Merge pull request #18261 from MathiasVP/add-more-atl-string-models

C++: Add more MaD models for ATL string classes
2025-12-16 16:53:25 +01:00 · 2025-01-02 15:06:04 +00:00
parent 68ca307ac9 cda007bae7
commit f23e56bdca
21 changed files with 2368 additions and 1030 deletions
--- a/cpp/ql/lib/ext/CAtlFileMappingBase.model.yml
+++ b/cpp/ql/lib/ext/CAtlFileMappingBase.model.yml
@@ -11,3 +11,4 @@ extensions:
      - ["", "CAtlFileMappingBase", True, "MapSharedMem", "", "", "Argument[*1]", "Argument[-1]", "taint", "manual"]
      - ["", "CAtlFileMappingBase", True, "OpenMapping", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
      - ["", "CAtlFileMappingBase", True, "operator=", "", "", "Argument[*0]", "Argument[-1]", "value", "manual"]
+      - ["", "CAtlFileMappingBase", True, "operator=", "", "", "Argument[*0]", "ReturnValue[*]", "value", "manual"]
--- a/cpp/ql/lib/ext/CSimpleMap.model.yml
+++ b/cpp/ql/lib/ext/CSimpleMap.model.yml
@@ -9,4 +9,5 @@ extensions:
      - ["", "CSimpleMap", True, "SetAt", "", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
      - ["", "CSimpleMap", True, "SetAtIndex", "", "", "Argument[*@2]", "Argument[-1].Element[@]", "value", "manual"]
      - ["", "CSimpleMap", True, "operator[]", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
-      - ["", "CSimpleMap", True, "operator=", "", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
+      - ["", "CSimpleMap", True, "operator=", "", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
+      - ["", "CSimpleMap", True, "operator=", "", "", "Argument[*0].Element[@]", "ReturnValue[*].Element[@]", "value", "manual"]
--- a/cpp/ql/lib/ext/CSimpleStringT.model.yml
+++ b/cpp/ql/lib/ext/CSimpleStringT.model.yml
@@ -0,0 +1,42 @@
+extensions:
+  - addsTo:
+      pack: codeql/cpp-all
+      extensible: summaryModel
+    data: # TODO this model can be improved a lot once we have MapKey content # namespace, type, subtypes, name, signature, ext, input, output, kind, provenance
+      - ["", "CSimpleStringT", True, "CSimpleStringT", "(const XCHAR *,int,IAtlStringMgr *)", "", "Argument[*0]", "Argument[-1]", "value", "manual"]
+      - ["", "CSimpleStringT", True, "CSimpleStringT", "(PCXSTR,IAtlStringMgr *)", "", "Argument[*0]", "Argument[-1]", "value", "manual"]
+      - ["", "CSimpleStringT", True, "CSimpleStringT", "(const CSimpleStringT &)", "", "Argument[*0]", "Argument[-1]", "value", "manual"]
+      - ["", "CSimpleStringT", True, "Append", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
+      - ["", "CSimpleStringT", True, "AppendChar", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
+      - ["", "CSimpleStringT", True, "CopyChars", "(XCHAR *,const XCHAR *,int)", "", "Argument[*1]", "Argument[*0]", "taint", "manual"]
+      - ["", "CSimpleStringT", True, "CopyChars", "(XCHAR *,size_t,const XCHAR *,int)", "", "Argument[*2]", "Argument[*0]", "taint", "manual"]
+      - ["", "CSimpleStringT", True, "CopyCharsOverlapped", "(XCHAR *,const XCHAR *,int)", "", "Argument[*1]", "Argument[*0]", "taint", "manual"]
+      - ["", "CSimpleStringT", True, "GetString", "", "", "Argument[-1]", "ReturnValue[*]", "value", "manual"]
+      - ["", "CSimpleStringT", True, "LockBuffer", "", "", "Argument[-1]", "ReturnValue[*]", "value", "manual"]
+      - ["", "CSimpleStringT", True, "SetAt", "", "", "Argument[1]", "Argument[-1]", "taint", "manual"]
+      - ["", "CSimpleStringT", True, "SetString", "", "", "Argument[*0]", "Argument[-1]", "value", "manual"]
+      - ["", "CSimpleStringT", True, "operator PCXSTR", "", "", "Argument[-1]", "ReturnValue[*]", "value", "manual"]
+      - ["", "CSimpleStringT", True, "operator[]", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
+      - ["", "CSimpleStringT", True, "operator+=", "(PCXSTR)", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["", "CSimpleStringT", True, "operator+=", "(PCXSTR)", "", "Argument[*0]", "ReturnValue[*]", "taint", "manual"]
+      - ["", "CSimpleStringT", True, "operator+=", "(PCXSTR)", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
+      - ["", "CSimpleStringT", True, "operator+=", "(const CSimpleStringT &)", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["", "CSimpleStringT", True, "operator+=", "(const CSimpleStringT &)", "", "Argument[*0]", "ReturnValue[*]", "taint", "manual"]
+      - ["", "CSimpleStringT", True, "operator+=", "(const CSimpleStringT &)", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
+      - ["", "CSimpleStringT", True, "operator+=", "(const CStaticString &)", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["", "CSimpleStringT", True, "operator+=", "(const CStaticString &)", "", "Argument[*0]", "ReturnValue[*]", "taint", "manual"]
+      - ["", "CSimpleStringT", True, "operator+=", "(const CStaticString &)", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
+      - ["", "CSimpleStringT", True, "operator+=", "(char)", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["", "CSimpleStringT", True, "operator+=", "(char)", "", "Argument[0]", "ReturnValue[*]", "taint", "manual"]
+      - ["", "CSimpleStringT", True, "operator+=", "(char)", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
+      - ["", "CSimpleStringT", True, "operator+=", "(unsigned char)", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["", "CSimpleStringT", True, "operator+=", "(unsigned char)", "", "Argument[0]", "ReturnValue[*]", "taint", "manual"]
+      - ["", "CSimpleStringT", True, "operator+=", "(unsigned char)", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
+      - ["", "CSimpleStringT", True, "operator+=", "(wchar_t)", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["", "CSimpleStringT", True, "operator+=", "(wchar_t)", "", "Argument[0]", "ReturnValue[*]", "taint", "manual"]
+      - ["", "CSimpleStringT", True, "operator+=", "(wchar_t)", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
+      - ["", "CSimpleStringT", True, "operator=", "", "", "Argument[*0]", "Argument[-1]", "value", "manual"]
+      - ["", "CSimpleStringT", True, "operator=", "", "", "Argument[*0]", "ReturnValue[*]", "value", "manual"]
+      - ["", "CSimpleStringT", True, "GetAt", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
+      - ["", "CSimpleStringT", True, "GetBuffer", "", "", "Argument[-1]", "ReturnValue[*]", "value", "manual"]
+      - ["", "CSimpleStringT", True, "GetBufferSetLength", "", "", "Argument[-1]", "ReturnValue[*]", "value", "manual"]
--- a/cpp/ql/lib/ext/CStrBufT.model.yml
+++ b/cpp/ql/lib/ext/CStrBufT.model.yml
@@ -0,0 +1,8 @@
+extensions:
+  - addsTo:
+      pack: codeql/cpp-all
+      extensible: summaryModel
+    data:
+      - ["", "CStrBufT", True, "CStrBufT", "", "", "Argument[*0]", "Argument[-1]", "value", "manual"]
+      - ["", "CStrBufT", True, "operator PCXSTR", "", "", "Argument[-1]", "ReturnValue[*]", "value", "manual"]
+      - ["", "CStrBufT", True, "operator PXSTR", "", "", "Argument[-1]", "ReturnValue[*]", "value", "manual"]
--- a/cpp/ql/lib/ext/CStringData.model.yml
+++ b/cpp/ql/lib/ext/CStringData.model.yml
@@ -0,0 +1,6 @@
+extensions:
+  - addsTo:
+      pack: codeql/cpp-all
+      extensible: summaryModel
+    data:
+      - ["", "CStringData", True, "data", "", "", "Argument[-1]", "ReturnValue[*]", "value", "manual"]
--- a/cpp/ql/lib/ext/CStringT.model.yml
+++ b/cpp/ql/lib/ext/CStringT.model.yml
@@ -0,0 +1,118 @@
+extensions:
+  - addsTo:
+      pack: codeql/cpp-all
+      extensible: summaryModel
+    data: # TODO this model can be improved a lot once we have MapKey content # namespace, type, subtypes, name, signature, ext, input, output, kind, provenance
+      - ["", "CStringT", True, "CStringT", "(const VARIANT &)", "", "Argument[*0]", "Argument[-1]", "value", "manual"]
+      - ["", "CStringT", True, "CStringT", "(const VARIANT &,IAtlStringMgr *)", "", "Argument[*0]", "Argument[-1]", "value", "manual"]
+      - ["", "CStringT", True, "CStringT", "(const CStringT &)", "", "Argument[*0]", "Argument[-1]", "value", "manual"]
+      - ["", "CStringT", True, "CStringT", "(const CSimpleStringT &)", "", "Argument[*0]", "Argument[-1]", "value", "manual"]
+      - ["", "CStringT", True, "CStringT", "(const XCHAR *)", "", "Argument[*0]", "Argument[-1]", "value", "manual"]
+      - ["", "CStringT", True, "CStringT", "(const YCHAR *)", "", "Argument[*0]", "Argument[-1]", "value", "manual"]
+      - ["", "CStringT", True, "CStringT", "(LPCSTR,IAtlStringMgr *)", "", "Argument[*0]", "Argument[-1]", "value", "manual"]
+      - ["", "CStringT", True, "CStringT", "(LPCWSTR,IAtlStringMgr *)", "", "Argument[*0]", "Argument[-1]", "value", "manual"]
+      - ["", "CStringT", True, "CStringT", "(const unsigned char *)", "", "Argument[*0]", "Argument[-1]", "value", "manual"]
+      - ["", "CStringT", True, "CStringT", "(char *)", "", "Argument[*0]", "Argument[-1]", "value", "manual"]
+      - ["", "CStringT", True, "CStringT", "(unsigned char *)", "", "Argument[*0]", "Argument[-1]", "value", "manual"]
+      - ["", "CStringT", True, "CStringT", "(wchar_t *)", "", "Argument[*0]", "Argument[-1]", "value", "manual"]
+      - ["", "CStringT", True, "CStringT", "(const unsigned char *,IAtlStringMgr *)", "", "Argument[*0]", "Argument[-1]", "value", "manual"]
+      - ["", "CStringT", True, "CStringT", "(char,int)", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
+      - ["", "CStringT", True, "CStringT", "(wchar_t,int)", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
+      - ["", "CStringT", True, "CStringT", "(const XCHAR *,int)", "", "Argument[*0]", "Argument[-1]", "value", "manual"]
+      - ["", "CStringT", True, "CStringT", "(const YCHAR *,int)", "", "Argument[*0]", "Argument[-1]", "value", "manual"]
+      - ["", "CStringT", True, "CStringT", "(const XCHAR *,int,AtlStringMgr *)", "", "Argument[*0]", "Argument[-1]", "value", "manual"]
+      - ["", "CStringT", True, "CStringT", "(const YCHAR *,int,IAtlStringMgr *)", "", "Argument[*0]", "Argument[-1]", "value", "manual"]
+      - ["", "CStringT", True, "AllocSysString", "", "", "Argument[-1]", "ReturnValue[*]", "value", "manual"]
+      - ["", "CStringT", True, "AppendFormat", "(PCXSTR,...)", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
+      - ["", "CStringT", True, "AppendFormat", "(PCXSTR,...)", "", "Argument[1..8]", "Argument[-1]", "taint", "manual"]
+      - ["", "CStringT", True, "AppendFormat", "(PCXSTR,...)", "", "Argument[*1..8]", "Argument[-1]", "taint", "manual"]
+      - ["", "CStringT", True, "AppendFormat", "(UINT,...)", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
+      - ["", "CStringT", True, "AppendFormat", "(UINT,...)", "", "Argument[1..8]", "Argument[-1]", "taint", "manual"]
+      - ["", "CStringT", True, "AppendFormat", "(UINT,...)", "", "Argument[*1..8]", "Argument[-1]", "taint", "manual"]
+      - ["", "CStringT", True, "Format", "(PCXSTR,...)", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
+      - ["", "CStringT", True, "Format", "(PCXSTR,...)", "", "Argument[1..8]", "Argument[-1]", "taint", "manual"]
+      - ["", "CStringT", True, "Format", "(PCXSTR,...)", "", "Argument[*1..8]", "Argument[-1]", "taint", "manual"]
+      - ["", "CStringT", True, "Format", "(UINT,...)", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
+      - ["", "CStringT", True, "Format", "(UINT,...)", "", "Argument[1..8]", "Argument[-1]", "taint", "manual"]
+      - ["", "CStringT", True, "Format", "(UINT,...)", "", "Argument[*1..8]", "Argument[-1]", "taint", "manual"]
+      - ["", "CStringT", True, "FormatMessage", "(PCXSTR,...)", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
+      - ["", "CStringT", True, "FormatMessage", "(PCXSTR,...)", "", "Argument[1..8]", "Argument[-1]", "taint", "manual"]
+      - ["", "CStringT", True, "FormatMessage", "(PCXSTR,...)", "", "Argument[*1..8]", "Argument[-1]", "taint", "manual"]
+      - ["", "CStringT", True, "FormatMessage", "(UINT,...)", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
+      - ["", "CStringT", True, "FormatMessage", "(UINT,...)", "", "Argument[1..8]", "Argument[-1]", "taint", "manual"]
+      - ["", "CStringT", True, "FormatMessage", "(UINT,...)", "", "Argument[*1..8]", "Argument[-1]", "taint", "manual"]
+      - ["", "CStringT", True, "FormatMessageV", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
+      - ["", "CStringT", True, "FormatMessageV", "", "", "Argument[*1]", "Argument[-1]", "taint", "manual"]
+      - ["", "CStringT", True, "FormatV", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
+      - ["", "CStringT", True, "FormatV", "", "", "Argument[1]", "Argument[-1]", "taint", "manual"]
+      - ["", "CStringT", True, "Insert", "(int,PCXSTR)", "", "Argument[*1]", "Argument[-1]", "taint", "manual"]
+      - ["", "CStringT", True, "Insert", "(int,XCHAR)", "", "Argument[1]", "Argument[-1]", "taint", "manual"]
+      - ["", "CStringT", True, "Left", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
+      - ["", "CStringT", True, "Right", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
+      - ["", "CStringT", True, "LoadString", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
+      - ["", "CStringT", True, "LoadString", "", "", "Argument[1]", "Argument[-1]", "taint", "manual"]
+      - ["", "CStringT", True, "MakeLower", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["", "CStringT", True, "MakeReverse", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["", "CStringT", True, "MakeUpper", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["", "CStringT", True, "Mid", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
+      - ["", "CStringT", True, "Replace", "(PCXSTR,PCXSTR)", "", "Argument[*1]", "Argument[-1]", "taint", "manual"]
+      - ["", "CStringT", True, "Replace", "(XCHAR,XCHAR)", "", "Argument[1]", "Argument[-1]", "taint", "manual"]
+      - ["", "CStringT", True, "SetSysString", "", "", "Argument[-1]", "ReturnValue", "value", "manual"]
+      - ["", "CStringT", True, "SetSysString", "", "", "Argument[-1]", "Argument[**0]", "value", "manual"]
+      - ["", "CStringT", True, "SpanExcluding", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
+      - ["", "CStringT", True, "SpanIncluding", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
+      - ["", "CStringT", True, "Tokenize", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
+      - ["", "CStringT", True, "Trim", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["", "CStringT", True, "TrimLeft", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["", "CStringT", True, "TrimRight", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["", "CStringT", True, "operator=", "(const CStringT &)", "", "Argument[*0]", "Argument[-1]", "value", "manual"]
+      - ["", "CStringT", True, "operator=", "(const CStringT &)", "", "Argument[*0]", "ReturnValue[*]", "value", "manual"]
+      - ["", "CStringT", True, "operator=", "(const CSimpleStringT &)", "", "Argument[*0]", "Argument[-1]", "value", "manual"]
+      - ["", "CStringT", True, "operator=", "(const CSimpleStringT &)", "", "Argument[*0]", "ReturnValue[*]", "value", "manual"]
+      - ["", "CStringT", True, "operator=", "(PCXSTR)", "", "Argument[*0]", "Argument[-1]", "value", "manual"]
+      - ["", "CStringT", True, "operator=", "(PCXSTR)", "", "Argument[*0]", "ReturnValue[*]", "value", "manual"]
+      - ["", "CStringT", True, "operator=", "(PCYSTR)", "", "Argument[*0]", "Argument[-1]", "value", "manual"]
+      - ["", "CStringT", True, "operator=", "(PCYSTR)", "", "Argument[*0]", "ReturnValue[*]", "value", "manual"]
+      - ["", "CStringT", True, "operator=", "(const unsigned char *)", "", "Argument[*0]", "Argument[-1]", "value", "manual"]
+      - ["", "CStringT", True, "operator=", "(const unsigned char *)", "", "Argument[*0]", "ReturnValue[*]", "value", "manual"]
+      - ["", "CStringT", True, "operator=", "(XCHAR)", "", "Argument[0]", "Argument[-1]", "value", "manual"]
+      - ["", "CStringT", True, "operator=", "(XCHAR)", "", "Argument[0]", "ReturnValue[*]", "value", "manual"]
+      - ["", "CStringT", True, "operator=", "(YCHAR)", "", "Argument[0]", "Argument[-1]", "value", "manual"]
+      - ["", "CStringT", True, "operator=", "(YCHAR)", "", "Argument[0]", "ReturnValue[*]", "value", "manual"]
+      - ["", "CStringT", True, "operator=", "(const VARIANT &)", "", "Argument[0]", "Argument[-1]", "value", "manual"]
+      - ["", "CStringT", True, "operator=", "(const VARIANT &)", "", "Argument[0]", "ReturnValue[*]", "value", "manual"]
+      - ["", "", True, "operator+", "(const CStringT &,const CStringT &)", "", "Argument[*0..1]", "ReturnValue", "taint", "manual"]
+      - ["", "", True, "operator+", "(const CStringT &,PCXSTR)", "", "Argument[*0..1]", "ReturnValue", "taint", "manual"]
+      - ["", "", True, "operator+", "(PCXSTR,const CStringT &)", "", "Argument[*0..1]", "ReturnValue", "taint", "manual"]
+      - ["", "", True, "operator+", "(char,const CStringT &)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
+      - ["", "", True, "operator+", "(char,const CStringT &)", "", "Argument[*1]", "ReturnValue", "taint", "manual"]
+      - ["", "", True, "operator+", "(const CStringT &,char)", "", "Argument[*0]", "ReturnValue", "taint", "manual"]
+      - ["", "", True, "operator+", "(const CStringT &,char)", "", "Argument[1]", "ReturnValue", "taint", "manual"]
+      - ["", "", True, "operator+", "(const CStringT &,wchar_t)", "", "Argument[*0]", "ReturnValue", "taint", "manual"]
+      - ["", "", True, "operator+", "(const CStringT &,wchar_t)", "", "Argument[1]", "ReturnValue", "taint", "manual"]
+      - ["", "", True, "operator+", "(wchar_t, const CStringT &)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
+      - ["", "", True, "operator+", "(wchar_t,const CStringT &)", "", "Argument[*1]", "ReturnValue", "taint", "manual"]
+      - ["", "", True, "operator+=", "(const CSimpleStringT &)", "", "Argument[*0]", "ReturnValue[*]", "taint", "manual"]
+      - ["", "", True, "operator+=", "(const CSimpleStringT &)", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
+      - ["", "", True, "operator+=", "(const CSimpleStringT &)", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["", "", True, "operator+=", "(const CStaticString &)", "", "Argument[*0]", "ReturnValue[*]", "taint", "manual"]
+      - ["", "", True, "operator+=", "(const CStaticString &)", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
+      - ["", "", True, "operator+=", "(const CStaticString &)", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["", "", True, "operator+=", "(PCXSTR)", "", "Argument[*0]", "ReturnValue[*]", "taint", "manual"]
+      - ["", "", True, "operator+=", "(PCXSTR)", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
+      - ["", "", True, "operator+=", "(PCXSTR)", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["", "", True, "operator+=", "(PCYSTR)", "", "Argument[*0]", "ReturnValue[*]", "taint", "manual"]
+      - ["", "", True, "operator+=", "(PCYSTR)", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
+      - ["", "", True, "operator+=", "(PCYSTR)", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["", "", True, "operator+=", "(char)", "", "Argument[0]", "ReturnValue[*]", "taint", "manual"]
+      - ["", "", True, "operator+=", "(char)", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
+      - ["", "", True, "operator+=", "(char)", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["", "", True, "operator+=", "(unsigned char)", "", "Argument[0]", "ReturnValue[*]", "taint", "manual"]
+      - ["", "", True, "operator+=", "(unsigned char)", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
+      - ["", "", True, "operator+=", "(unsigned char)", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["", "", True, "operator+=", "(wchar_t)", "", "Argument[0]", "ReturnValue[*]", "taint", "manual"]
+      - ["", "", True, "operator+=", "(wchar_t)", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
+      - ["", "", True, "operator+=", "(wchar_t)", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["", "", True, "operator+=", "(const VARIANT &)", "", "Argument[0]", "ReturnValue[*]", "taint", "manual"]
+      - ["", "", True, "operator+=", "(const VARIANT &)", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
+      - ["", "", True, "operator+=", "(const VARIANT &)", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
--- a/cpp/ql/lib/ext/CUrl.model.yml
+++ b/cpp/ql/lib/ext/CUrl.model.yml
@@ -18,4 +18,5 @@ extensions:
      - ["", "CUrl", True, "SetSchemeName", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
      - ["", "CUrl", True, "SetUrlPath", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
      - ["", "CUrl", True, "SetUserName", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
-      - ["", "CUrl", True, "operator=", "", "", "Argument[*0]", "Argument[-1]", "value", "manual"]
+      - ["", "CUrl", True, "operator=", "", "", "Argument[*0]", "Argument[-1]", "value", "manual"]
+      - ["", "CUrl", True, "operator=", "", "", "Argument[*0]", "ReturnValue[*]", "value", "manual"]
--- a/cpp/ql/lib/ext/bsl.deque.model.yml
+++ b/cpp/ql/lib/ext/bsl.deque.model.yml
@@ -53,6 +53,7 @@ extensions:
      - ["bsl", "deque", True, "insert<InputIt>", "(const_iterator,InputIt,InputIt)", "", "Argument[1].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
      - ["bsl", "deque", True, "insert<InputIt>", "(const_iterator,InputIt,InputIt)", "", "Argument[1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
      - ["bsl", "deque", True, "operator=", "", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
+      - ["bsl", "deque", True, "operator=", "", "", "Argument[*0].Element[@]", "ReturnValue[*].Element[@]", "value", "manual"]
      - ["bsl", "deque", True, "operator[]", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
      - ["bsl", "deque", True, "push_back", "", "", "Argument[*@0]", "Argument[-1].Element[@]", "value", "manual"]
      - ["bsl", "deque", True, "push_front", "", "", "Argument[*@0]", "Argument[-1].Element[@]", "value", "manual"]
--- a/cpp/ql/lib/ext/bsl.forward_list.model.yml
+++ b/cpp/ql/lib/ext/bsl.forward_list.model.yml
@@ -40,6 +40,7 @@ extensions:
      - ["bsl", "forward_list", True, "insert_after<InputIt>", "(const_iterator,InputIt,InputIt)", "", "Argument[1].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
      - ["bsl", "forward_list", True, "insert_after<InputIt>", "(const_iterator,InputIt,InputIt)", "", "Argument[1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
      - ["bsl", "forward_list", True, "operator=", "", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
+      - ["bsl", "forward_list", True, "operator=", "", "", "Argument[*0].Element[@]", "ReturnValue[*].Element[@]", "value", "manual"]
      - ["bsl", "forward_list", True, "push_front", "", "", "Argument[*@0]", "Argument[-1].Element[@]", "value", "manual"]
      - ["bsl", "forward_list", True, "rbegin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
      - ["bsl", "forward_list", True, "rcbegin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
--- a/cpp/ql/lib/ext/bsl.list.model.yml
+++ b/cpp/ql/lib/ext/bsl.list.model.yml
@@ -52,6 +52,7 @@ extensions:
      - ["bsl", "list", True, "list", "(const list &)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
      - ["bsl", "list", True, "list", "(list &&)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
      - ["bsl", "list", True, "operator=", "", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
+      - ["bsl", "list", True, "operator=", "", "", "Argument[*0].Element[@]", "ReturnValue[*].Element[@]", "value", "manual"]
      - ["bsl", "list", True, "push_back", "", "", "Argument[*@0]", "Argument[-1].Element[@]", "value", "manual"]
      - ["bsl", "list", True, "push_front", "", "", "Argument[*@0]", "Argument[-1].Element[@]", "value", "manual"]
      - ["bsl", "list", True, "rbegin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
--- a/cpp/ql/lib/ext/bsl.vector.model.yml
+++ b/cpp/ql/lib/ext/bsl.vector.model.yml
@@ -39,6 +39,7 @@ extensions:
      - ["bsl", "vector", True, "insert<InputIt>", "(const_iterator,InputIt,InputIt)", "", "Argument[1].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
      - ["bsl", "vector", True, "insert<InputIt>", "(const_iterator,InputIt,InputIt)", "", "Argument[1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
      - ["bsl", "vector", True, "operator=", "", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
+      - ["bsl", "vector", True, "operator=", "", "", "Argument[*0].Element[@]", "ReturnValue[*].Element[@]", "value", "manual"]
      - ["bsl", "vector", True, "operator[]", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
      - ["bsl", "vector", True, "push_back", "", "", "Argument[*@0]", "Argument[-1].Element[@]", "value", "manual"]
      - ["bsl", "vector", True, "rbegin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
--- a/cpp/ql/lib/ext/std.deque.model.yml
+++ b/cpp/ql/lib/ext/std.deque.model.yml
@@ -53,6 +53,7 @@ extensions:
      - ["std", "deque", True, "insert<InputIt>", "(const_iterator,InputIt,InputIt)", "", "Argument[1].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
      - ["std", "deque", True, "insert<InputIt>", "(const_iterator,InputIt,InputIt)", "", "Argument[1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
      - ["std", "deque", True, "operator=", "", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
+      - ["std", "deque", True, "operator=", "", "", "Argument[*0].Element[@]", "ReturnValue[*].Element[@]", "value", "manual"]
      - ["std", "deque", True, "operator[]", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
      - ["std", "deque", True, "push_back", "", "", "Argument[*@0]", "Argument[-1].Element[@]", "value", "manual"]
      - ["std", "deque", True, "push_front", "", "", "Argument[*@0]", "Argument[-1].Element[@]", "value", "manual"]
--- a/cpp/ql/lib/ext/std.forward_list.model.yml
+++ b/cpp/ql/lib/ext/std.forward_list.model.yml
@@ -40,6 +40,7 @@ extensions:
      - ["std", "forward_list", True, "insert_after<InputIt>", "(const_iterator,InputIt,InputIt)", "", "Argument[1].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
      - ["std", "forward_list", True, "insert_after<InputIt>", "(const_iterator,InputIt,InputIt)", "", "Argument[1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
      - ["std", "forward_list", True, "operator=", "", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
+      - ["std", "forward_list", True, "operator=", "", "", "Argument[*0].Element[@]", "ReturnValue[*].Element[@]", "value", "manual"]
      - ["std", "forward_list", True, "push_front", "", "", "Argument[*@0]", "Argument[-1].Element[@]", "value", "manual"]
      - ["std", "forward_list", True, "rbegin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
      - ["std", "forward_list", True, "rcbegin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
--- a/cpp/ql/lib/ext/std.list.model.yml
+++ b/cpp/ql/lib/ext/std.list.model.yml
@@ -52,6 +52,7 @@ extensions:
      - ["std", "list", True, "list", "(const list &)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
      - ["std", "list", True, "list", "(list &&)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
      - ["std", "list", True, "operator=", "", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
+      - ["std", "list", True, "operator=", "", "", "Argument[*0].Element[@]", "ReturnValue[*].Element[@]", "value", "manual"]
      - ["std", "list", True, "push_back", "", "", "Argument[*@0]", "Argument[-1].Element[@]", "value", "manual"]
      - ["std", "list", True, "push_front", "", "", "Argument[*@0]", "Argument[-1].Element[@]", "value", "manual"]
      - ["std", "list", True, "rbegin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
--- a/cpp/ql/lib/ext/std.vector.model.yml
+++ b/cpp/ql/lib/ext/std.vector.model.yml
@@ -39,6 +39,7 @@ extensions:
      - ["std", "vector", True, "insert<InputIt>", "(const_iterator,InputIt,InputIt)", "", "Argument[1].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
      - ["std", "vector", True, "insert<InputIt>", "(const_iterator,InputIt,InputIt)", "", "Argument[1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
      - ["std", "vector", True, "operator=", "", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
+      - ["std", "vector", True, "operator=", "", "", "Argument[*0].Element[@]", "ReturnValue[*].Element[@]", "value", "manual"]
      - ["std", "vector", True, "operator[]", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
      - ["std", "vector", True, "push_back", "", "", "Argument[*@0]", "Argument[-1].Element[@]", "value", "manual"]
      - ["std", "vector", True, "rbegin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
--- a/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
@@ -491,6 +491,10 @@ string getParameterTypeWithoutTemplateArguments(Function f, int n) {
    parseAngles(s, base, _, specifiers) and
    result = base + specifiers
  )
+  or
+  f.isVarargs() and
+  n = f.getNumberOfParameters() and
+  result = "..."
 }

 /**
--- a/cpp/ql/test/library-tests/dataflow/external-models/flow.expected
+++ b/cpp/ql/test/library-tests/dataflow/external-models/flow.expected
@@ -10,14 +10,14 @@ edges
 | asio_streams.cpp:100:44:100:62 | call to buffer | asio_streams.cpp:103:29:103:39 | *send_buffer | provenance | Sink:MaD:6 |
 | asio_streams.cpp:100:64:100:71 | *send_str | asio_streams.cpp:56:18:56:23 | [summary param] *0 in buffer | provenance |  |
 | asio_streams.cpp:100:64:100:71 | *send_str | asio_streams.cpp:100:44:100:62 | call to buffer | provenance | MaD:10 |
-| test.cpp:4:5:4:11 | [summary param] 0 in ymlStep | test.cpp:4:5:4:11 | [summary] to write: ReturnValue in ymlStep | provenance | MaD:801 |
-| test.cpp:7:10:7:18 | call to ymlSource | test.cpp:7:10:7:18 | call to ymlSource | provenance | Src:MaD:799  |
-| test.cpp:7:10:7:18 | call to ymlSource | test.cpp:11:10:11:10 | x | provenance | Sink:MaD:800 |
+| test.cpp:4:5:4:11 | [summary param] 0 in ymlStep | test.cpp:4:5:4:11 | [summary] to write: ReturnValue in ymlStep | provenance | MaD:966 |
+| test.cpp:7:10:7:18 | call to ymlSource | test.cpp:7:10:7:18 | call to ymlSource | provenance | Src:MaD:964  |
+| test.cpp:7:10:7:18 | call to ymlSource | test.cpp:11:10:11:10 | x | provenance | Sink:MaD:965 |
 | test.cpp:7:10:7:18 | call to ymlSource | test.cpp:13:18:13:18 | x | provenance |  |
 | test.cpp:13:10:13:16 | call to ymlStep | test.cpp:13:10:13:16 | call to ymlStep | provenance |  |
-| test.cpp:13:10:13:16 | call to ymlStep | test.cpp:15:10:15:10 | y | provenance | Sink:MaD:800 |
+| test.cpp:13:10:13:16 | call to ymlStep | test.cpp:15:10:15:10 | y | provenance | Sink:MaD:965 |
 | test.cpp:13:18:13:18 | x | test.cpp:4:5:4:11 | [summary param] 0 in ymlStep | provenance |  |
-| test.cpp:13:18:13:18 | x | test.cpp:13:10:13:16 | call to ymlStep | provenance | MaD:801 |
+| test.cpp:13:18:13:18 | x | test.cpp:13:10:13:16 | call to ymlStep | provenance | MaD:966 |
 nodes
 | asio_streams.cpp:56:18:56:23 | [summary param] *0 in buffer | semmle.label | [summary param] *0 in buffer |
 | asio_streams.cpp:56:18:56:23 | [summary] to write: ReturnValue in buffer | semmle.label | [summary] to write: ReturnValue in buffer |
--- a/cpp/ql/test/library-tests/dataflow/external-models/validatemodels.expected
+++ b/cpp/ql/test/library-tests/dataflow/external-models/validatemodels.expected
@@ -5,8 +5,10 @@
 | Dubious member name "operator LPSTR" in summary model. |
 | Dubious member name "operator LPWSTR" in summary model. |
 | Dubious member name "operator PCXSTR" in summary model. |
+| Dubious member name "operator PXSTR" in summary model. |
 | Dubious member name "operator&" in summary model. |
 | Dubious member name "operator*" in summary model. |
+| Dubious member name "operator+" in summary model. |
 | Dubious member name "operator+=" in summary model. |
 | Dubious member name "operator->" in summary model. |
 | Dubious member name "operator=" in summary model. |
@@ -16,19 +18,45 @@
 | Dubious signature "(CRegKey &)" in summary model. |
 | Dubious signature "(DWORD &,LPCTSTR)" in summary model. |
 | Dubious signature "(InputIterator,InputIterator,const Allocator &)" in summary model. |
+| Dubious signature "(LPCSTR,IAtlStringMgr *)" in summary model. |
 | Dubious signature "(LPCTSTR,DWORD *,void *,ULONG *)" in summary model. |
+| Dubious signature "(LPCWSTR,IAtlStringMgr *)" in summary model. |
 | Dubious signature "(LPTSTR,LPCTSTR,DWORD *)" in summary model. |
+| Dubious signature "(PCXSTR,IAtlStringMgr *)" in summary model. |
+| Dubious signature "(PCXSTR,const CStringT &)" in summary model. |
+| Dubious signature "(XCHAR *,const XCHAR *,int)" in summary model. |
+| Dubious signature "(XCHAR *,size_t,const XCHAR *,int)" in summary model. |
+| Dubious signature "(char *)" in summary model. |
+| Dubious signature "(char,const CStringT &)" in summary model. |
 | Dubious signature "(const CComBSTR &)" in summary model. |
 | Dubious signature "(const CComSafeArray &)" in summary model. |
+| Dubious signature "(const CSimpleStringT &)" in summary model. |
+| Dubious signature "(const CStaticString &)" in summary model. |
+| Dubious signature "(const CStringT &)" in summary model. |
+| Dubious signature "(const CStringT &,PCXSTR)" in summary model. |
+| Dubious signature "(const CStringT &,char)" in summary model. |
+| Dubious signature "(const CStringT &,const CStringT &)" in summary model. |
+| Dubious signature "(const CStringT &,wchar_t)" in summary model. |
 | Dubious signature "(const SAFEARRAY &)" in summary model. |
 | Dubious signature "(const SAFEARRAY *)" in summary model. |
 | Dubious signature "(const T &,BOOL)" in summary model. |
+| Dubious signature "(const VARIANT &)" in summary model. |
+| Dubious signature "(const VARIANT &,IAtlStringMgr *)" in summary model. |
+| Dubious signature "(const XCHAR *)" in summary model. |
+| Dubious signature "(const XCHAR *,int)" in summary model. |
+| Dubious signature "(const XCHAR *,int,AtlStringMgr *)" in summary model. |
+| Dubious signature "(const XCHAR *,int,IAtlStringMgr *)" in summary model. |
+| Dubious signature "(const YCHAR *)" in summary model. |
+| Dubious signature "(const YCHAR *,int)" in summary model. |
+| Dubious signature "(const YCHAR *,int,IAtlStringMgr *)" in summary model. |
 | Dubious signature "(const deque &)" in summary model. |
 | Dubious signature "(const deque &,const Allocator &)" in summary model. |
 | Dubious signature "(const forward_list &)" in summary model. |
 | Dubious signature "(const forward_list &,const Allocator &)" in summary model. |
 | Dubious signature "(const list &)" in summary model. |
 | Dubious signature "(const list &,const Allocator &)" in summary model. |
+| Dubious signature "(const unsigned char *)" in summary model. |
+| Dubious signature "(const unsigned char *,IAtlStringMgr *)" in summary model. |
 | Dubious signature "(const vector &)" in summary model. |
 | Dubious signature "(const vector &,const Allocator &)" in summary model. |
 | Dubious signature "(const_iterator,T &&)" in summary model. |
@@ -43,5 +71,10 @@
 | Dubious signature "(list &&,const Allocator &)" in summary model. |
 | Dubious signature "(size_type,const T &)" in summary model. |
 | Dubious signature "(size_type,const T &,const Allocator &)" in summary model. |
+| Dubious signature "(unsigned char *)" in summary model. |
+| Dubious signature "(unsigned char)" in summary model. |
 | Dubious signature "(vector &&)" in summary model. |
 | Dubious signature "(vector &&,const Allocator &)" in summary model. |
+| Dubious signature "(wchar_t *)" in summary model. |
+| Dubious signature "(wchar_t, const CStringT &)" in summary model. |
+| Dubious signature "(wchar_t,const CStringT &)" in summary model. |
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/atl.cpp
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/atl.cpp
@@ -11,6 +11,7 @@ typedef void* PVOID;
 typedef bool BOOL;
 typedef char* PSTR, *LPSTR;
 typedef const char* LPCTSTR;
+typedef const wchar_t* LPCWSTR;
 typedef unsigned short WORD;
 typedef unsigned long DWORD;
 typedef void* HANDLE;
@@ -897,4 +898,345 @@ void test_CUrl() {
    url2.SetUserName(x);
    sink(url2); // $ ir
  }
+}
+
+struct IAtlStringMgr {}; // simplified
+
+using XCHAR = char;
+using YCHAR = wchar_t;
+
+template <typename BaseType>
+struct CSimpleStringT {
+  using PCXSTR = const BaseType*; // simplified
+  using PXSTR = BaseType*; // simplified
+
+  CSimpleStringT() throw();
+  CSimpleStringT(const XCHAR* pchSrc, int nLength, IAtlStringMgr* pStringMgr);
+  CSimpleStringT(PCXSTR pszSrc, IAtlStringMgr* pStringMgr);
+  CSimpleStringT(const CSimpleStringT& strSrc);
+
+  ~CSimpleStringT() throw();
+
+  void Append(const CSimpleStringT& strSrc);
+  void Append(PCXSTR pszSrc, int nLength);
+  void Append(PCXSTR pszSrc);
+
+  void AppendChar(XCHAR ch);
+
+  static void CopyChars(XCHAR* pchDest, const XCHAR* pchSrc, int nChars) throw();
+  static void CopyChars(XCHAR* pchDest, size_t nDestLen, const XCHAR* pchSrc, int nChars) throw();
+  static void CopyCharsOverlapped(XCHAR* pchDest, const XCHAR* pchSrc, int nChars) throw();
+
+  XCHAR GetAt(int iChar) const;
+  PXSTR GetBuffer(int nMinBufferLength);
+  PXSTR GetBuffer();
+  PXSTR GetBufferSetLength(int nLength);
+
+  PCXSTR GetString() const throw();
+  PXSTR LockBuffer();
+  void SetAt(int iChar, XCHAR ch);
+  void SetString(PCXSTR pszSrc, int nLength);
+  void SetString(PCXSTR pszSrc);
+  operator PCXSTR() const throw();
+  XCHAR operator[](int iChar) const;
+
+  CSimpleStringT& operator+=(PCXSTR pszSrc);
+  CSimpleStringT& operator+=(const CSimpleStringT& strSrc);
+  CSimpleStringT& operator+=(char ch);
+  CSimpleStringT& operator+=(unsigned char ch);
+  CSimpleStringT& operator+=(wchar_t ch);
+
+  CSimpleStringT& operator=(PCXSTR pszSrc);
+  CSimpleStringT& operator=(const CSimpleStringT& strSrc);
+};
+
+void test_CSimpleStringT() {
+  char* x = indirect_source<char>();
+
+  CSimpleStringT<char> s1(x, 10, nullptr);
+  sink(s1.GetString()); // $ ir
+
+  CSimpleStringT<char> s2(x, nullptr);
+  sink(s2.GetString()); // $ ir
+
+  CSimpleStringT<char> s3(s2);
+  sink(s3.GetString()); // $ ir
+
+  CSimpleStringT<char> s4;
+  s4.Append(indirect_source<char>());
+  sink(s4.GetString()); // $ ir
+
+  CSimpleStringT<char> s5;
+  s5.Append(s4);
+  sink(s5.GetString()); // $ ir
+
+  CSimpleStringT<char> s6;
+  s6.Append(indirect_source<char>(), 42);
+  sink(s6.GetString()); // $ ir
+
+  char buffer1[128];
+  CSimpleStringT<char>::CopyChars(buffer1, x, 10);
+  sink(buffer1); // $ ast ir
+
+  char buffer2[128];
+  CSimpleStringT<char>::CopyChars(buffer2, 128, x, 10);
+  sink(buffer2); // $ ast ir
+
+  char buffer3[128];
+  CSimpleStringT<char>::CopyCharsOverlapped(buffer3, x, 10);
+  sink(buffer3); // $ ast ir
+
+  sink(s4.GetAt(0)); // $ ir
+  sink(s4.GetBuffer(10)); // $ ir
+  sink(s4.GetBuffer()); // $ ir
+  sink(s4.GetBufferSetLength(10)); // $ ir
+
+  sink(s4.LockBuffer()); // $ ir
+
+  CSimpleStringT<char> s7;
+  s7.SetAt(0, source<char>());
+  sink(s7.GetAt(0)); // $ ir
+
+  CSimpleStringT<char> s8;
+  s8.SetString(indirect_source<char>());
+  sink(s8.GetAt(0)); // $ ir
+
+  CSimpleStringT<char> s9;
+  s9.SetString(indirect_source<char>(), 1024);
+  sink(s9.GetAt(0)); // $ ir
+
+  sink(static_cast<CSimpleStringT<char>::PCXSTR>(s1)); // $ ir
+  
+  sink(s1[0]); // $ ir
+}
+
+template<typename T>
+struct MakeOther {};
+
+template<>
+struct MakeOther<char> {
+  using other_t = wchar_t;
+};
+
+template<>
+struct MakeOther<wchar_t> {
+  using other_t = char;
+};
+
+template<typename BaseType>
+struct CStringT : public CSimpleStringT<BaseType> {
+  using XCHAR = BaseType; // simplified
+  using YCHAR = typename MakeOther<BaseType>::other_t; // simplified
+  using PCXSTR = typename CSimpleStringT<BaseType>::PCXSTR;
+  using PXSTR = typename CSimpleStringT<BaseType>::PXSTR;
+  CStringT() throw();
+
+  CStringT(IAtlStringMgr* pStringMgr) throw();
+  CStringT(const VARIANT& varSrc);
+  CStringT(const VARIANT& varSrc, IAtlStringMgr* pStringMgr);
+  CStringT(const CStringT& strSrc);
+  CStringT(const CSimpleStringT<BaseType>& strSrc);
+  CStringT(const XCHAR* pszSrc);
+  CStringT(const YCHAR* pszSrc);
+  CStringT(LPCSTR pszSrc, IAtlStringMgr* pStringMgr);
+  CStringT(LPCWSTR pszSrc, IAtlStringMgr* pStringMgr);
+  CStringT(const unsigned char* pszSrc);
+  CStringT(char* pszSrc);
+  CStringT(unsigned char* pszSrc);
+  CStringT(wchar_t* pszSrc);
+  CStringT(const unsigned char* pszSrc, IAtlStringMgr* pStringMgr);
+  CStringT(char ch, int nLength = 1);
+  CStringT(wchar_t ch, int nLength = 1);
+  CStringT(const XCHAR* pch, int nLength);
+  CStringT(const YCHAR* pch, int nLength);
+  CStringT(const XCHAR* pch, int nLength, IAtlStringMgr* pStringMgr);
+  CStringT(const YCHAR* pch, int nLength, IAtlStringMgr* pStringMgr);
+
+  operator CSimpleStringT<BaseType> &();
+
+  ~CStringT() throw();
+
+  BSTR AllocSysString() const;
+  void AppendFormat(PCXSTR pszFormat, ...);
+  void AppendFormat(UINT nFormatID, ...);
+  int Delete(int iIndex, int nCount = 1);
+  int Find(PCXSTR pszSub, int iStart=0) const throw();
+  int Find(XCHAR ch, int iStart=0) const throw();
+  int FindOneOf(PCXSTR pszCharSet) const throw();
+  void Format(UINT nFormatID, ...);
+  void Format(PCXSTR pszFormat, ...);
+  BOOL GetEnvironmentVariable(PCXSTR pszVar);
+  int Insert(int iIndex, PCXSTR psz);
+  int Insert(int iIndex, XCHAR ch);
+  CStringT Left(int nCount) const;
+  BOOL LoadString(HINSTANCE hInstance, UINT nID, WORD wLanguageID);
+  BOOL LoadString(HINSTANCE hInstance, UINT nID);
+  BOOL LoadString(UINT nID);
+  CStringT& MakeLower();
+  CStringT& MakeReverse();
+  CStringT& MakeUpper();
+  CStringT Mid(int iFirst, int nCount) const;
+  CStringT Mid(int iFirst) const;
+  int Replace(PCXSTR pszOld, PCXSTR pszNew);
+  int Replace(XCHAR chOld, XCHAR chNew);
+  CStringT Right(int nCount) const;
+  BSTR SetSysString(BSTR* pbstr) const;
+  CStringT SpanExcluding(PCXSTR pszCharSet) const;
+  CStringT SpanIncluding(PCXSTR pszCharSet) const;
+  CStringT Tokenize(PCXSTR pszTokens, int& iStart) const;
+  CStringT& Trim(XCHAR chTarget);
+  CStringT& Trim(PCXSTR pszTargets);
+  CStringT& Trim();
+  CStringT& TrimLeft(XCHAR chTarget);
+  CStringT& TrimLeft(PCXSTR pszTargets);
+  CStringT& TrimLeft();
+  CStringT& TrimRight(XCHAR chTarget);
+  CStringT& TrimRight(PCXSTR pszTargets);
+  CStringT& TrimRight();
+};
+
+void test_CStringT() {
+  VARIANT v = source<VARIANT>();
+
+  CStringT<char> s1(v);
+  sink(s1.GetString()); // $ ir
+
+  CStringT<char> s2(v, nullptr);
+  sink(s2.GetString()); // $ ir
+
+  CStringT<char> s3(s2);
+  sink(s3.GetString()); // $ ir
+
+  char* x = indirect_source<char>();
+  CStringT<char> s4(x);
+  sink(s4.GetString()); // $ ir
+
+  wchar_t* y = indirect_source<wchar_t>();
+  CStringT<wchar_t> s5(y);
+  sink(s5.GetString()); // $ ir
+
+  CStringT<char> s6(x, nullptr);
+  sink(s6.GetString()); // $ ir
+
+  CStringT<wchar_t> s7(y, nullptr);
+  sink(s7.GetString()); // $ ir
+
+  unsigned char* ucs = indirect_source<unsigned char>();
+  CStringT<char> s8(ucs);
+  sink(s8.GetString()); // $ ir
+
+  char c = source<char>();
+  CStringT<char> s9(c);
+  sink(s9.GetString()); // $ ir
+
+  wchar_t wc = source<wchar_t>();
+  CStringT<wchar_t> s10(wc);
+  sink(s10.GetString()); // $ ir
+
+  sink(static_cast<CSimpleStringT<char>&>(s1)); // $ ast ir
+
+  auto bstr = s1.AllocSysString();
+  sink(bstr); // $ ir
+
+  CStringT<char> s11;
+  s11.AppendFormat("%d", source<int>());
+  sink(s11.GetString()); // $ ir
+
+  CStringT<char> s12;
+  s12.AppendFormat(indirect_source<char>());
+  sink(s12.GetString()); // $ ir
+
+  CStringT<char> s13;
+  s13.AppendFormat(source<UINT>());
+  sink(s13.GetString()); // $ ir
+
+  CStringT<char> s14;
+  s14.AppendFormat(42, source<char>());
+  sink(s14.GetString()); // $ ir
+
+  CStringT<char> s15;
+  s15.AppendFormat(42, indirect_source<char>());
+  sink(s15.GetString()); // $ ir
+
+  CStringT<char> s16;
+  s16.AppendFormat("%s", indirect_source<char>());
+
+  CStringT<char> s17;
+  s17.Insert(0, x);
+  sink(s17.GetString()); // $ ir
+
+  CStringT<char> s18;
+  s18.Insert(0, source<char>());
+  sink(s18.GetString()); // $ ir
+
+  sink(s1.Left(42).GetString()); // $ ir
+
+  CStringT<char> s20;
+  s20.LoadString(source<UINT>());
+  sink(s20.GetString()); // $ ir
+
+  sink(s1.MakeLower().GetString()); // $ ir
+  sink(s1.MakeReverse().GetString()); // $ ir
+  sink(s1.MakeUpper().GetString()); // $ ir
+  sink(s1.Mid(0, 42).GetString()); // $ ir
+
+  CStringT<char> s21;
+  s21.Replace("abc", x);
+  sink(s21.GetString()); // $ ir
+
+  CStringT<char> s22;
+  s22.Replace('\n', source<char>());
+  sink(s22.GetString()); // $ ir
+
+  sink(s2.Right(42).GetString()); // $ ir
+
+  BSTR bstr2;
+  s1.SetSysString(&bstr2);
+  sink(bstr2); // $ ast ir
+
+  sink(s1.SpanExcluding("abc").GetString()); // $ ir
+  sink(s1.SpanIncluding("abc").GetString()); // $ ir
+  
+  int start = 0;
+  sink(s1.Tokenize("abc", start).GetString()); // $ ir
+
+  sink(s1.Trim('a').GetString()); // $ ir
+  sink(s1.Trim("abc").GetString()); // $ ir
+  sink(s1.Trim().GetString()); // $ ir
+  sink(s1.TrimLeft('a').GetString()); // $ ir
+  sink(s1.TrimLeft("abc").GetString()); // $ ir
+  sink(s1.TrimLeft().GetString()); // $ ir
+  sink(s1.TrimRight('a').GetString()); // $ ir
+  sink(s1.TrimRight("abc").GetString()); // $ ir
+  sink(s1.TrimRight().GetString()); // $ ir
+}
+
+struct CStringData {
+  void* data() throw();
+};
+
+void test_CStringData() {
+  CStringData d = source<CStringData>();
+  sink(d.data()); // $ ir
+}
+
+template<typename TCharType>
+struct CStrBufT {
+  typedef CSimpleStringT<TCharType> StringType;
+
+  using PCXSTR = typename StringType::PCXSTR;
+  using PXSTR = typename StringType::PXSTR;
+
+  CStrBufT(StringType& str, int nMinLength, DWORD dwFlags);
+  CStrBufT(StringType& str);
+
+  operator PCXSTR() const throw();
+  operator PXSTR() throw();
+};
+
+void test_CStrBufT() {
+  CStringT<char> s = source<CStringT<char>>();
+  CStrBufT<char> b(s, 42, 0);
+  sink(static_cast<CStrBufT<char>::PCXSTR>(b)); // $ ir
+  sink(static_cast<CStrBufT<char>::PXSTR>(b)); // $ ir
 }
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/test_mad-signatures.expected
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/test_mad-signatures.expected