Add changelog for 2.16.4

.bazelversion

@@ -1 +1 @@
-7.1.0
+7.0.2

.github/workflows/cpp-swift-analysis.yml

@@ -1,55 +0,0 @@
-name: "Code scanning - C++"
-
-on:
-  push:
-    branches:
-      - main
-      - 'rc/*'
-  pull_request:
-    branches:
-      - main
-      - 'rc/*'
-    paths:
-      - 'swift/**'
-      - '.github/codeql/**'
-      - '.github/workflows/cpp-swift-analysis.yml'
-  schedule:
-    - cron: '0 9 * * 1'
-
-jobs:
-  CodeQL-Build:
-
-    runs-on: ubuntu-latest
-
-    permissions:
-      contents: read
-      security-events: write
-      pull-requests: read
-
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v4
-
-    # Initializes the CodeQL tools for scanning.
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@main
-      # Override language selection by uncommenting this and choosing your languages
-      with:
-        languages: cpp
-        config-file: ./.github/codeql/codeql-config.yml
-  
-    - name: "[Ubuntu] Remove GCC 13 from runner image"
-      shell: bash
-      run: |
-        sudo rm -f /etc/apt/sources.list.d/ubuntu-toolchain-r-ubuntu-test-jammy.list
-        sudo apt-get update
-        sudo apt-get install -y --allow-downgrades libc6=2.35-* libc6-dev=2.35-* libstdc++6=12.3.0-* libgcc-s1=12.3.0-*
-
-    - name: "Build Swift extractor using Bazel"
-      run: |
-        bazel clean --expunge
-        bazel run //swift:create-extractor-pack --nouse_action_cache --noremote_accept_cached --noremote_upload_local_results --spawn_strategy=local --features=-layering_check
-        bazel shutdown
-
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@main

CODEOWNERS

@@ -1,5 +1,4 @@
 /cpp/ @github/codeql-c-analysis
-/cpp/autobuilder/ @github/codeql-c-extractor
 /csharp/ @github/codeql-csharp
 /go/ @github/codeql-go
 /java/ @github/codeql-java

codeql-workspace.yml

@@ -6,7 +6,6 @@ provide:
   - "*/ql/consistency-queries/qlpack.yml"
   - "*/ql/automodel/src/qlpack.yml"
   - "*/ql/automodel/test/qlpack.yml"
-  - "python/extractor/qlpack.yml"
   - "shared/**/qlpack.yml"
   - "cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/qlpack.yml"
   - "go/ql/config/legacy-support/qlpack.yml"
@@ -28,6 +27,7 @@ provide:
   - "misc/suite-helpers/qlpack.yml"
   - "ruby/extractor-pack/codeql-extractor.yml"
   - "swift/extractor-pack/codeql-extractor.yml"
+  - "swift/integration-tests/qlpack.yml"
   - "ql/extractor-pack/codeql-extractor.yml"
   - ".github/codeql/extensions/**/codeql-pack.yml"
 

config/identical-files.json

@@ -251,6 +251,13 @@
     "cpp/ql/src/Security/CWE/CWE-020/SafeExternalAPIFunction.qll",
     "cpp/ql/src/Security/CWE/CWE-020/ir/SafeExternalAPIFunction.qll"
   ],
+  "XML": [
+    "cpp/ql/lib/semmle/code/cpp/XML.qll",
+    "csharp/ql/lib/semmle/code/csharp/XML.qll",
+    "java/ql/lib/semmle/code/xml/XML.qll",
+    "javascript/ql/lib/semmle/javascript/XML.qll",
+    "python/ql/lib/semmle/python/xml/XML.qll"
+  ],
   "DuplicationProblems.inc.qhelp": [
     "cpp/ql/src/Metrics/Files/DuplicationProblems.inc.qhelp",
     "javascript/ql/src/Metrics/DuplicationProblems.inc.qhelp",
@@ -365,4 +372,4 @@
     "python/ql/test/experimental/dataflow/model-summaries/InlineTaintTest.ext.yml",
     "python/ql/test/experimental/dataflow/model-summaries/NormalDataflowTest.ext.yml"
   ]
-}
+}

cpp/autobuilder/Semmle.Autobuild.Cpp.Tests/BuildScripts.cs

@@ -203,8 +203,6 @@ namespace Semmle.Autobuild.Cpp.Tests
         public IList<DiagnosticMessage> Diagnostics { get; } = new List<DiagnosticMessage>();
 
         public void AddEntry(DiagnosticMessage message) => this.Diagnostics.Add(message);
-
-        public void Dispose() { }
     }
 
     /// <summary>
@@ -252,7 +250,12 @@ namespace Semmle.Autobuild.Cpp.Tests
             EndCallbackIn.Add(s);
         }
 
-        CppAutobuilder CreateAutoBuilder(bool isWindows, string? dotnetVersion = null, string cwd = @"C:\Project")
+        CppAutobuilder CreateAutoBuilder(bool isWindows,
+            string? buildless = null, string? solution = null, string? buildCommand = null, string? ignoreErrors = null,
+            string? msBuildArguments = null, string? msBuildPlatform = null, string? msBuildConfiguration = null, string? msBuildTarget = null,
+            string? dotnetArguments = null, string? dotnetVersion = null, string? vsToolsVersion = null,
+            string? nugetRestore = null, string? allSolutions = null,
+            string cwd = @"C:\Project")
         {
             string codeqlUpperLanguage = Language.Cpp.UpperCaseName;
             Actions.GetEnvironmentVariable[$"CODEQL_AUTOBUILDER_{codeqlUpperLanguage}_NO_INDEXING"] = "false";
@@ -262,7 +265,22 @@ namespace Semmle.Autobuild.Cpp.Tests
             Actions.GetEnvironmentVariable[$"CODEQL_EXTRACTOR_{codeqlUpperLanguage}_DIAGNOSTIC_DIR"] = "";
             Actions.GetEnvironmentVariable["CODEQL_JAVA_HOME"] = @"C:\codeql\tools\java";
             Actions.GetEnvironmentVariable["CODEQL_PLATFORM"] = "win64";
-            Actions.GetEnvironmentVariable["CODEQL_EXTRACTOR_CSHARP_OPTION_DOTNET_VERSION"] = dotnetVersion;
+            Actions.GetEnvironmentVariable["SEMMLE_DIST"] = @"C:\odasa";
+            Actions.GetEnvironmentVariable["SEMMLE_JAVA_HOME"] = @"C:\odasa\tools\java";
+            Actions.GetEnvironmentVariable["SEMMLE_PLATFORM_TOOLS"] = @"C:\odasa\tools";
+            Actions.GetEnvironmentVariable["LGTM_INDEX_VSTOOLS_VERSION"] = vsToolsVersion;
+            Actions.GetEnvironmentVariable["LGTM_INDEX_MSBUILD_ARGUMENTS"] = msBuildArguments;
+            Actions.GetEnvironmentVariable["LGTM_INDEX_MSBUILD_PLATFORM"] = msBuildPlatform;
+            Actions.GetEnvironmentVariable["LGTM_INDEX_MSBUILD_CONFIGURATION"] = msBuildConfiguration;
+            Actions.GetEnvironmentVariable["LGTM_INDEX_MSBUILD_TARGET"] = msBuildTarget;
+            Actions.GetEnvironmentVariable["LGTM_INDEX_DOTNET_ARGUMENTS"] = dotnetArguments;
+            Actions.GetEnvironmentVariable["LGTM_INDEX_DOTNET_VERSION"] = dotnetVersion;
+            Actions.GetEnvironmentVariable["LGTM_INDEX_BUILD_COMMAND"] = buildCommand;
+            Actions.GetEnvironmentVariable["LGTM_INDEX_SOLUTION"] = solution;
+            Actions.GetEnvironmentVariable["LGTM_INDEX_IGNORE_ERRORS"] = ignoreErrors;
+            Actions.GetEnvironmentVariable["LGTM_INDEX_BUILDLESS"] = buildless;
+            Actions.GetEnvironmentVariable["LGTM_INDEX_ALL_SOLUTIONS"] = allSolutions;
+            Actions.GetEnvironmentVariable["LGTM_INDEX_NUGET_RESTORE"] = nugetRestore;
             Actions.GetEnvironmentVariable["ProgramFiles(x86)"] = isWindows ? @"C:\Program Files (x86)" : null;
             Actions.GetCurrentDirectory = cwd;
             Actions.IsWindows = isWindows;

cpp/autobuilder/Semmle.Autobuild.Cpp/CppAutobuilder.cs

@@ -26,6 +26,9 @@ namespace Semmle.Autobuild.Cpp
 
         public override BuildScript GetBuildScript()
         {
+            if (Options.BuildCommand != null)
+                return new BuildCommandRule((_, f) => f(null)).Analyse(this, false);
+
             return
                 // First try MSBuild
                 new MsBuildRule().Analyse(this, true) |

cpp/autobuilder/Semmle.Autobuild.Cpp/Program.cs

@@ -17,7 +17,7 @@ namespace Semmle.Autobuild.Cpp
                 try
                 {
                     Console.WriteLine("CodeQL C++ autobuilder");
-                    using var builder = new CppAutobuilder(actions, options);
+                    var builder = new CppAutobuilder(actions, options);
                     return builder.AttemptBuild();
                 }
                 catch (InvalidEnvironmentException ex)

cpp/downgrades/aa7ff0ab32cd4674f6ab731d32fea64116997b05/exprs.ql

@@ -1,13 +0,0 @@
-class Expr extends @expr {
-  string toString() { none() }
-}
-
-class Location extends @location_expr {
-  string toString() { none() }
-}
-
-from Expr expr, int kind, int kind_new, Location loc
-where
-  exprs(expr, kind, loc) and
-  if kind = 363 then kind_new = 1 else kind_new = kind
-select expr, kind_new, loc

cpp/downgrades/aa7ff0ab32cd4674f6ab731d32fea64116997b05/upgrade.properties

@@ -1,4 +0,0 @@
-description: Introduce re-use expressions
-compatibility: partial
-expr_reuse.rel: delete
-exprs.rel: run exprs.qlo

cpp/downgrades/abfce5c170f93e281948f7689ece373464fdaf87/expr_reuse.ql

@@ -1,7 +0,0 @@
-class Expr extends @expr {
-  string toString() { none() }
-}
-
-from Expr reuse, Expr original
-where expr_reuse(reuse, original, _)
-select reuse, original

cpp/downgrades/abfce5c170f93e281948f7689ece373464fdaf87/expr_types.ql

@@ -1,22 +0,0 @@
-class Expr extends @expr {
-  string toString() { none() }
-}
-
-class Type extends @type {
-  string toString() { none() }
-}
-
-predicate existingType(Expr expr, Type type, int value_category) {
-  expr_types(expr, type, value_category)
-}
-
-predicate reuseType(Expr reuse, Type type, int value_category) {
-  exists(Expr original |
-    expr_reuse(reuse, original, value_category) and
-    expr_types(original, type, _)
-  )
-}
-
-from Expr expr, Type type, int value_category
-where existingType(expr, type, value_category) or reuseType(expr, type, value_category)
-select expr, type, value_category

cpp/downgrades/abfce5c170f93e281948f7689ece373464fdaf87/upgrade.properties

@@ -1,4 +0,0 @@
-description: Add value category to expr_reuse table
-compatibility: full
-expr_reuse.rel: run expr_reuse.qlo
-expr_types.rel: run expr_types.qlo

cpp/ql/lib/CHANGELOG.md

@@ -1,32 +1,3 @@
-## 0.12.10
-
-### New Features
-
-* Added a `TaintInheritingContent` class that can be extended to model taint flowing from a qualifier to a field.
-* Added a predicate `GuardCondition.comparesEq/4` to query whether an expression is compared to a constant. 
-* Added a predicate `GuardCondition.ensuresEq/4` to query whether a basic block is guarded by an expression being equal to a constant.
-* Added a predicate `GuardCondition.comparesLt/4` to query whether an expression is compared to a constant. 
-* Added a predicate `GuardCondition.ensuresLt/4` to query whether a basic block is guarded by an expression being less than a constant.
-* Added a predicate `GuardCondition.valueControls` to query whether a basic block is guarded by a particular `case` of a `switch` statement.
-
-### Minor Analysis Improvements
-
-* Added destructors for temporary objects with extended lifetimes to the intermediate representation.
-
-## 0.12.9
-
-No user-facing changes.
-
-## 0.12.8
-
-No user-facing changes.
-
-## 0.12.7
-
-### Minor Analysis Improvements
-
-* Added destructors for named objects to the intermediate representation.
-
 ## 0.12.6
 
 ### New Features

cpp/ql/lib/change-notes/2024-02-26-ir-named-destructors.md

@@ -1,5 +1,4 @@
-## 0.12.7
-
-### Minor Analysis Improvements
-
-* Added destructors for named objects to the intermediate representation.
+---
+category: minorAnalysis
+---
+* Added destructors for named objects to the intermediate representation.

cpp/ql/lib/change-notes/released/0.12.10.md

@@ -1,14 +0,0 @@
-## 0.12.10
-
-### New Features
-
-* Added a `TaintInheritingContent` class that can be extended to model taint flowing from a qualifier to a field.
-* Added a predicate `GuardCondition.comparesEq/4` to query whether an expression is compared to a constant. 
-* Added a predicate `GuardCondition.ensuresEq/4` to query whether a basic block is guarded by an expression being equal to a constant.
-* Added a predicate `GuardCondition.comparesLt/4` to query whether an expression is compared to a constant. 
-* Added a predicate `GuardCondition.ensuresLt/4` to query whether a basic block is guarded by an expression being less than a constant.
-* Added a predicate `GuardCondition.valueControls` to query whether a basic block is guarded by a particular `case` of a `switch` statement.
-
-### Minor Analysis Improvements
-
-* Added destructors for temporary objects with extended lifetimes to the intermediate representation.

cpp/ql/lib/change-notes/released/0.12.8.md

@@ -1,3 +0,0 @@
-## 0.12.8
-
-No user-facing changes.

cpp/ql/lib/change-notes/released/0.12.9.md

@@ -1,3 +0,0 @@
-## 0.12.9
-
-No user-facing changes.

cpp/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.12.10
+lastReleaseVersion: 0.12.6

cpp/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cpp-all
-version: 0.12.11-dev
+version: 0.12.7-dev
 groups: cpp
 dbscheme: semmlecode.cpp.dbscheme
 extractor: cpp
@@ -11,5 +11,4 @@ dependencies:
   codeql/ssa: ${workspace}
   codeql/tutorial: ${workspace}
   codeql/util: ${workspace}
-  codeql/xml: ${workspace}
 warnOnImplicitThis: true

cpp/ql/lib/semmle/code/cpp/PrintAST.qll

@@ -309,12 +309,9 @@ class ExprNode extends AstNode {
   override AstNode getChildInternal(int childIndex) {
     result.getAst() = expr.getChild(childIndex)
     or
-    childIndex = max(int index | exists(expr.getChild(index)) or index = 0) + 1 and
-    result.getAst() = expr.(ConditionDeclExpr).getInitializingExpr()
-    or
     exists(int destructorIndex |
       result.getAst() = expr.getImplicitDestructorCall(destructorIndex) and
-      childIndex = destructorIndex + max(int index | exists(expr.getChild(index)) or index = 0) + 2
+      childIndex = destructorIndex + max(int index | exists(expr.getChild(index)) or index = 0) + 1
     )
   }
 
@@ -689,8 +686,6 @@ private string getChildAccessorWithoutConversions(Locatable parent, Element chil
       not namedExprChildPredicates(expr, child, _) and
       exists(int n | expr.getChild(n) = child and result = "getChild(" + n + ")")
       or
-      expr.(ConditionDeclExpr).getInitializingExpr() = child and result = "getInitializingExpr()"
-      or
       exists(int n |
         expr.getImplicitDestructorCall(n) = child and
         result = "getImplicitDestructorCall(" + n + ")"
@@ -862,7 +857,7 @@ private predicate namedExprChildPredicates(Expr expr, Element ele, string pred)
     or
     expr.(DeleteOrDeleteArrayExpr).getDestructorCall() = ele and pred = "getDestructorCall()"
     or
-    expr.(DeleteOrDeleteArrayExpr).getExprWithReuse() = ele and pred = "getExprWithReuse()"
+    expr.(DeleteOrDeleteArrayExpr).getExpr() = ele and pred = "getExpr()"
     or
     expr.(DestructorFieldDestruction).getExpr() = ele and pred = "getExpr()"
     or

cpp/ql/lib/semmle/code/cpp/Variable.qll

@@ -590,33 +590,6 @@ class TemplateVariable extends Variable {
   Variable getAnInstantiation() { result.isConstructedFrom(this) }
 }
 
-/**
- * A variable that is an instantiation of a template. For example
- * the instantiation `myTemplateVariable<int>` in the following code:
- * ```
- * template<class T>
- * T myTemplateVariable;
- *
- * void caller(int i) {
- *   myTemplateVariable<int> = i;
- * }
- * ```
- */
-class VariableTemplateInstantiation extends Variable {
-  TemplateVariable tv;
-
-  VariableTemplateInstantiation() { tv.getAnInstantiation() = this }
-
-  override string getAPrimaryQlClass() { result = "VariableTemplateInstantiation" }
-
-  /**
-   * Gets the variable template from which this instantiation was instantiated.
-   *
-   * Example: For `int x<int>`, returns `T x`.
-   */
-  TemplateVariable getTemplate() { result = tv }
-}
-
 /**
  * A non-static local variable or parameter that is not part of an
  * uninstantiated template. Uninstantiated templates are purely syntax, and

cpp/ql/lib/semmle/code/cpp/XML.qll

@@ -3,67 +3,305 @@
  */
 
 import semmle.files.FileSystem
-private import codeql.xml.Xml
 
-private module Input implements InputSig<File, Location> {
-  class XmlLocatableBase = @xmllocatable or @xmlnamespaceable;
+private class TXmlLocatable =
+  @xmldtd or @xmlelement or @xmlattribute or @xmlnamespace or @xmlcomment or @xmlcharacters;
 
-  predicate xmllocations_(XmlLocatableBase e, Location loc) { xmllocations(e, loc) }
+/** An XML element that has a location. */
+class XmlLocatable extends @xmllocatable, TXmlLocatable {
+  /** Gets the source location for this element. */
+  Location getLocation() { xmllocations(this, result) }
 
-  class XmlParentBase = @xmlparent;
-
-  class XmlNamespaceableBase = @xmlnamespaceable;
-
-  class XmlElementBase = @xmlelement;
-
-  class XmlFileBase = File;
-
-  predicate xmlEncoding_(XmlFileBase f, string enc) { xmlEncoding(f, enc) }
-
-  class XmlDtdBase = @xmldtd;
-
-  predicate xmlDTDs_(XmlDtdBase e, string root, string publicId, string systemId, XmlFileBase file) {
-    xmlDTDs(e, root, publicId, systemId, file)
-  }
-
-  predicate xmlElements_(
-    XmlElementBase e, string name, XmlParentBase parent, int idx, XmlFileBase file
+  /**
+   * Holds if this element is at the specified location.
+   * The location spans column `startcolumn` of line `startline` to
+   * column `endcolumn` of line `endline` in file `filepath`.
+   * For more information, see
+   * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+   */
+  predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
   ) {
-    xmlElements(e, name, parent, idx, file)
+    exists(File f, Location l | l = this.getLocation() |
+      locations_default(l, f, startline, startcolumn, endline, endcolumn) and
+      filepath = f.getAbsolutePath()
+    )
   }
 
-  class XmlAttributeBase = @xmlattribute;
+  /** Gets a textual representation of this element. */
+  string toString() { none() } // overridden in subclasses
+}
 
-  predicate xmlAttrs_(
-    XmlAttributeBase e, XmlElementBase elementid, string name, string value, int idx,
-    XmlFileBase file
-  ) {
-    xmlAttrs(e, elementid, name, value, idx, file)
+/**
+ * An `XmlParent` is either an `XmlElement` or an `XmlFile`,
+ * both of which can contain other elements.
+ */
+class XmlParent extends @xmlparent {
+  XmlParent() {
+    // explicitly restrict `this` to be either an `XmlElement` or an `XmlFile`;
+    // the type `@xmlparent` currently also includes non-XML files
+    this instanceof @xmlelement or xmlEncoding(this, _)
   }
 
-  class XmlNamespaceBase = @xmlnamespace;
+  /**
+   * Gets a printable representation of this XML parent.
+   * (Intended to be overridden in subclasses.)
+   */
+  string getName() { none() } // overridden in subclasses
 
-  predicate xmlNs_(XmlNamespaceBase e, string prefixName, string uri, XmlFileBase file) {
-    xmlNs(e, prefixName, uri, file)
+  /** Gets the file to which this XML parent belongs. */
+  XmlFile getFile() { result = this or xmlElements(this, _, _, _, result) }
+
+  /** Gets the child element at a specified index of this XML parent. */
+  XmlElement getChild(int index) { xmlElements(result, _, this, index, _) }
+
+  /** Gets a child element of this XML parent. */
+  XmlElement getAChild() { xmlElements(result, _, this, _, _) }
+
+  /** Gets a child element of this XML parent with the given `name`. */
+  XmlElement getAChild(string name) { xmlElements(result, _, this, _, _) and result.hasName(name) }
+
+  /** Gets a comment that is a child of this XML parent. */
+  XmlComment getAComment() { xmlComments(result, _, this, _) }
+
+  /** Gets a character sequence that is a child of this XML parent. */
+  XmlCharacters getACharactersSet() { xmlChars(result, _, this, _, _, _) }
+
+  /** Gets the depth in the tree. (Overridden in XmlElement.) */
+  int getDepth() { result = 0 }
+
+  /** Gets the number of child XML elements of this XML parent. */
+  int getNumberOfChildren() { result = count(XmlElement e | xmlElements(e, _, this, _, _)) }
+
+  /** Gets the number of places in the body of this XML parent where text occurs. */
+  int getNumberOfCharacterSets() { result = count(int pos | xmlChars(_, _, this, pos, _, _)) }
+
+  /**
+   * Gets the result of appending all the character sequences of this XML parent from
+   * left to right, separated by a space.
+   */
+  string allCharactersString() {
+    result =
+      concat(string chars, int pos | xmlChars(_, chars, this, pos, _, _) | chars, " " order by pos)
   }
 
-  predicate xmlHasNs_(XmlNamespaceableBase e, XmlNamespaceBase ns, XmlFileBase file) {
-    xmlHasNs(e, ns, file)
-  }
+  /** Gets the text value contained in this XML parent. */
+  string getTextValue() { result = this.allCharactersString() }
 
-  class XmlCommentBase = @xmlcomment;
+  /** Gets a printable representation of this XML parent. */
+  string toString() { result = this.getName() }
+}
 
-  predicate xmlComments_(XmlCommentBase e, string text, XmlParentBase parent, XmlFileBase file) {
-    xmlComments(e, text, parent, file)
-  }
+/** An XML file. */
+class XmlFile extends XmlParent, File {
+  XmlFile() { xmlEncoding(this, _) }
 
-  class XmlCharactersBase = @xmlcharacters;
+  /** Gets a printable representation of this XML file. */
+  override string toString() { result = this.getName() }
 
-  predicate xmlChars_(
-    XmlCharactersBase e, string text, XmlParentBase parent, int idx, int isCDATA, XmlFileBase file
-  ) {
-    xmlChars(e, text, parent, idx, isCDATA, file)
+  /** Gets the name of this XML file. */
+  override string getName() { result = File.super.getAbsolutePath() }
+
+  /** Gets the encoding of this XML file. */
+  string getEncoding() { xmlEncoding(this, result) }
+
+  /** Gets the XML file itself. */
+  override XmlFile getFile() { result = this }
+
+  /** Gets a top-most element in an XML file. */
+  XmlElement getARootElement() { result = this.getAChild() }
+
+  /** Gets a DTD associated with this XML file. */
+  XmlDtd getADtd() { xmlDTDs(result, _, _, _, this) }
+}
+
+/**
+ * An XML document type definition (DTD).
+ *
+ * Example:
+ *
+ * ```
+ * <!ELEMENT person (firstName, lastName?)>
+ * <!ELEMENT firstName (#PCDATA)>
+ * <!ELEMENT lastName (#PCDATA)>
+ * ```
+ */
+class XmlDtd extends XmlLocatable, @xmldtd {
+  /** Gets the name of the root element of this DTD. */
+  string getRoot() { xmlDTDs(this, result, _, _, _) }
+
+  /** Gets the public ID of this DTD. */
+  string getPublicId() { xmlDTDs(this, _, result, _, _) }
+
+  /** Gets the system ID of this DTD. */
+  string getSystemId() { xmlDTDs(this, _, _, result, _) }
+
+  /** Holds if this DTD is public. */
+  predicate isPublic() { not xmlDTDs(this, _, "", _, _) }
+
+  /** Gets the parent of this DTD. */
+  XmlParent getParent() { xmlDTDs(this, _, _, _, result) }
+
+  override string toString() {
+    this.isPublic() and
+    result = this.getRoot() + " PUBLIC '" + this.getPublicId() + "' '" + this.getSystemId() + "'"
+    or
+    not this.isPublic() and
+    result = this.getRoot() + " SYSTEM '" + this.getSystemId() + "'"
   }
 }
 
-import Make<File, Location, Input>
+/**
+ * An XML element in an XML file.
+ *
+ * Example:
+ *
+ * ```
+ * <manifest xmlns:android="http://schemas.android.com/apk/res/android"
+ *           package="com.example.exampleapp" android:versionCode="1">
+ * </manifest>
+ * ```
+ */
+class XmlElement extends @xmlelement, XmlParent, XmlLocatable {
+  /** Holds if this XML element has the given `name`. */
+  predicate hasName(string name) { name = this.getName() }
+
+  /** Gets the name of this XML element. */
+  override string getName() { xmlElements(this, result, _, _, _) }
+
+  /** Gets the XML file in which this XML element occurs. */
+  override XmlFile getFile() { xmlElements(this, _, _, _, result) }
+
+  /** Gets the parent of this XML element. */
+  XmlParent getParent() { xmlElements(this, _, result, _, _) }
+
+  /** Gets the index of this XML element among its parent's children. */
+  int getIndex() { xmlElements(this, _, _, result, _) }
+
+  /** Holds if this XML element has a namespace. */
+  predicate hasNamespace() { xmlHasNs(this, _, _) }
+
+  /** Gets the namespace of this XML element, if any. */
+  XmlNamespace getNamespace() { xmlHasNs(this, result, _) }
+
+  /** Gets the index of this XML element among its parent's children. */
+  int getElementPositionIndex() { xmlElements(this, _, _, result, _) }
+
+  /** Gets the depth of this element within the XML file tree structure. */
+  override int getDepth() { result = this.getParent().getDepth() + 1 }
+
+  /** Gets an XML attribute of this XML element. */
+  XmlAttribute getAnAttribute() { result.getElement() = this }
+
+  /** Gets the attribute with the specified `name`, if any. */
+  XmlAttribute getAttribute(string name) { result.getElement() = this and result.getName() = name }
+
+  /** Holds if this XML element has an attribute with the specified `name`. */
+  predicate hasAttribute(string name) { exists(this.getAttribute(name)) }
+
+  /** Gets the value of the attribute with the specified `name`, if any. */
+  string getAttributeValue(string name) { result = this.getAttribute(name).getValue() }
+
+  /** Gets a printable representation of this XML element. */
+  override string toString() { result = this.getName() }
+}
+
+/**
+ * An attribute that occurs inside an XML element.
+ *
+ * Examples:
+ *
+ * ```
+ * package="com.example.exampleapp"
+ * android:versionCode="1"
+ * ```
+ */
+class XmlAttribute extends @xmlattribute, XmlLocatable {
+  /** Gets the name of this attribute. */
+  string getName() { xmlAttrs(this, _, result, _, _, _) }
+
+  /** Gets the XML element to which this attribute belongs. */
+  XmlElement getElement() { xmlAttrs(this, result, _, _, _, _) }
+
+  /** Holds if this attribute has a namespace. */
+  predicate hasNamespace() { xmlHasNs(this, _, _) }
+
+  /** Gets the namespace of this attribute, if any. */
+  XmlNamespace getNamespace() { xmlHasNs(this, result, _) }
+
+  /** Gets the value of this attribute. */
+  string getValue() { xmlAttrs(this, _, _, result, _, _) }
+
+  /** Gets a printable representation of this XML attribute. */
+  override string toString() { result = this.getName() + "=" + this.getValue() }
+}
+
+/**
+ * A namespace used in an XML file.
+ *
+ * Example:
+ *
+ * ```
+ * xmlns:android="http://schemas.android.com/apk/res/android"
+ * ```
+ */
+class XmlNamespace extends XmlLocatable, @xmlnamespace {
+  /** Gets the prefix of this namespace. */
+  string getPrefix() { xmlNs(this, result, _, _) }
+
+  /** Gets the URI of this namespace. */
+  string getUri() { xmlNs(this, _, result, _) }
+
+  /** Holds if this namespace has no prefix. */
+  predicate isDefault() { this.getPrefix() = "" }
+
+  override string toString() {
+    this.isDefault() and result = this.getUri()
+    or
+    not this.isDefault() and result = this.getPrefix() + ":" + this.getUri()
+  }
+}
+
+/**
+ * A comment in an XML file.
+ *
+ * Example:
+ *
+ * ```
+ * <!-- This is a comment. -->
+ * ```
+ */
+class XmlComment extends @xmlcomment, XmlLocatable {
+  /** Gets the text content of this XML comment. */
+  string getText() { xmlComments(this, result, _, _) }
+
+  /** Gets the parent of this XML comment. */
+  XmlParent getParent() { xmlComments(this, _, result, _) }
+
+  /** Gets a printable representation of this XML comment. */
+  override string toString() { result = this.getText() }
+}
+
+/**
+ * A sequence of characters that occurs between opening and
+ * closing tags of an XML element, excluding other elements.
+ *
+ * Example:
+ *
+ * ```
+ * <content>This is a sequence of characters.</content>
+ * ```
+ */
+class XmlCharacters extends @xmlcharacters, XmlLocatable {
+  /** Gets the content of this character sequence. */
+  string getCharacters() { xmlChars(this, result, _, _, _, _) }
+
+  /** Gets the parent of this character sequence. */
+  XmlParent getParent() { xmlChars(this, _, result, _, _, _) }
+
+  /** Holds if this character sequence is CDATA. */
+  predicate isCDATA() { xmlChars(this, _, _, _, 1, _) }
+
+  /** Gets a printable representation of this XML character sequence. */
+  override string toString() { result = this.getCharacters() }
+}

cpp/ql/lib/semmle/code/cpp/controlflow/IRGuards.qll

@@ -20,44 +20,6 @@ private predicate isUnreachedBlock(IRBlock block) {
   block.getFirstInstruction() instanceof UnreachedInstruction
 }
 
-private newtype TAbstractValue =
-  TBooleanValue(boolean b) { b = true or b = false } or
-  TMatchValue(CaseEdge c)
-
-/**
- * An abstract value. This is either a boolean value, or a `switch` case.
- */
-abstract class AbstractValue extends TAbstractValue {
-  /** Gets an abstract value that represents the dual of this value, if any. */
-  abstract AbstractValue getDualValue();
-
-  /** Gets a textual representation of this abstract value. */
-  abstract string toString();
-}
-
-/** A Boolean value. */
-class BooleanValue extends AbstractValue, TBooleanValue {
-  /** Gets the underlying Boolean value. */
-  boolean getValue() { this = TBooleanValue(result) }
-
-  override BooleanValue getDualValue() { result.getValue() = this.getValue().booleanNot() }
-
-  override string toString() { result = this.getValue().toString() }
-}
-
-/** A value that represents a match against a specific `switch` case. */
-class MatchValue extends AbstractValue, TMatchValue {
-  /** Gets the case. */
-  CaseEdge getCase() { this = TMatchValue(result) }
-
-  override MatchValue getDualValue() {
-    // A `MatchValue` has no dual.
-    none()
-  }
-
-  override string toString() { result = this.getCase().toString() }
-}
-
 /**
  * A Boolean condition in the AST that guards one or more basic blocks. This includes
  * operands of logical operators but not switch statements.
@@ -72,15 +34,6 @@ class GuardCondition extends Expr {
     this.(BinaryLogicalOperation).getAnOperand() instanceof GuardCondition
   }
 
-  /**
-   * Holds if this condition controls `controlled`, meaning that `controlled` is only
-   * entered if the value of this condition is `v`.
-   *
-   * For details on what "controls" mean, see the QLDoc for `controls`.
-   */
-  cached
-  predicate valueControls(BasicBlock controlled, AbstractValue v) { none() }
-
   /**
    * Holds if this condition controls `controlled`, meaning that `controlled` is only
    * entered if the value of this condition is `testIsTrue`.
@@ -108,9 +61,7 @@ class GuardCondition extends Expr {
    * true (for `&&`) or false (for `||`) branch.
    */
   cached
-  final predicate controls(BasicBlock controlled, boolean testIsTrue) {
-    this.valueControls(controlled, any(BooleanValue bv | bv.getValue() = testIsTrue))
-  }
+  predicate controls(BasicBlock controlled, boolean testIsTrue) { none() }
 
   /** Holds if (determined by this guard) `left < right + k` evaluates to `isLessThan` if this expression evaluates to `testIsTrue`. */
   cached
@@ -125,20 +76,6 @@ class GuardCondition extends Expr {
   cached
   predicate ensuresLt(Expr left, Expr right, int k, BasicBlock block, boolean isLessThan) { none() }
 
-  /**
-   * Holds if (determined by this guard) `e < k` evaluates to `isLessThan` if
-   * this expression evaluates to `value`.
-   */
-  cached
-  predicate comparesLt(Expr e, int k, boolean isLessThan, AbstractValue value) { none() }
-
-  /**
-   * Holds if (determined by this guard) `e < k` must be `isLessThan` in `block`.
-   * If `isLessThan = false` then this implies `e >= k`.
-   */
-  cached
-  predicate ensuresLt(Expr e, int k, BasicBlock block, boolean isLessThan) { none() }
-
   /** Holds if (determined by this guard) `left == right + k` evaluates to `areEqual` if this expression evaluates to `testIsTrue`. */
   cached
   predicate comparesEq(Expr left, Expr right, int k, boolean areEqual, boolean testIsTrue) {
@@ -151,17 +88,6 @@ class GuardCondition extends Expr {
    */
   cached
   predicate ensuresEq(Expr left, Expr right, int k, BasicBlock block, boolean areEqual) { none() }
-
-  /** Holds if (determined by this guard) `e == k` evaluates to `areEqual` if this expression evaluates to `value`. */
-  cached
-  predicate comparesEq(Expr e, int k, boolean areEqual, AbstractValue value) { none() }
-
-  /**
-   * Holds if (determined by this guard) `e == k` must be `areEqual` in `block`.
-   * If `areEqual = false` then this implies `e != k`.
-   */
-  cached
-  predicate ensuresEq(Expr e, int k, BasicBlock block, boolean areEqual) { none() }
 }
 
 /**
@@ -172,13 +98,13 @@ private class GuardConditionFromBinaryLogicalOperator extends GuardCondition {
     this.(BinaryLogicalOperation).getAnOperand() instanceof GuardCondition
   }
 
-  override predicate valueControls(BasicBlock controlled, AbstractValue v) {
+  override predicate controls(BasicBlock controlled, boolean testIsTrue) {
     exists(BinaryLogicalOperation binop, GuardCondition lhs, GuardCondition rhs |
       this = binop and
       lhs = binop.getLeftOperand() and
       rhs = binop.getRightOperand() and
-      lhs.valueControls(controlled, v) and
-      rhs.valueControls(controlled, v)
+      lhs.controls(controlled, testIsTrue) and
+      rhs.controls(controlled, testIsTrue)
     )
   }
 
@@ -190,27 +116,12 @@ private class GuardConditionFromBinaryLogicalOperator extends GuardCondition {
     )
   }
 
-  override predicate comparesLt(Expr e, int k, boolean isLessThan, AbstractValue value) {
-    exists(BooleanValue partValue, GuardCondition part |
-      this.(BinaryLogicalOperation)
-          .impliesValue(part, partValue.getValue(), value.(BooleanValue).getValue())
-    |
-      part.comparesLt(e, k, isLessThan, partValue)
-    )
-  }
-
   override predicate ensuresLt(Expr left, Expr right, int k, BasicBlock block, boolean isLessThan) {
     exists(boolean testIsTrue |
       this.comparesLt(left, right, k, isLessThan, testIsTrue) and this.controls(block, testIsTrue)
     )
   }
 
-  override predicate ensuresLt(Expr e, int k, BasicBlock block, boolean isLessThan) {
-    exists(AbstractValue value |
-      this.comparesLt(e, k, isLessThan, value) and this.valueControls(block, value)
-    )
-  }
-
   override predicate comparesEq(Expr left, Expr right, int k, boolean areEqual, boolean testIsTrue) {
     exists(boolean partIsTrue, GuardCondition part |
       this.(BinaryLogicalOperation).impliesValue(part, partIsTrue, testIsTrue)
@@ -224,21 +135,6 @@ private class GuardConditionFromBinaryLogicalOperator extends GuardCondition {
       this.comparesEq(left, right, k, areEqual, testIsTrue) and this.controls(block, testIsTrue)
     )
   }
-
-  override predicate comparesEq(Expr e, int k, boolean areEqual, AbstractValue value) {
-    exists(BooleanValue partValue, GuardCondition part |
-      this.(BinaryLogicalOperation)
-          .impliesValue(part, partValue.getValue(), value.(BooleanValue).getValue())
-    |
-      part.comparesEq(e, k, areEqual, partValue)
-    )
-  }
-
-  override predicate ensuresEq(Expr e, int k, BasicBlock block, boolean areEqual) {
-    exists(AbstractValue value |
-      this.comparesEq(e, k, areEqual, value) and this.valueControls(block, value)
-    )
-  }
 }
 
 /**
@@ -250,12 +146,13 @@ private class GuardConditionFromIR extends GuardCondition {
 
   GuardConditionFromIR() { this = ir.getUnconvertedResultExpression() }
 
-  override predicate valueControls(BasicBlock controlled, AbstractValue v) {
+  override predicate controls(BasicBlock controlled, boolean testIsTrue) {
     // This condition must determine the flow of control; that is, this
     // node must be a top-level condition.
-    this.controlsBlock(controlled, v)
+    this.controlsBlock(controlled, testIsTrue)
   }
 
+  /** Holds if (determined by this guard) `left < right + k` evaluates to `isLessThan` if this expression evaluates to `testIsTrue`. */
   override predicate comparesLt(Expr left, Expr right, int k, boolean isLessThan, boolean testIsTrue) {
     exists(Instruction li, Instruction ri |
       li.getUnconvertedResultExpression() = left and
@@ -264,13 +161,10 @@ private class GuardConditionFromIR extends GuardCondition {
     )
   }
 
-  override predicate comparesLt(Expr e, int k, boolean isLessThan, AbstractValue value) {
-    exists(Instruction i |
-      i.getUnconvertedResultExpression() = e and
-      ir.comparesLt(i.getAUse(), k, isLessThan, value)
-    )
-  }
-
+  /**
+   * Holds if (determined by this guard) `left < right + k` must be `isLessThan` in `block`.
+   * If `isLessThan = false` then this implies `left >= right + k`.
+   */
   override predicate ensuresLt(Expr left, Expr right, int k, BasicBlock block, boolean isLessThan) {
     exists(Instruction li, Instruction ri, boolean testIsTrue |
       li.getUnconvertedResultExpression() = left and
@@ -280,14 +174,7 @@ private class GuardConditionFromIR extends GuardCondition {
     )
   }
 
-  override predicate ensuresLt(Expr e, int k, BasicBlock block, boolean isLessThan) {
-    exists(Instruction i, AbstractValue value |
-      i.getUnconvertedResultExpression() = e and
-      ir.comparesLt(i.getAUse(), k, isLessThan, value) and
-      this.valueControls(block, value)
-    )
-  }
-
+  /** Holds if (determined by this guard) `left == right + k` evaluates to `areEqual` if this expression evaluates to `testIsTrue`. */
   override predicate comparesEq(Expr left, Expr right, int k, boolean areEqual, boolean testIsTrue) {
     exists(Instruction li, Instruction ri |
       li.getUnconvertedResultExpression() = left and
@@ -296,6 +183,10 @@ private class GuardConditionFromIR extends GuardCondition {
     )
   }
 
+  /**
+   * Holds if (determined by this guard) `left == right + k` must be `areEqual` in `block`.
+   * If `areEqual = false` then this implies `left != right + k`.
+   */
   override predicate ensuresEq(Expr left, Expr right, int k, BasicBlock block, boolean areEqual) {
     exists(Instruction li, Instruction ri, boolean testIsTrue |
       li.getUnconvertedResultExpression() = left and
@@ -305,30 +196,15 @@ private class GuardConditionFromIR extends GuardCondition {
     )
   }
 
-  override predicate comparesEq(Expr e, int k, boolean areEqual, AbstractValue value) {
-    exists(Instruction i |
-      i.getUnconvertedResultExpression() = e and
-      ir.comparesEq(i.getAUse(), k, areEqual, value)
-    )
-  }
-
-  override predicate ensuresEq(Expr e, int k, BasicBlock block, boolean areEqual) {
-    exists(Instruction i, AbstractValue value |
-      i.getUnconvertedResultExpression() = e and
-      ir.comparesEq(i.getAUse(), k, areEqual, value) and
-      this.valueControls(block, value)
-    )
-  }
-
   /**
    * Holds if this condition controls `block`, meaning that `block` is only
-   * entered if the value of this condition is `v`. This helper
+   * entered if the value of this condition is `testIsTrue`. This helper
    * predicate does not necessarily hold for binary logical operations like
    * `&&` and `||`. See the detailed explanation on predicate `controls`.
    */
-  private predicate controlsBlock(BasicBlock controlled, AbstractValue v) {
+  private predicate controlsBlock(BasicBlock controlled, boolean testIsTrue) {
     exists(IRBlock irb |
-      ir.valueControls(irb, v) and
+      ir.controls(irb, testIsTrue) and
       nonExcludedIRAndBasicBlock(irb, controlled) and
       not isUnreachedBlock(irb)
     )
@@ -373,28 +249,10 @@ private predicate nonExcludedIRAndBasicBlock(IRBlock irb, BasicBlock controlled)
  */
 cached
 class IRGuardCondition extends Instruction {
-  Instruction branch;
+  ConditionalBranchInstruction branch;
 
   cached
-  IRGuardCondition() { branch = getBranchForCondition(this) }
-
-  /**
-   * Holds if this condition controls `controlled`, meaning that `controlled` is only
-   * entered if the value of this condition is `v`.
-   *
-   * For details on what "controls" mean, see the QLDoc for `controls`.
-   */
-  cached
-  predicate valueControls(IRBlock controlled, AbstractValue v) {
-    // This condition must determine the flow of control; that is, this
-    // node must be a top-level condition.
-    this.controlsBlock(controlled, v)
-    or
-    exists(IRGuardCondition ne |
-      this = ne.(LogicalNotInstruction).getUnary() and
-      ne.valueControls(controlled, v.getDualValue())
-    )
-  }
+  IRGuardCondition() { branch = get_branch_for_condition(this) }
 
   /**
    * Holds if this condition controls `controlled`, meaning that `controlled` is only
@@ -424,25 +282,13 @@ class IRGuardCondition extends Instruction {
    */
   cached
   predicate controls(IRBlock controlled, boolean testIsTrue) {
-    this.valueControls(controlled, any(BooleanValue bv | bv.getValue() = testIsTrue))
-  }
-
-  /**
-   * Holds if the control-flow edge `(pred, succ)` may be taken only if
-   * the value of this condition is `v`.
-   */
-  cached
-  predicate valueControlsEdge(IRBlock pred, IRBlock succ, AbstractValue v) {
-    pred.getASuccessor() = succ and
-    this.valueControls(pred, v)
+    // This condition must determine the flow of control; that is, this
+    // node must be a top-level condition.
+    this.controlsBlock(controlled, testIsTrue)
     or
-    succ = this.getBranchSuccessor(v) and
-    (
-      branch.(ConditionalBranchInstruction).getCondition() = this and
-      branch.getBlock() = pred
-      or
-      branch.(SwitchInstruction).getExpression() = this and
-      branch.getBlock() = pred
+    exists(IRGuardCondition ne |
+      this = ne.(LogicalNotInstruction).getUnary() and
+      ne.controls(controlled, testIsTrue.booleanNot())
     )
   }
 
@@ -451,12 +297,17 @@ class IRGuardCondition extends Instruction {
    * the value of this condition is `testIsTrue`.
    */
   cached
-  final predicate controlsEdge(IRBlock pred, IRBlock succ, boolean testIsTrue) {
-    this.valueControlsEdge(pred, succ, any(BooleanValue bv | bv.getValue() = testIsTrue))
+  predicate controlsEdge(IRBlock pred, IRBlock succ, boolean testIsTrue) {
+    pred.getASuccessor() = succ and
+    this.controls(pred, testIsTrue)
+    or
+    succ = this.getBranchSuccessor(testIsTrue) and
+    branch.getCondition() = this and
+    branch.getBlock() = pred
   }
 
   /**
-   * Gets the block to which `branch` jumps directly when the value of this condition is `v`.
+   * Gets the block to which `branch` jumps directly when this condition is `testIsTrue`.
    *
    * This predicate is intended to help with situations in which an inference can only be made
    * based on an edge between a block with multiple successors and a block with multiple
@@ -470,39 +321,21 @@ class IRGuardCondition extends Instruction {
    * return x;
    * ```
    */
-  private IRBlock getBranchSuccessor(AbstractValue v) {
-    branch.(ConditionalBranchInstruction).getCondition() = this and
-    exists(BooleanValue bv | bv = v |
-      bv.getValue() = true and
-      result.getFirstInstruction() = branch.(ConditionalBranchInstruction).getTrueSuccessor()
+  private IRBlock getBranchSuccessor(boolean testIsTrue) {
+    branch.getCondition() = this and
+    (
+      testIsTrue = true and
+      result.getFirstInstruction() = branch.getTrueSuccessor()
       or
-      bv.getValue() = false and
-      result.getFirstInstruction() = branch.(ConditionalBranchInstruction).getFalseSuccessor()
-    )
-    or
-    exists(SwitchInstruction switch, CaseEdge kind | switch = branch |
-      switch.getExpression() = this and
-      result.getFirstInstruction() = switch.getSuccessor(kind) and
-      kind = v.(MatchValue).getCase()
+      testIsTrue = false and
+      result.getFirstInstruction() = branch.getFalseSuccessor()
     )
   }
 
   /** Holds if (determined by this guard) `left < right + k` evaluates to `isLessThan` if this expression evaluates to `testIsTrue`. */
   cached
   predicate comparesLt(Operand left, Operand right, int k, boolean isLessThan, boolean testIsTrue) {
-    exists(BooleanValue value |
-      compares_lt(this, left, right, k, isLessThan, value) and
-      value.getValue() = testIsTrue
-    )
-  }
-
-  /**
-   * Holds if (determined by this guard) `op < k` evaluates to `isLessThan` if
-   * this expression evaluates to `value`.
-   */
-  cached
-  predicate comparesLt(Operand op, int k, boolean isLessThan, AbstractValue value) {
-    compares_lt(this, op, k, isLessThan, value)
+    compares_lt(this, left, right, k, isLessThan, testIsTrue)
   }
 
   /**
@@ -511,19 +344,8 @@ class IRGuardCondition extends Instruction {
    */
   cached
   predicate ensuresLt(Operand left, Operand right, int k, IRBlock block, boolean isLessThan) {
-    exists(AbstractValue value |
-      compares_lt(this, left, right, k, isLessThan, value) and this.valueControls(block, value)
-    )
-  }
-
-  /**
-   * Holds if (determined by this guard) `op < k` must be `isLessThan` in `block`.
-   * If `isLessThan = false` then this implies `op >= k`.
-   */
-  cached
-  predicate ensuresLt(Operand op, int k, IRBlock block, boolean isLessThan) {
-    exists(AbstractValue value |
-      compares_lt(this, op, k, isLessThan, value) and this.valueControls(block, value)
+    exists(boolean testIsTrue |
+      compares_lt(this, left, right, k, isLessThan, testIsTrue) and this.controls(block, testIsTrue)
     )
   }
 
@@ -535,37 +357,16 @@ class IRGuardCondition extends Instruction {
   predicate ensuresLtEdge(
     Operand left, Operand right, int k, IRBlock pred, IRBlock succ, boolean isLessThan
   ) {
-    exists(AbstractValue value |
-      compares_lt(this, left, right, k, isLessThan, value) and
-      this.valueControlsEdge(pred, succ, value)
-    )
-  }
-
-  /**
-   * Holds if (determined by this guard) `op < k` must be `isLessThan` on the edge from
-   * `pred` to `succ`. If `isLessThan = false` then this implies `op >= k`.
-   */
-  cached
-  predicate ensuresLtEdge(Operand left, int k, IRBlock pred, IRBlock succ, boolean isLessThan) {
-    exists(AbstractValue value |
-      compares_lt(this, left, k, isLessThan, value) and
-      this.valueControlsEdge(pred, succ, value)
+    exists(boolean testIsTrue |
+      compares_lt(this, left, right, k, isLessThan, testIsTrue) and
+      this.controlsEdge(pred, succ, testIsTrue)
     )
   }
 
   /** Holds if (determined by this guard) `left == right + k` evaluates to `areEqual` if this expression evaluates to `testIsTrue`. */
   cached
   predicate comparesEq(Operand left, Operand right, int k, boolean areEqual, boolean testIsTrue) {
-    exists(BooleanValue value |
-      compares_eq(this, left, right, k, areEqual, value) and
-      value.getValue() = testIsTrue
-    )
-  }
-
-  /** Holds if (determined by this guard) `op == k` evaluates to `areEqual` if this expression evaluates to `value`. */
-  cached
-  predicate comparesEq(Operand op, int k, boolean areEqual, AbstractValue value) {
-    compares_eq(this, op, k, areEqual, value)
+    compares_eq(this, left, right, k, areEqual, testIsTrue)
   }
 
   /**
@@ -574,19 +375,8 @@ class IRGuardCondition extends Instruction {
    */
   cached
   predicate ensuresEq(Operand left, Operand right, int k, IRBlock block, boolean areEqual) {
-    exists(AbstractValue value |
-      compares_eq(this, left, right, k, areEqual, value) and this.valueControls(block, value)
-    )
-  }
-
-  /**
-   * Holds if (determined by this guard) `op == k` must be `areEqual` in `block`.
-   * If `areEqual = false` then this implies `op != k`.
-   */
-  cached
-  predicate ensuresEq(Operand op, int k, IRBlock block, boolean areEqual) {
-    exists(AbstractValue value |
-      compares_eq(this, op, k, areEqual, value) and this.valueControls(block, value)
+    exists(boolean testIsTrue |
+      compares_eq(this, left, right, k, areEqual, testIsTrue) and this.controls(block, testIsTrue)
     )
   }
 
@@ -598,31 +388,19 @@ class IRGuardCondition extends Instruction {
   predicate ensuresEqEdge(
     Operand left, Operand right, int k, IRBlock pred, IRBlock succ, boolean areEqual
   ) {
-    exists(AbstractValue value |
-      compares_eq(this, left, right, k, areEqual, value) and
-      this.valueControlsEdge(pred, succ, value)
-    )
-  }
-
-  /**
-   * Holds if (determined by this guard) `op == k` must be `areEqual` on the edge from
-   * `pred` to `succ`. If `areEqual = false` then this implies `op != k`.
-   */
-  cached
-  predicate ensuresEqEdge(Operand op, int k, IRBlock pred, IRBlock succ, boolean areEqual) {
-    exists(AbstractValue value |
-      compares_eq(this, op, k, areEqual, value) and
-      this.valueControlsEdge(pred, succ, value)
+    exists(boolean testIsTrue |
+      compares_eq(this, left, right, k, areEqual, testIsTrue) and
+      this.controlsEdge(pred, succ, testIsTrue)
     )
   }
 
   /**
    * Holds if this condition controls `block`, meaning that `block` is only
-   * entered if the value of this condition is `v`. This helper
+   * entered if the value of this condition is `testIsTrue`. This helper
    * predicate does not necessarily hold for binary logical operations like
    * `&&` and `||`. See the detailed explanation on predicate `controls`.
    */
-  private predicate controlsBlock(IRBlock controlled, AbstractValue v) {
+  private predicate controlsBlock(IRBlock controlled, boolean testIsTrue) {
     not isUnreachedBlock(controlled) and
     //
     // For this block to control the block `controlled` with `testIsTrue` the
@@ -663,7 +441,7 @@ class IRGuardCondition extends Instruction {
     // that `this` strictly dominates `controlled` so that isn't necessary to check
     // directly.
     exists(IRBlock succ |
-      succ = this.getBranchSuccessor(v) and
+      succ = this.getBranchSuccessor(testIsTrue) and
       this.hasDominatingEdgeTo(succ) and
       succ.dominates(controlled)
     )
@@ -698,14 +476,12 @@ class IRGuardCondition extends Instruction {
   private IRBlock getBranchBlock() { result = branch.getBlock() }
 }
 
-private Instruction getBranchForCondition(Instruction guard) {
-  result.(ConditionalBranchInstruction).getCondition() = guard
+private ConditionalBranchInstruction get_branch_for_condition(Instruction guard) {
+  result.getCondition() = guard
   or
   exists(LogicalNotInstruction cond |
-    result = getBranchForCondition(cond) and cond.getUnary() = guard
+    result = get_branch_for_condition(cond) and cond.getUnary() = guard
   )
-  or
-  result.(SwitchInstruction).getExpression() = guard
 }
 
 /**
@@ -714,98 +490,52 @@ private Instruction getBranchForCondition(Instruction guard) {
  * Beware making mistaken logical implications here relating `areEqual` and `testIsTrue`.
  */
 private predicate compares_eq(
-  Instruction test, Operand left, Operand right, int k, boolean areEqual, AbstractValue value
+  Instruction test, Operand left, Operand right, int k, boolean areEqual, boolean testIsTrue
 ) {
   /* The simple case where the test *is* the comparison so areEqual = testIsTrue xor eq. */
-  exists(AbstractValue v | simple_comparison_eq(test, left, right, k, v) |
-    areEqual = true and value = v
+  exists(boolean eq | simple_comparison_eq(test, left, right, k, eq) |
+    areEqual = true and testIsTrue = eq
     or
-    areEqual = false and value = v.getDualValue()
+    areEqual = false and testIsTrue = eq.booleanNot()
   )
   or
   // I think this is handled by forwarding in controlsBlock.
   //or
   //logical_comparison_eq(test, left, right, k, areEqual, testIsTrue)
   /* a == b + k => b == a - k */
-  exists(int mk | k = -mk | compares_eq(test, right, left, mk, areEqual, value))
+  exists(int mk | k = -mk | compares_eq(test, right, left, mk, areEqual, testIsTrue))
   or
-  complex_eq(test, left, right, k, areEqual, value)
+  complex_eq(test, left, right, k, areEqual, testIsTrue)
   or
   /* (x is true => (left == right + k)) => (!x is false => (left == right + k)) */
-  exists(AbstractValue dual | value = dual.getDualValue() |
-    compares_eq(test.(LogicalNotInstruction).getUnary(), left, right, k, areEqual, dual)
-  )
-}
-
-/** Holds if `op == k` is `areEqual` given that `test` is equal to `value`. */
-private predicate compares_eq(
-  Instruction test, Operand op, int k, boolean areEqual, AbstractValue value
-) {
-  /* The simple case where the test *is* the comparison so areEqual = testIsTrue xor eq. */
-  exists(AbstractValue v | simple_comparison_eq(test, op, k, v) |
-    areEqual = true and value = v
-    or
-    areEqual = false and value = v.getDualValue()
-  )
-  or
-  complex_eq(test, op, k, areEqual, value)
-  or
-  /* (x is true => (op == k)) => (!x is false => (op == k)) */
-  exists(AbstractValue dual | value = dual.getDualValue() |
-    compares_eq(test.(LogicalNotInstruction).getUnary(), op, k, areEqual, dual)
-  )
-  or
-  // ((test is `areEqual` => op == const + k2) and const == `k1`) =>
-  // test is `areEqual` => op == k1 + k2
-  exists(int k1, int k2, ConstantInstruction const |
-    compares_eq(test, op, const.getAUse(), k2, areEqual, value) and
-    int_value(const) = k1 and
-    k = k1 + k2
+  exists(boolean isFalse | testIsTrue = isFalse.booleanNot() |
+    compares_eq(test.(LogicalNotInstruction).getUnary(), left, right, k, areEqual, isFalse)
   )
 }
 
 /** Rearrange various simple comparisons into `left == right + k` form. */
 private predicate simple_comparison_eq(
-  CompareInstruction cmp, Operand left, Operand right, int k, AbstractValue value
+  CompareInstruction cmp, Operand left, Operand right, int k, boolean areEqual
 ) {
   left = cmp.getLeftOperand() and
   cmp instanceof CompareEQInstruction and
   right = cmp.getRightOperand() and
   k = 0 and
-  value.(BooleanValue).getValue() = true
+  areEqual = true
   or
   left = cmp.getLeftOperand() and
   cmp instanceof CompareNEInstruction and
   right = cmp.getRightOperand() and
   k = 0 and
-  value.(BooleanValue).getValue() = false
-}
-
-/** Rearrange various simple comparisons into `op == k` form. */
-private predicate simple_comparison_eq(Instruction test, Operand op, int k, AbstractValue value) {
-  exists(SwitchInstruction switch, CaseEdge case |
-    test = switch.getExpression() and
-    op.getDef() = test and
-    case = value.(MatchValue).getCase() and
-    exists(switch.getSuccessor(case)) and
-    case.getValue().toInt() = k
-  )
+  areEqual = false
 }
 
 private predicate complex_eq(
-  CompareInstruction cmp, Operand left, Operand right, int k, boolean areEqual, AbstractValue value
+  CompareInstruction cmp, Operand left, Operand right, int k, boolean areEqual, boolean testIsTrue
 ) {
-  sub_eq(cmp, left, right, k, areEqual, value)
+  sub_eq(cmp, left, right, k, areEqual, testIsTrue)
   or
-  add_eq(cmp, left, right, k, areEqual, value)
-}
-
-private predicate complex_eq(
-  Instruction test, Operand op, int k, boolean areEqual, AbstractValue value
-) {
-  sub_eq(test, op, k, areEqual, value)
-  or
-  add_eq(test, op, k, areEqual, value)
+  add_eq(cmp, left, right, k, areEqual, testIsTrue)
 }
 
 /*
@@ -815,46 +545,31 @@ private predicate complex_eq(
 
 /** Holds if `left < right + k` evaluates to `isLt` given that test is `testIsTrue`. */
 private predicate compares_lt(
-  Instruction test, Operand left, Operand right, int k, boolean isLt, AbstractValue value
+  Instruction test, Operand left, Operand right, int k, boolean isLt, boolean testIsTrue
 ) {
   /* In the simple case, the test is the comparison, so isLt = testIsTrue */
-  simple_comparison_lt(test, left, right, k) and
-  value.(BooleanValue).getValue() = isLt
+  simple_comparison_lt(test, left, right, k) and isLt = true and testIsTrue = true
   or
-  complex_lt(test, left, right, k, isLt, value)
+  simple_comparison_lt(test, left, right, k) and isLt = false and testIsTrue = false
+  or
+  complex_lt(test, left, right, k, isLt, testIsTrue)
   or
   /* (not (left < right + k)) => (left >= right + k) */
-  exists(boolean isGe | isLt = isGe.booleanNot() | compares_ge(test, left, right, k, isGe, value))
+  exists(boolean isGe | isLt = isGe.booleanNot() |
+    compares_ge(test, left, right, k, isGe, testIsTrue)
+  )
   or
   /* (x is true => (left < right + k)) => (!x is false => (left < right + k)) */
-  exists(AbstractValue dual | value = dual.getDualValue() |
-    compares_lt(test.(LogicalNotInstruction).getUnary(), left, right, k, isLt, dual)
-  )
-}
-
-/** Holds if `op < k` evaluates to `isLt` given that `test` evaluates to `value`. */
-private predicate compares_lt(Instruction test, Operand op, int k, boolean isLt, AbstractValue value) {
-  simple_comparison_lt(test, op, k, isLt, value)
-  or
-  complex_lt(test, op, k, isLt, value)
-  or
-  /* (x is true => (op < k)) => (!x is false => (op < k)) */
-  exists(AbstractValue dual | value = dual.getDualValue() |
-    compares_lt(test.(LogicalNotInstruction).getUnary(), op, k, isLt, dual)
-  )
-  or
-  exists(int k1, int k2, ConstantInstruction const |
-    compares_lt(test, op, const.getAUse(), k2, isLt, value) and
-    int_value(const) = k1 and
-    k = k1 + k2
+  exists(boolean isFalse | testIsTrue = isFalse.booleanNot() |
+    compares_lt(test.(LogicalNotInstruction).getUnary(), left, right, k, isLt, isFalse)
   )
 }
 
 /** `(a < b + k) => (b > a - k) => (b >= a + (1-k))` */
 private predicate compares_ge(
-  Instruction test, Operand left, Operand right, int k, boolean isGe, AbstractValue value
+  Instruction test, Operand left, Operand right, int k, boolean isGe, boolean testIsTrue
 ) {
-  exists(int onemk | k = 1 - onemk | compares_lt(test, right, left, onemk, isGe, value))
+  exists(int onemk | k = 1 - onemk | compares_lt(test, right, left, onemk, isGe, testIsTrue))
 }
 
 /** Rearrange various simple comparisons into `left < right + k` form. */
@@ -880,99 +595,55 @@ private predicate simple_comparison_lt(CompareInstruction cmp, Operand left, Ope
   k = 1
 }
 
-/** Rearrange various simple comparisons into `op < k` form. */
-private predicate simple_comparison_lt(
-  Instruction test, Operand op, int k, boolean isLt, AbstractValue value
-) {
-  exists(SwitchInstruction switch, CaseEdge case |
-    test = switch.getExpression() and
-    op.getDef() = test and
-    case = value.(MatchValue).getCase() and
-    exists(switch.getSuccessor(case)) and
-    case.getMaxValue() > case.getMinValue()
-  |
-    // op <= k => op < k - 1
-    isLt = true and
-    case.getMaxValue().toInt() = k - 1
-    or
-    isLt = false and
-    case.getMinValue().toInt() = k
-  )
-}
-
 private predicate complex_lt(
-  CompareInstruction cmp, Operand left, Operand right, int k, boolean isLt, AbstractValue value
+  CompareInstruction cmp, Operand left, Operand right, int k, boolean isLt, boolean testIsTrue
 ) {
-  sub_lt(cmp, left, right, k, isLt, value)
+  sub_lt(cmp, left, right, k, isLt, testIsTrue)
   or
-  add_lt(cmp, left, right, k, isLt, value)
-}
-
-private predicate complex_lt(
-  Instruction test, Operand left, int k, boolean isLt, AbstractValue value
-) {
-  sub_lt(test, left, k, isLt, value)
-  or
-  add_lt(test, left, k, isLt, value)
+  add_lt(cmp, left, right, k, isLt, testIsTrue)
 }
 
 // left - x < right + c => left < right + (c+x)
 // left < (right - x) + c => left < right + (c-x)
 private predicate sub_lt(
-  CompareInstruction cmp, Operand left, Operand right, int k, boolean isLt, AbstractValue value
+  CompareInstruction cmp, Operand left, Operand right, int k, boolean isLt, boolean testIsTrue
 ) {
   exists(SubInstruction lhs, int c, int x |
-    compares_lt(cmp, lhs.getAUse(), right, c, isLt, value) and
+    compares_lt(cmp, lhs.getAUse(), right, c, isLt, testIsTrue) and
     left = lhs.getLeftOperand() and
     x = int_value(lhs.getRight()) and
     k = c + x
   )
   or
   exists(SubInstruction rhs, int c, int x |
-    compares_lt(cmp, left, rhs.getAUse(), c, isLt, value) and
+    compares_lt(cmp, left, rhs.getAUse(), c, isLt, testIsTrue) and
     right = rhs.getLeftOperand() and
     x = int_value(rhs.getRight()) and
     k = c - x
   )
   or
   exists(PointerSubInstruction lhs, int c, int x |
-    compares_lt(cmp, lhs.getAUse(), right, c, isLt, value) and
+    compares_lt(cmp, lhs.getAUse(), right, c, isLt, testIsTrue) and
     left = lhs.getLeftOperand() and
     x = int_value(lhs.getRight()) and
     k = c + x
   )
   or
   exists(PointerSubInstruction rhs, int c, int x |
-    compares_lt(cmp, left, rhs.getAUse(), c, isLt, value) and
+    compares_lt(cmp, left, rhs.getAUse(), c, isLt, testIsTrue) and
     right = rhs.getLeftOperand() and
     x = int_value(rhs.getRight()) and
     k = c - x
   )
 }
 
-private predicate sub_lt(Instruction test, Operand left, int k, boolean isLt, AbstractValue value) {
-  exists(SubInstruction lhs, int c, int x |
-    compares_lt(test, lhs.getAUse(), c, isLt, value) and
-    left = lhs.getLeftOperand() and
-    x = int_value(lhs.getRight()) and
-    k = c + x
-  )
-  or
-  exists(PointerSubInstruction lhs, int c, int x |
-    compares_lt(test, lhs.getAUse(), c, isLt, value) and
-    left = lhs.getLeftOperand() and
-    x = int_value(lhs.getRight()) and
-    k = c + x
-  )
-}
-
 // left + x < right + c => left < right + (c-x)
 // left < (right + x) + c => left < right + (c+x)
 private predicate add_lt(
-  CompareInstruction cmp, Operand left, Operand right, int k, boolean isLt, AbstractValue value
+  CompareInstruction cmp, Operand left, Operand right, int k, boolean isLt, boolean testIsTrue
 ) {
   exists(AddInstruction lhs, int c, int x |
-    compares_lt(cmp, lhs.getAUse(), right, c, isLt, value) and
+    compares_lt(cmp, lhs.getAUse(), right, c, isLt, testIsTrue) and
     (
       left = lhs.getLeftOperand() and x = int_value(lhs.getRight())
       or
@@ -982,7 +653,7 @@ private predicate add_lt(
   )
   or
   exists(AddInstruction rhs, int c, int x |
-    compares_lt(cmp, left, rhs.getAUse(), c, isLt, value) and
+    compares_lt(cmp, left, rhs.getAUse(), c, isLt, testIsTrue) and
     (
       right = rhs.getLeftOperand() and x = int_value(rhs.getRight())
       or
@@ -992,7 +663,7 @@ private predicate add_lt(
   )
   or
   exists(PointerAddInstruction lhs, int c, int x |
-    compares_lt(cmp, lhs.getAUse(), right, c, isLt, value) and
+    compares_lt(cmp, lhs.getAUse(), right, c, isLt, testIsTrue) and
     (
       left = lhs.getLeftOperand() and x = int_value(lhs.getRight())
       or
@@ -1002,7 +673,7 @@ private predicate add_lt(
   )
   or
   exists(PointerAddInstruction rhs, int c, int x |
-    compares_lt(cmp, left, rhs.getAUse(), c, isLt, value) and
+    compares_lt(cmp, left, rhs.getAUse(), c, isLt, testIsTrue) and
     (
       right = rhs.getLeftOperand() and x = int_value(rhs.getRight())
       or
@@ -1012,86 +683,47 @@ private predicate add_lt(
   )
 }
 
-private predicate add_lt(Instruction test, Operand left, int k, boolean isLt, AbstractValue value) {
-  exists(AddInstruction lhs, int c, int x |
-    compares_lt(test, lhs.getAUse(), c, isLt, value) and
-    (
-      left = lhs.getLeftOperand() and x = int_value(lhs.getRight())
-      or
-      left = lhs.getRightOperand() and x = int_value(lhs.getLeft())
-    ) and
-    k = c - x
-  )
-  or
-  exists(PointerAddInstruction lhs, int c, int x |
-    compares_lt(test, lhs.getAUse(), c, isLt, value) and
-    (
-      left = lhs.getLeftOperand() and x = int_value(lhs.getRight())
-      or
-      left = lhs.getRightOperand() and x = int_value(lhs.getLeft())
-    ) and
-    k = c - x
-  )
-}
-
 // left - x == right + c => left == right + (c+x)
 // left == (right - x) + c => left == right + (c-x)
 private predicate sub_eq(
-  CompareInstruction cmp, Operand left, Operand right, int k, boolean areEqual, AbstractValue value
+  CompareInstruction cmp, Operand left, Operand right, int k, boolean areEqual, boolean testIsTrue
 ) {
   exists(SubInstruction lhs, int c, int x |
-    compares_eq(cmp, lhs.getAUse(), right, c, areEqual, value) and
+    compares_eq(cmp, lhs.getAUse(), right, c, areEqual, testIsTrue) and
     left = lhs.getLeftOperand() and
     x = int_value(lhs.getRight()) and
     k = c + x
   )
   or
   exists(SubInstruction rhs, int c, int x |
-    compares_eq(cmp, left, rhs.getAUse(), c, areEqual, value) and
+    compares_eq(cmp, left, rhs.getAUse(), c, areEqual, testIsTrue) and
     right = rhs.getLeftOperand() and
     x = int_value(rhs.getRight()) and
     k = c - x
   )
   or
   exists(PointerSubInstruction lhs, int c, int x |
-    compares_eq(cmp, lhs.getAUse(), right, c, areEqual, value) and
+    compares_eq(cmp, lhs.getAUse(), right, c, areEqual, testIsTrue) and
     left = lhs.getLeftOperand() and
     x = int_value(lhs.getRight()) and
     k = c + x
   )
   or
   exists(PointerSubInstruction rhs, int c, int x |
-    compares_eq(cmp, left, rhs.getAUse(), c, areEqual, value) and
+    compares_eq(cmp, left, rhs.getAUse(), c, areEqual, testIsTrue) and
     right = rhs.getLeftOperand() and
     x = int_value(rhs.getRight()) and
     k = c - x
   )
 }
 
-// op - x == c => op == (c+x)
-private predicate sub_eq(Instruction test, Operand op, int k, boolean areEqual, AbstractValue value) {
-  exists(SubInstruction sub, int c, int x |
-    compares_eq(test, sub.getAUse(), c, areEqual, value) and
-    op = sub.getLeftOperand() and
-    x = int_value(sub.getRight()) and
-    k = c + x
-  )
-  or
-  exists(PointerSubInstruction sub, int c, int x |
-    compares_eq(test, sub.getAUse(), c, areEqual, value) and
-    op = sub.getLeftOperand() and
-    x = int_value(sub.getRight()) and
-    k = c + x
-  )
-}
-
 // left + x == right + c => left == right + (c-x)
 // left == (right + x) + c => left == right + (c+x)
 private predicate add_eq(
-  CompareInstruction cmp, Operand left, Operand right, int k, boolean areEqual, AbstractValue value
+  CompareInstruction cmp, Operand left, Operand right, int k, boolean areEqual, boolean testIsTrue
 ) {
   exists(AddInstruction lhs, int c, int x |
-    compares_eq(cmp, lhs.getAUse(), right, c, areEqual, value) and
+    compares_eq(cmp, lhs.getAUse(), right, c, areEqual, testIsTrue) and
     (
       left = lhs.getLeftOperand() and x = int_value(lhs.getRight())
       or
@@ -1101,7 +733,7 @@ private predicate add_eq(
   )
   or
   exists(AddInstruction rhs, int c, int x |
-    compares_eq(cmp, left, rhs.getAUse(), c, areEqual, value) and
+    compares_eq(cmp, left, rhs.getAUse(), c, areEqual, testIsTrue) and
     (
       right = rhs.getLeftOperand() and x = int_value(rhs.getRight())
       or
@@ -1111,7 +743,7 @@ private predicate add_eq(
   )
   or
   exists(PointerAddInstruction lhs, int c, int x |
-    compares_eq(cmp, lhs.getAUse(), right, c, areEqual, value) and
+    compares_eq(cmp, lhs.getAUse(), right, c, areEqual, testIsTrue) and
     (
       left = lhs.getLeftOperand() and x = int_value(lhs.getRight())
       or
@@ -1121,7 +753,7 @@ private predicate add_eq(
   )
   or
   exists(PointerAddInstruction rhs, int c, int x |
-    compares_eq(cmp, left, rhs.getAUse(), c, areEqual, value) and
+    compares_eq(cmp, left, rhs.getAUse(), c, areEqual, testIsTrue) and
     (
       right = rhs.getLeftOperand() and x = int_value(rhs.getRight())
       or
@@ -1131,30 +763,5 @@ private predicate add_eq(
   )
 }
 
-// left + x == right + c => left == right + (c-x)
-private predicate add_eq(
-  Instruction test, Operand left, int k, boolean areEqual, AbstractValue value
-) {
-  exists(AddInstruction lhs, int c, int x |
-    compares_eq(test, lhs.getAUse(), c, areEqual, value) and
-    (
-      left = lhs.getLeftOperand() and x = int_value(lhs.getRight())
-      or
-      left = lhs.getRightOperand() and x = int_value(lhs.getLeft())
-    ) and
-    k = c - x
-  )
-  or
-  exists(PointerAddInstruction lhs, int c, int x |
-    compares_eq(test, lhs.getAUse(), c, areEqual, value) and
-    (
-      left = lhs.getLeftOperand() and x = int_value(lhs.getRight())
-      or
-      left = lhs.getRightOperand() and x = int_value(lhs.getLeft())
-    ) and
-    k = c - x
-  )
-}
-
 /** The int value of integer constant expression. */
 private int int_value(Instruction i) { result = i.(IntegerConstantInstruction).getValue().toInt() }

cpp/ql/lib/semmle/code/cpp/dataflow/DataFlow.qll

@@ -28,6 +28,6 @@ import cpp
 deprecated module DataFlow {
   private import semmle.code.cpp.dataflow.internal.DataFlowImplSpecific
   private import codeql.dataflow.DataFlow
-  import DataFlowMake<Location, CppOldDataFlow>
+  import DataFlowMake<CppOldDataFlow>
   import semmle.code.cpp.dataflow.internal.DataFlowImpl1
 }

cpp/ql/lib/semmle/code/cpp/dataflow/TaintTracking.qll

@@ -29,6 +29,6 @@ deprecated module TaintTracking {
   private import semmle.code.cpp.dataflow.internal.DataFlowImplSpecific
   private import semmle.code.cpp.dataflow.internal.TaintTrackingImplSpecific
   private import codeql.dataflow.TaintTracking
-  import TaintFlowMake<Location, CppOldDataFlow, CppOldTaintTracking>
+  import TaintFlowMake<CppOldDataFlow, CppOldTaintTracking>
   import semmle.code.cpp.dataflow.internal.tainttracking1.TaintTrackingImpl
 }

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll

@@ -2,7 +2,6 @@
  * DEPRECATED: Use `semmle.code.cpp.dataflow.new.DataFlow` instead.
  */
 
-private import semmle.code.cpp.Location
 private import DataFlowImplSpecific
 private import codeql.dataflow.internal.DataFlowImpl
-import MakeImpl<Location, CppOldDataFlow>
+import MakeImpl<CppOldDataFlow>

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl1.qll

@@ -285,8 +285,6 @@ deprecated private module Config implements FullStateConfigSig {
 
   int fieldFlowBranchLimit() { result = min(any(Configuration config).fieldFlowBranchLimit()) }
 
-  int accessPathLimit() { result = 5 }
-
   FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
 
   predicate sourceGrouping(Node source, string sourceGroup) {

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll

@@ -285,8 +285,6 @@ deprecated private module Config implements FullStateConfigSig {
 
   int fieldFlowBranchLimit() { result = min(any(Configuration config).fieldFlowBranchLimit()) }
 
-  int accessPathLimit() { result = 5 }
-
   FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
 
   predicate sourceGrouping(Node source, string sourceGroup) {

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll

@@ -285,8 +285,6 @@ deprecated private module Config implements FullStateConfigSig {
 
   int fieldFlowBranchLimit() { result = min(any(Configuration config).fieldFlowBranchLimit()) }
 
-  int accessPathLimit() { result = 5 }
-
   FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
 
   predicate sourceGrouping(Node source, string sourceGroup) {

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll

@@ -285,8 +285,6 @@ deprecated private module Config implements FullStateConfigSig {
 
   int fieldFlowBranchLimit() { result = min(any(Configuration config).fieldFlowBranchLimit()) }
 
-  int accessPathLimit() { result = 5 }
-
   FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
 
   predicate sourceGrouping(Node source, string sourceGroup) {

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplCommon.qll

@@ -2,7 +2,6 @@
  * DEPRECATED: Use `semmle.code.cpp.dataflow.new.DataFlow` instead.
  */
 
-private import semmle.code.cpp.Location
 private import DataFlowImplSpecific
 private import codeql.dataflow.internal.DataFlowImplCommon
-import MakeImplCommon<Location, CppOldDataFlow>
+import MakeImplCommon<CppOldDataFlow>

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplConsistency.qll

@@ -10,7 +10,7 @@ private import DataFlowImplSpecific
 private import TaintTrackingImplSpecific
 private import codeql.dataflow.internal.DataFlowImplConsistency
 
-private module Input implements InputSig<Location, CppOldDataFlow> {
+private module Input implements InputSig<CppOldDataFlow> {
   predicate argHasPostUpdateExclude(Private::ArgumentNode n) {
     // Is the null pointer (or something that's not really a pointer)
     exists(n.asExpr().getValue())
@@ -26,4 +26,4 @@ private module Input implements InputSig<Location, CppOldDataFlow> {
   }
 }
 
-module Consistency = MakeConsistency<Location, CppOldDataFlow, CppOldTaintTracking, Input>;
+module Consistency = MakeConsistency<CppOldDataFlow, CppOldTaintTracking, Input>;

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplLocal.qll

@@ -285,8 +285,6 @@ deprecated private module Config implements FullStateConfigSig {
 
   int fieldFlowBranchLimit() { result = min(any(Configuration config).fieldFlowBranchLimit()) }
 
-  int accessPathLimit() { result = 5 }
-
   FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
 
   predicate sourceGrouping(Node source, string sourceGroup) {

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplSpecific.qll

@@ -4,7 +4,6 @@
  * Provides C++-specific definitions for use in the data flow library.
  */
 
-private import semmle.code.cpp.Location
 private import codeql.dataflow.DataFlow
 
 module Private {
@@ -16,7 +15,7 @@ module Public {
   import DataFlowUtil
 }
 
-module CppOldDataFlow implements InputSig<Location> {
+module CppOldDataFlow implements InputSig {
   import Private
   import Public
 

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll

@@ -105,7 +105,7 @@ class Node extends TNode {
    * For more information, see
    * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
    */
-  deprecated predicate hasLocationInfo(
+  predicate hasLocationInfo(
     string filepath, int startline, int startcolumn, int endline, int endcolumn
   ) {
     this.getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)

cpp/ql/lib/semmle/code/cpp/dataflow/internal/TaintTrackingImplSpecific.qll

@@ -4,10 +4,9 @@
  * Provides C++-specific definitions for use in the taint tracking library.
  */
 
-private import semmle.code.cpp.Location
 private import codeql.dataflow.TaintTracking
 private import DataFlowImplSpecific
 
-module CppOldTaintTracking implements InputSig<Location, CppOldDataFlow> {
+module CppOldTaintTracking implements InputSig<CppOldDataFlow> {
   import TaintTrackingUtil
 }

cpp/ql/lib/semmle/code/cpp/dataflow/new/DataFlow.qll

@@ -28,6 +28,6 @@ import cpp
 module DataFlow {
   private import semmle.code.cpp.ir.dataflow.internal.DataFlowImplSpecific
   private import codeql.dataflow.DataFlow
-  import DataFlowMake<Location, CppDataFlow>
+  import DataFlowMake<CppDataFlow>
   import semmle.code.cpp.ir.dataflow.internal.DataFlowImpl1
 }

cpp/ql/lib/semmle/code/cpp/dataflow/new/TaintTracking.qll

@@ -27,7 +27,6 @@ module TaintTracking {
   private import semmle.code.cpp.ir.dataflow.internal.DataFlowImplSpecific
   private import semmle.code.cpp.ir.dataflow.internal.TaintTrackingImplSpecific
   private import codeql.dataflow.TaintTracking
-  private import semmle.code.cpp.Location
-  import TaintFlowMake<Location, CppDataFlow, CppTaintTracking>
+  import TaintFlowMake<CppDataFlow, CppTaintTracking>
   import semmle.code.cpp.ir.dataflow.internal.tainttracking1.TaintTrackingImpl
 }

cpp/ql/lib/semmle/code/cpp/exprs/Expr.qll

@@ -1015,33 +1015,8 @@ class DeleteOrDeleteArrayExpr extends Expr, TDeleteOrDeleteArrayExpr {
   Expr getExpr() {
     // If there is a destructor call, the object being deleted is the qualifier
     // otherwise it is the third child.
-    exists(Expr exprWithReuse | exprWithReuse = this.getExprWithReuse() |
-      if not exprWithReuse instanceof ReuseExpr
-      then result = exprWithReuse
-      else result = this.getDestructorCall().getQualifier()
-    )
+    result = this.getChild(3) or result = this.getDestructorCall().getQualifier()
   }
-
-  /**
-   * Gets the object or array being deleted, and gets a `ReuseExpr` when there
-   * is a destructor call and the object is also the qualifier of the call.
-   *
-   * For example, given:
-   * ```
-   * struct HasDestructor { ~HasDestructor(); };
-   * struct PlainOldData { int x, char y; };
-   *
-   * void f(HasDestructor* hasDestructor, PlainOldData* pod) {
-   *   delete hasDestructor;
-   *   delete pod;
-   * }
-   * ```
-   * This predicate yields a `ReuseExpr` for `delete hasDestructor`, as the
-   * the deleted expression has a destructor, and that expression is also
-   * the qualifier of the destructor call. In the case of `delete pod` the
-   * predicate does not yield a `ReuseExpr`, as there is no destructor call.
-   */
-  Expr getExprWithReuse() { result = this.getChild(3) }
 }
 
 /**
@@ -1347,41 +1322,3 @@ class CoYieldExpr extends UnaryOperation, @co_yield {
 
   override int getPrecedence() { result = 2 }
 }
-
-/**
- * An expression representing the re-use of another expression.
- *
- * In some specific cases an expression may be referred to outside its
- * original context. A re-use expression wraps any such reference. A
- * re-use expression can for example occur as the qualifier of an implicit
- * destructor called on a temporary object, where the original use of the
- * expression is in the definition of the temporary.
- */
-class ReuseExpr extends Expr, @reuseexpr {
-  override string getAPrimaryQlClass() { result = "ReuseExpr" }
-
-  override string toString() { result = "reuse of " + this.getReusedExpr().toString() }
-
-  /**
-   * Gets the expression that is being re-used.
-   */
-  Expr getReusedExpr() {
-    // In the case of a prvalue, the extractor outputs the expression
-    // before conversion, but the converted expression is intended.
-    if this.isPRValueCategory()
-    then result = this.getBaseReusedExpr().getFullyConverted()
-    else result = this.getBaseReusedExpr()
-  }
-
-  private Expr getBaseReusedExpr() {
-    expr_reuse(underlyingElement(this), unresolveElement(result), _)
-  }
-
-  override Type getType() { result = this.getReusedExpr().getType() }
-
-  override predicate isLValueCategory() { expr_reuse(underlyingElement(this), _, 3) }
-
-  override predicate isXValueCategory() { expr_reuse(underlyingElement(this), _, 2) }
-
-  override predicate isPRValueCategory() { expr_reuse(underlyingElement(this), _, 1) }
-}

cpp/ql/lib/semmle/code/cpp/ir/dataflow/DataFlow.qll

@@ -24,6 +24,6 @@ import cpp
 module DataFlow {
   private import semmle.code.cpp.ir.dataflow.internal.DataFlowImplSpecific
   private import codeql.dataflow.DataFlow
-  import DataFlowMake<Location, CppDataFlow>
+  import DataFlowMake<CppDataFlow>
   import semmle.code.cpp.ir.dataflow.internal.DataFlowImpl1
 }

cpp/ql/lib/semmle/code/cpp/ir/dataflow/FlowSteps.qll

@@ -1,20 +0,0 @@
-/**
- * This file provides an abstract class that can be used to model additional
- * object-to-field taint-flow.
- */
-
-private import codeql.util.Unit
-private import semmle.code.cpp.dataflow.new.DataFlow
-
-/**
- * A `Content` that should be implicitly regarded as tainted whenever an object with such `Content`
- * is itself tainted.
- *
- * For example, if we had a type `struct Container { int field; }`, then by default a tainted
- * `Container` and a `Container` with a tainted `int` stored in its `field` are distinct.
- *
- * If `any(DataFlow::FieldContent fc | fc.getField().hasQualifiedName("Container", "field"))` was
- * included in this type however, then a tainted `Container` would imply that its `field` is also
- * tainted (but not vice versa).
- */
-abstract class TaintInheritingContent extends DataFlow::Content { }

cpp/ql/lib/semmle/code/cpp/ir/dataflow/TaintTracking.qll

@@ -23,6 +23,6 @@ module TaintTracking {
   private import semmle.code.cpp.ir.dataflow.internal.DataFlowImplSpecific
   private import semmle.code.cpp.ir.dataflow.internal.TaintTrackingImplSpecific
   private import codeql.dataflow.TaintTracking
-  import TaintFlowMake<Location, CppDataFlow, CppTaintTracking>
+  import TaintFlowMake<CppDataFlow, CppTaintTracking>
   import semmle.code.cpp.ir.dataflow.internal.tainttracking1.TaintTrackingImpl
 }

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll

@@ -1,4 +1,3 @@
-private import semmle.code.cpp.Location
 private import DataFlowImplSpecific
 private import codeql.dataflow.internal.DataFlowImpl
-import MakeImpl<Location, CppDataFlow>
+import MakeImpl<CppDataFlow>

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl1.qll

@@ -285,8 +285,6 @@ deprecated private module Config implements FullStateConfigSig {
 
   int fieldFlowBranchLimit() { result = min(any(Configuration config).fieldFlowBranchLimit()) }
 
-  int accessPathLimit() { result = 5 }
-
   FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
 
   predicate sourceGrouping(Node source, string sourceGroup) {

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll

@@ -285,8 +285,6 @@ deprecated private module Config implements FullStateConfigSig {
 
   int fieldFlowBranchLimit() { result = min(any(Configuration config).fieldFlowBranchLimit()) }
 
-  int accessPathLimit() { result = 5 }
-
   FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
 
   predicate sourceGrouping(Node source, string sourceGroup) {

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll

@@ -285,8 +285,6 @@ deprecated private module Config implements FullStateConfigSig {
 
   int fieldFlowBranchLimit() { result = min(any(Configuration config).fieldFlowBranchLimit()) }
 
-  int accessPathLimit() { result = 5 }
-
   FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
 
   predicate sourceGrouping(Node source, string sourceGroup) {

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll

@@ -285,8 +285,6 @@ deprecated private module Config implements FullStateConfigSig {
 
   int fieldFlowBranchLimit() { result = min(any(Configuration config).fieldFlowBranchLimit()) }
 
-  int accessPathLimit() { result = 5 }
-
   FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
 
   predicate sourceGrouping(Node source, string sourceGroup) {

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplCommon.qll

@@ -1,4 +1,3 @@
-private import semmle.code.cpp.Location
 private import DataFlowImplSpecific
 private import codeql.dataflow.internal.DataFlowImplCommon
-import MakeImplCommon<Location, CppDataFlow>
+import MakeImplCommon<CppDataFlow>

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplConsistency.qll

@@ -8,7 +8,7 @@ private import DataFlowImplSpecific
 private import TaintTrackingImplSpecific
 private import codeql.dataflow.internal.DataFlowImplConsistency
 
-private module Input implements InputSig<Location, CppDataFlow> {
+private module Input implements InputSig<CppDataFlow> {
   predicate argHasPostUpdateExclude(Private::ArgumentNode n) {
     // The rules for whether an IR argument gets a post-update node are too
     // complex to model here.
@@ -16,4 +16,4 @@ private module Input implements InputSig<Location, CppDataFlow> {
   }
 }
 
-module Consistency = MakeConsistency<Location, CppDataFlow, CppTaintTracking, Input>;
+module Consistency = MakeConsistency<CppDataFlow, CppTaintTracking, Input>;

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplSpecific.qll

@@ -3,7 +3,6 @@
  */
 
 private import codeql.dataflow.DataFlow
-private import semmle.code.cpp.Location
 
 module Private {
   import DataFlowPrivate
@@ -14,7 +13,7 @@ module Public {
   import DataFlowUtil
 }
 
-module CppDataFlow implements InputSig<Location> {
+module CppDataFlow implements InputSig {
   import Private
   import Public
 

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll

@@ -448,7 +448,7 @@ class Node extends TIRDataFlowNode {
    * For more information, see
    * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
    */
-  deprecated predicate hasLocationInfo(
+  predicate hasLocationInfo(
     string filepath, int startline, int startcolumn, int endline, int endcolumn
   ) {
     this.getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
@@ -1331,7 +1331,6 @@ private import GetConvertedResultExpression
 
 /** Holds if `node` is an `OperandNode` that should map `node.asExpr()` to `e`. */
 predicate exprNodeShouldBeOperand(OperandNode node, Expr e, int n) {
-  not exprNodeShouldBeIndirectOperand(_, e, n) and
   exists(Instruction def |
     unique( | | getAUse(def)) = node.getOperand() and
     e = getConvertedResultExpression(def, n)
@@ -1348,22 +1347,6 @@ private predicate indirectExprNodeShouldBeIndirectOperand(
   )
 }
 
-/** Holds if `node` should be an `IndirectOperand` that maps `node.asExpr()` to `e`. */
-private predicate exprNodeShouldBeIndirectOperand(IndirectOperand node, Expr e, int n) {
-  exists(ArgumentOperand operand |
-    // When an argument (qualifier or positional) is a prvalue and the
-    // parameter (qualifier or positional) is a (const) reference, IR
-    // construction introduces a temporary `IRVariable`. The `VariableAddress`
-    // instruction has the argument as its `getConvertedResultExpression`
-    // result. However, the instruction actually represents the _address_ of
-    // the argument. So to fix this mismatch, we have the indirection of the
-    // `VariableAddressInstruction` map to the expression.
-    node.hasOperandAndIndirectionIndex(operand, 1) and
-    e = getConvertedResultExpression(operand.getDef(), n) and
-    operand.getDef().(VariableAddressInstruction).getIRVariable() instanceof IRTempVariable
-  )
-}
-
 private predicate exprNodeShouldBeIndirectOutNode(IndirectArgumentOutNode node, Expr e, int n) {
   exists(CallInstruction call |
     call.getStaticCallTarget() instanceof Constructor and
@@ -1376,7 +1359,6 @@ private predicate exprNodeShouldBeIndirectOutNode(IndirectArgumentOutNode node,
 predicate exprNodeShouldBeInstruction(Node node, Expr e, int n) {
   not exprNodeShouldBeOperand(_, e, n) and
   not exprNodeShouldBeIndirectOutNode(_, e, n) and
-  not exprNodeShouldBeIndirectOperand(_, e, n) and
   e = getConvertedResultExpression(node.asInstruction(), n)
 }
 
@@ -1409,8 +1391,7 @@ abstract private class ExprNodeBase extends Node {
 private predicate exprNodeShouldBe(Expr e, int n) {
   exprNodeShouldBeInstruction(_, e, n) or
   exprNodeShouldBeOperand(_, e, n) or
-  exprNodeShouldBeIndirectOutNode(_, e, n) or
-  exprNodeShouldBeIndirectOperand(_, e, n)
+  exprNodeShouldBeIndirectOutNode(_, e, n)
 }
 
 private class InstructionExprNode extends ExprNodeBase, InstructionNode {
@@ -1552,12 +1533,6 @@ private class IndirectArgumentOutExprNode extends ExprNodeBase, IndirectArgument
   final override Expr getConvertedExpr(int n) { exprNodeShouldBeIndirectOutNode(this, result, n) }
 }
 
-private class IndirectOperandExprNode extends ExprNodeBase instanceof IndirectOperand {
-  IndirectOperandExprNode() { exprNodeShouldBeIndirectOperand(this, _, _) }
-
-  final override Expr getConvertedExpr(int n) { exprNodeShouldBeIndirectOperand(this, result, n) }
-}
-
 /**
  * An expression, viewed as a node in a data flow graph.
  */
@@ -2301,8 +2276,8 @@ private import ContentStars
 
 /** A reference through a non-union instance field. */
 class FieldContent extends Content, TFieldContent {
-  private Field f;
-  private int indirectionIndex;
+  Field f;
+  int indirectionIndex;
 
   FieldContent() { this = TFieldContent(f, indirectionIndex) }
 
@@ -2329,9 +2304,9 @@ class FieldContent extends Content, TFieldContent {
 
 /** A reference through an instance field of a union. */
 class UnionContent extends Content, TUnionContent {
-  private Union u;
-  private int indirectionIndex;
-  private int bytes;
+  Union u;
+  int indirectionIndex;
+  int bytes;
 
   UnionContent() { this = TUnionContent(u, bytes, indirectionIndex) }
 

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/TaintTrackingImplSpecific.qll

@@ -4,8 +4,7 @@
 
 private import codeql.dataflow.TaintTracking
 private import DataFlowImplSpecific
-private import semmle.code.cpp.Location
 
-module CppTaintTracking implements InputSig<Location, CppDataFlow> {
+module CppTaintTracking implements InputSig<CppDataFlow> {
   import TaintTrackingUtil
 }

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/TaintTrackingUtil.qll

@@ -6,7 +6,6 @@ private import semmle.code.cpp.models.interfaces.SideEffect
 private import DataFlowUtil
 private import DataFlowPrivate
 private import SsaInternals as Ssa
-private import semmle.code.cpp.ir.dataflow.FlowSteps
 
 /**
  * Holds if taint propagates from `nodeFrom` to `nodeTo` in exactly one local
@@ -38,12 +37,6 @@ predicate localAdditionalTaintStep(DataFlow::Node nodeFrom, DataFlow::Node nodeT
   )
   or
   any(Ssa::Indirection ind).isAdditionalTaintStep(nodeFrom, nodeTo)
-  or
-  // object->field conflation for content that is a `TaintInheritingContent`.
-  exists(DataFlow::ContentSet f |
-    readStep(nodeFrom, f, nodeTo) and
-    f.getAReadContent() instanceof TaintInheritingContent
-  )
 }
 
 /**

cpp/ql/lib/semmle/code/cpp/ir/implementation/EdgeKind.qll

@@ -90,15 +90,6 @@ class CaseEdge extends EdgeKind, TCaseEdge {
    * Gets the largest value of the switch expression for which control will flow along this edge.
    */
   final string getMaxValue() { result = maxValue }
-
-  /**
-   * Gets the unique value of the switch expression for which control will
-   * flow along this edge, if any.
-   */
-  final string getValue() {
-    minValue = maxValue and
-    result = minValue
-  }
 }
 
 /**

cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/constant/ConstantAnalysis.qll

@@ -38,12 +38,6 @@ private int getBinaryInstructionValue(BinaryInstruction instr) {
     or
     instr instanceof DivInstruction and result = div(left, right)
     or
-    instr instanceof BitOrInstruction and result = bitOr(left, right)
-    or
-    instr instanceof BitAndInstruction and result = bitAnd(left, right)
-    or
-    instr instanceof BitXorInstruction and result = bitXor(left, right)
-    or
     instr instanceof CompareEQInstruction and result = compareEQ(left, right)
     or
     instr instanceof CompareNEInstruction and result = compareNE(left, right)

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/constant/ConstantAnalysis.qll

@@ -38,12 +38,6 @@ private int getBinaryInstructionValue(BinaryInstruction instr) {
     or
     instr instanceof DivInstruction and result = div(left, right)
     or
-    instr instanceof BitOrInstruction and result = bitOr(left, right)
-    or
-    instr instanceof BitAndInstruction and result = bitAnd(left, right)
-    or
-    instr instanceof BitXorInstruction and result = bitXor(left, right)
-    or
     instr instanceof CompareEQInstruction and result = compareEQ(left, right)
     or
     instr instanceof CompareNEInstruction and result = compareNE(left, right)

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedElement.qll

@@ -40,43 +40,12 @@ IRTempVariable getIRTempVariable(Locatable ast, TempVariableTag tag) {
   result.getTag() = tag
 }
 
-/** Gets an operand of `op`. */
-private Expr getAnOperand(Operation op) { result = op.getAnOperand() }
-
-/**
- * Gets the number of nested operands of `op`. For example,
- * `getNumberOfNestedBinaryOperands((1 + 2) + 3))` is `3`.
- */
-private int getNumberOfNestedBinaryOperands(Operation op) { result = count(getAnOperand*(op)) }
-
-/**
- * Holds if `op` should not be translated to a `ConstantInstruction` as part of
- * IR generation, even if the value of `op` is constant.
- */
-private predicate ignoreConstantValue(Operation op) {
-  op instanceof BitwiseAndExpr
-  or
-  op instanceof BitwiseOrExpr
-  or
-  op instanceof BitwiseXorExpr
-}
-
 /**
  * Holds if `expr` is a constant of a type that can be replaced directly with
  * its value in the IR. This does not include address constants as we have no
  * means to express those as QL values.
  */
-predicate isIRConstant(Expr expr) {
-  exists(expr.getValue()) and
-  // We avoid constant folding certain operations since it's often useful to
-  // mark one of those as a source in dataflow, and if the operation is
-  // constant folded it's not possible to mark its operands as a source (or
-  // sink).
-  // But to avoid creating an outrageous amount of IR from very large
-  // constant expressions we fall back to constant folding if the operation
-  // has more than 50 operands (i.e., 1 + 2 + 3 + 4 + ... + 50)
-  if ignoreConstantValue(expr) then getNumberOfNestedBinaryOperands(expr) > 50 else any()
-}
+predicate isIRConstant(Expr expr) { exists(expr.getValue()) }
 
 // Pulled out for performance. See
 // https://github.com/github/codeql-coreql-team/issues/1044.
@@ -150,6 +119,11 @@ private predicate ignoreExprOnly(Expr expr) {
   or
   not translateFunction(getEnclosingFunction(expr)) and
   not Raw::varHasIRFunc(getEnclosingVariable(expr))
+  or
+  exists(DeleteOrDeleteArrayExpr deleteExpr |
+    // Ignore the destructor call, because the duplicated qualifier breaks control flow.
+    deleteExpr.getDestructorCall() = expr
+  )
 }
 
 /**

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll

@@ -2245,11 +2245,7 @@ class TranslatedDeleteOrDeleteArrayExpr extends TranslatedNonConstantExpr, Trans
 
   final override Type getCallResultType() { result = expr.getType() }
 
-  final override TranslatedExpr getQualifier() {
-    result = getTranslatedExpr(expr.getDestructorCall())
-  }
-
-  final override Instruction getQualifierResult() { none() }
+  final override TranslatedExpr getQualifier() { none() }
 
   final override predicate hasArguments() {
     // All deallocator calls have at least one argument.
@@ -2264,7 +2260,7 @@ class TranslatedDeleteOrDeleteArrayExpr extends TranslatedNonConstantExpr, Trans
   final override TranslatedExpr getArgument(int index) {
     // The only argument we define is the pointer to be deallocated.
     index = 0 and
-    result = getTranslatedExpr(expr.getExprWithReuse().getFullyConverted())
+    result = getTranslatedExpr(expr.getExpr().getFullyConverted())
   }
 
   final override predicate mayThrowException() {
@@ -2773,50 +2769,6 @@ class TranslatedTemporaryObjectExpr extends TranslatedNonConstantExpr,
   final override Instruction getResult() { result = this.getTargetAddress() }
 }
 
-/**
- * IR translation of a `ReuseExpr`.
- *
- * This translation produces a copy of the glvalue instruction holding the (unconverted) result
- * of the reused expression. In the case where the original expression was a prvalue, the
- * result will be a copy of the glvalue operand of a `TranslatedLoad`.
- */
-class TranslatedReuseExpr extends TranslatedNonConstantExpr {
-  override ReuseExpr expr;
-
-  override Instruction getFirstInstruction(EdgeKind kind) {
-    result = this.getInstruction(OnlyInstructionTag()) and
-    kind instanceof GotoEdge
-  }
-
-  override predicate hasInstruction(Opcode opcode, InstructionTag tag, CppType resultType) {
-    opcode instanceof Opcode::CopyValue and
-    tag instanceof OnlyInstructionTag and
-    resultType = this.getResultType()
-  }
-
-  override Instruction getResult() { result = this.getInstruction(OnlyInstructionTag()) }
-
-  override Instruction getInstructionSuccessorInternal(InstructionTag tag, EdgeKind kind) {
-    tag = OnlyInstructionTag() and
-    kind instanceof GotoEdge and
-    result = this.getParent().getChildSuccessor(this, kind)
-  }
-
-  override TranslatedElement getChildInternal(int id) { none() }
-
-  override Instruction getALastInstructionInternal() {
-    result = this.getInstruction(OnlyInstructionTag())
-  }
-
-  override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
-    tag = OnlyInstructionTag() and
-    operandTag instanceof UnaryOperandTag and
-    if getTranslatedExpr(expr.getReusedExpr()) instanceof TranslatedLoad
-    then result = getTranslatedExpr(expr.getReusedExpr()).(TranslatedLoad).getOperand().getResult()
-    else result = getTranslatedExpr(expr.getReusedExpr()).getResult()
-  }
-}
-
 /**
  * IR translation of a `throw` expression.
  */

cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/constant/ConstantAnalysis.qll

@@ -38,12 +38,6 @@ private int getBinaryInstructionValue(BinaryInstruction instr) {
     or
     instr instanceof DivInstruction and result = div(left, right)
     or
-    instr instanceof BitOrInstruction and result = bitOr(left, right)
-    or
-    instr instanceof BitAndInstruction and result = bitAnd(left, right)
-    or
-    instr instanceof BitXorInstruction and result = bitXor(left, right)
-    or
     instr instanceof CompareEQInstruction and result = compareEQ(left, right)
     or
     instr instanceof CompareNEInstruction and result = compareNE(left, right)

cpp/ql/lib/semmle/code/cpp/ir/internal/IntegerPartial.qll

@@ -89,18 +89,6 @@ int compareLE(int a, int b) { if a <= b then result = 1 else result = 0 }
 bindingset[a, b]
 int compareGE(int a, int b) { if a >= b then result = 1 else result = 0 }
 
-/** Returns `a | b`. */
-bindingset[a, b]
-int bitOr(int a, int b) { result = a.bitOr(b) }
-
-/** Returns `a & b`. */
-bindingset[a, b]
-int bitAnd(int a, int b) { result = a.bitAnd(b) }
-
-/** Returns `a ^ b`. */
-bindingset[a, b]
-int bitXor(int a, int b) { result = a.bitXor(b) }
-
 /**
  * Returns `-a`. If the negation would overflow, there is no result.
  */

cpp/ql/lib/semmle/code/cpp/models/Models.qll

@@ -41,4 +41,3 @@ private import implementations.SqLite3
 private import implementations.PostgreSql
 private import implementations.System
 private import implementations.StructuredExceptionHandling
-private import implementations.Fopen

cpp/ql/lib/semmle/code/cpp/models/implementations/Allocation.qll

@@ -36,9 +36,7 @@ private class MallocAllocationFunction extends AllocationFunction {
         "CRYPTO_malloc", // CRYPTO_malloc(size_t num, const char *file, int line)
         "CRYPTO_zalloc", // CRYPTO_zalloc(size_t num, const char *file, int line)
         "CRYPTO_secure_malloc", // CRYPTO_secure_malloc(size_t num, const char *file, int line)
-        "CRYPTO_secure_zalloc", // CRYPTO_secure_zalloc(size_t num, const char *file, int line)
-        "g_malloc", // g_malloc (n_bytes);
-        "g_try_malloc" // g_try_malloc(n_bytes);
+        "CRYPTO_secure_zalloc" // CRYPTO_secure_zalloc(size_t num, const char *file, int line)
       ]) and
     sizeArg = 0
     or
@@ -141,9 +139,7 @@ private class ReallocAllocationFunction extends AllocationFunction, TaintFunctio
         // --- Windows COM allocation
         "CoTaskMemRealloc", // CoTaskMemRealloc(ptr, size)
         // --- OpenSSL memory allocation
-        "CRYPTO_realloc", // CRYPTO_realloc(void *addr, size_t num, const char *file, int line)
-        "g_realloc", // g_realloc(mem, n_bytes);
-        "g_try_realloc" // g_try_realloc(mem, n_bytes);
+        "CRYPTO_realloc" // CRYPTO_realloc(void *addr, size_t num, const char *file, int line)
       ]) and
     sizeArg = 1 and
     reallocArg = 0

cpp/ql/lib/semmle/code/cpp/models/implementations/Deallocation.qll

@@ -20,10 +20,8 @@ private class StandardDeallocationFunction extends DeallocationFunction {
     freedArg = 0
     or
     this.hasGlobalName([
-        // --- OpenSSL memory deallocation
-        "CRYPTO_free", "CRYPTO_secure_free",
-        // --- glib memory deallocation
-        "g_free"
+        // --- OpenSSL memory allocation
+        "CRYPTO_free", "CRYPTO_secure_free"
       ]) and
     freedArg = 0
     or

cpp/ql/lib/semmle/code/cpp/models/implementations/Fopen.qll

@@ -1,50 +0,0 @@
-/**
- * Provides implementation classes modeling `fopen` and various similar
- * functions. See `semmle.code.cpp.models.Models` for usage information.
- */
-
-import semmle.code.cpp.models.interfaces.Alias
-import semmle.code.cpp.models.interfaces.SideEffect
-
-/** The function `fopen` and friends. */
-private class Fopen extends Function, AliasFunction, SideEffectFunction {
-  Fopen() {
-    this.hasGlobalOrStdName(["fopen", "fopen_s", "freopen"])
-    or
-    this.hasGlobalName(["_open", "_wfopen", "_fsopen", "_wfsopen", "_wopen"])
-  }
-
-  override predicate hasOnlySpecificWriteSideEffects() { any() }
-
-  override predicate hasOnlySpecificReadSideEffects() { any() }
-
-  override predicate parameterEscapesOnlyViaReturn(int i) { none() }
-
-  override predicate parameterNeverEscapes(int index) {
-    // None of the parameters escape
-    this.getParameter(index).getUnspecifiedType() instanceof PointerType
-  }
-
-  override predicate hasSpecificReadSideEffect(ParameterIndex i, boolean buffer) {
-    (
-      this.hasGlobalOrStdName(["fopen", "fopen_s"])
-      or
-      this.hasGlobalName(["_wfopen", "_fsopen", "_wfsopen"])
-    ) and
-    i = [0, 1] and
-    buffer = true
-    or
-    this.hasGlobalOrStdName("freopen") and
-    (
-      i = [0, 1] and
-      buffer = true
-      or
-      i = 2 and
-      buffer = false
-    )
-    or
-    this.hasGlobalName(["_open", "_wopen"]) and
-    i = 0 and
-    buffer = true
-  }
-}

cpp/ql/lib/semmle/code/cpp/models/implementations/Iterator.qll

@@ -9,8 +9,6 @@ import cpp
 import semmle.code.cpp.models.interfaces.Taint
 import semmle.code.cpp.models.interfaces.DataFlow
 import semmle.code.cpp.models.interfaces.Iterator
-import semmle.code.cpp.models.interfaces.Alias
-import semmle.code.cpp.models.interfaces.SideEffect
 
 /**
  * An instantiation of the `std::iterator_traits` template.
@@ -440,7 +438,7 @@ private class IteratorAssignmentMemberOperatorModel extends IteratorAssignmentMe
  * A `begin` or `end` member function, or a related member function, that
  * returns an iterator.
  */
-class BeginOrEndFunction extends MemberFunction {
+private class BeginOrEndFunction extends MemberFunction, TaintFunction, GetIteratorFunction {
   BeginOrEndFunction() {
     this.hasName([
         "begin", "cbegin", "rbegin", "crbegin", "end", "cend", "rend", "crend", "before_begin",
@@ -448,11 +446,7 @@ class BeginOrEndFunction extends MemberFunction {
       ]) and
     this.getType().getUnspecifiedType() instanceof Iterator
   }
-}
 
-private class BeginOrEndFunctionModels extends BeginOrEndFunction, TaintFunction,
-  GetIteratorFunction, AliasFunction, SideEffectFunction
-{
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     input.isQualifierObject() and
     output.isReturnValue()
@@ -462,22 +456,6 @@ private class BeginOrEndFunctionModels extends BeginOrEndFunction, TaintFunction
     input.isQualifierObject() and
     output.isReturnValue()
   }
-
-  override predicate parameterNeverEscapes(int index) { index = -1 }
-
-  override predicate parameterEscapesOnlyViaReturn(int index) { none() }
-
-  override predicate hasOnlySpecificReadSideEffects() { any() }
-
-  override predicate hasOnlySpecificWriteSideEffects() { any() }
-
-  override predicate hasSpecificWriteSideEffect(ParameterIndex i, boolean buffer, boolean mustWrite) {
-    none()
-  }
-
-  override predicate hasSpecificReadSideEffect(ParameterIndex i, boolean buffer) {
-    i = -1 and buffer = false
-  }
 }
 
 /**

cpp/ql/lib/semmle/code/cpp/models/implementations/StdContainer.qll

@@ -253,15 +253,13 @@ private class StdSequenceContainerAssign extends TaintFunction {
 /**
  * The standard container functions `at` and `operator[]`.
  */
-class StdSequenceContainerAt extends MemberFunction {
+private class StdSequenceContainerAt extends TaintFunction {
   StdSequenceContainerAt() {
     this.getClassAndName(["at", "operator[]"]) instanceof Array or
     this.getClassAndName(["at", "operator[]"]) instanceof Deque or
     this.getClassAndName(["at", "operator[]"]) instanceof Vector
   }
-}
 
-private class StdSequenceContainerAtModel extends StdSequenceContainerAt, TaintFunction {
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from qualifier to referenced return value
     input.isQualifierObject() and

cpp/ql/lib/semmle/code/cpp/models/implementations/StdMap.qll

@@ -129,11 +129,9 @@ private class StdMapMerge extends TaintFunction {
 /**
  * The standard map functions `at` and `operator[]`.
  */
-class StdMapAt extends MemberFunction {
+private class StdMapAt extends TaintFunction {
   StdMapAt() { this.getClassAndName(["at", "operator[]"]) instanceof MapOrUnorderedMap }
-}
 
-private class StdMapAtModels extends StdMapAt, TaintFunction {
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from qualifier to referenced return value
     input.isQualifierObject() and

cpp/ql/lib/semmlecode.cpp.dbscheme

@@ -1513,12 +1513,6 @@ exprs(
     int location: @location_expr ref
 );
 
-expr_reuse(
-    int reuse: @expr ref,
-    int original: @expr ref,
-    int value_category: int ref
-)
-
 /*
   case @value.category of
     1 = prval
@@ -1747,7 +1741,6 @@ case @expr.kind of
 | 360 = @isunsigned
 | 361 = @isvoid
 | 362 = @isvolatile
-| 363 = @reuseexpr
 ;
 
 @var_args_expr = @vastartexpr

cpp/ql/lib/upgrades/298438feb146335af824002589cd6d4e96e5dbf9/upgrade.properties

@@ -1,2 +0,0 @@
-description: Introduce re-use expressions
-compatibility: backwards

cpp/ql/lib/upgrades/aa7ff0ab32cd4674f6ab731d32fea64116997b05/expr_reuse.ql

@@ -1,7 +0,0 @@
-class Expr extends @expr {
-  string toString() { none() }
-}
-
-from Expr reuse, Expr original, int value_category
-where expr_reuse(reuse, original) and expr_types(original, _, value_category)
-select reuse, original, value_category

cpp/ql/lib/upgrades/aa7ff0ab32cd4674f6ab731d32fea64116997b05/upgrade.properties

@@ -1,3 +0,0 @@
-description: Add value category to expr_reuse table
-compatibility: full
-expr_reuse.rel: run expr_reuse.qlo

cpp/ql/src/CHANGELOG.md

@@ -1,34 +1,3 @@
-## 0.9.9
-
-### New Queries
-
-* Added a new query, `cpp/type-confusion`, to detect casts to invalid types.
-
-### Query Metadata Changes
-
-* `@precision medium` metadata was added to the `cpp/boost/tls-settings-misconfiguration` and `cpp/boost/use-of-deprecated-hardcoded-security-protocol` queries, and these queries are now included in the security-extended suite. The `@name` metadata of these queries were also updated.
-
-### Minor Analysis Improvements
-
-* The "Missing return-value check for a 'scanf'-like function" query (`cpp/missing-check-scanf`) has been converted to a `path-problem` query.
-* The "Potentially uninitialized local variable" query (`cpp/uninitialized-local`) has been converted to a `path-problem` query.
-* Added models for `GLib` allocation and deallocation functions.
-
-## 0.9.8
-
-No user-facing changes.
-
-## 0.9.7
-
-No user-facing changes.
-
-## 0.9.6
-
-### Minor Analysis Improvements
-
-* The "non-constant format string" query (`cpp/non-constant-format`) has been converted to a `path-problem` query.
-* The new C/C++ dataflow and taint-tracking libraries (`semmle.code.cpp.dataflow.new.DataFlow` and `semmle.code.cpp.dataflow.new.TaintTracking`) now implicitly assume that dataflow and taint modelled via `DataFlowFunction` and `TaintFunction` always fully overwrite their buffers and thus act as flow barriers. As a result, many dataflow and taint-tracking queries now produce fewer false positives. To remove this assumption and go back to the previous behavior for a given model, one can override the new `isPartialWrite` predicate.
-
 ## 0.9.5
 
 ### Minor Analysis Improvements

cpp/ql/src/Critical/DoubleFree.ql

@@ -37,5 +37,6 @@ where
   DoubleFree::flowPath(source, sink) and
   isFree(source.getNode(), _, _, dealloc) and
   isFree(sink.getNode(), e2)
-select sink.getNode(), source, sink, "Memory pointed to by $@ may already have been freed by $@.",
-  e2, e2.toString(), dealloc, dealloc.toString()
+select sink.getNode(), source, sink,
+  "Memory pointed to by '" + e2.toString() + "' may already have been freed by $@.", dealloc,
+  dealloc.toString()

cpp/ql/src/Critical/MissingCheckScanf.ql

@@ -2,7 +2,7 @@
  * @name Missing return-value check for a 'scanf'-like function
  * @description Failing to check that a call to 'scanf' actually writes to an
  *              output variable can lead to unexpected behavior at reading time.
- * @kind path-problem
+ * @kind problem
  * @problem.severity warning
  * @security-severity 7.5
  * @precision medium
@@ -18,9 +18,16 @@ import semmle.code.cpp.commons.Scanf
 import semmle.code.cpp.controlflow.Guards
 import semmle.code.cpp.dataflow.new.DataFlow::DataFlow
 import semmle.code.cpp.ir.IR
-import semmle.code.cpp.valuenumbering.GlobalValueNumbering
+import semmle.code.cpp.ir.ValueNumbering
 import ScanfChecks
-import ScanfToUseFlow::PathGraph
+
+/** Holds if `n` reaches an argument  to a call to a `scanf`-like function. */
+pragma[nomagic]
+predicate revFlow0(Node n) {
+  isSink(_, _, n, _)
+  or
+  exists(Node succ | revFlow0(succ) | localFlowStep(n, succ))
+}
 
 /**
  * Holds if `n` represents an uninitialized stack-allocated variable, or a
@@ -31,45 +38,30 @@ predicate isUninitialized(Node n) {
   n.asIndirectExpr(1) instanceof AllocationExpr
 }
 
+pragma[nomagic]
+predicate fwdFlow0(Node n) {
+  revFlow0(n) and
+  (
+    isUninitialized(n)
+    or
+    exists(Node prev |
+      fwdFlow0(prev) and
+      localFlowStep(prev, n)
+    )
+  )
+}
+
 predicate isSink(ScanfFunctionCall call, int index, Node n, Expr input) {
   input = call.getOutputArgument(index) and
   n.asIndirectExpr() = input
 }
 
-/**
- * A configuration to track a uninitialized data flowing to a `scanf`-like
- * output parameter position.
- *
- * This is meant to be a simple flow to rule out cases like:
- * ```
- * int x = 0;
- * scanf(..., &x);
- * use(x);
- * ```
- * since `x` is already initialized it's not a security concern that `x` is
- * used without checking the return value of `scanf`.
- *
- * Since this flow is meant to be simple, we disable field flow and require the
- * source and the sink to be in the same callable.
- */
-module UninitializedToScanfConfig implements ConfigSig {
-  predicate isSource(Node source) { isUninitialized(source) }
-
-  predicate isSink(Node sink) { isSink(_, _, sink, _) }
-
-  FlowFeature getAFeature() { result instanceof FeatureEqualSourceSinkCallContext }
-
-  int accessPathLimit() { result = 0 }
-}
-
-module UninitializedToScanfFlow = Global<UninitializedToScanfConfig>;
-
 /**
  * Holds if `call` is a `scanf`-like call and `output` is the `index`'th
  * argument that has not been previously initialized.
  */
 predicate isRelevantScanfCall(ScanfFunctionCall call, int index, Expr output) {
-  exists(Node n | UninitializedToScanfFlow::flowTo(n) and isSink(call, index, n, output)) and
+  exists(Node n | fwdFlow0(n) and isSink(call, index, n, output)) and
   // Exclude results from incorrectky checked scanf query
   not incorrectlyCheckedScanf(call)
 }
@@ -85,6 +77,31 @@ predicate isSource(ScanfFunctionCall call, int index, Node n, Expr output) {
   n.asDefiningArgument() = output
 }
 
+/**
+ * Holds if `n` is reachable from an output argument of a relevant call to
+ * a `scanf`-like function.
+ */
+pragma[nomagic]
+predicate fwdFlow(Node n) {
+  isSource(_, _, n, _)
+  or
+  exists(Node prev |
+    fwdFlow(prev) and
+    localFlowStep(prev, n) and
+    not isSanitizerOut(prev)
+  )
+}
+
+/** Holds if `n` should not have outgoing flow. */
+predicate isSanitizerOut(Node n) {
+  // We disable flow out of sinks to reduce result duplication
+  isSink(n, _)
+  or
+  // If the node is being passed to a function it may be
+  // modified, and thus it's safe to later read the value.
+  exists(n.asIndirectArgument())
+}
+
 /**
  * Holds if `n` is a node such that `n.asExpr() = e` and `e` is not an
  * argument of a deallocation expression.
@@ -95,37 +112,40 @@ predicate isSink(Node n, Expr e) {
 }
 
 /**
- * A configuration to track flow from the output argument of a call to a
- * `scanf`-like function, and to a use of the defined variable.
+ * Holds if `n` is part of a path from a call to a `scanf`-like function
+ * to a use of the written variable.
  */
-module ScanfToUseConfig implements ConfigSig {
-  predicate isSource(Node source) { isSource(_, _, source, _) }
-
-  predicate isSink(Node sink) { isSink(sink, _) }
-
-  predicate isBarrierOut(Node n) {
-    // We disable flow out of sinks to reduce result duplication
+pragma[nomagic]
+predicate revFlow(Node n) {
+  fwdFlow(n) and
+  (
     isSink(n, _)
     or
-    // If the node is being passed to a function it may be
-    // modified, and thus it's safe to later read the value.
-    exists(n.asIndirectArgument())
-  }
+    exists(Node succ |
+      revFlow(succ) and
+      localFlowStep(n, succ) and
+      not isSanitizerOut(n)
+    )
+  )
 }
 
-module ScanfToUseFlow = Global<ScanfToUseConfig>;
+/** A local flow step, restricted to relevant dataflow nodes. */
+private predicate step(Node n1, Node n2) {
+  revFlow(n1) and
+  revFlow(n2) and
+  localFlowStep(n1, n2)
+}
+
+predicate hasFlow(Node n1, Node n2) = fastTC(step/2)(n1, n2)
 
 /**
  * Holds if `source` is the `index`'th argument to the `scanf`-like call `call`, and `sink` is
  * a dataflow node that represents the expression `e`.
  */
-predicate flowPath(
-  ScanfToUseFlow::PathNode source, ScanfFunctionCall call, int index, ScanfToUseFlow::PathNode sink,
-  Expr e
-) {
-  isSource(call, index, source.getNode(), _) and
-  ScanfToUseFlow::flowPath(source, sink) and
-  isSink(sink.getNode(), e)
+predicate hasFlow(Node source, ScanfFunctionCall call, int index, Node sink, Expr e) {
+  isSource(call, index, source, _) and
+  hasFlow(source, sink) and
+  isSink(sink, e)
 }
 
 /**
@@ -147,33 +167,39 @@ int getMinimumGuardConstant(ScanfFunctionCall call, int index) {
  * Holds the access to `e` isn't guarded by a check that ensures that `call` returned
  * at least `minGuard`.
  */
-predicate hasNonGuardedAccess(
-  ScanfToUseFlow::PathNode source, ScanfFunctionCall call, ScanfToUseFlow::PathNode sink, Expr e,
-  int minGuard
-) {
+predicate hasNonGuardedAccess(ScanfFunctionCall call, Expr e, int minGuard) {
   exists(int index |
-    flowPath(source, call, index, sink, e) and
+    hasFlow(_, call, index, _, e) and
     minGuard = getMinimumGuardConstant(call, index)
   |
-    not exists(GuardCondition guard |
-      // call == k and k >= minGuard so call >= minGuard
-      guard
-          .ensuresEq(globalValueNumber(call).getAnExpr(), any(int k | minGuard <= k),
-            e.getBasicBlock(), true)
+    not exists(int value |
+      e.getBasicBlock() = blockGuardedBy(value, "==", call) and minGuard <= value
       or
-      // call >= k and k >= minGuard so call >= minGuard
-      guard
-          .ensuresLt(globalValueNumber(call).getAnExpr(), any(int k | minGuard <= k),
-            e.getBasicBlock(), false)
+      e.getBasicBlock() = blockGuardedBy(value, "<", call) and minGuard - 1 <= value
+      or
+      e.getBasicBlock() = blockGuardedBy(value, "<=", call) and minGuard <= value
     )
   )
 }
 
-from
-  ScanfToUseFlow::PathNode source, ScanfToUseFlow::PathNode sink, ScanfFunctionCall call, Expr e,
-  int minGuard
-where hasNonGuardedAccess(source, call, sink, e, minGuard)
-select e, source, sink,
+/** Returns a block guarded by the assertion of `value op call` */
+BasicBlock blockGuardedBy(int value, string op, ScanfFunctionCall call) {
+  exists(GuardCondition g, Expr left, Expr right |
+    right = g.getAChild() and
+    value = left.getValue().toInt() and
+    localExprFlow(call, right)
+  |
+    g.ensuresEq(left, right, 0, result, true) and op = "=="
+    or
+    g.ensuresLt(left, right, 0, result, true) and op = "<"
+    or
+    g.ensuresLt(left, right, 1, result, true) and op = "<="
+  )
+}
+
+from ScanfFunctionCall call, Expr e, int minGuard
+where hasNonGuardedAccess(call, e, minGuard)
+select e,
   "This variable is read, but may not have been written. " +
     "It should be guarded by a check that the $@ returns at least " + minGuard + ".", call,
   call.toString()

cpp/ql/src/Critical/ScanfChecks.qll

@@ -3,11 +3,15 @@ private import semmle.code.cpp.commons.Scanf
 private import semmle.code.cpp.controlflow.IRGuards
 private import semmle.code.cpp.ir.ValueNumbering
 
+private ConstantInstruction getZeroInstruction() { result.getValue() = "0" }
+
+private Operand zero() { result.getDef() = getZeroInstruction() }
+
 private predicate exprInBooleanContext(Expr e) {
   exists(IRGuardCondition gc |
     exists(Instruction i |
       i.getUnconvertedResultExpression() = e and
-      gc.comparesEq(valueNumber(i).getAUse(), 0, _, _)
+      gc.comparesEq(valueNumber(i).getAUse(), zero(), 0, _, _)
     )
     or
     gc.getUnconvertedResultExpression() = e
@@ -32,6 +36,10 @@ private string getEofValue() {
   )
 }
 
+private ConstantInstruction getEofInstruction() { result.getValue() = getEofValue() }
+
+private Operand eof() { result.getDef() = getEofInstruction() }
+
 /**
  * Holds if the value of `call` has been checked to not equal `EOF`.
  */
@@ -39,10 +47,10 @@ private predicate checkedForEof(ScanfFunctionCall call) {
   exists(IRGuardCondition gc |
     exists(Instruction i | i.getUnconvertedResultExpression() = call |
       // call == EOF
-      gc.comparesEq(valueNumber(i).getAUse(), getEofValue().toInt(), _, _)
+      gc.comparesEq(valueNumber(i).getAUse(), eof(), 0, _, _)
       or
       // call < 0 (EOF is guaranteed to be negative)
-      gc.comparesLt(valueNumber(i).getAUse(), 0, true, _)
+      gc.comparesLt(valueNumber(i).getAUse(), zero(), 0, true, _)
     )
   )
 }

cpp/ql/src/Likely Bugs/Format/NonConstantFormat.ql

@@ -37,37 +37,6 @@ class UncalledFunction extends Function {
   }
 }
 
-/** The `unsigned short` type. */
-class UnsignedShort extends ShortType {
-  UnsignedShort() { this.isUnsigned() }
-}
-
-/**
- * Holds if `t` cannot refer to a string. That is, it's a built-in
- * or arithmetic type that is not a "`char` like" type.
- */
-predicate cannotContainString(Type t) {
-  exists(Type unspecified |
-    unspecified = t.getUnspecifiedType() and
-    not unspecified instanceof UnknownType and
-    not unspecified instanceof CharType and
-    not unspecified instanceof WideCharType and
-    not unspecified instanceof Char8Type and
-    not unspecified instanceof Char16Type and
-    not unspecified instanceof Char32Type and
-    // C often defines `wchar_t` as `unsigned short`
-    not unspecified instanceof UnsignedShort
-  |
-    unspecified instanceof ArithmeticType or
-    unspecified instanceof BuiltInType
-  )
-}
-
-predicate dataFlowOrTaintFlowFunction(Function func, FunctionOutput output) {
-  func.(DataFlowFunction).hasDataFlow(_, output) or
-  func.(TaintFunction).hasTaintFlow(_, output)
-}
-
 /**
  * Holds if `node` is a non-constant source of data flow for non-const format string detection.
  * This is defined as either:
@@ -100,9 +69,7 @@ predicate isNonConst(DataFlow::Node node) {
   // Parameters of uncalled functions that aren't const
   exists(UncalledFunction f, Parameter p |
     f.getAParameter() = p and
-    // We pick the indirection of the parameter since this query is focused
-    // on strings.
-    p = node.asParameter(1) and
+    p = node.asParameter() and
     // Ignore main's argv parameter as it is already considered a `FlowSource`
     // not ignoring it will result in path redundancies
     (f.getName() = "main" implies p != f.getParameter(1))
@@ -115,27 +82,30 @@ predicate isNonConst(DataFlow::Node node) {
   //       are considered as possible non-const sources
   // The function's output must also not be const to be considered a non-const source
   exists(Function func, CallInstruction call |
-    not func.hasDefinition() and
-    func = call.getStaticCallTarget()
-  |
-    // Case 1: It's a known dataflow or taintflow function with flow to the return value
-    call.getUnconvertedResultExpression() = node.asIndirectExpr() and
-    not exists(FunctionOutput output |
-      dataFlowOrTaintFlowFunction(func, output) and
-      output.isReturnValueDeref(_) and
-      node = callOutput(call, output)
+    // NOTE: could use `Call` getAnArgument() instead of `CallInstruction` but requires two
+    // variables representing the same call in ordoer to use `callOutput` below.
+    exists(Expr arg |
+      call.getPositionalArgumentOperand(_).getDef().getUnconvertedResultExpression() = arg and
+      arg = node.asDefiningArgument()
     )
     or
-    // Case 2: It's a known dataflow or taintflow function with flow to an output parameter
-    exists(int i |
-      call.getPositionalArgumentOperand(i).getDef().getUnconvertedResultExpression() =
-        node.asDefiningArgument() and
-      not exists(FunctionOutput output |
-        dataFlowOrTaintFlowFunction(func, output) and
-        output.isParameterDeref(i, _) and
-        node = callOutput(call, output)
-      )
+    call.getUnconvertedResultExpression() = node.asIndirectExpr()
+  |
+    func = call.getStaticCallTarget() and
+    not exists(FunctionOutput output |
+      // NOTE: we must include dataflow and taintflow. e.g., including only dataflow we will find sprintf
+      // variant function's output are now possible non-const sources
+      pragma[only_bind_out](func).(DataFlowFunction).hasDataFlow(_, output) or
+      pragma[only_bind_out](func).(TaintFunction).hasTaintFlow(_, output)
+    |
+      node = callOutput(call, output)
     )
+  ) and
+  not exists(Call c |
+    c.getTarget().hasDefinition() and
+    if node instanceof DataFlow::DefinitionByReferenceNode
+    then c.getAnArgument() = node.asDefiningArgument()
+    else c = [node.asExpr(), node.asIndirectExpr()]
   )
 }
 
@@ -144,29 +114,18 @@ predicate isNonConst(DataFlow::Node node) {
  * `FormattingFunctionCall`.
  */
 predicate isSinkImpl(DataFlow::Node sink, Expr formatString) {
-  sink.asIndirectExpr() = formatString and
+  [sink.asExpr(), sink.asIndirectExpr()] = formatString and
   exists(FormattingFunctionCall fc | formatString = fc.getArgument(fc.getFormatParameterIndex()))
 }
 
 module NonConstFlowConfig implements DataFlow::ConfigSig {
-  predicate isSource(DataFlow::Node source) {
-    exists(Type t |
-      isNonConst(source) and
-      t = source.getType() and
-      not cannotContainString(t)
-    )
-  }
+  predicate isSource(DataFlow::Node source) { isNonConst(source) }
 
   predicate isSink(DataFlow::Node sink) { isSinkImpl(sink, _) }
 
   predicate isBarrier(DataFlow::Node node) {
     // Ignore tracing non-const through array indices
-    exists(ArrayExpr a | a.getArrayOffset() = node.asIndirectExpr())
-    or
-    exists(Type t |
-      t = node.getType() and
-      cannotContainString(t)
-    )
+    exists(ArrayExpr a | a.getArrayOffset() = node.asExpr())
   }
 }
 

cpp/ql/src/Likely Bugs/Memory Management/UninitializedLocal.ql

@@ -2,7 +2,7 @@
  * @name Potentially uninitialized local variable
  * @description Reading from a local variable that has not been assigned to
  *              will typically yield garbage.
- * @kind path-problem
+ * @kind problem
  * @id cpp/uninitialized-local
  * @problem.severity warning
  * @security-severity 7.8
@@ -15,7 +15,6 @@
 import cpp
 import semmle.code.cpp.ir.IR
 import semmle.code.cpp.ir.dataflow.MustFlow
-import PathGraph
 
 /**
  * Auxiliary predicate: Types that don't require initialization
@@ -90,4 +89,4 @@ where
   conf.hasFlowPath(source, sink) and
   isSinkImpl(sink.getInstruction(), va) and
   v = va.getTarget()
-select va, source, sink, "The variable $@ may not be initialized at this access.", v, v.getName()
+select va, "The variable $@ may not be initialized at this access.", v, v.getName()

cpp/ql/src/Likely Bugs/Protocols/TlsSettingsMisconfiguration.ql

@@ -1,9 +1,8 @@
 /**
- * @name boost::asio TLS settings misconfiguration
+ * @name Boost_asio TLS Settings Misconfiguration
  * @description Using the TLS or SSLv23 protocol from the boost::asio library, but not disabling deprecated protocols, or disabling minimum-recommended protocols.
  * @kind problem
  * @problem.severity error
- * @precision medium
  * @security-severity 7.5
  * @id cpp/boost/tls-settings-misconfiguration
  * @tags security
@@ -13,41 +12,34 @@
 import cpp
 import semmle.code.cpp.security.boostorg.asio.protocols
 
-predicate isSourceImpl(DataFlow::Node source, ConstructorCall cc) {
-  exists(BoostorgAsio::SslContextClass c | c.getAContructorCall() = cc and cc = source.asExpr())
-}
-
-predicate isSinkImpl(DataFlow::Node sink, FunctionCall fcSetOptions) {
-  exists(BoostorgAsio::SslSetOptionsFunction f |
-    f.getACallToThisFunction() = fcSetOptions and
-    fcSetOptions.getQualifier() = sink.asIndirectExpr()
-  )
-}
-
 module ExistsAnyFlowConfig implements DataFlow::ConfigSig {
-  predicate isSource(DataFlow::Node source) { isSourceImpl(source, _) }
+  predicate isSource(DataFlow::Node source) {
+    exists(BoostorgAsio::SslContextClass c | c.getAContructorCall() = source.asExpr())
+  }
 
-  predicate isSink(DataFlow::Node sink) { isSinkImpl(sink, _) }
+  predicate isSink(DataFlow::Node sink) {
+    exists(BoostorgAsio::SslSetOptionsFunction f, FunctionCall fcSetOptions |
+      f.getACallToThisFunction() = fcSetOptions and
+      fcSetOptions.getQualifier() = sink.asExpr()
+    )
+  }
 }
 
 module ExistsAnyFlow = DataFlow::Global<ExistsAnyFlowConfig>;
 
 bindingset[flag]
 predicate isOptionSet(ConstructorCall cc, int flag, FunctionCall fcSetOptions) {
-  exists(
-    VariableAccess contextSetOptions, BoostorgAsio::SslSetOptionsFunction f, DataFlow::Node source,
-    DataFlow::Node sink
-  |
-    isSourceImpl(source, cc) and
-    isSinkImpl(sink, fcSetOptions) and
-    ExistsAnyFlow::flow(source, sink) and
-    f.getACallToThisFunction() = fcSetOptions and
-    contextSetOptions = fcSetOptions.getQualifier() and
-    forex(Expr optionArgument |
-      optionArgument = fcSetOptions.getArgument(0) and
-      BoostorgAsio::SslOptionFlow::flowTo(DataFlow::exprNode(optionArgument))
-    |
-      optionArgument.getValue().toInt().bitShiftRight(16).bitAnd(flag) = flag
+  exists(VariableAccess contextSetOptions |
+    ExistsAnyFlow::flow(DataFlow::exprNode(cc), DataFlow::exprNode(contextSetOptions)) and
+    exists(BoostorgAsio::SslSetOptionsFunction f | f.getACallToThisFunction() = fcSetOptions |
+      contextSetOptions = fcSetOptions.getQualifier() and
+      forall(Expr optionArgument, Expr optionArgumentSource |
+        optionArgument = fcSetOptions.getArgument(0) and
+        BoostorgAsio::SslOptionFlow::flow(DataFlow::exprNode(optionArgumentSource),
+          DataFlow::exprNode(optionArgument))
+      |
+        optionArgument.getValue().toInt().bitShiftRight(16).bitAnd(flag) = flag
+      )
     )
   )
 }

cpp/ql/src/Likely Bugs/Protocols/UseOfDeprecatedHardcodedProtocol.ql

@@ -1,9 +1,8 @@
 /**
- * @name boost::asio use of deprecated hardcoded protocol
+ * @name boost::asio Use of deprecated hardcoded Protocol
  * @description Using a deprecated hard-coded protocol using the boost::asio library.
  * @kind problem
  * @problem.severity error
- * @precision medium
  * @security-severity 7.5
  * @id cpp/boost/use-of-deprecated-hardcoded-security-protocol
  * @tags security

cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.qhelp

@@ -1,50 +0,0 @@
-<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
-<qhelp>
-
-<overview>
-<p>
-Certain casts in C and C++ place no restrictions on the target type. For
-example, C style casts such as <code>(MyClass*)p</code> allows the programmer
-to cast any pointer <code>p</code> to an expression of type <code>MyClass*</code>.
-If the runtime type of <code>p</code> turns out to be a type that's incompatible
-with <code>MyClass</code>, this results in undefined behavior.
-</p>
-</overview>
-
-<recommendation>
-<p>
-If possible, use <code>dynamic_cast</code> to safely cast between polymorphic types.
-If <code>dynamic_cast</code> is not an option, use <code>static_cast</code> to restrict
-the kinds of conversions that the compiler is allowed to perform. If C++ style casts is
-not an option, carefully check that all casts are safe.
-</p>
-</recommendation>
-
-<example>
-<p>
-Consider the following class hierachy where we define a base class <code>Shape</code> and two
-derived classes <code>Circle</code> and <code>Square</code> that are mutually incompatible:
-</p>
-<sample src="TypeConfusionCommon.cpp"/>
-
-<p>
-The following code demonstrates a type confusion vulnerability where the programmer
-assumes that the runtime type of <code>p</code> is always a <code>Square</code>.
-However, if <code>p</code> is a <code>Circle</code>, the cast will result in undefined behavior.
-</p>
-<sample src="TypeConfusionBad.cpp"/>
-
-<p>
-The following code fixes the vulnerability by using <code>dynamic_cast</code> to
-safely cast between polymorphic types. If the cast fails, <code>dynamic_cast</code>
-returns a null pointer, which can be checked for and handled appropriately.
-</p>
-<sample src="TypeConfusionGood.cpp"/>
-</example>
-
-<references>
-<li>
-Microsoft Learn: <a href="https://learn.microsoft.com/en-us/cpp/cpp/type-conversions-and-type-safety-modern-cpp">Type conversions and type safety</a>.
-</li>
-</references>
-</qhelp>

cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.ql

@@ -1,263 +0,0 @@
-/**
- * @name Type confusion
- * @description Casting a value to an incompatible type can lead to undefined behavior.
- * @kind path-problem
- * @problem.severity warning
- * @security-severity 9.3
- * @precision medium
- * @id cpp/type-confusion
- * @tags security
- *       external/cwe/cwe-843
- */
-
-import cpp
-import semmle.code.cpp.dataflow.new.DataFlow
-import Flow::PathGraph
-
-/**
- * Holds if `f` is a field located at byte offset `offset` in `c`.
- *
- * Note that predicate is recursive, so that given the following:
- * ```cpp
- * struct S1 {
- *   int a;
- *   void* b;
- * };
- *
- * struct S2 {
- *   S1 s1;
- *   char c;
- * };
- * ```
- * both `hasAFieldWithOffset(S2, s1, 0)` and `hasAFieldWithOffset(S2, a, 0)`
- * holds.
- */
-predicate hasAFieldWithOffset(Class c, Field f, int offset) {
-  // Base case: `f` is a field in `c`.
-  f = c.getAField() and
-  offset = f.getByteOffset() and
-  not f.getUnspecifiedType().(Class).hasDefinition()
-  or
-  // Otherwise, we find the struct that is a field of `c` which then has
-  // the field `f` as a member.
-  exists(Field g |
-    g = c.getAField() and
-    // Find the field with the largest offset that's less than or equal to
-    // offset. That's the struct we need to search recursively.
-    g =
-      max(Field cand, int candOffset |
-        cand = c.getAField() and
-        candOffset = cand.getByteOffset() and
-        offset >= candOffset
-      |
-        cand order by candOffset
-      ) and
-    hasAFieldWithOffset(g.getUnspecifiedType(), f, offset - g.getByteOffset())
-  )
-}
-
-/** Holds if `f` is the last field of its declaring class. */
-predicate lastField(Field f) {
-  exists(Class c | c = f.getDeclaringType() |
-    f =
-      max(Field cand, int byteOffset |
-        cand.getDeclaringType() = c and byteOffset = f.getByteOffset()
-      |
-        cand order by byteOffset
-      )
-  )
-}
-
-/**
- * Holds if there exists a field in `c2` at offset `offset` that's compatible
- * with `f1`.
- */
-bindingset[f1, offset, c2]
-pragma[inline_late]
-predicate hasCompatibleFieldAtOffset(Field f1, int offset, Class c2) {
-  exists(Field f2 | hasAFieldWithOffset(c2, f2, offset) |
-    // Let's not deal with bit-fields for now.
-    f2 instanceof BitField
-    or
-    f1.getUnspecifiedType().getSize() = f2.getUnspecifiedType().getSize()
-    or
-    lastField(f1) and
-    f1.getUnspecifiedType().getSize() <= f2.getUnspecifiedType().getSize()
-  )
-}
-
-/**
- * Holds if `c1` is a prefix of `c2`.
- */
-bindingset[c1, c2]
-pragma[inline_late]
-predicate prefix(Class c1, Class c2) {
-  not c1.isPolymorphic() and
-  not c2.isPolymorphic() and
-  if c1 instanceof Union
-  then
-    // If it's a union we just verify that one of it's variants is compatible with the other class
-    exists(Field f1, int offset |
-      // Let's not deal with bit-fields for now.
-      not f1 instanceof BitField and
-      hasAFieldWithOffset(c1, f1, offset)
-    |
-      hasCompatibleFieldAtOffset(f1, offset, c2)
-    )
-  else
-    forall(Field f1, int offset |
-      // Let's not deal with bit-fields for now.
-      not f1 instanceof BitField and
-      hasAFieldWithOffset(c1, f1, offset)
-    |
-      hasCompatibleFieldAtOffset(f1, offset, c2)
-    )
-}
-
-/**
- * An unsafe cast is any explicit cast that is not
- * a `dynamic_cast`.
- */
-class UnsafeCast extends Cast {
-  private Class toType;
-
-  UnsafeCast() {
-    (
-      this instanceof CStyleCast
-      or
-      this instanceof StaticCast
-      or
-      this instanceof ReinterpretCast
-    ) and
-    toType = this.getExplicitlyConverted().getUnspecifiedType().stripType() and
-    not this.isImplicit() and
-    exists(TypeDeclarationEntry tde |
-      tde = toType.getDefinition() and
-      not tde.isFromUninstantiatedTemplate(_)
-    )
-  }
-
-  Class getConvertedType() { result = toType }
-
-  /**
-   * Holds if the result of this cast can safely be interpreted as a value of
-   * type `t`.
-   *
-   * The compatibility rules are as follows:
-   *
-   * 1. the result of `(T)x` is compatible with the type `T` for any `T`
-   * 2. the result of `(T)x` is compatible with the type `U` for any `U` such
-   *    that `U` is a subtype of `T`, or `T` is a subtype of `U`.
-   * 3. the result of `(T)x` is compatible with the type `U` if the list
-   *    of fields of `T` is a prefix of the list of fields of `U`.
-   *    For example, if `U` is `struct { unsigned char x; int y; };`
-   *    and `T` is `struct { unsigned char uc; };`.
-   * 4. the result of `(T)x` is compatible with the type `U` if the list
-   *    of fields of `U` is a prefix of the list of fields of `T`.
-   *
-   *    Condition 4 is a bit controversial, since it assumes that the additional
-   *    fields in `T` won't be accessed. This may result in some FNs.
-   */
-  bindingset[this, t]
-  pragma[inline_late]
-  predicate compatibleWith(Type t) {
-    // Conition 1
-    t.stripType() = this.getConvertedType()
-    or
-    // Condition 3
-    prefix(this.getConvertedType(), t.stripType())
-    or
-    // Condition 4
-    prefix(t.stripType(), this.getConvertedType())
-    or
-    // Condition 2 (a)
-    t.stripType().(Class).getABaseClass+() = this.getConvertedType()
-    or
-    // Condition 2 (b)
-    t.stripType() = this.getConvertedType().getABaseClass+()
-  }
-}
-
-/**
- * Holds if `source` is an allocation that allocates a value of type `type`.
- */
-predicate isSourceImpl(DataFlow::Node source, Class type) {
-  exists(AllocationExpr alloc |
-    alloc = source.asExpr() and
-    type = alloc.getAllocatedElementType().stripType() and
-    not exists(
-      alloc
-          .(NewOrNewArrayExpr)
-          .getAllocator()
-          .(OperatorNewAllocationFunction)
-          .getPlacementArgument()
-    )
-  ) and
-  exists(TypeDeclarationEntry tde |
-    tde = type.getDefinition() and
-    not tde.isFromUninstantiatedTemplate(_)
-  )
-}
-
-/** A configuration describing flow from an allocation to a potentially unsafe cast. */
-module Config implements DataFlow::ConfigSig {
-  predicate isSource(DataFlow::Node source) { isSourceImpl(source, _) }
-
-  predicate isBarrier(DataFlow::Node node) {
-    // We disable flow through global variables to reduce FPs from infeasible paths
-    node instanceof DataFlow::VariableNode
-    or
-    exists(Class c | c = node.getType().stripType() |
-      not c.hasDefinition()
-      or
-      exists(TypeDeclarationEntry tde |
-        tde = c.getDefinition() and
-        tde.isFromUninstantiatedTemplate(_)
-      )
-    )
-  }
-
-  predicate isSink(DataFlow::Node sink) { sink.asExpr() = any(UnsafeCast cast).getUnconverted() }
-
-  int fieldFlowBranchLimit() { result = 0 }
-}
-
-module Flow = DataFlow::Global<Config>;
-
-predicate relevantType(DataFlow::Node sink, Class allocatedType) {
-  exists(DataFlow::Node source |
-    Flow::flow(source, sink) and
-    isSourceImpl(source, allocatedType)
-  )
-}
-
-predicate isSinkImpl(
-  DataFlow::Node sink, Class allocatedType, Type convertedType, boolean compatible
-) {
-  exists(UnsafeCast cast |
-    relevantType(sink, allocatedType) and
-    sink.asExpr() = cast.getUnconverted() and
-    convertedType = cast.getConvertedType()
-  |
-    if cast.compatibleWith(allocatedType) then compatible = true else compatible = false
-  )
-}
-
-from
-  Flow::PathNode source, Flow::PathNode sink, Type badSourceType, Type sinkType,
-  DataFlow::Node sinkNode
-where
-  Flow::flowPath(source, sink) and
-  sinkNode = sink.getNode() and
-  isSourceImpl(source.getNode(), badSourceType) and
-  isSinkImpl(sinkNode, badSourceType, sinkType, false) and
-  // If there is any flow that would result in a valid cast then we don't
-  // report an alert here. This reduces the number of FPs from infeasible paths
-  // significantly.
-  not exists(DataFlow::Node goodSource, Type goodSourceType |
-    isSourceImpl(goodSource, goodSourceType) and
-    isSinkImpl(sinkNode, goodSourceType, sinkType, true) and
-    Flow::flow(goodSource, sinkNode)
-  )
-select sinkNode, source, sink, "Conversion from $@ to $@ is invalid.", badSourceType,
-  badSourceType.toString(), sinkType, sinkType.toString()

cpp/ql/src/Security/CWE/CWE-843/TypeConfusionBad.cpp

@@ -1,7 +0,0 @@
-void allocate_and_draw_bad() {
-  Shape* shape = new Circle;
-  // ...
-  // BAD: Assumes that shape is always a Square
-  Square* square = static_cast<Square*>(shape);
-  int length = square->getLength();
-}

cpp/ql/src/Security/CWE/CWE-843/TypeConfusionCommon.cpp

@@ -1,25 +0,0 @@
-struct Shape {
-  virtual ~Shape();
-
-  virtual void draw() = 0;
-};
-
-struct Circle : public Shape {
-  Circle();
-
-  void draw() override {
-    /* ... */
-  }
-
-  int getRadius();
-};
-
-struct Square : public Shape {
-  Square();
-
-  void draw() override {
-    /* ... */
-  }
-
-  int getLength();
-};

cpp/ql/src/Security/CWE/CWE-843/TypeConfusionGood.cpp

@@ -1,11 +0,0 @@
-void allocate_and_draw_good() {
-  Shape* shape = new Circle;
-  // ...
-  // GOOD: Dynamically checks if shape is a Square
-  Square* square = dynamic_cast<Square*>(shape);
-  if(square) {
-    int length = square->getLength();
-  } else {
-    // handle error
-  }
-}

cpp/ql/src/Summary/LinesOfUserCode.ql

@@ -4,7 +4,6 @@
  * @kind metric
  * @tags summary
  *       lines-of-code
- *       debug
  * @id cpp/summary/lines-of-user-code
  */
 

cpp/ql/src/change-notes/2024-02-16-modelled-functions-block-flow.md

@@ -1,6 +1,4 @@
-## 0.9.6
-
-### Minor Analysis Improvements
-
-* The "non-constant format string" query (`cpp/non-constant-format`) has been converted to a `path-problem` query.
+---
+category: minorAnalysis
+---
 * The new C/C++ dataflow and taint-tracking libraries (`semmle.code.cpp.dataflow.new.DataFlow` and `semmle.code.cpp.dataflow.new.TaintTracking`) now implicitly assume that dataflow and taint modelled via `DataFlowFunction` and `TaintFunction` always fully overwrite their buffers and thus act as flow barriers. As a result, many dataflow and taint-tracking queries now produce fewer false positives. To remove this assumption and go back to the previous behavior for a given model, one can override the new `isPartialWrite` predicate.

cpp/ql/src/change-notes/2024-02-29-non-constant-format-path-query.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The "non-constant format string" query (`cpp/non-constant-format`) has been converted to a `path-problem` query.

cpp/ql/src/change-notes/released/0.9.7.md

@@ -1,3 +0,0 @@
-## 0.9.7
-
-No user-facing changes.

cpp/ql/src/change-notes/released/0.9.8.md

@@ -1,3 +0,0 @@
-## 0.9.8
-
-No user-facing changes.

cpp/ql/src/change-notes/released/0.9.9.md

@@ -1,15 +0,0 @@
-## 0.9.9
-
-### New Queries
-
-* Added a new query, `cpp/type-confusion`, to detect casts to invalid types.
-
-### Query Metadata Changes
-
-* `@precision medium` metadata was added to the `cpp/boost/tls-settings-misconfiguration` and `cpp/boost/use-of-deprecated-hardcoded-security-protocol` queries, and these queries are now included in the security-extended suite. The `@name` metadata of these queries were also updated.
-
-### Minor Analysis Improvements
-
-* The "Missing return-value check for a 'scanf'-like function" query (`cpp/missing-check-scanf`) has been converted to a `path-problem` query.
-* The "Potentially uninitialized local variable" query (`cpp/uninitialized-local`) has been converted to a `path-problem` query.
-* Added models for `GLib` allocation and deallocation functions.