From 030ab4f626064b5f81395674fb5499f6eaa088ef Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Mon, 10 Aug 2020 10:56:58 +0100
Subject: [PATCH 01/12] C++: Add string append operators to the test (changes
 layout).

---
 .../dataflow/taint-tests/localTaint.expected  | 398 +++++++++---------
 .../dataflow/taint-tests/stl.cpp              |   8 +
 .../dataflow/taint-tests/taint.expected       |  42 +-
 .../dataflow/taint-tests/test_diff.expected   |  40 +-
 .../dataflow/taint-tests/test_ir.expected     |   8 +-
 5 files changed, 252 insertions(+), 244 deletions(-)

diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
index ed26a2de21d..7e496929ee0 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
@@ -308,205 +308,205 @@
 | movableclass.cpp:65:13:65:18 | call to source | movableclass.cpp:65:13:65:20 | call to MyMovableClass | TAINT |
 | movableclass.cpp:65:13:65:20 | call to MyMovableClass | movableclass.cpp:65:8:65:9 | ref arg s3 | TAINT |
 | movableclass.cpp:65:13:65:20 | call to MyMovableClass | movableclass.cpp:65:11:65:11 | call to operator= | TAINT |
-| stl.cpp:97:12:97:17 | call to source | stl.cpp:101:7:101:7 | a |  |
-| stl.cpp:98:16:98:20 | 123 | stl.cpp:98:16:98:21 | call to basic_string | TAINT |
-| stl.cpp:98:16:98:21 | call to basic_string | stl.cpp:102:7:102:7 | b |  |
-| stl.cpp:98:16:98:21 | call to basic_string | stl.cpp:104:7:104:7 | b |  |
-| stl.cpp:99:16:99:21 | call to source | stl.cpp:99:16:99:24 | call to basic_string | TAINT |
-| stl.cpp:99:16:99:24 | call to basic_string | stl.cpp:103:7:103:7 | c |  |
-| stl.cpp:99:16:99:24 | call to basic_string | stl.cpp:105:7:105:7 | c |  |
-| stl.cpp:104:7:104:7 | b | stl.cpp:104:9:104:13 | call to c_str | TAINT |
-| stl.cpp:105:7:105:7 | c | stl.cpp:105:9:105:13 | call to c_str | TAINT |
-| stl.cpp:110:20:110:22 | call to basic_stringstream | stl.cpp:113:2:113:4 | ss1 |  |
-| stl.cpp:110:20:110:22 | call to basic_stringstream | stl.cpp:119:7:119:9 | ss1 |  |
-| stl.cpp:110:20:110:22 | call to basic_stringstream | stl.cpp:124:7:124:9 | ss1 |  |
-| stl.cpp:110:25:110:27 | call to basic_stringstream | stl.cpp:114:2:114:4 | ss2 |  |
-| stl.cpp:110:25:110:27 | call to basic_stringstream | stl.cpp:120:7:120:9 | ss2 |  |
-| stl.cpp:110:25:110:27 | call to basic_stringstream | stl.cpp:125:7:125:9 | ss2 |  |
-| stl.cpp:110:30:110:32 | call to basic_stringstream | stl.cpp:115:2:115:4 | ss3 |  |
-| stl.cpp:110:30:110:32 | call to basic_stringstream | stl.cpp:121:7:121:9 | ss3 |  |
-| stl.cpp:110:30:110:32 | call to basic_stringstream | stl.cpp:126:7:126:9 | ss3 |  |
-| stl.cpp:110:35:110:37 | call to basic_stringstream | stl.cpp:116:2:116:4 | ss4 |  |
-| stl.cpp:110:35:110:37 | call to basic_stringstream | stl.cpp:122:7:122:9 | ss4 |  |
-| stl.cpp:110:35:110:37 | call to basic_stringstream | stl.cpp:127:7:127:9 | ss4 |  |
-| stl.cpp:110:40:110:42 | call to basic_stringstream | stl.cpp:117:2:117:4 | ss5 |  |
-| stl.cpp:110:40:110:42 | call to basic_stringstream | stl.cpp:123:7:123:9 | ss5 |  |
-| stl.cpp:110:40:110:42 | call to basic_stringstream | stl.cpp:128:7:128:9 | ss5 |  |
-| stl.cpp:111:16:111:21 | call to source | stl.cpp:111:16:111:24 | call to basic_string | TAINT |
-| stl.cpp:111:16:111:24 | call to basic_string | stl.cpp:117:9:117:9 | t |  |
-| stl.cpp:113:2:113:4 | ref arg ss1 | stl.cpp:119:7:119:9 | ss1 |  |
-| stl.cpp:113:2:113:4 | ref arg ss1 | stl.cpp:124:7:124:9 | ss1 |  |
-| stl.cpp:114:2:114:4 | ref arg ss2 | stl.cpp:120:7:120:9 | ss2 |  |
-| stl.cpp:114:2:114:4 | ref arg ss2 | stl.cpp:125:7:125:9 | ss2 |  |
-| stl.cpp:115:2:115:4 | ref arg ss3 | stl.cpp:121:7:121:9 | ss3 |  |
-| stl.cpp:115:2:115:4 | ref arg ss3 | stl.cpp:126:7:126:9 | ss3 |  |
-| stl.cpp:116:2:116:4 | ref arg ss4 | stl.cpp:122:7:122:9 | ss4 |  |
-| stl.cpp:116:2:116:4 | ref arg ss4 | stl.cpp:127:7:127:9 | ss4 |  |
-| stl.cpp:117:2:117:4 | ref arg ss5 | stl.cpp:123:7:123:9 | ss5 |  |
-| stl.cpp:117:2:117:4 | ref arg ss5 | stl.cpp:128:7:128:9 | ss5 |  |
-| stl.cpp:131:32:131:37 | source | stl.cpp:136:9:136:14 | source |  |
-| stl.cpp:133:20:133:22 | call to basic_stringstream | stl.cpp:135:2:135:4 | ss1 |  |
-| stl.cpp:133:20:133:22 | call to basic_stringstream | stl.cpp:138:7:138:9 | ss1 |  |
-| stl.cpp:133:20:133:22 | call to basic_stringstream | stl.cpp:140:7:140:9 | ss1 |  |
-| stl.cpp:133:25:133:27 | call to basic_stringstream | stl.cpp:136:2:136:4 | ss2 |  |
-| stl.cpp:133:25:133:27 | call to basic_stringstream | stl.cpp:139:7:139:9 | ss2 |  |
-| stl.cpp:133:25:133:27 | call to basic_stringstream | stl.cpp:141:7:141:9 | ss2 |  |
-| stl.cpp:135:2:135:4 | ref arg ss1 | stl.cpp:138:7:138:9 | ss1 |  |
-| stl.cpp:135:2:135:4 | ref arg ss1 | stl.cpp:140:7:140:9 | ss1 |  |
-| stl.cpp:136:2:136:4 | ref arg ss2 | stl.cpp:139:7:139:9 | ss2 |  |
-| stl.cpp:136:2:136:4 | ref arg ss2 | stl.cpp:141:7:141:9 | ss2 |  |
-| stl.cpp:154:16:154:28 | call to basic_string | stl.cpp:155:7:155:11 | path1 |  |
-| stl.cpp:154:17:154:26 | call to user_input | stl.cpp:154:16:154:28 | call to basic_string | TAINT |
-| stl.cpp:155:7:155:11 | path1 | stl.cpp:155:13:155:17 | call to c_str | TAINT |
-| stl.cpp:158:10:158:19 | call to user_input | stl.cpp:158:10:158:21 | call to basic_string | TAINT |
-| stl.cpp:158:10:158:21 | call to basic_string | stl.cpp:158:2:158:21 | ... = ... |  |
-| stl.cpp:158:10:158:21 | call to basic_string | stl.cpp:159:7:159:11 | path2 |  |
-| stl.cpp:159:7:159:11 | path2 | stl.cpp:159:13:159:17 | call to c_str | TAINT |
-| stl.cpp:161:15:161:24 | call to user_input | stl.cpp:161:15:161:27 | call to basic_string | TAINT |
-| stl.cpp:161:15:161:27 | call to basic_string | stl.cpp:162:7:162:11 | path3 |  |
-| stl.cpp:162:7:162:11 | path3 | stl.cpp:162:13:162:17 | call to c_str | TAINT |
-| stl.cpp:167:19:167:24 | call to source | stl.cpp:170:17:170:18 | cs |  |
-| stl.cpp:167:19:167:24 | call to source | stl.cpp:172:7:172:8 | cs |  |
-| stl.cpp:170:17:170:18 | cs | stl.cpp:170:17:170:19 | call to basic_string | TAINT |
-| stl.cpp:170:17:170:19 | call to basic_string | stl.cpp:173:7:173:8 | ss |  |
-| stl.cpp:178:19:178:24 | call to source | stl.cpp:181:17:181:18 | cs |  |
-| stl.cpp:181:17:181:18 | cs | stl.cpp:181:17:181:19 | call to basic_string | TAINT |
-| stl.cpp:181:17:181:19 | call to basic_string | stl.cpp:184:7:184:8 | ss |  |
-| stl.cpp:181:17:181:19 | call to basic_string | stl.cpp:187:7:187:8 | ss |  |
-| stl.cpp:184:7:184:8 | ss | stl.cpp:184:10:184:14 | call to c_str | TAINT |
-| stl.cpp:184:10:184:14 | call to c_str | stl.cpp:184:2:184:16 | ... = ... |  |
-| stl.cpp:184:10:184:14 | call to c_str | stl.cpp:186:7:186:8 | cs |  |
-| stl.cpp:193:18:193:24 | hello | stl.cpp:193:18:193:25 | call to basic_string | TAINT |
-| stl.cpp:193:18:193:25 | call to basic_string | stl.cpp:198:8:198:9 | s1 |  |
-| stl.cpp:194:19:194:26 | call to basic_string | stl.cpp:199:8:199:9 | s2 |  |
-| stl.cpp:194:20:194:26 | hello | stl.cpp:194:19:194:26 | call to basic_string | TAINT |
-| stl.cpp:196:8:196:14 | call to basic_string | stl.cpp:196:3:196:14 | ... = ... |  |
-| stl.cpp:196:8:196:14 | call to basic_string | stl.cpp:200:8:200:9 | s3 |  |
-| stl.cpp:196:8:196:14 | hello | stl.cpp:196:8:196:14 | call to basic_string | TAINT |
-| stl.cpp:204:18:204:23 | call to source | stl.cpp:204:18:204:26 | call to basic_string | TAINT |
-| stl.cpp:204:18:204:26 | call to basic_string | stl.cpp:209:8:209:9 | s1 |  |
-| stl.cpp:205:19:205:27 | call to basic_string | stl.cpp:210:8:210:9 | s2 |  |
-| stl.cpp:205:20:205:25 | call to source | stl.cpp:205:19:205:27 | call to basic_string | TAINT |
-| stl.cpp:207:8:207:13 | call to source | stl.cpp:207:8:207:15 | call to basic_string | TAINT |
-| stl.cpp:207:8:207:15 | call to basic_string | stl.cpp:207:3:207:15 | ... = ... |  |
-| stl.cpp:207:8:207:15 | call to basic_string | stl.cpp:211:8:211:9 | s3 |  |
-| stl.cpp:215:15:215:16 | call to basic_string | stl.cpp:216:20:216:21 | s1 |  |
-| stl.cpp:215:15:215:16 | call to basic_string | stl.cpp:218:8:218:9 | s1 |  |
-| stl.cpp:215:15:215:16 | call to basic_string | stl.cpp:220:8:220:9 | s1 |  |
-| stl.cpp:216:20:216:21 | s1 | stl.cpp:221:8:221:9 | s2 |  |
-| stl.cpp:218:8:218:9 | s1 | stl.cpp:218:3:218:9 | ... = ... |  |
-| stl.cpp:218:8:218:9 | s1 | stl.cpp:222:8:222:9 | s3 |  |
-| stl.cpp:226:19:226:40 | call to basic_string | stl.cpp:230:8:230:9 | s1 |  |
-| stl.cpp:226:32:226:37 | call to source | stl.cpp:226:19:226:40 | call to basic_string | TAINT |
-| stl.cpp:228:8:228:28 | call to basic_string | stl.cpp:228:3:228:28 | ... = ... |  |
-| stl.cpp:228:8:228:28 | call to basic_string | stl.cpp:231:8:231:9 | s2 |  |
-| stl.cpp:228:20:228:25 | call to source | stl.cpp:228:8:228:28 | call to basic_string | TAINT |
-| stl.cpp:238:16:238:21 | call to source | stl.cpp:238:16:238:24 | call to basic_string | TAINT |
-| stl.cpp:238:16:238:24 | call to basic_string | stl.cpp:239:15:239:15 | s |  |
-| stl.cpp:238:16:238:24 | call to basic_string | stl.cpp:243:33:243:33 | s |  |
-| stl.cpp:238:16:238:24 | call to basic_string | stl.cpp:243:50:243:50 | s |  |
-| stl.cpp:238:16:238:24 | call to basic_string | stl.cpp:247:16:247:16 | s |  |
-| stl.cpp:239:15:239:15 | call to begin | stl.cpp:239:15:239:15 | (__begin) |  |
-| stl.cpp:239:15:239:15 | call to begin | stl.cpp:239:15:239:15 | (__begin) |  |
-| stl.cpp:239:15:239:15 | call to begin | stl.cpp:239:15:239:15 | (__begin) |  |
-| stl.cpp:239:15:239:15 | call to end | stl.cpp:239:15:239:15 | (__end) |  |
-| stl.cpp:239:15:239:15 | call to operator* | stl.cpp:240:8:240:8 | c |  |
-| stl.cpp:239:15:239:15 | ref arg (__begin) | stl.cpp:239:15:239:15 | (__begin) |  |
-| stl.cpp:239:15:239:15 | ref arg (__begin) | stl.cpp:239:15:239:15 | (__begin) |  |
-| stl.cpp:239:15:239:15 | ref arg (__begin) | stl.cpp:239:15:239:15 | (__begin) |  |
-| stl.cpp:239:15:239:15 | ref arg (__range) | stl.cpp:239:15:239:15 | (__range) |  |
-| stl.cpp:239:15:239:15 | s | stl.cpp:239:15:239:15 | (__range) |  |
-| stl.cpp:239:15:239:15 | s | stl.cpp:239:15:239:15 | (__range) |  |
-| stl.cpp:239:15:239:15 | s | stl.cpp:239:15:239:15 | call to operator* | TAINT |
-| stl.cpp:243:33:243:33 | ref arg s | stl.cpp:243:50:243:50 | s |  |
-| stl.cpp:243:33:243:33 | ref arg s | stl.cpp:247:16:247:16 | s |  |
-| stl.cpp:243:35:243:39 | call to begin | stl.cpp:243:44:243:45 | it |  |
-| stl.cpp:243:35:243:39 | call to begin | stl.cpp:243:61:243:62 | it |  |
-| stl.cpp:243:35:243:39 | call to begin | stl.cpp:244:9:244:10 | it |  |
-| stl.cpp:243:50:243:50 | ref arg s | stl.cpp:243:50:243:50 | s |  |
-| stl.cpp:243:50:243:50 | ref arg s | stl.cpp:247:16:247:16 | s |  |
-| stl.cpp:243:61:243:62 | ref arg it | stl.cpp:243:44:243:45 | it |  |
-| stl.cpp:243:61:243:62 | ref arg it | stl.cpp:243:61:243:62 | it |  |
-| stl.cpp:243:61:243:62 | ref arg it | stl.cpp:244:9:244:10 | it |  |
-| stl.cpp:247:16:247:16 | call to begin | stl.cpp:247:16:247:16 | (__begin) |  |
-| stl.cpp:247:16:247:16 | call to begin | stl.cpp:247:16:247:16 | (__begin) |  |
-| stl.cpp:247:16:247:16 | call to begin | stl.cpp:247:16:247:16 | (__begin) |  |
-| stl.cpp:247:16:247:16 | call to end | stl.cpp:247:16:247:16 | (__end) |  |
-| stl.cpp:247:16:247:16 | call to operator* | stl.cpp:248:8:248:8 | c |  |
-| stl.cpp:247:16:247:16 | ref arg (__begin) | stl.cpp:247:16:247:16 | (__begin) |  |
-| stl.cpp:247:16:247:16 | ref arg (__begin) | stl.cpp:247:16:247:16 | (__begin) |  |
-| stl.cpp:247:16:247:16 | ref arg (__begin) | stl.cpp:247:16:247:16 | (__begin) |  |
-| stl.cpp:247:16:247:16 | ref arg (__range) | stl.cpp:247:16:247:16 | (__range) |  |
-| stl.cpp:247:16:247:16 | s | stl.cpp:247:16:247:16 | (__range) |  |
-| stl.cpp:247:16:247:16 | s | stl.cpp:247:16:247:16 | (__range) |  |
-| stl.cpp:247:16:247:16 | s | stl.cpp:247:16:247:16 | call to operator* | TAINT |
-| stl.cpp:251:28:251:33 | call to source | stl.cpp:251:28:251:36 | call to basic_string | TAINT |
-| stl.cpp:251:28:251:36 | call to basic_string | stl.cpp:252:22:252:28 | const_s |  |
-| stl.cpp:252:22:252:22 | call to begin | stl.cpp:252:22:252:22 | (__begin) |  |
-| stl.cpp:252:22:252:22 | call to begin | stl.cpp:252:22:252:22 | (__begin) |  |
-| stl.cpp:252:22:252:22 | call to begin | stl.cpp:252:22:252:22 | (__begin) |  |
-| stl.cpp:252:22:252:22 | call to end | stl.cpp:252:22:252:22 | (__end) |  |
-| stl.cpp:252:22:252:22 | call to operator* | stl.cpp:253:8:253:8 | c |  |
-| stl.cpp:252:22:252:22 | ref arg (__begin) | stl.cpp:252:22:252:22 | (__begin) |  |
-| stl.cpp:252:22:252:22 | ref arg (__begin) | stl.cpp:252:22:252:22 | (__begin) |  |
-| stl.cpp:252:22:252:22 | ref arg (__begin) | stl.cpp:252:22:252:22 | (__begin) |  |
-| stl.cpp:252:22:252:28 | const_s | stl.cpp:252:22:252:22 | (__range) |  |
-| stl.cpp:252:22:252:28 | const_s | stl.cpp:252:22:252:22 | (__range) |  |
-| stl.cpp:252:22:252:28 | const_s | stl.cpp:252:22:252:22 | call to operator* | TAINT |
-| stl.cpp:288:43:288:49 | source1 | stl.cpp:292:21:292:27 | source1 |  |
-| stl.cpp:288:43:288:49 | source1 | stl.cpp:306:33:306:39 | source1 |  |
-| stl.cpp:292:21:292:27 | source1 | stl.cpp:292:21:292:28 | call to vector | TAINT |
-| stl.cpp:292:21:292:28 | call to vector | stl.cpp:294:14:294:14 | v |  |
-| stl.cpp:292:21:292:28 | call to vector | stl.cpp:298:38:298:38 | v |  |
-| stl.cpp:292:21:292:28 | call to vector | stl.cpp:298:55:298:55 | v |  |
-| stl.cpp:292:21:292:28 | call to vector | stl.cpp:302:15:302:15 | v |  |
-| stl.cpp:294:14:294:14 | call to begin | stl.cpp:294:14:294:14 | (__begin) |  |
-| stl.cpp:294:14:294:14 | call to begin | stl.cpp:294:14:294:14 | (__begin) |  |
-| stl.cpp:294:14:294:14 | call to begin | stl.cpp:294:14:294:14 | (__begin) |  |
-| stl.cpp:294:14:294:14 | call to end | stl.cpp:294:14:294:14 | (__end) |  |
-| stl.cpp:294:14:294:14 | call to operator* | stl.cpp:295:8:295:8 | x |  |
-| stl.cpp:294:14:294:14 | ref arg (__begin) | stl.cpp:294:14:294:14 | (__begin) |  |
-| stl.cpp:294:14:294:14 | ref arg (__begin) | stl.cpp:294:14:294:14 | (__begin) |  |
-| stl.cpp:294:14:294:14 | ref arg (__begin) | stl.cpp:294:14:294:14 | (__begin) |  |
-| stl.cpp:294:14:294:14 | ref arg (__range) | stl.cpp:294:14:294:14 | (__range) |  |
-| stl.cpp:294:14:294:14 | v | stl.cpp:294:14:294:14 | (__range) |  |
-| stl.cpp:294:14:294:14 | v | stl.cpp:294:14:294:14 | (__range) |  |
-| stl.cpp:294:14:294:14 | v | stl.cpp:294:14:294:14 | call to operator* | TAINT |
-| stl.cpp:298:38:298:38 | ref arg v | stl.cpp:298:55:298:55 | v |  |
-| stl.cpp:298:38:298:38 | ref arg v | stl.cpp:302:15:302:15 | v |  |
-| stl.cpp:298:40:298:44 | call to begin | stl.cpp:298:49:298:50 | it |  |
-| stl.cpp:298:40:298:44 | call to begin | stl.cpp:298:66:298:67 | it |  |
-| stl.cpp:298:40:298:44 | call to begin | stl.cpp:299:9:299:10 | it |  |
-| stl.cpp:298:55:298:55 | ref arg v | stl.cpp:298:55:298:55 | v |  |
-| stl.cpp:298:55:298:55 | ref arg v | stl.cpp:302:15:302:15 | v |  |
-| stl.cpp:298:66:298:67 | ref arg it | stl.cpp:298:49:298:50 | it |  |
-| stl.cpp:298:66:298:67 | ref arg it | stl.cpp:298:66:298:67 | it |  |
-| stl.cpp:298:66:298:67 | ref arg it | stl.cpp:299:9:299:10 | it |  |
-| stl.cpp:302:15:302:15 | call to begin | stl.cpp:302:15:302:15 | (__begin) |  |
-| stl.cpp:302:15:302:15 | call to begin | stl.cpp:302:15:302:15 | (__begin) |  |
-| stl.cpp:302:15:302:15 | call to begin | stl.cpp:302:15:302:15 | (__begin) |  |
-| stl.cpp:302:15:302:15 | call to end | stl.cpp:302:15:302:15 | (__end) |  |
-| stl.cpp:302:15:302:15 | call to operator* | stl.cpp:303:8:303:8 | x |  |
-| stl.cpp:302:15:302:15 | ref arg (__begin) | stl.cpp:302:15:302:15 | (__begin) |  |
-| stl.cpp:302:15:302:15 | ref arg (__begin) | stl.cpp:302:15:302:15 | (__begin) |  |
-| stl.cpp:302:15:302:15 | ref arg (__begin) | stl.cpp:302:15:302:15 | (__begin) |  |
-| stl.cpp:302:15:302:15 | ref arg (__range) | stl.cpp:302:15:302:15 | (__range) |  |
-| stl.cpp:302:15:302:15 | v | stl.cpp:302:15:302:15 | (__range) |  |
-| stl.cpp:302:15:302:15 | v | stl.cpp:302:15:302:15 | (__range) |  |
-| stl.cpp:302:15:302:15 | v | stl.cpp:302:15:302:15 | call to operator* | TAINT |
-| stl.cpp:306:33:306:39 | source1 | stl.cpp:306:33:306:40 | call to vector | TAINT |
-| stl.cpp:306:33:306:40 | call to vector | stl.cpp:307:21:307:27 | const_v |  |
-| stl.cpp:307:21:307:21 | call to begin | stl.cpp:307:21:307:21 | (__begin) |  |
-| stl.cpp:307:21:307:21 | call to begin | stl.cpp:307:21:307:21 | (__begin) |  |
-| stl.cpp:307:21:307:21 | call to begin | stl.cpp:307:21:307:21 | (__begin) |  |
-| stl.cpp:307:21:307:21 | call to end | stl.cpp:307:21:307:21 | (__end) |  |
-| stl.cpp:307:21:307:21 | call to operator* | stl.cpp:308:8:308:8 | x |  |
-| stl.cpp:307:21:307:21 | ref arg (__begin) | stl.cpp:307:21:307:21 | (__begin) |  |
-| stl.cpp:307:21:307:21 | ref arg (__begin) | stl.cpp:307:21:307:21 | (__begin) |  |
-| stl.cpp:307:21:307:21 | ref arg (__begin) | stl.cpp:307:21:307:21 | (__begin) |  |
-| stl.cpp:307:21:307:27 | const_v | stl.cpp:307:21:307:21 | (__range) |  |
-| stl.cpp:307:21:307:27 | const_v | stl.cpp:307:21:307:21 | (__range) |  |
-| stl.cpp:307:21:307:27 | const_v | stl.cpp:307:21:307:21 | call to operator* | TAINT |
+| stl.cpp:105:12:105:17 | call to source | stl.cpp:109:7:109:7 | a |  |
+| stl.cpp:106:16:106:20 | 123 | stl.cpp:106:16:106:21 | call to basic_string | TAINT |
+| stl.cpp:106:16:106:21 | call to basic_string | stl.cpp:110:7:110:7 | b |  |
+| stl.cpp:106:16:106:21 | call to basic_string | stl.cpp:112:7:112:7 | b |  |
+| stl.cpp:107:16:107:21 | call to source | stl.cpp:107:16:107:24 | call to basic_string | TAINT |
+| stl.cpp:107:16:107:24 | call to basic_string | stl.cpp:111:7:111:7 | c |  |
+| stl.cpp:107:16:107:24 | call to basic_string | stl.cpp:113:7:113:7 | c |  |
+| stl.cpp:112:7:112:7 | b | stl.cpp:112:9:112:13 | call to c_str | TAINT |
+| stl.cpp:113:7:113:7 | c | stl.cpp:113:9:113:13 | call to c_str | TAINT |
+| stl.cpp:118:20:118:22 | call to basic_stringstream | stl.cpp:121:2:121:4 | ss1 |  |
+| stl.cpp:118:20:118:22 | call to basic_stringstream | stl.cpp:127:7:127:9 | ss1 |  |
+| stl.cpp:118:20:118:22 | call to basic_stringstream | stl.cpp:132:7:132:9 | ss1 |  |
+| stl.cpp:118:25:118:27 | call to basic_stringstream | stl.cpp:122:2:122:4 | ss2 |  |
+| stl.cpp:118:25:118:27 | call to basic_stringstream | stl.cpp:128:7:128:9 | ss2 |  |
+| stl.cpp:118:25:118:27 | call to basic_stringstream | stl.cpp:133:7:133:9 | ss2 |  |
+| stl.cpp:118:30:118:32 | call to basic_stringstream | stl.cpp:123:2:123:4 | ss3 |  |
+| stl.cpp:118:30:118:32 | call to basic_stringstream | stl.cpp:129:7:129:9 | ss3 |  |
+| stl.cpp:118:30:118:32 | call to basic_stringstream | stl.cpp:134:7:134:9 | ss3 |  |
+| stl.cpp:118:35:118:37 | call to basic_stringstream | stl.cpp:124:2:124:4 | ss4 |  |
+| stl.cpp:118:35:118:37 | call to basic_stringstream | stl.cpp:130:7:130:9 | ss4 |  |
+| stl.cpp:118:35:118:37 | call to basic_stringstream | stl.cpp:135:7:135:9 | ss4 |  |
+| stl.cpp:118:40:118:42 | call to basic_stringstream | stl.cpp:125:2:125:4 | ss5 |  |
+| stl.cpp:118:40:118:42 | call to basic_stringstream | stl.cpp:131:7:131:9 | ss5 |  |
+| stl.cpp:118:40:118:42 | call to basic_stringstream | stl.cpp:136:7:136:9 | ss5 |  |
+| stl.cpp:119:16:119:21 | call to source | stl.cpp:119:16:119:24 | call to basic_string | TAINT |
+| stl.cpp:119:16:119:24 | call to basic_string | stl.cpp:125:9:125:9 | t |  |
+| stl.cpp:121:2:121:4 | ref arg ss1 | stl.cpp:127:7:127:9 | ss1 |  |
+| stl.cpp:121:2:121:4 | ref arg ss1 | stl.cpp:132:7:132:9 | ss1 |  |
+| stl.cpp:122:2:122:4 | ref arg ss2 | stl.cpp:128:7:128:9 | ss2 |  |
+| stl.cpp:122:2:122:4 | ref arg ss2 | stl.cpp:133:7:133:9 | ss2 |  |
+| stl.cpp:123:2:123:4 | ref arg ss3 | stl.cpp:129:7:129:9 | ss3 |  |
+| stl.cpp:123:2:123:4 | ref arg ss3 | stl.cpp:134:7:134:9 | ss3 |  |
+| stl.cpp:124:2:124:4 | ref arg ss4 | stl.cpp:130:7:130:9 | ss4 |  |
+| stl.cpp:124:2:124:4 | ref arg ss4 | stl.cpp:135:7:135:9 | ss4 |  |
+| stl.cpp:125:2:125:4 | ref arg ss5 | stl.cpp:131:7:131:9 | ss5 |  |
+| stl.cpp:125:2:125:4 | ref arg ss5 | stl.cpp:136:7:136:9 | ss5 |  |
+| stl.cpp:139:32:139:37 | source | stl.cpp:144:9:144:14 | source |  |
+| stl.cpp:141:20:141:22 | call to basic_stringstream | stl.cpp:143:2:143:4 | ss1 |  |
+| stl.cpp:141:20:141:22 | call to basic_stringstream | stl.cpp:146:7:146:9 | ss1 |  |
+| stl.cpp:141:20:141:22 | call to basic_stringstream | stl.cpp:148:7:148:9 | ss1 |  |
+| stl.cpp:141:25:141:27 | call to basic_stringstream | stl.cpp:144:2:144:4 | ss2 |  |
+| stl.cpp:141:25:141:27 | call to basic_stringstream | stl.cpp:147:7:147:9 | ss2 |  |
+| stl.cpp:141:25:141:27 | call to basic_stringstream | stl.cpp:149:7:149:9 | ss2 |  |
+| stl.cpp:143:2:143:4 | ref arg ss1 | stl.cpp:146:7:146:9 | ss1 |  |
+| stl.cpp:143:2:143:4 | ref arg ss1 | stl.cpp:148:7:148:9 | ss1 |  |
+| stl.cpp:144:2:144:4 | ref arg ss2 | stl.cpp:147:7:147:9 | ss2 |  |
+| stl.cpp:144:2:144:4 | ref arg ss2 | stl.cpp:149:7:149:9 | ss2 |  |
+| stl.cpp:162:16:162:28 | call to basic_string | stl.cpp:163:7:163:11 | path1 |  |
+| stl.cpp:162:17:162:26 | call to user_input | stl.cpp:162:16:162:28 | call to basic_string | TAINT |
+| stl.cpp:163:7:163:11 | path1 | stl.cpp:163:13:163:17 | call to c_str | TAINT |
+| stl.cpp:166:10:166:19 | call to user_input | stl.cpp:166:10:166:21 | call to basic_string | TAINT |
+| stl.cpp:166:10:166:21 | call to basic_string | stl.cpp:166:2:166:21 | ... = ... |  |
+| stl.cpp:166:10:166:21 | call to basic_string | stl.cpp:167:7:167:11 | path2 |  |
+| stl.cpp:167:7:167:11 | path2 | stl.cpp:167:13:167:17 | call to c_str | TAINT |
+| stl.cpp:169:15:169:24 | call to user_input | stl.cpp:169:15:169:27 | call to basic_string | TAINT |
+| stl.cpp:169:15:169:27 | call to basic_string | stl.cpp:170:7:170:11 | path3 |  |
+| stl.cpp:170:7:170:11 | path3 | stl.cpp:170:13:170:17 | call to c_str | TAINT |
+| stl.cpp:175:19:175:24 | call to source | stl.cpp:178:17:178:18 | cs |  |
+| stl.cpp:175:19:175:24 | call to source | stl.cpp:180:7:180:8 | cs |  |
+| stl.cpp:178:17:178:18 | cs | stl.cpp:178:17:178:19 | call to basic_string | TAINT |
+| stl.cpp:178:17:178:19 | call to basic_string | stl.cpp:181:7:181:8 | ss |  |
+| stl.cpp:186:19:186:24 | call to source | stl.cpp:189:17:189:18 | cs |  |
+| stl.cpp:189:17:189:18 | cs | stl.cpp:189:17:189:19 | call to basic_string | TAINT |
+| stl.cpp:189:17:189:19 | call to basic_string | stl.cpp:192:7:192:8 | ss |  |
+| stl.cpp:189:17:189:19 | call to basic_string | stl.cpp:195:7:195:8 | ss |  |
+| stl.cpp:192:7:192:8 | ss | stl.cpp:192:10:192:14 | call to c_str | TAINT |
+| stl.cpp:192:10:192:14 | call to c_str | stl.cpp:192:2:192:16 | ... = ... |  |
+| stl.cpp:192:10:192:14 | call to c_str | stl.cpp:194:7:194:8 | cs |  |
+| stl.cpp:201:18:201:24 | hello | stl.cpp:201:18:201:25 | call to basic_string | TAINT |
+| stl.cpp:201:18:201:25 | call to basic_string | stl.cpp:206:8:206:9 | s1 |  |
+| stl.cpp:202:19:202:26 | call to basic_string | stl.cpp:207:8:207:9 | s2 |  |
+| stl.cpp:202:20:202:26 | hello | stl.cpp:202:19:202:26 | call to basic_string | TAINT |
+| stl.cpp:204:8:204:14 | call to basic_string | stl.cpp:204:3:204:14 | ... = ... |  |
+| stl.cpp:204:8:204:14 | call to basic_string | stl.cpp:208:8:208:9 | s3 |  |
+| stl.cpp:204:8:204:14 | hello | stl.cpp:204:8:204:14 | call to basic_string | TAINT |
+| stl.cpp:212:18:212:23 | call to source | stl.cpp:212:18:212:26 | call to basic_string | TAINT |
+| stl.cpp:212:18:212:26 | call to basic_string | stl.cpp:217:8:217:9 | s1 |  |
+| stl.cpp:213:19:213:27 | call to basic_string | stl.cpp:218:8:218:9 | s2 |  |
+| stl.cpp:213:20:213:25 | call to source | stl.cpp:213:19:213:27 | call to basic_string | TAINT |
+| stl.cpp:215:8:215:13 | call to source | stl.cpp:215:8:215:15 | call to basic_string | TAINT |
+| stl.cpp:215:8:215:15 | call to basic_string | stl.cpp:215:3:215:15 | ... = ... |  |
+| stl.cpp:215:8:215:15 | call to basic_string | stl.cpp:219:8:219:9 | s3 |  |
+| stl.cpp:223:15:223:16 | call to basic_string | stl.cpp:224:20:224:21 | s1 |  |
+| stl.cpp:223:15:223:16 | call to basic_string | stl.cpp:226:8:226:9 | s1 |  |
+| stl.cpp:223:15:223:16 | call to basic_string | stl.cpp:228:8:228:9 | s1 |  |
+| stl.cpp:224:20:224:21 | s1 | stl.cpp:229:8:229:9 | s2 |  |
+| stl.cpp:226:8:226:9 | s1 | stl.cpp:226:3:226:9 | ... = ... |  |
+| stl.cpp:226:8:226:9 | s1 | stl.cpp:230:8:230:9 | s3 |  |
+| stl.cpp:234:19:234:40 | call to basic_string | stl.cpp:238:8:238:9 | s1 |  |
+| stl.cpp:234:32:234:37 | call to source | stl.cpp:234:19:234:40 | call to basic_string | TAINT |
+| stl.cpp:236:8:236:28 | call to basic_string | stl.cpp:236:3:236:28 | ... = ... |  |
+| stl.cpp:236:8:236:28 | call to basic_string | stl.cpp:239:8:239:9 | s2 |  |
+| stl.cpp:236:20:236:25 | call to source | stl.cpp:236:8:236:28 | call to basic_string | TAINT |
+| stl.cpp:246:16:246:21 | call to source | stl.cpp:246:16:246:24 | call to basic_string | TAINT |
+| stl.cpp:246:16:246:24 | call to basic_string | stl.cpp:247:15:247:15 | s |  |
+| stl.cpp:246:16:246:24 | call to basic_string | stl.cpp:251:33:251:33 | s |  |
+| stl.cpp:246:16:246:24 | call to basic_string | stl.cpp:251:50:251:50 | s |  |
+| stl.cpp:246:16:246:24 | call to basic_string | stl.cpp:255:16:255:16 | s |  |
+| stl.cpp:247:15:247:15 | call to begin | stl.cpp:247:15:247:15 | (__begin) |  |
+| stl.cpp:247:15:247:15 | call to begin | stl.cpp:247:15:247:15 | (__begin) |  |
+| stl.cpp:247:15:247:15 | call to begin | stl.cpp:247:15:247:15 | (__begin) |  |
+| stl.cpp:247:15:247:15 | call to end | stl.cpp:247:15:247:15 | (__end) |  |
+| stl.cpp:247:15:247:15 | call to operator* | stl.cpp:248:8:248:8 | c |  |
+| stl.cpp:247:15:247:15 | ref arg (__begin) | stl.cpp:247:15:247:15 | (__begin) |  |
+| stl.cpp:247:15:247:15 | ref arg (__begin) | stl.cpp:247:15:247:15 | (__begin) |  |
+| stl.cpp:247:15:247:15 | ref arg (__begin) | stl.cpp:247:15:247:15 | (__begin) |  |
+| stl.cpp:247:15:247:15 | ref arg (__range) | stl.cpp:247:15:247:15 | (__range) |  |
+| stl.cpp:247:15:247:15 | s | stl.cpp:247:15:247:15 | (__range) |  |
+| stl.cpp:247:15:247:15 | s | stl.cpp:247:15:247:15 | (__range) |  |
+| stl.cpp:247:15:247:15 | s | stl.cpp:247:15:247:15 | call to operator* | TAINT |
+| stl.cpp:251:33:251:33 | ref arg s | stl.cpp:251:50:251:50 | s |  |
+| stl.cpp:251:33:251:33 | ref arg s | stl.cpp:255:16:255:16 | s |  |
+| stl.cpp:251:35:251:39 | call to begin | stl.cpp:251:44:251:45 | it |  |
+| stl.cpp:251:35:251:39 | call to begin | stl.cpp:251:61:251:62 | it |  |
+| stl.cpp:251:35:251:39 | call to begin | stl.cpp:252:9:252:10 | it |  |
+| stl.cpp:251:50:251:50 | ref arg s | stl.cpp:251:50:251:50 | s |  |
+| stl.cpp:251:50:251:50 | ref arg s | stl.cpp:255:16:255:16 | s |  |
+| stl.cpp:251:61:251:62 | ref arg it | stl.cpp:251:44:251:45 | it |  |
+| stl.cpp:251:61:251:62 | ref arg it | stl.cpp:251:61:251:62 | it |  |
+| stl.cpp:251:61:251:62 | ref arg it | stl.cpp:252:9:252:10 | it |  |
+| stl.cpp:255:16:255:16 | call to begin | stl.cpp:255:16:255:16 | (__begin) |  |
+| stl.cpp:255:16:255:16 | call to begin | stl.cpp:255:16:255:16 | (__begin) |  |
+| stl.cpp:255:16:255:16 | call to begin | stl.cpp:255:16:255:16 | (__begin) |  |
+| stl.cpp:255:16:255:16 | call to end | stl.cpp:255:16:255:16 | (__end) |  |
+| stl.cpp:255:16:255:16 | call to operator* | stl.cpp:256:8:256:8 | c |  |
+| stl.cpp:255:16:255:16 | ref arg (__begin) | stl.cpp:255:16:255:16 | (__begin) |  |
+| stl.cpp:255:16:255:16 | ref arg (__begin) | stl.cpp:255:16:255:16 | (__begin) |  |
+| stl.cpp:255:16:255:16 | ref arg (__begin) | stl.cpp:255:16:255:16 | (__begin) |  |
+| stl.cpp:255:16:255:16 | ref arg (__range) | stl.cpp:255:16:255:16 | (__range) |  |
+| stl.cpp:255:16:255:16 | s | stl.cpp:255:16:255:16 | (__range) |  |
+| stl.cpp:255:16:255:16 | s | stl.cpp:255:16:255:16 | (__range) |  |
+| stl.cpp:255:16:255:16 | s | stl.cpp:255:16:255:16 | call to operator* | TAINT |
+| stl.cpp:259:28:259:33 | call to source | stl.cpp:259:28:259:36 | call to basic_string | TAINT |
+| stl.cpp:259:28:259:36 | call to basic_string | stl.cpp:260:22:260:28 | const_s |  |
+| stl.cpp:260:22:260:22 | call to begin | stl.cpp:260:22:260:22 | (__begin) |  |
+| stl.cpp:260:22:260:22 | call to begin | stl.cpp:260:22:260:22 | (__begin) |  |
+| stl.cpp:260:22:260:22 | call to begin | stl.cpp:260:22:260:22 | (__begin) |  |
+| stl.cpp:260:22:260:22 | call to end | stl.cpp:260:22:260:22 | (__end) |  |
+| stl.cpp:260:22:260:22 | call to operator* | stl.cpp:261:8:261:8 | c |  |
+| stl.cpp:260:22:260:22 | ref arg (__begin) | stl.cpp:260:22:260:22 | (__begin) |  |
+| stl.cpp:260:22:260:22 | ref arg (__begin) | stl.cpp:260:22:260:22 | (__begin) |  |
+| stl.cpp:260:22:260:22 | ref arg (__begin) | stl.cpp:260:22:260:22 | (__begin) |  |
+| stl.cpp:260:22:260:28 | const_s | stl.cpp:260:22:260:22 | (__range) |  |
+| stl.cpp:260:22:260:28 | const_s | stl.cpp:260:22:260:22 | (__range) |  |
+| stl.cpp:260:22:260:28 | const_s | stl.cpp:260:22:260:22 | call to operator* | TAINT |
+| stl.cpp:296:43:296:49 | source1 | stl.cpp:300:21:300:27 | source1 |  |
+| stl.cpp:296:43:296:49 | source1 | stl.cpp:314:33:314:39 | source1 |  |
+| stl.cpp:300:21:300:27 | source1 | stl.cpp:300:21:300:28 | call to vector | TAINT |
+| stl.cpp:300:21:300:28 | call to vector | stl.cpp:302:14:302:14 | v |  |
+| stl.cpp:300:21:300:28 | call to vector | stl.cpp:306:38:306:38 | v |  |
+| stl.cpp:300:21:300:28 | call to vector | stl.cpp:306:55:306:55 | v |  |
+| stl.cpp:300:21:300:28 | call to vector | stl.cpp:310:15:310:15 | v |  |
+| stl.cpp:302:14:302:14 | call to begin | stl.cpp:302:14:302:14 | (__begin) |  |
+| stl.cpp:302:14:302:14 | call to begin | stl.cpp:302:14:302:14 | (__begin) |  |
+| stl.cpp:302:14:302:14 | call to begin | stl.cpp:302:14:302:14 | (__begin) |  |
+| stl.cpp:302:14:302:14 | call to end | stl.cpp:302:14:302:14 | (__end) |  |
+| stl.cpp:302:14:302:14 | call to operator* | stl.cpp:303:8:303:8 | x |  |
+| stl.cpp:302:14:302:14 | ref arg (__begin) | stl.cpp:302:14:302:14 | (__begin) |  |
+| stl.cpp:302:14:302:14 | ref arg (__begin) | stl.cpp:302:14:302:14 | (__begin) |  |
+| stl.cpp:302:14:302:14 | ref arg (__begin) | stl.cpp:302:14:302:14 | (__begin) |  |
+| stl.cpp:302:14:302:14 | ref arg (__range) | stl.cpp:302:14:302:14 | (__range) |  |
+| stl.cpp:302:14:302:14 | v | stl.cpp:302:14:302:14 | (__range) |  |
+| stl.cpp:302:14:302:14 | v | stl.cpp:302:14:302:14 | (__range) |  |
+| stl.cpp:302:14:302:14 | v | stl.cpp:302:14:302:14 | call to operator* | TAINT |
+| stl.cpp:306:38:306:38 | ref arg v | stl.cpp:306:55:306:55 | v |  |
+| stl.cpp:306:38:306:38 | ref arg v | stl.cpp:310:15:310:15 | v |  |
+| stl.cpp:306:40:306:44 | call to begin | stl.cpp:306:49:306:50 | it |  |
+| stl.cpp:306:40:306:44 | call to begin | stl.cpp:306:66:306:67 | it |  |
+| stl.cpp:306:40:306:44 | call to begin | stl.cpp:307:9:307:10 | it |  |
+| stl.cpp:306:55:306:55 | ref arg v | stl.cpp:306:55:306:55 | v |  |
+| stl.cpp:306:55:306:55 | ref arg v | stl.cpp:310:15:310:15 | v |  |
+| stl.cpp:306:66:306:67 | ref arg it | stl.cpp:306:49:306:50 | it |  |
+| stl.cpp:306:66:306:67 | ref arg it | stl.cpp:306:66:306:67 | it |  |
+| stl.cpp:306:66:306:67 | ref arg it | stl.cpp:307:9:307:10 | it |  |
+| stl.cpp:310:15:310:15 | call to begin | stl.cpp:310:15:310:15 | (__begin) |  |
+| stl.cpp:310:15:310:15 | call to begin | stl.cpp:310:15:310:15 | (__begin) |  |
+| stl.cpp:310:15:310:15 | call to begin | stl.cpp:310:15:310:15 | (__begin) |  |
+| stl.cpp:310:15:310:15 | call to end | stl.cpp:310:15:310:15 | (__end) |  |
+| stl.cpp:310:15:310:15 | call to operator* | stl.cpp:311:8:311:8 | x |  |
+| stl.cpp:310:15:310:15 | ref arg (__begin) | stl.cpp:310:15:310:15 | (__begin) |  |
+| stl.cpp:310:15:310:15 | ref arg (__begin) | stl.cpp:310:15:310:15 | (__begin) |  |
+| stl.cpp:310:15:310:15 | ref arg (__begin) | stl.cpp:310:15:310:15 | (__begin) |  |
+| stl.cpp:310:15:310:15 | ref arg (__range) | stl.cpp:310:15:310:15 | (__range) |  |
+| stl.cpp:310:15:310:15 | v | stl.cpp:310:15:310:15 | (__range) |  |
+| stl.cpp:310:15:310:15 | v | stl.cpp:310:15:310:15 | (__range) |  |
+| stl.cpp:310:15:310:15 | v | stl.cpp:310:15:310:15 | call to operator* | TAINT |
+| stl.cpp:314:33:314:39 | source1 | stl.cpp:314:33:314:40 | call to vector | TAINT |
+| stl.cpp:314:33:314:40 | call to vector | stl.cpp:315:21:315:27 | const_v |  |
+| stl.cpp:315:21:315:21 | call to begin | stl.cpp:315:21:315:21 | (__begin) |  |
+| stl.cpp:315:21:315:21 | call to begin | stl.cpp:315:21:315:21 | (__begin) |  |
+| stl.cpp:315:21:315:21 | call to begin | stl.cpp:315:21:315:21 | (__begin) |  |
+| stl.cpp:315:21:315:21 | call to end | stl.cpp:315:21:315:21 | (__end) |  |
+| stl.cpp:315:21:315:21 | call to operator* | stl.cpp:316:8:316:8 | x |  |
+| stl.cpp:315:21:315:21 | ref arg (__begin) | stl.cpp:315:21:315:21 | (__begin) |  |
+| stl.cpp:315:21:315:21 | ref arg (__begin) | stl.cpp:315:21:315:21 | (__begin) |  |
+| stl.cpp:315:21:315:21 | ref arg (__begin) | stl.cpp:315:21:315:21 | (__begin) |  |
+| stl.cpp:315:21:315:27 | const_v | stl.cpp:315:21:315:21 | (__range) |  |
+| stl.cpp:315:21:315:27 | const_v | stl.cpp:315:21:315:21 | (__range) |  |
+| stl.cpp:315:21:315:27 | const_v | stl.cpp:315:21:315:21 | call to operator* | TAINT |
 | structlikeclass.cpp:5:7:5:7 | Unknown literal | structlikeclass.cpp:5:7:5:7 | constructor init of field v | TAINT |
 | structlikeclass.cpp:5:7:5:7 | Unknown literal | structlikeclass.cpp:5:7:5:7 | constructor init of field v | TAINT |
 | structlikeclass.cpp:5:7:5:7 | this | structlikeclass.cpp:5:7:5:7 | constructor init of field v [pre-this] |  |
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/stl.cpp b/cpp/ql/test/library-tests/dataflow/taint-tests/stl.cpp
index 654628a4dd4..c3788cac899 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/stl.cpp
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/stl.cpp
@@ -49,8 +49,16 @@ namespace std
 		const_iterator end() const;
 		const_iterator cbegin() const;
 		const_iterator cend() const;
+
+		template<class T> basic_string& operator+=(const T& t);
+		basic_string& operator+=(const charT* s);
+		basic_string& append(const basic_string& str);
+		basic_string& append(const charT* s);
 	};
 
+	template<class charT, class traits, class Allocator> basic_string<charT, traits, Allocator> operator+(const basic_string<charT, traits, Allocator>& lhs, const basic_string<charT, traits, Allocator>& rhs);
+	template<class charT, class traits, class Allocator> basic_string<charT, traits, Allocator> operator+(const basic_string<charT, traits, Allocator>& lhs, const charT* rhs);
+
 	typedef basic_string<char> string;
 
 	template <class charT, class traits = char_traits<charT> >
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected b/cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected
index cd213ac2055..2f470e7b574 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected
@@ -32,27 +32,27 @@
 | movableclass.cpp:55:8:55:9 | s2 | movableclass.cpp:52:23:52:28 | call to source |
 | movableclass.cpp:64:8:64:9 | s2 | movableclass.cpp:23:55:23:60 | call to source |
 | movableclass.cpp:65:11:65:11 | call to operator= | movableclass.cpp:65:13:65:18 | call to source |
-| stl.cpp:101:7:101:7 | a | stl.cpp:97:12:97:17 | call to source |
-| stl.cpp:103:7:103:7 | c | stl.cpp:99:16:99:21 | call to source |
-| stl.cpp:105:9:105:13 | call to c_str | stl.cpp:99:16:99:21 | call to source |
-| stl.cpp:155:13:155:17 | call to c_str | stl.cpp:147:10:147:15 | call to source |
-| stl.cpp:159:13:159:17 | call to c_str | stl.cpp:147:10:147:15 | call to source |
-| stl.cpp:162:13:162:17 | call to c_str | stl.cpp:147:10:147:15 | call to source |
-| stl.cpp:172:7:172:8 | cs | stl.cpp:167:19:167:24 | call to source |
-| stl.cpp:173:7:173:8 | ss | stl.cpp:167:19:167:24 | call to source |
-| stl.cpp:186:7:186:8 | cs | stl.cpp:178:19:178:24 | call to source |
-| stl.cpp:187:7:187:8 | ss | stl.cpp:178:19:178:24 | call to source |
-| stl.cpp:209:8:209:9 | s1 | stl.cpp:204:18:204:23 | call to source |
-| stl.cpp:210:8:210:9 | s2 | stl.cpp:205:20:205:25 | call to source |
-| stl.cpp:211:8:211:9 | s3 | stl.cpp:207:8:207:13 | call to source |
-| stl.cpp:230:8:230:9 | s1 | stl.cpp:226:32:226:37 | call to source |
-| stl.cpp:231:8:231:9 | s2 | stl.cpp:228:20:228:25 | call to source |
-| stl.cpp:240:8:240:8 | c | stl.cpp:238:16:238:21 | call to source |
-| stl.cpp:248:8:248:8 | c | stl.cpp:238:16:238:21 | call to source |
-| stl.cpp:253:8:253:8 | c | stl.cpp:251:28:251:33 | call to source |
-| stl.cpp:295:8:295:8 | x | stl.cpp:288:43:288:49 | source1 |
-| stl.cpp:303:8:303:8 | x | stl.cpp:288:43:288:49 | source1 |
-| stl.cpp:308:8:308:8 | x | stl.cpp:288:43:288:49 | source1 |
+| stl.cpp:109:7:109:7 | a | stl.cpp:105:12:105:17 | call to source |
+| stl.cpp:111:7:111:7 | c | stl.cpp:107:16:107:21 | call to source |
+| stl.cpp:113:9:113:13 | call to c_str | stl.cpp:107:16:107:21 | call to source |
+| stl.cpp:163:13:163:17 | call to c_str | stl.cpp:155:10:155:15 | call to source |
+| stl.cpp:167:13:167:17 | call to c_str | stl.cpp:155:10:155:15 | call to source |
+| stl.cpp:170:13:170:17 | call to c_str | stl.cpp:155:10:155:15 | call to source |
+| stl.cpp:180:7:180:8 | cs | stl.cpp:175:19:175:24 | call to source |
+| stl.cpp:181:7:181:8 | ss | stl.cpp:175:19:175:24 | call to source |
+| stl.cpp:194:7:194:8 | cs | stl.cpp:186:19:186:24 | call to source |
+| stl.cpp:195:7:195:8 | ss | stl.cpp:186:19:186:24 | call to source |
+| stl.cpp:217:8:217:9 | s1 | stl.cpp:212:18:212:23 | call to source |
+| stl.cpp:218:8:218:9 | s2 | stl.cpp:213:20:213:25 | call to source |
+| stl.cpp:219:8:219:9 | s3 | stl.cpp:215:8:215:13 | call to source |
+| stl.cpp:238:8:238:9 | s1 | stl.cpp:234:32:234:37 | call to source |
+| stl.cpp:239:8:239:9 | s2 | stl.cpp:236:20:236:25 | call to source |
+| stl.cpp:248:8:248:8 | c | stl.cpp:246:16:246:21 | call to source |
+| stl.cpp:256:8:256:8 | c | stl.cpp:246:16:246:21 | call to source |
+| stl.cpp:261:8:261:8 | c | stl.cpp:259:28:259:33 | call to source |
+| stl.cpp:303:8:303:8 | x | stl.cpp:296:43:296:49 | source1 |
+| stl.cpp:311:8:311:8 | x | stl.cpp:296:43:296:49 | source1 |
+| stl.cpp:316:8:316:8 | x | stl.cpp:296:43:296:49 | source1 |
 | structlikeclass.cpp:35:8:35:9 | s1 | structlikeclass.cpp:29:22:29:27 | call to source |
 | structlikeclass.cpp:36:8:36:9 | s2 | structlikeclass.cpp:30:24:30:29 | call to source |
 | structlikeclass.cpp:37:8:37:9 | s3 | structlikeclass.cpp:29:22:29:27 | call to source |
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected b/cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected
index be3b27ea69d..359286e62b6 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected
@@ -30,26 +30,26 @@
 | movableclass.cpp:55:8:55:9 | movableclass.cpp:52:23:52:28 | AST only |
 | movableclass.cpp:64:8:64:9 | movableclass.cpp:23:55:23:60 | AST only |
 | movableclass.cpp:65:11:65:11 | movableclass.cpp:65:13:65:18 | AST only |
-| stl.cpp:103:7:103:7 | stl.cpp:99:16:99:21 | AST only |
-| stl.cpp:105:9:105:13 | stl.cpp:99:16:99:21 | AST only |
-| stl.cpp:155:13:155:17 | stl.cpp:147:10:147:15 | AST only |
-| stl.cpp:159:13:159:17 | stl.cpp:147:10:147:15 | AST only |
-| stl.cpp:162:13:162:17 | stl.cpp:147:10:147:15 | AST only |
-| stl.cpp:172:7:172:8 | stl.cpp:167:19:167:26 | IR only |
-| stl.cpp:173:7:173:8 | stl.cpp:167:19:167:24 | AST only |
-| stl.cpp:186:7:186:8 | stl.cpp:178:19:178:24 | AST only |
-| stl.cpp:187:7:187:8 | stl.cpp:178:19:178:24 | AST only |
-| stl.cpp:209:8:209:9 | stl.cpp:204:18:204:23 | AST only |
-| stl.cpp:210:8:210:9 | stl.cpp:205:20:205:25 | AST only |
-| stl.cpp:211:8:211:9 | stl.cpp:207:8:207:13 | AST only |
-| stl.cpp:230:8:230:9 | stl.cpp:226:32:226:37 | AST only |
-| stl.cpp:231:8:231:9 | stl.cpp:228:20:228:25 | AST only |
-| stl.cpp:240:8:240:8 | stl.cpp:238:16:238:21 | AST only |
-| stl.cpp:248:8:248:8 | stl.cpp:238:16:238:21 | AST only |
-| stl.cpp:253:8:253:8 | stl.cpp:251:28:251:33 | AST only |
-| stl.cpp:295:8:295:8 | stl.cpp:288:43:288:49 | AST only |
-| stl.cpp:303:8:303:8 | stl.cpp:288:43:288:49 | AST only |
-| stl.cpp:308:8:308:8 | stl.cpp:288:43:288:49 | AST only |
+| stl.cpp:111:7:111:7 | stl.cpp:107:16:107:21 | AST only |
+| stl.cpp:113:9:113:13 | stl.cpp:107:16:107:21 | AST only |
+| stl.cpp:163:13:163:17 | stl.cpp:155:10:155:15 | AST only |
+| stl.cpp:167:13:167:17 | stl.cpp:155:10:155:15 | AST only |
+| stl.cpp:170:13:170:17 | stl.cpp:155:10:155:15 | AST only |
+| stl.cpp:180:7:180:8 | stl.cpp:175:19:175:26 | IR only |
+| stl.cpp:181:7:181:8 | stl.cpp:175:19:175:24 | AST only |
+| stl.cpp:194:7:194:8 | stl.cpp:186:19:186:24 | AST only |
+| stl.cpp:195:7:195:8 | stl.cpp:186:19:186:24 | AST only |
+| stl.cpp:217:8:217:9 | stl.cpp:212:18:212:23 | AST only |
+| stl.cpp:218:8:218:9 | stl.cpp:213:20:213:25 | AST only |
+| stl.cpp:219:8:219:9 | stl.cpp:215:8:215:13 | AST only |
+| stl.cpp:238:8:238:9 | stl.cpp:234:32:234:37 | AST only |
+| stl.cpp:239:8:239:9 | stl.cpp:236:20:236:25 | AST only |
+| stl.cpp:248:8:248:8 | stl.cpp:246:16:246:21 | AST only |
+| stl.cpp:256:8:256:8 | stl.cpp:246:16:246:21 | AST only |
+| stl.cpp:261:8:261:8 | stl.cpp:259:28:259:33 | AST only |
+| stl.cpp:303:8:303:8 | stl.cpp:296:43:296:49 | AST only |
+| stl.cpp:311:8:311:8 | stl.cpp:296:43:296:49 | AST only |
+| stl.cpp:316:8:316:8 | stl.cpp:296:43:296:49 | AST only |
 | structlikeclass.cpp:35:8:35:9 | structlikeclass.cpp:29:22:29:27 | AST only |
 | structlikeclass.cpp:36:8:36:9 | structlikeclass.cpp:30:24:30:29 | AST only |
 | structlikeclass.cpp:37:8:37:9 | structlikeclass.cpp:29:22:29:27 | AST only |
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/test_ir.expected b/cpp/ql/test/library-tests/dataflow/taint-tests/test_ir.expected
index 62debb5d11f..fae0af72b67 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/test_ir.expected
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/test_ir.expected
@@ -1,10 +1,10 @@
 | format.cpp:157:7:157:22 | (int)... | format.cpp:147:12:147:25 | call to source |
 | format.cpp:157:7:157:22 | access to array | format.cpp:147:12:147:25 | call to source |
 | format.cpp:158:7:158:27 | ... + ... | format.cpp:148:16:148:30 | call to source |
-| stl.cpp:101:7:101:7 | (const char *)... | stl.cpp:97:12:97:17 | call to source |
-| stl.cpp:101:7:101:7 | a | stl.cpp:97:12:97:17 | call to source |
-| stl.cpp:172:7:172:8 | cs | stl.cpp:167:19:167:24 | call to source |
-| stl.cpp:172:7:172:8 | cs | stl.cpp:167:19:167:26 | (const char *)... |
+| stl.cpp:109:7:109:7 | (const char *)... | stl.cpp:105:12:105:17 | call to source |
+| stl.cpp:109:7:109:7 | a | stl.cpp:105:12:105:17 | call to source |
+| stl.cpp:180:7:180:8 | cs | stl.cpp:175:19:175:24 | call to source |
+| stl.cpp:180:7:180:8 | cs | stl.cpp:175:19:175:26 | (const char *)... |
 | structlikeclass.cpp:38:8:38:9 | s4 | structlikeclass.cpp:33:8:33:13 | call to source |
 | structlikeclass.cpp:61:8:61:9 | s2 | structlikeclass.cpp:58:24:58:29 | call to source |
 | structlikeclass.cpp:62:8:62:20 | ... = ... | structlikeclass.cpp:62:13:62:18 | call to source |

From f824a893ca6dd7902e8f958a46704b10c8531c48 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Mon, 10 Aug 2020 16:46:47 +0100
Subject: [PATCH 02/12] C++: Add test cases for appending strings.

---
 .../dataflow/taint-tests/localTaint.expected  | 46 +++++++++++++++++++
 .../dataflow/taint-tests/stl.cpp              | 42 +++++++++++++++++
 2 files changed, 88 insertions(+)

diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
index 7e496929ee0..84460e258d3 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
@@ -507,6 +507,52 @@
 | stl.cpp:315:21:315:27 | const_v | stl.cpp:315:21:315:21 | (__range) |  |
 | stl.cpp:315:21:315:27 | const_v | stl.cpp:315:21:315:21 | (__range) |  |
 | stl.cpp:315:21:315:27 | const_v | stl.cpp:315:21:315:21 | call to operator* | TAINT |
+| stl.cpp:322:18:322:24 | hello | stl.cpp:322:18:322:25 | call to basic_string | TAINT |
+| stl.cpp:322:18:322:25 | call to basic_string | stl.cpp:325:8:325:9 | s1 |  |
+| stl.cpp:322:18:322:25 | call to basic_string | stl.cpp:325:13:325:14 | s1 |  |
+| stl.cpp:322:18:322:25 | call to basic_string | stl.cpp:326:8:326:9 | s1 |  |
+| stl.cpp:322:18:322:25 | call to basic_string | stl.cpp:327:13:327:14 | s1 |  |
+| stl.cpp:322:18:322:25 | call to basic_string | stl.cpp:330:8:330:9 | s1 |  |
+| stl.cpp:322:18:322:25 | call to basic_string | stl.cpp:331:8:331:9 | s1 |  |
+| stl.cpp:323:18:323:23 | call to source | stl.cpp:323:18:323:26 | call to basic_string | TAINT |
+| stl.cpp:323:18:323:26 | call to basic_string | stl.cpp:326:13:326:14 | s2 |  |
+| stl.cpp:323:18:323:26 | call to basic_string | stl.cpp:327:8:327:9 | s2 |  |
+| stl.cpp:323:18:323:26 | call to basic_string | stl.cpp:328:8:328:9 | s2 |  |
+| stl.cpp:323:18:323:26 | call to basic_string | stl.cpp:328:13:328:14 | s2 |  |
+| stl.cpp:335:18:335:22 | abc | stl.cpp:335:18:335:23 | call to basic_string | TAINT |
+| stl.cpp:335:18:335:23 | call to basic_string | stl.cpp:339:8:339:9 | s3 |  |
+| stl.cpp:335:18:335:23 | call to basic_string | stl.cpp:342:8:342:9 | s3 |  |
+| stl.cpp:335:18:335:23 | call to basic_string | stl.cpp:346:8:346:9 | s3 |  |
+| stl.cpp:335:18:335:23 | call to basic_string | stl.cpp:351:8:351:9 | s3 |  |
+| stl.cpp:335:18:335:23 | call to basic_string | stl.cpp:355:8:355:9 | s3 |  |
+| stl.cpp:336:18:336:23 | call to source | stl.cpp:336:18:336:26 | call to basic_string | TAINT |
+| stl.cpp:336:18:336:26 | call to basic_string | stl.cpp:339:13:339:14 | s4 |  |
+| stl.cpp:336:18:336:26 | call to basic_string | stl.cpp:343:9:343:10 | s4 |  |
+| stl.cpp:336:18:336:26 | call to basic_string | stl.cpp:352:13:352:14 | s4 |  |
+| stl.cpp:339:11:339:11 | call to operator+ | stl.cpp:339:3:339:14 | ... = ... |  |
+| stl.cpp:339:11:339:11 | call to operator+ | stl.cpp:340:8:340:9 | s5 |  |
+| stl.cpp:342:8:342:9 | s3 | stl.cpp:342:3:342:9 | ... = ... |  |
+| stl.cpp:342:8:342:9 | s3 | stl.cpp:343:3:343:4 | s6 |  |
+| stl.cpp:342:8:342:9 | s3 | stl.cpp:344:8:344:9 | s6 |  |
+| stl.cpp:343:3:343:4 | ref arg s6 | stl.cpp:344:8:344:9 | s6 |  |
+| stl.cpp:346:8:346:9 | s3 | stl.cpp:346:3:346:9 | ... = ... |  |
+| stl.cpp:346:8:346:9 | s3 | stl.cpp:347:3:347:4 | s7 |  |
+| stl.cpp:346:8:346:9 | s3 | stl.cpp:348:3:348:4 | s7 |  |
+| stl.cpp:346:8:346:9 | s3 | stl.cpp:349:8:349:9 | s7 |  |
+| stl.cpp:347:3:347:4 | ref arg s7 | stl.cpp:348:3:348:4 | s7 |  |
+| stl.cpp:347:3:347:4 | ref arg s7 | stl.cpp:349:8:349:9 | s7 |  |
+| stl.cpp:348:3:348:4 | ref arg s7 | stl.cpp:349:8:349:9 | s7 |  |
+| stl.cpp:351:8:351:9 | s3 | stl.cpp:351:3:351:9 | ... = ... |  |
+| stl.cpp:351:8:351:9 | s3 | stl.cpp:352:3:352:4 | s8 |  |
+| stl.cpp:351:8:351:9 | s3 | stl.cpp:353:8:353:9 | s8 |  |
+| stl.cpp:352:3:352:4 | ref arg s8 | stl.cpp:353:8:353:9 | s8 |  |
+| stl.cpp:355:8:355:9 | s3 | stl.cpp:355:3:355:9 | ... = ... |  |
+| stl.cpp:355:8:355:9 | s3 | stl.cpp:356:3:356:4 | s9 |  |
+| stl.cpp:355:8:355:9 | s3 | stl.cpp:357:3:357:4 | s9 |  |
+| stl.cpp:355:8:355:9 | s3 | stl.cpp:358:8:358:9 | s9 |  |
+| stl.cpp:356:3:356:4 | ref arg s9 | stl.cpp:357:3:357:4 | s9 |  |
+| stl.cpp:356:3:356:4 | ref arg s9 | stl.cpp:358:8:358:9 | s9 |  |
+| stl.cpp:357:3:357:4 | ref arg s9 | stl.cpp:358:8:358:9 | s9 |  |
 | structlikeclass.cpp:5:7:5:7 | Unknown literal | structlikeclass.cpp:5:7:5:7 | constructor init of field v | TAINT |
 | structlikeclass.cpp:5:7:5:7 | Unknown literal | structlikeclass.cpp:5:7:5:7 | constructor init of field v | TAINT |
 | structlikeclass.cpp:5:7:5:7 | this | structlikeclass.cpp:5:7:5:7 | constructor init of field v [pre-this] |  |
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/stl.cpp b/cpp/ql/test/library-tests/dataflow/taint-tests/stl.cpp
index c3788cac899..32429150bca 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/stl.cpp
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/stl.cpp
@@ -316,3 +316,45 @@ void test_range_based_for_loop_vector(int source1) {
 		sink(x); // tainted [NOT DETECTED by IR]
 	}
 }
+
+void test_string_append() {
+	{
+		std::string s1("hello");
+		std::string s2(source());
+
+		sink(s1 + s1);
+		sink(s1 + s2); // tainted [NOT DETECTED]
+		sink(s2 + s1); // tainted [NOT DETECTED]
+		sink(s2 + s2); // tainted [NOT DETECTED]
+	
+		sink(s1 + " world");
+		sink(s1 + source()); // tainted [NOT DETECTED]
+	}
+
+	{
+		std::string s3("abc");
+		std::string s4(source());
+		std::string s5, s6, s7, s8, s9;
+
+		s5 = s3 + s4;
+		sink(s5); // tainted [NOT DETECTED]
+
+		s6 = s3;
+		s6 += s4;
+		sink(s6); // tainted [NOT DETECTED]
+
+		s7 = s3;
+		s7 += source();
+		s7 += " ";
+		sink(s7); // tainted [NOT DETECTED]
+
+		s8 = s3;
+		s8.append(s4);
+		sink(s8); // tainted [NOT DETECTED]
+
+		s9 = s3;
+		s9.append(source());
+		s9.append(" ");
+		sink(s9); // tainted [NOT DETECTED]
+	}
+}

From a57dfd6b678605d0066ad84bed1569063bebd12f Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Tue, 11 Aug 2020 11:31:28 +0100
Subject: [PATCH 03/12] C++: Taint through std::string append.

---
 .../cpp/models/implementations/StdString.qll     | 16 ++++++++++++++++
 .../dataflow/taint-tests/localTaint.expected     |  6 ++++++
 .../library-tests/dataflow/taint-tests/stl.cpp   |  4 ++--
 .../dataflow/taint-tests/taint.expected          |  2 ++
 .../dataflow/taint-tests/test_diff.expected      |  2 ++
 5 files changed, 28 insertions(+), 2 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
index 9ffef420a19..8820b8813fa 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
@@ -12,3 +12,19 @@ class StdStringCStr extends TaintFunction {
     output.isReturnValue()
   }
 }
+
+/**
+ * The `std::string` function `append`.
+ */
+class StdStringAppend extends TaintFunction {
+  StdStringAppend() { this.hasQualifiedName("std", "basic_string", "append") }
+
+  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+    // flow from parameter to string itself (qualifier) and return value
+    input.isParameterDeref(0) and
+    (
+      output.isQualifierObject() or
+      output.isReturnValueDeref()
+    )
+  }
+}
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
index 84460e258d3..d9ae1254933 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
@@ -546,13 +546,19 @@
 | stl.cpp:351:8:351:9 | s3 | stl.cpp:352:3:352:4 | s8 |  |
 | stl.cpp:351:8:351:9 | s3 | stl.cpp:353:8:353:9 | s8 |  |
 | stl.cpp:352:3:352:4 | ref arg s8 | stl.cpp:353:8:353:9 | s8 |  |
+| stl.cpp:352:13:352:14 | s4 | stl.cpp:352:3:352:4 | ref arg s8 | TAINT |
+| stl.cpp:352:13:352:14 | s4 | stl.cpp:352:6:352:11 | call to append | TAINT |
 | stl.cpp:355:8:355:9 | s3 | stl.cpp:355:3:355:9 | ... = ... |  |
 | stl.cpp:355:8:355:9 | s3 | stl.cpp:356:3:356:4 | s9 |  |
 | stl.cpp:355:8:355:9 | s3 | stl.cpp:357:3:357:4 | s9 |  |
 | stl.cpp:355:8:355:9 | s3 | stl.cpp:358:8:358:9 | s9 |  |
 | stl.cpp:356:3:356:4 | ref arg s9 | stl.cpp:357:3:357:4 | s9 |  |
 | stl.cpp:356:3:356:4 | ref arg s9 | stl.cpp:358:8:358:9 | s9 |  |
+| stl.cpp:356:13:356:18 | call to source | stl.cpp:356:3:356:4 | ref arg s9 | TAINT |
+| stl.cpp:356:13:356:18 | call to source | stl.cpp:356:6:356:11 | call to append | TAINT |
 | stl.cpp:357:3:357:4 | ref arg s9 | stl.cpp:358:8:358:9 | s9 |  |
+| stl.cpp:357:13:357:15 |   | stl.cpp:357:3:357:4 | ref arg s9 | TAINT |
+| stl.cpp:357:13:357:15 |   | stl.cpp:357:6:357:11 | call to append | TAINT |
 | structlikeclass.cpp:5:7:5:7 | Unknown literal | structlikeclass.cpp:5:7:5:7 | constructor init of field v | TAINT |
 | structlikeclass.cpp:5:7:5:7 | Unknown literal | structlikeclass.cpp:5:7:5:7 | constructor init of field v | TAINT |
 | structlikeclass.cpp:5:7:5:7 | this | structlikeclass.cpp:5:7:5:7 | constructor init of field v [pre-this] |  |
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/stl.cpp b/cpp/ql/test/library-tests/dataflow/taint-tests/stl.cpp
index 32429150bca..2ae246cac08 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/stl.cpp
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/stl.cpp
@@ -350,11 +350,11 @@ void test_string_append() {
 
 		s8 = s3;
 		s8.append(s4);
-		sink(s8); // tainted [NOT DETECTED]
+		sink(s8); // tainted
 
 		s9 = s3;
 		s9.append(source());
 		s9.append(" ");
-		sink(s9); // tainted [NOT DETECTED]
+		sink(s9); // tainted
 	}
 }
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected b/cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected
index 2f470e7b574..855f886c626 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected
@@ -53,6 +53,8 @@
 | stl.cpp:303:8:303:8 | x | stl.cpp:296:43:296:49 | source1 |
 | stl.cpp:311:8:311:8 | x | stl.cpp:296:43:296:49 | source1 |
 | stl.cpp:316:8:316:8 | x | stl.cpp:296:43:296:49 | source1 |
+| stl.cpp:353:8:353:9 | s8 | stl.cpp:336:18:336:23 | call to source |
+| stl.cpp:358:8:358:9 | s9 | stl.cpp:356:13:356:18 | call to source |
 | structlikeclass.cpp:35:8:35:9 | s1 | structlikeclass.cpp:29:22:29:27 | call to source |
 | structlikeclass.cpp:36:8:36:9 | s2 | structlikeclass.cpp:30:24:30:29 | call to source |
 | structlikeclass.cpp:37:8:37:9 | s3 | structlikeclass.cpp:29:22:29:27 | call to source |
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected b/cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected
index 359286e62b6..c7a0ebe6d84 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected
@@ -50,6 +50,8 @@
 | stl.cpp:303:8:303:8 | stl.cpp:296:43:296:49 | AST only |
 | stl.cpp:311:8:311:8 | stl.cpp:296:43:296:49 | AST only |
 | stl.cpp:316:8:316:8 | stl.cpp:296:43:296:49 | AST only |
+| stl.cpp:353:8:353:9 | stl.cpp:336:18:336:23 | AST only |
+| stl.cpp:358:8:358:9 | stl.cpp:356:13:356:18 | AST only |
 | structlikeclass.cpp:35:8:35:9 | structlikeclass.cpp:29:22:29:27 | AST only |
 | structlikeclass.cpp:36:8:36:9 | structlikeclass.cpp:30:24:30:29 | AST only |
 | structlikeclass.cpp:37:8:37:9 | structlikeclass.cpp:29:22:29:27 | AST only |

From cf6f53082323e133e701c08091508e39476ea165 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Tue, 11 Aug 2020 15:02:36 +0100
Subject: [PATCH 04/12] C++: Taint through std::string operator+.

---
 .../cpp/models/implementations/StdString.qll  | 26 +++++++++++++++++++
 .../dataflow/taint-tests/localTaint.expected  | 14 ++++++++++
 .../dataflow/taint-tests/stl.cpp              | 10 +++----
 .../dataflow/taint-tests/taint.expected       |  5 ++++
 .../dataflow/taint-tests/test_diff.expected   |  5 ++++
 5 files changed, 55 insertions(+), 5 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
index 8820b8813fa..aae2012d758 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
@@ -1,5 +1,12 @@
 import semmle.code.cpp.models.interfaces.Taint
 
+/**
+ * The `std::basic_string` template class.
+ */
+class StdBasicString extends TemplateClass {
+  StdBasicString() { this.hasQualifiedName("std", "basic_string") }
+}
+
 /**
  * The standard function `std::string.c_str`.
  */
@@ -13,6 +20,25 @@ class StdStringCStr extends TaintFunction {
   }
 }
 
+/**
+ * The `std::string` function `operator+`.
+ */
+class StdStringPlus extends TaintFunction {
+  StdStringPlus() {
+    this.hasQualifiedName("std", "operator+") and
+    this.getParameter(0).getType().getUnspecifiedType().(ReferenceType).getBaseType() = any(StdBasicString s).getAnInstantiation()
+  }
+
+  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+    // flow from parameters to return value
+    (
+      input.isParameterDeref(0) or
+      input.isParameterDeref(1)
+    ) and
+    output.isReturnValueDeref()
+  }
+}
+
 /**
  * The `std::string` function `append`.
  */
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
index d9ae1254933..c91dfe970e3 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
@@ -519,6 +519,18 @@
 | stl.cpp:323:18:323:26 | call to basic_string | stl.cpp:327:8:327:9 | s2 |  |
 | stl.cpp:323:18:323:26 | call to basic_string | stl.cpp:328:8:328:9 | s2 |  |
 | stl.cpp:323:18:323:26 | call to basic_string | stl.cpp:328:13:328:14 | s2 |  |
+| stl.cpp:325:8:325:9 | s1 | stl.cpp:325:11:325:11 | call to operator+ | TAINT |
+| stl.cpp:325:13:325:14 | s1 | stl.cpp:325:11:325:11 | call to operator+ | TAINT |
+| stl.cpp:326:8:326:9 | s1 | stl.cpp:326:11:326:11 | call to operator+ | TAINT |
+| stl.cpp:326:13:326:14 | s2 | stl.cpp:326:11:326:11 | call to operator+ | TAINT |
+| stl.cpp:327:8:327:9 | s2 | stl.cpp:327:11:327:11 | call to operator+ | TAINT |
+| stl.cpp:327:13:327:14 | s1 | stl.cpp:327:11:327:11 | call to operator+ | TAINT |
+| stl.cpp:328:8:328:9 | s2 | stl.cpp:328:11:328:11 | call to operator+ | TAINT |
+| stl.cpp:328:13:328:14 | s2 | stl.cpp:328:11:328:11 | call to operator+ | TAINT |
+| stl.cpp:330:8:330:9 | s1 | stl.cpp:330:11:330:11 | call to operator+ | TAINT |
+| stl.cpp:330:13:330:20 |  world | stl.cpp:330:11:330:11 | call to operator+ | TAINT |
+| stl.cpp:331:8:331:9 | s1 | stl.cpp:331:11:331:11 | call to operator+ | TAINT |
+| stl.cpp:331:13:331:18 | call to source | stl.cpp:331:11:331:11 | call to operator+ | TAINT |
 | stl.cpp:335:18:335:22 | abc | stl.cpp:335:18:335:23 | call to basic_string | TAINT |
 | stl.cpp:335:18:335:23 | call to basic_string | stl.cpp:339:8:339:9 | s3 |  |
 | stl.cpp:335:18:335:23 | call to basic_string | stl.cpp:342:8:342:9 | s3 |  |
@@ -529,8 +541,10 @@
 | stl.cpp:336:18:336:26 | call to basic_string | stl.cpp:339:13:339:14 | s4 |  |
 | stl.cpp:336:18:336:26 | call to basic_string | stl.cpp:343:9:343:10 | s4 |  |
 | stl.cpp:336:18:336:26 | call to basic_string | stl.cpp:352:13:352:14 | s4 |  |
+| stl.cpp:339:8:339:9 | s3 | stl.cpp:339:11:339:11 | call to operator+ | TAINT |
 | stl.cpp:339:11:339:11 | call to operator+ | stl.cpp:339:3:339:14 | ... = ... |  |
 | stl.cpp:339:11:339:11 | call to operator+ | stl.cpp:340:8:340:9 | s5 |  |
+| stl.cpp:339:13:339:14 | s4 | stl.cpp:339:11:339:11 | call to operator+ | TAINT |
 | stl.cpp:342:8:342:9 | s3 | stl.cpp:342:3:342:9 | ... = ... |  |
 | stl.cpp:342:8:342:9 | s3 | stl.cpp:343:3:343:4 | s6 |  |
 | stl.cpp:342:8:342:9 | s3 | stl.cpp:344:8:344:9 | s6 |  |
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/stl.cpp b/cpp/ql/test/library-tests/dataflow/taint-tests/stl.cpp
index 2ae246cac08..8c3e9423605 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/stl.cpp
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/stl.cpp
@@ -323,12 +323,12 @@ void test_string_append() {
 		std::string s2(source());
 
 		sink(s1 + s1);
-		sink(s1 + s2); // tainted [NOT DETECTED]
-		sink(s2 + s1); // tainted [NOT DETECTED]
-		sink(s2 + s2); // tainted [NOT DETECTED]
+		sink(s1 + s2); // tainted
+		sink(s2 + s1); // tainted
+		sink(s2 + s2); // tainted
 	
 		sink(s1 + " world");
-		sink(s1 + source()); // tainted [NOT DETECTED]
+		sink(s1 + source()); // tainted
 	}
 
 	{
@@ -337,7 +337,7 @@ void test_string_append() {
 		std::string s5, s6, s7, s8, s9;
 
 		s5 = s3 + s4;
-		sink(s5); // tainted [NOT DETECTED]
+		sink(s5); // tainted
 
 		s6 = s3;
 		s6 += s4;
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected b/cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected
index 855f886c626..f04733bab7d 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected
@@ -53,6 +53,11 @@
 | stl.cpp:303:8:303:8 | x | stl.cpp:296:43:296:49 | source1 |
 | stl.cpp:311:8:311:8 | x | stl.cpp:296:43:296:49 | source1 |
 | stl.cpp:316:8:316:8 | x | stl.cpp:296:43:296:49 | source1 |
+| stl.cpp:326:11:326:11 | call to operator+ | stl.cpp:323:18:323:23 | call to source |
+| stl.cpp:327:11:327:11 | call to operator+ | stl.cpp:323:18:323:23 | call to source |
+| stl.cpp:328:11:328:11 | call to operator+ | stl.cpp:323:18:323:23 | call to source |
+| stl.cpp:331:11:331:11 | call to operator+ | stl.cpp:331:13:331:18 | call to source |
+| stl.cpp:340:8:340:9 | s5 | stl.cpp:336:18:336:23 | call to source |
 | stl.cpp:353:8:353:9 | s8 | stl.cpp:336:18:336:23 | call to source |
 | stl.cpp:358:8:358:9 | s9 | stl.cpp:356:13:356:18 | call to source |
 | structlikeclass.cpp:35:8:35:9 | s1 | structlikeclass.cpp:29:22:29:27 | call to source |
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected b/cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected
index c7a0ebe6d84..5c80cbfd071 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected
@@ -50,6 +50,11 @@
 | stl.cpp:303:8:303:8 | stl.cpp:296:43:296:49 | AST only |
 | stl.cpp:311:8:311:8 | stl.cpp:296:43:296:49 | AST only |
 | stl.cpp:316:8:316:8 | stl.cpp:296:43:296:49 | AST only |
+| stl.cpp:326:11:326:11 | stl.cpp:323:18:323:23 | AST only |
+| stl.cpp:327:11:327:11 | stl.cpp:323:18:323:23 | AST only |
+| stl.cpp:328:11:328:11 | stl.cpp:323:18:323:23 | AST only |
+| stl.cpp:331:11:331:11 | stl.cpp:331:13:331:18 | AST only |
+| stl.cpp:340:8:340:9 | stl.cpp:336:18:336:23 | AST only |
 | stl.cpp:353:8:353:9 | stl.cpp:336:18:336:23 | AST only |
 | stl.cpp:358:8:358:9 | stl.cpp:356:13:356:18 | AST only |
 | structlikeclass.cpp:35:8:35:9 | structlikeclass.cpp:29:22:29:27 | AST only |

From f62ad750481b9d0d72147e3d221a859bf3c1aa5b Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Tue, 11 Aug 2020 15:25:48 +0100
Subject: [PATCH 05/12] C++: Taint through std::string operator+=.

---
 .../semmle/code/cpp/models/implementations/StdString.qll   | 7 +++++--
 .../library-tests/dataflow/taint-tests/localTaint.expected | 6 ++++++
 cpp/ql/test/library-tests/dataflow/taint-tests/stl.cpp     | 4 ++--
 .../test/library-tests/dataflow/taint-tests/taint.expected | 2 ++
 .../library-tests/dataflow/taint-tests/test_diff.expected  | 2 ++
 5 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
index aae2012d758..35965fe207d 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
@@ -40,10 +40,13 @@ class StdStringPlus extends TaintFunction {
 }
 
 /**
- * The `std::string` function `append`.
+ * The `std::string` functions `operator+=` and `append`.
  */
 class StdStringAppend extends TaintFunction {
-  StdStringAppend() { this.hasQualifiedName("std", "basic_string", "append") }
+  StdStringAppend() {
+    this.hasQualifiedName("std", "basic_string", "operator+=") or
+    this.hasQualifiedName("std", "basic_string", "append")
+  }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from parameter to string itself (qualifier) and return value
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
index c91dfe970e3..08fdcd85eeb 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
@@ -549,13 +549,19 @@
 | stl.cpp:342:8:342:9 | s3 | stl.cpp:343:3:343:4 | s6 |  |
 | stl.cpp:342:8:342:9 | s3 | stl.cpp:344:8:344:9 | s6 |  |
 | stl.cpp:343:3:343:4 | ref arg s6 | stl.cpp:344:8:344:9 | s6 |  |
+| stl.cpp:343:9:343:10 | s4 | stl.cpp:343:3:343:4 | ref arg s6 | TAINT |
+| stl.cpp:343:9:343:10 | s4 | stl.cpp:343:6:343:6 | call to operator+= | TAINT |
 | stl.cpp:346:8:346:9 | s3 | stl.cpp:346:3:346:9 | ... = ... |  |
 | stl.cpp:346:8:346:9 | s3 | stl.cpp:347:3:347:4 | s7 |  |
 | stl.cpp:346:8:346:9 | s3 | stl.cpp:348:3:348:4 | s7 |  |
 | stl.cpp:346:8:346:9 | s3 | stl.cpp:349:8:349:9 | s7 |  |
 | stl.cpp:347:3:347:4 | ref arg s7 | stl.cpp:348:3:348:4 | s7 |  |
 | stl.cpp:347:3:347:4 | ref arg s7 | stl.cpp:349:8:349:9 | s7 |  |
+| stl.cpp:347:9:347:14 | call to source | stl.cpp:347:3:347:4 | ref arg s7 | TAINT |
+| stl.cpp:347:9:347:14 | call to source | stl.cpp:347:6:347:6 | call to operator+= | TAINT |
 | stl.cpp:348:3:348:4 | ref arg s7 | stl.cpp:349:8:349:9 | s7 |  |
+| stl.cpp:348:9:348:11 |   | stl.cpp:348:3:348:4 | ref arg s7 | TAINT |
+| stl.cpp:348:9:348:11 |   | stl.cpp:348:6:348:6 | call to operator+= | TAINT |
 | stl.cpp:351:8:351:9 | s3 | stl.cpp:351:3:351:9 | ... = ... |  |
 | stl.cpp:351:8:351:9 | s3 | stl.cpp:352:3:352:4 | s8 |  |
 | stl.cpp:351:8:351:9 | s3 | stl.cpp:353:8:353:9 | s8 |  |
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/stl.cpp b/cpp/ql/test/library-tests/dataflow/taint-tests/stl.cpp
index 8c3e9423605..698bed82c02 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/stl.cpp
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/stl.cpp
@@ -341,12 +341,12 @@ void test_string_append() {
 
 		s6 = s3;
 		s6 += s4;
-		sink(s6); // tainted [NOT DETECTED]
+		sink(s6); // tainted
 
 		s7 = s3;
 		s7 += source();
 		s7 += " ";
-		sink(s7); // tainted [NOT DETECTED]
+		sink(s7); // tainted
 
 		s8 = s3;
 		s8.append(s4);
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected b/cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected
index f04733bab7d..345f8674aad 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected
@@ -58,6 +58,8 @@
 | stl.cpp:328:11:328:11 | call to operator+ | stl.cpp:323:18:323:23 | call to source |
 | stl.cpp:331:11:331:11 | call to operator+ | stl.cpp:331:13:331:18 | call to source |
 | stl.cpp:340:8:340:9 | s5 | stl.cpp:336:18:336:23 | call to source |
+| stl.cpp:344:8:344:9 | s6 | stl.cpp:336:18:336:23 | call to source |
+| stl.cpp:349:8:349:9 | s7 | stl.cpp:347:9:347:14 | call to source |
 | stl.cpp:353:8:353:9 | s8 | stl.cpp:336:18:336:23 | call to source |
 | stl.cpp:358:8:358:9 | s9 | stl.cpp:356:13:356:18 | call to source |
 | structlikeclass.cpp:35:8:35:9 | s1 | structlikeclass.cpp:29:22:29:27 | call to source |
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected b/cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected
index 5c80cbfd071..4c83b90df08 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected
@@ -55,6 +55,8 @@
 | stl.cpp:328:11:328:11 | stl.cpp:323:18:323:23 | AST only |
 | stl.cpp:331:11:331:11 | stl.cpp:331:13:331:18 | AST only |
 | stl.cpp:340:8:340:9 | stl.cpp:336:18:336:23 | AST only |
+| stl.cpp:344:8:344:9 | stl.cpp:336:18:336:23 | AST only |
+| stl.cpp:349:8:349:9 | stl.cpp:347:9:347:14 | AST only |
 | stl.cpp:353:8:353:9 | stl.cpp:336:18:336:23 | AST only |
 | stl.cpp:358:8:358:9 | stl.cpp:356:13:356:18 | AST only |
 | structlikeclass.cpp:35:8:35:9 | structlikeclass.cpp:29:22:29:27 | AST only |

From 128b8328b980a49e553b654772bf4ed06ce58578 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Tue, 11 Aug 2020 16:16:02 +0100
Subject: [PATCH 06/12] C++: Autoformat.

---
 .../src/semmle/code/cpp/models/implementations/StdString.qll   | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
index 35965fe207d..9d83ef2bd35 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
@@ -26,7 +26,8 @@ class StdStringCStr extends TaintFunction {
 class StdStringPlus extends TaintFunction {
   StdStringPlus() {
     this.hasQualifiedName("std", "operator+") and
-    this.getParameter(0).getType().getUnspecifiedType().(ReferenceType).getBaseType() = any(StdBasicString s).getAnInstantiation()
+    this.getParameter(0).getType().getUnspecifiedType().(ReferenceType).getBaseType() =
+      any(StdBasicString s).getAnInstantiation()
   }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {

From 50558257fc98a567e2e31288fa8cbf5b06428382 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Tue, 11 Aug 2020 17:05:49 +0100
Subject: [PATCH 07/12] C++: Change note.

---
 change-notes/1.26/analysis-cpp.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/change-notes/1.26/analysis-cpp.md b/change-notes/1.26/analysis-cpp.md
index 083229e18c4..01809bf33b5 100644
--- a/change-notes/1.26/analysis-cpp.md
+++ b/change-notes/1.26/analysis-cpp.md
@@ -17,3 +17,4 @@ The following changes in version 1.26 affect C/C++ analysis in all applications.
 
 ## Changes to libraries
 
+* The models library now models more taint flows through `std::string`.

From a655124213f9111b055a07ee012526a2d24f6883 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Tue, 11 Aug 2020 17:28:31 +0100
Subject: [PATCH 08/12] C++: I think this is more correct.

---
 cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
index 9d83ef2bd35..4a77e241874 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
@@ -36,7 +36,7 @@ class StdStringPlus extends TaintFunction {
       input.isParameterDeref(0) or
       input.isParameterDeref(1)
     ) and
-    output.isReturnValueDeref()
+    output.isReturnValue()
   }
 }
 

From b99ca601543cb4db2fa48ae32dee0b23f99e2fd6 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Wed, 12 Aug 2020 12:43:28 +0100
Subject: [PATCH 09/12] C++: Address review comments.

---
 .../code/cpp/models/implementations/StdString.qll   | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
index 4a77e241874..17ccfc954b2 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
@@ -26,8 +26,7 @@ class StdStringCStr extends TaintFunction {
 class StdStringPlus extends TaintFunction {
   StdStringPlus() {
     this.hasQualifiedName("std", "operator+") and
-    this.getParameter(0).getType().getUnspecifiedType().(ReferenceType).getBaseType() =
-      any(StdBasicString s).getAnInstantiation()
+    this.getUnspecifiedType() = any(StdBasicString s).getAnInstantiation()
   }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
@@ -49,9 +48,17 @@ class StdStringAppend extends TaintFunction {
     this.hasQualifiedName("std", "basic_string", "append")
   }
 
+  /**
+   * Gets the index of a parameter to this function that is a string.
+   */
+  int getAStringParameter() {
+    getParameter(result).getType() instanceof PointerType or
+    getParameter(result).getType() instanceof ReferenceType
+  }
+
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from parameter to string itself (qualifier) and return value
-    input.isParameterDeref(0) and
+    input.isParameterDeref(getAStringParameter()) and
     (
       output.isQualifierObject() or
       output.isReturnValueDeref()

From 732a8fa4c9c17fa7a463d397d87d1fca353f59b9 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Thu, 13 Aug 2020 12:44:54 +0100
Subject: [PATCH 10/12] C++: Add another member function.

---
 .../dataflow/taint-tests/localTaint.expected  | 538 +++++++++---------
 .../dataflow/taint-tests/stl.cpp              |   9 +
 .../dataflow/taint-tests/taint.expected       |  60 +-
 .../dataflow/taint-tests/test_diff.expected   |  58 +-
 .../dataflow/taint-tests/test_ir.expected     |   8 +-
 5 files changed, 341 insertions(+), 332 deletions(-)

diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
index 08fdcd85eeb..a387ca676d6 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
@@ -308,277 +308,277 @@
 | movableclass.cpp:65:13:65:18 | call to source | movableclass.cpp:65:13:65:20 | call to MyMovableClass | TAINT |
 | movableclass.cpp:65:13:65:20 | call to MyMovableClass | movableclass.cpp:65:8:65:9 | ref arg s3 | TAINT |
 | movableclass.cpp:65:13:65:20 | call to MyMovableClass | movableclass.cpp:65:11:65:11 | call to operator= | TAINT |
-| stl.cpp:105:12:105:17 | call to source | stl.cpp:109:7:109:7 | a |  |
-| stl.cpp:106:16:106:20 | 123 | stl.cpp:106:16:106:21 | call to basic_string | TAINT |
-| stl.cpp:106:16:106:21 | call to basic_string | stl.cpp:110:7:110:7 | b |  |
-| stl.cpp:106:16:106:21 | call to basic_string | stl.cpp:112:7:112:7 | b |  |
-| stl.cpp:107:16:107:21 | call to source | stl.cpp:107:16:107:24 | call to basic_string | TAINT |
-| stl.cpp:107:16:107:24 | call to basic_string | stl.cpp:111:7:111:7 | c |  |
-| stl.cpp:107:16:107:24 | call to basic_string | stl.cpp:113:7:113:7 | c |  |
-| stl.cpp:112:7:112:7 | b | stl.cpp:112:9:112:13 | call to c_str | TAINT |
-| stl.cpp:113:7:113:7 | c | stl.cpp:113:9:113:13 | call to c_str | TAINT |
-| stl.cpp:118:20:118:22 | call to basic_stringstream | stl.cpp:121:2:121:4 | ss1 |  |
-| stl.cpp:118:20:118:22 | call to basic_stringstream | stl.cpp:127:7:127:9 | ss1 |  |
-| stl.cpp:118:20:118:22 | call to basic_stringstream | stl.cpp:132:7:132:9 | ss1 |  |
-| stl.cpp:118:25:118:27 | call to basic_stringstream | stl.cpp:122:2:122:4 | ss2 |  |
-| stl.cpp:118:25:118:27 | call to basic_stringstream | stl.cpp:128:7:128:9 | ss2 |  |
-| stl.cpp:118:25:118:27 | call to basic_stringstream | stl.cpp:133:7:133:9 | ss2 |  |
-| stl.cpp:118:30:118:32 | call to basic_stringstream | stl.cpp:123:2:123:4 | ss3 |  |
-| stl.cpp:118:30:118:32 | call to basic_stringstream | stl.cpp:129:7:129:9 | ss3 |  |
-| stl.cpp:118:30:118:32 | call to basic_stringstream | stl.cpp:134:7:134:9 | ss3 |  |
-| stl.cpp:118:35:118:37 | call to basic_stringstream | stl.cpp:124:2:124:4 | ss4 |  |
-| stl.cpp:118:35:118:37 | call to basic_stringstream | stl.cpp:130:7:130:9 | ss4 |  |
-| stl.cpp:118:35:118:37 | call to basic_stringstream | stl.cpp:135:7:135:9 | ss4 |  |
-| stl.cpp:118:40:118:42 | call to basic_stringstream | stl.cpp:125:2:125:4 | ss5 |  |
-| stl.cpp:118:40:118:42 | call to basic_stringstream | stl.cpp:131:7:131:9 | ss5 |  |
-| stl.cpp:118:40:118:42 | call to basic_stringstream | stl.cpp:136:7:136:9 | ss5 |  |
-| stl.cpp:119:16:119:21 | call to source | stl.cpp:119:16:119:24 | call to basic_string | TAINT |
-| stl.cpp:119:16:119:24 | call to basic_string | stl.cpp:125:9:125:9 | t |  |
-| stl.cpp:121:2:121:4 | ref arg ss1 | stl.cpp:127:7:127:9 | ss1 |  |
-| stl.cpp:121:2:121:4 | ref arg ss1 | stl.cpp:132:7:132:9 | ss1 |  |
-| stl.cpp:122:2:122:4 | ref arg ss2 | stl.cpp:128:7:128:9 | ss2 |  |
-| stl.cpp:122:2:122:4 | ref arg ss2 | stl.cpp:133:7:133:9 | ss2 |  |
-| stl.cpp:123:2:123:4 | ref arg ss3 | stl.cpp:129:7:129:9 | ss3 |  |
-| stl.cpp:123:2:123:4 | ref arg ss3 | stl.cpp:134:7:134:9 | ss3 |  |
-| stl.cpp:124:2:124:4 | ref arg ss4 | stl.cpp:130:7:130:9 | ss4 |  |
-| stl.cpp:124:2:124:4 | ref arg ss4 | stl.cpp:135:7:135:9 | ss4 |  |
-| stl.cpp:125:2:125:4 | ref arg ss5 | stl.cpp:131:7:131:9 | ss5 |  |
-| stl.cpp:125:2:125:4 | ref arg ss5 | stl.cpp:136:7:136:9 | ss5 |  |
-| stl.cpp:139:32:139:37 | source | stl.cpp:144:9:144:14 | source |  |
-| stl.cpp:141:20:141:22 | call to basic_stringstream | stl.cpp:143:2:143:4 | ss1 |  |
-| stl.cpp:141:20:141:22 | call to basic_stringstream | stl.cpp:146:7:146:9 | ss1 |  |
-| stl.cpp:141:20:141:22 | call to basic_stringstream | stl.cpp:148:7:148:9 | ss1 |  |
-| stl.cpp:141:25:141:27 | call to basic_stringstream | stl.cpp:144:2:144:4 | ss2 |  |
-| stl.cpp:141:25:141:27 | call to basic_stringstream | stl.cpp:147:7:147:9 | ss2 |  |
-| stl.cpp:141:25:141:27 | call to basic_stringstream | stl.cpp:149:7:149:9 | ss2 |  |
-| stl.cpp:143:2:143:4 | ref arg ss1 | stl.cpp:146:7:146:9 | ss1 |  |
-| stl.cpp:143:2:143:4 | ref arg ss1 | stl.cpp:148:7:148:9 | ss1 |  |
-| stl.cpp:144:2:144:4 | ref arg ss2 | stl.cpp:147:7:147:9 | ss2 |  |
-| stl.cpp:144:2:144:4 | ref arg ss2 | stl.cpp:149:7:149:9 | ss2 |  |
-| stl.cpp:162:16:162:28 | call to basic_string | stl.cpp:163:7:163:11 | path1 |  |
-| stl.cpp:162:17:162:26 | call to user_input | stl.cpp:162:16:162:28 | call to basic_string | TAINT |
-| stl.cpp:163:7:163:11 | path1 | stl.cpp:163:13:163:17 | call to c_str | TAINT |
-| stl.cpp:166:10:166:19 | call to user_input | stl.cpp:166:10:166:21 | call to basic_string | TAINT |
-| stl.cpp:166:10:166:21 | call to basic_string | stl.cpp:166:2:166:21 | ... = ... |  |
-| stl.cpp:166:10:166:21 | call to basic_string | stl.cpp:167:7:167:11 | path2 |  |
-| stl.cpp:167:7:167:11 | path2 | stl.cpp:167:13:167:17 | call to c_str | TAINT |
-| stl.cpp:169:15:169:24 | call to user_input | stl.cpp:169:15:169:27 | call to basic_string | TAINT |
-| stl.cpp:169:15:169:27 | call to basic_string | stl.cpp:170:7:170:11 | path3 |  |
-| stl.cpp:170:7:170:11 | path3 | stl.cpp:170:13:170:17 | call to c_str | TAINT |
-| stl.cpp:175:19:175:24 | call to source | stl.cpp:178:17:178:18 | cs |  |
-| stl.cpp:175:19:175:24 | call to source | stl.cpp:180:7:180:8 | cs |  |
-| stl.cpp:178:17:178:18 | cs | stl.cpp:178:17:178:19 | call to basic_string | TAINT |
-| stl.cpp:178:17:178:19 | call to basic_string | stl.cpp:181:7:181:8 | ss |  |
-| stl.cpp:186:19:186:24 | call to source | stl.cpp:189:17:189:18 | cs |  |
-| stl.cpp:189:17:189:18 | cs | stl.cpp:189:17:189:19 | call to basic_string | TAINT |
-| stl.cpp:189:17:189:19 | call to basic_string | stl.cpp:192:7:192:8 | ss |  |
-| stl.cpp:189:17:189:19 | call to basic_string | stl.cpp:195:7:195:8 | ss |  |
-| stl.cpp:192:7:192:8 | ss | stl.cpp:192:10:192:14 | call to c_str | TAINT |
-| stl.cpp:192:10:192:14 | call to c_str | stl.cpp:192:2:192:16 | ... = ... |  |
-| stl.cpp:192:10:192:14 | call to c_str | stl.cpp:194:7:194:8 | cs |  |
-| stl.cpp:201:18:201:24 | hello | stl.cpp:201:18:201:25 | call to basic_string | TAINT |
-| stl.cpp:201:18:201:25 | call to basic_string | stl.cpp:206:8:206:9 | s1 |  |
-| stl.cpp:202:19:202:26 | call to basic_string | stl.cpp:207:8:207:9 | s2 |  |
-| stl.cpp:202:20:202:26 | hello | stl.cpp:202:19:202:26 | call to basic_string | TAINT |
-| stl.cpp:204:8:204:14 | call to basic_string | stl.cpp:204:3:204:14 | ... = ... |  |
-| stl.cpp:204:8:204:14 | call to basic_string | stl.cpp:208:8:208:9 | s3 |  |
-| stl.cpp:204:8:204:14 | hello | stl.cpp:204:8:204:14 | call to basic_string | TAINT |
-| stl.cpp:212:18:212:23 | call to source | stl.cpp:212:18:212:26 | call to basic_string | TAINT |
-| stl.cpp:212:18:212:26 | call to basic_string | stl.cpp:217:8:217:9 | s1 |  |
-| stl.cpp:213:19:213:27 | call to basic_string | stl.cpp:218:8:218:9 | s2 |  |
-| stl.cpp:213:20:213:25 | call to source | stl.cpp:213:19:213:27 | call to basic_string | TAINT |
-| stl.cpp:215:8:215:13 | call to source | stl.cpp:215:8:215:15 | call to basic_string | TAINT |
-| stl.cpp:215:8:215:15 | call to basic_string | stl.cpp:215:3:215:15 | ... = ... |  |
-| stl.cpp:215:8:215:15 | call to basic_string | stl.cpp:219:8:219:9 | s3 |  |
-| stl.cpp:223:15:223:16 | call to basic_string | stl.cpp:224:20:224:21 | s1 |  |
-| stl.cpp:223:15:223:16 | call to basic_string | stl.cpp:226:8:226:9 | s1 |  |
-| stl.cpp:223:15:223:16 | call to basic_string | stl.cpp:228:8:228:9 | s1 |  |
-| stl.cpp:224:20:224:21 | s1 | stl.cpp:229:8:229:9 | s2 |  |
-| stl.cpp:226:8:226:9 | s1 | stl.cpp:226:3:226:9 | ... = ... |  |
-| stl.cpp:226:8:226:9 | s1 | stl.cpp:230:8:230:9 | s3 |  |
-| stl.cpp:234:19:234:40 | call to basic_string | stl.cpp:238:8:238:9 | s1 |  |
-| stl.cpp:234:32:234:37 | call to source | stl.cpp:234:19:234:40 | call to basic_string | TAINT |
-| stl.cpp:236:8:236:28 | call to basic_string | stl.cpp:236:3:236:28 | ... = ... |  |
-| stl.cpp:236:8:236:28 | call to basic_string | stl.cpp:239:8:239:9 | s2 |  |
-| stl.cpp:236:20:236:25 | call to source | stl.cpp:236:8:236:28 | call to basic_string | TAINT |
-| stl.cpp:246:16:246:21 | call to source | stl.cpp:246:16:246:24 | call to basic_string | TAINT |
-| stl.cpp:246:16:246:24 | call to basic_string | stl.cpp:247:15:247:15 | s |  |
-| stl.cpp:246:16:246:24 | call to basic_string | stl.cpp:251:33:251:33 | s |  |
-| stl.cpp:246:16:246:24 | call to basic_string | stl.cpp:251:50:251:50 | s |  |
-| stl.cpp:246:16:246:24 | call to basic_string | stl.cpp:255:16:255:16 | s |  |
-| stl.cpp:247:15:247:15 | call to begin | stl.cpp:247:15:247:15 | (__begin) |  |
-| stl.cpp:247:15:247:15 | call to begin | stl.cpp:247:15:247:15 | (__begin) |  |
-| stl.cpp:247:15:247:15 | call to begin | stl.cpp:247:15:247:15 | (__begin) |  |
-| stl.cpp:247:15:247:15 | call to end | stl.cpp:247:15:247:15 | (__end) |  |
-| stl.cpp:247:15:247:15 | call to operator* | stl.cpp:248:8:248:8 | c |  |
-| stl.cpp:247:15:247:15 | ref arg (__begin) | stl.cpp:247:15:247:15 | (__begin) |  |
-| stl.cpp:247:15:247:15 | ref arg (__begin) | stl.cpp:247:15:247:15 | (__begin) |  |
-| stl.cpp:247:15:247:15 | ref arg (__begin) | stl.cpp:247:15:247:15 | (__begin) |  |
-| stl.cpp:247:15:247:15 | ref arg (__range) | stl.cpp:247:15:247:15 | (__range) |  |
-| stl.cpp:247:15:247:15 | s | stl.cpp:247:15:247:15 | (__range) |  |
-| stl.cpp:247:15:247:15 | s | stl.cpp:247:15:247:15 | (__range) |  |
-| stl.cpp:247:15:247:15 | s | stl.cpp:247:15:247:15 | call to operator* | TAINT |
-| stl.cpp:251:33:251:33 | ref arg s | stl.cpp:251:50:251:50 | s |  |
-| stl.cpp:251:33:251:33 | ref arg s | stl.cpp:255:16:255:16 | s |  |
-| stl.cpp:251:35:251:39 | call to begin | stl.cpp:251:44:251:45 | it |  |
-| stl.cpp:251:35:251:39 | call to begin | stl.cpp:251:61:251:62 | it |  |
-| stl.cpp:251:35:251:39 | call to begin | stl.cpp:252:9:252:10 | it |  |
-| stl.cpp:251:50:251:50 | ref arg s | stl.cpp:251:50:251:50 | s |  |
-| stl.cpp:251:50:251:50 | ref arg s | stl.cpp:255:16:255:16 | s |  |
-| stl.cpp:251:61:251:62 | ref arg it | stl.cpp:251:44:251:45 | it |  |
-| stl.cpp:251:61:251:62 | ref arg it | stl.cpp:251:61:251:62 | it |  |
-| stl.cpp:251:61:251:62 | ref arg it | stl.cpp:252:9:252:10 | it |  |
-| stl.cpp:255:16:255:16 | call to begin | stl.cpp:255:16:255:16 | (__begin) |  |
-| stl.cpp:255:16:255:16 | call to begin | stl.cpp:255:16:255:16 | (__begin) |  |
-| stl.cpp:255:16:255:16 | call to begin | stl.cpp:255:16:255:16 | (__begin) |  |
-| stl.cpp:255:16:255:16 | call to end | stl.cpp:255:16:255:16 | (__end) |  |
-| stl.cpp:255:16:255:16 | call to operator* | stl.cpp:256:8:256:8 | c |  |
-| stl.cpp:255:16:255:16 | ref arg (__begin) | stl.cpp:255:16:255:16 | (__begin) |  |
-| stl.cpp:255:16:255:16 | ref arg (__begin) | stl.cpp:255:16:255:16 | (__begin) |  |
-| stl.cpp:255:16:255:16 | ref arg (__begin) | stl.cpp:255:16:255:16 | (__begin) |  |
-| stl.cpp:255:16:255:16 | ref arg (__range) | stl.cpp:255:16:255:16 | (__range) |  |
-| stl.cpp:255:16:255:16 | s | stl.cpp:255:16:255:16 | (__range) |  |
-| stl.cpp:255:16:255:16 | s | stl.cpp:255:16:255:16 | (__range) |  |
-| stl.cpp:255:16:255:16 | s | stl.cpp:255:16:255:16 | call to operator* | TAINT |
-| stl.cpp:259:28:259:33 | call to source | stl.cpp:259:28:259:36 | call to basic_string | TAINT |
-| stl.cpp:259:28:259:36 | call to basic_string | stl.cpp:260:22:260:28 | const_s |  |
-| stl.cpp:260:22:260:22 | call to begin | stl.cpp:260:22:260:22 | (__begin) |  |
-| stl.cpp:260:22:260:22 | call to begin | stl.cpp:260:22:260:22 | (__begin) |  |
-| stl.cpp:260:22:260:22 | call to begin | stl.cpp:260:22:260:22 | (__begin) |  |
-| stl.cpp:260:22:260:22 | call to end | stl.cpp:260:22:260:22 | (__end) |  |
-| stl.cpp:260:22:260:22 | call to operator* | stl.cpp:261:8:261:8 | c |  |
-| stl.cpp:260:22:260:22 | ref arg (__begin) | stl.cpp:260:22:260:22 | (__begin) |  |
-| stl.cpp:260:22:260:22 | ref arg (__begin) | stl.cpp:260:22:260:22 | (__begin) |  |
-| stl.cpp:260:22:260:22 | ref arg (__begin) | stl.cpp:260:22:260:22 | (__begin) |  |
-| stl.cpp:260:22:260:28 | const_s | stl.cpp:260:22:260:22 | (__range) |  |
-| stl.cpp:260:22:260:28 | const_s | stl.cpp:260:22:260:22 | (__range) |  |
-| stl.cpp:260:22:260:28 | const_s | stl.cpp:260:22:260:22 | call to operator* | TAINT |
-| stl.cpp:296:43:296:49 | source1 | stl.cpp:300:21:300:27 | source1 |  |
-| stl.cpp:296:43:296:49 | source1 | stl.cpp:314:33:314:39 | source1 |  |
-| stl.cpp:300:21:300:27 | source1 | stl.cpp:300:21:300:28 | call to vector | TAINT |
-| stl.cpp:300:21:300:28 | call to vector | stl.cpp:302:14:302:14 | v |  |
-| stl.cpp:300:21:300:28 | call to vector | stl.cpp:306:38:306:38 | v |  |
-| stl.cpp:300:21:300:28 | call to vector | stl.cpp:306:55:306:55 | v |  |
-| stl.cpp:300:21:300:28 | call to vector | stl.cpp:310:15:310:15 | v |  |
-| stl.cpp:302:14:302:14 | call to begin | stl.cpp:302:14:302:14 | (__begin) |  |
-| stl.cpp:302:14:302:14 | call to begin | stl.cpp:302:14:302:14 | (__begin) |  |
-| stl.cpp:302:14:302:14 | call to begin | stl.cpp:302:14:302:14 | (__begin) |  |
-| stl.cpp:302:14:302:14 | call to end | stl.cpp:302:14:302:14 | (__end) |  |
-| stl.cpp:302:14:302:14 | call to operator* | stl.cpp:303:8:303:8 | x |  |
-| stl.cpp:302:14:302:14 | ref arg (__begin) | stl.cpp:302:14:302:14 | (__begin) |  |
-| stl.cpp:302:14:302:14 | ref arg (__begin) | stl.cpp:302:14:302:14 | (__begin) |  |
-| stl.cpp:302:14:302:14 | ref arg (__begin) | stl.cpp:302:14:302:14 | (__begin) |  |
-| stl.cpp:302:14:302:14 | ref arg (__range) | stl.cpp:302:14:302:14 | (__range) |  |
-| stl.cpp:302:14:302:14 | v | stl.cpp:302:14:302:14 | (__range) |  |
-| stl.cpp:302:14:302:14 | v | stl.cpp:302:14:302:14 | (__range) |  |
-| stl.cpp:302:14:302:14 | v | stl.cpp:302:14:302:14 | call to operator* | TAINT |
-| stl.cpp:306:38:306:38 | ref arg v | stl.cpp:306:55:306:55 | v |  |
-| stl.cpp:306:38:306:38 | ref arg v | stl.cpp:310:15:310:15 | v |  |
-| stl.cpp:306:40:306:44 | call to begin | stl.cpp:306:49:306:50 | it |  |
-| stl.cpp:306:40:306:44 | call to begin | stl.cpp:306:66:306:67 | it |  |
-| stl.cpp:306:40:306:44 | call to begin | stl.cpp:307:9:307:10 | it |  |
-| stl.cpp:306:55:306:55 | ref arg v | stl.cpp:306:55:306:55 | v |  |
-| stl.cpp:306:55:306:55 | ref arg v | stl.cpp:310:15:310:15 | v |  |
-| stl.cpp:306:66:306:67 | ref arg it | stl.cpp:306:49:306:50 | it |  |
-| stl.cpp:306:66:306:67 | ref arg it | stl.cpp:306:66:306:67 | it |  |
-| stl.cpp:306:66:306:67 | ref arg it | stl.cpp:307:9:307:10 | it |  |
-| stl.cpp:310:15:310:15 | call to begin | stl.cpp:310:15:310:15 | (__begin) |  |
-| stl.cpp:310:15:310:15 | call to begin | stl.cpp:310:15:310:15 | (__begin) |  |
-| stl.cpp:310:15:310:15 | call to begin | stl.cpp:310:15:310:15 | (__begin) |  |
-| stl.cpp:310:15:310:15 | call to end | stl.cpp:310:15:310:15 | (__end) |  |
-| stl.cpp:310:15:310:15 | call to operator* | stl.cpp:311:8:311:8 | x |  |
-| stl.cpp:310:15:310:15 | ref arg (__begin) | stl.cpp:310:15:310:15 | (__begin) |  |
-| stl.cpp:310:15:310:15 | ref arg (__begin) | stl.cpp:310:15:310:15 | (__begin) |  |
-| stl.cpp:310:15:310:15 | ref arg (__begin) | stl.cpp:310:15:310:15 | (__begin) |  |
-| stl.cpp:310:15:310:15 | ref arg (__range) | stl.cpp:310:15:310:15 | (__range) |  |
-| stl.cpp:310:15:310:15 | v | stl.cpp:310:15:310:15 | (__range) |  |
-| stl.cpp:310:15:310:15 | v | stl.cpp:310:15:310:15 | (__range) |  |
-| stl.cpp:310:15:310:15 | v | stl.cpp:310:15:310:15 | call to operator* | TAINT |
-| stl.cpp:314:33:314:39 | source1 | stl.cpp:314:33:314:40 | call to vector | TAINT |
-| stl.cpp:314:33:314:40 | call to vector | stl.cpp:315:21:315:27 | const_v |  |
-| stl.cpp:315:21:315:21 | call to begin | stl.cpp:315:21:315:21 | (__begin) |  |
-| stl.cpp:315:21:315:21 | call to begin | stl.cpp:315:21:315:21 | (__begin) |  |
-| stl.cpp:315:21:315:21 | call to begin | stl.cpp:315:21:315:21 | (__begin) |  |
-| stl.cpp:315:21:315:21 | call to end | stl.cpp:315:21:315:21 | (__end) |  |
-| stl.cpp:315:21:315:21 | call to operator* | stl.cpp:316:8:316:8 | x |  |
-| stl.cpp:315:21:315:21 | ref arg (__begin) | stl.cpp:315:21:315:21 | (__begin) |  |
-| stl.cpp:315:21:315:21 | ref arg (__begin) | stl.cpp:315:21:315:21 | (__begin) |  |
-| stl.cpp:315:21:315:21 | ref arg (__begin) | stl.cpp:315:21:315:21 | (__begin) |  |
-| stl.cpp:315:21:315:27 | const_v | stl.cpp:315:21:315:21 | (__range) |  |
-| stl.cpp:315:21:315:27 | const_v | stl.cpp:315:21:315:21 | (__range) |  |
-| stl.cpp:315:21:315:27 | const_v | stl.cpp:315:21:315:21 | call to operator* | TAINT |
-| stl.cpp:322:18:322:24 | hello | stl.cpp:322:18:322:25 | call to basic_string | TAINT |
-| stl.cpp:322:18:322:25 | call to basic_string | stl.cpp:325:8:325:9 | s1 |  |
-| stl.cpp:322:18:322:25 | call to basic_string | stl.cpp:325:13:325:14 | s1 |  |
-| stl.cpp:322:18:322:25 | call to basic_string | stl.cpp:326:8:326:9 | s1 |  |
-| stl.cpp:322:18:322:25 | call to basic_string | stl.cpp:327:13:327:14 | s1 |  |
-| stl.cpp:322:18:322:25 | call to basic_string | stl.cpp:330:8:330:9 | s1 |  |
-| stl.cpp:322:18:322:25 | call to basic_string | stl.cpp:331:8:331:9 | s1 |  |
-| stl.cpp:323:18:323:23 | call to source | stl.cpp:323:18:323:26 | call to basic_string | TAINT |
-| stl.cpp:323:18:323:26 | call to basic_string | stl.cpp:326:13:326:14 | s2 |  |
-| stl.cpp:323:18:323:26 | call to basic_string | stl.cpp:327:8:327:9 | s2 |  |
-| stl.cpp:323:18:323:26 | call to basic_string | stl.cpp:328:8:328:9 | s2 |  |
-| stl.cpp:323:18:323:26 | call to basic_string | stl.cpp:328:13:328:14 | s2 |  |
-| stl.cpp:325:8:325:9 | s1 | stl.cpp:325:11:325:11 | call to operator+ | TAINT |
-| stl.cpp:325:13:325:14 | s1 | stl.cpp:325:11:325:11 | call to operator+ | TAINT |
-| stl.cpp:326:8:326:9 | s1 | stl.cpp:326:11:326:11 | call to operator+ | TAINT |
-| stl.cpp:326:13:326:14 | s2 | stl.cpp:326:11:326:11 | call to operator+ | TAINT |
-| stl.cpp:327:8:327:9 | s2 | stl.cpp:327:11:327:11 | call to operator+ | TAINT |
-| stl.cpp:327:13:327:14 | s1 | stl.cpp:327:11:327:11 | call to operator+ | TAINT |
-| stl.cpp:328:8:328:9 | s2 | stl.cpp:328:11:328:11 | call to operator+ | TAINT |
-| stl.cpp:328:13:328:14 | s2 | stl.cpp:328:11:328:11 | call to operator+ | TAINT |
-| stl.cpp:330:8:330:9 | s1 | stl.cpp:330:11:330:11 | call to operator+ | TAINT |
-| stl.cpp:330:13:330:20 |  world | stl.cpp:330:11:330:11 | call to operator+ | TAINT |
-| stl.cpp:331:8:331:9 | s1 | stl.cpp:331:11:331:11 | call to operator+ | TAINT |
-| stl.cpp:331:13:331:18 | call to source | stl.cpp:331:11:331:11 | call to operator+ | TAINT |
-| stl.cpp:335:18:335:22 | abc | stl.cpp:335:18:335:23 | call to basic_string | TAINT |
-| stl.cpp:335:18:335:23 | call to basic_string | stl.cpp:339:8:339:9 | s3 |  |
-| stl.cpp:335:18:335:23 | call to basic_string | stl.cpp:342:8:342:9 | s3 |  |
-| stl.cpp:335:18:335:23 | call to basic_string | stl.cpp:346:8:346:9 | s3 |  |
-| stl.cpp:335:18:335:23 | call to basic_string | stl.cpp:351:8:351:9 | s3 |  |
-| stl.cpp:335:18:335:23 | call to basic_string | stl.cpp:355:8:355:9 | s3 |  |
-| stl.cpp:336:18:336:23 | call to source | stl.cpp:336:18:336:26 | call to basic_string | TAINT |
-| stl.cpp:336:18:336:26 | call to basic_string | stl.cpp:339:13:339:14 | s4 |  |
-| stl.cpp:336:18:336:26 | call to basic_string | stl.cpp:343:9:343:10 | s4 |  |
-| stl.cpp:336:18:336:26 | call to basic_string | stl.cpp:352:13:352:14 | s4 |  |
-| stl.cpp:339:8:339:9 | s3 | stl.cpp:339:11:339:11 | call to operator+ | TAINT |
-| stl.cpp:339:11:339:11 | call to operator+ | stl.cpp:339:3:339:14 | ... = ... |  |
-| stl.cpp:339:11:339:11 | call to operator+ | stl.cpp:340:8:340:9 | s5 |  |
-| stl.cpp:339:13:339:14 | s4 | stl.cpp:339:11:339:11 | call to operator+ | TAINT |
-| stl.cpp:342:8:342:9 | s3 | stl.cpp:342:3:342:9 | ... = ... |  |
-| stl.cpp:342:8:342:9 | s3 | stl.cpp:343:3:343:4 | s6 |  |
-| stl.cpp:342:8:342:9 | s3 | stl.cpp:344:8:344:9 | s6 |  |
-| stl.cpp:343:3:343:4 | ref arg s6 | stl.cpp:344:8:344:9 | s6 |  |
-| stl.cpp:343:9:343:10 | s4 | stl.cpp:343:3:343:4 | ref arg s6 | TAINT |
-| stl.cpp:343:9:343:10 | s4 | stl.cpp:343:6:343:6 | call to operator+= | TAINT |
-| stl.cpp:346:8:346:9 | s3 | stl.cpp:346:3:346:9 | ... = ... |  |
-| stl.cpp:346:8:346:9 | s3 | stl.cpp:347:3:347:4 | s7 |  |
-| stl.cpp:346:8:346:9 | s3 | stl.cpp:348:3:348:4 | s7 |  |
-| stl.cpp:346:8:346:9 | s3 | stl.cpp:349:8:349:9 | s7 |  |
-| stl.cpp:347:3:347:4 | ref arg s7 | stl.cpp:348:3:348:4 | s7 |  |
-| stl.cpp:347:3:347:4 | ref arg s7 | stl.cpp:349:8:349:9 | s7 |  |
-| stl.cpp:347:9:347:14 | call to source | stl.cpp:347:3:347:4 | ref arg s7 | TAINT |
-| stl.cpp:347:9:347:14 | call to source | stl.cpp:347:6:347:6 | call to operator+= | TAINT |
-| stl.cpp:348:3:348:4 | ref arg s7 | stl.cpp:349:8:349:9 | s7 |  |
-| stl.cpp:348:9:348:11 |   | stl.cpp:348:3:348:4 | ref arg s7 | TAINT |
-| stl.cpp:348:9:348:11 |   | stl.cpp:348:6:348:6 | call to operator+= | TAINT |
+| stl.cpp:109:12:109:17 | call to source | stl.cpp:113:7:113:7 | a |  |
+| stl.cpp:110:16:110:20 | 123 | stl.cpp:110:16:110:21 | call to basic_string | TAINT |
+| stl.cpp:110:16:110:21 | call to basic_string | stl.cpp:114:7:114:7 | b |  |
+| stl.cpp:110:16:110:21 | call to basic_string | stl.cpp:116:7:116:7 | b |  |
+| stl.cpp:111:16:111:21 | call to source | stl.cpp:111:16:111:24 | call to basic_string | TAINT |
+| stl.cpp:111:16:111:24 | call to basic_string | stl.cpp:115:7:115:7 | c |  |
+| stl.cpp:111:16:111:24 | call to basic_string | stl.cpp:117:7:117:7 | c |  |
+| stl.cpp:116:7:116:7 | b | stl.cpp:116:9:116:13 | call to c_str | TAINT |
+| stl.cpp:117:7:117:7 | c | stl.cpp:117:9:117:13 | call to c_str | TAINT |
+| stl.cpp:122:20:122:22 | call to basic_stringstream | stl.cpp:125:2:125:4 | ss1 |  |
+| stl.cpp:122:20:122:22 | call to basic_stringstream | stl.cpp:131:7:131:9 | ss1 |  |
+| stl.cpp:122:20:122:22 | call to basic_stringstream | stl.cpp:136:7:136:9 | ss1 |  |
+| stl.cpp:122:25:122:27 | call to basic_stringstream | stl.cpp:126:2:126:4 | ss2 |  |
+| stl.cpp:122:25:122:27 | call to basic_stringstream | stl.cpp:132:7:132:9 | ss2 |  |
+| stl.cpp:122:25:122:27 | call to basic_stringstream | stl.cpp:137:7:137:9 | ss2 |  |
+| stl.cpp:122:30:122:32 | call to basic_stringstream | stl.cpp:127:2:127:4 | ss3 |  |
+| stl.cpp:122:30:122:32 | call to basic_stringstream | stl.cpp:133:7:133:9 | ss3 |  |
+| stl.cpp:122:30:122:32 | call to basic_stringstream | stl.cpp:138:7:138:9 | ss3 |  |
+| stl.cpp:122:35:122:37 | call to basic_stringstream | stl.cpp:128:2:128:4 | ss4 |  |
+| stl.cpp:122:35:122:37 | call to basic_stringstream | stl.cpp:134:7:134:9 | ss4 |  |
+| stl.cpp:122:35:122:37 | call to basic_stringstream | stl.cpp:139:7:139:9 | ss4 |  |
+| stl.cpp:122:40:122:42 | call to basic_stringstream | stl.cpp:129:2:129:4 | ss5 |  |
+| stl.cpp:122:40:122:42 | call to basic_stringstream | stl.cpp:135:7:135:9 | ss5 |  |
+| stl.cpp:122:40:122:42 | call to basic_stringstream | stl.cpp:140:7:140:9 | ss5 |  |
+| stl.cpp:123:16:123:21 | call to source | stl.cpp:123:16:123:24 | call to basic_string | TAINT |
+| stl.cpp:123:16:123:24 | call to basic_string | stl.cpp:129:9:129:9 | t |  |
+| stl.cpp:125:2:125:4 | ref arg ss1 | stl.cpp:131:7:131:9 | ss1 |  |
+| stl.cpp:125:2:125:4 | ref arg ss1 | stl.cpp:136:7:136:9 | ss1 |  |
+| stl.cpp:126:2:126:4 | ref arg ss2 | stl.cpp:132:7:132:9 | ss2 |  |
+| stl.cpp:126:2:126:4 | ref arg ss2 | stl.cpp:137:7:137:9 | ss2 |  |
+| stl.cpp:127:2:127:4 | ref arg ss3 | stl.cpp:133:7:133:9 | ss3 |  |
+| stl.cpp:127:2:127:4 | ref arg ss3 | stl.cpp:138:7:138:9 | ss3 |  |
+| stl.cpp:128:2:128:4 | ref arg ss4 | stl.cpp:134:7:134:9 | ss4 |  |
+| stl.cpp:128:2:128:4 | ref arg ss4 | stl.cpp:139:7:139:9 | ss4 |  |
+| stl.cpp:129:2:129:4 | ref arg ss5 | stl.cpp:135:7:135:9 | ss5 |  |
+| stl.cpp:129:2:129:4 | ref arg ss5 | stl.cpp:140:7:140:9 | ss5 |  |
+| stl.cpp:143:32:143:37 | source | stl.cpp:148:9:148:14 | source |  |
+| stl.cpp:145:20:145:22 | call to basic_stringstream | stl.cpp:147:2:147:4 | ss1 |  |
+| stl.cpp:145:20:145:22 | call to basic_stringstream | stl.cpp:150:7:150:9 | ss1 |  |
+| stl.cpp:145:20:145:22 | call to basic_stringstream | stl.cpp:152:7:152:9 | ss1 |  |
+| stl.cpp:145:25:145:27 | call to basic_stringstream | stl.cpp:148:2:148:4 | ss2 |  |
+| stl.cpp:145:25:145:27 | call to basic_stringstream | stl.cpp:151:7:151:9 | ss2 |  |
+| stl.cpp:145:25:145:27 | call to basic_stringstream | stl.cpp:153:7:153:9 | ss2 |  |
+| stl.cpp:147:2:147:4 | ref arg ss1 | stl.cpp:150:7:150:9 | ss1 |  |
+| stl.cpp:147:2:147:4 | ref arg ss1 | stl.cpp:152:7:152:9 | ss1 |  |
+| stl.cpp:148:2:148:4 | ref arg ss2 | stl.cpp:151:7:151:9 | ss2 |  |
+| stl.cpp:148:2:148:4 | ref arg ss2 | stl.cpp:153:7:153:9 | ss2 |  |
+| stl.cpp:166:16:166:28 | call to basic_string | stl.cpp:167:7:167:11 | path1 |  |
+| stl.cpp:166:17:166:26 | call to user_input | stl.cpp:166:16:166:28 | call to basic_string | TAINT |
+| stl.cpp:167:7:167:11 | path1 | stl.cpp:167:13:167:17 | call to c_str | TAINT |
+| stl.cpp:170:10:170:19 | call to user_input | stl.cpp:170:10:170:21 | call to basic_string | TAINT |
+| stl.cpp:170:10:170:21 | call to basic_string | stl.cpp:170:2:170:21 | ... = ... |  |
+| stl.cpp:170:10:170:21 | call to basic_string | stl.cpp:171:7:171:11 | path2 |  |
+| stl.cpp:171:7:171:11 | path2 | stl.cpp:171:13:171:17 | call to c_str | TAINT |
+| stl.cpp:173:15:173:24 | call to user_input | stl.cpp:173:15:173:27 | call to basic_string | TAINT |
+| stl.cpp:173:15:173:27 | call to basic_string | stl.cpp:174:7:174:11 | path3 |  |
+| stl.cpp:174:7:174:11 | path3 | stl.cpp:174:13:174:17 | call to c_str | TAINT |
+| stl.cpp:179:19:179:24 | call to source | stl.cpp:182:17:182:18 | cs |  |
+| stl.cpp:179:19:179:24 | call to source | stl.cpp:184:7:184:8 | cs |  |
+| stl.cpp:182:17:182:18 | cs | stl.cpp:182:17:182:19 | call to basic_string | TAINT |
+| stl.cpp:182:17:182:19 | call to basic_string | stl.cpp:185:7:185:8 | ss |  |
+| stl.cpp:190:19:190:24 | call to source | stl.cpp:193:17:193:18 | cs |  |
+| stl.cpp:193:17:193:18 | cs | stl.cpp:193:17:193:19 | call to basic_string | TAINT |
+| stl.cpp:193:17:193:19 | call to basic_string | stl.cpp:196:7:196:8 | ss |  |
+| stl.cpp:193:17:193:19 | call to basic_string | stl.cpp:199:7:199:8 | ss |  |
+| stl.cpp:196:7:196:8 | ss | stl.cpp:196:10:196:14 | call to c_str | TAINT |
+| stl.cpp:196:10:196:14 | call to c_str | stl.cpp:196:2:196:16 | ... = ... |  |
+| stl.cpp:196:10:196:14 | call to c_str | stl.cpp:198:7:198:8 | cs |  |
+| stl.cpp:205:18:205:24 | hello | stl.cpp:205:18:205:25 | call to basic_string | TAINT |
+| stl.cpp:205:18:205:25 | call to basic_string | stl.cpp:210:8:210:9 | s1 |  |
+| stl.cpp:206:19:206:26 | call to basic_string | stl.cpp:211:8:211:9 | s2 |  |
+| stl.cpp:206:20:206:26 | hello | stl.cpp:206:19:206:26 | call to basic_string | TAINT |
+| stl.cpp:208:8:208:14 | call to basic_string | stl.cpp:208:3:208:14 | ... = ... |  |
+| stl.cpp:208:8:208:14 | call to basic_string | stl.cpp:212:8:212:9 | s3 |  |
+| stl.cpp:208:8:208:14 | hello | stl.cpp:208:8:208:14 | call to basic_string | TAINT |
+| stl.cpp:216:18:216:23 | call to source | stl.cpp:216:18:216:26 | call to basic_string | TAINT |
+| stl.cpp:216:18:216:26 | call to basic_string | stl.cpp:221:8:221:9 | s1 |  |
+| stl.cpp:217:19:217:27 | call to basic_string | stl.cpp:222:8:222:9 | s2 |  |
+| stl.cpp:217:20:217:25 | call to source | stl.cpp:217:19:217:27 | call to basic_string | TAINT |
+| stl.cpp:219:8:219:13 | call to source | stl.cpp:219:8:219:15 | call to basic_string | TAINT |
+| stl.cpp:219:8:219:15 | call to basic_string | stl.cpp:219:3:219:15 | ... = ... |  |
+| stl.cpp:219:8:219:15 | call to basic_string | stl.cpp:223:8:223:9 | s3 |  |
+| stl.cpp:227:15:227:16 | call to basic_string | stl.cpp:228:20:228:21 | s1 |  |
+| stl.cpp:227:15:227:16 | call to basic_string | stl.cpp:230:8:230:9 | s1 |  |
+| stl.cpp:227:15:227:16 | call to basic_string | stl.cpp:232:8:232:9 | s1 |  |
+| stl.cpp:228:20:228:21 | s1 | stl.cpp:233:8:233:9 | s2 |  |
+| stl.cpp:230:8:230:9 | s1 | stl.cpp:230:3:230:9 | ... = ... |  |
+| stl.cpp:230:8:230:9 | s1 | stl.cpp:234:8:234:9 | s3 |  |
+| stl.cpp:238:19:238:40 | call to basic_string | stl.cpp:242:8:242:9 | s1 |  |
+| stl.cpp:238:32:238:37 | call to source | stl.cpp:238:19:238:40 | call to basic_string | TAINT |
+| stl.cpp:240:8:240:28 | call to basic_string | stl.cpp:240:3:240:28 | ... = ... |  |
+| stl.cpp:240:8:240:28 | call to basic_string | stl.cpp:243:8:243:9 | s2 |  |
+| stl.cpp:240:20:240:25 | call to source | stl.cpp:240:8:240:28 | call to basic_string | TAINT |
+| stl.cpp:250:16:250:21 | call to source | stl.cpp:250:16:250:24 | call to basic_string | TAINT |
+| stl.cpp:250:16:250:24 | call to basic_string | stl.cpp:251:15:251:15 | s |  |
+| stl.cpp:250:16:250:24 | call to basic_string | stl.cpp:255:33:255:33 | s |  |
+| stl.cpp:250:16:250:24 | call to basic_string | stl.cpp:255:50:255:50 | s |  |
+| stl.cpp:250:16:250:24 | call to basic_string | stl.cpp:259:16:259:16 | s |  |
+| stl.cpp:251:15:251:15 | call to begin | stl.cpp:251:15:251:15 | (__begin) |  |
+| stl.cpp:251:15:251:15 | call to begin | stl.cpp:251:15:251:15 | (__begin) |  |
+| stl.cpp:251:15:251:15 | call to begin | stl.cpp:251:15:251:15 | (__begin) |  |
+| stl.cpp:251:15:251:15 | call to end | stl.cpp:251:15:251:15 | (__end) |  |
+| stl.cpp:251:15:251:15 | call to operator* | stl.cpp:252:8:252:8 | c |  |
+| stl.cpp:251:15:251:15 | ref arg (__begin) | stl.cpp:251:15:251:15 | (__begin) |  |
+| stl.cpp:251:15:251:15 | ref arg (__begin) | stl.cpp:251:15:251:15 | (__begin) |  |
+| stl.cpp:251:15:251:15 | ref arg (__begin) | stl.cpp:251:15:251:15 | (__begin) |  |
+| stl.cpp:251:15:251:15 | ref arg (__range) | stl.cpp:251:15:251:15 | (__range) |  |
+| stl.cpp:251:15:251:15 | s | stl.cpp:251:15:251:15 | (__range) |  |
+| stl.cpp:251:15:251:15 | s | stl.cpp:251:15:251:15 | (__range) |  |
+| stl.cpp:251:15:251:15 | s | stl.cpp:251:15:251:15 | call to operator* | TAINT |
+| stl.cpp:255:33:255:33 | ref arg s | stl.cpp:255:50:255:50 | s |  |
+| stl.cpp:255:33:255:33 | ref arg s | stl.cpp:259:16:259:16 | s |  |
+| stl.cpp:255:35:255:39 | call to begin | stl.cpp:255:44:255:45 | it |  |
+| stl.cpp:255:35:255:39 | call to begin | stl.cpp:255:61:255:62 | it |  |
+| stl.cpp:255:35:255:39 | call to begin | stl.cpp:256:9:256:10 | it |  |
+| stl.cpp:255:50:255:50 | ref arg s | stl.cpp:255:50:255:50 | s |  |
+| stl.cpp:255:50:255:50 | ref arg s | stl.cpp:259:16:259:16 | s |  |
+| stl.cpp:255:61:255:62 | ref arg it | stl.cpp:255:44:255:45 | it |  |
+| stl.cpp:255:61:255:62 | ref arg it | stl.cpp:255:61:255:62 | it |  |
+| stl.cpp:255:61:255:62 | ref arg it | stl.cpp:256:9:256:10 | it |  |
+| stl.cpp:259:16:259:16 | call to begin | stl.cpp:259:16:259:16 | (__begin) |  |
+| stl.cpp:259:16:259:16 | call to begin | stl.cpp:259:16:259:16 | (__begin) |  |
+| stl.cpp:259:16:259:16 | call to begin | stl.cpp:259:16:259:16 | (__begin) |  |
+| stl.cpp:259:16:259:16 | call to end | stl.cpp:259:16:259:16 | (__end) |  |
+| stl.cpp:259:16:259:16 | call to operator* | stl.cpp:260:8:260:8 | c |  |
+| stl.cpp:259:16:259:16 | ref arg (__begin) | stl.cpp:259:16:259:16 | (__begin) |  |
+| stl.cpp:259:16:259:16 | ref arg (__begin) | stl.cpp:259:16:259:16 | (__begin) |  |
+| stl.cpp:259:16:259:16 | ref arg (__begin) | stl.cpp:259:16:259:16 | (__begin) |  |
+| stl.cpp:259:16:259:16 | ref arg (__range) | stl.cpp:259:16:259:16 | (__range) |  |
+| stl.cpp:259:16:259:16 | s | stl.cpp:259:16:259:16 | (__range) |  |
+| stl.cpp:259:16:259:16 | s | stl.cpp:259:16:259:16 | (__range) |  |
+| stl.cpp:259:16:259:16 | s | stl.cpp:259:16:259:16 | call to operator* | TAINT |
+| stl.cpp:263:28:263:33 | call to source | stl.cpp:263:28:263:36 | call to basic_string | TAINT |
+| stl.cpp:263:28:263:36 | call to basic_string | stl.cpp:264:22:264:28 | const_s |  |
+| stl.cpp:264:22:264:22 | call to begin | stl.cpp:264:22:264:22 | (__begin) |  |
+| stl.cpp:264:22:264:22 | call to begin | stl.cpp:264:22:264:22 | (__begin) |  |
+| stl.cpp:264:22:264:22 | call to begin | stl.cpp:264:22:264:22 | (__begin) |  |
+| stl.cpp:264:22:264:22 | call to end | stl.cpp:264:22:264:22 | (__end) |  |
+| stl.cpp:264:22:264:22 | call to operator* | stl.cpp:265:8:265:8 | c |  |
+| stl.cpp:264:22:264:22 | ref arg (__begin) | stl.cpp:264:22:264:22 | (__begin) |  |
+| stl.cpp:264:22:264:22 | ref arg (__begin) | stl.cpp:264:22:264:22 | (__begin) |  |
+| stl.cpp:264:22:264:22 | ref arg (__begin) | stl.cpp:264:22:264:22 | (__begin) |  |
+| stl.cpp:264:22:264:28 | const_s | stl.cpp:264:22:264:22 | (__range) |  |
+| stl.cpp:264:22:264:28 | const_s | stl.cpp:264:22:264:22 | (__range) |  |
+| stl.cpp:264:22:264:28 | const_s | stl.cpp:264:22:264:22 | call to operator* | TAINT |
+| stl.cpp:300:43:300:49 | source1 | stl.cpp:304:21:304:27 | source1 |  |
+| stl.cpp:300:43:300:49 | source1 | stl.cpp:318:33:318:39 | source1 |  |
+| stl.cpp:304:21:304:27 | source1 | stl.cpp:304:21:304:28 | call to vector | TAINT |
+| stl.cpp:304:21:304:28 | call to vector | stl.cpp:306:14:306:14 | v |  |
+| stl.cpp:304:21:304:28 | call to vector | stl.cpp:310:38:310:38 | v |  |
+| stl.cpp:304:21:304:28 | call to vector | stl.cpp:310:55:310:55 | v |  |
+| stl.cpp:304:21:304:28 | call to vector | stl.cpp:314:15:314:15 | v |  |
+| stl.cpp:306:14:306:14 | call to begin | stl.cpp:306:14:306:14 | (__begin) |  |
+| stl.cpp:306:14:306:14 | call to begin | stl.cpp:306:14:306:14 | (__begin) |  |
+| stl.cpp:306:14:306:14 | call to begin | stl.cpp:306:14:306:14 | (__begin) |  |
+| stl.cpp:306:14:306:14 | call to end | stl.cpp:306:14:306:14 | (__end) |  |
+| stl.cpp:306:14:306:14 | call to operator* | stl.cpp:307:8:307:8 | x |  |
+| stl.cpp:306:14:306:14 | ref arg (__begin) | stl.cpp:306:14:306:14 | (__begin) |  |
+| stl.cpp:306:14:306:14 | ref arg (__begin) | stl.cpp:306:14:306:14 | (__begin) |  |
+| stl.cpp:306:14:306:14 | ref arg (__begin) | stl.cpp:306:14:306:14 | (__begin) |  |
+| stl.cpp:306:14:306:14 | ref arg (__range) | stl.cpp:306:14:306:14 | (__range) |  |
+| stl.cpp:306:14:306:14 | v | stl.cpp:306:14:306:14 | (__range) |  |
+| stl.cpp:306:14:306:14 | v | stl.cpp:306:14:306:14 | (__range) |  |
+| stl.cpp:306:14:306:14 | v | stl.cpp:306:14:306:14 | call to operator* | TAINT |
+| stl.cpp:310:38:310:38 | ref arg v | stl.cpp:310:55:310:55 | v |  |
+| stl.cpp:310:38:310:38 | ref arg v | stl.cpp:314:15:314:15 | v |  |
+| stl.cpp:310:40:310:44 | call to begin | stl.cpp:310:49:310:50 | it |  |
+| stl.cpp:310:40:310:44 | call to begin | stl.cpp:310:66:310:67 | it |  |
+| stl.cpp:310:40:310:44 | call to begin | stl.cpp:311:9:311:10 | it |  |
+| stl.cpp:310:55:310:55 | ref arg v | stl.cpp:310:55:310:55 | v |  |
+| stl.cpp:310:55:310:55 | ref arg v | stl.cpp:314:15:314:15 | v |  |
+| stl.cpp:310:66:310:67 | ref arg it | stl.cpp:310:49:310:50 | it |  |
+| stl.cpp:310:66:310:67 | ref arg it | stl.cpp:310:66:310:67 | it |  |
+| stl.cpp:310:66:310:67 | ref arg it | stl.cpp:311:9:311:10 | it |  |
+| stl.cpp:314:15:314:15 | call to begin | stl.cpp:314:15:314:15 | (__begin) |  |
+| stl.cpp:314:15:314:15 | call to begin | stl.cpp:314:15:314:15 | (__begin) |  |
+| stl.cpp:314:15:314:15 | call to begin | stl.cpp:314:15:314:15 | (__begin) |  |
+| stl.cpp:314:15:314:15 | call to end | stl.cpp:314:15:314:15 | (__end) |  |
+| stl.cpp:314:15:314:15 | call to operator* | stl.cpp:315:8:315:8 | x |  |
+| stl.cpp:314:15:314:15 | ref arg (__begin) | stl.cpp:314:15:314:15 | (__begin) |  |
+| stl.cpp:314:15:314:15 | ref arg (__begin) | stl.cpp:314:15:314:15 | (__begin) |  |
+| stl.cpp:314:15:314:15 | ref arg (__begin) | stl.cpp:314:15:314:15 | (__begin) |  |
+| stl.cpp:314:15:314:15 | ref arg (__range) | stl.cpp:314:15:314:15 | (__range) |  |
+| stl.cpp:314:15:314:15 | v | stl.cpp:314:15:314:15 | (__range) |  |
+| stl.cpp:314:15:314:15 | v | stl.cpp:314:15:314:15 | (__range) |  |
+| stl.cpp:314:15:314:15 | v | stl.cpp:314:15:314:15 | call to operator* | TAINT |
+| stl.cpp:318:33:318:39 | source1 | stl.cpp:318:33:318:40 | call to vector | TAINT |
+| stl.cpp:318:33:318:40 | call to vector | stl.cpp:319:21:319:27 | const_v |  |
+| stl.cpp:319:21:319:21 | call to begin | stl.cpp:319:21:319:21 | (__begin) |  |
+| stl.cpp:319:21:319:21 | call to begin | stl.cpp:319:21:319:21 | (__begin) |  |
+| stl.cpp:319:21:319:21 | call to begin | stl.cpp:319:21:319:21 | (__begin) |  |
+| stl.cpp:319:21:319:21 | call to end | stl.cpp:319:21:319:21 | (__end) |  |
+| stl.cpp:319:21:319:21 | call to operator* | stl.cpp:320:8:320:8 | x |  |
+| stl.cpp:319:21:319:21 | ref arg (__begin) | stl.cpp:319:21:319:21 | (__begin) |  |
+| stl.cpp:319:21:319:21 | ref arg (__begin) | stl.cpp:319:21:319:21 | (__begin) |  |
+| stl.cpp:319:21:319:21 | ref arg (__begin) | stl.cpp:319:21:319:21 | (__begin) |  |
+| stl.cpp:319:21:319:27 | const_v | stl.cpp:319:21:319:21 | (__range) |  |
+| stl.cpp:319:21:319:27 | const_v | stl.cpp:319:21:319:21 | (__range) |  |
+| stl.cpp:319:21:319:27 | const_v | stl.cpp:319:21:319:21 | call to operator* | TAINT |
+| stl.cpp:331:18:331:24 | hello | stl.cpp:331:18:331:25 | call to basic_string | TAINT |
+| stl.cpp:331:18:331:25 | call to basic_string | stl.cpp:334:8:334:9 | s1 |  |
+| stl.cpp:331:18:331:25 | call to basic_string | stl.cpp:334:13:334:14 | s1 |  |
+| stl.cpp:331:18:331:25 | call to basic_string | stl.cpp:335:8:335:9 | s1 |  |
+| stl.cpp:331:18:331:25 | call to basic_string | stl.cpp:336:13:336:14 | s1 |  |
+| stl.cpp:331:18:331:25 | call to basic_string | stl.cpp:339:8:339:9 | s1 |  |
+| stl.cpp:331:18:331:25 | call to basic_string | stl.cpp:340:8:340:9 | s1 |  |
+| stl.cpp:332:18:332:23 | call to source | stl.cpp:332:18:332:26 | call to basic_string | TAINT |
+| stl.cpp:332:18:332:26 | call to basic_string | stl.cpp:335:13:335:14 | s2 |  |
+| stl.cpp:332:18:332:26 | call to basic_string | stl.cpp:336:8:336:9 | s2 |  |
+| stl.cpp:332:18:332:26 | call to basic_string | stl.cpp:337:8:337:9 | s2 |  |
+| stl.cpp:332:18:332:26 | call to basic_string | stl.cpp:337:13:337:14 | s2 |  |
+| stl.cpp:334:8:334:9 | s1 | stl.cpp:334:11:334:11 | call to operator+ | TAINT |
+| stl.cpp:334:13:334:14 | s1 | stl.cpp:334:11:334:11 | call to operator+ | TAINT |
+| stl.cpp:335:8:335:9 | s1 | stl.cpp:335:11:335:11 | call to operator+ | TAINT |
+| stl.cpp:335:13:335:14 | s2 | stl.cpp:335:11:335:11 | call to operator+ | TAINT |
+| stl.cpp:336:8:336:9 | s2 | stl.cpp:336:11:336:11 | call to operator+ | TAINT |
+| stl.cpp:336:13:336:14 | s1 | stl.cpp:336:11:336:11 | call to operator+ | TAINT |
+| stl.cpp:337:8:337:9 | s2 | stl.cpp:337:11:337:11 | call to operator+ | TAINT |
+| stl.cpp:337:13:337:14 | s2 | stl.cpp:337:11:337:11 | call to operator+ | TAINT |
+| stl.cpp:339:8:339:9 | s1 | stl.cpp:339:11:339:11 | call to operator+ | TAINT |
+| stl.cpp:339:13:339:20 |  world | stl.cpp:339:11:339:11 | call to operator+ | TAINT |
+| stl.cpp:340:8:340:9 | s1 | stl.cpp:340:11:340:11 | call to operator+ | TAINT |
+| stl.cpp:340:13:340:18 | call to source | stl.cpp:340:11:340:11 | call to operator+ | TAINT |
+| stl.cpp:344:18:344:22 | abc | stl.cpp:344:18:344:23 | call to basic_string | TAINT |
+| stl.cpp:344:18:344:23 | call to basic_string | stl.cpp:348:8:348:9 | s3 |  |
+| stl.cpp:344:18:344:23 | call to basic_string | stl.cpp:351:8:351:9 | s3 |  |
+| stl.cpp:344:18:344:23 | call to basic_string | stl.cpp:355:8:355:9 | s3 |  |
+| stl.cpp:344:18:344:23 | call to basic_string | stl.cpp:360:8:360:9 | s3 |  |
+| stl.cpp:344:18:344:23 | call to basic_string | stl.cpp:364:8:364:9 | s3 |  |
+| stl.cpp:345:18:345:23 | call to source | stl.cpp:345:18:345:26 | call to basic_string | TAINT |
+| stl.cpp:345:18:345:26 | call to basic_string | stl.cpp:348:13:348:14 | s4 |  |
+| stl.cpp:345:18:345:26 | call to basic_string | stl.cpp:352:9:352:10 | s4 |  |
+| stl.cpp:345:18:345:26 | call to basic_string | stl.cpp:361:13:361:14 | s4 |  |
+| stl.cpp:348:8:348:9 | s3 | stl.cpp:348:11:348:11 | call to operator+ | TAINT |
+| stl.cpp:348:11:348:11 | call to operator+ | stl.cpp:348:3:348:14 | ... = ... |  |
+| stl.cpp:348:11:348:11 | call to operator+ | stl.cpp:349:8:349:9 | s5 |  |
+| stl.cpp:348:13:348:14 | s4 | stl.cpp:348:11:348:11 | call to operator+ | TAINT |
 | stl.cpp:351:8:351:9 | s3 | stl.cpp:351:3:351:9 | ... = ... |  |
-| stl.cpp:351:8:351:9 | s3 | stl.cpp:352:3:352:4 | s8 |  |
-| stl.cpp:351:8:351:9 | s3 | stl.cpp:353:8:353:9 | s8 |  |
-| stl.cpp:352:3:352:4 | ref arg s8 | stl.cpp:353:8:353:9 | s8 |  |
-| stl.cpp:352:13:352:14 | s4 | stl.cpp:352:3:352:4 | ref arg s8 | TAINT |
-| stl.cpp:352:13:352:14 | s4 | stl.cpp:352:6:352:11 | call to append | TAINT |
+| stl.cpp:351:8:351:9 | s3 | stl.cpp:352:3:352:4 | s6 |  |
+| stl.cpp:351:8:351:9 | s3 | stl.cpp:353:8:353:9 | s6 |  |
+| stl.cpp:352:3:352:4 | ref arg s6 | stl.cpp:353:8:353:9 | s6 |  |
+| stl.cpp:352:9:352:10 | s4 | stl.cpp:352:3:352:4 | ref arg s6 | TAINT |
+| stl.cpp:352:9:352:10 | s4 | stl.cpp:352:6:352:6 | call to operator+= | TAINT |
 | stl.cpp:355:8:355:9 | s3 | stl.cpp:355:3:355:9 | ... = ... |  |
-| stl.cpp:355:8:355:9 | s3 | stl.cpp:356:3:356:4 | s9 |  |
-| stl.cpp:355:8:355:9 | s3 | stl.cpp:357:3:357:4 | s9 |  |
-| stl.cpp:355:8:355:9 | s3 | stl.cpp:358:8:358:9 | s9 |  |
-| stl.cpp:356:3:356:4 | ref arg s9 | stl.cpp:357:3:357:4 | s9 |  |
-| stl.cpp:356:3:356:4 | ref arg s9 | stl.cpp:358:8:358:9 | s9 |  |
-| stl.cpp:356:13:356:18 | call to source | stl.cpp:356:3:356:4 | ref arg s9 | TAINT |
-| stl.cpp:356:13:356:18 | call to source | stl.cpp:356:6:356:11 | call to append | TAINT |
-| stl.cpp:357:3:357:4 | ref arg s9 | stl.cpp:358:8:358:9 | s9 |  |
-| stl.cpp:357:13:357:15 |   | stl.cpp:357:3:357:4 | ref arg s9 | TAINT |
-| stl.cpp:357:13:357:15 |   | stl.cpp:357:6:357:11 | call to append | TAINT |
+| stl.cpp:355:8:355:9 | s3 | stl.cpp:356:3:356:4 | s7 |  |
+| stl.cpp:355:8:355:9 | s3 | stl.cpp:357:3:357:4 | s7 |  |
+| stl.cpp:355:8:355:9 | s3 | stl.cpp:358:8:358:9 | s7 |  |
+| stl.cpp:356:3:356:4 | ref arg s7 | stl.cpp:357:3:357:4 | s7 |  |
+| stl.cpp:356:3:356:4 | ref arg s7 | stl.cpp:358:8:358:9 | s7 |  |
+| stl.cpp:356:9:356:14 | call to source | stl.cpp:356:3:356:4 | ref arg s7 | TAINT |
+| stl.cpp:356:9:356:14 | call to source | stl.cpp:356:6:356:6 | call to operator+= | TAINT |
+| stl.cpp:357:3:357:4 | ref arg s7 | stl.cpp:358:8:358:9 | s7 |  |
+| stl.cpp:357:9:357:11 |   | stl.cpp:357:3:357:4 | ref arg s7 | TAINT |
+| stl.cpp:357:9:357:11 |   | stl.cpp:357:6:357:6 | call to operator+= | TAINT |
+| stl.cpp:360:8:360:9 | s3 | stl.cpp:360:3:360:9 | ... = ... |  |
+| stl.cpp:360:8:360:9 | s3 | stl.cpp:361:3:361:4 | s8 |  |
+| stl.cpp:360:8:360:9 | s3 | stl.cpp:362:8:362:9 | s8 |  |
+| stl.cpp:361:3:361:4 | ref arg s8 | stl.cpp:362:8:362:9 | s8 |  |
+| stl.cpp:361:13:361:14 | s4 | stl.cpp:361:3:361:4 | ref arg s8 | TAINT |
+| stl.cpp:361:13:361:14 | s4 | stl.cpp:361:6:361:11 | call to append | TAINT |
+| stl.cpp:364:8:364:9 | s3 | stl.cpp:364:3:364:9 | ... = ... |  |
+| stl.cpp:364:8:364:9 | s3 | stl.cpp:365:3:365:4 | s9 |  |
+| stl.cpp:364:8:364:9 | s3 | stl.cpp:366:3:366:4 | s9 |  |
+| stl.cpp:364:8:364:9 | s3 | stl.cpp:367:8:367:9 | s9 |  |
+| stl.cpp:365:3:365:4 | ref arg s9 | stl.cpp:366:3:366:4 | s9 |  |
+| stl.cpp:365:3:365:4 | ref arg s9 | stl.cpp:367:8:367:9 | s9 |  |
+| stl.cpp:365:13:365:18 | call to source | stl.cpp:365:3:365:4 | ref arg s9 | TAINT |
+| stl.cpp:365:13:365:18 | call to source | stl.cpp:365:6:365:11 | call to append | TAINT |
+| stl.cpp:366:3:366:4 | ref arg s9 | stl.cpp:367:8:367:9 | s9 |  |
+| stl.cpp:366:13:366:15 |   | stl.cpp:366:3:366:4 | ref arg s9 | TAINT |
+| stl.cpp:366:13:366:15 |   | stl.cpp:366:6:366:11 | call to append | TAINT |
 | structlikeclass.cpp:5:7:5:7 | Unknown literal | structlikeclass.cpp:5:7:5:7 | constructor init of field v | TAINT |
 | structlikeclass.cpp:5:7:5:7 | Unknown literal | structlikeclass.cpp:5:7:5:7 | constructor init of field v | TAINT |
 | structlikeclass.cpp:5:7:5:7 | this | structlikeclass.cpp:5:7:5:7 | constructor init of field v [pre-this] |  |
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/stl.cpp b/cpp/ql/test/library-tests/dataflow/taint-tests/stl.cpp
index 698bed82c02..991b9fc5cc6 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/stl.cpp
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/stl.cpp
@@ -30,11 +30,14 @@ namespace std
 	template <class T> class allocator {
 	public:
 		allocator() throw();
+		typedef size_t size_type;
 	};
 	
 	template<class charT, class traits = char_traits<charT>, class Allocator = allocator<charT> >
 	class basic_string {
 	public:
+		typedef typename Allocator::size_type size_type;
+
 		explicit basic_string(const Allocator& a = Allocator());
 		basic_string(const charT* s, const Allocator& a = Allocator());
 
@@ -54,6 +57,7 @@ namespace std
 		basic_string& operator+=(const charT* s);
 		basic_string& append(const basic_string& str);
 		basic_string& append(const charT* s);
+		basic_string& append(size_type n, charT c);
 	};
 
 	template<class charT, class traits, class Allocator> basic_string<charT, traits, Allocator> operator+(const basic_string<charT, traits, Allocator>& lhs, const basic_string<charT, traits, Allocator>& rhs);
@@ -317,6 +321,11 @@ void test_range_based_for_loop_vector(int source1) {
 	}
 }
 
+namespace ns_char
+{
+	char source();
+}
+
 void test_string_append() {
 	{
 		std::string s1("hello");
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected b/cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected
index 345f8674aad..050ba49f97b 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected
@@ -32,36 +32,36 @@
 | movableclass.cpp:55:8:55:9 | s2 | movableclass.cpp:52:23:52:28 | call to source |
 | movableclass.cpp:64:8:64:9 | s2 | movableclass.cpp:23:55:23:60 | call to source |
 | movableclass.cpp:65:11:65:11 | call to operator= | movableclass.cpp:65:13:65:18 | call to source |
-| stl.cpp:109:7:109:7 | a | stl.cpp:105:12:105:17 | call to source |
-| stl.cpp:111:7:111:7 | c | stl.cpp:107:16:107:21 | call to source |
-| stl.cpp:113:9:113:13 | call to c_str | stl.cpp:107:16:107:21 | call to source |
-| stl.cpp:163:13:163:17 | call to c_str | stl.cpp:155:10:155:15 | call to source |
-| stl.cpp:167:13:167:17 | call to c_str | stl.cpp:155:10:155:15 | call to source |
-| stl.cpp:170:13:170:17 | call to c_str | stl.cpp:155:10:155:15 | call to source |
-| stl.cpp:180:7:180:8 | cs | stl.cpp:175:19:175:24 | call to source |
-| stl.cpp:181:7:181:8 | ss | stl.cpp:175:19:175:24 | call to source |
-| stl.cpp:194:7:194:8 | cs | stl.cpp:186:19:186:24 | call to source |
-| stl.cpp:195:7:195:8 | ss | stl.cpp:186:19:186:24 | call to source |
-| stl.cpp:217:8:217:9 | s1 | stl.cpp:212:18:212:23 | call to source |
-| stl.cpp:218:8:218:9 | s2 | stl.cpp:213:20:213:25 | call to source |
-| stl.cpp:219:8:219:9 | s3 | stl.cpp:215:8:215:13 | call to source |
-| stl.cpp:238:8:238:9 | s1 | stl.cpp:234:32:234:37 | call to source |
-| stl.cpp:239:8:239:9 | s2 | stl.cpp:236:20:236:25 | call to source |
-| stl.cpp:248:8:248:8 | c | stl.cpp:246:16:246:21 | call to source |
-| stl.cpp:256:8:256:8 | c | stl.cpp:246:16:246:21 | call to source |
-| stl.cpp:261:8:261:8 | c | stl.cpp:259:28:259:33 | call to source |
-| stl.cpp:303:8:303:8 | x | stl.cpp:296:43:296:49 | source1 |
-| stl.cpp:311:8:311:8 | x | stl.cpp:296:43:296:49 | source1 |
-| stl.cpp:316:8:316:8 | x | stl.cpp:296:43:296:49 | source1 |
-| stl.cpp:326:11:326:11 | call to operator+ | stl.cpp:323:18:323:23 | call to source |
-| stl.cpp:327:11:327:11 | call to operator+ | stl.cpp:323:18:323:23 | call to source |
-| stl.cpp:328:11:328:11 | call to operator+ | stl.cpp:323:18:323:23 | call to source |
-| stl.cpp:331:11:331:11 | call to operator+ | stl.cpp:331:13:331:18 | call to source |
-| stl.cpp:340:8:340:9 | s5 | stl.cpp:336:18:336:23 | call to source |
-| stl.cpp:344:8:344:9 | s6 | stl.cpp:336:18:336:23 | call to source |
-| stl.cpp:349:8:349:9 | s7 | stl.cpp:347:9:347:14 | call to source |
-| stl.cpp:353:8:353:9 | s8 | stl.cpp:336:18:336:23 | call to source |
-| stl.cpp:358:8:358:9 | s9 | stl.cpp:356:13:356:18 | call to source |
+| stl.cpp:113:7:113:7 | a | stl.cpp:109:12:109:17 | call to source |
+| stl.cpp:115:7:115:7 | c | stl.cpp:111:16:111:21 | call to source |
+| stl.cpp:117:9:117:13 | call to c_str | stl.cpp:111:16:111:21 | call to source |
+| stl.cpp:167:13:167:17 | call to c_str | stl.cpp:159:10:159:15 | call to source |
+| stl.cpp:171:13:171:17 | call to c_str | stl.cpp:159:10:159:15 | call to source |
+| stl.cpp:174:13:174:17 | call to c_str | stl.cpp:159:10:159:15 | call to source |
+| stl.cpp:184:7:184:8 | cs | stl.cpp:179:19:179:24 | call to source |
+| stl.cpp:185:7:185:8 | ss | stl.cpp:179:19:179:24 | call to source |
+| stl.cpp:198:7:198:8 | cs | stl.cpp:190:19:190:24 | call to source |
+| stl.cpp:199:7:199:8 | ss | stl.cpp:190:19:190:24 | call to source |
+| stl.cpp:221:8:221:9 | s1 | stl.cpp:216:18:216:23 | call to source |
+| stl.cpp:222:8:222:9 | s2 | stl.cpp:217:20:217:25 | call to source |
+| stl.cpp:223:8:223:9 | s3 | stl.cpp:219:8:219:13 | call to source |
+| stl.cpp:242:8:242:9 | s1 | stl.cpp:238:32:238:37 | call to source |
+| stl.cpp:243:8:243:9 | s2 | stl.cpp:240:20:240:25 | call to source |
+| stl.cpp:252:8:252:8 | c | stl.cpp:250:16:250:21 | call to source |
+| stl.cpp:260:8:260:8 | c | stl.cpp:250:16:250:21 | call to source |
+| stl.cpp:265:8:265:8 | c | stl.cpp:263:28:263:33 | call to source |
+| stl.cpp:307:8:307:8 | x | stl.cpp:300:43:300:49 | source1 |
+| stl.cpp:315:8:315:8 | x | stl.cpp:300:43:300:49 | source1 |
+| stl.cpp:320:8:320:8 | x | stl.cpp:300:43:300:49 | source1 |
+| stl.cpp:335:11:335:11 | call to operator+ | stl.cpp:332:18:332:23 | call to source |
+| stl.cpp:336:11:336:11 | call to operator+ | stl.cpp:332:18:332:23 | call to source |
+| stl.cpp:337:11:337:11 | call to operator+ | stl.cpp:332:18:332:23 | call to source |
+| stl.cpp:340:11:340:11 | call to operator+ | stl.cpp:340:13:340:18 | call to source |
+| stl.cpp:349:8:349:9 | s5 | stl.cpp:345:18:345:23 | call to source |
+| stl.cpp:353:8:353:9 | s6 | stl.cpp:345:18:345:23 | call to source |
+| stl.cpp:358:8:358:9 | s7 | stl.cpp:356:9:356:14 | call to source |
+| stl.cpp:362:8:362:9 | s8 | stl.cpp:345:18:345:23 | call to source |
+| stl.cpp:367:8:367:9 | s9 | stl.cpp:365:13:365:18 | call to source |
 | structlikeclass.cpp:35:8:35:9 | s1 | structlikeclass.cpp:29:22:29:27 | call to source |
 | structlikeclass.cpp:36:8:36:9 | s2 | structlikeclass.cpp:30:24:30:29 | call to source |
 | structlikeclass.cpp:37:8:37:9 | s3 | structlikeclass.cpp:29:22:29:27 | call to source |
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected b/cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected
index 4c83b90df08..839a077e3e6 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected
@@ -30,35 +30,35 @@
 | movableclass.cpp:55:8:55:9 | movableclass.cpp:52:23:52:28 | AST only |
 | movableclass.cpp:64:8:64:9 | movableclass.cpp:23:55:23:60 | AST only |
 | movableclass.cpp:65:11:65:11 | movableclass.cpp:65:13:65:18 | AST only |
-| stl.cpp:111:7:111:7 | stl.cpp:107:16:107:21 | AST only |
-| stl.cpp:113:9:113:13 | stl.cpp:107:16:107:21 | AST only |
-| stl.cpp:163:13:163:17 | stl.cpp:155:10:155:15 | AST only |
-| stl.cpp:167:13:167:17 | stl.cpp:155:10:155:15 | AST only |
-| stl.cpp:170:13:170:17 | stl.cpp:155:10:155:15 | AST only |
-| stl.cpp:180:7:180:8 | stl.cpp:175:19:175:26 | IR only |
-| stl.cpp:181:7:181:8 | stl.cpp:175:19:175:24 | AST only |
-| stl.cpp:194:7:194:8 | stl.cpp:186:19:186:24 | AST only |
-| stl.cpp:195:7:195:8 | stl.cpp:186:19:186:24 | AST only |
-| stl.cpp:217:8:217:9 | stl.cpp:212:18:212:23 | AST only |
-| stl.cpp:218:8:218:9 | stl.cpp:213:20:213:25 | AST only |
-| stl.cpp:219:8:219:9 | stl.cpp:215:8:215:13 | AST only |
-| stl.cpp:238:8:238:9 | stl.cpp:234:32:234:37 | AST only |
-| stl.cpp:239:8:239:9 | stl.cpp:236:20:236:25 | AST only |
-| stl.cpp:248:8:248:8 | stl.cpp:246:16:246:21 | AST only |
-| stl.cpp:256:8:256:8 | stl.cpp:246:16:246:21 | AST only |
-| stl.cpp:261:8:261:8 | stl.cpp:259:28:259:33 | AST only |
-| stl.cpp:303:8:303:8 | stl.cpp:296:43:296:49 | AST only |
-| stl.cpp:311:8:311:8 | stl.cpp:296:43:296:49 | AST only |
-| stl.cpp:316:8:316:8 | stl.cpp:296:43:296:49 | AST only |
-| stl.cpp:326:11:326:11 | stl.cpp:323:18:323:23 | AST only |
-| stl.cpp:327:11:327:11 | stl.cpp:323:18:323:23 | AST only |
-| stl.cpp:328:11:328:11 | stl.cpp:323:18:323:23 | AST only |
-| stl.cpp:331:11:331:11 | stl.cpp:331:13:331:18 | AST only |
-| stl.cpp:340:8:340:9 | stl.cpp:336:18:336:23 | AST only |
-| stl.cpp:344:8:344:9 | stl.cpp:336:18:336:23 | AST only |
-| stl.cpp:349:8:349:9 | stl.cpp:347:9:347:14 | AST only |
-| stl.cpp:353:8:353:9 | stl.cpp:336:18:336:23 | AST only |
-| stl.cpp:358:8:358:9 | stl.cpp:356:13:356:18 | AST only |
+| stl.cpp:115:7:115:7 | stl.cpp:111:16:111:21 | AST only |
+| stl.cpp:117:9:117:13 | stl.cpp:111:16:111:21 | AST only |
+| stl.cpp:167:13:167:17 | stl.cpp:159:10:159:15 | AST only |
+| stl.cpp:171:13:171:17 | stl.cpp:159:10:159:15 | AST only |
+| stl.cpp:174:13:174:17 | stl.cpp:159:10:159:15 | AST only |
+| stl.cpp:184:7:184:8 | stl.cpp:179:19:179:26 | IR only |
+| stl.cpp:185:7:185:8 | stl.cpp:179:19:179:24 | AST only |
+| stl.cpp:198:7:198:8 | stl.cpp:190:19:190:24 | AST only |
+| stl.cpp:199:7:199:8 | stl.cpp:190:19:190:24 | AST only |
+| stl.cpp:221:8:221:9 | stl.cpp:216:18:216:23 | AST only |
+| stl.cpp:222:8:222:9 | stl.cpp:217:20:217:25 | AST only |
+| stl.cpp:223:8:223:9 | stl.cpp:219:8:219:13 | AST only |
+| stl.cpp:242:8:242:9 | stl.cpp:238:32:238:37 | AST only |
+| stl.cpp:243:8:243:9 | stl.cpp:240:20:240:25 | AST only |
+| stl.cpp:252:8:252:8 | stl.cpp:250:16:250:21 | AST only |
+| stl.cpp:260:8:260:8 | stl.cpp:250:16:250:21 | AST only |
+| stl.cpp:265:8:265:8 | stl.cpp:263:28:263:33 | AST only |
+| stl.cpp:307:8:307:8 | stl.cpp:300:43:300:49 | AST only |
+| stl.cpp:315:8:315:8 | stl.cpp:300:43:300:49 | AST only |
+| stl.cpp:320:8:320:8 | stl.cpp:300:43:300:49 | AST only |
+| stl.cpp:335:11:335:11 | stl.cpp:332:18:332:23 | AST only |
+| stl.cpp:336:11:336:11 | stl.cpp:332:18:332:23 | AST only |
+| stl.cpp:337:11:337:11 | stl.cpp:332:18:332:23 | AST only |
+| stl.cpp:340:11:340:11 | stl.cpp:340:13:340:18 | AST only |
+| stl.cpp:349:8:349:9 | stl.cpp:345:18:345:23 | AST only |
+| stl.cpp:353:8:353:9 | stl.cpp:345:18:345:23 | AST only |
+| stl.cpp:358:8:358:9 | stl.cpp:356:9:356:14 | AST only |
+| stl.cpp:362:8:362:9 | stl.cpp:345:18:345:23 | AST only |
+| stl.cpp:367:8:367:9 | stl.cpp:365:13:365:18 | AST only |
 | structlikeclass.cpp:35:8:35:9 | structlikeclass.cpp:29:22:29:27 | AST only |
 | structlikeclass.cpp:36:8:36:9 | structlikeclass.cpp:30:24:30:29 | AST only |
 | structlikeclass.cpp:37:8:37:9 | structlikeclass.cpp:29:22:29:27 | AST only |
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/test_ir.expected b/cpp/ql/test/library-tests/dataflow/taint-tests/test_ir.expected
index fae0af72b67..463637d73e0 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/test_ir.expected
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/test_ir.expected
@@ -1,10 +1,10 @@
 | format.cpp:157:7:157:22 | (int)... | format.cpp:147:12:147:25 | call to source |
 | format.cpp:157:7:157:22 | access to array | format.cpp:147:12:147:25 | call to source |
 | format.cpp:158:7:158:27 | ... + ... | format.cpp:148:16:148:30 | call to source |
-| stl.cpp:109:7:109:7 | (const char *)... | stl.cpp:105:12:105:17 | call to source |
-| stl.cpp:109:7:109:7 | a | stl.cpp:105:12:105:17 | call to source |
-| stl.cpp:180:7:180:8 | cs | stl.cpp:175:19:175:24 | call to source |
-| stl.cpp:180:7:180:8 | cs | stl.cpp:175:19:175:26 | (const char *)... |
+| stl.cpp:113:7:113:7 | (const char *)... | stl.cpp:109:12:109:17 | call to source |
+| stl.cpp:113:7:113:7 | a | stl.cpp:109:12:109:17 | call to source |
+| stl.cpp:184:7:184:8 | cs | stl.cpp:179:19:179:24 | call to source |
+| stl.cpp:184:7:184:8 | cs | stl.cpp:179:19:179:26 | (const char *)... |
 | structlikeclass.cpp:38:8:38:9 | s4 | structlikeclass.cpp:33:8:33:13 | call to source |
 | structlikeclass.cpp:61:8:61:9 | s2 | structlikeclass.cpp:58:24:58:29 | call to source |
 | structlikeclass.cpp:62:8:62:20 | ... = ... | structlikeclass.cpp:62:13:62:18 | call to source |

From 3c0e7a709f4289cde3222b3705d124279996a407 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Thu, 13 Aug 2020 14:22:11 +0100
Subject: [PATCH 11/12] C++: Add a test of append with CharT.

---
 cpp/ql/test/library-tests/dataflow/taint-tests/stl.cpp | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/stl.cpp b/cpp/ql/test/library-tests/dataflow/taint-tests/stl.cpp
index 991b9fc5cc6..46b3448d37e 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/stl.cpp
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/stl.cpp
@@ -366,4 +366,12 @@ void test_string_append() {
 		s9.append(" ");
 		sink(s9); // tainted
 	}
+
+	{
+		std::string s10("abc");
+		char c = ns_char::source();
+
+		s10.append(1, c);
+		sink(s10); // tainted [NOT DETECTED]
+	}
 }

From 7349333006343c4e9a1768b4a8e25d87b2d6a53e Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Thu, 13 Aug 2020 14:44:51 +0100
Subject: [PATCH 12/12] C++: Taint through char append.

---
 .../semmle/code/cpp/models/implementations/StdString.qll   | 6 ++++--
 .../library-tests/dataflow/taint-tests/localTaint.expected | 7 +++++++
 cpp/ql/test/library-tests/dataflow/taint-tests/stl.cpp     | 2 +-
 .../test/library-tests/dataflow/taint-tests/taint.expected | 1 +
 .../library-tests/dataflow/taint-tests/test_diff.expected  | 1 +
 5 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
index 17ccfc954b2..06ca6ad8fd7 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
@@ -49,11 +49,13 @@ class StdStringAppend extends TaintFunction {
   }
 
   /**
-   * Gets the index of a parameter to this function that is a string.
+   * Gets the index of a parameter to this function that is a string (or
+   * character).
    */
   int getAStringParameter() {
     getParameter(result).getType() instanceof PointerType or
-    getParameter(result).getType() instanceof ReferenceType
+    getParameter(result).getType() instanceof ReferenceType or
+    getParameter(result).getType() = getDeclaringType().getTemplateArgument(0) // i.e. `std::basic_string::CharT`
   }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
index a387ca676d6..cbaa02ae640 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
@@ -579,6 +579,13 @@
 | stl.cpp:366:3:366:4 | ref arg s9 | stl.cpp:367:8:367:9 | s9 |  |
 | stl.cpp:366:13:366:15 |   | stl.cpp:366:3:366:4 | ref arg s9 | TAINT |
 | stl.cpp:366:13:366:15 |   | stl.cpp:366:6:366:11 | call to append | TAINT |
+| stl.cpp:371:19:371:23 | abc | stl.cpp:371:19:371:24 | call to basic_string | TAINT |
+| stl.cpp:371:19:371:24 | call to basic_string | stl.cpp:374:3:374:5 | s10 |  |
+| stl.cpp:371:19:371:24 | call to basic_string | stl.cpp:375:8:375:10 | s10 |  |
+| stl.cpp:372:12:372:26 | call to source | stl.cpp:374:17:374:17 | c |  |
+| stl.cpp:374:3:374:5 | ref arg s10 | stl.cpp:375:8:375:10 | s10 |  |
+| stl.cpp:374:17:374:17 | c | stl.cpp:374:3:374:5 | ref arg s10 | TAINT |
+| stl.cpp:374:17:374:17 | c | stl.cpp:374:7:374:12 | call to append | TAINT |
 | structlikeclass.cpp:5:7:5:7 | Unknown literal | structlikeclass.cpp:5:7:5:7 | constructor init of field v | TAINT |
 | structlikeclass.cpp:5:7:5:7 | Unknown literal | structlikeclass.cpp:5:7:5:7 | constructor init of field v | TAINT |
 | structlikeclass.cpp:5:7:5:7 | this | structlikeclass.cpp:5:7:5:7 | constructor init of field v [pre-this] |  |
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/stl.cpp b/cpp/ql/test/library-tests/dataflow/taint-tests/stl.cpp
index 46b3448d37e..d0253b9b025 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/stl.cpp
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/stl.cpp
@@ -372,6 +372,6 @@ void test_string_append() {
 		char c = ns_char::source();
 
 		s10.append(1, c);
-		sink(s10); // tainted [NOT DETECTED]
+		sink(s10); // tainted
 	}
 }
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected b/cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected
index 050ba49f97b..3c3ed47e351 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected
@@ -62,6 +62,7 @@
 | stl.cpp:358:8:358:9 | s7 | stl.cpp:356:9:356:14 | call to source |
 | stl.cpp:362:8:362:9 | s8 | stl.cpp:345:18:345:23 | call to source |
 | stl.cpp:367:8:367:9 | s9 | stl.cpp:365:13:365:18 | call to source |
+| stl.cpp:375:8:375:10 | s10 | stl.cpp:372:12:372:26 | call to source |
 | structlikeclass.cpp:35:8:35:9 | s1 | structlikeclass.cpp:29:22:29:27 | call to source |
 | structlikeclass.cpp:36:8:36:9 | s2 | structlikeclass.cpp:30:24:30:29 | call to source |
 | structlikeclass.cpp:37:8:37:9 | s3 | structlikeclass.cpp:29:22:29:27 | call to source |
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected b/cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected
index 839a077e3e6..7704bbf9bf0 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected
@@ -59,6 +59,7 @@
 | stl.cpp:358:8:358:9 | stl.cpp:356:9:356:14 | AST only |
 | stl.cpp:362:8:362:9 | stl.cpp:345:18:345:23 | AST only |
 | stl.cpp:367:8:367:9 | stl.cpp:365:13:365:18 | AST only |
+| stl.cpp:375:8:375:10 | stl.cpp:372:12:372:26 | AST only |
 | structlikeclass.cpp:35:8:35:9 | structlikeclass.cpp:29:22:29:27 | AST only |
 | structlikeclass.cpp:36:8:36:9 | structlikeclass.cpp:30:24:30:29 | AST only |
 | structlikeclass.cpp:37:8:37:9 | structlikeclass.cpp:29:22:29:27 | AST only |