C++: accept test results

.github/workflows/go-version-update.yml

@@ -1,208 +0,0 @@
-name: Update Go version
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: "0 3 * * 1"  # Run weekly on Mondays at 3 AM UTC (1 = Monday)
-
-permissions:
-  contents: write
-  pull-requests: write
-
-jobs:
-  update-go-version:
-    name: Check and update Go version
-    if: github.repository == 'github/codeql'
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v5
-        with:
-          fetch-depth: 0
-
-      - name: Set up Git
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-
-      - name: Fetch latest Go version
-        id: fetch-version
-        run: |
-          LATEST_GO_VERSION=$(curl -s https://go.dev/dl/?mode=json | jq -r '.[0].version')
-          
-          if [ -z "$LATEST_GO_VERSION" ] || [ "$LATEST_GO_VERSION" = "null" ]; then
-            echo "Error: Failed to fetch latest Go version from go.dev"
-            exit 1
-          fi
-          
-          echo "Latest Go version from go.dev: $LATEST_GO_VERSION"
-          echo "version=$LATEST_GO_VERSION" >> $GITHUB_OUTPUT
-          
-          # Extract version numbers (e.g., go1.26.0 -> 1.26.0)
-          LATEST_VERSION_NUM=$(echo $LATEST_GO_VERSION | sed 's/^go//')
-          echo "version_num=$LATEST_VERSION_NUM" >> $GITHUB_OUTPUT
-          
-          # Extract major.minor version (e.g., 1.26.0 -> 1.26)
-          LATEST_MAJOR_MINOR=$(echo $LATEST_VERSION_NUM | sed -E 's/^([0-9]+\.[0-9]+).*/\1/')
-          echo "major_minor=$LATEST_MAJOR_MINOR" >> $GITHUB_OUTPUT
-
-      - name: Check current Go version
-        id: current-version
-        run: |
-          CURRENT_VERSION=$(sed -n 's/.*go_sdk\.download(version = \"\([^\"]*\)\".*/\1/p' MODULE.bazel)
-          
-          if [ -z "$CURRENT_VERSION" ]; then
-            echo "Error: Could not extract Go version from MODULE.bazel"
-            exit 1
-          fi
-          
-          echo "Current Go version in MODULE.bazel: $CURRENT_VERSION"
-          echo "version=$CURRENT_VERSION" >> $GITHUB_OUTPUT
-          
-          # Extract major.minor version
-          CURRENT_MAJOR_MINOR=$(echo $CURRENT_VERSION | sed -E 's/^([0-9]+\.[0-9]+).*/\1/')
-          echo "major_minor=$CURRENT_MAJOR_MINOR" >> $GITHUB_OUTPUT
-
-      - name: Compare versions
-        id: compare
-        run: |
-          LATEST="${{ steps.fetch-version.outputs.version_num }}"
-          CURRENT="${{ steps.current-version.outputs.version }}"
-          
-          echo "Latest: $LATEST"
-          echo "Current: $CURRENT"
-          
-          if [ "$LATEST" = "$CURRENT" ]; then
-            echo "Go version is up to date"
-            echo "needs_update=false" >> $GITHUB_OUTPUT
-          else
-            echo "Go version needs update from $CURRENT to $LATEST"
-            echo "needs_update=true" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Update Go version in files
-        if: steps.compare.outputs.needs_update == 'true'
-        run: |
-          LATEST_VERSION_NUM="${{ steps.fetch-version.outputs.version_num }}"
-          LATEST_MAJOR_MINOR="${{ steps.fetch-version.outputs.major_minor }}"
-          CURRENT_VERSION="${{ steps.current-version.outputs.version }}"
-          CURRENT_MAJOR_MINOR="${{ steps.current-version.outputs.major_minor }}"
-          
-          echo "Updating from $CURRENT_VERSION to $LATEST_VERSION_NUM"
-          
-          # Escape dots in current version strings for use in sed patterns
-          CURRENT_VERSION_ESCAPED=$(echo "$CURRENT_VERSION" | sed 's/\./\\./g')
-          CURRENT_MAJOR_MINOR_ESCAPED=$(echo "$CURRENT_MAJOR_MINOR" | sed 's/\./\\./g')
-          
-          # Update MODULE.bazel
-          sed -i "s/go_sdk\.download(version = \"$CURRENT_VERSION_ESCAPED\")/go_sdk.download(version = \"$LATEST_VERSION_NUM\")/" MODULE.bazel
-          if ! grep -q "go_sdk.download(version = \"$LATEST_VERSION_NUM\")" MODULE.bazel; then
-            echo "Error: Failed to update MODULE.bazel"
-            exit 1
-          fi
-          
-          # Update go/extractor/go.mod
-          if ! sed -i "s/^go $CURRENT_MAJOR_MINOR_ESCAPED\$/go $LATEST_MAJOR_MINOR/" go/extractor/go.mod; then
-            echo "Warning: Failed to update go directive in go.mod"
-          fi
-          if ! sed -i "s/^toolchain go$CURRENT_VERSION_ESCAPED\$/toolchain go$LATEST_VERSION_NUM/" go/extractor/go.mod; then
-            echo "Warning: Failed to update toolchain in go.mod"
-          fi
-          
-          # Update go/extractor/autobuilder/build-environment.go
-          if ! sed -i "s/var maxGoVersion = util\.NewSemVer(\"$CURRENT_MAJOR_MINOR_ESCAPED\")/var maxGoVersion = util.NewSemVer(\"$LATEST_MAJOR_MINOR\")/" go/extractor/autobuilder/build-environment.go; then
-            echo "Warning: Failed to update build-environment.go"
-          fi
-          
-          # Update go/actions/test/action.yml
-          if ! sed -i "s/default: \"~$CURRENT_VERSION_ESCAPED\"/default: \"~$LATEST_VERSION_NUM\"/" go/actions/test/action.yml; then
-            echo "Warning: Failed to update action.yml"
-          fi
-          
-          # Show what changed
-          git diff
-
-      - name: Check for changes
-        id: check-changes
-        if: steps.compare.outputs.needs_update == 'true'
-        run: |
-          if git diff --quiet; then
-            echo "No changes detected"
-            echo "has_changes=false" >> $GITHUB_OUTPUT
-          else
-            echo "Changes detected"
-            echo "has_changes=true" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Check for existing PR
-        if: steps.check-changes.outputs.has_changes == 'true'
-        id: check-pr
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          BRANCH_NAME="workflow/go-version-update"
-          PR_NUMBER=$(gh pr list --head "$BRANCH_NAME" --state open --json number --jq '.[0].number')
-          
-          if [ -n "$PR_NUMBER" ]; then
-            echo "Existing PR found: #$PR_NUMBER"
-            echo "pr_exists=true" >> $GITHUB_OUTPUT
-            echo "pr_number=$PR_NUMBER" >> $GITHUB_OUTPUT
-          else
-            echo "No existing PR found"
-            echo "pr_exists=false" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Commit and push changes
-        if: steps.check-changes.outputs.has_changes == 'true'
-        run: |
-          BRANCH_NAME="workflow/go-version-update"
-          LATEST_VERSION_NUM="${{ steps.fetch-version.outputs.version_num }}"
-          LATEST_MAJOR_MINOR="${{ steps.fetch-version.outputs.major_minor }}"
-          
-          # Create or switch to branch
-          git checkout -B "$BRANCH_NAME"
-          
-          # Stage and commit changes
-          git add MODULE.bazel go/extractor/go.mod go/extractor/autobuilder/build-environment.go go/actions/test/action.yml
-          git commit -m "Go: Update to $LATEST_VERSION_NUM"
-          
-          # Push changes
-          git push --force-with-lease origin "$BRANCH_NAME"
-
-      - name: Create or update PR
-        if: steps.check-changes.outputs.has_changes == 'true'
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          BRANCH_NAME="workflow/go-version-update"
-          LATEST_VERSION_NUM="${{ steps.fetch-version.outputs.version_num }}"
-          CURRENT_VERSION="${{ steps.current-version.outputs.version }}"
-          
-          PR_TITLE="Go: Update to $LATEST_VERSION_NUM"
-          
-          PR_BODY=$(cat <<EOF
-          This PR updates Go from $CURRENT_VERSION to $LATEST_VERSION_NUM.
-
-          Updated files:
-          - \`MODULE.bazel\` - go_sdk.download version
-          - \`go/extractor/go.mod\` - go directive and toolchain
-          - \`go/extractor/autobuilder/build-environment.go\` - maxGoVersion (only if MAJOR.MINOR changes)
-          - \`go/actions/test/action.yml\` - default go-test-version
-
-          This PR was automatically created by the [Go version update workflow](https://github.com/${{ github.repository }}/blob/main/.github/workflows/go-version-update.yml).
-          EOF
-          )
-          
-          if [ "${{ steps.check-pr.outputs.pr_exists }}" = "true" ]; then
-            echo "Updating existing PR #${{ steps.check-pr.outputs.pr_number }}"
-            gh pr edit "${{ steps.check-pr.outputs.pr_number }}" --title "$PR_TITLE" --body "$PR_BODY"
-          else
-            echo "Creating new PR"
-            gh pr create \
-              --title "$PR_TITLE" \
-              --body "$PR_BODY" \
-              --base main \
-              --head "$BRANCH_NAME" \
-              --label "Go"
-          fi

MODULE.bazel

@@ -273,7 +273,7 @@ use_repo(
 )
 
 go_sdk = use_extension("@rules_go//go:extensions.bzl", "go_sdk")
-go_sdk.download(version = "1.26.4")
+go_sdk.download(version = "1.26.0")
 
 go_deps = use_extension("@gazelle//:extensions.bzl", "go_deps")
 go_deps.from_file(go_mod = "//go/extractor:go.mod")

actions/ql/lib/CHANGELOG.md

@@ -1,9 +1,3 @@
-## 0.4.37
-
-### Minor Analysis Improvements
-
-* The GitHub Actions analysis now recognizes more Bash regex checks that restrict a value to alphanumeric characters, include regexes like `^[0-9a-zA-Z]{40}([0-9a-zA-Z]{24})?$` which check for a sha1 or sha256 hash. This may reduce false positive results where command output is validated with grouped or optional alphanumeric patterns before being used.
-
 ## 0.4.36
 
 ### Minor Analysis Improvements

actions/ql/lib/change-notes/2026-05-12-improved-alphanumeric-regex.md

@@ -1,5 +1,4 @@
-## 0.4.37
-
-### Minor Analysis Improvements
-
-* The GitHub Actions analysis now recognizes more Bash regex checks that restrict a value to alphanumeric characters, include regexes like `^[0-9a-zA-Z]{40}([0-9a-zA-Z]{24})?$` which check for a sha1 or sha256 hash. This may reduce false positive results where command output is validated with grouped or optional alphanumeric patterns before being used.
+---
+category: minorAnalysis
+---
+* The GitHub Actions analysis now recognizes more Bash regex checks that restrict a value to alphanumeric characters, include regexes like `^[0-9a-zA-Z]{40}([0-9a-zA-Z]{24})?$` which check for a sha1 or sha256 hash. This may reduce false positive results where command output is validated with grouped or optional alphanumeric patterns before being used.

actions/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.4.37
+lastReleaseVersion: 0.4.36

actions/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/actions-all
-version: 0.4.38-dev
+version: 0.4.37-dev
 library: true
 warnOnImplicitThis: true
 dependencies:

actions/ql/src/CHANGELOG.md

@@ -1,22 +1,3 @@
-## 0.6.29
-
-### Query Metadata Changes
-
-* Reversed adjustment of the name of `actions/untrusted-checkout/high`, but kept the portion of the previous change for the word "trusted" to "privileged". Added a missing "a" to phrasing in `actions/untrusted-checkout/high` and `actions/untrusted-checkout/medium`.
-
-### Major Analysis Improvements
-
-* Adjusted `actions/untrusted-checkout/critical` to align more with other untrusted resource queries, where the alert location is the location where the artifact is obtained from (the checkout point). This aligns with the other 2 related queries. This will cause the same alerts to re-open for closed alerts of this query.
-
-### Minor Analysis Improvements
-
-* Altered the alert message for clarity for queries: `actions/untrusted-checkout/critical`, `actions/untrusted-checkout/high`.
-* The `actions/unpinned-tag` query now recognizes 64-character SHA-256 commit hashes as properly pinned references, in addition to 40-character SHA-1 hashes.
-
-### Bug Fixes
-
-* Adjusted (minor) help file descriptions for queries: `actions/untrusted-checkout/critical`, `actions/untrusted-checkout/high`, `actions/untrusted-checkout/medium`. Clarified wording on in minor point, added one more listed resource and added one more recommendation for things to check.
-
 ## 0.6.28
 
 ### Query Metadata Changes

actions/ql/src/change-notes/2026-05-05-untrusted-checkout-high.md

@@ -0,0 +1,4 @@
+---
+category: majorAnalysis
+---
+* Adjusted `actions/untrusted-checkout/critical` to align more with other untrusted resource queries, where the alert location is the location where the artifact is obtained from (the checkout point). This aligns with the other 2 related queries. This will cause the same alerts to re-open for closed alerts of this query.

actions/ql/src/change-notes/2026-05-12-sha256-pinned-actions.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The `actions/unpinned-tag` query now recognizes 64-character SHA-256 commit hashes as properly pinned references, in addition to 40-character SHA-1 hashes.

actions/ql/src/change-notes/2026-05-14-further-iteration-untrusted-checkout-improvements-alert.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Altered the alert message for clarity for queries: `actions/untrusted-checkout/critical`, `actions/untrusted-checkout/high`.

actions/ql/src/change-notes/2026-05-14-further-iteration-untrusted-checkout-improvements-helpfile.md

@@ -0,0 +1,4 @@
+---
+category: fix
+---
+* Adjusted (minor) help file descriptions for queries: `actions/untrusted-checkout/critical`, `actions/untrusted-checkout/high`, `actions/untrusted-checkout/medium`. Clarified wording on in minor point, added one more listed resource and added one more recommendation for things to check.

actions/ql/src/change-notes/2026-05-14-further-iteration-untrusted-checkout-improvements-metadata.md

@@ -0,0 +1,4 @@
+---
+category: queryMetadata
+---
+* Reversed adjustment of the name of `actions/untrusted-checkout/high`, but kept the portion of the previous change for the word "trusted" to "privileged". Added a missing "a" to phrasing in `actions/untrusted-checkout/high` and `actions/untrusted-checkout/medium`.

actions/ql/src/change-notes/released/0.6.29.md

@@ -1,18 +0,0 @@
-## 0.6.29
-
-### Query Metadata Changes
-
-* Reversed adjustment of the name of `actions/untrusted-checkout/high`, but kept the portion of the previous change for the word "trusted" to "privileged". Added a missing "a" to phrasing in `actions/untrusted-checkout/high` and `actions/untrusted-checkout/medium`.
-
-### Major Analysis Improvements
-
-* Adjusted `actions/untrusted-checkout/critical` to align more with other untrusted resource queries, where the alert location is the location where the artifact is obtained from (the checkout point). This aligns with the other 2 related queries. This will cause the same alerts to re-open for closed alerts of this query.
-
-### Minor Analysis Improvements
-
-* Altered the alert message for clarity for queries: `actions/untrusted-checkout/critical`, `actions/untrusted-checkout/high`.
-* The `actions/unpinned-tag` query now recognizes 64-character SHA-256 commit hashes as properly pinned references, in addition to 40-character SHA-1 hashes.
-
-### Bug Fixes
-
-* Adjusted (minor) help file descriptions for queries: `actions/untrusted-checkout/critical`, `actions/untrusted-checkout/high`, `actions/untrusted-checkout/medium`. Clarified wording on in minor point, added one more listed resource and added one more recommendation for things to check.

actions/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.6.29
+lastReleaseVersion: 0.6.28

actions/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/actions-queries
-version: 0.6.30-dev
+version: 0.6.29-dev
 library: false
 warnOnImplicitThis: true
 groups: [actions, queries]

config/identical-files.json

@@ -11,6 +11,10 @@
     "java/ql/lib/semmle/code/java/dataflow/internal/rangeanalysis/SignAnalysisCommon.qll",
     "csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/SignAnalysisCommon.qll"
   ],
+  "Bound Java/C#": [
+    "java/ql/lib/semmle/code/java/dataflow/Bound.qll",
+    "csharp/ql/lib/semmle/code/csharp/dataflow/Bound.qll"
+  ],
   "ModulusAnalysis Java/C#": [
     "java/ql/lib/semmle/code/java/dataflow/ModulusAnalysis.qll",
     "csharp/ql/lib/semmle/code/csharp/dataflow/ModulusAnalysis.qll"

cpp/downgrades/0853f43dc8c08deecb473c54a2b70da8597f1ab5/upgrade.properties

@@ -1,2 +0,0 @@
-description: Fix NameQualifier inconsistency
-compatibility: full

cpp/ql/lib/CHANGELOG.md

@@ -1,19 +1,3 @@
-## 10.2.0
-
-### Deprecated APIs
-
-* The `UsingAliasTypedefType` class has been deprecated. Use `TypeAliasType` instead.
-
-### New Features
-
-* Added a `getOriginalTemplate` predicate to `TemplateClass`, `TemplateFunction`, `TemplateVariable`, and `AliasTemplateType`, which yields the class member template the template was generated from. The predicates only have results for templates that are members of class template instantiations.
-* Added `AliasTemplateType` and `AliasTemplateInstantiationType` classes, representing C++ alias templates and their instantiations.
-
-### Minor Analysis Improvements
-
-* Added flow source models for `scanf_s` and related functions.
-* Added a `Call` column to `LocalFlowSourceFunction::hasLocalFlowSource` and `RemoteFlowSourceFunction::hasRemoteFlowSource`. The old predicates without a `Call` column continue to be supported.
-
 ## 10.1.1
 
 ### Minor Analysis Improvements

cpp/ql/lib/DefaultOptions.qll

@@ -30,6 +30,8 @@ class Options extends string {
   predicate overrideReturnsNull(Call call) {
     // Used in CVS:
     call.(FunctionCall).getTarget().hasGlobalName("Xstrdup")
+    or
+    CustomOptions::overrideReturnsNull(call) // old Options.qll
   }
 
   /**
@@ -43,6 +45,8 @@ class Options extends string {
     // Used in CVS:
     call.(FunctionCall).getTarget().hasGlobalName("Xstrdup") and
     nullValue(call.getArgument(0))
+    or
+    CustomOptions::returnsNull(call) // old Options.qll
   }
 
   /**
@@ -61,6 +65,8 @@ class Options extends string {
     f.hasGlobalOrStdName([
         "exit", "_exit", "_Exit", "abort", "__assert_fail", "longjmp", "__builtin_unreachable"
       ])
+    or
+    CustomOptions::exits(f) // old Options.qll
   }
 
   /**
@@ -73,7 +79,8 @@ class Options extends string {
    * runtime, the program's behavior is undefined)
    */
   predicate exprExits(Expr e) {
-    e.(AssumeExpr).getChild(0).(CompileTimeConstantInt).getIntValue() = 0
+    e.(AssumeExpr).getChild(0).(CompileTimeConstantInt).getIntValue() = 0 or
+    CustomOptions::exprExits(e) // old Options.qll
   }
 
   /**
@@ -81,7 +88,10 @@ class Options extends string {
    *
    * By default holds only for `fgets`.
    */
-  predicate alwaysCheckReturnValue(Function f) { f.hasGlobalOrStdName("fgets") }
+  predicate alwaysCheckReturnValue(Function f) {
+    f.hasGlobalOrStdName("fgets") or
+    CustomOptions::alwaysCheckReturnValue(f) // old Options.qll
+  }
 
   /**
    * Holds if it is reasonable to ignore the return value of function
@@ -97,6 +107,8 @@ class Options extends string {
     // common way of sleeping using select:
     fc.getTarget().hasGlobalName("select") and
     fc.getArgument(0).getValue() = "0"
+    or
+    CustomOptions::okToIgnoreReturnValue(fc) // old Options.qll
   }
 }
 

cpp/ql/lib/Options.qll

@@ -98,3 +98,57 @@ class CustomMutexType extends MutexType {
    */
   override predicate unlockAccess(FunctionCall fc, Expr arg) { none() }
 }
+
+/**
+ * DEPRECATED: customize `CustomOptions.overrideReturnsNull` instead.
+ *
+ * This predicate is required to support backwards compatibility for
+ * older `Options.qll` files.  It should not be removed or modified by
+ * end users.
+ */
+predicate overrideReturnsNull(Call call) { none() }
+
+/**
+ * DEPRECATED: customize `CustomOptions.returnsNull` instead.
+ *
+ * This predicate is required to support backwards compatibility for
+ * older `Options.qll` files.  It should not be removed or modified by
+ * end users.
+ */
+predicate returnsNull(Call call) { none() }
+
+/**
+ * DEPRECATED: customize `CustomOptions.exits` instead.
+ *
+ * This predicate is required to support backwards compatibility for
+ * older `Options.qll` files.  It should not be removed or modified by
+ * end users.
+ */
+predicate exits(Function f) { none() }
+
+/**
+ * DEPRECATED: customize `CustomOptions.exprExits` instead.
+ *
+ * This predicate is required to support backwards compatibility for
+ * older `Options.qll` files.  It should not be removed or modified by
+ * end users.
+ */
+predicate exprExits(Expr e) { none() }
+
+/**
+ * DEPRECATED: customize `CustomOptions.alwaysCheckReturnValue` instead.
+ *
+ * This predicate is required to support backwards compatibility for
+ * older `Options.qll` files.  It should not be removed or modified by
+ * end users.
+ */
+predicate alwaysCheckReturnValue(Function f) { none() }
+
+/**
+ * DEPRECATED: customize `CustomOptions.okToIgnoreReturnValue` instead.
+ *
+ * This predicate is required to support backwards compatibility for
+ * older `Options.qll` files.  It should not be removed or modified by
+ * end users.
+ */
+predicate okToIgnoreReturnValue(FunctionCall fc) { none() }

cpp/ql/lib/change-notes/2026-05-15-secure-scanf.md

@@ -0,0 +1,5 @@
+---
+category: minorAnalysis
+---
+* Added flow source models for `scanf_s` and related functions.
+* Added a `Call` column to `LocalFlowSourceFunction::hasLocalFlowSource` and `RemoteFlowSourceFunction::hasRemoteFlowSource`. The old predicates without a `Call` column continue to be supported.

cpp/ql/lib/change-notes/2026-05-16-alias-template.md

@@ -0,0 +1,4 @@
+---
+category: feature
+---
+* Added `AliasTemplateType` and `AliasTemplateInstantiationType` classes, representing C++ alias templates and their instantiations.

cpp/ql/lib/change-notes/2026-05-18-alias-type.md

@@ -0,0 +1,4 @@
+---
+category: deprecated
+---
+* The `UsingAliasTypedefType` class has been deprecated. Use `TypeAliasType` instead.

cpp/ql/lib/change-notes/2026-05-21-generated-from.md

@@ -0,0 +1,4 @@
+---
+category: feature
+---
+* Added a `getOriginalTemplate` predicate to `TemplateClass`, `TemplateFunction`, `TemplateVariable`, and `AliasTemplateType`, which yields the class member template the template was generated from. The predicates only have results for templates that are members of class template instantiations.

cpp/ql/lib/change-notes/2026-05-27-deprecated-removal.md

@@ -1,15 +0,0 @@
----
-category: breaking
----
-* Removed the deprecated `overrideReturnsNull` predicate from `Options.qll`. Use `CustomOptions.overrideReturnsNull` instead.
-* Removed the deprecated `returnsNull` predicate from `Options.qll`. Use `CustomOptions.returnsNull` instead.
-* Removed the deprecated `exits` predicate from `Options.qll`. Use `CustomOptions.exits` instead.
-* Removed the deprecated `exprExits` predicate from `Options.qll`. Use `CustomOptions.exprExits` instead.
-* Removed the deprecated `alwaysCheckReturnValue` predicate from `Options.qll`. Use `CustomOptions.alwaysCheckReturnValue` instead.
-* Removed the deprecated `okToIgnoreReturnValue` predicate from `Options.qll`. Use `CustomOptions.okToIgnoreReturnValue` instead.
-* Removed the deprecated `semmle.code.cpp.Member`. Import `semmle.code.cpp.Element` and/or `semmle.code.cpp.Type` directly.
-* Removed the deprecated `UnknownDefaultLocation` class. Use `UnknownLocation` instead.
-* Removed the deprecated `UnknownExprLocation` class. Use `UnknownLocation` instead.
-* Removed the deprecated `UnknownStmtLocation` class. Use `UnknownLocation` instead.
-* Removed the deprecated `TemplateParameter` class. Use `TypeTemplateParameter` instead.
-* Support for class resolution across link targets has been removed for databases which were created with CodeQL versions before 1.23.0.

cpp/ql/lib/change-notes/released/10.2.0.md

@@ -1,15 +0,0 @@
-## 10.2.0
-
-### Deprecated APIs
-
-* The `UsingAliasTypedefType` class has been deprecated. Use `TypeAliasType` instead.
-
-### New Features
-
-* Added a `getOriginalTemplate` predicate to `TemplateClass`, `TemplateFunction`, `TemplateVariable`, and `AliasTemplateType`, which yields the class member template the template was generated from. The predicates only have results for templates that are members of class template instantiations.
-* Added `AliasTemplateType` and `AliasTemplateInstantiationType` classes, representing C++ alias templates and their instantiations.
-
-### Minor Analysis Improvements
-
-* Added flow source models for `scanf_s` and related functions.
-* Added a `Call` column to `LocalFlowSourceFunction::hasLocalFlowSource` and `RemoteFlowSourceFunction::hasRemoteFlowSource`. The old predicates without a `Call` column continue to be supported.

cpp/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 10.2.0
+lastReleaseVersion: 10.1.1

cpp/ql/lib/cpp.qll

@@ -32,6 +32,7 @@ import semmle.code.cpp.Class
 import semmle.code.cpp.Struct
 import semmle.code.cpp.Union
 import semmle.code.cpp.Enum
+import semmle.code.cpp.Member
 import semmle.code.cpp.Field
 import semmle.code.cpp.Function
 import semmle.code.cpp.MemberFunction

cpp/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cpp-all
-version: 10.2.1-dev
+version: 10.1.2-dev
 groups: cpp
 dbscheme: semmlecode.cpp.dbscheme
 extractor: cpp

cpp/ql/lib/semmle/code/cpp/Location.qll

@@ -148,3 +148,28 @@ class UnknownLocation extends Location {
     this.getFile().getAbsolutePath() = "" and locations_default(this, _, 0, 0, 0, 0)
   }
 }
+
+/**
+ * A dummy location which is used when something doesn't have a location in
+ * the source code but needs to have a `Location` associated with it.
+ *
+ * DEPRECATED: use `UnknownLocation`
+ */
+deprecated class UnknownDefaultLocation extends UnknownLocation { }
+
+/**
+ * A dummy location which is used when an expression doesn't have a
+ * location in the source code but needs to have a `Location` associated
+ * with it.
+ *
+ * DEPRECATED: use `UnknownLocation`
+ */
+deprecated class UnknownExprLocation extends UnknownLocation { }
+
+/**
+ * A dummy location which is used when a statement doesn't have a location
+ * in the source code but needs to have a `Location` associated with it.
+ *
+ * DEPRECATED: use `UnknownLocation`
+ */
+deprecated class UnknownStmtLocation extends UnknownLocation { }

cpp/ql/lib/semmle/code/cpp/Member.qll

@@ -0,0 +1,6 @@
+/**
+ * DEPRECATED: import `semmle.code.cpp.Element` and/or `semmle.code.cpp.Type` directly as required.
+ */
+
+import semmle.code.cpp.Element
+import semmle.code.cpp.Type

cpp/ql/lib/semmle/code/cpp/TemplateParameter.qll

@@ -35,6 +35,13 @@ class NonTypeTemplateParameter extends Literal, TemplateParameterImpl {
   override string getAPrimaryQlClass() { result = "NonTypeTemplateParameter" }
 }
 
+/**
+ * A C++ `typename` (or `class`) template parameter.
+ *
+ * DEPRECATED: Use `TypeTemplateParameter` instead.
+ */
+deprecated class TemplateParameter = TypeTemplateParameter;
+
 /**
  * A C++ `typename` (or `class`) template parameter.
  *

cpp/ql/lib/semmle/code/cpp/Type.qll

@@ -1071,7 +1071,7 @@ class NullPointerType extends BuiltInType {
  * const float fa[40];
  * ```
  */
-class DerivedType extends Type, NameQualifyingElement, @derivedtype {
+class DerivedType extends Type, @derivedtype {
   override string toString() { result = this.getName() }
 
   override string getName() { derivedtypes(underlyingElement(this), result, _, _) }

cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll

@@ -276,45 +276,6 @@ private predicate isClassConstructedFrom(Class c, Class templateClass) {
   not c.isConstructedFrom(_) and c = templateClass
 }
 
-/** Gets the fully templated version of `c`. */
-private Class getFullyTemplatedClassOld(Class c) {
-  not c.isFromUninstantiatedTemplate(_) and
-  isClassConstructedFrom(c, result)
-}
-
-private TemplateClass getOriginalClassTemplate(TemplateClass tc) {
-  result = tc.getOriginalTemplate()
-  or
-  not exists(tc.getOriginalTemplate()) and
-  result = tc
-}
-
-/** Gets the fully templated version of `c`. */
-private Class getFullyTemplatedClassNew(Class c) {
-  not c.isFromUninstantiatedTemplate(_) and
-  exists(Class mid |
-    c.isConstructedFrom(mid)
-    or
-    not c.isConstructedFrom(_) and c = mid
-  |
-    result = getOriginalClassTemplate(mid)
-    or
-    not mid instanceof TemplateClass and mid = result
-  )
-}
-
-/** Gets the fully templated version of `c`. */
-private Class getFullyTemplatedClass(Class c) {
-  // The `Class::getOriginalTemplate` predicate was introduced in CodeQL
-  // version 2.25.6 and the upgrade script leaves the
-  // `class_template_generated_from` extensionals empty if the database
-  // was generated with an older extractor. So we use the old implementation
-  // if the `class_template_generated_from` extensional is empty.
-  if class_template_generated_from(_, _)
-  then result = getFullyTemplatedClassNew(c)
-  else result = getFullyTemplatedClassOld(c)
-}
-
 /**
  * Holds if `f` is an instantiation of a function template `templateFunc`, or
  * holds with `f = templateFunc` if `f` is not an instantiation of any function
@@ -331,7 +292,7 @@ private predicate isFunctionConstructedFrom(Function f, Function templateFunc) {
 }
 
 /** Gets the fully templated version of `f`. */
-private Function getFullyTemplatedFunctionOld(Function f) {
+Function getFullyTemplatedFunction(Function f) {
   not f.isFromUninstantiatedTemplate(_) and
   (
     exists(Class c, Class templateClass, int i |
@@ -345,46 +306,13 @@ private Function getFullyTemplatedFunctionOld(Function f) {
   )
 }
 
-private TemplateFunction getOriginalFunctionTemplate(TemplateFunction tf) {
-  result = tf.getOriginalTemplate()
-  or
-  not exists(tf.getOriginalTemplate()) and
-  result = tf
-}
-
-/** Gets the fully templated version of `f`. */
-private Function getFullyTemplatedFunctionNew(Function f) {
-  not f.isFromUninstantiatedTemplate(_) and
-  exists(Function mid |
-    f.isConstructedFrom(mid)
-    or
-    not f.isConstructedFrom(_) and f = mid
-  |
-    result = getOriginalFunctionTemplate(mid)
-    or
-    not mid instanceof TemplateFunction and mid = result
-  )
-}
-
-/** Gets the fully templated version of `f`. */
-Function getFullyTemplatedFunction(Function f) {
-  // The `Function::getOriginalTemplate` predicate was introduced in CodeQL
-  // version 2.25.6 and the upgrade script leaves the
-  // `function_template_generated_from` extensionals empty if the database
-  // was generated with an older extractor. So we use the old implementation
-  // if the `function_template_generated_from` extensional is empty.
-  if function_template_generated_from(_, _)
-  then result = getFullyTemplatedFunctionNew(f)
-  else result = getFullyTemplatedFunctionOld(f)
-}
-
 /** Prefixes `const` to `s` if `t` is const, or returns `s` otherwise. */
 bindingset[s, t]
 private string withConst(string s, Type t) {
   if t.isConst() then result = "const " + s else result = s
 }
 
-/** Prefixes `volatile` to `s` if `t` is volatile, or returns `s` otherwise. */
+/** Prefixes `volatile` to `s` if `t` is const, or returns `s` otherwise. */
 bindingset[s, t]
 private string withVolatile(string s, Type t) {
   if t.isVolatile() then result = "volatile " + s else result = s
@@ -562,7 +490,7 @@ pragma[nomagic]
 private string getTypeNameWithoutClassTemplates(Function f, int n, int remaining) {
   // If there is a declaring type then we start by expanding the function templates
   exists(Class template |
-    template = getFullyTemplatedClass(f.getDeclaringType()) and
+    isClassConstructedFrom(f.getDeclaringType(), template) and
     remaining = getNumberOfSupportedClassTemplateArguments(template) and
     result = getTypeNameWithoutFunctionTemplates(f, n, 0)
   )
@@ -574,7 +502,7 @@ private string getTypeNameWithoutClassTemplates(Function f, int n, int remaining
   or
   exists(string mid, TypeTemplateParameter tp, Class template |
     mid = getTypeNameWithoutClassTemplates(f, n, remaining + 1) and
-    template = getFullyTemplatedClass(f.getDeclaringType()) and
+    isClassConstructedFrom(f.getDeclaringType(), template) and
     tp = getSupportedClassTemplateArgument(template, remaining)
   |
     result = mid.replaceAll(tp.getName(), "class:" + remaining.toString())

cpp/ql/lib/semmle/code/cpp/internal/ResolveClass.qll

@@ -1,5 +1,59 @@
 import semmle.code.cpp.Type
 
+/** For upgraded databases without mangled name info. */
+pragma[noinline]
+private string getTopLevelClassName(@usertype c) {
+  not mangled_name(_, _, _) and
+  isClass(c) and
+  usertypes(c, result, _) and
+  not namespacembrs(_, c) and // not in a namespace
+  not member(_, _, c) and // not in some structure
+  not class_instantiation(c, _) // not a template instantiation
+}
+
+/**
+ * For upgraded databases without mangled name info.
+ * Holds if `d` is a unique complete class named `name`.
+ */
+pragma[noinline]
+private predicate existsCompleteWithName(string name, @usertype d) {
+  not mangled_name(_, _, _) and
+  is_complete(d) and
+  name = getTopLevelClassName(d) and
+  onlyOneCompleteClassExistsWithName(name)
+}
+
+/** For upgraded databases without mangled name info. */
+pragma[noinline]
+private predicate onlyOneCompleteClassExistsWithName(string name) {
+  not mangled_name(_, _, _) and
+  strictcount(@usertype c | is_complete(c) and getTopLevelClassName(c) = name) = 1
+}
+
+/**
+ * For upgraded databases without mangled name info.
+ * Holds if `c` is an incomplete class named `name`.
+ */
+pragma[noinline]
+private predicate existsIncompleteWithName(string name, @usertype c) {
+  not mangled_name(_, _, _) and
+  not is_complete(c) and
+  name = getTopLevelClassName(c)
+}
+
+/**
+ * For upgraded databases without mangled name info.
+ * Holds if `c` is an incomplete class, and there exists a unique complete class `d`
+ * with the same name.
+ */
+private predicate oldHasCompleteTwin(@usertype c, @usertype d) {
+  not mangled_name(_, _, _) and
+  exists(string name |
+    existsIncompleteWithName(name, c) and
+    existsCompleteWithName(name, d)
+  )
+}
+
 pragma[noinline]
 private @mangledname getClassMangledName(@usertype c) {
   isClass(c) and
@@ -49,7 +103,10 @@ private module Cached {
   @usertype resolveClass(@usertype c) {
     hasCompleteTwin(c, result)
     or
+    oldHasCompleteTwin(c, result)
+    or
     not hasCompleteTwin(c, _) and
+    not oldHasCompleteTwin(c, _) and
     result = c
   }
 

cpp/ql/lib/semmlecode.cpp.dbscheme

@@ -1430,8 +1430,7 @@ specialnamequalifyingelements(
 @namequalifyingelement = @namespace
                        | @specialnamequalifyingelement
                        | @usertype
-                       | @decltype
-                       | @derivedtype;
+                       | @decltype;
 
 namequalifiers(
     unique int id: @namequalifier,

cpp/ql/lib/upgrades/ef8d209a22e27413aaaeff4446f0ecb9fa2c227b/upgrade.properties

@@ -1,2 +0,0 @@
-description: Fix NameQualifier inconsistency
-compatibility: full

cpp/ql/src/CHANGELOG.md

@@ -1,7 +1,3 @@
-## 1.6.4
-
-No user-facing changes.
-
 ## 1.6.3
 
 ### Minor Analysis Improvements

cpp/ql/src/change-notes/released/1.6.4.md

@@ -1,3 +0,0 @@
-## 1.6.4
-
-No user-facing changes.

cpp/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.6.4
+lastReleaseVersion: 1.6.3

cpp/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cpp-queries
-version: 1.6.5-dev
+version: 1.6.4-dev
 groups:
   - cpp
   - queries

cpp/ql/test/examples/BadLocking/AV Rule 107.qlref

@@ -1,2 +1 @@
-query: jsf/4.13 Functions/AV Rule 107.ql
-postprocess: utils/test/InlineExpectationsTestQuery.ql
+jsf/4.13 Functions/AV Rule 107.ql

cpp/ql/test/examples/BadLocking/LocalVariableHidesGlobalVariable.qlref

@@ -1,2 +1 @@
-query: Best Practices/Hiding/LocalVariableHidesGlobalVariable.ql
-postprocess: utils/test/InlineExpectationsTestQuery.ql
+Best Practices/Hiding/LocalVariableHidesGlobalVariable.ql

cpp/ql/test/examples/BadLocking/UnintendedDeclaration.cpp

@@ -48,7 +48,7 @@ void test1()
 
 void test2()
 {
-	Lock<Mutex> myLock(); // BAD (interpreted as a function declaration, this does nothing) // $ Alert[cpp/function-in-block]
+	Lock<Mutex> myLock(); // BAD (interpreted as a function declaration, this does nothing)
 
 	// ...
 }
@@ -62,14 +62,14 @@ void test3()
 
 void test4()
 {
-	Lock<Mutex>(myMutex); // BAD (creates an uninitialized variable called `myMutex`, probably not intended) // $ Alert[cpp/local-variable-hides-global-variable]
+	Lock<Mutex>(myMutex); // BAD (creates an uninitialized variable called `myMutex`, probably not intended)
 
 	// ...
 }
 
 void test5()
 {
-	Lock<Mutex> myLock(Mutex); // BAD (interpreted as a function declaration, this does nothing) // $ Alert[cpp/function-in-block]
+	Lock<Mutex> myLock(Mutex); // BAD (interpreted as a function declaration, this does nothing)
 
 	// ...
 }

cpp/ql/test/examples/expressions/PrintAST.qlref

@@ -1 +1 @@
-query: semmle/code/cpp/PrintAST.ql
+semmle/code/cpp/PrintAST.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-020/NoCheckBeforeUnsafePutUser/NoCheckBeforeUnsafePutUser.qlref

@@ -1,2 +1 @@
-query: experimental/Security/CWE/CWE-020/NoCheckBeforeUnsafePutUser.ql
-postprocess: utils/test/InlineExpectationsTestQuery.ql
+experimental/Security/CWE/CWE-020/NoCheckBeforeUnsafePutUser.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-020/semmle/tests/LateCheckOfFunctionArgument.qlref

@@ -1,2 +1 @@
-query: experimental/Security/CWE/CWE-020/LateCheckOfFunctionArgument.ql
-postprocess: utils/test/InlineExpectationsTestQuery.ql
+experimental/Security/CWE/CWE-020/LateCheckOfFunctionArgument.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-020/semmle/tests/test.c

@@ -3,6 +3,6 @@ void workFunction_0(char *s) {
   char buf[80], buf1[8];
   if(len<0) return;
   memset(buf,0,len); //GOOD
-  memset(buf1,0,len1); //BAD // $ Alert
+  memset(buf1,0,len1); //BAD
   if(len1<0) return;
 }

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-078/WordexpTainted.qlref

@@ -1,2 +1 @@
-query: experimental/Security/CWE/CWE-078/WordexpTainted.ql
-postprocess: utils/test/InlineExpectationsTestQuery.ql
+experimental/Security/CWE/CWE-078/WordexpTainted.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-078/test.cpp

@@ -19,14 +19,14 @@ enum {
 
 int wordexp(const char *restrict s, wordexp_t *restrict p, int flags);
 
-int main(int argc, char** argv) { // $ Source
+int main(int argc, char** argv) {
   char *filePath = argv[2];
 
   {
     // BAD: the user string is injected directly into `wordexp` which performs command substitution
 
     wordexp_t we;
-    wordexp(filePath, &we, 0); // $ Alert
+    wordexp(filePath, &we, 0);
   }
 
   {

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1041/semmle/tests/FindWrapperFunctions.qlref

@@ -1,2 +1 @@
-query: experimental/Security/CWE/CWE-1041/FindWrapperFunctions.ql
-postprocess: utils/test/InlineExpectationsTestQuery.ql
+experimental/Security/CWE/CWE-1041/FindWrapperFunctions.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1041/semmle/tests/test.cpp

@@ -20,7 +20,7 @@ void myFclose(FILE * fmy)
 int main(int argc, char *argv[])
 {
   fe = fopen("myFile.txt", "wt");
-  fclose(fe); // BAD // $ Alert
+  fclose(fe); // BAD
   fe = fopen("myFile.txt", "wt");
   myFclose(fe); // GOOD
   return 0;

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1126/semmle/tests/DeclarationOfVariableWithUnnecessarilyWideScope.qlref

@@ -1,2 +1 @@
-query: experimental/Security/CWE/CWE-1126/DeclarationOfVariableWithUnnecessarilyWideScope.ql
-postprocess: utils/test/InlineExpectationsTestQuery.ql
+experimental/Security/CWE/CWE-1126/DeclarationOfVariableWithUnnecessarilyWideScope.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1126/semmle/tests/test.c

@@ -11,7 +11,7 @@ void workFunction_0(char *s) {
   while(intIndex > 2)
   {
     buf[intIndex] = 1;
-    int intIndex; // BAD // $ Alert
+    int intIndex; // BAD
     intIndex--;
   }
   intIndex = 10;

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1240/CustomCryptographicPrimitive.qlref

@@ -1,2 +1 @@
-query: experimental/Security/CWE/CWE-1240/CustomCryptographicPrimitive.ql
-postprocess: utils/test/InlineExpectationsTestQuery.ql
+experimental/Security/CWE/CWE-1240/CustomCryptographicPrimitive.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1240/tests_crypto.cpp

@@ -8,7 +8,7 @@ int strlen(const char *string);
 
 // the following function is homebrew crypto written for this test.  This is a bad algorithm
 // on multiple levels and should never be used in cryptography.
-void encryptString(char *string, unsigned int key) { // $ Alert
+void encryptString(char *string, unsigned int key) {
 	char *ptr = string;
 	int len = strlen(string);
 
@@ -27,7 +27,7 @@ void encryptString(char *string, unsigned int key) { // $ Alert
 
 // the following function is homebrew crypto written for this test.  This is a bad algorithm
 // on multiple levels and should never be used in cryptography.
-void MyEncrypt(const unsigned int *dataIn, unsigned int *dataOut, unsigned int dataSize, unsigned int key[2]) { // $ Alert
+void MyEncrypt(const unsigned int *dataIn, unsigned int *dataOut, unsigned int dataSize, unsigned int key[2]) {
 	unsigned int state[2];
 	unsigned int t;
 
@@ -48,7 +48,7 @@ void MyEncrypt(const unsigned int *dataIn, unsigned int *dataOut, unsigned int d
 // the following function resembles an implementation of the AES "mix columns"
 // step. It is not accurate, efficient or safe and should never be used in
 // cryptography.
-void mix_columns(const uint8_t inputs[4], uint8_t outputs[4]) { // $ Alert
+void mix_columns(const uint8_t inputs[4], uint8_t outputs[4]) {
 	// The "mix columns" step takes four bytes as inputs. Each byte represents a
 	// polynomial with 8 one-bit coefficients, e.g. input bits 00001101
 	// represent the polynomial x^3 + x^2 + 1.  Arithmetic is reduced modulo
@@ -80,7 +80,7 @@ void mix_columns(const uint8_t inputs[4], uint8_t outputs[4]) { // $ Alert
 // the following function resembles initialization of an S-box as may be done
 // in an implementation of DES, AES and other encryption algorithms. It is not
 // accurate, efficient or safe and should never be used in cryptography.
-void init_aes_sbox(unsigned char data[256]) { // $ Alert
+void init_aes_sbox(unsigned char data[256]) {
 	// initialize `data` in a loop using lots of ^, ^= and << operations and
 	// a few fixed constants.
 	unsigned int state = 0x12345678;

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-125/semmle/tests/DangerousWorksWithMultibyteOrWideCharacters.qlref

@@ -1,2 +1 @@
-query: experimental/Security/CWE/CWE-125/DangerousWorksWithMultibyteOrWideCharacters.ql
-postprocess: utils/test/InlineExpectationsTestQuery.ql
+experimental/Security/CWE/CWE-125/DangerousWorksWithMultibyteOrWideCharacters.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-125/semmle/tests/test.cpp

@@ -63,7 +63,7 @@ static void badTest1(const char* ptr)
   int ret;
   int len;
   len = strlen(ptr);
-  for (wchar_t wc; (ret = mbtowc(&wc, ptr, 4)) > 0; len-=ret) { // BAD:we can get unpredictable results // $ Alert
+  for (wchar_t wc; (ret = mbtowc(&wc, ptr, 4)) > 0; len-=ret) { // BAD:we can get unpredictable results
     wprintf(L"%lc", wc);
     ptr += ret;
   }
@@ -73,7 +73,7 @@ static void badTest2(const char* ptr)
   int ret;
   int len;
   len = strlen(ptr);
-  for (wchar_t wc; (ret = mbtowc(&wc, ptr, sizeof(wchar_t))) > 0; len-=ret) { // BAD:we can get unpredictable results // $ Alert
+  for (wchar_t wc; (ret = mbtowc(&wc, ptr, sizeof(wchar_t))) > 0; len-=ret) { // BAD:we can get unpredictable results
     wprintf(L"%lc", wc);
     ptr += ret;
   }
@@ -103,7 +103,7 @@ static void badTest3(const char* ptr,int wc_len)
   len = wc_len;
   wchar_t *wc = new wchar_t[wc_len];
   while (*ptr && len > 0) {
-    ret = mbtowc(wc, ptr, MB_CUR_MAX); // BAD // $ Alert
+    ret = mbtowc(wc, ptr, MB_CUR_MAX); // BAD
     if (ret <0)
       break;
     if (ret == 0 || ret > len)
@@ -120,7 +120,7 @@ static void badTest4(const char* ptr,int wc_len)
   len = wc_len;
   wchar_t *wc = new wchar_t[wc_len];
   while (*ptr && len > 0) {
-    ret = mbtowc(wc, ptr, 16); // BAD // $ Alert
+    ret = mbtowc(wc, ptr, 16); // BAD
     if (ret <0)
       break;
     if (ret == 0 || ret > len)
@@ -137,7 +137,7 @@ static void badTest5(const char* ptr,int wc_len)
   len = wc_len;
   wchar_t *wc = new wchar_t[wc_len];
   while (*ptr && len > 0) {
-    ret = mbtowc(wc, ptr, sizeof(wchar_t)); // BAD // $ Alert
+    ret = mbtowc(wc, ptr, sizeof(wchar_t)); // BAD
     if (ret <0)
       break;
     if (ret == 0 || ret > len)
@@ -155,7 +155,7 @@ static void badTest6(const char* ptr,int wc_len)
   len = wc_len;
   wchar_t *wc = new wchar_t[wc_len];
   while (*ptr && wc_len > 0) {
-    ret = mbtowc(wc, ptr, wc_len); // BAD // $ Alert
+    ret = mbtowc(wc, ptr, wc_len); // BAD
     if (ret <0)
       if (checkErrors()) {
         ++ptr;
@@ -178,7 +178,7 @@ static void badTest7(const char* ptr,int wc_len)
   len = wc_len;
   wchar_t *wc = new wchar_t[wc_len];
   while (*ptr && wc_len > 0) {
-    ret = mbtowc(wc, ptr, len); // BAD // $ Alert
+    ret = mbtowc(wc, ptr, len); // BAD
     if (ret <0)
         break;
     if (ret == 0 || ret > len)
@@ -194,7 +194,7 @@ static void badTest8(const char* ptr,wchar_t *wc)
   int len;
   len = strlen(ptr);
   while (*ptr && len > 0) {
-    ret = mbtowc(wc, ptr, len); // BAD // $ Alert
+    ret = mbtowc(wc, ptr, len); // BAD
     if (ret <0)
       break;
     if (ret == 0 || ret > len)

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-125/semmle/tests/test1.cpp

@@ -25,8 +25,8 @@ void* calloc (size_t num, size_t size);
 void* malloc (size_t size);
 
 static void badTest1(void *src,  int size) {
-    WideCharToMultiByte(CP_ACP, 0, (LPCWSTR)src, -1, (LPSTR)src, size, 0, 0); // BAD // $ Alert
-    MultiByteToWideChar(CP_ACP, 0, (LPCSTR)src, -1, (LPCWSTR)src, 30); // BAD // $ Alert
+    WideCharToMultiByte(CP_ACP, 0, (LPCWSTR)src, -1, (LPSTR)src, size, 0, 0); // BAD
+    MultiByteToWideChar(CP_ACP, 0, (LPCSTR)src, -1, (LPCWSTR)src, 30); // BAD
 }
 void goodTest2(){
   wchar_t src[] = L"0123456789ABCDEF";
@@ -42,7 +42,7 @@ void goodTest2(){
 static void badTest2(){
   wchar_t src[] = L"0123456789ABCDEF";
   char dst[16];
-  WideCharToMultiByte(CP_UTF8, 0, src, -1, dst, 16, NULL, NULL); // BAD // $ Alert
+  WideCharToMultiByte(CP_UTF8, 0, src, -1, dst, 16, NULL, NULL); // BAD
   printf("%s\n", dst);
 }
 static void goodTest3(){
@@ -55,7 +55,7 @@ static void badTest3(){
   char src[] = "0123456789ABCDEF";
   int size = MultiByteToWideChar(CP_UTF8, 0, src,sizeof(src),NULL,0);
   wchar_t * dst = (wchar_t*)calloc(size + 1, 1);
-  MultiByteToWideChar(CP_UTF8, 0, src, -1, dst, size+1); // BAD // $ Alert
+  MultiByteToWideChar(CP_UTF8, 0, src, -1, dst, size+1); // BAD
 }
 static void goodTest4(){
   char src[] = "0123456789ABCDEF";
@@ -67,13 +67,13 @@ static void badTest4(){
   char src[] = "0123456789ABCDEF";
   int size = MultiByteToWideChar(CP_UTF8, 0, src,sizeof(src),NULL,0);
   wchar_t * dst = (wchar_t*)malloc(size + 1);
-  MultiByteToWideChar(CP_UTF8, 0, src, -1, dst, size+1); // BAD // $ Alert
+  MultiByteToWideChar(CP_UTF8, 0, src, -1, dst, size+1); // BAD
 }
 static int goodTest5(void *src){
   return WideCharToMultiByte(CP_ACP, 0, (LPCWSTR)src, -1, 0, 0, 0, 0); // GOOD
 }
 static int badTest5 (void *src) {
-  return WideCharToMultiByte(CP_ACP, 0, (LPCWSTR)src, -1, 0, 3, 0, 0);  // BAD // $ Alert
+  return WideCharToMultiByte(CP_ACP, 0, (LPCWSTR)src, -1, 0, 3, 0, 0);  // BAD
 }
 static void goodTest6(WCHAR *src)
 {
@@ -90,6 +90,6 @@ static void goodTest6(WCHAR *src)
 static void badTest6(WCHAR *src)
 {
     char dst[5] ="";
-    WideCharToMultiByte(CP_ACP, 0, src, -1, dst, 260, 0, 0); // BAD // $ Alert
+    WideCharToMultiByte(CP_ACP, 0, src, -1, dst, 260, 0, 0); // BAD
     printf("%s\n", dst);
 }

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-125/semmle/tests/test2.cpp

@@ -12,11 +12,11 @@ size_t mbsrtowcs(wchar_t *wcstr,const char *mbstr,size_t count, mbstate_t *mbsta
 
 
 static void badTest1(void *src,  int size) {
-    mbstowcs((wchar_t*)src,(char*)src,size); // BAD // $ Alert
+    mbstowcs((wchar_t*)src,(char*)src,size); // BAD
     _locale_t locale;
-    _mbstowcs_l((wchar_t*)src,(char*)src,size,locale); // BAD // $ Alert
+    _mbstowcs_l((wchar_t*)src,(char*)src,size,locale); // BAD
     mbstate_t *mbstate;
-    mbsrtowcs((wchar_t*)src,(char*)src,size,mbstate); // BAD // $ Alert
+    mbsrtowcs((wchar_t*)src,(char*)src,size,mbstate); // BAD
 }
 static void goodTest2(){
   char src[] = "0123456789ABCDEF";
@@ -32,7 +32,7 @@ static void goodTest2(){
 static void badTest2(){
   char src[] = "0123456789ABCDEF";
   wchar_t dst[16];
-  mbstowcs(dst, src,16); // BAD // $ Alert
+  mbstowcs(dst, src,16); // BAD
   printf("%s\n", dst);
 }
 static void goodTest3(){
@@ -45,7 +45,7 @@ static void badTest3(){
   char src[] = "0123456789ABCDEF";
   int size = mbstowcs(NULL, src,NULL);
   wchar_t * dst = (wchar_t*)calloc(size + 1, 1);
-  mbstowcs(dst, src,size+1); // BAD // $ Alert
+  mbstowcs(dst, src,size+1); // BAD
 }
 static void goodTest4(){
   char src[] = "0123456789ABCDEF";
@@ -57,13 +57,13 @@ static void badTest4(){
   char src[] = "0123456789ABCDEF";
   int size = mbstowcs(NULL, src,NULL);
   wchar_t * dst = (wchar_t*)malloc(size + 1);
-  mbstowcs(dst, src,size+1); // BAD // $ Alert
+  mbstowcs(dst, src,size+1); // BAD
 }
 static int goodTest5(void *src){
   return mbstowcs(NULL, (char*)src,NULL); // GOOD
 }
 static int badTest5 (void *src) {
-  return mbstowcs(NULL, (char*)src,3); // BAD // $ Alert
+  return mbstowcs(NULL, (char*)src,3); // BAD
 }
 static void goodTest6(void *src){
   wchar_t dst[5];
@@ -77,6 +77,6 @@ static void goodTest6(void *src){
 }
 static void badTest6(void *src){
   wchar_t dst[5];
-  mbstowcs(dst, (char*)src,260); // BAD // $ Alert
+  mbstowcs(dst, (char*)src,260); // BAD
   printf("%s\n", dst);
 }

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-125/semmle/tests/test3.cpp

@@ -13,7 +13,7 @@ static size_t badTest1(unsigned char *src){
   int cb = 0;
   unsigned char dst[50];
   while( cb < sizeof(dst) )
-    dst[cb++]=*src++; // BAD // $ Alert
+    dst[cb++]=*src++; // BAD
   return _mbclen(dst);
 }
 static void goodTest2(unsigned char *src){
@@ -33,7 +33,7 @@ static void badTest2(unsigned char *src){
   unsigned char dst[50];
   while( cb < sizeof(dst) )
   {
-    _mbccpy(dst+cb,src); // BAD // $ Alert
+    _mbccpy(dst+cb,src); // BAD
     cb+=_mbclen(src);
     src=_mbsinc(src);
   }
@@ -44,5 +44,5 @@ static void goodTest3(){
 }
 static void badTest3(){
   wchar_t name[50];
-  name[sizeof(name) - 1] = L'\0'; // BAD // $ Alert
+  name[sizeof(name) - 1] = L'\0'; // BAD
 }

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/AllocMultiplicationOverflow/AllocMultiplicationOverflow.qlref

@@ -1,2 +1 @@
-query: experimental/Security/CWE/CWE-190/AllocMultiplicationOverflow.ql
-postprocess: utils/test/InlineExpectationsTestQuery.ql
+experimental/Security/CWE/CWE-190/AllocMultiplicationOverflow.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/AllocMultiplicationOverflow/test.cpp

@@ -10,31 +10,31 @@ void test()
 	int y = getAnInt();
 
 	char *buffer1 = (char *)malloc(x + y); // GOOD
-	char *buffer2 = (char *)malloc(x * y); // BAD // $ Alert
+	char *buffer2 = (char *)malloc(x * y); // BAD
 	int *buffer3 = (int *)malloc(x * sizeof(int)); // GOOD
-	int *buffer4 = (int *)malloc(x * y * sizeof(int)); // BAD // $ Alert
+	int *buffer4 = (int *)malloc(x * y * sizeof(int)); // BAD
 
 	if ((x <= 1000) && (y <= 1000))
 	{
-		char *buffer5 = (char *)malloc(x * y); // GOOD [FALSE POSITIVE] // $ Alert
+		char *buffer5 = (char *)malloc(x * y); // GOOD [FALSE POSITIVE]
 	}
 
-	size_t size1 = x * y; // $ Source
-	char *buffer5 = (char *)malloc(size1); // BAD // $ Alert
+	size_t size1 = x * y;
+	char *buffer5 = (char *)malloc(size1); // BAD
 
 	size_t size2 = x;
 	size2 *= y;
 	char *buffer6 = (char *)malloc(size2); // BAD [NOT DETECTED]
 
 	char *buffer7 = new char[x * 10]; // GOOD
-	char *buffer8 = new char[x * y]; // BAD // $ Alert
-	char *buffer9 = new char[x * x]; // BAD // $ Alert
+	char *buffer8 = new char[x * y]; // BAD
+	char *buffer9 = new char[x * x]; // BAD
 }
 
 
 // --- custom allocators ---
  
-void *MyMalloc1(size_t size) { return malloc(size); } // [additional detection here] // $ Alert
+void *MyMalloc1(size_t size) { return malloc(size); } // [additional detection here]
 void *MyMalloc2(size_t size);
 
 void customAllocatorTests()
@@ -42,6 +42,6 @@ void customAllocatorTests()
 	int x = getAnInt();
 	int y = getAnInt();
 
-	char *buffer1 = (char *)MyMalloc1(x * y); // BAD // $ Alert Source
-	char *buffer2 = (char *)MyMalloc2(x * y); // BAD // $ Alert
+	char *buffer1 = (char *)MyMalloc1(x * y); // BAD
+	char *buffer2 = (char *)MyMalloc2(x * y); // BAD
 }

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/DangerousUseOfTransformationAfterOperation/DangerousUseOfTransformationAfterOperation.qlref

@@ -1,2 +1 @@
-query: experimental/Security/CWE/CWE-190/DangerousUseOfTransformationAfterOperation.ql
-postprocess: utils/test/InlineExpectationsTestQuery.ql
+experimental/Security/CWE/CWE-190/DangerousUseOfTransformationAfterOperation.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/DangerousUseOfTransformationAfterOperation/test.cpp

@@ -6,17 +6,17 @@ void functionWork(char aA[10],unsigned int aUI) {
   int aI;
 
   aI = (aUI*8)/10; // GOOD
-  aI = aUI*8; // BAD // $ Alert
+  aI = aUI*8; // BAD
   aP = aA+aI;
   aI = (int)aUI*8; // GOOD
   
-  aL = (unsigned long)(aI*aI); // BAD // $ Alert
+  aL = (unsigned long)(aI*aI); // BAD
   aL = ((unsigned long)aI*aI); // GOOD
   
-  testCall((unsigned long)(aI*aI)); // BAD // $ Alert
+  testCall((unsigned long)(aI*aI)); // BAD
   testCall(((unsigned long)aI*aI)); // GOOD
   
-  if((unsigned long)(aI*aI) > aL) // BAD // $ Alert
+  if((unsigned long)(aI*aI) > aL) // BAD
     return;
   if(((unsigned long)aI*aI) > aL) // GOOD
     return;

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/IfStatementAdditionOverflow/IfStatementAdditionOverflow.qlref

@@ -1,2 +1 @@
-query: experimental/Security/CWE/CWE-190/IfStatementAdditionOverflow.ql
-postprocess: utils/test/InlineExpectationsTestQuery.ql
+experimental/Security/CWE/CWE-190/IfStatementAdditionOverflow.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/IfStatementAdditionOverflow/test.cpp

@@ -15,49 +15,49 @@ void test()
 	unsigned short b1 = getAnUnsignedShort();
 	unsigned short c1 = getAnUnsignedShort();
 
-	if (a+b>c) a = c-b; // BAD // $ Alert
-	if (a+b>c) { a = c-b; } // BAD // $ Alert
-	if (b+a>c) a = c-b; // BAD // $ Alert
-	if (b+a>c) { a = c-b; } // BAD // $ Alert
-	if (c>a+b) a = c-b; // BAD // $ Alert
-	if (c>a+b) { a = c-b; } // BAD // $ Alert
-	if (c>b+a) a = c-b; // BAD // $ Alert
-	if (c>b+a) { a = c-b; } // BAD // $ Alert
+	if (a+b>c) a = c-b; // BAD
+	if (a+b>c) { a = c-b; } // BAD
+	if (b+a>c) a = c-b; // BAD
+	if (b+a>c) { a = c-b; } // BAD
+	if (c>a+b) a = c-b; // BAD
+	if (c>a+b) { a = c-b; } // BAD
+	if (c>b+a) a = c-b; // BAD
+	if (c>b+a) { a = c-b; } // BAD
 
-	if (a+b>=c) a = c-b; // BAD // $ Alert
-	if (a+b>=c) { a = c-b; } // BAD // $ Alert
-	if (b+a>=c) a = c-b; // BAD // $ Alert
-	if (b+a>=c) { a = c-b; } // BAD // $ Alert
-	if (c>=a+b) a = c-b; // BAD // $ Alert
-	if (c>=a+b) { a = c-b; } // BAD // $ Alert
-	if (c>=b+a) a = c-b; // BAD // $ Alert
-	if (c>=b+a) { a = c-b; } // BAD // $ Alert
+	if (a+b>=c) a = c-b; // BAD
+	if (a+b>=c) { a = c-b; } // BAD
+	if (b+a>=c) a = c-b; // BAD
+	if (b+a>=c) { a = c-b; } // BAD
+	if (c>=a+b) a = c-b; // BAD
+	if (c>=a+b) { a = c-b; } // BAD
+	if (c>=b+a) a = c-b; // BAD
+	if (c>=b+a) { a = c-b; } // BAD
 
-	if (a+b<c) a = c-b; // BAD // $ Alert
-	if (a+b<c) { a = c-b; } // BAD // $ Alert
-	if (b+a<c) a = c-b; // BAD // $ Alert
-	if (b+a<c) { a = c-b; } // BAD // $ Alert
-	if (c<a+b) a = c-b; // BAD // $ Alert
-	if (c<a+b) { a = c-b; } // BAD // $ Alert
-	if (c<b+a) a = c-b; // BAD // $ Alert
-	if (c<b+a) { a = c-b; } // BAD // $ Alert
+	if (a+b<c) a = c-b; // BAD
+	if (a+b<c) { a = c-b; } // BAD
+	if (b+a<c) a = c-b; // BAD
+	if (b+a<c) { a = c-b; } // BAD
+	if (c<a+b) a = c-b; // BAD
+	if (c<a+b) { a = c-b; } // BAD
+	if (c<b+a) a = c-b; // BAD
+	if (c<b+a) { a = c-b; } // BAD
 
-	if (a+b<=c) a = c-b; // BAD // $ Alert
-	if (a+b<=c) { a = c-b; } // BAD // $ Alert
-	if (b+a<=c) a = c-b; // BAD // $ Alert
-	if (b+a<=c) { a = c-b; } // BAD // $ Alert
-	if (c<=a+b) a = c-b; // BAD // $ Alert
-	if (c<=a+b) { a = c-b; } // BAD // $ Alert
-	if (c<=b+a) a = c-b; // BAD // $ Alert
-	if (c<=b+a) { a = c-b; } // BAD // $ Alert
+	if (a+b<=c) a = c-b; // BAD
+	if (a+b<=c) { a = c-b; } // BAD
+	if (b+a<=c) a = c-b; // BAD
+	if (b+a<=c) { a = c-b; } // BAD
+	if (c<=a+b) a = c-b; // BAD
+	if (c<=a+b) { a = c-b; } // BAD
+	if (c<=b+a) a = c-b; // BAD
+	if (c<=b+a) { a = c-b; } // BAD
 
-	if (a+b>d) a = d-b; // BAD // $ Alert
+	if (a+b>d) a = d-b; // BAD
 	if (a+(double)b>c) a = c-b; // GOOD
 	if (a+(-x)>c) a = c-(-y); // GOOD
 	if (a+b>c) { b++; a = c-b; } // GOOD
 	if (a+d>c) a = c-d; // GOOD
 	if (a1+b1>c1) a1 = c1-b1; // GOOD
 	
-	if (a+b<=c) { /* ... */ } else { a = c-b; } // BAD // $ Alert
-	if (a+b<=c) { return; } a = c-b; // BAD // $ Alert
+	if (a+b<=c) { /* ... */ } else { a = c-b; } // BAD
+	if (a+b<=c) { return; } a = c-b; // BAD
 }

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/array-access/ArrayAccessProductFlow.qlref

@@ -1,2 +1 @@
-query: experimental/Likely Bugs/ArrayAccessProductFlow.ql
-postprocess: utils/test/InlineExpectationsTestQuery.ql
+experimental/Likely Bugs/ArrayAccessProductFlow.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/array-access/test.cpp

@@ -1,13 +1,13 @@
 char *malloc(int size);
 
 void test1(int size) {
-    char *arr = malloc(size); // $ Source
+    char *arr = malloc(size);
     for (int i = 0; i < size; i++) {
         arr[i] = 0; // GOOD
     }
 
     for (int i = 0; i <= size; i++) {
-        arr[i] = i; // BAD // $ Alert
+        arr[i] = i; // BAD
     }
 }
 
@@ -18,7 +18,7 @@ typedef struct {
 
 array_t mk_array(int size) {
     array_t arr;
-    arr.p = malloc(size); // $ Source
+    arr.p = malloc(size);
     arr.size = size;
 
     return arr;
@@ -32,7 +32,7 @@ void test2(int size) {
     }
 
     for (int i = 0; i <= arr.size; i++) {
-        arr.p[i] = i; // BAD // $ Alert
+        arr.p[i] = i; // BAD
     }
 }
 
@@ -42,7 +42,7 @@ void test3_callee(array_t arr) {
     }
 
     for (int i = 0; i <= arr.size; i++) {
-        arr.p[i] = i; // BAD // $ Alert
+        arr.p[i] = i; // BAD
     }
 }
 
@@ -52,7 +52,7 @@ void test3(int size) {
 
 void test4(int size) {
     array_t arr;
-    arr.p = malloc(size); // $ Source
+    arr.p = malloc(size);
     arr.size = size;
 
     for (int i = 0; i < arr.size; i++) {
@@ -60,13 +60,13 @@ void test4(int size) {
     }
 
     for (int i = 0; i <= arr.size; i++) {
-        arr.p[i] = i; // BAD // $ Alert
+        arr.p[i] = i; // BAD
     }
 }
 
 array_t *mk_array_p(int size) {
     array_t *arr = (array_t*) malloc(sizeof(array_t));
-    arr->p = malloc(size); // $ Source
+    arr->p = malloc(size);
     arr->size = size;
 
     return arr;
@@ -80,7 +80,7 @@ void test5(int size) {
     }
 
     for (int i = 0; i <= arr->size; i++) {
-        arr->p[i] = i; // BAD // $ Alert
+        arr->p[i] = i; // BAD
     }
 }
 
@@ -90,7 +90,7 @@ void test6_callee(array_t *arr) {
     }
 
     for (int i = 0; i <= arr->size; i++) {
-        arr->p[i] = i; // BAD // $ Alert
+        arr->p[i] = i; // BAD
     }
 }
 

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/constant-size/ConstantSizeArrayOffByOne.qlref

@@ -1,2 +1 @@
-query: experimental/Security/CWE/CWE-193/ConstantSizeArrayOffByOne.ql
-postprocess: utils/test/InlineExpectationsTestQuery.ql
+experimental/Security/CWE/CWE-193/ConstantSizeArrayOffByOne.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/constant-size/test.cpp

@@ -32,60 +32,60 @@ void testOneArray(OneArray *arr) {
 
 void testBig(BigArray *arr) {
     arr->buf[MAX_SIZE-1] = 0; // GOOD
-    arr->buf[MAX_SIZE] = 0;   // BAD // $ Alert
-    arr->buf[MAX_SIZE+1] = 0; // BAD // $ Alert
+    arr->buf[MAX_SIZE] = 0;   // BAD
+    arr->buf[MAX_SIZE+1] = 0; // BAD
 
     for(int i = 0; i < MAX_SIZE; i++) {
         arr->buf[i] = 0; // GOOD
     }
     
     for(int i = 0; i <= MAX_SIZE; i++) {
-        arr->buf[i] = 0; // BAD // $ Alert
+        arr->buf[i] = 0; // BAD
     }
 }
 
 void testFields(ArrayAndFields *arr) {
     arr->buf[MAX_SIZE-1] = 0; // GOOD
-    arr->buf[MAX_SIZE] = 0;   // BAD? // $ Alert
-    arr->buf[MAX_SIZE+1] = 0; // BAD? // $ Alert
+    arr->buf[MAX_SIZE] = 0;   // BAD?
+    arr->buf[MAX_SIZE+1] = 0; // BAD?
 
     for(int i = 0; i < MAX_SIZE; i++) {
         arr->buf[i] = 0; // GOOD
     }
     
     for(int i = 0; i <= MAX_SIZE; i++) {
-        arr->buf[i] = 0; // BAD? // $ Alert
+        arr->buf[i] = 0; // BAD?
     }
 
     for(int i = 0; i < MAX_SIZE+2; i++) {
-        arr->buf[i] = 0; // BAD? // $ Alert
+        arr->buf[i] = 0; // BAD?
     }
     // is this different if it's a memcpy?
 }
 
-void assignThroughPointer(int *p) { // $ Sink
+void assignThroughPointer(int *p) {
     *p = 0; // ??? should the result go at a flow source?
 }
 
 void addToPointerAndAssign(int *p) {
     p[MAX_SIZE-1] = 0; // GOOD
-    p[MAX_SIZE] = 0; // BAD // $ Alert
+    p[MAX_SIZE] = 0; // BAD
 }
 
 void testInterproc(BigArray *arr) {
     assignThroughPointer(&arr->buf[MAX_SIZE-1]); // GOOD
-    assignThroughPointer(&arr->buf[MAX_SIZE]); // BAD // $ Alert
+    assignThroughPointer(&arr->buf[MAX_SIZE]); // BAD
 
-    addToPointerAndAssign(arr->buf); // $ Source
+    addToPointerAndAssign(arr->buf);
 }
 
 #define MAX_SIZE_BYTES 4096
 
 void testCharIndex(BigArray *arr) {
-    char *charBuf = (char*) arr->buf; // $ Source
+    char *charBuf = (char*) arr->buf;
 
     charBuf[MAX_SIZE_BYTES - 1] = 0; // GOOD
-    charBuf[MAX_SIZE_BYTES] = 0; // BAD // $ Alert
+    charBuf[MAX_SIZE_BYTES] = 0; // BAD
 }
 
 void testEqRefinement() {
@@ -125,7 +125,7 @@ void testStackAllocated() {
     char *arr[MAX_SIZE];
 
     for(int i = 0; i <= MAX_SIZE; i++) {
-        arr[i] = 0; // BAD // $ Alert
+        arr[i] = 0; // BAD
     }
 }
 
@@ -133,18 +133,18 @@ int strncmp(const char*, const char*, int);
 
 char testStrncmp2(char *arr) {
     if(strncmp(arr, "<test>", 6) == 0) {
-        arr += 6; // $ Alert
+        arr += 6;
     }
-    return *arr; // GOOD [FALSE POSITIVE] // $ Sink
+    return *arr; // GOOD [FALSE POSITIVE]
 }
 
 void testStrncmp1() {
     char asdf[5];
-    testStrncmp2(asdf); // $ Source
+    testStrncmp2(asdf);
 }
 
 void countdownBuf1(int **p) {
-  *--(*p) = 1; // GOOD [FALSE POSITIVE] // $ Sink
+  *--(*p) = 1; // GOOD [FALSE POSITIVE]
   *--(*p) = 2; // GOOD
   *--(*p) = 3; // GOOD
   *--(*p) = 4; // GOOD
@@ -153,7 +153,7 @@ void countdownBuf1(int **p) {
 void countdownBuf2() {
   int buf[4];
 
-  int *x = buf + 4; // $ Alert
+  int *x = buf + 4;
 
   countdownBuf1(&x);
 }
@@ -215,10 +215,10 @@ int countdownLength2() {
 
 void pointer_size_larger_than_array_element_size() {
     unsigned char buffer[100]; // getByteSize() = 100
-    int *ptr = (int *)buffer; // pai.getElementSize() will be sizeof(int) = 4 -> size = 25 // $ Source
+    int *ptr = (int *)buffer; // pai.getElementSize() will be sizeof(int) = 4 -> size = 25
 
     ptr[24] = 0; // GOOD: writes bytes 96, 97, 98, 99
-    ptr[25] = 0; // BAD: writes bytes 100, 101, 102, 103 // $ Alert
+    ptr[25] = 0; // BAD: writes bytes 100, 101, 102, 103
 }
 
 struct vec2 { int x, y; };
@@ -226,10 +226,10 @@ struct vec3 { int x, y, z; };
 
 void pointer_size_smaller_than_array_element_size_but_does_not_divide_it() {
     vec3 array[3]; // getByteSize() = 9 * sizeof(int)
-    vec2 *ptr = (vec2 *)array; // pai.getElementSize() will be 2 * sizeof(int) -> size = 4 // $ Source
+    vec2 *ptr = (vec2 *)array; // pai.getElementSize() will be 2 * sizeof(int) -> size = 4
 
     ptr[3] = vec2{}; // GOOD: writes ints 6, 7
-    ptr[4] = vec2{}; // BAD: writes ints 8, 9 // $ Alert
+    ptr[4] = vec2{}; // BAD: writes ints 8, 9
 }
 
 void pointer_size_larger_than_array_element_size_and_does_not_divide_it() {
@@ -258,7 +258,7 @@ void call_use(unsigned char* p, int n) {
     if(n == 3) {
         unsigned char x = p[0];
         unsigned char y = p[1];
-        unsigned char z = p[2]; // GOOD [FALSE POSITIVE]: `call_use(buffer2, 2)` won't reach this point. // $ Alert
+        unsigned char z = p[2]; // GOOD [FALSE POSITIVE]: `call_use(buffer2, 2)` won't reach this point.
         use(x, y, z);
     }
 }
@@ -283,7 +283,7 @@ void test_call_use2() {
     call_call_use(buffer1,1);
 
     unsigned char buffer2[2];
-    call_call_use(buffer2,2); // $ Source
+    call_call_use(buffer2,2);
 
     unsigned char buffer3[3];
     call_call_use(buffer3,3);
@@ -296,7 +296,7 @@ int guardingCallee(int *arr, int size) {
 
     int sum;
     for (int i = 0; i < size; i++) {
-        sum += arr[i]; // GOOD [FALSE POSITIVE] - guarded by size // $ Alert
+        sum += arr[i]; // GOOD [FALSE POSITIVE] - guarded by size
     }
     return sum;
 }
@@ -306,7 +306,7 @@ int guardingCaller() {
     guardingCallee(arr1, MAX_SIZE);
     
     int arr2[10];
-    guardingCallee(arr2, 10); // $ Source
+    guardingCallee(arr2, 10);
 }
 
 // simplified md5 padding
@@ -319,10 +319,10 @@ void correlatedCondition(int num) {
             end = temp + 56;
         }
         else if (num < 64) {
-            end = temp + 64; // GOOD [FALSE POSITVE] // $ Alert
+            end = temp + 64; // GOOD [FALSE POSITVE]
         }
         char *temp2 = temp + num;
-        while(temp2 != end) { // $ Sink
+        while(temp2 != end) {
             *temp2 = 0;
             temp2++;
         }

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test1/ExposureSensitiveInformationUnauthorizedActor.qlref

@@ -1,2 +1 @@
-query: experimental/Security/CWE/CWE-200/ExposureSensitiveInformationUnauthorizedActor.ql
-postprocess: utils/test/InlineExpectationsTestQuery.ql
+experimental/Security/CWE/CWE-200/ExposureSensitiveInformationUnauthorizedActor.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test1/test.cpp

@@ -9,7 +9,7 @@ int main(int argc, char *argv[])
 {
   //umask(0022);
   FILE *fp;
-  fp = fopen("myFile.txt","w"); // BAD // $ Alert
+  fp = fopen("myFile.txt","w"); // BAD
   //chmod("myFile.txt",0644);
   fprintf(fp,"%s\n","data to file");
   fclose(fp);

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test2/ExposureSensitiveInformationUnauthorizedActor.qlref

@@ -1,2 +1 @@
-query: experimental/Security/CWE/CWE-200/ExposureSensitiveInformationUnauthorizedActor.ql
-postprocess: utils/test/InlineExpectationsTestQuery.ql
+experimental/Security/CWE/CWE-200/ExposureSensitiveInformationUnauthorizedActor.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test3/ExposureSensitiveInformationUnauthorizedActor.qlref

@@ -1,2 +1 @@
-query: experimental/Security/CWE/CWE-200/ExposureSensitiveInformationUnauthorizedActor.ql
-postprocess: utils/test/InlineExpectationsTestQuery.ql
+experimental/Security/CWE/CWE-200/ExposureSensitiveInformationUnauthorizedActor.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-243/semmle/tests/IncorrectChangingWorkingDirectory.qlref

@@ -1,2 +1 @@
-query: experimental/Security/CWE/CWE-243/IncorrectChangingWorkingDirectory.ql
-postprocess: utils/test/InlineExpectationsTestQuery.ql
+experimental/Security/CWE/CWE-243/IncorrectChangingWorkingDirectory.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-243/semmle/tests/test.cpp

@@ -9,7 +9,7 @@ int chdir(char *path);
 void exit(int status);
 
 int funTest1(){
-  if (chroot("/myFold/myTmp") == -1) {  // BAD // $ Alert
+  if (chroot("/myFold/myTmp") == -1) {  // BAD
     exit(-1);
   }
   return 0;
@@ -26,7 +26,7 @@ int funTest2(){
 }
 
 int funTest3(){  
-  chdir("/myFold/myTmp"); // BAD // $ Alert
+  chdir("/myFold/myTmp"); // BAD
   return 0;
 }
 int main(int argc, char *argv[])

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-266/semmle/tests/IncorrectPrivilegeAssignment.qlref

@@ -1,2 +1 @@
-query: experimental/Security/CWE/CWE-266/IncorrectPrivilegeAssignment.ql
-postprocess: utils/test/InlineExpectationsTestQuery.ql
+experimental/Security/CWE/CWE-266/IncorrectPrivilegeAssignment.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-266/semmle/tests/test.cpp

@@ -6,7 +6,7 @@ int fclose(FILE *stream);
 
 void funcTest1()
 {
-  umask(0666); // BAD // $ Alert
+  umask(0666); // BAD
   FILE *fe;
   fe = fopen("myFile.txt", "wt");
   fclose(fe);
@@ -27,7 +27,7 @@ void funcTest2(int mode)
   FILE *fe;
   fe = fopen("myFile.txt", "wt");
   fclose(fe);
-  chmod("myFile.txt",0555-mode); // BAD // $ Alert
+  chmod("myFile.txt",0555-mode); // BAD
 }
 
 void funcTest2g(int mode)

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-285/PamAuthorization.qlref

@@ -1,2 +1 @@
-query: experimental/Security/CWE/CWE-285/PamAuthorization.ql
-postprocess: utils/test/InlineExpectationsTestQuery.ql
+experimental/Security/CWE/CWE-285/PamAuthorization.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-285/test.cpp

@@ -26,7 +26,7 @@ bool PamAuthBad(const std::string &username_in,
         return false;
     }
 
-    err = pam_authenticate(pamh, 0); // $ Alert
+    err = pam_authenticate(pamh, 0);
     if (err != PAM_SUCCESS)
         return err;
 

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-295/CurlSSL.cpp

@@ -22,8 +22,8 @@ char host[] = "codeql.com";
 
 void bad(void) {
 	std::unique_ptr<CURL> curl = std::unique_ptr<CURL>(curl_easy_init());
-	curl_easy_setopt(curl.get(), CURLOPT_SSL_VERIFYPEER, 0); // $ Alert
-	curl_easy_setopt(curl.get(), CURLOPT_SSL_VERIFYHOST, 0);  // $ Alert
+	curl_easy_setopt(curl.get(), CURLOPT_SSL_VERIFYPEER, 0);
+	curl_easy_setopt(curl.get(), CURLOPT_SSL_VERIFYHOST, 0); 
   	curl_easy_setopt(curl.get(), CURLOPT_URL, host);
   	curl_easy_perform(curl.get());
 }

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-295/CurlSSL.qlref

@@ -1,2 +1 @@
-query: experimental/Security/CWE/CWE-295/CurlSSL.ql
-postprocess: utils/test/InlineExpectationsTestQuery.ql
+experimental/Security/CWE/CWE-295/CurlSSL.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-359/semmle/tests/PrivateCleartextWrite.qlref

@@ -1,2 +1 @@
-query: experimental/Security/CWE/CWE-359/PrivateCleartextWrite.ql
-postprocess: utils/test/InlineExpectationsTestQuery.ql
+experimental/Security/CWE/CWE-359/PrivateCleartextWrite.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-359/semmle/tests/test.cpp

@@ -54,7 +54,7 @@ void file()
   FILE *file;
 
   // BAD: write zipcode to file in cleartext
-  fputs(theZipcode, file); // $ Alert
+  fputs(theZipcode, file);
 
   // GOOD: encrypt first
   char *encrypted = encrypt(theZipcode);
@@ -71,15 +71,15 @@ int main(int argc, char **argv)
   char *buff4;
 
   // BAD: write medical to buffer in cleartext
-  sprintf(buff1, "%s", medical); // $ Alert Source
+  sprintf(buff1, "%s", medical);
 
   // BAD: write medical to buffer in cleartext
-  char *temp = medical; // $ Source
-  sprintf(buff2, "%s", temp); // $ Alert
+  char *temp = medical;
+  sprintf(buff2, "%s", temp);
 
   // BAD: write medical to buffer in cleartext
-  char *buff5 = func(medical); // $ Source
-  sprintf(buff3, "%s", buff5); // $ Alert
+  char *buff5 = func(medical);
+  sprintf(buff3, "%s", buff5);
 
   char *buff6 = encrypt(medical);
   // GOOD: encrypt first
@@ -93,10 +93,10 @@ void stream()
   ofstream mystream;
 
   // BAD: write zipcode to file in cleartext
-  mystream << "the zipcode is: " << theZipcode; // $ Alert Source
+  mystream << "the zipcode is: " << theZipcode;
 
   // BAD: write zipcode to file in cleartext
-  (mystream << "the zipcode is: ").write(theZipcode, strlen(theZipcode)); // $ Alert
+  (mystream << "the zipcode is: ").write(theZipcode, strlen(theZipcode));
 
   // GOOD: encrypt first
   char *encrypted = encrypt(theZipcode);

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-369/semmle/tests/DivideByZeroUsingReturnValue.qlref

@@ -1,2 +1 @@
-query: experimental/Security/CWE/CWE-369/DivideByZeroUsingReturnValue.ql
-postprocess: utils/test/InlineExpectationsTestQuery.ql
+experimental/Security/CWE/CWE-369/DivideByZeroUsingReturnValue.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-369/semmle/tests/test.cpp

@@ -44,13 +44,13 @@ int getSize2(int type) {
 
 int badTestf1(int type, int met) {
   int is = getSize(type);
-  if (met == 1) return 123 / is; // BAD // $ Alert
-  else return 123 / getSize2(type); // BAD // $ Alert
+  if (met == 1) return 123 / is; // BAD
+  else return 123 / getSize2(type); // BAD
 }
 int badTestf2(int type) {
   int is;
   is = getSize(type);
-  return 123 / is; // BAD // $ Alert
+  return 123 / is; // BAD
 }
 
 int badTestf3(int type, int met) {
@@ -62,23 +62,23 @@ int badTestf3(int type, int met) {
   case 2:
     if (0 == is) return 123 / is; // BAD [NOT DETECTED]
   case 3:
-    if (!is & 123 / is) // BAD // $ Alert
+    if (!is & 123 / is) // BAD
       return 123;
   case 4:
-    if (!is | 123 / is) // BAD // $ Alert
+    if (!is | 123 / is) // BAD
       return 123;
   case 5:
-    if (123 / is || !is) // BAD  // $ Alert
+    if (123 / is || !is) // BAD 
       return 123;
   case 6:
-    if (123 / is && !is) // BAD // $ Alert
+    if (123 / is && !is) // BAD
       return 123;
   case 7:
-    if (!is) return 123 / is; // BAD // $ Alert
+    if (!is) return 123 / is; // BAD
   case 8:
-    if (is > -1) return 123 / is; // BAD // $ Alert
+    if (is > -1) return 123 / is; // BAD
   case 9:
-    if (is < 2) return 123 / is; // BAD // $ Alert
+    if (is < 2) return 123 / is; // BAD
   }
   if (is != 0) return -1;
   if (is == 0) type += 1;
@@ -125,20 +125,20 @@ int badTestf4(int type) {
   int is = getSize(type);
   int d;
   d = type * is;
-  return 123 / d; // BAD // $ Alert
+  return 123 / d; // BAD
 }
 
 int badTestf5(int type) {
   int is = getSize(type);
   int d;
   d = is / type;
-  return 123 / d; // BAD // $ Alert
+  return 123 / d; // BAD
 }
 int badTestf6(int type) {
   int is = getSize(type);
   int d;
   d = is / type;
-  return type * 123 / d; // BAD // $ Alert
+  return type * 123 / d; // BAD
 }
 
 int badTestf7(int type, int met) {
@@ -150,7 +150,7 @@ int badTestf7(int type, int met) {
       return 123 / is; // GOOD
   }
   quit:
-    return 123 / is; // BAD // $ Alert
+    return 123 / is; // BAD
 }
 
 int goodTestf7(int type, int met) {
@@ -169,8 +169,8 @@ int goodTestf7(int type, int met) {
 
 int badTestf8(int type) {
   int is = getSize(type);
-  type /= is; // BAD // $ Alert
-  type %= is; // BAD // $ Alert
+  type /= is; // BAD
+  type %= is; // BAD
   return type;
 }
 
@@ -184,7 +184,7 @@ float getSizeFloat(float type) {
 }
 float badTestf9(float type) {
   float is = getSizeFloat(type);
-  return 123 / is; // BAD // $ Alert
+  return 123 / is; // BAD
 }
 float goodTestf9(float type) {
   float is = getSizeFloat(type);
@@ -196,18 +196,18 @@ int badTestf10(int type) {
   int out = type;
   int is = getSize(type);
   if (is > -2) {
-    out /= 123 / (is + 1); // BAD // $ Alert
+    out /= 123 / (is + 1); // BAD
   }
   if (is > 0) {
-    return 123 / (is - 1); // BAD // $ Alert
+    return 123 / (is - 1); // BAD
   }
   if (is <= 0) return 0;
-  return 123 / (is - 1); // BAD // $ Alert
+  return 123 / (is - 1); // BAD
   return 0;
 }
 int badTestf11(int type) {
   int is = getSize(type);
-  return 123 / (is - 3); // BAD // $ Alert
+  return 123 / (is - 3); // BAD
 }
 
 int goodTestf11(int type) {
@@ -255,12 +255,12 @@ int badMySubDiv(int type, int is) {
 
 void badTestf13(int type) {
   int is = getSize(type);
-  badMyDiv(type, is); // BAD // $ Alert
-  badMyDiv(type, is - 2); // BAD // $ Alert
-  badMySubDiv(type, is); // BAD // $ Alert
+  badMyDiv(type, is); // BAD
+  badMyDiv(type, is - 2); // BAD
+  badMySubDiv(type, is); // BAD
   goodMyDiv(type, is); // GOOD
   if (is < 5)
-    badMySubDiv(type, is); // BAD // $ Alert
+    badMySubDiv(type, is); // BAD
   if (is < 0)
     badMySubDiv(type, is); // BAD [NOT DETECTED]
   if (is > 5)
@@ -270,9 +270,9 @@ void badTestf13(int type) {
   if (is > 0)
     badMyDiv(type, is); // GOOD
   if (is < 5)
-    badMyDiv(type, is - 3); // BAD // $ Alert
+    badMyDiv(type, is - 3); // BAD
   if (is < 0)
-    badMyDiv(type, is + 1); // BAD // $ Alert
+    badMyDiv(type, is + 1); // BAD
   if (is > 5)
     badMyDiv(type, is - 3); // GOOD
 }

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-377/semmle/tests/InsecureTemporaryFile.qlref

@@ -1,2 +1 @@
-query: experimental/Security/CWE/CWE-377/InsecureTemporaryFile.ql
-postprocess: utils/test/InlineExpectationsTestQuery.ql
+experimental/Security/CWE/CWE-377/InsecureTemporaryFile.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-377/semmle/tests/test.cpp

@@ -13,7 +13,7 @@ int fclose(FILE *stream);
 int funcTest1()
 {
   FILE *fp;
-  char *filename = tmpnam(NULL); // BAD // $ Alert
+  char *filename = tmpnam(NULL); // BAD
   fp = fopen(filename,"w");
   fprintf(fp,"%s\n","data to file");
   fclose(fp);

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/MemoryLeakOnFailedCallToRealloc.qlref

@@ -1,2 +1 @@
-query: experimental/Security/CWE/CWE-401/MemoryLeakOnFailedCallToRealloc.ql
-postprocess: utils/test/InlineExpectationsTestQuery.ql
+experimental/Security/CWE/CWE-401/MemoryLeakOnFailedCallToRealloc.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/test.c

@@ -31,7 +31,7 @@ unsigned char * badResize_0(unsigned char * buffer,size_t currentSize,size_t new
 	// BAD: on unsuccessful call to realloc, we will lose a pointer to a valid memory block
 	if (currentSize < newSize)
 	{
-		buffer = (unsigned char *)realloc(buffer, newSize); // $ Alert
+		buffer = (unsigned char *)realloc(buffer, newSize);
 	}
 	return buffer;
 }
@@ -60,7 +60,7 @@ unsigned char * badResize_1_0(unsigned char * buffer,size_t currentSize,size_t n
 	// BAD: on unsuccessful call to realloc, we will lose a pointer to a valid memory block
 	if (currentSize < newSize)
 	{
-		buffer = (unsigned char *)realloc(buffer, newSize); // $ Alert
+		buffer = (unsigned char *)realloc(buffer, newSize);
 	}
 	return buffer;
 }
@@ -136,7 +136,7 @@ unsigned char * badResize_1_1(unsigned char * buffer,size_t currentSize,size_t n
 	// BAD: on unsuccessful call to realloc, we will lose a pointer to a valid memory block
 	if (currentSize < newSize)
 	{
-		buffer = (unsigned char *)realloc(buffer, newSize); // $ Alert
+		buffer = (unsigned char *)realloc(buffer, newSize);
 	}
 	if(!buffer)
 		aFakeFailed_1(1, 1);
@@ -183,7 +183,7 @@ unsigned char * badResize_2_0(unsigned char * buffer,size_t currentSize,size_t n
 	assert(buffer!=0);
 	if (currentSize < newSize)
 	{
-		buffer = (unsigned char *)realloc(buffer, newSize); // $ Alert
+		buffer = (unsigned char *)realloc(buffer, newSize);
 	}
 	return buffer;
 }
@@ -279,7 +279,7 @@ unsigned char *goodResize_3_1(unsigned char *buffer, size_t currentSize, size_t
 	unsigned char *tmp = buffer;
 	if (currentSize < newSize)
 	{
-		buffer = (unsigned char *)realloc(buffer, newSize); // $ Alert
+		buffer = (unsigned char *)realloc(buffer, newSize);
 		if (buffer == NULL)
 		{
 			free(tmp);
@@ -296,7 +296,7 @@ unsigned char *goodResize_3_2(unsigned char *buffer, size_t currentSize, size_t
 	unsigned char *tmp = buffer;
 	if (currentSize < newSize)
 	{
-		tmp = (unsigned char *)realloc(tmp, newSize); // $ Alert
+		tmp = (unsigned char *)realloc(tmp, newSize);
 		if (tmp != 0)
 		{
 			buffer = tmp;
@@ -325,7 +325,7 @@ unsigned char * badResize_5_2(unsigned char *buffer, size_t currentSize, size_t
 	// BAD: on unsuccessful call to realloc, we will lose a pointer to a valid memory block
 	if (currentSize < newSize)
 	{
-		buffer = (unsigned char *)realloc(buffer, newSize); // $ Alert
+		buffer = (unsigned char *)realloc(buffer, newSize);
 	}
 	if (cond)
 	{
@@ -339,7 +339,7 @@ unsigned char * badResize_5_1(unsigned char *buffer, size_t currentSize, size_t
 	// BAD: on unsuccessful call to realloc, we will lose a pointer to a valid memory block
 	if (currentSize < newSize)
 	{
-		buffer = (unsigned char *)realloc(buffer, newSize); // $ Alert
+		buffer = (unsigned char *)realloc(buffer, newSize);
 		assert(cond); // irrelevant
 	}
 	return buffer;

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/DecompressionBombs.qlref

@@ -1,2 +1 @@
-query: experimental/Security/CWE/CWE-409/DecompressionBombs.ql
-postprocess: utils/test/InlineExpectationsTestQuery.ql
+experimental/Security/CWE/CWE-409/DecompressionBombs.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/brotliTest.cpp

@@ -15,12 +15,12 @@ BrotliDecoderResult BrotliDecoderDecompressStream(
 void brotli_test(int argc, const char **argv) {
     uint8_t output[1024];
     size_t output_size = sizeof(output);
-    BrotliDecoderDecompress(1024, (uint8_t *) argv[2], &output_size, output); // BAD // $ Alert
+    BrotliDecoderDecompress(1024, (uint8_t *) argv[2], &output_size, output); // BAD
 
     size_t input_size = 1024;
     const uint8_t *input_p = (const uint8_t*)argv[2];
     uint8_t *output_p = output;
     size_t out_size;
-    BrotliDecoderDecompressStream(0, &input_size, &input_p, &output_size, // BAD // $ Alert
+    BrotliDecoderDecompressStream(0, &input_size, &input_p, &output_size, // BAD
                                   &output_p, &out_size);
 }

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/libarchiveTests.cpp

@@ -19,7 +19,7 @@ static int read_data(archive *ar) {
         size_t size;
         la_int64_t offset;
 
-        int r = archive_read_data_block(ar, &buff, &size, &offset); // BAD // $ Alert
+        int r = archive_read_data_block(ar, &buff, &size, &offset); // BAD
         if (r == ARCHIVE_EOF)
             return ARCHIVE_OK;
         if (r < ARCHIVE_OK)

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/main.cpp

@@ -4,7 +4,7 @@ void minizip_test(int argc, const char **argv);
 void zlib_test(int argc, const char **argv);
 void zstd_test(int argc, const char **argv);
 
-int main(int argc, const char **argv) { // $ Source
+int main(int argc, const char **argv) {
     brotli_test(argc, argv);
     libarchive_test(argc, argv);
     minizip_test(argc, argv);

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/minizipTest.cpp

@@ -14,7 +14,7 @@ void minizip_test(int argc, const char **argv) {
     int32_t bytes_read;
     char buf[4096];
     while(true) {
-        bytes_read = mz_zip_entry_read(zip_handle, (char *) argv[1], sizeof(buf)); // BAD // $ Alert
+        bytes_read = mz_zip_entry_read(zip_handle, (char *) argv[1], sizeof(buf)); // BAD
         if (bytes_read <= 0) {
             break;
         }
@@ -23,7 +23,7 @@ void minizip_test(int argc, const char **argv) {
     void *zip_reader = mz_zip_reader_create();
     mz_zip_reader_open_file(zip_reader, argv[1]);
     mz_zip_reader_goto_first_entry(zip_reader);
-    mz_zip_reader_entry_save(zip_reader, 0, 0); // BAD // $ Alert
+    mz_zip_reader_entry_save(zip_reader, 0, 0); // BAD
 
-    UnzOpen(argv[3]); // BAD // $ Alert
+    UnzOpen(argv[3]); // BAD
 }