Javascript: tentative fix to a weird build problem

Overlay: Add missing `overlay[caller?]` annotation

.github/workflows/check-change-note.yml

@@ -16,7 +16,6 @@ on:
       - "shared/**/*.qll"
       - "!**/experimental/**"
       - "!ql/**"
-      - "!rust/**"
       - ".github/workflows/check-change-note.yml"
 
 jobs:

.github/workflows/ql-for-ql-dataset_measure.yml

@@ -53,7 +53,7 @@ jobs:
       - name: Create database
         run: |
           "${CODEQL}" database create \
-          --search-path "${{ github.workspace }}"
+          --search-path "${{ github.workspace }}" \
           --threads 4 \
             --language ql --source-root "${{ github.workspace }}/repo" \
             "${{ runner.temp }}/database"

Cargo.lock

@@ -419,6 +419,7 @@ dependencies = [
  "lazy_static",
  "rayon",
  "regex",
+ "serde_json",
  "tracing",
  "tracing-subscriber",
  "tree-sitter",

actions/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/actions-all
-version: 0.4.12
+version: 0.4.13-dev
 library: true
 warnOnImplicitThis: true
 dependencies:

actions/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/actions-queries
-version: 0.6.4
+version: 0.6.5-dev
 library: false
 warnOnImplicitThis: true
 groups: [actions, queries]

config/add-overlay-annotations.py

@@ -17,16 +17,16 @@
 #!/usr/bin/python3
 import sys
 import os
+import re
 from difflib import context_diff
 
+OVERLAY_PATTERN = re.compile(r'overlay\[[a-zA-Z?_-]+\]')
 
 def has_overlay_annotations(lines):
     '''
     Check whether the given lines contain any overlay[...] annotations.
     '''
-    overlays = ["local", "local?", "global", "caller", "caller?"]
-    annotations = [f"overlay[{t}]" for t in overlays]
-    return any(ann in line for ann in annotations for line in lines)
+    return any(OVERLAY_PATTERN.search(line) for line in lines)
 
 
 def is_line_comment(line):

config/dbscheme-fragments.json

@@ -11,6 +11,7 @@
     "/*- Diagnostic messages -*/",
     "/*- Diagnostic messages: severity -*/",
     "/*- Source location prefix -*/",
+    "/*- Database metadata -*/",
     "/*- Lines of code -*/",
     "/*- Configuration files with key value pairs -*/",
     "/*- YAML -*/",
@@ -31,4 +32,4 @@
     "/*- Python dbscheme -*/",
     "/*- Empty location -*/"
   ]
-}
+}

config/opcode-qldoc.py

@@ -8,9 +8,9 @@ needs_an_re = re.compile(r'^(?!Unary)[AEIOU]')  # Name requiring "an" instead of
 start_qldoc_re = re.compile(r'^\s*/\*\*')  # Start of a QLDoc comment
 end_qldoc_re = re.compile(r'\*/\s*$')  # End of a QLDoc comment
 blank_qldoc_line_re = re.compile(r'^\s*\*\s*$')  # A line in a QLDoc comment with only the '*'
-instruction_class_re = re.compile(r'^class (?P<name>[A-aa-z0-9]+)Instruction\s')  # Declaration of an `Instruction` class
-opcode_base_class_re = re.compile(r'^abstract class (?P<name>[A-aa-z0-9]+)Opcode\s')  # Declaration of an `Opcode` base class
-opcode_class_re = re.compile(r'^  class (?P<name>[A-aa-z0-9]+)\s')  # Declaration of an `Opcode` class
+instruction_class_re = re.compile(r'^class (?P<name>[A-Za-z0-9]+)Instruction\s')  # Declaration of an `Instruction` class
+opcode_base_class_re = re.compile(r'^abstract class (?P<name>[A-Za-z0-9]+)Opcode\s')  # Declaration of an `Opcode` base class
+opcode_class_re = re.compile(r'^  class (?P<name>[A-Za-z0-9]+)\s')  # Declaration of an `Opcode` class
 
 script_dir = path.realpath(path.dirname(__file__))
 instruction_path = path.realpath(path.join(script_dir, '../cpp/ql/src/semmle/code/cpp/ir/implementation/raw/Instruction.qll'))

cpp/downgrades/7bc12b02a4363149f0727a4bce07952dbb9d98aa/builtintypes.ql

@@ -0,0 +1,14 @@
+class BuiltinType extends @builtintype {
+  string toString() { none() }
+}
+
+from BuiltinType type, string name, int kind, int kind_new, int size, int sign, int alignment
+where
+  builtintypes(type, name, kind, size, sign, alignment) and
+  if
+    type instanceof @complex_fp16 or
+    type instanceof @complex_std_bfloat16 or
+    type instanceof @complex_std_float16
+  then kind_new = 2
+  else kind_new = kind
+select type, name, kind_new, size, sign, alignment

cpp/downgrades/7bc12b02a4363149f0727a4bce07952dbb9d98aa/upgrade.properties

@@ -0,0 +1,3 @@
+description: Introduce new complex 16-bit floating-point types
+compatibility: backwards
+builtintypes.rel: run builtintypes.qlo

cpp/ql/lib/change-notes/2025-06-20-oracle-oci-models.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added `sql-injection` sink models for the Oracle Call Interface (OCI) database library functions `OCIStmtPrepare` and `OCIStmtPrepare2`.

cpp/ql/lib/change-notes/2025-06-24-float16.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added support for `__fp16 _Complex` and `__bf16 _Complex` types

cpp/ql/lib/experimental/quantum/Language.qll

@@ -56,7 +56,7 @@ module ArtifactFlowConfig implements DataFlow::ConfigSig {
 module ArtifactFlow = DataFlow::Global<ArtifactFlowConfig>;
 
 /**
- * Artifact output to node input configuration
+ * An artifact output to node input configuration
  */
 abstract class AdditionalFlowInputStep extends DataFlow::Node {
   abstract DataFlow::Node getOutput();
@@ -91,9 +91,8 @@ module GenericDataSourceFlowConfig implements DataFlow::ConfigSig {
 
 module GenericDataSourceFlow = TaintTracking::Global<GenericDataSourceFlowConfig>;
 
-private class ConstantDataSource extends Crypto::GenericConstantSourceInstance instanceof Literal {
-  ConstantDataSource() { this instanceof OpenSslGenericSourceCandidateLiteral }
-
+private class ConstantDataSource extends Crypto::GenericConstantSourceInstance instanceof OpenSslGenericSourceCandidateLiteral
+{
   override DataFlow::Node getOutputNode() { result.asExpr() = this }
 
   override predicate flowsTo(Crypto::FlowAwareElement other) {

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/AlgToAVCFlow.qll

@@ -48,7 +48,7 @@ module KnownOpenSslAlgorithmToAlgorithmValueConsumerConfig implements DataFlow::
 module KnownOpenSslAlgorithmToAlgorithmValueConsumerFlow =
   DataFlow::Global<KnownOpenSslAlgorithmToAlgorithmValueConsumerConfig>;
 
-module RSAPaddingAlgorithmToPaddingAlgorithmValueConsumerConfig implements DataFlow::ConfigSig {
+module RsaPaddingAlgorithmToPaddingAlgorithmValueConsumerConfig implements DataFlow::ConfigSig {
   predicate isSource(DataFlow::Node source) { source.asExpr() instanceof OpenSslPaddingLiteral }
 
   predicate isSink(DataFlow::Node sink) {
@@ -60,8 +60,8 @@ module RSAPaddingAlgorithmToPaddingAlgorithmValueConsumerConfig implements DataF
   }
 }
 
-module RSAPaddingAlgorithmToPaddingAlgorithmValueConsumerFlow =
-  DataFlow::Global<RSAPaddingAlgorithmToPaddingAlgorithmValueConsumerConfig>;
+module RsaPaddingAlgorithmToPaddingAlgorithmValueConsumerFlow =
+  DataFlow::Global<RsaPaddingAlgorithmToPaddingAlgorithmValueConsumerConfig>;
 
 class OpenSslAlgorithmAdditionalFlowStep extends AdditionalFlowInputStep {
   OpenSslAlgorithmAdditionalFlowStep() { exists(AlgorithmPassthroughCall c | c.getInNode() = this) }
@@ -114,11 +114,11 @@ class CopyAndDupAlgorithmPassthroughCall extends AlgorithmPassthroughCall {
   override DataFlow::Node getOutNode() { result = outNode }
 }
 
-class NIDToPointerPassthroughCall extends AlgorithmPassthroughCall {
+class NidToPointerPassthroughCall extends AlgorithmPassthroughCall {
   DataFlow::Node inNode;
   DataFlow::Node outNode;
 
-  NIDToPointerPassthroughCall() {
+  NidToPointerPassthroughCall() {
     this.getTarget().getName() in ["OBJ_nid2obj", "OBJ_nid2ln", "OBJ_nid2sn"] and
     inNode.asExpr() = this.getArgument(0) and
     outNode.asExpr() = this
@@ -150,11 +150,11 @@ class PointerToPointerPassthroughCall extends AlgorithmPassthroughCall {
   override DataFlow::Node getOutNode() { result = outNode }
 }
 
-class PointerToNIDPassthroughCall extends AlgorithmPassthroughCall {
+class PointerToNidPassthroughCall extends AlgorithmPassthroughCall {
   DataFlow::Node inNode;
   DataFlow::Node outNode;
 
-  PointerToNIDPassthroughCall() {
+  PointerToNidPassthroughCall() {
     this.getTarget().getName() in ["OBJ_obj2nid", "OBJ_ln2nid", "OBJ_sn2nid", "OBJ_txt2nid"] and
     (
       inNode.asIndirectExpr() = this.getArgument(0)

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/BlockAlgorithmInstance.qll

@@ -5,36 +5,35 @@ private import experimental.quantum.OpenSSL.AlgorithmInstances.KnownAlgorithmCon
 private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.DirectAlgorithmValueConsumer
 private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumerBase
 private import AlgToAVCFlow
+private import codeql.quantum.experimental.Standardization::Types::KeyOpAlg as KeyOpAlg
 
 /**
  * Given a `KnownOpenSslBlockModeAlgorithmExpr`, converts this to a block family type.
  * Does not bind if there is no mapping (no mapping to 'unknown' or 'other').
  */
 predicate knownOpenSslConstantToBlockModeFamilyType(
-  KnownOpenSslBlockModeAlgorithmExpr e, Crypto::TBlockCipherModeOfOperationType type
+  KnownOpenSslBlockModeAlgorithmExpr e, KeyOpAlg::ModeOfOperationType type
 ) {
   exists(string name |
     name = e.(KnownOpenSslAlgorithmExpr).getNormalizedName() and
     (
-      name.matches("CBC") and type instanceof Crypto::CBC
+      name = "CBC" and type instanceof KeyOpAlg::CBC
       or
-      name.matches("CFB%") and type instanceof Crypto::CFB
+      name = "CFB%" and type instanceof KeyOpAlg::CFB
       or
-      name.matches("CTR") and type instanceof Crypto::CTR
+      name = "CTR" and type instanceof KeyOpAlg::CTR
       or
-      name.matches("GCM") and type instanceof Crypto::GCM
+      name = "GCM" and type instanceof KeyOpAlg::GCM
       or
-      name.matches("OFB") and type instanceof Crypto::OFB
+      name = "OFB" and type instanceof KeyOpAlg::OFB
       or
-      name.matches("XTS") and type instanceof Crypto::XTS
+      name = "XTS" and type instanceof KeyOpAlg::XTS
       or
-      name.matches("CCM") and type instanceof Crypto::CCM
+      name = "CCM" and type instanceof KeyOpAlg::CCM
       or
-      name.matches("GCM") and type instanceof Crypto::GCM
+      name = "CCM" and type instanceof KeyOpAlg::CCM
       or
-      name.matches("CCM") and type instanceof Crypto::CCM
-      or
-      name.matches("ECB") and type instanceof Crypto::ECB
+      name = "ECB" and type instanceof KeyOpAlg::ECB
     )
   )
 }
@@ -64,10 +63,10 @@ class KnownOpenSslBlockModeConstantAlgorithmInstance extends OpenSslAlgorithmIns
     getterCall = this
   }
 
-  override Crypto::TBlockCipherModeOfOperationType getModeType() {
+  override KeyOpAlg::ModeOfOperationType getModeType() {
     knownOpenSslConstantToBlockModeFamilyType(this, result)
     or
-    not knownOpenSslConstantToBlockModeFamilyType(this, _) and result = Crypto::OtherMode()
+    not knownOpenSslConstantToBlockModeFamilyType(this, _) and result = KeyOpAlg::OtherMode()
   }
 
   // NOTE: I'm not going to attempt to parse out the mode specific part, so returning

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/CipherAlgorithmInstance.qll

@@ -33,9 +33,9 @@ predicate knownOpenSslConstantToCipherFamilyType(
       or
       name.matches("CAST5%") and type = KeyOpAlg::TSymmetricCipher(KeyOpAlg::CAST5())
       or
-      name.matches("2DES%") and type = KeyOpAlg::TSymmetricCipher(KeyOpAlg::DoubleDES())
+      name.matches("2DES%") and type = KeyOpAlg::TSymmetricCipher(KeyOpAlg::DOUBLE_DES())
       or
-      name.matches("3DES%") and type = KeyOpAlg::TSymmetricCipher(KeyOpAlg::TripleDES())
+      name.matches("3DES%") and type = KeyOpAlg::TSymmetricCipher(KeyOpAlg::TRIPLE_DES())
       or
       name.matches("DES%") and type = KeyOpAlg::TSymmetricCipher(KeyOpAlg::DES())
       or
@@ -113,7 +113,7 @@ class KnownOpenSslCipherConstantAlgorithmInstance extends OpenSslAlgorithmInstan
     this.(KnownOpenSslCipherAlgorithmExpr).getExplicitKeySize() = result
   }
 
-  override Crypto::KeyOpAlg::Algorithm getAlgorithmType() {
+  override KeyOpAlg::AlgorithmType getAlgorithmType() {
     knownOpenSslConstantToCipherFamilyType(this, result)
     or
     not knownOpenSslConstantToCipherFamilyType(this, _) and

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/EllipticCurveAlgorithmInstance.qll

@@ -39,8 +39,14 @@ class KnownOpenSslEllipticCurveConstantAlgorithmInstance extends OpenSslAlgorith
     result = this.(Call).getTarget().getName()
   }
 
-  override Crypto::TEllipticCurveType getEllipticCurveType() {
-    Crypto::ellipticCurveNameToKeySizeAndFamilyMapping(this.getParsedEllipticCurveName(), _, result)
+  override Crypto::EllipticCurveFamilyType getEllipticCurveFamilyType() {
+    if
+      Crypto::ellipticCurveNameToKnownKeySizeAndFamilyMapping(this.getParsedEllipticCurveName(), _,
+        _)
+    then
+      Crypto::ellipticCurveNameToKnownKeySizeAndFamilyMapping(this.getParsedEllipticCurveName(), _,
+        result)
+    else result = Crypto::OtherEllipticCurveType()
   }
 
   override string getParsedEllipticCurveName() {
@@ -48,7 +54,7 @@ class KnownOpenSslEllipticCurveConstantAlgorithmInstance extends OpenSslAlgorith
   }
 
   override int getKeySize() {
-    Crypto::ellipticCurveNameToKeySizeAndFamilyMapping(this.(KnownOpenSslAlgorithmExpr)
+    Crypto::ellipticCurveNameToKnownKeySizeAndFamilyMapping(this.(KnownOpenSslAlgorithmExpr)
           .getNormalizedName(), result, _)
   }
 }

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/HashAlgorithmInstance.qll

@@ -11,21 +11,21 @@ predicate knownOpenSslConstantToHashFamilyType(
   exists(string name |
     name = e.(KnownOpenSslAlgorithmExpr).getNormalizedName() and
     (
-      name.matches("BLAKE2B") and type instanceof Crypto::BLAKE2B
+      name = "BLAKE2B" and type instanceof Crypto::BLAKE2B
       or
-      name.matches("BLAKE2S") and type instanceof Crypto::BLAKE2S
+      name = "BLAKE2S" and type instanceof Crypto::BLAKE2S
       or
-      name.matches("GOST%") and type instanceof Crypto::GOSTHash
+      name.matches("GOST%") and type instanceof Crypto::GOST_HASH
       or
-      name.matches("MD2") and type instanceof Crypto::MD2
+      name = "MD2" and type instanceof Crypto::MD2
       or
-      name.matches("MD4") and type instanceof Crypto::MD4
+      name = "MD4" and type instanceof Crypto::MD4
       or
-      name.matches("MD5") and type instanceof Crypto::MD5
+      name = "MD5" and type instanceof Crypto::MD5
       or
-      name.matches("MDC2") and type instanceof Crypto::MDC2
+      name = "MDC2" and type instanceof Crypto::MDC2
       or
-      name.matches("POLY1305") and type instanceof Crypto::POLY1305
+      name = "POLY1305" and type instanceof Crypto::POLY1305
       or
       name.matches(["SHA", "SHA1"]) and type instanceof Crypto::SHA1
       or
@@ -33,13 +33,13 @@ predicate knownOpenSslConstantToHashFamilyType(
       or
       name.matches("SHA3-%") and type instanceof Crypto::SHA3
       or
-      name.matches(["SHAKE"]) and type instanceof Crypto::SHAKE
+      name = "SHAKE" and type instanceof Crypto::SHAKE
       or
-      name.matches("SM3") and type instanceof Crypto::SM3
+      name = "SM3" and type instanceof Crypto::SM3
       or
-      name.matches("RIPEMD160") and type instanceof Crypto::RIPEMD160
+      name = "RIPEMD160" and type instanceof Crypto::RIPEMD160
       or
-      name.matches("WHIRLPOOL") and type instanceof Crypto::WHIRLPOOL
+      name = "WHIRLPOOL" and type instanceof Crypto::WHIRLPOOL
     )
   )
 }

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/KnownAlgorithmConstants.qll

@@ -210,7 +210,8 @@ string getAlgorithmAlias(string alias) {
 }
 
 /**
- * Finds aliases of known alagorithms defined by users (through obj_name_add and various macros pointing to this function)
+ * Holds for aliases of known algorithms defined by users
+ * (through obj_name_add and various macros pointing to this function).
  *
  * The `target` and `alias` are converted to lowercase to be of a standard form.
  */
@@ -222,7 +223,7 @@ predicate customAliases(string target, string alias) {
 }
 
 /**
- * A hard-coded mapping of known algorithm aliases in OpenSsl.
+ * Holds for a hard-coded mapping of known algorithm aliases in OpenSsl.
  * This was derived by applying the same kind of logic foun din `customAliases` to the
  * OpenSsl code base directly.
  *

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/MACAlgorithmInstance.qll

@@ -7,7 +7,7 @@ private import experimental.quantum.OpenSSL.Operations.OpenSSLOperations
 private import AlgToAVCFlow
 
 class KnownOpenSslMacConstantAlgorithmInstance extends OpenSslAlgorithmInstance,
-  Crypto::MACAlgorithmInstance instanceof KnownOpenSslMacAlgorithmExpr
+  Crypto::MacAlgorithmInstance instanceof KnownOpenSslMacAlgorithmExpr
 {
   OpenSslAlgorithmValueConsumer getterCall;
 
@@ -39,14 +39,14 @@ class KnownOpenSslMacConstantAlgorithmInstance extends OpenSslAlgorithmInstance,
     result = this.(Call).getTarget().getName()
   }
 
-  override Crypto::TMACType getMacType() {
-    this instanceof KnownOpenSslHMacAlgorithmExpr and result instanceof Crypto::THMAC
+  override Crypto::MacType getMacType() {
+    this instanceof KnownOpenSslHMacAlgorithmExpr and result = Crypto::HMAC()
     or
-    this instanceof KnownOpenSslCMacAlgorithmExpr and result instanceof Crypto::TCMAC
+    this instanceof KnownOpenSslCMacAlgorithmExpr and result = Crypto::CMAC()
   }
 }
 
-class KnownOpenSslHMacConstantAlgorithmInstance extends Crypto::HMACAlgorithmInstance,
+class KnownOpenSslHMacConstantAlgorithmInstance extends Crypto::HmacAlgorithmInstance,
   KnownOpenSslMacConstantAlgorithmInstance
 {
   override Crypto::AlgorithmValueConsumer getHashAlgorithmValueConsumer() {

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/PaddingAlgorithmInstance.qll

@@ -5,6 +5,7 @@ private import experimental.quantum.OpenSSL.AlgorithmInstances.KnownAlgorithmCon
 private import AlgToAVCFlow
 private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.DirectAlgorithmValueConsumer
 private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumerBase
+private import codeql.quantum.experimental.Standardization::Types::KeyOpAlg as KeyOpAlg
 
 /**
  * A class to define padding specific integer values.
@@ -28,18 +29,18 @@ class OpenSslPaddingLiteral extends Literal {
  * Does not bind if there is no mapping (no mapping to 'unknown' or 'other').
  */
 predicate knownOpenSslConstantToPaddingFamilyType(
-  KnownOpenSslPaddingAlgorithmExpr e, Crypto::TPaddingType type
+  KnownOpenSslPaddingAlgorithmExpr e, KeyOpAlg::PaddingSchemeType type
 ) {
   exists(string name |
     name = e.(KnownOpenSslAlgorithmExpr).getNormalizedName() and
     (
-      name.matches("OAEP") and type = Crypto::OAEP()
+      name = "OAEP" and type = KeyOpAlg::OAEP()
       or
-      name.matches("PSS") and type = Crypto::PSS()
+      name = "PSS" and type = KeyOpAlg::PSS()
       or
-      name.matches("PKCS7") and type = Crypto::PKCS7()
+      name = "PKCS7" and type = KeyOpAlg::PKCS7()
       or
-      name.matches("PKCS1V15") and type = Crypto::PKCS1_v1_5()
+      name = "PKCS1V15" and type = KeyOpAlg::PKCS1_V1_5()
     )
   )
 }
@@ -85,7 +86,7 @@ class KnownOpenSslPaddingConstantAlgorithmInstance extends OpenSslAlgorithmInsta
       // Source is `this`
       src.asExpr() = this and
       // This traces to a padding-specific consumer
-      RSAPaddingAlgorithmToPaddingAlgorithmValueConsumerFlow::flow(src, sink)
+      RsaPaddingAlgorithmToPaddingAlgorithmValueConsumerFlow::flow(src, sink)
     ) and
     isPaddingSpecificConsumer = true
   }
@@ -98,24 +99,24 @@ class KnownOpenSslPaddingConstantAlgorithmInstance extends OpenSslAlgorithmInsta
 
   override OpenSslAlgorithmValueConsumer getAvc() { result = getterCall }
 
-  Crypto::TPaddingType getKnownPaddingType() {
-    this.(Literal).getValue().toInt() in [1, 7, 8] and result = Crypto::PKCS1_v1_5()
+  KeyOpAlg::PaddingSchemeType getKnownPaddingType() {
+    this.(Literal).getValue().toInt() in [1, 7, 8] and result = KeyOpAlg::PKCS1_V1_5()
     or
-    this.(Literal).getValue().toInt() = 3 and result = Crypto::NoPadding()
+    this.(Literal).getValue().toInt() = 3 and result = KeyOpAlg::NoPadding()
     or
-    this.(Literal).getValue().toInt() = 4 and result = Crypto::OAEP()
+    this.(Literal).getValue().toInt() = 4 and result = KeyOpAlg::OAEP()
     or
-    this.(Literal).getValue().toInt() = 5 and result = Crypto::ANSI_X9_23()
+    this.(Literal).getValue().toInt() = 5 and result = KeyOpAlg::ANSI_X9_23()
     or
-    this.(Literal).getValue().toInt() = 6 and result = Crypto::PSS()
+    this.(Literal).getValue().toInt() = 6 and result = KeyOpAlg::PSS()
   }
 
-  override Crypto::TPaddingType getPaddingType() {
+  override KeyOpAlg::PaddingSchemeType getPaddingType() {
     isPaddingSpecificConsumer = true and
     (
       result = this.getKnownPaddingType()
       or
-      not exists(this.getKnownPaddingType()) and result = Crypto::OtherPadding()
+      not exists(this.getKnownPaddingType()) and result = KeyOpAlg::OtherPadding()
     )
     or
     isPaddingSpecificConsumer = false and
@@ -143,7 +144,7 @@ class KnownOpenSslPaddingConstantAlgorithmInstance extends OpenSslAlgorithmInsta
 //     this instanceof Literal and
 //     this.getValue().toInt() in [0, 1, 3, 4, 5, 6, 7, 8]
 //     // TODO: trace to padding-specific consumers
-//     RSAPaddingAlgorithmToPaddingAlgorithmValueConsumerFlow
+//     RsaPaddingAlgorithmToPaddingAlgorithmValueConsumerFlow
 //   }
 //   override string getRawPaddingAlgorithmName() { result = this.(Literal).getValue().toString() }
 //   override Crypto::TPaddingType getPaddingType() {
@@ -161,18 +162,18 @@ class KnownOpenSslPaddingConstantAlgorithmInstance extends OpenSslAlgorithmInsta
 //           else result = Crypto::OtherPadding()
 //   }
 // }
-class OAEPPaddingAlgorithmInstance extends Crypto::OAEPPaddingAlgorithmInstance,
+class OaepPaddingAlgorithmInstance extends Crypto::OaepPaddingAlgorithmInstance,
   KnownOpenSslPaddingConstantAlgorithmInstance
 {
-  OAEPPaddingAlgorithmInstance() {
-    this.(Crypto::PaddingAlgorithmInstance).getPaddingType() = Crypto::OAEP()
+  OaepPaddingAlgorithmInstance() {
+    this.(Crypto::PaddingAlgorithmInstance).getPaddingType() = KeyOpAlg::OAEP()
   }
 
-  override Crypto::HashAlgorithmInstance getOAEPEncodingHashAlgorithm() {
+  override Crypto::HashAlgorithmInstance getOaepEncodingHashAlgorithm() {
     none() //TODO
   }
 
-  override Crypto::HashAlgorithmInstance getMGF1HashAlgorithm() {
+  override Crypto::HashAlgorithmInstance getMgf1HashAlgorithm() {
     none() //TODO
   }
 }

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/SignatureAlgorithmInstance.qll

@@ -73,7 +73,7 @@ class KnownOpenSslSignatureConstantAlgorithmInstance extends OpenSslAlgorithmIns
     none()
   }
 
-  override KeyOpAlg::Algorithm getAlgorithmType() {
+  override KeyOpAlg::AlgorithmType getAlgorithmType() {
     knownOpenSslConstantToSignatureFamilyType(this, result)
     or
     not knownOpenSslConstantToSignatureFamilyType(this, _) and

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmValueConsumers/DirectAlgorithmValueConsumer.qll

@@ -4,10 +4,10 @@ private import experimental.quantum.OpenSSL.AlgorithmInstances.KnownAlgorithmCon
 private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumerBase
 
 /**
- * Cases like EVP_MD5(),
- * there is no input, rather it directly gets an algorithm
- * and returns it.
- * Also includes operations directly using an algorithm
+ * A call that is considered to inherently 'consume' an algorithm value.
+ * E.g., cases like EVP_MD5(),
+ * where there is no input, rather it directly gets an algorithm
+ * and returns it. Also includes operations directly using an algorithm
  * like AES_encrypt().
  */
 class DirectAlgorithmValueConsumer extends OpenSslAlgorithmValueConsumer instanceof OpenSslAlgorithmCall

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmValueConsumers/HashAlgorithmValueConsumer.qll

@@ -7,7 +7,7 @@ private import experimental.quantum.OpenSSL.AlgorithmInstances.OpenSSLAlgorithmI
 abstract class HashAlgorithmValueConsumer extends OpenSslAlgorithmValueConsumer { }
 
 /**
- * EVP_Q_Digest directly consumes algorithm constant values
+ * An EVP_Q_Digest directly consumes algorithm constant values
  */
 class Evp_Q_Digest_Algorithm_Consumer extends HashAlgorithmValueConsumer {
   Evp_Q_Digest_Algorithm_Consumer() { this.(Call).getTarget().getName() = "EVP_Q_digest" }

cpp/ql/lib/experimental/quantum/OpenSSL/Operations/EVPCipherOperation.qll

@@ -91,7 +91,8 @@ class Evp_Cipher_Update_Call extends EvpUpdate {
 }
 
 /**
- * see: https://docs.openssl.org/master/man3/EVP_EncryptInit/#synopsis
+ * The EVP Cipher operations.
+ * See: https://docs.openssl.org/master/man3/EVP_EncryptInit/#synopsis
  * Base configuration for all EVP cipher operations.
  */
 abstract class Evp_Cipher_Operation extends EvpOperation, Crypto::KeyOperationInstance {
@@ -163,6 +164,7 @@ class Evp_Cipher_Final_Call extends EvpFinal, Evp_Cipher_Operation {
 }
 
 /**
+ * The EVP encryption/decryption operations.
  * https://docs.openssl.org/3.2/man3/EVP_PKEY_decrypt/
  * https://docs.openssl.org/3.2/man3/EVP_PKEY_encrypt
  */

cpp/ql/lib/ext/Oracle.oci.model.yml

@@ -0,0 +1,8 @@
+# partial model of the Oracle Call Interface (OCI) library
+extensions:
+  - addsTo:
+      pack: codeql/cpp-all
+      extensible: sinkModel
+    data: # namespace, type, subtypes, name, signature, ext, input, kind, provenance
+      - ["", "", False, "OCIStmtPrepare", "", "", "Argument[*2]", "sql-injection", "manual"]
+      - ["", "", False, "OCIStmtPrepare2", "", "", "Argument[*3]", "sql-injection", "manual"]

cpp/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cpp-all
-version: 5.2.0
+version: 5.2.1-dev
 groups: cpp
 dbscheme: semmlecode.cpp.dbscheme
 extractor: cpp

cpp/ql/lib/semmle/code/cpp/Type.qll

@@ -858,6 +858,15 @@ private predicate floatingPointTypeMapping(
   or
   // __mfp8
   kind = 62 and base = 2 and domain = TRealDomain() and realKind = 62 and extended = false
+  or
+  // _Complex __fp16
+  kind = 64 and base = 2 and domain = TComplexDomain() and realKind = 54 and extended = false
+  or
+  // _Complex __bf16
+  kind = 65 and base = 2 and domain = TComplexDomain() and realKind = 55 and extended = false
+  or
+  // _Complex std::float16_t
+  kind = 66 and base = 2 and domain = TComplexDomain() and realKind = 56 and extended = false
 }
 
 /**

cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll

@@ -229,6 +229,49 @@ private predicate summaryModel0(
   )
 }
 
+/**
+ * Holds if the given extension tuple `madId` should pretty-print as `model`.
+ *
+ * This predicate should only be used in tests.
+ */
+predicate interpretModelForTest(QlBuiltins::ExtensionId madId, string model) {
+  exists(
+    string namespace, string type, boolean subtypes, string name, string signature, string ext,
+    string output, string kind, string provenance
+  |
+    Extensions::sourceModel(namespace, type, subtypes, name, signature, ext, output, kind,
+      provenance, madId)
+  |
+    model =
+      "Source: " + namespace + "; " + type + "; " + subtypes + "; " + name + "; " + signature + "; "
+        + ext + "; " + output + "; " + kind + "; " + provenance
+  )
+  or
+  exists(
+    string namespace, string type, boolean subtypes, string name, string signature, string ext,
+    string input, string kind, string provenance
+  |
+    Extensions::sinkModel(namespace, type, subtypes, name, signature, ext, input, kind, provenance,
+      madId)
+  |
+    model =
+      "Sink: " + namespace + "; " + type + "; " + subtypes + "; " + name + "; " + signature + "; " +
+        ext + "; " + input + "; " + kind + "; " + provenance
+  )
+  or
+  exists(
+    string namespace, string type, boolean subtypes, string name, string signature, string ext,
+    string input, string output, string kind, string provenance
+  |
+    Extensions::summaryModel(namespace, type, subtypes, name, signature, ext, input, output, kind,
+      provenance, madId)
+  |
+    model =
+      "Summary: " + namespace + "; " + type + "; " + subtypes + "; " + name + "; " + signature +
+        "; " + ext + "; " + input + "; " + output + "; " + kind + "; " + provenance
+  )
+}
+
 /**
  * Holds if `input` is `input0`, but with all occurrences of `@` replaced
  * by `n` repetitions of `*` (and similarly for `output` and `output0`).

cpp/ql/lib/semmlecode.cpp.dbscheme

@@ -693,6 +693,9 @@ case @builtintype.kind of
 | 61 = @complex_std_float128  // _Complex _Float128
 | 62 = @mfp8                  // __mfp8
 | 63 = @scalable_vector_count // __SVCount_t
+| 64 = @complex_fp16          // _Complex __fp16
+| 65 = @complex_std_bfloat16  // _Complex __bf16
+| 66 = @complex_std_float16   // _Complex std::float16_t
 ;
 
 builtintypes(

cpp/ql/lib/upgrades/e38346051783182ea75822e4adf8d4c6a949bc37/upgrade.properties

@@ -0,0 +1,2 @@
+description: Support more complex 16-bit floating-point types
+compatibility: full

cpp/ql/lib/utils/test/PrettyPrintModels.ql

@@ -0,0 +1,6 @@
+/**
+ * @kind test-postprocess
+ */
+
+import semmle.code.cpp.dataflow.ExternalFlow
+import codeql.dataflow.test.ProvenancePathGraph::TestPostProcessing::TranslateProvenanceResults<interpretModelForTest/2>

cpp/ql/src/Security/CWE/CWE-089/SqlTainted.ql

@@ -38,6 +38,9 @@ module SqlTaintedConfig implements DataFlow::ConfigSig {
 
   predicate isSink(DataFlow::Node node) {
     exists(SqlLikeFunction runSql | runSql.outermostWrapperFunctionCall(asSinkExpr(node), _))
+    or
+    // sink defined using models-as-data
+    sinkNode(node, "sql-injection")
   }
 
   predicate isBarrier(DataFlow::Node node) {
@@ -56,13 +59,21 @@ module SqlTaintedConfig implements DataFlow::ConfigSig {
 module SqlTainted = TaintTracking::Global<SqlTaintedConfig>;
 
 from
-  SqlLikeFunction runSql, Expr taintedArg, FlowSource taintSource, SqlTainted::PathNode sourceNode,
-  SqlTainted::PathNode sinkNode, string callChain
+  Expr taintedArg, FlowSource taintSource, SqlTainted::PathNode sourceNode,
+  SqlTainted::PathNode sinkNode, string extraText
 where
-  runSql.outermostWrapperFunctionCall(taintedArg, callChain) and
+  (
+    exists(SqlLikeFunction runSql, string callChain |
+      runSql.outermostWrapperFunctionCall(taintedArg, callChain) and
+      extraText = " and then passed to " + callChain
+    )
+    or
+    sinkNode(sinkNode.getNode(), "sql-injection") and
+    extraText = ""
+  ) and
   SqlTainted::flowPath(sourceNode, sinkNode) and
   taintedArg = asSinkExpr(sinkNode.getNode()) and
   taintSource = sourceNode.getNode()
 select taintedArg, sourceNode, sinkNode,
-  "This argument to a SQL query function is derived from $@ and then passed to " + callChain + ".",
-  taintSource, "user input (" + taintSource.getSourceType() + ")"
+  "This argument to a SQL query function is derived from $@" + extraText + ".", taintSource,
+  "user input (" + taintSource.getSourceType() + ")"

cpp/ql/src/change-notes/2025-06-20-sql-injection-models.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The query `cpp/sql-injection` now can be extended using the `sql-injection` Models as Data (MaD) sink kind.

cpp/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cpp-queries
-version: 1.4.3
+version: 1.4.4-dev
 groups:
   - cpp
   - queries

cpp/ql/test/library-tests/dataflow/external-models/flow.expected

@@ -1,57 +1,80 @@
-testFailures
+models
+| 1 | Sink: ; ; false; ymlSink; ; ; Argument[0]; test-sink; manual |
+| 2 | Sink: boost::asio; ; false; write; ; ; Argument[*1]; remote-sink; manual |
+| 3 | Source: ; ; false; GetCommandLineA; ; ; ReturnValue[*]; local; manual |
+| 4 | Source: ; ; false; GetEnvironmentStringsA; ; ; ReturnValue[*]; local; manual |
+| 5 | Source: ; ; false; GetEnvironmentVariableA; ; ; Argument[*1]; local; manual |
+| 6 | Source: ; ; false; MapViewOfFile2; ; ; ReturnValue[*]; local; manual |
+| 7 | Source: ; ; false; MapViewOfFile3; ; ; ReturnValue[*]; local; manual |
+| 8 | Source: ; ; false; MapViewOfFile3FromApp; ; ; ReturnValue[*]; local; manual |
+| 9 | Source: ; ; false; MapViewOfFile; ; ; ReturnValue[*]; local; manual |
+| 10 | Source: ; ; false; MapViewOfFileEx; ; ; ReturnValue[*]; local; manual |
+| 11 | Source: ; ; false; MapViewOfFileFromApp; ; ; ReturnValue[*]; local; manual |
+| 12 | Source: ; ; false; MapViewOfFileNuma2; ; ; ReturnValue[*]; local; manual |
+| 13 | Source: ; ; false; NtReadFile; ; ; Argument[*5]; local; manual |
+| 14 | Source: ; ; false; ReadFile; ; ; Argument[*1]; local; manual |
+| 15 | Source: ; ; false; ReadFileEx; ; ; Argument[*1]; local; manual |
+| 16 | Source: ; ; false; ymlSource; ; ; ReturnValue; local; manual |
+| 17 | Source: boost::asio; ; false; read_until; ; ; Argument[*1]; remote; manual |
+| 18 | Summary: ; ; false; CommandLineToArgvA; ; ; Argument[*0]; ReturnValue[**]; taint; manual |
+| 19 | Summary: ; ; false; ReadFileEx; ; ; Argument[*3].Field[@hEvent]; Argument[4].Parameter[*2].Field[@hEvent]; value; manual |
+| 20 | Summary: ; ; false; ymlStepGenerated; ; ; Argument[0]; ReturnValue; taint; df-generated |
+| 21 | Summary: ; ; false; ymlStepManual; ; ; Argument[0]; ReturnValue; taint; manual |
+| 22 | Summary: ; ; false; ymlStepManual_with_body; ; ; Argument[0]; ReturnValue; taint; manual |
+| 23 | Summary: boost::asio; ; false; buffer; ; ; Argument[*0]; ReturnValue; taint; manual |
 edges
-| asio_streams.cpp:56:18:56:23 | [summary param] *0 in buffer | asio_streams.cpp:56:18:56:23 | [summary] to write: ReturnValue in buffer | provenance | MaD:10 |
-| asio_streams.cpp:87:34:87:44 | read_until output argument | asio_streams.cpp:91:7:91:17 | recv_buffer | provenance | Src:MaD:2  |
-| asio_streams.cpp:87:34:87:44 | read_until output argument | asio_streams.cpp:93:29:93:39 | *recv_buffer | provenance | Src:MaD:2 Sink:MaD:6 |
+| asio_streams.cpp:56:18:56:23 | [summary param] *0 in buffer | asio_streams.cpp:56:18:56:23 | [summary] to write: ReturnValue in buffer | provenance | MaD:23 |
+| asio_streams.cpp:87:34:87:44 | read_until output argument | asio_streams.cpp:91:7:91:17 | recv_buffer | provenance | Src:MaD:17  |
+| asio_streams.cpp:87:34:87:44 | read_until output argument | asio_streams.cpp:93:29:93:39 | *recv_buffer | provenance | Src:MaD:17 Sink:MaD:2 |
 | asio_streams.cpp:97:37:97:44 | call to source | asio_streams.cpp:98:7:98:14 | send_str | provenance | TaintFunction |
 | asio_streams.cpp:97:37:97:44 | call to source | asio_streams.cpp:100:64:100:71 | *send_str | provenance | TaintFunction |
 | asio_streams.cpp:100:44:100:62 | call to buffer | asio_streams.cpp:100:44:100:62 | call to buffer | provenance |  |
 | asio_streams.cpp:100:44:100:62 | call to buffer | asio_streams.cpp:101:7:101:17 | send_buffer | provenance |  |
-| asio_streams.cpp:100:44:100:62 | call to buffer | asio_streams.cpp:103:29:103:39 | *send_buffer | provenance | Sink:MaD:6 |
+| asio_streams.cpp:100:44:100:62 | call to buffer | asio_streams.cpp:103:29:103:39 | *send_buffer | provenance | Sink:MaD:2 |
 | asio_streams.cpp:100:64:100:71 | *send_str | asio_streams.cpp:56:18:56:23 | [summary param] *0 in buffer | provenance |  |
-| asio_streams.cpp:100:64:100:71 | *send_str | asio_streams.cpp:100:44:100:62 | call to buffer | provenance | MaD:10 |
-| test.cpp:4:5:4:17 | [summary param] 0 in ymlStepManual | test.cpp:4:5:4:17 | [summary] to write: ReturnValue in ymlStepManual | provenance | MaD:26955 |
-| test.cpp:5:5:5:20 | [summary param] 0 in ymlStepGenerated | test.cpp:5:5:5:20 | [summary] to write: ReturnValue in ymlStepGenerated | provenance | MaD:26956 |
-| test.cpp:6:5:6:27 | [summary param] 0 in ymlStepManual_with_body | test.cpp:6:5:6:27 | [summary] to write: ReturnValue in ymlStepManual_with_body | provenance | MaD:26957 |
+| asio_streams.cpp:100:64:100:71 | *send_str | asio_streams.cpp:100:44:100:62 | call to buffer | provenance | MaD:23 |
+| test.cpp:4:5:4:17 | [summary param] 0 in ymlStepManual | test.cpp:4:5:4:17 | [summary] to write: ReturnValue in ymlStepManual | provenance | MaD:21 |
+| test.cpp:5:5:5:20 | [summary param] 0 in ymlStepGenerated | test.cpp:5:5:5:20 | [summary] to write: ReturnValue in ymlStepGenerated | provenance | MaD:20 |
+| test.cpp:6:5:6:27 | [summary param] 0 in ymlStepManual_with_body | test.cpp:6:5:6:27 | [summary] to write: ReturnValue in ymlStepManual_with_body | provenance | MaD:22 |
 | test.cpp:7:47:7:52 | value2 | test.cpp:7:64:7:69 | value2 | provenance |  |
 | test.cpp:7:64:7:69 | value2 | test.cpp:7:5:7:30 | *ymlStepGenerated_with_body | provenance |  |
-| test.cpp:10:10:10:18 | call to ymlSource | test.cpp:10:10:10:18 | call to ymlSource | provenance | Src:MaD:26953  |
-| test.cpp:10:10:10:18 | call to ymlSource | test.cpp:14:10:14:10 | x | provenance | Sink:MaD:26954 |
+| test.cpp:10:10:10:18 | call to ymlSource | test.cpp:10:10:10:18 | call to ymlSource | provenance | Src:MaD:16  |
+| test.cpp:10:10:10:18 | call to ymlSource | test.cpp:14:10:14:10 | x | provenance | Sink:MaD:1 |
 | test.cpp:10:10:10:18 | call to ymlSource | test.cpp:17:24:17:24 | x | provenance |  |
 | test.cpp:10:10:10:18 | call to ymlSource | test.cpp:21:27:21:27 | x | provenance |  |
 | test.cpp:10:10:10:18 | call to ymlSource | test.cpp:25:35:25:35 | x | provenance |  |
 | test.cpp:10:10:10:18 | call to ymlSource | test.cpp:32:41:32:41 | x | provenance |  |
 | test.cpp:17:10:17:22 | call to ymlStepManual | test.cpp:17:10:17:22 | call to ymlStepManual | provenance |  |
-| test.cpp:17:10:17:22 | call to ymlStepManual | test.cpp:18:10:18:10 | y | provenance | Sink:MaD:26954 |
+| test.cpp:17:10:17:22 | call to ymlStepManual | test.cpp:18:10:18:10 | y | provenance | Sink:MaD:1 |
 | test.cpp:17:24:17:24 | x | test.cpp:4:5:4:17 | [summary param] 0 in ymlStepManual | provenance |  |
-| test.cpp:17:24:17:24 | x | test.cpp:17:10:17:22 | call to ymlStepManual | provenance | MaD:26955 |
+| test.cpp:17:24:17:24 | x | test.cpp:17:10:17:22 | call to ymlStepManual | provenance | MaD:21 |
 | test.cpp:21:10:21:25 | call to ymlStepGenerated | test.cpp:21:10:21:25 | call to ymlStepGenerated | provenance |  |
-| test.cpp:21:10:21:25 | call to ymlStepGenerated | test.cpp:22:10:22:10 | z | provenance | Sink:MaD:26954 |
+| test.cpp:21:10:21:25 | call to ymlStepGenerated | test.cpp:22:10:22:10 | z | provenance | Sink:MaD:1 |
 | test.cpp:21:27:21:27 | x | test.cpp:5:5:5:20 | [summary param] 0 in ymlStepGenerated | provenance |  |
-| test.cpp:21:27:21:27 | x | test.cpp:21:10:21:25 | call to ymlStepGenerated | provenance | MaD:26956 |
+| test.cpp:21:27:21:27 | x | test.cpp:21:10:21:25 | call to ymlStepGenerated | provenance | MaD:20 |
 | test.cpp:25:11:25:33 | call to ymlStepManual_with_body | test.cpp:25:11:25:33 | call to ymlStepManual_with_body | provenance |  |
-| test.cpp:25:11:25:33 | call to ymlStepManual_with_body | test.cpp:26:10:26:11 | y2 | provenance | Sink:MaD:26954 |
+| test.cpp:25:11:25:33 | call to ymlStepManual_with_body | test.cpp:26:10:26:11 | y2 | provenance | Sink:MaD:1 |
 | test.cpp:25:35:25:35 | x | test.cpp:6:5:6:27 | [summary param] 0 in ymlStepManual_with_body | provenance |  |
-| test.cpp:25:35:25:35 | x | test.cpp:25:11:25:33 | call to ymlStepManual_with_body | provenance | MaD:26957 |
+| test.cpp:25:35:25:35 | x | test.cpp:25:11:25:33 | call to ymlStepManual_with_body | provenance | MaD:22 |
 | test.cpp:32:11:32:36 | call to ymlStepGenerated_with_body | test.cpp:32:11:32:36 | call to ymlStepGenerated_with_body | provenance |  |
-| test.cpp:32:11:32:36 | call to ymlStepGenerated_with_body | test.cpp:33:10:33:11 | z2 | provenance | Sink:MaD:26954 |
+| test.cpp:32:11:32:36 | call to ymlStepGenerated_with_body | test.cpp:33:10:33:11 | z2 | provenance | Sink:MaD:1 |
 | test.cpp:32:41:32:41 | x | test.cpp:7:47:7:52 | value2 | provenance |  |
 | test.cpp:32:41:32:41 | x | test.cpp:32:11:32:36 | call to ymlStepGenerated_with_body | provenance |  |
-| windows.cpp:17:8:17:25 | [summary param] *0 in CommandLineToArgvA | windows.cpp:17:8:17:25 | [summary] to write: ReturnValue[**] in CommandLineToArgvA | provenance | MaD:341 |
-| windows.cpp:22:15:22:29 | *call to GetCommandLineA | windows.cpp:22:15:22:29 | *call to GetCommandLineA | provenance | Src:MaD:325  |
+| windows.cpp:17:8:17:25 | [summary param] *0 in CommandLineToArgvA | windows.cpp:17:8:17:25 | [summary] to write: ReturnValue[**] in CommandLineToArgvA | provenance | MaD:18 |
+| windows.cpp:22:15:22:29 | *call to GetCommandLineA | windows.cpp:22:15:22:29 | *call to GetCommandLineA | provenance | Src:MaD:3  |
 | windows.cpp:22:15:22:29 | *call to GetCommandLineA | windows.cpp:24:8:24:11 | * ... | provenance |  |
 | windows.cpp:22:15:22:29 | *call to GetCommandLineA | windows.cpp:27:36:27:38 | *cmd | provenance |  |
 | windows.cpp:27:17:27:34 | **call to CommandLineToArgvA | windows.cpp:27:17:27:34 | **call to CommandLineToArgvA | provenance |  |
 | windows.cpp:27:17:27:34 | **call to CommandLineToArgvA | windows.cpp:30:8:30:15 | * ... | provenance |  |
 | windows.cpp:27:36:27:38 | *cmd | windows.cpp:17:8:17:25 | [summary param] *0 in CommandLineToArgvA | provenance |  |
-| windows.cpp:27:36:27:38 | *cmd | windows.cpp:27:17:27:34 | **call to CommandLineToArgvA | provenance | MaD:341 |
-| windows.cpp:34:17:34:38 | *call to GetEnvironmentStringsA | windows.cpp:34:17:34:38 | *call to GetEnvironmentStringsA | provenance | Src:MaD:327  |
+| windows.cpp:27:36:27:38 | *cmd | windows.cpp:27:17:27:34 | **call to CommandLineToArgvA | provenance | MaD:18 |
+| windows.cpp:34:17:34:38 | *call to GetEnvironmentStringsA | windows.cpp:34:17:34:38 | *call to GetEnvironmentStringsA | provenance | Src:MaD:4  |
 | windows.cpp:34:17:34:38 | *call to GetEnvironmentStringsA | windows.cpp:36:10:36:13 | * ... | provenance |  |
-| windows.cpp:39:36:39:38 | GetEnvironmentVariableA output argument | windows.cpp:41:10:41:13 | * ... | provenance | Src:MaD:329  |
+| windows.cpp:39:36:39:38 | GetEnvironmentVariableA output argument | windows.cpp:41:10:41:13 | * ... | provenance | Src:MaD:5  |
 | windows.cpp:90:6:90:15 | [summary param] *3 in ReadFileEx [*hEvent] | windows.cpp:90:6:90:15 | [summary] read: Argument[*3].Field[*hEvent] in ReadFileEx | provenance |  |
 | windows.cpp:90:6:90:15 | [summary param] *3 in ReadFileEx [hEvent] | windows.cpp:90:6:90:15 | [summary] read: Argument[*3].Field[hEvent] in ReadFileEx | provenance |  |
-| windows.cpp:90:6:90:15 | [summary] read: Argument[*3].Field[*hEvent] in ReadFileEx | windows.cpp:90:6:90:15 | [summary] to write: Argument[4].Parameter[*2].Field[*hEvent] in ReadFileEx | provenance | MaD:343 |
-| windows.cpp:90:6:90:15 | [summary] read: Argument[*3].Field[hEvent] in ReadFileEx | windows.cpp:90:6:90:15 | [summary] to write: Argument[4].Parameter[*2].Field[hEvent] in ReadFileEx | provenance | MaD:343 |
+| windows.cpp:90:6:90:15 | [summary] read: Argument[*3].Field[*hEvent] in ReadFileEx | windows.cpp:90:6:90:15 | [summary] to write: Argument[4].Parameter[*2].Field[*hEvent] in ReadFileEx | provenance | MaD:19 |
+| windows.cpp:90:6:90:15 | [summary] read: Argument[*3].Field[hEvent] in ReadFileEx | windows.cpp:90:6:90:15 | [summary] to write: Argument[4].Parameter[*2].Field[hEvent] in ReadFileEx | provenance | MaD:19 |
 | windows.cpp:90:6:90:15 | [summary] to write: Argument[4].Parameter[*2] in ReadFileEx [*hEvent] | windows.cpp:147:16:147:27 | *lpOverlapped [*hEvent] | provenance |  |
 | windows.cpp:90:6:90:15 | [summary] to write: Argument[4].Parameter[*2] in ReadFileEx [hEvent] | windows.cpp:157:16:157:27 | *lpOverlapped [hEvent] | provenance |  |
 | windows.cpp:90:6:90:15 | [summary] to write: Argument[4].Parameter[*2].Field[*hEvent] in ReadFileEx | windows.cpp:90:6:90:15 | [summary] to write: Argument[4].Parameter[*2] in ReadFileEx [*hEvent] | provenance |  |
@@ -67,36 +90,36 @@ edges
 | windows.cpp:159:12:159:55 | hEvent | windows.cpp:160:8:160:8 | c | provenance |  |
 | windows.cpp:159:35:159:46 | *lpOverlapped [hEvent] | windows.cpp:159:12:159:55 | hEvent | provenance |  |
 | windows.cpp:159:35:159:46 | *lpOverlapped [hEvent] | windows.cpp:159:12:159:55 | hEvent | provenance |  |
-| windows.cpp:168:35:168:40 | ReadFile output argument | windows.cpp:170:10:170:16 | * ... | provenance | Src:MaD:331  |
-| windows.cpp:177:23:177:28 | ReadFileEx output argument | windows.cpp:179:10:179:16 | * ... | provenance | Src:MaD:332  |
-| windows.cpp:189:21:189:26 | ReadFile output argument | windows.cpp:190:5:190:56 | *... = ... | provenance | Src:MaD:331  |
+| windows.cpp:168:35:168:40 | ReadFile output argument | windows.cpp:170:10:170:16 | * ... | provenance | Src:MaD:14  |
+| windows.cpp:177:23:177:28 | ReadFileEx output argument | windows.cpp:179:10:179:16 | * ... | provenance | Src:MaD:15  |
+| windows.cpp:189:21:189:26 | ReadFile output argument | windows.cpp:190:5:190:56 | *... = ... | provenance | Src:MaD:14  |
 | windows.cpp:190:5:190:14 | *overlapped [post update] [*hEvent] | windows.cpp:192:53:192:63 | *& ... [*hEvent] | provenance |  |
 | windows.cpp:190:5:190:56 | *... = ... | windows.cpp:190:5:190:14 | *overlapped [post update] [*hEvent] | provenance |  |
 | windows.cpp:192:53:192:63 | *& ... [*hEvent] | windows.cpp:90:6:90:15 | [summary param] *3 in ReadFileEx [*hEvent] | provenance |  |
-| windows.cpp:198:21:198:26 | ReadFile output argument | windows.cpp:199:5:199:57 | ... = ... | provenance | Src:MaD:331  |
+| windows.cpp:198:21:198:26 | ReadFile output argument | windows.cpp:199:5:199:57 | ... = ... | provenance | Src:MaD:14  |
 | windows.cpp:199:5:199:14 | *overlapped [post update] [hEvent] | windows.cpp:201:53:201:63 | *& ... [hEvent] | provenance |  |
 | windows.cpp:199:5:199:57 | ... = ... | windows.cpp:199:5:199:14 | *overlapped [post update] [hEvent] | provenance |  |
 | windows.cpp:201:53:201:63 | *& ... [hEvent] | windows.cpp:90:6:90:15 | [summary param] *3 in ReadFileEx [hEvent] | provenance |  |
-| windows.cpp:209:84:209:89 | NtReadFile output argument | windows.cpp:211:10:211:16 | * ... | provenance | Src:MaD:340  |
-| windows.cpp:286:23:286:35 | *call to MapViewOfFile | windows.cpp:286:23:286:35 | *call to MapViewOfFile | provenance | Src:MaD:333  |
+| windows.cpp:209:84:209:89 | NtReadFile output argument | windows.cpp:211:10:211:16 | * ... | provenance | Src:MaD:13  |
+| windows.cpp:286:23:286:35 | *call to MapViewOfFile | windows.cpp:286:23:286:35 | *call to MapViewOfFile | provenance | Src:MaD:9  |
 | windows.cpp:286:23:286:35 | *call to MapViewOfFile | windows.cpp:287:20:287:52 | *pMapView | provenance |  |
 | windows.cpp:287:20:287:52 | *pMapView | windows.cpp:289:10:289:16 | * ... | provenance |  |
-| windows.cpp:293:23:293:36 | *call to MapViewOfFile2 | windows.cpp:293:23:293:36 | *call to MapViewOfFile2 | provenance | Src:MaD:334  |
+| windows.cpp:293:23:293:36 | *call to MapViewOfFile2 | windows.cpp:293:23:293:36 | *call to MapViewOfFile2 | provenance | Src:MaD:6  |
 | windows.cpp:293:23:293:36 | *call to MapViewOfFile2 | windows.cpp:294:20:294:52 | *pMapView | provenance |  |
 | windows.cpp:294:20:294:52 | *pMapView | windows.cpp:296:10:296:16 | * ... | provenance |  |
-| windows.cpp:302:23:302:36 | *call to MapViewOfFile3 | windows.cpp:302:23:302:36 | *call to MapViewOfFile3 | provenance | Src:MaD:335  |
+| windows.cpp:302:23:302:36 | *call to MapViewOfFile3 | windows.cpp:302:23:302:36 | *call to MapViewOfFile3 | provenance | Src:MaD:7  |
 | windows.cpp:302:23:302:36 | *call to MapViewOfFile3 | windows.cpp:303:20:303:52 | *pMapView | provenance |  |
 | windows.cpp:303:20:303:52 | *pMapView | windows.cpp:305:10:305:16 | * ... | provenance |  |
-| windows.cpp:311:23:311:43 | *call to MapViewOfFile3FromApp | windows.cpp:311:23:311:43 | *call to MapViewOfFile3FromApp | provenance | Src:MaD:336  |
+| windows.cpp:311:23:311:43 | *call to MapViewOfFile3FromApp | windows.cpp:311:23:311:43 | *call to MapViewOfFile3FromApp | provenance | Src:MaD:8  |
 | windows.cpp:311:23:311:43 | *call to MapViewOfFile3FromApp | windows.cpp:312:20:312:52 | *pMapView | provenance |  |
 | windows.cpp:312:20:312:52 | *pMapView | windows.cpp:314:10:314:16 | * ... | provenance |  |
-| windows.cpp:318:23:318:37 | *call to MapViewOfFileEx | windows.cpp:318:23:318:37 | *call to MapViewOfFileEx | provenance | Src:MaD:337  |
+| windows.cpp:318:23:318:37 | *call to MapViewOfFileEx | windows.cpp:318:23:318:37 | *call to MapViewOfFileEx | provenance | Src:MaD:10  |
 | windows.cpp:318:23:318:37 | *call to MapViewOfFileEx | windows.cpp:319:20:319:52 | *pMapView | provenance |  |
 | windows.cpp:319:20:319:52 | *pMapView | windows.cpp:321:10:321:16 | * ... | provenance |  |
-| windows.cpp:325:23:325:42 | *call to MapViewOfFileFromApp | windows.cpp:325:23:325:42 | *call to MapViewOfFileFromApp | provenance | Src:MaD:338  |
+| windows.cpp:325:23:325:42 | *call to MapViewOfFileFromApp | windows.cpp:325:23:325:42 | *call to MapViewOfFileFromApp | provenance | Src:MaD:11  |
 | windows.cpp:325:23:325:42 | *call to MapViewOfFileFromApp | windows.cpp:326:20:326:52 | *pMapView | provenance |  |
 | windows.cpp:326:20:326:52 | *pMapView | windows.cpp:328:10:328:16 | * ... | provenance |  |
-| windows.cpp:332:23:332:40 | *call to MapViewOfFileNuma2 | windows.cpp:332:23:332:40 | *call to MapViewOfFileNuma2 | provenance | Src:MaD:339  |
+| windows.cpp:332:23:332:40 | *call to MapViewOfFileNuma2 | windows.cpp:332:23:332:40 | *call to MapViewOfFileNuma2 | provenance | Src:MaD:12  |
 | windows.cpp:332:23:332:40 | *call to MapViewOfFileNuma2 | windows.cpp:333:20:333:52 | *pMapView | provenance |  |
 | windows.cpp:333:20:333:52 | *pMapView | windows.cpp:335:10:335:16 | * ... | provenance |  |
 nodes
@@ -222,3 +245,4 @@ subpaths
 | test.cpp:25:35:25:35 | x | test.cpp:6:5:6:27 | [summary param] 0 in ymlStepManual_with_body | test.cpp:6:5:6:27 | [summary] to write: ReturnValue in ymlStepManual_with_body | test.cpp:25:11:25:33 | call to ymlStepManual_with_body |
 | test.cpp:32:41:32:41 | x | test.cpp:7:47:7:52 | value2 | test.cpp:7:5:7:30 | *ymlStepGenerated_with_body | test.cpp:32:11:32:36 | call to ymlStepGenerated_with_body |
 | windows.cpp:27:36:27:38 | *cmd | windows.cpp:17:8:17:25 | [summary param] *0 in CommandLineToArgvA | windows.cpp:17:8:17:25 | [summary] to write: ReturnValue[**] in CommandLineToArgvA | windows.cpp:27:17:27:34 | **call to CommandLineToArgvA |
+testFailures

cpp/ql/test/library-tests/dataflow/external-models/flow.ql

@@ -1,7 +1,7 @@
 import utils.test.dataflow.FlowTestCommon
 import cpp
 import semmle.code.cpp.security.FlowSources
-import IRTest::IRFlow::PathGraph
+import codeql.dataflow.test.ProvenancePathGraph
 
 module IRTest {
   private import semmle.code.cpp.ir.IR
@@ -33,3 +33,4 @@ module IRTest {
 }
 
 import MakeTest<IRFlowTest<IRTest::IRFlow>>
+import ShowProvenance<interpretModelForTest/2, IRTest::IRFlow::PathNode, IRTest::IRFlow::PathGraph>

cpp/ql/test/library-tests/templates/instantiation_directive/functions.expected

@@ -1,3 +1,5 @@
 | file://:0:0:0:0 | operator= | file://:0:0:0:0 | __va_list_tag && |
 | file://:0:0:0:0 | operator= | file://:0:0:0:0 | const __va_list_tag & |
+| test.cpp:2:6:2:6 | foo | file://:0:0:0:0 | float |
+| test.cpp:2:6:2:6 | foo | file://:0:0:0:0 | int |
 | test.cpp:2:6:2:8 | foo | test.cpp:1:19:1:19 | T |

cpp/ql/test/library-tests/templates/isfromtemplateinstantiation/instantiations.expected

@@ -10,3 +10,4 @@
 | isfromtemplateinstantiation.cpp:134:29:134:33 | Outer<int> | ClassTemplateInstantiation | file://:0:0:0:0 | int |
 | isfromtemplateinstantiation.cpp:135:31:135:35 | Inner<long> | ClassTemplateInstantiation | file://:0:0:0:0 | long |
 | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> | ClassTemplateInstantiation | load.cpp:3:7:3:24 | std_istream_mockup |
+| load.cpp:22:10:22:10 | load | FunctionTemplateInstantiation | file://:0:0:0:0 | short |

cpp/ql/test/library-tests/templates/isfromtemplateinstantiation/isfromtemplateinstantiation.expected

@@ -104,6 +104,15 @@
 | isfromtemplateinstantiation.cpp:99:1:99:1 | return ... | isfromtemplateinstantiation.cpp:77:26:77:45 | AnotherTemplateClass<int> |
 | isfromtemplateinstantiation.cpp:99:1:99:1 | return ... | isfromtemplateinstantiation.cpp:97:52:97:52 | AnotherTemplateClass<int>::myMethod2(MyClassEnum) |
 | isfromtemplateinstantiation.cpp:110:3:110:3 | definition of var_template | isfromtemplateinstantiation.cpp:110:3:110:3 | var_template |
+| isfromtemplateinstantiation.cpp:129:6:129:6 | AnotherTemplateClass<long *>::f() | isfromtemplateinstantiation.cpp:128:7:128:30 | AnotherTemplateClass<long *> |
+| isfromtemplateinstantiation.cpp:129:6:129:6 | definition of f | isfromtemplateinstantiation.cpp:128:7:128:30 | AnotherTemplateClass<long *> |
+| isfromtemplateinstantiation.cpp:129:6:129:6 | definition of f | isfromtemplateinstantiation.cpp:129:6:129:6 | AnotherTemplateClass<long *>::f() |
+| isfromtemplateinstantiation.cpp:129:10:129:22 | { ... } | isfromtemplateinstantiation.cpp:128:7:128:30 | AnotherTemplateClass<long *> |
+| isfromtemplateinstantiation.cpp:129:10:129:22 | { ... } | isfromtemplateinstantiation.cpp:129:6:129:6 | AnotherTemplateClass<long *>::f() |
+| isfromtemplateinstantiation.cpp:129:12:129:20 | return ... | isfromtemplateinstantiation.cpp:128:7:128:30 | AnotherTemplateClass<long *> |
+| isfromtemplateinstantiation.cpp:129:12:129:20 | return ... | isfromtemplateinstantiation.cpp:129:6:129:6 | AnotherTemplateClass<long *>::f() |
+| isfromtemplateinstantiation.cpp:129:19:129:19 | 1 | isfromtemplateinstantiation.cpp:128:7:128:30 | AnotherTemplateClass<long *> |
+| isfromtemplateinstantiation.cpp:129:19:129:19 | 1 | isfromtemplateinstantiation.cpp:129:6:129:6 | AnotherTemplateClass<long *>::f() |
 | isfromtemplateinstantiation.cpp:135:31:135:35 | Inner<U> | isfromtemplateinstantiation.cpp:134:29:134:33 | Outer<int> |
 | isfromtemplateinstantiation.cpp:135:31:135:35 | declaration of Inner<U> | isfromtemplateinstantiation.cpp:134:29:134:33 | Outer<int> |
 | isfromtemplateinstantiation.cpp:136:7:136:7 | definition of x | isfromtemplateinstantiation.cpp:135:31:135:35 | Inner<long> |
@@ -112,7 +121,94 @@
 | isfromtemplateinstantiation.cpp:137:7:137:7 | y | isfromtemplateinstantiation.cpp:135:31:135:35 | Inner<long> |
 | load.cpp:15:14:15:15 | definition of is | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
 | load.cpp:15:14:15:15 | is | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:18:5:18:5 | basic_text_iprimitive<std_istream_mockup>::basic_text_iprimitive(std_istream_mockup &) | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:18:5:18:5 | definition of basic_text_iprimitive | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:18:5:18:5 | definition of basic_text_iprimitive | load.cpp:18:5:18:5 | basic_text_iprimitive<std_istream_mockup>::basic_text_iprimitive(std_istream_mockup &) |
+| load.cpp:18:36:18:42 | definition of isParam | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:18:36:18:42 | definition of isParam | load.cpp:18:5:18:5 | basic_text_iprimitive<std_istream_mockup>::basic_text_iprimitive(std_istream_mockup &) |
+| load.cpp:18:36:18:42 | std_istream_mockup & isParam | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:18:36:18:42 | std_istream_mockup & isParam | load.cpp:18:5:18:5 | basic_text_iprimitive<std_istream_mockup>::basic_text_iprimitive(std_istream_mockup &) |
+| load.cpp:19:11:19:21 | constructor init of field is | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:19:11:19:21 | constructor init of field is | load.cpp:18:5:18:5 | basic_text_iprimitive<std_istream_mockup>::basic_text_iprimitive(std_istream_mockup &) |
+| load.cpp:19:14:19:20 | (reference dereference) | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:19:14:19:20 | (reference dereference) | load.cpp:18:5:18:5 | basic_text_iprimitive<std_istream_mockup>::basic_text_iprimitive(std_istream_mockup &) |
+| load.cpp:19:14:19:20 | (reference to) | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:19:14:19:20 | (reference to) | load.cpp:18:5:18:5 | basic_text_iprimitive<std_istream_mockup>::basic_text_iprimitive(std_istream_mockup &) |
+| load.cpp:19:14:19:20 | isParam | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:19:14:19:20 | isParam | load.cpp:18:5:18:5 | basic_text_iprimitive<std_istream_mockup>::basic_text_iprimitive(std_istream_mockup &) |
+| load.cpp:19:23:19:24 | { ... } | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:19:23:19:24 | { ... } | load.cpp:18:5:18:5 | basic_text_iprimitive<std_istream_mockup>::basic_text_iprimitive(std_istream_mockup &) |
+| load.cpp:19:24:19:24 | return ... | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:19:24:19:24 | return ... | load.cpp:18:5:18:5 | basic_text_iprimitive<std_istream_mockup>::basic_text_iprimitive(std_istream_mockup &) |
+| load.cpp:22:10:22:10 | basic_text_iprimitive<std_istream_mockup>::load<short>(short &) | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:22:10:22:10 | definition of load | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:22:10:22:10 | definition of load | load.cpp:22:10:22:10 | basic_text_iprimitive<std_istream_mockup>::load<short>(short &) |
 | load.cpp:22:10:22:13 | basic_text_iprimitive<std_istream_mockup>::load<T>(T &) | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
 | load.cpp:22:10:22:13 | declaration of load | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
 | load.cpp:22:19:22:19 | T & t | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
 | load.cpp:22:19:22:19 | declaration of t | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:22:19:22:19 | definition of t | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:22:19:22:19 | definition of t | load.cpp:22:10:22:10 | basic_text_iprimitive<std_istream_mockup>::load<short>(short &) |
+| load.cpp:22:19:22:19 | short & t | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:22:19:22:19 | short & t | load.cpp:22:10:22:10 | basic_text_iprimitive<std_istream_mockup>::load<short>(short &) |
+| load.cpp:23:5:25:5 | { ... } | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:23:5:25:5 | { ... } | load.cpp:22:10:22:10 | basic_text_iprimitive<std_istream_mockup>::load<short>(short &) |
+| load.cpp:24:9:24:10 | (reference dereference) | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:24:9:24:10 | (reference dereference) | load.cpp:22:10:22:10 | basic_text_iprimitive<std_istream_mockup>::load<short>(short &) |
+| load.cpp:24:9:24:10 | is | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:24:9:24:10 | is | load.cpp:22:10:22:10 | basic_text_iprimitive<std_istream_mockup>::load<short>(short &) |
+| load.cpp:24:9:24:10 | this | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:24:9:24:10 | this | load.cpp:22:10:22:10 | basic_text_iprimitive<std_istream_mockup>::load<short>(short &) |
+| load.cpp:24:9:24:16 | ExprStmt | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:24:9:24:16 | ExprStmt | load.cpp:22:10:22:10 | basic_text_iprimitive<std_istream_mockup>::load<short>(short &) |
+| load.cpp:24:12:24:12 | call to operator>> | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:24:12:24:12 | call to operator>> | load.cpp:22:10:22:10 | basic_text_iprimitive<std_istream_mockup>::load<short>(short &) |
+| load.cpp:24:12:24:16 | (reference dereference) | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:24:12:24:16 | (reference dereference) | load.cpp:22:10:22:10 | basic_text_iprimitive<std_istream_mockup>::load<short>(short &) |
+| load.cpp:24:15:24:15 | (reference dereference) | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:24:15:24:15 | (reference dereference) | load.cpp:22:10:22:10 | basic_text_iprimitive<std_istream_mockup>::load<short>(short &) |
+| load.cpp:24:15:24:15 | (reference to) | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:24:15:24:15 | (reference to) | load.cpp:22:10:22:10 | basic_text_iprimitive<std_istream_mockup>::load<short>(short &) |
+| load.cpp:24:15:24:15 | t | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:24:15:24:15 | t | load.cpp:22:10:22:10 | basic_text_iprimitive<std_istream_mockup>::load<short>(short &) |
+| load.cpp:25:5:25:5 | return ... | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:25:5:25:5 | return ... | load.cpp:22:10:22:10 | basic_text_iprimitive<std_istream_mockup>::load<short>(short &) |
+| load.cpp:27:10:27:10 | basic_text_iprimitive<std_istream_mockup>::load(char &) | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:27:10:27:10 | definition of load | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:27:10:27:10 | definition of load | load.cpp:27:10:27:10 | basic_text_iprimitive<std_istream_mockup>::load(char &) |
+| load.cpp:27:22:27:22 | char & t | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:27:22:27:22 | char & t | load.cpp:27:10:27:10 | basic_text_iprimitive<std_istream_mockup>::load(char &) |
+| load.cpp:27:22:27:22 | definition of t | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:27:22:27:22 | definition of t | load.cpp:27:10:27:10 | basic_text_iprimitive<std_istream_mockup>::load(char &) |
+| load.cpp:28:5:32:5 | { ... } | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:28:5:32:5 | { ... } | load.cpp:27:10:27:10 | basic_text_iprimitive<std_istream_mockup>::load(char &) |
+| load.cpp:29:9:29:20 | declaration | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:29:9:29:20 | declaration | load.cpp:27:10:27:10 | basic_text_iprimitive<std_istream_mockup>::load(char &) |
+| load.cpp:29:19:29:19 | definition of i | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:29:19:29:19 | definition of i | load.cpp:27:10:27:10 | basic_text_iprimitive<std_istream_mockup>::load(char &) |
+| load.cpp:29:19:29:19 | i | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:29:19:29:19 | i | load.cpp:27:10:27:10 | basic_text_iprimitive<std_istream_mockup>::load(char &) |
+| load.cpp:30:9:30:12 | call to load | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:30:9:30:12 | call to load | load.cpp:27:10:27:10 | basic_text_iprimitive<std_istream_mockup>::load(char &) |
+| load.cpp:30:9:30:12 | this | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:30:9:30:12 | this | load.cpp:27:10:27:10 | basic_text_iprimitive<std_istream_mockup>::load(char &) |
+| load.cpp:30:9:30:16 | ExprStmt | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:30:9:30:16 | ExprStmt | load.cpp:27:10:27:10 | basic_text_iprimitive<std_istream_mockup>::load(char &) |
+| load.cpp:30:14:30:14 | (reference to) | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:30:14:30:14 | (reference to) | load.cpp:27:10:27:10 | basic_text_iprimitive<std_istream_mockup>::load(char &) |
+| load.cpp:30:14:30:14 | i | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:30:14:30:14 | i | load.cpp:27:10:27:10 | basic_text_iprimitive<std_istream_mockup>::load(char &) |
+| load.cpp:31:9:31:9 | (reference dereference) | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:31:9:31:9 | (reference dereference) | load.cpp:27:10:27:10 | basic_text_iprimitive<std_istream_mockup>::load(char &) |
+| load.cpp:31:9:31:9 | t | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:31:9:31:9 | t | load.cpp:27:10:27:10 | basic_text_iprimitive<std_istream_mockup>::load(char &) |
+| load.cpp:31:9:31:13 | ... = ... | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:31:9:31:13 | ... = ... | load.cpp:27:10:27:10 | basic_text_iprimitive<std_istream_mockup>::load(char &) |
+| load.cpp:31:9:31:14 | ExprStmt | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:31:9:31:14 | ExprStmt | load.cpp:27:10:27:10 | basic_text_iprimitive<std_istream_mockup>::load(char &) |
+| load.cpp:31:13:31:13 | (char)... | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:31:13:31:13 | (char)... | load.cpp:27:10:27:10 | basic_text_iprimitive<std_istream_mockup>::load(char &) |
+| load.cpp:31:13:31:13 | i | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:31:13:31:13 | i | load.cpp:27:10:27:10 | basic_text_iprimitive<std_istream_mockup>::load(char &) |
+| load.cpp:32:5:32:5 | return ... | load.cpp:13:7:13:27 | basic_text_iprimitive<std_istream_mockup> |
+| load.cpp:32:5:32:5 | return ... | load.cpp:27:10:27:10 | basic_text_iprimitive<std_istream_mockup>::load(char &) |

cpp/ql/test/library-tests/templates/isfromtemplateinstantiation/isfromuninstantiatedtemplate.expected

@@ -425,7 +425,16 @@ isFromUninstantiatedTemplate
 | isfromtemplateinstantiation.cpp:123:6:123:6 | f |  |  | Declaration |  |
 | isfromtemplateinstantiation.cpp:128:7:128:30 | AnotherTemplateClass<T *> |  | T | Declaration |  |
 | isfromtemplateinstantiation.cpp:128:7:128:30 | AnotherTemplateClass<long *> | I |  | Declaration |  |
+| isfromtemplateinstantiation.cpp:129:6:129:6 | definition of f |  | T | Definition |  |
+| isfromtemplateinstantiation.cpp:129:6:129:6 | definition of f | I |  | Definition |  |
 | isfromtemplateinstantiation.cpp:129:6:129:6 | f |  | T | Declaration |  |
+| isfromtemplateinstantiation.cpp:129:6:129:6 | f | I |  | Declaration |  |
+| isfromtemplateinstantiation.cpp:129:10:129:22 | { ... } |  | T | Stmt |  |
+| isfromtemplateinstantiation.cpp:129:10:129:22 | { ... } | I |  | Stmt |  |
+| isfromtemplateinstantiation.cpp:129:12:129:20 | return ... |  | T | Stmt |  |
+| isfromtemplateinstantiation.cpp:129:12:129:20 | return ... | I |  | Stmt |  |
+| isfromtemplateinstantiation.cpp:129:19:129:19 | 1 |  | T | Expr |  |
+| isfromtemplateinstantiation.cpp:129:19:129:19 | 1 | I |  | Expr |  |
 | isfromtemplateinstantiation.cpp:134:29:134:33 | Outer<T> |  | T | Declaration |  |
 | isfromtemplateinstantiation.cpp:134:29:134:33 | Outer<int> | I |  | Declaration |  |
 | isfromtemplateinstantiation.cpp:135:31:135:35 | Inner<U> |  | T | Declaration |  |
@@ -461,21 +470,82 @@ isFromUninstantiatedTemplate
 | load.cpp:15:14:15:15 | definition of is | I |  | Definition |  |
 | load.cpp:15:14:15:15 | is |  | T | Declaration |  |
 | load.cpp:15:14:15:15 | is | I |  | Declaration |  |
+| load.cpp:18:5:18:5 | basic_text_iprimitive | I |  | Declaration |  |
 | load.cpp:18:5:18:25 | basic_text_iprimitive |  | T | Declaration |  |
+| load.cpp:18:36:18:42 | definition of isParam |  | T | Definition |  |
+| load.cpp:18:36:18:42 | definition of isParam | I |  | Definition |  |
+| load.cpp:18:36:18:42 | isParam |  | T | Declaration |  |
+| load.cpp:18:36:18:42 | isParam | I |  | Declaration |  |
+| load.cpp:19:11:19:21 | constructor init of field is |  | T | Expr |  |
+| load.cpp:19:11:19:21 | constructor init of field is | I |  | Expr |  |
 | load.cpp:19:14:19:20 | (reference dereference) |  | T | Expr |  |
+| load.cpp:19:14:19:20 | (reference dereference) | I |  | Expr |  |
 | load.cpp:19:14:19:20 | (reference to) |  | T | Expr |  |
+| load.cpp:19:14:19:20 | (reference to) | I |  | Expr |  |
 | load.cpp:19:14:19:20 | isParam |  | T | Expr | Ref |
+| load.cpp:19:14:19:20 | isParam | I |  | Expr | Ref |
+| load.cpp:19:23:19:24 | { ... } |  | T | Stmt |  |
+| load.cpp:19:23:19:24 | { ... } | I |  | Stmt |  |
+| load.cpp:19:24:19:24 | return ... |  | T | Stmt |  |
+| load.cpp:19:24:19:24 | return ... | I |  | Stmt |  |
+| load.cpp:22:10:22:10 | load | I |  | Declaration |  |
 | load.cpp:22:10:22:13 | load |  | T | Declaration |  |
 | load.cpp:22:10:22:13 | load | I | T | Declaration |  |
+| load.cpp:22:19:22:19 | definition of t |  | T | Definition |  |
+| load.cpp:22:19:22:19 | definition of t | I |  | Definition |  |
 | load.cpp:22:19:22:19 | t |  | T | Declaration |  |
+| load.cpp:22:19:22:19 | t | I |  | Declaration |  |
 | load.cpp:22:19:22:19 | t | I | T | Declaration |  |
+| load.cpp:23:5:25:5 | { ... } |  | T | Stmt |  |
+| load.cpp:23:5:25:5 | { ... } | I |  | Stmt |  |
 | load.cpp:24:9:24:10 | (reference dereference) |  | T | Expr |  |
+| load.cpp:24:9:24:10 | (reference dereference) | I |  | Expr |  |
 | load.cpp:24:9:24:10 | is |  | T | Expr | Not ref |
+| load.cpp:24:9:24:10 | is | I |  | Expr | Not ref |
 | load.cpp:24:9:24:10 | this |  | T | Expr |  |
+| load.cpp:24:9:24:10 | this | I |  | Expr |  |
+| load.cpp:24:9:24:16 | ExprStmt |  | T | Stmt |  |
+| load.cpp:24:9:24:16 | ExprStmt | I |  | Stmt |  |
 | load.cpp:24:15:24:15 | (reference dereference) |  | T | Expr |  |
+| load.cpp:24:15:24:15 | (reference dereference) | I |  | Expr |  |
+| load.cpp:24:15:24:15 | (reference to) | I |  | Expr |  |
 | load.cpp:24:15:24:15 | t |  | T | Expr | Not ref |
+| load.cpp:24:15:24:15 | t | I |  | Expr | Ref |
+| load.cpp:25:5:25:5 | return ... |  | T | Stmt |  |
+| load.cpp:25:5:25:5 | return ... | I |  | Stmt |  |
+| load.cpp:27:10:27:10 | load | I |  | Declaration |  |
 | load.cpp:27:10:27:13 | load |  | T | Declaration |  |
+| load.cpp:27:22:27:22 | definition of t |  | T | Definition |  |
+| load.cpp:27:22:27:22 | definition of t | I |  | Definition |  |
+| load.cpp:27:22:27:22 | t |  | T | Declaration |  |
+| load.cpp:27:22:27:22 | t | I |  | Declaration |  |
+| load.cpp:28:5:32:5 | { ... } |  | T | Stmt |  |
+| load.cpp:28:5:32:5 | { ... } | I |  | Stmt |  |
+| load.cpp:29:9:29:20 | declaration |  | T | Stmt |  |
+| load.cpp:29:9:29:20 | declaration | I |  | Stmt |  |
+| load.cpp:29:19:29:19 | definition of i |  | T | Definition |  |
+| load.cpp:29:19:29:19 | definition of i | I |  | Definition |  |
+| load.cpp:29:19:29:19 | i |  | T | Declaration |  |
+| load.cpp:29:19:29:19 | i | I |  | Declaration |  |
+| load.cpp:30:9:30:12 | Unknown literal |  | T | Expr |  |
+| load.cpp:30:9:30:12 | call to load | I |  | Expr |  |
+| load.cpp:30:9:30:12 | this | I |  | Expr |  |
+| load.cpp:30:9:30:16 | ExprStmt |  | T | Stmt |  |
+| load.cpp:30:9:30:16 | ExprStmt | I |  | Stmt |  |
+| load.cpp:30:14:30:14 | (reference to) | I |  | Expr |  |
+| load.cpp:30:14:30:14 | i |  | T | Expr | Not ref |
+| load.cpp:30:14:30:14 | i | I |  | Expr | Ref |
 | load.cpp:31:9:31:9 | (reference dereference) |  | T | Expr |  |
+| load.cpp:31:9:31:9 | (reference dereference) | I |  | Expr |  |
 | load.cpp:31:9:31:9 | t |  | T | Expr | Not ref |
+| load.cpp:31:9:31:9 | t | I |  | Expr | Not ref |
+| load.cpp:31:9:31:13 | ... = ... |  | T | Expr |  |
+| load.cpp:31:9:31:13 | ... = ... | I |  | Expr |  |
+| load.cpp:31:9:31:14 | ExprStmt |  | T | Stmt |  |
+| load.cpp:31:9:31:14 | ExprStmt | I |  | Stmt |  |
 | load.cpp:31:13:31:13 | (char)... |  | T | Expr |  |
+| load.cpp:31:13:31:13 | (char)... | I |  | Expr |  |
 | load.cpp:31:13:31:13 | i |  | T | Expr | Not ref |
+| load.cpp:31:13:31:13 | i | I |  | Expr | Not ref |
+| load.cpp:32:5:32:5 | return ... |  | T | Stmt |  |
+| load.cpp:32:5:32:5 | return ... | I |  | Stmt |  |

cpp/ql/test/library-tests/templates/switch/test.expected

@@ -1 +1,2 @@
 | test.cpp:13:3:20:3 | switch (...) ...  | 3 |
+| test.cpp:13:3:20:3 | switch (...) ...  | 3 |

cpp/ql/test/library-tests/templates/type_instantiations/types.expected

@@ -5,10 +5,13 @@
 | file://:0:0:0:0 | _Complex _Float64 |
 | file://:0:0:0:0 | _Complex _Float64x |
 | file://:0:0:0:0 | _Complex _Float128 |
+| file://:0:0:0:0 | _Complex __bf16 |
 | file://:0:0:0:0 | _Complex __float128 |
+| file://:0:0:0:0 | _Complex __fp16 |
 | file://:0:0:0:0 | _Complex double |
 | file://:0:0:0:0 | _Complex float |
 | file://:0:0:0:0 | _Complex long double |
+| file://:0:0:0:0 | _Complex std::float16_t |
 | file://:0:0:0:0 | _Decimal32 |
 | file://:0:0:0:0 | _Decimal64 |
 | file://:0:0:0:0 | _Decimal128 |

cpp/ql/test/library-tests/type_sizes/type_sizes.expected

@@ -25,10 +25,13 @@
 | file://:0:0:0:0 | _Complex _Float64 | 16 |
 | file://:0:0:0:0 | _Complex _Float64x | 32 |
 | file://:0:0:0:0 | _Complex _Float128 | 32 |
+| file://:0:0:0:0 | _Complex __bf16 | 4 |
 | file://:0:0:0:0 | _Complex __float128 | 32 |
+| file://:0:0:0:0 | _Complex __fp16 | 4 |
 | file://:0:0:0:0 | _Complex double | 16 |
 | file://:0:0:0:0 | _Complex float | 8 |
 | file://:0:0:0:0 | _Complex long double | 32 |
+| file://:0:0:0:0 | _Complex std::float16_t | 4 |
 | file://:0:0:0:0 | _Decimal32 | 4 |
 | file://:0:0:0:0 | _Decimal64 | 8 |
 | file://:0:0:0:0 | _Decimal128 | 16 |

cpp/ql/test/library-tests/unspecified_type/types/unspecified_type.expected

@@ -7,10 +7,13 @@
 | file://:0:0:0:0 | _Complex _Float64 | _Complex _Float64 |
 | file://:0:0:0:0 | _Complex _Float64x | _Complex _Float64x |
 | file://:0:0:0:0 | _Complex _Float128 | _Complex _Float128 |
+| file://:0:0:0:0 | _Complex __bf16 | _Complex __bf16 |
 | file://:0:0:0:0 | _Complex __float128 | _Complex __float128 |
+| file://:0:0:0:0 | _Complex __fp16 | _Complex __fp16 |
 | file://:0:0:0:0 | _Complex double | _Complex double |
 | file://:0:0:0:0 | _Complex float | _Complex float |
 | file://:0:0:0:0 | _Complex long double | _Complex long double |
+| file://:0:0:0:0 | _Complex std::float16_t | _Complex std::float16_t |
 | file://:0:0:0:0 | _Decimal32 | _Decimal32 |
 | file://:0:0:0:0 | _Decimal64 | _Decimal64 |
 | file://:0:0:0:0 | _Decimal128 | _Decimal128 |

cpp/ql/test/library-tests/variables/variables/types.expected

@@ -6,10 +6,13 @@
 | _Complex _Float64 | BinaryFloatingPointType, ComplexNumberType |  |  |  |  |
 | _Complex _Float64x | BinaryFloatingPointType, ComplexNumberType |  |  |  |  |
 | _Complex _Float128 | BinaryFloatingPointType, ComplexNumberType |  |  |  |  |
+| _Complex __bf16 | BinaryFloatingPointType, ComplexNumberType |  |  |  |  |
 | _Complex __float128 | BinaryFloatingPointType, ComplexNumberType |  |  |  |  |
+| _Complex __fp16 | BinaryFloatingPointType, ComplexNumberType |  |  |  |  |
 | _Complex double | BinaryFloatingPointType, ComplexNumberType |  |  |  |  |
 | _Complex float | BinaryFloatingPointType, ComplexNumberType |  |  |  |  |
 | _Complex long double | BinaryFloatingPointType, ComplexNumberType |  |  |  |  |
+| _Complex std::float16_t | BinaryFloatingPointType, ComplexNumberType |  |  |  |  |
 | _Decimal32 | Decimal32Type |  |  |  |  |
 | _Decimal64 | Decimal64Type |  |  |  |  |
 | _Decimal128 | Decimal128Type |  |  |  |  |

cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/SqlTainted.expected

@@ -1,3 +1,11 @@
+#select
+| test.c:21:18:21:23 | query1 | test.c:14:27:14:30 | **argv | test.c:21:18:21:23 | *query1 | This argument to a SQL query function is derived from $@ and then passed to mysql_query(sqlArg). | test.c:14:27:14:30 | **argv | user input (a command-line argument) |
+| test.c:51:18:51:23 | query1 | test.c:14:27:14:30 | **argv | test.c:51:18:51:23 | *query1 | This argument to a SQL query function is derived from $@ and then passed to mysql_query(sqlArg). | test.c:14:27:14:30 | **argv | user input (a command-line argument) |
+| test.c:76:17:76:25 | userInput | test.c:75:8:75:16 | gets output argument | test.c:76:17:76:25 | *userInput | This argument to a SQL query function is derived from $@ and then passed to SQLPrepare(StatementText). | test.c:75:8:75:16 | gets output argument | user input (string read by gets) |
+| test.c:77:20:77:28 | userInput | test.c:75:8:75:16 | gets output argument | test.c:77:20:77:28 | *userInput | This argument to a SQL query function is derived from $@ and then passed to SQLExecDirect(StatementText). | test.c:75:8:75:16 | gets output argument | user input (string read by gets) |
+| test.c:106:24:106:29 | query1 | test.c:101:8:101:16 | gets output argument | test.c:106:24:106:29 | *query1 | This argument to a SQL query function is derived from $@. | test.c:101:8:101:16 | gets output argument | user input (string read by gets) |
+| test.c:107:28:107:33 | query1 | test.c:101:8:101:16 | gets output argument | test.c:107:28:107:33 | *query1 | This argument to a SQL query function is derived from $@. | test.c:101:8:101:16 | gets output argument | user input (string read by gets) |
+| test.cpp:43:27:43:33 | access to array | test.cpp:39:27:39:30 | **argv | test.cpp:43:27:43:33 | *access to array | This argument to a SQL query function is derived from $@ and then passed to pqxx::work::exec1((unnamed parameter 0)). | test.cpp:39:27:39:30 | **argv | user input (a command-line argument) |
 edges
 | test.c:14:27:14:30 | **argv | test.c:15:20:15:26 | *access to array | provenance |  |
 | test.c:15:20:15:26 | *access to array | test.c:21:18:21:23 | *query1 | provenance | TaintFunction |
@@ -9,7 +17,12 @@ edges
 | test.c:48:20:48:33 | *globalUsername | test.c:51:18:51:23 | *query1 | provenance | TaintFunction |
 | test.c:75:8:75:16 | gets output argument | test.c:76:17:76:25 | *userInput | provenance |  |
 | test.c:75:8:75:16 | gets output argument | test.c:77:20:77:28 | *userInput | provenance |  |
+| test.c:101:8:101:16 | gets output argument | test.c:106:24:106:29 | *query1 | provenance | TaintFunction Sink:MaD:2 |
+| test.c:101:8:101:16 | gets output argument | test.c:107:28:107:33 | *query1 | provenance | TaintFunction Sink:MaD:1 |
 | test.cpp:39:27:39:30 | **argv | test.cpp:43:27:43:33 | *access to array | provenance |  |
+models
+| 1 | Sink: ; ; false; OCIStmtPrepare2; ; ; Argument[*3]; sql-injection; manual |
+| 2 | Sink: ; ; false; OCIStmtPrepare; ; ; Argument[*2]; sql-injection; manual |
 nodes
 | test.c:14:27:14:30 | **argv | semmle.label | **argv |
 | test.c:15:20:15:26 | *access to array | semmle.label | *access to array |
@@ -23,12 +36,9 @@ nodes
 | test.c:75:8:75:16 | gets output argument | semmle.label | gets output argument |
 | test.c:76:17:76:25 | *userInput | semmle.label | *userInput |
 | test.c:77:20:77:28 | *userInput | semmle.label | *userInput |
+| test.c:101:8:101:16 | gets output argument | semmle.label | gets output argument |
+| test.c:106:24:106:29 | *query1 | semmle.label | *query1 |
+| test.c:107:28:107:33 | *query1 | semmle.label | *query1 |
 | test.cpp:39:27:39:30 | **argv | semmle.label | **argv |
 | test.cpp:43:27:43:33 | *access to array | semmle.label | *access to array |
 subpaths
-#select
-| test.c:21:18:21:23 | query1 | test.c:14:27:14:30 | **argv | test.c:21:18:21:23 | *query1 | This argument to a SQL query function is derived from $@ and then passed to mysql_query(sqlArg). | test.c:14:27:14:30 | **argv | user input (a command-line argument) |
-| test.c:51:18:51:23 | query1 | test.c:14:27:14:30 | **argv | test.c:51:18:51:23 | *query1 | This argument to a SQL query function is derived from $@ and then passed to mysql_query(sqlArg). | test.c:14:27:14:30 | **argv | user input (a command-line argument) |
-| test.c:76:17:76:25 | userInput | test.c:75:8:75:16 | gets output argument | test.c:76:17:76:25 | *userInput | This argument to a SQL query function is derived from $@ and then passed to SQLPrepare(StatementText). | test.c:75:8:75:16 | gets output argument | user input (string read by gets) |
-| test.c:77:20:77:28 | userInput | test.c:75:8:75:16 | gets output argument | test.c:77:20:77:28 | *userInput | This argument to a SQL query function is derived from $@ and then passed to SQLExecDirect(StatementText). | test.c:75:8:75:16 | gets output argument | user input (string read by gets) |
-| test.cpp:43:27:43:33 | access to array | test.cpp:39:27:39:30 | **argv | test.cpp:43:27:43:33 | *access to array | This argument to a SQL query function is derived from $@ and then passed to pqxx::work::exec1((unnamed parameter 0)). | test.cpp:39:27:39:30 | **argv | user input (a command-line argument) |

cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/SqlTainted.qlref

@@ -1 +1,5 @@
-Security/CWE/CWE-089/SqlTainted.ql
+query: Security/CWE/CWE-089/SqlTainted.ql
+postprocess:
+ - utils/test/PrettyPrintModels.ql
+ - utils/test/InlineExpectationsTestQuery.ql
+ 

cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/test.c

@@ -11,14 +11,14 @@ int atoi(const char *nptr);
 void exit(int i);
 ///// Test code /////
 
-int main(int argc, char** argv) {
+int main(int argc, char** argv) { // $ Source
   char *userName = argv[2];
   int userNumber = atoi(argv[3]);
 
   // a string from the user is injected directly into an SQL query.
   char query1[1000] = {0};
   snprintf(query1, 1000, "SELECT UID FROM USERS where name = \"%s\"", userName);
-  mysql_query(0, query1); // BAD
+  mysql_query(0, query1); // $ Alert
   
   // the user string is encoded by a library routine.
   char userNameSanitized[1000] = {0};
@@ -48,7 +48,7 @@ void badFunc() {
   char *userName = globalUsername;
   char query1[1000] = {0};
   snprintf(query1, 1000, "SELECT UID FROM USERS where name = \"%s\"", userName);
-  mysql_query(0, query1); // BAD
+  mysql_query(0, query1); // $ Alert
 }
 
 //ODBC Library Rountines
@@ -72,7 +72,44 @@ SQLRETURN SQLPrepare(
 
 void ODBCTests(){
   char userInput[100];
-  gets(userInput);
-  SQLPrepare(0, userInput, 100); // BAD
-  SQLExecDirect(0, userInput, 100); // BAD
+  gets(userInput); // $ Source
+  SQLPrepare(0, userInput, 100); // $ Alert
+  SQLExecDirect(0, userInput, 100); // $ Alert
+}
+
+// Oracle Call Interface (OCI) Routines
+int OCIStmtPrepare(
+      void *arg0,
+      void *arg1,
+      const unsigned char *sql,
+      unsigned int arg3,
+      unsigned int arg4,
+      unsigned int arg5);
+int OCIStmtPrepare2(
+      void *arg0,
+      void **arg1,
+      void *arg2,
+      const unsigned char *sql,
+      unsigned int arg4,
+      const unsigned char *arg5,
+      unsigned int arg6,
+      unsigned int arg7,
+      unsigned int arg8);
+
+void OCITests(){
+  char userInput[100];
+  gets(userInput); // $ Source
+
+  // a string from the user is injected directly into an SQL query.
+  char query1[1000] = {0};
+  snprintf(query1, 1000, "SELECT UID FROM USERS where name = \"%s\"", userInput);
+  OCIStmtPrepare(0, 0, query1, 0, 0, 0); // $ Alert
+  OCIStmtPrepare2(0, 0, 0, query1, 0, 0, 0, 0, 0); // $ Alert
+
+  // an integer from the user is injected into an SQL query.
+  int userNumber = atoi(userInput);
+  char query2[1000] = {0};
+  snprintf(query2, 1000, "SELECT UID FROM USERS where number = \"%i\"", userNumber);
+  OCIStmtPrepare(0, 0, query2, 0, 0, 0); // GOOD
+  OCIStmtPrepare2(0, 0, 0, query2, 0, 0, 0, 0, 0); // GOOD
 }

cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/test.cpp

@@ -36,11 +36,11 @@ namespace pqxx {
     };
 }
 
-int main(int argc, char** argv) {
+int main(int argc, char** argv) { // $ Source
     pqxx::connection c;
     pqxx::work w(c);
     
-    pqxx::row r = w.exec1(argv[1]); // BAD
+    pqxx::row r = w.exec1(argv[1]); // $ Alert
     
     pqxx::result r2 = w.exec(w.quote(argv[1])); // GOOD
 

csharp/ql/campaigns/Solorigate/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-all
-version: 1.7.43
+version: 1.7.44-dev
 groups:
   - csharp
   - solorigate

csharp/ql/campaigns/Solorigate/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-queries
-version: 1.7.43
+version: 1.7.44-dev
 groups:
   - csharp
   - solorigate

csharp/ql/lib/ext/Microsoft.Data.SqlClient.model.yml

@@ -0,0 +1,20 @@
+extensions:
+  - addsTo:
+      pack: codeql/csharp-all
+      extensible: sinkModel
+    data:
+      - ["Microsoft.Data.SqlClient", "SqlCommand", False, "SqlCommand", "(System.String)", "", "Argument[0]", "sql-injection", "manual"]
+      - ["Microsoft.Data.SqlClient", "SqlCommand", False, "SqlCommand", "(System.String,Microsoft.Data.SqlClient.SqlConnection)", "", "Argument[0]", "sql-injection", "manual"]
+      - ["Microsoft.Data.SqlClient", "SqlCommand", False, "SqlCommand", "(System.String,Microsoft.Data.SqlClient.SqlConnection,Microsoft.Data.SqlClient.SqlTransaction)", "", "Argument[0]", "sql-injection", "manual"]
+      - ["Microsoft.Data.SqlClient", "SqlCommand", False, "SqlCommand", "(System.String,Microsoft.Data.SqlClient.SqlConnection,Microsoft.Data.SqlClient.SqlTransaction,Microsoft.Data.SqlClient.SqlCommandColumnEncryptionSetting)", "", "Argument[0]", "sql-injection", "manual"]
+      - ["Microsoft.Data.SqlClient", "SqlDataAdapter", False, "SqlDataAdapter", "(Microsoft.Data.SqlClient.SqlCommand)", "", "Argument[0]", "sql-injection", "manual"]
+      - ["Microsoft.Data.SqlClient", "SqlDataAdapter", False, "SqlDataAdapter", "(System.String,Microsoft.Data.SqlClient.SqlConnection)", "", "Argument[0]", "sql-injection", "manual"]
+      - ["Microsoft.Data.SqlClient", "SqlDataAdapter", False, "SqlDataAdapter", "(System.String,System.String)", "", "Argument[0]", "sql-injection", "manual"]
+  - addsTo:
+      pack: codeql/csharp-all
+      extensible: summaryModel
+    data:
+      - ["Microsoft.Data.SqlClient", "SqlCommand", False, "SqlCommand", "(System.String)", "", "Argument[0]", "Argument[this]", "taint", "manual"]
+      - ["Microsoft.Data.SqlClient", "SqlCommand", False, "SqlCommand", "(System.String,Microsoft.Data.SqlClient.SqlConnection)", "", "Argument[0]", "Argument[this]", "taint", "manual"]
+      - ["Microsoft.Data.SqlClient", "SqlCommand", False, "SqlCommand", "(System.String,Microsoft.Data.SqlClient.SqlConnection,Microsoft.Data.SqlClient.SqlTransaction)", "", "Argument[0]", "Argument[this]", "taint", "manual"]
+      - ["Microsoft.Data.SqlClient", "SqlCommand", False, "SqlCommand", "(System.String,Microsoft.Data.SqlClient.SqlConnection,Microsoft.Data.SqlClient.SqlTransaction,Microsoft.Data.SqlClient.SqlCommandColumnEncryptionSetting)", "", "Argument[0]", "Argument[this]", "taint", "manual"]

csharp/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-all
-version: 5.1.9
+version: 5.1.10-dev
 groups: csharp
 dbscheme: semmlecode.csharp.dbscheme
 extractor: csharp

csharp/ql/lib/semmle/code/csharp/dataflow/Bound.qll

@@ -1,6 +1,8 @@
 /**
  * Provides classes for representing abstract bounds for use in, for example, range analysis.
  */
+overlay[local?]
+module;
 
 private import internal.rangeanalysis.BoundSpecific
 

csharp/ql/lib/semmle/code/csharp/dataflow/ModulusAnalysis.qll

@@ -3,6 +3,8 @@
  * an expression, `b` is a `Bound` (typically zero or the value of an SSA
  * variable), and `v` is an integer in the range `[0 .. m-1]`.
  */
+overlay[local?]
+module;
 
 private import internal.rangeanalysis.ModulusAnalysisSpecific::Private
 private import Bound

csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/Sign.qll

@@ -1,3 +1,6 @@
+overlay[local?]
+module;
+
 newtype TSign =
   TNeg() or
   TZero() or

csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/SignAnalysisCommon.qll

@@ -5,6 +5,8 @@
  * The analysis is implemented as an abstract interpretation over the
  * three-valued domain `{negative, zero, positive}`.
  */
+overlay[local?]
+module;
 
 private import SignAnalysisSpecific::Private
 private import SsaReadPositionCommon

csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/SsaReadPositionCommon.qll

@@ -1,6 +1,8 @@
 /**
  * Provides classes for representing a position at which an SSA variable is read.
  */
+overlay[local?]
+module;
 
 private import SsaReadPositionSpecific
 import SsaReadPositionSpecific::Public

csharp/ql/lib/semmle/code/csharp/frameworks/Sql.qll

@@ -35,6 +35,7 @@ class IDbCommandConstructionSqlExpr extends SqlExpr, ObjectCreation {
       ic.getParameter(0).getType() instanceof StringType and
       not exists(Type t | t = ic.getDeclaringType() |
         // Known sealed classes:
+        t.hasFullyQualifiedName("Microsoft.Data.SqlClient", "SqlCommand") or
         t.hasFullyQualifiedName("System.Data.SqlClient", "SqlCommand") or
         t.hasFullyQualifiedName("System.Data.Odbc", "OdbcCommand") or
         t.hasFullyQualifiedName("System.Data.OleDb", "OleDbCommand") or

csharp/ql/src/change-notes/2025-06-25-sqlcommand-models.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added explicit SQL injection Models as Data models for `Microsoft.Data.SqlClient.SqlCommand` and `Microsoft.Data.SqlClient.SqlDataAdapter`. This reduces false negatives for the query `cs/sql-injection`.

csharp/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-queries
-version: 1.3.0
+version: 1.3.1-dev
 groups:
   - csharp
   - queries

csharp/ql/test/query-tests/Security Features/CWE-089-2/SqlInjection.cs

@@ -0,0 +1,33 @@
+using System;
+using Microsoft.Data;
+using Microsoft.Data.SqlClient;
+
+namespace Test
+{
+    class SqlInjection
+    {
+        string connectionString;
+        System.Windows.Forms.TextBox box1;
+
+        public void MakeSqlCommand()
+        {
+            // BAD: Text from a local textbox
+            using (var connection = new SqlConnection(connectionString))
+            {
+                var queryString = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='"
+                  + box1.Text + "' ORDER BY PRICE"; // $ Source[cs/sql-injection]
+                var cmd = new SqlCommand(queryString); // $ Alert[cs/sql-injection]
+                var adapter = new SqlDataAdapter(cmd); // $ Alert[cs/sql-injection]
+            }
+
+            // BAD: Input from the command line.
+            using (var connection = new SqlConnection(connectionString))
+            {
+                var queryString = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='"
+                  + Console.ReadLine() + "' ORDER BY PRICE"; // $ Source[cs/sql-injection]
+                var cmd = new SqlCommand(queryString); // $ Alert[cs/sql-injection]
+                var adapter = new SqlDataAdapter(cmd); // $ Alert[cs/sql-injection]
+            }
+        }
+    }
+}

csharp/ql/test/query-tests/Security Features/CWE-089-2/SqlInjection.expected

@@ -0,0 +1,39 @@
+#select
+| SqlInjection.cs:19:42:19:52 | access to local variable queryString | SqlInjection.cs:18:21:18:29 | access to property Text : String | SqlInjection.cs:19:42:19:52 | access to local variable queryString | This query depends on $@. | SqlInjection.cs:18:21:18:29 | access to property Text : String | this TextBox text |
+| SqlInjection.cs:20:50:20:52 | access to local variable cmd | SqlInjection.cs:18:21:18:29 | access to property Text : String | SqlInjection.cs:20:50:20:52 | access to local variable cmd | This query depends on $@. | SqlInjection.cs:18:21:18:29 | access to property Text : String | this TextBox text |
+| SqlInjection.cs:28:42:28:52 | access to local variable queryString | SqlInjection.cs:27:21:27:38 | call to method ReadLine : String | SqlInjection.cs:28:42:28:52 | access to local variable queryString | This query depends on $@. | SqlInjection.cs:27:21:27:38 | call to method ReadLine : String | this read from stdin |
+| SqlInjection.cs:29:50:29:52 | access to local variable cmd | SqlInjection.cs:27:21:27:38 | call to method ReadLine : String | SqlInjection.cs:29:50:29:52 | access to local variable cmd | This query depends on $@. | SqlInjection.cs:27:21:27:38 | call to method ReadLine : String | this read from stdin |
+edges
+| SqlInjection.cs:17:21:17:31 | access to local variable queryString : String | SqlInjection.cs:19:42:19:52 | access to local variable queryString | provenance | Sink:MaD:1 |
+| SqlInjection.cs:17:21:17:31 | access to local variable queryString : String | SqlInjection.cs:19:42:19:52 | access to local variable queryString : String | provenance |  |
+| SqlInjection.cs:18:21:18:29 | access to property Text : String | SqlInjection.cs:17:21:17:31 | access to local variable queryString : String | provenance |  |
+| SqlInjection.cs:19:21:19:23 | access to local variable cmd : SqlCommand | SqlInjection.cs:20:50:20:52 | access to local variable cmd | provenance | Sink:MaD:2 |
+| SqlInjection.cs:19:27:19:53 | object creation of type SqlCommand : SqlCommand | SqlInjection.cs:19:21:19:23 | access to local variable cmd : SqlCommand | provenance |  |
+| SqlInjection.cs:19:42:19:52 | access to local variable queryString : String | SqlInjection.cs:19:27:19:53 | object creation of type SqlCommand : SqlCommand | provenance | MaD:4 |
+| SqlInjection.cs:26:21:26:31 | access to local variable queryString : String | SqlInjection.cs:28:42:28:52 | access to local variable queryString | provenance | Sink:MaD:1 |
+| SqlInjection.cs:26:21:26:31 | access to local variable queryString : String | SqlInjection.cs:28:42:28:52 | access to local variable queryString : String | provenance |  |
+| SqlInjection.cs:27:21:27:38 | call to method ReadLine : String | SqlInjection.cs:26:21:26:31 | access to local variable queryString : String | provenance | Src:MaD:3  |
+| SqlInjection.cs:28:21:28:23 | access to local variable cmd : SqlCommand | SqlInjection.cs:29:50:29:52 | access to local variable cmd | provenance | Sink:MaD:2 |
+| SqlInjection.cs:28:27:28:53 | object creation of type SqlCommand : SqlCommand | SqlInjection.cs:28:21:28:23 | access to local variable cmd : SqlCommand | provenance |  |
+| SqlInjection.cs:28:42:28:52 | access to local variable queryString : String | SqlInjection.cs:28:27:28:53 | object creation of type SqlCommand : SqlCommand | provenance | MaD:4 |
+models
+| 1 | Sink: Microsoft.Data.SqlClient; SqlCommand; false; SqlCommand; (System.String); ; Argument[0]; sql-injection; manual |
+| 2 | Sink: Microsoft.Data.SqlClient; SqlDataAdapter; false; SqlDataAdapter; (Microsoft.Data.SqlClient.SqlCommand); ; Argument[0]; sql-injection; manual |
+| 3 | Source: System; Console; false; ReadLine; ; ; ReturnValue; stdin; manual |
+| 4 | Summary: Microsoft.Data.SqlClient; SqlCommand; false; SqlCommand; (System.String); ; Argument[0]; Argument[this]; taint; manual |
+nodes
+| SqlInjection.cs:17:21:17:31 | access to local variable queryString : String | semmle.label | access to local variable queryString : String |
+| SqlInjection.cs:18:21:18:29 | access to property Text : String | semmle.label | access to property Text : String |
+| SqlInjection.cs:19:21:19:23 | access to local variable cmd : SqlCommand | semmle.label | access to local variable cmd : SqlCommand |
+| SqlInjection.cs:19:27:19:53 | object creation of type SqlCommand : SqlCommand | semmle.label | object creation of type SqlCommand : SqlCommand |
+| SqlInjection.cs:19:42:19:52 | access to local variable queryString | semmle.label | access to local variable queryString |
+| SqlInjection.cs:19:42:19:52 | access to local variable queryString : String | semmle.label | access to local variable queryString : String |
+| SqlInjection.cs:20:50:20:52 | access to local variable cmd | semmle.label | access to local variable cmd |
+| SqlInjection.cs:26:21:26:31 | access to local variable queryString : String | semmle.label | access to local variable queryString : String |
+| SqlInjection.cs:27:21:27:38 | call to method ReadLine : String | semmle.label | call to method ReadLine : String |
+| SqlInjection.cs:28:21:28:23 | access to local variable cmd : SqlCommand | semmle.label | access to local variable cmd : SqlCommand |
+| SqlInjection.cs:28:27:28:53 | object creation of type SqlCommand : SqlCommand | semmle.label | object creation of type SqlCommand : SqlCommand |
+| SqlInjection.cs:28:42:28:52 | access to local variable queryString | semmle.label | access to local variable queryString |
+| SqlInjection.cs:28:42:28:52 | access to local variable queryString : String | semmle.label | access to local variable queryString : String |
+| SqlInjection.cs:29:50:29:52 | access to local variable cmd | semmle.label | access to local variable cmd |
+subpaths

csharp/ql/test/query-tests/Security Features/CWE-089-2/SqlInjection.ext.yml

@@ -0,0 +1,7 @@
+extensions:
+
+  - addsTo:
+      pack: codeql/threat-models
+      extensible: threatModelConfiguration
+    data:
+      - ["local", true, 0]

csharp/ql/test/query-tests/Security Features/CWE-089-2/SqlInjection.qlref

@@ -0,0 +1,4 @@
+query: Security Features/CWE-089/SqlInjection.ql
+postprocess:
+  - utils/test/PrettyPrintModels.ql
+  - utils/test/InlineExpectationsTestQuery.ql

csharp/ql/test/query-tests/Security Features/CWE-089-2/options

@@ -0,0 +1,4 @@
+semmle-extractor-options: /nostdlib /noconfig
+semmle-extractor-options: --load-sources-from-project:${testdir}/../../../resources/stubs/Microsoft.Data.SqlClient/6.0.2/Microsoft.Data.SqlClient.csproj
+semmle-extractor-options: ${testdir}/../../../resources/stubs/System.Windows.cs
+semmle-extractor-options: --load-sources-from-project:${testdir}/../../../resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.AspNetCore.App.csproj

csharp/ql/test/query-tests/Security Features/CWE-089/SecondOrderSqlInjection.cs

@@ -17,12 +17,12 @@ namespace Test
             {
                 connection.Open();
                 SqlCommand customerCommand = new SqlCommand("SELECT * FROM customers", connection);
-                SqlDataReader customerReader = customerCommand.ExecuteReader();
+                SqlDataReader customerReader = customerCommand.ExecuteReader(); // $ Source[cs/sql-injection]
 
                 while (customerReader.Read())
                 {
                     // BAD: Read from database, write it straight to another query
-                    SqlCommand secondCustomerCommand = new SqlCommand("SELECT * FROM customers WHERE customerName=" + customerReader.GetString(1), connection);
+                    SqlCommand secondCustomerCommand = new SqlCommand("SELECT * FROM customers WHERE customerName=" + customerReader.GetString(1), connection); // $ Alert[cs/sql-injection]
                 }
                 customerReader.Close();
             }
@@ -30,7 +30,7 @@ namespace Test
 
         public void RunSQLFromFile()
         {
-            using (FileStream fs = new FileStream("myfile.txt", FileMode.Open))
+            using (FileStream fs = new FileStream("myfile.txt", FileMode.Open)) // $ Source[cs/sql-injection]
             {
                 using (StreamReader sr = new StreamReader(fs, Encoding.UTF8))
                 {
@@ -42,7 +42,7 @@ namespace Test
                             continue;
                         using (var connection = new SQLiteConnection(""))
                         {
-                            var cmd = new SQLiteCommand(sql, connection);
+                            var cmd = new SQLiteCommand(sql, connection); // $ Alert[cs/sql-injection]
                             cmd.ExecuteScalar();
                         }
                     }

csharp/ql/test/query-tests/Security Features/CWE-089/SqlInjection.cs

@@ -35,8 +35,8 @@ namespace Test
             using (var connection = new SqlConnection(connectionString))
             {
                 var query1 = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='"
-                  + categoryTextBox.Text + "' ORDER BY PRICE";
-                var adapter = new SqlDataAdapter(query1, connection);
+                  + categoryTextBox.Text + "' ORDER BY PRICE"; // $ Source[cs/sql-injection]
+                var adapter = new SqlDataAdapter(query1, connection); // $ Alert[cs/sql-injection]
                 var result = new DataSet();
                 adapter.Fill(result);
             }
@@ -70,9 +70,9 @@ namespace Test
                 {
                     // BAD: Use EntityFramework direct Sql execution methods
                     var query1 = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='"
-                              + categoryTextBox.Text + "' ORDER BY PRICE";
-                    context.Database.ExecuteSqlCommand(query1);
-                    context.Database.SqlQuery<string>(query1);
+                              + categoryTextBox.Text + "' ORDER BY PRICE"; // $ Source[cs/sql-injection]
+                    context.Database.ExecuteSqlCommand(query1); // $ Alert[cs/sql-injection]
+                    context.Database.SqlQuery<string>(query1); // $ Alert[cs/sql-injection]
                     // GOOD: Use EntityFramework direct Sql execution methods with parameter
                     var query2 = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY="
                             + "@p0 ORDER BY PRICE";
@@ -84,8 +84,8 @@ namespace Test
             using (var connection = new SqlConnection(connectionString))
             {
                 var query1 = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='"
-                  + box1.Text + "' ORDER BY PRICE";
-                var adapter = new SqlDataAdapter(query1, connection);
+                  + box1.Text + "' ORDER BY PRICE"; // $ Source[cs/sql-injection]
+                var adapter = new SqlDataAdapter(query1, connection); // $ Alert[cs/sql-injection]
                 var result = new DataSet();
                 adapter.Fill(result);
             }
@@ -94,9 +94,9 @@ namespace Test
             using (var connection = new SqlConnection(connectionString))
             {
                 var queryString = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='"
-                  + box1.Text + "' ORDER BY PRICE";
-                var cmd = new SqlCommand(queryString);
-                var adapter = new SqlDataAdapter(cmd);
+                  + box1.Text + "' ORDER BY PRICE"; // $ Source[cs/sql-injection]
+                var cmd = new SqlCommand(queryString); // $ Alert[cs/sql-injection]
+                var adapter = new SqlDataAdapter(cmd); // $ Alert[cs/sql-injection]
                 var result = new DataSet();
                 adapter.Fill(result);
             }
@@ -105,9 +105,9 @@ namespace Test
             using (var connection = new SqlConnection(connectionString))
             {
                 var queryString = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='"
-                  + Console.ReadLine()! + "' ORDER BY PRICE";
-                var cmd = new SqlCommand(queryString);
-                var adapter = new SqlDataAdapter(cmd);
+                  + Console.ReadLine()! + "' ORDER BY PRICE"; // $ Source[cs/sql-injection]
+                var cmd = new SqlCommand(queryString); // $ Alert[cs/sql-injection]
+                var adapter = new SqlDataAdapter(cmd); // $ Alert[cs/sql-injection]
                 var result = new DataSet();
                 adapter.Fill(result);
             }
@@ -119,14 +119,14 @@ namespace Test
     public abstract class MyController : Controller
     {
         [HttpPost("{userId:string}")]
-        public async Task<IActionResult> GetUserById([FromRoute] string userId, CancellationToken cancellationToken)
+        public async Task<IActionResult> GetUserById([FromRoute] string userId, CancellationToken cancellationToken) // $ Source[cs/sql-injection]
         {
             // This is a vulnerable method due to SQL injection
             string query = "SELECT * FROM Users WHERE UserId = '" + userId + "'";
 
             using (SqlConnection connection = new SqlConnection("YourConnectionString"))
             {
-                SqlCommand command = new SqlCommand(query, connection);
+                SqlCommand command = new SqlCommand(query, connection); // $ Alert[cs/sql-injection]
                 connection.Open();
 
                 SqlDataReader reader = command.ExecuteReader();

csharp/ql/test/query-tests/Security Features/CWE-089/SqlInjection.qlref

@@ -1,2 +1,4 @@
 query: Security Features/CWE-089/SqlInjection.ql
-postprocess: utils/test/PrettyPrintModels.ql
+postprocess:
+  - utils/test/PrettyPrintModels.ql
+  - utils/test/InlineExpectationsTestQuery.ql

csharp/ql/test/query-tests/Security Features/CWE-089/SqlInjectionDapper.cs

@@ -17,8 +17,8 @@ namespace Test
         {
             using (var connection = new SqlConnection(connectionString))
             {
-                var query = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='" + box1.Text + "' ORDER BY PRICE";
-                var result = connection.Query<object>(query);
+                var query = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='" + box1.Text + "' ORDER BY PRICE"; // $ Source[cs/sql-injection]
+                var result = connection.Query<object>(query); // $ Alert[cs/sql-injection]
             }
         }
 
@@ -26,8 +26,8 @@ namespace Test
         {
             using (var connection = new SqlConnection(connectionString))
             {
-                var query = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='" + box1.Text + "' ORDER BY PRICE";
-                var result = await connection.QueryAsync<object>(query);
+                var query = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='" + box1.Text + "' ORDER BY PRICE"; // $ Source[cs/sql-injection]
+                var result = await connection.QueryAsync<object>(query); // $ Alert[cs/sql-injection]
             }
         }
 
@@ -35,8 +35,8 @@ namespace Test
         {
             using (var connection = new SqlConnection(connectionString))
             {
-                var query = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='" + box1.Text + "' ORDER BY PRICE";
-                var result = await connection.QueryFirstAsync(query);
+                var query = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='" + box1.Text + "' ORDER BY PRICE"; // $ Source[cs/sql-injection]
+                var result = await connection.QueryFirstAsync(query); // $ Alert[cs/sql-injection]
             }
         }
 
@@ -44,9 +44,9 @@ namespace Test
         {
             using (var connection = new SqlConnection(connectionString))
             {
-                var query = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='" + box1.Text + "' ORDER BY PRICE";
+                var query = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='" + box1.Text + "' ORDER BY PRICE"; // $ Source[cs/sql-injection]
 
-                await connection.ExecuteAsync(query);
+                await connection.ExecuteAsync(query); // $ Alert[cs/sql-injection]
             }
         }
 
@@ -54,8 +54,8 @@ namespace Test
         {
             using (var connection = new SqlConnection(connectionString))
             {
-                var query = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='" + box1.Text + "' ORDER BY PRICE";
-                connection.ExecuteScalar(query);
+                var query = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='" + box1.Text + "' ORDER BY PRICE"; // $ Source[cs/sql-injection]
+                connection.ExecuteScalar(query); // $ Alert[cs/sql-injection]
             }
         }
 
@@ -63,8 +63,8 @@ namespace Test
         {
             using (var connection = new SqlConnection(connectionString))
             {
-                var query = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='" + box1.Text + "' ORDER BY PRICE";
-                connection.ExecuteReader(query);
+                var query = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='" + box1.Text + "' ORDER BY PRICE"; // $ Source[cs/sql-injection]
+                connection.ExecuteReader(query); // $ Alert[cs/sql-injection]
             }
         }
 
@@ -72,9 +72,9 @@ namespace Test
         {
             using (var connection = new SqlConnection(connectionString))
             {
-                var query = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='" + box1.Text + "' ORDER BY PRICE";
+                var query = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='" + box1.Text + "' ORDER BY PRICE"; // $ Source[cs/sql-injection]
 
-                var comDef = new CommandDefinition(query);
+                var comDef = new CommandDefinition(query); // $ Alert[cs/sql-injection]
                 var result = await connection.QueryFirstAsync(comDef);
             }
         }

csharp/ql/test/query-tests/Security Features/CWE-089/SqlInjectionSqlite.cs

@@ -16,12 +16,12 @@ namespace TestSqlite
         public void InjectUntrustedData()
         {
             // BAD: untrusted data is not sanitized.
-            SQLiteCommand cmd = new SQLiteCommand(untrustedData.Text);
+            SQLiteCommand cmd = new SQLiteCommand(untrustedData.Text); // $ Alert[cs/sql-injection]
 
             // BAD: untrusted data is not sanitized.
             using (var connection = new SQLiteConnection(connectionString))
             {
-                cmd = new SQLiteCommand(untrustedData.Text, connection);
+                cmd = new SQLiteCommand(untrustedData.Text, connection); // $ Source[cs/sql-injection] Alert[cs/sql-injection]
             }
 
             SQLiteDataAdapter adapter;
@@ -30,23 +30,23 @@ namespace TestSqlite
             // BAD: untrusted data is not sanitized.
             using (var connection = new SQLiteConnection(connectionString))
             {
-                adapter = new SQLiteDataAdapter(untrustedData.Text, connection);
+                adapter = new SQLiteDataAdapter(untrustedData.Text, connection); // $ Alert[cs/sql-injection]
                 result = new DataSet();
                 adapter.Fill(result);
             }
 
             // BAD: untrusted data is not sanitized.
-            adapter = new SQLiteDataAdapter(untrustedData.Text, connectionString);
+            adapter = new SQLiteDataAdapter(untrustedData.Text, connectionString); // $ Alert[cs/sql-injection]
             result = new DataSet();
             adapter.Fill(result);
 
             // BAD: untrusted data is not sanitized.
-            adapter = new SQLiteDataAdapter(cmd);
+            adapter = new SQLiteDataAdapter(cmd); // $ Alert[cs/sql-injection]
             result = new DataSet();
             adapter.Fill(result);
 
             // BAD: untrusted data as filename is not sanitized.
-            using (FileStream fs = new FileStream(untrustedData.Text, FileMode.Open))
+            using (FileStream fs = new FileStream(untrustedData.Text, FileMode.Open)) // $ Source[cs/sql-injection]
             {
                 using (StreamReader sr = new StreamReader(fs, Encoding.UTF8))
                 {
@@ -58,7 +58,7 @@ namespace TestSqlite
                             continue;
                         using (var connection = new SQLiteConnection(""))
                         {
-                            cmd = new SQLiteCommand(sql, connection);
+                            cmd = new SQLiteCommand(sql, connection); // $ Alert[cs/sql-injection]
                             cmd.ExecuteScalar();
                         }
                     }
@@ -66,4 +66,4 @@ namespace TestSqlite
             }
         }
     }
-}
+}

csharp/ql/test/resources/stubs/Azure.Core/1.38.0/Azure.Core.csproj

@@ -0,0 +1,20 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net9.0</TargetFramework>
+    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
+    <OutputPath>bin\</OutputPath>
+    <AppendTargetFrameworkToOutputPath>false</AppendTargetFrameworkToOutputPath>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="../../Microsoft.Bcl.AsyncInterfaces/1.1.1/Microsoft.Bcl.AsyncInterfaces.csproj" />
+    <ProjectReference Include="../../System.ClientModel/1.0.0/System.ClientModel.csproj" />
+    <ProjectReference Include="../../System.Diagnostics.DiagnosticSource/6.0.1/System.Diagnostics.DiagnosticSource.csproj" />
+    <ProjectReference Include="../../System.Memory.Data/1.0.2/System.Memory.Data.csproj" />
+    <ProjectReference Include="../../System.Numerics.Vectors/4.5.0/System.Numerics.Vectors.csproj" />
+    <ProjectReference Include="../../System.Text.Encodings.Web/4.7.2/System.Text.Encodings.Web.csproj" />
+    <ProjectReference Include="../../System.Text.Json/4.7.2/System.Text.Json.csproj" />
+    <ProjectReference Include="../../System.Threading.Tasks.Extensions/4.5.4/System.Threading.Tasks.Extensions.csproj" />
+    <ProjectReference Include="../../_frameworks/Microsoft.NETCore.App/Microsoft.NETCore.App.csproj" />
+  </ItemGroup>
+</Project>

csharp/ql/test/resources/stubs/Azure.Identity/1.11.4/Azure.Identity.cs

@@ -0,0 +1,431 @@
+// This file contains auto-generated code.
+// Generated from `Azure.Identity, Version=1.11.4.0, Culture=neutral, PublicKeyToken=92742159e12e44c8`.
+namespace Azure
+{
+    namespace Identity
+    {
+        public class AuthenticationFailedException : System.Exception
+        {
+            public AuthenticationFailedException(string message) => throw null;
+            public AuthenticationFailedException(string message, System.Exception innerException) => throw null;
+            protected AuthenticationFailedException(System.Runtime.Serialization.SerializationInfo info, System.Runtime.Serialization.StreamingContext context) => throw null;
+        }
+        public class AuthenticationRecord
+        {
+            public string Authority { get => throw null; }
+            public string ClientId { get => throw null; }
+            public static Azure.Identity.AuthenticationRecord Deserialize(System.IO.Stream stream, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+            public static System.Threading.Tasks.Task<Azure.Identity.AuthenticationRecord> DeserializeAsync(System.IO.Stream stream, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+            public string HomeAccountId { get => throw null; }
+            public void Serialize(System.IO.Stream stream, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+            public System.Threading.Tasks.Task SerializeAsync(System.IO.Stream stream, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+            public string TenantId { get => throw null; }
+            public string Username { get => throw null; }
+        }
+        public class AuthenticationRequiredException : Azure.Identity.CredentialUnavailableException
+        {
+            public AuthenticationRequiredException(string message, Azure.Core.TokenRequestContext context) : base(default(string)) => throw null;
+            public AuthenticationRequiredException(string message, Azure.Core.TokenRequestContext context, System.Exception innerException) : base(default(string)) => throw null;
+            protected AuthenticationRequiredException(System.Runtime.Serialization.SerializationInfo info, System.Runtime.Serialization.StreamingContext context) : base(default(string)) => throw null;
+            public Azure.Core.TokenRequestContext TokenRequestContext { get => throw null; }
+        }
+        public class AuthorizationCodeCredential : Azure.Core.TokenCredential
+        {
+            protected AuthorizationCodeCredential() => throw null;
+            public AuthorizationCodeCredential(string tenantId, string clientId, string clientSecret, string authorizationCode) => throw null;
+            public AuthorizationCodeCredential(string tenantId, string clientId, string clientSecret, string authorizationCode, Azure.Identity.AuthorizationCodeCredentialOptions options) => throw null;
+            public AuthorizationCodeCredential(string tenantId, string clientId, string clientSecret, string authorizationCode, Azure.Identity.TokenCredentialOptions options) => throw null;
+            public override Azure.Core.AccessToken GetToken(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+            public override System.Threading.Tasks.ValueTask<Azure.Core.AccessToken> GetTokenAsync(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+        }
+        public class AuthorizationCodeCredentialOptions : Azure.Identity.TokenCredentialOptions
+        {
+            public System.Collections.Generic.IList<string> AdditionallyAllowedTenants { get => throw null; }
+            public AuthorizationCodeCredentialOptions() => throw null;
+            public bool DisableInstanceDiscovery { get => throw null; set { } }
+            public System.Uri RedirectUri { get => throw null; set { } }
+        }
+        public static class AzureAuthorityHosts
+        {
+            public static System.Uri AzureChina { get => throw null; }
+            public static System.Uri AzureGermany { get => throw null; }
+            public static System.Uri AzureGovernment { get => throw null; }
+            public static System.Uri AzurePublicCloud { get => throw null; }
+        }
+        public class AzureCliCredential : Azure.Core.TokenCredential
+        {
+            public AzureCliCredential() => throw null;
+            public AzureCliCredential(Azure.Identity.AzureCliCredentialOptions options) => throw null;
+            public override Azure.Core.AccessToken GetToken(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+            public override System.Threading.Tasks.ValueTask<Azure.Core.AccessToken> GetTokenAsync(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+        }
+        public class AzureCliCredentialOptions : Azure.Identity.TokenCredentialOptions
+        {
+            public System.Collections.Generic.IList<string> AdditionallyAllowedTenants { get => throw null; }
+            public AzureCliCredentialOptions() => throw null;
+            public System.TimeSpan? ProcessTimeout { get => throw null; set { } }
+            public string TenantId { get => throw null; set { } }
+        }
+        public class AzureDeveloperCliCredential : Azure.Core.TokenCredential
+        {
+            public AzureDeveloperCliCredential() => throw null;
+            public AzureDeveloperCliCredential(Azure.Identity.AzureDeveloperCliCredentialOptions options) => throw null;
+            public override Azure.Core.AccessToken GetToken(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+            public override System.Threading.Tasks.ValueTask<Azure.Core.AccessToken> GetTokenAsync(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+        }
+        public class AzureDeveloperCliCredentialOptions : Azure.Identity.TokenCredentialOptions
+        {
+            public System.Collections.Generic.IList<string> AdditionallyAllowedTenants { get => throw null; }
+            public AzureDeveloperCliCredentialOptions() => throw null;
+            public System.TimeSpan? ProcessTimeout { get => throw null; set { } }
+            public string TenantId { get => throw null; set { } }
+        }
+        public class AzurePowerShellCredential : Azure.Core.TokenCredential
+        {
+            public AzurePowerShellCredential() => throw null;
+            public AzurePowerShellCredential(Azure.Identity.AzurePowerShellCredentialOptions options) => throw null;
+            public override Azure.Core.AccessToken GetToken(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken) => throw null;
+            public override System.Threading.Tasks.ValueTask<Azure.Core.AccessToken> GetTokenAsync(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+        }
+        public class AzurePowerShellCredentialOptions : Azure.Identity.TokenCredentialOptions
+        {
+            public System.Collections.Generic.IList<string> AdditionallyAllowedTenants { get => throw null; }
+            public AzurePowerShellCredentialOptions() => throw null;
+            public System.TimeSpan? ProcessTimeout { get => throw null; set { } }
+            public string TenantId { get => throw null; set { } }
+        }
+        public class BrowserCustomizationOptions
+        {
+            public BrowserCustomizationOptions() => throw null;
+            public string ErrorMessage { get => throw null; set { } }
+            public string SuccessMessage { get => throw null; set { } }
+            public bool? UseEmbeddedWebView { get => throw null; set { } }
+        }
+        public class ChainedTokenCredential : Azure.Core.TokenCredential
+        {
+            public ChainedTokenCredential(params Azure.Core.TokenCredential[] sources) => throw null;
+            public override Azure.Core.AccessToken GetToken(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+            public override System.Threading.Tasks.ValueTask<Azure.Core.AccessToken> GetTokenAsync(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+        }
+        public class ClientAssertionCredential : Azure.Core.TokenCredential
+        {
+            protected ClientAssertionCredential() => throw null;
+            public ClientAssertionCredential(string tenantId, string clientId, System.Func<System.Threading.CancellationToken, System.Threading.Tasks.Task<string>> assertionCallback, Azure.Identity.ClientAssertionCredentialOptions options = default(Azure.Identity.ClientAssertionCredentialOptions)) => throw null;
+            public ClientAssertionCredential(string tenantId, string clientId, System.Func<string> assertionCallback, Azure.Identity.ClientAssertionCredentialOptions options = default(Azure.Identity.ClientAssertionCredentialOptions)) => throw null;
+            public override Azure.Core.AccessToken GetToken(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+            public override System.Threading.Tasks.ValueTask<Azure.Core.AccessToken> GetTokenAsync(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+        }
+        public class ClientAssertionCredentialOptions : Azure.Identity.TokenCredentialOptions
+        {
+            public System.Collections.Generic.IList<string> AdditionallyAllowedTenants { get => throw null; }
+            public ClientAssertionCredentialOptions() => throw null;
+            public bool DisableInstanceDiscovery { get => throw null; set { } }
+        }
+        public class ClientCertificateCredential : Azure.Core.TokenCredential
+        {
+            protected ClientCertificateCredential() => throw null;
+            public ClientCertificateCredential(string tenantId, string clientId, string clientCertificatePath) => throw null;
+            public ClientCertificateCredential(string tenantId, string clientId, string clientCertificatePath, Azure.Identity.TokenCredentialOptions options) => throw null;
+            public ClientCertificateCredential(string tenantId, string clientId, string clientCertificatePath, Azure.Identity.ClientCertificateCredentialOptions options) => throw null;
+            public ClientCertificateCredential(string tenantId, string clientId, System.Security.Cryptography.X509Certificates.X509Certificate2 clientCertificate) => throw null;
+            public ClientCertificateCredential(string tenantId, string clientId, System.Security.Cryptography.X509Certificates.X509Certificate2 clientCertificate, Azure.Identity.TokenCredentialOptions options) => throw null;
+            public ClientCertificateCredential(string tenantId, string clientId, System.Security.Cryptography.X509Certificates.X509Certificate2 clientCertificate, Azure.Identity.ClientCertificateCredentialOptions options) => throw null;
+            public override Azure.Core.AccessToken GetToken(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+            public override System.Threading.Tasks.ValueTask<Azure.Core.AccessToken> GetTokenAsync(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+        }
+        public class ClientCertificateCredentialOptions : Azure.Identity.TokenCredentialOptions
+        {
+            public System.Collections.Generic.IList<string> AdditionallyAllowedTenants { get => throw null; }
+            public ClientCertificateCredentialOptions() => throw null;
+            public bool DisableInstanceDiscovery { get => throw null; set { } }
+            public bool SendCertificateChain { get => throw null; set { } }
+            public Azure.Identity.TokenCachePersistenceOptions TokenCachePersistenceOptions { get => throw null; set { } }
+        }
+        public class ClientSecretCredential : Azure.Core.TokenCredential
+        {
+            protected ClientSecretCredential() => throw null;
+            public ClientSecretCredential(string tenantId, string clientId, string clientSecret) => throw null;
+            public ClientSecretCredential(string tenantId, string clientId, string clientSecret, Azure.Identity.ClientSecretCredentialOptions options) => throw null;
+            public ClientSecretCredential(string tenantId, string clientId, string clientSecret, Azure.Identity.TokenCredentialOptions options) => throw null;
+            public override Azure.Core.AccessToken GetToken(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+            public override System.Threading.Tasks.ValueTask<Azure.Core.AccessToken> GetTokenAsync(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+        }
+        public class ClientSecretCredentialOptions : Azure.Identity.TokenCredentialOptions
+        {
+            public System.Collections.Generic.IList<string> AdditionallyAllowedTenants { get => throw null; }
+            public ClientSecretCredentialOptions() => throw null;
+            public bool DisableInstanceDiscovery { get => throw null; set { } }
+            public Azure.Identity.TokenCachePersistenceOptions TokenCachePersistenceOptions { get => throw null; set { } }
+        }
+        public class CredentialUnavailableException : Azure.Identity.AuthenticationFailedException
+        {
+            public CredentialUnavailableException(string message) : base(default(string)) => throw null;
+            public CredentialUnavailableException(string message, System.Exception innerException) : base(default(string)) => throw null;
+            protected CredentialUnavailableException(System.Runtime.Serialization.SerializationInfo info, System.Runtime.Serialization.StreamingContext context) : base(default(string)) => throw null;
+        }
+        public class DefaultAzureCredential : Azure.Core.TokenCredential
+        {
+            public DefaultAzureCredential(bool includeInteractiveCredentials = default(bool)) => throw null;
+            public DefaultAzureCredential(Azure.Identity.DefaultAzureCredentialOptions options) => throw null;
+            public override Azure.Core.AccessToken GetToken(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+            public override System.Threading.Tasks.ValueTask<Azure.Core.AccessToken> GetTokenAsync(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+        }
+        public class DefaultAzureCredentialOptions : Azure.Identity.TokenCredentialOptions
+        {
+            public System.Collections.Generic.IList<string> AdditionallyAllowedTenants { get => throw null; }
+            public System.TimeSpan? CredentialProcessTimeout { get => throw null; set { } }
+            public DefaultAzureCredentialOptions() => throw null;
+            public bool DisableInstanceDiscovery { get => throw null; set { } }
+            public bool ExcludeAzureCliCredential { get => throw null; set { } }
+            public bool ExcludeAzureDeveloperCliCredential { get => throw null; set { } }
+            public bool ExcludeAzurePowerShellCredential { get => throw null; set { } }
+            public bool ExcludeEnvironmentCredential { get => throw null; set { } }
+            public bool ExcludeInteractiveBrowserCredential { get => throw null; set { } }
+            public bool ExcludeManagedIdentityCredential { get => throw null; set { } }
+            public bool ExcludeSharedTokenCacheCredential { get => throw null; set { } }
+            public bool ExcludeVisualStudioCodeCredential { get => throw null; set { } }
+            public bool ExcludeVisualStudioCredential { get => throw null; set { } }
+            public bool ExcludeWorkloadIdentityCredential { get => throw null; set { } }
+            public string InteractiveBrowserCredentialClientId { get => throw null; set { } }
+            public string InteractiveBrowserTenantId { get => throw null; set { } }
+            public string ManagedIdentityClientId { get => throw null; set { } }
+            public Azure.Core.ResourceIdentifier ManagedIdentityResourceId { get => throw null; set { } }
+            public string SharedTokenCacheTenantId { get => throw null; set { } }
+            public string SharedTokenCacheUsername { get => throw null; set { } }
+            public string TenantId { get => throw null; set { } }
+            public string VisualStudioCodeTenantId { get => throw null; set { } }
+            public string VisualStudioTenantId { get => throw null; set { } }
+            public string WorkloadIdentityClientId { get => throw null; set { } }
+        }
+        public class DeviceCodeCredential : Azure.Core.TokenCredential
+        {
+            public virtual Azure.Identity.AuthenticationRecord Authenticate(System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+            public virtual Azure.Identity.AuthenticationRecord Authenticate(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+            public virtual System.Threading.Tasks.Task<Azure.Identity.AuthenticationRecord> AuthenticateAsync(System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+            public virtual System.Threading.Tasks.Task<Azure.Identity.AuthenticationRecord> AuthenticateAsync(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+            public DeviceCodeCredential() => throw null;
+            public DeviceCodeCredential(Azure.Identity.DeviceCodeCredentialOptions options) => throw null;
+            public DeviceCodeCredential(System.Func<Azure.Identity.DeviceCodeInfo, System.Threading.CancellationToken, System.Threading.Tasks.Task> deviceCodeCallback, string clientId, Azure.Identity.TokenCredentialOptions options = default(Azure.Identity.TokenCredentialOptions)) => throw null;
+            public DeviceCodeCredential(System.Func<Azure.Identity.DeviceCodeInfo, System.Threading.CancellationToken, System.Threading.Tasks.Task> deviceCodeCallback, string tenantId, string clientId, Azure.Identity.TokenCredentialOptions options = default(Azure.Identity.TokenCredentialOptions)) => throw null;
+            public override Azure.Core.AccessToken GetToken(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+            public override System.Threading.Tasks.ValueTask<Azure.Core.AccessToken> GetTokenAsync(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+        }
+        public class DeviceCodeCredentialOptions : Azure.Identity.TokenCredentialOptions
+        {
+            public System.Collections.Generic.IList<string> AdditionallyAllowedTenants { get => throw null; }
+            public Azure.Identity.AuthenticationRecord AuthenticationRecord { get => throw null; set { } }
+            public string ClientId { get => throw null; set { } }
+            public DeviceCodeCredentialOptions() => throw null;
+            public System.Func<Azure.Identity.DeviceCodeInfo, System.Threading.CancellationToken, System.Threading.Tasks.Task> DeviceCodeCallback { get => throw null; set { } }
+            public bool DisableAutomaticAuthentication { get => throw null; set { } }
+            public bool DisableInstanceDiscovery { get => throw null; set { } }
+            public string TenantId { get => throw null; set { } }
+            public Azure.Identity.TokenCachePersistenceOptions TokenCachePersistenceOptions { get => throw null; set { } }
+        }
+        public struct DeviceCodeInfo
+        {
+            public string ClientId { get => throw null; }
+            public string DeviceCode { get => throw null; }
+            public System.DateTimeOffset ExpiresOn { get => throw null; }
+            public string Message { get => throw null; }
+            public System.Collections.Generic.IReadOnlyCollection<string> Scopes { get => throw null; }
+            public string UserCode { get => throw null; }
+            public System.Uri VerificationUri { get => throw null; }
+        }
+        public class EnvironmentCredential : Azure.Core.TokenCredential
+        {
+            public EnvironmentCredential() => throw null;
+            public EnvironmentCredential(Azure.Identity.TokenCredentialOptions options) => throw null;
+            public EnvironmentCredential(Azure.Identity.EnvironmentCredentialOptions options) => throw null;
+            public override Azure.Core.AccessToken GetToken(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+            public override System.Threading.Tasks.ValueTask<Azure.Core.AccessToken> GetTokenAsync(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+        }
+        public class EnvironmentCredentialOptions : Azure.Identity.TokenCredentialOptions
+        {
+            public System.Collections.Generic.IList<string> AdditionallyAllowedTenants { get => throw null; }
+            public EnvironmentCredentialOptions() => throw null;
+            public bool DisableInstanceDiscovery { get => throw null; set { } }
+        }
+        public static class IdentityModelFactory
+        {
+            public static Azure.Identity.AuthenticationRecord AuthenticationRecord(string username, string authority, string homeAccountId, string tenantId, string clientId) => throw null;
+            public static Azure.Identity.DeviceCodeInfo DeviceCodeInfo(string userCode, string deviceCode, System.Uri verificationUri, System.DateTimeOffset expiresOn, string message, string clientId, System.Collections.Generic.IReadOnlyCollection<string> scopes) => throw null;
+        }
+        public class InteractiveBrowserCredential : Azure.Core.TokenCredential
+        {
+            public virtual Azure.Identity.AuthenticationRecord Authenticate(System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+            public virtual Azure.Identity.AuthenticationRecord Authenticate(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+            public virtual System.Threading.Tasks.Task<Azure.Identity.AuthenticationRecord> AuthenticateAsync(System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+            public virtual System.Threading.Tasks.Task<Azure.Identity.AuthenticationRecord> AuthenticateAsync(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+            public InteractiveBrowserCredential() => throw null;
+            public InteractiveBrowserCredential(Azure.Identity.InteractiveBrowserCredentialOptions options) => throw null;
+            public InteractiveBrowserCredential(string clientId) => throw null;
+            public InteractiveBrowserCredential(string tenantId, string clientId, Azure.Identity.TokenCredentialOptions options = default(Azure.Identity.TokenCredentialOptions)) => throw null;
+            public override Azure.Core.AccessToken GetToken(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+            public override System.Threading.Tasks.ValueTask<Azure.Core.AccessToken> GetTokenAsync(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+        }
+        public class InteractiveBrowserCredentialOptions : Azure.Identity.TokenCredentialOptions
+        {
+            public System.Collections.Generic.IList<string> AdditionallyAllowedTenants { get => throw null; }
+            public Azure.Identity.AuthenticationRecord AuthenticationRecord { get => throw null; set { } }
+            public Azure.Identity.BrowserCustomizationOptions BrowserCustomization { get => throw null; set { } }
+            public string ClientId { get => throw null; set { } }
+            public InteractiveBrowserCredentialOptions() => throw null;
+            public bool DisableAutomaticAuthentication { get => throw null; set { } }
+            public bool DisableInstanceDiscovery { get => throw null; set { } }
+            public string LoginHint { get => throw null; set { } }
+            public System.Uri RedirectUri { get => throw null; set { } }
+            public string TenantId { get => throw null; set { } }
+            public Azure.Identity.TokenCachePersistenceOptions TokenCachePersistenceOptions { get => throw null; set { } }
+        }
+        public class ManagedIdentityCredential : Azure.Core.TokenCredential
+        {
+            protected ManagedIdentityCredential() => throw null;
+            public ManagedIdentityCredential(string clientId = default(string), Azure.Identity.TokenCredentialOptions options = default(Azure.Identity.TokenCredentialOptions)) => throw null;
+            public ManagedIdentityCredential(Azure.Core.ResourceIdentifier resourceId, Azure.Identity.TokenCredentialOptions options = default(Azure.Identity.TokenCredentialOptions)) => throw null;
+            public override Azure.Core.AccessToken GetToken(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+            public override System.Threading.Tasks.ValueTask<Azure.Core.AccessToken> GetTokenAsync(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+        }
+        public class OnBehalfOfCredential : Azure.Core.TokenCredential
+        {
+            protected OnBehalfOfCredential() => throw null;
+            public OnBehalfOfCredential(string tenantId, string clientId, System.Security.Cryptography.X509Certificates.X509Certificate2 clientCertificate, string userAssertion) => throw null;
+            public OnBehalfOfCredential(string tenantId, string clientId, System.Security.Cryptography.X509Certificates.X509Certificate2 clientCertificate, string userAssertion, Azure.Identity.OnBehalfOfCredentialOptions options) => throw null;
+            public OnBehalfOfCredential(string tenantId, string clientId, string clientSecret, string userAssertion) => throw null;
+            public OnBehalfOfCredential(string tenantId, string clientId, string clientSecret, string userAssertion, Azure.Identity.OnBehalfOfCredentialOptions options) => throw null;
+            public override Azure.Core.AccessToken GetToken(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken) => throw null;
+            public override System.Threading.Tasks.ValueTask<Azure.Core.AccessToken> GetTokenAsync(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken) => throw null;
+        }
+        public class OnBehalfOfCredentialOptions : Azure.Identity.TokenCredentialOptions
+        {
+            public System.Collections.Generic.IList<string> AdditionallyAllowedTenants { get => throw null; }
+            public OnBehalfOfCredentialOptions() => throw null;
+            public bool DisableInstanceDiscovery { get => throw null; set { } }
+            public bool SendCertificateChain { get => throw null; set { } }
+            public Azure.Identity.TokenCachePersistenceOptions TokenCachePersistenceOptions { get => throw null; set { } }
+        }
+        public class SharedTokenCacheCredential : Azure.Core.TokenCredential
+        {
+            public SharedTokenCacheCredential() => throw null;
+            public SharedTokenCacheCredential(Azure.Identity.SharedTokenCacheCredentialOptions options) => throw null;
+            public SharedTokenCacheCredential(string username, Azure.Identity.TokenCredentialOptions options = default(Azure.Identity.TokenCredentialOptions)) => throw null;
+            public override Azure.Core.AccessToken GetToken(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+            public override System.Threading.Tasks.ValueTask<Azure.Core.AccessToken> GetTokenAsync(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+        }
+        public class SharedTokenCacheCredentialOptions : Azure.Identity.TokenCredentialOptions
+        {
+            public Azure.Identity.AuthenticationRecord AuthenticationRecord { get => throw null; set { } }
+            public string ClientId { get => throw null; set { } }
+            public SharedTokenCacheCredentialOptions() => throw null;
+            public SharedTokenCacheCredentialOptions(Azure.Identity.TokenCachePersistenceOptions tokenCacheOptions) => throw null;
+            public bool DisableInstanceDiscovery { get => throw null; set { } }
+            public bool EnableGuestTenantAuthentication { get => throw null; set { } }
+            public string TenantId { get => throw null; set { } }
+            public Azure.Identity.TokenCachePersistenceOptions TokenCachePersistenceOptions { get => throw null; set { } }
+            public string Username { get => throw null; set { } }
+        }
+        public struct TokenCacheData
+        {
+            public System.ReadOnlyMemory<byte> CacheBytes { get => throw null; }
+            public TokenCacheData(System.ReadOnlyMemory<byte> cacheBytes) => throw null;
+        }
+        public class TokenCachePersistenceOptions
+        {
+            public TokenCachePersistenceOptions() => throw null;
+            public string Name { get => throw null; set { } }
+            public bool UnsafeAllowUnencryptedStorage { get => throw null; set { } }
+        }
+        public class TokenCacheRefreshArgs
+        {
+            public bool IsCaeEnabled { get => throw null; }
+            public string SuggestedCacheKey { get => throw null; }
+        }
+        public class TokenCacheUpdatedArgs
+        {
+            public bool IsCaeEnabled { get => throw null; }
+            public System.ReadOnlyMemory<byte> UnsafeCacheData { get => throw null; }
+        }
+        public class TokenCredentialDiagnosticsOptions : Azure.Core.DiagnosticsOptions
+        {
+            public TokenCredentialDiagnosticsOptions() => throw null;
+            public bool IsAccountIdentifierLoggingEnabled { get => throw null; set { } }
+        }
+        public class TokenCredentialOptions : Azure.Core.ClientOptions
+        {
+            public System.Uri AuthorityHost { get => throw null; set { } }
+            public TokenCredentialOptions() => throw null;
+            public Azure.Identity.TokenCredentialDiagnosticsOptions Diagnostics { get => throw null; }
+            public bool IsUnsafeSupportLoggingEnabled { get => throw null; set { } }
+        }
+        public abstract class UnsafeTokenCacheOptions : Azure.Identity.TokenCachePersistenceOptions
+        {
+            protected UnsafeTokenCacheOptions() => throw null;
+            protected abstract System.Threading.Tasks.Task<System.ReadOnlyMemory<byte>> RefreshCacheAsync();
+            protected virtual System.Threading.Tasks.Task<Azure.Identity.TokenCacheData> RefreshCacheAsync(Azure.Identity.TokenCacheRefreshArgs args, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+            protected abstract System.Threading.Tasks.Task TokenCacheUpdatedAsync(Azure.Identity.TokenCacheUpdatedArgs tokenCacheUpdatedArgs);
+        }
+        public class UsernamePasswordCredential : Azure.Core.TokenCredential
+        {
+            public virtual Azure.Identity.AuthenticationRecord Authenticate(System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+            public virtual Azure.Identity.AuthenticationRecord Authenticate(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+            public virtual System.Threading.Tasks.Task<Azure.Identity.AuthenticationRecord> AuthenticateAsync(System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+            public virtual System.Threading.Tasks.Task<Azure.Identity.AuthenticationRecord> AuthenticateAsync(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+            protected UsernamePasswordCredential() => throw null;
+            public UsernamePasswordCredential(string username, string password, string tenantId, string clientId) => throw null;
+            public UsernamePasswordCredential(string username, string password, string tenantId, string clientId, Azure.Identity.TokenCredentialOptions options) => throw null;
+            public UsernamePasswordCredential(string username, string password, string tenantId, string clientId, Azure.Identity.UsernamePasswordCredentialOptions options) => throw null;
+            public override Azure.Core.AccessToken GetToken(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+            public override System.Threading.Tasks.ValueTask<Azure.Core.AccessToken> GetTokenAsync(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+        }
+        public class UsernamePasswordCredentialOptions : Azure.Identity.TokenCredentialOptions
+        {
+            public System.Collections.Generic.IList<string> AdditionallyAllowedTenants { get => throw null; }
+            public UsernamePasswordCredentialOptions() => throw null;
+            public bool DisableInstanceDiscovery { get => throw null; set { } }
+            public Azure.Identity.TokenCachePersistenceOptions TokenCachePersistenceOptions { get => throw null; set { } }
+        }
+        public class VisualStudioCodeCredential : Azure.Core.TokenCredential
+        {
+            public VisualStudioCodeCredential() => throw null;
+            public VisualStudioCodeCredential(Azure.Identity.VisualStudioCodeCredentialOptions options) => throw null;
+            public override Azure.Core.AccessToken GetToken(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken) => throw null;
+            public override System.Threading.Tasks.ValueTask<Azure.Core.AccessToken> GetTokenAsync(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken) => throw null;
+        }
+        public class VisualStudioCodeCredentialOptions : Azure.Identity.TokenCredentialOptions
+        {
+            public System.Collections.Generic.IList<string> AdditionallyAllowedTenants { get => throw null; }
+            public VisualStudioCodeCredentialOptions() => throw null;
+            public string TenantId { get => throw null; set { } }
+        }
+        public class VisualStudioCredential : Azure.Core.TokenCredential
+        {
+            public VisualStudioCredential() => throw null;
+            public VisualStudioCredential(Azure.Identity.VisualStudioCredentialOptions options) => throw null;
+            public override Azure.Core.AccessToken GetToken(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken) => throw null;
+            public override System.Threading.Tasks.ValueTask<Azure.Core.AccessToken> GetTokenAsync(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken) => throw null;
+        }
+        public class VisualStudioCredentialOptions : Azure.Identity.TokenCredentialOptions
+        {
+            public System.Collections.Generic.IList<string> AdditionallyAllowedTenants { get => throw null; }
+            public VisualStudioCredentialOptions() => throw null;
+            public System.TimeSpan? ProcessTimeout { get => throw null; set { } }
+            public string TenantId { get => throw null; set { } }
+        }
+        public class WorkloadIdentityCredential : Azure.Core.TokenCredential
+        {
+            public WorkloadIdentityCredential() => throw null;
+            public WorkloadIdentityCredential(Azure.Identity.WorkloadIdentityCredentialOptions options) => throw null;
+            public override Azure.Core.AccessToken GetToken(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+            public override System.Threading.Tasks.ValueTask<Azure.Core.AccessToken> GetTokenAsync(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) => throw null;
+        }
+        public class WorkloadIdentityCredentialOptions : Azure.Identity.TokenCredentialOptions
+        {
+            public System.Collections.Generic.IList<string> AdditionallyAllowedTenants { get => throw null; }
+            public string ClientId { get => throw null; set { } }
+            public WorkloadIdentityCredentialOptions() => throw null;
+            public bool DisableInstanceDiscovery { get => throw null; set { } }
+            public string TenantId { get => throw null; set { } }
+            public string TokenFilePath { get => throw null; set { } }
+        }
+    }
+}

csharp/ql/test/resources/stubs/Azure.Identity/1.11.4/Azure.Identity.csproj

@@ -0,0 +1,19 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net9.0</TargetFramework>
+    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
+    <OutputPath>bin\</OutputPath>
+    <AppendTargetFrameworkToOutputPath>false</AppendTargetFrameworkToOutputPath>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="../../Azure.Core/1.38.0/Azure.Core.csproj" />
+    <ProjectReference Include="../../Microsoft.Identity.Client/4.61.3/Microsoft.Identity.Client.csproj" />
+    <ProjectReference Include="../../Microsoft.Identity.Client.Extensions.Msal/4.61.3/Microsoft.Identity.Client.Extensions.Msal.csproj" />
+    <ProjectReference Include="../../System.Memory/4.5.4/System.Memory.csproj" />
+    <ProjectReference Include="../../System.Security.Cryptography.ProtectedData/9.0.1/System.Security.Cryptography.ProtectedData.csproj" />
+    <ProjectReference Include="../../System.Text.Json/4.7.2/System.Text.Json.csproj" />
+    <ProjectReference Include="../../System.Threading.Tasks.Extensions/4.5.4/System.Threading.Tasks.Extensions.csproj" />
+    <ProjectReference Include="../../_frameworks/Microsoft.NETCore.App/Microsoft.NETCore.App.csproj" />
+  </ItemGroup>
+</Project>

csharp/ql/test/resources/stubs/Microsoft.Bcl.AsyncInterfaces/1.1.1/Microsoft.Bcl.AsyncInterfaces.csproj

@@ -0,0 +1,12 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net9.0</TargetFramework>
+    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
+    <OutputPath>bin\</OutputPath>
+    <AppendTargetFrameworkToOutputPath>false</AppendTargetFrameworkToOutputPath>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="../../_frameworks/Microsoft.NETCore.App/Microsoft.NETCore.App.csproj" />
+  </ItemGroup>
+</Project>

csharp/ql/test/resources/stubs/Microsoft.Bcl.Cryptography/9.0.4/Microsoft.Bcl.Cryptography.csproj

@@ -0,0 +1,12 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net9.0</TargetFramework>
+    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
+    <OutputPath>bin\</OutputPath>
+    <AppendTargetFrameworkToOutputPath>false</AppendTargetFrameworkToOutputPath>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="../../_frameworks/Microsoft.NETCore.App/Microsoft.NETCore.App.csproj" />
+  </ItemGroup>
+</Project>

csharp/ql/test/resources/stubs/Microsoft.Data.SqlClient.SNI.runtime/6.0.2/Microsoft.Data.SqlClient.SNI.runtime.csproj

@@ -0,0 +1,12 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net9.0</TargetFramework>
+    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
+    <OutputPath>bin\</OutputPath>
+    <AppendTargetFrameworkToOutputPath>false</AppendTargetFrameworkToOutputPath>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="../../_frameworks/Microsoft.NETCore.App/Microsoft.NETCore.App.csproj" />
+  </ItemGroup>
+</Project>

csharp/ql/test/resources/stubs/Microsoft.Data.SqlClient/6.0.2/Microsoft.Data.SqlClient.csproj

@@ -0,0 +1,21 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net9.0</TargetFramework>
+    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
+    <OutputPath>bin\</OutputPath>
+    <AppendTargetFrameworkToOutputPath>false</AppendTargetFrameworkToOutputPath>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="../../Azure.Identity/1.11.4/Azure.Identity.csproj" />
+    <ProjectReference Include="../../Microsoft.Bcl.Cryptography/9.0.4/Microsoft.Bcl.Cryptography.csproj" />
+    <ProjectReference Include="../../Microsoft.Data.SqlClient.SNI.runtime/6.0.2/Microsoft.Data.SqlClient.SNI.runtime.csproj" />
+    <ProjectReference Include="../../Microsoft.Extensions.Caching.Memory/9.0.4/Microsoft.Extensions.Caching.Memory.csproj" />
+    <ProjectReference Include="../../Microsoft.IdentityModel.JsonWebTokens/7.5.0/Microsoft.IdentityModel.JsonWebTokens.csproj" />
+    <ProjectReference Include="../../Microsoft.IdentityModel.Protocols.OpenIdConnect/7.5.0/Microsoft.IdentityModel.Protocols.OpenIdConnect.csproj" />
+    <ProjectReference Include="../../Microsoft.SqlServer.Server/1.0.0/Microsoft.SqlServer.Server.csproj" />
+    <ProjectReference Include="../../System.Configuration.ConfigurationManager/9.0.4/System.Configuration.ConfigurationManager.csproj" />
+    <ProjectReference Include="../../System.Security.Cryptography.Pkcs/9.0.4/System.Security.Cryptography.Pkcs.csproj" />
+    <ProjectReference Include="../../_frameworks/Microsoft.NETCore.App/Microsoft.NETCore.App.csproj" />
+  </ItemGroup>
+</Project>

csharp/ql/test/resources/stubs/Microsoft.Extensions.Caching.Abstractions/9.0.4/Microsoft.Extensions.Caching.Abstractions.csproj

@@ -0,0 +1,13 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net9.0</TargetFramework>
+    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
+    <OutputPath>bin\</OutputPath>
+    <AppendTargetFrameworkToOutputPath>false</AppendTargetFrameworkToOutputPath>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="../../Microsoft.Extensions.Primitives/9.0.4/Microsoft.Extensions.Primitives.csproj" />
+    <ProjectReference Include="../../_frameworks/Microsoft.NETCore.App/Microsoft.NETCore.App.csproj" />
+  </ItemGroup>
+</Project>

csharp/ql/test/resources/stubs/Microsoft.Extensions.Caching.Memory/9.0.4/Microsoft.Extensions.Caching.Memory.csproj

@@ -0,0 +1,17 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net9.0</TargetFramework>
+    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
+    <OutputPath>bin\</OutputPath>
+    <AppendTargetFrameworkToOutputPath>false</AppendTargetFrameworkToOutputPath>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="../../Microsoft.Extensions.Caching.Abstractions/9.0.4/Microsoft.Extensions.Caching.Abstractions.csproj" />
+    <ProjectReference Include="../../Microsoft.Extensions.DependencyInjection.Abstractions/9.0.4/Microsoft.Extensions.DependencyInjection.Abstractions.csproj" />
+    <ProjectReference Include="../../Microsoft.Extensions.Logging.Abstractions/9.0.4/Microsoft.Extensions.Logging.Abstractions.csproj" />
+    <ProjectReference Include="../../Microsoft.Extensions.Options/9.0.4/Microsoft.Extensions.Options.csproj" />
+    <ProjectReference Include="../../Microsoft.Extensions.Primitives/9.0.4/Microsoft.Extensions.Primitives.csproj" />
+    <ProjectReference Include="../../_frameworks/Microsoft.NETCore.App/Microsoft.NETCore.App.csproj" />
+  </ItemGroup>
+</Project>

csharp/ql/test/resources/stubs/Microsoft.Extensions.DependencyInjection.Abstractions/9.0.4/Microsoft.Extensions.DependencyInjection.Abstractions.csproj

@@ -0,0 +1,12 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net9.0</TargetFramework>
+    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
+    <OutputPath>bin\</OutputPath>
+    <AppendTargetFrameworkToOutputPath>false</AppendTargetFrameworkToOutputPath>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="../../_frameworks/Microsoft.NETCore.App/Microsoft.NETCore.App.csproj" />
+  </ItemGroup>
+</Project>

csharp/ql/test/resources/stubs/Microsoft.Extensions.Logging.Abstractions/9.0.4/Microsoft.Extensions.Logging.Abstractions.csproj

@@ -0,0 +1,13 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net9.0</TargetFramework>
+    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
+    <OutputPath>bin\</OutputPath>
+    <AppendTargetFrameworkToOutputPath>false</AppendTargetFrameworkToOutputPath>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="../../Microsoft.Extensions.DependencyInjection.Abstractions/9.0.4/Microsoft.Extensions.DependencyInjection.Abstractions.csproj" />
+    <ProjectReference Include="../../_frameworks/Microsoft.NETCore.App/Microsoft.NETCore.App.csproj" />
+  </ItemGroup>
+</Project>

csharp/ql/test/resources/stubs/Microsoft.Extensions.Options/9.0.4/Microsoft.Extensions.Options.csproj

@@ -0,0 +1,14 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net9.0</TargetFramework>
+    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
+    <OutputPath>bin\</OutputPath>
+    <AppendTargetFrameworkToOutputPath>false</AppendTargetFrameworkToOutputPath>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="../../Microsoft.Extensions.DependencyInjection.Abstractions/9.0.4/Microsoft.Extensions.DependencyInjection.Abstractions.csproj" />
+    <ProjectReference Include="../../Microsoft.Extensions.Primitives/9.0.4/Microsoft.Extensions.Primitives.csproj" />
+    <ProjectReference Include="../../_frameworks/Microsoft.NETCore.App/Microsoft.NETCore.App.csproj" />
+  </ItemGroup>
+</Project>

csharp/ql/test/resources/stubs/Microsoft.Extensions.Primitives/9.0.4/Microsoft.Extensions.Primitives.csproj

@@ -0,0 +1,12 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net9.0</TargetFramework>
+    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
+    <OutputPath>bin\</OutputPath>
+    <AppendTargetFrameworkToOutputPath>false</AppendTargetFrameworkToOutputPath>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="../../_frameworks/Microsoft.NETCore.App/Microsoft.NETCore.App.csproj" />
+  </ItemGroup>
+</Project>

csharp/ql/test/resources/stubs/Microsoft.Identity.Client.Extensions.Msal/4.61.3/Microsoft.Identity.Client.Extensions.Msal.cs

@@ -0,0 +1,103 @@
+// This file contains auto-generated code.
+// Generated from `Microsoft.Identity.Client.Extensions.Msal, Version=4.61.3.0, Culture=neutral, PublicKeyToken=0a613f4dd989e8ae`.
+namespace Microsoft
+{
+    namespace Identity
+    {
+        namespace Client
+        {
+            namespace Extensions
+            {
+                namespace Msal
+                {
+                    public class CacheChangedEventArgs : System.EventArgs
+                    {
+                        public readonly System.Collections.Generic.IEnumerable<string> AccountsAdded;
+                        public readonly System.Collections.Generic.IEnumerable<string> AccountsRemoved;
+                        public CacheChangedEventArgs(System.Collections.Generic.IEnumerable<string> added, System.Collections.Generic.IEnumerable<string> removed) => throw null;
+                    }
+                    public sealed class CrossPlatLock : System.IDisposable
+                    {
+                        public CrossPlatLock(string lockfilePath, int lockFileRetryDelay = default(int), int lockFileRetryCount = default(int)) => throw null;
+                        public void Dispose() => throw null;
+                    }
+                    public class MsalCacheHelper
+                    {
+                        public event System.EventHandler<Microsoft.Identity.Client.Extensions.Msal.CacheChangedEventArgs> CacheChanged;
+                        public void Clear() => throw null;
+                        public static System.Threading.Tasks.Task<Microsoft.Identity.Client.Extensions.Msal.MsalCacheHelper> CreateAsync(Microsoft.Identity.Client.Extensions.Msal.StorageCreationProperties storageCreationProperties, System.Diagnostics.TraceSource logger = default(System.Diagnostics.TraceSource)) => throw null;
+                        public const string LinuxKeyRingDefaultCollection = default;
+                        public const string LinuxKeyRingSessionCollection = default;
+                        public byte[] LoadUnencryptedTokenCache() => throw null;
+                        public void RegisterCache(Microsoft.Identity.Client.ITokenCache tokenCache) => throw null;
+                        public void SaveUnencryptedTokenCache(byte[] tokenCache) => throw null;
+                        public void UnregisterCache(Microsoft.Identity.Client.ITokenCache tokenCache) => throw null;
+                        public static string UserRootDirectory { get => throw null; }
+                        public void VerifyPersistence() => throw null;
+                    }
+                    public class MsalCachePersistenceException : System.Exception
+                    {
+                        public MsalCachePersistenceException() => throw null;
+                        public MsalCachePersistenceException(string message) => throw null;
+                        public MsalCachePersistenceException(string message, System.Exception innerException) => throw null;
+                        protected MsalCachePersistenceException(System.Runtime.Serialization.SerializationInfo info, System.Runtime.Serialization.StreamingContext context) => throw null;
+                    }
+                    public static class SharedUtilities
+                    {
+                        public static string GetUserRootDirectory() => throw null;
+                        public static bool IsLinuxPlatform() => throw null;
+                        public static bool IsMacPlatform() => throw null;
+                        public static bool IsWindowsPlatform() => throw null;
+                    }
+                    public class Storage
+                    {
+                        public void Clear(bool ignoreExceptions = default(bool)) => throw null;
+                        public static Microsoft.Identity.Client.Extensions.Msal.Storage Create(Microsoft.Identity.Client.Extensions.Msal.StorageCreationProperties creationProperties, System.Diagnostics.TraceSource logger = default(System.Diagnostics.TraceSource)) => throw null;
+                        public byte[] ReadData() => throw null;
+                        public void VerifyPersistence() => throw null;
+                        public void WriteData(byte[] data) => throw null;
+                    }
+                    public class StorageCreationProperties
+                    {
+                        public string Authority { get => throw null; }
+                        public readonly string CacheDirectory;
+                        public readonly string CacheFileName;
+                        public string CacheFilePath { get => throw null; }
+                        public string ClientId { get => throw null; }
+                        public readonly System.Collections.Generic.KeyValuePair<string, string> KeyringAttribute1;
+                        public readonly System.Collections.Generic.KeyValuePair<string, string> KeyringAttribute2;
+                        public readonly string KeyringCollection;
+                        public readonly string KeyringSchemaName;
+                        public readonly string KeyringSecretLabel;
+                        public readonly int LockRetryCount;
+                        public readonly int LockRetryDelay;
+                        public readonly string MacKeyChainAccountName;
+                        public readonly string MacKeyChainServiceName;
+                        public readonly bool UseLinuxUnencryptedFallback;
+                        public readonly bool UseUnencryptedFallback;
+                    }
+                    public class StorageCreationPropertiesBuilder
+                    {
+                        public Microsoft.Identity.Client.Extensions.Msal.StorageCreationProperties Build() => throw null;
+                        public StorageCreationPropertiesBuilder(string cacheFileName, string cacheDirectory, string clientId) => throw null;
+                        public StorageCreationPropertiesBuilder(string cacheFileName, string cacheDirectory) => throw null;
+                        public Microsoft.Identity.Client.Extensions.Msal.StorageCreationPropertiesBuilder CustomizeLockRetry(int lockRetryDelay, int lockRetryCount) => throw null;
+                        public Microsoft.Identity.Client.Extensions.Msal.StorageCreationPropertiesBuilder WithCacheChangedEvent(string clientId, string authority = default(string)) => throw null;
+                        public Microsoft.Identity.Client.Extensions.Msal.StorageCreationPropertiesBuilder WithLinuxKeyring(string schemaName, string collection, string secretLabel, System.Collections.Generic.KeyValuePair<string, string> attribute1, System.Collections.Generic.KeyValuePair<string, string> attribute2) => throw null;
+                        public Microsoft.Identity.Client.Extensions.Msal.StorageCreationPropertiesBuilder WithLinuxUnprotectedFile() => throw null;
+                        public Microsoft.Identity.Client.Extensions.Msal.StorageCreationPropertiesBuilder WithMacKeyChain(string serviceName, string accountName) => throw null;
+                        public Microsoft.Identity.Client.Extensions.Msal.StorageCreationPropertiesBuilder WithUnprotectedFile() => throw null;
+                    }
+                    public class TraceSourceLogger
+                    {
+                        public TraceSourceLogger(System.Diagnostics.TraceSource traceSource) => throw null;
+                        public void LogError(string message) => throw null;
+                        public void LogInformation(string message) => throw null;
+                        public void LogWarning(string message) => throw null;
+                        public System.Diagnostics.TraceSource Source { get => throw null; }
+                    }
+                }
+            }
+        }
+    }
+}

csharp/ql/test/resources/stubs/Microsoft.Identity.Client.Extensions.Msal/4.61.3/Microsoft.Identity.Client.Extensions.Msal.csproj

@@ -0,0 +1,14 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net9.0</TargetFramework>
+    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
+    <OutputPath>bin\</OutputPath>
+    <AppendTargetFrameworkToOutputPath>false</AppendTargetFrameworkToOutputPath>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="../../Microsoft.Identity.Client/4.61.3/Microsoft.Identity.Client.csproj" />
+    <ProjectReference Include="../../System.Security.Cryptography.ProtectedData/9.0.1/System.Security.Cryptography.ProtectedData.csproj" />
+    <ProjectReference Include="../../_frameworks/Microsoft.NETCore.App/Microsoft.NETCore.App.csproj" />
+  </ItemGroup>
+</Project>

csharp/ql/test/resources/stubs/Microsoft.Identity.Client/4.61.3/Microsoft.Identity.Client.csproj

@@ -0,0 +1,14 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net9.0</TargetFramework>
+    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
+    <OutputPath>bin\</OutputPath>
+    <AppendTargetFrameworkToOutputPath>false</AppendTargetFrameworkToOutputPath>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="../../Microsoft.IdentityModel.Abstractions/7.5.0/Microsoft.IdentityModel.Abstractions.csproj" />
+    <ProjectReference Include="../../System.Diagnostics.DiagnosticSource/6.0.1/System.Diagnostics.DiagnosticSource.csproj" />
+    <ProjectReference Include="../../_frameworks/Microsoft.NETCore.App/Microsoft.NETCore.App.csproj" />
+  </ItemGroup>
+</Project>

csharp/ql/test/resources/stubs/Microsoft.IdentityModel.Abstractions/7.5.0/Microsoft.IdentityModel.Abstractions.cs

@@ -0,0 +1,77 @@
+// This file contains auto-generated code.
+// Generated from `Microsoft.IdentityModel.Abstractions, Version=7.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35`.
+namespace Microsoft
+{
+    namespace IdentityModel
+    {
+        namespace Abstractions
+        {
+            public enum EventLogLevel
+            {
+                LogAlways = 0,
+                Critical = 1,
+                Error = 2,
+                Warning = 3,
+                Informational = 4,
+                Verbose = 5,
+            }
+            public interface IIdentityLogger
+            {
+                bool IsEnabled(Microsoft.IdentityModel.Abstractions.EventLogLevel eventLogLevel);
+                void Log(Microsoft.IdentityModel.Abstractions.LogEntry entry);
+            }
+            public interface ITelemetryClient
+            {
+                string ClientId { get; set; }
+                void Initialize();
+                bool IsEnabled();
+                bool IsEnabled(string eventName);
+                void TrackEvent(Microsoft.IdentityModel.Abstractions.TelemetryEventDetails eventDetails);
+                void TrackEvent(string eventName, System.Collections.Generic.IDictionary<string, string> stringProperties = default(System.Collections.Generic.IDictionary<string, string>), System.Collections.Generic.IDictionary<string, long> longProperties = default(System.Collections.Generic.IDictionary<string, long>), System.Collections.Generic.IDictionary<string, bool> boolProperties = default(System.Collections.Generic.IDictionary<string, bool>), System.Collections.Generic.IDictionary<string, System.DateTime> dateTimeProperties = default(System.Collections.Generic.IDictionary<string, System.DateTime>), System.Collections.Generic.IDictionary<string, double> doubleProperties = default(System.Collections.Generic.IDictionary<string, double>), System.Collections.Generic.IDictionary<string, System.Guid> guidProperties = default(System.Collections.Generic.IDictionary<string, System.Guid>));
+            }
+            public class LogEntry
+            {
+                public string CorrelationId { get => throw null; set { } }
+                public LogEntry() => throw null;
+                public Microsoft.IdentityModel.Abstractions.EventLogLevel EventLogLevel { get => throw null; set { } }
+                public string Message { get => throw null; set { } }
+            }
+            public sealed class NullIdentityModelLogger : Microsoft.IdentityModel.Abstractions.IIdentityLogger
+            {
+                public static Microsoft.IdentityModel.Abstractions.NullIdentityModelLogger Instance { get => throw null; }
+                public bool IsEnabled(Microsoft.IdentityModel.Abstractions.EventLogLevel eventLogLevel) => throw null;
+                public void Log(Microsoft.IdentityModel.Abstractions.LogEntry entry) => throw null;
+            }
+            public class NullTelemetryClient : Microsoft.IdentityModel.Abstractions.ITelemetryClient
+            {
+                public string ClientId { get => throw null; set { } }
+                public void Initialize() => throw null;
+                public static Microsoft.IdentityModel.Abstractions.NullTelemetryClient Instance { get => throw null; }
+                public bool IsEnabled() => throw null;
+                public bool IsEnabled(string eventName) => throw null;
+                public void TrackEvent(Microsoft.IdentityModel.Abstractions.TelemetryEventDetails eventDetails) => throw null;
+                public void TrackEvent(string eventName, System.Collections.Generic.IDictionary<string, string> stringProperties = default(System.Collections.Generic.IDictionary<string, string>), System.Collections.Generic.IDictionary<string, long> longProperties = default(System.Collections.Generic.IDictionary<string, long>), System.Collections.Generic.IDictionary<string, bool> boolProperties = default(System.Collections.Generic.IDictionary<string, bool>), System.Collections.Generic.IDictionary<string, System.DateTime> dateTimeProperties = default(System.Collections.Generic.IDictionary<string, System.DateTime>), System.Collections.Generic.IDictionary<string, double> doubleProperties = default(System.Collections.Generic.IDictionary<string, double>), System.Collections.Generic.IDictionary<string, System.Guid> guidProperties = default(System.Collections.Generic.IDictionary<string, System.Guid>)) => throw null;
+            }
+            public static class ObservabilityConstants
+            {
+                public const string ActivityId = default;
+                public const string ClientId = default;
+                public const string Duration = default;
+                public const string Succeeded = default;
+            }
+            public abstract class TelemetryEventDetails
+            {
+                protected TelemetryEventDetails() => throw null;
+                public virtual string Name { get => throw null; set { } }
+                public virtual System.Collections.Generic.IReadOnlyDictionary<string, object> Properties { get => throw null; }
+                protected System.Collections.Generic.IDictionary<string, object> PropertyValues { get => throw null; }
+                public virtual void SetProperty(string key, string value) => throw null;
+                public virtual void SetProperty(string key, long value) => throw null;
+                public virtual void SetProperty(string key, bool value) => throw null;
+                public virtual void SetProperty(string key, System.DateTime value) => throw null;
+                public virtual void SetProperty(string key, double value) => throw null;
+                public virtual void SetProperty(string key, System.Guid value) => throw null;
+            }
+        }
+    }
+}

csharp/ql/test/resources/stubs/Microsoft.IdentityModel.Abstractions/7.5.0/Microsoft.IdentityModel.Abstractions.csproj

@@ -0,0 +1,12 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net9.0</TargetFramework>
+    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
+    <OutputPath>bin\</OutputPath>
+    <AppendTargetFrameworkToOutputPath>false</AppendTargetFrameworkToOutputPath>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="../../_frameworks/Microsoft.NETCore.App/Microsoft.NETCore.App.csproj" />
+  </ItemGroup>
+</Project>

csharp/ql/test/resources/stubs/Microsoft.IdentityModel.JsonWebTokens/7.5.0/Microsoft.IdentityModel.JsonWebTokens.cs

@@ -0,0 +1,174 @@
+// This file contains auto-generated code.
+// Generated from `Microsoft.IdentityModel.JsonWebTokens, Version=7.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35`.
+namespace Microsoft
+{
+    namespace IdentityModel
+    {
+        namespace JsonWebTokens
+        {
+            public static class JsonClaimValueTypes
+            {
+                public const string Json = default;
+                public const string JsonArray = default;
+                public const string JsonNull = default;
+            }
+            public class JsonWebToken : Microsoft.IdentityModel.Tokens.SecurityToken
+            {
+                public string Actor { get => throw null; }
+                public string Alg { get => throw null; }
+                public System.Collections.Generic.IEnumerable<string> Audiences { get => throw null; }
+                public string AuthenticationTag { get => throw null; }
+                public string Azp { get => throw null; }
+                public string Ciphertext { get => throw null; }
+                public virtual System.Collections.Generic.IEnumerable<System.Security.Claims.Claim> Claims { get => throw null; }
+                public JsonWebToken(string jwtEncodedString) => throw null;
+                public JsonWebToken(System.ReadOnlyMemory<char> encodedTokenMemory) => throw null;
+                public JsonWebToken(string header, string payload) => throw null;
+                public string Cty { get => throw null; }
+                public string Enc { get => throw null; }
+                public string EncodedHeader { get => throw null; }
+                public string EncodedPayload { get => throw null; }
+                public string EncodedSignature { get => throw null; }
+                public string EncodedToken { get => throw null; }
+                public string EncryptedKey { get => throw null; }
+                public System.Security.Claims.Claim GetClaim(string key) => throw null;
+                public T GetHeaderValue<T>(string key) => throw null;
+                public T GetPayloadValue<T>(string key) => throw null;
+                public override string Id { get => throw null; }
+                public string InitializationVector { get => throw null; }
+                public Microsoft.IdentityModel.JsonWebTokens.JsonWebToken InnerToken { get => throw null; }
+                public bool IsEncrypted { get => throw null; }
+                public bool IsSigned { get => throw null; }
+                public System.DateTime IssuedAt { get => throw null; }
+                public override string Issuer { get => throw null; }
+                public string Kid { get => throw null; }
+                public override Microsoft.IdentityModel.Tokens.SecurityKey SecurityKey { get => throw null; }
+                public override Microsoft.IdentityModel.Tokens.SecurityKey SigningKey { get => throw null; set { } }
+                public string Subject { get => throw null; }
+                public override string ToString() => throw null;
+                public bool TryGetClaim(string key, out System.Security.Claims.Claim value) => throw null;
+                public bool TryGetHeaderValue<T>(string key, out T value) => throw null;
+                public bool TryGetPayloadValue<T>(string key, out T value) => throw null;
+                public bool TryGetValue<T>(string key, out T value) => throw null;
+                public string Typ { get => throw null; }
+                public override string UnsafeToString() => throw null;
+                public override System.DateTime ValidFrom { get => throw null; }
+                public override System.DateTime ValidTo { get => throw null; }
+                public string X5t { get => throw null; }
+                public string Zip { get => throw null; }
+            }
+            public class JsonWebTokenHandler : Microsoft.IdentityModel.Tokens.TokenHandler
+            {
+                public const string Base64UrlEncodedUnsignedJWSHeader = default;
+                public virtual bool CanReadToken(string token) => throw null;
+                public virtual bool CanValidateToken { get => throw null; }
+                protected virtual System.Security.Claims.ClaimsIdentity CreateClaimsIdentity(Microsoft.IdentityModel.JsonWebTokens.JsonWebToken jwtToken, Microsoft.IdentityModel.Tokens.TokenValidationParameters validationParameters) => throw null;
+                protected virtual System.Security.Claims.ClaimsIdentity CreateClaimsIdentity(Microsoft.IdentityModel.JsonWebTokens.JsonWebToken jwtToken, Microsoft.IdentityModel.Tokens.TokenValidationParameters validationParameters, string issuer) => throw null;
+                public virtual string CreateToken(string payload) => throw null;
+                public virtual string CreateToken(string payload, System.Collections.Generic.IDictionary<string, object> additionalHeaderClaims) => throw null;
+                public virtual string CreateToken(string payload, Microsoft.IdentityModel.Tokens.SigningCredentials signingCredentials) => throw null;
+                public virtual string CreateToken(string payload, Microsoft.IdentityModel.Tokens.SigningCredentials signingCredentials, System.Collections.Generic.IDictionary<string, object> additionalHeaderClaims) => throw null;
+                public virtual string CreateToken(Microsoft.IdentityModel.Tokens.SecurityTokenDescriptor tokenDescriptor) => throw null;
+                public virtual string CreateToken(string payload, Microsoft.IdentityModel.Tokens.EncryptingCredentials encryptingCredentials) => throw null;
+                public virtual string CreateToken(string payload, Microsoft.IdentityModel.Tokens.EncryptingCredentials encryptingCredentials, System.Collections.Generic.IDictionary<string, object> additionalHeaderClaims) => throw null;
+                public virtual string CreateToken(string payload, Microsoft.IdentityModel.Tokens.SigningCredentials signingCredentials, Microsoft.IdentityModel.Tokens.EncryptingCredentials encryptingCredentials) => throw null;
+                public virtual string CreateToken(string payload, Microsoft.IdentityModel.Tokens.SigningCredentials signingCredentials, Microsoft.IdentityModel.Tokens.EncryptingCredentials encryptingCredentials, System.Collections.Generic.IDictionary<string, object> additionalHeaderClaims) => throw null;
+                public virtual string CreateToken(string payload, Microsoft.IdentityModel.Tokens.EncryptingCredentials encryptingCredentials, string compressionAlgorithm) => throw null;
+                public virtual string CreateToken(string payload, Microsoft.IdentityModel.Tokens.SigningCredentials signingCredentials, Microsoft.IdentityModel.Tokens.EncryptingCredentials encryptingCredentials, string compressionAlgorithm) => throw null;
+                public virtual string CreateToken(string payload, Microsoft.IdentityModel.Tokens.SigningCredentials signingCredentials, Microsoft.IdentityModel.Tokens.EncryptingCredentials encryptingCredentials, string compressionAlgorithm, System.Collections.Generic.IDictionary<string, object> additionalHeaderClaims, System.Collections.Generic.IDictionary<string, object> additionalInnerHeaderClaims) => throw null;
+                public virtual string CreateToken(string payload, Microsoft.IdentityModel.Tokens.SigningCredentials signingCredentials, Microsoft.IdentityModel.Tokens.EncryptingCredentials encryptingCredentials, string compressionAlgorithm, System.Collections.Generic.IDictionary<string, object> additionalHeaderClaims) => throw null;
+                public JsonWebTokenHandler() => throw null;
+                public string DecryptToken(Microsoft.IdentityModel.JsonWebTokens.JsonWebToken jwtToken, Microsoft.IdentityModel.Tokens.TokenValidationParameters validationParameters) => throw null;
+                public static System.Collections.Generic.IDictionary<string, string> DefaultInboundClaimTypeMap;
+                public static bool DefaultMapInboundClaims;
+                public string EncryptToken(string innerJwt, Microsoft.IdentityModel.Tokens.EncryptingCredentials encryptingCredentials) => throw null;
+                public string EncryptToken(string innerJwt, Microsoft.IdentityModel.Tokens.EncryptingCredentials encryptingCredentials, System.Collections.Generic.IDictionary<string, object> additionalHeaderClaims) => throw null;
+                public string EncryptToken(string innerJwt, Microsoft.IdentityModel.Tokens.EncryptingCredentials encryptingCredentials, string algorithm) => throw null;
+                public string EncryptToken(string innerJwt, Microsoft.IdentityModel.Tokens.EncryptingCredentials encryptingCredentials, string algorithm, System.Collections.Generic.IDictionary<string, object> additionalHeaderClaims) => throw null;
+                public System.Collections.Generic.IDictionary<string, string> InboundClaimTypeMap { get => throw null; set { } }
+                public bool MapInboundClaims { get => throw null; set { } }
+                public virtual Microsoft.IdentityModel.JsonWebTokens.JsonWebToken ReadJsonWebToken(string token) => throw null;
+                public override Microsoft.IdentityModel.Tokens.SecurityToken ReadToken(string token) => throw null;
+                protected virtual Microsoft.IdentityModel.Tokens.SecurityKey ResolveTokenDecryptionKey(string token, Microsoft.IdentityModel.JsonWebTokens.JsonWebToken jwtToken, Microsoft.IdentityModel.Tokens.TokenValidationParameters validationParameters) => throw null;
+                public static string ShortClaimTypeProperty { get => throw null; set { } }
+                public System.Type TokenType { get => throw null; }
+                public virtual Microsoft.IdentityModel.Tokens.TokenValidationResult ValidateToken(string token, Microsoft.IdentityModel.Tokens.TokenValidationParameters validationParameters) => throw null;
+                public override System.Threading.Tasks.Task<Microsoft.IdentityModel.Tokens.TokenValidationResult> ValidateTokenAsync(string token, Microsoft.IdentityModel.Tokens.TokenValidationParameters validationParameters) => throw null;
+                public override System.Threading.Tasks.Task<Microsoft.IdentityModel.Tokens.TokenValidationResult> ValidateTokenAsync(Microsoft.IdentityModel.Tokens.SecurityToken token, Microsoft.IdentityModel.Tokens.TokenValidationParameters validationParameters) => throw null;
+            }
+            public static class JwtConstants
+            {
+                public const string DirectKeyUseAlg = default;
+                public const string HeaderType = default;
+                public const string HeaderTypeAlt = default;
+                public const string JsonCompactSerializationRegex = default;
+                public const string JweCompactSerializationRegex = default;
+                public const int JweSegmentCount = 5;
+                public const int JwsSegmentCount = 3;
+                public const int MaxJwtSegmentCount = 5;
+                public const string TokenType = default;
+                public const string TokenTypeAlt = default;
+            }
+            public struct JwtHeaderParameterNames
+            {
+                public const string Alg = default;
+                public const string Apu = default;
+                public const string Apv = default;
+                public const string Cty = default;
+                public const string Enc = default;
+                public const string Epk = default;
+                public const string IV = default;
+                public const string Jku = default;
+                public const string Jwk = default;
+                public const string Kid = default;
+                public const string Typ = default;
+                public const string X5c = default;
+                public const string X5t = default;
+                public const string X5u = default;
+                public const string Zip = default;
+            }
+            public struct JwtRegisteredClaimNames
+            {
+                public const string Acr = default;
+                public const string Actort = default;
+                public const string Amr = default;
+                public const string AtHash = default;
+                public const string Aud = default;
+                public const string AuthTime = default;
+                public const string Azp = default;
+                public const string Birthdate = default;
+                public const string CHash = default;
+                public const string Email = default;
+                public const string Exp = default;
+                public const string FamilyName = default;
+                public const string Gender = default;
+                public const string GivenName = default;
+                public const string Iat = default;
+                public const string Iss = default;
+                public const string Jti = default;
+                public const string Name = default;
+                public const string NameId = default;
+                public const string Nbf = default;
+                public const string Nonce = default;
+                public const string PhoneNumber = default;
+                public const string PhoneNumberVerified = default;
+                public const string Prn = default;
+                public const string Sid = default;
+                public const string Sub = default;
+                public const string Typ = default;
+                public const string UniqueName = default;
+                public const string Website = default;
+            }
+            public class JwtTokenUtilities
+            {
+                public static string CreateEncodedSignature(string input, Microsoft.IdentityModel.Tokens.SigningCredentials signingCredentials) => throw null;
+                public static string CreateEncodedSignature(string input, Microsoft.IdentityModel.Tokens.SigningCredentials signingCredentials, bool cacheProvider) => throw null;
+                public JwtTokenUtilities() => throw null;
+                public static byte[] GenerateKeyBytes(int sizeInBits) => throw null;
+                public static System.Collections.Generic.IEnumerable<Microsoft.IdentityModel.Tokens.SecurityKey> GetAllDecryptionKeys(Microsoft.IdentityModel.Tokens.TokenValidationParameters validationParameters) => throw null;
+                public static System.Text.RegularExpressions.Regex RegexJwe;
+                public static System.Text.RegularExpressions.Regex RegexJws;
+            }
+        }
+    }
+}

csharp/ql/test/resources/stubs/Microsoft.IdentityModel.JsonWebTokens/7.5.0/Microsoft.IdentityModel.JsonWebTokens.csproj

@@ -0,0 +1,13 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net9.0</TargetFramework>
+    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
+    <OutputPath>bin\</OutputPath>
+    <AppendTargetFrameworkToOutputPath>false</AppendTargetFrameworkToOutputPath>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="../../Microsoft.IdentityModel.Tokens/7.5.0/Microsoft.IdentityModel.Tokens.csproj" />
+    <ProjectReference Include="../../_frameworks/Microsoft.NETCore.App/Microsoft.NETCore.App.csproj" />
+  </ItemGroup>
+</Project>