Extend C# control flow elements with type mentions

csharp/ql/lib/semmle/code/csharp/ExprOrStmtParent.qll

@@ -121,6 +121,13 @@ private module Cached {
     result = getAChildExpr(parent)
     or
     result = parent.getAChildStmt()
+    or
+    result =
+      any(TypeMention tm |
+        tm.getTarget() = parent
+        or
+        tm.getParent+().getTarget() = parent
+      )
   }
 
   private predicate parent(ControlFlowElement child, ExprOrStmtParent parent) {

csharp/ql/lib/semmle/code/csharp/Type.qll

@@ -6,6 +6,7 @@ import Generics
 import Location
 import Namespace
 import Property
+import semmle.code.csharp.controlflow.ControlFlowElement
 private import Conversion
 private import semmle.code.csharp.metrics.Coupling
 private import TypeRef
@@ -1286,7 +1287,7 @@ class TupleType extends ValueType, @tuple_type {
  * A type mention, that is, any mention of a type in a source code file.
  * For example, `int` is mentioned in `int M() { return 1; }`.
  */
-class TypeMention extends @type_mention {
+class TypeMention extends ControlFlowElement, @type_mention {
   Type type;
   @type_mention_parent parent;
 
@@ -1319,13 +1320,13 @@ class TypeMention extends @type_mention {
    * }
    * ```
    */
-  TypeMention getParent() { result = parent }
+  override TypeMention getParent() { result = parent }
 
   /** Gets a textual representation of this type mention. */
-  string toString() { result = type.toString() }
+  override string toString() { result = type.toString() }
 
   /** Gets the location of this type mention. */
-  Location getLocation() { type_mention_location(this, result) }
+  override Location getALocation() { type_mention_location(this, result) }
 }
 
 /**

csharp/ql/lib/semmle/code/csharp/controlflow/ControlFlowElement.qll

@@ -20,7 +20,7 @@ class ControlFlowElementOrCallable extends ExprOrStmtParent, TControlFlowElement
  */
 class ControlFlowElement extends ControlFlowElementOrCallable, @control_flow_element {
   /** Gets the enclosing callable of this element, if any. */
-  Callable getEnclosingCallable() { none() }
+  Callable getEnclosingCallable() { enclosingCallable(this, result) }
 
   /** Gets the assembly that this element was compiled into. */
   Assembly getAssembly() {

csharp/ql/lib/semmlecode.csharp.dbscheme

@@ -219,7 +219,7 @@ overlayChangedFiles(
 /** ELEMENTS **/
 
 @element = @declaration | @stmt | @expr | @modifier | @attribute | @namespace_declaration
-         | @using_directive | @type_parameter_constraints | @externalDataElement
+         | @using_directive | @type_parameter_constraints | @type_mention | @externalDataElement
          | @xmllocatable | @asp_element | @namespace | @preprocessor_directive;
 
 @declaration = @callable | @generic | @assignable | @namespace;
@@ -1369,7 +1369,7 @@ compiler_generated(unique int id: @element ref);
 
 /** CONTROL/DATA FLOW **/
 
-@control_flow_element = @stmt | @expr | @parameter;
+@control_flow_element = @stmt | @expr | @parameter | @type_mention;
 
 /* XML Files */
 

go/ql/test/library-tests/semmle/go/concepts/LoggerCall/logrus.go

@@ -13,7 +13,7 @@ func logSomething(entry *logrus.Entry) {
 	entry.Traceln(text) // $ logger=text
 }
 
-func logrusCalls(selector int) {
+func logrusCalls() {
 	err := errors.New("Error")
 	var fields logrus.Fields = nil
 	var fn logrus.LogFunction = nil
@@ -27,15 +27,11 @@ func logrusCalls(selector int) {
 	tmp = logrus.WithFields(fields) // $ logger=fields
 	logSomething(tmp)
 
-	logrus.Error(text)      // $ logger=text
-	logrus.Infof(fmt, text) // $ logger=fmt logger=text
-	if selector == 0 {
-		logrus.Fatalf(fmt, text) // $ logger=fmt logger=text
-	} else if selector == 1 {
-		logrus.Panicln(text) // $ logger=text
-	} else if selector == 2 {
-		logrus.FatalFn(fn) // $ logger=fn
-	}
+	logrus.Error(text)       // $ logger=text
+	logrus.Fatalf(fmt, text) // $ logger=fmt logger=text
+	logrus.Panicln(text)     // $ logger=text
+	logrus.Infof(fmt, text)  // $ logger=fmt logger=text
+	logrus.FatalFn(fn)       // $ logger=fn
 
 	// components corresponding to the format specifier "%T" are not considered vulnerable
 	logrus.Infof("%s: found type %T", text, v)  // $ logger="%s: found type %T" logger=text type-logger=v

go/ql/test/library-tests/semmle/go/concepts/LoggerCall/main.go

@@ -8,6 +8,6 @@ var v []byte
 
 func main() {
 	glogTest(len(v))
-	stdlib(len(v))
+	stdlib()
 	slogTest()
 }

go/ql/test/library-tests/semmle/go/concepts/LoggerCall/stdlib.go

@@ -4,69 +4,37 @@ import (
 	"log"
 )
 
-func stdlib(selector int) {
+func stdlib() {
 	var logger log.Logger
 	logger.SetPrefix("prefix: ")
-	switch selector {
-	case 0:
-		logger.Fatal(text) // $ logger=text
-	case 1:
-		logger.Fatalf(fmt, text) // $ logger=fmt logger=text
-	case 2:
-		logger.Fatalln(text) // $ logger=text
-	case 3:
-		logger.Panic(text) // $ logger=text
-	case 4:
-		logger.Panicf(fmt, text) // $ logger=fmt logger=text
-	case 5:
-		logger.Panicln(text) // $ logger=text
-	case 6:
-		logger.Print(text) // $ logger=text
-	case 7:
-		logger.Printf(fmt, text) // $ logger=fmt logger=text
-	case 8:
-		logger.Println(text) // $ logger=text
-	}
+	logger.Fatal(text)       // $ logger=text
+	logger.Fatalf(fmt, text) // $ logger=fmt logger=text
+	logger.Fatalln(text)     // $ logger=text
+	logger.Panic(text)       // $ logger=text
+	logger.Panicf(fmt, text) // $ logger=fmt logger=text
+	logger.Panicln(text)     // $ logger=text
+	logger.Print(text)       // $ logger=text
+	logger.Printf(fmt, text) // $ logger=fmt logger=text
+	logger.Println(text)     // $ logger=text
 
 	// components corresponding to the format specifier "%T" are not considered vulnerable
-	switch selector {
-	case 9:
-		logger.Fatalf("%s: found type %T", text, v) // $ logger="%s: found type %T" logger=text type-logger=v
-	case 10:
-		logger.Panicf("%s: found type %T", text, v) // $ logger="%s: found type %T" logger=text type-logger=v
-	case 11:
-		logger.Printf("%s: found type %T", text, v) // $ logger="%s: found type %T" logger=text type-logger=v
-	}
+	logger.Fatalf("%s: found type %T", text, v) // $ logger="%s: found type %T" logger=text type-logger=v
+	logger.Panicf("%s: found type %T", text, v) // $ logger="%s: found type %T" logger=text type-logger=v
+	logger.Printf("%s: found type %T", text, v) // $ logger="%s: found type %T" logger=text type-logger=v
 
 	log.SetPrefix("prefix: ")
-	switch selector {
-	case 12:
-		log.Fatal(text) // $ logger=text
-	case 13:
-		log.Fatalf(fmt, text) // $ logger=fmt logger=text
-	case 14:
-		log.Fatalln(text) // $ logger=text
-	case 15:
-		log.Panic(text) // $ logger=text
-	case 16:
-		log.Panicf(fmt, text) // $ logger=fmt logger=text
-	case 17:
-		log.Panicln(text) // $ logger=text
-	case 18:
-		log.Print(text) // $ logger=text
-	case 19:
-		log.Printf(fmt, text) // $ logger=fmt logger=text
-	case 20:
-		log.Println(text) // $ logger=text
-	}
+	log.Fatal(text)       // $ logger=text
+	log.Fatalf(fmt, text) // $ logger=fmt logger=text
+	log.Fatalln(text)     // $ logger=text
+	log.Panic(text)       // $ logger=text
+	log.Panicf(fmt, text) // $ logger=fmt logger=text
+	log.Panicln(text)     // $ logger=text
+	log.Print(text)       // $ logger=text
+	log.Printf(fmt, text) // $ logger=fmt logger=text
+	log.Println(text)     // $ logger=text
 
 	// components corresponding to the format specifier "%T" are not considered vulnerable
-	switch selector {
-	case 21:
-		log.Fatalf("%s: found type %T", text, v) // $ logger="%s: found type %T" logger=text type-logger=v
-	case 22:
-		log.Panicf("%s: found type %T", text, v) // $ logger="%s: found type %T" logger=text type-logger=v
-	case 23:
-		log.Printf("%s: found type %T", text, v) // $ logger="%s: found type %T" logger=text type-logger=v
-	}
+	log.Fatalf("%s: found type %T", text, v) // $ logger="%s: found type %T" logger=text type-logger=v
+	log.Panicf("%s: found type %T", text, v) // $ logger="%s: found type %T" logger=text type-logger=v
+	log.Printf("%s: found type %T", text, v) // $ logger="%s: found type %T" logger=text type-logger=v
 }

go/ql/test/library-tests/semmle/go/controlflow/ControlFlowGraph/ControlFlowNode_getASuccessor.expected

@@ -34,265 +34,6 @@
 | DuplicateSwitchCase.go:16:1:16:14 | function declaration | DuplicateSwitchCase.go:0:0:0:0 | exit |
 | DuplicateSwitchCase.go:16:6:16:9 | skip | DuplicateSwitchCase.go:16:1:16:14 | function declaration |
 | DuplicateSwitchCase.go:16:13:16:14 | skip | DuplicateSwitchCase.go:16:1:16:14 | exit |
-| epilogues.go:0:0:0:0 | entry | epilogues.go:3:1:3:12 | skip |
-| epilogues.go:3:1:3:12 | skip | epilogues.go:8:1:10:1 | skip |
-| epilogues.go:8:1:10:1 | skip | epilogues.go:12:21:12:23 | skip |
-| epilogues.go:12:1:14:1 | entry | epilogues.go:12:7:12:7 | argument corresponding to l |
-| epilogues.go:12:1:14:1 | function declaration | epilogues.go:16:20:16:27 | skip |
-| epilogues.go:12:7:12:7 | argument corresponding to l | epilogues.go:12:7:12:7 | initialization of l |
-| epilogues.go:12:7:12:7 | initialization of l | epilogues.go:12:25:12:27 | argument corresponding to msg |
-| epilogues.go:12:21:12:23 | skip | epilogues.go:12:1:14:1 | function declaration |
-| epilogues.go:12:25:12:27 | argument corresponding to msg | epilogues.go:12:25:12:27 | initialization of msg |
-| epilogues.go:12:25:12:27 | initialization of msg | epilogues.go:12:37:12:40 | argument corresponding to code |
-| epilogues.go:12:37:12:40 | argument corresponding to code | epilogues.go:12:37:12:40 | initialization of code |
-| epilogues.go:12:37:12:40 | initialization of code | epilogues.go:13:2:13:12 | selection of Println |
-| epilogues.go:13:2:13:12 | selection of Println | epilogues.go:13:14:13:14 | l |
-| epilogues.go:13:2:13:33 | call to Println | epilogues.go:12:1:14:1 | exit |
-| epilogues.go:13:14:13:14 | implicit dereference | epilogues.go:12:1:14:1 | exit |
-| epilogues.go:13:14:13:14 | implicit dereference | epilogues.go:13:14:13:21 | selection of prefix |
-| epilogues.go:13:14:13:14 | l | epilogues.go:13:14:13:14 | implicit dereference |
-| epilogues.go:13:14:13:21 | selection of prefix | epilogues.go:13:24:13:26 | msg |
-| epilogues.go:13:24:13:26 | msg | epilogues.go:13:29:13:32 | code |
-| epilogues.go:13:29:13:32 | code | epilogues.go:13:2:13:33 | call to Println |
-| epilogues.go:16:1:18:1 | entry | epilogues.go:16:7:16:7 | argument corresponding to l |
-| epilogues.go:16:1:18:1 | function declaration | epilogues.go:23:6:23:15 | skip |
-| epilogues.go:16:7:16:7 | argument corresponding to l | epilogues.go:16:7:16:7 | initialization of l |
-| epilogues.go:16:7:16:7 | initialization of l | epilogues.go:16:29:16:31 | argument corresponding to msg |
-| epilogues.go:16:20:16:27 | skip | epilogues.go:16:1:18:1 | function declaration |
-| epilogues.go:16:29:16:31 | argument corresponding to msg | epilogues.go:16:29:16:31 | initialization of msg |
-| epilogues.go:16:29:16:31 | initialization of msg | epilogues.go:17:2:17:12 | selection of Println |
-| epilogues.go:17:2:17:12 | selection of Println | epilogues.go:17:14:17:14 | l |
-| epilogues.go:17:2:17:27 | call to Println | epilogues.go:16:1:18:1 | exit |
-| epilogues.go:17:14:17:14 | l | epilogues.go:17:14:17:21 | selection of prefix |
-| epilogues.go:17:14:17:21 | selection of prefix | epilogues.go:17:24:17:26 | msg |
-| epilogues.go:17:24:17:26 | msg | epilogues.go:17:2:17:27 | call to Println |
-| epilogues.go:23:1:27:1 | entry | epilogues.go:24:5:24:5 | skip |
-| epilogues.go:23:1:27:1 | function declaration | epilogues.go:31:6:31:13 | skip |
-| epilogues.go:23:6:23:15 | skip | epilogues.go:23:1:27:1 | function declaration |
-| epilogues.go:24:5:24:5 | assignment to r | epilogues.go:24:21:24:21 | r |
-| epilogues.go:24:5:24:5 | skip | epilogues.go:24:10:24:16 | recover |
-| epilogues.go:24:10:24:16 | recover | epilogues.go:24:10:24:18 | call to recover |
-| epilogues.go:24:10:24:18 | call to recover | epilogues.go:24:5:24:5 | assignment to r |
-| epilogues.go:24:21:24:21 | r | epilogues.go:24:26:24:28 | nil |
-| epilogues.go:24:21:24:28 | ...!=... | epilogues.go:23:1:27:1 | exit |
-| epilogues.go:24:21:24:28 | ...!=... | epilogues.go:24:21:24:28 | ...!=... is false |
-| epilogues.go:24:21:24:28 | ...!=... | epilogues.go:24:21:24:28 | ...!=... is true |
-| epilogues.go:24:21:24:28 | ...!=... is false | epilogues.go:23:1:27:1 | exit |
-| epilogues.go:24:21:24:28 | ...!=... is true | epilogues.go:25:3:25:13 | selection of Println |
-| epilogues.go:24:26:24:28 | nil | epilogues.go:24:21:24:28 | ...!=... |
-| epilogues.go:25:3:25:13 | selection of Println | epilogues.go:25:15:25:26 | "recovered:" |
-| epilogues.go:25:3:25:30 | call to Println | epilogues.go:23:1:27:1 | exit |
-| epilogues.go:25:15:25:26 | "recovered:" | epilogues.go:25:29:25:29 | r |
-| epilogues.go:25:29:25:29 | r | epilogues.go:25:3:25:30 | call to Println |
-| epilogues.go:31:1:33:1 | entry | epilogues.go:31:15:31:15 | argument corresponding to x |
-| epilogues.go:31:1:33:1 | function declaration | epilogues.go:36:6:36:12 | skip |
-| epilogues.go:31:6:31:13 | skip | epilogues.go:31:1:33:1 | function declaration |
-| epilogues.go:31:15:31:15 | argument corresponding to x | epilogues.go:31:15:31:15 | initialization of x |
-| epilogues.go:31:15:31:15 | initialization of x | epilogues.go:32:9:32:9 | x |
-| epilogues.go:32:2:32:13 | return statement | epilogues.go:31:1:33:1 | exit |
-| epilogues.go:32:9:32:9 | x | epilogues.go:32:13:32:13 | 2 |
-| epilogues.go:32:9:32:13 | ...*... | epilogues.go:32:2:32:13 | return statement |
-| epilogues.go:32:13:32:13 | 2 | epilogues.go:32:9:32:13 | ...*... |
-| epilogues.go:36:1:38:1 | entry | epilogues.go:37:2:37:12 | selection of Println |
-| epilogues.go:36:1:38:1 | function declaration | epilogues.go:42:6:42:18 | skip |
-| epilogues.go:36:6:36:12 | skip | epilogues.go:36:1:38:1 | function declaration |
-| epilogues.go:37:2:37:12 | selection of Println | epilogues.go:37:14:37:19 | "void" |
-| epilogues.go:37:2:37:20 | call to Println | epilogues.go:36:1:38:1 | exit |
-| epilogues.go:37:14:37:19 | "void" | epilogues.go:37:2:37:20 | call to Println |
-| epilogues.go:42:1:48:1 | entry | epilogues.go:42:20:42:20 | argument corresponding to x |
-| epilogues.go:42:1:48:1 | function declaration | epilogues.go:51:6:51:21 | skip |
-| epilogues.go:42:6:42:18 | skip | epilogues.go:42:1:48:1 | function declaration |
-| epilogues.go:42:20:42:20 | argument corresponding to x | epilogues.go:42:20:42:20 | initialization of x |
-| epilogues.go:42:20:42:20 | initialization of x | epilogues.go:42:28:42:33 | zero value for result |
-| epilogues.go:42:28:42:33 | implicit read of result | epilogues.go:42:40:42:42 | implicit read of err |
-| epilogues.go:42:28:42:33 | initialization of result | epilogues.go:42:40:42:42 | zero value for err |
-| epilogues.go:42:28:42:33 | zero value for result | epilogues.go:42:28:42:33 | initialization of result |
-| epilogues.go:42:40:42:42 | implicit read of err | epilogues.go:42:1:48:1 | exit |
-| epilogues.go:42:40:42:42 | initialization of err | epilogues.go:43:5:43:5 | x |
-| epilogues.go:42:40:42:42 | zero value for err | epilogues.go:42:40:42:42 | initialization of err |
-| epilogues.go:43:5:43:5 | x | epilogues.go:43:9:43:9 | 0 |
-| epilogues.go:43:5:43:9 | ...<... | epilogues.go:43:5:43:9 | ...<... is false |
-| epilogues.go:43:5:43:9 | ...<... | epilogues.go:43:5:43:9 | ...<... is true |
-| epilogues.go:43:5:43:9 | ...<... is false | epilogues.go:47:9:47:9 | x |
-| epilogues.go:43:5:43:9 | ...<... is true | epilogues.go:44:3:44:8 | skip |
-| epilogues.go:43:9:43:9 | 0 | epilogues.go:43:5:43:9 | ...<... |
-| epilogues.go:44:3:44:8 | assignment to result | epilogues.go:45:3:45:8 | return statement |
-| epilogues.go:44:3:44:8 | skip | epilogues.go:44:13:44:13 | x |
-| epilogues.go:44:12:44:13 | -... | epilogues.go:44:3:44:8 | assignment to result |
-| epilogues.go:44:13:44:13 | x | epilogues.go:44:12:44:13 | -... |
-| epilogues.go:45:3:45:8 | return statement | epilogues.go:42:28:42:33 | implicit read of result |
-| epilogues.go:47:2:47:14 | return statement | epilogues.go:42:28:42:33 | implicit read of result |
-| epilogues.go:47:9:47:9 | implicit write of result | epilogues.go:47:12:47:14 | nil |
-| epilogues.go:47:9:47:9 | x | epilogues.go:47:9:47:9 | implicit write of result |
-| epilogues.go:47:12:47:14 | implicit write of err | epilogues.go:47:2:47:14 | return statement |
-| epilogues.go:47:12:47:14 | nil | epilogues.go:47:12:47:14 | implicit write of err |
-| epilogues.go:51:1:54:1 | entry | epilogues.go:51:23:51:23 | argument corresponding to x |
-| epilogues.go:51:1:54:1 | function declaration | epilogues.go:59:6:59:25 | skip |
-| epilogues.go:51:6:51:21 | skip | epilogues.go:51:1:54:1 | function declaration |
-| epilogues.go:51:23:51:23 | argument corresponding to x | epilogues.go:51:23:51:23 | initialization of x |
-| epilogues.go:51:23:51:23 | initialization of x | epilogues.go:51:31:51:31 | zero value for n |
-| epilogues.go:51:31:51:31 | implicit read of n | epilogues.go:51:1:54:1 | exit |
-| epilogues.go:51:31:51:31 | initialization of n | epilogues.go:52:2:52:2 | skip |
-| epilogues.go:51:31:51:31 | zero value for n | epilogues.go:51:31:51:31 | initialization of n |
-| epilogues.go:52:2:52:2 | assignment to n | epilogues.go:53:2:53:7 | return statement |
-| epilogues.go:52:2:52:2 | skip | epilogues.go:52:6:52:6 | x |
-| epilogues.go:52:6:52:6 | x | epilogues.go:52:10:52:10 | 1 |
-| epilogues.go:52:6:52:10 | ...+... | epilogues.go:52:2:52:2 | assignment to n |
-| epilogues.go:52:10:52:10 | 1 | epilogues.go:52:6:52:10 | ...+... |
-| epilogues.go:53:2:53:7 | return statement | epilogues.go:51:31:51:31 | implicit read of n |
-| epilogues.go:59:1:62:1 | entry | epilogues.go:59:27:59:27 | argument corresponding to l |
-| epilogues.go:59:1:62:1 | function declaration | epilogues.go:66:6:66:26 | skip |
-| epilogues.go:59:6:59:25 | skip | epilogues.go:59:1:62:1 | function declaration |
-| epilogues.go:59:27:59:27 | argument corresponding to l | epilogues.go:59:27:59:27 | initialization of l |
-| epilogues.go:59:27:59:27 | initialization of l | epilogues.go:59:41:59:45 | argument corresponding to items |
-| epilogues.go:59:41:59:45 | argument corresponding to items | epilogues.go:59:41:59:45 | initialization of items |
-| epilogues.go:59:41:59:45 | initialization of items | epilogues.go:60:8:60:8 | l |
-| epilogues.go:60:2:60:33 | defer statement | epilogues.go:61:2:61:12 | selection of Println |
-| epilogues.go:60:8:60:8 | l | epilogues.go:60:8:60:12 | selection of log |
-| epilogues.go:60:8:60:12 | selection of log | epilogues.go:60:14:60:20 | "count" |
-| epilogues.go:60:8:60:33 | call to log | epilogues.go:59:1:62:1 | exit |
-| epilogues.go:60:14:60:20 | "count" | epilogues.go:60:23:60:25 | len |
-| epilogues.go:60:23:60:25 | len | epilogues.go:60:27:60:31 | items |
-| epilogues.go:60:23:60:32 | call to len | epilogues.go:60:2:60:33 | defer statement |
-| epilogues.go:60:27:60:31 | items | epilogues.go:60:23:60:32 | call to len |
-| epilogues.go:61:2:61:12 | selection of Println | epilogues.go:61:14:61:25 | "processing" |
-| epilogues.go:61:2:61:38 | call to Println | epilogues.go:60:8:60:33 | call to log |
-| epilogues.go:61:14:61:25 | "processing" | epilogues.go:61:28:61:30 | len |
-| epilogues.go:61:28:61:30 | len | epilogues.go:61:32:61:36 | items |
-| epilogues.go:61:28:61:37 | call to len | epilogues.go:61:2:61:38 | call to Println |
-| epilogues.go:61:32:61:36 | items | epilogues.go:61:28:61:37 | call to len |
-| epilogues.go:66:1:71:1 | entry | epilogues.go:66:28:66:33 | argument corresponding to prefix |
-| epilogues.go:66:1:71:1 | function declaration | epilogues.go:77:6:77:20 | skip |
-| epilogues.go:66:6:66:26 | skip | epilogues.go:66:1:71:1 | function declaration |
-| epilogues.go:66:28:66:33 | argument corresponding to prefix | epilogues.go:66:28:66:33 | initialization of prefix |
-| epilogues.go:66:28:66:33 | initialization of prefix | epilogues.go:67:2:67:2 | skip |
-| epilogues.go:67:2:67:2 | assignment to l | epilogues.go:68:8:68:8 | l |
-| epilogues.go:67:2:67:2 | skip | epilogues.go:67:7:67:31 | struct literal |
-| epilogues.go:67:7:67:31 | struct literal | epilogues.go:67:25:67:30 | prefix |
-| epilogues.go:67:17:67:30 | init of key-value pair | epilogues.go:67:2:67:2 | assignment to l |
-| epilogues.go:67:25:67:30 | prefix | epilogues.go:67:17:67:30 | init of key-value pair |
-| epilogues.go:68:2:68:24 | defer statement | epilogues.go:69:10:69:10 | l |
-| epilogues.go:68:8:68:8 | l | epilogues.go:68:8:68:17 | selection of logValue |
-| epilogues.go:68:8:68:17 | selection of logValue | epilogues.go:68:19:68:23 | "bye" |
-| epilogues.go:68:8:68:24 | call to logValue | epilogues.go:66:1:71:1 | exit |
-| epilogues.go:68:19:68:23 | "bye" | epilogues.go:68:2:68:24 | defer statement |
-| epilogues.go:69:2:69:25 | defer statement | epilogues.go:70:2:70:12 | selection of Println |
-| epilogues.go:69:8:69:15 | selection of log | epilogues.go:69:17:69:21 | "ptr" |
-| epilogues.go:69:8:69:25 | call to log | epilogues.go:68:8:68:24 | call to logValue |
-| epilogues.go:69:9:69:10 | &... | epilogues.go:69:8:69:15 | selection of log |
-| epilogues.go:69:10:69:10 | l | epilogues.go:69:9:69:10 | &... |
-| epilogues.go:69:17:69:21 | "ptr" | epilogues.go:69:24:69:24 | 7 |
-| epilogues.go:69:24:69:24 | 7 | epilogues.go:69:2:69:25 | defer statement |
-| epilogues.go:70:2:70:12 | selection of Println | epilogues.go:70:14:70:19 | "body" |
-| epilogues.go:70:2:70:20 | call to Println | epilogues.go:69:8:69:25 | call to log |
-| epilogues.go:70:14:70:19 | "body" | epilogues.go:70:2:70:20 | call to Println |
-| epilogues.go:77:1:82:1 | entry | epilogues.go:77:22:77:22 | argument corresponding to x |
-| epilogues.go:77:1:82:1 | function declaration | epilogues.go:87:6:87:20 | skip |
-| epilogues.go:77:6:77:20 | skip | epilogues.go:77:1:82:1 | function declaration |
-| epilogues.go:77:22:77:22 | argument corresponding to x | epilogues.go:77:22:77:22 | initialization of x |
-| epilogues.go:77:22:77:22 | initialization of x | epilogues.go:78:8:80:2 | function literal |
-| epilogues.go:78:2:80:15 | defer statement | epilogues.go:81:2:81:12 | selection of Println |
-| epilogues.go:78:8:80:2 | entry | epilogues.go:78:13:78:17 | argument corresponding to label |
-| epilogues.go:78:8:80:2 | function literal | epilogues.go:80:4:80:9 | "done" |
-| epilogues.go:78:8:80:15 | function call | epilogues.go:77:1:82:1 | exit |
-| epilogues.go:78:13:78:17 | argument corresponding to label | epilogues.go:78:13:78:17 | initialization of label |
-| epilogues.go:78:13:78:17 | initialization of label | epilogues.go:78:27:78:27 | argument corresponding to n |
-| epilogues.go:78:27:78:27 | argument corresponding to n | epilogues.go:78:27:78:27 | initialization of n |
-| epilogues.go:78:27:78:27 | initialization of n | epilogues.go:79:3:79:13 | selection of Println |
-| epilogues.go:79:3:79:13 | selection of Println | epilogues.go:79:15:79:19 | label |
-| epilogues.go:79:3:79:23 | call to Println | epilogues.go:78:8:80:2 | exit |
-| epilogues.go:79:15:79:19 | label | epilogues.go:79:22:79:22 | n |
-| epilogues.go:79:22:79:22 | n | epilogues.go:79:3:79:23 | call to Println |
-| epilogues.go:80:4:80:9 | "done" | epilogues.go:80:12:80:12 | x |
-| epilogues.go:80:12:80:12 | x | epilogues.go:80:14:80:14 | 1 |
-| epilogues.go:80:12:80:14 | ...+... | epilogues.go:78:2:80:15 | defer statement |
-| epilogues.go:80:14:80:14 | 1 | epilogues.go:80:12:80:14 | ...+... |
-| epilogues.go:81:2:81:12 | selection of Println | epilogues.go:81:14:81:19 | "body" |
-| epilogues.go:81:2:81:23 | call to Println | epilogues.go:78:8:80:15 | function call |
-| epilogues.go:81:14:81:19 | "body" | epilogues.go:81:22:81:22 | x |
-| epilogues.go:81:22:81:22 | x | epilogues.go:81:2:81:23 | call to Println |
-| epilogues.go:87:1:98:1 | entry | epilogues.go:87:22:87:22 | argument corresponding to x |
-| epilogues.go:87:1:98:1 | function declaration | epilogues.go:102:6:102:24 | skip |
-| epilogues.go:87:6:87:20 | skip | epilogues.go:87:1:98:1 | function declaration |
-| epilogues.go:87:22:87:22 | argument corresponding to x | epilogues.go:87:22:87:22 | initialization of x |
-| epilogues.go:87:22:87:22 | initialization of x | epilogues.go:87:30:87:35 | zero value for result |
-| epilogues.go:87:30:87:35 | implicit read of result | epilogues.go:87:1:98:1 | exit |
-| epilogues.go:87:30:87:35 | initialization of result | epilogues.go:88:8:92:2 | function literal |
-| epilogues.go:87:30:87:35 | zero value for result | epilogues.go:87:30:87:35 | initialization of result |
-| epilogues.go:88:2:92:4 | defer statement | epilogues.go:93:5:93:5 | x |
-| epilogues.go:88:8:92:2 | entry | epilogues.go:89:6:89:6 | skip |
-| epilogues.go:88:8:92:2 | function literal | epilogues.go:88:2:92:4 | defer statement |
-| epilogues.go:88:8:92:4 | function call | epilogues.go:87:1:98:1 | exit |
-| epilogues.go:88:8:92:4 | function call | epilogues.go:87:30:87:35 | implicit read of result |
-| epilogues.go:89:6:89:6 | assignment to r | epilogues.go:89:22:89:22 | r |
-| epilogues.go:89:6:89:6 | skip | epilogues.go:89:11:89:17 | recover |
-| epilogues.go:89:11:89:17 | recover | epilogues.go:89:11:89:19 | call to recover |
-| epilogues.go:89:11:89:19 | call to recover | epilogues.go:89:6:89:6 | assignment to r |
-| epilogues.go:89:22:89:22 | r | epilogues.go:89:27:89:29 | nil |
-| epilogues.go:89:22:89:29 | ...!=... | epilogues.go:88:8:92:2 | exit |
-| epilogues.go:89:22:89:29 | ...!=... | epilogues.go:89:22:89:29 | ...!=... is false |
-| epilogues.go:89:22:89:29 | ...!=... | epilogues.go:89:22:89:29 | ...!=... is true |
-| epilogues.go:89:22:89:29 | ...!=... is false | epilogues.go:88:8:92:2 | exit |
-| epilogues.go:89:22:89:29 | ...!=... is true | epilogues.go:90:4:90:9 | skip |
-| epilogues.go:89:27:89:29 | nil | epilogues.go:89:22:89:29 | ...!=... |
-| epilogues.go:90:4:90:9 | assignment to result | epilogues.go:88:8:92:2 | exit |
-| epilogues.go:90:4:90:9 | skip | epilogues.go:90:13:90:14 | -... |
-| epilogues.go:90:13:90:14 | -... | epilogues.go:90:4:90:9 | assignment to result |
-| epilogues.go:93:5:93:5 | x | epilogues.go:93:9:93:9 | 0 |
-| epilogues.go:93:5:93:9 | ...<... | epilogues.go:93:5:93:9 | ...<... is false |
-| epilogues.go:93:5:93:9 | ...<... | epilogues.go:93:5:93:9 | ...<... is true |
-| epilogues.go:93:5:93:9 | ...<... is false | epilogues.go:96:2:96:7 | skip |
-| epilogues.go:93:5:93:9 | ...<... is true | epilogues.go:94:3:94:7 | panic |
-| epilogues.go:93:9:93:9 | 0 | epilogues.go:93:5:93:9 | ...<... |
-| epilogues.go:94:3:94:7 | panic | epilogues.go:94:9:94:13 | "neg" |
-| epilogues.go:94:3:94:14 | call to panic | epilogues.go:88:8:92:4 | function call |
-| epilogues.go:94:9:94:13 | "neg" | epilogues.go:94:3:94:14 | call to panic |
-| epilogues.go:96:2:96:7 | assignment to result | epilogues.go:97:9:97:14 | result |
-| epilogues.go:96:2:96:7 | skip | epilogues.go:96:11:96:11 | x |
-| epilogues.go:96:11:96:11 | x | epilogues.go:96:15:96:15 | x |
-| epilogues.go:96:11:96:15 | ...*... | epilogues.go:96:2:96:7 | assignment to result |
-| epilogues.go:96:15:96:15 | x | epilogues.go:96:11:96:15 | ...*... |
-| epilogues.go:97:2:97:14 | return statement | epilogues.go:88:8:92:4 | function call |
-| epilogues.go:97:9:97:14 | implicit write of result | epilogues.go:97:2:97:14 | return statement |
-| epilogues.go:97:9:97:14 | result | epilogues.go:97:9:97:14 | implicit write of result |
-| epilogues.go:102:1:110:1 | entry | epilogues.go:102:26:102:26 | argument corresponding to x |
-| epilogues.go:102:1:110:1 | function declaration | epilogues.go:115:6:115:22 | skip |
-| epilogues.go:102:6:102:24 | skip | epilogues.go:102:1:110:1 | function declaration |
-| epilogues.go:102:26:102:26 | argument corresponding to x | epilogues.go:102:26:102:26 | initialization of x |
-| epilogues.go:102:26:102:26 | initialization of x | epilogues.go:102:34:102:35 | zero value for ok |
-| epilogues.go:102:34:102:35 | implicit read of ok | epilogues.go:102:43:102:43 | implicit read of n |
-| epilogues.go:102:34:102:35 | initialization of ok | epilogues.go:102:43:102:43 | zero value for n |
-| epilogues.go:102:34:102:35 | zero value for ok | epilogues.go:102:34:102:35 | initialization of ok |
-| epilogues.go:102:43:102:43 | implicit read of n | epilogues.go:102:1:110:1 | exit |
-| epilogues.go:102:43:102:43 | initialization of n | epilogues.go:103:8:103:17 | epiRecover |
-| epilogues.go:102:43:102:43 | zero value for n | epilogues.go:102:43:102:43 | initialization of n |
-| epilogues.go:103:2:103:19 | defer statement | epilogues.go:104:5:104:5 | x |
-| epilogues.go:103:8:103:17 | epiRecover | epilogues.go:103:2:103:19 | defer statement |
-| epilogues.go:103:8:103:19 | call to epiRecover | epilogues.go:102:1:110:1 | exit |
-| epilogues.go:103:8:103:19 | call to epiRecover | epilogues.go:102:34:102:35 | implicit read of ok |
-| epilogues.go:104:5:104:5 | x | epilogues.go:104:10:104:10 | 0 |
-| epilogues.go:104:5:104:10 | ...==... | epilogues.go:104:5:104:10 | ...==... is false |
-| epilogues.go:104:5:104:10 | ...==... | epilogues.go:104:5:104:10 | ...==... is true |
-| epilogues.go:104:5:104:10 | ...==... is false | epilogues.go:107:2:107:2 | skip |
-| epilogues.go:104:5:104:10 | ...==... is true | epilogues.go:105:3:105:8 | return statement |
-| epilogues.go:104:10:104:10 | 0 | epilogues.go:104:5:104:10 | ...==... |
-| epilogues.go:105:3:105:8 | return statement | epilogues.go:103:8:103:19 | call to epiRecover |
-| epilogues.go:107:2:107:2 | assignment to n | epilogues.go:108:2:108:3 | skip |
-| epilogues.go:107:2:107:2 | skip | epilogues.go:107:6:107:6 | x |
-| epilogues.go:107:6:107:6 | x | epilogues.go:107:2:107:2 | assignment to n |
-| epilogues.go:108:2:108:3 | assignment to ok | epilogues.go:109:2:109:7 | return statement |
-| epilogues.go:108:2:108:3 | skip | epilogues.go:108:7:108:10 | true |
-| epilogues.go:108:7:108:10 | true | epilogues.go:108:2:108:3 | assignment to ok |
-| epilogues.go:109:2:109:7 | return statement | epilogues.go:103:8:103:19 | call to epiRecover |
-| epilogues.go:115:1:118:1 | entry | epilogues.go:116:8:116:17 | epiRecover |
-| epilogues.go:115:1:118:1 | function declaration | epilogues.go:0:0:0:0 | exit |
-| epilogues.go:115:6:115:22 | skip | epilogues.go:115:1:118:1 | function declaration |
-| epilogues.go:116:2:116:19 | defer statement | epilogues.go:117:2:117:6 | panic |
-| epilogues.go:116:8:116:17 | epiRecover | epilogues.go:116:2:116:19 | defer statement |
-| epilogues.go:116:8:116:19 | call to epiRecover | epilogues.go:115:1:118:1 | exit |
-| epilogues.go:117:2:117:6 | panic | epilogues.go:117:8:117:13 | "boom" |
-| epilogues.go:117:2:117:14 | call to panic | epilogues.go:116:8:116:19 | call to epiRecover |
-| epilogues.go:117:8:117:13 | "boom" | epilogues.go:117:2:117:14 | call to panic |
 | equalitytests.go:0:0:0:0 | entry | equalitytests.go:3:1:5:1 | skip |
 | equalitytests.go:3:1:5:1 | skip | equalitytests.go:7:1:9:1 | skip |
 | equalitytests.go:7:1:9:1 | skip | equalitytests.go:11:6:11:18 | skip |

go/ql/test/library-tests/semmle/go/controlflow/ControlFlowGraph/NoretFunctions.expected

@@ -1,4 +1,3 @@
-| epilogues.go:115:6:115:22 | epiRecoverUnnamed | github.com/github/codeql-go/ql/test/library-tests/semmle/go/controlflow/ControlFlowGraph.epiRecoverUnnamed |
 | file://:0:0:0:0 | Exit | os.Exit |
 | file://:0:0:0:0 | Fatal | log.Fatal |
 | file://:0:0:0:0 | Fatal | log.Logger.Fatal |

go/ql/test/library-tests/semmle/go/controlflow/ControlFlowGraph/epilogues.go

@@ -1,118 +0,0 @@
-package main
-
-import "fmt"
-
-// epiLogger has methods with both pointer and value receivers, used to check
-// that the receiver and arguments of a deferred call are evaluated at the
-// `defer` statement rather than in the function epilogue.
-type epiLogger struct {
-	prefix string
-}
-
-func (l *epiLogger) log(msg string, code int) {
-	fmt.Println(l.prefix, msg, code)
-}
-
-func (l epiLogger) logValue(msg string) {
-	fmt.Println(l.prefix, msg)
-}
-
-// epiRecover recovers from a panic. It is used as a deferred function so we can
-// check that control flow returns to the result-read nodes and the normal exit
-// node after recovering.
-func epiRecover() {
-	if r := recover(); r != nil {
-		fmt.Println("recovered:", r)
-	}
-}
-
-// epiPlain has no named result variable and a single `return` with a child
-// expression.
-func epiPlain(x int) int {
-	return x * 2
-}
-
-// epiVoid has no named result variable and no `return` statement at all.
-func epiVoid() {
-	fmt.Println("void")
-}
-
-// epiNamedMixed has named result variables and a mix of a bare `return` (no
-// child expressions) and a `return` with child expressions.
-func epiNamedMixed(x int) (result int, err error) {
-	if x < 0 {
-		result = -x
-		return
-	}
-	return x, nil
-}
-
-// epiNamedBareOnly has a named result variable and only a bare `return`.
-func epiNamedBareOnly(x int) (n int) {
-	n = x + 1
-	return
-}
-
-// epiDeferReceiverArgs has a deferred call with a (pointer) receiver and
-// arguments that are expressions, so we can check the receiver `l` and the
-// arguments `"count"` and `len(items)` are evaluated at the `defer` statement.
-func epiDeferReceiverArgs(l *epiLogger, items []int) {
-	defer l.log("count", len(items))
-	fmt.Println("processing", len(items))
-}
-
-// epiDeferValueReceiver has deferred calls with a value receiver and an
-// address-of receiver, both with arguments evaluated at the `defer` statement.
-func epiDeferValueReceiver(prefix string) {
-	l := epiLogger{prefix: prefix}
-	defer l.logValue("bye")
-	defer (&l).log("ptr", 7)
-	fmt.Println("body")
-}
-
-// epiDeferFuncLit has a deferred function literal with parameters, so we can
-// check that the arguments `"done"` and `x+1` are evaluated at the `defer`
-// statement and that control flow enters the function literal body when it is
-// invoked at the function epilogue.
-func epiDeferFuncLit(x int) {
-	defer func(label string, n int) {
-		fmt.Println(label, n)
-	}("done", x+1)
-	fmt.Println("body", x)
-}
-
-// epiRecoverNamed has a named result variable and a deferred closure containing
-// `recover()`. After recovering on the panic path, control flow should return
-// to the result-read nodes and the normal exit node.
-func epiRecoverNamed(x int) (result int) {
-	defer func() {
-		if r := recover(); r != nil {
-			result = -1
-		}
-	}()
-	if x < 0 {
-		panic("neg")
-	}
-	result = x * x
-	return result
-}
-
-// epiRecoverNamedBare has named result variables, a deferred function
-// containing `recover()`, and only bare `return` statements.
-func epiRecoverNamedBare(x int) (ok bool, n int) {
-	defer epiRecover()
-	if x == 0 {
-		return
-	}
-	n = x
-	ok = true
-	return
-}
-
-// epiRecoverUnnamed has no named result variables and a deferred function
-// containing `recover()`; after recovering, control flow should reach the
-// normal exit node directly (there are no result-read nodes).
-func epiRecoverUnnamed() {
-	defer epiRecover()
-	panic("boom")
-}

python/ql/lib/LegacyPointsTo.qll

@@ -213,11 +213,9 @@ class ExprWithPointsTo extends Expr {
    * Gets what this expression might "refer-to" in the given `context`.
    */
   predicate refersTo(Context context, Object obj, ClassObject cls, AstNode origin) {
-    exists(ControlFlowNode this_, ControlFlowNode origin_ |
-      this_.getNode() = this and origin_.getNode() = origin
-    |
-      this_.(ControlFlowNodeWithPointsTo).refersTo(context, obj, cls, origin_)
-    )
+    this.getAFlowNode()
+        .(ControlFlowNodeWithPointsTo)
+        .refersTo(context, obj, cls, origin.getAFlowNode())
   }
 
   /**
@@ -228,11 +226,7 @@ class ExprWithPointsTo extends Expr {
    */
   pragma[nomagic]
   predicate refersTo(Object obj, AstNode origin) {
-    exists(ControlFlowNode this_, ControlFlowNode origin_ |
-      this_.getNode() = this and origin_.getNode() = origin
-    |
-      this_.(ControlFlowNodeWithPointsTo).refersTo(obj, origin_)
-    )
+    this.getAFlowNode().(ControlFlowNodeWithPointsTo).refersTo(obj, origin.getAFlowNode())
   }
 
   /**
@@ -246,22 +240,16 @@ class ExprWithPointsTo extends Expr {
    * in the given `context`.
    */
   predicate pointsTo(Context context, Value value, AstNode origin) {
-    exists(ControlFlowNode this_, ControlFlowNode origin_ |
-      this_.getNode() = this and origin_.getNode() = origin
-    |
-      this_.(ControlFlowNodeWithPointsTo).pointsTo(context, value, origin_)
-    )
+    this.getAFlowNode()
+        .(ControlFlowNodeWithPointsTo)
+        .pointsTo(context, value, origin.getAFlowNode())
   }
 
   /**
    * Holds if this expression might "point-to" to `value` which is from `origin`.
    */
   predicate pointsTo(Value value, AstNode origin) {
-    exists(ControlFlowNode this_, ControlFlowNode origin_ |
-      this_.getNode() = this and origin_.getNode() = origin
-    |
-      this_.(ControlFlowNodeWithPointsTo).pointsTo(value, origin_)
-    )
+    this.getAFlowNode().(ControlFlowNodeWithPointsTo).pointsTo(value, origin.getAFlowNode())
   }
 
   /**
@@ -487,10 +475,7 @@ class FunctionMetricsWithPointsTo extends FunctionMetrics {
     not non_coupling_method(result) and
     exists(Call call | call.getScope() = this |
       exists(FunctionObject callee | callee.getFunction() = result |
-        exists(CallNode call_ |
-          call_.getNode() = call and
-          call_.getFunction().(ControlFlowNodeWithPointsTo).refersTo(callee)
-        )
+        call.getAFlowNode().getFunction().(ControlFlowNodeWithPointsTo).refersTo(callee)
       )
       or
       exists(Attribute a | call.getFunc() = a |

python/ql/lib/analysis/DefinitionTracking.qll

@@ -64,7 +64,7 @@ private predicate jump_to_defn(ControlFlowNode use, Definition defn) {
 private predicate preferred_jump_to_defn(Expr use, Definition def) {
   not use instanceof ClassExpr and
   not use instanceof FunctionExpr and
-  exists(ControlFlowNode useNode | useNode.getNode() = use | jump_to_defn(useNode, def))
+  jump_to_defn(use.getAFlowNode(), def)
 }
 
 private predicate unique_jump_to_defn(Expr use, Definition def) {
@@ -452,7 +452,7 @@ private predicate self_parameter_jump_to_defn_attribute(
  * This exists primarily for testing use `getPreferredDefinition()` instead.
  */
 Definition getADefinition(Expr use) {
-  exists(ControlFlowNode useNode | useNode.getNode() = use | jump_to_defn(useNode, result)) and
+  jump_to_defn(use.getAFlowNode(), result) and
   not use instanceof Call and
   not use.isArtificial() and
   // Not the use itself

python/ql/lib/change-notes/2026-05-19-deprecate-getAFlowNode.md

@@ -1,5 +0,0 @@
----
-category: deprecated
----
-* The `AstNode.getAFlowNode()` predicate has been deprecated. Use `ControlFlowNode.getNode()` from the other direction instead: replace `e.getAFlowNode() = n` with `n.getNode() = e`. This is a preparatory step towards migrating the dataflow library off the legacy CFG; it has no semantic effect.
-

python/ql/lib/change-notes/2026-06-01-deprecate-getAReturnValueFlowNode.md

@@ -1,4 +0,0 @@
----
-category: deprecated
----
-* The `Function.getAReturnValueFlowNode()` predicate has been deprecated. Bind a `Return` node explicitly instead — `exists(Return ret | ret.getScope() = f and n.getNode() = ret.getValue())`. This is a preparatory step towards migrating the dataflow library off the legacy CFG; it has no semantic effect.

python/ql/lib/semmle/python/AstExtended.qll

@@ -17,17 +17,12 @@ abstract class AstNode extends AstNode_ {
   abstract Scope getScope();
 
   /**
-   * DEPRECATED: use `ControlFlowNode.getNode()` from the other direction instead;
-   * that is, replace `e.getAFlowNode() = n` with `n.getNode() = e`. This API is
-   * being removed to untangle the AST and CFG hierarchies in preparation for
-   * migrating the dataflow library off the legacy CFG.
-   *
    * Gets a flow node corresponding directly to this node.
    * NOTE: For some statements and other purely syntactic elements,
-   * there may not be a `ControlFlowNode`.
+   * there may not be a `ControlFlowNode`
    */
   cached
-  deprecated ControlFlowNode getAFlowNode() {
+  ControlFlowNode getAFlowNode() {
     Stages::AST::ref() and
     py_flow_bb_node(result, this, _, _)
   }

python/ql/lib/semmle/python/Exprs.qll

@@ -28,9 +28,7 @@ class Expr extends Expr_, AstNode {
   /** Whether this expression may have a side effect (as determined purely from its syntax) */
   predicate hasSideEffects() {
     /* If an exception raised by this expression handled, count that as a side effect */
-    exists(ControlFlowNode n | n.getNode() = this |
-      n.getASuccessor().getNode() instanceof ExceptStmt
-    )
+    this.getAFlowNode().getASuccessor().getNode() instanceof ExceptStmt
     or
     this.getASubExpression().hasSideEffects()
   }
@@ -70,7 +68,7 @@ class Attribute extends Attribute_ {
   /* syntax: Expr.name */
   override Expr getASubExpression() { result = this.getObject() }
 
-  deprecated override AttrNode getAFlowNode() { result = super.getAFlowNode() }
+  override AttrNode getAFlowNode() { result = super.getAFlowNode() }
 
   /** Gets the name of this attribute. That is the `name` in `obj.name` */
   string getName() { result = Attribute_.super.getAttr() }
@@ -99,7 +97,7 @@ class Subscript extends Subscript_ {
 
   Expr getObject() { result = Subscript_.super.getValue() }
 
-  deprecated override SubscriptNode getAFlowNode() { result = super.getAFlowNode() }
+  override SubscriptNode getAFlowNode() { result = super.getAFlowNode() }
 }
 
 /** A call expression, such as `func(...)` */
@@ -115,7 +113,7 @@ class Call extends Call_ {
 
   override string toString() { result = this.getFunc().toString() + "()" }
 
-  deprecated override CallNode getAFlowNode() { result = super.getAFlowNode() }
+  override CallNode getAFlowNode() { result = super.getAFlowNode() }
 
   /** Gets a tuple (*) argument of this call. */
   Expr getStarargs() { result = this.getAPositionalArg().(Starred).getValue() }
@@ -203,7 +201,7 @@ class IfExp extends IfExp_ {
     result = this.getTest() or result = this.getBody() or result = this.getOrelse()
   }
 
-  deprecated override IfExprNode getAFlowNode() { result = super.getAFlowNode() }
+  override IfExprNode getAFlowNode() { result = super.getAFlowNode() }
 }
 
 /** A starred expression, such as the `*rest` in the assignment `first, *rest = seq` */
@@ -413,7 +411,7 @@ class PlaceHolder extends PlaceHolder_ {
 
   override string toString() { result = "$" + this.getId() }
 
-  deprecated override NameNode getAFlowNode() { result = super.getAFlowNode() }
+  override NameNode getAFlowNode() { result = super.getAFlowNode() }
 }
 
 /** A tuple expression such as `( 1, 3, 5, 7, 9 )` */
@@ -480,7 +478,7 @@ class Name extends Name_ {
 
   override string toString() { result = this.getId() }
 
-  deprecated override NameNode getAFlowNode() { result = super.getAFlowNode() }
+  override NameNode getAFlowNode() { result = super.getAFlowNode() }
 
   override predicate isArtificial() {
     /* Artificial variable names in comprehensions all start with "." */
@@ -587,7 +585,7 @@ abstract class NameConstant extends Name, ImmutableLiteral {
 
   override predicate isConstant() { any() }
 
-  deprecated override NameConstantNode getAFlowNode() { result = Name.super.getAFlowNode() }
+  override NameConstantNode getAFlowNode() { result = Name.super.getAFlowNode() }
 
   override predicate isArtificial() { none() }
 }

python/ql/lib/semmle/python/Flow.qll

@@ -555,27 +555,27 @@ class DefinitionNode extends ControlFlowNode {
   cached
   DefinitionNode() {
     Stages::AST::ref() and
-    exists(Assign a | this.getNode() = a.getATarget())
+    exists(Assign a | a.getATarget().getAFlowNode() = this)
     or
-    exists(AssignExpr a | this.getNode() = a.getTarget())
+    exists(AssignExpr a | a.getTarget().getAFlowNode() = this)
     or
-    exists(AnnAssign a | this.getNode() = a.getTarget() and exists(a.getValue()))
+    exists(AnnAssign a | a.getTarget().getAFlowNode() = this and exists(a.getValue()))
     or
-    exists(Alias a | this.getNode() = a.getAsname())
+    exists(Alias a | a.getAsname().getAFlowNode() = this)
     or
     augstore(_, this)
     or
     // `x, y = 1, 2` where LHS is a combination of list or tuples
-    exists(Assign a | this.getNode() = list_or_tuple_nested_element(a.getATarget()))
+    exists(Assign a | list_or_tuple_nested_element(a.getATarget()).getAFlowNode() = this)
     or
-    exists(For for | this.getNode() = for.getTarget())
+    exists(For for | for.getTarget().getAFlowNode() = this)
     or
-    exists(Parameter param | this.getNode() = param.asName() and exists(param.getDefault()))
+    exists(Parameter param | this = param.asName().getAFlowNode() and exists(param.getDefault()))
   }
 
   /** flow node corresponding to the value assigned for the definition corresponding to this flow node */
   ControlFlowNode getValue() {
-    result.getNode() = assigned_value(this.getNode()) and
+    result = assigned_value(this.getNode()).getAFlowNode() and
     (
       result.getBasicBlock().dominates(this.getBasicBlock())
       or
@@ -584,7 +584,7 @@ class DefinitionNode extends ControlFlowNode {
       // since the default value for a parameter is evaluated in the same basic block as
       // the function definition, but the parameter belongs to the basic block of the function,
       // there is no dominance relationship between the two.
-      exists(Parameter param | this.getNode() = param.asName())
+      exists(Parameter param | this = param.asName().getAFlowNode())
     )
   }
 }
@@ -901,7 +901,7 @@ class ExceptFlowNode extends ControlFlowNode {
     exists(ExceptStmt ex |
       this.getBasicBlock().dominates(result.getBasicBlock()) and
       ex = this.getNode() and
-      result.getNode() = ex.getType()
+      result = ex.getType().getAFlowNode()
     )
   }
 
@@ -913,7 +913,7 @@ class ExceptFlowNode extends ControlFlowNode {
     exists(ExceptStmt ex |
       this.getBasicBlock().dominates(result.getBasicBlock()) and
       ex = this.getNode() and
-      result.getNode() = ex.getName()
+      result = ex.getName().getAFlowNode()
     )
   }
 }
@@ -928,7 +928,7 @@ class ExceptGroupFlowNode extends ControlFlowNode {
    */
   ControlFlowNode getType() {
     this.getBasicBlock().dominates(result.getBasicBlock()) and
-    result.getNode() = this.getNode().(ExceptGroupStmt).getType()
+    result = this.getNode().(ExceptGroupStmt).getType().getAFlowNode()
   }
 
   /**
@@ -937,7 +937,7 @@ class ExceptGroupFlowNode extends ControlFlowNode {
    */
   ControlFlowNode getName() {
     this.getBasicBlock().dominates(result.getBasicBlock()) and
-    result.getNode() = this.getNode().(ExceptGroupStmt).getName()
+    result = this.getNode().(ExceptGroupStmt).getName().getAFlowNode()
   }
 }
 

python/ql/lib/semmle/python/Function.qll

@@ -153,16 +153,8 @@ class Function extends Function_, Scope, AstNode {
 
   override predicate contains(AstNode inner) { Scope.super.contains(inner) }
 
-  /**
-   * DEPRECATED: bind a `Return` node explicitly instead, e.g.
-   * `exists(Return ret | ret.getScope() = this and n.getNode() = ret.getValue())`.
-   * This API is being phased out together with `AstNode.getAFlowNode()` to
-   * untangle the AST and CFG hierarchies in preparation for migrating the
-   * dataflow library off the legacy CFG.
-   *
-   * Gets a control flow node for a return value of this function.
-   */
-  deprecated ControlFlowNode getAReturnValueFlowNode() {
+  /** Gets a control flow node for a return value of this function */
+  ControlFlowNode getAReturnValueFlowNode() {
     exists(Return ret |
       ret.getScope() = this and
       ret.getValue() = result.getNode()

python/ql/lib/semmle/python/Import.qll

@@ -163,7 +163,7 @@ class ImportMember extends ImportMember_ {
     result = this.getModule().(ImportExpr).getImportedModuleName() + "." + this.getName()
   }
 
-  deprecated override ImportMemberNode getAFlowNode() { result = super.getAFlowNode() }
+  override ImportMemberNode getAFlowNode() { result = super.getAFlowNode() }
 }
 
 /** An import statement */

python/ql/lib/semmle/python/SelfAttribute.qll

@@ -46,23 +46,20 @@ class SelfAttributeRead extends SelfAttribute {
   }
 
   predicate guardedByHasattr() {
-    exists(Variable var, ControlFlowNode n, ControlFlowNode this_, ControlFlowNode obj_ |
-      this_.getNode() = this and obj_.getNode() = this.getObject()
-    |
-      var.getAUse() = obj_ and
+    exists(Variable var, ControlFlowNode n |
+      var.getAUse() = this.getObject().getAFlowNode() and
       hasattr(n, var.getAUse(), this.getName()) and
-      n.strictlyDominates(this_)
+      n.strictlyDominates(this.getAFlowNode())
     )
   }
 
   pragma[noinline]
   predicate locallyDefined() {
-    exists(SelfAttributeStore store, ControlFlowNode store_, ControlFlowNode this_ |
-      store_.getNode() = store and this_.getNode() = this
-    |
+    exists(SelfAttributeStore store |
       this.getName() = store.getName() and
-      this.getScope() = store.getScope() and
-      store_.strictlyDominates(this_)
+      this.getScope() = store.getScope()
+    |
+      store.getAFlowNode().strictlyDominates(this.getAFlowNode())
     )
   }
 }

python/ql/lib/semmle/python/dataflow/new/BarrierGuards.qll

@@ -5,30 +5,24 @@ private import semmle.python.dataflow.new.DataFlow
 
 private predicate constCompare(DataFlow::GuardNode g, ControlFlowNode node, boolean branch) {
   exists(CompareNode cn | cn = g |
-    exists(ImmutableLiteral const, Cmpop op, ControlFlowNode c |
-      c.getNode() = const and
-      (
-        op = any(Eq eq) and branch = true
-        or
-        op = any(NotEq ne) and branch = false
-      )
-    |
-      cn.operands(c, op, node)
+    exists(ImmutableLiteral const, Cmpop op |
+      op = any(Eq eq) and branch = true
       or
-      cn.operands(node, op, c)
+      op = any(NotEq ne) and branch = false
+    |
+      cn.operands(const.getAFlowNode(), op, node)
+      or
+      cn.operands(node, op, const.getAFlowNode())
     )
     or
-    exists(NameConstant const, Cmpop op, ControlFlowNode c |
-      c.getNode() = const and
-      (
-        op = any(Is is_) and branch = true
-        or
-        op = any(IsNot isn) and branch = false
-      )
-    |
-      cn.operands(c, op, node)
+    exists(NameConstant const, Cmpop op |
+      op = any(Is is_) and branch = true
       or
-      cn.operands(node, op, c)
+      op = any(IsNot isn) and branch = false
+    |
+      cn.operands(const.getAFlowNode(), op, node)
+      or
+      cn.operands(node, op, const.getAFlowNode())
     )
     or
     exists(IterableNode const_iterable, Cmpop op |

python/ql/lib/semmle/python/dataflow/new/internal/Attributes.qll

@@ -228,7 +228,7 @@ private class ClassDefinitionAsAttrWrite extends AttrWrite, CfgNode {
 
   override Node getValue() { result.asCfgNode() = node.getValue() }
 
-  override Node getObject() { result.asCfgNode().getNode() = cls }
+  override Node getObject() { result.asCfgNode() = cls.getAFlowNode() }
 
   override ExprNode getAttributeNameExpr() { none() }
 

python/ql/lib/semmle/python/dataflow/new/internal/DataFlowDispatch.qll

@@ -1913,8 +1913,8 @@ abstract class ReturnNode extends Node {
 class ExtractedReturnNode extends ReturnNode, CfgNode {
   // See `TaintTrackingImplementation::returnFlowStep`
   ExtractedReturnNode() {
-    node.getNode() = any(Return ret).getValue() or
-    node.getNode() = any(Yield yield)
+    node = any(Return ret).getValue().getAFlowNode() or
+    node = any(Yield yield).getAFlowNode()
   }
 
   override ReturnKind getKind() { any() }
@@ -1932,7 +1932,7 @@ class ExtractedReturnNode extends ReturnNode, CfgNode {
 class YieldNodeInContextManagerFunction extends ReturnNode, CfgNode {
   YieldNodeInContextManagerFunction() {
     hasContextmanagerDecorator(node.getScope()) and
-    node.getNode() = any(Yield yield).getValue()
+    node = any(Yield yield).getValue().getAFlowNode()
   }
 
   override ReturnKind getKind() { any() }

python/ql/lib/semmle/python/dataflow/new/internal/DataFlowPrivate.qll

@@ -185,8 +185,8 @@ private predicate synthDictSplatArgumentNodeStoreStep(
  */
 predicate yieldStoreStep(Node nodeFrom, Content c, Node nodeTo) {
   exists(Yield yield |
-    nodeTo.asCfgNode().getNode() = yield and
-    nodeFrom.asCfgNode().getNode() = yield.getValue() and
+    nodeTo.asCfgNode() = yield.getAFlowNode() and
+    nodeFrom.asCfgNode() = yield.getValue().getAFlowNode() and
     // TODO: Consider if this will also need to transfer dictionary content
     // once dictionary comprehensions are supported.
     c instanceof ListElementContent

python/ql/lib/semmle/python/dataflow/new/internal/DataFlowPublic.qll

@@ -485,7 +485,7 @@ class ModuleVariableNode extends Node, TModuleVariableNode {
 
   /** Gets a node that reads this variable, excluding reads that happen through `from ... import *`. */
   Node getALocalRead() {
-    result.asCfgNode().getNode() = var.getALoad() and
+    result.asCfgNode() = var.getALoad().getAFlowNode() and
     not result.getScope() = mod
   }
 

python/ql/lib/semmle/python/dataflow/new/internal/ImportResolution.qll

@@ -9,19 +9,7 @@ private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.dataflow.new.internal.ImportStar
 private import semmle.python.dataflow.new.TypeTracking
 private import semmle.python.dataflow.new.internal.DataFlowPrivate
-
-/**
- * Holds if `init` is a package's `__init__.py` and `var` is a global variable in
- * `init` whose name matches a submodule of the package.
- *
- * Inlined from `SsaSource::init_module_submodule_defn` to avoid pulling
- * `semmle.python.essa.SsaDefinitions` into the new dataflow stack.
- */
-private predicate initModuleSubmoduleDefn(GlobalVariable var, Module init) {
-  init.isPackageInit() and
-  exists(init.getPackage().getSubModule(var.getId())) and
-  var.getScope() = init
-}
+private import semmle.python.essa.SsaDefinitions
 
 /**
  * Python modules and the way imports are resolved are... complicated. Here's a crash course in how
@@ -338,7 +326,7 @@ module ImportResolution {
     // imported yet.
     exists(string submodule, Module package, EssaVariable var |
       submodule = var.getName() and
-      initModuleSubmoduleDefn(var.getSourceVariable(), package) and
+      SsaSource::init_module_submodule_defn(var.getSourceVariable(), package.getEntryNode()) and
       m = getModuleFromName(package.getPackageName() + "." + submodule) and
       result.asCfgNode() = var.getDefinition().(EssaNodeDefinition).getDefiningNode()
     )

python/ql/lib/semmle/python/dataflow/new/internal/TypeTrackingImpl.qll

@@ -94,10 +94,8 @@ private module SummaryTypeTrackerInput implements SummaryTypeTracker::Input {
   Node returnOf(Node callable, SummaryComponent return) {
     return = FlowSummaryImpl::Private::SummaryComponent::return() and
     // `result` should be the return value of a callable expression (lambda or function) referenced by `callable`
-    exists(Return ret |
-      ret.getScope() = callable.getALocalSource().asExpr().(CallableExpr).getInnerScope() and
-      result.asCfgNode().getNode() = ret.getValue()
-    )
+    result.asCfgNode() =
+      callable.getALocalSource().asExpr().(CallableExpr).getInnerScope().getAReturnValueFlowNode()
   }
 
   // Relating callables to nodes

python/ql/lib/semmle/python/dataflow/new/internal/VariableCapture.qll

@@ -61,7 +61,7 @@ private module CaptureInput implements Shared::InputSig<Location, Cfg::BasicBloc
   class VariableWrite extends ControlFlowNode {
     CapturedVariable v;
 
-    VariableWrite() { exists(DefinitionNode d | d.getNode() = v.getAStore() | this = d.getValue()) }
+    VariableWrite() { this = v.getAStore().getAFlowNode().(DefinitionNode).getValue() }
 
     CapturedVariable getVariable() { result = v }
 
@@ -71,7 +71,7 @@ private module CaptureInput implements Shared::InputSig<Location, Cfg::BasicBloc
   class VariableRead extends Expr {
     CapturedVariable v;
 
-    VariableRead() { this.getNode() = v.getALoad() }
+    VariableRead() { this = v.getALoad().getAFlowNode() }
 
     CapturedVariable getVariable() { result = v }
   }

python/ql/lib/semmle/python/dataflow/old/Implementation.qll

@@ -448,7 +448,8 @@ class TaintTrackingImplementation extends string instanceof TaintTracking::Confi
       context = TNoParam() and
       src = TTaintTrackingNode_(retval, TNoParam(), path, kind, this) and
       node.asCfgNode() = call and
-      retval.asCfgNode().getNode() = any(Return ret | ret.getScope() = pyfunc.getScope()).getValue()
+      retval.asCfgNode() =
+        any(Return ret | ret.getScope() = pyfunc.getScope()).getValue().getAFlowNode()
     ) and
     edgeLabel = "return"
   }
@@ -470,7 +471,8 @@ class TaintTrackingImplementation extends string instanceof TaintTracking::Confi
       this.callContexts(call, src, pyfunc, context, callee) and
       retnode = TTaintTrackingNode_(retval, callee, path, kind, this) and
       node.asCfgNode() = call and
-      retval.asCfgNode().getNode() = any(Return ret | ret.getScope() = pyfunc.getScope()).getValue()
+      retval.asCfgNode() =
+        any(Return ret | ret.getScope() = pyfunc.getScope()).getValue().getAFlowNode()
     ) and
     edgeLabel = "call"
   }
@@ -714,10 +716,8 @@ private class EssaTaintTracking extends string instanceof TaintTracking::Configu
       src = TTaintTrackingNode_(srcnode, context, path, srckind, this) and
       path.noAttribute()
     |
-      srcnode.asCfgNode().getNode() = assign.getValue() and
-      exists(SequenceNode left_parent | left_parent.getNode() = assign.getATarget() |
-        depth = iterable_unpacking_descent(left_parent, defn.getDefiningNode())
-      ) and
+      assign.getValue().getAFlowNode() = srcnode.asCfgNode() and
+      depth = iterable_unpacking_descent(assign.getATarget().getAFlowNode(), defn.getDefiningNode()) and
       kind = taint_at_depth(srckind, depth)
     )
   }
@@ -964,7 +964,7 @@ private TaintKind taint_at_depth(SequenceKind parent_kind, int depth) {
  * - with `left_defn` = `*y`, `left_parent` = `((x, *y), ...)`, result = 1
  */
 int iterable_unpacking_descent(SequenceNode left_parent, ControlFlowNode left_defn) {
-  exists(Assign a | left_parent.getNode() = a.getATarget().getASubExpression*()) and
+  exists(Assign a | a.getATarget().getASubExpression*().getAFlowNode() = left_parent) and
   left_parent.getAnElement() = left_defn and
   // Handle `a, *b = some_iterable`
   if left_defn instanceof StarredNode then result = 0 else result = 1

python/ql/lib/semmle/python/essa/SsaDefinitions.qll

@@ -56,7 +56,7 @@ module SsaSource {
   predicate with_definition(Variable v, ControlFlowNode defn) {
     exists(With with, Name var |
       with.getOptionalVars() = var and
-      defn.getNode() = var
+      var.getAFlowNode() = defn
     |
       var = v.getAStore()
     )
@@ -67,7 +67,7 @@ module SsaSource {
   predicate pattern_capture_definition(Variable v, ControlFlowNode defn) {
     exists(MatchCapturePattern capture, Name var |
       capture.getVariable() = var and
-      defn.getNode() = var
+      var.getAFlowNode() = defn
     |
       var = v.getAStore()
     )
@@ -78,7 +78,7 @@ module SsaSource {
   predicate pattern_alias_definition(Variable v, ControlFlowNode defn) {
     exists(MatchAsPattern pattern, Name var |
       pattern.getAlias() = var and
-      defn.getNode() = var
+      var.getAFlowNode() = defn
     |
       var = v.getAStore()
     )

python/ql/lib/semmle/python/frameworks/Bottle.qll

@@ -59,7 +59,7 @@ module Bottle {
 
         override Parameter getARoutedParameter() { none() }
 
-        override Function getARequestHandler() { node.getNode() = result.getADecorator() }
+        override Function getARequestHandler() { result.getADecorator().getAFlowNode() = node }
       }
     }
 
@@ -73,10 +73,7 @@ module Bottle {
       /** A response returned by a view callable. */
       class BottleReturnResponse extends Http::Server::HttpResponse::Range {
         BottleReturnResponse() {
-          exists(Return ret |
-            ret.getScope() = any(View::ViewCallable vc) and
-            this.asCfgNode().getNode() = ret.getValue()
-          )
+          this.asCfgNode() = any(View::ViewCallable vc).getAReturnValueFlowNode()
         }
 
         override DataFlow::Node getBody() { result = this }

python/ql/lib/semmle/python/frameworks/Django.qll

@@ -2872,10 +2872,7 @@ module PrivateDjango {
     DataFlow::CfgNode
   {
     DjangoRedirectViewGetRedirectUrlReturn() {
-      exists(Return ret |
-        ret.getScope() = any(GetRedirectUrlFunction f) and
-        node.getNode() = ret.getValue()
-      )
+      node = any(GetRedirectUrlFunction f).getAReturnValueFlowNode()
     }
 
     override DataFlow::Node getRedirectLocation() { result = this }

python/ql/lib/semmle/python/frameworks/FastApi.qll

@@ -129,7 +129,7 @@ module FastApi {
       result in [this.getArg(0), this.getArgByName("path")]
     }
 
-    override Function getARequestHandler() { node.getNode() = result.getADecorator() }
+    override Function getARequestHandler() { result.getADecorator().getAFlowNode() = node }
 
     override string getFramework() { result = "FastAPI" }
 
@@ -309,10 +309,7 @@ module FastApi {
       FastApiRouteSetup routeSetup;
 
       FastApiRequestHandlerReturn() {
-        exists(Return ret |
-          ret.getScope() = routeSetup.getARequestHandler() and
-          node.getNode() = ret.getValue()
-        )
+        node = routeSetup.getARequestHandler().getAReturnValueFlowNode()
       }
 
       override DataFlow::Node getBody() { result = this }

python/ql/lib/semmle/python/frameworks/Flask.qll

@@ -371,7 +371,7 @@ module Flask {
       result in [this.getArg(0), this.getArgByName("rule")]
     }
 
-    override Function getARequestHandler() { node.getNode() = result.getADecorator() }
+    override Function getARequestHandler() { result.getADecorator().getAFlowNode() = node }
   }
 
   /**
@@ -536,7 +536,7 @@ module Flask {
     FlaskRouteHandlerReturn() {
       exists(Function routeHandler |
         routeHandler = any(FlaskRouteSetup rs).getARequestHandler() and
-        exists(Return ret | ret.getScope() = routeHandler and node.getNode() = ret.getValue()) and
+        node = routeHandler.getAReturnValueFlowNode() and
         not this instanceof Flask::Response::InstanceSource
       )
     }

python/ql/lib/semmle/python/frameworks/FlaskAdmin.qll

@@ -38,7 +38,7 @@ private module FlaskAdmin {
       result in [this.getArg(0), this.getArgByName("url")]
     }
 
-    override Function getARequestHandler() { node.getNode() = result.getADecorator() }
+    override Function getARequestHandler() { result.getADecorator().getAFlowNode() = node }
   }
 
   /**
@@ -71,7 +71,7 @@ private module FlaskAdmin {
 
     override Function getARequestHandler() {
       exists(Flask::FlaskViewClass cls |
-        node.getNode() = cls.getADecorator() and
+        cls.getADecorator().getAFlowNode() = node and
         result = cls.getARequestHandler()
       )
     }

python/ql/lib/semmle/python/frameworks/Pyramid.qll

@@ -166,10 +166,7 @@ module Pyramid {
     /** A response returned by a view callable. */
     private class PyramidReturnResponse extends Http::Server::HttpResponse::Range {
       PyramidReturnResponse() {
-        exists(Return ret |
-          ret.getScope() = any(View::ViewCallable vc) and
-          this.asCfgNode().getNode() = ret.getValue()
-        ) and
+        this.asCfgNode() = any(View::ViewCallable vc).getAReturnValueFlowNode() and
         not this = instance()
       }
 

python/ql/lib/semmle/python/frameworks/Stdlib.qll

@@ -2254,9 +2254,8 @@ module StdlibPrivate {
       DataFlow::CfgNode
     {
       WsgirefSimpleServerApplicationReturn() {
-        exists(WsgirefSimpleServerApplication requestHandler, Return ret |
-          ret.getScope() = requestHandler and
-          node.getNode() = ret.getValue()
+        exists(WsgirefSimpleServerApplication requestHandler |
+          node = requestHandler.getAReturnValueFlowNode()
         )
       }
 

python/ql/lib/semmle/python/frameworks/Twisted.qll

@@ -182,10 +182,7 @@ private module Twisted {
     DataFlow::CfgNode
   {
     TwistedResourceRenderMethodReturn() {
-      exists(Return ret |
-        ret.getScope() = any(TwistedResourceRenderMethod meth) and
-        this.asCfgNode().getNode() = ret.getValue()
-      )
+      this.asCfgNode() = any(TwistedResourceRenderMethod meth).getAReturnValueFlowNode()
     }
 
     override DataFlow::Node getBody() { result = this }

python/ql/lib/semmle/python/internal/CachedStages.qll

@@ -77,7 +77,7 @@ module Stages {
       or
       exists(any(AstExtended::AstNode n).getParentNode())
       or
-      exists(PyFlow::ControlFlowNode cfg, AstExtended::AstNode n | cfg.getNode() = n)
+      exists(any(AstExtended::AstNode n).getAFlowNode())
       or
       exists(any(PyFlow::BasicBlock b).getImmediateDominator())
       or

python/ql/lib/semmle/python/objects/Callables.qll

@@ -56,9 +56,8 @@ abstract class CallableObjectInternal extends ObjectInternal {
 /** A Python function. */
 class PythonFunctionObjectInternal extends CallableObjectInternal, TPythonFunctionObject {
   override Function getScope() {
-    exists(CallableExpr expr, ControlFlowNode exprCfg |
-      exprCfg.getNode() = expr and
-      this = TPythonFunctionObject(exprCfg) and
+    exists(CallableExpr expr |
+      this = TPythonFunctionObject(expr.getAFlowNode()) and
       result = expr.getInnerScope()
     )
   }
@@ -81,12 +80,11 @@ class PythonFunctionObjectInternal extends CallableObjectInternal, TPythonFuncti
 
   pragma[nomagic]
   override predicate callResult(PointsToContext callee, ObjectInternal obj, CfgOrigin origin) {
-    exists(Function func, Return ret, ControlFlowNode rval, ControlFlowNode forigin |
+    exists(Function func, ControlFlowNode rval, ControlFlowNode forigin |
       func = this.getScope() and
       callee.appliesToScope(func)
     |
-      ret.getScope() = func and
-      rval.getNode() = ret.getValue() and
+      rval = func.getAReturnValueFlowNode() and
       PointsToInternal::pointsTo(rval, callee, obj, forigin) and
       origin = CfgOrigin::fromCfgNode(forigin)
     )
@@ -162,11 +160,10 @@ class PythonFunctionObjectInternal extends CallableObjectInternal, TPythonFuncti
 }
 
 private BasicBlock blockReturningNone(Function func) {
-  exists(Return ret, ControlFlowNode ret_ |
+  exists(Return ret |
     not exists(ret.getValue()) and
     ret.getScope() = func and
-    ret_.getNode() = ret and
-    result = ret_.getBasicBlock()
+    result = ret.getAFlowNode().getBasicBlock()
   )
 }
 

python/ql/lib/semmle/python/objects/Classes.qll

@@ -113,9 +113,8 @@ abstract class ClassObjectInternal extends ObjectInternal {
 class PythonClassObjectInternal extends ClassObjectInternal, TPythonClassObject {
   /** Gets the scope for this Python class */
   Class getScope() {
-    exists(ClassExpr expr, ControlFlowNode exprCfg |
-      exprCfg.getNode() = expr and
-      this = TPythonClassObject(exprCfg) and
+    exists(ClassExpr expr |
+      this = TPythonClassObject(expr.getAFlowNode()) and
       result = expr.getInnerScope()
     )
   }

python/ql/lib/semmle/python/objects/ObjectAPI.qll

@@ -745,12 +745,7 @@ class PythonFunctionValue extends FunctionValue {
   override int maxParameters() { result = this.getScope().getMaxPositionalArguments() }
 
   /** Gets a control flow node corresponding to a return statement in this function */
-  ControlFlowNode getAReturnedNode() {
-    exists(Return ret |
-      ret.getScope() = this.getScope() and
-      result.getNode() = ret.getValue()
-    )
-  }
+  ControlFlowNode getAReturnedNode() { result = this.getScope().getAReturnValueFlowNode() }
 
   override ClassValue getARaisedType() { scope_raises(result, this.getScope()) }
 

python/ql/lib/semmle/python/objects/TObject.qll

@@ -387,7 +387,7 @@ private PythonClassObjectInternal abcMetaClassObject() {
 private predicate neither_class_nor_static_method(Function f) {
   not exists(f.getADecorator())
   or
-  exists(ControlFlowNode deco | deco.getNode() = f.getADecorator() |
+  exists(ControlFlowNode deco | deco = f.getADecorator().getAFlowNode() |
     exists(ObjectInternal o | PointsToInternal::pointsTo(deco, _, o, _) |
       o != ObjectInternal::staticMethod() and
       o != ObjectInternal::classMethod()

python/ql/lib/semmle/python/pointsto/PointsTo.qll

@@ -711,7 +711,7 @@ private module InterModulePointsTo {
     ControlFlowNode f, PointsToContext context, ObjectInternal value, ControlFlowNode origin
   ) {
     exists(string name, ImportExpr i |
-      f.getNode() = i and
+      i.getAFlowNode() = f and
       i.getImportedModuleName() = name and
       PointsToInternal::module_imported_as(value, name) and
       origin = f and
@@ -2118,9 +2118,8 @@ module Types {
     result.getBuiltin() = cls.getBuiltin().getBaseClass() and n = 0
     or
     exists(Class pycls | pycls = cls.(PythonClassObjectInternal).getScope() |
-      exists(ObjectInternal base, ControlFlowNode baseNode |
-        baseNode.getNode() = pycls.getBase(n) and
-        PointsToInternal::pointsTo(baseNode, _, base, _)
+      exists(ObjectInternal base |
+        PointsToInternal::pointsTo(pycls.getBase(n).getAFlowNode(), _, base, _)
       |
         result = base and base != ObjectInternal::unknown()
         or
@@ -2224,10 +2223,7 @@ module Types {
   }
 
   private ControlFlowNode decorator_call_callee(PythonClassObjectInternal cls) {
-    exists(CallNode deco |
-      deco.getNode() = cls.getScope().getADecorator() and
-      result = deco.getFunction()
-    )
+    result = cls.getScope().getADecorator().getAFlowNode().(CallNode).getFunction()
   }
 
   private boolean has_six_add_metaclass(PythonClassObjectInternal cls) {
@@ -2266,7 +2262,7 @@ module Types {
   }
 
   private EssaVariable metaclass_var(Class cls) {
-    result.getASourceUse().getNode() = cls.getMetaClass()
+    result.getASourceUse() = cls.getMetaClass().getAFlowNode()
     or
     major_version() = 2 and
     not exists(cls.getMetaClass()) and

python/ql/lib/semmle/python/types/ClassObject.qll

@@ -181,7 +181,7 @@ class ClassObject extends Object {
     )
   }
 
-  ControlFlowNode declaredMetaClass() { result.getNode() = this.getPyClass().getMetaClass() }
+  ControlFlowNode declaredMetaClass() { result = this.getPyClass().getMetaClass().getAFlowNode() }
 
   /** Has type inference failed to compute the full class hierarchy for this class for the reason given. */
   predicate failedInference(string reason) { Types::failedInference(this.theClass(), reason) }
@@ -195,9 +195,8 @@ class ClassObject extends Object {
    * It is guaranteed that getProbableSingletonInstance() returns at most one Object for each ClassObject.
    */
   Object getProbableSingletonInstance() {
-    exists(ControlFlowNodeWithPointsTo use, Expr origin, ControlFlowNode origin_ |
-      origin_.getNode() = origin and
-      use.refersTo(result, this, origin_)
+    exists(ControlFlowNodeWithPointsTo use, Expr origin |
+      use.refersTo(result, this, origin.getAFlowNode())
     |
       this.hasStaticallyUniqueInstance() and
       /* Ensure that original expression will be executed only one. */

python/ql/lib/semmle/python/types/Exceptions.qll

@@ -427,7 +427,7 @@ class ExceptFlowNodeWithPointsTo extends ExceptFlowNode {
 }
 
 private ControlFlowNodeWithPointsTo element_from_tuple_objectapi(Object tuple) {
-  exists(Tuple t | t = tuple.getOrigin() and result.getNode() = t.getAnElt())
+  exists(Tuple t | t = tuple.getOrigin() and result = t.getAnElt().getAFlowNode())
 }
 
 /**

python/ql/lib/semmle/python/types/Extensions.qll

@@ -36,8 +36,8 @@ class RangeIterationVariableFact extends PointsToExtension {
   RangeIterationVariableFact() {
     exists(For f, ControlFlowNode iterable |
       iterable.getBasicBlock().dominates(this.(ControlFlowNode).getBasicBlock()) and
-      iterable.getNode() = f.getIter() and
-      this.(ControlFlowNode).getNode() = f.getTarget() and
+      f.getIter().getAFlowNode() = iterable and
+      f.getTarget().getAFlowNode() = this and
       exists(ObjectInternal range |
         PointsTo::pointsTo(iterable, _, range, _) and
         range.getClass() = ObjectInternal::builtin("range")

python/ql/lib/semmle/python/types/FunctionObject.qll

@@ -137,10 +137,7 @@ class PyFunctionObject extends FunctionObject {
 
   /** Gets a control flow node corresponding to the value of a return statement */
   ControlFlowNodeWithPointsTo getAReturnedNode() {
-    exists(Return ret |
-      ret.getScope() = this.getFunction() and
-      result.getNode() = ret.getValue()
-    )
+    result = this.getFunction().getAReturnValueFlowNode()
   }
 
   override string descriptiveString() {
@@ -173,7 +170,7 @@ class PyFunctionObject extends FunctionObject {
   predicate unconditionallyReturnsParameter(int n) {
     exists(SsaVariable pvar |
       exists(Parameter p | p = this.getFunction().getArg(n) |
-        pvar.getDefinition().getNode() = p.asName()
+        p.asName().getAFlowNode() = pvar.getDefinition()
       ) and
       exists(NameNode rval |
         rval = pvar.getAUse() and

python/ql/lib/semmle/python/types/Object.qll

@@ -337,7 +337,7 @@ class TupleObject extends SequenceObject {
     or
     this instanceof TupleNode
     or
-    exists(Function func | this.(ControlFlowNode).getNode() = func.getVararg())
+    exists(Function func | func.getVararg().getAFlowNode() = this)
   }
 }
 
@@ -352,9 +352,7 @@ module TupleObject {
 }
 
 class NonEmptyTupleObject extends TupleObject {
-  NonEmptyTupleObject() {
-    exists(Function func | this.(ControlFlowNode).getNode() = func.getVararg())
-  }
+  NonEmptyTupleObject() { exists(Function func | func.getVararg().getAFlowNode() = this) }
 
   override boolean booleanValue() { result = true }
 }

python/ql/src/Classes/ClassAttributes.qll

@@ -48,11 +48,9 @@ class CheckClass extends ClassObject {
         self_dict = sub.getObject()
         or
         /* Indirect assignment via temporary variable */
-        exists(SsaVariable v, ControlFlowNode subObjCfg, ControlFlowNode selfDictCfg |
-          subObjCfg.getNode() = sub.getObject() and selfDictCfg.getNode() = self_dict
-        |
-          v.getAUse() = subObjCfg and
-          v.getDefinition().(DefinitionNode).getValue() = selfDictCfg
+        exists(SsaVariable v |
+          v.getAUse() = sub.getObject().getAFlowNode() and
+          v.getDefinition().(DefinitionNode).getValue() = self_dict.getAFlowNode()
         )
       ) and
       a.getATarget() = sub and
@@ -64,10 +62,9 @@ class CheckClass extends ClassObject {
 
   pragma[nomagic]
   private predicate monkeyPatched(string name) {
-    exists(Attribute a, ControlFlowNode objCfg |
-      objCfg.getNode() = a.getObject() and
+    exists(Attribute a |
       a.getCtx() instanceof Store and
-      PointsTo::points_to(objCfg, _, this, _, _) and
+      PointsTo::points_to(a.getObject().getAFlowNode(), _, this, _, _) and
       a.getName() = name
     )
   }
@@ -87,9 +84,9 @@ class CheckClass extends ClassObject {
   }
 
   predicate interestingUndefined(SelfAttributeRead a) {
-    exists(string name, ControlFlowNode aCfg | name = a.getName() and aCfg.getNode() = a |
+    exists(string name | name = a.getName() |
       this.interestingContext(a, name) and
-      not this.definedInBlock(aCfg.getBasicBlock(), name)
+      not this.definedInBlock(a.getAFlowNode().getBasicBlock(), name)
     )
   }
 
@@ -112,9 +109,8 @@ class CheckClass extends ClassObject {
 
   pragma[nomagic]
   private predicate definitionInBlock(BasicBlock b, string name) {
-    exists(SelfAttributeStore sa, ControlFlowNode saCfg |
-      saCfg.getNode() = sa and
-      saCfg.getBasicBlock() = b and
+    exists(SelfAttributeStore sa |
+      sa.getAFlowNode().getBasicBlock() = b and
       sa.getName() = name and
       sa.getClass() = this.getPyClass()
     )

python/ql/src/Exceptions/CatchingBaseException.ql

@@ -15,9 +15,7 @@
 import python
 import semmle.python.ApiGraphs
 
-predicate doesnt_reraise(ExceptStmt ex) {
-  exists(ControlFlowNode exCfg | exCfg.getNode() = ex | exCfg.getBasicBlock().reachesExit())
-}
+predicate doesnt_reraise(ExceptStmt ex) { ex.getAFlowNode().getBasicBlock().reachesExit() }
 
 predicate catches_base_exception(ExceptStmt ex) {
   ex.getType() = API::builtin("BaseException").getAValueReachableFromSource().asExpr()

python/ql/src/Expressions/CallArgs.qll

@@ -116,7 +116,7 @@ FunctionValue get_function_or_initializer(Value func_or_cls) {
 predicate illegally_named_parameter_objectapi(Call call, Object func, string name) {
   not func.isC() and
   name = call.getANamedArgumentName() and
-  exists(ControlFlowNode callCfg | callCfg.getNode() = call | callCfg = get_a_call_objectapi(func)) and
+  call.getAFlowNode() = get_a_call_objectapi(func) and
   not get_function_or_initializer_objectapi(func).isLegalArgumentName(name)
 }
 
@@ -124,7 +124,7 @@ predicate illegally_named_parameter_objectapi(Call call, Object func, string nam
 predicate illegally_named_parameter(Call call, Value func, string name) {
   not func.isBuiltin() and
   name = call.getANamedArgumentName() and
-  exists(ControlFlowNode callCfg | callCfg.getNode() = call | callCfg = get_a_call(func)) and
+  call.getAFlowNode() = get_a_call(func) and
   not get_function_or_initializer(func).isLegalArgumentName(name)
 }
 
@@ -146,9 +146,7 @@ predicate too_few_args_objectapi(Call call, Object callable, int limit) {
     call = func.getAMethodCall().getNode() and limit = func.minParameters() - 1
     or
     callable instanceof ClassObject and
-    exists(ControlFlowNode callCfg | callCfg.getNode() = call |
-      callCfg = get_a_call_objectapi(callable)
-    ) and
+    call.getAFlowNode() = get_a_call_objectapi(callable) and
     limit = func.minParameters() - 1
   )
 }
@@ -174,7 +172,7 @@ predicate too_few_args(Call call, Value callable, int limit) {
     call = func.getAMethodCall().getNode() and limit = func.minParameters() - 1
     or
     callable instanceof ClassValue and
-    exists(ControlFlowNode callCfg | callCfg.getNode() = call | callCfg = get_a_call(callable)) and
+    call.getAFlowNode() = get_a_call(callable) and
     limit = func.minParameters() - 1
   )
 }
@@ -193,9 +191,7 @@ predicate too_many_args_objectapi(Call call, Object callable, int limit) {
     call = func.getAMethodCall().getNode() and limit = func.maxParameters() - 1
     or
     callable instanceof ClassObject and
-    exists(ControlFlowNode callCfg | callCfg.getNode() = call |
-      callCfg = get_a_call_objectapi(callable)
-    ) and
+    call.getAFlowNode() = get_a_call_objectapi(callable) and
     limit = func.maxParameters() - 1
   ) and
   positional_arg_count_for_call_objectapi(call, callable) > limit
@@ -215,7 +211,7 @@ predicate too_many_args(Call call, Value callable, int limit) {
     call = func.getAMethodCall().getNode() and limit = func.maxParameters() - 1
     or
     callable instanceof ClassValue and
-    exists(ControlFlowNode callCfg | callCfg.getNode() = call | callCfg = get_a_call(callable)) and
+    call.getAFlowNode() = get_a_call(callable) and
     limit = func.maxParameters() - 1
   ) and
   positional_arg_count_for_call(call, callable) > limit

python/ql/src/Expressions/DuplicateKeyInDictionaryLiteral.ql

@@ -36,15 +36,11 @@ where
   exists(string s | dict_key(d, k1, s) and dict_key(d, k2, s) and k1 != k2) and
   (
     exists(BasicBlock b, int i1, int i2 |
-      b.getNode(i1).getNode() = k1 and
-      b.getNode(i2).getNode() = k2 and
+      k1.getAFlowNode() = b.getNode(i1) and
+      k2.getAFlowNode() = b.getNode(i2) and
       i1 < i2
     )
     or
-    exists(ControlFlowNode k1Cfg, ControlFlowNode k2Cfg |
-      k1Cfg.getNode() = k1 and k2Cfg.getNode() = k2
-    |
-      k1Cfg.getBasicBlock().strictlyDominates(k2Cfg.getBasicBlock())
-    )
+    k1.getAFlowNode().getBasicBlock().strictlyDominates(k2.getAFlowNode().getBasicBlock())
   )
 select k1, "Dictionary key " + repr(k1) + " is subsequently $@.", k2, "overwritten"

python/ql/src/Expressions/Formatting/AdvancedFormatting.qll

@@ -98,18 +98,16 @@ private predicate brace_pair(PossibleAdvancedFormatString fmt, int start, int en
 }
 
 private predicate advanced_format_call(Call format_expr, PossibleAdvancedFormatString fmt, int args) {
-  exists(CallNode call, ControlFlowNode fmtCfg |
-    call.getNode() = format_expr and fmtCfg.getNode() = fmt
-  |
+  exists(CallNode call | call = format_expr.getAFlowNode() |
     call.getFunction().(ControlFlowNodeWithPointsTo).pointsTo(Value::named("format")) and
-    call.getArg(0).(ControlFlowNodeWithPointsTo).pointsTo(_, fmtCfg) and
+    call.getArg(0).(ControlFlowNodeWithPointsTo).pointsTo(_, fmt.getAFlowNode()) and
     args = count(format_expr.getAnArg()) - 1
     or
     call.getFunction()
         .(AttrNode)
         .getObject("format")
         .(ControlFlowNodeWithPointsTo)
-        .pointsTo(_, fmtCfg) and
+        .pointsTo(_, fmt.getAFlowNode()) and
     args = count(format_expr.getAnArg())
   )
 }

python/ql/src/Expressions/IncorrectComparisonUsingIs.ql

@@ -15,7 +15,7 @@ import python
 
 /** Holds if the comparison `comp` uses `is` or `is not` (represented as `op`) to compare its `left` and `right` arguments. */
 predicate comparison_using_is(Compare comp, ControlFlowNode left, Cmpop op, ControlFlowNode right) {
-  exists(CompareNode fcomp | fcomp.getNode() = comp |
+  exists(CompareNode fcomp | fcomp = comp.getAFlowNode() |
     fcomp.operands(left, op, right) and
     (op instanceof Is or op instanceof IsNot)
   )

python/ql/src/Expressions/IsComparisons.qll

@@ -5,7 +5,7 @@ private import LegacyPointsTo
 
 /** Holds if the comparison `comp` uses `is` or `is not` (represented as `op`) to compare its `left` and `right` arguments. */
 predicate comparison_using_is(Compare comp, ControlFlowNode left, Cmpop op, ControlFlowNode right) {
-  exists(CompareNode fcomp | fcomp.getNode() = comp |
+  exists(CompareNode fcomp | fcomp = comp.getAFlowNode() |
     fcomp.operands(left, op, right) and
     (op instanceof Is or op instanceof IsNot)
   )

python/ql/src/Expressions/TruncatedDivision.ql

@@ -19,7 +19,7 @@ where
   // Only relevant for Python 2, as all later versions implement true division
   major_version() = 2 and
   exists(BinaryExprNode bin, Value lval, Value rval |
-    bin.getNode() = div and
+    bin = div.getAFlowNode() and
     bin.getNode().getOp() instanceof Div and
     bin.getLeft().(ControlFlowNodeWithPointsTo).pointsTo(lval, left) and
     lval.getClass() = ClassValue::int_() and

python/ql/src/Functions/ExplicitReturnInInit.ql

@@ -19,9 +19,7 @@ where
   exists(Function init | init.isInitMethod() and r.getScope() = init) and
   r.getValue() = rv and
   not rv.pointsTo(Value::none_()) and
-  not exists(FunctionValue f, ControlFlowNode rvCfg | rvCfg.getNode() = rv |
-    f.getACall() = rvCfg and f.neverReturns()
-  ) and
+  not exists(FunctionValue f | f.getACall() = rv.getAFlowNode() | f.neverReturns()) and
   // to avoid double reporting, don't trigger if returning result from other __init__ function
   not exists(Attribute meth | meth = rv.(Call).getFunc() | meth.getName() = "__init__")
 select r, "Explicit return in __init__ method."

python/ql/src/Functions/ReturnValueIgnored.ql

@@ -69,12 +69,7 @@ where
   returns_meaningful_value(callee) and
   not wrapped_in_try_except(call) and
   exists(int unused |
-    unused =
-      count(ExprStmt e |
-        exists(ControlFlowNode eValCfg | eValCfg.getNode() = e.getValue() |
-          eValCfg = callee.getACall()
-        )
-      ) and
+    unused = count(ExprStmt e | e.getValue().getAFlowNode() = callee.getACall()) and
     total = count(callee.getACall())
   |
     percentage_used = (100.0 * (total - unused) / total).floor()

python/ql/src/Resources/FileOpen.qll

@@ -138,12 +138,12 @@ predicate function_opens_file(FunctionValue f) {
   f = Value::named("open")
   or
   exists(EssaVariable v, Return ret | ret.getScope() = f.getScope() |
-    v.getNode() = ret.getValue().getAUse() and
+    ret.getValue().getAFlowNode() = v.getAUse() and
     var_is_open(v, _)
   )
   or
   exists(Return ret, FunctionValue callee | ret.getScope() = f.getScope() |
-    callee.getNode() = ret.getValue().getACall() and
+    ret.getValue().getAFlowNode() = callee.getACall() and
     function_opens_file(callee)
   )
 }

python/ql/src/Security/CWE-798/HardcodedCredentials.ql

@@ -94,7 +94,7 @@ class CredentialSink extends DataFlow::Node {
         this.(DataFlow::ArgumentNode).argumentOf(_, pos)
       )
       or
-      exists(Keyword k | k.getArg() = name and this.asCfgNode().getNode() = k.getValue())
+      exists(Keyword k | k.getArg() = name and k.getValue().getAFlowNode() = this.asCfgNode())
       or
       exists(CompareNode cmp, NameNode n | n.getId() = name |
         cmp.operands(this.asCfgNode(), any(Eq eq), n)

python/ql/src/Statements/IterableStringOrSequence.ql

@@ -25,7 +25,7 @@ from
   For loop, ControlFlowNodeWithPointsTo iter, Value str, Value seq, ControlFlowNode seq_origin,
   ControlFlowNode str_origin
 where
-  iter.getNode() = loop.getIter() and
+  loop.getIter().getAFlowNode() = iter and
   iter.pointsTo(str, str_origin) and
   iter.pointsTo(seq, seq_origin) and
   has_string_type(str) and

python/ql/src/Statements/NestedLoopsSameVariableWithReuse.ql

@@ -15,7 +15,7 @@
 import python
 
 predicate loop_variable_ssa(For f, Variable v, SsaVariable s) {
-  s.getDefinition().getNode() = f.getTarget() and v = s.getVariable()
+  f.getTarget().getAFlowNode() = s.getDefinition() and v = s.getVariable()
 }
 
 predicate variableUsedInNestedLoops(For inner, For outer, Variable v, Name n) {

python/ql/src/Statements/NonIteratorInForLoop.ql

@@ -16,7 +16,7 @@ private import LegacyPointsTo
 
 from For loop, ControlFlowNodeWithPointsTo iter, Value v, ClassValue t, ControlFlowNode origin
 where
-  iter.getNode() = loop.getIter() and
+  loop.getIter().getAFlowNode() = iter and
   iter.pointsTo(_, v, origin) and
   v.getClass() = t and
   not t.isIterable() and

python/ql/src/Statements/SideEffectInAssert.ql

@@ -24,13 +24,11 @@ predicate func_with_side_effects(Expr e) {
 }
 
 predicate call_with_side_effect(Call e) {
-  exists(ControlFlowNode eCfg | eCfg.getNode() = e |
-    eCfg =
-      API::moduleImport("subprocess")
-          .getMember(["call", "check_call", "check_output"])
-          .getACall()
-          .asCfgNode()
-  )
+  e.getAFlowNode() =
+    API::moduleImport("subprocess")
+        .getMember(["call", "check_call", "check_output"])
+        .getACall()
+        .asCfgNode()
 }
 
 predicate probable_side_effect(Expr e) {

python/ql/src/Variables/Definition.qll

@@ -133,11 +133,7 @@ class ListComprehensionDeclaration extends ListComp {
     major_version() = 2 and
     this.getIterationVariable(_).getId() = result.getId() and
     result.getScope() = this.getScope() and
-    exists(ControlFlowNode thisCfg, ControlFlowNode resultCfg |
-      thisCfg.getNode() = this and resultCfg.getNode() = result
-    |
-      thisCfg.strictlyReaches(resultCfg)
-    ) and
+    this.getAFlowNode().strictlyReaches(result.getAFlowNode()) and
     result.isUse()
   }
 

python/ql/src/Variables/LeakingListComprehension.ql

@@ -13,21 +13,18 @@
 import python
 import Definition
 
-from
-  ListComprehensionDeclaration l, Name use, Name defn, ControlFlowNode lCfg, ControlFlowNode useCfg
+from ListComprehensionDeclaration l, Name use, Name defn
 where
   use = l.getALeakedVariableUse() and
   defn = l.getDefinition() and
-  lCfg.getNode() = l and
-  useCfg.getNode() = use and
-  lCfg.strictlyReaches(useCfg) and
+  l.getAFlowNode().strictlyReaches(use.getAFlowNode()) and
   /* Make sure we aren't in a loop, as the variable may be redefined */
-  not useCfg.strictlyReaches(lCfg) and
+  not use.getAFlowNode().strictlyReaches(l.getAFlowNode()) and
   not l.contains(use) and
   not use.deletes(_) and
   not exists(SsaVariable v |
-    v.getAUse() = useCfg and
-    not v.getDefinition().strictlyDominates(lCfg)
+    v.getAUse() = use.getAFlowNode() and
+    not v.getDefinition().strictlyDominates(l.getAFlowNode())
   )
 select use,
   use.getId() + " may have a different value in Python 3, as the $@ will not be in scope.", defn,

python/ql/src/Variables/Loop.qll

@@ -26,11 +26,8 @@ private Stmt loop_probably_defines(Variable v) {
 
 /** Holds if the variable used by `use` is probably defined in a loop */
 predicate probably_defined_in_loop(Name use) {
-  exists(Stmt loop, ControlFlowNode loopCfg, ControlFlowNode useCfg |
-    loop = loop_probably_defines(use.getVariable()) and
-    loopCfg.getNode() = loop and
-    useCfg.getNode() = use and
-    loopCfg.strictlyReaches(useCfg)
+  exists(Stmt loop | loop = loop_probably_defines(use.getVariable()) |
+    loop.getAFlowNode().strictlyReaches(use.getAFlowNode())
   )
 }
 

python/ql/src/Variables/MultiplyDefined.ql

@@ -24,8 +24,8 @@ predicate multiply_defined(AstNode asgn1, AstNode asgn2, Variable v) {
 
   forex(Definition def, Definition redef |
     def.getVariable() = v and
-    def.getNode() = asgn1 and
-    redef.getNode() = asgn2
+    def = asgn1.getAFlowNode() and
+    redef = asgn2.getAFlowNode()
   |
     def.isUnused() and
     def.getARedef() = redef and

python/ql/src/Variables/SuspiciousUnusedLoopIterationVariable.ql

@@ -88,9 +88,7 @@ predicate implicit_repeat(For f) {
  * E.g. gets `x` from `{ y for y in x }`.
  */
 ControlFlowNode get_comp_iterable(For f) {
-  exists(Comp c, ControlFlowNode cCfg |
-    c.getFunction().getStmt(0) = f and cCfg.getNode() = c and cCfg.getAPredecessor() = result
-  )
+  exists(Comp c | c.getFunction().getStmt(0) = f | c.getAFlowNode().getAPredecessor() = result)
 }
 
 from For f, Variable v, string msg

python/ql/src/Variables/Undefined.qll

@@ -19,10 +19,9 @@ private predicate loop_entry_variables(EssaVariable pred, EssaVariable succ) {
 private predicate loop_entry_edge(BasicBlock pred, BasicBlock loop) {
   pred = loop.getAPredecessor() and
   pred = loop.getImmediateDominator() and
-  exists(Stmt s, ControlFlowNode sCfg |
+  exists(Stmt s |
     loop_probably_executes_at_least_once(s) and
-    sCfg.getNode() = s and
-    sCfg.getBasicBlock() = loop
+    s.getAFlowNode().getBasicBlock() = loop
   )
 }
 

python/ql/src/Variables/UndefinedGlobal.ql

@@ -27,7 +27,7 @@ predicate guarded_against_name_error(Name u) {
   |
     globals.getFunc().(Name).getId() = "globals" and
     guard.controls(controlled, _) and
-    exists(ControlFlowNode uCfg | uCfg.getNode() = u | controlled.contains(uCfg))
+    controlled.contains(u.getAFlowNode())
   )
 }
 
@@ -101,18 +101,18 @@ predicate undefined_use(Name u) {
 }
 
 private predicate first_use_in_a_block(Name use) {
-  exists(GlobalVariable v, BasicBlock b, int i, ControlFlowNode useCfg | useCfg.getNode() = use |
-    i = min(int j | b.getNode(j).getNode() = v.getALoad()) and b.getNode(i) = useCfg
+  exists(GlobalVariable v, BasicBlock b, int i |
+    i = min(int j | b.getNode(j).getNode() = v.getALoad()) and b.getNode(i) = use.getAFlowNode()
   )
 }
 
 predicate first_undefined_use(Name use) {
   undefined_use(use) and
-  exists(GlobalVariable v, ControlFlowNode useCfg | v.getALoad() = use and useCfg.getNode() = use |
+  exists(GlobalVariable v | v.getALoad() = use |
     first_use_in_a_block(use) and
     not exists(ControlFlowNode other |
       other.getNode() = v.getALoad() and
-      other.getBasicBlock().strictlyDominates(useCfg.getBasicBlock())
+      other.getBasicBlock().strictlyDominates(use.getAFlowNode().getBasicBlock())
     )
   )
 }

python/ql/src/Variables/UndefinedPlaceHolder.ql

@@ -18,8 +18,8 @@ private import semmle.python.types.ImportTime
 
 /* Local variable part */
 predicate initialized_as_local(PlaceHolder use) {
-  exists(SsaVariableWithPointsTo l, Function f, ControlFlowNode useCfg |
-    f = use.getScope() and useCfg.getNode() = use and l.getAUse() = useCfg
+  exists(SsaVariableWithPointsTo l, Function f |
+    f = use.getScope() and l.getAUse() = use.getAFlowNode()
   |
     l.getVariable() instanceof LocalVariable and
     not l.maybeUndefined()

python/ql/src/Variables/UnusedModuleVariable.ql

@@ -54,7 +54,7 @@ predicate unused_global(Name unused, GlobalVariable v) {
       u.uses(v)
     |
       // That is reachable from this definition, directly
-      exists(ControlFlowNode uCfg | uCfg.getNode() = u | defn.strictlyReaches(uCfg))
+      defn.strictlyReaches(u.getAFlowNode())
       or
       // indirectly
       defn.getBasicBlock().reachesExit() and u.getScope() != unused.getScope()

python/ql/src/analysis/CrossProjectDefinitions.qll

@@ -48,17 +48,15 @@ class Symbol extends TSymbol {
   AstNode find() {
     this = TModule(result)
     or
-    exists(Symbol s, string name, ControlFlowNode resultCfg |
-      this = TMember(s, name) and resultCfg.getNode() = result
-    |
+    exists(Symbol s, string name | this = TMember(s, name) |
       exists(ClassObject cls |
         s.resolvesTo() = cls and
-        cls.attributeRefersTo(name, _, resultCfg)
+        cls.attributeRefersTo(name, _, result.getAFlowNode())
       )
       or
       exists(ModuleObject m |
         s.resolvesTo() = m and
-        m.attributeRefersTo(name, _, resultCfg)
+        m.attributeRefersTo(name, _, result.getAFlowNode())
       )
     )
   }

python/ql/src/analysis/ImportFailure.ql

@@ -80,11 +80,10 @@ class VersionGuard extends ConditionBlock {
   VersionGuard() { this.getLastNode() instanceof VersionTest }
 }
 
-from ImportExpr ie, ControlFlowNode ieCfg
+from ImportExpr ie
 where
-  ieCfg.getNode() = ie and
   not ie.(ExprWithPointsTo).refersTo(_) and
-  exists(Context c | c.appliesTo(ieCfg)) and
+  exists(Context c | c.appliesTo(ie.getAFlowNode())) and
   not ok_to_fail(ie) and
-  not exists(VersionGuard guard | guard.controls(ieCfg.getBasicBlock(), _))
+  not exists(VersionGuard guard | guard.controls(ie.getAFlowNode().getBasicBlock(), _))
 select ie, "Unable to resolve import of '" + ie.getImportedModuleName() + "'."

python/ql/src/analysis/KeyPointsToFailure.ql

@@ -11,13 +11,13 @@ import python
 import semmle.python.pointsto.PointsTo
 
 predicate points_to_failure(Expr e) {
-  exists(ControlFlowNode f | f.getNode() = e | not PointsTo::pointsTo(f, _, _, _))
+  exists(ControlFlowNode f | f = e.getAFlowNode() | not PointsTo::pointsTo(f, _, _, _))
 }
 
 predicate key_points_to_failure(Expr e) {
   points_to_failure(e) and
   not points_to_failure(e.getASubExpression()) and
-  not exists(SsaVariable ssa, ControlFlowNode eCfg | eCfg.getNode() = e and ssa.getAUse() = eCfg |
+  not exists(SsaVariable ssa | ssa.getAUse() = e.getAFlowNode() |
     points_to_failure(ssa.getAnUltimateDefinition().getDefinition().getNode())
   ) and
   not exists(Assign a | a.getATarget() = e)

python/ql/src/analysis/PointsToFailure.ql

@@ -12,5 +12,5 @@ import python
 private import LegacyPointsTo
 
 from Expr e
-where exists(ControlFlowNodeWithPointsTo f | f.getNode() = e | not f.refersTo(_))
+where exists(ControlFlowNodeWithPointsTo f | f = e.getAFlowNode() | not f.refersTo(_))
 select e, "Expression does not 'point-to' any object."

python/ql/src/semmle/python/functions/ModificationOfParameterWithDefaultCustomizations.qll

@@ -131,7 +131,7 @@ module ModificationOfParameterWithDefault {
       exists(DeletionNode d | d.getTarget().(SubscriptNode).getObject() = this.asCfgNode())
       or
       // augmented assignment to the value
-      exists(AugAssign a | this.asCfgNode().getNode() = a.getTarget())
+      exists(AugAssign a | a.getTarget().getAFlowNode() = this.asCfgNode())
       or
       // modifying function call
       exists(DataFlow::CallCfgNode c, DataFlow::AttrRead a | c.getFunction() = a |

python/ql/test/2/library-tests/comprehensions/ConsistencyCheck.ql

@@ -5,7 +5,5 @@
 import python
 
 select count(Comprehension c |
-    count(c.toString()) != 1 or
-    count(c.getLocation()) != 1 or
-    not exists(ControlFlowNode n | n.getNode() = c)
+    count(c.toString()) != 1 or count(c.getLocation()) != 1 or not exists(c.getAFlowNode())
   )

python/ql/test/experimental/import-resolution/importflow.ql

@@ -45,15 +45,13 @@ private class VersionGuardedNode extends DataFlow::Node {
 
   VersionGuardedNode() {
     version in [2, 3] and
-    exists(If parent, CompareNode c, ControlFlowNode litCfg |
-      parent.getBody().contains(this.asExpr()) and
-      litCfg.getNode() = any(IntegerLiteral lit | lit.getValue() = version)
-    |
+    exists(If parent, CompareNode c | parent.getBody().contains(this.asExpr()) |
       c.operands(API::moduleImport("sys")
             .getMember("version_info")
             .getASubscript()
             .asSource()
-            .asCfgNode(), any(Eq eq), litCfg)
+            .asCfgNode(), any(Eq eq),
+        any(IntegerLiteral lit | lit.getValue() = version).getAFlowNode())
     )
   }
 

python/ql/test/library-tests/ControlFlow/PointsToSupport/UseFromDefinition.ql

@@ -9,7 +9,7 @@ Expr assignedValue(Name n) {
 
 from Name def, DefinitionNode d
 where
-  d.getNode() = def and
+  d = def.getAFlowNode() and
   exists(assignedValue(def)) and
   not d.getValue().getNode() = assignedValue(def)
 select def.toString(), assignedValue(def)

python/ql/test/library-tests/ControlFlow/splitting/NodeCount.ql

@@ -8,4 +8,4 @@ where
   not a instanceof ExprStmt and
   a.getScope() = s and
   s instanceof Function
-select a.getLocation().getStartLine(), s.getName(), a, count(ControlFlowNode n | n.getNode() = a)
+select a.getLocation().getStartLine(), s.getName(), a, count(a.getAFlowNode())

python/ql/test/library-tests/PointsTo/global/Global.ql

@@ -3,6 +3,6 @@ private import LegacyPointsTo
 
 from ControlFlowNode f, PointsToContext ctx, Value obj, ControlFlowNode orig
 where
-  exists(ExprStmt s | f.getNode() = s.getValue()) and
+  exists(ExprStmt s | s.getValue().getAFlowNode() = f) and
   PointsTo::pointsTo(f, ctx, obj, orig)
 select ctx, f, obj.toString(), orig

python/ql/test/library-tests/PointsTo/local/LocalPointsTo.ql

@@ -4,6 +4,6 @@ import semmle.python.objects.ObjectInternal
 
 from ControlFlowNode f, ObjectInternal obj, ControlFlowNode orig
 where
-  exists(ExprStmt s | f.getNode() = s.getValue()) and
+  exists(ExprStmt s | s.getValue().getAFlowNode() = f) and
   PointsTo::pointsTo(f, _, obj, orig)
 select f, obj.toString(), orig

python/ql/test/library-tests/dataflow/tainttracking/TestTaintLib.qll

@@ -43,7 +43,7 @@ query predicate test_taint(string arg_location, string test_res, string scope_na
       // TODO: Replace with `hasFlowToExpr` once that is working
       if
         TestTaintTrackingFlow::flowTo(any(DataFlow::Node n |
-            n.(DataFlow::CfgNode).getNode().getNode() = arg
+            n.(DataFlow::CfgNode).getNode() = arg.getAFlowNode()
           ))
       then has_taint = true
       else has_taint = false

python/tools/recorded-call-graph-metrics/ql/lib/RecordedCalls.qll

@@ -238,10 +238,9 @@ module PointsToBasedCallGraph {
     Value calleeValue;
 
     ResolvableRecordedCall() {
-      exists(Call call, XmlCallee xmlCallee, ControlFlowNode callCfg |
+      exists(Call call, XmlCallee xmlCallee |
         call = this.getACall() and
-        callCfg.getNode() = call and
-        calleeValue.getACall() = callCfg and
+        calleeValue.getACall() = call.getAFlowNode() and
         xmlCallee = this.getXmlCallee() and
         (
           xmlCallee instanceof XmlPythonCallee and