Merge branch 'main' into generate-more-value-preserving-summaries-2

2026-04-26 17:25:19 +02:00 · 2025-05-02 10:51:11 +01:00
parent d8eafbb9e2 74669cb0cb
commit d5bc95daeb
240 changed files with 3011 additions and 1935 deletions
--- a/Abuse/FormatInvalid.ql
+++ b/Abuse/FormatInvalid.ql
@@ -8,6 +8,7 @@
 * @id cs/invalid-string-formatting
 * @tags reliability
 *       maintainability
+ *       quality
 */

 import csharp
--- a/Abuse/NoDisposeCallOnLocalIDisposable.ql
+++ b/Abuse/NoDisposeCallOnLocalIDisposable.ql
@@ -8,6 +8,7 @@
 * @id cs/local-not-disposed
 * @tags efficiency
 *       maintainability
+ *       quality
 *       external/cwe/cwe-404
 *       external/cwe/cwe-459
 *       external/cwe/cwe-460
--- a/Practices/Control-Flow/ConstantCondition.ql
+++ b/Practices/Control-Flow/ConstantCondition.ql
@@ -9,6 +9,7 @@
 * @id cs/constant-condition
 * @tags maintainability
 *       readability
+ *       quality
 *       external/cwe/cwe-835
 */

--- a/csharp/ql/src/Configuration/PasswordInConfigurationFile.ql
+++ b/csharp/ql/src/Configuration/PasswordInConfigurationFile.ql
@@ -7,7 +7,7 @@
 * @precision medium
 * @id cs/password-in-configuration
 * @tags security
- *       external/cwe/cwe-13
+ *       external/cwe/cwe-013
 *       external/cwe/cwe-256
 *       external/cwe/cwe-313
 */
--- a/Code/DeadStoreOfLocal.ql
+++ b/Code/DeadStoreOfLocal.ql
@@ -6,6 +6,7 @@
 * @problem.severity warning
 * @id cs/useless-assignment-to-local
 * @tags maintainability
+ *       quality
 *       external/cwe/cwe-563
 * @precision very-high
 */
--- a/Bugs/Collections/ContainerLengthCmpOffByOne.ql
+++ b/Bugs/Collections/ContainerLengthCmpOffByOne.ql
@@ -9,6 +9,7 @@
 * @tags reliability
 *       correctness
 *       logic
+ *       quality
 *      external/cwe/cwe-193
 */

--- a/Bugs/Collections/ContainerSizeCmpZero.ql
+++ b/Bugs/Collections/ContainerSizeCmpZero.ql
@@ -8,6 +8,7 @@
 * @tags reliability
 *       correctness
 *       logic
+ *       quality
 */

 import csharp
--- a/Bugs/DangerousNonShortCircuitLogic.ql
+++ b/Bugs/DangerousNonShortCircuitLogic.ql
@@ -9,6 +9,7 @@
 * @tags reliability
 *       correctness
 *       logic
+ *       quality
 *       external/cwe/cwe-480
 *       external/cwe/cwe-691
 */
--- a/Bugs/EqualityCheckOnFloats.ql
+++ b/Bugs/EqualityCheckOnFloats.ql
@@ -9,6 +9,7 @@
 * @id cs/equality-on-floats
 * @tags reliability
 *       correctness
+ *       quality
 */

 import csharp
--- a/Bugs/ReferenceEqualsOnValueTypes.ql
+++ b/Bugs/ReferenceEqualsOnValueTypes.ql
@@ -7,6 +7,7 @@
 * @id cs/reference-equality-on-valuetypes
 * @tags reliability
 *       correctness
+ *       quality
 *       external/cwe/cwe-595
 */

--- a/Bugs/SelfAssignment.ql
+++ b/Bugs/SelfAssignment.ql
@@ -8,6 +8,7 @@
 * @tags reliability
 *       correctness
 *       logic
+ *       quality
 */

 import csharp
--- a/Bugs/UncheckedCastInEquals.ql
+++ b/Bugs/UncheckedCastInEquals.ql
@@ -7,6 +7,7 @@
 * @id cs/unchecked-cast-in-equals
 * @tags reliability
 *       maintainability
+ *       quality
 */

 import csharp
--- a/csharp/ql/src/Performance/UseTryGetValue.ql
+++ b/csharp/ql/src/Performance/UseTryGetValue.ql
@@ -6,7 +6,9 @@
 * @problem.severity recommendation
 * @precision high
 * @id cs/inefficient-containskey
- * @tags maintainability efficiency
+ * @tags maintainability
+ *       efficiency
+ *       quality
 */

 import csharp
--- a/Features/CWE-011/ASPNetDebug.ql
+++ b/Features/CWE-011/ASPNetDebug.ql
@@ -10,7 +10,7 @@
 * @tags security
 *       maintainability
 *       frameworks/asp.net
- *       external/cwe/cwe-11
+ *       external/cwe/cwe-011
 *       external/cwe/cwe-532
 */

--- a/Features/CWE-016/ASPNetMaxRequestLength.ql
+++ b/Features/CWE-016/ASPNetMaxRequestLength.ql
@@ -8,7 +8,7 @@
 * @id cs/web/large-max-request-length
 * @tags security
 *       frameworks/asp.net
- *       external/cwe/cwe-16
+ *       external/cwe/cwe-016
 */

 import csharp
--- a/Features/CWE-016/ASPNetPagesValidateRequest.ql
+++ b/Features/CWE-016/ASPNetPagesValidateRequest.ql
@@ -8,7 +8,7 @@
 * @id cs/web/request-validation-disabled
 * @tags security
 *       frameworks/asp.net
- *       external/cwe/cwe-16
+ *       external/cwe/cwe-016
 */

 import csharp
--- a/Features/CWE-020/ExternalAPIsUsedWithUntrustedData.ql
+++ b/Features/CWE-020/ExternalAPIsUsedWithUntrustedData.ql
@@ -5,7 +5,7 @@
 *              to it.
 * @id cs/count-untrusted-data-external-api
 * @kind table
- * @tags security external/cwe/cwe-20
+ * @tags security external/cwe/cwe-020
 */

 import csharp
--- a/Features/CWE-020/RuntimeChecksBypass.ql
+++ b/Features/CWE-020/RuntimeChecksBypass.ql
@@ -7,7 +7,7 @@
 * @security-severity 7.8
 * @precision medium
 * @tags security
- *       external/cwe/cwe-20
+ *       external/cwe/cwe-020
 */

 import semmle.code.csharp.serialization.Serialization
--- a/Features/CWE-020/UntrustedDataToExternalAPI.ql
+++ b/Features/CWE-020/UntrustedDataToExternalAPI.ql
@@ -6,7 +6,7 @@
 * @precision low
 * @problem.severity error
 * @security-severity 7.8
- * @tags security external/cwe/cwe-20
+ * @tags security external/cwe/cwe-020
 */

 import csharp
--- a/Features/CWE-248/MissingASPNETGlobalErrorHandler.ql
+++ b/Features/CWE-248/MissingASPNETGlobalErrorHandler.ql
@@ -8,7 +8,7 @@
 * @precision high
 * @id cs/web/missing-global-error-handler
 * @tags security
- *       external/cwe/cwe-12
+ *       external/cwe/cwe-012
 *       external/cwe/cwe-248
 */

--- a/code/DefaultToString.ql
+++ b/code/DefaultToString.ql
@@ -8,6 +8,7 @@
 * @id cs/call-to-object-tostring
 * @tags reliability
 *       maintainability
+ *       quality
 */

 import DefaultToStringQuery
--- a/code/IntGetHashCode.ql
+++ b/code/IntGetHashCode.ql
@@ -8,6 +8,7 @@
 * @id cs/useless-gethashcode-call
 * @tags readability
 *       useless-code
+ *       quality
 */

 import csharp
--- a/csharp/ql/src/change-notes/2025-05-01-cwe-tag-changed.md
+++ b/csharp/ql/src/change-notes/2025-05-01-cwe-tag-changed.md
@@ -0,0 +1,12 @@
+---
+category: queryMetadata
+---
+
+* The tag `external/cwe/cwe-13` has been removed from `cs/password-in-configuration` and the tag `external/cwe/cwe-013` has been added.
+* The tag `external/cwe/cwe-11` has been removed from `cs/web/debug-binary` and the tag `external/cwe/cwe-011` has been added.
+* The tag `external/cwe/cwe-16` has been removed from `cs/web/large-max-request-length` and the tag `external/cwe/cwe-016` has been added.
+* The tag `external/cwe/cwe-16` has been removed from `cs/web/request-validation-disabled` and the tag `external/cwe/cwe-016` has been added.
+* The tag `external/cwe/cwe-20` has been removed from `cs/count-untrusted-data-external-api` and the tag `external/cwe/cwe-020` has been added.
+* The tag `external/cwe/cwe-20` has been removed from `cs/serialization-check-bypass` and the tag `external/cwe/cwe-020` has been added.
+* The tag `external/cwe/cwe-20` has been removed from `cs/untrusted-data-to-external-api` and the tag `external/cwe/cwe-020` has been added.
+* The tag `external/cwe/cwe-12` has been removed from `cs/web/missing-global-error-handler` and the tag `external/cwe/cwe-012` has been added.
--- a/csharp/ql/src/codeql-suites/csharp-code-quality.qls
+++ b/csharp/ql/src/codeql-suites/csharp-code-quality.qls
@@ -1,17 +1,3 @@
 - queries: .
- include:
-    id:
-      - cs/index-out-of-bounds
-      - cs/test-for-negative-container-size
-      - cs/unchecked-cast-in-equals
-      - cs/reference-equality-on-valuetypes
-      - cs/self-assignment
-      - cs/inefficient-containskey
-      - cs/call-to-object-tostring
-      - cs/local-not-disposed
-      - cs/constant-condition
-      - cs/useless-gethashcode-call
-      - cs/non-short-circuit
-      - cs/useless-assignment-to-local
-      - cs/invalid-string-formatting
-      - cs/equality-on-floats
+- apply: code-quality-selectors.yml
+  from: codeql/suite-helpers
--- a/csharp/ql/src/utils/modelgenerator/CaptureContentSummaryModels.ql
+++ b/csharp/ql/src/utils/modelgenerator/CaptureContentSummaryModels.ql
@@ -7,6 +7,7 @@
 */

 import internal.CaptureModels
+import SummaryModels

 from DataFlowSummaryTargetApi api, string flow
 where flow = ContentSensitive::captureFlow(api, _, _)
--- a/csharp/ql/src/utils/modelgenerator/CaptureNeutralModels.ql
+++ b/csharp/ql/src/utils/modelgenerator/CaptureNeutralModels.ql
@@ -7,6 +7,7 @@
 */

 import internal.CaptureModels
+import SummaryModels

 from DataFlowSummaryTargetApi api, string noflow
 where noflow = captureNeutral(api)
--- a/csharp/ql/src/utils/modelgenerator/CaptureSinkModels.ql
+++ b/csharp/ql/src/utils/modelgenerator/CaptureSinkModels.ql
@@ -7,6 +7,7 @@
 */

 import internal.CaptureModels
+import SinkModels

 from DataFlowSinkTargetApi api, string sink
 where sink = Heuristic::captureSink(api)
--- a/csharp/ql/src/utils/modelgenerator/CaptureSourceModels.ql
+++ b/csharp/ql/src/utils/modelgenerator/CaptureSourceModels.ql
@@ -7,6 +7,7 @@
 */

 import internal.CaptureModels
+import SourceModels

 from DataFlowSourceTargetApi api, string source
 where source = Heuristic::captureSource(api)
--- a/csharp/ql/src/utils/modelgenerator/CaptureSummaryModels.ql
+++ b/csharp/ql/src/utils/modelgenerator/CaptureSummaryModels.ql
@@ -7,6 +7,7 @@
 */

 import internal.CaptureModels
+import SummaryModels

 from DataFlowSummaryTargetApi api, string flow
 where flow = captureFlow(api, _)
--- a/csharp/ql/src/utils/modelgenerator/debug/CaptureSummaryModelsPartialPath.ql
+++ b/csharp/ql/src/utils/modelgenerator/debug/CaptureSummaryModelsPartialPath.ql
@@ -10,6 +10,7 @@

 import csharp
 import utils.modelgenerator.internal.CaptureModels
+import SummaryModels
 import PartialFlow::PartialPathGraph

 int explorationLimit() { result = 3 }
--- a/csharp/ql/src/utils/modelgenerator/debug/CaptureSummaryModelsPath.ql
+++ b/csharp/ql/src/utils/modelgenerator/debug/CaptureSummaryModelsPath.ql
@@ -10,6 +10,7 @@

 import csharp
 import utils.modelgenerator.internal.CaptureModels
+import SummaryModels
 import Heuristic
 import PropagateTaintFlow::PathGraph

--- a/csharp/ql/src/utils/modelgenerator/internal/CaptureModels.qll
+++ b/csharp/ql/src/utils/modelgenerator/internal/CaptureModels.qll
@@ -15,7 +15,41 @@ private import semmle.code.csharp.frameworks.System
 private import semmle.code.csharp.Location
 private import codeql.mad.modelgenerator.internal.ModelGeneratorImpl

-module ModelGeneratorInput implements ModelGeneratorInputSig<Location, CsharpDataFlow> {
+private predicate irrelevantAccessor(CS::Accessor a) {
+  a.getDeclaration().(CS::Property).isReadWrite()
+}
+
+private predicate isUninterestingForModels(Callable api) {
+  api.getDeclaringType().getNamespace().getFullName() = ""
+  or
+  api instanceof CS::ConversionOperator
+  or
+  api instanceof Util::MainMethod
+  or
+  api instanceof CS::Destructor
+  or
+  api instanceof CS::AnonymousFunctionExpr
+  or
+  api.(CS::Constructor).isParameterless()
+  or
+  exists(Type decl | decl = api.getDeclaringType() |
+    decl instanceof SystemObjectClass or
+    decl instanceof SystemValueTypeClass
+  )
+  or
+  // Disregard properties that have both a get and a set accessor,
+  // which implicitly means auto implemented properties.
+  irrelevantAccessor(api)
+}
+
+private predicate relevant(Callable api) {
+  [api.(CS::Modifiable), api.(CS::Accessor).getDeclaration()].isEffectivelyPublic() and
+  api.fromSource() and
+  api.isUnboundDeclaration() and
+  not isUninterestingForModels(api)
+}
+
+module ModelGeneratorCommonInput implements ModelGeneratorCommonInputSig<Location, CsharpDataFlow> {
  class Type = CS::Type;

  class Parameter = CS::Parameter;
@@ -24,127 +58,8 @@ module ModelGeneratorInput implements ModelGeneratorInputSig<Location, CsharpDat

  class NodeExtended = CS::DataFlow::Node;

-  Callable getAsExprEnclosingCallable(NodeExtended node) {
-    result = node.asExpr().getEnclosingCallable()
-  }
-
  Callable getEnclosingCallable(NodeExtended node) { result = node.getEnclosingCallable() }

-  Parameter asParameter(NodeExtended node) { result = node.asParameter() }
-
-  /**
-   * Holds if any of the parameters of `api` are `System.Func<>`.
-   */
-  private predicate isHigherOrder(Callable api) {
-    exists(Type t | t = api.getAParameter().getType().getUnboundDeclaration() |
-      t instanceof SystemLinqExpressions::DelegateExtType
-    )
-  }
-
-  private predicate irrelevantAccessor(CS::Accessor a) {
-    a.getDeclaration().(CS::Property).isReadWrite()
-  }
-
-  private predicate isUninterestingForModels(Callable api) {
-    api.getDeclaringType().getNamespace().getFullName() = ""
-    or
-    api instanceof CS::ConversionOperator
-    or
-    api instanceof Util::MainMethod
-    or
-    api instanceof CS::Destructor
-    or
-    api instanceof CS::AnonymousFunctionExpr
-    or
-    api.(CS::Constructor).isParameterless()
-    or
-    exists(Type decl | decl = api.getDeclaringType() |
-      decl instanceof SystemObjectClass or
-      decl instanceof SystemValueTypeClass
-    )
-    or
-    // Disregard properties that have both a get and a set accessor,
-    // which implicitly means auto implemented properties.
-    irrelevantAccessor(api)
-  }
-
-  private predicate relevant(Callable api) {
-    [api.(CS::Modifiable), api.(CS::Accessor).getDeclaration()].isEffectivelyPublic() and
-    api.fromSource() and
-    api.isUnboundDeclaration() and
-    not isUninterestingForModels(api)
-  }
-
-  private Callable getARelevantOverrideeOrImplementee(Overridable m) {
-    m.overridesOrImplements(result) and relevant(result)
-  }
-
-  /**
-   * Gets the super implementation of `api` if it is relevant.
-   * If such a super implementation does not exist, returns `api` if it is relevant.
-   */
-  private Callable liftedImpl(Callable api) {
-    (
-      result = getARelevantOverrideeOrImplementee(api)
-      or
-      result = api and relevant(api)
-    ) and
-    not exists(getARelevantOverrideeOrImplementee(result))
-  }
-
-  private predicate hasManualSummaryModel(Callable api) {
-    api = any(FlowSummaryImpl::Public::SummarizedCallable sc | sc.applyManualModel()) or
-    api = any(FlowSummaryImpl::Public::NeutralSummaryCallable sc | sc.hasManualModel())
-  }
-
-  private predicate hasManualSourceModel(Callable api) {
-    api = any(ExternalFlow::SourceCallable sc | sc.hasManualModel()) or
-    api = any(FlowSummaryImpl::Public::NeutralSourceCallable sc | sc.hasManualModel())
-  }
-
-  private predicate hasManualSinkModel(Callable api) {
-    api = any(ExternalFlow::SinkCallable sc | sc.hasManualModel()) or
-    api = any(FlowSummaryImpl::Public::NeutralSinkCallable sc | sc.hasManualModel())
-  }
-
-  predicate isUninterestingForDataFlowModels(Callable api) { none() }
-
-  predicate isUninterestingForHeuristicDataFlowModels(Callable api) { isHigherOrder(api) }
-
-  class SourceOrSinkTargetApi extends Callable {
-    SourceOrSinkTargetApi() { relevant(this) }
-  }
-
-  class SinkTargetApi extends SourceOrSinkTargetApi {
-    SinkTargetApi() { not hasManualSinkModel(this) }
-  }
-
-  class SourceTargetApi extends SourceOrSinkTargetApi {
-    SourceTargetApi() {
-      not hasManualSourceModel(this) and
-      // Do not generate source models for overridable callables
-      // as virtual dispatch implies that too many methods
-      // will be considered sources.
-      not this.(Overridable).overridesOrImplements(_)
-    }
-  }
-
-  class SummaryTargetApi extends Callable {
-    private Callable lift;
-
-    SummaryTargetApi() {
-      lift = liftedImpl(this) and
-      not hasManualSummaryModel(lift)
-    }
-
-    Callable lift() { result = lift }
-
-    predicate isRelevant() {
-      relevant(this) and
-      not hasManualSummaryModel(this)
-    }
-  }
-
  /**
   * Holds if `t` is a type that is generally used for bulk data in collection types.
   * Eg. char[] is roughly equivalent to string and thus a highly
@@ -205,6 +120,8 @@ module ModelGeneratorInput implements ModelGeneratorInputSig<Location, CsharpDat
    )
  }

+  class InstanceParameterNode = DataFlowPrivate::InstanceParameterNode;
+
  string qualifierString() { result = "Argument[this]" }

  string parameterAccess(CS::Parameter p) {
@@ -215,8 +132,6 @@ module ModelGeneratorInput implements ModelGeneratorInputSig<Location, CsharpDat

  string parameterContentAccess(CS::Parameter p) { result = "Argument[" + p.getPosition() + "]" }

-  class InstanceParameterNode = DataFlowPrivate::InstanceParameterNode;
-
  private signature string parameterAccessSig(Parameter p);

  private module ParamReturnNodeAsOutput<parameterAccessSig/1 getParamAccess> {
@@ -251,63 +166,92 @@ module ModelGeneratorInput implements ModelGeneratorInputSig<Location, CsharpDat
    node.asExpr() instanceof CS::ThisAccess
  }

-  private predicate isRelevantMemberAccess(DataFlow::Node node) {
-    exists(CS::MemberAccess access | access = node.asExpr() |
-      access.hasThisQualifier() and
-      access.getTarget().isEffectivelyPublic() and
-      (
-        access instanceof CS::FieldAccess
-        or
-        access.getTarget().(CS::Property).getSetter().isPublic()
-      )
-    )
-  }
-
-  predicate sinkModelSanitizer(DataFlow::Node node) { none() }
-
-  predicate apiSource(DataFlow::Node source) {
-    isRelevantMemberAccess(source) or source instanceof DataFlow::ParameterNode
-  }
-
-  private predicate uniquelyCalls(DataFlowCallable dc1, DataFlowCallable dc2) {
-    exists(DataFlowCall call |
-      dc1 = call.getEnclosingCallable() and
-      dc2 = unique(DataFlowCallable dc0 | dc0 = viableCallable(call) | dc0)
-    )
-  }
-
-  bindingset[dc1, dc2]
-  private predicate uniquelyCallsPlus(DataFlowCallable dc1, DataFlowCallable dc2) =
-    fastTC(uniquelyCalls/2)(dc1, dc2)
-
-  bindingset[sourceEnclosing, api]
-  predicate irrelevantSourceSinkApi(Callable sourceEnclosing, SourceTargetApi api) {
-    not exists(DataFlowCallable dc1, DataFlowCallable dc2 |
-      uniquelyCallsPlus(dc1, dc2) or dc1 = dc2
-    |
-      dc1.getUnderlyingCallable() = api and
-      dc2.getUnderlyingCallable() = sourceEnclosing
-    )
-  }
-
-  string getInputArgument(DataFlow::Node source) {
-    exists(int pos |
-      pos = source.(DataFlow::ParameterNode).getParameter().getPosition() and
-      result = "Argument[" + pos + "]"
-    )
-    or
-    source.asExpr() instanceof DataFlowPrivate::FieldOrPropertyAccess and
-    result = qualifierString()
-  }
-
-  bindingset[kind]
-  predicate isRelevantSinkKind(string kind) { any() }
-
-  bindingset[kind]
-  predicate isRelevantSourceKind(string kind) { any() }
-
  predicate containerContent(DataFlow::ContentSet c) { c.isElement() }

+  string partialModelRow(Callable api, int i) {
+    i = 0 and ExternalFlow::partialModel(api, result, _, _, _, _) // package
+    or
+    i = 1 and ExternalFlow::partialModel(api, _, result, _, _, _) // type
+    or
+    i = 2 and ExternalFlow::partialModel(api, _, _, result, _, _) // extensible
+    or
+    i = 3 and ExternalFlow::partialModel(api, _, _, _, result, _) // name
+    or
+    i = 4 and ExternalFlow::partialModel(api, _, _, _, _, result) // parameters
+    or
+    i = 5 and result = "" and exists(api) // ext
+  }
+
+  string partialNeutralModelRow(Callable api, int i) {
+    i = 0 and result = partialModelRow(api, 0) // package
+    or
+    i = 1 and result = partialModelRow(api, 1) // type
+    or
+    i = 2 and result = partialModelRow(api, 3) // name
+    or
+    i = 3 and result = partialModelRow(api, 4) // parameters
+  }
+}
+
+private import ModelGeneratorCommonInput
+private import MakeModelGeneratorFactory<Location, CsharpDataFlow, CsharpTaintTracking, ModelGeneratorCommonInput>
+
+module SummaryModelGeneratorInput implements SummaryModelGeneratorInputSig {
+  Callable getAsExprEnclosingCallable(NodeExtended node) {
+    result = node.asExpr().getEnclosingCallable()
+  }
+
+  Parameter asParameter(NodeExtended node) { result = node.asParameter() }
+
+  /**
+   * Holds if any of the parameters of `api` are `System.Func<>`.
+   */
+  private predicate isHigherOrder(Callable api) {
+    exists(Type t | t = api.getAParameter().getType().getUnboundDeclaration() |
+      t instanceof SystemLinqExpressions::DelegateExtType
+    )
+  }
+
+  private Callable getARelevantOverrideeOrImplementee(Overridable m) {
+    m.overridesOrImplements(result) and relevant(result)
+  }
+
+  /**
+   * Gets the super implementation of `api` if it is relevant.
+   * If such a super implementation does not exist, returns `api` if it is relevant.
+   */
+  private Callable liftedImpl(Callable api) {
+    (
+      result = getARelevantOverrideeOrImplementee(api)
+      or
+      result = api and relevant(api)
+    ) and
+    not exists(getARelevantOverrideeOrImplementee(result))
+  }
+
+  private predicate hasManualSummaryModel(Callable api) {
+    api = any(FlowSummaryImpl::Public::SummarizedCallable sc | sc.applyManualModel()) or
+    api = any(FlowSummaryImpl::Public::NeutralSummaryCallable sc | sc.hasManualModel())
+  }
+
+  predicate isUninterestingForHeuristicDataFlowModels(Callable api) { isHigherOrder(api) }
+
+  class SummaryTargetApi extends Callable {
+    private Callable lift;
+
+    SummaryTargetApi() {
+      lift = liftedImpl(this) and
+      not hasManualSummaryModel(lift)
+    }
+
+    Callable lift() { result = lift }
+
+    predicate isRelevant() {
+      relevant(this) and
+      not hasManualSummaryModel(this)
+    }
+  }
+
  predicate isAdditionalContentFlowStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
    TaintTrackingPrivate::defaultAdditionalTaintStep(nodeFrom, nodeTo, _) and
    not nodeTo.asExpr() instanceof CS::ElementAccess and
@@ -370,34 +314,88 @@ module ModelGeneratorInput implements ModelGeneratorInputSig<Location, CsharpDat
    or
    c.isDelegateCallReturn() and result = "ReturnValue"
  }
+}

-  string partialModelRow(Callable api, int i) {
-    i = 0 and ExternalFlow::partialModel(api, result, _, _, _, _) // package
-    or
-    i = 1 and ExternalFlow::partialModel(api, _, result, _, _, _) // type
-    or
-    i = 2 and ExternalFlow::partialModel(api, _, _, result, _, _) // extensible
-    or
-    i = 3 and ExternalFlow::partialModel(api, _, _, _, result, _) // name
-    or
-    i = 4 and ExternalFlow::partialModel(api, _, _, _, _, result) // parameters
-    or
-    i = 5 and result = "" and exists(api) // ext
+private module SourceModelGeneratorInput implements SourceModelGeneratorInputSig {
+  private predicate hasManualSourceModel(Callable api) {
+    api = any(ExternalFlow::SourceCallable sc | sc.hasManualModel()) or
+    api = any(FlowSummaryImpl::Public::NeutralSourceCallable sc | sc.hasManualModel())
  }

-  string partialNeutralModelRow(Callable api, int i) {
-    i = 0 and result = partialModelRow(api, 0) // package
-    or
-    i = 1 and result = partialModelRow(api, 1) // type
-    or
-    i = 2 and result = partialModelRow(api, 3) // name
-    or
-    i = 3 and result = partialModelRow(api, 4) // parameters
+  class SourceTargetApi extends Callable {
+    SourceTargetApi() {
+      relevant(this) and
+      not hasManualSourceModel(this) and
+      // Do not generate source models for overridable callables
+      // as virtual dispatch implies that too many methods
+      // will be considered sources.
+      not this.(Overridable).overridesOrImplements(_)
+    }
+  }
+
+  private predicate uniquelyCalls(DataFlowCallable dc1, DataFlowCallable dc2) {
+    exists(DataFlowCall call |
+      dc1 = call.getEnclosingCallable() and
+      dc2 = unique(DataFlowCallable dc0 | dc0 = viableCallable(call) | dc0)
+    )
+  }
+
+  bindingset[dc1, dc2]
+  private predicate uniquelyCallsPlus(DataFlowCallable dc1, DataFlowCallable dc2) =
+    fastTC(uniquelyCalls/2)(dc1, dc2)
+
+  bindingset[sourceEnclosing, api]
+  predicate irrelevantSourceSinkApi(Callable sourceEnclosing, SourceTargetApi api) {
+    not exists(DataFlowCallable dc1, DataFlowCallable dc2 |
+      uniquelyCallsPlus(dc1, dc2) or dc1 = dc2
+    |
+      dc1.getUnderlyingCallable() = api and
+      dc2.getUnderlyingCallable() = sourceEnclosing
+    )
  }

  predicate sourceNode = ExternalFlow::sourceNode/2;
+}
+
+private module SinkModelGeneratorInput implements SinkModelGeneratorInputSig {
+  private predicate hasManualSinkModel(Callable api) {
+    api = any(ExternalFlow::SinkCallable sc | sc.hasManualModel()) or
+    api = any(FlowSummaryImpl::Public::NeutralSinkCallable sc | sc.hasManualModel())
+  }
+
+  class SinkTargetApi extends Callable {
+    SinkTargetApi() { relevant(this) and not hasManualSinkModel(this) }
+  }
+
+  private predicate isRelevantMemberAccess(DataFlow::Node node) {
+    exists(CS::MemberAccess access | access = node.asExpr() |
+      access.hasThisQualifier() and
+      access.getTarget().isEffectivelyPublic() and
+      (
+        access instanceof CS::FieldAccess
+        or
+        access.getTarget().(CS::Property).getSetter().isPublic()
+      )
+    )
+  }
+
+  predicate apiSource(DataFlow::Node source) {
+    isRelevantMemberAccess(source) or source instanceof DataFlow::ParameterNode
+  }
+
+  string getInputArgument(DataFlow::Node source) {
+    exists(int pos |
+      pos = source.(DataFlow::ParameterNode).getParameter().getPosition() and
+      result = "Argument[" + pos + "]"
+    )
+    or
+    source.asExpr() instanceof DataFlowPrivate::FieldOrPropertyAccess and
+    result = qualifierString()
+  }

  predicate sinkNode = ExternalFlow::sinkNode/2;
 }

-import MakeModelGenerator<Location, CsharpDataFlow, CsharpTaintTracking, ModelGeneratorInput>
+import MakeSummaryModelGenerator<SummaryModelGeneratorInput> as SummaryModels
+import MakeSourceModelGenerator<SourceModelGeneratorInput> as SourceModels
+import MakeSinkModelGenerator<SinkModelGeneratorInput> as SinkModels
--- a/csharp/ql/src/utils/modelgenerator/internal/CaptureModelsPrinting.qll
+++ b/csharp/ql/src/utils/modelgenerator/internal/CaptureModelsPrinting.qll
@@ -1,6 +1,6 @@
 private import csharp as CS
 private import codeql.mad.modelgenerator.internal.ModelPrinting
-private import CaptureModels::ModelGeneratorInput as ModelGeneratorInput
+private import CaptureModels::ModelGeneratorCommonInput as ModelGeneratorInput

 private module ModelPrintingLang implements ModelPrintingLangSig {
  class Callable = CS::Callable;
--- a/csharp/ql/src/utils/modelgenerator/internal/CaptureTypeBasedSummaryModels.qll
+++ b/csharp/ql/src/utils/modelgenerator/internal/CaptureTypeBasedSummaryModels.qll
@@ -2,7 +2,8 @@ private import csharp
 private import semmle.code.csharp.frameworks.system.collections.Generic as GenericCollections
 private import semmle.code.csharp.dataflow.internal.DataFlowPrivate
 private import semmle.code.csharp.frameworks.system.linq.Expressions
-private import CaptureModels::ModelGeneratorInput as ModelGeneratorInput
+private import CaptureModels::ModelGeneratorCommonInput as ModelGeneratorInput
+private import CaptureModels::SummaryModelGeneratorInput as SummaryModelGeneratorInput
 private import CaptureModelsPrinting

 /**
@@ -177,21 +178,19 @@ private predicate output(Callable callable, TypeParameter tp, string output) {
  delegateSink(callable, tp, output)
 }

-private module ModelPrintingInput implements ModelPrintingSig {
+private module ModelPrintingInput implements ModelPrintingSummarySig {
  class SummaryApi = TypeBasedFlowTargetApi;

-  class SourceOrSinkApi = TypeBasedFlowTargetApi;
-
  string getProvenance() { result = "tb-generated" }
 }

-private module Printing = ModelPrinting<ModelPrintingInput>;
+private module Printing = ModelPrintingSummary<ModelPrintingInput>;

 /**
 * A class of callables that are relevant generating summaries for based
 * on the Theorems for Free approach.
 */
-class TypeBasedFlowTargetApi extends ModelGeneratorInput::SummaryTargetApi {
+class TypeBasedFlowTargetApi extends SummaryModelGeneratorInput::SummaryTargetApi {
  /**
   * Gets the string representation of all type based summaries for `this`
   * inspired by the Theorems for Free approach.
--- a/csharp/ql/test/utils/modelgenerator/dataflow/CaptureContentSummaryModels.ql
+++ b/csharp/ql/test/utils/modelgenerator/dataflow/CaptureContentSummaryModels.ql
@@ -1,5 +1,6 @@
 import csharp
 import utils.modelgenerator.internal.CaptureModels
+import SummaryModels
 import utils.test.InlineMadTest

 module InlineMadTestConfig implements InlineMadTestConfigSig {
--- a/csharp/ql/test/utils/modelgenerator/dataflow/CaptureHeuristicSummaryModels.ql
+++ b/csharp/ql/test/utils/modelgenerator/dataflow/CaptureHeuristicSummaryModels.ql
@@ -1,5 +1,6 @@
 import csharp
 import utils.modelgenerator.internal.CaptureModels
+import SummaryModels
 import utils.test.InlineMadTest

 module InlineMadTestConfig implements InlineMadTestConfigSig {
--- a/csharp/ql/test/utils/modelgenerator/dataflow/CaptureNeutralModels.ql
+++ b/csharp/ql/test/utils/modelgenerator/dataflow/CaptureNeutralModels.ql
@@ -1,5 +1,6 @@
 import csharp
 import utils.modelgenerator.internal.CaptureModels
+import SummaryModels
 import utils.test.InlineMadTest

 module InlineMadTestConfig implements InlineMadTestConfigSig {
--- a/csharp/ql/test/utils/modelgenerator/dataflow/CaptureSinkModels.ql
+++ b/csharp/ql/test/utils/modelgenerator/dataflow/CaptureSinkModels.ql
@@ -1,5 +1,6 @@
 import csharp
 import utils.modelgenerator.internal.CaptureModels
+import SinkModels
 import utils.test.InlineMadTest

 module InlineMadTestConfig implements InlineMadTestConfigSig {
--- a/csharp/ql/test/utils/modelgenerator/dataflow/CaptureSourceModels.ql
+++ b/csharp/ql/test/utils/modelgenerator/dataflow/CaptureSourceModels.ql
@@ -1,5 +1,6 @@
 import csharp
 import utils.modelgenerator.internal.CaptureModels
+import SourceModels
 import utils.test.InlineMadTest

 module InlineMadTestConfig implements InlineMadTestConfigSig {