hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-17 01:03:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'main' into redsun82/rust-doc

Browse Source
This commit is contained in:
Paolo Tranquilli
2025-06-12 17:33:51 +02:00
parent 902a421c23 a5dba9b54f
commit e1e34df948
358 changed files with 52600 additions and 10741 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
actions/ql/lib/change-notes/2025-06-09-bash-parsing-performance.md Normal file
View File

@@ -0,0 +1,6 @@
---
category: minorAnalysis
---
* Fixed performance issues in the parsing of Bash scripts in workflow files,
which led to out-of-disk errors when analysing certain workflow files with
complex interpolations of shell commands or quoted strings.

138
actions/ql/lib/codeql/actions/Bash.qll
View File

@@ -8,35 +8,64 @@ class BashShellScript extends ShellScript {
)
}
private string lineProducer(int i) {
result = this.getRawScript().regexpReplaceAll("\\\\\\s*\n", "").splitAt("\n", i)
/**
* Gets the line at 0-based index `lineIndex` within this shell script,
* assuming newlines as separators.
*/
private string lineProducer(int lineIndex) {
result = this.getRawScript().regexpReplaceAll("\\\\\\s*\n", "").splitAt("\n", lineIndex)
}
private predicate cmdSubstitutionReplacement(string cmdSubs, string id, int k) {
exists(string line | line = this.lineProducer(k) |
exists(int i, int j |
cmdSubs =
// $() cmd substitution
line.regexpFind("\\$\\((?:[^()]+|\\((?:[^()]+|\\([^()]*\\))*\\))*\\)", i, j)
.regexpReplaceAll("^\\$\\(", "")
.regexpReplaceAll("\\)$", "") and
id = "cmdsubs:" + k + ":" + i + ":" + j
)
or
exists(int i, int j |
// `...` cmd substitution
cmdSubs =
line.regexpFind("\\`[^\\`]+\\`", i, j)
.regexpReplaceAll("^\\`", "")
.regexpReplaceAll("\\`$", "") and
id = "cmd:" + k + ":" + i + ":" + j
)
private predicate cmdSubstitutionReplacement(string command, string id, int lineIndex) {
this.commandInSubstitution(lineIndex, command, id)
or
this.commandInBackticks(lineIndex, command, id)
}
/**
* Holds if there is a command substitution `$(command)` in
* the line at `lineIndex` in the shell script,
* and `id` is a unique identifier for this command.
*/
private predicate commandInSubstitution(int lineIndex, string command, string id) {
exists(int occurrenceIndex, int occurrenceOffset |
command =
// Look for the command inside a $(...) command substitution
this.lineProducer(lineIndex)
.regexpFind("\\$\\((?:[^()]+|\\((?:[^()]+|\\([^()]*\\))*\\))*\\)", occurrenceIndex,
occurrenceOffset)
// trim starting $( - TODO do this in first regex
.regexpReplaceAll("^\\$\\(", "")
// trim ending ) - TODO do this in first regex
.regexpReplaceAll("\\)$", "") and
id = "cmdsubs:" + lineIndex + ":" + occurrenceIndex + ":" + occurrenceOffset
)
}
private predicate rankedCmdSubstitutionReplacements(int i, string old, string new) {
old = rank[i](string old2 | this.cmdSubstitutionReplacement(old2, _, _) | old2) and
this.cmdSubstitutionReplacement(old, new, _)
/**
* Holds if `command` is a command in backticks `` `...` `` in
* the line at `lineIndex` in the shell script,
* and `id` is a unique identifier for this command.
*/
private predicate commandInBackticks(int lineIndex, string command, string id) {
exists(int occurrenceIndex, int occurrenceOffset |
command =
this.lineProducer(lineIndex)
.regexpFind("\\`[^\\`]+\\`", occurrenceIndex, occurrenceOffset)
// trim leading backtick - TODO do this in first regex
.regexpReplaceAll("^\\`", "")
// trim trailing backtick - TODO do this in first regex
.regexpReplaceAll("\\`$", "") and
id = "cmd:" + lineIndex + ":" + occurrenceIndex + ":" + occurrenceOffset
)
}
private predicate rankedCmdSubstitutionReplacements(int i, string command, string commandId) {
// rank commands by their unique IDs
commandId = rank[i](string c, string id | this.cmdSubstitutionReplacement(c, id, _) | id) and
// since we cannot output (command, ID) tuples from the rank operation,
// we need to work out the specific command associated with the resulting ID
this.cmdSubstitutionReplacement(command, commandId, _)
}
private predicate doReplaceCmdSubstitutions(int line, int round, string old, string new) {
@@ -64,31 +93,56 @@ class BashShellScript extends ShellScript {
this.cmdSubstitutionReplacement(result, _, i)
}
/**
* Holds if `quotedStr` is a string in double quotes in
* the line at `lineIndex` in the shell script,
* and `id` is a unique identifier for this quoted string.
*/
private predicate doubleQuotedString(int lineIndex, string quotedStr, string id) {
exists(int occurrenceIndex, int occurrenceOffset |
// double quoted string
quotedStr =
this.cmdSubstitutedLineProducer(lineIndex)
.regexpFind("\"((?:[^\"\\\\]|\\\\.)*)\"", occurrenceIndex, occurrenceOffset) and
id =
"qstr:" + lineIndex + ":" + occurrenceIndex + ":" + occurrenceOffset + ":" +
quotedStr.length() + ":" + quotedStr.regexpReplaceAll("[^a-zA-Z0-9]", "")
)
}
/**
* Holds if `quotedStr` is a string in single quotes in
* the line at `lineIndex` in the shell script,
* and `id` is a unique identifier for this quoted string.
*/
private predicate singleQuotedString(int lineIndex, string quotedStr, string id) {
exists(int occurrenceIndex, int occurrenceOffset |
// single quoted string
quotedStr =
this.cmdSubstitutedLineProducer(lineIndex)
.regexpFind("'((?:\\\\.|[^'\\\\])*)'", occurrenceIndex, occurrenceOffset) and
id =
"qstr:" + lineIndex + ":" + occurrenceIndex + ":" + occurrenceOffset + ":" +
quotedStr.length() + ":" + quotedStr.regexpReplaceAll("[^a-zA-Z0-9]", "")
)
}
private predicate quotedStringReplacement(string quotedStr, string id) {
exists(string line, int k | line = this.cmdSubstitutedLineProducer(k) |
exists(int i, int j |
// double quoted string
quotedStr = line.regexpFind("\"((?:[^\"\\\\]|\\\\.)*)\"", i, j) and
id =
"qstr:" + k + ":" + i + ":" + j + ":" + quotedStr.length() + ":" +
quotedStr.regexpReplaceAll("[^a-zA-Z0-9]", "")
)
exists(int lineIndex |
this.doubleQuotedString(lineIndex, quotedStr, id)
or
exists(int i, int j |
// single quoted string
quotedStr = line.regexpFind("'((?:\\\\.|[^'\\\\])*)'", i, j) and
id =
"qstr:" + k + ":" + i + ":" + j + ":" + quotedStr.length() + ":" +
quotedStr.regexpReplaceAll("[^a-zA-Z0-9]", "")
)
this.singleQuotedString(lineIndex, quotedStr, id)
) and
// Only do this for strings that might otherwise disrupt subsequent parsing
quotedStr.regexpMatch("[\"'].*[$\n\r'\"" + Bash::separator() + "].*[\"']")
}
private predicate rankedQuotedStringReplacements(int i, string old, string new) {
old = rank[i](string old2 | this.quotedStringReplacement(old2, _) | old2) and
this.quotedStringReplacement(old, new)
private predicate rankedQuotedStringReplacements(int i, string quotedString, string quotedStringId) {
// rank quoted strings by their nearly-unique IDs
quotedStringId = rank[i](string s, string id | this.quotedStringReplacement(s, id) | id) and
// since we cannot output (string, ID) tuples from the rank operation,
// we need to work out the specific string associated with the resulting ID
this.quotedStringReplacement(quotedString, quotedStringId)
}
private predicate doReplaceQuotedStrings(int line, int round, string old, string new) {

81
actions/ql/test/query-tests/Security/CWE-094/.github/workflows/interpolation.yml vendored Normal file
View File

@@ -0,0 +1,81 @@
name: Workflow with complex interpolation
on:
workflow_dispatch:
inputs:
choice-a:
required: true
type: choice
description: choice-a
default: a1
options:
- a1
- a2
- a3
string-b:
required: false
type: string
description: string-b
string-c:
required: false
type: string
description: string-c
list-d:
required: true
type: string
default: d1 d2
description: list-d whitespace separated
list-e:
required: false
type: string
description: list-e whitespace separated
choice-f:
required: true
type: choice
description: choice-f
options:
- false
- true
env:
DRY_TEST: false
B: ${{ github.event.inputs.string-b }}
jobs:
job:
runs-on: ubuntu-latest
steps:
- name: Produce values
id: produce-values
run: |
echo "region=region" >> $GITHUB_OUTPUT
echo "zone=zone" >> $GITHUB_OUTPUT
- name: Step with complex interpolation
id: complex
env:
CHOICE_A: ${{ github.event.inputs.choice-a }}
STRING_B: ${{ github.event.inputs.string-b }}
STRING_C: ${{ github.event.inputs.string-c }}
LIST_D: ${{ github.event.inputs.list-d }}
LIST_E: ${{ github.event.inputs.list-e }}
CHOICE_F: ${{ github.event.inputs.choice-f }}
REGION: ${{ steps.produce-values.outputs.region }}
ZONE: ${{ steps.produce-values.outputs.zone }}
DRY_TEST_JSON: ${{ fromJSON(env.DRY_TEST) }}
FUNCTION_NAME: my-function
USER_EMAIL: 'example@example.com'
TYPE: type
RANGE: '0-100'
run: |
comma_separated_list_d=$(echo "${LIST_D}" | sed "s/ /\",\"/g")
comma_separated_list_e=$(echo "${LIST_E}" | sed "s/ /\",\"/g")
c1=$(echo "${STRING_C}" | cut -d "-" -f 1)
c2=$(echo "${STRING_C}" | cut -d "-" -f 2)
# Similar commands that use JSON payloads with string interpolation.
response=$(aws lambda invoke --invocation-type RequestResponse --function-name "${FUNCTION_NAME}" --region "${REGION}" --cli-read-timeout 0 --cli-binary-format raw-in-base64-out --payload '{"appName":"my-app","chA":"'"${CHOICE_A}"'","c1":"'"${c1}"'","c2":"'"${c2}"'","a":"${CHOICE_A}","bValue":"${B}","zone":"${ZONE}","userEmail":"'"${USER_EMAIL}"'","region":"${REGION}","range":"${RANGE}","type":"${TYPE}","b":"${STRING_B}","listD":"","listE":"","dryTest":'"${DRY_TEST_JSON}"',"f":"${CHOICE_F}"}' ./config.json --log-type Tail)
response=$(aws lambda invoke --invocation-type RequestResponse --function-name "${FUNCTION_NAME}" --region "${REGION}" --cli-read-timeout 0 --cli-binary-format raw-in-base64-out --payload '{"appName":"my-app","chA":"'"${CHOICE_A}"'","c1":"'"${c1}"'","c2":"'"${c2}"'","a":"${CHOICE_A}","bValue":"${B}","zone":"${ZONE}","userEmail":"'"${USER_EMAIL}"'","region":"${REGION}","range":"${RANGE}","type":"${TYPE}","b":"${STRING_B}","listD":["'"${comma_separated_list_d}"'"],"listE":"","dryTest":'"${DRY_TEST_JSON}"',"f":"${CHOICE_F}"}' ./config.json --log-type Tail)
response=$(aws lambda invoke --invocation-type RequestResponse --function-name "${FUNCTION_NAME}" --region "${REGION}" --cli-read-timeout 0 --cli-binary-format raw-in-base64-out --payload '{"appName":"my-app","chA":"'"${CHOICE_A}"'","c1":"'"${c1}"'","c2":"'"${c2}"'","a":"${CHOICE_A}","bValue":"${B}","zone":"${ZONE}","userEmail":"'"${USER_EMAIL}"'","region":"${REGION}","range":"${RANGE}","type":"${TYPE}","b":"${STRING_B}","listD":["'"${comma_separated_list_d}"'"],"listE":"","dryTest":'"${DRY_TEST_JSON}"',"f":"${CHOICE_F}"}' ./config.json --log-type Tail)
response=$(aws lambda invoke --invocation-type RequestResponse --function-name "${FUNCTION_NAME}" --region "${REGION}" --cli-read-timeout 0 --cli-binary-format raw-in-base64-out --payload '{"appName":"my-app","chA":"'"${CHOICE_A}"'","c1":"'"${c1}"'","c2":"'"${c2}"'","a":"${CHOICE_A}","bValue":"${B}","zone":"${ZONE}","userEmail":"'"${USER_EMAIL}"'","region":"${REGION}","range":"${RANGE}","type":"${TYPE}","b":"${STRING_B}","listD":["'"${comma_separated_list_d}"'"],"listE":"","dryTest":'"${DRY_TEST_JSON}"',"f":"${CHOICE_F}"}' ./config.json --log-type Tail)
response=$(aws lambda invoke --invocation-type RequestResponse --function-name "${FUNCTION_NAME}" --region "${REGION}" --cli-read-timeout 0 --cli-binary-format raw-in-base64-out --payload '{"appName":"my-app","chA":"'"${CHOICE_A}"'","c1":"'"${c1}"'","c2":"'"${c2}"'","a":"${CHOICE_A}","bValue":"${B}","zone":"${ZONE}","userEmail":"'"${USER_EMAIL}"'","region":"${REGION}","range":"${RANGE}","type":"${TYPE}","b":"${STRING_B}","listD":"","listE":["'"${comma_separated_list_e}"'"],"dryTest":'"${DRY_TEST_JSON}"',"f":"${CHOICE_F}"}' ./config.json --log-type Tail)
shell: bash

10
cpp/bulk_generation_targets.yml Normal file
View File

@@ -0,0 +1,10 @@
language: cpp
strategy: dca
destination: cpp/ql/lib/ext/generated
targets:
- name: openssl
with-sinks: false
with-sources: false
- name: sqlite
with-sinks: false
with-sources: false

7
cpp/downgrades/3c45f8b9e71ec723bf50c40581e1f18f4f25e290/lambdas.ql Normal file
View File

@@ -0,0 +1,7 @@
class LambdaExpr extends @lambdaexpr {
string toString() { none() }
}
from LambdaExpr lambda, string default_capture, boolean has_explicit_return_type
where lambdas(lambda, default_capture, has_explicit_return_type, _)
select lambda, default_capture, has_explicit_return_type

2493
cpp/downgrades/3c45f8b9e71ec723bf50c40581e1f18f4f25e290/old.dbscheme Normal file
View File

File diff suppressed because it is too large Load Diff

2492
cpp/downgrades/3c45f8b9e71ec723bf50c40581e1f18f4f25e290/semmlecode.cpp.dbscheme Normal file
View File

File diff suppressed because it is too large Load Diff

3
cpp/downgrades/3c45f8b9e71ec723bf50c40581e1f18f4f25e290/upgrade.properties Normal file
View File

@@ -0,0 +1,3 @@
description: capture whether a lambda has an explicitly specified parameter list.
compatibility: full
lambdas.rel: run lambdas.qlo

9
cpp/downgrades/af887e83a815a9cefe774ffa80e2493a1365b9e2/builtintypes.ql Normal file
View File

@@ -0,0 +1,9 @@
class BuiltinType extends @builtintype {
string toString() { none() }
}
from BuiltinType id, string name, int kind, int new_kind, int size, int sign, int alignment
where
builtintypes(id, name, kind, size, sign, alignment) and
if kind = 62 then new_kind = 1 else new_kind = kind
select id, name, new_kind, size, sign, alignment

2492
cpp/downgrades/af887e83a815a9cefe774ffa80e2493a1365b9e2/old.dbscheme Normal file
View File

File diff suppressed because it is too large Load Diff

2491
cpp/downgrades/af887e83a815a9cefe774ffa80e2493a1365b9e2/semmlecode.cpp.dbscheme Normal file
View File

File diff suppressed because it is too large Load Diff

3
cpp/downgrades/af887e83a815a9cefe774ffa80e2493a1365b9e2/upgrade.properties Normal file
View File

@@ -0,0 +1,3 @@
description: Support __mfp8 type
compatibility: backwards
builtintypes.rel: run builtintypes.qlo

9
cpp/misc/bulk_generation_targets.json
View File

@@ -1,9 +0,0 @@
{
"strategy": "dca",
"language": "cpp",
"targets": [
{ "name": "openssl", "with-sources": false, "with-sinks": false },
{ "name": "sqlite", "with-sources": false, "with-sinks": false }
],
"destination": "cpp/ql/lib/ext/generated"
}

4
cpp/ql/lib/change-notes/2025-06-06-lambda-parameters.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: feature
---
* Added a predicate `hasParameterList` to `LambdaExpression` to capture whether a lambda has an explicitly specified parameter list.

3
cpp/ql/lib/semmle/code/cpp/Type.qll
View File

@@ -839,6 +839,9 @@ private predicate floatingPointTypeMapping(
or
// _Complex _Float128
kind = 61 and base = 2 and domain = TComplexDomain() and realKind = 49 and extended = false
or
// __mfp8
kind = 62 and base = 2 and domain = TRealDomain() and realKind = 62 and extended = false
}
/**

9
cpp/ql/lib/semmle/code/cpp/exprs/Lambda.qll
View File

@@ -41,12 +41,17 @@ class LambdaExpression extends Expr, @lambdaexpr {
* - "&" if capture-by-reference is the default for implicit captures.
* - "=" if capture-by-value is the default for implicit captures.
*/
string getDefaultCaptureMode() { lambdas(underlyingElement(this), result, _) }
string getDefaultCaptureMode() { lambdas(underlyingElement(this), result, _, _) }
/**
* Holds if the return type (of the call operator of the resulting object) was explicitly specified.
*/
predicate returnTypeIsExplicit() { lambdas(underlyingElement(this), _, true) }
predicate returnTypeIsExplicit() { lambdas(underlyingElement(this), _, true, _) }
/**
* Holds if the lambda has an explicitly specified parameter list, even when empty.
*/
predicate hasParameterList() { lambdas(underlyingElement(this), _, _, true) }
/**
* Gets the function which will be invoked when the resulting object is called.

4
cpp/ql/lib/semmlecode.cpp.dbscheme
View File

@@ -691,6 +691,7 @@ case @builtintype.kind of
| 59 = @complex_std_float64 // _Complex _Float64
| 60 = @complex_float64x // _Complex _Float64x
| 61 = @complex_std_float128 // _Complex _Float128
| 62 = @mfp8 // __mfp8
;
builtintypes(
@@ -2138,7 +2139,8 @@ code_block(
lambdas(
unique int expr: @lambdaexpr ref,
string default_capture: string ref,
boolean has_explicit_return_type: boolean ref
boolean has_explicit_return_type: boolean ref,
boolean has_explicit_parameter_list: boolean ref
);
lambda_capture(

7951
cpp/ql/lib/semmlecode.cpp.dbscheme.stats
View File

File diff suppressed because it is too large Load Diff

2491
cpp/ql/lib/upgrades/9a7c3c14c1076f64b871719117a558733d987b48/old.dbscheme Normal file
View File

File diff suppressed because it is too large Load Diff

2492
cpp/ql/lib/upgrades/9a7c3c14c1076f64b871719117a558733d987b48/semmlecode.cpp.dbscheme Normal file
View File

File diff suppressed because it is too large Load Diff

2
cpp/ql/lib/upgrades/9a7c3c14c1076f64b871719117a558733d987b48/upgrade.properties Normal file
View File

@@ -0,0 +1,2 @@
description: Support __mfp8 type
compatibility: full

7
cpp/ql/lib/upgrades/af887e83a815a9cefe774ffa80e2493a1365b9e2/lambdas.ql Normal file
View File

@@ -0,0 +1,7 @@
class LambdaExpr extends @lambdaexpr {
string toString() { none() }
}
from LambdaExpr lambda, string default_capture, boolean has_explicit_return_type
where lambdas(lambda, default_capture, has_explicit_return_type)
select lambda, default_capture, has_explicit_return_type, true

2492
cpp/ql/lib/upgrades/af887e83a815a9cefe774ffa80e2493a1365b9e2/old.dbscheme Normal file
View File

File diff suppressed because it is too large Load Diff

2493
cpp/ql/lib/upgrades/af887e83a815a9cefe774ffa80e2493a1365b9e2/semmlecode.cpp.dbscheme Normal file
View File

File diff suppressed because it is too large Load Diff

3
cpp/ql/lib/upgrades/af887e83a815a9cefe774ffa80e2493a1365b9e2/upgrade.properties Normal file
View File

@@ -0,0 +1,3 @@
description: capture whether a lambda has an explicitly specified parameter list.
compatibility: backwards
lambdas.rel: run lambdas.qlo

71
cpp/ql/test/library-tests/ir/ir/PrintAST.expected
View File

@@ -58,6 +58,77 @@
#-----| Type = [LongType] unsigned long
#-----| getParameter(1): [Parameter] (unnamed parameter 1)
#-----| Type = [ScopedEnum] align_val_t
arm.cpp:
# 6| [TopLevelFunction] uint8x8_t vadd_u8(uint8x8_t, uint8x8_t)
# 6| <params>:
# 6| getParameter(0): [Parameter] a
# 6| Type = [CTypedefType] uint8x8_t
# 6| getParameter(1): [Parameter] b
# 6| Type = [CTypedefType] uint8x8_t
# 6| getEntryPoint(): [BlockStmt] { ... }
# 7| getStmt(0): [ReturnStmt] return ...
# 7| getExpr(): [AddExpr] ... + ...
# 7| Type = [GNUVectorType] __attribute((neon_vector_type(8))) unsigned char
# 7| ValueCategory = prvalue
# 7| getLeftOperand(): [VariableAccess] a
# 7| Type = [CTypedefType] uint8x8_t
# 7| ValueCategory = prvalue(load)
# 7| getRightOperand(): [VariableAccess] b
# 7| Type = [CTypedefType] uint8x8_t
# 7| ValueCategory = prvalue(load)
# 12| [TopLevelFunction] uint16x8_t __builtin_aarch64_uaddlv8qi_uuu(uint8x8_t, uint8x8_t)
# 12| <params>:
# 12| getParameter(0): [Parameter] (unnamed parameter 0)
# 12| Type = [CTypedefType] uint8x8_t
# 12| getParameter(1): [Parameter] (unnamed parameter 1)
# 12| Type = [CTypedefType] uint8x8_t
# 14| [TopLevelFunction] uint16x8_t vaddl_u8(uint8x8_t, uint8x8_t)
# 14| <params>:
# 14| getParameter(0): [Parameter] a
# 14| Type = [CTypedefType] uint8x8_t
# 14| getParameter(1): [Parameter] b
# 14| Type = [CTypedefType] uint8x8_t
# 14| getEntryPoint(): [BlockStmt] { ... }
# 15| getStmt(0): [ReturnStmt] return ...
# 15| getExpr(): [FunctionCall] call to __builtin_aarch64_uaddlv8qi_uuu
# 15| Type = [CTypedefType] uint16x8_t
# 15| ValueCategory = prvalue
# 15| getArgument(0): [VariableAccess] a
# 15| Type = [CTypedefType] uint8x8_t
# 15| ValueCategory = prvalue(load)
# 15| getArgument(1): [VariableAccess] b
# 15| Type = [CTypedefType] uint8x8_t
# 15| ValueCategory = prvalue(load)
# 18| [TopLevelFunction] uint16x8_t arm_add(uint8x8_t, uint8x8_t)
# 18| <params>:
# 18| getParameter(0): [Parameter] a
# 18| Type = [CTypedefType] uint8x8_t
# 18| getParameter(1): [Parameter] b
# 18| Type = [CTypedefType] uint8x8_t
# 18| getEntryPoint(): [BlockStmt] { ... }
# 19| getStmt(0): [DeclStmt] declaration
# 19| getDeclarationEntry(0): [VariableDeclarationEntry] definition of c
# 19| Type = [CTypedefType] uint8x8_t
# 19| getVariable().getInitializer(): [Initializer] initializer for c
# 19| getExpr(): [FunctionCall] call to vadd_u8
# 19| Type = [CTypedefType] uint8x8_t
# 19| ValueCategory = prvalue
# 19| getArgument(0): [VariableAccess] a
# 19| Type = [CTypedefType] uint8x8_t
# 19| ValueCategory = prvalue(load)
# 19| getArgument(1): [VariableAccess] b
# 19| Type = [CTypedefType] uint8x8_t
# 19| ValueCategory = prvalue(load)
# 20| getStmt(1): [ReturnStmt] return ...
# 20| getExpr(): [FunctionCall] call to vaddl_u8
# 20| Type = [CTypedefType] uint16x8_t
# 20| ValueCategory = prvalue
# 20| getArgument(0): [VariableAccess] a
# 20| Type = [CTypedefType] uint8x8_t
# 20| ValueCategory = prvalue(load)
# 20| getArgument(1): [VariableAccess] c
# 20| Type = [CTypedefType] uint8x8_t
# 20| ValueCategory = prvalue(load)
bad_asts.cpp:
# 5| [CopyAssignmentOperator] Bad::S& Bad::S::operator=(Bad::S const&)
# 5| <params>:

83
cpp/ql/test/library-tests/ir/ir/aliased_ir.expected
View File

@@ -1,3 +1,86 @@
arm.cpp:
# 6| uint8x8_t vadd_u8(uint8x8_t, uint8x8_t)
# 6| Block 0
# 6| v6_1(void) = EnterFunction :
# 6| m6_2(unknown) = AliasedDefinition :
# 6| m6_3(unknown) = InitializeNonLocal :
# 6| m6_4(unknown) = Chi : total:m6_2, partial:m6_3
# 6| r6_5(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[a] :
# 6| m6_6(__attribute((neon_vector_type(8))) unsigned char) = InitializeParameter[a] : &:r6_5
# 6| r6_7(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[b] :
# 6| m6_8(__attribute((neon_vector_type(8))) unsigned char) = InitializeParameter[b] : &:r6_7
# 7| r7_1(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[#return] :
# 7| r7_2(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[a] :
# 7| r7_3(__attribute((neon_vector_type(8))) unsigned char) = Load[a] : &:r7_2, m6_6
# 7| r7_4(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[b] :
# 7| r7_5(__attribute((neon_vector_type(8))) unsigned char) = Load[b] : &:r7_4, m6_8
# 7| r7_6(__attribute((neon_vector_type(8))) unsigned char) = Add : r7_3, r7_5
# 7| m7_7(__attribute((neon_vector_type(8))) unsigned char) = Store[#return] : &:r7_1, r7_6
# 6| r6_9(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[#return] :
# 6| v6_10(void) = ReturnValue : &:r6_9, m7_7
# 6| v6_11(void) = AliasedUse : m6_3
# 6| v6_12(void) = ExitFunction :
# 14| uint16x8_t vaddl_u8(uint8x8_t, uint8x8_t)
# 14| Block 0
# 14| v14_1(void) = EnterFunction :
# 14| m14_2(unknown) = AliasedDefinition :
# 14| m14_3(unknown) = InitializeNonLocal :
# 14| m14_4(unknown) = Chi : total:m14_2, partial:m14_3
# 14| r14_5(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[a] :
# 14| m14_6(__attribute((neon_vector_type(8))) unsigned char) = InitializeParameter[a] : &:r14_5
# 14| r14_7(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[b] :
# 14| m14_8(__attribute((neon_vector_type(8))) unsigned char) = InitializeParameter[b] : &:r14_7
# 15| r15_1(glval<__attribute((neon_vector_type(8))) unsigned short>) = VariableAddress[#return] :
# 15| r15_2(glval<unknown>) = FunctionAddress[__builtin_aarch64_uaddlv8qi_uuu] :
# 15| r15_3(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[a] :
# 15| r15_4(__attribute((neon_vector_type(8))) unsigned char) = Load[a] : &:r15_3, m14_6
# 15| r15_5(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[b] :
# 15| r15_6(__attribute((neon_vector_type(8))) unsigned char) = Load[b] : &:r15_5, m14_8
# 15| r15_7(__attribute((neon_vector_type(8))) unsigned short) = Call[__builtin_aarch64_uaddlv8qi_uuu] : func:r15_2, 0:r15_4, 1:r15_6
# 15| m15_8(unknown) = ^CallSideEffect : ~m14_4
# 15| m15_9(unknown) = Chi : total:m14_4, partial:m15_8
# 15| m15_10(__attribute((neon_vector_type(8))) unsigned short) = Store[#return] : &:r15_1, r15_7
# 14| r14_9(glval<__attribute((neon_vector_type(8))) unsigned short>) = VariableAddress[#return] :
# 14| v14_10(void) = ReturnValue : &:r14_9, m15_10
# 14| v14_11(void) = AliasedUse : ~m15_9
# 14| v14_12(void) = ExitFunction :
# 18| uint16x8_t arm_add(uint8x8_t, uint8x8_t)
# 18| Block 0
# 18| v18_1(void) = EnterFunction :
# 18| m18_2(unknown) = AliasedDefinition :
# 18| m18_3(unknown) = InitializeNonLocal :
# 18| m18_4(unknown) = Chi : total:m18_2, partial:m18_3
# 18| r18_5(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[a] :
# 18| m18_6(__attribute((neon_vector_type(8))) unsigned char) = InitializeParameter[a] : &:r18_5
# 18| r18_7(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[b] :
# 18| m18_8(__attribute((neon_vector_type(8))) unsigned char) = InitializeParameter[b] : &:r18_7
# 19| r19_1(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[c] :
# 19| r19_2(glval<unknown>) = FunctionAddress[vadd_u8] :
# 19| r19_3(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[a] :
# 19| r19_4(__attribute((neon_vector_type(8))) unsigned char) = Load[a] : &:r19_3, m18_6
# 19| r19_5(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[b] :
# 19| r19_6(__attribute((neon_vector_type(8))) unsigned char) = Load[b] : &:r19_5, m18_8
# 19| r19_7(__attribute((neon_vector_type(8))) unsigned char) = Call[vadd_u8] : func:r19_2, 0:r19_4, 1:r19_6
# 19| m19_8(unknown) = ^CallSideEffect : ~m18_4
# 19| m19_9(unknown) = Chi : total:m18_4, partial:m19_8
# 19| m19_10(__attribute((neon_vector_type(8))) unsigned char) = Store[c] : &:r19_1, r19_7
# 20| r20_1(glval<__attribute((neon_vector_type(8))) unsigned short>) = VariableAddress[#return] :
# 20| r20_2(glval<unknown>) = FunctionAddress[vaddl_u8] :
# 20| r20_3(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[a] :
# 20| r20_4(__attribute((neon_vector_type(8))) unsigned char) = Load[a] : &:r20_3, m18_6
# 20| r20_5(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[c] :
# 20| r20_6(__attribute((neon_vector_type(8))) unsigned char) = Load[c] : &:r20_5, m19_10
# 20| r20_7(__attribute((neon_vector_type(8))) unsigned short) = Call[vaddl_u8] : func:r20_2, 0:r20_4, 1:r20_6
# 20| m20_8(unknown) = ^CallSideEffect : ~m19_9
# 20| m20_9(unknown) = Chi : total:m19_9, partial:m20_8
# 20| m20_10(__attribute((neon_vector_type(8))) unsigned short) = Store[#return] : &:r20_1, r20_7
# 18| r18_9(glval<__attribute((neon_vector_type(8))) unsigned short>) = VariableAddress[#return] :
# 18| v18_10(void) = ReturnValue : &:r18_9, m20_10
# 18| v18_11(void) = AliasedUse : ~m20_9
# 18| v18_12(void) = ExitFunction :
bad_asts.cpp:
# 9| int Bad::S::MemberFunction<int 6>(int)
# 9| Block 0

21
cpp/ql/test/library-tests/ir/ir/arm.cpp Normal file
View File

@@ -0,0 +1,21 @@
// semmle-extractor-options: --edg --target --edg linux_arm64
typedef __Uint8x8_t uint8x8_t;
typedef __Uint16x8_t uint16x8_t;
uint8x8_t vadd_u8(uint8x8_t a, uint8x8_t b) {
return a + b;
}
// Workaround: the frontend only exposes this when the arm_neon.h
// header is encountered.
uint16x8_t __builtin_aarch64_uaddlv8qi_uuu(uint8x8_t, uint8x8_t);
uint16x8_t vaddl_u8(uint8x8_t a, uint8x8_t b) {
return __builtin_aarch64_uaddlv8qi_uuu (a, b);
}
uint16x8_t arm_add(uint8x8_t a, uint8x8_t b) {
uint8x8_t c = vadd_u8(a, b);
return vaddl_u8(a, c);
}

77
cpp/ql/test/library-tests/ir/ir/raw_ir.expected
View File

@@ -1,3 +1,80 @@
arm.cpp:
# 6| uint8x8_t vadd_u8(uint8x8_t, uint8x8_t)
# 6| Block 0
# 6| v6_1(void) = EnterFunction :
# 6| mu6_2(unknown) = AliasedDefinition :
# 6| mu6_3(unknown) = InitializeNonLocal :
# 6| r6_4(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[a] :
# 6| mu6_5(__attribute((neon_vector_type(8))) unsigned char) = InitializeParameter[a] : &:r6_4
# 6| r6_6(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[b] :
# 6| mu6_7(__attribute((neon_vector_type(8))) unsigned char) = InitializeParameter[b] : &:r6_6
# 7| r7_1(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[#return] :
# 7| r7_2(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[a] :
# 7| r7_3(__attribute((neon_vector_type(8))) unsigned char) = Load[a] : &:r7_2, ~m?
# 7| r7_4(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[b] :
# 7| r7_5(__attribute((neon_vector_type(8))) unsigned char) = Load[b] : &:r7_4, ~m?
# 7| r7_6(__attribute((neon_vector_type(8))) unsigned char) = Add : r7_3, r7_5
# 7| mu7_7(__attribute((neon_vector_type(8))) unsigned char) = Store[#return] : &:r7_1, r7_6
# 6| r6_8(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[#return] :
# 6| v6_9(void) = ReturnValue : &:r6_8, ~m?
# 6| v6_10(void) = AliasedUse : ~m?
# 6| v6_11(void) = ExitFunction :
# 14| uint16x8_t vaddl_u8(uint8x8_t, uint8x8_t)
# 14| Block 0
# 14| v14_1(void) = EnterFunction :
# 14| mu14_2(unknown) = AliasedDefinition :
# 14| mu14_3(unknown) = InitializeNonLocal :
# 14| r14_4(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[a] :
# 14| mu14_5(__attribute((neon_vector_type(8))) unsigned char) = InitializeParameter[a] : &:r14_4
# 14| r14_6(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[b] :
# 14| mu14_7(__attribute((neon_vector_type(8))) unsigned char) = InitializeParameter[b] : &:r14_6
# 15| r15_1(glval<__attribute((neon_vector_type(8))) unsigned short>) = VariableAddress[#return] :
# 15| r15_2(glval<unknown>) = FunctionAddress[__builtin_aarch64_uaddlv8qi_uuu] :
# 15| r15_3(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[a] :
# 15| r15_4(__attribute((neon_vector_type(8))) unsigned char) = Load[a] : &:r15_3, ~m?
# 15| r15_5(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[b] :
# 15| r15_6(__attribute((neon_vector_type(8))) unsigned char) = Load[b] : &:r15_5, ~m?
# 15| r15_7(__attribute((neon_vector_type(8))) unsigned short) = Call[__builtin_aarch64_uaddlv8qi_uuu] : func:r15_2, 0:r15_4, 1:r15_6
# 15| mu15_8(unknown) = ^CallSideEffect : ~m?
# 15| mu15_9(__attribute((neon_vector_type(8))) unsigned short) = Store[#return] : &:r15_1, r15_7
# 14| r14_8(glval<__attribute((neon_vector_type(8))) unsigned short>) = VariableAddress[#return] :
# 14| v14_9(void) = ReturnValue : &:r14_8, ~m?
# 14| v14_10(void) = AliasedUse : ~m?
# 14| v14_11(void) = ExitFunction :
# 18| uint16x8_t arm_add(uint8x8_t, uint8x8_t)
# 18| Block 0
# 18| v18_1(void) = EnterFunction :
# 18| mu18_2(unknown) = AliasedDefinition :
# 18| mu18_3(unknown) = InitializeNonLocal :
# 18| r18_4(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[a] :
# 18| mu18_5(__attribute((neon_vector_type(8))) unsigned char) = InitializeParameter[a] : &:r18_4
# 18| r18_6(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[b] :
# 18| mu18_7(__attribute((neon_vector_type(8))) unsigned char) = InitializeParameter[b] : &:r18_6
# 19| r19_1(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[c] :
# 19| r19_2(glval<unknown>) = FunctionAddress[vadd_u8] :
# 19| r19_3(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[a] :
# 19| r19_4(__attribute((neon_vector_type(8))) unsigned char) = Load[a] : &:r19_3, ~m?
# 19| r19_5(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[b] :
# 19| r19_6(__attribute((neon_vector_type(8))) unsigned char) = Load[b] : &:r19_5, ~m?
# 19| r19_7(__attribute((neon_vector_type(8))) unsigned char) = Call[vadd_u8] : func:r19_2, 0:r19_4, 1:r19_6
# 19| mu19_8(unknown) = ^CallSideEffect : ~m?
# 19| mu19_9(__attribute((neon_vector_type(8))) unsigned char) = Store[c] : &:r19_1, r19_7
# 20| r20_1(glval<__attribute((neon_vector_type(8))) unsigned short>) = VariableAddress[#return] :
# 20| r20_2(glval<unknown>) = FunctionAddress[vaddl_u8] :
# 20| r20_3(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[a] :
# 20| r20_4(__attribute((neon_vector_type(8))) unsigned char) = Load[a] : &:r20_3, ~m?
# 20| r20_5(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[c] :
# 20| r20_6(__attribute((neon_vector_type(8))) unsigned char) = Load[c] : &:r20_5, ~m?
# 20| r20_7(__attribute((neon_vector_type(8))) unsigned short) = Call[vaddl_u8] : func:r20_2, 0:r20_4, 1:r20_6
# 20| mu20_8(unknown) = ^CallSideEffect : ~m?
# 20| mu20_9(__attribute((neon_vector_type(8))) unsigned short) = Store[#return] : &:r20_1, r20_7
# 18| r18_8(glval<__attribute((neon_vector_type(8))) unsigned short>) = VariableAddress[#return] :
# 18| v18_9(void) = ReturnValue : &:r18_8, ~m?
# 18| v18_10(void) = AliasedUse : ~m?
# 18| v18_11(void) = ExitFunction :
bad_asts.cpp:
# 9| int Bad::S::MemberFunction<int 6>(int)
# 9| Block 0

11
cpp/ql/test/library-tests/lambdas/syntax/empty_declarator.expected Normal file
View File

@@ -0,0 +1,11 @@
| parameters.cpp:2:5:2:23 | [...](...){...} | with list | 2 |
| parameters.cpp:4:5:4:22 | [...](...){...} | with list | 1 |
| parameters.cpp:6:5:6:17 | [...](...){...} | with list | 1 |
| parameters.cpp:8:5:8:20 | [...](...){...} | with list | 0 |
| parameters.cpp:10:5:10:26 | [...](...){...} | with list | 0 |
| parameters.cpp:11:5:11:24 | [...](...){...} | without list | 0 |
| parameters.cpp:13:5:13:20 | [...](...){...} | with list | 0 |
| parameters.cpp:16:5:18:5 | [...](...){...} | with list | 0 |
| parameters.cpp:20:5:22:5 | [...](...){...} | without list | 0 |
| parameters.cpp:24:5:24:10 | [...](...){...} | without list | 0 |
| parameters.cpp:25:5:25:14 | [...](...){...} | with list | 0 |

5
cpp/ql/test/library-tests/lambdas/syntax/empty_declarator.ql Normal file
View File

@@ -0,0 +1,5 @@
import cpp
from LambdaExpression e, string parameterList
where if e.hasParameterList() then parameterList = "with list" else parameterList = "without list"
select e, parameterList, e.getLambdaFunction().getNumberOfParameters()

26
cpp/ql/test/library-tests/lambdas/syntax/parameters.cpp Normal file
View File

@@ -0,0 +1,26 @@
void test_lambda_declarator() {
[=](int, float) { };
[](int x = 42) { };
[](int x) { };
[]() mutable { };
[]() [[nodiscard]] { };
[] [[nodiscard]] { };
[]() -> void { };
int i;
[&i]() {
i += 1;
};
[&i] {
i += 1;
};
[] { };
[=] () { };
}

1
cpp/ql/test/library-tests/templates/type_instantiations/types.expected
View File

@@ -25,6 +25,7 @@
| file://:0:0:0:0 | __float128 |
| file://:0:0:0:0 | __fp16 |
| file://:0:0:0:0 | __int128 |
| file://:0:0:0:0 | __mfp8 |
| file://:0:0:0:0 | __va_list_tag |
| file://:0:0:0:0 | __va_list_tag & |
| file://:0:0:0:0 | __va_list_tag && |

1
cpp/ql/test/library-tests/type_sizes/type_sizes.expected
View File

@@ -46,6 +46,7 @@
| file://:0:0:0:0 | __float128 | 16 |
| file://:0:0:0:0 | __fp16 | 2 |
| file://:0:0:0:0 | __int128 | 16 |
| file://:0:0:0:0 | __mfp8 | 1 |
| file://:0:0:0:0 | __va_list_tag | 24 |
| file://:0:0:0:0 | __va_list_tag & | 8 |
| file://:0:0:0:0 | __va_list_tag && | 8 |

1
cpp/ql/test/library-tests/unspecified_type/types/unspecified_type.expected
View File

@@ -27,6 +27,7 @@
| file://:0:0:0:0 | __float128 | __float128 |
| file://:0:0:0:0 | __fp16 | __fp16 |
| file://:0:0:0:0 | __int128 | __int128 |
| file://:0:0:0:0 | __mfp8 | __mfp8 |
| file://:0:0:0:0 | __va_list_tag & | __va_list_tag & |
| file://:0:0:0:0 | __va_list_tag && | __va_list_tag && |
| file://:0:0:0:0 | auto | auto |

1
cpp/ql/test/library-tests/variables/variables/types.expected
View File

@@ -26,6 +26,7 @@
| __float128 | Float128Type | | | | |
| __fp16 | BinaryFloatingPointType, RealNumberType | | | | |
| __int128 | Int128Type | | | | |
| __mfp8 | BinaryFloatingPointType, RealNumberType | | | | |
| __va_list_tag | DirectAccessHolder, MetricClass, Struct, StructLikeClass | | | | |
| __va_list_tag & | LValueReferenceType, PointerOrArrayOrReferenceType, PointerOrArrayOrReferenceTypeIndirection | | __va_list_tag | | |
| __va_list_tag && | PointerOrArrayOrReferenceType, PointerOrArrayOrReferenceTypeIndirection, RValueReferenceType | | __va_list_tag | | |

3
csharp/ql/integration-tests/posix/query-suite/csharp-code-quality.qls.expected
View File

@@ -2,6 +2,8 @@ ql/csharp/ql/src/API Abuse/CallToGCCollect.ql
ql/csharp/ql/src/API Abuse/FormatInvalid.ql
ql/csharp/ql/src/API Abuse/NoDisposeCallOnLocalIDisposable.ql
ql/csharp/ql/src/Bad Practices/Control-Flow/ConstantCondition.ql
ql/csharp/ql/src/CSI/NullAlways.ql
ql/csharp/ql/src/CSI/NullMaybe.ql
ql/csharp/ql/src/Dead Code/DeadStoreOfLocal.ql
ql/csharp/ql/src/Language Abuse/MissedReadonlyOpportunity.ql
ql/csharp/ql/src/Likely Bugs/Collections/ContainerLengthCmpOffByOne.ql
@@ -11,6 +13,7 @@ ql/csharp/ql/src/Likely Bugs/EqualityCheckOnFloats.ql
ql/csharp/ql/src/Likely Bugs/ReferenceEqualsOnValueTypes.ql
ql/csharp/ql/src/Likely Bugs/SelfAssignment.ql
ql/csharp/ql/src/Likely Bugs/UncheckedCastInEquals.ql
ql/csharp/ql/src/Performance/StringConcatenationInLoop.ql
ql/csharp/ql/src/Performance/UseTryGetValue.ql
ql/csharp/ql/src/Useless code/DefaultToString.ql
ql/csharp/ql/src/Useless code/IntGetHashCode.ql

9
csharp/ql/lib/semmle/code/csharp/dataflow/Nullness.qll
View File

@@ -544,8 +544,13 @@ class Dereference extends G::DereferenceableExpr {
p.hasExtensionMethodModifier() and
not emc.isConditional()
|
p.fromSource() // assume all non-source extension methods perform a dereference
implies
// Assume all non-source extension methods on
// (1) nullable types are null-safe
// (2) non-nullable types are doing a dereference.
p.fromLibrary() and
not p.getAnnotatedType().isNullableRefType()
or
p.fromSource() and
exists(
Ssa::ImplicitParameterDefinition def,
AssignableDefinitions::ImplicitParameterDefinition pdef

4
csharp/ql/lib/semmle/code/csharp/frameworks/system/Diagnostics.qll
View File

@@ -41,9 +41,7 @@ class SystemDiagnosticsDebugClass extends SystemDiagnosticsClass {
/** Gets an `Assert(bool, ...)` method. */
Method getAssertMethod() {
result.getDeclaringType() = this and
result.hasName("Assert") and
result.getParameter(0).getType() instanceof BoolType and
result.getReturnType() instanceof VoidType
result.hasName("Assert")
}
}

1
csharp/ql/src/CSI/NullAlways.ql
View File

@@ -9,6 +9,7 @@
* correctness
* exceptions
* external/cwe/cwe-476
* quality
*/
import csharp

1
csharp/ql/src/CSI/NullMaybe.ql
View File

@@ -10,6 +10,7 @@
* correctness
* exceptions
* external/cwe/cwe-476
* quality
*/
import csharp

1
csharp/ql/src/Performance/StringConcatenationInLoop.ql
View File

@@ -7,6 +7,7 @@
* @id cs/string-concatenation-in-loop
* @tags efficiency
* maintainability
* quality
*/
import csharp

2
csharp/ql/src/Security Features/CWE-134/UncontrolledFormatString.ql
View File

@@ -4,7 +4,7 @@
* and cause a denial of service.
* @kind path-problem
* @problem.severity error
* @security-severity 9.3
* @security-severity 7.3
* @precision high
* @id cs/uncontrolled-format-string
* @tags security

4
csharp/ql/src/change-notes/2025-06-03-dereferece-extension-method.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: minorAnalysis
---
* The queries `cs/dereferenced-value-is-always-null` and `cs/dereferenced-value-may-be-null` have been improved to reduce false positives. The queries no longer assume that expressions are dereferenced when passed as the receiver (`this` parameter) to extension methods where that parameter is a nullable type.

4
csharp/ql/src/change-notes/2025-06-06-reduce-CWE-134-for-memory-safe-languages.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: queryMetadata
---
* Adjusts the `@security-severity` from 9.3 to 7.3 for `cs/uncontrolled-format-string` to align `CWE-134` severity for memory safe languages to better reflect their impact.

143
csharp/ql/src/codeql-suites/csharp-security-and-quality.qls
View File

@@ -1,4 +1,143 @@
- description: Security-and-quality queries for C#
- queries: .
- apply: security-and-quality-selectors.yml
from: codeql/suite-helpers
- include:
kind:
- problem
- path-problem
precision:
- high
- very-high
tags contain:
- security
- include:
kind:
- problem
- path-problem
precision: medium
problem.severity:
- error
- warning
tags contain:
- security
- include:
id:
- cs/asp/response-write
- cs/call-to-gc
- cs/call-to-object-tostring
- cs/call-to-obsolete-method
- cs/call-to-unmanaged-code
- cs/cast-from-abstract-to-concrete-collection
- cs/cast-of-this-to-type-parameter
- cs/catch-nullreferenceexception
- cs/catch-of-all-exceptions
- cs/chained-type-tests
- cs/class-implements-icloneable
- cs/class-missing-equals
- cs/class-name-comparison
- cs/class-name-matches-base-class
- cs/coalesce-of-identical-expressions
- cs/comparison-of-identical-expressions
- cs/complex-block
- cs/complex-condition
- cs/constant-comparison
- cs/constant-condition
- cs/coupled-types
- cs/dereferenced-value-is-always-null
- cs/dereferenced-value-may-be-null
- cs/dispose-not-called-on-throw
- cs/downcast-of-this
- cs/empty-block
- cs/empty-catch-block
- cs/empty-collection
- cs/empty-lock-statement
- cs/equality-on-floats
- cs/equals-on-arrays
- cs/equals-on-unrelated-types
- cs/equals-uses-as
- cs/equals-uses-is
- cs/expose-implementation
- cs/field-masks-base-field
- cs/gethashcode-is-not-defined
- cs/impossible-array-cast
- cs/inconsistent-compareto-and-equals
- cs/inconsistent-equals-and-gethashcode
- cs/inconsistent-lock-sequence
- cs/index-out-of-bounds
- cs/inefficient-containskey
- cs/invalid-dynamic-call
- cs/invalid-string-formatting
- cs/linq/inconsistent-enumeration
- cs/linq/missed-all
- cs/linq/missed-cast
- cs/linq/missed-oftype
- cs/linq/missed-select
- cs/linq/missed-where
- cs/linq/useless-select
- cs/local-not-disposed
- cs/local-shadows-member
- cs/lock-this
- cs/locked-wait
- cs/loss-of-precision
- cs/mishandling-japanese-era
- cs/misleading-indentation
- cs/missed-readonly-modifier
- cs/missed-ternary-operator
- cs/missed-using-statement
- cs/nested-if-statements
- cs/nested-loops-with-same-variable
- cs/non-short-circuit
- cs/null-argument-to-equals
- cs/path-combine
- cs/recursive-equals-call
- cs/recursive-operator-equals-call
- cs/reference-equality-on-valuetypes
- cs/reference-equality-with-object
- cs/rethrown-exception-variable
- cs/self-assignment
- cs/simplifiable-boolean-expression
- cs/static-field-written-by-instance
- cs/string-concatenation-in-loop
- cs/stringbuilder-creation-in-loop
- cs/stringbuilder-initialized-with-character
- cs/test-for-negative-container-size
- cs/too-many-ref-parameters
- cs/type-test-of-this
- cs/unchecked-cast-in-equals
- cs/unmanaged-code
- cs/unsafe-double-checked-lock
- cs/unsafe-sync-on-field
- cs/unsafe-year-construction
- cs/unsynchronized-getter
- cs/unsynchronized-static-access
- cs/unused-collection
- cs/unused-label
- cs/unused-property-value
- cs/useless-assignment-to-local
- cs/useless-cast-to-self
- cs/useless-gethashcode-call
- cs/useless-if-statement
- cs/useless-tostring-call
- cs/useless-type-test
- cs/useless-upcast
- cs/virtual-call-in-constructor
- cs/wrong-compareto-signature
- cs/wrong-equals-signature
- cs/xmldoc/missing-summary
- include:
kind:
- diagnostic
- include:
kind:
- metric
tags contain:
- summary
- exclude:
deprecated: //
- exclude:
query path:
- /^experimental\/.*/
- Metrics/Summaries/FrameworkCoverage.ql
- exclude:
tags contain:
- modeleditor
- modelgenerator

14
csharp/ql/test/query-tests/Nullness/A.cs
View File

@@ -5,7 +5,7 @@ class A
public void Lock()
{
object synchronizedAlways = null;
lock (synchronizedAlways) // BAD (always)
lock (synchronizedAlways) // $ Alert[cs/dereferenced-value-is-always-null]
{
synchronizedAlways.GetHashCode(); // GOOD
}
@@ -14,7 +14,7 @@ class A
public void ArrayAssignTest()
{
int[] arrayNull = null;
arrayNull[0] = 10; // BAD (always)
arrayNull[0] = 10; // $ Alert[cs/dereferenced-value-is-always-null]
int[] arrayOk;
arrayOk = new int[10];
@@ -28,10 +28,10 @@ class A
object methodAccess = null;
object methodCall = null;
Console.WriteLine(arrayAccess[1]); // BAD (always)
Console.WriteLine(fieldAccess.Length); // BAD (always)
Func<String> tmp = methodAccess.ToString; // BAD (always)
Console.WriteLine(methodCall.ToString()); // BAD (always)
Console.WriteLine(arrayAccess[1]); // $ Alert[cs/dereferenced-value-is-always-null]
Console.WriteLine(fieldAccess.Length); // $ Alert[cs/dereferenced-value-is-always-null]
Func<String> tmp = methodAccess.ToString; // $ Alert[cs/dereferenced-value-is-always-null]
Console.WriteLine(methodCall.ToString()); // $ Alert[cs/dereferenced-value-is-always-null]
Console.WriteLine(arrayAccess[1]); // GOOD
Console.WriteLine(fieldAccess.Length); // GOOD
@@ -47,7 +47,7 @@ class A
object varRef = null;
TestMethod2(ref varRef);
varRef.ToString(); // BAD (always)
varRef.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
varRef = null;
TestMethod3(ref varRef);

10
csharp/ql/test/query-tests/Nullness/Assert.cs
View File

@@ -12,7 +12,7 @@ class AssertTests
s = b ? null : "";
Assert.IsNull(s);
Console.WriteLine(s.Length); // BAD (always)
Console.WriteLine(s.Length); // $ Alert[cs/dereferenced-value-is-always-null]
s = b ? null : "";
Assert.IsNotNull(s);
@@ -20,7 +20,7 @@ class AssertTests
s = b ? null : "";
Assert.IsTrue(s == null);
Console.WriteLine(s.Length); // BAD (always)
Console.WriteLine(s.Length); // $ Alert[cs/dereferenced-value-is-always-null]
s = b ? null : "";
Assert.IsTrue(s != null);
@@ -28,7 +28,7 @@ class AssertTests
s = b ? null : "";
Assert.IsFalse(s != null);
Console.WriteLine(s.Length); // BAD (always)
Console.WriteLine(s.Length); // $ Alert[cs/dereferenced-value-is-always-null]
s = b ? null : "";
Assert.IsFalse(s == null);
@@ -44,10 +44,10 @@ class AssertTests
s = b ? null : "";
Assert.IsTrue(s == null && b);
Console.WriteLine(s.Length); // BAD (always)
Console.WriteLine(s.Length); // $ Alert[cs/dereferenced-value-is-always-null]
s = b ? null : "";
Assert.IsFalse(s != null || !b);
Console.WriteLine(s.Length); // BAD (always)
Console.WriteLine(s.Length); // $ Alert[cs/dereferenced-value-is-always-null]
}
}

4
csharp/ql/test/query-tests/Nullness/B.cs
View File

@@ -10,7 +10,7 @@ class B
B neqCallAlways = null;
if (eqCallAlways == null)
eqCallAlways.ToString(); // BAD (always)
eqCallAlways.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
if (b2 != null)
b2.ToString(); // GOOD
@@ -21,7 +21,7 @@ class B
if (neqCallAlways != null) { }
else
neqCallAlways.ToString(); // BAD (always)
neqCallAlways.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
}
public static bool operator ==(B b1, B b2)

58
csharp/ql/test/query-tests/Nullness/C.cs
View File

@@ -15,7 +15,7 @@ public class C
if (!(o != null))
{
o.GetHashCode(); // BAD (always)
o.GetHashCode(); // $ Alert[cs/dereferenced-value-is-always-null]
}
}
@@ -39,7 +39,7 @@ public class C
{
var s = Maybe() ? null : "";
Debug.Assert(s == null);
s.ToString(); // BAD (always)
s.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
s = Maybe() ? null : "";
Debug.Assert(s != null);
@@ -50,22 +50,22 @@ public class C
{
var o1 = new object();
AssertNull(o1);
o1.ToString(); // BAD (always) (false negative)
o1.ToString(); // $ MISSING: Alert[cs/dereferenced-value-is-always-null]
var o2 = Maybe() ? null : "";
Assert.IsNull(o2);
o2.ToString(); // BAD (always)
o2.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
}
public void AssertNotNullTest()
{
var o1 = Maybe() ? null : new object();
var o1 = Maybe() ? null : new object(); // $ Source[cs/dereferenced-value-may-be-null]
AssertNonNull(o1);
o1.ToString(); // GOOD (false positive)
o1.ToString(); // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
var o2 = Maybe() ? null : new object();
var o2 = Maybe() ? null : new object(); // $ Source[cs/dereferenced-value-may-be-null]
AssertNonNull(o1);
o2.ToString(); // BAD (maybe)
o2.ToString(); // $ Alert[cs/dereferenced-value-may-be-null]
var o3 = Maybe() ? null : new object();
Assert.IsNotNull(o3);
@@ -91,16 +91,16 @@ public class C
public void Lock()
{
var o = Maybe() ? null : new object();
lock (o) // BAD (maybe)
var o = Maybe() ? null : new object(); // $ Source[cs/dereferenced-value-may-be-null]
lock (o) // $ Alert[cs/dereferenced-value-may-be-null]
o.ToString(); // GOOD
}
public void Foreach(IEnumerable<int> list)
{
if (Maybe())
list = null;
foreach (var x in list) // BAD (maybe)
list = null; // $ Source[cs/dereferenced-value-may-be-null]
foreach (var x in list) // $ Alert[cs/dereferenced-value-may-be-null]
{
x.ToString(); // GOOD
list.ToString(); // GOOD
@@ -159,7 +159,7 @@ public class C
s = null;
do
{
s.ToString(); // BAD (always)
s.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
s = null;
}
while (s != null);
@@ -167,15 +167,15 @@ public class C
s = null;
do
{
s.ToString(); // BAD (always)
s.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
}
while (s != null);
s = "";
do
{
s.ToString(); // BAD (maybe)
s = null;
s.ToString(); // $ Alert[cs/dereferenced-value-may-be-null]
s = null; // $ Source[cs/dereferenced-value-may-be-null]
}
while (true);
}
@@ -193,15 +193,15 @@ public class C
s = null;
while (b)
{
s.ToString(); // BAD (always)
s.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
s = null;
}
s = "";
while (true)
{
s.ToString(); // BAD (maybe)
s = null;
s.ToString(); // $ Alert[cs/dereferenced-value-may-be-null]
s = null; // $ Source[cs/dereferenced-value-may-be-null]
}
}
@@ -215,12 +215,12 @@ public class C
}
if (s == null)
s.ToString(); // BAD (always)
s.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
s = "";
if (s != null && s.Length % 2 == 0)
s = null;
s.ToString(); // BAD (maybe)
s = null; // $ Source[cs/dereferenced-value-may-be-null]
s.ToString(); // $ Alert[cs/dereferenced-value-may-be-null]
}
public void For()
@@ -230,23 +230,23 @@ public class C
{
s.ToString(); // GOOD
}
s.ToString(); // BAD (always)
s.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
for (s = null; s == null; s = null)
{
s.ToString(); // BAD (always)
s.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
}
for (s = ""; ; s = null)
for (s = ""; ; s = null) // $ Source[cs/dereferenced-value-may-be-null]
{
s.ToString(); // BAD (maybe)
s.ToString(); // $ Alert[cs/dereferenced-value-may-be-null]
}
}
public void ArrayAssignTest()
{
int[] a = null;
a[0] = 10; // BAD (always)
a[0] = 10; // $ Alert[cs/dereferenced-value-is-always-null]
a = new int[10];
a[0] = 42; // GOOD
@@ -257,8 +257,8 @@ public class C
int[] ia = null;
string[] sa = null;
ia[1] = 0; // BAD (always)
var temp = sa.Length; // BAD (always)
ia[1] = 0; // $ Alert[cs/dereferenced-value-is-always-null]
var temp = sa.Length; // $ Alert[cs/dereferenced-value-is-always-null]
ia[1] = 0; // BAD (always), but not first
temp = sa.Length; // BAD (always), but not first

120
csharp/ql/test/query-tests/Nullness/D.cs
View File

@@ -14,22 +14,22 @@ public class D
public void Caller()
{
Callee1(new object());
Callee1(null);
Callee1(null); // $ Source[cs/dereferenced-value-may-be-null]
Callee2(new object());
}
public void Callee1(object param)
{
param.ToString(); // BAD (maybe)
param.ToString(); // $ Alert[cs/dereferenced-value-may-be-null]
}
public void Callee2(object param)
public void Callee2(object param) // $ Source[cs/dereferenced-value-may-be-null]
{
if (param != null)
{
param.ToString(); // GOOD
}
param.ToString(); // BAD (maybe)
param.ToString(); // $ Alert[cs/dereferenced-value-may-be-null]
}
private static bool CustomIsNull(object x)
@@ -55,54 +55,54 @@ public class D
if ((2 > 1 && o4 != null) != false)
o4.ToString(); // GOOD
var o5 = (o4 != null) ? "" : null;
var o5 = (o4 != null) ? "" : null; // $ Source[cs/dereferenced-value-may-be-null]
if (o5 != null)
o4.ToString(); // GOOD
if (o4 != null)
o5.ToString(); // GOOD (false positive)
o5.ToString(); // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
var o6 = maybe ? null : "";
if (!CustomIsNull(o6))
o6.ToString(); // GOOD
var o7 = maybe ? null : "";
var o7 = maybe ? null : ""; // $ Source[cs/dereferenced-value-may-be-null]
var ok = o7 != null && 2 > 1;
if (ok)
o7.ToString(); // GOOD
else
o7.ToString(); // BAD (maybe)
o7.ToString(); // $ Alert[cs/dereferenced-value-may-be-null]
var o8 = maybe ? null : "";
var o8 = maybe ? null : ""; // $ Source[cs/dereferenced-value-may-be-null]
int track = o8 == null ? 42 : 1 + 1;
if (track == 2)
o8.ToString(); // GOOD
if (track != 42)
o8.ToString(); // GOOD
if (track < 42)
o8.ToString(); // GOOD (false positive)
o8.ToString(); // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
if (track <= 41)
o8.ToString(); // GOOD (false positive)
o8.ToString(); // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
}
public void Deref(int i)
{
int[] xs = maybe ? null : new int[2];
int[] xs = maybe ? null : new int[2]; // $ Source[cs/dereferenced-value-may-be-null]
if (i > 1)
xs[0] = 5; // BAD (maybe)
xs[0] = 5; // $ Alert[cs/dereferenced-value-may-be-null]
if (i > 2)
maybe = xs[1] > 5; // BAD (maybe)
maybe = xs[1] > 5; // $ Alert[cs/dereferenced-value-may-be-null]
if (i > 3)
{
var l = xs.Length; // BAD (maybe)
var l = xs.Length; // $ Alert[cs/dereferenced-value-may-be-null]
}
if (i > 4)
foreach (var _ in xs) ; // BAD (maybe)
foreach (var _ in xs) ; // $ Alert[cs/dereferenced-value-may-be-null]
if (i > 5)
lock (xs) // BAD (maybe)
lock (xs) // $ Alert[cs/dereferenced-value-may-be-null]
xs.ToString(); // Not reported - same basic block
if (i > 6)
@@ -117,12 +117,12 @@ public class D
var x = b ? null : "abc";
x = x == null ? "" : x;
if (x == null)
x.ToString(); // BAD (always)
x.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
else
x.ToString(); // GOOD
}
public void LengthGuard(int[] a, int[] b)
public void LengthGuard(int[] a, int[] b) // $ Source[cs/dereferenced-value-may-be-null]
{
int alen = a == null ? 0 : a.Length; // GOOD
int blen = b == null ? 0 : b.Length; // GOOD
@@ -131,8 +131,8 @@ public class D
{
for (int i = 0; i < alen; i++)
{
sum += a[i]; // GOOD (false positive)
sum += b[i]; // GOOD (false positive)
sum += a[i]; // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
sum += b[i]; // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
}
}
int alen2;
@@ -142,13 +142,13 @@ public class D
alen2 = 0;
for (int i = 1; i <= alen2; ++i)
{
sum += a[i - 1]; // GOOD (false positive)
sum += a[i - 1]; // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
}
}
public void MissedGuard(object obj)
public void MissedGuard(object obj) // $ Source[cs/dereferenced-value-may-be-null]
{
obj.ToString(); // BAD (maybe)
obj.ToString(); // $ Alert[cs/dereferenced-value-may-be-null]
var x = obj != null ? 1 : 0;
}
@@ -160,7 +160,7 @@ public class D
public void Exceptions()
{
object obj = null;
object obj = null; // $ Source[cs/dereferenced-value-may-be-null]
try
{
obj = MkMaybe();
@@ -168,7 +168,7 @@ public class D
catch (Exception e)
{
}
obj.ToString(); // BAD (maybe)
obj.ToString(); // $ Alert[cs/dereferenced-value-may-be-null]
object obj2 = null;
try
@@ -194,7 +194,7 @@ public class D
{
var o = new Object();
if (o == null)
o.ToString(); // BAD (always)
o.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
o.ToString(); // GOOD
try
@@ -204,7 +204,7 @@ public class D
catch (Exception e)
{
if (e == null)
e.ToString(); // BAD (always)
e.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
e.ToString(); // GOOD
}
@@ -214,12 +214,12 @@ public class D
var o3 = "abc";
if (o3 == null)
o3.ToString(); // BAD (always)
o3.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
o3.ToString(); // GOOD
var o4 = "" + null;
if (o4 == null)
o4.ToString(); // BAD (always)
o4.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
o4.ToString(); // GOOD
}
@@ -237,25 +237,25 @@ public class D
if (flag)
o.ToString(); // GOOD
o = null;
o = null; // $ Source[cs/dereferenced-value-may-be-null]
var other = maybe ? null : "";
if (other == null)
o = "";
if (other != null)
o.ToString(); // BAD (always) (reported as maybe)
o.ToString(); // $ Alert[cs/dereferenced-value-may-be-null] (always - but reported as maybe)
else
o.ToString(); // GOOD (false positive)
o.ToString(); // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
var o2 = (num < 0) ? null : "";
var o2 = (num < 0) ? null : ""; // $ Source[cs/dereferenced-value-may-be-null]
if (num < 0)
o2 = "";
else
o2.ToString(); // GOOD (false positive)
o2.ToString(); // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
}
public void TrackingVariable(int[] a)
{
object o = null;
object o = null; // $ Source[cs/dereferenced-value-may-be-null]
object other = null;
if (maybe)
{
@@ -264,9 +264,9 @@ public class D
}
if (other is string)
o.ToString(); // GOOD (false positive)
o.ToString(); // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
o = null;
o = null; // $ Source[cs/dereferenced-value-may-be-null]
int count = 0;
var found = false;
for (var i = 0; i < a.Length; i++)
@@ -280,7 +280,7 @@ public class D
}
if (a[i] > 10000)
{
o = null;
o = null; // $ Source[cs/dereferenced-value-may-be-null]
count = 0;
if (2 > i) { }
found = false;
@@ -288,20 +288,20 @@ public class D
}
if (count > 3)
o.ToString(); // GOOD (false positive)
o.ToString(); // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
if (found)
o.ToString(); // GOOD (false positive)
o.ToString(); // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
object prev = null;
object prev = null; // $ Source[cs/dereferenced-value-may-be-null]
for (var i = 0; i < a.Length; ++i)
{
if (i != 0)
prev.ToString(); // GOOD (false positive)
prev.ToString(); // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
prev = a[i];
}
string s = null;
string s = null; // $ Source[cs/dereferenced-value-may-be-null]
{
var s_null = true;
foreach (var i in a)
@@ -310,10 +310,10 @@ public class D
s = "" + a;
}
if (!s_null)
s.ToString(); // GOOD (false positive)
s.ToString(); // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
}
object r = null;
object r = null; // $ Source[cs/dereferenced-value-may-be-null]
var stat = MyStatus.INIT;
while (stat == MyStatus.INIT && stat != MyStatus.READY)
{
@@ -321,7 +321,7 @@ public class D
if (stat == MyStatus.INIT)
stat = MyStatus.READY;
}
r.ToString(); // GOOD (false positive)
r.ToString(); // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
}
public enum MyStatus
@@ -348,28 +348,28 @@ public class D
public void LoopCorr(int iters)
{
int[] a = null;
int[] a = null; // $ Source[cs/dereferenced-value-may-be-null]
if (iters > 0)
a = new int[iters];
for (var i = 0; i < iters; ++i)
a[i] = 0; // GOOD (false positive)
a[i] = 0; // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
if (iters > 0)
{
string last = null;
string last = null; // $ Source[cs/dereferenced-value-may-be-null]
for (var i = 0; i < iters; i++)
last = "abc";
last.ToString(); // GOOD (false positive)
last.ToString(); // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
}
int[] b = maybe ? null : new int[iters];
int[] b = maybe ? null : new int[iters]; // $ Source[cs/dereferenced-value-may-be-null]
if (iters > 0 && (b == null || b.Length < iters))
throw new Exception();
for (var i = 0; i < iters; ++i)
{
b[i] = 0; // GOOD (false positive)
b[i] = 0; // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
}
}
@@ -382,33 +382,33 @@ public class D
if (ioe != null)
ioe = e;
else
ioe.ToString(); // BAD (always)
ioe.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
}
public void LengthGuard2(int[] a, int[] b)
public void LengthGuard2(int[] a, int[] b) // $ Source[cs/dereferenced-value-may-be-null]
{
int alen = a == null ? 0 : a.Length; // GOOD
int sum = 0;
int i;
for (i = 0; i < alen; i++)
{
sum += a[i]; // GOOD (false positive)
sum += a[i]; // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
}
int blen = b == null ? 0 : b.Length; // GOOD
for (i = 0; i < blen; i++)
{
sum += b[i]; // GOOD (false positive)
sum += b[i]; // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
}
i = -3;
}
public void CorrConds2(object x, object y)
public void CorrConds2(object x, object y) // $ Source[cs/dereferenced-value-may-be-null]
{
if ((x != null && y == null) || (x == null && y != null))
return;
if (x != null)
y.ToString(); // GOOD (false positive)
y.ToString(); // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
if (y != null)
x.ToString(); // GOOD (false positive)
x.ToString(); // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
}
}

118
csharp/ql/test/query-tests/Nullness/E.cs
View File

@@ -6,12 +6,12 @@ public class E
{
public void Ex1(long[][][] a1, int ix, int len)
{
long[][] a2 = null;
long[][] a2 = null; // $ Source[cs/dereferenced-value-may-be-null]
var haveA2 = ix < len && (a2 = a1[ix]) != null;
long[] a3 = null;
var haveA3 = haveA2 && (a3 = a2[ix]) != null; // GOOD (FALSE POSITIVE)
long[] a3 = null; // $ Source[cs/dereferenced-value-may-be-null]
var haveA3 = haveA2 && (a3 = a2[ix]) != null; // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
if (haveA3)
a3[0] = 0; // GOOD (FALSE POSITIVE)
a3[0] = 0; // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
}
public void Ex2(bool x, bool y)
@@ -20,11 +20,11 @@ public class E
var s2 = (s1 == null) ? null : "";
if (s2 == null)
{
s1 = y ? null : "";
s1 = y ? null : ""; // $ Source[cs/dereferenced-value-may-be-null]
s2 = (s1 == null) ? null : "";
}
if (s2 != null)
s1.ToString(); // GOOD (FALSE POSITIVE)
s1.ToString(); // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
}
public void Ex3(IEnumerable<string> ss)
@@ -48,7 +48,7 @@ public class E
{
int index = 0;
var result = new List<List<string>>();
List<string> slice = null;
List<string> slice = null; // $ Source[cs/dereferenced-value-may-be-null]
var iter = list.GetEnumerator();
while (iter.MoveNext())
{
@@ -58,19 +58,19 @@ public class E
slice = new List<string>();
result.Add(slice);
}
slice.Add(str); // GOOD (FALSE POSITIVE)
slice.Add(str); // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
++index;
}
}
public void Ex5(bool hasArr, int[] arr)
public void Ex5(bool hasArr, int[] arr) // $ Source[cs/dereferenced-value-may-be-null]
{
int arrLen = 0;
if (hasArr)
arrLen = arr == null ? 0 : arr.Length;
if (arrLen > 0)
arr[0] = 0; // GOOD (FALSE POSITIVE)
arr[0] = 0; // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
}
public const int MY_CONST_A = 1;
@@ -104,12 +104,12 @@ public class E
public void Ex7(int[] arr1)
{
int[] arr2 = null;
int[] arr2 = null; // $ Source[cs/dereferenced-value-may-be-null]
if (arr1.Length > 0)
arr2 = new int[arr1.Length];
for (var i = 0; i < arr1.Length; i++)
arr2[i] = arr1[i]; // GOOD (FALSE POSITIVE)
arr2[i] = arr1[i]; // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
}
public void Ex8(int x, int lim)
@@ -122,7 +122,7 @@ public class E
int j = 0;
while (!stop && j < lim)
{
int step = (j * obj.GetHashCode()) % 10; // GOOD (FALSE POSITIVE)
int step = (j * obj.GetHashCode()) % 10; // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
if (step == 0)
{
obj.ToString(); // GOOD
@@ -134,7 +134,7 @@ public class E
}
else
{
obj = null;
obj = null; // $ Source[cs/dereferenced-value-may-be-null]
}
continue;
}
@@ -149,33 +149,33 @@ public class E
{
return;
}
object obj2 = obj1;
object obj2 = obj1; // $ Source[cs/dereferenced-value-may-be-null]
if (obj2 != null && obj2.GetHashCode() % 5 > 2)
{
obj2.ToString(); // GOOD
cond = true;
}
if (cond)
obj2.ToString(); // GOOD (FALSE POSITIVE)
obj2.ToString(); // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
}
public void Ex10(int[] a)
public void Ex10(int[] a) // $ Source[cs/dereferenced-value-may-be-null]
{
int n = a == null ? 0 : a.Length;
for (var i = 0; i < n; i++)
{
int x = a[i]; // GOOD (FALSE POSITIVE)
int x = a[i]; // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
if (x > 7)
a = new int[n];
}
}
public void Ex11(object obj, bool b1)
public void Ex11(object obj, bool b1) // $ Source[cs/dereferenced-value-may-be-null]
{
bool b2 = obj == null ? false : b1;
if (b2 == null)
{
obj.ToString(); // GOOD (FALSE POSITIVE)
obj.ToString(); // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
}
if (obj == null)
{
@@ -183,61 +183,61 @@ public class E
}
if (b1 == null)
{
obj.ToString(); // GOOD (FALSE POSITIVE)
obj.ToString(); // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
}
}
public void Ex12(object o)
public void Ex12(object o) // $ Source[cs/dereferenced-value-may-be-null]
{
var i = o.GetHashCode(); // BAD (maybe)
var i = o.GetHashCode(); // $ Alert[cs/dereferenced-value-may-be-null]
var s = o?.ToString();
}
public void Ex13(bool b)
{
var o = b ? null : "";
var o = b ? null : ""; // $ Source[cs/dereferenced-value-may-be-null]
o.M1(); // GOOD
if (b)
o.M2(); // BAD (maybe)
o.M2(); // $ Alert[cs/dereferenced-value-may-be-null]
else
o.Select(x => x); // BAD (maybe)
o.Select(x => x); // $ Alert[cs/dereferenced-value-may-be-null]
}
public int Ex14(string s)
{
if (s is string)
return s.Length;
return s.GetHashCode(); // BAD (always)
return s.GetHashCode(); // $ Alert[cs/dereferenced-value-is-always-null]
}
public void Ex15(bool b)
{
var x = "";
if (b)
x = null;
x.ToString(); // BAD (maybe)
x = null; // $ Source[cs/dereferenced-value-may-be-null]
x.ToString(); // $ Alert[cs/dereferenced-value-may-be-null]
if (b)
x.ToString(); // BAD (always)
x.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
}
public void Ex16(bool b)
{
var x = "";
if (b)
x = null;
x = null; // $ Source[cs/dereferenced-value-may-be-null]
if (b)
x.ToString(); // BAD (always)
x.ToString(); // BAD (maybe)
x.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
x.ToString(); // $ Alert[cs/dereferenced-value-may-be-null]
}
public int Ex17(int? i)
public int Ex17(int? i) // $ Source[cs/dereferenced-value-may-be-null]
{
return i.Value; // BAD (maybe)
return i.Value; // $ Alert[cs/dereferenced-value-may-be-null]
}
public int Ex18(int? i)
public int Ex18(int? i) // $ Source[cs/dereferenced-value-may-be-null]
{
return (int)i; // BAD (maybe)
return (int)i; // $ Alert[cs/dereferenced-value-may-be-null]
}
public int Ex19(int? i)
@@ -280,9 +280,9 @@ public class E
{
if (b)
b.ToString();
var o = Make();
var o = Make(); // $ Source[cs/dereferenced-value-may-be-null]
o?.ToString();
o.ToString(); // BAD (maybe)
o.ToString(); // $ Alert[cs/dereferenced-value-may-be-null]
if (b)
b.ToString();
}
@@ -298,8 +298,8 @@ public class E
public void Ex25(object o)
{
var s = o as string;
s.ToString(); // BAD (maybe)
var s = o as string; // $ Source[cs/dereferenced-value-may-be-null]
s.ToString(); // $ Alert[cs/dereferenced-value-may-be-null]
}
private long? l;
@@ -320,15 +320,15 @@ public class E
{
if ((s1 ?? s2) is null)
{
s1.ToString(); // BAD (always)
s2.ToString(); // BAD (always)
s1.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
s2.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
}
}
static void Ex28()
{
var x = (string)null ?? null;
x.ToString(); // BAD (always)
x.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
}
static void Ex29(string s)
@@ -339,14 +339,14 @@ public class E
static void Ex30(string s, object o)
{
var x = s ?? o as string;
x.ToString(); // BAD (maybe)
var x = s ?? o as string; // $ Source[cs/dereferenced-value-may-be-null]
x.ToString(); // $ Alert[cs/dereferenced-value-may-be-null]
}
static void Ex31(string s, object o)
{
dynamic x = s ?? o as string;
x.ToString(); // BAD (maybe)
dynamic x = s ?? o as string; // $ Source[cs/dereferenced-value-may-be-null]
x.ToString(); // $ Alert[cs/dereferenced-value-may-be-null]
}
static void Ex32(string s, object o)
@@ -363,7 +363,7 @@ public class E
x.ToString(); // GOOD
}
static int Ex34(string s = null) => s.Length; // BAD (maybe)
static int Ex34(string s = null) => s.Length; // $ Alert[cs/dereferenced-value-may-be-null]
static int Ex35(string s = "null") => s.Length; // GOOD
@@ -371,19 +371,19 @@ public class E
{
if (o is string)
{
var s = o as string;
return s.Length; // GOOD (FALSE POSITIVE)
var s = o as string; // $ Source[cs/dereferenced-value-may-be-null]
return s.Length; // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
}
return -1;
}
static bool Ex37(E e1, E e2)
static bool Ex37(E e1, E e2) // $ Source[cs/dereferenced-value-may-be-null]
{
if ((e1 == null && e2 != null) || (e1 != null && e2 == null))
return false;
if (e1 == null && e2 == null)
return true;
return e1.Long == e2.Long; // GOOD (FALSE POSITIVE)
return e1.Long == e2.Long; // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
}
int Ex38(int? i)
@@ -402,7 +402,7 @@ public class E
{
int? i = null;
i ??= null;
return i.Value; // BAD (always)
return i.Value; // $ Alert[cs/dereferenced-value-is-always-null]
}
int Ex41()
@@ -414,20 +414,20 @@ public class E
static bool Ex42(int? i, IEnumerable<int> @is)
{
return @is.Any(j => j == i.Value); // BAD (maybe)
return @is.Any(j => j == i.Value); // $ Alert[cs/dereferenced-value-may-be-null]
}
static bool Ex43(int? i, IEnumerable<int> @is)
{
if (i.HasValue)
return @is.Any(j => j == i.Value); // GOOD (FALSE POSITIVE)
return @is.Any(j => j == i.Value); // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
return false;
}
static bool Ex44(int? i, IEnumerable<int> @is)
{
if (i.HasValue)
@is = @is.Where(j => j == i.Value); // BAD (always)
@is = @is.Where(j => j == i.Value); // $ Alert[cs/dereferenced-value-may-be-null]
i = null;
return @is.Any();
}
@@ -436,12 +436,12 @@ public class E
{
if (s is null)
{
s.ToString(); // BAD (always)
s.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
}
if (s is not not null)
{
s.ToString(); // BAD (always) (FALSE NEGATIVE)
s.ToString(); // $ MISSING: Alert[cs/dereferenced-value-is-always-null]
}
if (s is not null)

16
csharp/ql/test/query-tests/Nullness/F.cs Normal file
View File

@@ -0,0 +1,16 @@
using Library;
public class F
{
public void M1()
{
object o = null;
o.Accept(); // $ Alert[cs/dereferenced-value-is-always-null]
}
public void M2()
{
object? o = null;
o.AcceptNullable();
}
}

4
csharp/ql/test/query-tests/Nullness/Forwarding.cs
View File

@@ -33,11 +33,11 @@ class ForwardingTests
if (IsNotNullWrong(s))
{
Console.WriteLine(s.Length); // BAD (always)
Console.WriteLine(s.Length); // $ Alert[cs/dereferenced-value-is-always-null]
}
AssertIsNotNull(s);
Console.WriteLine(s.Length); // GOOD (false positive)
Console.WriteLine(s.Length); // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-is-always-null]
}
bool IsNotNull(object o)

4
csharp/ql/test/query-tests/Nullness/GuardedString.cs
View File

@@ -4,7 +4,7 @@ class GuardedStringTest
{
void Fn(bool b)
{
string s = b ? null : "";
string s = b ? null : ""; // $ Source[cs/dereferenced-value-may-be-null]
if (!string.IsNullOrEmpty(s))
{
@@ -32,7 +32,7 @@ class GuardedStringTest
Console.WriteLine(s.Length); // GOOD
if (s?.Length != 0)
Console.WriteLine(s.Length); // BAD (maybe)
Console.WriteLine(s.Length); // $ Alert[cs/dereferenced-value-may-be-null]
else
Console.WriteLine(s.Length); // GOOD
}

4
csharp/ql/test/query-tests/Nullness/Implications.expected
View File

@@ -1305,6 +1305,10 @@
| E.cs:442:13:442:29 | ... is ... | true | E.cs:442:13:442:13 | access to parameter s | non-null |
| E.cs:447:13:447:25 | ... is ... | true | E.cs:447:13:447:13 | access to parameter s | non-null |
| E.cs:452:13:452:23 | ... is ... | true | E.cs:452:13:452:13 | access to parameter s | non-null |
| F.cs:8:9:8:9 | access to local variable o | non-null | F.cs:7:20:7:23 | null | non-null |
| F.cs:8:9:8:9 | access to local variable o | null | F.cs:7:20:7:23 | null | null |
| F.cs:14:9:14:9 | access to local variable o | non-null | F.cs:13:21:13:24 | null | non-null |
| F.cs:14:9:14:9 | access to local variable o | null | F.cs:13:21:13:24 | null | null |
| Forwarding.cs:9:13:9:30 | !... | false | Forwarding.cs:9:14:9:30 | call to method IsNullOrEmpty | true |
| Forwarding.cs:9:13:9:30 | !... | true | Forwarding.cs:9:14:9:30 | call to method IsNullOrEmpty | false |
| Forwarding.cs:9:14:9:14 | access to local variable s | empty | Forwarding.cs:7:20:7:23 | null | empty |

1
csharp/ql/test/query-tests/Nullness/NullAlways.expected
View File

@@ -38,6 +38,7 @@
| E.cs:331:9:331:9 | access to local variable x | Variable $@ is always null at this dereference. | E.cs:330:13:330:13 | x | x |
| E.cs:405:16:405:16 | access to local variable i | Variable $@ is always null at this dereference. | E.cs:403:14:403:14 | i | i |
| E.cs:439:13:439:13 | access to parameter s | Variable $@ is always null at this dereference. | E.cs:435:29:435:29 | s | s |
| F.cs:8:9:8:9 | access to local variable o | Variable $@ is always null at this dereference. | F.cs:7:16:7:16 | o | o |
| Forwarding.cs:36:31:36:31 | access to local variable s | Variable $@ is always null at this dereference. | Forwarding.cs:7:16:7:16 | s | s |
| Forwarding.cs:40:27:40:27 | access to local variable s | Variable $@ is always null at this dereference. | Forwarding.cs:7:16:7:16 | s | s |
| NullAlwaysBad.cs:9:30:9:30 | access to parameter s | Variable $@ is always null at this dereference. | NullAlwaysBad.cs:7:29:7:29 | s | s |

3
csharp/ql/test/query-tests/Nullness/NullAlways.qlref
View File

@@ -1 +1,2 @@
CSI/NullAlways.ql
query: CSI/NullAlways.ql
postprocess: utils/test/InlineExpectationsTestQuery.ql

2
csharp/ql/test/query-tests/Nullness/NullAlwaysBad.cs
View File

@@ -6,7 +6,7 @@ namespace NullAlways
{
void DoPrint(string s)
{
if (s != null || s.Length > 0)
if (s != null || s.Length > 0) // $ Alert[cs/dereferenced-value-is-always-null]
Console.WriteLine(s);
}
}

961
csharp/ql/test/query-tests/Nullness/NullMaybe.expected
View File

@@ -1,3 +1,483 @@
#select
| C.cs:64:9:64:10 | access to local variable o1 | C.cs:62:13:62:46 | SSA def(o1) | C.cs:64:9:64:10 | access to local variable o1 | Variable $@ may be null at this access because of $@ assignment. | C.cs:62:13:62:14 | o1 | o1 | C.cs:62:13:62:46 | Object o1 = ... | this |
| C.cs:68:9:68:10 | access to local variable o2 | C.cs:66:13:66:46 | SSA def(o2) | C.cs:68:9:68:10 | access to local variable o2 | Variable $@ may be null at this access because of $@ assignment. | C.cs:66:13:66:14 | o2 | o2 | C.cs:66:13:66:46 | Object o2 = ... | this |
| C.cs:95:15:95:15 | access to local variable o | C.cs:94:13:94:45 | SSA def(o) | C.cs:95:15:95:15 | access to local variable o | Variable $@ may be null at this access because of $@ assignment. | C.cs:94:13:94:13 | o | o | C.cs:94:13:94:45 | Object o = ... | this |
| C.cs:103:27:103:30 | access to parameter list | C.cs:102:13:102:23 | SSA def(list) | C.cs:103:27:103:30 | access to parameter list | Variable $@ may be null at this access because of $@ assignment. | C.cs:99:42:99:45 | list | list | C.cs:102:13:102:23 | ... = ... | this |
| C.cs:177:13:177:13 | access to local variable s | C.cs:178:13:178:20 | SSA def(s) | C.cs:177:13:177:13 | access to local variable s | Variable $@ may be null at this access because of $@ assignment. | C.cs:151:13:151:13 | s | s | C.cs:178:13:178:20 | ... = ... | this |
| C.cs:203:13:203:13 | access to local variable s | C.cs:204:13:204:20 | SSA def(s) | C.cs:203:13:203:13 | access to local variable s | Variable $@ may be null at this access because of $@ assignment. | C.cs:185:13:185:13 | s | s | C.cs:204:13:204:20 | ... = ... | this |
| C.cs:223:9:223:9 | access to local variable s | C.cs:222:13:222:20 | SSA def(s) | C.cs:223:9:223:9 | access to local variable s | Variable $@ may be null at this access because of $@ assignment. | C.cs:210:13:210:13 | s | s | C.cs:222:13:222:20 | ... = ... | this |
| C.cs:242:13:242:13 | access to local variable s | C.cs:240:24:240:31 | SSA def(s) | C.cs:242:13:242:13 | access to local variable s | Variable $@ may be null at this access because of $@ assignment. | C.cs:228:16:228:16 | s | s | C.cs:240:24:240:31 | ... = ... | this |
| D.cs:23:9:23:13 | access to parameter param | D.cs:17:17:17:20 | null | D.cs:23:9:23:13 | access to parameter param | Variable $@ may be null at this access because of $@ null argument. | D.cs:21:32:21:36 | param | param | D.cs:17:17:17:20 | null | this |
| D.cs:32:9:32:13 | access to parameter param | D.cs:26:32:26:36 | SSA param(param) | D.cs:32:9:32:13 | access to parameter param | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:26:32:26:36 | param | param | D.cs:28:13:28:25 | ... != ... | this |
| D.cs:62:13:62:14 | access to local variable o5 | D.cs:58:13:58:41 | SSA def(o5) | D.cs:62:13:62:14 | access to local variable o5 | Variable $@ may be null at this access because of $@ assignment. | D.cs:58:13:58:14 | o5 | o5 | D.cs:58:13:58:41 | String o5 = ... | this |
| D.cs:73:13:73:14 | access to local variable o7 | D.cs:68:13:68:34 | SSA def(o7) | D.cs:73:13:73:14 | access to local variable o7 | Variable $@ may be null at this access because of $@ assignment. | D.cs:68:13:68:14 | o7 | o7 | D.cs:68:13:68:34 | String o7 = ... | this |
| D.cs:82:13:82:14 | access to local variable o8 | D.cs:75:13:75:34 | SSA def(o8) | D.cs:82:13:82:14 | access to local variable o8 | Variable $@ may be null at this access because of $@ assignment. | D.cs:75:13:75:14 | o8 | o8 | D.cs:75:13:75:34 | String o8 = ... | this |
| D.cs:84:13:84:14 | access to local variable o8 | D.cs:75:13:75:34 | SSA def(o8) | D.cs:84:13:84:14 | access to local variable o8 | Variable $@ may be null at this access because of $@ assignment. | D.cs:75:13:75:14 | o8 | o8 | D.cs:75:13:75:34 | String o8 = ... | this |
| D.cs:91:13:91:14 | access to local variable xs | D.cs:89:15:89:44 | SSA def(xs) | D.cs:91:13:91:14 | access to local variable xs | Variable $@ may be null at this access because of $@ assignment. | D.cs:89:15:89:16 | xs | xs | D.cs:89:15:89:44 | Int32[] xs = ... | this |
| D.cs:94:21:94:22 | access to local variable xs | D.cs:89:15:89:44 | SSA def(xs) | D.cs:94:21:94:22 | access to local variable xs | Variable $@ may be null at this access because of $@ assignment. | D.cs:89:15:89:16 | xs | xs | D.cs:89:15:89:44 | Int32[] xs = ... | this |
| D.cs:98:21:98:22 | access to local variable xs | D.cs:89:15:89:44 | SSA def(xs) | D.cs:98:21:98:22 | access to local variable xs | Variable $@ may be null at this access because of $@ assignment. | D.cs:89:15:89:16 | xs | xs | D.cs:89:15:89:44 | Int32[] xs = ... | this |
| D.cs:102:31:102:32 | access to local variable xs | D.cs:89:15:89:44 | SSA def(xs) | D.cs:102:31:102:32 | access to local variable xs | Variable $@ may be null at this access because of $@ assignment. | D.cs:89:15:89:16 | xs | xs | D.cs:89:15:89:44 | Int32[] xs = ... | this |
| D.cs:105:19:105:20 | access to local variable xs | D.cs:89:15:89:44 | SSA def(xs) | D.cs:105:19:105:20 | access to local variable xs | Variable $@ may be null at this access because of $@ assignment. | D.cs:89:15:89:16 | xs | xs | D.cs:89:15:89:44 | Int32[] xs = ... | this |
| D.cs:134:24:134:24 | access to parameter a | D.cs:125:35:125:35 | SSA param(a) | D.cs:134:24:134:24 | access to parameter a | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:125:35:125:35 | a | a | D.cs:127:20:127:28 | ... == ... | this |
| D.cs:134:24:134:24 | access to parameter a | D.cs:125:35:125:35 | SSA param(a) | D.cs:134:24:134:24 | access to parameter a | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:125:35:125:35 | a | a | D.cs:139:13:139:21 | ... != ... | this |
| D.cs:135:24:135:24 | access to parameter b | D.cs:125:44:125:44 | SSA param(b) | D.cs:135:24:135:24 | access to parameter b | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:125:44:125:44 | b | b | D.cs:128:20:128:28 | ... == ... | this |
| D.cs:145:20:145:20 | access to parameter a | D.cs:125:35:125:35 | SSA param(a) | D.cs:145:20:145:20 | access to parameter a | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:125:35:125:35 | a | a | D.cs:127:20:127:28 | ... == ... | this |
| D.cs:145:20:145:20 | access to parameter a | D.cs:125:35:125:35 | SSA param(a) | D.cs:145:20:145:20 | access to parameter a | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:125:35:125:35 | a | a | D.cs:139:13:139:21 | ... != ... | this |
| D.cs:151:9:151:11 | access to parameter obj | D.cs:149:36:149:38 | SSA param(obj) | D.cs:151:9:151:11 | access to parameter obj | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:149:36:149:38 | obj | obj | D.cs:152:17:152:27 | ... != ... | this |
| D.cs:171:9:171:11 | access to local variable obj | D.cs:163:16:163:25 | SSA def(obj) | D.cs:171:9:171:11 | access to local variable obj | Variable $@ may be null at this access because of $@ assignment. | D.cs:163:16:163:18 | obj | obj | D.cs:163:16:163:25 | Object obj = ... | this |
| D.cs:245:13:245:13 | access to local variable o | D.cs:240:9:240:16 | SSA def(o) | D.cs:245:13:245:13 | access to local variable o | Variable $@ may be null at this access because of $@ assignment. | D.cs:228:16:228:16 | o | o | D.cs:240:9:240:16 | ... = ... | this |
| D.cs:247:13:247:13 | access to local variable o | D.cs:240:9:240:16 | SSA def(o) | D.cs:247:13:247:13 | access to local variable o | Variable $@ may be null at this access because of $@ assignment. | D.cs:228:16:228:16 | o | o | D.cs:240:9:240:16 | ... = ... | this |
| D.cs:253:13:253:14 | access to local variable o2 | D.cs:249:13:249:38 | SSA def(o2) | D.cs:253:13:253:14 | access to local variable o2 | Variable $@ may be null at this access because of $@ assignment. | D.cs:249:13:249:14 | o2 | o2 | D.cs:249:13:249:38 | String o2 = ... | this |
| D.cs:267:13:267:13 | access to local variable o | D.cs:258:16:258:23 | SSA def(o) | D.cs:267:13:267:13 | access to local variable o | Variable $@ may be null at this access because of $@ assignment. | D.cs:258:16:258:16 | o | o | D.cs:258:16:258:23 | Object o = ... | this |
| D.cs:291:13:291:13 | access to local variable o | D.cs:269:9:269:16 | SSA def(o) | D.cs:291:13:291:13 | access to local variable o | Variable $@ may be null at this access because of $@ assignment. | D.cs:258:16:258:16 | o | o | D.cs:269:9:269:16 | ... = ... | this |
| D.cs:291:13:291:13 | access to local variable o | D.cs:283:17:283:24 | SSA def(o) | D.cs:291:13:291:13 | access to local variable o | Variable $@ may be null at this access because of $@ assignment. | D.cs:258:16:258:16 | o | o | D.cs:283:17:283:24 | ... = ... | this |
| D.cs:294:13:294:13 | access to local variable o | D.cs:269:9:269:16 | SSA def(o) | D.cs:294:13:294:13 | access to local variable o | Variable $@ may be null at this access because of $@ assignment. | D.cs:258:16:258:16 | o | o | D.cs:269:9:269:16 | ... = ... | this |
| D.cs:294:13:294:13 | access to local variable o | D.cs:283:17:283:24 | SSA def(o) | D.cs:294:13:294:13 | access to local variable o | Variable $@ may be null at this access because of $@ assignment. | D.cs:258:16:258:16 | o | o | D.cs:283:17:283:24 | ... = ... | this |
| D.cs:300:17:300:20 | access to local variable prev | D.cs:296:16:296:26 | SSA def(prev) | D.cs:300:17:300:20 | access to local variable prev | Variable $@ may be null at this access because of $@ assignment. | D.cs:296:16:296:19 | prev | prev | D.cs:296:16:296:26 | Object prev = ... | this |
| D.cs:313:17:313:17 | access to local variable s | D.cs:304:16:304:23 | SSA def(s) | D.cs:313:17:313:17 | access to local variable s | Variable $@ may be null at this access because of $@ assignment. | D.cs:304:16:304:16 | s | s | D.cs:304:16:304:23 | String s = ... | this |
| D.cs:324:9:324:9 | access to local variable r | D.cs:316:16:316:23 | SSA def(r) | D.cs:324:9:324:9 | access to local variable r | Variable $@ may be null at this access because of $@ assignment. | D.cs:316:16:316:16 | r | r | D.cs:316:16:316:23 | Object r = ... | this |
| D.cs:356:13:356:13 | access to local variable a | D.cs:351:15:351:22 | SSA def(a) | D.cs:356:13:356:13 | access to local variable a | Variable $@ may be null at this access because of $@ assignment. | D.cs:351:15:351:15 | a | a | D.cs:351:15:351:22 | Int32[] a = ... | this |
| D.cs:363:13:363:16 | access to local variable last | D.cs:360:20:360:30 | SSA def(last) | D.cs:363:13:363:16 | access to local variable last | Variable $@ may be null at this access because of $@ assignment. | D.cs:360:20:360:23 | last | last | D.cs:360:20:360:30 | String last = ... | this |
| D.cs:372:13:372:13 | access to local variable b | D.cs:366:15:366:47 | SSA def(b) | D.cs:372:13:372:13 | access to local variable b | Variable $@ may be null at this access because of $@ assignment. | D.cs:366:15:366:15 | b | b | D.cs:366:15:366:47 | Int32[] b = ... | this |
| D.cs:395:20:395:20 | access to parameter a | D.cs:388:36:388:36 | SSA param(a) | D.cs:395:20:395:20 | access to parameter a | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:388:36:388:36 | a | a | D.cs:390:20:390:28 | ... == ... | this |
| D.cs:400:20:400:20 | access to parameter b | D.cs:388:45:388:45 | SSA param(b) | D.cs:400:20:400:20 | access to parameter b | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:388:45:388:45 | b | b | D.cs:397:20:397:28 | ... == ... | this |
| D.cs:410:13:410:13 | access to parameter y | D.cs:405:45:405:45 | SSA param(y) | D.cs:410:13:410:13 | access to parameter y | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:405:45:405:45 | y | y | D.cs:407:27:407:35 | ... == ... | this |
| D.cs:410:13:410:13 | access to parameter y | D.cs:405:45:405:45 | SSA param(y) | D.cs:410:13:410:13 | access to parameter y | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:405:45:405:45 | y | y | D.cs:407:55:407:63 | ... != ... | this |
| D.cs:410:13:410:13 | access to parameter y | D.cs:405:45:405:45 | SSA param(y) | D.cs:410:13:410:13 | access to parameter y | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:405:45:405:45 | y | y | D.cs:411:13:411:21 | ... != ... | this |
| D.cs:412:13:412:13 | access to parameter x | D.cs:405:35:405:35 | SSA param(x) | D.cs:412:13:412:13 | access to parameter x | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:405:35:405:35 | x | x | D.cs:407:14:407:22 | ... != ... | this |
| D.cs:412:13:412:13 | access to parameter x | D.cs:405:35:405:35 | SSA param(x) | D.cs:412:13:412:13 | access to parameter x | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:405:35:405:35 | x | x | D.cs:407:42:407:50 | ... == ... | this |
| D.cs:412:13:412:13 | access to parameter x | D.cs:405:35:405:35 | SSA param(x) | D.cs:412:13:412:13 | access to parameter x | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:405:35:405:35 | x | x | D.cs:409:13:409:21 | ... != ... | this |
| E.cs:12:38:12:39 | access to local variable a2 | E.cs:9:18:9:26 | SSA def(a2) | E.cs:12:38:12:39 | access to local variable a2 | Variable $@ may be null at this access because of $@ assignment. | E.cs:9:18:9:19 | a2 | a2 | E.cs:9:18:9:26 | Int64[][] a2 = ... | this |
| E.cs:14:13:14:14 | access to local variable a3 | E.cs:11:16:11:24 | SSA def(a3) | E.cs:14:13:14:14 | access to local variable a3 | Variable $@ may be null at this access because of $@ assignment. | E.cs:11:16:11:17 | a3 | a3 | E.cs:11:16:11:24 | Int64[] a3 = ... | this |
| E.cs:27:13:27:14 | access to local variable s1 | E.cs:23:13:23:30 | SSA def(s1) | E.cs:27:13:27:14 | access to local variable s1 | Variable $@ may be null at this access because of $@ assignment. | E.cs:19:13:19:14 | s1 | s1 | E.cs:23:13:23:30 | ... = ... | this |
| E.cs:61:13:61:17 | access to local variable slice | E.cs:51:22:51:33 | SSA def(slice) | E.cs:61:13:61:17 | access to local variable slice | Variable $@ may be null at this access because of $@ assignment. | E.cs:51:22:51:26 | slice | slice | E.cs:51:22:51:33 | List<String> slice = ... | this |
| E.cs:73:13:73:15 | access to parameter arr | E.cs:66:40:66:42 | SSA param(arr) | E.cs:73:13:73:15 | access to parameter arr | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:66:40:66:42 | arr | arr | E.cs:70:22:70:32 | ... == ... | this |
| E.cs:112:13:112:16 | access to local variable arr2 | E.cs:107:15:107:25 | SSA def(arr2) | E.cs:112:13:112:16 | access to local variable arr2 | Variable $@ may be null at this access because of $@ assignment. | E.cs:107:15:107:18 | arr2 | arr2 | E.cs:107:15:107:25 | Int32[] arr2 = ... | this |
| E.cs:125:33:125:35 | access to local variable obj | E.cs:137:25:137:34 | SSA def(obj) | E.cs:125:33:125:35 | access to local variable obj | Variable $@ may be null at this access because of $@ assignment. | E.cs:119:13:119:15 | obj | obj | E.cs:137:25:137:34 | ... = ... | this |
| E.cs:159:13:159:16 | access to local variable obj2 | E.cs:152:16:152:26 | SSA def(obj2) | E.cs:159:13:159:16 | access to local variable obj2 | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:152:16:152:19 | obj2 | obj2 | E.cs:153:13:153:24 | ... != ... | this |
| E.cs:167:21:167:21 | access to parameter a | E.cs:162:28:162:28 | SSA param(a) | E.cs:167:21:167:21 | access to parameter a | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:162:28:162:28 | a | a | E.cs:164:17:164:25 | ... == ... | this |
| E.cs:178:13:178:15 | access to parameter obj | E.cs:173:29:173:31 | SSA param(obj) | E.cs:178:13:178:15 | access to parameter obj | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:173:29:173:31 | obj | obj | E.cs:175:19:175:29 | ... == ... | this |
| E.cs:178:13:178:15 | access to parameter obj | E.cs:173:29:173:31 | SSA param(obj) | E.cs:178:13:178:15 | access to parameter obj | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:173:29:173:31 | obj | obj | E.cs:180:13:180:23 | ... == ... | this |
| E.cs:186:13:186:15 | access to parameter obj | E.cs:173:29:173:31 | SSA param(obj) | E.cs:186:13:186:15 | access to parameter obj | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:173:29:173:31 | obj | obj | E.cs:175:19:175:29 | ... == ... | this |
| E.cs:186:13:186:15 | access to parameter obj | E.cs:173:29:173:31 | SSA param(obj) | E.cs:186:13:186:15 | access to parameter obj | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:173:29:173:31 | obj | obj | E.cs:180:13:180:23 | ... == ... | this |
| E.cs:192:17:192:17 | access to parameter o | E.cs:190:29:190:29 | SSA param(o) | E.cs:192:17:192:17 | access to parameter o | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:190:29:190:29 | o | o | E.cs:193:17:193:17 | access to parameter o | this |
| E.cs:201:13:201:13 | access to local variable o | E.cs:198:13:198:29 | [b (line 196): true] SSA def(o) | E.cs:201:13:201:13 | access to local variable o | Variable $@ may be null at this access because of $@ assignment. | E.cs:198:13:198:13 | o | o | E.cs:198:13:198:29 | String o = ... | this |
| E.cs:203:13:203:13 | access to local variable o | E.cs:198:13:198:29 | [b (line 196): false] SSA def(o) | E.cs:203:13:203:13 | access to local variable o | Variable $@ may be null at this access because of $@ assignment. | E.cs:198:13:198:13 | o | o | E.cs:198:13:198:29 | String o = ... | this |
| E.cs:218:9:218:9 | access to local variable x | E.cs:217:13:217:20 | [b (line 213): true] SSA def(x) | E.cs:218:9:218:9 | access to local variable x | Variable $@ may be null at this access because of $@ assignment. | E.cs:215:13:215:13 | x | x | E.cs:217:13:217:20 | ... = ... | this |
| E.cs:230:9:230:9 | access to local variable x | E.cs:227:13:227:20 | [b (line 223): true] SSA def(x) | E.cs:230:9:230:9 | access to local variable x | Variable $@ may be null at this access because of $@ assignment. | E.cs:225:13:225:13 | x | x | E.cs:227:13:227:20 | ... = ... | this |
| E.cs:235:16:235:16 | access to parameter i | E.cs:233:26:233:26 | SSA param(i) | E.cs:235:16:235:16 | access to parameter i | Variable $@ may be null at this access because it has a nullable type. | E.cs:233:26:233:26 | i | i | E.cs:233:26:233:26 | i | this |
| E.cs:240:21:240:21 | access to parameter i | E.cs:238:26:238:26 | SSA param(i) | E.cs:240:21:240:21 | access to parameter i | Variable $@ may be null at this access because it has a nullable type. | E.cs:238:26:238:26 | i | i | E.cs:238:26:238:26 | i | this |
| E.cs:285:9:285:9 | access to local variable o | E.cs:283:13:283:22 | [b (line 279): false] SSA def(o) | E.cs:285:9:285:9 | access to local variable o | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:283:13:283:13 | o | o | E.cs:284:9:284:9 | access to local variable o | this |
| E.cs:285:9:285:9 | access to local variable o | E.cs:283:13:283:22 | [b (line 279): true] SSA def(o) | E.cs:285:9:285:9 | access to local variable o | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:283:13:283:13 | o | o | E.cs:284:9:284:9 | access to local variable o | this |
| E.cs:302:9:302:9 | access to local variable s | E.cs:301:13:301:27 | SSA def(s) | E.cs:302:9:302:9 | access to local variable s | Variable $@ may be null at this access because of $@ assignment. | E.cs:301:13:301:13 | s | s | E.cs:301:13:301:27 | String s = ... | this |
| E.cs:343:9:343:9 | access to local variable x | E.cs:342:13:342:32 | SSA def(x) | E.cs:343:9:343:9 | access to local variable x | Variable $@ may be null at this access because of $@ assignment. | E.cs:342:13:342:13 | x | x | E.cs:342:13:342:32 | String x = ... | this |
| E.cs:349:9:349:9 | access to local variable x | E.cs:348:17:348:36 | SSA def(x) | E.cs:349:9:349:9 | access to local variable x | Variable $@ may be null at this access because of $@ assignment. | E.cs:348:17:348:17 | x | x | E.cs:348:17:348:36 | dynamic x = ... | this |
| E.cs:366:41:366:41 | access to parameter s | E.cs:366:28:366:28 | SSA param(s) | E.cs:366:41:366:41 | access to parameter s | Variable $@ may be null at this access because the parameter has a null default value. | E.cs:366:28:366:28 | s | s | E.cs:366:32:366:35 | null | this |
| E.cs:375:20:375:20 | access to local variable s | E.cs:374:17:374:31 | SSA def(s) | E.cs:375:20:375:20 | access to local variable s | Variable $@ may be null at this access because of $@ assignment. | E.cs:374:17:374:17 | s | s | E.cs:374:17:374:31 | String s = ... | this |
| E.cs:386:16:386:17 | access to parameter e1 | E.cs:380:24:380:25 | SSA param(e1) | E.cs:386:16:386:17 | access to parameter e1 | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:380:24:380:25 | e1 | e1 | E.cs:382:14:382:23 | ... == ... | this |
| E.cs:386:16:386:17 | access to parameter e1 | E.cs:380:24:380:25 | SSA param(e1) | E.cs:386:16:386:17 | access to parameter e1 | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:380:24:380:25 | e1 | e1 | E.cs:382:44:382:53 | ... != ... | this |
| E.cs:386:16:386:17 | access to parameter e1 | E.cs:380:24:380:25 | SSA param(e1) | E.cs:386:16:386:17 | access to parameter e1 | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:380:24:380:25 | e1 | e1 | E.cs:384:13:384:22 | ... == ... | this |
| E.cs:386:27:386:28 | access to parameter e2 | E.cs:380:30:380:31 | SSA param(e2) | E.cs:386:27:386:28 | access to parameter e2 | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:380:30:380:31 | e2 | e2 | E.cs:382:28:382:37 | ... != ... | this |
| E.cs:386:27:386:28 | access to parameter e2 | E.cs:380:30:380:31 | SSA param(e2) | E.cs:386:27:386:28 | access to parameter e2 | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:380:30:380:31 | e2 | e2 | E.cs:382:58:382:67 | ... == ... | this |
| E.cs:386:27:386:28 | access to parameter e2 | E.cs:380:30:380:31 | SSA param(e2) | E.cs:386:27:386:28 | access to parameter e2 | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:380:30:380:31 | e2 | e2 | E.cs:384:27:384:36 | ... == ... | this |
| E.cs:417:34:417:34 | access to parameter i | E.cs:417:24:417:40 | SSA capture def(i) | E.cs:417:34:417:34 | access to parameter i | Variable $@ may be null at this access because it has a nullable type. | E.cs:415:27:415:27 | i | i | E.cs:415:27:415:27 | i | this |
| E.cs:423:38:423:38 | access to parameter i | E.cs:423:28:423:44 | SSA capture def(i) | E.cs:423:38:423:38 | access to parameter i | Variable $@ may be null at this access because it has a nullable type. | E.cs:420:27:420:27 | i | i | E.cs:420:27:420:27 | i | this |
| E.cs:430:39:430:39 | access to parameter i | E.cs:430:29:430:45 | SSA capture def(i) | E.cs:430:39:430:39 | access to parameter i | Variable $@ may be null at this access because it has a nullable type. | E.cs:427:27:427:27 | i | i | E.cs:427:27:427:27 | i | this |
| GuardedString.cs:35:31:35:31 | access to local variable s | GuardedString.cs:7:16:7:32 | SSA def(s) | GuardedString.cs:35:31:35:31 | access to local variable s | Variable $@ may be null at this access because of $@ assignment. | GuardedString.cs:7:16:7:16 | s | s | GuardedString.cs:7:16:7:32 | String s = ... | this |
| NullMaybeBad.cs:7:27:7:27 | access to parameter o | NullMaybeBad.cs:13:17:13:20 | null | NullMaybeBad.cs:7:27:7:27 | access to parameter o | Variable $@ may be null at this access because of $@ null argument. | NullMaybeBad.cs:5:25:5:25 | o | o | NullMaybeBad.cs:13:17:13:20 | null | this |
| Params.cs:14:17:14:20 | access to parameter args | Params.cs:20:12:20:15 | null | Params.cs:14:17:14:20 | access to parameter args | Variable $@ may be null at this access because of $@ null argument. | Params.cs:12:36:12:39 | args | args | Params.cs:20:12:20:15 | null | this |
| StringConcatenation.cs:16:17:16:17 | access to local variable s | StringConcatenation.cs:14:16:14:23 | SSA def(s) | StringConcatenation.cs:16:17:16:17 | access to local variable s | Variable $@ may be null at this access because of $@ assignment. | StringConcatenation.cs:14:16:14:16 | s | s | StringConcatenation.cs:14:16:14:23 | String s = ... | this |
edges
| A.cs:7:16:7:40 | SSA def(synchronizedAlways) | A.cs:8:15:8:32 | access to local variable synchronizedAlways |
| A.cs:7:16:7:40 | SSA def(synchronizedAlways) | A.cs:10:13:10:30 | access to local variable synchronizedAlways |
| A.cs:16:15:16:30 | SSA def(arrayNull) | A.cs:17:9:17:17 | access to local variable arrayNull |
| A.cs:26:15:26:32 | SSA def(arrayAccess) | A.cs:31:27:31:37 | access to local variable arrayAccess |
| A.cs:26:15:26:32 | SSA def(arrayAccess) | A.cs:36:27:36:37 | access to local variable arrayAccess |
| A.cs:27:18:27:35 | SSA def(fieldAccess) | A.cs:32:27:32:37 | access to local variable fieldAccess |
| A.cs:27:18:27:35 | SSA def(fieldAccess) | A.cs:37:27:37:37 | access to local variable fieldAccess |
| A.cs:28:16:28:34 | SSA def(methodAccess) | A.cs:33:28:33:39 | access to local variable methodAccess |
| A.cs:28:16:28:34 | SSA def(methodAccess) | A.cs:38:15:38:26 | access to local variable methodAccess |
| A.cs:29:16:29:32 | SSA def(methodCall) | A.cs:34:27:34:36 | access to local variable methodCall |
| A.cs:29:16:29:32 | SSA def(methodCall) | A.cs:39:27:39:36 | access to local variable methodCall |
| A.cs:48:16:48:28 | SSA def(varRef) | A.cs:50:9:50:14 | access to local variable varRef |
| Assert.cs:13:9:13:25 | [b (line 7): false] SSA def(s) | Assert.cs:15:27:15:27 | access to local variable s |
| Assert.cs:13:9:13:25 | [b (line 7): true] SSA def(s) | Assert.cs:15:27:15:27 | access to local variable s |
| Assert.cs:21:9:21:25 | [b (line 7): false] SSA def(s) | Assert.cs:23:27:23:27 | access to local variable s |
| Assert.cs:21:9:21:25 | [b (line 7): true] SSA def(s) | Assert.cs:23:27:23:27 | access to local variable s |
| Assert.cs:29:9:29:25 | [b (line 7): false] SSA def(s) | Assert.cs:31:27:31:27 | access to local variable s |
| Assert.cs:29:9:29:25 | [b (line 7): true] SSA def(s) | Assert.cs:31:27:31:27 | access to local variable s |
| Assert.cs:45:9:45:25 | [b (line 7): true] SSA def(s) | Assert.cs:46:36:46:36 | [b (line 7): true] access to parameter b |
| Assert.cs:46:23:46:36 | [true, b (line 7): true] ... && ... | Assert.cs:47:27:47:27 | access to local variable s |
| Assert.cs:46:36:46:36 | [b (line 7): true] access to parameter b | Assert.cs:46:23:46:36 | [true, b (line 7): true] ... && ... |
| Assert.cs:49:9:49:25 | [b (line 7): true] SSA def(s) | Assert.cs:50:38:50:38 | [b (line 7): true] access to parameter b |
| Assert.cs:50:24:50:38 | [false] ... \|\| ... | Assert.cs:51:27:51:27 | access to local variable s |
| Assert.cs:50:37:50:38 | [false] !... | Assert.cs:50:24:50:38 | [false] ... \|\| ... |
| Assert.cs:50:38:50:38 | [b (line 7): true] access to parameter b | Assert.cs:50:37:50:38 | [false] !... |
| B.cs:7:11:7:29 | SSA def(eqCallAlways) | B.cs:13:13:13:24 | access to local variable eqCallAlways |
| B.cs:10:11:10:30 | SSA def(neqCallAlways) | B.cs:13:13:13:36 | ...; |
| B.cs:10:11:10:30 | SSA def(neqCallAlways) | B.cs:15:9:16:26 | if (...) ... |
| B.cs:13:13:13:36 | ...; | B.cs:15:9:16:26 | if (...) ... |
| B.cs:15:9:16:26 | if (...) ... | B.cs:16:13:16:26 | ...; |
| B.cs:15:9:16:26 | if (...) ... | B.cs:18:9:20:26 | if (...) ... |
| B.cs:16:13:16:26 | ...; | B.cs:18:9:20:26 | if (...) ... |
| B.cs:18:9:20:26 | if (...) ... | B.cs:18:25:18:27 | {...} |
| B.cs:18:9:20:26 | if (...) ... | B.cs:20:13:20:26 | ...; |
| B.cs:18:25:18:27 | {...} | B.cs:22:9:24:37 | if (...) ... |
| B.cs:20:13:20:26 | ...; | B.cs:22:9:24:37 | if (...) ... |
| B.cs:22:9:24:37 | if (...) ... | B.cs:24:13:24:25 | access to local variable neqCallAlways |
| C.cs:10:16:10:23 | SSA def(o) | C.cs:11:17:11:28 | [false] !... |
| C.cs:11:13:11:30 | [false] !... | C.cs:16:9:19:9 | if (...) ... |
| C.cs:11:15:11:29 | [true] !... | C.cs:11:13:11:30 | [false] !... |
| C.cs:11:17:11:28 | [false] !... | C.cs:11:15:11:29 | [true] !... |
| C.cs:16:9:19:9 | if (...) ... | C.cs:16:13:16:24 | [true] !... |
| C.cs:16:13:16:24 | [true] !... | C.cs:18:13:18:13 | access to local variable o |
| C.cs:40:13:40:35 | SSA def(s) | C.cs:42:9:42:9 | access to local variable s |
| C.cs:55:13:55:36 | SSA def(o2) | C.cs:57:9:57:10 | access to local variable o2 |
| C.cs:62:13:62:46 | SSA def(o1) | C.cs:64:9:64:10 | access to local variable o1 |
| C.cs:66:13:66:46 | SSA def(o2) | C.cs:68:9:68:10 | access to local variable o2 |
| C.cs:94:13:94:45 | SSA def(o) | C.cs:95:15:95:15 | access to local variable o |
| C.cs:94:13:94:45 | SSA def(o) | C.cs:96:13:96:13 | access to local variable o |
| C.cs:102:13:102:23 | SSA def(list) | C.cs:103:27:103:30 | access to parameter list |
| C.cs:102:13:102:23 | SSA def(list) | C.cs:103:27:103:30 | access to parameter list |
| C.cs:103:9:107:9 | foreach (... ... in ...) ... | C.cs:103:22:103:22 | Int32 x |
| C.cs:103:9:107:9 | foreach (... ... in ...) ... | C.cs:106:13:106:16 | access to parameter list |
| C.cs:103:22:103:22 | Int32 x | C.cs:103:9:107:9 | foreach (... ... in ...) ... |
| C.cs:103:27:103:30 | access to parameter list | C.cs:103:9:107:9 | foreach (... ... in ...) ... |
| C.cs:159:9:159:16 | SSA def(s) | C.cs:162:13:162:13 | access to local variable s |
| C.cs:167:9:167:16 | SSA def(s) | C.cs:170:13:170:13 | access to local variable s |
| C.cs:178:13:178:20 | SSA def(s) | C.cs:177:13:177:13 | access to local variable s |
| C.cs:193:9:193:16 | SSA def(s) | C.cs:196:13:196:13 | access to local variable s |
| C.cs:197:13:197:20 | [b (line 192): true] SSA def(s) | C.cs:196:13:196:13 | access to local variable s |
| C.cs:201:16:201:19 | true | C.cs:203:13:203:13 | access to local variable s |
| C.cs:204:13:204:20 | SSA def(s) | C.cs:201:16:201:19 | true |
| C.cs:210:13:210:35 | SSA def(s) | C.cs:217:9:218:25 | if (...) ... |
| C.cs:214:13:214:20 | SSA def(s) | C.cs:217:9:218:25 | if (...) ... |
| C.cs:217:9:218:25 | if (...) ... | C.cs:218:13:218:13 | access to local variable s |
| C.cs:222:13:222:20 | SSA def(s) | C.cs:223:9:223:9 | access to local variable s |
| C.cs:229:22:229:22 | access to local variable s | C.cs:233:9:233:9 | access to local variable s |
| C.cs:229:33:229:40 | SSA def(s) | C.cs:229:22:229:22 | access to local variable s |
| C.cs:235:14:235:21 | SSA def(s) | C.cs:235:24:235:24 | access to local variable s |
| C.cs:235:24:235:24 | access to local variable s | C.cs:237:13:237:13 | access to local variable s |
| C.cs:235:35:235:42 | SSA def(s) | C.cs:235:24:235:24 | access to local variable s |
| C.cs:240:24:240:31 | SSA def(s) | C.cs:242:13:242:13 | access to local variable s |
| C.cs:248:15:248:22 | SSA def(a) | C.cs:249:9:249:9 | access to local variable a |
| C.cs:257:15:257:23 | SSA def(ia) | C.cs:260:9:260:10 | access to local variable ia |
| C.cs:257:15:257:23 | SSA def(ia) | C.cs:263:9:263:10 | access to local variable ia |
| C.cs:258:18:258:26 | SSA def(sa) | C.cs:261:20:261:21 | access to local variable sa |
| C.cs:258:18:258:26 | SSA def(sa) | C.cs:264:16:264:17 | access to local variable sa |
| D.cs:17:17:17:20 | null | D.cs:23:9:23:13 | access to parameter param |
| D.cs:26:32:26:36 | SSA param(param) | D.cs:32:9:32:13 | access to parameter param |
| D.cs:58:13:58:41 | SSA def(o5) | D.cs:61:9:62:26 | if (...) ... |
| D.cs:61:9:62:26 | if (...) ... | D.cs:62:13:62:14 | access to local variable o5 |
| D.cs:68:13:68:34 | SSA def(o7) | D.cs:69:18:69:36 | ... && ... |
| D.cs:69:18:69:36 | ... && ... | D.cs:73:13:73:14 | access to local variable o7 |
| D.cs:75:13:75:34 | SSA def(o8) | D.cs:76:34:76:35 | 42 |
| D.cs:76:21:76:43 | ... ? ... : ... | D.cs:79:9:80:26 | if (...) ... |
| D.cs:76:34:76:35 | 42 | D.cs:76:21:76:43 | ... ? ... : ... |
| D.cs:79:9:80:26 | if (...) ... | D.cs:81:9:82:26 | if (...) ... |
| D.cs:81:9:82:26 | if (...) ... | D.cs:82:13:82:14 | access to local variable o8 |
| D.cs:81:9:82:26 | if (...) ... | D.cs:82:13:82:26 | ...; |
| D.cs:81:9:82:26 | if (...) ... | D.cs:83:9:84:26 | if (...) ... |
| D.cs:82:13:82:26 | ...; | D.cs:83:9:84:26 | if (...) ... |
| D.cs:83:9:84:26 | if (...) ... | D.cs:84:13:84:14 | access to local variable o8 |
| D.cs:89:15:89:44 | SSA def(xs) | D.cs:91:13:91:14 | access to local variable xs |
| D.cs:89:15:89:44 | SSA def(xs) | D.cs:91:13:91:22 | ...; |
| D.cs:89:15:89:44 | SSA def(xs) | D.cs:93:9:94:30 | if (...) ... |
| D.cs:91:13:91:22 | ...; | D.cs:93:9:94:30 | if (...) ... |
| D.cs:93:9:94:30 | if (...) ... | D.cs:94:13:94:30 | ...; |
| D.cs:93:9:94:30 | if (...) ... | D.cs:94:21:94:22 | access to local variable xs |
| D.cs:93:9:94:30 | if (...) ... | D.cs:96:9:99:9 | if (...) ... |
| D.cs:94:13:94:30 | ...; | D.cs:96:9:99:9 | if (...) ... |
| D.cs:96:9:99:9 | if (...) ... | D.cs:97:9:99:9 | {...} |
| D.cs:96:9:99:9 | if (...) ... | D.cs:98:21:98:22 | access to local variable xs |
| D.cs:96:9:99:9 | if (...) ... | D.cs:101:9:102:35 | if (...) ... |
| D.cs:97:9:99:9 | {...} | D.cs:101:9:102:35 | if (...) ... |
| D.cs:101:9:102:35 | if (...) ... | D.cs:102:31:102:32 | access to local variable xs |
| D.cs:101:9:102:35 | if (...) ... | D.cs:102:31:102:32 | access to local variable xs |
| D.cs:101:9:102:35 | if (...) ... | D.cs:104:9:106:30 | if (...) ... |
| D.cs:102:13:102:35 | foreach (... ... in ...) ... | D.cs:102:26:102:26 | Int32 _ |
| D.cs:102:13:102:35 | foreach (... ... in ...) ... | D.cs:104:9:106:30 | if (...) ... |
| D.cs:102:26:102:26 | Int32 _ | D.cs:102:13:102:35 | foreach (... ... in ...) ... |
| D.cs:102:31:102:32 | access to local variable xs | D.cs:102:13:102:35 | foreach (... ... in ...) ... |
| D.cs:104:9:106:30 | if (...) ... | D.cs:105:19:105:20 | access to local variable xs |
| D.cs:104:9:106:30 | if (...) ... | D.cs:106:17:106:18 | access to local variable xs |
| D.cs:118:9:118:30 | SSA def(x) | D.cs:120:13:120:13 | access to local variable x |
| D.cs:125:35:125:35 | SSA param(a) | D.cs:127:32:127:32 | 0 |
| D.cs:125:35:125:35 | SSA param(a) | D.cs:127:32:127:32 | 0 |
| D.cs:125:44:125:44 | SSA param(b) | D.cs:127:32:127:32 | 0 |
| D.cs:125:44:125:44 | SSA param(b) | D.cs:127:36:127:36 | access to parameter a |
| D.cs:127:20:127:43 | ... ? ... : ... | D.cs:128:32:128:32 | 0 |
| D.cs:127:20:127:43 | ... ? ... : ... | D.cs:128:32:128:32 | 0 |
| D.cs:127:20:127:43 | ... ? ... : ... | D.cs:128:36:128:36 | access to parameter b |
| D.cs:127:32:127:32 | 0 | D.cs:127:20:127:43 | ... ? ... : ... |
| D.cs:127:32:127:32 | 0 | D.cs:127:20:127:43 | ... ? ... : ... |
| D.cs:127:36:127:36 | access to parameter a | D.cs:127:20:127:43 | ... ? ... : ... |
| D.cs:128:20:128:43 | ... ? ... : ... | D.cs:131:9:137:9 | {...} |
| D.cs:128:20:128:43 | ... ? ... : ... | D.cs:131:9:137:9 | {...} |
| D.cs:128:20:128:43 | ... ? ... : ... | D.cs:138:9:138:18 | ... ...; |
| D.cs:128:32:128:32 | 0 | D.cs:128:20:128:43 | ... ? ... : ... |
| D.cs:128:32:128:32 | 0 | D.cs:128:20:128:43 | ... ? ... : ... |
| D.cs:128:36:128:36 | access to parameter b | D.cs:128:20:128:43 | ... ? ... : ... |
| D.cs:131:9:137:9 | {...} | D.cs:132:29:132:29 | access to local variable i |
| D.cs:131:9:137:9 | {...} | D.cs:132:29:132:29 | access to local variable i |
| D.cs:132:29:132:29 | access to local variable i | D.cs:133:13:136:13 | {...} |
| D.cs:132:29:132:29 | access to local variable i | D.cs:133:13:136:13 | {...} |
| D.cs:132:29:132:29 | access to local variable i | D.cs:134:24:134:24 | access to parameter a |
| D.cs:132:29:132:29 | access to local variable i | D.cs:135:24:135:24 | access to parameter b |
| D.cs:132:29:132:29 | access to local variable i | D.cs:138:9:138:18 | ... ...; |
| D.cs:133:13:136:13 | {...} | D.cs:132:29:132:29 | access to local variable i |
| D.cs:133:13:136:13 | {...} | D.cs:132:29:132:29 | access to local variable i |
| D.cs:138:9:138:18 | ... ...; | D.cs:142:13:142:22 | ...; |
| D.cs:142:13:142:22 | ...; | D.cs:143:9:146:9 | for (...;...;...) ... |
| D.cs:143:9:146:9 | for (...;...;...) ... | D.cs:143:25:143:25 | access to local variable i |
| D.cs:143:25:143:25 | access to local variable i | D.cs:144:9:146:9 | {...} |
| D.cs:143:25:143:25 | access to local variable i | D.cs:145:20:145:20 | access to parameter a |
| D.cs:144:9:146:9 | {...} | D.cs:143:25:143:25 | access to local variable i |
| D.cs:149:36:149:38 | SSA param(obj) | D.cs:151:9:151:11 | access to parameter obj |
| D.cs:163:16:163:25 | SSA def(obj) | D.cs:168:9:170:9 | [exception: Exception] catch (...) {...} |
| D.cs:168:9:170:9 | [exception: Exception] catch (...) {...} | D.cs:168:26:168:26 | [exception: Exception] Exception e |
| D.cs:168:26:168:26 | [exception: Exception] Exception e | D.cs:171:9:171:11 | access to local variable obj |
| D.cs:240:9:240:16 | SSA def(o) | D.cs:241:29:241:32 | null |
| D.cs:240:9:240:16 | SSA def(o) | D.cs:241:36:241:37 | "" |
| D.cs:241:21:241:37 | ... ? ... : ... | D.cs:244:9:247:25 | if (...) ... |
| D.cs:241:29:241:32 | null | D.cs:241:21:241:37 | ... ? ... : ... |
| D.cs:241:36:241:37 | "" | D.cs:241:21:241:37 | ... ? ... : ... |
| D.cs:244:9:247:25 | if (...) ... | D.cs:245:13:245:13 | access to local variable o |
| D.cs:244:9:247:25 | if (...) ... | D.cs:247:13:247:13 | access to local variable o |
| D.cs:249:13:249:38 | SSA def(o2) | D.cs:253:13:253:14 | access to local variable o2 |
| D.cs:258:16:258:23 | SSA def(o) | D.cs:266:9:267:25 | if (...) ... |
| D.cs:266:9:267:25 | if (...) ... | D.cs:266:13:266:27 | [true] ... is ... |
| D.cs:266:13:266:27 | [true] ... is ... | D.cs:267:13:267:13 | access to local variable o |
| D.cs:269:9:269:16 | SSA def(o) | D.cs:272:25:272:25 | access to local variable i |
| D.cs:272:25:272:25 | access to local variable i | D.cs:273:9:288:9 | {...} |
| D.cs:272:25:272:25 | access to local variable i | D.cs:290:9:291:25 | if (...) ... |
| D.cs:272:39:272:39 | access to local variable i | D.cs:272:25:272:25 | access to local variable i |
| D.cs:273:9:288:9 | {...} | D.cs:281:13:287:13 | if (...) ... |
| D.cs:281:13:287:13 | if (...) ... | D.cs:272:39:272:39 | access to local variable i |
| D.cs:283:17:283:24 | SSA def(o) | D.cs:285:28:285:30 | {...} |
| D.cs:283:17:283:24 | SSA def(o) | D.cs:286:17:286:30 | ...; |
| D.cs:285:28:285:30 | {...} | D.cs:286:17:286:30 | ...; |
| D.cs:286:17:286:30 | ...; | D.cs:272:39:272:39 | access to local variable i |
| D.cs:290:9:291:25 | if (...) ... | D.cs:291:13:291:13 | access to local variable o |
| D.cs:290:9:291:25 | if (...) ... | D.cs:291:13:291:25 | ...; |
| D.cs:290:9:291:25 | if (...) ... | D.cs:293:9:294:25 | if (...) ... |
| D.cs:291:13:291:25 | ...; | D.cs:293:9:294:25 | if (...) ... |
| D.cs:293:9:294:25 | if (...) ... | D.cs:294:13:294:13 | access to local variable o |
| D.cs:296:16:296:26 | SSA def(prev) | D.cs:297:25:297:25 | access to local variable i |
| D.cs:297:25:297:25 | access to local variable i | D.cs:298:9:302:9 | {...} |
| D.cs:298:9:302:9 | {...} | D.cs:300:17:300:20 | access to local variable prev |
| D.cs:304:16:304:23 | SSA def(s) | D.cs:307:13:311:13 | foreach (... ... in ...) ... |
| D.cs:307:13:311:13 | foreach (... ... in ...) ... | D.cs:312:13:313:29 | if (...) ... |
| D.cs:312:13:313:29 | if (...) ... | D.cs:312:17:312:23 | [true] !... |
| D.cs:312:17:312:23 | [true] !... | D.cs:313:17:313:17 | access to local variable s |
| D.cs:316:16:316:23 | SSA def(r) | D.cs:318:16:318:19 | access to local variable stat |
| D.cs:318:16:318:19 | access to local variable stat | D.cs:318:16:318:62 | [false] ... && ... |
| D.cs:318:16:318:19 | access to local variable stat | D.cs:318:41:318:44 | access to local variable stat |
| D.cs:318:16:318:62 | [false] ... && ... | D.cs:324:9:324:9 | access to local variable r |
| D.cs:318:41:318:44 | access to local variable stat | D.cs:318:16:318:62 | [false] ... && ... |
| D.cs:351:15:351:22 | SSA def(a) | D.cs:355:9:356:21 | for (...;...;...) ... |
| D.cs:355:9:356:21 | for (...;...;...) ... | D.cs:355:25:355:25 | access to local variable i |
| D.cs:355:25:355:25 | access to local variable i | D.cs:356:13:356:13 | access to local variable a |
| D.cs:355:25:355:25 | access to local variable i | D.cs:356:13:356:21 | ...; |
| D.cs:356:13:356:21 | ...; | D.cs:355:25:355:25 | access to local variable i |
| D.cs:360:20:360:30 | SSA def(last) | D.cs:361:29:361:29 | access to local variable i |
| D.cs:361:29:361:29 | access to local variable i | D.cs:363:13:363:16 | access to local variable last |
| D.cs:366:15:366:47 | SSA def(b) | D.cs:367:13:367:56 | [false] ... && ... |
| D.cs:367:13:367:56 | [false] ... && ... | D.cs:370:9:373:9 | for (...;...;...) ... |
| D.cs:370:9:373:9 | for (...;...;...) ... | D.cs:370:25:370:25 | access to local variable i |
| D.cs:370:25:370:25 | access to local variable i | D.cs:371:9:373:9 | {...} |
| D.cs:370:25:370:25 | access to local variable i | D.cs:372:13:372:13 | access to local variable b |
| D.cs:371:9:373:9 | {...} | D.cs:370:25:370:25 | access to local variable i |
| D.cs:378:19:378:28 | SSA def(ioe) | D.cs:382:9:385:27 | if (...) ... |
| D.cs:382:9:385:27 | if (...) ... | D.cs:385:13:385:15 | access to local variable ioe |
| D.cs:388:36:388:36 | SSA param(a) | D.cs:390:32:390:32 | 0 |
| D.cs:388:45:388:45 | SSA param(b) | D.cs:390:32:390:32 | 0 |
| D.cs:388:45:388:45 | SSA param(b) | D.cs:390:36:390:36 | access to parameter a |
| D.cs:390:20:390:43 | ... ? ... : ... | D.cs:393:21:393:21 | access to local variable i |
| D.cs:390:20:390:43 | ... ? ... : ... | D.cs:393:21:393:21 | access to local variable i |
| D.cs:390:32:390:32 | 0 | D.cs:390:20:390:43 | ... ? ... : ... |
| D.cs:390:32:390:32 | 0 | D.cs:390:20:390:43 | ... ? ... : ... |
| D.cs:390:36:390:36 | access to parameter a | D.cs:390:20:390:43 | ... ? ... : ... |
| D.cs:393:21:393:21 | access to local variable i | D.cs:394:9:396:9 | {...} |
| D.cs:393:21:393:21 | access to local variable i | D.cs:394:9:396:9 | {...} |
| D.cs:393:21:393:21 | access to local variable i | D.cs:395:20:395:20 | access to parameter a |
| D.cs:393:21:393:21 | access to local variable i | D.cs:397:9:397:44 | ... ...; |
| D.cs:394:9:396:9 | {...} | D.cs:393:21:393:21 | access to local variable i |
| D.cs:394:9:396:9 | {...} | D.cs:393:21:393:21 | access to local variable i |
| D.cs:397:9:397:44 | ... ...; | D.cs:397:32:397:32 | 0 |
| D.cs:397:20:397:43 | ... ? ... : ... | D.cs:398:21:398:21 | access to local variable i |
| D.cs:397:32:397:32 | 0 | D.cs:397:20:397:43 | ... ? ... : ... |
| D.cs:398:21:398:21 | access to local variable i | D.cs:399:9:401:9 | {...} |
| D.cs:398:21:398:21 | access to local variable i | D.cs:400:20:400:20 | access to parameter b |
| D.cs:399:9:401:9 | {...} | D.cs:398:21:398:21 | access to local variable i |
| D.cs:405:35:405:35 | SSA param(x) | D.cs:407:14:407:35 | [false] ... && ... |
| D.cs:405:35:405:35 | SSA param(x) | D.cs:407:14:407:35 | [false] ... && ... |
| D.cs:405:35:405:35 | SSA param(x) | D.cs:407:14:407:35 | [false] ... && ... |
| D.cs:405:45:405:45 | SSA param(y) | D.cs:407:14:407:35 | [false] ... && ... |
| D.cs:405:45:405:45 | SSA param(y) | D.cs:407:14:407:35 | [false] ... && ... |
| D.cs:405:45:405:45 | SSA param(y) | D.cs:407:14:407:35 | [false] ... && ... |
| D.cs:407:13:407:64 | [false] ... \|\| ... | D.cs:409:9:410:25 | if (...) ... |
| D.cs:407:13:407:64 | [false] ... \|\| ... | D.cs:409:9:410:25 | if (...) ... |
| D.cs:407:14:407:35 | [false] ... && ... | D.cs:407:42:407:42 | access to parameter x |
| D.cs:407:14:407:35 | [false] ... && ... | D.cs:407:42:407:42 | access to parameter x |
| D.cs:407:42:407:42 | access to parameter x | D.cs:407:42:407:63 | [false] ... && ... |
| D.cs:407:42:407:42 | access to parameter x | D.cs:407:55:407:55 | access to parameter y |
| D.cs:407:42:407:42 | access to parameter x | D.cs:407:55:407:55 | access to parameter y |
| D.cs:407:42:407:63 | [false] ... && ... | D.cs:407:13:407:64 | [false] ... \|\| ... |
| D.cs:407:42:407:63 | [false] ... && ... | D.cs:407:13:407:64 | [false] ... \|\| ... |
| D.cs:407:55:407:55 | access to parameter y | D.cs:407:42:407:63 | [false] ... && ... |
| D.cs:407:55:407:55 | access to parameter y | D.cs:407:42:407:63 | [false] ... && ... |
| D.cs:409:9:410:25 | if (...) ... | D.cs:410:13:410:13 | access to parameter y |
| D.cs:409:9:410:25 | if (...) ... | D.cs:411:9:412:25 | if (...) ... |
| D.cs:411:9:412:25 | if (...) ... | D.cs:412:13:412:13 | access to parameter x |
| E.cs:9:18:9:26 | SSA def(a2) | E.cs:10:22:10:54 | ... && ... |
| E.cs:10:22:10:54 | ... && ... | E.cs:12:38:12:39 | access to local variable a2 |
| E.cs:11:16:11:24 | SSA def(a3) | E.cs:12:22:12:52 | ... && ... |
| E.cs:12:22:12:52 | ... && ... | E.cs:14:13:14:14 | access to local variable a3 |
| E.cs:23:13:23:30 | SSA def(s1) | E.cs:24:33:24:36 | null |
| E.cs:24:18:24:41 | ... ? ... : ... | E.cs:26:9:27:26 | if (...) ... |
| E.cs:24:33:24:36 | null | E.cs:24:18:24:41 | ... ? ... : ... |
| E.cs:26:9:27:26 | if (...) ... | E.cs:27:13:27:14 | access to local variable s1 |
| E.cs:51:22:51:33 | SSA def(slice) | E.cs:53:16:53:19 | access to local variable iter |
| E.cs:53:16:53:19 | access to local variable iter | E.cs:54:9:63:9 | {...} |
| E.cs:54:9:63:9 | {...} | E.cs:61:13:61:17 | access to local variable slice |
| E.cs:54:9:63:9 | {...} | E.cs:61:13:61:27 | ...; |
| E.cs:61:13:61:27 | ...; | E.cs:53:16:53:19 | access to local variable iter |
| E.cs:66:40:66:42 | SSA param(arr) | E.cs:70:13:70:50 | ...; |
| E.cs:66:40:66:42 | SSA param(arr) | E.cs:72:9:73:23 | if (...) ... |
| E.cs:70:13:70:50 | ...; | E.cs:70:36:70:36 | 0 |
| E.cs:70:22:70:49 | ... ? ... : ... | E.cs:72:9:73:23 | if (...) ... |
| E.cs:70:36:70:36 | 0 | E.cs:70:22:70:49 | ... ? ... : ... |
| E.cs:72:9:73:23 | if (...) ... | E.cs:73:13:73:15 | access to parameter arr |
| E.cs:107:15:107:25 | SSA def(arr2) | E.cs:111:9:112:30 | for (...;...;...) ... |
| E.cs:111:9:112:30 | for (...;...;...) ... | E.cs:111:25:111:25 | access to local variable i |
| E.cs:111:25:111:25 | access to local variable i | E.cs:112:13:112:16 | access to local variable arr2 |
| E.cs:111:25:111:25 | access to local variable i | E.cs:112:13:112:30 | ...; |
| E.cs:112:13:112:30 | ...; | E.cs:111:25:111:25 | access to local variable i |
| E.cs:120:16:120:20 | [true] !... | E.cs:121:9:143:9 | {...} |
| E.cs:120:17:120:20 | access to local variable stop | E.cs:120:16:120:20 | [true] !... |
| E.cs:121:9:143:9 | {...} | E.cs:123:21:123:24 | access to local variable stop |
| E.cs:123:20:123:24 | [false] !... | E.cs:123:20:123:35 | [false] ... && ... |
| E.cs:123:20:123:24 | [true] !... | E.cs:123:29:123:29 | access to local variable j |
| E.cs:123:20:123:35 | [false] ... && ... | E.cs:120:17:120:20 | access to local variable stop |
| E.cs:123:20:123:35 | [true] ... && ... | E.cs:124:13:142:13 | {...} |
| E.cs:123:20:123:35 | [true] ... && ... | E.cs:125:33:125:35 | access to local variable obj |
| E.cs:123:21:123:24 | access to local variable stop | E.cs:123:20:123:24 | [false] !... |
| E.cs:123:21:123:24 | access to local variable stop | E.cs:123:20:123:24 | [true] !... |
| E.cs:123:29:123:29 | access to local variable j | E.cs:123:20:123:35 | [false] ... && ... |
| E.cs:123:29:123:29 | access to local variable j | E.cs:123:20:123:35 | [true] ... && ... |
| E.cs:124:13:142:13 | {...} | E.cs:128:21:128:23 | access to local variable obj |
| E.cs:124:13:142:13 | {...} | E.cs:141:17:141:26 | ...; |
| E.cs:137:25:137:34 | SSA def(obj) | E.cs:139:21:139:29 | continue; |
| E.cs:139:21:139:29 | continue; | E.cs:123:21:123:24 | access to local variable stop |
| E.cs:141:17:141:26 | ...; | E.cs:123:21:123:24 | access to local variable stop |
| E.cs:152:16:152:26 | SSA def(obj2) | E.cs:153:13:153:54 | [false] ... && ... |
| E.cs:153:13:153:54 | [false] ... && ... | E.cs:158:9:159:28 | if (...) ... |
| E.cs:158:9:159:28 | if (...) ... | E.cs:159:13:159:16 | access to local variable obj2 |
| E.cs:162:28:162:28 | SSA param(a) | E.cs:164:29:164:29 | 0 |
| E.cs:164:17:164:40 | ... ? ... : ... | E.cs:165:25:165:25 | access to local variable i |
| E.cs:164:29:164:29 | 0 | E.cs:164:17:164:40 | ... ? ... : ... |
| E.cs:165:25:165:25 | access to local variable i | E.cs:166:9:170:9 | {...} |
| E.cs:165:25:165:25 | access to local variable i | E.cs:167:21:167:21 | access to parameter a |
| E.cs:165:32:165:32 | access to local variable i | E.cs:165:25:165:25 | access to local variable i |
| E.cs:166:9:170:9 | {...} | E.cs:165:32:165:32 | access to local variable i |
| E.cs:173:29:173:31 | SSA param(obj) | E.cs:175:33:175:37 | false |
| E.cs:173:29:173:31 | SSA param(obj) | E.cs:175:33:175:37 | false |
| E.cs:175:19:175:42 | ... ? ... : ... | E.cs:177:9:179:9 | {...} |
| E.cs:175:19:175:42 | ... ? ... : ... | E.cs:178:13:178:15 | access to parameter obj |
| E.cs:175:19:175:42 | ... ? ... : ... | E.cs:180:9:183:9 | if (...) ... |
| E.cs:175:33:175:37 | false | E.cs:175:19:175:42 | ... ? ... : ... |
| E.cs:177:9:179:9 | {...} | E.cs:180:9:183:9 | if (...) ... |
| E.cs:180:9:183:9 | if (...) ... | E.cs:181:9:183:9 | {...} |
| E.cs:181:9:183:9 | {...} | E.cs:184:9:187:9 | if (...) ... |
| E.cs:184:9:187:9 | if (...) ... | E.cs:186:13:186:15 | access to parameter obj |
| E.cs:190:29:190:29 | SSA param(o) | E.cs:192:17:192:17 | access to parameter o |
| E.cs:198:13:198:29 | [b (line 196): false] SSA def(o) | E.cs:203:13:203:13 | access to local variable o |
| E.cs:198:13:198:29 | [b (line 196): true] SSA def(o) | E.cs:201:13:201:13 | access to local variable o |
| E.cs:206:28:206:28 | SSA param(s) | E.cs:208:13:208:23 | [false] ... is ... |
| E.cs:208:13:208:23 | [false] ... is ... | E.cs:210:16:210:16 | access to parameter s |
| E.cs:217:13:217:20 | [b (line 213): true] SSA def(x) | E.cs:218:9:218:9 | access to local variable x |
| E.cs:217:13:217:20 | [b (line 213): true] SSA def(x) | E.cs:220:13:220:13 | access to local variable x |
| E.cs:227:13:227:20 | [b (line 223): true] SSA def(x) | E.cs:229:13:229:13 | access to local variable x |
| E.cs:227:13:227:20 | [b (line 223): true] SSA def(x) | E.cs:229:13:229:25 | ...; |
| E.cs:229:13:229:25 | ...; | E.cs:230:9:230:9 | access to local variable x |
| E.cs:233:26:233:26 | SSA param(i) | E.cs:235:16:235:16 | access to parameter i |
| E.cs:238:26:238:26 | SSA param(i) | E.cs:240:21:240:21 | access to parameter i |
| E.cs:283:13:283:22 | [b (line 279): false] SSA def(o) | E.cs:285:9:285:9 | access to local variable o |
| E.cs:283:13:283:22 | [b (line 279): true] SSA def(o) | E.cs:285:9:285:9 | access to local variable o |
| E.cs:301:13:301:27 | SSA def(s) | E.cs:302:9:302:9 | access to local variable s |
| E.cs:319:29:319:30 | SSA param(s1) | E.cs:321:20:321:21 | access to parameter s2 |
| E.cs:321:13:321:30 | [true] ... is ... | E.cs:323:13:323:14 | access to parameter s1 |
| E.cs:321:14:321:21 | ... ?? ... | E.cs:321:13:321:30 | [true] ... is ... |
| E.cs:321:20:321:21 | access to parameter s2 | E.cs:321:14:321:21 | ... ?? ... |
| E.cs:330:13:330:36 | SSA def(x) | E.cs:331:9:331:9 | access to local variable x |
| E.cs:342:13:342:32 | SSA def(x) | E.cs:343:9:343:9 | access to local variable x |
| E.cs:348:17:348:36 | SSA def(x) | E.cs:349:9:349:9 | access to local variable x |
| E.cs:366:28:366:28 | SSA param(s) | E.cs:366:41:366:41 | access to parameter s |
| E.cs:374:17:374:31 | SSA def(s) | E.cs:375:20:375:20 | access to local variable s |
| E.cs:380:24:380:25 | SSA param(e1) | E.cs:382:28:382:29 | access to parameter e2 |
| E.cs:380:24:380:25 | SSA param(e1) | E.cs:382:28:382:29 | access to parameter e2 |
| E.cs:380:24:380:25 | SSA param(e1) | E.cs:382:28:382:29 | access to parameter e2 |
| E.cs:380:30:380:31 | SSA param(e2) | E.cs:382:14:382:37 | [false] ... && ... |
| E.cs:380:30:380:31 | SSA param(e2) | E.cs:382:14:382:37 | [false] ... && ... |
| E.cs:380:30:380:31 | SSA param(e2) | E.cs:382:14:382:37 | [false] ... && ... |
| E.cs:380:30:380:31 | SSA param(e2) | E.cs:382:28:382:29 | access to parameter e2 |
| E.cs:380:30:380:31 | SSA param(e2) | E.cs:382:28:382:29 | access to parameter e2 |
| E.cs:380:30:380:31 | SSA param(e2) | E.cs:382:28:382:29 | access to parameter e2 |
| E.cs:382:13:382:68 | [false] ... \|\| ... | E.cs:384:9:385:24 | if (...) ... |
| E.cs:382:13:382:68 | [false] ... \|\| ... | E.cs:384:9:385:24 | if (...) ... |
| E.cs:382:14:382:37 | [false] ... && ... | E.cs:382:44:382:45 | access to parameter e1 |
| E.cs:382:14:382:37 | [false] ... && ... | E.cs:382:44:382:45 | access to parameter e1 |
| E.cs:382:28:382:29 | access to parameter e2 | E.cs:382:14:382:37 | [false] ... && ... |
| E.cs:382:28:382:29 | access to parameter e2 | E.cs:382:14:382:37 | [false] ... && ... |
| E.cs:382:44:382:45 | access to parameter e1 | E.cs:382:44:382:67 | [false] ... && ... |
| E.cs:382:44:382:45 | access to parameter e1 | E.cs:382:44:382:67 | [false] ... && ... |
| E.cs:382:44:382:67 | [false] ... && ... | E.cs:382:13:382:68 | [false] ... \|\| ... |
| E.cs:382:44:382:67 | [false] ... && ... | E.cs:382:13:382:68 | [false] ... \|\| ... |
| E.cs:384:9:385:24 | if (...) ... | E.cs:384:13:384:36 | [false] ... && ... |
| E.cs:384:9:385:24 | if (...) ... | E.cs:384:27:384:28 | access to parameter e2 |
| E.cs:384:13:384:36 | [false] ... && ... | E.cs:386:16:386:17 | access to parameter e1 |
| E.cs:384:13:384:36 | [false] ... && ... | E.cs:386:27:386:28 | access to parameter e2 |
| E.cs:384:27:384:28 | access to parameter e2 | E.cs:384:13:384:36 | [false] ... && ... |
| E.cs:404:9:404:18 | SSA def(i) | E.cs:405:16:405:16 | access to local variable i |
| E.cs:404:9:404:18 | SSA def(i) | E.cs:405:16:405:16 | access to local variable i |
| E.cs:417:24:417:40 | SSA capture def(i) | E.cs:417:34:417:34 | access to parameter i |
| E.cs:423:28:423:44 | SSA capture def(i) | E.cs:423:38:423:38 | access to parameter i |
| E.cs:430:29:430:45 | SSA capture def(i) | E.cs:430:39:430:39 | access to parameter i |
| E.cs:435:29:435:29 | SSA param(s) | E.cs:437:13:437:21 | [true] ... is ... |
| E.cs:437:13:437:21 | [true] ... is ... | E.cs:439:13:439:13 | access to parameter s |
| F.cs:7:16:7:23 | SSA def(o) | F.cs:8:9:8:9 | access to local variable o |
| Forwarding.cs:7:16:7:23 | SSA def(s) | Forwarding.cs:9:13:9:30 | [false] !... |
| Forwarding.cs:9:13:9:30 | [false] !... | Forwarding.cs:14:9:17:9 | if (...) ... |
| Forwarding.cs:14:9:17:9 | if (...) ... | Forwarding.cs:19:9:22:9 | if (...) ... |
| Forwarding.cs:19:9:22:9 | if (...) ... | Forwarding.cs:19:13:19:23 | [false] !... |
| Forwarding.cs:19:13:19:23 | [false] !... | Forwarding.cs:24:9:27:9 | if (...) ... |
| Forwarding.cs:24:9:27:9 | if (...) ... | Forwarding.cs:29:9:32:9 | if (...) ... |
| Forwarding.cs:29:9:32:9 | if (...) ... | Forwarding.cs:34:9:37:9 | if (...) ... |
| Forwarding.cs:34:9:37:9 | if (...) ... | Forwarding.cs:35:9:37:9 | {...} |
| Forwarding.cs:34:9:37:9 | if (...) ... | Forwarding.cs:36:31:36:31 | access to local variable s |
| Forwarding.cs:35:9:37:9 | {...} | Forwarding.cs:40:27:40:27 | access to local variable s |
| GuardedString.cs:7:16:7:32 | SSA def(s) | GuardedString.cs:9:13:9:36 | [false] !... |
| GuardedString.cs:9:13:9:36 | [false] !... | GuardedString.cs:14:9:17:9 | if (...) ... |
| GuardedString.cs:14:9:17:9 | if (...) ... | GuardedString.cs:14:13:14:41 | [false] !... |
| GuardedString.cs:14:13:14:41 | [false] !... | GuardedString.cs:19:9:20:40 | if (...) ... |
| GuardedString.cs:19:9:20:40 | if (...) ... | GuardedString.cs:19:26:19:26 | 0 |
| GuardedString.cs:19:26:19:26 | 0 | GuardedString.cs:22:9:23:40 | if (...) ... |
| GuardedString.cs:22:9:23:40 | if (...) ... | GuardedString.cs:22:25:22:25 | 0 |
| GuardedString.cs:22:25:22:25 | 0 | GuardedString.cs:25:9:26:40 | if (...) ... |
| GuardedString.cs:25:9:26:40 | if (...) ... | GuardedString.cs:25:26:25:26 | 0 |
| GuardedString.cs:25:26:25:26 | 0 | GuardedString.cs:28:9:29:40 | if (...) ... |
| GuardedString.cs:28:9:29:40 | if (...) ... | GuardedString.cs:28:25:28:26 | 10 |
| GuardedString.cs:28:25:28:26 | 10 | GuardedString.cs:31:9:32:40 | if (...) ... |
| GuardedString.cs:31:9:32:40 | if (...) ... | GuardedString.cs:31:26:31:27 | 10 |
| GuardedString.cs:31:26:31:27 | 10 | GuardedString.cs:34:9:37:40 | if (...) ... |
| GuardedString.cs:34:9:37:40 | if (...) ... | GuardedString.cs:34:26:34:26 | 0 |
| GuardedString.cs:34:26:34:26 | 0 | GuardedString.cs:35:31:35:31 | access to local variable s |
| NullAlwaysBad.cs:7:29:7:29 | SSA param(s) | NullAlwaysBad.cs:9:30:9:30 | access to parameter s |
| NullMaybeBad.cs:13:17:13:20 | null | NullMaybeBad.cs:7:27:7:27 | access to parameter o |
| Params.cs:20:12:20:15 | null | Params.cs:14:17:14:20 | access to parameter args |
| StringConcatenation.cs:14:16:14:23 | SSA def(s) | StringConcatenation.cs:15:16:15:16 | access to local variable s |
| StringConcatenation.cs:15:16:15:16 | access to local variable s | StringConcatenation.cs:16:17:16:17 | access to local variable s |
nodes
| A.cs:7:16:7:40 | SSA def(synchronizedAlways) |
| A.cs:8:15:8:32 | access to local variable synchronizedAlways |
@@ -415,6 +895,8 @@ nodes
| E.cs:435:29:435:29 | SSA param(s) |
| E.cs:437:13:437:21 | [true] ... is ... |
| E.cs:439:13:439:13 | access to parameter s |
| F.cs:7:16:7:23 | SSA def(o) |
| F.cs:8:9:8:9 | access to local variable o |
| Forwarding.cs:7:16:7:23 | SSA def(s) |
| Forwarding.cs:9:13:9:30 | [false] !... |
| Forwarding.cs:14:9:17:9 | if (...) ... |
@@ -452,482 +934,3 @@ nodes
| StringConcatenation.cs:14:16:14:23 | SSA def(s) |
| StringConcatenation.cs:15:16:15:16 | access to local variable s |
| StringConcatenation.cs:16:17:16:17 | access to local variable s |
edges
| A.cs:7:16:7:40 | SSA def(synchronizedAlways) | A.cs:8:15:8:32 | access to local variable synchronizedAlways |
| A.cs:7:16:7:40 | SSA def(synchronizedAlways) | A.cs:10:13:10:30 | access to local variable synchronizedAlways |
| A.cs:16:15:16:30 | SSA def(arrayNull) | A.cs:17:9:17:17 | access to local variable arrayNull |
| A.cs:26:15:26:32 | SSA def(arrayAccess) | A.cs:31:27:31:37 | access to local variable arrayAccess |
| A.cs:26:15:26:32 | SSA def(arrayAccess) | A.cs:36:27:36:37 | access to local variable arrayAccess |
| A.cs:27:18:27:35 | SSA def(fieldAccess) | A.cs:32:27:32:37 | access to local variable fieldAccess |
| A.cs:27:18:27:35 | SSA def(fieldAccess) | A.cs:37:27:37:37 | access to local variable fieldAccess |
| A.cs:28:16:28:34 | SSA def(methodAccess) | A.cs:33:28:33:39 | access to local variable methodAccess |
| A.cs:28:16:28:34 | SSA def(methodAccess) | A.cs:38:15:38:26 | access to local variable methodAccess |
| A.cs:29:16:29:32 | SSA def(methodCall) | A.cs:34:27:34:36 | access to local variable methodCall |
| A.cs:29:16:29:32 | SSA def(methodCall) | A.cs:39:27:39:36 | access to local variable methodCall |
| A.cs:48:16:48:28 | SSA def(varRef) | A.cs:50:9:50:14 | access to local variable varRef |
| Assert.cs:13:9:13:25 | [b (line 7): false] SSA def(s) | Assert.cs:15:27:15:27 | access to local variable s |
| Assert.cs:13:9:13:25 | [b (line 7): true] SSA def(s) | Assert.cs:15:27:15:27 | access to local variable s |
| Assert.cs:21:9:21:25 | [b (line 7): false] SSA def(s) | Assert.cs:23:27:23:27 | access to local variable s |
| Assert.cs:21:9:21:25 | [b (line 7): true] SSA def(s) | Assert.cs:23:27:23:27 | access to local variable s |
| Assert.cs:29:9:29:25 | [b (line 7): false] SSA def(s) | Assert.cs:31:27:31:27 | access to local variable s |
| Assert.cs:29:9:29:25 | [b (line 7): true] SSA def(s) | Assert.cs:31:27:31:27 | access to local variable s |
| Assert.cs:45:9:45:25 | [b (line 7): true] SSA def(s) | Assert.cs:46:36:46:36 | [b (line 7): true] access to parameter b |
| Assert.cs:46:23:46:36 | [true, b (line 7): true] ... && ... | Assert.cs:47:27:47:27 | access to local variable s |
| Assert.cs:46:36:46:36 | [b (line 7): true] access to parameter b | Assert.cs:46:23:46:36 | [true, b (line 7): true] ... && ... |
| Assert.cs:49:9:49:25 | [b (line 7): true] SSA def(s) | Assert.cs:50:38:50:38 | [b (line 7): true] access to parameter b |
| Assert.cs:50:24:50:38 | [false] ... \|\| ... | Assert.cs:51:27:51:27 | access to local variable s |
| Assert.cs:50:37:50:38 | [false] !... | Assert.cs:50:24:50:38 | [false] ... \|\| ... |
| Assert.cs:50:38:50:38 | [b (line 7): true] access to parameter b | Assert.cs:50:37:50:38 | [false] !... |
| B.cs:7:11:7:29 | SSA def(eqCallAlways) | B.cs:13:13:13:24 | access to local variable eqCallAlways |
| B.cs:10:11:10:30 | SSA def(neqCallAlways) | B.cs:13:13:13:36 | ...; |
| B.cs:10:11:10:30 | SSA def(neqCallAlways) | B.cs:15:9:16:26 | if (...) ... |
| B.cs:13:13:13:36 | ...; | B.cs:15:9:16:26 | if (...) ... |
| B.cs:15:9:16:26 | if (...) ... | B.cs:16:13:16:26 | ...; |
| B.cs:15:9:16:26 | if (...) ... | B.cs:18:9:20:26 | if (...) ... |
| B.cs:16:13:16:26 | ...; | B.cs:18:9:20:26 | if (...) ... |
| B.cs:18:9:20:26 | if (...) ... | B.cs:18:25:18:27 | {...} |
| B.cs:18:9:20:26 | if (...) ... | B.cs:20:13:20:26 | ...; |
| B.cs:18:25:18:27 | {...} | B.cs:22:9:24:37 | if (...) ... |
| B.cs:20:13:20:26 | ...; | B.cs:22:9:24:37 | if (...) ... |
| B.cs:22:9:24:37 | if (...) ... | B.cs:24:13:24:25 | access to local variable neqCallAlways |
| C.cs:10:16:10:23 | SSA def(o) | C.cs:11:17:11:28 | [false] !... |
| C.cs:11:13:11:30 | [false] !... | C.cs:16:9:19:9 | if (...) ... |
| C.cs:11:15:11:29 | [true] !... | C.cs:11:13:11:30 | [false] !... |
| C.cs:11:17:11:28 | [false] !... | C.cs:11:15:11:29 | [true] !... |
| C.cs:16:9:19:9 | if (...) ... | C.cs:16:13:16:24 | [true] !... |
| C.cs:16:13:16:24 | [true] !... | C.cs:18:13:18:13 | access to local variable o |
| C.cs:40:13:40:35 | SSA def(s) | C.cs:42:9:42:9 | access to local variable s |
| C.cs:55:13:55:36 | SSA def(o2) | C.cs:57:9:57:10 | access to local variable o2 |
| C.cs:62:13:62:46 | SSA def(o1) | C.cs:64:9:64:10 | access to local variable o1 |
| C.cs:66:13:66:46 | SSA def(o2) | C.cs:68:9:68:10 | access to local variable o2 |
| C.cs:94:13:94:45 | SSA def(o) | C.cs:95:15:95:15 | access to local variable o |
| C.cs:94:13:94:45 | SSA def(o) | C.cs:96:13:96:13 | access to local variable o |
| C.cs:102:13:102:23 | SSA def(list) | C.cs:103:27:103:30 | access to parameter list |
| C.cs:102:13:102:23 | SSA def(list) | C.cs:103:27:103:30 | access to parameter list |
| C.cs:103:9:107:9 | foreach (... ... in ...) ... | C.cs:103:22:103:22 | Int32 x |
| C.cs:103:9:107:9 | foreach (... ... in ...) ... | C.cs:106:13:106:16 | access to parameter list |
| C.cs:103:22:103:22 | Int32 x | C.cs:103:9:107:9 | foreach (... ... in ...) ... |
| C.cs:103:27:103:30 | access to parameter list | C.cs:103:9:107:9 | foreach (... ... in ...) ... |
| C.cs:159:9:159:16 | SSA def(s) | C.cs:162:13:162:13 | access to local variable s |
| C.cs:167:9:167:16 | SSA def(s) | C.cs:170:13:170:13 | access to local variable s |
| C.cs:178:13:178:20 | SSA def(s) | C.cs:177:13:177:13 | access to local variable s |
| C.cs:193:9:193:16 | SSA def(s) | C.cs:196:13:196:13 | access to local variable s |
| C.cs:197:13:197:20 | [b (line 192): true] SSA def(s) | C.cs:196:13:196:13 | access to local variable s |
| C.cs:201:16:201:19 | true | C.cs:203:13:203:13 | access to local variable s |
| C.cs:204:13:204:20 | SSA def(s) | C.cs:201:16:201:19 | true |
| C.cs:210:13:210:35 | SSA def(s) | C.cs:217:9:218:25 | if (...) ... |
| C.cs:214:13:214:20 | SSA def(s) | C.cs:217:9:218:25 | if (...) ... |
| C.cs:217:9:218:25 | if (...) ... | C.cs:218:13:218:13 | access to local variable s |
| C.cs:222:13:222:20 | SSA def(s) | C.cs:223:9:223:9 | access to local variable s |
| C.cs:229:22:229:22 | access to local variable s | C.cs:233:9:233:9 | access to local variable s |
| C.cs:229:33:229:40 | SSA def(s) | C.cs:229:22:229:22 | access to local variable s |
| C.cs:235:14:235:21 | SSA def(s) | C.cs:235:24:235:24 | access to local variable s |
| C.cs:235:24:235:24 | access to local variable s | C.cs:237:13:237:13 | access to local variable s |
| C.cs:235:35:235:42 | SSA def(s) | C.cs:235:24:235:24 | access to local variable s |
| C.cs:240:24:240:31 | SSA def(s) | C.cs:242:13:242:13 | access to local variable s |
| C.cs:248:15:248:22 | SSA def(a) | C.cs:249:9:249:9 | access to local variable a |
| C.cs:257:15:257:23 | SSA def(ia) | C.cs:260:9:260:10 | access to local variable ia |
| C.cs:257:15:257:23 | SSA def(ia) | C.cs:263:9:263:10 | access to local variable ia |
| C.cs:258:18:258:26 | SSA def(sa) | C.cs:261:20:261:21 | access to local variable sa |
| C.cs:258:18:258:26 | SSA def(sa) | C.cs:264:16:264:17 | access to local variable sa |
| D.cs:17:17:17:20 | null | D.cs:23:9:23:13 | access to parameter param |
| D.cs:26:32:26:36 | SSA param(param) | D.cs:32:9:32:13 | access to parameter param |
| D.cs:58:13:58:41 | SSA def(o5) | D.cs:61:9:62:26 | if (...) ... |
| D.cs:61:9:62:26 | if (...) ... | D.cs:62:13:62:14 | access to local variable o5 |
| D.cs:68:13:68:34 | SSA def(o7) | D.cs:69:18:69:36 | ... && ... |
| D.cs:69:18:69:36 | ... && ... | D.cs:73:13:73:14 | access to local variable o7 |
| D.cs:75:13:75:34 | SSA def(o8) | D.cs:76:34:76:35 | 42 |
| D.cs:76:21:76:43 | ... ? ... : ... | D.cs:79:9:80:26 | if (...) ... |
| D.cs:76:34:76:35 | 42 | D.cs:76:21:76:43 | ... ? ... : ... |
| D.cs:79:9:80:26 | if (...) ... | D.cs:81:9:82:26 | if (...) ... |
| D.cs:81:9:82:26 | if (...) ... | D.cs:82:13:82:14 | access to local variable o8 |
| D.cs:81:9:82:26 | if (...) ... | D.cs:82:13:82:26 | ...; |
| D.cs:81:9:82:26 | if (...) ... | D.cs:83:9:84:26 | if (...) ... |
| D.cs:82:13:82:26 | ...; | D.cs:83:9:84:26 | if (...) ... |
| D.cs:83:9:84:26 | if (...) ... | D.cs:84:13:84:14 | access to local variable o8 |
| D.cs:89:15:89:44 | SSA def(xs) | D.cs:91:13:91:14 | access to local variable xs |
| D.cs:89:15:89:44 | SSA def(xs) | D.cs:91:13:91:22 | ...; |
| D.cs:89:15:89:44 | SSA def(xs) | D.cs:93:9:94:30 | if (...) ... |
| D.cs:91:13:91:22 | ...; | D.cs:93:9:94:30 | if (...) ... |
| D.cs:93:9:94:30 | if (...) ... | D.cs:94:13:94:30 | ...; |
| D.cs:93:9:94:30 | if (...) ... | D.cs:94:21:94:22 | access to local variable xs |
| D.cs:93:9:94:30 | if (...) ... | D.cs:96:9:99:9 | if (...) ... |
| D.cs:94:13:94:30 | ...; | D.cs:96:9:99:9 | if (...) ... |
| D.cs:96:9:99:9 | if (...) ... | D.cs:97:9:99:9 | {...} |
| D.cs:96:9:99:9 | if (...) ... | D.cs:98:21:98:22 | access to local variable xs |
| D.cs:96:9:99:9 | if (...) ... | D.cs:101:9:102:35 | if (...) ... |
| D.cs:97:9:99:9 | {...} | D.cs:101:9:102:35 | if (...) ... |
| D.cs:101:9:102:35 | if (...) ... | D.cs:102:31:102:32 | access to local variable xs |
| D.cs:101:9:102:35 | if (...) ... | D.cs:102:31:102:32 | access to local variable xs |
| D.cs:101:9:102:35 | if (...) ... | D.cs:104:9:106:30 | if (...) ... |
| D.cs:102:13:102:35 | foreach (... ... in ...) ... | D.cs:102:26:102:26 | Int32 _ |
| D.cs:102:13:102:35 | foreach (... ... in ...) ... | D.cs:104:9:106:30 | if (...) ... |
| D.cs:102:26:102:26 | Int32 _ | D.cs:102:13:102:35 | foreach (... ... in ...) ... |
| D.cs:102:31:102:32 | access to local variable xs | D.cs:102:13:102:35 | foreach (... ... in ...) ... |
| D.cs:104:9:106:30 | if (...) ... | D.cs:105:19:105:20 | access to local variable xs |
| D.cs:104:9:106:30 | if (...) ... | D.cs:106:17:106:18 | access to local variable xs |
| D.cs:118:9:118:30 | SSA def(x) | D.cs:120:13:120:13 | access to local variable x |
| D.cs:125:35:125:35 | SSA param(a) | D.cs:127:32:127:32 | 0 |
| D.cs:125:35:125:35 | SSA param(a) | D.cs:127:32:127:32 | 0 |
| D.cs:125:44:125:44 | SSA param(b) | D.cs:127:32:127:32 | 0 |
| D.cs:125:44:125:44 | SSA param(b) | D.cs:127:36:127:36 | access to parameter a |
| D.cs:127:20:127:43 | ... ? ... : ... | D.cs:128:32:128:32 | 0 |
| D.cs:127:20:127:43 | ... ? ... : ... | D.cs:128:32:128:32 | 0 |
| D.cs:127:20:127:43 | ... ? ... : ... | D.cs:128:36:128:36 | access to parameter b |
| D.cs:127:32:127:32 | 0 | D.cs:127:20:127:43 | ... ? ... : ... |
| D.cs:127:32:127:32 | 0 | D.cs:127:20:127:43 | ... ? ... : ... |
| D.cs:127:36:127:36 | access to parameter a | D.cs:127:20:127:43 | ... ? ... : ... |
| D.cs:128:20:128:43 | ... ? ... : ... | D.cs:131:9:137:9 | {...} |
| D.cs:128:20:128:43 | ... ? ... : ... | D.cs:131:9:137:9 | {...} |
| D.cs:128:20:128:43 | ... ? ... : ... | D.cs:138:9:138:18 | ... ...; |
| D.cs:128:32:128:32 | 0 | D.cs:128:20:128:43 | ... ? ... : ... |
| D.cs:128:32:128:32 | 0 | D.cs:128:20:128:43 | ... ? ... : ... |
| D.cs:128:36:128:36 | access to parameter b | D.cs:128:20:128:43 | ... ? ... : ... |
| D.cs:131:9:137:9 | {...} | D.cs:132:29:132:29 | access to local variable i |
| D.cs:131:9:137:9 | {...} | D.cs:132:29:132:29 | access to local variable i |
| D.cs:132:29:132:29 | access to local variable i | D.cs:133:13:136:13 | {...} |
| D.cs:132:29:132:29 | access to local variable i | D.cs:133:13:136:13 | {...} |
| D.cs:132:29:132:29 | access to local variable i | D.cs:134:24:134:24 | access to parameter a |
| D.cs:132:29:132:29 | access to local variable i | D.cs:135:24:135:24 | access to parameter b |
| D.cs:132:29:132:29 | access to local variable i | D.cs:138:9:138:18 | ... ...; |
| D.cs:133:13:136:13 | {...} | D.cs:132:29:132:29 | access to local variable i |
| D.cs:133:13:136:13 | {...} | D.cs:132:29:132:29 | access to local variable i |
| D.cs:138:9:138:18 | ... ...; | D.cs:142:13:142:22 | ...; |
| D.cs:142:13:142:22 | ...; | D.cs:143:9:146:9 | for (...;...;...) ... |
| D.cs:143:9:146:9 | for (...;...;...) ... | D.cs:143:25:143:25 | access to local variable i |
| D.cs:143:25:143:25 | access to local variable i | D.cs:144:9:146:9 | {...} |
| D.cs:143:25:143:25 | access to local variable i | D.cs:145:20:145:20 | access to parameter a |
| D.cs:144:9:146:9 | {...} | D.cs:143:25:143:25 | access to local variable i |
| D.cs:149:36:149:38 | SSA param(obj) | D.cs:151:9:151:11 | access to parameter obj |
| D.cs:163:16:163:25 | SSA def(obj) | D.cs:168:9:170:9 | [exception: Exception] catch (...) {...} |
| D.cs:168:9:170:9 | [exception: Exception] catch (...) {...} | D.cs:168:26:168:26 | [exception: Exception] Exception e |
| D.cs:168:26:168:26 | [exception: Exception] Exception e | D.cs:171:9:171:11 | access to local variable obj |
| D.cs:240:9:240:16 | SSA def(o) | D.cs:241:29:241:32 | null |
| D.cs:240:9:240:16 | SSA def(o) | D.cs:241:36:241:37 | "" |
| D.cs:241:21:241:37 | ... ? ... : ... | D.cs:244:9:247:25 | if (...) ... |
| D.cs:241:29:241:32 | null | D.cs:241:21:241:37 | ... ? ... : ... |
| D.cs:241:36:241:37 | "" | D.cs:241:21:241:37 | ... ? ... : ... |
| D.cs:244:9:247:25 | if (...) ... | D.cs:245:13:245:13 | access to local variable o |
| D.cs:244:9:247:25 | if (...) ... | D.cs:247:13:247:13 | access to local variable o |
| D.cs:249:13:249:38 | SSA def(o2) | D.cs:253:13:253:14 | access to local variable o2 |
| D.cs:258:16:258:23 | SSA def(o) | D.cs:266:9:267:25 | if (...) ... |
| D.cs:266:9:267:25 | if (...) ... | D.cs:266:13:266:27 | [true] ... is ... |
| D.cs:266:13:266:27 | [true] ... is ... | D.cs:267:13:267:13 | access to local variable o |
| D.cs:269:9:269:16 | SSA def(o) | D.cs:272:25:272:25 | access to local variable i |
| D.cs:272:25:272:25 | access to local variable i | D.cs:273:9:288:9 | {...} |
| D.cs:272:25:272:25 | access to local variable i | D.cs:290:9:291:25 | if (...) ... |
| D.cs:272:39:272:39 | access to local variable i | D.cs:272:25:272:25 | access to local variable i |
| D.cs:273:9:288:9 | {...} | D.cs:281:13:287:13 | if (...) ... |
| D.cs:281:13:287:13 | if (...) ... | D.cs:272:39:272:39 | access to local variable i |
| D.cs:283:17:283:24 | SSA def(o) | D.cs:285:28:285:30 | {...} |
| D.cs:283:17:283:24 | SSA def(o) | D.cs:286:17:286:30 | ...; |
| D.cs:285:28:285:30 | {...} | D.cs:286:17:286:30 | ...; |
| D.cs:286:17:286:30 | ...; | D.cs:272:39:272:39 | access to local variable i |
| D.cs:290:9:291:25 | if (...) ... | D.cs:291:13:291:13 | access to local variable o |
| D.cs:290:9:291:25 | if (...) ... | D.cs:291:13:291:25 | ...; |
| D.cs:290:9:291:25 | if (...) ... | D.cs:293:9:294:25 | if (...) ... |
| D.cs:291:13:291:25 | ...; | D.cs:293:9:294:25 | if (...) ... |
| D.cs:293:9:294:25 | if (...) ... | D.cs:294:13:294:13 | access to local variable o |
| D.cs:296:16:296:26 | SSA def(prev) | D.cs:297:25:297:25 | access to local variable i |
| D.cs:297:25:297:25 | access to local variable i | D.cs:298:9:302:9 | {...} |
| D.cs:298:9:302:9 | {...} | D.cs:300:17:300:20 | access to local variable prev |
| D.cs:304:16:304:23 | SSA def(s) | D.cs:307:13:311:13 | foreach (... ... in ...) ... |
| D.cs:307:13:311:13 | foreach (... ... in ...) ... | D.cs:312:13:313:29 | if (...) ... |
| D.cs:312:13:313:29 | if (...) ... | D.cs:312:17:312:23 | [true] !... |
| D.cs:312:17:312:23 | [true] !... | D.cs:313:17:313:17 | access to local variable s |
| D.cs:316:16:316:23 | SSA def(r) | D.cs:318:16:318:19 | access to local variable stat |
| D.cs:318:16:318:19 | access to local variable stat | D.cs:318:16:318:62 | [false] ... && ... |
| D.cs:318:16:318:19 | access to local variable stat | D.cs:318:41:318:44 | access to local variable stat |
| D.cs:318:16:318:62 | [false] ... && ... | D.cs:324:9:324:9 | access to local variable r |
| D.cs:318:41:318:44 | access to local variable stat | D.cs:318:16:318:62 | [false] ... && ... |
| D.cs:351:15:351:22 | SSA def(a) | D.cs:355:9:356:21 | for (...;...;...) ... |
| D.cs:355:9:356:21 | for (...;...;...) ... | D.cs:355:25:355:25 | access to local variable i |
| D.cs:355:25:355:25 | access to local variable i | D.cs:356:13:356:13 | access to local variable a |
| D.cs:355:25:355:25 | access to local variable i | D.cs:356:13:356:21 | ...; |
| D.cs:356:13:356:21 | ...; | D.cs:355:25:355:25 | access to local variable i |
| D.cs:360:20:360:30 | SSA def(last) | D.cs:361:29:361:29 | access to local variable i |
| D.cs:361:29:361:29 | access to local variable i | D.cs:363:13:363:16 | access to local variable last |
| D.cs:366:15:366:47 | SSA def(b) | D.cs:367:13:367:56 | [false] ... && ... |
| D.cs:367:13:367:56 | [false] ... && ... | D.cs:370:9:373:9 | for (...;...;...) ... |
| D.cs:370:9:373:9 | for (...;...;...) ... | D.cs:370:25:370:25 | access to local variable i |
| D.cs:370:25:370:25 | access to local variable i | D.cs:371:9:373:9 | {...} |
| D.cs:370:25:370:25 | access to local variable i | D.cs:372:13:372:13 | access to local variable b |
| D.cs:371:9:373:9 | {...} | D.cs:370:25:370:25 | access to local variable i |
| D.cs:378:19:378:28 | SSA def(ioe) | D.cs:382:9:385:27 | if (...) ... |
| D.cs:382:9:385:27 | if (...) ... | D.cs:385:13:385:15 | access to local variable ioe |
| D.cs:388:36:388:36 | SSA param(a) | D.cs:390:32:390:32 | 0 |
| D.cs:388:45:388:45 | SSA param(b) | D.cs:390:32:390:32 | 0 |
| D.cs:388:45:388:45 | SSA param(b) | D.cs:390:36:390:36 | access to parameter a |
| D.cs:390:20:390:43 | ... ? ... : ... | D.cs:393:21:393:21 | access to local variable i |
| D.cs:390:20:390:43 | ... ? ... : ... | D.cs:393:21:393:21 | access to local variable i |
| D.cs:390:32:390:32 | 0 | D.cs:390:20:390:43 | ... ? ... : ... |
| D.cs:390:32:390:32 | 0 | D.cs:390:20:390:43 | ... ? ... : ... |
| D.cs:390:36:390:36 | access to parameter a | D.cs:390:20:390:43 | ... ? ... : ... |
| D.cs:393:21:393:21 | access to local variable i | D.cs:394:9:396:9 | {...} |
| D.cs:393:21:393:21 | access to local variable i | D.cs:394:9:396:9 | {...} |
| D.cs:393:21:393:21 | access to local variable i | D.cs:395:20:395:20 | access to parameter a |
| D.cs:393:21:393:21 | access to local variable i | D.cs:397:9:397:44 | ... ...; |
| D.cs:394:9:396:9 | {...} | D.cs:393:21:393:21 | access to local variable i |
| D.cs:394:9:396:9 | {...} | D.cs:393:21:393:21 | access to local variable i |
| D.cs:397:9:397:44 | ... ...; | D.cs:397:32:397:32 | 0 |
| D.cs:397:20:397:43 | ... ? ... : ... | D.cs:398:21:398:21 | access to local variable i |
| D.cs:397:32:397:32 | 0 | D.cs:397:20:397:43 | ... ? ... : ... |
| D.cs:398:21:398:21 | access to local variable i | D.cs:399:9:401:9 | {...} |
| D.cs:398:21:398:21 | access to local variable i | D.cs:400:20:400:20 | access to parameter b |
| D.cs:399:9:401:9 | {...} | D.cs:398:21:398:21 | access to local variable i |
| D.cs:405:35:405:35 | SSA param(x) | D.cs:407:14:407:35 | [false] ... && ... |
| D.cs:405:35:405:35 | SSA param(x) | D.cs:407:14:407:35 | [false] ... && ... |
| D.cs:405:35:405:35 | SSA param(x) | D.cs:407:14:407:35 | [false] ... && ... |
| D.cs:405:45:405:45 | SSA param(y) | D.cs:407:14:407:35 | [false] ... && ... |
| D.cs:405:45:405:45 | SSA param(y) | D.cs:407:14:407:35 | [false] ... && ... |
| D.cs:405:45:405:45 | SSA param(y) | D.cs:407:14:407:35 | [false] ... && ... |
| D.cs:407:13:407:64 | [false] ... \|\| ... | D.cs:409:9:410:25 | if (...) ... |
| D.cs:407:13:407:64 | [false] ... \|\| ... | D.cs:409:9:410:25 | if (...) ... |
| D.cs:407:14:407:35 | [false] ... && ... | D.cs:407:42:407:42 | access to parameter x |
| D.cs:407:14:407:35 | [false] ... && ... | D.cs:407:42:407:42 | access to parameter x |
| D.cs:407:42:407:42 | access to parameter x | D.cs:407:42:407:63 | [false] ... && ... |
| D.cs:407:42:407:42 | access to parameter x | D.cs:407:55:407:55 | access to parameter y |
| D.cs:407:42:407:42 | access to parameter x | D.cs:407:55:407:55 | access to parameter y |
| D.cs:407:42:407:63 | [false] ... && ... | D.cs:407:13:407:64 | [false] ... \|\| ... |
| D.cs:407:42:407:63 | [false] ... && ... | D.cs:407:13:407:64 | [false] ... \|\| ... |
| D.cs:407:55:407:55 | access to parameter y | D.cs:407:42:407:63 | [false] ... && ... |
| D.cs:407:55:407:55 | access to parameter y | D.cs:407:42:407:63 | [false] ... && ... |
| D.cs:409:9:410:25 | if (...) ... | D.cs:410:13:410:13 | access to parameter y |
| D.cs:409:9:410:25 | if (...) ... | D.cs:411:9:412:25 | if (...) ... |
| D.cs:411:9:412:25 | if (...) ... | D.cs:412:13:412:13 | access to parameter x |
| E.cs:9:18:9:26 | SSA def(a2) | E.cs:10:22:10:54 | ... && ... |
| E.cs:10:22:10:54 | ... && ... | E.cs:12:38:12:39 | access to local variable a2 |
| E.cs:11:16:11:24 | SSA def(a3) | E.cs:12:22:12:52 | ... && ... |
| E.cs:12:22:12:52 | ... && ... | E.cs:14:13:14:14 | access to local variable a3 |
| E.cs:23:13:23:30 | SSA def(s1) | E.cs:24:33:24:36 | null |
| E.cs:24:18:24:41 | ... ? ... : ... | E.cs:26:9:27:26 | if (...) ... |
| E.cs:24:33:24:36 | null | E.cs:24:18:24:41 | ... ? ... : ... |
| E.cs:26:9:27:26 | if (...) ... | E.cs:27:13:27:14 | access to local variable s1 |
| E.cs:51:22:51:33 | SSA def(slice) | E.cs:53:16:53:19 | access to local variable iter |
| E.cs:53:16:53:19 | access to local variable iter | E.cs:54:9:63:9 | {...} |
| E.cs:54:9:63:9 | {...} | E.cs:61:13:61:17 | access to local variable slice |
| E.cs:54:9:63:9 | {...} | E.cs:61:13:61:27 | ...; |
| E.cs:61:13:61:27 | ...; | E.cs:53:16:53:19 | access to local variable iter |
| E.cs:66:40:66:42 | SSA param(arr) | E.cs:70:13:70:50 | ...; |
| E.cs:66:40:66:42 | SSA param(arr) | E.cs:72:9:73:23 | if (...) ... |
| E.cs:70:13:70:50 | ...; | E.cs:70:36:70:36 | 0 |
| E.cs:70:22:70:49 | ... ? ... : ... | E.cs:72:9:73:23 | if (...) ... |
| E.cs:70:36:70:36 | 0 | E.cs:70:22:70:49 | ... ? ... : ... |
| E.cs:72:9:73:23 | if (...) ... | E.cs:73:13:73:15 | access to parameter arr |
| E.cs:107:15:107:25 | SSA def(arr2) | E.cs:111:9:112:30 | for (...;...;...) ... |
| E.cs:111:9:112:30 | for (...;...;...) ... | E.cs:111:25:111:25 | access to local variable i |
| E.cs:111:25:111:25 | access to local variable i | E.cs:112:13:112:16 | access to local variable arr2 |
| E.cs:111:25:111:25 | access to local variable i | E.cs:112:13:112:30 | ...; |
| E.cs:112:13:112:30 | ...; | E.cs:111:25:111:25 | access to local variable i |
| E.cs:120:16:120:20 | [true] !... | E.cs:121:9:143:9 | {...} |
| E.cs:120:17:120:20 | access to local variable stop | E.cs:120:16:120:20 | [true] !... |
| E.cs:121:9:143:9 | {...} | E.cs:123:21:123:24 | access to local variable stop |
| E.cs:123:20:123:24 | [false] !... | E.cs:123:20:123:35 | [false] ... && ... |
| E.cs:123:20:123:24 | [true] !... | E.cs:123:29:123:29 | access to local variable j |
| E.cs:123:20:123:35 | [false] ... && ... | E.cs:120:17:120:20 | access to local variable stop |
| E.cs:123:20:123:35 | [true] ... && ... | E.cs:124:13:142:13 | {...} |
| E.cs:123:20:123:35 | [true] ... && ... | E.cs:125:33:125:35 | access to local variable obj |
| E.cs:123:21:123:24 | access to local variable stop | E.cs:123:20:123:24 | [false] !... |
| E.cs:123:21:123:24 | access to local variable stop | E.cs:123:20:123:24 | [true] !... |
| E.cs:123:29:123:29 | access to local variable j | E.cs:123:20:123:35 | [false] ... && ... |
| E.cs:123:29:123:29 | access to local variable j | E.cs:123:20:123:35 | [true] ... && ... |
| E.cs:124:13:142:13 | {...} | E.cs:128:21:128:23 | access to local variable obj |
| E.cs:124:13:142:13 | {...} | E.cs:141:17:141:26 | ...; |
| E.cs:137:25:137:34 | SSA def(obj) | E.cs:139:21:139:29 | continue; |
| E.cs:139:21:139:29 | continue; | E.cs:123:21:123:24 | access to local variable stop |
| E.cs:141:17:141:26 | ...; | E.cs:123:21:123:24 | access to local variable stop |
| E.cs:152:16:152:26 | SSA def(obj2) | E.cs:153:13:153:54 | [false] ... && ... |
| E.cs:153:13:153:54 | [false] ... && ... | E.cs:158:9:159:28 | if (...) ... |
| E.cs:158:9:159:28 | if (...) ... | E.cs:159:13:159:16 | access to local variable obj2 |
| E.cs:162:28:162:28 | SSA param(a) | E.cs:164:29:164:29 | 0 |
| E.cs:164:17:164:40 | ... ? ... : ... | E.cs:165:25:165:25 | access to local variable i |
| E.cs:164:29:164:29 | 0 | E.cs:164:17:164:40 | ... ? ... : ... |
| E.cs:165:25:165:25 | access to local variable i | E.cs:166:9:170:9 | {...} |
| E.cs:165:25:165:25 | access to local variable i | E.cs:167:21:167:21 | access to parameter a |
| E.cs:165:32:165:32 | access to local variable i | E.cs:165:25:165:25 | access to local variable i |
| E.cs:166:9:170:9 | {...} | E.cs:165:32:165:32 | access to local variable i |
| E.cs:173:29:173:31 | SSA param(obj) | E.cs:175:33:175:37 | false |
| E.cs:173:29:173:31 | SSA param(obj) | E.cs:175:33:175:37 | false |
| E.cs:175:19:175:42 | ... ? ... : ... | E.cs:177:9:179:9 | {...} |
| E.cs:175:19:175:42 | ... ? ... : ... | E.cs:178:13:178:15 | access to parameter obj |
| E.cs:175:19:175:42 | ... ? ... : ... | E.cs:180:9:183:9 | if (...) ... |
| E.cs:175:33:175:37 | false | E.cs:175:19:175:42 | ... ? ... : ... |
| E.cs:177:9:179:9 | {...} | E.cs:180:9:183:9 | if (...) ... |
| E.cs:180:9:183:9 | if (...) ... | E.cs:181:9:183:9 | {...} |
| E.cs:181:9:183:9 | {...} | E.cs:184:9:187:9 | if (...) ... |
| E.cs:184:9:187:9 | if (...) ... | E.cs:186:13:186:15 | access to parameter obj |
| E.cs:190:29:190:29 | SSA param(o) | E.cs:192:17:192:17 | access to parameter o |
| E.cs:198:13:198:29 | [b (line 196): false] SSA def(o) | E.cs:203:13:203:13 | access to local variable o |
| E.cs:198:13:198:29 | [b (line 196): true] SSA def(o) | E.cs:201:13:201:13 | access to local variable o |
| E.cs:206:28:206:28 | SSA param(s) | E.cs:208:13:208:23 | [false] ... is ... |
| E.cs:208:13:208:23 | [false] ... is ... | E.cs:210:16:210:16 | access to parameter s |
| E.cs:217:13:217:20 | [b (line 213): true] SSA def(x) | E.cs:218:9:218:9 | access to local variable x |
| E.cs:217:13:217:20 | [b (line 213): true] SSA def(x) | E.cs:220:13:220:13 | access to local variable x |
| E.cs:227:13:227:20 | [b (line 223): true] SSA def(x) | E.cs:229:13:229:13 | access to local variable x |
| E.cs:227:13:227:20 | [b (line 223): true] SSA def(x) | E.cs:229:13:229:25 | ...; |
| E.cs:229:13:229:25 | ...; | E.cs:230:9:230:9 | access to local variable x |
| E.cs:233:26:233:26 | SSA param(i) | E.cs:235:16:235:16 | access to parameter i |
| E.cs:238:26:238:26 | SSA param(i) | E.cs:240:21:240:21 | access to parameter i |
| E.cs:283:13:283:22 | [b (line 279): false] SSA def(o) | E.cs:285:9:285:9 | access to local variable o |
| E.cs:283:13:283:22 | [b (line 279): true] SSA def(o) | E.cs:285:9:285:9 | access to local variable o |
| E.cs:301:13:301:27 | SSA def(s) | E.cs:302:9:302:9 | access to local variable s |
| E.cs:319:29:319:30 | SSA param(s1) | E.cs:321:20:321:21 | access to parameter s2 |
| E.cs:321:13:321:30 | [true] ... is ... | E.cs:323:13:323:14 | access to parameter s1 |
| E.cs:321:14:321:21 | ... ?? ... | E.cs:321:13:321:30 | [true] ... is ... |
| E.cs:321:20:321:21 | access to parameter s2 | E.cs:321:14:321:21 | ... ?? ... |
| E.cs:330:13:330:36 | SSA def(x) | E.cs:331:9:331:9 | access to local variable x |
| E.cs:342:13:342:32 | SSA def(x) | E.cs:343:9:343:9 | access to local variable x |
| E.cs:348:17:348:36 | SSA def(x) | E.cs:349:9:349:9 | access to local variable x |
| E.cs:366:28:366:28 | SSA param(s) | E.cs:366:41:366:41 | access to parameter s |
| E.cs:374:17:374:31 | SSA def(s) | E.cs:375:20:375:20 | access to local variable s |
| E.cs:380:24:380:25 | SSA param(e1) | E.cs:382:28:382:29 | access to parameter e2 |
| E.cs:380:24:380:25 | SSA param(e1) | E.cs:382:28:382:29 | access to parameter e2 |
| E.cs:380:24:380:25 | SSA param(e1) | E.cs:382:28:382:29 | access to parameter e2 |
| E.cs:380:30:380:31 | SSA param(e2) | E.cs:382:14:382:37 | [false] ... && ... |
| E.cs:380:30:380:31 | SSA param(e2) | E.cs:382:14:382:37 | [false] ... && ... |
| E.cs:380:30:380:31 | SSA param(e2) | E.cs:382:14:382:37 | [false] ... && ... |
| E.cs:380:30:380:31 | SSA param(e2) | E.cs:382:28:382:29 | access to parameter e2 |
| E.cs:380:30:380:31 | SSA param(e2) | E.cs:382:28:382:29 | access to parameter e2 |
| E.cs:380:30:380:31 | SSA param(e2) | E.cs:382:28:382:29 | access to parameter e2 |
| E.cs:382:13:382:68 | [false] ... \|\| ... | E.cs:384:9:385:24 | if (...) ... |
| E.cs:382:13:382:68 | [false] ... \|\| ... | E.cs:384:9:385:24 | if (...) ... |
| E.cs:382:14:382:37 | [false] ... && ... | E.cs:382:44:382:45 | access to parameter e1 |
| E.cs:382:14:382:37 | [false] ... && ... | E.cs:382:44:382:45 | access to parameter e1 |
| E.cs:382:28:382:29 | access to parameter e2 | E.cs:382:14:382:37 | [false] ... && ... |
| E.cs:382:28:382:29 | access to parameter e2 | E.cs:382:14:382:37 | [false] ... && ... |
| E.cs:382:44:382:45 | access to parameter e1 | E.cs:382:44:382:67 | [false] ... && ... |
| E.cs:382:44:382:45 | access to parameter e1 | E.cs:382:44:382:67 | [false] ... && ... |
| E.cs:382:44:382:67 | [false] ... && ... | E.cs:382:13:382:68 | [false] ... \|\| ... |
| E.cs:382:44:382:67 | [false] ... && ... | E.cs:382:13:382:68 | [false] ... \|\| ... |
| E.cs:384:9:385:24 | if (...) ... | E.cs:384:13:384:36 | [false] ... && ... |
| E.cs:384:9:385:24 | if (...) ... | E.cs:384:27:384:28 | access to parameter e2 |
| E.cs:384:13:384:36 | [false] ... && ... | E.cs:386:16:386:17 | access to parameter e1 |
| E.cs:384:13:384:36 | [false] ... && ... | E.cs:386:27:386:28 | access to parameter e2 |
| E.cs:384:27:384:28 | access to parameter e2 | E.cs:384:13:384:36 | [false] ... && ... |
| E.cs:404:9:404:18 | SSA def(i) | E.cs:405:16:405:16 | access to local variable i |
| E.cs:404:9:404:18 | SSA def(i) | E.cs:405:16:405:16 | access to local variable i |
| E.cs:417:24:417:40 | SSA capture def(i) | E.cs:417:34:417:34 | access to parameter i |
| E.cs:423:28:423:44 | SSA capture def(i) | E.cs:423:38:423:38 | access to parameter i |
| E.cs:430:29:430:45 | SSA capture def(i) | E.cs:430:39:430:39 | access to parameter i |
| E.cs:435:29:435:29 | SSA param(s) | E.cs:437:13:437:21 | [true] ... is ... |
| E.cs:437:13:437:21 | [true] ... is ... | E.cs:439:13:439:13 | access to parameter s |
| Forwarding.cs:7:16:7:23 | SSA def(s) | Forwarding.cs:9:13:9:30 | [false] !... |
| Forwarding.cs:9:13:9:30 | [false] !... | Forwarding.cs:14:9:17:9 | if (...) ... |
| Forwarding.cs:14:9:17:9 | if (...) ... | Forwarding.cs:19:9:22:9 | if (...) ... |
| Forwarding.cs:19:9:22:9 | if (...) ... | Forwarding.cs:19:13:19:23 | [false] !... |
| Forwarding.cs:19:13:19:23 | [false] !... | Forwarding.cs:24:9:27:9 | if (...) ... |
| Forwarding.cs:24:9:27:9 | if (...) ... | Forwarding.cs:29:9:32:9 | if (...) ... |
| Forwarding.cs:29:9:32:9 | if (...) ... | Forwarding.cs:34:9:37:9 | if (...) ... |
| Forwarding.cs:34:9:37:9 | if (...) ... | Forwarding.cs:35:9:37:9 | {...} |
| Forwarding.cs:34:9:37:9 | if (...) ... | Forwarding.cs:36:31:36:31 | access to local variable s |
| Forwarding.cs:35:9:37:9 | {...} | Forwarding.cs:40:27:40:27 | access to local variable s |
| GuardedString.cs:7:16:7:32 | SSA def(s) | GuardedString.cs:9:13:9:36 | [false] !... |
| GuardedString.cs:9:13:9:36 | [false] !... | GuardedString.cs:14:9:17:9 | if (...) ... |
| GuardedString.cs:14:9:17:9 | if (...) ... | GuardedString.cs:14:13:14:41 | [false] !... |
| GuardedString.cs:14:13:14:41 | [false] !... | GuardedString.cs:19:9:20:40 | if (...) ... |
| GuardedString.cs:19:9:20:40 | if (...) ... | GuardedString.cs:19:26:19:26 | 0 |
| GuardedString.cs:19:26:19:26 | 0 | GuardedString.cs:22:9:23:40 | if (...) ... |
| GuardedString.cs:22:9:23:40 | if (...) ... | GuardedString.cs:22:25:22:25 | 0 |
| GuardedString.cs:22:25:22:25 | 0 | GuardedString.cs:25:9:26:40 | if (...) ... |
| GuardedString.cs:25:9:26:40 | if (...) ... | GuardedString.cs:25:26:25:26 | 0 |
| GuardedString.cs:25:26:25:26 | 0 | GuardedString.cs:28:9:29:40 | if (...) ... |
| GuardedString.cs:28:9:29:40 | if (...) ... | GuardedString.cs:28:25:28:26 | 10 |
| GuardedString.cs:28:25:28:26 | 10 | GuardedString.cs:31:9:32:40 | if (...) ... |
| GuardedString.cs:31:9:32:40 | if (...) ... | GuardedString.cs:31:26:31:27 | 10 |
| GuardedString.cs:31:26:31:27 | 10 | GuardedString.cs:34:9:37:40 | if (...) ... |
| GuardedString.cs:34:9:37:40 | if (...) ... | GuardedString.cs:34:26:34:26 | 0 |
| GuardedString.cs:34:26:34:26 | 0 | GuardedString.cs:35:31:35:31 | access to local variable s |
| NullAlwaysBad.cs:7:29:7:29 | SSA param(s) | NullAlwaysBad.cs:9:30:9:30 | access to parameter s |
| NullMaybeBad.cs:13:17:13:20 | null | NullMaybeBad.cs:7:27:7:27 | access to parameter o |
| Params.cs:20:12:20:15 | null | Params.cs:14:17:14:20 | access to parameter args |
| StringConcatenation.cs:14:16:14:23 | SSA def(s) | StringConcatenation.cs:15:16:15:16 | access to local variable s |
| StringConcatenation.cs:15:16:15:16 | access to local variable s | StringConcatenation.cs:16:17:16:17 | access to local variable s |
#select
| C.cs:64:9:64:10 | access to local variable o1 | C.cs:62:13:62:46 | SSA def(o1) | C.cs:64:9:64:10 | access to local variable o1 | Variable $@ may be null at this access because of $@ assignment. | C.cs:62:13:62:14 | o1 | o1 | C.cs:62:13:62:46 | Object o1 = ... | this |
| C.cs:68:9:68:10 | access to local variable o2 | C.cs:66:13:66:46 | SSA def(o2) | C.cs:68:9:68:10 | access to local variable o2 | Variable $@ may be null at this access because of $@ assignment. | C.cs:66:13:66:14 | o2 | o2 | C.cs:66:13:66:46 | Object o2 = ... | this |
| C.cs:95:15:95:15 | access to local variable o | C.cs:94:13:94:45 | SSA def(o) | C.cs:95:15:95:15 | access to local variable o | Variable $@ may be null at this access because of $@ assignment. | C.cs:94:13:94:13 | o | o | C.cs:94:13:94:45 | Object o = ... | this |
| C.cs:103:27:103:30 | access to parameter list | C.cs:102:13:102:23 | SSA def(list) | C.cs:103:27:103:30 | access to parameter list | Variable $@ may be null at this access because of $@ assignment. | C.cs:99:42:99:45 | list | list | C.cs:102:13:102:23 | ... = ... | this |
| C.cs:177:13:177:13 | access to local variable s | C.cs:178:13:178:20 | SSA def(s) | C.cs:177:13:177:13 | access to local variable s | Variable $@ may be null at this access because of $@ assignment. | C.cs:151:13:151:13 | s | s | C.cs:178:13:178:20 | ... = ... | this |
| C.cs:203:13:203:13 | access to local variable s | C.cs:204:13:204:20 | SSA def(s) | C.cs:203:13:203:13 | access to local variable s | Variable $@ may be null at this access because of $@ assignment. | C.cs:185:13:185:13 | s | s | C.cs:204:13:204:20 | ... = ... | this |
| C.cs:223:9:223:9 | access to local variable s | C.cs:222:13:222:20 | SSA def(s) | C.cs:223:9:223:9 | access to local variable s | Variable $@ may be null at this access because of $@ assignment. | C.cs:210:13:210:13 | s | s | C.cs:222:13:222:20 | ... = ... | this |
| C.cs:242:13:242:13 | access to local variable s | C.cs:240:24:240:31 | SSA def(s) | C.cs:242:13:242:13 | access to local variable s | Variable $@ may be null at this access because of $@ assignment. | C.cs:228:16:228:16 | s | s | C.cs:240:24:240:31 | ... = ... | this |
| D.cs:23:9:23:13 | access to parameter param | D.cs:17:17:17:20 | null | D.cs:23:9:23:13 | access to parameter param | Variable $@ may be null at this access because of $@ null argument. | D.cs:21:32:21:36 | param | param | D.cs:17:17:17:20 | null | this |
| D.cs:32:9:32:13 | access to parameter param | D.cs:26:32:26:36 | SSA param(param) | D.cs:32:9:32:13 | access to parameter param | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:26:32:26:36 | param | param | D.cs:28:13:28:25 | ... != ... | this |
| D.cs:62:13:62:14 | access to local variable o5 | D.cs:58:13:58:41 | SSA def(o5) | D.cs:62:13:62:14 | access to local variable o5 | Variable $@ may be null at this access because of $@ assignment. | D.cs:58:13:58:14 | o5 | o5 | D.cs:58:13:58:41 | String o5 = ... | this |
| D.cs:73:13:73:14 | access to local variable o7 | D.cs:68:13:68:34 | SSA def(o7) | D.cs:73:13:73:14 | access to local variable o7 | Variable $@ may be null at this access because of $@ assignment. | D.cs:68:13:68:14 | o7 | o7 | D.cs:68:13:68:34 | String o7 = ... | this |
| D.cs:82:13:82:14 | access to local variable o8 | D.cs:75:13:75:34 | SSA def(o8) | D.cs:82:13:82:14 | access to local variable o8 | Variable $@ may be null at this access because of $@ assignment. | D.cs:75:13:75:14 | o8 | o8 | D.cs:75:13:75:34 | String o8 = ... | this |
| D.cs:84:13:84:14 | access to local variable o8 | D.cs:75:13:75:34 | SSA def(o8) | D.cs:84:13:84:14 | access to local variable o8 | Variable $@ may be null at this access because of $@ assignment. | D.cs:75:13:75:14 | o8 | o8 | D.cs:75:13:75:34 | String o8 = ... | this |
| D.cs:91:13:91:14 | access to local variable xs | D.cs:89:15:89:44 | SSA def(xs) | D.cs:91:13:91:14 | access to local variable xs | Variable $@ may be null at this access because of $@ assignment. | D.cs:89:15:89:16 | xs | xs | D.cs:89:15:89:44 | Int32[] xs = ... | this |
| D.cs:94:21:94:22 | access to local variable xs | D.cs:89:15:89:44 | SSA def(xs) | D.cs:94:21:94:22 | access to local variable xs | Variable $@ may be null at this access because of $@ assignment. | D.cs:89:15:89:16 | xs | xs | D.cs:89:15:89:44 | Int32[] xs = ... | this |
| D.cs:98:21:98:22 | access to local variable xs | D.cs:89:15:89:44 | SSA def(xs) | D.cs:98:21:98:22 | access to local variable xs | Variable $@ may be null at this access because of $@ assignment. | D.cs:89:15:89:16 | xs | xs | D.cs:89:15:89:44 | Int32[] xs = ... | this |
| D.cs:102:31:102:32 | access to local variable xs | D.cs:89:15:89:44 | SSA def(xs) | D.cs:102:31:102:32 | access to local variable xs | Variable $@ may be null at this access because of $@ assignment. | D.cs:89:15:89:16 | xs | xs | D.cs:89:15:89:44 | Int32[] xs = ... | this |
| D.cs:105:19:105:20 | access to local variable xs | D.cs:89:15:89:44 | SSA def(xs) | D.cs:105:19:105:20 | access to local variable xs | Variable $@ may be null at this access because of $@ assignment. | D.cs:89:15:89:16 | xs | xs | D.cs:89:15:89:44 | Int32[] xs = ... | this |
| D.cs:134:24:134:24 | access to parameter a | D.cs:125:35:125:35 | SSA param(a) | D.cs:134:24:134:24 | access to parameter a | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:125:35:125:35 | a | a | D.cs:127:20:127:28 | ... == ... | this |
| D.cs:134:24:134:24 | access to parameter a | D.cs:125:35:125:35 | SSA param(a) | D.cs:134:24:134:24 | access to parameter a | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:125:35:125:35 | a | a | D.cs:139:13:139:21 | ... != ... | this |
| D.cs:135:24:135:24 | access to parameter b | D.cs:125:44:125:44 | SSA param(b) | D.cs:135:24:135:24 | access to parameter b | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:125:44:125:44 | b | b | D.cs:128:20:128:28 | ... == ... | this |
| D.cs:145:20:145:20 | access to parameter a | D.cs:125:35:125:35 | SSA param(a) | D.cs:145:20:145:20 | access to parameter a | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:125:35:125:35 | a | a | D.cs:127:20:127:28 | ... == ... | this |
| D.cs:145:20:145:20 | access to parameter a | D.cs:125:35:125:35 | SSA param(a) | D.cs:145:20:145:20 | access to parameter a | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:125:35:125:35 | a | a | D.cs:139:13:139:21 | ... != ... | this |
| D.cs:151:9:151:11 | access to parameter obj | D.cs:149:36:149:38 | SSA param(obj) | D.cs:151:9:151:11 | access to parameter obj | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:149:36:149:38 | obj | obj | D.cs:152:17:152:27 | ... != ... | this |
| D.cs:171:9:171:11 | access to local variable obj | D.cs:163:16:163:25 | SSA def(obj) | D.cs:171:9:171:11 | access to local variable obj | Variable $@ may be null at this access because of $@ assignment. | D.cs:163:16:163:18 | obj | obj | D.cs:163:16:163:25 | Object obj = ... | this |
| D.cs:245:13:245:13 | access to local variable o | D.cs:240:9:240:16 | SSA def(o) | D.cs:245:13:245:13 | access to local variable o | Variable $@ may be null at this access because of $@ assignment. | D.cs:228:16:228:16 | o | o | D.cs:240:9:240:16 | ... = ... | this |
| D.cs:247:13:247:13 | access to local variable o | D.cs:240:9:240:16 | SSA def(o) | D.cs:247:13:247:13 | access to local variable o | Variable $@ may be null at this access because of $@ assignment. | D.cs:228:16:228:16 | o | o | D.cs:240:9:240:16 | ... = ... | this |
| D.cs:253:13:253:14 | access to local variable o2 | D.cs:249:13:249:38 | SSA def(o2) | D.cs:253:13:253:14 | access to local variable o2 | Variable $@ may be null at this access because of $@ assignment. | D.cs:249:13:249:14 | o2 | o2 | D.cs:249:13:249:38 | String o2 = ... | this |
| D.cs:267:13:267:13 | access to local variable o | D.cs:258:16:258:23 | SSA def(o) | D.cs:267:13:267:13 | access to local variable o | Variable $@ may be null at this access because of $@ assignment. | D.cs:258:16:258:16 | o | o | D.cs:258:16:258:23 | Object o = ... | this |
| D.cs:291:13:291:13 | access to local variable o | D.cs:269:9:269:16 | SSA def(o) | D.cs:291:13:291:13 | access to local variable o | Variable $@ may be null at this access because of $@ assignment. | D.cs:258:16:258:16 | o | o | D.cs:269:9:269:16 | ... = ... | this |
| D.cs:291:13:291:13 | access to local variable o | D.cs:283:17:283:24 | SSA def(o) | D.cs:291:13:291:13 | access to local variable o | Variable $@ may be null at this access because of $@ assignment. | D.cs:258:16:258:16 | o | o | D.cs:283:17:283:24 | ... = ... | this |
| D.cs:294:13:294:13 | access to local variable o | D.cs:269:9:269:16 | SSA def(o) | D.cs:294:13:294:13 | access to local variable o | Variable $@ may be null at this access because of $@ assignment. | D.cs:258:16:258:16 | o | o | D.cs:269:9:269:16 | ... = ... | this |
| D.cs:294:13:294:13 | access to local variable o | D.cs:283:17:283:24 | SSA def(o) | D.cs:294:13:294:13 | access to local variable o | Variable $@ may be null at this access because of $@ assignment. | D.cs:258:16:258:16 | o | o | D.cs:283:17:283:24 | ... = ... | this |
| D.cs:300:17:300:20 | access to local variable prev | D.cs:296:16:296:26 | SSA def(prev) | D.cs:300:17:300:20 | access to local variable prev | Variable $@ may be null at this access because of $@ assignment. | D.cs:296:16:296:19 | prev | prev | D.cs:296:16:296:26 | Object prev = ... | this |
| D.cs:313:17:313:17 | access to local variable s | D.cs:304:16:304:23 | SSA def(s) | D.cs:313:17:313:17 | access to local variable s | Variable $@ may be null at this access because of $@ assignment. | D.cs:304:16:304:16 | s | s | D.cs:304:16:304:23 | String s = ... | this |
| D.cs:324:9:324:9 | access to local variable r | D.cs:316:16:316:23 | SSA def(r) | D.cs:324:9:324:9 | access to local variable r | Variable $@ may be null at this access because of $@ assignment. | D.cs:316:16:316:16 | r | r | D.cs:316:16:316:23 | Object r = ... | this |
| D.cs:356:13:356:13 | access to local variable a | D.cs:351:15:351:22 | SSA def(a) | D.cs:356:13:356:13 | access to local variable a | Variable $@ may be null at this access because of $@ assignment. | D.cs:351:15:351:15 | a | a | D.cs:351:15:351:22 | Int32[] a = ... | this |
| D.cs:363:13:363:16 | access to local variable last | D.cs:360:20:360:30 | SSA def(last) | D.cs:363:13:363:16 | access to local variable last | Variable $@ may be null at this access because of $@ assignment. | D.cs:360:20:360:23 | last | last | D.cs:360:20:360:30 | String last = ... | this |
| D.cs:372:13:372:13 | access to local variable b | D.cs:366:15:366:47 | SSA def(b) | D.cs:372:13:372:13 | access to local variable b | Variable $@ may be null at this access because of $@ assignment. | D.cs:366:15:366:15 | b | b | D.cs:366:15:366:47 | Int32[] b = ... | this |
| D.cs:395:20:395:20 | access to parameter a | D.cs:388:36:388:36 | SSA param(a) | D.cs:395:20:395:20 | access to parameter a | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:388:36:388:36 | a | a | D.cs:390:20:390:28 | ... == ... | this |
| D.cs:400:20:400:20 | access to parameter b | D.cs:388:45:388:45 | SSA param(b) | D.cs:400:20:400:20 | access to parameter b | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:388:45:388:45 | b | b | D.cs:397:20:397:28 | ... == ... | this |
| D.cs:410:13:410:13 | access to parameter y | D.cs:405:45:405:45 | SSA param(y) | D.cs:410:13:410:13 | access to parameter y | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:405:45:405:45 | y | y | D.cs:407:27:407:35 | ... == ... | this |
| D.cs:410:13:410:13 | access to parameter y | D.cs:405:45:405:45 | SSA param(y) | D.cs:410:13:410:13 | access to parameter y | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:405:45:405:45 | y | y | D.cs:407:55:407:63 | ... != ... | this |
| D.cs:410:13:410:13 | access to parameter y | D.cs:405:45:405:45 | SSA param(y) | D.cs:410:13:410:13 | access to parameter y | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:405:45:405:45 | y | y | D.cs:411:13:411:21 | ... != ... | this |
| D.cs:412:13:412:13 | access to parameter x | D.cs:405:35:405:35 | SSA param(x) | D.cs:412:13:412:13 | access to parameter x | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:405:35:405:35 | x | x | D.cs:407:14:407:22 | ... != ... | this |
| D.cs:412:13:412:13 | access to parameter x | D.cs:405:35:405:35 | SSA param(x) | D.cs:412:13:412:13 | access to parameter x | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:405:35:405:35 | x | x | D.cs:407:42:407:50 | ... == ... | this |
| D.cs:412:13:412:13 | access to parameter x | D.cs:405:35:405:35 | SSA param(x) | D.cs:412:13:412:13 | access to parameter x | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:405:35:405:35 | x | x | D.cs:409:13:409:21 | ... != ... | this |
| E.cs:12:38:12:39 | access to local variable a2 | E.cs:9:18:9:26 | SSA def(a2) | E.cs:12:38:12:39 | access to local variable a2 | Variable $@ may be null at this access because of $@ assignment. | E.cs:9:18:9:19 | a2 | a2 | E.cs:9:18:9:26 | Int64[][] a2 = ... | this |
| E.cs:14:13:14:14 | access to local variable a3 | E.cs:11:16:11:24 | SSA def(a3) | E.cs:14:13:14:14 | access to local variable a3 | Variable $@ may be null at this access because of $@ assignment. | E.cs:11:16:11:17 | a3 | a3 | E.cs:11:16:11:24 | Int64[] a3 = ... | this |
| E.cs:27:13:27:14 | access to local variable s1 | E.cs:23:13:23:30 | SSA def(s1) | E.cs:27:13:27:14 | access to local variable s1 | Variable $@ may be null at this access because of $@ assignment. | E.cs:19:13:19:14 | s1 | s1 | E.cs:23:13:23:30 | ... = ... | this |
| E.cs:61:13:61:17 | access to local variable slice | E.cs:51:22:51:33 | SSA def(slice) | E.cs:61:13:61:17 | access to local variable slice | Variable $@ may be null at this access because of $@ assignment. | E.cs:51:22:51:26 | slice | slice | E.cs:51:22:51:33 | List<String> slice = ... | this |
| E.cs:73:13:73:15 | access to parameter arr | E.cs:66:40:66:42 | SSA param(arr) | E.cs:73:13:73:15 | access to parameter arr | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:66:40:66:42 | arr | arr | E.cs:70:22:70:32 | ... == ... | this |
| E.cs:112:13:112:16 | access to local variable arr2 | E.cs:107:15:107:25 | SSA def(arr2) | E.cs:112:13:112:16 | access to local variable arr2 | Variable $@ may be null at this access because of $@ assignment. | E.cs:107:15:107:18 | arr2 | arr2 | E.cs:107:15:107:25 | Int32[] arr2 = ... | this |
| E.cs:125:33:125:35 | access to local variable obj | E.cs:137:25:137:34 | SSA def(obj) | E.cs:125:33:125:35 | access to local variable obj | Variable $@ may be null at this access because of $@ assignment. | E.cs:119:13:119:15 | obj | obj | E.cs:137:25:137:34 | ... = ... | this |
| E.cs:159:13:159:16 | access to local variable obj2 | E.cs:152:16:152:26 | SSA def(obj2) | E.cs:159:13:159:16 | access to local variable obj2 | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:152:16:152:19 | obj2 | obj2 | E.cs:153:13:153:24 | ... != ... | this |
| E.cs:167:21:167:21 | access to parameter a | E.cs:162:28:162:28 | SSA param(a) | E.cs:167:21:167:21 | access to parameter a | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:162:28:162:28 | a | a | E.cs:164:17:164:25 | ... == ... | this |
| E.cs:178:13:178:15 | access to parameter obj | E.cs:173:29:173:31 | SSA param(obj) | E.cs:178:13:178:15 | access to parameter obj | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:173:29:173:31 | obj | obj | E.cs:175:19:175:29 | ... == ... | this |
| E.cs:178:13:178:15 | access to parameter obj | E.cs:173:29:173:31 | SSA param(obj) | E.cs:178:13:178:15 | access to parameter obj | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:173:29:173:31 | obj | obj | E.cs:180:13:180:23 | ... == ... | this |
| E.cs:186:13:186:15 | access to parameter obj | E.cs:173:29:173:31 | SSA param(obj) | E.cs:186:13:186:15 | access to parameter obj | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:173:29:173:31 | obj | obj | E.cs:175:19:175:29 | ... == ... | this |
| E.cs:186:13:186:15 | access to parameter obj | E.cs:173:29:173:31 | SSA param(obj) | E.cs:186:13:186:15 | access to parameter obj | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:173:29:173:31 | obj | obj | E.cs:180:13:180:23 | ... == ... | this |
| E.cs:192:17:192:17 | access to parameter o | E.cs:190:29:190:29 | SSA param(o) | E.cs:192:17:192:17 | access to parameter o | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:190:29:190:29 | o | o | E.cs:193:17:193:17 | access to parameter o | this |
| E.cs:201:13:201:13 | access to local variable o | E.cs:198:13:198:29 | [b (line 196): true] SSA def(o) | E.cs:201:13:201:13 | access to local variable o | Variable $@ may be null at this access because of $@ assignment. | E.cs:198:13:198:13 | o | o | E.cs:198:13:198:29 | String o = ... | this |
| E.cs:203:13:203:13 | access to local variable o | E.cs:198:13:198:29 | [b (line 196): false] SSA def(o) | E.cs:203:13:203:13 | access to local variable o | Variable $@ may be null at this access because of $@ assignment. | E.cs:198:13:198:13 | o | o | E.cs:198:13:198:29 | String o = ... | this |
| E.cs:218:9:218:9 | access to local variable x | E.cs:217:13:217:20 | [b (line 213): true] SSA def(x) | E.cs:218:9:218:9 | access to local variable x | Variable $@ may be null at this access because of $@ assignment. | E.cs:215:13:215:13 | x | x | E.cs:217:13:217:20 | ... = ... | this |
| E.cs:230:9:230:9 | access to local variable x | E.cs:227:13:227:20 | [b (line 223): true] SSA def(x) | E.cs:230:9:230:9 | access to local variable x | Variable $@ may be null at this access because of $@ assignment. | E.cs:225:13:225:13 | x | x | E.cs:227:13:227:20 | ... = ... | this |
| E.cs:235:16:235:16 | access to parameter i | E.cs:233:26:233:26 | SSA param(i) | E.cs:235:16:235:16 | access to parameter i | Variable $@ may be null at this access because it has a nullable type. | E.cs:233:26:233:26 | i | i | E.cs:233:26:233:26 | i | this |
| E.cs:240:21:240:21 | access to parameter i | E.cs:238:26:238:26 | SSA param(i) | E.cs:240:21:240:21 | access to parameter i | Variable $@ may be null at this access because it has a nullable type. | E.cs:238:26:238:26 | i | i | E.cs:238:26:238:26 | i | this |
| E.cs:285:9:285:9 | access to local variable o | E.cs:283:13:283:22 | [b (line 279): false] SSA def(o) | E.cs:285:9:285:9 | access to local variable o | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:283:13:283:13 | o | o | E.cs:284:9:284:9 | access to local variable o | this |
| E.cs:285:9:285:9 | access to local variable o | E.cs:283:13:283:22 | [b (line 279): true] SSA def(o) | E.cs:285:9:285:9 | access to local variable o | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:283:13:283:13 | o | o | E.cs:284:9:284:9 | access to local variable o | this |
| E.cs:302:9:302:9 | access to local variable s | E.cs:301:13:301:27 | SSA def(s) | E.cs:302:9:302:9 | access to local variable s | Variable $@ may be null at this access because of $@ assignment. | E.cs:301:13:301:13 | s | s | E.cs:301:13:301:27 | String s = ... | this |
| E.cs:343:9:343:9 | access to local variable x | E.cs:342:13:342:32 | SSA def(x) | E.cs:343:9:343:9 | access to local variable x | Variable $@ may be null at this access because of $@ assignment. | E.cs:342:13:342:13 | x | x | E.cs:342:13:342:32 | String x = ... | this |
| E.cs:349:9:349:9 | access to local variable x | E.cs:348:17:348:36 | SSA def(x) | E.cs:349:9:349:9 | access to local variable x | Variable $@ may be null at this access because of $@ assignment. | E.cs:348:17:348:17 | x | x | E.cs:348:17:348:36 | dynamic x = ... | this |
| E.cs:366:41:366:41 | access to parameter s | E.cs:366:28:366:28 | SSA param(s) | E.cs:366:41:366:41 | access to parameter s | Variable $@ may be null at this access because the parameter has a null default value. | E.cs:366:28:366:28 | s | s | E.cs:366:32:366:35 | null | this |
| E.cs:375:20:375:20 | access to local variable s | E.cs:374:17:374:31 | SSA def(s) | E.cs:375:20:375:20 | access to local variable s | Variable $@ may be null at this access because of $@ assignment. | E.cs:374:17:374:17 | s | s | E.cs:374:17:374:31 | String s = ... | this |
| E.cs:386:16:386:17 | access to parameter e1 | E.cs:380:24:380:25 | SSA param(e1) | E.cs:386:16:386:17 | access to parameter e1 | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:380:24:380:25 | e1 | e1 | E.cs:382:14:382:23 | ... == ... | this |
| E.cs:386:16:386:17 | access to parameter e1 | E.cs:380:24:380:25 | SSA param(e1) | E.cs:386:16:386:17 | access to parameter e1 | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:380:24:380:25 | e1 | e1 | E.cs:382:44:382:53 | ... != ... | this |
| E.cs:386:16:386:17 | access to parameter e1 | E.cs:380:24:380:25 | SSA param(e1) | E.cs:386:16:386:17 | access to parameter e1 | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:380:24:380:25 | e1 | e1 | E.cs:384:13:384:22 | ... == ... | this |
| E.cs:386:27:386:28 | access to parameter e2 | E.cs:380:30:380:31 | SSA param(e2) | E.cs:386:27:386:28 | access to parameter e2 | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:380:30:380:31 | e2 | e2 | E.cs:382:28:382:37 | ... != ... | this |
| E.cs:386:27:386:28 | access to parameter e2 | E.cs:380:30:380:31 | SSA param(e2) | E.cs:386:27:386:28 | access to parameter e2 | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:380:30:380:31 | e2 | e2 | E.cs:382:58:382:67 | ... == ... | this |
| E.cs:386:27:386:28 | access to parameter e2 | E.cs:380:30:380:31 | SSA param(e2) | E.cs:386:27:386:28 | access to parameter e2 | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:380:30:380:31 | e2 | e2 | E.cs:384:27:384:36 | ... == ... | this |
| E.cs:417:34:417:34 | access to parameter i | E.cs:417:24:417:40 | SSA capture def(i) | E.cs:417:34:417:34 | access to parameter i | Variable $@ may be null at this access because it has a nullable type. | E.cs:415:27:415:27 | i | i | E.cs:415:27:415:27 | i | this |
| E.cs:423:38:423:38 | access to parameter i | E.cs:423:28:423:44 | SSA capture def(i) | E.cs:423:38:423:38 | access to parameter i | Variable $@ may be null at this access because it has a nullable type. | E.cs:420:27:420:27 | i | i | E.cs:420:27:420:27 | i | this |
| E.cs:430:39:430:39 | access to parameter i | E.cs:430:29:430:45 | SSA capture def(i) | E.cs:430:39:430:39 | access to parameter i | Variable $@ may be null at this access because it has a nullable type. | E.cs:427:27:427:27 | i | i | E.cs:427:27:427:27 | i | this |
| GuardedString.cs:35:31:35:31 | access to local variable s | GuardedString.cs:7:16:7:32 | SSA def(s) | GuardedString.cs:35:31:35:31 | access to local variable s | Variable $@ may be null at this access because of $@ assignment. | GuardedString.cs:7:16:7:16 | s | s | GuardedString.cs:7:16:7:32 | String s = ... | this |
| NullMaybeBad.cs:7:27:7:27 | access to parameter o | NullMaybeBad.cs:13:17:13:20 | null | NullMaybeBad.cs:7:27:7:27 | access to parameter o | Variable $@ may be null at this access because of $@ null argument. | NullMaybeBad.cs:5:25:5:25 | o | o | NullMaybeBad.cs:13:17:13:20 | null | this |
| Params.cs:14:17:14:20 | access to parameter args | Params.cs:20:12:20:15 | null | Params.cs:14:17:14:20 | access to parameter args | Variable $@ may be null at this access because of $@ null argument. | Params.cs:12:36:12:39 | args | args | Params.cs:20:12:20:15 | null | this |
| StringConcatenation.cs:16:17:16:17 | access to local variable s | StringConcatenation.cs:14:16:14:23 | SSA def(s) | StringConcatenation.cs:16:17:16:17 | access to local variable s | Variable $@ may be null at this access because of $@ assignment. | StringConcatenation.cs:14:16:14:16 | s | s | StringConcatenation.cs:14:16:14:23 | String s = ... | this |

3
csharp/ql/test/query-tests/Nullness/NullMaybe.qlref
View File

@@ -1 +1,2 @@
CSI/NullMaybe.ql
query: CSI/NullMaybe.ql
postprocess: utils/test/InlineExpectationsTestQuery.ql

4
csharp/ql/test/query-tests/Nullness/NullMaybeBad.cs
View File

@@ -4,12 +4,12 @@ class Bad
{
void DoPrint(object o)
{
Console.WriteLine(o.ToString());
Console.WriteLine(o.ToString()); // $ Alert[cs/dereferenced-value-may-be-null]
}
void M()
{
DoPrint("Hello");
DoPrint(null);
DoPrint(null); // $ Source[cs/dereferenced-value-may-be-null]
}
}

6
csharp/ql/test/query-tests/Nullness/Params.cs
View File

@@ -11,12 +11,12 @@ public class Params
public void M2(params string[] args)
{
var l = args.Length; // Good
var l = args.Length; // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
}
public void M()
{
M1("a", "b", "c", null);
M2(null);
M2(null); // $ Source[cs/dereferenced-value-may-be-null]
}
}
}

4
csharp/ql/test/query-tests/Nullness/StringConcatenation.cs
View File

@@ -11,9 +11,9 @@ class StringsTest
void StringMaybeNull()
{
string s = null;
string s = null; // $ Source[cs/dereferenced-value-may-be-null]
while (s != "")
s = s.Trim(); // BAD (maybe)
s = s.Trim(); // $ Alert[cs/dereferenced-value-may-be-null]
}
void StringNotNull()

3
csharp/ql/test/query-tests/Nullness/options
View File

@@ -1,3 +1,4 @@
semmle-extractor-options: /nostdlib /noconfig
semmle-extractor-options: --load-sources-from-project:${testdir}/../../resources/stubs/_frameworks/Microsoft.NETCore.App/Microsoft.NETCore.App.csproj
semmle-extractor-options: ${testdir}/../../resources/stubs/Microsoft.VisualStudio.TestTools.UnitTesting.cs
semmle-extractor-options: ${testdir}/../../resources/stubs/Microsoft.VisualStudio.TestTools.UnitTesting.cs
semmle-extractor-options: ${testdir}/../../resources/stubs/Library.cs

13
csharp/ql/test/resources/stubs/Library.cs Normal file
View File

@@ -0,0 +1,13 @@
namespace Library;
/*
* This file is for making stubs for library methods used for testing purposes.
* The file is located in the stubs folder, because then the code is not
* recognized as being from source.
*/
public static class MyExtensions
{
public static void Accept(this object o) { }
public static void AcceptNullable(this object? o) { }
}

2
docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.19.4.rst
View File

@@ -79,4 +79,4 @@ JavaScript/TypeScript
* Added taint-steps for :code:`Array.prototype.toReversed`.
* Added taint-steps for :code:`Array.prototype.toSorted`.
* Added support for :code:`String.prototype.matchAll`.
* Added taint-steps for :code:`Array.prototype.reverse`.
* Added taint-steps for :code:`Array.prototype.reverse`.

82
docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.22.0.rst Normal file
View File

@@ -0,0 +1,82 @@
.. _codeql-cli-2.22.0:
==========================
CodeQL 2.22.0 (2025-06-11)
==========================
.. contents:: Contents
:depth: 2
:local:
:backlinks: none
This is an overview of changes in the CodeQL CLI and relevant CodeQL query and library packs. For additional updates on changes to the CodeQL code scanning experience, check out the `code scanning section on the GitHub blog <https://github.blog/tag/code-scanning/>`__, `relevant GitHub Changelog updates <https://github.blog/changelog/label/code-scanning/>`__, `changes in the CodeQL extension for Visual Studio Code <https://marketplace.visualstudio.com/items/GitHub.vscode-codeql/changelog>`__, and the `CodeQL Action changelog <https://github.com/github/codeql-action/blob/main/CHANGELOG.md>`__.
Security Coverage
-----------------
CodeQL 2.22.0 runs a total of 450 security queries when configured with the Default suite (covering 165 CWE). The Extended suite enables an additional 128 queries (covering 33 more CWE). 1 security query has been added with this release.
CodeQL CLI
----------
Breaking Changes
~~~~~~~~~~~~~~~~
* A number of breaking changes have been made to the C and C++ CodeQL test environment as used by :code:`codeql test run`\ :
* Options starting with a :code:`/` are no longer supported by
:code:`semmle-extractor-options`. Any option starting with a :code:`/` should be replaced by the equivalent option starting with a :code:`-`, e.g., :code:`/D` should be replaced by :code:`-D`.
* Preprocessor command line options of the form :code:`-D<macro>#<def>` are no longer supported by :code:`semmle-extractor-options`. :code:`-D<macro>=<def>` should be used instead.
* The :code:`/Fp` and :code:`-o` options are no longer supported by
:code:`semmle-extractor-options`. The options should be omitted.
* The :code:`-emit-pch`, :code:`-include-pch`, :code:`/Yc`, and :code:`/Yu` options, and the
:code:`--preinclude` option taking a pre-compiled header as its argument, are no longer supported by :code:`semmle-extractor-options`. Any test that makes use of this should be replaced by a test that invokes the CodeQL CLI with the
:code:`create database` option and that runs the relevant queries on the created database.
Query Packs
-----------
Minor Analysis Improvements
~~~~~~~~~~~~~~~~~~~~~~~~~~~
Python
""""""
* Added SQL injection models from the :code:`pandas` PyPI package.
New Queries
~~~~~~~~~~~
Golang
""""""
* Query (:code:`go/html-template-escaping-bypass-xss`) has been promoted to the main query suite. This query finds potential cross-site scripting (XSS) vulnerabilities when using the :code:`html/template` package, caused by user input being cast to a type which bypasses the HTML autoescaping. It was originally contributed to the experimental query pack by @gagliardetto in `https://github.com/github/codeql-go/pull/493 <https://github.com/github/codeql-go/pull/493>`_.
Language Libraries
------------------
Minor Analysis Improvements
~~~~~~~~~~~~~~~~~~~~~~~~~~~
Golang
""""""
* The first argument of :code:`Client.Query` in :code:`cloud.google.com/go/bigquery` is now recognized as a SQL injection sink.
JavaScript/TypeScript
"""""""""""""""""""""
* Added taint flow through the :code:`URL` constructor from the :code:`url` package, improving the identification of SSRF vulnerabilities.
Swift
"""""
* Updated to allow analysis of Swift 6.1.2.
New Features
~~~~~~~~~~~~
C/C++
"""""
* Added a predicate :code:`getReferencedMember` to :code:`UsingDeclarationEntry`, which yields a member depending on a type template parameter.

1
docs/codeql/codeql-overview/codeql-changelog/index.rst
View File

@@ -11,6 +11,7 @@ A list of queries for each suite and language `is available here <https://docs.g
.. toctree::
:maxdepth: 1
codeql-cli-2.22.0
codeql-cli-2.21.4
codeql-cli-2.21.3
codeql-cli-2.21.2

2
go/ql/src/CHANGELOG.md
View File

@@ -2,7 +2,7 @@
### New Queries
* Query (`go/html-template-escaping-bypass-xss`) has been promoted to the main query suite. This query finds potential cross-site scripting (XSS) vulnerabilities when using the `html/template` package, caused by user input being cast to a type which bypasses the HTML autoescaping. It was originally contributed to the experimental query pack by @gagliardetto in <https://github.com/github/codeql-go/pull/493>.
* Query (`go/html-template-escaping-bypass-xss`) has been promoted to the main query suite. This query finds potential cross-site scripting (XSS) vulnerabilities when using the `html/template` package, caused by user input being cast to a type which bypasses the HTML autoescaping. It was originally contributed to the experimental query pack by @gagliardetto in https://github.com/github/codeql-go/pull/493.
## 1.2.1

2
go/ql/src/change-notes/released/1.3.0.md
View File

@@ -2,4 +2,4 @@
### New Queries
* Query (`go/html-template-escaping-bypass-xss`) has been promoted to the main query suite. This query finds potential cross-site scripting (XSS) vulnerabilities when using the `html/template` package, caused by user input being cast to a type which bypasses the HTML autoescaping. It was originally contributed to the experimental query pack by @gagliardetto in <https://github.com/github/codeql-go/pull/493>.
* Query (`go/html-template-escaping-bypass-xss`) has been promoted to the main query suite. This query finds potential cross-site scripting (XSS) vulnerabilities when using the `html/template` package, caused by user input being cast to a type which bypasses the HTML autoescaping. It was originally contributed to the experimental query pack by @gagliardetto in https://github.com/github/codeql-go/pull/493.

1
java/ql/integration-tests/java/query-suite/java-code-scanning.qls.expected
View File

@@ -12,7 +12,6 @@ ql/java/ql/src/Security/CWE/CWE-023/PartialPathTraversalFromRemote.ql
ql/java/ql/src/Security/CWE/CWE-074/JndiInjection.ql
ql/java/ql/src/Security/CWE/CWE-074/XsltInjection.ql
ql/java/ql/src/Security/CWE/CWE-078/ExecTainted.ql
ql/java/ql/src/Security/CWE/CWE-078/ExecUnescaped.ql
ql/java/ql/src/Security/CWE/CWE-079/XSS.ql
ql/java/ql/src/Security/CWE/CWE-089/SqlTainted.ql
ql/java/ql/src/Security/CWE/CWE-090/LdapInjection.ql

2
java/ql/src/Security/CWE/CWE-078/ExecUnescaped.ql
View File

@@ -5,7 +5,7 @@
* @kind problem
* @problem.severity error
* @security-severity 9.8
* @precision high
* @precision medium
* @id java/concatenated-command-line
* @tags security
* external/cwe/cwe-078

2
java/ql/src/Security/CWE/CWE-134/ExternallyControlledFormatString.ql
View File

@@ -3,7 +3,7 @@
* @description Using external input in format strings can lead to exceptions or information leaks.
* @kind path-problem
* @problem.severity error
* @security-severity 9.3
* @security-severity 7.3
* @precision high
* @id java/tainted-format-string
* @tags security

4
java/ql/src/change-notes/2025-06-06-reduce-CWE-134-for-memory-safe-languages.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: queryMetadata
---
* Adjusts the `@security-severity` from 9.3 to 7.3 for `java/tainted-format-string` to align `CWE-134` severity for memory safe languages to better reflect their impact.

4
java/ql/src/change-notes/2025-06-10-reduce-precision-for-building-cmdline-with-string-concatenation.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: queryMetadata
---
* Adjusts the `@precision` from high to medium for `java/concatenated-command-line` because it is producing false positive alerts when the concatenated strings are hard-coded.

6
javascript/extractor/src/com/semmle/js/extractor/ScopeManager.java
View File

@@ -426,7 +426,6 @@ public class ScopeManager {
// cases where we turn on the 'declKind' flags
@Override
public Void visit(FunctionDeclaration nd, Void v) {
if (nd.hasDeclareKeyword() && !isInTypeScriptDeclarationFile()) return null;
// strict mode functions are block-scoped, non-strict mode ones aren't
if (blockscope == isStrict) visit(nd.getId(), DeclKind.var);
return null;
@@ -434,7 +433,6 @@ public class ScopeManager {
@Override
public Void visit(ClassDeclaration nd, Void c) {
if (nd.hasDeclareKeyword() && !isInTypeScriptDeclarationFile()) return null;
if (blockscope) visit(nd.getClassDef().getId(), DeclKind.varAndType);
return null;
}
@@ -483,7 +481,6 @@ public class ScopeManager {
@Override
public Void visit(VariableDeclaration nd, Void v) {
if (nd.hasDeclareKeyword() && !isInTypeScriptDeclarationFile()) return null;
// in block scoping mode, only process 'let'; in non-block scoping
// mode, only process non-'let'
if (blockscope == nd.isBlockScoped(ecmaVersion)) visit(nd.getDeclarations());
@@ -518,8 +515,7 @@ public class ScopeManager {
@Override
public Void visit(NamespaceDeclaration nd, Void c) {
if (blockscope) return null;
boolean isAmbientOutsideDtsFile = nd.hasDeclareKeyword() && !isInTypeScriptDeclarationFile();
boolean hasVariable = nd.isInstantiated() && !isAmbientOutsideDtsFile;
boolean hasVariable = nd.isInstantiated();
visit(nd.getName(), hasVariable ? DeclKind.varAndNamespace : DeclKind.namespace);
return null;
}

2286
javascript/extractor/tests/ts/output/trap/conditionalTypes.ts.trap
View File

File diff suppressed because it is too large Load Diff

103
javascript/extractor/tests/ts/output/trap/declareClass.ts.trap
View File

@@ -50,61 +50,64 @@ toplevels(#20001,0)
#20016=@"loc,{#10000},1,1,2,0"
locations_default(#20016,#10000,1,1,2,0)
hasLocation(#20001,#20016)
#20017=*
stmts(#20017,26,#20001,0,"declare class C {}")
hasLocation(#20017,#20003)
stmt_containers(#20017,#20001)
has_declare_keyword(#20017)
#20018=*
exprs(#20018,78,#20017,0,"C")
hasLocation(#20018,#20009)
enclosing_stmt(#20018,#20017)
expr_containers(#20018,#20001)
literals("C","C",#20018)
#20019=@"var;{C};{#20000}"
variables(#20019,"C",#20000)
decl(#20018,#20019)
#20017=@"var;{C};{#20000}"
variables(#20017,"C",#20000)
#20018=@"local_type_name;{C};{#20000}"
local_type_names(#20018,"C",#20000)
#20019=*
stmts(#20019,26,#20001,0,"declare class C {}")
hasLocation(#20019,#20003)
stmt_containers(#20019,#20001)
has_declare_keyword(#20019)
#20020=*
scopes(#20020,10)
scopenodes(#20017,#20020)
scopenesting(#20020,#20000)
exprs(#20020,78,#20019,0,"C")
hasLocation(#20020,#20009)
enclosing_stmt(#20020,#20019)
expr_containers(#20020,#20001)
literals("C","C",#20020)
decl(#20020,#20017)
typedecl(#20020,#20018)
#20021=*
properties(#20021,#20017,2,0,"constructor() {}")
#20022=@"loc,{#10000},1,17,1,16"
locations_default(#20022,#10000,1,17,1,16)
hasLocation(#20021,#20022)
#20023=*
exprs(#20023,0,#20021,0,"constructor")
hasLocation(#20023,#20022)
enclosing_stmt(#20023,#20017)
expr_containers(#20023,#20001)
literals("constructor","constructor",#20023)
scopes(#20021,10)
scopenodes(#20019,#20021)
scopenesting(#20021,#20000)
#20022=*
properties(#20022,#20019,2,0,"constructor() {}")
#20023=@"loc,{#10000},1,17,1,16"
locations_default(#20023,#10000,1,17,1,16)
hasLocation(#20022,#20023)
#20024=*
exprs(#20024,9,#20021,1,"() {}")
hasLocation(#20024,#20022)
enclosing_stmt(#20024,#20017)
exprs(#20024,0,#20022,0,"constructor")
hasLocation(#20024,#20023)
enclosing_stmt(#20024,#20019)
expr_containers(#20024,#20001)
literals("constructor","constructor",#20024)
#20025=*
scopes(#20025,1)
scopenodes(#20024,#20025)
scopenesting(#20025,#20020)
#20026=@"var;{arguments};{#20025}"
variables(#20026,"arguments",#20025)
is_arguments_object(#20026)
#20027=*
stmts(#20027,1,#20024,-2,"{}")
hasLocation(#20027,#20022)
stmt_containers(#20027,#20024)
is_method(#20021)
exprs(#20025,9,#20022,1,"() {}")
hasLocation(#20025,#20023)
enclosing_stmt(#20025,#20019)
expr_containers(#20025,#20001)
#20026=*
scopes(#20026,1)
scopenodes(#20025,#20026)
scopenesting(#20026,#20021)
#20027=@"var;{arguments};{#20026}"
variables(#20027,"arguments",#20026)
is_arguments_object(#20027)
#20028=*
entry_cfg_node(#20028,#20001)
#20029=@"loc,{#10000},1,1,1,0"
locations_default(#20029,#10000,1,1,1,0)
hasLocation(#20028,#20029)
#20030=*
exit_cfg_node(#20030,#20001)
hasLocation(#20030,#20015)
successor(#20017,#20030)
successor(#20028,#20017)
stmts(#20028,1,#20025,-2,"{}")
hasLocation(#20028,#20023)
stmt_containers(#20028,#20025)
is_method(#20022)
#20029=*
entry_cfg_node(#20029,#20001)
#20030=@"loc,{#10000},1,1,1,0"
locations_default(#20030,#10000,1,1,1,0)
hasLocation(#20029,#20030)
#20031=*
exit_cfg_node(#20031,#20001)
hasLocation(#20031,#20015)
successor(#20019,#20031)
successor(#20029,#20019)
numlines(#10000,1,1,0)
filetype(#10000,"typescript")

131
javascript/extractor/tests/ts/output/trap/functiondecorators.ts.trap
View File

@@ -584,62 +584,63 @@ toplevels(#20001,0)
#20221=@"loc,{#10000},1,1,16,0"
locations_default(#20221,#10000,1,1,16,0)
hasLocation(#20001,#20221)
#20222=@"var;{C};{#20000}"
variables(#20222,"C",#20000)
#20223=@"local_type_name;{C};{#20000}"
local_type_names(#20223,"C",#20000)
#20224=*
stmts(#20224,18,#20001,0,"declare var A : any;")
hasLocation(#20224,#20003)
stmt_containers(#20224,#20001)
has_declare_keyword(#20224)
#20225=*
exprs(#20225,64,#20224,0,"A : any")
#20226=@"loc,{#10000},1,13,1,19"
locations_default(#20226,#10000,1,13,1,19)
hasLocation(#20225,#20226)
enclosing_stmt(#20225,#20224)
expr_containers(#20225,#20001)
#20222=@"var;{A};{#20000}"
variables(#20222,"A",#20000)
#20223=@"var;{B};{#20000}"
variables(#20223,"B",#20000)
#20224=@"var;{C};{#20000}"
variables(#20224,"C",#20000)
variables(#20224,"C",#20000)
#20225=@"local_type_name;{C};{#20000}"
local_type_names(#20225,"C",#20000)
#20226=*
stmts(#20226,18,#20001,0,"declare var A : any;")
hasLocation(#20226,#20003)
stmt_containers(#20226,#20001)
has_declare_keyword(#20226)
#20227=*
exprs(#20227,78,#20225,0,"A")
hasLocation(#20227,#20037)
enclosing_stmt(#20227,#20224)
exprs(#20227,64,#20226,0,"A : any")
#20228=@"loc,{#10000},1,13,1,19"
locations_default(#20228,#10000,1,13,1,19)
hasLocation(#20227,#20228)
enclosing_stmt(#20227,#20226)
expr_containers(#20227,#20001)
literals("A","A",#20227)
#20228=@"var;{A};{#20000}"
variables(#20228,"A",#20000)
decl(#20227,#20228)
#20229=*
typeexprs(#20229,2,#20225,2,"any")
hasLocation(#20229,#20041)
enclosing_stmt(#20229,#20224)
exprs(#20229,78,#20227,0,"A")
hasLocation(#20229,#20037)
enclosing_stmt(#20229,#20226)
expr_containers(#20229,#20001)
literals("any","any",#20229)
literals("A","A",#20229)
decl(#20229,#20222)
#20230=*
stmts(#20230,18,#20001,1,"declare var B : any;")
hasLocation(#20230,#20005)
stmt_containers(#20230,#20001)
has_declare_keyword(#20230)
typeexprs(#20230,2,#20227,2,"any")
hasLocation(#20230,#20041)
enclosing_stmt(#20230,#20226)
expr_containers(#20230,#20001)
literals("any","any",#20230)
#20231=*
exprs(#20231,64,#20230,0,"B : any")
#20232=@"loc,{#10000},2,13,2,19"
locations_default(#20232,#10000,2,13,2,19)
hasLocation(#20231,#20232)
enclosing_stmt(#20231,#20230)
expr_containers(#20231,#20001)
#20233=*
exprs(#20233,78,#20231,0,"B")
hasLocation(#20233,#20049)
enclosing_stmt(#20233,#20230)
expr_containers(#20233,#20001)
literals("B","B",#20233)
#20234=@"var;{B};{#20000}"
variables(#20234,"B",#20000)
decl(#20233,#20234)
stmts(#20231,18,#20001,1,"declare var B : any;")
hasLocation(#20231,#20005)
stmt_containers(#20231,#20001)
has_declare_keyword(#20231)
#20232=*
exprs(#20232,64,#20231,0,"B : any")
#20233=@"loc,{#10000},2,13,2,19"
locations_default(#20233,#10000,2,13,2,19)
hasLocation(#20232,#20233)
enclosing_stmt(#20232,#20231)
expr_containers(#20232,#20001)
#20234=*
exprs(#20234,78,#20232,0,"B")
hasLocation(#20234,#20049)
enclosing_stmt(#20234,#20231)
expr_containers(#20234,#20001)
literals("B","B",#20234)
decl(#20234,#20223)
#20235=*
typeexprs(#20235,2,#20231,2,"any")
typeexprs(#20235,2,#20232,2,"any")
hasLocation(#20235,#20053)
enclosing_stmt(#20235,#20230)
enclosing_stmt(#20235,#20231)
expr_containers(#20235,#20001)
literals("any","any",#20235)
#20236=*
@@ -660,7 +661,7 @@ hasLocation(#20239,#20061)
enclosing_stmt(#20239,#20236)
expr_containers(#20239,#20001)
literals("C","C",#20239)
decl(#20239,#20222)
decl(#20239,#20224)
#20240=*
typeexprs(#20240,2,#20237,2,"any")
hasLocation(#20240,#20065)
@@ -679,8 +680,8 @@ hasLocation(#20243,#20071)
enclosing_stmt(#20243,#20241)
expr_containers(#20243,#20001)
literals("C","C",#20243)
decl(#20243,#20222)
typedecl(#20243,#20223)
decl(#20243,#20224)
typedecl(#20243,#20225)
#20244=*
scopes(#20244,10)
scopenodes(#20241,#20244)
@@ -769,7 +770,7 @@ exprs(#20266,79,#20265,0,"A")
hasLocation(#20266,#20093)
expr_containers(#20266,#20258)
literals("A","A",#20266)
bind(#20266,#20228)
bind(#20266,#20222)
#20267=*
stmts(#20267,1,#20258,-2,"{}")
#20268=@"loc,{#10000},7,12,7,13"
@@ -825,7 +826,7 @@ exprs(#20281,79,#20279,0,"A")
hasLocation(#20281,#20109)
expr_containers(#20281,#20272)
literals("A","A",#20281)
bind(#20281,#20228)
bind(#20281,#20222)
#20282=*
exprs(#20282,94,#20277,1,"@B")
#20283=@"loc,{#10000},8,9,8,10"
@@ -837,7 +838,7 @@ exprs(#20284,79,#20282,0,"B")
hasLocation(#20284,#20113)
expr_containers(#20284,#20272)
literals("B","B",#20284)
bind(#20284,#20234)
bind(#20284,#20223)
#20285=*
stmts(#20285,1,#20272,-2,"{}")
#20286=@"loc,{#10000},8,16,8,17"
@@ -899,7 +900,7 @@ exprs(#20300,79,#20299,0,"A")
hasLocation(#20300,#20133)
expr_containers(#20300,#20290)
literals("A","A",#20300)
bind(#20300,#20228)
bind(#20300,#20222)
#20301=*
stmts(#20301,1,#20290,-2,"{}")
#20302=@"loc,{#10000},10,18,10,19"
@@ -963,7 +964,7 @@ exprs(#20317,79,#20315,0,"A")
hasLocation(#20317,#20153)
expr_containers(#20317,#20306)
literals("A","A",#20317)
bind(#20317,#20228)
bind(#20317,#20222)
#20318=*
exprs(#20318,94,#20313,1,"@B")
#20319=@"loc,{#10000},11,15,11,16"
@@ -975,7 +976,7 @@ exprs(#20320,79,#20318,0,"B")
hasLocation(#20320,#20157)
expr_containers(#20320,#20306)
literals("B","B",#20320)
bind(#20320,#20234)
bind(#20320,#20223)
#20321=*
stmts(#20321,1,#20306,-2,"{}")
#20322=@"loc,{#10000},11,22,11,23"
@@ -1037,7 +1038,7 @@ exprs(#20336,79,#20335,0,"A")
hasLocation(#20336,#20173)
expr_containers(#20336,#20326)
literals("A","A",#20336)
bind(#20336,#20228)
bind(#20336,#20222)
#20337=*
exprs(#20337,104,#20326,-12,"@B")
#20338=@"loc,{#10000},13,12,13,13"
@@ -1053,7 +1054,7 @@ exprs(#20340,79,#20339,0,"B")
hasLocation(#20340,#20181)
expr_containers(#20340,#20326)
literals("B","B",#20340)
bind(#20340,#20234)
bind(#20340,#20223)
#20341=*
stmts(#20341,1,#20326,-2,"{}")
#20342=@"loc,{#10000},13,18,13,19"
@@ -1115,7 +1116,7 @@ exprs(#20356,79,#20355,0,"A")
hasLocation(#20356,#20197)
expr_containers(#20356,#20346)
literals("A","A",#20356)
bind(#20356,#20228)
bind(#20356,#20222)
#20357=*
exprs(#20357,104,#20346,-12,"@B @C")
#20358=@"loc,{#10000},14,12,14,16"
@@ -1133,7 +1134,7 @@ exprs(#20361,79,#20359,0,"B")
hasLocation(#20361,#20205)
expr_containers(#20361,#20346)
literals("B","B",#20361)
bind(#20361,#20234)
bind(#20361,#20223)
#20362=*
exprs(#20362,94,#20357,1,"@C")
#20363=@"loc,{#10000},14,15,14,16"
@@ -1145,7 +1146,7 @@ exprs(#20364,79,#20362,0,"C")
hasLocation(#20364,#20209)
expr_containers(#20364,#20346)
literals("C","C",#20364)
bind(#20364,#20222)
bind(#20364,#20224)
#20365=*
stmts(#20365,1,#20346,-2,"{}")
#20366=@"loc,{#10000},14,22,14,23"
@@ -1349,8 +1350,8 @@ successor(#20265,#20263)
successor(#20263,#20281)
successor(#20241,#20266)
successor(#20236,#20243)
successor(#20230,#20236)
successor(#20224,#20230)
successor(#20374,#20224)
successor(#20231,#20236)
successor(#20226,#20231)
successor(#20374,#20226)
numlines(#10000,15,12,0)
filetype(#10000,"typescript")

889
javascript/extractor/tests/ts/output/trap/nobody.ts.trap
View File

@@ -694,506 +694,509 @@ toplevels(#20001,0)
#20252=@"loc,{#10000},2,1,30,0"
locations_default(#20252,#10000,2,1,30,0)
hasLocation(#20001,#20252)
#20253=@"var;{C};{#20000}"
variables(#20253,"C",#20000)
#20254=@"local_type_name;{C};{#20000}"
local_type_names(#20254,"C",#20000)
#20255=*
stmts(#20255,17,#20001,0,"declare ... on f();")
hasLocation(#20255,#20020)
stmt_containers(#20255,#20001)
has_declare_keyword(#20255)
#20256=*
exprs(#20256,78,#20255,-1,"f")
hasLocation(#20256,#20079)
expr_containers(#20256,#20255)
literals("f","f",#20256)
#20257=@"var;{f};{#20000}"
variables(#20257,"f",#20000)
decl(#20256,#20257)
#20253=@"var;{f};{#20000}"
variables(#20253,"f",#20000)
#20254=@"var;{C};{#20000}"
variables(#20254,"C",#20000)
#20255=@"var;{D};{#20000}"
variables(#20255,"D",#20000)
#20256=@"local_type_name;{C};{#20000}"
local_type_names(#20256,"C",#20000)
#20257=@"local_type_name;{D};{#20000}"
local_type_names(#20257,"D",#20000)
#20258=*
scopes(#20258,1)
scopenodes(#20255,#20258)
scopenesting(#20258,#20000)
#20259=@"var;{arguments};{#20258}"
variables(#20259,"arguments",#20258)
is_arguments_object(#20259)
stmts(#20258,17,#20001,0,"declare ... on f();")
hasLocation(#20258,#20020)
stmt_containers(#20258,#20001)
has_declare_keyword(#20258)
#20259=*
exprs(#20259,78,#20258,-1,"f")
hasLocation(#20259,#20079)
expr_containers(#20259,#20258)
literals("f","f",#20259)
decl(#20259,#20253)
#20260=*
stmts(#20260,26,#20001,1,"abstrac ... mber;\n}")
#20261=@"loc,{#10000},4,1,15,1"
locations_default(#20261,#10000,4,1,15,1)
hasLocation(#20260,#20261)
stmt_containers(#20260,#20001)
is_abstract_class(#20260)
scopes(#20260,1)
scopenodes(#20258,#20260)
scopenesting(#20260,#20000)
#20261=@"var;{arguments};{#20260}"
variables(#20261,"arguments",#20260)
is_arguments_object(#20261)
#20262=*
exprs(#20262,78,#20260,0,"C")
hasLocation(#20262,#20091)
enclosing_stmt(#20262,#20260)
expr_containers(#20262,#20001)
literals("C","C",#20262)
decl(#20262,#20253)
typedecl(#20262,#20254)
#20263=*
scopes(#20263,10)
scopenodes(#20260,#20263)
scopenesting(#20263,#20000)
stmts(#20262,26,#20001,1,"abstrac ... mber;\n}")
#20263=@"loc,{#10000},4,1,15,1"
locations_default(#20263,#10000,4,1,15,1)
hasLocation(#20262,#20263)
stmt_containers(#20262,#20001)
is_abstract_class(#20262)
#20264=*
properties(#20264,#20260,2,0,"abstract h();")
#20265=@"loc,{#10000},6,3,6,15"
locations_default(#20265,#10000,6,3,6,15)
hasLocation(#20264,#20265)
exprs(#20264,78,#20262,0,"C")
hasLocation(#20264,#20091)
enclosing_stmt(#20264,#20262)
expr_containers(#20264,#20001)
literals("C","C",#20264)
decl(#20264,#20254)
typedecl(#20264,#20256)
#20265=*
scopes(#20265,10)
scopenodes(#20262,#20265)
scopenesting(#20265,#20000)
#20266=*
exprs(#20266,0,#20264,0,"h")
hasLocation(#20266,#20097)
enclosing_stmt(#20266,#20260)
expr_containers(#20266,#20001)
literals("h","h",#20266)
#20267=*
exprs(#20267,9,#20264,1,"abstract h();")
hasLocation(#20267,#20265)
enclosing_stmt(#20267,#20260)
expr_containers(#20267,#20001)
properties(#20266,#20262,2,0,"abstract h();")
#20267=@"loc,{#10000},6,3,6,15"
locations_default(#20267,#10000,6,3,6,15)
hasLocation(#20266,#20267)
#20268=*
scopes(#20268,1)
scopenodes(#20267,#20268)
scopenesting(#20268,#20263)
#20269=@"var;{arguments};{#20268}"
variables(#20269,"arguments",#20268)
is_arguments_object(#20269)
is_method(#20264)
is_abstract_member(#20264)
exprs(#20268,0,#20266,0,"h")
hasLocation(#20268,#20097)
enclosing_stmt(#20268,#20262)
expr_containers(#20268,#20001)
literals("h","h",#20268)
#20269=*
exprs(#20269,9,#20266,1,"abstract h();")
hasLocation(#20269,#20267)
enclosing_stmt(#20269,#20262)
expr_containers(#20269,#20001)
#20270=*
properties(#20270,#20260,3,0,"g(x: nu ... number;")
#20271=@"loc,{#10000},9,3,9,23"
locations_default(#20271,#10000,9,3,9,23)
hasLocation(#20270,#20271)
scopes(#20270,1)
scopenodes(#20269,#20270)
scopenesting(#20270,#20265)
#20271=@"var;{arguments};{#20270}"
variables(#20271,"arguments",#20270)
is_arguments_object(#20271)
is_method(#20266)
is_abstract_member(#20266)
#20272=*
exprs(#20272,0,#20270,0,"g")
hasLocation(#20272,#20105)
enclosing_stmt(#20272,#20260)
expr_containers(#20272,#20001)
literals("g","g",#20272)
#20273=*
exprs(#20273,9,#20270,1,"g(x: nu ... number;")
hasLocation(#20273,#20271)
enclosing_stmt(#20273,#20260)
expr_containers(#20273,#20001)
properties(#20272,#20262,3,0,"g(x: nu ... number;")
#20273=@"loc,{#10000},9,3,9,23"
locations_default(#20273,#10000,9,3,9,23)
hasLocation(#20272,#20273)
#20274=*
scopes(#20274,1)
scopenodes(#20273,#20274)
scopenesting(#20274,#20263)
#20275=@"var;{x};{#20274}"
variables(#20275,"x",#20274)
exprs(#20274,0,#20272,0,"g")
hasLocation(#20274,#20105)
enclosing_stmt(#20274,#20262)
expr_containers(#20274,#20001)
literals("g","g",#20274)
#20275=*
exprs(#20275,9,#20272,1,"g(x: nu ... number;")
hasLocation(#20275,#20273)
enclosing_stmt(#20275,#20262)
expr_containers(#20275,#20001)
#20276=*
exprs(#20276,78,#20273,0,"x")
hasLocation(#20276,#20109)
expr_containers(#20276,#20273)
literals("x","x",#20276)
decl(#20276,#20275)
#20277=@"var;{arguments};{#20274}"
variables(#20277,"arguments",#20274)
is_arguments_object(#20277)
scopes(#20276,1)
scopenodes(#20275,#20276)
scopenesting(#20276,#20265)
#20277=@"var;{x};{#20276}"
variables(#20277,"x",#20276)
#20278=*
typeexprs(#20278,2,#20273,-3,"number")
hasLocation(#20278,#20119)
expr_containers(#20278,#20273)
literals("number","number",#20278)
#20279=*
typeexprs(#20279,2,#20273,-6,"number")
hasLocation(#20279,#20113)
expr_containers(#20279,#20273)
literals("number","number",#20279)
is_method(#20270)
exprs(#20278,78,#20275,0,"x")
hasLocation(#20278,#20109)
expr_containers(#20278,#20275)
literals("x","x",#20278)
decl(#20278,#20277)
#20279=@"var;{arguments};{#20276}"
variables(#20279,"arguments",#20276)
is_arguments_object(#20279)
#20280=*
properties(#20280,#20260,4,0,"g(x: st ... string;")
#20281=@"loc,{#10000},10,3,10,23"
locations_default(#20281,#10000,10,3,10,23)
hasLocation(#20280,#20281)
typeexprs(#20280,2,#20275,-3,"number")
hasLocation(#20280,#20119)
expr_containers(#20280,#20275)
literals("number","number",#20280)
#20281=*
typeexprs(#20281,2,#20275,-6,"number")
hasLocation(#20281,#20113)
expr_containers(#20281,#20275)
literals("number","number",#20281)
is_method(#20272)
#20282=*
exprs(#20282,0,#20280,0,"g")
hasLocation(#20282,#20123)
enclosing_stmt(#20282,#20260)
expr_containers(#20282,#20001)
literals("g","g",#20282)
#20283=*
exprs(#20283,9,#20280,1,"g(x: st ... string;")
hasLocation(#20283,#20281)
enclosing_stmt(#20283,#20260)
expr_containers(#20283,#20001)
properties(#20282,#20262,4,0,"g(x: st ... string;")
#20283=@"loc,{#10000},10,3,10,23"
locations_default(#20283,#10000,10,3,10,23)
hasLocation(#20282,#20283)
#20284=*
scopes(#20284,1)
scopenodes(#20283,#20284)
scopenesting(#20284,#20263)
#20285=@"var;{x};{#20284}"
variables(#20285,"x",#20284)
exprs(#20284,0,#20282,0,"g")
hasLocation(#20284,#20123)
enclosing_stmt(#20284,#20262)
expr_containers(#20284,#20001)
literals("g","g",#20284)
#20285=*
exprs(#20285,9,#20282,1,"g(x: st ... string;")
hasLocation(#20285,#20283)
enclosing_stmt(#20285,#20262)
expr_containers(#20285,#20001)
#20286=*
exprs(#20286,78,#20283,0,"x")
hasLocation(#20286,#20127)
expr_containers(#20286,#20283)
literals("x","x",#20286)
decl(#20286,#20285)
#20287=@"var;{arguments};{#20284}"
variables(#20287,"arguments",#20284)
is_arguments_object(#20287)
scopes(#20286,1)
scopenodes(#20285,#20286)
scopenesting(#20286,#20265)
#20287=@"var;{x};{#20286}"
variables(#20287,"x",#20286)
#20288=*
typeexprs(#20288,2,#20283,-3,"string")
hasLocation(#20288,#20137)
expr_containers(#20288,#20283)
literals("string","string",#20288)
#20289=*
typeexprs(#20289,2,#20283,-6,"string")
hasLocation(#20289,#20131)
expr_containers(#20289,#20283)
literals("string","string",#20289)
is_method(#20280)
exprs(#20288,78,#20285,0,"x")
hasLocation(#20288,#20127)
expr_containers(#20288,#20285)
literals("x","x",#20288)
decl(#20288,#20287)
#20289=@"var;{arguments};{#20286}"
variables(#20289,"arguments",#20286)
is_arguments_object(#20289)
#20290=*
properties(#20290,#20260,5,0,"g(x: any) {}")
#20291=@"loc,{#10000},11,3,11,14"
locations_default(#20291,#10000,11,3,11,14)
hasLocation(#20290,#20291)
typeexprs(#20290,2,#20285,-3,"string")
hasLocation(#20290,#20137)
expr_containers(#20290,#20285)
literals("string","string",#20290)
#20291=*
typeexprs(#20291,2,#20285,-6,"string")
hasLocation(#20291,#20131)
expr_containers(#20291,#20285)
literals("string","string",#20291)
is_method(#20282)
#20292=*
exprs(#20292,0,#20290,0,"g")
hasLocation(#20292,#20141)
enclosing_stmt(#20292,#20260)
expr_containers(#20292,#20001)
literals("g","g",#20292)
#20293=*
exprs(#20293,9,#20290,1,"g(x: any) {}")
hasLocation(#20293,#20291)
enclosing_stmt(#20293,#20260)
expr_containers(#20293,#20001)
properties(#20292,#20262,5,0,"g(x: any) {}")
#20293=@"loc,{#10000},11,3,11,14"
locations_default(#20293,#10000,11,3,11,14)
hasLocation(#20292,#20293)
#20294=*
scopes(#20294,1)
scopenodes(#20293,#20294)
scopenesting(#20294,#20263)
#20295=@"var;{x};{#20294}"
variables(#20295,"x",#20294)
exprs(#20294,0,#20292,0,"g")
hasLocation(#20294,#20141)
enclosing_stmt(#20294,#20262)
expr_containers(#20294,#20001)
literals("g","g",#20294)
#20295=*
exprs(#20295,9,#20292,1,"g(x: any) {}")
hasLocation(#20295,#20293)
enclosing_stmt(#20295,#20262)
expr_containers(#20295,#20001)
#20296=*
exprs(#20296,78,#20293,0,"x")
hasLocation(#20296,#20145)
expr_containers(#20296,#20293)
literals("x","x",#20296)
decl(#20296,#20295)
#20297=@"var;{arguments};{#20294}"
variables(#20297,"arguments",#20294)
is_arguments_object(#20297)
scopes(#20296,1)
scopenodes(#20295,#20296)
scopenesting(#20296,#20265)
#20297=@"var;{x};{#20296}"
variables(#20297,"x",#20296)
#20298=*
typeexprs(#20298,2,#20293,-6,"any")
hasLocation(#20298,#20149)
expr_containers(#20298,#20293)
literals("any","any",#20298)
#20299=*
stmts(#20299,1,#20293,-2,"{}")
#20300=@"loc,{#10000},11,13,11,14"
locations_default(#20300,#10000,11,13,11,14)
hasLocation(#20299,#20300)
stmt_containers(#20299,#20293)
is_method(#20290)
exprs(#20298,78,#20295,0,"x")
hasLocation(#20298,#20145)
expr_containers(#20298,#20295)
literals("x","x",#20298)
decl(#20298,#20297)
#20299=@"var;{arguments};{#20296}"
variables(#20299,"arguments",#20296)
is_arguments_object(#20299)
#20300=*
typeexprs(#20300,2,#20295,-6,"any")
hasLocation(#20300,#20149)
expr_containers(#20300,#20295)
literals("any","any",#20300)
#20301=*
properties(#20301,#20260,6,8,"abstract x: number;")
#20302=@"loc,{#10000},14,3,14,21"
locations_default(#20302,#10000,14,3,14,21)
stmts(#20301,1,#20295,-2,"{}")
#20302=@"loc,{#10000},11,13,11,14"
locations_default(#20302,#10000,11,13,11,14)
hasLocation(#20301,#20302)
stmt_containers(#20301,#20295)
is_method(#20292)
#20303=*
#20304=*
exprs(#20304,0,#20301,0,"x")
hasLocation(#20304,#20159)
expr_containers(#20304,#20303)
literals("x","x",#20304)
is_abstract_member(#20301)
properties(#20303,#20262,6,8,"abstract x: number;")
#20304=@"loc,{#10000},14,3,14,21"
locations_default(#20304,#10000,14,3,14,21)
hasLocation(#20303,#20304)
#20305=*
typeexprs(#20305,2,#20301,2,"number")
hasLocation(#20305,#20163)
enclosing_stmt(#20305,#20260)
expr_containers(#20305,#20001)
literals("number","number",#20305)
#20306=*
properties(#20306,#20260,7,0,"constructor() {}")
#20307=@"loc,{#10000},4,18,4,17"
locations_default(#20307,#10000,4,18,4,17)
hasLocation(#20306,#20307)
exprs(#20306,0,#20303,0,"x")
hasLocation(#20306,#20159)
expr_containers(#20306,#20305)
literals("x","x",#20306)
is_abstract_member(#20303)
#20307=*
typeexprs(#20307,2,#20303,2,"number")
hasLocation(#20307,#20163)
enclosing_stmt(#20307,#20262)
expr_containers(#20307,#20001)
literals("number","number",#20307)
#20308=*
exprs(#20308,0,#20306,0,"constructor")
hasLocation(#20308,#20307)
enclosing_stmt(#20308,#20260)
expr_containers(#20308,#20001)
literals("constructor","constructor",#20308)
exprs(#20303,9,#20306,1,"() {}")
hasLocation(#20303,#20307)
enclosing_stmt(#20303,#20260)
expr_containers(#20303,#20001)
#20309=*
scopes(#20309,1)
scopenodes(#20303,#20309)
scopenesting(#20309,#20263)
#20310=@"var;{arguments};{#20309}"
variables(#20310,"arguments",#20309)
is_arguments_object(#20310)
properties(#20308,#20262,7,0,"constructor() {}")
#20309=@"loc,{#10000},4,18,4,17"
locations_default(#20309,#10000,4,18,4,17)
hasLocation(#20308,#20309)
#20310=*
exprs(#20310,0,#20308,0,"constructor")
hasLocation(#20310,#20309)
enclosing_stmt(#20310,#20262)
expr_containers(#20310,#20001)
literals("constructor","constructor",#20310)
exprs(#20305,9,#20308,1,"() {}")
hasLocation(#20305,#20309)
enclosing_stmt(#20305,#20262)
expr_containers(#20305,#20001)
#20311=*
stmts(#20311,1,#20303,-2,"{}")
hasLocation(#20311,#20307)
stmt_containers(#20311,#20303)
is_method(#20306)
#20312=*
stmts(#20312,26,#20001,2,"declare ... mber;\n}")
#20313=@"loc,{#10000},18,1,29,1"
locations_default(#20313,#10000,18,1,29,1)
hasLocation(#20312,#20313)
stmt_containers(#20312,#20001)
has_declare_keyword(#20312)
is_abstract_class(#20312)
scopes(#20311,1)
scopenodes(#20305,#20311)
scopenesting(#20311,#20265)
#20312=@"var;{arguments};{#20311}"
variables(#20312,"arguments",#20311)
is_arguments_object(#20312)
#20313=*
stmts(#20313,1,#20305,-2,"{}")
hasLocation(#20313,#20309)
stmt_containers(#20313,#20305)
is_method(#20308)
#20314=*
exprs(#20314,78,#20312,0,"D")
hasLocation(#20314,#20174)
enclosing_stmt(#20314,#20312)
expr_containers(#20314,#20001)
literals("D","D",#20314)
#20315=@"var;{D};{#20000}"
variables(#20315,"D",#20000)
decl(#20314,#20315)
stmts(#20314,26,#20001,2,"declare ... mber;\n}")
#20315=@"loc,{#10000},18,1,29,1"
locations_default(#20315,#10000,18,1,29,1)
hasLocation(#20314,#20315)
stmt_containers(#20314,#20001)
has_declare_keyword(#20314)
is_abstract_class(#20314)
#20316=*
scopes(#20316,10)
scopenodes(#20312,#20316)
scopenesting(#20316,#20000)
exprs(#20316,78,#20314,0,"D")
hasLocation(#20316,#20174)
enclosing_stmt(#20316,#20314)
expr_containers(#20316,#20001)
literals("D","D",#20316)
decl(#20316,#20255)
typedecl(#20316,#20257)
#20317=*
properties(#20317,#20312,2,0,"abstract h();")
#20318=@"loc,{#10000},20,3,20,15"
locations_default(#20318,#10000,20,3,20,15)
hasLocation(#20317,#20318)
#20319=*
exprs(#20319,0,#20317,0,"h")
hasLocation(#20319,#20180)
enclosing_stmt(#20319,#20312)
expr_containers(#20319,#20001)
literals("h","h",#20319)
scopes(#20317,10)
scopenodes(#20314,#20317)
scopenesting(#20317,#20000)
#20318=*
properties(#20318,#20314,2,0,"abstract h();")
#20319=@"loc,{#10000},20,3,20,15"
locations_default(#20319,#10000,20,3,20,15)
hasLocation(#20318,#20319)
#20320=*
exprs(#20320,9,#20317,1,"abstract h();")
hasLocation(#20320,#20318)
enclosing_stmt(#20320,#20312)
exprs(#20320,0,#20318,0,"h")
hasLocation(#20320,#20180)
enclosing_stmt(#20320,#20314)
expr_containers(#20320,#20001)
literals("h","h",#20320)
#20321=*
scopes(#20321,1)
scopenodes(#20320,#20321)
scopenesting(#20321,#20316)
#20322=@"var;{arguments};{#20321}"
variables(#20322,"arguments",#20321)
is_arguments_object(#20322)
is_method(#20317)
is_abstract_member(#20317)
#20323=*
properties(#20323,#20312,3,0,"g(x: nu ... number;")
#20324=@"loc,{#10000},23,3,23,23"
locations_default(#20324,#10000,23,3,23,23)
hasLocation(#20323,#20324)
#20325=*
exprs(#20325,0,#20323,0,"g")
hasLocation(#20325,#20188)
enclosing_stmt(#20325,#20312)
expr_containers(#20325,#20001)
literals("g","g",#20325)
exprs(#20321,9,#20318,1,"abstract h();")
hasLocation(#20321,#20319)
enclosing_stmt(#20321,#20314)
expr_containers(#20321,#20001)
#20322=*
scopes(#20322,1)
scopenodes(#20321,#20322)
scopenesting(#20322,#20317)
#20323=@"var;{arguments};{#20322}"
variables(#20323,"arguments",#20322)
is_arguments_object(#20323)
is_method(#20318)
is_abstract_member(#20318)
#20324=*
properties(#20324,#20314,3,0,"g(x: nu ... number;")
#20325=@"loc,{#10000},23,3,23,23"
locations_default(#20325,#10000,23,3,23,23)
hasLocation(#20324,#20325)
#20326=*
exprs(#20326,9,#20323,1,"g(x: nu ... number;")
hasLocation(#20326,#20324)
enclosing_stmt(#20326,#20312)
exprs(#20326,0,#20324,0,"g")
hasLocation(#20326,#20188)
enclosing_stmt(#20326,#20314)
expr_containers(#20326,#20001)
literals("g","g",#20326)
#20327=*
scopes(#20327,1)
scopenodes(#20326,#20327)
scopenesting(#20327,#20316)
#20328=@"var;{x};{#20327}"
variables(#20328,"x",#20327)
#20329=*
exprs(#20329,78,#20326,0,"x")
hasLocation(#20329,#20192)
expr_containers(#20329,#20326)
literals("x","x",#20329)
decl(#20329,#20328)
#20330=@"var;{arguments};{#20327}"
variables(#20330,"arguments",#20327)
is_arguments_object(#20330)
#20331=*
typeexprs(#20331,2,#20326,-3,"number")
hasLocation(#20331,#20202)
expr_containers(#20331,#20326)
literals("number","number",#20331)
exprs(#20327,9,#20324,1,"g(x: nu ... number;")
hasLocation(#20327,#20325)
enclosing_stmt(#20327,#20314)
expr_containers(#20327,#20001)
#20328=*
scopes(#20328,1)
scopenodes(#20327,#20328)
scopenesting(#20328,#20317)
#20329=@"var;{x};{#20328}"
variables(#20329,"x",#20328)
#20330=*
exprs(#20330,78,#20327,0,"x")
hasLocation(#20330,#20192)
expr_containers(#20330,#20327)
literals("x","x",#20330)
decl(#20330,#20329)
#20331=@"var;{arguments};{#20328}"
variables(#20331,"arguments",#20328)
is_arguments_object(#20331)
#20332=*
typeexprs(#20332,2,#20326,-6,"number")
hasLocation(#20332,#20196)
expr_containers(#20332,#20326)
typeexprs(#20332,2,#20327,-3,"number")
hasLocation(#20332,#20202)
expr_containers(#20332,#20327)
literals("number","number",#20332)
is_method(#20323)
#20333=*
properties(#20333,#20312,4,0,"g(x: st ... string;")
#20334=@"loc,{#10000},24,3,24,23"
locations_default(#20334,#10000,24,3,24,23)
hasLocation(#20333,#20334)
#20335=*
exprs(#20335,0,#20333,0,"g")
hasLocation(#20335,#20206)
enclosing_stmt(#20335,#20312)
expr_containers(#20335,#20001)
literals("g","g",#20335)
typeexprs(#20333,2,#20327,-6,"number")
hasLocation(#20333,#20196)
expr_containers(#20333,#20327)
literals("number","number",#20333)
is_method(#20324)
#20334=*
properties(#20334,#20314,4,0,"g(x: st ... string;")
#20335=@"loc,{#10000},24,3,24,23"
locations_default(#20335,#10000,24,3,24,23)
hasLocation(#20334,#20335)
#20336=*
exprs(#20336,9,#20333,1,"g(x: st ... string;")
hasLocation(#20336,#20334)
enclosing_stmt(#20336,#20312)
exprs(#20336,0,#20334,0,"g")
hasLocation(#20336,#20206)
enclosing_stmt(#20336,#20314)
expr_containers(#20336,#20001)
literals("g","g",#20336)
#20337=*
scopes(#20337,1)
scopenodes(#20336,#20337)
scopenesting(#20337,#20316)
#20338=@"var;{x};{#20337}"
variables(#20338,"x",#20337)
#20339=*
exprs(#20339,78,#20336,0,"x")
hasLocation(#20339,#20210)
expr_containers(#20339,#20336)
literals("x","x",#20339)
decl(#20339,#20338)
#20340=@"var;{arguments};{#20337}"
variables(#20340,"arguments",#20337)
is_arguments_object(#20340)
#20341=*
typeexprs(#20341,2,#20336,-3,"string")
hasLocation(#20341,#20220)
expr_containers(#20341,#20336)
literals("string","string",#20341)
exprs(#20337,9,#20334,1,"g(x: st ... string;")
hasLocation(#20337,#20335)
enclosing_stmt(#20337,#20314)
expr_containers(#20337,#20001)
#20338=*
scopes(#20338,1)
scopenodes(#20337,#20338)
scopenesting(#20338,#20317)
#20339=@"var;{x};{#20338}"
variables(#20339,"x",#20338)
#20340=*
exprs(#20340,78,#20337,0,"x")
hasLocation(#20340,#20210)
expr_containers(#20340,#20337)
literals("x","x",#20340)
decl(#20340,#20339)
#20341=@"var;{arguments};{#20338}"
variables(#20341,"arguments",#20338)
is_arguments_object(#20341)
#20342=*
typeexprs(#20342,2,#20336,-6,"string")
hasLocation(#20342,#20214)
expr_containers(#20342,#20336)
typeexprs(#20342,2,#20337,-3,"string")
hasLocation(#20342,#20220)
expr_containers(#20342,#20337)
literals("string","string",#20342)
is_method(#20333)
#20343=*
properties(#20343,#20312,5,0,"g(x: any) {}")
#20344=@"loc,{#10000},25,3,25,14"
locations_default(#20344,#10000,25,3,25,14)
hasLocation(#20343,#20344)
#20345=*
exprs(#20345,0,#20343,0,"g")
hasLocation(#20345,#20224)
enclosing_stmt(#20345,#20312)
expr_containers(#20345,#20001)
literals("g","g",#20345)
typeexprs(#20343,2,#20337,-6,"string")
hasLocation(#20343,#20214)
expr_containers(#20343,#20337)
literals("string","string",#20343)
is_method(#20334)
#20344=*
properties(#20344,#20314,5,0,"g(x: any) {}")
#20345=@"loc,{#10000},25,3,25,14"
locations_default(#20345,#10000,25,3,25,14)
hasLocation(#20344,#20345)
#20346=*
exprs(#20346,9,#20343,1,"g(x: any) {}")
hasLocation(#20346,#20344)
enclosing_stmt(#20346,#20312)
exprs(#20346,0,#20344,0,"g")
hasLocation(#20346,#20224)
enclosing_stmt(#20346,#20314)
expr_containers(#20346,#20001)
literals("g","g",#20346)
#20347=*
scopes(#20347,1)
scopenodes(#20346,#20347)
scopenesting(#20347,#20316)
#20348=@"var;{x};{#20347}"
variables(#20348,"x",#20347)
#20349=*
exprs(#20349,78,#20346,0,"x")
hasLocation(#20349,#20228)
expr_containers(#20349,#20346)
literals("x","x",#20349)
decl(#20349,#20348)
#20350=@"var;{arguments};{#20347}"
variables(#20350,"arguments",#20347)
is_arguments_object(#20350)
#20351=*
typeexprs(#20351,2,#20346,-6,"any")
hasLocation(#20351,#20232)
expr_containers(#20351,#20346)
literals("any","any",#20351)
exprs(#20347,9,#20344,1,"g(x: any) {}")
hasLocation(#20347,#20345)
enclosing_stmt(#20347,#20314)
expr_containers(#20347,#20001)
#20348=*
scopes(#20348,1)
scopenodes(#20347,#20348)
scopenesting(#20348,#20317)
#20349=@"var;{x};{#20348}"
variables(#20349,"x",#20348)
#20350=*
exprs(#20350,78,#20347,0,"x")
hasLocation(#20350,#20228)
expr_containers(#20350,#20347)
literals("x","x",#20350)
decl(#20350,#20349)
#20351=@"var;{arguments};{#20348}"
variables(#20351,"arguments",#20348)
is_arguments_object(#20351)
#20352=*
stmts(#20352,1,#20346,-2,"{}")
#20353=@"loc,{#10000},25,13,25,14"
locations_default(#20353,#10000,25,13,25,14)
hasLocation(#20352,#20353)
stmt_containers(#20352,#20346)
is_method(#20343)
#20354=*
properties(#20354,#20312,6,8,"abstract x: number;")
#20355=@"loc,{#10000},28,3,28,21"
locations_default(#20355,#10000,28,3,28,21)
hasLocation(#20354,#20355)
#20356=*
typeexprs(#20352,2,#20347,-6,"any")
hasLocation(#20352,#20232)
expr_containers(#20352,#20347)
literals("any","any",#20352)
#20353=*
stmts(#20353,1,#20347,-2,"{}")
#20354=@"loc,{#10000},25,13,25,14"
locations_default(#20354,#10000,25,13,25,14)
hasLocation(#20353,#20354)
stmt_containers(#20353,#20347)
is_method(#20344)
#20355=*
properties(#20355,#20314,6,8,"abstract x: number;")
#20356=@"loc,{#10000},28,3,28,21"
locations_default(#20356,#10000,28,3,28,21)
hasLocation(#20355,#20356)
#20357=*
exprs(#20357,0,#20354,0,"x")
hasLocation(#20357,#20242)
expr_containers(#20357,#20356)
literals("x","x",#20357)
is_abstract_member(#20354)
#20358=*
typeexprs(#20358,2,#20354,2,"number")
hasLocation(#20358,#20246)
enclosing_stmt(#20358,#20312)
expr_containers(#20358,#20001)
literals("number","number",#20358)
exprs(#20358,0,#20355,0,"x")
hasLocation(#20358,#20242)
expr_containers(#20358,#20357)
literals("x","x",#20358)
is_abstract_member(#20355)
#20359=*
properties(#20359,#20312,7,0,"constructor() {}")
#20360=@"loc,{#10000},18,26,18,25"
locations_default(#20360,#10000,18,26,18,25)
hasLocation(#20359,#20360)
#20361=*
exprs(#20361,0,#20359,0,"constructor")
hasLocation(#20361,#20360)
enclosing_stmt(#20361,#20312)
expr_containers(#20361,#20001)
literals("constructor","constructor",#20361)
exprs(#20356,9,#20359,1,"() {}")
hasLocation(#20356,#20360)
enclosing_stmt(#20356,#20312)
expr_containers(#20356,#20001)
typeexprs(#20359,2,#20355,2,"number")
hasLocation(#20359,#20246)
enclosing_stmt(#20359,#20314)
expr_containers(#20359,#20001)
literals("number","number",#20359)
#20360=*
properties(#20360,#20314,7,0,"constructor() {}")
#20361=@"loc,{#10000},18,26,18,25"
locations_default(#20361,#10000,18,26,18,25)
hasLocation(#20360,#20361)
#20362=*
scopes(#20362,1)
scopenodes(#20356,#20362)
scopenesting(#20362,#20316)
#20363=@"var;{arguments};{#20362}"
variables(#20363,"arguments",#20362)
is_arguments_object(#20363)
#20364=*
stmts(#20364,1,#20356,-2,"{}")
hasLocation(#20364,#20360)
stmt_containers(#20364,#20356)
is_method(#20359)
exprs(#20362,0,#20360,0,"constructor")
hasLocation(#20362,#20361)
enclosing_stmt(#20362,#20314)
expr_containers(#20362,#20001)
literals("constructor","constructor",#20362)
exprs(#20357,9,#20360,1,"() {}")
hasLocation(#20357,#20361)
enclosing_stmt(#20357,#20314)
expr_containers(#20357,#20001)
#20363=*
scopes(#20363,1)
scopenodes(#20357,#20363)
scopenesting(#20363,#20317)
#20364=@"var;{arguments};{#20363}"
variables(#20364,"arguments",#20363)
is_arguments_object(#20364)
#20365=*
entry_cfg_node(#20365,#20001)
#20366=@"loc,{#10000},2,1,2,0"
locations_default(#20366,#10000,2,1,2,0)
hasLocation(#20365,#20366)
#20367=*
exit_cfg_node(#20367,#20001)
hasLocation(#20367,#20251)
successor(#20312,#20367)
successor(#20303,#20306)
stmts(#20365,1,#20357,-2,"{}")
hasLocation(#20365,#20361)
stmt_containers(#20365,#20357)
is_method(#20360)
#20366=*
entry_cfg_node(#20366,#20001)
#20367=@"loc,{#10000},2,1,2,0"
locations_default(#20367,#10000,2,1,2,0)
hasLocation(#20366,#20367)
#20368=*
entry_cfg_node(#20368,#20303)
hasLocation(#20368,#20307)
exit_cfg_node(#20368,#20001)
hasLocation(#20368,#20251)
successor(#20314,#20368)
successor(#20305,#20308)
#20369=*
exit_cfg_node(#20369,#20303)
hasLocation(#20369,#20307)
successor(#20311,#20369)
successor(#20368,#20311)
successor(#20308,#20303)
successor(#20306,#20260)
successor(#20293,#20290)
entry_cfg_node(#20369,#20305)
hasLocation(#20369,#20309)
#20370=*
entry_cfg_node(#20370,#20293)
#20371=@"loc,{#10000},11,3,11,2"
locations_default(#20371,#10000,11,3,11,2)
hasLocation(#20370,#20371)
#20372=*
exit_cfg_node(#20372,#20293)
#20373=@"loc,{#10000},11,15,11,14"
locations_default(#20373,#10000,11,15,11,14)
hasLocation(#20372,#20373)
successor(#20299,#20372)
successor(#20296,#20299)
successor(#20370,#20296)
successor(#20292,#20293)
successor(#20290,#20308)
successor(#20280,#20292)
successor(#20270,#20280)
successor(#20264,#20270)
successor(#20262,#20264)
successor(#20260,#20312)
successor(#20255,#20262)
successor(#20365,#20255)
exit_cfg_node(#20370,#20305)
hasLocation(#20370,#20309)
successor(#20313,#20370)
successor(#20369,#20313)
successor(#20310,#20305)
successor(#20308,#20262)
successor(#20295,#20292)
#20371=*
entry_cfg_node(#20371,#20295)
#20372=@"loc,{#10000},11,3,11,2"
locations_default(#20372,#10000,11,3,11,2)
hasLocation(#20371,#20372)
#20373=*
exit_cfg_node(#20373,#20295)
#20374=@"loc,{#10000},11,15,11,14"
locations_default(#20374,#10000,11,15,11,14)
hasLocation(#20373,#20374)
successor(#20301,#20373)
successor(#20298,#20301)
successor(#20371,#20298)
successor(#20294,#20295)
successor(#20292,#20310)
successor(#20282,#20294)
successor(#20272,#20282)
successor(#20266,#20272)
successor(#20264,#20266)
successor(#20262,#20314)
successor(#20258,#20264)
successor(#20366,#20258)
numlines(#10000,29,15,8)
filetype(#10000,"typescript")

272
javascript/extractor/tests/ts/output/trap/thisparameter.ts.trap
View File

@@ -425,146 +425,146 @@ hasLocation(#20001,#20158)
variables(#20159,"declaration",#20000)
#20160=@"var;{f};{#20000}"
variables(#20160,"f",#20000)
#20161=@"var;{C};{#20000}"
variables(#20161,"C",#20000)
#20162=@"local_type_name;{C};{#20000}"
local_type_names(#20162,"C",#20000)
#20163=@"local_type_name;{I};{#20000}"
local_type_names(#20163,"I",#20000)
#20164=*
stmts(#20164,17,#20001,0,"functio ... ber) {}")
hasLocation(#20164,#20003)
stmt_containers(#20164,#20001)
#20161=@"var;{ambient};{#20000}"
variables(#20161,"ambient",#20000)
#20162=@"var;{C};{#20000}"
variables(#20162,"C",#20000)
#20163=@"local_type_name;{C};{#20000}"
local_type_names(#20163,"C",#20000)
#20164=@"local_type_name;{I};{#20000}"
local_type_names(#20164,"I",#20000)
#20165=*
exprs(#20165,78,#20164,-1,"declaration")
hasLocation(#20165,#20033)
expr_containers(#20165,#20164)
literals("declaration","declaration",#20165)
decl(#20165,#20159)
stmts(#20165,17,#20001,0,"functio ... ber) {}")
hasLocation(#20165,#20003)
stmt_containers(#20165,#20001)
#20166=*
scopes(#20166,1)
scopenodes(#20164,#20166)
scopenesting(#20166,#20000)
#20167=@"var;{x};{#20166}"
variables(#20167,"x",#20166)
#20168=*
exprs(#20168,78,#20164,0,"x")
hasLocation(#20168,#20045)
expr_containers(#20168,#20164)
literals("x","x",#20168)
decl(#20168,#20167)
#20169=@"var;{arguments};{#20166}"
variables(#20169,"arguments",#20166)
is_arguments_object(#20169)
#20170=*
typeexprs(#20170,2,#20164,-4,"void")
hasLocation(#20170,#20041)
expr_containers(#20170,#20164)
literals("void","void",#20170)
exprs(#20166,78,#20165,-1,"declaration")
hasLocation(#20166,#20033)
expr_containers(#20166,#20165)
literals("declaration","declaration",#20166)
decl(#20166,#20159)
#20167=*
scopes(#20167,1)
scopenodes(#20165,#20167)
scopenesting(#20167,#20000)
#20168=@"var;{x};{#20167}"
variables(#20168,"x",#20167)
#20169=*
exprs(#20169,78,#20165,0,"x")
hasLocation(#20169,#20045)
expr_containers(#20169,#20165)
literals("x","x",#20169)
decl(#20169,#20168)
#20170=@"var;{arguments};{#20167}"
variables(#20170,"arguments",#20167)
is_arguments_object(#20170)
#20171=*
typeexprs(#20171,2,#20164,-6,"number")
hasLocation(#20171,#20049)
expr_containers(#20171,#20164)
literals("number","number",#20171)
typeexprs(#20171,2,#20165,-4,"void")
hasLocation(#20171,#20041)
expr_containers(#20171,#20165)
literals("void","void",#20171)
#20172=*
stmts(#20172,1,#20164,-2,"{}")
#20173=@"loc,{#10000},1,45,1,46"
locations_default(#20173,#10000,1,45,1,46)
hasLocation(#20172,#20173)
stmt_containers(#20172,#20164)
#20174=*
stmts(#20174,18,#20001,1,"var f = ... ber) {}")
hasLocation(#20174,#20007)
stmt_containers(#20174,#20001)
typeexprs(#20172,2,#20165,-6,"number")
hasLocation(#20172,#20049)
expr_containers(#20172,#20165)
literals("number","number",#20172)
#20173=*
stmts(#20173,1,#20165,-2,"{}")
#20174=@"loc,{#10000},1,45,1,46"
locations_default(#20174,#10000,1,45,1,46)
hasLocation(#20173,#20174)
stmt_containers(#20173,#20165)
#20175=*
exprs(#20175,64,#20174,0,"f = fun ... ber) {}")
#20176=@"loc,{#10000},3,5,3,44"
locations_default(#20176,#10000,3,5,3,44)
hasLocation(#20175,#20176)
enclosing_stmt(#20175,#20174)
expr_containers(#20175,#20001)
#20177=*
exprs(#20177,78,#20175,0,"f")
hasLocation(#20177,#20059)
enclosing_stmt(#20177,#20174)
expr_containers(#20177,#20001)
literals("f","f",#20177)
decl(#20177,#20160)
stmts(#20175,18,#20001,1,"var f = ... ber) {}")
hasLocation(#20175,#20007)
stmt_containers(#20175,#20001)
#20176=*
exprs(#20176,64,#20175,0,"f = fun ... ber) {}")
#20177=@"loc,{#10000},3,5,3,44"
locations_default(#20177,#10000,3,5,3,44)
hasLocation(#20176,#20177)
enclosing_stmt(#20176,#20175)
expr_containers(#20176,#20001)
#20178=*
exprs(#20178,9,#20175,1,"functio ... ber) {}")
#20179=@"loc,{#10000},3,9,3,44"
locations_default(#20179,#10000,3,9,3,44)
hasLocation(#20178,#20179)
enclosing_stmt(#20178,#20174)
exprs(#20178,78,#20176,0,"f")
hasLocation(#20178,#20059)
enclosing_stmt(#20178,#20175)
expr_containers(#20178,#20001)
#20180=*
scopes(#20180,1)
scopenodes(#20178,#20180)
scopenesting(#20180,#20000)
#20181=@"var;{x};{#20180}"
variables(#20181,"x",#20180)
#20182=*
exprs(#20182,78,#20178,0,"x")
hasLocation(#20182,#20075)
expr_containers(#20182,#20178)
literals("x","x",#20182)
decl(#20182,#20181)
#20183=@"var;{arguments};{#20180}"
variables(#20183,"arguments",#20180)
is_arguments_object(#20183)
#20184=*
typeexprs(#20184,2,#20178,-4,"string")
hasLocation(#20184,#20071)
expr_containers(#20184,#20178)
literals("string","string",#20184)
literals("f","f",#20178)
decl(#20178,#20160)
#20179=*
exprs(#20179,9,#20176,1,"functio ... ber) {}")
#20180=@"loc,{#10000},3,9,3,44"
locations_default(#20180,#10000,3,9,3,44)
hasLocation(#20179,#20180)
enclosing_stmt(#20179,#20175)
expr_containers(#20179,#20001)
#20181=*
scopes(#20181,1)
scopenodes(#20179,#20181)
scopenesting(#20181,#20000)
#20182=@"var;{x};{#20181}"
variables(#20182,"x",#20181)
#20183=*
exprs(#20183,78,#20179,0,"x")
hasLocation(#20183,#20075)
expr_containers(#20183,#20179)
literals("x","x",#20183)
decl(#20183,#20182)
#20184=@"var;{arguments};{#20181}"
variables(#20184,"arguments",#20181)
is_arguments_object(#20184)
#20185=*
typeexprs(#20185,2,#20178,-6,"number")
hasLocation(#20185,#20079)
expr_containers(#20185,#20178)
literals("number","number",#20185)
typeexprs(#20185,2,#20179,-4,"string")
hasLocation(#20185,#20071)
expr_containers(#20185,#20179)
literals("string","string",#20185)
#20186=*
stmts(#20186,1,#20178,-2,"{}")
#20187=@"loc,{#10000},3,43,3,44"
locations_default(#20187,#10000,3,43,3,44)
hasLocation(#20186,#20187)
stmt_containers(#20186,#20178)
#20188=*
stmts(#20188,17,#20001,2,"declare ... umber);")
hasLocation(#20188,#20011)
stmt_containers(#20188,#20001)
has_declare_keyword(#20188)
typeexprs(#20186,2,#20179,-6,"number")
hasLocation(#20186,#20079)
expr_containers(#20186,#20179)
literals("number","number",#20186)
#20187=*
stmts(#20187,1,#20179,-2,"{}")
#20188=@"loc,{#10000},3,43,3,44"
locations_default(#20188,#10000,3,43,3,44)
hasLocation(#20187,#20188)
stmt_containers(#20187,#20179)
#20189=*
exprs(#20189,78,#20188,-1,"ambient")
hasLocation(#20189,#20091)
expr_containers(#20189,#20188)
literals("ambient","ambient",#20189)
#20190=@"var;{ambient};{#20000}"
variables(#20190,"ambient",#20000)
decl(#20189,#20190)
stmts(#20189,17,#20001,2,"declare ... umber);")
hasLocation(#20189,#20011)
stmt_containers(#20189,#20001)
has_declare_keyword(#20189)
#20190=*
exprs(#20190,78,#20189,-1,"ambient")
hasLocation(#20190,#20091)
expr_containers(#20190,#20189)
literals("ambient","ambient",#20190)
decl(#20190,#20161)
#20191=*
scopes(#20191,1)
scopenodes(#20188,#20191)
scopenodes(#20189,#20191)
scopenesting(#20191,#20000)
#20192=@"var;{x};{#20191}"
variables(#20192,"x",#20191)
#20193=*
exprs(#20193,78,#20188,0,"x")
exprs(#20193,78,#20189,0,"x")
hasLocation(#20193,#20103)
expr_containers(#20193,#20188)
expr_containers(#20193,#20189)
literals("x","x",#20193)
decl(#20193,#20192)
#20194=@"var;{arguments};{#20191}"
variables(#20194,"arguments",#20191)
is_arguments_object(#20194)
#20195=*
typeexprs(#20195,2,#20188,-4,"string")
typeexprs(#20195,2,#20189,-4,"string")
hasLocation(#20195,#20099)
expr_containers(#20195,#20188)
expr_containers(#20195,#20189)
literals("string","string",#20195)
#20196=*
typeexprs(#20196,2,#20188,-6,"number")
typeexprs(#20196,2,#20189,-6,"number")
hasLocation(#20196,#20107)
expr_containers(#20196,#20188)
expr_containers(#20196,#20189)
literals("number","number",#20196)
#20197=*
stmts(#20197,26,#20001,3,"class C ... C) {}\n}")
@@ -578,8 +578,8 @@ hasLocation(#20199,#20115)
enclosing_stmt(#20199,#20197)
expr_containers(#20199,#20001)
literals("C","C",#20199)
decl(#20199,#20161)
typedecl(#20199,#20162)
decl(#20199,#20162)
typedecl(#20199,#20163)
#20200=*
scopes(#20200,10)
scopenodes(#20197,#20200)
@@ -612,7 +612,7 @@ typeexprs(#20207,0,#20204,-4,"C")
hasLocation(#20207,#20127)
expr_containers(#20207,#20204)
literals("C","C",#20207)
typebind(#20207,#20162)
typebind(#20207,#20163)
#20208=*
stmts(#20208,1,#20204,-2,"{}")
#20209=@"loc,{#10000},8,19,8,20"
@@ -660,7 +660,7 @@ hasLocation(#20219,#20138)
enclosing_stmt(#20219,#20217)
expr_containers(#20219,#20001)
literals("I","I",#20219)
typedecl(#20219,#20163)
typedecl(#20219,#20164)
#20220=*
properties(#20220,#20217,2,0,"method(this: I);")
#20221=@"loc,{#10000},12,3,12,18"
@@ -689,7 +689,7 @@ typeexprs(#20226,0,#20223,-4,"I")
hasLocation(#20226,#20150)
expr_containers(#20226,#20223)
literals("I","I",#20226)
typebind(#20226,#20163)
typebind(#20226,#20164)
is_method(#20220)
is_abstract_member(#20220)
#20227=*
@@ -729,37 +729,37 @@ successor(#20203,#20204)
successor(#20201,#20212)
successor(#20199,#20203)
successor(#20197,#20217)
successor(#20188,#20199)
successor(#20174,#20177)
successor(#20178,#20175)
successor(#20189,#20199)
successor(#20175,#20178)
successor(#20179,#20176)
#20236=*
entry_cfg_node(#20236,#20178)
entry_cfg_node(#20236,#20179)
#20237=@"loc,{#10000},3,9,3,8"
locations_default(#20237,#10000,3,9,3,8)
hasLocation(#20236,#20237)
#20238=*
exit_cfg_node(#20238,#20178)
exit_cfg_node(#20238,#20179)
#20239=@"loc,{#10000},3,45,3,44"
locations_default(#20239,#10000,3,45,3,44)
hasLocation(#20238,#20239)
successor(#20186,#20238)
successor(#20182,#20186)
successor(#20236,#20182)
successor(#20177,#20178)
successor(#20175,#20188)
successor(#20164,#20174)
successor(#20187,#20238)
successor(#20183,#20187)
successor(#20236,#20183)
successor(#20178,#20179)
successor(#20176,#20189)
successor(#20165,#20175)
#20240=*
entry_cfg_node(#20240,#20164)
entry_cfg_node(#20240,#20165)
hasLocation(#20240,#20228)
#20241=*
exit_cfg_node(#20241,#20164)
exit_cfg_node(#20241,#20165)
#20242=@"loc,{#10000},1,47,1,46"
locations_default(#20242,#10000,1,47,1,46)
hasLocation(#20241,#20242)
successor(#20172,#20241)
successor(#20168,#20172)
successor(#20240,#20168)
successor(#20165,#20164)
successor(#20227,#20165)
successor(#20173,#20241)
successor(#20169,#20173)
successor(#20240,#20169)
successor(#20166,#20165)
successor(#20227,#20166)
numlines(#10000,14,9,0)
filetype(#10000,"typescript")

2
javascript/ql/integration-tests/query-suite/javascript-code-quality.qls.expected
View File

@@ -1,6 +1,8 @@
ql/javascript/ql/src/Declarations/IneffectiveParameterType.ql
ql/javascript/ql/src/Declarations/SuspiciousMethodNameDeclaration.ql
ql/javascript/ql/src/Expressions/ExprHasNoEffect.ql
ql/javascript/ql/src/Expressions/MissingAwait.ql
ql/javascript/ql/src/LanguageFeatures/SpuriousArguments.ql
ql/javascript/ql/src/Quality/UnhandledErrorInStreamPipeline.ql
ql/javascript/ql/src/RegExp/DuplicateCharacterInCharacterClass.ql
ql/javascript/ql/src/RegExp/RegExpAlwaysMatches.ql

1
javascript/ql/integration-tests/query-suite/not_included_in_qls.expected
View File

@@ -147,4 +147,3 @@ ql/javascript/ql/src/meta/extraction-metrics/FileData.ql
ql/javascript/ql/src/meta/extraction-metrics/MissingMetrics.ql
ql/javascript/ql/src/meta/extraction-metrics/PhaseTimings.ql
ql/javascript/ql/src/meta/types/TypedExprs.ql
ql/javascript/ql/src/meta/types/TypesWithQualifiedName.ql

29
javascript/ql/lib/Expressions/ExprHasNoEffect.qll
View File

@@ -22,6 +22,9 @@ predicate inVoidContext(Expr e) {
)
)
or
// propagate void context through parenthesized expressions
inVoidContext(e.getParent().(ParExpr))
or
exists(SeqExpr seq, int i, int n |
e = seq.getOperand(i) and
n = seq.getNumOperands()
@@ -129,6 +132,19 @@ predicate noSideEffects(Expr e) {
)
}
/**
* Holds if `e` is a compound expression that may contain sub-expressions with side effects.
* We should not flag these directly as useless since we want to flag only the innermost
* expressions that actually have no effect.
*/
predicate isCompoundExpression(Expr e) {
e instanceof LogicalBinaryExpr
or
e instanceof SeqExpr
or
e instanceof ParExpr
}
/**
* Holds if the expression `e` should be reported as having no effect.
*/
@@ -145,6 +161,7 @@ predicate hasNoEffect(Expr e) {
not isDeclaration(e) and
// exclude DOM properties, which sometimes have magical auto-update properties
not isDomProperty(e.(PropAccess).getPropertyName()) and
not isCompoundExpression(e) and
// exclude xUnit.js annotations
not e instanceof XUnitAnnotation and
// exclude common patterns that are most likely intentional
@@ -157,7 +174,17 @@ predicate hasNoEffect(Expr e) {
not exists(fe.getName())
) and
// exclude block-level flow type annotations. For example: `(name: empty)`.
not e.(ParExpr).getExpression().getLastToken().getNextToken().getValue() = ":" and
not exists(ParExpr parent |
e.getParent() = parent and
e.getLastToken().getNextToken().getValue() = ":"
) and
// exclude expressions that are part of a conditional expression
not exists(ConditionalExpr cond | e = cond.getABranch() |
e instanceof NullLiteral or
e.(GlobalVarAccess).getName() = "undefined" or
e.(NumberLiteral).getIntValue() = 0 or
e instanceof VoidExpr
) and
// exclude the first statement of a try block
not e = any(TryStmt stmt).getBody().getStmt(0).(ExprStmt).getExpr() and
// exclude expressions that are alone in a file, and file doesn't contain a function.

55
javascript/ql/lib/definitions.qll
View File

@@ -153,17 +153,7 @@ private predicate jsdocTypeLookup(JSDocNamedTypeExpr ref, AstNode decl, string k
kind = "T"
}
/**
* Gets an element, of kind `kind`, that element `e` uses, if any.
*
* The `kind` is a string representing what kind of use it is:
* - `"M"` for function and method calls
* - `"T"` for uses of types
* - `"V"` for variable accesses
* - `"I"` for imports
*/
cached
AstNode definitionOf(Locatable e, string kind) {
private AstNode definitionOfRaw(Locatable e, string kind) {
variableDefLookup(e, result, kind)
or
// prefer definitions over declarations
@@ -179,3 +169,46 @@ AstNode definitionOf(Locatable e, string kind) {
or
jsdocTypeLookup(e, result, kind)
}
/** Gets a more useful node to show for something that resolves to `node`. */
private AstNode redirectOnce(AstNode node) {
exists(ConstructorDeclaration ctor |
ctor.isSynthetic() and
node = ctor.getBody() and
result = ctor.getDeclaringClass()
)
or
exists(ClassDefinition cls |
node = cls and
result = cls.getIdentifier()
)
or
exists(FunctionDeclStmt decl |
node = decl and
result = decl.getIdentifier()
)
or
exists(MethodDeclaration member |
not member instanceof ConstructorDeclaration and
node = member.getBody() and
result = member.getNameExpr()
)
}
private AstNode redirect(AstNode node) {
node = definitionOfRaw(_, _) and
result = redirectOnce*(node) and
not exists(redirectOnce(result))
}
/**
* Gets an element, of kind `kind`, that element `e` uses, if any.
*
* The `kind` is a string representing what kind of use it is:
* - `"M"` for function and method calls
* - `"T"` for uses of types
* - `"V"` for variable accesses
* - `"I"` for imports
*/
cached
AstNode definitionOf(Locatable e, string kind) { result = redirect(definitionOfRaw(e, kind)) }

12
javascript/ql/lib/semmle/javascript/ApiGraphs.qll
View File

@@ -649,11 +649,13 @@ module API {
/** Gets a node corresponding to an import of module `m` without taking into account types from models. */
Node getAModuleImportRaw(string m) {
result = Impl::MkModuleImport(m) or
result = Impl::MkModuleImport(m).(Node).getMember("default")
result = Impl::MkModuleImport(m).(Node).getMember("default") or
result = Impl::MkTypeUse(m, "")
}
/** Gets a node whose type has the given qualified name, not including types from models. */
Node getANodeOfTypeRaw(string moduleName, string exportedName) {
exportedName != "" and
result = Impl::MkTypeUse(moduleName, exportedName).(Node).getInstance()
or
exportedName = "" and
@@ -749,18 +751,14 @@ module API {
MkModuleImport(string m) {
imports(_, m)
or
any(TypeAnnotation n).hasQualifiedName(m, _)
or
any(Type t).hasUnderlyingType(m, _)
any(TypeAnnotation n).hasUnderlyingType(m, _)
} or
MkClassInstance(DataFlow::ClassNode cls) { needsDefNode(cls) } or
MkDef(DataFlow::Node nd) { rhs(_, _, nd) } or
MkUse(DataFlow::Node nd) { use(_, _, nd) } or
/** A use of a TypeScript type. */
MkTypeUse(string moduleName, string exportName) {
any(TypeAnnotation n).hasQualifiedName(moduleName, exportName)
or
any(Type t).hasUnderlyingType(moduleName, exportName)
any(TypeAnnotation n).hasUnderlyingType(moduleName, exportName)
} or
MkSyntheticCallbackArg(DataFlow::Node src, int bound, DataFlow::InvokeNode nd) {
trackUseNode(src, true, bound, "").flowsTo(nd.getCalleeNode())

101
javascript/ql/lib/semmle/javascript/Closure.qll
View File

@@ -5,17 +5,49 @@
import javascript
module Closure {
/** A call to `goog.require` */
class RequireCallExpr extends CallExpr {
RequireCallExpr() { this.getCallee().(PropAccess).getQualifiedName() = "goog.require" }
/** Gets the imported namespace name. */
string getClosureNamespace() { result = this.getArgument(0).getStringValue() }
}
/** A call to `goog.provide` */
class ProvideCallExpr extends CallExpr {
ProvideCallExpr() { this.getCallee().(PropAccess).getQualifiedName() = "goog.provide" }
/** Gets the imported namespace name. */
string getClosureNamespace() { result = this.getArgument(0).getStringValue() }
}
/** A call to `goog.module` or `goog.declareModuleId`. */
private class ModuleDeclarationCall extends CallExpr {
private string kind;
ModuleDeclarationCall() {
this.getCallee().(PropAccess).getQualifiedName() = kind and
kind = ["goog.module", "goog.declareModuleId"]
}
/** Gets the declared namespace. */
string getClosureNamespace() { result = this.getArgument(0).getStringValue() }
/** Gets the string `goog.module` or `goog.declareModuleId` depending on which method is being called. */
string getModuleKind() { result = kind }
}
/**
* A reference to a Closure namespace.
*/
class ClosureNamespaceRef extends DataFlow::Node instanceof ClosureNamespaceRef::Range {
deprecated class ClosureNamespaceRef extends DataFlow::Node instanceof ClosureNamespaceRef::Range {
/**
* Gets the namespace being referenced.
*/
string getClosureNamespace() { result = super.getClosureNamespace() }
}
module ClosureNamespaceRef {
deprecated module ClosureNamespaceRef {
/**
* A reference to a Closure namespace.
*
@@ -32,10 +64,10 @@ module Closure {
/**
* A data flow node that returns the value of a closure namespace.
*/
class ClosureNamespaceAccess extends ClosureNamespaceRef instanceof ClosureNamespaceAccess::Range {
}
deprecated class ClosureNamespaceAccess extends ClosureNamespaceRef instanceof ClosureNamespaceAccess::Range
{ }
module ClosureNamespaceAccess {
deprecated module ClosureNamespaceAccess {
/**
* A data flow node that returns the value of a closure namespace.
*
@@ -47,7 +79,7 @@ module Closure {
/**
* A call to a method on the `goog.` namespace, as a closure reference.
*/
abstract private class DefaultNamespaceRef extends DataFlow::MethodCallNode,
abstract deprecated private class DefaultNamespaceRef extends DataFlow::MethodCallNode,
ClosureNamespaceRef::Range
{
DefaultNamespaceRef() { this = DataFlow::globalVarRef("goog").getAMethodCall() }
@@ -59,14 +91,14 @@ module Closure {
* Holds if `node` is the data flow node corresponding to the expression in
* a top-level expression statement.
*/
private predicate isTopLevelExpr(DataFlow::Node node) {
deprecated private predicate isTopLevelExpr(DataFlow::Node node) {
any(TopLevel tl).getAChildStmt().(ExprStmt).getExpr().flow() = node
}
/**
* A top-level call to `goog.provide`.
*/
private class DefaultClosureProvideCall extends DefaultNamespaceRef {
deprecated private class DefaultClosureProvideCall extends DefaultNamespaceRef {
DefaultClosureProvideCall() {
this.getMethodName() = "provide" and
isTopLevelExpr(this)
@@ -76,13 +108,14 @@ module Closure {
/**
* A top-level call to `goog.provide`.
*/
class ClosureProvideCall extends ClosureNamespaceRef, DataFlow::MethodCallNode instanceof DefaultClosureProvideCall
deprecated class ClosureProvideCall extends ClosureNamespaceRef, DataFlow::MethodCallNode instanceof DefaultClosureProvideCall
{ }
/**
* A call to `goog.require`.
*/
private class DefaultClosureRequireCall extends DefaultNamespaceRef, ClosureNamespaceAccess::Range
deprecated private class DefaultClosureRequireCall extends DefaultNamespaceRef,
ClosureNamespaceAccess::Range
{
DefaultClosureRequireCall() { this.getMethodName() = "require" }
}
@@ -90,13 +123,13 @@ module Closure {
/**
* A call to `goog.require`.
*/
class ClosureRequireCall extends ClosureNamespaceAccess, DataFlow::MethodCallNode instanceof DefaultClosureRequireCall
deprecated class ClosureRequireCall extends ClosureNamespaceAccess, DataFlow::MethodCallNode instanceof DefaultClosureRequireCall
{ }
/**
* A top-level call to `goog.module` or `goog.declareModuleId`.
*/
private class DefaultClosureModuleDeclaration extends DefaultNamespaceRef {
deprecated private class DefaultClosureModuleDeclaration extends DefaultNamespaceRef {
DefaultClosureModuleDeclaration() {
(this.getMethodName() = "module" or this.getMethodName() = "declareModuleId") and
isTopLevelExpr(this)
@@ -106,41 +139,29 @@ module Closure {
/**
* A top-level call to `goog.module` or `goog.declareModuleId`.
*/
class ClosureModuleDeclaration extends ClosureNamespaceRef, DataFlow::MethodCallNode instanceof DefaultClosureModuleDeclaration
deprecated class ClosureModuleDeclaration extends ClosureNamespaceRef, DataFlow::MethodCallNode instanceof DefaultClosureModuleDeclaration
{ }
private GlobalVariable googVariable() { variables(result, "goog", any(GlobalScope sc)) }
pragma[nomagic]
private MethodCallExpr googModuleDeclExpr() {
result.getReceiver() = googVariable().getAnAccess() and
result.getMethodName() = ["module", "declareModuleId"]
}
pragma[nomagic]
private MethodCallExpr googModuleDeclExprInContainer(StmtContainer container) {
result = googModuleDeclExpr() and
container = result.getContainer()
}
pragma[noinline]
private ClosureRequireCall getARequireInTopLevel(ClosureModule m) { result.getTopLevel() = m }
private RequireCallExpr getARequireInTopLevel(ClosureModule m) { result.getTopLevel() = m }
/**
* A module using the Closure module system, declared using `goog.module()` or `goog.declareModuleId()`.
*/
class ClosureModule extends Module {
ClosureModule() { exists(googModuleDeclExprInContainer(this)) }
private ModuleDeclarationCall decl;
ClosureModule() { decl.getTopLevel() = this }
/**
* Gets the call to `goog.module` or `goog.declareModuleId` in this module.
*/
ClosureModuleDeclaration getModuleDeclaration() { result.getTopLevel() = this }
deprecated ClosureModuleDeclaration getModuleDeclaration() { result.getTopLevel() = this }
/**
* Gets the namespace of this module.
*/
string getClosureNamespace() { result = this.getModuleDeclaration().getClosureNamespace() }
string getClosureNamespace() { result = decl.getClosureNamespace() }
override Module getAnImportedModule() {
result.(ClosureModule).getClosureNamespace() =
@@ -156,7 +177,7 @@ module Closure {
* Has no result for ES6 modules using `goog.declareModuleId`.
*/
Variable getExportsVariable() {
this.getModuleDeclaration().getMethodName() = "module" and
decl.getModuleKind() = "goog.module" and
result = this.getScope().getVariable("exports")
}
@@ -185,15 +206,15 @@ module Closure {
ClosureScript() {
not this instanceof ClosureModule and
(
any(ClosureProvideCall provide).getTopLevel() = this
any(ProvideCallExpr provide).getTopLevel() = this
or
any(ClosureRequireCall require).getTopLevel() = this
any(RequireCallExpr require).getTopLevel() = this
)
}
/** Gets the identifier of a namespace required by this module. */
string getARequiredNamespace() {
exists(ClosureRequireCall require |
exists(RequireCallExpr require |
require.getTopLevel() = this and
result = require.getClosureNamespace()
)
@@ -201,7 +222,7 @@ module Closure {
/** Gets the identifer of a namespace provided by this module. */
string getAProvidedNamespace() {
exists(ClosureProvideCall require |
exists(ProvideCallExpr require |
require.getTopLevel() = this and
result = require.getClosureNamespace()
)
@@ -213,7 +234,13 @@ module Closure {
*/
pragma[noinline]
predicate isClosureNamespace(string name) {
exists(string namespace | namespace = any(ClosureNamespaceRef ref).getClosureNamespace() |
exists(string namespace |
namespace =
[
any(RequireCallExpr ref).getClosureNamespace(),
any(ModuleDeclarationCall c).getClosureNamespace()
]
|
name = namespace.substring(0, namespace.indexOf("."))
or
name = namespace

3
javascript/ql/lib/semmle/javascript/ES2015Modules.qll
View File

@@ -180,6 +180,9 @@ deprecated private class LiteralImportPath extends PathExpr, ConstantString {
* ```
*/
class ImportSpecifier extends Expr, @import_specifier {
/** Gets the import declaration in which this specifier appears. */
ImportDeclaration getImportDeclaration() { result.getASpecifier() = this }
/** Gets the imported symbol; undefined for default and namespace import specifiers. */
Identifier getImported() { result = this.getChildExpr(0) }

7
javascript/ql/lib/semmle/javascript/Expr.qll
View File

@@ -4,6 +4,7 @@
import javascript
private import semmle.javascript.internal.CachedStages
private import semmle.javascript.internal.TypeResolution
/**
* A program element that is either an expression or a type annotation.
@@ -1017,7 +1018,11 @@ class InvokeExpr extends @invokeexpr, Expr {
* Note that the resolved function may be overridden in a subclass and thus is not
* necessarily the actual target of this invocation at runtime.
*/
Function getResolvedCallee() { result = this.getResolvedCalleeName().getImplementation() }
Function getResolvedCallee() {
TypeResolution::callTarget(this, result)
or
result = this.getResolvedCalleeName().getImplementation()
}
}
/**

6
javascript/ql/lib/semmle/javascript/GlobalAccessPaths.qll
View File

@@ -34,7 +34,7 @@ module AccessPath {
not this.accessesGlobal(_) and
not this instanceof DataFlow::PropRead and
not this instanceof PropertyProjection and
not this instanceof Closure::ClosureNamespaceAccess and
not this.asExpr() instanceof Closure::RequireCallExpr and
not this = DataFlow::parameterNode(any(ImmediatelyInvokedFunctionExpr iife).getAParameter()) and
not FlowSteps::identityFunctionStep(_, this)
}
@@ -139,8 +139,8 @@ module AccessPath {
result = join(fromReference(prop.getBase(), root), "[number]")
)
or
exists(Closure::ClosureNamespaceAccess acc | node = acc |
result = acc.getClosureNamespace() and
exists(Closure::RequireCallExpr req | node = req.flow() |
result = req.getClosureNamespace() and
root.isGlobal()
)
or

102
javascript/ql/lib/semmle/javascript/JSDoc.qll
View File

@@ -33,6 +33,9 @@ class JSDoc extends @jsdoc, Locatable {
result.getTitle() = title
}
/** Gets the element to which this JSDoc comment is attached */
Documentable getDocumentedElement() { result.getDocumentation() = this }
override string toString() { result = this.getComment().toString() }
}
@@ -299,6 +302,41 @@ class JSDocIdentifierTypeExpr extends @jsdoc_identifier_type_expr, JSDocTypeExpr
override predicate isRawFunction() { this.getName() = "Function" }
}
private AstNode getAncestorInScope(Documentable doc) {
any(JSDocLocalTypeAccess t).getJSDocComment() = doc.getDocumentation() and // restrict to cases where we need this
result = doc.getParent()
or
exists(AstNode mid |
mid = getAncestorInScope(doc) and
not mid = any(Scope s).getScopeElement() and
result = mid.getParent()
)
}
private Scope getScope(Documentable doc) { result.getScopeElement() = getAncestorInScope(doc) }
pragma[nomagic]
private predicate shouldResolveName(TopLevel top, string name) {
exists(JSDocLocalTypeAccess access |
access.getName() = name and
access.getTopLevel() = top
)
}
private LexicalName getOwnLocal(Scope scope, string name, DeclarationSpace space) {
scope = result.getScope() and
name = result.getName() and
space = result.getDeclarationSpace() and
shouldResolveName(scope.getScopeElement().getTopLevel(), name) // restrict size of predicate
}
private LexicalName resolveLocal(Scope scope, string name, DeclarationSpace space) {
result = getOwnLocal(scope, name, space)
or
result = resolveLocal(scope.getOuterScope(), name, space) and
not exists(getOwnLocal(scope, name, space))
}
/**
* An unqualified identifier in a JSDoc type expression.
*
@@ -311,6 +349,12 @@ class JSDocIdentifierTypeExpr extends @jsdoc_identifier_type_expr, JSDocTypeExpr
*/
class JSDocLocalTypeAccess extends JSDocIdentifierTypeExpr {
JSDocLocalTypeAccess() { not this = any(JSDocQualifiedTypeAccess a).getNameNode() }
/** Gets a variable, type-name, or namespace that this expression may resolve to. */
LexicalName getALexicalName() {
result =
resolveLocal(getScope(this.getJSDocComment().getDocumentedElement()), this.getName(), _)
}
}
/**
@@ -371,7 +415,7 @@ class JSDocNamedTypeExpr extends JSDocTypeExpr {
* - `foo.bar.Baz` has prefix `foo` and suffix `.bar.Baz`.
* - `Baz` has prefix `Baz` and an empty suffix.
*/
predicate hasNameParts(string prefix, string suffix) {
deprecated predicate hasNameParts(string prefix, string suffix) {
not this = any(JSDocQualifiedTypeAccess a).getBase() and // restrict size of predicate
exists(string regex, string name | regex = "([^.]+)(.*)" |
name = this.getRawName() and
@@ -379,46 +423,6 @@ class JSDocNamedTypeExpr extends JSDocTypeExpr {
suffix = name.regexpCapture(regex, 2)
)
}
pragma[noinline]
pragma[nomagic]
private predicate hasNamePartsAndEnv(string prefix, string suffix, JSDoc::Environment env) {
// Force join ordering
this.hasNameParts(prefix, suffix) and
env.isContainerInScope(this.getContainer())
}
/**
* Gets the qualified name of this name by resolving its prefix, if any.
*/
cached
private string resolvedName() {
exists(string prefix, string suffix, JSDoc::Environment env |
this.hasNamePartsAndEnv(prefix, suffix, env) and
result = env.resolveAlias(prefix) + suffix
)
}
override predicate hasQualifiedName(string globalName) {
globalName = this.resolvedName()
or
not exists(this.resolvedName()) and
globalName = this.getRawName()
}
override DataFlow::ClassNode getClass() {
exists(string name |
this.hasQualifiedName(name) and
result.hasQualifiedName(name)
)
or
// Handle case where a local variable has a reference to the class,
// but the class doesn't have a globally qualified name.
exists(string alias, JSDoc::Environment env |
this.hasNamePartsAndEnv(alias, "", env) and
result.getAClassReference().flowsTo(env.getNodeFromAlias(alias))
)
}
}
/**
@@ -447,12 +451,6 @@ class JSDocAppliedTypeExpr extends @jsdoc_applied_type_expr, JSDocTypeExpr {
* For example, in `Array<string>`, `string` is the only argument type.
*/
JSDocTypeExpr getAnArgument() { result = this.getArgument(_) }
override predicate hasQualifiedName(string globalName) {
this.getHead().hasQualifiedName(globalName)
}
override DataFlow::ClassNode getClass() { result = this.getHead().getClass() }
}
/**
@@ -472,8 +470,6 @@ class JSDocNullableTypeExpr extends @jsdoc_nullable_type_expr, JSDocTypeExpr {
predicate isPrefix() { jsdoc_prefix_qualifier(this) }
override JSDocTypeExpr getAnUnderlyingType() { result = this.getTypeExpr().getAnUnderlyingType() }
override DataFlow::ClassNode getClass() { result = this.getTypeExpr().getClass() }
}
/**
@@ -493,8 +489,6 @@ class JSDocNonNullableTypeExpr extends @jsdoc_non_nullable_type_expr, JSDocTypeE
predicate isPrefix() { jsdoc_prefix_qualifier(this) }
override JSDocTypeExpr getAnUnderlyingType() { result = this.getTypeExpr().getAnUnderlyingType() }
override DataFlow::ClassNode getClass() { result = this.getTypeExpr().getClass() }
}
/**
@@ -599,8 +593,6 @@ class JSDocOptionalParameterTypeExpr extends @jsdoc_optional_type_expr, JSDocTyp
override JSDocTypeExpr getAnUnderlyingType() {
result = this.getUnderlyingType().getAnUnderlyingType()
}
override DataFlow::ClassNode getClass() { result = this.getUnderlyingType().getClass() }
}
/**
@@ -635,7 +627,7 @@ module JSDoc {
/**
* A statement container which may declare JSDoc name aliases.
*/
class Environment extends StmtContainer {
deprecated class Environment extends StmtContainer {
/**
* Gets the fully qualified name aliased by the given unqualified name
* within this container.
@@ -685,7 +677,7 @@ module JSDoc {
}
pragma[noinline]
private predicate isTypenamePrefix(string name) {
deprecated private predicate isTypenamePrefix(string name) {
any(JSDocNamedTypeExpr expr).hasNameParts(name, _)
}
}

32
javascript/ql/lib/semmle/javascript/TypeAnnotations.qll
View File

@@ -4,6 +4,8 @@
import javascript
private import internal.StmtContainers
private import internal.NameResolution
private import internal.UnderlyingTypes
/**
* A type annotation, either in the form of a TypeScript type or a JSDoc comment.
@@ -75,14 +77,38 @@ class TypeAnnotation extends @type_annotation, NodeInStmtContainer {
TypeAnnotation getAnUnderlyingType() { result = this }
/**
* DEPRECATED. Use `hasUnderlyingType` instead.
*
* Holds if this is a reference to the type with qualified name `globalName` relative to the global scope.
*/
predicate hasQualifiedName(string globalName) { none() }
deprecated predicate hasQualifiedName(string globalName) {
UnderlyingTypes::nodeHasUnderlyingType(this, globalName)
}
/**
* DEPRECATED. Use `hasUnderlyingType` instead.
*
* Holds if this is a reference to the type exported from `moduleName` under the name `exportedName`.
*/
predicate hasQualifiedName(string moduleName, string exportedName) { none() }
deprecated predicate hasQualifiedName(string moduleName, string exportedName) {
UnderlyingTypes::nodeHasUnderlyingType(this, moduleName, exportedName)
}
/**
* Holds if this is a reference to the type with qualified name `globalName` relative to the global scope,
* or is declared as a subtype thereof, or is a union or intersection containing such a type.
*/
final predicate hasUnderlyingType(string globalName) {
UnderlyingTypes::nodeHasUnderlyingType(this, globalName)
}
/**
* Holds if this is a reference to the type exported from `moduleName` under the name `exportedName`,
* or is declared as a subtype thereof, or is a union or intersection containing such a type.
*/
final predicate hasUnderlyingType(string moduleName, string exportedName) {
UnderlyingTypes::nodeHasUnderlyingType(this, moduleName, exportedName)
}
/** Gets the statement in which this type appears. */
Stmt getEnclosingStmt() { none() }
@@ -107,5 +133,5 @@ class TypeAnnotation extends @type_annotation, NodeInStmtContainer {
*
* This unfolds nullability modifiers and generic type applications.
*/
DataFlow::ClassNode getClass() { none() }
final DataFlow::ClassNode getClass() { UnderlyingTypes::nodeHasUnderlyingClassType(this, result) }
}

62
javascript/ql/lib/semmle/javascript/TypeScript.qll
View File

@@ -1,4 +1,5 @@
import javascript
private import semmle.javascript.internal.UnderlyingTypes
/**
* A statement that defines a namespace, that is, a namespace declaration or enum declaration.
@@ -575,10 +576,6 @@ class TypeExpr extends ExprOrType, @typeexpr, TypeAnnotation {
override Function getEnclosingFunction() { result = ExprOrType.super.getEnclosingFunction() }
override TopLevel getTopLevel() { result = ExprOrType.super.getTopLevel() }
override DataFlow::ClassNode getClass() {
result.getAstNode() = this.getType().(ClassType).getClass()
}
}
/**
@@ -698,58 +695,9 @@ class TypeAccess extends @typeaccess, TypeExpr, TypeRef {
*/
TypeName getTypeName() { ast_node_symbol(this, result) }
override predicate hasQualifiedName(string globalName) {
this.getTypeName().hasQualifiedName(globalName)
or
exists(LocalTypeAccess local | local = this |
not exists(local.getLocalTypeName()) and // Without a local type name, the type is looked up in the global scope.
globalName = local.getName()
)
}
override predicate hasQualifiedName(string moduleName, string exportedName) {
this.getTypeName().hasQualifiedName(moduleName, exportedName)
or
exists(ImportDeclaration imprt, ImportSpecifier spec |
moduleName = getImportName(imprt) and
spec = imprt.getASpecifier()
|
spec.getImportedName() = exportedName and
this = spec.getLocal().(TypeDecl).getLocalTypeName().getAnAccess()
or
(spec instanceof ImportNamespaceSpecifier or spec instanceof ImportDefaultSpecifier) and
this =
spec.getLocal().(LocalNamespaceDecl).getLocalNamespaceName().getAMemberAccess(exportedName)
)
or
exists(ImportEqualsDeclaration imprt |
moduleName = getImportName(imprt.getImportedEntity()) and
this =
imprt
.getIdentifier()
.(LocalNamespaceDecl)
.getLocalNamespaceName()
.getAMemberAccess(exportedName)
)
}
override string getAPrimaryQlClass() { result = "TypeAccess" }
}
/**
* Gets a suitable name for the library imported by `imprt`.
*
* For relative imports, this is the snapshot-relative path to the imported module.
* For non-relative imports, it is the import path itself.
*/
private string getImportName(Import imprt) {
exists(string path | path = imprt.getImportedPathString() |
if path.regexpMatch("[./].*")
then result = imprt.getImportedModule().getFile().getRelativePath()
else result = path
)
}
/** An identifier that is used as part of a type, such as `Date`. */
class LocalTypeAccess extends @local_type_access, TypeAccess, Identifier, LexicalAccess {
override predicate isStringy() { this.getName() = "String" }
@@ -822,14 +770,6 @@ class GenericTypeExpr extends @generic_typeexpr, TypeExpr {
/** Gets the number of type arguments. This is always at least one. */
int getNumTypeArgument() { result = count(this.getATypeArgument()) }
override predicate hasQualifiedName(string globalName) {
this.getTypeAccess().hasQualifiedName(globalName)
}
override predicate hasQualifiedName(string moduleName, string exportedName) {
this.getTypeAccess().hasQualifiedName(moduleName, exportedName)
}
override string getAPrimaryQlClass() { result = "GenericTypeExpr" }
}

26
javascript/ql/lib/semmle/javascript/Variables.qll
View File

@@ -27,6 +27,12 @@ class Scope extends @scope {
result = this.getAVariable() and
result.getName() = name
}
/** Gets the local type name with the given name declared in this scope. */
LocalTypeName getLocalTypeName(string name) {
result.getScope() = this and
result.getName() = name
}
}
/**
@@ -128,8 +134,26 @@ class Variable extends @variable, LexicalName {
/** Gets the scope this variable is declared in. */
override Scope getScope() { variables(this, _, result) }
/**
* Holds if this variable is declared in the top-level of a module using a `declare` statement.
*
* For example:
* ```js
* declare var $: any;
* ```
*
* Such variables are generally treated as a global variables, except for type-checking related purposes.
*/
pragma[nomagic]
predicate isTopLevelWithAmbientDeclaration() {
this.getScope() instanceof ModuleScope and
forex(VarDecl decl | decl = this.getADeclaration() | decl.isAmbient())
}
/** Holds if this is a global variable. */
predicate isGlobal() { this.getScope() instanceof GlobalScope }
predicate isGlobal() {
this.getScope() instanceof GlobalScope or this.isTopLevelWithAmbientDeclaration()
}
/**
* Holds if this is a variable exported from a TypeScript namespace.

30
javascript/ql/lib/semmle/javascript/ViewComponentInput.qll
View File

@@ -3,6 +3,7 @@
*/
private import javascript
private import semmle.javascript.internal.TypeResolution
/**
* An input to a view component, such as React props.
@@ -14,34 +15,11 @@ abstract class ViewComponentInput extends DataFlow::Node {
private class ViewComponentInputAsThreatModelSource extends ThreatModelSource::Range instanceof ViewComponentInput
{
ViewComponentInputAsThreatModelSource() { not isSafeType(this.asExpr().getType()) }
ViewComponentInputAsThreatModelSource() {
not TypeResolution::valueHasSanitizingPrimitiveType(this.asExpr())
}
final override string getThreatModel() { result = "view-component-input" }
final override string getSourceType() { result = ViewComponentInput.super.getSourceType() }
}
private predicate isSafeType(Type t) {
t instanceof NumberLikeType
or
t instanceof BooleanLikeType
or
t instanceof UndefinedType
or
t instanceof NullType
or
t instanceof VoidType
or
hasSafeTypes(t, t.(UnionType).getNumElementType())
or
isSafeType(t.(IntersectionType).getAnElementType())
}
/** Hold if the first `n` components of `t` are safe types. */
private predicate hasSafeTypes(UnionType t, int n) {
isSafeType(t.getElementType(0)) and
n = 1
or
isSafeType(t.getElementType(n - 1)) and
hasSafeTypes(t, n - 1)
}

47
javascript/ql/lib/semmle/javascript/dataflow/DataFlow.qll
View File

@@ -27,6 +27,9 @@ private import internal.PreCallGraphStep
private import semmle.javascript.internal.CachedStages
private import semmle.javascript.dataflow.internal.DataFlowPrivate as Private
private import semmle.javascript.dataflow.internal.VariableOrThis
private import semmle.javascript.internal.NameResolution
private import semmle.javascript.internal.UnderlyingTypes
private import semmle.javascript.internal.TypeResolution
module DataFlow {
/**
@@ -189,26 +192,6 @@ module DataFlow {
FlowSteps::identityFunctionStep(result, this)
}
/**
* Gets the static type of this node as determined by the TypeScript type system.
*/
private Type getType() {
exists(AST::ValueNode node |
this = TValueNode(node) and
ast_node_type(node, result)
)
or
exists(BindingPattern pattern |
this = lvalueNode(pattern) and
ast_node_type(pattern, result)
)
or
exists(MethodDefinition def |
this = TThisNode(def.getInit()) and
ast_node_type(def.getDeclaringClass(), result)
)
}
/**
* Gets the type annotation describing the type of this node,
* provided that a static type could not be found.
@@ -229,6 +212,15 @@ module DataFlow {
)
}
private NameResolution::Node getNameResolutionNode() {
this = valueNode(result)
or
exists(PropertyPattern pattern |
result = pattern.getValuePattern() and
this = TPropNode(pattern)
)
}
/**
* Holds if this node is annotated with the given named type,
* or is declared as a subtype thereof, or is a union or intersection containing such a type.
@@ -236,9 +228,10 @@ module DataFlow {
cached
predicate hasUnderlyingType(string globalName) {
Stages::TypeTracking::ref() and
this.getType().hasUnderlyingType(globalName)
or
this.getFallbackTypeAnnotation().getAnUnderlyingType().hasQualifiedName(globalName)
exists(NameResolution::Node type |
TypeResolution::valueHasType(this.getNameResolutionNode(), type) and
UnderlyingTypes::nodeHasUnderlyingType(type, globalName)
)
}
/**
@@ -248,9 +241,11 @@ module DataFlow {
cached
predicate hasUnderlyingType(string moduleName, string typeName) {
Stages::TypeTracking::ref() and
this.getType().hasUnderlyingType(moduleName, typeName)
or
this.getFallbackTypeAnnotation().getAnUnderlyingType().hasQualifiedName(moduleName, typeName)
moduleName != "global" and
exists(NameResolution::Node type |
TypeResolution::valueHasType(this.getNameResolutionNode(), type) and
UnderlyingTypes::nodeHasUnderlyingType(type, moduleName, typeName)
)
}
/**

9
javascript/ql/lib/semmle/javascript/dataflow/Sources.qll
View File

@@ -333,7 +333,14 @@ module SourceNode {
astNode instanceof TaggedTemplateExpr or
astNode instanceof Templating::PipeRefExpr or
astNode instanceof Templating::TemplateVarRefExpr or
astNode instanceof StringLiteral
astNode instanceof StringLiteral or
astNode instanceof TypeAssertion or
astNode instanceof SatisfiesExpr
)
or
exists(VariableDeclarator decl |
exists(decl.getTypeAnnotation()) and
this = DataFlow::valueNode(decl.getBindingPattern())
)
or
DataFlow::parameterNode(this, _)

8
javascript/ql/lib/semmle/javascript/dataflow/internal/Contents.qll
View File

@@ -179,6 +179,9 @@ module Public {
/** Holds if this represents values stored at an unknown array index. */
predicate isUnknownArrayElement() { this = MkArrayElementUnknown() }
/** Holds if this represents the value of a resolved promise. */
predicate isPromiseValue() { this = MkPromiseValue() }
/** Holds if this represents values stored in a `Map` at an unknown key. */
predicate isMapValueWithUnknownKey() { this = MkMapValueWithUnknownKey() }
@@ -266,6 +269,11 @@ module Public {
or
this = ContentSet::anyCapturedContent() and
result instanceof Private::MkCapturedContent
or
// Although data flow will never use the special `Awaited` ContentSet in a read or store step,
// it may appear in type-tracking and type resolution, and here it helps to treat is as `Awaited[value]`.
this = MkAwaited() and
result = MkPromiseValue()
}
/** Gets the singleton content to be accessed. */

37
javascript/ql/lib/semmle/javascript/frameworks/Nest.qll
View File

@@ -5,6 +5,8 @@
import javascript
private import semmle.javascript.security.dataflow.ServerSideUrlRedirectCustomizations
private import semmle.javascript.dataflow.internal.PreCallGraphStep
private import semmle.javascript.internal.NameResolution
private import semmle.javascript.internal.TypeResolution
/**
* Provides classes and predicates for reasoning about [Nest](https://nestjs.com/).
@@ -133,7 +135,9 @@ module NestJS {
hasSanitizingPipe(this, false)
or
hasSanitizingPipe(this, true) and
isSanitizingType(this.getParameter().getType().unfold())
// Note: we could consider types with class-validator decorators to be sanitized here, but instead we consider the root
// object to be tainted, but omit taint steps for the individual properties names that have sanitizing decorators. See ClassValidator.qll.
TypeResolution::isSanitizingPrimitiveType(this.getParameter().getTypeAnnotation())
}
}
@@ -209,19 +213,6 @@ module NestJS {
dependsOnType = true
}
/**
* Holds if a parameter of type `t` is considered sanitized, provided it has been checked by `ValidationPipe`
* (which relies on metadata emitted by the TypeScript compiler).
*/
private predicate isSanitizingType(Type t) {
t instanceof NumberType
or
t instanceof BooleanType
//
// Note: we could consider types with class-validator decorators to be sanitized here, but instead we consider the root
// object to be tainted, but omit taint steps for the individual properties names that have sanitizing decorators. See ClassValidator.qll.
}
/**
* A user-defined pipe class, for example:
* ```js
@@ -237,7 +228,7 @@ module NestJS {
CustomPipeClass() {
exists(ClassDefinition cls |
this = cls.flow() and
cls.getASuperInterface().hasQualifiedName("@nestjs/common", "PipeTransform")
cls.getASuperInterface().hasUnderlyingType("@nestjs/common", "PipeTransform")
)
}
@@ -327,14 +318,6 @@ module NestJS {
}
}
private predicate isStringType(Type type) {
type instanceof StringType
or
type instanceof AnyType
or
isStringType(type.(PromiseType).getElementType().unfold())
}
/**
* A return value from a route handler, seen as an argument to `res.send()`.
*
@@ -353,10 +336,10 @@ module NestJS {
ReturnValueAsResponseSend() {
handler.isReturnValueReflected() and
this = handler.getAReturn() and
// Only returned strings are sinks
not exists(Type type |
type = this.asExpr().getType() and
not isStringType(type.unfold())
// Only returned strings are sinks. If we can find a type for the return value, it must be string-like.
not exists(NameResolution::Node type |
TypeResolution::valueHasType(this.asExpr(), type) and
not TypeResolution::hasUnderlyingStringOrAnyType(type)
)
}

Some files were not shown because too many files have changed in this diff Show More