-04-02-integer-multiplication-cast-to-long.md
diff --git a/cpp/ql/src/change-notes/2026-04-02-integer-multiplication-cast-to-long.md b/cpp/ql/src/change-notes/2026-04-02-integer-multiplication-cast-to-long.md
new file mode 100644
index 00000000000..cd6796b408f
--- /dev/null
+++ b/cpp/ql/src/change-notes/2026-04-02-integer-multiplication-cast-to-long.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The "Multiplication result converted to larger type" (`cpp/integer-multiplication-cast-to-long`) query has been upgraded to `high` precision. This query will now run in the default code scanning suite.
From 520e95d92c255dc4e54ccaadc8c31121f0651ded Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Thu, 2 Apr 2026 11:30:34 +0100
Subject: [PATCH 041/185] C++: Upgrade query precision.
---
cpp/ql/src/Security/CWE/CWE-190/ComparisonWithWiderType.ql | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/cpp/ql/src/Security/CWE/CWE-190/ComparisonWithWiderType.ql b/cpp/ql/src/Security/CWE/CWE-190/ComparisonWithWiderType.ql
index 3f330807304..7d9ef88adea 100644
--- a/cpp/ql/src/Security/CWE/CWE-190/ComparisonWithWiderType.ql
+++ b/cpp/ql/src/Security/CWE/CWE-190/ComparisonWithWiderType.ql
@@ -6,7 +6,7 @@
* @kind problem
* @problem.severity warning
* @security-severity 7.8
- * @precision medium
+ * @precision high
* @tags reliability
* security
* external/cwe/cwe-190
From 9dbbdef4cbab1c6bb4f63825112f329b3f5f5fad Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Thu, 2 Apr 2026 11:30:52 +0100
Subject: [PATCH 042/185] C++: Change note.
---
.../src/change-notes/2026-04-02-comparison-with-wider-type.md | 4 ++++
1 file changed, 4 insertions(+)
create mode 100644 cpp/ql/src/change-notes/2026-04-02-comparison-with-wider-type.md
diff --git a/cpp/ql/src/change-notes/2026-04-02-comparison-with-wider-type.md b/cpp/ql/src/change-notes/2026-04-02-comparison-with-wider-type.md
new file mode 100644
index 00000000000..c84e1dba404
--- /dev/null
+++ b/cpp/ql/src/change-notes/2026-04-02-comparison-with-wider-type.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The "Comparison of narrow type with wide type in loop condition" (`cpp/comparison-with-wider-type`) query has been upgraded to `high` precision. This query will now run in the default code scanning suite.
From 2d02056e5c2434b85a853b8d414a5bffa327ed1c Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Thu, 2 Apr 2026 11:34:54 +0100
Subject: [PATCH 043/185] C++: Second change note.
---
.../change-notes/2026-04-02-implicit-function-declaration.md | 4 ++++
1 file changed, 4 insertions(+)
create mode 100644 cpp/ql/src/change-notes/2026-04-02-implicit-function-declaration.md
diff --git a/cpp/ql/src/change-notes/2026-04-02-implicit-function-declaration.md b/cpp/ql/src/change-notes/2026-04-02-implicit-function-declaration.md
new file mode 100644
index 00000000000..dd0dbd4bc7d
--- /dev/null
+++ b/cpp/ql/src/change-notes/2026-04-02-implicit-function-declaration.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The "Implicit function declaration" (`cpp/implicit-function-declaration`) query has been upgraded to `high` precision.
From e83658ed06c43ea71f6d35adf1285592ae15148d Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Thu, 2 Apr 2026 11:38:09 +0100
Subject: [PATCH 044/185] C++: Upgrade query precision.
---
.../Underspecified Functions/ImplicitFunctionDeclaration.ql | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql b/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql
index 007ef71a163..0cf6c8b3714 100644
--- a/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql
+++ b/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql
@@ -5,7 +5,7 @@
* may lead to unpredictable behavior.
* @kind problem
* @problem.severity warning
- * @precision medium
+ * @precision high
* @id cpp/implicit-function-declaration
* @tags correctness
* maintainability
From 9eabfc5fdc5d3b809641e4f8b81c1188b6d9a743 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Thu, 2 Apr 2026 11:39:45 +0100
Subject: [PATCH 045/185] Update cpp/ql/src/Likely Bugs/Underspecified
Functions/ImplicitFunctionDeclaration.ql
Co-authored-by: Jeroen Ketema <93738568+jketema@users.noreply.github.com>
---
.../Underspecified Functions/ImplicitFunctionDeclaration.ql | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql b/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql
index 0cf6c8b3714..00b29efbd0f 100644
--- a/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql
+++ b/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql
@@ -18,7 +18,7 @@ import TooManyArguments
import semmle.code.cpp.commons.Exclusions
/*
- * This query is not compatible with build mode: none databases, and has
+ * This query is not compatible with build mode: none databases, and produces
* no results on those databases.
*/
From 56af9a84ab4f6232bf03c10bc08def2a4611cb83 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Thu, 2 Apr 2026 11:40:51 +0100
Subject: [PATCH 046/185] Update cpp/ql/src/Likely Bugs/Underspecified
Functions/ImplicitFunctionDeclaration.qhelp
---
.../Underspecified Functions/ImplicitFunctionDeclaration.qhelp | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.qhelp b/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.qhelp
index d9b5a022077..90a98e1bf57 100644
--- a/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.qhelp
+++ b/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.qhelp
@@ -14,7 +14,7 @@ function may behave unpredictably.
This may indicate a misspelled function name, or that the required header containing
the function declaration has not been included.
-Note: This query is not compatible with build mode: none databases, and produces
+
Note: This query is not compatible with build mode: none databases, and produces
no results on those databases.
From 70b72f70e14f51930f3c9c4de67174ca0636214e Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Thu, 2 Apr 2026 11:32:53 +0100
Subject: [PATCH 047/185] C++: Upgrade query precision.
---
cpp/ql/src/Security/CWE/CWE-468/SuspiciousAddWithSizeof.ql | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/cpp/ql/src/Security/CWE/CWE-468/SuspiciousAddWithSizeof.ql b/cpp/ql/src/Security/CWE/CWE-468/SuspiciousAddWithSizeof.ql
index 343e96a00d3..d5a5cd8f665 100644
--- a/cpp/ql/src/Security/CWE/CWE-468/SuspiciousAddWithSizeof.ql
+++ b/cpp/ql/src/Security/CWE/CWE-468/SuspiciousAddWithSizeof.ql
@@ -6,7 +6,7 @@
* @kind problem
* @problem.severity warning
* @security-severity 8.8
- * @precision medium
+ * @precision high
* @id cpp/suspicious-add-sizeof
* @tags security
* external/cwe/cwe-468
From cc89b6ea919eb619ee932c2008fca5bbdeb4da08 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Thu, 2 Apr 2026 11:33:06 +0100
Subject: [PATCH 048/185] C++: Change note.
---
cpp/ql/src/change-notes/2026-04-02-suspicious-add-sizeof.md | 4 ++++
1 file changed, 4 insertions(+)
create mode 100644 cpp/ql/src/change-notes/2026-04-02-suspicious-add-sizeof.md
diff --git a/cpp/ql/src/change-notes/2026-04-02-suspicious-add-sizeof.md b/cpp/ql/src/change-notes/2026-04-02-suspicious-add-sizeof.md
new file mode 100644
index 00000000000..040e89c1347
--- /dev/null
+++ b/cpp/ql/src/change-notes/2026-04-02-suspicious-add-sizeof.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The "Suspicious add with sizeof" (`cpp/suspicious-add-sizeof`) query has been upgraded to `high` precision. This query will now run in the default code scanning suite.
From 5866bcc8816a23b612043ba4dbb847eb4f36a019 Mon Sep 17 00:00:00 2001
From: Jeroen Ketema
Date: Thu, 2 Apr 2026 15:41:41 +0200
Subject: [PATCH 049/185] Actions: Add FP test for
`actions/missing-workflow-permissions`
---
.../Security/CWE-275/.github/workflows/perms11.yml | 9 +++++++++
.../Security/CWE-275/.github/workflows/perms12.yml | 11 +++++++++++
.../CWE-275/MissingActionsPermissions.expected | 1 +
3 files changed, 21 insertions(+)
create mode 100644 actions/ql/test/query-tests/Security/CWE-275/.github/workflows/perms11.yml
create mode 100644 actions/ql/test/query-tests/Security/CWE-275/.github/workflows/perms12.yml
diff --git a/actions/ql/test/query-tests/Security/CWE-275/.github/workflows/perms11.yml b/actions/ql/test/query-tests/Security/CWE-275/.github/workflows/perms11.yml
new file mode 100644
index 00000000000..717cdabc302
--- /dev/null
+++ b/actions/ql/test/query-tests/Security/CWE-275/.github/workflows/perms11.yml
@@ -0,0 +1,9 @@
+on:
+ workflow_call:
+
+jobs:
+ build:
+ name: Build and test
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/deploy-pages
diff --git a/actions/ql/test/query-tests/Security/CWE-275/.github/workflows/perms12.yml b/actions/ql/test/query-tests/Security/CWE-275/.github/workflows/perms12.yml
new file mode 100644
index 00000000000..25ac1f53248
--- /dev/null
+++ b/actions/ql/test/query-tests/Security/CWE-275/.github/workflows/perms12.yml
@@ -0,0 +1,11 @@
+on:
+ workflow_dispatch:
+
+permissions:
+ contents: read
+ id-token: write
+ pages: write
+
+jobs:
+ call-workflow:
+ uses: ./.github/workflows/perms11.yml
diff --git a/actions/ql/test/query-tests/Security/CWE-275/MissingActionsPermissions.expected b/actions/ql/test/query-tests/Security/CWE-275/MissingActionsPermissions.expected
index 52a045e0de2..74edf8a7d38 100644
--- a/actions/ql/test/query-tests/Security/CWE-275/MissingActionsPermissions.expected
+++ b/actions/ql/test/query-tests/Security/CWE-275/MissingActionsPermissions.expected
@@ -6,3 +6,4 @@
| .github/workflows/perms8.yml:7:5:10:33 | Job: build | Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {id-token: write, pages: write} |
| .github/workflows/perms9.yml:7:5:10:44 | Job: build | Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {packages: write} |
| .github/workflows/perms10.yml:7:5:10:33 | Job: build | Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read, models: read} |
+| .github/workflows/perms11.yml:6:5:9:33 | Job: build | Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {id-token: write, pages: write} |
From 74e6d3474d4a0f03a870a0ab5f23cb66f325ad3d Mon Sep 17 00:00:00 2001
From: Jeroen Ketema
Date: Thu, 2 Apr 2026 15:42:45 +0200
Subject: [PATCH 050/185] Actions: Correctly check permissions in
`actions/missing-workflow-permissions`
---
.../CWE-275/MissingActionsPermissions.ql | 17 +++++++++++++++--
1 file changed, 15 insertions(+), 2 deletions(-)
diff --git a/actions/ql/src/Security/CWE-275/MissingActionsPermissions.ql b/actions/ql/src/Security/CWE-275/MissingActionsPermissions.ql
index a8bd8a5f93d..00f601fd5da 100644
--- a/actions/ql/src/Security/CWE-275/MissingActionsPermissions.ql
+++ b/actions/ql/src/Security/CWE-275/MissingActionsPermissions.ql
@@ -26,10 +26,23 @@ string permissionsForJob(Job job) {
"{" + concat(string permission | permission = jobNeedsPermission(job) | permission, ", ") + "}"
}
+predicate jobHasPermissions(Job job) {
+ exists(job.getPermissions())
+ or
+ exists(job.getEnclosingWorkflow().getPermissions())
+ or
+ // The workflow is reusable and cannot be triggered in any other way; check callers
+ exists(ReusableWorkflow r | r = job.getEnclosingWorkflow() |
+ not exists(Event e | e = r.getOn().getAnEvent() | e.getName() != "workflow_call") and
+ forall(Job caller | caller = job.getEnclosingWorkflow().(ReusableWorkflow).getACaller() |
+ jobHasPermissions(caller)
+ )
+ )
+}
+
from Job job, string permissions
where
- not exists(job.getPermissions()) and
- not exists(job.getEnclosingWorkflow().getPermissions()) and
+ not jobHasPermissions(job) and
// exists a trigger event that is not a workflow_call
exists(Event e |
e = job.getATriggerEvent() and
From 47409d1c599c2367c67e649bf89a4817cee9e1b2 Mon Sep 17 00:00:00 2001
From: Jeroen Ketema
Date: Thu, 2 Apr 2026 15:43:49 +0200
Subject: [PATCH 051/185] Actions: Update expected test results
---
.../Security/CWE-275/MissingActionsPermissions.expected | 1 -
1 file changed, 1 deletion(-)
diff --git a/actions/ql/test/query-tests/Security/CWE-275/MissingActionsPermissions.expected b/actions/ql/test/query-tests/Security/CWE-275/MissingActionsPermissions.expected
index 74edf8a7d38..52a045e0de2 100644
--- a/actions/ql/test/query-tests/Security/CWE-275/MissingActionsPermissions.expected
+++ b/actions/ql/test/query-tests/Security/CWE-275/MissingActionsPermissions.expected
@@ -6,4 +6,3 @@
| .github/workflows/perms8.yml:7:5:10:33 | Job: build | Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {id-token: write, pages: write} |
| .github/workflows/perms9.yml:7:5:10:44 | Job: build | Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {packages: write} |
| .github/workflows/perms10.yml:7:5:10:33 | Job: build | Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read, models: read} |
-| .github/workflows/perms11.yml:6:5:9:33 | Job: build | Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {id-token: write, pages: write} |
From 87f9b9581ec3bb327ea78fbc82a6b3f3c4c2c355 Mon Sep 17 00:00:00 2001
From: Jeroen Ketema
Date: Thu, 2 Apr 2026 15:48:45 +0200
Subject: [PATCH 052/185] Actions: Add change note
---
actions/ql/src/change-notes/2026-04-02-permissions.md | 4 ++++
1 file changed, 4 insertions(+)
create mode 100644 actions/ql/src/change-notes/2026-04-02-permissions.md
diff --git a/actions/ql/src/change-notes/2026-04-02-permissions.md b/actions/ql/src/change-notes/2026-04-02-permissions.md
new file mode 100644
index 00000000000..2672a30ef87
--- /dev/null
+++ b/actions/ql/src/change-notes/2026-04-02-permissions.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The query `actions/missing-workflow-permissions` no longer produces false positive results on reusable workflows where all callers set permissions.
\ No newline at end of file
From e69e30aa84b9240369b7b32e83a0e84a11e402d6 Mon Sep 17 00:00:00 2001
From: Kristen Newbury
Date: Thu, 2 Apr 2026 11:32:37 -0400
Subject: [PATCH 053/185] Adjust alert messages
CWE-829/ArtifactPoisoning[Critical|Medium]
---
actions/ql/src/Security/CWE-829/ArtifactPoisoningCritical.ql | 4 ++--
actions/ql/src/Security/CWE-829/ArtifactPoisoningMedium.ql | 3 +--
actions/ql/src/change-notes/2026-04-02-alert-msg-poisoning.md | 4 ++++
3 files changed, 7 insertions(+), 4 deletions(-)
create mode 100644 actions/ql/src/change-notes/2026-04-02-alert-msg-poisoning.md
diff --git a/actions/ql/src/Security/CWE-829/ArtifactPoisoningCritical.ql b/actions/ql/src/Security/CWE-829/ArtifactPoisoningCritical.ql
index 24ecb4b0339..fc65f93f5c0 100644
--- a/actions/ql/src/Security/CWE-829/ArtifactPoisoningCritical.ql
+++ b/actions/ql/src/Security/CWE-829/ArtifactPoisoningCritical.ql
@@ -21,5 +21,5 @@ where
ArtifactPoisoningFlow::flowPath(source, sink) and
event = getRelevantEventInPrivilegedContext(sink.getNode())
select sink.getNode(), source, sink,
- "Potential artifact poisoning in $@, which may be controlled by an external user ($@).", sink,
- sink.getNode().toString(), event, event.getName()
+ "Potential artifact poisoning, which may be controlled by an external user ($@).", event,
+ event.getName()
diff --git a/actions/ql/src/Security/CWE-829/ArtifactPoisoningMedium.ql b/actions/ql/src/Security/CWE-829/ArtifactPoisoningMedium.ql
index d2aff7da95f..6caba357114 100644
--- a/actions/ql/src/Security/CWE-829/ArtifactPoisoningMedium.ql
+++ b/actions/ql/src/Security/CWE-829/ArtifactPoisoningMedium.ql
@@ -21,5 +21,4 @@ where
ArtifactPoisoningFlow::flowPath(source, sink) and
inNonPrivilegedContext(sink.getNode().asExpr())
select sink.getNode(), source, sink,
- "Potential artifact poisoning in $@, which may be controlled by an external user.", sink,
- sink.getNode().toString()
+ "Potential artifact poisoning, which may be controlled by an external user."
diff --git a/actions/ql/src/change-notes/2026-04-02-alert-msg-poisoning.md b/actions/ql/src/change-notes/2026-04-02-alert-msg-poisoning.md
new file mode 100644
index 00000000000..5b016941566
--- /dev/null
+++ b/actions/ql/src/change-notes/2026-04-02-alert-msg-poisoning.md
@@ -0,0 +1,4 @@
+---
+category: majorAnalysis
+---
+* Fixed alert messages in `actions/artifact-poisoning/critical` and `actions/artifact-poisoning/medium` as they previously included a redundant placeholder in the alert message that would on occasion contain a long block of yml that makes the alert difficult to understand.
\ No newline at end of file
From 41714656ec52f1dd92b1e47ddb47a4438be05676 Mon Sep 17 00:00:00 2001
From: Kristen Newbury
Date: Thu, 2 Apr 2026 11:58:58 -0400
Subject: [PATCH 054/185] Adjust alert messages actions CWE-829
---
.../CWE-829/ArtifactPoisoningCritical.ql | 4 +--
.../CWE-829/ArtifactPoisoningMedium.ql | 2 +-
.../2026-04-02-alert-msg-poisoning.md | 2 +-
.../ArtifactPoisoningCritical.expected | 36 +++++++++----------
4 files changed, 22 insertions(+), 22 deletions(-)
diff --git a/actions/ql/src/Security/CWE-829/ArtifactPoisoningCritical.ql b/actions/ql/src/Security/CWE-829/ArtifactPoisoningCritical.ql
index fc65f93f5c0..44b69cd46b2 100644
--- a/actions/ql/src/Security/CWE-829/ArtifactPoisoningCritical.ql
+++ b/actions/ql/src/Security/CWE-829/ArtifactPoisoningCritical.ql
@@ -21,5 +21,5 @@ where
ArtifactPoisoningFlow::flowPath(source, sink) and
event = getRelevantEventInPrivilegedContext(sink.getNode())
select sink.getNode(), source, sink,
- "Potential artifact poisoning, which may be controlled by an external user ($@).", event,
- event.getName()
+ "Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@).",
+ event, event.getName()
diff --git a/actions/ql/src/Security/CWE-829/ArtifactPoisoningMedium.ql b/actions/ql/src/Security/CWE-829/ArtifactPoisoningMedium.ql
index 6caba357114..cc5532172e8 100644
--- a/actions/ql/src/Security/CWE-829/ArtifactPoisoningMedium.ql
+++ b/actions/ql/src/Security/CWE-829/ArtifactPoisoningMedium.ql
@@ -21,4 +21,4 @@ where
ArtifactPoisoningFlow::flowPath(source, sink) and
inNonPrivilegedContext(sink.getNode().asExpr())
select sink.getNode(), source, sink,
- "Potential artifact poisoning, which may be controlled by an external user."
+ "Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user."
diff --git a/actions/ql/src/change-notes/2026-04-02-alert-msg-poisoning.md b/actions/ql/src/change-notes/2026-04-02-alert-msg-poisoning.md
index 5b016941566..30936d8b5c5 100644
--- a/actions/ql/src/change-notes/2026-04-02-alert-msg-poisoning.md
+++ b/actions/ql/src/change-notes/2026-04-02-alert-msg-poisoning.md
@@ -1,4 +1,4 @@
---
category: majorAnalysis
---
-* Fixed alert messages in `actions/artifact-poisoning/critical` and `actions/artifact-poisoning/medium` as they previously included a redundant placeholder in the alert message that would on occasion contain a long block of yml that makes the alert difficult to understand.
\ No newline at end of file
+* Fixed alert messages in `actions/artifact-poisoning/critical` and `actions/artifact-poisoning/medium` as they previously included a redundant placeholder in the alert message that would on occasion contain a long block of yml that makes the alert difficult to understand. Also clarify the wording to make it clear that it is not the artifact that is being poisoned, but instead a potentially untrusted artifact that is consumed.
\ No newline at end of file
diff --git a/actions/ql/test/query-tests/Security/CWE-829/ArtifactPoisoningCritical.expected b/actions/ql/test/query-tests/Security/CWE-829/ArtifactPoisoningCritical.expected
index 2d29cd9b79b..75f08e0357e 100644
--- a/actions/ql/test/query-tests/Security/CWE-829/ArtifactPoisoningCritical.expected
+++ b/actions/ql/test/query-tests/Security/CWE-829/ArtifactPoisoningCritical.expected
@@ -55,21 +55,21 @@ nodes
| .github/workflows/test25.yml:39:14:40:45 | ./gradlew buildScanPublishPrevious\n | semmle.label | ./gradlew buildScanPublishPrevious\n |
subpaths
#select
-| .github/workflows/artifactpoisoning11.yml:38:11:38:77 | ./sonarcloud-data/x.py build -j$(nproc) --compiler gcc --skip-build | .github/workflows/artifactpoisoning11.yml:13:9:32:6 | Uses Step | .github/workflows/artifactpoisoning11.yml:38:11:38:77 | ./sonarcloud-data/x.py build -j$(nproc) --compiler gcc --skip-build | Potential artifact poisoning in $@, which may be controlled by an external user ($@). | .github/workflows/artifactpoisoning11.yml:38:11:38:77 | ./sonarcloud-data/x.py build -j$(nproc) --compiler gcc --skip-build | ./sonarcloud-data/x.py build -j$(nproc) --compiler gcc --skip-build | .github/workflows/artifactpoisoning11.yml:4:3:4:14 | workflow_run | workflow_run |
-| .github/workflows/artifactpoisoning12.yml:38:11:38:25 | python foo/x.py | .github/workflows/artifactpoisoning12.yml:13:9:32:6 | Uses Step | .github/workflows/artifactpoisoning12.yml:38:11:38:25 | python foo/x.py | Potential artifact poisoning in $@, which may be controlled by an external user ($@). | .github/workflows/artifactpoisoning12.yml:38:11:38:25 | python foo/x.py | python foo/x.py | .github/workflows/artifactpoisoning12.yml:4:3:4:14 | workflow_run | workflow_run |
-| .github/workflows/artifactpoisoning21.yml:19:14:20:21 | sh foo/cmd\n | .github/workflows/artifactpoisoning21.yml:13:9:18:6 | Uses Step | .github/workflows/artifactpoisoning21.yml:19:14:20:21 | sh foo/cmd\n | Potential artifact poisoning in $@, which may be controlled by an external user ($@). | .github/workflows/artifactpoisoning21.yml:19:14:20:21 | sh foo/cmd\n | sh foo/cmd\n | .github/workflows/artifactpoisoning21.yml:4:3:4:14 | workflow_run | workflow_run |
-| .github/workflows/artifactpoisoning22.yml:18:14:18:19 | sh cmd | .github/workflows/artifactpoisoning22.yml:13:9:17:6 | Uses Step | .github/workflows/artifactpoisoning22.yml:18:14:18:19 | sh cmd | Potential artifact poisoning in $@, which may be controlled by an external user ($@). | .github/workflows/artifactpoisoning22.yml:18:14:18:19 | sh cmd | sh cmd | .github/workflows/artifactpoisoning22.yml:4:3:4:14 | workflow_run | workflow_run |
-| .github/workflows/artifactpoisoning31.yml:19:14:19:22 | ./foo/cmd | .github/workflows/artifactpoisoning31.yml:13:9:15:6 | Run Step | .github/workflows/artifactpoisoning31.yml:19:14:19:22 | ./foo/cmd | Potential artifact poisoning in $@, which may be controlled by an external user ($@). | .github/workflows/artifactpoisoning31.yml:19:14:19:22 | ./foo/cmd | ./foo/cmd | .github/workflows/artifactpoisoning31.yml:4:3:4:14 | workflow_run | workflow_run |
-| .github/workflows/artifactpoisoning32.yml:17:14:18:20 | ./bar/cmd\n | .github/workflows/artifactpoisoning32.yml:13:9:16:6 | Run Step | .github/workflows/artifactpoisoning32.yml:17:14:18:20 | ./bar/cmd\n | Potential artifact poisoning in $@, which may be controlled by an external user ($@). | .github/workflows/artifactpoisoning32.yml:17:14:18:20 | ./bar/cmd\n | ./bar/cmd\n | .github/workflows/artifactpoisoning32.yml:4:3:4:14 | workflow_run | workflow_run |
-| .github/workflows/artifactpoisoning33.yml:17:14:18:20 | ./bar/cmd\n | .github/workflows/artifactpoisoning33.yml:13:9:16:6 | Run Step | .github/workflows/artifactpoisoning33.yml:17:14:18:20 | ./bar/cmd\n | Potential artifact poisoning in $@, which may be controlled by an external user ($@). | .github/workflows/artifactpoisoning33.yml:17:14:18:20 | ./bar/cmd\n | ./bar/cmd\n | .github/workflows/artifactpoisoning33.yml:4:3:4:14 | workflow_run | workflow_run |
-| .github/workflows/artifactpoisoning34.yml:20:14:22:23 | npm install\nnpm run lint\n | .github/workflows/artifactpoisoning34.yml:13:9:16:6 | Run Step | .github/workflows/artifactpoisoning34.yml:20:14:22:23 | npm install\nnpm run lint\n | Potential artifact poisoning in $@, which may be controlled by an external user ($@). | .github/workflows/artifactpoisoning34.yml:20:14:22:23 | npm install\nnpm run lint\n | npm install\nnpm run lint\n | .github/workflows/artifactpoisoning34.yml:4:3:4:14 | workflow_run | workflow_run |
-| .github/workflows/artifactpoisoning41.yml:22:14:22:22 | ./foo/cmd | .github/workflows/artifactpoisoning41.yml:13:9:21:6 | Run Step | .github/workflows/artifactpoisoning41.yml:22:14:22:22 | ./foo/cmd | Potential artifact poisoning in $@, which may be controlled by an external user ($@). | .github/workflows/artifactpoisoning41.yml:22:14:22:22 | ./foo/cmd | ./foo/cmd | .github/workflows/artifactpoisoning41.yml:4:3:4:14 | workflow_run | workflow_run |
-| .github/workflows/artifactpoisoning42.yml:22:14:22:18 | ./cmd | .github/workflows/artifactpoisoning42.yml:13:9:21:6 | Run Step | .github/workflows/artifactpoisoning42.yml:22:14:22:18 | ./cmd | Potential artifact poisoning in $@, which may be controlled by an external user ($@). | .github/workflows/artifactpoisoning42.yml:22:14:22:18 | ./cmd | ./cmd | .github/workflows/artifactpoisoning42.yml:4:3:4:14 | workflow_run | workflow_run |
-| .github/workflows/artifactpoisoning71.yml:17:14:18:40 | sed -f config foo.md > bar.md\n | .github/workflows/artifactpoisoning71.yml:9:9:16:6 | Uses Step | .github/workflows/artifactpoisoning71.yml:17:14:18:40 | sed -f config foo.md > bar.md\n | Potential artifact poisoning in $@, which may be controlled by an external user ($@). | .github/workflows/artifactpoisoning71.yml:17:14:18:40 | sed -f config foo.md > bar.md\n | sed -f config foo.md > bar.md\n | .github/workflows/artifactpoisoning71.yml:4:5:4:16 | workflow_run | workflow_run |
-| .github/workflows/artifactpoisoning81.yml:31:14:31:27 | python test.py | .github/workflows/artifactpoisoning81.yml:28:9:31:6 | Uses Step | .github/workflows/artifactpoisoning81.yml:31:14:31:27 | python test.py | Potential artifact poisoning in $@, which may be controlled by an external user ($@). | .github/workflows/artifactpoisoning81.yml:31:14:31:27 | python test.py | python test.py | .github/workflows/artifactpoisoning81.yml:3:5:3:23 | pull_request_target | pull_request_target |
-| .github/workflows/artifactpoisoning92.yml:28:9:29:6 | Uses Step | .github/actions/download-artifact-2/action.yaml:6:7:25:4 | Uses Step | .github/workflows/artifactpoisoning92.yml:28:9:29:6 | Uses Step | Potential artifact poisoning in $@, which may be controlled by an external user ($@). | .github/workflows/artifactpoisoning92.yml:28:9:29:6 | Uses Step | Uses Step | .github/workflows/artifactpoisoning92.yml:3:3:3:14 | workflow_run | workflow_run |
-| .github/workflows/artifactpoisoning92.yml:29:14:29:26 | make snapshot | .github/actions/download-artifact-2/action.yaml:6:7:25:4 | Uses Step | .github/workflows/artifactpoisoning92.yml:29:14:29:26 | make snapshot | Potential artifact poisoning in $@, which may be controlled by an external user ($@). | .github/workflows/artifactpoisoning92.yml:29:14:29:26 | make snapshot | make snapshot | .github/workflows/artifactpoisoning92.yml:3:3:3:14 | workflow_run | workflow_run |
-| .github/workflows/artifactpoisoning96.yml:18:14:18:24 | npm install | .github/workflows/artifactpoisoning96.yml:13:9:18:6 | Uses Step | .github/workflows/artifactpoisoning96.yml:18:14:18:24 | npm install | Potential artifact poisoning in $@, which may be controlled by an external user ($@). | .github/workflows/artifactpoisoning96.yml:18:14:18:24 | npm install | npm install | .github/workflows/artifactpoisoning96.yml:2:3:2:14 | workflow_run | workflow_run |
-| .github/workflows/artifactpoisoning101.yml:17:14:19:59 | PR_NUMBER=$(./get_pull_request_number.sh pr_number.txt)\necho "PR_NUMBER=$PR_NUMBER" >> $GITHUB_OUTPUT \n | .github/workflows/artifactpoisoning101.yml:10:9:16:6 | Uses Step | .github/workflows/artifactpoisoning101.yml:17:14:19:59 | PR_NUMBER=$(./get_pull_request_number.sh pr_number.txt)\necho "PR_NUMBER=$PR_NUMBER" >> $GITHUB_OUTPUT \n | Potential artifact poisoning in $@, which may be controlled by an external user ($@). | .github/workflows/artifactpoisoning101.yml:17:14:19:59 | PR_NUMBER=$(./get_pull_request_number.sh pr_number.txt)\necho "PR_NUMBER=$PR_NUMBER" >> $GITHUB_OUTPUT \n | PR_NUMBER=$(./get_pull_request_number.sh pr_number.txt)\necho "PR_NUMBER=$PR_NUMBER" >> $GITHUB_OUTPUT \n | .github/workflows/artifactpoisoning101.yml:4:3:4:21 | pull_request_target | pull_request_target |
-| .github/workflows/test18.yml:36:15:40:58 | Uses Step | .github/workflows/test18.yml:12:15:33:12 | Uses Step | .github/workflows/test18.yml:36:15:40:58 | Uses Step | Potential artifact poisoning in $@, which may be controlled by an external user ($@). | .github/workflows/test18.yml:36:15:40:58 | Uses Step | Uses Step | .github/workflows/test18.yml:3:5:3:16 | workflow_run | workflow_run |
-| .github/workflows/test25.yml:39:14:40:45 | ./gradlew buildScanPublishPrevious\n | .github/workflows/test25.yml:22:9:32:6 | Uses Step: downloadBuildScan | .github/workflows/test25.yml:39:14:40:45 | ./gradlew buildScanPublishPrevious\n | Potential artifact poisoning in $@, which may be controlled by an external user ($@). | .github/workflows/test25.yml:39:14:40:45 | ./gradlew buildScanPublishPrevious\n | ./gradlew buildScanPublishPrevious\n | .github/workflows/test25.yml:2:3:2:14 | workflow_run | workflow_run |
+| .github/workflows/artifactpoisoning11.yml:38:11:38:77 | ./sonarcloud-data/x.py build -j$(nproc) --compiler gcc --skip-build | .github/workflows/artifactpoisoning11.yml:13:9:32:6 | Uses Step | .github/workflows/artifactpoisoning11.yml:38:11:38:77 | ./sonarcloud-data/x.py build -j$(nproc) --compiler gcc --skip-build | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning11.yml:4:3:4:14 | workflow_run | workflow_run |
+| .github/workflows/artifactpoisoning12.yml:38:11:38:25 | python foo/x.py | .github/workflows/artifactpoisoning12.yml:13:9:32:6 | Uses Step | .github/workflows/artifactpoisoning12.yml:38:11:38:25 | python foo/x.py | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning12.yml:4:3:4:14 | workflow_run | workflow_run |
+| .github/workflows/artifactpoisoning21.yml:19:14:20:21 | sh foo/cmd\n | .github/workflows/artifactpoisoning21.yml:13:9:18:6 | Uses Step | .github/workflows/artifactpoisoning21.yml:19:14:20:21 | sh foo/cmd\n | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning21.yml:4:3:4:14 | workflow_run | workflow_run |
+| .github/workflows/artifactpoisoning22.yml:18:14:18:19 | sh cmd | .github/workflows/artifactpoisoning22.yml:13:9:17:6 | Uses Step | .github/workflows/artifactpoisoning22.yml:18:14:18:19 | sh cmd | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning22.yml:4:3:4:14 | workflow_run | workflow_run |
+| .github/workflows/artifactpoisoning31.yml:19:14:19:22 | ./foo/cmd | .github/workflows/artifactpoisoning31.yml:13:9:15:6 | Run Step | .github/workflows/artifactpoisoning31.yml:19:14:19:22 | ./foo/cmd | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning31.yml:4:3:4:14 | workflow_run | workflow_run |
+| .github/workflows/artifactpoisoning32.yml:17:14:18:20 | ./bar/cmd\n | .github/workflows/artifactpoisoning32.yml:13:9:16:6 | Run Step | .github/workflows/artifactpoisoning32.yml:17:14:18:20 | ./bar/cmd\n | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning32.yml:4:3:4:14 | workflow_run | workflow_run |
+| .github/workflows/artifactpoisoning33.yml:17:14:18:20 | ./bar/cmd\n | .github/workflows/artifactpoisoning33.yml:13:9:16:6 | Run Step | .github/workflows/artifactpoisoning33.yml:17:14:18:20 | ./bar/cmd\n | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning33.yml:4:3:4:14 | workflow_run | workflow_run |
+| .github/workflows/artifactpoisoning34.yml:20:14:22:23 | npm install\nnpm run lint\n | .github/workflows/artifactpoisoning34.yml:13:9:16:6 | Run Step | .github/workflows/artifactpoisoning34.yml:20:14:22:23 | npm install\nnpm run lint\n | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning34.yml:4:3:4:14 | workflow_run | workflow_run |
+| .github/workflows/artifactpoisoning41.yml:22:14:22:22 | ./foo/cmd | .github/workflows/artifactpoisoning41.yml:13:9:21:6 | Run Step | .github/workflows/artifactpoisoning41.yml:22:14:22:22 | ./foo/cmd | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning41.yml:4:3:4:14 | workflow_run | workflow_run |
+| .github/workflows/artifactpoisoning42.yml:22:14:22:18 | ./cmd | .github/workflows/artifactpoisoning42.yml:13:9:21:6 | Run Step | .github/workflows/artifactpoisoning42.yml:22:14:22:18 | ./cmd | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning42.yml:4:3:4:14 | workflow_run | workflow_run |
+| .github/workflows/artifactpoisoning71.yml:17:14:18:40 | sed -f config foo.md > bar.md\n | .github/workflows/artifactpoisoning71.yml:9:9:16:6 | Uses Step | .github/workflows/artifactpoisoning71.yml:17:14:18:40 | sed -f config foo.md > bar.md\n | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning71.yml:4:5:4:16 | workflow_run | workflow_run |
+| .github/workflows/artifactpoisoning81.yml:31:14:31:27 | python test.py | .github/workflows/artifactpoisoning81.yml:28:9:31:6 | Uses Step | .github/workflows/artifactpoisoning81.yml:31:14:31:27 | python test.py | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning81.yml:3:5:3:23 | pull_request_target | pull_request_target |
+| .github/workflows/artifactpoisoning92.yml:28:9:29:6 | Uses Step | .github/actions/download-artifact-2/action.yaml:6:7:25:4 | Uses Step | .github/workflows/artifactpoisoning92.yml:28:9:29:6 | Uses Step | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning92.yml:3:3:3:14 | workflow_run | workflow_run |
+| .github/workflows/artifactpoisoning92.yml:29:14:29:26 | make snapshot | .github/actions/download-artifact-2/action.yaml:6:7:25:4 | Uses Step | .github/workflows/artifactpoisoning92.yml:29:14:29:26 | make snapshot | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning92.yml:3:3:3:14 | workflow_run | workflow_run |
+| .github/workflows/artifactpoisoning96.yml:18:14:18:24 | npm install | .github/workflows/artifactpoisoning96.yml:13:9:18:6 | Uses Step | .github/workflows/artifactpoisoning96.yml:18:14:18:24 | npm install | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning96.yml:2:3:2:14 | workflow_run | workflow_run |
+| .github/workflows/artifactpoisoning101.yml:17:14:19:59 | PR_NUMBER=$(./get_pull_request_number.sh pr_number.txt)\necho "PR_NUMBER=$PR_NUMBER" >> $GITHUB_OUTPUT \n | .github/workflows/artifactpoisoning101.yml:10:9:16:6 | Uses Step | .github/workflows/artifactpoisoning101.yml:17:14:19:59 | PR_NUMBER=$(./get_pull_request_number.sh pr_number.txt)\necho "PR_NUMBER=$PR_NUMBER" >> $GITHUB_OUTPUT \n | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning101.yml:4:3:4:21 | pull_request_target | pull_request_target |
+| .github/workflows/test18.yml:36:15:40:58 | Uses Step | .github/workflows/test18.yml:12:15:33:12 | Uses Step | .github/workflows/test18.yml:36:15:40:58 | Uses Step | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/test18.yml:3:5:3:16 | workflow_run | workflow_run |
+| .github/workflows/test25.yml:39:14:40:45 | ./gradlew buildScanPublishPrevious\n | .github/workflows/test25.yml:22:9:32:6 | Uses Step: downloadBuildScan | .github/workflows/test25.yml:39:14:40:45 | ./gradlew buildScanPublishPrevious\n | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/test25.yml:2:3:2:14 | workflow_run | workflow_run |
From 20cfe291995f1631f9672a8f19aab75a7bfbf511 Mon Sep 17 00:00:00 2001
From: MarkLee131
Date: Sat, 4 Apr 2026 20:56:53 +0800
Subject: [PATCH 055/185] Java: reduce false positives in sensitive-log by
expanding FP exclusion regex
The getCommonSensitiveInfoFPRegex() only excluded "null", "tokenizer", and
"tokenImage", causing widespread false positives for common non-sensitive
variable names containing "token" or "secret".
This adds exclusions for three categories:
- Pagination/iteration tokens: nextToken (AWS SDK), pageToken (GCP),
continuationToken (Azure), etc.
- Token metadata: tokenType (OAuth), tokenEndpoint (OIDC), tokenCount,
tokenIndex, tokenLength, tokenUrl, etc.
- Secret metadata: secretName (K8s/AWS), secretId (Azure),
secretVersion, secretArn, secretPath, etc.
All truly sensitive variable names (accessToken, clientSecret, secretKey,
refreshToken, etc.) remain correctly flagged.
---
.../2026-04-04-sensitive-log-fp-reduction.md | 4 ++
.../code/java/security/SensitiveActions.qll | 20 ++++++-
.../CWE-532/SensitiveLogInfo.expected | 32 ++++++++++++
.../query-tests/security/CWE-532/Test.java | 52 +++++++++++++++++++
4 files changed, 106 insertions(+), 2 deletions(-)
create mode 100644 java/ql/lib/change-notes/2026-04-04-sensitive-log-fp-reduction.md
diff --git a/java/ql/lib/change-notes/2026-04-04-sensitive-log-fp-reduction.md b/java/ql/lib/change-notes/2026-04-04-sensitive-log-fp-reduction.md
new file mode 100644
index 00000000000..15fc811360b
--- /dev/null
+++ b/java/ql/lib/change-notes/2026-04-04-sensitive-log-fp-reduction.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The `java/sensitive-log` query now excludes additional common variable naming patterns that do not hold sensitive data, reducing false positives. This includes pagination/iteration tokens (`nextToken`, `pageToken`, `continuationToken`), token metadata (`tokenType`, `tokenEndpoint`, `tokenCount`), and secret metadata (`secretName`, `secretId`, `secretVersion`).
diff --git a/java/ql/lib/semmle/code/java/security/SensitiveActions.qll b/java/ql/lib/semmle/code/java/security/SensitiveActions.qll
index 6733219a8d5..efbc22b0b29 100644
--- a/java/ql/lib/semmle/code/java/security/SensitiveActions.qll
+++ b/java/ql/lib/semmle/code/java/security/SensitiveActions.qll
@@ -40,14 +40,30 @@ string getCommonSensitiveInfoRegex() {
/**
* Gets a regular expression for matching common names of variables that
- * indicate the value being held does not contains sensitive information,
+ * indicate the value being held does not contain sensitive information,
* but is a false positive for `getCommonSensitiveInfoRegex`.
*
* - "tokenizer" is often used for java.util.StringTokenizer.
* - "tokenImage" appears in parser code generated by JavaCC.
+ * - Pagination/iteration tokens: "nextToken" (AWS SDK), "pageToken" (GCP), etc.
+ * - Token metadata: "tokenType" (OAuth), "tokenEndpoint" (OIDC), "tokenCount", etc.
+ * - Secret metadata: "secretName" (K8s/AWS), "secretId" (Azure), "secretVersion", etc.
*/
string getCommonSensitiveInfoFPRegex() {
- result = "(?i).*(null|tokenizer).*" or result = "tokenImage"
+ result = "(?i).*(null|tokenizer).*"
+ or
+ result = "tokenImage"
+ or
+ // Pagination/iteration tokens (e.g., AWS SDK pagination cursors, parser tokens)
+ result = "(?i).*(next|previous|current|page|continuation|cursor)tokens?.*"
+ or
+ // Token metadata/infrastructure (token followed by a non-value descriptor)
+ result =
+ "(?i).*tokens?(type|kind|count|index|position|length|offset|endpoint|url|uri|bucket|rate|delimiter|separator|format|number|name|id|prefix|suffix|pattern|class|style).*"
+ or
+ // Secret metadata (secret followed by a non-value descriptor)
+ result =
+ "(?i).*secrets?(name|id|version|ref|arn|path|type|label|description|question|manager|client|provider|store|factory|properties).*"
}
/** An expression that might contain sensitive data. */
diff --git a/java/ql/test/query-tests/security/CWE-532/SensitiveLogInfo.expected b/java/ql/test/query-tests/security/CWE-532/SensitiveLogInfo.expected
index 54f1e9f8a5a..ad3715ec7e2 100644
--- a/java/ql/test/query-tests/security/CWE-532/SensitiveLogInfo.expected
+++ b/java/ql/test/query-tests/security/CWE-532/SensitiveLogInfo.expected
@@ -3,6 +3,14 @@
| Test.java:12:22:12:52 | ... + ... | Test.java:12:44:12:52 | authToken : String | Test.java:12:22:12:52 | ... + ... | This $@ is written to a log file. | Test.java:12:44:12:52 | authToken | potentially sensitive information |
| Test.java:21:22:21:75 | ... + ... | Test.java:21:44:21:52 | authToken : String | Test.java:21:22:21:75 | ... + ... | This $@ is written to a log file. | Test.java:21:44:21:52 | authToken | potentially sensitive information |
| Test.java:22:22:22:75 | ... + ... | Test.java:22:44:22:52 | authToken : String | Test.java:22:22:22:75 | ... + ... | This $@ is written to a log file. | Test.java:22:44:22:52 | authToken | potentially sensitive information |
+| Test.java:67:21:67:43 | ... + ... | Test.java:67:33:67:43 | accessToken : String | Test.java:67:21:67:43 | ... + ... | This $@ is written to a log file. | Test.java:67:33:67:43 | accessToken | potentially sensitive information |
+| Test.java:68:21:68:45 | ... + ... | Test.java:68:34:68:45 | clientSecret : String | Test.java:68:21:68:45 | ... + ... | This $@ is written to a log file. | Test.java:68:34:68:45 | clientSecret | potentially sensitive information |
+| Test.java:69:21:69:42 | ... + ... | Test.java:69:34:69:42 | apiSecret : String | Test.java:69:21:69:42 | ... + ... | This $@ is written to a log file. | Test.java:69:34:69:42 | apiSecret | potentially sensitive information |
+| Test.java:70:21:70:44 | ... + ... | Test.java:70:33:70:44 | sessionToken : String | Test.java:70:21:70:44 | ... + ... | This $@ is written to a log file. | Test.java:70:33:70:44 | sessionToken | potentially sensitive information |
+| Test.java:71:21:71:43 | ... + ... | Test.java:71:33:71:43 | bearerToken : String | Test.java:71:21:71:43 | ... + ... | This $@ is written to a log file. | Test.java:71:33:71:43 | bearerToken | potentially sensitive information |
+| Test.java:72:21:72:39 | ... + ... | Test.java:72:31:72:39 | secretKey : String | Test.java:72:21:72:39 | ... + ... | This $@ is written to a log file. | Test.java:72:31:72:39 | secretKey | potentially sensitive information |
+| Test.java:73:21:73:44 | ... + ... | Test.java:73:33:73:44 | refreshToken : String | Test.java:73:21:73:44 | ... + ... | This $@ is written to a log file. | Test.java:73:33:73:44 | refreshToken | potentially sensitive information |
+| Test.java:74:21:74:43 | ... + ... | Test.java:74:33:74:43 | secretValue : String | Test.java:74:21:74:43 | ... + ... | This $@ is written to a log file. | Test.java:74:33:74:43 | secretValue | potentially sensitive information |
edges
| Test.java:11:46:11:53 | password : String | Test.java:11:21:11:53 | ... + ... | provenance | Sink:MaD:2 |
| Test.java:12:44:12:52 | authToken : String | Test.java:12:22:12:52 | ... + ... | provenance | Sink:MaD:1 |
@@ -10,6 +18,14 @@ edges
| Test.java:21:44:21:67 | substring(...) : String | Test.java:21:22:21:75 | ... + ... | provenance | Sink:MaD:1 |
| Test.java:22:44:22:52 | authToken : String | Test.java:22:44:22:67 | substring(...) : String | provenance | MaD:3 |
| Test.java:22:44:22:67 | substring(...) : String | Test.java:22:22:22:75 | ... + ... | provenance | Sink:MaD:1 |
+| Test.java:67:33:67:43 | accessToken : String | Test.java:67:21:67:43 | ... + ... | provenance | Sink:MaD:2 |
+| Test.java:68:34:68:45 | clientSecret : String | Test.java:68:21:68:45 | ... + ... | provenance | Sink:MaD:2 |
+| Test.java:69:34:69:42 | apiSecret : String | Test.java:69:21:69:42 | ... + ... | provenance | Sink:MaD:2 |
+| Test.java:70:33:70:44 | sessionToken : String | Test.java:70:21:70:44 | ... + ... | provenance | Sink:MaD:2 |
+| Test.java:71:33:71:43 | bearerToken : String | Test.java:71:21:71:43 | ... + ... | provenance | Sink:MaD:2 |
+| Test.java:72:31:72:39 | secretKey : String | Test.java:72:21:72:39 | ... + ... | provenance | Sink:MaD:2 |
+| Test.java:73:33:73:44 | refreshToken : String | Test.java:73:21:73:44 | ... + ... | provenance | Sink:MaD:2 |
+| Test.java:74:33:74:43 | secretValue : String | Test.java:74:21:74:43 | ... + ... | provenance | Sink:MaD:2 |
models
| 1 | Sink: org.apache.logging.log4j; Logger; true; error; (String); ; Argument[0]; log-injection; manual |
| 2 | Sink: org.apache.logging.log4j; Logger; true; info; (String); ; Argument[0]; log-injection; manual |
@@ -25,4 +41,20 @@ nodes
| Test.java:22:22:22:75 | ... + ... | semmle.label | ... + ... |
| Test.java:22:44:22:52 | authToken : String | semmle.label | authToken : String |
| Test.java:22:44:22:67 | substring(...) : String | semmle.label | substring(...) : String |
+| Test.java:67:21:67:43 | ... + ... | semmle.label | ... + ... |
+| Test.java:67:33:67:43 | accessToken : String | semmle.label | accessToken : String |
+| Test.java:68:21:68:45 | ... + ... | semmle.label | ... + ... |
+| Test.java:68:34:68:45 | clientSecret : String | semmle.label | clientSecret : String |
+| Test.java:69:21:69:42 | ... + ... | semmle.label | ... + ... |
+| Test.java:69:34:69:42 | apiSecret : String | semmle.label | apiSecret : String |
+| Test.java:70:21:70:44 | ... + ... | semmle.label | ... + ... |
+| Test.java:70:33:70:44 | sessionToken : String | semmle.label | sessionToken : String |
+| Test.java:71:21:71:43 | ... + ... | semmle.label | ... + ... |
+| Test.java:71:33:71:43 | bearerToken : String | semmle.label | bearerToken : String |
+| Test.java:72:21:72:39 | ... + ... | semmle.label | ... + ... |
+| Test.java:72:31:72:39 | secretKey : String | semmle.label | secretKey : String |
+| Test.java:73:21:73:44 | ... + ... | semmle.label | ... + ... |
+| Test.java:73:33:73:44 | refreshToken : String | semmle.label | refreshToken : String |
+| Test.java:74:21:74:43 | ... + ... | semmle.label | ... + ... |
+| Test.java:74:33:74:43 | secretValue : String | semmle.label | secretValue : String |
subpaths
diff --git a/java/ql/test/query-tests/security/CWE-532/Test.java b/java/ql/test/query-tests/security/CWE-532/Test.java
index 6521f7e2df7..759228ae3ec 100644
--- a/java/ql/test/query-tests/security/CWE-532/Test.java
+++ b/java/ql/test/query-tests/security/CWE-532/Test.java
@@ -21,4 +21,56 @@ class Test {
logger.error("Auth failed for: " + authToken.substring(1,5) + "..."); // $ Alert
logger.error("Auth failed for: " + authToken.substring(0,8) + "..."); // $ Alert
}
+
+ // Tests for false positive exclusions: variables with "token" or "secret" in the name
+ // that do not hold sensitive data.
+ void testFalsePositiveExclusions(
+ String nextToken, String pageToken, String continuationToken, String cursorToken,
+ String tokenType, String tokenEndpoint, String tokenCount, String tokenUrl,
+ String tokenIndex, String tokenLength, String tokenName, String tokenId,
+ String secretName, String secretId, String secretVersion, String secretArn,
+ String secretPath, String secretType, String secretQuestion,
+ String secretManager, String secretProperties
+ ) {
+ Logger logger = null;
+ // Pagination/iteration tokens (e.g., AWS SDK, GCP, Azure pagination cursors)
+ logger.info("cursor: " + nextToken); // Safe
+ logger.info("cursor: " + pageToken); // Safe
+ logger.info("cursor: " + continuationToken); // Safe
+ logger.info("cursor: " + cursorToken); // Safe
+ // Token metadata (e.g., OAuth token type, OIDC discovery endpoint)
+ logger.info("type: " + tokenType); // Safe
+ logger.info("endpoint: " + tokenEndpoint); // Safe
+ logger.info("count: " + tokenCount); // Safe
+ logger.info("url: " + tokenUrl); // Safe
+ logger.info("index: " + tokenIndex); // Safe
+ logger.info("length: " + tokenLength); // Safe
+ logger.info("name: " + tokenName); // Safe
+ logger.info("id: " + tokenId); // Safe
+ // Secret metadata (e.g., K8s secret name, AWS Secrets Manager identifiers)
+ logger.info("name: " + secretName); // Safe
+ logger.info("id: " + secretId); // Safe
+ logger.info("version: " + secretVersion); // Safe
+ logger.info("arn: " + secretArn); // Safe
+ logger.info("path: " + secretPath); // Safe
+ logger.info("type: " + secretType); // Safe
+ logger.info("question: " + secretQuestion); // Safe
+ logger.info("manager: " + secretManager); // Safe
+ logger.info("properties: " + secretProperties); // Safe
+ }
+
+ // These should still be flagged as sensitive
+ void testTruePositives(String accessToken, String clientSecret, String apiSecret,
+ String sessionToken, String bearerToken, String secretKey,
+ String refreshToken, String secretValue) {
+ Logger logger = null;
+ logger.info("token: " + accessToken); // $ Alert
+ logger.info("secret: " + clientSecret); // $ Alert
+ logger.info("secret: " + apiSecret); // $ Alert
+ logger.info("token: " + sessionToken); // $ Alert
+ logger.info("token: " + bearerToken); // $ Alert
+ logger.info("key: " + secretKey); // $ Alert
+ logger.info("token: " + refreshToken); // $ Alert
+ logger.info("value: " + secretValue); // $ Alert
+ }
}
From 46ef0204ef019d7b073ae1d5c275660be157e5b4 Mon Sep 17 00:00:00 2001
From: MarkLee131
Date: Sat, 4 Apr 2026 21:58:32 +0800
Subject: [PATCH 056/185] Remove secretQuestion from FP exclusion list
secretQuestion is ambiguous: it could be the question text (not
sensitive) or a security question answer. Worse, the regex
secrets?(question) also matches secretQuestionAnswer, which is
clearly sensitive. Drop it to avoid false negatives.
---
.../code/java/security/SensitiveActions.qll | 2 +-
.../CWE-532/SensitiveLogInfo.expected | 64 +++++++++----------
.../query-tests/security/CWE-532/Test.java | 3 +-
3 files changed, 34 insertions(+), 35 deletions(-)
diff --git a/java/ql/lib/semmle/code/java/security/SensitiveActions.qll b/java/ql/lib/semmle/code/java/security/SensitiveActions.qll
index efbc22b0b29..a4adcd7c341 100644
--- a/java/ql/lib/semmle/code/java/security/SensitiveActions.qll
+++ b/java/ql/lib/semmle/code/java/security/SensitiveActions.qll
@@ -63,7 +63,7 @@ string getCommonSensitiveInfoFPRegex() {
or
// Secret metadata (secret followed by a non-value descriptor)
result =
- "(?i).*secrets?(name|id|version|ref|arn|path|type|label|description|question|manager|client|provider|store|factory|properties).*"
+ "(?i).*secrets?(name|id|version|ref|arn|path|type|label|description|manager|client|provider|store|factory|properties).*"
}
/** An expression that might contain sensitive data. */
diff --git a/java/ql/test/query-tests/security/CWE-532/SensitiveLogInfo.expected b/java/ql/test/query-tests/security/CWE-532/SensitiveLogInfo.expected
index ad3715ec7e2..4a5ed058b50 100644
--- a/java/ql/test/query-tests/security/CWE-532/SensitiveLogInfo.expected
+++ b/java/ql/test/query-tests/security/CWE-532/SensitiveLogInfo.expected
@@ -3,14 +3,14 @@
| Test.java:12:22:12:52 | ... + ... | Test.java:12:44:12:52 | authToken : String | Test.java:12:22:12:52 | ... + ... | This $@ is written to a log file. | Test.java:12:44:12:52 | authToken | potentially sensitive information |
| Test.java:21:22:21:75 | ... + ... | Test.java:21:44:21:52 | authToken : String | Test.java:21:22:21:75 | ... + ... | This $@ is written to a log file. | Test.java:21:44:21:52 | authToken | potentially sensitive information |
| Test.java:22:22:22:75 | ... + ... | Test.java:22:44:22:52 | authToken : String | Test.java:22:22:22:75 | ... + ... | This $@ is written to a log file. | Test.java:22:44:22:52 | authToken | potentially sensitive information |
-| Test.java:67:21:67:43 | ... + ... | Test.java:67:33:67:43 | accessToken : String | Test.java:67:21:67:43 | ... + ... | This $@ is written to a log file. | Test.java:67:33:67:43 | accessToken | potentially sensitive information |
-| Test.java:68:21:68:45 | ... + ... | Test.java:68:34:68:45 | clientSecret : String | Test.java:68:21:68:45 | ... + ... | This $@ is written to a log file. | Test.java:68:34:68:45 | clientSecret | potentially sensitive information |
-| Test.java:69:21:69:42 | ... + ... | Test.java:69:34:69:42 | apiSecret : String | Test.java:69:21:69:42 | ... + ... | This $@ is written to a log file. | Test.java:69:34:69:42 | apiSecret | potentially sensitive information |
-| Test.java:70:21:70:44 | ... + ... | Test.java:70:33:70:44 | sessionToken : String | Test.java:70:21:70:44 | ... + ... | This $@ is written to a log file. | Test.java:70:33:70:44 | sessionToken | potentially sensitive information |
-| Test.java:71:21:71:43 | ... + ... | Test.java:71:33:71:43 | bearerToken : String | Test.java:71:21:71:43 | ... + ... | This $@ is written to a log file. | Test.java:71:33:71:43 | bearerToken | potentially sensitive information |
-| Test.java:72:21:72:39 | ... + ... | Test.java:72:31:72:39 | secretKey : String | Test.java:72:21:72:39 | ... + ... | This $@ is written to a log file. | Test.java:72:31:72:39 | secretKey | potentially sensitive information |
-| Test.java:73:21:73:44 | ... + ... | Test.java:73:33:73:44 | refreshToken : String | Test.java:73:21:73:44 | ... + ... | This $@ is written to a log file. | Test.java:73:33:73:44 | refreshToken | potentially sensitive information |
-| Test.java:74:21:74:43 | ... + ... | Test.java:74:33:74:43 | secretValue : String | Test.java:74:21:74:43 | ... + ... | This $@ is written to a log file. | Test.java:74:33:74:43 | secretValue | potentially sensitive information |
+| Test.java:66:21:66:43 | ... + ... | Test.java:66:33:66:43 | accessToken : String | Test.java:66:21:66:43 | ... + ... | This $@ is written to a log file. | Test.java:66:33:66:43 | accessToken | potentially sensitive information |
+| Test.java:67:21:67:45 | ... + ... | Test.java:67:34:67:45 | clientSecret : String | Test.java:67:21:67:45 | ... + ... | This $@ is written to a log file. | Test.java:67:34:67:45 | clientSecret | potentially sensitive information |
+| Test.java:68:21:68:42 | ... + ... | Test.java:68:34:68:42 | apiSecret : String | Test.java:68:21:68:42 | ... + ... | This $@ is written to a log file. | Test.java:68:34:68:42 | apiSecret | potentially sensitive information |
+| Test.java:69:21:69:44 | ... + ... | Test.java:69:33:69:44 | sessionToken : String | Test.java:69:21:69:44 | ... + ... | This $@ is written to a log file. | Test.java:69:33:69:44 | sessionToken | potentially sensitive information |
+| Test.java:70:21:70:43 | ... + ... | Test.java:70:33:70:43 | bearerToken : String | Test.java:70:21:70:43 | ... + ... | This $@ is written to a log file. | Test.java:70:33:70:43 | bearerToken | potentially sensitive information |
+| Test.java:71:21:71:39 | ... + ... | Test.java:71:31:71:39 | secretKey : String | Test.java:71:21:71:39 | ... + ... | This $@ is written to a log file. | Test.java:71:31:71:39 | secretKey | potentially sensitive information |
+| Test.java:72:21:72:44 | ... + ... | Test.java:72:33:72:44 | refreshToken : String | Test.java:72:21:72:44 | ... + ... | This $@ is written to a log file. | Test.java:72:33:72:44 | refreshToken | potentially sensitive information |
+| Test.java:73:21:73:43 | ... + ... | Test.java:73:33:73:43 | secretValue : String | Test.java:73:21:73:43 | ... + ... | This $@ is written to a log file. | Test.java:73:33:73:43 | secretValue | potentially sensitive information |
edges
| Test.java:11:46:11:53 | password : String | Test.java:11:21:11:53 | ... + ... | provenance | Sink:MaD:2 |
| Test.java:12:44:12:52 | authToken : String | Test.java:12:22:12:52 | ... + ... | provenance | Sink:MaD:1 |
@@ -18,14 +18,14 @@ edges
| Test.java:21:44:21:67 | substring(...) : String | Test.java:21:22:21:75 | ... + ... | provenance | Sink:MaD:1 |
| Test.java:22:44:22:52 | authToken : String | Test.java:22:44:22:67 | substring(...) : String | provenance | MaD:3 |
| Test.java:22:44:22:67 | substring(...) : String | Test.java:22:22:22:75 | ... + ... | provenance | Sink:MaD:1 |
-| Test.java:67:33:67:43 | accessToken : String | Test.java:67:21:67:43 | ... + ... | provenance | Sink:MaD:2 |
-| Test.java:68:34:68:45 | clientSecret : String | Test.java:68:21:68:45 | ... + ... | provenance | Sink:MaD:2 |
-| Test.java:69:34:69:42 | apiSecret : String | Test.java:69:21:69:42 | ... + ... | provenance | Sink:MaD:2 |
-| Test.java:70:33:70:44 | sessionToken : String | Test.java:70:21:70:44 | ... + ... | provenance | Sink:MaD:2 |
-| Test.java:71:33:71:43 | bearerToken : String | Test.java:71:21:71:43 | ... + ... | provenance | Sink:MaD:2 |
-| Test.java:72:31:72:39 | secretKey : String | Test.java:72:21:72:39 | ... + ... | provenance | Sink:MaD:2 |
-| Test.java:73:33:73:44 | refreshToken : String | Test.java:73:21:73:44 | ... + ... | provenance | Sink:MaD:2 |
-| Test.java:74:33:74:43 | secretValue : String | Test.java:74:21:74:43 | ... + ... | provenance | Sink:MaD:2 |
+| Test.java:66:33:66:43 | accessToken : String | Test.java:66:21:66:43 | ... + ... | provenance | Sink:MaD:2 |
+| Test.java:67:34:67:45 | clientSecret : String | Test.java:67:21:67:45 | ... + ... | provenance | Sink:MaD:2 |
+| Test.java:68:34:68:42 | apiSecret : String | Test.java:68:21:68:42 | ... + ... | provenance | Sink:MaD:2 |
+| Test.java:69:33:69:44 | sessionToken : String | Test.java:69:21:69:44 | ... + ... | provenance | Sink:MaD:2 |
+| Test.java:70:33:70:43 | bearerToken : String | Test.java:70:21:70:43 | ... + ... | provenance | Sink:MaD:2 |
+| Test.java:71:31:71:39 | secretKey : String | Test.java:71:21:71:39 | ... + ... | provenance | Sink:MaD:2 |
+| Test.java:72:33:72:44 | refreshToken : String | Test.java:72:21:72:44 | ... + ... | provenance | Sink:MaD:2 |
+| Test.java:73:33:73:43 | secretValue : String | Test.java:73:21:73:43 | ... + ... | provenance | Sink:MaD:2 |
models
| 1 | Sink: org.apache.logging.log4j; Logger; true; error; (String); ; Argument[0]; log-injection; manual |
| 2 | Sink: org.apache.logging.log4j; Logger; true; info; (String); ; Argument[0]; log-injection; manual |
@@ -41,20 +41,20 @@ nodes
| Test.java:22:22:22:75 | ... + ... | semmle.label | ... + ... |
| Test.java:22:44:22:52 | authToken : String | semmle.label | authToken : String |
| Test.java:22:44:22:67 | substring(...) : String | semmle.label | substring(...) : String |
-| Test.java:67:21:67:43 | ... + ... | semmle.label | ... + ... |
-| Test.java:67:33:67:43 | accessToken : String | semmle.label | accessToken : String |
-| Test.java:68:21:68:45 | ... + ... | semmle.label | ... + ... |
-| Test.java:68:34:68:45 | clientSecret : String | semmle.label | clientSecret : String |
-| Test.java:69:21:69:42 | ... + ... | semmle.label | ... + ... |
-| Test.java:69:34:69:42 | apiSecret : String | semmle.label | apiSecret : String |
-| Test.java:70:21:70:44 | ... + ... | semmle.label | ... + ... |
-| Test.java:70:33:70:44 | sessionToken : String | semmle.label | sessionToken : String |
-| Test.java:71:21:71:43 | ... + ... | semmle.label | ... + ... |
-| Test.java:71:33:71:43 | bearerToken : String | semmle.label | bearerToken : String |
-| Test.java:72:21:72:39 | ... + ... | semmle.label | ... + ... |
-| Test.java:72:31:72:39 | secretKey : String | semmle.label | secretKey : String |
-| Test.java:73:21:73:44 | ... + ... | semmle.label | ... + ... |
-| Test.java:73:33:73:44 | refreshToken : String | semmle.label | refreshToken : String |
-| Test.java:74:21:74:43 | ... + ... | semmle.label | ... + ... |
-| Test.java:74:33:74:43 | secretValue : String | semmle.label | secretValue : String |
+| Test.java:66:21:66:43 | ... + ... | semmle.label | ... + ... |
+| Test.java:66:33:66:43 | accessToken : String | semmle.label | accessToken : String |
+| Test.java:67:21:67:45 | ... + ... | semmle.label | ... + ... |
+| Test.java:67:34:67:45 | clientSecret : String | semmle.label | clientSecret : String |
+| Test.java:68:21:68:42 | ... + ... | semmle.label | ... + ... |
+| Test.java:68:34:68:42 | apiSecret : String | semmle.label | apiSecret : String |
+| Test.java:69:21:69:44 | ... + ... | semmle.label | ... + ... |
+| Test.java:69:33:69:44 | sessionToken : String | semmle.label | sessionToken : String |
+| Test.java:70:21:70:43 | ... + ... | semmle.label | ... + ... |
+| Test.java:70:33:70:43 | bearerToken : String | semmle.label | bearerToken : String |
+| Test.java:71:21:71:39 | ... + ... | semmle.label | ... + ... |
+| Test.java:71:31:71:39 | secretKey : String | semmle.label | secretKey : String |
+| Test.java:72:21:72:44 | ... + ... | semmle.label | ... + ... |
+| Test.java:72:33:72:44 | refreshToken : String | semmle.label | refreshToken : String |
+| Test.java:73:21:73:43 | ... + ... | semmle.label | ... + ... |
+| Test.java:73:33:73:43 | secretValue : String | semmle.label | secretValue : String |
subpaths
diff --git a/java/ql/test/query-tests/security/CWE-532/Test.java b/java/ql/test/query-tests/security/CWE-532/Test.java
index 759228ae3ec..5c9826ba2cc 100644
--- a/java/ql/test/query-tests/security/CWE-532/Test.java
+++ b/java/ql/test/query-tests/security/CWE-532/Test.java
@@ -29,7 +29,7 @@ class Test {
String tokenType, String tokenEndpoint, String tokenCount, String tokenUrl,
String tokenIndex, String tokenLength, String tokenName, String tokenId,
String secretName, String secretId, String secretVersion, String secretArn,
- String secretPath, String secretType, String secretQuestion,
+ String secretPath, String secretType,
String secretManager, String secretProperties
) {
Logger logger = null;
@@ -54,7 +54,6 @@ class Test {
logger.info("arn: " + secretArn); // Safe
logger.info("path: " + secretPath); // Safe
logger.info("type: " + secretType); // Safe
- logger.info("question: " + secretQuestion); // Safe
logger.info("manager: " + secretManager); // Safe
logger.info("properties: " + secretProperties); // Safe
}
From 4fe2f6d2b44e0ea850d8cfffaee5b107aac24791 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
Date: Mon, 6 Apr 2026 10:30:38 +0000
Subject: [PATCH 057/185] Release preparation for version 2.25.2
---
actions/ql/lib/CHANGELOG.md | 4 ++++
.../ql/lib/change-notes/released/0.4.33.md | 3 +++
actions/ql/lib/codeql-pack.release.yml | 2 +-
actions/ql/lib/qlpack.yml | 2 +-
actions/ql/src/CHANGELOG.md | 4 ++++
.../ql/src/change-notes/released/0.6.25.md | 3 +++
actions/ql/src/codeql-pack.release.yml | 2 +-
actions/ql/src/qlpack.yml | 2 +-
cpp/ql/lib/CHANGELOG.md | 20 +++++++++++++++++++
...6-03-20-add-indirect-uninitialized-node.md | 4 ----
...rameter-nodes-and-indirect-instructions.md | 5 -----
.../lib/change-notes/2026-03-24-field-init.md | 5 -----
.../2026-03-26-convert-csv-models-to-yml.md | 4 ----
.../change-notes/2026-03-30-nsdmi-dataflow.md | 4 ----
.../2026-03-31-http-flow-sources.md | 4 ----
cpp/ql/lib/change-notes/2026-03-31-meson.md | 4 ----
cpp/ql/lib/change-notes/released/9.0.0.md | 19 ++++++++++++++++++
cpp/ql/lib/codeql-pack.release.yml | 2 +-
cpp/ql/lib/qlpack.yml | 2 +-
cpp/ql/src/CHANGELOG.md | 14 +++++++++++++
...-11-integer-multiplication-cast-to-long.md | 4 ----
...3-adjust-xss-and-log-injection-severity.md | 4 ----
.../2026-03-16-wrong-type-format-argument.md | 4 ----
.../2026-03-19-suspicious-add-sizeof.md | 4 ----
.../2026-03-19-tainted-format-string.md | 4 ----
.../2026-03-30-warning-diagnostics.md | 4 ----
cpp/ql/src/change-notes/released/1.6.0.md | 13 ++++++++++++
cpp/ql/src/codeql-pack.release.yml | 2 +-
cpp/ql/src/qlpack.yml | 2 +-
.../ql/campaigns/Solorigate/lib/CHANGELOG.md | 4 ++++
.../lib/change-notes/released/1.7.64.md | 3 +++
.../Solorigate/lib/codeql-pack.release.yml | 2 +-
csharp/ql/campaigns/Solorigate/lib/qlpack.yml | 2 +-
.../ql/campaigns/Solorigate/src/CHANGELOG.md | 4 ++++
.../src/change-notes/released/1.7.64.md | 3 +++
.../Solorigate/src/codeql-pack.release.yml | 2 +-
csharp/ql/campaigns/Solorigate/src/qlpack.yml | 2 +-
csharp/ql/lib/CHANGELOG.md | 10 ++++++++++
.../2026-03-26-expanded-assignments.md | 4 ----
.../5.4.12.md} | 8 +++++---
csharp/ql/lib/codeql-pack.release.yml | 2 +-
csharp/ql/lib/qlpack.yml | 2 +-
csharp/ql/src/CHANGELOG.md | 11 ++++++++++
...3-adjust-xss-and-log-injection-severity.md | 5 -----
.../1.7.0.md} | 12 ++++++++---
csharp/ql/src/codeql-pack.release.yml | 2 +-
csharp/ql/src/qlpack.yml | 2 +-
go/ql/consistency-queries/CHANGELOG.md | 4 ++++
.../change-notes/released/1.0.47.md | 3 +++
.../codeql-pack.release.yml | 2 +-
go/ql/consistency-queries/qlpack.yml | 2 +-
go/ql/lib/CHANGELOG.md | 4 ++++
go/ql/lib/change-notes/released/7.0.5.md | 3 +++
go/ql/lib/codeql-pack.release.yml | 2 +-
go/ql/lib/qlpack.yml | 2 +-
go/ql/src/CHANGELOG.md | 7 +++++++
.../1.6.0.md} | 7 ++++---
go/ql/src/codeql-pack.release.yml | 2 +-
go/ql/src/qlpack.yml | 2 +-
java/ql/lib/CHANGELOG.md | 9 +++++++++
.../change-notes/2026-03-26-kotlin-2.3.20.md | 4 ----
...6-03-28-tainted-arithmetic-bounds-check.md | 4 ----
.../9.0.3.md} | 9 ++++++---
java/ql/lib/codeql-pack.release.yml | 2 +-
java/ql/lib/qlpack.yml | 2 +-
java/ql/src/CHANGELOG.md | 7 +++++++
.../1.11.0.md} | 7 ++++---
java/ql/src/codeql-pack.release.yml | 2 +-
java/ql/src/qlpack.yml | 2 +-
javascript/ql/lib/CHANGELOG.md | 4 ++++
.../ql/lib/change-notes/released/2.6.27.md | 3 +++
javascript/ql/lib/codeql-pack.release.yml | 2 +-
javascript/ql/lib/qlpack.yml | 2 +-
javascript/ql/src/CHANGELOG.md | 4 ++++
.../ql/src/change-notes/released/2.3.7.md | 3 +++
javascript/ql/src/codeql-pack.release.yml | 2 +-
javascript/ql/src/qlpack.yml | 2 +-
misc/suite-helpers/CHANGELOG.md | 4 ++++
.../change-notes/released/1.0.47.md | 3 +++
misc/suite-helpers/codeql-pack.release.yml | 2 +-
misc/suite-helpers/qlpack.yml | 2 +-
python/ql/lib/CHANGELOG.md | 6 ++++++
.../7.0.4.md} | 6 +++---
python/ql/lib/codeql-pack.release.yml | 2 +-
python/ql/lib/qlpack.yml | 2 +-
python/ql/src/CHANGELOG.md | 11 ++++++++++
...026-03-13-port-simple-points-to-queries.md | 5 -----
.../1.8.0.md} | 11 +++++++---
python/ql/src/codeql-pack.release.yml | 2 +-
python/ql/src/qlpack.yml | 2 +-
ruby/ql/lib/CHANGELOG.md | 4 ++++
ruby/ql/lib/change-notes/released/5.1.15.md | 3 +++
ruby/ql/lib/codeql-pack.release.yml | 2 +-
ruby/ql/lib/qlpack.yml | 2 +-
ruby/ql/src/CHANGELOG.md | 7 +++++++
.../1.6.0.md} | 7 ++++---
ruby/ql/src/codeql-pack.release.yml | 2 +-
ruby/ql/src/qlpack.yml | 2 +-
rust/ql/lib/CHANGELOG.md | 4 ++++
rust/ql/lib/change-notes/released/0.2.11.md | 3 +++
rust/ql/lib/codeql-pack.release.yml | 2 +-
rust/ql/lib/qlpack.yml | 2 +-
rust/ql/src/CHANGELOG.md | 7 +++++++
.../0.1.32.md} | 7 ++++---
rust/ql/src/codeql-pack.release.yml | 2 +-
rust/ql/src/qlpack.yml | 2 +-
shared/concepts/CHANGELOG.md | 4 ++++
.../concepts/change-notes/released/0.0.21.md | 3 +++
shared/concepts/codeql-pack.release.yml | 2 +-
shared/concepts/qlpack.yml | 2 +-
shared/controlflow/CHANGELOG.md | 4 ++++
.../change-notes/released/2.0.31.md | 3 +++
shared/controlflow/codeql-pack.release.yml | 2 +-
shared/controlflow/qlpack.yml | 2 +-
shared/dataflow/CHANGELOG.md | 4 ++++
.../dataflow/change-notes/released/2.1.3.md | 3 +++
shared/dataflow/codeql-pack.release.yml | 2 +-
shared/dataflow/qlpack.yml | 2 +-
shared/mad/CHANGELOG.md | 4 ++++
shared/mad/change-notes/released/1.0.47.md | 3 +++
shared/mad/codeql-pack.release.yml | 2 +-
shared/mad/qlpack.yml | 2 +-
shared/quantum/CHANGELOG.md | 4 ++++
.../quantum/change-notes/released/0.0.25.md | 3 +++
shared/quantum/codeql-pack.release.yml | 2 +-
shared/quantum/qlpack.yml | 2 +-
shared/rangeanalysis/CHANGELOG.md | 4 ++++
.../change-notes/released/1.0.47.md | 3 +++
shared/rangeanalysis/codeql-pack.release.yml | 2 +-
shared/rangeanalysis/qlpack.yml | 2 +-
shared/regex/CHANGELOG.md | 4 ++++
shared/regex/change-notes/released/1.0.47.md | 3 +++
shared/regex/codeql-pack.release.yml | 2 +-
shared/regex/qlpack.yml | 2 +-
shared/ssa/CHANGELOG.md | 4 ++++
shared/ssa/change-notes/released/2.0.23.md | 3 +++
shared/ssa/codeql-pack.release.yml | 2 +-
shared/ssa/qlpack.yml | 2 +-
shared/threat-models/CHANGELOG.md | 4 ++++
.../change-notes/released/1.0.47.md | 3 +++
shared/threat-models/codeql-pack.release.yml | 2 +-
shared/threat-models/qlpack.yml | 2 +-
shared/tutorial/CHANGELOG.md | 4 ++++
.../tutorial/change-notes/released/1.0.47.md | 3 +++
shared/tutorial/codeql-pack.release.yml | 2 +-
shared/tutorial/qlpack.yml | 2 +-
shared/typeflow/CHANGELOG.md | 4 ++++
.../typeflow/change-notes/released/1.0.47.md | 3 +++
shared/typeflow/codeql-pack.release.yml | 2 +-
shared/typeflow/qlpack.yml | 2 +-
shared/typeinference/CHANGELOG.md | 4 ++++
.../change-notes/released/0.0.28.md | 3 +++
shared/typeinference/codeql-pack.release.yml | 2 +-
shared/typeinference/qlpack.yml | 2 +-
shared/typetracking/CHANGELOG.md | 4 ++++
.../change-notes/released/2.0.31.md | 3 +++
shared/typetracking/codeql-pack.release.yml | 2 +-
shared/typetracking/qlpack.yml | 2 +-
shared/typos/CHANGELOG.md | 4 ++++
shared/typos/change-notes/released/1.0.47.md | 3 +++
shared/typos/codeql-pack.release.yml | 2 +-
shared/typos/qlpack.yml | 2 +-
shared/util/CHANGELOG.md | 4 ++++
shared/util/change-notes/released/2.0.34.md | 3 +++
shared/util/codeql-pack.release.yml | 2 +-
shared/util/qlpack.yml | 2 +-
shared/xml/CHANGELOG.md | 4 ++++
shared/xml/change-notes/released/1.0.47.md | 3 +++
shared/xml/codeql-pack.release.yml | 2 +-
shared/xml/qlpack.yml | 2 +-
shared/yaml/CHANGELOG.md | 4 ++++
shared/yaml/change-notes/released/1.0.47.md | 3 +++
shared/yaml/codeql-pack.release.yml | 2 +-
shared/yaml/qlpack.yml | 2 +-
swift/ql/lib/CHANGELOG.md | 4 ++++
swift/ql/lib/change-notes/released/6.3.3.md | 3 +++
swift/ql/lib/codeql-pack.release.yml | 2 +-
swift/ql/lib/qlpack.yml | 2 +-
swift/ql/src/CHANGELOG.md | 6 ++++++
.../1.3.0.md} | 7 ++++---
swift/ql/src/codeql-pack.release.yml | 2 +-
swift/ql/src/qlpack.yml | 2 +-
182 files changed, 483 insertions(+), 188 deletions(-)
create mode 100644 actions/ql/lib/change-notes/released/0.4.33.md
create mode 100644 actions/ql/src/change-notes/released/0.6.25.md
delete mode 100644 cpp/ql/lib/change-notes/2026-03-20-add-indirect-uninitialized-node.md
delete mode 100644 cpp/ql/lib/change-notes/2026-03-23-indirect-parameter-nodes-and-indirect-instructions.md
delete mode 100644 cpp/ql/lib/change-notes/2026-03-24-field-init.md
delete mode 100644 cpp/ql/lib/change-notes/2026-03-26-convert-csv-models-to-yml.md
delete mode 100644 cpp/ql/lib/change-notes/2026-03-30-nsdmi-dataflow.md
delete mode 100644 cpp/ql/lib/change-notes/2026-03-31-http-flow-sources.md
delete mode 100644 cpp/ql/lib/change-notes/2026-03-31-meson.md
create mode 100644 cpp/ql/lib/change-notes/released/9.0.0.md
delete mode 100644 cpp/ql/src/change-notes/2026-03-11-integer-multiplication-cast-to-long.md
delete mode 100644 cpp/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md
delete mode 100644 cpp/ql/src/change-notes/2026-03-16-wrong-type-format-argument.md
delete mode 100644 cpp/ql/src/change-notes/2026-03-19-suspicious-add-sizeof.md
delete mode 100644 cpp/ql/src/change-notes/2026-03-19-tainted-format-string.md
delete mode 100644 cpp/ql/src/change-notes/2026-03-30-warning-diagnostics.md
create mode 100644 cpp/ql/src/change-notes/released/1.6.0.md
create mode 100644 csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.64.md
create mode 100644 csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.64.md
delete mode 100644 csharp/ql/lib/change-notes/2026-03-26-expanded-assignments.md
rename csharp/ql/lib/change-notes/{2026-03-19-fix-log-forging-extension-methods.md => released/5.4.12.md} (52%)
delete mode 100644 csharp/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md
rename csharp/ql/src/change-notes/{2026-03-31-constantcondition-simplify.md => released/1.7.0.md} (58%)
create mode 100644 go/ql/consistency-queries/change-notes/released/1.0.47.md
create mode 100644 go/ql/lib/change-notes/released/7.0.5.md
rename go/ql/src/change-notes/{2026-03-13-adjust-xss-and-log-injection-severity.md => released/1.6.0.md} (87%)
delete mode 100644 java/ql/lib/change-notes/2026-03-26-kotlin-2.3.20.md
delete mode 100644 java/ql/lib/change-notes/2026-03-28-tainted-arithmetic-bounds-check.md
rename java/ql/lib/change-notes/{2026-03-27-add-ec-to-secure-algorithms.md => released/9.0.3.md} (63%)
rename java/ql/src/change-notes/{2026-03-13-adjust-xss-and-log-injection-severity.md => released/1.11.0.md} (88%)
create mode 100644 javascript/ql/lib/change-notes/released/2.6.27.md
create mode 100644 javascript/ql/src/change-notes/released/2.3.7.md
create mode 100644 misc/suite-helpers/change-notes/released/1.0.47.md
rename python/ql/lib/change-notes/{2026-03-11-fix-unresolved-relative-imports.md => released/7.0.4.md} (89%)
delete mode 100644 python/ql/src/change-notes/2026-03-13-port-simple-points-to-queries.md
rename python/ql/src/change-notes/{2026-03-13-adjust-xss-and-log-injection-severity.md => released/1.8.0.md} (56%)
create mode 100644 ruby/ql/lib/change-notes/released/5.1.15.md
rename ruby/ql/src/change-notes/{2026-03-13-adjust-xss-and-log-injection-severity.md => released/1.6.0.md} (87%)
create mode 100644 rust/ql/lib/change-notes/released/0.2.11.md
rename rust/ql/src/change-notes/{2026-03-13-adjust-xss-and-log-injection-severity.md => released/0.1.32.md} (84%)
create mode 100644 shared/concepts/change-notes/released/0.0.21.md
create mode 100644 shared/controlflow/change-notes/released/2.0.31.md
create mode 100644 shared/dataflow/change-notes/released/2.1.3.md
create mode 100644 shared/mad/change-notes/released/1.0.47.md
create mode 100644 shared/quantum/change-notes/released/0.0.25.md
create mode 100644 shared/rangeanalysis/change-notes/released/1.0.47.md
create mode 100644 shared/regex/change-notes/released/1.0.47.md
create mode 100644 shared/ssa/change-notes/released/2.0.23.md
create mode 100644 shared/threat-models/change-notes/released/1.0.47.md
create mode 100644 shared/tutorial/change-notes/released/1.0.47.md
create mode 100644 shared/typeflow/change-notes/released/1.0.47.md
create mode 100644 shared/typeinference/change-notes/released/0.0.28.md
create mode 100644 shared/typetracking/change-notes/released/2.0.31.md
create mode 100644 shared/typos/change-notes/released/1.0.47.md
create mode 100644 shared/util/change-notes/released/2.0.34.md
create mode 100644 shared/xml/change-notes/released/1.0.47.md
create mode 100644 shared/yaml/change-notes/released/1.0.47.md
create mode 100644 swift/ql/lib/change-notes/released/6.3.3.md
rename swift/ql/src/change-notes/{2026-03-13-adjust-xss-and-log-injection-severity.md => released/1.3.0.md} (75%)
diff --git a/actions/ql/lib/CHANGELOG.md b/actions/ql/lib/CHANGELOG.md
index 03201c9603a..d625bc6f619 100644
--- a/actions/ql/lib/CHANGELOG.md
+++ b/actions/ql/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.4.33
+
+No user-facing changes.
+
## 0.4.32
No user-facing changes.
diff --git a/actions/ql/lib/change-notes/released/0.4.33.md b/actions/ql/lib/change-notes/released/0.4.33.md
new file mode 100644
index 00000000000..99c04e352df
--- /dev/null
+++ b/actions/ql/lib/change-notes/released/0.4.33.md
@@ -0,0 +1,3 @@
+## 0.4.33
+
+No user-facing changes.
diff --git a/actions/ql/lib/codeql-pack.release.yml b/actions/ql/lib/codeql-pack.release.yml
index 3201cd9b063..7581fef2abf 100644
--- a/actions/ql/lib/codeql-pack.release.yml
+++ b/actions/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.4.32
+lastReleaseVersion: 0.4.33
diff --git a/actions/ql/lib/qlpack.yml b/actions/ql/lib/qlpack.yml
index bc4a8ba134b..131f29b87aa 100644
--- a/actions/ql/lib/qlpack.yml
+++ b/actions/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/actions-all
-version: 0.4.33-dev
+version: 0.4.33
library: true
warnOnImplicitThis: true
dependencies:
diff --git a/actions/ql/src/CHANGELOG.md b/actions/ql/src/CHANGELOG.md
index e42a19a8168..d991237aca9 100644
--- a/actions/ql/src/CHANGELOG.md
+++ b/actions/ql/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.6.25
+
+No user-facing changes.
+
## 0.6.24
No user-facing changes.
diff --git a/actions/ql/src/change-notes/released/0.6.25.md b/actions/ql/src/change-notes/released/0.6.25.md
new file mode 100644
index 00000000000..b9d9e69c728
--- /dev/null
+++ b/actions/ql/src/change-notes/released/0.6.25.md
@@ -0,0 +1,3 @@
+## 0.6.25
+
+No user-facing changes.
diff --git a/actions/ql/src/codeql-pack.release.yml b/actions/ql/src/codeql-pack.release.yml
index f4aa7271ace..b8288b39222 100644
--- a/actions/ql/src/codeql-pack.release.yml
+++ b/actions/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.6.24
+lastReleaseVersion: 0.6.25
diff --git a/actions/ql/src/qlpack.yml b/actions/ql/src/qlpack.yml
index 3f76a5273f1..024862b808a 100644
--- a/actions/ql/src/qlpack.yml
+++ b/actions/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/actions-queries
-version: 0.6.25-dev
+version: 0.6.25
library: false
warnOnImplicitThis: true
groups: [actions, queries]
diff --git a/cpp/ql/lib/CHANGELOG.md b/cpp/ql/lib/CHANGELOG.md
index 686195e9211..5b5bc748c5d 100644
--- a/cpp/ql/lib/CHANGELOG.md
+++ b/cpp/ql/lib/CHANGELOG.md
@@ -1,3 +1,23 @@
+## 9.0.0
+
+### Breaking Changes
+
+* The `SourceModelCsv`, `SinkModelCsv`, and `SummaryModelCsv` classes and the associated CSV parsing infrastructure have been removed from `ExternalFlow.qll`. New models should be added as `.model.yml` files in the `ext/` directory.
+
+### New Features
+
+* Added a subclass `MesonPrivateTestFile` of `ConfigurationTestFile` that represents files created by Meson to test the build configuration.
+* Added a class `ConstructorDirectFieldInit` to represent field initializations that occur in member initializer lists.
+* Added a class `ConstructorDefaultFieldInit` to represent default field initializations.
+* Added a class `DataFlow::IndirectParameterNode` to represent the indirection of a parameter as a dataflow node.
+* Added a predicate `Node::asIndirectInstruction` which returns the `Instruction` that defines the indirect dataflow node, if any.
+* Added a class `IndirectUninitializedNode` to represent the indirection of an uninitialized local variable as a dataflow node.
+
+### Minor Analysis Improvements
+
+* Added `HttpReceiveHttpRequest`, `HttpReceiveRequestEntityBody`, and `HttpReceiveClientCertificate` from Win32's `http.h` as remote flow sources.
+* Added dataflow through members initialized via non-static data member initialization (NSDMI).
+
## 8.0.3
No user-facing changes.
diff --git a/cpp/ql/lib/change-notes/2026-03-20-add-indirect-uninitialized-node.md b/cpp/ql/lib/change-notes/2026-03-20-add-indirect-uninitialized-node.md
deleted file mode 100644
index 07235e047d4..00000000000
--- a/cpp/ql/lib/change-notes/2026-03-20-add-indirect-uninitialized-node.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: feature
----
-* Added a class `IndirectUninitializedNode` to represent the indirection of an uninitialized local variable as a dataflow node.
diff --git a/cpp/ql/lib/change-notes/2026-03-23-indirect-parameter-nodes-and-indirect-instructions.md b/cpp/ql/lib/change-notes/2026-03-23-indirect-parameter-nodes-and-indirect-instructions.md
deleted file mode 100644
index c3bd4028ee9..00000000000
--- a/cpp/ql/lib/change-notes/2026-03-23-indirect-parameter-nodes-and-indirect-instructions.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-category: feature
----
-* Added a class `DataFlow::IndirectParameterNode` to represent the indirection of a parameter as a dataflow node.
-* Added a predicate `Node::asIndirectInstruction` which returns the `Instruction` that defines the indirect dataflow node, if any.
\ No newline at end of file
diff --git a/cpp/ql/lib/change-notes/2026-03-24-field-init.md b/cpp/ql/lib/change-notes/2026-03-24-field-init.md
deleted file mode 100644
index c11329a3d9f..00000000000
--- a/cpp/ql/lib/change-notes/2026-03-24-field-init.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-category: feature
----
-* Added a class `ConstructorDirectFieldInit` to represent field initializations that occur in member initializer lists.
-* Added a class `ConstructorDefaultFieldInit` to represent default field initializations.
diff --git a/cpp/ql/lib/change-notes/2026-03-26-convert-csv-models-to-yml.md b/cpp/ql/lib/change-notes/2026-03-26-convert-csv-models-to-yml.md
deleted file mode 100644
index 41d77b518f1..00000000000
--- a/cpp/ql/lib/change-notes/2026-03-26-convert-csv-models-to-yml.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: breaking
----
-* The `SourceModelCsv`, `SinkModelCsv`, and `SummaryModelCsv` classes and the associated CSV parsing infrastructure have been removed from `ExternalFlow.qll`. New models should be added as `.model.yml` files in the `ext/` directory.
diff --git a/cpp/ql/lib/change-notes/2026-03-30-nsdmi-dataflow.md b/cpp/ql/lib/change-notes/2026-03-30-nsdmi-dataflow.md
deleted file mode 100644
index 8bf87900330..00000000000
--- a/cpp/ql/lib/change-notes/2026-03-30-nsdmi-dataflow.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Added dataflow through members initialized via non-static data member initialization (NSDMI).
\ No newline at end of file
diff --git a/cpp/ql/lib/change-notes/2026-03-31-http-flow-sources.md b/cpp/ql/lib/change-notes/2026-03-31-http-flow-sources.md
deleted file mode 100644
index 54a0ad81036..00000000000
--- a/cpp/ql/lib/change-notes/2026-03-31-http-flow-sources.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Added `HttpReceiveHttpRequest`, `HttpReceiveRequestEntityBody`, and `HttpReceiveClientCertificate` from Win32's `http.h` as remote flow sources.
\ No newline at end of file
diff --git a/cpp/ql/lib/change-notes/2026-03-31-meson.md b/cpp/ql/lib/change-notes/2026-03-31-meson.md
deleted file mode 100644
index c18de40b85d..00000000000
--- a/cpp/ql/lib/change-notes/2026-03-31-meson.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: feature
----
-* Added a subclass `MesonPrivateTestFile` of `ConfigurationTestFile` that represents files created by Meson to test the build configuration.
diff --git a/cpp/ql/lib/change-notes/released/9.0.0.md b/cpp/ql/lib/change-notes/released/9.0.0.md
new file mode 100644
index 00000000000..2f97209a02d
--- /dev/null
+++ b/cpp/ql/lib/change-notes/released/9.0.0.md
@@ -0,0 +1,19 @@
+## 9.0.0
+
+### Breaking Changes
+
+* The `SourceModelCsv`, `SinkModelCsv`, and `SummaryModelCsv` classes and the associated CSV parsing infrastructure have been removed from `ExternalFlow.qll`. New models should be added as `.model.yml` files in the `ext/` directory.
+
+### New Features
+
+* Added a subclass `MesonPrivateTestFile` of `ConfigurationTestFile` that represents files created by Meson to test the build configuration.
+* Added a class `ConstructorDirectFieldInit` to represent field initializations that occur in member initializer lists.
+* Added a class `ConstructorDefaultFieldInit` to represent default field initializations.
+* Added a class `DataFlow::IndirectParameterNode` to represent the indirection of a parameter as a dataflow node.
+* Added a predicate `Node::asIndirectInstruction` which returns the `Instruction` that defines the indirect dataflow node, if any.
+* Added a class `IndirectUninitializedNode` to represent the indirection of an uninitialized local variable as a dataflow node.
+
+### Minor Analysis Improvements
+
+* Added `HttpReceiveHttpRequest`, `HttpReceiveRequestEntityBody`, and `HttpReceiveClientCertificate` from Win32's `http.h` as remote flow sources.
+* Added dataflow through members initialized via non-static data member initialization (NSDMI).
diff --git a/cpp/ql/lib/codeql-pack.release.yml b/cpp/ql/lib/codeql-pack.release.yml
index 1be4ac8d0d3..fd5f4a48b3c 100644
--- a/cpp/ql/lib/codeql-pack.release.yml
+++ b/cpp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 8.0.3
+lastReleaseVersion: 9.0.0
diff --git a/cpp/ql/lib/qlpack.yml b/cpp/ql/lib/qlpack.yml
index 802f3c3e4de..e4e7a96ef68 100644
--- a/cpp/ql/lib/qlpack.yml
+++ b/cpp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/cpp-all
-version: 8.0.4-dev
+version: 9.0.0
groups: cpp
dbscheme: semmlecode.cpp.dbscheme
extractor: cpp
diff --git a/cpp/ql/src/CHANGELOG.md b/cpp/ql/src/CHANGELOG.md
index 126b1d9efa3..a3f9d1836ad 100644
--- a/cpp/ql/src/CHANGELOG.md
+++ b/cpp/ql/src/CHANGELOG.md
@@ -1,3 +1,17 @@
+## 1.6.0
+
+### Query Metadata Changes
+
+* The `@security-severity` metadata of `cpp/cgi-xss` has been increased from 6.1 (medium) to 7.8 (high).
+
+### Minor Analysis Improvements
+
+* The "Extraction warnings" (`cpp/diagnostics/extraction-warnings`) diagnostics query no longer yields `ExtractionRecoverableWarning`s for `build-mode: none` databases. The results were found to significantly increase the sizes of the produced SARIF files, making them unprocessable in some cases.
+* Fixed an issue with the "Suspicious add with sizeof" (`cpp/suspicious-add-sizeof`) query causing false positive results in `build-mode: none` databases.
+* Fixed an issue with the "Uncontrolled format string" (`cpp/tainted-format-string`) query involving certain kinds of formatting function implementations.
+* Fixed an issue with the "Wrong type of arguments to formatting function" (`cpp/wrong-type-format-argument`) query causing false positive results in `build-mode: none` databases.
+* Fixed an issue with the "Multiplication result converted to larger type" (`cpp/integer-multiplication-cast-to-long`) query causing false positive results in `build-mode: none` databases.
+
## 1.5.15
No user-facing changes.
diff --git a/cpp/ql/src/change-notes/2026-03-11-integer-multiplication-cast-to-long.md b/cpp/ql/src/change-notes/2026-03-11-integer-multiplication-cast-to-long.md
deleted file mode 100644
index 4d4a66c0a22..00000000000
--- a/cpp/ql/src/change-notes/2026-03-11-integer-multiplication-cast-to-long.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Fixed an issue with the "Multiplication result converted to larger type" (`cpp/integer-multiplication-cast-to-long`) query causing false positive results in `build-mode: none` databases.
diff --git a/cpp/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md b/cpp/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md
deleted file mode 100644
index 0810e9c49ba..00000000000
--- a/cpp/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: queryMetadata
----
-* The `@security-severity` metadata of `cpp/cgi-xss` has been increased from 6.1 (medium) to 7.8 (high).
diff --git a/cpp/ql/src/change-notes/2026-03-16-wrong-type-format-argument.md b/cpp/ql/src/change-notes/2026-03-16-wrong-type-format-argument.md
deleted file mode 100644
index 84aef7791fc..00000000000
--- a/cpp/ql/src/change-notes/2026-03-16-wrong-type-format-argument.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Fixed an issue with the "Wrong type of arguments to formatting function" (`cpp/wrong-type-format-argument`) query causing false positive results in `build-mode: none` databases.
diff --git a/cpp/ql/src/change-notes/2026-03-19-suspicious-add-sizeof.md b/cpp/ql/src/change-notes/2026-03-19-suspicious-add-sizeof.md
deleted file mode 100644
index 387e2d44b46..00000000000
--- a/cpp/ql/src/change-notes/2026-03-19-suspicious-add-sizeof.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Fixed an issue with the "Suspicious add with sizeof" (`cpp/suspicious-add-sizeof`) query causing false positive results in `build-mode: none` databases.
diff --git a/cpp/ql/src/change-notes/2026-03-19-tainted-format-string.md b/cpp/ql/src/change-notes/2026-03-19-tainted-format-string.md
deleted file mode 100644
index 6a1133917bf..00000000000
--- a/cpp/ql/src/change-notes/2026-03-19-tainted-format-string.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Fixed an issue with the "Uncontrolled format string" (`cpp/tainted-format-string`) query involving certain kinds of formatting function implementations.
diff --git a/cpp/ql/src/change-notes/2026-03-30-warning-diagnostics.md b/cpp/ql/src/change-notes/2026-03-30-warning-diagnostics.md
deleted file mode 100644
index 0db0d7c718d..00000000000
--- a/cpp/ql/src/change-notes/2026-03-30-warning-diagnostics.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* The "Extraction warnings" (`cpp/diagnostics/extraction-warnings`) diagnostics query no longer yields `ExtractionRecoverableWarning`s for `build-mode: none` databases. The results were found to significantly increase the sizes of the produced SARIF files, making them unprocessable in some cases.
diff --git a/cpp/ql/src/change-notes/released/1.6.0.md b/cpp/ql/src/change-notes/released/1.6.0.md
new file mode 100644
index 00000000000..3bbb9480660
--- /dev/null
+++ b/cpp/ql/src/change-notes/released/1.6.0.md
@@ -0,0 +1,13 @@
+## 1.6.0
+
+### Query Metadata Changes
+
+* The `@security-severity` metadata of `cpp/cgi-xss` has been increased from 6.1 (medium) to 7.8 (high).
+
+### Minor Analysis Improvements
+
+* The "Extraction warnings" (`cpp/diagnostics/extraction-warnings`) diagnostics query no longer yields `ExtractionRecoverableWarning`s for `build-mode: none` databases. The results were found to significantly increase the sizes of the produced SARIF files, making them unprocessable in some cases.
+* Fixed an issue with the "Suspicious add with sizeof" (`cpp/suspicious-add-sizeof`) query causing false positive results in `build-mode: none` databases.
+* Fixed an issue with the "Uncontrolled format string" (`cpp/tainted-format-string`) query involving certain kinds of formatting function implementations.
+* Fixed an issue with the "Wrong type of arguments to formatting function" (`cpp/wrong-type-format-argument`) query causing false positive results in `build-mode: none` databases.
+* Fixed an issue with the "Multiplication result converted to larger type" (`cpp/integer-multiplication-cast-to-long`) query causing false positive results in `build-mode: none` databases.
diff --git a/cpp/ql/src/codeql-pack.release.yml b/cpp/ql/src/codeql-pack.release.yml
index b41e6e78a66..c4f0b07d533 100644
--- a/cpp/ql/src/codeql-pack.release.yml
+++ b/cpp/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.5.15
+lastReleaseVersion: 1.6.0
diff --git a/cpp/ql/src/qlpack.yml b/cpp/ql/src/qlpack.yml
index 3160da2efb6..fa0391ae9c1 100644
--- a/cpp/ql/src/qlpack.yml
+++ b/cpp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/cpp-queries
-version: 1.5.16-dev
+version: 1.6.0
groups:
- cpp
- queries
diff --git a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
index dfbc0f9f376..f7107d18c01 100644
--- a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
+++ b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.7.64
+
+No user-facing changes.
+
## 1.7.63
No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.64.md b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.64.md
new file mode 100644
index 00000000000..47290bbbeb3
--- /dev/null
+++ b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.64.md
@@ -0,0 +1,3 @@
+## 1.7.64
+
+No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
index 3d19252da0b..f41e954c9ae 100644
--- a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
+++ b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.7.63
+lastReleaseVersion: 1.7.64
diff --git a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
index 972746e9255..9c094c18dc6 100644
--- a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-all
-version: 1.7.64-dev
+version: 1.7.64
groups:
- csharp
- solorigate
diff --git a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
index dfbc0f9f376..f7107d18c01 100644
--- a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
+++ b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.7.64
+
+No user-facing changes.
+
## 1.7.63
No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.64.md b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.64.md
new file mode 100644
index 00000000000..47290bbbeb3
--- /dev/null
+++ b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.64.md
@@ -0,0 +1,3 @@
+## 1.7.64
+
+No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
index 3d19252da0b..f41e954c9ae 100644
--- a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
+++ b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.7.63
+lastReleaseVersion: 1.7.64
diff --git a/csharp/ql/campaigns/Solorigate/src/qlpack.yml b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
index 7a4e4fff627..666c44a2805 100644
--- a/csharp/ql/campaigns/Solorigate/src/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-queries
-version: 1.7.64-dev
+version: 1.7.64
groups:
- csharp
- solorigate
diff --git a/csharp/ql/lib/CHANGELOG.md b/csharp/ql/lib/CHANGELOG.md
index 7261891eed7..57d99a41480 100644
--- a/csharp/ql/lib/CHANGELOG.md
+++ b/csharp/ql/lib/CHANGELOG.md
@@ -1,3 +1,13 @@
+## 5.4.12
+
+### Minor Analysis Improvements
+
+* The extractor no longer synthesizes expanded forms of compound assignments. This may have a small impact on the results of queries that explicitly or implicitly rely on the expanded form of compound assignments.
+* The `cs/log-forging` query no longer treats arguments to extension methods with
+ source code on `ILogger` types as sinks. Instead, taint is tracked interprocedurally
+ through extension method bodies, reducing false positives when extension methods
+ sanitize input internally.
+
## 5.4.11
No user-facing changes.
diff --git a/csharp/ql/lib/change-notes/2026-03-26-expanded-assignments.md b/csharp/ql/lib/change-notes/2026-03-26-expanded-assignments.md
deleted file mode 100644
index 159ab1ee3c6..00000000000
--- a/csharp/ql/lib/change-notes/2026-03-26-expanded-assignments.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* The extractor no longer synthesizes expanded forms of compound assignments. This may have a small impact on the results of queries that explicitly or implicitly rely on the expanded form of compound assignments.
diff --git a/csharp/ql/lib/change-notes/2026-03-19-fix-log-forging-extension-methods.md b/csharp/ql/lib/change-notes/released/5.4.12.md
similarity index 52%
rename from csharp/ql/lib/change-notes/2026-03-19-fix-log-forging-extension-methods.md
rename to csharp/ql/lib/change-notes/released/5.4.12.md
index 65ce217b105..506fae5a15e 100644
--- a/csharp/ql/lib/change-notes/2026-03-19-fix-log-forging-extension-methods.md
+++ b/csharp/ql/lib/change-notes/released/5.4.12.md
@@ -1,6 +1,8 @@
----
-category: minorAnalysis
----
+## 5.4.12
+
+### Minor Analysis Improvements
+
+* The extractor no longer synthesizes expanded forms of compound assignments. This may have a small impact on the results of queries that explicitly or implicitly rely on the expanded form of compound assignments.
* The `cs/log-forging` query no longer treats arguments to extension methods with
source code on `ILogger` types as sinks. Instead, taint is tracked interprocedurally
through extension method bodies, reducing false positives when extension methods
diff --git a/csharp/ql/lib/codeql-pack.release.yml b/csharp/ql/lib/codeql-pack.release.yml
index f742ee59b53..43db6e52c98 100644
--- a/csharp/ql/lib/codeql-pack.release.yml
+++ b/csharp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 5.4.11
+lastReleaseVersion: 5.4.12
diff --git a/csharp/ql/lib/qlpack.yml b/csharp/ql/lib/qlpack.yml
index b45bd57ad56..d5088885cdb 100644
--- a/csharp/ql/lib/qlpack.yml
+++ b/csharp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-all
-version: 5.4.12-dev
+version: 5.4.12
groups: csharp
dbscheme: semmlecode.csharp.dbscheme
extractor: csharp
diff --git a/csharp/ql/src/CHANGELOG.md b/csharp/ql/src/CHANGELOG.md
index 39bfe944d5d..fc0f8c58d79 100644
--- a/csharp/ql/src/CHANGELOG.md
+++ b/csharp/ql/src/CHANGELOG.md
@@ -1,3 +1,14 @@
+## 1.7.0
+
+### Query Metadata Changes
+
+* The `@security-severity` metadata of `cs/log-forging` has been reduced from 7.8 (high) to 6.1 (medium).
+* The `@security-severity` metadata of `cs/web/xss` has been increased from 6.1 (medium) to 7.8 (high).
+
+### Major Analysis Improvements
+
+* The `cs/constant-condition` query has been simplified. The query no longer reports trivially constant conditions as they were found to generally be intentional. As a result, it should now produce fewer false positives. Additionally, the simplification means that it now reports all the results that `cs/constant-comparison` used to report, and as consequence, that query has been deleted.
+
## 1.6.6
No user-facing changes.
diff --git a/csharp/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md b/csharp/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md
deleted file mode 100644
index c317194bc25..00000000000
--- a/csharp/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-category: queryMetadata
----
-* The `@security-severity` metadata of `cs/log-forging` has been reduced from 7.8 (high) to 6.1 (medium).
-* The `@security-severity` metadata of `cs/web/xss` has been increased from 6.1 (medium) to 7.8 (high).
diff --git a/csharp/ql/src/change-notes/2026-03-31-constantcondition-simplify.md b/csharp/ql/src/change-notes/released/1.7.0.md
similarity index 58%
rename from csharp/ql/src/change-notes/2026-03-31-constantcondition-simplify.md
rename to csharp/ql/src/change-notes/released/1.7.0.md
index a1051d4c00f..906a13d68d0 100644
--- a/csharp/ql/src/change-notes/2026-03-31-constantcondition-simplify.md
+++ b/csharp/ql/src/change-notes/released/1.7.0.md
@@ -1,4 +1,10 @@
----
-category: majorAnalysis
----
+## 1.7.0
+
+### Query Metadata Changes
+
+* The `@security-severity` metadata of `cs/log-forging` has been reduced from 7.8 (high) to 6.1 (medium).
+* The `@security-severity` metadata of `cs/web/xss` has been increased from 6.1 (medium) to 7.8 (high).
+
+### Major Analysis Improvements
+
* The `cs/constant-condition` query has been simplified. The query no longer reports trivially constant conditions as they were found to generally be intentional. As a result, it should now produce fewer false positives. Additionally, the simplification means that it now reports all the results that `cs/constant-comparison` used to report, and as consequence, that query has been deleted.
diff --git a/csharp/ql/src/codeql-pack.release.yml b/csharp/ql/src/codeql-pack.release.yml
index f8e54f30a67..d1184cc6750 100644
--- a/csharp/ql/src/codeql-pack.release.yml
+++ b/csharp/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.6.6
+lastReleaseVersion: 1.7.0
diff --git a/csharp/ql/src/qlpack.yml b/csharp/ql/src/qlpack.yml
index 728074e959d..64d02609317 100644
--- a/csharp/ql/src/qlpack.yml
+++ b/csharp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-queries
-version: 1.6.7-dev
+version: 1.7.0
groups:
- csharp
- queries
diff --git a/go/ql/consistency-queries/CHANGELOG.md b/go/ql/consistency-queries/CHANGELOG.md
index 065f61912fa..34ae2fd2277 100644
--- a/go/ql/consistency-queries/CHANGELOG.md
+++ b/go/ql/consistency-queries/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.0.47
+
+No user-facing changes.
+
## 1.0.46
No user-facing changes.
diff --git a/go/ql/consistency-queries/change-notes/released/1.0.47.md b/go/ql/consistency-queries/change-notes/released/1.0.47.md
new file mode 100644
index 00000000000..0c12039c180
--- /dev/null
+++ b/go/ql/consistency-queries/change-notes/released/1.0.47.md
@@ -0,0 +1,3 @@
+## 1.0.47
+
+No user-facing changes.
diff --git a/go/ql/consistency-queries/codeql-pack.release.yml b/go/ql/consistency-queries/codeql-pack.release.yml
index 05205e6a59e..dcec0f6405a 100644
--- a/go/ql/consistency-queries/codeql-pack.release.yml
+++ b/go/ql/consistency-queries/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.0.46
+lastReleaseVersion: 1.0.47
diff --git a/go/ql/consistency-queries/qlpack.yml b/go/ql/consistency-queries/qlpack.yml
index ba15945e1a2..53b3d29e717 100644
--- a/go/ql/consistency-queries/qlpack.yml
+++ b/go/ql/consistency-queries/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql-go-consistency-queries
-version: 1.0.47-dev
+version: 1.0.47
groups:
- go
- queries
diff --git a/go/ql/lib/CHANGELOG.md b/go/ql/lib/CHANGELOG.md
index 09f0c884320..441d15a0d0e 100644
--- a/go/ql/lib/CHANGELOG.md
+++ b/go/ql/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 7.0.5
+
+No user-facing changes.
+
## 7.0.4
No user-facing changes.
diff --git a/go/ql/lib/change-notes/released/7.0.5.md b/go/ql/lib/change-notes/released/7.0.5.md
new file mode 100644
index 00000000000..adee6ebe3a7
--- /dev/null
+++ b/go/ql/lib/change-notes/released/7.0.5.md
@@ -0,0 +1,3 @@
+## 7.0.5
+
+No user-facing changes.
diff --git a/go/ql/lib/codeql-pack.release.yml b/go/ql/lib/codeql-pack.release.yml
index 6630ee1984a..2cff21d59fe 100644
--- a/go/ql/lib/codeql-pack.release.yml
+++ b/go/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 7.0.4
+lastReleaseVersion: 7.0.5
diff --git a/go/ql/lib/qlpack.yml b/go/ql/lib/qlpack.yml
index f3e9e50bf7b..5c371bb7ae4 100644
--- a/go/ql/lib/qlpack.yml
+++ b/go/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/go-all
-version: 7.0.5-dev
+version: 7.0.5
groups: go
dbscheme: go.dbscheme
extractor: go
diff --git a/go/ql/src/CHANGELOG.md b/go/ql/src/CHANGELOG.md
index f6fcaa51ab3..2bc95cc1922 100644
--- a/go/ql/src/CHANGELOG.md
+++ b/go/ql/src/CHANGELOG.md
@@ -1,3 +1,10 @@
+## 1.6.0
+
+### Query Metadata Changes
+
+* The `@security-severity` metadata of `go/log-injection` has been reduced from 7.8 (high) to 6.1 (medium).
+* The `@security-severity` metadata of `go/html-template-escaping-bypass-xss`, `go/reflected-xss` and `go/stored-xss` has been increased from 6.1 (medium) to 7.8 (high).
+
## 1.5.10
No user-facing changes.
diff --git a/go/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md b/go/ql/src/change-notes/released/1.6.0.md
similarity index 87%
rename from go/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md
rename to go/ql/src/change-notes/released/1.6.0.md
index 45320bcd719..1e508254885 100644
--- a/go/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md
+++ b/go/ql/src/change-notes/released/1.6.0.md
@@ -1,5 +1,6 @@
----
-category: queryMetadata
----
+## 1.6.0
+
+### Query Metadata Changes
+
* The `@security-severity` metadata of `go/log-injection` has been reduced from 7.8 (high) to 6.1 (medium).
* The `@security-severity` metadata of `go/html-template-escaping-bypass-xss`, `go/reflected-xss` and `go/stored-xss` has been increased from 6.1 (medium) to 7.8 (high).
diff --git a/go/ql/src/codeql-pack.release.yml b/go/ql/src/codeql-pack.release.yml
index fda54b31bff..c4f0b07d533 100644
--- a/go/ql/src/codeql-pack.release.yml
+++ b/go/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.5.10
+lastReleaseVersion: 1.6.0
diff --git a/go/ql/src/qlpack.yml b/go/ql/src/qlpack.yml
index fd374637a9b..1ec2c5b9430 100644
--- a/go/ql/src/qlpack.yml
+++ b/go/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/go-queries
-version: 1.5.11-dev
+version: 1.6.0
groups:
- go
- queries
diff --git a/java/ql/lib/CHANGELOG.md b/java/ql/lib/CHANGELOG.md
index ecbffa5461c..caa1eaecb94 100644
--- a/java/ql/lib/CHANGELOG.md
+++ b/java/ql/lib/CHANGELOG.md
@@ -1,3 +1,12 @@
+## 9.0.3
+
+### Minor Analysis Improvements
+
+* The `java/tainted-arithmetic` query no longer flags arithmetic expressions that are used directly as an operand of a comparison in `if`-condition bounds-checking patterns. For example, `if (off + len > array.length)` is now recognized as a bounds check rather than a potentially vulnerable computation, reducing false positives.
+* The `java/potentially-weak-cryptographic-algorithm` query no longer flags Elliptic Curve algorithms (`EC`, `ECDSA`, `ECDH`, `EdDSA`, `Ed25519`, `Ed448`, `XDH`, `X25519`, `X448`), HMAC-based algorithms (`HMACSHA1`, `HMACSHA256`, `HMACSHA384`, `HMACSHA512`), or PBKDF2 key derivation as potentially insecure. These are modern, secure algorithms recommended by NIST and other standards bodies. This will reduce the number of false positives for this query.
+* The first argument of the method `getInstance` of `java.security.Signature` is now modeled as a sink for `java/potentially-weak-cryptographic-algorithm`, `java/weak-cryptographic-algorithm` and `java/rsa-without-oaep`. This will increase the number of alerts for these queries.
+* Kotlin versions up to 2.3.20 are now supported.
+
## 9.0.2
No user-facing changes.
diff --git a/java/ql/lib/change-notes/2026-03-26-kotlin-2.3.20.md b/java/ql/lib/change-notes/2026-03-26-kotlin-2.3.20.md
deleted file mode 100644
index b18cff45704..00000000000
--- a/java/ql/lib/change-notes/2026-03-26-kotlin-2.3.20.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Kotlin versions up to 2.3.20 are now supported.
diff --git a/java/ql/lib/change-notes/2026-03-28-tainted-arithmetic-bounds-check.md b/java/ql/lib/change-notes/2026-03-28-tainted-arithmetic-bounds-check.md
deleted file mode 100644
index 0688815c822..00000000000
--- a/java/ql/lib/change-notes/2026-03-28-tainted-arithmetic-bounds-check.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* The `java/tainted-arithmetic` query no longer flags arithmetic expressions that are used directly as an operand of a comparison in `if`-condition bounds-checking patterns. For example, `if (off + len > array.length)` is now recognized as a bounds check rather than a potentially vulnerable computation, reducing false positives.
diff --git a/java/ql/lib/change-notes/2026-03-27-add-ec-to-secure-algorithms.md b/java/ql/lib/change-notes/released/9.0.3.md
similarity index 63%
rename from java/ql/lib/change-notes/2026-03-27-add-ec-to-secure-algorithms.md
rename to java/ql/lib/change-notes/released/9.0.3.md
index ee53bedd417..828b5867f8b 100644
--- a/java/ql/lib/change-notes/2026-03-27-add-ec-to-secure-algorithms.md
+++ b/java/ql/lib/change-notes/released/9.0.3.md
@@ -1,5 +1,8 @@
----
-category: minorAnalysis
----
+## 9.0.3
+
+### Minor Analysis Improvements
+
+* The `java/tainted-arithmetic` query no longer flags arithmetic expressions that are used directly as an operand of a comparison in `if`-condition bounds-checking patterns. For example, `if (off + len > array.length)` is now recognized as a bounds check rather than a potentially vulnerable computation, reducing false positives.
* The `java/potentially-weak-cryptographic-algorithm` query no longer flags Elliptic Curve algorithms (`EC`, `ECDSA`, `ECDH`, `EdDSA`, `Ed25519`, `Ed448`, `XDH`, `X25519`, `X448`), HMAC-based algorithms (`HMACSHA1`, `HMACSHA256`, `HMACSHA384`, `HMACSHA512`), or PBKDF2 key derivation as potentially insecure. These are modern, secure algorithms recommended by NIST and other standards bodies. This will reduce the number of false positives for this query.
* The first argument of the method `getInstance` of `java.security.Signature` is now modeled as a sink for `java/potentially-weak-cryptographic-algorithm`, `java/weak-cryptographic-algorithm` and `java/rsa-without-oaep`. This will increase the number of alerts for these queries.
+* Kotlin versions up to 2.3.20 are now supported.
diff --git a/java/ql/lib/codeql-pack.release.yml b/java/ql/lib/codeql-pack.release.yml
index 533351acdc9..175658aaf53 100644
--- a/java/ql/lib/codeql-pack.release.yml
+++ b/java/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 9.0.2
+lastReleaseVersion: 9.0.3
diff --git a/java/ql/lib/qlpack.yml b/java/ql/lib/qlpack.yml
index fc1d2c13281..d840954d623 100644
--- a/java/ql/lib/qlpack.yml
+++ b/java/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-all
-version: 9.0.3-dev
+version: 9.0.3
groups: java
dbscheme: config/semmlecode.dbscheme
extractor: java
diff --git a/java/ql/src/CHANGELOG.md b/java/ql/src/CHANGELOG.md
index 8d9ce4a75b4..2a2f8052092 100644
--- a/java/ql/src/CHANGELOG.md
+++ b/java/ql/src/CHANGELOG.md
@@ -1,3 +1,10 @@
+## 1.11.0
+
+### Query Metadata Changes
+
+* The `@security-severity` metadata of `java/log-injection` has been reduced from 7.8 (high) to 6.1 (medium).
+* The `@security-severity` metadata of `java/android/webview-addjavascriptinterface`, `java/android/websettings-javascript-enabled` and `java/xss` has been increased from 6.1 (medium) to 7.8 (high).
+
## 1.10.11
No user-facing changes.
diff --git a/java/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md b/java/ql/src/change-notes/released/1.11.0.md
similarity index 88%
rename from java/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md
rename to java/ql/src/change-notes/released/1.11.0.md
index fa1288af16e..0be4b0481d6 100644
--- a/java/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md
+++ b/java/ql/src/change-notes/released/1.11.0.md
@@ -1,5 +1,6 @@
----
-category: queryMetadata
----
+## 1.11.0
+
+### Query Metadata Changes
+
* The `@security-severity` metadata of `java/log-injection` has been reduced from 7.8 (high) to 6.1 (medium).
* The `@security-severity` metadata of `java/android/webview-addjavascriptinterface`, `java/android/websettings-javascript-enabled` and `java/xss` has been increased from 6.1 (medium) to 7.8 (high).
diff --git a/java/ql/src/codeql-pack.release.yml b/java/ql/src/codeql-pack.release.yml
index d267e07fb66..276088d81dc 100644
--- a/java/ql/src/codeql-pack.release.yml
+++ b/java/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.10.11
+lastReleaseVersion: 1.11.0
diff --git a/java/ql/src/qlpack.yml b/java/ql/src/qlpack.yml
index 78372a6ec85..2c4f95fb25b 100644
--- a/java/ql/src/qlpack.yml
+++ b/java/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-queries
-version: 1.10.12-dev
+version: 1.11.0
groups:
- java
- queries
diff --git a/javascript/ql/lib/CHANGELOG.md b/javascript/ql/lib/CHANGELOG.md
index 52d003921a0..fedb0b9b587 100644
--- a/javascript/ql/lib/CHANGELOG.md
+++ b/javascript/ql/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 2.6.27
+
+No user-facing changes.
+
## 2.6.26
No user-facing changes.
diff --git a/javascript/ql/lib/change-notes/released/2.6.27.md b/javascript/ql/lib/change-notes/released/2.6.27.md
new file mode 100644
index 00000000000..94482b5ebe6
--- /dev/null
+++ b/javascript/ql/lib/change-notes/released/2.6.27.md
@@ -0,0 +1,3 @@
+## 2.6.27
+
+No user-facing changes.
diff --git a/javascript/ql/lib/codeql-pack.release.yml b/javascript/ql/lib/codeql-pack.release.yml
index 679fedfb2ca..2ce86b10a85 100644
--- a/javascript/ql/lib/codeql-pack.release.yml
+++ b/javascript/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 2.6.26
+lastReleaseVersion: 2.6.27
diff --git a/javascript/ql/lib/qlpack.yml b/javascript/ql/lib/qlpack.yml
index 06ba4c2b8c6..df3fa463f35 100644
--- a/javascript/ql/lib/qlpack.yml
+++ b/javascript/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/javascript-all
-version: 2.6.27-dev
+version: 2.6.27
groups: javascript
dbscheme: semmlecode.javascript.dbscheme
extractor: javascript
diff --git a/javascript/ql/src/CHANGELOG.md b/javascript/ql/src/CHANGELOG.md
index 272799b3da3..29e6c8e8da3 100644
--- a/javascript/ql/src/CHANGELOG.md
+++ b/javascript/ql/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 2.3.7
+
+No user-facing changes.
+
## 2.3.6
No user-facing changes.
diff --git a/javascript/ql/src/change-notes/released/2.3.7.md b/javascript/ql/src/change-notes/released/2.3.7.md
new file mode 100644
index 00000000000..5be2835f398
--- /dev/null
+++ b/javascript/ql/src/change-notes/released/2.3.7.md
@@ -0,0 +1,3 @@
+## 2.3.7
+
+No user-facing changes.
diff --git a/javascript/ql/src/codeql-pack.release.yml b/javascript/ql/src/codeql-pack.release.yml
index 2c82422104b..914cded08b3 100644
--- a/javascript/ql/src/codeql-pack.release.yml
+++ b/javascript/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 2.3.6
+lastReleaseVersion: 2.3.7
diff --git a/javascript/ql/src/qlpack.yml b/javascript/ql/src/qlpack.yml
index c01152a2480..7bd7a08f955 100644
--- a/javascript/ql/src/qlpack.yml
+++ b/javascript/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/javascript-queries
-version: 2.3.7-dev
+version: 2.3.7
groups:
- javascript
- queries
diff --git a/misc/suite-helpers/CHANGELOG.md b/misc/suite-helpers/CHANGELOG.md
index 1b5fe4c06da..4b73639b1f7 100644
--- a/misc/suite-helpers/CHANGELOG.md
+++ b/misc/suite-helpers/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.0.47
+
+No user-facing changes.
+
## 1.0.46
No user-facing changes.
diff --git a/misc/suite-helpers/change-notes/released/1.0.47.md b/misc/suite-helpers/change-notes/released/1.0.47.md
new file mode 100644
index 00000000000..0c12039c180
--- /dev/null
+++ b/misc/suite-helpers/change-notes/released/1.0.47.md
@@ -0,0 +1,3 @@
+## 1.0.47
+
+No user-facing changes.
diff --git a/misc/suite-helpers/codeql-pack.release.yml b/misc/suite-helpers/codeql-pack.release.yml
index 05205e6a59e..dcec0f6405a 100644
--- a/misc/suite-helpers/codeql-pack.release.yml
+++ b/misc/suite-helpers/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.0.46
+lastReleaseVersion: 1.0.47
diff --git a/misc/suite-helpers/qlpack.yml b/misc/suite-helpers/qlpack.yml
index 3107188efcf..9ee0e7338b2 100644
--- a/misc/suite-helpers/qlpack.yml
+++ b/misc/suite-helpers/qlpack.yml
@@ -1,4 +1,4 @@
name: codeql/suite-helpers
-version: 1.0.47-dev
+version: 1.0.47
groups: shared
warnOnImplicitThis: true
diff --git a/python/ql/lib/CHANGELOG.md b/python/ql/lib/CHANGELOG.md
index ec5ff5ffe4f..a6833ea8db3 100644
--- a/python/ql/lib/CHANGELOG.md
+++ b/python/ql/lib/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 7.0.4
+
+### Bug Fixes
+
+- Fixed the resolution of relative imports such as `from . import helper` inside namespace packages (directories without an `__init__.py` file), which previously did not work correctly, leading to missing flow.
+
## 7.0.3
No user-facing changes.
diff --git a/python/ql/lib/change-notes/2026-03-11-fix-unresolved-relative-imports.md b/python/ql/lib/change-notes/released/7.0.4.md
similarity index 89%
rename from python/ql/lib/change-notes/2026-03-11-fix-unresolved-relative-imports.md
rename to python/ql/lib/change-notes/released/7.0.4.md
index 15290fb3d66..91464598a0e 100644
--- a/python/ql/lib/change-notes/2026-03-11-fix-unresolved-relative-imports.md
+++ b/python/ql/lib/change-notes/released/7.0.4.md
@@ -1,5 +1,5 @@
----
-category: fix
----
+## 7.0.4
+
+### Bug Fixes
- Fixed the resolution of relative imports such as `from . import helper` inside namespace packages (directories without an `__init__.py` file), which previously did not work correctly, leading to missing flow.
diff --git a/python/ql/lib/codeql-pack.release.yml b/python/ql/lib/codeql-pack.release.yml
index cf80607304e..6630ee1984a 100644
--- a/python/ql/lib/codeql-pack.release.yml
+++ b/python/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 7.0.3
+lastReleaseVersion: 7.0.4
diff --git a/python/ql/lib/qlpack.yml b/python/ql/lib/qlpack.yml
index bdf4cd0d804..11bd0783583 100644
--- a/python/ql/lib/qlpack.yml
+++ b/python/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/python-all
-version: 7.0.4-dev
+version: 7.0.4
groups: python
dbscheme: semmlecode.python.dbscheme
extractor: python
diff --git a/python/ql/src/CHANGELOG.md b/python/ql/src/CHANGELOG.md
index 4b109dca569..d5f5269c61d 100644
--- a/python/ql/src/CHANGELOG.md
+++ b/python/ql/src/CHANGELOG.md
@@ -1,3 +1,14 @@
+## 1.8.0
+
+### Query Metadata Changes
+
+* The `@security-severity` metadata of `py/log-injection` has been reduced from 7.8 (high) to 6.1 (medium).
+* The `@security-severity` metadata of `py/jinja2/autoescape-false` and `py/reflective-xss` has been increased from 6.1 (medium) to 7.8 (high).
+
+### Major Analysis Improvements
+
+- Several quality queries have been ported away from using the legacy points-to library. This may lead to changes in alerts.
+
## 1.7.11
No user-facing changes.
diff --git a/python/ql/src/change-notes/2026-03-13-port-simple-points-to-queries.md b/python/ql/src/change-notes/2026-03-13-port-simple-points-to-queries.md
deleted file mode 100644
index 3673b6de83a..00000000000
--- a/python/ql/src/change-notes/2026-03-13-port-simple-points-to-queries.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-category: majorAnalysis
----
-
-- Several quality queries have been ported away from using the legacy points-to library. This may lead to changes in alerts.
diff --git a/python/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md b/python/ql/src/change-notes/released/1.8.0.md
similarity index 56%
rename from python/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md
rename to python/ql/src/change-notes/released/1.8.0.md
index 4278d0171e3..123b4604da3 100644
--- a/python/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md
+++ b/python/ql/src/change-notes/released/1.8.0.md
@@ -1,5 +1,10 @@
----
-category: queryMetadata
----
+## 1.8.0
+
+### Query Metadata Changes
+
* The `@security-severity` metadata of `py/log-injection` has been reduced from 7.8 (high) to 6.1 (medium).
* The `@security-severity` metadata of `py/jinja2/autoescape-false` and `py/reflective-xss` has been increased from 6.1 (medium) to 7.8 (high).
+
+### Major Analysis Improvements
+
+- Several quality queries have been ported away from using the legacy points-to library. This may lead to changes in alerts.
diff --git a/python/ql/src/codeql-pack.release.yml b/python/ql/src/codeql-pack.release.yml
index 6e5b0b6e2f2..dc8a37cc443 100644
--- a/python/ql/src/codeql-pack.release.yml
+++ b/python/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.7.11
+lastReleaseVersion: 1.8.0
diff --git a/python/ql/src/qlpack.yml b/python/ql/src/qlpack.yml
index 32f1015130b..d3c52c315e8 100644
--- a/python/ql/src/qlpack.yml
+++ b/python/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/python-queries
-version: 1.7.12-dev
+version: 1.8.0
groups:
- python
- queries
diff --git a/ruby/ql/lib/CHANGELOG.md b/ruby/ql/lib/CHANGELOG.md
index ce1187d6442..40cb88d396f 100644
--- a/ruby/ql/lib/CHANGELOG.md
+++ b/ruby/ql/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 5.1.15
+
+No user-facing changes.
+
## 5.1.14
No user-facing changes.
diff --git a/ruby/ql/lib/change-notes/released/5.1.15.md b/ruby/ql/lib/change-notes/released/5.1.15.md
new file mode 100644
index 00000000000..c3ff6293f36
--- /dev/null
+++ b/ruby/ql/lib/change-notes/released/5.1.15.md
@@ -0,0 +1,3 @@
+## 5.1.15
+
+No user-facing changes.
diff --git a/ruby/ql/lib/codeql-pack.release.yml b/ruby/ql/lib/codeql-pack.release.yml
index bf92d1c672e..840348ed924 100644
--- a/ruby/ql/lib/codeql-pack.release.yml
+++ b/ruby/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 5.1.14
+lastReleaseVersion: 5.1.15
diff --git a/ruby/ql/lib/qlpack.yml b/ruby/ql/lib/qlpack.yml
index 56537ce0a17..687618237bb 100644
--- a/ruby/ql/lib/qlpack.yml
+++ b/ruby/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ruby-all
-version: 5.1.15-dev
+version: 5.1.15
groups: ruby
extractor: ruby
dbscheme: ruby.dbscheme
diff --git a/ruby/ql/src/CHANGELOG.md b/ruby/ql/src/CHANGELOG.md
index 884e126d9a1..cb4c0ae7874 100644
--- a/ruby/ql/src/CHANGELOG.md
+++ b/ruby/ql/src/CHANGELOG.md
@@ -1,3 +1,10 @@
+## 1.6.0
+
+### Query Metadata Changes
+
+* The `@security-severity` metadata of `rb/log-injection` has been reduced from 7.8 (high) to 6.1 (medium).
+* The `@security-severity` metadata of `rb/reflected-xss`, `rb/stored-xss` and `rb/html-constructed-from-input` has been increased from 6.1 (medium) to 7.8 (high).
+
## 1.5.11
No user-facing changes.
diff --git a/ruby/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md b/ruby/ql/src/change-notes/released/1.6.0.md
similarity index 87%
rename from ruby/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md
rename to ruby/ql/src/change-notes/released/1.6.0.md
index 459c2ce7f91..0398dab7aaf 100644
--- a/ruby/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md
+++ b/ruby/ql/src/change-notes/released/1.6.0.md
@@ -1,5 +1,6 @@
----
-category: queryMetadata
----
+## 1.6.0
+
+### Query Metadata Changes
+
* The `@security-severity` metadata of `rb/log-injection` has been reduced from 7.8 (high) to 6.1 (medium).
* The `@security-severity` metadata of `rb/reflected-xss`, `rb/stored-xss` and `rb/html-constructed-from-input` has been increased from 6.1 (medium) to 7.8 (high).
diff --git a/ruby/ql/src/codeql-pack.release.yml b/ruby/ql/src/codeql-pack.release.yml
index 7e8e8103d99..c4f0b07d533 100644
--- a/ruby/ql/src/codeql-pack.release.yml
+++ b/ruby/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.5.11
+lastReleaseVersion: 1.6.0
diff --git a/ruby/ql/src/qlpack.yml b/ruby/ql/src/qlpack.yml
index 20487d171b1..a0473f5f849 100644
--- a/ruby/ql/src/qlpack.yml
+++ b/ruby/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ruby-queries
-version: 1.5.12-dev
+version: 1.6.0
groups:
- ruby
- queries
diff --git a/rust/ql/lib/CHANGELOG.md b/rust/ql/lib/CHANGELOG.md
index 2672c08645b..eea5bd6e89d 100644
--- a/rust/ql/lib/CHANGELOG.md
+++ b/rust/ql/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.11
+
+No user-facing changes.
+
## 0.2.10
No user-facing changes.
diff --git a/rust/ql/lib/change-notes/released/0.2.11.md b/rust/ql/lib/change-notes/released/0.2.11.md
new file mode 100644
index 00000000000..1037f9194f8
--- /dev/null
+++ b/rust/ql/lib/change-notes/released/0.2.11.md
@@ -0,0 +1,3 @@
+## 0.2.11
+
+No user-facing changes.
diff --git a/rust/ql/lib/codeql-pack.release.yml b/rust/ql/lib/codeql-pack.release.yml
index a71167814cb..2ee635b9937 100644
--- a/rust/ql/lib/codeql-pack.release.yml
+++ b/rust/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.10
+lastReleaseVersion: 0.2.11
diff --git a/rust/ql/lib/qlpack.yml b/rust/ql/lib/qlpack.yml
index 502f10265fa..cef8c27d1cb 100644
--- a/rust/ql/lib/qlpack.yml
+++ b/rust/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/rust-all
-version: 0.2.11-dev
+version: 0.2.11
groups: rust
extractor: rust
dbscheme: rust.dbscheme
diff --git a/rust/ql/src/CHANGELOG.md b/rust/ql/src/CHANGELOG.md
index 35445b7d626..eab921bcbd6 100644
--- a/rust/ql/src/CHANGELOG.md
+++ b/rust/ql/src/CHANGELOG.md
@@ -1,3 +1,10 @@
+## 0.1.32
+
+### Query Metadata Changes
+
+* The `@security-severity` metadata of `rust/log-injection` has been increased from 2.6 (low) to 6.1 (medium).
+* The `@security-severity` metadata of `rust/xss` has been increased from 6.1 (medium) to 7.8 (high).
+
## 0.1.31
No user-facing changes.
diff --git a/rust/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md b/rust/ql/src/change-notes/released/0.1.32.md
similarity index 84%
rename from rust/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md
rename to rust/ql/src/change-notes/released/0.1.32.md
index 8bfc5be1551..d18f3ccd08d 100644
--- a/rust/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md
+++ b/rust/ql/src/change-notes/released/0.1.32.md
@@ -1,5 +1,6 @@
----
-category: queryMetadata
----
+## 0.1.32
+
+### Query Metadata Changes
+
* The `@security-severity` metadata of `rust/log-injection` has been increased from 2.6 (low) to 6.1 (medium).
* The `@security-severity` metadata of `rust/xss` has been increased from 6.1 (medium) to 7.8 (high).
diff --git a/rust/ql/src/codeql-pack.release.yml b/rust/ql/src/codeql-pack.release.yml
index 8f9b017abfe..21bbd752f27 100644
--- a/rust/ql/src/codeql-pack.release.yml
+++ b/rust/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.1.31
+lastReleaseVersion: 0.1.32
diff --git a/rust/ql/src/qlpack.yml b/rust/ql/src/qlpack.yml
index 48abcc305ee..41f566526eb 100644
--- a/rust/ql/src/qlpack.yml
+++ b/rust/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/rust-queries
-version: 0.1.32-dev
+version: 0.1.32
groups:
- rust
- queries
diff --git a/shared/concepts/CHANGELOG.md b/shared/concepts/CHANGELOG.md
index fc5bdcd8e23..704ea3e8e01 100644
--- a/shared/concepts/CHANGELOG.md
+++ b/shared/concepts/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.0.21
+
+No user-facing changes.
+
## 0.0.20
No user-facing changes.
diff --git a/shared/concepts/change-notes/released/0.0.21.md b/shared/concepts/change-notes/released/0.0.21.md
new file mode 100644
index 00000000000..d32472e976d
--- /dev/null
+++ b/shared/concepts/change-notes/released/0.0.21.md
@@ -0,0 +1,3 @@
+## 0.0.21
+
+No user-facing changes.
diff --git a/shared/concepts/codeql-pack.release.yml b/shared/concepts/codeql-pack.release.yml
index d2e86745bca..0c15c351db4 100644
--- a/shared/concepts/codeql-pack.release.yml
+++ b/shared/concepts/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.20
+lastReleaseVersion: 0.0.21
diff --git a/shared/concepts/qlpack.yml b/shared/concepts/qlpack.yml
index 04966d3a5b1..c2cc618dd2d 100644
--- a/shared/concepts/qlpack.yml
+++ b/shared/concepts/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/concepts
-version: 0.0.21-dev
+version: 0.0.21
groups: shared
library: true
dependencies:
diff --git a/shared/controlflow/CHANGELOG.md b/shared/controlflow/CHANGELOG.md
index 8725b6df20a..baca729ddda 100644
--- a/shared/controlflow/CHANGELOG.md
+++ b/shared/controlflow/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 2.0.31
+
+No user-facing changes.
+
## 2.0.30
No user-facing changes.
diff --git a/shared/controlflow/change-notes/released/2.0.31.md b/shared/controlflow/change-notes/released/2.0.31.md
new file mode 100644
index 00000000000..b3cd05e3de4
--- /dev/null
+++ b/shared/controlflow/change-notes/released/2.0.31.md
@@ -0,0 +1,3 @@
+## 2.0.31
+
+No user-facing changes.
diff --git a/shared/controlflow/codeql-pack.release.yml b/shared/controlflow/codeql-pack.release.yml
index 19c80429585..783d47207cd 100644
--- a/shared/controlflow/codeql-pack.release.yml
+++ b/shared/controlflow/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 2.0.30
+lastReleaseVersion: 2.0.31
diff --git a/shared/controlflow/qlpack.yml b/shared/controlflow/qlpack.yml
index 2bb2efdb8c0..c5c64a8bcb6 100644
--- a/shared/controlflow/qlpack.yml
+++ b/shared/controlflow/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/controlflow
-version: 2.0.31-dev
+version: 2.0.31
groups: shared
library: true
dependencies:
diff --git a/shared/dataflow/CHANGELOG.md b/shared/dataflow/CHANGELOG.md
index b2836038ddf..52c893f78e2 100644
--- a/shared/dataflow/CHANGELOG.md
+++ b/shared/dataflow/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 2.1.3
+
+No user-facing changes.
+
## 2.1.2
No user-facing changes.
diff --git a/shared/dataflow/change-notes/released/2.1.3.md b/shared/dataflow/change-notes/released/2.1.3.md
new file mode 100644
index 00000000000..a1338012fcd
--- /dev/null
+++ b/shared/dataflow/change-notes/released/2.1.3.md
@@ -0,0 +1,3 @@
+## 2.1.3
+
+No user-facing changes.
diff --git a/shared/dataflow/codeql-pack.release.yml b/shared/dataflow/codeql-pack.release.yml
index 1a4e53e8772..345fb0c73a4 100644
--- a/shared/dataflow/codeql-pack.release.yml
+++ b/shared/dataflow/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 2.1.2
+lastReleaseVersion: 2.1.3
diff --git a/shared/dataflow/qlpack.yml b/shared/dataflow/qlpack.yml
index da82b4bcd40..3009091cfdb 100644
--- a/shared/dataflow/qlpack.yml
+++ b/shared/dataflow/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/dataflow
-version: 2.1.3-dev
+version: 2.1.3
groups: shared
library: true
dependencies:
diff --git a/shared/mad/CHANGELOG.md b/shared/mad/CHANGELOG.md
index f08f6492daf..1bffb976cf8 100644
--- a/shared/mad/CHANGELOG.md
+++ b/shared/mad/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.0.47
+
+No user-facing changes.
+
## 1.0.46
No user-facing changes.
diff --git a/shared/mad/change-notes/released/1.0.47.md b/shared/mad/change-notes/released/1.0.47.md
new file mode 100644
index 00000000000..0c12039c180
--- /dev/null
+++ b/shared/mad/change-notes/released/1.0.47.md
@@ -0,0 +1,3 @@
+## 1.0.47
+
+No user-facing changes.
diff --git a/shared/mad/codeql-pack.release.yml b/shared/mad/codeql-pack.release.yml
index 05205e6a59e..dcec0f6405a 100644
--- a/shared/mad/codeql-pack.release.yml
+++ b/shared/mad/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.0.46
+lastReleaseVersion: 1.0.47
diff --git a/shared/mad/qlpack.yml b/shared/mad/qlpack.yml
index 00243bdecc0..678be4858dc 100644
--- a/shared/mad/qlpack.yml
+++ b/shared/mad/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/mad
-version: 1.0.47-dev
+version: 1.0.47
groups: shared
library: true
dependencies:
diff --git a/shared/quantum/CHANGELOG.md b/shared/quantum/CHANGELOG.md
index 20ebb6b42c0..8d524a11a09 100644
--- a/shared/quantum/CHANGELOG.md
+++ b/shared/quantum/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.0.25
+
+No user-facing changes.
+
## 0.0.24
No user-facing changes.
diff --git a/shared/quantum/change-notes/released/0.0.25.md b/shared/quantum/change-notes/released/0.0.25.md
new file mode 100644
index 00000000000..e41a9acfa06
--- /dev/null
+++ b/shared/quantum/change-notes/released/0.0.25.md
@@ -0,0 +1,3 @@
+## 0.0.25
+
+No user-facing changes.
diff --git a/shared/quantum/codeql-pack.release.yml b/shared/quantum/codeql-pack.release.yml
index b956773a07f..6d0e80a50c3 100644
--- a/shared/quantum/codeql-pack.release.yml
+++ b/shared/quantum/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.24
+lastReleaseVersion: 0.0.25
diff --git a/shared/quantum/qlpack.yml b/shared/quantum/qlpack.yml
index 4a33f9168a2..38fca7fc6dc 100644
--- a/shared/quantum/qlpack.yml
+++ b/shared/quantum/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/quantum
-version: 0.0.25-dev
+version: 0.0.25
groups: shared
library: true
dependencies:
diff --git a/shared/rangeanalysis/CHANGELOG.md b/shared/rangeanalysis/CHANGELOG.md
index 0014924513d..0ab7487192c 100644
--- a/shared/rangeanalysis/CHANGELOG.md
+++ b/shared/rangeanalysis/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.0.47
+
+No user-facing changes.
+
## 1.0.46
No user-facing changes.
diff --git a/shared/rangeanalysis/change-notes/released/1.0.47.md b/shared/rangeanalysis/change-notes/released/1.0.47.md
new file mode 100644
index 00000000000..0c12039c180
--- /dev/null
+++ b/shared/rangeanalysis/change-notes/released/1.0.47.md
@@ -0,0 +1,3 @@
+## 1.0.47
+
+No user-facing changes.
diff --git a/shared/rangeanalysis/codeql-pack.release.yml b/shared/rangeanalysis/codeql-pack.release.yml
index 05205e6a59e..dcec0f6405a 100644
--- a/shared/rangeanalysis/codeql-pack.release.yml
+++ b/shared/rangeanalysis/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.0.46
+lastReleaseVersion: 1.0.47
diff --git a/shared/rangeanalysis/qlpack.yml b/shared/rangeanalysis/qlpack.yml
index fe558ac3f18..2cf45348dc0 100644
--- a/shared/rangeanalysis/qlpack.yml
+++ b/shared/rangeanalysis/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/rangeanalysis
-version: 1.0.47-dev
+version: 1.0.47
groups: shared
library: true
dependencies:
diff --git a/shared/regex/CHANGELOG.md b/shared/regex/CHANGELOG.md
index 0b6da82a669..dd6f0c4cad6 100644
--- a/shared/regex/CHANGELOG.md
+++ b/shared/regex/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.0.47
+
+No user-facing changes.
+
## 1.0.46
No user-facing changes.
diff --git a/shared/regex/change-notes/released/1.0.47.md b/shared/regex/change-notes/released/1.0.47.md
new file mode 100644
index 00000000000..0c12039c180
--- /dev/null
+++ b/shared/regex/change-notes/released/1.0.47.md
@@ -0,0 +1,3 @@
+## 1.0.47
+
+No user-facing changes.
diff --git a/shared/regex/codeql-pack.release.yml b/shared/regex/codeql-pack.release.yml
index 05205e6a59e..dcec0f6405a 100644
--- a/shared/regex/codeql-pack.release.yml
+++ b/shared/regex/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.0.46
+lastReleaseVersion: 1.0.47
diff --git a/shared/regex/qlpack.yml b/shared/regex/qlpack.yml
index 58fc5cc3e10..b2070c25fb1 100644
--- a/shared/regex/qlpack.yml
+++ b/shared/regex/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/regex
-version: 1.0.47-dev
+version: 1.0.47
groups: shared
library: true
dependencies:
diff --git a/shared/ssa/CHANGELOG.md b/shared/ssa/CHANGELOG.md
index 9b5af989964..3573140fc41 100644
--- a/shared/ssa/CHANGELOG.md
+++ b/shared/ssa/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 2.0.23
+
+No user-facing changes.
+
## 2.0.22
No user-facing changes.
diff --git a/shared/ssa/change-notes/released/2.0.23.md b/shared/ssa/change-notes/released/2.0.23.md
new file mode 100644
index 00000000000..ab6f6f171ed
--- /dev/null
+++ b/shared/ssa/change-notes/released/2.0.23.md
@@ -0,0 +1,3 @@
+## 2.0.23
+
+No user-facing changes.
diff --git a/shared/ssa/codeql-pack.release.yml b/shared/ssa/codeql-pack.release.yml
index 980bdfe195b..1bd7e296a34 100644
--- a/shared/ssa/codeql-pack.release.yml
+++ b/shared/ssa/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 2.0.22
+lastReleaseVersion: 2.0.23
diff --git a/shared/ssa/qlpack.yml b/shared/ssa/qlpack.yml
index 3cf46284247..ab991edcccc 100644
--- a/shared/ssa/qlpack.yml
+++ b/shared/ssa/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ssa
-version: 2.0.23-dev
+version: 2.0.23
groups: shared
library: true
dependencies:
diff --git a/shared/threat-models/CHANGELOG.md b/shared/threat-models/CHANGELOG.md
index 065f61912fa..34ae2fd2277 100644
--- a/shared/threat-models/CHANGELOG.md
+++ b/shared/threat-models/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.0.47
+
+No user-facing changes.
+
## 1.0.46
No user-facing changes.
diff --git a/shared/threat-models/change-notes/released/1.0.47.md b/shared/threat-models/change-notes/released/1.0.47.md
new file mode 100644
index 00000000000..0c12039c180
--- /dev/null
+++ b/shared/threat-models/change-notes/released/1.0.47.md
@@ -0,0 +1,3 @@
+## 1.0.47
+
+No user-facing changes.
diff --git a/shared/threat-models/codeql-pack.release.yml b/shared/threat-models/codeql-pack.release.yml
index 05205e6a59e..dcec0f6405a 100644
--- a/shared/threat-models/codeql-pack.release.yml
+++ b/shared/threat-models/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.0.46
+lastReleaseVersion: 1.0.47
diff --git a/shared/threat-models/qlpack.yml b/shared/threat-models/qlpack.yml
index c3589be5880..37f9b1ba744 100644
--- a/shared/threat-models/qlpack.yml
+++ b/shared/threat-models/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/threat-models
-version: 1.0.47-dev
+version: 1.0.47
library: true
groups: shared
dataExtensions:
diff --git a/shared/tutorial/CHANGELOG.md b/shared/tutorial/CHANGELOG.md
index 297d40b694f..cf8f60d1d46 100644
--- a/shared/tutorial/CHANGELOG.md
+++ b/shared/tutorial/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.0.47
+
+No user-facing changes.
+
## 1.0.46
No user-facing changes.
diff --git a/shared/tutorial/change-notes/released/1.0.47.md b/shared/tutorial/change-notes/released/1.0.47.md
new file mode 100644
index 00000000000..0c12039c180
--- /dev/null
+++ b/shared/tutorial/change-notes/released/1.0.47.md
@@ -0,0 +1,3 @@
+## 1.0.47
+
+No user-facing changes.
diff --git a/shared/tutorial/codeql-pack.release.yml b/shared/tutorial/codeql-pack.release.yml
index 05205e6a59e..dcec0f6405a 100644
--- a/shared/tutorial/codeql-pack.release.yml
+++ b/shared/tutorial/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.0.46
+lastReleaseVersion: 1.0.47
diff --git a/shared/tutorial/qlpack.yml b/shared/tutorial/qlpack.yml
index 53716b9b5ca..d2ab12f9345 100644
--- a/shared/tutorial/qlpack.yml
+++ b/shared/tutorial/qlpack.yml
@@ -1,7 +1,7 @@
name: codeql/tutorial
description: Library for the CodeQL detective tutorials, helping new users learn to
write CodeQL queries.
-version: 1.0.47-dev
+version: 1.0.47
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/shared/typeflow/CHANGELOG.md b/shared/typeflow/CHANGELOG.md
index 039a7ef99a3..8c5ee5e9486 100644
--- a/shared/typeflow/CHANGELOG.md
+++ b/shared/typeflow/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.0.47
+
+No user-facing changes.
+
## 1.0.46
No user-facing changes.
diff --git a/shared/typeflow/change-notes/released/1.0.47.md b/shared/typeflow/change-notes/released/1.0.47.md
new file mode 100644
index 00000000000..0c12039c180
--- /dev/null
+++ b/shared/typeflow/change-notes/released/1.0.47.md
@@ -0,0 +1,3 @@
+## 1.0.47
+
+No user-facing changes.
diff --git a/shared/typeflow/codeql-pack.release.yml b/shared/typeflow/codeql-pack.release.yml
index 05205e6a59e..dcec0f6405a 100644
--- a/shared/typeflow/codeql-pack.release.yml
+++ b/shared/typeflow/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.0.46
+lastReleaseVersion: 1.0.47
diff --git a/shared/typeflow/qlpack.yml b/shared/typeflow/qlpack.yml
index ea0f559611c..c8d7a74c297 100644
--- a/shared/typeflow/qlpack.yml
+++ b/shared/typeflow/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/typeflow
-version: 1.0.47-dev
+version: 1.0.47
groups: shared
library: true
dependencies:
diff --git a/shared/typeinference/CHANGELOG.md b/shared/typeinference/CHANGELOG.md
index be06e2108a8..7153b9314b1 100644
--- a/shared/typeinference/CHANGELOG.md
+++ b/shared/typeinference/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.0.28
+
+No user-facing changes.
+
## 0.0.27
No user-facing changes.
diff --git a/shared/typeinference/change-notes/released/0.0.28.md b/shared/typeinference/change-notes/released/0.0.28.md
new file mode 100644
index 00000000000..1b4fdd47819
--- /dev/null
+++ b/shared/typeinference/change-notes/released/0.0.28.md
@@ -0,0 +1,3 @@
+## 0.0.28
+
+No user-facing changes.
diff --git a/shared/typeinference/codeql-pack.release.yml b/shared/typeinference/codeql-pack.release.yml
index dbab90d6989..3462db7d348 100644
--- a/shared/typeinference/codeql-pack.release.yml
+++ b/shared/typeinference/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.27
+lastReleaseVersion: 0.0.28
diff --git a/shared/typeinference/qlpack.yml b/shared/typeinference/qlpack.yml
index 75aedbf6423..d459c36ce72 100644
--- a/shared/typeinference/qlpack.yml
+++ b/shared/typeinference/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/typeinference
-version: 0.0.28-dev
+version: 0.0.28
groups: shared
library: true
dependencies:
diff --git a/shared/typetracking/CHANGELOG.md b/shared/typetracking/CHANGELOG.md
index 4132c8bcd99..f779002267a 100644
--- a/shared/typetracking/CHANGELOG.md
+++ b/shared/typetracking/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 2.0.31
+
+No user-facing changes.
+
## 2.0.30
No user-facing changes.
diff --git a/shared/typetracking/change-notes/released/2.0.31.md b/shared/typetracking/change-notes/released/2.0.31.md
new file mode 100644
index 00000000000..b3cd05e3de4
--- /dev/null
+++ b/shared/typetracking/change-notes/released/2.0.31.md
@@ -0,0 +1,3 @@
+## 2.0.31
+
+No user-facing changes.
diff --git a/shared/typetracking/codeql-pack.release.yml b/shared/typetracking/codeql-pack.release.yml
index 19c80429585..783d47207cd 100644
--- a/shared/typetracking/codeql-pack.release.yml
+++ b/shared/typetracking/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 2.0.30
+lastReleaseVersion: 2.0.31
diff --git a/shared/typetracking/qlpack.yml b/shared/typetracking/qlpack.yml
index b9998e1240a..d2d55be5b55 100644
--- a/shared/typetracking/qlpack.yml
+++ b/shared/typetracking/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/typetracking
-version: 2.0.31-dev
+version: 2.0.31
groups: shared
library: true
dependencies:
diff --git a/shared/typos/CHANGELOG.md b/shared/typos/CHANGELOG.md
index 6f0db2fa4b3..b49f756fef0 100644
--- a/shared/typos/CHANGELOG.md
+++ b/shared/typos/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.0.47
+
+No user-facing changes.
+
## 1.0.46
No user-facing changes.
diff --git a/shared/typos/change-notes/released/1.0.47.md b/shared/typos/change-notes/released/1.0.47.md
new file mode 100644
index 00000000000..0c12039c180
--- /dev/null
+++ b/shared/typos/change-notes/released/1.0.47.md
@@ -0,0 +1,3 @@
+## 1.0.47
+
+No user-facing changes.
diff --git a/shared/typos/codeql-pack.release.yml b/shared/typos/codeql-pack.release.yml
index 05205e6a59e..dcec0f6405a 100644
--- a/shared/typos/codeql-pack.release.yml
+++ b/shared/typos/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.0.46
+lastReleaseVersion: 1.0.47
diff --git a/shared/typos/qlpack.yml b/shared/typos/qlpack.yml
index dc62caedd6b..b9b579b5176 100644
--- a/shared/typos/qlpack.yml
+++ b/shared/typos/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/typos
-version: 1.0.47-dev
+version: 1.0.47
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/shared/util/CHANGELOG.md b/shared/util/CHANGELOG.md
index 56a45488e07..cb3ac7bbe79 100644
--- a/shared/util/CHANGELOG.md
+++ b/shared/util/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 2.0.34
+
+No user-facing changes.
+
## 2.0.33
No user-facing changes.
diff --git a/shared/util/change-notes/released/2.0.34.md b/shared/util/change-notes/released/2.0.34.md
new file mode 100644
index 00000000000..fd170d38ce6
--- /dev/null
+++ b/shared/util/change-notes/released/2.0.34.md
@@ -0,0 +1,3 @@
+## 2.0.34
+
+No user-facing changes.
diff --git a/shared/util/codeql-pack.release.yml b/shared/util/codeql-pack.release.yml
index 92e23200b4d..339a3ce7c57 100644
--- a/shared/util/codeql-pack.release.yml
+++ b/shared/util/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 2.0.33
+lastReleaseVersion: 2.0.34
diff --git a/shared/util/qlpack.yml b/shared/util/qlpack.yml
index d27b3d6c59c..4f7bb193afb 100644
--- a/shared/util/qlpack.yml
+++ b/shared/util/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/util
-version: 2.0.34-dev
+version: 2.0.34
groups: shared
library: true
dependencies: null
diff --git a/shared/xml/CHANGELOG.md b/shared/xml/CHANGELOG.md
index dc06867e32d..98702251320 100644
--- a/shared/xml/CHANGELOG.md
+++ b/shared/xml/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.0.47
+
+No user-facing changes.
+
## 1.0.46
No user-facing changes.
diff --git a/shared/xml/change-notes/released/1.0.47.md b/shared/xml/change-notes/released/1.0.47.md
new file mode 100644
index 00000000000..0c12039c180
--- /dev/null
+++ b/shared/xml/change-notes/released/1.0.47.md
@@ -0,0 +1,3 @@
+## 1.0.47
+
+No user-facing changes.
diff --git a/shared/xml/codeql-pack.release.yml b/shared/xml/codeql-pack.release.yml
index 05205e6a59e..dcec0f6405a 100644
--- a/shared/xml/codeql-pack.release.yml
+++ b/shared/xml/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.0.46
+lastReleaseVersion: 1.0.47
diff --git a/shared/xml/qlpack.yml b/shared/xml/qlpack.yml
index 5195fcbbe18..fe6e59d133e 100644
--- a/shared/xml/qlpack.yml
+++ b/shared/xml/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/xml
-version: 1.0.47-dev
+version: 1.0.47
groups: shared
library: true
dependencies:
diff --git a/shared/yaml/CHANGELOG.md b/shared/yaml/CHANGELOG.md
index 557db2b4405..4a41f8ee9df 100644
--- a/shared/yaml/CHANGELOG.md
+++ b/shared/yaml/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.0.47
+
+No user-facing changes.
+
## 1.0.46
No user-facing changes.
diff --git a/shared/yaml/change-notes/released/1.0.47.md b/shared/yaml/change-notes/released/1.0.47.md
new file mode 100644
index 00000000000..0c12039c180
--- /dev/null
+++ b/shared/yaml/change-notes/released/1.0.47.md
@@ -0,0 +1,3 @@
+## 1.0.47
+
+No user-facing changes.
diff --git a/shared/yaml/codeql-pack.release.yml b/shared/yaml/codeql-pack.release.yml
index 05205e6a59e..dcec0f6405a 100644
--- a/shared/yaml/codeql-pack.release.yml
+++ b/shared/yaml/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.0.46
+lastReleaseVersion: 1.0.47
diff --git a/shared/yaml/qlpack.yml b/shared/yaml/qlpack.yml
index b6f74301d3a..f8e5976f8fa 100644
--- a/shared/yaml/qlpack.yml
+++ b/shared/yaml/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/yaml
-version: 1.0.47-dev
+version: 1.0.47
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/swift/ql/lib/CHANGELOG.md b/swift/ql/lib/CHANGELOG.md
index fda32d265b0..3967689b933 100644
--- a/swift/ql/lib/CHANGELOG.md
+++ b/swift/ql/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 6.3.3
+
+No user-facing changes.
+
## 6.3.2
No user-facing changes.
diff --git a/swift/ql/lib/change-notes/released/6.3.3.md b/swift/ql/lib/change-notes/released/6.3.3.md
new file mode 100644
index 00000000000..86c54aaebb2
--- /dev/null
+++ b/swift/ql/lib/change-notes/released/6.3.3.md
@@ -0,0 +1,3 @@
+## 6.3.3
+
+No user-facing changes.
diff --git a/swift/ql/lib/codeql-pack.release.yml b/swift/ql/lib/codeql-pack.release.yml
index bf4d875e15a..83b98dcdbc3 100644
--- a/swift/ql/lib/codeql-pack.release.yml
+++ b/swift/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 6.3.2
+lastReleaseVersion: 6.3.3
diff --git a/swift/ql/lib/qlpack.yml b/swift/ql/lib/qlpack.yml
index d403d14d991..ebe1f051136 100644
--- a/swift/ql/lib/qlpack.yml
+++ b/swift/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/swift-all
-version: 6.3.3-dev
+version: 6.3.3
groups: swift
extractor: swift
dbscheme: swift.dbscheme
diff --git a/swift/ql/src/CHANGELOG.md b/swift/ql/src/CHANGELOG.md
index 1d4d9877b60..f880dc3366f 100644
--- a/swift/ql/src/CHANGELOG.md
+++ b/swift/ql/src/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 1.3.0
+
+### Query Metadata Changes
+
+* The `@security-severity` metadata of `swift/unsafe-webview-fetch` has been increased from 6.1 (medium) to 7.8 (high).
+
## 1.2.20
No user-facing changes.
diff --git a/swift/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md b/swift/ql/src/change-notes/released/1.3.0.md
similarity index 75%
rename from swift/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md
rename to swift/ql/src/change-notes/released/1.3.0.md
index a46302ed146..5a85d7239d7 100644
--- a/swift/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md
+++ b/swift/ql/src/change-notes/released/1.3.0.md
@@ -1,4 +1,5 @@
----
-category: queryMetadata
----
+## 1.3.0
+
+### Query Metadata Changes
+
* The `@security-severity` metadata of `swift/unsafe-webview-fetch` has been increased from 6.1 (medium) to 7.8 (high).
diff --git a/swift/ql/src/codeql-pack.release.yml b/swift/ql/src/codeql-pack.release.yml
index 8e035aaa1f4..ec16350ed6f 100644
--- a/swift/ql/src/codeql-pack.release.yml
+++ b/swift/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.2.20
+lastReleaseVersion: 1.3.0
diff --git a/swift/ql/src/qlpack.yml b/swift/ql/src/qlpack.yml
index 64c712af472..84b3e1d0b5d 100644
--- a/swift/ql/src/qlpack.yml
+++ b/swift/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/swift-queries
-version: 1.2.21-dev
+version: 1.3.0
groups:
- swift
- queries
From 242090e0acdb7d1af75b4f3e4c556629e24f95ff Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
Date: Mon, 6 Apr 2026 13:49:20 +0000
Subject: [PATCH 058/185] Post-release preparation for codeql-cli-2.25.2
---
actions/ql/lib/qlpack.yml | 2 +-
actions/ql/src/qlpack.yml | 2 +-
cpp/ql/lib/qlpack.yml | 2 +-
cpp/ql/src/qlpack.yml | 2 +-
csharp/ql/campaigns/Solorigate/lib/qlpack.yml | 2 +-
csharp/ql/campaigns/Solorigate/src/qlpack.yml | 2 +-
csharp/ql/lib/qlpack.yml | 2 +-
csharp/ql/src/qlpack.yml | 2 +-
go/ql/consistency-queries/qlpack.yml | 2 +-
go/ql/lib/qlpack.yml | 2 +-
go/ql/src/qlpack.yml | 2 +-
java/ql/lib/qlpack.yml | 2 +-
java/ql/src/qlpack.yml | 2 +-
javascript/ql/lib/qlpack.yml | 2 +-
javascript/ql/src/qlpack.yml | 2 +-
misc/suite-helpers/qlpack.yml | 2 +-
python/ql/lib/qlpack.yml | 2 +-
python/ql/src/qlpack.yml | 2 +-
ruby/ql/lib/qlpack.yml | 2 +-
ruby/ql/src/qlpack.yml | 2 +-
rust/ql/lib/qlpack.yml | 2 +-
rust/ql/src/qlpack.yml | 2 +-
shared/concepts/qlpack.yml | 2 +-
shared/controlflow/qlpack.yml | 2 +-
shared/dataflow/qlpack.yml | 2 +-
shared/mad/qlpack.yml | 2 +-
shared/quantum/qlpack.yml | 2 +-
shared/rangeanalysis/qlpack.yml | 2 +-
shared/regex/qlpack.yml | 2 +-
shared/ssa/qlpack.yml | 2 +-
shared/threat-models/qlpack.yml | 2 +-
shared/tutorial/qlpack.yml | 2 +-
shared/typeflow/qlpack.yml | 2 +-
shared/typeinference/qlpack.yml | 2 +-
shared/typetracking/qlpack.yml | 2 +-
shared/typos/qlpack.yml | 2 +-
shared/util/qlpack.yml | 2 +-
shared/xml/qlpack.yml | 2 +-
shared/yaml/qlpack.yml | 2 +-
swift/ql/lib/qlpack.yml | 2 +-
swift/ql/src/qlpack.yml | 2 +-
41 files changed, 41 insertions(+), 41 deletions(-)
diff --git a/actions/ql/lib/qlpack.yml b/actions/ql/lib/qlpack.yml
index 131f29b87aa..fec27415800 100644
--- a/actions/ql/lib/qlpack.yml
+++ b/actions/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/actions-all
-version: 0.4.33
+version: 0.4.34-dev
library: true
warnOnImplicitThis: true
dependencies:
diff --git a/actions/ql/src/qlpack.yml b/actions/ql/src/qlpack.yml
index 024862b808a..3216a36f3d0 100644
--- a/actions/ql/src/qlpack.yml
+++ b/actions/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/actions-queries
-version: 0.6.25
+version: 0.6.26-dev
library: false
warnOnImplicitThis: true
groups: [actions, queries]
diff --git a/cpp/ql/lib/qlpack.yml b/cpp/ql/lib/qlpack.yml
index e4e7a96ef68..dbf57d2b869 100644
--- a/cpp/ql/lib/qlpack.yml
+++ b/cpp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/cpp-all
-version: 9.0.0
+version: 9.0.1-dev
groups: cpp
dbscheme: semmlecode.cpp.dbscheme
extractor: cpp
diff --git a/cpp/ql/src/qlpack.yml b/cpp/ql/src/qlpack.yml
index fa0391ae9c1..4648951796c 100644
--- a/cpp/ql/src/qlpack.yml
+++ b/cpp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/cpp-queries
-version: 1.6.0
+version: 1.6.1-dev
groups:
- cpp
- queries
diff --git a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
index 9c094c18dc6..006ef851567 100644
--- a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-all
-version: 1.7.64
+version: 1.7.65-dev
groups:
- csharp
- solorigate
diff --git a/csharp/ql/campaigns/Solorigate/src/qlpack.yml b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
index 666c44a2805..af5fd98f58a 100644
--- a/csharp/ql/campaigns/Solorigate/src/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-queries
-version: 1.7.64
+version: 1.7.65-dev
groups:
- csharp
- solorigate
diff --git a/csharp/ql/lib/qlpack.yml b/csharp/ql/lib/qlpack.yml
index d5088885cdb..02c1ccd0d33 100644
--- a/csharp/ql/lib/qlpack.yml
+++ b/csharp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-all
-version: 5.4.12
+version: 5.4.13-dev
groups: csharp
dbscheme: semmlecode.csharp.dbscheme
extractor: csharp
diff --git a/csharp/ql/src/qlpack.yml b/csharp/ql/src/qlpack.yml
index 64d02609317..9ea341d1b38 100644
--- a/csharp/ql/src/qlpack.yml
+++ b/csharp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-queries
-version: 1.7.0
+version: 1.7.1-dev
groups:
- csharp
- queries
diff --git a/go/ql/consistency-queries/qlpack.yml b/go/ql/consistency-queries/qlpack.yml
index 53b3d29e717..c9dda4765dd 100644
--- a/go/ql/consistency-queries/qlpack.yml
+++ b/go/ql/consistency-queries/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql-go-consistency-queries
-version: 1.0.47
+version: 1.0.48-dev
groups:
- go
- queries
diff --git a/go/ql/lib/qlpack.yml b/go/ql/lib/qlpack.yml
index 5c371bb7ae4..2d7338a020d 100644
--- a/go/ql/lib/qlpack.yml
+++ b/go/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/go-all
-version: 7.0.5
+version: 7.0.6-dev
groups: go
dbscheme: go.dbscheme
extractor: go
diff --git a/go/ql/src/qlpack.yml b/go/ql/src/qlpack.yml
index 1ec2c5b9430..de4e5e06d38 100644
--- a/go/ql/src/qlpack.yml
+++ b/go/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/go-queries
-version: 1.6.0
+version: 1.6.1-dev
groups:
- go
- queries
diff --git a/java/ql/lib/qlpack.yml b/java/ql/lib/qlpack.yml
index d840954d623..7f058cfb8d6 100644
--- a/java/ql/lib/qlpack.yml
+++ b/java/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-all
-version: 9.0.3
+version: 9.0.4-dev
groups: java
dbscheme: config/semmlecode.dbscheme
extractor: java
diff --git a/java/ql/src/qlpack.yml b/java/ql/src/qlpack.yml
index 2c4f95fb25b..72b4a5f94e6 100644
--- a/java/ql/src/qlpack.yml
+++ b/java/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-queries
-version: 1.11.0
+version: 1.11.1-dev
groups:
- java
- queries
diff --git a/javascript/ql/lib/qlpack.yml b/javascript/ql/lib/qlpack.yml
index df3fa463f35..e0834c056d1 100644
--- a/javascript/ql/lib/qlpack.yml
+++ b/javascript/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/javascript-all
-version: 2.6.27
+version: 2.6.28-dev
groups: javascript
dbscheme: semmlecode.javascript.dbscheme
extractor: javascript
diff --git a/javascript/ql/src/qlpack.yml b/javascript/ql/src/qlpack.yml
index 7bd7a08f955..117fae183e9 100644
--- a/javascript/ql/src/qlpack.yml
+++ b/javascript/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/javascript-queries
-version: 2.3.7
+version: 2.3.8-dev
groups:
- javascript
- queries
diff --git a/misc/suite-helpers/qlpack.yml b/misc/suite-helpers/qlpack.yml
index 9ee0e7338b2..1d853802342 100644
--- a/misc/suite-helpers/qlpack.yml
+++ b/misc/suite-helpers/qlpack.yml
@@ -1,4 +1,4 @@
name: codeql/suite-helpers
-version: 1.0.47
+version: 1.0.48-dev
groups: shared
warnOnImplicitThis: true
diff --git a/python/ql/lib/qlpack.yml b/python/ql/lib/qlpack.yml
index 11bd0783583..fe87c5761cf 100644
--- a/python/ql/lib/qlpack.yml
+++ b/python/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/python-all
-version: 7.0.4
+version: 7.0.5-dev
groups: python
dbscheme: semmlecode.python.dbscheme
extractor: python
diff --git a/python/ql/src/qlpack.yml b/python/ql/src/qlpack.yml
index d3c52c315e8..aa2a2364854 100644
--- a/python/ql/src/qlpack.yml
+++ b/python/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/python-queries
-version: 1.8.0
+version: 1.8.1-dev
groups:
- python
- queries
diff --git a/ruby/ql/lib/qlpack.yml b/ruby/ql/lib/qlpack.yml
index 687618237bb..bbf4de40909 100644
--- a/ruby/ql/lib/qlpack.yml
+++ b/ruby/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ruby-all
-version: 5.1.15
+version: 5.1.16-dev
groups: ruby
extractor: ruby
dbscheme: ruby.dbscheme
diff --git a/ruby/ql/src/qlpack.yml b/ruby/ql/src/qlpack.yml
index a0473f5f849..191689565de 100644
--- a/ruby/ql/src/qlpack.yml
+++ b/ruby/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ruby-queries
-version: 1.6.0
+version: 1.6.1-dev
groups:
- ruby
- queries
diff --git a/rust/ql/lib/qlpack.yml b/rust/ql/lib/qlpack.yml
index cef8c27d1cb..f5031020037 100644
--- a/rust/ql/lib/qlpack.yml
+++ b/rust/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/rust-all
-version: 0.2.11
+version: 0.2.12-dev
groups: rust
extractor: rust
dbscheme: rust.dbscheme
diff --git a/rust/ql/src/qlpack.yml b/rust/ql/src/qlpack.yml
index 41f566526eb..f78504db76e 100644
--- a/rust/ql/src/qlpack.yml
+++ b/rust/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/rust-queries
-version: 0.1.32
+version: 0.1.33-dev
groups:
- rust
- queries
diff --git a/shared/concepts/qlpack.yml b/shared/concepts/qlpack.yml
index c2cc618dd2d..bf6e8b6018c 100644
--- a/shared/concepts/qlpack.yml
+++ b/shared/concepts/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/concepts
-version: 0.0.21
+version: 0.0.22-dev
groups: shared
library: true
dependencies:
diff --git a/shared/controlflow/qlpack.yml b/shared/controlflow/qlpack.yml
index c5c64a8bcb6..5573548794d 100644
--- a/shared/controlflow/qlpack.yml
+++ b/shared/controlflow/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/controlflow
-version: 2.0.31
+version: 2.0.32-dev
groups: shared
library: true
dependencies:
diff --git a/shared/dataflow/qlpack.yml b/shared/dataflow/qlpack.yml
index 3009091cfdb..3b917def33d 100644
--- a/shared/dataflow/qlpack.yml
+++ b/shared/dataflow/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/dataflow
-version: 2.1.3
+version: 2.1.4-dev
groups: shared
library: true
dependencies:
diff --git a/shared/mad/qlpack.yml b/shared/mad/qlpack.yml
index 678be4858dc..b5583f8c55a 100644
--- a/shared/mad/qlpack.yml
+++ b/shared/mad/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/mad
-version: 1.0.47
+version: 1.0.48-dev
groups: shared
library: true
dependencies:
diff --git a/shared/quantum/qlpack.yml b/shared/quantum/qlpack.yml
index 38fca7fc6dc..a19e99ef7ea 100644
--- a/shared/quantum/qlpack.yml
+++ b/shared/quantum/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/quantum
-version: 0.0.25
+version: 0.0.26-dev
groups: shared
library: true
dependencies:
diff --git a/shared/rangeanalysis/qlpack.yml b/shared/rangeanalysis/qlpack.yml
index 2cf45348dc0..d493350749e 100644
--- a/shared/rangeanalysis/qlpack.yml
+++ b/shared/rangeanalysis/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/rangeanalysis
-version: 1.0.47
+version: 1.0.48-dev
groups: shared
library: true
dependencies:
diff --git a/shared/regex/qlpack.yml b/shared/regex/qlpack.yml
index b2070c25fb1..7b953dcff1c 100644
--- a/shared/regex/qlpack.yml
+++ b/shared/regex/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/regex
-version: 1.0.47
+version: 1.0.48-dev
groups: shared
library: true
dependencies:
diff --git a/shared/ssa/qlpack.yml b/shared/ssa/qlpack.yml
index ab991edcccc..a8fa9a11424 100644
--- a/shared/ssa/qlpack.yml
+++ b/shared/ssa/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ssa
-version: 2.0.23
+version: 2.0.24-dev
groups: shared
library: true
dependencies:
diff --git a/shared/threat-models/qlpack.yml b/shared/threat-models/qlpack.yml
index 37f9b1ba744..a4a367a990b 100644
--- a/shared/threat-models/qlpack.yml
+++ b/shared/threat-models/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/threat-models
-version: 1.0.47
+version: 1.0.48-dev
library: true
groups: shared
dataExtensions:
diff --git a/shared/tutorial/qlpack.yml b/shared/tutorial/qlpack.yml
index d2ab12f9345..f961ccdc0eb 100644
--- a/shared/tutorial/qlpack.yml
+++ b/shared/tutorial/qlpack.yml
@@ -1,7 +1,7 @@
name: codeql/tutorial
description: Library for the CodeQL detective tutorials, helping new users learn to
write CodeQL queries.
-version: 1.0.47
+version: 1.0.48-dev
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/shared/typeflow/qlpack.yml b/shared/typeflow/qlpack.yml
index c8d7a74c297..f7e111d28fd 100644
--- a/shared/typeflow/qlpack.yml
+++ b/shared/typeflow/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/typeflow
-version: 1.0.47
+version: 1.0.48-dev
groups: shared
library: true
dependencies:
diff --git a/shared/typeinference/qlpack.yml b/shared/typeinference/qlpack.yml
index d459c36ce72..97c8df36895 100644
--- a/shared/typeinference/qlpack.yml
+++ b/shared/typeinference/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/typeinference
-version: 0.0.28
+version: 0.0.29-dev
groups: shared
library: true
dependencies:
diff --git a/shared/typetracking/qlpack.yml b/shared/typetracking/qlpack.yml
index d2d55be5b55..aa029687531 100644
--- a/shared/typetracking/qlpack.yml
+++ b/shared/typetracking/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/typetracking
-version: 2.0.31
+version: 2.0.32-dev
groups: shared
library: true
dependencies:
diff --git a/shared/typos/qlpack.yml b/shared/typos/qlpack.yml
index b9b579b5176..37fc79bb1df 100644
--- a/shared/typos/qlpack.yml
+++ b/shared/typos/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/typos
-version: 1.0.47
+version: 1.0.48-dev
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/shared/util/qlpack.yml b/shared/util/qlpack.yml
index 4f7bb193afb..02e6241dccb 100644
--- a/shared/util/qlpack.yml
+++ b/shared/util/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/util
-version: 2.0.34
+version: 2.0.35-dev
groups: shared
library: true
dependencies: null
diff --git a/shared/xml/qlpack.yml b/shared/xml/qlpack.yml
index fe6e59d133e..0d75859bdb9 100644
--- a/shared/xml/qlpack.yml
+++ b/shared/xml/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/xml
-version: 1.0.47
+version: 1.0.48-dev
groups: shared
library: true
dependencies:
diff --git a/shared/yaml/qlpack.yml b/shared/yaml/qlpack.yml
index f8e5976f8fa..cfea54e0b5b 100644
--- a/shared/yaml/qlpack.yml
+++ b/shared/yaml/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/yaml
-version: 1.0.47
+version: 1.0.48-dev
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/swift/ql/lib/qlpack.yml b/swift/ql/lib/qlpack.yml
index ebe1f051136..32c6458ddea 100644
--- a/swift/ql/lib/qlpack.yml
+++ b/swift/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/swift-all
-version: 6.3.3
+version: 6.3.4-dev
groups: swift
extractor: swift
dbscheme: swift.dbscheme
diff --git a/swift/ql/src/qlpack.yml b/swift/ql/src/qlpack.yml
index 84b3e1d0b5d..5b6c7a6977a 100644
--- a/swift/ql/src/qlpack.yml
+++ b/swift/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/swift-queries
-version: 1.3.0
+version: 1.3.1-dev
groups:
- swift
- queries
From 74b0e8c19a811ad34f2efbca96425e3185217e76 Mon Sep 17 00:00:00 2001
From: idrissrio
Date: Wed, 18 Mar 2026 15:34:59 +0100
Subject: [PATCH 059/185] Java: Accept new test results after JDK 26 extractor
upgrade
---
.../compact-source-files/CompactSourceAnalysis.expected | 2 +-
.../compact-source-files/ImplicitClassDetection.expected | 2 +-
.../compact-source-files/MethodInCompactSource.expected | 4 ++--
java/ql/test/library-tests/compact-source-files/options | 2 +-
java/ql/test/library-tests/dataflow/kdf/options | 2 +-
java/ql/test/library-tests/dataflow/scoped-values/options | 2 +-
java/ql/test/library-tests/errorexpr/Test.java | 1 -
java/ql/test/library-tests/flexible-constructors/options | 2 +-
java/ql/test/library-tests/module-import-declarations/options | 2 +-
9 files changed, 9 insertions(+), 10 deletions(-)
diff --git a/java/ql/test/library-tests/compact-source-files/CompactSourceAnalysis.expected b/java/ql/test/library-tests/compact-source-files/CompactSourceAnalysis.expected
index 05db00aa26d..0e1dd647e41 100644
--- a/java/ql/test/library-tests/compact-source-files/CompactSourceAnalysis.expected
+++ b/java/ql/test/library-tests/compact-source-files/CompactSourceAnalysis.expected
@@ -1 +1 @@
-| Test.java:0:0:0:0 | Test | Test.java:1:1:1:1 | Test | Compact source file 'Test' contains implicit class 'Test' |
+| Test.java:0:0:0:0 | Test | Test.java:1:1:29:1 | Test | Compact source file 'Test' contains implicit class 'Test' |
diff --git a/java/ql/test/library-tests/compact-source-files/ImplicitClassDetection.expected b/java/ql/test/library-tests/compact-source-files/ImplicitClassDetection.expected
index 61dcdd8a17f..9bfaaecbbcb 100644
--- a/java/ql/test/library-tests/compact-source-files/ImplicitClassDetection.expected
+++ b/java/ql/test/library-tests/compact-source-files/ImplicitClassDetection.expected
@@ -1,2 +1,2 @@
-| Test.java:1:1:1:1 | Test | implicit |
+| Test.java:1:1:29:1 | Test | implicit |
| Test.java:25:7:25:16 | NotCompact | not implicit |
diff --git a/java/ql/test/library-tests/compact-source-files/MethodInCompactSource.expected b/java/ql/test/library-tests/compact-source-files/MethodInCompactSource.expected
index 3c7b45f500e..d4b41c61441 100644
--- a/java/ql/test/library-tests/compact-source-files/MethodInCompactSource.expected
+++ b/java/ql/test/library-tests/compact-source-files/MethodInCompactSource.expected
@@ -1,5 +1,5 @@
-| Test.java:1:1:1:1 | | in compact source |
-| Test.java:1:1:1:1 | | in compact source |
+| Test.java:1:1:29:1 | | in compact source |
+| Test.java:1:1:29:1 | | in compact source |
| Test.java:5:6:5:9 | main | in compact source |
| Test.java:11:6:11:16 | processData | in compact source |
| Test.java:16:14:16:31 | updatePrivateField | in compact source |
diff --git a/java/ql/test/library-tests/compact-source-files/options b/java/ql/test/library-tests/compact-source-files/options
index db1dc01e53b..3d6e630aa73 100644
--- a/java/ql/test/library-tests/compact-source-files/options
+++ b/java/ql/test/library-tests/compact-source-files/options
@@ -1 +1 @@
-//semmle-extractor-options: --javac-args --release 25 --enable-preview
+//semmle-extractor-options: --javac-args --release 25
diff --git a/java/ql/test/library-tests/dataflow/kdf/options b/java/ql/test/library-tests/dataflow/kdf/options
index f4edc64c017..801b81e0752 100644
--- a/java/ql/test/library-tests/dataflow/kdf/options
+++ b/java/ql/test/library-tests/dataflow/kdf/options
@@ -1 +1 @@
-//semmle-extractor-options: --javac-args --enable-preview --release 25
\ No newline at end of file
+//semmle-extractor-options: --javac-args --release 25
\ No newline at end of file
diff --git a/java/ql/test/library-tests/dataflow/scoped-values/options b/java/ql/test/library-tests/dataflow/scoped-values/options
index c793109355a..2d42b8d2cd8 100644
--- a/java/ql/test/library-tests/dataflow/scoped-values/options
+++ b/java/ql/test/library-tests/dataflow/scoped-values/options
@@ -1 +1 @@
-//semmle-extractor-options: --javac-args -source 25 -target 25 --enable-preview
\ No newline at end of file
+//semmle-extractor-options: --javac-args -source 25 -target 25
\ No newline at end of file
diff --git a/java/ql/test/library-tests/errorexpr/Test.java b/java/ql/test/library-tests/errorexpr/Test.java
index af314e5ced6..068690e7bb2 100644
--- a/java/ql/test/library-tests/errorexpr/Test.java
+++ b/java/ql/test/library-tests/errorexpr/Test.java
@@ -13,6 +13,5 @@ public class Test {
}
// Diagnostic Matches: Erroneous node in tree: (ERROR)
-// Diagnostic Matches: In file Test.java:8:15 no end location for JCMethodInvocation : yield(x)
// Diagnostic Matches: 1 errors during annotation processing
// Diagnostic Matches: Unknown or erroneous type for expression of kind ErrorExpr
diff --git a/java/ql/test/library-tests/flexible-constructors/options b/java/ql/test/library-tests/flexible-constructors/options
index db1dc01e53b..3d6e630aa73 100644
--- a/java/ql/test/library-tests/flexible-constructors/options
+++ b/java/ql/test/library-tests/flexible-constructors/options
@@ -1 +1 @@
-//semmle-extractor-options: --javac-args --release 25 --enable-preview
+//semmle-extractor-options: --javac-args --release 25
diff --git a/java/ql/test/library-tests/module-import-declarations/options b/java/ql/test/library-tests/module-import-declarations/options
index b510fdce0df..801b81e0752 100644
--- a/java/ql/test/library-tests/module-import-declarations/options
+++ b/java/ql/test/library-tests/module-import-declarations/options
@@ -1 +1 @@
-//semmle-extractor-options: --javac-args --release 25 --enable-preview
\ No newline at end of file
+//semmle-extractor-options: --javac-args --release 25
\ No newline at end of file
From 5a6eb7947068ce413cb20678bb743ceb2b4b0a48 Mon Sep 17 00:00:00 2001
From: idrissrio
Date: Fri, 20 Mar 2026 20:27:33 +0100
Subject: [PATCH 060/185] Java: Pin CWE-676 test to --release 25
Thread.stop() was removed in JDK 26. Pin the test to --release 25.
---
java/ql/test/query-tests/security/CWE-676/semmle/tests/options | 1 +
1 file changed, 1 insertion(+)
create mode 100644 java/ql/test/query-tests/security/CWE-676/semmle/tests/options
diff --git a/java/ql/test/query-tests/security/CWE-676/semmle/tests/options b/java/ql/test/query-tests/security/CWE-676/semmle/tests/options
new file mode 100644
index 00000000000..3d6e630aa73
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-676/semmle/tests/options
@@ -0,0 +1 @@
+//semmle-extractor-options: --javac-args --release 25
From 3ccbd8032c938c95f9ea2d2f5568545370c80216 Mon Sep 17 00:00:00 2001
From: idrissrio
Date: Fri, 20 Mar 2026 20:27:41 +0100
Subject: [PATCH 061/185] Java: Accept new test results for JDK 26
JDK 26 added ofLazy methods to List, Map, and Set collections.
Update expected test output to include these new methods.
---
.../test.expected | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/java/ql/test-kotlin1/library-tests/java-kotlin-collection-type-generic-methods/test.expected b/java/ql/test-kotlin1/library-tests/java-kotlin-collection-type-generic-methods/test.expected
index a56980d10ac..a55e73e283f 100644
--- a/java/ql/test-kotlin1/library-tests/java-kotlin-collection-type-generic-methods/test.expected
+++ b/java/ql/test-kotlin1/library-tests/java-kotlin-collection-type-generic-methods/test.expected
@@ -196,6 +196,8 @@ methodWithDuplicate
| List | listIterator | int |
| List | of | E |
| List | of | E[] |
+| List | ofLazy | IntFunction extends E> |
+| List | ofLazy | int |
| List | remove | Object |
| List | remove | int |
| List | removeAll | Collection> |
@@ -222,6 +224,8 @@ methodWithDuplicate
| List | listIterator | int |
| List | of | E |
| List | of | E[] |
+| List | ofLazy | IntFunction extends E> |
+| List | ofLazy | int |
| List | remove | Object |
| List | remove | int |
| List | removeAll | Collection> |
@@ -248,6 +252,8 @@ methodWithDuplicate
| List | listIterator | int |
| List | of | E |
| List | of | E[] |
+| List | ofLazy | IntFunction extends E> |
+| List | ofLazy | int |
| List | remove | Object |
| List | remove | int |
| List | removeAll | Collection> |
@@ -280,6 +286,8 @@ methodWithDuplicate
| Map | of | K |
| Map | of | V |
| Map | ofEntries | Entry extends K,? extends V>[] |
+| Map | ofLazy | Function super K,? extends V> |
+| Map | ofLazy | Set extends K> |
| Map | put | K |
| Map | put | V |
| Map | putAll | Map extends K,? extends V> |
@@ -310,6 +318,8 @@ methodWithDuplicate
| Map | of | K |
| Map | of | V |
| Map | ofEntries | Entry extends K,? extends V>[] |
+| Map | ofLazy | Function super K,? extends V> |
+| Map | ofLazy | Set extends K> |
| Map | put | Identity |
| Map | put | Object |
| Map | putAll | Map extends Identity,? extends Object> |
@@ -341,6 +351,8 @@ methodWithDuplicate
| Map | of | K |
| Map | of | V |
| Map | ofEntries | Entry extends K,? extends V>[] |
+| Map | ofLazy | Function super K,? extends V> |
+| Map | ofLazy | Set extends K> |
| Map | put | K |
| Map | put | V |
| Map | putAll | Map extends K,? extends V> |
@@ -370,6 +382,8 @@ methodWithDuplicate
| Map