Merge branch 'main' into missing-check-scanf-squashed

config/identical-files.json

@@ -462,9 +462,6 @@
   ],
   "SSA C#": [
     "csharp/ql/lib/semmle/code/csharp/dataflow/internal/SsaImplCommon.qll",
-    "csharp/ql/lib/semmle/code/csharp/controlflow/internal/pressa/SsaImplCommon.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/basessa/SsaImplCommon.qll",
-    "csharp/ql/lib/semmle/code/cil/internal/SsaImplCommon.qll",
     "ruby/ql/lib/codeql/ruby/dataflow/internal/SsaImplCommon.qll",
     "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaImplCommon.qll",
     "swift/ql/lib/codeql/swift/dataflow/internal/SsaImplCommon.qll"
@@ -584,22 +581,22 @@
   ],
   "Swift declarations test file": [
     "swift/ql/test/extractor-tests/declarations/declarations.swift",
-    "swift/ql/test/library-tests/parent/declarations.swift"
+    "swift/ql/test/library-tests/ast/declarations.swift"
   ],
   "Swift statements test file": [
     "swift/ql/test/extractor-tests/statements/statements.swift",
-    "swift/ql/test/library-tests/parent/statements.swift"
+    "swift/ql/test/library-tests/ast/statements.swift"
   ],
   "Swift expressions test file": [
     "swift/ql/test/extractor-tests/expressions/expressions.swift",
-    "swift/ql/test/library-tests/parent/expressions.swift"
+    "swift/ql/test/library-tests/ast/expressions.swift"
   ],
   "Swift patterns test file": [
     "swift/ql/test/extractor-tests/patterns/patterns.swift",
-    "swift/ql/test/library-tests/parent/patterns.swift"
+    "swift/ql/test/library-tests/ast/patterns.swift"
   ],
   "IncompleteMultiCharacterSanitization JS/Ruby": [
     "javascript/ql/lib/semmle/javascript/security/IncompleteMultiCharacterSanitizationQuery.qll",
     "ruby/ql/lib/codeql/ruby/security/IncompleteMultiCharacterSanitizationQuery.qll"
   ]
-}
+}

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaImplSpecific.qll

@@ -1,18 +0,0 @@
-private import semmle.code.cpp.ir.IR
-private import SsaInternals as Ssa
-
-class BasicBlock = IRBlock;
-
-class SourceVariable = Ssa::SourceVariable;
-
-BasicBlock getImmediateBasicBlockDominator(BasicBlock bb) { result.immediatelyDominates(bb) }
-
-BasicBlock getABasicBlockSuccessor(BasicBlock bb) { result = bb.getASuccessor() }
-
-class ExitBasicBlock extends IRBlock {
-  ExitBasicBlock() { this.getLastInstruction() instanceof ExitFunctionInstruction }
-}
-
-predicate variableWrite = Ssa::variableWrite/4;
-
-predicate variableRead = Ssa::variableRead/4;

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternals.qll

@@ -1,10 +1,10 @@
-import SsaImplCommon
 private import cpp as Cpp
 private import semmle.code.cpp.ir.IR
 private import DataFlowUtil
 private import DataFlowImplCommon as DataFlowImplCommon
 private import semmle.code.cpp.models.interfaces.Allocation as Alloc
 private import semmle.code.cpp.models.interfaces.DataFlow as DataFlow
+private import SsaImplCommon as SsaImplCommon
 
 private module SourceVariables {
   private newtype TSourceVariable =
@@ -38,8 +38,6 @@ private module SourceVariables {
   }
 }
 
-import SourceVariables
-
 cached
 private newtype TDefOrUse =
   TExplicitDef(Instruction store) { explicitWrite(_, store, _) } or
@@ -86,7 +84,7 @@ abstract class Def extends DefOrUse {
   Instruction getInstruction() { result = store }
 
   /** Gets the variable that is defined by this definition. */
-  abstract SourceVariable getSourceVariable();
+  abstract SourceVariables::SourceVariable getSourceVariable();
 
   /** Holds if this definition is guaranteed to happen. */
   abstract predicate isCertain();
@@ -103,10 +101,10 @@ abstract class Def extends DefOrUse {
 private class ExplicitDef extends Def, TExplicitDef {
   ExplicitDef() { this = TExplicitDef(store) }
 
-  override SourceVariable getSourceVariable() {
+  override SourceVariables::SourceVariable getSourceVariable() {
     exists(VariableInstruction var |
       explicitWrite(_, this.getInstruction(), var) and
-      result.(SourceIRVariable).getIRVariable() = var.getIRVariable()
+      result.(SourceVariables::SourceIRVariable).getIRVariable() = var.getIRVariable()
     )
   }
 
@@ -116,11 +114,11 @@ private class ExplicitDef extends Def, TExplicitDef {
 private class ParameterDef extends Def, TInitializeParam {
   ParameterDef() { this = TInitializeParam(store) }
 
-  override SourceVariable getSourceVariable() {
-    result.(SourceIRVariable).getIRVariable() =
+  override SourceVariables::SourceVariable getSourceVariable() {
+    result.(SourceVariables::SourceIRVariable).getIRVariable() =
       store.(InitializeParameterInstruction).getIRVariable()
     or
-    result.(SourceIRVariableIndirection).getUnderlyingIRVariable() =
+    result.(SourceVariables::SourceIRVariableIndirection).getUnderlyingIRVariable() =
       store.(InitializeIndirectionInstruction).getIRVariable()
   }
 
@@ -138,7 +136,7 @@ abstract class Use extends DefOrUse {
   override string toString() { result = "Use" }
 
   /** Gets the variable that is used by this use. */
-  abstract SourceVariable getSourceVariable();
+  abstract SourceVariables::SourceVariable getSourceVariable();
 
   override IRBlock getBlock() { result = use.getUse().getBlock() }
 
@@ -148,12 +146,14 @@ abstract class Use extends DefOrUse {
 private class ExplicitUse extends Use, TExplicitUse {
   ExplicitUse() { this = TExplicitUse(use) }
 
-  override SourceVariable getSourceVariable() {
+  override SourceVariables::SourceVariable getSourceVariable() {
     exists(VariableInstruction var |
       use.getDef() = var and
       if use.getUse() instanceof ReadSideEffectInstruction
-      then result.(SourceIRVariableIndirection).getUnderlyingIRVariable() = var.getIRVariable()
-      else result.(SourceIRVariable).getIRVariable() = var.getIRVariable()
+      then
+        result.(SourceVariables::SourceIRVariableIndirection).getUnderlyingIRVariable() =
+          var.getIRVariable()
+      else result.(SourceVariables::SourceIRVariable).getIRVariable() = var.getIRVariable()
     )
   }
 }
@@ -161,10 +161,11 @@ private class ExplicitUse extends Use, TExplicitUse {
 private class ReturnParameterIndirection extends Use, TReturnParamIndirection {
   ReturnParameterIndirection() { this = TReturnParamIndirection(use) }
 
-  override SourceVariable getSourceVariable() {
+  override SourceVariables::SourceVariable getSourceVariable() {
     exists(ReturnIndirectionInstruction ret |
       returnParameterIndirection(use, ret) and
-      result.(SourceIRVariableIndirection).getUnderlyingIRVariable() = ret.getIRVariable()
+      result.(SourceVariables::SourceIRVariableIndirection).getUnderlyingIRVariable() =
+        ret.getIRVariable()
     )
   }
 }
@@ -610,27 +611,45 @@ private module Cached {
 
 import Cached
 
-/**
- * Holds if the `i`'th write in block `bb` writes to the variable `v`.
- * `certain` is `true` if the write is guaranteed to overwrite the entire variable.
- */
-predicate variableWrite(IRBlock bb, int i, SourceVariable v, boolean certain) {
-  DataFlowImplCommon::forceCachingInSameStage() and
-  exists(Def def |
-    def.hasIndexInBlock(bb, i) and
-    v = def.getSourceVariable() and
-    (if def.isCertain() then certain = true else certain = false)
-  )
+private module SsaInput implements SsaImplCommon::InputSig {
+  private import semmle.code.cpp.ir.IR
+
+  class BasicBlock = IRBlock;
+
+  class SourceVariable = SourceVariables::SourceVariable;
+
+  BasicBlock getImmediateBasicBlockDominator(BasicBlock bb) { result.immediatelyDominates(bb) }
+
+  BasicBlock getABasicBlockSuccessor(BasicBlock bb) { result = bb.getASuccessor() }
+
+  class ExitBasicBlock extends IRBlock {
+    ExitBasicBlock() { this.getLastInstruction() instanceof ExitFunctionInstruction }
+  }
+
+  /**
+   * Holds if the `i`'th write in block `bb` writes to the variable `v`.
+   * `certain` is `true` if the write is guaranteed to overwrite the entire variable.
+   */
+  predicate variableWrite(BasicBlock bb, int i, SourceVariable v, boolean certain) {
+    DataFlowImplCommon::forceCachingInSameStage() and
+    exists(Def def |
+      def.hasIndexInBlock(bb, i) and
+      v = def.getSourceVariable() and
+      (if def.isCertain() then certain = true else certain = false)
+    )
+  }
+
+  /**
+   * Holds if the `i`'th read in block `bb` reads to the variable `v`.
+   * `certain` is `true` if the read is guaranteed. For C++, this is always the case.
+   */
+  predicate variableRead(BasicBlock bb, int i, SourceVariable v, boolean certain) {
+    exists(Use use |
+      use.hasIndexInBlock(bb, i) and
+      v = use.getSourceVariable() and
+      certain = true
+    )
+  }
 }
 
-/**
- * Holds if the `i`'th read in block `bb` reads to the variable `v`.
- * `certain` is `true` if the read is guaranteed. For C++, this is always the case.
- */
-predicate variableRead(IRBlock bb, int i, SourceVariable v, boolean certain) {
-  exists(Use use |
-    use.hasIndexInBlock(bb, i) and
-    v = use.getSourceVariable() and
-    certain = true
-  )
-}
+import SsaImplCommon::Make<SsaInput>

csharp/codeql-extractor.yml

@@ -35,3 +35,10 @@ options:
       the code (for example if it uses inaccessible dependencies).
     type: string
     pattern: "^(false|true)$"
+  cil:
+    title: Whether to enable CIL extraction.
+    description: >
+      A value indicating, whether CIL extraction should be enabled.
+      The default is 'true'.
+    type: string
+    pattern: "^(false|true)$"

csharp/documentation/library-coverage/coverage.csv

@@ -9,7 +9,7 @@ Microsoft.Extensions.Caching.Memory,,,46,,,,,,,,,,,,45,1
 Microsoft.Extensions.Configuration,,,83,,,,,,,,,,,,80,3
 Microsoft.Extensions.DependencyInjection,,,62,,,,,,,,,,,,62,
 Microsoft.Extensions.DependencyModel,,,12,,,,,,,,,,,,12,
-Microsoft.Extensions.FileProviders,,,15,,,,,,,,,,,,15,
+Microsoft.Extensions.FileProviders,,,16,,,,,,,,,,,,16,
 Microsoft.Extensions.FileSystemGlobbing,,,15,,,,,,,,,,,,13,2
 Microsoft.Extensions.Hosting,,,17,,,,,,,,,,,,16,1
 Microsoft.Extensions.Http,,,10,,,,,,,,,,,,10,
@@ -24,5 +24,5 @@ Microsoft.Win32,,,8,,,,,,,,,,,,8,
 MySql.Data.MySqlClient,48,,,,,,,,,,48,,,,,
 Newtonsoft.Json,,,91,,,,,,,,,,,,73,18
 ServiceStack,194,,7,27,,,,,,75,92,,,,7,
-System,43,4,11809,,1,1,1,,4,,33,3,1,3,9867,1942
+System,65,4,12081,,8,8,9,,4,,33,3,1,3,10139,1942
 Windows.Security.Cryptography.Core,1,,,,,,,1,,,,,,,,

csharp/documentation/library-coverage/coverage.rst

@@ -8,7 +8,7 @@ C# framework & library support
 
    Framework / library,Package,Flow sources,Taint & value steps,Sinks (total),`CWE-079` :sub:`Cross-site scripting`
    `ServiceStack <https://servicestack.net/>`_,"``ServiceStack.*``, ``ServiceStack``",,7,194,
-   System,"``System.*``, ``System``",4,11809,43,7
-   Others,"``Dapper``, ``JsonToItemsTaskFactory``, ``Microsoft.ApplicationBlocks.Data``, ``Microsoft.CSharp``, ``Microsoft.EntityFrameworkCore``, ``Microsoft.Extensions.Caching.Distributed``, ``Microsoft.Extensions.Caching.Memory``, ``Microsoft.Extensions.Configuration``, ``Microsoft.Extensions.DependencyInjection``, ``Microsoft.Extensions.DependencyModel``, ``Microsoft.Extensions.FileProviders``, ``Microsoft.Extensions.FileSystemGlobbing``, ``Microsoft.Extensions.Hosting``, ``Microsoft.Extensions.Http``, ``Microsoft.Extensions.Logging``, ``Microsoft.Extensions.Options``, ``Microsoft.Extensions.Primitives``, ``Microsoft.Interop``, ``Microsoft.NET.Build.Tasks``, ``Microsoft.NETCore.Platforms.BuildTasks``, ``Microsoft.VisualBasic``, ``Microsoft.Win32``, ``MySql.Data.MySqlClient``, ``Newtonsoft.Json``, ``Windows.Security.Cryptography.Core``",,554,138,
-   Totals,,4,12370,375,7
+   System,"``System.*``, ``System``",4,12081,65,7
+   Others,"``Dapper``, ``JsonToItemsTaskFactory``, ``Microsoft.ApplicationBlocks.Data``, ``Microsoft.CSharp``, ``Microsoft.EntityFrameworkCore``, ``Microsoft.Extensions.Caching.Distributed``, ``Microsoft.Extensions.Caching.Memory``, ``Microsoft.Extensions.Configuration``, ``Microsoft.Extensions.DependencyInjection``, ``Microsoft.Extensions.DependencyModel``, ``Microsoft.Extensions.FileProviders``, ``Microsoft.Extensions.FileSystemGlobbing``, ``Microsoft.Extensions.Hosting``, ``Microsoft.Extensions.Http``, ``Microsoft.Extensions.Logging``, ``Microsoft.Extensions.Options``, ``Microsoft.Extensions.Primitives``, ``Microsoft.Interop``, ``Microsoft.NET.Build.Tasks``, ``Microsoft.NETCore.Platforms.BuildTasks``, ``Microsoft.VisualBasic``, ``Microsoft.Win32``, ``MySql.Data.MySqlClient``, ``Newtonsoft.Json``, ``Windows.Security.Cryptography.Core``",,555,138,
+   Totals,,4,12643,397,7
 

csharp/downgrades/4ac7d8bcac6f664b1e83c858aa71f8dc761cc603/upgrade.properties

@@ -0,0 +1,2 @@
+description: Introduce '--cil' flag in the comments. This does not make any changes to the dbscheme.
+compatibility: full

csharp/extractor/Semmle.Extraction.CSharp.Driver/Driver.cs

@@ -18,14 +18,11 @@ namespace Semmle.Extraction.CSharp
             if (args.Length > 0 && args[0] == "--dotnetexec")
             {
                 var compilerRegEx = new Regex(@"csc\.exe|mcs\.exe|csc\.dll", RegexOptions.Compiled);
-                var cil = args.Length > 1 && args[1] == "--cil";
-                for (var i = cil ? 2 : 1; i < args.Length; i++)
+                for (var i = 1; i < args.Length; i++)
                 {
                     if (compilerRegEx.IsMatch(args[i]))
                     {
                         var argsList = new List<string>();
-                        if (cil)
-                            argsList.Add("--cil");
                         argsList.Add("--compiler");
                         argsList.Add(args[i]);
                         if (i + 1 < args.Length)

csharp/extractor/Semmle.Extraction.CSharp.Standalone/Program.cs

@@ -56,7 +56,6 @@ namespace Semmle.Extraction.CSharp.Standalone
             CSharp.Extractor.SetInvariantCulture();
 
             var options = Options.Create(args);
-            // options.CIL = true;  // To do: Enable this
 
             if (options.Help)
             {

csharp/extractor/Semmle.Extraction.Tests/Options.cs

@@ -22,7 +22,7 @@ namespace Semmle.Extraction.Tests
         {
             options = CSharp.Options.CreateWithEnvironment(Array.Empty<string>());
             Assert.True(options.Cache);
-            Assert.False(options.CIL);
+            Assert.True(options.CIL);
             Assert.Null(options.Framework);
             Assert.Null(options.CompilerName);
             Assert.Empty(options.CompilerArguments);
@@ -51,10 +51,20 @@ namespace Semmle.Extraction.Tests
         [Fact]
         public void CIL()
         {
-            options = CSharp.Options.CreateWithEnvironment(new string[] { "--cil" });
+            options = CSharp.Options.CreateWithEnvironment(Array.Empty<string>());
             Assert.True(options.CIL);
-            options = CSharp.Options.CreateWithEnvironment(new string[] { "--cil", "--nocil" });
+
+            Environment.SetEnvironmentVariable("CODEQL_EXTRACTOR_CSHARP_OPTION_CIL", "false");
+            options = CSharp.Options.CreateWithEnvironment(Array.Empty<string>());
             Assert.False(options.CIL);
+
+            Environment.SetEnvironmentVariable("CODEQL_EXTRACTOR_CSHARP_OPTION_CIL", "true");
+            options = CSharp.Options.CreateWithEnvironment(Array.Empty<string>());
+            Assert.True(options.CIL);
+
+            Environment.SetEnvironmentVariable("CODEQL_EXTRACTOR_CSHARP_OPTION_CIL", null);
+            options = CSharp.Options.CreateWithEnvironment(Array.Empty<string>());
+            Assert.True(options.CIL);
         }
 
         [Fact]
@@ -121,22 +131,6 @@ namespace Semmle.Extraction.Tests
             Assert.Equal("foo", options.Framework);
         }
 
-        [Fact]
-        public void EnvironmentVariables()
-        {
-            Environment.SetEnvironmentVariable("LGTM_INDEX_EXTRACTOR", "--cil c");
-            options = CSharp.Options.CreateWithEnvironment(new string[] { "a", "b" });
-            Assert.True(options.CIL);
-            Assert.Equal("a", options.CompilerArguments[0]);
-            Assert.Equal("b", options.CompilerArguments[1]);
-            Assert.Equal("c", options.CompilerArguments[2]);
-
-            Environment.SetEnvironmentVariable("LGTM_INDEX_EXTRACTOR", "");
-            Environment.SetEnvironmentVariable("LGTM_INDEX_EXTRACTOR", "--nocil");
-            options = CSharp.Options.CreateWithEnvironment(new string[] { "--cil" });
-            Assert.False(options.CIL);
-        }
-
         [Fact]
         public void StandaloneDefaults()
         {

csharp/extractor/Semmle.Extraction/Options.cs

@@ -28,7 +28,7 @@ namespace Semmle.Extraction
         /// <summary>
         /// Holds if CIL should be extracted.
         /// </summary>
-        public bool CIL { get; private set; } = false;
+        public bool CIL { get; private set; } = true;
 
         /// <summary>
         /// Holds if assemblies shouldn't be extracted twice.
@@ -50,7 +50,6 @@ namespace Semmle.Extraction
         /// </summary>
         public bool QlTest { get; private set; } = false;
 
-
         /// <summary>
         /// The compression algorithm used for trap files.
         /// </summary>
@@ -73,6 +72,9 @@ namespace Semmle.Extraction
                         return true;
                     }
                     return false;
+                case "cil":
+                    CIL = Boolean.Parse(value);
+                    return true;
                 default:
                     return false;
             }
@@ -97,9 +99,6 @@ namespace Semmle.Extraction
                 case "cache":
                     Cache = value;
                     return true;
-                case "cil":
-                    CIL = value;
-                    return true;
                 case "pdb":
                     PDB = value;
                     CIL = true;

csharp/extractor/Semmle.Util/CommandLineOptions.cs

@@ -17,7 +17,7 @@ namespace Semmle.Util
         bool HandleOption(string key, string value);
 
         /// <summary>
-        /// Handle a flag of the form "--cil" or "--nocil"
+        /// Handle a flag of the form "--cache" or "--nocache"
         /// </summary>
         /// <param name="key">The name of the flag. This is case sensitive.</param>
         /// <param name="value">True if set, or false if prefixed by "--no"</param>
@@ -40,6 +40,7 @@ namespace Semmle.Util
 
     public static class OptionsExtensions
     {
+        private static readonly string[] ExtractorOptions = new[] { "trap_compression", "cil" };
         private static string? GetExtractorOption(string name) =>
             Environment.GetEnvironmentVariable($"CODEQL_EXTRACTOR_CSHARP_OPTION_{name.ToUpper()}");
 
@@ -47,12 +48,14 @@ namespace Semmle.Util
         {
             var extractorOptions = new List<string>();
 
-            var trapCompression = GetExtractorOption("trap_compression");
-            if (!string.IsNullOrEmpty(trapCompression))
+            foreach (var option in ExtractorOptions)
             {
-                extractorOptions.Add($"--trap_compression:{trapCompression}");
+                var value = GetExtractorOption(option);
+                if (!string.IsNullOrEmpty(value))
+                {
+                    extractorOptions.Add($"--{option}:{value}");
+                }
             }
-
             return extractorOptions;
         }
 

csharp/ql/consistency-queries/SsaConsistency.ql

@@ -1,8 +1,8 @@
 import csharp
-import semmle.code.csharp.dataflow.internal.SsaImplCommon::Consistency
+import semmle.code.csharp.dataflow.internal.SsaImpl::Consistency as Consistency
 import Ssa
 
-class MyRelevantDefinition extends RelevantDefinition, Ssa::Definition {
+class MyRelevantDefinition extends Consistency::RelevantDefinition, Ssa::Definition {
   override predicate hasLocationInfo(
     string filepath, int startline, int startcolumn, int endline, int endcolumn
   ) {
@@ -10,6 +10,14 @@ class MyRelevantDefinition extends RelevantDefinition, Ssa::Definition {
   }
 }
 
+query predicate nonUniqueDef = Consistency::nonUniqueDef/4;
+
+query predicate readWithoutDef = Consistency::readWithoutDef/3;
+
+query predicate deadDef = Consistency::deadDef/2;
+
+query predicate notDominatedByDef = Consistency::notDominatedByDef/4;
+
 query predicate localDeclWithSsaDef(LocalVariableDeclExpr d) {
   // Local variables in C# must be initialized before every use, so uninitialized
   // local variables should not have an SSA definition, as that would imply that

csharp/ql/lib/semmle/code/cil/Ssa.qll

@@ -8,13 +8,12 @@ private import CIL
  * Provides classes for working with static single assignment (SSA) form.
  */
 module Ssa {
-  private import internal.SsaImplCommon as SsaImpl
-  private import internal.SsaImpl
+  private import internal.SsaImpl as SsaImpl
 
   /** An SSA definition. */
   class Definition extends SsaImpl::Definition {
     /** Gets a read of this SSA definition. */
-    final ReadAccess getARead() { result = getARead(this) }
+    final ReadAccess getARead() { result = SsaImpl::getARead(this) }
 
     /** Gets the underlying variable update, if any. */
     final VariableUpdate getVariableUpdate() {
@@ -25,11 +24,11 @@ module Ssa {
     }
 
     /** Gets a first read of this SSA definition. */
-    final ReadAccess getAFirstRead() { result = getAFirstRead(this) }
+    final ReadAccess getAFirstRead() { result = SsaImpl::getAFirstRead(this) }
 
     /** Holds if `first` and `second` are adjacent reads of this SSA definition. */
     final predicate hasAdjacentReads(ReadAccess first, ReadAccess second) {
-      hasAdjacentReads(this, first, second)
+      SsaImpl::hasAdjacentReads(this, first, second)
     }
 
     private Definition getAPhiInput() { result = this.(PhiNode).getAnInput() }
@@ -52,7 +51,7 @@ module Ssa {
     final override Location getLocation() { result = this.getBasicBlock().getLocation() }
 
     /** Gets an input to this phi node. */
-    final Definition getAnInput() { result = getAPhiInput(this) }
+    final Definition getAnInput() { result = SsaImpl::getAPhiInput(this) }
 
     /**
      * Holds if if `def` is an input to this phi node, and a reference to `def` at
@@ -60,7 +59,7 @@ module Ssa {
      * other references.
      */
     final predicate hasLastInputRef(Definition def, BasicBlock bb, int i) {
-      hasLastInputRef(this, def, bb, i)
+      SsaImpl::hasLastInputRef(this, def, bb, i)
     }
   }
 }

csharp/ql/lib/semmle/code/cil/internal/SsaImpl.qll

@@ -1,8 +1,40 @@
-private import semmle.code.cil.CIL
-private import SsaImplCommon
+private import cil
+private import semmle.code.csharp.dataflow.internal.SsaImplCommon as SsaImplCommon
+
+private module SsaInput implements SsaImplCommon::InputSig {
+  class BasicBlock = CIL::BasicBlock;
+
+  BasicBlock getImmediateBasicBlockDominator(BasicBlock bb) { result = bb.getImmediateDominator() }
+
+  BasicBlock getABasicBlockSuccessor(BasicBlock bb) { result = bb.getASuccessor() }
+
+  class ExitBasicBlock = CIL::ExitBasicBlock;
+
+  class SourceVariable = CIL::StackVariable;
+
+  predicate variableWrite(BasicBlock bb, int i, SourceVariable v, boolean certain) {
+    forceCachingInSameStage() and
+    exists(CIL::VariableUpdate vu |
+      vu.updatesAt(bb, i) and
+      v = vu.getVariable() and
+      certain = true
+    )
+  }
+
+  predicate variableRead(BasicBlock bb, int i, SourceVariable v, boolean certain) {
+    exists(CIL::ReadAccess ra | bb.getNode(i) = ra |
+      ra.getTarget() = v and
+      certain = true
+    )
+  }
+}
+
+import SsaImplCommon::Make<SsaInput>
 
 cached
 private module Cached {
+  private import CIL
+
   cached
   predicate forceCachingInSameStage() { any() }
 

csharp/ql/lib/semmle/code/cil/internal/SsaImplCommon.qll

@@ -1,795 +0,0 @@
-/**
- * Provides a language-independent implementation of static single assignment
- * (SSA) form.
- */
-
-private import SsaImplSpecific
-
-private BasicBlock getABasicBlockPredecessor(BasicBlock bb) { getABasicBlockSuccessor(result) = bb }
-
-/**
- * Liveness analysis (based on source variables) to restrict the size of the
- * SSA representation.
- */
-private module Liveness {
-  /**
-   * A classification of variable references into reads (of a given kind) and
-   * (certain or uncertain) writes.
-   */
-  private newtype TRefKind =
-    Read(boolean certain) { certain in [false, true] } or
-    Write(boolean certain) { certain in [false, true] }
-
-  private class RefKind extends TRefKind {
-    string toString() {
-      exists(boolean certain | this = Read(certain) and result = "read (" + certain + ")")
-      or
-      exists(boolean certain | this = Write(certain) and result = "write (" + certain + ")")
-    }
-
-    int getOrder() {
-      this = Read(_) and
-      result = 0
-      or
-      this = Write(_) and
-      result = 1
-    }
-  }
-
-  /**
-   * Holds if the `i`th node of basic block `bb` is a reference to `v` of kind `k`.
-   */
-  predicate ref(BasicBlock bb, int i, SourceVariable v, RefKind k) {
-    exists(boolean certain | variableRead(bb, i, v, certain) | k = Read(certain))
-    or
-    exists(boolean certain | variableWrite(bb, i, v, certain) | k = Write(certain))
-  }
-
-  private newtype OrderedRefIndex =
-    MkOrderedRefIndex(int i, int tag) {
-      exists(RefKind rk | ref(_, i, _, rk) | tag = rk.getOrder())
-    }
-
-  private OrderedRefIndex refOrd(BasicBlock bb, int i, SourceVariable v, RefKind k, int ord) {
-    ref(bb, i, v, k) and
-    result = MkOrderedRefIndex(i, ord) and
-    ord = k.getOrder()
-  }
-
-  /**
-   * Gets the (1-based) rank of the reference to `v` at the `i`th node of
-   * basic block `bb`, which has the given reference kind `k`.
-   *
-   * Reads are considered before writes when they happen at the same index.
-   */
-  private int refRank(BasicBlock bb, int i, SourceVariable v, RefKind k) {
-    refOrd(bb, i, v, k, _) =
-      rank[result](int j, int ord, OrderedRefIndex res |
-        res = refOrd(bb, j, v, _, ord)
-      |
-        res order by j, ord
-      )
-  }
-
-  private int maxRefRank(BasicBlock bb, SourceVariable v) {
-    result = refRank(bb, _, v, _) and
-    not result + 1 = refRank(bb, _, v, _)
-  }
-
-  predicate lastRefIsRead(BasicBlock bb, SourceVariable v) {
-    maxRefRank(bb, v) = refRank(bb, _, v, Read(_))
-  }
-
-  /**
-   * Gets the (1-based) rank of the first reference to `v` inside basic block `bb`
-   * that is either a read or a certain write.
-   */
-  private int firstReadOrCertainWrite(BasicBlock bb, SourceVariable v) {
-    result =
-      min(int r, RefKind k |
-        r = refRank(bb, _, v, k) and
-        k != Write(false)
-      |
-        r
-      )
-  }
-
-  /**
-   * Holds if source variable `v` is live at the beginning of basic block `bb`.
-   */
-  predicate liveAtEntry(BasicBlock bb, SourceVariable v) {
-    // The first read or certain write to `v` inside `bb` is a read
-    refRank(bb, _, v, Read(_)) = firstReadOrCertainWrite(bb, v)
-    or
-    // There is no certain write to `v` inside `bb`, but `v` is live at entry
-    // to a successor basic block of `bb`
-    not exists(firstReadOrCertainWrite(bb, v)) and
-    liveAtExit(bb, v)
-  }
-
-  /**
-   * Holds if source variable `v` is live at the end of basic block `bb`.
-   */
-  predicate liveAtExit(BasicBlock bb, SourceVariable v) {
-    liveAtEntry(getABasicBlockSuccessor(bb), v)
-  }
-
-  /**
-   * Holds if variable `v` is live in basic block `bb` at index `i`.
-   * The rank of `i` is `rnk` as defined by `refRank()`.
-   */
-  private predicate liveAtRank(BasicBlock bb, int i, SourceVariable v, int rnk) {
-    exists(RefKind kind | rnk = refRank(bb, i, v, kind) |
-      rnk = maxRefRank(bb, v) and
-      liveAtExit(bb, v)
-      or
-      ref(bb, i, v, kind) and
-      kind = Read(_)
-      or
-      exists(RefKind nextKind |
-        liveAtRank(bb, _, v, rnk + 1) and
-        rnk + 1 = refRank(bb, _, v, nextKind) and
-        nextKind != Write(true)
-      )
-    )
-  }
-
-  /**
-   * Holds if variable `v` is live after the (certain or uncertain) write at
-   * index `i` inside basic block `bb`.
-   */
-  predicate liveAfterWrite(BasicBlock bb, int i, SourceVariable v) {
-    exists(int rnk | rnk = refRank(bb, i, v, Write(_)) | liveAtRank(bb, i, v, rnk))
-  }
-}
-
-private import Liveness
-
-/**
- * Holds if `df` is in the dominance frontier of `bb`.
- *
- * This is equivalent to:
- *
- * ```ql
- * bb = getImmediateBasicBlockDominator*(getABasicBlockPredecessor(df)) and
- * not bb = getImmediateBasicBlockDominator+(df)
- * ```
- */
-private predicate inDominanceFrontier(BasicBlock bb, BasicBlock df) {
-  bb = getABasicBlockPredecessor(df) and not bb = getImmediateBasicBlockDominator(df)
-  or
-  exists(BasicBlock prev | inDominanceFrontier(prev, df) |
-    bb = getImmediateBasicBlockDominator(prev) and
-    not bb = getImmediateBasicBlockDominator(df)
-  )
-}
-
-/**
- * Holds if `bb` is in the dominance frontier of a block containing a
- * definition of `v`.
- */
-pragma[noinline]
-private predicate inDefDominanceFrontier(BasicBlock bb, SourceVariable v) {
-  exists(BasicBlock defbb, Definition def |
-    def.definesAt(v, defbb, _) and
-    inDominanceFrontier(defbb, bb)
-  )
-}
-
-cached
-newtype TDefinition =
-  TWriteDef(SourceVariable v, BasicBlock bb, int i) {
-    variableWrite(bb, i, v, _) and
-    liveAfterWrite(bb, i, v)
-  } or
-  TPhiNode(SourceVariable v, BasicBlock bb) {
-    inDefDominanceFrontier(bb, v) and
-    liveAtEntry(bb, v)
-  }
-
-private module SsaDefReaches {
-  newtype TSsaRefKind =
-    SsaActualRead() or
-    SsaPhiRead() or
-    SsaDef()
-
-  class SsaRead = SsaActualRead or SsaPhiRead;
-
-  /**
-   * A classification of SSA variable references into reads and definitions.
-   */
-  class SsaRefKind extends TSsaRefKind {
-    string toString() {
-      this = SsaActualRead() and
-      result = "SsaActualRead"
-      or
-      this = SsaPhiRead() and
-      result = "SsaPhiRead"
-      or
-      this = SsaDef() and
-      result = "SsaDef"
-    }
-
-    int getOrder() {
-      this instanceof SsaRead and
-      result = 0
-      or
-      this = SsaDef() and
-      result = 1
-    }
-  }
-
-  /**
-   * Holds if `bb` is in the dominance frontier of a block containing a
-   * read of `v`.
-   */
-  pragma[nomagic]
-  private predicate inReadDominanceFrontier(BasicBlock bb, SourceVariable v) {
-    exists(BasicBlock readbb | inDominanceFrontier(readbb, bb) |
-      lastRefIsRead(readbb, v)
-      or
-      phiRead(readbb, v)
-    )
-  }
-
-  /**
-   * Holds if a phi-read node should be inserted for variable `v` at the beginning
-   * of basic block `bb`.
-   *
-   * Phi-read nodes are like normal phi nodes, but they are inserted based on reads
-   * instead of writes, and only if the dominance-frontier block does not already
-   * contain a reference (read or write) to `v`. Unlike normal phi nodes, this is
-   * an internal implementation detail that is not exposed.
-   *
-   * The motivation for adding phi-reads is to improve performance of the use-use
-   * calculation in cases where there is a large number of reads that can reach the
-   * same join-point, and from there reach a large number of basic blocks. Example:
-   *
-   * ```cs
-   * if (a)
-   *   use(x);
-   * else if (b)
-   *   use(x);
-   * else if (c)
-   *   use(x);
-   * else if (d)
-   *   use(x);
-   * // many more ifs ...
-   *
-   * // phi-read for `x` inserted here
-   *
-   * // program not mentioning `x`, with large basic block graph
-   *
-   * use(x);
-   * ```
-   *
-   * Without phi-reads, the analysis has to replicate reachability for each of
-   * the guarded uses of `x`. However, with phi-reads, the analysis will limit
-   * each conditional use of `x` to reach the basic block containing the phi-read
-   * node for `x`, and only that basic block will have to compute reachability
-   * through the remainder of the large program.
-   *
-   * Like normal reads, each phi-read node `phi-read` can be reached from exactly
-   * one SSA definition (without passing through another definition): Assume, for
-   * the sake of contradiction, that there are two reaching definitions `def1` and
-   * `def2`. Now, if both `def1` and `def2` dominate `phi-read`, then the nearest
-   * dominating definition will prevent the other from reaching `phi-read`. So, at
-   * least one of `def1` and `def2` cannot dominate `phi-read`; assume it is `def1`.
-   * Then `def1` must go through one of its dominance-frontier blocks in order to
-   * reach `phi-read`. However, such a block will always start with a (normal) phi
-   * node, which contradicts reachability.
-   *
-   * Also, like normal reads, the unique SSA definition `def` that reaches `phi-read`,
-   * will dominate `phi-read`. Assuming it doesn't means that the path from `def`
-   * to `phi-read` goes through a dominance-frontier block, and hence a phi node,
-   * which contradicts reachability.
-   */
-  pragma[nomagic]
-  predicate phiRead(BasicBlock bb, SourceVariable v) {
-    inReadDominanceFrontier(bb, v) and
-    liveAtEntry(bb, v) and
-    // only if there are no other references to `v` inside `bb`
-    not ref(bb, _, v, _) and
-    not exists(Definition def | def.definesAt(v, bb, _))
-  }
-
-  /**
-   * Holds if the `i`th node of basic block `bb` is a reference to `v`,
-   * either a read (when `k` is `SsaRead()`) or an SSA definition (when `k`
-   * is `SsaDef()`).
-   *
-   * Unlike `Liveness::ref`, this includes `phi` nodes.
-   */
-  pragma[nomagic]
-  predicate ssaRef(BasicBlock bb, int i, SourceVariable v, SsaRefKind k) {
-    variableRead(bb, i, v, _) and
-    k = SsaActualRead()
-    or
-    phiRead(bb, v) and
-    i = -1 and
-    k = SsaPhiRead()
-    or
-    any(Definition def).definesAt(v, bb, i) and
-    k = SsaDef()
-  }
-
-  private newtype OrderedSsaRefIndex =
-    MkOrderedSsaRefIndex(int i, SsaRefKind k) { ssaRef(_, i, _, k) }
-
-  private OrderedSsaRefIndex ssaRefOrd(BasicBlock bb, int i, SourceVariable v, SsaRefKind k, int ord) {
-    ssaRef(bb, i, v, k) and
-    result = MkOrderedSsaRefIndex(i, k) and
-    ord = k.getOrder()
-  }
-
-  /**
-   * Gets the (1-based) rank of the reference to `v` at the `i`th node of basic
-   * block `bb`, which has the given reference kind `k`.
-   *
-   * For example, if `bb` is a basic block with a phi node for `v` (considered
-   * to be at index -1), reads `v` at node 2, and defines it at node 5, we have:
-   *
-   * ```ql
-   * ssaRefRank(bb, -1, v, SsaDef()) = 1    // phi node
-   * ssaRefRank(bb,  2, v, Read())   = 2    // read at node 2
-   * ssaRefRank(bb,  5, v, SsaDef()) = 3    // definition at node 5
-   * ```
-   *
-   * Reads are considered before writes when they happen at the same index.
-   */
-  int ssaRefRank(BasicBlock bb, int i, SourceVariable v, SsaRefKind k) {
-    ssaRefOrd(bb, i, v, k, _) =
-      rank[result](int j, int ord, OrderedSsaRefIndex res |
-        res = ssaRefOrd(bb, j, v, _, ord)
-      |
-        res order by j, ord
-      )
-  }
-
-  int maxSsaRefRank(BasicBlock bb, SourceVariable v) {
-    result = ssaRefRank(bb, _, v, _) and
-    not result + 1 = ssaRefRank(bb, _, v, _)
-  }
-
-  /**
-   * Holds if the SSA definition `def` reaches rank index `rnk` in its own
-   * basic block `bb`.
-   */
-  predicate ssaDefReachesRank(BasicBlock bb, Definition def, int rnk, SourceVariable v) {
-    exists(int i |
-      rnk = ssaRefRank(bb, i, v, SsaDef()) and
-      def.definesAt(v, bb, i)
-    )
-    or
-    ssaDefReachesRank(bb, def, rnk - 1, v) and
-    rnk = ssaRefRank(bb, _, v, any(SsaRead k))
-  }
-
-  /**
-   * Holds if the SSA definition of `v` at `def` reaches index `i` in the same
-   * basic block `bb`, without crossing another SSA definition of `v`.
-   */
-  predicate ssaDefReachesReadWithinBlock(SourceVariable v, Definition def, BasicBlock bb, int i) {
-    exists(int rnk |
-      ssaDefReachesRank(bb, def, rnk, v) and
-      rnk = ssaRefRank(bb, i, v, any(SsaRead k))
-    )
-  }
-
-  /**
-   * Same as `ssaRefRank()`, but restricted to a particular SSA definition `def`.
-   */
-  int ssaDefRank(Definition def, SourceVariable v, BasicBlock bb, int i, SsaRefKind k) {
-    v = def.getSourceVariable() and
-    result = ssaRefRank(bb, i, v, k) and
-    (
-      ssaDefReachesRead(_, def, bb, i)
-      or
-      def.definesAt(_, bb, i)
-    )
-  }
-
-  /**
-   * Holds if the reference to `def` at index `i` in basic block `bb` is the
-   * last reference to `v` inside `bb`.
-   */
-  pragma[noinline]
-  predicate lastSsaRef(Definition def, SourceVariable v, BasicBlock bb, int i) {
-    ssaDefRank(def, v, bb, i, _) = maxSsaRefRank(bb, v)
-  }
-
-  predicate defOccursInBlock(Definition def, BasicBlock bb, SourceVariable v, SsaRefKind k) {
-    exists(ssaDefRank(def, v, bb, _, k))
-  }
-
-  pragma[noinline]
-  private predicate ssaDefReachesThroughBlock(Definition def, BasicBlock bb) {
-    ssaDefReachesEndOfBlock(bb, def, _) and
-    not defOccursInBlock(_, bb, def.getSourceVariable(), _)
-  }
-
-  /**
-   * Holds if `def` is accessed in basic block `bb1` (either a read or a write),
-   * `bb2` is a transitive successor of `bb1`, `def` is live at the end of _some_
-   * predecessor of `bb2`, and the underlying variable for `def` is neither read
-   * nor written in any block on the path between `bb1` and `bb2`.
-   *
-   * Phi reads are considered as normal reads for this predicate.
-   */
-  pragma[nomagic]
-  private predicate varBlockReachesInclPhiRead(Definition def, BasicBlock bb1, BasicBlock bb2) {
-    defOccursInBlock(def, bb1, _, _) and
-    bb2 = getABasicBlockSuccessor(bb1)
-    or
-    exists(BasicBlock mid |
-      varBlockReachesInclPhiRead(def, bb1, mid) and
-      ssaDefReachesThroughBlock(def, mid) and
-      bb2 = getABasicBlockSuccessor(mid)
-    )
-  }
-
-  pragma[nomagic]
-  private predicate phiReadStep(Definition def, SourceVariable v, BasicBlock bb1, BasicBlock bb2) {
-    varBlockReachesInclPhiRead(def, bb1, bb2) and
-    defOccursInBlock(def, bb2, v, SsaPhiRead())
-  }
-
-  pragma[nomagic]
-  private predicate varBlockReachesExclPhiRead(Definition def, BasicBlock bb1, BasicBlock bb2) {
-    varBlockReachesInclPhiRead(pragma[only_bind_into](def), bb1, pragma[only_bind_into](bb2)) and
-    ssaRef(bb2, _, def.getSourceVariable(), [SsaActualRead().(TSsaRefKind), SsaDef()])
-    or
-    exists(BasicBlock mid |
-      varBlockReachesExclPhiRead(def, mid, bb2) and
-      phiReadStep(def, _, bb1, mid)
-    )
-  }
-
-  /**
-   * Holds if `def` is accessed in basic block `bb1` (either a read or a write),
-   * the underlying variable `v` of `def` is accessed in basic block `bb2`
-   * (either a read or a write), `bb2` is a transitive successor of `bb1`, and
-   * `v` is neither read nor written in any block on the path between `bb1`
-   * and `bb2`.
-   */
-  pragma[nomagic]
-  predicate varBlockReaches(Definition def, BasicBlock bb1, BasicBlock bb2) {
-    varBlockReachesExclPhiRead(def, bb1, bb2) and
-    not defOccursInBlock(def, bb1, _, SsaPhiRead())
-  }
-
-  pragma[nomagic]
-  predicate defAdjacentRead(Definition def, BasicBlock bb1, BasicBlock bb2, int i2) {
-    varBlockReaches(def, bb1, bb2) and
-    ssaRefRank(bb2, i2, def.getSourceVariable(), SsaActualRead()) = 1
-  }
-
-  /**
-   * Holds if `def` is accessed in basic block `bb` (either a read or a write),
-   * `bb1` can reach a transitive successor `bb2` where `def` is no longer live,
-   * and `v` is neither read nor written in any block on the path between `bb`
-   * and `bb2`.
-   */
-  pragma[nomagic]
-  predicate varBlockReachesExit(Definition def, BasicBlock bb) {
-    exists(BasicBlock bb2 | varBlockReachesInclPhiRead(def, bb, bb2) |
-      not defOccursInBlock(def, bb2, _, _) and
-      not ssaDefReachesEndOfBlock(bb2, def, _)
-    )
-    or
-    exists(BasicBlock mid |
-      varBlockReachesExit(def, mid) and
-      phiReadStep(def, _, bb, mid)
-    )
-  }
-}
-
-predicate phiReadExposedForTesting = phiRead/2;
-
-private import SsaDefReaches
-
-pragma[nomagic]
-predicate liveThrough(BasicBlock bb, SourceVariable v) {
-  liveAtExit(bb, v) and
-  not ssaRef(bb, _, v, SsaDef())
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if the SSA definition of `v` at `def` reaches the end of basic
- * block `bb`, at which point it is still live, without crossing another
- * SSA definition of `v`.
- */
-pragma[nomagic]
-predicate ssaDefReachesEndOfBlock(BasicBlock bb, Definition def, SourceVariable v) {
-  exists(int last |
-    last = maxSsaRefRank(pragma[only_bind_into](bb), pragma[only_bind_into](v)) and
-    ssaDefReachesRank(bb, def, last, v) and
-    liveAtExit(bb, v)
-  )
-  or
-  // The construction of SSA form ensures that each read of a variable is
-  // dominated by its definition. An SSA definition therefore reaches a
-  // control flow node if it is the _closest_ SSA definition that dominates
-  // the node. If two definitions dominate a node then one must dominate the
-  // other, so therefore the definition of _closest_ is given by the dominator
-  // tree. Thus, reaching definitions can be calculated in terms of dominance.
-  ssaDefReachesEndOfBlock(getImmediateBasicBlockDominator(bb), def, pragma[only_bind_into](v)) and
-  liveThrough(bb, pragma[only_bind_into](v))
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if `inp` is an input to the phi node `phi` along the edge originating in `bb`.
- */
-pragma[nomagic]
-predicate phiHasInputFromBlock(PhiNode phi, Definition inp, BasicBlock bb) {
-  exists(SourceVariable v, BasicBlock bbDef |
-    phi.definesAt(v, bbDef, _) and
-    getABasicBlockPredecessor(bbDef) = bb and
-    ssaDefReachesEndOfBlock(bb, inp, v)
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if the SSA definition of `v` at `def` reaches a read at index `i` in
- * basic block `bb`, without crossing another SSA definition of `v`. The read
- * is of kind `rk`.
- */
-pragma[nomagic]
-predicate ssaDefReachesRead(SourceVariable v, Definition def, BasicBlock bb, int i) {
-  ssaDefReachesReadWithinBlock(v, def, bb, i)
-  or
-  ssaRef(bb, i, v, any(SsaRead k)) and
-  ssaDefReachesEndOfBlock(getABasicBlockPredecessor(bb), def, v) and
-  not ssaDefReachesReadWithinBlock(v, _, bb, i)
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if `def` is accessed at index `i1` in basic block `bb1` (either a read
- * or a write), `def` is read at index `i2` in basic block `bb2`, and there is a
- * path between them without any read of `def`.
- */
-pragma[nomagic]
-predicate adjacentDefRead(Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2) {
-  exists(int rnk |
-    rnk = ssaDefRank(def, _, bb1, i1, _) and
-    rnk + 1 = ssaDefRank(def, _, bb1, i2, SsaActualRead()) and
-    variableRead(bb1, i2, _, _) and
-    bb2 = bb1
-  )
-  or
-  lastSsaRef(def, _, bb1, i1) and
-  defAdjacentRead(def, bb1, bb2, i2)
-}
-
-pragma[noinline]
-private predicate adjacentDefRead(
-  Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2, SourceVariable v
-) {
-  adjacentDefRead(def, bb1, i1, bb2, i2) and
-  v = def.getSourceVariable()
-}
-
-private predicate adjacentDefReachesRead(
-  Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2
-) {
-  exists(SourceVariable v | adjacentDefRead(def, bb1, i1, bb2, i2, v) |
-    ssaRef(bb1, i1, v, SsaDef())
-    or
-    variableRead(bb1, i1, v, true)
-  )
-  or
-  exists(BasicBlock bb3, int i3 |
-    adjacentDefReachesRead(def, bb1, i1, bb3, i3) and
-    variableRead(bb3, i3, _, false) and
-    adjacentDefRead(def, bb3, i3, bb2, i2)
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Same as `adjacentDefRead`, but ignores uncertain reads.
- */
-pragma[nomagic]
-predicate adjacentDefNoUncertainReads(Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2) {
-  adjacentDefReachesRead(def, bb1, i1, bb2, i2) and
-  variableRead(bb2, i2, _, true)
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if the node at index `i` in `bb` is a last reference to SSA definition
- * `def`. The reference is last because it can reach another write `next`,
- * without passing through another read or write.
- */
-pragma[nomagic]
-predicate lastRefRedef(Definition def, BasicBlock bb, int i, Definition next) {
-  exists(SourceVariable v |
-    // Next reference to `v` inside `bb` is a write
-    exists(int rnk, int j |
-      rnk = ssaDefRank(def, v, bb, i, _) and
-      next.definesAt(v, bb, j) and
-      rnk + 1 = ssaRefRank(bb, j, v, SsaDef())
-    )
-    or
-    // Can reach a write using one or more steps
-    lastSsaRef(def, v, bb, i) and
-    exists(BasicBlock bb2 |
-      varBlockReaches(def, bb, bb2) and
-      1 = ssaDefRank(next, v, bb2, _, SsaDef())
-    )
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if `inp` is an immediately preceding definition of uncertain definition
- * `def`. Since `def` is uncertain, the value from the preceding definition might
- * still be valid.
- */
-pragma[nomagic]
-predicate uncertainWriteDefinitionInput(UncertainWriteDefinition def, Definition inp) {
-  lastRefRedef(inp, _, _, def)
-}
-
-private predicate adjacentDefReachesUncertainRead(
-  Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2
-) {
-  adjacentDefReachesRead(def, bb1, i1, bb2, i2) and
-  variableRead(bb2, i2, _, false)
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Same as `lastRefRedef`, but ignores uncertain reads.
- */
-pragma[nomagic]
-predicate lastRefRedefNoUncertainReads(Definition def, BasicBlock bb, int i, Definition next) {
-  lastRefRedef(def, bb, i, next) and
-  not variableRead(bb, i, def.getSourceVariable(), false)
-  or
-  exists(BasicBlock bb0, int i0 |
-    lastRefRedef(def, bb0, i0, next) and
-    adjacentDefReachesUncertainRead(def, bb, i, bb0, i0)
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if the node at index `i` in `bb` is a last reference to SSA
- * definition `def`.
- *
- * That is, the node can reach the end of the enclosing callable, or another
- * SSA definition for the underlying source variable, without passing through
- * another read.
- */
-pragma[nomagic]
-predicate lastRef(Definition def, BasicBlock bb, int i) {
-  // Can reach another definition
-  lastRefRedef(def, bb, i, _)
-  or
-  exists(SourceVariable v | lastSsaRef(def, v, bb, i) |
-    // Can reach exit directly
-    bb instanceof ExitBasicBlock
-    or
-    // Can reach a block using one or more steps, where `def` is no longer live
-    varBlockReachesExit(def, bb)
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Same as `lastRefRedef`, but ignores uncertain reads.
- */
-pragma[nomagic]
-predicate lastRefNoUncertainReads(Definition def, BasicBlock bb, int i) {
-  lastRef(def, bb, i) and
-  not variableRead(bb, i, def.getSourceVariable(), false)
-  or
-  exists(BasicBlock bb0, int i0 |
-    lastRef(def, bb0, i0) and
-    adjacentDefReachesUncertainRead(def, bb, i, bb0, i0)
-  )
-}
-
-/** A static single assignment (SSA) definition. */
-class Definition extends TDefinition {
-  /** Gets the source variable underlying this SSA definition. */
-  SourceVariable getSourceVariable() { this.definesAt(result, _, _) }
-
-  /**
-   * Holds if this SSA definition defines `v` at index `i` in basic block `bb`.
-   * Phi nodes are considered to be at index `-1`, while normal variable writes
-   * are at the index of the control flow node they wrap.
-   */
-  final predicate definesAt(SourceVariable v, BasicBlock bb, int i) {
-    this = TWriteDef(v, bb, i)
-    or
-    this = TPhiNode(v, bb) and i = -1
-  }
-
-  /** Gets the basic block to which this SSA definition belongs. */
-  final BasicBlock getBasicBlock() { this.definesAt(_, result, _) }
-
-  /** Gets a textual representation of this SSA definition. */
-  string toString() { none() }
-}
-
-/** An SSA definition that corresponds to a write. */
-class WriteDefinition extends Definition, TWriteDef {
-  private SourceVariable v;
-  private BasicBlock bb;
-  private int i;
-
-  WriteDefinition() { this = TWriteDef(v, bb, i) }
-
-  override string toString() { result = "WriteDef" }
-}
-
-/** A phi node. */
-class PhiNode extends Definition, TPhiNode {
-  override string toString() { result = "Phi" }
-}
-
-/**
- * An SSA definition that represents an uncertain update of the underlying
- * source variable.
- */
-class UncertainWriteDefinition extends WriteDefinition {
-  UncertainWriteDefinition() {
-    exists(SourceVariable v, BasicBlock bb, int i |
-      this.definesAt(v, bb, i) and
-      variableWrite(bb, i, v, false)
-    )
-  }
-}
-
-/** Provides a set of consistency queries. */
-module Consistency {
-  abstract class RelevantDefinition extends Definition {
-    abstract predicate hasLocationInfo(
-      string filepath, int startline, int startcolumn, int endline, int endcolumn
-    );
-  }
-
-  query predicate nonUniqueDef(RelevantDefinition def, SourceVariable v, BasicBlock bb, int i) {
-    ssaDefReachesRead(v, def, bb, i) and
-    not exists(unique(Definition def0 | ssaDefReachesRead(v, def0, bb, i)))
-  }
-
-  query predicate readWithoutDef(SourceVariable v, BasicBlock bb, int i) {
-    variableRead(bb, i, v, _) and
-    not ssaDefReachesRead(v, _, bb, i)
-  }
-
-  query predicate deadDef(RelevantDefinition def, SourceVariable v) {
-    v = def.getSourceVariable() and
-    not ssaDefReachesRead(_, def, _, _) and
-    not phiHasInputFromBlock(_, def, _) and
-    not uncertainWriteDefinitionInput(_, def)
-  }
-
-  query predicate notDominatedByDef(RelevantDefinition def, SourceVariable v, BasicBlock bb, int i) {
-    exists(BasicBlock bbDef, int iDef | def.definesAt(v, bbDef, iDef) |
-      ssaDefReachesReadWithinBlock(v, def, bb, i) and
-      (bb != bbDef or i < iDef)
-      or
-      ssaDefReachesRead(v, def, bb, i) and
-      not ssaDefReachesReadWithinBlock(v, def, bb, i) and
-      not def.definesAt(v, getImmediateBasicBlockDominator*(bb), _)
-    )
-  }
-}

csharp/ql/lib/semmle/code/cil/internal/SsaImplSpecific.qll

@@ -1,30 +0,0 @@
-/** Provides the CIL specific parameters for `SsaImplCommon.qll`. */
-
-private import cil
-private import SsaImpl
-
-class BasicBlock = CIL::BasicBlock;
-
-BasicBlock getImmediateBasicBlockDominator(BasicBlock bb) { result = bb.getImmediateDominator() }
-
-BasicBlock getABasicBlockSuccessor(BasicBlock bb) { result = bb.getASuccessor() }
-
-class ExitBasicBlock = CIL::ExitBasicBlock;
-
-class SourceVariable = CIL::StackVariable;
-
-predicate variableWrite(BasicBlock bb, int i, SourceVariable v, boolean certain) {
-  forceCachingInSameStage() and
-  exists(CIL::VariableUpdate vu |
-    vu.updatesAt(bb, i) and
-    v = vu.getVariable() and
-    certain = true
-  )
-}
-
-predicate variableRead(BasicBlock bb, int i, SourceVariable v, boolean certain) {
-  exists(CIL::ReadAccess ra | bb.getNode(i) = ra |
-    ra.getTarget() = v and
-    certain = true
-  )
-}

csharp/ql/lib/semmle/code/csharp/controlflow/BasicBlocks.qll

@@ -192,8 +192,7 @@ class BasicBlock extends TBasicBlockStart {
    * Gets the basic block that immediately dominates this basic block, if any.
    *
    * That is, all paths reaching this basic block from some entry point
-   * basic block must go through the result, which is an immediate basic block
-   * predecessor of this basic block.
+   * basic block must go through the result.
    *
    * Example:
    *
@@ -207,8 +206,7 @@ class BasicBlock extends TBasicBlockStart {
    *
    * The basic block starting on line 2 is an immediate dominator of
    * the basic block online 4 (all paths from the entry point of `M`
-   * to `return s.Length;` must go through the null check, and the null check
-   * is an immediate predecessor of `return s.Length;`).
+   * to `return s.Length;` must go through the null check.
    */
   BasicBlock getImmediateDominator() { bbIDominates(result, this) }
 

csharp/ql/lib/semmle/code/csharp/controlflow/internal/PreSsa.qll

@@ -6,26 +6,158 @@ import csharp
  * scope variables.
  */
 module PreSsa {
-  import pressa.SsaImplSpecific
-  private import pressa.SsaImplCommon as SsaImpl
+  private import AssignableDefinitions
+  private import semmle.code.csharp.controlflow.internal.ControlFlowGraphImpl
+  private import semmle.code.csharp.controlflow.internal.PreBasicBlocks as PreBasicBlocks
+  private import semmle.code.csharp.dataflow.internal.SsaImplCommon as SsaImplCommon
+
+  private predicate definitionAt(
+    AssignableDefinition def, SsaInput::BasicBlock bb, int i, SsaInput::SourceVariable v
+  ) {
+    bb.getElement(i) = def.getExpr() and
+    v = def.getTarget() and
+    // In cases like `(x, x) = (0, 1)`, we discard the first (dead) definition of `x`
+    not exists(TupleAssignmentDefinition first, TupleAssignmentDefinition second | first = def |
+      second.getAssignment() = first.getAssignment() and
+      second.getEvaluationOrder() > first.getEvaluationOrder() and
+      second.getTarget() = v
+    )
+    or
+    def.(ImplicitParameterDefinition).getParameter() = v and
+    exists(Callable c | v = c.getAParameter() |
+      scopeFirst(c, bb) and
+      i = -1
+    )
+  }
+
+  predicate implicitEntryDef(Callable c, SsaInput::BasicBlock bb, SsaInput::SourceVariable v) {
+    not v instanceof LocalScopeVariable and
+    c = v.getACallable() and
+    scopeFirst(c, bb)
+  }
+
+  module SsaInput implements SsaImplCommon::InputSig {
+    class BasicBlock = PreBasicBlocks::PreBasicBlock;
+
+    BasicBlock getImmediateBasicBlockDominator(BasicBlock bb) { result.immediatelyDominates(bb) }
+
+    BasicBlock getABasicBlockSuccessor(BasicBlock bb) { result = bb.getASuccessor() }
+
+    class ExitBasicBlock extends BasicBlock {
+      ExitBasicBlock() { scopeLast(_, this.getLastElement(), _) }
+    }
+
+    /** Holds if `a` is assigned in non-constructor callable `c`. */
+    pragma[nomagic]
+    private predicate assignableDefinition(Assignable a, Callable c) {
+      exists(AssignableDefinition def | def.getTarget() = a |
+        c = def.getEnclosingCallable() and
+        not c instanceof Constructor
+      )
+    }
+
+    /** Holds if `a` is accessed in callable `c`. */
+    pragma[nomagic]
+    private predicate assignableAccess(Assignable a, Callable c) {
+      exists(AssignableAccess aa | aa.getTarget() = a | c = aa.getEnclosingCallable())
+    }
+
+    pragma[nomagic]
+    private predicate assignableNoCapturing(Assignable a, Callable c) {
+      assignableAccess(a, c) and
+      /*
+       * The code below is equivalent to
+       * ```ql
+       * not exists(Callable other | assignableDefinition(a, other) | other != c)
+       * ```
+       * but it avoids a Cartesian product in the compiler generated antijoin
+       * predicate.
+       */
+
+      (
+        not assignableDefinition(a, _)
+        or
+        c = unique(Callable c0 | assignableDefinition(a, c0) | c0)
+      )
+    }
+
+    pragma[noinline]
+    private predicate assignableNoComplexQualifiers(Assignable a) {
+      forall(QualifiableExpr qe | qe.(AssignableAccess).getTarget() = a | qe.targetIsThisInstance())
+    }
+
+    /**
+     * A simple assignable. Either a local scope variable or a field/property
+     * that behaves like a local scope variable.
+     */
+    class SourceVariable extends Assignable {
+      private Callable c;
+
+      SourceVariable() {
+        (
+          this instanceof LocalScopeVariable
+          or
+          this = any(Field f | not f.isVolatile())
+          or
+          this = any(TrivialProperty tp | not tp.isOverridableOrImplementable())
+        ) and
+        assignableNoCapturing(this, c) and
+        assignableNoComplexQualifiers(this)
+      }
+
+      /** Gets a callable in which this simple assignable can be analyzed. */
+      Callable getACallable() { result = c }
+    }
+
+    predicate variableWrite(BasicBlock bb, int i, SourceVariable v, boolean certain) {
+      exists(AssignableDefinition def |
+        definitionAt(def, bb, i, v) and
+        if def.getTargetAccess().isRefArgument() then certain = false else certain = true
+      )
+      or
+      exists(Callable c |
+        implicitEntryDef(c, bb, v) and
+        i = -1 and
+        certain = true
+      )
+    }
+
+    predicate variableRead(BasicBlock bb, int i, SourceVariable v, boolean certain) {
+      exists(AssignableRead read |
+        read = bb.getElement(i) and
+        read.getTarget() = v and
+        certain = true
+      )
+      or
+      v =
+        any(LocalScopeVariable lsv |
+          lsv.getCallable() = bb.(ExitBasicBlock).getEnclosingCallable() and
+          i = bb.length() and
+          (lsv.isRef() or v.(Parameter).isOut()) and
+          certain = false
+        )
+    }
+  }
+
+  private module SsaImpl = SsaImplCommon::Make<SsaInput>;
 
   class Definition extends SsaImpl::Definition {
     final AssignableRead getARead() {
-      exists(BasicBlock bb, int i |
+      exists(SsaInput::BasicBlock bb, int i |
         SsaImpl::ssaDefReachesRead(_, this, bb, i) and
         result = bb.getElement(i)
       )
     }
 
     final AssignableDefinition getDefinition() {
-      exists(BasicBlock bb, int i, SourceVariable v |
+      exists(SsaInput::BasicBlock bb, int i, SsaInput::SourceVariable v |
         this.definesAt(v, bb, i) and
         definitionAt(result, bb, i, v)
       )
     }
 
     final AssignableRead getAFirstRead() {
-      exists(BasicBlock bb1, int i1, BasicBlock bb2, int i2 |
+      exists(SsaInput::BasicBlock bb1, int i1, SsaInput::BasicBlock bb2, int i2 |
         this.definesAt(_, bb1, i1) and
         SsaImpl::adjacentDefRead(this, bb1, i1, bb2, i2) and
         result = bb2.getElement(i2)
@@ -42,14 +174,14 @@ module PreSsa {
       not result instanceof PhiNode
     }
 
-    final predicate isLiveAtEndOfBlock(BasicBlock bb) {
+    final predicate isLiveAtEndOfBlock(SsaInput::BasicBlock bb) {
       SsaImpl::ssaDefReachesEndOfBlock(bb, this, _)
     }
 
     Location getLocation() {
       result = this.getDefinition().getLocation()
       or
-      exists(Callable c, BasicBlock bb, SourceVariable v |
+      exists(Callable c, SsaInput::BasicBlock bb, SsaInput::SourceVariable v |
         this.definesAt(v, bb, -1) and
         implicitEntryDef(c, bb, v) and
         result = c.getLocation()
@@ -64,9 +196,9 @@ module PreSsa {
   }
 
   predicate adjacentReadPairSameVar(AssignableRead read1, AssignableRead read2) {
-    exists(BasicBlock bb1, int i1, BasicBlock bb2, int i2 |
+    exists(SsaInput::BasicBlock bb1, int i1, SsaInput::BasicBlock bb2, int i2 |
       read1 = bb1.getElement(i1) and
-      variableRead(bb1, i1, _, true) and
+      SsaInput::variableRead(bb1, i1, _, true) and
       SsaImpl::adjacentDefRead(_, bb1, i1, bb2, i2) and
       read2 = bb2.getElement(i2)
     )

csharp/ql/lib/semmle/code/csharp/controlflow/internal/pressa/SsaImplCommon.qll

@@ -1,795 +0,0 @@
-/**
- * Provides a language-independent implementation of static single assignment
- * (SSA) form.
- */
-
-private import SsaImplSpecific
-
-private BasicBlock getABasicBlockPredecessor(BasicBlock bb) { getABasicBlockSuccessor(result) = bb }
-
-/**
- * Liveness analysis (based on source variables) to restrict the size of the
- * SSA representation.
- */
-private module Liveness {
-  /**
-   * A classification of variable references into reads (of a given kind) and
-   * (certain or uncertain) writes.
-   */
-  private newtype TRefKind =
-    Read(boolean certain) { certain in [false, true] } or
-    Write(boolean certain) { certain in [false, true] }
-
-  private class RefKind extends TRefKind {
-    string toString() {
-      exists(boolean certain | this = Read(certain) and result = "read (" + certain + ")")
-      or
-      exists(boolean certain | this = Write(certain) and result = "write (" + certain + ")")
-    }
-
-    int getOrder() {
-      this = Read(_) and
-      result = 0
-      or
-      this = Write(_) and
-      result = 1
-    }
-  }
-
-  /**
-   * Holds if the `i`th node of basic block `bb` is a reference to `v` of kind `k`.
-   */
-  predicate ref(BasicBlock bb, int i, SourceVariable v, RefKind k) {
-    exists(boolean certain | variableRead(bb, i, v, certain) | k = Read(certain))
-    or
-    exists(boolean certain | variableWrite(bb, i, v, certain) | k = Write(certain))
-  }
-
-  private newtype OrderedRefIndex =
-    MkOrderedRefIndex(int i, int tag) {
-      exists(RefKind rk | ref(_, i, _, rk) | tag = rk.getOrder())
-    }
-
-  private OrderedRefIndex refOrd(BasicBlock bb, int i, SourceVariable v, RefKind k, int ord) {
-    ref(bb, i, v, k) and
-    result = MkOrderedRefIndex(i, ord) and
-    ord = k.getOrder()
-  }
-
-  /**
-   * Gets the (1-based) rank of the reference to `v` at the `i`th node of
-   * basic block `bb`, which has the given reference kind `k`.
-   *
-   * Reads are considered before writes when they happen at the same index.
-   */
-  private int refRank(BasicBlock bb, int i, SourceVariable v, RefKind k) {
-    refOrd(bb, i, v, k, _) =
-      rank[result](int j, int ord, OrderedRefIndex res |
-        res = refOrd(bb, j, v, _, ord)
-      |
-        res order by j, ord
-      )
-  }
-
-  private int maxRefRank(BasicBlock bb, SourceVariable v) {
-    result = refRank(bb, _, v, _) and
-    not result + 1 = refRank(bb, _, v, _)
-  }
-
-  predicate lastRefIsRead(BasicBlock bb, SourceVariable v) {
-    maxRefRank(bb, v) = refRank(bb, _, v, Read(_))
-  }
-
-  /**
-   * Gets the (1-based) rank of the first reference to `v` inside basic block `bb`
-   * that is either a read or a certain write.
-   */
-  private int firstReadOrCertainWrite(BasicBlock bb, SourceVariable v) {
-    result =
-      min(int r, RefKind k |
-        r = refRank(bb, _, v, k) and
-        k != Write(false)
-      |
-        r
-      )
-  }
-
-  /**
-   * Holds if source variable `v` is live at the beginning of basic block `bb`.
-   */
-  predicate liveAtEntry(BasicBlock bb, SourceVariable v) {
-    // The first read or certain write to `v` inside `bb` is a read
-    refRank(bb, _, v, Read(_)) = firstReadOrCertainWrite(bb, v)
-    or
-    // There is no certain write to `v` inside `bb`, but `v` is live at entry
-    // to a successor basic block of `bb`
-    not exists(firstReadOrCertainWrite(bb, v)) and
-    liveAtExit(bb, v)
-  }
-
-  /**
-   * Holds if source variable `v` is live at the end of basic block `bb`.
-   */
-  predicate liveAtExit(BasicBlock bb, SourceVariable v) {
-    liveAtEntry(getABasicBlockSuccessor(bb), v)
-  }
-
-  /**
-   * Holds if variable `v` is live in basic block `bb` at index `i`.
-   * The rank of `i` is `rnk` as defined by `refRank()`.
-   */
-  private predicate liveAtRank(BasicBlock bb, int i, SourceVariable v, int rnk) {
-    exists(RefKind kind | rnk = refRank(bb, i, v, kind) |
-      rnk = maxRefRank(bb, v) and
-      liveAtExit(bb, v)
-      or
-      ref(bb, i, v, kind) and
-      kind = Read(_)
-      or
-      exists(RefKind nextKind |
-        liveAtRank(bb, _, v, rnk + 1) and
-        rnk + 1 = refRank(bb, _, v, nextKind) and
-        nextKind != Write(true)
-      )
-    )
-  }
-
-  /**
-   * Holds if variable `v` is live after the (certain or uncertain) write at
-   * index `i` inside basic block `bb`.
-   */
-  predicate liveAfterWrite(BasicBlock bb, int i, SourceVariable v) {
-    exists(int rnk | rnk = refRank(bb, i, v, Write(_)) | liveAtRank(bb, i, v, rnk))
-  }
-}
-
-private import Liveness
-
-/**
- * Holds if `df` is in the dominance frontier of `bb`.
- *
- * This is equivalent to:
- *
- * ```ql
- * bb = getImmediateBasicBlockDominator*(getABasicBlockPredecessor(df)) and
- * not bb = getImmediateBasicBlockDominator+(df)
- * ```
- */
-private predicate inDominanceFrontier(BasicBlock bb, BasicBlock df) {
-  bb = getABasicBlockPredecessor(df) and not bb = getImmediateBasicBlockDominator(df)
-  or
-  exists(BasicBlock prev | inDominanceFrontier(prev, df) |
-    bb = getImmediateBasicBlockDominator(prev) and
-    not bb = getImmediateBasicBlockDominator(df)
-  )
-}
-
-/**
- * Holds if `bb` is in the dominance frontier of a block containing a
- * definition of `v`.
- */
-pragma[noinline]
-private predicate inDefDominanceFrontier(BasicBlock bb, SourceVariable v) {
-  exists(BasicBlock defbb, Definition def |
-    def.definesAt(v, defbb, _) and
-    inDominanceFrontier(defbb, bb)
-  )
-}
-
-cached
-newtype TDefinition =
-  TWriteDef(SourceVariable v, BasicBlock bb, int i) {
-    variableWrite(bb, i, v, _) and
-    liveAfterWrite(bb, i, v)
-  } or
-  TPhiNode(SourceVariable v, BasicBlock bb) {
-    inDefDominanceFrontier(bb, v) and
-    liveAtEntry(bb, v)
-  }
-
-private module SsaDefReaches {
-  newtype TSsaRefKind =
-    SsaActualRead() or
-    SsaPhiRead() or
-    SsaDef()
-
-  class SsaRead = SsaActualRead or SsaPhiRead;
-
-  /**
-   * A classification of SSA variable references into reads and definitions.
-   */
-  class SsaRefKind extends TSsaRefKind {
-    string toString() {
-      this = SsaActualRead() and
-      result = "SsaActualRead"
-      or
-      this = SsaPhiRead() and
-      result = "SsaPhiRead"
-      or
-      this = SsaDef() and
-      result = "SsaDef"
-    }
-
-    int getOrder() {
-      this instanceof SsaRead and
-      result = 0
-      or
-      this = SsaDef() and
-      result = 1
-    }
-  }
-
-  /**
-   * Holds if `bb` is in the dominance frontier of a block containing a
-   * read of `v`.
-   */
-  pragma[nomagic]
-  private predicate inReadDominanceFrontier(BasicBlock bb, SourceVariable v) {
-    exists(BasicBlock readbb | inDominanceFrontier(readbb, bb) |
-      lastRefIsRead(readbb, v)
-      or
-      phiRead(readbb, v)
-    )
-  }
-
-  /**
-   * Holds if a phi-read node should be inserted for variable `v` at the beginning
-   * of basic block `bb`.
-   *
-   * Phi-read nodes are like normal phi nodes, but they are inserted based on reads
-   * instead of writes, and only if the dominance-frontier block does not already
-   * contain a reference (read or write) to `v`. Unlike normal phi nodes, this is
-   * an internal implementation detail that is not exposed.
-   *
-   * The motivation for adding phi-reads is to improve performance of the use-use
-   * calculation in cases where there is a large number of reads that can reach the
-   * same join-point, and from there reach a large number of basic blocks. Example:
-   *
-   * ```cs
-   * if (a)
-   *   use(x);
-   * else if (b)
-   *   use(x);
-   * else if (c)
-   *   use(x);
-   * else if (d)
-   *   use(x);
-   * // many more ifs ...
-   *
-   * // phi-read for `x` inserted here
-   *
-   * // program not mentioning `x`, with large basic block graph
-   *
-   * use(x);
-   * ```
-   *
-   * Without phi-reads, the analysis has to replicate reachability for each of
-   * the guarded uses of `x`. However, with phi-reads, the analysis will limit
-   * each conditional use of `x` to reach the basic block containing the phi-read
-   * node for `x`, and only that basic block will have to compute reachability
-   * through the remainder of the large program.
-   *
-   * Like normal reads, each phi-read node `phi-read` can be reached from exactly
-   * one SSA definition (without passing through another definition): Assume, for
-   * the sake of contradiction, that there are two reaching definitions `def1` and
-   * `def2`. Now, if both `def1` and `def2` dominate `phi-read`, then the nearest
-   * dominating definition will prevent the other from reaching `phi-read`. So, at
-   * least one of `def1` and `def2` cannot dominate `phi-read`; assume it is `def1`.
-   * Then `def1` must go through one of its dominance-frontier blocks in order to
-   * reach `phi-read`. However, such a block will always start with a (normal) phi
-   * node, which contradicts reachability.
-   *
-   * Also, like normal reads, the unique SSA definition `def` that reaches `phi-read`,
-   * will dominate `phi-read`. Assuming it doesn't means that the path from `def`
-   * to `phi-read` goes through a dominance-frontier block, and hence a phi node,
-   * which contradicts reachability.
-   */
-  pragma[nomagic]
-  predicate phiRead(BasicBlock bb, SourceVariable v) {
-    inReadDominanceFrontier(bb, v) and
-    liveAtEntry(bb, v) and
-    // only if there are no other references to `v` inside `bb`
-    not ref(bb, _, v, _) and
-    not exists(Definition def | def.definesAt(v, bb, _))
-  }
-
-  /**
-   * Holds if the `i`th node of basic block `bb` is a reference to `v`,
-   * either a read (when `k` is `SsaRead()`) or an SSA definition (when `k`
-   * is `SsaDef()`).
-   *
-   * Unlike `Liveness::ref`, this includes `phi` nodes.
-   */
-  pragma[nomagic]
-  predicate ssaRef(BasicBlock bb, int i, SourceVariable v, SsaRefKind k) {
-    variableRead(bb, i, v, _) and
-    k = SsaActualRead()
-    or
-    phiRead(bb, v) and
-    i = -1 and
-    k = SsaPhiRead()
-    or
-    any(Definition def).definesAt(v, bb, i) and
-    k = SsaDef()
-  }
-
-  private newtype OrderedSsaRefIndex =
-    MkOrderedSsaRefIndex(int i, SsaRefKind k) { ssaRef(_, i, _, k) }
-
-  private OrderedSsaRefIndex ssaRefOrd(BasicBlock bb, int i, SourceVariable v, SsaRefKind k, int ord) {
-    ssaRef(bb, i, v, k) and
-    result = MkOrderedSsaRefIndex(i, k) and
-    ord = k.getOrder()
-  }
-
-  /**
-   * Gets the (1-based) rank of the reference to `v` at the `i`th node of basic
-   * block `bb`, which has the given reference kind `k`.
-   *
-   * For example, if `bb` is a basic block with a phi node for `v` (considered
-   * to be at index -1), reads `v` at node 2, and defines it at node 5, we have:
-   *
-   * ```ql
-   * ssaRefRank(bb, -1, v, SsaDef()) = 1    // phi node
-   * ssaRefRank(bb,  2, v, Read())   = 2    // read at node 2
-   * ssaRefRank(bb,  5, v, SsaDef()) = 3    // definition at node 5
-   * ```
-   *
-   * Reads are considered before writes when they happen at the same index.
-   */
-  int ssaRefRank(BasicBlock bb, int i, SourceVariable v, SsaRefKind k) {
-    ssaRefOrd(bb, i, v, k, _) =
-      rank[result](int j, int ord, OrderedSsaRefIndex res |
-        res = ssaRefOrd(bb, j, v, _, ord)
-      |
-        res order by j, ord
-      )
-  }
-
-  int maxSsaRefRank(BasicBlock bb, SourceVariable v) {
-    result = ssaRefRank(bb, _, v, _) and
-    not result + 1 = ssaRefRank(bb, _, v, _)
-  }
-
-  /**
-   * Holds if the SSA definition `def` reaches rank index `rnk` in its own
-   * basic block `bb`.
-   */
-  predicate ssaDefReachesRank(BasicBlock bb, Definition def, int rnk, SourceVariable v) {
-    exists(int i |
-      rnk = ssaRefRank(bb, i, v, SsaDef()) and
-      def.definesAt(v, bb, i)
-    )
-    or
-    ssaDefReachesRank(bb, def, rnk - 1, v) and
-    rnk = ssaRefRank(bb, _, v, any(SsaRead k))
-  }
-
-  /**
-   * Holds if the SSA definition of `v` at `def` reaches index `i` in the same
-   * basic block `bb`, without crossing another SSA definition of `v`.
-   */
-  predicate ssaDefReachesReadWithinBlock(SourceVariable v, Definition def, BasicBlock bb, int i) {
-    exists(int rnk |
-      ssaDefReachesRank(bb, def, rnk, v) and
-      rnk = ssaRefRank(bb, i, v, any(SsaRead k))
-    )
-  }
-
-  /**
-   * Same as `ssaRefRank()`, but restricted to a particular SSA definition `def`.
-   */
-  int ssaDefRank(Definition def, SourceVariable v, BasicBlock bb, int i, SsaRefKind k) {
-    v = def.getSourceVariable() and
-    result = ssaRefRank(bb, i, v, k) and
-    (
-      ssaDefReachesRead(_, def, bb, i)
-      or
-      def.definesAt(_, bb, i)
-    )
-  }
-
-  /**
-   * Holds if the reference to `def` at index `i` in basic block `bb` is the
-   * last reference to `v` inside `bb`.
-   */
-  pragma[noinline]
-  predicate lastSsaRef(Definition def, SourceVariable v, BasicBlock bb, int i) {
-    ssaDefRank(def, v, bb, i, _) = maxSsaRefRank(bb, v)
-  }
-
-  predicate defOccursInBlock(Definition def, BasicBlock bb, SourceVariable v, SsaRefKind k) {
-    exists(ssaDefRank(def, v, bb, _, k))
-  }
-
-  pragma[noinline]
-  private predicate ssaDefReachesThroughBlock(Definition def, BasicBlock bb) {
-    ssaDefReachesEndOfBlock(bb, def, _) and
-    not defOccursInBlock(_, bb, def.getSourceVariable(), _)
-  }
-
-  /**
-   * Holds if `def` is accessed in basic block `bb1` (either a read or a write),
-   * `bb2` is a transitive successor of `bb1`, `def` is live at the end of _some_
-   * predecessor of `bb2`, and the underlying variable for `def` is neither read
-   * nor written in any block on the path between `bb1` and `bb2`.
-   *
-   * Phi reads are considered as normal reads for this predicate.
-   */
-  pragma[nomagic]
-  private predicate varBlockReachesInclPhiRead(Definition def, BasicBlock bb1, BasicBlock bb2) {
-    defOccursInBlock(def, bb1, _, _) and
-    bb2 = getABasicBlockSuccessor(bb1)
-    or
-    exists(BasicBlock mid |
-      varBlockReachesInclPhiRead(def, bb1, mid) and
-      ssaDefReachesThroughBlock(def, mid) and
-      bb2 = getABasicBlockSuccessor(mid)
-    )
-  }
-
-  pragma[nomagic]
-  private predicate phiReadStep(Definition def, SourceVariable v, BasicBlock bb1, BasicBlock bb2) {
-    varBlockReachesInclPhiRead(def, bb1, bb2) and
-    defOccursInBlock(def, bb2, v, SsaPhiRead())
-  }
-
-  pragma[nomagic]
-  private predicate varBlockReachesExclPhiRead(Definition def, BasicBlock bb1, BasicBlock bb2) {
-    varBlockReachesInclPhiRead(pragma[only_bind_into](def), bb1, pragma[only_bind_into](bb2)) and
-    ssaRef(bb2, _, def.getSourceVariable(), [SsaActualRead().(TSsaRefKind), SsaDef()])
-    or
-    exists(BasicBlock mid |
-      varBlockReachesExclPhiRead(def, mid, bb2) and
-      phiReadStep(def, _, bb1, mid)
-    )
-  }
-
-  /**
-   * Holds if `def` is accessed in basic block `bb1` (either a read or a write),
-   * the underlying variable `v` of `def` is accessed in basic block `bb2`
-   * (either a read or a write), `bb2` is a transitive successor of `bb1`, and
-   * `v` is neither read nor written in any block on the path between `bb1`
-   * and `bb2`.
-   */
-  pragma[nomagic]
-  predicate varBlockReaches(Definition def, BasicBlock bb1, BasicBlock bb2) {
-    varBlockReachesExclPhiRead(def, bb1, bb2) and
-    not defOccursInBlock(def, bb1, _, SsaPhiRead())
-  }
-
-  pragma[nomagic]
-  predicate defAdjacentRead(Definition def, BasicBlock bb1, BasicBlock bb2, int i2) {
-    varBlockReaches(def, bb1, bb2) and
-    ssaRefRank(bb2, i2, def.getSourceVariable(), SsaActualRead()) = 1
-  }
-
-  /**
-   * Holds if `def` is accessed in basic block `bb` (either a read or a write),
-   * `bb1` can reach a transitive successor `bb2` where `def` is no longer live,
-   * and `v` is neither read nor written in any block on the path between `bb`
-   * and `bb2`.
-   */
-  pragma[nomagic]
-  predicate varBlockReachesExit(Definition def, BasicBlock bb) {
-    exists(BasicBlock bb2 | varBlockReachesInclPhiRead(def, bb, bb2) |
-      not defOccursInBlock(def, bb2, _, _) and
-      not ssaDefReachesEndOfBlock(bb2, def, _)
-    )
-    or
-    exists(BasicBlock mid |
-      varBlockReachesExit(def, mid) and
-      phiReadStep(def, _, bb, mid)
-    )
-  }
-}
-
-predicate phiReadExposedForTesting = phiRead/2;
-
-private import SsaDefReaches
-
-pragma[nomagic]
-predicate liveThrough(BasicBlock bb, SourceVariable v) {
-  liveAtExit(bb, v) and
-  not ssaRef(bb, _, v, SsaDef())
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if the SSA definition of `v` at `def` reaches the end of basic
- * block `bb`, at which point it is still live, without crossing another
- * SSA definition of `v`.
- */
-pragma[nomagic]
-predicate ssaDefReachesEndOfBlock(BasicBlock bb, Definition def, SourceVariable v) {
-  exists(int last |
-    last = maxSsaRefRank(pragma[only_bind_into](bb), pragma[only_bind_into](v)) and
-    ssaDefReachesRank(bb, def, last, v) and
-    liveAtExit(bb, v)
-  )
-  or
-  // The construction of SSA form ensures that each read of a variable is
-  // dominated by its definition. An SSA definition therefore reaches a
-  // control flow node if it is the _closest_ SSA definition that dominates
-  // the node. If two definitions dominate a node then one must dominate the
-  // other, so therefore the definition of _closest_ is given by the dominator
-  // tree. Thus, reaching definitions can be calculated in terms of dominance.
-  ssaDefReachesEndOfBlock(getImmediateBasicBlockDominator(bb), def, pragma[only_bind_into](v)) and
-  liveThrough(bb, pragma[only_bind_into](v))
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if `inp` is an input to the phi node `phi` along the edge originating in `bb`.
- */
-pragma[nomagic]
-predicate phiHasInputFromBlock(PhiNode phi, Definition inp, BasicBlock bb) {
-  exists(SourceVariable v, BasicBlock bbDef |
-    phi.definesAt(v, bbDef, _) and
-    getABasicBlockPredecessor(bbDef) = bb and
-    ssaDefReachesEndOfBlock(bb, inp, v)
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if the SSA definition of `v` at `def` reaches a read at index `i` in
- * basic block `bb`, without crossing another SSA definition of `v`. The read
- * is of kind `rk`.
- */
-pragma[nomagic]
-predicate ssaDefReachesRead(SourceVariable v, Definition def, BasicBlock bb, int i) {
-  ssaDefReachesReadWithinBlock(v, def, bb, i)
-  or
-  ssaRef(bb, i, v, any(SsaRead k)) and
-  ssaDefReachesEndOfBlock(getABasicBlockPredecessor(bb), def, v) and
-  not ssaDefReachesReadWithinBlock(v, _, bb, i)
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if `def` is accessed at index `i1` in basic block `bb1` (either a read
- * or a write), `def` is read at index `i2` in basic block `bb2`, and there is a
- * path between them without any read of `def`.
- */
-pragma[nomagic]
-predicate adjacentDefRead(Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2) {
-  exists(int rnk |
-    rnk = ssaDefRank(def, _, bb1, i1, _) and
-    rnk + 1 = ssaDefRank(def, _, bb1, i2, SsaActualRead()) and
-    variableRead(bb1, i2, _, _) and
-    bb2 = bb1
-  )
-  or
-  lastSsaRef(def, _, bb1, i1) and
-  defAdjacentRead(def, bb1, bb2, i2)
-}
-
-pragma[noinline]
-private predicate adjacentDefRead(
-  Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2, SourceVariable v
-) {
-  adjacentDefRead(def, bb1, i1, bb2, i2) and
-  v = def.getSourceVariable()
-}
-
-private predicate adjacentDefReachesRead(
-  Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2
-) {
-  exists(SourceVariable v | adjacentDefRead(def, bb1, i1, bb2, i2, v) |
-    ssaRef(bb1, i1, v, SsaDef())
-    or
-    variableRead(bb1, i1, v, true)
-  )
-  or
-  exists(BasicBlock bb3, int i3 |
-    adjacentDefReachesRead(def, bb1, i1, bb3, i3) and
-    variableRead(bb3, i3, _, false) and
-    adjacentDefRead(def, bb3, i3, bb2, i2)
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Same as `adjacentDefRead`, but ignores uncertain reads.
- */
-pragma[nomagic]
-predicate adjacentDefNoUncertainReads(Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2) {
-  adjacentDefReachesRead(def, bb1, i1, bb2, i2) and
-  variableRead(bb2, i2, _, true)
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if the node at index `i` in `bb` is a last reference to SSA definition
- * `def`. The reference is last because it can reach another write `next`,
- * without passing through another read or write.
- */
-pragma[nomagic]
-predicate lastRefRedef(Definition def, BasicBlock bb, int i, Definition next) {
-  exists(SourceVariable v |
-    // Next reference to `v` inside `bb` is a write
-    exists(int rnk, int j |
-      rnk = ssaDefRank(def, v, bb, i, _) and
-      next.definesAt(v, bb, j) and
-      rnk + 1 = ssaRefRank(bb, j, v, SsaDef())
-    )
-    or
-    // Can reach a write using one or more steps
-    lastSsaRef(def, v, bb, i) and
-    exists(BasicBlock bb2 |
-      varBlockReaches(def, bb, bb2) and
-      1 = ssaDefRank(next, v, bb2, _, SsaDef())
-    )
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if `inp` is an immediately preceding definition of uncertain definition
- * `def`. Since `def` is uncertain, the value from the preceding definition might
- * still be valid.
- */
-pragma[nomagic]
-predicate uncertainWriteDefinitionInput(UncertainWriteDefinition def, Definition inp) {
-  lastRefRedef(inp, _, _, def)
-}
-
-private predicate adjacentDefReachesUncertainRead(
-  Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2
-) {
-  adjacentDefReachesRead(def, bb1, i1, bb2, i2) and
-  variableRead(bb2, i2, _, false)
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Same as `lastRefRedef`, but ignores uncertain reads.
- */
-pragma[nomagic]
-predicate lastRefRedefNoUncertainReads(Definition def, BasicBlock bb, int i, Definition next) {
-  lastRefRedef(def, bb, i, next) and
-  not variableRead(bb, i, def.getSourceVariable(), false)
-  or
-  exists(BasicBlock bb0, int i0 |
-    lastRefRedef(def, bb0, i0, next) and
-    adjacentDefReachesUncertainRead(def, bb, i, bb0, i0)
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if the node at index `i` in `bb` is a last reference to SSA
- * definition `def`.
- *
- * That is, the node can reach the end of the enclosing callable, or another
- * SSA definition for the underlying source variable, without passing through
- * another read.
- */
-pragma[nomagic]
-predicate lastRef(Definition def, BasicBlock bb, int i) {
-  // Can reach another definition
-  lastRefRedef(def, bb, i, _)
-  or
-  exists(SourceVariable v | lastSsaRef(def, v, bb, i) |
-    // Can reach exit directly
-    bb instanceof ExitBasicBlock
-    or
-    // Can reach a block using one or more steps, where `def` is no longer live
-    varBlockReachesExit(def, bb)
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Same as `lastRefRedef`, but ignores uncertain reads.
- */
-pragma[nomagic]
-predicate lastRefNoUncertainReads(Definition def, BasicBlock bb, int i) {
-  lastRef(def, bb, i) and
-  not variableRead(bb, i, def.getSourceVariable(), false)
-  or
-  exists(BasicBlock bb0, int i0 |
-    lastRef(def, bb0, i0) and
-    adjacentDefReachesUncertainRead(def, bb, i, bb0, i0)
-  )
-}
-
-/** A static single assignment (SSA) definition. */
-class Definition extends TDefinition {
-  /** Gets the source variable underlying this SSA definition. */
-  SourceVariable getSourceVariable() { this.definesAt(result, _, _) }
-
-  /**
-   * Holds if this SSA definition defines `v` at index `i` in basic block `bb`.
-   * Phi nodes are considered to be at index `-1`, while normal variable writes
-   * are at the index of the control flow node they wrap.
-   */
-  final predicate definesAt(SourceVariable v, BasicBlock bb, int i) {
-    this = TWriteDef(v, bb, i)
-    or
-    this = TPhiNode(v, bb) and i = -1
-  }
-
-  /** Gets the basic block to which this SSA definition belongs. */
-  final BasicBlock getBasicBlock() { this.definesAt(_, result, _) }
-
-  /** Gets a textual representation of this SSA definition. */
-  string toString() { none() }
-}
-
-/** An SSA definition that corresponds to a write. */
-class WriteDefinition extends Definition, TWriteDef {
-  private SourceVariable v;
-  private BasicBlock bb;
-  private int i;
-
-  WriteDefinition() { this = TWriteDef(v, bb, i) }
-
-  override string toString() { result = "WriteDef" }
-}
-
-/** A phi node. */
-class PhiNode extends Definition, TPhiNode {
-  override string toString() { result = "Phi" }
-}
-
-/**
- * An SSA definition that represents an uncertain update of the underlying
- * source variable.
- */
-class UncertainWriteDefinition extends WriteDefinition {
-  UncertainWriteDefinition() {
-    exists(SourceVariable v, BasicBlock bb, int i |
-      this.definesAt(v, bb, i) and
-      variableWrite(bb, i, v, false)
-    )
-  }
-}
-
-/** Provides a set of consistency queries. */
-module Consistency {
-  abstract class RelevantDefinition extends Definition {
-    abstract predicate hasLocationInfo(
-      string filepath, int startline, int startcolumn, int endline, int endcolumn
-    );
-  }
-
-  query predicate nonUniqueDef(RelevantDefinition def, SourceVariable v, BasicBlock bb, int i) {
-    ssaDefReachesRead(v, def, bb, i) and
-    not exists(unique(Definition def0 | ssaDefReachesRead(v, def0, bb, i)))
-  }
-
-  query predicate readWithoutDef(SourceVariable v, BasicBlock bb, int i) {
-    variableRead(bb, i, v, _) and
-    not ssaDefReachesRead(v, _, bb, i)
-  }
-
-  query predicate deadDef(RelevantDefinition def, SourceVariable v) {
-    v = def.getSourceVariable() and
-    not ssaDefReachesRead(_, def, _, _) and
-    not phiHasInputFromBlock(_, def, _) and
-    not uncertainWriteDefinitionInput(_, def)
-  }
-
-  query predicate notDominatedByDef(RelevantDefinition def, SourceVariable v, BasicBlock bb, int i) {
-    exists(BasicBlock bbDef, int iDef | def.definesAt(v, bbDef, iDef) |
-      ssaDefReachesReadWithinBlock(v, def, bb, i) and
-      (bb != bbDef or i < iDef)
-      or
-      ssaDefReachesRead(v, def, bb, i) and
-      not ssaDefReachesReadWithinBlock(v, def, bb, i) and
-      not def.definesAt(v, getImmediateBasicBlockDominator*(bb), _)
-    )
-  }
-}

csharp/ql/lib/semmle/code/csharp/controlflow/internal/pressa/SsaImplSpecific.qll

@@ -1,130 +0,0 @@
-/** Provides the C# specific parameters for `SsaImplCommon.qll`. */
-
-private import csharp
-private import AssignableDefinitions
-private import semmle.code.csharp.controlflow.internal.PreBasicBlocks as PreBasicBlocks
-private import semmle.code.csharp.controlflow.internal.ControlFlowGraphImpl
-
-class BasicBlock = PreBasicBlocks::PreBasicBlock;
-
-BasicBlock getImmediateBasicBlockDominator(BasicBlock bb) { result.immediatelyDominates(bb) }
-
-BasicBlock getABasicBlockSuccessor(BasicBlock bb) { result = bb.getASuccessor() }
-
-class ExitBasicBlock extends BasicBlock {
-  ExitBasicBlock() { scopeLast(_, this.getLastElement(), _) }
-}
-
-/** Holds if `a` is assigned in non-constructor callable `c`. */
-pragma[nomagic]
-private predicate assignableDefinition(Assignable a, Callable c) {
-  exists(AssignableDefinition def | def.getTarget() = a |
-    c = def.getEnclosingCallable() and
-    not c instanceof Constructor
-  )
-}
-
-/** Holds if `a` is accessed in callable `c`. */
-pragma[nomagic]
-private predicate assignableAccess(Assignable a, Callable c) {
-  exists(AssignableAccess aa | aa.getTarget() = a | c = aa.getEnclosingCallable())
-}
-
-pragma[nomagic]
-private predicate assignableNoCapturing(Assignable a, Callable c) {
-  assignableAccess(a, c) and
-  /*
-   * The code below is equivalent to
-   * ```ql
-   * not exists(Callable other | assignableDefinition(a, other) | other != c)
-   * ```
-   * but it avoids a Cartesian product in the compiler generated antijoin
-   * predicate.
-   */
-
-  (
-    not assignableDefinition(a, _)
-    or
-    c = unique(Callable c0 | assignableDefinition(a, c0) | c0)
-  )
-}
-
-pragma[noinline]
-private predicate assignableNoComplexQualifiers(Assignable a) {
-  forall(QualifiableExpr qe | qe.(AssignableAccess).getTarget() = a | qe.targetIsThisInstance())
-}
-
-/**
- * A simple assignable. Either a local scope variable or a field/property
- * that behaves like a local scope variable.
- */
-class SourceVariable extends Assignable {
-  private Callable c;
-
-  SourceVariable() {
-    (
-      this instanceof LocalScopeVariable
-      or
-      this = any(Field f | not f.isVolatile())
-      or
-      this = any(TrivialProperty tp | not tp.isOverridableOrImplementable())
-    ) and
-    assignableNoCapturing(this, c) and
-    assignableNoComplexQualifiers(this)
-  }
-
-  /** Gets a callable in which this simple assignable can be analyzed. */
-  Callable getACallable() { result = c }
-}
-
-predicate definitionAt(AssignableDefinition def, BasicBlock bb, int i, SourceVariable v) {
-  bb.getElement(i) = def.getExpr() and
-  v = def.getTarget() and
-  // In cases like `(x, x) = (0, 1)`, we discard the first (dead) definition of `x`
-  not exists(TupleAssignmentDefinition first, TupleAssignmentDefinition second | first = def |
-    second.getAssignment() = first.getAssignment() and
-    second.getEvaluationOrder() > first.getEvaluationOrder() and
-    second.getTarget() = v
-  )
-  or
-  def.(ImplicitParameterDefinition).getParameter() = v and
-  exists(Callable c | v = c.getAParameter() |
-    scopeFirst(c, bb) and
-    i = -1
-  )
-}
-
-predicate implicitEntryDef(Callable c, BasicBlock bb, SourceVariable v) {
-  not v instanceof LocalScopeVariable and
-  c = v.getACallable() and
-  scopeFirst(c, bb)
-}
-
-predicate variableWrite(BasicBlock bb, int i, SourceVariable v, boolean certain) {
-  exists(AssignableDefinition def |
-    definitionAt(def, bb, i, v) and
-    if def.getTargetAccess().isRefArgument() then certain = false else certain = true
-  )
-  or
-  exists(Callable c |
-    implicitEntryDef(c, bb, v) and
-    i = -1 and
-    certain = true
-  )
-}
-
-predicate variableRead(BasicBlock bb, int i, SourceVariable v, boolean certain) {
-  exists(AssignableRead read |
-    read = bb.getElement(i) and
-    read.getTarget() = v and
-    certain = true
-  )
-  or
-  v =
-    any(LocalScopeVariable lsv |
-      lsv.getCallable() = bb.(ExitBasicBlock).getEnclosingCallable() and
-      i = bb.length() and
-      (lsv.isRef() or v.(Parameter).isOut()) and
-      certain = false
-    )
-}

csharp/ql/lib/semmle/code/csharp/dataflow/ExternalFlow.qll

@@ -12,6 +12,8 @@
  *   `namespace; type; subtypes; name; signature; ext; input; output; kind; provenance`
  * - Negative Summaries:
  *   `namespace; type; name; signature; provenance`
+ *   A negative summary is used to indicate that there is no flow via a callable.
+ *
  * The interpretation of a row is similar to API-graphs with a left-to-right
  * reading.
  * 1. The `namespace` column selects a namespace.

csharp/ql/lib/semmle/code/csharp/dataflow/internal/BaseSSA.qll

@@ -4,19 +4,74 @@ import csharp
  * Provides a simple SSA implementation for local scope variables.
  */
 module BaseSsa {
-  import basessa.SsaImplSpecific
-  private import basessa.SsaImplCommon as SsaImpl
+  private import AssignableDefinitions
+  private import semmle.code.csharp.dataflow.internal.SsaImplCommon as SsaImplCommon
+
+  /**
+   * Holds if the `i`th node of basic block `bb` is assignable definition `def`,
+   * targeting local scope variable `v`.
+   */
+  private predicate definitionAt(
+    AssignableDefinition def, ControlFlow::BasicBlock bb, int i, SsaInput::SourceVariable v
+  ) {
+    bb.getNode(i) = def.getAControlFlowNode() and
+    v = def.getTarget() and
+    // In cases like `(x, x) = (0, 1)`, we discard the first (dead) definition of `x`
+    not exists(TupleAssignmentDefinition first, TupleAssignmentDefinition second | first = def |
+      second.getAssignment() = first.getAssignment() and
+      second.getEvaluationOrder() > first.getEvaluationOrder() and
+      second.getTarget() = v
+    )
+  }
+
+  private module SsaInput implements SsaImplCommon::InputSig {
+    class BasicBlock = ControlFlow::BasicBlock;
+
+    BasicBlock getImmediateBasicBlockDominator(BasicBlock bb) {
+      result = bb.getImmediateDominator()
+    }
+
+    BasicBlock getABasicBlockSuccessor(BasicBlock bb) { result = bb.getASuccessor() }
+
+    class ExitBasicBlock = ControlFlow::BasicBlocks::ExitBlock;
+
+    pragma[noinline]
+    private Callable getAnAssigningCallable(LocalScopeVariable v) {
+      result = any(AssignableDefinition def | def.getTarget() = v).getEnclosingCallable()
+    }
+
+    class SourceVariable extends LocalScopeVariable {
+      SourceVariable() { not getAnAssigningCallable(this) != getAnAssigningCallable(this) }
+    }
+
+    predicate variableWrite(BasicBlock bb, int i, SourceVariable v, boolean certain) {
+      exists(AssignableDefinition def |
+        definitionAt(def, bb, i, v) and
+        if def.isCertain() then certain = true else certain = false
+      )
+    }
+
+    predicate variableRead(BasicBlock bb, int i, SourceVariable v, boolean certain) {
+      exists(AssignableRead read |
+        read.getAControlFlowNode() = bb.getNode(i) and
+        read.getTarget() = v and
+        certain = true
+      )
+    }
+  }
+
+  private module SsaImpl = SsaImplCommon::Make<SsaInput>;
 
   class Definition extends SsaImpl::Definition {
     final AssignableRead getARead() {
-      exists(BasicBlock bb, int i |
+      exists(ControlFlow::BasicBlock bb, int i |
         SsaImpl::ssaDefReachesRead(_, this, bb, i) and
         result.getAControlFlowNode() = bb.getNode(i)
       )
     }
 
     final AssignableDefinition getDefinition() {
-      exists(BasicBlock bb, int i, SourceVariable v |
+      exists(ControlFlow::BasicBlock bb, int i, SsaInput::SourceVariable v |
         this.definesAt(v, bb, i) and
         definitionAt(result, bb, i, v)
       )

csharp/ql/lib/semmle/code/csharp/dataflow/internal/SsaImpl.qll

@@ -3,7 +3,53 @@
  */
 
 import csharp
-import SsaImplCommon
+private import SsaImplCommon as SsaImplCommon
+private import AssignableDefinitions
+
+private module SsaInput implements SsaImplCommon::InputSig {
+  class BasicBlock = ControlFlow::BasicBlock;
+
+  BasicBlock getImmediateBasicBlockDominator(BasicBlock bb) { result = bb.getImmediateDominator() }
+
+  BasicBlock getABasicBlockSuccessor(BasicBlock bb) { result = bb.getASuccessor() }
+
+  class ExitBasicBlock = ControlFlow::BasicBlocks::ExitBlock;
+
+  class SourceVariable = Ssa::SourceVariable;
+
+  /**
+   * Holds if the `i`th node of basic block `bb` is a (potential) write to source
+   * variable `v`. The Boolean `certain` indicates whether the write is certain.
+   *
+   * This includes implicit writes via calls.
+   */
+  predicate variableWrite(ControlFlow::BasicBlock bb, int i, Ssa::SourceVariable v, boolean certain) {
+    variableWriteDirect(bb, i, v, certain)
+    or
+    variableWriteQualifier(bb, i, v, certain)
+    or
+    updatesNamedFieldOrProp(bb, i, _, v, _) and
+    certain = false
+    or
+    updatesCapturedVariable(bb, i, _, v, _, _) and
+    certain = false
+  }
+
+  /**
+   * Holds if the `i`th of basic block `bb` reads source variable `v`.
+   *
+   * This includes implicit reads via calls.
+   */
+  predicate variableRead(ControlFlow::BasicBlock bb, int i, Ssa::SourceVariable v, boolean certain) {
+    variableReadActual(bb, i, v) and
+    certain = true
+    or
+    variableReadPseudo(bb, i, v) and
+    certain = false
+  }
+}
+
+import SsaImplCommon::Make<SsaInput>
 
 /**
  * Holds if the `i`th node of basic block `bb` reads source variable `v`.
@@ -805,24 +851,6 @@ private module CapturedVariableImpl {
   }
 }
 
-/**
- * Holds if the `i`th node of basic block `bb` is a (potential) write to source
- * variable `v`. The Boolean `certain` indicates whether the write is certain.
- *
- * This includes implicit writes via calls.
- */
-predicate variableWrite(ControlFlow::BasicBlock bb, int i, Ssa::SourceVariable v, boolean certain) {
-  variableWriteDirect(bb, i, v, certain)
-  or
-  variableWriteQualifier(bb, i, v, certain)
-  or
-  updatesNamedFieldOrProp(bb, i, _, v, _) and
-  certain = false
-  or
-  updatesCapturedVariable(bb, i, _, v, _, _) and
-  certain = false
-}
-
 /**
  * Liveness analysis to restrict the size of the SSA representation for
  * captured variables.
@@ -1039,19 +1067,6 @@ private predicate variableReadPseudo(ControlFlow::BasicBlock bb, int i, Ssa::Sou
   capturedReadIn(bb, i, v, _, _, _)
 }
 
-/**
- * Holds if the `i`th of basic block `bb` reads source variable `v`.
- *
- * This includes implicit reads via calls.
- */
-predicate variableRead(ControlFlow::BasicBlock bb, int i, Ssa::SourceVariable v, boolean certain) {
-  variableReadActual(bb, i, v) and
-  certain = true
-  or
-  variableReadPseudo(bb, i, v) and
-  certain = false
-}
-
 cached
 private module Cached {
   cached
@@ -1151,7 +1166,7 @@ private module Cached {
   predicate variableWriteQualifier(
     ControlFlow::BasicBlock bb, int i, QualifiedFieldOrPropSourceVariable v, boolean certain
   ) {
-    variableWrite(bb, i, v.getQualifier(), certain) and
+    SsaInput::variableWrite(bb, i, v.getQualifier(), certain) and
     // Eliminate corner case where a call definition can overlap with a
     // qualifier definition: if method `M` updates field `F`, then a call
     // to `M` is both an update of `x.M` and `x.M.M`, so the former call

csharp/ql/lib/semmle/code/csharp/dataflow/internal/SsaImplSpecific.qll

@@ -1,19 +0,0 @@
-/** Provides the C# specific parameters for `SsaImplCommon.qll`. */
-
-private import csharp
-private import AssignableDefinitions
-private import SsaImpl as SsaImpl
-
-class BasicBlock = ControlFlow::BasicBlock;
-
-BasicBlock getImmediateBasicBlockDominator(BasicBlock bb) { result = bb.getImmediateDominator() }
-
-BasicBlock getABasicBlockSuccessor(BasicBlock bb) { result = bb.getASuccessor() }
-
-class ExitBasicBlock = ControlFlow::BasicBlocks::ExitBlock;
-
-class SourceVariable = Ssa::SourceVariable;
-
-predicate variableWrite = SsaImpl::variableWrite/4;
-
-predicate variableRead = SsaImpl::variableRead/4;

csharp/ql/lib/semmle/code/csharp/dataflow/internal/basessa/SsaImplCommon.qll

@@ -1,795 +0,0 @@
-/**
- * Provides a language-independent implementation of static single assignment
- * (SSA) form.
- */
-
-private import SsaImplSpecific
-
-private BasicBlock getABasicBlockPredecessor(BasicBlock bb) { getABasicBlockSuccessor(result) = bb }
-
-/**
- * Liveness analysis (based on source variables) to restrict the size of the
- * SSA representation.
- */
-private module Liveness {
-  /**
-   * A classification of variable references into reads (of a given kind) and
-   * (certain or uncertain) writes.
-   */
-  private newtype TRefKind =
-    Read(boolean certain) { certain in [false, true] } or
-    Write(boolean certain) { certain in [false, true] }
-
-  private class RefKind extends TRefKind {
-    string toString() {
-      exists(boolean certain | this = Read(certain) and result = "read (" + certain + ")")
-      or
-      exists(boolean certain | this = Write(certain) and result = "write (" + certain + ")")
-    }
-
-    int getOrder() {
-      this = Read(_) and
-      result = 0
-      or
-      this = Write(_) and
-      result = 1
-    }
-  }
-
-  /**
-   * Holds if the `i`th node of basic block `bb` is a reference to `v` of kind `k`.
-   */
-  predicate ref(BasicBlock bb, int i, SourceVariable v, RefKind k) {
-    exists(boolean certain | variableRead(bb, i, v, certain) | k = Read(certain))
-    or
-    exists(boolean certain | variableWrite(bb, i, v, certain) | k = Write(certain))
-  }
-
-  private newtype OrderedRefIndex =
-    MkOrderedRefIndex(int i, int tag) {
-      exists(RefKind rk | ref(_, i, _, rk) | tag = rk.getOrder())
-    }
-
-  private OrderedRefIndex refOrd(BasicBlock bb, int i, SourceVariable v, RefKind k, int ord) {
-    ref(bb, i, v, k) and
-    result = MkOrderedRefIndex(i, ord) and
-    ord = k.getOrder()
-  }
-
-  /**
-   * Gets the (1-based) rank of the reference to `v` at the `i`th node of
-   * basic block `bb`, which has the given reference kind `k`.
-   *
-   * Reads are considered before writes when they happen at the same index.
-   */
-  private int refRank(BasicBlock bb, int i, SourceVariable v, RefKind k) {
-    refOrd(bb, i, v, k, _) =
-      rank[result](int j, int ord, OrderedRefIndex res |
-        res = refOrd(bb, j, v, _, ord)
-      |
-        res order by j, ord
-      )
-  }
-
-  private int maxRefRank(BasicBlock bb, SourceVariable v) {
-    result = refRank(bb, _, v, _) and
-    not result + 1 = refRank(bb, _, v, _)
-  }
-
-  predicate lastRefIsRead(BasicBlock bb, SourceVariable v) {
-    maxRefRank(bb, v) = refRank(bb, _, v, Read(_))
-  }
-
-  /**
-   * Gets the (1-based) rank of the first reference to `v` inside basic block `bb`
-   * that is either a read or a certain write.
-   */
-  private int firstReadOrCertainWrite(BasicBlock bb, SourceVariable v) {
-    result =
-      min(int r, RefKind k |
-        r = refRank(bb, _, v, k) and
-        k != Write(false)
-      |
-        r
-      )
-  }
-
-  /**
-   * Holds if source variable `v` is live at the beginning of basic block `bb`.
-   */
-  predicate liveAtEntry(BasicBlock bb, SourceVariable v) {
-    // The first read or certain write to `v` inside `bb` is a read
-    refRank(bb, _, v, Read(_)) = firstReadOrCertainWrite(bb, v)
-    or
-    // There is no certain write to `v` inside `bb`, but `v` is live at entry
-    // to a successor basic block of `bb`
-    not exists(firstReadOrCertainWrite(bb, v)) and
-    liveAtExit(bb, v)
-  }
-
-  /**
-   * Holds if source variable `v` is live at the end of basic block `bb`.
-   */
-  predicate liveAtExit(BasicBlock bb, SourceVariable v) {
-    liveAtEntry(getABasicBlockSuccessor(bb), v)
-  }
-
-  /**
-   * Holds if variable `v` is live in basic block `bb` at index `i`.
-   * The rank of `i` is `rnk` as defined by `refRank()`.
-   */
-  private predicate liveAtRank(BasicBlock bb, int i, SourceVariable v, int rnk) {
-    exists(RefKind kind | rnk = refRank(bb, i, v, kind) |
-      rnk = maxRefRank(bb, v) and
-      liveAtExit(bb, v)
-      or
-      ref(bb, i, v, kind) and
-      kind = Read(_)
-      or
-      exists(RefKind nextKind |
-        liveAtRank(bb, _, v, rnk + 1) and
-        rnk + 1 = refRank(bb, _, v, nextKind) and
-        nextKind != Write(true)
-      )
-    )
-  }
-
-  /**
-   * Holds if variable `v` is live after the (certain or uncertain) write at
-   * index `i` inside basic block `bb`.
-   */
-  predicate liveAfterWrite(BasicBlock bb, int i, SourceVariable v) {
-    exists(int rnk | rnk = refRank(bb, i, v, Write(_)) | liveAtRank(bb, i, v, rnk))
-  }
-}
-
-private import Liveness
-
-/**
- * Holds if `df` is in the dominance frontier of `bb`.
- *
- * This is equivalent to:
- *
- * ```ql
- * bb = getImmediateBasicBlockDominator*(getABasicBlockPredecessor(df)) and
- * not bb = getImmediateBasicBlockDominator+(df)
- * ```
- */
-private predicate inDominanceFrontier(BasicBlock bb, BasicBlock df) {
-  bb = getABasicBlockPredecessor(df) and not bb = getImmediateBasicBlockDominator(df)
-  or
-  exists(BasicBlock prev | inDominanceFrontier(prev, df) |
-    bb = getImmediateBasicBlockDominator(prev) and
-    not bb = getImmediateBasicBlockDominator(df)
-  )
-}
-
-/**
- * Holds if `bb` is in the dominance frontier of a block containing a
- * definition of `v`.
- */
-pragma[noinline]
-private predicate inDefDominanceFrontier(BasicBlock bb, SourceVariable v) {
-  exists(BasicBlock defbb, Definition def |
-    def.definesAt(v, defbb, _) and
-    inDominanceFrontier(defbb, bb)
-  )
-}
-
-cached
-newtype TDefinition =
-  TWriteDef(SourceVariable v, BasicBlock bb, int i) {
-    variableWrite(bb, i, v, _) and
-    liveAfterWrite(bb, i, v)
-  } or
-  TPhiNode(SourceVariable v, BasicBlock bb) {
-    inDefDominanceFrontier(bb, v) and
-    liveAtEntry(bb, v)
-  }
-
-private module SsaDefReaches {
-  newtype TSsaRefKind =
-    SsaActualRead() or
-    SsaPhiRead() or
-    SsaDef()
-
-  class SsaRead = SsaActualRead or SsaPhiRead;
-
-  /**
-   * A classification of SSA variable references into reads and definitions.
-   */
-  class SsaRefKind extends TSsaRefKind {
-    string toString() {
-      this = SsaActualRead() and
-      result = "SsaActualRead"
-      or
-      this = SsaPhiRead() and
-      result = "SsaPhiRead"
-      or
-      this = SsaDef() and
-      result = "SsaDef"
-    }
-
-    int getOrder() {
-      this instanceof SsaRead and
-      result = 0
-      or
-      this = SsaDef() and
-      result = 1
-    }
-  }
-
-  /**
-   * Holds if `bb` is in the dominance frontier of a block containing a
-   * read of `v`.
-   */
-  pragma[nomagic]
-  private predicate inReadDominanceFrontier(BasicBlock bb, SourceVariable v) {
-    exists(BasicBlock readbb | inDominanceFrontier(readbb, bb) |
-      lastRefIsRead(readbb, v)
-      or
-      phiRead(readbb, v)
-    )
-  }
-
-  /**
-   * Holds if a phi-read node should be inserted for variable `v` at the beginning
-   * of basic block `bb`.
-   *
-   * Phi-read nodes are like normal phi nodes, but they are inserted based on reads
-   * instead of writes, and only if the dominance-frontier block does not already
-   * contain a reference (read or write) to `v`. Unlike normal phi nodes, this is
-   * an internal implementation detail that is not exposed.
-   *
-   * The motivation for adding phi-reads is to improve performance of the use-use
-   * calculation in cases where there is a large number of reads that can reach the
-   * same join-point, and from there reach a large number of basic blocks. Example:
-   *
-   * ```cs
-   * if (a)
-   *   use(x);
-   * else if (b)
-   *   use(x);
-   * else if (c)
-   *   use(x);
-   * else if (d)
-   *   use(x);
-   * // many more ifs ...
-   *
-   * // phi-read for `x` inserted here
-   *
-   * // program not mentioning `x`, with large basic block graph
-   *
-   * use(x);
-   * ```
-   *
-   * Without phi-reads, the analysis has to replicate reachability for each of
-   * the guarded uses of `x`. However, with phi-reads, the analysis will limit
-   * each conditional use of `x` to reach the basic block containing the phi-read
-   * node for `x`, and only that basic block will have to compute reachability
-   * through the remainder of the large program.
-   *
-   * Like normal reads, each phi-read node `phi-read` can be reached from exactly
-   * one SSA definition (without passing through another definition): Assume, for
-   * the sake of contradiction, that there are two reaching definitions `def1` and
-   * `def2`. Now, if both `def1` and `def2` dominate `phi-read`, then the nearest
-   * dominating definition will prevent the other from reaching `phi-read`. So, at
-   * least one of `def1` and `def2` cannot dominate `phi-read`; assume it is `def1`.
-   * Then `def1` must go through one of its dominance-frontier blocks in order to
-   * reach `phi-read`. However, such a block will always start with a (normal) phi
-   * node, which contradicts reachability.
-   *
-   * Also, like normal reads, the unique SSA definition `def` that reaches `phi-read`,
-   * will dominate `phi-read`. Assuming it doesn't means that the path from `def`
-   * to `phi-read` goes through a dominance-frontier block, and hence a phi node,
-   * which contradicts reachability.
-   */
-  pragma[nomagic]
-  predicate phiRead(BasicBlock bb, SourceVariable v) {
-    inReadDominanceFrontier(bb, v) and
-    liveAtEntry(bb, v) and
-    // only if there are no other references to `v` inside `bb`
-    not ref(bb, _, v, _) and
-    not exists(Definition def | def.definesAt(v, bb, _))
-  }
-
-  /**
-   * Holds if the `i`th node of basic block `bb` is a reference to `v`,
-   * either a read (when `k` is `SsaRead()`) or an SSA definition (when `k`
-   * is `SsaDef()`).
-   *
-   * Unlike `Liveness::ref`, this includes `phi` nodes.
-   */
-  pragma[nomagic]
-  predicate ssaRef(BasicBlock bb, int i, SourceVariable v, SsaRefKind k) {
-    variableRead(bb, i, v, _) and
-    k = SsaActualRead()
-    or
-    phiRead(bb, v) and
-    i = -1 and
-    k = SsaPhiRead()
-    or
-    any(Definition def).definesAt(v, bb, i) and
-    k = SsaDef()
-  }
-
-  private newtype OrderedSsaRefIndex =
-    MkOrderedSsaRefIndex(int i, SsaRefKind k) { ssaRef(_, i, _, k) }
-
-  private OrderedSsaRefIndex ssaRefOrd(BasicBlock bb, int i, SourceVariable v, SsaRefKind k, int ord) {
-    ssaRef(bb, i, v, k) and
-    result = MkOrderedSsaRefIndex(i, k) and
-    ord = k.getOrder()
-  }
-
-  /**
-   * Gets the (1-based) rank of the reference to `v` at the `i`th node of basic
-   * block `bb`, which has the given reference kind `k`.
-   *
-   * For example, if `bb` is a basic block with a phi node for `v` (considered
-   * to be at index -1), reads `v` at node 2, and defines it at node 5, we have:
-   *
-   * ```ql
-   * ssaRefRank(bb, -1, v, SsaDef()) = 1    // phi node
-   * ssaRefRank(bb,  2, v, Read())   = 2    // read at node 2
-   * ssaRefRank(bb,  5, v, SsaDef()) = 3    // definition at node 5
-   * ```
-   *
-   * Reads are considered before writes when they happen at the same index.
-   */
-  int ssaRefRank(BasicBlock bb, int i, SourceVariable v, SsaRefKind k) {
-    ssaRefOrd(bb, i, v, k, _) =
-      rank[result](int j, int ord, OrderedSsaRefIndex res |
-        res = ssaRefOrd(bb, j, v, _, ord)
-      |
-        res order by j, ord
-      )
-  }
-
-  int maxSsaRefRank(BasicBlock bb, SourceVariable v) {
-    result = ssaRefRank(bb, _, v, _) and
-    not result + 1 = ssaRefRank(bb, _, v, _)
-  }
-
-  /**
-   * Holds if the SSA definition `def` reaches rank index `rnk` in its own
-   * basic block `bb`.
-   */
-  predicate ssaDefReachesRank(BasicBlock bb, Definition def, int rnk, SourceVariable v) {
-    exists(int i |
-      rnk = ssaRefRank(bb, i, v, SsaDef()) and
-      def.definesAt(v, bb, i)
-    )
-    or
-    ssaDefReachesRank(bb, def, rnk - 1, v) and
-    rnk = ssaRefRank(bb, _, v, any(SsaRead k))
-  }
-
-  /**
-   * Holds if the SSA definition of `v` at `def` reaches index `i` in the same
-   * basic block `bb`, without crossing another SSA definition of `v`.
-   */
-  predicate ssaDefReachesReadWithinBlock(SourceVariable v, Definition def, BasicBlock bb, int i) {
-    exists(int rnk |
-      ssaDefReachesRank(bb, def, rnk, v) and
-      rnk = ssaRefRank(bb, i, v, any(SsaRead k))
-    )
-  }
-
-  /**
-   * Same as `ssaRefRank()`, but restricted to a particular SSA definition `def`.
-   */
-  int ssaDefRank(Definition def, SourceVariable v, BasicBlock bb, int i, SsaRefKind k) {
-    v = def.getSourceVariable() and
-    result = ssaRefRank(bb, i, v, k) and
-    (
-      ssaDefReachesRead(_, def, bb, i)
-      or
-      def.definesAt(_, bb, i)
-    )
-  }
-
-  /**
-   * Holds if the reference to `def` at index `i` in basic block `bb` is the
-   * last reference to `v` inside `bb`.
-   */
-  pragma[noinline]
-  predicate lastSsaRef(Definition def, SourceVariable v, BasicBlock bb, int i) {
-    ssaDefRank(def, v, bb, i, _) = maxSsaRefRank(bb, v)
-  }
-
-  predicate defOccursInBlock(Definition def, BasicBlock bb, SourceVariable v, SsaRefKind k) {
-    exists(ssaDefRank(def, v, bb, _, k))
-  }
-
-  pragma[noinline]
-  private predicate ssaDefReachesThroughBlock(Definition def, BasicBlock bb) {
-    ssaDefReachesEndOfBlock(bb, def, _) and
-    not defOccursInBlock(_, bb, def.getSourceVariable(), _)
-  }
-
-  /**
-   * Holds if `def` is accessed in basic block `bb1` (either a read or a write),
-   * `bb2` is a transitive successor of `bb1`, `def` is live at the end of _some_
-   * predecessor of `bb2`, and the underlying variable for `def` is neither read
-   * nor written in any block on the path between `bb1` and `bb2`.
-   *
-   * Phi reads are considered as normal reads for this predicate.
-   */
-  pragma[nomagic]
-  private predicate varBlockReachesInclPhiRead(Definition def, BasicBlock bb1, BasicBlock bb2) {
-    defOccursInBlock(def, bb1, _, _) and
-    bb2 = getABasicBlockSuccessor(bb1)
-    or
-    exists(BasicBlock mid |
-      varBlockReachesInclPhiRead(def, bb1, mid) and
-      ssaDefReachesThroughBlock(def, mid) and
-      bb2 = getABasicBlockSuccessor(mid)
-    )
-  }
-
-  pragma[nomagic]
-  private predicate phiReadStep(Definition def, SourceVariable v, BasicBlock bb1, BasicBlock bb2) {
-    varBlockReachesInclPhiRead(def, bb1, bb2) and
-    defOccursInBlock(def, bb2, v, SsaPhiRead())
-  }
-
-  pragma[nomagic]
-  private predicate varBlockReachesExclPhiRead(Definition def, BasicBlock bb1, BasicBlock bb2) {
-    varBlockReachesInclPhiRead(pragma[only_bind_into](def), bb1, pragma[only_bind_into](bb2)) and
-    ssaRef(bb2, _, def.getSourceVariable(), [SsaActualRead().(TSsaRefKind), SsaDef()])
-    or
-    exists(BasicBlock mid |
-      varBlockReachesExclPhiRead(def, mid, bb2) and
-      phiReadStep(def, _, bb1, mid)
-    )
-  }
-
-  /**
-   * Holds if `def` is accessed in basic block `bb1` (either a read or a write),
-   * the underlying variable `v` of `def` is accessed in basic block `bb2`
-   * (either a read or a write), `bb2` is a transitive successor of `bb1`, and
-   * `v` is neither read nor written in any block on the path between `bb1`
-   * and `bb2`.
-   */
-  pragma[nomagic]
-  predicate varBlockReaches(Definition def, BasicBlock bb1, BasicBlock bb2) {
-    varBlockReachesExclPhiRead(def, bb1, bb2) and
-    not defOccursInBlock(def, bb1, _, SsaPhiRead())
-  }
-
-  pragma[nomagic]
-  predicate defAdjacentRead(Definition def, BasicBlock bb1, BasicBlock bb2, int i2) {
-    varBlockReaches(def, bb1, bb2) and
-    ssaRefRank(bb2, i2, def.getSourceVariable(), SsaActualRead()) = 1
-  }
-
-  /**
-   * Holds if `def` is accessed in basic block `bb` (either a read or a write),
-   * `bb1` can reach a transitive successor `bb2` where `def` is no longer live,
-   * and `v` is neither read nor written in any block on the path between `bb`
-   * and `bb2`.
-   */
-  pragma[nomagic]
-  predicate varBlockReachesExit(Definition def, BasicBlock bb) {
-    exists(BasicBlock bb2 | varBlockReachesInclPhiRead(def, bb, bb2) |
-      not defOccursInBlock(def, bb2, _, _) and
-      not ssaDefReachesEndOfBlock(bb2, def, _)
-    )
-    or
-    exists(BasicBlock mid |
-      varBlockReachesExit(def, mid) and
-      phiReadStep(def, _, bb, mid)
-    )
-  }
-}
-
-predicate phiReadExposedForTesting = phiRead/2;
-
-private import SsaDefReaches
-
-pragma[nomagic]
-predicate liveThrough(BasicBlock bb, SourceVariable v) {
-  liveAtExit(bb, v) and
-  not ssaRef(bb, _, v, SsaDef())
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if the SSA definition of `v` at `def` reaches the end of basic
- * block `bb`, at which point it is still live, without crossing another
- * SSA definition of `v`.
- */
-pragma[nomagic]
-predicate ssaDefReachesEndOfBlock(BasicBlock bb, Definition def, SourceVariable v) {
-  exists(int last |
-    last = maxSsaRefRank(pragma[only_bind_into](bb), pragma[only_bind_into](v)) and
-    ssaDefReachesRank(bb, def, last, v) and
-    liveAtExit(bb, v)
-  )
-  or
-  // The construction of SSA form ensures that each read of a variable is
-  // dominated by its definition. An SSA definition therefore reaches a
-  // control flow node if it is the _closest_ SSA definition that dominates
-  // the node. If two definitions dominate a node then one must dominate the
-  // other, so therefore the definition of _closest_ is given by the dominator
-  // tree. Thus, reaching definitions can be calculated in terms of dominance.
-  ssaDefReachesEndOfBlock(getImmediateBasicBlockDominator(bb), def, pragma[only_bind_into](v)) and
-  liveThrough(bb, pragma[only_bind_into](v))
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if `inp` is an input to the phi node `phi` along the edge originating in `bb`.
- */
-pragma[nomagic]
-predicate phiHasInputFromBlock(PhiNode phi, Definition inp, BasicBlock bb) {
-  exists(SourceVariable v, BasicBlock bbDef |
-    phi.definesAt(v, bbDef, _) and
-    getABasicBlockPredecessor(bbDef) = bb and
-    ssaDefReachesEndOfBlock(bb, inp, v)
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if the SSA definition of `v` at `def` reaches a read at index `i` in
- * basic block `bb`, without crossing another SSA definition of `v`. The read
- * is of kind `rk`.
- */
-pragma[nomagic]
-predicate ssaDefReachesRead(SourceVariable v, Definition def, BasicBlock bb, int i) {
-  ssaDefReachesReadWithinBlock(v, def, bb, i)
-  or
-  ssaRef(bb, i, v, any(SsaRead k)) and
-  ssaDefReachesEndOfBlock(getABasicBlockPredecessor(bb), def, v) and
-  not ssaDefReachesReadWithinBlock(v, _, bb, i)
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if `def` is accessed at index `i1` in basic block `bb1` (either a read
- * or a write), `def` is read at index `i2` in basic block `bb2`, and there is a
- * path between them without any read of `def`.
- */
-pragma[nomagic]
-predicate adjacentDefRead(Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2) {
-  exists(int rnk |
-    rnk = ssaDefRank(def, _, bb1, i1, _) and
-    rnk + 1 = ssaDefRank(def, _, bb1, i2, SsaActualRead()) and
-    variableRead(bb1, i2, _, _) and
-    bb2 = bb1
-  )
-  or
-  lastSsaRef(def, _, bb1, i1) and
-  defAdjacentRead(def, bb1, bb2, i2)
-}
-
-pragma[noinline]
-private predicate adjacentDefRead(
-  Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2, SourceVariable v
-) {
-  adjacentDefRead(def, bb1, i1, bb2, i2) and
-  v = def.getSourceVariable()
-}
-
-private predicate adjacentDefReachesRead(
-  Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2
-) {
-  exists(SourceVariable v | adjacentDefRead(def, bb1, i1, bb2, i2, v) |
-    ssaRef(bb1, i1, v, SsaDef())
-    or
-    variableRead(bb1, i1, v, true)
-  )
-  or
-  exists(BasicBlock bb3, int i3 |
-    adjacentDefReachesRead(def, bb1, i1, bb3, i3) and
-    variableRead(bb3, i3, _, false) and
-    adjacentDefRead(def, bb3, i3, bb2, i2)
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Same as `adjacentDefRead`, but ignores uncertain reads.
- */
-pragma[nomagic]
-predicate adjacentDefNoUncertainReads(Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2) {
-  adjacentDefReachesRead(def, bb1, i1, bb2, i2) and
-  variableRead(bb2, i2, _, true)
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if the node at index `i` in `bb` is a last reference to SSA definition
- * `def`. The reference is last because it can reach another write `next`,
- * without passing through another read or write.
- */
-pragma[nomagic]
-predicate lastRefRedef(Definition def, BasicBlock bb, int i, Definition next) {
-  exists(SourceVariable v |
-    // Next reference to `v` inside `bb` is a write
-    exists(int rnk, int j |
-      rnk = ssaDefRank(def, v, bb, i, _) and
-      next.definesAt(v, bb, j) and
-      rnk + 1 = ssaRefRank(bb, j, v, SsaDef())
-    )
-    or
-    // Can reach a write using one or more steps
-    lastSsaRef(def, v, bb, i) and
-    exists(BasicBlock bb2 |
-      varBlockReaches(def, bb, bb2) and
-      1 = ssaDefRank(next, v, bb2, _, SsaDef())
-    )
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if `inp` is an immediately preceding definition of uncertain definition
- * `def`. Since `def` is uncertain, the value from the preceding definition might
- * still be valid.
- */
-pragma[nomagic]
-predicate uncertainWriteDefinitionInput(UncertainWriteDefinition def, Definition inp) {
-  lastRefRedef(inp, _, _, def)
-}
-
-private predicate adjacentDefReachesUncertainRead(
-  Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2
-) {
-  adjacentDefReachesRead(def, bb1, i1, bb2, i2) and
-  variableRead(bb2, i2, _, false)
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Same as `lastRefRedef`, but ignores uncertain reads.
- */
-pragma[nomagic]
-predicate lastRefRedefNoUncertainReads(Definition def, BasicBlock bb, int i, Definition next) {
-  lastRefRedef(def, bb, i, next) and
-  not variableRead(bb, i, def.getSourceVariable(), false)
-  or
-  exists(BasicBlock bb0, int i0 |
-    lastRefRedef(def, bb0, i0, next) and
-    adjacentDefReachesUncertainRead(def, bb, i, bb0, i0)
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if the node at index `i` in `bb` is a last reference to SSA
- * definition `def`.
- *
- * That is, the node can reach the end of the enclosing callable, or another
- * SSA definition for the underlying source variable, without passing through
- * another read.
- */
-pragma[nomagic]
-predicate lastRef(Definition def, BasicBlock bb, int i) {
-  // Can reach another definition
-  lastRefRedef(def, bb, i, _)
-  or
-  exists(SourceVariable v | lastSsaRef(def, v, bb, i) |
-    // Can reach exit directly
-    bb instanceof ExitBasicBlock
-    or
-    // Can reach a block using one or more steps, where `def` is no longer live
-    varBlockReachesExit(def, bb)
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Same as `lastRefRedef`, but ignores uncertain reads.
- */
-pragma[nomagic]
-predicate lastRefNoUncertainReads(Definition def, BasicBlock bb, int i) {
-  lastRef(def, bb, i) and
-  not variableRead(bb, i, def.getSourceVariable(), false)
-  or
-  exists(BasicBlock bb0, int i0 |
-    lastRef(def, bb0, i0) and
-    adjacentDefReachesUncertainRead(def, bb, i, bb0, i0)
-  )
-}
-
-/** A static single assignment (SSA) definition. */
-class Definition extends TDefinition {
-  /** Gets the source variable underlying this SSA definition. */
-  SourceVariable getSourceVariable() { this.definesAt(result, _, _) }
-
-  /**
-   * Holds if this SSA definition defines `v` at index `i` in basic block `bb`.
-   * Phi nodes are considered to be at index `-1`, while normal variable writes
-   * are at the index of the control flow node they wrap.
-   */
-  final predicate definesAt(SourceVariable v, BasicBlock bb, int i) {
-    this = TWriteDef(v, bb, i)
-    or
-    this = TPhiNode(v, bb) and i = -1
-  }
-
-  /** Gets the basic block to which this SSA definition belongs. */
-  final BasicBlock getBasicBlock() { this.definesAt(_, result, _) }
-
-  /** Gets a textual representation of this SSA definition. */
-  string toString() { none() }
-}
-
-/** An SSA definition that corresponds to a write. */
-class WriteDefinition extends Definition, TWriteDef {
-  private SourceVariable v;
-  private BasicBlock bb;
-  private int i;
-
-  WriteDefinition() { this = TWriteDef(v, bb, i) }
-
-  override string toString() { result = "WriteDef" }
-}
-
-/** A phi node. */
-class PhiNode extends Definition, TPhiNode {
-  override string toString() { result = "Phi" }
-}
-
-/**
- * An SSA definition that represents an uncertain update of the underlying
- * source variable.
- */
-class UncertainWriteDefinition extends WriteDefinition {
-  UncertainWriteDefinition() {
-    exists(SourceVariable v, BasicBlock bb, int i |
-      this.definesAt(v, bb, i) and
-      variableWrite(bb, i, v, false)
-    )
-  }
-}
-
-/** Provides a set of consistency queries. */
-module Consistency {
-  abstract class RelevantDefinition extends Definition {
-    abstract predicate hasLocationInfo(
-      string filepath, int startline, int startcolumn, int endline, int endcolumn
-    );
-  }
-
-  query predicate nonUniqueDef(RelevantDefinition def, SourceVariable v, BasicBlock bb, int i) {
-    ssaDefReachesRead(v, def, bb, i) and
-    not exists(unique(Definition def0 | ssaDefReachesRead(v, def0, bb, i)))
-  }
-
-  query predicate readWithoutDef(SourceVariable v, BasicBlock bb, int i) {
-    variableRead(bb, i, v, _) and
-    not ssaDefReachesRead(v, _, bb, i)
-  }
-
-  query predicate deadDef(RelevantDefinition def, SourceVariable v) {
-    v = def.getSourceVariable() and
-    not ssaDefReachesRead(_, def, _, _) and
-    not phiHasInputFromBlock(_, def, _) and
-    not uncertainWriteDefinitionInput(_, def)
-  }
-
-  query predicate notDominatedByDef(RelevantDefinition def, SourceVariable v, BasicBlock bb, int i) {
-    exists(BasicBlock bbDef, int iDef | def.definesAt(v, bbDef, iDef) |
-      ssaDefReachesReadWithinBlock(v, def, bb, i) and
-      (bb != bbDef or i < iDef)
-      or
-      ssaDefReachesRead(v, def, bb, i) and
-      not ssaDefReachesReadWithinBlock(v, def, bb, i) and
-      not def.definesAt(v, getImmediateBasicBlockDominator*(bb), _)
-    )
-  }
-}

csharp/ql/lib/semmle/code/csharp/dataflow/internal/basessa/SsaImplSpecific.qll

@@ -1,51 +0,0 @@
-/** Provides the C# specific parameters for `SsaImplCommon.qll`. */
-
-private import csharp
-private import AssignableDefinitions
-
-class BasicBlock = ControlFlow::BasicBlock;
-
-BasicBlock getImmediateBasicBlockDominator(BasicBlock bb) { result = bb.getImmediateDominator() }
-
-BasicBlock getABasicBlockSuccessor(BasicBlock bb) { result = bb.getASuccessor() }
-
-class ExitBasicBlock = ControlFlow::BasicBlocks::ExitBlock;
-
-pragma[noinline]
-private Callable getAnAssigningCallable(LocalScopeVariable v) {
-  result = any(AssignableDefinition def | def.getTarget() = v).getEnclosingCallable()
-}
-
-class SourceVariable extends LocalScopeVariable {
-  SourceVariable() { not getAnAssigningCallable(this) != getAnAssigningCallable(this) }
-}
-
-/**
- * Holds if the `i`th node of basic block `bb` is assignable definition `def`,
- * targeting local scope variable `v`.
- */
-predicate definitionAt(AssignableDefinition def, BasicBlock bb, int i, SourceVariable v) {
-  bb.getNode(i) = def.getAControlFlowNode() and
-  v = def.getTarget() and
-  // In cases like `(x, x) = (0, 1)`, we discard the first (dead) definition of `x`
-  not exists(TupleAssignmentDefinition first, TupleAssignmentDefinition second | first = def |
-    second.getAssignment() = first.getAssignment() and
-    second.getEvaluationOrder() > first.getEvaluationOrder() and
-    second.getTarget() = v
-  )
-}
-
-predicate variableWrite(BasicBlock bb, int i, SourceVariable v, boolean certain) {
-  exists(AssignableDefinition def |
-    definitionAt(def, bb, i, v) and
-    if def.isCertain() then certain = true else certain = false
-  )
-}
-
-predicate variableRead(BasicBlock bb, int i, SourceVariable v, boolean certain) {
-  exists(AssignableRead read |
-    read.getAControlFlowNode() = bb.getNode(i) and
-    read.getTarget() = v and
-    certain = true
-  )
-}

csharp/ql/lib/semmle/code/csharp/frameworks/GeneratedNegative.qll

@@ -1,9 +1,8 @@
+/** Provides a module for importing negative models. */
+
 /**
  * A module importing all generated negative Models as Data models.
  */
-
-import csharp
-
 private module GeneratedFrameworks {
   private import generated.dotnet.NegativeRuntime
 }

csharp/ql/lib/semmle/code/csharp/frameworks/generated/dotnet/NegativeRuntime.qll

@@ -3237,7 +3237,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.CodeDom.Compiler;IndentedTextWriter;Close;();generated",
         "System.CodeDom.Compiler;IndentedTextWriter;DisposeAsync;();generated",
         "System.CodeDom.Compiler;IndentedTextWriter;Flush;();generated",
-        "System.CodeDom.Compiler;IndentedTextWriter;FlushAsync;();generated",
         "System.CodeDom.Compiler;IndentedTextWriter;IndentedTextWriter;(System.IO.TextWriter);generated",
         "System.CodeDom.Compiler;IndentedTextWriter;OutputTabs;();generated",
         "System.CodeDom.Compiler;IndentedTextWriter;OutputTabsAsync;();generated",
@@ -3281,7 +3280,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.CodeDom.Compiler;IndentedTextWriter;WriteLineAsync;(System.String);generated",
         "System.CodeDom.Compiler;IndentedTextWriter;WriteLineAsync;(System.Text.StringBuilder,System.Threading.CancellationToken);generated",
         "System.CodeDom.Compiler;IndentedTextWriter;WriteLineNoTabs;(System.String);generated",
-        "System.CodeDom.Compiler;IndentedTextWriter;WriteLineNoTabsAsync;(System.String);generated",
         "System.CodeDom.Compiler;IndentedTextWriter;get_Indent;();generated",
         "System.CodeDom.Compiler;IndentedTextWriter;set_Indent;(System.Int32);generated",
         "System.CodeDom.Compiler;TempFileCollection;AddFile;(System.String,System.Boolean);generated",
@@ -3459,7 +3457,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.CodeDom;CodeNamespaceImport;set_LinePragma;(System.CodeDom.CodeLinePragma);generated",
         "System.CodeDom;CodeNamespaceImportCollection;Clear;();generated",
         "System.CodeDom;CodeNamespaceImportCollection;Contains;(System.Object);generated",
-        "System.CodeDom;CodeNamespaceImportCollection;GetEnumerator;();generated",
         "System.CodeDom;CodeNamespaceImportCollection;IndexOf;(System.Object);generated",
         "System.CodeDom;CodeNamespaceImportCollection;Remove;(System.Object);generated",
         "System.CodeDom;CodeNamespaceImportCollection;RemoveAt;(System.Int32);generated",
@@ -3612,7 +3609,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Collections.Concurrent;ConcurrentDictionary<,>;Contains;(System.Collections.Generic.KeyValuePair<TKey,TValue>);generated",
         "System.Collections.Concurrent;ConcurrentDictionary<,>;Contains;(System.Object);generated",
         "System.Collections.Concurrent;ConcurrentDictionary<,>;ContainsKey;(TKey);generated",
-        "System.Collections.Concurrent;ConcurrentDictionary<,>;GetEnumerator;();generated",
         "System.Collections.Concurrent;ConcurrentDictionary<,>;Remove;(System.Collections.Generic.KeyValuePair<TKey,TValue>);generated",
         "System.Collections.Concurrent;ConcurrentDictionary<,>;Remove;(System.Object);generated",
         "System.Collections.Concurrent;ConcurrentDictionary<,>;Remove;(TKey);generated",
@@ -3676,9 +3672,7 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Collections.Generic;ByteEqualityComparer;Equals;(System.Object);generated",
         "System.Collections.Generic;ByteEqualityComparer;GetHashCode;();generated",
         "System.Collections.Generic;ByteEqualityComparer;GetHashCode;(System.Byte);generated",
-        "System.Collections.Generic;CollectionExtensions;AsReadOnly<,>;(System.Collections.Generic.IDictionary<TKey,TValue>);generated",
         "System.Collections.Generic;CollectionExtensions;GetValueOrDefault<,>;(System.Collections.Generic.IReadOnlyDictionary<TKey,TValue>,TKey);generated",
-        "System.Collections.Generic;CollectionExtensions;TryAdd<,>;(System.Collections.Generic.IDictionary<TKey,TValue>,TKey,TValue);generated",
         "System.Collections.Generic;Comparer<>;Compare;(System.Object,System.Object);generated",
         "System.Collections.Generic;Comparer<>;Compare;(T,T);generated",
         "System.Collections.Generic;Comparer<>;get_Default;();generated",
@@ -3819,7 +3813,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Collections.Generic;KeyNotFoundException;KeyNotFoundException;(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext);generated",
         "System.Collections.Generic;KeyNotFoundException;KeyNotFoundException;(System.String);generated",
         "System.Collections.Generic;KeyNotFoundException;KeyNotFoundException;(System.String,System.Exception);generated",
-        "System.Collections.Generic;KeyValuePair;Create<,>;(TKey,TValue);generated",
         "System.Collections.Generic;KeyValuePair<,>;ToString;();generated",
         "System.Collections.Generic;LinkedList<>+Enumerator;Dispose;();generated",
         "System.Collections.Generic;LinkedList<>+Enumerator;GetObjectData;(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext);generated",
@@ -4172,9 +4165,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Collections.Immutable;ImmutableDictionary;CreateBuilder<,>;();generated",
         "System.Collections.Immutable;ImmutableDictionary;CreateBuilder<,>;(System.Collections.Generic.IEqualityComparer<TKey>);generated",
         "System.Collections.Immutable;ImmutableDictionary;CreateBuilder<,>;(System.Collections.Generic.IEqualityComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>);generated",
-        "System.Collections.Immutable;ImmutableDictionary;CreateRange<,>;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);generated",
-        "System.Collections.Immutable;ImmutableDictionary;CreateRange<,>;(System.Collections.Generic.IEqualityComparer<TKey>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);generated",
-        "System.Collections.Immutable;ImmutableDictionary;CreateRange<,>;(System.Collections.Generic.IEqualityComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);generated",
         "System.Collections.Immutable;ImmutableDictionary;GetValueOrDefault<,>;(System.Collections.Immutable.IImmutableDictionary<TKey,TValue>,TKey);generated",
         "System.Collections.Immutable;ImmutableDictionary<,>+Builder;Clear;();generated",
         "System.Collections.Immutable;ImmutableDictionary<,>+Builder;Contains;(System.Collections.Generic.KeyValuePair<TKey,TValue>);generated",
@@ -4264,10 +4254,8 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Collections.Immutable;ImmutableInterlocked;TryRemove<,>;(System.Collections.Immutable.ImmutableDictionary<TKey,TValue>,TKey,TValue);generated",
         "System.Collections.Immutable;ImmutableInterlocked;TryUpdate<,>;(System.Collections.Immutable.ImmutableDictionary<TKey,TValue>,TKey,TValue,TValue);generated",
         "System.Collections.Immutable;ImmutableList;Create<>;();generated",
-        "System.Collections.Immutable;ImmutableList;Create<>;(T);generated",
         "System.Collections.Immutable;ImmutableList;Create<>;(T[]);generated",
         "System.Collections.Immutable;ImmutableList;CreateBuilder<>;();generated",
-        "System.Collections.Immutable;ImmutableList;CreateRange<>;(System.Collections.Generic.IEnumerable<T>);generated",
         "System.Collections.Immutable;ImmutableList;IndexOf<>;(System.Collections.Immutable.IImmutableList<T>,T);generated",
         "System.Collections.Immutable;ImmutableList;IndexOf<>;(System.Collections.Immutable.IImmutableList<T>,T,System.Collections.Generic.IEqualityComparer<T>);generated",
         "System.Collections.Immutable;ImmutableList;IndexOf<>;(System.Collections.Immutable.IImmutableList<T>,T,System.Int32);generated",
@@ -4331,9 +4319,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Collections.Immutable;ImmutableQueue<>;get_IsEmpty;();generated",
         "System.Collections.Immutable;ImmutableSortedDictionary;Create<,>;();generated",
         "System.Collections.Immutable;ImmutableSortedDictionary;CreateBuilder<,>;();generated",
-        "System.Collections.Immutable;ImmutableSortedDictionary;CreateRange<,>;(System.Collections.Generic.IComparer<TKey>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);generated",
-        "System.Collections.Immutable;ImmutableSortedDictionary;CreateRange<,>;(System.Collections.Generic.IComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);generated",
-        "System.Collections.Immutable;ImmutableSortedDictionary;CreateRange<,>;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);generated",
         "System.Collections.Immutable;ImmutableSortedDictionary<,>+Builder;Clear;();generated",
         "System.Collections.Immutable;ImmutableSortedDictionary<,>+Builder;Contains;(System.Collections.Generic.KeyValuePair<TKey,TValue>);generated",
         "System.Collections.Immutable;ImmutableSortedDictionary<,>+Builder;Contains;(System.Object);generated",
@@ -4353,7 +4338,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Collections.Immutable;ImmutableSortedDictionary<,>+Enumerator;Dispose;();generated",
         "System.Collections.Immutable;ImmutableSortedDictionary<,>+Enumerator;MoveNext;();generated",
         "System.Collections.Immutable;ImmutableSortedDictionary<,>+Enumerator;Reset;();generated",
-        "System.Collections.Immutable;ImmutableSortedDictionary<,>+Enumerator;get_Current;();generated",
         "System.Collections.Immutable;ImmutableSortedDictionary<,>;Clear;();generated",
         "System.Collections.Immutable;ImmutableSortedDictionary<,>;Contains;(System.Collections.Generic.KeyValuePair<TKey,TValue>);generated",
         "System.Collections.Immutable;ImmutableSortedDictionary<,>;Contains;(System.Object);generated",
@@ -4370,8 +4354,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Collections.Immutable;ImmutableSortedDictionary<,>;get_IsReadOnly;();generated",
         "System.Collections.Immutable;ImmutableSortedDictionary<,>;get_IsSynchronized;();generated",
         "System.Collections.Immutable;ImmutableSortedSet;Create<>;();generated",
-        "System.Collections.Immutable;ImmutableSortedSet;Create<>;(System.Collections.Generic.IComparer<T>,T);generated",
-        "System.Collections.Immutable;ImmutableSortedSet;Create<>;(T);generated",
         "System.Collections.Immutable;ImmutableSortedSet;Create<>;(T[]);generated",
         "System.Collections.Immutable;ImmutableSortedSet;CreateBuilder<>;();generated",
         "System.Collections.Immutable;ImmutableSortedSet<>+Builder;Clear;();generated",
@@ -4385,7 +4367,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Collections.Immutable;ImmutableSortedSet<>+Builder;Overlaps;(System.Collections.Generic.IEnumerable<T>);generated",
         "System.Collections.Immutable;ImmutableSortedSet<>+Builder;Remove;(T);generated",
         "System.Collections.Immutable;ImmutableSortedSet<>+Builder;SetEquals;(System.Collections.Generic.IEnumerable<T>);generated",
-        "System.Collections.Immutable;ImmutableSortedSet<>+Builder;SymmetricExceptWith;(System.Collections.Generic.IEnumerable<T>);generated",
         "System.Collections.Immutable;ImmutableSortedSet<>+Builder;get_Count;();generated",
         "System.Collections.Immutable;ImmutableSortedSet<>+Builder;get_IsReadOnly;();generated",
         "System.Collections.Immutable;ImmutableSortedSet<>+Builder;get_IsSynchronized;();generated",
@@ -4399,7 +4380,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Collections.Immutable;ImmutableSortedSet<>;ExceptWith;(System.Collections.Generic.IEnumerable<T>);generated",
         "System.Collections.Immutable;ImmutableSortedSet<>;IndexOf;(System.Object);generated",
         "System.Collections.Immutable;ImmutableSortedSet<>;IndexOf;(T);generated",
-        "System.Collections.Immutable;ImmutableSortedSet<>;Intersect;(System.Collections.Generic.IEnumerable<T>);generated",
         "System.Collections.Immutable;ImmutableSortedSet<>;IntersectWith;(System.Collections.Generic.IEnumerable<T>);generated",
         "System.Collections.Immutable;ImmutableSortedSet<>;IsProperSubsetOf;(System.Collections.Generic.IEnumerable<T>);generated",
         "System.Collections.Immutable;ImmutableSortedSet<>;IsProperSupersetOf;(System.Collections.Generic.IEnumerable<T>);generated",
@@ -4411,7 +4391,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Collections.Immutable;ImmutableSortedSet<>;Remove;(T);generated",
         "System.Collections.Immutable;ImmutableSortedSet<>;RemoveAt;(System.Int32);generated",
         "System.Collections.Immutable;ImmutableSortedSet<>;SetEquals;(System.Collections.Generic.IEnumerable<T>);generated",
-        "System.Collections.Immutable;ImmutableSortedSet<>;SymmetricExcept;(System.Collections.Generic.IEnumerable<T>);generated",
         "System.Collections.Immutable;ImmutableSortedSet<>;SymmetricExceptWith;(System.Collections.Generic.IEnumerable<T>);generated",
         "System.Collections.Immutable;ImmutableSortedSet<>;UnionWith;(System.Collections.Generic.IEnumerable<T>);generated",
         "System.Collections.Immutable;ImmutableSortedSet<>;get_Count;();generated",
@@ -4819,7 +4798,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.ComponentModel.Composition.Hosting;AggregateCatalog;AggregateCatalog;(System.Collections.Generic.IEnumerable<System.ComponentModel.Composition.Primitives.ComposablePartCatalog>);generated",
         "System.ComponentModel.Composition.Hosting;AggregateCatalog;AggregateCatalog;(System.ComponentModel.Composition.Primitives.ComposablePartCatalog[]);generated",
         "System.ComponentModel.Composition.Hosting;AggregateCatalog;Dispose;(System.Boolean);generated",
-        "System.ComponentModel.Composition.Hosting;AggregateCatalog;GetExports;(System.ComponentModel.Composition.Primitives.ImportDefinition);generated",
         "System.ComponentModel.Composition.Hosting;AggregateCatalog;OnChanged;(System.ComponentModel.Composition.Hosting.ComposablePartCatalogChangeEventArgs);generated",
         "System.ComponentModel.Composition.Hosting;AggregateCatalog;OnChanging;(System.ComponentModel.Composition.Hosting.ComposablePartCatalogChangeEventArgs);generated",
         "System.ComponentModel.Composition.Hosting;AggregateExportProvider;AggregateExportProvider;(System.Collections.Generic.IEnumerable<System.ComponentModel.Composition.Hosting.ExportProvider>);generated",
@@ -4827,13 +4805,11 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.ComponentModel.Composition.Hosting;AggregateExportProvider;Dispose;(System.Boolean);generated",
         "System.ComponentModel.Composition.Hosting;ApplicationCatalog;ApplicationCatalog;();generated",
         "System.ComponentModel.Composition.Hosting;ApplicationCatalog;Dispose;(System.Boolean);generated",
-        "System.ComponentModel.Composition.Hosting;ApplicationCatalog;GetExports;(System.ComponentModel.Composition.Primitives.ImportDefinition);generated",
         "System.ComponentModel.Composition.Hosting;ApplicationCatalog;ToString;();generated",
         "System.ComponentModel.Composition.Hosting;ApplicationCatalog;get_DisplayName;();generated",
         "System.ComponentModel.Composition.Hosting;ApplicationCatalog;get_Origin;();generated",
         "System.ComponentModel.Composition.Hosting;AssemblyCatalog;AssemblyCatalog;(System.String);generated",
         "System.ComponentModel.Composition.Hosting;AssemblyCatalog;Dispose;(System.Boolean);generated",
-        "System.ComponentModel.Composition.Hosting;AssemblyCatalog;GetExports;(System.ComponentModel.Composition.Primitives.ImportDefinition);generated",
         "System.ComponentModel.Composition.Hosting;AssemblyCatalog;get_Origin;();generated",
         "System.ComponentModel.Composition.Hosting;AtomicComposition;AtomicComposition;();generated",
         "System.ComponentModel.Composition.Hosting;AtomicComposition;Complete;();generated",
@@ -4869,7 +4845,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.ComponentModel.Composition.Hosting;CompositionContainer;SatisfyImportsOnce;(System.ComponentModel.Composition.Primitives.ComposablePart);generated",
         "System.ComponentModel.Composition.Hosting;CompositionScopeDefinition;CompositionScopeDefinition;();generated",
         "System.ComponentModel.Composition.Hosting;CompositionScopeDefinition;Dispose;(System.Boolean);generated",
-        "System.ComponentModel.Composition.Hosting;CompositionScopeDefinition;GetExports;(System.ComponentModel.Composition.Primitives.ImportDefinition);generated",
         "System.ComponentModel.Composition.Hosting;CompositionScopeDefinition;OnChanged;(System.ComponentModel.Composition.Hosting.ComposablePartCatalogChangeEventArgs);generated",
         "System.ComponentModel.Composition.Hosting;CompositionScopeDefinition;OnChanging;(System.ComponentModel.Composition.Hosting.ComposablePartCatalogChangeEventArgs);generated",
         "System.ComponentModel.Composition.Hosting;CompositionService;Dispose;();generated",
@@ -4879,7 +4854,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.ComponentModel.Composition.Hosting;DirectoryCatalog;DirectoryCatalog;(System.String,System.Reflection.ReflectionContext);generated",
         "System.ComponentModel.Composition.Hosting;DirectoryCatalog;DirectoryCatalog;(System.String,System.Reflection.ReflectionContext,System.ComponentModel.Composition.Primitives.ICompositionElement);generated",
         "System.ComponentModel.Composition.Hosting;DirectoryCatalog;Dispose;(System.Boolean);generated",
-        "System.ComponentModel.Composition.Hosting;DirectoryCatalog;GetExports;(System.ComponentModel.Composition.Primitives.ImportDefinition);generated",
         "System.ComponentModel.Composition.Hosting;DirectoryCatalog;OnChanged;(System.ComponentModel.Composition.Hosting.ComposablePartCatalogChangeEventArgs);generated",
         "System.ComponentModel.Composition.Hosting;DirectoryCatalog;OnChanging;(System.ComponentModel.Composition.Hosting.ComposablePartCatalogChangeEventArgs);generated",
         "System.ComponentModel.Composition.Hosting;DirectoryCatalog;Refresh;();generated",
@@ -4902,7 +4876,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.ComponentModel.Composition.Hosting;ExportsChangeEventArgs;get_AtomicComposition;();generated",
         "System.ComponentModel.Composition.Hosting;ExportsChangeEventArgs;set_AtomicComposition;(System.ComponentModel.Composition.Hosting.AtomicComposition);generated",
         "System.ComponentModel.Composition.Hosting;FilteredCatalog;Dispose;(System.Boolean);generated",
-        "System.ComponentModel.Composition.Hosting;FilteredCatalog;GetExports;(System.ComponentModel.Composition.Primitives.ImportDefinition);generated",
         "System.ComponentModel.Composition.Hosting;FilteredCatalog;IncludeDependencies;();generated",
         "System.ComponentModel.Composition.Hosting;FilteredCatalog;IncludeDependents;();generated",
         "System.ComponentModel.Composition.Hosting;FilteredCatalog;OnChanged;(System.ComponentModel.Composition.Hosting.ComposablePartCatalogChangeEventArgs);generated",
@@ -4936,7 +4909,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.ComponentModel.Composition.Primitives;ComposablePartCatalog;ComposablePartCatalog;();generated",
         "System.ComponentModel.Composition.Primitives;ComposablePartCatalog;Dispose;();generated",
         "System.ComponentModel.Composition.Primitives;ComposablePartCatalog;Dispose;(System.Boolean);generated",
-        "System.ComponentModel.Composition.Primitives;ComposablePartCatalog;GetExports;(System.ComponentModel.Composition.Primitives.ImportDefinition);generated",
         "System.ComponentModel.Composition.Primitives;ComposablePartDefinition;ComposablePartDefinition;();generated",
         "System.ComponentModel.Composition.Primitives;ComposablePartDefinition;CreatePart;();generated",
         "System.ComponentModel.Composition.Primitives;ComposablePartDefinition;get_ExportDefinitions;();generated",
@@ -6364,7 +6336,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.ComponentModel;TypeConverter+SimplePropertyDescriptor;get_ComponentType;();generated",
         "System.ComponentModel;TypeConverter+SimplePropertyDescriptor;get_IsReadOnly;();generated",
         "System.ComponentModel;TypeConverter+SimplePropertyDescriptor;get_PropertyType;();generated",
-        "System.ComponentModel;TypeConverter+StandardValuesCollection;GetEnumerator;();generated",
         "System.ComponentModel;TypeConverter+StandardValuesCollection;get_Count;();generated",
         "System.ComponentModel;TypeConverter+StandardValuesCollection;get_IsSynchronized;();generated",
         "System.ComponentModel;TypeConverter+StandardValuesCollection;get_SyncRoot;();generated",
@@ -7511,14 +7482,9 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Data.Common;DbCommand;DbCommand;();generated",
         "System.Data.Common;DbCommand;DisposeAsync;();generated",
         "System.Data.Common;DbCommand;ExecuteDbDataReader;(System.Data.CommandBehavior);generated",
-        "System.Data.Common;DbCommand;ExecuteDbDataReaderAsync;(System.Data.CommandBehavior,System.Threading.CancellationToken);generated",
         "System.Data.Common;DbCommand;ExecuteNonQuery;();generated",
         "System.Data.Common;DbCommand;ExecuteNonQueryAsync;();generated",
         "System.Data.Common;DbCommand;ExecuteNonQueryAsync;(System.Threading.CancellationToken);generated",
-        "System.Data.Common;DbCommand;ExecuteReaderAsync;();generated",
-        "System.Data.Common;DbCommand;ExecuteReaderAsync;(System.Data.CommandBehavior);generated",
-        "System.Data.Common;DbCommand;ExecuteReaderAsync;(System.Data.CommandBehavior,System.Threading.CancellationToken);generated",
-        "System.Data.Common;DbCommand;ExecuteReaderAsync;(System.Threading.CancellationToken);generated",
         "System.Data.Common;DbCommand;ExecuteScalar;();generated",
         "System.Data.Common;DbCommand;ExecuteScalarAsync;();generated",
         "System.Data.Common;DbCommand;ExecuteScalarAsync;(System.Threading.CancellationToken);generated",
@@ -7602,7 +7568,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Data.Common;DbConnectionStringBuilder;GetDefaultEvent;();generated",
         "System.Data.Common;DbConnectionStringBuilder;GetDefaultProperty;();generated",
         "System.Data.Common;DbConnectionStringBuilder;GetEditor;(System.Type);generated",
-        "System.Data.Common;DbConnectionStringBuilder;GetEnumerator;();generated",
         "System.Data.Common;DbConnectionStringBuilder;GetEvents;();generated",
         "System.Data.Common;DbConnectionStringBuilder;GetEvents;(System.Attribute[]);generated",
         "System.Data.Common;DbConnectionStringBuilder;GetProperties;(System.Collections.Hashtable);generated",
@@ -7670,8 +7635,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Data.Common;DbDataReader;GetDecimal;(System.Int32);generated",
         "System.Data.Common;DbDataReader;GetDouble;(System.Int32);generated",
         "System.Data.Common;DbDataReader;GetFieldType;(System.Int32);generated",
-        "System.Data.Common;DbDataReader;GetFieldValueAsync<>;(System.Int32);generated",
-        "System.Data.Common;DbDataReader;GetFieldValueAsync<>;(System.Int32,System.Threading.CancellationToken);generated",
         "System.Data.Common;DbDataReader;GetFloat;(System.Int32);generated",
         "System.Data.Common;DbDataReader;GetGuid;(System.Int32);generated",
         "System.Data.Common;DbDataReader;GetInt16;(System.Int32);generated",
@@ -7681,7 +7644,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Data.Common;DbDataReader;GetOrdinal;(System.String);generated",
         "System.Data.Common;DbDataReader;GetProviderSpecificFieldType;(System.Int32);generated",
         "System.Data.Common;DbDataReader;GetSchemaTable;();generated",
-        "System.Data.Common;DbDataReader;GetSchemaTableAsync;(System.Threading.CancellationToken);generated",
         "System.Data.Common;DbDataReader;GetStream;(System.Int32);generated",
         "System.Data.Common;DbDataReader;GetString;(System.Int32);generated",
         "System.Data.Common;DbDataReader;GetValue;(System.Int32);generated",
@@ -8993,9 +8955,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Data;DataColumnChangeEventArgs;get_ProposedValue;();generated",
         "System.Data;DataColumnChangeEventArgs;get_Row;();generated",
         "System.Data;DataColumnChangeEventArgs;set_ProposedValue;(System.Object);generated",
-        "System.Data;DataColumnCollection;Add;();generated",
-        "System.Data;DataColumnCollection;Add;(System.String,System.Type);generated",
-        "System.Data;DataColumnCollection;Add;(System.String,System.Type,System.String);generated",
         "System.Data;DataColumnCollection;CanRemove;(System.Data.DataColumn);generated",
         "System.Data;DataColumnCollection;Clear;();generated",
         "System.Data;DataColumnCollection;Contains;(System.String);generated",
@@ -9018,7 +8977,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Data;DataReaderExtensions;GetDecimal;(System.Data.Common.DbDataReader,System.String);generated",
         "System.Data;DataReaderExtensions;GetDouble;(System.Data.Common.DbDataReader,System.String);generated",
         "System.Data;DataReaderExtensions;GetFieldType;(System.Data.Common.DbDataReader,System.String);generated",
-        "System.Data;DataReaderExtensions;GetFieldValueAsync<>;(System.Data.Common.DbDataReader,System.String,System.Threading.CancellationToken);generated",
         "System.Data;DataReaderExtensions;GetFloat;(System.Data.Common.DbDataReader,System.String);generated",
         "System.Data;DataReaderExtensions;GetInt16;(System.Data.Common.DbDataReader,System.String);generated",
         "System.Data;DataReaderExtensions;GetInt32;(System.Data.Common.DbDataReader,System.String);generated",
@@ -9036,10 +8994,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Data;DataRelation;get_Nested;();generated",
         "System.Data;DataRelation;get_ParentTable;();generated",
         "System.Data;DataRelation;set_Nested;(System.Boolean);generated",
-        "System.Data;DataRelationCollection;Add;(System.Data.DataColumn,System.Data.DataColumn);generated",
-        "System.Data;DataRelationCollection;Add;(System.Data.DataColumn[],System.Data.DataColumn[]);generated",
-        "System.Data;DataRelationCollection;Add;(System.String,System.Data.DataColumn,System.Data.DataColumn);generated",
-        "System.Data;DataRelationCollection;Add;(System.String,System.Data.DataColumn[],System.Data.DataColumn[]);generated",
         "System.Data;DataRelationCollection;AddCore;(System.Data.DataRelation);generated",
         "System.Data;DataRelationCollection;CanRemove;(System.Data.DataRelation);generated",
         "System.Data;DataRelationCollection;Clear;();generated",
@@ -9286,7 +9240,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Data;DataTableClearEventArgs;get_Table;();generated",
         "System.Data;DataTableClearEventArgs;get_TableName;();generated",
         "System.Data;DataTableClearEventArgs;get_TableNamespace;();generated",
-        "System.Data;DataTableCollection;Add;();generated",
         "System.Data;DataTableCollection;CanRemove;(System.Data.DataTable);generated",
         "System.Data;DataTableCollection;Clear;();generated",
         "System.Data;DataTableCollection;Contains;(System.String);generated",
@@ -13442,19 +13395,15 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Drawing.Printing;PrinterResolution;set_X;(System.Int32);generated",
         "System.Drawing.Printing;PrinterResolution;set_Y;(System.Int32);generated",
         "System.Drawing.Printing;PrinterSettings+PaperSizeCollection;CopyTo;(System.Drawing.Printing.PaperSize[],System.Int32);generated",
-        "System.Drawing.Printing;PrinterSettings+PaperSizeCollection;GetEnumerator;();generated",
         "System.Drawing.Printing;PrinterSettings+PaperSizeCollection;get_Count;();generated",
         "System.Drawing.Printing;PrinterSettings+PaperSizeCollection;get_IsSynchronized;();generated",
         "System.Drawing.Printing;PrinterSettings+PaperSourceCollection;CopyTo;(System.Drawing.Printing.PaperSource[],System.Int32);generated",
-        "System.Drawing.Printing;PrinterSettings+PaperSourceCollection;GetEnumerator;();generated",
         "System.Drawing.Printing;PrinterSettings+PaperSourceCollection;get_Count;();generated",
         "System.Drawing.Printing;PrinterSettings+PaperSourceCollection;get_IsSynchronized;();generated",
         "System.Drawing.Printing;PrinterSettings+PrinterResolutionCollection;CopyTo;(System.Drawing.Printing.PrinterResolution[],System.Int32);generated",
-        "System.Drawing.Printing;PrinterSettings+PrinterResolutionCollection;GetEnumerator;();generated",
         "System.Drawing.Printing;PrinterSettings+PrinterResolutionCollection;get_Count;();generated",
         "System.Drawing.Printing;PrinterSettings+PrinterResolutionCollection;get_IsSynchronized;();generated",
         "System.Drawing.Printing;PrinterSettings+StringCollection;CopyTo;(System.String[],System.Int32);generated",
-        "System.Drawing.Printing;PrinterSettings+StringCollection;GetEnumerator;();generated",
         "System.Drawing.Printing;PrinterSettings+StringCollection;get_Count;();generated",
         "System.Drawing.Printing;PrinterSettings+StringCollection;get_IsSynchronized;();generated",
         "System.Drawing.Printing;PrinterSettings;Clone;();generated",
@@ -15785,12 +15734,10 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.IO.Compression;DeflateStream;EndWrite;(System.IAsyncResult);generated",
         "System.IO.Compression;DeflateStream;Flush;();generated",
         "System.IO.Compression;DeflateStream;Read;(System.Span<System.Byte>);generated",
-        "System.IO.Compression;DeflateStream;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);generated",
         "System.IO.Compression;DeflateStream;ReadByte;();generated",
         "System.IO.Compression;DeflateStream;Seek;(System.Int64,System.IO.SeekOrigin);generated",
         "System.IO.Compression;DeflateStream;SetLength;(System.Int64);generated",
         "System.IO.Compression;DeflateStream;Write;(System.ReadOnlySpan<System.Byte>);generated",
-        "System.IO.Compression;DeflateStream;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);generated",
         "System.IO.Compression;DeflateStream;WriteByte;(System.Byte);generated",
         "System.IO.Compression;DeflateStream;get_CanRead;();generated",
         "System.IO.Compression;DeflateStream;get_CanSeek;();generated",
@@ -15806,12 +15753,10 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.IO.Compression;GZipStream;GZipStream;(System.IO.Stream,System.IO.Compression.CompressionLevel);generated",
         "System.IO.Compression;GZipStream;GZipStream;(System.IO.Stream,System.IO.Compression.CompressionMode);generated",
         "System.IO.Compression;GZipStream;Read;(System.Span<System.Byte>);generated",
-        "System.IO.Compression;GZipStream;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);generated",
         "System.IO.Compression;GZipStream;ReadByte;();generated",
         "System.IO.Compression;GZipStream;Seek;(System.Int64,System.IO.SeekOrigin);generated",
         "System.IO.Compression;GZipStream;SetLength;(System.Int64);generated",
         "System.IO.Compression;GZipStream;Write;(System.ReadOnlySpan<System.Byte>);generated",
-        "System.IO.Compression;GZipStream;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);generated",
         "System.IO.Compression;GZipStream;WriteByte;(System.Byte);generated",
         "System.IO.Compression;GZipStream;get_CanRead;();generated",
         "System.IO.Compression;GZipStream;get_CanSeek;();generated",
@@ -16383,7 +16328,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.IO;BinaryWriter;BinaryWriter;(System.IO.Stream,System.Text.Encoding);generated",
         "System.IO;BinaryWriter;Close;();generated", "System.IO;BinaryWriter;Dispose;();generated",
         "System.IO;BinaryWriter;Dispose;(System.Boolean);generated",
-        "System.IO;BinaryWriter;DisposeAsync;();generated",
         "System.IO;BinaryWriter;Flush;();generated",
         "System.IO;BinaryWriter;Seek;(System.Int32,System.IO.SeekOrigin);generated",
         "System.IO;BinaryWriter;Write7BitEncodedInt64;(System.Int64);generated",
@@ -16774,18 +16718,14 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.IO;Stream;DisposeAsync;();generated",
         "System.IO;Stream;EndRead;(System.IAsyncResult);generated",
         "System.IO;Stream;EndWrite;(System.IAsyncResult);generated",
-        "System.IO;Stream;Flush;();generated", "System.IO;Stream;FlushAsync;();generated",
-        "System.IO;Stream;FlushAsync;(System.Threading.CancellationToken);generated",
-        "System.IO;Stream;ObjectInvariant;();generated",
+        "System.IO;Stream;Flush;();generated", "System.IO;Stream;ObjectInvariant;();generated",
         "System.IO;Stream;Read;(System.Span<System.Byte>);generated",
-        "System.IO;Stream;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);generated",
         "System.IO;Stream;ReadByte;();generated",
         "System.IO;Stream;Seek;(System.Int64,System.IO.SeekOrigin);generated",
         "System.IO;Stream;SetLength;(System.Int64);generated",
         "System.IO;Stream;ValidateBufferArguments;(System.Byte[],System.Int32,System.Int32);generated",
         "System.IO;Stream;ValidateCopyToArguments;(System.IO.Stream,System.Int32);generated",
         "System.IO;Stream;Write;(System.ReadOnlySpan<System.Byte>);generated",
-        "System.IO;Stream;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);generated",
         "System.IO;Stream;WriteByte;(System.Byte);generated",
         "System.IO;Stream;get_CanRead;();generated", "System.IO;Stream;get_CanSeek;();generated",
         "System.IO;Stream;get_CanTimeout;();generated",
@@ -16805,7 +16745,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.IO;StreamWriter;Dispose;(System.Boolean);generated",
         "System.IO;StreamWriter;DisposeAsync;();generated",
         "System.IO;StreamWriter;Flush;();generated",
-        "System.IO;StreamWriter;FlushAsync;();generated",
         "System.IO;StreamWriter;StreamWriter;(System.IO.Stream);generated",
         "System.IO;StreamWriter;StreamWriter;(System.IO.Stream,System.Text.Encoding);generated",
         "System.IO;StreamWriter;StreamWriter;(System.IO.Stream,System.Text.Encoding,System.Int32);generated",
@@ -16824,15 +16763,8 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.IO;StreamWriter;Write;(System.String,System.Object,System.Object);generated",
         "System.IO;StreamWriter;Write;(System.String,System.Object,System.Object,System.Object);generated",
         "System.IO;StreamWriter;Write;(System.String,System.Object[]);generated",
-        "System.IO;StreamWriter;WriteAsync;(System.Char);generated",
-        "System.IO;StreamWriter;WriteAsync;(System.Char[],System.Int32,System.Int32);generated",
-        "System.IO;StreamWriter;WriteAsync;(System.String);generated",
         "System.IO;StreamWriter;WriteLine;(System.ReadOnlySpan<System.Char>);generated",
         "System.IO;StreamWriter;WriteLine;(System.String);generated",
-        "System.IO;StreamWriter;WriteLineAsync;();generated",
-        "System.IO;StreamWriter;WriteLineAsync;(System.Char);generated",
-        "System.IO;StreamWriter;WriteLineAsync;(System.Char[],System.Int32,System.Int32);generated",
-        "System.IO;StreamWriter;WriteLineAsync;(System.String);generated",
         "System.IO;StreamWriter;get_AutoFlush;();generated",
         "System.IO;StreamWriter;set_AutoFlush;(System.Boolean);generated",
         "System.IO;StringReader;Close;();generated",
@@ -16845,10 +16777,8 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.IO;StringWriter;StringWriter;(System.Text.StringBuilder);generated",
         "System.IO;StringWriter;Write;(System.Char);generated",
         "System.IO;StringWriter;Write;(System.ReadOnlySpan<System.Char>);generated",
-        "System.IO;StringWriter;Write;(System.Text.StringBuilder);generated",
         "System.IO;StringWriter;WriteAsync;(System.Char);generated",
         "System.IO;StringWriter;WriteLine;(System.ReadOnlySpan<System.Char>);generated",
-        "System.IO;StringWriter;WriteLine;(System.Text.StringBuilder);generated",
         "System.IO;StringWriter;WriteLineAsync;(System.Char);generated",
         "System.IO;StringWriter;get_Encoding;();generated",
         "System.IO;TextReader;Close;();generated", "System.IO;TextReader;Dispose;();generated",
@@ -16857,7 +16787,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.IO;TextWriter;Close;();generated", "System.IO;TextWriter;Dispose;();generated",
         "System.IO;TextWriter;Dispose;(System.Boolean);generated",
         "System.IO;TextWriter;DisposeAsync;();generated", "System.IO;TextWriter;Flush;();generated",
-        "System.IO;TextWriter;FlushAsync;();generated",
         "System.IO;TextWriter;TextWriter;();generated",
         "System.IO;TextWriter;Write;(System.Boolean);generated",
         "System.IO;TextWriter;Write;(System.Char);generated",
@@ -16872,9 +16801,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.IO;TextWriter;Write;(System.Text.StringBuilder);generated",
         "System.IO;TextWriter;Write;(System.UInt32);generated",
         "System.IO;TextWriter;Write;(System.UInt64);generated",
-        "System.IO;TextWriter;WriteAsync;(System.Char);generated",
-        "System.IO;TextWriter;WriteAsync;(System.Char[],System.Int32,System.Int32);generated",
-        "System.IO;TextWriter;WriteAsync;(System.String);generated",
         "System.IO;TextWriter;WriteLine;();generated",
         "System.IO;TextWriter;WriteLine;(System.Boolean);generated",
         "System.IO;TextWriter;WriteLine;(System.Char);generated",
@@ -16884,13 +16810,8 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.IO;TextWriter;WriteLine;(System.Int64);generated",
         "System.IO;TextWriter;WriteLine;(System.ReadOnlySpan<System.Char>);generated",
         "System.IO;TextWriter;WriteLine;(System.Single);generated",
-        "System.IO;TextWriter;WriteLine;(System.Text.StringBuilder);generated",
         "System.IO;TextWriter;WriteLine;(System.UInt32);generated",
         "System.IO;TextWriter;WriteLine;(System.UInt64);generated",
-        "System.IO;TextWriter;WriteLineAsync;();generated",
-        "System.IO;TextWriter;WriteLineAsync;(System.Char);generated",
-        "System.IO;TextWriter;WriteLineAsync;(System.Char[],System.Int32,System.Int32);generated",
-        "System.IO;TextWriter;WriteLineAsync;(System.String);generated",
         "System.IO;TextWriter;get_Encoding;();generated",
         "System.IO;UnmanagedMemoryAccessor;Dispose;();generated",
         "System.IO;UnmanagedMemoryAccessor;Dispose;(System.Boolean);generated",
@@ -18094,7 +18015,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Net.Http.Headers;HttpHeadersNonValidated+Enumerator;Reset;();generated",
         "System.Net.Http.Headers;HttpHeadersNonValidated;Contains;(System.String);generated",
         "System.Net.Http.Headers;HttpHeadersNonValidated;ContainsKey;(System.String);generated",
-        "System.Net.Http.Headers;HttpHeadersNonValidated;GetEnumerator;();generated",
         "System.Net.Http.Headers;HttpHeadersNonValidated;get_Count;();generated",
         "System.Net.Http.Headers;HttpRequestHeaders;get_Accept;();generated",
         "System.Net.Http.Headers;HttpRequestHeaders;get_AcceptCharset;();generated",
@@ -18283,7 +18203,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Net.Http.Json;JsonContent;TryComputeLength;(System.Int64);generated",
         "System.Net.Http.Json;JsonContent;get_ObjectType;();generated",
         "System.Net.Http.Json;JsonContent;get_Value;();generated",
-        "System.Net.Http;ByteArrayContent;CreateContentReadStreamAsync;();generated",
         "System.Net.Http;ByteArrayContent;TryComputeLength;(System.Int64);generated",
         "System.Net.Http;DelegatingHandler;DelegatingHandler;();generated",
         "System.Net.Http;DelegatingHandler;Dispose;(System.Boolean);generated",
@@ -18383,7 +18302,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Net.Http;HttpClientHandler;set_UseDefaultCredentials;(System.Boolean);generated",
         "System.Net.Http;HttpClientHandler;set_UseProxy;(System.Boolean);generated",
         "System.Net.Http;HttpContent;CreateContentReadStreamAsync;();generated",
-        "System.Net.Http;HttpContent;CreateContentReadStreamAsync;(System.Threading.CancellationToken);generated",
         "System.Net.Http;HttpContent;Dispose;();generated",
         "System.Net.Http;HttpContent;Dispose;(System.Boolean);generated",
         "System.Net.Http;HttpContent;HttpContent;();generated",
@@ -18472,7 +18390,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Net.Http;MultipartContent;get_HeaderEncodingSelector;();generated",
         "System.Net.Http;MultipartFormDataContent;MultipartFormDataContent;();generated",
         "System.Net.Http;MultipartFormDataContent;MultipartFormDataContent;(System.String);generated",
-        "System.Net.Http;ReadOnlyMemoryContent;CreateContentReadStreamAsync;();generated",
         "System.Net.Http;ReadOnlyMemoryContent;SerializeToStream;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);generated",
         "System.Net.Http;ReadOnlyMemoryContent;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext);generated",
         "System.Net.Http;ReadOnlyMemoryContent;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);generated",
@@ -19103,7 +19020,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Net.Quic;QuicStreamAbortedException;QuicStreamAbortedException;(System.String,System.Int64);generated",
         "System.Net.Quic;QuicStreamAbortedException;get_ErrorCode;();generated",
         "System.Net.Security;AuthenticatedStream;Dispose;(System.Boolean);generated",
-        "System.Net.Security;AuthenticatedStream;DisposeAsync;();generated",
         "System.Net.Security;AuthenticatedStream;get_IsAuthenticated;();generated",
         "System.Net.Security;AuthenticatedStream;get_IsEncrypted;();generated",
         "System.Net.Security;AuthenticatedStream;get_IsMutuallyAuthenticated;();generated",
@@ -19328,7 +19244,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Net.Sockets;SendPacketsElement;set_MemoryBuffer;(System.Nullable<System.ReadOnlyMemory<System.Byte>>);generated",
         "System.Net.Sockets;SendPacketsElement;set_OffsetLong;(System.Int64);generated",
         "System.Net.Sockets;Socket;AcceptAsync;();generated",
-        "System.Net.Sockets;Socket;AcceptAsync;(System.Net.Sockets.Socket);generated",
         "System.Net.Sockets;Socket;CancelConnectAsync;(System.Net.Sockets.SocketAsyncEventArgs);generated",
         "System.Net.Sockets;Socket;Close;();generated",
         "System.Net.Sockets;Socket;Close;(System.Int32);generated",
@@ -19343,7 +19258,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Net.Sockets;Socket;DuplicateAndClose;(System.Int32);generated",
         "System.Net.Sockets;Socket;EndAccept;(System.Byte[],System.IAsyncResult);generated",
         "System.Net.Sockets;Socket;EndAccept;(System.Byte[],System.Int32,System.IAsyncResult);generated",
-        "System.Net.Sockets;Socket;EndAccept;(System.IAsyncResult);generated",
         "System.Net.Sockets;Socket;EndConnect;(System.IAsyncResult);generated",
         "System.Net.Sockets;Socket;EndDisconnect;(System.IAsyncResult);generated",
         "System.Net.Sockets;Socket;EndReceive;(System.IAsyncResult);generated",
@@ -19378,10 +19292,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Net.Sockets;Socket;ReceiveAsync;(System.ArraySegment<System.Byte>,System.Net.Sockets.SocketFlags);generated",
         "System.Net.Sockets;Socket;ReceiveAsync;(System.Collections.Generic.IList<System.ArraySegment<System.Byte>>);generated",
         "System.Net.Sockets;Socket;ReceiveAsync;(System.Collections.Generic.IList<System.ArraySegment<System.Byte>>,System.Net.Sockets.SocketFlags);generated",
-        "System.Net.Sockets;Socket;ReceiveFromAsync;(System.ArraySegment<System.Byte>,System.Net.EndPoint);generated",
-        "System.Net.Sockets;Socket;ReceiveFromAsync;(System.ArraySegment<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint);generated",
-        "System.Net.Sockets;Socket;ReceiveMessageFromAsync;(System.ArraySegment<System.Byte>,System.Net.EndPoint);generated",
-        "System.Net.Sockets;Socket;ReceiveMessageFromAsync;(System.ArraySegment<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint);generated",
         "System.Net.Sockets;Socket;Select;(System.Collections.IList,System.Collections.IList,System.Collections.IList,System.Int32);generated",
         "System.Net.Sockets;Socket;Send;(System.Byte[]);generated",
         "System.Net.Sockets;Socket;Send;(System.Byte[],System.Int32,System.Int32,System.Net.Sockets.SocketFlags);generated",
@@ -19481,14 +19391,11 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Net.Sockets;SocketInformation;set_Options;(System.Net.Sockets.SocketInformationOptions);generated",
         "System.Net.Sockets;SocketInformation;set_ProtocolInformation;(System.Byte[]);generated",
         "System.Net.Sockets;SocketTaskExtensions;AcceptAsync;(System.Net.Sockets.Socket);generated",
-        "System.Net.Sockets;SocketTaskExtensions;AcceptAsync;(System.Net.Sockets.Socket,System.Net.Sockets.Socket);generated",
         "System.Net.Sockets;SocketTaskExtensions;ConnectAsync;(System.Net.Sockets.Socket,System.Net.IPAddress[],System.Int32);generated",
         "System.Net.Sockets;SocketTaskExtensions;ConnectAsync;(System.Net.Sockets.Socket,System.Net.IPAddress[],System.Int32,System.Threading.CancellationToken);generated",
         "System.Net.Sockets;SocketTaskExtensions;ConnectAsync;(System.Net.Sockets.Socket,System.String,System.Int32);generated",
         "System.Net.Sockets;SocketTaskExtensions;ReceiveAsync;(System.Net.Sockets.Socket,System.ArraySegment<System.Byte>,System.Net.Sockets.SocketFlags);generated",
         "System.Net.Sockets;SocketTaskExtensions;ReceiveAsync;(System.Net.Sockets.Socket,System.Collections.Generic.IList<System.ArraySegment<System.Byte>>,System.Net.Sockets.SocketFlags);generated",
-        "System.Net.Sockets;SocketTaskExtensions;ReceiveFromAsync;(System.Net.Sockets.Socket,System.ArraySegment<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint);generated",
-        "System.Net.Sockets;SocketTaskExtensions;ReceiveMessageFromAsync;(System.Net.Sockets.Socket,System.ArraySegment<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint);generated",
         "System.Net.Sockets;SocketTaskExtensions;SendAsync;(System.Net.Sockets.Socket,System.ArraySegment<System.Byte>,System.Net.Sockets.SocketFlags);generated",
         "System.Net.Sockets;SocketTaskExtensions;SendAsync;(System.Net.Sockets.Socket,System.Collections.Generic.IList<System.ArraySegment<System.Byte>>,System.Net.Sockets.SocketFlags);generated",
         "System.Net.Sockets;TcpClient;Close;();generated",
@@ -19530,8 +19437,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Net.Sockets;TcpListener;AcceptTcpClientAsync;(System.Threading.CancellationToken);generated",
         "System.Net.Sockets;TcpListener;AllowNatTraversal;(System.Boolean);generated",
         "System.Net.Sockets;TcpListener;Create;(System.Int32);generated",
-        "System.Net.Sockets;TcpListener;EndAcceptSocket;(System.IAsyncResult);generated",
-        "System.Net.Sockets;TcpListener;EndAcceptTcpClient;(System.IAsyncResult);generated",
         "System.Net.Sockets;TcpListener;Pending;();generated",
         "System.Net.Sockets;TcpListener;Start;();generated",
         "System.Net.Sockets;TcpListener;Start;(System.Int32);generated",
@@ -19748,10 +19653,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Net;CredentialCache;Remove;(System.Uri,System.String);generated",
         "System.Net;CredentialCache;get_DefaultCredentials;();generated",
         "System.Net;CredentialCache;get_DefaultNetworkCredentials;();generated",
-        "System.Net;Dns;EndGetHostAddresses;(System.IAsyncResult);generated",
-        "System.Net;Dns;EndGetHostByName;(System.IAsyncResult);generated",
-        "System.Net;Dns;EndGetHostEntry;(System.IAsyncResult);generated",
-        "System.Net;Dns;EndResolve;(System.IAsyncResult);generated",
         "System.Net;Dns;GetHostAddresses;(System.String);generated",
         "System.Net;Dns;GetHostAddresses;(System.String,System.Net.Sockets.AddressFamily);generated",
         "System.Net;Dns;GetHostAddressesAsync;(System.String);generated",
@@ -19795,8 +19696,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Net;EndpointPermission;get_Port;();generated",
         "System.Net;EndpointPermission;get_Transport;();generated",
         "System.Net;FileWebRequest;Abort;();generated",
-        "System.Net;FileWebRequest;EndGetRequestStream;(System.IAsyncResult);generated",
-        "System.Net;FileWebRequest;EndGetResponse;(System.IAsyncResult);generated",
         "System.Net;FileWebRequest;FileWebRequest;(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext);generated",
         "System.Net;FileWebRequest;GetObjectData;(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext);generated",
         "System.Net;FileWebRequest;GetRequestStreamAsync;();generated",
@@ -19951,9 +19850,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Net;HttpWebRequest;AddRange;(System.String,System.Int32,System.Int32);generated",
         "System.Net;HttpWebRequest;AddRange;(System.String,System.Int64);generated",
         "System.Net;HttpWebRequest;AddRange;(System.String,System.Int64,System.Int64);generated",
-        "System.Net;HttpWebRequest;EndGetRequestStream;(System.IAsyncResult);generated",
-        "System.Net;HttpWebRequest;EndGetRequestStream;(System.IAsyncResult,System.Net.TransportContext);generated",
-        "System.Net;HttpWebRequest;EndGetResponse;(System.IAsyncResult);generated",
         "System.Net;HttpWebRequest;GetObjectData;(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext);generated",
         "System.Net;HttpWebRequest;HttpWebRequest;(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext);generated",
         "System.Net;HttpWebRequest;get_AllowAutoRedirect;();generated",
@@ -20102,7 +19998,7 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Net;NetworkCredential;get_SecurePassword;();generated",
         "System.Net;NetworkCredential;set_SecurePassword;(System.Security.SecureString);generated",
         "System.Net;PathList;GetCookiesCount;();generated",
-        "System.Net;PathList;get_Count;();generated", "System.Net;PathList;get_Values;();generated",
+        "System.Net;PathList;get_Count;();generated",
         "System.Net;PathList;set_Item;(System.String,System.Object);generated",
         "System.Net;ProtocolViolationException;ProtocolViolationException;();generated",
         "System.Net;ProtocolViolationException;ProtocolViolationException;(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext);generated",
@@ -20488,6 +20384,7 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Numerics;BigInteger;Log;(System.Numerics.BigInteger,System.Double);generated",
         "System.Numerics;BigInteger;ModPow;(System.Numerics.BigInteger,System.Numerics.BigInteger,System.Numerics.BigInteger);generated",
         "System.Numerics;BigInteger;Multiply;(System.Numerics.BigInteger,System.Numerics.BigInteger);generated",
+        "System.Numerics;BigInteger;Negate;(System.Numerics.BigInteger);generated",
         "System.Numerics;BigInteger;Parse;(System.ReadOnlySpan<System.Char>,System.Globalization.NumberStyles,System.IFormatProvider);generated",
         "System.Numerics;BigInteger;Parse;(System.String);generated",
         "System.Numerics;BigInteger;Parse;(System.String,System.Globalization.NumberStyles);generated",
@@ -20553,6 +20450,7 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Numerics;BigInteger;op_Multiply;(System.Numerics.BigInteger,System.Numerics.BigInteger);generated",
         "System.Numerics;BigInteger;op_OnesComplement;(System.Numerics.BigInteger);generated",
         "System.Numerics;BigInteger;op_Subtraction;(System.Numerics.BigInteger,System.Numerics.BigInteger);generated",
+        "System.Numerics;BigInteger;op_UnaryNegation;(System.Numerics.BigInteger);generated",
         "System.Numerics;BitOperations;IsPow2;(System.Int32);generated",
         "System.Numerics;BitOperations;IsPow2;(System.Int64);generated",
         "System.Numerics;BitOperations;IsPow2;(System.IntPtr);generated",
@@ -23476,7 +23374,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Resources;ResourceSet;Dispose;(System.Boolean);generated",
         "System.Resources;ResourceSet;GetDefaultReader;();generated",
         "System.Resources;ResourceSet;GetDefaultWriter;();generated",
-        "System.Resources;ResourceSet;GetEnumerator;();generated",
         "System.Resources;ResourceSet;GetObject;(System.String);generated",
         "System.Resources;ResourceSet;GetObject;(System.String,System.Boolean);generated",
         "System.Resources;ResourceSet;GetString;(System.String);generated",
@@ -23691,6 +23588,8 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Runtime.CompilerServices;DisablePrivateReflectionAttribute;DisablePrivateReflectionAttribute;();generated",
         "System.Runtime.CompilerServices;DiscardableAttribute;DiscardableAttribute;();generated",
         "System.Runtime.CompilerServices;DynamicAttribute;DynamicAttribute;();generated",
+        "System.Runtime.CompilerServices;DynamicAttribute;DynamicAttribute;(System.Boolean[]);generated",
+        "System.Runtime.CompilerServices;DynamicAttribute;get_TransformFlags;();generated",
         "System.Runtime.CompilerServices;EnumeratorCancellationAttribute;EnumeratorCancellationAttribute;();generated",
         "System.Runtime.CompilerServices;FixedAddressValueTypeAttribute;FixedAddressValueTypeAttribute;();generated",
         "System.Runtime.CompilerServices;FixedBufferAttribute;FixedBufferAttribute;(System.Type,System.Int32);generated",
@@ -29676,7 +29575,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Security.Cryptography.Pkcs;Pkcs12SafeContents;Decrypt;(System.ReadOnlySpan<System.Byte>);generated",
         "System.Security.Cryptography.Pkcs;Pkcs12SafeContents;Decrypt;(System.ReadOnlySpan<System.Char>);generated",
         "System.Security.Cryptography.Pkcs;Pkcs12SafeContents;Decrypt;(System.String);generated",
-        "System.Security.Cryptography.Pkcs;Pkcs12SafeContents;GetBags;();generated",
         "System.Security.Cryptography.Pkcs;Pkcs12SafeContents;Pkcs12SafeContents;();generated",
         "System.Security.Cryptography.Pkcs;Pkcs12SafeContents;get_ConfidentialityMode;();generated",
         "System.Security.Cryptography.Pkcs;Pkcs12SafeContents;get_IsReadOnly;();generated",
@@ -29984,7 +29882,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Security.Cryptography.X509Certificates;X509Certificate;get_Handle;();generated",
         "System.Security.Cryptography.X509Certificates;X509CertificateCollection+X509CertificateEnumerator;MoveNext;();generated",
         "System.Security.Cryptography.X509Certificates;X509CertificateCollection+X509CertificateEnumerator;Reset;();generated",
-        "System.Security.Cryptography.X509Certificates;X509CertificateCollection+X509CertificateEnumerator;X509CertificateEnumerator;(System.Security.Cryptography.X509Certificates.X509CertificateCollection);generated",
         "System.Security.Cryptography.X509Certificates;X509CertificateCollection;Contains;(System.Security.Cryptography.X509Certificates.X509Certificate);generated",
         "System.Security.Cryptography.X509Certificates;X509CertificateCollection;GetHashCode;();generated",
         "System.Security.Cryptography.X509Certificates;X509CertificateCollection;IndexOf;(System.Security.Cryptography.X509Certificates.X509Certificate);generated",
@@ -30154,7 +30051,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Security.Cryptography.Xml;EncryptionPropertyCollection;get_IsReadOnly;();generated",
         "System.Security.Cryptography.Xml;EncryptionPropertyCollection;get_IsSynchronized;();generated",
         "System.Security.Cryptography.Xml;IRelDecryptor;Decrypt;(System.Security.Cryptography.Xml.EncryptionMethod,System.Security.Cryptography.Xml.KeyInfo,System.IO.Stream);generated",
-        "System.Security.Cryptography.Xml;KeyInfo;GetEnumerator;(System.Type);generated",
         "System.Security.Cryptography.Xml;KeyInfo;GetXml;();generated",
         "System.Security.Cryptography.Xml;KeyInfo;KeyInfo;();generated",
         "System.Security.Cryptography.Xml;KeyInfo;get_Count;();generated",
@@ -30221,7 +30117,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Security.Cryptography.Xml;Transform;Transform;();generated",
         "System.Security.Cryptography.Xml;Transform;get_InputTypes;();generated",
         "System.Security.Cryptography.Xml;Transform;get_OutputTypes;();generated",
-        "System.Security.Cryptography.Xml;TransformChain;GetEnumerator;();generated",
         "System.Security.Cryptography.Xml;TransformChain;TransformChain;();generated",
         "System.Security.Cryptography.Xml;TransformChain;get_Count;();generated",
         "System.Security.Cryptography.Xml;X509IssuerSerial;get_IssuerName;();generated",
@@ -34394,7 +34289,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Text.Json.Serialization;ReferenceResolver;GetReference;(System.Object,System.Boolean);generated",
         "System.Text.Json.Serialization;ReferenceResolver;ResolveReference;(System.String);generated",
         "System.Text.Json.SourceGeneration;JsonSourceGenerator;Execute;(Microsoft.CodeAnalysis.GeneratorExecutionContext);generated",
-        "System.Text.Json.SourceGeneration;JsonSourceGenerator;GetSerializableTypes;();generated",
         "System.Text.Json.SourceGeneration;JsonSourceGenerator;Initialize;(Microsoft.CodeAnalysis.GeneratorInitializationContext);generated",
         "System.Text.Json.SourceGeneration;JsonSourceGenerator;Initialize;(Microsoft.CodeAnalysis.IncrementalGeneratorInitializationContext);generated",
         "System.Text.Json;JsonDocument;Dispose;();generated",
@@ -35424,7 +35318,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Threading.RateLimiting;MetadataName<>;op_Inequality;(System.Threading.RateLimiting.MetadataName<>,System.Threading.RateLimiting.MetadataName<>);generated",
         "System.Threading.RateLimiting;RateLimitLease;Dispose;();generated",
         "System.Threading.RateLimiting;RateLimitLease;Dispose;(System.Boolean);generated",
-        "System.Threading.RateLimiting;RateLimitLease;GetAllMetadata;();generated",
         "System.Threading.RateLimiting;RateLimitLease;TryGetMetadata;(System.String,System.Object);generated",
         "System.Threading.RateLimiting;RateLimitLease;get_IsAcquired;();generated",
         "System.Threading.RateLimiting;RateLimitLease;get_MetadataNames;();generated",
@@ -35507,10 +35400,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Threading.Tasks.Dataflow;DataflowBlock;OutputAvailableAsync<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>);generated",
         "System.Threading.Tasks.Dataflow;DataflowBlock;OutputAvailableAsync<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>,System.Threading.CancellationToken);generated",
         "System.Threading.Tasks.Dataflow;DataflowBlock;ReceiveAllAsync<>;(System.Threading.Tasks.Dataflow.IReceivableSourceBlock<TOutput>,System.Threading.CancellationToken);generated",
-        "System.Threading.Tasks.Dataflow;DataflowBlock;ReceiveAsync<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>);generated",
-        "System.Threading.Tasks.Dataflow;DataflowBlock;ReceiveAsync<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>,System.Threading.CancellationToken);generated",
-        "System.Threading.Tasks.Dataflow;DataflowBlock;ReceiveAsync<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>,System.TimeSpan);generated",
-        "System.Threading.Tasks.Dataflow;DataflowBlock;ReceiveAsync<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>,System.TimeSpan,System.Threading.CancellationToken);generated",
         "System.Threading.Tasks.Dataflow;DataflowBlock;SendAsync<>;(System.Threading.Tasks.Dataflow.ITargetBlock<TInput>,TInput);generated",
         "System.Threading.Tasks.Dataflow;DataflowBlockOptions;DataflowBlockOptions;();generated",
         "System.Threading.Tasks.Dataflow;DataflowBlockOptions;get_BoundedCapacity;();generated",
@@ -36723,13 +36612,10 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Xml.Schema;XmlSchemaParticle;set_MinOccursString;(System.String);generated",
         "System.Xml.Schema;XmlSchemaPatternFacet;XmlSchemaPatternFacet;();generated",
         "System.Xml.Schema;XmlSchemaRedefine;XmlSchemaRedefine;();generated",
-        "System.Xml.Schema;XmlSchemaSet;Add;(System.Xml.Schema.XmlSchemaSet);generated",
         "System.Xml.Schema;XmlSchemaSet;Compile;();generated",
         "System.Xml.Schema;XmlSchemaSet;Contains;(System.String);generated",
         "System.Xml.Schema;XmlSchemaSet;Contains;(System.Xml.Schema.XmlSchema);generated",
-        "System.Xml.Schema;XmlSchemaSet;CopyTo;(System.Xml.Schema.XmlSchema[],System.Int32);generated",
         "System.Xml.Schema;XmlSchemaSet;RemoveRecursive;(System.Xml.Schema.XmlSchema);generated",
-        "System.Xml.Schema;XmlSchemaSet;Schemas;();generated",
         "System.Xml.Schema;XmlSchemaSet;Schemas;(System.String);generated",
         "System.Xml.Schema;XmlSchemaSet;XmlSchemaSet;();generated",
         "System.Xml.Schema;XmlSchemaSet;get_Count;();generated",
@@ -36982,7 +36868,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Xml.Serialization;XmlSerializationWriter;WriteEmptyTag;(System.String,System.String);generated",
         "System.Xml.Serialization;XmlSerializationWriter;WriteEndElement;();generated",
         "System.Xml.Serialization;XmlSerializationWriter;WriteEndElement;(System.Object);generated",
-        "System.Xml.Serialization;XmlSerializationWriter;WriteId;(System.Object);generated",
         "System.Xml.Serialization;XmlSerializationWriter;WriteNamespaceDeclarations;(System.Xml.Serialization.XmlSerializerNamespaces);generated",
         "System.Xml.Serialization;XmlSerializationWriter;WriteNullTagEncoded;(System.String);generated",
         "System.Xml.Serialization;XmlSerializationWriter;WriteNullTagEncoded;(System.String,System.String);generated",
@@ -36991,8 +36876,6 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System.Xml.Serialization;XmlSerializationWriter;WriteNullableQualifiedNameEncoded;(System.String,System.String,System.Xml.XmlQualifiedName,System.Xml.XmlQualifiedName);generated",
         "System.Xml.Serialization;XmlSerializationWriter;WriteNullableQualifiedNameLiteral;(System.String,System.String,System.Xml.XmlQualifiedName);generated",
         "System.Xml.Serialization;XmlSerializationWriter;WriteReferencedElements;();generated",
-        "System.Xml.Serialization;XmlSerializationWriter;WriteReferencingElement;(System.String,System.String,System.Object);generated",
-        "System.Xml.Serialization;XmlSerializationWriter;WriteReferencingElement;(System.String,System.String,System.Object,System.Boolean);generated",
         "System.Xml.Serialization;XmlSerializationWriter;WriteStartDocument;();generated",
         "System.Xml.Serialization;XmlSerializationWriter;WriteStartElement;(System.String);generated",
         "System.Xml.Serialization;XmlSerializationWriter;WriteStartElement;(System.String,System.String);generated",
@@ -41163,29 +41046,7 @@ private class RuntimeNegativesummaryCsv extends NegativeSummaryModelCsv {
         "System;Tuple<>;Equals;(System.Object,System.Collections.IEqualityComparer);generated",
         "System;Tuple<>;GetHashCode;();generated",
         "System;Tuple<>;GetHashCode;(System.Collections.IEqualityComparer);generated",
-        "System;Tuple<>;get_Length;();generated",
-        "System;TupleExtensions;ToTuple<,,,,,,,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15,T16,T17,T18,T19,T20,T21>>>);generated",
-        "System;TupleExtensions;ToTuple<,,,,,,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15,T16,T17,T18,T19,T20>>>);generated",
-        "System;TupleExtensions;ToTuple<,,,,,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15,T16,T17,T18,T19>>>);generated",
-        "System;TupleExtensions;ToTuple<,,,,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15,T16,T17,T18>>>);generated",
-        "System;TupleExtensions;ToTuple<,,,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15,T16,T17>>>);generated",
-        "System;TupleExtensions;ToTuple<,,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15,T16>>>);generated",
-        "System;TupleExtensions;ToTuple<,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15>>>);generated",
-        "System;TupleExtensions;ToTuple<,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14>>);generated",
-        "System;TupleExtensions;ToTuple<,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13>>);generated",
-        "System;TupleExtensions;ToTuple<,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12>>);generated",
-        "System;TupleExtensions;ToTuple<,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11>>);generated",
-        "System;TupleExtensions;ToTuple<,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10>>);generated",
-        "System;TupleExtensions;ToTuple<,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9>>);generated",
-        "System;TupleExtensions;ToTuple<,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8>>);generated",
-        "System;TupleExtensions;ToTuple<,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7>);generated",
-        "System;TupleExtensions;ToTuple<,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6>);generated",
-        "System;TupleExtensions;ToTuple<,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5>);generated",
-        "System;TupleExtensions;ToTuple<,,,>;(System.ValueTuple<T1,T2,T3,T4>);generated",
-        "System;TupleExtensions;ToTuple<,,>;(System.ValueTuple<T1,T2,T3>);generated",
-        "System;TupleExtensions;ToTuple<,>;(System.ValueTuple<T1,T2>);generated",
-        "System;TupleExtensions;ToTuple<>;(System.ValueTuple<T1>);generated",
-        "System;Type;Equals;(System.Object);generated",
+        "System;Tuple<>;get_Length;();generated", "System;Type;Equals;(System.Object);generated",
         "System;Type;Equals;(System.Type);generated", "System;Type;GetArrayRank;();generated",
         "System;Type;GetAttributeFlagsImpl;();generated",
         "System;Type;GetConstructorImpl;(System.Reflection.BindingFlags,System.Reflection.Binder,System.Reflection.CallingConventions,System.Type[],System.Reflection.ParameterModifier[]);generated",

csharp/ql/lib/semmlecode.csharp.dbscheme

@@ -36,10 +36,9 @@ compilations(
  * --- | ---
  * 0   | --compiler
  * 1   | *path to compiler*
- * 2   | --cil
- * 3   | f1.cs
- * 4   | f2.cs
- * 5   | f3.cs
+ * 2   | f1.cs
+ * 3   | f2.cs
+ * 4   | f3.cs
  */
 #keyset[id, num]
 compilation_args(

csharp/ql/lib/upgrades/a696c8bae067f69ab3208e98ce35f4fdf7efb68b/upgrade.properties

@@ -0,0 +1,2 @@
+description: Remove '--cil' flag from the comments. This does not make any changes to the dbscheme.
+compatibility: full

csharp/ql/src/change-notes/2022-08-24-remove-cil-flag.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* A new extractor option has been introduced for disabling CIL extraction. Either pass `-Ocil=false` to the `codeql` CLI or set the environment variable `CODEQL_EXTRACTOR_CSHARP_OPTION_CIL=false`.

csharp/ql/src/utils/model-generator/internal/CaptureModels.qll

@@ -234,6 +234,7 @@ string captureSource(TargetApi api) {
     config.hasFlow(source, sink) and
     ExternalFlow::sourceNode(source, kind) and
     api = sink.getEnclosingCallable() and
+    isRelevantSourceKind(kind) and
     result = asSourceModel(api, returnNodeAsOutput(sink), kind)
   )
 }

csharp/ql/src/utils/model-generator/internal/CaptureModelsSpecific.qll

@@ -58,6 +58,31 @@ predicate asPartialModel = DataFlowPrivate::Csv::asPartialModel/1;
 
 predicate asPartialNegativeModel = DataFlowPrivate::Csv::asPartialNegativeModel/1;
 
+/**
+ * Holds if `t` is a type that is generally used for bulk data in collection types.
+ * Eg. char[] is roughly equivalent to string and thus a highly
+ * relevant type for model generation.
+ */
+private predicate isPrimitiveTypeUsedForBulkData(CS::Type t) {
+  t instanceof CS::ByteType or
+  t instanceof CS::CharType
+}
+
+/**
+ * Holds if the collection type `ct` is irrelevant for model generation.
+ * Collection types where the type of the elements are
+ * (1) unknown - are considered relevant.
+ * (2) known - at least one the child types should be relevant (a non-simple type
+ * or a type used for bulk data)
+ */
+private predicate irrelevantCollectionType(CS::Type ct) {
+  Collections::isCollectionType(ct) and
+  forex(CS::Type child | child = ct.getAChild() |
+    child instanceof CS::SimpleType and
+    not isPrimitiveTypeUsedForBulkData(child)
+  )
+}
+
 /**
  * Holds for type `t` for fields that are relevant as an intermediate
  * read or write step in the data flow analysis.
@@ -66,7 +91,8 @@ predicate asPartialNegativeModel = DataFlowPrivate::Csv::asPartialNegativeModel/
  */
 predicate isRelevantType(CS::Type t) {
   not t instanceof CS::SimpleType and
-  not t instanceof CS::Enum
+  not t instanceof CS::Enum and
+  not irrelevantCollectionType(t)
 }
 
 /**
@@ -167,3 +193,9 @@ string asInputArgument(DataFlow::Node source) {
  */
 bindingset[kind]
 predicate isRelevantSinkKind(string kind) { any() }
+
+/**
+ * Holds if `kind` is a relevant source kind for creating source models.
+ */
+bindingset[kind]
+predicate isRelevantSourceKind(string kind) { not kind = "file" }

csharp/ql/test/library-tests/dataflow/library/FlowSummariesFiltered.expected

@@ -226,6 +226,7 @@ summary
 | Microsoft.Extensions.FileProviders.Composite;CompositeDirectoryContents;false;CompositeDirectoryContents;(System.Collections.Generic.IList<Microsoft.Extensions.FileProviders.IFileProvider>,System.String);;Argument[1];Argument[this];taint;generated |
 | Microsoft.Extensions.FileProviders.Internal;PhysicalDirectoryContents;false;PhysicalDirectoryContents;(System.String,Microsoft.Extensions.FileProviders.Physical.ExclusionFilters);;Argument[0];Argument[this];taint;generated |
 | Microsoft.Extensions.FileProviders.Physical;PhysicalDirectoryInfo;false;PhysicalDirectoryInfo;(System.IO.DirectoryInfo);;Argument[0];Argument[this];taint;generated |
+| Microsoft.Extensions.FileProviders.Physical;PhysicalFileInfo;false;CreateReadStream;();;Argument[this];ReturnValue;taint;generated |
 | Microsoft.Extensions.FileProviders.Physical;PhysicalFileInfo;false;PhysicalFileInfo;(System.IO.FileInfo);;Argument[0];Argument[this];taint;generated |
 | Microsoft.Extensions.FileProviders.Physical;PhysicalFileInfo;false;get_PhysicalPath;();;Argument[this];ReturnValue;taint;generated |
 | Microsoft.Extensions.FileProviders.Physical;PhysicalFilesWatcher;false;PhysicalFilesWatcher;(System.String,System.IO.FileSystemWatcher,System.Boolean,Microsoft.Extensions.FileProviders.Physical.ExclusionFilters);;Argument[0];Argument[this];taint;generated |
@@ -537,6 +538,8 @@ summary
 | System.CodeDom.Compiler;GeneratedCodeAttribute;false;get_Version;();;Argument[this];ReturnValue;taint;generated |
 | System.CodeDom.Compiler;IndentedTextWriter;false;IndentedTextWriter;(System.IO.TextWriter,System.String);;Argument[0];Argument[this];taint;generated |
 | System.CodeDom.Compiler;IndentedTextWriter;false;IndentedTextWriter;(System.IO.TextWriter,System.String);;Argument[1];Argument[this];taint;generated |
+| System.CodeDom.Compiler;IndentedTextWriter;false;WriteLineNoTabsAsync;(System.String);;Argument[0];ReturnValue;taint;generated |
+| System.CodeDom.Compiler;IndentedTextWriter;false;WriteLineNoTabsAsync;(System.String);;Argument[this];ReturnValue;taint;generated |
 | System.CodeDom.Compiler;IndentedTextWriter;false;get_Encoding;();;Argument[this];ReturnValue;taint;generated |
 | System.CodeDom.Compiler;IndentedTextWriter;false;get_InnerWriter;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Concurrent;BlockingCollection<>;false;Add;(T);;Argument[0];Argument[this].Element;value;manual |
@@ -561,6 +564,7 @@ summary
 | System.Collections.Concurrent;ConcurrentDictionary<,>;false;ConcurrentDictionary;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>,System.Collections.Generic.IEqualityComparer<TKey>);;Argument[0].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
 | System.Collections.Concurrent;ConcurrentDictionary<,>;false;ConcurrentDictionary;(System.Int32,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>,System.Collections.Generic.IEqualityComparer<TKey>);;Argument[1].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | System.Collections.Concurrent;ConcurrentDictionary<,>;false;ConcurrentDictionary;(System.Int32,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>,System.Collections.Generic.IEqualityComparer<TKey>);;Argument[1].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
+| System.Collections.Concurrent;ConcurrentDictionary<,>;false;GetEnumerator;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Concurrent;ConcurrentDictionary<,>;false;GetOrAdd;(TKey,TValue);;Argument[1];ReturnValue;taint;generated |
 | System.Collections.Concurrent;ConcurrentDictionary<,>;false;get_Comparer;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Concurrent;ConcurrentDictionary<,>;false;get_Keys;();;Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];ReturnValue.Element;value;manual |
@@ -581,6 +585,9 @@ summary
 | System.Collections.Generic;CollectionExtensions;false;GetValueOrDefault<,>;(System.Collections.Generic.IReadOnlyDictionary<TKey,TValue>,TKey,TValue);;Argument[1];ReturnValue;taint;generated |
 | System.Collections.Generic;CollectionExtensions;false;GetValueOrDefault<,>;(System.Collections.Generic.IReadOnlyDictionary<TKey,TValue>,TKey,TValue);;Argument[2];ReturnValue;taint;generated |
 | System.Collections.Generic;CollectionExtensions;false;Remove<,>;(System.Collections.Generic.IDictionary<TKey,TValue>,TKey,TValue);;Argument[0].Element;ReturnValue;taint;generated |
+| System.Collections.Generic;CollectionExtensions;false;TryAdd<,>;(System.Collections.Generic.IDictionary<TKey,TValue>,TKey,TValue);;Argument[0].Element;Argument[2];taint;generated |
+| System.Collections.Generic;CollectionExtensions;false;TryAdd<,>;(System.Collections.Generic.IDictionary<TKey,TValue>,TKey,TValue);;Argument[1];Argument[0].Element;taint;generated |
+| System.Collections.Generic;CollectionExtensions;false;TryAdd<,>;(System.Collections.Generic.IDictionary<TKey,TValue>,TKey,TValue);;Argument[2];Argument[0].Element;taint;generated |
 | System.Collections.Generic;Dictionary<,>+Enumerator;false;get_Current;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Generic;Dictionary<,>+Enumerator;false;get_Entry;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Generic;Dictionary<,>+Enumerator;false;get_Key;();;Argument[this];ReturnValue;taint;generated |
@@ -630,6 +637,8 @@ summary
 | System.Collections.Generic;IList<>;true;get_Item;(System.Int32);;Argument[this].Element;ReturnValue;value;manual |
 | System.Collections.Generic;IList<>;true;set_Item;(System.Int32,T);;Argument[1];Argument[this].Element;value;manual |
 | System.Collections.Generic;ISet<>;true;Add;(T);;Argument[0];Argument[this].Element;value;manual |
+| System.Collections.Generic;KeyValuePair;false;Create<,>;(TKey,TValue);;Argument[0];ReturnValue;taint;generated |
+| System.Collections.Generic;KeyValuePair;false;Create<,>;(TKey,TValue);;Argument[1];ReturnValue;taint;generated |
 | System.Collections.Generic;KeyValuePair<,>;false;Deconstruct;(TKey,TValue);;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Generic;KeyValuePair<,>;false;KeyValuePair;(TKey,TValue);;Argument[0];Argument[this].Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | System.Collections.Generic;KeyValuePair<,>;false;KeyValuePair;(TKey,TValue);;Argument[1];Argument[this].Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
@@ -834,6 +843,12 @@ summary
 | System.Collections.Immutable;ImmutableDictionary;false;Create<,>;(System.Collections.Generic.IEqualityComparer<TKey>);;Argument[0];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableDictionary;false;Create<,>;(System.Collections.Generic.IEqualityComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>);;Argument[0];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableDictionary;false;Create<,>;(System.Collections.Generic.IEqualityComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>);;Argument[1];ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableDictionary;false;CreateRange<,>;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[0].Element;ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableDictionary;false;CreateRange<,>;(System.Collections.Generic.IEqualityComparer<TKey>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[0];ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableDictionary;false;CreateRange<,>;(System.Collections.Generic.IEqualityComparer<TKey>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[1].Element;ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableDictionary;false;CreateRange<,>;(System.Collections.Generic.IEqualityComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[0];ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableDictionary;false;CreateRange<,>;(System.Collections.Generic.IEqualityComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[1];ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableDictionary;false;CreateRange<,>;(System.Collections.Generic.IEqualityComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[2].Element;ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableDictionary;false;GetValueOrDefault<,>;(System.Collections.Immutable.IImmutableDictionary<TKey,TValue>,TKey,TValue);;Argument[2];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableDictionary;false;ToImmutableDictionary<,>;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[0].Element;ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableDictionary;false;ToImmutableDictionary<,>;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>,System.Collections.Generic.IEqualityComparer<TKey>);;Argument[0].Element;ReturnValue;taint;generated |
@@ -901,6 +916,8 @@ summary
 | System.Collections.Immutable;ImmutableHashSet<>;false;get_KeyComparer;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableHashSet<>;false;get_SyncRoot;();;Argument[this];ReturnValue;value;generated |
 | System.Collections.Immutable;ImmutableInterlocked;false;GetOrAdd<,>;(System.Collections.Immutable.ImmutableDictionary<TKey,TValue>,TKey,TValue);;Argument[2];ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableList;false;Create<>;(T);;Argument[0];ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableList;false;CreateRange<>;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableList;false;Remove<>;(System.Collections.Immutable.IImmutableList<T>,T);;Argument[0].Element;ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableList;false;RemoveRange<>;(System.Collections.Immutable.IImmutableList<T>,System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableList;false;Replace<>;(System.Collections.Immutable.IImmutableList<T>,T,T);;Argument[0].Element;ReturnValue;taint;generated |
@@ -986,6 +1003,12 @@ summary
 | System.Collections.Immutable;ImmutableSortedDictionary;false;CreateBuilder<,>;(System.Collections.Generic.IComparer<TKey>);;Argument[0];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedDictionary;false;CreateBuilder<,>;(System.Collections.Generic.IComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>);;Argument[0];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedDictionary;false;CreateBuilder<,>;(System.Collections.Generic.IComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>);;Argument[1];ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableSortedDictionary;false;CreateRange<,>;(System.Collections.Generic.IComparer<TKey>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[0];ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableSortedDictionary;false;CreateRange<,>;(System.Collections.Generic.IComparer<TKey>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[1].Element;ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableSortedDictionary;false;CreateRange<,>;(System.Collections.Generic.IComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[0];ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableSortedDictionary;false;CreateRange<,>;(System.Collections.Generic.IComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[1];ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableSortedDictionary;false;CreateRange<,>;(System.Collections.Generic.IComparer<TKey>,System.Collections.Generic.IEqualityComparer<TValue>,System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[2].Element;ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableSortedDictionary;false;CreateRange<,>;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[0].Element;ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedDictionary;false;ToImmutableSortedDictionary<,>;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>);;Argument[0].Element;ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedDictionary;false;ToImmutableSortedDictionary<,>;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>,System.Collections.Generic.IComparer<TKey>);;Argument[0].Element;ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedDictionary;false;ToImmutableSortedDictionary<,>;(System.Collections.Generic.IEnumerable<System.Collections.Generic.KeyValuePair<TKey,TValue>>,System.Collections.Generic.IComparer<TKey>);;Argument[1];ReturnValue;taint;generated |
@@ -1008,6 +1031,7 @@ summary
 | System.Collections.Immutable;ImmutableSortedDictionary<,>+Builder;false;get_Values;();;Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];ReturnValue.Element;value;manual |
 | System.Collections.Immutable;ImmutableSortedDictionary<,>+Builder;false;set_KeyComparer;(System.Collections.Generic.IComparer<TKey>);;Argument[0];Argument[this];taint;generated |
 | System.Collections.Immutable;ImmutableSortedDictionary<,>+Builder;false;set_ValueComparer;(System.Collections.Generic.IEqualityComparer<TValue>);;Argument[0];Argument[this];taint;generated |
+| System.Collections.Immutable;ImmutableSortedDictionary<,>+Enumerator;false;get_Current;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedDictionary<,>;false;Add;(System.Collections.Generic.KeyValuePair<TKey,TValue>);;Argument[0].Property[System.Collections.Generic.KeyValuePair<,>.Key];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | System.Collections.Immutable;ImmutableSortedDictionary<,>;false;Add;(System.Collections.Generic.KeyValuePair<TKey,TValue>);;Argument[0].Property[System.Collections.Generic.KeyValuePair<,>.Value];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
 | System.Collections.Immutable;ImmutableSortedDictionary<,>;false;Add;(TKey,TValue);;Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
@@ -1034,7 +1058,10 @@ summary
 | System.Collections.Immutable;ImmutableSortedDictionary<,>;false;get_ValueComparer;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedDictionary<,>;false;get_Values;();;Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];ReturnValue.Element;value;manual |
 | System.Collections.Immutable;ImmutableSortedSet;false;Create<>;(System.Collections.Generic.IComparer<T>);;Argument[0];ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableSortedSet;false;Create<>;(System.Collections.Generic.IComparer<T>,T);;Argument[0];ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableSortedSet;false;Create<>;(System.Collections.Generic.IComparer<T>,T);;Argument[1];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet;false;Create<>;(System.Collections.Generic.IComparer<T>,T[]);;Argument[0];ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableSortedSet;false;Create<>;(T);;Argument[0];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet;false;CreateBuilder<>;(System.Collections.Generic.IComparer<T>);;Argument[0];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet;false;CreateRange<>;(System.Collections.Generic.IComparer<T>,System.Collections.Generic.IEnumerable<T>);;Argument[0];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet;false;CreateRange<>;(System.Collections.Generic.IComparer<T>,System.Collections.Generic.IEnumerable<T>);;Argument[1].Element;ReturnValue;taint;generated |
@@ -1046,6 +1073,7 @@ summary
 | System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Immutable.ImmutableSortedSet<>+Enumerator.Current];value;manual |
 | System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;IntersectWith;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;Argument[this];taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;Reverse;();;Argument[0].Element;ReturnValue.Element;value;manual |
+| System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;SymmetricExceptWith;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;Argument[this];taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;ToImmutable;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;TryGetValue;(T,T);;Argument[0];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;TryGetValue;(T,T);;Argument[this];ReturnValue;taint;generated |
@@ -1059,8 +1087,12 @@ summary
 | System.Collections.Immutable;ImmutableSortedSet<>;false;Add;(T);;Argument[0];Argument[this].Element;value;manual |
 | System.Collections.Immutable;ImmutableSortedSet<>;false;Except;(System.Collections.Generic.IEnumerable<T>);;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet<>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Immutable.ImmutableSortedSet<>+Enumerator.Current];value;manual |
+| System.Collections.Immutable;ImmutableSortedSet<>;false;Intersect;(System.Collections.Generic.IEnumerable<T>);;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet<>;false;Remove;(T);;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet<>;false;Reverse;();;Argument[0].Element;ReturnValue.Element;value;manual |
+| System.Collections.Immutable;ImmutableSortedSet<>;false;SymmetricExcept;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;Argument[this];taint;generated |
+| System.Collections.Immutable;ImmutableSortedSet<>;false;SymmetricExcept;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;ReturnValue;taint;generated |
+| System.Collections.Immutable;ImmutableSortedSet<>;false;SymmetricExcept;(System.Collections.Generic.IEnumerable<T>);;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet<>;false;ToBuilder;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet<>;false;TryGetValue;(T,T);;Argument[0];ReturnValue;taint;generated |
 | System.Collections.Immutable;ImmutableSortedSet<>;false;TryGetValue;(T,T);;Argument[this];ReturnValue;taint;generated |
@@ -1086,18 +1118,24 @@ summary
 | System.Collections.Immutable;ImmutableStack<>;false;Push;(T);;Argument[this];ReturnValue;taint;generated |
 | System.Collections.ObjectModel;Collection<>;false;Collection;(System.Collections.Generic.IList<T>);;Argument[0].Element;Argument[this];taint;generated |
 | System.Collections.ObjectModel;Collection<>;false;InsertItem;(System.Int32,T);;Argument[1];Argument[this];taint;generated |
+| System.Collections.ObjectModel;Collection<>;false;InsertItem;(System.Int32,T);;Argument[this];Argument[1];taint;generated |
 | System.Collections.ObjectModel;Collection<>;false;SetItem;(System.Int32,T);;Argument[1];Argument[this];taint;generated |
+| System.Collections.ObjectModel;Collection<>;false;SetItem;(System.Int32,T);;Argument[this];Argument[1];taint;generated |
 | System.Collections.ObjectModel;Collection<>;false;get_Items;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.ObjectModel;Collection<>;false;get_SyncRoot;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.ObjectModel;KeyedCollection<,>;false;InsertItem;(System.Int32,TItem);;Argument[1];Argument[this];taint;generated |
+| System.Collections.ObjectModel;KeyedCollection<,>;false;InsertItem;(System.Int32,TItem);;Argument[this];Argument[1];taint;generated |
 | System.Collections.ObjectModel;KeyedCollection<,>;false;KeyedCollection;(System.Collections.Generic.IEqualityComparer<TKey>,System.Int32);;Argument[0];Argument[this];taint;generated |
 | System.Collections.ObjectModel;KeyedCollection<,>;false;SetItem;(System.Int32,TItem);;Argument[1];Argument[this];taint;generated |
+| System.Collections.ObjectModel;KeyedCollection<,>;false;SetItem;(System.Int32,TItem);;Argument[this];Argument[1];taint;generated |
 | System.Collections.ObjectModel;KeyedCollection<,>;false;TryGetValue;(TKey,TItem);;Argument[this];ReturnValue;taint;generated |
 | System.Collections.ObjectModel;KeyedCollection<,>;false;get_Comparer;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.ObjectModel;KeyedCollection<,>;false;get_Dictionary;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections.ObjectModel;KeyedCollection<,>;false;get_Item;(TKey);;Argument[this].Element;ReturnValue;value;manual |
 | System.Collections.ObjectModel;ObservableCollection<>;false;InsertItem;(System.Int32,T);;Argument[1];Argument[this];taint;generated |
+| System.Collections.ObjectModel;ObservableCollection<>;false;InsertItem;(System.Int32,T);;Argument[this];Argument[1];taint;generated |
 | System.Collections.ObjectModel;ObservableCollection<>;false;SetItem;(System.Int32,T);;Argument[1];Argument[this];taint;generated |
+| System.Collections.ObjectModel;ObservableCollection<>;false;SetItem;(System.Int32,T);;Argument[this];Argument[1];taint;generated |
 | System.Collections.ObjectModel;ReadOnlyCollection<>;false;ReadOnlyCollection;(System.Collections.Generic.IList<T>);;Argument[0].Element;Argument[this];taint;generated |
 | System.Collections.ObjectModel;ReadOnlyCollection<>;false;get_Item;(System.Int32);;Argument[this].Element;ReturnValue;value;manual |
 | System.Collections.ObjectModel;ReadOnlyCollection<>;false;get_Items;();;Argument[this];ReturnValue;taint;generated |
@@ -1208,6 +1246,7 @@ summary
 | System.Collections;BitArray;false;Xor;(System.Collections.BitArray);;Argument[this];ReturnValue;value;generated |
 | System.Collections;BitArray;false;get_SyncRoot;();;Argument[this];ReturnValue;value;generated |
 | System.Collections;CollectionBase;false;Remove;(System.Object);;Argument[0];Argument[this];taint;generated |
+| System.Collections;CollectionBase;false;Remove;(System.Object);;Argument[this];Argument[0];taint;generated |
 | System.Collections;CollectionBase;false;get_InnerList;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections;CollectionBase;false;get_List;();;Argument[this];ReturnValue;taint;generated |
 | System.Collections;CollectionBase;false;get_SyncRoot;();;Argument[this];ReturnValue;taint;generated |
@@ -1384,7 +1423,9 @@ summary
 | System.ComponentModel;BaseNumberConverter;false;ConvertTo;(System.ComponentModel.ITypeDescriptorContext,System.Globalization.CultureInfo,System.Object,System.Type);;Argument[1];ReturnValue;taint;generated |
 | System.ComponentModel;BaseNumberConverter;false;ConvertTo;(System.ComponentModel.ITypeDescriptorContext,System.Globalization.CultureInfo,System.Object,System.Type);;Argument[2];ReturnValue;taint;generated |
 | System.ComponentModel;BindingList<>;false;InsertItem;(System.Int32,T);;Argument[1];Argument[this];taint;generated |
+| System.ComponentModel;BindingList<>;false;InsertItem;(System.Int32,T);;Argument[this];Argument[1];taint;generated |
 | System.ComponentModel;BindingList<>;false;SetItem;(System.Int32,T);;Argument[1];Argument[this];taint;generated |
+| System.ComponentModel;BindingList<>;false;SetItem;(System.Int32,T);;Argument[this];Argument[1];taint;generated |
 | System.ComponentModel;CategoryAttribute;false;CategoryAttribute;(System.String);;Argument[0];Argument[this];taint;generated |
 | System.ComponentModel;CategoryAttribute;false;get_Category;();;Argument[this];ReturnValue;taint;generated |
 | System.ComponentModel;CharConverter;false;ConvertTo;(System.ComponentModel.ITypeDescriptorContext,System.Globalization.CultureInfo,System.Object,System.Type);;Argument[2];ReturnValue;taint;generated |
@@ -1669,6 +1710,10 @@ summary
 | System.Data.Common;DataTableMappingCollection;false;set_Item;(System.String,System.Data.Common.DataTableMapping);;Argument[1];Argument[this].Element;value;manual |
 | System.Data.Common;DbCommand;false;ExecuteReader;();;Argument[this];ReturnValue;taint;generated |
 | System.Data.Common;DbCommand;false;ExecuteReader;(System.Data.CommandBehavior);;Argument[this];ReturnValue;taint;generated |
+| System.Data.Common;DbCommand;false;ExecuteReaderAsync;();;Argument[this];ReturnValue;taint;generated |
+| System.Data.Common;DbCommand;false;ExecuteReaderAsync;(System.Data.CommandBehavior);;Argument[this];ReturnValue;taint;generated |
+| System.Data.Common;DbCommand;false;ExecuteReaderAsync;(System.Data.CommandBehavior,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
+| System.Data.Common;DbCommand;false;ExecuteReaderAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Data.Common;DbCommand;false;get_Connection;();;Argument[this];ReturnValue;taint;generated |
 | System.Data.Common;DbCommand;false;get_Parameters;();;Argument[this];ReturnValue;taint;generated |
 | System.Data.Common;DbCommand;false;get_Transaction;();;Argument[this];ReturnValue;taint;generated |
@@ -1676,6 +1721,7 @@ summary
 | System.Data.Common;DbCommand;false;set_Connection;(System.Data.IDbConnection);;Argument[0];Argument[this];taint;generated |
 | System.Data.Common;DbCommand;false;set_Transaction;(System.Data.Common.DbTransaction);;Argument[0];Argument[this];taint;generated |
 | System.Data.Common;DbCommand;false;set_Transaction;(System.Data.IDbTransaction);;Argument[0];Argument[this];taint;generated |
+| System.Data.Common;DbCommand;true;ExecuteDbDataReaderAsync;(System.Data.CommandBehavior,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Data.Common;DbCommand;true;PrepareAsync;(System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Data.Common;DbCommandBuilder;false;GetDeleteCommand;();;Argument[this];ReturnValue;taint;generated |
 | System.Data.Common;DbCommandBuilder;false;GetDeleteCommand;(System.Boolean);;Argument[this];ReturnValue;taint;generated |
@@ -1704,6 +1750,7 @@ summary
 | System.Data.Common;DbConnectionStringBuilder;false;AppendKeyValuePair;(System.Text.StringBuilder,System.String,System.String);;Argument[2];Argument[0];taint;generated |
 | System.Data.Common;DbConnectionStringBuilder;false;AppendKeyValuePair;(System.Text.StringBuilder,System.String,System.String,System.Boolean);;Argument[1];Argument[0];taint;generated |
 | System.Data.Common;DbConnectionStringBuilder;false;AppendKeyValuePair;(System.Text.StringBuilder,System.String,System.String,System.Boolean);;Argument[2];Argument[0];taint;generated |
+| System.Data.Common;DbConnectionStringBuilder;false;GetEnumerator;();;Argument[this];ReturnValue;taint;generated |
 | System.Data.Common;DbConnectionStringBuilder;false;GetProperties;();;Argument[this];ReturnValue;taint;generated |
 | System.Data.Common;DbConnectionStringBuilder;false;GetProperties;(System.Attribute[]);;Argument[this];ReturnValue;taint;generated |
 | System.Data.Common;DbConnectionStringBuilder;false;GetPropertyOwner;(System.ComponentModel.PropertyDescriptor);;Argument[this];ReturnValue;value;generated |
@@ -1733,9 +1780,12 @@ summary
 | System.Data.Common;DbDataAdapter;true;CreateRowUpdatingEvent;(System.Data.DataRow,System.Data.IDbCommand,System.Data.StatementType,System.Data.Common.DataTableMapping);;Argument[0];ReturnValue;taint;generated |
 | System.Data.Common;DbDataAdapter;true;CreateRowUpdatingEvent;(System.Data.DataRow,System.Data.IDbCommand,System.Data.StatementType,System.Data.Common.DataTableMapping);;Argument[1];ReturnValue;taint;generated |
 | System.Data.Common;DbDataAdapter;true;CreateRowUpdatingEvent;(System.Data.DataRow,System.Data.IDbCommand,System.Data.StatementType,System.Data.Common.DataTableMapping);;Argument[3];ReturnValue;taint;generated |
+| System.Data.Common;DbDataReader;false;GetFieldValueAsync<>;(System.Int32);;Argument[this];ReturnValue;taint;generated |
 | System.Data.Common;DbDataReader;true;GetFieldValue<>;(System.Int32);;Argument[this];ReturnValue;taint;generated |
+| System.Data.Common;DbDataReader;true;GetFieldValueAsync<>;(System.Int32,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Data.Common;DbDataReader;true;GetProviderSpecificValue;(System.Int32);;Argument[this];ReturnValue;taint;generated |
 | System.Data.Common;DbDataReader;true;GetProviderSpecificValues;(System.Object[]);;Argument[this];Argument[0].Element;taint;generated |
+| System.Data.Common;DbDataReader;true;GetSchemaTableAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Data.Common;DbDataReader;true;GetTextReader;(System.Int32);;Argument[this];ReturnValue;taint;generated |
 | System.Data.Common;DbDataRecord;false;GetPropertyOwner;(System.ComponentModel.PropertyDescriptor);;Argument[this];ReturnValue;value;generated |
 | System.Data.Common;DbEnumerator;false;DbEnumerator;(System.Data.IDataReader);;Argument[0];Argument[this];taint;generated |
@@ -1870,8 +1920,11 @@ summary
 | System.Data;DataColumn;false;set_Prefix;(System.String);;Argument[0];Argument[this];taint;generated |
 | System.Data;DataColumnChangeEventArgs;false;DataColumnChangeEventArgs;(System.Data.DataRow,System.Data.DataColumn,System.Object);;Argument[1];Argument[this];taint;generated |
 | System.Data;DataColumnChangeEventArgs;false;get_Column;();;Argument[this];ReturnValue;taint;generated |
+| System.Data;DataColumnCollection;false;Add;();;Argument[this];ReturnValue;taint;generated |
 | System.Data;DataColumnCollection;false;Add;(System.Data.DataColumn);;Argument[0];Argument[this].Element;value;manual |
 | System.Data;DataColumnCollection;false;Add;(System.String);;Argument[0];Argument[this].Element;value;manual |
+| System.Data;DataColumnCollection;false;Add;(System.String,System.Type);;Argument[this];ReturnValue;taint;generated |
+| System.Data;DataColumnCollection;false;Add;(System.String,System.Type,System.String);;Argument[this];ReturnValue;taint;generated |
 | System.Data;DataColumnCollection;false;AddRange;(System.Data.DataColumn[]);;Argument[0].Element;Argument[this].Element;value;manual |
 | System.Data;DataColumnCollection;false;CopyTo;(System.Data.DataColumn[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Data;DataColumnCollection;false;get_Item;(System.Int32);;Argument[this];ReturnValue;taint;generated |
@@ -1879,6 +1932,7 @@ summary
 | System.Data;DataColumnCollection;false;get_List;();;Argument[this];ReturnValue;taint;generated |
 | System.Data;DataReaderExtensions;false;GetDateTime;(System.Data.Common.DbDataReader,System.String);;Argument[0].Element;ReturnValue;taint;generated |
 | System.Data;DataReaderExtensions;false;GetFieldValue<>;(System.Data.Common.DbDataReader,System.String);;Argument[0].Element;ReturnValue;taint;generated |
+| System.Data;DataReaderExtensions;false;GetFieldValueAsync<>;(System.Data.Common.DbDataReader,System.String,System.Threading.CancellationToken);;Argument[0].Element;ReturnValue;taint;generated |
 | System.Data;DataReaderExtensions;false;GetGuid;(System.Data.Common.DbDataReader,System.String);;Argument[0].Element;ReturnValue;taint;generated |
 | System.Data;DataReaderExtensions;false;GetProviderSpecificValue;(System.Data.Common.DbDataReader,System.String);;Argument[0].Element;ReturnValue;taint;generated |
 | System.Data;DataReaderExtensions;false;GetString;(System.Data.Common.DbDataReader,System.String);;Argument[0].Element;ReturnValue;taint;generated |
@@ -1910,10 +1964,16 @@ summary
 | System.Data;DataRelationCollection;false;Add;(System.Data.DataRelation);;Argument[0];Argument[this].Element;value;manual |
 | System.Data;DataRelationCollection;false;CopyTo;(System.Data.DataRelation[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Data;DataRelationCollection;false;Remove;(System.Data.DataRelation);;Argument[0];Argument[this];taint;generated |
+| System.Data;DataRelationCollection;true;Add;(System.Data.DataColumn,System.Data.DataColumn);;Argument[this];ReturnValue;taint;generated |
+| System.Data;DataRelationCollection;true;Add;(System.Data.DataColumn[],System.Data.DataColumn[]);;Argument[this];ReturnValue;taint;generated |
+| System.Data;DataRelationCollection;true;Add;(System.String,System.Data.DataColumn,System.Data.DataColumn);;Argument[this];ReturnValue;taint;generated |
 | System.Data;DataRelationCollection;true;Add;(System.String,System.Data.DataColumn,System.Data.DataColumn,System.Boolean);;Argument[0];Argument[this];taint;generated |
 | System.Data;DataRelationCollection;true;Add;(System.String,System.Data.DataColumn,System.Data.DataColumn,System.Boolean);;Argument[0];ReturnValue;taint;generated |
+| System.Data;DataRelationCollection;true;Add;(System.String,System.Data.DataColumn,System.Data.DataColumn,System.Boolean);;Argument[this];ReturnValue;taint;generated |
+| System.Data;DataRelationCollection;true;Add;(System.String,System.Data.DataColumn[],System.Data.DataColumn[]);;Argument[this];ReturnValue;taint;generated |
 | System.Data;DataRelationCollection;true;Add;(System.String,System.Data.DataColumn[],System.Data.DataColumn[],System.Boolean);;Argument[0];Argument[this];taint;generated |
 | System.Data;DataRelationCollection;true;Add;(System.String,System.Data.DataColumn[],System.Data.DataColumn[],System.Boolean);;Argument[0];ReturnValue;taint;generated |
+| System.Data;DataRelationCollection;true;Add;(System.String,System.Data.DataColumn[],System.Data.DataColumn[],System.Boolean);;Argument[this];ReturnValue;taint;generated |
 | System.Data;DataRelationCollection;true;AddRange;(System.Data.DataRelation[]);;Argument[0].Element;Argument[this].Element;value;manual |
 | System.Data;DataRow;false;DataRow;(System.Data.DataRowBuilder);;Argument[0];Argument[this];taint;generated |
 | System.Data;DataRow;false;GetChildRows;(System.Data.DataRelation);;Argument[this];ReturnValue;taint;generated |
@@ -2017,10 +2077,12 @@ summary
 | System.Data;DataTable;false;set_PrimaryKey;(System.Data.DataColumn[]);;Argument[0].Element;Argument[this];taint;generated |
 | System.Data;DataTable;false;set_Site;(System.ComponentModel.ISite);;Argument[0];Argument[this];taint;generated |
 | System.Data;DataTable;false;set_TableName;(System.String);;Argument[0];Argument[this];taint;generated |
+| System.Data;DataTableCollection;false;Add;();;Argument[this];ReturnValue;taint;generated |
 | System.Data;DataTableCollection;false;Add;(System.Data.DataTable);;Argument[0];Argument[this].Element;value;manual |
 | System.Data;DataTableCollection;false;Add;(System.String);;Argument[0];Argument[this].Element;value;manual |
 | System.Data;DataTableCollection;false;Add;(System.String,System.String);;Argument[1];Argument[this];taint;generated |
 | System.Data;DataTableCollection;false;Add;(System.String,System.String);;Argument[1];ReturnValue;taint;generated |
+| System.Data;DataTableCollection;false;Add;(System.String,System.String);;Argument[this];ReturnValue;taint;generated |
 | System.Data;DataTableCollection;false;AddRange;(System.Data.DataTable[]);;Argument[0].Element;Argument[this].Element;value;manual |
 | System.Data;DataTableCollection;false;CopyTo;(System.Data.DataTable[],System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Data;DataTableCollection;false;get_Item;(System.Int32);;Argument[this];ReturnValue;taint;generated |
@@ -2598,7 +2660,10 @@ summary
 | System.IO.Compression;ZipArchiveEntry;false;get_LastWriteTime;();;Argument[this];ReturnValue;taint;generated |
 | System.IO.Compression;ZipArchiveEntry;false;get_Name;();;Argument[this];ReturnValue;taint;generated |
 | System.IO.Compression;ZipArchiveEntry;false;set_LastWriteTime;(System.DateTimeOffset);;Argument[0];Argument[this];taint;generated |
+| System.IO.Compression;ZipFile;false;Open;(System.String,System.IO.Compression.ZipArchiveMode);;Argument[0];ReturnValue;taint;generated |
+| System.IO.Compression;ZipFile;false;Open;(System.String,System.IO.Compression.ZipArchiveMode,System.Text.Encoding);;Argument[0];ReturnValue;taint;generated |
 | System.IO.Compression;ZipFile;false;Open;(System.String,System.IO.Compression.ZipArchiveMode,System.Text.Encoding);;Argument[2];ReturnValue;taint;generated |
+| System.IO.Compression;ZipFile;false;OpenRead;(System.String);;Argument[0];ReturnValue;taint;generated |
 | System.IO.Compression;ZipFileExtensions;false;CreateEntryFromFile;(System.IO.Compression.ZipArchive,System.String,System.String);;Argument[0];ReturnValue;taint;generated |
 | System.IO.Compression;ZipFileExtensions;false;CreateEntryFromFile;(System.IO.Compression.ZipArchive,System.String,System.String);;Argument[2];ReturnValue;taint;generated |
 | System.IO.Compression;ZipFileExtensions;false;CreateEntryFromFile;(System.IO.Compression.ZipArchive,System.String,System.String,System.IO.Compression.CompressionLevel);;Argument[0];ReturnValue;taint;generated |
@@ -2613,11 +2678,14 @@ summary
 | System.IO.IsolatedStorage;IsolatedStorage;false;get_DomainIdentity;();;Argument[this];ReturnValue;taint;generated |
 | System.IO.IsolatedStorage;IsolatedStorageFileStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.IO.IsolatedStorage;IsolatedStorageFileStream;false;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
-| System.IO.IsolatedStorage;IsolatedStorageFileStream;false;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO.IsolatedStorage;IsolatedStorageFileStream;false;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.IO.IsolatedStorage;IsolatedStorageFileStream;false;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
-| System.IO.IsolatedStorage;IsolatedStorageFileStream;false;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO.MemoryMappedFiles;MemoryMappedFile;false;CreateFromFile;(System.IO.FileStream,System.String,System.Int64,System.IO.MemoryMappedFiles.MemoryMappedFileAccess,System.IO.HandleInheritability,System.Boolean);;Argument[0];ReturnValue;taint;generated |
+| System.IO.MemoryMappedFiles;MemoryMappedFile;false;CreateFromFile;(System.String);;Argument[0];ReturnValue;taint;generated |
+| System.IO.MemoryMappedFiles;MemoryMappedFile;false;CreateFromFile;(System.String,System.IO.FileMode);;Argument[0];ReturnValue;taint;generated |
+| System.IO.MemoryMappedFiles;MemoryMappedFile;false;CreateFromFile;(System.String,System.IO.FileMode,System.String);;Argument[0];ReturnValue;taint;generated |
+| System.IO.MemoryMappedFiles;MemoryMappedFile;false;CreateFromFile;(System.String,System.IO.FileMode,System.String,System.Int64);;Argument[0];ReturnValue;taint;generated |
+| System.IO.MemoryMappedFiles;MemoryMappedFile;false;CreateFromFile;(System.String,System.IO.FileMode,System.String,System.Int64,System.IO.MemoryMappedFiles.MemoryMappedFileAccess);;Argument[0];ReturnValue;taint;generated |
 | System.IO.MemoryMappedFiles;MemoryMappedFile;false;get_SafeMemoryMappedFileHandle;();;Argument[this];ReturnValue;taint;generated |
 | System.IO.MemoryMappedFiles;MemoryMappedViewAccessor;false;get_SafeMemoryMappedViewHandle;();;Argument[this];ReturnValue;taint;generated |
 | System.IO.MemoryMappedFiles;MemoryMappedViewStream;false;get_SafeMemoryMappedViewHandle;();;Argument[this];ReturnValue;taint;generated |
@@ -2655,6 +2723,7 @@ summary
 | System.IO;BinaryReader;false;get_BaseStream;();;Argument[this];ReturnValue;taint;generated |
 | System.IO;BinaryWriter;false;BinaryWriter;(System.IO.Stream,System.Text.Encoding,System.Boolean);;Argument[0];Argument[this];taint;generated |
 | System.IO;BinaryWriter;false;BinaryWriter;(System.IO.Stream,System.Text.Encoding,System.Boolean);;Argument[1];Argument[this];taint;generated |
+| System.IO;BinaryWriter;false;DisposeAsync;();;Argument[this];ReturnValue;taint;generated |
 | System.IO;BinaryWriter;false;Write;(System.Byte[]);;Argument[0].Element;Argument[this];taint;generated |
 | System.IO;BinaryWriter;false;Write;(System.Byte[],System.Int32,System.Int32);;Argument[0].Element;Argument[this];taint;generated |
 | System.IO;BinaryWriter;false;get_BaseStream;();;Argument[this];ReturnValue;taint;generated |
@@ -2694,8 +2763,19 @@ summary
 | System.IO;File;false;AppendAllLinesAsync;(System.String,System.Collections.Generic.IEnumerable<System.String>,System.Threading.CancellationToken);;Argument[2];ReturnValue;taint;generated |
 | System.IO;File;false;AppendAllTextAsync;(System.String,System.String,System.Text.Encoding,System.Threading.CancellationToken);;Argument[3];ReturnValue;taint;generated |
 | System.IO;File;false;AppendAllTextAsync;(System.String,System.String,System.Threading.CancellationToken);;Argument[2];ReturnValue;taint;generated |
+| System.IO;File;false;Create;(System.String);;Argument[0];ReturnValue;taint;generated |
+| System.IO;File;false;Create;(System.String,System.Int32);;Argument[0];ReturnValue;taint;generated |
+| System.IO;File;false;Create;(System.String,System.Int32,System.IO.FileOptions);;Argument[0];ReturnValue;taint;generated |
 | System.IO;File;false;CreateSymbolicLink;(System.String,System.String);;Argument[0];ReturnValue;taint;generated |
+| System.IO;File;false;Open;(System.String,System.IO.FileMode);;Argument[0];ReturnValue;taint;generated |
+| System.IO;File;false;Open;(System.String,System.IO.FileMode,System.IO.FileAccess);;Argument[0];ReturnValue;taint;generated |
+| System.IO;File;false;Open;(System.String,System.IO.FileMode,System.IO.FileAccess,System.IO.FileShare);;Argument[0];ReturnValue;taint;generated |
 | System.IO;File;false;OpenHandle;(System.String,System.IO.FileMode,System.IO.FileAccess,System.IO.FileShare,System.IO.FileOptions,System.Int64);;Argument[0];ReturnValue;taint;generated |
+| System.IO;File;false;OpenRead;(System.String);;Argument[0];ReturnValue;taint;generated |
+| System.IO;File;false;OpenText;(System.String);;Argument[0];ReturnValue;taint;generated |
+| System.IO;File;false;OpenWrite;(System.String);;Argument[0];ReturnValue;taint;generated |
+| System.IO;File;false;ReadAllText;(System.String);;Argument[0];ReturnValue;taint;generated |
+| System.IO;File;false;ReadAllText;(System.String,System.Text.Encoding);;Argument[0];ReturnValue;taint;generated |
 | System.IO;File;false;ReadLines;(System.String);;Argument[0];ReturnValue;taint;generated |
 | System.IO;File;false;ReadLines;(System.String,System.Text.Encoding);;Argument[0];ReturnValue;taint;generated |
 | System.IO;File;false;ReadLines;(System.String,System.Text.Encoding);;Argument[1];ReturnValue;taint;generated |
@@ -2706,8 +2786,15 @@ summary
 | System.IO;File;false;WriteAllTextAsync;(System.String,System.String,System.Threading.CancellationToken);;Argument[2];ReturnValue;taint;generated |
 | System.IO;FileInfo;false;CopyTo;(System.String);;Argument[0];ReturnValue;taint;generated |
 | System.IO;FileInfo;false;CopyTo;(System.String,System.Boolean);;Argument[0];ReturnValue;taint;generated |
+| System.IO;FileInfo;false;Create;();;Argument[this];ReturnValue;taint;generated |
 | System.IO;FileInfo;false;MoveTo;(System.String);;Argument[0];Argument[this];taint;generated |
 | System.IO;FileInfo;false;MoveTo;(System.String,System.Boolean);;Argument[0];Argument[this];taint;generated |
+| System.IO;FileInfo;false;Open;(System.IO.FileMode);;Argument[this];ReturnValue;taint;generated |
+| System.IO;FileInfo;false;Open;(System.IO.FileMode,System.IO.FileAccess);;Argument[this];ReturnValue;taint;generated |
+| System.IO;FileInfo;false;Open;(System.IO.FileMode,System.IO.FileAccess,System.IO.FileShare);;Argument[this];ReturnValue;taint;generated |
+| System.IO;FileInfo;false;OpenRead;();;Argument[this];ReturnValue;taint;generated |
+| System.IO;FileInfo;false;OpenText;();;Argument[this];ReturnValue;taint;generated |
+| System.IO;FileInfo;false;OpenWrite;();;Argument[this];ReturnValue;taint;generated |
 | System.IO;FileInfo;false;get_Directory;();;Argument[this];ReturnValue;taint;generated |
 | System.IO;FileInfo;false;get_DirectoryName;();;Argument[this];ReturnValue;taint;generated |
 | System.IO;FileLoadException;false;GetObjectData;(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext);;Argument[this];Argument[0];taint;generated |
@@ -2723,10 +2810,8 @@ summary
 | System.IO;FileStream;false;FileStream;(System.String,System.IO.FileMode,System.IO.FileAccess,System.IO.FileShare,System.Int32,System.IO.FileOptions);;Argument[0];Argument[this];taint;manual |
 | System.IO;FileStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.IO;FileStream;false;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
-| System.IO;FileStream;false;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO;FileStream;false;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.IO;FileStream;false;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
-| System.IO;FileStream;false;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO;FileStream;false;get_SafeFileHandle;();;Argument[this];ReturnValue;taint;generated |
 | System.IO;FileSystemEventArgs;false;FileSystemEventArgs;(System.IO.WatcherChangeTypes,System.String,System.String);;Argument[1];Argument[this];taint;generated |
 | System.IO;FileSystemEventArgs;false;FileSystemEventArgs;(System.IO.WatcherChangeTypes,System.String,System.String);;Argument[2];Argument[this];taint;generated |
@@ -2811,6 +2896,7 @@ summary
 | System.IO;Stream;false;CopyToAsync;(System.IO.Stream);;Argument[this];Argument[0];taint;manual |
 | System.IO;Stream;false;CopyToAsync;(System.IO.Stream,System.Int32);;Argument[this];Argument[0];taint;manual |
 | System.IO;Stream;false;CopyToAsync;(System.IO.Stream,System.Threading.CancellationToken);;Argument[this];Argument[0];taint;manual |
+| System.IO;Stream;false;FlushAsync;();;Argument[this];ReturnValue;taint;generated |
 | System.IO;Stream;false;ReadAsync;(System.Byte[],System.Int32,System.Int32);;Argument[this];Argument[0].Element;taint;manual |
 | System.IO;Stream;false;Synchronized;(System.IO.Stream);;Argument[0];ReturnValue;taint;generated |
 | System.IO;Stream;false;WriteAsync;(System.Byte[],System.Int32,System.Int32);;Argument[0].Element;Argument[this];taint;manual |
@@ -2818,10 +2904,13 @@ summary
 | System.IO;Stream;true;BeginWrite;(System.Byte[],System.Int32,System.Int32,System.AsyncCallback,System.Object);;Argument[0].Element;Argument[this];taint;manual |
 | System.IO;Stream;true;CopyTo;(System.IO.Stream,System.Int32);;Argument[this];Argument[0];taint;manual |
 | System.IO;Stream;true;CopyToAsync;(System.IO.Stream,System.Int32,System.Threading.CancellationToken);;Argument[this];Argument[0];taint;manual |
+| System.IO;Stream;true;FlushAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO;Stream;true;Read;(System.Byte[],System.Int32,System.Int32);;Argument[this];Argument[0].Element;taint;manual |
 | System.IO;Stream;true;ReadAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);;Argument[this];Argument[0].Element;taint;manual |
+| System.IO;Stream;true;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO;Stream;true;Write;(System.Byte[],System.Int32,System.Int32);;Argument[0].Element;Argument[this];taint;manual |
 | System.IO;Stream;true;WriteAsync;(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken);;Argument[0].Element;Argument[this];taint;manual |
+| System.IO;Stream;true;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO;StreamReader;false;StreamReader;(System.IO.Stream);;Argument[0];Argument[this];taint;manual |
 | System.IO;StreamReader;false;StreamReader;(System.IO.Stream,System.Boolean);;Argument[0];Argument[this];taint;manual |
 | System.IO;StreamReader;false;StreamReader;(System.IO.Stream,System.Text.Encoding);;Argument[0];Argument[this];taint;manual |
@@ -2847,10 +2936,13 @@ summary
 | System.IO;StringWriter;false;ToString;();;Argument[this];ReturnValue;taint;generated |
 | System.IO;StringWriter;false;Write;(System.Char[],System.Int32,System.Int32);;Argument[0].Element;Argument[this];taint;generated |
 | System.IO;StringWriter;false;Write;(System.String);;Argument[0];Argument[this];taint;generated |
+| System.IO;StringWriter;false;Write;(System.Text.StringBuilder);;Argument[0];Argument[this];taint;generated |
 | System.IO;StringWriter;false;WriteAsync;(System.Char[],System.Int32,System.Int32);;Argument[0].Element;Argument[this];taint;generated |
 | System.IO;StringWriter;false;WriteAsync;(System.String);;Argument[0];Argument[this];taint;generated |
+| System.IO;StringWriter;false;WriteAsync;(System.Text.StringBuilder,System.Threading.CancellationToken);;Argument[0];Argument[this];taint;generated |
 | System.IO;StringWriter;false;WriteLineAsync;(System.Char[],System.Int32,System.Int32);;Argument[0].Element;Argument[this];taint;generated |
 | System.IO;StringWriter;false;WriteLineAsync;(System.String);;Argument[0];Argument[this];taint;generated |
+| System.IO;StringWriter;false;WriteLineAsync;(System.Text.StringBuilder,System.Threading.CancellationToken);;Argument[0];Argument[this];taint;generated |
 | System.IO;TextReader;false;Synchronized;(System.IO.TextReader);;Argument[0];ReturnValue;taint;generated |
 | System.IO;TextReader;true;Read;();;Argument[this];ReturnValue;taint;manual |
 | System.IO;TextReader;true;Read;(System.Char[],System.Int32,System.Int32);;Argument[this];ReturnValue;taint;manual |
@@ -2868,7 +2960,12 @@ summary
 | System.IO;TextWriter;false;Synchronized;(System.IO.TextWriter);;Argument[0];ReturnValue;taint;generated |
 | System.IO;TextWriter;false;TextWriter;(System.IFormatProvider);;Argument[0];Argument[this];taint;generated |
 | System.IO;TextWriter;false;WriteAsync;(System.Char[]);;Argument[0].Element;Argument[this];taint;generated |
+| System.IO;TextWriter;false;WriteAsync;(System.Char[]);;Argument[0].Element;ReturnValue;taint;generated |
+| System.IO;TextWriter;false;WriteAsync;(System.Char[]);;Argument[this];ReturnValue;taint;generated |
 | System.IO;TextWriter;false;WriteLineAsync;(System.Char[]);;Argument[0].Element;Argument[this];taint;generated |
+| System.IO;TextWriter;false;WriteLineAsync;(System.Char[]);;Argument[0].Element;ReturnValue;taint;generated |
+| System.IO;TextWriter;false;WriteLineAsync;(System.Char[]);;Argument[this];ReturnValue;taint;generated |
+| System.IO;TextWriter;true;FlushAsync;();;Argument[this];ReturnValue;taint;generated |
 | System.IO;TextWriter;true;Write;(System.Char[]);;Argument[0].Element;Argument[this];taint;generated |
 | System.IO;TextWriter;true;Write;(System.Object);;Argument[0];Argument[this];taint;generated |
 | System.IO;TextWriter;true;Write;(System.String,System.Object);;Argument[0];Argument[this];taint;generated |
@@ -2882,7 +2979,14 @@ summary
 | System.IO;TextWriter;true;Write;(System.String,System.Object,System.Object,System.Object);;Argument[3];Argument[this];taint;generated |
 | System.IO;TextWriter;true;Write;(System.String,System.Object[]);;Argument[0];Argument[this];taint;generated |
 | System.IO;TextWriter;true;Write;(System.String,System.Object[]);;Argument[1].Element;Argument[this];taint;generated |
+| System.IO;TextWriter;true;WriteAsync;(System.Char);;Argument[this];ReturnValue;taint;generated |
+| System.IO;TextWriter;true;WriteAsync;(System.Char[],System.Int32,System.Int32);;Argument[0].Element;ReturnValue;taint;generated |
+| System.IO;TextWriter;true;WriteAsync;(System.Char[],System.Int32,System.Int32);;Argument[this];ReturnValue;taint;generated |
+| System.IO;TextWriter;true;WriteAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.IO;TextWriter;true;WriteAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
+| System.IO;TextWriter;true;WriteAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
+| System.IO;TextWriter;true;WriteAsync;(System.String);;Argument[0];ReturnValue;taint;generated |
+| System.IO;TextWriter;true;WriteAsync;(System.String);;Argument[this];ReturnValue;taint;generated |
 | System.IO;TextWriter;true;WriteAsync;(System.Text.StringBuilder,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
 | System.IO;TextWriter;true;WriteLine;(System.Char[]);;Argument[0].Element;Argument[this];taint;generated |
 | System.IO;TextWriter;true;WriteLine;(System.Char[],System.Int32,System.Int32);;Argument[0].Element;Argument[this];taint;generated |
@@ -2899,8 +3003,18 @@ summary
 | System.IO;TextWriter;true;WriteLine;(System.String,System.Object,System.Object,System.Object);;Argument[3];Argument[this];taint;generated |
 | System.IO;TextWriter;true;WriteLine;(System.String,System.Object[]);;Argument[0];Argument[this];taint;generated |
 | System.IO;TextWriter;true;WriteLine;(System.String,System.Object[]);;Argument[1].Element;Argument[this];taint;generated |
+| System.IO;TextWriter;true;WriteLine;(System.Text.StringBuilder);;Argument[0];Argument[this];taint;generated |
+| System.IO;TextWriter;true;WriteLineAsync;();;Argument[this];ReturnValue;taint;generated |
+| System.IO;TextWriter;true;WriteLineAsync;(System.Char);;Argument[this];ReturnValue;taint;generated |
+| System.IO;TextWriter;true;WriteLineAsync;(System.Char[],System.Int32,System.Int32);;Argument[0].Element;ReturnValue;taint;generated |
+| System.IO;TextWriter;true;WriteLineAsync;(System.Char[],System.Int32,System.Int32);;Argument[this];ReturnValue;taint;generated |
+| System.IO;TextWriter;true;WriteLineAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.IO;TextWriter;true;WriteLineAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
+| System.IO;TextWriter;true;WriteLineAsync;(System.ReadOnlyMemory<System.Char>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
+| System.IO;TextWriter;true;WriteLineAsync;(System.String);;Argument[0];ReturnValue;taint;generated |
+| System.IO;TextWriter;true;WriteLineAsync;(System.String);;Argument[this];ReturnValue;taint;generated |
 | System.IO;TextWriter;true;WriteLineAsync;(System.Text.StringBuilder,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
+| System.IO;TextWriter;true;WriteLineAsync;(System.Text.StringBuilder,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.IO;TextWriter;true;get_FormatProvider;();;Argument[this];ReturnValue;taint;generated |
 | System.IO;TextWriter;true;get_NewLine;();;Argument[this];ReturnValue;taint;generated |
 | System.IO;TextWriter;true;set_NewLine;(System.String);;Argument[0];Argument[this];taint;generated |
@@ -4095,6 +4209,7 @@ summary
 | System.Net.Http.Headers;HeaderStringValues;false;ToString;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http.Headers;HttpHeaders;false;get_NonValidated;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http.Headers;HttpHeadersNonValidated+Enumerator;false;get_Current;();;Argument[this];ReturnValue;taint;generated |
+| System.Net.Http.Headers;HttpHeadersNonValidated;false;GetEnumerator;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http.Headers;HttpHeadersNonValidated;false;TryGetValue;(System.String,System.Net.Http.Headers.HeaderStringValues);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Http.Headers;HttpHeadersNonValidated;false;TryGetValues;(System.String,System.Net.Http.Headers.HeaderStringValues);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Http.Headers;HttpHeadersNonValidated;false;get_Item;(System.String);;Argument[0];ReturnValue;taint;generated |
@@ -4194,12 +4309,17 @@ summary
 | System.Net.Http.Json;JsonContent;false;Create<>;(T,System.Net.Http.Headers.MediaTypeHeaderValue,System.Text.Json.JsonSerializerOptions);;Argument[2];ReturnValue;taint;generated |
 | System.Net.Http;ByteArrayContent;false;ByteArrayContent;(System.Byte[]);;Argument[0].Element;Argument[this];taint;generated |
 | System.Net.Http;ByteArrayContent;false;ByteArrayContent;(System.Byte[],System.Int32,System.Int32);;Argument[0].Element;Argument[this];taint;generated |
+| System.Net.Http;ByteArrayContent;false;CreateContentReadStreamAsync;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http;ByteArrayContent;false;SerializeToStream;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[this];Argument[0];taint;generated |
+| System.Net.Http;ByteArrayContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Http;ByteArrayContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext);;Argument[this];Argument[0];taint;generated |
+| System.Net.Http;ByteArrayContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext);;Argument[this];ReturnValue;taint;generated |
+| System.Net.Http;ByteArrayContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[2];ReturnValue;taint;generated |
 | System.Net.Http;DelegatingHandler;false;DelegatingHandler;(System.Net.Http.HttpMessageHandler);;Argument[0];Argument[this];taint;generated |
 | System.Net.Http;DelegatingHandler;false;SendAsync;(System.Net.Http.HttpRequestMessage,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
 | System.Net.Http;DelegatingHandler;false;get_InnerHandler;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http;DelegatingHandler;false;set_InnerHandler;(System.Net.Http.HttpMessageHandler);;Argument[0];Argument[this];taint;generated |
+| System.Net.Http;FormUrlEncodedContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[2];ReturnValue;taint;generated |
 | System.Net.Http;HttpClient;false;Send;(System.Net.Http.HttpRequestMessage);;Argument[this];Argument[0];taint;generated |
 | System.Net.Http;HttpClient;false;Send;(System.Net.Http.HttpRequestMessage,System.Net.Http.HttpCompletionOption);;Argument[this];Argument[0];taint;generated |
 | System.Net.Http;HttpClient;false;Send;(System.Net.Http.HttpRequestMessage,System.Net.Http.HttpCompletionOption,System.Threading.CancellationToken);;Argument[this];Argument[0];taint;generated |
@@ -4226,7 +4346,10 @@ summary
 | System.Net.Http;HttpContent;false;ReadAsStreamAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http;HttpContent;false;get_Headers;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http;HttpContent;true;CreateContentReadStream;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
+| System.Net.Http;HttpContent;true;CreateContentReadStreamAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
+| System.Net.Http;HttpContent;true;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Http;HttpContent;true;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[this];Argument[0];taint;generated |
+| System.Net.Http;HttpContent;true;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http;HttpMessageInvoker;false;HttpMessageInvoker;(System.Net.Http.HttpMessageHandler,System.Boolean);;Argument[0];Argument[this];taint;generated |
 | System.Net.Http;HttpMessageInvoker;false;SendAsync;(System.Net.Http.HttpRequestMessage,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
 | System.Net.Http;HttpMethod;false;HttpMethod;(System.String);;Argument[0];Argument[this];taint;generated |
@@ -4262,6 +4385,7 @@ summary
 | System.Net.Http;MultipartFormDataContent;false;Add;(System.Net.Http.HttpContent);;Argument[0];Argument[this].Element;value;manual |
 | System.Net.Http;MultipartFormDataContent;false;Add;(System.Net.Http.HttpContent,System.String);;Argument[0];Argument[this];taint;generated |
 | System.Net.Http;MultipartFormDataContent;false;Add;(System.Net.Http.HttpContent,System.String,System.String);;Argument[0];Argument[this];taint;generated |
+| System.Net.Http;ReadOnlyMemoryContent;false;CreateContentReadStreamAsync;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http;ReadOnlyMemoryContent;false;ReadOnlyMemoryContent;(System.ReadOnlyMemory<System.Byte>);;Argument[0];Argument[this];taint;generated |
 | System.Net.Http;SocketsHttpConnectionContext;false;get_DnsEndPoint;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http;SocketsHttpConnectionContext;false;get_InitialRequestMessage;();;Argument[this];ReturnValue;taint;generated |
@@ -4300,9 +4424,13 @@ summary
 | System.Net.Http;SocketsHttpPlaintextStreamFilterContext;false;get_NegotiatedHttpVersion;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http;SocketsHttpPlaintextStreamFilterContext;false;get_PlaintextStream;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Http;StreamContent;false;SerializeToStream;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[this];Argument[0];taint;generated |
+| System.Net.Http;StreamContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Http;StreamContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext);;Argument[this];Argument[0];taint;generated |
+| System.Net.Http;StreamContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext);;Argument[this];ReturnValue;taint;generated |
+| System.Net.Http;StreamContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[2];ReturnValue;taint;generated |
 | System.Net.Http;StreamContent;false;StreamContent;(System.IO.Stream);;Argument[0];Argument[this];taint;generated |
 | System.Net.Http;StreamContent;false;StreamContent;(System.IO.Stream,System.Int32);;Argument[0];Argument[this];taint;generated |
+| System.Net.Http;StringContent;false;SerializeToStreamAsync;(System.IO.Stream,System.Net.TransportContext,System.Threading.CancellationToken);;Argument[2];ReturnValue;taint;generated |
 | System.Net.Mail;AlternateView;false;CreateAlternateViewFromString;(System.String);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Mail;AlternateView;false;CreateAlternateViewFromString;(System.String,System.Net.Mime.ContentType);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Mail;AlternateView;false;CreateAlternateViewFromString;(System.String,System.Net.Mime.ContentType);;Argument[1];ReturnValue;taint;generated |
@@ -4332,7 +4460,10 @@ summary
 | System.Net.Mail;AttachmentBase;false;AttachmentBase;(System.IO.Stream,System.Net.Mime.ContentType);;Argument[0];Argument[this];taint;generated |
 | System.Net.Mail;AttachmentBase;false;AttachmentBase;(System.IO.Stream,System.Net.Mime.ContentType);;Argument[1];Argument[this];taint;generated |
 | System.Net.Mail;AttachmentBase;false;AttachmentBase;(System.IO.Stream,System.String);;Argument[0];Argument[this];taint;generated |
+| System.Net.Mail;AttachmentBase;false;AttachmentBase;(System.String);;Argument[0];Argument[this];taint;generated |
+| System.Net.Mail;AttachmentBase;false;AttachmentBase;(System.String,System.Net.Mime.ContentType);;Argument[0];Argument[this];taint;generated |
 | System.Net.Mail;AttachmentBase;false;AttachmentBase;(System.String,System.Net.Mime.ContentType);;Argument[1];Argument[this];taint;generated |
+| System.Net.Mail;AttachmentBase;false;AttachmentBase;(System.String,System.String);;Argument[0];Argument[this];taint;generated |
 | System.Net.Mail;AttachmentBase;false;get_ContentId;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Mail;AttachmentBase;false;get_ContentStream;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Mail;AttachmentBase;false;set_ContentType;(System.Net.Mime.ContentType);;Argument[0];Argument[this];taint;generated |
@@ -4428,6 +4559,7 @@ summary
 | System.Net.NetworkInformation;PhysicalAddress;false;PhysicalAddress;(System.Byte[]);;Argument[0].Element;Argument[this];taint;generated |
 | System.Net.NetworkInformation;UnicastIPAddressInformationCollection;false;get_Item;(System.Int32);;Argument[this];ReturnValue;taint;generated |
 | System.Net.Security;AuthenticatedStream;false;AuthenticatedStream;(System.IO.Stream,System.Boolean);;Argument[0];Argument[this];taint;generated |
+| System.Net.Security;AuthenticatedStream;false;DisposeAsync;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Security;AuthenticatedStream;false;get_InnerStream;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Security;NegotiateStream;false;AuthenticateAsClient;(System.Net.NetworkCredential,System.Security.Authentication.ExtendedProtection.ChannelBinding,System.String);;Argument[1];Argument[this];taint;generated |
 | System.Net.Security;NegotiateStream;false;AuthenticateAsClient;(System.Net.NetworkCredential,System.Security.Authentication.ExtendedProtection.ChannelBinding,System.String);;Argument[2];Argument[this];taint;generated |
@@ -4448,10 +4580,8 @@ summary
 | System.Net.Security;NegotiateStream;false;FlushAsync;(System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Security;NegotiateStream;false;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Security;NegotiateStream;false;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
-| System.Net.Security;NegotiateStream;false;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Net.Security;NegotiateStream;false;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Security;NegotiateStream;false;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
-| System.Net.Security;NegotiateStream;false;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Net.Security;NegotiateStream;false;get_RemoteIdentity;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Security;SslApplicationProtocol;false;ToString;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Security;SslApplicationProtocol;false;get_Protocol;();;Argument[this];ReturnValue;taint;generated |
@@ -4482,12 +4612,11 @@ summary
 | System.Net.Sockets;NetworkStream;false;NetworkStream;(System.Net.Sockets.Socket,System.IO.FileAccess,System.Boolean);;Argument[0];Argument[this];taint;generated |
 | System.Net.Sockets;NetworkStream;false;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Sockets;NetworkStream;false;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
-| System.Net.Sockets;NetworkStream;false;ReadAsync;(System.Memory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Net.Sockets;NetworkStream;false;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
-| System.Net.Sockets;NetworkStream;false;WriteAsync;(System.ReadOnlyMemory<System.Byte>,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Net.Sockets;NetworkStream;false;get_Socket;();;Argument[this];ReturnValue;taint;generated |
 | System.Net.Sockets;SafeSocketHandle;false;SafeSocketHandle;(System.IntPtr,System.Boolean);;Argument[0];Argument[this];taint;generated |
 | System.Net.Sockets;Socket;false;Accept;();;Argument[this];ReturnValue;taint;generated |
+| System.Net.Sockets;Socket;false;AcceptAsync;(System.Net.Sockets.Socket);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;AcceptAsync;(System.Net.Sockets.Socket,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;AcceptAsync;(System.Net.Sockets.Socket,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;AcceptAsync;(System.Net.Sockets.Socket,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
@@ -4511,6 +4640,7 @@ summary
 | System.Net.Sockets;Socket;false;DisconnectAsync;(System.Boolean,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;DisconnectAsync;(System.Boolean,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;DisconnectAsync;(System.Net.Sockets.SocketAsyncEventArgs);;Argument[this];Argument[0];taint;generated |
+| System.Net.Sockets;Socket;false;EndAccept;(System.IAsyncResult);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;ReceiveAsync;(System.Memory<System.Byte>,System.Net.Sockets.SocketFlags,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;ReceiveAsync;(System.Memory<System.Byte>,System.Net.Sockets.SocketFlags,System.Threading.CancellationToken);;Argument[2];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;ReceiveAsync;(System.Memory<System.Byte>,System.Net.Sockets.SocketFlags,System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
@@ -4527,6 +4657,7 @@ summary
 | System.Net.Sockets;Socket;false;ReceiveFrom;(System.Span<System.Byte>,System.Net.EndPoint);;Argument[1];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;ReceiveFrom;(System.Span<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint);;Argument[2];Argument[this];taint;generated |
 | System.Net.Sockets;Socket;false;ReceiveFrom;(System.Span<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint);;Argument[2];ReturnValue;taint;generated |
+| System.Net.Sockets;Socket;false;ReceiveFromAsync;(System.ArraySegment<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint);;Argument[2];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;ReceiveFromAsync;(System.Memory<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;ReceiveFromAsync;(System.Memory<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint,System.Threading.CancellationToken);;Argument[2];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;ReceiveFromAsync;(System.Memory<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint,System.Threading.CancellationToken);;Argument[3];ReturnValue;taint;generated |
@@ -4536,6 +4667,7 @@ summary
 | System.Net.Sockets;Socket;false;ReceiveMessageFrom;(System.Byte[],System.Int32,System.Int32,System.Net.Sockets.SocketFlags,System.Net.EndPoint,System.Net.Sockets.IPPacketInformation);;Argument[4];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;ReceiveMessageFrom;(System.Span<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint,System.Net.Sockets.IPPacketInformation);;Argument[2];Argument[this];taint;generated |
 | System.Net.Sockets;Socket;false;ReceiveMessageFrom;(System.Span<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint,System.Net.Sockets.IPPacketInformation);;Argument[2];ReturnValue;taint;generated |
+| System.Net.Sockets;Socket;false;ReceiveMessageFromAsync;(System.ArraySegment<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint);;Argument[2];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;ReceiveMessageFromAsync;(System.Memory<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;ReceiveMessageFromAsync;(System.Memory<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint,System.Threading.CancellationToken);;Argument[2];ReturnValue;taint;generated |
 | System.Net.Sockets;Socket;false;ReceiveMessageFromAsync;(System.Memory<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint,System.Threading.CancellationToken);;Argument[3];ReturnValue;taint;generated |
@@ -4583,6 +4715,7 @@ summary
 | System.Net.Sockets;SocketAsyncEventArgs;false;set_SendPacketsElements;(System.Net.Sockets.SendPacketsElement[]);;Argument[0].Element;Argument[this];taint;generated |
 | System.Net.Sockets;SocketAsyncEventArgs;false;set_UserToken;(System.Object);;Argument[0];Argument[this];taint;generated |
 | System.Net.Sockets;SocketException;false;get_Message;();;Argument[this];ReturnValue;taint;generated |
+| System.Net.Sockets;SocketTaskExtensions;false;AcceptAsync;(System.Net.Sockets.Socket,System.Net.Sockets.Socket);;Argument[1];ReturnValue;taint;generated |
 | System.Net.Sockets;SocketTaskExtensions;false;ConnectAsync;(System.Net.Sockets.Socket,System.Net.EndPoint);;Argument[1];Argument[0];taint;generated |
 | System.Net.Sockets;SocketTaskExtensions;false;ConnectAsync;(System.Net.Sockets.Socket,System.Net.EndPoint,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Sockets;SocketTaskExtensions;false;ConnectAsync;(System.Net.Sockets.Socket,System.Net.EndPoint,System.Threading.CancellationToken);;Argument[1];Argument[0];taint;generated |
@@ -4594,6 +4727,8 @@ summary
 | System.Net.Sockets;SocketTaskExtensions;false;ReceiveAsync;(System.Net.Sockets.Socket,System.Memory<System.Byte>,System.Net.Sockets.SocketFlags,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Sockets;SocketTaskExtensions;false;ReceiveAsync;(System.Net.Sockets.Socket,System.Memory<System.Byte>,System.Net.Sockets.SocketFlags,System.Threading.CancellationToken);;Argument[1];ReturnValue;taint;generated |
 | System.Net.Sockets;SocketTaskExtensions;false;ReceiveAsync;(System.Net.Sockets.Socket,System.Memory<System.Byte>,System.Net.Sockets.SocketFlags,System.Threading.CancellationToken);;Argument[3];ReturnValue;taint;generated |
+| System.Net.Sockets;SocketTaskExtensions;false;ReceiveFromAsync;(System.Net.Sockets.Socket,System.ArraySegment<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint);;Argument[3];ReturnValue;taint;generated |
+| System.Net.Sockets;SocketTaskExtensions;false;ReceiveMessageFromAsync;(System.Net.Sockets.Socket,System.ArraySegment<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint);;Argument[3];ReturnValue;taint;generated |
 | System.Net.Sockets;SocketTaskExtensions;false;SendAsync;(System.Net.Sockets.Socket,System.ReadOnlyMemory<System.Byte>,System.Net.Sockets.SocketFlags,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Sockets;SocketTaskExtensions;false;SendAsync;(System.Net.Sockets.Socket,System.ReadOnlyMemory<System.Byte>,System.Net.Sockets.SocketFlags,System.Threading.CancellationToken);;Argument[3];ReturnValue;taint;generated |
 | System.Net.Sockets;SocketTaskExtensions;false;SendToAsync;(System.Net.Sockets.Socket,System.ArraySegment<System.Byte>,System.Net.Sockets.SocketFlags,System.Net.EndPoint);;Argument[3];Argument[0];taint;generated |
@@ -4608,6 +4743,8 @@ summary
 | System.Net.Sockets;TcpListener;false;AcceptSocketAsync;(System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Sockets;TcpListener;false;AcceptSocketAsync;(System.Threading.CancellationToken);;Argument[this];ReturnValue;taint;generated |
 | System.Net.Sockets;TcpListener;false;AcceptTcpClient;();;Argument[this];ReturnValue;taint;generated |
+| System.Net.Sockets;TcpListener;false;EndAcceptSocket;(System.IAsyncResult);;Argument[0];ReturnValue;taint;generated |
+| System.Net.Sockets;TcpListener;false;EndAcceptTcpClient;(System.IAsyncResult);;Argument[0];ReturnValue;taint;generated |
 | System.Net.Sockets;TcpListener;false;TcpListener;(System.Net.IPAddress,System.Int32);;Argument[0];Argument[this];taint;generated |
 | System.Net.Sockets;TcpListener;false;TcpListener;(System.Net.IPEndPoint);;Argument[0];Argument[this];taint;generated |
 | System.Net.Sockets;TcpListener;false;get_LocalEndpoint;();;Argument[this];ReturnValue;taint;generated |
@@ -4693,11 +4830,17 @@ summary
 | System.Net;CookieCollection;false;get_SyncRoot;();;Argument[this];ReturnValue;value;generated |
 | System.Net;CookieException;false;GetObjectData;(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext);;Argument[this];Argument[0];taint;generated |
 | System.Net;CredentialCache;false;GetCredential;(System.Uri,System.String);;Argument[this];ReturnValue;taint;generated |
+| System.Net;Dns;false;EndGetHostAddresses;(System.IAsyncResult);;Argument[0];ReturnValue;taint;generated |
+| System.Net;Dns;false;EndGetHostByName;(System.IAsyncResult);;Argument[0];ReturnValue;taint;generated |
+| System.Net;Dns;false;EndGetHostEntry;(System.IAsyncResult);;Argument[0];ReturnValue;taint;generated |
+| System.Net;Dns;false;EndResolve;(System.IAsyncResult);;Argument[0];ReturnValue;taint;generated |
 | System.Net;DnsEndPoint;false;DnsEndPoint;(System.String,System.Int32,System.Net.Sockets.AddressFamily);;Argument[0];Argument[this];taint;generated |
 | System.Net;DnsEndPoint;false;ToString;();;Argument[this];ReturnValue;taint;generated |
 | System.Net;DnsEndPoint;false;get_Host;();;Argument[this];ReturnValue;taint;generated |
 | System.Net;DownloadDataCompletedEventArgs;false;get_Result;();;Argument[this];ReturnValue;taint;generated |
 | System.Net;DownloadStringCompletedEventArgs;false;get_Result;();;Argument[this];ReturnValue;taint;generated |
+| System.Net;FileWebRequest;false;EndGetRequestStream;(System.IAsyncResult);;Argument[0];ReturnValue;taint;generated |
+| System.Net;FileWebRequest;false;EndGetResponse;(System.IAsyncResult);;Argument[0];ReturnValue;taint;generated |
 | System.Net;FileWebRequest;false;GetRequestStream;();;Argument[this];ReturnValue;taint;generated |
 | System.Net;FileWebRequest;false;GetResponse;();;Argument[this];ReturnValue;taint;generated |
 | System.Net;FileWebRequest;false;get_ContentType;();;Argument[this];ReturnValue;taint;generated |
@@ -4772,6 +4915,9 @@ summary
 | System.Net;HttpListenerTimeoutManager;false;get_IdleConnection;();;Argument[this];ReturnValue;taint;generated |
 | System.Net;HttpListenerTimeoutManager;false;set_DrainEntityBody;(System.TimeSpan);;Argument[0];Argument[this];taint;generated |
 | System.Net;HttpListenerTimeoutManager;false;set_IdleConnection;(System.TimeSpan);;Argument[0];Argument[this];taint;generated |
+| System.Net;HttpWebRequest;false;EndGetRequestStream;(System.IAsyncResult);;Argument[0];ReturnValue;taint;generated |
+| System.Net;HttpWebRequest;false;EndGetRequestStream;(System.IAsyncResult,System.Net.TransportContext);;Argument[0];ReturnValue;taint;generated |
+| System.Net;HttpWebRequest;false;EndGetResponse;(System.IAsyncResult);;Argument[0];ReturnValue;taint;generated |
 | System.Net;HttpWebRequest;false;GetRequestStream;();;Argument[this];ReturnValue;taint;generated |
 | System.Net;HttpWebRequest;false;GetRequestStream;(System.Net.TransportContext);;Argument[this];ReturnValue;taint;generated |
 | System.Net;HttpWebRequest;false;GetResponse;();;Argument[this];ReturnValue;taint;generated |
@@ -4857,6 +5003,8 @@ summary
 | System.Net;WebClient;false;GetWebResponse;(System.Net.WebRequest);;Argument[0];ReturnValue;taint;generated |
 | System.Net;WebClient;false;GetWebResponse;(System.Net.WebRequest,System.IAsyncResult);;Argument[0];Argument[this];taint;generated |
 | System.Net;WebClient;false;GetWebResponse;(System.Net.WebRequest,System.IAsyncResult);;Argument[0];ReturnValue;taint;generated |
+| System.Net;WebClient;false;GetWebResponse;(System.Net.WebRequest,System.IAsyncResult);;Argument[1];Argument[this];taint;generated |
+| System.Net;WebClient;false;GetWebResponse;(System.Net.WebRequest,System.IAsyncResult);;Argument[1];ReturnValue;taint;generated |
 | System.Net;WebClient;false;OpenRead;(System.String);;Argument[0];Argument[this];taint;generated |
 | System.Net;WebClient;false;OpenRead;(System.String);;Argument[0];ReturnValue;taint;generated |
 | System.Net;WebClient;false;OpenRead;(System.String);;Argument[this];ReturnValue;taint;generated |
@@ -5002,7 +5150,6 @@ summary
 | System.Numerics;BigInteger;false;Max;(System.Numerics.BigInteger,System.Numerics.BigInteger);;Argument[1];ReturnValue;taint;generated |
 | System.Numerics;BigInteger;false;Min;(System.Numerics.BigInteger,System.Numerics.BigInteger);;Argument[0];ReturnValue;taint;generated |
 | System.Numerics;BigInteger;false;Min;(System.Numerics.BigInteger,System.Numerics.BigInteger);;Argument[1];ReturnValue;taint;generated |
-| System.Numerics;BigInteger;false;Negate;(System.Numerics.BigInteger);;Argument[0];ReturnValue;taint;generated |
 | System.Numerics;BigInteger;false;Pow;(System.Numerics.BigInteger,System.Int32);;Argument[0];ReturnValue;taint;generated |
 | System.Numerics;BigInteger;false;Remainder;(System.Numerics.BigInteger,System.Numerics.BigInteger);;Argument[0];ReturnValue;taint;generated |
 | System.Numerics;Complex;false;ToString;(System.IFormatProvider);;Argument[0];ReturnValue;taint;generated |
@@ -5727,9 +5874,11 @@ summary
 | System.Resources;ResourceReader;false;GetEnumerator;();;Argument[this];ReturnValue;taint;generated |
 | System.Resources;ResourceReader;false;GetResourceData;(System.String,System.String,System.Byte[]);;Argument[this];ReturnValue;taint;generated |
 | System.Resources;ResourceReader;false;ResourceReader;(System.IO.Stream);;Argument[0];Argument[this];taint;generated |
+| System.Resources;ResourceSet;false;GetEnumerator;();;Argument[this];ReturnValue;taint;generated |
 | System.Resources;ResourceSet;false;ResourceSet;(System.IO.Stream);;Argument[0];Argument[this];taint;generated |
 | System.Resources;ResourceSet;false;ResourceSet;(System.Resources.IResourceReader);;Argument[0].Element;Argument[this];taint;generated |
 | System.Resources;ResourceWriter;false;ResourceWriter;(System.IO.Stream);;Argument[0];Argument[this];taint;generated |
+| System.Resources;ResourceWriter;false;ResourceWriter;(System.String);;Argument[0];Argument[this];taint;generated |
 | System.Runtime.CompilerServices;AsyncIteratorMethodBuilder;false;AwaitOnCompleted<,>;(TAwaiter,TStateMachine);;Argument[1];Argument[this];taint;generated |
 | System.Runtime.CompilerServices;AsyncIteratorMethodBuilder;false;AwaitUnsafeOnCompleted<,>;(TAwaiter,TStateMachine);;Argument[1];Argument[this];taint;generated |
 | System.Runtime.CompilerServices;AsyncTaskMethodBuilder;false;AwaitOnCompleted<,>;(TAwaiter,TStateMachine);;Argument[1];Argument[this];taint;generated |
@@ -5763,8 +5912,6 @@ summary
 | System.Runtime.CompilerServices;DefaultInterpolatedStringHandler;false;DefaultInterpolatedStringHandler;(System.Int32,System.Int32,System.IFormatProvider);;Argument[2];Argument[this];taint;generated |
 | System.Runtime.CompilerServices;DefaultInterpolatedStringHandler;false;DefaultInterpolatedStringHandler;(System.Int32,System.Int32,System.IFormatProvider,System.Span<System.Char>);;Argument[2];Argument[this];taint;generated |
 | System.Runtime.CompilerServices;DefaultInterpolatedStringHandler;false;DefaultInterpolatedStringHandler;(System.Int32,System.Int32,System.IFormatProvider,System.Span<System.Char>);;Argument[3];Argument[this];taint;generated |
-| System.Runtime.CompilerServices;DynamicAttribute;false;DynamicAttribute;(System.Boolean[]);;Argument[0].Element;Argument[this];taint;generated |
-| System.Runtime.CompilerServices;DynamicAttribute;false;get_TransformFlags;();;Argument[this];ReturnValue;taint;generated |
 | System.Runtime.CompilerServices;FormattableStringFactory;false;Create;(System.String,System.Object[]);;Argument[0];ReturnValue;taint;generated |
 | System.Runtime.CompilerServices;FormattableStringFactory;false;Create;(System.String,System.Object[]);;Argument[1].Element;ReturnValue;taint;generated |
 | System.Runtime.CompilerServices;PoolingAsyncValueTaskMethodBuilder;false;AwaitOnCompleted<,>;(TAwaiter,TStateMachine);;Argument[1];Argument[this];taint;generated |
@@ -6109,6 +6256,7 @@ summary
 | System.Security.Cryptography.X509Certificates;X509Certificate;false;ToString;(System.Boolean);;Argument[this];ReturnValue;taint;generated |
 | System.Security.Cryptography.X509Certificates;X509Certificate;false;get_Issuer;();;Argument[this];ReturnValue;taint;generated |
 | System.Security.Cryptography.X509Certificates;X509Certificate;false;get_Subject;();;Argument[this];ReturnValue;taint;generated |
+| System.Security.Cryptography.X509Certificates;X509CertificateCollection+X509CertificateEnumerator;false;X509CertificateEnumerator;(System.Security.Cryptography.X509Certificates.X509CertificateCollection);;Argument[0].Element;Argument[this];taint;generated |
 | System.Security.Cryptography.X509Certificates;X509CertificateCollection+X509CertificateEnumerator;false;get_Current;();;Argument[this];ReturnValue;taint;generated |
 | System.Security.Cryptography.X509Certificates;X509CertificateCollection;false;Add;(System.Security.Cryptography.X509Certificates.X509Certificate);;Argument[0];Argument[this].Element;value;manual |
 | System.Security.Cryptography.X509Certificates;X509CertificateCollection;false;AddRange;(System.Security.Cryptography.X509Certificates.X509CertificateCollection);;Argument[0].Element;Argument[this].Element;value;manual |
@@ -6240,6 +6388,7 @@ summary
 | System.Security.Cryptography.Xml;EncryptionPropertyCollection;false;get_SyncRoot;();;Argument[this];ReturnValue;taint;generated |
 | System.Security.Cryptography.Xml;EncryptionPropertyCollection;false;set_ItemOf;(System.Int32,System.Security.Cryptography.Xml.EncryptionProperty);;Argument[1];Argument[this];taint;generated |
 | System.Security.Cryptography.Xml;KeyInfo;false;AddClause;(System.Security.Cryptography.Xml.KeyInfoClause);;Argument[0];Argument[this];taint;generated |
+| System.Security.Cryptography.Xml;KeyInfo;false;GetEnumerator;(System.Type);;Argument[this];ReturnValue;taint;generated |
 | System.Security.Cryptography.Xml;KeyInfo;false;LoadXml;(System.Xml.XmlElement);;Argument[0].Element;Argument[this];taint;generated |
 | System.Security.Cryptography.Xml;KeyInfo;false;get_Id;();;Argument[this];ReturnValue;taint;generated |
 | System.Security.Cryptography.Xml;KeyInfo;false;set_Id;(System.String);;Argument[0];Argument[this];taint;generated |
@@ -6351,6 +6500,7 @@ summary
 | System.Security.Cryptography.Xml;Transform;false;set_Context;(System.Xml.XmlElement);;Argument[0].Element;Argument[this];taint;generated |
 | System.Security.Cryptography.Xml;Transform;false;set_Resolver;(System.Xml.XmlResolver);;Argument[0];Argument[this];taint;generated |
 | System.Security.Cryptography.Xml;TransformChain;false;Add;(System.Security.Cryptography.Xml.Transform);;Argument[0];Argument[this];taint;generated |
+| System.Security.Cryptography.Xml;TransformChain;false;GetEnumerator;();;Argument[this];ReturnValue;taint;generated |
 | System.Security.Cryptography.Xml;TransformChain;false;get_Item;(System.Int32);;Argument[this];ReturnValue;taint;generated |
 | System.Security.Cryptography.Xml;XmlDecryptionTransform;false;AddExceptUri;(System.String);;Argument[0];Argument[this];taint;generated |
 | System.Security.Cryptography.Xml;XmlDecryptionTransform;false;GetOutput;();;Argument[this];ReturnValue;taint;generated |
@@ -6518,6 +6668,7 @@ summary
 | System.Text.Encodings.Web;TextEncoder;true;Encode;(System.IO.TextWriter,System.String,System.Int32,System.Int32);;Argument[1];Argument[0];taint;generated |
 | System.Text.Encodings.Web;TextEncoder;true;Encode;(System.String);;Argument[0];ReturnValue;taint;generated |
 | System.Text.Json.Nodes;JsonArray;false;Add<>;(T);;Argument[0];Argument[this];taint;generated |
+| System.Text.Json.Nodes;JsonArray;false;Add<>;(T);;Argument[this];Argument[0];taint;generated |
 | System.Text.Json.Nodes;JsonArray;false;Create;(System.Text.Json.JsonElement,System.Nullable<System.Text.Json.Nodes.JsonNodeOptions>);;Argument[0];ReturnValue;taint;generated |
 | System.Text.Json.Nodes;JsonArray;false;JsonArray;(System.Text.Json.Nodes.JsonNodeOptions,System.Text.Json.Nodes.JsonNode[]);;Argument[this];Argument[1].Element;taint;generated |
 | System.Text.Json.Nodes;JsonArray;false;JsonArray;(System.Text.Json.Nodes.JsonNode[]);;Argument[this];Argument[0].Element;taint;generated |
@@ -6885,6 +7036,10 @@ summary
 | System.Threading.Tasks.Dataflow;DataflowBlock;false;Receive<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Threading.Tasks.Dataflow;DataflowBlock;false;Receive<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>,System.TimeSpan);;Argument[0];ReturnValue;taint;generated |
 | System.Threading.Tasks.Dataflow;DataflowBlock;false;Receive<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>,System.TimeSpan,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
+| System.Threading.Tasks.Dataflow;DataflowBlock;false;ReceiveAsync<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>);;Argument[0];ReturnValue;taint;generated |
+| System.Threading.Tasks.Dataflow;DataflowBlock;false;ReceiveAsync<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
+| System.Threading.Tasks.Dataflow;DataflowBlock;false;ReceiveAsync<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>,System.TimeSpan);;Argument[0];ReturnValue;taint;generated |
+| System.Threading.Tasks.Dataflow;DataflowBlock;false;ReceiveAsync<>;(System.Threading.Tasks.Dataflow.ISourceBlock<TOutput>,System.TimeSpan,System.Threading.CancellationToken);;Argument[0];ReturnValue;taint;generated |
 | System.Threading.Tasks.Dataflow;DataflowBlock;false;SendAsync<>;(System.Threading.Tasks.Dataflow.ITargetBlock<TInput>,TInput,System.Threading.CancellationToken);;Argument[1];Argument[0];taint;generated |
 | System.Threading.Tasks.Dataflow;DataflowBlock;false;TryReceive<>;(System.Threading.Tasks.Dataflow.IReceivableSourceBlock<TOutput>,TOutput);;Argument[0];ReturnValue;taint;generated |
 | System.Threading.Tasks.Dataflow;DataflowBlockOptions;false;get_CancellationToken;();;Argument[this];ReturnValue;taint;generated |
@@ -7448,6 +7603,7 @@ summary
 | System.Xml.Linq;XText;false;XText;(System.Xml.Linq.XText);;Argument[0];Argument[this];taint;generated |
 | System.Xml.Linq;XText;false;get_Value;();;Argument[this];ReturnValue;taint;generated |
 | System.Xml.Linq;XText;false;set_Value;(System.String);;Argument[0];Argument[this];taint;generated |
+| System.Xml.Resolvers;XmlPreloadedResolver;false;GetEntity;(System.Uri,System.String,System.Type);;Argument[0];ReturnValue;taint;generated |
 | System.Xml.Resolvers;XmlPreloadedResolver;false;XmlPreloadedResolver;(System.Xml.XmlResolver,System.Xml.Resolvers.XmlKnownDtds,System.Collections.Generic.IEqualityComparer<System.Uri>);;Argument[0];Argument[this];taint;generated |
 | System.Xml.Resolvers;XmlPreloadedResolver;false;XmlPreloadedResolver;(System.Xml.XmlResolver,System.Xml.Resolvers.XmlKnownDtds,System.Collections.Generic.IEqualityComparer<System.Uri>);;Argument[2];Argument[this];taint;generated |
 | System.Xml.Resolvers;XmlPreloadedResolver;false;set_Credentials;(System.Net.ICredentials);;Argument[0];Argument[this];taint;generated |
@@ -7676,9 +7832,12 @@ summary
 | System.Xml.Schema;XmlSchemaSet;false;Add;(System.String,System.Xml.XmlReader);;Argument[this];ReturnValue;taint;generated |
 | System.Xml.Schema;XmlSchemaSet;false;Add;(System.Xml.Schema.XmlSchema);;Argument[0];Argument[this];taint;generated |
 | System.Xml.Schema;XmlSchemaSet;false;Add;(System.Xml.Schema.XmlSchema);;Argument[0];ReturnValue;taint;generated |
+| System.Xml.Schema;XmlSchemaSet;false;Add;(System.Xml.Schema.XmlSchemaSet);;Argument[0];Argument[this];taint;generated |
+| System.Xml.Schema;XmlSchemaSet;false;CopyTo;(System.Xml.Schema.XmlSchema[],System.Int32);;Argument[this];Argument[0].Element;taint;generated |
 | System.Xml.Schema;XmlSchemaSet;false;Remove;(System.Xml.Schema.XmlSchema);;Argument[0];ReturnValue;taint;generated |
 | System.Xml.Schema;XmlSchemaSet;false;Reprocess;(System.Xml.Schema.XmlSchema);;Argument[0];Argument[this];taint;generated |
 | System.Xml.Schema;XmlSchemaSet;false;Reprocess;(System.Xml.Schema.XmlSchema);;Argument[0];ReturnValue;taint;generated |
+| System.Xml.Schema;XmlSchemaSet;false;Schemas;();;Argument[this];ReturnValue;taint;generated |
 | System.Xml.Schema;XmlSchemaSet;false;XmlSchemaSet;(System.Xml.XmlNameTable);;Argument[0];Argument[this];taint;generated |
 | System.Xml.Schema;XmlSchemaSet;false;get_CompilationSettings;();;Argument[this];ReturnValue;taint;generated |
 | System.Xml.Schema;XmlSchemaSet;false;get_GlobalAttributes;();;Argument[this];ReturnValue;taint;generated |
@@ -7765,8 +7924,10 @@ summary
 | System.Xml.Schema;XmlSchemaXPath;false;get_XPath;();;Argument[this];ReturnValue;taint;generated |
 | System.Xml.Schema;XmlSchemaXPath;false;set_XPath;(System.String);;Argument[0];Argument[this];taint;generated |
 | System.Xml.Serialization;CodeIdentifiers;false;Add;(System.String,System.Object);;Argument[1];Argument[this];taint;generated |
+| System.Xml.Serialization;CodeIdentifiers;false;Add;(System.String,System.Object);;Argument[this];Argument[1];taint;generated |
 | System.Xml.Serialization;CodeIdentifiers;false;AddUnique;(System.String,System.Object);;Argument[0];ReturnValue;taint;generated |
 | System.Xml.Serialization;CodeIdentifiers;false;AddUnique;(System.String,System.Object);;Argument[1];Argument[this];taint;generated |
+| System.Xml.Serialization;CodeIdentifiers;false;AddUnique;(System.String,System.Object);;Argument[this];Argument[1];taint;generated |
 | System.Xml.Serialization;CodeIdentifiers;false;MakeUnique;(System.String);;Argument[0];ReturnValue;taint;generated |
 | System.Xml.Serialization;CodeIdentifiers;false;ToArray;(System.Type);;Argument[this];ReturnValue;taint;generated |
 | System.Xml.Serialization;ImportContext;false;ImportContext;(System.Xml.Serialization.CodeIdentifiers,System.Boolean);;Argument[0];Argument[this];taint;generated |
@@ -8072,6 +8233,7 @@ summary
 | System.Xml.Serialization;XmlSerializationWriter;false;WriteElementStringRaw;(System.String,System.String,System.String);;Argument[2];Argument[this];taint;generated |
 | System.Xml.Serialization;XmlSerializationWriter;false;WriteElementStringRaw;(System.String,System.String,System.String,System.Xml.XmlQualifiedName);;Argument[2];Argument[this];taint;generated |
 | System.Xml.Serialization;XmlSerializationWriter;false;WriteElementStringRaw;(System.String,System.String,System.Xml.XmlQualifiedName);;Argument[1];Argument[this];taint;generated |
+| System.Xml.Serialization;XmlSerializationWriter;false;WriteId;(System.Object);;Argument[this];Argument[0];taint;generated |
 | System.Xml.Serialization;XmlSerializationWriter;false;WriteNullableStringEncoded;(System.String,System.String,System.String,System.Xml.XmlQualifiedName);;Argument[2];Argument[this];taint;generated |
 | System.Xml.Serialization;XmlSerializationWriter;false;WriteNullableStringEncodedRaw;(System.String,System.String,System.Byte[],System.Xml.XmlQualifiedName);;Argument[2].Element;Argument[this];taint;generated |
 | System.Xml.Serialization;XmlSerializationWriter;false;WriteNullableStringEncodedRaw;(System.String,System.String,System.String,System.Xml.XmlQualifiedName);;Argument[2];Argument[this];taint;generated |
@@ -8079,9 +8241,15 @@ summary
 | System.Xml.Serialization;XmlSerializationWriter;false;WriteNullableStringLiteralRaw;(System.String,System.String,System.Byte[]);;Argument[2].Element;Argument[this];taint;generated |
 | System.Xml.Serialization;XmlSerializationWriter;false;WriteNullableStringLiteralRaw;(System.String,System.String,System.String);;Argument[2];Argument[this];taint;generated |
 | System.Xml.Serialization;XmlSerializationWriter;false;WritePotentiallyReferencingElement;(System.String,System.String,System.Object);;Argument[2];Argument[this];taint;generated |
+| System.Xml.Serialization;XmlSerializationWriter;false;WritePotentiallyReferencingElement;(System.String,System.String,System.Object);;Argument[this];Argument[2];taint;generated |
 | System.Xml.Serialization;XmlSerializationWriter;false;WritePotentiallyReferencingElement;(System.String,System.String,System.Object,System.Type);;Argument[2];Argument[this];taint;generated |
+| System.Xml.Serialization;XmlSerializationWriter;false;WritePotentiallyReferencingElement;(System.String,System.String,System.Object,System.Type);;Argument[this];Argument[2];taint;generated |
 | System.Xml.Serialization;XmlSerializationWriter;false;WritePotentiallyReferencingElement;(System.String,System.String,System.Object,System.Type,System.Boolean);;Argument[2];Argument[this];taint;generated |
+| System.Xml.Serialization;XmlSerializationWriter;false;WritePotentiallyReferencingElement;(System.String,System.String,System.Object,System.Type,System.Boolean);;Argument[this];Argument[2];taint;generated |
 | System.Xml.Serialization;XmlSerializationWriter;false;WritePotentiallyReferencingElement;(System.String,System.String,System.Object,System.Type,System.Boolean,System.Boolean);;Argument[2];Argument[this];taint;generated |
+| System.Xml.Serialization;XmlSerializationWriter;false;WritePotentiallyReferencingElement;(System.String,System.String,System.Object,System.Type,System.Boolean,System.Boolean);;Argument[this];Argument[2];taint;generated |
+| System.Xml.Serialization;XmlSerializationWriter;false;WriteReferencingElement;(System.String,System.String,System.Object);;Argument[this];Argument[2];taint;generated |
+| System.Xml.Serialization;XmlSerializationWriter;false;WriteReferencingElement;(System.String,System.String,System.Object,System.Boolean);;Argument[this];Argument[2];taint;generated |
 | System.Xml.Serialization;XmlSerializationWriter;false;WriteRpcResult;(System.String,System.String);;Argument[0];Argument[this];taint;generated |
 | System.Xml.Serialization;XmlSerializationWriter;false;WriteRpcResult;(System.String,System.String);;Argument[1];Argument[this];taint;generated |
 | System.Xml.Serialization;XmlSerializationWriter;false;WriteSerializable;(System.Xml.Serialization.IXmlSerializable,System.String,System.String,System.Boolean);;Argument[0];Argument[this];taint;generated |
@@ -8657,6 +8825,7 @@ summary
 | System.Xml;XmlReaderSettings;false;set_XmlResolver;(System.Xml.XmlResolver);;Argument[0];Argument[this];taint;generated |
 | System.Xml;XmlResolver;true;ResolveUri;(System.Uri,System.String);;Argument[0];ReturnValue;taint;generated |
 | System.Xml;XmlResolver;true;ResolveUri;(System.Uri,System.String);;Argument[1];ReturnValue;taint;generated |
+| System.Xml;XmlSecureResolver;false;GetEntity;(System.Uri,System.String,System.Type);;Argument[0];ReturnValue;taint;generated |
 | System.Xml;XmlSecureResolver;false;XmlSecureResolver;(System.Xml.XmlResolver,System.String);;Argument[0];Argument[this];taint;generated |
 | System.Xml;XmlSecureResolver;false;set_Credentials;(System.Net.ICredentials);;Argument[0];Argument[this];taint;generated |
 | System.Xml;XmlSignificantWhitespace;false;CloneNode;(System.Boolean);;Argument[this];ReturnValue;taint;generated |
@@ -8684,6 +8853,7 @@ summary
 | System.Xml;XmlTextWriter;false;XmlTextWriter;(System.IO.TextWriter);;Argument[0];Argument[this];taint;generated |
 | System.Xml;XmlTextWriter;false;get_BaseStream;();;Argument[this];ReturnValue;taint;generated |
 | System.Xml;XmlTextWriter;false;get_XmlLang;();;Argument[this];ReturnValue;taint;generated |
+| System.Xml;XmlUrlResolver;false;GetEntity;(System.Uri,System.String,System.Type);;Argument[0];ReturnValue;taint;generated |
 | System.Xml;XmlUrlResolver;false;set_Credentials;(System.Net.ICredentials);;Argument[0];Argument[this];taint;generated |
 | System.Xml;XmlUrlResolver;false;set_Proxy;(System.Net.IWebProxy);;Argument[0];Argument[this];taint;generated |
 | System.Xml;XmlValidatingReader;false;LookupNamespace;(System.String);;Argument[0];ReturnValue;taint;generated |
@@ -8701,6 +8871,8 @@ summary
 | System.Xml;XmlWriter;false;Create;(System.IO.TextWriter);;Argument[0];ReturnValue;taint;generated |
 | System.Xml;XmlWriter;false;Create;(System.IO.TextWriter,System.Xml.XmlWriterSettings);;Argument[0];ReturnValue;taint;generated |
 | System.Xml;XmlWriter;false;Create;(System.IO.TextWriter,System.Xml.XmlWriterSettings);;Argument[1];ReturnValue;taint;generated |
+| System.Xml;XmlWriter;false;Create;(System.String);;Argument[0];ReturnValue;taint;generated |
+| System.Xml;XmlWriter;false;Create;(System.String,System.Xml.XmlWriterSettings);;Argument[0];ReturnValue;taint;generated |
 | System.Xml;XmlWriter;false;Create;(System.String,System.Xml.XmlWriterSettings);;Argument[1];ReturnValue;taint;generated |
 | System.Xml;XmlWriter;false;Create;(System.Text.StringBuilder,System.Xml.XmlWriterSettings);;Argument[1];ReturnValue;taint;generated |
 | System.Xml;XmlWriter;false;Create;(System.Xml.XmlWriter);;Argument[0];ReturnValue;taint;generated |
@@ -9773,6 +9945,27 @@ summary
 | System;TupleExtensions;false;Deconstruct<,>;(System.Tuple<T1,T2>,T1,T2);;Argument[0].Property[System.Tuple<,>.Item1];Argument[1];value;manual |
 | System;TupleExtensions;false;Deconstruct<,>;(System.Tuple<T1,T2>,T1,T2);;Argument[0].Property[System.Tuple<,>.Item2];Argument[2];value;manual |
 | System;TupleExtensions;false;Deconstruct<>;(System.Tuple<T1>,T1);;Argument[0].Property[System.Tuple<>.Item1];Argument[1];value;manual |
+| System;TupleExtensions;false;ToTuple<,,,,,,,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15,T16,T17,T18,T19,T20,T21>>>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,,,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15,T16,T17,T18,T19,T20>>>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15,T16,T17,T18,T19>>>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15,T16,T17,T18>>>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15,T16,T17>>>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15,T16>>>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14,System.ValueTuple<T15>>>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13,T14>>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12,T13>>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11,T12>>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10,T11>>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9,T10>>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8,T9>>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7,System.ValueTuple<T8>>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6,T7>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5,T6>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,,>;(System.ValueTuple<T1,T2,T3,T4,T5>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,,>;(System.ValueTuple<T1,T2,T3,T4>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,,>;(System.ValueTuple<T1,T2,T3>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<,>;(System.ValueTuple<T1,T2>);;Argument[0];ReturnValue;taint;generated |
+| System;TupleExtensions;false;ToTuple<>;(System.ValueTuple<T1>);;Argument[0];ReturnValue;taint;generated |
 | System;TupleExtensions;false;ToValueTuple<,,,,,,,,,,,,,,,,,,,,>;(System.Tuple<T1,T2,T3,T4,T5,T6,T7,System.Tuple<T8,T9,T10,T11,T12,T13,T14,System.Tuple<T15,T16,T17,T18,T19,T20,T21>>>);;Argument[0];ReturnValue;taint;generated |
 | System;TupleExtensions;false;ToValueTuple<,,,,,,,,,,,,,,,,,,,>;(System.Tuple<T1,T2,T3,T4,T5,T6,T7,System.Tuple<T8,T9,T10,T11,T12,T13,T14,System.Tuple<T15,T16,T17,T18,T19,T20>>>);;Argument[0];ReturnValue;taint;generated |
 | System;TupleExtensions;false;ToValueTuple<,,,,,,,,,,,,,,,,,,>;(System.Tuple<T1,T2,T3,T4,T5,T6,T7,System.Tuple<T8,T9,T10,T11,T12,T13,T14,System.Tuple<T15,T16,T17,T18,T19>>>);;Argument[0];ReturnValue;taint;generated |

csharp/ql/test/library-tests/dataflow/ssa/PreSsaConsistency.ql

@@ -7,7 +7,9 @@ class CallableWithSplitting extends Callable {
   CallableWithSplitting() { this = any(SplitControlFlowElement e).getEnclosingCallable() }
 }
 
-query predicate defReadInconsistency(AssignableRead ar, Expr e, PreSsa::SourceVariable v, boolean b) {
+query predicate defReadInconsistency(
+  AssignableRead ar, Expr e, PreSsa::SsaInput::SourceVariable v, boolean b
+) {
   // Exclude definitions in callables with CFG splitting, as SSA definitions may be
   // very different from pre-SSA definitions
   not ar.getEnclosingCallable() instanceof CallableWithSplitting and
@@ -36,7 +38,8 @@ query predicate defReadInconsistency(AssignableRead ar, Expr e, PreSsa::SourceVa
 }
 
 query predicate readReadInconsistency(
-  LocalScopeVariableRead read1, LocalScopeVariableRead read2, PreSsa::SourceVariable v, boolean b
+  LocalScopeVariableRead read1, LocalScopeVariableRead read2, PreSsa::SsaInput::SourceVariable v,
+  boolean b
 ) {
   // Exclude definitions in callables with CFG splitting, as SSA definitions may be
   // very different from pre-SSA definitions
@@ -50,7 +53,7 @@ query predicate readReadInconsistency(
     b = false and
     v = read1.getTarget() and
     SsaImpl::adjacentReadPairSameVar(_, read1.getAControlFlowNode(), read2.getAControlFlowNode()) and
-    read1.getTarget() instanceof PreSsa::SourceVariable and
+    read1.getTarget() instanceof PreSsa::SsaInput::SourceVariable and
     not PreSsa::adjacentReadPairSameVar(read1, read2) and
     // Exclude split CFG elements because SSA may be more precise than pre-SSA
     // in those cases
@@ -59,7 +62,9 @@ query predicate readReadInconsistency(
   )
 }
 
-query predicate phiInconsistency(ControlFlowElement cfe, Expr e, PreSsa::SourceVariable v, boolean b) {
+query predicate phiInconsistency(
+  ControlFlowElement cfe, Expr e, PreSsa::SsaInput::SourceVariable v, boolean b
+) {
   // Exclude definitions in callables with CFG splitting, as SSA definitions may be
   // very different from pre-SSA definitions
   not cfe.getEnclosingCallable() instanceof CallableWithSplitting and

csharp/ql/test/library-tests/dataflow/ssa/SSAPhiRead.ql

@@ -1,5 +1,5 @@
 import csharp
-import semmle.code.csharp.dataflow.internal.SsaImplCommon
+import semmle.code.csharp.dataflow.internal.SsaImpl
 
 from Ssa::SourceVariable v, ControlFlow::BasicBlock bb
 where phiReadExposedForTesting(bb, v)

csharp/ql/test/utils/model-generator/CaptureNegativeSummaryModels.expected

@@ -1,5 +1,8 @@
 | NoSummaries;BaseClass;M1;(System.String);generated |
 | NoSummaries;BaseClass;M2;(System.String);generated |
+| NoSummaries;CollectionFlow;ReturnSimpleTypeArray;(System.Int32[]);generated |
+| NoSummaries;CollectionFlow;ReturnSimpleTypeDictionary;(System.Collections.Generic.Dictionary<System.Int32,System.Int32>);generated |
+| NoSummaries;CollectionFlow;ReturnSimpleTypeList;(System.Collections.Generic.List<System.Int32>);generated |
 | NoSummaries;EquatableBound;Equals;(System.Object);generated |
 | NoSummaries;EquatableUnBound<>;Equals;(T);generated |
 | NoSummaries;SimpleTypes;M1;(System.Boolean);generated |

csharp/ql/test/utils/model-generator/CaptureSummaryModels.expected

@@ -13,8 +13,13 @@
 | Summaries;CollectionFlow;false;AssignFieldToArray;(System.Object[]);;Argument[this];Argument[0].Element;taint;generated |
 | Summaries;CollectionFlow;false;AssignToArray;(System.Object,System.Object[]);;Argument[0];Argument[1].Element;taint;generated |
 | Summaries;CollectionFlow;false;ReturnArrayElement;(System.Object[]);;Argument[0].Element;ReturnValue;taint;generated |
+| Summaries;CollectionFlow;false;ReturnBulkTypeList;(System.Collections.Generic.List<System.Byte>);;Argument[0].Element;ReturnValue;taint;generated |
+| Summaries;CollectionFlow;false;ReturnComplexTypeArray;(System.String[]);;Argument[0].Element;ReturnValue;taint;generated |
+| Summaries;CollectionFlow;false;ReturnComplexTypeDictionary;(System.Collections.Generic.Dictionary<System.Int32,System.String>);;Argument[0].Element;ReturnValue;taint;generated |
 | Summaries;CollectionFlow;false;ReturnFieldInAList;();;Argument[this];ReturnValue;taint;generated |
 | Summaries;CollectionFlow;false;ReturnListElement;(System.Collections.Generic.List<System.Object>);;Argument[0].Element;ReturnValue;taint;generated |
+| Summaries;CollectionFlow;false;ReturnUntypedArray;(System.Array);;Argument[0].Element;ReturnValue;taint;generated |
+| Summaries;CollectionFlow;false;ReturnUntypedList;(System.Collections.IList);;Argument[0].Element;ReturnValue;taint;generated |
 | Summaries;DerivedClass1Flow;false;ReturnParam1;(System.String,System.String);;Argument[1];ReturnValue;taint;generated |
 | Summaries;DerivedClass2Flow;false;ReturnParam0;(System.String,System.Int32);;Argument[0];ReturnValue;taint;generated |
 | Summaries;DerivedClass2Flow;false;ReturnParam;(System.Object);;Argument[0];ReturnValue;taint;generated |

csharp/ql/test/utils/model-generator/NoSummaries.cs

@@ -1,4 +1,5 @@
 using System;
+using System.Collections.Generic;
 
 namespace NoSummaries;
 
@@ -110,4 +111,24 @@ public abstract class BaseClass
 
     // Negative summary.
     public abstract string M2(string s);
+}
+
+// No methods in this class will have generated flow as
+// the simple types used in the collection are not bulk data types.
+public class CollectionFlow
+{
+    public int[] ReturnSimpleTypeArray(int[] a)
+    {
+        return a;
+    }
+
+    public List<int> ReturnSimpleTypeList(List<int> a)
+    {
+        return a;
+    }
+
+    public Dictionary<int, int> ReturnSimpleTypeDictionary(Dictionary<int, int> a)
+    {
+        return a;
+    }
 }

csharp/ql/test/utils/model-generator/Summaries.cs

@@ -1,5 +1,6 @@
 using System;
 using System.Linq;
+using System.Collections;
 using System.Collections.Generic;
 
 namespace Summaries;
@@ -85,6 +86,31 @@ public class CollectionFlow
     {
         return new List<string> { tainted };
     }
+
+    public string[] ReturnComplexTypeArray(string[] a)
+    {
+        return a;
+    }
+
+    public List<byte> ReturnBulkTypeList(List<byte> a)
+    {
+        return a;
+    }
+
+    public Dictionary<int, string> ReturnComplexTypeDictionary(Dictionary<int, string> a)
+    {
+        return a;
+    }
+
+    public Array ReturnUntypedArray(Array a)
+    {
+        return a;
+    }
+
+    public IList ReturnUntypedList(IList a)
+    {
+        return a;
+    }
 }
 
 public class IEnumerableFlow

csharp/tools/linux64/compiler-tracing.spec

@@ -3,12 +3,10 @@
   invoke ${config_dir}/Semmle.Extraction.CSharp.Driver
   prepend --compiler
   prepend "${compiler}"
-  prepend --cil
 **/mono*:
 **/dotnet:
   invoke ${config_dir}/Semmle.Extraction.CSharp.Driver
   prepend --dotnetexec
-  prepend --cil
 **/msbuild:
 **/xbuild:
   replace yes

csharp/tools/osx64/compiler-tracing.spec

@@ -3,12 +3,10 @@
   invoke ${config_dir}/Semmle.Extraction.CSharp.Driver
   prepend --compiler
   prepend "${compiler}"
-  prepend --cil
 **/mono*:
 **/dotnet:
   invoke ${config_dir}/Semmle.Extraction.CSharp.Driver
   prepend --dotnetexec
-  prepend --cil
 **/msbuild:
 **/xbuild:
   replace yes

csharp/tools/tracing-config.lua

@@ -51,7 +51,7 @@ function RegisterExtractorPack(id)
     local windowsMatchers = {
         DotnetMatcherBuild,
         CreatePatternMatcher({ '^csc.*%.exe$' }, MatchCompilerName, extractor, {
-            prepend = { '--cil', '--compiler', '"${compiler}"' },
+            prepend = {'--compiler', '"${compiler}"' },
             order = ORDER_BEFORE
         }),
         CreatePatternMatcher({ '^fakes.*%.exe$', 'moles.*%.exe' },
@@ -64,7 +64,7 @@ function RegisterExtractorPack(id)
 
             local seenCompilerCall = false
             local argv = NativeArgumentsToArgv(compilerArguments.nativeArgumentPointer)
-            local extractorArgs = { '--cil', '--compiler' }
+            local extractorArgs = { '--compiler' }
             for _, arg in ipairs(argv) do
                 if arg:match('csc%.dll$') then
                     seenCompilerCall = true
@@ -92,7 +92,7 @@ function RegisterExtractorPack(id)
         DotnetMatcherBuild,
         CreatePatternMatcher({ '^mcs%.exe$', '^csc%.exe$' }, MatchCompilerName,
             extractor, {
-            prepend = { '--cil', '--compiler', '"${compiler}"' },
+            prepend = { '--compiler', '"${compiler}"' },
             order = ORDER_BEFORE
         }), function(compilerName, compilerPath, compilerArguments, _languageId)
             if MatchCompilerName('^msbuild$', compilerName, compilerPath,
@@ -118,7 +118,7 @@ function RegisterExtractorPack(id)
 
             local seenCompilerCall = false
             local argv = compilerArguments.argv
-            local extractorArgs = { '--cil', '--compiler' }
+            local extractorArgs = { '--compiler' }
             for _, arg in ipairs(argv) do
                 if arg:match('csc%.dll$') or arg:match('csc%.exe$') or arg:match('mcs%.exe$') then
                     seenCompilerCall = true

csharp/tools/win64/compiler-tracing.spec

@@ -6,8 +6,6 @@
   invoke ${config_dir}\Semmle.Extraction.CSharp.Driver.exe
   prepend --compiler
   prepend "${compiler}"
-  prepend --cil
 **\dotnet.exe:
   invoke ${config_dir}\Semmle.Extraction.CSharp.Driver.exe
   prepend --dotnetexec
-  prepend --cil

docs/codeql/codeql-overview/codeql-tools.rst

@@ -13,9 +13,40 @@ CodeQL command-line interface
 
 The CodeQL command-line interface (CLI) is primarily used to create databases for 
 security research. You can also query CodeQL databases directly from the command line 
-or using the Visual Studio Code extension. For more information, see
-":ref:`CodeQL CLI <codeql-cli>`."
+or using the Visual Studio Code extension.
+The CodeQL CLI can be downloaded from `GitHub releases <https://github.com/github/codeql-cli-binaries/releases>`__.
+For more information, see ":ref:`CodeQL CLI <codeql-cli>`" and the `CLI changelog <https://github.com/github/codeql-cli-binaries/blob/main/CHANGELOG.md>`__.
 
+CodeQL packs
+-----------------------------
+
+The standard CodeQL query and library packs
+(`source <https://github.com/github/codeql/tree/codeql-cli/latest>`__)
+maintained by GitHub are:
+
+- ``codeql/cpp-queries`` (`changelog <https://github.com/github/codeql/tree/codeql-cli/latest/cpp/ql/src/CHANGELOG.md>`__, `source <https://github.com/github/codeql/tree/codeql-cli/latest/cpp/ql/src>`__)
+- ``codeql/cpp-all`` (`changelog <https://github.com/github/codeql/tree/codeql-cli/latest/cpp/ql/lib/CHANGELOG.md>`__, `source <https://github.com/github/codeql/tree/codeql-cli/latest/cpp/ql/lib>`__)
+- ``codeql/csharp-queries`` (`changelog <https://github.com/github/codeql/tree/codeql-cli/latest/csharp/ql/src/CHANGELOG.md>`__, `source <https://github.com/github/codeql/tree/codeql-cli/latest/csharp/ql/src>`__)
+- ``codeql/csharp-all`` (`changelog <https://github.com/github/codeql/tree/codeql-cli/latest/csharp/ql/lib/CHANGELOG.md>`__, `source <https://github.com/github/codeql/tree/codeql-cli/latest/csharp/ql/lib>`__)
+- ``codeql/go-queries`` (`changelog <https://github.com/github/codeql/tree/codeql-cli/latest/go/ql/src/CHANGELOG.md>`__, `source <https://github.com/github/codeql/tree/codeql-cli/latest/go/ql/src>`__)
+- ``codeql/go-all`` (`changelog <https://github.com/github/codeql/tree/codeql-cli/latest/go/ql/lib/CHANGELOG.md>`__, `source <https://github.com/github/codeql/tree/codeql-cli/latest/go/ql/lib>`__)
+- ``codeql/java-queries`` (`changelog <https://github.com/github/codeql/tree/codeql-cli/latest/java/ql/src/CHANGELOG.md>`__, `source <https://github.com/github/codeql/tree/codeql-cli/latest/java/ql/src>`__)
+- ``codeql/java-all`` (`changelog <https://github.com/github/codeql/tree/codeql-cli/latest/java/ql/lib/CHANGELOG.md>`__, `source <https://github.com/github/codeql/tree/codeql-cli/latest/java/ql/lib>`__)
+- ``codeql/javascript-queries`` (`changelog <https://github.com/github/codeql/tree/codeql-cli/latest/javascript/ql/src/CHANGELOG.md>`__, `source <https://github.com/github/codeql/tree/codeql-cli/latest/javascript/ql/src>`__)
+- ``codeql/javascript-all`` (`changelog <https://github.com/github/codeql/tree/codeql-cli/latest/javascript/ql/lib/CHANGELOG.md>`__, `source <https://github.com/github/codeql/tree/codeql-cli/latest/javascript/ql/lib>`__)
+- ``codeql/python-queries`` (`changelog <https://github.com/github/codeql/tree/codeql-cli/latest/python/ql/src/CHANGELOG.md>`__, `source <https://github.com/github/codeql/tree/codeql-cli/latest/python/ql/src>`__)
+- ``codeql/python-all`` (`changelog <https://github.com/github/codeql/tree/codeql-cli/latest/python/ql/lib/CHANGELOG.md>`__, `source <https://github.com/github/codeql/tree/codeql-cli/latest/python/ql/lib>`__)
+- ``codeql/ruby-queries`` (`changelog <https://github.com/github/codeql/tree/codeql-cli/latest/ruby/ql/src/CHANGELOG.md>`__, `source <https://github.com/github/codeql/tree/codeql-cli/latest/ruby/ql/src>`__)
+- ``codeql/ruby-all`` (`changelog <https://github.com/github/codeql/tree/codeql-cli/latest/ruby/ql/lib/CHANGELOG.md>`__, `source <https://github.com/github/codeql/tree/codeql-cli/latest/ruby/ql/lib>`__)
+
+For more information, see ":ref:`About CodeQL packs <about-codeql-packs>`."
+
+CodeQL bundle
+-----------------------------
+
+The CodeQL bundle consists of the CodeQL CLI together with the standard CodeQL query and library packs
+maintained by GitHub. The bundle can be downloaded from `GitHub releases <https://github.com/github/codeql-action/releases>`__.
+Use this when running `code scanning with CodeQL <https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-with-codeql>`__ on GitHub Actions or in another CI system.
 
 CodeQL for Visual Studio Code
 -----------------------------

java/documentation/library-coverage/coverage.csv

@@ -32,7 +32,7 @@ jakarta.ws.rs.container,,9,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,9,,
 jakarta.ws.rs.core,2,,149,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,94,55
 java.beans,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
 java.io,37,,39,,15,,,,,,,,,,,,,,,,,,,,,,,,22,,,,,,,,39,
-java.lang,13,,58,,,,,,,,,,,8,,,,,4,,,1,,,,,,,,,,,,,,,46,12
+java.lang,13,,66,,,,,,,,,,,8,,,,,4,,,1,,,,,,,,,,,,,,,54,12
 java.net,10,3,7,,,,,,,,,,,,,,10,,,,,,,,,,,,,,,,,,,3,7,
 java.nio,15,,11,,13,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,11,
 java.sql,11,,,,,,,,,4,,,,,,,,,,,,,,,,7,,,,,,,,,,,,
@@ -59,7 +59,7 @@ okhttp3,2,,47,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,,,,22,25
 org.apache.commons.codec,,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,6,
 org.apache.commons.collections,,,800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,17,783
 org.apache.commons.collections4,,,800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,17,783
-org.apache.commons.io,104,,561,,89,,,,,,,,,,,,15,,,,,,,,,,,,,,,,,,,,547,14
+org.apache.commons.io,106,,556,,91,,,,,,,,,,,,15,,,,,,,,,,,,,,,,,,,,542,14
 org.apache.commons.jexl2,15,,,,,,,,,,15,,,,,,,,,,,,,,,,,,,,,,,,,,,
 org.apache.commons.jexl3,15,,,,,,,,,,15,,,,,,,,,,,,,,,,,,,,,,,,,,,
 org.apache.commons.lang3,,,424,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,293,131

java/documentation/library-coverage/coverage.rst

@@ -9,15 +9,15 @@ Java framework & library support
    Framework / library,Package,Flow sources,Taint & value steps,Sinks (total),`CWE‑022` :sub:`Path injection`,`CWE‑036` :sub:`Path traversal`,`CWE‑079` :sub:`Cross-site scripting`,`CWE‑089` :sub:`SQL injection`,`CWE‑090` :sub:`LDAP injection`,`CWE‑094` :sub:`Code injection`,`CWE‑319` :sub:`Cleartext transmission`
    Android,``android.*``,52,424,108,,,3,67,,,
    `Apache Commons Collections <https://commons.apache.org/proper/commons-collections/>`_,"``org.apache.commons.collections``, ``org.apache.commons.collections4``",,1600,,,,,,,,
-   `Apache Commons IO <https://commons.apache.org/proper/commons-io/>`_,``org.apache.commons.io``,,561,104,89,,,,,,15
+   `Apache Commons IO <https://commons.apache.org/proper/commons-io/>`_,``org.apache.commons.io``,,556,106,91,,,,,,15
    `Apache Commons Lang <https://commons.apache.org/proper/commons-lang/>`_,``org.apache.commons.lang3``,,424,,,,,,,,
    `Apache Commons Text <https://commons.apache.org/proper/commons-text/>`_,``org.apache.commons.text``,,272,,,,,,,,
    `Apache HttpComponents <https://hc.apache.org/>`_,"``org.apache.hc.core5.*``, ``org.apache.http``",5,136,28,,,3,,,,25
    `Google Guava <https://guava.dev/>`_,``com.google.common.*``,,728,39,,6,,,,,
    `JSON-java <https://github.com/stleary/JSON-java>`_,``org.json``,,236,,,,,,,,
-   Java Standard Library,``java.*``,3,577,130,28,,,7,,,10
+   Java Standard Library,``java.*``,3,585,130,28,,,7,,,10
    Java extensions,"``javax.*``, ``jakarta.*``",63,609,32,,,4,,1,1,2
    `Spring <https://spring.io/>`_,``org.springframework.*``,29,477,101,,,,19,14,,29
    Others,"``androidx.slice``, ``cn.hutool.core.codec``, ``com.esotericsoftware.kryo.io``, ``com.esotericsoftware.kryo5.io``, ``com.fasterxml.jackson.core``, ``com.fasterxml.jackson.databind``, ``com.opensymphony.xwork2.ognl``, ``com.rabbitmq.client``, ``com.unboundid.ldap.sdk``, ``com.zaxxer.hikari``, ``flexjson``, ``groovy.lang``, ``groovy.util``, ``jodd.json``, ``kotlin.jvm.internal``, ``net.sf.saxon.s9api``, ``ognl``, ``okhttp3``, ``org.apache.commons.codec``, ``org.apache.commons.jexl2``, ``org.apache.commons.jexl3``, ``org.apache.commons.logging``, ``org.apache.commons.ognl``, ``org.apache.directory.ldap.client.api``, ``org.apache.ibatis.jdbc``, ``org.apache.log4j``, ``org.apache.logging.log4j``, ``org.apache.shiro.codec``, ``org.apache.shiro.jndi``, ``org.codehaus.groovy.control``, ``org.dom4j``, ``org.hibernate``, ``org.jboss.logging``, ``org.jdbi.v3.core``, ``org.jooq``, ``org.mvel2``, ``org.scijava.log``, ``org.slf4j``, ``org.xml.sax``, ``org.xmlpull.v1``, ``play.mvc``, ``ratpack.core.form``, ``ratpack.core.handling``, ``ratpack.core.http``, ``ratpack.exec``, ``ratpack.form``, ``ratpack.func``, ``ratpack.handling``, ``ratpack.http``, ``ratpack.util``, ``retrofit2``",65,395,932,,,,14,18,,3
-   Totals,,217,6439,1474,117,6,10,107,33,1,84
+   Totals,,217,6442,1476,119,6,10,107,33,1,84
 

java/kotlin-extractor/generate_dbscheme.py

@@ -171,13 +171,12 @@ with open('src/main/kotlin/KotlinExtractorDbScheme.kt', 'w') as kt:
             for num, typ in mapping:
                 genTable(kt, relname, columns, enum, kind, num, typ)
 
+    kt.write('sealed interface AnyDbType\n')
     for typ in sorted(supertypes):
-        kt.write('sealed interface Db' + upperFirst(typ))
+        kt.write('sealed interface Db' + upperFirst(typ) + ': AnyDbType')
         # Sorting makes the output deterministic.
         names = sorted(supertypes[typ])
-        if names:
-            kt.write(': ')
-            kt.write(', '.join(map(lambda name: 'Db' + upperFirst(name), names)))
+        kt.write(''.join(map(lambda name: ', Db' + upperFirst(name), names)))
         kt.write('\n')
     for alias in sorted(type_aliases):
         kt.write('typealias Db' + upperFirst(alias) + ' = Db' + upperFirst(type_aliases[alias]) + '\n')

java/kotlin-extractor/src/main/kotlin/KotlinFileExtractor.kt

@@ -159,31 +159,6 @@ open class KotlinFileExtractor(
         }
     }
 
-
-
-    fun getLabel(element: IrElement) : String? {
-        when (element) {
-            is IrClass -> return getClassLabel(element, listOf()).classLabel
-            is IrTypeParameter -> return getTypeParameterLabel(element)
-            is IrFunction -> return getFunctionLabel(element, null)
-            is IrValueParameter -> return getValueParameterLabel(element, null)
-            is IrProperty -> return getPropertyLabel(element)
-            is IrField -> return getFieldLabel(element)
-            is IrEnumEntry -> return getEnumEntryLabel(element)
-            is IrTypeAlias -> return getTypeAliasLabel(element)
-
-            // Fresh entities:
-            is IrBody -> return null
-            is IrExpression -> return null
-
-            // todo add others:
-            else -> {
-                logger.errorElement("Unhandled element type: ${element::class}", element)
-                return null
-            }
-        }
-    }
-
     private fun extractTypeParameter(tp: IrTypeParameter, apparentIndex: Int, javaTypeParameter: JavaTypeParameter?): Label<out DbTypevariable>? {
         with("type parameter", tp) {
             val parentId = getTypeParameterParentLabel(tp) ?: return null
@@ -1544,19 +1519,18 @@ open class KotlinFileExtractor(
     }
 
     private fun extractStaticTypeAccessQualifier(target: IrDeclaration, parentExpr: Label<out DbExprparent>, locId: Label<DbLocation>, enclosingCallable: Label<out DbCallable>, enclosingStmt: Label<out DbStmt>) {
-        if (target.shouldExtractAsStaticMemberOfClass) {
-            extractTypeAccessRecursive(target.parentAsClass.toRawType(), locId, parentExpr, -1, enclosingCallable, enclosingStmt)
-        } else if (target.shouldExtractAsStaticMemberOfFile) {
-            extractTypeAccess(useFileClassType(target.parent as IrFile), locId, parentExpr, -1, enclosingCallable, enclosingStmt)
+        if (target.shouldExtractAsStatic) {
+            val parent = target.parent
+            if (parent is IrClass) {
+                extractTypeAccessRecursive(parent.toRawType(), locId, parentExpr, -1, enclosingCallable, enclosingStmt)
+            } else if (parent is IrFile) {
+                extractTypeAccess(useFileClassType(parent), locId, parentExpr, -1, enclosingCallable, enclosingStmt)
+            } else {
+                logger.warnElement("Unexpected static type access qualifer ${parent.javaClass}", target)
+            }
         }
     }
 
-    private val IrDeclaration.shouldExtractAsStaticMemberOfClass: Boolean
-        get() = this.shouldExtractAsStatic && parent is IrClass
-
-    private val IrDeclaration.shouldExtractAsStaticMemberOfFile: Boolean
-        get() = this.shouldExtractAsStatic && parent is IrFile
-
     private fun isStaticAnnotatedNonCompanionMember(f: IrSimpleFunction) =
         f.parentClassOrNull?.isNonCompanionObject == true &&
                 (f.hasAnnotation(jvmStaticFqName) || f.correspondingPropertySymbol?.owner?.hasAnnotation(jvmStaticFqName) == true)

java/kotlin-extractor/src/main/kotlin/KotlinUsesExtractor.kt

@@ -667,11 +667,15 @@ open class KotlinUsesExtractor(
                     dimensions++
                     if (elementType.isPrimitiveArray())
                         isPrimitiveArray = true
-                    if (((elementType as IrSimpleType).arguments.singleOrNull() as? IrTypeProjection)?.variance == Variance.IN_VARIANCE) {
-                        // Because Java's arrays are covariant, Kotlin will render Array<in X> as Object[], Array<Array<in X>> as Object[][] etc.
-                        componentType = replaceComponentTypeWithAny(s, dimensions - 1)
-                        elementType = pluginContext.irBuiltIns.anyType as IrSimpleType
-                        break
+                    if (elementType is IrSimpleType) {
+                        if ((elementType.arguments.singleOrNull() as? IrTypeProjection)?.variance == Variance.IN_VARIANCE) {
+                            // Because Java's arrays are covariant, Kotlin will render Array<in X> as Object[], Array<Array<in X>> as Object[][] etc.
+                            componentType = replaceComponentTypeWithAny(s, dimensions - 1)
+                            elementType = pluginContext.irBuiltIns.anyType
+                            break
+                        }
+                    } else {
+                        logger.warn("Unexpected element type representation ${elementType.javaClass} for ${s.render()}")
                     }
                     elementType = elementType.getArrayElementType(pluginContext.irBuiltIns)
                 }
@@ -1169,7 +1173,7 @@ open class KotlinUsesExtractor(
         "kotlin.Boolean", "kotlin.Byte", "kotlin.Char", "kotlin.Double", "kotlin.Float", "kotlin.Int", "kotlin.Long", "kotlin.Number", "kotlin.Short"
     )
 
-    private fun kotlinFunctionToJavaEquivalent(f: IrFunction, noReplace: Boolean) =
+    private fun kotlinFunctionToJavaEquivalent(f: IrFunction, noReplace: Boolean): IrFunction =
         if (noReplace)
             f
         else
@@ -1186,8 +1190,7 @@ open class KotlinUsesExtractor(
                             decl.valueParameters.zip(f.valueParameters).all { p -> p.first.type.classifierOrNull == p.second.type.classifierOrNull }
                         } ?:
                         // Or if there is none, look for the only viable overload
-                        javaClass.declarations.singleOrNull { decl ->
-                            decl is IrFunction &&
+                        javaClass.declarations.singleOrNullSubType<IrFunction> { decl ->
                             decl.name == f.name &&
                             decl.valueParameters.size == f.valueParameters.size
                         } ?:
@@ -1213,7 +1216,7 @@ open class KotlinUsesExtractor(
                     else
                         null
                 }
-            } as IrFunction? ?: f
+            } ?: f
 
     fun <T: DbCallable> useFunction(f: IrFunction, classTypeArgsIncludingOuterClasses: List<IrTypeArgument>? = null, noReplace: Boolean = false): Label<out T> {
         return useFunction(f, null, classTypeArgsIncludingOuterClasses, noReplace)
@@ -1415,12 +1418,11 @@ open class KotlinUsesExtractor(
         for(t in subbedSupertypes) {
             when(t) {
                 is IrSimpleType -> {
-                    when (t.classifier.owner) {
+                    val owner = t.classifier.owner
+                    when (owner) {
                         is IrClass -> {
-                            val classifier: IrClassifierSymbol = t.classifier
-                            val tcls: IrClass = classifier.owner as IrClass
                             val typeArgs = if (t.arguments.isNotEmpty() && mode is ExtractSupertypesMode.Raw) null else t.arguments
-                            val l = useClassInstance(tcls, typeArgs, inReceiverContext).typeResult.id
+                            val l = useClassInstance(owner, typeArgs, inReceiverContext).typeResult.id
                             tw.writeExtendsReftype(id, l)
                         }
                         else -> {
@@ -1458,13 +1460,13 @@ open class KotlinUsesExtractor(
                 return eraseTypeParameter(owner)
             }
 
-            if (t.isArray() || t.isNullableArray()) {
-                val elementType = t.getArrayElementType(pluginContext.irBuiltIns)
-                val erasedElementType = erase(elementType)
-                return (classifier as IrClassSymbol).typeWith(erasedElementType).codeQlWithHasQuestionMark(t.hasQuestionMark)
-            }
-
             if (owner is IrClass) {
+                if (t.isArray() || t.isNullableArray()) {
+                    val elementType = t.getArrayElementType(pluginContext.irBuiltIns)
+                    val erasedElementType = erase(elementType)
+                    return owner.typeWith(erasedElementType).codeQlWithHasQuestionMark(t.hasQuestionMark)
+                }
+
                 return if (t.arguments.isNotEmpty())
                     t.addAnnotations(listOf(RawTypeAnnotation.annotationConstructor))
                 else

java/kotlin-extractor/src/main/kotlin/Label.kt

@@ -6,8 +6,8 @@ import java.io.StringWriter
 /**
  * This represents a label (`#...`) in a TRAP file.
  */
-interface Label<T> {
-    fun <U> cast(): Label<U> {
+interface Label<T: AnyDbType> {
+    fun <U: AnyDbType> cast(): Label<U> {
         @Suppress("UNCHECKED_CAST")
         return this as Label<U>
     }
@@ -17,7 +17,7 @@ interface Label<T> {
  * The label `#i`, e.g. `#123`. Most labels we generate are of this
  * form.
  */
-class IntLabel<T>(val i: Int): Label<T> {
+class IntLabel<T: AnyDbType>(val i: Int): Label<T> {
     override fun toString(): String = "#$i"
 }
 
@@ -26,6 +26,6 @@ class IntLabel<T>(val i: Int): Label<T> {
  * shared between different components (e.g. when both the interceptor
  * and the extractor need to refer to the same label).
  */
-class StringLabel<T>(val name: String): Label<T> {
+class StringLabel<T: AnyDbType>(val name: String): Label<T> {
     override fun toString(): String = "#$name"
 }

java/kotlin-extractor/src/main/kotlin/TrapWriter.kt

@@ -26,7 +26,7 @@ class TrapLabelManager {
     private var nextInt: Int = 100
 
     /** Returns a fresh label. */
-    fun <T> getFreshLabel(): Label<T> {
+    fun <T: AnyDbType> getFreshLabel(): Label<T> {
         return IntLabel(nextInt++)
     }
 
@@ -64,7 +64,7 @@ open class TrapWriter (protected val loggerBase: LoggerBase, val lm: TrapLabelMa
      * `getLabelFor` instead, which allows non-existent labels to be
      * initialised.
      */
-    fun <T> getExistingLabelFor(key: String): Label<T>? {
+    fun <T: AnyDbType> getExistingLabelFor(key: String): Label<T>? {
         return lm.labelMapping.get(key)?.cast<T>()
     }
     /**
@@ -73,7 +73,7 @@ open class TrapWriter (protected val loggerBase: LoggerBase, val lm: TrapLabelMa
      * is run on it, and it is returned.
      */
     @JvmOverloads // Needed so Java can call a method with an optional argument
-    fun <T> getLabelFor(key: String, initialise: (Label<T>) -> Unit = {}): Label<T> {
+    fun <T: AnyDbType> getLabelFor(key: String, initialise: (Label<T>) -> Unit = {}): Label<T> {
         val maybeLabel: Label<T>? = getExistingLabelFor(key)
         if(maybeLabel == null) {
             val label: Label<T> = lm.getFreshLabel()
@@ -89,7 +89,7 @@ open class TrapWriter (protected val loggerBase: LoggerBase, val lm: TrapLabelMa
     /**
      * Returns a label for a fresh ID (i.e. a new label bound to `*`).
      */
-    fun <T> getFreshIdLabel(): Label<T> {
+    fun <T: AnyDbType> getFreshIdLabel(): Label<T> {
         val label: Label<T> = lm.getFreshLabel()
         writeTrap("$label = *\n")
         return label

java/kotlin-extractor/src/main/kotlin/comments/CommentExtractor.kt

@@ -7,6 +7,9 @@ import com.intellij.psi.PsiComment
 import com.intellij.psi.PsiElement
 import org.jetbrains.kotlin.ir.IrElement
 import org.jetbrains.kotlin.ir.declarations.*
+import org.jetbrains.kotlin.ir.expressions.IrBody
+import org.jetbrains.kotlin.ir.expressions.IrExpression
+import org.jetbrains.kotlin.ir.util.parentClassOrNull
 import org.jetbrains.kotlin.kdoc.psi.api.KDoc
 import org.jetbrains.kotlin.lexer.KtTokens
 import org.jetbrains.kotlin.psi.KtVisitor
@@ -102,7 +105,7 @@ class CommentExtractor(private val fileExtractor: KotlinFileExtractor, private v
                                 label = "variable ${ownerIr.name.asString()}"
                                 tw.getExistingVariableLabelFor(ownerIr)
                             } else {
-                                label = fileExtractor.getLabel(ownerIr) ?: continue
+                                label = getLabel(ownerIr) ?: continue
                                 tw.getExistingLabelFor<DbTop>(label)
                             }
                             if (existingLabel == null) {
@@ -118,9 +121,42 @@ class CommentExtractor(private val fileExtractor: KotlinFileExtractor, private v
             private fun getKDocOwner(comment: KDoc) : PsiElement? {
                 val owner = comment.owner
                 if (owner == null) {
-                    logger.warn("Couldn't get owner of KDoc.")
+                    logger.warn("Couldn't get owner of KDoc. The comment is extracted without an owner.")
                 }
                 return owner
             }
+
+            private fun getLabel(element: IrElement) : String? {
+                when (element) {
+                    is IrClass -> return fileExtractor.getClassLabel(element, listOf()).classLabel
+                    is IrTypeParameter -> return fileExtractor.getTypeParameterLabel(element)
+                    is IrFunction -> return fileExtractor.getFunctionLabel(element, null)
+                    is IrValueParameter -> return fileExtractor.getValueParameterLabel(element, null)
+                    is IrProperty -> return fileExtractor.getPropertyLabel(element)
+                    is IrField -> return fileExtractor.getFieldLabel(element)
+                    is IrEnumEntry -> return fileExtractor.getEnumEntryLabel(element)
+                    is IrTypeAlias -> return fileExtractor.getTypeAliasLabel(element)
+
+                    is IrAnonymousInitializer -> {
+                        val parentClass = element.parentClassOrNull
+                        if (parentClass == null) {
+                            logger.warnElement("Parent of anonymous initializer is not a class", element)
+                            return null
+                        }
+                        // Assign the comment to the class. The content of the `init` blocks might be extracted in multiple constructors.
+                        return getLabel(parentClass)
+                    }
+
+                    // Fresh entities:
+                    is IrBody -> return null
+                    is IrExpression -> return null
+
+                    // todo add others:
+                    else -> {
+                        logger.warnElement("Unhandled element type found during comment extraction: ${element::class}", element)
+                        return null
+                    }
+                }
         }
+    }
 }

java/kotlin-extractor/src/main/kotlin/utils/Iterable.kt

@@ -13,3 +13,14 @@ inline fun <reified S: IrDeclaration> Iterable<IrDeclaration>.findSubType(
     return this.find { it is S && predicate(it) } as S?
 }
 
+/**
+ * This behaves the same as Iterable<IrDeclaration>.singleOrNull, but
+ * requires that the value found is of the subtype S, and it casts
+ * the result for you appropriately.
+ */
+inline fun <reified S: IrDeclaration> Iterable<IrDeclaration>.singleOrNullSubType(
+    predicate: (S) -> Boolean
+): S? {
+    return this.singleOrNull { it is S && predicate(it) } as S?
+}
+

java/kotlin-extractor/src/main/kotlin/utils/TypeResults.kt

@@ -12,8 +12,8 @@ package com.github.codeql
  * `shortName` is a Java primitive name (e.g. "int"), a class short name with Java-style type arguments ("InnerClass<E>" or
  * "OuterClass<ConcreteArgument>" or "OtherClass<? extends Bound>") or an array ("componentShortName[]").
  */
-data class TypeResultGeneric<SignatureType,out LabelType>(val id: Label<out LabelType>, val signature: SignatureType, val shortName: String) {
-    fun <U> cast(): TypeResult<U> {
+data class TypeResultGeneric<SignatureType,out LabelType: AnyDbType>(val id: Label<out LabelType>, val signature: SignatureType, val shortName: String) {
+    fun <U: AnyDbType> cast(): TypeResult<U> {
         @Suppress("UNCHECKED_CAST")
         return this as TypeResult<U>
     }
@@ -25,6 +25,6 @@ typealias TypeResultWithoutSignature<T> = TypeResultGeneric<Unit,T>
 typealias TypeResults = TypeResultsGeneric<String>
 typealias TypeResultsWithoutSignatures = TypeResultsGeneric<Unit>
 
-fun <T> TypeResult<T>.forgetSignature(): TypeResultWithoutSignature<T> {
+fun <T: AnyDbType> TypeResult<T>.forgetSignature(): TypeResultWithoutSignature<T> {
     return TypeResultWithoutSignature(this.id, Unit, this.shortName)
 }

java/kotlin-extractor/src/main/kotlin/utils/TypeSubstitution.kt

@@ -123,14 +123,17 @@ private fun IrTypeArgument.lowerBound(context: IrPluginContext) =
 
 fun IrType.substituteTypeAndArguments(substitutionMap: Map<IrTypeParameterSymbol, IrTypeArgument>?, useContext: KotlinUsesExtractor.TypeContext, pluginContext: IrPluginContext): IrType =
     substitutionMap?.let { substMap ->
-        this.classifierOrNull?.let { typeClassifier ->
+        if (this is IrSimpleType) {
+            val typeClassifier = this.classifier
             substMap[typeClassifier]?.let {
                 when(useContext) {
                     KotlinUsesExtractor.TypeContext.RETURN -> it.upperBound(pluginContext)
                     else -> it.lowerBound(pluginContext)
                 }
-            } ?: (this as IrSimpleType).substituteTypeArguments(substMap)
-        } ?: this
+            } ?: this.substituteTypeArguments(substMap)
+        } else {
+            this
+        }
     } ?: this
 
 object RawTypeAnnotation {

java/ql/lib/change-notes/2022-08-19-string-taint-models.md

@@ -0,0 +1,5 @@
+---
+category: minorAnalysis
+---
+* Added taint flow models for the `java.lang.String.(charAt|getBytes)` methods.
+* Improved taint flow models for the `java.lang.String.(replace|replaceFirst|replaceAll)` methods. Additional results may be found where users do not properly sanitize their inputs.

java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll

@@ -12,6 +12,7 @@
  *   `namespace; type; subtypes; name; signature; ext; input; output; kind; provenance`
  * - Negative Summaries:
  *   `namespace; type; name; signature; provenance`
+ *   A negative summary is used to indicate that there is no flow via a callable.
  *
  * The interpretation of a row is similar to API-graphs with a left-to-right
  * reading.

java/ql/lib/semmle/code/java/dataflow/TypeFlow.qll

@@ -204,38 +204,42 @@ private predicate exactType(TypeFlowNode n, RefType t) {
 
 /**
  * Holds if `n` occurs in a position where type information might be discarded;
- * `t` is the potentially boxed type of `n`, `t1` is the erasure of `t`, and
- * `t2` is the erased type of the implicit or explicit cast.
+ * `t1` is the type of `n`, `t1e` is the erasure of `t1`, `t2` is the type of
+ * the implicit or explicit cast, and `t2e` is the erasure of `t2`.
  */
-pragma[noinline]
-private predicate upcastCand(TypeFlowNode n, RefType t, RefType t1, RefType t2) {
-  t = boxIfNeeded(n.getType()) and
-  t.getErasure() = t1 and
-  (
-    exists(Variable v | v.getAnAssignedValue() = n.asExpr() and t2 = v.getType().getErasure())
-    or
-    exists(CastingExpr c | c.getExpr() = n.asExpr() and t2 = c.getType().getErasure())
-    or
-    exists(ReturnStmt ret |
-      ret.getResult() = n.asExpr() and t2 = ret.getEnclosingCallable().getReturnType().getErasure()
-    )
-    or
-    exists(MethodAccess ma | viableImpl_v1(ma) = n.asMethod() and t2 = ma.getType())
-    or
-    exists(Parameter p | privateParamArg(p, n.asExpr()) and t2 = p.getType().getErasure())
-    or
-    exists(ChooseExpr cond |
-      cond.getAResultExpr() = n.asExpr() and
-      t2 = cond.getType().getErasure()
+pragma[nomagic]
+private predicate upcastCand(TypeFlowNode n, RefType t1, RefType t1e, RefType t2, RefType t2e) {
+  exists(TypeFlowNode next | step(n, next) or joinStep(n, next) |
+    n.getType() = t1 and
+    next.getType() = t2 and
+    t1.getErasure() = t1e and
+    t2.getErasure() = t2e and
+    t1 != t2
+  )
+}
+
+/** Holds if `t` is a raw type or parameterised type with unrestricted type arguments. */
+private predicate unbound(RefType t) {
+  t instanceof RawType
+  or
+  exists(ParameterizedType pt | pt = t |
+    forex(RefType arg | arg = pt.getATypeArgument() |
+      arg.(Wildcard).isUnconstrained()
+      or
+      arg.(BoundedType).getUpperBoundType() instanceof TypeObject and
+      not arg.(Wildcard).hasLowerBound()
     )
   )
 }
 
 /** Holds if `n` occurs in a position where type information is discarded. */
-private predicate upcast(TypeFlowNode n, RefType t) {
-  exists(RefType t1, RefType t2 |
-    upcastCand(n, t, t1, t2) and
-    t1.getASourceSupertype+() = t2
+private predicate upcast(TypeFlowNode n, RefType t1) {
+  exists(RefType t1e, RefType t2, RefType t2e | upcastCand(n, t1, t1e, t2, t2e) |
+    t1e.getASourceSupertype+() = t2e
+    or
+    t1e = t2e and
+    unbound(t2) and
+    not unbound(t1)
   )
 }
 

java/ql/lib/semmle/code/java/dataflow/internal/NegativeSummary.qll

@@ -0,0 +1,9 @@
+/** Provides modules for importing negative summaries. */
+
+/**
+ * A module importing the frameworks that provide external flow data,
+ * ensuring that they are visible to the taint tracking / data flow library.
+ */
+private module Frameworks {
+  private import semmle.code.java.frameworks.GeneratedNegative
+}

java/ql/lib/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll

@@ -251,7 +251,7 @@ private predicate qualifierToArgumentStep(Expr tracked, Expr sink) {
 
 /** Access to a method that passes taint from the qualifier. */
 private predicate qualifierToMethodStep(Expr tracked, MethodAccess sink) {
-  (taintPreservingQualifierToMethod(sink.getMethod()) or unsafeEscape(sink)) and
+  taintPreservingQualifierToMethod(sink.getMethod()) and
   tracked = sink.getQualifier()
 }
 
@@ -282,28 +282,6 @@ private predicate taintPreservingQualifierToMethod(Method m) {
   )
 }
 
-private class StringReplaceMethod extends TaintPreservingCallable {
-  StringReplaceMethod() {
-    this.getDeclaringType() instanceof TypeString and
-    (
-      this.hasName("replace") or
-      this.hasName("replaceAll") or
-      this.hasName("replaceFirst")
-    )
-  }
-
-  override predicate returnsTaintFrom(int arg) { arg = 1 }
-}
-
-private predicate unsafeEscape(MethodAccess ma) {
-  // Removing `<script>` tags using a string-replace method is
-  // unsafe if such a tag is embedded inside another one (e.g. `<scr<script>ipt>`).
-  exists(StringReplaceMethod m | ma.getMethod() = m |
-    ma.getArgument(0).(StringLiteral).getValue() = "(<script>)" and
-    ma.getArgument(1).(StringLiteral).getValue() = ""
-  )
-}
-
 /** Access to a method that passes taint from an argument. */
 private predicate argToMethodStep(Expr tracked, MethodAccess sink) {
   exists(Method m, int i |

java/ql/lib/semmle/code/java/dispatch/VirtualDispatch.qll

@@ -211,10 +211,14 @@ private module Dispatch {
     exists(Method m | t.hasMethod(m, _, _) and impl = m.getSourceDeclaration())
   }
 
+  private predicate isAbstractWithSubclass(SrcRefType t) {
+    t.isAbstract() and exists(Class c | c.getASourceSupertype() = t)
+  }
+
   private predicate hasViableSubtype(RefType t, SrcRefType sub) {
     sub.extendsOrImplements*(t) and
     not sub instanceof Interface and
-    not sub.isAbstract()
+    not isAbstractWithSubclass(sub)
   }
 }
 

java/ql/lib/semmle/code/java/frameworks/GeneratedNegative.qll

@@ -0,0 +1,8 @@
+/** Provides a module for importing negative models. */
+
+/**
+ * A module importing all generated negative Models as Data models.
+ */
+private module GeneratedFrameworks {
+  private import apache.NegativeIOGenerated
+}

java/ql/lib/semmle/code/java/frameworks/Strings.qll

@@ -20,10 +20,17 @@ private class StringSummaryCsv extends SummaryModelCsv {
         "java.lang;String;false;formatted;(Object[]);;Argument[0].ArrayElement;ReturnValue;taint;manual",
         "java.lang;String;false;getChars;;;Argument[-1];Argument[2];taint;manual",
         "java.lang;String;false;getBytes;;;Argument[-1];ReturnValue;taint;manual",
+        "java.lang;String;false;getBytes;;;Argument[-1];Argument[2];taint;manual",
         "java.lang;String;false;indent;;;Argument[-1];ReturnValue;taint;manual",
         "java.lang;String;false;intern;;;Argument[-1];ReturnValue;taint;manual",
         "java.lang;String;false;join;;;Argument[0..1];ReturnValue;taint;manual",
         "java.lang;String;false;repeat;(int);;Argument[-1];ReturnValue;taint;manual",
+        "java.lang;String;false;replace;;;Argument[-1];ReturnValue;taint;manual",
+        "java.lang;String;false;replace;;;Argument[1];ReturnValue;taint;manual",
+        "java.lang;String;false;replaceAll;;;Argument[-1];ReturnValue;taint;manual",
+        "java.lang;String;false;replaceAll;;;Argument[1];ReturnValue;taint;manual",
+        "java.lang;String;false;replaceFirst;;;Argument[-1];ReturnValue;taint;manual",
+        "java.lang;String;false;replaceFirst;;;Argument[1];ReturnValue;taint;manual",
         "java.lang;String;false;split;;;Argument[-1];ReturnValue;taint;manual",
         "java.lang;String;false;String;;;Argument[0];Argument[-1];taint;manual",
         "java.lang;String;false;strip;;;Argument[-1];ReturnValue;taint;manual",
@@ -55,6 +62,7 @@ private class StringSummaryCsv extends SummaryModelCsv {
         "java.lang;StringBuffer;true;StringBuffer;(CharSequence);;Argument[0];Argument[-1];taint;manual",
         "java.lang;StringBuffer;true;StringBuffer;(String);;Argument[0];Argument[-1];taint;manual",
         "java.lang;StringBuilder;true;StringBuilder;;;Argument[0];Argument[-1];taint;manual",
+        "java.lang;CharSequence;true;charAt;;;Argument[-1];ReturnValue;taint;manual",
         "java.lang;CharSequence;true;subSequence;;;Argument[-1];ReturnValue;taint;manual",
         "java.lang;CharSequence;true;toString;;;Argument[-1];ReturnValue;taint;manual"
       ]

java/ql/lib/semmle/code/java/frameworks/apache/IOGenerated.qll

@@ -13,7 +13,9 @@ private class IOGeneratedSinksCsv extends SinkModelCsv {
         "org.apache.commons.io.file;PathFilter;true;accept;(Path,BasicFileAttributes);;Argument[0];create-file;generated",
         "org.apache.commons.io.file;PathUtils;false;copyFile;(URL,Path,CopyOption[]);;Argument[0];open-url;generated",
         "org.apache.commons.io.file;PathUtils;false;copyFile;(URL,Path,CopyOption[]);;Argument[1];create-file;generated",
+        "org.apache.commons.io.file;PathUtils;false;copyFileToDirectory;(Path,Path,CopyOption[]);;Argument[1];create-file;generated",
         "org.apache.commons.io.file;PathUtils;false;copyFileToDirectory;(URL,Path,CopyOption[]);;Argument[0];open-url;generated",
+        "org.apache.commons.io.file;PathUtils;false;copyFileToDirectory;(URL,Path,CopyOption[]);;Argument[1];create-file;generated",
         "org.apache.commons.io.file;PathUtils;false;newOutputStream;(Path,boolean);;Argument[0];create-file;generated",
         "org.apache.commons.io.file;PathUtils;false;writeString;(Path,CharSequence,Charset,OpenOption[]);;Argument[0];create-file;generated",
         "org.apache.commons.io.filefilter;FileFilterUtils;true;filter;(IOFileFilter,File[]);;Argument[1];create-file;generated",
@@ -631,14 +633,10 @@ private class IOGeneratedSummaryCsv extends SummaryModelCsv {
         "org.apache.commons.io;IOUtils;true;readLines;(InputStream,Charset);;Argument[0];ReturnValue;taint;generated",
         "org.apache.commons.io;IOUtils;true;readLines;(InputStream,String);;Argument[0];ReturnValue;taint;generated",
         "org.apache.commons.io;IOUtils;true;readLines;(Reader);;Argument[0];ReturnValue;taint;generated",
-        "org.apache.commons.io;IOUtils;true;toBufferedInputStream;(InputStream);;Argument[0];ReturnValue;taint;generated",
-        "org.apache.commons.io;IOUtils;true;toBufferedInputStream;(InputStream,int);;Argument[0];ReturnValue;taint;generated",
         "org.apache.commons.io;IOUtils;true;toBufferedReader;(Reader);;Argument[0];ReturnValue;taint;generated",
         "org.apache.commons.io;IOUtils;true;toBufferedReader;(Reader,int);;Argument[0];ReturnValue;taint;generated",
         "org.apache.commons.io;IOUtils;true;toByteArray;(InputStream,int);;Argument[0];ReturnValue;taint;generated",
         "org.apache.commons.io;IOUtils;true;toByteArray;(InputStream,long);;Argument[0];ReturnValue;taint;generated",
-        "org.apache.commons.io;IOUtils;true;toByteArray;(Reader);;Argument[0];ReturnValue;taint;generated",
-        "org.apache.commons.io;IOUtils;true;toByteArray;(Reader,String);;Argument[0];ReturnValue;taint;generated",
         "org.apache.commons.io;IOUtils;true;toByteArray;(String);;Argument[0];ReturnValue;taint;generated",
         "org.apache.commons.io;IOUtils;true;toCharArray;(InputStream);;Argument[0];ReturnValue;taint;generated",
         "org.apache.commons.io;IOUtils;true;toCharArray;(InputStream,Charset);;Argument[0];ReturnValue;taint;generated",
@@ -669,7 +667,6 @@ private class IOGeneratedSummaryCsv extends SummaryModelCsv {
         "org.apache.commons.io;IOUtils;true;writeLines;(Collection,String,OutputStream);;Argument[1];Argument[2];taint;generated",
         "org.apache.commons.io;IOUtils;true;writeLines;(Collection,String,OutputStream,Charset);;Argument[1];Argument[2];taint;generated",
         "org.apache.commons.io;IOUtils;true;writeLines;(Collection,String,OutputStream,String);;Argument[1];Argument[2];taint;generated",
-        "org.apache.commons.io;IOUtils;true;writeLines;(Collection,String,Writer);;Argument[0].Element;Argument[2];taint;generated",
         "org.apache.commons.io;IOUtils;true;writeLines;(Collection,String,Writer);;Argument[1];Argument[2];taint;generated",
         "org.apache.commons.io;IOUtils;true;writer;(Appendable);;Argument[0];ReturnValue;taint;generated",
         "org.apache.commons.io;LineIterator;true;LineIterator;(Reader);;Argument[0];Argument[-1];taint;generated",

java/ql/lib/semmle/code/java/frameworks/apache/NegativeIOGenerated.qll

@@ -0,0 +1,769 @@
+/**
+ * THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT.
+ * Definitions of negative summaries in the IOGenerated framework.
+ */
+
+import java
+private import semmle.code.java.dataflow.ExternalFlow
+
+private class IOGeneratedNegativesummaryCsv extends NegativeSummaryModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "org.apache.commons.io.charset;CharsetDecoders;CharsetDecoders;();generated",
+        "org.apache.commons.io.charset;CharsetEncoders;CharsetEncoders;();generated",
+        "org.apache.commons.io.comparator;DefaultFileComparator;DefaultFileComparator;();generated",
+        "org.apache.commons.io.comparator;DirectoryFileComparator;DirectoryFileComparator;();generated",
+        "org.apache.commons.io.comparator;ExtensionFileComparator;ExtensionFileComparator;();generated",
+        "org.apache.commons.io.comparator;ExtensionFileComparator;ExtensionFileComparator;(IOCase);generated",
+        "org.apache.commons.io.comparator;ExtensionFileComparator;toString;();generated",
+        "org.apache.commons.io.comparator;LastModifiedFileComparator;LastModifiedFileComparator;();generated",
+        "org.apache.commons.io.comparator;NameFileComparator;NameFileComparator;();generated",
+        "org.apache.commons.io.comparator;NameFileComparator;NameFileComparator;(IOCase);generated",
+        "org.apache.commons.io.comparator;NameFileComparator;toString;();generated",
+        "org.apache.commons.io.comparator;PathFileComparator;PathFileComparator;();generated",
+        "org.apache.commons.io.comparator;PathFileComparator;PathFileComparator;(IOCase);generated",
+        "org.apache.commons.io.comparator;PathFileComparator;toString;();generated",
+        "org.apache.commons.io.comparator;SizeFileComparator;SizeFileComparator;();generated",
+        "org.apache.commons.io.comparator;SizeFileComparator;SizeFileComparator;(boolean);generated",
+        "org.apache.commons.io.comparator;SizeFileComparator;toString;();generated",
+        "org.apache.commons.io.file.attribute;FileTimes;minusMillis;(FileTime,long);generated",
+        "org.apache.commons.io.file.attribute;FileTimes;minusNanos;(FileTime,long);generated",
+        "org.apache.commons.io.file.attribute;FileTimes;minusSeconds;(FileTime,long);generated",
+        "org.apache.commons.io.file.attribute;FileTimes;now;();generated",
+        "org.apache.commons.io.file.attribute;FileTimes;ntfsTimeToDate;(long);generated",
+        "org.apache.commons.io.file.attribute;FileTimes;ntfsTimeToFileTime;(long);generated",
+        "org.apache.commons.io.file.attribute;FileTimes;plusMillis;(FileTime,long);generated",
+        "org.apache.commons.io.file.attribute;FileTimes;plusNanos;(FileTime,long);generated",
+        "org.apache.commons.io.file.attribute;FileTimes;plusSeconds;(FileTime,long);generated",
+        "org.apache.commons.io.file.attribute;FileTimes;setLastModifiedTime;(Path);generated",
+        "org.apache.commons.io.file.attribute;FileTimes;toDate;(FileTime);generated",
+        "org.apache.commons.io.file.attribute;FileTimes;toFileTime;(Date);generated",
+        "org.apache.commons.io.file.attribute;FileTimes;toNtfsTime;(Date);generated",
+        "org.apache.commons.io.file.attribute;FileTimes;toNtfsTime;(FileTime);generated",
+        "org.apache.commons.io.file.spi;FileSystemProviders;getFileSystemProvider;(Path);generated",
+        "org.apache.commons.io.file.spi;FileSystemProviders;installed;();generated",
+        "org.apache.commons.io.file;AccumulatorPathVisitor;AccumulatorPathVisitor;();generated",
+        "org.apache.commons.io.file;AccumulatorPathVisitor;relativizeDirectories;(Path,boolean,Comparator);generated",
+        "org.apache.commons.io.file;AccumulatorPathVisitor;relativizeFiles;(Path,boolean,Comparator);generated",
+        "org.apache.commons.io.file;AccumulatorPathVisitor;withBigIntegerCounters;();generated",
+        "org.apache.commons.io.file;AccumulatorPathVisitor;withLongCounters;();generated",
+        "org.apache.commons.io.file;CleaningPathVisitor;withBigIntegerCounters;();generated",
+        "org.apache.commons.io.file;CleaningPathVisitor;withLongCounters;();generated",
+        "org.apache.commons.io.file;Counters$Counter;add;(long);generated",
+        "org.apache.commons.io.file;Counters$Counter;get;();generated",
+        "org.apache.commons.io.file;Counters$Counter;getBigInteger;();generated",
+        "org.apache.commons.io.file;Counters$Counter;getLong;();generated",
+        "org.apache.commons.io.file;Counters$Counter;increment;();generated",
+        "org.apache.commons.io.file;Counters$Counter;reset;();generated",
+        "org.apache.commons.io.file;Counters$PathCounters;getByteCounter;();generated",
+        "org.apache.commons.io.file;Counters$PathCounters;getDirectoryCounter;();generated",
+        "org.apache.commons.io.file;Counters$PathCounters;getFileCounter;();generated",
+        "org.apache.commons.io.file;Counters$PathCounters;reset;();generated",
+        "org.apache.commons.io.file;Counters;Counters;();generated",
+        "org.apache.commons.io.file;Counters;bigIntegerCounter;();generated",
+        "org.apache.commons.io.file;Counters;bigIntegerPathCounters;();generated",
+        "org.apache.commons.io.file;Counters;longCounter;();generated",
+        "org.apache.commons.io.file;Counters;longPathCounters;();generated",
+        "org.apache.commons.io.file;Counters;noopCounter;();generated",
+        "org.apache.commons.io.file;Counters;noopPathCounters;();generated",
+        "org.apache.commons.io.file;CountingPathVisitor;toString;();generated",
+        "org.apache.commons.io.file;CountingPathVisitor;withBigIntegerCounters;();generated",
+        "org.apache.commons.io.file;CountingPathVisitor;withLongCounters;();generated",
+        "org.apache.commons.io.file;DeletingPathVisitor;withBigIntegerCounters;();generated",
+        "org.apache.commons.io.file;DeletingPathVisitor;withLongCounters;();generated",
+        "org.apache.commons.io.file;NoopPathVisitor;NoopPathVisitor;();generated",
+        "org.apache.commons.io.file;PathFilter;accept;(Path,BasicFileAttributes);generated",
+        "org.apache.commons.io.file;PathUtils;cleanDirectory;(Path);generated",
+        "org.apache.commons.io.file;PathUtils;cleanDirectory;(Path,DeleteOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;copyDirectory;(Path,Path,CopyOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;copyFileToDirectory;(Path,Path,CopyOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;countDirectory;(Path);generated",
+        "org.apache.commons.io.file;PathUtils;countDirectoryAsBigInteger;(Path);generated",
+        "org.apache.commons.io.file;PathUtils;createParentDirectories;(Path,FileAttribute[]);generated",
+        "org.apache.commons.io.file;PathUtils;createParentDirectories;(Path,LinkOption,FileAttribute[]);generated",
+        "org.apache.commons.io.file;PathUtils;current;();generated",
+        "org.apache.commons.io.file;PathUtils;delete;(Path);generated",
+        "org.apache.commons.io.file;PathUtils;delete;(Path,DeleteOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;delete;(Path,LinkOption[],DeleteOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;deleteDirectory;(Path);generated",
+        "org.apache.commons.io.file;PathUtils;deleteDirectory;(Path,DeleteOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;deleteDirectory;(Path,LinkOption[],DeleteOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;deleteFile;(Path);generated",
+        "org.apache.commons.io.file;PathUtils;deleteFile;(Path,DeleteOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;deleteFile;(Path,LinkOption[],DeleteOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;directoryAndFileContentEquals;(Path,Path);generated",
+        "org.apache.commons.io.file;PathUtils;directoryAndFileContentEquals;(Path,Path,LinkOption[],OpenOption[],FileVisitOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;directoryContentEquals;(Path,Path);generated",
+        "org.apache.commons.io.file;PathUtils;directoryContentEquals;(Path,Path,int,LinkOption[],FileVisitOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;fileContentEquals;(Path,Path);generated",
+        "org.apache.commons.io.file;PathUtils;fileContentEquals;(Path,Path,LinkOption[],OpenOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;filter;(PathFilter,Path[]);generated",
+        "org.apache.commons.io.file;PathUtils;getAclEntryList;(Path);generated",
+        "org.apache.commons.io.file;PathUtils;getAclFileAttributeView;(Path,LinkOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;getDosFileAttributeView;(Path,LinkOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;getPosixFileAttributeView;(Path,LinkOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;getTempDirectory;();generated",
+        "org.apache.commons.io.file;PathUtils;isDirectory;(Path,LinkOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;isEmpty;(Path);generated",
+        "org.apache.commons.io.file;PathUtils;isEmptyDirectory;(Path);generated",
+        "org.apache.commons.io.file;PathUtils;isEmptyFile;(Path);generated",
+        "org.apache.commons.io.file;PathUtils;isNewer;(Path,ChronoZonedDateTime,LinkOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;isNewer;(Path,FileTime,LinkOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;isNewer;(Path,Instant,LinkOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;isNewer;(Path,Path);generated",
+        "org.apache.commons.io.file;PathUtils;isNewer;(Path,long,LinkOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;isOlder;(Path,FileTime,LinkOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;isOlder;(Path,Instant,LinkOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;isOlder;(Path,Path);generated",
+        "org.apache.commons.io.file;PathUtils;isOlder;(Path,long,LinkOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;isPosix;(Path,LinkOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;isRegularFile;(Path,LinkOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;newDirectoryStream;(Path,PathFilter);generated",
+        "org.apache.commons.io.file;PathUtils;newOutputStream;(Path,boolean);generated",
+        "org.apache.commons.io.file;PathUtils;noFollowLinkOptionArray;();generated",
+        "org.apache.commons.io.file;PathUtils;readAttributes;(Path,Class,LinkOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;readBasicFileAttributes;(Path);generated",
+        "org.apache.commons.io.file;PathUtils;readBasicFileAttributes;(Path,LinkOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;readBasicFileAttributesUnchecked;(Path);generated",
+        "org.apache.commons.io.file;PathUtils;readDosFileAttributes;(Path,LinkOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;readOsFileAttributes;(Path,LinkOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;readPosixFileAttributes;(Path,LinkOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;readString;(Path,Charset);generated",
+        "org.apache.commons.io.file;PathUtils;setLastModifiedTime;(Path,Path);generated",
+        "org.apache.commons.io.file;PathUtils;sizeOf;(Path);generated",
+        "org.apache.commons.io.file;PathUtils;sizeOfAsBigInteger;(Path);generated",
+        "org.apache.commons.io.file;PathUtils;sizeOfDirectory;(Path);generated",
+        "org.apache.commons.io.file;PathUtils;sizeOfDirectoryAsBigInteger;(Path);generated",
+        "org.apache.commons.io.file;PathUtils;waitFor;(Path,Duration,LinkOption[]);generated",
+        "org.apache.commons.io.file;PathUtils;walk;(Path,PathFilter,int,boolean,FileVisitOption[]);generated",
+        "org.apache.commons.io.file;StandardDeleteOption;overrideReadOnly;(DeleteOption[]);generated",
+        "org.apache.commons.io.filefilter;AbstractFileFilter;AbstractFileFilter;();generated",
+        "org.apache.commons.io.filefilter;AbstractFileFilter;toString;();generated",
+        "org.apache.commons.io.filefilter;AgeFileFilter;AgeFileFilter;(Date);generated",
+        "org.apache.commons.io.filefilter;AgeFileFilter;AgeFileFilter;(Date,boolean);generated",
+        "org.apache.commons.io.filefilter;AgeFileFilter;AgeFileFilter;(File);generated",
+        "org.apache.commons.io.filefilter;AgeFileFilter;AgeFileFilter;(File,boolean);generated",
+        "org.apache.commons.io.filefilter;AgeFileFilter;AgeFileFilter;(long);generated",
+        "org.apache.commons.io.filefilter;AgeFileFilter;AgeFileFilter;(long,boolean);generated",
+        "org.apache.commons.io.filefilter;AndFileFilter;AndFileFilter;();generated",
+        "org.apache.commons.io.filefilter;ConditionalFileFilter;addFileFilter;(IOFileFilter);generated",
+        "org.apache.commons.io.filefilter;ConditionalFileFilter;getFileFilters;();generated",
+        "org.apache.commons.io.filefilter;ConditionalFileFilter;removeFileFilter;(IOFileFilter);generated",
+        "org.apache.commons.io.filefilter;ConditionalFileFilter;setFileFilters;(List);generated",
+        "org.apache.commons.io.filefilter;FalseFileFilter;toString;();generated",
+        "org.apache.commons.io.filefilter;FileFilterUtils;FileFilterUtils;();generated",
+        "org.apache.commons.io.filefilter;FileFilterUtils;ageFileFilter;(Date);generated",
+        "org.apache.commons.io.filefilter;FileFilterUtils;ageFileFilter;(Date,boolean);generated",
+        "org.apache.commons.io.filefilter;FileFilterUtils;ageFileFilter;(File);generated",
+        "org.apache.commons.io.filefilter;FileFilterUtils;ageFileFilter;(File,boolean);generated",
+        "org.apache.commons.io.filefilter;FileFilterUtils;ageFileFilter;(long);generated",
+        "org.apache.commons.io.filefilter;FileFilterUtils;ageFileFilter;(long,boolean);generated",
+        "org.apache.commons.io.filefilter;FileFilterUtils;directoryFileFilter;();generated",
+        "org.apache.commons.io.filefilter;FileFilterUtils;falseFileFilter;();generated",
+        "org.apache.commons.io.filefilter;FileFilterUtils;fileFileFilter;();generated",
+        "org.apache.commons.io.filefilter;FileFilterUtils;filter;(IOFileFilter,File[]);generated",
+        "org.apache.commons.io.filefilter;FileFilterUtils;filter;(IOFileFilter,Iterable);generated",
+        "org.apache.commons.io.filefilter;FileFilterUtils;filterList;(IOFileFilter,File[]);generated",
+        "org.apache.commons.io.filefilter;FileFilterUtils;filterList;(IOFileFilter,Iterable);generated",
+        "org.apache.commons.io.filefilter;FileFilterUtils;filterSet;(IOFileFilter,File[]);generated",
+        "org.apache.commons.io.filefilter;FileFilterUtils;filterSet;(IOFileFilter,Iterable);generated",
+        "org.apache.commons.io.filefilter;FileFilterUtils;sizeFileFilter;(long);generated",
+        "org.apache.commons.io.filefilter;FileFilterUtils;sizeFileFilter;(long,boolean);generated",
+        "org.apache.commons.io.filefilter;FileFilterUtils;sizeRangeFileFilter;(long,long);generated",
+        "org.apache.commons.io.filefilter;FileFilterUtils;trueFileFilter;();generated",
+        "org.apache.commons.io.filefilter;IOFileFilter;and;(IOFileFilter);generated",
+        "org.apache.commons.io.filefilter;IOFileFilter;negate;();generated",
+        "org.apache.commons.io.filefilter;IOFileFilter;or;(IOFileFilter);generated",
+        "org.apache.commons.io.filefilter;OrFileFilter;OrFileFilter;();generated",
+        "org.apache.commons.io.filefilter;RegexFileFilter;RegexFileFilter;(String);generated",
+        "org.apache.commons.io.filefilter;RegexFileFilter;RegexFileFilter;(String,IOCase);generated",
+        "org.apache.commons.io.filefilter;RegexFileFilter;RegexFileFilter;(String,int);generated",
+        "org.apache.commons.io.filefilter;SizeFileFilter;SizeFileFilter;(long);generated",
+        "org.apache.commons.io.filefilter;SizeFileFilter;SizeFileFilter;(long,boolean);generated",
+        "org.apache.commons.io.filefilter;SizeFileFilter;toString;();generated",
+        "org.apache.commons.io.filefilter;SymbolicLinkFileFilter;SymbolicLinkFileFilter;(FileVisitResult,FileVisitResult);generated",
+        "org.apache.commons.io.filefilter;TrueFileFilter;toString;();generated",
+        "org.apache.commons.io.function;IOBiConsumer;accept;(Object,Object);generated",
+        "org.apache.commons.io.function;IOBiConsumer;andThen;(IOBiConsumer);generated",
+        "org.apache.commons.io.function;IOBiFunction;andThen;(Function);generated",
+        "org.apache.commons.io.function;IOBiFunction;andThen;(IOFunction);generated",
+        "org.apache.commons.io.function;IOBiFunction;apply;(Object,Object);generated",
+        "org.apache.commons.io.function;IOConsumer;accept;(Object);generated",
+        "org.apache.commons.io.function;IOConsumer;andThen;(IOConsumer);generated",
+        "org.apache.commons.io.function;IOConsumer;forEach;(Object[],IOConsumer);generated",
+        "org.apache.commons.io.function;IOConsumer;forEachIndexed;(Stream,IOConsumer);generated",
+        "org.apache.commons.io.function;IOConsumer;noop;();generated",
+        "org.apache.commons.io.function;IOFunction;andThen;(Consumer);generated",
+        "org.apache.commons.io.function;IOFunction;andThen;(Function);generated",
+        "org.apache.commons.io.function;IOFunction;andThen;(IOConsumer);generated",
+        "org.apache.commons.io.function;IOFunction;andThen;(IOFunction);generated",
+        "org.apache.commons.io.function;IOFunction;apply;(Object);generated",
+        "org.apache.commons.io.function;IOFunction;compose;(Function);generated",
+        "org.apache.commons.io.function;IOFunction;compose;(IOFunction);generated",
+        "org.apache.commons.io.function;IOFunction;compose;(IOSupplier);generated",
+        "org.apache.commons.io.function;IOFunction;compose;(Supplier);generated",
+        "org.apache.commons.io.function;IOFunction;identity;();generated",
+        "org.apache.commons.io.function;IORunnable;run;();generated",
+        "org.apache.commons.io.function;IOSupplier;get;();generated",
+        "org.apache.commons.io.function;IOTriFunction;andThen;(Function);generated",
+        "org.apache.commons.io.function;IOTriFunction;andThen;(IOFunction);generated",
+        "org.apache.commons.io.function;IOTriFunction;apply;(Object,Object,Object);generated",
+        "org.apache.commons.io.input.buffer;CircularByteBuffer;CircularByteBuffer;();generated",
+        "org.apache.commons.io.input.buffer;CircularByteBuffer;CircularByteBuffer;(int);generated",
+        "org.apache.commons.io.input.buffer;CircularByteBuffer;add;(byte);generated",
+        "org.apache.commons.io.input.buffer;CircularByteBuffer;add;(byte[],int,int);generated",
+        "org.apache.commons.io.input.buffer;CircularByteBuffer;clear;();generated",
+        "org.apache.commons.io.input.buffer;CircularByteBuffer;getCurrentNumberOfBytes;();generated",
+        "org.apache.commons.io.input.buffer;CircularByteBuffer;getSpace;();generated",
+        "org.apache.commons.io.input.buffer;CircularByteBuffer;hasBytes;();generated",
+        "org.apache.commons.io.input.buffer;CircularByteBuffer;hasSpace;();generated",
+        "org.apache.commons.io.input.buffer;CircularByteBuffer;hasSpace;(int);generated",
+        "org.apache.commons.io.input.buffer;CircularByteBuffer;peek;(byte[],int,int);generated",
+        "org.apache.commons.io.input.buffer;CircularByteBuffer;read;();generated",
+        "org.apache.commons.io.input.buffer;CircularByteBuffer;read;(byte[],int,int);generated",
+        "org.apache.commons.io.input.buffer;PeekableInputStream;peek;(byte[]);generated",
+        "org.apache.commons.io.input.buffer;PeekableInputStream;peek;(byte[],int,int);generated",
+        "org.apache.commons.io.input;AutoCloseInputStream;AutoCloseInputStream;(InputStream);generated",
+        "org.apache.commons.io.input;BOMInputStream;BOMInputStream;(InputStream);generated",
+        "org.apache.commons.io.input;BOMInputStream;BOMInputStream;(InputStream,boolean);generated",
+        "org.apache.commons.io.input;BOMInputStream;hasBOM;();generated",
+        "org.apache.commons.io.input;BOMInputStream;hasBOM;(ByteOrderMark);generated",
+        "org.apache.commons.io.input;BoundedInputStream;isPropagateClose;();generated",
+        "org.apache.commons.io.input;BoundedInputStream;setPropagateClose;(boolean);generated",
+        "org.apache.commons.io.input;BoundedInputStream;toString;();generated",
+        "org.apache.commons.io.input;BrokenInputStream;BrokenInputStream;();generated",
+        "org.apache.commons.io.input;BrokenInputStream;BrokenInputStream;(IOException);generated",
+        "org.apache.commons.io.input;BrokenReader;BrokenReader;();generated",
+        "org.apache.commons.io.input;BrokenReader;BrokenReader;(IOException);generated",
+        "org.apache.commons.io.input;BufferedFileChannelInputStream;BufferedFileChannelInputStream;(File);generated",
+        "org.apache.commons.io.input;BufferedFileChannelInputStream;BufferedFileChannelInputStream;(File,int);generated",
+        "org.apache.commons.io.input;BufferedFileChannelInputStream;BufferedFileChannelInputStream;(Path);generated",
+        "org.apache.commons.io.input;BufferedFileChannelInputStream;BufferedFileChannelInputStream;(Path,int);generated",
+        "org.apache.commons.io.input;CharSequenceInputStream;CharSequenceInputStream;(CharSequence,Charset);generated",
+        "org.apache.commons.io.input;CharSequenceInputStream;CharSequenceInputStream;(CharSequence,Charset,int);generated",
+        "org.apache.commons.io.input;CharSequenceInputStream;CharSequenceInputStream;(CharSequence,String);generated",
+        "org.apache.commons.io.input;CharSequenceInputStream;CharSequenceInputStream;(CharSequence,String,int);generated",
+        "org.apache.commons.io.input;CharacterFilterReader;CharacterFilterReader;(Reader,int);generated",
+        "org.apache.commons.io.input;CharacterSetFilterReader;CharacterSetFilterReader;(Reader,Integer[]);generated",
+        "org.apache.commons.io.input;CharacterSetFilterReader;CharacterSetFilterReader;(Reader,Set);generated",
+        "org.apache.commons.io.input;CloseShieldInputStream;CloseShieldInputStream;(InputStream);generated",
+        "org.apache.commons.io.input;CloseShieldReader;CloseShieldReader;(Reader);generated",
+        "org.apache.commons.io.input;CloseShieldReader;wrap;(Reader);generated",
+        "org.apache.commons.io.input;ClosedInputStream;ClosedInputStream;();generated",
+        "org.apache.commons.io.input;ClosedReader;ClosedReader;();generated",
+        "org.apache.commons.io.input;CountingInputStream;CountingInputStream;(InputStream);generated",
+        "org.apache.commons.io.input;CountingInputStream;getByteCount;();generated",
+        "org.apache.commons.io.input;CountingInputStream;getCount;();generated",
+        "org.apache.commons.io.input;CountingInputStream;resetByteCount;();generated",
+        "org.apache.commons.io.input;CountingInputStream;resetCount;();generated",
+        "org.apache.commons.io.input;DemuxInputStream;DemuxInputStream;();generated",
+        "org.apache.commons.io.input;DemuxInputStream;bindStream;(InputStream);generated",
+        "org.apache.commons.io.input;MarkShieldInputStream;MarkShieldInputStream;(InputStream);generated",
+        "org.apache.commons.io.input;MemoryMappedFileInputStream;MemoryMappedFileInputStream;(Path);generated",
+        "org.apache.commons.io.input;MemoryMappedFileInputStream;MemoryMappedFileInputStream;(Path,int);generated",
+        "org.apache.commons.io.input;MessageDigestCalculatingInputStream;MessageDigestCalculatingInputStream;(InputStream);generated",
+        "org.apache.commons.io.input;MessageDigestCalculatingInputStream;MessageDigestCalculatingInputStream;(InputStream,String);generated",
+        "org.apache.commons.io.input;NullInputStream;NullInputStream;();generated",
+        "org.apache.commons.io.input;NullInputStream;NullInputStream;(long);generated",
+        "org.apache.commons.io.input;NullInputStream;NullInputStream;(long,boolean,boolean);generated",
+        "org.apache.commons.io.input;NullInputStream;getPosition;();generated",
+        "org.apache.commons.io.input;NullInputStream;getSize;();generated",
+        "org.apache.commons.io.input;NullReader;NullReader;();generated",
+        "org.apache.commons.io.input;NullReader;NullReader;(long);generated",
+        "org.apache.commons.io.input;NullReader;NullReader;(long,boolean,boolean);generated",
+        "org.apache.commons.io.input;NullReader;getPosition;();generated",
+        "org.apache.commons.io.input;NullReader;getSize;();generated",
+        "org.apache.commons.io.input;ObservableInputStream$Observer;Observer;();generated",
+        "org.apache.commons.io.input;ObservableInputStream$Observer;closed;();generated",
+        "org.apache.commons.io.input;ObservableInputStream$Observer;data;(byte[],int,int);generated",
+        "org.apache.commons.io.input;ObservableInputStream$Observer;data;(int);generated",
+        "org.apache.commons.io.input;ObservableInputStream$Observer;error;(IOException);generated",
+        "org.apache.commons.io.input;ObservableInputStream$Observer;finished;();generated",
+        "org.apache.commons.io.input;ObservableInputStream;ObservableInputStream;(InputStream);generated",
+        "org.apache.commons.io.input;ObservableInputStream;consume;();generated",
+        "org.apache.commons.io.input;ObservableInputStream;remove;(Observer);generated",
+        "org.apache.commons.io.input;ObservableInputStream;removeAllObservers;();generated",
+        "org.apache.commons.io.input;ProxyInputStream;ProxyInputStream;(InputStream);generated",
+        "org.apache.commons.io.input;ProxyReader;ProxyReader;(Reader);generated",
+        "org.apache.commons.io.input;QueueInputStream;QueueInputStream;();generated",
+        "org.apache.commons.io.input;QueueInputStream;QueueInputStream;(BlockingQueue);generated",
+        "org.apache.commons.io.input;QueueInputStream;newQueueOutputStream;();generated",
+        "org.apache.commons.io.input;RandomAccessFileInputStream;availableLong;();generated",
+        "org.apache.commons.io.input;RandomAccessFileInputStream;isCloseOnClose;();generated",
+        "org.apache.commons.io.input;ReversedLinesFileReader;ReversedLinesFileReader;(File);generated",
+        "org.apache.commons.io.input;ReversedLinesFileReader;ReversedLinesFileReader;(File,Charset);generated",
+        "org.apache.commons.io.input;ReversedLinesFileReader;ReversedLinesFileReader;(File,int,Charset);generated",
+        "org.apache.commons.io.input;ReversedLinesFileReader;ReversedLinesFileReader;(File,int,String);generated",
+        "org.apache.commons.io.input;ReversedLinesFileReader;ReversedLinesFileReader;(Path,Charset);generated",
+        "org.apache.commons.io.input;ReversedLinesFileReader;ReversedLinesFileReader;(Path,int,Charset);generated",
+        "org.apache.commons.io.input;ReversedLinesFileReader;ReversedLinesFileReader;(Path,int,String);generated",
+        "org.apache.commons.io.input;SwappedDataInputStream;SwappedDataInputStream;(InputStream);generated",
+        "org.apache.commons.io.input;TaggedInputStream;TaggedInputStream;(InputStream);generated",
+        "org.apache.commons.io.input;TaggedInputStream;isCauseOf;(Throwable);generated",
+        "org.apache.commons.io.input;TaggedInputStream;throwIfCauseOf;(Throwable);generated",
+        "org.apache.commons.io.input;TaggedReader;TaggedReader;(Reader);generated",
+        "org.apache.commons.io.input;TaggedReader;isCauseOf;(Throwable);generated",
+        "org.apache.commons.io.input;TaggedReader;throwIfCauseOf;(Throwable);generated",
+        "org.apache.commons.io.input;Tailer$RandomAccessResourceBridge;getPointer;();generated",
+        "org.apache.commons.io.input;Tailer$RandomAccessResourceBridge;read;(byte[]);generated",
+        "org.apache.commons.io.input;Tailer$RandomAccessResourceBridge;seek;(long);generated",
+        "org.apache.commons.io.input;Tailer$Tailable;getRandomAccess;(String);generated",
+        "org.apache.commons.io.input;Tailer$Tailable;isNewer;(FileTime);generated",
+        "org.apache.commons.io.input;Tailer$Tailable;lastModifiedFileTime;();generated",
+        "org.apache.commons.io.input;Tailer$Tailable;size;();generated",
+        "org.apache.commons.io.input;Tailer;getDelay;();generated",
+        "org.apache.commons.io.input;Tailer;stop;();generated",
+        "org.apache.commons.io.input;TailerListener;fileNotFound;();generated",
+        "org.apache.commons.io.input;TailerListener;fileRotated;();generated",
+        "org.apache.commons.io.input;TailerListener;handle;(Exception);generated",
+        "org.apache.commons.io.input;TailerListener;handle;(String);generated",
+        "org.apache.commons.io.input;TailerListener;init;(Tailer);generated",
+        "org.apache.commons.io.input;TailerListenerAdapter;TailerListenerAdapter;();generated",
+        "org.apache.commons.io.input;TailerListenerAdapter;endOfFileReached;();generated",
+        "org.apache.commons.io.input;TimestampedObserver;TimestampedObserver;();generated",
+        "org.apache.commons.io.input;TimestampedObserver;getOpenToCloseDuration;();generated",
+        "org.apache.commons.io.input;TimestampedObserver;getOpenToNowDuration;();generated",
+        "org.apache.commons.io.input;UncheckedFilterInputStream;UncheckedFilterInputStream;(InputStream);generated",
+        "org.apache.commons.io.input;UncheckedFilterReader;UncheckedFilterReader;(Reader);generated",
+        "org.apache.commons.io.input;UncheckedFilterReader;on;(Reader);generated",
+        "org.apache.commons.io.input;XmlStreamReader;XmlStreamReader;(File);generated",
+        "org.apache.commons.io.input;XmlStreamReader;XmlStreamReader;(Path);generated",
+        "org.apache.commons.io.input;XmlStreamReader;XmlStreamReader;(URL);generated",
+        "org.apache.commons.io.monitor;FileAlterationListener;onDirectoryChange;(File);generated",
+        "org.apache.commons.io.monitor;FileAlterationListener;onDirectoryCreate;(File);generated",
+        "org.apache.commons.io.monitor;FileAlterationListener;onDirectoryDelete;(File);generated",
+        "org.apache.commons.io.monitor;FileAlterationListener;onFileChange;(File);generated",
+        "org.apache.commons.io.monitor;FileAlterationListener;onFileCreate;(File);generated",
+        "org.apache.commons.io.monitor;FileAlterationListener;onFileDelete;(File);generated",
+        "org.apache.commons.io.monitor;FileAlterationListener;onStart;(FileAlterationObserver);generated",
+        "org.apache.commons.io.monitor;FileAlterationListener;onStop;(FileAlterationObserver);generated",
+        "org.apache.commons.io.monitor;FileAlterationListenerAdaptor;FileAlterationListenerAdaptor;();generated",
+        "org.apache.commons.io.monitor;FileAlterationMonitor;FileAlterationMonitor;();generated",
+        "org.apache.commons.io.monitor;FileAlterationMonitor;FileAlterationMonitor;(long);generated",
+        "org.apache.commons.io.monitor;FileAlterationMonitor;getInterval;();generated",
+        "org.apache.commons.io.monitor;FileAlterationMonitor;removeObserver;(FileAlterationObserver);generated",
+        "org.apache.commons.io.monitor;FileAlterationMonitor;start;();generated",
+        "org.apache.commons.io.monitor;FileAlterationMonitor;stop;();generated",
+        "org.apache.commons.io.monitor;FileAlterationMonitor;stop;(long);generated",
+        "org.apache.commons.io.monitor;FileAlterationObserver;checkAndNotify;();generated",
+        "org.apache.commons.io.monitor;FileAlterationObserver;destroy;();generated",
+        "org.apache.commons.io.monitor;FileAlterationObserver;initialize;();generated",
+        "org.apache.commons.io.monitor;FileAlterationObserver;removeListener;(FileAlterationListener);generated",
+        "org.apache.commons.io.monitor;FileEntry;getLastModified;();generated",
+        "org.apache.commons.io.monitor;FileEntry;getLength;();generated",
+        "org.apache.commons.io.monitor;FileEntry;getLevel;();generated",
+        "org.apache.commons.io.monitor;FileEntry;isDirectory;();generated",
+        "org.apache.commons.io.monitor;FileEntry;isExists;();generated",
+        "org.apache.commons.io.monitor;FileEntry;refresh;(File);generated",
+        "org.apache.commons.io.monitor;FileEntry;setDirectory;(boolean);generated",
+        "org.apache.commons.io.monitor;FileEntry;setExists;(boolean);generated",
+        "org.apache.commons.io.monitor;FileEntry;setLastModified;(long);generated",
+        "org.apache.commons.io.monitor;FileEntry;setLength;(long);generated",
+        "org.apache.commons.io.output;AbstractByteArrayOutputStream;AbstractByteArrayOutputStream;();generated",
+        "org.apache.commons.io.output;AbstractByteArrayOutputStream;reset;();generated",
+        "org.apache.commons.io.output;AbstractByteArrayOutputStream;size;();generated",
+        "org.apache.commons.io.output;AbstractByteArrayOutputStream;toByteArray;();generated",
+        "org.apache.commons.io.output;AbstractByteArrayOutputStream;toInputStream;();generated",
+        "org.apache.commons.io.output;AbstractByteArrayOutputStream;write;(InputStream);generated",
+        "org.apache.commons.io.output;AbstractByteArrayOutputStream;writeTo;(OutputStream);generated",
+        "org.apache.commons.io.output;BrokenOutputStream;BrokenOutputStream;();generated",
+        "org.apache.commons.io.output;BrokenOutputStream;BrokenOutputStream;(IOException);generated",
+        "org.apache.commons.io.output;BrokenWriter;BrokenWriter;();generated",
+        "org.apache.commons.io.output;BrokenWriter;BrokenWriter;(IOException);generated",
+        "org.apache.commons.io.output;ByteArrayOutputStream;ByteArrayOutputStream;();generated",
+        "org.apache.commons.io.output;ByteArrayOutputStream;ByteArrayOutputStream;(int);generated",
+        "org.apache.commons.io.output;ByteArrayOutputStream;toBufferedInputStream;(InputStream);generated",
+        "org.apache.commons.io.output;ByteArrayOutputStream;toBufferedInputStream;(InputStream,int);generated",
+        "org.apache.commons.io.output;ChunkedWriter;ChunkedWriter;(Writer);generated",
+        "org.apache.commons.io.output;ChunkedWriter;ChunkedWriter;(Writer,int);generated",
+        "org.apache.commons.io.output;CloseShieldWriter;CloseShieldWriter;(Writer);generated",
+        "org.apache.commons.io.output;CloseShieldWriter;wrap;(Writer);generated",
+        "org.apache.commons.io.output;ClosedOutputStream;ClosedOutputStream;();generated",
+        "org.apache.commons.io.output;ClosedWriter;ClosedWriter;();generated",
+        "org.apache.commons.io.output;CountingOutputStream;getByteCount;();generated",
+        "org.apache.commons.io.output;CountingOutputStream;getCount;();generated",
+        "org.apache.commons.io.output;CountingOutputStream;resetByteCount;();generated",
+        "org.apache.commons.io.output;CountingOutputStream;resetCount;();generated",
+        "org.apache.commons.io.output;DeferredFileOutputStream;isInMemory;();generated",
+        "org.apache.commons.io.output;DeferredFileOutputStream;toInputStream;();generated",
+        "org.apache.commons.io.output;DemuxOutputStream;DemuxOutputStream;();generated",
+        "org.apache.commons.io.output;DemuxOutputStream;bindStream;(OutputStream);generated",
+        "org.apache.commons.io.output;FileWriterWithEncoding;FileWriterWithEncoding;(File,Charset);generated",
+        "org.apache.commons.io.output;FileWriterWithEncoding;FileWriterWithEncoding;(File,Charset,boolean);generated",
+        "org.apache.commons.io.output;FileWriterWithEncoding;FileWriterWithEncoding;(File,CharsetEncoder);generated",
+        "org.apache.commons.io.output;FileWriterWithEncoding;FileWriterWithEncoding;(File,CharsetEncoder,boolean);generated",
+        "org.apache.commons.io.output;FileWriterWithEncoding;FileWriterWithEncoding;(File,String);generated",
+        "org.apache.commons.io.output;FileWriterWithEncoding;FileWriterWithEncoding;(File,String,boolean);generated",
+        "org.apache.commons.io.output;FileWriterWithEncoding;FileWriterWithEncoding;(String,Charset);generated",
+        "org.apache.commons.io.output;FileWriterWithEncoding;FileWriterWithEncoding;(String,Charset,boolean);generated",
+        "org.apache.commons.io.output;FileWriterWithEncoding;FileWriterWithEncoding;(String,CharsetEncoder);generated",
+        "org.apache.commons.io.output;FileWriterWithEncoding;FileWriterWithEncoding;(String,CharsetEncoder,boolean);generated",
+        "org.apache.commons.io.output;FileWriterWithEncoding;FileWriterWithEncoding;(String,String);generated",
+        "org.apache.commons.io.output;FileWriterWithEncoding;FileWriterWithEncoding;(String,String,boolean);generated",
+        "org.apache.commons.io.output;LockableFileWriter;LockableFileWriter;(File);generated",
+        "org.apache.commons.io.output;LockableFileWriter;LockableFileWriter;(File,Charset);generated",
+        "org.apache.commons.io.output;LockableFileWriter;LockableFileWriter;(File,String);generated",
+        "org.apache.commons.io.output;LockableFileWriter;LockableFileWriter;(File,boolean);generated",
+        "org.apache.commons.io.output;LockableFileWriter;LockableFileWriter;(String);generated",
+        "org.apache.commons.io.output;LockableFileWriter;LockableFileWriter;(String,boolean);generated",
+        "org.apache.commons.io.output;NullOutputStream;NullOutputStream;();generated",
+        "org.apache.commons.io.output;NullPrintStream;NullPrintStream;();generated",
+        "org.apache.commons.io.output;NullWriter;NullWriter;();generated",
+        "org.apache.commons.io.output;ProxyWriter;ProxyWriter;(Writer);generated",
+        "org.apache.commons.io.output;QueueOutputStream;QueueOutputStream;();generated",
+        "org.apache.commons.io.output;QueueOutputStream;QueueOutputStream;(BlockingQueue);generated",
+        "org.apache.commons.io.output;QueueOutputStream;newQueueInputStream;();generated",
+        "org.apache.commons.io.output;StringBuilderWriter;StringBuilderWriter;();generated",
+        "org.apache.commons.io.output;StringBuilderWriter;StringBuilderWriter;(int);generated",
+        "org.apache.commons.io.output;TaggedOutputStream;isCauseOf;(Exception);generated",
+        "org.apache.commons.io.output;TaggedOutputStream;throwIfCauseOf;(Exception);generated",
+        "org.apache.commons.io.output;TaggedWriter;TaggedWriter;(Writer);generated",
+        "org.apache.commons.io.output;TaggedWriter;isCauseOf;(Exception);generated",
+        "org.apache.commons.io.output;TaggedWriter;throwIfCauseOf;(Exception);generated",
+        "org.apache.commons.io.output;ThresholdingOutputStream;ThresholdingOutputStream;(int);generated",
+        "org.apache.commons.io.output;ThresholdingOutputStream;getByteCount;();generated",
+        "org.apache.commons.io.output;ThresholdingOutputStream;getThreshold;();generated",
+        "org.apache.commons.io.output;ThresholdingOutputStream;isThresholdExceeded;();generated",
+        "org.apache.commons.io.output;UncheckedFilterWriter;on;(Writer);generated",
+        "org.apache.commons.io.output;UnsynchronizedByteArrayOutputStream;UnsynchronizedByteArrayOutputStream;();generated",
+        "org.apache.commons.io.output;UnsynchronizedByteArrayOutputStream;UnsynchronizedByteArrayOutputStream;(int);generated",
+        "org.apache.commons.io.output;UnsynchronizedByteArrayOutputStream;toBufferedInputStream;(InputStream);generated",
+        "org.apache.commons.io.output;UnsynchronizedByteArrayOutputStream;toBufferedInputStream;(InputStream,int);generated",
+        "org.apache.commons.io.output;XmlStreamWriter;XmlStreamWriter;(File);generated",
+        "org.apache.commons.io.serialization;ClassNameMatcher;matches;(String);generated",
+        "org.apache.commons.io;ByteOrderMark;get;(int);generated",
+        "org.apache.commons.io;ByteOrderMark;getBytes;();generated",
+        "org.apache.commons.io;ByteOrderMark;length;();generated",
+        "org.apache.commons.io;ByteOrderParser;parseByteOrder;(String);generated",
+        "org.apache.commons.io;Charsets;Charsets;();generated",
+        "org.apache.commons.io;Charsets;requiredCharsets;();generated",
+        "org.apache.commons.io;Charsets;toCharset;(Charset);generated",
+        "org.apache.commons.io;Charsets;toCharset;(String);generated",
+        "org.apache.commons.io;CopyUtils;CopyUtils;();generated",
+        "org.apache.commons.io;CopyUtils;copy;(Reader,OutputStream);generated",
+        "org.apache.commons.io;CopyUtils;copy;(Reader,OutputStream,String);generated",
+        "org.apache.commons.io;CopyUtils;copy;(String,OutputStream);generated",
+        "org.apache.commons.io;CopyUtils;copy;(String,OutputStream,String);generated",
+        "org.apache.commons.io;DirectoryWalker$CancelException;getDepth;();generated",
+        "org.apache.commons.io;EndianUtils;EndianUtils;();generated",
+        "org.apache.commons.io;EndianUtils;readSwappedDouble;(InputStream);generated",
+        "org.apache.commons.io;EndianUtils;readSwappedDouble;(byte[],int);generated",
+        "org.apache.commons.io;EndianUtils;readSwappedFloat;(InputStream);generated",
+        "org.apache.commons.io;EndianUtils;readSwappedFloat;(byte[],int);generated",
+        "org.apache.commons.io;EndianUtils;readSwappedInteger;(InputStream);generated",
+        "org.apache.commons.io;EndianUtils;readSwappedInteger;(byte[],int);generated",
+        "org.apache.commons.io;EndianUtils;readSwappedLong;(InputStream);generated",
+        "org.apache.commons.io;EndianUtils;readSwappedLong;(byte[],int);generated",
+        "org.apache.commons.io;EndianUtils;readSwappedShort;(InputStream);generated",
+        "org.apache.commons.io;EndianUtils;readSwappedShort;(byte[],int);generated",
+        "org.apache.commons.io;EndianUtils;readSwappedUnsignedInteger;(InputStream);generated",
+        "org.apache.commons.io;EndianUtils;readSwappedUnsignedInteger;(byte[],int);generated",
+        "org.apache.commons.io;EndianUtils;readSwappedUnsignedShort;(InputStream);generated",
+        "org.apache.commons.io;EndianUtils;readSwappedUnsignedShort;(byte[],int);generated",
+        "org.apache.commons.io;EndianUtils;swapDouble;(double);generated",
+        "org.apache.commons.io;EndianUtils;swapFloat;(float);generated",
+        "org.apache.commons.io;EndianUtils;swapInteger;(int);generated",
+        "org.apache.commons.io;EndianUtils;swapLong;(long);generated",
+        "org.apache.commons.io;EndianUtils;swapShort;(short);generated",
+        "org.apache.commons.io;EndianUtils;writeSwappedDouble;(OutputStream,double);generated",
+        "org.apache.commons.io;EndianUtils;writeSwappedDouble;(byte[],int,double);generated",
+        "org.apache.commons.io;EndianUtils;writeSwappedFloat;(OutputStream,float);generated",
+        "org.apache.commons.io;EndianUtils;writeSwappedFloat;(byte[],int,float);generated",
+        "org.apache.commons.io;EndianUtils;writeSwappedInteger;(OutputStream,int);generated",
+        "org.apache.commons.io;EndianUtils;writeSwappedInteger;(byte[],int,int);generated",
+        "org.apache.commons.io;EndianUtils;writeSwappedLong;(OutputStream,long);generated",
+        "org.apache.commons.io;EndianUtils;writeSwappedLong;(byte[],int,long);generated",
+        "org.apache.commons.io;EndianUtils;writeSwappedShort;(OutputStream,short);generated",
+        "org.apache.commons.io;EndianUtils;writeSwappedShort;(byte[],int,short);generated",
+        "org.apache.commons.io;FileCleaner;FileCleaner;();generated",
+        "org.apache.commons.io;FileCleaner;exitWhenFinished;();generated",
+        "org.apache.commons.io;FileCleaner;getInstance;();generated",
+        "org.apache.commons.io;FileCleaner;getTrackCount;();generated",
+        "org.apache.commons.io;FileCleaner;track;(File,Object);generated",
+        "org.apache.commons.io;FileCleaner;track;(File,Object,FileDeleteStrategy);generated",
+        "org.apache.commons.io;FileCleaner;track;(String,Object);generated",
+        "org.apache.commons.io;FileCleaner;track;(String,Object,FileDeleteStrategy);generated",
+        "org.apache.commons.io;FileCleaningTracker;FileCleaningTracker;();generated",
+        "org.apache.commons.io;FileCleaningTracker;exitWhenFinished;();generated",
+        "org.apache.commons.io;FileCleaningTracker;getTrackCount;();generated",
+        "org.apache.commons.io;FileCleaningTracker;track;(File,Object);generated",
+        "org.apache.commons.io;FileCleaningTracker;track;(File,Object,FileDeleteStrategy);generated",
+        "org.apache.commons.io;FileCleaningTracker;track;(String,Object);generated",
+        "org.apache.commons.io;FileCleaningTracker;track;(String,Object,FileDeleteStrategy);generated",
+        "org.apache.commons.io;FileDeleteStrategy;delete;(File);generated",
+        "org.apache.commons.io;FileDeleteStrategy;deleteQuietly;(File);generated",
+        "org.apache.commons.io;FileExistsException;FileExistsException;();generated",
+        "org.apache.commons.io;FileExistsException;FileExistsException;(File);generated",
+        "org.apache.commons.io;FileExistsException;FileExistsException;(String);generated",
+        "org.apache.commons.io;FileSystem;getCurrent;();generated",
+        "org.apache.commons.io;FileSystem;getIllegalFileNameChars;();generated",
+        "org.apache.commons.io;FileSystem;getMaxFileNameLength;();generated",
+        "org.apache.commons.io;FileSystem;getMaxPathLength;();generated",
+        "org.apache.commons.io;FileSystem;getNameSeparator;();generated",
+        "org.apache.commons.io;FileSystem;getReservedFileNames;();generated",
+        "org.apache.commons.io;FileSystem;isCasePreserving;();generated",
+        "org.apache.commons.io;FileSystem;isCaseSensitive;();generated",
+        "org.apache.commons.io;FileSystem;isLegalFileName;(CharSequence);generated",
+        "org.apache.commons.io;FileSystem;isReservedFileName;(CharSequence);generated",
+        "org.apache.commons.io;FileSystem;normalizeSeparators;(String);generated",
+        "org.apache.commons.io;FileSystem;supportsDriveLetter;();generated",
+        "org.apache.commons.io;FileSystemUtils;FileSystemUtils;();generated",
+        "org.apache.commons.io;FileSystemUtils;freeSpace;(String);generated",
+        "org.apache.commons.io;FileSystemUtils;freeSpaceKb;();generated",
+        "org.apache.commons.io;FileSystemUtils;freeSpaceKb;(String);generated",
+        "org.apache.commons.io;FileSystemUtils;freeSpaceKb;(String,long);generated",
+        "org.apache.commons.io;FileSystemUtils;freeSpaceKb;(long);generated",
+        "org.apache.commons.io;FileUtils;FileUtils;();generated",
+        "org.apache.commons.io;FileUtils;byteCountToDisplaySize;(BigInteger);generated",
+        "org.apache.commons.io;FileUtils;byteCountToDisplaySize;(Number);generated",
+        "org.apache.commons.io;FileUtils;byteCountToDisplaySize;(long);generated",
+        "org.apache.commons.io;FileUtils;checksumCRC32;(File);generated",
+        "org.apache.commons.io;FileUtils;cleanDirectory;(File);generated",
+        "org.apache.commons.io;FileUtils;contentEquals;(File,File);generated",
+        "org.apache.commons.io;FileUtils;contentEqualsIgnoreEOL;(File,File,String);generated",
+        "org.apache.commons.io;FileUtils;copyDirectory;(File,File);generated",
+        "org.apache.commons.io;FileUtils;copyDirectory;(File,File,FileFilter);generated",
+        "org.apache.commons.io;FileUtils;copyDirectory;(File,File,FileFilter,boolean);generated",
+        "org.apache.commons.io;FileUtils;copyDirectory;(File,File,FileFilter,boolean,CopyOption[]);generated",
+        "org.apache.commons.io;FileUtils;copyDirectory;(File,File,boolean);generated",
+        "org.apache.commons.io;FileUtils;copyDirectoryToDirectory;(File,File);generated",
+        "org.apache.commons.io;FileUtils;copyFile;(File,File);generated",
+        "org.apache.commons.io;FileUtils;copyFile;(File,File,CopyOption[]);generated",
+        "org.apache.commons.io;FileUtils;copyFile;(File,File,boolean);generated",
+        "org.apache.commons.io;FileUtils;copyFile;(File,File,boolean,CopyOption[]);generated",
+        "org.apache.commons.io;FileUtils;copyFile;(File,OutputStream);generated",
+        "org.apache.commons.io;FileUtils;copyFileToDirectory;(File,File);generated",
+        "org.apache.commons.io;FileUtils;copyFileToDirectory;(File,File,boolean);generated",
+        "org.apache.commons.io;FileUtils;copyInputStreamToFile;(InputStream,File);generated",
+        "org.apache.commons.io;FileUtils;copyToDirectory;(File,File);generated",
+        "org.apache.commons.io;FileUtils;copyToDirectory;(Iterable,File);generated",
+        "org.apache.commons.io;FileUtils;copyToFile;(InputStream,File);generated",
+        "org.apache.commons.io;FileUtils;copyURLToFile;(URL,File);generated",
+        "org.apache.commons.io;FileUtils;copyURLToFile;(URL,File,int,int);generated",
+        "org.apache.commons.io;FileUtils;createParentDirectories;(File);generated",
+        "org.apache.commons.io;FileUtils;current;();generated",
+        "org.apache.commons.io;FileUtils;deleteDirectory;(File);generated",
+        "org.apache.commons.io;FileUtils;deleteQuietly;(File);generated",
+        "org.apache.commons.io;FileUtils;directoryContains;(File,File);generated",
+        "org.apache.commons.io;FileUtils;forceDelete;(File);generated",
+        "org.apache.commons.io;FileUtils;forceDeleteOnExit;(File);generated",
+        "org.apache.commons.io;FileUtils;forceMkdir;(File);generated",
+        "org.apache.commons.io;FileUtils;forceMkdirParent;(File);generated",
+        "org.apache.commons.io;FileUtils;getTempDirectory;();generated",
+        "org.apache.commons.io;FileUtils;getTempDirectoryPath;();generated",
+        "org.apache.commons.io;FileUtils;getUserDirectory;();generated",
+        "org.apache.commons.io;FileUtils;getUserDirectoryPath;();generated",
+        "org.apache.commons.io;FileUtils;isDirectory;(File,LinkOption[]);generated",
+        "org.apache.commons.io;FileUtils;isEmptyDirectory;(File);generated",
+        "org.apache.commons.io;FileUtils;isFileNewer;(File,ChronoLocalDate);generated",
+        "org.apache.commons.io;FileUtils;isFileNewer;(File,ChronoLocalDate,LocalTime);generated",
+        "org.apache.commons.io;FileUtils;isFileNewer;(File,ChronoLocalDateTime);generated",
+        "org.apache.commons.io;FileUtils;isFileNewer;(File,ChronoLocalDateTime,ZoneId);generated",
+        "org.apache.commons.io;FileUtils;isFileNewer;(File,ChronoZonedDateTime);generated",
+        "org.apache.commons.io;FileUtils;isFileNewer;(File,Date);generated",
+        "org.apache.commons.io;FileUtils;isFileNewer;(File,File);generated",
+        "org.apache.commons.io;FileUtils;isFileNewer;(File,FileTime);generated",
+        "org.apache.commons.io;FileUtils;isFileNewer;(File,Instant);generated",
+        "org.apache.commons.io;FileUtils;isFileNewer;(File,long);generated",
+        "org.apache.commons.io;FileUtils;isFileOlder;(File,ChronoLocalDate);generated",
+        "org.apache.commons.io;FileUtils;isFileOlder;(File,ChronoLocalDate,LocalTime);generated",
+        "org.apache.commons.io;FileUtils;isFileOlder;(File,ChronoLocalDateTime);generated",
+        "org.apache.commons.io;FileUtils;isFileOlder;(File,ChronoLocalDateTime,ZoneId);generated",
+        "org.apache.commons.io;FileUtils;isFileOlder;(File,ChronoZonedDateTime);generated",
+        "org.apache.commons.io;FileUtils;isFileOlder;(File,Date);generated",
+        "org.apache.commons.io;FileUtils;isFileOlder;(File,File);generated",
+        "org.apache.commons.io;FileUtils;isFileOlder;(File,FileTime);generated",
+        "org.apache.commons.io;FileUtils;isFileOlder;(File,Instant);generated",
+        "org.apache.commons.io;FileUtils;isFileOlder;(File,long);generated",
+        "org.apache.commons.io;FileUtils;isRegularFile;(File,LinkOption[]);generated",
+        "org.apache.commons.io;FileUtils;isSymlink;(File);generated",
+        "org.apache.commons.io;FileUtils;iterateFiles;(File,IOFileFilter,IOFileFilter);generated",
+        "org.apache.commons.io;FileUtils;iterateFiles;(File,String[],boolean);generated",
+        "org.apache.commons.io;FileUtils;iterateFilesAndDirs;(File,IOFileFilter,IOFileFilter);generated",
+        "org.apache.commons.io;FileUtils;lastModified;(File);generated",
+        "org.apache.commons.io;FileUtils;lastModifiedFileTime;(File);generated",
+        "org.apache.commons.io;FileUtils;lastModifiedUnchecked;(File);generated",
+        "org.apache.commons.io;FileUtils;lineIterator;(File);generated",
+        "org.apache.commons.io;FileUtils;lineIterator;(File,String);generated",
+        "org.apache.commons.io;FileUtils;listFiles;(File,IOFileFilter,IOFileFilter);generated",
+        "org.apache.commons.io;FileUtils;listFiles;(File,String[],boolean);generated",
+        "org.apache.commons.io;FileUtils;listFilesAndDirs;(File,IOFileFilter,IOFileFilter);generated",
+        "org.apache.commons.io;FileUtils;moveDirectory;(File,File);generated",
+        "org.apache.commons.io;FileUtils;moveDirectoryToDirectory;(File,File,boolean);generated",
+        "org.apache.commons.io;FileUtils;moveFile;(File,File);generated",
+        "org.apache.commons.io;FileUtils;moveFile;(File,File,CopyOption[]);generated",
+        "org.apache.commons.io;FileUtils;moveFileToDirectory;(File,File,boolean);generated",
+        "org.apache.commons.io;FileUtils;moveToDirectory;(File,File,boolean);generated",
+        "org.apache.commons.io;FileUtils;newOutputStream;(File,boolean);generated",
+        "org.apache.commons.io;FileUtils;openInputStream;(File);generated",
+        "org.apache.commons.io;FileUtils;openOutputStream;(File);generated",
+        "org.apache.commons.io;FileUtils;openOutputStream;(File,boolean);generated",
+        "org.apache.commons.io;FileUtils;readFileToByteArray;(File);generated",
+        "org.apache.commons.io;FileUtils;readFileToString;(File);generated",
+        "org.apache.commons.io;FileUtils;readFileToString;(File,Charset);generated",
+        "org.apache.commons.io;FileUtils;readFileToString;(File,String);generated",
+        "org.apache.commons.io;FileUtils;readLines;(File);generated",
+        "org.apache.commons.io;FileUtils;readLines;(File,Charset);generated",
+        "org.apache.commons.io;FileUtils;readLines;(File,String);generated",
+        "org.apache.commons.io;FileUtils;sizeOf;(File);generated",
+        "org.apache.commons.io;FileUtils;sizeOfAsBigInteger;(File);generated",
+        "org.apache.commons.io;FileUtils;sizeOfDirectory;(File);generated",
+        "org.apache.commons.io;FileUtils;sizeOfDirectoryAsBigInteger;(File);generated",
+        "org.apache.commons.io;FileUtils;streamFiles;(File,boolean,String[]);generated",
+        "org.apache.commons.io;FileUtils;toFile;(URL);generated",
+        "org.apache.commons.io;FileUtils;toFiles;(URL[]);generated",
+        "org.apache.commons.io;FileUtils;touch;(File);generated",
+        "org.apache.commons.io;FileUtils;waitFor;(File,int);generated",
+        "org.apache.commons.io;FileUtils;write;(File,CharSequence);generated",
+        "org.apache.commons.io;FileUtils;write;(File,CharSequence,Charset);generated",
+        "org.apache.commons.io;FileUtils;write;(File,CharSequence,Charset,boolean);generated",
+        "org.apache.commons.io;FileUtils;write;(File,CharSequence,String);generated",
+        "org.apache.commons.io;FileUtils;write;(File,CharSequence,String,boolean);generated",
+        "org.apache.commons.io;FileUtils;write;(File,CharSequence,boolean);generated",
+        "org.apache.commons.io;FileUtils;writeByteArrayToFile;(File,byte[]);generated",
+        "org.apache.commons.io;FileUtils;writeByteArrayToFile;(File,byte[],boolean);generated",
+        "org.apache.commons.io;FileUtils;writeByteArrayToFile;(File,byte[],int,int);generated",
+        "org.apache.commons.io;FileUtils;writeByteArrayToFile;(File,byte[],int,int,boolean);generated",
+        "org.apache.commons.io;FileUtils;writeLines;(File,Collection);generated",
+        "org.apache.commons.io;FileUtils;writeLines;(File,Collection,String);generated",
+        "org.apache.commons.io;FileUtils;writeLines;(File,Collection,String,boolean);generated",
+        "org.apache.commons.io;FileUtils;writeLines;(File,Collection,boolean);generated",
+        "org.apache.commons.io;FileUtils;writeLines;(File,String,Collection);generated",
+        "org.apache.commons.io;FileUtils;writeLines;(File,String,Collection,String);generated",
+        "org.apache.commons.io;FileUtils;writeLines;(File,String,Collection,String,boolean);generated",
+        "org.apache.commons.io;FileUtils;writeLines;(File,String,Collection,boolean);generated",
+        "org.apache.commons.io;FileUtils;writeStringToFile;(File,String);generated",
+        "org.apache.commons.io;FileUtils;writeStringToFile;(File,String,Charset);generated",
+        "org.apache.commons.io;FileUtils;writeStringToFile;(File,String,Charset,boolean);generated",
+        "org.apache.commons.io;FileUtils;writeStringToFile;(File,String,String);generated",
+        "org.apache.commons.io;FileUtils;writeStringToFile;(File,String,String,boolean);generated",
+        "org.apache.commons.io;FileUtils;writeStringToFile;(File,String,boolean);generated",
+        "org.apache.commons.io;FilenameUtils;FilenameUtils;();generated",
+        "org.apache.commons.io;FilenameUtils;directoryContains;(String,String);generated",
+        "org.apache.commons.io;FilenameUtils;equals;(String,String);generated",
+        "org.apache.commons.io;FilenameUtils;equals;(String,String,boolean,IOCase);generated",
+        "org.apache.commons.io;FilenameUtils;equalsNormalized;(String,String);generated",
+        "org.apache.commons.io;FilenameUtils;equalsNormalizedOnSystem;(String,String);generated",
+        "org.apache.commons.io;FilenameUtils;equalsOnSystem;(String,String);generated",
+        "org.apache.commons.io;FilenameUtils;getPrefixLength;(String);generated",
+        "org.apache.commons.io;FilenameUtils;indexOfExtension;(String);generated",
+        "org.apache.commons.io;FilenameUtils;indexOfLastSeparator;(String);generated",
+        "org.apache.commons.io;FilenameUtils;isExtension;(String,Collection);generated",
+        "org.apache.commons.io;FilenameUtils;isExtension;(String,String);generated",
+        "org.apache.commons.io;FilenameUtils;isExtension;(String,String[]);generated",
+        "org.apache.commons.io;FilenameUtils;separatorsToSystem;(String);generated",
+        "org.apache.commons.io;FilenameUtils;separatorsToUnix;(String);generated",
+        "org.apache.commons.io;FilenameUtils;separatorsToWindows;(String);generated",
+        "org.apache.commons.io;FilenameUtils;wildcardMatch;(String,String);generated",
+        "org.apache.commons.io;FilenameUtils;wildcardMatch;(String,String,IOCase);generated",
+        "org.apache.commons.io;FilenameUtils;wildcardMatchOnSystem;(String,String);generated",
+        "org.apache.commons.io;HexDump;HexDump;();generated",
+        "org.apache.commons.io;HexDump;dump;(byte[],long,OutputStream,int);generated",
+        "org.apache.commons.io;IOCase;checkCompareTo;(String,String);generated",
+        "org.apache.commons.io;IOCase;checkEndsWith;(String,String);generated",
+        "org.apache.commons.io;IOCase;checkEquals;(String,String);generated",
+        "org.apache.commons.io;IOCase;checkIndexOf;(String,int,String);generated",
+        "org.apache.commons.io;IOCase;checkRegionMatches;(String,int,String);generated",
+        "org.apache.commons.io;IOCase;checkStartsWith;(String,String);generated",
+        "org.apache.commons.io;IOCase;forName;(String);generated",
+        "org.apache.commons.io;IOCase;getName;();generated",
+        "org.apache.commons.io;IOCase;isCaseSensitive;();generated",
+        "org.apache.commons.io;IOCase;isCaseSensitive;(IOCase);generated",
+        "org.apache.commons.io;IOCase;toString;();generated",
+        "org.apache.commons.io;IOCase;value;(IOCase,IOCase);generated",
+        "org.apache.commons.io;IOExceptionList;checkEmpty;(List,Object);generated",
+        "org.apache.commons.io;IOExceptionList;getCause;(int,Class);generated",
+        "org.apache.commons.io;IOExceptionWithCause;IOExceptionWithCause;(String,Throwable);generated",
+        "org.apache.commons.io;IOExceptionWithCause;IOExceptionWithCause;(Throwable);generated",
+        "org.apache.commons.io;IOIndexedException;IOIndexedException;(int,Throwable);generated",
+        "org.apache.commons.io;IOIndexedException;getIndex;();generated",
+        "org.apache.commons.io;IOUtils;IOUtils;();generated",
+        "org.apache.commons.io;IOUtils;byteArray;();generated",
+        "org.apache.commons.io;IOUtils;byteArray;(int);generated",
+        "org.apache.commons.io;IOUtils;close;(Closeable);generated",
+        "org.apache.commons.io;IOUtils;close;(Closeable,IOConsumer);generated",
+        "org.apache.commons.io;IOUtils;close;(Closeable[]);generated",
+        "org.apache.commons.io;IOUtils;close;(URLConnection);generated",
+        "org.apache.commons.io;IOUtils;closeQuietly;(Closeable);generated",
+        "org.apache.commons.io;IOUtils;closeQuietly;(Closeable,Consumer);generated",
+        "org.apache.commons.io;IOUtils;closeQuietly;(Closeable[]);generated",
+        "org.apache.commons.io;IOUtils;closeQuietly;(InputStream);generated",
+        "org.apache.commons.io;IOUtils;closeQuietly;(OutputStream);generated",
+        "org.apache.commons.io;IOUtils;closeQuietly;(Reader);generated",
+        "org.apache.commons.io;IOUtils;closeQuietly;(Selector);generated",
+        "org.apache.commons.io;IOUtils;closeQuietly;(ServerSocket);generated",
+        "org.apache.commons.io;IOUtils;closeQuietly;(Socket);generated",
+        "org.apache.commons.io;IOUtils;closeQuietly;(Writer);generated",
+        "org.apache.commons.io;IOUtils;consume;(InputStream);generated",
+        "org.apache.commons.io;IOUtils;contentEquals;(InputStream,InputStream);generated",
+        "org.apache.commons.io;IOUtils;contentEquals;(Reader,Reader);generated",
+        "org.apache.commons.io;IOUtils;contentEqualsIgnoreEOL;(Reader,Reader);generated",
+        "org.apache.commons.io;IOUtils;copy;(ByteArrayOutputStream);generated",
+        "org.apache.commons.io;IOUtils;copy;(Reader,OutputStream);generated",
+        "org.apache.commons.io;IOUtils;copy;(Reader,OutputStream,Charset);generated",
+        "org.apache.commons.io;IOUtils;copy;(Reader,OutputStream,String);generated",
+        "org.apache.commons.io;IOUtils;copy;(URL,File);generated",
+        "org.apache.commons.io;IOUtils;copy;(URL,OutputStream);generated",
+        "org.apache.commons.io;IOUtils;length;(CharSequence);generated",
+        "org.apache.commons.io;IOUtils;length;(Object[]);generated",
+        "org.apache.commons.io;IOUtils;length;(byte[]);generated",
+        "org.apache.commons.io;IOUtils;length;(char[]);generated",
+        "org.apache.commons.io;IOUtils;resourceToByteArray;(String);generated",
+        "org.apache.commons.io;IOUtils;resourceToByteArray;(String,ClassLoader);generated",
+        "org.apache.commons.io;IOUtils;resourceToString;(String,Charset);generated",
+        "org.apache.commons.io;IOUtils;resourceToString;(String,Charset,ClassLoader);generated",
+        "org.apache.commons.io;IOUtils;resourceToURL;(String);generated",
+        "org.apache.commons.io;IOUtils;resourceToURL;(String,ClassLoader);generated",
+        "org.apache.commons.io;IOUtils;skip;(InputStream,long);generated",
+        "org.apache.commons.io;IOUtils;skip;(ReadableByteChannel,long);generated",
+        "org.apache.commons.io;IOUtils;skip;(Reader,long);generated",
+        "org.apache.commons.io;IOUtils;skipFully;(InputStream,long);generated",
+        "org.apache.commons.io;IOUtils;skipFully;(ReadableByteChannel,long);generated",
+        "org.apache.commons.io;IOUtils;skipFully;(Reader,long);generated",
+        "org.apache.commons.io;IOUtils;toBufferedInputStream;(InputStream);generated",
+        "org.apache.commons.io;IOUtils;toBufferedInputStream;(InputStream,int);generated",
+        "org.apache.commons.io;IOUtils;toByteArray;(InputStream);generated",
+        "org.apache.commons.io;IOUtils;toByteArray;(Reader);generated",
+        "org.apache.commons.io;IOUtils;toByteArray;(Reader,Charset);generated",
+        "org.apache.commons.io;IOUtils;toByteArray;(Reader,String);generated",
+        "org.apache.commons.io;IOUtils;toByteArray;(URI);generated",
+        "org.apache.commons.io;IOUtils;toByteArray;(URL);generated",
+        "org.apache.commons.io;IOUtils;toByteArray;(URLConnection);generated",
+        "org.apache.commons.io;IOUtils;toString;(URI);generated",
+        "org.apache.commons.io;IOUtils;toString;(URI,Charset);generated",
+        "org.apache.commons.io;IOUtils;toString;(URI,String);generated",
+        "org.apache.commons.io;IOUtils;toString;(URL);generated",
+        "org.apache.commons.io;IOUtils;toString;(URL,Charset);generated",
+        "org.apache.commons.io;IOUtils;toString;(URL,String);generated",
+        "org.apache.commons.io;IOUtils;write;(CharSequence,OutputStream);generated",
+        "org.apache.commons.io;IOUtils;write;(CharSequence,OutputStream,Charset);generated",
+        "org.apache.commons.io;IOUtils;write;(CharSequence,OutputStream,String);generated",
+        "org.apache.commons.io;IOUtils;write;(String,OutputStream);generated",
+        "org.apache.commons.io;IOUtils;write;(String,OutputStream,Charset);generated",
+        "org.apache.commons.io;IOUtils;write;(String,OutputStream,String);generated",
+        "org.apache.commons.io;IOUtils;write;(StringBuffer,OutputStream);generated",
+        "org.apache.commons.io;IOUtils;write;(StringBuffer,OutputStream,String);generated",
+        "org.apache.commons.io;IOUtils;write;(char[],OutputStream);generated",
+        "org.apache.commons.io;IOUtils;write;(char[],OutputStream,Charset);generated",
+        "org.apache.commons.io;IOUtils;write;(char[],OutputStream,String);generated",
+        "org.apache.commons.io;LineIterator;closeQuietly;(LineIterator);generated",
+        "org.apache.commons.io;RandomAccessFileMode;create;(File);generated",
+        "org.apache.commons.io;RandomAccessFileMode;create;(Path);generated",
+        "org.apache.commons.io;RandomAccessFileMode;create;(String);generated",
+        "org.apache.commons.io;RandomAccessFileMode;toString;();generated",
+        "org.apache.commons.io;StandardLineSeparator;getBytes;(Charset);generated",
+        "org.apache.commons.io;StandardLineSeparator;getString;();generated",
+        "org.apache.commons.io;TaggedIOException;isTaggedWith;(Throwable,Object);generated",
+        "org.apache.commons.io;TaggedIOException;throwCauseIfTaggedWith;(Throwable,Object);generated",
+        "org.apache.commons.io;UncheckedIO;UncheckedIO;();generated",
+        "org.apache.commons.io;UncheckedIO;accept;(IOConsumer,Object);generated",
+        "org.apache.commons.io;UncheckedIO;apply;(IOBiFunction,Object,Object);generated",
+        "org.apache.commons.io;UncheckedIO;get;(IOSupplier);generated",
+        "org.apache.commons.io;UncheckedIO;run;(IORunnable);generated",
+        "org.apache.commons.io;UncheckedIOExceptions;UncheckedIOExceptions;();generated",
+        "org.apache.commons.io;UncheckedIOExceptions;create;(Object);generated",
+        "org.apache.commons.io;UncheckedIOExceptions;wrap;(IOException,Object);generated"
+      ]
+  }
+}

java/ql/lib/semmle/code/java/security/OverlyLargeRangeQuery.qll

@@ -173,7 +173,7 @@ module RangePrinter {
   }
 
   /** Gets the number of parts we should print for a given `range`. */
-  private int parts(OverlyWideRange range) { result = 1 + strictcount(cutoff(range, _)) }
+  private int parts(OverlyWideRange range) { result = 1 + count(cutoff(range, _)) }
 
   /** Holds if the given part of a range should span from `low` to `high`. */
   private predicate part(OverlyWideRange range, int part, string low, string high) {

java/ql/src/Security/CWE/CWE-113/ResponseSplitting.ql

@@ -27,8 +27,21 @@ class ResponseSplittingConfig extends TaintTracking::Configuration {
   override predicate isSink(DataFlow::Node sink) { sink instanceof HeaderSplittingSink }
 
   override predicate isSanitizer(DataFlow::Node node) {
-    node.getType() instanceof PrimitiveType or
+    node.getType() instanceof PrimitiveType
+    or
     node.getType() instanceof BoxedType
+    or
+    exists(MethodAccess ma, string methodName, CompileTimeConstantExpr target |
+      node.asExpr() = ma and
+      ma.getMethod().hasQualifiedName("java.lang", "String", methodName) and
+      target = ma.getArgument(0) and
+      (
+        methodName = "replace" and target.getIntValue() = [10, 13] // 10 == "\n", 13 == "\r"
+        or
+        methodName = "replaceAll" and
+        target.getStringValue().regexpMatch(".*([\n\r]|\\[\\^[^\\]\r\n]*\\]).*")
+      )
+    )
   }
 }
 

java/ql/src/Telemetry/UnsupportedExternalAPIs.ql

@@ -8,6 +8,7 @@
 
 import java
 import semmle.code.java.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl
+import semmle.code.java.dataflow.internal.NegativeSummary
 import ExternalApi
 
 private predicate getRelevantUsages(ExternalApi api, int usages) {

java/ql/src/experimental/Security/CWE/CWE-601/SpringUrlRedirect.ql

@@ -11,7 +11,7 @@
  */
 
 import java
-import SpringUrlRedirect
+import experimental.semmle.code.java.security.SpringUrlRedirect
 import semmle.code.java.dataflow.FlowSources
 import semmle.code.java.controlflow.Guards
 import DataFlow::PathGraph

java/ql/src/experimental/Security/CWE/CWE-625/DotRegex.java

@@ -0,0 +1,32 @@
+String PROTECTED_PATTERN = "/protected/.*";
+String CONSTRAINT_PATTERN = "/protected/xyz\\.xml";
+
+// BAD: A string with line return e.g. `/protected/%0dxyz` can bypass the path check
+Pattern p = Pattern.compile(PROTECTED_PATTERN);
+Matcher m = p.matcher(path);
+
+// GOOD: A string with line return e.g. `/protected/%0dxyz` cannot bypass the path check
+Pattern p = Pattern.compile(PROTECTED_PATTERN, Pattern.DOTALL);
+Matcher m = p.matcher(path);
+
+// GOOD: Only a specific path can pass the validation
+Pattern p = Pattern.compile(CONSTRAINT_PATTERN);
+Matcher m = p.matcher(path);
+
+if (m.matches()) {
+    // Protected page - check access token and redirect to login page
+} else {
+    // Not protected page - render content
+}
+
+// BAD: A string with line return e.g. `/protected/%0axyz` can bypass the path check
+boolean matches = path.matches(PROTECTED_PATTERN);
+
+// BAD: A string with line return e.g. `/protected/%0axyz` can bypass the path check
+boolean matches = Pattern.matches(PROTECTED_PATTERN, path);
+
+if (matches) {
+    // Protected page - check access token and redirect to login page
+} else {
+    // Not protected page - render content
+}

java/ql/src/experimental/Security/CWE/CWE-625/PermissiveDotRegex.qhelp

@@ -0,0 +1,40 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+
+<overview>
+<p>By default, "dot" (<code>.</code>) in regular expressions matches all characters except newline characters <code>\n</code> and
+<code>\r</code>. Regular expressions containing a dot can be bypassed with the characters \r(%0a) , \n(%0d) when the default regex
+matching implementations of Java are used. When regular expressions serve to match protected resource patterns to grant access
+to protected application resources, attackers can gain access to unauthorized paths.</p>
+</overview>
+
+<recommendation>
+<p>To guard against unauthorized access, it is advisable to properly specify regex patterns for validating user input. The Java
+Pattern Matcher API <code>Pattern.compile(PATTERN, Pattern.DOTALL)</code> with the <code>DOTALL</code> flag set can be adopted
+to address this vulnerability.</p>
+</recommendation>
+
+<example>
+<p>The following examples show the bad case and the good case respectively. The <code>bad</code> methods show a regex pattern allowing
+bypass. In the <code>good</code> methods, it is shown how to solve this problem by either specifying the regex pattern correctly or
+use the Java API that can detect new line characters. 
+</p>
+
+<sample src="DotRegex.java" />
+</example>
+
+<references>
+<li>Lay0us1:
+  <a href="https://github.com/Lay0us1/CVE-2022-32532">CVE 2022-22978: Authorization Bypass in RegexRequestMatcher</a>.
+</li>
+<li>Apache Shiro:
+  <a href="https://github.com/apache/shiro/commit/6bcb92e06fa588b9c7790dd01bc02135d58d3f5b">Address the RegexRequestMatcher issue in 1.9.1</a>.
+</li>
+<li>CVE-2022-32532:
+  <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32532">Applications using RegExPatternMatcher with "." in the regular expression are possibly vulnerable to an authorization bypass</a>.
+</li>
+</references>
+
+</qhelp>

java/ql/src/experimental/Security/CWE/CWE-625/PermissiveDotRegex.ql

@@ -0,0 +1,22 @@
+/**
+ * @name URL matched by permissive `.` in the regular expression
+ * @description URL validated with permissive `.` in regex  are possibly vulnerable
+ *              to an authorization bypass.
+ * @kind path-problem
+ * @problem.severity warning
+ * @precision high
+ * @id java/permissive-dot-regex
+ * @tags security
+ *       external/cwe-625
+ *       external/cwe-863
+ */
+
+import java
+import semmle.code.java.dataflow.FlowSources
+import DataFlow::PathGraph
+import PermissiveDotRegexQuery
+
+from DataFlow::PathNode source, DataFlow::PathNode sink, MatchRegexConfiguration conf
+where conf.hasFlowPath(source, sink)
+select sink.getNode(), source, sink, "Potentially authentication bypass due to $@.",
+  source.getNode(), "user-provided value"

java/ql/src/experimental/Security/CWE/CWE-625/PermissiveDotRegexQuery.qll

@@ -0,0 +1,218 @@
+/** Provides classes related to security-centered regular expression matching. */
+
+import java
+private import semmle.code.java.dataflow.ExternalFlow
+private import semmle.code.java.dataflow.FlowSources
+import experimental.semmle.code.java.security.SpringUrlRedirect
+import semmle.code.java.controlflow.Guards
+import semmle.code.java.security.UrlRedirect
+import Regex
+
+/** A string that ends with `.*` not prefixed with `\`. */
+class PermissiveDotStr extends StringLiteral {
+  PermissiveDotStr() {
+    exists(string s, int i | this.getValue() = s |
+      s.indexOf(".*") = i and
+      not s.charAt(i - 1) = "\\" and
+      s.length() = i + 2
+    )
+  }
+}
+
+/** Source model of remote flow source with servlets. */
+private class GetServletUriSource extends SourceModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "javax.servlet.http;HttpServletRequest;false;getPathInfo;();;ReturnValue;uri-path;manual",
+        "javax.servlet.http;HttpServletRequest;false;getPathTranslated;();;ReturnValue;uri-path;manual",
+        "javax.servlet.http;HttpServletRequest;false;getRequestURI;();;ReturnValue;uri-path;manual",
+        "javax.servlet.http;HttpServletRequest;false;getRequestURL;();;ReturnValue;uri-path;manual",
+        "javax.servlet.http;HttpServletRequest;false;getServletPath;();;ReturnValue;uri-path;manual"
+      ]
+  }
+}
+
+/** Sink of servlet dispatcher. */
+private class UrlDispatchSink extends UrlRedirectSink {
+  UrlDispatchSink() {
+    exists(MethodAccess ma |
+      ma.getMethod() instanceof RequestDispatchMethod and
+      this.asExpr() = ma.getQualifier()
+    )
+  }
+}
+
+/** The `doFilter` method of `javax.servlet.FilterChain`. */
+private class ServletFilterMethod extends Method {
+  ServletFilterMethod() {
+    this.getDeclaringType().getASupertype*().hasQualifiedName("javax.servlet", "FilterChain") and
+    this.hasName("doFilter")
+  }
+}
+
+/** Sink of servlet filter. */
+private class UrlFilterSink extends UrlRedirectSink {
+  UrlFilterSink() {
+    exists(MethodAccess ma |
+      ma.getMethod() instanceof ServletFilterMethod and
+      this.asExpr() = ma.getQualifier()
+    )
+  }
+}
+
+/** A Spring framework annotation indicating remote uri user input. */
+class SpringUriInputAnnotation extends Annotation {
+  SpringUriInputAnnotation() {
+    this.getType()
+        .hasQualifiedName("org.springframework.web.bind.annotation",
+          ["PathVariable", "RequestParam"])
+  }
+}
+
+class SpringUriInputParameterSource extends DataFlow::Node {
+  SpringUriInputParameterSource() {
+    this.asParameter() =
+      any(SpringRequestMappingParameter srmp |
+        srmp.getAnAnnotation() instanceof SpringUriInputAnnotation
+      )
+  }
+}
+
+/**
+ * A data flow sink to construct regular expressions.
+ */
+class CompileRegexSink extends DataFlow::ExprNode {
+  CompileRegexSink() {
+    exists(MethodAccess ma, Method m | m = ma.getMethod() |
+      (
+        ma.getArgument(0) = this.asExpr() and
+        (
+          m instanceof StringMatchMethod // input.matches(regexPattern)
+          or
+          m instanceof PatternCompileMethod // p = Pattern.compile(regexPattern)
+          or
+          m instanceof PatternMatchMethod // p = Pattern.matches(regexPattern, input)
+        )
+      )
+    )
+  }
+}
+
+/**
+ * A flow configuration for permissive dot regex.
+ */
+class PermissiveDotRegexConfig extends DataFlow2::Configuration {
+  PermissiveDotRegexConfig() { this = "PermissiveDotRegex::PermissiveDotRegexConfig" }
+
+  override predicate isSource(DataFlow2::Node src) { src.asExpr() instanceof PermissiveDotStr }
+
+  override predicate isSink(DataFlow2::Node sink) { sink instanceof CompileRegexSink }
+
+  override predicate isBarrier(DataFlow2::Node node) {
+    exists(
+      MethodAccess ma, Field f // Pattern.compile(PATTERN, Pattern.DOTALL)
+    |
+      ma.getMethod() instanceof PatternCompileMethod and
+      ma.getArgument(1) = f.getAnAccess() and
+      f.hasName("DOTALL") and
+      f.getDeclaringType() instanceof Pattern and
+      node.asExpr() = ma.getArgument(0)
+    )
+  }
+}
+
+/**
+ * A taint-tracking configuration for untrusted user input used to match regular expressions.
+ */
+class MatchRegexConfiguration extends TaintTracking::Configuration {
+  MatchRegexConfiguration() { this = "PermissiveDotRegex::MatchRegexConfiguration" }
+
+  override predicate isSource(DataFlow::Node source) {
+    sourceNode(source, "uri-path") or // Servlet uri source
+    source instanceof SpringUriInputParameterSource // Spring uri source
+  }
+
+  override predicate isSink(DataFlow::Node sink) {
+    sink instanceof MatchRegexSink and
+    exists(
+      Guard guard, Expr se, Expr ce // used in a condition to control url redirect, which is a typical security enforcement
+    |
+      (
+        sink.asExpr() = ce.(MethodAccess).getQualifier() or
+        sink.asExpr() = ce.(MethodAccess).getAnArgument() or
+        sink.asExpr() = ce
+      ) and
+      (
+        DataFlow::localExprFlow(ce, guard.(MethodAccess).getQualifier()) or
+        DataFlow::localExprFlow(ce, guard.(MethodAccess).getAnArgument())
+      ) and
+      (
+        DataFlow::exprNode(se) instanceof UrlRedirectSink or
+        DataFlow::exprNode(se) instanceof SpringUrlRedirectSink
+      ) and
+      guard.controls(se.getBasicBlock(), true)
+    ) and
+    exists(MethodAccess ma | any(PermissiveDotRegexConfig conf2).hasFlowToExpr(ma.getArgument(0)) |
+      // input.matches(regexPattern)
+      ma.getMethod() instanceof StringMatchMethod and
+      ma.getQualifier() = sink.asExpr()
+      or
+      // p = Pattern.compile(regexPattern); p.matcher(input)
+      ma.getMethod() instanceof PatternCompileMethod and
+      exists(MethodAccess pma |
+        pma.getMethod() instanceof PatternMatcherMethod and
+        sink.asExpr() = pma.getArgument(0) and
+        DataFlow::localExprFlow(ma, pma.getQualifier())
+      )
+      or
+      // p = Pattern.matches(regexPattern, input)
+      ma.getMethod() instanceof PatternMatchMethod and
+      sink.asExpr() = ma.getArgument(1)
+    )
+  }
+}
+
+abstract class MatchRegexSink extends DataFlow::ExprNode { }
+
+/**
+ * A data flow sink to string match regular expressions.
+ */
+class StringMatchRegexSink extends MatchRegexSink {
+  StringMatchRegexSink() {
+    exists(MethodAccess ma, Method m | m = ma.getMethod() |
+      (
+        m instanceof StringMatchMethod and
+        ma.getQualifier() = this.asExpr()
+      )
+    )
+  }
+}
+
+/**
+ * A data flow sink to `pattern.matches` regular expressions.
+ */
+class PatternMatchRegexSink extends MatchRegexSink {
+  PatternMatchRegexSink() {
+    exists(MethodAccess ma, Method m | m = ma.getMethod() |
+      (
+        m instanceof PatternMatchMethod and
+        ma.getArgument(1) = this.asExpr()
+      )
+    )
+  }
+}
+
+/**
+ * A data flow sink to `pattern.matcher` match regular expressions.
+ */
+class PatternMatcherRegexSink extends MatchRegexSink {
+  PatternMatcherRegexSink() {
+    exists(MethodAccess ma, Method m | m = ma.getMethod() |
+      (
+        m instanceof PatternMatcherMethod and
+        ma.getArgument(0) = this.asExpr()
+      )
+    )
+  }
+}

java/ql/src/experimental/Security/CWE/CWE-625/Regex.qll

@@ -0,0 +1,50 @@
+/** Provides methods related to regular expression matching. */
+
+import java
+
+/**
+ * The class `Pattern` for pattern match.
+ */
+class Pattern extends RefType {
+  Pattern() { this.hasQualifiedName("java.util.regex", "Pattern") }
+}
+
+/**
+ * The method `compile` for `Pattern`.
+ */
+class PatternCompileMethod extends Method {
+  PatternCompileMethod() {
+    this.getDeclaringType().getASupertype*() instanceof Pattern and
+    this.hasName("compile")
+  }
+}
+
+/**
+ * The method `matches` for `Pattern`.
+ */
+class PatternMatchMethod extends Method {
+  PatternMatchMethod() {
+    this.getDeclaringType().getASupertype*() instanceof Pattern and
+    this.hasName("matches")
+  }
+}
+
+/**
+ * The method `matcher` for `Pattern`.
+ */
+class PatternMatcherMethod extends Method {
+  PatternMatcherMethod() {
+    this.getDeclaringType().getASupertype*() instanceof Pattern and
+    this.hasName("matcher")
+  }
+}
+
+/**
+ * The method `matches` for `String`.
+ */
+class StringMatchMethod extends Method {
+  StringMatchMethod() {
+    this.getDeclaringType().getASupertype*() instanceof TypeString and
+    this.hasName("matches")
+  }
+}

java/ql/src/experimental/semmle/code/java/security/SpringUrlRedirect.qll

@@ -1,9 +1,7 @@
-import java
-import DataFlow
-import semmle.code.java.dataflow.FlowSources
-import semmle.code.java.dataflow.DataFlow2
-import semmle.code.java.dataflow.TaintTracking
-import semmle.code.java.frameworks.spring.SpringController
+/** Provides classes and predicates related to Spring URL redirect. */
+
+private import java
+private import semmle.code.java.dataflow.FlowSources
 
 /**
  * A concatenate expression using the string `redirect:` or `ajaxredirect:` or `forward:` on the left.
@@ -42,6 +40,13 @@ abstract class SpringUrlRedirectSink extends DataFlow::Node { }
  */
 private class SpringViewUrlRedirectSink extends SpringUrlRedirectSink {
   SpringViewUrlRedirectSink() {
+    // Hardcoded redirect such as "redirect:login"
+    this.asExpr()
+        .(CompileTimeConstantExpr)
+        .getStringValue()
+        .indexOf(["redirect:", "ajaxredirect:", "forward:"]) = 0 and
+    any(SpringRequestMappingMethod sqmm).polyCalls*(this.getEnclosingCallable())
+    or
     exists(RedirectBuilderExpr rbe |
       rbe.getRightOperand() = this.asExpr() and
       any(SpringRequestMappingMethod sqmm).polyCalls*(this.getEnclosingCallable())

java/ql/src/utils/model-generator/internal/CaptureModels.qll

@@ -234,6 +234,7 @@ string captureSource(TargetApi api) {
     config.hasFlow(source, sink) and
     ExternalFlow::sourceNode(source, kind) and
     api = sink.getEnclosingCallable() and
+    isRelevantSourceKind(kind) and
     result = asSourceModel(api, returnNodeAsOutput(sink), kind)
   )
 }

java/ql/src/utils/model-generator/internal/CaptureModelsSpecific.qll

@@ -55,7 +55,8 @@ private predicate isJdkInternal(J::CompilationUnit cu) {
 private predicate isRelevantForModels(J::Callable api) {
   not isInTestFile(api.getCompilationUnit().getFile()) and
   not isJdkInternal(api.getCompilationUnit()) and
-  not api instanceof J::MainMethod
+  not api instanceof J::MainMethod and
+  not api instanceof J::StaticInitializer
 }
 
 /**
@@ -259,3 +260,9 @@ predicate isRelevantSinkKind(string kind) {
   not kind.matches("regex-use%") and
   not kind = "write-file"
 }
+
+/**
+ * Holds if `kind` is a relevant source kind for creating source models.
+ */
+bindingset[kind]
+predicate isRelevantSourceKind(string kind) { any() }

java/ql/test/experimental/query-tests/security/CWE-625/DotRegexFilter.java

@@ -0,0 +1,70 @@
+import java.io.IOException;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+import javax.servlet.Filter;
+import javax.servlet.FilterChain;
+import javax.servlet.FilterConfig;
+import javax.servlet.ServletContext;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+public class DotRegexFilter implements Filter {
+	private static final String PROTECTED_PATTERN = "/protected/.*";
+	private static final String CONSTRAINT_PATTERN = "/protected/xyz\\.xml";
+
+	private ServletContext context;
+
+	public void init(FilterConfig config) throws ServletException {
+		this.context = config.getServletContext();
+	}
+
+	// BAD: A string with line return e.g. `/protected/%0dxyz` can bypass the path check
+	public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
+		HttpServletRequest httpRequest = (HttpServletRequest) request;
+		HttpServletResponse httpResponse = (HttpServletResponse) response;
+		String source = httpRequest.getPathInfo();
+
+		Pattern p = Pattern.compile(PROTECTED_PATTERN);
+		Matcher m = p.matcher(source);
+
+		if (m.matches()) {
+			// Protected page - check access token and redirect to login page
+			if (!httpRequest.getSession().getAttribute("secAttr").equals("secValue")) {
+				// Redirect to the login page
+				httpResponse.sendRedirect("/login.html");
+			} else {
+				// Not protected page - pass the request along the filter chain
+				chain.doFilter(request, response);
+			}
+		}
+	}
+
+	// GOOD: A string with line return e.g. `/protected/%0dxyz` cannot bypass the path check
+	public void doFilter2(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
+		HttpServletRequest httpRequest = (HttpServletRequest) request;
+		HttpServletResponse httpResponse = (HttpServletResponse) response;
+		String source = httpRequest.getPathInfo();
+
+		Pattern p = Pattern.compile(CONSTRAINT_PATTERN);
+		Matcher m = p.matcher(source);
+
+		if (m.matches()) {
+			// Protected page - check access token and redirect to login page
+			if (!httpRequest.getSession().getAttribute("secAttr").equals("secValue")) {
+				// Redirect to the login page
+				httpResponse.sendRedirect("/login.html");
+			} else {
+				// Not protected page - pass the request along the filter chain
+				chain.doFilter(request, response);
+			}
+		}
+	}
+
+	public void destroy() {
+		// Close resources
+	}
+}

java/ql/test/experimental/query-tests/security/CWE-625/DotRegexServlet.java

@@ -0,0 +1,150 @@
+import java.io.IOException;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.servlet.RequestDispatcher;
+import javax.servlet.ServletException;
+
+public class DotRegexServlet extends HttpServlet {
+	private static final String PROTECTED_PATTERN = "/protected/.*";
+	private static final String CONSTRAINT_PATTERN = "/protected/xyz\\.xml";
+
+	@Override
+	// BAD: A string with line return e.g. `/protected/%0dxyz` can bypass the path check
+	protected void doGet(HttpServletRequest request, HttpServletResponse response)
+			throws ServletException, IOException {
+		String source = request.getPathInfo();
+
+		Pattern p = Pattern.compile(PROTECTED_PATTERN);
+		Matcher m = p.matcher(source);
+
+		if (m.matches()) {
+			// Protected page - check access token and redirect to login page
+			if (!request.getSession().getAttribute("secAttr").equals("secValue")) {
+				response.sendRedirect("/login.html");
+				return;
+			} else {
+				// Not protected page - render content
+			}
+		}
+	}
+
+	// GOOD: A string with line return e.g. `/protected/%0dxyz` cannot bypass the path check
+	protected void doGet2(HttpServletRequest request, HttpServletResponse response)
+			throws ServletException, IOException {
+		String source = request.getPathInfo();
+
+		Pattern p = Pattern.compile(PROTECTED_PATTERN, Pattern.DOTALL);
+		Matcher m = p.matcher(source);
+
+		if (m.matches()) {
+			// Protected page - check access token and redirect to login page
+			if (!request.getSession().getAttribute("secAttr").equals("secValue")) {
+				response.sendRedirect("/login.html");
+				return;
+			} else {
+				// Not protected page - render content
+			}
+		}
+	}
+
+	// BAD: A string with line return e.g. `/protected/%0axyz` can bypass the path check
+	protected void doGet3(HttpServletRequest request, HttpServletResponse response)
+			throws ServletException, IOException {
+		String source = request.getRequestURI();
+
+		boolean matches = source.matches(PROTECTED_PATTERN);
+
+		if (matches) {
+			// Protected page - check access token and redirect to login page
+			if (!request.getSession().getAttribute("secAttr").equals("secValue")) {
+				response.sendRedirect("/login.html");
+				return;
+			} else {
+				// Not protected page - render content
+			}
+		}
+	}
+
+	// BAD: A string with line return e.g. `/protected/%0axyz` can bypass the path check
+	protected void doGet4(HttpServletRequest request, HttpServletResponse response)
+			throws ServletException, IOException {
+		String source = request.getPathInfo();
+
+		boolean matches = Pattern.matches(PROTECTED_PATTERN, source);
+
+		if (matches) {
+			// Protected page - check access token and redirect to login page
+			if (!request.getSession().getAttribute("secAttr").equals("secValue")) {
+				response.sendRedirect("/login.html");
+				return;
+			} else {
+				// Not protected page - render content
+			}
+		}
+	}
+
+	// GOOD: Only a specific path can pass the validation
+	protected void doGet5(HttpServletRequest request, HttpServletResponse response)
+			throws ServletException, IOException {
+		String source = request.getPathInfo();
+
+		Pattern p = Pattern.compile(CONSTRAINT_PATTERN);
+		Matcher m = p.matcher(source);
+
+		if (m.matches()) {
+			// Protected page - check access token and redirect to login page
+			if (!request.getSession().getAttribute("secAttr").equals("secValue")) {
+				response.sendRedirect("/login.html");
+				return;
+			} else {
+				// Not protected page - render content
+			}
+		}
+	}
+
+	// BAD: A string with line return e.g. `/protected/%0dxyz` can bypass the path check
+	protected void doGet6(HttpServletRequest request, HttpServletResponse response)
+			throws ServletException, IOException {
+		String source = request.getPathInfo();
+
+		Pattern p = Pattern.compile(PROTECTED_PATTERN);
+		Matcher m = p.matcher(source);
+
+		if (m.matches()) {
+			// Protected page - check access token and redirect to login page
+			if (!request.getSession().getAttribute("secAttr").equals("secValue")) {
+				RequestDispatcher dispatcher = getServletContext().getRequestDispatcher("/login");
+				dispatcher.forward(request, response);
+			} else {
+				// Not protected page - render content
+				RequestDispatcher dispatcher = getServletContext().getRequestDispatcher(source);
+				dispatcher.forward(request, response);
+			}
+		}
+	}
+
+	// GOOD: A string with line return e.g. `/protected/%0dxyz` cannot bypass the path check
+	protected void doGet7(HttpServletRequest request, HttpServletResponse response)
+			throws ServletException, IOException {
+		String source = request.getPathInfo();
+
+		Pattern p = Pattern.compile(PROTECTED_PATTERN, Pattern.DOTALL);
+		Matcher m = p.matcher(source);
+
+		if (m.matches()) {
+			// Protected page - check access token and redirect to login page
+			if (!request.getSession().getAttribute("secAttr").equals("secValue")) {
+				RequestDispatcher dispatcher = getServletContext().getRequestDispatcher("/login");
+				dispatcher.forward(request, response);
+			} else {
+				// Not protected page - render content
+				RequestDispatcher dispatcher = getServletContext().getRequestDispatcher(source);
+				dispatcher.include(request, response);
+			}
+		}
+	}
+}

java/ql/test/experimental/query-tests/security/CWE-625/DotRegexSpring.java

@@ -0,0 +1,75 @@
+import org.springframework.stereotype.Controller;
+import org.springframework.ui.Model;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.servlet.view.RedirectView;
+
+import java.io.UnsupportedEncodingException;
+import java.net.URLDecoder;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+@Controller
+public class DotRegexSpring {
+	private static final String PROTECTED_PATTERN = "/protected/.*";
+	private static final String CONSTRAINT_PATTERN = "/protected/xyz\\.xml";
+	
+	@GetMapping("param")
+	// BAD: A string with line return e.g. `/protected/%0dxyz` can bypass the path check
+	public String withParam(@RequestParam String path, Model model) throws UnsupportedEncodingException {
+		Pattern p = Pattern.compile(PROTECTED_PATTERN);
+		path = decodePath(path);
+		Matcher m = p.matcher(path);
+
+		if (m.matches()) {
+			// Protected page - check access token and redirect to login page
+			if (model.getAttribute("secAttr") == null || !model.getAttribute("secAttr").equals("secValue")) {
+				return "redirect:login";
+			}
+		}
+		// Not protected page - render content
+		return path;
+	}
+
+	@GetMapping("{path}")
+	// BAD: A string with line return e.g. `%252Fprotected%252F%250dxyz` can bypass the path check
+	public RedirectView withPathVariable1(@PathVariable String path, Model model) throws UnsupportedEncodingException {
+		Pattern p = Pattern.compile(PROTECTED_PATTERN);
+		path = decodePath(path);
+		Matcher m = p.matcher(path);
+
+		if (m.matches()) {
+			// Protected page - check access token and redirect to login page
+			if (model.getAttribute("secAttr") == null || !model.getAttribute("secAttr").equals("secValue")) {
+				RedirectView redirectView = new RedirectView("login", true);
+				return redirectView;
+			}
+		}
+		return null;
+	}
+	
+	@GetMapping("/sp/{path}")
+	// GOOD: A string with line return e.g. `%252Fprotected%252F%250dxyz` cannot bypass the path check
+	public String withPathVariable2(@PathVariable String path, Model model) throws UnsupportedEncodingException {
+		Pattern p = Pattern.compile(CONSTRAINT_PATTERN);
+		path = decodePath(path);
+		Matcher m = p.matcher(path);
+
+		if (m.matches()) {
+			// Protected page - check access token and redirect to login page
+			if (model.getAttribute("secAttr") == null || !model.getAttribute("secAttr").equals("secValue")) {
+				return "redirect:login";
+			}	
+		}
+		// Not protected page - render content
+		return path;
+	}
+
+	private String decodePath(String path) throws UnsupportedEncodingException {
+		while (path.indexOf("%") > -1) {
+			path = URLDecoder.decode(path, "UTF-8");
+		}
+		return path;
+	}
+}

java/ql/test/experimental/query-tests/security/CWE-625/PermissiveDotRegex.expected

@@ -0,0 +1,53 @@
+edges
+| DotRegexFilter.java:29:19:29:43 | getPathInfo(...) : String | DotRegexFilter.java:32:25:32:30 | source |
+| DotRegexServlet.java:19:19:19:39 | getPathInfo(...) : String | DotRegexServlet.java:22:25:22:30 | source |
+| DotRegexServlet.java:57:19:57:41 | getRequestURI(...) : String | DotRegexServlet.java:59:21:59:26 | source |
+| DotRegexServlet.java:75:19:75:39 | getPathInfo(...) : String | DotRegexServlet.java:77:56:77:61 | source |
+| DotRegexServlet.java:112:19:112:39 | getPathInfo(...) : String | DotRegexServlet.java:115:25:115:30 | source |
+| DotRegexSpring.java:20:26:20:50 | path : String | DotRegexSpring.java:22:21:22:24 | path : String |
+| DotRegexSpring.java:22:10:22:25 | decodePath(...) : String | DotRegexSpring.java:23:25:23:28 | path |
+| DotRegexSpring.java:22:21:22:24 | path : String | DotRegexSpring.java:22:10:22:25 | decodePath(...) : String |
+| DotRegexSpring.java:22:21:22:24 | path : String | DotRegexSpring.java:69:28:69:38 | path : String |
+| DotRegexSpring.java:37:40:37:64 | path : String | DotRegexSpring.java:39:21:39:24 | path : String |
+| DotRegexSpring.java:39:10:39:25 | decodePath(...) : String | DotRegexSpring.java:40:25:40:28 | path |
+| DotRegexSpring.java:39:21:39:24 | path : String | DotRegexSpring.java:39:10:39:25 | decodePath(...) : String |
+| DotRegexSpring.java:39:21:39:24 | path : String | DotRegexSpring.java:69:28:69:38 | path : String |
+| DotRegexSpring.java:69:28:69:38 | path : String | DotRegexSpring.java:71:29:71:32 | path : String |
+| DotRegexSpring.java:69:28:69:38 | path : String | DotRegexSpring.java:73:10:73:13 | path : String |
+| DotRegexSpring.java:71:11:71:42 | decode(...) : String | DotRegexSpring.java:71:29:71:32 | path : String |
+| DotRegexSpring.java:71:11:71:42 | decode(...) : String | DotRegexSpring.java:73:10:73:13 | path : String |
+| DotRegexSpring.java:71:29:71:32 | path : String | DotRegexSpring.java:71:11:71:42 | decode(...) : String |
+nodes
+| DotRegexFilter.java:29:19:29:43 | getPathInfo(...) : String | semmle.label | getPathInfo(...) : String |
+| DotRegexFilter.java:32:25:32:30 | source | semmle.label | source |
+| DotRegexServlet.java:19:19:19:39 | getPathInfo(...) : String | semmle.label | getPathInfo(...) : String |
+| DotRegexServlet.java:22:25:22:30 | source | semmle.label | source |
+| DotRegexServlet.java:57:19:57:41 | getRequestURI(...) : String | semmle.label | getRequestURI(...) : String |
+| DotRegexServlet.java:59:21:59:26 | source | semmle.label | source |
+| DotRegexServlet.java:75:19:75:39 | getPathInfo(...) : String | semmle.label | getPathInfo(...) : String |
+| DotRegexServlet.java:77:56:77:61 | source | semmle.label | source |
+| DotRegexServlet.java:112:19:112:39 | getPathInfo(...) : String | semmle.label | getPathInfo(...) : String |
+| DotRegexServlet.java:115:25:115:30 | source | semmle.label | source |
+| DotRegexSpring.java:20:26:20:50 | path : String | semmle.label | path : String |
+| DotRegexSpring.java:22:10:22:25 | decodePath(...) : String | semmle.label | decodePath(...) : String |
+| DotRegexSpring.java:22:21:22:24 | path : String | semmle.label | path : String |
+| DotRegexSpring.java:23:25:23:28 | path | semmle.label | path |
+| DotRegexSpring.java:37:40:37:64 | path : String | semmle.label | path : String |
+| DotRegexSpring.java:39:10:39:25 | decodePath(...) : String | semmle.label | decodePath(...) : String |
+| DotRegexSpring.java:39:21:39:24 | path : String | semmle.label | path : String |
+| DotRegexSpring.java:40:25:40:28 | path | semmle.label | path |
+| DotRegexSpring.java:69:28:69:38 | path : String | semmle.label | path : String |
+| DotRegexSpring.java:71:11:71:42 | decode(...) : String | semmle.label | decode(...) : String |
+| DotRegexSpring.java:71:29:71:32 | path : String | semmle.label | path : String |
+| DotRegexSpring.java:73:10:73:13 | path : String | semmle.label | path : String |
+subpaths
+| DotRegexSpring.java:22:21:22:24 | path : String | DotRegexSpring.java:69:28:69:38 | path : String | DotRegexSpring.java:73:10:73:13 | path : String | DotRegexSpring.java:22:10:22:25 | decodePath(...) : String |
+| DotRegexSpring.java:39:21:39:24 | path : String | DotRegexSpring.java:69:28:69:38 | path : String | DotRegexSpring.java:73:10:73:13 | path : String | DotRegexSpring.java:39:10:39:25 | decodePath(...) : String |
+#select
+| DotRegexFilter.java:32:25:32:30 | source | DotRegexFilter.java:29:19:29:43 | getPathInfo(...) : String | DotRegexFilter.java:32:25:32:30 | source | Potentially authentication bypass due to $@. | DotRegexFilter.java:29:19:29:43 | getPathInfo(...) | user-provided value |
+| DotRegexServlet.java:22:25:22:30 | source | DotRegexServlet.java:19:19:19:39 | getPathInfo(...) : String | DotRegexServlet.java:22:25:22:30 | source | Potentially authentication bypass due to $@. | DotRegexServlet.java:19:19:19:39 | getPathInfo(...) | user-provided value |
+| DotRegexServlet.java:59:21:59:26 | source | DotRegexServlet.java:57:19:57:41 | getRequestURI(...) : String | DotRegexServlet.java:59:21:59:26 | source | Potentially authentication bypass due to $@. | DotRegexServlet.java:57:19:57:41 | getRequestURI(...) | user-provided value |
+| DotRegexServlet.java:77:56:77:61 | source | DotRegexServlet.java:75:19:75:39 | getPathInfo(...) : String | DotRegexServlet.java:77:56:77:61 | source | Potentially authentication bypass due to $@. | DotRegexServlet.java:75:19:75:39 | getPathInfo(...) | user-provided value |
+| DotRegexServlet.java:115:25:115:30 | source | DotRegexServlet.java:112:19:112:39 | getPathInfo(...) : String | DotRegexServlet.java:115:25:115:30 | source | Potentially authentication bypass due to $@. | DotRegexServlet.java:112:19:112:39 | getPathInfo(...) | user-provided value |
+| DotRegexSpring.java:23:25:23:28 | path | DotRegexSpring.java:20:26:20:50 | path : String | DotRegexSpring.java:23:25:23:28 | path | Potentially authentication bypass due to $@. | DotRegexSpring.java:20:26:20:50 | path | user-provided value |
+| DotRegexSpring.java:40:25:40:28 | path | DotRegexSpring.java:37:40:37:64 | path : String | DotRegexSpring.java:40:25:40:28 | path | Potentially authentication bypass due to $@. | DotRegexSpring.java:37:40:37:64 | path | user-provided value |

java/ql/test/experimental/query-tests/security/CWE-625/PermissiveDotRegex.qlref

@@ -0,0 +1 @@
+experimental/Security/CWE/CWE-625/PermissiveDotRegex.ql

java/ql/test/experimental/query-tests/security/CWE-625/options

@@ -0,0 +1 @@
+//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/servlet-api-2.4:${testdir}/../../../../stubs/springframework-5.3.8

java/ql/test/kotlin/library-tests/comments/comments.expected

@@ -9,6 +9,7 @@ comments
 | comments.kt:37:5:37:23 | /** This is high */ | /** This is high */ |
 | comments.kt:42:5:44:6 | /**\n     * A variable.\n    */ | /**\n     * A variable.\n    */ |
 | comments.kt:48:1:50:3 | /**\n * A type alias comment\n */ | /**\n * A type alias comment\n */ |
+| comments.kt:54:5:56:7 | /**\n     * An init block comment\n     */ | /**\n     * An init block comment\n     */ |
 commentOwners
 | comments.kt:4:1:11:3 | /**\n * A group of *members*.\n *\n * This class has no useful logic; it's just a documentation example.\n *\n * @property name the name of this group.\n * @constructor Creates an empty group.\n */ | comments.kt:12:1:31:1 | Group |
 | comments.kt:4:1:11:3 | /**\n * A group of *members*.\n *\n * This class has no useful logic; it's just a documentation example.\n *\n * @property name the name of this group.\n * @constructor Creates an empty group.\n */ | comments.kt:12:1:31:1 | Group |
@@ -20,6 +21,7 @@ commentOwners
 | comments.kt:37:5:37:23 | /** This is high */ | comments.kt:38:5:38:11 | High |
 | comments.kt:42:5:44:6 | /**\n     * A variable.\n    */ | comments.kt:45:5:45:13 | int a |
 | comments.kt:48:1:50:3 | /**\n * A type alias comment\n */ | comments.kt:51:1:51:24 | MyType |
+| comments.kt:54:5:56:7 | /**\n     * An init block comment\n     */ | comments.kt:53:1:58:1 | InitBlock |
 commentSections
 | comments.kt:1:1:1:25 | /** Kdoc with no owner */ | Kdoc with no owner |
 | comments.kt:4:1:11:3 | /**\n * A group of *members*.\n *\n * This class has no useful logic; it's just a documentation example.\n *\n * @property name the name of this group.\n * @constructor Creates an empty group.\n */ | A group of *members*.\n\nThis class has no useful logic; it's just a documentation example.\n\n |
@@ -31,11 +33,13 @@ commentSections
 | comments.kt:37:5:37:23 | /** This is high */ | This is high |
 | comments.kt:42:5:44:6 | /**\n     * A variable.\n    */ | A variable. |
 | comments.kt:48:1:50:3 | /**\n * A type alias comment\n */ | A type alias comment |
+| comments.kt:54:5:56:7 | /**\n     * An init block comment\n     */ | An init block comment |
 commentSectionContents
 | A group of *members*.\n\nThis class has no useful logic; it's just a documentation example.\n\n | A group of *members*.\n\nThis class has no useful logic; it's just a documentation example.\n\n |
 | A type alias comment | A type alias comment |
 | A variable. | A variable. |
 | Adds a [member] to this group.\n | Adds a [member] to this group.\n |
+| An init block comment | An init block comment |
 | Creates an empty group. | Creates an empty group. |
 | Kdoc with no owner | Kdoc with no owner |
 | Medium is in the middle | Medium is in the middle |

java/ql/test/kotlin/library-tests/comments/comments.kt

@@ -49,3 +49,10 @@ fun fn1() {
  * A type alias comment
  */
 typealias MyType = Group
+
+class InitBlock {
+    /**
+     * An init block comment
+     */
+    init { }
+}

java/ql/test/library-tests/dataflow/external-models/negativesummaries.ql

@@ -0,0 +1,8 @@
+/**
+ * CSV Validation of negative summaries.
+ */
+
+import java
+import semmle.code.java.dataflow.ExternalFlow
+import CsvValidation
+import semmle.code.java.dataflow.internal.NegativeSummary

java/ql/test/library-tests/dataflow/taint/B.java

@@ -41,7 +41,7 @@ public class B {
     String valueOfSubstring = String.valueOf(complex.toCharArray(), 0, 1);
     sink(valueOfSubstring);
     // tainted - unsafe escape
-    String badEscape = constructed.replaceAll("(<script>)", "");
+    String badEscape = constructed.replaceAll("irrelevant", "irrelevant");
     sink(badEscape);
     // tainted - tokenized string
     String token = new StringTokenizer(badEscape).nextToken();
@@ -189,4 +189,32 @@ public class B {
   public static boolean safe() {
     return true;
   }
+
+  public static void extendedTests(){
+    String s = taint()[0];
+
+    String replReceiver = s.replace("irrelevant", "irrelevant");
+    sink(replReceiver);
+
+    String replChar = "a".replace('a', s.charAt(0));
+    sink(replChar);
+
+    String replCharReceiver = s.replace('a', 'b');
+    sink(replCharReceiver);
+
+    String charAt = "";
+    for(int i = 0; i < 10; i++)
+        charAt = charAt + s.charAt(i);
+    sink(charAt);
+
+    byte[] bytes = new byte[10];
+    s.getBytes(0, 1, bytes, 0);
+    sink(bytes);
+
+    String replAll = s.replaceAll("irrelevant", "irrelevant");
+    sink(replAll);
+
+    String replFirst = s.replaceFirst("irrelevant", "irrelevant");
+    sink(replFirst);
+  }
 }

java/ql/test/library-tests/dataflow/taint/test.expected

@@ -43,6 +43,13 @@
 | B.java:15:21:15:27 | taint(...) | B.java:157:10:157:46 | toFile(...) |
 | B.java:15:21:15:27 | taint(...) | B.java:160:10:160:46 | getAbsoluteFile(...) |
 | B.java:15:21:15:27 | taint(...) | B.java:163:10:163:47 | getCanonicalFile(...) |
+| B.java:194:16:194:22 | taint(...) | B.java:197:10:197:21 | replReceiver |
+| B.java:194:16:194:22 | taint(...) | B.java:200:10:200:17 | replChar |
+| B.java:194:16:194:22 | taint(...) | B.java:203:10:203:25 | replCharReceiver |
+| B.java:194:16:194:22 | taint(...) | B.java:208:10:208:15 | charAt |
+| B.java:194:16:194:22 | taint(...) | B.java:212:10:212:14 | bytes |
+| B.java:194:16:194:22 | taint(...) | B.java:215:10:215:16 | replAll |
+| B.java:194:16:194:22 | taint(...) | B.java:218:10:218:18 | replFirst |
 | CharSeq.java:7:26:7:32 | taint(...) | CharSeq.java:8:12:8:14 | seq |
 | CharSeq.java:7:26:7:32 | taint(...) | CharSeq.java:11:12:11:21 | seqFromSeq |
 | CharSeq.java:7:26:7:32 | taint(...) | CharSeq.java:14:12:14:24 | stringFromSeq |

java/ql/test/query-tests/security/CWE-089/semmle/examples/taintedString.expected

@@ -64,5 +64,7 @@
 | Test.java:213:21:213:24 | main | 5 | Test.java:218:14:218:17 | args |
 | Validation.java:6:21:6:35 | checkIdentifier | 1 | Validation.java:7:23:7:24 | id |
 | Validation.java:6:21:6:35 | checkIdentifier | 2 | Validation.java:8:13:8:14 | id |
+| Validation.java:6:21:6:35 | checkIdentifier | 2 | Validation.java:8:13:8:24 | charAt(...) |
+| Validation.java:6:21:6:35 | checkIdentifier | 3 | Validation.java:9:28:9:28 | c |
 | Validation.java:6:21:6:35 | checkIdentifier | 4 | Validation.java:10:32:10:58 | ... + ... |
 | Validation.java:6:21:6:35 | checkIdentifier | 4 | Validation.java:10:57:10:58 | id |