Add test case with MISSING tag demonstrating instance-across-call shortcoming

cpp/ql/lib/change-notes/2026-06-30-variables-as-mad-sources-and-sinks.md

@@ -1,4 +0,0 @@
----
-category: breaking
----
-* Removed support for using variables as sources and sinks in models-as-data. Users of this feature should convert such sources and sinks to models defined using the QL language.

cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll

@@ -931,6 +931,31 @@ private Element interpretElement0(
     signature = "" and
     elementSpec(namespace, type, subtypes, name, signature, _)
   )
+  or
+  // Member variables
+  elementSpec(namespace, type, subtypes, name, signature, _) and
+  signature = "" and
+  exists(Class namedClass, Class classWithMember, MemberVariable member |
+    member.getName() = name and
+    member = classWithMember.getAMember() and
+    namedClass.hasQualifiedName(namespace, type) and
+    result = member
+  |
+    // field declared in the named type or a subtype of it (or an extension of any)
+    subtypes = true and
+    classWithMember = namedClass.getADerivedClass*()
+    or
+    // field declared directly in the named type (or an extension of it)
+    subtypes = false and
+    classWithMember = namedClass
+  )
+  or
+  // Global or namespace variables
+  elementSpec(namespace, type, subtypes, name, signature, _) and
+  signature = "" and
+  type = "" and
+  subtypes = false and
+  result = any(GlobalOrNamespaceVariable v | v.hasQualifiedName(namespace, name))
 }
 
 cached

cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll

@@ -230,11 +230,40 @@ module SourceSinkInterpretationInput implements
 
   /** Provides additional sink specification logic. */
   bindingset[c]
-  predicate interpretOutput(string c, InterpretNode mid, InterpretNode node) { none() }
+  predicate interpretOutput(string c, InterpretNode mid, InterpretNode node) {
+    // Allow variables to be picked as output nodes.
+    exists(Node n, Element ast |
+      n = node.asNode() and
+      ast = mid.asElement()
+    |
+      c = "" and
+      n.asExpr().(VariableAccess).getTarget() = ast
+    )
+  }
 
   /** Provides additional source specification logic. */
   bindingset[c]
-  predicate interpretInput(string c, InterpretNode mid, InterpretNode node) { none() }
+  predicate interpretInput(string c, InterpretNode mid, InterpretNode node) {
+    exists(Node n, Element ast, VariableAccess e |
+      n = node.asNode() and
+      ast = mid.asElement() and
+      e.getTarget() = ast
+    |
+      // Allow variables to be picked as input nodes.
+      // We could simply do this as `e = n.asExpr()`, but that would not allow
+      // us to pick `x` as a sink in an example such as `x = source()` (but
+      // only subsequent uses of `x`) since the variable access on `x` doesn't
+      // actually load the value of `x`. So instead, we pick the instruction
+      // node corresponding to the generated `StoreInstruction` and use the
+      // expression associated with the destination instruction. This means
+      // that the `x` in `x = source()` can be marked as an input.
+      c = "" and
+      exists(StoreInstruction store |
+        store.getDestinationAddress().getUnconvertedResultExpression() = e and
+        n.asInstruction() = store
+      )
+    )
+  }
 }
 
 module Private {

cpp/ql/test/library-tests/dataflow/models-as-data/testModels.expected

@@ -33,34 +33,34 @@ summaryCalls
 | file://:0:0:0:0 | [summary] call to [summary param] 0 in madCallArg0ReturnToReturnFirst in madCallArg0ReturnToReturnFirst |
 | file://:0:0:0:0 | [summary] call to [summary param] 0 in madCallArg0WithValue in madCallArg0WithValue |
 summarizedCallables
-| tests.cpp:127:5:127:19 | madArg0ToReturn |
+| tests.cpp:144:5:144:19 | madArg0ToReturn |
-| tests.cpp:128:6:128:28 | madArg0ToReturnIndirect |
+| tests.cpp:145:6:145:28 | madArg0ToReturnIndirect |
-| tests.cpp:130:5:130:28 | madArg0ToReturnValueFlow |
+| tests.cpp:147:5:147:28 | madArg0ToReturnValueFlow |
-| tests.cpp:131:5:131:27 | madArg0IndirectToReturn |
+| tests.cpp:148:5:148:27 | madArg0IndirectToReturn |
-| tests.cpp:132:5:132:33 | madArg0DoubleIndirectToReturn |
+| tests.cpp:149:5:149:33 | madArg0DoubleIndirectToReturn |
-| tests.cpp:133:5:133:30 | madArg0NotIndirectToReturn |
+| tests.cpp:150:5:150:30 | madArg0NotIndirectToReturn |
-| tests.cpp:134:6:134:26 | madArg0ToArg1Indirect |
+| tests.cpp:151:6:151:26 | madArg0ToArg1Indirect |
-| tests.cpp:135:6:135:34 | madArg0IndirectToArg1Indirect |
+| tests.cpp:152:6:152:34 | madArg0IndirectToArg1Indirect |
-| tests.cpp:136:5:136:18 | madArgsComplex |
+| tests.cpp:153:5:153:18 | madArgsComplex |
-| tests.cpp:137:5:137:14 | madArgsAny |
+| tests.cpp:154:5:154:14 | madArgsAny |
-| tests.cpp:138:5:138:28 | madAndImplementedComplex |
+| tests.cpp:155:5:155:28 | madAndImplementedComplex |
-| tests.cpp:143:5:143:24 | madArg0FieldToReturn |
+| tests.cpp:160:5:160:24 | madArg0FieldToReturn |
-| tests.cpp:144:5:144:32 | madArg0IndirectFieldToReturn |
+| tests.cpp:161:5:161:32 | madArg0IndirectFieldToReturn |
-| tests.cpp:145:5:145:32 | madArg0FieldIndirectToReturn |
+| tests.cpp:162:5:162:32 | madArg0FieldIndirectToReturn |
-| tests.cpp:146:13:146:32 | madArg0ToReturnField |
+| tests.cpp:163:13:163:32 | madArg0ToReturnField |
-| tests.cpp:147:14:147:41 | madArg0ToReturnIndirectField |
+| tests.cpp:164:14:164:41 | madArg0ToReturnIndirectField |
-| tests.cpp:148:13:148:40 | madArg0ToReturnFieldIndirect |
+| tests.cpp:165:13:165:40 | madArg0ToReturnFieldIndirect |
-| tests.cpp:250:7:250:19 | madArg0ToSelf |
+| tests.cpp:284:7:284:19 | madArg0ToSelf |
-| tests.cpp:251:6:251:20 | madSelfToReturn |
+| tests.cpp:285:6:285:20 | madSelfToReturn |
-| tests.cpp:253:7:253:20 | madArg0ToField |
+| tests.cpp:287:7:287:20 | madArg0ToField |
-| tests.cpp:254:6:254:21 | madFieldToReturn |
+| tests.cpp:288:6:288:21 | madFieldToReturn |
-| tests.cpp:277:7:277:30 | namespaceMadSelfToReturn |
+| tests.cpp:313:7:313:30 | namespaceMadSelfToReturn |
-| tests.cpp:392:5:392:29 | madCallArg0ReturnToReturn |
+| tests.cpp:434:5:434:29 | madCallArg0ReturnToReturn |
-| tests.cpp:393:9:393:38 | madCallArg0ReturnToReturnFirst |
+| tests.cpp:435:9:435:38 | madCallArg0ReturnToReturnFirst |
-| tests.cpp:394:6:394:25 | madCallArg0WithValue |
+| tests.cpp:436:6:436:25 | madCallArg0WithValue |
-| tests.cpp:395:5:395:36 | madCallReturnValueIgnoreFunction |
+| tests.cpp:437:5:437:36 | madCallReturnValueIgnoreFunction |
-| tests.cpp:417:5:417:31 | parameter_ref_to_return_ref |
+| tests.cpp:459:5:459:31 | parameter_ref_to_return_ref |
-| tests.cpp:429:5:429:17 | receive_array |
+| tests.cpp:471:5:471:17 | receive_array |
 sourceCallables
 | tests.cpp:3:5:3:10 | source |
 | tests.cpp:4:6:4:14 | sourcePtr |
@@ -82,284 +82,297 @@ sourceCallables
 | tests.cpp:19:6:19:32 | remoteMadSourceIndirectArg1 |
 | tests.cpp:19:39:19:39 | x |
 | tests.cpp:19:47:19:47 | y |
-| tests.cpp:23:7:23:30 | namespace2LocalMadSource |
+| tests.cpp:20:5:20:22 | remoteMadSourceVar |
-| tests.cpp:26:6:26:19 | localMadSource |
+| tests.cpp:21:6:21:31 | remoteMadSourceVarIndirect |
-| tests.cpp:28:5:28:27 | namespaceLocalMadSource |
+| tests.cpp:24:6:24:28 | namespaceLocalMadSource |
-| tests.cpp:30:6:30:17 | test_sources |
+| tests.cpp:25:6:25:31 | namespaceLocalMadSourceVar |
-| tests.cpp:45:6:45:6 | v |
+| tests.cpp:28:7:28:30 | namespace2LocalMadSource |
-| tests.cpp:46:7:46:16 | v_indirect |
+| tests.cpp:31:6:31:19 | localMadSource |
-| tests.cpp:47:6:47:13 | v_direct |
+| tests.cpp:33:5:33:27 | namespaceLocalMadSource |
-| tests.cpp:58:6:58:6 | a |
+| tests.cpp:35:6:35:17 | test_sources |
-| tests.cpp:58:9:58:9 | b |
+| tests.cpp:50:6:50:6 | v |
-| tests.cpp:58:12:58:12 | c |
+| tests.cpp:51:7:51:16 | v_indirect |
-| tests.cpp:58:15:58:15 | d |
+| tests.cpp:52:6:52:13 | v_direct |
-| tests.cpp:67:6:67:6 | e |
+| tests.cpp:63:6:63:6 | a |
-| tests.cpp:75:6:75:26 | remoteMadSourceParam0 |
+| tests.cpp:63:9:63:9 | b |
-| tests.cpp:75:32:75:32 | x |
+| tests.cpp:63:12:63:12 | c |
-| tests.cpp:82:6:82:16 | madSinkArg0 |
+| tests.cpp:63:15:63:15 | d |
-| tests.cpp:82:22:82:22 | x |
+| tests.cpp:75:6:75:6 | e |
-| tests.cpp:83:6:83:13 | notASink |
+| tests.cpp:85:6:85:26 | remoteMadSourceParam0 |
-| tests.cpp:83:19:83:19 | x |
+| tests.cpp:85:32:85:32 | x |
-| tests.cpp:84:6:84:16 | madSinkArg1 |
+| tests.cpp:92:6:92:16 | madSinkArg0 |
-| tests.cpp:84:22:84:22 | x |
+| tests.cpp:92:22:92:22 | x |
-| tests.cpp:84:29:84:29 | y |
+| tests.cpp:93:6:93:13 | notASink |
-| tests.cpp:85:6:85:17 | madSinkArg01 |
+| tests.cpp:93:19:93:19 | x |
-| tests.cpp:85:23:85:23 | x |
+| tests.cpp:94:6:94:16 | madSinkArg1 |
-| tests.cpp:85:30:85:30 | y |
+| tests.cpp:94:22:94:22 | x |
-| tests.cpp:85:37:85:37 | z |
+| tests.cpp:94:29:94:29 | y |
-| tests.cpp:86:6:86:17 | madSinkArg02 |
+| tests.cpp:95:6:95:17 | madSinkArg01 |
-| tests.cpp:86:23:86:23 | x |
+| tests.cpp:95:23:95:23 | x |
-| tests.cpp:86:30:86:30 | y |
+| tests.cpp:95:30:95:30 | y |
-| tests.cpp:86:37:86:37 | z |
+| tests.cpp:95:37:95:37 | z |
-| tests.cpp:87:6:87:24 | madSinkIndirectArg0 |
+| tests.cpp:96:6:96:17 | madSinkArg02 |
-| tests.cpp:87:31:87:31 | x |
+| tests.cpp:96:23:96:23 | x |
-| tests.cpp:88:6:88:30 | madSinkDoubleIndirectArg0 |
+| tests.cpp:96:30:96:30 | y |
-| tests.cpp:88:38:88:38 | x |
+| tests.cpp:96:37:96:37 | z |
-| tests.cpp:92:6:92:15 | test_sinks |
+| tests.cpp:97:6:97:24 | madSinkIndirectArg0 |
-| tests.cpp:106:6:106:6 | a |
+| tests.cpp:97:31:97:31 | x |
-| tests.cpp:107:7:107:11 | a_ptr |
+| tests.cpp:98:6:98:30 | madSinkDoubleIndirectArg0 |
-| tests.cpp:115:6:115:18 | madSinkParam0 |
+| tests.cpp:98:38:98:38 | x |
-| tests.cpp:115:24:115:24 | x |
+| tests.cpp:99:5:99:14 | madSinkVar |
-| tests.cpp:121:8:121:8 | operator= |
+| tests.cpp:100:6:100:23 | madSinkVarIndirect |
-| tests.cpp:121:8:121:8 | operator= |
+| tests.cpp:102:6:102:15 | test_sinks |
-| tests.cpp:121:8:121:18 | MyContainer |
+| tests.cpp:116:6:116:6 | a |
-| tests.cpp:122:6:122:10 | value |
+| tests.cpp:117:7:117:11 | a_ptr |
-| tests.cpp:123:6:123:11 | value2 |
+| tests.cpp:132:6:132:18 | madSinkParam0 |
-| tests.cpp:124:7:124:9 | ptr |
+| tests.cpp:132:24:132:24 | x |
-| tests.cpp:127:5:127:19 | madArg0ToReturn |
+| tests.cpp:138:8:138:8 | operator= |
-| tests.cpp:127:25:127:25 | x |
+| tests.cpp:138:8:138:8 | operator= |
-| tests.cpp:128:6:128:28 | madArg0ToReturnIndirect |
+| tests.cpp:138:8:138:18 | MyContainer |
-| tests.cpp:128:34:128:34 | x |
+| tests.cpp:139:6:139:10 | value |
-| tests.cpp:129:5:129:15 | notASummary |
+| tests.cpp:140:6:140:11 | value2 |
-| tests.cpp:129:21:129:21 | x |
+| tests.cpp:141:7:141:9 | ptr |
-| tests.cpp:130:5:130:28 | madArg0ToReturnValueFlow |
+| tests.cpp:144:5:144:19 | madArg0ToReturn |
-| tests.cpp:130:34:130:34 | x |
+| tests.cpp:144:25:144:25 | x |
-| tests.cpp:131:5:131:27 | madArg0IndirectToReturn |
+| tests.cpp:145:6:145:28 | madArg0ToReturnIndirect |
-| tests.cpp:131:34:131:34 | x |
+| tests.cpp:145:34:145:34 | x |
-| tests.cpp:132:5:132:33 | madArg0DoubleIndirectToReturn |
+| tests.cpp:146:5:146:15 | notASummary |
-| tests.cpp:132:41:132:41 | x |
+| tests.cpp:146:21:146:21 | x |
-| tests.cpp:133:5:133:30 | madArg0NotIndirectToReturn |
+| tests.cpp:147:5:147:28 | madArg0ToReturnValueFlow |
-| tests.cpp:133:37:133:37 | x |
+| tests.cpp:147:34:147:34 | x |
-| tests.cpp:134:6:134:26 | madArg0ToArg1Indirect |
+| tests.cpp:148:5:148:27 | madArg0IndirectToReturn |
-| tests.cpp:134:32:134:32 | x |
+| tests.cpp:148:34:148:34 | x |
-| tests.cpp:134:40:134:40 | y |
+| tests.cpp:149:5:149:33 | madArg0DoubleIndirectToReturn |
-| tests.cpp:135:6:135:34 | madArg0IndirectToArg1Indirect |
+| tests.cpp:149:41:149:41 | x |
-| tests.cpp:135:47:135:47 | x |
+| tests.cpp:150:5:150:30 | madArg0NotIndirectToReturn |
-| tests.cpp:135:55:135:55 | y |
+| tests.cpp:150:37:150:37 | x |
-| tests.cpp:136:5:136:18 | madArgsComplex |
+| tests.cpp:151:6:151:26 | madArg0ToArg1Indirect |
-| tests.cpp:136:25:136:25 | a |
+| tests.cpp:151:32:151:32 | x |
-| tests.cpp:136:33:136:33 | b |
+| tests.cpp:151:40:151:40 | y |
-| tests.cpp:136:40:136:40 | c |
+| tests.cpp:152:6:152:34 | madArg0IndirectToArg1Indirect |
-| tests.cpp:136:47:136:47 | d |
+| tests.cpp:152:47:152:47 | x |
-| tests.cpp:137:5:137:14 | madArgsAny |
+| tests.cpp:152:55:152:55 | y |
-| tests.cpp:137:20:137:20 | a |
+| tests.cpp:153:5:153:18 | madArgsComplex |
-| tests.cpp:137:28:137:28 | b |
+| tests.cpp:153:25:153:25 | a |
-| tests.cpp:138:5:138:28 | madAndImplementedComplex |
+| tests.cpp:153:33:153:33 | b |
-| tests.cpp:138:34:138:34 | a |
+| tests.cpp:153:40:153:40 | c |
-| tests.cpp:138:41:138:41 | b |
+| tests.cpp:153:47:153:47 | d |
-| tests.cpp:138:48:138:48 | c |
+| tests.cpp:154:5:154:14 | madArgsAny |
-| tests.cpp:143:5:143:24 | madArg0FieldToReturn |
+| tests.cpp:154:20:154:20 | a |
-| tests.cpp:143:38:143:39 | mc |
+| tests.cpp:154:28:154:28 | b |
-| tests.cpp:144:5:144:32 | madArg0IndirectFieldToReturn |
+| tests.cpp:155:5:155:28 | madAndImplementedComplex |
-| tests.cpp:144:47:144:48 | mc |
+| tests.cpp:155:34:155:34 | a |
-| tests.cpp:145:5:145:32 | madArg0FieldIndirectToReturn |
+| tests.cpp:155:41:155:41 | b |
-| tests.cpp:145:46:145:47 | mc |
+| tests.cpp:155:48:155:48 | c |
-| tests.cpp:146:13:146:32 | madArg0ToReturnField |
+| tests.cpp:160:5:160:24 | madArg0FieldToReturn |
-| tests.cpp:146:38:146:38 | x |
+| tests.cpp:160:38:160:39 | mc |
-| tests.cpp:147:14:147:41 | madArg0ToReturnIndirectField |
+| tests.cpp:161:5:161:32 | madArg0IndirectFieldToReturn |
-| tests.cpp:147:47:147:47 | x |
+| tests.cpp:161:47:161:48 | mc |
-| tests.cpp:148:13:148:40 | madArg0ToReturnFieldIndirect |
+| tests.cpp:162:5:162:32 | madArg0FieldIndirectToReturn |
-| tests.cpp:148:46:148:46 | x |
+| tests.cpp:162:46:162:47 | mc |
-| tests.cpp:150:6:150:19 | test_summaries |
+| tests.cpp:163:13:163:32 | madArg0ToReturnField |
-| tests.cpp:153:6:153:6 | a |
+| tests.cpp:163:38:163:38 | x |
-| tests.cpp:153:9:153:9 | b |
+| tests.cpp:164:14:164:41 | madArg0ToReturnIndirectField |
-| tests.cpp:153:12:153:12 | c |
+| tests.cpp:164:47:164:47 | x |
-| tests.cpp:153:15:153:15 | d |
+| tests.cpp:165:13:165:40 | madArg0ToReturnFieldIndirect |
-| tests.cpp:153:18:153:18 | e |
+| tests.cpp:165:46:165:46 | x |
-| tests.cpp:154:7:154:11 | a_ptr |
+| tests.cpp:167:13:167:30 | madFieldToFieldVar |
-| tests.cpp:197:14:197:16 | mc1 |
+| tests.cpp:168:13:168:38 | madFieldToIndirectFieldVar |
-| tests.cpp:197:19:197:21 | mc2 |
+| tests.cpp:169:14:169:39 | madIndirectFieldToFieldVar |
-| tests.cpp:216:15:216:18 | rtn1 |
+| tests.cpp:171:6:171:19 | test_summaries |
-| tests.cpp:219:14:219:17 | rtn2 |
+| tests.cpp:174:6:174:6 | a |
-| tests.cpp:220:7:220:14 | rtn2_ptr |
+| tests.cpp:174:9:174:9 | b |
-| tests.cpp:233:7:233:7 | operator= |
+| tests.cpp:174:12:174:12 | c |
-| tests.cpp:233:7:233:7 | operator= |
+| tests.cpp:174:15:174:15 | d |
-| tests.cpp:233:7:233:13 | MyClass |
+| tests.cpp:174:18:174:18 | e |
-| tests.cpp:236:6:236:26 | memberRemoteMadSource |
+| tests.cpp:175:7:175:11 | a_ptr |
-| tests.cpp:237:7:237:39 | memberRemoteMadSourceIndirectArg0 |
+| tests.cpp:218:14:218:16 | mc1 |
-| tests.cpp:237:46:237:46 | x |
+| tests.cpp:218:19:218:21 | mc2 |
-| tests.cpp:239:7:239:21 | qualifierSource |
+| tests.cpp:237:15:237:18 | rtn1 |
-| tests.cpp:240:7:240:26 | qualifierFieldSource |
+| tests.cpp:240:14:240:17 | rtn2 |
-| tests.cpp:243:7:243:23 | memberMadSinkArg0 |
+| tests.cpp:241:7:241:14 | rtn2_ptr |
-| tests.cpp:243:29:243:29 | x |
+| tests.cpp:267:7:267:7 | operator= |
-| tests.cpp:245:7:245:19 | qualifierSink |
+| tests.cpp:267:7:267:7 | operator= |
-| tests.cpp:246:7:246:23 | qualifierArg0Sink |
+| tests.cpp:267:7:267:13 | MyClass |
-| tests.cpp:246:29:246:29 | x |
+| tests.cpp:270:6:270:26 | memberRemoteMadSource |
-| tests.cpp:247:7:247:24 | qualifierFieldSink |
+| tests.cpp:271:7:271:39 | memberRemoteMadSourceIndirectArg0 |
-| tests.cpp:250:7:250:19 | madArg0ToSelf |
+| tests.cpp:271:46:271:46 | x |
-| tests.cpp:250:25:250:25 | x |
+| tests.cpp:272:6:272:29 | memberRemoteMadSourceVar |
-| tests.cpp:251:6:251:20 | madSelfToReturn |
+| tests.cpp:273:7:273:21 | qualifierSource |
-| tests.cpp:252:6:252:16 | notASummary |
+| tests.cpp:274:7:274:26 | qualifierFieldSource |
-| tests.cpp:253:7:253:20 | madArg0ToField |
+| tests.cpp:277:7:277:23 | memberMadSinkArg0 |
-| tests.cpp:253:26:253:26 | x |
+| tests.cpp:277:29:277:29 | x |
-| tests.cpp:254:6:254:21 | madFieldToReturn |
+| tests.cpp:278:6:278:21 | memberMadSinkVar |
-| tests.cpp:256:6:256:8 | val |
+| tests.cpp:279:7:279:19 | qualifierSink |
-| tests.cpp:259:7:259:7 | MyDerivedClass |
+| tests.cpp:280:7:280:23 | qualifierArg0Sink |
-| tests.cpp:259:7:259:7 | operator= |
+| tests.cpp:280:29:280:29 | x |
-| tests.cpp:259:7:259:7 | operator= |
+| tests.cpp:281:7:281:24 | qualifierFieldSink |
-| tests.cpp:259:7:259:20 | MyDerivedClass |
+| tests.cpp:284:7:284:19 | madArg0ToSelf |
-| tests.cpp:261:6:261:28 | subtypeRemoteMadSource1 |
+| tests.cpp:284:25:284:25 | x |
-| tests.cpp:262:6:262:21 | subtypeNonSource |
+| tests.cpp:285:6:285:20 | madSelfToReturn |
-| tests.cpp:263:6:263:28 | subtypeRemoteMadSource2 |
+| tests.cpp:286:6:286:16 | notASummary |
-| tests.cpp:266:9:266:15 | source2 |
+| tests.cpp:287:7:287:20 | madArg0ToField |
-| tests.cpp:267:6:267:9 | sink |
+| tests.cpp:287:26:287:26 | x |
-| tests.cpp:267:19:267:20 | mc |
+| tests.cpp:288:6:288:21 | madFieldToReturn |
-| tests.cpp:270:8:270:8 | operator= |
+| tests.cpp:290:6:290:8 | val |
-| tests.cpp:270:8:270:8 | operator= |
+| tests.cpp:293:7:293:7 | MyDerivedClass |
-| tests.cpp:270:8:270:14 | MyClass |
+| tests.cpp:293:7:293:7 | operator= |
-| tests.cpp:273:8:273:33 | namespaceMemberMadSinkArg0 |
+| tests.cpp:293:7:293:7 | operator= |
-| tests.cpp:273:39:273:39 | x |
+| tests.cpp:293:7:293:20 | MyDerivedClass |
-| tests.cpp:274:15:274:46 | namespaceStaticMemberMadSinkArg0 |
+| tests.cpp:295:6:295:28 | subtypeRemoteMadSource1 |
-| tests.cpp:274:52:274:52 | x |
+| tests.cpp:296:6:296:21 | subtypeNonSource |
-| tests.cpp:277:7:277:30 | namespaceMadSelfToReturn |
+| tests.cpp:297:6:297:28 | subtypeRemoteMadSource2 |
-| tests.cpp:281:22:281:28 | source3 |
+| tests.cpp:300:9:300:15 | source2 |
-| tests.cpp:283:6:283:23 | test_class_members |
+| tests.cpp:301:6:301:9 | sink |
-| tests.cpp:284:10:284:11 | mc |
+| tests.cpp:301:19:301:20 | mc |
-| tests.cpp:284:14:284:16 | mc2 |
+| tests.cpp:304:8:304:8 | operator= |
-| tests.cpp:284:19:284:21 | mc3 |
+| tests.cpp:304:8:304:8 | operator= |
-| tests.cpp:284:24:284:26 | mc4 |
+| tests.cpp:304:8:304:14 | MyClass |
-| tests.cpp:284:29:284:31 | mc5 |
+| tests.cpp:307:8:307:33 | namespaceMemberMadSinkArg0 |
-| tests.cpp:284:34:284:36 | mc6 |
+| tests.cpp:307:39:307:39 | x |
-| tests.cpp:284:39:284:41 | mc7 |
+| tests.cpp:308:15:308:46 | namespaceStaticMemberMadSinkArg0 |
-| tests.cpp:284:44:284:46 | mc8 |
+| tests.cpp:308:52:308:52 | x |
-| tests.cpp:284:49:284:51 | mc9 |
+| tests.cpp:309:7:309:31 | namespaceMemberMadSinkVar |
-| tests.cpp:284:54:284:57 | mc10 |
+| tests.cpp:310:14:310:44 | namespaceStaticMemberMadSinkVar |
-| tests.cpp:284:60:284:63 | mc11 |
+| tests.cpp:313:7:313:30 | namespaceMadSelfToReturn |
-| tests.cpp:285:11:285:13 | ptr |
+| tests.cpp:317:22:317:28 | source3 |
-| tests.cpp:285:17:285:23 | mc4_ptr |
+| tests.cpp:319:6:319:23 | test_class_members |
-| tests.cpp:286:17:286:19 | mdc |
+| tests.cpp:320:10:320:11 | mc |
-| tests.cpp:287:23:287:25 | mnc |
+| tests.cpp:320:14:320:16 | mc2 |
-| tests.cpp:287:28:287:31 | mnc2 |
+| tests.cpp:320:19:320:21 | mc3 |
-| tests.cpp:288:24:288:31 | mnc2_ptr |
+| tests.cpp:320:24:320:26 | mc4 |
-| tests.cpp:294:6:294:6 | a |
+| tests.cpp:320:29:320:31 | mc5 |
-| tests.cpp:387:8:387:8 | operator= |
+| tests.cpp:320:34:320:36 | mc6 |
-| tests.cpp:387:8:387:8 | operator= |
+| tests.cpp:320:39:320:41 | mc7 |
-| tests.cpp:387:8:387:14 | intPair |
+| tests.cpp:320:44:320:46 | mc8 |
-| tests.cpp:388:6:388:10 | first |
+| tests.cpp:320:49:320:51 | mc9 |
-| tests.cpp:389:6:389:11 | second |
+| tests.cpp:320:54:320:57 | mc10 |
-| tests.cpp:392:5:392:29 | madCallArg0ReturnToReturn |
+| tests.cpp:320:60:320:63 | mc11 |
-| tests.cpp:392:37:392:43 | fun_ptr |
+| tests.cpp:321:11:321:13 | ptr |
-| tests.cpp:393:9:393:38 | madCallArg0ReturnToReturnFirst |
+| tests.cpp:321:17:321:23 | mc4_ptr |
-| tests.cpp:393:46:393:52 | fun_ptr |
+| tests.cpp:322:17:322:19 | mdc |
-| tests.cpp:394:6:394:25 | madCallArg0WithValue |
+| tests.cpp:323:23:323:25 | mnc |
-| tests.cpp:394:34:394:40 | fun_ptr |
+| tests.cpp:323:28:323:31 | mnc2 |
-| tests.cpp:394:53:394:57 | value |
+| tests.cpp:324:24:324:31 | mnc2_ptr |
-| tests.cpp:395:5:395:36 | madCallReturnValueIgnoreFunction |
+| tests.cpp:330:6:330:6 | a |
-| tests.cpp:395:45:395:51 | fun_ptr |
+| tests.cpp:429:8:429:8 | operator= |
-| tests.cpp:395:64:395:68 | value |
+| tests.cpp:429:8:429:8 | operator= |
-| tests.cpp:397:5:397:14 | getTainted |
+| tests.cpp:429:8:429:14 | intPair |
-| tests.cpp:398:6:398:13 | useValue |
+| tests.cpp:430:6:430:10 | first |
-| tests.cpp:398:19:398:19 | x |
+| tests.cpp:431:6:431:11 | second |
-| tests.cpp:399:6:399:17 | dontUseValue |
+| tests.cpp:434:5:434:29 | madCallArg0ReturnToReturn |
-| tests.cpp:399:23:399:23 | x |
+| tests.cpp:434:37:434:43 | fun_ptr |
-| tests.cpp:401:6:401:27 | test_function_pointers |
+| tests.cpp:435:9:435:38 | madCallArg0ReturnToReturnFirst |
-| tests.cpp:414:19:414:19 | X |
+| tests.cpp:435:46:435:52 | fun_ptr |
-| tests.cpp:415:8:415:35 | StructWithTypedefInParameter<X> |
+| tests.cpp:436:6:436:25 | madCallArg0WithValue |
-| tests.cpp:415:8:415:35 | StructWithTypedefInParameter<int> |
+| tests.cpp:436:34:436:40 | fun_ptr |
-| tests.cpp:416:12:416:15 | Type |
+| tests.cpp:436:53:436:57 | value |
-| tests.cpp:417:5:417:31 | parameter_ref_to_return_ref |
+| tests.cpp:437:5:437:36 | madCallReturnValueIgnoreFunction |
-| tests.cpp:417:5:417:31 | parameter_ref_to_return_ref |
+| tests.cpp:437:45:437:51 | fun_ptr |
-| tests.cpp:417:45:417:45 | x |
+| tests.cpp:437:64:437:68 | value |
-| tests.cpp:417:45:417:45 | x |
+| tests.cpp:439:5:439:14 | getTainted |
-| tests.cpp:420:6:420:37 | test_parameter_ref_to_return_ref |
+| tests.cpp:440:6:440:13 | useValue |
-| tests.cpp:421:6:421:6 | x |
+| tests.cpp:440:19:440:19 | x |
-| tests.cpp:422:36:422:36 | s |
+| tests.cpp:441:6:441:17 | dontUseValue |
-| tests.cpp:423:6:423:6 | y |
+| tests.cpp:441:23:441:23 | x |
-| tests.cpp:427:7:427:9 | INT |
+| tests.cpp:443:6:443:27 | test_function_pointers |
-| tests.cpp:429:5:429:17 | receive_array |
+| tests.cpp:456:19:456:19 | X |
-| tests.cpp:429:23:429:23 | a |
+| tests.cpp:457:8:457:35 | StructWithTypedefInParameter<X> |
-| tests.cpp:431:6:431:23 | test_receive_array |
+| tests.cpp:457:8:457:35 | StructWithTypedefInParameter<int> |
-| tests.cpp:432:6:432:6 | x |
+| tests.cpp:458:12:458:15 | Type |
-| tests.cpp:433:6:433:10 | array |
+| tests.cpp:459:5:459:31 | parameter_ref_to_return_ref |
-| tests.cpp:434:6:434:6 | y |
+| tests.cpp:459:5:459:31 | parameter_ref_to_return_ref |
+| tests.cpp:459:45:459:45 | x |
+| tests.cpp:459:45:459:45 | x |
+| tests.cpp:462:6:462:37 | test_parameter_ref_to_return_ref |
+| tests.cpp:463:6:463:6 | x |
+| tests.cpp:464:36:464:36 | s |
+| tests.cpp:465:6:465:6 | y |
+| tests.cpp:469:7:469:9 | INT |
+| tests.cpp:471:5:471:17 | receive_array |
+| tests.cpp:471:23:471:23 | a |
+| tests.cpp:473:6:473:23 | test_receive_array |
+| tests.cpp:474:6:474:6 | x |
+| tests.cpp:475:6:475:10 | array |
+| tests.cpp:476:6:476:6 | y |
 flowSummaryNode
-| tests.cpp:127:5:127:19 | [summary param] 0 in madArg0ToReturn | ParameterNode | madArg0ToReturn | madArg0ToReturn |
+| tests.cpp:144:5:144:19 | [summary param] 0 in madArg0ToReturn | ParameterNode | madArg0ToReturn | madArg0ToReturn |
-| tests.cpp:127:5:127:19 | [summary] to write: ReturnValue in madArg0ToReturn | ReturnNode | madArg0ToReturn | madArg0ToReturn |
+| tests.cpp:144:5:144:19 | [summary] to write: ReturnValue in madArg0ToReturn | ReturnNode | madArg0ToReturn | madArg0ToReturn |
-| tests.cpp:128:6:128:28 | [summary param] 0 in madArg0ToReturnIndirect | ParameterNode | madArg0ToReturnIndirect | madArg0ToReturnIndirect |
+| tests.cpp:145:6:145:28 | [summary param] 0 in madArg0ToReturnIndirect | ParameterNode | madArg0ToReturnIndirect | madArg0ToReturnIndirect |
-| tests.cpp:128:6:128:28 | [summary] to write: ReturnValue[*] in madArg0ToReturnIndirect | ReturnNode | madArg0ToReturnIndirect | madArg0ToReturnIndirect |
+| tests.cpp:145:6:145:28 | [summary] to write: ReturnValue[*] in madArg0ToReturnIndirect | ReturnNode | madArg0ToReturnIndirect | madArg0ToReturnIndirect |
-| tests.cpp:130:5:130:28 | [summary param] 0 in madArg0ToReturnValueFlow | ParameterNode | madArg0ToReturnValueFlow | madArg0ToReturnValueFlow |
+| tests.cpp:147:5:147:28 | [summary param] 0 in madArg0ToReturnValueFlow | ParameterNode | madArg0ToReturnValueFlow | madArg0ToReturnValueFlow |
-| tests.cpp:130:5:130:28 | [summary] to write: ReturnValue in madArg0ToReturnValueFlow | ReturnNode | madArg0ToReturnValueFlow | madArg0ToReturnValueFlow |
+| tests.cpp:147:5:147:28 | [summary] to write: ReturnValue in madArg0ToReturnValueFlow | ReturnNode | madArg0ToReturnValueFlow | madArg0ToReturnValueFlow |
-| tests.cpp:131:5:131:27 | [summary param] *0 in madArg0IndirectToReturn | ParameterNode | madArg0IndirectToReturn | madArg0IndirectToReturn |
+| tests.cpp:148:5:148:27 | [summary param] *0 in madArg0IndirectToReturn | ParameterNode | madArg0IndirectToReturn | madArg0IndirectToReturn |
-| tests.cpp:131:5:131:27 | [summary] to write: ReturnValue in madArg0IndirectToReturn | ReturnNode | madArg0IndirectToReturn | madArg0IndirectToReturn |
+| tests.cpp:148:5:148:27 | [summary] to write: ReturnValue in madArg0IndirectToReturn | ReturnNode | madArg0IndirectToReturn | madArg0IndirectToReturn |
-| tests.cpp:132:5:132:33 | [summary param] **0 in madArg0DoubleIndirectToReturn | ParameterNode | madArg0DoubleIndirectToReturn | madArg0DoubleIndirectToReturn |
+| tests.cpp:149:5:149:33 | [summary param] **0 in madArg0DoubleIndirectToReturn | ParameterNode | madArg0DoubleIndirectToReturn | madArg0DoubleIndirectToReturn |
-| tests.cpp:132:5:132:33 | [summary] to write: ReturnValue in madArg0DoubleIndirectToReturn | ReturnNode | madArg0DoubleIndirectToReturn | madArg0DoubleIndirectToReturn |
+| tests.cpp:149:5:149:33 | [summary] to write: ReturnValue in madArg0DoubleIndirectToReturn | ReturnNode | madArg0DoubleIndirectToReturn | madArg0DoubleIndirectToReturn |
-| tests.cpp:133:5:133:30 | [summary param] 0 in madArg0NotIndirectToReturn | ParameterNode | madArg0NotIndirectToReturn | madArg0NotIndirectToReturn |
+| tests.cpp:150:5:150:30 | [summary param] 0 in madArg0NotIndirectToReturn | ParameterNode | madArg0NotIndirectToReturn | madArg0NotIndirectToReturn |
-| tests.cpp:133:5:133:30 | [summary] to write: ReturnValue in madArg0NotIndirectToReturn | ReturnNode | madArg0NotIndirectToReturn | madArg0NotIndirectToReturn |
+| tests.cpp:150:5:150:30 | [summary] to write: ReturnValue in madArg0NotIndirectToReturn | ReturnNode | madArg0NotIndirectToReturn | madArg0NotIndirectToReturn |
-| tests.cpp:134:6:134:26 | [summary param] 0 in madArg0ToArg1Indirect | ParameterNode | madArg0ToArg1Indirect | madArg0ToArg1Indirect |
+| tests.cpp:151:6:151:26 | [summary param] 0 in madArg0ToArg1Indirect | ParameterNode | madArg0ToArg1Indirect | madArg0ToArg1Indirect |
-| tests.cpp:134:6:134:26 | [summary param] *1 in madArg0ToArg1Indirect | ParameterNode | madArg0ToArg1Indirect | madArg0ToArg1Indirect |
+| tests.cpp:151:6:151:26 | [summary param] *1 in madArg0ToArg1Indirect | ParameterNode | madArg0ToArg1Indirect | madArg0ToArg1Indirect |
-| tests.cpp:134:6:134:26 | [summary] to write: Argument[*1] in madArg0ToArg1Indirect | PostUpdateNode | madArg0ToArg1Indirect | madArg0ToArg1Indirect |
+| tests.cpp:151:6:151:26 | [summary] to write: Argument[*1] in madArg0ToArg1Indirect | PostUpdateNode | madArg0ToArg1Indirect | madArg0ToArg1Indirect |
-| tests.cpp:135:6:135:34 | [summary param] *0 in madArg0IndirectToArg1Indirect | ParameterNode | madArg0IndirectToArg1Indirect | madArg0IndirectToArg1Indirect |
+| tests.cpp:152:6:152:34 | [summary param] *0 in madArg0IndirectToArg1Indirect | ParameterNode | madArg0IndirectToArg1Indirect | madArg0IndirectToArg1Indirect |
-| tests.cpp:135:6:135:34 | [summary param] *1 in madArg0IndirectToArg1Indirect | ParameterNode | madArg0IndirectToArg1Indirect | madArg0IndirectToArg1Indirect |
+| tests.cpp:152:6:152:34 | [summary param] *1 in madArg0IndirectToArg1Indirect | ParameterNode | madArg0IndirectToArg1Indirect | madArg0IndirectToArg1Indirect |
-| tests.cpp:135:6:135:34 | [summary] to write: Argument[*1] in madArg0IndirectToArg1Indirect | PostUpdateNode | madArg0IndirectToArg1Indirect | madArg0IndirectToArg1Indirect |
+| tests.cpp:152:6:152:34 | [summary] to write: Argument[*1] in madArg0IndirectToArg1Indirect | PostUpdateNode | madArg0IndirectToArg1Indirect | madArg0IndirectToArg1Indirect |
-| tests.cpp:136:5:136:18 | [summary param] 2 in madArgsComplex | ParameterNode | madArgsComplex | madArgsComplex |
+| tests.cpp:153:5:153:18 | [summary param] 2 in madArgsComplex | ParameterNode | madArgsComplex | madArgsComplex |
-| tests.cpp:136:5:136:18 | [summary param] *0 in madArgsComplex | ParameterNode | madArgsComplex | madArgsComplex |
+| tests.cpp:153:5:153:18 | [summary param] *0 in madArgsComplex | ParameterNode | madArgsComplex | madArgsComplex |
-| tests.cpp:136:5:136:18 | [summary param] *1 in madArgsComplex | ParameterNode | madArgsComplex | madArgsComplex |
+| tests.cpp:153:5:153:18 | [summary param] *1 in madArgsComplex | ParameterNode | madArgsComplex | madArgsComplex |
-| tests.cpp:136:5:136:18 | [summary] to write: ReturnValue in madArgsComplex | ReturnNode | madArgsComplex | madArgsComplex |
+| tests.cpp:153:5:153:18 | [summary] to write: ReturnValue in madArgsComplex | ReturnNode | madArgsComplex | madArgsComplex |
-| tests.cpp:138:5:138:28 | [summary param] 2 in madAndImplementedComplex | ParameterNode | madAndImplementedComplex | madAndImplementedComplex |
+| tests.cpp:155:5:155:28 | [summary param] 2 in madAndImplementedComplex | ParameterNode | madAndImplementedComplex | madAndImplementedComplex |
-| tests.cpp:138:5:138:28 | [summary] to write: ReturnValue in madAndImplementedComplex | ReturnNode | madAndImplementedComplex | madAndImplementedComplex |
+| tests.cpp:155:5:155:28 | [summary] to write: ReturnValue in madAndImplementedComplex | ReturnNode | madAndImplementedComplex | madAndImplementedComplex |
-| tests.cpp:143:5:143:24 | [summary param] 0 in madArg0FieldToReturn | ParameterNode | madArg0FieldToReturn | madArg0FieldToReturn |
+| tests.cpp:160:5:160:24 | [summary param] 0 in madArg0FieldToReturn | ParameterNode | madArg0FieldToReturn | madArg0FieldToReturn |
-| tests.cpp:143:5:143:24 | [summary] read: Argument[0].Field[MyContainer::value]/Field[value] in madArg0FieldToReturn |  | madArg0FieldToReturn | madArg0FieldToReturn |
+| tests.cpp:160:5:160:24 | [summary] read: Argument[0].Field[MyContainer::value]/Field[value] in madArg0FieldToReturn |  | madArg0FieldToReturn | madArg0FieldToReturn |
-| tests.cpp:143:5:143:24 | [summary] to write: ReturnValue in madArg0FieldToReturn | ReturnNode | madArg0FieldToReturn | madArg0FieldToReturn |
+| tests.cpp:160:5:160:24 | [summary] to write: ReturnValue in madArg0FieldToReturn | ReturnNode | madArg0FieldToReturn | madArg0FieldToReturn |
-| tests.cpp:144:5:144:32 | [summary param] *0 in madArg0IndirectFieldToReturn | ParameterNode | madArg0IndirectFieldToReturn | madArg0IndirectFieldToReturn |
+| tests.cpp:161:5:161:32 | [summary param] *0 in madArg0IndirectFieldToReturn | ParameterNode | madArg0IndirectFieldToReturn | madArg0IndirectFieldToReturn |
-| tests.cpp:144:5:144:32 | [summary] read: Argument[*0].Field[MyContainer::value]/Field[value] in madArg0IndirectFieldToReturn |  | madArg0IndirectFieldToReturn | madArg0IndirectFieldToReturn |
+| tests.cpp:161:5:161:32 | [summary] read: Argument[*0].Field[MyContainer::value]/Field[value] in madArg0IndirectFieldToReturn |  | madArg0IndirectFieldToReturn | madArg0IndirectFieldToReturn |
-| tests.cpp:144:5:144:32 | [summary] to write: ReturnValue in madArg0IndirectFieldToReturn | ReturnNode | madArg0IndirectFieldToReturn | madArg0IndirectFieldToReturn |
+| tests.cpp:161:5:161:32 | [summary] to write: ReturnValue in madArg0IndirectFieldToReturn | ReturnNode | madArg0IndirectFieldToReturn | madArg0IndirectFieldToReturn |
-| tests.cpp:145:5:145:32 | [summary param] 0 in madArg0FieldIndirectToReturn | ParameterNode | madArg0FieldIndirectToReturn | madArg0FieldIndirectToReturn |
+| tests.cpp:162:5:162:32 | [summary param] 0 in madArg0FieldIndirectToReturn | ParameterNode | madArg0FieldIndirectToReturn | madArg0FieldIndirectToReturn |
-| tests.cpp:145:5:145:32 | [summary] read: Argument[0].Field[*MyContainer::ptr]/Field[*ptr] in madArg0FieldIndirectToReturn |  | madArg0FieldIndirectToReturn | madArg0FieldIndirectToReturn |
+| tests.cpp:162:5:162:32 | [summary] read: Argument[0].Field[*MyContainer::ptr]/Field[*ptr] in madArg0FieldIndirectToReturn |  | madArg0FieldIndirectToReturn | madArg0FieldIndirectToReturn |
-| tests.cpp:145:5:145:32 | [summary] to write: ReturnValue in madArg0FieldIndirectToReturn | ReturnNode | madArg0FieldIndirectToReturn | madArg0FieldIndirectToReturn |
+| tests.cpp:162:5:162:32 | [summary] to write: ReturnValue in madArg0FieldIndirectToReturn | ReturnNode | madArg0FieldIndirectToReturn | madArg0FieldIndirectToReturn |
-| tests.cpp:146:13:146:32 | [summary param] 0 in madArg0ToReturnField | ParameterNode | madArg0ToReturnField | madArg0ToReturnField |
+| tests.cpp:163:13:163:32 | [summary param] 0 in madArg0ToReturnField | ParameterNode | madArg0ToReturnField | madArg0ToReturnField |
-| tests.cpp:146:13:146:32 | [summary] to write: ReturnValue in madArg0ToReturnField | ReturnNode | madArg0ToReturnField | madArg0ToReturnField |
+| tests.cpp:163:13:163:32 | [summary] to write: ReturnValue in madArg0ToReturnField | ReturnNode | madArg0ToReturnField | madArg0ToReturnField |
-| tests.cpp:146:13:146:32 | [summary] to write: ReturnValue.Field[MyContainer::value]/Field[value] in madArg0ToReturnField |  | madArg0ToReturnField | madArg0ToReturnField |
+| tests.cpp:163:13:163:32 | [summary] to write: ReturnValue.Field[MyContainer::value]/Field[value] in madArg0ToReturnField |  | madArg0ToReturnField | madArg0ToReturnField |
-| tests.cpp:147:14:147:41 | [summary param] 0 in madArg0ToReturnIndirectField | ParameterNode | madArg0ToReturnIndirectField | madArg0ToReturnIndirectField |
+| tests.cpp:164:14:164:41 | [summary param] 0 in madArg0ToReturnIndirectField | ParameterNode | madArg0ToReturnIndirectField | madArg0ToReturnIndirectField |
-| tests.cpp:147:14:147:41 | [summary] to write: ReturnValue[*] in madArg0ToReturnIndirectField | ReturnNode | madArg0ToReturnIndirectField | madArg0ToReturnIndirectField |
+| tests.cpp:164:14:164:41 | [summary] to write: ReturnValue[*] in madArg0ToReturnIndirectField | ReturnNode | madArg0ToReturnIndirectField | madArg0ToReturnIndirectField |
-| tests.cpp:147:14:147:41 | [summary] to write: ReturnValue[*].Field[MyContainer::value]/Field[value] in madArg0ToReturnIndirectField |  | madArg0ToReturnIndirectField | madArg0ToReturnIndirectField |
+| tests.cpp:164:14:164:41 | [summary] to write: ReturnValue[*].Field[MyContainer::value]/Field[value] in madArg0ToReturnIndirectField |  | madArg0ToReturnIndirectField | madArg0ToReturnIndirectField |
-| tests.cpp:148:13:148:40 | [summary param] 0 in madArg0ToReturnFieldIndirect | ParameterNode | madArg0ToReturnFieldIndirect | madArg0ToReturnFieldIndirect |
+| tests.cpp:165:13:165:40 | [summary param] 0 in madArg0ToReturnFieldIndirect | ParameterNode | madArg0ToReturnFieldIndirect | madArg0ToReturnFieldIndirect |
-| tests.cpp:148:13:148:40 | [summary] to write: ReturnValue in madArg0ToReturnFieldIndirect | ReturnNode | madArg0ToReturnFieldIndirect | madArg0ToReturnFieldIndirect |
+| tests.cpp:165:13:165:40 | [summary] to write: ReturnValue in madArg0ToReturnFieldIndirect | ReturnNode | madArg0ToReturnFieldIndirect | madArg0ToReturnFieldIndirect |
-| tests.cpp:148:13:148:40 | [summary] to write: ReturnValue.Field[*MyContainer::ptr]/Field[*ptr] in madArg0ToReturnFieldIndirect |  | madArg0ToReturnFieldIndirect | madArg0ToReturnFieldIndirect |
+| tests.cpp:165:13:165:40 | [summary] to write: ReturnValue.Field[*MyContainer::ptr]/Field[*ptr] in madArg0ToReturnFieldIndirect |  | madArg0ToReturnFieldIndirect | madArg0ToReturnFieldIndirect |
-| tests.cpp:250:7:250:19 | [summary param] 0 in madArg0ToSelf | ParameterNode | madArg0ToSelf | madArg0ToSelf |
+| tests.cpp:284:7:284:19 | [summary param] 0 in madArg0ToSelf | ParameterNode | madArg0ToSelf | madArg0ToSelf |
-| tests.cpp:250:7:250:19 | [summary param] this in madArg0ToSelf | ParameterNode | madArg0ToSelf | madArg0ToSelf |
+| tests.cpp:284:7:284:19 | [summary param] this in madArg0ToSelf | ParameterNode | madArg0ToSelf | madArg0ToSelf |
-| tests.cpp:250:7:250:19 | [summary] to write: Argument[this] in madArg0ToSelf | PostUpdateNode | madArg0ToSelf | madArg0ToSelf |
+| tests.cpp:284:7:284:19 | [summary] to write: Argument[this] in madArg0ToSelf | PostUpdateNode | madArg0ToSelf | madArg0ToSelf |
-| tests.cpp:251:6:251:20 | [summary param] this in madSelfToReturn | ParameterNode | madSelfToReturn | madSelfToReturn |
+| tests.cpp:285:6:285:20 | [summary param] this in madSelfToReturn | ParameterNode | madSelfToReturn | madSelfToReturn |
-| tests.cpp:251:6:251:20 | [summary] to write: ReturnValue in madSelfToReturn | ReturnNode | madSelfToReturn | madSelfToReturn |
+| tests.cpp:285:6:285:20 | [summary] to write: ReturnValue in madSelfToReturn | ReturnNode | madSelfToReturn | madSelfToReturn |
-| tests.cpp:253:7:253:20 | [summary param] 0 in madArg0ToField | ParameterNode | madArg0ToField | madArg0ToField |
+| tests.cpp:287:7:287:20 | [summary param] 0 in madArg0ToField | ParameterNode | madArg0ToField | madArg0ToField |
-| tests.cpp:253:7:253:20 | [summary param] this in madArg0ToField | ParameterNode | madArg0ToField | madArg0ToField |
+| tests.cpp:287:7:287:20 | [summary param] this in madArg0ToField | ParameterNode | madArg0ToField | madArg0ToField |
-| tests.cpp:253:7:253:20 | [summary] to write: Argument[this] in madArg0ToField | PostUpdateNode | madArg0ToField | madArg0ToField |
+| tests.cpp:287:7:287:20 | [summary] to write: Argument[this] in madArg0ToField | PostUpdateNode | madArg0ToField | madArg0ToField |
-| tests.cpp:253:7:253:20 | [summary] to write: Argument[this].Field[MyClass::val]/Field[val] in madArg0ToField |  | madArg0ToField | madArg0ToField |
+| tests.cpp:287:7:287:20 | [summary] to write: Argument[this].Field[MyClass::val]/Field[val] in madArg0ToField |  | madArg0ToField | madArg0ToField |
-| tests.cpp:254:6:254:21 | [summary param] this in madFieldToReturn | ParameterNode | madFieldToReturn | madFieldToReturn |
+| tests.cpp:288:6:288:21 | [summary param] this in madFieldToReturn | ParameterNode | madFieldToReturn | madFieldToReturn |
-| tests.cpp:254:6:254:21 | [summary] read: Argument[this].Field[MyClass::val]/Field[val] in madFieldToReturn |  | madFieldToReturn | madFieldToReturn |
+| tests.cpp:288:6:288:21 | [summary] read: Argument[this].Field[MyClass::val]/Field[val] in madFieldToReturn |  | madFieldToReturn | madFieldToReturn |
-| tests.cpp:254:6:254:21 | [summary] to write: ReturnValue in madFieldToReturn | ReturnNode | madFieldToReturn | madFieldToReturn |
+| tests.cpp:288:6:288:21 | [summary] to write: ReturnValue in madFieldToReturn | ReturnNode | madFieldToReturn | madFieldToReturn |
-| tests.cpp:277:7:277:30 | [summary param] this in namespaceMadSelfToReturn | ParameterNode | namespaceMadSelfToReturn | namespaceMadSelfToReturn |
+| tests.cpp:313:7:313:30 | [summary param] this in namespaceMadSelfToReturn | ParameterNode | namespaceMadSelfToReturn | namespaceMadSelfToReturn |
-| tests.cpp:277:7:277:30 | [summary] to write: ReturnValue in namespaceMadSelfToReturn | ReturnNode | namespaceMadSelfToReturn | namespaceMadSelfToReturn |
+| tests.cpp:313:7:313:30 | [summary] to write: ReturnValue in namespaceMadSelfToReturn | ReturnNode | namespaceMadSelfToReturn | namespaceMadSelfToReturn |
-| tests.cpp:392:5:392:29 | [summary param] 0 in madCallArg0ReturnToReturn | ParameterNode | madCallArg0ReturnToReturn | madCallArg0ReturnToReturn |
+| tests.cpp:434:5:434:29 | [summary param] 0 in madCallArg0ReturnToReturn | ParameterNode | madCallArg0ReturnToReturn | madCallArg0ReturnToReturn |
-| tests.cpp:392:5:392:29 | [summary] read: Argument[0].Parameter[this pointer] in madCallArg0ReturnToReturn | PostUpdateNode | madCallArg0ReturnToReturn | madCallArg0ReturnToReturn |
+| tests.cpp:434:5:434:29 | [summary] read: Argument[0].Parameter[this pointer] in madCallArg0ReturnToReturn | PostUpdateNode | madCallArg0ReturnToReturn | madCallArg0ReturnToReturn |
-| tests.cpp:392:5:392:29 | [summary] read: Argument[0].ReturnValue in madCallArg0ReturnToReturn | OutNode | madCallArg0ReturnToReturn | madCallArg0ReturnToReturn |
+| tests.cpp:434:5:434:29 | [summary] read: Argument[0].ReturnValue in madCallArg0ReturnToReturn | OutNode | madCallArg0ReturnToReturn | madCallArg0ReturnToReturn |
-| tests.cpp:392:5:392:29 | [summary] to write: Argument[0].Parameter[this pointer] in madCallArg0ReturnToReturn | ArgumentNode | madCallArg0ReturnToReturn | madCallArg0ReturnToReturn |
+| tests.cpp:434:5:434:29 | [summary] to write: Argument[0].Parameter[this pointer] in madCallArg0ReturnToReturn | ArgumentNode | madCallArg0ReturnToReturn | madCallArg0ReturnToReturn |
-| tests.cpp:392:5:392:29 | [summary] to write: ReturnValue in madCallArg0ReturnToReturn | ReturnNode | madCallArg0ReturnToReturn | madCallArg0ReturnToReturn |
+| tests.cpp:434:5:434:29 | [summary] to write: ReturnValue in madCallArg0ReturnToReturn | ReturnNode | madCallArg0ReturnToReturn | madCallArg0ReturnToReturn |
-| tests.cpp:393:9:393:38 | [summary param] 0 in madCallArg0ReturnToReturnFirst | ParameterNode | madCallArg0ReturnToReturnFirst | madCallArg0ReturnToReturnFirst |
+| tests.cpp:435:9:435:38 | [summary param] 0 in madCallArg0ReturnToReturnFirst | ParameterNode | madCallArg0ReturnToReturnFirst | madCallArg0ReturnToReturnFirst |
-| tests.cpp:393:9:393:38 | [summary] read: Argument[0].Parameter[this pointer] in madCallArg0ReturnToReturnFirst | PostUpdateNode | madCallArg0ReturnToReturnFirst | madCallArg0ReturnToReturnFirst |
+| tests.cpp:435:9:435:38 | [summary] read: Argument[0].Parameter[this pointer] in madCallArg0ReturnToReturnFirst | PostUpdateNode | madCallArg0ReturnToReturnFirst | madCallArg0ReturnToReturnFirst |
-| tests.cpp:393:9:393:38 | [summary] read: Argument[0].ReturnValue in madCallArg0ReturnToReturnFirst | OutNode | madCallArg0ReturnToReturnFirst | madCallArg0ReturnToReturnFirst |
+| tests.cpp:435:9:435:38 | [summary] read: Argument[0].ReturnValue in madCallArg0ReturnToReturnFirst | OutNode | madCallArg0ReturnToReturnFirst | madCallArg0ReturnToReturnFirst |
-| tests.cpp:393:9:393:38 | [summary] to write: Argument[0].Parameter[this pointer] in madCallArg0ReturnToReturnFirst | ArgumentNode | madCallArg0ReturnToReturnFirst | madCallArg0ReturnToReturnFirst |
+| tests.cpp:435:9:435:38 | [summary] to write: Argument[0].Parameter[this pointer] in madCallArg0ReturnToReturnFirst | ArgumentNode | madCallArg0ReturnToReturnFirst | madCallArg0ReturnToReturnFirst |
-| tests.cpp:393:9:393:38 | [summary] to write: ReturnValue in madCallArg0ReturnToReturnFirst | ReturnNode | madCallArg0ReturnToReturnFirst | madCallArg0ReturnToReturnFirst |
+| tests.cpp:435:9:435:38 | [summary] to write: ReturnValue in madCallArg0ReturnToReturnFirst | ReturnNode | madCallArg0ReturnToReturnFirst | madCallArg0ReturnToReturnFirst |
-| tests.cpp:393:9:393:38 | [summary] to write: ReturnValue.Field[first]/Field[intPair::first] in madCallArg0ReturnToReturnFirst |  | madCallArg0ReturnToReturnFirst | madCallArg0ReturnToReturnFirst |
+| tests.cpp:435:9:435:38 | [summary] to write: ReturnValue.Field[first]/Field[intPair::first] in madCallArg0ReturnToReturnFirst |  | madCallArg0ReturnToReturnFirst | madCallArg0ReturnToReturnFirst |
-| tests.cpp:394:6:394:25 | [summary param] 0 in madCallArg0WithValue | ParameterNode | madCallArg0WithValue | madCallArg0WithValue |
+| tests.cpp:436:6:436:25 | [summary param] 0 in madCallArg0WithValue | ParameterNode | madCallArg0WithValue | madCallArg0WithValue |
-| tests.cpp:394:6:394:25 | [summary param] 1 in madCallArg0WithValue | ParameterNode | madCallArg0WithValue | madCallArg0WithValue |
+| tests.cpp:436:6:436:25 | [summary param] 1 in madCallArg0WithValue | ParameterNode | madCallArg0WithValue | madCallArg0WithValue |
-| tests.cpp:394:6:394:25 | [summary] read: Argument[0].Parameter[0] in madCallArg0WithValue | PostUpdateNode | madCallArg0WithValue | madCallArg0WithValue |
+| tests.cpp:436:6:436:25 | [summary] read: Argument[0].Parameter[0] in madCallArg0WithValue | PostUpdateNode | madCallArg0WithValue | madCallArg0WithValue |
-| tests.cpp:394:6:394:25 | [summary] read: Argument[0].Parameter[this pointer] in madCallArg0WithValue | PostUpdateNode | madCallArg0WithValue | madCallArg0WithValue |
+| tests.cpp:436:6:436:25 | [summary] read: Argument[0].Parameter[this pointer] in madCallArg0WithValue | PostUpdateNode | madCallArg0WithValue | madCallArg0WithValue |
-| tests.cpp:394:6:394:25 | [summary] to write: Argument[0].Parameter[0] in madCallArg0WithValue | ArgumentNode | madCallArg0WithValue | madCallArg0WithValue |
+| tests.cpp:436:6:436:25 | [summary] to write: Argument[0].Parameter[0] in madCallArg0WithValue | ArgumentNode | madCallArg0WithValue | madCallArg0WithValue |
-| tests.cpp:394:6:394:25 | [summary] to write: Argument[0].Parameter[this pointer] in madCallArg0WithValue | ArgumentNode | madCallArg0WithValue | madCallArg0WithValue |
+| tests.cpp:436:6:436:25 | [summary] to write: Argument[0].Parameter[this pointer] in madCallArg0WithValue | ArgumentNode | madCallArg0WithValue | madCallArg0WithValue |
-| tests.cpp:394:6:394:25 | [summary] to write: Argument[1] in madCallArg0WithValue | PostUpdateNode | madCallArg0WithValue | madCallArg0WithValue |
+| tests.cpp:436:6:436:25 | [summary] to write: Argument[1] in madCallArg0WithValue | PostUpdateNode | madCallArg0WithValue | madCallArg0WithValue |
-| tests.cpp:395:5:395:36 | [summary param] 1 in madCallReturnValueIgnoreFunction | ParameterNode | madCallReturnValueIgnoreFunction | madCallReturnValueIgnoreFunction |
+| tests.cpp:437:5:437:36 | [summary param] 1 in madCallReturnValueIgnoreFunction | ParameterNode | madCallReturnValueIgnoreFunction | madCallReturnValueIgnoreFunction |
-| tests.cpp:395:5:395:36 | [summary] to write: ReturnValue in madCallReturnValueIgnoreFunction | ReturnNode | madCallReturnValueIgnoreFunction | madCallReturnValueIgnoreFunction |
+| tests.cpp:437:5:437:36 | [summary] to write: ReturnValue in madCallReturnValueIgnoreFunction | ReturnNode | madCallReturnValueIgnoreFunction | madCallReturnValueIgnoreFunction |
-| tests.cpp:417:5:417:31 | [summary param] *0 in parameter_ref_to_return_ref | ParameterNode | parameter_ref_to_return_ref | parameter_ref_to_return_ref |
+| tests.cpp:459:5:459:31 | [summary param] *0 in parameter_ref_to_return_ref | ParameterNode | parameter_ref_to_return_ref | parameter_ref_to_return_ref |
-| tests.cpp:417:5:417:31 | [summary] to write: ReturnValue[*] in parameter_ref_to_return_ref | ReturnNode | parameter_ref_to_return_ref | parameter_ref_to_return_ref |
+| tests.cpp:459:5:459:31 | [summary] to write: ReturnValue[*] in parameter_ref_to_return_ref | ReturnNode | parameter_ref_to_return_ref | parameter_ref_to_return_ref |
-| tests.cpp:429:5:429:17 | [summary param] *0 in receive_array | ParameterNode | receive_array | receive_array |
+| tests.cpp:471:5:471:17 | [summary param] *0 in receive_array | ParameterNode | receive_array | receive_array |
-| tests.cpp:429:5:429:17 | [summary] to write: ReturnValue in receive_array | ReturnNode | receive_array | receive_array |
+| tests.cpp:471:5:471:17 | [summary] to write: ReturnValue in receive_array | ReturnNode | receive_array | receive_array |

cpp/ql/test/library-tests/dataflow/models-as-data/testModels.ext.yml

@@ -11,12 +11,15 @@ extensions:
       - ["", "", False, "remoteMadSourceDoubleIndirect", "", "", "ReturnValue[**]", "remote", "manual"]
       - ["", "", False, "remoteMadSourceIndirectArg0", "", "", "Argument[*0]", "remote", "manual"]
       - ["", "", False, "remoteMadSourceIndirectArg1", "", "", "Argument[*1]", "remote", "manual"]
+      - ["", "", False, "remoteMadSourceVar", "", "", "", "remote", "manual"]
+      - ["", "", False, "remoteMadSourceVarIndirect", "", "", "*", "remote", "manual"] # we can't express this source/sink correctly at present, "*" is not a valid access path
       - ["", "", False, "remoteMadSourceParam0", "", "", "Parameter[0]", "remote", "manual"]
       - ["MyNamespace", "", False, "namespaceLocalMadSource", "", "", "ReturnValue", "local", "manual"]
       - ["MyNamespace", "", False, "namespaceLocalMadSourceVar", "", "", "", "local", "manual"]
       - ["MyNamespace::MyNamespace2", "", False, "namespace2LocalMadSource", "", "", "ReturnValue", "local", "manual"]
       - ["", "MyClass", True, "memberRemoteMadSource", "", "", "ReturnValue", "remote", "manual"]
       - ["", "MyClass", True, "memberRemoteMadSourceIndirectArg0", "", "", "Argument[*0]", "remote", "manual"]
+      - ["", "MyClass", True, "memberRemoteMadSourceVar", "", "", "", "remote", "manual"]
       - ["", "MyClass", True, "subtypeRemoteMadSource1", "", "", "ReturnValue", "remote", "manual"]
       - ["", "MyClass", False, "subtypeNonSource", "", "", "ReturnValue", "remote", "manual"] # the tests define this in MyDerivedClass, so it should *not* be recongized as a source
       - ["", "MyClass", True, "qualifierSource", "", "", "Argument[-1]", "remote", "manual"]
@@ -32,13 +35,18 @@ extensions:
       - ["", "", False, "madSinkArg02", "", "", "Argument[0,2]", "test-sink", "manual"]
       - ["", "", False, "madSinkIndirectArg0", "", "", "Argument[*0]", "test-sink", "manual"]
       - ["", "", False, "madSinkDoubleIndirectArg0", "", "", "Argument[**0]", "test-sink", "manual"]
+      - ["", "", False, "madSinkVar", "", "", "", "test-sink", "manual"]
+      - ["", "", False, "madSinkVarIndirect", "", "", "*", "test-sink", "manual"] # we can't express this source/sink correctly at present, "*" is not a valid access path
       - ["", "", False, "madSinkParam0", "", "", "Parameter[0]", "test-sink", "manual"]
       - ["", "MyClass", True, "memberMadSinkArg0", "", "", "Argument[0]", "test-sink", "manual"]
+      - ["", "MyClass", True, "memberMadSinkVar", "", "", "", "test-sink", "manual"]
       - ["", "MyClass", True, "qualifierSink", "", "", "Argument[-1]", "test-sink", "manual"]
       - ["", "MyClass", True, "qualifierArg0Sink", "", "", "Argument[-1..0]", "test-sink", "manual"]
       - ["", "MyClass", True, "qualifierFieldSink", "", "", "Argument[-1].val", "test-sink", "manual"]
       - ["MyNamespace", "MyClass", True, "namespaceMemberMadSinkArg0", "", "", "Argument[0]", "test-sink", "manual"]
       - ["MyNamespace", "MyClass", True, "namespaceStaticMemberMadSinkArg0", "", "", "Argument[0]", "test-sink", "manual"]
+      - ["MyNamespace", "MyClass", True, "namespaceMemberMadSinkVar", "", "", "", "test-sink", "manual"]
+      - ["MyNamespace", "MyClass", True, "namespaceStaticMemberMadSinkVar", "", "", "", "test-sink", "manual"]
   - addsTo:
       pack: codeql/cpp-all
       extensible: summaryModel
@@ -60,6 +68,9 @@ extensions:
       - ["", "", False, "madArg0ToReturnField", "", "", "Argument[0]", "ReturnValue.Field[value]", "taint", "manual"]
       - ["", "", False, "madArg0ToReturnIndirectField", "", "", "Argument[0]", "ReturnValue[*].Field[value]", "taint", "manual"]
       - ["", "", False, "madArg0ToReturnFieldIndirect", "", "", "Argument[0]", "ReturnValue.Field[*ptr]", "taint", "manual"]
+      - ["", "", False, "madFieldToFieldVar", "", "", "Field[value]", "Field[value2]", "taint", "manual"] # we can't express this source/sink correctly at present, "Field[value]" is not a valid input and "Field[value2]" is not a valid output
+      - ["", "", False, "madFieldToIndirectFieldVar", "", "", "Field[value]", "Field[*ptr]", "taint", "manual"] # we can't express this source/sink correctly at present, "Field[value]" is not a valid input and "Field[*ptr]" is not a valid output
+      - ["", "", False, "madIndirectFieldToFieldVar", "", "", "Field[value]", "Field[value2]", "taint", "manual"] # we can't express this source/sink correctly at present, "Field[value]" is not a valid input and "Field[value2]" is not a valid output
       - ["", "MyClass", True, "madArg0ToSelf", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
       - ["", "MyClass", True, "madSelfToReturn", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
       - ["", "MyClass", True, "madArg0ToField", "", "", "Argument[0]", "Argument[-1].Field[val]", "taint", "manual"]

cpp/ql/test/library-tests/dataflow/models-as-data/tests.cpp

@@ -17,8 +17,13 @@ int *remoteMadSourceIndirect(); // $ interpretElement
 int **remoteMadSourceDoubleIndirect(); // $ interpretElement
 void remoteMadSourceIndirectArg0(int *x, int *y); // $ interpretElement
 void remoteMadSourceIndirectArg1(int &x, int &y); // $ interpretElement
+int remoteMadSourceVar; // $ interpretElement
+int *remoteMadSourceVarIndirect; // $ interpretElement
 
 namespace MyNamespace {
+	int namespaceLocalMadSource(); // $ interpretElement
+	int namespaceLocalMadSourceVar; // $ interpretElement
+
 	namespace MyNamespace2 {
 		int namespace2LocalMadSource(); // $ interpretElement
 	}
@@ -64,9 +69,14 @@ void test_sources() {
 	sink(c);
 	sink(d); // $ ir
 
+	sink(remoteMadSourceVar); // $ ir
+	sink(*remoteMadSourceVarIndirect); // $ MISSING: ir
+
 	int e = localMadSource();
 	sink(e); // $ ir
 
+	sink(MyNamespace::namespaceLocalMadSource()); // $ ir
+	sink(MyNamespace::namespaceLocalMadSourceVar); // $ ir
 	sink(MyNamespace::MyNamespace2::namespace2LocalMadSource()); // $ ir
 	sink(MyNamespace::localMadSource()); // $ (the MyNamespace version of this function is not a source)
 	sink(namespaceLocalMadSource()); // (the global namespace version of this function is not a source)
@@ -86,8 +96,8 @@ void madSinkArg01(int x, int y, int z); // $ interpretElement
 void madSinkArg02(int x, int y, int z); // $ interpretElement
 void madSinkIndirectArg0(int *x); // $ interpretElement
 void madSinkDoubleIndirectArg0(int **x); // $ interpretElement
-
+int madSinkVar; // $ interpretElement
-
+int *madSinkVarIndirect; // $ interpretElement
 
 void test_sinks() {
 	// test sinks
@@ -108,8 +118,15 @@ void test_sinks() {
 	madSinkIndirectArg0(&a); // $ ir
 	madSinkIndirectArg0(a_ptr); // $ ir
 	madSinkDoubleIndirectArg0(&a_ptr); // $ ir
+
+	madSinkVar = source();  // $ ir
+
+	// test sources + sinks together
+
 	madSinkArg0(localMadSource()); // $ ir
 	madSinkIndirectArg0(remoteMadSourceIndirect()); // $ ir
+	madSinkVar = remoteMadSourceVar; // $ ir
+	*madSinkVarIndirect = remoteMadSourceVar; // $ MISSING: ir
 }
 
 void madSinkParam0(int x) { // $ interpretElement
@@ -147,6 +164,10 @@ MyContainer madArg0ToReturnField(int x); // $ interpretElement
 MyContainer *madArg0ToReturnIndirectField(int x); // $ interpretElement
 MyContainer madArg0ToReturnFieldIndirect(int x); // $ interpretElement
 
+MyContainer madFieldToFieldVar; // $ interpretElement
+MyContainer madFieldToIndirectFieldVar; // $ interpretElement
+MyContainer *madIndirectFieldToFieldVar; // $ interpretElement
+
 void test_summaries() {
 	// test summaries
 
@@ -220,6 +241,19 @@ void test_summaries() {
 	int *rtn2_ptr = rtn2.ptr;
 	sink(*rtn2_ptr); // $ ir
 
+	// test global variable summaries
+
+	madFieldToFieldVar.value = source();
+	sink(madFieldToFieldVar.value2); // $ MISSING: ir
+
+	madFieldToIndirectFieldVar.value = source();
+	sink(madFieldToIndirectFieldVar.ptr);
+	sink(*(madFieldToIndirectFieldVar.ptr)); // $ MISSING: ir
+
+	madIndirectFieldToFieldVar->value = source();
+	sink((*madIndirectFieldToFieldVar).value2); // $ MISSING: ir
+	sink(madIndirectFieldToFieldVar->value2); // $ MISSING: ir
+
 	// test source + sinks + summaries together
 
 	madSinkArg0(madArg0ToReturn(remoteMadSource())); // $ ir
@@ -235,13 +269,13 @@ public:
 	// sources
 	int memberRemoteMadSource(); // $ interpretElement
 	void memberRemoteMadSourceIndirectArg0(int *x); // $ interpretElement
-	
+	int memberRemoteMadSourceVar; // $ interpretElement
 	void qualifierSource(); // $ interpretElement
 	void qualifierFieldSource(); // $ interpretElement
 
 	// sinks
 	void memberMadSinkArg0(int x); // $ interpretElement
-
+	int memberMadSinkVar; // $ interpretElement
 	void qualifierSink(); // $ interpretElement
 	void qualifierArg0Sink(int x); // $ interpretElement
 	void qualifierFieldSink(); // $ interpretElement
@@ -272,6 +306,8 @@ namespace MyNamespace {
 		// sinks
 		void namespaceMemberMadSinkArg0(int x); // $ interpretElement
 		static void namespaceStaticMemberMadSinkArg0(int x); // $ interpretElement
+		int namespaceMemberMadSinkVar; // $ interpretElement
+		static int namespaceStaticMemberMadSinkVar; // $ interpretElement
 
 		// summaries
 		int namespaceMadSelfToReturn(); // $ interpretElement
@@ -295,6 +331,8 @@ void test_class_members() {
 	mc.memberRemoteMadSourceIndirectArg0(&a);
 	sink(a); // $ ir
 
+	sink(mc.memberRemoteMadSourceVar); // $ ir
+
 	// test subtype sources
 
 	sink(mdc.memberRemoteMadSource()); // $ ir
@@ -306,8 +344,12 @@ void test_class_members() {
 
 	mc.memberMadSinkArg0(source()); // $ ir
 
+	mc.memberMadSinkVar = source(); // $ ir
+
 	mnc.namespaceMemberMadSinkArg0(source()); // $ ir
 	MyNamespace::MyClass::namespaceStaticMemberMadSinkArg0(source()); // $ ir
+	mnc.namespaceMemberMadSinkVar = source(); // $ ir
+	MyNamespace::MyClass::namespaceStaticMemberMadSinkVar = source(); // $ ir
 
 	// test class member summaries
 

csharp/ql/integration-tests/windows/subst/code/Program.cs

@@ -1,4 +0,0 @@
-class Program
-{
-    static void Main() {}
-}

csharp/ql/integration-tests/windows/subst/code/dotnet_build.csproj

@@ -1,10 +0,0 @@
-<Project Sdk="Microsoft.NET.Sdk">
-
-  <PropertyGroup>
-    <OutputType>Exe</OutputType>
-    <TargetFramework>net9.0</TargetFramework>
-    <ImplicitUsings>enable</ImplicitUsings>
-    <Nullable>enable</Nullable>
-  </PropertyGroup>
-
-</Project>

csharp/ql/integration-tests/windows/subst/code/global.json

@@ -1,5 +0,0 @@
-{
-    "sdk": {
-        "version": "9.0.201"
-    }
-}

csharp/ql/integration-tests/windows/subst/file.expected

@@ -1,8 +0,0 @@
-| code/Program.cs:0:0:0:0 | code/Program.cs |  |
-| code/obj/Debug/net9.0/.NETCoreApp,Version=v9.0.AssemblyAttributes.cs:0:0:0:0 | code/obj/Debug/net9.0/.NETCoreApp,Version=v9.0.AssemblyAttributes.cs |  |
-| code/obj/Debug/net9.0/dotnet_build.AssemblyInfo.cs:0:0:0:0 | code/obj/Debug/net9.0/dotnet_build.AssemblyInfo.cs |  |
-| code/obj/Debug/net9.0/dotnet_build.GlobalUsings.g.cs:0:0:0:0 | code/obj/Debug/net9.0/dotnet_build.GlobalUsings.g.cs |  |
-| code/obj/Debug/net9.0/dotnet_build.dll:0:0:0:0 | code/obj/Debug/net9.0/dotnet_build.dll |  |
-| file://:0:0:0:0 |  |  |
-| file://Z:/dotnet_build.csproj:0:0:0:0 | Z:/dotnet_build.csproj | relative |
-| file://Z:/obj/dotnet_build.csproj.nuget.g.props:0:0:0:0 | Z:/obj/dotnet_build.csproj.nuget.g.props | relative |

csharp/ql/integration-tests/windows/subst/file.ql

@@ -1,7 +0,0 @@
-import csharp
-
-from File f, string relative
-where
-  not f.getURL().matches("file://C:/Program Files/%") and
-  if exists(f.getRelativePath()) then relative = "relative" else relative = ""
-select f, relative

csharp/ql/integration-tests/windows/subst/test.py

@@ -1,7 +0,0 @@
-import runs_on
-
-
-@runs_on.windows
-def test(codeql, csharp, cwd, subst_drive):
-    drive = subst_drive(cwd / "code")
-    codeql.database.create(source_root=drive)

go/BUILD.bazel

@@ -56,19 +56,9 @@ codeql_pkg_files(
     prefix = "tools/{CODEQL_PLATFORM}",
 )
 
-codeql_pkg_files(
-    name = "canonicalize-dll",
-    srcs = select({
-        "@platforms//os:windows": ["//shared/canonicalize:pkg"],
-        "//conditions:default": [],
-    }),
-    prefix = "tools/{CODEQL_PLATFORM}",
-)
-
 codeql_pack(
     name = "go",
     srcs = [
-        ":canonicalize-dll",
         ":extractor-pack-arch",
         ":resources",
         "//go/codeql-tools",

go/documentation/library-coverage/coverage.csv

@@ -123,7 +123,7 @@ k8s.io/api/core,,,10,,,,,,,,,,,,,,,,,,,,,,,10,
 k8s.io/apimachinery/pkg/runtime,,,47,,,,,,,,,,,,,,,,,,,,,,,47,
 k8s.io/klog,90,,,,,,90,,,,,,,,,,,,,,,,,,,,
 launchpad.net/xmlpath,2,,,,,,,,,,,,,,,,,,2,,,,,,,,
-log,43,,16,,,,43,,,,,,,,,,,,,,,,,,,16,
+log,40,,3,,,,40,,,,,,,,,,,,,,,,,,,3,
 math/big,,,1,,,,,,,,,,,,,,,,,,,,,,,1,
 mime,,,14,,,,,,,,,,,,,,,,,,,,,,,14,
 net,2,16,100,,,,,,1,,,,,,,,1,,,,,,,16,,100,

go/documentation/library-coverage/coverage.rst

@@ -32,7 +32,7 @@ Go framework & library support
    `Revel <http://revel.github.io/>`_,"``github.com/revel/revel*``, ``github.com/robfig/revel*``",46,20,4
    `SendGrid <https://github.com/sendgrid/sendgrid-go>`_,``github.com/sendgrid/sendgrid-go*``,,1,
    `Squirrel <https://github.com/Masterminds/squirrel>`_,"``github.com/Masterminds/squirrel*``, ``github.com/lann/squirrel*``, ``gopkg.in/Masterminds/squirrel``",81,,96
-   `Standard library <https://pkg.go.dev/std>`_,"````, ``archive/*``, ``bufio``, ``bytes``, ``cmp``, ``compress/*``, ``container/*``, ``context``, ``crypto``, ``crypto/*``, ``database/*``, ``debug/*``, ``embed``, ``encoding``, ``encoding/*``, ``errors``, ``expvar``, ``flag``, ``fmt``, ``go/*``, ``hash``, ``hash/*``, ``html``, ``html/*``, ``image``, ``image/*``, ``index/*``, ``io``, ``io/*``, ``log``, ``log/*``, ``maps``, ``math``, ``math/*``, ``mime``, ``mime/*``, ``net``, ``net/*``, ``os``, ``os/*``, ``path``, ``path/*``, ``plugin``, ``reflect``, ``reflect/*``, ``regexp``, ``regexp/*``, ``slices``, ``sort``, ``strconv``, ``strings``, ``sync``, ``sync/*``, ``syscall``, ``syscall/*``, ``testing``, ``testing/*``, ``text/*``, ``time``, ``time/*``, ``unicode``, ``unicode/*``, ``unsafe``, ``weak``",52,625,127
+   `Standard library <https://pkg.go.dev/std>`_,"````, ``archive/*``, ``bufio``, ``bytes``, ``cmp``, ``compress/*``, ``container/*``, ``context``, ``crypto``, ``crypto/*``, ``database/*``, ``debug/*``, ``embed``, ``encoding``, ``encoding/*``, ``errors``, ``expvar``, ``flag``, ``fmt``, ``go/*``, ``hash``, ``hash/*``, ``html``, ``html/*``, ``image``, ``image/*``, ``index/*``, ``io``, ``io/*``, ``log``, ``log/*``, ``maps``, ``math``, ``math/*``, ``mime``, ``mime/*``, ``net``, ``net/*``, ``os``, ``os/*``, ``path``, ``path/*``, ``plugin``, ``reflect``, ``reflect/*``, ``regexp``, ``regexp/*``, ``slices``, ``sort``, ``strconv``, ``strings``, ``sync``, ``sync/*``, ``syscall``, ``syscall/*``, ``testing``, ``testing/*``, ``text/*``, ``time``, ``time/*``, ``unicode``, ``unicode/*``, ``unsafe``, ``weak``",52,612,124
    `XORM <https://xorm.io>`_,"``github.com/go-xorm/xorm*``, ``xorm.io/xorm*``",,,68
    `XPath <https://github.com/antchfx/xpath>`_,``github.com/antchfx/xpath*``,,,4
    `appleboy/gin-jwt <https://github.com/appleboy/gin-jwt>`_,``github.com/appleboy/gin-jwt*``,,,1
@@ -74,5 +74,5 @@ Go framework & library support
    `xpathparser <https://github.com/santhosh-tekuri/xpathparser>`_,``github.com/santhosh-tekuri/xpathparser*``,,,2
    `yaml <https://gopkg.in/yaml.v3>`_,``gopkg.in/yaml*``,,9,
    `zap <https://go.uber.org/zap>`_,``go.uber.org/zap*``,,11,33
-   Totals,,688,1085,1580
+   Totals,,688,1072,1577
 

go/extractor/BUILD.bazel

@@ -16,7 +16,6 @@ go_library(
     importpath = "github.com/github/codeql-go/extractor",
     visibility = ["//visibility:public"],
     deps = [
-        "//go/extractor/canonicalize",
         "//go/extractor/dbscheme",
         "//go/extractor/diagnostics",
         "//go/extractor/srcarchive",

go/extractor/canonicalize/BUILD.bazel

@@ -1,11 +0,0 @@
-load("@rules_go//go:def.bzl", "go_library")
-
-go_library(
-    name = "canonicalize",
-    srcs = [
-        "canonicalize_other.go",
-        "canonicalize_windows.go",
-    ],
-    importpath = "github.com/github/codeql-go/extractor/canonicalize",
-    visibility = ["//visibility:public"],
-)

go/extractor/canonicalize/canonicalize_other.go

@@ -1,5 +0,0 @@
-//go:build !windows
-
-package canonicalize
-
-func CanonicalizePath(path string) string { return path }

go/extractor/canonicalize/canonicalize_windows.go

@@ -1,65 +0,0 @@
-//go:build windows
-
-package canonicalize
-
-import (
-	"os"
-	"path/filepath"
-	"syscall"
-	"unsafe"
-)
-
-var (
-	dll              *syscall.DLL
-	procCanonicalize *syscall.Proc
-	procFree         *syscall.Proc
-	available        bool
-)
-
-func init() {
-	root := os.Getenv("CODEQL_EXTRACTOR_GO_ROOT")
-	if root == "" {
-		return
-	}
-	dllPath := filepath.Join(root, "tools", "win64", "codeql_canonical_path.dll")
-	d, err := syscall.LoadDLL(dllPath)
-	if err != nil {
-		return
-	}
-	p, err := d.FindProc("canonicalize_path_u8")
-	if err != nil {
-		return
-	}
-	f, _ := d.FindProc("canonicalize_free_u8")
-	dll = d
-	procCanonicalize = p
-	procFree = f
-	available = true
-}
-
-func CanonicalizePath(path string) string {
-	if !available {
-		return path
-	}
-	pathBytes := append([]byte(path), 0)
-	ret, _, _ := procCanonicalize.Call(uintptr(unsafe.Pointer(&pathBytes[0])))
-	if ret == 0 {
-		return path
-	}
-	result := bytePtrToString((*byte)(unsafe.Pointer(ret)))
-	if procFree != nil {
-		procFree.Call(ret)
-	}
-	return result
-}
-
-func bytePtrToString(p *byte) string {
-	if p == nil {
-		return ""
-	}
-	var n int
-	for ptr := unsafe.Pointer(p); *(*byte)(ptr) != 0; n++ {
-		ptr = unsafe.Add(ptr, 1)
-	}
-	return string(unsafe.Slice(p, n))
-}

go/extractor/extractor.go

@@ -22,7 +22,6 @@ import (
 	"sync"
 	"time"
 
-	"github.com/github/codeql-go/extractor/canonicalize"
 	"github.com/github/codeql-go/extractor/dbscheme"
 	"github.com/github/codeql-go/extractor/diagnostics"
 	"github.com/github/codeql-go/extractor/srcarchive"
@@ -767,7 +766,7 @@ func normalizedPath(ast *ast.File, fset *token.FileSet) string {
 	if err != nil {
 		return file
 	}
-	return canonicalize.CanonicalizePath(path)
+	return path
 }
 
 // extractFile extracts AST information for the given file

go/ql/integration-tests/subst/code/main.go

@@ -1,3 +0,0 @@
-package main
-
-func main() {}

go/ql/integration-tests/subst/file.expected

@@ -1 +0,0 @@
-| file://Z:/main.go:0:0:0:0 | Z:/main.go | relative |

go/ql/integration-tests/subst/file.ql

@@ -1,5 +0,0 @@
-import go
-
-from File f, string relative
-where if exists(f.getRelativePath()) then relative = "relative" else relative = ""
-select f, relative

go/ql/integration-tests/subst/test.py

@@ -1,7 +0,0 @@
-import runs_on
-
-
-@runs_on.windows
-def test(codeql, go, cwd, subst_drive):
-    drive = subst_drive(cwd / "code")
-    codeql.database.create(command="go build main.go", source_root=drive)

java/kotlin-extractor/src/main/java/com/semmle/util/files/FileUtil.java

@@ -1242,11 +1242,11 @@ public class FileUtil
 	public static File tryMakeCanonical (File f)
 	{
 		try {
-			return NativeCanonicalizer.resolve(f.getCanonicalFile());
+			return f.getCanonicalFile();
 		}
 		catch (IOException ignored) {
 			Exceptions.ignore(ignored, "Can't log error: Could be too verbose.");
-			return NativeCanonicalizer.resolve(new File(simplifyPath(f)));
+			return new File(simplifyPath(f));
 		}
 	}
 

java/kotlin-extractor/src/main/java/com/semmle/util/files/NativeCanonicalizer.java

@@ -1,41 +0,0 @@
-package com.semmle.util.files;
-
-import java.io.File;
-import java.nio.file.Path;
-import java.nio.file.Paths;
-
-public class NativeCanonicalizer {
-  private static final boolean available;
-
-  static {
-    boolean loaded = false;
-    if (File.separatorChar == '\\') {
-      String dist = System.getenv("CODEQL_DIST");
-      if (dist != null && !dist.isEmpty()) {
-        try {
-          Path library = Paths.get(dist).resolve("tools").resolve("win64")
-              .resolve("codeql_canonical_path.dll").toAbsolutePath();
-          System.load(library.toString());
-          loaded = true;
-        } catch (RuntimeException | UnsatisfiedLinkError ignored) {
-        }
-      }
-    }
-    available = loaded;
-  }
-
-  private NativeCanonicalizer() {}
-
-  // UTF-16 JNI interface - no encoding conversion
-  private static native String nativeCanonicalizePath(String path);
-
-  public static File resolve(File path) {
-    if (!available) return path;
-    String result = nativeCanonicalizePath(path.getAbsolutePath());
-    return result != null ? new File(result) : path;
-  }
-
-  public static boolean isAvailable() {
-    return available;
-  }
-}

java/ql/integration-tests/java/subst/code/test1.java

@@ -1,4 +0,0 @@
-class Test {
-  public static void main(String[] args) {
-  }
-}

java/ql/integration-tests/java/subst/code/test2.kt

@@ -1 +0,0 @@
-fun main() {}

java/ql/integration-tests/java/subst/file.expected

@@ -1,5 +0,0 @@
-| file://:0:0:0:0 |  |  |
-| file://:0:0:0:0 |  |  |
-| file://Z:/Test.class:0:0:0:0 | Test | relative |
-| file://Z:/test1.java:0:0:0:0 | test1 | relative |
-| file://Z:/test2.kt:0:0:0:0 | test2 | relative |

java/ql/integration-tests/java/subst/file.ql

@@ -1,9 +0,0 @@
-import java
-
-from File f, string relative
-where
-  not f.getURL().matches("file:///modules/%") and
-  not f.getURL().matches("file:///!unknown-binary-location/kotlin/%") and
-  not f.getURL().matches("%/ql/java/kotlin-extractor/%") and
-  if exists(f.getRelativePath()) then relative = "relative" else relative = ""
-select f, relative

java/ql/integration-tests/java/subst/test.py

@@ -1,7 +0,0 @@
-import runs_on
-
-
-@runs_on.windows
-def test(codeql, java, cwd, subst_drive):
-    drive = subst_drive(cwd / "code")
-    codeql.database.create(command=["javac test1.java", "kotlinc test2.kt"], source_root=drive)

java/ql/test-kotlin1/library-tests/dataflow/summaries/test.expected

@@ -234,3 +234,8 @@ subpaths
 | use.kt:9:14:9:25 | taint(...) : Closeable | use.kt:9:31:9:36 | it : Closeable | use.kt:9:33:9:34 | it : Closeable | use.kt:9:14:9:36 | use(...) |
 | with.kt:7:19:7:30 | taint(...) : String | with.kt:7:33:7:40 | $this$with : String | with.kt:7:35:7:38 | this : String | with.kt:7:14:7:40 | with(...) |
 testFailures
+| test.kt:28:14:28:21 | getSecond(...) | Unexpected result: hasTaintFlow=a |
+| test.kt:35:14:35:27 | component1(...) | Unexpected result: hasTaintFlow=d |
+| test.kt:41:14:41:22 | getSecond(...) | Unexpected result: hasTaintFlow=e |
+| test.kt:53:14:53:24 | getDuration(...) | Unexpected result: hasTaintFlow=f |
+| test.kt:58:14:58:29 | component2(...) | Unexpected result: hasTaintFlow=g |

java/ql/test-kotlin1/library-tests/dataflow/summaries/test.kt

@@ -25,20 +25,20 @@ class Test {
         val p = Pair(taint("a"), "")
         sink(p)                                     // $ hasTaintFlow=a
         sink(p.component1())                        // $ hasTaintFlow=a
-        sink(p.second)                              // $ SPURIOUS: hasTaintFlow=a
+        sink(p.second)
 
         sink(taint("b").capitalize())                   // $ hasTaintFlow=b
         sink(taint("c").replaceFirstChar { _ -> 'x' })  // $ hasTaintFlow=c
 
         val t = Triple("", taint("d"), "")
         sink(t)                                     // $ hasTaintFlow=d
-        sink(t.component1())                        // $ SPURIOUS: hasTaintFlow=d
+        sink(t.component1())
         sink(t.second)                              // $ hasTaintFlow=d
 
         val p1 = taint("e") to ""
         sink(p1)                                    // $ hasTaintFlow=e
         sink(p1.component1())                       // $ hasTaintFlow=e
-        sink(p1.second)                             // $ SPURIOUS: hasTaintFlow=e
+        sink(p1.second)
 
         val l = p.toList()
         sink(l)                                     // $ hasTaintFlow=a
@@ -50,12 +50,12 @@ class Test {
         val tv = TimedValue(taint("f"), Duration.parse(""))
         sink(tv)                                    // $ hasTaintFlow=f
         sink(tv.component1())                       // $ hasTaintFlow=f
-        sink(tv.duration)                           // $ SPURIOUS: hasTaintFlow=f
+        sink(tv.duration)
 
         val mg0 = MatchGroup(taint("g"), IntRange(0, 10))
         sink(mg0)                                   // $ hasTaintFlow=g
         sink(mg0.value)                             // $ hasTaintFlow=g
-        sink(mg0.component2())                      // $ SPURIOUS: hasTaintFlow=g
+        sink(mg0.component2())
 
         val iv = IndexedValue<String>(5, taint("h"))
         sink(iv)                                    // $ hasTaintFlow=h

java/ql/test-kotlin2/library-tests/dataflow/summaries/test.expected

@@ -234,3 +234,8 @@ subpaths
 | use.kt:9:14:9:25 | taint(...) : Closeable | use.kt:9:31:9:36 | it : Closeable | use.kt:9:33:9:34 | it : Closeable | use.kt:9:14:9:36 | use(...) |
 | with.kt:7:19:7:30 | taint(...) : String | with.kt:7:33:7:40 | $this$with : String | with.kt:7:35:7:38 | this : String | with.kt:7:14:7:40 | with(...) |
 testFailures
+| test.kt:28:14:28:21 | getSecond(...) | Unexpected result: hasTaintFlow=a |
+| test.kt:35:14:35:27 | component1(...) | Unexpected result: hasTaintFlow=d |
+| test.kt:41:14:41:22 | getSecond(...) | Unexpected result: hasTaintFlow=e |
+| test.kt:53:14:53:24 | getDuration(...) | Unexpected result: hasTaintFlow=f |
+| test.kt:58:14:58:29 | component2(...) | Unexpected result: hasTaintFlow=g |

java/ql/test-kotlin2/library-tests/dataflow/summaries/test.kt

@@ -25,20 +25,20 @@ class Test {
         val p = Pair(taint("a"), "")
         sink(p)                                     // $ hasTaintFlow=a
         sink(p.component1())                        // $ hasTaintFlow=a
-        sink(p.second)                              // $ SPURIOUS: hasTaintFlow=a
+        sink(p.second)
 
         sink(taint("b").capitalize())                   // $ hasTaintFlow=b
         sink(taint("c").replaceFirstChar { _ -> 'x' })  // $ hasTaintFlow=c
 
         val t = Triple("", taint("d"), "")
         sink(t)                                     // $ hasTaintFlow=d
-        sink(t.component1())                        // $ SPURIOUS: hasTaintFlow=d
+        sink(t.component1())
         sink(t.second)                              // $ hasTaintFlow=d
 
         val p1 = taint("e") to ""
         sink(p1)                                    // $ hasTaintFlow=e
         sink(p1.component1())                       // $ hasTaintFlow=e
-        sink(p1.second)                             // $ SPURIOUS: hasTaintFlow=e
+        sink(p1.second)
 
         val l = p.toList()
         sink(l)                                     // $ hasTaintFlow=a
@@ -50,12 +50,12 @@ class Test {
         val tv = TimedValue(taint("f"), Duration.parse(""))
         sink(tv)                                    // $ hasTaintFlow=f
         sink(tv.component1())                       // $ hasTaintFlow=f
-        sink(tv.duration)                           // $ SPURIOUS: hasTaintFlow=f
+        sink(tv.duration)
 
         val mg0 = MatchGroup(taint("g"), IntRange(0, 10))
         sink(mg0)                                   // $ hasTaintFlow=g
         sink(mg0.value)                             // $ hasTaintFlow=g
-        sink(mg0.component2())                      // $ SPURIOUS: hasTaintFlow=g
+        sink(mg0.component2())
 
         val iv = IndexedValue<String>(5, taint("h"))
         sink(iv)                                    // $ hasTaintFlow=h

javascript/ql/integration-tests/subst/code/main.js

@@ -1 +0,0 @@
-function interesting() { }

javascript/ql/integration-tests/subst/code/test.ts

@@ -1 +0,0 @@
-0

javascript/ql/integration-tests/subst/file.expected

@@ -1,2 +0,0 @@
-| file://Z:/main.js:0:0:0:0 | Z:/main.js | relative |
-| file://Z:/test.ts:0:0:0:0 | Z:/test.ts | relative |

javascript/ql/integration-tests/subst/file.ql

@@ -1,7 +0,0 @@
-import javascript
-
-from File f, string relative
-where
-  not f.getURL().matches("%/target/intree/%") and
-  if exists(f.getRelativePath()) then relative = "relative" else relative = ""
-select f, relative

javascript/ql/integration-tests/subst/test.py

@@ -1,7 +0,0 @@
-import runs_on
-
-
-@runs_on.windows
-def test(codeql, javascript, cwd, subst_drive):
-    drive = subst_drive(cwd / "code")
-    codeql.database.create(source_root=drive)

python/ql/integration-tests/subst/code/main.py

@@ -1 +0,0 @@
-print(0)

python/ql/integration-tests/subst/file.expected

@@ -1 +0,0 @@
-| code/main.py:0:0:0:0 | code/main.py |  |

python/ql/integration-tests/subst/file.ql

@@ -1,5 +0,0 @@
-import python
-
-from File f, string relative
-where if exists(f.getRelativePath()) then relative = "relative" else relative = ""
-select f, relative

python/ql/integration-tests/subst/test.py

@@ -1,7 +0,0 @@
-import runs_on
-
-
-@runs_on.windows
-def test(codeql, python, cwd, subst_drive):
-    drive = subst_drive(cwd / "code")
-    codeql.database.create(source_root=drive)

python/ql/lib/change-notes/2026-06-30-instance-attribute-typetracking-performance.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Type tracking of values stored in instance attributes and read from outside the class (for example `instance.attr` where the value was assigned to `self.attr` in a method) no longer relies on a dedicated instance type-tracker. This avoids a structural mutual recursion that could cause catastrophic query slowdowns on some OOP-heavy code bases. Such reads are now resolved using local flow from the constructor call, which is slightly less precise for instances that flow across a call or return before being read.

python/ql/lib/semmle/python/dataflow/new/internal/TypeTrackingImpl.qll

@@ -349,11 +349,23 @@ module TypeTrackingInput implements Shared::TypeTrackingInput<Location> {
    * `instance.attr`, where `instance` is a reference to an instance of `cls`).
    *
    * This complements `selfAttrRef`, which only handles `self.attr` accesses inside the
-   * methods of `cls`. Unlike `selfAttrRef`, this depends on the call graph (via
+   * methods of `cls`. The instance is identified using *local* flow from a constructor
-   * `classInstanceTracker`), so steps using it must be reported as `levelStepCall`.
+   * call `cls(...)` (resolved via the call graph by `resolveClassCall`), rather than a
+   * dedicated instance type-tracker (`classInstanceTracker`).
+   *
+   * Using `classInstanceTracker` here would make `levelStepCall` mutually recursive with
+   * `classInstanceTracker` -- itself a full type-tracker run -- which caused catastrophic
+   * query slowdowns on some OOP-heavy Python code bases (e.g. `mypy` and `dask`). Relying
+   * on local flow from a resolved constructor call instead depends only on `classTracker`
+   * (the same call-graph machinery already used by `inheritedFieldStep`), avoiding that
+   * blow-up. The trade-off is reduced precision: instances that flow across a call or
+   * return before being read are no longer covered by this step.
    */
   private predicate instanceAttrRead(Class cls, string attr, DataFlowPublic::AttrRead read) {
-    read.getObject() = DataFlowDispatch::classInstanceTracker(cls) and
+    exists(DataFlowPublic::CallCfgNode construction |
+      DataFlowDispatch::resolveClassCall(construction.asCfgNode(), cls) and
+      read.getObject().getALocalSource() = construction
+    ) and
     read.mayHaveAttributeName(attr)
   }
 
@@ -432,9 +444,9 @@ module TypeTrackingInput implements Shared::TypeTrackingInput<Location> {
    * This is the cross-instance counterpart of `localFieldStep`: it relates a write of
    * `self.attr` inside a class to a read of `attr` on a reference to an instance of that
    * class or one of its subclasses. Identifying instances relies on the call graph (via
-   * `classInstanceTracker`), so this step is reported as `levelStepCall` rather than
+   * `resolveClassCall`, see `instanceAttrRead`), so this step is reported as
-   * `levelStepNoCall`. The write may occur in the instance's own class or in any of its
+   * `levelStepCall` rather than `levelStepNoCall`. The write may occur in the instance's
-   * superclasses, since those methods are inherited.
+   * own class or in any of its superclasses, since those methods are inherited.
    *
    * Like `localFieldStep`, this is an over-approximation: it is both instance-insensitive
    * and order-insensitive.

python/ql/test/library-tests/dataflow/typetracking/attribute_tests.py

@@ -161,6 +161,18 @@ print(instance.foo) # $ tracked MISSING: tracked=foo
 instance.print_foo() # $ MISSING: tracked=foo
 
 
+# attribute set in method, but the instance flows across a call/return before the read.
+# `instanceFieldStep` identifies the instance using only local flow from the constructor
+# call, so a value stored on `self.foo` is not seen once the instance has crossed a
+# function boundary.
+
+def make_my_class2():
+    return MyClass2()
+
+returned_instance = make_my_class2()
+print(returned_instance.foo) # $ MISSING: tracked
+
+
 # attribute set from outside of class
 
 class MyClass3(object):

ruby/ql/integration-tests/subst/code/test.rb

@@ -1 +0,0 @@
-0

ruby/ql/integration-tests/subst/file.expected

@@ -1,2 +0,0 @@
-| code/test.rb:0:0:0:0 | code/test.rb |  |
-| file://:0:0:0:0 |  |  |

ruby/ql/integration-tests/subst/file.ql

@@ -1,5 +0,0 @@
-import ruby
-
-from File f, string relative
-where if exists(f.getRelativePath()) then relative = "relative" else relative = ""
-select f, relative

ruby/ql/integration-tests/subst/test.py

@@ -1,7 +0,0 @@
-import runs_on
-
-
-@runs_on.windows
-def test(codeql, ruby, cwd, subst_drive):
-    drive = subst_drive(cwd / "code")
-    codeql.database.create(source_root=drive)

rust/ql/integration-tests/subst/code/test.rs

@@ -1 +0,0 @@
-fn main() {}

rust/ql/integration-tests/subst/file.expected

@@ -1,2 +0,0 @@
-| code/test.rs:0:0:0:0 | code/test.rs |  |
-| file://:0:0:0:0 |  |  |

rust/ql/integration-tests/subst/file.ql

@@ -1,7 +0,0 @@
-import rust
-
-from File f, string relative
-where
-  not f.getURL().matches("%/target/intree/%") and
-  if exists(f.getRelativePath()) then relative = "relative" else relative = ""
-select f, relative

rust/ql/integration-tests/subst/test.py

@@ -1,7 +0,0 @@
-import runs_on
-
-
-@runs_on.windows
-def test(codeql, rust, cwd, subst_drive):
-    drive = subst_drive(cwd / "code")
-    codeql.database.create(source_root=drive)

shared/canonicalize/BUILD.bazel

@@ -1,35 +0,0 @@
-load("@rules_cc//cc:defs.bzl", "cc_binary", "cc_library")
-load("@rules_pkg//pkg:mappings.bzl", "pkg_attributes", "pkg_files")
-
-cc_binary(
-    name = "codeql_canonical_path.dll",
-    srcs = [
-        "canonicalize.cpp",
-        "canonicalize.h",
-        "canonicalize_jni.cpp",
-    ],
-    defines = ["CODEQL_CANONICALIZE_EXPORTS"],
-    linkopts = ["-lkernel32"],
-    linkshared = True,
-    target_compatible_with = ["@platforms//os:windows"],
-    visibility = ["//visibility:public"],
-    deps = ["@rules_java//toolchains:jni"],
-)
-
-cc_library(
-    name = "canonicalize",
-    srcs = ["canonicalize.cpp"],
-    hdrs = ["canonicalize.h"],
-    defines = ["CODEQL_CANONICALIZE_EXPORTS"],
-    linkopts = ["-lkernel32"],
-    target_compatible_with = ["@platforms//os:windows"],
-    visibility = ["//visibility:public"],
-)
-
-pkg_files(
-    name = "pkg",
-    srcs = [":codeql_canonical_path.dll"],
-    attributes = pkg_attributes(mode = "0755"),
-    target_compatible_with = ["@platforms//os:windows"],
-    visibility = ["//visibility:public"],
-)

shared/canonicalize/canonicalize.cpp

@@ -1,165 +0,0 @@
-#ifdef _WIN32
-#include "canonicalize.h"
-#include <windows.h>
-#include <string>
-#include <unordered_map>
-#include <shared_mutex>
-#include <random>
-
-namespace {
-
-class PathCache {
-public:
-    static PathCache& instance() {
-        static PathCache cache;
-        return cache;
-    }
-
-    const wchar_t* canonicalize(const wchar_t* path) {
-        std::wstring key(path);
-
-        // Fast path: shared (read) lock for cache hit
-        {
-            std::shared_lock lock(mutex_);
-            auto it = cache_.find(key);
-            if (it != cache_.end()) {
-                return _wcsdup(it->second.c_str());
-            }
-        }
-
-        // Slow path: resolve and insert under exclusive lock
-        std::wstring resolved = resolve(path);
-        if (resolved.empty()) return nullptr;
-
-        std::unique_lock lock(mutex_);
-        // Check again under exclusive lock (another thread may have inserted)
-        auto it = cache_.find(key);
-        if (it != cache_.end()) {
-            return _wcsdup(it->second.c_str());
-        }
-
-        // Evict a random entry if at capacity (matches C# strategy)
-        if (cache_.size() >= max_capacity_) {
-            std::uniform_int_distribution<size_t> dist(0, cache_.size() - 1);
-            auto evict = cache_.begin();
-            std::advance(evict, dist(rng_));
-            cache_.erase(evict);
-        }
-
-        auto inserted = cache_.emplace(std::move(key), std::move(resolved)).first;
-        return _wcsdup(inserted->second.c_str());
-    }
-
-private:
-    PathCache() = default;
-
-    static constexpr size_t max_capacity_ = 4096;
-    std::unordered_map<std::wstring, std::wstring> cache_;
-    std::shared_mutex mutex_;
-    std::mt19937 rng_{std::random_device{}()};
-
-    static std::wstring resolve(const wchar_t* path) {
-        HANDLE h = CreateFileW(
-            path,
-            0,
-            FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
-            nullptr,
-            OPEN_EXISTING,
-            FILE_FLAG_BACKUP_SEMANTICS,
-            nullptr);
-
-        if (h == INVALID_HANDLE_VALUE) {
-            return resolve_nonexistent(path);
-        }
-
-        std::wstring result = get_final_path(h);
-        CloseHandle(h);
-
-        if (result.empty()) return {};
-        return strip_prefix(result);
-    }
-
-    static std::wstring get_final_path(HANDLE h) {
-        wchar_t buf[MAX_PATH];
-        DWORD len = GetFinalPathNameByHandleW(h, buf, MAX_PATH, FILE_NAME_NORMALIZED);
-
-        if (len > 0 && len < MAX_PATH) {
-            return std::wstring(buf, len);
-        }
-        if (len >= MAX_PATH) {
-            std::wstring big(len + 1, L'\0');
-            len = GetFinalPathNameByHandleW(h, big.data(), len + 1, FILE_NAME_NORMALIZED);
-            if (len > 0) return std::wstring(big.data(), len);
-        }
-        return {};
-    }
-
-    static std::wstring strip_prefix(const std::wstring& path) {
-        constexpr std::wstring_view unc_prefix = L"\\\\?\\UNC\\";
-        constexpr std::wstring_view lp_prefix = L"\\\\?\\";
-
-        if (path.starts_with(unc_prefix)) {
-            return L"\\" + path.substr(unc_prefix.size() - 1);
-        }
-        if (path.starts_with(lp_prefix)) {
-            return std::wstring(path.substr(lp_prefix.size()));
-        }
-        return path;
-    }
-
-    // For non-existent files: canonicalize parent, append filename
-    // (matches C#'s ConstructCanonicalPath)
-    static std::wstring resolve_nonexistent(const wchar_t* path) {
-        std::wstring spath(path);
-        auto sep = spath.find_last_of(L"\\/");
-        if (sep == std::wstring::npos) return {};
-
-        std::wstring parent = spath.substr(0, sep);
-        std::wstring name = spath.substr(sep + 1);
-
-        std::wstring canonical_parent = resolve(parent.c_str());
-        if (canonical_parent.empty()) return {};
-
-        return canonical_parent + L"\\" + name;
-    }
-};
-
-} // namespace
-
-extern "C" {
-
-CODEQL_API const wchar_t* canonicalize_path_w(const wchar_t* path) {
-    if (!path || !*path) return nullptr;
-    return PathCache::instance().canonicalize(path);
-}
-
-CODEQL_API void canonicalize_free_w(const wchar_t* path) {
-    free(const_cast<wchar_t*>(path));
-}
-
-CODEQL_API const char* canonicalize_path_u8(const char* path) {
-    if (!path || !*path) return nullptr;
-
-    int wlen = MultiByteToWideChar(CP_UTF8, 0, path, -1, nullptr, 0);
-    if (wlen <= 0) return nullptr;
-    std::wstring wpath(wlen - 1, L'\0');
-    MultiByteToWideChar(CP_UTF8, 0, path, -1, wpath.data(), wlen);
-
-    const wchar_t* wresult = PathCache::instance().canonicalize(wpath.c_str());
-    if (!wresult) return nullptr;
-
-    int ulen = WideCharToMultiByte(CP_UTF8, 0, wresult, -1, nullptr, 0, nullptr, nullptr);
-    if (ulen <= 0) { free(const_cast<wchar_t*>(wresult)); return nullptr; }
-    char* result = static_cast<char*>(malloc(ulen));
-    WideCharToMultiByte(CP_UTF8, 0, wresult, -1, result, ulen, nullptr, nullptr);
-    free(const_cast<wchar_t*>(wresult));
-
-    return result;
-}
-
-CODEQL_API void canonicalize_free_u8(const char* path) {
-    free(const_cast<char*>(path));
-}
-
-} // extern "C"
-#endif

shared/canonicalize/canonicalize.h

@@ -1,31 +0,0 @@
-#ifndef CODEQL_CANONICALIZE_H
-#define CODEQL_CANONICALIZE_H
-
-#ifdef _WIN32
-
-#ifdef CODEQL_CANONICALIZE_EXPORTS
-#define CODEQL_API __declspec(dllexport)
-#else
-#define CODEQL_API __declspec(dllimport)
-#endif
-
-#include <wchar.h>
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-// UTF-16 interface (for JNI / Java / Kotlin)
-CODEQL_API const wchar_t* canonicalize_path_w(const wchar_t* path);
-CODEQL_API void canonicalize_free_w(const wchar_t* path);
-
-// UTF-8 interface (for Go)
-CODEQL_API const char* canonicalize_path_u8(const char* path);
-CODEQL_API void canonicalize_free_u8(const char* path);
-
-#ifdef __cplusplus
-}
-#endif
-
-#endif // _WIN32
-#endif // CODEQL_CANONICALIZE_H

shared/canonicalize/canonicalize_jni.cpp

@@ -1,25 +0,0 @@
-#ifdef _WIN32
-#include <jni.h>
-#include "canonicalize.h"
-
-extern "C" {
-
-JNIEXPORT jstring JNICALL
-Java_com_semmle_util_files_NativeCanonicalizer_nativeCanonicalizePath(
-    JNIEnv *env, jclass cls, jstring jpath) {
-
-    const jchar* path = env->GetStringChars(jpath, nullptr);
-    const wchar_t* result = canonicalize_path_w(reinterpret_cast<const wchar_t*>(path));
-    env->ReleaseStringChars(jpath, path);
-
-    if (result == nullptr) return nullptr;
-
-    jstring jresult = env->NewString(
-        reinterpret_cast<const jchar*>(result),
-        static_cast<jsize>(wcslen(result)));
-    canonicalize_free_w(result);
-    return jresult;
-}
-
-} // extern "C"
-#endif