use ATM model from training run classification-test2

New atm features rebased

cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImplCommon.qll

@@ -709,7 +709,8 @@ private module Cached {
      */
     pragma[nomagic]
     private DataFlowCallable viableImplInCallContextExt(DataFlowCall call, DataFlowCall ctx) {
-      result = viableImplInCallContext(call, ctx)
+      result = viableImplInCallContext(call, ctx) and
+      result = viableCallable(call)
       or
       result = viableCallableLambda(call, TDataFlowCallSome(ctx))
       or

cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImplConsistency.qll

@@ -38,6 +38,13 @@ module Consistency {
 
     /** Holds if `n` should be excluded from the consistency test `uniquePostUpdate`. */
     predicate uniquePostUpdateExclude(Node n) { none() }
+
+    /** Holds if `(call, ctx)` should be excluded from the consistency test `viableImplInCallContextTooLargeExclude`. */
+    predicate viableImplInCallContextTooLargeExclude(
+      DataFlowCall call, DataFlowCall ctx, DataFlowCallable callable
+    ) {
+      none()
+    }
   }
 
   private class RelevantNode extends Node {
@@ -217,4 +224,12 @@ module Consistency {
     not any(ConsistencyConfiguration c).postWithInFlowExclude(n) and
     msg = "PostUpdateNode should not be the target of local flow."
   }
+
+  query predicate viableImplInCallContextTooLarge(
+    DataFlowCall call, DataFlowCall ctx, DataFlowCallable callable
+  ) {
+    callable = viableImplInCallContext(call, ctx) and
+    not callable = viableCallable(call) and
+    not any(ConsistencyConfiguration c).viableImplInCallContextTooLargeExclude(call, ctx, callable)
+  }
 }

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplCommon.qll

@@ -709,7 +709,8 @@ private module Cached {
      */
     pragma[nomagic]
     private DataFlowCallable viableImplInCallContextExt(DataFlowCall call, DataFlowCall ctx) {
-      result = viableImplInCallContext(call, ctx)
+      result = viableImplInCallContext(call, ctx) and
+      result = viableCallable(call)
       or
       result = viableCallableLambda(call, TDataFlowCallSome(ctx))
       or

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplConsistency.qll

@@ -38,6 +38,13 @@ module Consistency {
 
     /** Holds if `n` should be excluded from the consistency test `uniquePostUpdate`. */
     predicate uniquePostUpdateExclude(Node n) { none() }
+
+    /** Holds if `(call, ctx)` should be excluded from the consistency test `viableImplInCallContextTooLargeExclude`. */
+    predicate viableImplInCallContextTooLargeExclude(
+      DataFlowCall call, DataFlowCall ctx, DataFlowCallable callable
+    ) {
+      none()
+    }
   }
 
   private class RelevantNode extends Node {
@@ -217,4 +224,12 @@ module Consistency {
     not any(ConsistencyConfiguration c).postWithInFlowExclude(n) and
     msg = "PostUpdateNode should not be the target of local flow."
   }
+
+  query predicate viableImplInCallContextTooLarge(
+    DataFlowCall call, DataFlowCall ctx, DataFlowCallable callable
+  ) {
+    callable = viableImplInCallContext(call, ctx) and
+    not callable = viableCallable(call) and
+    not any(ConsistencyConfiguration c).viableImplInCallContextTooLargeExclude(call, ctx, callable)
+  }
 }

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplCommon.qll

@@ -709,7 +709,8 @@ private module Cached {
      */
     pragma[nomagic]
     private DataFlowCallable viableImplInCallContextExt(DataFlowCall call, DataFlowCall ctx) {
-      result = viableImplInCallContext(call, ctx)
+      result = viableImplInCallContext(call, ctx) and
+      result = viableCallable(call)
       or
       result = viableCallableLambda(call, TDataFlowCallSome(ctx))
       or

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplConsistency.qll

@@ -38,6 +38,13 @@ module Consistency {
 
     /** Holds if `n` should be excluded from the consistency test `uniquePostUpdate`. */
     predicate uniquePostUpdateExclude(Node n) { none() }
+
+    /** Holds if `(call, ctx)` should be excluded from the consistency test `viableImplInCallContextTooLargeExclude`. */
+    predicate viableImplInCallContextTooLargeExclude(
+      DataFlowCall call, DataFlowCall ctx, DataFlowCallable callable
+    ) {
+      none()
+    }
   }
 
   private class RelevantNode extends Node {
@@ -217,4 +224,12 @@ module Consistency {
     not any(ConsistencyConfiguration c).postWithInFlowExclude(n) and
     msg = "PostUpdateNode should not be the target of local flow."
   }
+
+  query predicate viableImplInCallContextTooLarge(
+    DataFlowCall call, DataFlowCall ctx, DataFlowCallable callable
+  ) {
+    callable = viableImplInCallContext(call, ctx) and
+    not callable = viableCallable(call) and
+    not any(ConsistencyConfiguration c).viableImplInCallContextTooLargeExclude(call, ctx, callable)
+  }
 }

cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-consistency.expected

@@ -87,3 +87,4 @@ postWithInFlow
 | test.cpp:465:3:465:4 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
 | test.cpp:465:4:465:4 | p [inner post update] | PostUpdateNode should not be the target of local flow. |
 | test.cpp:470:22:470:22 | x [inner post update] | PostUpdateNode should not be the target of local flow. |
+viableImplInCallContextTooLarge

cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-ir-consistency.expected

@@ -627,3 +627,4 @@ postWithInFlow
 | true_upon_entry.cpp:98:7:98:7 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
 | true_upon_entry.cpp:101:18:101:18 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
 | true_upon_entry.cpp:102:5:102:5 | x [post update] | PostUpdateNode should not be the target of local flow. |
+viableImplInCallContextTooLarge

cpp/ql/test/library-tests/dataflow/fields/dataflow-consistency.expected

@@ -155,3 +155,4 @@ postWithInFlow
 | simple.cpp:92:7:92:7 | i [post update] | PostUpdateNode should not be the target of local flow. |
 | struct_init.c:24:11:24:12 | ab [inner post update] | PostUpdateNode should not be the target of local flow. |
 | struct_init.c:36:17:36:24 | nestedAB [inner post update] | PostUpdateNode should not be the target of local flow. |
+viableImplInCallContextTooLarge

cpp/ql/test/library-tests/dataflow/fields/dataflow-ir-consistency.expected

@@ -1323,3 +1323,4 @@ postWithInFlow
 | struct_init.c:46:16:46:24 | FieldAddress [post update] | PostUpdateNode should not be the target of local flow. |
 | struct_init.c:46:16:46:24 | pointerAB [post update] | PostUpdateNode should not be the target of local flow. |
 | struct_init.c:46:16:46:24 | pointerAB [post update] | PostUpdateNode should not be the target of local flow. |
+viableImplInCallContextTooLarge

cpp/ql/test/library-tests/syntax-zoo/dataflow-consistency.expected

@@ -124,3 +124,4 @@ postWithInFlow
 | static_init_templates.cpp:3:2:3:4 | ref [post update] | PostUpdateNode should not be the target of local flow. |
 | static_init_templates.cpp:21:2:21:4 | val [post update] | PostUpdateNode should not be the target of local flow. |
 | try_catch.cpp:7:8:7:8 | call to exception | PostUpdateNode should not be the target of local flow. |
+viableImplInCallContextTooLarge

cpp/ql/test/library-tests/syntax-zoo/dataflow-ir-consistency.expected

@@ -2710,3 +2710,4 @@ postWithInFlow
 | whilestmt.c:11:5:11:8 | done [post update] | PostUpdateNode should not be the target of local flow. |
 | whilestmt.c:40:7:40:7 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
 | whilestmt.c:42:7:42:7 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
+viableImplInCallContextTooLarge

csharp/ql/integration-tests/all-platforms/dotnet_run/Program.cs

@@ -1 +1 @@
-Console.WriteLine(args.Length > 0 ? args[0] + ", " + args[1] : "");
+Console.WriteLine(args.Length > 1 ? args[0] + ", " + args[1] : "Default reply");

csharp/ql/integration-tests/all-platforms/dotnet_run/dotnet_run.csproj

@@ -7,4 +7,8 @@
     <Nullable>enable</Nullable>
   </PropertyGroup>
 
+ <Target Name="DeleteBinObjFolders" BeforeTargets="Clean">
+   <RemoveDir Directories=".\bin" />
+   <RemoveDir Directories=".\obj" />
+ </Target>
 </Project>

csharp/ql/integration-tests/all-platforms/dotnet_run/test.py

@@ -1,17 +1,43 @@
+import os
 from create_database_utils import *
 
+def run_codeql_database_create_stdout(args, dbname):
+    stdout = open(dbname + "file.txt", 'w+')
+    run_codeql_database_create(args, test_db=dbname, db=None, stdout=stdout, lang="csharp")
+    stdout.seek(0)
+    s = stdout.read()
+    stdout.close()
+    return s
+
+def check_build_out(msg, s):
+    if "[build-stdout] " + msg not in s:
+        raise Exception("The C# extractor did not interpret the 'dotnet run' command correctly")
+
 # no arguments
-run_codeql_database_create(['dotnet run'], test_db="test-db", db=None, lang="csharp")
+s = run_codeql_database_create_stdout(['dotnet run'], "test-db")
+check_build_out("Default reply", s)
 
 # no arguments, but `--`
-run_codeql_database_create(['dotnet clean', 'rm -rf test-db obj bin', 'dotnet run --'], test_db="test2-db", db=None, lang="csharp")
+s = run_codeql_database_create_stdout(['dotnet clean', 'rm -rf test-db', 'dotnet run --'], "test2-db")
+check_build_out("Default reply", s)
+
+# one argument, no `--`
+s = run_codeql_database_create_stdout(['dotnet clean', 'rm -rf test2-db', 'dotnet run hello'], "test3-db")
+check_build_out("Default reply", s)
+
+# one argument, but `--`
+s = run_codeql_database_create_stdout(['dotnet clean', 'rm -rf test3-db', 'dotnet run -- hello'], "test4-db")
+check_build_out("Default reply", s)
 
 # two arguments, no `--`
-run_codeql_database_create(['dotnet clean', 'rm -rf test2-db obj bin', 'dotnet run hello world'], test_db="test3-db", db=None, lang="csharp")
+s = run_codeql_database_create_stdout(['dotnet clean', 'rm -rf test4-db', 'dotnet run hello world'], "test5-db")
+check_build_out("hello, world", s)
 
 # two arguments, and `--`
-run_codeql_database_create(['dotnet clean', 'rm -rf test3-db obj bin', 'dotnet run -- hello world'], test_db="test4-db", db=None, lang="csharp")
+s = run_codeql_database_create_stdout(['dotnet clean', 'rm -rf test5-db', 'dotnet run -- hello world'], "test6-db")
+check_build_out("hello, world", s)
 
 # shared compilation enabled; tracer should override by changing the command
 # to `dotnet run -p:UseSharedCompilation=true -p:UseSharedCompilation=false -- hello world`
-run_codeql_database_create(['dotnet clean', 'rm -rf test4-db obj bin', 'dotnet run -p:UseSharedCompilation=true -- hello world'], test_db="test5-db", db=None, lang="csharp")
+s = run_codeql_database_create_stdout(['dotnet clean', 'rm -rf test6-db', 'dotnet run -p:UseSharedCompilation=true -- hello world'], "test7-db")
+check_build_out("hello, world", s)

csharp/ql/lib/semmle/code/csharp/dataflow/ExternalFlow.qll

@@ -504,16 +504,36 @@ class UnboundCallable extends Callable {
   }
 }
 
+pragma[nomagic]
+private predicate callableSpecInfo(Callable c, string namespace, string type, string name) {
+  c.getDeclaringType().hasQualifiedName(namespace, type) and
+  c.getName() = name
+}
+
+pragma[nomagic]
+private predicate subtypeSpecCandidate(string name, UnboundValueOrRefType t) {
+  exists(UnboundValueOrRefType t0 |
+    elementSpec(_, _, true, name, _, _, t0) and
+    t = t0.getASubTypeUnbound+()
+  )
+}
+
+pragma[nomagic]
+private predicate callableInfo(Callable c, string name, UnboundValueOrRefType decl) {
+  name = c.getName() and
+  decl = c.getDeclaringType()
+}
+
 private class InterpretedCallable extends Callable {
   InterpretedCallable() {
-    exists(UnboundValueOrRefType t, boolean subtypes, string name |
-      elementSpec(_, _, subtypes, name, _, _, t) and
-      this.hasName(name)
-    |
-      this.getDeclaringType() = t
-      or
-      subtypes = true and
-      this.getDeclaringType() = t.getASubTypeUnbound+()
+    exists(string namespace, string type, string name |
+      callableSpecInfo(this, namespace, type, name) and
+      elementSpec(namespace, type, _, name, _, _)
+    )
+    or
+    exists(string name, UnboundValueOrRefType t |
+      callableInfo(this, name, t) and
+      subtypeSpecCandidate(name, t)
     )
   }
 }

csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowDispatch.qll

@@ -175,10 +175,19 @@ private module DispatchImpl {
    * restricted to those `call`s for which a context might make a difference.
    */
   DataFlowCallable viableImplInCallContext(NonDelegateDataFlowCall call, DataFlowCall ctx) {
-    result.getUnderlyingCallable() =
-      call.getDispatchCall()
-          .getADynamicTargetInCallContext(ctx.(NonDelegateDataFlowCall).getDispatchCall())
-          .getUnboundDeclaration()
+    exists(DispatchCall dc | dc = call.getDispatchCall() |
+      result.getUnderlyingCallable() =
+        getCallableForDataFlow(dc.getADynamicTargetInCallContext(ctx.(NonDelegateDataFlowCall)
+                .getDispatchCall()).getUnboundDeclaration())
+      or
+      exists(Callable c, DataFlowCallable encl |
+        result.asSummarizedCallable() = c and
+        mayBenefitFromCallContext(call, encl) and
+        encl = ctx.getARuntimeTarget() and
+        c = dc.getAStaticTarget().getUnboundDeclaration() and
+        not c instanceof RuntimeCallable
+      )
+    )
   }
 }
 

csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImplCommon.qll

@@ -709,7 +709,8 @@ private module Cached {
      */
     pragma[nomagic]
     private DataFlowCallable viableImplInCallContextExt(DataFlowCall call, DataFlowCall ctx) {
-      result = viableImplInCallContext(call, ctx)
+      result = viableImplInCallContext(call, ctx) and
+      result = viableCallable(call)
       or
       result = viableCallableLambda(call, TDataFlowCallSome(ctx))
       or

csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImplConsistency.qll

@@ -38,6 +38,13 @@ module Consistency {
 
     /** Holds if `n` should be excluded from the consistency test `uniquePostUpdate`. */
     predicate uniquePostUpdateExclude(Node n) { none() }
+
+    /** Holds if `(call, ctx)` should be excluded from the consistency test `viableImplInCallContextTooLargeExclude`. */
+    predicate viableImplInCallContextTooLargeExclude(
+      DataFlowCall call, DataFlowCall ctx, DataFlowCallable callable
+    ) {
+      none()
+    }
   }
 
   private class RelevantNode extends Node {
@@ -217,4 +224,12 @@ module Consistency {
     not any(ConsistencyConfiguration c).postWithInFlowExclude(n) and
     msg = "PostUpdateNode should not be the target of local flow."
   }
+
+  query predicate viableImplInCallContextTooLarge(
+    DataFlowCall call, DataFlowCall ctx, DataFlowCallable callable
+  ) {
+    callable = viableImplInCallContext(call, ctx) and
+    not callable = viableCallable(call) and
+    not any(ConsistencyConfiguration c).viableImplInCallContextTooLargeExclude(call, ctx, callable)
+  }
 }

java/kotlin-extractor/src/main/kotlin/KotlinFileExtractor.kt

@@ -574,8 +574,8 @@ open class KotlinFileExtractor(
 
                     break
                 } else if (parent is IrFile) {
-                    if (innerClass != null) {
-                        // We don't have to extract file class containers for classes
+                    if (innerClass != null && !innerClass.isLocal) {
+                        // We don't have to extract file class containers for classes except for local classes
                         break
                     }
                     if (this.filePath != parent.path) {

java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImplCommon.qll

@@ -709,7 +709,8 @@ private module Cached {
      */
     pragma[nomagic]
     private DataFlowCallable viableImplInCallContextExt(DataFlowCall call, DataFlowCall ctx) {
-      result = viableImplInCallContext(call, ctx)
+      result = viableImplInCallContext(call, ctx) and
+      result = viableCallable(call)
       or
       result = viableCallableLambda(call, TDataFlowCallSome(ctx))
       or

java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImplConsistency.qll

@@ -38,6 +38,13 @@ module Consistency {
 
     /** Holds if `n` should be excluded from the consistency test `uniquePostUpdate`. */
     predicate uniquePostUpdateExclude(Node n) { none() }
+
+    /** Holds if `(call, ctx)` should be excluded from the consistency test `viableImplInCallContextTooLargeExclude`. */
+    predicate viableImplInCallContextTooLargeExclude(
+      DataFlowCall call, DataFlowCall ctx, DataFlowCallable callable
+    ) {
+      none()
+    }
   }
 
   private class RelevantNode extends Node {
@@ -217,4 +224,12 @@ module Consistency {
     not any(ConsistencyConfiguration c).postWithInFlowExclude(n) and
     msg = "PostUpdateNode should not be the target of local flow."
   }
+
+  query predicate viableImplInCallContextTooLarge(
+    DataFlowCall call, DataFlowCall ctx, DataFlowCallable callable
+  ) {
+    callable = viableImplInCallContext(call, ctx) and
+    not callable = viableCallable(call) and
+    not any(ConsistencyConfiguration c).viableImplInCallContextTooLargeExclude(call, ctx, callable)
+  }
 }

java/ql/test/kotlin/library-tests/classes/PrintAst.expected

@@ -7,6 +7,30 @@ classes.kt:
 #   32|         0: [Parameter] s
 #   32|           0: [TypeAccess] String
 #   32|       5: [BlockStmt] { ... }
+#  158|     2: [Method] fn1
+#  158|       3: [TypeAccess] Unit
+#  158|       5: [BlockStmt] { ... }
+#  159|         0: [LocalTypeDeclStmt] class ...
+#  159|           0: [LocalClass] X
+#  159|             1: [Constructor] X
+#  159|               5: [BlockStmt] { ... }
+#  159|                 0: [SuperConstructorInvocationStmt] super(...)
+#  159|                 1: [BlockStmt] { ... }
+#  162|     3: [Method] fn2
+#  162|       3: [TypeAccess] Object
+#  162|       5: [BlockStmt] { ... }
+#  162|         0: [ReturnStmt] return ...
+#  162|           0: [StmtExpr] <Stmt>
+#  162|             0: [BlockStmt] { ... }
+#  162|               0: [LocalTypeDeclStmt] class ...
+#  162|                 0: [AnonymousClass,LocalClass] new Object(...) { ... }
+#  162|                   1: [Constructor] 
+#  162|                     5: [BlockStmt] { ... }
+#  162|                       0: [SuperConstructorInvocationStmt] super(...)
+#  162|                       1: [BlockStmt] { ... }
+#  162|               1: [ExprStmt] <Expr>;
+#  162|                 0: [ClassInstanceExpr] new (...)
+#  162|                   -3: [TypeAccess] Object
 #    2|   2: [Class] ClassOne
 #    2|     1: [Constructor] ClassOne
 #    2|       5: [BlockStmt] { ... }

java/ql/test/kotlin/library-tests/classes/anonymousClasses.expected

@@ -6,6 +6,7 @@
 | classes.kt:85:16:85:25 | new Object(...) { ... } | classes.kt:85:16:85:25 | new (...) |  | classes.kt:85:16:85:25 | Object | classes.kt:85:16:85:25 | class ... |
 | classes.kt:89:16:89:44 | new Interface3<Integer>(...) { ... } | classes.kt:89:16:89:44 | new (...) |  | classes.kt:89:16:89:44 | Interface3<Integer> | classes.kt:89:16:89:44 | class ... |
 | classes.kt:127:16:134:9 | new Object(...) { ... } | classes.kt:127:16:134:9 | new (...) |  | classes.kt:127:16:134:9 | Object | classes.kt:127:16:134:9 | class ... |
+| classes.kt:162:13:162:22 | new Object(...) { ... } | classes.kt:162:13:162:22 | new (...) |  | classes.kt:162:13:162:22 | Object | classes.kt:162:13:162:22 | class ... |
 | generic_anonymous.kt:3:19:5:3 | new Object(...) { ... } | generic_anonymous.kt:3:19:5:3 | new (...) |  | generic_anonymous.kt:3:19:5:3 | Object | generic_anonymous.kt:3:19:5:3 | class ... |
 | generic_anonymous.kt:26:13:26:37 | new Object(...) { ... } | generic_anonymous.kt:26:13:26:37 | new (...) |  | generic_anonymous.kt:26:13:26:37 | Object | generic_anonymous.kt:26:13:26:37 | class ... |
 | generic_anonymous.kt:27:13:27:37 | new Object(...) { ... } | generic_anonymous.kt:27:13:27:37 | new (...) |  | generic_anonymous.kt:27:13:27:37 | Object | generic_anonymous.kt:27:13:27:37 | class ... |

java/ql/test/kotlin/library-tests/classes/classes.expected

@@ -39,6 +39,8 @@
 | classes.kt:141:13:145:13 | Cl1 | Cl0$Cl1 | final, private |
 | classes.kt:150:1:156:1 | Cl00 | Cl00 | final, public |
 | classes.kt:151:5:155:5 | Cl01 | Cl00$Cl01 | final, public |
+| classes.kt:159:5:159:14 | X | ClassesKt$X | final, private |
+| classes.kt:162:13:162:22 | new Object(...) { ... } | <anonymous class> | final, private |
 | generic_anonymous.kt:0:0:0:0 | Generic_anonymousKt | Generic_anonymousKt | final, public |
 | generic_anonymous.kt:1:1:9:1 | Generic | Generic | final, private |
 | generic_anonymous.kt:3:19:5:3 | new Object(...) { ... } | <anonymous class> | final, private |

java/ql/test/kotlin/library-tests/classes/classes.kt

@@ -153,4 +153,10 @@ class Cl00<U0> {
             val x = Cl01<U1>()
         }
     }
-}
+}
+
+fun fn1() {
+    class X {}
+}
+
+fun fn2() = object { }

java/ql/test/kotlin/library-tests/classes/ctorCalls.expected

@@ -39,6 +39,8 @@ superCall
 | classes.kt:141:13:145:13 | super(...) |
 | classes.kt:150:1:156:1 | super(...) |
 | classes.kt:151:5:155:5 | super(...) |
+| classes.kt:159:5:159:14 | super(...) |
+| classes.kt:162:13:162:22 | super(...) |
 | generic_anonymous.kt:1:1:9:1 | super(...) |
 | generic_anonymous.kt:3:19:5:3 | super(...) |
 | generic_anonymous.kt:15:1:33:1 | super(...) |

java/ql/test/kotlin/library-tests/classes/localClass.expected

@@ -4,6 +4,7 @@
 | classes.kt:129:17:131:17 | class ... | classes.kt:129:17:131:17 | Local3 | classes.kt:128:13:133:13 | fn | classes.kt:127:16:134:9 | new Object(...) { ... } |
 | classes.kt:140:9:146:9 | class ... | classes.kt:140:9:146:9 |  | classes.kt:139:5:147:5 | func1 | classes.kt:138:1:148:1 | Cl0 |
 | classes.kt:141:13:145:13 | class ... | classes.kt:141:13:145:13 | Cl1 | classes.kt:140:9:146:9 | func2 | classes.kt:138:1:148:1 | Cl0 |
+| classes.kt:159:5:159:14 | class ... | classes.kt:159:5:159:14 | X | classes.kt:158:1:160:1 | fn1 | classes.kt:0:0:0:0 | ClassesKt |
 | generic_anonymous.kt:25:9:31:9 | class ... | generic_anonymous.kt:25:9:31:9 |  | generic_anonymous.kt:24:5:32:5 | func1 | generic_anonymous.kt:15:1:33:1 | Outer |
 | localClassField.kt:3:9:3:19 | class ... | localClassField.kt:3:9:3:19 | L | localClassField.kt:1:1:11:1 | A | localClassField.kt:1:1:11:1 | A |
 | localClassField.kt:8:9:8:19 | class ... | localClassField.kt:8:9:8:19 | L | localClassField.kt:1:1:11:1 | A | localClassField.kt:1:1:11:1 | A |

java/ql/test/kotlin/library-tests/classes/superTypes.expected

@@ -44,6 +44,8 @@
 | classes.kt:141:13:145:13 | Cl1 | file://<external>/Object.class:0:0:0:0 | Object |
 | classes.kt:150:1:156:1 | Cl00 | file://<external>/Object.class:0:0:0:0 | Object |
 | classes.kt:151:5:155:5 | Cl01 | file://<external>/Object.class:0:0:0:0 | Object |
+| classes.kt:159:5:159:14 | X | file://<external>/Object.class:0:0:0:0 | Object |
+| classes.kt:162:13:162:22 | new Object(...) { ... } | file://<external>/Object.class:0:0:0:0 | Object |
 | file://<external>/C1$<no name provided>$Local3.class:0:0:0:0 | Local3<Integer> | file://<external>/Object.class:0:0:0:0 | Object |
 | file://<external>/C1$Local1.class:0:0:0:0 | Local1<Integer> | file://<external>/Object.class:0:0:0:0 | Object |
 | file://<external>/C1$Local2.class:0:0:0:0 | Local2<Integer> | file://<external>/Object.class:0:0:0:0 | Object |

javascript/ql/experimental/adaptivethreatmodeling/lib/experimental/adaptivethreatmodeling/EndpointFeatures.qll

@@ -16,220 +16,8 @@ private import FunctionBodyFeatures as FunctionBodyFeatures
 private string getTokenFeature(DataFlow::Node endpoint, string featureName) {
   // Performance optimization: Restrict feature extraction to endpoints we've explicitly asked to featurize.
   endpoint = any(FeaturizationConfig cfg).getAnEndpointToFeaturize() and
-  (
-    // Features for endpoints that are contained within a function.
-    exists(Function function |
-      function = FunctionBodyFeatures::getRepresentativeFunctionForEndpoint(endpoint)
-    |
-      // The name of the function that encloses the endpoint.
-      featureName = "enclosingFunctionName" and result = FunctionNames::getNameToFeaturize(function)
-      or
-      // A feature containing natural language tokens from the function that encloses the endpoint in
-      // the order that they appear in the source code.
-      featureName = "enclosingFunctionBody" and
-      result = FunctionBodyFeatures::getBodyTokensFeature(function)
-    )
-    or
-    result =
-      strictconcat(DataFlow::CallNode call, string component |
-        component = getACallBasedTokenFeatureComponent(endpoint, call, featureName)
-      |
-        component, " "
-      )
-    or
-    // The access path of the function being called, both with and without structural info, if the
-    // function being called originates from an external API. For example, the endpoint here:
-    //
-    // ```js
-    // const mongoose = require('mongoose'),
-    //   User = mongoose.model('User', null);
-    // User.findOne(ENDPOINT);
-    // ```
-    //
-    // would have a callee access path with structural info of
-    // `mongoose member model instanceorreturn member findOne instanceorreturn`, and a callee access
-    // path without structural info of `mongoose model findOne`.
-    //
-    // These features indicate that the callee comes from (reading the access path backwards) an
-    // instance of the `findOne` member of an instance of the `model` member of the `mongoose`
-    // external library.
-    exists(AccessPaths::Boolean includeStructuralInfo |
-      featureName =
-        "calleeAccessPath" +
-          any(string x | if includeStructuralInfo = true then x = "WithStructuralInfo" else x = "") and
-      result =
-        concat(API::Node node, string accessPath |
-          node.getInducingNode().(DataFlow::CallNode).getAnArgument() = endpoint and
-          AccessPaths::accessPaths(node, includeStructuralInfo, accessPath, _)
-        |
-          accessPath, " "
-        )
-    )
-  )
-}
-
-/**
- * Gets a value of the function-call-related token-based feature named `featureName` associated
- * with the function call `call` and the endpoint `endpoint`.
- *
- * This may in general report multiple strings, each containing a space-separated list of tokens.
- *
- * **Technical details:** This predicate can have multiple values per endpoint and feature name. As
- * a result, the results from this predicate must be concatenated together.  However concatenating
- * other features like the function body tokens is expensive, so for performance reasons we separate
- * out this predicate from those other features.
- */
-private string getACallBasedTokenFeatureComponent(
-  DataFlow::Node endpoint, DataFlow::CallNode call, string featureName
-) {
-  // Performance optimization: Restrict feature extraction to endpoints we've explicitly asked to featurize.
-  endpoint = any(FeaturizationConfig cfg).getAnEndpointToFeaturize() and
-  // Features for endpoints that are an argument to a function call.
-  endpoint = call.getAnArgument() and
-  (
-    // The name of the function being called, e.g. in a call `Artist.findOne(...)`, this is `findOne`.
-    featureName = "calleeName" and result = call.getCalleeName()
-    or
-    // The name of the receiver of the call, e.g. in a call `Artist.findOne(...)`, this is `Artist`.
-    featureName = "receiverName" and result = call.getReceiver().asExpr().(VarRef).getName()
-    or
-    // The argument index of the endpoint, e.g. in `f(a, endpoint, b)`, this is 1.
-    featureName = "argumentIndex" and
-    result = any(int argIndex | call.getArgument(argIndex) = endpoint).toString()
-    or
-    // The name of the API that the function being called originates from, if the function being
-    // called originates from an external API. For example, the endpoint here:
-    //
-    // ```js
-    // const mongoose = require('mongoose'),
-    //   User = mongoose.model('User', null);
-    // User.findOne(ENDPOINT);
-    // ```
-    //
-    // would have a callee API name of `mongoose`.
-    featureName = "calleeApiName" and
-    exists(API::Node apiNode |
-      AccessPaths::accessPaths(apiNode, false, _, result) and call = apiNode.getInducingNode()
-    )
-  )
-}
-
-/**
- * This module provides functionality for getting a representation of the access path of nodes
- * within the program.
- *
- * For example, it gives the `User.find` callee here:
- *
- * ```js
- * const mongoose = require('mongoose'),
- * User = mongoose.model('User', null);
- * User.find({ 'isAdmin': true })
- * ```
- * the access path `mongoose member model instanceorreturn member find instanceorreturn`.
- *
- * This access path is based on the simplified access path that the untrusted data flowing to
- * external API query associates to each of its sinks, with modifications to optionally include
- * explicit structural information and to improve how well the path tokenizes.
- */
-private module AccessPaths {
-  bindingset[str]
-  private predicate isNumericString(string str) { exists(str.toInt()) }
-
-  /**
-   * Gets a parameter of `base` with name `name`, or a property named `name` of a destructuring parameter.
-   */
-  private API::Node getNamedParameter(API::Node base, string name) {
-    exists(API::Node param |
-      param = base.getAParameter() and
-      not param = base.getReceiver()
-    |
-      result = param and
-      name = param.asSource().(DataFlow::ParameterNode).getName()
-      or
-      param.asSource().asExpr() instanceof DestructuringPattern and
-      result = param.getMember(name)
-    )
-  }
-
-  /**
-   * A utility class that is equivalent to `boolean` but does not require type joining.
-   */
-  class Boolean extends boolean {
-    Boolean() { this = true or this = false }
-  }
-
-  /** Get the access path for the node. This includes structural information like `member`, `param`, and `functionalarg` if `includeStructuralInfo` is true. */
-  predicate accessPaths(
-    API::Node node, Boolean includeStructuralInfo, string accessPath, string apiName
-  ) {
-    //node = API::moduleImport(result)
-    node = API::moduleImport(apiName) and accessPath = apiName
-    or
-    exists(API::Node previousNode, string previousAccessPath |
-      previousNode.getDepth() < node.getDepth() and
-      accessPaths(previousNode, includeStructuralInfo, previousAccessPath, apiName)
-    |
-      // e.g. `new X`, `X()`
-      node = [previousNode.getInstance(), previousNode.getReturn()] and
-      if includeStructuralInfo = true
-      then accessPath = previousAccessPath + " instanceorreturn"
-      else accessPath = previousAccessPath
-      or
-      // e.g. `x.y`, `x[y]`, `const { y } = x`, where `y` is non-numeric and is known at analysis
-      // time.
-      exists(string member |
-        node = previousNode.getMember(member) and
-        not node = previousNode.getUnknownMember() and
-        not isNumericString(member) and
-        not (member = "default" and previousNode = API::moduleImport(_)) and
-        not member = "then" // use the 'promised' edges for .then callbacks
-      |
-        if includeStructuralInfo = true
-        then accessPath = previousAccessPath + " member " + member
-        else accessPath = previousAccessPath + " " + member
-      )
-      or
-      // e.g. `x.y`, `x[y]`, `const { y } = x`, where `y` is numeric or not known at analysis time.
-      (
-        node = previousNode.getUnknownMember() or
-        node = previousNode.getMember(any(string s | isNumericString(s)))
-      ) and
-      if includeStructuralInfo = true
-      then accessPath = previousAccessPath + " member"
-      else accessPath = previousAccessPath
-      or
-      // e.g. `x.then(y => ...)`
-      node = previousNode.getPromised() and
-      accessPath = previousAccessPath
-      or
-      // e.g. `x.y((a, b) => ...)`
-      // Name callback parameters after their name in the source code.
-      // For example, the `res` parameter in `express.get('/foo', (req, res) => {...})` will be
-      // named `express member get functionalarg param res`.
-      exists(string paramName |
-        node = getNamedParameter(previousNode.getAParameter(), paramName) and
-        (
-          if includeStructuralInfo = true
-          then accessPath = previousAccessPath + " functionalarg param " + paramName
-          else accessPath = previousAccessPath + " " + paramName
-        )
-        or
-        exists(string callbackName, int index |
-          node =
-            getNamedParameter(previousNode
-                  .getASuccessor(API::Label::parameter(index))
-                  .getMember(callbackName), paramName) and
-          index != -1 and // ignore receiver
-          if includeStructuralInfo = true
-          then
-            accessPath =
-              previousAccessPath + " functionalarg " + index + " " + callbackName + " param " +
-                paramName
-          else accessPath = previousAccessPath + " " + index + " " + callbackName + " " + paramName
-        )
-      )
-    )
-  }
+  exists(EndpointFeature f | f.getName() = featureName and result = f.getValue(endpoint)) and
+  featureName = getASupportedFeatureName()
 }
 
 private module FunctionNames {
@@ -284,13 +72,7 @@ private module FunctionNames {
 }
 
 /** Get a name of a supported generic token-based feature. */
-string getASupportedFeatureName() {
-  result =
-    [
-      "enclosingFunctionName", "calleeName", "receiverName", "argumentIndex", "calleeApiName",
-      "calleeAccessPath", "calleeAccessPathWithStructuralInfo", "enclosingFunctionBody"
-    ]
-}
+string getASupportedFeatureName() { result = any(EndpointFeature f).getName() }
 
 /**
  * Generic token-based features for ATM.
@@ -303,3 +85,591 @@ predicate tokenFeatures(DataFlow::Node endpoint, string featureName, string feat
   endpoint = any(FeaturizationConfig cfg).getAnEndpointToFeaturize() and
   featureValue = getTokenFeature(endpoint, featureName)
 }
+
+/**
+ * See EndpointFeature
+ */
+private newtype TEndpointFeature =
+  TEnclosingFunctionName() or
+  TReceiverName() or
+  TEnclosingFunctionBody() or
+  TFileImports() or
+  TCalleeImports() or
+  TCalleeFlexibleAccessPath() or
+  TInputAccessPathFromCallee() or
+  TInputArgumentIndex() or
+  TContextFunctionInterfaces() or
+  TContextSurroundingFunctionParameters() or
+  TAssignedToPropName() or
+  TStringConcatenatedWith()
+
+/**
+ * An implementation of an endpoint feature: defines feature-name/value tuples for use in ML.
+ */
+abstract class EndpointFeature extends TEndpointFeature {
+  /**
+   * Gets the name of the feature. Used by the ML model.
+   * Names are coupled to models: changing the name of a feature requires retraining the model.
+   */
+  abstract string getName();
+
+  /**
+   * Gets the value of the feature. Used by the ML model.
+   * Models are trained based on feature values, so changing the value of a feature requires retraining the model.
+   */
+  abstract string getValue(DataFlow::Node endpoint);
+
+  string toString() { result = this.getName() }
+}
+
+/**
+ * The feature for the name of the function that encloses the endpoint.
+ */
+class EnclosingFunctionName extends EndpointFeature, TEnclosingFunctionName {
+  override string getName() { result = "enclosingFunctionName" }
+
+  override string getValue(DataFlow::Node endpoint) {
+    result =
+      FunctionNames::getNameToFeaturize(FunctionBodyFeatures::getRepresentativeFunctionForEndpoint(endpoint))
+  }
+}
+
+/**
+ * The feature for the name of the receiver of the call, e.g. in a call `Artist.findOne(...)`, this is `Artist`.
+ */
+class ReceiverName extends EndpointFeature, TReceiverName {
+  override string getName() { result = "receiverName" }
+
+  override string getValue(DataFlow::Node endpoint) {
+    result =
+      strictconcat(DataFlow::CallNode call, string component |
+        endpoint = call.getAnArgument() and
+        component = call.getReceiver().asExpr().(VarRef).getName()
+      |
+        component, " "
+      )
+  }
+}
+
+/**
+ * The feature for the natural language tokens from the function that encloses the endpoint in
+ * the order that they appear in the source code.
+ */
+class EnclosingFunctionBody extends EndpointFeature, TEnclosingFunctionBody {
+  override string getName() { result = "enclosingFunctionBody" }
+
+  override string getValue(DataFlow::Node endpoint) {
+    endpoint = any(FeaturizationConfig cfg).getAnEndpointToFeaturize() and
+    result =
+      FunctionBodyFeatures::getBodyTokensFeature(FunctionBodyFeatures::getRepresentativeFunctionForEndpoint(endpoint))
+  }
+}
+
+/**
+ * The feature for the imports defined in the file containing an endpoint.
+ *
+ * ### Example
+ *
+ * ```javascript
+ * import { findOne } from 'mongoose';
+ * import * as _ from 'lodash';
+ * const pg = require('pg');
+ *
+ * // ...
+ * ```
+ *
+ * In this file, all endpoints will have the value `lodash mongoose pg` for the feature `fileImports`.
+ */
+class FileImports extends EndpointFeature, TFileImports {
+  override string getName() { result = "fileImports" }
+
+  override string getValue(DataFlow::Node endpoint) {
+    result = SyntacticUtilities::getImportPathsForFile(endpoint.getFile())
+  }
+}
+
+/**
+ * The feature for the function parameters of the functions that enclose an endpoint.
+ *
+ * ### Example
+ * ```javascript
+ * function f(a, b) {
+ *   // ...
+ *   const g = (c, d) => x.foo(endpoint);
+ * //                          ^^^^^^^^
+ * }
+ * ```
+ * In the above example, the feature for the marked endpoint has value '(a, b)\n(c, d)'.
+ * The line breaks act as a separator between the parameters of different functions but
+ * will be treated by tokenization as if they were spaces.
+ */
+class ContextSurroundingFunctionParameters extends EndpointFeature,
+  TContextSurroundingFunctionParameters {
+  override string getName() { result = "contextSurroundingFunctionParameters" }
+
+  Function getRelevantFunction(DataFlow::Node endpoint) {
+    result = endpoint.asExpr().getEnclosingFunction*()
+  }
+
+  override string getValue(DataFlow::Node endpoint) {
+    result =
+      concat(string functionParameterLine, Function f |
+        f = this.getRelevantFunction(endpoint) and
+        functionParameterLine = SyntacticUtilities::getFunctionParametersFeatureComponent(f)
+      |
+        functionParameterLine, "\n"
+        order by
+          f.getLocation().getStartLine(), f.getLocation().getStartColumn()
+      )
+  }
+}
+
+/**
+ * The feature that gives the name of any properties an endpoint is assigned to (if any).
+ *
+ * ### Example
+ * ```javascript
+ * const div = document.createElement('div');
+ * div.innerHTML = endpoint; // feature value is 'innerHTML'
+ *
+ * foo({x: endpoint}); // feature value is 'x'
+ * ```
+ */
+class AssignedToPropName extends EndpointFeature, TAssignedToPropName {
+  override string getName() { result = "assignedToPropName" }
+
+  override string getValue(DataFlow::Node endpoint) {
+    exists(DataFlow::PropWrite w | w.getRhs().asExpr().getUnderlyingValue().flow() = endpoint |
+      result = w.getPropertyName()
+    )
+  }
+}
+
+/**
+ * The feature that shows the text an endpoint is being concatenated with.
+ *
+ * ### Example
+ *
+ * ```javascript
+ * const x = 'foo' + endpoint + 'bar'; // feature value is `'foo' -endpoint- 'bar'
+ * ```
+ */
+class StringConcatenatedWith extends EndpointFeature, TStringConcatenatedWith {
+  override string getName() { result = "stringConcatenatedWith" }
+
+  override string getValue(DataFlow::Node endpoint) {
+    exists(StringOps::ConcatenationRoot root |
+      root.getALeaf() = endpoint and
+      result =
+        concat(StringOps::ConcatenationLeaf p |
+            p.getRoot() = root and
+            (
+              p.getStartLine() < endpoint.getStartLine()
+              or
+              p.getStartLine() = endpoint.getStartLine() and
+              p.getStartColumn() < endpoint.getStartColumn()
+            )
+          |
+            SyntacticUtilities::renderStringConcatOperand(p), " + "
+            order by
+              p.getStartLine(), p.getStartColumn()
+          ) + " -endpoint- " +
+          concat(StringOps::ConcatenationLeaf p |
+            p.getRoot() = root and
+            (
+              p.getStartLine() > endpoint.getStartLine()
+              or
+              p.getStartLine() = endpoint.getStartLine() and
+              p.getStartColumn() > endpoint.getStartColumn()
+            )
+          |
+            SyntacticUtilities::renderStringConcatOperand(p), " + "
+            order by
+              p.getStartLine(), p.getStartColumn()
+          )
+    )
+  }
+}
+
+/**
+ * The feature for the imports used in the callee of an invocation.
+ *
+ * ### Example
+ *
+ * ```javascript
+ * import * as _ from 'lodash';
+ *
+ * // ...
+ * _.deepClone(someObject);
+ * //          ^^^^^^^^^^ will have the value `lodash` for the feature `calleeImports`.
+ * ```
+ */
+class CalleeImports extends EndpointFeature, TCalleeImports {
+  override string getName() { result = "calleeImports" }
+
+  override string getValue(DataFlow::Node endpoint) {
+    not result = SyntacticUtilities::getUnknownSymbol() and
+    exists(DataFlow::InvokeNode invk |
+      (
+        invk.getAnArgument() = endpoint or
+        SyntacticUtilities::getANestedInitializerValue(invk.getAnArgument()
+              .asExpr()
+              .getUnderlyingValue()).flow() = endpoint
+      ) and
+      result =
+        concat(string importPath |
+          importPath = SyntacticUtilities::getCalleeImportPath(invk.getCalleeNode())
+        |
+          importPath, " " order by importPath
+        )
+    )
+  }
+}
+
+/**
+ * The feature for the interfaces of all named functions in the same file as the endpoint.
+ *
+ * ### Example
+ * ```javascript
+ * // Will return: "f(a, b, c)\ng(x, y, z)\nh(u, v)" for this file.
+ * function f(a, b, c) { ... }
+ *
+ * function g(x, y, z) {
+ *   function h(u, v) { ... }
+ *   ...
+ * }
+ * ```
+ */
+class ContextFunctionInterfaces extends EndpointFeature, TContextFunctionInterfaces {
+  override string getName() { result = "contextFunctionInterfaces" }
+
+  override string getValue(DataFlow::Node endpoint) {
+    result = SyntacticUtilities::getFunctionInterfacesForFile(endpoint.getFile())
+  }
+}
+
+/**
+ * Syntactic utilities for feature value computation.
+ */
+private module SyntacticUtilities {
+  /**
+   * Renders an operand in a string concatenation by surrounding a constant in quotes, and
+   * by using `getSimpleAccessPath` for everything else.
+   */
+  string renderStringConcatOperand(DataFlow::Node operand) {
+    if exists(unique(string v | operand.mayHaveStringValue(v)))
+    then result = "'" + any(string v | operand.mayHaveStringValue(v)) + "'"
+    else result = getSimpleAccessPath(operand)
+  }
+
+  /** Gets all the imports defined in the file containing the endpoint. */
+  string getImportPathsForFile(File file) {
+    result =
+      concat(string importPath |
+        importPath = SyntacticUtilities::getImportPathForFile(file)
+      |
+        importPath, " " order by importPath
+      )
+  }
+
+  /** Gets an import located in `file`. */
+  string getImportPathForFile(File file) {
+    result = any(Import imp | imp.getFile() = file).getImportedPath().getValue()
+  }
+
+  /**
+   * Gets the feature component for the parameters of a function.
+   *
+   * ```javascript
+   * function f(a, b, c) { // will return "(a, b, c)" for this function
+   *  return a + b + c;
+   * }
+   *
+   * async function g(a) { // will return "(a)" for this function
+   *   return 2*a
+   * };
+   *
+   * const h = (b) => 3*b; // will return "(b)" for this function
+   * ```
+   */
+  string getFunctionParametersFeatureComponent(Function f) {
+    result =
+      "(" +
+        concat(string parameter, int i |
+          parameter = getParameterNameOrUnknown(f.getParameter(i))
+        |
+          parameter, ", " order by i
+        ) + ")"
+  }
+
+  /**
+   * Gets the function interfaces of all named functions in a file, concatenated together.
+   *
+   * ```javascript
+   * // Will return: "f(a, b, c)\ng(x, y, z)\nh(u, v)" for this file.
+   * function f(a, b, c) { ... }
+   *
+   * function g(x, y, z) {
+   *   function h(u, v) { ... }
+   *   ...
+   * }
+   */
+  string getFunctionInterfacesForFile(File file) {
+    result =
+      concat(Function func, string line |
+        func.getFile() = file and
+        line = func.getName() + getFunctionParametersFeatureComponent(func)
+      |
+        line, "\n" order by line
+      )
+  }
+
+  /**
+   * Gets a property initializer value in an object literal or one of its nested object literals.
+   */
+  Expr getANestedInitializerValue(ObjectExpr o) {
+    exists(Expr init | init = o.getAProperty().getInit().getUnderlyingValue() |
+      result = [init, getANestedInitializerValue(init)]
+    )
+  }
+
+  /**
+   * Computes a simple access path for how a callee can refer to a value that appears in an argument to a call.
+   *
+   * Supports:
+   * - direct arguments
+   * - properties of (nested) objects that are arguments
+   *
+   * Unknown cases and property names result in `?`.
+   */
+  string getSimpleParameterAccessPath(DataFlow::Node node) {
+    if exists(DataFlow::CallNode call | node = call.getArgument(_))
+    then exists(DataFlow::CallNode call, int i | node = call.getArgument(i) | result = i + "")
+    else result = getSimplePropertyAccessPath(node)
+  }
+
+  /**
+   * Computes a simple access path for how a user can refer to a value that appears in an (nested) object.
+   *
+   * Supports:
+   * - properties of (nested) objects
+   *
+   * Unknown cases and property names result in `?`.
+   */
+  string getSimplePropertyAccessPath(DataFlow::Node node) {
+    if exists(ObjectExpr o | o.getAProperty().getInit().getUnderlyingValue() = node.asExpr())
+    then
+      exists(DataFlow::PropWrite w |
+        w.getRhs() = node and
+        result = getSimpleParameterAccessPath(w.getBase()) + "." + getPropertyNameOrUnknown(w)
+      )
+    else result = getUnknownSymbol()
+  }
+
+  /**
+   * Gets the imported package path that this node depends on, if any.
+   *
+   * Otherwise, returns '?'.
+   *
+   * XXX Be careful with using this in your features, as it might teach the model
+   * a fixed list of "dangerous" libraries that could lead to bad generalization.
+   */
+  string getCalleeImportPath(DataFlow::Node node) {
+    exists(DataFlow::Node src | src = node.getALocalSource() |
+      if src instanceof DataFlow::ModuleImportNode
+      then result = src.(DataFlow::ModuleImportNode).getPath()
+      else
+        if src instanceof DataFlow::PropRead
+        then result = getCalleeImportPath(src.(DataFlow::PropRead).getBase())
+        else
+          if src instanceof DataFlow::InvokeNode
+          then result = getCalleeImportPath(src.(DataFlow::InvokeNode).getCalleeNode())
+          else
+            if src.asExpr() instanceof AwaitExpr
+            then result = getCalleeImportPath(src.asExpr().(AwaitExpr).getOperand().flow())
+            else result = getUnknownSymbol()
+    )
+  }
+
+  /**
+   * Computes a simple access path for a node.
+   *
+   * Supports:
+   * - variable reads (including `this` and `super`)
+   * - imports
+   * - await
+   * - property reads
+   * - invocations
+   *
+   * Unknown cases and property names results in `?`.
+   *
+   * # Examples
+   *
+   *  - The node `x.foo` will have the simple access path `x.foo`.
+   *  - In the following file, the simple access path will be `import("./foo").bar.baz`:
+   *
+   * ```javascript
+   * import * as lib from "./foo"
+   * console.log(lib.bar.baz());
+   * //          ^^^^^^^^^^^ node
+   */
+  string getSimpleAccessPath(DataFlow::Node node) {
+    exists(Expr e | e = node.asExpr().getUnderlyingValue() |
+      if
+        e instanceof SuperAccess or
+        e instanceof ThisAccess or
+        e instanceof VarAccess or
+        e instanceof Import or
+        e instanceof AwaitExpr or
+        node instanceof DataFlow::PropRead or
+        node instanceof DataFlow::InvokeNode
+      then
+        e instanceof SuperAccess and result = "super"
+        or
+        e instanceof ThisAccess and result = "this"
+        or
+        e instanceof VarAccess and result = e.(VarAccess).getName()
+        or
+        e instanceof Import and result = "import(" + getSimpleImportPath(e) + ")"
+        or
+        e instanceof AwaitExpr and
+        result = "(await " + getSimpleAccessPath(e.(AwaitExpr).getOperand().flow()) + ")"
+        or
+        node instanceof DataFlow::PropRead and
+        result =
+          getSimpleAccessPath(node.(DataFlow::PropRead).getBase()) + "." +
+            getPropertyNameOrUnknown(node)
+        or
+        (node instanceof DataFlow::InvokeNode and not e instanceof Import) and
+        result = getSimpleAccessPath(node.(DataFlow::InvokeNode).getCalleeNode()) + "()"
+      else result = getUnknownSymbol()
+    )
+  }
+
+  string getUnknownSymbol() { result = "?" }
+
+  /**
+   * Gets the imported path.
+   *
+   * XXX To avoid teaching the ML model about npm packages, only relative paths are supported
+   *
+   * Unknown paths result in `?`.
+   */
+  string getSimpleImportPath(Import i) {
+    if exists(i.getImportedPath().getValue())
+    then
+      exists(string p | p = i.getImportedPath().getValue() |
+        // Hide absolute imports from ML training data.
+        // ============================================
+        // There is the hypothesis that exposing absolute imports to the model
+        // might lead to bad generalization. For example, the model might learn
+        // to strongly associate a specific database client with sinks and no
+        // longer be able to flag sinks when data flow is broken.
+        // Placing this logic so deeply within the feature extraction code is
+        // perhaps a bit of a hack and it is a use case to consider when refactoring
+        // endpoint filters/data extraction.
+        if p.matches(".%") then result = "\"p\"" else result = "!"
+      )
+    else result = getUnknownSymbol()
+  }
+
+  /**
+   * Gets the property name of a property reference or `?` if it is unknown.
+   */
+  string getPropertyNameOrUnknown(DataFlow::PropRef ref) {
+    if exists(ref.getPropertyName())
+    then result = ref.getPropertyName()
+    else result = getUnknownSymbol()
+  }
+
+  /**
+   * Gets the parameter name if it exists, or `?` if it is unknown.
+   */
+  string getParameterNameOrUnknown(Parameter p) {
+    if exists(p.getName()) then result = p.getName() else result = getUnknownSymbol()
+  }
+}
+
+/**
+ * The feature for the access path of the callee node of a call that has an argument that "contains" the endpoint.
+ *
+ * "Containment" is syntactic, and currently means that the endpoint is an argument to the call, or that the endpoint is a (nested) property value of an argument.
+ *
+ * Examples:
+ * ```
+ * foo(endpoint); // -> foo
+ * foo.bar(endpoint); // -> foo.bar
+ * foo.bar({ baz: endpoint }); // -> foo.bar
+ * this.foo.bar(endpoint); // -> this.foo.bar
+ * foo[complex()].bar(endpoint); // -> foo.?.bar
+ * ```
+ */
+class CalleeFlexibleAccessPath extends EndpointFeature, TCalleeFlexibleAccessPath {
+  override string getName() { result = "CalleeFlexibleAccessPath" }
+
+  override string getValue(DataFlow::Node endpoint) {
+    exists(DataFlow::InvokeNode invk |
+      result = SyntacticUtilities::getSimpleAccessPath(invk.getCalleeNode()) and
+      // ignore the unknown path
+      not result = SyntacticUtilities::getUnknownSymbol() and
+      (
+        invk.getAnArgument() = endpoint or
+        SyntacticUtilities::getANestedInitializerValue(invk.getAnArgument()
+              .asExpr()
+              .getUnderlyingValue()).flow() = endpoint
+      )
+    )
+  }
+}
+
+/**
+ * The feature for how a callee can refer to a the endpoint that is "contained" in some argument to a call
+ *
+ * "Containment" is syntactic, and currently means that the endpoint is an argument to the call, or that the endpoint is a (nested) property value of an argument.
+ *
+ * Examples:
+ * ```
+ * foo({ bar: endpoint }); // -> bar
+ * foo(x, { bar: { baz: endpoint } }); // -> bar.baz
+ * ```
+ */
+class InputAccessPathFromCallee extends EndpointFeature, TInputAccessPathFromCallee {
+  override string getName() { result = "InputAccessPathFromCallee" }
+
+  override string getValue(DataFlow::Node endpoint) {
+    exists(DataFlow::InvokeNode invk |
+      result = SyntacticUtilities::getSimpleParameterAccessPath(endpoint) and
+      SyntacticUtilities::getANestedInitializerValue(invk.getAnArgument()
+            .asExpr()
+            .getUnderlyingValue()).flow() = endpoint
+    )
+  }
+}
+
+/**
+ * The feature for how the index of an argument that "contains" and endpoint.
+ *
+ * "Containment" is syntactic, and currently means that the endpoint is an argument to the call, or that the endpoint is a (nested) property value of an argument.
+ *
+ * Examples:
+ * ```
+ * foo(endpoint); // -> 0
+ * foo({ bar: endpoint }); // -> 0
+ * foo(x, { bar: { baz: endpoint } }); // -> 1
+ * ```
+ */
+class InputArgumentIndex extends EndpointFeature, TInputArgumentIndex {
+  override string getName() { result = "InputArgumentIndex" }
+
+  override string getValue(DataFlow::Node endpoint) {
+    exists(DataFlow::InvokeNode invk, DataFlow::Node arg, int i | arg = invk.getArgument(i) |
+      result = i + "" and
+      (
+        invk.getArgument(i) = endpoint
+        or
+        SyntacticUtilities::getANestedInitializerValue(arg.asExpr().getUnderlyingValue()).flow() =
+          endpoint
+      )
+    )
+  }
+}

javascript/ql/experimental/adaptivethreatmodeling/src/codeql-pack.lock.yml

@@ -1,6 +1,6 @@
 ---
 dependencies:
-  codeql/javascript-experimental-atm-model:
-    version: 0.2.0
+  dsp-testing/javascript-experimental-atm-model:
+    version: 0.2.1-2022-10-07-10h43m13s.hungry-panda-5wlwgw2p.49f6f50f04fb67286bfb3b335968a0cb683d1dd61acbfd13138bfeb101842b9f
 compiled: false
 lockVersion: 1.0.0

javascript/ql/experimental/adaptivethreatmodeling/src/qlpack.yml

@@ -4,8 +4,8 @@ version: 0.3.4
 suites: codeql-suites
 defaultSuiteFile: codeql-suites/javascript-atm-code-scanning.qls
 groups:
-    - javascript
-    - experimental
+  - javascript
+  - experimental
 dependencies:
-    codeql/javascript-experimental-atm-lib: "*"
-    codeql/javascript-experimental-atm-model: "0.2.0"
+  codeql/javascript-experimental-atm-lib: "*"
+  dsp-testing/javascript-experimental-atm-model: 0.2.1-2022-10-07-10h43m13s.hungry-panda-5wlwgw2p.49f6f50f04fb67286bfb3b335968a0cb683d1dd61acbfd13138bfeb101842b9f

javascript/ql/experimental/adaptivethreatmodeling/test/endpoint_unit_tests/ExtractEndpointData.expected

@@ -296,179 +296,267 @@ endpoints
 | index.js:84:12:84:18 | foo.bar | Xss | notASinkReason | ClientRequest | string |
 | index.js:84:12:84:18 | foo.bar | Xss | sinkLabel | NotASink | string |
 tokenFeatures
-| applications/examples/static/epydoc/epydoc.js:2:15:2:33 | "Should be ignored" | argumentIndex | 0 |
-| applications/examples/static/epydoc/epydoc.js:2:15:2:33 | "Should be ignored" | calleeAccessPath |  |
-| applications/examples/static/epydoc/epydoc.js:2:15:2:33 | "Should be ignored" | calleeAccessPathWithStructuralInfo |  |
-| applications/examples/static/epydoc/epydoc.js:2:15:2:33 | "Should be ignored" | calleeApiName |  |
-| applications/examples/static/epydoc/epydoc.js:2:15:2:33 | "Should be ignored" | calleeName | log |
+| applications/examples/static/epydoc/epydoc.js:2:15:2:33 | "Should be ignored" | CalleeFlexibleAccessPath | console.log |
+| applications/examples/static/epydoc/epydoc.js:2:15:2:33 | "Should be ignored" | InputAccessPathFromCallee |  |
+| applications/examples/static/epydoc/epydoc.js:2:15:2:33 | "Should be ignored" | InputArgumentIndex | 0 |
+| applications/examples/static/epydoc/epydoc.js:2:15:2:33 | "Should be ignored" | assignedToPropName |  |
+| applications/examples/static/epydoc/epydoc.js:2:15:2:33 | "Should be ignored" | calleeImports |  |
+| applications/examples/static/epydoc/epydoc.js:2:15:2:33 | "Should be ignored" | contextFunctionInterfaces | should_be_ignored() |
+| applications/examples/static/epydoc/epydoc.js:2:15:2:33 | "Should be ignored" | contextSurroundingFunctionParameters | () |
 | applications/examples/static/epydoc/epydoc.js:2:15:2:33 | "Should be ignored" | enclosingFunctionBody | console log Should be ignored |
 | applications/examples/static/epydoc/epydoc.js:2:15:2:33 | "Should be ignored" | enclosingFunctionName | should_be_ignored |
+| applications/examples/static/epydoc/epydoc.js:2:15:2:33 | "Should be ignored" | fileImports |  |
 | applications/examples/static/epydoc/epydoc.js:2:15:2:33 | "Should be ignored" | receiverName | console |
-| index.js:1:25:1:33 | "express" | argumentIndex | 0 |
-| index.js:1:25:1:33 | "express" | calleeAccessPath |  |
-| index.js:1:25:1:33 | "express" | calleeAccessPathWithStructuralInfo |  |
-| index.js:1:25:1:33 | "express" | calleeApiName |  |
-| index.js:1:25:1:33 | "express" | calleeName | require |
+| applications/examples/static/epydoc/epydoc.js:2:15:2:33 | "Should be ignored" | stringConcatenatedWith |  |
+| index.js:1:25:1:33 | "express" | CalleeFlexibleAccessPath | require |
+| index.js:1:25:1:33 | "express" | InputAccessPathFromCallee |  |
+| index.js:1:25:1:33 | "express" | InputArgumentIndex | 0 |
+| index.js:1:25:1:33 | "express" | assignedToPropName |  |
+| index.js:1:25:1:33 | "express" | calleeImports |  |
+| index.js:1:25:1:33 | "express" | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:1:25:1:33 | "express" | contextSurroundingFunctionParameters |  |
 | index.js:1:25:1:33 | "express" | enclosingFunctionBody |  |
 | index.js:1:25:1:33 | "express" | enclosingFunctionName |  |
+| index.js:1:25:1:33 | "express" | fileImports | express mongoose |
 | index.js:1:25:1:33 | "express" | receiverName |  |
-| index.js:2:26:2:35 | 'mongoose' | argumentIndex | 0 |
-| index.js:2:26:2:35 | 'mongoose' | calleeAccessPath |  |
-| index.js:2:26:2:35 | 'mongoose' | calleeAccessPathWithStructuralInfo |  |
-| index.js:2:26:2:35 | 'mongoose' | calleeApiName |  |
-| index.js:2:26:2:35 | 'mongoose' | calleeName | require |
+| index.js:1:25:1:33 | "express" | stringConcatenatedWith |  |
+| index.js:2:26:2:35 | 'mongoose' | CalleeFlexibleAccessPath | require |
+| index.js:2:26:2:35 | 'mongoose' | InputAccessPathFromCallee |  |
+| index.js:2:26:2:35 | 'mongoose' | InputArgumentIndex | 0 |
+| index.js:2:26:2:35 | 'mongoose' | assignedToPropName |  |
+| index.js:2:26:2:35 | 'mongoose' | calleeImports |  |
+| index.js:2:26:2:35 | 'mongoose' | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:2:26:2:35 | 'mongoose' | contextSurroundingFunctionParameters |  |
 | index.js:2:26:2:35 | 'mongoose' | enclosingFunctionBody |  |
 | index.js:2:26:2:35 | 'mongoose' | enclosingFunctionName |  |
+| index.js:2:26:2:35 | 'mongoose' | fileImports | express mongoose |
 | index.js:2:26:2:35 | 'mongoose' | receiverName |  |
-| index.js:3:29:3:34 | 'User' | argumentIndex | 0 |
-| index.js:3:29:3:34 | 'User' | calleeAccessPath | mongoose model |
-| index.js:3:29:3:34 | 'User' | calleeAccessPathWithStructuralInfo | mongoose member model instanceorreturn |
-| index.js:3:29:3:34 | 'User' | calleeApiName | mongoose |
-| index.js:3:29:3:34 | 'User' | calleeName | model |
+| index.js:2:26:2:35 | 'mongoose' | stringConcatenatedWith |  |
+| index.js:3:29:3:34 | 'User' | CalleeFlexibleAccessPath | mongoose.model |
+| index.js:3:29:3:34 | 'User' | InputAccessPathFromCallee |  |
+| index.js:3:29:3:34 | 'User' | InputArgumentIndex | 0 |
+| index.js:3:29:3:34 | 'User' | assignedToPropName |  |
+| index.js:3:29:3:34 | 'User' | calleeImports | mongoose |
+| index.js:3:29:3:34 | 'User' | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:3:29:3:34 | 'User' | contextSurroundingFunctionParameters |  |
 | index.js:3:29:3:34 | 'User' | enclosingFunctionBody |  |
 | index.js:3:29:3:34 | 'User' | enclosingFunctionName |  |
+| index.js:3:29:3:34 | 'User' | fileImports | express mongoose |
 | index.js:3:29:3:34 | 'User' | receiverName | mongoose |
-| index.js:3:37:3:40 | null | argumentIndex | 1 |
-| index.js:3:37:3:40 | null | calleeAccessPath | mongoose model |
-| index.js:3:37:3:40 | null | calleeAccessPathWithStructuralInfo | mongoose member model instanceorreturn |
-| index.js:3:37:3:40 | null | calleeApiName | mongoose |
-| index.js:3:37:3:40 | null | calleeName | model |
+| index.js:3:29:3:34 | 'User' | stringConcatenatedWith |  |
+| index.js:3:37:3:40 | null | CalleeFlexibleAccessPath | mongoose.model |
+| index.js:3:37:3:40 | null | InputAccessPathFromCallee |  |
+| index.js:3:37:3:40 | null | InputArgumentIndex | 1 |
+| index.js:3:37:3:40 | null | assignedToPropName |  |
+| index.js:3:37:3:40 | null | calleeImports | mongoose |
+| index.js:3:37:3:40 | null | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:3:37:3:40 | null | contextSurroundingFunctionParameters |  |
 | index.js:3:37:3:40 | null | enclosingFunctionBody |  |
 | index.js:3:37:3:40 | null | enclosingFunctionName |  |
+| index.js:3:37:3:40 | null | fileImports | express mongoose |
 | index.js:3:37:3:40 | null | receiverName | mongoose |
-| index.js:8:12:8:21 | '/isAdmin' | argumentIndex | 0 |
-| index.js:8:12:8:21 | '/isAdmin' | calleeAccessPath | express post |
-| index.js:8:12:8:21 | '/isAdmin' | calleeAccessPathWithStructuralInfo | express instanceorreturn member post instanceorreturn |
-| index.js:8:12:8:21 | '/isAdmin' | calleeApiName | express |
-| index.js:8:12:8:21 | '/isAdmin' | calleeName | post |
+| index.js:3:37:3:40 | null | stringConcatenatedWith |  |
+| index.js:8:12:8:21 | '/isAdmin' | CalleeFlexibleAccessPath | app.post |
+| index.js:8:12:8:21 | '/isAdmin' | InputAccessPathFromCallee |  |
+| index.js:8:12:8:21 | '/isAdmin' | InputArgumentIndex | 0 |
+| index.js:8:12:8:21 | '/isAdmin' | assignedToPropName |  |
+| index.js:8:12:8:21 | '/isAdmin' | calleeImports | express |
+| index.js:8:12:8:21 | '/isAdmin' | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:8:12:8:21 | '/isAdmin' | contextSurroundingFunctionParameters | () |
 | index.js:8:12:8:21 | '/isAdmin' | enclosingFunctionBody | app post /isAdmin req res User find isAdmin req body isAdmin |
 | index.js:8:12:8:21 | '/isAdmin' | enclosingFunctionName | flowFromSourceToSink |
+| index.js:8:12:8:21 | '/isAdmin' | fileImports | express mongoose |
 | index.js:8:12:8:21 | '/isAdmin' | receiverName | app |
-| index.js:8:24:10:3 | (req, r ... });\\n  } | argumentIndex | 1 |
-| index.js:8:24:10:3 | (req, r ... });\\n  } | calleeAccessPath | express post |
-| index.js:8:24:10:3 | (req, r ... });\\n  } | calleeAccessPathWithStructuralInfo | express instanceorreturn member post instanceorreturn |
-| index.js:8:24:10:3 | (req, r ... });\\n  } | calleeApiName | express |
-| index.js:8:24:10:3 | (req, r ... });\\n  } | calleeName | post |
+| index.js:8:12:8:21 | '/isAdmin' | stringConcatenatedWith |  |
+| index.js:8:24:10:3 | (req, r ... });\\n  } | CalleeFlexibleAccessPath | app.post |
+| index.js:8:24:10:3 | (req, r ... });\\n  } | InputAccessPathFromCallee |  |
+| index.js:8:24:10:3 | (req, r ... });\\n  } | InputArgumentIndex | 1 |
+| index.js:8:24:10:3 | (req, r ... });\\n  } | assignedToPropName |  |
+| index.js:8:24:10:3 | (req, r ... });\\n  } | calleeImports | express |
+| index.js:8:24:10:3 | (req, r ... });\\n  } | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:8:24:10:3 | (req, r ... });\\n  } | contextSurroundingFunctionParameters | ()\n(req, res) |
 | index.js:8:24:10:3 | (req, r ... });\\n  } | enclosingFunctionBody | app post /isAdmin req res User find isAdmin req body isAdmin |
 | index.js:8:24:10:3 | (req, r ... });\\n  } | enclosingFunctionName | flowFromSourceToSink |
+| index.js:8:24:10:3 | (req, r ... });\\n  } | fileImports | express mongoose |
 | index.js:8:24:10:3 | (req, r ... });\\n  } | receiverName | app |
-| index.js:9:15:9:45 | { 'isAd ... Admin } | argumentIndex | 0 |
-| index.js:9:15:9:45 | { 'isAd ... Admin } | calleeAccessPath | mongoose model find |
-| index.js:9:15:9:45 | { 'isAd ... Admin } | calleeAccessPathWithStructuralInfo | mongoose member model instanceorreturn member find instanceorreturn |
-| index.js:9:15:9:45 | { 'isAd ... Admin } | calleeApiName | mongoose |
-| index.js:9:15:9:45 | { 'isAd ... Admin } | calleeName | find |
+| index.js:8:24:10:3 | (req, r ... });\\n  } | stringConcatenatedWith |  |
+| index.js:9:15:9:45 | { 'isAd ... Admin } | CalleeFlexibleAccessPath | User.find |
+| index.js:9:15:9:45 | { 'isAd ... Admin } | InputAccessPathFromCallee |  |
+| index.js:9:15:9:45 | { 'isAd ... Admin } | InputArgumentIndex | 0 |
+| index.js:9:15:9:45 | { 'isAd ... Admin } | assignedToPropName |  |
+| index.js:9:15:9:45 | { 'isAd ... Admin } | calleeImports | mongoose |
+| index.js:9:15:9:45 | { 'isAd ... Admin } | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:9:15:9:45 | { 'isAd ... Admin } | contextSurroundingFunctionParameters | ()\n(req, res) |
 | index.js:9:15:9:45 | { 'isAd ... Admin } | enclosingFunctionBody | app post /isAdmin req res User find isAdmin req body isAdmin |
 | index.js:9:15:9:45 | { 'isAd ... Admin } | enclosingFunctionName | flowFromSourceToSink |
+| index.js:9:15:9:45 | { 'isAd ... Admin } | fileImports | express mongoose |
 | index.js:9:15:9:45 | { 'isAd ... Admin } | receiverName | User |
-| index.js:9:28:9:43 | req.body.isAdmin | argumentIndex |  |
-| index.js:9:28:9:43 | req.body.isAdmin | calleeAccessPath |  |
-| index.js:9:28:9:43 | req.body.isAdmin | calleeAccessPathWithStructuralInfo |  |
-| index.js:9:28:9:43 | req.body.isAdmin | calleeApiName |  |
-| index.js:9:28:9:43 | req.body.isAdmin | calleeName |  |
+| index.js:9:15:9:45 | { 'isAd ... Admin } | stringConcatenatedWith |  |
+| index.js:9:28:9:43 | req.body.isAdmin | CalleeFlexibleAccessPath | User.find |
+| index.js:9:28:9:43 | req.body.isAdmin | InputAccessPathFromCallee | 0.isAdmin |
+| index.js:9:28:9:43 | req.body.isAdmin | InputArgumentIndex | 0 |
+| index.js:9:28:9:43 | req.body.isAdmin | assignedToPropName | isAdmin |
+| index.js:9:28:9:43 | req.body.isAdmin | calleeImports | mongoose |
+| index.js:9:28:9:43 | req.body.isAdmin | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:9:28:9:43 | req.body.isAdmin | contextSurroundingFunctionParameters | ()\n(req, res) |
 | index.js:9:28:9:43 | req.body.isAdmin | enclosingFunctionBody | app post /isAdmin req res User find isAdmin req body isAdmin |
 | index.js:9:28:9:43 | req.body.isAdmin | enclosingFunctionName | flowFromSourceToSink |
+| index.js:9:28:9:43 | req.body.isAdmin | fileImports | express mongoose |
 | index.js:9:28:9:43 | req.body.isAdmin | receiverName |  |
-| index.js:14:12:14:21 | '/isAdmin' | argumentIndex | 0 |
-| index.js:14:12:14:21 | '/isAdmin' | calleeAccessPath | express post |
-| index.js:14:12:14:21 | '/isAdmin' | calleeAccessPathWithStructuralInfo | express instanceorreturn member post instanceorreturn |
-| index.js:14:12:14:21 | '/isAdmin' | calleeApiName | express |
-| index.js:14:12:14:21 | '/isAdmin' | calleeName | post |
+| index.js:9:28:9:43 | req.body.isAdmin | stringConcatenatedWith |  |
+| index.js:14:12:14:21 | '/isAdmin' | CalleeFlexibleAccessPath | app.post |
+| index.js:14:12:14:21 | '/isAdmin' | InputAccessPathFromCallee |  |
+| index.js:14:12:14:21 | '/isAdmin' | InputArgumentIndex | 0 |
+| index.js:14:12:14:21 | '/isAdmin' | assignedToPropName |  |
+| index.js:14:12:14:21 | '/isAdmin' | calleeImports | express |
+| index.js:14:12:14:21 | '/isAdmin' | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:14:12:14:21 | '/isAdmin' | contextSurroundingFunctionParameters | () |
 | index.js:14:12:14:21 | '/isAdmin' | enclosingFunctionBody | app post /isAdmin req res console log req body isAdmin |
 | index.js:14:12:14:21 | '/isAdmin' | enclosingFunctionName | flowFromSourceToNotASink |
+| index.js:14:12:14:21 | '/isAdmin' | fileImports | express mongoose |
 | index.js:14:12:14:21 | '/isAdmin' | receiverName | app |
-| index.js:14:24:16:3 | (req, r ... n);\\n  } | argumentIndex | 1 |
-| index.js:14:24:16:3 | (req, r ... n);\\n  } | calleeAccessPath | express post |
-| index.js:14:24:16:3 | (req, r ... n);\\n  } | calleeAccessPathWithStructuralInfo | express instanceorreturn member post instanceorreturn |
-| index.js:14:24:16:3 | (req, r ... n);\\n  } | calleeApiName | express |
-| index.js:14:24:16:3 | (req, r ... n);\\n  } | calleeName | post |
+| index.js:14:12:14:21 | '/isAdmin' | stringConcatenatedWith |  |
+| index.js:14:24:16:3 | (req, r ... n);\\n  } | CalleeFlexibleAccessPath | app.post |
+| index.js:14:24:16:3 | (req, r ... n);\\n  } | InputAccessPathFromCallee |  |
+| index.js:14:24:16:3 | (req, r ... n);\\n  } | InputArgumentIndex | 1 |
+| index.js:14:24:16:3 | (req, r ... n);\\n  } | assignedToPropName |  |
+| index.js:14:24:16:3 | (req, r ... n);\\n  } | calleeImports | express |
+| index.js:14:24:16:3 | (req, r ... n);\\n  } | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:14:24:16:3 | (req, r ... n);\\n  } | contextSurroundingFunctionParameters | ()\n(req, res) |
 | index.js:14:24:16:3 | (req, r ... n);\\n  } | enclosingFunctionBody | app post /isAdmin req res console log req body isAdmin |
 | index.js:14:24:16:3 | (req, r ... n);\\n  } | enclosingFunctionName | flowFromSourceToNotASink |
+| index.js:14:24:16:3 | (req, r ... n);\\n  } | fileImports | express mongoose |
 | index.js:14:24:16:3 | (req, r ... n);\\n  } | receiverName | app |
-| index.js:15:17:15:32 | req.body.isAdmin | argumentIndex | 0 |
-| index.js:15:17:15:32 | req.body.isAdmin | calleeAccessPath |  |
-| index.js:15:17:15:32 | req.body.isAdmin | calleeAccessPathWithStructuralInfo |  |
-| index.js:15:17:15:32 | req.body.isAdmin | calleeApiName |  |
-| index.js:15:17:15:32 | req.body.isAdmin | calleeName | log |
+| index.js:14:24:16:3 | (req, r ... n);\\n  } | stringConcatenatedWith |  |
+| index.js:15:17:15:32 | req.body.isAdmin | CalleeFlexibleAccessPath | console.log |
+| index.js:15:17:15:32 | req.body.isAdmin | InputAccessPathFromCallee |  |
+| index.js:15:17:15:32 | req.body.isAdmin | InputArgumentIndex | 0 |
+| index.js:15:17:15:32 | req.body.isAdmin | assignedToPropName |  |
+| index.js:15:17:15:32 | req.body.isAdmin | calleeImports |  |
+| index.js:15:17:15:32 | req.body.isAdmin | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:15:17:15:32 | req.body.isAdmin | contextSurroundingFunctionParameters | ()\n(req, res) |
 | index.js:15:17:15:32 | req.body.isAdmin | enclosingFunctionBody | app post /isAdmin req res console log req body isAdmin |
 | index.js:15:17:15:32 | req.body.isAdmin | enclosingFunctionName | flowFromSourceToNotASink |
+| index.js:15:17:15:32 | req.body.isAdmin | fileImports | express mongoose |
 | index.js:15:17:15:32 | req.body.isAdmin | receiverName | console |
-| index.js:20:13:20:31 | { 'isAdmin': true } | argumentIndex | 0 |
-| index.js:20:13:20:31 | { 'isAdmin': true } | calleeAccessPath | mongoose model find |
-| index.js:20:13:20:31 | { 'isAdmin': true } | calleeAccessPathWithStructuralInfo | mongoose member model instanceorreturn member find instanceorreturn |
-| index.js:20:13:20:31 | { 'isAdmin': true } | calleeApiName | mongoose |
-| index.js:20:13:20:31 | { 'isAdmin': true } | calleeName | find |
+| index.js:15:17:15:32 | req.body.isAdmin | stringConcatenatedWith |  |
+| index.js:20:13:20:31 | { 'isAdmin': true } | CalleeFlexibleAccessPath | User.find |
+| index.js:20:13:20:31 | { 'isAdmin': true } | InputAccessPathFromCallee |  |
+| index.js:20:13:20:31 | { 'isAdmin': true } | InputArgumentIndex | 0 |
+| index.js:20:13:20:31 | { 'isAdmin': true } | assignedToPropName |  |
+| index.js:20:13:20:31 | { 'isAdmin': true } | calleeImports | mongoose |
+| index.js:20:13:20:31 | { 'isAdmin': true } | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:20:13:20:31 | { 'isAdmin': true } | contextSurroundingFunctionParameters | () |
 | index.js:20:13:20:31 | { 'isAdmin': true } | enclosingFunctionBody | User find isAdmin true |
 | index.js:20:13:20:31 | { 'isAdmin': true } | enclosingFunctionName | notFlowFromSource |
+| index.js:20:13:20:31 | { 'isAdmin': true } | fileImports | express mongoose |
 | index.js:20:13:20:31 | { 'isAdmin': true } | receiverName | User |
-| index.js:20:26:20:29 | true | argumentIndex |  |
-| index.js:20:26:20:29 | true | calleeAccessPath |  |
-| index.js:20:26:20:29 | true | calleeAccessPathWithStructuralInfo |  |
-| index.js:20:26:20:29 | true | calleeApiName |  |
-| index.js:20:26:20:29 | true | calleeName |  |
+| index.js:20:13:20:31 | { 'isAdmin': true } | stringConcatenatedWith |  |
+| index.js:20:26:20:29 | true | CalleeFlexibleAccessPath | User.find |
+| index.js:20:26:20:29 | true | InputAccessPathFromCallee | 0.isAdmin |
+| index.js:20:26:20:29 | true | InputArgumentIndex | 0 |
+| index.js:20:26:20:29 | true | assignedToPropName | isAdmin |
+| index.js:20:26:20:29 | true | calleeImports | mongoose |
+| index.js:20:26:20:29 | true | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:20:26:20:29 | true | contextSurroundingFunctionParameters | () |
 | index.js:20:26:20:29 | true | enclosingFunctionBody | User find isAdmin true |
 | index.js:20:26:20:29 | true | enclosingFunctionName | notFlowFromSource |
+| index.js:20:26:20:29 | true | fileImports | express mongoose |
 | index.js:20:26:20:29 | true | receiverName |  |
-| index.js:24:13:24:22 | "constant" | argumentIndex | 0 |
-| index.js:24:13:24:22 | "constant" | calleeAccessPath | mongoose model find |
-| index.js:24:13:24:22 | "constant" | calleeAccessPathWithStructuralInfo | mongoose member model instanceorreturn member find instanceorreturn |
-| index.js:24:13:24:22 | "constant" | calleeApiName | mongoose |
-| index.js:24:13:24:22 | "constant" | calleeName | find |
+| index.js:20:26:20:29 | true | stringConcatenatedWith |  |
+| index.js:24:13:24:22 | "constant" | CalleeFlexibleAccessPath | User.find |
+| index.js:24:13:24:22 | "constant" | InputAccessPathFromCallee |  |
+| index.js:24:13:24:22 | "constant" | InputArgumentIndex | 0 |
+| index.js:24:13:24:22 | "constant" | assignedToPropName |  |
+| index.js:24:13:24:22 | "constant" | calleeImports | mongoose |
+| index.js:24:13:24:22 | "constant" | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:24:13:24:22 | "constant" | contextSurroundingFunctionParameters | () |
 | index.js:24:13:24:22 | "constant" | enclosingFunctionBody | User find constant |
 | index.js:24:13:24:22 | "constant" | enclosingFunctionName | constantExpression |
+| index.js:24:13:24:22 | "constant" | fileImports | express mongoose |
 | index.js:24:13:24:22 | "constant" | receiverName | User |
-| index.js:28:13:28:28 | UNDEFINED_GLOBAL | argumentIndex | 0 |
-| index.js:28:13:28:28 | UNDEFINED_GLOBAL | calleeAccessPath | mongoose model find |
-| index.js:28:13:28:28 | UNDEFINED_GLOBAL | calleeAccessPathWithStructuralInfo | mongoose member model instanceorreturn member find instanceorreturn |
-| index.js:28:13:28:28 | UNDEFINED_GLOBAL | calleeApiName | mongoose |
-| index.js:28:13:28:28 | UNDEFINED_GLOBAL | calleeName | find |
+| index.js:24:13:24:22 | "constant" | stringConcatenatedWith |  |
+| index.js:28:13:28:28 | UNDEFINED_GLOBAL | CalleeFlexibleAccessPath | User.find |
+| index.js:28:13:28:28 | UNDEFINED_GLOBAL | InputAccessPathFromCallee |  |
+| index.js:28:13:28:28 | UNDEFINED_GLOBAL | InputArgumentIndex | 0 |
+| index.js:28:13:28:28 | UNDEFINED_GLOBAL | assignedToPropName |  |
+| index.js:28:13:28:28 | UNDEFINED_GLOBAL | calleeImports | mongoose |
+| index.js:28:13:28:28 | UNDEFINED_GLOBAL | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:28:13:28:28 | UNDEFINED_GLOBAL | contextSurroundingFunctionParameters | () |
 | index.js:28:13:28:28 | UNDEFINED_GLOBAL | enclosingFunctionBody | User find UNDEFINED_GLOBAL |
 | index.js:28:13:28:28 | UNDEFINED_GLOBAL | enclosingFunctionName | notConstantExpression |
+| index.js:28:13:28:28 | UNDEFINED_GLOBAL | fileImports | express mongoose |
 | index.js:28:13:28:28 | UNDEFINED_GLOBAL | receiverName | User |
-| index.js:32:15:32:24 | "someData" | argumentIndex | 0 |
-| index.js:32:15:32:24 | "someData" | calleeAccessPath |  |
-| index.js:32:15:32:24 | "someData" | calleeAccessPathWithStructuralInfo |  |
-| index.js:32:15:32:24 | "someData" | calleeApiName |  |
-| index.js:32:15:32:24 | "someData" | calleeName | log |
+| index.js:28:13:28:28 | UNDEFINED_GLOBAL | stringConcatenatedWith |  |
+| index.js:32:15:32:24 | "someData" | CalleeFlexibleAccessPath | console.log |
+| index.js:32:15:32:24 | "someData" | InputAccessPathFromCallee |  |
+| index.js:32:15:32:24 | "someData" | InputArgumentIndex | 0 |
+| index.js:32:15:32:24 | "someData" | assignedToPropName |  |
+| index.js:32:15:32:24 | "someData" | calleeImports |  |
+| index.js:32:15:32:24 | "someData" | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:32:15:32:24 | "someData" | contextSurroundingFunctionParameters | () |
 | index.js:32:15:32:24 | "someData" | enclosingFunctionBody | console log someData |
 | index.js:32:15:32:24 | "someData" | enclosingFunctionName | notASink |
+| index.js:32:15:32:24 | "someData" | fileImports | express mongoose |
 | index.js:32:15:32:24 | "someData" | receiverName | console |
-| index.js:36:20:36:22 | "a" | argumentIndex | 0 |
-| index.js:36:20:36:22 | "a" | calleeAccessPath |  |
-| index.js:36:20:36:22 | "a" | calleeAccessPathWithStructuralInfo |  |
-| index.js:36:20:36:22 | "a" | calleeApiName |  |
-| index.js:36:20:36:22 | "a" | calleeName | startsWith |
+| index.js:32:15:32:24 | "someData" | stringConcatenatedWith |  |
+| index.js:36:20:36:22 | "a" | CalleeFlexibleAccessPath | ?.startsWith |
+| index.js:36:20:36:22 | "a" | InputAccessPathFromCallee |  |
+| index.js:36:20:36:22 | "a" | InputArgumentIndex | 0 |
+| index.js:36:20:36:22 | "a" | assignedToPropName |  |
+| index.js:36:20:36:22 | "a" | calleeImports |  |
+| index.js:36:20:36:22 | "a" | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:36:20:36:22 | "a" | contextSurroundingFunctionParameters | () |
 | index.js:36:20:36:22 | "a" | enclosingFunctionBody | abc startsWith a |
 | index.js:36:20:36:22 | "a" | enclosingFunctionName | notASinkMultipleReasons |
+| index.js:36:20:36:22 | "a" | fileImports | express mongoose |
 | index.js:36:20:36:22 | "a" | receiverName |  |
-| index.js:41:13:68:61 | "a" + " ... " + "a" | argumentIndex | 0 |
-| index.js:41:13:68:61 | "a" + " ... " + "a" | calleeAccessPath | mongoose model find |
-| index.js:41:13:68:61 | "a" + " ... " + "a" | calleeAccessPathWithStructuralInfo | mongoose member model instanceorreturn member find instanceorreturn |
-| index.js:41:13:68:61 | "a" + " ... " + "a" | calleeApiName | mongoose |
-| index.js:41:13:68:61 | "a" + " ... " + "a" | calleeName | find |
+| index.js:36:20:36:22 | "a" | stringConcatenatedWith |  |
+| index.js:41:13:68:61 | "a" + " ... " + "a" | CalleeFlexibleAccessPath | User.find |
+| index.js:41:13:68:61 | "a" + " ... " + "a" | InputAccessPathFromCallee |  |
+| index.js:41:13:68:61 | "a" + " ... " + "a" | InputArgumentIndex | 0 |
+| index.js:41:13:68:61 | "a" + " ... " + "a" | assignedToPropName |  |
+| index.js:41:13:68:61 | "a" + " ... " + "a" | calleeImports | mongoose |
+| index.js:41:13:68:61 | "a" + " ... " + "a" | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:41:13:68:61 | "a" + " ... " + "a" | contextSurroundingFunctionParameters | () |
 | index.js:41:13:68:61 | "a" + " ... " + "a" | enclosingFunctionBody |  |
 | index.js:41:13:68:61 | "a" + " ... " + "a" | enclosingFunctionName | veryLongFunctionBody |
+| index.js:41:13:68:61 | "a" + " ... " + "a" | fileImports | express mongoose |
 | index.js:41:13:68:61 | "a" + " ... " + "a" | receiverName | User |
-| index.js:78:30:78:39 | "someData" | argumentIndex | 0 |
-| index.js:78:30:78:39 | "someData" | calleeAccessPath |  |
-| index.js:78:30:78:39 | "someData" | calleeAccessPathWithStructuralInfo |  |
-| index.js:78:30:78:39 | "someData" | calleeApiName |  |
-| index.js:78:30:78:39 | "someData" | calleeName | log |
+| index.js:41:13:68:61 | "a" + " ... " + "a" | stringConcatenatedWith |  |
+| index.js:78:30:78:39 | "someData" | CalleeFlexibleAccessPath | console.log |
+| index.js:78:30:78:39 | "someData" | InputAccessPathFromCallee |  |
+| index.js:78:30:78:39 | "someData" | InputArgumentIndex | 0 |
+| index.js:78:30:78:39 | "someData" | assignedToPropName |  |
+| index.js:78:30:78:39 | "someData" | calleeImports |  |
+| index.js:78:30:78:39 | "someData" | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:78:30:78:39 | "someData" | contextSurroundingFunctionParameters | () |
 | index.js:78:30:78:39 | "someData" | enclosingFunctionBody | console log someData |
 | index.js:78:30:78:39 | "someData" | enclosingFunctionName | identity#functionalargument |
+| index.js:78:30:78:39 | "someData" | fileImports | express mongoose |
 | index.js:78:30:78:39 | "someData" | receiverName | console |
-| index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | argumentIndex | 0 |
-| index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | calleeAccessPath |  |
-| index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | calleeAccessPathWithStructuralInfo |  |
-| index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | calleeApiName |  |
-| index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | calleeName | ajax |
+| index.js:78:30:78:39 | "someData" | stringConcatenatedWith |  |
+| index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | CalleeFlexibleAccessPath | $.ajax |
+| index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | InputAccessPathFromCallee |  |
+| index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | InputArgumentIndex | 0 |
+| index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | assignedToPropName |  |
+| index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | calleeImports |  |
+| index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | contextSurroundingFunctionParameters | (foo) |
 | index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | enclosingFunctionBody | foo $ ajax url foo bar |
 | index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | enclosingFunctionName | effectiveSinkAndNotASink |
+| index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | fileImports | express mongoose |
 | index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | receiverName | $ |
-| index.js:84:12:84:18 | foo.bar | argumentIndex |  |
-| index.js:84:12:84:18 | foo.bar | calleeAccessPath |  |
-| index.js:84:12:84:18 | foo.bar | calleeAccessPathWithStructuralInfo |  |
-| index.js:84:12:84:18 | foo.bar | calleeApiName |  |
-| index.js:84:12:84:18 | foo.bar | calleeName |  |
+| index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | stringConcatenatedWith |  |
+| index.js:84:12:84:18 | foo.bar | CalleeFlexibleAccessPath | $.ajax |
+| index.js:84:12:84:18 | foo.bar | InputAccessPathFromCallee | 0.url |
+| index.js:84:12:84:18 | foo.bar | InputArgumentIndex | 0 |
+| index.js:84:12:84:18 | foo.bar | assignedToPropName | url |
+| index.js:84:12:84:18 | foo.bar | calleeImports |  |
+| index.js:84:12:84:18 | foo.bar | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:84:12:84:18 | foo.bar | contextSurroundingFunctionParameters | (foo) |
 | index.js:84:12:84:18 | foo.bar | enclosingFunctionBody | foo $ ajax url foo bar |
 | index.js:84:12:84:18 | foo.bar | enclosingFunctionName | effectiveSinkAndNotASink |
+| index.js:84:12:84:18 | foo.bar | fileImports | express mongoose |
 | index.js:84:12:84:18 | foo.bar | receiverName |  |
+| index.js:84:12:84:18 | foo.bar | stringConcatenatedWith |  |

javascript/ql/experimental/adaptivethreatmodeling/test/endpoint_unit_tests/ExtractEndpointDataEvaluation.expected

@@ -276,171 +276,255 @@ endpoints
 | index.js:84:12:84:18 | foo.bar | Xss | notASinkReason | ClientRequest | string |
 | index.js:84:12:84:18 | foo.bar | Xss | sinkLabel | NotASink | string |
 tokenFeatures
-| index.js:1:25:1:33 | "express" | argumentIndex | 0 |
-| index.js:1:25:1:33 | "express" | calleeAccessPath |  |
-| index.js:1:25:1:33 | "express" | calleeAccessPathWithStructuralInfo |  |
-| index.js:1:25:1:33 | "express" | calleeApiName |  |
-| index.js:1:25:1:33 | "express" | calleeName | require |
+| index.js:1:25:1:33 | "express" | CalleeFlexibleAccessPath | require |
+| index.js:1:25:1:33 | "express" | InputAccessPathFromCallee |  |
+| index.js:1:25:1:33 | "express" | InputArgumentIndex | 0 |
+| index.js:1:25:1:33 | "express" | assignedToPropName |  |
+| index.js:1:25:1:33 | "express" | calleeImports |  |
+| index.js:1:25:1:33 | "express" | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:1:25:1:33 | "express" | contextSurroundingFunctionParameters |  |
 | index.js:1:25:1:33 | "express" | enclosingFunctionBody |  |
 | index.js:1:25:1:33 | "express" | enclosingFunctionName |  |
+| index.js:1:25:1:33 | "express" | fileImports | express mongoose |
 | index.js:1:25:1:33 | "express" | receiverName |  |
-| index.js:2:26:2:35 | 'mongoose' | argumentIndex | 0 |
-| index.js:2:26:2:35 | 'mongoose' | calleeAccessPath |  |
-| index.js:2:26:2:35 | 'mongoose' | calleeAccessPathWithStructuralInfo |  |
-| index.js:2:26:2:35 | 'mongoose' | calleeApiName |  |
-| index.js:2:26:2:35 | 'mongoose' | calleeName | require |
+| index.js:1:25:1:33 | "express" | stringConcatenatedWith |  |
+| index.js:2:26:2:35 | 'mongoose' | CalleeFlexibleAccessPath | require |
+| index.js:2:26:2:35 | 'mongoose' | InputAccessPathFromCallee |  |
+| index.js:2:26:2:35 | 'mongoose' | InputArgumentIndex | 0 |
+| index.js:2:26:2:35 | 'mongoose' | assignedToPropName |  |
+| index.js:2:26:2:35 | 'mongoose' | calleeImports |  |
+| index.js:2:26:2:35 | 'mongoose' | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:2:26:2:35 | 'mongoose' | contextSurroundingFunctionParameters |  |
 | index.js:2:26:2:35 | 'mongoose' | enclosingFunctionBody |  |
 | index.js:2:26:2:35 | 'mongoose' | enclosingFunctionName |  |
+| index.js:2:26:2:35 | 'mongoose' | fileImports | express mongoose |
 | index.js:2:26:2:35 | 'mongoose' | receiverName |  |
-| index.js:3:29:3:34 | 'User' | argumentIndex | 0 |
-| index.js:3:29:3:34 | 'User' | calleeAccessPath | mongoose model |
-| index.js:3:29:3:34 | 'User' | calleeAccessPathWithStructuralInfo | mongoose member model instanceorreturn |
-| index.js:3:29:3:34 | 'User' | calleeApiName | mongoose |
-| index.js:3:29:3:34 | 'User' | calleeName | model |
+| index.js:2:26:2:35 | 'mongoose' | stringConcatenatedWith |  |
+| index.js:3:29:3:34 | 'User' | CalleeFlexibleAccessPath | mongoose.model |
+| index.js:3:29:3:34 | 'User' | InputAccessPathFromCallee |  |
+| index.js:3:29:3:34 | 'User' | InputArgumentIndex | 0 |
+| index.js:3:29:3:34 | 'User' | assignedToPropName |  |
+| index.js:3:29:3:34 | 'User' | calleeImports | mongoose |
+| index.js:3:29:3:34 | 'User' | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:3:29:3:34 | 'User' | contextSurroundingFunctionParameters |  |
 | index.js:3:29:3:34 | 'User' | enclosingFunctionBody |  |
 | index.js:3:29:3:34 | 'User' | enclosingFunctionName |  |
+| index.js:3:29:3:34 | 'User' | fileImports | express mongoose |
 | index.js:3:29:3:34 | 'User' | receiverName | mongoose |
-| index.js:3:37:3:40 | null | argumentIndex | 1 |
-| index.js:3:37:3:40 | null | calleeAccessPath | mongoose model |
-| index.js:3:37:3:40 | null | calleeAccessPathWithStructuralInfo | mongoose member model instanceorreturn |
-| index.js:3:37:3:40 | null | calleeApiName | mongoose |
-| index.js:3:37:3:40 | null | calleeName | model |
+| index.js:3:29:3:34 | 'User' | stringConcatenatedWith |  |
+| index.js:3:37:3:40 | null | CalleeFlexibleAccessPath | mongoose.model |
+| index.js:3:37:3:40 | null | InputAccessPathFromCallee |  |
+| index.js:3:37:3:40 | null | InputArgumentIndex | 1 |
+| index.js:3:37:3:40 | null | assignedToPropName |  |
+| index.js:3:37:3:40 | null | calleeImports | mongoose |
+| index.js:3:37:3:40 | null | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:3:37:3:40 | null | contextSurroundingFunctionParameters |  |
 | index.js:3:37:3:40 | null | enclosingFunctionBody |  |
 | index.js:3:37:3:40 | null | enclosingFunctionName |  |
+| index.js:3:37:3:40 | null | fileImports | express mongoose |
 | index.js:3:37:3:40 | null | receiverName | mongoose |
-| index.js:8:12:8:21 | '/isAdmin' | argumentIndex | 0 |
-| index.js:8:12:8:21 | '/isAdmin' | calleeAccessPath | express post |
-| index.js:8:12:8:21 | '/isAdmin' | calleeAccessPathWithStructuralInfo | express instanceorreturn member post instanceorreturn |
-| index.js:8:12:8:21 | '/isAdmin' | calleeApiName | express |
-| index.js:8:12:8:21 | '/isAdmin' | calleeName | post |
+| index.js:3:37:3:40 | null | stringConcatenatedWith |  |
+| index.js:8:12:8:21 | '/isAdmin' | CalleeFlexibleAccessPath | app.post |
+| index.js:8:12:8:21 | '/isAdmin' | InputAccessPathFromCallee |  |
+| index.js:8:12:8:21 | '/isAdmin' | InputArgumentIndex | 0 |
+| index.js:8:12:8:21 | '/isAdmin' | assignedToPropName |  |
+| index.js:8:12:8:21 | '/isAdmin' | calleeImports | express |
+| index.js:8:12:8:21 | '/isAdmin' | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:8:12:8:21 | '/isAdmin' | contextSurroundingFunctionParameters | () |
 | index.js:8:12:8:21 | '/isAdmin' | enclosingFunctionBody | app post /isAdmin req res User find isAdmin req body isAdmin |
 | index.js:8:12:8:21 | '/isAdmin' | enclosingFunctionName | flowFromSourceToSink |
+| index.js:8:12:8:21 | '/isAdmin' | fileImports | express mongoose |
 | index.js:8:12:8:21 | '/isAdmin' | receiverName | app |
-| index.js:8:24:10:3 | (req, r ... });\\n  } | argumentIndex | 1 |
-| index.js:8:24:10:3 | (req, r ... });\\n  } | calleeAccessPath | express post |
-| index.js:8:24:10:3 | (req, r ... });\\n  } | calleeAccessPathWithStructuralInfo | express instanceorreturn member post instanceorreturn |
-| index.js:8:24:10:3 | (req, r ... });\\n  } | calleeApiName | express |
-| index.js:8:24:10:3 | (req, r ... });\\n  } | calleeName | post |
+| index.js:8:12:8:21 | '/isAdmin' | stringConcatenatedWith |  |
+| index.js:8:24:10:3 | (req, r ... });\\n  } | CalleeFlexibleAccessPath | app.post |
+| index.js:8:24:10:3 | (req, r ... });\\n  } | InputAccessPathFromCallee |  |
+| index.js:8:24:10:3 | (req, r ... });\\n  } | InputArgumentIndex | 1 |
+| index.js:8:24:10:3 | (req, r ... });\\n  } | assignedToPropName |  |
+| index.js:8:24:10:3 | (req, r ... });\\n  } | calleeImports | express |
+| index.js:8:24:10:3 | (req, r ... });\\n  } | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:8:24:10:3 | (req, r ... });\\n  } | contextSurroundingFunctionParameters | ()\n(req, res) |
 | index.js:8:24:10:3 | (req, r ... });\\n  } | enclosingFunctionBody | app post /isAdmin req res User find isAdmin req body isAdmin |
 | index.js:8:24:10:3 | (req, r ... });\\n  } | enclosingFunctionName | flowFromSourceToSink |
+| index.js:8:24:10:3 | (req, r ... });\\n  } | fileImports | express mongoose |
 | index.js:8:24:10:3 | (req, r ... });\\n  } | receiverName | app |
-| index.js:9:15:9:45 | { 'isAd ... Admin } | argumentIndex | 0 |
-| index.js:9:15:9:45 | { 'isAd ... Admin } | calleeAccessPath | mongoose model find |
-| index.js:9:15:9:45 | { 'isAd ... Admin } | calleeAccessPathWithStructuralInfo | mongoose member model instanceorreturn member find instanceorreturn |
-| index.js:9:15:9:45 | { 'isAd ... Admin } | calleeApiName | mongoose |
-| index.js:9:15:9:45 | { 'isAd ... Admin } | calleeName | find |
+| index.js:8:24:10:3 | (req, r ... });\\n  } | stringConcatenatedWith |  |
+| index.js:9:15:9:45 | { 'isAd ... Admin } | CalleeFlexibleAccessPath | User.find |
+| index.js:9:15:9:45 | { 'isAd ... Admin } | InputAccessPathFromCallee |  |
+| index.js:9:15:9:45 | { 'isAd ... Admin } | InputArgumentIndex | 0 |
+| index.js:9:15:9:45 | { 'isAd ... Admin } | assignedToPropName |  |
+| index.js:9:15:9:45 | { 'isAd ... Admin } | calleeImports | mongoose |
+| index.js:9:15:9:45 | { 'isAd ... Admin } | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:9:15:9:45 | { 'isAd ... Admin } | contextSurroundingFunctionParameters | ()\n(req, res) |
 | index.js:9:15:9:45 | { 'isAd ... Admin } | enclosingFunctionBody | app post /isAdmin req res User find isAdmin req body isAdmin |
 | index.js:9:15:9:45 | { 'isAd ... Admin } | enclosingFunctionName | flowFromSourceToSink |
+| index.js:9:15:9:45 | { 'isAd ... Admin } | fileImports | express mongoose |
 | index.js:9:15:9:45 | { 'isAd ... Admin } | receiverName | User |
-| index.js:9:28:9:43 | req.body.isAdmin | argumentIndex |  |
-| index.js:9:28:9:43 | req.body.isAdmin | calleeAccessPath |  |
-| index.js:9:28:9:43 | req.body.isAdmin | calleeAccessPathWithStructuralInfo |  |
-| index.js:9:28:9:43 | req.body.isAdmin | calleeApiName |  |
-| index.js:9:28:9:43 | req.body.isAdmin | calleeName |  |
+| index.js:9:15:9:45 | { 'isAd ... Admin } | stringConcatenatedWith |  |
+| index.js:9:28:9:43 | req.body.isAdmin | CalleeFlexibleAccessPath | User.find |
+| index.js:9:28:9:43 | req.body.isAdmin | InputAccessPathFromCallee | 0.isAdmin |
+| index.js:9:28:9:43 | req.body.isAdmin | InputArgumentIndex | 0 |
+| index.js:9:28:9:43 | req.body.isAdmin | assignedToPropName | isAdmin |
+| index.js:9:28:9:43 | req.body.isAdmin | calleeImports | mongoose |
+| index.js:9:28:9:43 | req.body.isAdmin | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:9:28:9:43 | req.body.isAdmin | contextSurroundingFunctionParameters | ()\n(req, res) |
 | index.js:9:28:9:43 | req.body.isAdmin | enclosingFunctionBody | app post /isAdmin req res User find isAdmin req body isAdmin |
 | index.js:9:28:9:43 | req.body.isAdmin | enclosingFunctionName | flowFromSourceToSink |
+| index.js:9:28:9:43 | req.body.isAdmin | fileImports | express mongoose |
 | index.js:9:28:9:43 | req.body.isAdmin | receiverName |  |
-| index.js:14:12:14:21 | '/isAdmin' | argumentIndex | 0 |
-| index.js:14:12:14:21 | '/isAdmin' | calleeAccessPath | express post |
-| index.js:14:12:14:21 | '/isAdmin' | calleeAccessPathWithStructuralInfo | express instanceorreturn member post instanceorreturn |
-| index.js:14:12:14:21 | '/isAdmin' | calleeApiName | express |
-| index.js:14:12:14:21 | '/isAdmin' | calleeName | post |
+| index.js:9:28:9:43 | req.body.isAdmin | stringConcatenatedWith |  |
+| index.js:14:12:14:21 | '/isAdmin' | CalleeFlexibleAccessPath | app.post |
+| index.js:14:12:14:21 | '/isAdmin' | InputAccessPathFromCallee |  |
+| index.js:14:12:14:21 | '/isAdmin' | InputArgumentIndex | 0 |
+| index.js:14:12:14:21 | '/isAdmin' | assignedToPropName |  |
+| index.js:14:12:14:21 | '/isAdmin' | calleeImports | express |
+| index.js:14:12:14:21 | '/isAdmin' | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:14:12:14:21 | '/isAdmin' | contextSurroundingFunctionParameters | () |
 | index.js:14:12:14:21 | '/isAdmin' | enclosingFunctionBody | app post /isAdmin req res console log req body isAdmin |
 | index.js:14:12:14:21 | '/isAdmin' | enclosingFunctionName | flowFromSourceToNotASink |
+| index.js:14:12:14:21 | '/isAdmin' | fileImports | express mongoose |
 | index.js:14:12:14:21 | '/isAdmin' | receiverName | app |
-| index.js:14:24:16:3 | (req, r ... n);\\n  } | argumentIndex | 1 |
-| index.js:14:24:16:3 | (req, r ... n);\\n  } | calleeAccessPath | express post |
-| index.js:14:24:16:3 | (req, r ... n);\\n  } | calleeAccessPathWithStructuralInfo | express instanceorreturn member post instanceorreturn |
-| index.js:14:24:16:3 | (req, r ... n);\\n  } | calleeApiName | express |
-| index.js:14:24:16:3 | (req, r ... n);\\n  } | calleeName | post |
+| index.js:14:12:14:21 | '/isAdmin' | stringConcatenatedWith |  |
+| index.js:14:24:16:3 | (req, r ... n);\\n  } | CalleeFlexibleAccessPath | app.post |
+| index.js:14:24:16:3 | (req, r ... n);\\n  } | InputAccessPathFromCallee |  |
+| index.js:14:24:16:3 | (req, r ... n);\\n  } | InputArgumentIndex | 1 |
+| index.js:14:24:16:3 | (req, r ... n);\\n  } | assignedToPropName |  |
+| index.js:14:24:16:3 | (req, r ... n);\\n  } | calleeImports | express |
+| index.js:14:24:16:3 | (req, r ... n);\\n  } | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:14:24:16:3 | (req, r ... n);\\n  } | contextSurroundingFunctionParameters | ()\n(req, res) |
 | index.js:14:24:16:3 | (req, r ... n);\\n  } | enclosingFunctionBody | app post /isAdmin req res console log req body isAdmin |
 | index.js:14:24:16:3 | (req, r ... n);\\n  } | enclosingFunctionName | flowFromSourceToNotASink |
+| index.js:14:24:16:3 | (req, r ... n);\\n  } | fileImports | express mongoose |
 | index.js:14:24:16:3 | (req, r ... n);\\n  } | receiverName | app |
-| index.js:15:17:15:32 | req.body.isAdmin | argumentIndex | 0 |
-| index.js:15:17:15:32 | req.body.isAdmin | calleeAccessPath |  |
-| index.js:15:17:15:32 | req.body.isAdmin | calleeAccessPathWithStructuralInfo |  |
-| index.js:15:17:15:32 | req.body.isAdmin | calleeApiName |  |
-| index.js:15:17:15:32 | req.body.isAdmin | calleeName | log |
+| index.js:14:24:16:3 | (req, r ... n);\\n  } | stringConcatenatedWith |  |
+| index.js:15:17:15:32 | req.body.isAdmin | CalleeFlexibleAccessPath | console.log |
+| index.js:15:17:15:32 | req.body.isAdmin | InputAccessPathFromCallee |  |
+| index.js:15:17:15:32 | req.body.isAdmin | InputArgumentIndex | 0 |
+| index.js:15:17:15:32 | req.body.isAdmin | assignedToPropName |  |
+| index.js:15:17:15:32 | req.body.isAdmin | calleeImports |  |
+| index.js:15:17:15:32 | req.body.isAdmin | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:15:17:15:32 | req.body.isAdmin | contextSurroundingFunctionParameters | ()\n(req, res) |
 | index.js:15:17:15:32 | req.body.isAdmin | enclosingFunctionBody | app post /isAdmin req res console log req body isAdmin |
 | index.js:15:17:15:32 | req.body.isAdmin | enclosingFunctionName | flowFromSourceToNotASink |
+| index.js:15:17:15:32 | req.body.isAdmin | fileImports | express mongoose |
 | index.js:15:17:15:32 | req.body.isAdmin | receiverName | console |
-| index.js:20:13:20:31 | { 'isAdmin': true } | argumentIndex | 0 |
-| index.js:20:13:20:31 | { 'isAdmin': true } | calleeAccessPath | mongoose model find |
-| index.js:20:13:20:31 | { 'isAdmin': true } | calleeAccessPathWithStructuralInfo | mongoose member model instanceorreturn member find instanceorreturn |
-| index.js:20:13:20:31 | { 'isAdmin': true } | calleeApiName | mongoose |
-| index.js:20:13:20:31 | { 'isAdmin': true } | calleeName | find |
+| index.js:15:17:15:32 | req.body.isAdmin | stringConcatenatedWith |  |
+| index.js:20:13:20:31 | { 'isAdmin': true } | CalleeFlexibleAccessPath | User.find |
+| index.js:20:13:20:31 | { 'isAdmin': true } | InputAccessPathFromCallee |  |
+| index.js:20:13:20:31 | { 'isAdmin': true } | InputArgumentIndex | 0 |
+| index.js:20:13:20:31 | { 'isAdmin': true } | assignedToPropName |  |
+| index.js:20:13:20:31 | { 'isAdmin': true } | calleeImports | mongoose |
+| index.js:20:13:20:31 | { 'isAdmin': true } | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:20:13:20:31 | { 'isAdmin': true } | contextSurroundingFunctionParameters | () |
 | index.js:20:13:20:31 | { 'isAdmin': true } | enclosingFunctionBody | User find isAdmin true |
 | index.js:20:13:20:31 | { 'isAdmin': true } | enclosingFunctionName | notFlowFromSource |
+| index.js:20:13:20:31 | { 'isAdmin': true } | fileImports | express mongoose |
 | index.js:20:13:20:31 | { 'isAdmin': true } | receiverName | User |
-| index.js:20:26:20:29 | true | argumentIndex |  |
-| index.js:20:26:20:29 | true | calleeAccessPath |  |
-| index.js:20:26:20:29 | true | calleeAccessPathWithStructuralInfo |  |
-| index.js:20:26:20:29 | true | calleeApiName |  |
-| index.js:20:26:20:29 | true | calleeName |  |
+| index.js:20:13:20:31 | { 'isAdmin': true } | stringConcatenatedWith |  |
+| index.js:20:26:20:29 | true | CalleeFlexibleAccessPath | User.find |
+| index.js:20:26:20:29 | true | InputAccessPathFromCallee | 0.isAdmin |
+| index.js:20:26:20:29 | true | InputArgumentIndex | 0 |
+| index.js:20:26:20:29 | true | assignedToPropName | isAdmin |
+| index.js:20:26:20:29 | true | calleeImports | mongoose |
+| index.js:20:26:20:29 | true | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:20:26:20:29 | true | contextSurroundingFunctionParameters | () |
 | index.js:20:26:20:29 | true | enclosingFunctionBody | User find isAdmin true |
 | index.js:20:26:20:29 | true | enclosingFunctionName | notFlowFromSource |
+| index.js:20:26:20:29 | true | fileImports | express mongoose |
 | index.js:20:26:20:29 | true | receiverName |  |
-| index.js:24:13:24:22 | "constant" | argumentIndex | 0 |
-| index.js:24:13:24:22 | "constant" | calleeAccessPath | mongoose model find |
-| index.js:24:13:24:22 | "constant" | calleeAccessPathWithStructuralInfo | mongoose member model instanceorreturn member find instanceorreturn |
-| index.js:24:13:24:22 | "constant" | calleeApiName | mongoose |
-| index.js:24:13:24:22 | "constant" | calleeName | find |
+| index.js:20:26:20:29 | true | stringConcatenatedWith |  |
+| index.js:24:13:24:22 | "constant" | CalleeFlexibleAccessPath | User.find |
+| index.js:24:13:24:22 | "constant" | InputAccessPathFromCallee |  |
+| index.js:24:13:24:22 | "constant" | InputArgumentIndex | 0 |
+| index.js:24:13:24:22 | "constant" | assignedToPropName |  |
+| index.js:24:13:24:22 | "constant" | calleeImports | mongoose |
+| index.js:24:13:24:22 | "constant" | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:24:13:24:22 | "constant" | contextSurroundingFunctionParameters | () |
 | index.js:24:13:24:22 | "constant" | enclosingFunctionBody | User find constant |
 | index.js:24:13:24:22 | "constant" | enclosingFunctionName | constantExpression |
+| index.js:24:13:24:22 | "constant" | fileImports | express mongoose |
 | index.js:24:13:24:22 | "constant" | receiverName | User |
-| index.js:28:13:28:28 | UNDEFINED_GLOBAL | argumentIndex | 0 |
-| index.js:28:13:28:28 | UNDEFINED_GLOBAL | calleeAccessPath | mongoose model find |
-| index.js:28:13:28:28 | UNDEFINED_GLOBAL | calleeAccessPathWithStructuralInfo | mongoose member model instanceorreturn member find instanceorreturn |
-| index.js:28:13:28:28 | UNDEFINED_GLOBAL | calleeApiName | mongoose |
-| index.js:28:13:28:28 | UNDEFINED_GLOBAL | calleeName | find |
+| index.js:24:13:24:22 | "constant" | stringConcatenatedWith |  |
+| index.js:28:13:28:28 | UNDEFINED_GLOBAL | CalleeFlexibleAccessPath | User.find |
+| index.js:28:13:28:28 | UNDEFINED_GLOBAL | InputAccessPathFromCallee |  |
+| index.js:28:13:28:28 | UNDEFINED_GLOBAL | InputArgumentIndex | 0 |
+| index.js:28:13:28:28 | UNDEFINED_GLOBAL | assignedToPropName |  |
+| index.js:28:13:28:28 | UNDEFINED_GLOBAL | calleeImports | mongoose |
+| index.js:28:13:28:28 | UNDEFINED_GLOBAL | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:28:13:28:28 | UNDEFINED_GLOBAL | contextSurroundingFunctionParameters | () |
 | index.js:28:13:28:28 | UNDEFINED_GLOBAL | enclosingFunctionBody | User find UNDEFINED_GLOBAL |
 | index.js:28:13:28:28 | UNDEFINED_GLOBAL | enclosingFunctionName | notConstantExpression |
+| index.js:28:13:28:28 | UNDEFINED_GLOBAL | fileImports | express mongoose |
 | index.js:28:13:28:28 | UNDEFINED_GLOBAL | receiverName | User |
-| index.js:32:15:32:24 | "someData" | argumentIndex | 0 |
-| index.js:32:15:32:24 | "someData" | calleeAccessPath |  |
-| index.js:32:15:32:24 | "someData" | calleeAccessPathWithStructuralInfo |  |
-| index.js:32:15:32:24 | "someData" | calleeApiName |  |
-| index.js:32:15:32:24 | "someData" | calleeName | log |
+| index.js:28:13:28:28 | UNDEFINED_GLOBAL | stringConcatenatedWith |  |
+| index.js:32:15:32:24 | "someData" | CalleeFlexibleAccessPath | console.log |
+| index.js:32:15:32:24 | "someData" | InputAccessPathFromCallee |  |
+| index.js:32:15:32:24 | "someData" | InputArgumentIndex | 0 |
+| index.js:32:15:32:24 | "someData" | assignedToPropName |  |
+| index.js:32:15:32:24 | "someData" | calleeImports |  |
+| index.js:32:15:32:24 | "someData" | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:32:15:32:24 | "someData" | contextSurroundingFunctionParameters | () |
 | index.js:32:15:32:24 | "someData" | enclosingFunctionBody | console log someData |
 | index.js:32:15:32:24 | "someData" | enclosingFunctionName | notASink |
+| index.js:32:15:32:24 | "someData" | fileImports | express mongoose |
 | index.js:32:15:32:24 | "someData" | receiverName | console |
-| index.js:36:20:36:22 | "a" | argumentIndex | 0 |
-| index.js:36:20:36:22 | "a" | calleeAccessPath |  |
-| index.js:36:20:36:22 | "a" | calleeAccessPathWithStructuralInfo |  |
-| index.js:36:20:36:22 | "a" | calleeApiName |  |
-| index.js:36:20:36:22 | "a" | calleeName | startsWith |
+| index.js:32:15:32:24 | "someData" | stringConcatenatedWith |  |
+| index.js:36:20:36:22 | "a" | CalleeFlexibleAccessPath | ?.startsWith |
+| index.js:36:20:36:22 | "a" | InputAccessPathFromCallee |  |
+| index.js:36:20:36:22 | "a" | InputArgumentIndex | 0 |
+| index.js:36:20:36:22 | "a" | assignedToPropName |  |
+| index.js:36:20:36:22 | "a" | calleeImports |  |
+| index.js:36:20:36:22 | "a" | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:36:20:36:22 | "a" | contextSurroundingFunctionParameters | () |
 | index.js:36:20:36:22 | "a" | enclosingFunctionBody | abc startsWith a |
 | index.js:36:20:36:22 | "a" | enclosingFunctionName | notASinkMultipleReasons |
+| index.js:36:20:36:22 | "a" | fileImports | express mongoose |
 | index.js:36:20:36:22 | "a" | receiverName |  |
-| index.js:41:13:68:61 | "a" + " ... " + "a" | argumentIndex | 0 |
-| index.js:41:13:68:61 | "a" + " ... " + "a" | calleeAccessPath | mongoose model find |
-| index.js:41:13:68:61 | "a" + " ... " + "a" | calleeAccessPathWithStructuralInfo | mongoose member model instanceorreturn member find instanceorreturn |
-| index.js:41:13:68:61 | "a" + " ... " + "a" | calleeApiName | mongoose |
-| index.js:41:13:68:61 | "a" + " ... " + "a" | calleeName | find |
+| index.js:36:20:36:22 | "a" | stringConcatenatedWith |  |
+| index.js:41:13:68:61 | "a" + " ... " + "a" | CalleeFlexibleAccessPath | User.find |
+| index.js:41:13:68:61 | "a" + " ... " + "a" | InputAccessPathFromCallee |  |
+| index.js:41:13:68:61 | "a" + " ... " + "a" | InputArgumentIndex | 0 |
+| index.js:41:13:68:61 | "a" + " ... " + "a" | assignedToPropName |  |
+| index.js:41:13:68:61 | "a" + " ... " + "a" | calleeImports | mongoose |
+| index.js:41:13:68:61 | "a" + " ... " + "a" | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:41:13:68:61 | "a" + " ... " + "a" | contextSurroundingFunctionParameters | () |
 | index.js:41:13:68:61 | "a" + " ... " + "a" | enclosingFunctionBody |  |
 | index.js:41:13:68:61 | "a" + " ... " + "a" | enclosingFunctionName | veryLongFunctionBody |
+| index.js:41:13:68:61 | "a" + " ... " + "a" | fileImports | express mongoose |
 | index.js:41:13:68:61 | "a" + " ... " + "a" | receiverName | User |
-| index.js:78:30:78:39 | "someData" | argumentIndex | 0 |
-| index.js:78:30:78:39 | "someData" | calleeAccessPath |  |
-| index.js:78:30:78:39 | "someData" | calleeAccessPathWithStructuralInfo |  |
-| index.js:78:30:78:39 | "someData" | calleeApiName |  |
-| index.js:78:30:78:39 | "someData" | calleeName | log |
+| index.js:41:13:68:61 | "a" + " ... " + "a" | stringConcatenatedWith |  |
+| index.js:78:30:78:39 | "someData" | CalleeFlexibleAccessPath | console.log |
+| index.js:78:30:78:39 | "someData" | InputAccessPathFromCallee |  |
+| index.js:78:30:78:39 | "someData" | InputArgumentIndex | 0 |
+| index.js:78:30:78:39 | "someData" | assignedToPropName |  |
+| index.js:78:30:78:39 | "someData" | calleeImports |  |
+| index.js:78:30:78:39 | "someData" | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:78:30:78:39 | "someData" | contextSurroundingFunctionParameters | () |
 | index.js:78:30:78:39 | "someData" | enclosingFunctionBody | console log someData |
 | index.js:78:30:78:39 | "someData" | enclosingFunctionName | identity#functionalargument |
+| index.js:78:30:78:39 | "someData" | fileImports | express mongoose |
 | index.js:78:30:78:39 | "someData" | receiverName | console |
-| index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | argumentIndex | 0 |
-| index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | calleeAccessPath |  |
-| index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | calleeAccessPathWithStructuralInfo |  |
-| index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | calleeApiName |  |
-| index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | calleeName | ajax |
+| index.js:78:30:78:39 | "someData" | stringConcatenatedWith |  |
+| index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | CalleeFlexibleAccessPath | $.ajax |
+| index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | InputAccessPathFromCallee |  |
+| index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | InputArgumentIndex | 0 |
+| index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | assignedToPropName |  |
+| index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | calleeImports |  |
+| index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | contextSurroundingFunctionParameters | (foo) |
 | index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | enclosingFunctionBody | foo $ ajax url foo bar |
 | index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | enclosingFunctionName | effectiveSinkAndNotASink |
+| index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | fileImports | express mongoose |
 | index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | receiverName | $ |
-| index.js:84:12:84:18 | foo.bar | argumentIndex |  |
-| index.js:84:12:84:18 | foo.bar | calleeAccessPath |  |
-| index.js:84:12:84:18 | foo.bar | calleeAccessPathWithStructuralInfo |  |
-| index.js:84:12:84:18 | foo.bar | calleeApiName |  |
-| index.js:84:12:84:18 | foo.bar | calleeName |  |
+| index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | stringConcatenatedWith |  |
+| index.js:84:12:84:18 | foo.bar | CalleeFlexibleAccessPath | $.ajax |
+| index.js:84:12:84:18 | foo.bar | InputAccessPathFromCallee | 0.url |
+| index.js:84:12:84:18 | foo.bar | InputArgumentIndex | 0 |
+| index.js:84:12:84:18 | foo.bar | assignedToPropName | url |
+| index.js:84:12:84:18 | foo.bar | calleeImports |  |
+| index.js:84:12:84:18 | foo.bar | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:84:12:84:18 | foo.bar | contextSurroundingFunctionParameters | (foo) |
 | index.js:84:12:84:18 | foo.bar | enclosingFunctionBody | foo $ ajax url foo bar |
 | index.js:84:12:84:18 | foo.bar | enclosingFunctionName | effectiveSinkAndNotASink |
+| index.js:84:12:84:18 | foo.bar | fileImports | express mongoose |
 | index.js:84:12:84:18 | foo.bar | receiverName |  |
+| index.js:84:12:84:18 | foo.bar | stringConcatenatedWith |  |

javascript/ql/experimental/adaptivethreatmodeling/test/endpoint_unit_tests/ExtractEndpointDataTraining.expected

@@ -76,51 +76,75 @@ endpoints
 | index.js:84:12:84:18 | foo.bar | Xss | notASinkReason | ClientRequest | string |
 | index.js:84:12:84:18 | foo.bar | Xss | sinkLabel | NotASink | string |
 tokenFeatures
-| index.js:9:15:9:45 | { 'isAd ... Admin } | argumentIndex | 0 |
-| index.js:9:15:9:45 | { 'isAd ... Admin } | calleeAccessPath | mongoose model find |
-| index.js:9:15:9:45 | { 'isAd ... Admin } | calleeAccessPathWithStructuralInfo | mongoose member model instanceorreturn member find instanceorreturn |
-| index.js:9:15:9:45 | { 'isAd ... Admin } | calleeApiName | mongoose |
-| index.js:9:15:9:45 | { 'isAd ... Admin } | calleeName | find |
+| index.js:9:15:9:45 | { 'isAd ... Admin } | CalleeFlexibleAccessPath | User.find |
+| index.js:9:15:9:45 | { 'isAd ... Admin } | InputAccessPathFromCallee |  |
+| index.js:9:15:9:45 | { 'isAd ... Admin } | InputArgumentIndex | 0 |
+| index.js:9:15:9:45 | { 'isAd ... Admin } | assignedToPropName |  |
+| index.js:9:15:9:45 | { 'isAd ... Admin } | calleeImports | mongoose |
+| index.js:9:15:9:45 | { 'isAd ... Admin } | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:9:15:9:45 | { 'isAd ... Admin } | contextSurroundingFunctionParameters | ()\n(req, res) |
 | index.js:9:15:9:45 | { 'isAd ... Admin } | enclosingFunctionBody | app post /isAdmin req res User find isAdmin req body isAdmin |
 | index.js:9:15:9:45 | { 'isAd ... Admin } | enclosingFunctionName | flowFromSourceToSink |
+| index.js:9:15:9:45 | { 'isAd ... Admin } | fileImports | express mongoose |
 | index.js:9:15:9:45 | { 'isAd ... Admin } | receiverName | User |
-| index.js:15:17:15:32 | req.body.isAdmin | argumentIndex | 0 |
-| index.js:15:17:15:32 | req.body.isAdmin | calleeAccessPath |  |
-| index.js:15:17:15:32 | req.body.isAdmin | calleeAccessPathWithStructuralInfo |  |
-| index.js:15:17:15:32 | req.body.isAdmin | calleeApiName |  |
-| index.js:15:17:15:32 | req.body.isAdmin | calleeName | log |
+| index.js:9:15:9:45 | { 'isAd ... Admin } | stringConcatenatedWith |  |
+| index.js:15:17:15:32 | req.body.isAdmin | CalleeFlexibleAccessPath | console.log |
+| index.js:15:17:15:32 | req.body.isAdmin | InputAccessPathFromCallee |  |
+| index.js:15:17:15:32 | req.body.isAdmin | InputArgumentIndex | 0 |
+| index.js:15:17:15:32 | req.body.isAdmin | assignedToPropName |  |
+| index.js:15:17:15:32 | req.body.isAdmin | calleeImports |  |
+| index.js:15:17:15:32 | req.body.isAdmin | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:15:17:15:32 | req.body.isAdmin | contextSurroundingFunctionParameters | ()\n(req, res) |
 | index.js:15:17:15:32 | req.body.isAdmin | enclosingFunctionBody | app post /isAdmin req res console log req body isAdmin |
 | index.js:15:17:15:32 | req.body.isAdmin | enclosingFunctionName | flowFromSourceToNotASink |
+| index.js:15:17:15:32 | req.body.isAdmin | fileImports | express mongoose |
 | index.js:15:17:15:32 | req.body.isAdmin | receiverName | console |
-| index.js:20:13:20:31 | { 'isAdmin': true } | argumentIndex | 0 |
-| index.js:20:13:20:31 | { 'isAdmin': true } | calleeAccessPath | mongoose model find |
-| index.js:20:13:20:31 | { 'isAdmin': true } | calleeAccessPathWithStructuralInfo | mongoose member model instanceorreturn member find instanceorreturn |
-| index.js:20:13:20:31 | { 'isAdmin': true } | calleeApiName | mongoose |
-| index.js:20:13:20:31 | { 'isAdmin': true } | calleeName | find |
+| index.js:15:17:15:32 | req.body.isAdmin | stringConcatenatedWith |  |
+| index.js:20:13:20:31 | { 'isAdmin': true } | CalleeFlexibleAccessPath | User.find |
+| index.js:20:13:20:31 | { 'isAdmin': true } | InputAccessPathFromCallee |  |
+| index.js:20:13:20:31 | { 'isAdmin': true } | InputArgumentIndex | 0 |
+| index.js:20:13:20:31 | { 'isAdmin': true } | assignedToPropName |  |
+| index.js:20:13:20:31 | { 'isAdmin': true } | calleeImports | mongoose |
+| index.js:20:13:20:31 | { 'isAdmin': true } | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:20:13:20:31 | { 'isAdmin': true } | contextSurroundingFunctionParameters | () |
 | index.js:20:13:20:31 | { 'isAdmin': true } | enclosingFunctionBody | User find isAdmin true |
 | index.js:20:13:20:31 | { 'isAdmin': true } | enclosingFunctionName | notFlowFromSource |
+| index.js:20:13:20:31 | { 'isAdmin': true } | fileImports | express mongoose |
 | index.js:20:13:20:31 | { 'isAdmin': true } | receiverName | User |
-| index.js:28:13:28:28 | UNDEFINED_GLOBAL | argumentIndex | 0 |
-| index.js:28:13:28:28 | UNDEFINED_GLOBAL | calleeAccessPath | mongoose model find |
-| index.js:28:13:28:28 | UNDEFINED_GLOBAL | calleeAccessPathWithStructuralInfo | mongoose member model instanceorreturn member find instanceorreturn |
-| index.js:28:13:28:28 | UNDEFINED_GLOBAL | calleeApiName | mongoose |
-| index.js:28:13:28:28 | UNDEFINED_GLOBAL | calleeName | find |
+| index.js:20:13:20:31 | { 'isAdmin': true } | stringConcatenatedWith |  |
+| index.js:28:13:28:28 | UNDEFINED_GLOBAL | CalleeFlexibleAccessPath | User.find |
+| index.js:28:13:28:28 | UNDEFINED_GLOBAL | InputAccessPathFromCallee |  |
+| index.js:28:13:28:28 | UNDEFINED_GLOBAL | InputArgumentIndex | 0 |
+| index.js:28:13:28:28 | UNDEFINED_GLOBAL | assignedToPropName |  |
+| index.js:28:13:28:28 | UNDEFINED_GLOBAL | calleeImports | mongoose |
+| index.js:28:13:28:28 | UNDEFINED_GLOBAL | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:28:13:28:28 | UNDEFINED_GLOBAL | contextSurroundingFunctionParameters | () |
 | index.js:28:13:28:28 | UNDEFINED_GLOBAL | enclosingFunctionBody | User find UNDEFINED_GLOBAL |
 | index.js:28:13:28:28 | UNDEFINED_GLOBAL | enclosingFunctionName | notConstantExpression |
+| index.js:28:13:28:28 | UNDEFINED_GLOBAL | fileImports | express mongoose |
 | index.js:28:13:28:28 | UNDEFINED_GLOBAL | receiverName | User |
-| index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | argumentIndex | 0 |
-| index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | calleeAccessPath |  |
-| index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | calleeAccessPathWithStructuralInfo |  |
-| index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | calleeApiName |  |
-| index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | calleeName | ajax |
+| index.js:28:13:28:28 | UNDEFINED_GLOBAL | stringConcatenatedWith |  |
+| index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | CalleeFlexibleAccessPath | $.ajax |
+| index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | InputAccessPathFromCallee |  |
+| index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | InputArgumentIndex | 0 |
+| index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | assignedToPropName |  |
+| index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | calleeImports |  |
+| index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | contextSurroundingFunctionParameters | (foo) |
 | index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | enclosingFunctionBody | foo $ ajax url foo bar |
 | index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | enclosingFunctionName | effectiveSinkAndNotASink |
+| index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | fileImports | express mongoose |
 | index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | receiverName | $ |
-| index.js:84:12:84:18 | foo.bar | argumentIndex |  |
-| index.js:84:12:84:18 | foo.bar | calleeAccessPath |  |
-| index.js:84:12:84:18 | foo.bar | calleeAccessPathWithStructuralInfo |  |
-| index.js:84:12:84:18 | foo.bar | calleeApiName |  |
-| index.js:84:12:84:18 | foo.bar | calleeName |  |
+| index.js:83:10:85:3 | {\\n    " ... ar,\\n  } | stringConcatenatedWith |  |
+| index.js:84:12:84:18 | foo.bar | CalleeFlexibleAccessPath | $.ajax |
+| index.js:84:12:84:18 | foo.bar | InputAccessPathFromCallee | 0.url |
+| index.js:84:12:84:18 | foo.bar | InputArgumentIndex | 0 |
+| index.js:84:12:84:18 | foo.bar | assignedToPropName | url |
+| index.js:84:12:84:18 | foo.bar | calleeImports |  |
+| index.js:84:12:84:18 | foo.bar | contextFunctionInterfaces | constantExpression()\neffectiveSinkAndNotASink(foo)\nflowFromSourceToNotASink()\nflowFromSourceToSink()\nidentity(x)\nnotASink()\nnotASinkMultipleReasons()\nnotConstantExpression()\nnotFlowFromSource()\nveryLongFunctionBody() |
+| index.js:84:12:84:18 | foo.bar | contextSurroundingFunctionParameters | (foo) |
 | index.js:84:12:84:18 | foo.bar | enclosingFunctionBody | foo $ ajax url foo bar |
 | index.js:84:12:84:18 | foo.bar | enclosingFunctionName | effectiveSinkAndNotASink |
+| index.js:84:12:84:18 | foo.bar | fileImports | express mongoose |
 | index.js:84:12:84:18 | foo.bar | receiverName |  |
+| index.js:84:12:84:18 | foo.bar | stringConcatenatedWith |  |

javascript/ql/experimental/adaptivethreatmodeling/test/generic_feature_testing/EmptyFeature.ql

@@ -0,0 +1,9 @@
+import javascript
+import experimental.adaptivethreatmodeling.EndpointFeatures
+import experimental.adaptivethreatmodeling.FeaturizationConfig
+import TestUtil
+
+// every feature must produce a value for at least one endpoint, otherwise the feature is completely broken, or a relevant test example is missing
+from EndpointFeature feature
+where forall(Endpoint endpoint | not exists(feature.getValue(endpoint)))
+select feature.getName()

javascript/ql/experimental/adaptivethreatmodeling/test/generic_feature_testing/FeatureValue.expected

@@ -0,0 +1,141 @@
+| test.html:2:61:2:68 | endpoint | CalleeFlexibleAccessPath | $event.target.files.item |
+| test.html:2:61:2:68 | endpoint | InputArgumentIndex | 0 |
+| test.html:2:61:2:68 | endpoint | contextFunctionInterfaces |  |
+| test.html:2:61:2:68 | endpoint | contextSurroundingFunctionParameters |  |
+| test.html:2:61:2:68 | endpoint | fileImports |  |
+| test.js:6:7:6:14 | endpoint | CalleeFlexibleAccessPath | f |
+| test.js:6:7:6:14 | endpoint | InputArgumentIndex | 0 |
+| test.js:6:7:6:14 | endpoint | calleeImports | ? lib3 |
+| test.js:6:7:6:14 | endpoint | contextFunctionInterfaces | f(?)\nfoo()\ng()\nm() |
+| test.js:6:7:6:14 | endpoint | contextSurroundingFunctionParameters | () |
+| test.js:6:7:6:14 | endpoint | enclosingFunctionBody | f endpoint 12 f p endpoint f p q endpoint o m endpoint o m p endpoint o m p q endpoint F endpoint o m m m endpoint f endpoint o x m endpoint o m x p m endpoint p endpoint foo bar baz endpoint foo bar endpoint f f o m endpoint |
+| test.js:6:7:6:14 | endpoint | enclosingFunctionName |  |
+| test.js:6:7:6:14 | endpoint | fileImports | foo lib1 lib2 lib3 |
+| test.js:7:11:7:18 | endpoint | CalleeFlexibleAccessPath | f |
+| test.js:7:11:7:18 | endpoint | InputAccessPathFromCallee | 0.p |
+| test.js:7:11:7:18 | endpoint | InputArgumentIndex | 0 |
+| test.js:7:11:7:18 | endpoint | assignedToPropName | p |
+| test.js:7:11:7:18 | endpoint | calleeImports | ? lib3 |
+| test.js:7:11:7:18 | endpoint | contextFunctionInterfaces | f(?)\nfoo()\ng()\nm() |
+| test.js:7:11:7:18 | endpoint | contextSurroundingFunctionParameters | () |
+| test.js:7:11:7:18 | endpoint | enclosingFunctionBody | f endpoint 12 f p endpoint f p q endpoint o m endpoint o m p endpoint o m p q endpoint F endpoint o m m m endpoint f endpoint o x m endpoint o m x p m endpoint p endpoint foo bar baz endpoint foo bar endpoint f f o m endpoint |
+| test.js:7:11:7:18 | endpoint | enclosingFunctionName |  |
+| test.js:7:11:7:18 | endpoint | fileImports | foo lib1 lib2 lib3 |
+| test.js:8:15:8:22 | endpoint | CalleeFlexibleAccessPath | f |
+| test.js:8:15:8:22 | endpoint | InputAccessPathFromCallee | 0.p.q |
+| test.js:8:15:8:22 | endpoint | InputArgumentIndex | 0 |
+| test.js:8:15:8:22 | endpoint | assignedToPropName | q |
+| test.js:8:15:8:22 | endpoint | calleeImports | ? lib3 |
+| test.js:8:15:8:22 | endpoint | contextFunctionInterfaces | f(?)\nfoo()\ng()\nm() |
+| test.js:8:15:8:22 | endpoint | contextSurroundingFunctionParameters | () |
+| test.js:8:15:8:22 | endpoint | enclosingFunctionBody | f endpoint 12 f p endpoint f p q endpoint o m endpoint o m p endpoint o m p q endpoint F endpoint o m m m endpoint f endpoint o x m endpoint o m x p m endpoint p endpoint foo bar baz endpoint foo bar endpoint f f o m endpoint |
+| test.js:8:15:8:22 | endpoint | enclosingFunctionName |  |
+| test.js:8:15:8:22 | endpoint | fileImports | foo lib1 lib2 lib3 |
+| test.js:9:9:9:16 | endpoint | CalleeFlexibleAccessPath | o.m |
+| test.js:9:9:9:16 | endpoint | InputArgumentIndex | 0 |
+| test.js:9:9:9:16 | endpoint | calleeImports | ? lib2 |
+| test.js:9:9:9:16 | endpoint | contextFunctionInterfaces | f(?)\nfoo()\ng()\nm() |
+| test.js:9:9:9:16 | endpoint | contextSurroundingFunctionParameters | () |
+| test.js:9:9:9:16 | endpoint | enclosingFunctionBody | f endpoint 12 f p endpoint f p q endpoint o m endpoint o m p endpoint o m p q endpoint F endpoint o m m m endpoint f endpoint o x m endpoint o m x p m endpoint p endpoint foo bar baz endpoint foo bar endpoint f f o m endpoint |
+| test.js:9:9:9:16 | endpoint | enclosingFunctionName |  |
+| test.js:9:9:9:16 | endpoint | fileImports | foo lib1 lib2 lib3 |
+| test.js:9:9:9:16 | endpoint | receiverName | o |
+| test.js:10:13:10:20 | endpoint | CalleeFlexibleAccessPath | o.m |
+| test.js:10:13:10:20 | endpoint | InputAccessPathFromCallee | 0.p |
+| test.js:10:13:10:20 | endpoint | InputArgumentIndex | 0 |
+| test.js:10:13:10:20 | endpoint | assignedToPropName | p |
+| test.js:10:13:10:20 | endpoint | calleeImports | ? lib2 |
+| test.js:10:13:10:20 | endpoint | contextFunctionInterfaces | f(?)\nfoo()\ng()\nm() |
+| test.js:10:13:10:20 | endpoint | contextSurroundingFunctionParameters | () |
+| test.js:10:13:10:20 | endpoint | enclosingFunctionBody | f endpoint 12 f p endpoint f p q endpoint o m endpoint o m p endpoint o m p q endpoint F endpoint o m m m endpoint f endpoint o x m endpoint o m x p m endpoint p endpoint foo bar baz endpoint foo bar endpoint f f o m endpoint |
+| test.js:10:13:10:20 | endpoint | enclosingFunctionName |  |
+| test.js:10:13:10:20 | endpoint | fileImports | foo lib1 lib2 lib3 |
+| test.js:11:17:11:24 | endpoint | CalleeFlexibleAccessPath | o.m |
+| test.js:11:17:11:24 | endpoint | InputAccessPathFromCallee | 0.p.q |
+| test.js:11:17:11:24 | endpoint | InputArgumentIndex | 0 |
+| test.js:11:17:11:24 | endpoint | assignedToPropName | q |
+| test.js:11:17:11:24 | endpoint | calleeImports | ? lib2 |
+| test.js:11:17:11:24 | endpoint | contextFunctionInterfaces | f(?)\nfoo()\ng()\nm() |
+| test.js:11:17:11:24 | endpoint | contextSurroundingFunctionParameters | () |
+| test.js:11:17:11:24 | endpoint | enclosingFunctionBody | f endpoint 12 f p endpoint f p q endpoint o m endpoint o m p endpoint o m p q endpoint F endpoint o m m m endpoint f endpoint o x m endpoint o m x p m endpoint p endpoint foo bar baz endpoint foo bar endpoint f f o m endpoint |
+| test.js:11:17:11:24 | endpoint | enclosingFunctionName |  |
+| test.js:11:17:11:24 | endpoint | fileImports | foo lib1 lib2 lib3 |
+| test.js:12:11:12:18 | endpoint | CalleeFlexibleAccessPath | F |
+| test.js:12:11:12:18 | endpoint | InputArgumentIndex | 0 |
+| test.js:12:11:12:18 | endpoint | calleeImports | lib1 |
+| test.js:12:11:12:18 | endpoint | contextFunctionInterfaces | f(?)\nfoo()\ng()\nm() |
+| test.js:12:11:12:18 | endpoint | contextSurroundingFunctionParameters | () |
+| test.js:12:11:12:18 | endpoint | enclosingFunctionBody | f endpoint 12 f p endpoint f p q endpoint o m endpoint o m p endpoint o m p q endpoint F endpoint o m m m endpoint f endpoint o x m endpoint o m x p m endpoint p endpoint foo bar baz endpoint foo bar endpoint f f o m endpoint |
+| test.js:12:11:12:18 | endpoint | enclosingFunctionName |  |
+| test.js:12:11:12:18 | endpoint | fileImports | foo lib1 lib2 lib3 |
+| test.js:13:17:13:24 | endpoint | CalleeFlexibleAccessPath | o.m().m().m |
+| test.js:13:17:13:24 | endpoint | InputArgumentIndex | 0 |
+| test.js:13:17:13:24 | endpoint | calleeImports | ? lib2 |
+| test.js:13:17:13:24 | endpoint | contextFunctionInterfaces | f(?)\nfoo()\ng()\nm() |
+| test.js:13:17:13:24 | endpoint | contextSurroundingFunctionParameters | () |
+| test.js:13:17:13:24 | endpoint | enclosingFunctionBody | f endpoint 12 f p endpoint f p q endpoint o m endpoint o m p endpoint o m p q endpoint F endpoint o m m m endpoint f endpoint o x m endpoint o m x p m endpoint p endpoint foo bar baz endpoint foo bar endpoint f f o m endpoint |
+| test.js:13:17:13:24 | endpoint | enclosingFunctionName |  |
+| test.js:13:17:13:24 | endpoint | fileImports | foo lib1 lib2 lib3 |
+| test.js:14:9:14:16 | endpoint | CalleeFlexibleAccessPath | f() |
+| test.js:14:9:14:16 | endpoint | InputArgumentIndex | 0 |
+| test.js:14:9:14:16 | endpoint | calleeImports | ? lib3 |
+| test.js:14:9:14:16 | endpoint | contextFunctionInterfaces | f(?)\nfoo()\ng()\nm() |
+| test.js:14:9:14:16 | endpoint | contextSurroundingFunctionParameters | () |
+| test.js:14:9:14:16 | endpoint | enclosingFunctionBody | f endpoint 12 f p endpoint f p q endpoint o m endpoint o m p endpoint o m p q endpoint F endpoint o m m m endpoint f endpoint o x m endpoint o m x p m endpoint p endpoint foo bar baz endpoint foo bar endpoint f f o m endpoint |
+| test.js:14:9:14:16 | endpoint | enclosingFunctionName |  |
+| test.js:14:9:14:16 | endpoint | fileImports | foo lib1 lib2 lib3 |
+| test.js:15:12:15:19 | endpoint | CalleeFlexibleAccessPath | o.?.m |
+| test.js:15:12:15:19 | endpoint | InputArgumentIndex | 0 |
+| test.js:15:12:15:19 | endpoint | calleeImports | ? lib2 |
+| test.js:15:12:15:19 | endpoint | contextFunctionInterfaces | f(?)\nfoo()\ng()\nm() |
+| test.js:15:12:15:19 | endpoint | contextSurroundingFunctionParameters | () |
+| test.js:15:12:15:19 | endpoint | enclosingFunctionBody | f endpoint 12 f p endpoint f p q endpoint o m endpoint o m p endpoint o m p q endpoint F endpoint o m m m endpoint f endpoint o x m endpoint o m x p m endpoint p endpoint foo bar baz endpoint foo bar endpoint f f o m endpoint |
+| test.js:15:12:15:19 | endpoint | enclosingFunctionName |  |
+| test.js:15:12:15:19 | endpoint | fileImports | foo lib1 lib2 lib3 |
+| test.js:16:16:16:23 | endpoint | CalleeFlexibleAccessPath | o.m.?.p.m |
+| test.js:16:16:16:23 | endpoint | InputArgumentIndex | 0 |
+| test.js:16:16:16:23 | endpoint | calleeImports | ? lib2 |
+| test.js:16:16:16:23 | endpoint | contextFunctionInterfaces | f(?)\nfoo()\ng()\nm() |
+| test.js:16:16:16:23 | endpoint | contextSurroundingFunctionParameters | () |
+| test.js:16:16:16:23 | endpoint | enclosingFunctionBody | f endpoint 12 f p endpoint f p q endpoint o m endpoint o m p endpoint o m p q endpoint F endpoint o m m m endpoint f endpoint o x m endpoint o m x p m endpoint p endpoint foo bar baz endpoint foo bar endpoint f f o m endpoint |
+| test.js:16:16:16:23 | endpoint | enclosingFunctionName |  |
+| test.js:16:16:16:23 | endpoint | fileImports | foo lib1 lib2 lib3 |
+| test.js:17:15:17:22 | endpoint | CalleeFlexibleAccessPath | (await p) |
+| test.js:17:15:17:22 | endpoint | InputArgumentIndex | 0 |
+| test.js:17:15:17:22 | endpoint | calleeImports | lib1 |
+| test.js:17:15:17:22 | endpoint | contextFunctionInterfaces | f(?)\nfoo()\ng()\nm() |
+| test.js:17:15:17:22 | endpoint | contextSurroundingFunctionParameters | () |
+| test.js:17:15:17:22 | endpoint | enclosingFunctionBody | f endpoint 12 f p endpoint f p q endpoint o m endpoint o m p endpoint o m p q endpoint F endpoint o m m m endpoint f endpoint o x m endpoint o m x p m endpoint p endpoint foo bar baz endpoint foo bar endpoint f f o m endpoint |
+| test.js:17:15:17:22 | endpoint | enclosingFunctionName |  |
+| test.js:17:15:17:22 | endpoint | fileImports | foo lib1 lib2 lib3 |
+| test.js:18:27:18:34 | endpoint | CalleeFlexibleAccessPath | import(!).bar.baz |
+| test.js:18:27:18:34 | endpoint | InputArgumentIndex | 0 |
+| test.js:18:27:18:34 | endpoint | calleeImports | foo |
+| test.js:18:27:18:34 | endpoint | contextFunctionInterfaces | f(?)\nfoo()\ng()\nm() |
+| test.js:18:27:18:34 | endpoint | contextSurroundingFunctionParameters | () |
+| test.js:18:27:18:34 | endpoint | enclosingFunctionBody | f endpoint 12 f p endpoint f p q endpoint o m endpoint o m p endpoint o m p q endpoint F endpoint o m m m endpoint f endpoint o x m endpoint o m x p m endpoint p endpoint foo bar baz endpoint foo bar endpoint f f o m endpoint |
+| test.js:18:27:18:34 | endpoint | enclosingFunctionName |  |
+| test.js:18:27:18:34 | endpoint | fileImports | foo lib1 lib2 lib3 |
+| test.js:20:13:20:20 | endpoint | CalleeFlexibleAccessPath | bar |
+| test.js:20:13:20:20 | endpoint | InputArgumentIndex | 0 |
+| test.js:20:13:20:20 | endpoint | calleeImports | lib1 |
+| test.js:20:13:20:20 | endpoint | contextFunctionInterfaces | f(?)\nfoo()\ng()\nm() |
+| test.js:20:13:20:20 | endpoint | contextSurroundingFunctionParameters | () |
+| test.js:20:13:20:20 | endpoint | enclosingFunctionBody | f endpoint 12 f p endpoint f p q endpoint o m endpoint o m p endpoint o m p q endpoint F endpoint o m m m endpoint f endpoint o x m endpoint o m x p m endpoint p endpoint foo bar baz endpoint foo bar endpoint f f o m endpoint |
+| test.js:20:13:20:20 | endpoint | enclosingFunctionName |  |
+| test.js:20:13:20:20 | endpoint | fileImports | foo lib1 lib2 lib3 |
+| test.js:22:21:22:28 | endpoint | InputArgumentIndex | 0 |
+| test.js:22:21:22:28 | endpoint | calleeImports | ? lib2 lib3 |
+| test.js:22:21:22:28 | endpoint | contextFunctionInterfaces | f(?)\nfoo()\ng()\nm() |
+| test.js:22:21:22:28 | endpoint | contextSurroundingFunctionParameters | () |
+| test.js:22:21:22:28 | endpoint | enclosingFunctionBody | f endpoint 12 f p endpoint f p q endpoint o m endpoint o m p endpoint o m p q endpoint F endpoint o m m m endpoint f endpoint o x m endpoint o m x p m endpoint p endpoint foo bar baz endpoint foo bar endpoint f f o m endpoint |
+| test.js:22:21:22:28 | endpoint | enclosingFunctionName |  |
+| test.js:22:21:22:28 | endpoint | fileImports | foo lib1 lib2 lib3 |
+| test.js:33:50:33:57 | endpoint | contextFunctionInterfaces | f(?)\nfoo()\ng()\nm() |
+| test.js:33:50:33:57 | endpoint | contextSurroundingFunctionParameters |  |
+| test.js:33:50:33:57 | endpoint | fileImports | foo lib1 lib2 lib3 |
+| test.js:33:50:33:57 | endpoint | stringConcatenatedWith | f() + '<a target="_blank" href="' -endpoint- '"></a>' |
+| test.js:35:18:35:25 | endpoint | contextFunctionInterfaces | f(?)\nfoo()\ng()\nm() |
+| test.js:35:18:35:25 | endpoint | contextSurroundingFunctionParameters |  |
+| test.js:35:18:35:25 | endpoint | fileImports | foo lib1 lib2 lib3 |
+| test.js:35:18:35:25 | endpoint | stringConcatenatedWith | 'foo' -endpoint- 'bar' |

javascript/ql/experimental/adaptivethreatmodeling/test/generic_feature_testing/FeatureValue.ql

@@ -0,0 +1,7 @@
+import javascript
+import experimental.adaptivethreatmodeling.EndpointFeatures
+import TestUtil
+
+// detailed output for the nearby tests
+from Endpoint endpoint, EndpointFeature feature
+select endpoint, feature.getName(), feature.getValue(endpoint)

javascript/ql/experimental/adaptivethreatmodeling/test/generic_feature_testing/NonFeaturizedEndpoint.ql

@@ -0,0 +1,8 @@
+import javascript
+import experimental.adaptivethreatmodeling.EndpointFeatures
+import TestUtil
+
+// every endpoint should have at least one feature value, otherwise the test source is likely malformed
+from Endpoint endpoint
+where not exists(EndpointFeature f | exists(f.getValue(endpoint)))
+select endpoint

javascript/ql/experimental/adaptivethreatmodeling/test/generic_feature_testing/NonFunctionalFeature.ql

@@ -0,0 +1,8 @@
+import javascript
+import experimental.adaptivethreatmodeling.EndpointFeatures
+import TestUtil
+
+// every feature must produce a single value for each endpoint that it computes a value for, per the contract of the `scoreEndpoints` HOP
+from Endpoint endpoint, EndpointFeature feature, int arity
+where arity = count(feature.getValue(endpoint)) and arity > 1
+select endpoint, feature.getName(), arity

javascript/ql/experimental/adaptivethreatmodeling/test/generic_feature_testing/TestUtil.qll

@@ -0,0 +1,6 @@
+import javascript
+import extraction.NoFeaturizationRestrictionsConfig
+
+class Endpoint extends DataFlow::Node {
+  Endpoint() { this.asExpr().(VarAccess).getName() = "endpoint" }
+}

javascript/ql/experimental/adaptivethreatmodeling/test/generic_feature_testing/test.html

@@ -0,0 +1,3 @@
+<div class="form-group">
+    <input (change)="restoreBackup($event.target.files.item(endpoint))" />
+</div>

javascript/ql/experimental/adaptivethreatmodeling/test/generic_feature_testing/test.js

@@ -0,0 +1,35 @@
+import { bar, F, p } from 'lib1';
+import * as o from 'lib2';
+const f = require('lib3');
+
+(async function () {
+    f(endpoint, 12);
+    f({p: endpoint});
+    f({p: {q: endpoint}});
+    o.m(endpoint);
+    o.m({p: endpoint});
+    o.m({p: {q: endpoint}});
+    new F(endpoint);
+    o.m().m().m(endpoint);
+    f()(endpoint);
+    o[x].m(endpoint);
+    o.m[x].p.m(endpoint);
+    (await p)(endpoint);
+    import("foo").bar.baz(endpoint);
+    function foo() {
+        bar(endpoint);
+    }
+    (f() ? f : o.m)(endpoint);
+});
+
+function f({ endpoint }) {}
+
+const g = async () => undefined;
+
+const o = { m: () => undefined }
+
+const url = f();
+
+const x = f() + "<a target=\"_blank\" href=\"" + endpoint + "\"></a>";
+
+const y = "foo"+ endpoint + "bar";

javascript/ql/lib/change-notes/2022-09-06-type-defs-squashed.md

@@ -0,0 +1,6 @@
+---
+category: minorAnalysis
+---
+
+- Several of the SQL and NoSQL library models have improved, leading to more results for the `js/sql-injection` query,
+  and in some cases the `js/missing-rate-limiting` query.

javascript/ql/lib/javascript.qll

@@ -99,6 +99,7 @@ import semmle.javascript.frameworks.JWT
 import semmle.javascript.frameworks.Handlebars
 import semmle.javascript.frameworks.History
 import semmle.javascript.frameworks.Immutable
+import semmle.javascript.frameworks.ImportGeneratedModels
 import semmle.javascript.frameworks.Knex
 import semmle.javascript.frameworks.LazyCache
 import semmle.javascript.frameworks.LdapJS

javascript/ql/lib/semmle/javascript/frameworks/Credentials.qll

@@ -34,10 +34,19 @@ abstract class CredentialsNode extends DataFlow::Node {
   abstract string getCredentialsKind();
 }
 
+/** Companion module to the `CredentialsExpr` class. */
+module CredentialsExpr {
+  /** Normalizes a credentials kind, mapping `username` to `user name`. */
+  bindingset[kind]
+  string normalizeKind(string kind) {
+    if kind = "username" then result = "user name" else result = kind
+  }
+}
+
 private class CredentialsFromModel extends CredentialsNode {
   string kind;
 
   CredentialsFromModel() { this = ModelOutput::getASinkNode("credentials[" + kind + "]").asSink() }
 
-  override string getCredentialsKind() { result = kind }
+  override string getCredentialsKind() { result = CredentialsExpr::normalizeKind(kind) }
 }

javascript/ql/lib/semmle/javascript/frameworks/ImportGeneratedModels.qll

@@ -0,0 +1,12 @@
+/**
+ * Imports all generated models.
+ */
+
+private import minimongo.Model
+private import mongodb.Model
+private import mssql.Model
+private import mysql.Model
+private import pg.Model
+private import sequelize.Model
+private import spanner.Model
+private import sqlite3.Model

javascript/ql/lib/semmle/javascript/frameworks/NoSQL.qll

@@ -17,64 +17,14 @@ module NoSql {
 deprecated module NoSQL = NoSql;
 
 /**
- * Gets a value that has been assigned to the "$where" property of an object that flows to `queryArg`.
- */
-private DataFlow::Node getADollarWhereProperty(API::Node queryArg) {
-  result = queryArg.getMember("$where").asSink()
-}
-
-/**
- * Provides classes modeling the MongoDB library.
+ * Provides classes modeling the `mongodb` and `mongoose` libraries.
  */
 private module MongoDB {
-  /**
-   * Gets an access to `mongodb.MongoClient` or a database.
-   *
-   * In Mongo version 2.x, a client and a database handle were the same concept, but in 3.x
-   * they were separated. To handle everything with a single model, we treat them as the same here.
-   */
-  private API::Node getAMongoClientOrDatabase() {
-    result = API::moduleImport("mongodb").getMember("MongoClient")
-    or
-    result = getAMongoClientOrDatabase().getMember("db").getReturn()
-    or
-    result = getAMongoClientOrDatabase().getMember("connect").getLastParameter().getParameter(1)
-  }
-
-  /** Gets a data flow node referring to a MongoDB collection. */
-  private API::Node getACollection() {
-    // A collection resulting from calling `Db.collection(...)`.
-    exists(API::Node collection |
-      collection = getAMongoClientOrDatabase().getMember("collection").getReturn()
-    |
-      result = collection
-      or
-      result = collection.getParameter(1).getParameter(0)
-    )
-    or
-    // note that this also covers `mongoose` models since they are subtypes of `mongodb.Collection`
-    result = API::Node::ofType("mongodb", "Collection")
-  }
-
-  /** A call to a MongoDB query method. */
-  private class QueryCall extends DatabaseAccess, API::CallNode {
-    int queryArgIdx;
-
-    QueryCall() {
-      exists(string method |
-        CollectionMethodSignatures::interpretsArgumentAsQuery(method, queryArgIdx) and
-        this = getACollection().getMember(method).getACall()
-      )
-    }
-
-    override DataFlow::Node getAQueryArgument() { result = this.getArgument(queryArgIdx) }
-
-    override DataFlow::Node getAResult() {
-      PromiseFlow::loadStep(this.getALocalUse(), result, Promises::valueProp())
-    }
-
-    DataFlow::Node getACodeOperator() {
-      result = getADollarWhereProperty(this.getParameter(queryArgIdx))
+  private class OldMongoDbAdapter extends ModelInput::TypeModelCsv {
+    override predicate row(string row) {
+      // In Mongo version 2.x, a client and a database handle were the same concept, but in 3.x
+      // they were separated. To handle everything with a single model, we treat them as the same here.
+      row = "mongodb;Db;mongodb;MongoClient;"
     }
   }
 
@@ -82,425 +32,58 @@ private module MongoDB {
    * An expression that is interpreted as a MongoDB query.
    */
   class Query extends NoSql::Query {
-    QueryCall qc;
+    private API::Node apiNode;
 
-    Query() { this = qc.getAQueryArgument() }
+    Query() { apiNode = ModelOutput::getASinkNode("mongodb.sink") and this = apiNode.asSink() }
 
-    override DataFlow::Node getACodeOperator() { result = qc.getACodeOperator() }
+    override DataFlow::Node getACodeOperator() { result = apiNode.getMember("$where").asSink() }
   }
 
-  /**
-   * Provides signatures for the Collection methods.
-   */
-  module CollectionMethodSignatures {
-    /**
-     * Holds if Collection method `name` interprets parameter `n` as a query.
-     */
-    predicate interpretsArgumentAsQuery(string name, int n) {
-      // FilterQuery
-      (
-        name = "aggregate" and n = 0
-        or
-        name = "count" and n = 0
-        or
-        name = "countDocuments" and n = 0
-        or
-        name = "deleteMany" and n = 0
-        or
-        name = "deleteOne" and n = 0
-        or
-        name = "distinct" and n = 1
-        or
-        name = "find" and n = 0
-        or
-        name = "findOne" and n = 0
-        or
-        name = "findOneAndDelete" and n = 0
-        or
-        name = "findOneAndRemove" and n = 0
-        or
-        name = "findOneAndReplace" and n = 0
-        or
-        name = "findOneAndUpdate" and n = 0
-        or
-        name = "remove" and n = 0
-        or
-        name = "replaceOne" and n = 0
-        or
-        name = "update" and n = 0
-        or
-        name = "updateMany" and n = 0
-        or
-        name = "updateOne" and n = 0
-      )
+  /** A call to a MongoDB query method. */
+  private class QueryCall extends DatabaseAccess, API::CallNode {
+    QueryCall() {
+      this = ModelOutput::getATypeNode("mongodb", "Collection").getAMember().getACall() and
+      not this.getCalleeName() = ["toString", "valueOf", "getLogger"]
       or
-      // UpdateQuery
-      (
-        name = "findOneAndUpdate" and n = 1
-        or
-        name = "update" and n = 1
-        or
-        name = "updateMany" and n = 1
-        or
-        name = "updateOne" and n = 1
-      )
-    }
-  }
-}
-
-/**
- * Provides classes modeling the Mongoose library.
- */
-private module Mongoose {
-  /**
-   * Gets an import of Mongoose.
-   */
-  API::Node getAMongooseInstance() { result = API::moduleImport("mongoose") }
-
-  /**
-   * Gets a reference to `mongoose.createConnection`.
-   */
-  API::Node createConnection() { result = getAMongooseInstance().getMember("createConnection") }
-
-  /**
-   * A Mongoose function.
-   */
-  abstract private class MongooseFunction extends API::Node {
-    /**
-     * Gets the API-graph node for the result from this function (if the function returns a `Query`).
-     */
-    abstract API::Node getQueryReturn();
-
-    /**
-     * Holds if this function returns a `Query` that evaluates to one or
-     * more Documents (`asArray` is false if it evaluates to a single
-     * Document).
-     */
-    abstract predicate returnsDocumentQuery(boolean asArray);
-
-    /**
-     * Gets an argument that this function interprets as a query.
-     */
-    abstract API::Node getQueryArgument();
-  }
-
-  /**
-   * Provides classes modeling the Mongoose Model class
-   */
-  module Model {
-    private class ModelFunction extends MongooseFunction {
-      string methodName;
-
-      ModelFunction() { this = getModelObject().getMember(methodName) }
-
-      override API::Node getQueryReturn() {
-        MethodSignatures::returnsQuery(methodName) and result = this.getReturn()
-      }
-
-      override predicate returnsDocumentQuery(boolean asArray) {
-        MethodSignatures::returnsDocumentQuery(methodName, asArray)
-      }
-
-      override API::Node getQueryArgument() {
-        exists(int n |
-          MethodSignatures::interpretsArgumentAsQuery(methodName, n) and
-          result = this.getParameter(n)
-        )
-      }
+      this =
+        ModelOutput::getATypeNode("mongodb", ["Db", "MongoClient"])
+            .getMember(["watch", "aggregate"])
+            .getACall()
     }
 
-    /**
-     * Gets a API-graph node referring to a Mongoose Model object.
-     */
-    private API::Node getModelObject() {
-      result = getAMongooseInstance().getMember("model").getReturn()
-      or
-      exists(API::Node conn | conn = createConnection().getReturn() |
-        result = conn.getMember("model").getReturn() or
-        result = conn.getMember("models").getAMember()
-      )
-      or
-      result = API::Node::ofType("mongoose", "Model")
+    override DataFlow::Node getAQueryArgument() {
+      result = [this.getAnArgument(), this.getOptionArgument(_, _)] and
+      result = ModelOutput::getASinkNode("mongodb.sink").asSink()
     }
 
-    /**
-     * Provides signatures for the Model methods.
-     */
-    module MethodSignatures {
-      /**
-       * Holds if Model method `name` interprets parameter `n` as a query.
-       */
-      predicate interpretsArgumentAsQuery(string name, int n) {
-        // implement lots of the MongoDB collection interface
-        MongoDB::CollectionMethodSignatures::interpretsArgumentAsQuery(name, n)
-        or
-        name = "find" + ["ById", "One"] + "AndUpdate" and n = 1
-        or
-        name in ["delete" + ["Many", "One"], "geoSearch", "remove", "replaceOne", "where"] and
-        n = 0
-        or
-        name in [
-            "find" + ["", "ById", "One"],
-            "find" + ["ById", "One"] + "And" + ["Delete", "Remove", "Update"],
-            "update" + ["", "Many", "One"]
-          ] and
-        n = 0
-      }
-
-      /**
-       * Holds if Model method `name` returns a Query.
-       */
-      predicate returnsQuery(string name) {
-        name =
-          [
-            "$where", "count", "findOne", "findOneAndDelete", "findOneAndRemove",
-            "findOneAndReplace", "findOneAndUpdate", "geosearch", "remove", "replaceOne", "update",
-            "updateMany", "countDocuments", "updateOne", "where", "deleteMany", "deleteOne", "find",
-            "findById", "findByIdAndDelete", "findByIdAndRemove", "findByIdAndUpdate"
-          ]
-      }
-
-      /**
-       * Holds if Document method `name` returns a query that results in
-       * one or more documents, the documents are wrapped in an array
-       * if `asArray` is true.
-       */
-      predicate returnsDocumentQuery(string name, boolean asArray) {
-        asArray = false and name = "findOne"
-        or
-        asArray = true and name = "find"
-      }
+    override DataFlow::Node getAResult() {
+      PromiseFlow::loadStep(this.getALocalUse(), result, Promises::valueProp())
     }
   }
 
-  /**
-   * Provides classes modeling the Mongoose Query class
-   */
-  module Query {
-    private class QueryFunction extends MongooseFunction {
-      string methodName;
-
-      QueryFunction() { this = getAMongooseQuery().getMember(methodName) }
-
-      override API::Node getQueryReturn() {
-        MethodSignatures::returnsQuery(methodName) and result = this.getReturn()
-      }
-
-      override predicate returnsDocumentQuery(boolean asArray) {
-        MethodSignatures::returnsDocumentQuery(methodName, asArray)
-      }
-
-      override API::Node getQueryArgument() {
-        exists(int n |
-          MethodSignatures::interpretsArgumentAsQuery(methodName, n) and
-          result = this.getParameter(n)
-        )
-      }
+  private class Insertion extends DatabaseAccess, API::CallNode {
+    Insertion() {
+      this = ModelOutput::getATypeNode("mongodb", "Collection").getAMember().getACall() and
+      this.getCalleeName().matches("insert%")
     }
 
-    private class NewQueryFunction extends MongooseFunction {
-      NewQueryFunction() { this = getAMongooseInstance().getMember("Query") }
+    override DataFlow::Node getAQueryArgument() { none() }
+  }
 
-      override API::Node getQueryReturn() { result = this.getInstance() }
-
-      override predicate returnsDocumentQuery(boolean asArray) { none() }
-
-      override API::Node getQueryArgument() { result = this.getParameter(2) }
-    }
-
-    /**
-     * Gets a data flow node referring to a Mongoose query object.
-     */
-    API::Node getAMongooseQuery() {
-      result = any(MongooseFunction f).getQueryReturn()
-      or
-      result = API::Node::ofType("mongoose", "Query")
-      or
-      result =
-        getAMongooseQuery()
-            .getMember(any(string name | MethodSignatures::returnsQuery(name)))
-            .getReturn()
-    }
-
-    /**
-     * Provides signatures for the Query methods.
-     */
-    module MethodSignatures {
-      /**
-       * Holds if Query method `name` interprets parameter `n` as a query.
-       */
-      predicate interpretsArgumentAsQuery(string name, int n) {
-        n = 0 and
-        name =
-          [
-            "and", "count", "findOneAndReplace", "findOneAndUpdate", "merge", "nor", "or", "remove",
-            "replaceOne", "setQuery", "setUpdate", "update", "countDocuments", "updateMany",
-            "updateOne", "where", "deleteMany", "deleteOne", "elemMatch", "find", "findOne",
-            "findOneAndDelete", "findOneAndRemove"
-          ]
-        or
-        n = 1 and
-        name = ["distinct", "findOneAndUpdate", "update", "updateMany", "updateOne"]
-      }
-
-      /**
-       * Holds if Query method `name` returns a Query.
-       */
-      predicate returnsQuery(string name) {
-        name =
-          [
-            "$where", "J", "comment", "count", "countDocuments", "distinct", "elemMatch", "equals",
-            "error", "estimatedDocumentCount", "exists", "explain", "all", "find", "findById",
-            "findOne", "findOneAndRemove", "findOneAndUpdate", "geometry", "get", "gt", "gte",
-            "hint", "and", "in", "intersects", "lean", "limit", "lt", "lte", "map", "map",
-            "maxDistance", "maxTimeMS", "batchsize", "maxscan", "mod", "ne", "near", "nearSphere",
-            "nin", "or", "orFail", "polygon", "populate", "box", "read", "readConcern", "regexp",
-            "remove", "select", "session", "set", "setOptions", "setQuery", "setUpdate", "center",
-            "size", "skip", "slaveOk", "slice", "snapshot", "sort", "update", "w", "where",
-            "within", "centerSphere", "wtimeout", "circle", "collation"
-          ]
-      }
-
-      /**
-       * Holds if Query method `name` returns a query that results in
-       * one or more documents, the documents are wrapped in an array
-       * if `asArray` is true.
-       */
-      predicate returnsDocumentQuery(string name, boolean asArray) {
-        asArray = false and name = "findOne"
-        or
-        asArray = true and name = "find"
-      }
-    }
+  private API::Node credentialsObject() {
+    result = API::Node::ofType("mongodb", "Auth")
+    or
+    result = API::Node::ofType("mongoose", "ConnectOptions")
   }
 
   /**
-   * Provides classes modeling the Mongoose Document class
-   */
-  module Document {
-    private class DocumentFunction extends MongooseFunction {
-      string methodName;
-
-      DocumentFunction() { this = getAMongooseDocument().getMember(methodName) }
-
-      override API::Node getQueryReturn() {
-        MethodSignatures::returnsQuery(methodName) and result = this.getReturn()
-      }
-
-      override predicate returnsDocumentQuery(boolean asArray) {
-        MethodSignatures::returnsDocumentQuery(methodName, asArray)
-      }
-
-      override API::Node getQueryArgument() {
-        exists(int n |
-          MethodSignatures::interpretsArgumentAsQuery(methodName, n) and
-          result = this.getParameter(n)
-        )
-      }
-    }
-
-    /**
-     * A Mongoose Document that is retrieved from the backing database.
-     */
-    class RetrievedDocument extends API::Node {
-      RetrievedDocument() {
-        exists(boolean asArray, API::Node param |
-          exists(MongooseFunction func |
-            func.returnsDocumentQuery(asArray) and
-            param = func.getLastParameter().getParameter(1)
-          )
-          or
-          exists(API::Node f |
-            f = Query::getAMongooseQuery().getMember("then") and
-            param = f.getParameter(0).getParameter(0)
-            or
-            f = Query::getAMongooseQuery().getMember("exec") and
-            param = f.getParameter(0).getParameter(1)
-          |
-            exists(DataFlow::MethodCallNode pred |
-              // limitation: look at the previous method call
-              Query::MethodSignatures::returnsDocumentQuery(pred.getMethodName(), asArray) and
-              pred.getAMethodCall() = f.getACall()
-            )
-          )
-        |
-          asArray = false and this = param
-          or
-          asArray = true and
-          // limitation: look for direct accesses
-          this = param.getUnknownMember()
-        )
-      }
-    }
-
-    /**
-     * Gets a data flow node referring to a Mongoose Document object.
-     */
-    private API::Node getAMongooseDocument() {
-      result instanceof RetrievedDocument
-      or
-      result = API::Node::ofType("mongoose", "Document")
-      or
-      result =
-        getAMongooseDocument()
-            .getMember(any(string name | MethodSignatures::returnsDocument(name)))
-            .getReturn()
-    }
-
-    private module MethodSignatures {
-      /**
-       * Holds if Document method `name` returns a Query.
-       */
-      predicate returnsQuery(string name) {
-        // Documents are subtypes of Models
-        Model::MethodSignatures::returnsQuery(name) or
-        name = "replaceOne" or
-        name = "update" or
-        name = "updateOne"
-      }
-
-      /**
-       * Holds if Document method `name` interprets parameter `n` as a query.
-       */
-      predicate interpretsArgumentAsQuery(string name, int n) {
-        // Documents are subtypes of Models
-        Model::MethodSignatures::interpretsArgumentAsQuery(name, n)
-        or
-        n = 0 and
-        (
-          name = "replaceOne" or
-          name = "update" or
-          name = "updateOne"
-        )
-      }
-
-      /**
-       * Holds if Document method `name` returns a query that results in
-       * one or more documents, the documents are wrapped in an array
-       * if `asArray` is true.
-       */
-      predicate returnsDocumentQuery(string name, boolean asArray) {
-        // Documents are subtypes of Models
-        Model::MethodSignatures::returnsDocumentQuery(name, asArray)
-      }
-
-      /**
-       * Holds if Document method `name` returns a Document.
-       */
-      predicate returnsDocument(string name) {
-        name = ["depopulate", "init", "populate", "overwrite"]
-      }
-    }
-  }
-
-  /**
-   * An expression passed to `mongoose.createConnection` to supply credentials.
+   * An expression passed to `mongodb` or `mongoose` to supply credentials.
    */
   class Credentials extends CredentialsNode {
     string kind;
 
     Credentials() {
-      exists(string prop | this = createConnection().getParameter(3).getMember(prop).asSink() |
+      exists(string prop | this = credentialsObject().getMember(prop).asSink() |
         prop = "user" and kind = "user name"
         or
         prop = "pass" and kind = "password"
@@ -509,123 +92,81 @@ private module Mongoose {
 
     override string getCredentialsKind() { result = kind }
   }
-
-  /**
-   * An expression that is interpreted as a (part of a) MongoDB query.
-   */
-  class MongoDBQueryPart extends NoSql::Query {
-    MongooseFunction f;
-
-    MongoDBQueryPart() { this = f.getQueryArgument().asSink() }
-
-    override DataFlow::Node getACodeOperator() {
-      result = getADollarWhereProperty(f.getQueryArgument())
-    }
-  }
-
-  /**
-   * An evaluation of a MongoDB query.
-   */
-  class ShorthandQueryEvaluation extends DatabaseAccess, DataFlow::InvokeNode {
-    MongooseFunction f;
-
-    ShorthandQueryEvaluation() {
-      this = f.getACall() and
-      // shorthand for execution: provide a callback
-      exists(f.getQueryReturn()) and
-      exists(this.getCallback(this.getNumArgument() - 1))
-    }
-
-    override DataFlow::Node getAQueryArgument() {
-      // NB: the complete information is not easily accessible for deeply chained calls
-      f.getQueryArgument().asSink() = result
-    }
-
-    override DataFlow::Node getAResult() {
-      result = this.getCallback(this.getNumArgument() - 1).getParameter(1)
-    }
-  }
-
-  class ExplicitQueryEvaluation extends DatabaseAccess, DataFlow::CallNode {
-    string member;
-
-    ExplicitQueryEvaluation() {
-      // explicit execution using a Query method call
-      member = ["exec", "then", "catch"] and
-      Query::getAMongooseQuery().getMember(member).getACall() = this
-    }
-
-    private int resultParamIndex() {
-      member = "then" and result = 0
-      or
-      member = "exec" and result = 1
-    }
-
-    override DataFlow::Node getAResult() {
-      result = this.getCallback(_).getParameter(this.resultParamIndex())
-    }
-
-    override DataFlow::Node getAQueryArgument() {
-      // NB: the complete information is not easily accessible for deeply chained calls
-      none()
-    }
-  }
 }
 
-/**
- * Provides classes modeling the Minimongo library.
- */
-private module Minimongo {
+private module Mongoose {
   /**
-   * Provides signatures for the Collection methods.
+   * A call that submits a mongoose query object to the database.
+   *
+   * Much of the mongoose API is for constructing intermdiate query objects, which are ultimately submitted by a call
+   * to `exec` or `then`. The inputs to such query constructors are treated as `mongodb.sink`s in the MaD model.
+   * Here we just mark the final call as a `DatabaseAccess`.
    */
-  module CollectionMethodSignatures {
-    /**
-     * Holds if Collection method `name` interprets parameter `queryArgIdx` as a query.
-     */
-    predicate interpretsArgumentAsQuery(string name, int queryArgIdx) {
-      // implements most of the MongoDB interface
-      MongoDB::CollectionMethodSignatures::interpretsArgumentAsQuery(name, queryArgIdx)
-    }
-  }
-
-  /** A call to a Minimongo query method. */
   private class QueryCall extends DatabaseAccess, API::CallNode {
-    int queryArgIdx;
-
     QueryCall() {
-      exists(string m |
-        this =
-          API::moduleImport("minimongo")
-              .getAMember()
-              .getReturn()
-              .getAMember()
-              .getMember(m)
-              .getACall() and
-        CollectionMethodSignatures::interpretsArgumentAsQuery(m, queryArgIdx)
-      )
+      this =
+        ModelOutput::getATypeNode("mongoose", "Query")
+            .getMember(["exec", "then", "catch"])
+            .getACall()
     }
 
-    override DataFlow::Node getAQueryArgument() { result = this.getArgument(queryArgIdx) }
+    override DataFlow::Node getAQueryArgument() { result = this.getReceiver() }
 
     override DataFlow::Node getAResult() {
-      PromiseFlow::loadStep(this.getALocalUse(), result, Promises::valueProp())
-    }
-
-    DataFlow::Node getACodeOperator() {
-      result = getADollarWhereProperty(this.getParameter(queryArgIdx))
+      this.getCalleeName() = ["then", "exec"] and
+      result = this.getReturn().getPromised().asSource()
+      or
+      this.getCalleeName() = "then" and
+      result = this.getParameter(0).getParameter(0).asSource()
+      or
+      this.getCalleeName() = "exec" and
+      result = this.getLastParameter().getParameter(1).asSource()
     }
   }
 
   /**
-   * An expression that is interpreted as a Minimongo query.
+   * A method call on `Document`, `Model` or `Query` returning a `Query` and taking a callback argument.
+   *
+   * This will execute the query immediately.
    */
-  class Query extends NoSql::Query {
-    QueryCall qc;
+  private class QueryWithCallback extends DatabaseAccess, API::CallNode {
+    QueryWithCallback() {
+      this =
+        ModelOutput::getATypeNode("mongoose", ["Document", "Model", "Query"])
+            .getAMember()
+            .getACall() and
+      this.getReturn() = ModelOutput::getATypeNode("mongoose", "Query") and
+      exists(this.getLastArgument().getABoundFunctionValue(_))
+    }
 
-    Query() { this = qc.getAQueryArgument() }
+    override DataFlow::Node getAQueryArgument() { result = this } // the call returns the query whose execution has started
 
-    override DataFlow::Node getACodeOperator() { result = qc.getACodeOperator() }
+    override DataFlow::Node getAResult() {
+      result = this.getLastParameter().getParameter(1).asSource()
+    }
+  }
+
+  /** An `await`'ed mongoose query, similar to calling `then()`. */
+  private class QueryAwait extends DatabaseAccess, DataFlow::ValueNode {
+    override AwaitExpr astNode;
+
+    QueryAwait() {
+      astNode.getOperand().flow() =
+        ModelOutput::getATypeNode("mongoose", "Query").getAValueReachableFromSource()
+    }
+
+    override DataFlow::Node getAQueryArgument() { result = astNode.getOperand().flow() }
+
+    override DataFlow::Node getAResult() { result = this }
+  }
+
+  class Insertion extends DatabaseAccess, API::CallNode {
+    Insertion() {
+      this = ModelOutput::getATypeNode("mongoose", "Model").getAMember().getACall() and
+      this.getCalleeName().matches("insert%")
+    }
+
+    override DataFlow::Node getAQueryArgument() { none() }
   }
 }
 
@@ -633,59 +174,17 @@ private module Minimongo {
  * Provides classes modeling the MarsDB library.
  */
 private module MarsDB {
-  private class MarsDBAccess extends DatabaseAccess, DataFlow::CallNode {
-    string method;
-
-    MarsDBAccess() {
-      this =
-        API::moduleImport("marsdb")
-            .getMember("Collection")
-            .getInstance()
-            .getMember(method)
-            .getACall()
+  // 'marsdb' has no typings and is archived.
+  // We just model is as a variant of 'mongoose'.
+  private class MongooseExtension extends ModelInput::TypeModelCsv {
+    override predicate row(string row) {
+      row =
+        [
+          "mongoose;Query;marsdb;;Member[Collection].Instance",
+          "mongoose;Model;marsdb;;Member[Collection].Instance",
+          "mongoose;Query;mongoose;Query;Member[sortFunc].ReturnValue",
+        ]
     }
-
-    string getMethod() { result = method }
-
-    override DataFlow::Node getAResult() {
-      PromiseFlow::loadStep(this.getALocalUse(), result, Promises::valueProp())
-    }
-
-    override DataFlow::Node getAQueryArgument() { none() }
-  }
-
-  /** A call to a MarsDB query method. */
-  private class QueryCall extends MarsDBAccess, API::CallNode {
-    int queryArgIdx;
-
-    QueryCall() {
-      exists(string m |
-        this.getMethod() = m and
-        // implements parts of the Minimongo interface
-        Minimongo::CollectionMethodSignatures::interpretsArgumentAsQuery(m, queryArgIdx)
-      )
-    }
-
-    override DataFlow::Node getAResult() {
-      PromiseFlow::loadStep(this.getALocalUse(), result, Promises::valueProp())
-    }
-
-    override DataFlow::Node getAQueryArgument() { result = this.getArgument(queryArgIdx) }
-
-    DataFlow::Node getACodeOperator() {
-      result = getADollarWhereProperty(this.getParameter(queryArgIdx))
-    }
-  }
-
-  /**
-   * An expression that is interpreted as a MarsDB query.
-   */
-  class Query extends NoSql::Query {
-    QueryCall qc;
-
-    Query() { this = qc.getAQueryArgument() }
-
-    override DataFlow::Node getACodeOperator() { result = qc.getACodeOperator() }
   }
 }
 

javascript/ql/lib/semmle/javascript/frameworks/SQL.qll

@@ -37,49 +37,13 @@ private module MySql {
   /** Gets the package name `mysql` or `mysql2`. */
   API::Node mysql() { result = API::moduleImport(moduleName()) }
 
-  /** Gets a reference to `mysql.createConnection`. */
-  API::Node createConnection() {
-    result = mysql().getMember(["createConnection", "createConnectionPromise"])
-  }
-
-  /** Gets a reference to `mysql.createPool`. */
-  API::Node createPool() { result = mysql().getMember(["createPool", "createPoolCluster"]) }
-
-  /** Gets a node that contains a MySQL pool created using `mysql.createPool()`. */
-  API::Node pool() {
-    result = createPool().getReturn()
-    or
-    result = pool().getMember("on").getReturn()
-    or
-    result = API::Node::ofType(moduleName(), ["Pool", "PoolCluster"])
-  }
-
-  /** Gets a data flow node that contains a freshly created MySQL connection instance. */
-  API::Node connection() {
-    result = createConnection().getReturn()
-    or
-    result = createConnection().getReturn().getPromised()
-    or
-    result = pool().getMember("getConnection").getParameter(0).getParameter(1)
-    or
-    result = pool().getMember("getConnection").getPromised()
-    or
-    exists(API::CallNode call |
-      call = pool().getMember("on").getACall() and
-      call.getArgument(0).getStringValue() = ["connection", "acquire", "release"] and
-      result = call.getParameter(1).getParameter(0)
-    )
-    or
-    result = API::Node::ofType(moduleName(), ["Connection", "PoolConnection"])
+  private API::Node connectionOrPool() {
+    result = API::Node::ofType(moduleName(), ["Connection", "Pool"])
   }
 
   /** A call to the MySql `query` method. */
   private class QueryCall extends DatabaseAccess, DataFlow::MethodCallNode {
-    QueryCall() {
-      exists(API::Node recv | recv = pool() or recv = connection() |
-        this = recv.getMember(["query", "execute"]).getACall()
-      )
-    }
+    QueryCall() { this = connectionOrPool().getMember(["query", "execute"]).getACall() }
 
     override DataFlow::Node getAResult() { result = this.getCallback(_).getParameter(1) }
 
@@ -96,20 +60,23 @@ private module MySql {
   /** A call to the `escape` or `escapeId` method that performs SQL sanitization. */
   class EscapingSanitizer extends SQL::SqlSanitizer instanceof API::CallNode {
     EscapingSanitizer() {
-      this = [mysql(), pool(), connection()].getMember(["escape", "escapeId"]).getACall() and
+      this = [mysql(), connectionOrPool()].getMember(["escape", "escapeId"]).getACall() and
       input = this.getArgument(0) and
       output = this
     }
   }
 
+  private API::Node connectionOptions() {
+    result = API::Node::ofType(moduleName(), "ConnectionOptions")
+  }
+
   /** An expression that is passed as user name or password to `mysql.createConnection`. */
   class Credentials extends CredentialsNode {
     string kind;
 
     Credentials() {
-      exists(API::Node callee, string prop |
-        callee in [createConnection(), createPool()] and
-        this = callee.getParameter(0).getMember(prop).asSink() and
+      exists(string prop |
+        this = connectionOptions().getMember(prop).asSink() and
         (
           prop = "user" and kind = "user name"
           or
@@ -126,61 +93,19 @@ private module MySql {
  * Provides classes modeling the PostgreSQL packages, such as `pg` and `pg-promise`.
  */
 private module Postgres {
-  API::Node pg() {
-    result = API::moduleImport("pg")
-    or
-    result = pgpMain().getMember("pg")
-  }
-
   /** Gets a reference to the `Client` constructor in the `pg` package, for example `require('pg').Client`. */
-  API::Node newClient() { result = pg().getMember("Client") }
-
-  /** Gets a freshly created Postgres client instance. */
-  API::Node client() {
-    result = newClient().getInstance()
+  API::Node clientOrPoolConstructor() {
+    result = API::Node::ofType("pg", ["ClientStatic", "PoolStatic"])
     or
-    // pool.connect(function(err, client) { ... })
-    result = pool().getMember("connect").getParameter(0).getParameter(1)
-    or
-    // await pool.connect()
-    result = pool().getMember("connect").getReturn().getPromised()
-    or
-    result = pgpConnection().getMember("client")
-    or
-    exists(API::CallNode call |
-      call = pool().getMember("on").getACall() and
-      call.getArgument(0).getStringValue() = ["connect", "acquire"] and
-      result = call.getParameter(1).getParameter(0)
-    )
-    or
-    result = client().getMember("on").getReturn()
-    or
-    result = API::Node::ofType("pg", ["Client", "PoolClient"])
-  }
-
-  /** Gets a constructor that when invoked constructs a new connection pool. */
-  API::Node newPool() {
-    // new require('pg').Pool()
-    result = pg().getMember("Pool")
-    or
-    // new require('pg-pool')
     result = API::moduleImport("pg-pool")
   }
 
-  /** Gets an API node that refers to a connection pool. */
-  API::Node pool() {
-    result = newPool().getInstance()
-    or
-    result = pgpDatabase().getMember("$pool")
-    or
-    result = pool().getMember("on").getReturn()
-    or
-    result = API::Node::ofType("pg", "Pool")
-  }
+  /** Gets a freshly created Postgres client instance. */
+  API::Node clientOrPool() { result = API::Node::ofType("pg", ["Client", "PoolClient", "Pool"]) }
 
   /** A call to the Postgres `query` method. */
   private class QueryCall extends DatabaseAccess, DataFlow::MethodCallNode {
-    QueryCall() { this = [client(), pool()].getMember("query").getACall() }
+    QueryCall() { this = clientOrPool().getMember(["execute", "query"]).getACall() }
 
     override DataFlow::Node getAResult() {
       this.getNumArgument() = 2 and
@@ -210,7 +135,7 @@ private module Postgres {
 
     Credentials() {
       exists(string prop |
-        this = [newClient(), newPool()].getParameter(0).getMember(prop).asSink()
+        this = clientOrPoolConstructor().getParameter(0).getMember(prop).asSink()
         or
         this = pgPromise().getParameter(0).getMember(prop).asSink()
       |
@@ -226,46 +151,8 @@ private module Postgres {
   /** Gets a node referring to the `pg-promise` library (which is not itself a Promise). */
   API::Node pgPromise() { result = API::moduleImport("pg-promise") }
 
-  /** Gets an initialized `pg-promise` library. */
-  API::Node pgpMain() {
-    result = pgPromise().getReturn()
-    or
-    result = API::Node::ofType("pg-promise", "IMain")
-  }
-
-  /** Gets a database from `pg-promise`. */
-  API::Node pgpDatabase() {
-    result = pgpMain().getReturn()
-    or
-    result = API::Node::ofType("pg-promise", "IDatabase")
-  }
-
-  /** Gets a connection created from a `pg-promise` database. */
-  API::Node pgpConnection() {
-    result = pgpDatabase().getMember("connect").getReturn().getPromised()
-    or
-    result = API::Node::ofType("pg-promise", "IConnected")
-  }
-
-  /** Gets a `pg-promise` task object. */
-  API::Node pgpTask() {
-    exists(API::Node taskMethod |
-      taskMethod = pgpObject().getMember(["task", "taskIf", "tx", "txIf"])
-    |
-      result = taskMethod.getParameter([0, 1]).getParameter(0)
-      or
-      result = taskMethod.getParameter(0).getMember("cnd").getParameter(0)
-    )
-    or
-    result = API::Node::ofType("pg-promise", "ITask")
-  }
-
   /** Gets a `pg-promise` object which supports querying (database, connection, or task). */
-  API::Node pgpObject() {
-    result = [pgpDatabase(), pgpConnection(), pgpTask()]
-    or
-    result = API::Node::ofType("pg-promise", "IBaseProtocol")
-  }
+  API::Node pgpObject() { result = API::Node::ofType("pg-promise", "IBaseProtocol") }
 
   private string pgpQueryMethodName() {
     result =
@@ -357,35 +244,13 @@ private module Postgres {
  * Provides classes modeling the `sqlite3` package.
  */
 private module Sqlite {
-  /** Gets a reference to the `sqlite3` module. */
-  API::Node sqlite() {
-    result = API::moduleImport("sqlite3")
-    or
-    result = sqlite().getMember("verbose").getReturn()
-  }
-
   /** Gets an expression that constructs or returns a Sqlite database instance. */
-  API::Node database() {
-    // new require('sqlite3').Database()
-    result = sqlite().getMember("Database").getInstance()
-    or
-    // chained call
-    result = getAChainingQueryCall()
-    or
-    result = API::Node::ofType("sqlite3", "Database")
-  }
-
-  /** Gets a call to a query method on a Sqlite database instance that returns the same instance. */
-  private API::Node getAChainingQueryCall() {
-    result = database().getMember(["all", "each", "exec", "get", "run"]).getReturn()
-  }
+  API::Node database() { result = API::Node::ofType("sqlite3", "Database") }
 
   /** A call to a Sqlite query method. */
   private class QueryCall extends DatabaseAccess, DataFlow::MethodCallNode {
     QueryCall() {
-      this = getAChainingQueryCall().asSource()
-      or
-      this = database().getMember("prepare").getACall()
+      this = database().getMember(["all", "each", "exec", "get", "prepare", "run"]).getACall()
     }
 
     override DataFlow::Node getAResult() {
@@ -409,31 +274,13 @@ private module MsSql {
   /** Gets a reference to the `mssql` module. */
   API::Node mssql() { result = API::moduleImport("mssql") }
 
-  /** Gets a node referring to an instance of the given class. */
-  API::Node mssqlClass(string name) {
-    result = mssql().getMember(name).getInstance()
-    or
-    result = API::Node::ofType("mssql", name)
+  /** Gets an API node corresponding to a type with a `query` or `batch` method. */
+  API::Node queryable() {
+    result = API::Node::ofType("mssql", ["Request", "ConnectionPool"]) or result = mssql()
   }
 
-  /** Gets an API node referring to a Request object. */
-  API::Node request() {
-    result = mssqlClass("Request")
-    or
-    result = request().getMember(["input", "replaceInput", "output", "replaceOutput"]).getReturn()
-    or
-    result = [transaction(), pool()].getMember("request").getReturn()
-  }
-
-  /** Gets an API node referring to a Transaction object. */
-  API::Node transaction() {
-    result = mssqlClass("Transaction")
-    or
-    result = pool().getMember("transaction").getReturn()
-  }
-
-  /** Gets a API node referring to a ConnectionPool object. */
-  API::Node pool() { result = mssqlClass("ConnectionPool") }
+  /** Gets an API node referring to a configuration object. */
+  API::Node config() { result = API::Node::ofType("mssql", "config") }
 
   /** A tagged template evaluated as a query. */
   private class QueryTemplateExpr extends DatabaseAccess, DataFlow::ValueNode, DataFlow::SourceNode {
@@ -455,7 +302,7 @@ private module MsSql {
 
   /** A call to a MsSql query method. */
   private class QueryCall extends DatabaseAccess, DataFlow::MethodCallNode {
-    QueryCall() { this = [mssql(), request()].getMember(["query", "batch"]).getACall() }
+    QueryCall() { this = queryable().getMember(["query", "batch"]).getACall() }
 
     override DataFlow::Node getAResult() {
       result = this.getCallback(1).getParameter(1)
@@ -489,13 +336,8 @@ private module MsSql {
     string kind;
 
     Credentials() {
-      exists(API::Node callee, string prop |
-        (
-          callee = mssql().getMember("connect")
-          or
-          callee = mssql().getMember("ConnectionPool")
-        ) and
-        this = callee.getParameter(0).getMember(prop).asSink() and
+      exists(string prop |
+        this = config().getMember(prop).asSink() and
         (
           prop = "user" and kind = "user name"
           or
@@ -512,34 +354,7 @@ private module MsSql {
  * Provides classes modeling the `sequelize` package.
  */
 private module Sequelize {
-  class SequelizeModel extends ModelInput::TypeModelCsv {
-    override predicate row(string row) {
-      // package1;type1;package2;type2;path
-      row =
-        [
-          "sequelize;;sequelize-typescript;;", //
-          "sequelize;Sequelize;sequelize;default;", //
-          "sequelize;Sequelize;sequelize;;Instance",
-          "sequelize;Sequelize;sequelize;;Member[Sequelize].Instance",
-        ]
-    }
-  }
-
-  class SequelizeSink extends ModelInput::SinkModelCsv {
-    override predicate row(string row) {
-      row =
-        [
-          "sequelize;Sequelize;Member[query].Argument[0];sql-injection",
-          "sequelize;Sequelize;Member[query].Argument[0].Member[query];sql-injection",
-          "sequelize;;Member[literal,asIs].Argument[0];sql-injection",
-          "sequelize;;Argument[1];credentials[user name]",
-          "sequelize;;Argument[2];credentials[password]",
-          "sequelize;;Argument[0..].Member[username];credentials[user name]",
-          "sequelize;;Argument[0..].Member[password];credentials[password]"
-        ]
-    }
-  }
-
+  // Note: the sinks are specified directly in the MaD model
   class SequelizeSource extends ModelInput::SourceModelCsv {
     override predicate row(string row) {
       row = "sequelize;Sequelize;Member[query].ReturnValue.Awaited;database-access-result"
@@ -548,31 +363,6 @@ private module Sequelize {
 }
 
 private module SpannerCsv {
-  class SpannerTypes extends ModelInput::TypeModelCsv {
-    override predicate row(string row) {
-      // package1; type1; package2; type2; path
-      row =
-        [
-          "@google-cloud/spanner;;@google-cloud/spanner;;Member[Spanner]",
-          "@google-cloud/spanner;Database;@google-cloud/spanner;;ReturnValue.Member[instance].ReturnValue.Member[database].ReturnValue",
-          "@google-cloud/spanner;v1.SpannerClient;@google-cloud/spanner;;Member[v1].Member[SpannerClient].Instance",
-          "@google-cloud/spanner;Transaction;@google-cloud/spanner;Database;Member[runTransaction,runTransactionAsync,getTransaction].Argument[0..1].Parameter[1]",
-          "@google-cloud/spanner;Transaction;@google-cloud/spanner;Database;Member[getTransaction].ReturnValue.Awaited",
-          "@google-cloud/spanner;Snapshot;@google-cloud/spanner;Database;Member[getSnapshot].Argument[0..1].Parameter[1]",
-          "@google-cloud/spanner;Snapshot;@google-cloud/spanner;Database;Member[getSnapshot].ReturnValue.Awaited",
-          "@google-cloud/spanner;BatchTransaction;@google-cloud/spanner;Database;Member[batchTransaction].ReturnValue",
-          "@google-cloud/spanner;BatchTransaction;@google-cloud/spanner;Database;Member[createBatchTransaction].ReturnValue.Awaited",
-          "@google-cloud/spanner;~SqlExecutorDirect;@google-cloud/spanner;Database;Member[run,runPartitionedUpdate,runStream]",
-          "@google-cloud/spanner;~SqlExecutorDirect;@google-cloud/spanner;Transaction;Member[run,runStream,runUpdate]",
-          "@google-cloud/spanner;~SqlExecutorDirect;@google-cloud/spanner;BatchTransaction;Member[createQueryPartitions]",
-          "@google-cloud/spanner;~SpannerObject;@google-cloud/spanner;v1.SpannerClient;",
-          "@google-cloud/spanner;~SpannerObject;@google-cloud/spanner;Database;",
-          "@google-cloud/spanner;~SpannerObject;@google-cloud/spanner;Transaction;",
-          "@google-cloud/spanner;~SpannerObject;@google-cloud/spanner;Snapshot;",
-        ]
-    }
-  }
-
   class SpannerSinks extends ModelInput::SinkModelCsv {
     override predicate row(string row) {
       // package; type; path; kind
@@ -582,7 +372,6 @@ private module SpannerCsv {
           "@google-cloud/spanner;~SqlExecutorDirect;Argument[0].Member[sql];sql-injection",
           "@google-cloud/spanner;Transaction;Member[batchUpdate].Argument[0];sql-injection",
           "@google-cloud/spanner;Transaction;Member[batchUpdate].Argument[0].ArrayElement.Member[sql];sql-injection",
-          "@google-cloud/spanner;v1.SpannerClient;Member[executeSql,executeStreamingSql].Argument[0].Member[sql];sql-injection",
         ]
     }
   }

javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModels.qll

@@ -502,7 +502,12 @@ private API::Node getNodeFromSubPath(API::Node base, AccessPath subPath, int n)
   result =
     getNodeFromSubPath(getNodeFromSubPath(base, subPath, n - 1), getSubPathAt(subPath, n - 1))
   or
-  typeStep(getNodeFromSubPath(base, subPath, n), result)
+  typeStep(getNodeFromSubPath(base, subPath, n), result) and
+  // Only apply type-steps strictly between the steps on the sub path, not before and after.
+  // Steps before/after lead to unnecessary transitive edges, which the user of the sub-path
+  // will themselves find by following type-steps.
+  n > 0 and
+  n < subPath.getNumToken()
 }
 
 /**

javascript/ql/lib/semmle/javascript/frameworks/minimongo/Model.qll

@@ -0,0 +1,86 @@
+/** Generated model file */
+
+private import javascript
+
+private class Types extends ModelInput::TypeModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "minimongo/IndexedDb;IndexedDbCollection;minimongo/IndexedDb;IndexedDbCollectionStatic;Instance", //
+        "minimongo/IndexedDb;IndexedDbCollection;minimongo/lib/IndexedDb;default;Member[collections].AnyMember", //
+        "minimongo/MemoryDb;Collection;minimongo/MemoryDb;CollectionStatic;Instance", //
+        "minimongo/MemoryDb;Collection;minimongo/lib/MemoryDb;default;Member[collections].AnyMember", //
+        "minimongo/RemoteDb;Collection;minimongo/RemoteDb;CollectionStatic;Instance", //
+        "minimongo/RemoteDb;Collection;minimongo/lib/RemoteDb;default;Member[collections].AnyMember", //
+        "minimongo/ReplicatingDb;Collection;minimongo/ReplicatingDb;CollectionStatic;Instance", //
+        "minimongo/ReplicatingDb;Collection;minimongo/lib/ReplicatingDb;default;Member[collections].AnyMember", //
+        "minimongo/lib/HybridDb;default;minimongo/lib/HybridDb;defaultStatic;Instance", //
+        "minimongo/lib/HybridDb;defaultStatic;minimongo/lib/HybridDb;;Member[default]", //
+        "minimongo/lib/HybridDb;defaultStatic;minimongo;;Member[HybridDb]", //
+        "minimongo/lib/IndexedDb;default;minimongo/lib/IndexedDb;defaultStatic;Instance", //
+        "minimongo/lib/IndexedDb;default;minimongo;;Member[utils].Member[autoselectLocalDb].ReturnValue", //
+        "minimongo/lib/IndexedDb;defaultStatic;minimongo/lib/IndexedDb;;Member[default]", //
+        "minimongo/lib/IndexedDb;defaultStatic;minimongo;;Member[IndexedDb]", //
+        "minimongo/lib/LocalStorageDb;default;minimongo/lib/LocalStorageDb;defaultStatic;Instance", //
+        "minimongo/lib/LocalStorageDb;default;minimongo;;Member[utils].Member[autoselectLocalDb].ReturnValue", //
+        "minimongo/lib/LocalStorageDb;defaultStatic;minimongo/lib/LocalStorageDb;;Member[default]", //
+        "minimongo/lib/LocalStorageDb;defaultStatic;minimongo;;Member[LocalStorageDb]", //
+        "minimongo/lib/MemoryDb;default;minimongo/lib/MemoryDb;defaultStatic;Instance", //
+        "minimongo/lib/MemoryDb;default;minimongo;;Member[utils].Member[autoselectLocalDb].ReturnValue", //
+        "minimongo/lib/MemoryDb;defaultStatic;minimongo/lib/MemoryDb;;Member[default]", //
+        "minimongo/lib/MemoryDb;defaultStatic;minimongo;;Member[MemoryDb]", //
+        "minimongo/lib/RemoteDb;default;minimongo/lib/RemoteDb;defaultStatic;Instance", //
+        "minimongo/lib/RemoteDb;defaultStatic;minimongo/lib/RemoteDb;;Member[default]", //
+        "minimongo/lib/RemoteDb;defaultStatic;minimongo;;Member[RemoteDb]", //
+        "minimongo/lib/ReplicatingDb;default;minimongo/lib/ReplicatingDb;defaultStatic;Instance", //
+        "minimongo/lib/ReplicatingDb;defaultStatic;minimongo/lib/ReplicatingDb;;Member[default]", //
+        "minimongo/lib/ReplicatingDb;defaultStatic;minimongo;;Member[ReplicatingDb]", //
+        "minimongo/lib/WebSQLDb;default;minimongo/lib/WebSQLDb;defaultStatic;Instance", //
+        "minimongo/lib/WebSQLDb;default;minimongo;;Member[utils].Member[autoselectLocalDb].ReturnValue", //
+        "minimongo/lib/WebSQLDb;defaultStatic;minimongo/lib/WebSQLDb;;Member[default]", //
+        "minimongo/lib/WebSQLDb;defaultStatic;minimongo;;Member[WebSQLDb]", //
+        "minimongo;HybridCollection;minimongo/lib/HybridDb;HybridCollection;", //
+        "minimongo;HybridCollection;minimongo/lib/HybridDb;default;Member[collections].AnyMember", //
+        "minimongo;HybridCollection;minimongo;HybridCollectionStatic;Instance", //
+        "minimongo;HybridCollectionStatic;minimongo/lib/HybridDb;;Member[HybridCollection]", //
+        "minimongo;HybridCollectionStatic;minimongo/lib/HybridDb;HybridCollectionStatic;", //
+        "minimongo;HybridCollectionStatic;minimongo;;Member[HybridCollection]", //
+        "minimongo;MinimongoBaseCollection;minimongo/RemoteDb;Collection;", //
+        "minimongo;MinimongoBaseCollection;minimongo/lib/types;MinimongoBaseCollection;", //
+        "minimongo;MinimongoBaseCollection;minimongo;HybridCollection;", //
+        "minimongo;MinimongoBaseCollection;minimongo;MinimongoCollection;", //
+        "minimongo;MinimongoBaseCollection;minimongo;MinimongoDb;AnyMember", //
+        "minimongo;MinimongoBaseCollection;minimongo;MinimongoLocalCollection;", //
+        "minimongo;MinimongoCollection;minimongo/lib/LocalStorageDb;default;Member[collections].AnyMember", //
+        "minimongo;MinimongoCollection;minimongo/lib/WebSQLDb;default;Member[collections].AnyMember", //
+        "minimongo;MinimongoCollection;minimongo/lib/types;MinimongoCollection;", //
+        "minimongo;MinimongoCollection;minimongo;HybridCollection;Member[remoteCol]", //
+        "minimongo;MinimongoCollection;minimongo;MinimongoDb;Member[collections].AnyMember", //
+        "minimongo;MinimongoDb;minimongo/lib/HybridDb;default;", //
+        "minimongo;MinimongoDb;minimongo/lib/HybridDb;default;Member[remoteDb]", //
+        "minimongo;MinimongoDb;minimongo/lib/LocalStorageDb;default;", //
+        "minimongo;MinimongoDb;minimongo/lib/MemoryDb;default;", //
+        "minimongo;MinimongoDb;minimongo/lib/RemoteDb;default;", //
+        "minimongo;MinimongoDb;minimongo/lib/ReplicatingDb;default;Member[masterDb,replicaDb]", //
+        "minimongo;MinimongoDb;minimongo/lib/WebSQLDb;default;", //
+        "minimongo;MinimongoDb;minimongo/lib/types;MinimongoDb;", //
+        "minimongo;MinimongoDb;minimongo;MinimongoDb;Member[remoteDb]", //
+        "minimongo;MinimongoDb;minimongo;MinimongoLocalDb;", //
+        "minimongo;MinimongoLocalCollection;minimongo/IndexedDb;IndexedDbCollection;", //
+        "minimongo;MinimongoLocalCollection;minimongo/MemoryDb;Collection;", //
+        "minimongo;MinimongoLocalCollection;minimongo/ReplicatingDb;Collection;", //
+        "minimongo;MinimongoLocalCollection;minimongo/ReplicatingDb;Collection;Member[masterCol,replicaCol]", //
+        "minimongo;MinimongoLocalCollection;minimongo/lib/types;MinimongoLocalCollection;", //
+        "minimongo;MinimongoLocalCollection;minimongo;HybridCollection;Member[localCol]", //
+        "minimongo;MinimongoLocalCollection;minimongo;MinimongoCollection;", //
+        "minimongo;MinimongoLocalCollection;minimongo;MinimongoLocalDb;Member[addCollection].Argument[2].Argument[0]", //
+        "minimongo;MinimongoLocalCollection;minimongo;MinimongoLocalDb;Member[collections].AnyMember", //
+        "minimongo;MinimongoLocalDb;minimongo/lib/HybridDb;default;Member[localDb]", //
+        "minimongo;MinimongoLocalDb;minimongo/lib/IndexedDb;default;", //
+        "minimongo;MinimongoLocalDb;minimongo/lib/ReplicatingDb;default;", //
+        "minimongo;MinimongoLocalDb;minimongo/lib/types;MinimongoLocalDb;", //
+        "minimongo;MinimongoLocalDb;minimongo;MinimongoDb;Member[localDb]", //
+        "mongodb;Collection;minimongo;MinimongoBaseCollection;", //
+      ]
+  }
+}

javascript/ql/lib/semmle/javascript/frameworks/minimongo/model.json

@@ -0,0 +1,94 @@
+{
+    "packages": {
+        "minimongo": "6.12.4"
+    },
+    "resolutions": {},
+    "language": "javascript",
+    "model": {
+        "typeDefinitions": [
+            "mongodb;Collection;minimongo;MinimongoBaseCollection;",
+            "minimongo;MinimongoBaseCollection;minimongo;MinimongoDb;AnyMember"
+        ],
+        "sinks": []
+    },
+    "generatedModel": {
+        "//": "Autogenerated section. Manual edits in here will be lost.",
+        "typeDefinitions": [
+            "minimongo/IndexedDb;IndexedDbCollection;minimongo/IndexedDb;IndexedDbCollectionStatic;Instance",
+            "minimongo/IndexedDb;IndexedDbCollection;minimongo/lib/IndexedDb;default;Member[collections].AnyMember",
+            "minimongo/MemoryDb;Collection;minimongo/MemoryDb;CollectionStatic;Instance",
+            "minimongo/MemoryDb;Collection;minimongo/lib/MemoryDb;default;Member[collections].AnyMember",
+            "minimongo/RemoteDb;Collection;minimongo/RemoteDb;CollectionStatic;Instance",
+            "minimongo/RemoteDb;Collection;minimongo/lib/RemoteDb;default;Member[collections].AnyMember",
+            "minimongo/ReplicatingDb;Collection;minimongo/ReplicatingDb;CollectionStatic;Instance",
+            "minimongo/ReplicatingDb;Collection;minimongo/lib/ReplicatingDb;default;Member[collections].AnyMember",
+            "minimongo/lib/HybridDb;default;minimongo/lib/HybridDb;defaultStatic;Instance",
+            "minimongo/lib/HybridDb;defaultStatic;minimongo/lib/HybridDb;;Member[default]",
+            "minimongo/lib/HybridDb;defaultStatic;minimongo;;Member[HybridDb]",
+            "minimongo/lib/IndexedDb;default;minimongo/lib/IndexedDb;defaultStatic;Instance",
+            "minimongo/lib/IndexedDb;default;minimongo;;Member[utils].Member[autoselectLocalDb].ReturnValue",
+            "minimongo/lib/IndexedDb;defaultStatic;minimongo/lib/IndexedDb;;Member[default]",
+            "minimongo/lib/IndexedDb;defaultStatic;minimongo;;Member[IndexedDb]",
+            "minimongo/lib/LocalStorageDb;default;minimongo/lib/LocalStorageDb;defaultStatic;Instance",
+            "minimongo/lib/LocalStorageDb;default;minimongo;;Member[utils].Member[autoselectLocalDb].ReturnValue",
+            "minimongo/lib/LocalStorageDb;defaultStatic;minimongo/lib/LocalStorageDb;;Member[default]",
+            "minimongo/lib/LocalStorageDb;defaultStatic;minimongo;;Member[LocalStorageDb]",
+            "minimongo/lib/MemoryDb;default;minimongo/lib/MemoryDb;defaultStatic;Instance",
+            "minimongo/lib/MemoryDb;default;minimongo;;Member[utils].Member[autoselectLocalDb].ReturnValue",
+            "minimongo/lib/MemoryDb;defaultStatic;minimongo/lib/MemoryDb;;Member[default]",
+            "minimongo/lib/MemoryDb;defaultStatic;minimongo;;Member[MemoryDb]",
+            "minimongo/lib/RemoteDb;default;minimongo/lib/RemoteDb;defaultStatic;Instance",
+            "minimongo/lib/RemoteDb;defaultStatic;minimongo/lib/RemoteDb;;Member[default]",
+            "minimongo/lib/RemoteDb;defaultStatic;minimongo;;Member[RemoteDb]",
+            "minimongo/lib/ReplicatingDb;default;minimongo/lib/ReplicatingDb;defaultStatic;Instance",
+            "minimongo/lib/ReplicatingDb;defaultStatic;minimongo/lib/ReplicatingDb;;Member[default]",
+            "minimongo/lib/ReplicatingDb;defaultStatic;minimongo;;Member[ReplicatingDb]",
+            "minimongo/lib/WebSQLDb;default;minimongo/lib/WebSQLDb;defaultStatic;Instance",
+            "minimongo/lib/WebSQLDb;default;minimongo;;Member[utils].Member[autoselectLocalDb].ReturnValue",
+            "minimongo/lib/WebSQLDb;defaultStatic;minimongo/lib/WebSQLDb;;Member[default]",
+            "minimongo/lib/WebSQLDb;defaultStatic;minimongo;;Member[WebSQLDb]",
+            "minimongo;HybridCollection;minimongo/lib/HybridDb;HybridCollection;",
+            "minimongo;HybridCollection;minimongo/lib/HybridDb;default;Member[collections].AnyMember",
+            "minimongo;HybridCollection;minimongo;HybridCollectionStatic;Instance",
+            "minimongo;HybridCollectionStatic;minimongo/lib/HybridDb;;Member[HybridCollection]",
+            "minimongo;HybridCollectionStatic;minimongo/lib/HybridDb;HybridCollectionStatic;",
+            "minimongo;HybridCollectionStatic;minimongo;;Member[HybridCollection]",
+            "minimongo;MinimongoBaseCollection;minimongo/RemoteDb;Collection;",
+            "minimongo;MinimongoBaseCollection;minimongo/lib/types;MinimongoBaseCollection;",
+            "minimongo;MinimongoBaseCollection;minimongo;HybridCollection;",
+            "minimongo;MinimongoBaseCollection;minimongo;MinimongoCollection;",
+            "minimongo;MinimongoBaseCollection;minimongo;MinimongoLocalCollection;",
+            "minimongo;MinimongoCollection;minimongo/lib/LocalStorageDb;default;Member[collections].AnyMember",
+            "minimongo;MinimongoCollection;minimongo/lib/WebSQLDb;default;Member[collections].AnyMember",
+            "minimongo;MinimongoCollection;minimongo/lib/types;MinimongoCollection;",
+            "minimongo;MinimongoCollection;minimongo;HybridCollection;Member[remoteCol]",
+            "minimongo;MinimongoCollection;minimongo;MinimongoDb;Member[collections].AnyMember",
+            "minimongo;MinimongoDb;minimongo/lib/HybridDb;default;",
+            "minimongo;MinimongoDb;minimongo/lib/HybridDb;default;Member[remoteDb]",
+            "minimongo;MinimongoDb;minimongo/lib/LocalStorageDb;default;",
+            "minimongo;MinimongoDb;minimongo/lib/MemoryDb;default;",
+            "minimongo;MinimongoDb;minimongo/lib/RemoteDb;default;",
+            "minimongo;MinimongoDb;minimongo/lib/ReplicatingDb;default;Member[masterDb,replicaDb]",
+            "minimongo;MinimongoDb;minimongo/lib/WebSQLDb;default;",
+            "minimongo;MinimongoDb;minimongo/lib/types;MinimongoDb;",
+            "minimongo;MinimongoDb;minimongo;MinimongoDb;Member[remoteDb]",
+            "minimongo;MinimongoDb;minimongo;MinimongoLocalDb;",
+            "minimongo;MinimongoLocalCollection;minimongo/IndexedDb;IndexedDbCollection;",
+            "minimongo;MinimongoLocalCollection;minimongo/MemoryDb;Collection;",
+            "minimongo;MinimongoLocalCollection;minimongo/ReplicatingDb;Collection;",
+            "minimongo;MinimongoLocalCollection;minimongo/ReplicatingDb;Collection;Member[masterCol,replicaCol]",
+            "minimongo;MinimongoLocalCollection;minimongo/lib/types;MinimongoLocalCollection;",
+            "minimongo;MinimongoLocalCollection;minimongo;HybridCollection;Member[localCol]",
+            "minimongo;MinimongoLocalCollection;minimongo;MinimongoCollection;",
+            "minimongo;MinimongoLocalCollection;minimongo;MinimongoLocalDb;Member[addCollection].Argument[2].Argument[0]",
+            "minimongo;MinimongoLocalCollection;minimongo;MinimongoLocalDb;Member[collections].AnyMember",
+            "minimongo;MinimongoLocalDb;minimongo/lib/HybridDb;default;Member[localDb]",
+            "minimongo;MinimongoLocalDb;minimongo/lib/IndexedDb;default;",
+            "minimongo;MinimongoLocalDb;minimongo/lib/ReplicatingDb;default;",
+            "minimongo;MinimongoLocalDb;minimongo/lib/types;MinimongoLocalDb;",
+            "minimongo;MinimongoLocalDb;minimongo;MinimongoDb;Member[localDb]"
+        ],
+        "summaries": [],
+        "typeVariables": []
+    }
+}

javascript/ql/lib/semmle/javascript/frameworks/mongodb/Model.qll

@@ -0,0 +1,806 @@
+/** Generated model file */
+
+private import javascript
+
+private class Sinks extends ModelInput::SinkModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "mongodb;Collection;Member[aggregate,count,countDocuments,deleteMany,deleteOne,find,findOne,findOneAndDelete,findOneAndReplace,remove,replaceOne,watch].Argument[0];mongodb.sink", //
+        "mongodb;Collection;Member[distinct].Argument[1];mongodb.sink", //
+        "mongodb;Collection;Member[findOneAndUpdate,update,updateMany,updateOne].Argument[0,1];mongodb.sink", //
+        "mongodb;Db;Member[aggregate,watch].Argument[0];mongodb.sink", //
+        "mongodb;DeleteManyModel;Member[filter];mongodb.sink", //
+        "mongodb;DeleteOneModel;Member[filter];mongodb.sink", //
+        "mongodb;MongoClient;Member[watch].Argument[0];mongodb.sink", //
+        "mongodb;UpdateManyModel;Member[filter,update];mongodb.sink", //
+        "mongodb;UpdateOneModel;Member[filter,update];mongodb.sink", //
+        "mongoose;CollectionBase;Member[findAndModify].Argument[0];mongodb.sink", //
+        "mongoose;Connection;Member[watch].Argument[0];mongodb.sink", //
+        "mongoose;Document;Member[update,updateOne].Argument[0];mongodb.sink", //
+        "mongoose;Model;Member[$where,aggregate,exists,find,findById,findByIdAndDelete,findByIdAndRemove,findOne,findOneAndDelete,findOneAndRemove,findOneAndReplace,geoSearch,remove,replaceOne,watch].Argument[0];mongodb.sink", //
+        "mongoose;Model;Member[count,where].WithArity[1,2].Argument[0];mongodb.sink", //
+        "mongoose;Model;Member[countDocuments].WithArity[1,2,3].Argument[0];mongodb.sink", //
+        "mongoose;Model;Member[deleteMany,deleteOne].WithArity[0,1,2,3].Argument[0];mongodb.sink", //
+        "mongoose;Model;Member[distinct,where].Argument[1];mongodb.sink", //
+        "mongoose;Model;Member[findByIdAndUpdate,findOneAndUpdate,update,updateMany,updateOne].Argument[0,1];mongodb.sink", //
+        "mongoose;Model;Member[find].WithArity[1,2,3,4].Argument[0];mongodb.sink", //
+        "mongoose;Query;Member[$where,and,find,findByIdAndDelete,findOne,findOneAndDelete,findOneAndRemove,nor,or,remove,replaceOne,setUpdate].Argument[0];mongodb.sink", //
+        "mongoose;Query;Member[count,where].WithArity[1,2].Argument[0];mongodb.sink", //
+        "mongoose;Query;Member[deleteMany,deleteOne].WithArity[0,1,2,3].Argument[0];mongodb.sink", //
+        "mongoose;Query;Member[distinct,where].Argument[1];mongodb.sink", //
+        "mongoose;Query;Member[findByIdAndUpdate,findOneAndUpdate,update,updateMany,updateOne].Argument[0,1];mongodb.sink", //
+        "mongoose;Query;Member[find].WithArity[1,2,3,4].Argument[0];mongodb.sink", //
+        "mongoose;QueryStatic;Argument[2];mongodb.sink", //
+      ]
+  }
+}
+
+private class Types extends ModelInput::TypeModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "mongodb;;mongoose;;Member[mongodb]", //
+        "mongodb;AbstractCursor;mongodb;FindCursor;", //
+        "mongodb;AbstractCursor;mongodb;ListCollectionsCursor;", //
+        "mongodb;AbstractCursor;mongodb;ListIndexesCursor;", //
+        "mongodb;AbstractCursorOptions;mongodb/mongodb;AbstractCursorOptions;", //
+        "mongodb;AbstractCursorOptions;mongodb;AggregationCursorOptions;", //
+        "mongodb;AbstractCursorOptions;mongoose;mongodb.AbstractCursorOptions;", //
+        "mongodb;AddUserOptions;mongodb/mongodb;AddUserOptions;", //
+        "mongodb;AddUserOptions;mongodb;Admin;Member[addUser].Argument[1,2]", //
+        "mongodb;AddUserOptions;mongodb;Db;Member[addUser].Argument[1,2]", //
+        "mongodb;AddUserOptions;mongoose;mongodb.AddUserOptions;", //
+        "mongodb;Admin;mongodb/mongodb;Admin;", //
+        "mongodb;Admin;mongodb;AdminStatic;Instance", //
+        "mongodb;Admin;mongodb;Db;Member[admin].ReturnValue", //
+        "mongodb;Admin;mongoose;mongodb.Admin;", //
+        "mongodb;AdminStatic;mongodb/mongodb;AdminStatic;", //
+        "mongodb;AdminStatic;mongodb;;Member[Admin]", //
+        "mongodb;AdminStatic;mongoose;mongodb.AdminStatic;", //
+        "mongodb;AggregateOptions;mongodb/mongodb;AggregateOptions;", //
+        "mongodb;AggregateOptions;mongodb;AggregationCursorOptions;", //
+        "mongodb;AggregateOptions;mongodb;ChangeStreamOptions;", //
+        "mongodb;AggregateOptions;mongodb;Collection;Member[aggregate].Argument[1]", //
+        "mongodb;AggregateOptions;mongodb;CountDocumentsOptions;", //
+        "mongodb;AggregateOptions;mongodb;Db;Member[aggregate].Argument[1]", //
+        "mongodb;AggregateOptions;mongoose;mongodb.AggregateOptions;", //
+        "mongodb;AggregationCursorOptions;mongodb/mongodb;AggregationCursorOptions;", //
+        "mongodb;AggregationCursorOptions;mongoose;mongodb.AggregationCursorOptions;", //
+        "mongodb;AnyBulkWriteOperation;mongodb/mongodb;AnyBulkWriteOperation;", //
+        "mongodb;AnyBulkWriteOperation;mongodb;BulkOperationBase;Member[raw].Argument[0]", //
+        "mongodb;AnyBulkWriteOperation;mongodb;Collection;Member[bulkWrite].Argument[0].ArrayElement", //
+        "mongodb;AnyBulkWriteOperation;mongoose;mongodb.AnyBulkWriteOperation;", //
+        "mongodb;Auth;mongodb/mongodb;Auth;", //
+        "mongodb;Auth;mongodb;MongoClientOptions;Member[auth]", //
+        "mongodb;Auth;mongoose;mongodb.Auth;", //
+        "mongodb;AutoEncrypter;mongodb/mongodb;AutoEncrypter;", //
+        "mongodb;AutoEncrypter;mongodb;AutoEncrypter;Instance", //
+        "mongodb;AutoEncrypter;mongodb;ConnectionOptions;Member[autoEncrypter]", //
+        "mongodb;AutoEncrypter;mongodb;MongoClient;Member[autoEncrypter]", //
+        "mongodb;AutoEncrypter;mongodb;MongoOptions;Member[autoEncrypter]", //
+        "mongodb;AutoEncrypter;mongoose;mongodb.AutoEncrypter;", //
+        "mongodb;AutoEncryptionOptions;mongodb/mongodb;AutoEncryptionOptions;", //
+        "mongodb;AutoEncryptionOptions;mongodb;AutoEncrypter;Argument[1]", //
+        "mongodb;AutoEncryptionOptions;mongodb;MongoClientOptions;Member[autoEncryption]", //
+        "mongodb;AutoEncryptionOptions;mongoose;mongodb.AutoEncryptionOptions;", //
+        "mongodb;BulkOperationBase;mongodb/mongodb;BulkOperationBase;", //
+        "mongodb;BulkOperationBase;mongodb;BulkOperationBase;Member[addToOperationsList,insert,raw].ReturnValue", //
+        "mongodb;BulkOperationBase;mongodb;BulkOperationBaseStatic;Instance", //
+        "mongodb;BulkOperationBase;mongodb;FindOperators;Member[bulkOperation]", //
+        "mongodb;BulkOperationBase;mongodb;FindOperators;Member[delete,deleteOne,replaceOne,update,updateOne].ReturnValue", //
+        "mongodb;BulkOperationBase;mongodb;OrderedBulkOperation;", //
+        "mongodb;BulkOperationBase;mongodb;UnorderedBulkOperation;", //
+        "mongodb;BulkOperationBase;mongoose;mongodb.BulkOperationBase;", //
+        "mongodb;BulkOperationBaseStatic;mongodb/mongodb;BulkOperationBaseStatic;", //
+        "mongodb;BulkOperationBaseStatic;mongodb;;Member[BulkOperationBase]", //
+        "mongodb;BulkOperationBaseStatic;mongoose;mongodb.BulkOperationBaseStatic;", //
+        "mongodb;BulkWriteOptions;mongodb/mongodb;BulkWriteOptions;", //
+        "mongodb;BulkWriteOptions;mongodb;BulkOperationBase;Member[execute].WithArity[0,1,2].Argument[0]", //
+        "mongodb;BulkWriteOptions;mongodb;Collection;Member[bulkWrite,insert,insertMany].Argument[1]", //
+        "mongodb;BulkWriteOptions;mongodb;Collection;Member[initializeOrderedBulkOp,initializeUnorderedBulkOp].Argument[0]", //
+        "mongodb;BulkWriteOptions;mongodb;OrderedBulkOperationStatic;Argument[1]", //
+        "mongodb;BulkWriteOptions;mongodb;UnorderedBulkOperationStatic;Argument[1]", //
+        "mongodb;BulkWriteOptions;mongoose;mongodb.BulkWriteOptions;", //
+        "mongodb;ChangeStream;mongodb/mongodb;ChangeStream;", //
+        "mongodb;ChangeStream;mongodb;ChangeStreamStatic;Instance", //
+        "mongodb;ChangeStream;mongodb;Collection;Member[watch].ReturnValue", //
+        "mongodb;ChangeStream;mongodb;Db;Member[watch].ReturnValue", //
+        "mongodb;ChangeStream;mongodb;MongoClient;Member[watch].ReturnValue", //
+        "mongodb;ChangeStream;mongoose;mongodb.ChangeStream;", //
+        "mongodb;ChangeStreamOptions;mongodb/mongodb;ChangeStreamOptions;", //
+        "mongodb;ChangeStreamOptions;mongodb;ChangeStream;Member[options]", //
+        "mongodb;ChangeStreamOptions;mongodb;Collection;Member[watch].Argument[1]", //
+        "mongodb;ChangeStreamOptions;mongodb;Db;Member[watch].Argument[1]", //
+        "mongodb;ChangeStreamOptions;mongodb;MongoClient;Member[watch].Argument[1]", //
+        "mongodb;ChangeStreamOptions;mongoose;mongodb.ChangeStreamOptions;", //
+        "mongodb;ChangeStreamStatic;mongodb/mongodb;ChangeStreamStatic;", //
+        "mongodb;ChangeStreamStatic;mongodb;;Member[ChangeStream]", //
+        "mongodb;ChangeStreamStatic;mongoose;mongodb.ChangeStreamStatic;", //
+        "mongodb;ClientSession;mongodb/mongodb;ClientSession;", //
+        "mongodb;ClientSession;mongodb;AbstractCursorOptions;Member[session]", //
+        "mongodb;ClientSession;mongodb;ClientSession;Member[equals].Argument[0]", //
+        "mongodb;ClientSession;mongodb;ClientSessionEvents;Member[ended].Argument[0]", //
+        "mongodb;ClientSession;mongodb;ClientSessionStatic;Instance", //
+        "mongodb;ClientSession;mongodb;IndexInformationOptions;Member[session]", //
+        "mongodb;ClientSession;mongodb;MongoClient;Member[startSession].ReturnValue", //
+        "mongodb;ClientSession;mongodb;OperationOptions;Member[session]", //
+        "mongodb;ClientSession;mongodb;ReadPreferenceFromOptions;Member[session]", //
+        "mongodb;ClientSession;mongodb;SelectServerOptions;Member[session]", //
+        "mongodb;ClientSession;mongodb;WithSessionCallback;Argument[0]", //
+        "mongodb;ClientSession;mongodb;WithTransactionCallback;Argument[0]", //
+        "mongodb;ClientSession;mongoose;mongodb.ClientSession;", //
+        "mongodb;ClientSessionEvents;mongodb/mongodb;ClientSessionEvents;", //
+        "mongodb;ClientSessionEvents;mongoose;mongodb.ClientSessionEvents;", //
+        "mongodb;ClientSessionOptions;mongodb/mongodb;ClientSessionOptions;", //
+        "mongodb;ClientSessionOptions;mongodb;MongoClient;Member[startSession].Argument[0]", //
+        "mongodb;ClientSessionOptions;mongodb;MongoClient;Member[withSession].WithArity[2].Argument[0]", //
+        "mongodb;ClientSessionOptions;mongoose;mongodb.ClientSessionOptions;", //
+        "mongodb;ClientSessionStatic;mongodb/mongodb;ClientSessionStatic;", //
+        "mongodb;ClientSessionStatic;mongodb;;Member[ClientSession]", //
+        "mongodb;ClientSessionStatic;mongoose;mongodb.ClientSessionStatic;", //
+        "mongodb;CollStatsOptions;mongodb/mongodb;CollStatsOptions;", //
+        "mongodb;CollStatsOptions;mongodb;Collection;Member[stats].Argument[0]", //
+        "mongodb;CollStatsOptions;mongoose;mongodb.CollStatsOptions;", //
+        "mongodb;Collection;mongodb/mongodb;Collection;", //
+        "mongodb;Collection;mongodb;ChangeStream;Member[parent]", //
+        "mongodb;Collection;mongodb;Collection;Member[rename].Argument[1,2].TypeVar[mongodb.Callback.0]", //
+        "mongodb;Collection;mongodb;Collection;Member[rename].WithArity[1,2].ReturnValue.Awaited", //
+        "mongodb;Collection;mongodb;CollectionStatic;Instance", //
+        "mongodb;Collection;mongodb;Db;Member[collection].ReturnValue", //
+        "mongodb;Collection;mongodb;Db;Member[collections].Argument[0,1].TypeVar[mongodb.Callback.0].ArrayElement", //
+        "mongodb;Collection;mongodb;Db;Member[collections].WithArity[0,1].ReturnValue.Awaited.ArrayElement", //
+        "mongodb;Collection;mongodb;Db;Member[createCollection].Argument[2].TypeVar[mongodb.Callback.0]", //
+        "mongodb;Collection;mongodb;Db;Member[createCollection].WithArity[1,2].ReturnValue.Awaited", //
+        "mongodb;Collection;mongodb;Db;Member[createCollection].WithArity[2].Argument[1].TypeVar[mongodb.Callback.0]", //
+        "mongodb;Collection;mongodb;Db;Member[renameCollection].Argument[2,3].TypeVar[mongodb.Callback.0]", //
+        "mongodb;Collection;mongodb;Db;Member[renameCollection].WithArity[2,3].ReturnValue.Awaited", //
+        "mongodb;Collection;mongodb;GridFSBucketWriteStream;Member[chunks,files]", //
+        "mongodb;Collection;mongodb;ListIndexesCursor;Member[parent]", //
+        "mongodb;Collection;mongodb;ListIndexesCursorStatic;Argument[0]", //
+        "mongodb;Collection;mongodb;OrderedBulkOperationStatic;Argument[0]", //
+        "mongodb;Collection;mongodb;UnorderedBulkOperationStatic;Argument[0]", //
+        "mongodb;Collection;mongoose;mongodb.Collection;", //
+        "mongodb;CollectionStatic;mongodb/mongodb;CollectionStatic;", //
+        "mongodb;CollectionStatic;mongodb;;Member[Collection]", //
+        "mongodb;CollectionStatic;mongoose;mongodb.CollectionStatic;", //
+        "mongodb;CommandOperationOptions;mongodb/mongodb;CommandOperationOptions;", //
+        "mongodb;CommandOperationOptions;mongodb;AddUserOptions;", //
+        "mongodb;CommandOperationOptions;mongodb;Admin;Member[buildInfo,ping,replSetGetStatus,serverInfo,serverStatus].Argument[0]", //
+        "mongodb;CommandOperationOptions;mongodb;AggregateOptions;", //
+        "mongodb;CommandOperationOptions;mongodb;BulkWriteOptions;", //
+        "mongodb;CommandOperationOptions;mongodb;CollStatsOptions;", //
+        "mongodb;CommandOperationOptions;mongodb;CountOptions;", //
+        "mongodb;CommandOperationOptions;mongodb;CreateCollectionOptions;", //
+        "mongodb;CommandOperationOptions;mongodb;CreateIndexesOptions;", //
+        "mongodb;CommandOperationOptions;mongodb;DbStatsOptions;", //
+        "mongodb;CommandOperationOptions;mongodb;DeleteOptions;", //
+        "mongodb;CommandOperationOptions;mongodb;DistinctOptions;", //
+        "mongodb;CommandOperationOptions;mongodb;DropCollectionOptions;", //
+        "mongodb;CommandOperationOptions;mongodb;DropDatabaseOptions;", //
+        "mongodb;CommandOperationOptions;mongodb;DropIndexesOptions;", //
+        "mongodb;CommandOperationOptions;mongodb;EstimatedDocumentCountOptions;", //
+        "mongodb;CommandOperationOptions;mongodb;EvalOptions;", //
+        "mongodb;CommandOperationOptions;mongodb;FindOneAndDeleteOptions;", //
+        "mongodb;CommandOperationOptions;mongodb;FindOneAndReplaceOptions;", //
+        "mongodb;CommandOperationOptions;mongodb;FindOneAndUpdateOptions;", //
+        "mongodb;CommandOperationOptions;mongodb;FindOptions;", //
+        "mongodb;CommandOperationOptions;mongodb;InsertOneOptions;", //
+        "mongodb;CommandOperationOptions;mongodb;ListCollectionsOptions;", //
+        "mongodb;CommandOperationOptions;mongodb;ListDatabasesOptions;", //
+        "mongodb;CommandOperationOptions;mongodb;ListIndexesOptions;", //
+        "mongodb;CommandOperationOptions;mongodb;MapReduceOptions;", //
+        "mongodb;CommandOperationOptions;mongodb;ProfilingLevelOptions;", //
+        "mongodb;CommandOperationOptions;mongodb;RemoveUserOptions;", //
+        "mongodb;CommandOperationOptions;mongodb;RenameOptions;", //
+        "mongodb;CommandOperationOptions;mongodb;ReplaceOptions;", //
+        "mongodb;CommandOperationOptions;mongodb;RunCommandOptions;", //
+        "mongodb;CommandOperationOptions;mongodb;SetProfilingLevelOptions;", //
+        "mongodb;CommandOperationOptions;mongodb;TransactionOptions;", //
+        "mongodb;CommandOperationOptions;mongodb;UpdateOptions;", //
+        "mongodb;CommandOperationOptions;mongodb;ValidateCollectionOptions;", //
+        "mongodb;CommandOperationOptions;mongoose;mongodb.CommandOperationOptions;", //
+        "mongodb;ConnectionOptions;mongodb/mongodb;ConnectionOptions;", //
+        "mongodb;ConnectionOptions;mongoose;mongodb.ConnectionOptions;", //
+        "mongodb;CountDocumentsOptions;mongodb/mongodb;CountDocumentsOptions;", //
+        "mongodb;CountDocumentsOptions;mongodb;Collection;Member[countDocuments].Argument[1]", //
+        "mongodb;CountDocumentsOptions;mongoose;mongodb.CountDocumentsOptions;", //
+        "mongodb;CountOptions;mongodb/mongodb;CountOptions;", //
+        "mongodb;CountOptions;mongodb;Collection;Member[count].Argument[1]", //
+        "mongodb;CountOptions;mongodb;FindCursor;Member[count].Argument[0]", //
+        "mongodb;CountOptions;mongoose;mongodb.CountOptions;", //
+        "mongodb;CreateCollectionOptions;mongodb/mongodb;CreateCollectionOptions;", //
+        "mongodb;CreateCollectionOptions;mongodb;Db;Member[createCollection].WithArity[1,2,3].Argument[1]", //
+        "mongodb;CreateCollectionOptions;mongoose;mongodb.CreateCollectionOptions;", //
+        "mongodb;CreateIndexesOptions;mongodb/mongodb;CreateIndexesOptions;", //
+        "mongodb;CreateIndexesOptions;mongodb;Collection;Member[createIndex,createIndexes].Argument[1]", //
+        "mongodb;CreateIndexesOptions;mongodb;Db;Member[createIndex].Argument[2]", //
+        "mongodb;CreateIndexesOptions;mongoose;mongodb.CreateIndexesOptions;", //
+        "mongodb;Db;mongodb/mongodb;Db;", //
+        "mongodb;Db;mongodb;ChangeStream;Member[parent]", //
+        "mongodb;Db;mongodb;DbStatic;Instance", //
+        "mongodb;Db;mongodb;GridFSBucketStatic;Argument[0]", //
+        "mongodb;Db;mongodb;ListCollectionsCursor;Member[parent]", //
+        "mongodb;Db;mongodb;ListCollectionsCursorStatic;Argument[0]", //
+        "mongodb;Db;mongodb;MongoClient;Member[db].ReturnValue", //
+        "mongodb;Db;mongoose;mongodb.Db;", //
+        "mongodb;DbStatic;mongodb/mongodb;DbStatic;", //
+        "mongodb;DbStatic;mongodb;;Member[Db]", //
+        "mongodb;DbStatic;mongoose;mongodb.DbStatic;", //
+        "mongodb;DbStatsOptions;mongodb/mongodb;DbStatsOptions;", //
+        "mongodb;DbStatsOptions;mongodb;Db;Member[stats].Argument[0]", //
+        "mongodb;DbStatsOptions;mongoose;mongodb.DbStatsOptions;", //
+        "mongodb;DeleteManyModel;mongodb/mongodb;DeleteManyModel;", //
+        "mongodb;DeleteManyModel;mongodb;AnyBulkWriteOperation;Member[deleteMany]", //
+        "mongodb;DeleteManyModel;mongoose;mongodb.DeleteManyModel;", //
+        "mongodb;DeleteOneModel;mongodb/mongodb;DeleteOneModel;", //
+        "mongodb;DeleteOneModel;mongodb;AnyBulkWriteOperation;Member[deleteOne]", //
+        "mongodb;DeleteOneModel;mongoose;mongodb.DeleteOneModel;", //
+        "mongodb;DeleteOptions;mongodb/mongodb;DeleteOptions;", //
+        "mongodb;DeleteOptions;mongodb;Collection;Member[deleteMany,deleteOne,remove].Argument[1]", //
+        "mongodb;DeleteOptions;mongoose;mongodb.DeleteOptions;", //
+        "mongodb;DistinctOptions;mongodb/mongodb;DistinctOptions;", //
+        "mongodb;DistinctOptions;mongodb;Collection;Member[distinct].Argument[2]", //
+        "mongodb;DistinctOptions;mongoose;mongodb.DistinctOptions;", //
+        "mongodb;DropCollectionOptions;mongodb/mongodb;DropCollectionOptions;", //
+        "mongodb;DropCollectionOptions;mongodb;Collection;Member[drop].Argument[0]", //
+        "mongodb;DropCollectionOptions;mongodb;Db;Member[dropCollection].Argument[1]", //
+        "mongodb;DropCollectionOptions;mongoose;mongodb.DropCollectionOptions;", //
+        "mongodb;DropDatabaseOptions;mongodb/mongodb;DropDatabaseOptions;", //
+        "mongodb;DropDatabaseOptions;mongodb;Db;Member[dropDatabase].Argument[0]", //
+        "mongodb;DropDatabaseOptions;mongoose;mongodb.DropDatabaseOptions;", //
+        "mongodb;DropIndexesOptions;mongodb/mongodb;DropIndexesOptions;", //
+        "mongodb;DropIndexesOptions;mongodb;Collection;Member[dropIndex].Argument[1]", //
+        "mongodb;DropIndexesOptions;mongodb;Collection;Member[dropIndexes].Argument[0]", //
+        "mongodb;DropIndexesOptions;mongoose;mongodb.DropIndexesOptions;", //
+        "mongodb;EstimatedDocumentCountOptions;mongodb/mongodb;EstimatedDocumentCountOptions;", //
+        "mongodb;EstimatedDocumentCountOptions;mongodb;Collection;Member[estimatedDocumentCount].Argument[0]", //
+        "mongodb;EstimatedDocumentCountOptions;mongoose;mongodb.EstimatedDocumentCountOptions;", //
+        "mongodb;EvalOptions;mongodb/mongodb;EvalOptions;", //
+        "mongodb;EvalOptions;mongoose;mongodb.EvalOptions;", //
+        "mongodb;FindCursor;mongodb/mongodb;FindCursor;", //
+        "mongodb;FindCursor;mongodb;Collection;Member[find].WithArity[0,1,2].ReturnValue", //
+        "mongodb;FindCursor;mongodb;FindCursor;Member[addQueryModifier,allowDiskUse,clone,collation,comment,filter,hint,limit,map,max,maxAwaitTimeMS,maxTimeMS,min,project,returnKey,showRecordId,skip,sort].ReturnValue", //
+        "mongodb;FindCursor;mongodb;FindCursorStatic;Instance", //
+        "mongodb;FindCursor;mongodb;GridFSBucket;Member[find].ReturnValue", //
+        "mongodb;FindCursor;mongoose;mongodb.FindCursor;", //
+        "mongodb;FindCursorStatic;mongodb/mongodb;FindCursorStatic;", //
+        "mongodb;FindCursorStatic;mongodb;;Member[FindCursor]", //
+        "mongodb;FindCursorStatic;mongoose;mongodb.FindCursorStatic;", //
+        "mongodb;FindOneAndDeleteOptions;mongodb/mongodb;FindOneAndDeleteOptions;", //
+        "mongodb;FindOneAndDeleteOptions;mongodb;Collection;Member[findOneAndDelete].Argument[1]", //
+        "mongodb;FindOneAndDeleteOptions;mongoose;mongodb.FindOneAndDeleteOptions;", //
+        "mongodb;FindOneAndReplaceOptions;mongodb/mongodb;FindOneAndReplaceOptions;", //
+        "mongodb;FindOneAndReplaceOptions;mongodb;Collection;Member[findOneAndReplace].Argument[2]", //
+        "mongodb;FindOneAndReplaceOptions;mongoose;mongodb.FindOneAndReplaceOptions;", //
+        "mongodb;FindOneAndUpdateOptions;mongodb/mongodb;FindOneAndUpdateOptions;", //
+        "mongodb;FindOneAndUpdateOptions;mongodb;Collection;Member[findOneAndUpdate].Argument[2]", //
+        "mongodb;FindOneAndUpdateOptions;mongoose;mongodb.FindOneAndUpdateOptions;", //
+        "mongodb;FindOperators;mongodb/mongodb;FindOperators;", //
+        "mongodb;FindOperators;mongodb;BulkOperationBase;Member[find].ReturnValue", //
+        "mongodb;FindOperators;mongodb;FindOperators;Member[arrayFilters,collation,upsert].ReturnValue", //
+        "mongodb;FindOperators;mongodb;FindOperatorsStatic;Instance", //
+        "mongodb;FindOperators;mongoose;mongodb.FindOperators;", //
+        "mongodb;FindOperatorsStatic;mongodb/mongodb;FindOperatorsStatic;", //
+        "mongodb;FindOperatorsStatic;mongodb;;Member[FindOperators]", //
+        "mongodb;FindOperatorsStatic;mongoose;mongodb.FindOperatorsStatic;", //
+        "mongodb;FindOptions;mongodb/mongodb;FindOptions;", //
+        "mongodb;FindOptions;mongodb;Collection;Member[find,findOne].Argument[1]", //
+        "mongodb;FindOptions;mongodb;GridFSBucket;Member[find].Argument[1]", //
+        "mongodb;FindOptions;mongoose;mongodb.FindOptions;", //
+        "mongodb;GridFSBucket;mongodb/mongodb;GridFSBucket;", //
+        "mongodb;GridFSBucket;mongodb;GridFSBucketStatic;Instance", //
+        "mongodb;GridFSBucket;mongodb;GridFSBucketWriteStream;Member[bucket]", //
+        "mongodb;GridFSBucket;mongoose;mongodb.GridFSBucket;", //
+        "mongodb;GridFSBucketStatic;mongodb/mongodb;GridFSBucketStatic;", //
+        "mongodb;GridFSBucketStatic;mongodb;;Member[GridFSBucket]", //
+        "mongodb;GridFSBucketStatic;mongoose;mongodb.GridFSBucketStatic;", //
+        "mongodb;GridFSBucketWriteStream;mongodb/mongodb;GridFSBucketWriteStream;", //
+        "mongodb;GridFSBucketWriteStream;mongodb;GridFSBucket;Member[openUploadStream,openUploadStreamWithId].ReturnValue", //
+        "mongodb;GridFSBucketWriteStream;mongodb;GridFSBucketWriteStream;Member[end].ReturnValue", //
+        "mongodb;GridFSBucketWriteStream;mongodb;GridFSBucketWriteStreamStatic;Instance", //
+        "mongodb;GridFSBucketWriteStream;mongoose;mongodb.GridFSBucketWriteStream;", //
+        "mongodb;GridFSBucketWriteStreamStatic;mongodb/mongodb;GridFSBucketWriteStreamStatic;", //
+        "mongodb;GridFSBucketWriteStreamStatic;mongodb;;Member[GridFSBucketWriteStream]", //
+        "mongodb;GridFSBucketWriteStreamStatic;mongoose;mongodb.GridFSBucketWriteStreamStatic;", //
+        "mongodb;IndexInformationOptions;mongodb/mongodb;IndexInformationOptions;", //
+        "mongodb;IndexInformationOptions;mongodb;Collection;Member[indexExists].Argument[1]", //
+        "mongodb;IndexInformationOptions;mongodb;Collection;Member[indexInformation,indexes].Argument[0]", //
+        "mongodb;IndexInformationOptions;mongodb;Db;Member[indexInformation].Argument[1]", //
+        "mongodb;IndexInformationOptions;mongoose;mongodb.IndexInformationOptions;", //
+        "mongodb;InsertOneOptions;mongodb/mongodb;InsertOneOptions;", //
+        "mongodb;InsertOneOptions;mongodb;Collection;Member[insertOne].Argument[1]", //
+        "mongodb;InsertOneOptions;mongoose;mongodb.InsertOneOptions;", //
+        "mongodb;ListCollectionsCursor;mongodb/mongodb;ListCollectionsCursor;", //
+        "mongodb;ListCollectionsCursor;mongodb;Db;Member[listCollections].WithArity[0,1,2].ReturnValue", //
+        "mongodb;ListCollectionsCursor;mongodb;ListCollectionsCursor;Member[clone].ReturnValue", //
+        "mongodb;ListCollectionsCursor;mongodb;ListCollectionsCursorStatic;Instance", //
+        "mongodb;ListCollectionsCursor;mongoose;mongodb.ListCollectionsCursor;", //
+        "mongodb;ListCollectionsCursorStatic;mongodb/mongodb;ListCollectionsCursorStatic;", //
+        "mongodb;ListCollectionsCursorStatic;mongodb;;Member[ListCollectionsCursor]", //
+        "mongodb;ListCollectionsCursorStatic;mongoose;mongodb.ListCollectionsCursorStatic;", //
+        "mongodb;ListCollectionsOptions;mongodb/mongodb;ListCollectionsOptions;", //
+        "mongodb;ListCollectionsOptions;mongodb;Db;Member[collections].Argument[0]", //
+        "mongodb;ListCollectionsOptions;mongodb;Db;Member[listCollections].WithArity[0,1,2].Argument[1]", //
+        "mongodb;ListCollectionsOptions;mongodb;ListCollectionsCursor;Member[options]", //
+        "mongodb;ListCollectionsOptions;mongodb;ListCollectionsCursorStatic;Argument[2]", //
+        "mongodb;ListCollectionsOptions;mongoose;mongodb.ListCollectionsOptions;", //
+        "mongodb;ListDatabasesOptions;mongodb/mongodb;ListDatabasesOptions;", //
+        "mongodb;ListDatabasesOptions;mongodb;Admin;Member[listDatabases].Argument[0]", //
+        "mongodb;ListDatabasesOptions;mongoose;mongodb.ListDatabasesOptions;", //
+        "mongodb;ListIndexesCursor;mongodb/mongodb;ListIndexesCursor;", //
+        "mongodb;ListIndexesCursor;mongodb;Collection;Member[listIndexes].ReturnValue", //
+        "mongodb;ListIndexesCursor;mongodb;ListIndexesCursor;Member[clone].ReturnValue", //
+        "mongodb;ListIndexesCursor;mongodb;ListIndexesCursorStatic;Instance", //
+        "mongodb;ListIndexesCursor;mongoose;mongodb.ListIndexesCursor;", //
+        "mongodb;ListIndexesCursorStatic;mongodb/mongodb;ListIndexesCursorStatic;", //
+        "mongodb;ListIndexesCursorStatic;mongodb;;Member[ListIndexesCursor]", //
+        "mongodb;ListIndexesCursorStatic;mongoose;mongodb.ListIndexesCursorStatic;", //
+        "mongodb;ListIndexesOptions;mongodb/mongodb;ListIndexesOptions;", //
+        "mongodb;ListIndexesOptions;mongodb;Collection;Member[listIndexes].Argument[0]", //
+        "mongodb;ListIndexesOptions;mongodb;ListIndexesCursor;Member[options]", //
+        "mongodb;ListIndexesOptions;mongodb;ListIndexesCursorStatic;Argument[1]", //
+        "mongodb;ListIndexesOptions;mongoose;mongodb.ListIndexesOptions;", //
+        "mongodb;MapReduceOptions;mongodb/mongodb;MapReduceOptions;", //
+        "mongodb;MapReduceOptions;mongodb;Collection;Member[mapReduce].Argument[2]", //
+        "mongodb;MapReduceOptions;mongoose;mongodb.MapReduceOptions;", //
+        "mongodb;MongoClient;mongodb/mongodb;MongoClient;", //
+        "mongodb;MongoClient;mongodb;AutoEncrypter;Argument[0]", //
+        "mongodb;MongoClient;mongodb;AutoEncryptionOptions;Member[keyVaultClient]", //
+        "mongodb;MongoClient;mongodb;ChangeStream;Member[parent]", //
+        "mongodb;MongoClient;mongodb;DbStatic;Argument[0]", //
+        "mongodb;MongoClient;mongodb;MongoClient;Member[connect].Argument[0].TypeVar[mongodb.Callback.0]", //
+        "mongodb;MongoClient;mongodb;MongoClient;Member[connect].WithArity[0].ReturnValue.Awaited", //
+        "mongodb;MongoClient;mongodb;MongoClientEvents;Member[open].Argument[0]", //
+        "mongodb;MongoClient;mongodb;MongoClientStatic;Instance", //
+        "mongodb;MongoClient;mongodb;MongoClientStatic;Member[connect].Argument[1,2].TypeVar[mongodb.Callback.0]", //
+        "mongodb;MongoClient;mongodb;MongoClientStatic;Member[connect].WithArity[1,2].ReturnValue.Awaited", //
+        "mongodb;MongoClient;mongoose;mongodb.MongoClient;", //
+        "mongodb;MongoClientEvents;mongodb/mongodb;MongoClientEvents;", //
+        "mongodb;MongoClientEvents;mongoose;mongodb.MongoClientEvents;", //
+        "mongodb;MongoClientOptions;mongodb/mongodb;MongoClientOptions;", //
+        "mongodb;MongoClientOptions;mongodb;MongoClientStatic;Argument[1]", //
+        "mongodb;MongoClientOptions;mongodb;MongoClientStatic;Member[connect].Argument[1]", //
+        "mongodb;MongoClientOptions;mongoose;mongodb.MongoClientOptions;", //
+        "mongodb;MongoClientStatic;mongodb/mongodb;MongoClientStatic;", //
+        "mongodb;MongoClientStatic;mongodb;;Member[MongoClient]", //
+        "mongodb;MongoClientStatic;mongoose;mongodb.MongoClientStatic;", //
+        "mongodb;MongoOptions;mongodb/mongodb;MongoOptions;", //
+        "mongodb;MongoOptions;mongodb;ClientSession;Member[clientOptions]", //
+        "mongodb;MongoOptions;mongodb;MongoClient;Member[options]", //
+        "mongodb;MongoOptions;mongoose;mongodb.MongoOptions;", //
+        "mongodb;OperationOptions;mongodb/mongodb;OperationOptions;", //
+        "mongodb;OperationOptions;mongodb;Collection;Member[isCapped,options].Argument[0]", //
+        "mongodb;OperationOptions;mongodb;CommandOperationOptions;", //
+        "mongodb;OperationOptions;mongoose;mongodb.OperationOptions;", //
+        "mongodb;OrderedBulkOperation;mongodb/mongodb;OrderedBulkOperation;", //
+        "mongodb;OrderedBulkOperation;mongodb;Collection;Member[initializeOrderedBulkOp].ReturnValue", //
+        "mongodb;OrderedBulkOperation;mongodb;OrderedBulkOperation;Member[addToOperationsList].ReturnValue", //
+        "mongodb;OrderedBulkOperation;mongodb;OrderedBulkOperationStatic;Instance", //
+        "mongodb;OrderedBulkOperation;mongoose;mongodb.OrderedBulkOperation;", //
+        "mongodb;OrderedBulkOperationStatic;mongodb/mongodb;OrderedBulkOperationStatic;", //
+        "mongodb;OrderedBulkOperationStatic;mongodb;;Member[OrderedBulkOperation]", //
+        "mongodb;OrderedBulkOperationStatic;mongoose;mongodb.OrderedBulkOperationStatic;", //
+        "mongodb;ProfilingLevelOptions;mongodb/mongodb;ProfilingLevelOptions;", //
+        "mongodb;ProfilingLevelOptions;mongodb;Db;Member[profilingLevel].Argument[0]", //
+        "mongodb;ProfilingLevelOptions;mongoose;mongodb.ProfilingLevelOptions;", //
+        "mongodb;ReadPreferenceFromOptions;mongodb/mongodb;ReadPreferenceFromOptions;", //
+        "mongodb;ReadPreferenceFromOptions;mongodb;ReadPreferenceStatic;Member[fromOptions].Argument[0]", //
+        "mongodb;ReadPreferenceFromOptions;mongoose;mongodb.ReadPreferenceFromOptions;", //
+        "mongodb;ReadPreferenceStatic;mongodb/mongodb;ReadPreferenceStatic;", //
+        "mongodb;ReadPreferenceStatic;mongodb;;Member[ReadPreference]", //
+        "mongodb;ReadPreferenceStatic;mongoose;mongodb.ReadPreferenceStatic;", //
+        "mongodb;RemoveUserOptions;mongodb/mongodb;RemoveUserOptions;", //
+        "mongodb;RemoveUserOptions;mongodb;Admin;Member[removeUser].Argument[1]", //
+        "mongodb;RemoveUserOptions;mongodb;Db;Member[removeUser].Argument[1]", //
+        "mongodb;RemoveUserOptions;mongoose;mongodb.RemoveUserOptions;", //
+        "mongodb;RenameOptions;mongodb/mongodb;RenameOptions;", //
+        "mongodb;RenameOptions;mongodb;Collection;Member[rename].Argument[1]", //
+        "mongodb;RenameOptions;mongodb;Db;Member[renameCollection].Argument[2]", //
+        "mongodb;RenameOptions;mongoose;mongodb.RenameOptions;", //
+        "mongodb;ReplaceOptions;mongodb/mongodb;ReplaceOptions;", //
+        "mongodb;ReplaceOptions;mongodb;Collection;Member[replaceOne].Argument[2]", //
+        "mongodb;ReplaceOptions;mongoose;mongodb.ReplaceOptions;", //
+        "mongodb;RunCommandOptions;mongodb/mongodb;RunCommandOptions;", //
+        "mongodb;RunCommandOptions;mongodb;Admin;Member[command].Argument[1]", //
+        "mongodb;RunCommandOptions;mongodb;Db;Member[command].Argument[1]", //
+        "mongodb;RunCommandOptions;mongoose;mongodb.RunCommandOptions;", //
+        "mongodb;SelectServerOptions;mongodb/mongodb;SelectServerOptions;", //
+        "mongodb;SelectServerOptions;mongoose;mongodb.SelectServerOptions;", //
+        "mongodb;SetProfilingLevelOptions;mongodb/mongodb;SetProfilingLevelOptions;", //
+        "mongodb;SetProfilingLevelOptions;mongodb;Db;Member[setProfilingLevel].Argument[1]", //
+        "mongodb;SetProfilingLevelOptions;mongoose;mongodb.SetProfilingLevelOptions;", //
+        "mongodb;Transaction;mongodb/mongodb;Transaction;", //
+        "mongodb;Transaction;mongodb;ClientSession;Member[transaction]", //
+        "mongodb;Transaction;mongodb;TransactionStatic;Instance", //
+        "mongodb;Transaction;mongoose;mongodb.Transaction;", //
+        "mongodb;TransactionOptions;mongodb/mongodb;TransactionOptions;", //
+        "mongodb;TransactionOptions;mongodb;ClientSession;Member[defaultTransactionOptions]", //
+        "mongodb;TransactionOptions;mongodb;ClientSession;Member[startTransaction].Argument[0]", //
+        "mongodb;TransactionOptions;mongodb;ClientSession;Member[withTransaction].Argument[1]", //
+        "mongodb;TransactionOptions;mongodb;ClientSessionOptions;Member[defaultTransactionOptions]", //
+        "mongodb;TransactionOptions;mongodb;Transaction;Member[options]", //
+        "mongodb;TransactionOptions;mongoose;mongodb.TransactionOptions;", //
+        "mongodb;TransactionStatic;mongodb/mongodb;TransactionStatic;", //
+        "mongodb;TransactionStatic;mongodb;;Member[Transaction]", //
+        "mongodb;TransactionStatic;mongoose;mongodb.TransactionStatic;", //
+        "mongodb;TypedEventEmitter;mongodb;AbstractCursor;", //
+        "mongodb;TypedEventEmitter;mongodb;ChangeStream;", //
+        "mongodb;TypedEventEmitter;mongodb;ClientSession;", //
+        "mongodb;TypedEventEmitter;mongodb;GridFSBucket;", //
+        "mongodb;TypedEventEmitter;mongodb;MongoClient;", //
+        "mongodb;UnorderedBulkOperation;mongodb/mongodb;UnorderedBulkOperation;", //
+        "mongodb;UnorderedBulkOperation;mongodb;Collection;Member[initializeUnorderedBulkOp].ReturnValue", //
+        "mongodb;UnorderedBulkOperation;mongodb;UnorderedBulkOperation;Member[addToOperationsList].ReturnValue", //
+        "mongodb;UnorderedBulkOperation;mongodb;UnorderedBulkOperationStatic;Instance", //
+        "mongodb;UnorderedBulkOperation;mongoose;mongodb.UnorderedBulkOperation;", //
+        "mongodb;UnorderedBulkOperationStatic;mongodb/mongodb;UnorderedBulkOperationStatic;", //
+        "mongodb;UnorderedBulkOperationStatic;mongodb;;Member[UnorderedBulkOperation]", //
+        "mongodb;UnorderedBulkOperationStatic;mongoose;mongodb.UnorderedBulkOperationStatic;", //
+        "mongodb;UpdateManyModel;mongodb/mongodb;UpdateManyModel;", //
+        "mongodb;UpdateManyModel;mongodb;AnyBulkWriteOperation;Member[updateMany]", //
+        "mongodb;UpdateManyModel;mongoose;mongodb.UpdateManyModel;", //
+        "mongodb;UpdateOneModel;mongodb/mongodb;UpdateOneModel;", //
+        "mongodb;UpdateOneModel;mongodb;AnyBulkWriteOperation;Member[updateOne]", //
+        "mongodb;UpdateOneModel;mongoose;mongodb.UpdateOneModel;", //
+        "mongodb;UpdateOptions;mongodb/mongodb;UpdateOptions;", //
+        "mongodb;UpdateOptions;mongodb;Collection;Member[update,updateMany,updateOne].Argument[2]", //
+        "mongodb;UpdateOptions;mongoose;mongodb.UpdateOptions;", //
+        "mongodb;ValidateCollectionOptions;mongodb/mongodb;ValidateCollectionOptions;", //
+        "mongodb;ValidateCollectionOptions;mongodb;Admin;Member[validateCollection].Argument[1]", //
+        "mongodb;ValidateCollectionOptions;mongoose;mongodb.ValidateCollectionOptions;", //
+        "mongodb;WithSessionCallback;mongodb/mongodb;WithSessionCallback;", //
+        "mongodb;WithSessionCallback;mongodb;MongoClient;Member[withSession].Argument[1]", //
+        "mongodb;WithSessionCallback;mongodb;MongoClient;Member[withSession].WithArity[1].Argument[0]", //
+        "mongodb;WithSessionCallback;mongoose;mongodb.WithSessionCallback;", //
+        "mongodb;WithTransactionCallback;mongodb/mongodb;WithTransactionCallback;", //
+        "mongodb;WithTransactionCallback;mongodb;ClientSession;Member[withTransaction].Argument[0]", //
+        "mongodb;WithTransactionCallback;mongoose;mongodb.WithTransactionCallback;", //
+        "mongoose/inferschematype;ResolvePathType;mongoose/inferschematype;ObtainDocumentPathType;", //
+        "mongoose/inferschematype;ResolvePathType;mongoose/inferschematype;ResolvePathType;TypeVar[mongoose.IfEquals.3].ArrayElement", //
+        "mongoose/inferschematype;ResolvePathType;mongoose/inferschematype;ResolvePathType;TypeVar[mongoose.IfEquals.3].TypeVar[mongoose.Types.DocumentArray.0]", //
+        "mongoose;;mongoose;;Member[mongoose]", //
+        "mongoose;AcceptsDiscriminator;mongoose;Model;", //
+        "mongoose;AcceptsDiscriminator;mongoose;Schema.Types.Array;", //
+        "mongoose;AcceptsDiscriminator;mongoose;Schema.Types.DocumentArray;", //
+        "mongoose;AcceptsDiscriminator;mongoose;Schema.Types.Subdocument;", //
+        "mongoose;Aggregate;mongoose;Aggregate;Member[addCursorFlag,addFields,allowDiskUse,append,collation,count,facet,graphLookup,group,hint,limit,lookup,match,model,near,option,project,read,readConcern,redact,replaceRoot,sample,search,session,skip,sort,sortByCount,unionWith,unwind].ReturnValue", //
+        "mongoose;Aggregate;mongoose;AggregateStatic;Instance", //
+        "mongoose;Aggregate;mongoose;Model;Member[aggregate].ReturnValue", //
+        "mongoose;AggregateStatic;mongoose;;Member[Aggregate]", //
+        "mongoose;Collection;mongoose;;Member[Collection]", //
+        "mongoose;Collection;mongoose;Collection;Instance", //
+        "mongoose;Collection;mongoose;Connection;Member[collection].ReturnValue", //
+        "mongoose;Collection;mongoose;Connection;Member[collections].AnyMember", //
+        "mongoose;Collection;mongoose;Document;Member[collection]", //
+        "mongoose;Collection;mongoose;Model;Member[collection]", //
+        "mongoose;CollectionBase;mongoose;Collection;", //
+        "mongoose;CompileModelOptions;mongoose;;Member[model].Argument[3]", //
+        "mongoose;CompileModelOptions;mongoose;Connection;Member[model].Argument[3]", //
+        "mongoose;ConnectOptions;mongoose;;Member[connect,createConnection].WithArity[1,2,3].Argument[1]", //
+        "mongoose;ConnectOptions;mongoose;Connection;Member[openUri].WithArity[1,2,3].Argument[1]", //
+        "mongoose;Connection;mongoose;;Member[connection]", //
+        "mongoose;Connection;mongoose;;Member[connections].ArrayElement", //
+        "mongoose;Connection;mongoose;;Member[createConnection].Argument[2].TypeVar[mongoose.Callback.0]", //
+        "mongoose;Connection;mongoose;;Member[createConnection].WithArity[0,1,2].ReturnValue", //
+        "mongoose;Connection;mongoose;;Member[createConnection].WithArity[2].Argument[1].TypeVar[mongoose.Callback.0]", //
+        "mongoose;Connection;mongoose;Collection;Argument[1]", //
+        "mongoose;Connection;mongoose;CollectionBase;Member[conn]", //
+        "mongoose;Connection;mongoose;CompileModelOptions;Member[connection]", //
+        "mongoose;Connection;mongoose;Connection;Member[asPromise].ReturnValue.Awaited", //
+        "mongoose;Connection;mongoose;Connection;Member[deleteModel,plugin,setClient,useDb].ReturnValue", //
+        "mongoose;Connection;mongoose;Connection;Member[openUri].Argument[2].TypeVar[mongoose.Callback.0]", //
+        "mongoose;Connection;mongoose;Connection;Member[openUri].WithArity[1,2].ReturnValue.Awaited", //
+        "mongoose;Connection;mongoose;Connection;Member[openUri].WithArity[2,3].ReturnValue", //
+        "mongoose;Connection;mongoose;Connection;Member[openUri].WithArity[2].Argument[1].TypeVar[mongoose.Callback.0]", //
+        "mongoose;Connection;mongoose;ConnectionStatic;Instance", //
+        "mongoose;Connection;mongoose;Document;Member[db]", //
+        "mongoose;Connection;mongoose;Model;Member[db]", //
+        "mongoose;ConnectionStatic;mongoose;;Member[Connection]", //
+        "mongoose;Cursor;mongoose;Query;Member[cursor].ReturnValue", //
+        "mongoose;DiscriminatorModel;mongoose;DiscriminatorSchema;TypeVar[mongoose.Schema.1]", //
+        "mongoose;Document;mongoose;Document;Member[$getAllSubdocs,$getPopulatedDocs].ReturnValue.ArrayElement", //
+        "mongoose;Document;mongoose;Document;Member[$inc,$parent,$set,depopulate,increment,init,overwrite,set].ReturnValue", //
+        "mongoose;Document;mongoose;Document;Member[delete,deleteOne].WithArity[0,1].ReturnValue.TypeVar[mongoose.QueryWithHelpers.1]", //
+        "mongoose;Document;mongoose;Document;Member[equals].Argument[0]", //
+        "mongoose;Document;mongoose;Document;Member[init].Argument[2].TypeVar[mongoose.Callback.0]", //
+        "mongoose;Document;mongoose;Document;Member[remove,save].WithArity[0,1].ReturnValue.Awaited", //
+        "mongoose;Document;mongoose;Document;Member[replaceOne,update,updateOne].ReturnValue.TypeVar[mongoose.Query.1]", //
+        "mongoose;Document;mongoose;Document;Member[save].Argument[1].TypeVar[mongoose.Callback.0]", //
+        "mongoose;Document;mongoose;Document;Member[save].WithArity[1].Argument[0].TypeVar[mongoose.Callback.0]", //
+        "mongoose;Document;mongoose;DocumentStatic;Instance", //
+        "mongoose;Document;mongoose;Error.VersionErrorStatic;Argument[0]", //
+        "mongoose;Document;mongoose;HydratedDocument;", //
+        "mongoose;Document;mongoose;HydratedDocument;TypeVar[mongoose.Require_id.0]", //
+        "mongoose;Document;mongoose;Model;Member[bulkSave].Argument[0].ArrayElement", //
+        "mongoose;Document;mongoose;TVirtualPathFN;Argument[2]", //
+        "mongoose;Document;mongoose;Types.Subdocument;", //
+        "mongoose;Document;mongoose;Types.Subdocument;Member[$parent,ownerDocument,parent].ReturnValue", //
+        "mongoose;Document;mongoose;VirtualType;Member[applyGetters,applySetters].Argument[1]", //
+        "mongoose;DocumentStatic;mongoose;;Member[Document]", //
+        "mongoose;Error.VersionErrorStatic;mongoose;;Member[Error].Member[VersionError]", //
+        "mongoose;HydratedDocument;mongoose;Model;Instance", //
+        "mongoose;HydratedDocument;mongoose;Model;Member[$where,count,countDocuments,deleteMany,deleteOne,distinct,estimatedDocumentCount,find,geoSearch,remove,replaceOne,update,updateMany,updateOne,where].ReturnValue.TypeVar[mongoose.QueryWithHelpers.1]", //
+        "mongoose;HydratedDocument;mongoose;Model;Member[$where,find,geoSearch,where].ReturnValue.TypeVar[mongoose.QueryWithHelpers.0].ArrayElement", //
+        "mongoose;HydratedDocument;mongoose;Model;Member[create,insertMany].WithArity[2].Argument[1].TypeVar[mongoose.Callback.0].ArrayElement", //
+        "mongoose;HydratedDocument;mongoose;Model;Member[create].WithArity[0..,1,2].ReturnValue.Awaited.ArrayElement", //
+        "mongoose;HydratedDocument;mongoose;Model;Member[create].WithArity[1].ReturnValue.Awaited", //
+        "mongoose;HydratedDocument;mongoose;Model;Member[create].WithArity[2].Argument[1].TypeVar[mongoose.Callback.0]", //
+        "mongoose;HydratedDocument;mongoose;Model;Member[exists].WithArity[1,2].ReturnValue.TypeVar[mongoose.QueryWithHelpers.1]", //
+        "mongoose;HydratedDocument;mongoose;Model;Member[find,insertMany].WithArity[3].Argument[2].TypeVar[mongoose.Callback.0].ArrayElement", //
+        "mongoose;HydratedDocument;mongoose;Model;Member[findById,findByIdAndDelete,findByIdAndRemove,findOne,findOneAndDelete,findOneAndRemove].ReturnValue.TypeVar[mongoose.QueryWithHelpers.0,mongoose.QueryWithHelpers.1]", //
+        "mongoose;HydratedDocument;mongoose;Model;Member[findById,findOne].Argument[3].TypeVar[mongoose.Callback.0]", //
+        "mongoose;HydratedDocument;mongoose;Model;Member[findByIdAndDelete,findByIdAndRemove,findOneAndDelete,findOneAndRemove].Argument[2].Argument[1]", //
+        "mongoose;HydratedDocument;mongoose;Model;Member[findByIdAndUpdate,findOneAndReplace,findOneAndUpdate].WithArity[0,1,2,3,4].ReturnValue.TypeVar[mongoose.QueryWithHelpers.0,mongoose.QueryWithHelpers.1]", //
+        "mongoose;HydratedDocument;mongoose;Model;Member[findByIdAndUpdate,findOneAndReplace,findOneAndUpdate].WithArity[3,4].ReturnValue.TypeVar[mongoose.QueryWithHelpers.0].TypeVar[mongoose.ModifyResult.0]", //
+        "mongoose;HydratedDocument;mongoose;Model;Member[findByIdAndUpdate].WithArity[0,1,2,4].Argument[3].Argument[1]", //
+        "mongoose;HydratedDocument;mongoose;Model;Member[findByIdAndUpdate].WithArity[3].Argument[2,3].Argument[1]", //
+        "mongoose;HydratedDocument;mongoose;Model;Member[findById].WithArity[1,2,3].Argument[2].TypeVar[mongoose.Callback.0]", //
+        "mongoose;HydratedDocument;mongoose;Model;Member[findOneAndReplace].WithArity[0,1,2,3,4].Argument[3].Argument[1]", //
+        "mongoose;HydratedDocument;mongoose;Model;Member[findOneAndUpdate].WithArity[3,4].Argument[3].Argument[1]", //
+        "mongoose;HydratedDocument;mongoose;Model;Member[findOne].WithArity[0,1,2].Argument[1,2].TypeVar[mongoose.Callback.0]", //
+        "mongoose;HydratedDocument;mongoose;Model;Member[findOne].WithArity[3].Argument[2].TypeVar[mongoose.Callback.0]", //
+        "mongoose;HydratedDocument;mongoose;Model;Member[find].Argument[3].TypeVar[mongoose.Callback.0].ArrayElement", //
+        "mongoose;HydratedDocument;mongoose;Model;Member[find].WithArity[0].Argument[0].TypeVar[mongoose.Callback.0].ArrayElement", //
+        "mongoose;HydratedDocument;mongoose;Model;Member[find].WithArity[1].Argument[0,1,2].TypeVar[mongoose.Callback.0].ArrayElement", //
+        "mongoose;HydratedDocument;mongoose;Model;Member[find].WithArity[2].Argument[1,2].TypeVar[mongoose.Callback.0].ArrayElement", //
+        "mongoose;HydratedDocument;mongoose;Model;Member[geoSearch].Argument[2].TypeVar[mongoose.Callback.0].ArrayElement", //
+        "mongoose;HydratedDocument;mongoose;Model;Member[hydrate].ReturnValue", //
+        "mongoose;HydratedDocument;mongoose;Model;Member[init].ReturnValue.Awaited", //
+        "mongoose;HydratedDocument;mongoose;Model;Member[insertMany].WithArity[1,2].ReturnValue.Awaited.ArrayElement", //
+        "mongoose;HydratedDocument;mongoose;Model;Member[populate].WithArity[2,3].Argument[2].TypeVar[mongoose.Callback.0]", //
+        "mongoose;HydratedDocument;mongoose;Model;Member[populate].WithArity[2,3].Argument[2].TypeVar[mongoose.Callback.0].ArrayElement", //
+        "mongoose;HydratedDocument;mongoose;Model;Member[populate].WithArity[2,3].ReturnValue.Awaited", //
+        "mongoose;HydratedDocument;mongoose;Model;Member[populate].WithArity[2,3].ReturnValue.Awaited.ArrayElement", //
+        "mongoose;HydratedDocument;mongoose;TVirtualPathFN;Argument[1].TypeVar[mongoose.VirtualType.0]", //
+        "mongoose;HydratedDocument;mongoose;VirtualPathFunctions;Member[options].TypeVar[mongoose.VirtualTypeOptions.0]", //
+        "mongoose;InsertManyOptions;mongoose;Model;Member[insertMany].WithArity[2,3].Argument[1]", //
+        "mongoose;Model;mongoose;;Member[Model]", //
+        "mongoose;Model;mongoose;;Member[model].ReturnValue", //
+        "mongoose;Model;mongoose;AcceptsDiscriminator;Member[discriminator].WithArity[2,3].ReturnValue", //
+        "mongoose;Model;mongoose;Aggregate;Member[model].Argument[0]", //
+        "mongoose;Model;mongoose;Connection;Member[model].WithArity[1,2,3,4].ReturnValue", //
+        "mongoose;Model;mongoose;Connection;Member[models].AnyMember", //
+        "mongoose;Model;mongoose;DiscriminatorModel;", //
+        "mongoose;Model;mongoose;Document;Member[$model].ReturnValue", //
+        "mongoose;Model;mongoose;Document;Member[populate].Argument[2]", //
+        "mongoose;Model;mongoose;Model;Member[discriminators].AnyMember", //
+        "mongoose;Model;mongoose;Models;AnyMember", //
+        "mongoose;Model;mongoose;PopulateOptions;Member[model]", //
+        "mongoose;Model;mongoose;Query;Member[cast].Argument[0]", //
+        "mongoose;Model;mongoose;Query;Member[populate].Argument[2]", //
+        "mongoose;Model;mongoose;Schema.Types.Array;Member[discriminator].WithArity[2,3].ReturnValue", //
+        "mongoose;Model;mongoose;Schema.Types.DocumentArray;Member[discriminator].WithArity[2,3].ReturnValue", //
+        "mongoose;Model;mongoose;Schema.Types.Subdocument;Member[discriminator].WithArity[2,3].ReturnValue", //
+        "mongoose;Model;mongoose;SchemaStatic;Instance.TypeVar[mongoose.Schema.1]", //
+        "mongoose;Models;mongoose;;Member[models]", //
+        "mongoose;PopulateOption;mongoose;InsertManyOptions;", //
+        "mongoose;PopulateOption;mongoose;QueryOptions;", //
+        "mongoose;PopulateOptions;mongoose;Document;Member[populate].Argument[4]", //
+        "mongoose;PopulateOptions;mongoose;Document;Member[populate].WithArity[1,2].Argument[0]", //
+        "mongoose;PopulateOptions;mongoose;Document;Member[populate].WithArity[1,2].Argument[0].ArrayElement", //
+        "mongoose;PopulateOptions;mongoose;Model;Member[populate].Argument[1]", //
+        "mongoose;PopulateOptions;mongoose;Model;Member[populate].Argument[1].ArrayElement", //
+        "mongoose;PopulateOptions;mongoose;PopulateOption;Member[populate]", //
+        "mongoose;PopulateOptions;mongoose;PopulateOption;Member[populate].ArrayElement", //
+        "mongoose;PopulateOptions;mongoose;PopulateOptions;Member[populate]", //
+        "mongoose;PopulateOptions;mongoose;PopulateOptions;Member[populate].ArrayElement", //
+        "mongoose;PopulateOptions;mongoose;Query;Member[populate].WithArity[1].Argument[0]", //
+        "mongoose;PopulateOptions;mongoose;Query;Member[populate].WithArity[1].Argument[0].ArrayElement", //
+        "mongoose;Query;mongoose;Document;Member[replaceOne,update,updateOne].ReturnValue", //
+        "mongoose;Query;mongoose;HydratedDocument;TypeVar[mongoose.Require_id.0]", //
+        "mongoose;Query;mongoose;Query;Member[all,allowDiskUse,and,batchSize,box,circle,clone,collation,comment,elemMatch,equals,exists,explain,geometry,gt,gte,hint,in,intersects,j,limit,lt,lte,maxDistance,maxScan,maxTimeMS,merge,mod,ne,near,nin,nor,or,polygon,read,readConcern,regex,remove,select,session,set,setOptions,size,skip,slice,snapshot,sort,tailable,w,where,within,wtimeout].ReturnValue", //
+        "mongoose;Query;mongoose;Query;Member[error].WithArity[1].ReturnValue", //
+        "mongoose;Query;mongoose;Query;Member[merge].Argument[0]", //
+        "mongoose;Query;mongoose;QueryStatic;Instance", //
+        "mongoose;Query;mongoose;QueryWithHelpers;", //
+        "mongoose;QueryOptions;mongoose;Document;Member[delete,deleteOne,remove].WithArity[0,1,2].Argument[0]", //
+        "mongoose;QueryOptions;mongoose;Document;Member[replaceOne,update,updateOne].Argument[1]", //
+        "mongoose;QueryOptions;mongoose;Model;Member[countDocuments,findByIdAndDelete,findByIdAndRemove,findOneAndDelete,findOneAndRemove].Argument[1]", //
+        "mongoose;QueryOptions;mongoose;Model;Member[deleteMany,deleteOne].WithArity[0,1,2,3].Argument[1]", //
+        "mongoose;QueryOptions;mongoose;Model;Member[estimatedDocumentCount].Argument[0]", //
+        "mongoose;QueryOptions;mongoose;Model;Member[find,findById].WithArity[1,2,3,4].Argument[2]", //
+        "mongoose;QueryOptions;mongoose;Model;Member[findByIdAndUpdate,findOne,findOneAndReplace,findOneAndUpdate].WithArity[0,1,2,3,4].Argument[2]", //
+        "mongoose;QueryOptions;mongoose;Model;Member[replaceOne,update,updateMany,updateOne].Argument[2]", //
+        "mongoose;QueryOptions;mongoose;PopulateOptions;Member[options]", //
+        "mongoose;QueryOptions;mongoose;Query;Member[countDocuments,findByIdAndDelete,findOneAndDelete,findOneAndRemove].Argument[1]", //
+        "mongoose;QueryOptions;mongoose;Query;Member[cursor,estimatedDocumentCount,setOptions].Argument[0]", //
+        "mongoose;QueryOptions;mongoose;Query;Member[cursor].ReturnValue.TypeVar[mongoose.Cursor.1]", //
+        "mongoose;QueryOptions;mongoose;Query;Member[deleteMany,deleteOne].WithArity[0,1,2,3].Argument[1]", //
+        "mongoose;QueryOptions;mongoose;Query;Member[findByIdAndUpdate,findOne,findOneAndUpdate].WithArity[0,1,2,3,4].Argument[2]", //
+        "mongoose;QueryOptions;mongoose;Query;Member[find].WithArity[1,2,3,4].Argument[2]", //
+        "mongoose;QueryOptions;mongoose;Query;Member[getOptions].ReturnValue", //
+        "mongoose;QueryOptions;mongoose;Query;Member[replaceOne,update,updateMany,updateOne].Argument[2]", //
+        "mongoose;QueryOptions;mongoose;VirtualTypeOptions;Member[options]", //
+        "mongoose;QueryStatic;mongoose;;Member[Query]", //
+        "mongoose;QueryWithHelpers;mongoose;Document;Member[delete,deleteOne].WithArity[0,1].ReturnValue", //
+        "mongoose;QueryWithHelpers;mongoose;Model;Member[$where,count,countDocuments,deleteMany,deleteOne,distinct,estimatedDocumentCount,find,findById,findByIdAndDelete,findByIdAndRemove,findOne,findOneAndDelete,findOneAndRemove,geoSearch,remove,replaceOne,update,updateMany,updateOne,where].ReturnValue", //
+        "mongoose;QueryWithHelpers;mongoose;Model;Member[exists].WithArity[1,2].ReturnValue", //
+        "mongoose;QueryWithHelpers;mongoose;Model;Member[findByIdAndUpdate,findOneAndReplace,findOneAndUpdate].WithArity[0,1,2,3,4].ReturnValue", //
+        "mongoose;QueryWithHelpers;mongoose;Query;Member[$where,count,countDocuments,deleteMany,deleteOne,distinct,estimatedDocumentCount,find,findByIdAndDelete,findOne,findOneAndDelete,findOneAndRemove,lean,orFail,populate,replaceOne,transform,update,updateMany,updateOne].ReturnValue", //
+        "mongoose;QueryWithHelpers;mongoose;Query;Member[findByIdAndUpdate,findOneAndUpdate].WithArity[0,1,2,3,4].ReturnValue", //
+        "mongoose;QueryWithHelpers;mongoose;Query;Member[toConstructor].ReturnValue.Instance", //
+        "mongoose;Schema.Types.Array;mongoose;Schema.Types.Array;Member[enum].ReturnValue", //
+        "mongoose;Schema.Types.Array;mongoose;Schema.Types.ArrayStatic;Instance", //
+        "mongoose;Schema.Types.ArrayStatic;mongoose;;Member[Schema].Member[Types].Member[Array]", //
+        "mongoose;Schema.Types.DocumentArray;mongoose;Schema.Types.DocumentArrayStatic;Instance", //
+        "mongoose;Schema.Types.DocumentArrayStatic;mongoose;;Member[Schema].Member[Types].Member[DocumentArray]", //
+        "mongoose;Schema.Types.Subdocument;mongoose;Schema.Types.SubdocumentStatic;Instance", //
+        "mongoose;Schema.Types.SubdocumentStatic;mongoose;;Member[Schema].Member[Types].Member[Subdocument]", //
+        "mongoose;Schema.Types.SubdocumentStatic;mongoose;Schema.Types.DocumentArray;Member[caster]", //
+        "mongoose;SchemaStatic;mongoose;;Member[Schema]", //
+        "mongoose;SessionOperation;mongoose;Aggregate;", //
+        "mongoose;SessionOperation;mongoose;Query;", //
+        "mongoose;TVirtualPathFN;mongoose;VirtualPathFunctions;Member[get,set]", //
+        "mongoose;Types.Array;mongoose;Types.DocumentArray;", //
+        "mongoose;Types.ArraySubdocument;mongoose;Types.ArraySubdocumentStatic;Instance", //
+        "mongoose;Types.ArraySubdocumentStatic;mongoose;;Member[Types].Member[ArraySubdocument]", //
+        "mongoose;Types.DocumentArray;mongoose/inferschematype;ResolvePathType;TypeVar[mongoose.IfEquals.3]", //
+        "mongoose;Types.DocumentArray;mongoose;Types.ArraySubdocument;Member[parentArray].ReturnValue", //
+        "mongoose;Types.DocumentArray;mongoose;Types.DocumentArrayStatic;Instance", //
+        "mongoose;Types.DocumentArrayStatic;mongoose;;Member[Types].Member[DocumentArray]", //
+        "mongoose;Types.ObjectId;mongoose/inferschematype;ResolvePathType;", //
+        "mongoose;Types.Subdocument;mongoose;Types.ArraySubdocument;", //
+        "mongoose;Types.Subdocument;mongoose;Types.DocumentArray;Member[create,id].ReturnValue", //
+        "mongoose;Types.Subdocument;mongoose;Types.DocumentArray;TypeVar[mongoose.Types.Array.0]", //
+        "mongoose;Types.Subdocument;mongoose;Types.SubdocumentStatic;Instance", //
+        "mongoose;Types.SubdocumentStatic;mongoose;;Member[Types].Member[Subdocument]", //
+        "mongoose;VirtualType;mongoose;TVirtualPathFN;Argument[1]", //
+        "mongoose;VirtualType;mongoose;VirtualType;Member[get,set].Argument[0].Argument[1]", //
+        "mongoose;VirtualType;mongoose;VirtualType;Member[get,set].ReturnValue", //
+        "mongoose;VirtualType;mongoose;VirtualTypeStatic;Instance", //
+        "mongoose;VirtualTypeOptions;mongoose;VirtualPathFunctions;Member[options]", //
+        "mongoose;VirtualTypeStatic;mongoose;;Member[VirtualType]", //
+      ]
+  }
+}
+
+private class Summaries extends ModelInput::SummaryModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "mongodb;AbstractCursor;;;Member[addCursorFlag,batchSize,maxTimeMS,withReadConcern,withReadPreference].ReturnValue;type", //
+        "mongodb;BulkOperationBase;;;Member[addToOperationsList,raw].ReturnValue;type", //
+        "mongodb;FindCursor;;;Member[addQueryModifier,allowDiskUse,collation,comment,filter,hint,limit,max,maxAwaitTimeMS,maxTimeMS,min,returnKey,showRecordId,skip,sort].ReturnValue;type", //
+        "mongodb;FindOperators;;;Member[arrayFilters,collation,upsert].ReturnValue;type", //
+        "mongodb;GridFSBucketWriteStream;;;Member[end].ReturnValue;type", //
+        "mongodb;MongoClient;;;Member[connect].Argument[0].TypeVar[mongodb.Callback.0];type", //
+        "mongodb;MongoClient;;;Member[connect].WithArity[0].ReturnValue.Awaited;type", //
+        "mongodb;OrderedBulkOperation;;;Member[addToOperationsList].ReturnValue;type", //
+        "mongodb;TypedEventEmitter;;;Member[addListener,off,on,once,prependListener,prependOnceListener,removeAllListeners,removeListener,setMaxListeners].ReturnValue;type", //
+        "mongodb;UnorderedBulkOperation;;;Member[addToOperationsList].ReturnValue;type", //
+        "mongoose;Aggregate;;;Member[addCursorFlag,addFields,allowDiskUse,append,collation,count,facet,graphLookup,group,hint,limit,lookup,match,model,near,option,project,read,readConcern,redact,replaceRoot,sample,search,session,skip,sort,sortByCount,unionWith,unwind].ReturnValue;type", //
+        "mongoose;Connection;;;Member[asPromise].ReturnValue.Awaited;type", //
+        "mongoose;Connection;;;Member[deleteModel,setClient].ReturnValue;type", //
+        "mongoose;Cursor;;;Member[addCursorFlag].ReturnValue;type", //
+        "mongoose;Document;;;Member[$inc,$set,depopulate,increment,init,overwrite,set].ReturnValue;type", //
+        "mongoose;Document;;;Member[delete,deleteOne].WithArity[0,1].ReturnValue.TypeVar[mongoose.QueryWithHelpers.1];type", //
+        "mongoose;Document;;;Member[getChanges].ReturnValue.TypeVar[mongoose.UpdateQuery.0];type", //
+        "mongoose;Document;;;Member[init].Argument[2].TypeVar[mongoose.Callback.0];type", //
+        "mongoose;Document;;;Member[populate].Argument[1,5].TypeVar[mongoose.Callback.0].TypeVar[mongoose.MergeType.0];type", //
+        "mongoose;Document;;;Member[populate].WithArity[1,2,3,4,5].ReturnValue.Awaited.TypeVar[mongoose.MergeType.0];type", //
+        "mongoose;Document;;;Member[remove,save].WithArity[0,1].ReturnValue.Awaited;type", //
+        "mongoose;Document;;;Member[replaceOne,update,updateOne].ReturnValue.TypeVar[mongoose.Query.1];type", //
+        "mongoose;Document;;;Member[save].Argument[1].TypeVar[mongoose.Callback.0];type", //
+        "mongoose;Document;;;Member[save].WithArity[1].Argument[0].TypeVar[mongoose.Callback.0];type", //
+        "mongoose;Document;;;Member[update,updateOne].Argument[0].TypeVar[mongoose.UpdateQuery.0];type", //
+        "mongoose;Query;;;Member[all,allowDiskUse,and,batchSize,box,circle,clone,collation,comment,elemMatch,equals,exists,explain,geometry,gt,gte,hint,in,intersects,j,limit,lt,lte,maxDistance,maxScan,maxTimeMS,merge,mod,ne,near,nin,nor,or,polygon,read,readConcern,regex,select,session,set,setOptions,size,skip,slice,snapshot,sort,tailable,w,where,within,wtimeout].ReturnValue;type", //
+        "mongoose;Query;;;Member[error].WithArity[1].ReturnValue;type", //
+        "mongoose;Schema.Types.Array;;;Member[enum].ReturnValue;type", //
+        "mongoose;SessionOperation;;;Member[session].ReturnValue;type", //
+        "mongoose;Types.Array;;;Member[pull,remove,set].ReturnValue;type", //
+        "mongoose;Types.ObjectId;;;Member[_id];type", //
+        "mongoose;VirtualType;;;Member[get,set].ReturnValue;type", //
+      ]
+  }
+}
+
+private class TypeVariables extends ModelInput::TypeVariableModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "mongodb.Callback.0;Argument[1]", //
+        "mongoose.Callback.0;Argument[1]", //
+        "mongoose.Cursor.0;Member[eachAsync].WithArity[1,2,3].Argument[0].Argument[0]", //
+        "mongoose.Cursor.0;Member[eachAsync].WithArity[2,3].Argument[0].Argument[0].ArrayElement", //
+        "mongoose.Cursor.0;Member[map].Argument[0].Argument[0]", //
+        "mongoose.Cursor.0;Member[next].Argument[0].TypeVar[mongoose.Callback.0]", //
+        "mongoose.Cursor.0;Member[next].WithArity[0].ReturnValue.Awaited", //
+        "mongoose.Cursor.1;Member[map].ReturnValue.TypeVar[mongoose.Cursor.1]", //
+        "mongoose.Cursor.1;Member[options]", //
+        "mongoose.DiscriminatorSchema.1;TypeVar[mongoose.Schema.1]", //
+        "mongoose.DiscriminatorSchema.1;TypeVar[mongoose.Schema.1].TypeVar[mongoose.DiscriminatorModel.1]", //
+        "mongoose.Document.0;Member[_id]", //
+        "mongoose.Document.0;Member[equals].Argument[0].TypeVar[mongoose.Document.0]", //
+        "mongoose.FilterQuery.0;TypeVar[mongoose._FilterQuery.0]", //
+        "mongoose.IfAny.1;", //
+        "mongoose.IfAny.2;", //
+        "mongoose.IfEquals.3;", //
+        "mongoose.LeanDocumentOrArray.0;", //
+        "mongoose.LeanDocumentOrArray.0;TypeVar[mongoose.LeanDocument.0]", //
+        "mongoose.LeanDocumentOrArrayWithRawType.0;", //
+        "mongoose.ModifyResult.0;Member[value].TypeVar[mongoose.Require_id.0]", //
+        "mongoose.PluginFunction.1;Argument[0].TypeVar[mongoose.Schema.1]", //
+        "mongoose.PostMiddlewareFunction.1;Argument[0]", //
+        "mongoose.Query.0;Member[exec].Argument[0].TypeVar[mongoose.Callback.0]", //
+        "mongoose.Query.0;Member[exec].WithArity[0].ReturnValue.Awaited", //
+        "mongoose.Query.0;Member[lean].ReturnValue.TypeVar[mongoose.QueryWithHelpers.0].TypeVar[mongoose.LeanDocumentOrArray.0,mongoose.LeanDocumentOrArrayWithRawType.0]", //
+        "mongoose.Query.0;Member[orFail].ReturnValue.TypeVar[mongoose.QueryWithHelpers.0]", //
+        "mongoose.Query.0;Member[populate].ReturnValue.TypeVar[mongoose.QueryWithHelpers.0].TypeVar[mongoose.UnpackedIntersection.0]", //
+        "mongoose.Query.0;Member[then,transform].Argument[0].Argument[0]", //
+        "mongoose.Query.0;Member[toConstructor].ReturnValue.Instance.TypeVar[mongoose.QueryWithHelpers.0]", //
+        "mongoose.Query.1;Member[$where,count,countDocuments,deleteMany,deleteOne,distinct,estimatedDocumentCount,find,lean,orFail,populate,replaceOne,transform,update,updateMany,updateOne].ReturnValue.TypeVar[mongoose.QueryWithHelpers.1]", //
+        "mongoose.Query.1;Member[$where,find].ReturnValue.TypeVar[mongoose.QueryWithHelpers.0].ArrayElement", //
+        "mongoose.Query.1;Member[_mongooseOptions].TypeVar[mongoose.MongooseQueryOptions.0]", //
+        "mongoose.Query.1;Member[and,nor,or].Argument[0].ArrayElement.TypeVar[mongoose.FilterQuery.0]", //
+        "mongoose.Query.1;Member[countDocuments,findByIdAndDelete,findOneAndDelete,findOneAndRemove].Argument[1].TypeVar[mongoose.QueryOptions.0]", //
+        "mongoose.Query.1;Member[countDocuments].WithArity[1,2,3].Argument[0].TypeVar[mongoose.FilterQuery.0]", //
+        "mongoose.Query.1;Member[count].WithArity[1,2].Argument[0].TypeVar[mongoose.FilterQuery.0]", //
+        "mongoose.Query.1;Member[cursor,estimatedDocumentCount,setOptions].Argument[0].TypeVar[mongoose.QueryOptions.0]", //
+        "mongoose.Query.1;Member[cursor].ReturnValue.TypeVar[mongoose.Cursor.0]", //
+        "mongoose.Query.1;Member[cursor].ReturnValue.TypeVar[mongoose.Cursor.1].TypeVar[mongoose.QueryOptions.0]", //
+        "mongoose.Query.1;Member[deleteMany,deleteOne].WithArity[0,1,2,3].Argument[0].TypeVar[mongoose.FilterQuery.0]", //
+        "mongoose.Query.1;Member[deleteMany,deleteOne].WithArity[0,1,2,3].Argument[1].TypeVar[mongoose.QueryOptions.0]", //
+        "mongoose.Query.1;Member[distinct].Argument[1].TypeVar[mongoose.FilterQuery.0]", //
+        "mongoose.Query.1;Member[findByIdAndDelete,findOne,findOneAndDelete,findOneAndRemove].ReturnValue.TypeVar[mongoose.QueryWithHelpers.0,mongoose.QueryWithHelpers.1]", //
+        "mongoose.Query.1;Member[findByIdAndDelete,findOneAndDelete,findOneAndRemove].Argument[2].Argument[1]", //
+        "mongoose.Query.1;Member[findByIdAndUpdate,findOneAndUpdate,update,updateMany,updateOne].Argument[1].TypeVar[mongoose.UpdateQuery.0]", //
+        "mongoose.Query.1;Member[findByIdAndUpdate,findOneAndUpdate].WithArity[0,1,2,3,4].Argument[2].TypeVar[mongoose.QueryOptions.0]", //
+        "mongoose.Query.1;Member[findByIdAndUpdate,findOneAndUpdate].WithArity[0,1,2,3,4].ReturnValue.TypeVar[mongoose.QueryWithHelpers.0,mongoose.QueryWithHelpers.1]", //
+        "mongoose.Query.1;Member[findByIdAndUpdate].WithArity[0,1,2,4].Argument[3].Argument[1]", //
+        "mongoose.Query.1;Member[findByIdAndUpdate].WithArity[3].Argument[2,3].Argument[1]", //
+        "mongoose.Query.1;Member[findOne,findOneAndDelete,findOneAndRemove,findOneAndUpdate,merge,remove,replaceOne,setQuery,update,updateMany,updateOne].Argument[0].TypeVar[mongoose.FilterQuery.0]", //
+        "mongoose.Query.1;Member[findOneAndUpdate].Argument[3].Argument[1]", //
+        "mongoose.Query.1;Member[findOneAndUpdate].Argument[3].Argument[2].TypeVar[mongoose.ModifyResult.0]", //
+        "mongoose.Query.1;Member[findOneAndUpdate].WithArity[3,4].ReturnValue.TypeVar[mongoose.QueryWithHelpers.0].TypeVar[mongoose.ModifyResult.0]", //
+        "mongoose.Query.1;Member[findOne].Argument[3].TypeVar[mongoose.Callback.0]", //
+        "mongoose.Query.1;Member[findOne].WithArity[0,1,2,3].Argument[2].TypeVar[mongoose.Callback.0,mongoose.QueryOptions.0]", //
+        "mongoose.Query.1;Member[findOne].WithArity[0,1,2].Argument[1].TypeVar[mongoose.Callback.0,mongoose.ProjectionType.0]", //
+        "mongoose.Query.1;Member[findOne].WithArity[3,4].Argument[1].TypeVar[mongoose.ProjectionType.0]", //
+        "mongoose.Query.1;Member[findOne].WithArity[4].Argument[2].TypeVar[mongoose.QueryOptions.0]", //
+        "mongoose.Query.1;Member[find].Argument[3].TypeVar[mongoose.Callback.0].ArrayElement", //
+        "mongoose.Query.1;Member[find].WithArity[0].Argument[0].TypeVar[mongoose.Callback.0].ArrayElement", //
+        "mongoose.Query.1;Member[find].WithArity[1,2,3,4].Argument[0].TypeVar[mongoose.FilterQuery.0]", //
+        "mongoose.Query.1;Member[find].WithArity[1,2,3,4].Argument[1].TypeVar[mongoose.ProjectionType.0]", //
+        "mongoose.Query.1;Member[find].WithArity[1,2,3,4].Argument[2].TypeVar[mongoose.QueryOptions.0]", //
+        "mongoose.Query.1;Member[find].WithArity[1].Argument[0,1,2].TypeVar[mongoose.Callback.0].ArrayElement", //
+        "mongoose.Query.1;Member[find].WithArity[2].Argument[1,2].TypeVar[mongoose.Callback.0].ArrayElement", //
+        "mongoose.Query.1;Member[find].WithArity[3].Argument[2].TypeVar[mongoose.Callback.0].ArrayElement", //
+        "mongoose.Query.1;Member[getFilter,getQuery].ReturnValue.TypeVar[mongoose.FilterQuery.0]", //
+        "mongoose.Query.1;Member[getOptions].ReturnValue.TypeVar[mongoose.QueryOptions.0]", //
+        "mongoose.Query.1;Member[getUpdate].ReturnValue.TypeVar[mongoose.UpdateQuery.0]", //
+        "mongoose.Query.1;Member[projection].WithArity[0,1].Argument[0].TypeVar[mongoose.ProjectionFields.0]", //
+        "mongoose.Query.1;Member[projection].WithArity[0,1].ReturnValue.TypeVar[mongoose.ProjectionFields.0]", //
+        "mongoose.Query.1;Member[remove].ReturnValue.TypeVar[mongoose.Query.1]", //
+        "mongoose.Query.1;Member[replaceOne,update,updateMany,updateOne].Argument[2].TypeVar[mongoose.QueryOptions.0]", //
+        "mongoose.Query.1;Member[replaceOne].Argument[1]", //
+        "mongoose.Query.1;Member[setUpdate].Argument[0].TypeVar[mongoose.UpdateQuery.0]", //
+        "mongoose.Query.1;Member[toConstructor].ReturnValue.Instance.TypeVar[mongoose.QueryWithHelpers.1]", //
+        "mongoose.QueryOptions.0;Member[projection].TypeVar[mongoose.ProjectionType.0]", //
+        "mongoose.QueryWithHelpers.0;TypeVar[mongoose.Query.0]", //
+        "mongoose.QueryWithHelpers.1;TypeVar[mongoose.Query.1]", //
+        "mongoose.Require_id.0;", //
+        "mongoose.Require_id.0;TypeVar[mongoose.IfAny.1,mongoose.IfAny.2]", //
+        "mongoose.RootQuerySelector.0;Member[$and,$nor,$or].ArrayElement.TypeVar[mongoose.FilterQuery.0]", //
+        "mongoose.Schema.1;Member[discriminator].ReturnValue.TypeVar[mongoose.DiscriminatorSchema.1]", //
+        "mongoose.Schema.1;Member[plugin].Argument[0].TypeVar[mongoose.PluginFunction.1]", //
+        "mongoose.Schema.1;Member[post].Argument[2].TypeVar[mongoose.ErrorHandlingMiddlewareFunction.0,mongoose.PostMiddlewareFunction.0,mongoose.PostMiddlewareFunction.1]", //
+        "mongoose.Schema.1;Member[post].WithArity[2].WithStringArgument[0=insertMany].Argument[1].TypeVar[mongoose.ErrorHandlingMiddlewareFunction.0,mongoose.PostMiddlewareFunction.0,mongoose.PostMiddlewareFunction.1]", //
+        "mongoose.Types.Array.0;Member[$pop,$shift,shift].ReturnValue", //
+        "mongoose.Types.Array.0;Member[set].Argument[1]", //
+        "mongoose.Types.DocumentArray.0;Member[create,id].ReturnValue", //
+        "mongoose.Types.DocumentArray.0;Member[create,id].ReturnValue.TypeVar[mongoose.Types.Subdocument.0].TypeVar[mongoose.InferId.0]", //
+        "mongoose.Types.DocumentArray.0;Member[push].Argument[0].ArrayElement.TypeVar[mongoose.AnyKeys.0]", //
+        "mongoose.Types.DocumentArray.0;TypeVar[mongoose.Types.Array.0]", //
+        "mongoose.Types.DocumentArray.0;TypeVar[mongoose.Types.Array.0].TypeVar[mongoose.Types.Subdocument.0].TypeVar[mongoose.InferId.0]", //
+        "mongoose.Types.Subdocument.0;TypeVar[mongoose.Document.0]", //
+        "mongoose.UnpackedIntersection.0;", //
+        "mongoose.UpdateQuery.0;TypeVar[mongoose._UpdateQuery.0].TypeVar[mongoose._UpdateQueryDef.0]", //
+        "mongoose.VirtualType.0;Member[get,set].Argument[0].Argument[1].TypeVar[mongoose.VirtualType.0]", //
+        "mongoose.VirtualType.0;Member[get,set].Argument[0].Argument[2]", //
+        "mongoose.VirtualTypeOptions.0;Member[foreignField,localField].Argument[0]", //
+        "mongoose._FilterQuery.0;TypeVar[mongoose.RootQuerySelector.0]", //
+        "mongoose._UpdateQuery.0;Member[$currentDate,$inc,$max,$min,$mul,$pop,$pull,$pullAll,$push,$set,$setOnInsert,$unset].TypeVar[mongoose.AnyKeys.0]", //
+      ]
+  }
+}

javascript/ql/lib/semmle/javascript/frameworks/mongodb/model.json

@@ -0,0 +1,818 @@
+{
+    "packages": {
+        "mongodb": "4.6.0",
+        "mongoose": "6.5.2"
+    },
+    "resolutions": {
+        "base64-js": "1.5.1",
+        "bson": "4.6.4",
+        "buffer": "5.7.1",
+        "denque": "2.0.1",
+        "ieee754": "1.2.1",
+        "sift": "16.0.0",
+        "smart-buffer": "4.2.0",
+        "socks": "2.6.2"
+    },
+    "language": "javascript",
+    "replaceTypeParameters": [
+        "mongoose;HydratedDocument;0;mongoose;Document",
+        "mongoose;HydratedDocument;0;mongoose;Query"
+    ],
+    "usedTypes": {
+        "sinks": [
+            "mongoose;ConnectOptions",
+            "mongodb;Auth"
+        ]
+    },
+    "ignoredTypes": {
+        "sourcesAndSinks": [
+            "mongoose;Schema",
+            "mongoose;SchemaType",
+            "mongoose;SchemaTypeOptions"
+        ]
+    },
+    "model": {
+        "sinks": [
+            "mongodb;Collection;Member[aggregate,count,countDocuments,deleteMany,deleteOne,find,findOne,findOneAndDelete,findOneAndReplace,remove,replaceOne,watch].Argument[0];mongodb.sink",
+            "mongodb;Collection;Member[distinct].Argument[1];mongodb.sink",
+            "mongodb;Collection;Member[findOneAndUpdate,update,updateMany,updateOne].Argument[0,1];mongodb.sink",
+            "mongodb;Db;Member[aggregate,watch].Argument[0];mongodb.sink",
+            "mongodb;DeleteManyModel;Member[filter];mongodb.sink",
+            "mongodb;DeleteOneModel;Member[filter];mongodb.sink",
+            "mongodb;MongoClient;Member[watch].Argument[0];mongodb.sink",
+            "mongodb;UpdateManyModel;Member[filter,update];mongodb.sink",
+            "mongodb;UpdateOneModel;Member[filter,update];mongodb.sink",
+            "mongoose;CollectionBase;Member[findAndModify].Argument[0];mongodb.sink",
+            "mongoose;Connection;Member[watch].Argument[0];mongodb.sink",
+            "mongoose;Document;Member[update,updateOne].Argument[0];mongodb.sink",
+            "mongoose;Model;Member[$where,aggregate,exists,find,findById,findByIdAndDelete,findByIdAndRemove,findOne,findOneAndDelete,findOneAndRemove,findOneAndReplace,geoSearch,remove,replaceOne,watch].Argument[0];mongodb.sink",
+            "mongoose;Model;Member[count,where].WithArity[1,2].Argument[0];mongodb.sink",
+            "mongoose;Model;Member[countDocuments].WithArity[1,2,3].Argument[0];mongodb.sink",
+            "mongoose;Model;Member[deleteMany,deleteOne].WithArity[0,1,2,3].Argument[0];mongodb.sink",
+            "mongoose;Model;Member[distinct,where].Argument[1];mongodb.sink",
+            "mongoose;Model;Member[findByIdAndUpdate,findOneAndUpdate,update,updateMany,updateOne].Argument[0,1];mongodb.sink",
+            "mongoose;Model;Member[find].WithArity[1,2,3,4].Argument[0];mongodb.sink",
+            "mongoose;Query;Member[$where,and,find,findByIdAndDelete,findOne,findOneAndDelete,findOneAndRemove,nor,or,remove,replaceOne,setUpdate].Argument[0];mongodb.sink",
+            "mongoose;Query;Member[count,where].WithArity[1,2].Argument[0];mongodb.sink",
+            "mongoose;Query;Member[deleteMany,deleteOne].WithArity[0,1,2,3].Argument[0];mongodb.sink",
+            "mongoose;Query;Member[distinct,where].Argument[1];mongodb.sink",
+            "mongoose;Query;Member[findByIdAndUpdate,findOneAndUpdate,update,updateMany,updateOne].Argument[0,1];mongodb.sink",
+            "mongoose;Query;Member[find].WithArity[1,2,3,4].Argument[0];mongodb.sink",
+            "mongoose;QueryStatic;Argument[2];mongodb.sink"
+        ]
+    },
+    "generatedModel": {
+        "//": "Autogenerated section. Manual edits in here will be lost.",
+        "typeDefinitions": [
+            "mongodb;;mongoose;;Member[mongodb]",
+            "mongodb;AbstractCursor;mongodb;FindCursor;",
+            "mongodb;AbstractCursor;mongodb;ListCollectionsCursor;",
+            "mongodb;AbstractCursor;mongodb;ListIndexesCursor;",
+            "mongodb;AbstractCursorOptions;mongodb/mongodb;AbstractCursorOptions;",
+            "mongodb;AbstractCursorOptions;mongodb;AggregationCursorOptions;",
+            "mongodb;AbstractCursorOptions;mongoose;mongodb.AbstractCursorOptions;",
+            "mongodb;AddUserOptions;mongodb/mongodb;AddUserOptions;",
+            "mongodb;AddUserOptions;mongodb;Admin;Member[addUser].Argument[1,2]",
+            "mongodb;AddUserOptions;mongodb;Db;Member[addUser].Argument[1,2]",
+            "mongodb;AddUserOptions;mongoose;mongodb.AddUserOptions;",
+            "mongodb;Admin;mongodb/mongodb;Admin;",
+            "mongodb;Admin;mongodb;AdminStatic;Instance",
+            "mongodb;Admin;mongodb;Db;Member[admin].ReturnValue",
+            "mongodb;Admin;mongoose;mongodb.Admin;",
+            "mongodb;AdminStatic;mongodb/mongodb;AdminStatic;",
+            "mongodb;AdminStatic;mongodb;;Member[Admin]",
+            "mongodb;AdminStatic;mongoose;mongodb.AdminStatic;",
+            "mongodb;AggregateOptions;mongodb/mongodb;AggregateOptions;",
+            "mongodb;AggregateOptions;mongodb;AggregationCursorOptions;",
+            "mongodb;AggregateOptions;mongodb;ChangeStreamOptions;",
+            "mongodb;AggregateOptions;mongodb;Collection;Member[aggregate].Argument[1]",
+            "mongodb;AggregateOptions;mongodb;CountDocumentsOptions;",
+            "mongodb;AggregateOptions;mongodb;Db;Member[aggregate].Argument[1]",
+            "mongodb;AggregateOptions;mongoose;mongodb.AggregateOptions;",
+            "mongodb;AggregationCursorOptions;mongodb/mongodb;AggregationCursorOptions;",
+            "mongodb;AggregationCursorOptions;mongoose;mongodb.AggregationCursorOptions;",
+            "mongodb;AnyBulkWriteOperation;mongodb/mongodb;AnyBulkWriteOperation;",
+            "mongodb;AnyBulkWriteOperation;mongodb;BulkOperationBase;Member[raw].Argument[0]",
+            "mongodb;AnyBulkWriteOperation;mongodb;Collection;Member[bulkWrite].Argument[0].ArrayElement",
+            "mongodb;AnyBulkWriteOperation;mongoose;mongodb.AnyBulkWriteOperation;",
+            "mongodb;Auth;mongodb/mongodb;Auth;",
+            "mongodb;Auth;mongodb;MongoClientOptions;Member[auth]",
+            "mongodb;Auth;mongoose;mongodb.Auth;",
+            "mongodb;AutoEncrypter;mongodb/mongodb;AutoEncrypter;",
+            "mongodb;AutoEncrypter;mongodb;AutoEncrypter;Instance",
+            "mongodb;AutoEncrypter;mongodb;ConnectionOptions;Member[autoEncrypter]",
+            "mongodb;AutoEncrypter;mongodb;MongoClient;Member[autoEncrypter]",
+            "mongodb;AutoEncrypter;mongodb;MongoOptions;Member[autoEncrypter]",
+            "mongodb;AutoEncrypter;mongoose;mongodb.AutoEncrypter;",
+            "mongodb;AutoEncryptionOptions;mongodb/mongodb;AutoEncryptionOptions;",
+            "mongodb;AutoEncryptionOptions;mongodb;AutoEncrypter;Argument[1]",
+            "mongodb;AutoEncryptionOptions;mongodb;MongoClientOptions;Member[autoEncryption]",
+            "mongodb;AutoEncryptionOptions;mongoose;mongodb.AutoEncryptionOptions;",
+            "mongodb;BulkOperationBase;mongodb/mongodb;BulkOperationBase;",
+            "mongodb;BulkOperationBase;mongodb;BulkOperationBase;Member[addToOperationsList,insert,raw].ReturnValue",
+            "mongodb;BulkOperationBase;mongodb;BulkOperationBaseStatic;Instance",
+            "mongodb;BulkOperationBase;mongodb;FindOperators;Member[bulkOperation]",
+            "mongodb;BulkOperationBase;mongodb;FindOperators;Member[delete,deleteOne,replaceOne,update,updateOne].ReturnValue",
+            "mongodb;BulkOperationBase;mongodb;OrderedBulkOperation;",
+            "mongodb;BulkOperationBase;mongodb;UnorderedBulkOperation;",
+            "mongodb;BulkOperationBase;mongoose;mongodb.BulkOperationBase;",
+            "mongodb;BulkOperationBaseStatic;mongodb/mongodb;BulkOperationBaseStatic;",
+            "mongodb;BulkOperationBaseStatic;mongodb;;Member[BulkOperationBase]",
+            "mongodb;BulkOperationBaseStatic;mongoose;mongodb.BulkOperationBaseStatic;",
+            "mongodb;BulkWriteOptions;mongodb/mongodb;BulkWriteOptions;",
+            "mongodb;BulkWriteOptions;mongodb;BulkOperationBase;Member[execute].WithArity[0,1,2].Argument[0]",
+            "mongodb;BulkWriteOptions;mongodb;Collection;Member[bulkWrite,insert,insertMany].Argument[1]",
+            "mongodb;BulkWriteOptions;mongodb;Collection;Member[initializeOrderedBulkOp,initializeUnorderedBulkOp].Argument[0]",
+            "mongodb;BulkWriteOptions;mongodb;OrderedBulkOperationStatic;Argument[1]",
+            "mongodb;BulkWriteOptions;mongodb;UnorderedBulkOperationStatic;Argument[1]",
+            "mongodb;BulkWriteOptions;mongoose;mongodb.BulkWriteOptions;",
+            "mongodb;ChangeStream;mongodb/mongodb;ChangeStream;",
+            "mongodb;ChangeStream;mongodb;ChangeStreamStatic;Instance",
+            "mongodb;ChangeStream;mongodb;Collection;Member[watch].ReturnValue",
+            "mongodb;ChangeStream;mongodb;Db;Member[watch].ReturnValue",
+            "mongodb;ChangeStream;mongodb;MongoClient;Member[watch].ReturnValue",
+            "mongodb;ChangeStream;mongoose;mongodb.ChangeStream;",
+            "mongodb;ChangeStreamOptions;mongodb/mongodb;ChangeStreamOptions;",
+            "mongodb;ChangeStreamOptions;mongodb;ChangeStream;Member[options]",
+            "mongodb;ChangeStreamOptions;mongodb;Collection;Member[watch].Argument[1]",
+            "mongodb;ChangeStreamOptions;mongodb;Db;Member[watch].Argument[1]",
+            "mongodb;ChangeStreamOptions;mongodb;MongoClient;Member[watch].Argument[1]",
+            "mongodb;ChangeStreamOptions;mongoose;mongodb.ChangeStreamOptions;",
+            "mongodb;ChangeStreamStatic;mongodb/mongodb;ChangeStreamStatic;",
+            "mongodb;ChangeStreamStatic;mongodb;;Member[ChangeStream]",
+            "mongodb;ChangeStreamStatic;mongoose;mongodb.ChangeStreamStatic;",
+            "mongodb;ClientSession;mongodb/mongodb;ClientSession;",
+            "mongodb;ClientSession;mongodb;AbstractCursorOptions;Member[session]",
+            "mongodb;ClientSession;mongodb;ClientSession;Member[equals].Argument[0]",
+            "mongodb;ClientSession;mongodb;ClientSessionEvents;Member[ended].Argument[0]",
+            "mongodb;ClientSession;mongodb;ClientSessionStatic;Instance",
+            "mongodb;ClientSession;mongodb;IndexInformationOptions;Member[session]",
+            "mongodb;ClientSession;mongodb;MongoClient;Member[startSession].ReturnValue",
+            "mongodb;ClientSession;mongodb;OperationOptions;Member[session]",
+            "mongodb;ClientSession;mongodb;ReadPreferenceFromOptions;Member[session]",
+            "mongodb;ClientSession;mongodb;SelectServerOptions;Member[session]",
+            "mongodb;ClientSession;mongodb;WithSessionCallback;Argument[0]",
+            "mongodb;ClientSession;mongodb;WithTransactionCallback;Argument[0]",
+            "mongodb;ClientSession;mongoose;mongodb.ClientSession;",
+            "mongodb;ClientSessionEvents;mongodb/mongodb;ClientSessionEvents;",
+            "mongodb;ClientSessionEvents;mongoose;mongodb.ClientSessionEvents;",
+            "mongodb;ClientSessionOptions;mongodb/mongodb;ClientSessionOptions;",
+            "mongodb;ClientSessionOptions;mongodb;MongoClient;Member[startSession].Argument[0]",
+            "mongodb;ClientSessionOptions;mongodb;MongoClient;Member[withSession].WithArity[2].Argument[0]",
+            "mongodb;ClientSessionOptions;mongoose;mongodb.ClientSessionOptions;",
+            "mongodb;ClientSessionStatic;mongodb/mongodb;ClientSessionStatic;",
+            "mongodb;ClientSessionStatic;mongodb;;Member[ClientSession]",
+            "mongodb;ClientSessionStatic;mongoose;mongodb.ClientSessionStatic;",
+            "mongodb;CollStatsOptions;mongodb/mongodb;CollStatsOptions;",
+            "mongodb;CollStatsOptions;mongodb;Collection;Member[stats].Argument[0]",
+            "mongodb;CollStatsOptions;mongoose;mongodb.CollStatsOptions;",
+            "mongodb;Collection;mongodb/mongodb;Collection;",
+            "mongodb;Collection;mongodb;ChangeStream;Member[parent]",
+            "mongodb;Collection;mongodb;Collection;Member[rename].Argument[1,2].TypeVar[mongodb.Callback.0]",
+            "mongodb;Collection;mongodb;Collection;Member[rename].WithArity[1,2].ReturnValue.Awaited",
+            "mongodb;Collection;mongodb;CollectionStatic;Instance",
+            "mongodb;Collection;mongodb;Db;Member[collection].ReturnValue",
+            "mongodb;Collection;mongodb;Db;Member[collections].Argument[0,1].TypeVar[mongodb.Callback.0].ArrayElement",
+            "mongodb;Collection;mongodb;Db;Member[collections].WithArity[0,1].ReturnValue.Awaited.ArrayElement",
+            "mongodb;Collection;mongodb;Db;Member[createCollection].Argument[2].TypeVar[mongodb.Callback.0]",
+            "mongodb;Collection;mongodb;Db;Member[createCollection].WithArity[1,2].ReturnValue.Awaited",
+            "mongodb;Collection;mongodb;Db;Member[createCollection].WithArity[2].Argument[1].TypeVar[mongodb.Callback.0]",
+            "mongodb;Collection;mongodb;Db;Member[renameCollection].Argument[2,3].TypeVar[mongodb.Callback.0]",
+            "mongodb;Collection;mongodb;Db;Member[renameCollection].WithArity[2,3].ReturnValue.Awaited",
+            "mongodb;Collection;mongodb;GridFSBucketWriteStream;Member[chunks,files]",
+            "mongodb;Collection;mongodb;ListIndexesCursor;Member[parent]",
+            "mongodb;Collection;mongodb;ListIndexesCursorStatic;Argument[0]",
+            "mongodb;Collection;mongodb;OrderedBulkOperationStatic;Argument[0]",
+            "mongodb;Collection;mongodb;UnorderedBulkOperationStatic;Argument[0]",
+            "mongodb;Collection;mongoose;mongodb.Collection;",
+            "mongodb;CollectionStatic;mongodb/mongodb;CollectionStatic;",
+            "mongodb;CollectionStatic;mongodb;;Member[Collection]",
+            "mongodb;CollectionStatic;mongoose;mongodb.CollectionStatic;",
+            "mongodb;CommandOperationOptions;mongodb/mongodb;CommandOperationOptions;",
+            "mongodb;CommandOperationOptions;mongodb;AddUserOptions;",
+            "mongodb;CommandOperationOptions;mongodb;Admin;Member[buildInfo,ping,replSetGetStatus,serverInfo,serverStatus].Argument[0]",
+            "mongodb;CommandOperationOptions;mongodb;AggregateOptions;",
+            "mongodb;CommandOperationOptions;mongodb;BulkWriteOptions;",
+            "mongodb;CommandOperationOptions;mongodb;CollStatsOptions;",
+            "mongodb;CommandOperationOptions;mongodb;CountOptions;",
+            "mongodb;CommandOperationOptions;mongodb;CreateCollectionOptions;",
+            "mongodb;CommandOperationOptions;mongodb;CreateIndexesOptions;",
+            "mongodb;CommandOperationOptions;mongodb;DbStatsOptions;",
+            "mongodb;CommandOperationOptions;mongodb;DeleteOptions;",
+            "mongodb;CommandOperationOptions;mongodb;DistinctOptions;",
+            "mongodb;CommandOperationOptions;mongodb;DropCollectionOptions;",
+            "mongodb;CommandOperationOptions;mongodb;DropDatabaseOptions;",
+            "mongodb;CommandOperationOptions;mongodb;DropIndexesOptions;",
+            "mongodb;CommandOperationOptions;mongodb;EstimatedDocumentCountOptions;",
+            "mongodb;CommandOperationOptions;mongodb;EvalOptions;",
+            "mongodb;CommandOperationOptions;mongodb;FindOneAndDeleteOptions;",
+            "mongodb;CommandOperationOptions;mongodb;FindOneAndReplaceOptions;",
+            "mongodb;CommandOperationOptions;mongodb;FindOneAndUpdateOptions;",
+            "mongodb;CommandOperationOptions;mongodb;FindOptions;",
+            "mongodb;CommandOperationOptions;mongodb;InsertOneOptions;",
+            "mongodb;CommandOperationOptions;mongodb;ListCollectionsOptions;",
+            "mongodb;CommandOperationOptions;mongodb;ListDatabasesOptions;",
+            "mongodb;CommandOperationOptions;mongodb;ListIndexesOptions;",
+            "mongodb;CommandOperationOptions;mongodb;MapReduceOptions;",
+            "mongodb;CommandOperationOptions;mongodb;ProfilingLevelOptions;",
+            "mongodb;CommandOperationOptions;mongodb;RemoveUserOptions;",
+            "mongodb;CommandOperationOptions;mongodb;RenameOptions;",
+            "mongodb;CommandOperationOptions;mongodb;ReplaceOptions;",
+            "mongodb;CommandOperationOptions;mongodb;RunCommandOptions;",
+            "mongodb;CommandOperationOptions;mongodb;SetProfilingLevelOptions;",
+            "mongodb;CommandOperationOptions;mongodb;TransactionOptions;",
+            "mongodb;CommandOperationOptions;mongodb;UpdateOptions;",
+            "mongodb;CommandOperationOptions;mongodb;ValidateCollectionOptions;",
+            "mongodb;CommandOperationOptions;mongoose;mongodb.CommandOperationOptions;",
+            "mongodb;ConnectionOptions;mongodb/mongodb;ConnectionOptions;",
+            "mongodb;ConnectionOptions;mongoose;mongodb.ConnectionOptions;",
+            "mongodb;CountDocumentsOptions;mongodb/mongodb;CountDocumentsOptions;",
+            "mongodb;CountDocumentsOptions;mongodb;Collection;Member[countDocuments].Argument[1]",
+            "mongodb;CountDocumentsOptions;mongoose;mongodb.CountDocumentsOptions;",
+            "mongodb;CountOptions;mongodb/mongodb;CountOptions;",
+            "mongodb;CountOptions;mongodb;Collection;Member[count].Argument[1]",
+            "mongodb;CountOptions;mongodb;FindCursor;Member[count].Argument[0]",
+            "mongodb;CountOptions;mongoose;mongodb.CountOptions;",
+            "mongodb;CreateCollectionOptions;mongodb/mongodb;CreateCollectionOptions;",
+            "mongodb;CreateCollectionOptions;mongodb;Db;Member[createCollection].WithArity[1,2,3].Argument[1]",
+            "mongodb;CreateCollectionOptions;mongoose;mongodb.CreateCollectionOptions;",
+            "mongodb;CreateIndexesOptions;mongodb/mongodb;CreateIndexesOptions;",
+            "mongodb;CreateIndexesOptions;mongodb;Collection;Member[createIndex,createIndexes].Argument[1]",
+            "mongodb;CreateIndexesOptions;mongodb;Db;Member[createIndex].Argument[2]",
+            "mongodb;CreateIndexesOptions;mongoose;mongodb.CreateIndexesOptions;",
+            "mongodb;Db;mongodb/mongodb;Db;",
+            "mongodb;Db;mongodb;ChangeStream;Member[parent]",
+            "mongodb;Db;mongodb;DbStatic;Instance",
+            "mongodb;Db;mongodb;GridFSBucketStatic;Argument[0]",
+            "mongodb;Db;mongodb;ListCollectionsCursor;Member[parent]",
+            "mongodb;Db;mongodb;ListCollectionsCursorStatic;Argument[0]",
+            "mongodb;Db;mongodb;MongoClient;Member[db].ReturnValue",
+            "mongodb;Db;mongoose;mongodb.Db;",
+            "mongodb;DbStatic;mongodb/mongodb;DbStatic;",
+            "mongodb;DbStatic;mongodb;;Member[Db]",
+            "mongodb;DbStatic;mongoose;mongodb.DbStatic;",
+            "mongodb;DbStatsOptions;mongodb/mongodb;DbStatsOptions;",
+            "mongodb;DbStatsOptions;mongodb;Db;Member[stats].Argument[0]",
+            "mongodb;DbStatsOptions;mongoose;mongodb.DbStatsOptions;",
+            "mongodb;DeleteManyModel;mongodb/mongodb;DeleteManyModel;",
+            "mongodb;DeleteManyModel;mongodb;AnyBulkWriteOperation;Member[deleteMany]",
+            "mongodb;DeleteManyModel;mongoose;mongodb.DeleteManyModel;",
+            "mongodb;DeleteOneModel;mongodb/mongodb;DeleteOneModel;",
+            "mongodb;DeleteOneModel;mongodb;AnyBulkWriteOperation;Member[deleteOne]",
+            "mongodb;DeleteOneModel;mongoose;mongodb.DeleteOneModel;",
+            "mongodb;DeleteOptions;mongodb/mongodb;DeleteOptions;",
+            "mongodb;DeleteOptions;mongodb;Collection;Member[deleteMany,deleteOne,remove].Argument[1]",
+            "mongodb;DeleteOptions;mongoose;mongodb.DeleteOptions;",
+            "mongodb;DistinctOptions;mongodb/mongodb;DistinctOptions;",
+            "mongodb;DistinctOptions;mongodb;Collection;Member[distinct].Argument[2]",
+            "mongodb;DistinctOptions;mongoose;mongodb.DistinctOptions;",
+            "mongodb;DropCollectionOptions;mongodb/mongodb;DropCollectionOptions;",
+            "mongodb;DropCollectionOptions;mongodb;Collection;Member[drop].Argument[0]",
+            "mongodb;DropCollectionOptions;mongodb;Db;Member[dropCollection].Argument[1]",
+            "mongodb;DropCollectionOptions;mongoose;mongodb.DropCollectionOptions;",
+            "mongodb;DropDatabaseOptions;mongodb/mongodb;DropDatabaseOptions;",
+            "mongodb;DropDatabaseOptions;mongodb;Db;Member[dropDatabase].Argument[0]",
+            "mongodb;DropDatabaseOptions;mongoose;mongodb.DropDatabaseOptions;",
+            "mongodb;DropIndexesOptions;mongodb/mongodb;DropIndexesOptions;",
+            "mongodb;DropIndexesOptions;mongodb;Collection;Member[dropIndex].Argument[1]",
+            "mongodb;DropIndexesOptions;mongodb;Collection;Member[dropIndexes].Argument[0]",
+            "mongodb;DropIndexesOptions;mongoose;mongodb.DropIndexesOptions;",
+            "mongodb;EstimatedDocumentCountOptions;mongodb/mongodb;EstimatedDocumentCountOptions;",
+            "mongodb;EstimatedDocumentCountOptions;mongodb;Collection;Member[estimatedDocumentCount].Argument[0]",
+            "mongodb;EstimatedDocumentCountOptions;mongoose;mongodb.EstimatedDocumentCountOptions;",
+            "mongodb;EvalOptions;mongodb/mongodb;EvalOptions;",
+            "mongodb;EvalOptions;mongoose;mongodb.EvalOptions;",
+            "mongodb;FindCursor;mongodb/mongodb;FindCursor;",
+            "mongodb;FindCursor;mongodb;Collection;Member[find].WithArity[0,1,2].ReturnValue",
+            "mongodb;FindCursor;mongodb;FindCursor;Member[addQueryModifier,allowDiskUse,clone,collation,comment,filter,hint,limit,map,max,maxAwaitTimeMS,maxTimeMS,min,project,returnKey,showRecordId,skip,sort].ReturnValue",
+            "mongodb;FindCursor;mongodb;FindCursorStatic;Instance",
+            "mongodb;FindCursor;mongodb;GridFSBucket;Member[find].ReturnValue",
+            "mongodb;FindCursor;mongoose;mongodb.FindCursor;",
+            "mongodb;FindCursorStatic;mongodb/mongodb;FindCursorStatic;",
+            "mongodb;FindCursorStatic;mongodb;;Member[FindCursor]",
+            "mongodb;FindCursorStatic;mongoose;mongodb.FindCursorStatic;",
+            "mongodb;FindOneAndDeleteOptions;mongodb/mongodb;FindOneAndDeleteOptions;",
+            "mongodb;FindOneAndDeleteOptions;mongodb;Collection;Member[findOneAndDelete].Argument[1]",
+            "mongodb;FindOneAndDeleteOptions;mongoose;mongodb.FindOneAndDeleteOptions;",
+            "mongodb;FindOneAndReplaceOptions;mongodb/mongodb;FindOneAndReplaceOptions;",
+            "mongodb;FindOneAndReplaceOptions;mongodb;Collection;Member[findOneAndReplace].Argument[2]",
+            "mongodb;FindOneAndReplaceOptions;mongoose;mongodb.FindOneAndReplaceOptions;",
+            "mongodb;FindOneAndUpdateOptions;mongodb/mongodb;FindOneAndUpdateOptions;",
+            "mongodb;FindOneAndUpdateOptions;mongodb;Collection;Member[findOneAndUpdate].Argument[2]",
+            "mongodb;FindOneAndUpdateOptions;mongoose;mongodb.FindOneAndUpdateOptions;",
+            "mongodb;FindOperators;mongodb/mongodb;FindOperators;",
+            "mongodb;FindOperators;mongodb;BulkOperationBase;Member[find].ReturnValue",
+            "mongodb;FindOperators;mongodb;FindOperators;Member[arrayFilters,collation,upsert].ReturnValue",
+            "mongodb;FindOperators;mongodb;FindOperatorsStatic;Instance",
+            "mongodb;FindOperators;mongoose;mongodb.FindOperators;",
+            "mongodb;FindOperatorsStatic;mongodb/mongodb;FindOperatorsStatic;",
+            "mongodb;FindOperatorsStatic;mongodb;;Member[FindOperators]",
+            "mongodb;FindOperatorsStatic;mongoose;mongodb.FindOperatorsStatic;",
+            "mongodb;FindOptions;mongodb/mongodb;FindOptions;",
+            "mongodb;FindOptions;mongodb;Collection;Member[find,findOne].Argument[1]",
+            "mongodb;FindOptions;mongodb;GridFSBucket;Member[find].Argument[1]",
+            "mongodb;FindOptions;mongoose;mongodb.FindOptions;",
+            "mongodb;GridFSBucket;mongodb/mongodb;GridFSBucket;",
+            "mongodb;GridFSBucket;mongodb;GridFSBucketStatic;Instance",
+            "mongodb;GridFSBucket;mongodb;GridFSBucketWriteStream;Member[bucket]",
+            "mongodb;GridFSBucket;mongoose;mongodb.GridFSBucket;",
+            "mongodb;GridFSBucketStatic;mongodb/mongodb;GridFSBucketStatic;",
+            "mongodb;GridFSBucketStatic;mongodb;;Member[GridFSBucket]",
+            "mongodb;GridFSBucketStatic;mongoose;mongodb.GridFSBucketStatic;",
+            "mongodb;GridFSBucketWriteStream;mongodb/mongodb;GridFSBucketWriteStream;",
+            "mongodb;GridFSBucketWriteStream;mongodb;GridFSBucket;Member[openUploadStream,openUploadStreamWithId].ReturnValue",
+            "mongodb;GridFSBucketWriteStream;mongodb;GridFSBucketWriteStream;Member[end].ReturnValue",
+            "mongodb;GridFSBucketWriteStream;mongodb;GridFSBucketWriteStreamStatic;Instance",
+            "mongodb;GridFSBucketWriteStream;mongoose;mongodb.GridFSBucketWriteStream;",
+            "mongodb;GridFSBucketWriteStreamStatic;mongodb/mongodb;GridFSBucketWriteStreamStatic;",
+            "mongodb;GridFSBucketWriteStreamStatic;mongodb;;Member[GridFSBucketWriteStream]",
+            "mongodb;GridFSBucketWriteStreamStatic;mongoose;mongodb.GridFSBucketWriteStreamStatic;",
+            "mongodb;IndexInformationOptions;mongodb/mongodb;IndexInformationOptions;",
+            "mongodb;IndexInformationOptions;mongodb;Collection;Member[indexExists].Argument[1]",
+            "mongodb;IndexInformationOptions;mongodb;Collection;Member[indexInformation,indexes].Argument[0]",
+            "mongodb;IndexInformationOptions;mongodb;Db;Member[indexInformation].Argument[1]",
+            "mongodb;IndexInformationOptions;mongoose;mongodb.IndexInformationOptions;",
+            "mongodb;InsertOneOptions;mongodb/mongodb;InsertOneOptions;",
+            "mongodb;InsertOneOptions;mongodb;Collection;Member[insertOne].Argument[1]",
+            "mongodb;InsertOneOptions;mongoose;mongodb.InsertOneOptions;",
+            "mongodb;ListCollectionsCursor;mongodb/mongodb;ListCollectionsCursor;",
+            "mongodb;ListCollectionsCursor;mongodb;Db;Member[listCollections].WithArity[0,1,2].ReturnValue",
+            "mongodb;ListCollectionsCursor;mongodb;ListCollectionsCursor;Member[clone].ReturnValue",
+            "mongodb;ListCollectionsCursor;mongodb;ListCollectionsCursorStatic;Instance",
+            "mongodb;ListCollectionsCursor;mongoose;mongodb.ListCollectionsCursor;",
+            "mongodb;ListCollectionsCursorStatic;mongodb/mongodb;ListCollectionsCursorStatic;",
+            "mongodb;ListCollectionsCursorStatic;mongodb;;Member[ListCollectionsCursor]",
+            "mongodb;ListCollectionsCursorStatic;mongoose;mongodb.ListCollectionsCursorStatic;",
+            "mongodb;ListCollectionsOptions;mongodb/mongodb;ListCollectionsOptions;",
+            "mongodb;ListCollectionsOptions;mongodb;Db;Member[collections].Argument[0]",
+            "mongodb;ListCollectionsOptions;mongodb;Db;Member[listCollections].WithArity[0,1,2].Argument[1]",
+            "mongodb;ListCollectionsOptions;mongodb;ListCollectionsCursor;Member[options]",
+            "mongodb;ListCollectionsOptions;mongodb;ListCollectionsCursorStatic;Argument[2]",
+            "mongodb;ListCollectionsOptions;mongoose;mongodb.ListCollectionsOptions;",
+            "mongodb;ListDatabasesOptions;mongodb/mongodb;ListDatabasesOptions;",
+            "mongodb;ListDatabasesOptions;mongodb;Admin;Member[listDatabases].Argument[0]",
+            "mongodb;ListDatabasesOptions;mongoose;mongodb.ListDatabasesOptions;",
+            "mongodb;ListIndexesCursor;mongodb/mongodb;ListIndexesCursor;",
+            "mongodb;ListIndexesCursor;mongodb;Collection;Member[listIndexes].ReturnValue",
+            "mongodb;ListIndexesCursor;mongodb;ListIndexesCursor;Member[clone].ReturnValue",
+            "mongodb;ListIndexesCursor;mongodb;ListIndexesCursorStatic;Instance",
+            "mongodb;ListIndexesCursor;mongoose;mongodb.ListIndexesCursor;",
+            "mongodb;ListIndexesCursorStatic;mongodb/mongodb;ListIndexesCursorStatic;",
+            "mongodb;ListIndexesCursorStatic;mongodb;;Member[ListIndexesCursor]",
+            "mongodb;ListIndexesCursorStatic;mongoose;mongodb.ListIndexesCursorStatic;",
+            "mongodb;ListIndexesOptions;mongodb/mongodb;ListIndexesOptions;",
+            "mongodb;ListIndexesOptions;mongodb;Collection;Member[listIndexes].Argument[0]",
+            "mongodb;ListIndexesOptions;mongodb;ListIndexesCursor;Member[options]",
+            "mongodb;ListIndexesOptions;mongodb;ListIndexesCursorStatic;Argument[1]",
+            "mongodb;ListIndexesOptions;mongoose;mongodb.ListIndexesOptions;",
+            "mongodb;MapReduceOptions;mongodb/mongodb;MapReduceOptions;",
+            "mongodb;MapReduceOptions;mongodb;Collection;Member[mapReduce].Argument[2]",
+            "mongodb;MapReduceOptions;mongoose;mongodb.MapReduceOptions;",
+            "mongodb;MongoClient;mongodb/mongodb;MongoClient;",
+            "mongodb;MongoClient;mongodb;AutoEncrypter;Argument[0]",
+            "mongodb;MongoClient;mongodb;AutoEncryptionOptions;Member[keyVaultClient]",
+            "mongodb;MongoClient;mongodb;ChangeStream;Member[parent]",
+            "mongodb;MongoClient;mongodb;DbStatic;Argument[0]",
+            "mongodb;MongoClient;mongodb;MongoClient;Member[connect].Argument[0].TypeVar[mongodb.Callback.0]",
+            "mongodb;MongoClient;mongodb;MongoClient;Member[connect].WithArity[0].ReturnValue.Awaited",
+            "mongodb;MongoClient;mongodb;MongoClientEvents;Member[open].Argument[0]",
+            "mongodb;MongoClient;mongodb;MongoClientStatic;Instance",
+            "mongodb;MongoClient;mongodb;MongoClientStatic;Member[connect].Argument[1,2].TypeVar[mongodb.Callback.0]",
+            "mongodb;MongoClient;mongodb;MongoClientStatic;Member[connect].WithArity[1,2].ReturnValue.Awaited",
+            "mongodb;MongoClient;mongoose;mongodb.MongoClient;",
+            "mongodb;MongoClientEvents;mongodb/mongodb;MongoClientEvents;",
+            "mongodb;MongoClientEvents;mongoose;mongodb.MongoClientEvents;",
+            "mongodb;MongoClientOptions;mongodb/mongodb;MongoClientOptions;",
+            "mongodb;MongoClientOptions;mongodb;MongoClientStatic;Argument[1]",
+            "mongodb;MongoClientOptions;mongodb;MongoClientStatic;Member[connect].Argument[1]",
+            "mongodb;MongoClientOptions;mongoose;mongodb.MongoClientOptions;",
+            "mongodb;MongoClientStatic;mongodb/mongodb;MongoClientStatic;",
+            "mongodb;MongoClientStatic;mongodb;;Member[MongoClient]",
+            "mongodb;MongoClientStatic;mongoose;mongodb.MongoClientStatic;",
+            "mongodb;MongoOptions;mongodb/mongodb;MongoOptions;",
+            "mongodb;MongoOptions;mongodb;ClientSession;Member[clientOptions]",
+            "mongodb;MongoOptions;mongodb;MongoClient;Member[options]",
+            "mongodb;MongoOptions;mongoose;mongodb.MongoOptions;",
+            "mongodb;OperationOptions;mongodb/mongodb;OperationOptions;",
+            "mongodb;OperationOptions;mongodb;Collection;Member[isCapped,options].Argument[0]",
+            "mongodb;OperationOptions;mongodb;CommandOperationOptions;",
+            "mongodb;OperationOptions;mongoose;mongodb.OperationOptions;",
+            "mongodb;OrderedBulkOperation;mongodb/mongodb;OrderedBulkOperation;",
+            "mongodb;OrderedBulkOperation;mongodb;Collection;Member[initializeOrderedBulkOp].ReturnValue",
+            "mongodb;OrderedBulkOperation;mongodb;OrderedBulkOperation;Member[addToOperationsList].ReturnValue",
+            "mongodb;OrderedBulkOperation;mongodb;OrderedBulkOperationStatic;Instance",
+            "mongodb;OrderedBulkOperation;mongoose;mongodb.OrderedBulkOperation;",
+            "mongodb;OrderedBulkOperationStatic;mongodb/mongodb;OrderedBulkOperationStatic;",
+            "mongodb;OrderedBulkOperationStatic;mongodb;;Member[OrderedBulkOperation]",
+            "mongodb;OrderedBulkOperationStatic;mongoose;mongodb.OrderedBulkOperationStatic;",
+            "mongodb;ProfilingLevelOptions;mongodb/mongodb;ProfilingLevelOptions;",
+            "mongodb;ProfilingLevelOptions;mongodb;Db;Member[profilingLevel].Argument[0]",
+            "mongodb;ProfilingLevelOptions;mongoose;mongodb.ProfilingLevelOptions;",
+            "mongodb;ReadPreferenceFromOptions;mongodb/mongodb;ReadPreferenceFromOptions;",
+            "mongodb;ReadPreferenceFromOptions;mongodb;ReadPreferenceStatic;Member[fromOptions].Argument[0]",
+            "mongodb;ReadPreferenceFromOptions;mongoose;mongodb.ReadPreferenceFromOptions;",
+            "mongodb;ReadPreferenceStatic;mongodb/mongodb;ReadPreferenceStatic;",
+            "mongodb;ReadPreferenceStatic;mongodb;;Member[ReadPreference]",
+            "mongodb;ReadPreferenceStatic;mongoose;mongodb.ReadPreferenceStatic;",
+            "mongodb;RemoveUserOptions;mongodb/mongodb;RemoveUserOptions;",
+            "mongodb;RemoveUserOptions;mongodb;Admin;Member[removeUser].Argument[1]",
+            "mongodb;RemoveUserOptions;mongodb;Db;Member[removeUser].Argument[1]",
+            "mongodb;RemoveUserOptions;mongoose;mongodb.RemoveUserOptions;",
+            "mongodb;RenameOptions;mongodb/mongodb;RenameOptions;",
+            "mongodb;RenameOptions;mongodb;Collection;Member[rename].Argument[1]",
+            "mongodb;RenameOptions;mongodb;Db;Member[renameCollection].Argument[2]",
+            "mongodb;RenameOptions;mongoose;mongodb.RenameOptions;",
+            "mongodb;ReplaceOptions;mongodb/mongodb;ReplaceOptions;",
+            "mongodb;ReplaceOptions;mongodb;Collection;Member[replaceOne].Argument[2]",
+            "mongodb;ReplaceOptions;mongoose;mongodb.ReplaceOptions;",
+            "mongodb;RunCommandOptions;mongodb/mongodb;RunCommandOptions;",
+            "mongodb;RunCommandOptions;mongodb;Admin;Member[command].Argument[1]",
+            "mongodb;RunCommandOptions;mongodb;Db;Member[command].Argument[1]",
+            "mongodb;RunCommandOptions;mongoose;mongodb.RunCommandOptions;",
+            "mongodb;SelectServerOptions;mongodb/mongodb;SelectServerOptions;",
+            "mongodb;SelectServerOptions;mongoose;mongodb.SelectServerOptions;",
+            "mongodb;SetProfilingLevelOptions;mongodb/mongodb;SetProfilingLevelOptions;",
+            "mongodb;SetProfilingLevelOptions;mongodb;Db;Member[setProfilingLevel].Argument[1]",
+            "mongodb;SetProfilingLevelOptions;mongoose;mongodb.SetProfilingLevelOptions;",
+            "mongodb;Transaction;mongodb/mongodb;Transaction;",
+            "mongodb;Transaction;mongodb;ClientSession;Member[transaction]",
+            "mongodb;Transaction;mongodb;TransactionStatic;Instance",
+            "mongodb;Transaction;mongoose;mongodb.Transaction;",
+            "mongodb;TransactionOptions;mongodb/mongodb;TransactionOptions;",
+            "mongodb;TransactionOptions;mongodb;ClientSession;Member[defaultTransactionOptions]",
+            "mongodb;TransactionOptions;mongodb;ClientSession;Member[startTransaction].Argument[0]",
+            "mongodb;TransactionOptions;mongodb;ClientSession;Member[withTransaction].Argument[1]",
+            "mongodb;TransactionOptions;mongodb;ClientSessionOptions;Member[defaultTransactionOptions]",
+            "mongodb;TransactionOptions;mongodb;Transaction;Member[options]",
+            "mongodb;TransactionOptions;mongoose;mongodb.TransactionOptions;",
+            "mongodb;TransactionStatic;mongodb/mongodb;TransactionStatic;",
+            "mongodb;TransactionStatic;mongodb;;Member[Transaction]",
+            "mongodb;TransactionStatic;mongoose;mongodb.TransactionStatic;",
+            "mongodb;TypedEventEmitter;mongodb;AbstractCursor;",
+            "mongodb;TypedEventEmitter;mongodb;ChangeStream;",
+            "mongodb;TypedEventEmitter;mongodb;ClientSession;",
+            "mongodb;TypedEventEmitter;mongodb;GridFSBucket;",
+            "mongodb;TypedEventEmitter;mongodb;MongoClient;",
+            "mongodb;UnorderedBulkOperation;mongodb/mongodb;UnorderedBulkOperation;",
+            "mongodb;UnorderedBulkOperation;mongodb;Collection;Member[initializeUnorderedBulkOp].ReturnValue",
+            "mongodb;UnorderedBulkOperation;mongodb;UnorderedBulkOperation;Member[addToOperationsList].ReturnValue",
+            "mongodb;UnorderedBulkOperation;mongodb;UnorderedBulkOperationStatic;Instance",
+            "mongodb;UnorderedBulkOperation;mongoose;mongodb.UnorderedBulkOperation;",
+            "mongodb;UnorderedBulkOperationStatic;mongodb/mongodb;UnorderedBulkOperationStatic;",
+            "mongodb;UnorderedBulkOperationStatic;mongodb;;Member[UnorderedBulkOperation]",
+            "mongodb;UnorderedBulkOperationStatic;mongoose;mongodb.UnorderedBulkOperationStatic;",
+            "mongodb;UpdateManyModel;mongodb/mongodb;UpdateManyModel;",
+            "mongodb;UpdateManyModel;mongodb;AnyBulkWriteOperation;Member[updateMany]",
+            "mongodb;UpdateManyModel;mongoose;mongodb.UpdateManyModel;",
+            "mongodb;UpdateOneModel;mongodb/mongodb;UpdateOneModel;",
+            "mongodb;UpdateOneModel;mongodb;AnyBulkWriteOperation;Member[updateOne]",
+            "mongodb;UpdateOneModel;mongoose;mongodb.UpdateOneModel;",
+            "mongodb;UpdateOptions;mongodb/mongodb;UpdateOptions;",
+            "mongodb;UpdateOptions;mongodb;Collection;Member[update,updateMany,updateOne].Argument[2]",
+            "mongodb;UpdateOptions;mongoose;mongodb.UpdateOptions;",
+            "mongodb;ValidateCollectionOptions;mongodb/mongodb;ValidateCollectionOptions;",
+            "mongodb;ValidateCollectionOptions;mongodb;Admin;Member[validateCollection].Argument[1]",
+            "mongodb;ValidateCollectionOptions;mongoose;mongodb.ValidateCollectionOptions;",
+            "mongodb;WithSessionCallback;mongodb/mongodb;WithSessionCallback;",
+            "mongodb;WithSessionCallback;mongodb;MongoClient;Member[withSession].Argument[1]",
+            "mongodb;WithSessionCallback;mongodb;MongoClient;Member[withSession].WithArity[1].Argument[0]",
+            "mongodb;WithSessionCallback;mongoose;mongodb.WithSessionCallback;",
+            "mongodb;WithTransactionCallback;mongodb/mongodb;WithTransactionCallback;",
+            "mongodb;WithTransactionCallback;mongodb;ClientSession;Member[withTransaction].Argument[0]",
+            "mongodb;WithTransactionCallback;mongoose;mongodb.WithTransactionCallback;",
+            "mongoose/inferschematype;ResolvePathType;mongoose/inferschematype;ObtainDocumentPathType;",
+            "mongoose/inferschematype;ResolvePathType;mongoose/inferschematype;ResolvePathType;TypeVar[mongoose.IfEquals.3].ArrayElement",
+            "mongoose/inferschematype;ResolvePathType;mongoose/inferschematype;ResolvePathType;TypeVar[mongoose.IfEquals.3].TypeVar[mongoose.Types.DocumentArray.0]",
+            "mongoose;;mongoose;;Member[mongoose]",
+            "mongoose;AcceptsDiscriminator;mongoose;Model;",
+            "mongoose;AcceptsDiscriminator;mongoose;Schema.Types.Array;",
+            "mongoose;AcceptsDiscriminator;mongoose;Schema.Types.DocumentArray;",
+            "mongoose;AcceptsDiscriminator;mongoose;Schema.Types.Subdocument;",
+            "mongoose;Aggregate;mongoose;Aggregate;Member[addCursorFlag,addFields,allowDiskUse,append,collation,count,facet,graphLookup,group,hint,limit,lookup,match,model,near,option,project,read,readConcern,redact,replaceRoot,sample,search,session,skip,sort,sortByCount,unionWith,unwind].ReturnValue",
+            "mongoose;Aggregate;mongoose;AggregateStatic;Instance",
+            "mongoose;Aggregate;mongoose;Model;Member[aggregate].ReturnValue",
+            "mongoose;AggregateStatic;mongoose;;Member[Aggregate]",
+            "mongoose;Collection;mongoose;;Member[Collection]",
+            "mongoose;Collection;mongoose;Collection;Instance",
+            "mongoose;Collection;mongoose;Connection;Member[collection].ReturnValue",
+            "mongoose;Collection;mongoose;Connection;Member[collections].AnyMember",
+            "mongoose;Collection;mongoose;Document;Member[collection]",
+            "mongoose;Collection;mongoose;Model;Member[collection]",
+            "mongoose;CollectionBase;mongoose;Collection;",
+            "mongoose;CompileModelOptions;mongoose;;Member[model].Argument[3]",
+            "mongoose;CompileModelOptions;mongoose;Connection;Member[model].Argument[3]",
+            "mongoose;ConnectOptions;mongoose;;Member[connect,createConnection].WithArity[1,2,3].Argument[1]",
+            "mongoose;ConnectOptions;mongoose;Connection;Member[openUri].WithArity[1,2,3].Argument[1]",
+            "mongoose;Connection;mongoose;;Member[connection]",
+            "mongoose;Connection;mongoose;;Member[connections].ArrayElement",
+            "mongoose;Connection;mongoose;;Member[createConnection].Argument[2].TypeVar[mongoose.Callback.0]",
+            "mongoose;Connection;mongoose;;Member[createConnection].WithArity[0,1,2].ReturnValue",
+            "mongoose;Connection;mongoose;;Member[createConnection].WithArity[2].Argument[1].TypeVar[mongoose.Callback.0]",
+            "mongoose;Connection;mongoose;Collection;Argument[1]",
+            "mongoose;Connection;mongoose;CollectionBase;Member[conn]",
+            "mongoose;Connection;mongoose;CompileModelOptions;Member[connection]",
+            "mongoose;Connection;mongoose;Connection;Member[asPromise].ReturnValue.Awaited",
+            "mongoose;Connection;mongoose;Connection;Member[deleteModel,plugin,setClient,useDb].ReturnValue",
+            "mongoose;Connection;mongoose;Connection;Member[openUri].Argument[2].TypeVar[mongoose.Callback.0]",
+            "mongoose;Connection;mongoose;Connection;Member[openUri].WithArity[1,2].ReturnValue.Awaited",
+            "mongoose;Connection;mongoose;Connection;Member[openUri].WithArity[2,3].ReturnValue",
+            "mongoose;Connection;mongoose;Connection;Member[openUri].WithArity[2].Argument[1].TypeVar[mongoose.Callback.0]",
+            "mongoose;Connection;mongoose;ConnectionStatic;Instance",
+            "mongoose;Connection;mongoose;Document;Member[db]",
+            "mongoose;Connection;mongoose;Model;Member[db]",
+            "mongoose;ConnectionStatic;mongoose;;Member[Connection]",
+            "mongoose;Cursor;mongoose;Query;Member[cursor].ReturnValue",
+            "mongoose;DiscriminatorModel;mongoose;DiscriminatorSchema;TypeVar[mongoose.Schema.1]",
+            "mongoose;Document;mongoose;Document;Member[$getAllSubdocs,$getPopulatedDocs].ReturnValue.ArrayElement",
+            "mongoose;Document;mongoose;Document;Member[$inc,$parent,$set,depopulate,increment,init,overwrite,set].ReturnValue",
+            "mongoose;Document;mongoose;Document;Member[delete,deleteOne].WithArity[0,1].ReturnValue.TypeVar[mongoose.QueryWithHelpers.1]",
+            "mongoose;Document;mongoose;Document;Member[equals].Argument[0]",
+            "mongoose;Document;mongoose;Document;Member[init].Argument[2].TypeVar[mongoose.Callback.0]",
+            "mongoose;Document;mongoose;Document;Member[remove,save].WithArity[0,1].ReturnValue.Awaited",
+            "mongoose;Document;mongoose;Document;Member[replaceOne,update,updateOne].ReturnValue.TypeVar[mongoose.Query.1]",
+            "mongoose;Document;mongoose;Document;Member[save].Argument[1].TypeVar[mongoose.Callback.0]",
+            "mongoose;Document;mongoose;Document;Member[save].WithArity[1].Argument[0].TypeVar[mongoose.Callback.0]",
+            "mongoose;Document;mongoose;DocumentStatic;Instance",
+            "mongoose;Document;mongoose;Error.VersionErrorStatic;Argument[0]",
+            "mongoose;Document;mongoose;HydratedDocument;",
+            "mongoose;Document;mongoose;HydratedDocument;TypeVar[mongoose.Require_id.0]",
+            "mongoose;Document;mongoose;Model;Member[bulkSave].Argument[0].ArrayElement",
+            "mongoose;Document;mongoose;TVirtualPathFN;Argument[2]",
+            "mongoose;Document;mongoose;Types.Subdocument;",
+            "mongoose;Document;mongoose;Types.Subdocument;Member[$parent,ownerDocument,parent].ReturnValue",
+            "mongoose;Document;mongoose;VirtualType;Member[applyGetters,applySetters].Argument[1]",
+            "mongoose;DocumentStatic;mongoose;;Member[Document]",
+            "mongoose;Error.VersionErrorStatic;mongoose;;Member[Error].Member[VersionError]",
+            "mongoose;HydratedDocument;mongoose;Model;Instance",
+            "mongoose;HydratedDocument;mongoose;Model;Member[$where,count,countDocuments,deleteMany,deleteOne,distinct,estimatedDocumentCount,find,geoSearch,remove,replaceOne,update,updateMany,updateOne,where].ReturnValue.TypeVar[mongoose.QueryWithHelpers.1]",
+            "mongoose;HydratedDocument;mongoose;Model;Member[$where,find,geoSearch,where].ReturnValue.TypeVar[mongoose.QueryWithHelpers.0].ArrayElement",
+            "mongoose;HydratedDocument;mongoose;Model;Member[create,insertMany].WithArity[2].Argument[1].TypeVar[mongoose.Callback.0].ArrayElement",
+            "mongoose;HydratedDocument;mongoose;Model;Member[create].WithArity[0..,1,2].ReturnValue.Awaited.ArrayElement",
+            "mongoose;HydratedDocument;mongoose;Model;Member[create].WithArity[1].ReturnValue.Awaited",
+            "mongoose;HydratedDocument;mongoose;Model;Member[create].WithArity[2].Argument[1].TypeVar[mongoose.Callback.0]",
+            "mongoose;HydratedDocument;mongoose;Model;Member[exists].WithArity[1,2].ReturnValue.TypeVar[mongoose.QueryWithHelpers.1]",
+            "mongoose;HydratedDocument;mongoose;Model;Member[find,insertMany].WithArity[3].Argument[2].TypeVar[mongoose.Callback.0].ArrayElement",
+            "mongoose;HydratedDocument;mongoose;Model;Member[findById,findByIdAndDelete,findByIdAndRemove,findOne,findOneAndDelete,findOneAndRemove].ReturnValue.TypeVar[mongoose.QueryWithHelpers.0,mongoose.QueryWithHelpers.1]",
+            "mongoose;HydratedDocument;mongoose;Model;Member[findById,findOne].Argument[3].TypeVar[mongoose.Callback.0]",
+            "mongoose;HydratedDocument;mongoose;Model;Member[findByIdAndDelete,findByIdAndRemove,findOneAndDelete,findOneAndRemove].Argument[2].Argument[1]",
+            "mongoose;HydratedDocument;mongoose;Model;Member[findByIdAndUpdate,findOneAndReplace,findOneAndUpdate].WithArity[0,1,2,3,4].ReturnValue.TypeVar[mongoose.QueryWithHelpers.0,mongoose.QueryWithHelpers.1]",
+            "mongoose;HydratedDocument;mongoose;Model;Member[findByIdAndUpdate,findOneAndReplace,findOneAndUpdate].WithArity[3,4].ReturnValue.TypeVar[mongoose.QueryWithHelpers.0].TypeVar[mongoose.ModifyResult.0]",
+            "mongoose;HydratedDocument;mongoose;Model;Member[findByIdAndUpdate].WithArity[0,1,2,4].Argument[3].Argument[1]",
+            "mongoose;HydratedDocument;mongoose;Model;Member[findByIdAndUpdate].WithArity[3].Argument[2,3].Argument[1]",
+            "mongoose;HydratedDocument;mongoose;Model;Member[findById].WithArity[1,2,3].Argument[2].TypeVar[mongoose.Callback.0]",
+            "mongoose;HydratedDocument;mongoose;Model;Member[findOneAndReplace].WithArity[0,1,2,3,4].Argument[3].Argument[1]",
+            "mongoose;HydratedDocument;mongoose;Model;Member[findOneAndUpdate].WithArity[3,4].Argument[3].Argument[1]",
+            "mongoose;HydratedDocument;mongoose;Model;Member[findOne].WithArity[0,1,2].Argument[1,2].TypeVar[mongoose.Callback.0]",
+            "mongoose;HydratedDocument;mongoose;Model;Member[findOne].WithArity[3].Argument[2].TypeVar[mongoose.Callback.0]",
+            "mongoose;HydratedDocument;mongoose;Model;Member[find].Argument[3].TypeVar[mongoose.Callback.0].ArrayElement",
+            "mongoose;HydratedDocument;mongoose;Model;Member[find].WithArity[0].Argument[0].TypeVar[mongoose.Callback.0].ArrayElement",
+            "mongoose;HydratedDocument;mongoose;Model;Member[find].WithArity[1].Argument[0,1,2].TypeVar[mongoose.Callback.0].ArrayElement",
+            "mongoose;HydratedDocument;mongoose;Model;Member[find].WithArity[2].Argument[1,2].TypeVar[mongoose.Callback.0].ArrayElement",
+            "mongoose;HydratedDocument;mongoose;Model;Member[geoSearch].Argument[2].TypeVar[mongoose.Callback.0].ArrayElement",
+            "mongoose;HydratedDocument;mongoose;Model;Member[hydrate].ReturnValue",
+            "mongoose;HydratedDocument;mongoose;Model;Member[init].ReturnValue.Awaited",
+            "mongoose;HydratedDocument;mongoose;Model;Member[insertMany].WithArity[1,2].ReturnValue.Awaited.ArrayElement",
+            "mongoose;HydratedDocument;mongoose;Model;Member[populate].WithArity[2,3].Argument[2].TypeVar[mongoose.Callback.0]",
+            "mongoose;HydratedDocument;mongoose;Model;Member[populate].WithArity[2,3].Argument[2].TypeVar[mongoose.Callback.0].ArrayElement",
+            "mongoose;HydratedDocument;mongoose;Model;Member[populate].WithArity[2,3].ReturnValue.Awaited",
+            "mongoose;HydratedDocument;mongoose;Model;Member[populate].WithArity[2,3].ReturnValue.Awaited.ArrayElement",
+            "mongoose;HydratedDocument;mongoose;TVirtualPathFN;Argument[1].TypeVar[mongoose.VirtualType.0]",
+            "mongoose;HydratedDocument;mongoose;VirtualPathFunctions;Member[options].TypeVar[mongoose.VirtualTypeOptions.0]",
+            "mongoose;InsertManyOptions;mongoose;Model;Member[insertMany].WithArity[2,3].Argument[1]",
+            "mongoose;Model;mongoose;;Member[Model]",
+            "mongoose;Model;mongoose;;Member[model].ReturnValue",
+            "mongoose;Model;mongoose;AcceptsDiscriminator;Member[discriminator].WithArity[2,3].ReturnValue",
+            "mongoose;Model;mongoose;Aggregate;Member[model].Argument[0]",
+            "mongoose;Model;mongoose;Connection;Member[model].WithArity[1,2,3,4].ReturnValue",
+            "mongoose;Model;mongoose;Connection;Member[models].AnyMember",
+            "mongoose;Model;mongoose;DiscriminatorModel;",
+            "mongoose;Model;mongoose;Document;Member[$model].ReturnValue",
+            "mongoose;Model;mongoose;Document;Member[populate].Argument[2]",
+            "mongoose;Model;mongoose;Model;Member[discriminators].AnyMember",
+            "mongoose;Model;mongoose;Models;AnyMember",
+            "mongoose;Model;mongoose;PopulateOptions;Member[model]",
+            "mongoose;Model;mongoose;Query;Member[cast].Argument[0]",
+            "mongoose;Model;mongoose;Query;Member[populate].Argument[2]",
+            "mongoose;Model;mongoose;Schema.Types.Array;Member[discriminator].WithArity[2,3].ReturnValue",
+            "mongoose;Model;mongoose;Schema.Types.DocumentArray;Member[discriminator].WithArity[2,3].ReturnValue",
+            "mongoose;Model;mongoose;Schema.Types.Subdocument;Member[discriminator].WithArity[2,3].ReturnValue",
+            "mongoose;Model;mongoose;SchemaStatic;Instance.TypeVar[mongoose.Schema.1]",
+            "mongoose;Models;mongoose;;Member[models]",
+            "mongoose;PopulateOption;mongoose;InsertManyOptions;",
+            "mongoose;PopulateOption;mongoose;QueryOptions;",
+            "mongoose;PopulateOptions;mongoose;Document;Member[populate].Argument[4]",
+            "mongoose;PopulateOptions;mongoose;Document;Member[populate].WithArity[1,2].Argument[0]",
+            "mongoose;PopulateOptions;mongoose;Document;Member[populate].WithArity[1,2].Argument[0].ArrayElement",
+            "mongoose;PopulateOptions;mongoose;Model;Member[populate].Argument[1]",
+            "mongoose;PopulateOptions;mongoose;Model;Member[populate].Argument[1].ArrayElement",
+            "mongoose;PopulateOptions;mongoose;PopulateOption;Member[populate]",
+            "mongoose;PopulateOptions;mongoose;PopulateOption;Member[populate].ArrayElement",
+            "mongoose;PopulateOptions;mongoose;PopulateOptions;Member[populate]",
+            "mongoose;PopulateOptions;mongoose;PopulateOptions;Member[populate].ArrayElement",
+            "mongoose;PopulateOptions;mongoose;Query;Member[populate].WithArity[1].Argument[0]",
+            "mongoose;PopulateOptions;mongoose;Query;Member[populate].WithArity[1].Argument[0].ArrayElement",
+            "mongoose;Query;mongoose;Document;Member[replaceOne,update,updateOne].ReturnValue",
+            "mongoose;Query;mongoose;HydratedDocument;TypeVar[mongoose.Require_id.0]",
+            "mongoose;Query;mongoose;Query;Member[all,allowDiskUse,and,batchSize,box,circle,clone,collation,comment,elemMatch,equals,exists,explain,geometry,gt,gte,hint,in,intersects,j,limit,lt,lte,maxDistance,maxScan,maxTimeMS,merge,mod,ne,near,nin,nor,or,polygon,read,readConcern,regex,remove,select,session,set,setOptions,size,skip,slice,snapshot,sort,tailable,w,where,within,wtimeout].ReturnValue",
+            "mongoose;Query;mongoose;Query;Member[error].WithArity[1].ReturnValue",
+            "mongoose;Query;mongoose;Query;Member[merge].Argument[0]",
+            "mongoose;Query;mongoose;QueryStatic;Instance",
+            "mongoose;Query;mongoose;QueryWithHelpers;",
+            "mongoose;QueryOptions;mongoose;Document;Member[delete,deleteOne,remove].WithArity[0,1,2].Argument[0]",
+            "mongoose;QueryOptions;mongoose;Document;Member[replaceOne,update,updateOne].Argument[1]",
+            "mongoose;QueryOptions;mongoose;Model;Member[countDocuments,findByIdAndDelete,findByIdAndRemove,findOneAndDelete,findOneAndRemove].Argument[1]",
+            "mongoose;QueryOptions;mongoose;Model;Member[deleteMany,deleteOne].WithArity[0,1,2,3].Argument[1]",
+            "mongoose;QueryOptions;mongoose;Model;Member[estimatedDocumentCount].Argument[0]",
+            "mongoose;QueryOptions;mongoose;Model;Member[find,findById].WithArity[1,2,3,4].Argument[2]",
+            "mongoose;QueryOptions;mongoose;Model;Member[findByIdAndUpdate,findOne,findOneAndReplace,findOneAndUpdate].WithArity[0,1,2,3,4].Argument[2]",
+            "mongoose;QueryOptions;mongoose;Model;Member[replaceOne,update,updateMany,updateOne].Argument[2]",
+            "mongoose;QueryOptions;mongoose;PopulateOptions;Member[options]",
+            "mongoose;QueryOptions;mongoose;Query;Member[countDocuments,findByIdAndDelete,findOneAndDelete,findOneAndRemove].Argument[1]",
+            "mongoose;QueryOptions;mongoose;Query;Member[cursor,estimatedDocumentCount,setOptions].Argument[0]",
+            "mongoose;QueryOptions;mongoose;Query;Member[cursor].ReturnValue.TypeVar[mongoose.Cursor.1]",
+            "mongoose;QueryOptions;mongoose;Query;Member[deleteMany,deleteOne].WithArity[0,1,2,3].Argument[1]",
+            "mongoose;QueryOptions;mongoose;Query;Member[findByIdAndUpdate,findOne,findOneAndUpdate].WithArity[0,1,2,3,4].Argument[2]",
+            "mongoose;QueryOptions;mongoose;Query;Member[find].WithArity[1,2,3,4].Argument[2]",
+            "mongoose;QueryOptions;mongoose;Query;Member[getOptions].ReturnValue",
+            "mongoose;QueryOptions;mongoose;Query;Member[replaceOne,update,updateMany,updateOne].Argument[2]",
+            "mongoose;QueryOptions;mongoose;VirtualTypeOptions;Member[options]",
+            "mongoose;QueryStatic;mongoose;;Member[Query]",
+            "mongoose;QueryWithHelpers;mongoose;Document;Member[delete,deleteOne].WithArity[0,1].ReturnValue",
+            "mongoose;QueryWithHelpers;mongoose;Model;Member[$where,count,countDocuments,deleteMany,deleteOne,distinct,estimatedDocumentCount,find,findById,findByIdAndDelete,findByIdAndRemove,findOne,findOneAndDelete,findOneAndRemove,geoSearch,remove,replaceOne,update,updateMany,updateOne,where].ReturnValue",
+            "mongoose;QueryWithHelpers;mongoose;Model;Member[exists].WithArity[1,2].ReturnValue",
+            "mongoose;QueryWithHelpers;mongoose;Model;Member[findByIdAndUpdate,findOneAndReplace,findOneAndUpdate].WithArity[0,1,2,3,4].ReturnValue",
+            "mongoose;QueryWithHelpers;mongoose;Query;Member[$where,count,countDocuments,deleteMany,deleteOne,distinct,estimatedDocumentCount,find,findByIdAndDelete,findOne,findOneAndDelete,findOneAndRemove,lean,orFail,populate,replaceOne,transform,update,updateMany,updateOne].ReturnValue",
+            "mongoose;QueryWithHelpers;mongoose;Query;Member[findByIdAndUpdate,findOneAndUpdate].WithArity[0,1,2,3,4].ReturnValue",
+            "mongoose;QueryWithHelpers;mongoose;Query;Member[toConstructor].ReturnValue.Instance",
+            "mongoose;Schema.Types.Array;mongoose;Schema.Types.Array;Member[enum].ReturnValue",
+            "mongoose;Schema.Types.Array;mongoose;Schema.Types.ArrayStatic;Instance",
+            "mongoose;Schema.Types.ArrayStatic;mongoose;;Member[Schema].Member[Types].Member[Array]",
+            "mongoose;Schema.Types.DocumentArray;mongoose;Schema.Types.DocumentArrayStatic;Instance",
+            "mongoose;Schema.Types.DocumentArrayStatic;mongoose;;Member[Schema].Member[Types].Member[DocumentArray]",
+            "mongoose;Schema.Types.Subdocument;mongoose;Schema.Types.SubdocumentStatic;Instance",
+            "mongoose;Schema.Types.SubdocumentStatic;mongoose;;Member[Schema].Member[Types].Member[Subdocument]",
+            "mongoose;Schema.Types.SubdocumentStatic;mongoose;Schema.Types.DocumentArray;Member[caster]",
+            "mongoose;SchemaStatic;mongoose;;Member[Schema]",
+            "mongoose;SessionOperation;mongoose;Aggregate;",
+            "mongoose;SessionOperation;mongoose;Query;",
+            "mongoose;TVirtualPathFN;mongoose;VirtualPathFunctions;Member[get,set]",
+            "mongoose;Types.Array;mongoose;Types.DocumentArray;",
+            "mongoose;Types.ArraySubdocument;mongoose;Types.ArraySubdocumentStatic;Instance",
+            "mongoose;Types.ArraySubdocumentStatic;mongoose;;Member[Types].Member[ArraySubdocument]",
+            "mongoose;Types.DocumentArray;mongoose/inferschematype;ResolvePathType;TypeVar[mongoose.IfEquals.3]",
+            "mongoose;Types.DocumentArray;mongoose;Types.ArraySubdocument;Member[parentArray].ReturnValue",
+            "mongoose;Types.DocumentArray;mongoose;Types.DocumentArrayStatic;Instance",
+            "mongoose;Types.DocumentArrayStatic;mongoose;;Member[Types].Member[DocumentArray]",
+            "mongoose;Types.ObjectId;mongoose/inferschematype;ResolvePathType;",
+            "mongoose;Types.Subdocument;mongoose;Types.ArraySubdocument;",
+            "mongoose;Types.Subdocument;mongoose;Types.DocumentArray;Member[create,id].ReturnValue",
+            "mongoose;Types.Subdocument;mongoose;Types.DocumentArray;TypeVar[mongoose.Types.Array.0]",
+            "mongoose;Types.Subdocument;mongoose;Types.SubdocumentStatic;Instance",
+            "mongoose;Types.SubdocumentStatic;mongoose;;Member[Types].Member[Subdocument]",
+            "mongoose;VirtualType;mongoose;TVirtualPathFN;Argument[1]",
+            "mongoose;VirtualType;mongoose;VirtualType;Member[get,set].Argument[0].Argument[1]",
+            "mongoose;VirtualType;mongoose;VirtualType;Member[get,set].ReturnValue",
+            "mongoose;VirtualType;mongoose;VirtualTypeStatic;Instance",
+            "mongoose;VirtualTypeOptions;mongoose;VirtualPathFunctions;Member[options]",
+            "mongoose;VirtualTypeStatic;mongoose;;Member[VirtualType]"
+        ],
+        "summaries": [
+            "mongodb;AbstractCursor;;;Member[addCursorFlag,batchSize,maxTimeMS,withReadConcern,withReadPreference].ReturnValue;type",
+            "mongodb;BulkOperationBase;;;Member[addToOperationsList,raw].ReturnValue;type",
+            "mongodb;FindCursor;;;Member[addQueryModifier,allowDiskUse,collation,comment,filter,hint,limit,max,maxAwaitTimeMS,maxTimeMS,min,returnKey,showRecordId,skip,sort].ReturnValue;type",
+            "mongodb;FindOperators;;;Member[arrayFilters,collation,upsert].ReturnValue;type",
+            "mongodb;GridFSBucketWriteStream;;;Member[end].ReturnValue;type",
+            "mongodb;MongoClient;;;Member[connect].Argument[0].TypeVar[mongodb.Callback.0];type",
+            "mongodb;MongoClient;;;Member[connect].WithArity[0].ReturnValue.Awaited;type",
+            "mongodb;OrderedBulkOperation;;;Member[addToOperationsList].ReturnValue;type",
+            "mongodb;TypedEventEmitter;;;Member[addListener,off,on,once,prependListener,prependOnceListener,removeAllListeners,removeListener,setMaxListeners].ReturnValue;type",
+            "mongodb;UnorderedBulkOperation;;;Member[addToOperationsList].ReturnValue;type",
+            "mongoose;Aggregate;;;Member[addCursorFlag,addFields,allowDiskUse,append,collation,count,facet,graphLookup,group,hint,limit,lookup,match,model,near,option,project,read,readConcern,redact,replaceRoot,sample,search,session,skip,sort,sortByCount,unionWith,unwind].ReturnValue;type",
+            "mongoose;Connection;;;Member[asPromise].ReturnValue.Awaited;type",
+            "mongoose;Connection;;;Member[deleteModel,setClient].ReturnValue;type",
+            "mongoose;Cursor;;;Member[addCursorFlag].ReturnValue;type",
+            "mongoose;Document;;;Member[$inc,$set,depopulate,increment,init,overwrite,set].ReturnValue;type",
+            "mongoose;Document;;;Member[delete,deleteOne].WithArity[0,1].ReturnValue.TypeVar[mongoose.QueryWithHelpers.1];type",
+            "mongoose;Document;;;Member[getChanges].ReturnValue.TypeVar[mongoose.UpdateQuery.0];type",
+            "mongoose;Document;;;Member[init].Argument[2].TypeVar[mongoose.Callback.0];type",
+            "mongoose;Document;;;Member[populate].Argument[1,5].TypeVar[mongoose.Callback.0].TypeVar[mongoose.MergeType.0];type",
+            "mongoose;Document;;;Member[populate].WithArity[1,2,3,4,5].ReturnValue.Awaited.TypeVar[mongoose.MergeType.0];type",
+            "mongoose;Document;;;Member[remove,save].WithArity[0,1].ReturnValue.Awaited;type",
+            "mongoose;Document;;;Member[replaceOne,update,updateOne].ReturnValue.TypeVar[mongoose.Query.1];type",
+            "mongoose;Document;;;Member[save].Argument[1].TypeVar[mongoose.Callback.0];type",
+            "mongoose;Document;;;Member[save].WithArity[1].Argument[0].TypeVar[mongoose.Callback.0];type",
+            "mongoose;Document;;;Member[update,updateOne].Argument[0].TypeVar[mongoose.UpdateQuery.0];type",
+            "mongoose;Query;;;Member[all,allowDiskUse,and,batchSize,box,circle,clone,collation,comment,elemMatch,equals,exists,explain,geometry,gt,gte,hint,in,intersects,j,limit,lt,lte,maxDistance,maxScan,maxTimeMS,merge,mod,ne,near,nin,nor,or,polygon,read,readConcern,regex,select,session,set,setOptions,size,skip,slice,snapshot,sort,tailable,w,where,within,wtimeout].ReturnValue;type",
+            "mongoose;Query;;;Member[error].WithArity[1].ReturnValue;type",
+            "mongoose;Schema.Types.Array;;;Member[enum].ReturnValue;type",
+            "mongoose;SessionOperation;;;Member[session].ReturnValue;type",
+            "mongoose;Types.Array;;;Member[pull,remove,set].ReturnValue;type",
+            "mongoose;Types.ObjectId;;;Member[_id];type",
+            "mongoose;VirtualType;;;Member[get,set].ReturnValue;type"
+        ],
+        "typeVariables": [
+            "mongodb.Callback.0;Argument[1]",
+            "mongoose.Callback.0;Argument[1]",
+            "mongoose.Cursor.0;Member[eachAsync].WithArity[1,2,3].Argument[0].Argument[0]",
+            "mongoose.Cursor.0;Member[eachAsync].WithArity[2,3].Argument[0].Argument[0].ArrayElement",
+            "mongoose.Cursor.0;Member[map].Argument[0].Argument[0]",
+            "mongoose.Cursor.0;Member[next].Argument[0].TypeVar[mongoose.Callback.0]",
+            "mongoose.Cursor.0;Member[next].WithArity[0].ReturnValue.Awaited",
+            "mongoose.Cursor.1;Member[map].ReturnValue.TypeVar[mongoose.Cursor.1]",
+            "mongoose.Cursor.1;Member[options]",
+            "mongoose.DiscriminatorSchema.1;TypeVar[mongoose.Schema.1]",
+            "mongoose.DiscriminatorSchema.1;TypeVar[mongoose.Schema.1].TypeVar[mongoose.DiscriminatorModel.1]",
+            "mongoose.Document.0;Member[_id]",
+            "mongoose.Document.0;Member[equals].Argument[0].TypeVar[mongoose.Document.0]",
+            "mongoose.FilterQuery.0;TypeVar[mongoose._FilterQuery.0]",
+            "mongoose.IfAny.1;",
+            "mongoose.IfAny.2;",
+            "mongoose.IfEquals.3;",
+            "mongoose.LeanDocumentOrArray.0;",
+            "mongoose.LeanDocumentOrArray.0;TypeVar[mongoose.LeanDocument.0]",
+            "mongoose.LeanDocumentOrArrayWithRawType.0;",
+            "mongoose.ModifyResult.0;Member[value].TypeVar[mongoose.Require_id.0]",
+            "mongoose.PluginFunction.1;Argument[0].TypeVar[mongoose.Schema.1]",
+            "mongoose.PostMiddlewareFunction.1;Argument[0]",
+            "mongoose.Query.0;Member[exec].Argument[0].TypeVar[mongoose.Callback.0]",
+            "mongoose.Query.0;Member[exec].WithArity[0].ReturnValue.Awaited",
+            "mongoose.Query.0;Member[lean].ReturnValue.TypeVar[mongoose.QueryWithHelpers.0].TypeVar[mongoose.LeanDocumentOrArray.0,mongoose.LeanDocumentOrArrayWithRawType.0]",
+            "mongoose.Query.0;Member[orFail].ReturnValue.TypeVar[mongoose.QueryWithHelpers.0]",
+            "mongoose.Query.0;Member[populate].ReturnValue.TypeVar[mongoose.QueryWithHelpers.0].TypeVar[mongoose.UnpackedIntersection.0]",
+            "mongoose.Query.0;Member[then,transform].Argument[0].Argument[0]",
+            "mongoose.Query.0;Member[toConstructor].ReturnValue.Instance.TypeVar[mongoose.QueryWithHelpers.0]",
+            "mongoose.Query.1;Member[$where,count,countDocuments,deleteMany,deleteOne,distinct,estimatedDocumentCount,find,lean,orFail,populate,replaceOne,transform,update,updateMany,updateOne].ReturnValue.TypeVar[mongoose.QueryWithHelpers.1]",
+            "mongoose.Query.1;Member[$where,find].ReturnValue.TypeVar[mongoose.QueryWithHelpers.0].ArrayElement",
+            "mongoose.Query.1;Member[_mongooseOptions].TypeVar[mongoose.MongooseQueryOptions.0]",
+            "mongoose.Query.1;Member[and,nor,or].Argument[0].ArrayElement.TypeVar[mongoose.FilterQuery.0]",
+            "mongoose.Query.1;Member[countDocuments,findByIdAndDelete,findOneAndDelete,findOneAndRemove].Argument[1].TypeVar[mongoose.QueryOptions.0]",
+            "mongoose.Query.1;Member[countDocuments].WithArity[1,2,3].Argument[0].TypeVar[mongoose.FilterQuery.0]",
+            "mongoose.Query.1;Member[count].WithArity[1,2].Argument[0].TypeVar[mongoose.FilterQuery.0]",
+            "mongoose.Query.1;Member[cursor,estimatedDocumentCount,setOptions].Argument[0].TypeVar[mongoose.QueryOptions.0]",
+            "mongoose.Query.1;Member[cursor].ReturnValue.TypeVar[mongoose.Cursor.0]",
+            "mongoose.Query.1;Member[cursor].ReturnValue.TypeVar[mongoose.Cursor.1].TypeVar[mongoose.QueryOptions.0]",
+            "mongoose.Query.1;Member[deleteMany,deleteOne].WithArity[0,1,2,3].Argument[0].TypeVar[mongoose.FilterQuery.0]",
+            "mongoose.Query.1;Member[deleteMany,deleteOne].WithArity[0,1,2,3].Argument[1].TypeVar[mongoose.QueryOptions.0]",
+            "mongoose.Query.1;Member[distinct].Argument[1].TypeVar[mongoose.FilterQuery.0]",
+            "mongoose.Query.1;Member[findByIdAndDelete,findOne,findOneAndDelete,findOneAndRemove].ReturnValue.TypeVar[mongoose.QueryWithHelpers.0,mongoose.QueryWithHelpers.1]",
+            "mongoose.Query.1;Member[findByIdAndDelete,findOneAndDelete,findOneAndRemove].Argument[2].Argument[1]",
+            "mongoose.Query.1;Member[findByIdAndUpdate,findOneAndUpdate,update,updateMany,updateOne].Argument[1].TypeVar[mongoose.UpdateQuery.0]",
+            "mongoose.Query.1;Member[findByIdAndUpdate,findOneAndUpdate].WithArity[0,1,2,3,4].Argument[2].TypeVar[mongoose.QueryOptions.0]",
+            "mongoose.Query.1;Member[findByIdAndUpdate,findOneAndUpdate].WithArity[0,1,2,3,4].ReturnValue.TypeVar[mongoose.QueryWithHelpers.0,mongoose.QueryWithHelpers.1]",
+            "mongoose.Query.1;Member[findByIdAndUpdate].WithArity[0,1,2,4].Argument[3].Argument[1]",
+            "mongoose.Query.1;Member[findByIdAndUpdate].WithArity[3].Argument[2,3].Argument[1]",
+            "mongoose.Query.1;Member[findOne,findOneAndDelete,findOneAndRemove,findOneAndUpdate,merge,remove,replaceOne,setQuery,update,updateMany,updateOne].Argument[0].TypeVar[mongoose.FilterQuery.0]",
+            "mongoose.Query.1;Member[findOneAndUpdate].Argument[3].Argument[1]",
+            "mongoose.Query.1;Member[findOneAndUpdate].Argument[3].Argument[2].TypeVar[mongoose.ModifyResult.0]",
+            "mongoose.Query.1;Member[findOneAndUpdate].WithArity[3,4].ReturnValue.TypeVar[mongoose.QueryWithHelpers.0].TypeVar[mongoose.ModifyResult.0]",
+            "mongoose.Query.1;Member[findOne].Argument[3].TypeVar[mongoose.Callback.0]",
+            "mongoose.Query.1;Member[findOne].WithArity[0,1,2,3].Argument[2].TypeVar[mongoose.Callback.0,mongoose.QueryOptions.0]",
+            "mongoose.Query.1;Member[findOne].WithArity[0,1,2].Argument[1].TypeVar[mongoose.Callback.0,mongoose.ProjectionType.0]",
+            "mongoose.Query.1;Member[findOne].WithArity[3,4].Argument[1].TypeVar[mongoose.ProjectionType.0]",
+            "mongoose.Query.1;Member[findOne].WithArity[4].Argument[2].TypeVar[mongoose.QueryOptions.0]",
+            "mongoose.Query.1;Member[find].Argument[3].TypeVar[mongoose.Callback.0].ArrayElement",
+            "mongoose.Query.1;Member[find].WithArity[0].Argument[0].TypeVar[mongoose.Callback.0].ArrayElement",
+            "mongoose.Query.1;Member[find].WithArity[1,2,3,4].Argument[0].TypeVar[mongoose.FilterQuery.0]",
+            "mongoose.Query.1;Member[find].WithArity[1,2,3,4].Argument[1].TypeVar[mongoose.ProjectionType.0]",
+            "mongoose.Query.1;Member[find].WithArity[1,2,3,4].Argument[2].TypeVar[mongoose.QueryOptions.0]",
+            "mongoose.Query.1;Member[find].WithArity[1].Argument[0,1,2].TypeVar[mongoose.Callback.0].ArrayElement",
+            "mongoose.Query.1;Member[find].WithArity[2].Argument[1,2].TypeVar[mongoose.Callback.0].ArrayElement",
+            "mongoose.Query.1;Member[find].WithArity[3].Argument[2].TypeVar[mongoose.Callback.0].ArrayElement",
+            "mongoose.Query.1;Member[getFilter,getQuery].ReturnValue.TypeVar[mongoose.FilterQuery.0]",
+            "mongoose.Query.1;Member[getOptions].ReturnValue.TypeVar[mongoose.QueryOptions.0]",
+            "mongoose.Query.1;Member[getUpdate].ReturnValue.TypeVar[mongoose.UpdateQuery.0]",
+            "mongoose.Query.1;Member[projection].WithArity[0,1].Argument[0].TypeVar[mongoose.ProjectionFields.0]",
+            "mongoose.Query.1;Member[projection].WithArity[0,1].ReturnValue.TypeVar[mongoose.ProjectionFields.0]",
+            "mongoose.Query.1;Member[remove].ReturnValue.TypeVar[mongoose.Query.1]",
+            "mongoose.Query.1;Member[replaceOne,update,updateMany,updateOne].Argument[2].TypeVar[mongoose.QueryOptions.0]",
+            "mongoose.Query.1;Member[replaceOne].Argument[1]",
+            "mongoose.Query.1;Member[setUpdate].Argument[0].TypeVar[mongoose.UpdateQuery.0]",
+            "mongoose.Query.1;Member[toConstructor].ReturnValue.Instance.TypeVar[mongoose.QueryWithHelpers.1]",
+            "mongoose.QueryOptions.0;Member[projection].TypeVar[mongoose.ProjectionType.0]",
+            "mongoose.QueryWithHelpers.0;TypeVar[mongoose.Query.0]",
+            "mongoose.QueryWithHelpers.1;TypeVar[mongoose.Query.1]",
+            "mongoose.Require_id.0;",
+            "mongoose.Require_id.0;TypeVar[mongoose.IfAny.1,mongoose.IfAny.2]",
+            "mongoose.RootQuerySelector.0;Member[$and,$nor,$or].ArrayElement.TypeVar[mongoose.FilterQuery.0]",
+            "mongoose.Schema.1;Member[discriminator].ReturnValue.TypeVar[mongoose.DiscriminatorSchema.1]",
+            "mongoose.Schema.1;Member[plugin].Argument[0].TypeVar[mongoose.PluginFunction.1]",
+            "mongoose.Schema.1;Member[post].Argument[2].TypeVar[mongoose.ErrorHandlingMiddlewareFunction.0,mongoose.PostMiddlewareFunction.0,mongoose.PostMiddlewareFunction.1]",
+            "mongoose.Schema.1;Member[post].WithArity[2].WithStringArgument[0=insertMany].Argument[1].TypeVar[mongoose.ErrorHandlingMiddlewareFunction.0,mongoose.PostMiddlewareFunction.0,mongoose.PostMiddlewareFunction.1]",
+            "mongoose.Types.Array.0;Member[$pop,$shift,shift].ReturnValue",
+            "mongoose.Types.Array.0;Member[set].Argument[1]",
+            "mongoose.Types.DocumentArray.0;Member[create,id].ReturnValue",
+            "mongoose.Types.DocumentArray.0;Member[create,id].ReturnValue.TypeVar[mongoose.Types.Subdocument.0].TypeVar[mongoose.InferId.0]",
+            "mongoose.Types.DocumentArray.0;Member[push].Argument[0].ArrayElement.TypeVar[mongoose.AnyKeys.0]",
+            "mongoose.Types.DocumentArray.0;TypeVar[mongoose.Types.Array.0]",
+            "mongoose.Types.DocumentArray.0;TypeVar[mongoose.Types.Array.0].TypeVar[mongoose.Types.Subdocument.0].TypeVar[mongoose.InferId.0]",
+            "mongoose.Types.Subdocument.0;TypeVar[mongoose.Document.0]",
+            "mongoose.UnpackedIntersection.0;",
+            "mongoose.UpdateQuery.0;TypeVar[mongoose._UpdateQuery.0].TypeVar[mongoose._UpdateQueryDef.0]",
+            "mongoose.VirtualType.0;Member[get,set].Argument[0].Argument[1].TypeVar[mongoose.VirtualType.0]",
+            "mongoose.VirtualType.0;Member[get,set].Argument[0].Argument[2]",
+            "mongoose.VirtualTypeOptions.0;Member[foreignField,localField].Argument[0]",
+            "mongoose._FilterQuery.0;TypeVar[mongoose.RootQuerySelector.0]",
+            "mongoose._UpdateQuery.0;Member[$currentDate,$inc,$max,$min,$mul,$pop,$pull,$pullAll,$push,$set,$setOnInsert,$unset].TypeVar[mongoose.AnyKeys.0]"
+        ]
+    }
+}

javascript/ql/lib/semmle/javascript/frameworks/mssql/Model.qll

@@ -0,0 +1,45 @@
+/** Generated model file */
+
+private import javascript
+
+private class Types extends ModelInput::TypeModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "mssql;ConnectionPool;mssql/msnodesqlv8;;Member[connect].ReturnValue.Awaited", //
+        "mssql;ConnectionPool;mssql/msnodesqlv8;;Member[pool]", //
+        "mssql;ConnectionPool;mssql;;Member[connect].ReturnValue.Awaited", //
+        "mssql;ConnectionPool;mssql;;Member[pool]", //
+        "mssql;ConnectionPool;mssql;ConnectionPool;Member[connect].WithArity[0].ReturnValue.Awaited", //
+        "mssql;ConnectionPool;mssql;ConnectionPoolStatic;Instance", //
+        "mssql;ConnectionPoolStatic;mssql/msnodesqlv8;;Member[ConnectionPool]", //
+        "mssql;ConnectionPoolStatic;mssql;;Member[ConnectionPool]", //
+        "mssql;PreparedStatement;mssql;PreparedStatement;Member[input,output].ReturnValue", //
+        "mssql;PreparedStatement;mssql;PreparedStatement;Member[prepare].WithArity[0,1,2].ReturnValue", //
+        "mssql;PreparedStatement;mssql;PreparedStatement;Member[unprepare].WithArity[1].ReturnValue", //
+        "mssql;PreparedStatement;mssql;PreparedStatementStatic;Instance", //
+        "mssql;PreparedStatement;mssql;Request;Member[pstatement]", //
+        "mssql;PreparedStatementStatic;mssql/msnodesqlv8;;Member[PreparedStatement]", //
+        "mssql;PreparedStatementStatic;mssql;;Member[PreparedStatement]", //
+        "mssql;Request;mssql;ConnectionPool;Member[request].ReturnValue", //
+        "mssql;Request;mssql;PreparedStatement;Member[execute].WithArity[2].ReturnValue", //
+        "mssql;Request;mssql;Request;Member[input,output,replaceInput].ReturnValue", //
+        "mssql;Request;mssql;Request;Member[replaceOutput].ReturnValue", //
+        "mssql;Request;mssql;RequestStatic;Instance", //
+        "mssql;Request;mssql;Transaction;Member[request].ReturnValue", //
+        "mssql;RequestStatic;mssql/msnodesqlv8;;Member[Request]", //
+        "mssql;RequestStatic;mssql;;Member[Request]", //
+        "mssql;Transaction;mssql;ConnectionPool;Member[transaction].ReturnValue", //
+        "mssql;Transaction;mssql;PreparedStatement;Member[transaction]", //
+        "mssql;Transaction;mssql;Request;Member[transaction]", //
+        "mssql;Transaction;mssql;Transaction;Member[begin].WithArity[0,1,2].ReturnValue", //
+        "mssql;Transaction;mssql;Transaction;Member[begin].WithArity[0,1].ReturnValue.Awaited", //
+        "mssql;Transaction;mssql;TransactionStatic;Instance", //
+        "mssql;TransactionStatic;mssql/msnodesqlv8;;Member[Transaction]", //
+        "mssql;TransactionStatic;mssql;;Member[Transaction]", //
+        "mssql;config;mssql/msnodesqlv8;;Member[connect].Argument[0]", //
+        "mssql;config;mssql;;Member[connect].Argument[0]", //
+        "mssql;config;mssql;ConnectionPoolStatic;WithArity[1,2].Argument[0]", //
+      ]
+  }
+}

javascript/ql/lib/semmle/javascript/frameworks/mssql/model.json

@@ -0,0 +1,66 @@
+{
+    "packages": {
+        "@types/mssql": "8.0.1"
+    },
+    "resolutions": {
+        "@types/node": "17.0.35",
+        "@types/tedious": "4.0.7",
+        "tarn": "3.0.2"
+    },
+    "language": "javascript",
+    "usedTypes": {
+        "sources": [
+            "mssql;Request",
+            "mssql;ConnectionPool"
+        ],
+        "sinks": [
+            "mssql;config"
+        ]
+    },
+    "model": {
+        "typeDefinitions": [
+            "mssql;Request;mssql;Request;Member[replaceOutput].ReturnValue"
+        ],
+        "sinks": []
+    },
+    "generatedModel": {
+        "//": "Autogenerated section. Manual edits in here will be lost.",
+        "typeDefinitions": [
+            "mssql;ConnectionPool;mssql/msnodesqlv8;;Member[connect].ReturnValue.Awaited",
+            "mssql;ConnectionPool;mssql/msnodesqlv8;;Member[pool]",
+            "mssql;ConnectionPool;mssql;;Member[connect].ReturnValue.Awaited",
+            "mssql;ConnectionPool;mssql;;Member[pool]",
+            "mssql;ConnectionPool;mssql;ConnectionPool;Member[connect].WithArity[0].ReturnValue.Awaited",
+            "mssql;ConnectionPool;mssql;ConnectionPoolStatic;Instance",
+            "mssql;ConnectionPoolStatic;mssql/msnodesqlv8;;Member[ConnectionPool]",
+            "mssql;ConnectionPoolStatic;mssql;;Member[ConnectionPool]",
+            "mssql;PreparedStatement;mssql;PreparedStatement;Member[input,output].ReturnValue",
+            "mssql;PreparedStatement;mssql;PreparedStatement;Member[prepare].WithArity[0,1,2].ReturnValue",
+            "mssql;PreparedStatement;mssql;PreparedStatement;Member[unprepare].WithArity[1].ReturnValue",
+            "mssql;PreparedStatement;mssql;PreparedStatementStatic;Instance",
+            "mssql;PreparedStatement;mssql;Request;Member[pstatement]",
+            "mssql;PreparedStatementStatic;mssql/msnodesqlv8;;Member[PreparedStatement]",
+            "mssql;PreparedStatementStatic;mssql;;Member[PreparedStatement]",
+            "mssql;Request;mssql;ConnectionPool;Member[request].ReturnValue",
+            "mssql;Request;mssql;PreparedStatement;Member[execute].WithArity[2].ReturnValue",
+            "mssql;Request;mssql;Request;Member[input,output,replaceInput].ReturnValue",
+            "mssql;Request;mssql;RequestStatic;Instance",
+            "mssql;Request;mssql;Transaction;Member[request].ReturnValue",
+            "mssql;RequestStatic;mssql/msnodesqlv8;;Member[Request]",
+            "mssql;RequestStatic;mssql;;Member[Request]",
+            "mssql;Transaction;mssql;ConnectionPool;Member[transaction].ReturnValue",
+            "mssql;Transaction;mssql;PreparedStatement;Member[transaction]",
+            "mssql;Transaction;mssql;Request;Member[transaction]",
+            "mssql;Transaction;mssql;Transaction;Member[begin].WithArity[0,1,2].ReturnValue",
+            "mssql;Transaction;mssql;Transaction;Member[begin].WithArity[0,1].ReturnValue.Awaited",
+            "mssql;Transaction;mssql;TransactionStatic;Instance",
+            "mssql;TransactionStatic;mssql/msnodesqlv8;;Member[Transaction]",
+            "mssql;TransactionStatic;mssql;;Member[Transaction]",
+            "mssql;config;mssql/msnodesqlv8;;Member[connect].Argument[0]",
+            "mssql;config;mssql;;Member[connect].Argument[0]",
+            "mssql;config;mssql;ConnectionPoolStatic;WithArity[1,2].Argument[0]"
+        ],
+        "summaries": [],
+        "typeVariables": []
+    }
+}

javascript/ql/lib/semmle/javascript/frameworks/mysql/Model.qll

@@ -0,0 +1,79 @@
+/** Generated model file */
+
+private import javascript
+
+private class Types extends ModelInput::TypeModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "mysql2/promise;Connection;mysql2/promise;;Member[createConnectionPromise].ReturnValue.Awaited", //
+        "mysql2/promise;Connection;mysql2/promise;;Member[createConnection].ReturnValue.Awaited", //
+        "mysql2/promise;Connection;mysql2/promise;PoolConnection;", //
+        "mysql2/promise;Connection;mysql2;;Member[createConnectionPromise].ReturnValue.Awaited", //
+        "mysql2/promise;Connection;mysql2;Connection;Member[promise].ReturnValue", //
+        "mysql2/promise;Pool;mysql2/promise;;Member[createPool].ReturnValue", //
+        "mysql2/promise;Pool;mysql2/promise;Pool;Member[addListener,on,once,prependListener,prependOnceListener].ReturnValue", //
+        "mysql2/promise;Pool;mysql2;Pool;Member[promise].ReturnValue", //
+        "mysql2/promise;PoolConnection;mysql2/promise;Pool;Member[addListener,on,once,prependListener,prependOnceListener].WithArity[2].WithStringArgument[0=acquire,0=connection,0=release].Argument[1].Argument[0]", //
+        "mysql2/promise;PoolConnection;mysql2/promise;Pool;Member[getConnection].ReturnValue.Awaited", //
+        "mysql2/promise;PoolConnection;mysql2;PoolConnection;Member[promise].ReturnValue", //
+        "mysql2/typings/mysql/lib/Connection;;mysql2/typings/mysql/lib/PoolConnection;;", //
+        "mysql2/typings/mysql/lib/Connection;;mysql2/typings/mysql;Connection;", //
+        "mysql2/typings/mysql/lib/PoolConnection;;mysql2/typings/mysql;PoolConnection;", //
+        "mysql2/typings/mysql;Connection;mysql2;Connection;", //
+        "mysql2/typings/mysql;Connection;mysql2;Pool;", //
+        "mysql2/typings/mysql;PoolConnection;mysql2;PoolConnection;", //
+        "mysql2;Connection;mysql2;;Member[createConnection].ReturnValue", //
+        "mysql2;Connection;mysql2;PoolConnection;", //
+        "mysql2;Connection;mysql2;authPlugins;Argument[0].Member[connection]", //
+        "mysql2;ConnectionOptions;mysql2/promise;;Member[createConnection].Argument[0]", //
+        "mysql2;ConnectionOptions;mysql2/promise;Connection;Member[changeUser].Argument[0]", //
+        "mysql2;ConnectionOptions;mysql2/promise;Connection;Member[config]", //
+        "mysql2;ConnectionOptions;mysql2;;Member[createConnection].Argument[0]", //
+        "mysql2;ConnectionOptions;mysql2;PoolOptions;", //
+        "mysql2;Pool;mysql2;;Member[createPool].ReturnValue", //
+        "mysql2;Pool;mysql2;Pool;Member[addListener,on,once,prependListener,prependOnceListener].ReturnValue", //
+        "mysql2;PoolConnection;mysql2;Pool;Member[addListener,on,once,prependListener,prependOnceListener].WithArity[2].WithStringArgument[0=acquire,0=connection,0=release].Argument[1].Argument[0]", //
+        "mysql2;PoolConnection;mysql2;Pool;Member[getConnection].Argument[0].Argument[1]", //
+        "mysql2;PoolOptions;mysql2/promise;;Member[createPool].Argument[0]", //
+        "mysql2;PoolOptions;mysql2;;Member[createPool].Argument[0]", //
+        "mysql2;authPlugins;mysql2;ConnectionOptions;Member[authPlugins].AnyMember", //
+        "mysql;Connection;mysql;;Member[createConnection].ReturnValue", //
+        "mysql;Connection;mysql;Pool;Member[on,addListener].WithStringArgument[0=acquire,0=connection,0=release].Argument[1].Argument[0]", //
+        "mysql;Connection;mysql;PoolConnection;", //
+        "mysql;Connection;mysql;Query;Member[RowDataPacket].Argument[2]", //
+        "mysql;ConnectionConfig;mysql;;Member[createConnection].Argument[0]", //
+        "mysql;ConnectionConfig;mysql;Connection;Member[config]", //
+        "mysql;ConnectionConfig;mysql;PoolConfig;", //
+        "mysql;ConnectionOptions;mysql;Connection;Member[changeUser].WithArity[1,2].Argument[0]", //
+        "mysql;ConnectionOptions;mysql;ConnectionConfig;", //
+        "mysql;Pool;mysql;;Member[createPool].ReturnValue", //
+        "mysql;Pool;mysql;PoolCluster;Member[of].ReturnValue", //
+        "mysql;PoolCluster;mysql;;Member[createPoolCluster].ReturnValue", //
+        "mysql;PoolConfig;mysql;;Member[createPool].Argument[0]", //
+        "mysql;PoolConfig;mysql;PoolCluster;Member[add].Argument[1]", //
+        "mysql;PoolConfig;mysql;PoolCluster;Member[add].WithArity[1].Argument[0]", //
+        "mysql;PoolConnection;mysql;Pool;Member[acquireConnection].Argument[0]", //
+        "mysql;PoolConnection;mysql;Pool;Member[acquireConnection].Argument[1].Argument[1]", //
+        "mysql;PoolConnection;mysql;Pool;Member[getConnection].Argument[0].Argument[1]", //
+        "mysql;PoolConnection;mysql;PoolCluster;Member[getConnection].Argument[1,2].Argument[1]", //
+        "mysql;PoolConnection;mysql;PoolCluster;Member[getConnection].WithArity[1].Argument[0].Argument[1]", //
+        "mysql;Query;mysql;Query;Member[on].ReturnValue", //
+        "mysql;Query;mysql;QueryFunction;ReturnValue", //
+        "mysql;Query;mysql;QueryFunction;WithArity[1].Argument[0]", //
+        "mysql;QueryFunction;mysql;Connection;Member[createQuery,query]", //
+        "mysql;QueryFunction;mysql;Pool;Member[query]", //
+      ]
+  }
+}
+
+private class Summaries extends ModelInput::SummaryModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "mysql2/promise;Pool;;;Member[addListener,on,once,prependListener,prependOnceListener].ReturnValue;type", //
+        "mysql2/typings/mysql/lib/Connection;;;;Member[addListener,on,once,prependListener,prependOnceListener].ReturnValue;type", //
+        "mysql2;Pool;;;Member[addListener,on,once,prependListener,prependOnceListener].ReturnValue;type", //
+      ]
+  }
+}

javascript/ql/lib/semmle/javascript/frameworks/mysql/model.json

@@ -0,0 +1,100 @@
+{
+    "packages": {
+        "@types/mysql": "2.15.21",
+        "mysql2": "2.3.3"
+    },
+    "resolutions": {
+        "@types/node": "17.0.40",
+        "denque": "2.1.0",
+        "iconv-lite": "0.6.3"
+    },
+    "language": "javascript",
+    "usedTypes": {
+        "sources": [
+            "mysql;Pool",
+            "mysql;Connection",
+            "mysql2;Pool",
+            "mysql2;Connection",
+            "mysql2/promise;Pool",
+            "mysql2/promise;Connection"
+        ],
+        "sinks": [
+            "mysql;ConnectionOptions",
+            "mysql2;ConnectionOptions",
+            "mysql2/promise;ConnectionOptions"
+        ]
+    },
+    "model": {
+        "sinks": [],
+        "typeDefinitions": [
+            "mysql;Connection;mysql;Pool;Member[on,addListener].WithStringArgument[0=acquire,0=connection,0=release].Argument[1].Argument[0]",
+            "mysql2/promise;Connection;mysql2;;Member[createConnectionPromise].ReturnValue.Awaited",
+            "mysql2/promise;Connection;mysql2/promise;;Member[createConnectionPromise].ReturnValue.Awaited"
+        ]
+    },
+    "generatedModel": {
+        "//": "Autogenerated section. Manual edits in here will be lost.",
+        "typeDefinitions": [
+            "mysql2/promise;Connection;mysql2/promise;;Member[createConnection].ReturnValue.Awaited",
+            "mysql2/promise;Connection;mysql2/promise;PoolConnection;",
+            "mysql2/promise;Connection;mysql2;Connection;Member[promise].ReturnValue",
+            "mysql2/promise;Pool;mysql2/promise;;Member[createPool].ReturnValue",
+            "mysql2/promise;Pool;mysql2/promise;Pool;Member[addListener,on,once,prependListener,prependOnceListener].ReturnValue",
+            "mysql2/promise;Pool;mysql2;Pool;Member[promise].ReturnValue",
+            "mysql2/promise;PoolConnection;mysql2/promise;Pool;Member[addListener,on,once,prependListener,prependOnceListener].WithArity[2].WithStringArgument[0=acquire,0=connection,0=release].Argument[1].Argument[0]",
+            "mysql2/promise;PoolConnection;mysql2/promise;Pool;Member[getConnection].ReturnValue.Awaited",
+            "mysql2/promise;PoolConnection;mysql2;PoolConnection;Member[promise].ReturnValue",
+            "mysql2/typings/mysql/lib/Connection;;mysql2/typings/mysql/lib/PoolConnection;;",
+            "mysql2/typings/mysql/lib/Connection;;mysql2/typings/mysql;Connection;",
+            "mysql2/typings/mysql/lib/PoolConnection;;mysql2/typings/mysql;PoolConnection;",
+            "mysql2/typings/mysql;Connection;mysql2;Connection;",
+            "mysql2/typings/mysql;Connection;mysql2;Pool;",
+            "mysql2/typings/mysql;PoolConnection;mysql2;PoolConnection;",
+            "mysql2;Connection;mysql2;;Member[createConnection].ReturnValue",
+            "mysql2;Connection;mysql2;PoolConnection;",
+            "mysql2;Connection;mysql2;authPlugins;Argument[0].Member[connection]",
+            "mysql2;ConnectionOptions;mysql2/promise;;Member[createConnection].Argument[0]",
+            "mysql2;ConnectionOptions;mysql2/promise;Connection;Member[changeUser].Argument[0]",
+            "mysql2;ConnectionOptions;mysql2/promise;Connection;Member[config]",
+            "mysql2;ConnectionOptions;mysql2;;Member[createConnection].Argument[0]",
+            "mysql2;ConnectionOptions;mysql2;PoolOptions;",
+            "mysql2;Pool;mysql2;;Member[createPool].ReturnValue",
+            "mysql2;Pool;mysql2;Pool;Member[addListener,on,once,prependListener,prependOnceListener].ReturnValue",
+            "mysql2;PoolConnection;mysql2;Pool;Member[addListener,on,once,prependListener,prependOnceListener].WithArity[2].WithStringArgument[0=acquire,0=connection,0=release].Argument[1].Argument[0]",
+            "mysql2;PoolConnection;mysql2;Pool;Member[getConnection].Argument[0].Argument[1]",
+            "mysql2;PoolOptions;mysql2/promise;;Member[createPool].Argument[0]",
+            "mysql2;PoolOptions;mysql2;;Member[createPool].Argument[0]",
+            "mysql2;authPlugins;mysql2;ConnectionOptions;Member[authPlugins].AnyMember",
+            "mysql;Connection;mysql;;Member[createConnection].ReturnValue",
+            "mysql;Connection;mysql;PoolConnection;",
+            "mysql;Connection;mysql;Query;Member[RowDataPacket].Argument[2]",
+            "mysql;ConnectionConfig;mysql;;Member[createConnection].Argument[0]",
+            "mysql;ConnectionConfig;mysql;Connection;Member[config]",
+            "mysql;ConnectionConfig;mysql;PoolConfig;",
+            "mysql;ConnectionOptions;mysql;Connection;Member[changeUser].WithArity[1,2].Argument[0]",
+            "mysql;ConnectionOptions;mysql;ConnectionConfig;",
+            "mysql;Pool;mysql;;Member[createPool].ReturnValue",
+            "mysql;Pool;mysql;PoolCluster;Member[of].ReturnValue",
+            "mysql;PoolCluster;mysql;;Member[createPoolCluster].ReturnValue",
+            "mysql;PoolConfig;mysql;;Member[createPool].Argument[0]",
+            "mysql;PoolConfig;mysql;PoolCluster;Member[add].Argument[1]",
+            "mysql;PoolConfig;mysql;PoolCluster;Member[add].WithArity[1].Argument[0]",
+            "mysql;PoolConnection;mysql;Pool;Member[acquireConnection].Argument[0]",
+            "mysql;PoolConnection;mysql;Pool;Member[acquireConnection].Argument[1].Argument[1]",
+            "mysql;PoolConnection;mysql;Pool;Member[getConnection].Argument[0].Argument[1]",
+            "mysql;PoolConnection;mysql;PoolCluster;Member[getConnection].Argument[1,2].Argument[1]",
+            "mysql;PoolConnection;mysql;PoolCluster;Member[getConnection].WithArity[1].Argument[0].Argument[1]",
+            "mysql;Query;mysql;Query;Member[on].ReturnValue",
+            "mysql;Query;mysql;QueryFunction;ReturnValue",
+            "mysql;Query;mysql;QueryFunction;WithArity[1].Argument[0]",
+            "mysql;QueryFunction;mysql;Connection;Member[createQuery,query]",
+            "mysql;QueryFunction;mysql;Pool;Member[query]"
+        ],
+        "summaries": [
+            "mysql2/promise;Pool;;;Member[addListener,on,once,prependListener,prependOnceListener].ReturnValue;type",
+            "mysql2/typings/mysql/lib/Connection;;;;Member[addListener,on,once,prependListener,prependOnceListener].ReturnValue;type",
+            "mysql2;Pool;;;Member[addListener,on,once,prependListener,prependOnceListener].ReturnValue;type"
+        ],
+        "typeVariables": []
+    }
+}

javascript/ql/lib/semmle/javascript/frameworks/pg/Model.qll

@@ -0,0 +1,120 @@
+/** Generated model file */
+
+private import javascript
+
+private class Types extends ModelInput::TypeModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "events;;pg-cursor;;", //
+        "events;;pg-promise/pg-subset;pg.IClient;", //
+        "events;;pg-promise/pg-subset;pg.IConnection;", //
+        "events;;pg-promise/pg-subset;pg.IPool;", //
+        "events;;pg;ClientBase;", //
+        "events;;pg;Events;", //
+        "events;;pg;Pool;", //
+        "global;NodeJS.EventEmitter;events;;", //
+        "pg-cursor;;pg-cursor;Static;Instance", //
+        "pg-cursor;Static;pg-cursor;;", //
+        "pg-pool;;pg-pool;;Member[addListener,on,once,prependListener,prependOnceListener].ReturnValue", //
+        "pg-pool;;pg-pool;Static;Instance", //
+        "pg-pool;Static;pg-pool;;", //
+        "pg-promise/pg-subset;pg.IClient;pg-promise/pg-subset;;Member[Client].Instance", //
+        "pg-promise/pg-subset;pg.IClient;pg-promise;;Argument[0].TypeVar[pg-promise.IInitOptions.1]", //
+        "pg-promise/pg-subset;pg.IClient;pg-promise;IMain;Argument[0].TypeVar[pg-promise/pg-subset.pg.IConnectionParameters.0]", //
+        "pg-promise/pg-subset;pg.IClient;pg-promise;IMain;ReturnValue.TypeVar[pg-promise.IDatabase.1]", //
+        "pg-promise/pg-subset;pg.IConnection;pg-promise/pg-subset;pg.IClient;Member[connection]", //
+        "pg-promise/pg-subset;pg.IPool;pg-promise;IDatabase;Member[$pool]", //
+        "pg-promise;IBaseProtocol;pg-promise/typescript/pg-promise;IBaseProtocol;", //
+        "pg-promise;IBaseProtocol;pg-promise;IConnected;", //
+        "pg-promise;IBaseProtocol;pg-promise;IDatabase;", //
+        "pg-promise;IBaseProtocol;pg-promise;ITask;", //
+        "pg-promise;IConnected;pg-promise/typescript/pg-promise;IConnected;", //
+        "pg-promise;IConnected;pg-promise;IDatabase;Member[connect].ReturnValue.Awaited", //
+        "pg-promise;IDatabase;pg-promise/typescript/pg-promise;IDatabase;", //
+        "pg-promise;IDatabase;pg-promise;IInitOptions;Member[extend].Argument[0]", //
+        "pg-promise;IDatabase;pg-promise;IMain;ReturnValue", //
+        "pg-promise;IInitOptions;pg-promise/typescript/pg-promise;IInitOptions;", //
+        "pg-promise;IInitOptions;pg-promise;;Argument[0]", //
+        "pg-promise;IInitOptions;pg-promise;ILibConfig;Member[options]", //
+        "pg-promise;ILibConfig;pg-promise/typescript/pg-promise;ILibConfig;", //
+        "pg-promise;ILibConfig;pg-promise;IDatabase;Member[$config]", //
+        "pg-promise;IMain;pg-promise/typescript/pg-promise;IMain;", //
+        "pg-promise;IMain;pg-promise;;ReturnValue", //
+        "pg-promise;IMain;pg-promise;ILibConfig;Member[pgp]", //
+        "pg-promise;ITask;pg-promise/typescript/pg-promise;ITask;", //
+        "pg-promise;ITask;pg-promise;IBaseProtocol;Member[task,taskIf,tx,txIf].Argument[1].Argument[0]", //
+        "pg-promise;ITask;pg-promise;IBaseProtocol;Member[task,taskIf,tx,txIf].WithArity[1].Argument[0].Argument[0]", //
+        "pg-promise;ITask;pg-promise;IBaseProtocol;Member[taskIf].WithArity[2].Argument[0].Member[cnd].Argument[0]", //
+        "pg-promise;ITask;pg-promise;IBaseProtocol;Member[txIf].WithArity[2].Argument[0].Member[cnd,reusable].Argument[0]", //
+        "pg;Client;pg-pool;Static;Instance.TypeVar[pg-pool..0]", //
+        "pg;Client;pg-promise/pg-subset;pg.IClient;", //
+        "pg;Client;pg;ClientStatic;Instance", //
+        "pg;Client;pg;Events;Member[addListener,on,once,prependListener,prependOnceListener].Argument[1].Argument[1]", //
+        "pg;ClientBase;pg;Client;", //
+        "pg;ClientBase;pg;PoolClient;", //
+        "pg;ClientStatic;pg;;Member[Client]", //
+        "pg;Connection;pg-promise/pg-subset;pg.IConnection;", //
+        "pg;Events;pg;Events;Member[addListener,on,once,prependListener,prependOnceListener].ReturnValue", //
+        "pg;Events;pg;EventsStatic;Instance", //
+        "pg;EventsStatic;pg;;Member[Events]", //
+        "pg;Pool;pg-pool;;", //
+        "pg;Pool;pg-promise/pg-subset;pg.IPool;", //
+        "pg;Pool;pg;Pool;Member[addListener,on,once,prependListener,prependOnceListener].ReturnValue", //
+        "pg;Pool;pg;PoolStatic;Instance", //
+        "pg;PoolClient;pg-pool;;Member[addListener,on,once,prependListener,prependOnceListener].WithArity[2].WithStringArgument[0=acquire,0=connect,0=remove].Argument[1].Argument[0]", //
+        "pg;PoolClient;pg-pool;;Member[addListener,on,once,prependListener,prependOnceListener].WithArity[2].WithStringArgument[0=error].Argument[1].Argument[1]", //
+        "pg;PoolClient;pg-pool;;Member[connect].Argument[0].Argument[1]", //
+        "pg;PoolClient;pg-pool;;Member[connect].WithArity[0].ReturnValue.Awaited", //
+        "pg;PoolClient;pg;Pool;Member[addListener,on,once,prependListener,prependOnceListener].WithArity[2].WithStringArgument[0=acquire,0=connect,0=remove].Argument[1].Argument[0]", //
+        "pg;PoolClient;pg;Pool;Member[addListener,on,once,prependListener,prependOnceListener].WithArity[2].WithStringArgument[0=error].Argument[1].Argument[1]", //
+        "pg;PoolClient;pg;Pool;Member[connect].Argument[0].Argument[1]", //
+        "pg;PoolClient;pg;Pool;Member[connect].WithArity[0].ReturnValue.Awaited", //
+        "pg;PoolStatic;pg;;Member[Pool]", //
+      ]
+  }
+}
+
+private class Summaries extends ModelInput::SummaryModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "global;NodeJS.EventEmitter;;;Member[addListener,off,on,once,prependListener,prependOnceListener,removeAllListeners,removeListener,setMaxListeners].ReturnValue;type", //
+        "pg-pool;;;;Member[addListener,on,once,prependListener,prependOnceListener].ReturnValue;type", //
+        "pg;ClientBase;;;Member[addListener,on,once,prependListener,prependOnceListener].ReturnValue;type", //
+        "pg;Events;;;Member[addListener,on,once,prependListener,prependOnceListener].ReturnValue;type", //
+        "pg;Pool;;;Member[addListener,on,once,prependListener,prependOnceListener].ReturnValue;type", //
+      ]
+  }
+}
+
+private class TypeVariables extends ModelInput::TypeVariableModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "pg-pool..0;Member[Client].TypeVar[pg-pool.ClientLikeCtr.0]", //
+        "pg-pool..0;Member[addListener,on,once,prependListener,prependOnceListener].WithArity[2].WithStringArgument[0=acquire,0=connect,0=remove].Argument[1].Argument[0]", //
+        "pg-pool..0;Member[addListener,on,once,prependListener,prependOnceListener].WithArity[2].WithStringArgument[0=error].Argument[1].Argument[1]", //
+        "pg-pool..0;Member[connect].Argument[0].Argument[1]", //
+        "pg-pool..0;Member[connect].WithArity[0].ReturnValue.Awaited", //
+        "pg-pool.ClientLikeCtr.0;Instance", //
+        "pg-promise.IConnected.1;Member[client]", //
+        "pg-promise.IConnectionOptions.0;Member[onLost].Argument[1].TypeVar[pg-promise.ILostContext.0]", //
+        "pg-promise.IDatabase.1;Member[$cn].TypeVar[pg-promise/pg-subset.pg.IConnectionParameters.0]", //
+        "pg-promise.IDatabase.1;Member[$config].TypeVar[pg-promise.ILibConfig.1]", //
+        "pg-promise.IDatabase.1;Member[connect].Argument[0].TypeVar[pg-promise.IConnectionOptions.0]", //
+        "pg-promise.IDatabase.1;Member[connect].ReturnValue.Awaited.TypeVar[pg-promise.IConnected.1]", //
+        "pg-promise.IEventContext.0;Member[client]", //
+        "pg-promise.IInitOptions.1;Member[connect,disconnect].Argument[0]", //
+        "pg-promise.IInitOptions.1;Member[error].Argument[1].TypeVar[pg-promise.IEventContext.0]", //
+        "pg-promise.IInitOptions.1;Member[extend].Argument[0].TypeVar[pg-promise.IDatabase.1]", //
+        "pg-promise.IInitOptions.1;Member[query,task,transact].Argument[0].TypeVar[pg-promise.IEventContext.0]", //
+        "pg-promise.IInitOptions.1;Member[receive].Argument[2].TypeVar[pg-promise.IEventContext.0]", //
+        "pg-promise.ILibConfig.1;Member[options].TypeVar[pg-promise.IInitOptions.1]", //
+        "pg-promise.ILibConfig.1;Member[pgp].TypeVar[pg-promise.IMain.1]", //
+        "pg-promise.ILostContext.0;Member[client]", //
+        "pg-promise/pg-promise.XPromise.0;Awaited", //
+        "pg-promise/pg-subset.pg.IConnectionParameters.0;Member[Client].Instance", //
+      ]
+  }
+}

javascript/ql/lib/semmle/javascript/frameworks/pg/model.json

@@ -0,0 +1,138 @@
+{
+    "packages": {
+        "@types/node": "18.6.5",
+        "@types/pg": "8.6.5",
+        "@types/pg-cursor": "2.7.0",
+        "@types/pg-pool": "2.0.3",
+        "pg-promise": "10.11.1"
+    },
+    "resolutions": {
+        "assert-options": "0.7.0",
+        "pg-minify": "1.6.2",
+        "pg-protocol": "1.5.0",
+        "pg-types": "2.2.0",
+        "postgres-array": "2.0.0",
+        "postgres-interval": "1.2.0",
+        "spex": "3.2.0"
+    },
+    "language": "javascript",
+    "usedTypes": {
+        "sources": [
+            "pg-cursor;",
+            "pg-pool;",
+            "pg-promise;IBaseProtocol",
+            "pg;Client",
+            "pg;ClientStatic",
+            "pg;Pool",
+            "pg;PoolClient",
+            "pg;PoolStatic"
+        ]
+    },
+    "model": {
+        "typeDefinitions": [
+            "pg;Client;pg-promise/pg-subset;pg.IClient;",
+            "pg;Connection;pg-promise/pg-subset;pg.IConnection;",
+            "pg;Pool;pg-promise/pg-subset;pg.IPool;"
+        ],
+        "sinks": []
+    },
+    "generatedModel": {
+        "//": "Autogenerated section. Manual edits in here will be lost.",
+        "typeDefinitions": [
+            "events;;pg-cursor;;",
+            "events;;pg-promise/pg-subset;pg.IClient;",
+            "events;;pg-promise/pg-subset;pg.IConnection;",
+            "events;;pg-promise/pg-subset;pg.IPool;",
+            "events;;pg;ClientBase;",
+            "events;;pg;Events;",
+            "events;;pg;Pool;",
+            "global;NodeJS.EventEmitter;events;;",
+            "pg-cursor;;pg-cursor;Static;Instance",
+            "pg-cursor;Static;pg-cursor;;",
+            "pg-pool;;pg-pool;;Member[addListener,on,once,prependListener,prependOnceListener].ReturnValue",
+            "pg-pool;;pg-pool;Static;Instance",
+            "pg-pool;Static;pg-pool;;",
+            "pg-promise/pg-subset;pg.IClient;pg-promise/pg-subset;;Member[Client].Instance",
+            "pg-promise/pg-subset;pg.IClient;pg-promise;;Argument[0].TypeVar[pg-promise.IInitOptions.1]",
+            "pg-promise/pg-subset;pg.IClient;pg-promise;IMain;Argument[0].TypeVar[pg-promise/pg-subset.pg.IConnectionParameters.0]",
+            "pg-promise/pg-subset;pg.IClient;pg-promise;IMain;ReturnValue.TypeVar[pg-promise.IDatabase.1]",
+            "pg-promise/pg-subset;pg.IConnection;pg-promise/pg-subset;pg.IClient;Member[connection]",
+            "pg-promise/pg-subset;pg.IPool;pg-promise;IDatabase;Member[$pool]",
+            "pg-promise;IBaseProtocol;pg-promise/typescript/pg-promise;IBaseProtocol;",
+            "pg-promise;IBaseProtocol;pg-promise;IConnected;",
+            "pg-promise;IBaseProtocol;pg-promise;IDatabase;",
+            "pg-promise;IBaseProtocol;pg-promise;ITask;",
+            "pg-promise;IConnected;pg-promise/typescript/pg-promise;IConnected;",
+            "pg-promise;IConnected;pg-promise;IDatabase;Member[connect].ReturnValue.Awaited",
+            "pg-promise;IDatabase;pg-promise/typescript/pg-promise;IDatabase;",
+            "pg-promise;IDatabase;pg-promise;IInitOptions;Member[extend].Argument[0]",
+            "pg-promise;IDatabase;pg-promise;IMain;ReturnValue",
+            "pg-promise;IInitOptions;pg-promise/typescript/pg-promise;IInitOptions;",
+            "pg-promise;IInitOptions;pg-promise;;Argument[0]",
+            "pg-promise;IInitOptions;pg-promise;ILibConfig;Member[options]",
+            "pg-promise;ILibConfig;pg-promise/typescript/pg-promise;ILibConfig;",
+            "pg-promise;ILibConfig;pg-promise;IDatabase;Member[$config]",
+            "pg-promise;IMain;pg-promise/typescript/pg-promise;IMain;",
+            "pg-promise;IMain;pg-promise;;ReturnValue",
+            "pg-promise;IMain;pg-promise;ILibConfig;Member[pgp]",
+            "pg-promise;ITask;pg-promise/typescript/pg-promise;ITask;",
+            "pg-promise;ITask;pg-promise;IBaseProtocol;Member[task,taskIf,tx,txIf].Argument[1].Argument[0]",
+            "pg-promise;ITask;pg-promise;IBaseProtocol;Member[task,taskIf,tx,txIf].WithArity[1].Argument[0].Argument[0]",
+            "pg-promise;ITask;pg-promise;IBaseProtocol;Member[taskIf].WithArity[2].Argument[0].Member[cnd].Argument[0]",
+            "pg-promise;ITask;pg-promise;IBaseProtocol;Member[txIf].WithArity[2].Argument[0].Member[cnd,reusable].Argument[0]",
+            "pg;Client;pg-pool;Static;Instance.TypeVar[pg-pool..0]",
+            "pg;Client;pg;ClientStatic;Instance",
+            "pg;Client;pg;Events;Member[addListener,on,once,prependListener,prependOnceListener].Argument[1].Argument[1]",
+            "pg;ClientBase;pg;Client;",
+            "pg;ClientBase;pg;PoolClient;",
+            "pg;ClientStatic;pg;;Member[Client]",
+            "pg;Events;pg;Events;Member[addListener,on,once,prependListener,prependOnceListener].ReturnValue",
+            "pg;Events;pg;EventsStatic;Instance",
+            "pg;EventsStatic;pg;;Member[Events]",
+            "pg;Pool;pg-pool;;",
+            "pg;Pool;pg;Pool;Member[addListener,on,once,prependListener,prependOnceListener].ReturnValue",
+            "pg;Pool;pg;PoolStatic;Instance",
+            "pg;PoolClient;pg-pool;;Member[addListener,on,once,prependListener,prependOnceListener].WithArity[2].WithStringArgument[0=acquire,0=connect,0=remove].Argument[1].Argument[0]",
+            "pg;PoolClient;pg-pool;;Member[addListener,on,once,prependListener,prependOnceListener].WithArity[2].WithStringArgument[0=error].Argument[1].Argument[1]",
+            "pg;PoolClient;pg-pool;;Member[connect].Argument[0].Argument[1]",
+            "pg;PoolClient;pg-pool;;Member[connect].WithArity[0].ReturnValue.Awaited",
+            "pg;PoolClient;pg;Pool;Member[addListener,on,once,prependListener,prependOnceListener].WithArity[2].WithStringArgument[0=acquire,0=connect,0=remove].Argument[1].Argument[0]",
+            "pg;PoolClient;pg;Pool;Member[addListener,on,once,prependListener,prependOnceListener].WithArity[2].WithStringArgument[0=error].Argument[1].Argument[1]",
+            "pg;PoolClient;pg;Pool;Member[connect].Argument[0].Argument[1]",
+            "pg;PoolClient;pg;Pool;Member[connect].WithArity[0].ReturnValue.Awaited",
+            "pg;PoolStatic;pg;;Member[Pool]"
+        ],
+        "summaries": [
+            "global;NodeJS.EventEmitter;;;Member[addListener,off,on,once,prependListener,prependOnceListener,removeAllListeners,removeListener,setMaxListeners].ReturnValue;type",
+            "pg-pool;;;;Member[addListener,on,once,prependListener,prependOnceListener].ReturnValue;type",
+            "pg;ClientBase;;;Member[addListener,on,once,prependListener,prependOnceListener].ReturnValue;type",
+            "pg;Events;;;Member[addListener,on,once,prependListener,prependOnceListener].ReturnValue;type",
+            "pg;Pool;;;Member[addListener,on,once,prependListener,prependOnceListener].ReturnValue;type"
+        ],
+        "typeVariables": [
+            "pg-pool..0;Member[Client].TypeVar[pg-pool.ClientLikeCtr.0]",
+            "pg-pool..0;Member[addListener,on,once,prependListener,prependOnceListener].WithArity[2].WithStringArgument[0=acquire,0=connect,0=remove].Argument[1].Argument[0]",
+            "pg-pool..0;Member[addListener,on,once,prependListener,prependOnceListener].WithArity[2].WithStringArgument[0=error].Argument[1].Argument[1]",
+            "pg-pool..0;Member[connect].Argument[0].Argument[1]",
+            "pg-pool..0;Member[connect].WithArity[0].ReturnValue.Awaited",
+            "pg-pool.ClientLikeCtr.0;Instance",
+            "pg-promise.IConnected.1;Member[client]",
+            "pg-promise.IConnectionOptions.0;Member[onLost].Argument[1].TypeVar[pg-promise.ILostContext.0]",
+            "pg-promise.IDatabase.1;Member[$cn].TypeVar[pg-promise/pg-subset.pg.IConnectionParameters.0]",
+            "pg-promise.IDatabase.1;Member[$config].TypeVar[pg-promise.ILibConfig.1]",
+            "pg-promise.IDatabase.1;Member[connect].Argument[0].TypeVar[pg-promise.IConnectionOptions.0]",
+            "pg-promise.IDatabase.1;Member[connect].ReturnValue.Awaited.TypeVar[pg-promise.IConnected.1]",
+            "pg-promise.IEventContext.0;Member[client]",
+            "pg-promise.IInitOptions.1;Member[connect,disconnect].Argument[0]",
+            "pg-promise.IInitOptions.1;Member[error].Argument[1].TypeVar[pg-promise.IEventContext.0]",
+            "pg-promise.IInitOptions.1;Member[extend].Argument[0].TypeVar[pg-promise.IDatabase.1]",
+            "pg-promise.IInitOptions.1;Member[query,task,transact].Argument[0].TypeVar[pg-promise.IEventContext.0]",
+            "pg-promise.IInitOptions.1;Member[receive].Argument[2].TypeVar[pg-promise.IEventContext.0]",
+            "pg-promise.ILibConfig.1;Member[options].TypeVar[pg-promise.IInitOptions.1]",
+            "pg-promise.ILibConfig.1;Member[pgp].TypeVar[pg-promise.IMain.1]",
+            "pg-promise.ILostContext.0;Member[client]",
+            "pg-promise/pg-promise.XPromise.0;Awaited",
+            "pg-promise/pg-subset.pg.IConnectionParameters.0;Member[Client].Instance"
+        ]
+    }
+}

javascript/ql/lib/semmle/javascript/frameworks/sequelize/Model.qll

@@ -0,0 +1,297 @@
+/** Generated model file */
+
+private import javascript
+
+private class Sinks extends ModelInput::SinkModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "sequelize;;Argument[0..].Member[password];credentials[password]", //
+        "sequelize;;Argument[0..].Member[username];credentials[username]", //
+        "sequelize;;Argument[1];credentials[username]", //
+        "sequelize;;Argument[2];credentials[password]", //
+        "sequelize;Sequelize;Member[query].Argument[0].Member[query];sql-injection", //
+        "sequelize;Sequelize;Member[query].Argument[0];sql-injection", //
+        "sequelize;SequelizeStaticAndInstance;Member[asIs,literal].Argument[0];sql-injection", //
+      ]
+  }
+}
+
+private class Types extends ModelInput::TypeModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "sequelize-typescript/associations/foreign-key/foreign-key-meta;ForeignKeyMeta;sequelize-typescript/associations/foreign-key/foreign-key-service;;Member[getForeignKeys].ReturnValue.ArrayElement", //
+        "sequelize-typescript/model/model/association/association-create-options;AssociationCreateOptions;sequelize-typescript;Model;Member[$create].Argument[2]", //
+        "sequelize-typescript/model/shared/model-not-initialized-error;ModelNotInitializedErrorStatic;sequelize-typescript/model/shared/model-not-initialized-error;;Member[ModelNotInitializedError]", //
+        "sequelize-typescript;AssociationCountOptions;sequelize-typescript/model/model/association/association-count-options;AssociationCountOptions;", //
+        "sequelize-typescript;AssociationCountOptions;sequelize-typescript;Model;Member[$count].Argument[1]", //
+        "sequelize-typescript;AssociationGetOptions;sequelize-typescript/model/model/association/association-get-options;AssociationGetOptions;", //
+        "sequelize-typescript;AssociationGetOptions;sequelize-typescript;Model;Member[$get].Argument[1]", //
+        "sequelize-typescript;AssociationGetOptions;sequelize-typescript;Model;Member[$has].Argument[2]", //
+        "sequelize-typescript;BaseAssociation;sequelize-typescript/associations/shared/association-service;;Member[addAssociation].Argument[1]", //
+        "sequelize-typescript;BaseAssociation;sequelize-typescript/associations/shared/association-service;;Member[getAssociations,getAssociationsByRelation].ReturnValue.ArrayElement", //
+        "sequelize-typescript;BaseAssociation;sequelize-typescript/associations/shared/association-service;;Member[setAssociations].Argument[1].ArrayElement", //
+        "sequelize-typescript;BaseAssociation;sequelize-typescript/associations/shared/base-association;BaseAssociation;", //
+        "sequelize-typescript;BaseAssociation;sequelize-typescript;;Member[addAssociation].Argument[1]", //
+        "sequelize-typescript;BaseAssociation;sequelize-typescript;;Member[getAssociations,getAssociationsByRelation].ReturnValue.ArrayElement", //
+        "sequelize-typescript;BaseAssociation;sequelize-typescript;;Member[setAssociations].Argument[1].ArrayElement", //
+        "sequelize-typescript;BaseAssociation;sequelize-typescript;BaseAssociationStatic;Instance", //
+        "sequelize-typescript;BaseAssociation;sequelize-typescript;BelongsToAssociation;", //
+        "sequelize-typescript;BaseAssociation;sequelize-typescript;BelongsToManyAssociation;", //
+        "sequelize-typescript;BaseAssociation;sequelize-typescript;HasAssociation;", //
+        "sequelize-typescript;BaseAssociationStatic;sequelize-typescript/associations/shared/base-association;;Member[BaseAssociation]", //
+        "sequelize-typescript;BaseAssociationStatic;sequelize-typescript/associations/shared/base-association;BaseAssociationStatic;", //
+        "sequelize-typescript;BaseAssociationStatic;sequelize-typescript;;Member[BaseAssociation]", //
+        "sequelize-typescript;BelongsToAssociation;sequelize-typescript/associations/belongs-to/belongs-to-association;BelongsToAssociation;", //
+        "sequelize-typescript;BelongsToAssociation;sequelize-typescript;BelongsToAssociationStatic;Instance", //
+        "sequelize-typescript;BelongsToAssociationStatic;sequelize-typescript/associations/belongs-to/belongs-to-association;;Member[BelongsToAssociation]", //
+        "sequelize-typescript;BelongsToAssociationStatic;sequelize-typescript/associations/belongs-to/belongs-to-association;BelongsToAssociationStatic;", //
+        "sequelize-typescript;BelongsToAssociationStatic;sequelize-typescript;;Member[BelongsToAssociation]", //
+        "sequelize-typescript;BelongsToManyAssociation;sequelize-typescript/associations/belongs-to-many/belongs-to-many-association;BelongsToManyAssociation;", //
+        "sequelize-typescript;BelongsToManyAssociation;sequelize-typescript;BelongsToManyAssociationStatic;Instance", //
+        "sequelize-typescript;BelongsToManyAssociationStatic;sequelize-typescript/associations/belongs-to-many/belongs-to-many-association;;Member[BelongsToManyAssociation]", //
+        "sequelize-typescript;BelongsToManyAssociationStatic;sequelize-typescript/associations/belongs-to-many/belongs-to-many-association;BelongsToManyAssociationStatic;", //
+        "sequelize-typescript;BelongsToManyAssociationStatic;sequelize-typescript;;Member[BelongsToManyAssociation]", //
+        "sequelize-typescript;DefaultScopeGetter;sequelize-typescript/scopes/default-scope;;Member[DefaultScope].Argument[0]", //
+        "sequelize-typescript;DefaultScopeGetter;sequelize-typescript/scopes/scope-options;DefaultScopeGetter;", //
+        "sequelize-typescript;DefaultScopeGetter;sequelize-typescript;;Member[DefaultScope].Argument[0]", //
+        "sequelize-typescript;DefaultScopeGetter;sequelize-typescript;ScopeOptionsGetters;Member[getDefaultScope]", //
+        "sequelize-typescript;HasAssociation;sequelize-typescript/associations/has/has-association;HasAssociation;", //
+        "sequelize-typescript;HasAssociation;sequelize-typescript;HasAssociationStatic;Instance", //
+        "sequelize-typescript;HasAssociationStatic;sequelize-typescript/associations/has/has-association;;Member[HasAssociation]", //
+        "sequelize-typescript;HasAssociationStatic;sequelize-typescript/associations/has/has-association;HasAssociationStatic;", //
+        "sequelize-typescript;HasAssociationStatic;sequelize-typescript;;Member[HasAssociation]", //
+        "sequelize-typescript;Model;sequelize-typescript/model/model/model;Model;", //
+        "sequelize-typescript;Model;sequelize-typescript;Model;Member[$add,$has,$remove,$set].Argument[1]", //
+        "sequelize-typescript;Model;sequelize-typescript;Model;Member[$add,$has,$remove,$set].Argument[1].ArrayElement", //
+        "sequelize-typescript;Model;sequelize-typescript;Model;Member[$create,reload].ReturnValue.Awaited", //
+        "sequelize-typescript;Model;sequelize-typescript;ModelStatic~;Instance", //
+        "sequelize-typescript;Model;sequelize-typescript;ModelStatic~;Member[initialize].ReturnValue.TypeVar[sequelize-typescript.ModelStatic.0]", //
+        "sequelize-typescript;Model;sequelize-typescript;ModelType;Instance", //
+        "sequelize-typescript;Model;sequelize-typescript;Sequelize;Member[getRepository].Argument[0].Instance", //
+        "sequelize-typescript;Model;sequelize-typescript;Sequelize;Member[getRepository].ReturnValue.TypeVar[sequelize-typescript.Repository.0]", //
+        "sequelize-typescript;ModelClassGetter;sequelize-typescript/associations/belongs-to-many/belongs-to-many;;Member[BelongsToMany].Argument[0,1]", //
+        "sequelize-typescript;ModelClassGetter;sequelize-typescript/associations/belongs-to/belongs-to;;Member[BelongsTo].Argument[0]", //
+        "sequelize-typescript;ModelClassGetter;sequelize-typescript/associations/foreign-key/foreign-key-meta;ForeignKeyMeta;Member[relatedClassGetter]", //
+        "sequelize-typescript;ModelClassGetter;sequelize-typescript/associations/foreign-key/foreign-key-service;;Member[addForeignKey].Argument[1]", //
+        "sequelize-typescript;ModelClassGetter;sequelize-typescript/associations/foreign-key/foreign-key;;Member[ForeignKey].Argument[0]", //
+        "sequelize-typescript;ModelClassGetter;sequelize-typescript/associations/has/has-many;;Member[HasMany].Argument[0]", //
+        "sequelize-typescript;ModelClassGetter;sequelize-typescript/associations/has/has-one;;Member[HasOne].Argument[0]", //
+        "sequelize-typescript;ModelClassGetter;sequelize-typescript/model/shared/model-class-getter;ModelClassGetter;", //
+        "sequelize-typescript;ModelClassGetter;sequelize-typescript;;Member[BelongsTo,ForeignKey,HasMany,HasOne].Argument[0]", //
+        "sequelize-typescript;ModelClassGetter;sequelize-typescript;;Member[BelongsToMany].Argument[0,1]", //
+        "sequelize-typescript;ModelClassGetter;sequelize-typescript;BaseAssociationStatic;Argument[0]", //
+        "sequelize-typescript;ModelClassGetter;sequelize-typescript;BelongsToAssociationStatic;Argument[0]", //
+        "sequelize-typescript;ModelClassGetter;sequelize-typescript;BelongsToManyAssociationStatic;Argument[0]", //
+        "sequelize-typescript;ModelClassGetter;sequelize-typescript;HasAssociationStatic;Argument[0]", //
+        "sequelize-typescript;ModelStatic~;sequelize-typescript/model/model/model;;Member[Model]", //
+        "sequelize-typescript;ModelStatic~;sequelize-typescript/model/model/model;ModelStatic~;", //
+        "sequelize-typescript;ModelStatic~;sequelize-typescript/model/shared/model-not-initialized-error;ModelNotInitializedErrorStatic;Argument[0]", //
+        "sequelize-typescript;ModelStatic~;sequelize-typescript;;Member[Model]", //
+        "sequelize-typescript;ModelType;sequelize-typescript/associations/foreign-key/foreign-key-service;;Member[getForeignKeyOptions].Argument[0,1]", //
+        "sequelize-typescript;ModelType;sequelize-typescript/model/model/model;ModelType;", //
+        "sequelize-typescript;ModelType;sequelize-typescript;BaseAssociation;Member[getAssociatedClass].ReturnValue", //
+        "sequelize-typescript;ModelType;sequelize-typescript;BaseAssociation;Member[getSequelizeOptions].Argument[0]", //
+        "sequelize-typescript;ModelType;sequelize-typescript;BelongsToAssociation;Member[getSequelizeOptions].Argument[0]", //
+        "sequelize-typescript;ModelType;sequelize-typescript;BelongsToManyAssociation;Member[getSequelizeOptions].Argument[0]", //
+        "sequelize-typescript;ModelType;sequelize-typescript;HasAssociation;Member[getSequelizeOptions].Argument[0]", //
+        "sequelize-typescript;ModelType;sequelize-typescript;ModelClassGetter;ReturnValue", //
+        "sequelize-typescript;ModelType;sequelize-typescript;Sequelize;Member[model].Argument[0]", //
+        "sequelize-typescript;ScopeOptionsGetters;sequelize-typescript/scopes/scope-options;ScopeOptionsGetters;", //
+        "sequelize-typescript;ScopeOptionsGetters;sequelize-typescript/scopes/scope-service;;Member[addScopeOptionsGetter,setScopeOptionsGetters].Argument[1]", //
+        "sequelize-typescript;ScopeOptionsGetters;sequelize-typescript/scopes/scope-service;;Member[getScopeOptionsGetters].ReturnValue", //
+        "sequelize-typescript;ScopeOptionsGetters;sequelize-typescript;;Member[addScopeOptionsGetter,setScopeOptionsGetters].Argument[1]", //
+        "sequelize-typescript;ScopeOptionsGetters;sequelize-typescript;;Member[getScopeOptionsGetters].ReturnValue", //
+        "sequelize-typescript;ScopesOptions;sequelize-typescript/scopes/scope-options;ScopesOptions;", //
+        "sequelize-typescript;ScopesOptions;sequelize-typescript/scopes/scope-service;;Member[resolveScope].Argument[2]", //
+        "sequelize-typescript;ScopesOptions;sequelize-typescript;;Member[resolveScope].Argument[2]", //
+        "sequelize-typescript;ScopesOptions;sequelize-typescript;ScopesOptionsGetter;ReturnValue.AnyMember", //
+        "sequelize-typescript;ScopesOptionsGetter;sequelize-typescript/scopes/scope-options;ScopesOptionsGetter;", //
+        "sequelize-typescript;ScopesOptionsGetter;sequelize-typescript/scopes/scopes;;Member[Scopes].Argument[0]", //
+        "sequelize-typescript;ScopesOptionsGetter;sequelize-typescript;;Member[Scopes].Argument[0]", //
+        "sequelize-typescript;ScopesOptionsGetter;sequelize-typescript;ScopeOptionsGetters;Member[getScopes]", //
+        "sequelize-typescript;Sequelize;sequelize-typescript/sequelize/sequelize/sequelize;Sequelize;", //
+        "sequelize-typescript;Sequelize;sequelize-typescript;BaseAssociation;Member[getSequelizeOptions].Argument[1]", //
+        "sequelize-typescript;Sequelize;sequelize-typescript;BelongsToManyAssociation;Member[getSequelizeOptions].Argument[1]", //
+        "sequelize-typescript;Sequelize;sequelize-typescript;SequelizeStatic;Instance", //
+        "sequelize-typescript;SequelizeOptions;sequelize-typescript/sequelize/sequelize/sequelize-options;SequelizeOptions;", //
+        "sequelize-typescript;SequelizeOptions;sequelize-typescript/sequelize/sequelize/sequelize-service;;Member[prepareArgs].ReturnValue.Member[options]", //
+        "sequelize-typescript;SequelizeOptions;sequelize-typescript/sequelize/sequelize/sequelize-service;;Member[prepareOptions].Argument[0]", //
+        "sequelize-typescript;SequelizeOptions;sequelize-typescript/sequelize/sequelize/sequelize-service;;Member[prepareOptions].ReturnValue", //
+        "sequelize-typescript;SequelizeOptions;sequelize-typescript;;Member[prepareArgs].ReturnValue.Member[options]", //
+        "sequelize-typescript;SequelizeOptions;sequelize-typescript;;Member[prepareOptions].Argument[0]", //
+        "sequelize-typescript;SequelizeOptions;sequelize-typescript;;Member[prepareOptions].ReturnValue", //
+        "sequelize-typescript;SequelizeOptions;sequelize-typescript;Sequelize;Member[options]", //
+        "sequelize-typescript;SequelizeOptions;sequelize-typescript;SequelizeStatic;Argument[3]", //
+        "sequelize-typescript;SequelizeOptions;sequelize-typescript;SequelizeStatic;WithArity[0].Argument[0]", //
+        "sequelize-typescript;SequelizeOptions;sequelize-typescript;SequelizeStatic;WithArity[1].Argument[0,1]", //
+        "sequelize-typescript;SequelizeOptions;sequelize-typescript;SequelizeStatic;WithArity[2].Argument[1,2]", //
+        "sequelize-typescript;SequelizeOptions;sequelize-typescript;SequelizeStatic;WithArity[3].Argument[2]", //
+        "sequelize-typescript;SequelizeStatic;sequelize-typescript/sequelize/sequelize/sequelize;;Member[Sequelize]", //
+        "sequelize-typescript;SequelizeStatic;sequelize-typescript/sequelize/sequelize/sequelize;SequelizeStatic;", //
+        "sequelize-typescript;SequelizeStatic;sequelize-typescript;;Member[Sequelize]", //
+        "sequelize;AnyFindOptions;sequelize;BelongsToManyAddAssociationMixin;Argument[1]", //
+        "sequelize;AnyFindOptions;sequelize;BelongsToManyAddAssociationsMixin;Argument[1]", //
+        "sequelize;AnyFindOptions;sequelize;BelongsToManySetAssociationsMixin;Argument[1]", //
+        "sequelize;AnyFindOptions;sequelize;DefineOptions;Member[defaultScope]", //
+        "sequelize;AnyFindOptions;sequelize;DefineScopeOptions;AnyMember", //
+        "sequelize;AnyFindOptions;sequelize;HasManySetAssociationsMixin;Argument[1]", //
+        "sequelize;AnyFindOptions;sequelize;Instance;Member[reload].Argument[0]", //
+        "sequelize;AnyFindOptions;sequelize;Model;Member[addScope].Argument[1]", //
+        "sequelize;AssociationOptionsBelongsToMany;sequelize;Associations;Member[belongsToMany].Argument[1]", //
+        "sequelize;Associations;sequelize;Model;", //
+        "sequelize;Associations;sequelize;SequelizeStaticAndInstance.Model;", //
+        "sequelize;BuildOptions;sequelize-typescript;ModelStatic~;Argument[1]", //
+        "sequelize;BuildOptions;sequelize;CreateOptions;", //
+        "sequelize;BuildOptions;sequelize;Model;Member[build,bulkBuild].Argument[1]", //
+        "sequelize;CountOptions;sequelize;Model;Member[count].Argument[0]", //
+        "sequelize;CreateOptions;sequelize-typescript/model/model/association/association-create-options;AssociationCreateOptions;", //
+        "sequelize;CreateOptions;sequelize;BelongsToCreateAssociationMixin;Argument[1]", //
+        "sequelize;CreateOptions;sequelize;BelongsToManyCreateAssociationMixin;Argument[1]", //
+        "sequelize;CreateOptions;sequelize;HasManyCreateAssociationMixin;Argument[1]", //
+        "sequelize;CreateOptions;sequelize;HasOneCreateAssociationMixin;Argument[1]", //
+        "sequelize;CreateOptions;sequelize;Model;Member[create].Argument[1]", //
+        "sequelize;DefineAttributeColumnOptions;sequelize;DefineAttributes;AnyMember", //
+        "sequelize;DefineAttributeColumnOptions;sequelize;QueryInterface;Member[addColumn,changeColumn].Argument[2]", //
+        "sequelize;DefineAttributeColumnReferencesOptions;sequelize;DefineAttributeColumnOptions;Member[references]", //
+        "sequelize;DefineAttributes;sequelize;Hooks;Member[beforeDefine].Argument[1].Argument[0]", //
+        "sequelize;DefineAttributes;sequelize;Hooks;Member[beforeDefine].WithArity[1].Argument[0].Argument[0]", //
+        "sequelize;DefineAttributes;sequelize;QueryInterface;Member[createTable].Argument[1]", //
+        "sequelize;DefineOptions;sequelize;Options;Member[define]", //
+        "sequelize;DefineOptions;sequelize;Sequelize;Member[define].Argument[2]", //
+        "sequelize;DefineScopeOptions;sequelize;DefineOptions;Member[scopes]", //
+        "sequelize;FindCreateFindOptions;sequelize;Model;Member[findCreateFind].Argument[0]", //
+        "sequelize;FindOptions;sequelize-typescript;AssociationCountOptions;", //
+        "sequelize;FindOptions;sequelize-typescript;AssociationGetOptions;", //
+        "sequelize;FindOptions;sequelize-typescript;DefaultScopeGetter;ReturnValue", //
+        "sequelize;FindOptions;sequelize-typescript;Model;Member[reload].Argument[0]", //
+        "sequelize;FindOptions;sequelize-typescript;ScopesOptions;", //
+        "sequelize;FindOptions;sequelize-typescript;ScopesOptions;ReturnValue", //
+        "sequelize;FindOptions;sequelize;AnyFindOptions;", //
+        "sequelize;FindOptions;sequelize;FindCreateFindOptions;", //
+        "sequelize;FindOptions;sequelize;FindOrInitializeOptions;", //
+        "sequelize;FindOptions;sequelize;Model;Member[all,find,findAll,findAndCount,findAndCountAll,findOne].Argument[0]", //
+        "sequelize;FindOptionsOrderArray;sequelize;FindOptions;Member[order]", //
+        "sequelize;FindOptionsOrderArray;sequelize;FindOptions;Member[order].ArrayElement", //
+        "sequelize;FindOrInitializeOptions;sequelize;Model;Member[findOrBuild,findOrCreate,findOrInitialize].Argument[0]", //
+        "sequelize;HasManyGetAssociationsMixinOptions;sequelize;HasManyGetAssociationsMixin;Argument[0]", //
+        "sequelize;HasManyGetAssociationsMixinOptions;sequelize;HasManyHasAssociationMixin;Argument[1]", //
+        "sequelize;HasManyGetAssociationsMixinOptions;sequelize;HasManyHasAssociationsMixin;Argument[1]", //
+        "sequelize;Hooks;sequelize;Hooks;Member[addHook,hook,removeHook].ReturnValue", //
+        "sequelize;Hooks;sequelize;Model;", //
+        "sequelize;Hooks;sequelize;Sequelize;", //
+        "sequelize;Hooks;sequelize;SequelizeStaticAndInstance.Model;", //
+        "sequelize;IncludeAssociation;sequelize;Associations;Member[belongsTo,belongsToMany,hasMany,hasOne].ReturnValue", //
+        "sequelize;IncludeAssociation;sequelize;IncludeOptions;Member[association]", //
+        "sequelize;IncludeOptions;sequelize;BuildOptions;Member[include].ArrayElement", //
+        "sequelize;IncludeOptions;sequelize;CountOptions;Member[include]", //
+        "sequelize;IncludeOptions;sequelize;CountOptions;Member[include].ArrayElement", //
+        "sequelize;IncludeOptions;sequelize;FindOptions;Member[include]", //
+        "sequelize;IncludeOptions;sequelize;FindOptions;Member[include].ArrayElement", //
+        "sequelize;IncludeOptions;sequelize;HasManyGetAssociationsMixinOptions;Member[include]", //
+        "sequelize;IncludeOptions;sequelize;IncludeOptions;Member[include]", //
+        "sequelize;IncludeOptions;sequelize;IncludeOptions;Member[include].ArrayElement", //
+        "sequelize;Instance;sequelize;Instance;Member[decrement,increment,reload,save,update,updateAttributes].ReturnValue.Awaited", //
+        "sequelize;Instance;sequelize;Instance;Member[equalsOneOf].Argument[0].ArrayElement", //
+        "sequelize;Instance;sequelize;Instance;Member[equals].Argument[0]", //
+        "sequelize;Instance;sequelize;Instance;Member[set,setAttributes].ReturnValue", //
+        "sequelize;Instance;sequelize;Model;Member[Instance,build].ReturnValue", //
+        "sequelize;Instance;sequelize;Model;Member[all,bulkCreate,findAll].ReturnValue.Awaited.ArrayElement", //
+        "sequelize;Instance;sequelize;Model;Member[bulkBuild].ReturnValue.ArrayElement", //
+        "sequelize;Instance;sequelize;Model;Member[create,find,findById,findByPk,findByPrimary,findOne].ReturnValue.Awaited", //
+        "sequelize;Instance;sequelize;Model;Member[findAndCount,findAndCountAll].ReturnValue.Awaited.Member[rows].ArrayElement", //
+        "sequelize;Instance;sequelize;QueryInterface;Member[delete,increment,insert,update].Argument[0]", //
+        "sequelize;Instance;sequelize;QueryOptions;Member[instance]", //
+        "sequelize;Instance;sequelize;SequelizeStaticAndInstance;Member[Instance]", //
+        "sequelize;Model;sequelize;AssociationOptionsBelongsToMany;Member[through]", //
+        "sequelize;Model;sequelize;Associations;Member[belongsTo,belongsToMany,hasMany,hasOne].Argument[0]", //
+        "sequelize;Model;sequelize;BuildOptions;Member[include].ArrayElement", //
+        "sequelize;Model;sequelize;CountOptions;Member[include]", //
+        "sequelize;Model;sequelize;CountOptions;Member[include].ArrayElement", //
+        "sequelize;Model;sequelize;DefineAttributeColumnReferencesOptions;Member[model]", //
+        "sequelize;Model;sequelize;FindOptions;Member[include]", //
+        "sequelize;Model;sequelize;FindOptions;Member[include].ArrayElement", //
+        "sequelize;Model;sequelize;FindOptions;Member[lock].Member[of]", //
+        "sequelize;Model;sequelize;FindOptionsOrderArray;ArrayElement", //
+        "sequelize;Model;sequelize;FindOptionsOrderArray;ArrayElement.Member[model]", //
+        "sequelize;Model;sequelize;Hooks;Member[afterDefine].Argument[1].Argument[0]", //
+        "sequelize;Model;sequelize;Hooks;Member[afterDefine].WithArity[1].Argument[0].Argument[0]", //
+        "sequelize;Model;sequelize;IncludeAssociation;Member[source,target]", //
+        "sequelize;Model;sequelize;IncludeOptions;Member[include,model]", //
+        "sequelize;Model;sequelize;IncludeOptions;Member[include].ArrayElement", //
+        "sequelize;Model;sequelize;Instance;Member[Model]", //
+        "sequelize;Model;sequelize;Model;Member[schema,scope,unscoped].ReturnValue", //
+        "sequelize;Model;sequelize;Model;Member[sync].ReturnValue.Awaited", //
+        "sequelize;Model;sequelize;Models;AnyMember", //
+        "sequelize;Model;sequelize;ModelsHashInterface;AnyMember", //
+        "sequelize;Model;sequelize;QueryInterface;Member[bulkDelete,rawSelect,upsert].Argument[3]", //
+        "sequelize;Model;sequelize;QueryInterface;Member[select].Argument[0]", //
+        "sequelize;Model;sequelize;QueryOptions;Member[model]", //
+        "sequelize;Model;sequelize;Sequelize;Member[define,import,model].ReturnValue", //
+        "sequelize;Model;sequelize;Sequelize;Member[import].Argument[1].ReturnValue", //
+        "sequelize;Model;sequelize;SequelizeStaticAndInstance;Member[Model]", //
+        "sequelize;Model;sequelize;ThroughOptions;Member[model]", //
+        "sequelize;Model;sequelize;Utils;Member[mapOptionFieldNames].Argument[1]", //
+        "sequelize;Model;sequelize;Utils;Member[mapValueFieldNames].Argument[2]", //
+        "sequelize;Models;sequelize;Model;Member[associate].Argument[0]", //
+        "sequelize;ModelsHashInterface;sequelize;Sequelize;Member[models]", //
+        "sequelize;Options;sequelize-typescript;SequelizeOptions;", //
+        "sequelize;Options;sequelize;Sequelize;Member[options]", //
+        "sequelize;Options;sequelize;SequelizeStatic;Argument[3]", //
+        "sequelize;Options;sequelize;SequelizeStatic;WithArity[1].Argument[0,1]", //
+        "sequelize;Options;sequelize;SequelizeStatic;WithArity[2].Argument[1,2]", //
+        "sequelize;Options;sequelize;SequelizeStatic;WithArity[3].Argument[2]", //
+        "sequelize;QueryInterface;sequelize;Sequelize;Member[getQueryInterface].ReturnValue", //
+        "sequelize;QueryOptions;sequelize;Options;Member[query]", //
+        "sequelize;QueryOptions;sequelize;QueryInterface;Member[bulkDelete,bulkInsert,createTable,select,setAutocommit,setIsolationLevel].Argument[2]", //
+        "sequelize;QueryOptions;sequelize;QueryInterface;Member[bulkUpdate,delete,insert].Argument[3]", //
+        "sequelize;QueryOptions;sequelize;QueryInterface;Member[commitTransaction,deferConstraints,dropTable,rawSelect,rollbackTransaction,showIndex,startTransaction].Argument[1]", //
+        "sequelize;QueryOptions;sequelize;QueryInterface;Member[createFunction].Argument[5]", //
+        "sequelize;QueryOptions;sequelize;QueryInterface;Member[dropAllEnums,dropAllTables,showAllSchemas,showAllTables].Argument[0]", //
+        "sequelize;QueryOptions;sequelize;QueryInterface;Member[increment,update,upsert].Argument[4]", //
+        "sequelize;QueryOptions;sequelize;Sequelize;Member[authenticate,validate].Argument[0]", //
+        "sequelize;QueryOptions;sequelize;Sequelize;Member[query].Argument[1]", //
+        "sequelize;Sequelize;sequelize-typescript;Sequelize;", //
+        "sequelize;Sequelize;sequelize;Hooks;Member[afterInit].Argument[1].Argument[0]", //
+        "sequelize;Sequelize;sequelize;Hooks;Member[afterInit].WithArity[1].Argument[0].Argument[0]", //
+        "sequelize;Sequelize;sequelize;Instance;Member[sequelize]", //
+        "sequelize;Sequelize;sequelize;QueryInterface;Member[sequelize]", //
+        "sequelize;Sequelize;sequelize;Sequelize;Member[import].Argument[1].Argument[0]", //
+        "sequelize;Sequelize;sequelize;SequelizeStatic;Instance", //
+        "sequelize;Sequelize;sequelize;SequelizeStatic;Member[useCLS].ReturnValue", //
+        "sequelize;SequelizeStatic;sequelize-typescript;Sequelize;", //
+        "sequelize;SequelizeStatic;sequelize;;", //
+        "sequelize;SequelizeStatic;sequelize;Sequelize;Member[Sequelize]", //
+        "sequelize;SequelizeStatic;sequelize;SequelizeStatic;Member[Sequelize,default]", //
+        "sequelize;SequelizeStaticAndInstance.Model;sequelize-typescript;Model;", //
+        "sequelize;SequelizeStaticAndInstance;sequelize;Sequelize;", //
+        "sequelize;SequelizeStaticAndInstance;sequelize;SequelizeStatic;", //
+        "sequelize;ThroughOptions;sequelize;AssociationOptionsBelongsToMany;Member[through]", //
+        "sequelize;Utils;sequelize;SequelizeStaticAndInstance;Member[Utils]", //
+      ]
+  }
+}
+
+private class Summaries extends ModelInput::SummaryModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "sequelize-typescript;Model;;;Member[reload].ReturnValue.Awaited;type", //
+        "sequelize;Instance;;;Member[decrement,increment,reload,save,update,updateAttributes].ReturnValue.Awaited;type", //
+        "sequelize;Instance;;;Member[set,setAttributes].ReturnValue;type", //
+        "sequelize;Model;;;Member[schema,scope,unscoped].ReturnValue;type", //
+        "sequelize;Model;;;Member[sync].ReturnValue.Awaited;type", //
+      ]
+  }
+}
+
+private class TypeVariables extends ModelInput::TypeVariableModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "sequelize-typescript.ModelStatic.0;Instance", //
+        "sequelize-typescript.Repository.0;Instance", //
+      ]
+  }
+}

javascript/ql/lib/semmle/javascript/frameworks/sequelize/model.json

@@ -0,0 +1,294 @@
+{
+    "packages": {
+        "@types/sequelize": "4.28.13",
+        "sequelize-typescript": "2.1.3"
+    },
+    "resolutions": {
+        "@types/bluebird": "3.5.36",
+        "@types/continuation-local-storage": "3.2.4",
+        "@types/lodash": "4.14.182",
+        "@types/node": "17.0.35",
+        "@types/validator": "13.7.2"
+    },
+    "language": "javascript",
+    "replaceTypeParameters": [
+        "sequelize;Model;TInstance;sequelize;Instance"
+    ],
+    "model": {
+        "sinks": [
+            "sequelize;;Argument[0..].Member[password];credentials[password]",
+            "sequelize;;Argument[0..].Member[username];credentials[username]",
+            "sequelize;;Argument[1];credentials[username]",
+            "sequelize;;Argument[2];credentials[password]",
+            "sequelize;Sequelize;Member[query].Argument[0].Member[query];sql-injection",
+            "sequelize;Sequelize;Member[query].Argument[0];sql-injection",
+            "sequelize;SequelizeStaticAndInstance;Member[asIs,literal].Argument[0];sql-injection"
+        ],
+        "typeDefinitions": [
+            "sequelize;Sequelize;sequelize-typescript;Sequelize;"
+        ]
+    },
+    "generatedModel": {
+        "//": "Autogenerated section. Manual edits in here will be lost.",
+        "typeDefinitions": [
+            "sequelize-typescript/associations/foreign-key/foreign-key-meta;ForeignKeyMeta;sequelize-typescript/associations/foreign-key/foreign-key-service;;Member[getForeignKeys].ReturnValue.ArrayElement",
+            "sequelize-typescript/model/model/association/association-create-options;AssociationCreateOptions;sequelize-typescript;Model;Member[$create].Argument[2]",
+            "sequelize-typescript/model/shared/model-not-initialized-error;ModelNotInitializedErrorStatic;sequelize-typescript/model/shared/model-not-initialized-error;;Member[ModelNotInitializedError]",
+            "sequelize-typescript;AssociationCountOptions;sequelize-typescript/model/model/association/association-count-options;AssociationCountOptions;",
+            "sequelize-typescript;AssociationCountOptions;sequelize-typescript;Model;Member[$count].Argument[1]",
+            "sequelize-typescript;AssociationGetOptions;sequelize-typescript/model/model/association/association-get-options;AssociationGetOptions;",
+            "sequelize-typescript;AssociationGetOptions;sequelize-typescript;Model;Member[$get].Argument[1]",
+            "sequelize-typescript;AssociationGetOptions;sequelize-typescript;Model;Member[$has].Argument[2]",
+            "sequelize-typescript;BaseAssociation;sequelize-typescript/associations/shared/association-service;;Member[addAssociation].Argument[1]",
+            "sequelize-typescript;BaseAssociation;sequelize-typescript/associations/shared/association-service;;Member[getAssociations,getAssociationsByRelation].ReturnValue.ArrayElement",
+            "sequelize-typescript;BaseAssociation;sequelize-typescript/associations/shared/association-service;;Member[setAssociations].Argument[1].ArrayElement",
+            "sequelize-typescript;BaseAssociation;sequelize-typescript/associations/shared/base-association;BaseAssociation;",
+            "sequelize-typescript;BaseAssociation;sequelize-typescript;;Member[addAssociation].Argument[1]",
+            "sequelize-typescript;BaseAssociation;sequelize-typescript;;Member[getAssociations,getAssociationsByRelation].ReturnValue.ArrayElement",
+            "sequelize-typescript;BaseAssociation;sequelize-typescript;;Member[setAssociations].Argument[1].ArrayElement",
+            "sequelize-typescript;BaseAssociation;sequelize-typescript;BaseAssociationStatic;Instance",
+            "sequelize-typescript;BaseAssociation;sequelize-typescript;BelongsToAssociation;",
+            "sequelize-typescript;BaseAssociation;sequelize-typescript;BelongsToManyAssociation;",
+            "sequelize-typescript;BaseAssociation;sequelize-typescript;HasAssociation;",
+            "sequelize-typescript;BaseAssociationStatic;sequelize-typescript/associations/shared/base-association;;Member[BaseAssociation]",
+            "sequelize-typescript;BaseAssociationStatic;sequelize-typescript/associations/shared/base-association;BaseAssociationStatic;",
+            "sequelize-typescript;BaseAssociationStatic;sequelize-typescript;;Member[BaseAssociation]",
+            "sequelize-typescript;BelongsToAssociation;sequelize-typescript/associations/belongs-to/belongs-to-association;BelongsToAssociation;",
+            "sequelize-typescript;BelongsToAssociation;sequelize-typescript;BelongsToAssociationStatic;Instance",
+            "sequelize-typescript;BelongsToAssociationStatic;sequelize-typescript/associations/belongs-to/belongs-to-association;;Member[BelongsToAssociation]",
+            "sequelize-typescript;BelongsToAssociationStatic;sequelize-typescript/associations/belongs-to/belongs-to-association;BelongsToAssociationStatic;",
+            "sequelize-typescript;BelongsToAssociationStatic;sequelize-typescript;;Member[BelongsToAssociation]",
+            "sequelize-typescript;BelongsToManyAssociation;sequelize-typescript/associations/belongs-to-many/belongs-to-many-association;BelongsToManyAssociation;",
+            "sequelize-typescript;BelongsToManyAssociation;sequelize-typescript;BelongsToManyAssociationStatic;Instance",
+            "sequelize-typescript;BelongsToManyAssociationStatic;sequelize-typescript/associations/belongs-to-many/belongs-to-many-association;;Member[BelongsToManyAssociation]",
+            "sequelize-typescript;BelongsToManyAssociationStatic;sequelize-typescript/associations/belongs-to-many/belongs-to-many-association;BelongsToManyAssociationStatic;",
+            "sequelize-typescript;BelongsToManyAssociationStatic;sequelize-typescript;;Member[BelongsToManyAssociation]",
+            "sequelize-typescript;DefaultScopeGetter;sequelize-typescript/scopes/default-scope;;Member[DefaultScope].Argument[0]",
+            "sequelize-typescript;DefaultScopeGetter;sequelize-typescript/scopes/scope-options;DefaultScopeGetter;",
+            "sequelize-typescript;DefaultScopeGetter;sequelize-typescript;;Member[DefaultScope].Argument[0]",
+            "sequelize-typescript;DefaultScopeGetter;sequelize-typescript;ScopeOptionsGetters;Member[getDefaultScope]",
+            "sequelize-typescript;HasAssociation;sequelize-typescript/associations/has/has-association;HasAssociation;",
+            "sequelize-typescript;HasAssociation;sequelize-typescript;HasAssociationStatic;Instance",
+            "sequelize-typescript;HasAssociationStatic;sequelize-typescript/associations/has/has-association;;Member[HasAssociation]",
+            "sequelize-typescript;HasAssociationStatic;sequelize-typescript/associations/has/has-association;HasAssociationStatic;",
+            "sequelize-typescript;HasAssociationStatic;sequelize-typescript;;Member[HasAssociation]",
+            "sequelize-typescript;Model;sequelize-typescript/model/model/model;Model;",
+            "sequelize-typescript;Model;sequelize-typescript;Model;Member[$add,$has,$remove,$set].Argument[1]",
+            "sequelize-typescript;Model;sequelize-typescript;Model;Member[$add,$has,$remove,$set].Argument[1].ArrayElement",
+            "sequelize-typescript;Model;sequelize-typescript;Model;Member[$create,reload].ReturnValue.Awaited",
+            "sequelize-typescript;Model;sequelize-typescript;ModelStatic~;Instance",
+            "sequelize-typescript;Model;sequelize-typescript;ModelStatic~;Member[initialize].ReturnValue.TypeVar[sequelize-typescript.ModelStatic.0]",
+            "sequelize-typescript;Model;sequelize-typescript;ModelType;Instance",
+            "sequelize-typescript;Model;sequelize-typescript;Sequelize;Member[getRepository].Argument[0].Instance",
+            "sequelize-typescript;Model;sequelize-typescript;Sequelize;Member[getRepository].ReturnValue.TypeVar[sequelize-typescript.Repository.0]",
+            "sequelize-typescript;ModelClassGetter;sequelize-typescript/associations/belongs-to-many/belongs-to-many;;Member[BelongsToMany].Argument[0,1]",
+            "sequelize-typescript;ModelClassGetter;sequelize-typescript/associations/belongs-to/belongs-to;;Member[BelongsTo].Argument[0]",
+            "sequelize-typescript;ModelClassGetter;sequelize-typescript/associations/foreign-key/foreign-key-meta;ForeignKeyMeta;Member[relatedClassGetter]",
+            "sequelize-typescript;ModelClassGetter;sequelize-typescript/associations/foreign-key/foreign-key-service;;Member[addForeignKey].Argument[1]",
+            "sequelize-typescript;ModelClassGetter;sequelize-typescript/associations/foreign-key/foreign-key;;Member[ForeignKey].Argument[0]",
+            "sequelize-typescript;ModelClassGetter;sequelize-typescript/associations/has/has-many;;Member[HasMany].Argument[0]",
+            "sequelize-typescript;ModelClassGetter;sequelize-typescript/associations/has/has-one;;Member[HasOne].Argument[0]",
+            "sequelize-typescript;ModelClassGetter;sequelize-typescript/model/shared/model-class-getter;ModelClassGetter;",
+            "sequelize-typescript;ModelClassGetter;sequelize-typescript;;Member[BelongsTo,ForeignKey,HasMany,HasOne].Argument[0]",
+            "sequelize-typescript;ModelClassGetter;sequelize-typescript;;Member[BelongsToMany].Argument[0,1]",
+            "sequelize-typescript;ModelClassGetter;sequelize-typescript;BaseAssociationStatic;Argument[0]",
+            "sequelize-typescript;ModelClassGetter;sequelize-typescript;BelongsToAssociationStatic;Argument[0]",
+            "sequelize-typescript;ModelClassGetter;sequelize-typescript;BelongsToManyAssociationStatic;Argument[0]",
+            "sequelize-typescript;ModelClassGetter;sequelize-typescript;HasAssociationStatic;Argument[0]",
+            "sequelize-typescript;ModelStatic~;sequelize-typescript/model/model/model;;Member[Model]",
+            "sequelize-typescript;ModelStatic~;sequelize-typescript/model/model/model;ModelStatic~;",
+            "sequelize-typescript;ModelStatic~;sequelize-typescript/model/shared/model-not-initialized-error;ModelNotInitializedErrorStatic;Argument[0]",
+            "sequelize-typescript;ModelStatic~;sequelize-typescript;;Member[Model]",
+            "sequelize-typescript;ModelType;sequelize-typescript/associations/foreign-key/foreign-key-service;;Member[getForeignKeyOptions].Argument[0,1]",
+            "sequelize-typescript;ModelType;sequelize-typescript/model/model/model;ModelType;",
+            "sequelize-typescript;ModelType;sequelize-typescript;BaseAssociation;Member[getAssociatedClass].ReturnValue",
+            "sequelize-typescript;ModelType;sequelize-typescript;BaseAssociation;Member[getSequelizeOptions].Argument[0]",
+            "sequelize-typescript;ModelType;sequelize-typescript;BelongsToAssociation;Member[getSequelizeOptions].Argument[0]",
+            "sequelize-typescript;ModelType;sequelize-typescript;BelongsToManyAssociation;Member[getSequelizeOptions].Argument[0]",
+            "sequelize-typescript;ModelType;sequelize-typescript;HasAssociation;Member[getSequelizeOptions].Argument[0]",
+            "sequelize-typescript;ModelType;sequelize-typescript;ModelClassGetter;ReturnValue",
+            "sequelize-typescript;ModelType;sequelize-typescript;Sequelize;Member[model].Argument[0]",
+            "sequelize-typescript;ScopeOptionsGetters;sequelize-typescript/scopes/scope-options;ScopeOptionsGetters;",
+            "sequelize-typescript;ScopeOptionsGetters;sequelize-typescript/scopes/scope-service;;Member[addScopeOptionsGetter,setScopeOptionsGetters].Argument[1]",
+            "sequelize-typescript;ScopeOptionsGetters;sequelize-typescript/scopes/scope-service;;Member[getScopeOptionsGetters].ReturnValue",
+            "sequelize-typescript;ScopeOptionsGetters;sequelize-typescript;;Member[addScopeOptionsGetter,setScopeOptionsGetters].Argument[1]",
+            "sequelize-typescript;ScopeOptionsGetters;sequelize-typescript;;Member[getScopeOptionsGetters].ReturnValue",
+            "sequelize-typescript;ScopesOptions;sequelize-typescript/scopes/scope-options;ScopesOptions;",
+            "sequelize-typescript;ScopesOptions;sequelize-typescript/scopes/scope-service;;Member[resolveScope].Argument[2]",
+            "sequelize-typescript;ScopesOptions;sequelize-typescript;;Member[resolveScope].Argument[2]",
+            "sequelize-typescript;ScopesOptions;sequelize-typescript;ScopesOptionsGetter;ReturnValue.AnyMember",
+            "sequelize-typescript;ScopesOptionsGetter;sequelize-typescript/scopes/scope-options;ScopesOptionsGetter;",
+            "sequelize-typescript;ScopesOptionsGetter;sequelize-typescript/scopes/scopes;;Member[Scopes].Argument[0]",
+            "sequelize-typescript;ScopesOptionsGetter;sequelize-typescript;;Member[Scopes].Argument[0]",
+            "sequelize-typescript;ScopesOptionsGetter;sequelize-typescript;ScopeOptionsGetters;Member[getScopes]",
+            "sequelize-typescript;Sequelize;sequelize-typescript/sequelize/sequelize/sequelize;Sequelize;",
+            "sequelize-typescript;Sequelize;sequelize-typescript;BaseAssociation;Member[getSequelizeOptions].Argument[1]",
+            "sequelize-typescript;Sequelize;sequelize-typescript;BelongsToManyAssociation;Member[getSequelizeOptions].Argument[1]",
+            "sequelize-typescript;Sequelize;sequelize-typescript;SequelizeStatic;Instance",
+            "sequelize-typescript;SequelizeOptions;sequelize-typescript/sequelize/sequelize/sequelize-options;SequelizeOptions;",
+            "sequelize-typescript;SequelizeOptions;sequelize-typescript/sequelize/sequelize/sequelize-service;;Member[prepareArgs].ReturnValue.Member[options]",
+            "sequelize-typescript;SequelizeOptions;sequelize-typescript/sequelize/sequelize/sequelize-service;;Member[prepareOptions].Argument[0]",
+            "sequelize-typescript;SequelizeOptions;sequelize-typescript/sequelize/sequelize/sequelize-service;;Member[prepareOptions].ReturnValue",
+            "sequelize-typescript;SequelizeOptions;sequelize-typescript;;Member[prepareArgs].ReturnValue.Member[options]",
+            "sequelize-typescript;SequelizeOptions;sequelize-typescript;;Member[prepareOptions].Argument[0]",
+            "sequelize-typescript;SequelizeOptions;sequelize-typescript;;Member[prepareOptions].ReturnValue",
+            "sequelize-typescript;SequelizeOptions;sequelize-typescript;Sequelize;Member[options]",
+            "sequelize-typescript;SequelizeOptions;sequelize-typescript;SequelizeStatic;Argument[3]",
+            "sequelize-typescript;SequelizeOptions;sequelize-typescript;SequelizeStatic;WithArity[0].Argument[0]",
+            "sequelize-typescript;SequelizeOptions;sequelize-typescript;SequelizeStatic;WithArity[1].Argument[0,1]",
+            "sequelize-typescript;SequelizeOptions;sequelize-typescript;SequelizeStatic;WithArity[2].Argument[1,2]",
+            "sequelize-typescript;SequelizeOptions;sequelize-typescript;SequelizeStatic;WithArity[3].Argument[2]",
+            "sequelize-typescript;SequelizeStatic;sequelize-typescript/sequelize/sequelize/sequelize;;Member[Sequelize]",
+            "sequelize-typescript;SequelizeStatic;sequelize-typescript/sequelize/sequelize/sequelize;SequelizeStatic;",
+            "sequelize-typescript;SequelizeStatic;sequelize-typescript;;Member[Sequelize]",
+            "sequelize;AnyFindOptions;sequelize;BelongsToManyAddAssociationMixin;Argument[1]",
+            "sequelize;AnyFindOptions;sequelize;BelongsToManyAddAssociationsMixin;Argument[1]",
+            "sequelize;AnyFindOptions;sequelize;BelongsToManySetAssociationsMixin;Argument[1]",
+            "sequelize;AnyFindOptions;sequelize;DefineOptions;Member[defaultScope]",
+            "sequelize;AnyFindOptions;sequelize;DefineScopeOptions;AnyMember",
+            "sequelize;AnyFindOptions;sequelize;HasManySetAssociationsMixin;Argument[1]",
+            "sequelize;AnyFindOptions;sequelize;Instance;Member[reload].Argument[0]",
+            "sequelize;AnyFindOptions;sequelize;Model;Member[addScope].Argument[1]",
+            "sequelize;AssociationOptionsBelongsToMany;sequelize;Associations;Member[belongsToMany].Argument[1]",
+            "sequelize;Associations;sequelize;Model;",
+            "sequelize;Associations;sequelize;SequelizeStaticAndInstance.Model;",
+            "sequelize;BuildOptions;sequelize-typescript;ModelStatic~;Argument[1]",
+            "sequelize;BuildOptions;sequelize;CreateOptions;",
+            "sequelize;BuildOptions;sequelize;Model;Member[build,bulkBuild].Argument[1]",
+            "sequelize;CountOptions;sequelize;Model;Member[count].Argument[0]",
+            "sequelize;CreateOptions;sequelize-typescript/model/model/association/association-create-options;AssociationCreateOptions;",
+            "sequelize;CreateOptions;sequelize;BelongsToCreateAssociationMixin;Argument[1]",
+            "sequelize;CreateOptions;sequelize;BelongsToManyCreateAssociationMixin;Argument[1]",
+            "sequelize;CreateOptions;sequelize;HasManyCreateAssociationMixin;Argument[1]",
+            "sequelize;CreateOptions;sequelize;HasOneCreateAssociationMixin;Argument[1]",
+            "sequelize;CreateOptions;sequelize;Model;Member[create].Argument[1]",
+            "sequelize;DefineAttributeColumnOptions;sequelize;DefineAttributes;AnyMember",
+            "sequelize;DefineAttributeColumnOptions;sequelize;QueryInterface;Member[addColumn,changeColumn].Argument[2]",
+            "sequelize;DefineAttributeColumnReferencesOptions;sequelize;DefineAttributeColumnOptions;Member[references]",
+            "sequelize;DefineAttributes;sequelize;Hooks;Member[beforeDefine].Argument[1].Argument[0]",
+            "sequelize;DefineAttributes;sequelize;Hooks;Member[beforeDefine].WithArity[1].Argument[0].Argument[0]",
+            "sequelize;DefineAttributes;sequelize;QueryInterface;Member[createTable].Argument[1]",
+            "sequelize;DefineOptions;sequelize;Options;Member[define]",
+            "sequelize;DefineOptions;sequelize;Sequelize;Member[define].Argument[2]",
+            "sequelize;DefineScopeOptions;sequelize;DefineOptions;Member[scopes]",
+            "sequelize;FindCreateFindOptions;sequelize;Model;Member[findCreateFind].Argument[0]",
+            "sequelize;FindOptions;sequelize-typescript;AssociationCountOptions;",
+            "sequelize;FindOptions;sequelize-typescript;AssociationGetOptions;",
+            "sequelize;FindOptions;sequelize-typescript;DefaultScopeGetter;ReturnValue",
+            "sequelize;FindOptions;sequelize-typescript;Model;Member[reload].Argument[0]",
+            "sequelize;FindOptions;sequelize-typescript;ScopesOptions;",
+            "sequelize;FindOptions;sequelize-typescript;ScopesOptions;ReturnValue",
+            "sequelize;FindOptions;sequelize;AnyFindOptions;",
+            "sequelize;FindOptions;sequelize;FindCreateFindOptions;",
+            "sequelize;FindOptions;sequelize;FindOrInitializeOptions;",
+            "sequelize;FindOptions;sequelize;Model;Member[all,find,findAll,findAndCount,findAndCountAll,findOne].Argument[0]",
+            "sequelize;FindOptionsOrderArray;sequelize;FindOptions;Member[order]",
+            "sequelize;FindOptionsOrderArray;sequelize;FindOptions;Member[order].ArrayElement",
+            "sequelize;FindOrInitializeOptions;sequelize;Model;Member[findOrBuild,findOrCreate,findOrInitialize].Argument[0]",
+            "sequelize;HasManyGetAssociationsMixinOptions;sequelize;HasManyGetAssociationsMixin;Argument[0]",
+            "sequelize;HasManyGetAssociationsMixinOptions;sequelize;HasManyHasAssociationMixin;Argument[1]",
+            "sequelize;HasManyGetAssociationsMixinOptions;sequelize;HasManyHasAssociationsMixin;Argument[1]",
+            "sequelize;Hooks;sequelize;Hooks;Member[addHook,hook,removeHook].ReturnValue",
+            "sequelize;Hooks;sequelize;Model;",
+            "sequelize;Hooks;sequelize;Sequelize;",
+            "sequelize;Hooks;sequelize;SequelizeStaticAndInstance.Model;",
+            "sequelize;IncludeAssociation;sequelize;Associations;Member[belongsTo,belongsToMany,hasMany,hasOne].ReturnValue",
+            "sequelize;IncludeAssociation;sequelize;IncludeOptions;Member[association]",
+            "sequelize;IncludeOptions;sequelize;BuildOptions;Member[include].ArrayElement",
+            "sequelize;IncludeOptions;sequelize;CountOptions;Member[include]",
+            "sequelize;IncludeOptions;sequelize;CountOptions;Member[include].ArrayElement",
+            "sequelize;IncludeOptions;sequelize;FindOptions;Member[include]",
+            "sequelize;IncludeOptions;sequelize;FindOptions;Member[include].ArrayElement",
+            "sequelize;IncludeOptions;sequelize;HasManyGetAssociationsMixinOptions;Member[include]",
+            "sequelize;IncludeOptions;sequelize;IncludeOptions;Member[include]",
+            "sequelize;IncludeOptions;sequelize;IncludeOptions;Member[include].ArrayElement",
+            "sequelize;Instance;sequelize;Instance;Member[decrement,increment,reload,save,update,updateAttributes].ReturnValue.Awaited",
+            "sequelize;Instance;sequelize;Instance;Member[equalsOneOf].Argument[0].ArrayElement",
+            "sequelize;Instance;sequelize;Instance;Member[equals].Argument[0]",
+            "sequelize;Instance;sequelize;Instance;Member[set,setAttributes].ReturnValue",
+            "sequelize;Instance;sequelize;Model;Member[Instance,build].ReturnValue",
+            "sequelize;Instance;sequelize;Model;Member[all,bulkCreate,findAll].ReturnValue.Awaited.ArrayElement",
+            "sequelize;Instance;sequelize;Model;Member[bulkBuild].ReturnValue.ArrayElement",
+            "sequelize;Instance;sequelize;Model;Member[create,find,findById,findByPk,findByPrimary,findOne].ReturnValue.Awaited",
+            "sequelize;Instance;sequelize;Model;Member[findAndCount,findAndCountAll].ReturnValue.Awaited.Member[rows].ArrayElement",
+            "sequelize;Instance;sequelize;QueryInterface;Member[delete,increment,insert,update].Argument[0]",
+            "sequelize;Instance;sequelize;QueryOptions;Member[instance]",
+            "sequelize;Instance;sequelize;SequelizeStaticAndInstance;Member[Instance]",
+            "sequelize;Model;sequelize;AssociationOptionsBelongsToMany;Member[through]",
+            "sequelize;Model;sequelize;Associations;Member[belongsTo,belongsToMany,hasMany,hasOne].Argument[0]",
+            "sequelize;Model;sequelize;BuildOptions;Member[include].ArrayElement",
+            "sequelize;Model;sequelize;CountOptions;Member[include]",
+            "sequelize;Model;sequelize;CountOptions;Member[include].ArrayElement",
+            "sequelize;Model;sequelize;DefineAttributeColumnReferencesOptions;Member[model]",
+            "sequelize;Model;sequelize;FindOptions;Member[include]",
+            "sequelize;Model;sequelize;FindOptions;Member[include].ArrayElement",
+            "sequelize;Model;sequelize;FindOptions;Member[lock].Member[of]",
+            "sequelize;Model;sequelize;FindOptionsOrderArray;ArrayElement",
+            "sequelize;Model;sequelize;FindOptionsOrderArray;ArrayElement.Member[model]",
+            "sequelize;Model;sequelize;Hooks;Member[afterDefine].Argument[1].Argument[0]",
+            "sequelize;Model;sequelize;Hooks;Member[afterDefine].WithArity[1].Argument[0].Argument[0]",
+            "sequelize;Model;sequelize;IncludeAssociation;Member[source,target]",
+            "sequelize;Model;sequelize;IncludeOptions;Member[include,model]",
+            "sequelize;Model;sequelize;IncludeOptions;Member[include].ArrayElement",
+            "sequelize;Model;sequelize;Instance;Member[Model]",
+            "sequelize;Model;sequelize;Model;Member[schema,scope,unscoped].ReturnValue",
+            "sequelize;Model;sequelize;Model;Member[sync].ReturnValue.Awaited",
+            "sequelize;Model;sequelize;Models;AnyMember",
+            "sequelize;Model;sequelize;ModelsHashInterface;AnyMember",
+            "sequelize;Model;sequelize;QueryInterface;Member[bulkDelete,rawSelect,upsert].Argument[3]",
+            "sequelize;Model;sequelize;QueryInterface;Member[select].Argument[0]",
+            "sequelize;Model;sequelize;QueryOptions;Member[model]",
+            "sequelize;Model;sequelize;Sequelize;Member[define,import,model].ReturnValue",
+            "sequelize;Model;sequelize;Sequelize;Member[import].Argument[1].ReturnValue",
+            "sequelize;Model;sequelize;SequelizeStaticAndInstance;Member[Model]",
+            "sequelize;Model;sequelize;ThroughOptions;Member[model]",
+            "sequelize;Model;sequelize;Utils;Member[mapOptionFieldNames].Argument[1]",
+            "sequelize;Model;sequelize;Utils;Member[mapValueFieldNames].Argument[2]",
+            "sequelize;Models;sequelize;Model;Member[associate].Argument[0]",
+            "sequelize;ModelsHashInterface;sequelize;Sequelize;Member[models]",
+            "sequelize;Options;sequelize-typescript;SequelizeOptions;",
+            "sequelize;Options;sequelize;Sequelize;Member[options]",
+            "sequelize;Options;sequelize;SequelizeStatic;Argument[3]",
+            "sequelize;Options;sequelize;SequelizeStatic;WithArity[1].Argument[0,1]",
+            "sequelize;Options;sequelize;SequelizeStatic;WithArity[2].Argument[1,2]",
+            "sequelize;Options;sequelize;SequelizeStatic;WithArity[3].Argument[2]",
+            "sequelize;QueryInterface;sequelize;Sequelize;Member[getQueryInterface].ReturnValue",
+            "sequelize;QueryOptions;sequelize;Options;Member[query]",
+            "sequelize;QueryOptions;sequelize;QueryInterface;Member[bulkDelete,bulkInsert,createTable,select,setAutocommit,setIsolationLevel].Argument[2]",
+            "sequelize;QueryOptions;sequelize;QueryInterface;Member[bulkUpdate,delete,insert].Argument[3]",
+            "sequelize;QueryOptions;sequelize;QueryInterface;Member[commitTransaction,deferConstraints,dropTable,rawSelect,rollbackTransaction,showIndex,startTransaction].Argument[1]",
+            "sequelize;QueryOptions;sequelize;QueryInterface;Member[createFunction].Argument[5]",
+            "sequelize;QueryOptions;sequelize;QueryInterface;Member[dropAllEnums,dropAllTables,showAllSchemas,showAllTables].Argument[0]",
+            "sequelize;QueryOptions;sequelize;QueryInterface;Member[increment,update,upsert].Argument[4]",
+            "sequelize;QueryOptions;sequelize;Sequelize;Member[authenticate,validate].Argument[0]",
+            "sequelize;QueryOptions;sequelize;Sequelize;Member[query].Argument[1]",
+            "sequelize;Sequelize;sequelize;Hooks;Member[afterInit].Argument[1].Argument[0]",
+            "sequelize;Sequelize;sequelize;Hooks;Member[afterInit].WithArity[1].Argument[0].Argument[0]",
+            "sequelize;Sequelize;sequelize;Instance;Member[sequelize]",
+            "sequelize;Sequelize;sequelize;QueryInterface;Member[sequelize]",
+            "sequelize;Sequelize;sequelize;Sequelize;Member[import].Argument[1].Argument[0]",
+            "sequelize;Sequelize;sequelize;SequelizeStatic;Instance",
+            "sequelize;Sequelize;sequelize;SequelizeStatic;Member[useCLS].ReturnValue",
+            "sequelize;SequelizeStatic;sequelize-typescript;Sequelize;",
+            "sequelize;SequelizeStatic;sequelize;;",
+            "sequelize;SequelizeStatic;sequelize;Sequelize;Member[Sequelize]",
+            "sequelize;SequelizeStatic;sequelize;SequelizeStatic;Member[Sequelize,default]",
+            "sequelize;SequelizeStaticAndInstance.Model;sequelize-typescript;Model;",
+            "sequelize;SequelizeStaticAndInstance;sequelize;Sequelize;",
+            "sequelize;SequelizeStaticAndInstance;sequelize;SequelizeStatic;",
+            "sequelize;ThroughOptions;sequelize;AssociationOptionsBelongsToMany;Member[through]",
+            "sequelize;Utils;sequelize;SequelizeStaticAndInstance;Member[Utils]"
+        ],
+        "summaries": [
+            "sequelize-typescript;Model;;;Member[reload].ReturnValue.Awaited;type",
+            "sequelize;Instance;;;Member[decrement,increment,reload,save,update,updateAttributes].ReturnValue.Awaited;type",
+            "sequelize;Instance;;;Member[set,setAttributes].ReturnValue;type",
+            "sequelize;Model;;;Member[schema,scope,unscoped].ReturnValue;type",
+            "sequelize;Model;;;Member[sync].ReturnValue.Awaited;type"
+        ],
+        "typeVariables": [
+            "sequelize-typescript.ModelStatic.0;Instance",
+            "sequelize-typescript.Repository.0;Instance"
+        ]
+    }
+}

javascript/ql/lib/semmle/javascript/frameworks/spanner/Model.qll

@@ -0,0 +1,198 @@
+/** Generated model file */
+
+private import javascript
+
+private class Types extends ModelInput::TypeModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "@google-cloud/spanner/batch-transaction;BatchTransaction;@google-cloud/spanner/batch-transaction;BatchTransactionStatic;Instance", //
+        "@google-cloud/spanner/batch-transaction;BatchTransaction;@google-cloud/spanner/database;CreateBatchTransactionCallback;TypeVar[@google-cloud/spanner/common.ResourceCallback.0]", //
+        "@google-cloud/spanner/batch-transaction;BatchTransaction;@google-cloud/spanner;Database;Member[batchTransaction].ReturnValue", //
+        "@google-cloud/spanner/batch-transaction;BatchTransactionStatic;@google-cloud/spanner/batch-transaction;;Member[BatchTransaction]", //
+        "@google-cloud/spanner/batch-transaction;TransactionIdentifier;@google-cloud/spanner/batch-transaction;BatchTransaction;Member[identifier].ReturnValue", //
+        "@google-cloud/spanner/batch-transaction;TransactionIdentifier;@google-cloud/spanner;Database;Member[batchTransaction].Argument[0]", //
+        "@google-cloud/spanner/database;BatchCreateSessionsCallback;@google-cloud/spanner;Database;Member[batchCreateSessions].Argument[1]", //
+        "@google-cloud/spanner/database;CreateBatchTransactionCallback;@google-cloud/spanner;Database;Member[createBatchTransaction].Argument[1]", //
+        "@google-cloud/spanner/database;CreateBatchTransactionCallback;@google-cloud/spanner;Database;Member[createBatchTransaction].WithArity[1].Argument[0]", //
+        "@google-cloud/spanner/database;CreateSessionCallback;@google-cloud/spanner;Database;Member[createSession].Argument[1]", //
+        "@google-cloud/spanner/database;CreateSessionCallback;@google-cloud/spanner;Database;Member[createSession].WithArity[1].Argument[0]", //
+        "@google-cloud/spanner/database;DatabaseCallback;@google-cloud/spanner;Database;Member[get].Argument[1]", //
+        "@google-cloud/spanner/database;DatabaseCallback;@google-cloud/spanner;Database;Member[get].WithArity[1].Argument[0]", //
+        "@google-cloud/spanner/database;GetSessionsCallback;@google-cloud/spanner;Database;Member[getSessions].Argument[1]", //
+        "@google-cloud/spanner/database;GetSessionsCallback;@google-cloud/spanner;Database;Member[getSessions].WithArity[1].Argument[0]", //
+        "@google-cloud/spanner/database;GetSnapshotCallback;@google-cloud/spanner;Database;Member[getSnapshot].Argument[1]", //
+        "@google-cloud/spanner/database;GetSnapshotCallback;@google-cloud/spanner;Database;Member[getSnapshot].WithArity[1].Argument[0]", //
+        "@google-cloud/spanner/database;GetTransactionCallback;@google-cloud/spanner;Database;Member[getTransaction].Argument[0]", //
+        "@google-cloud/spanner/database;PoolRequestCallback;@google-cloud/spanner;Database;Member[makePooledRequest_].Argument[1]", //
+        "@google-cloud/spanner/database;RestoreDatabaseCallback;@google-cloud/spanner;Database;Member[restore].Argument[1,2]", //
+        "@google-cloud/spanner/database;SessionPoolConstructor;@google-cloud/spanner;DatabaseStatic;Argument[2]", //
+        "@google-cloud/spanner/database;SessionPoolConstructor;@google-cloud/spanner;Instance;Member[database].Argument[1]", //
+        "@google-cloud/spanner/instance;CreateDatabaseCallback;@google-cloud/spanner;Instance;Member[createDatabase].Argument[2]", //
+        "@google-cloud/spanner/instance;CreateDatabaseCallback;@google-cloud/spanner;Instance;Member[createDatabase].WithArity[2].Argument[1]", //
+        "@google-cloud/spanner/instance;CreateDatabaseOptions;@google-cloud/spanner;Instance;Member[createDatabase].WithArity[1,2,3].Argument[1]", //
+        "@google-cloud/spanner/instance;CreateInstanceCallback;@google-cloud/spanner;Spanner;Member[createInstance].Argument[2]", //
+        "@google-cloud/spanner/instance;GetDatabasesCallback;@google-cloud/spanner;Instance;Member[getDatabases].Argument[1]", //
+        "@google-cloud/spanner/instance;GetDatabasesCallback;@google-cloud/spanner;Instance;Member[getDatabases].WithArity[1].Argument[0]", //
+        "@google-cloud/spanner/instance;GetInstanceCallback;@google-cloud/spanner;Instance;Member[get].Argument[1]", //
+        "@google-cloud/spanner/instance;GetInstanceCallback;@google-cloud/spanner;Instance;Member[get].WithArity[1].Argument[0]", //
+        "@google-cloud/spanner/session-pool;GetReadSessionCallback;@google-cloud/spanner/session-pool;SessionPoolInterface;Member[getReadSession].Argument[0]", //
+        "@google-cloud/spanner/session-pool;GetReadSessionCallback;@google-cloud/spanner;SessionPool;Member[getReadSession].Argument[0]", //
+        "@google-cloud/spanner/session-pool;GetWriteSessionCallback;@google-cloud/spanner/session-pool;SessionPoolInterface;Member[getWriteSession].Argument[0]", //
+        "@google-cloud/spanner/session-pool;GetWriteSessionCallback;@google-cloud/spanner;SessionPool;Member[getWriteSession].Argument[0]", //
+        "@google-cloud/spanner/session-pool;SessionPoolInterface;@google-cloud/spanner/database;SessionPoolConstructor;Instance", //
+        "@google-cloud/spanner/session-pool;SessionPoolInterface;@google-cloud/spanner;Database;Member[pool_]", //
+        "@google-cloud/spanner/session-pool;SessionPoolInterface;@google-cloud/spanner;SessionPool;", //
+        "@google-cloud/spanner/table;CreateTableCallback;@google-cloud/spanner;Database;Member[createTable].Argument[2]", //
+        "@google-cloud/spanner/table;CreateTableCallback;@google-cloud/spanner;Database;Member[createTable].WithArity[2].Argument[1]", //
+        "@google-cloud/spanner/table;CreateTableCallback;@google-cloud/spanner;Table;Member[create].Argument[2]", //
+        "@google-cloud/spanner/table;CreateTableCallback;@google-cloud/spanner;Table;Member[create].WithArity[2].Argument[1]", //
+        "@google-cloud/spanner/transaction-runner;AsyncRunTransactionCallback;@google-cloud/spanner/transaction-runner;AsyncTransactionRunnerStatic;Argument[2]", //
+        "@google-cloud/spanner/transaction-runner;AsyncRunTransactionCallback;@google-cloud/spanner;Database;Member[runTransactionAsync].Argument[1]", //
+        "@google-cloud/spanner/transaction-runner;AsyncRunTransactionCallback;@google-cloud/spanner;Database;Member[runTransactionAsync].WithArity[1].Argument[0]", //
+        "@google-cloud/spanner/transaction-runner;AsyncTransactionRunner;@google-cloud/spanner/transaction-runner;AsyncTransactionRunnerStatic;Instance", //
+        "@google-cloud/spanner/transaction-runner;AsyncTransactionRunnerStatic;@google-cloud/spanner/transaction-runner;;Member[AsyncTransactionRunner]", //
+        "@google-cloud/spanner/transaction-runner;RunTransactionCallback;@google-cloud/spanner/transaction-runner;TransactionRunnerStatic;Argument[2]", //
+        "@google-cloud/spanner/transaction-runner;RunTransactionCallback;@google-cloud/spanner;Database;Member[runTransaction].Argument[1]", //
+        "@google-cloud/spanner/transaction-runner;RunTransactionCallback;@google-cloud/spanner;Database;Member[runTransaction].WithArity[1].Argument[0]", //
+        "@google-cloud/spanner/transaction-runner;Runner;@google-cloud/spanner/transaction-runner;AsyncTransactionRunner;", //
+        "@google-cloud/spanner/transaction-runner;Runner;@google-cloud/spanner/transaction-runner;RunnerStatic;Instance", //
+        "@google-cloud/spanner/transaction-runner;Runner;@google-cloud/spanner/transaction-runner;TransactionRunner;", //
+        "@google-cloud/spanner/transaction-runner;RunnerStatic;@google-cloud/spanner/transaction-runner;;Member[Runner]", //
+        "@google-cloud/spanner/transaction-runner;TransactionRunner;@google-cloud/spanner/transaction-runner;TransactionRunnerStatic;Instance", //
+        "@google-cloud/spanner/transaction-runner;TransactionRunnerStatic;@google-cloud/spanner/transaction-runner;;Member[TransactionRunner]", //
+        "@google-cloud/spanner/transaction;Dml;@google-cloud/spanner/transaction;DmlStatic;Instance", //
+        "@google-cloud/spanner/transaction;Dml;@google-cloud/spanner;PartitionedDml;", //
+        "@google-cloud/spanner/transaction;Dml;@google-cloud/spanner;Transaction;", //
+        "@google-cloud/spanner/transaction;DmlStatic;@google-cloud/spanner/transaction;;Member[Dml]", //
+        "@google-cloud/spanner;BackupStatic;@google-cloud/spanner/backup;;Member[Backup]", //
+        "@google-cloud/spanner;BackupStatic;@google-cloud/spanner/backup;BackupStatic;", //
+        "@google-cloud/spanner;BackupStatic;@google-cloud/spanner;;Member[Backup]", //
+        "@google-cloud/spanner;BatchTransaction;@google-cloud/spanner/batch-transaction;BatchTransaction;", //
+        "@google-cloud/spanner;Database;@google-cloud/spanner/database;Database;", //
+        "@google-cloud/spanner;Database;@google-cloud/spanner/database;DatabaseCallback;TypeVar[@google-cloud/spanner/common.ResourceCallback.0]", //
+        "@google-cloud/spanner;Database;@google-cloud/spanner/database;RestoreDatabaseCallback;TypeVar[@google-cloud/spanner/common.LongRunningCallback.0]", //
+        "@google-cloud/spanner;Database;@google-cloud/spanner/database;SessionPoolConstructor;Argument[0]", //
+        "@google-cloud/spanner;Database;@google-cloud/spanner/instance;CreateDatabaseCallback;TypeVar[@google-cloud/spanner/common.LongRunningCallback.0]", //
+        "@google-cloud/spanner;Database;@google-cloud/spanner/instance;GetDatabasesCallback;TypeVar[@google-cloud/spanner/common.RequestCallback.0]", //
+        "@google-cloud/spanner;Database;@google-cloud/spanner;DatabaseStatic;Instance", //
+        "@google-cloud/spanner;Database;@google-cloud/spanner;Instance;Member[database].ReturnValue", //
+        "@google-cloud/spanner;Database;@google-cloud/spanner;SessionPool;Member[database]", //
+        "@google-cloud/spanner;Database;@google-cloud/spanner;SessionPoolStatic;Argument[0]", //
+        "@google-cloud/spanner;Database;@google-cloud/spanner;SessionStatic;Argument[0]", //
+        "@google-cloud/spanner;Database;@google-cloud/spanner;Table;Member[database]", //
+        "@google-cloud/spanner;Database;@google-cloud/spanner;TableStatic;Argument[0]", //
+        "@google-cloud/spanner;DatabaseStatic;@google-cloud/spanner/database;;Member[Database]", //
+        "@google-cloud/spanner;DatabaseStatic;@google-cloud/spanner/database;DatabaseStatic;", //
+        "@google-cloud/spanner;DatabaseStatic;@google-cloud/spanner;;Member[Database]", //
+        "@google-cloud/spanner;GetInstancesCallback;@google-cloud/spanner/build/src;GetInstancesCallback;", //
+        "@google-cloud/spanner;GetInstancesCallback;@google-cloud/spanner;Spanner;Member[getInstances].Argument[1]", //
+        "@google-cloud/spanner;GetInstancesCallback;@google-cloud/spanner;Spanner;Member[getInstances].WithArity[1].Argument[0]", //
+        "@google-cloud/spanner;Instance;@google-cloud/spanner/instance;CreateInstanceCallback;TypeVar[@google-cloud/spanner/common.LongRunningCallback.0]", //
+        "@google-cloud/spanner;Instance;@google-cloud/spanner/instance;GetInstanceCallback;TypeVar[@google-cloud/spanner/common.ResourceCallback.0]", //
+        "@google-cloud/spanner;Instance;@google-cloud/spanner/instance;Instance;", //
+        "@google-cloud/spanner;Instance;@google-cloud/spanner;BackupStatic;Argument[0]", //
+        "@google-cloud/spanner;Instance;@google-cloud/spanner;DatabaseStatic;Argument[0]", //
+        "@google-cloud/spanner;Instance;@google-cloud/spanner;GetInstancesCallback;TypeVar[@google-cloud/spanner/common.PagedCallback.0]", //
+        "@google-cloud/spanner;Instance;@google-cloud/spanner;InstanceStatic;Instance", //
+        "@google-cloud/spanner;Instance;@google-cloud/spanner;Spanner;Member[instance].ReturnValue", //
+        "@google-cloud/spanner;InstanceStatic;@google-cloud/spanner/instance;;Member[Instance]", //
+        "@google-cloud/spanner;InstanceStatic;@google-cloud/spanner/instance;InstanceStatic;", //
+        "@google-cloud/spanner;InstanceStatic;@google-cloud/spanner;;Member[Instance]", //
+        "@google-cloud/spanner;PartitionedDml;@google-cloud/spanner/transaction;PartitionedDml;", //
+        "@google-cloud/spanner;PartitionedDml;@google-cloud/spanner;PartitionedDmlStatic;Instance", //
+        "@google-cloud/spanner;PartitionedDml;@google-cloud/spanner;Session;Member[partitionedDml].ReturnValue", //
+        "@google-cloud/spanner;PartitionedDmlStatic;@google-cloud/spanner/transaction;;Member[PartitionedDml]", //
+        "@google-cloud/spanner;PartitionedDmlStatic;@google-cloud/spanner/transaction;PartitionedDmlStatic;", //
+        "@google-cloud/spanner;PartitionedDmlStatic;@google-cloud/spanner;;Member[PartitionedDml]", //
+        "@google-cloud/spanner;Session;@google-cloud/spanner/batch-transaction;TransactionIdentifier;Member[session]", //
+        "@google-cloud/spanner;Session;@google-cloud/spanner/database;BatchCreateSessionsCallback;TypeVar[@google-cloud/spanner/common.ResourceCallback.0].ArrayElement", //
+        "@google-cloud/spanner;Session;@google-cloud/spanner/database;CreateSessionCallback;TypeVar[@google-cloud/spanner/common.ResourceCallback.0]", //
+        "@google-cloud/spanner;Session;@google-cloud/spanner/database;GetSessionsCallback;TypeVar[@google-cloud/spanner/common.RequestCallback.0]", //
+        "@google-cloud/spanner;Session;@google-cloud/spanner/database;PoolRequestCallback;TypeVar[@google-cloud/spanner/common.RequestCallback.0]", //
+        "@google-cloud/spanner;Session;@google-cloud/spanner/session-pool;GetReadSessionCallback;TypeVar[@google-cloud/spanner/common.NormalCallback.0]", //
+        "@google-cloud/spanner;Session;@google-cloud/spanner/session-pool;GetWriteSessionCallback;Argument[1]", //
+        "@google-cloud/spanner;Session;@google-cloud/spanner/session-pool;SessionPoolInterface;Member[release].Argument[0]", //
+        "@google-cloud/spanner;Session;@google-cloud/spanner/session;Session;", //
+        "@google-cloud/spanner;Session;@google-cloud/spanner/transaction-runner;Runner;Member[session]", //
+        "@google-cloud/spanner;Session;@google-cloud/spanner;Database;Member[_runPartitionedUpdate].Argument[0]", //
+        "@google-cloud/spanner;Session;@google-cloud/spanner;Database;Member[makePooledRequest_].WithArity[1].ReturnValue.Awaited", //
+        "@google-cloud/spanner;Session;@google-cloud/spanner;Database;Member[session].ReturnValue", //
+        "@google-cloud/spanner;Session;@google-cloud/spanner;SessionPool;Member[_acquire,_getSession].ReturnValue.Awaited", //
+        "@google-cloud/spanner;Session;@google-cloud/spanner;SessionPool;Member[_borrow,_destroy,_isValidSession,_ping,_prepareTransaction,_release,release].Argument[0]", //
+        "@google-cloud/spanner;Session;@google-cloud/spanner;SessionPool;Member[_borrowFrom,_borrowNextAvailableSession].ReturnValue", //
+        "@google-cloud/spanner;Session;@google-cloud/spanner;SessionPool;Member[_getIdleSessions].ReturnValue.ArrayElement", //
+        "@google-cloud/spanner;Session;@google-cloud/spanner;SessionStatic;Instance", //
+        "@google-cloud/spanner;Session;@google-cloud/spanner;Snapshot;Member[session]", //
+        "@google-cloud/spanner;SessionPool;@google-cloud/spanner/instance;CreateDatabaseOptions;Member[poolCtor]", //
+        "@google-cloud/spanner;SessionPool;@google-cloud/spanner/session-pool;SessionPool;", //
+        "@google-cloud/spanner;SessionPool;@google-cloud/spanner;SessionPoolStatic;Instance", //
+        "@google-cloud/spanner;SessionPoolStatic;@google-cloud/spanner/session-pool;;Member[SessionPool]", //
+        "@google-cloud/spanner;SessionPoolStatic;@google-cloud/spanner/session-pool;SessionPoolStatic;", //
+        "@google-cloud/spanner;SessionPoolStatic;@google-cloud/spanner;;Member[SessionPool]", //
+        "@google-cloud/spanner;SessionStatic;@google-cloud/spanner/session;;Member[Session]", //
+        "@google-cloud/spanner;SessionStatic;@google-cloud/spanner/session;SessionStatic;", //
+        "@google-cloud/spanner;SessionStatic;@google-cloud/spanner;;Member[Session]", //
+        "@google-cloud/spanner;Snapshot;@google-cloud/spanner/batch-transaction;BatchTransaction;", //
+        "@google-cloud/spanner;Snapshot;@google-cloud/spanner/database;GetSnapshotCallback;TypeVar[@google-cloud/spanner/common.NormalCallback.0]", //
+        "@google-cloud/spanner;Snapshot;@google-cloud/spanner/transaction;Dml;", //
+        "@google-cloud/spanner;Snapshot;@google-cloud/spanner/transaction;Snapshot;", //
+        "@google-cloud/spanner;Snapshot;@google-cloud/spanner;Session;Member[snapshot].ReturnValue", //
+        "@google-cloud/spanner;Snapshot;@google-cloud/spanner;SnapshotStatic;Instance", //
+        "@google-cloud/spanner;SnapshotStatic;@google-cloud/spanner/transaction;;Member[Snapshot]", //
+        "@google-cloud/spanner;SnapshotStatic;@google-cloud/spanner/transaction;SnapshotStatic;", //
+        "@google-cloud/spanner;SnapshotStatic;@google-cloud/spanner;;Member[Snapshot]", //
+        "@google-cloud/spanner;Spanner;@google-cloud/spanner;InstanceStatic;Argument[0]", //
+        "@google-cloud/spanner;Spanner;@google-cloud/spanner;SpannerStatic;Instance", //
+        "@google-cloud/spanner;SpannerStatic;@google-cloud/spanner;;Member[Spanner]", //
+        "@google-cloud/spanner;Table;@google-cloud/spanner/table;CreateTableCallback;TypeVar[@google-cloud/spanner/common.LongRunningCallback.0]", //
+        "@google-cloud/spanner;Table;@google-cloud/spanner/table;Table;", //
+        "@google-cloud/spanner;Table;@google-cloud/spanner;Database;Member[table].ReturnValue", //
+        "@google-cloud/spanner;Table;@google-cloud/spanner;TableStatic;Instance", //
+        "@google-cloud/spanner;TableStatic;@google-cloud/spanner/table;;Member[Table]", //
+        "@google-cloud/spanner;TableStatic;@google-cloud/spanner/table;TableStatic;", //
+        "@google-cloud/spanner;TableStatic;@google-cloud/spanner;;Member[Table]", //
+        "@google-cloud/spanner;Transaction;@google-cloud/spanner/database;GetTransactionCallback;TypeVar[@google-cloud/spanner/common.NormalCallback.0]", //
+        "@google-cloud/spanner;Transaction;@google-cloud/spanner/session-pool;GetWriteSessionCallback;Argument[2]", //
+        "@google-cloud/spanner;Transaction;@google-cloud/spanner/transaction-runner;AsyncRunTransactionCallback;Argument[0]", //
+        "@google-cloud/spanner;Transaction;@google-cloud/spanner/transaction-runner;RunTransactionCallback;TypeVar[@google-cloud/spanner/common.NormalCallback.0]", //
+        "@google-cloud/spanner;Transaction;@google-cloud/spanner/transaction-runner;Runner;Member[getTransaction].ReturnValue.Awaited", //
+        "@google-cloud/spanner;Transaction;@google-cloud/spanner/transaction-runner;Runner;Member[transaction]", //
+        "@google-cloud/spanner;Transaction;@google-cloud/spanner/transaction;Transaction;", //
+        "@google-cloud/spanner;Transaction;@google-cloud/spanner;Session;Member[transaction].ReturnValue", //
+        "@google-cloud/spanner;Transaction;@google-cloud/spanner;Session;Member[txn]", //
+        "@google-cloud/spanner;Transaction;@google-cloud/spanner;TransactionStatic;Instance", //
+        "@google-cloud/spanner;TransactionStatic;@google-cloud/spanner/transaction;;Member[Transaction]", //
+        "@google-cloud/spanner;TransactionStatic;@google-cloud/spanner/transaction;TransactionStatic;", //
+        "@google-cloud/spanner;TransactionStatic;@google-cloud/spanner;;Member[Transaction]", //
+        "@google-cloud/spanner;v1.SpannerClient;@google-cloud/spanner/v1/spanner_client;SpannerClient;", //
+        "@google-cloud/spanner;v1.SpannerClient;@google-cloud/spanner;v1.SpannerClientStatic;Instance", //
+        "@google-cloud/spanner;v1.SpannerClientStatic;@google-cloud/spanner/v1/spanner_client;;Member[SpannerClient]", //
+        "@google-cloud/spanner;v1.SpannerClientStatic;@google-cloud/spanner/v1/spanner_client;SpannerClientStatic;", //
+        "@google-cloud/spanner;v1.SpannerClientStatic;@google-cloud/spanner;;Member[v1].Member[SpannerClient]", //
+        "@google-cloud/spanner;~SpannerObject;@google-cloud/spanner;Database;", //
+        "@google-cloud/spanner;~SpannerObject;@google-cloud/spanner;Snapshot;", //
+        "@google-cloud/spanner;~SpannerObject;@google-cloud/spanner;Transaction;", //
+        "@google-cloud/spanner;~SpannerObject;@google-cloud/spanner;v1.SpannerClient;", //
+        "@google-cloud/spanner;~SqlExecutorDirect;@google-cloud/spanner;BatchTransaction;Member[createQueryPartitions]", //
+        "@google-cloud/spanner;~SqlExecutorDirect;@google-cloud/spanner;Database;Member[run,runPartitionedUpdate,runStream]", //
+        "@google-cloud/spanner;~SqlExecutorDirect;@google-cloud/spanner;PartitionedDml;Member[runUpdate]", //
+        "@google-cloud/spanner;~SqlExecutorDirect;@google-cloud/spanner;Snapshot;Member[run,runStream]", //
+        "@google-cloud/spanner;~SqlExecutorDirect;@google-cloud/spanner;Transaction;Member[run,runStream,runUpdate]", //
+        "@google-cloud/spanner;~SqlExecutorDirect;@google-cloud/spanner;v1.SpannerClient;Member[executeSql,executeStreamingSql,partitionQuery]", //
+      ]
+  }
+}
+
+private class TypeVariables extends ModelInput::TypeVariableModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "@google-cloud/spanner/common.LongRunningCallback.0;Argument[1]", //
+        "@google-cloud/spanner/common.NormalCallback.0;Argument[1]", //
+        "@google-cloud/spanner/common.PagedCallback.0;Argument[1].ArrayElement", //
+        "@google-cloud/spanner/common.RequestCallback.0;TypeVar[@google-cloud/spanner/common.NormalCallback.0,@google-cloud/spanner/common.PagedCallback.0]", //
+        "@google-cloud/spanner/common.ResourceCallback.0;Argument[1]", //
+      ]
+  }
+}

javascript/ql/lib/semmle/javascript/frameworks/spanner/model.json

@@ -0,0 +1,249 @@
+{
+    "packages": {
+        "@google-cloud/spanner": "5.18.0"
+    },
+    "resolutions": {
+        "@google-cloud/common": "3.10.0",
+        "@google-cloud/precise-date": "2.0.4",
+        "@google-cloud/projectify": "2.1.1",
+        "@google-cloud/promisify": "2.0.4",
+        "@grpc/grpc-js": "1.6.7",
+        "@grpc/proto-loader": "0.6.12",
+        "@protobufjs/aspromise": "1.1.2",
+        "@protobufjs/base64": "1.1.2",
+        "@protobufjs/codegen": "2.0.4",
+        "@protobufjs/eventemitter": "1.1.0",
+        "@protobufjs/fetch": "1.1.0",
+        "@protobufjs/float": "1.0.2",
+        "@protobufjs/inquire": "1.1.0",
+        "@protobufjs/path": "1.1.2",
+        "@protobufjs/pool": "1.1.0",
+        "@protobufjs/utf8": "1.1.0",
+        "@tootallnate/once": "2.0.0",
+        "@types/big.js": "6.1.3",
+        "@types/duplexify": "3.6.1",
+        "@types/long": "4.0.2",
+        "@types/node": "17.0.35",
+        "@types/pumpify": "1.4.1",
+        "@types/stack-trace": "0.0.29",
+        "agent-base": "6.0.2",
+        "arrify": "2.0.1",
+        "base64-js": "1.5.1",
+        "checkpoint-stream": "0.1.2",
+        "ecdsa-sig-formatter": "1.0.11",
+        "eventemitter3": "4.0.7",
+        "gaxios": "4.3.3",
+        "gcp-metadata": "4.3.1",
+        "google-auth-library": "7.14.1",
+        "google-gax": "2.30.5",
+        "google-p12-pem": "3.1.4",
+        "grpc-gcp": "0.3.3",
+        "gtoken": "5.3.2",
+        "http-proxy-agent": "5.0.0",
+        "https-proxy-agent": "5.0.1",
+        "is-stream": "2.0.1",
+        "is-stream-ended": "0.1.4",
+        "p-queue": "6.6.2",
+        "p-timeout": "3.2.0",
+        "proto3-json-serializer": "0.1.9",
+        "protobufjs": "6.11.3",
+        "retry-request": "4.2.2",
+        "safe-buffer": "5.2.1",
+        "split-array-stream": "2.0.0",
+        "stream-events": "1.0.5",
+        "teeny-request": "7.2.0"
+    },
+    "language": "javascript",
+    "model": {
+        "typeDefinitions": [
+            "@google-cloud/spanner;BatchTransaction;@google-cloud/spanner/batch-transaction;BatchTransaction;",
+            "@google-cloud/spanner;~SpannerObject;@google-cloud/spanner;Database;",
+            "@google-cloud/spanner;~SpannerObject;@google-cloud/spanner;Snapshot;",
+            "@google-cloud/spanner;~SpannerObject;@google-cloud/spanner;Transaction;",
+            "@google-cloud/spanner;~SpannerObject;@google-cloud/spanner;v1.SpannerClient;",
+            "@google-cloud/spanner;~SqlExecutorDirect;@google-cloud/spanner;BatchTransaction;Member[createQueryPartitions]",
+            "@google-cloud/spanner;~SqlExecutorDirect;@google-cloud/spanner;Database;Member[run,runPartitionedUpdate,runStream]",
+            "@google-cloud/spanner;~SqlExecutorDirect;@google-cloud/spanner;PartitionedDml;Member[runUpdate]",
+            "@google-cloud/spanner;~SqlExecutorDirect;@google-cloud/spanner;Snapshot;Member[run,runStream]",
+            "@google-cloud/spanner;~SqlExecutorDirect;@google-cloud/spanner;Transaction;Member[run,runStream,runUpdate]",
+            "@google-cloud/spanner;~SqlExecutorDirect;@google-cloud/spanner;v1.SpannerClient;Member[executeSql,executeStreamingSql,partitionQuery]"
+        ],
+        "sinks": []
+    },
+    "generatedModel": {
+        "//": "Autogenerated section. Manual edits in here will be lost.",
+        "typeDefinitions": [
+            "@google-cloud/spanner/batch-transaction;BatchTransaction;@google-cloud/spanner/batch-transaction;BatchTransactionStatic;Instance",
+            "@google-cloud/spanner/batch-transaction;BatchTransaction;@google-cloud/spanner/database;CreateBatchTransactionCallback;TypeVar[@google-cloud/spanner/common.ResourceCallback.0]",
+            "@google-cloud/spanner/batch-transaction;BatchTransaction;@google-cloud/spanner;Database;Member[batchTransaction].ReturnValue",
+            "@google-cloud/spanner/batch-transaction;BatchTransactionStatic;@google-cloud/spanner/batch-transaction;;Member[BatchTransaction]",
+            "@google-cloud/spanner/batch-transaction;TransactionIdentifier;@google-cloud/spanner/batch-transaction;BatchTransaction;Member[identifier].ReturnValue",
+            "@google-cloud/spanner/batch-transaction;TransactionIdentifier;@google-cloud/spanner;Database;Member[batchTransaction].Argument[0]",
+            "@google-cloud/spanner/database;BatchCreateSessionsCallback;@google-cloud/spanner;Database;Member[batchCreateSessions].Argument[1]",
+            "@google-cloud/spanner/database;CreateBatchTransactionCallback;@google-cloud/spanner;Database;Member[createBatchTransaction].Argument[1]",
+            "@google-cloud/spanner/database;CreateBatchTransactionCallback;@google-cloud/spanner;Database;Member[createBatchTransaction].WithArity[1].Argument[0]",
+            "@google-cloud/spanner/database;CreateSessionCallback;@google-cloud/spanner;Database;Member[createSession].Argument[1]",
+            "@google-cloud/spanner/database;CreateSessionCallback;@google-cloud/spanner;Database;Member[createSession].WithArity[1].Argument[0]",
+            "@google-cloud/spanner/database;DatabaseCallback;@google-cloud/spanner;Database;Member[get].Argument[1]",
+            "@google-cloud/spanner/database;DatabaseCallback;@google-cloud/spanner;Database;Member[get].WithArity[1].Argument[0]",
+            "@google-cloud/spanner/database;GetSessionsCallback;@google-cloud/spanner;Database;Member[getSessions].Argument[1]",
+            "@google-cloud/spanner/database;GetSessionsCallback;@google-cloud/spanner;Database;Member[getSessions].WithArity[1].Argument[0]",
+            "@google-cloud/spanner/database;GetSnapshotCallback;@google-cloud/spanner;Database;Member[getSnapshot].Argument[1]",
+            "@google-cloud/spanner/database;GetSnapshotCallback;@google-cloud/spanner;Database;Member[getSnapshot].WithArity[1].Argument[0]",
+            "@google-cloud/spanner/database;GetTransactionCallback;@google-cloud/spanner;Database;Member[getTransaction].Argument[0]",
+            "@google-cloud/spanner/database;PoolRequestCallback;@google-cloud/spanner;Database;Member[makePooledRequest_].Argument[1]",
+            "@google-cloud/spanner/database;RestoreDatabaseCallback;@google-cloud/spanner;Database;Member[restore].Argument[1,2]",
+            "@google-cloud/spanner/database;SessionPoolConstructor;@google-cloud/spanner;DatabaseStatic;Argument[2]",
+            "@google-cloud/spanner/database;SessionPoolConstructor;@google-cloud/spanner;Instance;Member[database].Argument[1]",
+            "@google-cloud/spanner/instance;CreateDatabaseCallback;@google-cloud/spanner;Instance;Member[createDatabase].Argument[2]",
+            "@google-cloud/spanner/instance;CreateDatabaseCallback;@google-cloud/spanner;Instance;Member[createDatabase].WithArity[2].Argument[1]",
+            "@google-cloud/spanner/instance;CreateDatabaseOptions;@google-cloud/spanner;Instance;Member[createDatabase].WithArity[1,2,3].Argument[1]",
+            "@google-cloud/spanner/instance;CreateInstanceCallback;@google-cloud/spanner;Spanner;Member[createInstance].Argument[2]",
+            "@google-cloud/spanner/instance;GetDatabasesCallback;@google-cloud/spanner;Instance;Member[getDatabases].Argument[1]",
+            "@google-cloud/spanner/instance;GetDatabasesCallback;@google-cloud/spanner;Instance;Member[getDatabases].WithArity[1].Argument[0]",
+            "@google-cloud/spanner/instance;GetInstanceCallback;@google-cloud/spanner;Instance;Member[get].Argument[1]",
+            "@google-cloud/spanner/instance;GetInstanceCallback;@google-cloud/spanner;Instance;Member[get].WithArity[1].Argument[0]",
+            "@google-cloud/spanner/session-pool;GetReadSessionCallback;@google-cloud/spanner/session-pool;SessionPoolInterface;Member[getReadSession].Argument[0]",
+            "@google-cloud/spanner/session-pool;GetReadSessionCallback;@google-cloud/spanner;SessionPool;Member[getReadSession].Argument[0]",
+            "@google-cloud/spanner/session-pool;GetWriteSessionCallback;@google-cloud/spanner/session-pool;SessionPoolInterface;Member[getWriteSession].Argument[0]",
+            "@google-cloud/spanner/session-pool;GetWriteSessionCallback;@google-cloud/spanner;SessionPool;Member[getWriteSession].Argument[0]",
+            "@google-cloud/spanner/session-pool;SessionPoolInterface;@google-cloud/spanner/database;SessionPoolConstructor;Instance",
+            "@google-cloud/spanner/session-pool;SessionPoolInterface;@google-cloud/spanner;Database;Member[pool_]",
+            "@google-cloud/spanner/session-pool;SessionPoolInterface;@google-cloud/spanner;SessionPool;",
+            "@google-cloud/spanner/table;CreateTableCallback;@google-cloud/spanner;Database;Member[createTable].Argument[2]",
+            "@google-cloud/spanner/table;CreateTableCallback;@google-cloud/spanner;Database;Member[createTable].WithArity[2].Argument[1]",
+            "@google-cloud/spanner/table;CreateTableCallback;@google-cloud/spanner;Table;Member[create].Argument[2]",
+            "@google-cloud/spanner/table;CreateTableCallback;@google-cloud/spanner;Table;Member[create].WithArity[2].Argument[1]",
+            "@google-cloud/spanner/transaction-runner;AsyncRunTransactionCallback;@google-cloud/spanner/transaction-runner;AsyncTransactionRunnerStatic;Argument[2]",
+            "@google-cloud/spanner/transaction-runner;AsyncRunTransactionCallback;@google-cloud/spanner;Database;Member[runTransactionAsync].Argument[1]",
+            "@google-cloud/spanner/transaction-runner;AsyncRunTransactionCallback;@google-cloud/spanner;Database;Member[runTransactionAsync].WithArity[1].Argument[0]",
+            "@google-cloud/spanner/transaction-runner;AsyncTransactionRunner;@google-cloud/spanner/transaction-runner;AsyncTransactionRunnerStatic;Instance",
+            "@google-cloud/spanner/transaction-runner;AsyncTransactionRunnerStatic;@google-cloud/spanner/transaction-runner;;Member[AsyncTransactionRunner]",
+            "@google-cloud/spanner/transaction-runner;RunTransactionCallback;@google-cloud/spanner/transaction-runner;TransactionRunnerStatic;Argument[2]",
+            "@google-cloud/spanner/transaction-runner;RunTransactionCallback;@google-cloud/spanner;Database;Member[runTransaction].Argument[1]",
+            "@google-cloud/spanner/transaction-runner;RunTransactionCallback;@google-cloud/spanner;Database;Member[runTransaction].WithArity[1].Argument[0]",
+            "@google-cloud/spanner/transaction-runner;Runner;@google-cloud/spanner/transaction-runner;AsyncTransactionRunner;",
+            "@google-cloud/spanner/transaction-runner;Runner;@google-cloud/spanner/transaction-runner;RunnerStatic;Instance",
+            "@google-cloud/spanner/transaction-runner;Runner;@google-cloud/spanner/transaction-runner;TransactionRunner;",
+            "@google-cloud/spanner/transaction-runner;RunnerStatic;@google-cloud/spanner/transaction-runner;;Member[Runner]",
+            "@google-cloud/spanner/transaction-runner;TransactionRunner;@google-cloud/spanner/transaction-runner;TransactionRunnerStatic;Instance",
+            "@google-cloud/spanner/transaction-runner;TransactionRunnerStatic;@google-cloud/spanner/transaction-runner;;Member[TransactionRunner]",
+            "@google-cloud/spanner/transaction;Dml;@google-cloud/spanner/transaction;DmlStatic;Instance",
+            "@google-cloud/spanner/transaction;Dml;@google-cloud/spanner;PartitionedDml;",
+            "@google-cloud/spanner/transaction;Dml;@google-cloud/spanner;Transaction;",
+            "@google-cloud/spanner/transaction;DmlStatic;@google-cloud/spanner/transaction;;Member[Dml]",
+            "@google-cloud/spanner;BackupStatic;@google-cloud/spanner/backup;;Member[Backup]",
+            "@google-cloud/spanner;BackupStatic;@google-cloud/spanner/backup;BackupStatic;",
+            "@google-cloud/spanner;BackupStatic;@google-cloud/spanner;;Member[Backup]",
+            "@google-cloud/spanner;Database;@google-cloud/spanner/database;Database;",
+            "@google-cloud/spanner;Database;@google-cloud/spanner/database;DatabaseCallback;TypeVar[@google-cloud/spanner/common.ResourceCallback.0]",
+            "@google-cloud/spanner;Database;@google-cloud/spanner/database;RestoreDatabaseCallback;TypeVar[@google-cloud/spanner/common.LongRunningCallback.0]",
+            "@google-cloud/spanner;Database;@google-cloud/spanner/database;SessionPoolConstructor;Argument[0]",
+            "@google-cloud/spanner;Database;@google-cloud/spanner/instance;CreateDatabaseCallback;TypeVar[@google-cloud/spanner/common.LongRunningCallback.0]",
+            "@google-cloud/spanner;Database;@google-cloud/spanner/instance;GetDatabasesCallback;TypeVar[@google-cloud/spanner/common.RequestCallback.0]",
+            "@google-cloud/spanner;Database;@google-cloud/spanner;DatabaseStatic;Instance",
+            "@google-cloud/spanner;Database;@google-cloud/spanner;Instance;Member[database].ReturnValue",
+            "@google-cloud/spanner;Database;@google-cloud/spanner;SessionPool;Member[database]",
+            "@google-cloud/spanner;Database;@google-cloud/spanner;SessionPoolStatic;Argument[0]",
+            "@google-cloud/spanner;Database;@google-cloud/spanner;SessionStatic;Argument[0]",
+            "@google-cloud/spanner;Database;@google-cloud/spanner;Table;Member[database]",
+            "@google-cloud/spanner;Database;@google-cloud/spanner;TableStatic;Argument[0]",
+            "@google-cloud/spanner;DatabaseStatic;@google-cloud/spanner/database;;Member[Database]",
+            "@google-cloud/spanner;DatabaseStatic;@google-cloud/spanner/database;DatabaseStatic;",
+            "@google-cloud/spanner;DatabaseStatic;@google-cloud/spanner;;Member[Database]",
+            "@google-cloud/spanner;GetInstancesCallback;@google-cloud/spanner/build/src;GetInstancesCallback;",
+            "@google-cloud/spanner;GetInstancesCallback;@google-cloud/spanner;Spanner;Member[getInstances].Argument[1]",
+            "@google-cloud/spanner;GetInstancesCallback;@google-cloud/spanner;Spanner;Member[getInstances].WithArity[1].Argument[0]",
+            "@google-cloud/spanner;Instance;@google-cloud/spanner/instance;CreateInstanceCallback;TypeVar[@google-cloud/spanner/common.LongRunningCallback.0]",
+            "@google-cloud/spanner;Instance;@google-cloud/spanner/instance;GetInstanceCallback;TypeVar[@google-cloud/spanner/common.ResourceCallback.0]",
+            "@google-cloud/spanner;Instance;@google-cloud/spanner/instance;Instance;",
+            "@google-cloud/spanner;Instance;@google-cloud/spanner;BackupStatic;Argument[0]",
+            "@google-cloud/spanner;Instance;@google-cloud/spanner;DatabaseStatic;Argument[0]",
+            "@google-cloud/spanner;Instance;@google-cloud/spanner;GetInstancesCallback;TypeVar[@google-cloud/spanner/common.PagedCallback.0]",
+            "@google-cloud/spanner;Instance;@google-cloud/spanner;InstanceStatic;Instance",
+            "@google-cloud/spanner;Instance;@google-cloud/spanner;Spanner;Member[instance].ReturnValue",
+            "@google-cloud/spanner;InstanceStatic;@google-cloud/spanner/instance;;Member[Instance]",
+            "@google-cloud/spanner;InstanceStatic;@google-cloud/spanner/instance;InstanceStatic;",
+            "@google-cloud/spanner;InstanceStatic;@google-cloud/spanner;;Member[Instance]",
+            "@google-cloud/spanner;PartitionedDml;@google-cloud/spanner/transaction;PartitionedDml;",
+            "@google-cloud/spanner;PartitionedDml;@google-cloud/spanner;PartitionedDmlStatic;Instance",
+            "@google-cloud/spanner;PartitionedDml;@google-cloud/spanner;Session;Member[partitionedDml].ReturnValue",
+            "@google-cloud/spanner;PartitionedDmlStatic;@google-cloud/spanner/transaction;;Member[PartitionedDml]",
+            "@google-cloud/spanner;PartitionedDmlStatic;@google-cloud/spanner/transaction;PartitionedDmlStatic;",
+            "@google-cloud/spanner;PartitionedDmlStatic;@google-cloud/spanner;;Member[PartitionedDml]",
+            "@google-cloud/spanner;Session;@google-cloud/spanner/batch-transaction;TransactionIdentifier;Member[session]",
+            "@google-cloud/spanner;Session;@google-cloud/spanner/database;BatchCreateSessionsCallback;TypeVar[@google-cloud/spanner/common.ResourceCallback.0].ArrayElement",
+            "@google-cloud/spanner;Session;@google-cloud/spanner/database;CreateSessionCallback;TypeVar[@google-cloud/spanner/common.ResourceCallback.0]",
+            "@google-cloud/spanner;Session;@google-cloud/spanner/database;GetSessionsCallback;TypeVar[@google-cloud/spanner/common.RequestCallback.0]",
+            "@google-cloud/spanner;Session;@google-cloud/spanner/database;PoolRequestCallback;TypeVar[@google-cloud/spanner/common.RequestCallback.0]",
+            "@google-cloud/spanner;Session;@google-cloud/spanner/session-pool;GetReadSessionCallback;TypeVar[@google-cloud/spanner/common.NormalCallback.0]",
+            "@google-cloud/spanner;Session;@google-cloud/spanner/session-pool;GetWriteSessionCallback;Argument[1]",
+            "@google-cloud/spanner;Session;@google-cloud/spanner/session-pool;SessionPoolInterface;Member[release].Argument[0]",
+            "@google-cloud/spanner;Session;@google-cloud/spanner/session;Session;",
+            "@google-cloud/spanner;Session;@google-cloud/spanner/transaction-runner;Runner;Member[session]",
+            "@google-cloud/spanner;Session;@google-cloud/spanner;Database;Member[_runPartitionedUpdate].Argument[0]",
+            "@google-cloud/spanner;Session;@google-cloud/spanner;Database;Member[makePooledRequest_].WithArity[1].ReturnValue.Awaited",
+            "@google-cloud/spanner;Session;@google-cloud/spanner;Database;Member[session].ReturnValue",
+            "@google-cloud/spanner;Session;@google-cloud/spanner;SessionPool;Member[_acquire,_getSession].ReturnValue.Awaited",
+            "@google-cloud/spanner;Session;@google-cloud/spanner;SessionPool;Member[_borrow,_destroy,_isValidSession,_ping,_prepareTransaction,_release,release].Argument[0]",
+            "@google-cloud/spanner;Session;@google-cloud/spanner;SessionPool;Member[_borrowFrom,_borrowNextAvailableSession].ReturnValue",
+            "@google-cloud/spanner;Session;@google-cloud/spanner;SessionPool;Member[_getIdleSessions].ReturnValue.ArrayElement",
+            "@google-cloud/spanner;Session;@google-cloud/spanner;SessionStatic;Instance",
+            "@google-cloud/spanner;Session;@google-cloud/spanner;Snapshot;Member[session]",
+            "@google-cloud/spanner;SessionPool;@google-cloud/spanner/instance;CreateDatabaseOptions;Member[poolCtor]",
+            "@google-cloud/spanner;SessionPool;@google-cloud/spanner/session-pool;SessionPool;",
+            "@google-cloud/spanner;SessionPool;@google-cloud/spanner;SessionPoolStatic;Instance",
+            "@google-cloud/spanner;SessionPoolStatic;@google-cloud/spanner/session-pool;;Member[SessionPool]",
+            "@google-cloud/spanner;SessionPoolStatic;@google-cloud/spanner/session-pool;SessionPoolStatic;",
+            "@google-cloud/spanner;SessionPoolStatic;@google-cloud/spanner;;Member[SessionPool]",
+            "@google-cloud/spanner;SessionStatic;@google-cloud/spanner/session;;Member[Session]",
+            "@google-cloud/spanner;SessionStatic;@google-cloud/spanner/session;SessionStatic;",
+            "@google-cloud/spanner;SessionStatic;@google-cloud/spanner;;Member[Session]",
+            "@google-cloud/spanner;Snapshot;@google-cloud/spanner/batch-transaction;BatchTransaction;",
+            "@google-cloud/spanner;Snapshot;@google-cloud/spanner/database;GetSnapshotCallback;TypeVar[@google-cloud/spanner/common.NormalCallback.0]",
+            "@google-cloud/spanner;Snapshot;@google-cloud/spanner/transaction;Dml;",
+            "@google-cloud/spanner;Snapshot;@google-cloud/spanner/transaction;Snapshot;",
+            "@google-cloud/spanner;Snapshot;@google-cloud/spanner;Session;Member[snapshot].ReturnValue",
+            "@google-cloud/spanner;Snapshot;@google-cloud/spanner;SnapshotStatic;Instance",
+            "@google-cloud/spanner;SnapshotStatic;@google-cloud/spanner/transaction;;Member[Snapshot]",
+            "@google-cloud/spanner;SnapshotStatic;@google-cloud/spanner/transaction;SnapshotStatic;",
+            "@google-cloud/spanner;SnapshotStatic;@google-cloud/spanner;;Member[Snapshot]",
+            "@google-cloud/spanner;Spanner;@google-cloud/spanner;InstanceStatic;Argument[0]",
+            "@google-cloud/spanner;Spanner;@google-cloud/spanner;SpannerStatic;Instance",
+            "@google-cloud/spanner;SpannerStatic;@google-cloud/spanner;;Member[Spanner]",
+            "@google-cloud/spanner;Table;@google-cloud/spanner/table;CreateTableCallback;TypeVar[@google-cloud/spanner/common.LongRunningCallback.0]",
+            "@google-cloud/spanner;Table;@google-cloud/spanner/table;Table;",
+            "@google-cloud/spanner;Table;@google-cloud/spanner;Database;Member[table].ReturnValue",
+            "@google-cloud/spanner;Table;@google-cloud/spanner;TableStatic;Instance",
+            "@google-cloud/spanner;TableStatic;@google-cloud/spanner/table;;Member[Table]",
+            "@google-cloud/spanner;TableStatic;@google-cloud/spanner/table;TableStatic;",
+            "@google-cloud/spanner;TableStatic;@google-cloud/spanner;;Member[Table]",
+            "@google-cloud/spanner;Transaction;@google-cloud/spanner/database;GetTransactionCallback;TypeVar[@google-cloud/spanner/common.NormalCallback.0]",
+            "@google-cloud/spanner;Transaction;@google-cloud/spanner/session-pool;GetWriteSessionCallback;Argument[2]",
+            "@google-cloud/spanner;Transaction;@google-cloud/spanner/transaction-runner;AsyncRunTransactionCallback;Argument[0]",
+            "@google-cloud/spanner;Transaction;@google-cloud/spanner/transaction-runner;RunTransactionCallback;TypeVar[@google-cloud/spanner/common.NormalCallback.0]",
+            "@google-cloud/spanner;Transaction;@google-cloud/spanner/transaction-runner;Runner;Member[getTransaction].ReturnValue.Awaited",
+            "@google-cloud/spanner;Transaction;@google-cloud/spanner/transaction-runner;Runner;Member[transaction]",
+            "@google-cloud/spanner;Transaction;@google-cloud/spanner/transaction;Transaction;",
+            "@google-cloud/spanner;Transaction;@google-cloud/spanner;Session;Member[transaction].ReturnValue",
+            "@google-cloud/spanner;Transaction;@google-cloud/spanner;Session;Member[txn]",
+            "@google-cloud/spanner;Transaction;@google-cloud/spanner;TransactionStatic;Instance",
+            "@google-cloud/spanner;TransactionStatic;@google-cloud/spanner/transaction;;Member[Transaction]",
+            "@google-cloud/spanner;TransactionStatic;@google-cloud/spanner/transaction;TransactionStatic;",
+            "@google-cloud/spanner;TransactionStatic;@google-cloud/spanner;;Member[Transaction]",
+            "@google-cloud/spanner;v1.SpannerClient;@google-cloud/spanner/v1/spanner_client;SpannerClient;",
+            "@google-cloud/spanner;v1.SpannerClient;@google-cloud/spanner;v1.SpannerClientStatic;Instance",
+            "@google-cloud/spanner;v1.SpannerClientStatic;@google-cloud/spanner/v1/spanner_client;;Member[SpannerClient]",
+            "@google-cloud/spanner;v1.SpannerClientStatic;@google-cloud/spanner/v1/spanner_client;SpannerClientStatic;",
+            "@google-cloud/spanner;v1.SpannerClientStatic;@google-cloud/spanner;;Member[v1].Member[SpannerClient]"
+        ],
+        "summaries": [],
+        "typeVariables": [
+            "@google-cloud/spanner/common.LongRunningCallback.0;Argument[1]",
+            "@google-cloud/spanner/common.NormalCallback.0;Argument[1]",
+            "@google-cloud/spanner/common.PagedCallback.0;Argument[1].ArrayElement",
+            "@google-cloud/spanner/common.RequestCallback.0;TypeVar[@google-cloud/spanner/common.NormalCallback.0,@google-cloud/spanner/common.PagedCallback.0]",
+            "@google-cloud/spanner/common.ResourceCallback.0;Argument[1]"
+        ]
+    }
+}

javascript/ql/lib/semmle/javascript/frameworks/sqlite3/Model.qll

@@ -0,0 +1,37 @@
+/** Generated model file */
+
+private import javascript
+
+private class Types extends ModelInput::TypeModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "sqlite3;Database;sqlite3;;Member[cached].Member[Database].ReturnValue", //
+        "sqlite3;Database;sqlite3;Database;Member[addListener,all,each,exec,get,on,once,prependListener,prependOnceListener,run].ReturnValue", //
+        "sqlite3;Database;sqlite3;DatabaseStatic;Instance", //
+        "sqlite3;Database;sqlite3;Statement;Member[finalize].ReturnValue", //
+        "sqlite3;DatabaseStatic;sqlite3;;Member[Database]", //
+        "sqlite3;DatabaseStatic;sqlite3;sqlite3;Member[Database]", //
+        "sqlite3;RunResult;sqlite3;sqlite3;Member[RunResult]", //
+        "sqlite3;Statement;sqlite3;Database;Member[prepare].ReturnValue", //
+        "sqlite3;Statement;sqlite3;RunResult;", //
+        "sqlite3;Statement;sqlite3;Statement;Member[all,bind,each,get,reset,run].ReturnValue", //
+        "sqlite3;Statement;sqlite3;StatementStatic;Instance", //
+        "sqlite3;StatementStatic;sqlite3;;Member[Statement]", //
+        "sqlite3;StatementStatic;sqlite3;sqlite3;Member[Statement]", //
+        "sqlite3;sqlite3;sqlite3;;Member[verbose].ReturnValue", //
+        "sqlite3;sqlite3;sqlite3;sqlite3;Member[verbose].ReturnValue", //
+      ]
+  }
+}
+
+private class Summaries extends ModelInput::SummaryModelCsv {
+  override predicate row(string row) {
+    row =
+      [
+        "sqlite3;Database;;;Member[addListener,all,each,exec,get,on,once,prependListener,prependOnceListener,run].ReturnValue;type", //
+        "sqlite3;Statement;;;Member[all,bind,each,get,reset,run].ReturnValue;type", //
+        "sqlite3;sqlite3;;;Member[verbose].ReturnValue;type", //
+      ]
+  }
+}

javascript/ql/lib/semmle/javascript/frameworks/sqlite3/model.json

@@ -0,0 +1,43 @@
+{
+    "packages": {
+        "@types/sqlite3": "3.1.8"
+    },
+    "resolutions": {
+        "@types/node": "17.0.35"
+    },
+    "language": "javascript",
+    "usedTypes": {
+        "sources": [
+            "sqlite3;Database"
+        ]
+    },
+    "model": {
+        "sinks": []
+    },
+    "generatedModel": {
+        "//": "Autogenerated section. Manual edits in here will be lost.",
+        "typeDefinitions": [
+            "sqlite3;Database;sqlite3;;Member[cached].Member[Database].ReturnValue",
+            "sqlite3;Database;sqlite3;Database;Member[addListener,all,each,exec,get,on,once,prependListener,prependOnceListener,run].ReturnValue",
+            "sqlite3;Database;sqlite3;DatabaseStatic;Instance",
+            "sqlite3;Database;sqlite3;Statement;Member[finalize].ReturnValue",
+            "sqlite3;DatabaseStatic;sqlite3;;Member[Database]",
+            "sqlite3;DatabaseStatic;sqlite3;sqlite3;Member[Database]",
+            "sqlite3;RunResult;sqlite3;sqlite3;Member[RunResult]",
+            "sqlite3;Statement;sqlite3;Database;Member[prepare].ReturnValue",
+            "sqlite3;Statement;sqlite3;RunResult;",
+            "sqlite3;Statement;sqlite3;Statement;Member[all,bind,each,get,reset,run].ReturnValue",
+            "sqlite3;Statement;sqlite3;StatementStatic;Instance",
+            "sqlite3;StatementStatic;sqlite3;;Member[Statement]",
+            "sqlite3;StatementStatic;sqlite3;sqlite3;Member[Statement]",
+            "sqlite3;sqlite3;sqlite3;;Member[verbose].ReturnValue",
+            "sqlite3;sqlite3;sqlite3;sqlite3;Member[verbose].ReturnValue"
+        ],
+        "summaries": [
+            "sqlite3;Database;;;Member[addListener,all,each,exec,get,on,once,prependListener,prependOnceListener,run].ReturnValue;type",
+            "sqlite3;Statement;;;Member[all,bind,each,get,reset,run].ReturnValue;type",
+            "sqlite3;sqlite3;;;Member[verbose].ReturnValue;type"
+        ],
+        "typeVariables": []
+    }
+}

javascript/ql/test/ApiGraphs/typed/NodeOfType.expected

@@ -1,9 +1,30 @@
+getANodeOfType
 | body-parser |  | index.ts:4:20:4:41 | require ... arser") |
 | express |  | index.ts:3:17:3:34 | require("express") |
 | mongodb |  | index.ts:1:8:1:19 | * as mongodb |
+| mongodb | AbstractCursor | index.ts:14:3:14:33 | getColl ... d: v }) |
 | mongodb | Collection | index.ts:14:3:14:17 | getCollection() |
+| mongodb | FindCursor | index.ts:14:3:14:33 | getColl ... d: v }) |
+| mongodb | TypedEventEmitter | index.ts:14:3:14:33 | getColl ... d: v }) |
 | mongoose |  | index.ts:17:8:17:20 | * as mongoose |
+| mongoose | AcceptsDiscriminator | index.ts:22:3:22:20 | getMongooseModel() |
+| mongoose | Document | index.ts:22:3:22:20 | getMongooseModel() |
+| mongoose | HydratedDocument | index.ts:22:3:22:20 | getMongooseModel() |
 | mongoose | Model | index.ts:22:3:22:20 | getMongooseModel() |
+| mongoose | Query | index.ts:22:3:22:20 | getMongooseModel() |
+| mongoose | Query | index.ts:22:3:22:36 | getMong ... d: v }) |
 | mongoose | Query | index.ts:23:3:23:20 | getMongooseQuery() |
+| mongoose | Query | index.ts:23:3:23:36 | getMong ... d: v }) |
+| mongoose | QueryWithHelpers | index.ts:22:3:22:36 | getMong ... d: v }) |
+| mongoose | QueryWithHelpers | index.ts:23:3:23:36 | getMong ... d: v }) |
+| mongoose | SessionOperation | index.ts:22:3:22:20 | getMongooseModel() |
+| mongoose | SessionOperation | index.ts:22:3:22:36 | getMong ... d: v }) |
+| mongoose | SessionOperation | index.ts:23:3:23:20 | getMongooseQuery() |
+| mongoose | SessionOperation | index.ts:23:3:23:36 | getMong ... d: v }) |
 | puppeteer |  | index.ts:26:8:26:21 | * as puppeteer |
 | puppeteer | Browser | index.ts:30:22:30:33 | this.browser |
+getANodeOfTypeRaw
+| mongodb | Collection | index.ts:14:3:14:17 | getCollection() |
+| mongoose | Model | index.ts:22:3:22:20 | getMongooseModel() |
+| mongoose | Query | index.ts:23:3:23:20 | getMongooseQuery() |
+| puppeteer | Browser | index.ts:30:22:30:33 | this.browser |

javascript/ql/test/ApiGraphs/typed/NodeOfType.ql

@@ -1,4 +1,9 @@
 import javascript
 
-from string mod, string tp
-select mod, tp, API::Node::ofType(mod, tp).asSource()
+query DataFlow::Node getANodeOfType(string package, string type) {
+  result = API::Node::ofType(package, type).asSource()
+}
+
+query DataFlow::Node getANodeOfTypeRaw(string package, string type) {
+  result = API::Internal::getANodeOfTypeRaw(package, type).asSource()
+}

javascript/ql/test/library-tests/Security/heuristics/sources.js

@@ -1,14 +1,14 @@
 (function() {
     const password = '1234';
     sink(password); // NOT OK
-    
+
     const s = JSON.stringify();
     sink(s); // NOT OK
 })();
 
 (async function() {
     const knex = require('knex');
-    
+
     const users = knex().select('*').from('users');
     users.then(function (users) {
         sink(users); // NOT OK
@@ -23,13 +23,13 @@
 
 (function() {
     const pg = require('pg');
-    
+
     const pool = new pg.Pool({});
     pool.connect(async function (err, client, done) {
         client.query('SELECT * FROM users', function (err, users) {
             sink(users);
         });
-        
+
         const thenable = client.query('SELECT * FROM users')
         thenable.then(function(users) {
             sink(users); // NOT OK
@@ -79,7 +79,7 @@
     db.all('SELECT * FROM users', function (err, users) {
         sink(users); // NOT OK
     });
-    
+
     const sqlitepromise = db.all('SELECT * FROM users');
 
     sink(await sqlitepromise); // NOT OK
@@ -100,13 +100,13 @@
 (async function () {
     const sql = require('mssql');
     await sql.connect('...');
-    
+
     sql.query('SELECT * FROM users', function (err, users) {
         sink(users); // NOT OK
     });
 
     const mssqlthenable = sql.query('SELECT * FROM users');
-    
+
     mssqlthenable.then(function (users) {
         sink(users); // NOT OK
     });
@@ -120,7 +120,7 @@
 })();
 
 (async function () {
-    const {Spanner} = require('@google-cloud/spanner');
+    const {Spanner, v1} = require('@google-cloud/spanner');
     const db = new Spanner({projectId: 'test'})
         .instance('instanceid')
         .database('databaseid');
@@ -131,7 +131,7 @@
 
     const [users] = (await db.executeSql('SELECT * FROM users', {}));
     sink(users); // NOT OK
-    
+
     const spannerpromise = db.run({
         sql: 'SELECT * FROM users'
     });
@@ -144,7 +144,7 @@
         sink(rows); // NOT OK
     });
 
-    const client = new Spanner.v1.SpannerClient({});
+    const client = new v1.SpannerClient({});
     client.executeSql('SELECT * FROM users', {}, function (err, users) {
         sink(users); // NOT OK
     });
@@ -166,7 +166,7 @@
 
 (function () {
     const { MongoClient } = require('mongodb');
-    
+
     MongoClient.connect('mongodb://localhost:1234', async function (err, db) {
         const collection = db.collection('users');
         const users = await collection.find({});
@@ -209,11 +209,11 @@
 
 (async function () {
     const { Collection } = require('marsdb');
-    
+
     const doc = new Collection('users');
 
     const users = await doc.find({});
-    
+
     sink(users); // NOT OK
 })();
 

javascript/ql/test/library-tests/frameworks/SQL/SqlString.expected

@@ -41,7 +41,11 @@
 | sequelize-types.ts:7:24:7:35 | 'SELECT 123' |
 | sequelize.js:8:17:8:118 | 'SELECT ... Y name' |
 | sequelizeImport.js:3:17:3:118 | 'SELECT ... Y name' |
+| spanner2.js:4:19:4:59 | "not SQ ... anyway" |
+| spanner2.js:5:19:5:37 | { sql: "SQL code" } |
 | spanner2.js:5:26:5:35 | "SQL code" |
+| spanner2.js:6:28:6:68 | "not SQ ... anyway" |
+| spanner2.js:7:28:7:46 | { sql: "SQL code" } |
 | spanner2.js:7:35:7:44 | "SQL code" |
 | spanner-types.ts:4:12:4:23 | 'SELECT 123' |
 | spanner.js:6:8:6:17 | "SQL code" |

javascript/ql/test/library-tests/frameworks/SQL/spanner2.js

@@ -1,7 +1,7 @@
 const spanner = require("@google-cloud/spanner");
 const client = new spanner.v1.SpannerClient({});
 
-client.executeSql("not SQL code", (err, rows) => {});
+client.executeSql("not SQL code but treated as sink anyway", (err, rows) => {});
 client.executeSql({ sql: "SQL code" }, (err, rows) => {});
-client.executeStreamingSql("not SQL code", (err, rows) => {});
+client.executeStreamingSql("not SQL code but treated as sink anyway", (err, rows) => {});
 client.executeStreamingSql({ sql: "SQL code" }, (err, rows) => {});

javascript/ql/test/query-tests/Security/CWE-089/untyped/DatabaseAccesses.expected

@@ -6,8 +6,8 @@
 | json-schema-validator.js:55:13:55:27 | doc.find(query) |
 | json-schema-validator.js:59:13:59:27 | doc.find(query) |
 | json-schema-validator.js:61:13:61:27 | doc.find(query) |
-| marsdb-flow-to.js:14:3:14:22 | db.myDoc.find(query) |
-| marsdb.js:16:3:16:17 | doc.find(query) |
+| marsdb-flow-to.js:14:3:14:41 | db.myDo ...  => {}) |
+| marsdb.js:16:3:16:36 | doc.fin ...  => {}) |
 | minimongo.js:18:3:18:17 | doc.find(query) |
 | mongodb.js:18:7:18:21 | doc.find(query) |
 | mongodb.js:21:7:21:48 | doc.fin ... itle }) |

javascript/ql/test/query-tests/Security/CWE-089/untyped/marsdb-flow-to.js

@@ -11,5 +11,5 @@ app.post("/documents/find", (req, res) => {
   query.title = req.body.title;
 
   // NOT OK: query is tainted by user-provided object value
-  db.myDoc.find(query);
+  db.myDoc.find(query, (err, data) => {});
 });

javascript/ql/test/query-tests/Security/CWE-089/untyped/marsdb.js

@@ -13,5 +13,5 @@ app.post("/documents/find", (req, res) => {
   query.title = req.body.title;
 
   // NOT OK: query is tainted by user-provided object value
-  doc.find(query);
+  doc.find(query, (err, data) => {});
 });

javascript/ql/test/query-tests/Security/CWE-089/untyped/pg-promise.js

@@ -5,7 +5,7 @@ require('express')().get('/foo', (req, res) => {
 
   var query = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='"
              + req.params.category + "' ORDER BY PRICE";
-  
+
   db.any(query); // NOT OK
   db.many(query); // NOT OK
   db.manyOrNone(query); // NOT OK
@@ -17,7 +17,7 @@ require('express')().get('/foo', (req, res) => {
   db.oneOrNone(query); // NOT OK
   db.query(query); // NOT OK
   db.result(query); // NOT OK
-  
+
   db.one({
     text: query // NOT OK
   });
@@ -59,7 +59,7 @@ require('express')().get('/foo', (req, res) => {
   db.task(t => {
       return t.one(query); // NOT OK
   });
-  db.task(
+  db.taskIf(
     { cnd: t => t.one(query) }, // NOT OK
     t => t.one(query) // NOT OK
   );

python/ql/lib/change-notes/2022-09-22-flask-jsonify.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added modeling of creating Flask responses with `flask.jsonify`.

python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImplCommon.qll

@@ -709,7 +709,8 @@ private module Cached {
      */
     pragma[nomagic]
     private DataFlowCallable viableImplInCallContextExt(DataFlowCall call, DataFlowCall ctx) {
-      result = viableImplInCallContext(call, ctx)
+      result = viableImplInCallContext(call, ctx) and
+      result = viableCallable(call)
       or
       result = viableCallableLambda(call, TDataFlowCallSome(ctx))
       or

python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImplConsistency.qll

@@ -38,6 +38,13 @@ module Consistency {
 
     /** Holds if `n` should be excluded from the consistency test `uniquePostUpdate`. */
     predicate uniquePostUpdateExclude(Node n) { none() }
+
+    /** Holds if `(call, ctx)` should be excluded from the consistency test `viableImplInCallContextTooLargeExclude`. */
+    predicate viableImplInCallContextTooLargeExclude(
+      DataFlowCall call, DataFlowCall ctx, DataFlowCallable callable
+    ) {
+      none()
+    }
   }
 
   private class RelevantNode extends Node {
@@ -217,4 +224,12 @@ module Consistency {
     not any(ConsistencyConfiguration c).postWithInFlowExclude(n) and
     msg = "PostUpdateNode should not be the target of local flow."
   }
+
+  query predicate viableImplInCallContextTooLarge(
+    DataFlowCall call, DataFlowCall ctx, DataFlowCallable callable
+  ) {
+    callable = viableImplInCallContext(call, ctx) and
+    not callable = viableCallable(call) and
+    not any(ConsistencyConfiguration c).viableImplInCallContextTooLargeExclude(call, ctx, callable)
+  }
 }

python/ql/lib/semmle/python/frameworks/Flask.qll

@@ -171,6 +171,22 @@ module Flask {
       override DataFlow::Node getMimetypeOrContentTypeArg() { none() }
     }
 
+    /**
+     * A call to `flask.jsonify` function. This creates a JSON response.
+     *
+     * See
+     * - https://flask.palletsprojects.com/en/2.2.x/api/#flask.json.jsonify
+     */
+    private class FlaskJsonifyCall extends InstanceSource, DataFlow::CallCfgNode {
+      FlaskJsonifyCall() { this = API::moduleImport("flask").getMember("jsonify").getACall() }
+
+      override DataFlow::Node getBody() { result in [this.getArg(_), this.getArgByName(_)] }
+
+      override string getMimetypeDefault() { result = "application/json" }
+
+      override DataFlow::Node getMimetypeOrContentTypeArg() { none() }
+    }
+
     /** Gets a reference to an instance of `flask.Response`. */
     private DataFlow::TypeTrackingNode instance(DataFlow::TypeTracker t) {
       t.start() and

python/ql/lib/semmle/python/frameworks/data/internal/ApiGraphModels.qll

@@ -502,7 +502,12 @@ private API::Node getNodeFromSubPath(API::Node base, AccessPath subPath, int n)
   result =
     getNodeFromSubPath(getNodeFromSubPath(base, subPath, n - 1), getSubPathAt(subPath, n - 1))
   or
-  typeStep(getNodeFromSubPath(base, subPath, n), result)
+  typeStep(getNodeFromSubPath(base, subPath, n), result) and
+  // Only apply type-steps strictly between the steps on the sub path, not before and after.
+  // Steps before/after lead to unnecessary transitive edges, which the user of the sub-path
+  // will themselves find by following type-steps.
+  n > 0 and
+  n < subPath.getNumToken()
 }
 
 /**

python/ql/test/experimental/dataflow/basic/dataflow-consistency.expected

@@ -16,3 +16,4 @@ postIsInSameCallable
 reverseRead
 argHasPostUpdate
 postWithInFlow
+viableImplInCallContextTooLarge

python/ql/test/experimental/dataflow/calls/dataflow-consistency.expected

@@ -16,3 +16,4 @@ postIsInSameCallable
 reverseRead
 argHasPostUpdate
 postWithInFlow
+viableImplInCallContextTooLarge

python/ql/test/experimental/dataflow/consistency/dataflow-consistency.expected

@@ -16,3 +16,4 @@ postIsInSameCallable
 reverseRead
 argHasPostUpdate
 postWithInFlow
+viableImplInCallContextTooLarge

python/ql/test/experimental/dataflow/coverage/dataflow-consistency.expected

@@ -16,3 +16,4 @@ postIsInSameCallable
 reverseRead
 argHasPostUpdate
 postWithInFlow
+viableImplInCallContextTooLarge

python/ql/test/experimental/dataflow/fieldflow/dataflow-consistency.expected

@@ -16,3 +16,4 @@ postIsInSameCallable
 reverseRead
 argHasPostUpdate
 postWithInFlow
+viableImplInCallContextTooLarge

python/ql/test/experimental/dataflow/global-flow/dataflow-consistency.expected

@@ -16,3 +16,4 @@ postIsInSameCallable
 reverseRead
 argHasPostUpdate
 postWithInFlow
+viableImplInCallContextTooLarge

python/ql/test/experimental/dataflow/match/dataflow-consistency.expected

@@ -16,3 +16,4 @@ postIsInSameCallable
 reverseRead
 argHasPostUpdate
 postWithInFlow
+viableImplInCallContextTooLarge

python/ql/test/experimental/dataflow/pep_328/dataflow-consistency.expected

@@ -16,3 +16,4 @@ postIsInSameCallable
 reverseRead
 argHasPostUpdate
 postWithInFlow
+viableImplInCallContextTooLarge

python/ql/test/experimental/dataflow/regression/dataflow-consistency.expected

@@ -16,3 +16,4 @@ postIsInSameCallable
 reverseRead
 argHasPostUpdate
 postWithInFlow
+viableImplInCallContextTooLarge

python/ql/test/experimental/dataflow/strange-essaflow/dataflow-consistency.expected

@@ -16,3 +16,4 @@ postIsInSameCallable
 reverseRead
 argHasPostUpdate
 postWithInFlow
+viableImplInCallContextTooLarge

python/ql/test/experimental/dataflow/tainttracking/basic/dataflow-consistency.expected

@@ -16,3 +16,4 @@ postIsInSameCallable
 reverseRead
 argHasPostUpdate
 postWithInFlow
+viableImplInCallContextTooLarge

python/ql/test/experimental/dataflow/tainttracking/commonSanitizer/dataflow-consistency.expected

@@ -16,3 +16,4 @@ postIsInSameCallable
 reverseRead
 argHasPostUpdate
 postWithInFlow
+viableImplInCallContextTooLarge

python/ql/test/experimental/dataflow/tainttracking/customSanitizer/dataflow-consistency.expected

@@ -16,3 +16,4 @@ postIsInSameCallable
 reverseRead
 argHasPostUpdate
 postWithInFlow
+viableImplInCallContextTooLarge