Merge branch 'main' into post-release-prep/codeql-cli-2.12.4

2025-12-16 16:53:25 +01:00 · 2023-03-04 09:20:44 -05:00
parent af61b45785 6f120a66d0
commit e169702165
34 changed files with 355 additions and 154 deletions
--- a/cpp/ql/lib/semmle/code/cpp/Declaration.qll
+++ b/cpp/ql/lib/semmle/code/cpp/Declaration.qll
@@ -68,7 +68,9 @@ class Declaration extends Locatable, @declaration {
   * Holds if this declaration has the fully-qualified name `qualifiedName`.
   * See `getQualifiedName`.
   */
-  predicate hasQualifiedName(string qualifiedName) { this.getQualifiedName() = qualifiedName }
+  deprecated predicate hasQualifiedName(string qualifiedName) {
+    this.getQualifiedName() = qualifiedName
+  }

  /**
   * Holds if this declaration has a fully-qualified name with a name-space
--- a/java/ql/integration-tests/all-platforms/java/diagnostics/android-gradle-incompatibility/diagnostics.expected
+++ b/java/ql/integration-tests/all-platforms/java/diagnostics/android-gradle-incompatibility/diagnostics.expected
@@ -1,5 +1,5 @@
 {
-  "markdownMessage": "An Android build may have failed. Ensure the Code Scanning workflow installs required dependencies, and that the [Gradle and Android SDK versions are compatible](https://developer.android.com/studio/releases/gradle-plugin#updating-gradle). Suspicious output line: `   > Minimum supported Gradle version is 7.4. Current version is 7.3. If using the gradle wrapper, try editing the distributionUrl in <test-root-directory>/gradle/wrapper/gradle-wrapper.properties to gradle-7.4-all.zip`",
+  "markdownMessage": "An Android build may have failed. Ensure the Code Scanning workflow installs required dependencies, and that the [Gradle and Android SDK versions are compatible](https://developer.android.com/studio/releases/gradle-plugin#updating-gradle).\n\nSuspicious output line: `   > Minimum supported Gradle version is 7.4. Current version is 7.3. If using the gradle wrapper, try editing the distributionUrl in <test-root-directory>/gradle/wrapper/gradle-wrapper.properties to gradle-7.4-all.zip`",
  "severity": "error",
  "source": {
    "extractorName": "java",
@@ -13,7 +13,7 @@
  }
 }
 {
-  "markdownMessage": "An Android build may have failed. Ensure the Code Scanning workflow installs required dependencies, and that the [Gradle and Android SDK versions are compatible](https://developer.android.com/studio/releases/gradle-plugin#updating-gradle). Suspicious output line: `Caused by: java.lang.RuntimeException: Minimum supported Gradle version is 7.4. Current version is 7.3. If using the gradle wrapper, try editing the distributionUrl in <test-root-directory>/gradle/wrapper/gradle-wrapper.properties to gradle-7.4-all.zip`",
+  "markdownMessage": "An Android build may have failed. Ensure the Code Scanning workflow installs required dependencies, and that the [Gradle and Android SDK versions are compatible](https://developer.android.com/studio/releases/gradle-plugin#updating-gradle).\n\nSuspicious output line: `Caused by: java.lang.RuntimeException: Minimum supported Gradle version is 7.4. Current version is 7.3. If using the gradle wrapper, try editing the distributionUrl in <test-root-directory>/gradle/wrapper/gradle-wrapper.properties to gradle-7.4-all.zip`",
  "severity": "error",
  "source": {
    "extractorName": "java",
--- a/java/ql/integration-tests/all-platforms/java/diagnostics/compilation-error/diagnostics.expected
+++ b/java/ql/integration-tests/all-platforms/java/diagnostics/compilation-error/diagnostics.expected
@@ -1,5 +1,5 @@
 {
-  "markdownMessage": "A compilation error was observed while autobuilding your code. Check that your Code Scanning workflow installs the needed compiler version and dependencies. Suspicious output line: `[ERROR] COMPILATION ERROR : `",
+  "markdownMessage": "A compilation error was observed while autobuilding your code. Check that your Code Scanning workflow installs the needed compiler version and dependencies.\n\nSuspicious output line: `[ERROR] COMPILATION ERROR : `",
  "severity": "error",
  "source": {
    "extractorName": "java",
@@ -13,7 +13,7 @@
  }
 }
 {
-  "markdownMessage": "A compilation error was observed while autobuilding your code. Check that your Code Scanning workflow installs the needed compiler version and dependencies. Suspicious output line: `[ERROR] Failed to execute goal org.apache.maven.plugins:maven-compiler-plugin:3.8.0:compile (default-compile) on project maven-sample: Compilation failure`",
+  "markdownMessage": "A compilation error was observed while autobuilding your code. Check that your Code Scanning workflow installs the needed compiler version and dependencies.\n\nSuspicious output line: `[ERROR] Failed to execute goal org.apache.maven.plugins:maven-compiler-plugin:3.8.0:compile (default-compile) on project maven-sample: Compilation failure`",
  "severity": "error",
  "source": {
    "extractorName": "java",
@@ -27,7 +27,7 @@
  }
 }
 {
-  "markdownMessage": "A compilation error was observed while autobuilding your code. Check that your Code Scanning workflow installs the needed compiler version and dependencies. Suspicious output line: `org.apache.maven.lifecycle.LifecycleExecutionException: Failed to execute goal org.apache.maven.plugins:maven-compiler-plugin:3.8.0:compile (default-compile) on project maven-sample: Compilation failure`",
+  "markdownMessage": "A compilation error was observed while autobuilding your code. Check that your Code Scanning workflow installs the needed compiler version and dependencies.\n\nSuspicious output line: `org.apache.maven.lifecycle.LifecycleExecutionException: Failed to execute goal org.apache.maven.plugins:maven-compiler-plugin:3.8.0:compile (default-compile) on project maven-sample: Compilation failure`",
  "severity": "error",
  "source": {
    "extractorName": "java",
--- a/java/ql/integration-tests/all-platforms/java/diagnostics/dependency-error/diagnostics.expected
+++ b/java/ql/integration-tests/all-platforms/java/diagnostics/dependency-error/diagnostics.expected
@@ -1,5 +1,5 @@
 {
-  "markdownMessage": "A dependency failed to download. Check that all dependencies are available, and [supply credentials for any private dependencies](https://github.com/Azure/actions-workflow-samples/blob/master/assets/create-secrets-for-GitHub-workflows.md#set-up-secrets-in-github-action-workflows). Suspicious output line: `Caused by: org.eclipse.aether.transfer.ArtifactNotFoundException: Could not find artifact junit:junit-nonesuch:jar:4.11 in central (https://repo.maven.apache.org/maven2)`",
+  "markdownMessage": "A dependency failed to download. Check that all dependencies are available, and [supply credentials for any private dependencies](https://github.com/Azure/actions-workflow-samples/blob/master/assets/create-secrets-for-GitHub-workflows.md#set-up-secrets-in-github-action-workflows).\n\nSuspicious output line: `Caused by: org.eclipse.aether.transfer.ArtifactNotFoundException: Could not find artifact junit:junit-nonesuch:jar:4.11 in central (https://repo.maven.apache.org/maven2)`",
  "severity": "error",
  "source": {
    "extractorName": "java",
--- a/java/ql/integration-tests/all-platforms/java/diagnostics/java-version-too-old/diagnostics.expected
+++ b/java/ql/integration-tests/all-platforms/java/diagnostics/java-version-too-old/diagnostics.expected
@@ -1,5 +1,5 @@
 {
-  "markdownMessage": "Your project may need a different JDK version. Ensure your Code Scanning workflow file has [an appropriate `setup-java` step](https://github.com/actions/setup-java#eclipse-temurin). Suspicious output line: `> Could not target platform: 'Java SE 11' using tool chain: 'JDK 8 (1.8)'.`",
+  "markdownMessage": "Your project may need a different JDK version. Ensure your Code Scanning workflow file has [an appropriate `setup-java` step](https://github.com/actions/setup-java#eclipse-temurin).\n\nSuspicious output line: `> Could not target platform: 'Java SE 11' using tool chain: 'JDK 8 (1.8)'.`",
  "severity": "error",
  "source": {
    "extractorName": "java",
@@ -13,7 +13,7 @@
  }
 }
 {
-  "markdownMessage": "Your project may need a different JDK version. Ensure your Code Scanning workflow file has [an appropriate `setup-java` step](https://github.com/actions/setup-java#eclipse-temurin). Suspicious output line: `Caused by: java.lang.IllegalArgumentException: Could not target platform: 'Java SE 11' using tool chain: 'JDK 8 (1.8)'.`",
+  "markdownMessage": "Your project may need a different JDK version. Ensure your Code Scanning workflow file has [an appropriate `setup-java` step](https://github.com/actions/setup-java#eclipse-temurin).\n\nSuspicious output line: `Caused by: java.lang.IllegalArgumentException: Could not target platform: 'Java SE 11' using tool chain: 'JDK 8 (1.8)'.`",
  "severity": "error",
  "source": {
    "extractorName": "java",
--- a/java/ql/integration-tests/all-platforms/java/diagnostics/maven-http-repository/diagnostics.expected
+++ b/java/ql/integration-tests/all-platforms/java/diagnostics/maven-http-repository/diagnostics.expected
@@ -1,5 +1,5 @@
 {
-  "markdownMessage": "Building your code triggered an access to an insecure HTTP Maven repository. Allow access to insecure repositories, or [update your build to use HTTPS](https://maven.apache.org/docs/3.8.1/release-notes.html#how-to-fix-when-i-get-a-http-repository-blocked). Suspicious output line: `Caused by: org.eclipse.aether.resolution.ArtifactResolutionException: Could not transfer artifact junit-nonesuch:junit-nonesuch:pom:4.11 from/to maven-default-http-blocker (http://0.0.0.0/): Blocked mirror for repositories: [insecure (http://repo.maven.apache.org/maven2/, default, releases+snapshots)]`",
+  "markdownMessage": "Building your code triggered an access to an insecure HTTP Maven repository. Allow access to insecure repositories, or [update your build to use HTTPS](https://maven.apache.org/docs/3.8.1/release-notes.html#how-to-fix-when-i-get-a-http-repository-blocked).\n\nSuspicious output line: `Caused by: org.eclipse.aether.resolution.ArtifactResolutionException: Could not transfer artifact junit-nonesuch:junit-nonesuch:pom:4.11 from/to maven-default-http-blocker (http://0.0.0.0/): Blocked mirror for repositories: [insecure (http://repo.maven.apache.org/maven2/, default, releases+snapshots)]`",
  "severity": "error",
  "source": {
    "extractorName": "java",
@@ -13,7 +13,7 @@
  }
 }
 {
-  "markdownMessage": "Building your code triggered an access to an insecure HTTP Maven repository. Allow access to insecure repositories, or [update your build to use HTTPS](https://maven.apache.org/docs/3.8.1/release-notes.html#how-to-fix-when-i-get-a-http-repository-blocked). Suspicious output line: `Caused by: org.eclipse.aether.transfer.ArtifactTransferException: Could not transfer artifact junit-nonesuch:junit-nonesuch:pom:4.11 from/to maven-default-http-blocker (http://0.0.0.0/): Blocked mirror for repositories: [insecure (http://repo.maven.apache.org/maven2/, default, releases+snapshots)]`",
+  "markdownMessage": "Building your code triggered an access to an insecure HTTP Maven repository. Allow access to insecure repositories, or [update your build to use HTTPS](https://maven.apache.org/docs/3.8.1/release-notes.html#how-to-fix-when-i-get-a-http-repository-blocked).\n\nSuspicious output line: `Caused by: org.eclipse.aether.transfer.ArtifactTransferException: Could not transfer artifact junit-nonesuch:junit-nonesuch:pom:4.11 from/to maven-default-http-blocker (http://0.0.0.0/): Blocked mirror for repositories: [insecure (http://repo.maven.apache.org/maven2/, default, releases+snapshots)]`",
  "severity": "error",
  "source": {
    "extractorName": "java",
@@ -27,7 +27,7 @@
  }
 }
 {
-  "markdownMessage": "Building your code triggered an access to an insecure HTTP Maven repository. Allow access to insecure repositories, or [update your build to use HTTPS](https://maven.apache.org/docs/3.8.1/release-notes.html#how-to-fix-when-i-get-a-http-repository-blocked). Suspicious output line: `Caused by: org.eclipse.aether.transfer.NoRepositoryConnectorException: Blocked mirror for repositories: [insecure (http://repo.maven.apache.org/maven2/, default, releases+snapshots)]`",
+  "markdownMessage": "Building your code triggered an access to an insecure HTTP Maven repository. Allow access to insecure repositories, or [update your build to use HTTPS](https://maven.apache.org/docs/3.8.1/release-notes.html#how-to-fix-when-i-get-a-http-repository-blocked).\n\nSuspicious output line: `Caused by: org.eclipse.aether.transfer.NoRepositoryConnectorException: Blocked mirror for repositories: [insecure (http://repo.maven.apache.org/maven2/, default, releases+snapshots)]`",
  "severity": "error",
  "source": {
    "extractorName": "java",
@@ -41,7 +41,7 @@
  }
 }
 {
-  "markdownMessage": "Building your code triggered an access to an insecure HTTP Maven repository. Allow access to insecure repositories, or [update your build to use HTTPS](https://maven.apache.org/docs/3.8.1/release-notes.html#how-to-fix-when-i-get-a-http-repository-blocked). Suspicious output line: `[ERROR] Failed to execute goal on project maven-sample: Could not resolve dependencies for project com.example:maven-sample:jar:1.0-SNAPSHOT: Failed to collect dependencies at junit-nonesuch:junit-nonesuch:jar:4.11: Failed to read artifact descriptor for junit-nonesuch:junit-nonesuch:jar:4.11: Could not transfer artifact junit-nonesuch:junit-nonesuch:pom:4.11 from/to maven-default-http-blocker (http://0.0.0.0/): Blocked mirror for repositories: [insecure (http://repo.maven.apache.org/maven2/, default, releases+snapshots)] -> [Help 1]`",
+  "markdownMessage": "Building your code triggered an access to an insecure HTTP Maven repository. Allow access to insecure repositories, or [update your build to use HTTPS](https://maven.apache.org/docs/3.8.1/release-notes.html#how-to-fix-when-i-get-a-http-repository-blocked).\n\nSuspicious output line: `[ERROR] Failed to execute goal on project maven-sample: Could not resolve dependencies for project com.example:maven-sample:jar:1.0-SNAPSHOT: Failed to collect dependencies at junit-nonesuch:junit-nonesuch:jar:4.11: Failed to read artifact descriptor for junit-nonesuch:junit-nonesuch:jar:4.11: Could not transfer artifact junit-nonesuch:junit-nonesuch:pom:4.11 from/to maven-default-http-blocker (http://0.0.0.0/): Blocked mirror for repositories: [insecure (http://repo.maven.apache.org/maven2/, default, releases+snapshots)] -> [Help 1]`",
  "severity": "error",
  "source": {
    "extractorName": "java",
--- a/java/ql/integration-tests/all-platforms/java/diagnostics/multiple-candidate-builds/diagnostics.expected
+++ b/java/ql/integration-tests/all-platforms/java/diagnostics/multiple-candidate-builds/diagnostics.expected
@@ -1,5 +1,5 @@
 {
-  "markdownMessage": "Building using Maven was skipped because there were multiple sibling build directories containing build files: [./maven-project-1,./maven-project-2]. If you want to use one of these, please [manually supply a build command](https://docs.github.com/en/github-ae@latest/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-the-codeql-workflow-for-compiled-languages#adding-build-steps-for-a-compiled-language)",
+  "markdownMessage": "Building using Maven was skipped because there were multiple sibling build directories containing build files: [./maven-project-1,./maven-project-2]. If you want to use one of these, please [manually supply a build command](https://docs.github.com/en/github-ae@latest/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-the-codeql-workflow-for-compiled-languages#adding-build-steps-for-a-compiled-language).",
  "severity": "warning",
  "source": {
    "extractorName": "java",
@@ -13,7 +13,7 @@
  }
 }
 {
-  "markdownMessage": "If you want to use one of the candidate build systems and directories (see previous warnings), please [supply a manual a build command](https://docs.github.com/en/github-ae@latest/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-the-codeql-workflow-for-compiled-languages#adding-build-steps-for-a-compiled-language)",
+  "markdownMessage": "If you want to use one of the candidate build systems and directories (see previous warnings), please [supply a manual a build command](https://docs.github.com/en/github-ae@latest/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-the-codeql-workflow-for-compiled-languages#adding-build-steps-for-a-compiled-language).",
  "severity": "error",
  "source": {
    "extractorName": "java",
--- a/java/ql/integration-tests/all-platforms/java/diagnostics/no-build-system/diagnostics.expected
+++ b/java/ql/integration-tests/all-platforms/java/diagnostics/no-build-system/diagnostics.expected
@@ -1,5 +1,5 @@
 {
-  "markdownMessage": "Could not find a Gradle, Maven or Ant top-level project to build. Please [supply a manual build command](https://docs.github.com/en/github-ae@latest/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-the-codeql-workflow-for-compiled-languages#adding-build-steps-for-a-compiled-language)",
+  "markdownMessage": "Could not find a Gradle, Maven or Ant top-level project to build. Please [supply a manual build command](https://docs.github.com/en/github-ae@latest/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-the-codeql-workflow-for-compiled-languages#adding-build-steps-for-a-compiled-language).",
  "severity": "error",
  "source": {
    "extractorName": "java",
--- a/java/ql/integration-tests/all-platforms/java/diagnostics/no-gradle-test-classes/diagnostics.expected
+++ b/java/ql/integration-tests/all-platforms/java/diagnostics/no-gradle-test-classes/diagnostics.expected
@@ -13,7 +13,7 @@
  }
 }
 {
-  "markdownMessage": "Gradle project does not define a `testClasses` goal. [Supply a manual build command](https://docs.github.com/en/github-ae@latest/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-the-codeql-workflow-for-compiled-languages#adding-build-steps-for-a-compiled-language) that builds the code that should be analyzed. Suspicious output line: `org.gradle.execution.TaskSelectionException: Task 'testClasses' not found in root project 'no-gradle-test-classes'.`",
+  "markdownMessage": "Gradle project does not define a `testClasses` goal. [Supply a manual build command](https://docs.github.com/en/github-ae@latest/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-the-codeql-workflow-for-compiled-languages#adding-build-steps-for-a-compiled-language) that builds the code that should be analyzed.\n\nSuspicious output line: `org.gradle.execution.TaskSelectionException: Task 'testClasses' not found in root project 'no-gradle-test-classes'.`",
  "severity": "error",
  "source": {
    "extractorName": "java",
--- a/java/ql/integration-tests/all-platforms/kotlin/diagnostics/kotlin-version-too-new/diagnostics.expected
+++ b/java/ql/integration-tests/all-platforms/kotlin/diagnostics/kotlin-version-too-new/diagnostics.expected
@@ -1,10 +1,10 @@
 {
-  "markdownMessage": "The Kotlin version installed (`999.999.999`) is too recent for this version of CodeQL. Install a version lower than 1.8.30",
+  "markdownMessage": "The Kotlin version installed (`999.999.999`) is too recent for this version of CodeQL. Install a version lower than 1.8.30.",
  "severity": "error",
  "source": {
    "extractorName": "java",
    "id": "java/extractor-agent/kotlin-version-too-new",
-    "name": "Android build failure"
+    "name": "Kotlin version too new"
  },
  "visibility": {
    "cliSummaryTable": true,
--- a/ruby/ql/lib/codeql/ruby/frameworks/ActionController.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/ActionController.qll
@@ -520,15 +520,15 @@ ActionControllerClass getAssociatedControllerClass(ErbFile f) {
 * templates in `app/views/` and `app/views/layouts/`.
 */
 predicate controllerTemplateFile(ActionControllerClass cls, ErbFile templateFile) {
-  exists(string templatesPath, string sourcePrefix, string subPath, string controllerPath |
+  exists(string sourcePrefix, string subPath, string controllerPath |
    controllerPath = cls.getLocation().getFile().getRelativePath() and
-    templatesPath = templateFile.getParentContainer().getRelativePath() and
    // `sourcePrefix` is either a prefix path ending in a slash, or empty if
    // the rails app is at the source root
    sourcePrefix = [controllerPath.regexpCapture("^(.*/)app/controllers/(?:.*?)/(?:[^/]*)$", 1), ""] and
    controllerPath = sourcePrefix + "app/controllers/" + subPath + "_controller.rb" and
    (
-      templatesPath = sourcePrefix + "app/views/" + subPath or
+      sourcePrefix + "app/views/" + subPath = templateFile.getParentContainer().getRelativePath()
+      or
      templateFile.getRelativePath().matches(sourcePrefix + "app/views/layouts/" + subPath + "%")
    )
  )
--- a/swift/extractor/SwiftBuiltinSymbols.h
+++ b/swift/extractor/SwiftBuiltinSymbols.h
@@ -1,73 +0,0 @@
-#pragma once
-
-#include <array>
-
-namespace codeql {
-constexpr std::array swiftBuiltins = {
-    "zeroInitializer",
-    "BridgeObject",
-    "Word",
-    "NativeObject",
-    "RawPointer",
-    "Executor",
-    "Job",
-    "RawUnsafeContinuation",
-    "addressof",
-    "initialize",
-    "reinterpretCast",
-    "Int1",
-    "Int8",
-    "Int16",
-    "Int32",
-    "Int64",
-    "IntLiteral",
-    "FPIEEE16",
-    "FPIEEE32",
-    "FPIEEE64",
-    "FPIEEE80",
-    "Vec2xInt8",
-    "Vec4xInt8",
-    "Vec8xInt8",
-    "Vec16xInt8",
-    "Vec32xInt8",
-    "Vec64xInt8",
-    "Vec2xInt16",
-    "Vec4xInt16",
-    "Vec8xInt16",
-    "Vec16xInt16",
-    "Vec32xInt16",
-    "Vec64xInt16",
-    "Vec2xInt32",
-    "Vec4xInt32",
-    "Vec8xInt32",
-    "Vec16xInt32",
-    "Vec32xInt32",
-    "Vec64xInt32",
-    "Vec2xInt64",
-    "Vec4xInt64",
-    "Vec8xInt64",
-    "Vec16xInt64",
-    "Vec32xInt64",
-    "Vec64xInt64",
-    "Vec2xFPIEEE16",
-    "Vec4xFPIEEE16",
-    "Vec8xFPIEEE16",
-    "Vec16xFPIEEE16",
-    "Vec32xFPIEEE16",
-    "Vec64xFPIEEE16",
-    "Vec2xFPIEEE32",
-    "Vec4xFPIEEE32",
-    "Vec8xFPIEEE32",
-    "Vec16xFPIEEE32",
-    "Vec32xFPIEEE32",
-    "Vec64xFPIEEE32",
-    "Vec2xFPIEEE64",
-    "Vec4xFPIEEE64",
-    "Vec8xFPIEEE64",
-    "Vec16xFPIEEE64",
-    "Vec32xFPIEEE64",
-    "Vec64xFPIEEE64",
-    "buildDefaultActorExecutorRef",
-    "buildMainActorExecutorRef",
-};
-}
--- a/swift/extractor/SwiftExtractor.cpp
+++ b/swift/extractor/SwiftExtractor.cpp
@@ -10,10 +10,10 @@

 #include "swift/extractor/translators/SwiftVisitor.h"
 #include "swift/extractor/infra/TargetDomains.h"
-#include "swift/extractor/SwiftBuiltinSymbols.h"
 #include "swift/extractor/infra/file/Path.h"
 #include "swift/extractor/infra/SwiftLocationExtractor.h"
 #include "swift/extractor/infra/SwiftBodyEmissionStrategy.h"
+#include "swift/extractor/mangler/SwiftMangler.h"

 using namespace codeql;
 using namespace std::string_literals;
@@ -43,10 +43,16 @@ static void archiveFile(const SwiftExtractorConfiguration& config, swift::Source
  }
 }

-static fs::path getFilename(swift::ModuleDecl& module, swift::SourceFile* primaryFile) {
+static fs::path getFilename(swift::ModuleDecl& module,
+                            swift::SourceFile* primaryFile,
+                            const swift::Decl* lazyDeclaration) {
  if (primaryFile) {
    return resolvePath(primaryFile->getFilename());
  }
+  if (lazyDeclaration) {
+    SwiftMangler mangler;
+    return mangler.mangledName(*lazyDeclaration);
+  }
  // PCM clang module
  if (module.isNonSwiftModule()) {
    // Several modules with different names might come from .pcm (clang module) files
@@ -72,49 +78,42 @@ static fs::path getFilename(swift::ModuleDecl& module, swift::SourceFile* primar
  return resolvePath(filename);
 }

-/* The builtin module is special, as it does not publish any top-level declaration
- * It creates (and caches) declarations on demand when a lookup is carried out
- * (see BuiltinUnit in swift/AST/FileUnit.h for the cache details, and getBuiltinValueDecl in
- * swift/AST/Builtins.h for the creation details)
- * As we want to create the Builtin trap file once and for all so that it works for other
- * extraction runs, rather than collecting what we need we pre-populate the builtin trap with
- * what we expect. This list might need thus to be expanded.
- * Notice, that while swift/AST/Builtins.def has a list of builtin symbols, it does not contain
- * all information required to instantiate builtin variants.
- * Other possible approaches:
- * * create one trap per builtin declaration when encountered
- * * expand the list to all possible builtins (of which there are a lot)
- */
-static void getBuiltinDecls(swift::ModuleDecl& builtinModule,
-                            llvm::SmallVector<swift::Decl*>& decls) {
-  llvm::SmallVector<swift::ValueDecl*> values;
-  for (auto symbol : swiftBuiltins) {
-    builtinModule.lookupValue(builtinModule.getASTContext().getIdentifier(symbol),
-                              swift::NLKind::QualifiedLookup, values);
+static llvm::SmallVector<const swift::Decl*> getTopLevelDecls(swift::ModuleDecl& module,
+                                                              swift::SourceFile* primaryFile,
+                                                              const swift::Decl* lazyDeclaration) {
+  llvm::SmallVector<const swift::Decl*> ret;
+  if (lazyDeclaration) {
+    ret.push_back(lazyDeclaration);
+    return ret;
  }
-  decls.insert(decls.end(), values.begin(), values.end());
+  ret.push_back(&module);
+  llvm::SmallVector<swift::Decl*> topLevelDecls;
+  if (primaryFile) {
+    primaryFile->getTopLevelDecls(topLevelDecls);
+  } else {
+    module.getTopLevelDecls(topLevelDecls);
+  }
+  ret.insert(ret.end(), topLevelDecls.data(), topLevelDecls.data() + topLevelDecls.size());
+  return ret;
 }

-static llvm::SmallVector<swift::Decl*> getTopLevelDecls(swift::ModuleDecl& module,
-                                                        swift::SourceFile* primaryFile = nullptr) {
-  llvm::SmallVector<swift::Decl*> ret;
-  ret.push_back(&module);
+static TrapType getTrapType(swift::SourceFile* primaryFile, const swift::Decl* lazyDeclaration) {
  if (primaryFile) {
-    primaryFile->getTopLevelDecls(ret);
-  } else if (module.isBuiltinModule()) {
-    getBuiltinDecls(module, ret);
-  } else {
-    module.getTopLevelDecls(ret);
+    return TrapType::source;
  }
-  return ret;
+  if (lazyDeclaration) {
+    return TrapType::lazy_declaration;
+  }
+  return TrapType::module;
 }

 static std::unordered_set<swift::ModuleDecl*> extractDeclarations(
    SwiftExtractorState& state,
    swift::CompilerInstance& compiler,
    swift::ModuleDecl& module,
-    swift::SourceFile* primaryFile = nullptr) {
-  auto filename = getFilename(module, primaryFile);
+    swift::SourceFile* primaryFile,
+    const swift::Decl* lazyDeclaration) {
+  auto filename = getFilename(module, primaryFile, lazyDeclaration);
  if (primaryFile) {
    state.sourceFiles.push_back(filename);
  }
@@ -122,10 +121,13 @@ static std::unordered_set<swift::ModuleDecl*> extractDeclarations(
  // The extractor can be called several times from different processes with
  // the same input file(s). Using `TargetFile` the first process will win, and the following
  // will just skip the work
-  const auto trapType = primaryFile ? TrapType::source : TrapType::module;
+  const auto trapType = getTrapType(primaryFile, lazyDeclaration);
  auto trap = createTargetTrapDomain(state, filename, trapType);
  if (!trap) {
    // another process arrived first, nothing to do for us
+    if (lazyDeclaration) {
+      state.emittedDeclarations.insert(lazyDeclaration);
+    }
    return {};
  }

@@ -143,9 +145,10 @@ static std::unordered_set<swift::ModuleDecl*> extractDeclarations(

  SwiftLocationExtractor locationExtractor(*trap);
  locationExtractor.emitFile(primaryFile);
-  SwiftBodyEmissionStrategy bodyEmissionStrategy(module, primaryFile);
-  SwiftVisitor visitor(compiler.getSourceMgr(), *trap, locationExtractor, bodyEmissionStrategy);
-  auto topLevelDecls = getTopLevelDecls(module, primaryFile);
+  SwiftBodyEmissionStrategy bodyEmissionStrategy(module, primaryFile, lazyDeclaration);
+  SwiftVisitor visitor(compiler.getSourceMgr(), state, *trap, locationExtractor,
+                       bodyEmissionStrategy);
+  auto topLevelDecls = getTopLevelDecls(module, primaryFile, lazyDeclaration);
  for (auto decl : topLevelDecls) {
    visitor.extract(decl);
  }
@@ -198,10 +201,12 @@ void codeql::extractSwiftFiles(SwiftExtractorState& state, swift::CompilerInstan
        continue;
      }
      archiveFile(state.configuration, *sourceFile);
-      encounteredModules = extractDeclarations(state, compiler, *module, sourceFile);
+      encounteredModules =
+          extractDeclarations(state, compiler, *module, sourceFile, /*lazy declaration*/ nullptr);
    }
    if (!isFromSourceFile) {
-      encounteredModules = extractDeclarations(state, compiler, *module);
+      encounteredModules = extractDeclarations(state, compiler, *module, /*source file*/ nullptr,
+                                               /*lazy declaration*/ nullptr);
    }
    for (auto encountered : encounteredModules) {
      if (state.encounteredModules.count(encountered) == 0) {
@@ -211,3 +216,37 @@ void codeql::extractSwiftFiles(SwiftExtractorState& state, swift::CompilerInstan
    }
  }
 }
+
+static void cleanupPendingDeclarations(SwiftExtractorState& state) {
+  std::vector<const swift::Decl*> worklist(std::begin(state.pendingDeclarations),
+                                           std::end(state.pendingDeclarations));
+  for (auto decl : worklist) {
+    if (state.emittedDeclarations.count(decl)) {
+      state.pendingDeclarations.erase(decl);
+    }
+  }
+}
+
+static void extractLazy(SwiftExtractorState& state, swift::CompilerInstance& compiler) {
+  cleanupPendingDeclarations(state);
+  std::vector<const swift::Decl*> worklist(std::begin(state.pendingDeclarations),
+                                           std::end(state.pendingDeclarations));
+  for (auto pending : worklist) {
+    extractDeclarations(state, compiler, *pending->getModuleContext(), /*source file*/ nullptr,
+                        pending);
+  }
+}
+
+void codeql::extractExtractLazyDeclarations(SwiftExtractorState& state,
+                                            swift::CompilerInstance& compiler) {
+  // Just in case
+  const int upperBound = 100;
+  int iteration = 0;
+  while (!state.pendingDeclarations.empty() && iteration++ < upperBound) {
+    extractLazy(state, compiler);
+  }
+  if (iteration >= upperBound) {
+    std::cerr << "Swift extractor reached upper bound while extracting lazy declarations\n";
+    abort();
+  }
+}
--- a/swift/extractor/SwiftExtractor.h
+++ b/swift/extractor/SwiftExtractor.h
@@ -7,4 +7,5 @@

 namespace codeql {
 void extractSwiftFiles(SwiftExtractorState& state, swift::CompilerInstance& compiler);
+void extractExtractLazyDeclarations(SwiftExtractorState& state, swift::CompilerInstance& compiler);
 }  // namespace codeql
--- a/swift/extractor/config/SwiftExtractorState.h
+++ b/swift/extractor/config/SwiftExtractorState.h
@@ -24,6 +24,12 @@ struct SwiftExtractorState {

  // The path for the modules outputted by the underlying frontend run, ignoring path redirection
  std::vector<std::filesystem::path> originalOutputModules;
+
+  // All lazy named declarations that were already emitted
+  std::unordered_set<const swift::Decl*> emittedDeclarations;
+
+  // Lazy named declarations that were not yet emitted and will be emitted each one separately
+  std::unordered_set<const swift::Decl*> pendingDeclarations;
 };

 }  // namespace codeql
--- a/swift/extractor/infra/SwiftBodyEmissionStrategy.cpp
+++ b/swift/extractor/infra/SwiftBodyEmissionStrategy.cpp
@@ -16,6 +16,9 @@ bool SwiftBodyEmissionStrategy::shouldEmitDeclBody(const swift::Decl& decl) {
  if (module != &currentModule) {
    return false;
  }
+  if (currentLazyDeclaration && currentLazyDeclaration != &decl) {
+    return false;
+  }
  // ModuleDecl is a special case: if it passed the previous test, it is the current module
  // but it never has a source file, so we short circuit to emit it in any case
  if (!currentPrimarySourceFile || decl.getKind() == swift::DeclKind::Module) {
--- a/swift/extractor/infra/SwiftBodyEmissionStrategy.h
+++ b/swift/extractor/infra/SwiftBodyEmissionStrategy.h
@@ -8,13 +8,17 @@ namespace codeql {
 class SwiftBodyEmissionStrategy {
 public:
  SwiftBodyEmissionStrategy(swift::ModuleDecl& currentModule,
-                            swift::SourceFile* currentPrimarySourceFile)
-      : currentModule(currentModule), currentPrimarySourceFile(currentPrimarySourceFile) {}
+                            swift::SourceFile* currentPrimarySourceFile,
+                            const swift::Decl* currentLazyDeclaration)
+      : currentModule(currentModule),
+        currentPrimarySourceFile(currentPrimarySourceFile),
+        currentLazyDeclaration(currentLazyDeclaration) {}
  bool shouldEmitDeclBody(const swift::Decl& decl);

 private:
  swift::ModuleDecl& currentModule;
  swift::SourceFile* currentPrimarySourceFile;
+  const swift::Decl* currentLazyDeclaration;
 };

 }  // namespace codeql
--- a/swift/extractor/infra/SwiftDispatcher.h
+++ b/swift/extractor/infra/SwiftDispatcher.h
@@ -12,6 +12,7 @@
 #include "swift/extractor/trap/generated/TrapClasses.h"
 #include "swift/extractor/infra/SwiftLocationExtractor.h"
 #include "swift/extractor/infra/SwiftBodyEmissionStrategy.h"
+#include "swift/extractor/config/SwiftExtractorState.h"

 namespace codeql {

@@ -45,10 +46,12 @@ class SwiftDispatcher {
  // all references and pointers passed as parameters to this constructor are supposed to outlive
  // the SwiftDispatcher
  SwiftDispatcher(const swift::SourceManager& sourceManager,
+                  SwiftExtractorState& state,
                  TrapDomain& trap,
                  SwiftLocationExtractor& locationExtractor,
                  SwiftBodyEmissionStrategy& bodyEmissionStrategy)
      : sourceManager{sourceManager},
+        state{state},
        trap{trap},
        locationExtractor{locationExtractor},
        bodyEmissionStrategy{bodyEmissionStrategy} {}
@@ -248,7 +251,23 @@ class SwiftDispatcher {
    locationExtractor.attachLocation(sourceManager, comment, entry.id);
  }

+  void extractedDeclaration(const swift::Decl& decl) {
+    if (isLazyDeclaration(decl)) {
+      state.emittedDeclarations.insert(&decl);
+    }
+  }
+  void skippedDeclaration(const swift::Decl& decl) {
+    if (isLazyDeclaration(decl)) {
+      state.pendingDeclarations.insert(&decl);
+    }
+  }
+
 private:
+  bool isLazyDeclaration(const swift::Decl& decl) {
+    swift::ModuleDecl* module = decl.getModuleContext();
+    return module->isBuiltinModule() || module->getName().str() == "__ObjC";
+  }
+
  template <typename T, typename = void>
  struct HasSize : std::false_type {};

@@ -302,6 +321,7 @@ class SwiftDispatcher {
  virtual void visit(const swift::CapturedValue* capture) = 0;

  const swift::SourceManager& sourceManager;
+  SwiftExtractorState& state;
  TrapDomain& trap;
  Store store;
  SwiftLocationExtractor& locationExtractor;
--- a/swift/extractor/infra/TargetDomains.cpp
+++ b/swift/extractor/infra/TargetDomains.cpp
@@ -13,6 +13,8 @@ static const char* typeToStr(TrapType type) {
      return "invocations";
    case TrapType::linkage:
      return "linkage";
+    case TrapType::lazy_declaration:
+      return "lazy_decls";
    default:
      return "";
  }
--- a/swift/extractor/infra/TargetDomains.h
+++ b/swift/extractor/infra/TargetDomains.h
@@ -12,6 +12,7 @@ enum class TrapType {
  module,
  invocation,
  linkage,
+  lazy_declaration,
 };

 std::filesystem::path getTrapPath(const SwiftExtractorState& state,
--- a/swift/extractor/main.cpp
+++ b/swift/extractor/main.cpp
@@ -92,6 +92,7 @@ class Observer : public swift::FrontendObserver {
  void performedSemanticAnalysis(swift::CompilerInstance& compiler) override {
    codeql::extractSwiftFiles(state, compiler);
    codeql::extractSwiftInvocation(state, compiler, invocationTrap);
+    codeql::extractExtractLazyDeclarations(state, compiler);
  }

 private:
--- a/swift/extractor/translators/DeclTranslator.h
+++ b/swift/extractor/translators/DeclTranslator.h
@@ -2,6 +2,7 @@

 #include <swift/AST/Decl.h>
 #include <swift/AST/ASTMangler.h>
+#include <swift/AST/Module.h>

 #include "swift/extractor/translators/TranslatorBase.h"
 #include "swift/extractor/trap/generated/decl/TrapClasses.h"
@@ -70,8 +71,11 @@ class DeclTranslator : public AstTranslatorBase<DeclTranslator> {
    std::optional<TrapClassOf<D>> entry;
    auto id = dispatcher.assignNewLabel(decl, mangledName(decl));
    if (dispatcher.shouldEmitDeclBody(decl)) {
+      dispatcher.extractedDeclaration(decl);
      entry.emplace(id);
      fillDecl(decl, *entry);
+    } else {
+      dispatcher.skippedDeclaration(decl);
    }
    return entry;
  }
--- a/swift/ql/lib/codeql/swift/dataflow/internal/TaintTrackingPrivate.qll
+++ b/swift/ql/lib/codeql/swift/dataflow/internal/TaintTrackingPrivate.qll
@@ -46,6 +46,9 @@ private module Cached {
    // allow flow through arithmetic (this case includes string concatenation)
    nodeTo.asExpr().(ArithmeticOperation).getAnOperand() = nodeFrom.asExpr()
    or
+    // allow flow through bitwise operations
+    nodeTo.asExpr().(BitwiseOperation).getAnOperand() = nodeFrom.asExpr()
+    or
    // allow flow through assignment operations (e.g. `+=`)
    exists(AssignOperation op |
      nodeFrom.asExpr() = op.getSource() and
--- a/swift/ql/lib/codeql/swift/elements/expr/ArithmeticOperation.qll
+++ b/swift/ql/lib/codeql/swift/elements/expr/ArithmeticOperation.qll
@@ -45,30 +45,33 @@ class BinaryArithmeticOperation extends BinaryExpr {
 * An add expression.
 * ```
 * a + b
+ * a &+ b
 * ```
 */
 class AddExpr extends BinaryExpr {
-  AddExpr() { this.getStaticTarget().getName() = "+(_:_:)" }
+  AddExpr() { this.getStaticTarget().getName() = ["+(_:_:)", "&+(_:_:)"] }
 }

 /**
 * A subtract expression.
 * ```
 * a - b
+ * a &- b
 * ```
 */
 class SubExpr extends BinaryExpr {
-  SubExpr() { this.getStaticTarget().getName() = "-(_:_:)" }
+  SubExpr() { this.getStaticTarget().getName() = ["-(_:_:)", "&-(_:_:)"] }
 }

 /**
 * A multiply expression.
 * ```
 * a * b
+ * a &* b
 * ```
 */
 class MulExpr extends BinaryExpr {
-  MulExpr() { this.getStaticTarget().getName() = "*(_:_:)" }
+  MulExpr() { this.getStaticTarget().getName() = ["*(_:_:)", "&*(_:_:)"] }
 }

 /**
--- a/swift/ql/lib/codeql/swift/elements/expr/BitwiseOperation.qll
+++ b/swift/ql/lib/codeql/swift/elements/expr/BitwiseOperation.qll
@@ -6,6 +6,8 @@ private import codeql.swift.elements.expr.PrefixUnaryExpr
 * A bitwise operation, such as:
 * ```
 * a & b
+ * a << b
+ * ~a
 * ```
 */
 class BitwiseOperation extends Expr {
@@ -27,6 +29,8 @@ class BitwiseOperation extends Expr {
 * A binary bitwise operation, such as:
 * ```
 * a & b
+ * a << b
+ * a .^ b
 * ```
 */
 class BinaryBitwiseOperation extends BinaryExpr {
@@ -34,6 +38,9 @@ class BinaryBitwiseOperation extends BinaryExpr {
    this instanceof AndBitwiseExpr or
    this instanceof OrBitwiseExpr or
    this instanceof XorBitwiseExpr or
+    this instanceof PointwiseAndExpr or
+    this instanceof PointwiseOrExpr or
+    this instanceof PointwiseXorExpr or
    this instanceof ShiftLeftBitwiseExpr or
    this instanceof ShiftRightBitwiseExpr
  }
@@ -69,24 +76,56 @@ class XorBitwiseExpr extends BinaryExpr {
  XorBitwiseExpr() { this.getStaticTarget().getName() = "^(_:_:)" }
 }

+/**
+ * A pointwise bitwise-and expression:
+ * ```
+ * a .& b
+ * ```
+ */
+class PointwiseAndExpr extends BinaryExpr {
+  PointwiseAndExpr() { this.getOperator().getName() = ".&(_:_:)" }
+}
+
+/**
+ * A pointwise bitwise-or expression:
+ * ```
+ * a .| b
+ * ```
+ */
+class PointwiseOrExpr extends BinaryExpr {
+  PointwiseOrExpr() { this.getOperator().getName() = ".|(_:_:)" }
+}
+
+/**
+ * A pointwise bitwise exclusive-or expression:
+ * ```
+ * a .^ b
+ * ```
+ */
+class PointwiseXorExpr extends BinaryExpr {
+  PointwiseXorExpr() { this.getOperator().getName() = ".^(_:_:)" }
+}
+
 /**
 * A bitwise shift left expression.
 * ```
 * a << b
+ * a &<<
 * ```
 */
 class ShiftLeftBitwiseExpr extends BinaryExpr {
-  ShiftLeftBitwiseExpr() { this.getStaticTarget().getName() = "<<(_:_:)" }
+  ShiftLeftBitwiseExpr() { this.getStaticTarget().getName() = ["<<(_:_:)", "&<<(_:_:)"] }
 }

 /**
 * A bitwise shift right expression.
 * ```
 * a >> b
+ * a &>>
 * ```
 */
 class ShiftRightBitwiseExpr extends BinaryExpr {
-  ShiftRightBitwiseExpr() { this.getStaticTarget().getName() = ">>(_:_:)" }
+  ShiftRightBitwiseExpr() { this.getStaticTarget().getName() = [">>(_:_:)", "&>>(_:_:)"] }
 }

 /**
--- a/swift/ql/src/queries/Security/CWE-135/StringLengthConflation.ql
+++ b/swift/ql/src/queries/Security/CWE-135/StringLengthConflation.ql
@@ -12,6 +12,7 @@

 import swift
 import codeql.swift.dataflow.DataFlow
+import codeql.swift.dataflow.TaintTracking
 import DataFlow::PathGraph

 /**
@@ -52,7 +53,7 @@ class StringLengthConflationFlowState extends string {
 * a `String` or an `NSString` object, to a sink of a different kind that
 * expects an incompatible measure of length.
 */
-class StringLengthConflationConfiguration extends DataFlow::Configuration {
+class StringLengthConflationConfiguration extends TaintTracking::Configuration {
  StringLengthConflationConfiguration() { this = "StringLengthConflationConfiguration" }

  override predicate isSource(DataFlow::Node node, string flowstate) {
@@ -177,11 +178,6 @@ class StringLengthConflationConfiguration extends DataFlow::Configuration {
        correctFlowState.(StringLengthConflationFlowState).getEquivClass()
    )
  }
-
-  override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
-    // allow flow through `+`, `-`, `*` etc.
-    node2.asExpr().(ArithmeticOperation).getAnOperand() = node1.asExpr()
-  }
 }

 from
--- a/swift/ql/test/library-tests/dataflow/taint/core/LocalTaint.expected
+++ b/swift/ql/test/library-tests/dataflow/taint/core/LocalTaint.expected
@@ -19,6 +19,18 @@
 | simple.swift:21:13:21:20 | call to source() | simple.swift:21:13:21:24 | ... .%(_:_:) ... |
 | simple.swift:21:24:21:24 | 100 | simple.swift:21:13:21:24 | ... .%(_:_:) ... |
 | simple.swift:23:14:23:21 | call to source() | simple.swift:23:13:23:21 | call to -(_:) |
+| simple.swift:27:13:27:13 | 1 | simple.swift:27:13:27:25 | ... .&+(_:_:) ... |
+| simple.swift:27:18:27:25 | call to source() | simple.swift:27:13:27:25 | ... .&+(_:_:) ... |
+| simple.swift:28:13:28:20 | call to source() | simple.swift:28:13:28:25 | ... .&+(_:_:) ... |
+| simple.swift:28:25:28:25 | 1 | simple.swift:28:13:28:25 | ... .&+(_:_:) ... |
+| simple.swift:29:13:29:13 | 1 | simple.swift:29:13:29:25 | ... .&-(_:_:) ... |
+| simple.swift:29:18:29:25 | call to source() | simple.swift:29:13:29:25 | ... .&-(_:_:) ... |
+| simple.swift:30:13:30:20 | call to source() | simple.swift:30:13:30:25 | ... .&-(_:_:) ... |
+| simple.swift:30:25:30:25 | 1 | simple.swift:30:13:30:25 | ... .&-(_:_:) ... |
+| simple.swift:31:13:31:13 | 2 | simple.swift:31:13:31:25 | ... .&*(_:_:) ... |
+| simple.swift:31:18:31:25 | call to source() | simple.swift:31:13:31:25 | ... .&*(_:_:) ... |
+| simple.swift:32:13:32:20 | call to source() | simple.swift:32:13:32:25 | ... .&*(_:_:) ... |
+| simple.swift:32:25:32:25 | 2 | simple.swift:32:13:32:25 | ... .&*(_:_:) ... |
 | simple.swift:36:7:36:7 | SSA def(a) | simple.swift:37:13:37:13 | a |
 | simple.swift:36:11:36:11 | 0 | simple.swift:36:7:36:7 | SSA def(a) |
 | simple.swift:37:13:37:13 | [post] a | simple.swift:38:3:38:3 | a |
@@ -89,6 +101,27 @@
 | simple.swift:68:3:68:3 | [post] &... | simple.swift:69:13:69:13 | e |
 | simple.swift:68:3:68:3 | e | simple.swift:68:3:68:3 | &... |
 | simple.swift:68:8:68:8 | 100 | simple.swift:68:3:68:3 | &... |
+| simple.swift:73:13:73:13 | 0 | simple.swift:73:13:73:24 | ... .\|(_:_:) ... |
+| simple.swift:73:17:73:24 | call to source() | simple.swift:73:13:73:24 | ... .\|(_:_:) ... |
+| simple.swift:74:13:74:20 | call to source() | simple.swift:74:13:74:24 | ... .\|(_:_:) ... |
+| simple.swift:74:24:74:24 | 0 | simple.swift:74:13:74:24 | ... .\|(_:_:) ... |
+| simple.swift:76:13:76:13 | 0xffff | simple.swift:76:13:76:29 | ... .&(_:_:) ... |
+| simple.swift:76:22:76:29 | call to source() | simple.swift:76:13:76:29 | ... .&(_:_:) ... |
+| simple.swift:77:13:77:20 | call to source() | simple.swift:77:13:77:24 | ... .&(_:_:) ... |
+| simple.swift:77:24:77:24 | 0xffff | simple.swift:77:13:77:24 | ... .&(_:_:) ... |
+| simple.swift:79:13:79:13 | 0xffff | simple.swift:79:13:79:29 | ... .^(_:_:) ... |
+| simple.swift:79:22:79:29 | call to source() | simple.swift:79:13:79:29 | ... .^(_:_:) ... |
+| simple.swift:80:13:80:20 | call to source() | simple.swift:80:13:80:24 | ... .^(_:_:) ... |
+| simple.swift:80:24:80:24 | 0xffff | simple.swift:80:13:80:24 | ... .^(_:_:) ... |
+| simple.swift:82:13:82:20 | call to source() | simple.swift:82:13:82:25 | ... .<<(_:_:) ... |
+| simple.swift:82:25:82:25 | 1 | simple.swift:82:13:82:25 | ... .<<(_:_:) ... |
+| simple.swift:83:13:83:20 | call to source() | simple.swift:83:13:83:26 | ... .&<<(_:_:) ... |
+| simple.swift:83:26:83:26 | 1 | simple.swift:83:13:83:26 | ... .&<<(_:_:) ... |
+| simple.swift:84:13:84:20 | call to source() | simple.swift:84:13:84:25 | ... .>>(_:_:) ... |
+| simple.swift:84:25:84:25 | 1 | simple.swift:84:13:84:25 | ... .>>(_:_:) ... |
+| simple.swift:85:13:85:20 | call to source() | simple.swift:85:13:85:26 | ... .&>>(_:_:) ... |
+| simple.swift:85:26:85:26 | 1 | simple.swift:85:13:85:26 | ... .&>>(_:_:) ... |
+| simple.swift:87:14:87:21 | call to source() | simple.swift:87:13:87:21 | call to ~(_:) |
 | subscript.swift:1:7:1:7 | SSA def(self) | subscript.swift:1:7:1:7 | self[return] |
 | subscript.swift:1:7:1:7 | SSA def(self) | subscript.swift:1:7:1:7 | self[return] |
 | subscript.swift:1:7:1:7 | self | subscript.swift:1:7:1:7 | SSA def(self) |
--- a/swift/ql/test/library-tests/dataflow/taint/core/Taint.expected
+++ b/swift/ql/test/library-tests/dataflow/taint/core/Taint.expected
@@ -10,6 +10,12 @@ edges
 | simple.swift:20:19:20:26 | call to source() :  | simple.swift:20:13:20:26 | ... .%(_:_:) ... |
 | simple.swift:21:13:21:20 | call to source() :  | simple.swift:21:13:21:24 | ... .%(_:_:) ... |
 | simple.swift:23:14:23:21 | call to source() :  | simple.swift:23:13:23:21 | call to -(_:) |
+| simple.swift:27:18:27:25 | call to source() :  | simple.swift:27:13:27:25 | ... .&+(_:_:) ... |
+| simple.swift:28:13:28:20 | call to source() :  | simple.swift:28:13:28:25 | ... .&+(_:_:) ... |
+| simple.swift:29:18:29:25 | call to source() :  | simple.swift:29:13:29:25 | ... .&-(_:_:) ... |
+| simple.swift:30:13:30:20 | call to source() :  | simple.swift:30:13:30:25 | ... .&-(_:_:) ... |
+| simple.swift:31:18:31:25 | call to source() :  | simple.swift:31:13:31:25 | ... .&*(_:_:) ... |
+| simple.swift:32:13:32:20 | call to source() :  | simple.swift:32:13:32:25 | ... .&*(_:_:) ... |
 | simple.swift:40:8:40:15 | call to source() :  | simple.swift:41:13:41:13 | a |
 | simple.swift:40:8:40:15 | call to source() :  | simple.swift:43:13:43:13 | a |
 | simple.swift:48:8:48:15 | call to source() :  | simple.swift:49:13:49:13 | b |
@@ -20,6 +26,17 @@ edges
 | simple.swift:60:8:60:15 | call to source() :  | simple.swift:63:13:63:13 | d |
 | simple.swift:66:8:66:15 | call to source() :  | simple.swift:67:13:67:13 | e |
 | simple.swift:66:8:66:15 | call to source() :  | simple.swift:69:13:69:13 | e |
+| simple.swift:73:17:73:24 | call to source() :  | simple.swift:73:13:73:24 | ... .\|(_:_:) ... |
+| simple.swift:74:13:74:20 | call to source() :  | simple.swift:74:13:74:24 | ... .\|(_:_:) ... |
+| simple.swift:76:22:76:29 | call to source() :  | simple.swift:76:13:76:29 | ... .&(_:_:) ... |
+| simple.swift:77:13:77:20 | call to source() :  | simple.swift:77:13:77:24 | ... .&(_:_:) ... |
+| simple.swift:79:22:79:29 | call to source() :  | simple.swift:79:13:79:29 | ... .^(_:_:) ... |
+| simple.swift:80:13:80:20 | call to source() :  | simple.swift:80:13:80:24 | ... .^(_:_:) ... |
+| simple.swift:82:13:82:20 | call to source() :  | simple.swift:82:13:82:25 | ... .<<(_:_:) ... |
+| simple.swift:83:13:83:20 | call to source() :  | simple.swift:83:13:83:26 | ... .&<<(_:_:) ... |
+| simple.swift:84:13:84:20 | call to source() :  | simple.swift:84:13:84:25 | ... .>>(_:_:) ... |
+| simple.swift:85:13:85:20 | call to source() :  | simple.swift:85:13:85:26 | ... .&>>(_:_:) ... |
+| simple.swift:87:14:87:21 | call to source() :  | simple.swift:87:13:87:21 | call to ~(_:) |
 | subscript.swift:13:15:13:22 | call to source() :  | subscript.swift:13:15:13:25 | ...[...] |
 | subscript.swift:14:15:14:23 | call to source2() :  | subscript.swift:14:15:14:26 | ...[...] |
 | try.swift:9:17:9:24 | call to source() :  | try.swift:9:13:9:24 | try ... |
@@ -48,6 +65,18 @@ nodes
 | simple.swift:21:13:21:24 | ... .%(_:_:) ... | semmle.label | ... .%(_:_:) ... |
 | simple.swift:23:13:23:21 | call to -(_:) | semmle.label | call to -(_:) |
 | simple.swift:23:14:23:21 | call to source() :  | semmle.label | call to source() :  |
+| simple.swift:27:13:27:25 | ... .&+(_:_:) ... | semmle.label | ... .&+(_:_:) ... |
+| simple.swift:27:18:27:25 | call to source() :  | semmle.label | call to source() :  |
+| simple.swift:28:13:28:20 | call to source() :  | semmle.label | call to source() :  |
+| simple.swift:28:13:28:25 | ... .&+(_:_:) ... | semmle.label | ... .&+(_:_:) ... |
+| simple.swift:29:13:29:25 | ... .&-(_:_:) ... | semmle.label | ... .&-(_:_:) ... |
+| simple.swift:29:18:29:25 | call to source() :  | semmle.label | call to source() :  |
+| simple.swift:30:13:30:20 | call to source() :  | semmle.label | call to source() :  |
+| simple.swift:30:13:30:25 | ... .&-(_:_:) ... | semmle.label | ... .&-(_:_:) ... |
+| simple.swift:31:13:31:25 | ... .&*(_:_:) ... | semmle.label | ... .&*(_:_:) ... |
+| simple.swift:31:18:31:25 | call to source() :  | semmle.label | call to source() :  |
+| simple.swift:32:13:32:20 | call to source() :  | semmle.label | call to source() :  |
+| simple.swift:32:13:32:25 | ... .&*(_:_:) ... | semmle.label | ... .&*(_:_:) ... |
 | simple.swift:40:8:40:15 | call to source() :  | semmle.label | call to source() :  |
 | simple.swift:41:13:41:13 | a | semmle.label | a |
 | simple.swift:43:13:43:13 | a | semmle.label | a |
@@ -63,6 +92,28 @@ nodes
 | simple.swift:66:8:66:15 | call to source() :  | semmle.label | call to source() :  |
 | simple.swift:67:13:67:13 | e | semmle.label | e |
 | simple.swift:69:13:69:13 | e | semmle.label | e |
+| simple.swift:73:13:73:24 | ... .\|(_:_:) ... | semmle.label | ... .\|(_:_:) ... |
+| simple.swift:73:17:73:24 | call to source() :  | semmle.label | call to source() :  |
+| simple.swift:74:13:74:20 | call to source() :  | semmle.label | call to source() :  |
+| simple.swift:74:13:74:24 | ... .\|(_:_:) ... | semmle.label | ... .\|(_:_:) ... |
+| simple.swift:76:13:76:29 | ... .&(_:_:) ... | semmle.label | ... .&(_:_:) ... |
+| simple.swift:76:22:76:29 | call to source() :  | semmle.label | call to source() :  |
+| simple.swift:77:13:77:20 | call to source() :  | semmle.label | call to source() :  |
+| simple.swift:77:13:77:24 | ... .&(_:_:) ... | semmle.label | ... .&(_:_:) ... |
+| simple.swift:79:13:79:29 | ... .^(_:_:) ... | semmle.label | ... .^(_:_:) ... |
+| simple.swift:79:22:79:29 | call to source() :  | semmle.label | call to source() :  |
+| simple.swift:80:13:80:20 | call to source() :  | semmle.label | call to source() :  |
+| simple.swift:80:13:80:24 | ... .^(_:_:) ... | semmle.label | ... .^(_:_:) ... |
+| simple.swift:82:13:82:20 | call to source() :  | semmle.label | call to source() :  |
+| simple.swift:82:13:82:25 | ... .<<(_:_:) ... | semmle.label | ... .<<(_:_:) ... |
+| simple.swift:83:13:83:20 | call to source() :  | semmle.label | call to source() :  |
+| simple.swift:83:13:83:26 | ... .&<<(_:_:) ... | semmle.label | ... .&<<(_:_:) ... |
+| simple.swift:84:13:84:20 | call to source() :  | semmle.label | call to source() :  |
+| simple.swift:84:13:84:25 | ... .>>(_:_:) ... | semmle.label | ... .>>(_:_:) ... |
+| simple.swift:85:13:85:20 | call to source() :  | semmle.label | call to source() :  |
+| simple.swift:85:13:85:26 | ... .&>>(_:_:) ... | semmle.label | ... .&>>(_:_:) ... |
+| simple.swift:87:13:87:21 | call to ~(_:) | semmle.label | call to ~(_:) |
+| simple.swift:87:14:87:21 | call to source() :  | semmle.label | call to source() :  |
 | subscript.swift:13:15:13:22 | call to source() :  | semmle.label | call to source() :  |
 | subscript.swift:13:15:13:25 | ...[...] | semmle.label | ...[...] |
 | subscript.swift:14:15:14:23 | call to source2() :  | semmle.label | call to source2() :  |
@@ -86,6 +137,12 @@ subpaths
 | simple.swift:20:13:20:26 | ... .%(_:_:) ... | simple.swift:20:19:20:26 | call to source() :  | simple.swift:20:13:20:26 | ... .%(_:_:) ... | result |
 | simple.swift:21:13:21:24 | ... .%(_:_:) ... | simple.swift:21:13:21:20 | call to source() :  | simple.swift:21:13:21:24 | ... .%(_:_:) ... | result |
 | simple.swift:23:13:23:21 | call to -(_:) | simple.swift:23:14:23:21 | call to source() :  | simple.swift:23:13:23:21 | call to -(_:) | result |
+| simple.swift:27:13:27:25 | ... .&+(_:_:) ... | simple.swift:27:18:27:25 | call to source() :  | simple.swift:27:13:27:25 | ... .&+(_:_:) ... | result |
+| simple.swift:28:13:28:25 | ... .&+(_:_:) ... | simple.swift:28:13:28:20 | call to source() :  | simple.swift:28:13:28:25 | ... .&+(_:_:) ... | result |
+| simple.swift:29:13:29:25 | ... .&-(_:_:) ... | simple.swift:29:18:29:25 | call to source() :  | simple.swift:29:13:29:25 | ... .&-(_:_:) ... | result |
+| simple.swift:30:13:30:25 | ... .&-(_:_:) ... | simple.swift:30:13:30:20 | call to source() :  | simple.swift:30:13:30:25 | ... .&-(_:_:) ... | result |
+| simple.swift:31:13:31:25 | ... .&*(_:_:) ... | simple.swift:31:18:31:25 | call to source() :  | simple.swift:31:13:31:25 | ... .&*(_:_:) ... | result |
+| simple.swift:32:13:32:25 | ... .&*(_:_:) ... | simple.swift:32:13:32:20 | call to source() :  | simple.swift:32:13:32:25 | ... .&*(_:_:) ... | result |
 | simple.swift:41:13:41:13 | a | simple.swift:40:8:40:15 | call to source() :  | simple.swift:41:13:41:13 | a | result |
 | simple.swift:43:13:43:13 | a | simple.swift:40:8:40:15 | call to source() :  | simple.swift:43:13:43:13 | a | result |
 | simple.swift:49:13:49:13 | b | simple.swift:48:8:48:15 | call to source() :  | simple.swift:49:13:49:13 | b | result |
@@ -96,6 +153,17 @@ subpaths
 | simple.swift:63:13:63:13 | d | simple.swift:60:8:60:15 | call to source() :  | simple.swift:63:13:63:13 | d | result |
 | simple.swift:67:13:67:13 | e | simple.swift:66:8:66:15 | call to source() :  | simple.swift:67:13:67:13 | e | result |
 | simple.swift:69:13:69:13 | e | simple.swift:66:8:66:15 | call to source() :  | simple.swift:69:13:69:13 | e | result |
+| simple.swift:73:13:73:24 | ... .\|(_:_:) ... | simple.swift:73:17:73:24 | call to source() :  | simple.swift:73:13:73:24 | ... .\|(_:_:) ... | result |
+| simple.swift:74:13:74:24 | ... .\|(_:_:) ... | simple.swift:74:13:74:20 | call to source() :  | simple.swift:74:13:74:24 | ... .\|(_:_:) ... | result |
+| simple.swift:76:13:76:29 | ... .&(_:_:) ... | simple.swift:76:22:76:29 | call to source() :  | simple.swift:76:13:76:29 | ... .&(_:_:) ... | result |
+| simple.swift:77:13:77:24 | ... .&(_:_:) ... | simple.swift:77:13:77:20 | call to source() :  | simple.swift:77:13:77:24 | ... .&(_:_:) ... | result |
+| simple.swift:79:13:79:29 | ... .^(_:_:) ... | simple.swift:79:22:79:29 | call to source() :  | simple.swift:79:13:79:29 | ... .^(_:_:) ... | result |
+| simple.swift:80:13:80:24 | ... .^(_:_:) ... | simple.swift:80:13:80:20 | call to source() :  | simple.swift:80:13:80:24 | ... .^(_:_:) ... | result |
+| simple.swift:82:13:82:25 | ... .<<(_:_:) ... | simple.swift:82:13:82:20 | call to source() :  | simple.swift:82:13:82:25 | ... .<<(_:_:) ... | result |
+| simple.swift:83:13:83:26 | ... .&<<(_:_:) ... | simple.swift:83:13:83:20 | call to source() :  | simple.swift:83:13:83:26 | ... .&<<(_:_:) ... | result |
+| simple.swift:84:13:84:25 | ... .>>(_:_:) ... | simple.swift:84:13:84:20 | call to source() :  | simple.swift:84:13:84:25 | ... .>>(_:_:) ... | result |
+| simple.swift:85:13:85:26 | ... .&>>(_:_:) ... | simple.swift:85:13:85:20 | call to source() :  | simple.swift:85:13:85:26 | ... .&>>(_:_:) ... | result |
+| simple.swift:87:13:87:21 | call to ~(_:) | simple.swift:87:14:87:21 | call to source() :  | simple.swift:87:13:87:21 | call to ~(_:) | result |
 | subscript.swift:13:15:13:25 | ...[...] | subscript.swift:13:15:13:22 | call to source() :  | subscript.swift:13:15:13:25 | ...[...] | result |
 | subscript.swift:14:15:14:26 | ...[...] | subscript.swift:14:15:14:23 | call to source2() :  | subscript.swift:14:15:14:26 | ...[...] | result |
 | try.swift:9:13:9:24 | try ... | try.swift:9:17:9:24 | call to source() :  | try.swift:9:13:9:24 | try ... | result |
--- a/swift/ql/test/library-tests/dataflow/taint/core/simple.swift
+++ b/swift/ql/test/library-tests/dataflow/taint/core/simple.swift
@@ -24,12 +24,12 @@ func taintThroughArithmetic() {

  // overflow operators

-  sink(arg: 1 &+ source()) // $ MISSING: tainted=
-  sink(arg: source() &+ 1) // $ MISSING: tainted=
-  sink(arg: 1 &- source()) // $ MISSING: tainted=
-  sink(arg: source() &- 1) // $ MISSING: tainted=
-  sink(arg: 2 &* source()) // $ MISSING: tainted=
-  sink(arg: source() &* 2) // $ MISSING: tainted=
+  sink(arg: 1 &+ source()) // $ tainted=27
+  sink(arg: source() &+ 1) // $ tainted=28
+  sink(arg: 1 &- source()) // $ tainted=29
+  sink(arg: source() &- 1) // $ tainted=30
+  sink(arg: 2 &* source()) // $ tainted=31
+  sink(arg: source() &* 2) // $ tainted=32
 }

 func taintThroughAssignmentArithmetic() {
@@ -68,3 +68,21 @@ func taintThroughAssignmentArithmetic() {
  e %= 100
  sink(arg: e) // $ tainted=66
 }
+
+func taintThroughBitwiseOperators() {
+  sink(arg: 0 | source()) // $ tainted=73
+  sink(arg: source() | 0) // $ tainted=74
+
+  sink(arg: 0xffff & source()) // $ tainted=76
+  sink(arg: source() & 0xffff) // $ tainted=77
+
+  sink(arg: 0xffff ^ source()) // $ tainted=79
+  sink(arg: source() ^ 0xffff) // $ tainted=80
+
+  sink(arg: source() << 1) // $ tainted=82
+  sink(arg: source() &<< 1) // $ tainted=83
+  sink(arg: source() >> 1) // $ tainted=84
+  sink(arg: source() &>> 1) // $ tainted=85
+
+  sink(arg: ~source()) // $ tainted=87
+}
--- a/swift/ql/test/library-tests/elements/expr/arithmeticoperation/arithmeticoperation.expected
+++ b/swift/ql/test/library-tests/elements/expr/arithmeticoperation/arithmeticoperation.expected
@@ -5,3 +5,6 @@
 | arithmeticoperation.swift:10:6:10:10 | ... .%(_:_:) ... | BinaryArithmeticOperation, RemExpr |
 | arithmeticoperation.swift:11:6:11:7 | call to -(_:) | UnaryArithmeticOperation, UnaryMinusExpr |
 | arithmeticoperation.swift:12:6:12:7 | call to +(_:) | UnaryArithmeticOperation, UnaryPlusExpr |
+| arithmeticoperation.swift:15:6:15:11 | ... .&+(_:_:) ... | AddExpr, BinaryArithmeticOperation |
+| arithmeticoperation.swift:16:6:16:11 | ... .&-(_:_:) ... | BinaryArithmeticOperation, SubExpr |
+| arithmeticoperation.swift:17:6:17:11 | ... .&*(_:_:) ... | BinaryArithmeticOperation, MulExpr |
--- a/swift/ql/test/library-tests/elements/expr/arithmeticoperation/arithmeticoperation.swift
+++ b/swift/ql/test/library-tests/elements/expr/arithmeticoperation/arithmeticoperation.swift
@@ -10,4 +10,9 @@ func test(c: Bool, x: Int, y: Int, z: Int) {
 	v = x % y;
 	v = -x;
 	v = +x;
+
+	// arithmetic operations with overflow
+	v = x &+ y;
+	v = x &- y;
+	v = x &* y;
 }
--- a/swift/ql/test/library-tests/elements/expr/bitwiseopration/bitwiseoperation.expected
+++ b/swift/ql/test/library-tests/elements/expr/bitwiseopration/bitwiseoperation.expected
@@ -4,3 +4,8 @@
 | bitwiseoperation.swift:5:7:5:11 | ... .^(_:_:) ... | BinaryBitwiseOperation, XorBitwiseExpr |
 | bitwiseoperation.swift:6:7:6:12 | ... .<<(_:_:) ... | BinaryBitwiseOperation, ShiftLeftBitwiseExpr |
 | bitwiseoperation.swift:7:7:7:12 | ... .>>(_:_:) ... | BinaryBitwiseOperation, ShiftRightBitwiseExpr |
+| bitwiseoperation.swift:10:7:10:13 | ... .&<<(_:_:) ... | BinaryBitwiseOperation, ShiftLeftBitwiseExpr |
+| bitwiseoperation.swift:11:7:11:13 | ... .&>>(_:_:) ... | BinaryBitwiseOperation, ShiftRightBitwiseExpr |
+| bitwiseoperation.swift:17:7:17:12 | ... ..&(_:_:) ... | BinaryBitwiseOperation, PointwiseAndExpr |
+| bitwiseoperation.swift:18:7:18:12 | ... ..\|(_:_:) ... | BinaryBitwiseOperation, PointwiseOrExpr |
+| bitwiseoperation.swift:19:7:19:12 | ... ..^(_:_:) ... | BinaryBitwiseOperation, PointwiseXorExpr |
--- a/swift/ql/test/library-tests/elements/expr/bitwiseopration/bitwiseoperation.ql
+++ b/swift/ql/test/library-tests/elements/expr/bitwiseopration/bitwiseoperation.ql
@@ -9,6 +9,12 @@ string describe(BitwiseOperation e) {
  or
  e instanceof XorBitwiseExpr and result = "XorBitwiseExpr"
  or
+  e instanceof PointwiseAndExpr and result = "PointwiseAndExpr"
+  or
+  e instanceof PointwiseOrExpr and result = "PointwiseOrExpr"
+  or
+  e instanceof PointwiseXorExpr and result = "PointwiseXorExpr"
+  or
  e instanceof ShiftLeftBitwiseExpr and result = "ShiftLeftBitwiseExpr"
  or
  e instanceof ShiftRightBitwiseExpr and result = "ShiftRightBitwiseExpr"
--- a/swift/ql/test/library-tests/elements/expr/bitwiseopration/bitwiseoperation.swift
+++ b/swift/ql/test/library-tests/elements/expr/bitwiseopration/bitwiseoperation.swift
@@ -5,4 +5,16 @@ func bitwise() {
  _ = 1 ^ 2
  _ = 1 << 0
  _ = 1 >> 0
+
+  // bitwise operations with overflow
+  _ = 1 &<< 1
+  _ = 1 &>> 1
+
+  // pointwise bitwise operations
+  let a = SIMD4<Int>(1, 2, 3, 4)
+  let b = SIMD4<Int>(4, 3, 2, 1)
+  let m = a .< b
+  _ = m .& m
+  _ = m .| m
+  _ = m .^ m
 }