Swift: Remove workaround for LWG/issue3657.

.bazelrc

@@ -1,9 +1,3 @@
-common --enable_platform_specific_config
-
-build --repo_env=CC=clang --repo_env=CXX=clang++
-
-build:linux --cxxopt=-std=c++20
-build:macos --cxxopt=-std=c++20 --cpu=darwin_x86_64
-build:windows --cxxopt=/std:c++20 --cxxopt=/Zc:preprocessor
+build --repo_env=CC=clang --repo_env=CXX=clang++ --cxxopt="-std=c++20"
 
 try-import %workspace%/local.bazelrc

config/identical-files.json

@@ -523,10 +523,6 @@
     "python/ql/lib/semmle/python/dataflow/new/internal/TypeTracker.qll",
     "ruby/ql/lib/codeql/ruby/typetracking/TypeTracker.qll"
   ],
-  "SummaryTypeTracker": [
-    "python/ql/lib/semmle/python/dataflow/new/internal/SummaryTypeTracker.qll",
-    "ruby/ql/lib/codeql/ruby/typetracking/internal/SummaryTypeTracker.qll"
-  ],
   "AccessPathSyntax": [
     "csharp/ql/lib/semmle/code/csharp/dataflow/internal/AccessPathSyntax.qll",
     "go/ql/lib/semmle/go/dataflow/internal/AccessPathSyntax.qll",

cpp/ql/lib/CHANGELOG.md

@@ -1,11 +1,3 @@
-## 0.7.3
-
-### Minor Analysis Improvements
-
-* Deleted the deprecated `hasCopyConstructor` predicate from the `Class` class in `Class.qll`.
-* Deleted many deprecated predicates and classes with uppercase `AST`, `SSA`, `CFG`, `API`, etc. in their names. Use the PascalCased versions instead.
-* Deleted the deprecated `CodeDuplication.qll` file.
-
 ## 0.7.2
 
 ### New Features

cpp/ql/lib/change-notes/2022-08-06-delete-deps.md

@@ -1,7 +1,6 @@
-## 0.7.3
-
-### Minor Analysis Improvements
-
+---
+category: minorAnalysis
+---
 * Deleted the deprecated `hasCopyConstructor` predicate from the `Class` class in `Class.qll`.
 * Deleted many deprecated predicates and classes with uppercase `AST`, `SSA`, `CFG`, `API`, etc. in their names. Use the PascalCased versions instead.
-* Deleted the deprecated `CodeDuplication.qll` file.
+* Deleted the deprecated `CodeDuplication.qll` file.

cpp/ql/lib/change-notes/2023-06-19-delete-container-url.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Deleted the deprecated `getURL` predicate from the `Container`, `Folder`, and `File` classes. Use the `getLocation` predicate instead.

cpp/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.7.3
+lastReleaseVersion: 0.7.2

cpp/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cpp-all
-version: 0.7.4-dev
+version: 0.7.3-dev
 groups: cpp
 dbscheme: semmlecode.cpp.dbscheme
 extractor: cpp

cpp/ql/lib/semmle/code/cpp/File.qll

@@ -34,6 +34,14 @@ class Container extends Locatable, @container {
    */
   string getAbsolutePath() { none() } // overridden by subclasses
 
+  /**
+   * DEPRECATED: Use `getLocation` instead.
+   * Gets a URL representing the location of this container.
+   *
+   * For more information see [Providing URLs](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/#providing-urls).
+   */
+  deprecated string getURL() { none() } // overridden by subclasses
+
   /**
    * Gets the relative path of this file or folder from the root folder of the
    * analyzed source location. The relative path of the root folder itself is
@@ -175,6 +183,12 @@ class Folder extends Container, @folder {
   }
 
   override string getAPrimaryQlClass() { result = "Folder" }
+
+  /**
+   * DEPRECATED: Use `getLocation` instead.
+   * Gets the URL of this folder.
+   */
+  deprecated override string getURL() { result = "file://" + this.getAbsolutePath() + ":0:0:0:0" }
 }
 
 /**
@@ -199,6 +213,12 @@ class File extends Container, @file {
     result.hasLocationInfo(_, 0, 0, 0, 0)
   }
 
+  /**
+   * DEPRECATED: Use `getLocation` instead.
+   * Gets the URL of this file.
+   */
+  deprecated override string getURL() { result = "file://" + this.getAbsolutePath() + ":0:0:0:0" }
+
   /** Holds if this file was compiled as C (at any point). */
   predicate compiledAsC() { fileannotations(underlyingElement(this), 1, "compiled as c", "1") }
 

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll

@@ -2021,8 +2021,7 @@ module Impl<FullStateConfigSig Config> {
       FlowCheckNode() {
         castNode(this.asNode()) or
         clearsContentCached(this.asNode(), _) or
-        expectsContentCached(this.asNode(), _) or
-        neverSkipInPathGraph(this.asNode())
+        expectsContentCached(this.asNode(), _)
       }
     }
 

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowPrivate.qll

@@ -235,12 +235,6 @@ class CastNode extends Node {
   CastNode() { none() } // stub implementation
 }
 
-/**
- * Holds if `n` should never be skipped over in the `PathGraph` and in path
- * explanations.
- */
-predicate neverSkipInPathGraph(Node n) { none() }
-
 class DataFlowCallable = Function;
 
 class DataFlowExpr = Expr;

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll

@@ -2021,8 +2021,7 @@ module Impl<FullStateConfigSig Config> {
       FlowCheckNode() {
         castNode(this.asNode()) or
         clearsContentCached(this.asNode(), _) or
-        expectsContentCached(this.asNode(), _) or
-        neverSkipInPathGraph(this.asNode())
+        expectsContentCached(this.asNode(), _)
       }
     }
 

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll

@@ -193,89 +193,86 @@ private class SingleUseOperandNode0 extends OperandNode0, TSingleUseOperandNode0
   SingleUseOperandNode0() { this = TSingleUseOperandNode0(op) }
 }
 
-private module IndirectOperands {
+/**
+ * INTERNAL: Do not use.
+ *
+ * A node that represents the indirect value of an operand in the IR
+ * after `index` number of loads.
+ *
+ * Note: Unlike `RawIndirectOperand`, a value of type `IndirectOperand` may
+ * be an `OperandNode`.
+ */
+class IndirectOperand extends Node {
+  Operand operand;
+  int indirectionIndex;
+
+  IndirectOperand() {
+    this.(RawIndirectOperand).getOperand() = operand and
+    this.(RawIndirectOperand).getIndirectionIndex() = indirectionIndex
+    or
+    nodeHasOperand(this, Ssa::getIRRepresentationOfIndirectOperand(operand, indirectionIndex),
+      indirectionIndex - 1)
+  }
+
+  /** Gets the underlying operand. */
+  Operand getOperand() { result = operand }
+
+  /** Gets the underlying indirection index. */
+  int getIndirectionIndex() { result = indirectionIndex }
+
   /**
-   * INTERNAL: Do not use.
-   *
-   * A node that represents the indirect value of an operand in the IR
-   * after `index` number of loads.
-   *
-   * Note: Unlike `RawIndirectOperand`, a value of type `IndirectOperand` may
-   * be an `OperandNode`.
+   * Holds if this `IndirectOperand` is represented directly in the IR instead of
+   * a `RawIndirectionOperand` with operand `op` and indirection index `index`.
    */
-  abstract class IndirectOperand extends Node {
-    /** Gets the underlying operand and the underlying indirection index. */
-    abstract predicate hasOperandAndIndirectionIndex(Operand operand, int indirectionIndex);
-  }
-
-  private class IndirectOperandFromRaw extends IndirectOperand instanceof RawIndirectOperand {
-    override predicate hasOperandAndIndirectionIndex(Operand operand, int indirectionIndex) {
-      operand = RawIndirectOperand.super.getOperand() and
-      indirectionIndex = RawIndirectOperand.super.getIndirectionIndex()
-    }
-  }
-
-  private class IndirectOperandFromIRRepr extends IndirectOperand {
-    Operand operand;
-    int indirectionIndex;
-
-    IndirectOperandFromIRRepr() {
-      exists(Operand repr |
-        repr = Ssa::getIRRepresentationOfIndirectOperand(operand, indirectionIndex) and
-        nodeHasOperand(this, repr, indirectionIndex - 1)
-      )
-    }
-
-    override predicate hasOperandAndIndirectionIndex(Operand op, int index) {
-      op = operand and index = indirectionIndex
-    }
+  predicate isIRRepresentationOf(Operand op, int index) {
+    this instanceof OperandNode and
+    (
+      op = operand and
+      index = indirectionIndex
+    )
   }
 }
 
-import IndirectOperands
+/**
+ * INTERNAL: Do not use.
+ *
+ * A node that represents the indirect value of an instruction in the IR
+ * after `index` number of loads.
+ *
+ * Note: Unlike `RawIndirectInstruction`, a value of type `IndirectInstruction` may
+ * be an `InstructionNode`.
+ */
+class IndirectInstruction extends Node {
+  Instruction instr;
+  int indirectionIndex;
+
+  IndirectInstruction() {
+    this.(RawIndirectInstruction).getInstruction() = instr and
+    this.(RawIndirectInstruction).getIndirectionIndex() = indirectionIndex
+    or
+    nodeHasInstruction(this, Ssa::getIRRepresentationOfIndirectInstruction(instr, indirectionIndex),
+      indirectionIndex - 1)
+  }
+
+  /** Gets the underlying instruction. */
+  Instruction getInstruction() { result = instr }
+
+  /** Gets the underlying indirection index. */
+  int getIndirectionIndex() { result = indirectionIndex }
 
-private module IndirectInstructions {
   /**
-   * INTERNAL: Do not use.
-   *
-   * A node that represents the indirect value of an instruction in the IR
-   * after `index` number of loads.
-   *
-   * Note: Unlike `RawIndirectInstruction`, a value of type `IndirectInstruction` may
-   * be an `InstructionNode`.
+   * Holds if this `IndirectInstruction` is represented directly in the IR instead of
+   * a `RawIndirectionInstruction` with instruction `i` and indirection index `index`.
    */
-  abstract class IndirectInstruction extends Node {
-    /** Gets the underlying operand and the underlying indirection index. */
-    abstract predicate hasInstructionAndIndirectionIndex(Instruction instr, int index);
-  }
-
-  private class IndirectInstructionFromRaw extends IndirectInstruction instanceof RawIndirectInstruction
-  {
-    override predicate hasInstructionAndIndirectionIndex(Instruction instr, int index) {
-      instr = RawIndirectInstruction.super.getInstruction() and
-      index = RawIndirectInstruction.super.getIndirectionIndex()
-    }
-  }
-
-  private class IndirectInstructionFromIRRepr extends IndirectInstruction {
-    Instruction instr;
-    int indirectionIndex;
-
-    IndirectInstructionFromIRRepr() {
-      exists(Instruction repr |
-        repr = Ssa::getIRRepresentationOfIndirectInstruction(instr, indirectionIndex) and
-        nodeHasInstruction(this, repr, indirectionIndex - 1)
-      )
-    }
-
-    override predicate hasInstructionAndIndirectionIndex(Instruction i, int index) {
-      i = instr and index = indirectionIndex
-    }
+  predicate isIRRepresentationOf(Instruction i, int index) {
+    this instanceof InstructionNode and
+    (
+      i = instr and
+      index = indirectionIndex
+    )
   }
 }
 
-import IndirectInstructions
-
 /** Gets the callable in which this node occurs. */
 DataFlowCallable nodeGetEnclosingCallable(Node n) { result = n.getEnclosingCallable() }
 
@@ -323,7 +320,7 @@ private class SideEffectArgumentNode extends ArgumentNode, SideEffectOperandNode
   override predicate argumentOf(DataFlowCall dfCall, ArgumentPosition pos) {
     this.getCallInstruction() = dfCall and
     pos.(IndirectionPosition).getArgumentIndex() = this.getArgumentIndex() and
-    super.hasAddressOperandAndIndirectionIndex(_, pos.(IndirectionPosition).getIndirectionIndex())
+    pos.(IndirectionPosition).getIndirectionIndex() = super.getIndirectionIndex()
   }
 }
 
@@ -786,12 +783,6 @@ class CastNode extends Node {
   CastNode() { none() } // stub implementation
 }
 
-/**
- * Holds if `n` should never be skipped over in the `PathGraph` and in path
- * explanations.
- */
-predicate neverSkipInPathGraph(Node n) { none() }
-
 /**
  * A function that may contain code or a variable that may contain itself. When
  * flow crosses from one _enclosing callable_ to another, the interprocedural
@@ -848,7 +839,7 @@ predicate additionalLambdaFlowStep(Node nodeFrom, Node nodeTo, boolean preserves
  * One example would be to allow flow like `p.foo = p.bar;`, which is disallowed
  * by default as a heuristic.
  */
-predicate allowParameterReturnInSelf(ParameterNode p) { p instanceof IndirectParameterNode }
+predicate allowParameterReturnInSelf(ParameterNode p) { none() }
 
 private predicate fieldHasApproxName(Field f, string s) {
   s = f.getName().charAt(0) and

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll

@@ -274,7 +274,7 @@ class Node extends TIRDataFlowNode {
    * represents the value of `**x` going into `f`.
    */
   Expr asIndirectArgument(int index) {
-    this.(SideEffectOperandNode).hasAddressOperandAndIndirectionIndex(_, index) and
+    this.(SideEffectOperandNode).getIndirectionIndex() = index and
     result = this.(SideEffectOperandNode).getArgument()
   }
 
@@ -317,7 +317,7 @@ class Node extends TIRDataFlowNode {
     index = 0 and
     result = this.(ExplicitParameterNode).getParameter()
     or
-    this.(IndirectParameterNode).hasInstructionAndIndirectionIndex(_, index) and
+    this.(IndirectParameterNode).getIndirectionIndex() = index and
     result = this.(IndirectParameterNode).getParameter()
   }
 
@@ -577,20 +577,15 @@ class SsaPhiNode extends Node, TSsaPhiNode {
  *
  * A node representing a value after leaving a function.
  */
-class SideEffectOperandNode extends Node instanceof IndirectOperand {
+class SideEffectOperandNode extends Node, IndirectOperand {
   CallInstruction call;
   int argumentIndex;
 
-  SideEffectOperandNode() {
-    IndirectOperand.super.hasOperandAndIndirectionIndex(call.getArgumentOperand(argumentIndex), _)
-  }
+  SideEffectOperandNode() { operand = call.getArgumentOperand(argumentIndex) }
 
   CallInstruction getCallInstruction() { result = call }
 
-  /** Gets the underlying operand and the underlying indirection index. */
-  predicate hasAddressOperandAndIndirectionIndex(Operand operand, int indirectionIndex) {
-    IndirectOperand.super.hasOperandAndIndirectionIndex(operand, indirectionIndex)
-  }
+  Operand getAddressOperand() { result = operand }
 
   int getArgumentIndex() { result = argumentIndex }
 
@@ -670,10 +665,10 @@ class InitialGlobalValue extends Node, TInitialGlobalValue {
  *
  * A node representing an indirection of a parameter.
  */
-class IndirectParameterNode extends Node instanceof IndirectInstruction {
+class IndirectParameterNode extends Node, IndirectInstruction {
   InitializeParameterInstruction init;
 
-  IndirectParameterNode() { IndirectInstruction.super.hasInstructionAndIndirectionIndex(init, _) }
+  IndirectParameterNode() { this.getInstruction() = init }
 
   int getArgumentIndex() { init.hasIndex(result) }
 
@@ -682,12 +677,7 @@ class IndirectParameterNode extends Node instanceof IndirectInstruction {
 
   override Declaration getEnclosingCallable() { result = this.getFunction() }
 
-  override Declaration getFunction() { result = init.getEnclosingFunction() }
-
-  /** Gets the underlying operand and the underlying indirection index. */
-  predicate hasInstructionAndIndirectionIndex(Instruction instr, int index) {
-    IndirectInstruction.super.hasInstructionAndIndirectionIndex(instr, index)
-  }
+  override Declaration getFunction() { result = this.getInstruction().getEnclosingFunction() }
 
   override Location getLocationImpl() { result = this.getParameter().getLocation() }
 
@@ -709,8 +699,7 @@ class IndirectReturnNode extends Node {
   IndirectReturnNode() {
     this instanceof FinalParameterNode
     or
-    this.(IndirectOperand)
-        .hasOperandAndIndirectionIndex(any(ReturnValueInstruction ret).getReturnAddressOperand(), _)
+    this.(IndirectOperand).getOperand() = any(ReturnValueInstruction ret).getReturnAddressOperand()
   }
 
   override Declaration getEnclosingCallable() { result = this.getFunction() }
@@ -733,7 +722,7 @@ class IndirectReturnNode extends Node {
   int getIndirectionIndex() {
     result = this.(FinalParameterNode).getIndirectionIndex()
     or
-    this.(IndirectOperand).hasOperandAndIndirectionIndex(_, result)
+    result = this.(IndirectOperand).getIndirectionIndex()
   }
 }
 
@@ -1117,8 +1106,7 @@ predicate exprNodeShouldBeInstruction(Node node, Expr e) {
 /** Holds if `node` should be an `IndirectInstruction` that maps `node.asIndirectExpr()` to `e`. */
 predicate indirectExprNodeShouldBeIndirectInstruction(IndirectInstruction node, Expr e) {
   exists(Instruction instr |
-    node.hasInstructionAndIndirectionIndex(instr, _) and
-    not indirectExprNodeShouldBeIndirectOperand(_, e)
+    instr = node.getInstruction() and not indirectExprNodeShouldBeIndirectOperand(_, e)
   |
     e = instr.(VariableAddressInstruction).getAst().(Expr).getFullyConverted()
     or
@@ -1319,8 +1307,8 @@ pragma[noinline]
 private predicate indirectParameterNodeHasArgumentIndexAndIndex(
   IndirectParameterNode node, int argumentIndex, int indirectionIndex
 ) {
-  node.hasInstructionAndIndirectionIndex(_, indirectionIndex) and
-  node.getArgumentIndex() = argumentIndex
+  node.getArgumentIndex() = argumentIndex and
+  node.getIndirectionIndex() = indirectionIndex
 }
 
 /** A synthetic parameter to model the pointed-to object of a pointer parameter. */
@@ -1491,14 +1479,18 @@ VariableNode variableNode(Variable v) {
  */
 Node uninitializedNode(LocalVariable v) { none() }
 
+pragma[noinline]
 predicate hasOperandAndIndex(IndirectOperand indirectOperand, Operand operand, int indirectionIndex) {
-  indirectOperand.hasOperandAndIndirectionIndex(operand, indirectionIndex)
+  indirectOperand.getOperand() = operand and
+  indirectOperand.getIndirectionIndex() = indirectionIndex
 }
 
+pragma[noinline]
 predicate hasInstructionAndIndex(
   IndirectInstruction indirectInstr, Instruction instr, int indirectionIndex
 ) {
-  indirectInstr.hasInstructionAndIndirectionIndex(instr, indirectionIndex)
+  indirectInstr.getInstruction() = instr and
+  indirectInstr.getIndirectionIndex() = indirectionIndex
 }
 
 cached
@@ -1664,7 +1656,8 @@ module ExprFlowCached {
   private predicate isIndirectBaseOfArrayAccess(IndirectOperand n, Expr e) {
     exists(LoadInstruction load, PointerArithmeticInstruction pai |
       pai = load.getSourceAddress() and
-      n.hasOperandAndIndirectionIndex(pai.getLeftOperand(), 1) and
+      pai.getLeftOperand() = n.getOperand() and
+      n.getIndirectionIndex() = 1 and
       e = load.getConvertedResultExpression()
     )
   }

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/PrintIRFieldFlowSteps.qll

@@ -13,7 +13,7 @@ class FieldFlowPropertyProvider extends IRPropertyProvider {
   override string getOperandProperty(Operand operand, string key) {
     exists(PostFieldUpdateNode pfun, Content content |
       key = "store " + content.toString() and
-      pfun.getPreUpdateNode().(IndirectOperand).hasOperandAndIndirectionIndex(operand, _) and
+      operand = pfun.getPreUpdateNode().(IndirectOperand).getOperand() and
       result =
         strictconcat(string element, Node node |
           storeStep(node, content, pfun) and
@@ -25,7 +25,7 @@ class FieldFlowPropertyProvider extends IRPropertyProvider {
     or
     exists(Node node2, Content content |
       key = "read " + content.toString() and
-      node2.(IndirectOperand).hasOperandAndIndirectionIndex(operand, _) and
+      operand = node2.(IndirectOperand).getOperand() and
       result =
         strictconcat(string element, Node node1 |
           readStep(node1, content, node2) and

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/PrintIRUtilities.qll

@@ -18,12 +18,9 @@ private string stars(int k) {
 }
 
 string starsForNode(Node node) {
-  exists(int indirectionIndex |
-    node.(IndirectInstruction).hasInstructionAndIndirectionIndex(_, indirectionIndex) or
-    node.(IndirectOperand).hasOperandAndIndirectionIndex(_, indirectionIndex)
-  |
-    result = stars(indirectionIndex)
-  )
+  result = stars(node.(IndirectInstruction).getIndirectionIndex())
+  or
+  result = stars(node.(IndirectOperand).getIndirectionIndex())
   or
   not node instanceof IndirectInstruction and
   not node instanceof IndirectOperand and

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternalsCommon.qll

@@ -117,16 +117,6 @@ private int countIndirections(Type t) {
   else (
     result = any(Indirection ind | ind.getType() = t).getNumberOfIndirections()
     or
-    // If there is an indirection for the type, but we cannot count the number of indirections
-    // it means we couldn't reach a non-indirection type by stripping off indirections. This
-    // can occur if an iterator specifies itself as the value type. In this case we default to
-    // 1 indirection fore the type.
-    exists(Indirection ind |
-      ind.getType() = t and
-      not exists(ind.getNumberOfIndirections()) and
-      result = 1
-    )
-    or
     not exists(Indirection ind | ind.getType() = t) and
     result = 0
   )
@@ -273,7 +263,7 @@ private module IteratorIndirections {
         // Taint through `operator+=` and `operator-=` on iterators.
         call.getStaticCallTarget() instanceof Iterator::IteratorAssignArithmeticOperator and
         node2.(IndirectArgumentOutNode).getPreUpdateNode() = node1 and
-        node1.(IndirectOperand).hasOperandAndIndirectionIndex(call.getArgumentOperand(0), _) and
+        node1.(IndirectOperand).getOperand() = call.getArgumentOperand(0) and
         node1.getType().getUnspecifiedType() = this
       )
     }
@@ -806,7 +796,7 @@ private module Cached {
       address.getDef() = instr and
       isDereference(load, address) and
       isUseImpl(address, _, indirectionIndex - 1) and
-      result = load
+      result = instr
     )
   }
 

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/TaintTrackingUtil.qll

@@ -160,7 +160,7 @@ predicate modeledTaintStep(DataFlow::Node nodeIn, DataFlow::Node nodeOut) {
     FunctionInput modelIn, FunctionOutput modelOut
   |
     indirectArgument = callInput(call, modelIn) and
-    indirectArgument.hasAddressOperandAndIndirectionIndex(nodeIn.asOperand(), _) and
+    indirectArgument.getAddressOperand() = nodeIn.asOperand() and
     call.getStaticCallTarget() = func and
     (
       func.(DataFlowFunction).hasDataFlow(modelIn, modelOut)

cpp/ql/lib/semmle/code/cpp/models/implementations/Strcpy.qll

@@ -108,7 +108,7 @@ class StrcpyFunction extends ArrayFunction, DataFlowFunction, TaintFunction, Sid
     // these may do only a partial copy of the input buffer to the output
     // buffer
     exists(this.getParamSize()) and
-    input.isParameterDeref(this.getParamSrc()) and
+    input.isParameter(this.getParamSrc()) and
     (
       output.isParameterDeref(this.getParamDest()) or
       output.isReturnValueDeref()

cpp/ql/src/CHANGELOG.md

@@ -1,9 +1,3 @@
-## 0.6.3
-
-### New Queries
-
-* Added a new query, `cpp/overrun-write`, to detect buffer overflows in C-style functions that manipulate buffers.
-
 ## 0.6.2
 
 No user-facing changes.

cpp/ql/src/Security/CWE/CWE-119/OverrunWriteProductFlow.ql

@@ -5,7 +5,7 @@
  * @kind path-problem
  * @problem.severity error
  * @security-severity 9.3
- * @precision low
+ * @precision medium
  * @id cpp/overrun-write
  * @tags reliability
  *       security

cpp/ql/src/change-notes/2023-05-24-overrun-write-query.md

@@ -1,5 +1,4 @@
-## 0.6.3
-
-### New Queries
-
+---
+category: newQuery
+---
 * Added a new query, `cpp/overrun-write`, to detect buffer overflows in C-style functions that manipulate buffers.

cpp/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.6.3
+lastReleaseVersion: 0.6.2

cpp/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cpp-queries
-version: 0.6.4-dev
+version: 0.6.3-dev
 groups: 
   - cpp
   - queries

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/pointer-deref/InvalidPointerDeref.expected

@@ -748,46 +748,6 @@ edges
 | test.cpp:381:5:381:9 | ... ++ | test.cpp:384:14:384:16 | end |
 | test.cpp:381:5:381:9 | ... ++ | test.cpp:384:14:384:16 | end |
 | test.cpp:384:14:384:16 | end | test.cpp:384:13:384:16 | Load: * ... |
-| test.cpp:388:14:388:27 | new[] | test.cpp:389:16:389:17 | xs |
-| test.cpp:388:14:388:27 | new[] | test.cpp:392:5:392:6 | xs |
-| test.cpp:389:16:389:17 | xs | test.cpp:392:5:392:8 | ... ++ |
-| test.cpp:389:16:389:17 | xs | test.cpp:392:5:392:8 | ... ++ |
-| test.cpp:389:16:389:17 | xs | test.cpp:392:5:392:8 | ... ++ |
-| test.cpp:389:16:389:17 | xs | test.cpp:392:5:392:8 | ... ++ |
-| test.cpp:389:16:389:17 | xs | test.cpp:393:9:393:10 | xs |
-| test.cpp:389:16:389:17 | xs | test.cpp:393:9:393:10 | xs |
-| test.cpp:392:5:392:8 | ... ++ | test.cpp:392:5:392:8 | ... ++ |
-| test.cpp:392:5:392:8 | ... ++ | test.cpp:392:5:392:8 | ... ++ |
-| test.cpp:392:5:392:8 | ... ++ | test.cpp:393:9:393:10 | xs |
-| test.cpp:392:5:392:8 | ... ++ | test.cpp:393:9:393:10 | xs |
-| test.cpp:392:5:392:8 | ... ++ | test.cpp:393:9:393:10 | xs |
-| test.cpp:392:5:392:8 | ... ++ | test.cpp:393:9:393:10 | xs |
-| test.cpp:392:5:392:8 | ... ++ | test.cpp:395:5:395:6 | xs |
-| test.cpp:392:5:392:8 | ... ++ | test.cpp:395:5:395:6 | xs |
-| test.cpp:392:5:392:8 | ... ++ | test.cpp:395:5:395:13 | Store: ... = ... |
-| test.cpp:392:5:392:8 | ... ++ | test.cpp:395:5:395:13 | Store: ... = ... |
-| test.cpp:392:5:392:8 | ... ++ | test.cpp:395:5:395:13 | Store: ... = ... |
-| test.cpp:392:5:392:8 | ... ++ | test.cpp:395:5:395:13 | Store: ... = ... |
-| test.cpp:393:9:393:10 | xs | test.cpp:395:5:395:6 | xs |
-| test.cpp:393:9:393:10 | xs | test.cpp:395:5:395:13 | Store: ... = ... |
-| test.cpp:393:9:393:10 | xs | test.cpp:395:5:395:13 | Store: ... = ... |
-| test.cpp:395:5:395:6 | xs | test.cpp:395:5:395:13 | Store: ... = ... |
-| test.cpp:404:3:404:25 | ... = ... | test.cpp:404:7:404:8 | val indirection [post update] [xs] |
-| test.cpp:404:7:404:8 | val indirection [post update] [xs] | test.cpp:407:3:407:5 | val indirection [xs] |
-| test.cpp:404:12:404:25 | new[] | test.cpp:404:3:404:25 | ... = ... |
-| test.cpp:406:3:406:25 | ... = ... | test.cpp:406:7:406:8 | val indirection [post update] [xs] |
-| test.cpp:406:7:406:8 | val indirection [post update] [xs] | test.cpp:407:3:407:5 | val indirection [xs] |
-| test.cpp:406:12:406:25 | new[] | test.cpp:406:3:406:25 | ... = ... |
-| test.cpp:407:3:407:5 | val indirection [xs] | test.cpp:407:7:407:8 | xs indirection |
-| test.cpp:407:3:407:18 | access to array | test.cpp:407:3:407:22 | Store: ... = ... |
-| test.cpp:407:7:407:8 | xs | test.cpp:407:3:407:18 | access to array |
-| test.cpp:407:7:407:8 | xs indirection | test.cpp:407:7:407:8 | xs |
-| test.cpp:417:16:417:33 | new[] | test.cpp:419:7:419:8 | xs |
-| test.cpp:419:7:419:8 | xs | test.cpp:419:7:419:11 | access to array |
-| test.cpp:419:7:419:11 | access to array | test.cpp:419:7:419:15 | Store: ... = ... |
-| test.cpp:427:14:427:27 | new[] | test.cpp:433:5:433:6 | xs |
-| test.cpp:433:5:433:6 | xs | test.cpp:433:5:433:17 | access to array |
-| test.cpp:433:5:433:17 | access to array | test.cpp:433:5:433:21 | Store: ... = ... |
 nodes
 | test.cpp:4:15:4:20 | call to malloc | semmle.label | call to malloc |
 | test.cpp:5:15:5:15 | p | semmle.label | p |
@@ -1127,36 +1087,6 @@ nodes
 | test.cpp:381:5:381:9 | ... ++ | semmle.label | ... ++ |
 | test.cpp:384:13:384:16 | Load: * ... | semmle.label | Load: * ... |
 | test.cpp:384:14:384:16 | end | semmle.label | end |
-| test.cpp:388:14:388:27 | new[] | semmle.label | new[] |
-| test.cpp:389:16:389:17 | xs | semmle.label | xs |
-| test.cpp:392:5:392:6 | xs | semmle.label | xs |
-| test.cpp:392:5:392:8 | ... ++ | semmle.label | ... ++ |
-| test.cpp:392:5:392:8 | ... ++ | semmle.label | ... ++ |
-| test.cpp:392:5:392:8 | ... ++ | semmle.label | ... ++ |
-| test.cpp:392:5:392:8 | ... ++ | semmle.label | ... ++ |
-| test.cpp:393:9:393:10 | xs | semmle.label | xs |
-| test.cpp:393:9:393:10 | xs | semmle.label | xs |
-| test.cpp:395:5:395:6 | xs | semmle.label | xs |
-| test.cpp:395:5:395:13 | Store: ... = ... | semmle.label | Store: ... = ... |
-| test.cpp:404:3:404:25 | ... = ... | semmle.label | ... = ... |
-| test.cpp:404:7:404:8 | val indirection [post update] [xs] | semmle.label | val indirection [post update] [xs] |
-| test.cpp:404:12:404:25 | new[] | semmle.label | new[] |
-| test.cpp:406:3:406:25 | ... = ... | semmle.label | ... = ... |
-| test.cpp:406:7:406:8 | val indirection [post update] [xs] | semmle.label | val indirection [post update] [xs] |
-| test.cpp:406:12:406:25 | new[] | semmle.label | new[] |
-| test.cpp:407:3:407:5 | val indirection [xs] | semmle.label | val indirection [xs] |
-| test.cpp:407:3:407:18 | access to array | semmle.label | access to array |
-| test.cpp:407:3:407:22 | Store: ... = ... | semmle.label | Store: ... = ... |
-| test.cpp:407:7:407:8 | xs | semmle.label | xs |
-| test.cpp:407:7:407:8 | xs indirection | semmle.label | xs indirection |
-| test.cpp:417:16:417:33 | new[] | semmle.label | new[] |
-| test.cpp:419:7:419:8 | xs | semmle.label | xs |
-| test.cpp:419:7:419:11 | access to array | semmle.label | access to array |
-| test.cpp:419:7:419:15 | Store: ... = ... | semmle.label | Store: ... = ... |
-| test.cpp:427:14:427:27 | new[] | semmle.label | new[] |
-| test.cpp:433:5:433:6 | xs | semmle.label | xs |
-| test.cpp:433:5:433:17 | access to array | semmle.label | access to array |
-| test.cpp:433:5:433:21 | Store: ... = ... | semmle.label | Store: ... = ... |
 subpaths
 #select
 | test.cpp:6:14:6:15 | Load: * ... | test.cpp:4:15:4:20 | call to malloc | test.cpp:6:14:6:15 | Load: * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:4:15:4:20 | call to malloc | call to malloc | test.cpp:5:19:5:22 | size | size |
@@ -1183,7 +1113,3 @@ subpaths
 | test.cpp:359:14:359:32 | Load: * ... | test.cpp:355:14:355:27 | new[] | test.cpp:359:14:359:32 | Load: * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@ + 2. | test.cpp:355:14:355:27 | new[] | new[] | test.cpp:356:20:356:23 | size | size |
 | test.cpp:372:15:372:16 | Load: * ... | test.cpp:363:14:363:27 | new[] | test.cpp:372:15:372:16 | Load: * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:363:14:363:27 | new[] | new[] | test.cpp:365:19:365:22 | size | size |
 | test.cpp:384:13:384:16 | Load: * ... | test.cpp:377:14:377:27 | new[] | test.cpp:384:13:384:16 | Load: * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:377:14:377:27 | new[] | new[] | test.cpp:378:20:378:23 | size | size |
-| test.cpp:395:5:395:13 | Store: ... = ... | test.cpp:388:14:388:27 | new[] | test.cpp:395:5:395:13 | Store: ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:388:14:388:27 | new[] | new[] | test.cpp:389:19:389:22 | size | size |
-| test.cpp:407:3:407:22 | Store: ... = ... | test.cpp:404:12:404:25 | new[] | test.cpp:407:3:407:22 | Store: ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:404:12:404:25 | new[] | new[] | test.cpp:407:10:407:17 | ... - ... | ... - ... |
-| test.cpp:419:7:419:15 | Store: ... = ... | test.cpp:417:16:417:33 | new[] | test.cpp:419:7:419:15 | Store: ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:417:16:417:33 | new[] | new[] | test.cpp:419:10:419:10 | i | i |
-| test.cpp:433:5:433:21 | Store: ... = ... | test.cpp:427:14:427:27 | new[] | test.cpp:433:5:433:21 | Store: ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:427:14:427:27 | new[] | new[] | test.cpp:433:8:433:16 | ... ++ | ... ++ |

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/pointer-deref/test.cpp

@@ -383,53 +383,3 @@ void test27(unsigned size, bool b) {
 
   int val = *end; // BAD
 }
-
-void test28(unsigned size) {
-  char *xs = new char[size];
-  char *end = &xs[size];
-    if (xs >= end)
-      return;
-    xs++;
-    if (xs >= end)
-      return;
-    xs[0] = 0;  // GOOD [FALSE POSITIVE]
-}
-
-struct test29_struct {
-  char* xs;
-};
-
-void test29(unsigned size) {
-  test29_struct val;
-  val.xs = new char[size];
-  size++;
-  val.xs = new char[size];
-  val.xs[size - 1] = 0; // GOOD [FALSE POSITIVE]
-}
-
-void test30(int *size)
-{
-  int new_size = 0, tmp_size = 0;
-
-  test30(&tmp_size);
-  if (tmp_size + 1 > new_size) {
-    new_size = tmp_size + 1;
-    char *xs = new char[new_size];
-    for (int i = 0; i < new_size; i++) {
-      xs[i] = 0;  // GOOD [FALSE POSITIVE]
-    }
-  }
-  *size = new_size;
-}
-
-void test31(unsigned size, unsigned src_pos)
-{
-  char *xs = new char[size];
-  if (src_pos > size) {
-    src_pos = size;
-  }
-  unsigned dst_pos = src_pos;
-  if(dst_pos < size - 3) {
-    xs[dst_pos++] = 0; // GOOD [FALSE POSITIVE]
-  }
-}

cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-consistency.expected

@@ -67,8 +67,6 @@ postWithInFlow
 | ref.cpp:109:9:109:11 | val [post update] | PostUpdateNode should not be the target of local flow. |
 | ref.cpp:113:11:113:13 | val [post update] | PostUpdateNode should not be the target of local flow. |
 | ref.cpp:115:11:115:13 | val [post update] | PostUpdateNode should not be the target of local flow. |
-| self_parameter_flow.cpp:3:4:3:5 | ps [inner post update] | PostUpdateNode should not be the target of local flow. |
-| self_parameter_flow.cpp:8:9:8:9 | s [inner post update] | PostUpdateNode should not be the target of local flow. |
 | test.cpp:91:3:91:9 | source1 [post update] | PostUpdateNode should not be the target of local flow. |
 | test.cpp:115:3:115:6 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
 | test.cpp:115:4:115:6 | out [inner post update] | PostUpdateNode should not be the target of local flow. |
@@ -130,10 +128,6 @@ postWithInFlow
 | test.cpp:690:3:690:3 | s [post update] | PostUpdateNode should not be the target of local flow. |
 | test.cpp:694:4:694:6 | buf [inner post update] | PostUpdateNode should not be the target of local flow. |
 | test.cpp:704:23:704:25 | buf [inner post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:715:25:715:25 | c [inner post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:728:3:728:4 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:728:4:728:4 | p [inner post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:734:41:734:41 | x [inner post update] | PostUpdateNode should not be the target of local flow. |
 viableImplInCallContextTooLarge
 uniqueParameterNodeAtPosition
 uniqueParameterNodePosition

cpp/ql/test/library-tests/dataflow/dataflow-tests/self-Iterator.cpp

@@ -1,21 +0,0 @@
-#include "../../../include/iterator.h"
-int source();
-
-template<typename T>
-void sink(T);
-
-template<> struct std::iterator_traits<unsigned long>
-{   // get traits from integer type
-    typedef std::input_iterator_tag iterator_category;
-    typedef unsigned long value_type;
-    typedef unsigned long difference_type;
-    typedef unsigned long distance_type;
-    typedef unsigned long * pointer;
-    typedef unsigned long& reference;
-};
-
-
-int test() {
-    unsigned long x = source();
-    sink(x); // $ ast ir
-}

cpp/ql/test/library-tests/dataflow/dataflow-tests/self_parameter_flow.cpp

@@ -1,14 +0,0 @@
-void incr(unsigned char **ps) // $ ast-def=ps ir-def=*ps ir-def=**ps 
-{
-  *ps += 1;
-}
-
-void callincr(unsigned char *s) // $ ast-def=s 
-{
-  incr(&s);
-}
-
-void test(unsigned char *s) // $ ast-def=s
-{
-  callincr(s); // $ flow
-}

cpp/ql/test/library-tests/dataflow/dataflow-tests/test.cpp

@@ -702,35 +702,4 @@ void call_increment_buf(int** buf) { // $ ast-def=buf
 void test_conflation_regression(int* source) { // $ ast-def=source
   int* buf = source;
   call_increment_buf(&buf);
-}
-
-void write_to_star_star_p(unsigned char **p) // $ ast-def=p ir-def=**p ir-def=*p
-{
-  **p = 0;
-}
-
-void write_to_star_buf(unsigned char *buf) // $ ast-def=buf
-{
-  unsigned char *c = buf;
-  write_to_star_star_p(&c);
-}
-
-void test_write_to_star_buf(unsigned char *source) // $ ast-def=source
-{
-  write_to_star_buf(source);
-  sink(*source); // clean
-}
-
-void does_not_write_source_to_dereference(int *p) // $ ast-def=p ir-def=*p
-{
-  int x = source();
-  p = &x;
-  *p = 42;
-}
-
-void test_does_not_write_source_to_dereference()
-{
-  int x;
-  does_not_write_source_to_dereference(&x);
-  sink(x); // $ ast,ir=733:7 SPURIOUS: ast,ir=726:11
-}
+}

cpp/ql/test/library-tests/dataflow/dataflow-tests/test_self_parameter_flow.expected

@@ -1,2 +0,0 @@
-failures
-testFailures

cpp/ql/test/library-tests/dataflow/dataflow-tests/test_self_parameter_flow.ql

@@ -1,34 +0,0 @@
-import cpp
-import semmle.code.cpp.dataflow.new.DataFlow
-import TestUtilities.InlineExpectationsTest
-
-module TestConfig implements DataFlow::ConfigSig {
-  predicate isSource(DataFlow::Node source) {
-    source.getLocation().getFile().getBaseName() = "self_parameter_flow.cpp" and
-    source.asIndirectArgument() =
-      any(Call call | call.getTarget().hasName("callincr")).getAnArgument()
-  }
-
-  predicate isSink(DataFlow::Node sink) {
-    sink.asDefiningArgument() =
-      any(Call call | call.getTarget().hasName("callincr")).getAnArgument()
-  }
-}
-
-import DataFlow::Global<TestConfig>
-
-module TestSelfParameterFlow implements TestSig {
-  string getARelevantTag() { result = "flow" }
-
-  predicate hasActualResult(Location location, string element, string tag, string value) {
-    exists(DataFlow::Node sink |
-      flowTo(sink) and
-      location = sink.getLocation() and
-      element = sink.toString() and
-      tag = "flow" and
-      value = ""
-    )
-  }
-}
-
-import MakeTest<TestSelfParameterFlow>

cpp/ql/test/library-tests/dataflow/dataflow-tests/uninitialized.expected

@@ -42,5 +42,3 @@
 | test.cpp:551:9:551:9 | y | test.cpp:552:28:552:28 | y |
 | test.cpp:595:8:595:9 | xs | test.cpp:596:3:596:4 | xs |
 | test.cpp:595:8:595:9 | xs | test.cpp:597:9:597:10 | xs |
-| test.cpp:733:7:733:7 | x | test.cpp:734:41:734:41 | x |
-| test.cpp:733:7:733:7 | x | test.cpp:735:8:735:8 | x |

cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected

@@ -6591,20 +6591,6 @@
 | taint.cpp:702:4:702:6 | ... ++ | taint.cpp:703:8:703:8 | p | TAINT |
 | taint.cpp:702:10:702:11 | * ... | taint.cpp:702:3:702:11 | ... = ... |  |
 | taint.cpp:702:11:702:11 | s | taint.cpp:702:10:702:11 | * ... | TAINT |
-| taint.cpp:709:25:709:25 | d | taint.cpp:709:25:709:25 | d |  |
-| taint.cpp:709:25:709:25 | d | taint.cpp:711:10:711:10 | d |  |
-| taint.cpp:709:25:709:25 | d | taint.cpp:712:7:712:7 | d |  |
-| taint.cpp:709:34:709:34 | s | taint.cpp:709:34:709:34 | s |  |
-| taint.cpp:709:34:709:34 | s | taint.cpp:710:18:710:18 | s |  |
-| taint.cpp:709:34:709:34 | s | taint.cpp:711:13:711:13 | s |  |
-| taint.cpp:710:18:710:18 | ref arg s | taint.cpp:709:34:709:34 | s |  |
-| taint.cpp:710:18:710:18 | ref arg s | taint.cpp:711:13:711:13 | s |  |
-| taint.cpp:711:10:711:10 | d | taint.cpp:711:2:711:8 | call to strncpy |  |
-| taint.cpp:711:10:711:10 | ref arg d | taint.cpp:709:25:709:25 | d |  |
-| taint.cpp:711:10:711:10 | ref arg d | taint.cpp:712:7:712:7 | d |  |
-| taint.cpp:711:13:711:13 | s | taint.cpp:711:2:711:8 | call to strncpy | TAINT |
-| taint.cpp:711:13:711:13 | s | taint.cpp:711:10:711:10 | ref arg d | TAINT |
-| taint.cpp:712:7:712:7 | ref arg d | taint.cpp:709:25:709:25 | d |  |
 | vector.cpp:16:43:16:49 | source1 | vector.cpp:17:26:17:32 | source1 |  |
 | vector.cpp:16:43:16:49 | source1 | vector.cpp:31:38:31:44 | source1 |  |
 | vector.cpp:17:21:17:33 | call to vector | vector.cpp:19:14:19:14 | v |  |

cpp/ql/test/library-tests/dataflow/taint-tests/taint.cpp

@@ -702,12 +702,4 @@ namespace strings {
 		*p++ = *s;
 		sink(p); // $ ast ir
 	}
-}
-
-char * strncpy (char *, const char *, unsigned long);
-
-void test_strncpy(char* d, char* s) {
-	argument_source(s);
-	strncpy(d, s, 16);
-	sink(d); // $ ast ir
 }

cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/OverflowDestination.expected

@@ -8,19 +8,13 @@ edges
 | overflowdestination.cpp:23:45:23:48 | argv indirection | overflowdestination.cpp:30:17:30:20 | arg1 indirection |
 | overflowdestination.cpp:23:45:23:48 | argv indirection | overflowdestination.cpp:30:17:30:20 | arg1 indirection |
 | overflowdestination.cpp:43:8:43:10 | fgets output argument | overflowdestination.cpp:46:15:46:17 | src indirection |
-| overflowdestination.cpp:50:52:50:54 | src indirection | overflowdestination.cpp:53:9:53:12 | memcpy output argument |
 | overflowdestination.cpp:50:52:50:54 | src indirection | overflowdestination.cpp:53:15:53:17 | src indirection |
 | overflowdestination.cpp:50:52:50:54 | src indirection | overflowdestination.cpp:53:15:53:17 | src indirection |
-| overflowdestination.cpp:50:52:50:54 | src indirection | overflowdestination.cpp:54:9:54:12 | memcpy output argument |
-| overflowdestination.cpp:53:9:53:12 | memcpy output argument | overflowdestination.cpp:54:9:54:12 | memcpy output argument |
-| overflowdestination.cpp:54:9:54:12 | memcpy output argument | overflowdestination.cpp:54:9:54:12 | memcpy output argument |
 | overflowdestination.cpp:57:52:57:54 | src indirection | overflowdestination.cpp:64:16:64:19 | src2 indirection |
 | overflowdestination.cpp:57:52:57:54 | src indirection | overflowdestination.cpp:64:16:64:19 | src2 indirection |
 | overflowdestination.cpp:73:8:73:10 | fgets output argument | overflowdestination.cpp:75:30:75:32 | src indirection |
 | overflowdestination.cpp:73:8:73:10 | fgets output argument | overflowdestination.cpp:76:30:76:32 | src indirection |
-| overflowdestination.cpp:75:30:75:32 | overflowdest_test2 output argument | overflowdestination.cpp:76:30:76:32 | src indirection |
 | overflowdestination.cpp:75:30:75:32 | src indirection | overflowdestination.cpp:50:52:50:54 | src indirection |
-| overflowdestination.cpp:75:30:75:32 | src indirection | overflowdestination.cpp:75:30:75:32 | overflowdest_test2 output argument |
 | overflowdestination.cpp:76:30:76:32 | src indirection | overflowdestination.cpp:57:52:57:54 | src indirection |
 nodes
 | main.cpp:6:27:6:30 | argv indirection | semmle.label | argv indirection |
@@ -34,20 +28,15 @@ nodes
 | overflowdestination.cpp:43:8:43:10 | fgets output argument | semmle.label | fgets output argument |
 | overflowdestination.cpp:46:15:46:17 | src indirection | semmle.label | src indirection |
 | overflowdestination.cpp:50:52:50:54 | src indirection | semmle.label | src indirection |
-| overflowdestination.cpp:53:9:53:12 | memcpy output argument | semmle.label | memcpy output argument |
 | overflowdestination.cpp:53:15:53:17 | src indirection | semmle.label | src indirection |
 | overflowdestination.cpp:53:15:53:17 | src indirection | semmle.label | src indirection |
-| overflowdestination.cpp:54:9:54:12 | memcpy output argument | semmle.label | memcpy output argument |
 | overflowdestination.cpp:57:52:57:54 | src indirection | semmle.label | src indirection |
 | overflowdestination.cpp:64:16:64:19 | src2 indirection | semmle.label | src2 indirection |
 | overflowdestination.cpp:64:16:64:19 | src2 indirection | semmle.label | src2 indirection |
 | overflowdestination.cpp:73:8:73:10 | fgets output argument | semmle.label | fgets output argument |
-| overflowdestination.cpp:75:30:75:32 | overflowdest_test2 output argument | semmle.label | overflowdest_test2 output argument |
 | overflowdestination.cpp:75:30:75:32 | src indirection | semmle.label | src indirection |
 | overflowdestination.cpp:76:30:76:32 | src indirection | semmle.label | src indirection |
 subpaths
-| overflowdestination.cpp:75:30:75:32 | src indirection | overflowdestination.cpp:50:52:50:54 | src indirection | overflowdestination.cpp:53:9:53:12 | memcpy output argument | overflowdestination.cpp:75:30:75:32 | overflowdest_test2 output argument |
-| overflowdestination.cpp:75:30:75:32 | src indirection | overflowdestination.cpp:50:52:50:54 | src indirection | overflowdestination.cpp:54:9:54:12 | memcpy output argument | overflowdestination.cpp:75:30:75:32 | overflowdest_test2 output argument |
 #select
 | overflowdestination.cpp:30:2:30:8 | call to strncpy | main.cpp:6:27:6:30 | argv indirection | overflowdestination.cpp:30:17:30:20 | arg1 indirection | To avoid overflow, this operation should be bounded by destination-buffer size, not source-buffer size. |
 | overflowdestination.cpp:30:2:30:8 | call to strncpy | main.cpp:6:27:6:30 | argv indirection | overflowdestination.cpp:30:17:30:20 | arg1 indirection | To avoid overflow, this operation should be bounded by destination-buffer size, not source-buffer size. |

csharp/documentation/library-coverage/coverage.csv

@@ -24,5 +24,5 @@ Microsoft.Win32,,,8,,,,,,,,,,,,,,8,
 MySql.Data.MySqlClient,48,,,,,,,,,,,48,,,,,,
 Newtonsoft.Json,,,91,,,,,,,,,,,,,,73,18
 ServiceStack,194,,7,27,,,,,75,,,92,,,,,7,
-System,65,25,12148,,8,8,9,,,4,3,33,1,17,3,4,10163,1985
+System,65,25,12157,,8,8,9,,,4,3,33,1,17,3,4,10163,1994
 Windows.Security.Cryptography.Core,1,,,,,,,1,,,,,,,,,,

csharp/documentation/library-coverage/coverage.rst

@@ -8,7 +8,7 @@ C# framework & library support
 
    Framework / library,Package,Flow sources,Taint & value steps,Sinks (total),`CWE-079` :sub:`Cross-site scripting`
    `ServiceStack <https://servicestack.net/>`_,"``ServiceStack.*``, ``ServiceStack``",,7,194,
-   System,"``System.*``, ``System``",25,12148,65,7
+   System,"``System.*``, ``System``",25,12157,65,7
    Others,"``Dapper``, ``JsonToItemsTaskFactory``, ``Microsoft.ApplicationBlocks.Data``, ``Microsoft.CSharp``, ``Microsoft.EntityFrameworkCore``, ``Microsoft.Extensions.Caching.Distributed``, ``Microsoft.Extensions.Caching.Memory``, ``Microsoft.Extensions.Configuration``, ``Microsoft.Extensions.DependencyInjection``, ``Microsoft.Extensions.DependencyModel``, ``Microsoft.Extensions.FileProviders``, ``Microsoft.Extensions.FileSystemGlobbing``, ``Microsoft.Extensions.Hosting``, ``Microsoft.Extensions.Http``, ``Microsoft.Extensions.Logging``, ``Microsoft.Extensions.Options``, ``Microsoft.Extensions.Primitives``, ``Microsoft.Interop``, ``Microsoft.NET.Build.Tasks``, ``Microsoft.NETCore.Platforms.BuildTasks``, ``Microsoft.VisualBasic``, ``Microsoft.Win32``, ``MySql.Data.MySqlClient``, ``Newtonsoft.Json``, ``Windows.Security.Cryptography.Core``",,568,138,
-   Totals,,25,12723,397,7
+   Totals,,25,12732,397,7
 

csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md

@@ -1,7 +1,3 @@
-## 1.5.3
-
-No user-facing changes.
-
 ## 1.5.2
 
 No user-facing changes.

csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.5.3.md

@@ -1,3 +0,0 @@
-## 1.5.3
-
-No user-facing changes.

csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.5.3
+lastReleaseVersion: 1.5.2

csharp/ql/campaigns/Solorigate/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-all
-version: 1.5.4-dev
+version: 1.5.3-dev
 groups:
     - csharp
     - solorigate

csharp/ql/campaigns/Solorigate/src/CHANGELOG.md

@@ -1,7 +1,3 @@
-## 1.5.3
-
-No user-facing changes.
-
 ## 1.5.2
 
 No user-facing changes.

csharp/ql/campaigns/Solorigate/src/change-notes/released/1.5.3.md

@@ -1,3 +0,0 @@
-## 1.5.3
-
-No user-facing changes.

csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.5.3
+lastReleaseVersion: 1.5.2

csharp/ql/campaigns/Solorigate/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-queries
-version: 1.5.4-dev
+version: 1.5.3-dev
 groups:
     - csharp
     - solorigate

csharp/ql/consistency-queries/AstConsistency.qll

@@ -17,8 +17,3 @@ query predicate missingLocation(Element e) {
   not exists(TupleType t | e = t or e = t.getAField()) and
   not exists(e.getLocation())
 }
-
-query predicate multipleToString(Element e, string s) {
-  s = strictconcat(e.toString(), ",") and
-  strictcount(e.toString()) > 1
-}

csharp/ql/consistency-queries/CfgConsistency.ql

@@ -62,8 +62,3 @@ query predicate preBasicBlockConsistency(ControlFlowElement cfe1, ControlFlowEle
   bbIntraSuccInconsistency(cfe1, cfe2) and
   s = "intra succ inconsistency"
 }
-
-query predicate multipleToString(Node n, string s) {
-  s = strictconcat(n.toString(), ",") and
-  strictcount(n.toString()) > 1
-}

csharp/ql/consistency-queries/DataFlowConsistency.ql

@@ -37,13 +37,13 @@ private class MyConsistencyConfiguration extends ConsistencyConfiguration {
   }
 
   override predicate postWithInFlowExclude(Node n) {
-    n instanceof FlowSummaryNode
+    n instanceof SummaryNode
     or
     n.asExpr().(ObjectCreation).hasInitializer()
   }
 
   override predicate argHasPostUpdateExclude(ArgumentNode n) {
-    n instanceof FlowSummaryNode
+    n instanceof SummaryNode
     or
     not exists(LocalFlow::getAPostUpdateNodeForArg(n.getControlFlowNode()))
     or
@@ -74,8 +74,3 @@ private class MyConsistencyConfiguration extends ConsistencyConfiguration {
 
   override predicate identityLocalStepExclude(Node n) { none() }
 }
-
-query predicate multipleToString(Node n, string s) {
-  s = strictconcat(n.toString(), ",") and
-  strictcount(n.toString()) > 1
-}

csharp/ql/lib/CHANGELOG.md

@@ -1,24 +1,3 @@
-## 0.6.3
-
-### Major Analysis Improvements
-
-* The extractor has been changed to run after the traced compiler call. This allows inspecting compiler generated files, such as the output of source generators. With this change, `.cshtml` files and their generated `.cshtml.g.cs` counterparts are extracted on dotnet 6 and above.
-
-### Minor Analysis Improvements
-
-* C#: Analysis of the `dotnet test` command supplied with a `dll` or `exe` file as argument no longer fails due to the addition of an erroneous `-p:SharedCompilation=false` argument.
-* Deleted the deprecated `WebConfigXML`, `ConfigurationXMLElement`, `LocationXMLElement`, `SystemWebXMLElement`, `SystemWebServerXMLElement`, `CustomErrorsXMLElement`, and `HttpRuntimeXMLElement` classes from `WebConfig.qll`. The non-deprecated names with PascalCased Xml suffixes should be used instead.
-* Deleted the deprecated `Record` class from both `Types.qll` and `Type.qll`.
-* Deleted the deprecated `StructuralComparisonConfiguration` class from `StructuralComparison.qll`, use `sameGvn` instead.
-* Deleted the deprecated `isParameterOf` predicate from the `ParameterNode` class.
-* Deleted the deprecated `SafeExternalAPICallable`, `ExternalAPIDataNode`, `UntrustedDataToExternalAPIConfig`, `UntrustedExternalAPIDataNode`, and `ExternalAPIUsedWithUntrustedData` classes from `ExternalAPIsQuery.qll`. The non-deprecated names with PascalCased Api suffixes should be used instead.
-* Updated the following C# sink kind names. Any custom data extensions that use these sink kinds will need to be updated accordingly in order to continue working.
-  * `code` to `code-injection`
-  * `sql` to `sql-injection`
-  * `html` to `html-injection`
-  * `xss` to `js-injection`
-  * `remote` to `file-content-store`
-
 ## 0.6.2
 
 ### Minor Analysis Improvements

csharp/ql/lib/change-notes/2023-05-09-models-as-data.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Additional support for `command-injection`, `ldap-injection`, `log-injection`, and `url-redirection` sink kinds for Models as Data.

csharp/ql/lib/change-notes/2023-05-17-update-csharp-sink-kinds.md

@@ -0,0 +1,9 @@
+---
+category: minorAnalysis
+---
+* Updated the following C# sink kind names. Any custom data extensions that use these sink kinds will need to be updated accordingly in order to continue working.
+  * `code` to `code-injection`
+  * `sql` to `sql-injection`
+  * `html` to `html-injection`
+  * `xss` to `js-injection`
+  * `remote` to `file-content-store`

csharp/ql/lib/change-notes/2023-05-30-source-generators.md

@@ -0,0 +1,4 @@
+---
+category: majorAnalysis
+---
+* The extractor has been changed to run after the traced compiler call. This allows inspecting compiler generated files, such as the output of source generators. With this change, `.cshtml` files and their generated `.cshtml.g.cs` counterparts are extracted on dotnet 6 and above.

csharp/ql/lib/change-notes/2023-06-02-delete-deps.md

@@ -1,20 +1,8 @@
-## 0.6.3
-
-### Major Analysis Improvements
-
-* The extractor has been changed to run after the traced compiler call. This allows inspecting compiler generated files, such as the output of source generators. With this change, `.cshtml` files and their generated `.cshtml.g.cs` counterparts are extracted on dotnet 6 and above.
-
-### Minor Analysis Improvements
-
-* C#: Analysis of the `dotnet test` command supplied with a `dll` or `exe` file as argument no longer fails due to the addition of an erroneous `-p:SharedCompilation=false` argument.
+---
+category: minorAnalysis
+---
 * Deleted the deprecated `WebConfigXML`, `ConfigurationXMLElement`, `LocationXMLElement`, `SystemWebXMLElement`, `SystemWebServerXMLElement`, `CustomErrorsXMLElement`, and `HttpRuntimeXMLElement` classes from `WebConfig.qll`. The non-deprecated names with PascalCased Xml suffixes should be used instead.
 * Deleted the deprecated `Record` class from both `Types.qll` and `Type.qll`.
 * Deleted the deprecated `StructuralComparisonConfiguration` class from `StructuralComparison.qll`, use `sameGvn` instead.
 * Deleted the deprecated `isParameterOf` predicate from the `ParameterNode` class.
 * Deleted the deprecated `SafeExternalAPICallable`, `ExternalAPIDataNode`, `UntrustedDataToExternalAPIConfig`, `UntrustedExternalAPIDataNode`, and `ExternalAPIUsedWithUntrustedData` classes from `ExternalAPIsQuery.qll`. The non-deprecated names with PascalCased Api suffixes should be used instead.
-* Updated the following C# sink kind names. Any custom data extensions that use these sink kinds will need to be updated accordingly in order to continue working.
-  * `code` to `code-injection`
-  * `sql` to `sql-injection`
-  * `html` to `html-injection`
-  * `xss` to `js-injection`
-  * `remote` to `file-content-store`

csharp/ql/lib/change-notes/2023-06-06-dotnettest.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* C#: Analysis of the `dotnet test` command supplied with a `dll` or `exe` file as argument no longer fails due to the addition of an erroneous `-p:SharedCompilation=false` argument.

csharp/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.6.3
+lastReleaseVersion: 0.6.2

csharp/ql/lib/ext/System.Collections.Generic.model.yml

@@ -40,7 +40,7 @@ extensions:
       - ["System.Collections.Generic", "LinkedList<>", False, "FindLast", "(T)", "", "Argument[this].Element", "ReturnValue", "value", "manual"]
       - ["System.Collections.Generic", "LinkedList<>", False, "GetEnumerator", "()", "", "Argument[this].Element", "ReturnValue.Property[System.Collections.Generic.LinkedList<>+Enumerator.Current]", "value", "manual"]
       - ["System.Collections.Generic", "List<>", False, "AddRange", "(System.Collections.Generic.IEnumerable<T>)", "", "Argument[0].Element", "Argument[this].Element", "value", "manual"]
-      - ["System.Collections.Generic", "List<>", False, "AsReadOnly", "()", "", "Argument[this].Element", "ReturnValue.Element", "value", "manual"]
+      - ["System.Collections.Generic", "List<>", False, "AsReadOnly", "()", "", "Argument[0].Element", "ReturnValue.Element", "value", "manual"]
       - ["System.Collections.Generic", "List<>", False, "Find", "(System.Predicate<T>)", "", "Argument[this].Element", "Argument[0].Parameter[0]", "value", "manual"]
       - ["System.Collections.Generic", "List<>", False, "Find", "(System.Predicate<T>)", "", "Argument[this].Element", "ReturnValue", "value", "manual"]
       - ["System.Collections.Generic", "List<>", False, "FindAll", "(System.Predicate<T>)", "", "Argument[this].Element", "Argument[0].Parameter[0]", "value", "manual"]
@@ -48,8 +48,10 @@ extensions:
       - ["System.Collections.Generic", "List<>", False, "FindLast", "(System.Predicate<T>)", "", "Argument[this].Element", "Argument[0].Parameter[0]", "value", "manual"]
       - ["System.Collections.Generic", "List<>", False, "FindLast", "(System.Predicate<T>)", "", "Argument[this].Element", "ReturnValue", "value", "manual"]
       - ["System.Collections.Generic", "List<>", False, "GetEnumerator", "()", "", "Argument[this].Element", "ReturnValue.Property[System.Collections.Generic.List<>+Enumerator.Current]", "value", "manual"]
-      - ["System.Collections.Generic", "List<>", False, "GetRange", "(System.Int32,System.Int32)", "", "Argument[this].Element", "ReturnValue.Element", "value", "manual"]
+      - ["System.Collections.Generic", "List<>", False, "GetRange", "(System.Int32,System.Int32)", "", "Argument[0].Element", "ReturnValue.Element", "value", "manual"]
       - ["System.Collections.Generic", "List<>", False, "InsertRange", "(System.Int32,System.Collections.Generic.IEnumerable<T>)", "", "Argument[1].Element", "Argument[this].Element", "value", "manual"]
+      - ["System.Collections.Generic", "List<>", False, "Reverse", "()", "", "Argument[0].Element", "ReturnValue.Element", "value", "manual"]
+      - ["System.Collections.Generic", "List<>", False, "Reverse", "(System.Int32,System.Int32)", "", "Argument[0].Element", "ReturnValue.Element", "value", "manual"]
       - ["System.Collections.Generic", "Queue<>", False, "Clear", "()", "", "Argument[this].WithoutElement", "Argument[this]", "value", "manual"]
       - ["System.Collections.Generic", "Queue<>", False, "CopyTo", "(T[],System.Int32)", "", "Argument[this].Element", "Argument[0].Element", "value", "manual"]
       - ["System.Collections.Generic", "Queue<>", False, "GetEnumerator", "()", "", "Argument[this].Element", "ReturnValue.Property[System.Collections.Generic.Queue<>+Enumerator.Current]", "value", "manual"]
@@ -77,7 +79,7 @@ extensions:
       - ["System.Collections.Generic", "SortedList<,>+KeyList", False, "Clear", "()", "", "Argument[this].WithoutElement", "Argument[this]", "value", "manual"]
       - ["System.Collections.Generic", "SortedList<,>+ValueList", False, "Clear", "()", "", "Argument[this].WithoutElement", "Argument[this]", "value", "manual"]
       - ["System.Collections.Generic", "SortedSet<>", False, "GetEnumerator", "()", "", "Argument[this].Element", "ReturnValue.Property[System.Collections.Generic.SortedSet<>+Enumerator.Current]", "value", "manual"]
-      - ["System.Collections.Generic", "SortedSet<>", False, "Reverse", "()", "", "Argument[this].Element", "ReturnValue.Element", "value", "manual"]
+      - ["System.Collections.Generic", "SortedSet<>", False, "Reverse", "()", "", "Argument[0].Element", "ReturnValue.Element", "value", "manual"]
       - ["System.Collections.Generic", "Stack<>", False, "Clear", "()", "", "Argument[this].WithoutElement", "Argument[this]", "value", "manual"]
       - ["System.Collections.Generic", "Stack<>", False, "CopyTo", "(T[],System.Int32)", "", "Argument[this].Element", "Argument[0].Element", "value", "manual"]
       - ["System.Collections.Generic", "Stack<>", False, "GetEnumerator", "()", "", "Argument[this].Element", "ReturnValue.Property[System.Collections.Generic.Stack<>+Enumerator.Current]", "value", "manual"]

csharp/ql/lib/ext/System.Collections.Immutable.model.yml

@@ -20,6 +20,7 @@ extensions:
       - ["System.Collections.Immutable", "ImmutableArray<>+Builder", False, "AddRange<>", "(System.Collections.Immutable.ImmutableArray<TDerived>+Builder)", "", "Argument[0].Element", "Argument[this].Element", "value", "manual"]
       - ["System.Collections.Immutable", "ImmutableArray<>+Builder", False, "AddRange<>", "(TDerived[])", "", "Argument[0].Element", "Argument[this].Element", "value", "manual"]
       - ["System.Collections.Immutable", "ImmutableArray<>+Builder", False, "GetEnumerator", "()", "", "Argument[this].Element", "ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current]", "value", "manual"]
+      - ["System.Collections.Immutable", "ImmutableArray<>+Builder", False, "Reverse", "()", "", "Argument[0].Element", "ReturnValue.Element", "value", "manual"]
       - ["System.Collections.Immutable", "ImmutableDictionary<,>", False, "Add", "(System.Collections.Generic.KeyValuePair<TKey,TValue>)", "", "Argument[0].Property[System.Collections.Generic.KeyValuePair<,>.Key]", "Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key]", "value", "manual"]
       - ["System.Collections.Immutable", "ImmutableDictionary<,>", False, "Add", "(System.Collections.Generic.KeyValuePair<TKey,TValue>)", "", "Argument[0].Property[System.Collections.Generic.KeyValuePair<,>.Value]", "Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value]", "value", "manual"]
       - ["System.Collections.Immutable", "ImmutableDictionary<,>", False, "Add", "(TKey,TValue)", "", "Argument[0]", "Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key]", "value", "manual"]
@@ -48,11 +49,11 @@ extensions:
       - ["System.Collections.Immutable", "ImmutableList<>", False, "FindLast", "(System.Predicate<T>)", "", "Argument[this].Element", "Argument[0].Parameter[0]", "value", "manual"]
       - ["System.Collections.Immutable", "ImmutableList<>", False, "FindLast", "(System.Predicate<T>)", "", "Argument[this].Element", "ReturnValue", "value", "manual"]
       - ["System.Collections.Immutable", "ImmutableList<>", False, "GetEnumerator", "()", "", "Argument[this].Element", "ReturnValue.Property[System.Collections.Immutable.ImmutableList<>+Enumerator.Current]", "value", "manual"]
-      - ["System.Collections.Immutable", "ImmutableList<>", False, "GetRange", "(System.Int32,System.Int32)", "", "Argument[this].Element", "ReturnValue.Element", "value", "manual"]
+      - ["System.Collections.Immutable", "ImmutableList<>", False, "GetRange", "(System.Int32,System.Int32)", "", "Argument[0].Element", "ReturnValue.Element", "value", "manual"]
       - ["System.Collections.Immutable", "ImmutableList<>", False, "Insert", "(System.Int32,T)", "", "Argument[1]", "Argument[this].Element", "value", "manual"]
       - ["System.Collections.Immutable", "ImmutableList<>", False, "InsertRange", "(System.Int32,System.Collections.Generic.IEnumerable<T>)", "", "Argument[1].Element", "Argument[this].Element", "value", "manual"]
-      - ["System.Collections.Immutable", "ImmutableList<>", False, "Reverse", "()", "", "Argument[this].Element", "ReturnValue.Element", "value", "manual"]
-      - ["System.Collections.Immutable", "ImmutableList<>", False, "Reverse", "(System.Int32,System.Int32)", "", "Argument[this].Element", "ReturnValue.Element", "value", "manual"]
+      - ["System.Collections.Immutable", "ImmutableList<>", False, "Reverse", "()", "", "Argument[0].Element", "ReturnValue.Element", "value", "manual"]
+      - ["System.Collections.Immutable", "ImmutableList<>", False, "Reverse", "(System.Int32,System.Int32)", "", "Argument[0].Element", "ReturnValue.Element", "value", "manual"]
       - ["System.Collections.Immutable", "ImmutableList<>", False, "get_Item", "(System.Int32)", "", "Argument[this].Element", "ReturnValue", "value", "manual"]
       - ["System.Collections.Immutable", "ImmutableList<>+Builder", False, "AddRange", "(System.Collections.Generic.IEnumerable<T>)", "", "Argument[0].Element", "Argument[this].Element", "value", "manual"]
       - ["System.Collections.Immutable", "ImmutableList<>+Builder", False, "Find", "(System.Predicate<T>)", "", "Argument[this].Element", "Argument[0].Parameter[0]", "value", "manual"]
@@ -62,8 +63,10 @@ extensions:
       - ["System.Collections.Immutable", "ImmutableList<>+Builder", False, "FindLast", "(System.Predicate<T>)", "", "Argument[this].Element", "Argument[0].Parameter[0]", "value", "manual"]
       - ["System.Collections.Immutable", "ImmutableList<>+Builder", False, "FindLast", "(System.Predicate<T>)", "", "Argument[this].Element", "ReturnValue", "value", "manual"]
       - ["System.Collections.Immutable", "ImmutableList<>+Builder", False, "GetEnumerator", "()", "", "Argument[this].Element", "ReturnValue.Property[System.Collections.Immutable.ImmutableList<>+Enumerator.Current]", "value", "manual"]
-      - ["System.Collections.Immutable", "ImmutableList<>+Builder", False, "GetRange", "(System.Int32,System.Int32)", "", "Argument[this].Element", "ReturnValue.Element", "value", "manual"]
+      - ["System.Collections.Immutable", "ImmutableList<>+Builder", False, "GetRange", "(System.Int32,System.Int32)", "", "Argument[0].Element", "ReturnValue.Element", "value", "manual"]
       - ["System.Collections.Immutable", "ImmutableList<>+Builder", False, "InsertRange", "(System.Int32,System.Collections.Generic.IEnumerable<T>)", "", "Argument[1].Element", "Argument[this].Element", "value", "manual"]
+      - ["System.Collections.Immutable", "ImmutableList<>+Builder", False, "Reverse", "()", "", "Argument[0].Element", "ReturnValue.Element", "value", "manual"]
+      - ["System.Collections.Immutable", "ImmutableList<>+Builder", False, "Reverse", "(System.Int32,System.Int32)", "", "Argument[0].Element", "ReturnValue.Element", "value", "manual"]
       - ["System.Collections.Immutable", "ImmutableQueue<>", False, "GetEnumerator", "()", "", "Argument[this].Element", "ReturnValue.Property[System.Collections.Immutable.ImmutableQueue<>+Enumerator.Current]", "value", "manual"]
       - ["System.Collections.Immutable", "ImmutableSortedDictionary<,>", False, "Add", "(System.Collections.Generic.KeyValuePair<TKey,TValue>)", "", "Argument[0].Property[System.Collections.Generic.KeyValuePair<,>.Key]", "Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key]", "value", "manual"]
       - ["System.Collections.Immutable", "ImmutableSortedDictionary<,>", False, "Add", "(System.Collections.Generic.KeyValuePair<TKey,TValue>)", "", "Argument[0].Property[System.Collections.Generic.KeyValuePair<,>.Value]", "Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value]", "value", "manual"]
@@ -82,8 +85,8 @@ extensions:
       - ["System.Collections.Immutable", "ImmutableSortedDictionary<,>+Builder", False, "get_Values", "()", "", "Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value]", "ReturnValue.Element", "value", "manual"]
       - ["System.Collections.Immutable", "ImmutableSortedSet<>", False, "Add", "(T)", "", "Argument[0]", "Argument[this].Element", "value", "manual"]
       - ["System.Collections.Immutable", "ImmutableSortedSet<>", False, "GetEnumerator", "()", "", "Argument[this].Element", "ReturnValue.Property[System.Collections.Immutable.ImmutableSortedSet<>+Enumerator.Current]", "value", "manual"]
-      - ["System.Collections.Immutable", "ImmutableSortedSet<>", False, "Reverse", "()", "", "Argument[this].Element", "ReturnValue.Element", "value", "manual"]
+      - ["System.Collections.Immutable", "ImmutableSortedSet<>", False, "Reverse", "()", "", "Argument[0].Element", "ReturnValue.Element", "value", "manual"]
       - ["System.Collections.Immutable", "ImmutableSortedSet<>", False, "get_Item", "(System.Int32)", "", "Argument[this].Element", "ReturnValue", "value", "manual"]
       - ["System.Collections.Immutable", "ImmutableSortedSet<>+Builder", False, "GetEnumerator", "()", "", "Argument[this].Element", "ReturnValue.Property[System.Collections.Immutable.ImmutableSortedSet<>+Enumerator.Current]", "value", "manual"]
-      - ["System.Collections.Immutable", "ImmutableSortedSet<>+Builder", False, "Reverse", "()", "", "Argument[this].Element", "ReturnValue.Element", "value", "manual"]
+      - ["System.Collections.Immutable", "ImmutableSortedSet<>+Builder", False, "Reverse", "()", "", "Argument[0].Element", "ReturnValue.Element", "value", "manual"]
       - ["System.Collections.Immutable", "ImmutableStack<>", False, "GetEnumerator", "()", "", "Argument[this].Element", "ReturnValue.Property[System.Collections.Immutable.ImmutableStack<>+Enumerator.Current]", "value", "manual"]

csharp/ql/lib/ext/System.Collections.Specialized.model.yml

@@ -9,7 +9,7 @@ extensions:
       - ["System.Collections.Specialized", "NameValueCollection", False, "Add", "(System.Collections.Specialized.NameValueCollection)", "", "Argument[0]", "Argument[this].Element", "value", "manual"]
       - ["System.Collections.Specialized", "NameValueCollection", True, "Clear", "()", "", "Argument[this].WithoutElement", "Argument[this]", "value", "manual"]
       - ["System.Collections.Specialized", "NameValueCollection", False, "CopyTo", "(System.Array,System.Int32)", "", "Argument[this].Element", "Argument[0].Element", "value", "manual"]
-      - ["System.Collections.Specialized", "OrderedDictionary", False, "AsReadOnly", "()", "", "Argument[this].Element", "ReturnValue.Element", "value", "manual"]
+      - ["System.Collections.Specialized", "OrderedDictionary", False, "AsReadOnly", "()", "", "Argument[0].Element", "ReturnValue.Element", "value", "manual"]
       - ["System.Collections.Specialized", "StringCollection", False, "Add", "(System.String)", "", "Argument[0]", "Argument[this].Element", "value", "manual"]
       - ["System.Collections.Specialized", "StringCollection", False, "AddRange", "(System.String[])", "", "Argument[0].Element", "Argument[this].Element", "value", "manual"]
       - ["System.Collections.Specialized", "StringCollection", False, "CopyTo", "(System.String[],System.Int32)", "", "Argument[this].Element", "Argument[0].Element", "value", "manual"]

csharp/ql/lib/ext/System.Collections.model.yml

@@ -4,15 +4,17 @@ extensions:
       extensible: summaryModel
     data:
       - ["System.Collections", "ArrayList", False, "AddRange", "(System.Collections.ICollection)", "", "Argument[0].Element", "Argument[this].Element", "value", "manual"]
-      - ["System.Collections", "ArrayList", False, "Clone", "()", "", "Argument[this].Element", "ReturnValue.Element", "value", "manual"]
+      - ["System.Collections", "ArrayList", False, "Clone", "()", "", "Argument[0].Element", "ReturnValue.Element", "value", "manual"]
       - ["System.Collections", "ArrayList", False, "FixedSize", "(System.Collections.ArrayList)", "", "Argument[0].Element", "ReturnValue.Element", "value", "manual"]
       - ["System.Collections", "ArrayList", False, "FixedSize", "(System.Collections.IList)", "", "Argument[0].Element", "ReturnValue.Element", "value", "manual"]
       - ["System.Collections", "ArrayList", False, "GetEnumerator", "(System.Int32,System.Int32)", "", "Argument[this].Element", "ReturnValue.Property[System.Collections.IEnumerator.Current]", "value", "manual"]
-      - ["System.Collections", "ArrayList", False, "GetRange", "(System.Int32,System.Int32)", "", "Argument[this].Element", "ReturnValue.Element", "value", "manual"]
+      - ["System.Collections", "ArrayList", False, "GetRange", "(System.Int32,System.Int32)", "", "Argument[0].Element", "ReturnValue.Element", "value", "manual"]
       - ["System.Collections", "ArrayList", False, "InsertRange", "(System.Int32,System.Collections.ICollection)", "", "Argument[1].Element", "Argument[this].Element", "value", "manual"]
       - ["System.Collections", "ArrayList", False, "Repeat", "(System.Object,System.Int32)", "", "Argument[0]", "ReturnValue.Element", "value", "manual"]
-      - ["System.Collections", "BitArray", False, "Clone", "()", "", "Argument[this].Element", "ReturnValue.Element", "value", "manual"]
-      - ["System.Collections", "Hashtable", False, "Clone", "()", "", "Argument[this].Element", "ReturnValue.Element", "value", "manual"]
+      - ["System.Collections", "ArrayList", False, "Reverse", "()", "", "Argument[0].Element", "ReturnValue.Element", "value", "manual"]
+      - ["System.Collections", "ArrayList", False, "Reverse", "(System.Int32,System.Int32)", "", "Argument[0].Element", "ReturnValue.Element", "value", "manual"]
+      - ["System.Collections", "BitArray", False, "Clone", "()", "", "Argument[0].Element", "ReturnValue.Element", "value", "manual"]
+      - ["System.Collections", "Hashtable", False, "Clone", "()", "", "Argument[0].Element", "ReturnValue.Element", "value", "manual"]
       - ["System.Collections", "Hashtable", False, "Hashtable", "(System.Collections.IDictionary)", "", "Argument[0].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key]", "Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key]", "value", "manual"]
       - ["System.Collections", "Hashtable", False, "Hashtable", "(System.Collections.IDictionary)", "", "Argument[0].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value]", "Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value]", "value", "manual"]
       - ["System.Collections", "Hashtable", False, "Hashtable", "(System.Collections.IDictionary,System.Collections.IEqualityComparer)", "", "Argument[0].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key]", "Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key]", "value", "manual"]
@@ -41,9 +43,9 @@ extensions:
       - ["System.Collections", "IList", True, "get_Item", "(System.Int32)", "", "Argument[this].Element", "ReturnValue", "value", "manual"]
       - ["System.Collections", "IList", True, "set_Item", "(System.Int32,System.Object)", "", "Argument[1]", "Argument[this].Element", "value", "manual"]
       - ["System.Collections", "Queue", True, "Clear", "()", "", "Argument[this].WithoutElement", "Argument[this]", "value", "manual"]
-      - ["System.Collections", "Queue", False, "Clone", "()", "", "Argument[this].Element", "ReturnValue.Element", "value", "manual"]
+      - ["System.Collections", "Queue", False, "Clone", "()", "", "Argument[0].Element", "ReturnValue.Element", "value", "manual"]
       - ["System.Collections", "Queue", False, "Peek", "()", "", "Argument[this].Element", "ReturnValue", "value", "manual"]
-      - ["System.Collections", "SortedList", False, "Clone", "()", "", "Argument[this].Element", "ReturnValue.Element", "value", "manual"]
+      - ["System.Collections", "SortedList", False, "Clone", "()", "", "Argument[0].Element", "ReturnValue.Element", "value", "manual"]
       - ["System.Collections", "SortedList", False, "GetByIndex", "(System.Int32)", "", "Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value]", "ReturnValue", "value", "manual"]
       - ["System.Collections", "SortedList", False, "GetValueList", "()", "", "Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value]", "ReturnValue.Element", "value", "manual"]
       - ["System.Collections", "SortedList", False, "SortedList", "(System.Collections.IDictionary)", "", "Argument[0].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key]", "Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key]", "value", "manual"]
@@ -51,6 +53,6 @@ extensions:
       - ["System.Collections", "SortedList", False, "SortedList", "(System.Collections.IDictionary,System.Collections.IComparer)", "", "Argument[0].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key]", "Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key]", "value", "manual"]
       - ["System.Collections", "SortedList", False, "SortedList", "(System.Collections.IDictionary,System.Collections.IComparer)", "", "Argument[0].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value]", "Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value]", "value", "manual"]
       - ["System.Collections", "Stack", False, "Clear", "()", "", "Argument[this].WithoutElement", "Argument[this]", "value", "manual"]
-      - ["System.Collections", "Stack", False, "Clone", "()", "", "Argument[this].Element", "ReturnValue.Element", "value", "manual"]
+      - ["System.Collections", "Stack", False, "Clone", "()", "", "Argument[0].Element", "ReturnValue.Element", "value", "manual"]
       - ["System.Collections", "Stack", False, "Peek", "()", "", "Argument[this].Element", "ReturnValue", "value", "manual"]
       - ["System.Collections", "Stack", False, "Pop", "()", "", "Argument[this].Element", "ReturnValue", "value", "manual"]

csharp/ql/lib/ext/System.Data.model.yml

@@ -58,7 +58,7 @@ extensions:
       - ["System.Data", "IDataParameterCollection", True, "set_Item", "(System.String,System.Object)", "", "Argument[1]", "Argument[this].Element", "value", "manual"]
       - ["System.Data", "ITableMappingCollection", True, "get_Item", "(System.String)", "", "Argument[this].Element", "ReturnValue", "value", "manual"]
       - ["System.Data", "ITableMappingCollection", True, "set_Item", "(System.String,System.Object)", "", "Argument[1]", "Argument[this].Element", "value", "manual"]
-      - ["System.Data", "PropertyCollection", False, "Clone", "()", "", "Argument[this].Element", "ReturnValue.Element", "value", "manual"]
+      - ["System.Data", "PropertyCollection", False, "Clone", "()", "", "Argument[0].Element", "ReturnValue.Element", "value", "manual"]
       - ["System.Data", "TypedTableBaseExtensions", False, "AsEnumerable<>", "(System.Data.TypedTableBase<TRow>)", "", "Argument[0].Element", "ReturnValue.Element", "value", "manual"]
       - ["System.Data", "TypedTableBaseExtensions", False, "ElementAtOrDefault<>", "(System.Data.TypedTableBase<TRow>,System.Int32)", "", "Argument[0].Element", "ReturnValue", "value", "manual"]
       - ["System.Data", "TypedTableBaseExtensions", False, "OrderBy<,>", "(System.Data.TypedTableBase<TRow>,System.Func<TRow,TKey>)", "", "Argument[0].Element", "Argument[1].Parameter[0]", "value", "manual"]

csharp/ql/lib/ext/System.Runtime.CompilerServices.model.yml

@@ -6,4 +6,6 @@ extensions:
       - ["System.Runtime.CompilerServices", "ConditionalWeakTable<,>", False, "Clear", "()", "", "Argument[this].WithoutElement", "Argument[this]", "value", "manual"]
       - ["System.Runtime.CompilerServices", "ConfiguredTaskAwaitable<>", False, "GetAwaiter", "()", "", "Argument[this].SyntheticField[m_configuredTaskAwaiter]", "ReturnValue", "value", "manual"]
       - ["System.Runtime.CompilerServices", "ConfiguredTaskAwaitable<>+ConfiguredTaskAwaiter", False, "GetResult", "()", "", "Argument[this].SyntheticField[m_task_configured_task_awaitable].Property[System.Threading.Tasks.Task<>.Result]", "ReturnValue", "value", "manual"]
+      - ["System.Runtime.CompilerServices", "ReadOnlyCollectionBuilder<>", False, "Reverse", "()", "", "Argument[0].Element", "ReturnValue.Element", "value", "manual"]
+      - ["System.Runtime.CompilerServices", "ReadOnlyCollectionBuilder<>", False, "Reverse", "(System.Int32,System.Int32)", "", "Argument[0].Element", "ReturnValue.Element", "value", "manual"]
       - ["System.Runtime.CompilerServices", "TaskAwaiter<>", False, "GetResult", "()", "", "Argument[this].SyntheticField[m_task_task_awaiter].Property[System.Threading.Tasks.Task<>.Result]", "ReturnValue", "value", "manual"]

csharp/ql/lib/ext/System.model.yml

@@ -13,7 +13,7 @@ extensions:
       - ["System", "Array", False, "AsReadOnly<>", "(T[])", "", "Argument[0].Element", "ReturnValue.Element", "value", "manual"]
       - ["System", "Array", False, "Clear", "(System.Array)", "", "Argument[0].WithoutElement", "Argument[0]", "value", "manual"]
       - ["System", "Array", False, "Clear", "(System.Array,System.Int32,System.Int32)", "", "Argument[0].WithoutElement", "Argument[0]", "value", "manual"]
-      - ["System", "Array", False, "Clone", "()", "", "Argument[this].Element", "ReturnValue.Element", "value", "manual"]
+      - ["System", "Array", False, "Clone", "()", "", "Argument[0].Element", "ReturnValue.Element", "value", "manual"]
       - ["System", "Array", False, "CopyTo", "(System.Array,System.Int64)", "", "Argument[this].Element", "Argument[0].Element", "value", "manual"]
       - ["System", "Array", False, "Find<>", "(T[],System.Predicate<T>)", "", "Argument[0].Element", "Argument[1].Parameter[0]", "value", "manual"]
       - ["System", "Array", False, "Find<>", "(T[],System.Predicate<T>)", "", "Argument[0].Element", "ReturnValue", "value", "manual"]

csharp/ql/lib/qlpack.yml

@@ -1,12 +1,11 @@
 name: codeql/csharp-all
-version: 0.6.4-dev
+version: 0.6.3-dev
 groups: csharp
 dbscheme: semmlecode.csharp.dbscheme
 extractor: csharp
 library: true
 upgrades: upgrades
 dependencies:
-  codeql/mad: ${workspace}
   codeql/ssa: ${workspace}
   codeql/tutorial: ${workspace}
   codeql/util: ${workspace}

csharp/ql/lib/semmle/code/csharp/dataflow/ExternalFlow.qll

@@ -62,8 +62,8 @@
  *      in the given range. The range is inclusive at both ends.
  *    - "ReturnValue": Selects the return value of a call to the selected element.
  *
- *    For summaries, `input` and `output` may be suffixed by any number of the
- *    following, separated by ".":
+ *    For summaries, `input` and `output` may be prefixed by one of the following,
+ *    separated by the "of" keyword:
  *    - "Element": Selects an element in a collection.
  *    - "Field[f]": Selects the contents of field `f`.
  *    - "Property[p]": Selects the contents of property `p`.
@@ -95,7 +95,6 @@ private import internal.DataFlowPublic
 private import internal.FlowSummaryImpl::Public
 private import internal.FlowSummaryImpl::Private::External
 private import internal.FlowSummaryImplSpecific
-private import codeql.mad.ModelValidation as SharedModelVal
 
 /** Holds if a source model exists for the given parameters. */
 predicate sourceModel = Extensions::sourceModel/9;
@@ -205,18 +204,30 @@ module ModelValidation {
     )
   }
 
-  private module KindValConfig implements SharedModelVal::KindValidationConfigSig {
-    predicate summaryKind(string kind) { summaryModel(_, _, _, _, _, _, _, _, kind, _) }
-
-    predicate sinkKind(string kind) { sinkModel(_, _, _, _, _, _, _, kind, _) }
-
-    predicate sourceKind(string kind) { sourceModel(_, _, _, _, _, _, _, kind, _) }
-
-    predicate neutralKind(string kind) { neutralModel(_, _, _, _, kind, _) }
+  private string getInvalidModelKind() {
+    exists(string kind | summaryModel(_, _, _, _, _, _, _, _, kind, _) |
+      not kind = ["taint", "value"] and
+      result = "Invalid kind \"" + kind + "\" in summary model."
+    )
+    or
+    exists(string kind | sinkModel(_, _, _, _, _, _, _, kind, _) |
+      not kind =
+        ["code-injection", "sql-injection", "js-injection", "html-injection", "file-content-store"] and
+      not kind.matches("encryption-%") and
+      result = "Invalid kind \"" + kind + "\" in sink model."
+    )
+    or
+    exists(string kind | sourceModel(_, _, _, _, _, _, _, kind, _) |
+      not kind = ["local", "remote", "file", "file-write"] and
+      result = "Invalid kind \"" + kind + "\" in source model."
+    )
+    or
+    exists(string kind | neutralModel(_, _, _, _, kind, _) |
+      not kind = ["summary", "source", "sink"] and
+      result = "Invalid kind \"" + kind + "\" in neutral model."
+    )
   }
 
-  private module KindVal = SharedModelVal::KindValidation<KindValConfig>;
-
   private string getInvalidModelSignature() {
     exists(
       string pred, string namespace, string type, string name, string signature, string ext,
@@ -258,7 +269,7 @@ module ModelValidation {
     msg =
       [
         getInvalidModelSignature(), getInvalidModelInput(), getInvalidModelOutput(),
-        KindVal::getInvalidModelKind()
+        getInvalidModelKind()
       ]
   }
 }

csharp/ql/lib/semmle/code/csharp/dataflow/FlowSummary.qll

@@ -64,9 +64,14 @@ module SummaryComponent {
   /** Gets a summary component that represents the return value of a call. */
   SummaryComponent return() { result = return(any(DataFlowDispatch::NormalReturnKind rk)) }
 
-  predicate syntheticGlobal = SummaryComponentInternal::syntheticGlobal/1;
-
-  class SyntheticGlobal = SummaryComponentInternal::SyntheticGlobal;
+  /** Gets a summary component that represents a jump to `c`. */
+  SummaryComponent jump(Callable c) {
+    result =
+      return(any(DataFlowDispatch::JumpReturnKind jrk |
+          jrk.getTarget() = c.getUnboundDeclaration() and
+          jrk.getTargetReturnKind() instanceof DataFlowDispatch::NormalReturnKind
+        ))
+  }
 }
 
 class SummaryComponentStack = Impl::Public::SummaryComponentStack;
@@ -105,13 +110,8 @@ module SummaryComponentStack {
   /** Gets a singleton stack representing the return value of a call. */
   SummaryComponentStack return() { result = singleton(SummaryComponent::return()) }
 
-  /** Gets a singleton stack representing a synthetic global with name `name`. */
-  SummaryComponentStack syntheticGlobal(string synthetic) {
-    result = singleton(SummaryComponent::syntheticGlobal(synthetic))
-  }
-
-  /** Gets a textual representation of this stack used for flow summaries. */
-  string getComponentStack(SummaryComponentStack s) { result = Impl::Public::getComponentStack(s) }
+  /** Gets a singleton stack representing a jump to `c`. */
+  SummaryComponentStack jump(Callable c) { result = singleton(SummaryComponent::jump(c)) }
 }
 
 class SummarizedCallable = Impl::Public::SummarizedCallable;

csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowDispatch.qll

@@ -74,6 +74,18 @@ newtype TReturnKind =
     exists(Ssa::ExplicitDefinition def | def.isCapturedVariableDefinitionFlowOut(_, _) |
       v = def.getSourceVariable().getAssignable()
     )
+  } or
+  TJumpReturnKind(Callable target, ReturnKind rk) {
+    target.isUnboundDeclaration() and
+    (
+      rk instanceof NormalReturnKind and
+      (
+        target instanceof Constructor or
+        not target.getReturnType() instanceof VoidType
+      )
+      or
+      exists(target.getParameter(rk.(OutRefReturnKind).getPosition()))
+    )
   }
 
 /**
@@ -116,9 +128,7 @@ private module Cached {
       // No need to include calls that are compiled from source
       not call.getImplementation().getMethod().compiledFromSource()
     } or
-    TSummaryCall(
-      FlowSummaryImpl::Public::SummarizedCallable c, FlowSummaryImpl::Private::SummaryNode receiver
-    ) {
+    TSummaryCall(FlowSummaryImpl::Public::SummarizedCallable c, Node receiver) {
       FlowSummaryImpl::Private::summaryCallbackRange(c, receiver)
     }
 
@@ -245,6 +255,27 @@ class ImplicitCapturedReturnKind extends ReturnKind, TImplicitCapturedReturnKind
   override string toString() { result = "captured " + v }
 }
 
+/**
+ * A value returned through the output of another callable.
+ *
+ * This is currently only used to model flow summaries where data may flow into
+ * one API entry point and out of another.
+ */
+class JumpReturnKind extends ReturnKind, TJumpReturnKind {
+  private Callable target;
+  private ReturnKind rk;
+
+  JumpReturnKind() { this = TJumpReturnKind(target, rk) }
+
+  /** Gets the target of the jump. */
+  Callable getTarget() { result = target }
+
+  /** Gets the return kind of the target. */
+  ReturnKind getTargetReturnKind() { result = rk }
+
+  override string toString() { result = "jump to " + target }
+}
+
 /** A callable used for data flow. */
 class DataFlowCallable extends TDataFlowCallable {
   /** Get the underlying source code callable, if any. */
@@ -441,12 +472,12 @@ class CilDataFlowCall extends DataFlowCall, TCilCall {
  */
 class SummaryCall extends DelegateDataFlowCall, TSummaryCall {
   private FlowSummaryImpl::Public::SummarizedCallable c;
-  private FlowSummaryImpl::Private::SummaryNode receiver;
+  private Node receiver;
 
   SummaryCall() { this = TSummaryCall(c, receiver) }
 
   /** Gets the data flow node that this call targets. */
-  FlowSummaryImpl::Private::SummaryNode getReceiver() { result = receiver }
+  Node getReceiver() { result = receiver }
 
   override DataFlowCallable getARuntimeTarget() {
     none() // handled by the shared library

csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl.qll

@@ -2021,8 +2021,7 @@ module Impl<FullStateConfigSig Config> {
       FlowCheckNode() {
         castNode(this.asNode()) or
         clearsContentCached(this.asNode(), _) or
-        expectsContentCached(this.asNode(), _) or
-        neverSkipInPathGraph(this.asNode())
+        expectsContentCached(this.asNode(), _)
       }
     }
 

csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll

@@ -500,7 +500,7 @@ module LocalFlow {
    * inter-procedurality or field-sensitivity.
    */
   predicate excludeFromExposedRelations(Node n) {
-    n instanceof FlowSummaryNode or
+    n instanceof SummaryNode or
     n instanceof ImplicitCapturedArgumentNode
   }
 
@@ -559,8 +559,7 @@ predicate simpleLocalFlowStep(Node nodeFrom, Node nodeTo) {
   or
   LocalFlow::localFlowCapturedVarStep(nodeFrom, nodeTo)
   or
-  FlowSummaryImpl::Private::Steps::summaryLocalStep(nodeFrom.(FlowSummaryNode).getSummaryNode(),
-    nodeTo.(FlowSummaryNode).getSummaryNode(), true)
+  FlowSummaryImpl::Private::Steps::summaryLocalStep(nodeFrom, nodeTo, true)
   or
   nodeTo.(ObjectCreationNode).getPreUpdateNode() = nodeFrom.(ObjectInitializerNode)
 }
@@ -806,8 +805,7 @@ private module Cached {
 
   // Add artificial dependencies to enforce all cached predicates are evaluated
   // in the "DataFlowImplCommon stage"
-  cached
-  predicate forceCaching() {
+  private predicate forceCaching() {
     TaintTrackingPrivate::forceCachingInSameStage() or
     exists(any(NodeImpl n).getTypeImpl()) or
     exists(any(NodeImpl n).getControlFlowNodeImpl()) or
@@ -817,7 +815,10 @@ private module Cached {
 
   cached
   newtype TNode =
-    TExprNode(ControlFlow::Nodes::ElementNode cfn) { cfn.getElement() instanceof Expr } or
+    TExprNode(ControlFlow::Nodes::ElementNode cfn) {
+      forceCaching() and
+      cfn.getElement() instanceof Expr
+    } or
     TCilExprNode(CIL::Expr e) { e.getImplementation() instanceof CIL::BestImplementation } or
     TCilSsaDefinitionExtNode(CilSsaImpl::DefinitionExt def) or
     TSsaDefinitionExtNode(SsaImpl::DefinitionExt def) {
@@ -866,7 +867,12 @@ private module Cached {
         )
       )
     } or
-    TFlowSummaryNode(FlowSummaryImpl::Private::SummaryNode sn) or
+    TSummaryNode(DataFlowSummarizedCallable c, FlowSummaryImpl::Private::SummaryNodeState state) {
+      FlowSummaryImpl::Private::summaryNodeRange(c, state)
+    } or
+    TSummaryParameterNode(DataFlowSummarizedCallable c, ParameterPosition pos) {
+      FlowSummaryImpl::Private::summaryParameterNodeRange(c, pos)
+    } or
     TParamsArgumentNode(ControlFlow::Node callCfn) {
       callCfn = any(Call c | isParamsArg(c, _, _)).getAControlFlowNode()
     }
@@ -971,7 +977,9 @@ predicate nodeIsHidden(Node n) {
   or
   n instanceof MallocNode
   or
-  n instanceof FlowSummaryNode
+  n instanceof SummaryNode
+  or
+  n instanceof SummaryParameterNode
   or
   n instanceof ParamsArgumentNode
   or
@@ -1124,16 +1132,29 @@ private module ParameterNodes {
   }
 
   /** A parameter for a library callable with a flow summary. */
-  class SummaryParameterNode extends ParameterNodeImpl, FlowSummaryNode {
+  class SummaryParameterNode extends ParameterNodeImpl, TSummaryParameterNode {
+    private FlowSummaryImpl::Public::SummarizedCallable sc;
     private ParameterPosition pos_;
 
-    SummaryParameterNode() {
-      FlowSummaryImpl::Private::summaryParameterNode(this.getSummaryNode(), pos_)
-    }
+    SummaryParameterNode() { this = TSummaryParameterNode(sc, pos_) }
 
     override predicate isParameterOf(DataFlowCallable c, ParameterPosition pos) {
-      this.getSummarizedCallable() = c.asSummarizedCallable() and pos = pos_
+      sc = c.asSummarizedCallable() and pos = pos_
     }
+
+    override DataFlowCallable getEnclosingCallableImpl() { result.asSummarizedCallable() = sc }
+
+    override Type getTypeImpl() {
+      exists(int i | pos_.getPosition() = i and result = sc.getParameter(i).getType())
+      or
+      pos_.isThisParameter() and result = sc.getDeclaringType()
+    }
+
+    override ControlFlow::Node getControlFlowNodeImpl() { none() }
+
+    override EmptyLocation getLocationImpl() { any() }
+
+    override string toStringImpl() { result = "parameter " + pos_ + " of " + sc }
   }
 }
 
@@ -1302,16 +1323,11 @@ private module ArgumentNodes {
     override string toStringImpl() { result = "[implicit array creation] " + callCfn }
   }
 
-  private class SummaryArgumentNode extends FlowSummaryNode, ArgumentNodeImpl {
-    private DataFlowCall call_;
-    private ArgumentPosition pos_;
-
-    SummaryArgumentNode() {
-      FlowSummaryImpl::Private::summaryArgumentNode(call_, this.getSummaryNode(), pos_)
-    }
+  private class SummaryArgumentNode extends SummaryNode, ArgumentNodeImpl {
+    SummaryArgumentNode() { FlowSummaryImpl::Private::summaryArgumentNode(_, this, _) }
 
     override predicate argumentOf(DataFlowCall call, ArgumentPosition pos) {
-      call = call_ and pos = pos_
+      FlowSummaryImpl::Private::summaryArgumentNode(call, this, pos)
     }
   }
 }
@@ -1453,11 +1469,12 @@ private module ReturnNodes {
     }
   }
 
-  private class SummaryReturnNode extends FlowSummaryNode, ReturnNode {
+  private class SummaryReturnNode extends SummaryNode, ReturnNode {
     private ReturnKind rk;
 
     SummaryReturnNode() {
-      FlowSummaryImpl::Private::summaryReturnNode(this.getSummaryNode(), rk)
+      FlowSummaryImpl::Private::summaryReturnNode(this, rk) and
+      not rk instanceof JumpReturnKind
       or
       exists(Parameter p, int pos |
         summaryPostUpdateNodeIsOutOrRef(this, p) and
@@ -1477,9 +1494,9 @@ private module ReturnNodes {
  * Holds if summary node `n` is a post-update node for `out`/`ref` parameter `p`.
  * In this case we adjust it to instead be a return node.
  */
-private predicate summaryPostUpdateNodeIsOutOrRef(FlowSummaryNode n, Parameter p) {
-  exists(SummaryParameterNode pn, DataFlowCallable c, ParameterPosition pos |
-    FlowSummaryImpl::Private::summaryPostUpdateNode(n.getSummaryNode(), pn.getSummaryNode()) and
+private predicate summaryPostUpdateNodeIsOutOrRef(SummaryNode n, Parameter p) {
+  exists(ParameterNodeImpl pn, DataFlowCallable c, ParameterPosition pos |
+    FlowSummaryImpl::Private::summaryPostUpdateNode(n, pn) and
     pn.isParameterOf(c, pos) and
     p = c.asSummarizedCallable().getParameter(pos.getPosition()) and
     p.isOutOrRef()
@@ -1592,43 +1609,37 @@ private module OutNodes {
     }
   }
 
-  private class SummaryOutNode extends FlowSummaryNode, OutNode {
-    private DataFlowCall call;
-    private ReturnKind kind_;
+  private class SummaryOutNode extends SummaryNode, OutNode {
+    SummaryOutNode() { FlowSummaryImpl::Private::summaryOutNode(_, this, _) }
 
-    SummaryOutNode() {
-      FlowSummaryImpl::Private::summaryOutNode(call, this.getSummaryNode(), kind_)
+    override DataFlowCall getCall(ReturnKind kind) {
+      FlowSummaryImpl::Private::summaryOutNode(result, this, kind)
     }
-
-    override DataFlowCall getCall(ReturnKind kind) { result = call and kind = kind_ }
   }
 }
 
 import OutNodes
 
 /** A data-flow node used to model flow summaries. */
-class FlowSummaryNode extends NodeImpl, TFlowSummaryNode {
-  FlowSummaryImpl::Private::SummaryNode getSummaryNode() { this = TFlowSummaryNode(result) }
+class SummaryNode extends NodeImpl, TSummaryNode {
+  private FlowSummaryImpl::Public::SummarizedCallable c;
+  private FlowSummaryImpl::Private::SummaryNodeState state;
 
-  FlowSummaryImpl::Public::SummarizedCallable getSummarizedCallable() {
-    result = this.getSummaryNode().getSummarizedCallable()
-  }
+  SummaryNode() { this = TSummaryNode(c, state) }
 
-  override DataFlowCallable getEnclosingCallableImpl() {
-    result.asSummarizedCallable() = this.getSummarizedCallable()
-  }
+  override DataFlowCallable getEnclosingCallableImpl() { result.asSummarizedCallable() = c }
 
   override DataFlowType getDataFlowType() {
-    result = FlowSummaryImpl::Private::summaryNodeType(this.getSummaryNode())
+    result = FlowSummaryImpl::Private::summaryNodeType(this)
   }
 
   override DotNet::Type getTypeImpl() { none() }
 
   override ControlFlow::Node getControlFlowNodeImpl() { none() }
 
-  override Location getLocationImpl() { result = this.getSummarizedCallable().getLocation() }
+  override Location getLocationImpl() { result = c.getLocation() }
 
-  override string toStringImpl() { result = this.getSummaryNode().toString() }
+  override string toStringImpl() { result = "[summary] " + state + " in " + c }
 }
 
 /** A field or a property. */
@@ -1707,8 +1718,13 @@ predicate jumpStep(Node pred, Node succ) {
     flr.hasNonlocalValue()
   )
   or
-  FlowSummaryImpl::Private::Steps::summaryJumpStep(pred.(FlowSummaryNode).getSummaryNode(),
-    succ.(FlowSummaryNode).getSummaryNode())
+  exists(JumpReturnKind jrk, NonDelegateDataFlowCall call |
+    FlowSummaryImpl::Private::summaryReturnNode(pred, jrk) and
+    jrk.getTarget() = call.getATarget(_) and
+    succ = getAnOutNode(call, jrk.getTargetReturnKind())
+  )
+  or
+  FlowSummaryImpl::Private::Steps::summaryJumpStep(pred, succ)
 }
 
 private class StoreStepConfiguration extends ControlFlowReachabilityConfiguration {
@@ -1768,8 +1784,7 @@ predicate storeStep(Node node1, Content c, Node node2) {
     c = getResultContent()
   )
   or
-  FlowSummaryImpl::Private::Steps::summaryStoreStep(node1.(FlowSummaryNode).getSummaryNode(), c,
-    node2.(FlowSummaryNode).getSummaryNode())
+  FlowSummaryImpl::Private::Steps::summaryStoreStep(node1, c, node2)
 }
 
 private class ReadStepConfiguration extends ControlFlowReachabilityConfiguration {
@@ -1892,8 +1907,7 @@ predicate readStep(Node node1, Content c, Node node2) {
     )
   )
   or
-  FlowSummaryImpl::Private::Steps::summaryReadStep(node1.(FlowSummaryNode).getSummaryNode(), c,
-    node2.(FlowSummaryNode).getSummaryNode())
+  FlowSummaryImpl::Private::Steps::summaryReadStep(node1, c, node2)
 }
 
 /**
@@ -1906,7 +1920,7 @@ predicate clearsContent(Node n, Content c) {
   or
   fieldOrPropertyStore(_, c, _, n.(ObjectInitializerNode).getInitializer(), false)
   or
-  FlowSummaryImpl::Private::Steps::summaryClearsContent(n.(FlowSummaryNode).getSummaryNode(), c)
+  FlowSummaryImpl::Private::Steps::summaryClearsContent(n, c)
   or
   exists(WithExpr we, ObjectInitializer oi, FieldOrProperty f |
     oi = we.getInitializer() and
@@ -1921,7 +1935,7 @@ predicate clearsContent(Node n, Content c) {
  * at node `n`.
  */
 predicate expectsContent(Node n, ContentSet c) {
-  FlowSummaryImpl::Private::Steps::summaryExpectsContent(n.(FlowSummaryNode).getSummaryNode(), c)
+  FlowSummaryImpl::Private::Steps::summaryExpectsContent(n, c)
 }
 
 /**
@@ -2116,15 +2130,15 @@ private module PostUpdateNodes {
     override string toStringImpl() { result = "[post] " + cfn.toString() }
   }
 
-  private class SummaryPostUpdateNode extends FlowSummaryNode, PostUpdateNode {
-    private FlowSummaryImpl::Private::SummaryNode preUpdateNode;
-
+  private class SummaryPostUpdateNode extends SummaryNode, PostUpdateNode {
     SummaryPostUpdateNode() {
-      FlowSummaryImpl::Private::summaryPostUpdateNode(this.getSummaryNode(), preUpdateNode) and
+      FlowSummaryImpl::Private::summaryPostUpdateNode(this, _) and
       not summaryPostUpdateNodeIsOutOrRef(this, _)
     }
 
-    override Node getPreUpdateNode() { result.(FlowSummaryNode).getSummaryNode() = preUpdateNode }
+    override Node getPreUpdateNode() {
+      FlowSummaryImpl::Private::summaryPostUpdateNode(this, result)
+    }
   }
 }
 
@@ -2140,12 +2154,6 @@ class CastNode extends Node {
   }
 }
 
-/**
- * Holds if `n` should never be skipped over in the `PathGraph` and in path
- * explanations.
- */
-predicate neverSkipInPathGraph(Node n) { none() }
-
 class DataFlowExpr = DotNet::Expr;
 
 /** Holds if `e` is an expression that always has the same Boolean value `val`. */
@@ -2225,7 +2233,7 @@ predicate lambdaCall(DataFlowCall call, LambdaCallKind kind, Node receiver) {
         call.getControlFlowNode())
     )
     or
-    receiver.(FlowSummaryNode).getSummaryNode() = call.(SummaryCall).getReceiver()
+    receiver = call.(SummaryCall).getReceiver()
   ) and
   exists(kind)
 }

csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll

@@ -180,11 +180,6 @@ module Public {
       result = "Argument[" + getParameterPosition(pos) + "]"
     )
     or
-    exists(string synthetic |
-      sc = TSyntheticGlobalSummaryComponent(synthetic) and
-      result = "SyntheticGlobal[" + synthetic + "]"
-    )
-    or
     sc = TReturnSummaryComponent(getReturnValueKind()) and result = "ReturnValue"
   }
 
@@ -510,9 +505,6 @@ module Private {
     or
     // Add the post-update node corresponding to the requested argument node
     outputState(c, s) and isCallbackParameter(s)
-    or
-    // Add the parameter node for parameter side-effects
-    outputState(c, s) and s = SummaryComponentStack::argument(_)
   }
 
   private newtype TSummaryNodeState =
@@ -538,7 +530,7 @@ module Private {
    *   this state represents that the components in `s` _remain to be written_ to
    *   the output.
    */
-  private class SummaryNodeState extends TSummaryNodeState {
+  class SummaryNodeState extends TSummaryNodeState {
     /** Holds if this state is a valid input state for `c`. */
     pragma[nomagic]
     predicate isInputState(SummarizedCallable c, SummaryComponentStack s) {
@@ -567,42 +559,6 @@ module Private {
     }
   }
 
-  private newtype TSummaryNode =
-    TSummaryInternalNode(SummarizedCallable c, SummaryNodeState state) {
-      summaryNodeRange(c, state)
-    } or
-    TSummaryParameterNode(SummarizedCallable c, ParameterPosition pos) {
-      summaryParameterNodeRange(c, pos)
-    }
-
-  abstract class SummaryNode extends TSummaryNode {
-    abstract string toString();
-
-    abstract SummarizedCallable getSummarizedCallable();
-  }
-
-  private class SummaryInternalNode extends SummaryNode, TSummaryInternalNode {
-    private SummarizedCallable c;
-    private SummaryNodeState state;
-
-    SummaryInternalNode() { this = TSummaryInternalNode(c, state) }
-
-    override string toString() { result = "[summary] " + state + " in " + c }
-
-    override SummarizedCallable getSummarizedCallable() { result = c }
-  }
-
-  private class SummaryParamNode extends SummaryNode, TSummaryParameterNode {
-    private SummarizedCallable c;
-    private ParameterPosition pos;
-
-    SummaryParamNode() { this = TSummaryParameterNode(c, pos) }
-
-    override string toString() { result = "[summary param] " + pos + " in " + c }
-
-    override SummarizedCallable getSummarizedCallable() { result = c }
-  }
-
   /**
    * Holds if `state` represents having read from a parameter at position
    * `pos` in `c`. In this case we are not synthesizing a data-flow node,
@@ -618,7 +574,7 @@ module Private {
    * Holds if a synthesized summary node is needed for the state `state` in summarized
    * callable `c`.
    */
-  private predicate summaryNodeRange(SummarizedCallable c, SummaryNodeState state) {
+  predicate summaryNodeRange(SummarizedCallable c, SummaryNodeState state) {
     state.isInputState(c, _) and
     not parameterReadState(c, state, _)
     or
@@ -626,22 +582,22 @@ module Private {
   }
 
   pragma[noinline]
-  private SummaryNode summaryNodeInputState(SummarizedCallable c, SummaryComponentStack s) {
+  private Node summaryNodeInputState(SummarizedCallable c, SummaryComponentStack s) {
     exists(SummaryNodeState state | state.isInputState(c, s) |
-      result = TSummaryInternalNode(c, state)
+      result = summaryNode(c, state)
       or
       exists(ParameterPosition pos |
         parameterReadState(c, state, pos) and
-        result = TSummaryParameterNode(c, pos)
+        result.(ParamNode).isParameterOf(inject(c), pos)
       )
     )
   }
 
   pragma[noinline]
-  private SummaryNode summaryNodeOutputState(SummarizedCallable c, SummaryComponentStack s) {
+  private Node summaryNodeOutputState(SummarizedCallable c, SummaryComponentStack s) {
     exists(SummaryNodeState state |
       state.isOutputState(c, s) and
-      result = TSummaryInternalNode(c, state)
+      result = summaryNode(c, state)
     )
   }
 
@@ -649,14 +605,12 @@ module Private {
    * Holds if a write targets `post`, which is a post-update node for a
    * parameter at position `pos` in `c`.
    */
-  private predicate isParameterPostUpdate(
-    SummaryNode post, SummarizedCallable c, ParameterPosition pos
-  ) {
+  private predicate isParameterPostUpdate(Node post, SummarizedCallable c, ParameterPosition pos) {
     post = summaryNodeOutputState(c, SummaryComponentStack::argument(pos))
   }
 
   /** Holds if a parameter node at position `pos` is required for `c`. */
-  private predicate summaryParameterNodeRange(SummarizedCallable c, ParameterPosition pos) {
+  predicate summaryParameterNodeRange(SummarizedCallable c, ParameterPosition pos) {
     parameterReadState(c, _, pos)
     or
     // Same as `isParameterPostUpdate(_, c, pos)`, but can be used in a negative context
@@ -664,7 +618,7 @@ module Private {
   }
 
   private predicate callbackOutput(
-    SummarizedCallable c, SummaryComponentStack s, SummaryNode receiver, ReturnKind rk
+    SummarizedCallable c, SummaryComponentStack s, Node receiver, ReturnKind rk
   ) {
     any(SummaryNodeState state).isInputState(c, s) and
     s.head() = TReturnSummaryComponent(rk) and
@@ -672,7 +626,7 @@ module Private {
   }
 
   private predicate callbackInput(
-    SummarizedCallable c, SummaryComponentStack s, SummaryNode receiver, ArgumentPosition pos
+    SummarizedCallable c, SummaryComponentStack s, Node receiver, ArgumentPosition pos
   ) {
     any(SummaryNodeState state).isOutputState(c, s) and
     s.head() = TParameterSummaryComponent(pos) and
@@ -680,7 +634,7 @@ module Private {
   }
 
   /** Holds if a call targeting `receiver` should be synthesized inside `c`. */
-  predicate summaryCallbackRange(SummarizedCallable c, SummaryNode receiver) {
+  predicate summaryCallbackRange(SummarizedCallable c, Node receiver) {
     callbackOutput(c, _, receiver, _)
     or
     callbackInput(c, _, receiver, _)
@@ -693,10 +647,10 @@ module Private {
    * `getContentType()`, `getReturnType()`, `getCallbackParameterType()`, and
    * `getCallbackReturnType()`.
    */
-  DataFlowType summaryNodeType(SummaryNode n) {
-    exists(SummaryNode pre |
+  DataFlowType summaryNodeType(Node n) {
+    exists(Node pre |
       summaryPostUpdateNode(n, pre) and
-      result = summaryNodeType(pre)
+      result = getNodeType(pre)
     )
     or
     exists(SummarizedCallable c, SummaryComponentStack s, SummaryComponent head | head = s.head() |
@@ -708,12 +662,12 @@ module Private {
         )
         or
         head = TWithoutContentSummaryComponent(_) and
-        result = summaryNodeType(summaryNodeInputState(c, s.tail()))
+        result = getNodeType(summaryNodeInputState(c, s.tail()))
         or
         exists(ReturnKind rk |
           head = TReturnSummaryComponent(rk) and
           result =
-            getCallbackReturnType(summaryNodeType(summaryNodeInputState(pragma[only_bind_out](c),
+            getCallbackReturnType(getNodeType(summaryNodeInputState(pragma[only_bind_out](c),
                   s.tail())), rk)
         )
         or
@@ -721,11 +675,6 @@ module Private {
           head = TSyntheticGlobalSummaryComponent(sg) and
           result = getSyntheticGlobalType(sg)
         )
-        or
-        exists(ParameterPosition pos |
-          head = TArgumentSummaryComponent(pos) and
-          result = getParameterType(c, pos)
-        )
       )
       or
       n = summaryNodeOutputState(c, s) and
@@ -742,7 +691,7 @@ module Private {
         or
         exists(ArgumentPosition pos | head = TParameterSummaryComponent(pos) |
           result =
-            getCallbackParameterType(summaryNodeType(summaryNodeInputState(pragma[only_bind_out](c),
+            getCallbackParameterType(getNodeType(summaryNodeInputState(pragma[only_bind_out](c),
                   s.tail())), pos)
         )
         or
@@ -754,14 +703,9 @@ module Private {
     )
   }
 
-  /** Holds if summary node `p` is a parameter with position `pos`. */
-  predicate summaryParameterNode(SummaryNode p, ParameterPosition pos) {
-    p = TSummaryParameterNode(_, pos)
-  }
-
   /** Holds if summary node `out` contains output of kind `rk` from call `c`. */
-  predicate summaryOutNode(DataFlowCall c, SummaryNode out, ReturnKind rk) {
-    exists(SummarizedCallable callable, SummaryComponentStack s, SummaryNode receiver |
+  predicate summaryOutNode(DataFlowCall c, Node out, ReturnKind rk) {
+    exists(SummarizedCallable callable, SummaryComponentStack s, Node receiver |
       callbackOutput(callable, s, receiver, rk) and
       out = summaryNodeInputState(callable, s) and
       c = summaryDataFlowCall(receiver)
@@ -769,8 +713,8 @@ module Private {
   }
 
   /** Holds if summary node `arg` is at position `pos` in the call `c`. */
-  predicate summaryArgumentNode(DataFlowCall c, SummaryNode arg, ArgumentPosition pos) {
-    exists(SummarizedCallable callable, SummaryComponentStack s, SummaryNode receiver |
+  predicate summaryArgumentNode(DataFlowCall c, Node arg, ArgumentPosition pos) {
+    exists(SummarizedCallable callable, SummaryComponentStack s, Node receiver |
       callbackInput(callable, s, receiver, pos) and
       arg = summaryNodeOutputState(callable, s) and
       c = summaryDataFlowCall(receiver)
@@ -778,10 +722,10 @@ module Private {
   }
 
   /** Holds if summary node `post` is a post-update node with pre-update node `pre`. */
-  predicate summaryPostUpdateNode(SummaryNode post, SummaryNode pre) {
+  predicate summaryPostUpdateNode(Node post, Node pre) {
     exists(SummarizedCallable c, ParameterPosition pos |
       isParameterPostUpdate(post, c, pos) and
-      pre = TSummaryParameterNode(c, pos)
+      pre.(ParamNode).isParameterOf(inject(c), pos)
     )
     or
     exists(SummarizedCallable callable, SummaryComponentStack s |
@@ -792,7 +736,7 @@ module Private {
   }
 
   /** Holds if summary node `ret` is a return node of kind `rk`. */
-  predicate summaryReturnNode(SummaryNode ret, ReturnKind rk) {
+  predicate summaryReturnNode(Node ret, ReturnKind rk) {
     exists(SummaryComponentStack s |
       ret = summaryNodeOutputState(_, s) and
       s = TSingletonSummaryComponentStack(TReturnSummaryComponent(rk))
@@ -804,9 +748,7 @@ module Private {
    * node, and back out to `p`.
    */
   predicate summaryAllowParameterReturnInSelf(ParamNode p) {
-    exists(SummarizedCallable c, ParameterPosition ppos |
-      p.isParameterOf(inject(c), pragma[only_bind_into](ppos))
-    |
+    exists(SummarizedCallable c, ParameterPosition ppos | p.isParameterOf(inject(c), ppos) |
       exists(SummaryComponentStack inputContents, SummaryComponentStack outputContents |
         summary(c, inputContents, outputContents, _) and
         inputContents.bottom() = pragma[only_bind_into](TArgumentSummaryComponent(ppos)) and
@@ -821,7 +763,7 @@ module Private {
      * Holds if there is a local step from `pred` to `succ`, which is synthesized
      * from a flow summary.
      */
-    predicate summaryLocalStep(SummaryNode pred, SummaryNode succ, boolean preservesValue) {
+    predicate summaryLocalStep(Node pred, Node succ, boolean preservesValue) {
       exists(
         SummarizedCallable c, SummaryComponentStack inputContents,
         SummaryComponentStack outputContents
@@ -847,7 +789,7 @@ module Private {
      * Holds if there is a read step of content `c` from `pred` to `succ`, which
      * is synthesized from a flow summary.
      */
-    predicate summaryReadStep(SummaryNode pred, ContentSet c, SummaryNode succ) {
+    predicate summaryReadStep(Node pred, ContentSet c, Node succ) {
       exists(SummarizedCallable sc, SummaryComponentStack s |
         pred = summaryNodeInputState(sc, s.tail()) and
         succ = summaryNodeInputState(sc, s) and
@@ -859,7 +801,7 @@ module Private {
      * Holds if there is a store step of content `c` from `pred` to `succ`, which
      * is synthesized from a flow summary.
      */
-    predicate summaryStoreStep(SummaryNode pred, ContentSet c, SummaryNode succ) {
+    predicate summaryStoreStep(Node pred, ContentSet c, Node succ) {
       exists(SummarizedCallable sc, SummaryComponentStack s |
         pred = summaryNodeOutputState(sc, s) and
         succ = summaryNodeOutputState(sc, s.tail()) and
@@ -871,7 +813,7 @@ module Private {
      * Holds if there is a jump step from `pred` to `succ`, which is synthesized
      * from a flow summary.
      */
-    predicate summaryJumpStep(SummaryNode pred, SummaryNode succ) {
+    predicate summaryJumpStep(Node pred, Node succ) {
       exists(SummaryComponentStack s |
         s = SummaryComponentStack::singleton(SummaryComponent::syntheticGlobal(_)) and
         pred = summaryNodeOutputState(_, s) and
@@ -898,9 +840,9 @@ module Private {
      * `a` on line 2 to the post-update node for `a` on that line (via an intermediate
      * node where field `b` is cleared).
      */
-    predicate summaryClearsContent(SummaryNode n, ContentSet c) {
+    predicate summaryClearsContent(Node n, ContentSet c) {
       exists(SummarizedCallable sc, SummaryNodeState state, SummaryComponentStack stack |
-        n = TSummaryInternalNode(sc, state) and
+        n = summaryNode(sc, state) and
         state.isInputState(sc, stack) and
         stack.head() = SummaryComponent::withoutContent(c)
       )
@@ -910,9 +852,9 @@ module Private {
      * Holds if the value that is being tracked is expected to be stored inside
      * content `c` at `n`.
      */
-    predicate summaryExpectsContent(SummaryNode n, ContentSet c) {
+    predicate summaryExpectsContent(Node n, ContentSet c) {
       exists(SummarizedCallable sc, SummaryNodeState state, SummaryComponentStack stack |
-        n = TSummaryInternalNode(sc, state) and
+        n = summaryNode(sc, state) and
         state.isInputState(sc, stack) and
         stack.head() = SummaryComponent::withContent(c)
       )
@@ -920,17 +862,17 @@ module Private {
 
     pragma[noinline]
     private predicate viableParam(
-      DataFlowCall call, SummarizedCallable sc, ParameterPosition ppos, SummaryParamNode p
+      DataFlowCall call, SummarizedCallable sc, ParameterPosition ppos, ParamNode p
     ) {
       exists(DataFlowCallable c |
         c = inject(sc) and
-        p = TSummaryParameterNode(sc, ppos) and
+        p.isParameterOf(c, ppos) and
         c = viableCallable(call)
       )
     }
 
     pragma[nomagic]
-    private SummaryParamNode summaryArgParam(DataFlowCall call, ArgNode arg, SummarizedCallable sc) {
+    private ParamNode summaryArgParam0(DataFlowCall call, ArgNode arg, SummarizedCallable sc) {
       exists(ParameterPosition ppos |
         argumentPositionMatch(call, arg, ppos) and
         viableParam(call, sc, ppos, result)
@@ -942,12 +884,12 @@ module Private {
      * local steps. `clearsOrExpects` records whether any node on the path from `p` to
      * `n` either clears or expects contents.
      */
-    private predicate paramReachesLocal(SummaryParamNode p, SummaryNode n, boolean clearsOrExpects) {
+    private predicate paramReachesLocal(ParamNode p, Node n, boolean clearsOrExpects) {
       viableParam(_, _, _, p) and
       n = p and
       clearsOrExpects = false
       or
-      exists(SummaryNode mid, boolean clearsOrExpectsMid |
+      exists(Node mid, boolean clearsOrExpectsMid |
         paramReachesLocal(p, mid, clearsOrExpectsMid) and
         summaryLocalStep(mid, n, true) and
         if
@@ -967,33 +909,21 @@ module Private {
      */
     pragma[nomagic]
     predicate prohibitsUseUseFlow(ArgNode arg, SummarizedCallable sc) {
-      exists(SummaryParamNode p, ParameterPosition ppos, SummaryNode ret |
+      exists(ParamNode p, ParameterPosition ppos, Node ret |
         paramReachesLocal(p, ret, true) and
-        p = summaryArgParam(_, arg, sc) and
-        p = TSummaryParameterNode(_, pragma[only_bind_into](ppos)) and
+        p = summaryArgParam0(_, arg, sc) and
+        p.isParameterOf(_, pragma[only_bind_into](ppos)) and
         isParameterPostUpdate(ret, _, pragma[only_bind_into](ppos))
       )
     }
 
-    pragma[nomagic]
-    private predicate summaryReturnNodeExt(SummaryNode ret, ReturnKindExt rk) {
-      summaryReturnNode(ret, rk.(ValueReturnKind).getKind())
-      or
-      exists(SummaryParamNode p, SummaryNode pre, ParameterPosition pos |
-        paramReachesLocal(p, pre, _) and
-        summaryPostUpdateNode(ret, pre) and
-        p = TSummaryParameterNode(_, pos) and
-        rk.(ParamUpdateReturnKind).getPosition() = pos
-      )
-    }
-
     bindingset[ret]
-    private SummaryParamNode summaryArgParamRetOut(
-      ArgNode arg, SummaryNode ret, OutNodeExt out, SummarizedCallable sc
+    private ParamNode summaryArgParam(
+      ArgNode arg, ReturnNodeExt ret, OutNodeExt out, SummarizedCallable sc
     ) {
       exists(DataFlowCall call, ReturnKindExt rk |
-        result = summaryArgParam(call, arg, sc) and
-        summaryReturnNodeExt(ret, pragma[only_bind_into](rk)) and
+        result = summaryArgParam0(call, arg, sc) and
+        ret.getKind() = pragma[only_bind_into](rk) and
         out = pragma[only_bind_into](rk).getAnOutNode(call)
       )
     }
@@ -1006,9 +936,9 @@ module Private {
      * be useful to include in the exposed local data-flow/taint-tracking relations.
      */
     predicate summaryThroughStepValue(ArgNode arg, Node out, SummarizedCallable sc) {
-      exists(ReturnKind rk, SummaryNode ret, DataFlowCall call |
-        summaryLocalStep(summaryArgParam(call, arg, sc), ret, true) and
-        summaryReturnNode(ret, pragma[only_bind_into](rk)) and
+      exists(ReturnKind rk, ReturnNode ret, DataFlowCall call |
+        summaryLocalStep(summaryArgParam0(call, arg, sc), ret, true) and
+        ret.getKind() = pragma[only_bind_into](rk) and
         out = getAnOutNode(call, pragma[only_bind_into](rk))
       )
     }
@@ -1021,9 +951,7 @@ module Private {
      * be useful to include in the exposed local data-flow/taint-tracking relations.
      */
     predicate summaryThroughStepTaint(ArgNode arg, Node out, SummarizedCallable sc) {
-      exists(SummaryNode ret |
-        summaryLocalStep(summaryArgParamRetOut(arg, ret, out, sc), ret, false)
-      )
+      exists(ReturnNodeExt ret | summaryLocalStep(summaryArgParam(arg, ret, out, sc), ret, false))
     }
 
     /**
@@ -1034,8 +962,8 @@ module Private {
      * be useful to include in the exposed local data-flow/taint-tracking relations.
      */
     predicate summaryGetterStep(ArgNode arg, ContentSet c, Node out, SummarizedCallable sc) {
-      exists(SummaryNode mid, SummaryNode ret |
-        summaryReadStep(summaryArgParamRetOut(arg, ret, out, sc), c, mid) and
+      exists(Node mid, ReturnNodeExt ret |
+        summaryReadStep(summaryArgParam(arg, ret, out, sc), c, mid) and
         summaryLocalStep(mid, ret, _)
       )
     }
@@ -1048,8 +976,8 @@ module Private {
      * be useful to include in the exposed local data-flow/taint-tracking relations.
      */
     predicate summarySetterStep(ArgNode arg, ContentSet c, Node out, SummarizedCallable sc) {
-      exists(SummaryNode mid, SummaryNode ret |
-        summaryLocalStep(summaryArgParamRetOut(arg, ret, out, sc), mid, _) and
+      exists(Node mid, ReturnNodeExt ret |
+        summaryLocalStep(summaryArgParam(arg, ret, out, sc), mid, _) and
         summaryStoreStep(mid, c, ret)
       )
     }
@@ -1416,11 +1344,11 @@ module Private {
     }
 
     private newtype TNodeOrCall =
-      MkNode(SummaryNode n) {
+      MkNode(Node n) {
         exists(RelevantSummarizedCallable c |
-          n = TSummaryInternalNode(c, _)
+          n = summaryNode(c, _)
           or
-          n = TSummaryParameterNode(c, _)
+          n.(ParamNode).isParameterOf(inject(c), _)
         )
       } or
       MkCall(DataFlowCall call) {
@@ -1429,7 +1357,7 @@ module Private {
       }
 
     private class NodeOrCall extends TNodeOrCall {
-      SummaryNode asNode() { this = MkNode(result) }
+      Node asNode() { this = MkNode(result) }
 
       DataFlowCall asCall() { this = MkCall(result) }
 
@@ -1449,11 +1377,9 @@ module Private {
       predicate hasLocationInfo(
         string filepath, int startline, int startcolumn, int endline, int endcolumn
       ) {
-        filepath = "" and
-        startline = 0 and
-        startcolumn = 0 and
-        endline = 0 and
-        endcolumn = 0
+        this.asNode().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+        or
+        this.asCall().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
       }
     }
 

csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImplSpecific.qll

@@ -19,20 +19,16 @@ class SummarizedCallableBase extends Callable {
   SummarizedCallableBase() { this.isUnboundDeclaration() }
 }
 
-/**
- * A module for importing frameworks that define synthetic globals.
- */
-private module SyntheticGlobals {
-  private import semmle.code.csharp.frameworks.EntityFramework
-}
-
 DataFlowCallable inject(SummarizedCallable c) { result.asSummarizedCallable() = c }
 
 /** Gets the parameter position of the instance parameter. */
 ArgumentPosition callbackSelfParameterPosition() { none() } // disables implicit summary flow to `this` for callbacks
 
+/** Gets the synthesized summary data-flow node for the given values. */
+Node summaryNode(SummarizedCallable c, SummaryNodeState state) { result = TSummaryNode(c, state) }
+
 /** Gets the synthesized data-flow call for `receiver`. */
-SummaryCall summaryDataFlowCall(SummaryNode receiver) { receiver = result.getReceiver() }
+SummaryCall summaryDataFlowCall(Node receiver) { receiver = result.getReceiver() }
 
 /** Gets the type of content `c`. */
 DataFlowType getContentType(Content c) {
@@ -48,21 +44,7 @@ DataFlowType getContentType(Content c) {
   )
 }
 
-/** Gets the type of the parameter at the given position. */
-DataFlowType getParameterType(SummarizedCallable c, ParameterPosition pos) {
-  exists(Type t | result = Gvn::getGlobalValueNumber(t) |
-    exists(int i |
-      pos.getPosition() = i and
-      t = c.getParameter(i).getType()
-    )
-    or
-    pos.isThisParameter() and
-    t = c.getDeclaringType()
-  )
-}
-
-/** Gets the return type of kind `rk` for callable `c`. */
-DataFlowType getReturnType(DotNet::Callable c, ReturnKind rk) {
+private DataFlowType getReturnTypeBase(DotNet::Callable c, ReturnKind rk) {
   exists(Type t | result = Gvn::getGlobalValueNumber(t) |
     rk instanceof NormalReturnKind and
     (
@@ -76,6 +58,15 @@ DataFlowType getReturnType(DotNet::Callable c, ReturnKind rk) {
   )
 }
 
+/** Gets the return type of kind `rk` for callable `c`. */
+bindingset[c]
+DataFlowType getReturnType(SummarizedCallable c, ReturnKind rk) {
+  result = getReturnTypeBase(c, rk)
+  or
+  rk =
+    any(JumpReturnKind jrk | result = getReturnTypeBase(jrk.getTarget(), jrk.getTargetReturnKind()))
+}
+
 /**
  * Gets the type of the parameter matching arguments at position `pos` in a
  * synthesized call that targets a callback of type `t`.

csharp/ql/lib/semmle/code/csharp/dataflow/internal/TaintTrackingPrivate.qll

@@ -156,8 +156,7 @@ private module Cached {
     // tracking configurations where the source is a collection
     readStep(nodeFrom, TElementContent(), nodeTo)
     or
-    FlowSummaryImpl::Private::Steps::summaryLocalStep(nodeFrom.(FlowSummaryNode).getSummaryNode(),
-      nodeTo.(FlowSummaryNode).getSummaryNode(), false)
+    FlowSummaryImpl::Private::Steps::summaryLocalStep(nodeFrom, nodeTo, false)
     or
     nodeTo = nodeFrom.(DataFlow::NonLocalJumpNode).getAJumpSuccessor(false)
   }

csharp/ql/lib/semmle/code/csharp/frameworks/EntityFramework.qll

@@ -4,7 +4,6 @@
 
 import csharp
 private import DataFlow
-private import semmle.code.csharp.commons.QualifiedName
 private import semmle.code.csharp.frameworks.System
 private import semmle.code.csharp.frameworks.system.data.Entity
 private import semmle.code.csharp.frameworks.system.collections.Generic
@@ -237,7 +236,7 @@ module EntityFramework {
      * }
      * ```
      */
-    Property getADbSetProperty(Class elementType) {
+    private Property getADbSetProperty(Class elementType) {
       exists(ConstructedClass c |
         result.getType() = c and
         c.getUnboundDeclaration() instanceof DbSet and
@@ -352,104 +351,22 @@ module EntityFramework {
 
     /** Holds if component stack `head :: tail` is required for the output specification. */
     predicate requiresComponentStackOut(
-      Content head, Type headType, SummaryComponentStack tail, int dist,
-      DbContextClassSetProperty dbSetProp
+      Content head, Type headType, SummaryComponentStack tail, int dist
     ) {
-      exists(PropertyContent c1 |
+      exists(Property dbSetProp, PropertyContent c1 |
         dbSetProp = this.getADbSetProperty(headType) and
         this.stepRev(c1, _, head, headType, 0) and
         c1.getProperty() = dbSetProp and
-        tail = SummaryComponentStack::return() and
+        tail = SummaryComponentStack::jump(dbSetProp.getGetter()) and
         dist = 0
       )
       or
       exists(Content tailHead, SummaryComponentStack tailTail, Type tailType |
-        this.requiresComponentStackOut(tailHead, tailType, tailTail, dist - 1, dbSetProp) and
+        this.requiresComponentStackOut(tailHead, tailType, tailTail, dist - 1) and
         tail = SummaryComponentStack::push(SummaryComponent::content(tailHead), tailTail) and
         this.stepRev(tailHead, tailType, head, headType, dist)
       )
     }
-
-    /**
-     * Holds if `input` is a valid summary component stack for property `mapped` for this.
-     */
-    pragma[noinline]
-    predicate input(SummaryComponentStack input, Property mapped) {
-      exists(PropertyContent head, SummaryComponentStack tail |
-        this.requiresComponentStackIn(head, _, tail, _) and
-        head.getProperty() = mapped and
-        mapped = this.getAColumnProperty(_) and
-        input = SummaryComponentStack::push(SummaryComponent::content(head), tail)
-      )
-    }
-
-    /**
-     * Holds if `output` is a valid summary component stack for the getter of `dbSet`
-     * for property `mapped` for this.
-     */
-    pragma[noinline]
-    private predicate output(
-      SummaryComponentStack output, Property mapped, DbContextClassSetProperty dbSet
-    ) {
-      exists(PropertyContent head, SummaryComponentStack tail |
-        this.requiresComponentStackOut(head, _, tail, _, dbSet) and
-        head.getProperty() = mapped and
-        mapped = this.getAColumnProperty(_) and
-        output = SummaryComponentStack::push(SummaryComponent::content(head), tail)
-      )
-    }
-
-    /**
-     * Gets the synthetic name for the getter of `dbSet` for property `mapped` for this,
-     * where `output` is a valid summary component stack for the getter of `dbSet`
-     * for the property `mapped`.
-     */
-    pragma[nomagic]
-    string getSyntheticName(
-      SummaryComponentStack output, Property mapped, DbContextClassSetProperty dbSet
-    ) {
-      this = dbSet.getDbContextClass() and
-      this.output(output, mapped, dbSet) and
-      result = dbSet.getFullName() + "#" + SummaryComponentStack::getComponentStack(output)
-    }
-  }
-
-  private class DbContextClassSetProperty extends Property {
-    private DbContextClass c;
-
-    DbContextClassSetProperty() { this = c.getADbSetProperty(_) }
-
-    /**
-     * Gets the fully qualified name for this.
-     */
-    string getFullName() {
-      exists(string qualifier, string type, string name |
-        this.hasQualifiedName(qualifier, type, name)
-      |
-        result = getQualifiedName(qualifier, type, name)
-      )
-    }
-
-    /**
-     * Gets the context class where this is a DbSet property.
-     */
-    DbContextClass getDbContextClass() { result = c }
-  }
-
-  private class DbContextClassSetPropertySynthetic extends EFSummarizedCallable {
-    private DbContextClassSetProperty p;
-
-    DbContextClassSetPropertySynthetic() { this = p.getGetter() }
-
-    override predicate propagatesFlow(
-      SummaryComponentStack input, SummaryComponentStack output, boolean preservesValue
-    ) {
-      exists(string name, DbContextClass c |
-        preservesValue = true and
-        name = c.getSyntheticName(output, _, p) and
-        input = SummaryComponentStack::syntheticGlobal(name)
-      )
-    }
   }
 
   private class DbContextSaveChanges extends EFSummarizedCallable {
@@ -457,32 +374,44 @@ module EntityFramework {
 
     DbContextSaveChanges() { this = c.getASaveChanges() }
 
+    pragma[noinline]
+    private predicate input(SummaryComponentStack input, Property mapped) {
+      exists(PropertyContent head, SummaryComponentStack tail |
+        c.requiresComponentStackIn(head, _, tail, _) and
+        head.getProperty() = mapped and
+        mapped = c.getAColumnProperty(_) and
+        input = SummaryComponentStack::push(SummaryComponent::content(head), tail)
+      )
+    }
+
+    pragma[noinline]
+    private predicate output(SummaryComponentStack output, Property mapped) {
+      exists(PropertyContent head, SummaryComponentStack tail |
+        c.requiresComponentStackOut(head, _, tail, _) and
+        head.getProperty() = mapped and
+        mapped = c.getAColumnProperty(_) and
+        output = SummaryComponentStack::push(SummaryComponent::content(head), tail)
+      )
+    }
+
     override predicate propagatesFlow(
       SummaryComponentStack input, SummaryComponentStack output, boolean preservesValue
     ) {
-      exists(string name, Property mapped |
+      exists(Property mapped |
         preservesValue = true and
-        c.input(input, mapped) and
-        name = c.getSyntheticName(_, mapped, _) and
-        output = SummaryComponentStack::syntheticGlobal(name)
+        this.input(input, mapped) and
+        this.output(output, mapped)
       )
     }
   }
 
-  /**
-   * Add all possible synthetic global names.
-   */
-  private class EFSummarizedCallableSyntheticGlobal extends SummaryComponent::SyntheticGlobal {
-    EFSummarizedCallableSyntheticGlobal() { this = any(DbContextClass c).getSyntheticName(_, _, _) }
-  }
-
   private class DbContextSaveChangesRequiredSummaryComponentStack extends RequiredSummaryComponentStack
   {
     override predicate required(SummaryComponent head, SummaryComponentStack tail) {
       exists(Content c | head = SummaryComponent::content(c) |
         any(DbContextClass cls).requiresComponentStackIn(c, _, tail, _)
         or
-        any(DbContextClass cls).requiresComponentStackOut(c, _, tail, _, _)
+        any(DbContextClass cls).requiresComponentStackOut(c, _, tail, _)
       )
     }
   }

csharp/ql/lib/semmle/code/csharp/security/dataflow/CommandInjectionQuery.qll

@@ -6,7 +6,6 @@ import csharp
 private import semmle.code.csharp.security.dataflow.flowsources.Remote
 private import semmle.code.csharp.frameworks.system.Diagnostics
 private import semmle.code.csharp.security.Sanitizers
-private import semmle.code.csharp.dataflow.ExternalFlow
 
 /**
  * A source specific to command injection vulnerabilities.
@@ -67,11 +66,6 @@ module CommandInjection = TaintTracking::Global<CommandInjectionConfig>;
 /** A source of remote user input. */
 class RemoteSource extends Source instanceof RemoteFlowSource { }
 
-/** Command Injection sinks defined through Models as Data. */
-private class ExternalCommandInjectionExprSink extends Sink {
-  ExternalCommandInjectionExprSink() { sinkNode(this, "command-injection") }
-}
-
 /**
  * A sink in `System.Diagnostic.Process` or its related classes.
  */

csharp/ql/lib/semmle/code/csharp/security/dataflow/LDAPInjectionQuery.qll

@@ -8,7 +8,6 @@ private import semmle.code.csharp.security.dataflow.flowsources.Remote
 private import semmle.code.csharp.frameworks.system.DirectoryServices
 private import semmle.code.csharp.frameworks.system.directoryservices.Protocols
 private import semmle.code.csharp.security.Sanitizers
-private import semmle.code.csharp.dataflow.ExternalFlow
 
 /**
  * A data flow source for unvalidated user input that is used to construct LDAP queries.
@@ -69,11 +68,6 @@ module LdapInjection = TaintTracking::Global<LdapInjectionConfig>;
 /** A source of remote user input. */
 class RemoteSource extends Source instanceof RemoteFlowSource { }
 
-/** LDAP sinks defined through Models as Data. */
-private class ExternalLdapExprSink extends Sink {
-  ExternalLdapExprSink() { sinkNode(this, "ldap-injection") }
-}
-
 /**
  * An argument that sets the `Path` property of a `DirectoryEntry` object that is a sink for LDAP
  * injection.

csharp/ql/lib/semmle/code/csharp/security/dataflow/LogForgingQuery.qll

@@ -8,7 +8,6 @@ private import semmle.code.csharp.frameworks.System
 private import semmle.code.csharp.frameworks.system.text.RegularExpressions
 private import semmle.code.csharp.security.Sanitizers
 private import semmle.code.csharp.security.dataflow.flowsinks.ExternalLocationSink
-private import semmle.code.csharp.dataflow.ExternalFlow
 
 /**
  * A data flow source for untrusted user input used in log entries.
@@ -73,11 +72,6 @@ private class LogForgingLogMessageSink extends Sink, LogMessageSink { }
  */
 private class LogForgingTraceMessageSink extends Sink, TraceMessageSink { }
 
-/** Log Forging sinks defined through Models as Data. */
-private class ExternalLoggingExprSink extends Sink {
-  ExternalLoggingExprSink() { sinkNode(this, "log-injection") }
-}
-
 /**
  * A call to String replace or remove that is considered to sanitize replaced string.
  */

csharp/ql/lib/semmle/code/csharp/security/dataflow/UrlRedirectQuery.qll

@@ -9,7 +9,6 @@ private import semmle.code.csharp.frameworks.system.Web
 private import semmle.code.csharp.frameworks.system.web.Mvc
 private import semmle.code.csharp.security.Sanitizers
 private import semmle.code.csharp.frameworks.microsoft.AspNetCore
-private import semmle.code.csharp.dataflow.ExternalFlow
 
 /**
  * A data flow source for unvalidated URL redirect vulnerabilities.
@@ -71,11 +70,6 @@ module UrlRedirect = TaintTracking::Global<UrlRedirectConfig>;
 /** A source of remote user input. */
 class RemoteSource extends Source instanceof RemoteFlowSource { }
 
-/** URL Redirection sinks defined through Models as Data. */
-private class ExternalUrlRedirectExprSink extends Sink {
-  ExternalUrlRedirectExprSink() { sinkNode(this, "url-redirection") }
-}
-
 /**
  * A URL argument to a call to `HttpResponse.Redirect()` or `Controller.Redirect()`, that is a
  * sink for URL redirects.

csharp/ql/src/CHANGELOG.md

@@ -1,7 +1,3 @@
-## 0.6.3
-
-No user-facing changes.
-
 ## 0.6.2
 
 No user-facing changes.

csharp/ql/src/Security Features/CWE-022/ZipSlip.qhelp

@@ -3,15 +3,16 @@
   "qhelp.dtd">
 <qhelp>
 <overview>
-<p>Extracting files from a malicious zip file, or similar type of archive,
-is at risk of directory traversal attacks if filenames from the archive are
-not properly validated.</p>
+<p>Extracting files from a malicious zip archive without validating that the destination file path
+is within the destination directory can cause files outside the destination directory to be
+overwritten, due to the possible presence of directory traversal elements (<code>..</code>) in
+archive paths.</p>
 
 <p>Zip archives contain archive entries representing each file in the archive. These entries
 include a file path for the entry, but these file paths are not restricted and may contain
 unexpected special elements such as the directory traversal element (<code>..</code>). If these
-file paths are used to create a filesystem path, then a file operation may happen in an 
-unexpected location. This can result in sensitive information being
+file paths are used to determine an output file to write the contents of the archive item to, then
+the file may be written to an unexpected location. This can result in sensitive information being
 revealed or deleted, or an attacker being able to influence behavior by modifying unexpected
 files.</p>
 

csharp/ql/src/Security Features/CWE-022/ZipSlip.ql

@@ -1,8 +1,8 @@
 /**
- * @name Arbitrary file access during archive extraction ("Zip Slip")
- * @description Extracting files from a malicious ZIP file, or similar type of archive, without
- *              validating that the destination file path is within the destination directory
- *              can allow an attacker to unexpectedly gain access to resources.
+ * @name Arbitrary file write during zip extraction ("Zip Slip")
+ * @description Extracting files from a malicious zip archive without validating that the
+ *              destination file path is within the destination directory can cause files outside
+ *              the destination directory to be overwritten.
  * @kind path-problem
  * @id cs/zipslip
  * @problem.severity error

csharp/ql/src/change-notes/2023-06-16-zipslip-rename.md

@@ -1,4 +0,0 @@
----
-category: fix
----
-* The query "Arbitrary file write during zip extraction ("Zip Slip")" (`cs/zipslip`) has been renamed to "Arbitrary file access during archive extraction ("Zip Slip")."

csharp/ql/src/change-notes/released/0.6.3.md

@@ -1,3 +0,0 @@
-## 0.6.3
-
-No user-facing changes.

csharp/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.6.3
+lastReleaseVersion: 0.6.2

csharp/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-queries
-version: 0.6.4-dev
+version: 0.6.3-dev
 groups: 
   - csharp
   - queries

csharp/ql/test/TestUtilities/InlineFlowTest.qll

@@ -4,12 +4,11 @@
  * Example for a test.ql:
  * ```ql
  * import csharp
+ * import DefaultValueFlow::PathGraph
  * import TestUtilities.InlineFlowTest
- * import DefaultFlowTest
- * import PathGraph
  *
- * from PathNode source, PathNode sink
- * where flowPath(source, sink)
+ * from DefaultValueFlow::PathNode source, DefaultValueFlow::PathNode sink
+ * where DefaultValueFlow::flowPath(source, sink)
  * select sink, source, sink, "$@", source, source.toString()
  *
  * ```
@@ -33,10 +32,14 @@
  * }
  * ```
  *
- * If you are only interested in value flow, then instead of importing `DefaultFlowTest`, you can import
- * `ValueFlowTest<DefaultFlowConfig>`. Similarly, if you are only interested in taint flow, then instead of
- * importing `DefaultFlowTest`, you can import `TaintFlowTest<DefaultFlowConfig>`. In both cases
- * `DefaultFlowConfig` can be replaced by another implementation of `DataFlow::ConfigSig`.
+ * If you're not interested in a specific flow type, you can disable either value or taint flow expectations as follows:
+ * ```ql
+ * class HasFlowTest extends InlineFlowTest {
+ *   override DataFlow::Configuration getTaintFlowConfig() { none() }
+ *
+ *   override DataFlow::Configuration getValueFlowConfig() { none() }
+ * }
+ * ```
  *
  * If you need more fine-grained tuning, consider implementing a test using `InlineExpectationsTest`.
  */
@@ -44,8 +47,8 @@
 import csharp
 import TestUtilities.InlineExpectationsTest
 
-private predicate defaultSource(DataFlow::Node source) {
-  source.asExpr().(MethodCall).getTarget().getUndecoratedName() = ["Source", "Taint"]
+private predicate defaultSource(DataFlow::Node src) {
+  src.asExpr().(MethodCall).getTarget().getUndecoratedName() = ["Source", "Taint"]
 }
 
 private predicate defaultSink(DataFlow::Node sink) {
@@ -55,66 +58,42 @@ private predicate defaultSink(DataFlow::Node sink) {
 }
 
 module DefaultFlowConfig implements DataFlow::ConfigSig {
-  predicate isSource(DataFlow::Node source) { defaultSource(source) }
+  predicate isSource(DataFlow::Node n) { defaultSource(n) }
 
-  predicate isSink(DataFlow::Node sink) { defaultSink(sink) }
+  predicate isSink(DataFlow::Node n) { defaultSink(n) }
 
   int fieldFlowBranchLimit() { result = 1000 }
 }
 
-private module NoFlowConfig implements DataFlow::ConfigSig {
-  predicate isSource(DataFlow::Node source) { none() }
+module DefaultValueFlow = DataFlow::Global<DefaultFlowConfig>;
 
-  predicate isSink(DataFlow::Node sink) { none() }
-}
+module DefaultTaintFlow = TaintTracking::Global<DefaultFlowConfig>;
 
 private string getSourceArgString(DataFlow::Node src) {
   defaultSource(src) and
   src.asExpr().(MethodCall).getAnArgument().getValue() = result
 }
 
-module FlowTest<DataFlow::ConfigSig ValueFlowConfig, DataFlow::ConfigSig TaintFlowConfig> {
-  module ValueFlow = DataFlow::Global<ValueFlowConfig>;
+class InlineFlowTest extends InlineExpectationsTest {
+  InlineFlowTest() { this = "HasFlowTest" }
 
-  module TaintFlow = TaintTracking::Global<TaintFlowConfig>;
+  override string getARelevantTag() { result = ["hasValueFlow", "hasTaintFlow"] }
 
-  private module InlineTest implements TestSig {
-    string getARelevantTag() { result = ["hasValueFlow", "hasTaintFlow"] }
-
-    predicate hasActualResult(Location location, string element, string tag, string value) {
-      tag = "hasValueFlow" and
-      exists(DataFlow::Node src, DataFlow::Node sink | ValueFlow::flow(src, sink) |
-        sink.getLocation() = location and
-        element = sink.toString() and
-        if exists(getSourceArgString(src)) then value = getSourceArgString(src) else value = ""
-      )
-      or
-      tag = "hasTaintFlow" and
-      exists(DataFlow::Node src, DataFlow::Node sink |
-        TaintFlow::flow(src, sink) and not ValueFlow::flow(src, sink)
-      |
-        sink.getLocation() = location and
-        element = sink.toString() and
-        if exists(getSourceArgString(src)) then value = getSourceArgString(src) else value = ""
-      )
-    }
-  }
-
-  import MakeTest<InlineTest>
-  import DataFlow::MergePathGraph<ValueFlow::PathNode, TaintFlow::PathNode, ValueFlow::PathGraph, TaintFlow::PathGraph>
-
-  predicate flowPath(PathNode source, PathNode sink) {
-    ValueFlow::flowPath(source.asPathNode1(), sink.asPathNode1()) or
-    TaintFlow::flowPath(source.asPathNode2(), sink.asPathNode2())
+  override predicate hasActualResult(Location location, string element, string tag, string value) {
+    tag = "hasValueFlow" and
+    exists(DataFlow::Node src, DataFlow::Node sink | DefaultValueFlow::flow(src, sink) |
+      sink.getLocation() = location and
+      element = sink.toString() and
+      if exists(getSourceArgString(src)) then value = getSourceArgString(src) else value = ""
+    )
+    or
+    tag = "hasTaintFlow" and
+    exists(DataFlow::Node src, DataFlow::Node sink |
+      DefaultTaintFlow::flow(src, sink) and not DefaultValueFlow::flow(src, sink)
+    |
+      sink.getLocation() = location and
+      element = sink.toString() and
+      if exists(getSourceArgString(src)) then value = getSourceArgString(src) else value = ""
+    )
   }
 }
-
-module DefaultFlowTest = FlowTest<DefaultFlowConfig, DefaultFlowConfig>;
-
-module ValueFlowTest<DataFlow::ConfigSig ValueFlowConfig> {
-  import FlowTest<ValueFlowConfig, NoFlowConfig>
-}
-
-module TaintFlowTest<DataFlow::ConfigSig TaintFlowConfig> {
-  import FlowTest<NoFlowConfig, TaintFlowConfig>
-}

csharp/ql/test/experimental/CWE-918/RequestForgery.cs

@@ -1,3 +1,5 @@
+// semmle-extractor-options: ${testdir}/../../resources/stubs/System.Web.cs /r:System.Threading.Tasks.dll /r:System.Collections.Specialized.dll /r:System.Runtime.dll /r:System.Private.Uri.dll
+
 using System;
 using System.Threading.Tasks;
 using System.Web.Mvc;
@@ -36,3 +38,21 @@ namespace RequestForgery.Controllers
         }
     }
 }
+// Missing stubs:
+namespace System.Net.Http
+{
+    public class HttpClient
+    {
+        public async Task SendAsync(HttpRequestMessage request) => throw null;
+    }
+
+    public class HttpRequestMessage
+    {
+        public HttpRequestMessage(HttpMethod method, string requestUri) => throw null;
+    }
+
+    public class HttpMethod
+    {
+        public static readonly HttpMethod Get;
+    }
+}

csharp/ql/test/experimental/CWE-918/RequestForgery.expected

@@ -1,8 +1,8 @@
 edges
-| RequestForgery.cs:12:52:12:54 | url : String | RequestForgery.cs:14:66:14:68 | access to parameter url |
+| RequestForgery.cs:14:52:14:54 | url : String | RequestForgery.cs:16:66:16:68 | access to parameter url |
 nodes
-| RequestForgery.cs:12:52:12:54 | url : String | semmle.label | url : String |
-| RequestForgery.cs:14:66:14:68 | access to parameter url | semmle.label | access to parameter url |
+| RequestForgery.cs:14:52:14:54 | url : String | semmle.label | url : String |
+| RequestForgery.cs:16:66:16:68 | access to parameter url | semmle.label | access to parameter url |
 subpaths
 #select
-| RequestForgery.cs:14:66:14:68 | access to parameter url | RequestForgery.cs:12:52:12:54 | url : String | RequestForgery.cs:14:66:14:68 | access to parameter url | The URL of this request depends on a $@. | RequestForgery.cs:12:52:12:54 | url | user-provided value |
+| RequestForgery.cs:16:66:16:68 | access to parameter url | RequestForgery.cs:14:52:14:54 | url : String | RequestForgery.cs:16:66:16:68 | access to parameter url | The URL of this request depends on a $@. | RequestForgery.cs:14:52:14:54 | url | user-provided value |

csharp/ql/test/experimental/CWE-918/options

@@ -1,3 +0,0 @@
-semmle-extractor-options: /nostdlib /noconfig
-semmle-extractor-options: --load-sources-from-project:${testdir}/../../resources/stubs/_frameworks/Microsoft.NETCore.App/Microsoft.NETCore.App.csproj
-semmle-extractor-options: ${testdir}/../../resources/stubs/System.Web.cs

csharp/ql/test/library-tests/dataflow/delegates/DelegateFlow.expected

@@ -51,5 +51,5 @@ viableLambda
 | DelegateFlow.cs:125:9:125:25 | function pointer call | file://:0:0:0:0 | (none) | DelegateFlow.cs:7:17:7:18 | M2 |
 | DelegateFlow.cs:132:9:132:11 | delegate call | DelegateFlow.cs:135:25:135:40 | call to method M19 | DelegateFlow.cs:135:29:135:36 | (...) => ... |
 | DelegateFlow.cs:132:9:132:11 | delegate call | file://:0:0:0:0 | (none) | DelegateFlow.cs:131:17:131:24 | (...) => ... |
-| file://:0:0:0:0 | [summary] call to [summary param] position 0 in Lazy in Lazy | DelegateFlow.cs:105:9:105:24 | object creation of type Lazy<Int32> | DelegateFlow.cs:104:23:104:30 | (...) => ... |
-| file://:0:0:0:0 | [summary] call to [summary param] position 0 in Lazy in Lazy | DelegateFlow.cs:107:9:107:24 | object creation of type Lazy<Int32> | DelegateFlow.cs:106:13:106:20 | (...) => ... |
+| file://:0:0:0:0 | [summary] call to parameter position 0 of Lazy in Lazy | DelegateFlow.cs:105:9:105:24 | object creation of type Lazy<Int32> | DelegateFlow.cs:104:23:104:30 | (...) => ... |
+| file://:0:0:0:0 | [summary] call to parameter position 0 of Lazy in Lazy | DelegateFlow.cs:107:9:107:24 | object creation of type Lazy<Int32> | DelegateFlow.cs:106:13:106:20 | (...) => ... |

csharp/ql/test/library-tests/dataflow/fields/FieldFlow.ql

@@ -3,10 +3,9 @@
  */
 
 import csharp
+import DefaultValueFlow::PathGraph
 import TestUtilities.InlineFlowTest
-import DefaultFlowTest
-import PathGraph
 
-from PathNode source, PathNode sink
-where flowPath(source, sink)
+from DefaultValueFlow::PathNode source, DefaultValueFlow::PathNode sink
+where DefaultValueFlow::flowPath(source, sink)
 select sink, source, sink, "$@", source, source.toString()

csharp/ql/test/library-tests/dataflow/library/FlowSummaries.expected

@@ -1087,7 +1087,7 @@ summary
 | System.Collections.Generic;List<>;false;Add;(System.Object);;Argument[0];Argument[this].Element;value;manual |
 | System.Collections.Generic;List<>;false;Add;(T);;Argument[0];Argument[this].Element;value;manual |
 | System.Collections.Generic;List<>;false;AddRange;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;Argument[this].Element;value;manual |
-| System.Collections.Generic;List<>;false;AsReadOnly;();;Argument[this].Element;ReturnValue.Element;value;manual |
+| System.Collections.Generic;List<>;false;AsReadOnly;();;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections.Generic;List<>;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections.Generic;List<>;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Generic;List<>;false;CopyTo;(T[]);;Argument[this];Argument[0].Element;taint;df-generated |
@@ -1101,11 +1101,13 @@ summary
 | System.Collections.Generic;List<>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
 | System.Collections.Generic;List<>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.List<>+Enumerator.Current];value;manual |
 | System.Collections.Generic;List<>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
-| System.Collections.Generic;List<>;false;GetRange;(System.Int32,System.Int32);;Argument[this].Element;ReturnValue.Element;value;manual |
+| System.Collections.Generic;List<>;false;GetRange;(System.Int32,System.Int32);;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections.Generic;List<>;false;Insert;(System.Int32,System.Object);;Argument[1];Argument[this].Element;value;manual |
 | System.Collections.Generic;List<>;false;Insert;(System.Int32,T);;Argument[1];Argument[this].Element;value;manual |
 | System.Collections.Generic;List<>;false;InsertRange;(System.Int32,System.Collections.Generic.IEnumerable<T>);;Argument[1].Element;Argument[this].Element;value;manual |
 | System.Collections.Generic;List<>;false;List;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;Argument[this];taint;df-generated |
+| System.Collections.Generic;List<>;false;Reverse;();;Argument[0].Element;ReturnValue.Element;value;manual |
+| System.Collections.Generic;List<>;false;Reverse;(System.Int32,System.Int32);;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections.Generic;List<>;false;get_Item;(System.Int32);;Argument[this].Element;ReturnValue;value;manual |
 | System.Collections.Generic;List<>;false;get_SyncRoot;();;Argument[this];ReturnValue;value;df-generated |
 | System.Collections.Generic;List<>;false;set_Item;(System.Int32,System.Object);;Argument[1];Argument[this].Element;value;manual |
@@ -1229,7 +1231,7 @@ summary
 | System.Collections.Generic;SortedSet<>;false;GetViewBetween;(T,T);;Argument[1];ReturnValue;taint;df-generated |
 | System.Collections.Generic;SortedSet<>;false;GetViewBetween;(T,T);;Argument[this];ReturnValue;taint;df-generated |
 | System.Collections.Generic;SortedSet<>;false;IntersectWith;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;Argument[this];taint;df-generated |
-| System.Collections.Generic;SortedSet<>;false;Reverse;();;Argument[this].Element;ReturnValue.Element;value;manual |
+| System.Collections.Generic;SortedSet<>;false;Reverse;();;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections.Generic;SortedSet<>;false;SortedSet;(System.Collections.Generic.IComparer<T>);;Argument[0];Argument[this];taint;df-generated |
 | System.Collections.Generic;SortedSet<>;false;SortedSet;(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext);;Argument[0];Argument[this];taint;df-generated |
 | System.Collections.Generic;SortedSet<>;false;SymmetricExceptWith;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;Argument[this];taint;df-generated |
@@ -1288,6 +1290,7 @@ summary
 | System.Collections.Immutable;ImmutableArray<>+Builder;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
 | System.Collections.Immutable;ImmutableArray<>+Builder;false;Insert;(System.Int32,T);;Argument[1];Argument[this].Element;value;manual |
 | System.Collections.Immutable;ImmutableArray<>+Builder;false;MoveToImmutable;();;Argument[this];ReturnValue;taint;df-generated |
+| System.Collections.Immutable;ImmutableArray<>+Builder;false;Reverse;();;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections.Immutable;ImmutableArray<>+Builder;false;get_Item;(System.Int32);;Argument[this].Element;ReturnValue;value;manual |
 | System.Collections.Immutable;ImmutableArray<>+Builder;false;set_Item;(System.Int32,T);;Argument[1];Argument[this].Element;value;manual |
 | System.Collections.Immutable;ImmutableArray<>+Enumerator;false;get_Current;();;Argument[this];ReturnValue;taint;df-generated |
@@ -1484,10 +1487,12 @@ summary
 | System.Collections.Immutable;ImmutableList<>+Builder;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
 | System.Collections.Immutable;ImmutableList<>+Builder;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
 | System.Collections.Immutable;ImmutableList<>+Builder;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Immutable.ImmutableList<>+Enumerator.Current];value;manual |
-| System.Collections.Immutable;ImmutableList<>+Builder;false;GetRange;(System.Int32,System.Int32);;Argument[this].Element;ReturnValue.Element;value;manual |
+| System.Collections.Immutable;ImmutableList<>+Builder;false;GetRange;(System.Int32,System.Int32);;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections.Immutable;ImmutableList<>+Builder;false;Insert;(System.Int32,System.Object);;Argument[1];Argument[this].Element;value;manual |
 | System.Collections.Immutable;ImmutableList<>+Builder;false;Insert;(System.Int32,T);;Argument[1];Argument[this].Element;value;manual |
 | System.Collections.Immutable;ImmutableList<>+Builder;false;InsertRange;(System.Int32,System.Collections.Generic.IEnumerable<T>);;Argument[1].Element;Argument[this].Element;value;manual |
+| System.Collections.Immutable;ImmutableList<>+Builder;false;Reverse;();;Argument[0].Element;ReturnValue.Element;value;manual |
+| System.Collections.Immutable;ImmutableList<>+Builder;false;Reverse;(System.Int32,System.Int32);;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections.Immutable;ImmutableList<>+Builder;false;ToImmutable;();;Argument[this];ReturnValue;taint;df-generated |
 | System.Collections.Immutable;ImmutableList<>+Builder;false;get_Item;(System.Int32);;Argument[this].Element;ReturnValue;value;manual |
 | System.Collections.Immutable;ImmutableList<>+Builder;false;get_SyncRoot;();;Argument[this];ReturnValue;taint;df-generated |
@@ -1515,7 +1520,7 @@ summary
 | System.Collections.Immutable;ImmutableList<>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
 | System.Collections.Immutable;ImmutableList<>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
 | System.Collections.Immutable;ImmutableList<>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Immutable.ImmutableList<>+Enumerator.Current];value;manual |
-| System.Collections.Immutable;ImmutableList<>;false;GetRange;(System.Int32,System.Int32);;Argument[this].Element;ReturnValue.Element;value;manual |
+| System.Collections.Immutable;ImmutableList<>;false;GetRange;(System.Int32,System.Int32);;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections.Immutable;ImmutableList<>;false;Insert;(System.Int32,System.Object);;Argument[1];Argument[this].Element;value;manual |
 | System.Collections.Immutable;ImmutableList<>;false;Insert;(System.Int32,T);;Argument[1];Argument[this].Element;value;manual |
 | System.Collections.Immutable;ImmutableList<>;false;InsertRange;(System.Int32,System.Collections.Generic.IEnumerable<T>);;Argument[1].Element;Argument[this].Element;value;manual |
@@ -1532,8 +1537,8 @@ summary
 | System.Collections.Immutable;ImmutableList<>;false;Replace;(T,T,System.Collections.Generic.IEqualityComparer<T>);;Argument[1];Argument[this];taint;df-generated |
 | System.Collections.Immutable;ImmutableList<>;false;Replace;(T,T,System.Collections.Generic.IEqualityComparer<T>);;Argument[1];ReturnValue;taint;df-generated |
 | System.Collections.Immutable;ImmutableList<>;false;Replace;(T,T,System.Collections.Generic.IEqualityComparer<T>);;Argument[this];ReturnValue;taint;df-generated |
-| System.Collections.Immutable;ImmutableList<>;false;Reverse;();;Argument[this].Element;ReturnValue.Element;value;manual |
-| System.Collections.Immutable;ImmutableList<>;false;Reverse;(System.Int32,System.Int32);;Argument[this].Element;ReturnValue.Element;value;manual |
+| System.Collections.Immutable;ImmutableList<>;false;Reverse;();;Argument[0].Element;ReturnValue.Element;value;manual |
+| System.Collections.Immutable;ImmutableList<>;false;Reverse;(System.Int32,System.Int32);;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections.Immutable;ImmutableList<>;false;SetItem;(System.Int32,T);;Argument[1];Argument[this];taint;df-generated |
 | System.Collections.Immutable;ImmutableList<>;false;SetItem;(System.Int32,T);;Argument[1];ReturnValue;taint;df-generated |
 | System.Collections.Immutable;ImmutableList<>;false;SetItem;(System.Int32,T);;Argument[this];ReturnValue;taint;df-generated |
@@ -1671,7 +1676,7 @@ summary
 | System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
 | System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Immutable.ImmutableSortedSet<>+Enumerator.Current];value;manual |
 | System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;IntersectWith;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;Argument[this];taint;df-generated |
-| System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;Reverse;();;Argument[this].Element;ReturnValue.Element;value;manual |
+| System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;Reverse;();;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;SymmetricExceptWith;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;Argument[this];taint;df-generated |
 | System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;ToImmutable;();;Argument[this];ReturnValue;taint;df-generated |
 | System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;TryGetValue;(T,T);;Argument[0];ReturnValue;taint;df-generated |
@@ -1698,7 +1703,7 @@ summary
 | System.Collections.Immutable;ImmutableSortedSet<>;false;Insert;(System.Int32,T);;Argument[1];Argument[this].Element;value;manual |
 | System.Collections.Immutable;ImmutableSortedSet<>;false;Intersect;(System.Collections.Generic.IEnumerable<T>);;Argument[this];ReturnValue;taint;df-generated |
 | System.Collections.Immutable;ImmutableSortedSet<>;false;Remove;(T);;Argument[this];ReturnValue;taint;df-generated |
-| System.Collections.Immutable;ImmutableSortedSet<>;false;Reverse;();;Argument[this].Element;ReturnValue.Element;value;manual |
+| System.Collections.Immutable;ImmutableSortedSet<>;false;Reverse;();;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections.Immutable;ImmutableSortedSet<>;false;SymmetricExcept;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;Argument[this];taint;df-generated |
 | System.Collections.Immutable;ImmutableSortedSet<>;false;SymmetricExcept;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;ReturnValue;taint;df-generated |
 | System.Collections.Immutable;ImmutableSortedSet<>;false;SymmetricExcept;(System.Collections.Generic.IEnumerable<T>);;Argument[this];ReturnValue;taint;df-generated |
@@ -1892,7 +1897,7 @@ summary
 | System.Collections.Specialized;NotifyCollectionChangedEventArgs;false;get_OldItems;();;Argument[this];ReturnValue;taint;df-generated |
 | System.Collections.Specialized;OrderedDictionary;false;Add;(System.Object,System.Object);;Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | System.Collections.Specialized;OrderedDictionary;false;Add;(System.Object,System.Object);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
-| System.Collections.Specialized;OrderedDictionary;false;AsReadOnly;();;Argument[this].Element;ReturnValue.Element;value;manual |
+| System.Collections.Specialized;OrderedDictionary;false;AsReadOnly;();;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections.Specialized;OrderedDictionary;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System.Collections.Specialized;OrderedDictionary;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections.Specialized;OrderedDictionary;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
@@ -1933,19 +1938,21 @@ summary
 | System.Collections;ArrayList;false;AddRange;(System.Collections.ICollection);;Argument[0].Element;Argument[this].Element;value;manual |
 | System.Collections;ArrayList;false;ArrayList;(System.Collections.ICollection);;Argument[0].Element;Argument[this];taint;df-generated |
 | System.Collections;ArrayList;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
-| System.Collections;ArrayList;false;Clone;();;Argument[this].Element;ReturnValue.Element;value;manual |
+| System.Collections;ArrayList;false;Clone;();;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections;ArrayList;false;CopyTo;(System.Array);;Argument[this];Argument[0].Element;taint;df-generated |
 | System.Collections;ArrayList;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections;ArrayList;false;FixedSize;(System.Collections.ArrayList);;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections;ArrayList;false;FixedSize;(System.Collections.IList);;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections;ArrayList;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
 | System.Collections;ArrayList;false;GetEnumerator;(System.Int32,System.Int32);;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
-| System.Collections;ArrayList;false;GetRange;(System.Int32,System.Int32);;Argument[this].Element;ReturnValue.Element;value;manual |
+| System.Collections;ArrayList;false;GetRange;(System.Int32,System.Int32);;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections;ArrayList;false;Insert;(System.Int32,System.Object);;Argument[1];Argument[this].Element;value;manual |
 | System.Collections;ArrayList;false;InsertRange;(System.Int32,System.Collections.ICollection);;Argument[1].Element;Argument[this].Element;value;manual |
 | System.Collections;ArrayList;false;ReadOnly;(System.Collections.ArrayList);;Argument[0].Element;ReturnValue;taint;df-generated |
 | System.Collections;ArrayList;false;ReadOnly;(System.Collections.IList);;Argument[0].Element;ReturnValue;taint;df-generated |
 | System.Collections;ArrayList;false;Repeat;(System.Object,System.Int32);;Argument[0];ReturnValue.Element;value;manual |
+| System.Collections;ArrayList;false;Reverse;();;Argument[0].Element;ReturnValue.Element;value;manual |
+| System.Collections;ArrayList;false;Reverse;(System.Int32,System.Int32);;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections;ArrayList;false;SetRange;(System.Int32,System.Collections.ICollection);;Argument[1].Element;Argument[this];taint;df-generated |
 | System.Collections;ArrayList;false;Synchronized;(System.Collections.ArrayList);;Argument[0].Element;ReturnValue;taint;df-generated |
 | System.Collections;ArrayList;false;Synchronized;(System.Collections.IList);;Argument[0].Element;ReturnValue;taint;df-generated |
@@ -1953,7 +1960,7 @@ summary
 | System.Collections;ArrayList;false;get_SyncRoot;();;Argument[this];ReturnValue;value;df-generated |
 | System.Collections;ArrayList;false;set_Item;(System.Int32,System.Object);;Argument[1];Argument[this].Element;value;manual |
 | System.Collections;BitArray;false;And;(System.Collections.BitArray);;Argument[this];ReturnValue;value;df-generated |
-| System.Collections;BitArray;false;Clone;();;Argument[this].Element;ReturnValue.Element;value;manual |
+| System.Collections;BitArray;false;Clone;();;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections;BitArray;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections;BitArray;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
 | System.Collections;BitArray;false;LeftShift;(System.Int32);;Argument[this];ReturnValue;value;df-generated |
@@ -2000,7 +2007,7 @@ summary
 | System.Collections;Hashtable;false;Add;(System.Object,System.Object);;Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | System.Collections;Hashtable;false;Add;(System.Object,System.Object);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
 | System.Collections;Hashtable;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
-| System.Collections;Hashtable;false;Clone;();;Argument[this].Element;ReturnValue.Element;value;manual |
+| System.Collections;Hashtable;false;Clone;();;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections;Hashtable;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections;Hashtable;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
 | System.Collections;Hashtable;false;GetEnumerator;();;Argument[this];ReturnValue;taint;df-generated |
@@ -2048,7 +2055,7 @@ summary
 | System.Collections;IList;true;get_Item;(System.Int32);;Argument[this].Element;ReturnValue;value;manual |
 | System.Collections;IList;true;set_Item;(System.Int32,System.Object);;Argument[1];Argument[this].Element;value;manual |
 | System.Collections;Queue;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
-| System.Collections;Queue;false;Clone;();;Argument[this].Element;ReturnValue.Element;value;manual |
+| System.Collections;Queue;false;Clone;();;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections;Queue;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections;Queue;false;Dequeue;();;Argument[this];ReturnValue;taint;df-generated |
 | System.Collections;Queue;false;Enqueue;(System.Object);;Argument[0];Argument[this];taint;df-generated |
@@ -2064,7 +2071,7 @@ summary
 | System.Collections;SortedList;false;Add;(System.Object,System.Object);;Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | System.Collections;SortedList;false;Add;(System.Object,System.Object);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
 | System.Collections;SortedList;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
-| System.Collections;SortedList;false;Clone;();;Argument[this].Element;ReturnValue.Element;value;manual |
+| System.Collections;SortedList;false;Clone;();;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections;SortedList;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections;SortedList;false;GetByIndex;(System.Int32);;Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];ReturnValue;value;manual |
 | System.Collections;SortedList;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
@@ -2086,7 +2093,7 @@ summary
 | System.Collections;SortedList;false;set_Item;(System.Object,System.Object);;Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
 | System.Collections;SortedList;false;set_Item;(System.Object,System.Object);;Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];value;manual |
 | System.Collections;Stack;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
-| System.Collections;Stack;false;Clone;();;Argument[this].Element;ReturnValue.Element;value;manual |
+| System.Collections;Stack;false;Clone;();;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections;Stack;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Collections;Stack;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
 | System.Collections;Stack;false;Peek;();;Argument[this].Element;ReturnValue;value;manual |
@@ -3083,7 +3090,7 @@ summary
 | System.Data;InternalDataCollectionBase;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System.Data;InternalDataCollectionBase;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
 | System.Data;InternalDataCollectionBase;false;get_SyncRoot;();;Argument[this];ReturnValue;value;df-generated |
-| System.Data;PropertyCollection;false;Clone;();;Argument[this].Element;ReturnValue.Element;value;manual |
+| System.Data;PropertyCollection;false;Clone;();;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Data;TypedTableBase<>;false;Cast<>;();;Argument[this];ReturnValue;taint;df-generated |
 | System.Data;TypedTableBase<>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
 | System.Data;TypedTableBase<>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
@@ -7339,6 +7346,8 @@ summary
 | System.Runtime.CompilerServices;ReadOnlyCollectionBuilder<>;false;Insert;(System.Int32,System.Object);;Argument[1];Argument[this].Element;value;manual |
 | System.Runtime.CompilerServices;ReadOnlyCollectionBuilder<>;false;Insert;(System.Int32,T);;Argument[1];Argument[this].Element;value;manual |
 | System.Runtime.CompilerServices;ReadOnlyCollectionBuilder<>;false;ReadOnlyCollectionBuilder;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;Argument[this];taint;df-generated |
+| System.Runtime.CompilerServices;ReadOnlyCollectionBuilder<>;false;Reverse;();;Argument[0].Element;ReturnValue.Element;value;manual |
+| System.Runtime.CompilerServices;ReadOnlyCollectionBuilder<>;false;Reverse;(System.Int32,System.Int32);;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Runtime.CompilerServices;ReadOnlyCollectionBuilder<>;false;get_Item;(System.Int32);;Argument[this].Element;ReturnValue;value;manual |
 | System.Runtime.CompilerServices;ReadOnlyCollectionBuilder<>;false;get_SyncRoot;();;Argument[this];ReturnValue;value;df-generated |
 | System.Runtime.CompilerServices;ReadOnlyCollectionBuilder<>;false;set_Item;(System.Int32,System.Object);;Argument[1];Argument[this].Element;value;manual |
@@ -10693,7 +10702,7 @@ summary
 | System;Array;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
 | System;Array;false;Clear;(System.Array);;Argument[0].WithoutElement;Argument[0];value;manual |
 | System;Array;false;Clear;(System.Array,System.Int32,System.Int32);;Argument[0].WithoutElement;Argument[0];value;manual |
-| System;Array;false;Clone;();;Argument[this].Element;ReturnValue.Element;value;manual |
+| System;Array;false;Clone;();;Argument[0].Element;ReturnValue.Element;value;manual |
 | System;Array;false;CopyTo;(System.Array,System.Int32);;Argument[this].Element;Argument[0].Element;value;manual |
 | System;Array;false;CopyTo;(System.Array,System.Int64);;Argument[this].Element;Argument[0].Element;value;manual |
 | System;Array;false;Fill<>;(T[],T);;Argument[1];Argument[0].Element;taint;df-generated |

csharp/ql/test/library-tests/dataflow/library/FlowSummariesFiltered.expected

@@ -707,7 +707,7 @@ summary
 | System.Collections.Generic;LinkedListNode<>;false;set_Value;(T);;Argument[0];Argument[this];taint;df-generated |
 | System.Collections.Generic;List<>+Enumerator;false;get_Current;();;Argument[this];ReturnValue;taint;df-generated |
 | System.Collections.Generic;List<>;false;AddRange;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;Argument[this].Element;value;manual |
-| System.Collections.Generic;List<>;false;AsReadOnly;();;Argument[this].Element;ReturnValue.Element;value;manual |
+| System.Collections.Generic;List<>;false;AsReadOnly;();;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections.Generic;List<>;false;CopyTo;(T[]);;Argument[this];Argument[0].Element;taint;df-generated |
 | System.Collections.Generic;List<>;false;Find;(System.Predicate<T>);;Argument[this].Element;Argument[0].Parameter[0];value;manual |
 | System.Collections.Generic;List<>;false;Find;(System.Predicate<T>);;Argument[this].Element;ReturnValue;value;manual |
@@ -716,9 +716,11 @@ summary
 | System.Collections.Generic;List<>;false;FindLast;(System.Predicate<T>);;Argument[this].Element;Argument[0].Parameter[0];value;manual |
 | System.Collections.Generic;List<>;false;FindLast;(System.Predicate<T>);;Argument[this].Element;ReturnValue;value;manual |
 | System.Collections.Generic;List<>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.List<>+Enumerator.Current];value;manual |
-| System.Collections.Generic;List<>;false;GetRange;(System.Int32,System.Int32);;Argument[this].Element;ReturnValue.Element;value;manual |
+| System.Collections.Generic;List<>;false;GetRange;(System.Int32,System.Int32);;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections.Generic;List<>;false;InsertRange;(System.Int32,System.Collections.Generic.IEnumerable<T>);;Argument[1].Element;Argument[this].Element;value;manual |
 | System.Collections.Generic;List<>;false;List;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;Argument[this];taint;df-generated |
+| System.Collections.Generic;List<>;false;Reverse;();;Argument[0].Element;ReturnValue.Element;value;manual |
+| System.Collections.Generic;List<>;false;Reverse;(System.Int32,System.Int32);;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections.Generic;List<>;false;get_SyncRoot;();;Argument[this];ReturnValue;value;df-generated |
 | System.Collections.Generic;PriorityQueue<,>+UnorderedItemsCollection+Enumerator;false;get_Current;();;Argument[this];ReturnValue;taint;df-generated |
 | System.Collections.Generic;PriorityQueue<,>+UnorderedItemsCollection;false;GetEnumerator;();;Argument[this];ReturnValue;taint;df-generated |
@@ -784,7 +786,7 @@ summary
 | System.Collections.Generic;SortedSet<>;false;GetViewBetween;(T,T);;Argument[1];ReturnValue;taint;df-generated |
 | System.Collections.Generic;SortedSet<>;false;GetViewBetween;(T,T);;Argument[this];ReturnValue;taint;df-generated |
 | System.Collections.Generic;SortedSet<>;false;IntersectWith;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;Argument[this];taint;df-generated |
-| System.Collections.Generic;SortedSet<>;false;Reverse;();;Argument[this].Element;ReturnValue.Element;value;manual |
+| System.Collections.Generic;SortedSet<>;false;Reverse;();;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections.Generic;SortedSet<>;false;SortedSet;(System.Collections.Generic.IComparer<T>);;Argument[0];Argument[this];taint;df-generated |
 | System.Collections.Generic;SortedSet<>;false;SortedSet;(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext);;Argument[0];Argument[this];taint;df-generated |
 | System.Collections.Generic;SortedSet<>;false;SymmetricExceptWith;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;Argument[this];taint;df-generated |
@@ -835,6 +837,7 @@ summary
 | System.Collections.Immutable;ImmutableArray<>+Builder;false;AddRange<>;(TDerived[]);;Argument[0].Element;Argument[this].Element;value;manual |
 | System.Collections.Immutable;ImmutableArray<>+Builder;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Generic.IEnumerator<>.Current];value;manual |
 | System.Collections.Immutable;ImmutableArray<>+Builder;false;MoveToImmutable;();;Argument[this];ReturnValue;taint;df-generated |
+| System.Collections.Immutable;ImmutableArray<>+Builder;false;Reverse;();;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections.Immutable;ImmutableArray<>+Enumerator;false;get_Current;();;Argument[this];ReturnValue;taint;df-generated |
 | System.Collections.Immutable;ImmutableArray<>;false;Add;(T);;Argument[0];ReturnValue;taint;df-generated |
 | System.Collections.Immutable;ImmutableArray<>;false;AddRange;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;ReturnValue;taint;df-generated |
@@ -968,8 +971,10 @@ summary
 | System.Collections.Immutable;ImmutableList<>+Builder;false;FindLast;(System.Predicate<T>);;Argument[this].Element;Argument[0].Parameter[0];value;manual |
 | System.Collections.Immutable;ImmutableList<>+Builder;false;FindLast;(System.Predicate<T>);;Argument[this].Element;ReturnValue;value;manual |
 | System.Collections.Immutable;ImmutableList<>+Builder;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Immutable.ImmutableList<>+Enumerator.Current];value;manual |
-| System.Collections.Immutable;ImmutableList<>+Builder;false;GetRange;(System.Int32,System.Int32);;Argument[this].Element;ReturnValue.Element;value;manual |
+| System.Collections.Immutable;ImmutableList<>+Builder;false;GetRange;(System.Int32,System.Int32);;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections.Immutable;ImmutableList<>+Builder;false;InsertRange;(System.Int32,System.Collections.Generic.IEnumerable<T>);;Argument[1].Element;Argument[this].Element;value;manual |
+| System.Collections.Immutable;ImmutableList<>+Builder;false;Reverse;();;Argument[0].Element;ReturnValue.Element;value;manual |
+| System.Collections.Immutable;ImmutableList<>+Builder;false;Reverse;(System.Int32,System.Int32);;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections.Immutable;ImmutableList<>+Builder;false;ToImmutable;();;Argument[this];ReturnValue;taint;df-generated |
 | System.Collections.Immutable;ImmutableList<>+Builder;false;get_SyncRoot;();;Argument[this];ReturnValue;taint;df-generated |
 | System.Collections.Immutable;ImmutableList<>+Enumerator;false;get_Current;();;Argument[this];ReturnValue;taint;df-generated |
@@ -987,7 +992,7 @@ summary
 | System.Collections.Immutable;ImmutableList<>;false;FindLast;(System.Predicate<T>);;Argument[this].Element;Argument[0].Parameter[0];value;manual |
 | System.Collections.Immutable;ImmutableList<>;false;FindLast;(System.Predicate<T>);;Argument[this].Element;ReturnValue;value;manual |
 | System.Collections.Immutable;ImmutableList<>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Immutable.ImmutableList<>+Enumerator.Current];value;manual |
-| System.Collections.Immutable;ImmutableList<>;false;GetRange;(System.Int32,System.Int32);;Argument[this].Element;ReturnValue.Element;value;manual |
+| System.Collections.Immutable;ImmutableList<>;false;GetRange;(System.Int32,System.Int32);;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections.Immutable;ImmutableList<>;false;Insert;(System.Int32,T);;Argument[1];Argument[this].Element;value;manual |
 | System.Collections.Immutable;ImmutableList<>;false;InsertRange;(System.Int32,System.Collections.Generic.IEnumerable<T>);;Argument[1].Element;Argument[this].Element;value;manual |
 | System.Collections.Immutable;ImmutableList<>;false;Remove;(T);;Argument[this];ReturnValue;taint;df-generated |
@@ -1003,8 +1008,8 @@ summary
 | System.Collections.Immutable;ImmutableList<>;false;Replace;(T,T,System.Collections.Generic.IEqualityComparer<T>);;Argument[1];Argument[this];taint;df-generated |
 | System.Collections.Immutable;ImmutableList<>;false;Replace;(T,T,System.Collections.Generic.IEqualityComparer<T>);;Argument[1];ReturnValue;taint;df-generated |
 | System.Collections.Immutable;ImmutableList<>;false;Replace;(T,T,System.Collections.Generic.IEqualityComparer<T>);;Argument[this];ReturnValue;taint;df-generated |
-| System.Collections.Immutable;ImmutableList<>;false;Reverse;();;Argument[this].Element;ReturnValue.Element;value;manual |
-| System.Collections.Immutable;ImmutableList<>;false;Reverse;(System.Int32,System.Int32);;Argument[this].Element;ReturnValue.Element;value;manual |
+| System.Collections.Immutable;ImmutableList<>;false;Reverse;();;Argument[0].Element;ReturnValue.Element;value;manual |
+| System.Collections.Immutable;ImmutableList<>;false;Reverse;(System.Int32,System.Int32);;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections.Immutable;ImmutableList<>;false;SetItem;(System.Int32,T);;Argument[1];Argument[this];taint;df-generated |
 | System.Collections.Immutable;ImmutableList<>;false;SetItem;(System.Int32,T);;Argument[1];ReturnValue;taint;df-generated |
 | System.Collections.Immutable;ImmutableList<>;false;SetItem;(System.Int32,T);;Argument[this];ReturnValue;taint;df-generated |
@@ -1101,7 +1106,7 @@ summary
 | System.Collections.Immutable;ImmutableSortedSet;false;ToImmutableSortedSet<>;(System.Collections.Immutable.ImmutableSortedSet<TSource>+Builder);;Argument[0].Element;ReturnValue;taint;df-generated |
 | System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Immutable.ImmutableSortedSet<>+Enumerator.Current];value;manual |
 | System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;IntersectWith;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;Argument[this];taint;df-generated |
-| System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;Reverse;();;Argument[this].Element;ReturnValue.Element;value;manual |
+| System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;Reverse;();;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;SymmetricExceptWith;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;Argument[this];taint;df-generated |
 | System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;ToImmutable;();;Argument[this];ReturnValue;taint;df-generated |
 | System.Collections.Immutable;ImmutableSortedSet<>+Builder;false;TryGetValue;(T,T);;Argument[0];ReturnValue;taint;df-generated |
@@ -1119,7 +1124,7 @@ summary
 | System.Collections.Immutable;ImmutableSortedSet<>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.Property[System.Collections.Immutable.ImmutableSortedSet<>+Enumerator.Current];value;manual |
 | System.Collections.Immutable;ImmutableSortedSet<>;false;Intersect;(System.Collections.Generic.IEnumerable<T>);;Argument[this];ReturnValue;taint;df-generated |
 | System.Collections.Immutable;ImmutableSortedSet<>;false;Remove;(T);;Argument[this];ReturnValue;taint;df-generated |
-| System.Collections.Immutable;ImmutableSortedSet<>;false;Reverse;();;Argument[this].Element;ReturnValue.Element;value;manual |
+| System.Collections.Immutable;ImmutableSortedSet<>;false;Reverse;();;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections.Immutable;ImmutableSortedSet<>;false;SymmetricExcept;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;Argument[this];taint;df-generated |
 | System.Collections.Immutable;ImmutableSortedSet<>;false;SymmetricExcept;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;ReturnValue;taint;df-generated |
 | System.Collections.Immutable;ImmutableSortedSet<>;false;SymmetricExcept;(System.Collections.Generic.IEnumerable<T>);;Argument[this];ReturnValue;taint;df-generated |
@@ -1232,7 +1237,7 @@ summary
 | System.Collections.Specialized;NotifyCollectionChangedEventArgs;false;NotifyCollectionChangedEventArgs;(System.Collections.Specialized.NotifyCollectionChangedAction,System.Object,System.Object,System.Int32);;Argument[2];Argument[this];taint;df-generated |
 | System.Collections.Specialized;NotifyCollectionChangedEventArgs;false;get_NewItems;();;Argument[this];ReturnValue;taint;df-generated |
 | System.Collections.Specialized;NotifyCollectionChangedEventArgs;false;get_OldItems;();;Argument[this];ReturnValue;taint;df-generated |
-| System.Collections.Specialized;OrderedDictionary;false;AsReadOnly;();;Argument[this].Element;ReturnValue.Element;value;manual |
+| System.Collections.Specialized;OrderedDictionary;false;AsReadOnly;();;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections.Specialized;OrderedDictionary;false;GetObjectData;(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext);;Argument[this];Argument[0];taint;df-generated |
 | System.Collections.Specialized;OrderedDictionary;false;OrderedDictionary;(System.Int32,System.Collections.IEqualityComparer);;Argument[1];Argument[this];taint;df-generated |
 | System.Collections.Specialized;OrderedDictionary;false;OrderedDictionary;(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext);;Argument[0];Argument[this];taint;df-generated |
@@ -1253,22 +1258,24 @@ summary
 | System.Collections;ArrayList;false;Adapter;(System.Collections.IList);;Argument[0].Element;ReturnValue;taint;df-generated |
 | System.Collections;ArrayList;false;AddRange;(System.Collections.ICollection);;Argument[0].Element;Argument[this].Element;value;manual |
 | System.Collections;ArrayList;false;ArrayList;(System.Collections.ICollection);;Argument[0].Element;Argument[this];taint;df-generated |
-| System.Collections;ArrayList;false;Clone;();;Argument[this].Element;ReturnValue.Element;value;manual |
+| System.Collections;ArrayList;false;Clone;();;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections;ArrayList;false;CopyTo;(System.Array);;Argument[this];Argument[0].Element;taint;df-generated |
 | System.Collections;ArrayList;false;FixedSize;(System.Collections.ArrayList);;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections;ArrayList;false;FixedSize;(System.Collections.IList);;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections;ArrayList;false;GetEnumerator;(System.Int32,System.Int32);;Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
-| System.Collections;ArrayList;false;GetRange;(System.Int32,System.Int32);;Argument[this].Element;ReturnValue.Element;value;manual |
+| System.Collections;ArrayList;false;GetRange;(System.Int32,System.Int32);;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections;ArrayList;false;InsertRange;(System.Int32,System.Collections.ICollection);;Argument[1].Element;Argument[this].Element;value;manual |
 | System.Collections;ArrayList;false;ReadOnly;(System.Collections.ArrayList);;Argument[0].Element;ReturnValue;taint;df-generated |
 | System.Collections;ArrayList;false;ReadOnly;(System.Collections.IList);;Argument[0].Element;ReturnValue;taint;df-generated |
 | System.Collections;ArrayList;false;Repeat;(System.Object,System.Int32);;Argument[0];ReturnValue.Element;value;manual |
+| System.Collections;ArrayList;false;Reverse;();;Argument[0].Element;ReturnValue.Element;value;manual |
+| System.Collections;ArrayList;false;Reverse;(System.Int32,System.Int32);;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections;ArrayList;false;SetRange;(System.Int32,System.Collections.ICollection);;Argument[1].Element;Argument[this];taint;df-generated |
 | System.Collections;ArrayList;false;Synchronized;(System.Collections.ArrayList);;Argument[0].Element;ReturnValue;taint;df-generated |
 | System.Collections;ArrayList;false;Synchronized;(System.Collections.IList);;Argument[0].Element;ReturnValue;taint;df-generated |
 | System.Collections;ArrayList;false;get_SyncRoot;();;Argument[this];ReturnValue;value;df-generated |
 | System.Collections;BitArray;false;And;(System.Collections.BitArray);;Argument[this];ReturnValue;value;df-generated |
-| System.Collections;BitArray;false;Clone;();;Argument[this].Element;ReturnValue.Element;value;manual |
+| System.Collections;BitArray;false;Clone;();;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections;BitArray;false;LeftShift;(System.Int32);;Argument[this];ReturnValue;value;df-generated |
 | System.Collections;BitArray;false;Not;();;Argument[this];ReturnValue;value;df-generated |
 | System.Collections;BitArray;false;Or;(System.Collections.BitArray);;Argument[this];ReturnValue;value;df-generated |
@@ -1293,7 +1300,7 @@ summary
 | System.Collections;DictionaryEntry;false;get_Value;();;Argument[this];ReturnValue;taint;df-generated |
 | System.Collections;DictionaryEntry;false;set_Key;(System.Object);;Argument[0];Argument[this];taint;df-generated |
 | System.Collections;DictionaryEntry;false;set_Value;(System.Object);;Argument[0];Argument[this];taint;df-generated |
-| System.Collections;Hashtable;false;Clone;();;Argument[this].Element;ReturnValue.Element;value;manual |
+| System.Collections;Hashtable;false;Clone;();;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections;Hashtable;false;GetEnumerator;();;Argument[this];ReturnValue;taint;df-generated |
 | System.Collections;Hashtable;false;GetObjectData;(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext);;Argument[this];Argument[0];taint;df-generated |
 | System.Collections;Hashtable;false;Hashtable;(System.Collections.IDictionary);;Argument[0].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Key];value;manual |
@@ -1334,7 +1341,7 @@ summary
 | System.Collections;IList;true;get_Item;(System.Int32);;Argument[this].Element;ReturnValue;value;manual |
 | System.Collections;IList;true;set_Item;(System.Int32,System.Object);;Argument[1];Argument[this].Element;value;manual |
 | System.Collections;Queue;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
-| System.Collections;Queue;false;Clone;();;Argument[this].Element;ReturnValue.Element;value;manual |
+| System.Collections;Queue;false;Clone;();;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections;Queue;false;Dequeue;();;Argument[this];ReturnValue;taint;df-generated |
 | System.Collections;Queue;false;Enqueue;(System.Object);;Argument[0];Argument[this];taint;df-generated |
 | System.Collections;Queue;false;Peek;();;Argument[this].Element;ReturnValue;value;manual |
@@ -1343,7 +1350,7 @@ summary
 | System.Collections;Queue;false;get_SyncRoot;();;Argument[this];ReturnValue;value;df-generated |
 | System.Collections;ReadOnlyCollectionBase;false;get_InnerList;();;Argument[this];ReturnValue;taint;df-generated |
 | System.Collections;ReadOnlyCollectionBase;false;get_SyncRoot;();;Argument[this];ReturnValue;taint;df-generated |
-| System.Collections;SortedList;false;Clone;();;Argument[this].Element;ReturnValue.Element;value;manual |
+| System.Collections;SortedList;false;Clone;();;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections;SortedList;false;GetByIndex;(System.Int32);;Argument[this].Element.Property[System.Collections.Generic.KeyValuePair<,>.Value];ReturnValue;value;manual |
 | System.Collections;SortedList;false;GetEnumerator;();;Argument[this];ReturnValue;taint;df-generated |
 | System.Collections;SortedList;false;GetKey;(System.Int32);;Argument[this];ReturnValue;taint;df-generated |
@@ -1358,7 +1365,7 @@ summary
 | System.Collections;SortedList;false;Synchronized;(System.Collections.SortedList);;Argument[0].Element;ReturnValue;taint;df-generated |
 | System.Collections;SortedList;false;get_SyncRoot;();;Argument[this];ReturnValue;value;df-generated |
 | System.Collections;Stack;false;Clear;();;Argument[this].WithoutElement;Argument[this];value;manual |
-| System.Collections;Stack;false;Clone;();;Argument[this].Element;ReturnValue.Element;value;manual |
+| System.Collections;Stack;false;Clone;();;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Collections;Stack;false;Peek;();;Argument[this].Element;ReturnValue;value;manual |
 | System.Collections;Stack;false;Pop;();;Argument[this].Element;ReturnValue;value;manual |
 | System.Collections;Stack;false;Push;(System.Object);;Argument[0];Argument[this];taint;df-generated |
@@ -2237,7 +2244,7 @@ summary
 | System.Data;ITableMappingCollection;true;get_Item;(System.String);;Argument[this].Element;ReturnValue;value;manual |
 | System.Data;ITableMappingCollection;true;set_Item;(System.String,System.Object);;Argument[1];Argument[this].Element;value;manual |
 | System.Data;InternalDataCollectionBase;false;get_SyncRoot;();;Argument[this];ReturnValue;value;df-generated |
-| System.Data;PropertyCollection;false;Clone;();;Argument[this].Element;ReturnValue.Element;value;manual |
+| System.Data;PropertyCollection;false;Clone;();;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Data;TypedTableBase<>;false;Cast<>;();;Argument[this];ReturnValue;taint;df-generated |
 | System.Data;TypedTableBaseExtensions;false;AsEnumerable<>;(System.Data.TypedTableBase<TRow>);;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Data;TypedTableBaseExtensions;false;ElementAtOrDefault<>;(System.Data.TypedTableBase<TRow>,System.Int32);;Argument[0].Element;ReturnValue;value;manual |
@@ -5994,6 +6001,8 @@ summary
 | System.Runtime.CompilerServices;PoolingAsyncValueTaskMethodBuilder<>;false;SetResult;(TResult);;Argument[0];Argument[this];taint;df-generated |
 | System.Runtime.CompilerServices;PoolingAsyncValueTaskMethodBuilder<>;false;get_Task;();;Argument[this];ReturnValue;taint;df-generated |
 | System.Runtime.CompilerServices;ReadOnlyCollectionBuilder<>;false;ReadOnlyCollectionBuilder;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;Argument[this];taint;df-generated |
+| System.Runtime.CompilerServices;ReadOnlyCollectionBuilder<>;false;Reverse;();;Argument[0].Element;ReturnValue.Element;value;manual |
+| System.Runtime.CompilerServices;ReadOnlyCollectionBuilder<>;false;Reverse;(System.Int32,System.Int32);;Argument[0].Element;ReturnValue.Element;value;manual |
 | System.Runtime.CompilerServices;ReadOnlyCollectionBuilder<>;false;get_SyncRoot;();;Argument[this];ReturnValue;value;df-generated |
 | System.Runtime.CompilerServices;RuntimeWrappedException;false;GetObjectData;(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext);;Argument[this];Argument[0];taint;df-generated |
 | System.Runtime.CompilerServices;RuntimeWrappedException;false;RuntimeWrappedException;(System.Object);;Argument[0];Argument[this];taint;df-generated |
@@ -9019,7 +9028,7 @@ summary
 | System;Array;false;AsReadOnly<>;(T[]);;Argument[0].Element;ReturnValue.Element;value;manual |
 | System;Array;false;Clear;(System.Array);;Argument[0].WithoutElement;Argument[0];value;manual |
 | System;Array;false;Clear;(System.Array,System.Int32,System.Int32);;Argument[0].WithoutElement;Argument[0];value;manual |
-| System;Array;false;Clone;();;Argument[this].Element;ReturnValue.Element;value;manual |
+| System;Array;false;Clone;();;Argument[0].Element;ReturnValue.Element;value;manual |
 | System;Array;false;CopyTo;(System.Array,System.Int64);;Argument[this].Element;Argument[0].Element;value;manual |
 | System;Array;false;Fill<>;(T[],T);;Argument[1];Argument[0].Element;taint;df-generated |
 | System;Array;false;Fill<>;(T[],T,System.Int32,System.Int32);;Argument[1];Argument[0].Element;taint;df-generated |

csharp/ql/test/library-tests/dataflow/operators/operatorFlow.expected

@@ -1,186 +1,95 @@
 failures
-testFailures
 edges
 | Operator.cs:9:39:9:39 | x : C | Operator.cs:9:50:9:50 | access to parameter x : C |
-| Operator.cs:9:39:9:39 | x : C | Operator.cs:9:50:9:50 | access to parameter x : C |
-| Operator.cs:16:38:16:38 | x : C | Operator.cs:16:49:16:49 | access to parameter x : C |
 | Operator.cs:16:38:16:38 | x : C | Operator.cs:16:49:16:49 | access to parameter x : C |
 | Operator.cs:18:51:18:51 | y : C | Operator.cs:18:57:18:57 | access to parameter y : C |
-| Operator.cs:18:51:18:51 | y : C | Operator.cs:18:57:18:57 | access to parameter y : C |
-| Operator.cs:19:38:19:38 | x : C | Operator.cs:19:49:19:49 | access to parameter x : C |
 | Operator.cs:19:38:19:38 | x : C | Operator.cs:19:49:19:49 | access to parameter x : C |
 | Operator.cs:21:43:21:43 | y : C | Operator.cs:21:49:21:49 | access to parameter y : C |
-| Operator.cs:21:43:21:43 | y : C | Operator.cs:21:49:21:49 | access to parameter y : C |
-| Operator.cs:22:51:22:51 | y : C | Operator.cs:22:57:22:57 | access to parameter y : C |
 | Operator.cs:22:51:22:51 | y : C | Operator.cs:22:57:22:57 | access to parameter y : C |
 | Operator.cs:27:17:27:28 | call to method Source<C> : C | Operator.cs:29:17:29:17 | access to local variable x : C |
-| Operator.cs:27:17:27:28 | call to method Source<C> : C | Operator.cs:29:17:29:17 | access to local variable x : C |
-| Operator.cs:29:17:29:17 | access to local variable x : C | Operator.cs:16:38:16:38 | x : C |
 | Operator.cs:29:17:29:17 | access to local variable x : C | Operator.cs:16:38:16:38 | x : C |
 | Operator.cs:29:17:29:17 | access to local variable x : C | Operator.cs:29:17:29:21 | call to operator + : C |
-| Operator.cs:29:17:29:17 | access to local variable x : C | Operator.cs:29:17:29:21 | call to operator + : C |
-| Operator.cs:29:17:29:21 | call to operator + : C | Operator.cs:30:14:30:14 | access to local variable z |
 | Operator.cs:29:17:29:21 | call to operator + : C | Operator.cs:30:14:30:14 | access to local variable z |
 | Operator.cs:35:17:35:28 | call to method Source<C> : C | Operator.cs:37:27:37:27 | access to local variable x : C |
-| Operator.cs:35:17:35:28 | call to method Source<C> : C | Operator.cs:37:27:37:27 | access to local variable x : C |
-| Operator.cs:37:27:37:27 | access to local variable x : C | Operator.cs:19:38:19:38 | x : C |
 | Operator.cs:37:27:37:27 | access to local variable x : C | Operator.cs:19:38:19:38 | x : C |
 | Operator.cs:37:27:37:27 | access to local variable x : C | Operator.cs:37:27:37:31 | call to operator - : C |
-| Operator.cs:37:27:37:27 | access to local variable x : C | Operator.cs:37:27:37:31 | call to operator - : C |
-| Operator.cs:37:27:37:31 | call to operator - : C | Operator.cs:38:14:38:14 | access to local variable z |
 | Operator.cs:37:27:37:31 | call to operator - : C | Operator.cs:38:14:38:14 | access to local variable z |
 | Operator.cs:44:17:44:28 | call to method Source<C> : C | Operator.cs:45:29:45:29 | access to local variable y : C |
-| Operator.cs:44:17:44:28 | call to method Source<C> : C | Operator.cs:45:29:45:29 | access to local variable y : C |
-| Operator.cs:45:25:45:29 | call to operator checked - : C | Operator.cs:46:14:46:14 | access to local variable z |
 | Operator.cs:45:25:45:29 | call to operator checked - : C | Operator.cs:46:14:46:14 | access to local variable z |
 | Operator.cs:45:29:45:29 | access to local variable y : C | Operator.cs:18:51:18:51 | y : C |
-| Operator.cs:45:29:45:29 | access to local variable y : C | Operator.cs:18:51:18:51 | y : C |
-| Operator.cs:45:29:45:29 | access to local variable y : C | Operator.cs:45:25:45:29 | call to operator checked - : C |
 | Operator.cs:45:29:45:29 | access to local variable y : C | Operator.cs:45:25:45:29 | call to operator checked - : C |
 | Operator.cs:49:28:49:28 | x : C | Operator.cs:51:17:51:17 | access to parameter x : C |
-| Operator.cs:49:28:49:28 | x : C | Operator.cs:51:17:51:17 | access to parameter x : C |
-| Operator.cs:51:17:51:17 | access to parameter x : C | Operator.cs:9:39:9:39 | x : C |
 | Operator.cs:51:17:51:17 | access to parameter x : C | Operator.cs:9:39:9:39 | x : C |
 | Operator.cs:51:17:51:17 | access to parameter x : C | Operator.cs:51:17:51:21 | call to operator * : C |
-| Operator.cs:51:17:51:17 | access to parameter x : C | Operator.cs:51:17:51:21 | call to operator * : C |
-| Operator.cs:51:17:51:21 | call to operator * : C | Operator.cs:52:14:52:14 | (...) ... |
 | Operator.cs:51:17:51:21 | call to operator * : C | Operator.cs:52:14:52:14 | (...) ... |
 | Operator.cs:57:17:57:28 | call to method Source<C> : C | Operator.cs:59:15:59:15 | access to local variable x : C |
-| Operator.cs:57:17:57:28 | call to method Source<C> : C | Operator.cs:59:15:59:15 | access to local variable x : C |
-| Operator.cs:59:15:59:15 | access to local variable x : C | Operator.cs:49:28:49:28 | x : C |
 | Operator.cs:59:15:59:15 | access to local variable x : C | Operator.cs:49:28:49:28 | x : C |
 | Operator.cs:62:33:62:33 | y : C | Operator.cs:64:21:64:21 | access to parameter y : C |
-| Operator.cs:62:33:62:33 | y : C | Operator.cs:64:21:64:21 | access to parameter y : C |
-| Operator.cs:64:17:64:21 | call to operator / : C | Operator.cs:65:14:65:14 | (...) ... |
 | Operator.cs:64:17:64:21 | call to operator / : C | Operator.cs:65:14:65:14 | (...) ... |
 | Operator.cs:64:21:64:21 | access to parameter y : C | Operator.cs:21:43:21:43 | y : C |
-| Operator.cs:64:21:64:21 | access to parameter y : C | Operator.cs:21:43:21:43 | y : C |
-| Operator.cs:64:21:64:21 | access to parameter y : C | Operator.cs:64:17:64:21 | call to operator / : C |
 | Operator.cs:64:21:64:21 | access to parameter y : C | Operator.cs:64:17:64:21 | call to operator / : C |
 | Operator.cs:71:17:71:29 | call to method Source<C> : C | Operator.cs:72:18:72:18 | access to local variable y : C |
-| Operator.cs:71:17:71:29 | call to method Source<C> : C | Operator.cs:72:18:72:18 | access to local variable y : C |
-| Operator.cs:72:18:72:18 | access to local variable y : C | Operator.cs:62:33:62:33 | y : C |
 | Operator.cs:72:18:72:18 | access to local variable y : C | Operator.cs:62:33:62:33 | y : C |
 | Operator.cs:75:33:75:33 | y : C | Operator.cs:77:29:77:29 | access to parameter y : C |
-| Operator.cs:75:33:75:33 | y : C | Operator.cs:77:29:77:29 | access to parameter y : C |
-| Operator.cs:77:25:77:29 | call to operator checked / : C | Operator.cs:78:14:78:14 | (...) ... |
 | Operator.cs:77:25:77:29 | call to operator checked / : C | Operator.cs:78:14:78:14 | (...) ... |
 | Operator.cs:77:29:77:29 | access to parameter y : C | Operator.cs:22:51:22:51 | y : C |
-| Operator.cs:77:29:77:29 | access to parameter y : C | Operator.cs:22:51:22:51 | y : C |
-| Operator.cs:77:29:77:29 | access to parameter y : C | Operator.cs:77:25:77:29 | call to operator checked / : C |
 | Operator.cs:77:29:77:29 | access to parameter y : C | Operator.cs:77:25:77:29 | call to operator checked / : C |
 | Operator.cs:84:17:84:29 | call to method Source<C> : C | Operator.cs:85:18:85:18 | access to local variable y : C |
-| Operator.cs:84:17:84:29 | call to method Source<C> : C | Operator.cs:85:18:85:18 | access to local variable y : C |
-| Operator.cs:85:18:85:18 | access to local variable y : C | Operator.cs:75:33:75:33 | y : C |
 | Operator.cs:85:18:85:18 | access to local variable y : C | Operator.cs:75:33:75:33 | y : C |
 nodes
 | Operator.cs:9:39:9:39 | x : C | semmle.label | x : C |
-| Operator.cs:9:39:9:39 | x : C | semmle.label | x : C |
-| Operator.cs:9:50:9:50 | access to parameter x : C | semmle.label | access to parameter x : C |
 | Operator.cs:9:50:9:50 | access to parameter x : C | semmle.label | access to parameter x : C |
 | Operator.cs:16:38:16:38 | x : C | semmle.label | x : C |
-| Operator.cs:16:38:16:38 | x : C | semmle.label | x : C |
-| Operator.cs:16:49:16:49 | access to parameter x : C | semmle.label | access to parameter x : C |
 | Operator.cs:16:49:16:49 | access to parameter x : C | semmle.label | access to parameter x : C |
 | Operator.cs:18:51:18:51 | y : C | semmle.label | y : C |
-| Operator.cs:18:51:18:51 | y : C | semmle.label | y : C |
-| Operator.cs:18:57:18:57 | access to parameter y : C | semmle.label | access to parameter y : C |
 | Operator.cs:18:57:18:57 | access to parameter y : C | semmle.label | access to parameter y : C |
 | Operator.cs:19:38:19:38 | x : C | semmle.label | x : C |
-| Operator.cs:19:38:19:38 | x : C | semmle.label | x : C |
-| Operator.cs:19:49:19:49 | access to parameter x : C | semmle.label | access to parameter x : C |
 | Operator.cs:19:49:19:49 | access to parameter x : C | semmle.label | access to parameter x : C |
 | Operator.cs:21:43:21:43 | y : C | semmle.label | y : C |
-| Operator.cs:21:43:21:43 | y : C | semmle.label | y : C |
-| Operator.cs:21:49:21:49 | access to parameter y : C | semmle.label | access to parameter y : C |
 | Operator.cs:21:49:21:49 | access to parameter y : C | semmle.label | access to parameter y : C |
 | Operator.cs:22:51:22:51 | y : C | semmle.label | y : C |
-| Operator.cs:22:51:22:51 | y : C | semmle.label | y : C |
-| Operator.cs:22:57:22:57 | access to parameter y : C | semmle.label | access to parameter y : C |
 | Operator.cs:22:57:22:57 | access to parameter y : C | semmle.label | access to parameter y : C |
 | Operator.cs:27:17:27:28 | call to method Source<C> : C | semmle.label | call to method Source<C> : C |
-| Operator.cs:27:17:27:28 | call to method Source<C> : C | semmle.label | call to method Source<C> : C |
-| Operator.cs:29:17:29:17 | access to local variable x : C | semmle.label | access to local variable x : C |
 | Operator.cs:29:17:29:17 | access to local variable x : C | semmle.label | access to local variable x : C |
 | Operator.cs:29:17:29:21 | call to operator + : C | semmle.label | call to operator + : C |
-| Operator.cs:29:17:29:21 | call to operator + : C | semmle.label | call to operator + : C |
-| Operator.cs:30:14:30:14 | access to local variable z | semmle.label | access to local variable z |
 | Operator.cs:30:14:30:14 | access to local variable z | semmle.label | access to local variable z |
 | Operator.cs:35:17:35:28 | call to method Source<C> : C | semmle.label | call to method Source<C> : C |
-| Operator.cs:35:17:35:28 | call to method Source<C> : C | semmle.label | call to method Source<C> : C |
-| Operator.cs:37:27:37:27 | access to local variable x : C | semmle.label | access to local variable x : C |
 | Operator.cs:37:27:37:27 | access to local variable x : C | semmle.label | access to local variable x : C |
 | Operator.cs:37:27:37:31 | call to operator - : C | semmle.label | call to operator - : C |
-| Operator.cs:37:27:37:31 | call to operator - : C | semmle.label | call to operator - : C |
-| Operator.cs:38:14:38:14 | access to local variable z | semmle.label | access to local variable z |
 | Operator.cs:38:14:38:14 | access to local variable z | semmle.label | access to local variable z |
 | Operator.cs:44:17:44:28 | call to method Source<C> : C | semmle.label | call to method Source<C> : C |
-| Operator.cs:44:17:44:28 | call to method Source<C> : C | semmle.label | call to method Source<C> : C |
-| Operator.cs:45:25:45:29 | call to operator checked - : C | semmle.label | call to operator checked - : C |
 | Operator.cs:45:25:45:29 | call to operator checked - : C | semmle.label | call to operator checked - : C |
 | Operator.cs:45:29:45:29 | access to local variable y : C | semmle.label | access to local variable y : C |
-| Operator.cs:45:29:45:29 | access to local variable y : C | semmle.label | access to local variable y : C |
-| Operator.cs:46:14:46:14 | access to local variable z | semmle.label | access to local variable z |
 | Operator.cs:46:14:46:14 | access to local variable z | semmle.label | access to local variable z |
 | Operator.cs:49:28:49:28 | x : C | semmle.label | x : C |
-| Operator.cs:49:28:49:28 | x : C | semmle.label | x : C |
-| Operator.cs:51:17:51:17 | access to parameter x : C | semmle.label | access to parameter x : C |
 | Operator.cs:51:17:51:17 | access to parameter x : C | semmle.label | access to parameter x : C |
 | Operator.cs:51:17:51:21 | call to operator * : C | semmle.label | call to operator * : C |
-| Operator.cs:51:17:51:21 | call to operator * : C | semmle.label | call to operator * : C |
-| Operator.cs:52:14:52:14 | (...) ... | semmle.label | (...) ... |
 | Operator.cs:52:14:52:14 | (...) ... | semmle.label | (...) ... |
 | Operator.cs:57:17:57:28 | call to method Source<C> : C | semmle.label | call to method Source<C> : C |
-| Operator.cs:57:17:57:28 | call to method Source<C> : C | semmle.label | call to method Source<C> : C |
-| Operator.cs:59:15:59:15 | access to local variable x : C | semmle.label | access to local variable x : C |
 | Operator.cs:59:15:59:15 | access to local variable x : C | semmle.label | access to local variable x : C |
 | Operator.cs:62:33:62:33 | y : C | semmle.label | y : C |
-| Operator.cs:62:33:62:33 | y : C | semmle.label | y : C |
-| Operator.cs:64:17:64:21 | call to operator / : C | semmle.label | call to operator / : C |
 | Operator.cs:64:17:64:21 | call to operator / : C | semmle.label | call to operator / : C |
 | Operator.cs:64:21:64:21 | access to parameter y : C | semmle.label | access to parameter y : C |
-| Operator.cs:64:21:64:21 | access to parameter y : C | semmle.label | access to parameter y : C |
-| Operator.cs:65:14:65:14 | (...) ... | semmle.label | (...) ... |
 | Operator.cs:65:14:65:14 | (...) ... | semmle.label | (...) ... |
 | Operator.cs:71:17:71:29 | call to method Source<C> : C | semmle.label | call to method Source<C> : C |
-| Operator.cs:71:17:71:29 | call to method Source<C> : C | semmle.label | call to method Source<C> : C |
-| Operator.cs:72:18:72:18 | access to local variable y : C | semmle.label | access to local variable y : C |
 | Operator.cs:72:18:72:18 | access to local variable y : C | semmle.label | access to local variable y : C |
 | Operator.cs:75:33:75:33 | y : C | semmle.label | y : C |
-| Operator.cs:75:33:75:33 | y : C | semmle.label | y : C |
-| Operator.cs:77:25:77:29 | call to operator checked / : C | semmle.label | call to operator checked / : C |
 | Operator.cs:77:25:77:29 | call to operator checked / : C | semmle.label | call to operator checked / : C |
 | Operator.cs:77:29:77:29 | access to parameter y : C | semmle.label | access to parameter y : C |
-| Operator.cs:77:29:77:29 | access to parameter y : C | semmle.label | access to parameter y : C |
-| Operator.cs:78:14:78:14 | (...) ... | semmle.label | (...) ... |
 | Operator.cs:78:14:78:14 | (...) ... | semmle.label | (...) ... |
 | Operator.cs:84:17:84:29 | call to method Source<C> : C | semmle.label | call to method Source<C> : C |
-| Operator.cs:84:17:84:29 | call to method Source<C> : C | semmle.label | call to method Source<C> : C |
-| Operator.cs:85:18:85:18 | access to local variable y : C | semmle.label | access to local variable y : C |
 | Operator.cs:85:18:85:18 | access to local variable y : C | semmle.label | access to local variable y : C |
 subpaths
 | Operator.cs:29:17:29:17 | access to local variable x : C | Operator.cs:16:38:16:38 | x : C | Operator.cs:16:49:16:49 | access to parameter x : C | Operator.cs:29:17:29:21 | call to operator + : C |
-| Operator.cs:29:17:29:17 | access to local variable x : C | Operator.cs:16:38:16:38 | x : C | Operator.cs:16:49:16:49 | access to parameter x : C | Operator.cs:29:17:29:21 | call to operator + : C |
-| Operator.cs:37:27:37:27 | access to local variable x : C | Operator.cs:19:38:19:38 | x : C | Operator.cs:19:49:19:49 | access to parameter x : C | Operator.cs:37:27:37:31 | call to operator - : C |
 | Operator.cs:37:27:37:27 | access to local variable x : C | Operator.cs:19:38:19:38 | x : C | Operator.cs:19:49:19:49 | access to parameter x : C | Operator.cs:37:27:37:31 | call to operator - : C |
 | Operator.cs:45:29:45:29 | access to local variable y : C | Operator.cs:18:51:18:51 | y : C | Operator.cs:18:57:18:57 | access to parameter y : C | Operator.cs:45:25:45:29 | call to operator checked - : C |
-| Operator.cs:45:29:45:29 | access to local variable y : C | Operator.cs:18:51:18:51 | y : C | Operator.cs:18:57:18:57 | access to parameter y : C | Operator.cs:45:25:45:29 | call to operator checked - : C |
-| Operator.cs:51:17:51:17 | access to parameter x : C | Operator.cs:9:39:9:39 | x : C | Operator.cs:9:50:9:50 | access to parameter x : C | Operator.cs:51:17:51:21 | call to operator * : C |
 | Operator.cs:51:17:51:17 | access to parameter x : C | Operator.cs:9:39:9:39 | x : C | Operator.cs:9:50:9:50 | access to parameter x : C | Operator.cs:51:17:51:21 | call to operator * : C |
 | Operator.cs:64:21:64:21 | access to parameter y : C | Operator.cs:21:43:21:43 | y : C | Operator.cs:21:49:21:49 | access to parameter y : C | Operator.cs:64:17:64:21 | call to operator / : C |
-| Operator.cs:64:21:64:21 | access to parameter y : C | Operator.cs:21:43:21:43 | y : C | Operator.cs:21:49:21:49 | access to parameter y : C | Operator.cs:64:17:64:21 | call to operator / : C |
-| Operator.cs:77:29:77:29 | access to parameter y : C | Operator.cs:22:51:22:51 | y : C | Operator.cs:22:57:22:57 | access to parameter y : C | Operator.cs:77:25:77:29 | call to operator checked / : C |
 | Operator.cs:77:29:77:29 | access to parameter y : C | Operator.cs:22:51:22:51 | y : C | Operator.cs:22:57:22:57 | access to parameter y : C | Operator.cs:77:25:77:29 | call to operator checked / : C |
 #select
 | Operator.cs:30:14:30:14 | access to local variable z | Operator.cs:27:17:27:28 | call to method Source<C> : C | Operator.cs:30:14:30:14 | access to local variable z | $@ | Operator.cs:27:17:27:28 | call to method Source<C> : C | call to method Source<C> : C |
-| Operator.cs:30:14:30:14 | access to local variable z | Operator.cs:27:17:27:28 | call to method Source<C> : C | Operator.cs:30:14:30:14 | access to local variable z | $@ | Operator.cs:27:17:27:28 | call to method Source<C> : C | call to method Source<C> : C |
-| Operator.cs:38:14:38:14 | access to local variable z | Operator.cs:35:17:35:28 | call to method Source<C> : C | Operator.cs:38:14:38:14 | access to local variable z | $@ | Operator.cs:35:17:35:28 | call to method Source<C> : C | call to method Source<C> : C |
 | Operator.cs:38:14:38:14 | access to local variable z | Operator.cs:35:17:35:28 | call to method Source<C> : C | Operator.cs:38:14:38:14 | access to local variable z | $@ | Operator.cs:35:17:35:28 | call to method Source<C> : C | call to method Source<C> : C |
 | Operator.cs:46:14:46:14 | access to local variable z | Operator.cs:44:17:44:28 | call to method Source<C> : C | Operator.cs:46:14:46:14 | access to local variable z | $@ | Operator.cs:44:17:44:28 | call to method Source<C> : C | call to method Source<C> : C |
-| Operator.cs:46:14:46:14 | access to local variable z | Operator.cs:44:17:44:28 | call to method Source<C> : C | Operator.cs:46:14:46:14 | access to local variable z | $@ | Operator.cs:44:17:44:28 | call to method Source<C> : C | call to method Source<C> : C |
-| Operator.cs:52:14:52:14 | (...) ... | Operator.cs:57:17:57:28 | call to method Source<C> : C | Operator.cs:52:14:52:14 | (...) ... | $@ | Operator.cs:57:17:57:28 | call to method Source<C> : C | call to method Source<C> : C |
 | Operator.cs:52:14:52:14 | (...) ... | Operator.cs:57:17:57:28 | call to method Source<C> : C | Operator.cs:52:14:52:14 | (...) ... | $@ | Operator.cs:57:17:57:28 | call to method Source<C> : C | call to method Source<C> : C |
 | Operator.cs:65:14:65:14 | (...) ... | Operator.cs:71:17:71:29 | call to method Source<C> : C | Operator.cs:65:14:65:14 | (...) ... | $@ | Operator.cs:71:17:71:29 | call to method Source<C> : C | call to method Source<C> : C |
-| Operator.cs:65:14:65:14 | (...) ... | Operator.cs:71:17:71:29 | call to method Source<C> : C | Operator.cs:65:14:65:14 | (...) ... | $@ | Operator.cs:71:17:71:29 | call to method Source<C> : C | call to method Source<C> : C |
-| Operator.cs:78:14:78:14 | (...) ... | Operator.cs:84:17:84:29 | call to method Source<C> : C | Operator.cs:78:14:78:14 | (...) ... | $@ | Operator.cs:84:17:84:29 | call to method Source<C> : C | call to method Source<C> : C |
 | Operator.cs:78:14:78:14 | (...) ... | Operator.cs:84:17:84:29 | call to method Source<C> : C | Operator.cs:78:14:78:14 | (...) ... | $@ | Operator.cs:84:17:84:29 | call to method Source<C> : C | call to method Source<C> : C |

csharp/ql/test/library-tests/dataflow/operators/operatorFlow.ql

@@ -3,10 +3,9 @@
  */
 
 import csharp
+import DefaultValueFlow::PathGraph
 import TestUtilities.InlineFlowTest
-import DefaultFlowTest
-import PathGraph
 
-from PathNode source, PathNode sink
-where flowPath(source, sink)
+from DefaultValueFlow::PathNode source, DefaultValueFlow::PathNode sink
+where DefaultValueFlow::flowPath(source, sink)
 select sink, source, sink, "$@", source, source.toString()

csharp/ql/test/library-tests/dataflow/patterns/PatternFlow.expected

@@ -1,5 +1,4 @@
 failures
-testFailures
 edges
 nodes
 subpaths

csharp/ql/test/library-tests/dataflow/patterns/PatternFlow.ql

@@ -3,10 +3,9 @@
  */
 
 import csharp
+import DefaultValueFlow::PathGraph
 import TestUtilities.InlineFlowTest
-import DefaultFlowTest
-import PathGraph
 
-from PathNode source, PathNode sink
-where flowPath(source, sink)
+from DefaultValueFlow::PathNode source, DefaultValueFlow::PathNode sink
+where DefaultValueFlow::flowPath(source, sink)
 select sink, source, sink, "$@", source, source.toString()

csharp/ql/test/library-tests/dataflow/tuples/Tuples.expected

@@ -1,462 +1,233 @@
 failures
-testFailures
 edges
 | Tuples.cs:7:18:7:34 | call to method Source<Object> : Object | Tuples.cs:10:21:10:22 | access to local variable o1 : Object |
-| Tuples.cs:7:18:7:34 | call to method Source<Object> : Object | Tuples.cs:10:21:10:22 | access to local variable o1 : Object |
-| Tuples.cs:8:18:8:34 | call to method Source<Object> : Object | Tuples.cs:10:29:10:30 | access to local variable o2 : Object |
 | Tuples.cs:8:18:8:34 | call to method Source<Object> : Object | Tuples.cs:10:29:10:30 | access to local variable o2 : Object |
 | Tuples.cs:10:17:10:32 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object | Tuples.cs:11:9:11:23 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object |
-| Tuples.cs:10:17:10:32 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object | Tuples.cs:11:9:11:23 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object |
-| Tuples.cs:10:17:10:32 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object | Tuples.cs:16:9:16:19 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object |
 | Tuples.cs:10:17:10:32 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object | Tuples.cs:16:9:16:19 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object |
 | Tuples.cs:10:17:10:32 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object | Tuples.cs:21:9:21:22 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object |
-| Tuples.cs:10:17:10:32 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object | Tuples.cs:21:9:21:22 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object |
-| Tuples.cs:10:17:10:32 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object | Tuples.cs:26:14:26:14 | access to local variable x : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object |
 | Tuples.cs:10:17:10:32 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object | Tuples.cs:26:14:26:14 | access to local variable x : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object |
 | Tuples.cs:10:17:10:32 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object | Tuples.cs:27:14:27:14 | access to local variable x : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object |
-| Tuples.cs:10:17:10:32 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object | Tuples.cs:27:14:27:14 | access to local variable x : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object |
-| Tuples.cs:10:17:10:32 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object | Tuples.cs:11:9:11:23 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object |
 | Tuples.cs:10:17:10:32 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object | Tuples.cs:11:9:11:23 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object |
 | Tuples.cs:10:17:10:32 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object | Tuples.cs:16:9:16:19 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object |
-| Tuples.cs:10:17:10:32 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object | Tuples.cs:16:9:16:19 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object |
-| Tuples.cs:10:17:10:32 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object | Tuples.cs:21:9:21:22 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object |
 | Tuples.cs:10:17:10:32 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object | Tuples.cs:21:9:21:22 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object |
 | Tuples.cs:10:17:10:32 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object | Tuples.cs:29:14:29:14 | access to local variable x : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object |
-| Tuples.cs:10:17:10:32 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object | Tuples.cs:29:14:29:14 | access to local variable x : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object |
-| Tuples.cs:10:21:10:22 | access to local variable o1 : Object | Tuples.cs:10:17:10:32 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object |
 | Tuples.cs:10:21:10:22 | access to local variable o1 : Object | Tuples.cs:10:17:10:32 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object |
 | Tuples.cs:10:25:10:31 | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object | Tuples.cs:10:17:10:32 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object |
-| Tuples.cs:10:25:10:31 | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object | Tuples.cs:10:17:10:32 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object |
-| Tuples.cs:10:29:10:30 | access to local variable o2 : Object | Tuples.cs:10:25:10:31 | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object |
 | Tuples.cs:10:29:10:30 | access to local variable o2 : Object | Tuples.cs:10:25:10:31 | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object |
 | Tuples.cs:11:9:11:23 | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object | Tuples.cs:11:9:11:27 | SSA def(c) : Object |
-| Tuples.cs:11:9:11:23 | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object | Tuples.cs:11:9:11:27 | SSA def(c) : Object |
-| Tuples.cs:11:9:11:23 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object | Tuples.cs:11:9:11:27 | SSA def(a) : Object |
 | Tuples.cs:11:9:11:23 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object | Tuples.cs:11:9:11:27 | SSA def(a) : Object |
 | Tuples.cs:11:9:11:23 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object | Tuples.cs:11:9:11:23 | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object |
-| Tuples.cs:11:9:11:23 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object | Tuples.cs:11:9:11:23 | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object |
-| Tuples.cs:11:9:11:27 | SSA def(a) : Object | Tuples.cs:12:14:12:14 | access to local variable a |
 | Tuples.cs:11:9:11:27 | SSA def(a) : Object | Tuples.cs:12:14:12:14 | access to local variable a |
 | Tuples.cs:11:9:11:27 | SSA def(c) : Object | Tuples.cs:14:14:14:14 | access to local variable c |
-| Tuples.cs:11:9:11:27 | SSA def(c) : Object | Tuples.cs:14:14:14:14 | access to local variable c |
-| Tuples.cs:16:9:16:19 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object | Tuples.cs:16:9:16:23 | SSA def(a) : Object |
 | Tuples.cs:16:9:16:19 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object | Tuples.cs:16:9:16:23 | SSA def(a) : Object |
 | Tuples.cs:16:9:16:19 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object | Tuples.cs:16:13:16:18 | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object |
-| Tuples.cs:16:9:16:19 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object | Tuples.cs:16:13:16:18 | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object |
-| Tuples.cs:16:9:16:23 | SSA def(a) : Object | Tuples.cs:17:14:17:14 | access to local variable a |
 | Tuples.cs:16:9:16:23 | SSA def(a) : Object | Tuples.cs:17:14:17:14 | access to local variable a |
 | Tuples.cs:16:9:16:23 | SSA def(c) : Object | Tuples.cs:19:14:19:14 | access to local variable c |
-| Tuples.cs:16:9:16:23 | SSA def(c) : Object | Tuples.cs:19:14:19:14 | access to local variable c |
-| Tuples.cs:16:13:16:18 | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object | Tuples.cs:16:9:16:23 | SSA def(c) : Object |
 | Tuples.cs:16:13:16:18 | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object | Tuples.cs:16:9:16:23 | SSA def(c) : Object |
 | Tuples.cs:21:9:21:22 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object | Tuples.cs:21:9:21:26 | SSA def(p) : Object |
-| Tuples.cs:21:9:21:22 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object | Tuples.cs:21:9:21:26 | SSA def(p) : Object |
-| Tuples.cs:21:9:21:22 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object | Tuples.cs:21:9:21:26 | SSA def(q) : ValueTuple<Int32,Object> [field Item2] : Object |
 | Tuples.cs:21:9:21:22 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object | Tuples.cs:21:9:21:26 | SSA def(q) : ValueTuple<Int32,Object> [field Item2] : Object |
 | Tuples.cs:21:9:21:26 | SSA def(p) : Object | Tuples.cs:22:14:22:14 | access to local variable p |
-| Tuples.cs:21:9:21:26 | SSA def(p) : Object | Tuples.cs:22:14:22:14 | access to local variable p |
-| Tuples.cs:21:9:21:26 | SSA def(q) : ValueTuple<Int32,Object> [field Item2] : Object | Tuples.cs:24:14:24:14 | access to local variable q : ValueTuple<Int32,Object> [field Item2] : Object |
 | Tuples.cs:21:9:21:26 | SSA def(q) : ValueTuple<Int32,Object> [field Item2] : Object | Tuples.cs:24:14:24:14 | access to local variable q : ValueTuple<Int32,Object> [field Item2] : Object |
 | Tuples.cs:24:14:24:14 | access to local variable q : ValueTuple<Int32,Object> [field Item2] : Object | Tuples.cs:24:14:24:20 | access to field Item2 |
-| Tuples.cs:24:14:24:14 | access to local variable q : ValueTuple<Int32,Object> [field Item2] : Object | Tuples.cs:24:14:24:20 | access to field Item2 |
-| Tuples.cs:26:14:26:14 | access to local variable x : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object | Tuples.cs:26:14:26:20 | access to field Item1 |
 | Tuples.cs:26:14:26:14 | access to local variable x : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object | Tuples.cs:26:14:26:20 | access to field Item1 |
 | Tuples.cs:27:14:27:14 | access to local variable x : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object | Tuples.cs:27:14:27:16 | access to field Item1 |
-| Tuples.cs:27:14:27:14 | access to local variable x : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object | Tuples.cs:27:14:27:16 | access to field Item1 |
-| Tuples.cs:29:14:29:14 | access to local variable x : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object | Tuples.cs:29:14:29:20 | access to field Item2 : ValueTuple<Int32,Object> [field Item2] : Object |
 | Tuples.cs:29:14:29:14 | access to local variable x : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object | Tuples.cs:29:14:29:20 | access to field Item2 : ValueTuple<Int32,Object> [field Item2] : Object |
 | Tuples.cs:29:14:29:20 | access to field Item2 : ValueTuple<Int32,Object> [field Item2] : Object | Tuples.cs:29:14:29:26 | access to field Item2 |
-| Tuples.cs:29:14:29:20 | access to field Item2 : ValueTuple<Int32,Object> [field Item2] : Object | Tuples.cs:29:14:29:26 | access to field Item2 |
-| Tuples.cs:34:18:34:34 | call to method Source<Object> : Object | Tuples.cs:37:18:37:19 | access to local variable o1 : Object |
 | Tuples.cs:34:18:34:34 | call to method Source<Object> : Object | Tuples.cs:37:18:37:19 | access to local variable o1 : Object |
 | Tuples.cs:35:18:35:34 | call to method Source<Object> : Object | Tuples.cs:37:46:37:47 | access to local variable o2 : Object |
-| Tuples.cs:35:18:35:34 | call to method Source<Object> : Object | Tuples.cs:37:46:37:47 | access to local variable o2 : Object |
-| Tuples.cs:37:17:37:48 | (..., ...) : ValueTuple<Object,Int32,Int32,Int32,Int32,Int32,Int32,ValueTuple<Int32,Int32,Object>> [field Item1] : Object | Tuples.cs:38:14:38:14 | access to local variable x : ValueTuple<Object,Int32,Int32,Int32,Int32,Int32,Int32,ValueTuple<Int32,Int32,Object>> [field Item1] : Object |
 | Tuples.cs:37:17:37:48 | (..., ...) : ValueTuple<Object,Int32,Int32,Int32,Int32,Int32,Int32,ValueTuple<Int32,Int32,Object>> [field Item1] : Object | Tuples.cs:38:14:38:14 | access to local variable x : ValueTuple<Object,Int32,Int32,Int32,Int32,Int32,Int32,ValueTuple<Int32,Int32,Object>> [field Item1] : Object |
 | Tuples.cs:37:17:37:48 | (..., ...) : ValueTuple<Object,Int32,Int32,Int32,Int32,Int32,Int32,ValueTuple<Int32,Int32,Object>> [field Item10] : Object | Tuples.cs:40:14:40:14 | access to local variable x : ValueTuple<Object,Int32,Int32,Int32,Int32,Int32,Int32,ValueTuple<Int32,Int32,Object>> [field Item10] : Object |
-| Tuples.cs:37:17:37:48 | (..., ...) : ValueTuple<Object,Int32,Int32,Int32,Int32,Int32,Int32,ValueTuple<Int32,Int32,Object>> [field Item10] : Object | Tuples.cs:40:14:40:14 | access to local variable x : ValueTuple<Object,Int32,Int32,Int32,Int32,Int32,Int32,ValueTuple<Int32,Int32,Object>> [field Item10] : Object |
-| Tuples.cs:37:18:37:19 | access to local variable o1 : Object | Tuples.cs:37:17:37:48 | (..., ...) : ValueTuple<Object,Int32,Int32,Int32,Int32,Int32,Int32,ValueTuple<Int32,Int32,Object>> [field Item1] : Object |
 | Tuples.cs:37:18:37:19 | access to local variable o1 : Object | Tuples.cs:37:17:37:48 | (..., ...) : ValueTuple<Object,Int32,Int32,Int32,Int32,Int32,Int32,ValueTuple<Int32,Int32,Object>> [field Item1] : Object |
 | Tuples.cs:37:46:37:47 | access to local variable o2 : Object | Tuples.cs:37:17:37:48 | (..., ...) : ValueTuple<Object,Int32,Int32,Int32,Int32,Int32,Int32,ValueTuple<Int32,Int32,Object>> [field Item10] : Object |
-| Tuples.cs:37:46:37:47 | access to local variable o2 : Object | Tuples.cs:37:17:37:48 | (..., ...) : ValueTuple<Object,Int32,Int32,Int32,Int32,Int32,Int32,ValueTuple<Int32,Int32,Object>> [field Item10] : Object |
-| Tuples.cs:38:14:38:14 | access to local variable x : ValueTuple<Object,Int32,Int32,Int32,Int32,Int32,Int32,ValueTuple<Int32,Int32,Object>> [field Item1] : Object | Tuples.cs:38:14:38:20 | access to field Item1 |
 | Tuples.cs:38:14:38:14 | access to local variable x : ValueTuple<Object,Int32,Int32,Int32,Int32,Int32,Int32,ValueTuple<Int32,Int32,Object>> [field Item1] : Object | Tuples.cs:38:14:38:20 | access to field Item1 |
 | Tuples.cs:40:14:40:14 | access to local variable x : ValueTuple<Object,Int32,Int32,Int32,Int32,Int32,Int32,ValueTuple<Int32,Int32,Object>> [field Item10] : Object | Tuples.cs:40:14:40:21 | access to field Item10 |
-| Tuples.cs:40:14:40:14 | access to local variable x : ValueTuple<Object,Int32,Int32,Int32,Int32,Int32,Int32,ValueTuple<Int32,Int32,Object>> [field Item10] : Object | Tuples.cs:40:14:40:21 | access to field Item10 |
-| Tuples.cs:45:17:45:33 | call to method Source<String> : String | Tuples.cs:46:48:46:48 | access to local variable o : String |
 | Tuples.cs:45:17:45:33 | call to method Source<String> : String | Tuples.cs:46:48:46:48 | access to local variable o : String |
 | Tuples.cs:46:17:46:55 | (...) ... : ValueTuple<String,Int32,Int32> [field Item1] : String | Tuples.cs:47:14:47:14 | access to local variable x : ValueTuple<String,Int32,Int32> [field Item1] : String |
-| Tuples.cs:46:17:46:55 | (...) ... : ValueTuple<String,Int32,Int32> [field Item1] : String | Tuples.cs:47:14:47:14 | access to local variable x : ValueTuple<String,Int32,Int32> [field Item1] : String |
-| Tuples.cs:46:47:46:55 | (..., ...) : ValueTuple<String,Int32,Int32> [field Item1] : String | Tuples.cs:46:17:46:55 | (...) ... : ValueTuple<String,Int32,Int32> [field Item1] : String |
 | Tuples.cs:46:47:46:55 | (..., ...) : ValueTuple<String,Int32,Int32> [field Item1] : String | Tuples.cs:46:17:46:55 | (...) ... : ValueTuple<String,Int32,Int32> [field Item1] : String |
 | Tuples.cs:46:48:46:48 | access to local variable o : String | Tuples.cs:46:47:46:55 | (..., ...) : ValueTuple<String,Int32,Int32> [field Item1] : String |
-| Tuples.cs:46:48:46:48 | access to local variable o : String | Tuples.cs:46:47:46:55 | (..., ...) : ValueTuple<String,Int32,Int32> [field Item1] : String |
-| Tuples.cs:47:14:47:14 | access to local variable x : ValueTuple<String,Int32,Int32> [field Item1] : String | Tuples.cs:47:14:47:20 | access to field Item1 |
 | Tuples.cs:47:14:47:14 | access to local variable x : ValueTuple<String,Int32,Int32> [field Item1] : String | Tuples.cs:47:14:47:20 | access to field Item1 |
 | Tuples.cs:57:18:57:34 | call to method Source<String> : String | Tuples.cs:59:18:59:19 | access to local variable o1 : String |
-| Tuples.cs:57:18:57:34 | call to method Source<String> : String | Tuples.cs:59:18:59:19 | access to local variable o1 : String |
-| Tuples.cs:58:18:58:34 | call to method Source<String> : String | Tuples.cs:59:26:59:27 | access to local variable o2 : String |
 | Tuples.cs:58:18:58:34 | call to method Source<String> : String | Tuples.cs:59:26:59:27 | access to local variable o2 : String |
 | Tuples.cs:59:17:59:32 | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item1] : String | Tuples.cs:62:18:62:57 | SSA def(t) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item1] : String |
-| Tuples.cs:59:17:59:32 | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item1] : String | Tuples.cs:62:18:62:57 | SSA def(t) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item1] : String |
-| Tuples.cs:59:17:59:32 | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item1] : String | Tuples.cs:67:18:67:35 | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item1] : String |
 | Tuples.cs:59:17:59:32 | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item1] : String | Tuples.cs:67:18:67:35 | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item1] : String |
 | Tuples.cs:59:17:59:32 | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item1] : String | Tuples.cs:87:18:87:35 | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item1] : String |
-| Tuples.cs:59:17:59:32 | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item1] : String | Tuples.cs:87:18:87:35 | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item1] : String |
-| Tuples.cs:59:17:59:32 | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item2, field Item2] : String | Tuples.cs:62:18:62:57 | SSA def(t) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item2, field Item2] : String |
 | Tuples.cs:59:17:59:32 | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item2, field Item2] : String | Tuples.cs:62:18:62:57 | SSA def(t) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item2, field Item2] : String |
 | Tuples.cs:59:17:59:32 | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item2, field Item2] : String | Tuples.cs:67:18:67:35 | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item2, field Item2] : String |
-| Tuples.cs:59:17:59:32 | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item2, field Item2] : String | Tuples.cs:67:18:67:35 | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item2, field Item2] : String |
-| Tuples.cs:59:17:59:32 | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item2, field Item2] : String | Tuples.cs:87:18:87:35 | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item2, field Item2] : String |
 | Tuples.cs:59:17:59:32 | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item2, field Item2] : String | Tuples.cs:87:18:87:35 | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item2, field Item2] : String |
 | Tuples.cs:59:18:59:19 | access to local variable o1 : String | Tuples.cs:59:17:59:32 | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item1] : String |
-| Tuples.cs:59:18:59:19 | access to local variable o1 : String | Tuples.cs:59:17:59:32 | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item1] : String |
-| Tuples.cs:59:22:59:28 | (..., ...) : ValueTuple<Int32,String> [field Item2] : String | Tuples.cs:59:17:59:32 | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item2, field Item2] : String |
 | Tuples.cs:59:22:59:28 | (..., ...) : ValueTuple<Int32,String> [field Item2] : String | Tuples.cs:59:17:59:32 | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item2, field Item2] : String |
 | Tuples.cs:59:26:59:27 | access to local variable o2 : String | Tuples.cs:59:22:59:28 | (..., ...) : ValueTuple<Int32,String> [field Item2] : String |
-| Tuples.cs:59:26:59:27 | access to local variable o2 : String | Tuples.cs:59:22:59:28 | (..., ...) : ValueTuple<Int32,String> [field Item2] : String |
-| Tuples.cs:62:18:62:57 | SSA def(t) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item1] : String | Tuples.cs:63:22:63:22 | access to local variable t : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item1] : String |
 | Tuples.cs:62:18:62:57 | SSA def(t) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item1] : String | Tuples.cs:63:22:63:22 | access to local variable t : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item1] : String |
 | Tuples.cs:62:18:62:57 | SSA def(t) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item2, field Item2] : String | Tuples.cs:64:22:64:22 | access to local variable t : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item2, field Item2] : String |
-| Tuples.cs:62:18:62:57 | SSA def(t) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item2, field Item2] : String | Tuples.cs:64:22:64:22 | access to local variable t : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item2, field Item2] : String |
-| Tuples.cs:63:22:63:22 | access to local variable t : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item1] : String | Tuples.cs:63:22:63:28 | access to field Item1 |
 | Tuples.cs:63:22:63:22 | access to local variable t : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item1] : String | Tuples.cs:63:22:63:28 | access to field Item1 |
 | Tuples.cs:64:22:64:22 | access to local variable t : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item2, field Item2] : String | Tuples.cs:64:22:64:28 | access to field Item2 : ValueTuple<Int32,String> [field Item2] : String |
-| Tuples.cs:64:22:64:22 | access to local variable t : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item2, field Item2] : String | Tuples.cs:64:22:64:28 | access to field Item2 : ValueTuple<Int32,String> [field Item2] : String |
-| Tuples.cs:64:22:64:28 | access to field Item2 : ValueTuple<Int32,String> [field Item2] : String | Tuples.cs:64:22:64:34 | access to field Item2 |
 | Tuples.cs:64:22:64:28 | access to field Item2 : ValueTuple<Int32,String> [field Item2] : String | Tuples.cs:64:22:64:34 | access to field Item2 |
 | Tuples.cs:67:18:67:35 | (..., ...) : ValueTuple<Int32,String> [field Item2] : String | Tuples.cs:67:30:67:30 | SSA def(c) : String |
-| Tuples.cs:67:18:67:35 | (..., ...) : ValueTuple<Int32,String> [field Item2] : String | Tuples.cs:67:30:67:30 | SSA def(c) : String |
-| Tuples.cs:67:18:67:35 | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item1] : String | Tuples.cs:67:23:67:23 | SSA def(a) : String |
 | Tuples.cs:67:18:67:35 | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item1] : String | Tuples.cs:67:23:67:23 | SSA def(a) : String |
 | Tuples.cs:67:18:67:35 | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item2, field Item2] : String | Tuples.cs:67:18:67:35 | (..., ...) : ValueTuple<Int32,String> [field Item2] : String |
-| Tuples.cs:67:18:67:35 | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item2, field Item2] : String | Tuples.cs:67:18:67:35 | (..., ...) : ValueTuple<Int32,String> [field Item2] : String |
-| Tuples.cs:67:23:67:23 | SSA def(a) : String | Tuples.cs:68:22:68:22 | access to local variable a |
 | Tuples.cs:67:23:67:23 | SSA def(a) : String | Tuples.cs:68:22:68:22 | access to local variable a |
 | Tuples.cs:67:30:67:30 | SSA def(c) : String | Tuples.cs:69:22:69:22 | access to local variable c |
-| Tuples.cs:67:30:67:30 | SSA def(c) : String | Tuples.cs:69:22:69:22 | access to local variable c |
-| Tuples.cs:87:18:87:35 | (..., ...) : ValueTuple<Int32,String> [field Item2] : String | Tuples.cs:87:30:87:30 | SSA def(r) : String |
 | Tuples.cs:87:18:87:35 | (..., ...) : ValueTuple<Int32,String> [field Item2] : String | Tuples.cs:87:30:87:30 | SSA def(r) : String |
 | Tuples.cs:87:18:87:35 | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item1] : String | Tuples.cs:87:23:87:23 | SSA def(p) : String |
-| Tuples.cs:87:18:87:35 | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item1] : String | Tuples.cs:87:23:87:23 | SSA def(p) : String |
-| Tuples.cs:87:18:87:35 | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item2, field Item2] : String | Tuples.cs:87:18:87:35 | (..., ...) : ValueTuple<Int32,String> [field Item2] : String |
 | Tuples.cs:87:18:87:35 | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item2, field Item2] : String | Tuples.cs:87:18:87:35 | (..., ...) : ValueTuple<Int32,String> [field Item2] : String |
 | Tuples.cs:87:23:87:23 | SSA def(p) : String | Tuples.cs:89:18:89:18 | access to local variable p |
-| Tuples.cs:87:23:87:23 | SSA def(p) : String | Tuples.cs:89:18:89:18 | access to local variable p |
-| Tuples.cs:87:30:87:30 | SSA def(r) : String | Tuples.cs:90:18:90:18 | access to local variable r |
 | Tuples.cs:87:30:87:30 | SSA def(r) : String | Tuples.cs:90:18:90:18 | access to local variable r |
 | Tuples.cs:99:17:99:33 | call to method Source<String> : String | Tuples.cs:100:24:100:24 | access to local variable o : String |
-| Tuples.cs:99:17:99:33 | call to method Source<String> : String | Tuples.cs:100:24:100:24 | access to local variable o : String |
-| Tuples.cs:100:17:100:28 | object creation of type R1 : R1 [property i] : String | Tuples.cs:101:14:101:14 | access to local variable r : R1 [property i] : String |
 | Tuples.cs:100:17:100:28 | object creation of type R1 : R1 [property i] : String | Tuples.cs:101:14:101:14 | access to local variable r : R1 [property i] : String |
 | Tuples.cs:100:24:100:24 | access to local variable o : String | Tuples.cs:100:17:100:28 | object creation of type R1 : R1 [property i] : String |
-| Tuples.cs:100:24:100:24 | access to local variable o : String | Tuples.cs:100:17:100:28 | object creation of type R1 : R1 [property i] : String |
-| Tuples.cs:101:14:101:14 | access to local variable r : R1 [property i] : String | Tuples.cs:101:14:101:16 | access to property i |
 | Tuples.cs:101:14:101:14 | access to local variable r : R1 [property i] : String | Tuples.cs:101:14:101:16 | access to property i |
 | Tuples.cs:118:17:118:33 | call to method Source<Object> : Object | Tuples.cs:121:28:121:28 | access to local variable o : Object |
-| Tuples.cs:118:17:118:33 | call to method Source<Object> : Object | Tuples.cs:121:28:121:28 | access to local variable o : Object |
-| Tuples.cs:118:17:118:33 | call to method Source<Object> : Object | Tuples.cs:122:14:122:15 | access to local variable x1 |
 | Tuples.cs:118:17:118:33 | call to method Source<Object> : Object | Tuples.cs:122:14:122:15 | access to local variable x1 |
 | Tuples.cs:118:17:118:33 | call to method Source<Object> : Object | Tuples.cs:125:25:125:25 | access to local variable o : Object |
-| Tuples.cs:118:17:118:33 | call to method Source<Object> : Object | Tuples.cs:125:25:125:25 | access to local variable o : Object |
-| Tuples.cs:118:17:118:33 | call to method Source<Object> : Object | Tuples.cs:126:14:126:15 | access to local variable x2 |
 | Tuples.cs:118:17:118:33 | call to method Source<Object> : Object | Tuples.cs:126:14:126:15 | access to local variable x2 |
 | Tuples.cs:118:17:118:33 | call to method Source<Object> : Object | Tuples.cs:129:31:129:31 | access to local variable o : Object |
-| Tuples.cs:118:17:118:33 | call to method Source<Object> : Object | Tuples.cs:129:31:129:31 | access to local variable o : Object |
-| Tuples.cs:118:17:118:33 | call to method Source<Object> : Object | Tuples.cs:130:14:130:15 | access to local variable y3 |
 | Tuples.cs:118:17:118:33 | call to method Source<Object> : Object | Tuples.cs:130:14:130:15 | access to local variable y3 |
 | Tuples.cs:118:17:118:33 | call to method Source<Object> : Object | Tuples.cs:133:28:133:28 | access to local variable o : Object |
-| Tuples.cs:118:17:118:33 | call to method Source<Object> : Object | Tuples.cs:133:28:133:28 | access to local variable o : Object |
-| Tuples.cs:118:17:118:33 | call to method Source<Object> : Object | Tuples.cs:134:14:134:15 | access to local variable y4 |
 | Tuples.cs:118:17:118:33 | call to method Source<Object> : Object | Tuples.cs:134:14:134:15 | access to local variable y4 |
 | Tuples.cs:121:9:121:23 | (..., ...) : ValueTuple<Object,Int32> [field Item1] : Object | Tuples.cs:121:9:121:32 | SSA def(x1) : Object |
-| Tuples.cs:121:9:121:23 | (..., ...) : ValueTuple<Object,Int32> [field Item1] : Object | Tuples.cs:121:9:121:32 | SSA def(x1) : Object |
-| Tuples.cs:121:9:121:32 | SSA def(x1) : Object | Tuples.cs:122:14:122:15 | access to local variable x1 |
 | Tuples.cs:121:9:121:32 | SSA def(x1) : Object | Tuples.cs:122:14:122:15 | access to local variable x1 |
 | Tuples.cs:121:27:121:32 | (..., ...) : ValueTuple<Object,Int32> [field Item1] : Object | Tuples.cs:121:9:121:23 | (..., ...) : ValueTuple<Object,Int32> [field Item1] : Object |
-| Tuples.cs:121:27:121:32 | (..., ...) : ValueTuple<Object,Int32> [field Item1] : Object | Tuples.cs:121:9:121:23 | (..., ...) : ValueTuple<Object,Int32> [field Item1] : Object |
-| Tuples.cs:121:28:121:28 | access to local variable o : Object | Tuples.cs:121:27:121:32 | (..., ...) : ValueTuple<Object,Int32> [field Item1] : Object |
 | Tuples.cs:121:28:121:28 | access to local variable o : Object | Tuples.cs:121:27:121:32 | (..., ...) : ValueTuple<Object,Int32> [field Item1] : Object |
 | Tuples.cs:125:9:125:20 | (..., ...) : ValueTuple<Object,Int32> [field Item1] : Object | Tuples.cs:125:9:125:29 | SSA def(x2) : Object |
-| Tuples.cs:125:9:125:20 | (..., ...) : ValueTuple<Object,Int32> [field Item1] : Object | Tuples.cs:125:9:125:29 | SSA def(x2) : Object |
-| Tuples.cs:125:9:125:29 | SSA def(x2) : Object | Tuples.cs:126:14:126:15 | access to local variable x2 |
 | Tuples.cs:125:9:125:29 | SSA def(x2) : Object | Tuples.cs:126:14:126:15 | access to local variable x2 |
 | Tuples.cs:125:24:125:29 | (..., ...) : ValueTuple<Object,Int32> [field Item1] : Object | Tuples.cs:125:9:125:20 | (..., ...) : ValueTuple<Object,Int32> [field Item1] : Object |
-| Tuples.cs:125:24:125:29 | (..., ...) : ValueTuple<Object,Int32> [field Item1] : Object | Tuples.cs:125:9:125:20 | (..., ...) : ValueTuple<Object,Int32> [field Item1] : Object |
-| Tuples.cs:125:25:125:25 | access to local variable o : Object | Tuples.cs:125:24:125:29 | (..., ...) : ValueTuple<Object,Int32> [field Item1] : Object |
 | Tuples.cs:125:25:125:25 | access to local variable o : Object | Tuples.cs:125:24:125:29 | (..., ...) : ValueTuple<Object,Int32> [field Item1] : Object |
 | Tuples.cs:129:9:129:23 | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object | Tuples.cs:129:9:129:32 | SSA def(y3) : Object |
-| Tuples.cs:129:9:129:23 | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object | Tuples.cs:129:9:129:32 | SSA def(y3) : Object |
-| Tuples.cs:129:9:129:32 | SSA def(y3) : Object | Tuples.cs:130:14:130:15 | access to local variable y3 |
 | Tuples.cs:129:9:129:32 | SSA def(y3) : Object | Tuples.cs:130:14:130:15 | access to local variable y3 |
 | Tuples.cs:129:27:129:32 | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object | Tuples.cs:129:9:129:23 | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object |
-| Tuples.cs:129:27:129:32 | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object | Tuples.cs:129:9:129:23 | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object |
-| Tuples.cs:129:31:129:31 | access to local variable o : Object | Tuples.cs:129:27:129:32 | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object |
 | Tuples.cs:129:31:129:31 | access to local variable o : Object | Tuples.cs:129:27:129:32 | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object |
 | Tuples.cs:133:9:133:20 | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object | Tuples.cs:133:9:133:29 | SSA def(y4) : Object |
-| Tuples.cs:133:9:133:20 | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object | Tuples.cs:133:9:133:29 | SSA def(y4) : Object |
-| Tuples.cs:133:9:133:29 | SSA def(y4) : Object | Tuples.cs:134:14:134:15 | access to local variable y4 |
 | Tuples.cs:133:9:133:29 | SSA def(y4) : Object | Tuples.cs:134:14:134:15 | access to local variable y4 |
 | Tuples.cs:133:24:133:29 | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object | Tuples.cs:133:9:133:20 | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object |
-| Tuples.cs:133:24:133:29 | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object | Tuples.cs:133:9:133:20 | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object |
-| Tuples.cs:133:28:133:28 | access to local variable o : Object | Tuples.cs:133:24:133:29 | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object |
 | Tuples.cs:133:28:133:28 | access to local variable o : Object | Tuples.cs:133:24:133:29 | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object |
 nodes
 | Tuples.cs:7:18:7:34 | call to method Source<Object> : Object | semmle.label | call to method Source<Object> : Object |
-| Tuples.cs:7:18:7:34 | call to method Source<Object> : Object | semmle.label | call to method Source<Object> : Object |
-| Tuples.cs:8:18:8:34 | call to method Source<Object> : Object | semmle.label | call to method Source<Object> : Object |
 | Tuples.cs:8:18:8:34 | call to method Source<Object> : Object | semmle.label | call to method Source<Object> : Object |
 | Tuples.cs:10:17:10:32 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object | semmle.label | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object |
-| Tuples.cs:10:17:10:32 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object | semmle.label | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object |
-| Tuples.cs:10:17:10:32 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object | semmle.label | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object |
 | Tuples.cs:10:17:10:32 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object | semmle.label | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object |
 | Tuples.cs:10:21:10:22 | access to local variable o1 : Object | semmle.label | access to local variable o1 : Object |
-| Tuples.cs:10:21:10:22 | access to local variable o1 : Object | semmle.label | access to local variable o1 : Object |
-| Tuples.cs:10:25:10:31 | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object | semmle.label | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object |
 | Tuples.cs:10:25:10:31 | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object | semmle.label | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object |
 | Tuples.cs:10:29:10:30 | access to local variable o2 : Object | semmle.label | access to local variable o2 : Object |
-| Tuples.cs:10:29:10:30 | access to local variable o2 : Object | semmle.label | access to local variable o2 : Object |
-| Tuples.cs:11:9:11:23 | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object | semmle.label | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object |
 | Tuples.cs:11:9:11:23 | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object | semmle.label | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object |
 | Tuples.cs:11:9:11:23 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object | semmle.label | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object |
-| Tuples.cs:11:9:11:23 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object | semmle.label | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object |
-| Tuples.cs:11:9:11:23 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object | semmle.label | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object |
 | Tuples.cs:11:9:11:23 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object | semmle.label | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object |
 | Tuples.cs:11:9:11:27 | SSA def(a) : Object | semmle.label | SSA def(a) : Object |
-| Tuples.cs:11:9:11:27 | SSA def(a) : Object | semmle.label | SSA def(a) : Object |
-| Tuples.cs:11:9:11:27 | SSA def(c) : Object | semmle.label | SSA def(c) : Object |
 | Tuples.cs:11:9:11:27 | SSA def(c) : Object | semmle.label | SSA def(c) : Object |
 | Tuples.cs:12:14:12:14 | access to local variable a | semmle.label | access to local variable a |
-| Tuples.cs:12:14:12:14 | access to local variable a | semmle.label | access to local variable a |
-| Tuples.cs:14:14:14:14 | access to local variable c | semmle.label | access to local variable c |
 | Tuples.cs:14:14:14:14 | access to local variable c | semmle.label | access to local variable c |
 | Tuples.cs:16:9:16:19 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object | semmle.label | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object |
-| Tuples.cs:16:9:16:19 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object | semmle.label | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object |
-| Tuples.cs:16:9:16:19 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object | semmle.label | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object |
 | Tuples.cs:16:9:16:19 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object | semmle.label | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object |
 | Tuples.cs:16:9:16:23 | SSA def(a) : Object | semmle.label | SSA def(a) : Object |
-| Tuples.cs:16:9:16:23 | SSA def(a) : Object | semmle.label | SSA def(a) : Object |
-| Tuples.cs:16:9:16:23 | SSA def(c) : Object | semmle.label | SSA def(c) : Object |
 | Tuples.cs:16:9:16:23 | SSA def(c) : Object | semmle.label | SSA def(c) : Object |
 | Tuples.cs:16:13:16:18 | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object | semmle.label | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object |
-| Tuples.cs:16:13:16:18 | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object | semmle.label | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object |
-| Tuples.cs:17:14:17:14 | access to local variable a | semmle.label | access to local variable a |
 | Tuples.cs:17:14:17:14 | access to local variable a | semmle.label | access to local variable a |
 | Tuples.cs:19:14:19:14 | access to local variable c | semmle.label | access to local variable c |
-| Tuples.cs:19:14:19:14 | access to local variable c | semmle.label | access to local variable c |
-| Tuples.cs:21:9:21:22 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object | semmle.label | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object |
 | Tuples.cs:21:9:21:22 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object | semmle.label | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object |
 | Tuples.cs:21:9:21:22 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object | semmle.label | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object |
-| Tuples.cs:21:9:21:22 | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object | semmle.label | (..., ...) : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object |
-| Tuples.cs:21:9:21:26 | SSA def(p) : Object | semmle.label | SSA def(p) : Object |
 | Tuples.cs:21:9:21:26 | SSA def(p) : Object | semmle.label | SSA def(p) : Object |
 | Tuples.cs:21:9:21:26 | SSA def(q) : ValueTuple<Int32,Object> [field Item2] : Object | semmle.label | SSA def(q) : ValueTuple<Int32,Object> [field Item2] : Object |
-| Tuples.cs:21:9:21:26 | SSA def(q) : ValueTuple<Int32,Object> [field Item2] : Object | semmle.label | SSA def(q) : ValueTuple<Int32,Object> [field Item2] : Object |
-| Tuples.cs:22:14:22:14 | access to local variable p | semmle.label | access to local variable p |
 | Tuples.cs:22:14:22:14 | access to local variable p | semmle.label | access to local variable p |
 | Tuples.cs:24:14:24:14 | access to local variable q : ValueTuple<Int32,Object> [field Item2] : Object | semmle.label | access to local variable q : ValueTuple<Int32,Object> [field Item2] : Object |
-| Tuples.cs:24:14:24:14 | access to local variable q : ValueTuple<Int32,Object> [field Item2] : Object | semmle.label | access to local variable q : ValueTuple<Int32,Object> [field Item2] : Object |
-| Tuples.cs:24:14:24:20 | access to field Item2 | semmle.label | access to field Item2 |
 | Tuples.cs:24:14:24:20 | access to field Item2 | semmle.label | access to field Item2 |
 | Tuples.cs:26:14:26:14 | access to local variable x : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object | semmle.label | access to local variable x : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object |
-| Tuples.cs:26:14:26:14 | access to local variable x : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object | semmle.label | access to local variable x : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object |
-| Tuples.cs:26:14:26:20 | access to field Item1 | semmle.label | access to field Item1 |
 | Tuples.cs:26:14:26:20 | access to field Item1 | semmle.label | access to field Item1 |
 | Tuples.cs:27:14:27:14 | access to local variable x : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object | semmle.label | access to local variable x : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object |
-| Tuples.cs:27:14:27:14 | access to local variable x : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object | semmle.label | access to local variable x : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item1] : Object |
-| Tuples.cs:27:14:27:16 | access to field Item1 | semmle.label | access to field Item1 |
 | Tuples.cs:27:14:27:16 | access to field Item1 | semmle.label | access to field Item1 |
 | Tuples.cs:29:14:29:14 | access to local variable x : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object | semmle.label | access to local variable x : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object |
-| Tuples.cs:29:14:29:14 | access to local variable x : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object | semmle.label | access to local variable x : ValueTuple<Object,ValueTuple<Int32,Object>> [field Item2, field Item2] : Object |
-| Tuples.cs:29:14:29:20 | access to field Item2 : ValueTuple<Int32,Object> [field Item2] : Object | semmle.label | access to field Item2 : ValueTuple<Int32,Object> [field Item2] : Object |
 | Tuples.cs:29:14:29:20 | access to field Item2 : ValueTuple<Int32,Object> [field Item2] : Object | semmle.label | access to field Item2 : ValueTuple<Int32,Object> [field Item2] : Object |
 | Tuples.cs:29:14:29:26 | access to field Item2 | semmle.label | access to field Item2 |
-| Tuples.cs:29:14:29:26 | access to field Item2 | semmle.label | access to field Item2 |
-| Tuples.cs:34:18:34:34 | call to method Source<Object> : Object | semmle.label | call to method Source<Object> : Object |
 | Tuples.cs:34:18:34:34 | call to method Source<Object> : Object | semmle.label | call to method Source<Object> : Object |
 | Tuples.cs:35:18:35:34 | call to method Source<Object> : Object | semmle.label | call to method Source<Object> : Object |
-| Tuples.cs:35:18:35:34 | call to method Source<Object> : Object | semmle.label | call to method Source<Object> : Object |
-| Tuples.cs:37:17:37:48 | (..., ...) : ValueTuple<Object,Int32,Int32,Int32,Int32,Int32,Int32,ValueTuple<Int32,Int32,Object>> [field Item1] : Object | semmle.label | (..., ...) : ValueTuple<Object,Int32,Int32,Int32,Int32,Int32,Int32,ValueTuple<Int32,Int32,Object>> [field Item1] : Object |
 | Tuples.cs:37:17:37:48 | (..., ...) : ValueTuple<Object,Int32,Int32,Int32,Int32,Int32,Int32,ValueTuple<Int32,Int32,Object>> [field Item1] : Object | semmle.label | (..., ...) : ValueTuple<Object,Int32,Int32,Int32,Int32,Int32,Int32,ValueTuple<Int32,Int32,Object>> [field Item1] : Object |
 | Tuples.cs:37:17:37:48 | (..., ...) : ValueTuple<Object,Int32,Int32,Int32,Int32,Int32,Int32,ValueTuple<Int32,Int32,Object>> [field Item10] : Object | semmle.label | (..., ...) : ValueTuple<Object,Int32,Int32,Int32,Int32,Int32,Int32,ValueTuple<Int32,Int32,Object>> [field Item10] : Object |
-| Tuples.cs:37:17:37:48 | (..., ...) : ValueTuple<Object,Int32,Int32,Int32,Int32,Int32,Int32,ValueTuple<Int32,Int32,Object>> [field Item10] : Object | semmle.label | (..., ...) : ValueTuple<Object,Int32,Int32,Int32,Int32,Int32,Int32,ValueTuple<Int32,Int32,Object>> [field Item10] : Object |
-| Tuples.cs:37:18:37:19 | access to local variable o1 : Object | semmle.label | access to local variable o1 : Object |
 | Tuples.cs:37:18:37:19 | access to local variable o1 : Object | semmle.label | access to local variable o1 : Object |
 | Tuples.cs:37:46:37:47 | access to local variable o2 : Object | semmle.label | access to local variable o2 : Object |
-| Tuples.cs:37:46:37:47 | access to local variable o2 : Object | semmle.label | access to local variable o2 : Object |
-| Tuples.cs:38:14:38:14 | access to local variable x : ValueTuple<Object,Int32,Int32,Int32,Int32,Int32,Int32,ValueTuple<Int32,Int32,Object>> [field Item1] : Object | semmle.label | access to local variable x : ValueTuple<Object,Int32,Int32,Int32,Int32,Int32,Int32,ValueTuple<Int32,Int32,Object>> [field Item1] : Object |
 | Tuples.cs:38:14:38:14 | access to local variable x : ValueTuple<Object,Int32,Int32,Int32,Int32,Int32,Int32,ValueTuple<Int32,Int32,Object>> [field Item1] : Object | semmle.label | access to local variable x : ValueTuple<Object,Int32,Int32,Int32,Int32,Int32,Int32,ValueTuple<Int32,Int32,Object>> [field Item1] : Object |
 | Tuples.cs:38:14:38:20 | access to field Item1 | semmle.label | access to field Item1 |
-| Tuples.cs:38:14:38:20 | access to field Item1 | semmle.label | access to field Item1 |
-| Tuples.cs:40:14:40:14 | access to local variable x : ValueTuple<Object,Int32,Int32,Int32,Int32,Int32,Int32,ValueTuple<Int32,Int32,Object>> [field Item10] : Object | semmle.label | access to local variable x : ValueTuple<Object,Int32,Int32,Int32,Int32,Int32,Int32,ValueTuple<Int32,Int32,Object>> [field Item10] : Object |
 | Tuples.cs:40:14:40:14 | access to local variable x : ValueTuple<Object,Int32,Int32,Int32,Int32,Int32,Int32,ValueTuple<Int32,Int32,Object>> [field Item10] : Object | semmle.label | access to local variable x : ValueTuple<Object,Int32,Int32,Int32,Int32,Int32,Int32,ValueTuple<Int32,Int32,Object>> [field Item10] : Object |
 | Tuples.cs:40:14:40:21 | access to field Item10 | semmle.label | access to field Item10 |
-| Tuples.cs:40:14:40:21 | access to field Item10 | semmle.label | access to field Item10 |
-| Tuples.cs:45:17:45:33 | call to method Source<String> : String | semmle.label | call to method Source<String> : String |
 | Tuples.cs:45:17:45:33 | call to method Source<String> : String | semmle.label | call to method Source<String> : String |
 | Tuples.cs:46:17:46:55 | (...) ... : ValueTuple<String,Int32,Int32> [field Item1] : String | semmle.label | (...) ... : ValueTuple<String,Int32,Int32> [field Item1] : String |
-| Tuples.cs:46:17:46:55 | (...) ... : ValueTuple<String,Int32,Int32> [field Item1] : String | semmle.label | (...) ... : ValueTuple<String,Int32,Int32> [field Item1] : String |
-| Tuples.cs:46:47:46:55 | (..., ...) : ValueTuple<String,Int32,Int32> [field Item1] : String | semmle.label | (..., ...) : ValueTuple<String,Int32,Int32> [field Item1] : String |
 | Tuples.cs:46:47:46:55 | (..., ...) : ValueTuple<String,Int32,Int32> [field Item1] : String | semmle.label | (..., ...) : ValueTuple<String,Int32,Int32> [field Item1] : String |
 | Tuples.cs:46:48:46:48 | access to local variable o : String | semmle.label | access to local variable o : String |
-| Tuples.cs:46:48:46:48 | access to local variable o : String | semmle.label | access to local variable o : String |
-| Tuples.cs:47:14:47:14 | access to local variable x : ValueTuple<String,Int32,Int32> [field Item1] : String | semmle.label | access to local variable x : ValueTuple<String,Int32,Int32> [field Item1] : String |
 | Tuples.cs:47:14:47:14 | access to local variable x : ValueTuple<String,Int32,Int32> [field Item1] : String | semmle.label | access to local variable x : ValueTuple<String,Int32,Int32> [field Item1] : String |
 | Tuples.cs:47:14:47:20 | access to field Item1 | semmle.label | access to field Item1 |
-| Tuples.cs:47:14:47:20 | access to field Item1 | semmle.label | access to field Item1 |
-| Tuples.cs:57:18:57:34 | call to method Source<String> : String | semmle.label | call to method Source<String> : String |
 | Tuples.cs:57:18:57:34 | call to method Source<String> : String | semmle.label | call to method Source<String> : String |
 | Tuples.cs:58:18:58:34 | call to method Source<String> : String | semmle.label | call to method Source<String> : String |
-| Tuples.cs:58:18:58:34 | call to method Source<String> : String | semmle.label | call to method Source<String> : String |
-| Tuples.cs:59:17:59:32 | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item1] : String | semmle.label | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item1] : String |
 | Tuples.cs:59:17:59:32 | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item1] : String | semmle.label | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item1] : String |
 | Tuples.cs:59:17:59:32 | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item2, field Item2] : String | semmle.label | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item2, field Item2] : String |
-| Tuples.cs:59:17:59:32 | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item2, field Item2] : String | semmle.label | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item2, field Item2] : String |
-| Tuples.cs:59:18:59:19 | access to local variable o1 : String | semmle.label | access to local variable o1 : String |
 | Tuples.cs:59:18:59:19 | access to local variable o1 : String | semmle.label | access to local variable o1 : String |
 | Tuples.cs:59:22:59:28 | (..., ...) : ValueTuple<Int32,String> [field Item2] : String | semmle.label | (..., ...) : ValueTuple<Int32,String> [field Item2] : String |
-| Tuples.cs:59:22:59:28 | (..., ...) : ValueTuple<Int32,String> [field Item2] : String | semmle.label | (..., ...) : ValueTuple<Int32,String> [field Item2] : String |
-| Tuples.cs:59:26:59:27 | access to local variable o2 : String | semmle.label | access to local variable o2 : String |
 | Tuples.cs:59:26:59:27 | access to local variable o2 : String | semmle.label | access to local variable o2 : String |
 | Tuples.cs:62:18:62:57 | SSA def(t) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item1] : String | semmle.label | SSA def(t) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item1] : String |
-| Tuples.cs:62:18:62:57 | SSA def(t) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item1] : String | semmle.label | SSA def(t) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item1] : String |
-| Tuples.cs:62:18:62:57 | SSA def(t) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item2, field Item2] : String | semmle.label | SSA def(t) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item2, field Item2] : String |
 | Tuples.cs:62:18:62:57 | SSA def(t) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item2, field Item2] : String | semmle.label | SSA def(t) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item2, field Item2] : String |
 | Tuples.cs:63:22:63:22 | access to local variable t : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item1] : String | semmle.label | access to local variable t : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item1] : String |
-| Tuples.cs:63:22:63:22 | access to local variable t : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item1] : String | semmle.label | access to local variable t : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item1] : String |
-| Tuples.cs:63:22:63:28 | access to field Item1 | semmle.label | access to field Item1 |
 | Tuples.cs:63:22:63:28 | access to field Item1 | semmle.label | access to field Item1 |
 | Tuples.cs:64:22:64:22 | access to local variable t : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item2, field Item2] : String | semmle.label | access to local variable t : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item2, field Item2] : String |
-| Tuples.cs:64:22:64:22 | access to local variable t : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item2, field Item2] : String | semmle.label | access to local variable t : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item2, field Item2] : String |
-| Tuples.cs:64:22:64:28 | access to field Item2 : ValueTuple<Int32,String> [field Item2] : String | semmle.label | access to field Item2 : ValueTuple<Int32,String> [field Item2] : String |
 | Tuples.cs:64:22:64:28 | access to field Item2 : ValueTuple<Int32,String> [field Item2] : String | semmle.label | access to field Item2 : ValueTuple<Int32,String> [field Item2] : String |
 | Tuples.cs:64:22:64:34 | access to field Item2 | semmle.label | access to field Item2 |
-| Tuples.cs:64:22:64:34 | access to field Item2 | semmle.label | access to field Item2 |
-| Tuples.cs:67:18:67:35 | (..., ...) : ValueTuple<Int32,String> [field Item2] : String | semmle.label | (..., ...) : ValueTuple<Int32,String> [field Item2] : String |
 | Tuples.cs:67:18:67:35 | (..., ...) : ValueTuple<Int32,String> [field Item2] : String | semmle.label | (..., ...) : ValueTuple<Int32,String> [field Item2] : String |
 | Tuples.cs:67:18:67:35 | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item1] : String | semmle.label | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item1] : String |
-| Tuples.cs:67:18:67:35 | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item1] : String | semmle.label | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item1] : String |
-| Tuples.cs:67:18:67:35 | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item2, field Item2] : String | semmle.label | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item2, field Item2] : String |
 | Tuples.cs:67:18:67:35 | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item2, field Item2] : String | semmle.label | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item2, field Item2] : String |
 | Tuples.cs:67:23:67:23 | SSA def(a) : String | semmle.label | SSA def(a) : String |
-| Tuples.cs:67:23:67:23 | SSA def(a) : String | semmle.label | SSA def(a) : String |
-| Tuples.cs:67:30:67:30 | SSA def(c) : String | semmle.label | SSA def(c) : String |
 | Tuples.cs:67:30:67:30 | SSA def(c) : String | semmle.label | SSA def(c) : String |
 | Tuples.cs:68:22:68:22 | access to local variable a | semmle.label | access to local variable a |
-| Tuples.cs:68:22:68:22 | access to local variable a | semmle.label | access to local variable a |
-| Tuples.cs:69:22:69:22 | access to local variable c | semmle.label | access to local variable c |
 | Tuples.cs:69:22:69:22 | access to local variable c | semmle.label | access to local variable c |
 | Tuples.cs:87:18:87:35 | (..., ...) : ValueTuple<Int32,String> [field Item2] : String | semmle.label | (..., ...) : ValueTuple<Int32,String> [field Item2] : String |
-| Tuples.cs:87:18:87:35 | (..., ...) : ValueTuple<Int32,String> [field Item2] : String | semmle.label | (..., ...) : ValueTuple<Int32,String> [field Item2] : String |
-| Tuples.cs:87:18:87:35 | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item1] : String | semmle.label | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item1] : String |
 | Tuples.cs:87:18:87:35 | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item1] : String | semmle.label | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item1] : String |
 | Tuples.cs:87:18:87:35 | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item2, field Item2] : String | semmle.label | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item2, field Item2] : String |
-| Tuples.cs:87:18:87:35 | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item2, field Item2] : String | semmle.label | (..., ...) : ValueTuple<String,ValueTuple<Int32,String>,Int32> [field Item2, field Item2] : String |
-| Tuples.cs:87:23:87:23 | SSA def(p) : String | semmle.label | SSA def(p) : String |
 | Tuples.cs:87:23:87:23 | SSA def(p) : String | semmle.label | SSA def(p) : String |
 | Tuples.cs:87:30:87:30 | SSA def(r) : String | semmle.label | SSA def(r) : String |
-| Tuples.cs:87:30:87:30 | SSA def(r) : String | semmle.label | SSA def(r) : String |
-| Tuples.cs:89:18:89:18 | access to local variable p | semmle.label | access to local variable p |
 | Tuples.cs:89:18:89:18 | access to local variable p | semmle.label | access to local variable p |
 | Tuples.cs:90:18:90:18 | access to local variable r | semmle.label | access to local variable r |
-| Tuples.cs:90:18:90:18 | access to local variable r | semmle.label | access to local variable r |
-| Tuples.cs:99:17:99:33 | call to method Source<String> : String | semmle.label | call to method Source<String> : String |
 | Tuples.cs:99:17:99:33 | call to method Source<String> : String | semmle.label | call to method Source<String> : String |
 | Tuples.cs:100:17:100:28 | object creation of type R1 : R1 [property i] : String | semmle.label | object creation of type R1 : R1 [property i] : String |
-| Tuples.cs:100:17:100:28 | object creation of type R1 : R1 [property i] : String | semmle.label | object creation of type R1 : R1 [property i] : String |
-| Tuples.cs:100:24:100:24 | access to local variable o : String | semmle.label | access to local variable o : String |
 | Tuples.cs:100:24:100:24 | access to local variable o : String | semmle.label | access to local variable o : String |
 | Tuples.cs:101:14:101:14 | access to local variable r : R1 [property i] : String | semmle.label | access to local variable r : R1 [property i] : String |
-| Tuples.cs:101:14:101:14 | access to local variable r : R1 [property i] : String | semmle.label | access to local variable r : R1 [property i] : String |
-| Tuples.cs:101:14:101:16 | access to property i | semmle.label | access to property i |
 | Tuples.cs:101:14:101:16 | access to property i | semmle.label | access to property i |
 | Tuples.cs:118:17:118:33 | call to method Source<Object> : Object | semmle.label | call to method Source<Object> : Object |
-| Tuples.cs:118:17:118:33 | call to method Source<Object> : Object | semmle.label | call to method Source<Object> : Object |
-| Tuples.cs:121:9:121:23 | (..., ...) : ValueTuple<Object,Int32> [field Item1] : Object | semmle.label | (..., ...) : ValueTuple<Object,Int32> [field Item1] : Object |
 | Tuples.cs:121:9:121:23 | (..., ...) : ValueTuple<Object,Int32> [field Item1] : Object | semmle.label | (..., ...) : ValueTuple<Object,Int32> [field Item1] : Object |
 | Tuples.cs:121:9:121:32 | SSA def(x1) : Object | semmle.label | SSA def(x1) : Object |
-| Tuples.cs:121:9:121:32 | SSA def(x1) : Object | semmle.label | SSA def(x1) : Object |
-| Tuples.cs:121:27:121:32 | (..., ...) : ValueTuple<Object,Int32> [field Item1] : Object | semmle.label | (..., ...) : ValueTuple<Object,Int32> [field Item1] : Object |
 | Tuples.cs:121:27:121:32 | (..., ...) : ValueTuple<Object,Int32> [field Item1] : Object | semmle.label | (..., ...) : ValueTuple<Object,Int32> [field Item1] : Object |
 | Tuples.cs:121:28:121:28 | access to local variable o : Object | semmle.label | access to local variable o : Object |
-| Tuples.cs:121:28:121:28 | access to local variable o : Object | semmle.label | access to local variable o : Object |
-| Tuples.cs:122:14:122:15 | access to local variable x1 | semmle.label | access to local variable x1 |
 | Tuples.cs:122:14:122:15 | access to local variable x1 | semmle.label | access to local variable x1 |
 | Tuples.cs:125:9:125:20 | (..., ...) : ValueTuple<Object,Int32> [field Item1] : Object | semmle.label | (..., ...) : ValueTuple<Object,Int32> [field Item1] : Object |
-| Tuples.cs:125:9:125:20 | (..., ...) : ValueTuple<Object,Int32> [field Item1] : Object | semmle.label | (..., ...) : ValueTuple<Object,Int32> [field Item1] : Object |
-| Tuples.cs:125:9:125:29 | SSA def(x2) : Object | semmle.label | SSA def(x2) : Object |
 | Tuples.cs:125:9:125:29 | SSA def(x2) : Object | semmle.label | SSA def(x2) : Object |
 | Tuples.cs:125:24:125:29 | (..., ...) : ValueTuple<Object,Int32> [field Item1] : Object | semmle.label | (..., ...) : ValueTuple<Object,Int32> [field Item1] : Object |
-| Tuples.cs:125:24:125:29 | (..., ...) : ValueTuple<Object,Int32> [field Item1] : Object | semmle.label | (..., ...) : ValueTuple<Object,Int32> [field Item1] : Object |
-| Tuples.cs:125:25:125:25 | access to local variable o : Object | semmle.label | access to local variable o : Object |
 | Tuples.cs:125:25:125:25 | access to local variable o : Object | semmle.label | access to local variable o : Object |
 | Tuples.cs:126:14:126:15 | access to local variable x2 | semmle.label | access to local variable x2 |
-| Tuples.cs:126:14:126:15 | access to local variable x2 | semmle.label | access to local variable x2 |
-| Tuples.cs:129:9:129:23 | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object | semmle.label | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object |
 | Tuples.cs:129:9:129:23 | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object | semmle.label | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object |
 | Tuples.cs:129:9:129:32 | SSA def(y3) : Object | semmle.label | SSA def(y3) : Object |
-| Tuples.cs:129:9:129:32 | SSA def(y3) : Object | semmle.label | SSA def(y3) : Object |
-| Tuples.cs:129:27:129:32 | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object | semmle.label | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object |
 | Tuples.cs:129:27:129:32 | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object | semmle.label | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object |
 | Tuples.cs:129:31:129:31 | access to local variable o : Object | semmle.label | access to local variable o : Object |
-| Tuples.cs:129:31:129:31 | access to local variable o : Object | semmle.label | access to local variable o : Object |
-| Tuples.cs:130:14:130:15 | access to local variable y3 | semmle.label | access to local variable y3 |
 | Tuples.cs:130:14:130:15 | access to local variable y3 | semmle.label | access to local variable y3 |
 | Tuples.cs:133:9:133:20 | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object | semmle.label | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object |
-| Tuples.cs:133:9:133:20 | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object | semmle.label | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object |
-| Tuples.cs:133:9:133:29 | SSA def(y4) : Object | semmle.label | SSA def(y4) : Object |
 | Tuples.cs:133:9:133:29 | SSA def(y4) : Object | semmle.label | SSA def(y4) : Object |
 | Tuples.cs:133:24:133:29 | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object | semmle.label | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object |
-| Tuples.cs:133:24:133:29 | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object | semmle.label | (..., ...) : ValueTuple<Int32,Object> [field Item2] : Object |
 | Tuples.cs:133:28:133:28 | access to local variable o : Object | semmle.label | access to local variable o : Object |
-| Tuples.cs:133:28:133:28 | access to local variable o : Object | semmle.label | access to local variable o : Object |
-| Tuples.cs:134:14:134:15 | access to local variable y4 | semmle.label | access to local variable y4 |
 | Tuples.cs:134:14:134:15 | access to local variable y4 | semmle.label | access to local variable y4 |
 subpaths
 #select
 | Tuples.cs:12:14:12:14 | access to local variable a | Tuples.cs:7:18:7:34 | call to method Source<Object> : Object | Tuples.cs:12:14:12:14 | access to local variable a | $@ | Tuples.cs:7:18:7:34 | call to method Source<Object> : Object | call to method Source<Object> : Object |
-| Tuples.cs:12:14:12:14 | access to local variable a | Tuples.cs:7:18:7:34 | call to method Source<Object> : Object | Tuples.cs:12:14:12:14 | access to local variable a | $@ | Tuples.cs:7:18:7:34 | call to method Source<Object> : Object | call to method Source<Object> : Object |
-| Tuples.cs:14:14:14:14 | access to local variable c | Tuples.cs:8:18:8:34 | call to method Source<Object> : Object | Tuples.cs:14:14:14:14 | access to local variable c | $@ | Tuples.cs:8:18:8:34 | call to method Source<Object> : Object | call to method Source<Object> : Object |
 | Tuples.cs:14:14:14:14 | access to local variable c | Tuples.cs:8:18:8:34 | call to method Source<Object> : Object | Tuples.cs:14:14:14:14 | access to local variable c | $@ | Tuples.cs:8:18:8:34 | call to method Source<Object> : Object | call to method Source<Object> : Object |
 | Tuples.cs:17:14:17:14 | access to local variable a | Tuples.cs:7:18:7:34 | call to method Source<Object> : Object | Tuples.cs:17:14:17:14 | access to local variable a | $@ | Tuples.cs:7:18:7:34 | call to method Source<Object> : Object | call to method Source<Object> : Object |
-| Tuples.cs:17:14:17:14 | access to local variable a | Tuples.cs:7:18:7:34 | call to method Source<Object> : Object | Tuples.cs:17:14:17:14 | access to local variable a | $@ | Tuples.cs:7:18:7:34 | call to method Source<Object> : Object | call to method Source<Object> : Object |
-| Tuples.cs:19:14:19:14 | access to local variable c | Tuples.cs:8:18:8:34 | call to method Source<Object> : Object | Tuples.cs:19:14:19:14 | access to local variable c | $@ | Tuples.cs:8:18:8:34 | call to method Source<Object> : Object | call to method Source<Object> : Object |
 | Tuples.cs:19:14:19:14 | access to local variable c | Tuples.cs:8:18:8:34 | call to method Source<Object> : Object | Tuples.cs:19:14:19:14 | access to local variable c | $@ | Tuples.cs:8:18:8:34 | call to method Source<Object> : Object | call to method Source<Object> : Object |
 | Tuples.cs:22:14:22:14 | access to local variable p | Tuples.cs:7:18:7:34 | call to method Source<Object> : Object | Tuples.cs:22:14:22:14 | access to local variable p | $@ | Tuples.cs:7:18:7:34 | call to method Source<Object> : Object | call to method Source<Object> : Object |
-| Tuples.cs:22:14:22:14 | access to local variable p | Tuples.cs:7:18:7:34 | call to method Source<Object> : Object | Tuples.cs:22:14:22:14 | access to local variable p | $@ | Tuples.cs:7:18:7:34 | call to method Source<Object> : Object | call to method Source<Object> : Object |
-| Tuples.cs:24:14:24:20 | access to field Item2 | Tuples.cs:8:18:8:34 | call to method Source<Object> : Object | Tuples.cs:24:14:24:20 | access to field Item2 | $@ | Tuples.cs:8:18:8:34 | call to method Source<Object> : Object | call to method Source<Object> : Object |
 | Tuples.cs:24:14:24:20 | access to field Item2 | Tuples.cs:8:18:8:34 | call to method Source<Object> : Object | Tuples.cs:24:14:24:20 | access to field Item2 | $@ | Tuples.cs:8:18:8:34 | call to method Source<Object> : Object | call to method Source<Object> : Object |
 | Tuples.cs:26:14:26:20 | access to field Item1 | Tuples.cs:7:18:7:34 | call to method Source<Object> : Object | Tuples.cs:26:14:26:20 | access to field Item1 | $@ | Tuples.cs:7:18:7:34 | call to method Source<Object> : Object | call to method Source<Object> : Object |
-| Tuples.cs:26:14:26:20 | access to field Item1 | Tuples.cs:7:18:7:34 | call to method Source<Object> : Object | Tuples.cs:26:14:26:20 | access to field Item1 | $@ | Tuples.cs:7:18:7:34 | call to method Source<Object> : Object | call to method Source<Object> : Object |
-| Tuples.cs:27:14:27:16 | access to field Item1 | Tuples.cs:7:18:7:34 | call to method Source<Object> : Object | Tuples.cs:27:14:27:16 | access to field Item1 | $@ | Tuples.cs:7:18:7:34 | call to method Source<Object> : Object | call to method Source<Object> : Object |
 | Tuples.cs:27:14:27:16 | access to field Item1 | Tuples.cs:7:18:7:34 | call to method Source<Object> : Object | Tuples.cs:27:14:27:16 | access to field Item1 | $@ | Tuples.cs:7:18:7:34 | call to method Source<Object> : Object | call to method Source<Object> : Object |
 | Tuples.cs:29:14:29:26 | access to field Item2 | Tuples.cs:8:18:8:34 | call to method Source<Object> : Object | Tuples.cs:29:14:29:26 | access to field Item2 | $@ | Tuples.cs:8:18:8:34 | call to method Source<Object> : Object | call to method Source<Object> : Object |
-| Tuples.cs:29:14:29:26 | access to field Item2 | Tuples.cs:8:18:8:34 | call to method Source<Object> : Object | Tuples.cs:29:14:29:26 | access to field Item2 | $@ | Tuples.cs:8:18:8:34 | call to method Source<Object> : Object | call to method Source<Object> : Object |
-| Tuples.cs:38:14:38:20 | access to field Item1 | Tuples.cs:34:18:34:34 | call to method Source<Object> : Object | Tuples.cs:38:14:38:20 | access to field Item1 | $@ | Tuples.cs:34:18:34:34 | call to method Source<Object> : Object | call to method Source<Object> : Object |
 | Tuples.cs:38:14:38:20 | access to field Item1 | Tuples.cs:34:18:34:34 | call to method Source<Object> : Object | Tuples.cs:38:14:38:20 | access to field Item1 | $@ | Tuples.cs:34:18:34:34 | call to method Source<Object> : Object | call to method Source<Object> : Object |
 | Tuples.cs:40:14:40:21 | access to field Item10 | Tuples.cs:35:18:35:34 | call to method Source<Object> : Object | Tuples.cs:40:14:40:21 | access to field Item10 | $@ | Tuples.cs:35:18:35:34 | call to method Source<Object> : Object | call to method Source<Object> : Object |
-| Tuples.cs:40:14:40:21 | access to field Item10 | Tuples.cs:35:18:35:34 | call to method Source<Object> : Object | Tuples.cs:40:14:40:21 | access to field Item10 | $@ | Tuples.cs:35:18:35:34 | call to method Source<Object> : Object | call to method Source<Object> : Object |
-| Tuples.cs:47:14:47:20 | access to field Item1 | Tuples.cs:45:17:45:33 | call to method Source<String> : String | Tuples.cs:47:14:47:20 | access to field Item1 | $@ | Tuples.cs:45:17:45:33 | call to method Source<String> : String | call to method Source<String> : String |
 | Tuples.cs:47:14:47:20 | access to field Item1 | Tuples.cs:45:17:45:33 | call to method Source<String> : String | Tuples.cs:47:14:47:20 | access to field Item1 | $@ | Tuples.cs:45:17:45:33 | call to method Source<String> : String | call to method Source<String> : String |
 | Tuples.cs:63:22:63:28 | access to field Item1 | Tuples.cs:57:18:57:34 | call to method Source<String> : String | Tuples.cs:63:22:63:28 | access to field Item1 | $@ | Tuples.cs:57:18:57:34 | call to method Source<String> : String | call to method Source<String> : String |
-| Tuples.cs:63:22:63:28 | access to field Item1 | Tuples.cs:57:18:57:34 | call to method Source<String> : String | Tuples.cs:63:22:63:28 | access to field Item1 | $@ | Tuples.cs:57:18:57:34 | call to method Source<String> : String | call to method Source<String> : String |
-| Tuples.cs:64:22:64:34 | access to field Item2 | Tuples.cs:58:18:58:34 | call to method Source<String> : String | Tuples.cs:64:22:64:34 | access to field Item2 | $@ | Tuples.cs:58:18:58:34 | call to method Source<String> : String | call to method Source<String> : String |
 | Tuples.cs:64:22:64:34 | access to field Item2 | Tuples.cs:58:18:58:34 | call to method Source<String> : String | Tuples.cs:64:22:64:34 | access to field Item2 | $@ | Tuples.cs:58:18:58:34 | call to method Source<String> : String | call to method Source<String> : String |
 | Tuples.cs:68:22:68:22 | access to local variable a | Tuples.cs:57:18:57:34 | call to method Source<String> : String | Tuples.cs:68:22:68:22 | access to local variable a | $@ | Tuples.cs:57:18:57:34 | call to method Source<String> : String | call to method Source<String> : String |
-| Tuples.cs:68:22:68:22 | access to local variable a | Tuples.cs:57:18:57:34 | call to method Source<String> : String | Tuples.cs:68:22:68:22 | access to local variable a | $@ | Tuples.cs:57:18:57:34 | call to method Source<String> : String | call to method Source<String> : String |
-| Tuples.cs:69:22:69:22 | access to local variable c | Tuples.cs:58:18:58:34 | call to method Source<String> : String | Tuples.cs:69:22:69:22 | access to local variable c | $@ | Tuples.cs:58:18:58:34 | call to method Source<String> : String | call to method Source<String> : String |
 | Tuples.cs:69:22:69:22 | access to local variable c | Tuples.cs:58:18:58:34 | call to method Source<String> : String | Tuples.cs:69:22:69:22 | access to local variable c | $@ | Tuples.cs:58:18:58:34 | call to method Source<String> : String | call to method Source<String> : String |
 | Tuples.cs:89:18:89:18 | access to local variable p | Tuples.cs:57:18:57:34 | call to method Source<String> : String | Tuples.cs:89:18:89:18 | access to local variable p | $@ | Tuples.cs:57:18:57:34 | call to method Source<String> : String | call to method Source<String> : String |
-| Tuples.cs:89:18:89:18 | access to local variable p | Tuples.cs:57:18:57:34 | call to method Source<String> : String | Tuples.cs:89:18:89:18 | access to local variable p | $@ | Tuples.cs:57:18:57:34 | call to method Source<String> : String | call to method Source<String> : String |
-| Tuples.cs:90:18:90:18 | access to local variable r | Tuples.cs:58:18:58:34 | call to method Source<String> : String | Tuples.cs:90:18:90:18 | access to local variable r | $@ | Tuples.cs:58:18:58:34 | call to method Source<String> : String | call to method Source<String> : String |
 | Tuples.cs:90:18:90:18 | access to local variable r | Tuples.cs:58:18:58:34 | call to method Source<String> : String | Tuples.cs:90:18:90:18 | access to local variable r | $@ | Tuples.cs:58:18:58:34 | call to method Source<String> : String | call to method Source<String> : String |
 | Tuples.cs:101:14:101:16 | access to property i | Tuples.cs:99:17:99:33 | call to method Source<String> : String | Tuples.cs:101:14:101:16 | access to property i | $@ | Tuples.cs:99:17:99:33 | call to method Source<String> : String | call to method Source<String> : String |
-| Tuples.cs:101:14:101:16 | access to property i | Tuples.cs:99:17:99:33 | call to method Source<String> : String | Tuples.cs:101:14:101:16 | access to property i | $@ | Tuples.cs:99:17:99:33 | call to method Source<String> : String | call to method Source<String> : String |
-| Tuples.cs:122:14:122:15 | access to local variable x1 | Tuples.cs:118:17:118:33 | call to method Source<Object> : Object | Tuples.cs:122:14:122:15 | access to local variable x1 | $@ | Tuples.cs:118:17:118:33 | call to method Source<Object> : Object | call to method Source<Object> : Object |
 | Tuples.cs:122:14:122:15 | access to local variable x1 | Tuples.cs:118:17:118:33 | call to method Source<Object> : Object | Tuples.cs:122:14:122:15 | access to local variable x1 | $@ | Tuples.cs:118:17:118:33 | call to method Source<Object> : Object | call to method Source<Object> : Object |
 | Tuples.cs:126:14:126:15 | access to local variable x2 | Tuples.cs:118:17:118:33 | call to method Source<Object> : Object | Tuples.cs:126:14:126:15 | access to local variable x2 | $@ | Tuples.cs:118:17:118:33 | call to method Source<Object> : Object | call to method Source<Object> : Object |
-| Tuples.cs:126:14:126:15 | access to local variable x2 | Tuples.cs:118:17:118:33 | call to method Source<Object> : Object | Tuples.cs:126:14:126:15 | access to local variable x2 | $@ | Tuples.cs:118:17:118:33 | call to method Source<Object> : Object | call to method Source<Object> : Object |
-| Tuples.cs:130:14:130:15 | access to local variable y3 | Tuples.cs:118:17:118:33 | call to method Source<Object> : Object | Tuples.cs:130:14:130:15 | access to local variable y3 | $@ | Tuples.cs:118:17:118:33 | call to method Source<Object> : Object | call to method Source<Object> : Object |
 | Tuples.cs:130:14:130:15 | access to local variable y3 | Tuples.cs:118:17:118:33 | call to method Source<Object> : Object | Tuples.cs:130:14:130:15 | access to local variable y3 | $@ | Tuples.cs:118:17:118:33 | call to method Source<Object> : Object | call to method Source<Object> : Object |
 | Tuples.cs:134:14:134:15 | access to local variable y4 | Tuples.cs:118:17:118:33 | call to method Source<Object> : Object | Tuples.cs:134:14:134:15 | access to local variable y4 | $@ | Tuples.cs:118:17:118:33 | call to method Source<Object> : Object | call to method Source<Object> : Object |
-| Tuples.cs:134:14:134:15 | access to local variable y4 | Tuples.cs:118:17:118:33 | call to method Source<Object> : Object | Tuples.cs:134:14:134:15 | access to local variable y4 | $@ | Tuples.cs:118:17:118:33 | call to method Source<Object> : Object | call to method Source<Object> : Object |

csharp/ql/test/library-tests/dataflow/tuples/Tuples.ql

@@ -3,10 +3,9 @@
  */
 
 import csharp
+import DefaultValueFlow::PathGraph
 import TestUtilities.InlineFlowTest
-import DefaultFlowTest
-import PathGraph
 
-from PathNode source, PathNode sink
-where flowPath(source, sink)
+from DefaultValueFlow::PathNode source, DefaultValueFlow::PathNode sink
+where DefaultValueFlow::flowPath(source, sink)
 select sink, source, sink, "$@", source, source.toString()

csharp/ql/test/library-tests/frameworks/EntityFramework/EntityFramework.cs

@@ -5,7 +5,7 @@ using System.Linq;
 
 namespace EFTests
 {
-    public class Person
+    class Person
     {
         public virtual int Id { get; set; }
         public virtual string Name { get; set; }
@@ -17,13 +17,13 @@ namespace EFTests
         public ICollection<Address> Addresses { get; set; }
     }
 
-    public class Address
+    class Address
     {
         public int Id { get; set; }
         public string Street { get; set; }
     }
 
-    public class PersonAddressMap
+    class PersonAddressMap
     {
         public int Id { get; set; }
         public int PersonId { get; set; }
@@ -34,7 +34,7 @@ namespace EFTests
         public Address Address { get; set; }
     }
 
-    public class MyContext : DbContext
+    class MyContext : DbContext
     {
         public virtual DbSet<Person> Persons { get; set; }
         public virtual DbSet<Address> Addresses { get; set; }

csharp/ql/test/library-tests/frameworks/EntityFramework/EntityFrameworkCore.cs

@@ -6,7 +6,7 @@ using System.Linq;
 
 namespace EFCoreTests
 {
-    public class Person
+    class Person
     {
         public virtual int Id { get; set; }
         public virtual string Name { get; set; }
@@ -18,13 +18,13 @@ namespace EFCoreTests
         public ICollection<Address> Addresses { get; set; }
     }
 
-    public class Address
+    class Address
     {
         public int Id { get; set; }
         public string Street { get; set; }
     }
 
-    public class PersonAddressMap
+    class PersonAddressMap
     {
         public int Id { get; set; }
         public int PersonId { get; set; }
@@ -35,7 +35,7 @@ namespace EFCoreTests
         public Address Address { get; set; }
     }
 
-    public class MyContext : DbContext
+    class MyContext : DbContext
     {
         public virtual DbSet<Person> Persons { get; set; }
         public virtual DbSet<Address> Addresses { get; set; }