Merge pull request #21993 from michaelnebel/csharp/dropmono

C#: Only use `nuget.exe` on Windows or machines with Mono.

csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/NugetExeWrapper.cs

@@ -1,304 +0,0 @@
-using System;
-using System.Collections.Generic;
-using System.Diagnostics;
-using System.IO;
-using System.Linq;
-using Semmle.Util;
-
-namespace Semmle.Extraction.CSharp.DependencyFetching
-{
-    /// <summary>
-    /// Manage the downloading of NuGet packages with nuget.exe.
-    /// Locates packages in a source tree and downloads all of the
-    /// referenced assemblies to a temp folder.
-    /// </summary>
-    internal class NugetExeWrapper : IDisposable
-    {
-        private readonly string? nugetExe;
-        private readonly Semmle.Util.Logging.ILogger logger;
-
-        public int PackageCount => fileProvider.PackagesConfigs.Count;
-
-        private readonly string? backupNugetConfig;
-        private readonly string? nugetConfigPath;
-        private readonly FileProvider fileProvider;
-
-        /// <summary>
-        /// The packages directory.
-        /// This will be in the user-specified or computed Temp location
-        /// so as to not trample the source tree.
-        /// </summary>
-        private readonly DependencyDirectory packageDirectory;
-
-        /// <summary>
-        /// Create the package manager for a specified source tree.
-        /// </summary>
-        public NugetExeWrapper(FileProvider fileProvider, DependencyDirectory packageDirectory, Semmle.Util.Logging.ILogger logger, Func<bool> useDefaultFeed)
-        {
-            this.fileProvider = fileProvider;
-            this.packageDirectory = packageDirectory;
-            this.logger = logger;
-
-            if (fileProvider.PackagesConfigs.Count > 0)
-            {
-                logger.LogInfo($"Found packages.config files, trying to use nuget.exe for package restore");
-                nugetExe = ResolveNugetExe();
-                if (HasNoPackageSource() && useDefaultFeed())
-                {
-                    // We only modify or add a top level nuget.config file
-                    nugetConfigPath = Path.Combine(fileProvider.SourceDir.FullName, "nuget.config");
-                    try
-                    {
-                        if (File.Exists(nugetConfigPath))
-                        {
-                            var tempFolderPath = FileUtils.GetTemporaryWorkingDirectory(out _);
-
-                            do
-                            {
-                                backupNugetConfig = Path.Combine(tempFolderPath, Path.GetRandomFileName());
-                            }
-                            while (File.Exists(backupNugetConfig));
-                            File.Copy(nugetConfigPath, backupNugetConfig, true);
-                        }
-                        else
-                        {
-                            File.WriteAllText(nugetConfigPath,
-                                """
-                                <?xml version="1.0" encoding="utf-8"?>
-                                <configuration>
-                                  <packageSources>
-                                  </packageSources>
-                                </configuration>
-                                """);
-                        }
-                        AddDefaultPackageSource(nugetConfigPath);
-                    }
-                    catch (Exception e)
-                    {
-                        logger.LogError($"Failed to add default package source to {nugetConfigPath}: {e}");
-                    }
-                }
-            }
-        }
-
-        /// <summary>
-        /// Tries to find the location of `nuget.exe`. It looks for
-        /// - the environment variable specifying a location,
-        /// - files in the repository,
-        /// - tries to resolve nuget from the PATH, or
-        /// - downloads it if it is not found.
-        /// </summary>
-        private string ResolveNugetExe()
-        {
-            var envVarPath = Environment.GetEnvironmentVariable(EnvironmentVariableNames.NugetExePath);
-            if (!string.IsNullOrEmpty(envVarPath))
-            {
-                logger.LogInfo($"Using nuget.exe from environment variable: '{envVarPath}'");
-                return envVarPath;
-            }
-
-            try
-            {
-                return DownloadNugetExe(fileProvider.SourceDir.FullName);
-            }
-            catch (Exception exc)
-            {
-                logger.LogInfo($"Download of nuget.exe failed: {exc.Message}");
-            }
-
-            var nugetExesInRepo = fileProvider.NugetExes;
-            if (nugetExesInRepo.Count > 1)
-            {
-                logger.LogInfo($"Found multiple nuget.exe files in the repository: {string.Join(", ", nugetExesInRepo.OrderBy(s => s))}");
-            }
-
-            if (nugetExesInRepo.Count > 0)
-            {
-                var path = nugetExesInRepo.First();
-                logger.LogInfo($"Using nuget.exe from path '{path}'");
-                return path;
-            }
-
-            var executableName = Win32.IsWindows() ? "nuget.exe" : "nuget";
-            var nugetPath = FileUtils.FindProgramOnPath(executableName);
-            if (nugetPath is not null)
-            {
-                nugetPath = Path.Combine(nugetPath, executableName);
-                logger.LogInfo($"Using nuget.exe from PATH: {nugetPath}");
-                return nugetPath;
-            }
-
-            throw new Exception("Could not find or download nuget.exe.");
-        }
-
-        private string DownloadNugetExe(string sourceDir)
-        {
-            var directory = Path.Combine(sourceDir, ".nuget");
-            var nuget = Path.Combine(directory, "nuget.exe");
-
-            // Nuget.exe already exists in the .nuget directory.
-            if (File.Exists(nuget))
-            {
-                logger.LogInfo($"Found nuget.exe at {nuget}");
-                return nuget;
-            }
-
-            Directory.CreateDirectory(directory);
-            logger.LogInfo("Attempting to download nuget.exe");
-            FileUtils.DownloadFile(FileUtils.NugetExeUrl, nuget, logger);
-            logger.LogInfo($"Downloaded nuget.exe to {nuget}");
-            return nuget;
-        }
-
-        private bool RunWithMono => !Win32.IsWindows() && !string.IsNullOrEmpty(Path.GetExtension(nugetExe));
-
-        /// <summary>
-        /// Restore all packages in the specified packages.config file.
-        /// </summary>
-        /// <param name="packagesConfig">The packages.config file.</param>
-        private bool TryRestoreNugetPackage(string packagesConfig)
-        {
-            logger.LogInfo($"Restoring file \"{packagesConfig}\"...");
-
-            /* Use nuget.exe to install a package.
-             * Note that there is a clutch of NuGet assemblies which could be used to
-             * invoke this directly, which would arguably be nicer. However they are
-             * really unwieldy and this solution works for now.
-             */
-
-            string exe, args;
-            if (RunWithMono)
-            {
-                exe = "mono";
-                args = $"\"{nugetExe}\" install -OutputDirectory \"{packageDirectory}\" \"{packagesConfig}\"";
-            }
-            else
-            {
-                exe = nugetExe!;
-                args = $"install -OutputDirectory \"{packageDirectory}\" \"{packagesConfig}\"";
-            }
-
-            var pi = new ProcessStartInfo(exe, args)
-            {
-                RedirectStandardOutput = true,
-                RedirectStandardError = true,
-                UseShellExecute = false
-            };
-
-            var threadId = Environment.CurrentManagedThreadId;
-            void onOut(string s) => logger.LogDebug(s, threadId);
-            void onError(string s) => logger.LogError(s, threadId);
-            var exitCode = pi.ReadOutput(out _, onOut, onError);
-            if (exitCode != 0)
-            {
-                logger.LogError($"Command {pi.FileName} {pi.Arguments} failed with exit code {exitCode}");
-                return false;
-            }
-            else
-            {
-                logger.LogInfo($"Restored file \"{packagesConfig}\"");
-                return true;
-            }
-        }
-
-        /// <summary>
-        /// Download the packages to the temp folder.
-        /// </summary>
-        public int InstallPackages()
-        {
-            return fileProvider.PackagesConfigs.Count(TryRestoreNugetPackage);
-        }
-
-        private bool HasNoPackageSource()
-        {
-            if (Win32.IsWindows())
-            {
-                return false;
-            }
-
-            try
-            {
-                logger.LogInfo("Checking if default package source is available...");
-                RunMonoNugetCommand("sources list -ForceEnglishOutput", out var stdout);
-                if (stdout.All(line => line != "No sources found."))
-                {
-                    return false;
-                }
-
-                return true;
-            }
-            catch (Exception e)
-            {
-                logger.LogWarning($"Failed to check if default package source is added: {e}");
-                return false;
-            }
-        }
-
-        private void RunMonoNugetCommand(string command, out IList<string> stdout)
-        {
-            string exe, args;
-            if (RunWithMono)
-            {
-                exe = "mono";
-                args = $"\"{nugetExe}\" {command}";
-            }
-            else
-            {
-                exe = nugetExe!;
-                args = command;
-            }
-
-            var pi = new ProcessStartInfo(exe, args)
-            {
-                RedirectStandardOutput = true,
-                RedirectStandardError = true,
-                UseShellExecute = false
-            };
-
-            var threadId = Environment.CurrentManagedThreadId;
-            void onOut(string s) => logger.LogDebug(s, threadId);
-            void onError(string s) => logger.LogError(s, threadId);
-            pi.ReadOutput(out stdout, onOut, onError);
-        }
-
-        private void AddDefaultPackageSource(string nugetConfig)
-        {
-            logger.LogInfo("Adding default package source...");
-            RunMonoNugetCommand($"sources add -Name DefaultNugetOrg -Source {NugetPackageRestorer.PublicNugetOrgFeed} -ConfigFile \"{nugetConfig}\"", out _);
-        }
-
-        public void Dispose()
-        {
-            if (nugetConfigPath is null)
-            {
-                return;
-            }
-
-            try
-            {
-                if (backupNugetConfig is null)
-                {
-                    logger.LogInfo("Removing nuget.config file");
-                    File.Delete(nugetConfigPath);
-                    return;
-                }
-
-                logger.LogInfo("Reverting nuget.config file content");
-                // The content of the original nuget.config file is reverted without changing the file's attributes or casing:
-                using (var backup = File.OpenRead(backupNugetConfig))
-                using (var current = File.OpenWrite(nugetConfigPath))
-                {
-                    current.SetLength(0);   // Truncate file
-                    backup.CopyTo(current); // Restore original content
-                }
-
-                logger.LogInfo("Deleting backup nuget.config file");
-                File.Delete(backupNugetConfig);
-            }
-            catch (Exception exc)
-            {
-                logger.LogError($"Failed to restore original nuget.config file: {exc}");
-            }
-        }
-    }
-}

csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/NugetPackageRestorer.cs

@@ -161,13 +161,13 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
                     reachableFeeds.UnionWith(reachableInheritedFeeds);
                 }
 
-                using (var nuget = new NugetExeWrapper(fileProvider, legacyPackageDirectory, logger, IsDefaultFeedReachable))
+                using (var packagesConfigRestore = PackagesConfigRestoreFactory.Create(fileProvider, legacyPackageDirectory, logger, IsDefaultFeedReachable))
                 {
-                    var count = nuget.InstallPackages();
+                    var count = packagesConfigRestore.InstallPackages();
 
-                    if (nuget.PackageCount > 0)
+                    if (packagesConfigRestore.PackageCount > 0)
                     {
-                        compilationInfoContainer.CompilationInfos.Add(("packages.config files", nuget.PackageCount.ToString()));
+                        compilationInfoContainer.CompilationInfos.Add(("packages.config files", packagesConfigRestore.PackageCount.ToString()));
                         compilationInfoContainer.CompilationInfos.Add(("Successfully restored packages.config files", count.ToString()));
                     }
                 }

csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/PackagesConfigRestorer.cs

@@ -0,0 +1,368 @@
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.IO;
+using System.Linq;
+using Semmle.Util;
+
+namespace Semmle.Extraction.CSharp.DependencyFetching
+{
+    internal interface IPackagesConfigRestore : IDisposable
+    {
+        /// <summary>
+        /// The number of packages.config files found in the source tree.
+        /// </summary>
+        int PackageCount { get; }
+
+        /// <summary>
+        /// Download the packages to the temp folder.
+        /// </summary>
+        int InstallPackages();
+    }
+
+    /// <summary>
+    /// Factory for creating a package manager to restore NuGet packages referenced in packages.config files.
+    /// If the environment doesn't support using nuget.exe to restore packages from packages.config files, a no-op implementation is returned.
+    /// It is worth noting that for macOS and Linux, nuget.exe is used with mono. However, mono is being deprecated and the last GitHub images
+    /// to contain mono are:
+    /// - Ubuntu 22.04
+    /// - macOS 14
+    ///
+    /// If the packages from the packages.config files are not restored with the packages.config restore functionality below, there is a subsequent
+    /// step that still may succeed in restoring the packages without the help of nuget.exe (by attempting to restore using dotnet).
+    /// </summary>
+    internal class PackagesConfigRestoreFactory
+    {
+        public static IPackagesConfigRestore Create(FileProvider fileProvider, DependencyDirectory packageDirectory, Semmle.Util.Logging.ILogger logger, Func<bool> useDefaultFeed)
+        {
+            if (SystemBuildActions.Instance.IsWindows() || SystemBuildActions.Instance.IsMonoInstalled())
+            {
+                return new NugetExeWrapper(fileProvider, packageDirectory, logger, useDefaultFeed);
+            }
+
+            return new NoOpPackagesConfig(fileProvider, logger);
+        }
+
+        /// <summary>
+        /// Manage the downloading of NuGet packages with nuget.exe.
+        /// Locates packages in a source tree and downloads all of the
+        /// referenced assemblies to a temp folder.
+        /// </summary>
+        private class NugetExeWrapper : IPackagesConfigRestore
+        {
+            private readonly string? nugetExe;
+            private readonly Semmle.Util.Logging.ILogger logger;
+
+            public int PackageCount => fileProvider.PackagesConfigs.Count;
+
+            private readonly string? backupNugetConfig;
+            private readonly string? nugetConfigPath;
+            private readonly FileProvider fileProvider;
+
+            /// <summary>
+            /// The packages directory.
+            /// This will be in the user-specified or computed Temp location
+            /// so as to not trample the source tree.
+            /// </summary>
+            private readonly DependencyDirectory packageDirectory;
+
+            private bool IsWindows => SystemBuildActions.Instance.IsWindows();
+
+            /// <summary>
+            /// Create the package manager for a specified source tree.
+            /// </summary>
+            public NugetExeWrapper(FileProvider fileProvider, DependencyDirectory packageDirectory, Semmle.Util.Logging.ILogger logger, Func<bool> useDefaultFeed)
+            {
+                this.fileProvider = fileProvider;
+                this.packageDirectory = packageDirectory;
+                this.logger = logger;
+
+                if (fileProvider.PackagesConfigs.Count > 0)
+                {
+                    logger.LogInfo($"Found packages.config files, trying to use nuget.exe for package restore");
+                    nugetExe = ResolveNugetExe();
+                    if (!HasPackageSource() && useDefaultFeed())
+                    {
+                        // We only modify or add a top level nuget.config file
+                        nugetConfigPath = Path.Join(fileProvider.SourceDir.FullName, "nuget.config");
+                        try
+                        {
+                            if (File.Exists(nugetConfigPath))
+                            {
+                                var tempFolderPath = FileUtils.GetTemporaryWorkingDirectory(out _);
+
+                                do
+                                {
+                                    backupNugetConfig = Path.Join(tempFolderPath, Path.GetRandomFileName());
+                                }
+                                while (File.Exists(backupNugetConfig));
+                                File.Copy(nugetConfigPath, backupNugetConfig, true);
+                            }
+                            else
+                            {
+                                File.WriteAllText(nugetConfigPath,
+                                    """
+                                <?xml version="1.0" encoding="utf-8"?>
+                                <configuration>
+                                  <packageSources>
+                                  </packageSources>
+                                </configuration>
+                                """);
+                            }
+                            AddDefaultPackageSource(nugetConfigPath);
+                        }
+                        catch (Exception e)
+                        {
+                            logger.LogError($"Failed to add default package source to {nugetConfigPath}: {e}");
+                        }
+                    }
+                }
+            }
+
+            /// <summary>
+            /// Tries to find the location of `nuget.exe`. It looks for
+            /// - the environment variable specifying a location,
+            /// - files in the repository,
+            /// - tries to resolve nuget from the PATH, or
+            /// - downloads it if it is not found.
+            /// </summary>
+            private string ResolveNugetExe()
+            {
+                var envVarPath = Environment.GetEnvironmentVariable(EnvironmentVariableNames.NugetExePath);
+                if (!string.IsNullOrEmpty(envVarPath))
+                {
+                    logger.LogInfo($"Using nuget.exe from environment variable: '{envVarPath}'");
+                    return envVarPath;
+                }
+
+                try
+                {
+                    return DownloadNugetExe(fileProvider.SourceDir.FullName);
+                }
+                catch (Exception exc)
+                {
+                    logger.LogInfo($"Download of nuget.exe failed: {exc.Message}");
+                }
+
+                var nugetExesInRepo = fileProvider.NugetExes;
+                if (nugetExesInRepo.Count > 1)
+                {
+                    logger.LogInfo($"Found multiple nuget.exe files in the repository: {string.Join(", ", nugetExesInRepo.OrderBy(s => s))}");
+                }
+
+                if (nugetExesInRepo.Count > 0)
+                {
+                    var path = nugetExesInRepo.First();
+                    logger.LogInfo($"Using nuget.exe from path '{path}'");
+                    return path;
+                }
+
+                var executableName = IsWindows ? "nuget.exe" : "nuget";
+                var nugetPath = FileUtils.FindProgramOnPath(executableName);
+                if (nugetPath is not null)
+                {
+                    nugetPath = Path.Join(nugetPath, executableName);
+                    logger.LogInfo($"Using nuget.exe from PATH: {nugetPath}");
+                    return nugetPath;
+                }
+
+                throw new Exception("Could not find or download nuget.exe.");
+            }
+
+            private string DownloadNugetExe(string sourceDir)
+            {
+                var directory = Path.Join(sourceDir, ".nuget");
+                var nuget = Path.Join(directory, "nuget.exe");
+
+                // Nuget.exe already exists in the .nuget directory.
+                if (File.Exists(nuget))
+                {
+                    logger.LogInfo($"Found nuget.exe at {nuget}");
+                    return nuget;
+                }
+
+                Directory.CreateDirectory(directory);
+                logger.LogInfo("Attempting to download nuget.exe");
+                FileUtils.DownloadFile(FileUtils.NugetExeUrl, nuget, logger);
+                logger.LogInfo($"Downloaded nuget.exe to {nuget}");
+                return nuget;
+            }
+
+            private bool RunWithMono => !IsWindows && !string.IsNullOrEmpty(Path.GetExtension(nugetExe));
+
+            /// <summary>
+            /// Restore all packages in the specified packages.config file.
+            /// </summary>
+            /// <param name="packagesConfig">The packages.config file.</param>
+            private bool TryRestoreNugetPackage(string packagesConfig)
+            {
+                logger.LogInfo($"Restoring file \"{packagesConfig}\"...");
+
+                /* Use nuget.exe to install a package.
+                 * Note that there is a clutch of NuGet assemblies which could be used to
+                 * invoke this directly, which would arguably be nicer. However they are
+                 * really unwieldy and this solution works for now.
+                 */
+
+                string exe, args;
+                if (RunWithMono)
+                {
+                    exe = "mono";
+                    args = $"\"{nugetExe}\" install -OutputDirectory \"{packageDirectory}\" \"{packagesConfig}\"";
+                }
+                else
+                {
+                    exe = nugetExe!;
+                    args = $"install -OutputDirectory \"{packageDirectory}\" \"{packagesConfig}\"";
+                }
+
+                var pi = new ProcessStartInfo(exe, args)
+                {
+                    RedirectStandardOutput = true,
+                    RedirectStandardError = true,
+                    UseShellExecute = false
+                };
+
+                var threadId = Environment.CurrentManagedThreadId;
+                void onOut(string s) => logger.LogDebug(s, threadId);
+                void onError(string s) => logger.LogError(s, threadId);
+                var exitCode = pi.ReadOutput(out _, onOut, onError);
+                if (exitCode != 0)
+                {
+                    logger.LogError($"Command {pi.FileName} {pi.Arguments} failed with exit code {exitCode}");
+                    return false;
+                }
+                else
+                {
+                    logger.LogInfo($"Restored file \"{packagesConfig}\"");
+                    return true;
+                }
+            }
+
+            /// <summary>
+            /// Download the packages to the temp folder.
+            /// </summary>
+            public int InstallPackages()
+            {
+                return fileProvider.PackagesConfigs.Count(TryRestoreNugetPackage);
+            }
+
+            private bool HasPackageSource()
+            {
+                if (IsWindows)
+                {
+                    return true;
+                }
+
+                try
+                {
+                    logger.LogInfo("Checking if default package source is available...");
+                    RunMonoNugetCommand("sources list -ForceEnglishOutput", out var stdout);
+                    if (stdout.All(line => line != "No sources found."))
+                    {
+                        return true;
+                    }
+
+                    return false;
+                }
+                catch (Exception e)
+                {
+                    logger.LogWarning($"Failed to check if default package source is added: {e}");
+                    return true;
+                }
+            }
+
+            private void RunMonoNugetCommand(string command, out IList<string> stdout)
+            {
+                string exe, args;
+                if (RunWithMono)
+                {
+                    exe = "mono";
+                    args = $"\"{nugetExe}\" {command}";
+                }
+                else
+                {
+                    exe = nugetExe!;
+                    args = command;
+                }
+
+                var pi = new ProcessStartInfo(exe, args)
+                {
+                    RedirectStandardOutput = true,
+                    RedirectStandardError = true,
+                    UseShellExecute = false
+                };
+
+                var threadId = Environment.CurrentManagedThreadId;
+                void onOut(string s) => logger.LogDebug(s, threadId);
+                void onError(string s) => logger.LogError(s, threadId);
+                pi.ReadOutput(out stdout, onOut, onError);
+            }
+
+            private void AddDefaultPackageSource(string nugetConfig)
+            {
+                logger.LogInfo("Adding default package source...");
+                RunMonoNugetCommand($"sources add -Name DefaultNugetOrg -Source {NugetPackageRestorer.PublicNugetOrgFeed} -ConfigFile \"{nugetConfig}\"", out _);
+            }
+
+            public void Dispose()
+            {
+                if (nugetConfigPath is null)
+                {
+                    return;
+                }
+
+                try
+                {
+                    if (backupNugetConfig is null)
+                    {
+                        logger.LogInfo("Removing nuget.config file");
+                        File.Delete(nugetConfigPath);
+                        return;
+                    }
+
+                    logger.LogInfo("Reverting nuget.config file content");
+                    // The content of the original nuget.config file is reverted without changing the file's attributes or casing:
+                    using (var backup = File.OpenRead(backupNugetConfig))
+                    using (var current = File.OpenWrite(nugetConfigPath))
+                    {
+                        current.SetLength(0);   // Truncate file
+                        backup.CopyTo(current); // Restore original content
+                    }
+
+                    logger.LogInfo("Deleting backup nuget.config file");
+                    File.Delete(backupNugetConfig);
+                }
+                catch (Exception exc)
+                {
+                    logger.LogError($"Failed to restore original nuget.config file: {exc}");
+                }
+            }
+        }
+
+        private class NoOpPackagesConfig : IPackagesConfigRestore
+        {
+            private readonly Semmle.Util.Logging.ILogger logger;
+            private readonly FileProvider fileProvider;
+
+            public NoOpPackagesConfig(FileProvider fileProvider, Semmle.Util.Logging.ILogger logger)
+            {
+                this.fileProvider = fileProvider;
+                this.logger = logger;
+            }
+
+            public int PackageCount => fileProvider.PackagesConfigs.Count;
+
+            public int InstallPackages()
+            {
+                if (PackageCount > 0)
+                {
+                    logger.LogInfo("Found packages.config files, but nuget.exe cannot be used to restore packages on this platform. Skipping restore of packages.config files.");
+                }
+                return 0;
+            }
+
+            public void Dispose() { }
+        }
+    }
+}

csharp/ql/lib/semmle/code/csharp/controlflow/internal/ControlFlowGraph.qll

@@ -145,6 +145,8 @@ module Ast implements AstSig<Location> {
   final private class ParameterFinal = CS::Parameter;
 
   class Parameter extends ParameterFinal {
+    AstNode getPattern() { result = this }
+
     Expr getDefaultValue() {
       // Avoid combinatorial explosions for callables with multiple bodies
       result = unique( | | super.getDefaultValue())

go/documentation/library-coverage/coverage.csv

@@ -123,7 +123,7 @@ k8s.io/api/core,,,10,,,,,,,,,,,,,,,,,,,,,,,10,
 k8s.io/apimachinery/pkg/runtime,,,47,,,,,,,,,,,,,,,,,,,,,,,47,
 k8s.io/klog,90,,,,,,90,,,,,,,,,,,,,,,,,,,,
 launchpad.net/xmlpath,2,,,,,,,,,,,,,,,,,,2,,,,,,,,
-log,20,,3,,,,20,,,,,,,,,,,,,,,,,,,3,
+log,40,,3,,,,40,,,,,,,,,,,,,,,,,,,3,
 math/big,,,1,,,,,,,,,,,,,,,,,,,,,,,1,
 mime,,,14,,,,,,,,,,,,,,,,,,,,,,,14,
 net,2,16,100,,,,,,1,,,,,,,,1,,,,,,,16,,100,

go/documentation/library-coverage/coverage.rst

@@ -32,7 +32,7 @@ Go framework & library support
    `Revel <http://revel.github.io/>`_,"``github.com/revel/revel*``, ``github.com/robfig/revel*``",46,20,4
    `SendGrid <https://github.com/sendgrid/sendgrid-go>`_,``github.com/sendgrid/sendgrid-go*``,,1,
    `Squirrel <https://github.com/Masterminds/squirrel>`_,"``github.com/Masterminds/squirrel*``, ``github.com/lann/squirrel*``, ``gopkg.in/Masterminds/squirrel``",81,,96
-   `Standard library <https://pkg.go.dev/std>`_,"````, ``archive/*``, ``bufio``, ``bytes``, ``cmp``, ``compress/*``, ``container/*``, ``context``, ``crypto``, ``crypto/*``, ``database/*``, ``debug/*``, ``embed``, ``encoding``, ``encoding/*``, ``errors``, ``expvar``, ``flag``, ``fmt``, ``go/*``, ``hash``, ``hash/*``, ``html``, ``html/*``, ``image``, ``image/*``, ``index/*``, ``io``, ``io/*``, ``log``, ``log/*``, ``maps``, ``math``, ``math/*``, ``mime``, ``mime/*``, ``net``, ``net/*``, ``os``, ``os/*``, ``path``, ``path/*``, ``plugin``, ``reflect``, ``reflect/*``, ``regexp``, ``regexp/*``, ``slices``, ``sort``, ``strconv``, ``strings``, ``sync``, ``sync/*``, ``syscall``, ``syscall/*``, ``testing``, ``testing/*``, ``text/*``, ``time``, ``time/*``, ``unicode``, ``unicode/*``, ``unsafe``, ``weak``",52,612,104
+   `Standard library <https://pkg.go.dev/std>`_,"````, ``archive/*``, ``bufio``, ``bytes``, ``cmp``, ``compress/*``, ``container/*``, ``context``, ``crypto``, ``crypto/*``, ``database/*``, ``debug/*``, ``embed``, ``encoding``, ``encoding/*``, ``errors``, ``expvar``, ``flag``, ``fmt``, ``go/*``, ``hash``, ``hash/*``, ``html``, ``html/*``, ``image``, ``image/*``, ``index/*``, ``io``, ``io/*``, ``log``, ``log/*``, ``maps``, ``math``, ``math/*``, ``mime``, ``mime/*``, ``net``, ``net/*``, ``os``, ``os/*``, ``path``, ``path/*``, ``plugin``, ``reflect``, ``reflect/*``, ``regexp``, ``regexp/*``, ``slices``, ``sort``, ``strconv``, ``strings``, ``sync``, ``sync/*``, ``syscall``, ``syscall/*``, ``testing``, ``testing/*``, ``text/*``, ``time``, ``time/*``, ``unicode``, ``unicode/*``, ``unsafe``, ``weak``",52,612,124
    `XORM <https://xorm.io>`_,"``github.com/go-xorm/xorm*``, ``xorm.io/xorm*``",,,68
    `XPath <https://github.com/antchfx/xpath>`_,``github.com/antchfx/xpath*``,,,4
    `appleboy/gin-jwt <https://github.com/appleboy/gin-jwt>`_,``github.com/appleboy/gin-jwt*``,,,1
@@ -74,5 +74,5 @@ Go framework & library support
    `xpathparser <https://github.com/santhosh-tekuri/xpathparser>`_,``github.com/santhosh-tekuri/xpathparser*``,,,2
    `yaml <https://gopkg.in/yaml.v3>`_,``gopkg.in/yaml*``,,9,
    `zap <https://go.uber.org/zap>`_,``go.uber.org/zap*``,,11,33
-   Totals,,688,1072,1557
+   Totals,,688,1072,1577
 

java/ql/integration-tests/java/buildless-erroneous/diagnostics.expected

@@ -1,3 +1,18 @@
+{
+  "attributes": {},
+  "markdownMessage": "Internal telemetry for the Java extractor.\n\nNo action needed.",
+  "severity": "note",
+  "source": {
+    "extractorName": "java",
+    "id": "java/extractor/summary",
+    "name": "Java extractor telemetry"
+  },
+  "visibility": {
+    "cliSummaryTable": false,
+    "statusPage": false,
+    "telemetry": true
+  }
+}
 {
   "markdownMessage": "Because no usable build tool (Gradle, Maven, etc) was found, build scripts could not be queried for guidance about the appropriate JDK version for the code being extracted, or precise dependency information. The default JDK will be used, and external dependencies will be inferred from the Java package names used.",
   "severity": "unknown",

java/ql/integration-tests/java/buildless-gradle-boms/diagnostics.expected

@@ -1,3 +1,18 @@
+{
+  "attributes": {},
+  "markdownMessage": "Internal telemetry for the Java extractor.\n\nNo action needed.",
+  "severity": "note",
+  "source": {
+    "extractorName": "java",
+    "id": "java/extractor/summary",
+    "name": "Java extractor telemetry"
+  },
+  "visibility": {
+    "cliSummaryTable": false,
+    "statusPage": false,
+    "telemetry": true
+  }
+}
 {
   "markdownMessage": "Java analysis used build tool Gradle to pick a JDK version and/or to recommend external dependencies.",
   "severity": "unknown",

java/ql/integration-tests/java/buildless-gradle-classifiers/diagnostics.expected

@@ -1,3 +1,18 @@
+{
+  "attributes": {},
+  "markdownMessage": "Internal telemetry for the Java extractor.\n\nNo action needed.",
+  "severity": "note",
+  "source": {
+    "extractorName": "java",
+    "id": "java/extractor/summary",
+    "name": "Java extractor telemetry"
+  },
+  "visibility": {
+    "cliSummaryTable": false,
+    "statusPage": false,
+    "telemetry": true
+  }
+}
 {
   "markdownMessage": "Java analysis used build tool Gradle to pick a JDK version and/or to recommend external dependencies.",
   "severity": "unknown",

java/ql/integration-tests/java/buildless-gradle-timeout/diagnostics.expected

@@ -1,3 +1,18 @@
+{
+  "attributes": {},
+  "markdownMessage": "Internal telemetry for the Java extractor.\n\nNo action needed.",
+  "severity": "note",
+  "source": {
+    "extractorName": "java",
+    "id": "java/extractor/summary",
+    "name": "Java extractor telemetry"
+  },
+  "visibility": {
+    "cliSummaryTable": false,
+    "statusPage": false,
+    "telemetry": true
+  }
+}
 {
   "markdownMessage": "A Gradle process was aborted because it didn't write to the console for 5 seconds. Consider either lengthening the timeout if appropriate by setting CODEQL_EXTRACTOR_JAVA_BUILDLESS_CHILD_PROCESS_IDLE_TIMEOUT to a higher value or zero for no timeout, or else investigate why Gradle timed out. Java analysis will continue, but the analysis may be of reduced quality.",
   "severity": "note",

java/ql/integration-tests/java/buildless-gradle/diagnostics.expected

@@ -1,3 +1,18 @@
+{
+  "attributes": {},
+  "markdownMessage": "Internal telemetry for the Java extractor.\n\nNo action needed.",
+  "severity": "note",
+  "source": {
+    "extractorName": "java",
+    "id": "java/extractor/summary",
+    "name": "Java extractor telemetry"
+  },
+  "visibility": {
+    "cliSummaryTable": false,
+    "statusPage": false,
+    "telemetry": true
+  }
+}
 {
   "markdownMessage": "Java analysis used build tool Gradle to pick a JDK version and/or to recommend external dependencies.",
   "severity": "unknown",

java/ql/integration-tests/java/buildless-inherit-trust-store/diagnostics.expected

@@ -1,3 +1,18 @@
+{
+  "attributes": {},
+  "markdownMessage": "Internal telemetry for the Java extractor.\n\nNo action needed.",
+  "severity": "note",
+  "source": {
+    "extractorName": "java",
+    "id": "java/extractor/summary",
+    "name": "Java extractor telemetry"
+  },
+  "visibility": {
+    "cliSummaryTable": false,
+    "statusPage": false,
+    "telemetry": true
+  }
+}
 {
   "markdownMessage": "Java analysis used build tool Maven to pick a JDK version and/or to recommend external dependencies.",
   "severity": "unknown",

java/ql/integration-tests/java/buildless-maven-executable-war/diagnostics.expected

@@ -1,3 +1,18 @@
+{
+  "attributes": {},
+  "markdownMessage": "Internal telemetry for the Java extractor.\n\nNo action needed.",
+  "severity": "note",
+  "source": {
+    "extractorName": "java",
+    "id": "java/extractor/summary",
+    "name": "Java extractor telemetry"
+  },
+  "visibility": {
+    "cliSummaryTable": false,
+    "statusPage": false,
+    "telemetry": true
+  }
+}
 {
   "markdownMessage": "Java analysis used build tool Maven to pick a JDK version and/or to recommend external dependencies.",
   "severity": "unknown",

java/ql/integration-tests/java/buildless-maven-existing-settings-xml/diagnostics.expected

@@ -1,3 +1,18 @@
+{
+  "attributes": {},
+  "markdownMessage": "Internal telemetry for the Java extractor.\n\nNo action needed.",
+  "severity": "note",
+  "source": {
+    "extractorName": "java",
+    "id": "java/extractor/summary",
+    "name": "Java extractor telemetry"
+  },
+  "visibility": {
+    "cliSummaryTable": false,
+    "statusPage": false,
+    "telemetry": true
+  }
+}
 {
   "markdownMessage": "Java analysis used build tool Maven to pick a JDK version and/or to recommend external dependencies.",
   "severity": "unknown",

java/ql/integration-tests/java/buildless-maven-mirrorof/diagnostics.expected

@@ -1,3 +1,18 @@
+{
+  "attributes": {},
+  "markdownMessage": "Internal telemetry for the Java extractor.\n\nNo action needed.",
+  "severity": "note",
+  "source": {
+    "extractorName": "java",
+    "id": "java/extractor/summary",
+    "name": "Java extractor telemetry"
+  },
+  "visibility": {
+    "cliSummaryTable": false,
+    "statusPage": false,
+    "telemetry": true
+  }
+}
 {
   "markdownMessage": "Java analysis used build tool Maven to pick a JDK version and/or to recommend external dependencies.",
   "severity": "unknown",

java/ql/integration-tests/java/buildless-maven-multimodule/diagnostics.expected

@@ -1,3 +1,18 @@
+{
+  "attributes": {},
+  "markdownMessage": "Internal telemetry for the Java extractor.\n\nNo action needed.",
+  "severity": "note",
+  "source": {
+    "extractorName": "java",
+    "id": "java/extractor/summary",
+    "name": "Java extractor telemetry"
+  },
+  "visibility": {
+    "cliSummaryTable": false,
+    "statusPage": false,
+    "telemetry": true
+  }
+}
 {
   "markdownMessage": "Java analysis used build tool Maven to pick a JDK version and/or to recommend external dependencies.",
   "severity": "unknown",

java/ql/integration-tests/java/buildless-maven-timeout/diagnostics.expected

@@ -1,3 +1,18 @@
+{
+  "attributes": {},
+  "markdownMessage": "Internal telemetry for the Java extractor.\n\nNo action needed.",
+  "severity": "note",
+  "source": {
+    "extractorName": "java",
+    "id": "java/extractor/summary",
+    "name": "Java extractor telemetry"
+  },
+  "visibility": {
+    "cliSummaryTable": false,
+    "statusPage": false,
+    "telemetry": true
+  }
+}
 {
   "markdownMessage": "A Maven process was aborted because it didn't write to the console for 5 seconds. Consider either lenghtening the timeout if appropriate by setting CODEQL_EXTRACTOR_JAVA_BUILDLESS_CHILD_PROCESS_IDLE_TIMEOUT to a higher value or zero for no timeout, or else investigate why Maven timed out. Java analysis will continue, but the analysis may be of reduced quality.",
   "severity": "note",

java/ql/integration-tests/java/buildless-maven-tolerate-unavailable-dependency/diagnostics.expected

@@ -1,3 +1,18 @@
+{
+  "attributes": {},
+  "markdownMessage": "Internal telemetry for the Java extractor.\n\nNo action needed.",
+  "severity": "note",
+  "source": {
+    "extractorName": "java",
+    "id": "java/extractor/summary",
+    "name": "Java extractor telemetry"
+  },
+  "visibility": {
+    "cliSummaryTable": false,
+    "statusPage": false,
+    "telemetry": true
+  }
+}
 {
   "markdownMessage": "At least one dependency JAR suggested by the build system could not be downloaded. This means the analysis will try to satisfy the dependency with its default choice for the required external package name, which may be the wrong version or the wrong package entirely. This may lead to partial analysis of code using this dependency. See the extraction log for full details. If the cause appears to be a temporary outage, consider retrying the analysis.",
   "severity": "note",

java/ql/integration-tests/java/buildless-maven-tolerate-unavailable-dependency/test.py

@@ -1,4 +1,4 @@
-def test(codeql, java):
+def test(codeql, java, check_diagnostics_java):
     codeql.database.create(
         build_mode="none",
     )

java/ql/integration-tests/java/buildless-maven/diagnostics.expected

@@ -1,3 +1,18 @@
+{
+  "attributes": {},
+  "markdownMessage": "Internal telemetry for the Java extractor.\n\nNo action needed.",
+  "severity": "note",
+  "source": {
+    "extractorName": "java",
+    "id": "java/extractor/summary",
+    "name": "Java extractor telemetry"
+  },
+  "visibility": {
+    "cliSummaryTable": false,
+    "statusPage": false,
+    "telemetry": true
+  }
+}
 {
   "markdownMessage": "Java analysis used build tool Maven to pick a JDK version and/or to recommend external dependencies.",
   "severity": "unknown",

java/ql/integration-tests/java/buildless-proxy-gradle/diagnostics.expected

@@ -1,3 +1,18 @@
+{
+  "attributes": {},
+  "markdownMessage": "Internal telemetry for the Java extractor.\n\nNo action needed.",
+  "severity": "note",
+  "source": {
+    "extractorName": "java",
+    "id": "java/extractor/summary",
+    "name": "Java extractor telemetry"
+  },
+  "visibility": {
+    "cliSummaryTable": false,
+    "statusPage": false,
+    "telemetry": true
+  }
+}
 {
   "markdownMessage": "Java analysis used build tool Gradle to pick a JDK version and/or to recommend external dependencies.",
   "severity": "unknown",

java/ql/integration-tests/java/buildless-proxy-maven/diagnostics.expected

@@ -1,3 +1,18 @@
+{
+  "attributes": {},
+  "markdownMessage": "Internal telemetry for the Java extractor.\n\nNo action needed.",
+  "severity": "note",
+  "source": {
+    "extractorName": "java",
+    "id": "java/extractor/summary",
+    "name": "Java extractor telemetry"
+  },
+  "visibility": {
+    "cliSummaryTable": false,
+    "statusPage": false,
+    "telemetry": true
+  }
+}
 {
   "markdownMessage": "Java analysis used build tool Maven to pick a JDK version and/or to recommend external dependencies.",
   "severity": "unknown",

java/ql/integration-tests/java/buildless-sibling-projects/diagnostics.expected

@@ -1,3 +1,18 @@
+{
+  "attributes": {},
+  "markdownMessage": "Internal telemetry for the Java extractor.\n\nNo action needed.",
+  "severity": "note",
+  "source": {
+    "extractorName": "java",
+    "id": "java/extractor/summary",
+    "name": "Java extractor telemetry"
+  },
+  "visibility": {
+    "cliSummaryTable": false,
+    "statusPage": false,
+    "telemetry": true
+  }
+}
 {
   "markdownMessage": "Java analysis dropped the following dependencies because a sibling project depends on a higher version:\n\n* `junit/junit-4.11`",
   "severity": "unknown",

java/ql/integration-tests/java/buildless/diagnostics.expected

@@ -1,3 +1,18 @@
+{
+  "attributes": {},
+  "markdownMessage": "Internal telemetry for the Java extractor.\n\nNo action needed.",
+  "severity": "note",
+  "source": {
+    "extractorName": "java",
+    "id": "java/extractor/summary",
+    "name": "Java extractor telemetry"
+  },
+  "visibility": {
+    "cliSummaryTable": false,
+    "statusPage": false,
+    "telemetry": true
+  }
+}
 {
   "markdownMessage": "Because no usable build tool (Gradle, Maven, etc) was found, build scripts could not be queried for guidance about the appropriate JDK version for the code being extracted, or precise dependency information. The default JDK will be used, and external dependencies will be inferred from the Java package names used.",
   "severity": "unknown",

java/ql/integration-tests/java/gradle-sample-without-wrapper-or-gradle-buildless/diagnostics.expected

@@ -1,3 +1,21 @@
+{
+  "attributes": {
+    "java_vendor": "__REDACTED__",
+    "java_version": "11.0.31"
+  },
+  "markdownMessage": "Internal telemetry for the Java extractor.\n\nNo action needed.",
+  "severity": "note",
+  "source": {
+    "extractorName": "java",
+    "id": "java/extractor/summary",
+    "name": "Java extractor telemetry"
+  },
+  "visibility": {
+    "cliSummaryTable": false,
+    "statusPage": false,
+    "telemetry": true
+  }
+}
 {
   "markdownMessage": "Analyzed a Gradle project without the [Gradle wrapper](https://docs.gradle.org/current/userguide/gradle_wrapper.html). This may use an incompatible version of Gradle.",
   "severity": "warning",

java/ql/integration-tests/java/gradle-sample-without-wrapper-or-gradle-buildless/test.py

@@ -4,7 +4,8 @@ import pathlib
 
 
 # The version of gradle used doesn't work on java 17
-def test(codeql, use_java_11, java, environment):
+def test(codeql, use_java_11, java, environment, check_diagnostics):
+    check_diagnostics.redact += ["attributes.java_vendor"]
     gradle_override_dir = pathlib.Path(tempfile.mkdtemp())
     if runs_on.windows:
         (gradle_override_dir / "gradle.bat").write_text("@echo off\nexit /b 2\n")

java/ql/integration-tests/java/maven-download-failure/diagnostics.expected

@@ -1,3 +1,18 @@
+{
+  "attributes": {},
+  "markdownMessage": "Internal telemetry for the Java extractor.\n\nNo action needed.",
+  "severity": "note",
+  "source": {
+    "extractorName": "java",
+    "id": "java/extractor/summary",
+    "name": "Java extractor telemetry"
+  },
+  "visibility": {
+    "cliSummaryTable": false,
+    "statusPage": false,
+    "telemetry": true
+  }
+}
 {
   "markdownMessage": "Java analysis used build tool Maven to pick a JDK version and/or to recommend external dependencies.",
   "severity": "unknown",

java/ql/integration-tests/java/maven-download-failure/test.py

@@ -2,7 +2,7 @@ import os
 import os.path
 import shutil
 
-def test(codeql, java, check_diagnostics):
+def test(codeql, java, check_diagnostics_java):
 
     # Avoid shutil resolving mvn to the wrapper script in the test dir:
     os.environ["NoDefaultCurrentDirectoryInExePath"] = "0"

java/ql/lib/semmle/code/java/ControlFlowGraph.qll

@@ -61,6 +61,8 @@ private module Ast implements AstSig<Location> {
   class Parameter extends AstNode {
     Parameter() { none() }
 
+    AstNode getPattern() { none() }
+
     Expr getDefaultValue() { none() }
   }
 

misc/codegen/requirements_lock.txt

@@ -14,7 +14,7 @@ pluggy==1.5.0
     # via pytest
 pystache==0.6.8
     # via -r misc/codegen/requirements_in.txt
-pytest==9.0.3
+pytest==8.3.5
     # via -r misc/codegen/requirements_in.txt
 pyyaml==6.0.2
     # via -r misc/codegen/requirements_in.txt

python/ql/test/query-tests/Security/CWE-943-NoSqlInjection/PoC/requirements.txt

@@ -1,2 +1,2 @@
 flask
-pymongo==4.6.3
+pymongo==3.9

shared/controlflow/codeql/controlflow/ControlFlowGraph.qll

@@ -52,6 +52,15 @@ signature module AstSig<LocationSig Location> {
 
   /** A parameter of a callable. */
   class Parameter extends AstNode {
+    /**
+     * Gets the pattern associated with this parameter.
+     *
+     * The pattern is included in the CFG while the parameter itself is not.
+     * Although, in simple cases that do not involve destructuring, it is
+     * allowed for the pattern to be equal to the parameter.
+     */
+    AstNode getPattern();
+
     /** Gets the default value of this parameter, if any. */
     Expr getDefaultValue();
   }
@@ -631,7 +640,7 @@ module Make0<LocationSig Location, AstSig<Location> Ast> {
         or
         n = any(Case case).getPattern(_)
         or
-        exists(n.(Parameter).getDefaultValue())
+        exists(Parameter p | exists(p.getDefaultValue()) and n = p.getPattern())
       )
     }
 
@@ -803,24 +812,27 @@ module Make0<LocationSig Location, AstSig<Location> Ast> {
       )
     }
 
+    private predicate hasCfg(AstNode n) {
+      exists(getEnclosingCallable(n)) and
+      (n instanceof Parameter implies n = n.(Parameter).getPattern())
+    }
+
     cached
     private newtype TNode =
-      TBeforeNode(AstNode n) { Input1::cfgCachedStageRef() and exists(getEnclosingCallable(n)) } or
-      TAstNode(AstNode n) { postOrInOrder(n) and exists(getEnclosingCallable(n)) } or
+      TBeforeNode(AstNode n) { Input1::cfgCachedStageRef() and hasCfg(n) } or
+      TAstNode(AstNode n) { postOrInOrder(n) and hasCfg(n) } or
       TAfterValueNode(AstNode n, ConditionalSuccessor t) {
         inConditionalContext(n, t.getKind()) and
-        exists(getEnclosingCallable(n)) and
+        hasCfg(n) and
         not constantCondition(n, t.getDual())
       } or
       TAfterNode(AstNode n) {
-        exists(getEnclosingCallable(n)) and
+        hasCfg(n) and
         not inConditionalContext(n, _) and
         not cannotTerminateNormally(n) and
         not simpleLeafNode(n)
       } or
-      TAdditionalNode(AstNode n, string tag) {
-        additionalNode(n, tag, _) and exists(getEnclosingCallable(n))
-      } or
+      TAdditionalNode(AstNode n, string tag) { additionalNode(n, tag, _) and hasCfg(n) } or
       TEntryNode(Callable c) { callableHasBodyPart(c, _) } or
       TAnnotatedExitNode(Callable c, Boolean normal) { callableHasBodyPart(c, _) } or
       TExitNode(Callable c) { callableHasBodyPart(c, _) }
@@ -1390,8 +1402,8 @@ module Make0<LocationSig Location, AstSig<Location> Ast> {
       }
 
       pragma[nomagic]
-      private AstNode getParameterOrBodyEntry(Callable c, CallableContextOption ctx, int i) {
-        result = getRankedParameter(c, ctx, i)
+      private AstNode getParameterPatternOrBodyEntry(Callable c, CallableContextOption ctx, int i) {
+        result = getRankedParameter(c, ctx, i).getPattern()
         or
         (
           not exists(getRankedParameter(c, _, _)) and
@@ -1409,18 +1421,18 @@ module Make0<LocationSig Location, AstSig<Location> Ast> {
         or
         exists(Callable c |
           n1.(EntryNodeImpl).getEnclosingCallable() = c and
-          n2.isBefore(getParameterOrBodyEntry(c, _, 1))
+          n2.isBefore(getParameterPatternOrBodyEntry(c, _, 1))
           or
           exists(CallableContextOption ctx, Parameter p, int i | p = getRankedParameter(c, ctx, i) |
             exists(MatchingSuccessor t |
-              n1.isAfterValue(p, t) and
+              n1.isAfterValue(p.getPattern(), t) and
               if t.isMatch()
-              then n2.isBefore(getParameterOrBodyEntry(c, ctx, i + 1))
+              then n2.isBefore(getParameterPatternOrBodyEntry(c, ctx, i + 1))
               else n2.isBefore(p.getDefaultValue())
             )
             or
             n1.isAfter(p.getDefaultValue()) and
-            n2.isBefore(getParameterOrBodyEntry(c, ctx, i + 1))
+            n2.isBefore(getParameterPatternOrBodyEntry(c, ctx, i + 1))
           )
           or
           exists(Input1::CallableContext ctx, int i |
@@ -1796,6 +1808,7 @@ module Make0<LocationSig Location, AstSig<Location> Ast> {
        * and therefore should use default left-to-right evaluation.
        */
       private predicate defaultCfg(AstNode ast) {
+        hasCfg(ast) and
         not explicitStep(any(PreControlFlowNode n | n.isBefore(ast)), _)
       }