C++: Update stats to add coroutines

Initial impl won't support it

change-notes/1.25/analysis-javascript.md

@@ -30,7 +30,7 @@
   - [yargs](https://www.npmjs.com/package/yargs)
   - [webpack-dev-server](https://www.npmjs.com/package/webpack-dev-server)
 
-* TypeScript 4.0 is now supported.
+* TypeScript 3.9 is now supported.
 
 * TypeScript code embedded in HTML and Vue files is now extracted and analyzed.
 

cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImplConsistency.qll

@@ -123,18 +123,8 @@ module Consistency {
     n.getEnclosingCallable() != call.getEnclosingCallable()
   }
 
-  // This predicate helps the compiler forget that in some languages
-  // it is impossible for a result of `getPreUpdateNode` to be an
-  // instance of `PostUpdateNode`.
-  private Node getPre(PostUpdateNode n) {
-    result = n.getPreUpdateNode()
-    or
-    none()
-  }
-
   query predicate postIsNotPre(PostUpdateNode n, string msg) {
-    getPre(n) = n and
-    msg = "PostUpdateNode should not equal its pre-update node."
+    n.getPreUpdateNode() = n and msg = "PostUpdateNode should not equal its pre-update node."
   }
 
   query predicate postHasUniquePre(PostUpdateNode n, string msg) {
@@ -162,6 +152,12 @@ module Consistency {
     msg = "Origin of readStep is missing a PostUpdateNode."
   }
 
+  query predicate storeIsPostUpdate(Node n, string msg) {
+    storeStep(_, _, n) and
+    not n instanceof PostUpdateNode and
+    msg = "Store targets should be PostUpdateNodes."
+  }
+
   query predicate argHasPostUpdate(ArgumentNode n, string msg) {
     not hasPost(n) and
     not isImmutableOrUnobservable(n) and

cpp/ql/src/semmle/code/cpp/exprs/Expr.qll

@@ -1268,3 +1268,32 @@ class SpaceshipExpr extends BinaryOperation, @spaceshipexpr {
 
   override string getOperator() { result = "<=>" }
 }
+
+/**
+ * A C/C++ co_await expression
+ * ```
+ * co_await foo();
+ * ```
+ */
+class CoAwaitExpr extends UnaryOperation, @co_await {
+  override string getAPrimaryQlClass() { result = "CoAwaitExpr" }
+
+  override string getOperator() { result = "co_await" }
+
+  override int getPrecedence() { result = 16 }
+}
+
+
+/**
+ * A C/C++ co_yield expression
+ * ```
+ * co_yield 1;
+ * ```
+ */
+class CoYieldExpr extends UnaryOperation, @co_yield {
+  override string getAPrimaryQlClass() { result = "CoYieldExpr" }
+
+  override string getOperator() { result = "co_yield" }
+
+  override int getPrecedence() { result = 2 }
+}

cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImplConsistency.qll

@@ -123,18 +123,8 @@ module Consistency {
     n.getEnclosingCallable() != call.getEnclosingCallable()
   }
 
-  // This predicate helps the compiler forget that in some languages
-  // it is impossible for a result of `getPreUpdateNode` to be an
-  // instance of `PostUpdateNode`.
-  private Node getPre(PostUpdateNode n) {
-    result = n.getPreUpdateNode()
-    or
-    none()
-  }
-
   query predicate postIsNotPre(PostUpdateNode n, string msg) {
-    getPre(n) = n and
-    msg = "PostUpdateNode should not equal its pre-update node."
+    n.getPreUpdateNode() = n and msg = "PostUpdateNode should not equal its pre-update node."
   }
 
   query predicate postHasUniquePre(PostUpdateNode n, string msg) {
@@ -162,6 +152,12 @@ module Consistency {
     msg = "Origin of readStep is missing a PostUpdateNode."
   }
 
+  query predicate storeIsPostUpdate(Node n, string msg) {
+    storeStep(_, _, n) and
+    not n instanceof PostUpdateNode and
+    msg = "Store targets should be PostUpdateNodes."
+  }
+
   query predicate argHasPostUpdate(ArgumentNode n, string msg) {
     not hasPost(n) and
     not isImmutableOrUnobservable(n) and

cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll

@@ -144,23 +144,8 @@ OutNode getAnOutNode(DataFlowCall call, ReturnKind kind) {
  */
 predicate jumpStep(Node n1, Node n2) { none() }
 
-/**
- * Gets the field corresponding to the bit range `[startBit..endBit)` of class `c`.
- */
-private Field getField(Class c, int startBit, int endBit) {
-  result.getDeclaringType() = c and
-  startBit = 8 * result.getByteOffset() and
-  endBit = 8 * result.getType().getSize() + startBit
-  or
-  exists(Field f, Class cInner |
-    f = c.getAField() and
-    cInner = f.getUnderlyingType() and
-    result = getField(cInner, startBit - 8 * f.getByteOffset(), endBit - 8 * f.getByteOffset())
-  )
-}
-
 private newtype TContent =
-  TFieldContent(Class c, int startBit, int endBit) { exists(getField(c, startBit, endBit)) } or
+  TFieldContent(Field f) or
   TCollectionContent() or
   TArrayContent()
 
@@ -177,18 +162,18 @@ class Content extends TContent {
   }
 }
 
-class FieldContent extends Content, TFieldContent {
-  Class c;
-  int startBit;
-  int endBit;
+private class FieldContent extends Content, TFieldContent {
+  Field f;
 
-  FieldContent() { this = TFieldContent(c, startBit, endBit) }
+  FieldContent() { this = TFieldContent(f) }
 
-  override string toString() { result = getField().toString() }
+  Field getField() { result = f }
 
-  predicate hasOffset(Class cl, int start, int end) { cl = c and start = startBit and end = endBit }
+  override string toString() { result = f.toString() }
 
-  Field getField() { result = getField(c, startBit, endBit) }
+  override predicate hasLocationInfo(string path, int sl, int sc, int el, int ec) {
+    f.getLocation().hasLocationInfo(path, sl, sc, el, ec)
+  }
 }
 
 private class CollectionContent extends Content, TCollectionContent {
@@ -200,26 +185,20 @@ private class ArrayContent extends Content, TArrayContent {
 }
 
 private predicate storeStepNoChi(Node node1, Content f, PostUpdateNode node2) {
-  exists(StoreInstruction store |
+  exists(FieldAddressInstruction fa, StoreInstruction store |
     store = node2.asInstruction() and
+    store.getDestinationAddress() = fa and
     store.getSourceValue() = node1.asInstruction() and
-    f.(FieldContent).getField() = store.getDestinationAddress().(FieldInstruction).getField()
+    f.(FieldContent).getField() = fa.getField()
   )
 }
 
 private predicate storeStepChi(Node node1, Content f, PostUpdateNode node2) {
-  exists(StoreInstruction store, ChiInstruction chi |
+  exists(FieldAddressInstruction fa, StoreInstruction store |
     node1.asInstruction() = store and
-    node2.asInstruction() = chi and
-    chi.getPartial() = store and
-    (
-      exists(int startBit, int endBit |
-        chi.getUpdatedInterval(startBit, endBit) and
-        f.(FieldContent).hasOffset(chi.getResultType(), startBit, endBit)
-      )
-      or
-      f.(FieldContent).getField() = store.getDestinationAddress().(FieldInstruction).getField()
-    )
+    store.getDestinationAddress() = fa and
+    node2.asInstruction().(ChiInstruction).getPartial() = store and
+    f.(FieldContent).getField() = fa.getField()
   )
 }
 
@@ -239,18 +218,11 @@ predicate storeStep(Node node1, Content f, PostUpdateNode node2) {
  * `node2`.
  */
 predicate readStep(Node node1, Content f, Node node2) {
-  exists(LoadInstruction load |
-    node2.asInstruction() = load and
+  exists(FieldAddressInstruction fa, LoadInstruction load |
+    load.getSourceAddress() = fa and
     node1.asInstruction() = load.getSourceValueOperand().getAnyDef() and
-    (
-      exists(Class c, int startBit, int endBit |
-        c = load.getSourceValueOperand().getAnyDef().getResultType() and
-        load.getSourceValueOperand().getUsedInterval(startBit, endBit) and
-        f.(FieldContent).hasOffset(c, startBit, endBit)
-      )
-      or
-      f.(FieldContent).getField() = load.getSourceAddress().(FieldInstruction).getField()
-    )
+    fa.getField() = f.(FieldContent).getField() and
+    load = node2.asInstruction()
   )
 }
 

cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll

@@ -10,8 +10,6 @@ private import semmle.code.cpp.ir.ValueNumbering
 private import semmle.code.cpp.ir.IR
 private import semmle.code.cpp.controlflow.IRGuards
 private import semmle.code.cpp.models.interfaces.DataFlow
-private import semmle.code.cpp.ir.implementation.aliased_ssa.internal.AliasedSSA
-private import semmle.code.cpp.ir.internal.IntegerConstant
 
 private newtype TIRDataFlowNode =
   TInstructionNode(Instruction i) or
@@ -325,14 +323,12 @@ abstract private class PartialDefinitionNode extends PostUpdateNode {
 
 private class ExplicitFieldStoreQualifierNode extends PartialDefinitionNode {
   override ChiInstruction instr;
-  StoreInstruction store;
+  FieldAddressInstruction field;
 
   ExplicitFieldStoreQualifierNode() {
     not instr.isResultConflated() and
-    instr.getPartial() = store and
-    (
-      instr.getUpdatedInterval(_, _) or
-      store.getDestinationAddress() instanceof FieldAddressInstruction
+    exists(StoreInstruction store |
+      instr.getPartial() = store and field = store.getDestinationAddress()
     )
   }
 
@@ -343,12 +339,7 @@ private class ExplicitFieldStoreQualifierNode extends PartialDefinitionNode {
   override Node getPreUpdateNode() { result.asOperand() = instr.getTotalOperand() }
 
   override Expr getDefinedExpr() {
-    result =
-      store
-          .getDestinationAddress()
-          .(FieldAddressInstruction)
-          .getObjectAddress()
-          .getUnconvertedResultExpression()
+    result = field.getObjectAddress().getUnconvertedResultExpression()
   }
 }
 
@@ -360,22 +351,17 @@ private class ExplicitFieldStoreQualifierNode extends PartialDefinitionNode {
  */
 private class ExplicitSingleFieldStoreQualifierNode extends PartialDefinitionNode {
   override StoreInstruction instr;
+  FieldAddressInstruction field;
 
   ExplicitSingleFieldStoreQualifierNode() {
-    not exists(ChiInstruction chi | chi.getPartial() = instr) and
-    // Without this condition any store would create a `PostUpdateNode`.
-    instr.getDestinationAddress() instanceof FieldAddressInstruction
+    field = instr.getDestinationAddress() and
+    not exists(ChiInstruction chi | chi.getPartial() = instr)
   }
 
   override Node getPreUpdateNode() { none() }
 
   override Expr getDefinedExpr() {
-    result =
-      instr
-          .getDestinationAddress()
-          .(FieldAddressInstruction)
-          .getObjectAddress()
-          .getUnconvertedResultExpression()
+    result = field.getObjectAddress().getUnconvertedResultExpression()
   }
 }
 

cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll

@@ -1962,13 +1962,6 @@ class ChiInstruction extends Instruction {
    * Gets the operand that represents the new value written by the memory write.
    */
   final Instruction getPartial() { result = getPartialOperand().getDef() }
-
-  /**
-   * Gets the bit range `[startBit, endBit)` updated by the partial operand of this `ChiInstruction`.
-   */
-  final predicate getUpdatedInterval(int startBit, int endBit) {
-    Construction::getIntervalUpdatedByChi(this, startBit, endBit)
-  }
 }
 
 /**

cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/Operand.qll

@@ -328,14 +328,6 @@ class NonPhiMemoryOperand extends NonPhiOperand, MemoryOperand, NonPhiMemoryOper
     not Construction::isInCycle(useInstr) and
     strictcount(Construction::getMemoryOperandDefinition(useInstr, tag, _)) = 1
   }
-
-  /**
-   * Holds if the operand totally overlaps with its definition and consumes the
-   * bit range `[startBitOffset, endBitOffset)`.
-   */
-  predicate getUsedInterval(int startBitOffset, int endBitOffset) {
-    Construction::getUsedInterval(this, startBitOffset, endBitOffset)
-  }
 }
 
 /**

cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasedSSA.qll

@@ -617,9 +617,3 @@ MemoryLocation getOperandMemoryLocation(MemoryOperand operand) {
     )
   )
 }
-
-/** Gets the start bit offset of a `MemoryLocation`, if any. */
-int getStartBitOffset(VariableMemoryLocation location) { result = location.getStartBitOffset() }
-
-/** Gets the end bit offset of a `MemoryLocation`, if any. */
-int getEndBitOffset(VariableMemoryLocation location) { result = location.getEndBitOffset() }

cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstruction.qll

@@ -149,34 +149,6 @@ private module Cached {
     )
   }
 
-  /**
-   * Holds if the partial operand of this `ChiInstruction` updates the bit range
-   * `[startBitOffset, endBitOffset)` of the total operand.
-   */
-  cached
-  predicate getIntervalUpdatedByChi(ChiInstruction chi, int startBitOffset, int endBitOffset) {
-    exists(Alias::MemoryLocation location, OldInstruction oldInstruction |
-      oldInstruction = getOldInstruction(chi.getPartial()) and
-      location = Alias::getResultMemoryLocation(oldInstruction) and
-      startBitOffset = Alias::getStartBitOffset(location) and
-      endBitOffset = Alias::getEndBitOffset(location)
-    )
-  }
-
-  /**
-   * Holds if `operand` totally overlaps with its definition and consumes the bit range
-   * `[startBitOffset, endBitOffset)`.
-   */
-  cached
-  predicate getUsedInterval(NonPhiMemoryOperand operand, int startBitOffset, int endBitOffset) {
-    exists(Alias::MemoryLocation location, OldIR::NonPhiMemoryOperand oldOperand |
-      oldOperand = operand.getUse().(OldInstruction).getAnOperand() and
-      location = Alias::getOperandMemoryLocation(oldOperand) and
-      startBitOffset = Alias::getStartBitOffset(location) and
-      endBitOffset = Alias::getEndBitOffset(location)
-    )
-  }
-
   /**
    * Holds if `instr` is part of a cycle in the operand graph that doesn't go
    * through a phi instruction and therefore should be impossible.

cpp/ql/src/semmle/code/cpp/ir/implementation/raw/Instruction.qll

@@ -1962,13 +1962,6 @@ class ChiInstruction extends Instruction {
    * Gets the operand that represents the new value written by the memory write.
    */
   final Instruction getPartial() { result = getPartialOperand().getDef() }
-
-  /**
-   * Gets the bit range `[startBit, endBit)` updated by the partial operand of this `ChiInstruction`.
-   */
-  final predicate getUpdatedInterval(int startBit, int endBit) {
-    Construction::getIntervalUpdatedByChi(this, startBit, endBit)
-  }
 }
 
 /**

cpp/ql/src/semmle/code/cpp/ir/implementation/raw/Operand.qll

@@ -328,14 +328,6 @@ class NonPhiMemoryOperand extends NonPhiOperand, MemoryOperand, NonPhiMemoryOper
     not Construction::isInCycle(useInstr) and
     strictcount(Construction::getMemoryOperandDefinition(useInstr, tag, _)) = 1
   }
-
-  /**
-   * Holds if the operand totally overlaps with its definition and consumes the
-   * bit range `[startBitOffset, endBitOffset)`.
-   */
-  predicate getUsedInterval(int startBitOffset, int endBitOffset) {
-    Construction::getUsedInterval(this, startBitOffset, endBitOffset)
-  }
 }
 
 /**

cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/IRConstruction.qll

@@ -182,18 +182,6 @@ Instruction getMemoryOperandDefinition(
   none()
 }
 
-/**
- * Holds if the partial operand of this `ChiInstruction` updates the bit range
- * `[startBitOffset, endBitOffset)` of the total operand.
- */
-predicate getIntervalUpdatedByChi(ChiInstruction chi, int startBit, int endBit) { none() }
-
-/**
- * Holds if the operand totally overlaps with its definition and consumes the
- * bit range `[startBitOffset, endBitOffset)`.
- */
-predicate getUsedInterval(Operand operand, int startBit, int endBit) { none() }
-
 /** Gets a non-phi instruction that defines an operand of `instr`. */
 private Instruction getNonPhiOperandDef(Instruction instr) {
   result = getRegisterOperandDefinition(instr, _)

cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll

@@ -1962,13 +1962,6 @@ class ChiInstruction extends Instruction {
    * Gets the operand that represents the new value written by the memory write.
    */
   final Instruction getPartial() { result = getPartialOperand().getDef() }
-
-  /**
-   * Gets the bit range `[startBit, endBit)` updated by the partial operand of this `ChiInstruction`.
-   */
-  final predicate getUpdatedInterval(int startBit, int endBit) {
-    Construction::getIntervalUpdatedByChi(this, startBit, endBit)
-  }
 }
 
 /**

cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/Operand.qll

@@ -328,14 +328,6 @@ class NonPhiMemoryOperand extends NonPhiOperand, MemoryOperand, NonPhiMemoryOper
     not Construction::isInCycle(useInstr) and
     strictcount(Construction::getMemoryOperandDefinition(useInstr, tag, _)) = 1
   }
-
-  /**
-   * Holds if the operand totally overlaps with its definition and consumes the
-   * bit range `[startBitOffset, endBitOffset)`.
-   */
-  predicate getUsedInterval(int startBitOffset, int endBitOffset) {
-    Construction::getUsedInterval(this, startBitOffset, endBitOffset)
-  }
 }
 
 /**

cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll

@@ -149,34 +149,6 @@ private module Cached {
     )
   }
 
-  /**
-   * Holds if the partial operand of this `ChiInstruction` updates the bit range
-   * `[startBitOffset, endBitOffset)` of the total operand.
-   */
-  cached
-  predicate getIntervalUpdatedByChi(ChiInstruction chi, int startBitOffset, int endBitOffset) {
-    exists(Alias::MemoryLocation location, OldInstruction oldInstruction |
-      oldInstruction = getOldInstruction(chi.getPartial()) and
-      location = Alias::getResultMemoryLocation(oldInstruction) and
-      startBitOffset = Alias::getStartBitOffset(location) and
-      endBitOffset = Alias::getEndBitOffset(location)
-    )
-  }
-
-  /**
-   * Holds if `operand` totally overlaps with its definition and consumes the bit range
-   * `[startBitOffset, endBitOffset)`.
-   */
-  cached
-  predicate getUsedInterval(NonPhiMemoryOperand operand, int startBitOffset, int endBitOffset) {
-    exists(Alias::MemoryLocation location, OldIR::NonPhiMemoryOperand oldOperand |
-      oldOperand = operand.getUse().(OldInstruction).getAnOperand() and
-      location = Alias::getOperandMemoryLocation(oldOperand) and
-      startBitOffset = Alias::getStartBitOffset(location) and
-      endBitOffset = Alias::getEndBitOffset(location)
-    )
-  }
-
   /**
    * Holds if `instr` is part of a cycle in the operand graph that doesn't go
    * through a phi instruction and therefore should be impossible.

cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SimpleSSA.qll

@@ -79,9 +79,3 @@ MemoryLocation getResultMemoryLocation(Instruction instr) {
 MemoryLocation getOperandMemoryLocation(MemoryOperand operand) {
   result = getMemoryLocation(getAddressOperandAllocation(operand.getAddressOperand()))
 }
-
-/** Gets the start bit offset of a `MemoryLocation`, if any. */
-int getStartBitOffset(MemoryLocation location) { none() }
-
-/** Gets the end bit offset of a `MemoryLocation`, if any. */
-int getEndBitOffset(MemoryLocation location) { none() }

cpp/ql/src/semmle/code/cpp/stmts/Stmt.qll

@@ -662,6 +662,67 @@ class LabelStmt extends Stmt, @stmt_label {
   override predicate mayBeGloballyImpure() { none() }
 }
 
+/**
+ * A C/C++ 'co_return' statement.
+ *
+ * For example:
+ * ```
+ * co_return 1+2;
+ * ```
+ * or
+ * ```
+ * co_return;
+ * ```
+ */
+class CoReturnStmt extends Stmt, @stmt_co_return {
+  override string getAPrimaryQlClass() { result = "CoReturnStmt" }
+
+  /**
+   * Gets the operand of this 'co_return' statement.
+   *
+   * For example, for
+   * ```
+   * co_return 1+2;
+   * ```
+   * the operand is a function call `return_value(1+2)`, and for
+   * ```
+   * co_return;
+   * ```
+   * the operand is a function call `return_void()`.
+   */
+  FunctionCall getOperand() { result = this.getChild(0) }
+
+  /**
+   * Gets the expression of this 'co_return' statement, if any.
+   *
+   * For example, for
+   * ```
+   * co_return 1+2;
+   * ```
+   * the result is `1+2`, and there is no result for
+   * ```
+   * co_return;
+   * ```
+   */
+  Expr getExpr() { result = this.getOperand().getArgument(0) }
+
+  /**
+   * Holds if this 'co_return' statement has an expression.
+   *
+   * For example, this holds for
+   * ```
+   * co_return 1+2;
+   * ```
+   * but not for
+   * ```
+   * co_return;
+   * ```
+   */
+  predicate hasExpr() { exists(this.getExpr()) }
+
+  override string toString() { result = "co_return ..." }
+}
+
 /**
  * A C/C++ 'return' statement.
  *

cpp/ql/src/semmlecode.cpp.dbscheme

@@ -1228,6 +1228,8 @@ funbind(
             | @builtinaddressof
             | @vec_fill
             | @un_log_op_expr
+            | @co_await
+            | @co_yield
             ;
 
 @bin_log_op_expr = @andlogicalexpr | @orlogicalexpr;
@@ -1647,6 +1649,8 @@ case @expr.kind of
 | 324 = @builtinconvertvector
 | 325 = @builtincomplex
 | 326 = @spaceshipexpr
+| 327 = @co_await
+| 328 = @co_yield
 ;
 
 @var_args_expr = @vastartexpr
@@ -1851,6 +1855,7 @@ case @stmt.kind of
 |  33 = @stmt_handler
 // ...  34 @stmt_finally_end deprecated
 |  35 = @stmt_constexpr_if
+|  37 = @stmt_co_return
 ;
 
 type_vla(

cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-consistency.expected

@@ -14,6 +14,7 @@ postHasUniquePre
 uniquePostUpdate
 postIsInSameCallable
 reverseRead
+storeIsPostUpdate
 argHasPostUpdate
 | lambdas.cpp:18:7:18:7 | a | ArgumentNode is missing PostUpdateNode. |
 | lambdas.cpp:25:2:25:2 | b | ArgumentNode is missing PostUpdateNode. |

cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-ir-consistency.expected

@@ -29,4 +29,5 @@ postHasUniquePre
 uniquePostUpdate
 postIsInSameCallable
 reverseRead
+storeIsPostUpdate
 argHasPostUpdate

cpp/ql/test/library-tests/dataflow/fields/A.cpp

@@ -104,7 +104,7 @@ public:
   {
     if (C1 *c1 = dynamic_cast<C1 *>(c))
     {
-      sink(c1->a); // $ast,ir
+      sink(c1->a); // $ast $ir
     }
     C *cc;
     if (C2 *c2 = dynamic_cast<C2 *>(c))

cpp/ql/test/library-tests/dataflow/fields/aliasing.cpp

@@ -92,12 +92,3 @@ void nestedAssign() {
   w.s.m1 = user_input();
   sink(w.s.m1); // $ast,ir
 }
-
-void addressOfField() {
-  S s;
-  s.m1 = user_input();
-
-  S s_copy = s;
-  int* px = &s_copy.m1;
-  sink(*px); // $f-:ast $ir
-}

cpp/ql/test/library-tests/dataflow/fields/dataflow-consistency.expected

@@ -16,6 +16,7 @@ postHasUniquePre
 uniquePostUpdate
 postIsInSameCallable
 reverseRead
+storeIsPostUpdate
 argHasPostUpdate
 | A.cpp:41:15:41:21 | new | ArgumentNode is missing PostUpdateNode. |
 | A.cpp:55:12:55:19 | new | ArgumentNode is missing PostUpdateNode. |

cpp/ql/test/library-tests/dataflow/fields/dataflow-ir-consistency.expected

@@ -23,4 +23,5 @@ postHasUniquePre
 uniquePostUpdate
 postIsInSameCallable
 reverseRead
+storeIsPostUpdate
 argHasPostUpdate

cpp/ql/test/library-tests/dataflow/fields/flow-diff.expected

@@ -20,7 +20,6 @@
 | aliasing.cpp:42:11:42:20 | call to user_input | aliasing.cpp:43:13:43:14 | m1 | IR only |
 | aliasing.cpp:79:11:79:20 | call to user_input | aliasing.cpp:80:12:80:13 | m1 | IR only |
 | aliasing.cpp:86:10:86:19 | call to user_input | aliasing.cpp:87:12:87:13 | m1 | IR only |
-| aliasing.cpp:98:10:98:19 | call to user_input | aliasing.cpp:102:8:102:10 | * ... | IR only |
 | by_reference.cpp:84:14:84:23 | call to user_input | by_reference.cpp:111:25:111:25 | a | AST only |
 | by_reference.cpp:84:14:84:23 | call to user_input | by_reference.cpp:115:27:115:27 | a | AST only |
 | by_reference.cpp:88:13:88:22 | call to user_input | by_reference.cpp:131:25:131:25 | a | AST only |

cpp/ql/test/library-tests/dataflow/fields/ir-path-flow.expected

@@ -42,39 +42,24 @@ edges
 | C.cpp:27:8:27:11 | *#this [s1] | C.cpp:29:10:29:11 | s1 |
 | C.cpp:27:8:27:11 | *#this [s3] | C.cpp:31:10:31:11 | s3 |
 | aliasing.cpp:9:3:9:22 | Chi [m1] | aliasing.cpp:25:17:25:19 | pointerSetter output argument [m1] |
-| aliasing.cpp:9:3:9:22 | Chi [m1] | aliasing.cpp:25:17:25:19 | pointerSetter output argument [m1] |
-| aliasing.cpp:9:3:9:22 | Store | aliasing.cpp:9:3:9:22 | Chi [m1] |
 | aliasing.cpp:9:3:9:22 | Store | aliasing.cpp:9:3:9:22 | Chi [m1] |
 | aliasing.cpp:9:11:9:20 | call to user_input | aliasing.cpp:9:3:9:22 | Store |
 | aliasing.cpp:13:3:13:21 | Chi [m1] | aliasing.cpp:26:19:26:20 | referenceSetter output argument [m1] |
-| aliasing.cpp:13:3:13:21 | Chi [m1] | aliasing.cpp:26:19:26:20 | referenceSetter output argument [m1] |
-| aliasing.cpp:13:3:13:21 | Store | aliasing.cpp:13:3:13:21 | Chi [m1] |
 | aliasing.cpp:13:3:13:21 | Store | aliasing.cpp:13:3:13:21 | Chi [m1] |
 | aliasing.cpp:13:10:13:19 | call to user_input | aliasing.cpp:13:3:13:21 | Store |
 | aliasing.cpp:25:17:25:19 | Chi [m1] | aliasing.cpp:29:11:29:12 | m1 |
-| aliasing.cpp:25:17:25:19 | Chi [m1] | aliasing.cpp:29:11:29:12 | m1 |
-| aliasing.cpp:25:17:25:19 | pointerSetter output argument [m1] | aliasing.cpp:25:17:25:19 | Chi [m1] |
 | aliasing.cpp:25:17:25:19 | pointerSetter output argument [m1] | aliasing.cpp:25:17:25:19 | Chi [m1] |
 | aliasing.cpp:26:19:26:20 | Chi [m1] | aliasing.cpp:30:11:30:12 | m1 |
-| aliasing.cpp:26:19:26:20 | Chi [m1] | aliasing.cpp:30:11:30:12 | m1 |
-| aliasing.cpp:26:19:26:20 | referenceSetter output argument [m1] | aliasing.cpp:26:19:26:20 | Chi [m1] |
 | aliasing.cpp:26:19:26:20 | referenceSetter output argument [m1] | aliasing.cpp:26:19:26:20 | Chi [m1] |
 | aliasing.cpp:37:13:37:22 | call to user_input | aliasing.cpp:38:11:38:12 | m1 |
 | aliasing.cpp:42:11:42:20 | call to user_input | aliasing.cpp:43:13:43:14 | m1 |
 | aliasing.cpp:60:3:60:22 | Chi [m1] | aliasing.cpp:61:13:61:14 | Store [m1] |
-| aliasing.cpp:60:3:60:22 | Chi [m1] | aliasing.cpp:61:13:61:14 | Store [m1] |
-| aliasing.cpp:60:3:60:22 | Store | aliasing.cpp:60:3:60:22 | Chi [m1] |
 | aliasing.cpp:60:3:60:22 | Store | aliasing.cpp:60:3:60:22 | Chi [m1] |
 | aliasing.cpp:60:11:60:20 | call to user_input | aliasing.cpp:60:3:60:22 | Store |
 | aliasing.cpp:61:13:61:14 | Store [m1] | aliasing.cpp:62:14:62:15 | m1 |
-| aliasing.cpp:61:13:61:14 | Store [m1] | aliasing.cpp:62:14:62:15 | m1 |
 | aliasing.cpp:79:11:79:20 | call to user_input | aliasing.cpp:80:12:80:13 | m1 |
 | aliasing.cpp:86:10:86:19 | call to user_input | aliasing.cpp:87:12:87:13 | m1 |
 | aliasing.cpp:92:12:92:21 | call to user_input | aliasing.cpp:93:12:93:13 | m1 |
-| aliasing.cpp:98:3:98:21 | Chi [m1] | aliasing.cpp:100:14:100:14 | Store [m1] |
-| aliasing.cpp:98:3:98:21 | Store | aliasing.cpp:98:3:98:21 | Chi [m1] |
-| aliasing.cpp:98:10:98:19 | call to user_input | aliasing.cpp:98:3:98:21 | Store |
-| aliasing.cpp:100:14:100:14 | Store [m1] | aliasing.cpp:102:8:102:10 | * ... |
 | by_reference.cpp:50:3:50:3 | setDirectly output argument [a] | by_reference.cpp:51:8:51:8 | Argument -1 indirection [a] |
 | by_reference.cpp:50:17:50:26 | call to user_input | by_reference.cpp:50:3:50:3 | setDirectly output argument [a] |
 | by_reference.cpp:51:8:51:8 | Argument -1 indirection [a] | by_reference.cpp:51:10:51:20 | call to getDirectly |
@@ -88,130 +73,42 @@ edges
 | by_reference.cpp:68:21:68:30 | call to user_input | by_reference.cpp:68:17:68:18 | nonMemberSetA output argument [a] |
 | by_reference.cpp:69:22:69:23 | Argument 0 indirection [a] | by_reference.cpp:69:8:69:20 | call to nonMemberGetA |
 | by_reference.cpp:84:3:84:25 | Chi [a] | by_reference.cpp:102:21:102:39 | taint_inner_a_ptr output argument [a] |
-| by_reference.cpp:84:3:84:25 | Chi [a] | by_reference.cpp:102:21:102:39 | taint_inner_a_ptr output argument [a] |
-| by_reference.cpp:84:3:84:25 | Chi [a] | by_reference.cpp:102:21:102:39 | taint_inner_a_ptr output argument [inner_nested] |
 | by_reference.cpp:84:3:84:25 | Chi [a] | by_reference.cpp:106:21:106:41 | taint_inner_a_ptr output argument [a] |
-| by_reference.cpp:84:3:84:25 | Chi [a] | by_reference.cpp:106:21:106:41 | taint_inner_a_ptr output argument [a] |
-| by_reference.cpp:84:3:84:25 | Chi [a] | by_reference.cpp:106:21:106:41 | taint_inner_a_ptr output argument [inner_nested] |
-| by_reference.cpp:84:3:84:25 | Chi [inner_nested] | by_reference.cpp:102:21:102:39 | taint_inner_a_ptr output argument [a] |
-| by_reference.cpp:84:3:84:25 | Chi [inner_nested] | by_reference.cpp:102:21:102:39 | taint_inner_a_ptr output argument [inner_nested] |
-| by_reference.cpp:84:3:84:25 | Chi [inner_nested] | by_reference.cpp:106:21:106:41 | taint_inner_a_ptr output argument [a] |
-| by_reference.cpp:84:3:84:25 | Chi [inner_nested] | by_reference.cpp:106:21:106:41 | taint_inner_a_ptr output argument [inner_nested] |
 | by_reference.cpp:84:3:84:25 | Store | by_reference.cpp:84:3:84:25 | Chi [a] |
-| by_reference.cpp:84:3:84:25 | Store | by_reference.cpp:84:3:84:25 | Chi [a] |
-| by_reference.cpp:84:3:84:25 | Store | by_reference.cpp:84:3:84:25 | Chi [inner_nested] |
 | by_reference.cpp:84:14:84:23 | call to user_input | by_reference.cpp:84:3:84:25 | Store |
 | by_reference.cpp:88:3:88:24 | Chi [a] | by_reference.cpp:122:21:122:38 | taint_inner_a_ref output argument [a] |
-| by_reference.cpp:88:3:88:24 | Chi [a] | by_reference.cpp:122:21:122:38 | taint_inner_a_ref output argument [a] |
-| by_reference.cpp:88:3:88:24 | Chi [a] | by_reference.cpp:122:21:122:38 | taint_inner_a_ref output argument [inner_nested] |
 | by_reference.cpp:88:3:88:24 | Chi [a] | by_reference.cpp:126:21:126:40 | taint_inner_a_ref output argument [a] |
-| by_reference.cpp:88:3:88:24 | Chi [a] | by_reference.cpp:126:21:126:40 | taint_inner_a_ref output argument [a] |
-| by_reference.cpp:88:3:88:24 | Chi [a] | by_reference.cpp:126:21:126:40 | taint_inner_a_ref output argument [inner_nested] |
-| by_reference.cpp:88:3:88:24 | Chi [inner_nested] | by_reference.cpp:122:21:122:38 | taint_inner_a_ref output argument [a] |
-| by_reference.cpp:88:3:88:24 | Chi [inner_nested] | by_reference.cpp:122:21:122:38 | taint_inner_a_ref output argument [inner_nested] |
-| by_reference.cpp:88:3:88:24 | Chi [inner_nested] | by_reference.cpp:126:21:126:40 | taint_inner_a_ref output argument [a] |
-| by_reference.cpp:88:3:88:24 | Chi [inner_nested] | by_reference.cpp:126:21:126:40 | taint_inner_a_ref output argument [inner_nested] |
 | by_reference.cpp:88:3:88:24 | Store | by_reference.cpp:88:3:88:24 | Chi [a] |
-| by_reference.cpp:88:3:88:24 | Store | by_reference.cpp:88:3:88:24 | Chi [a] |
-| by_reference.cpp:88:3:88:24 | Store | by_reference.cpp:88:3:88:24 | Chi [inner_nested] |
 | by_reference.cpp:88:13:88:22 | call to user_input | by_reference.cpp:88:3:88:24 | Store |
 | by_reference.cpp:102:21:102:39 | Chi [a] | by_reference.cpp:110:27:110:27 | a |
-| by_reference.cpp:102:21:102:39 | Chi [a] | by_reference.cpp:110:27:110:27 | a |
-| by_reference.cpp:102:21:102:39 | Chi [inner_nested] | by_reference.cpp:110:27:110:27 | a |
 | by_reference.cpp:102:21:102:39 | taint_inner_a_ptr output argument [a] | by_reference.cpp:102:21:102:39 | Chi [a] |
-| by_reference.cpp:102:21:102:39 | taint_inner_a_ptr output argument [a] | by_reference.cpp:102:21:102:39 | Chi [a] |
-| by_reference.cpp:102:21:102:39 | taint_inner_a_ptr output argument [a] | by_reference.cpp:102:21:102:39 | Chi [inner_nested] |
-| by_reference.cpp:102:21:102:39 | taint_inner_a_ptr output argument [inner_nested] | by_reference.cpp:102:21:102:39 | Chi [a] |
-| by_reference.cpp:102:21:102:39 | taint_inner_a_ptr output argument [inner_nested] | by_reference.cpp:102:21:102:39 | Chi [inner_nested] |
 | by_reference.cpp:106:21:106:41 | Chi [a] | by_reference.cpp:114:29:114:29 | a |
-| by_reference.cpp:106:21:106:41 | Chi [a] | by_reference.cpp:114:29:114:29 | a |
-| by_reference.cpp:106:21:106:41 | Chi [inner_nested] | by_reference.cpp:114:29:114:29 | a |
 | by_reference.cpp:106:21:106:41 | taint_inner_a_ptr output argument [a] | by_reference.cpp:106:21:106:41 | Chi [a] |
-| by_reference.cpp:106:21:106:41 | taint_inner_a_ptr output argument [a] | by_reference.cpp:106:21:106:41 | Chi [a] |
-| by_reference.cpp:106:21:106:41 | taint_inner_a_ptr output argument [a] | by_reference.cpp:106:21:106:41 | Chi [inner_nested] |
-| by_reference.cpp:106:21:106:41 | taint_inner_a_ptr output argument [inner_nested] | by_reference.cpp:106:21:106:41 | Chi [a] |
-| by_reference.cpp:106:21:106:41 | taint_inner_a_ptr output argument [inner_nested] | by_reference.cpp:106:21:106:41 | Chi [inner_nested] |
 | by_reference.cpp:122:21:122:38 | Chi [a] | by_reference.cpp:130:27:130:27 | a |
-| by_reference.cpp:122:21:122:38 | Chi [a] | by_reference.cpp:130:27:130:27 | a |
-| by_reference.cpp:122:21:122:38 | Chi [inner_nested] | by_reference.cpp:130:27:130:27 | a |
 | by_reference.cpp:122:21:122:38 | taint_inner_a_ref output argument [a] | by_reference.cpp:122:21:122:38 | Chi [a] |
-| by_reference.cpp:122:21:122:38 | taint_inner_a_ref output argument [a] | by_reference.cpp:122:21:122:38 | Chi [a] |
-| by_reference.cpp:122:21:122:38 | taint_inner_a_ref output argument [a] | by_reference.cpp:122:21:122:38 | Chi [inner_nested] |
-| by_reference.cpp:122:21:122:38 | taint_inner_a_ref output argument [inner_nested] | by_reference.cpp:122:21:122:38 | Chi [a] |
-| by_reference.cpp:122:21:122:38 | taint_inner_a_ref output argument [inner_nested] | by_reference.cpp:122:21:122:38 | Chi [inner_nested] |
 | by_reference.cpp:126:21:126:40 | Chi [a] | by_reference.cpp:134:29:134:29 | a |
-| by_reference.cpp:126:21:126:40 | Chi [a] | by_reference.cpp:134:29:134:29 | a |
-| by_reference.cpp:126:21:126:40 | Chi [inner_nested] | by_reference.cpp:134:29:134:29 | a |
 | by_reference.cpp:126:21:126:40 | taint_inner_a_ref output argument [a] | by_reference.cpp:126:21:126:40 | Chi [a] |
-| by_reference.cpp:126:21:126:40 | taint_inner_a_ref output argument [a] | by_reference.cpp:126:21:126:40 | Chi [a] |
-| by_reference.cpp:126:21:126:40 | taint_inner_a_ref output argument [a] | by_reference.cpp:126:21:126:40 | Chi [inner_nested] |
-| by_reference.cpp:126:21:126:40 | taint_inner_a_ref output argument [inner_nested] | by_reference.cpp:126:21:126:40 | Chi [a] |
-| by_reference.cpp:126:21:126:40 | taint_inner_a_ref output argument [inner_nested] | by_reference.cpp:126:21:126:40 | Chi [inner_nested] |
-| complex.cpp:40:17:40:17 | *b [a_] | complex.cpp:51:16:51:16 | Argument -1 indirection [a_] |
-| complex.cpp:40:17:40:17 | *b [a_] | complex.cpp:51:16:51:16 | Argument -1 indirection [a_] |
 | complex.cpp:40:17:40:17 | *b [a_] | complex.cpp:51:16:51:16 | Argument -1 indirection [a_] |
 | complex.cpp:40:17:40:17 | *b [b_] | complex.cpp:51:16:51:16 | Argument -1 indirection [b_] |
-| complex.cpp:40:17:40:17 | *b [b_] | complex.cpp:51:16:51:16 | Argument -1 indirection [b_] |
-| complex.cpp:40:17:40:17 | *b [b_] | complex.cpp:51:16:51:16 | Argument -1 indirection [b_] |
-| complex.cpp:40:17:40:17 | *b [b_] | complex.cpp:52:16:52:16 | Argument -1 indirection [b_] |
-| complex.cpp:40:17:40:17 | *b [b_] | complex.cpp:52:16:52:16 | Argument -1 indirection [b_] |
 | complex.cpp:40:17:40:17 | *b [b_] | complex.cpp:52:16:52:16 | Argument -1 indirection [b_] |
 | complex.cpp:51:16:51:16 | Argument -1 indirection [a_] | complex.cpp:51:18:51:18 | call to a |
-| complex.cpp:51:16:51:16 | Argument -1 indirection [a_] | complex.cpp:51:18:51:18 | call to a |
-| complex.cpp:51:16:51:16 | Argument -1 indirection [a_] | complex.cpp:51:18:51:18 | call to a |
-| complex.cpp:51:16:51:16 | Argument -1 indirection [b_] | complex.cpp:51:16:51:16 | a output argument [b_] |
-| complex.cpp:51:16:51:16 | Argument -1 indirection [b_] | complex.cpp:51:16:51:16 | a output argument [b_] |
 | complex.cpp:51:16:51:16 | Argument -1 indirection [b_] | complex.cpp:51:16:51:16 | a output argument [b_] |
 | complex.cpp:51:16:51:16 | a output argument [b_] | complex.cpp:52:16:52:16 | Argument -1 indirection [b_] |
-| complex.cpp:51:16:51:16 | a output argument [b_] | complex.cpp:52:16:52:16 | Argument -1 indirection [b_] |
-| complex.cpp:51:16:51:16 | a output argument [b_] | complex.cpp:52:16:52:16 | Argument -1 indirection [b_] |
-| complex.cpp:52:16:52:16 | Argument -1 indirection [b_] | complex.cpp:52:18:52:18 | call to b |
-| complex.cpp:52:16:52:16 | Argument -1 indirection [b_] | complex.cpp:52:18:52:18 | call to b |
 | complex.cpp:52:16:52:16 | Argument -1 indirection [b_] | complex.cpp:52:18:52:18 | call to b |
 | complex.cpp:62:12:62:12 | setA output argument [a_] | complex.cpp:68:7:68:8 | Argument 0 indirection [a_] |
-| complex.cpp:62:12:62:12 | setA output argument [a_] | complex.cpp:68:7:68:8 | Argument 0 indirection [a_] |
-| complex.cpp:62:12:62:12 | setA output argument [a_] | complex.cpp:68:7:68:8 | Argument 0 indirection [a_] |
-| complex.cpp:62:19:62:28 | call to user_input | complex.cpp:62:12:62:12 | setA output argument [a_] |
-| complex.cpp:62:19:62:28 | call to user_input | complex.cpp:62:12:62:12 | setA output argument [a_] |
 | complex.cpp:62:19:62:28 | call to user_input | complex.cpp:62:12:62:12 | setA output argument [a_] |
 | complex.cpp:63:12:63:12 | setB output argument [b_] | complex.cpp:71:7:71:8 | Argument 0 indirection [b_] |
-| complex.cpp:63:12:63:12 | setB output argument [b_] | complex.cpp:71:7:71:8 | Argument 0 indirection [b_] |
-| complex.cpp:63:12:63:12 | setB output argument [b_] | complex.cpp:71:7:71:8 | Argument 0 indirection [b_] |
-| complex.cpp:63:19:63:28 | call to user_input | complex.cpp:63:12:63:12 | setB output argument [b_] |
-| complex.cpp:63:19:63:28 | call to user_input | complex.cpp:63:12:63:12 | setB output argument [b_] |
 | complex.cpp:63:19:63:28 | call to user_input | complex.cpp:63:12:63:12 | setB output argument [b_] |
 | complex.cpp:64:12:64:12 | setA output argument [a_] | complex.cpp:65:12:65:12 | Argument -1 indirection [a_] |
-| complex.cpp:64:12:64:12 | setA output argument [a_] | complex.cpp:65:12:65:12 | Argument -1 indirection [a_] |
-| complex.cpp:64:12:64:12 | setA output argument [a_] | complex.cpp:65:12:65:12 | Argument -1 indirection [a_] |
-| complex.cpp:64:12:64:12 | setA output argument [a_] | complex.cpp:74:7:74:8 | Argument 0 indirection [a_] |
-| complex.cpp:64:12:64:12 | setA output argument [a_] | complex.cpp:74:7:74:8 | Argument 0 indirection [a_] |
 | complex.cpp:64:12:64:12 | setA output argument [a_] | complex.cpp:74:7:74:8 | Argument 0 indirection [a_] |
 | complex.cpp:64:19:64:28 | call to user_input | complex.cpp:64:12:64:12 | setA output argument [a_] |
-| complex.cpp:64:19:64:28 | call to user_input | complex.cpp:64:12:64:12 | setA output argument [a_] |
-| complex.cpp:64:19:64:28 | call to user_input | complex.cpp:64:12:64:12 | setA output argument [a_] |
-| complex.cpp:65:12:65:12 | Argument -1 indirection [a_] | complex.cpp:65:12:65:12 | setB output argument [a_] |
-| complex.cpp:65:12:65:12 | Argument -1 indirection [a_] | complex.cpp:65:12:65:12 | setB output argument [a_] |
 | complex.cpp:65:12:65:12 | Argument -1 indirection [a_] | complex.cpp:65:12:65:12 | setB output argument [a_] |
 | complex.cpp:65:12:65:12 | setB output argument [a_] | complex.cpp:74:7:74:8 | Argument 0 indirection [a_] |
-| complex.cpp:65:12:65:12 | setB output argument [a_] | complex.cpp:74:7:74:8 | Argument 0 indirection [a_] |
-| complex.cpp:65:12:65:12 | setB output argument [a_] | complex.cpp:74:7:74:8 | Argument 0 indirection [a_] |
-| complex.cpp:65:12:65:12 | setB output argument [b_] | complex.cpp:74:7:74:8 | Argument 0 indirection [b_] |
-| complex.cpp:65:12:65:12 | setB output argument [b_] | complex.cpp:74:7:74:8 | Argument 0 indirection [b_] |
 | complex.cpp:65:12:65:12 | setB output argument [b_] | complex.cpp:74:7:74:8 | Argument 0 indirection [b_] |
 | complex.cpp:65:19:65:28 | call to user_input | complex.cpp:65:12:65:12 | setB output argument [b_] |
-| complex.cpp:65:19:65:28 | call to user_input | complex.cpp:65:12:65:12 | setB output argument [b_] |
-| complex.cpp:65:19:65:28 | call to user_input | complex.cpp:65:12:65:12 | setB output argument [b_] |
-| complex.cpp:68:7:68:8 | Argument 0 indirection [a_] | complex.cpp:40:17:40:17 | *b [a_] |
-| complex.cpp:68:7:68:8 | Argument 0 indirection [a_] | complex.cpp:40:17:40:17 | *b [a_] |
 | complex.cpp:68:7:68:8 | Argument 0 indirection [a_] | complex.cpp:40:17:40:17 | *b [a_] |
 | complex.cpp:71:7:71:8 | Argument 0 indirection [b_] | complex.cpp:40:17:40:17 | *b [b_] |
-| complex.cpp:71:7:71:8 | Argument 0 indirection [b_] | complex.cpp:40:17:40:17 | *b [b_] |
-| complex.cpp:71:7:71:8 | Argument 0 indirection [b_] | complex.cpp:40:17:40:17 | *b [b_] |
 | complex.cpp:74:7:74:8 | Argument 0 indirection [a_] | complex.cpp:40:17:40:17 | *b [a_] |
-| complex.cpp:74:7:74:8 | Argument 0 indirection [a_] | complex.cpp:40:17:40:17 | *b [a_] |
-| complex.cpp:74:7:74:8 | Argument 0 indirection [a_] | complex.cpp:40:17:40:17 | *b [a_] |
-| complex.cpp:74:7:74:8 | Argument 0 indirection [b_] | complex.cpp:40:17:40:17 | *b [b_] |
-| complex.cpp:74:7:74:8 | Argument 0 indirection [b_] | complex.cpp:40:17:40:17 | *b [b_] |
 | complex.cpp:74:7:74:8 | Argument 0 indirection [b_] | complex.cpp:40:17:40:17 | *b [b_] |
 | constructors.cpp:26:15:26:15 | *f [a_] | constructors.cpp:28:10:28:10 | Argument -1 indirection [a_] |
 | constructors.cpp:26:15:26:15 | *f [b_] | constructors.cpp:28:10:28:10 | Argument -1 indirection [b_] |
@@ -258,35 +155,20 @@ edges
 | simple.cpp:65:11:65:20 | call to user_input | simple.cpp:65:5:65:22 | Store [i] |
 | simple.cpp:66:12:66:12 | Store [i] | simple.cpp:67:13:67:13 | i |
 | simple.cpp:83:9:83:28 | Chi [f1] | simple.cpp:84:14:84:20 | Argument -1 indirection [f1] |
-| simple.cpp:83:9:83:28 | Chi [f1] | simple.cpp:84:14:84:20 | Argument -1 indirection [f1] |
-| simple.cpp:83:9:83:28 | Chi [f1] | simple.cpp:84:14:84:20 | Argument -1 indirection [f2] |
-| simple.cpp:83:9:83:28 | Chi [f2] | simple.cpp:84:14:84:20 | Argument -1 indirection [f1] |
-| simple.cpp:83:9:83:28 | Chi [f2] | simple.cpp:84:14:84:20 | Argument -1 indirection [f2] |
 | simple.cpp:83:9:83:28 | Store | simple.cpp:83:9:83:28 | Chi [f1] |
-| simple.cpp:83:9:83:28 | Store | simple.cpp:83:9:83:28 | Chi [f1] |
-| simple.cpp:83:9:83:28 | Store | simple.cpp:83:9:83:28 | Chi [f2] |
 | simple.cpp:83:17:83:26 | call to user_input | simple.cpp:83:9:83:28 | Store |
 | simple.cpp:84:14:84:20 | Argument -1 indirection [f1] | simple.cpp:84:14:84:20 | call to getf2f1 |
-| simple.cpp:84:14:84:20 | Argument -1 indirection [f1] | simple.cpp:84:14:84:20 | call to getf2f1 |
-| simple.cpp:84:14:84:20 | Argument -1 indirection [f2] | simple.cpp:84:14:84:20 | call to getf2f1 |
-| struct_init.c:14:24:14:25 | *ab [a] | struct_init.c:15:12:15:12 | a |
 | struct_init.c:14:24:14:25 | *ab [a] | struct_init.c:15:12:15:12 | a |
 | struct_init.c:20:20:20:29 | Chi [a] | struct_init.c:24:10:24:12 | Argument 0 indirection [a] |
-| struct_init.c:20:20:20:29 | Chi [a] | struct_init.c:24:10:24:12 | Argument 0 indirection [a] |
-| struct_init.c:20:20:20:29 | Store | struct_init.c:20:20:20:29 | Chi [a] |
 | struct_init.c:20:20:20:29 | Store | struct_init.c:20:20:20:29 | Chi [a] |
 | struct_init.c:20:20:20:29 | call to user_input | struct_init.c:20:20:20:29 | Store |
 | struct_init.c:20:20:20:29 | call to user_input | struct_init.c:22:11:22:11 | a |
 | struct_init.c:24:10:24:12 | Argument 0 indirection [a] | struct_init.c:14:24:14:25 | *ab [a] |
-| struct_init.c:24:10:24:12 | Argument 0 indirection [a] | struct_init.c:14:24:14:25 | *ab [a] |
 | struct_init.c:27:7:27:16 | Chi [a] | struct_init.c:36:10:36:24 | Argument 0 indirection [a] |
-| struct_init.c:27:7:27:16 | Chi [a] | struct_init.c:36:10:36:24 | Argument 0 indirection [a] |
-| struct_init.c:27:7:27:16 | Store | struct_init.c:27:7:27:16 | Chi [a] |
 | struct_init.c:27:7:27:16 | Store | struct_init.c:27:7:27:16 | Chi [a] |
 | struct_init.c:27:7:27:16 | call to user_input | struct_init.c:27:7:27:16 | Store |
 | struct_init.c:27:7:27:16 | call to user_input | struct_init.c:31:23:31:23 | a |
 | struct_init.c:36:10:36:24 | Argument 0 indirection [a] | struct_init.c:14:24:14:25 | *ab [a] |
-| struct_init.c:36:10:36:24 | Argument 0 indirection [a] | struct_init.c:14:24:14:25 | *ab [a] |
 nodes
 | A.cpp:55:5:55:5 | set output argument [c] | semmle.label | set output argument [c] |
 | A.cpp:55:12:55:19 | (C *)... | semmle.label | (C *)... |
@@ -339,20 +221,14 @@ nodes
 | C.cpp:29:10:29:11 | s1 | semmle.label | s1 |
 | C.cpp:31:10:31:11 | s3 | semmle.label | s3 |
 | aliasing.cpp:9:3:9:22 | Chi [m1] | semmle.label | Chi [m1] |
-| aliasing.cpp:9:3:9:22 | Chi [m1] | semmle.label | Chi [m1] |
 | aliasing.cpp:9:3:9:22 | Store | semmle.label | Store |
 | aliasing.cpp:9:11:9:20 | call to user_input | semmle.label | call to user_input |
 | aliasing.cpp:13:3:13:21 | Chi [m1] | semmle.label | Chi [m1] |
-| aliasing.cpp:13:3:13:21 | Chi [m1] | semmle.label | Chi [m1] |
 | aliasing.cpp:13:3:13:21 | Store | semmle.label | Store |
 | aliasing.cpp:13:10:13:19 | call to user_input | semmle.label | call to user_input |
 | aliasing.cpp:25:17:25:19 | Chi [m1] | semmle.label | Chi [m1] |
-| aliasing.cpp:25:17:25:19 | Chi [m1] | semmle.label | Chi [m1] |
-| aliasing.cpp:25:17:25:19 | pointerSetter output argument [m1] | semmle.label | pointerSetter output argument [m1] |
 | aliasing.cpp:25:17:25:19 | pointerSetter output argument [m1] | semmle.label | pointerSetter output argument [m1] |
 | aliasing.cpp:26:19:26:20 | Chi [m1] | semmle.label | Chi [m1] |
-| aliasing.cpp:26:19:26:20 | Chi [m1] | semmle.label | Chi [m1] |
-| aliasing.cpp:26:19:26:20 | referenceSetter output argument [m1] | semmle.label | referenceSetter output argument [m1] |
 | aliasing.cpp:26:19:26:20 | referenceSetter output argument [m1] | semmle.label | referenceSetter output argument [m1] |
 | aliasing.cpp:29:11:29:12 | m1 | semmle.label | m1 |
 | aliasing.cpp:30:11:30:12 | m1 | semmle.label | m1 |
@@ -361,11 +237,9 @@ nodes
 | aliasing.cpp:42:11:42:20 | call to user_input | semmle.label | call to user_input |
 | aliasing.cpp:43:13:43:14 | m1 | semmle.label | m1 |
 | aliasing.cpp:60:3:60:22 | Chi [m1] | semmle.label | Chi [m1] |
-| aliasing.cpp:60:3:60:22 | Chi [m1] | semmle.label | Chi [m1] |
 | aliasing.cpp:60:3:60:22 | Store | semmle.label | Store |
 | aliasing.cpp:60:11:60:20 | call to user_input | semmle.label | call to user_input |
 | aliasing.cpp:61:13:61:14 | Store [m1] | semmle.label | Store [m1] |
-| aliasing.cpp:61:13:61:14 | Store [m1] | semmle.label | Store [m1] |
 | aliasing.cpp:62:14:62:15 | m1 | semmle.label | m1 |
 | aliasing.cpp:79:11:79:20 | call to user_input | semmle.label | call to user_input |
 | aliasing.cpp:80:12:80:13 | m1 | semmle.label | m1 |
@@ -373,11 +247,6 @@ nodes
 | aliasing.cpp:87:12:87:13 | m1 | semmle.label | m1 |
 | aliasing.cpp:92:12:92:21 | call to user_input | semmle.label | call to user_input |
 | aliasing.cpp:93:12:93:13 | m1 | semmle.label | m1 |
-| aliasing.cpp:98:3:98:21 | Chi [m1] | semmle.label | Chi [m1] |
-| aliasing.cpp:98:3:98:21 | Store | semmle.label | Store |
-| aliasing.cpp:98:10:98:19 | call to user_input | semmle.label | call to user_input |
-| aliasing.cpp:100:14:100:14 | Store [m1] | semmle.label | Store [m1] |
-| aliasing.cpp:102:8:102:10 | * ... | semmle.label | * ... |
 | by_reference.cpp:50:3:50:3 | setDirectly output argument [a] | semmle.label | setDirectly output argument [a] |
 | by_reference.cpp:50:17:50:26 | call to user_input | semmle.label | call to user_input |
 | by_reference.cpp:51:8:51:8 | Argument -1 indirection [a] | semmle.label | Argument -1 indirection [a] |
@@ -395,116 +264,44 @@ nodes
 | by_reference.cpp:69:8:69:20 | call to nonMemberGetA | semmle.label | call to nonMemberGetA |
 | by_reference.cpp:69:22:69:23 | Argument 0 indirection [a] | semmle.label | Argument 0 indirection [a] |
 | by_reference.cpp:84:3:84:25 | Chi [a] | semmle.label | Chi [a] |
-| by_reference.cpp:84:3:84:25 | Chi [a] | semmle.label | Chi [a] |
-| by_reference.cpp:84:3:84:25 | Chi [a] | semmle.label | Chi [inner_nested] |
-| by_reference.cpp:84:3:84:25 | Chi [inner_nested] | semmle.label | Chi [a] |
-| by_reference.cpp:84:3:84:25 | Chi [inner_nested] | semmle.label | Chi [inner_nested] |
 | by_reference.cpp:84:3:84:25 | Store | semmle.label | Store |
 | by_reference.cpp:84:14:84:23 | call to user_input | semmle.label | call to user_input |
 | by_reference.cpp:88:3:88:24 | Chi [a] | semmle.label | Chi [a] |
-| by_reference.cpp:88:3:88:24 | Chi [a] | semmle.label | Chi [a] |
-| by_reference.cpp:88:3:88:24 | Chi [a] | semmle.label | Chi [inner_nested] |
-| by_reference.cpp:88:3:88:24 | Chi [inner_nested] | semmle.label | Chi [a] |
-| by_reference.cpp:88:3:88:24 | Chi [inner_nested] | semmle.label | Chi [inner_nested] |
 | by_reference.cpp:88:3:88:24 | Store | semmle.label | Store |
 | by_reference.cpp:88:13:88:22 | call to user_input | semmle.label | call to user_input |
 | by_reference.cpp:102:21:102:39 | Chi [a] | semmle.label | Chi [a] |
-| by_reference.cpp:102:21:102:39 | Chi [a] | semmle.label | Chi [a] |
-| by_reference.cpp:102:21:102:39 | Chi [a] | semmle.label | Chi [inner_nested] |
-| by_reference.cpp:102:21:102:39 | Chi [inner_nested] | semmle.label | Chi [a] |
-| by_reference.cpp:102:21:102:39 | Chi [inner_nested] | semmle.label | Chi [inner_nested] |
 | by_reference.cpp:102:21:102:39 | taint_inner_a_ptr output argument [a] | semmle.label | taint_inner_a_ptr output argument [a] |
-| by_reference.cpp:102:21:102:39 | taint_inner_a_ptr output argument [a] | semmle.label | taint_inner_a_ptr output argument [a] |
-| by_reference.cpp:102:21:102:39 | taint_inner_a_ptr output argument [a] | semmle.label | taint_inner_a_ptr output argument [inner_nested] |
-| by_reference.cpp:102:21:102:39 | taint_inner_a_ptr output argument [inner_nested] | semmle.label | taint_inner_a_ptr output argument [a] |
-| by_reference.cpp:102:21:102:39 | taint_inner_a_ptr output argument [inner_nested] | semmle.label | taint_inner_a_ptr output argument [inner_nested] |
 | by_reference.cpp:106:21:106:41 | Chi [a] | semmle.label | Chi [a] |
-| by_reference.cpp:106:21:106:41 | Chi [a] | semmle.label | Chi [a] |
-| by_reference.cpp:106:21:106:41 | Chi [a] | semmle.label | Chi [inner_nested] |
-| by_reference.cpp:106:21:106:41 | Chi [inner_nested] | semmle.label | Chi [a] |
-| by_reference.cpp:106:21:106:41 | Chi [inner_nested] | semmle.label | Chi [inner_nested] |
 | by_reference.cpp:106:21:106:41 | taint_inner_a_ptr output argument [a] | semmle.label | taint_inner_a_ptr output argument [a] |
-| by_reference.cpp:106:21:106:41 | taint_inner_a_ptr output argument [a] | semmle.label | taint_inner_a_ptr output argument [a] |
-| by_reference.cpp:106:21:106:41 | taint_inner_a_ptr output argument [a] | semmle.label | taint_inner_a_ptr output argument [inner_nested] |
-| by_reference.cpp:106:21:106:41 | taint_inner_a_ptr output argument [inner_nested] | semmle.label | taint_inner_a_ptr output argument [a] |
-| by_reference.cpp:106:21:106:41 | taint_inner_a_ptr output argument [inner_nested] | semmle.label | taint_inner_a_ptr output argument [inner_nested] |
 | by_reference.cpp:110:27:110:27 | a | semmle.label | a |
 | by_reference.cpp:114:29:114:29 | a | semmle.label | a |
 | by_reference.cpp:122:21:122:38 | Chi [a] | semmle.label | Chi [a] |
-| by_reference.cpp:122:21:122:38 | Chi [a] | semmle.label | Chi [a] |
-| by_reference.cpp:122:21:122:38 | Chi [a] | semmle.label | Chi [inner_nested] |
-| by_reference.cpp:122:21:122:38 | Chi [inner_nested] | semmle.label | Chi [a] |
-| by_reference.cpp:122:21:122:38 | Chi [inner_nested] | semmle.label | Chi [inner_nested] |
 | by_reference.cpp:122:21:122:38 | taint_inner_a_ref output argument [a] | semmle.label | taint_inner_a_ref output argument [a] |
-| by_reference.cpp:122:21:122:38 | taint_inner_a_ref output argument [a] | semmle.label | taint_inner_a_ref output argument [a] |
-| by_reference.cpp:122:21:122:38 | taint_inner_a_ref output argument [a] | semmle.label | taint_inner_a_ref output argument [inner_nested] |
-| by_reference.cpp:122:21:122:38 | taint_inner_a_ref output argument [inner_nested] | semmle.label | taint_inner_a_ref output argument [a] |
-| by_reference.cpp:122:21:122:38 | taint_inner_a_ref output argument [inner_nested] | semmle.label | taint_inner_a_ref output argument [inner_nested] |
 | by_reference.cpp:126:21:126:40 | Chi [a] | semmle.label | Chi [a] |
-| by_reference.cpp:126:21:126:40 | Chi [a] | semmle.label | Chi [a] |
-| by_reference.cpp:126:21:126:40 | Chi [a] | semmle.label | Chi [inner_nested] |
-| by_reference.cpp:126:21:126:40 | Chi [inner_nested] | semmle.label | Chi [a] |
-| by_reference.cpp:126:21:126:40 | Chi [inner_nested] | semmle.label | Chi [inner_nested] |
 | by_reference.cpp:126:21:126:40 | taint_inner_a_ref output argument [a] | semmle.label | taint_inner_a_ref output argument [a] |
-| by_reference.cpp:126:21:126:40 | taint_inner_a_ref output argument [a] | semmle.label | taint_inner_a_ref output argument [a] |
-| by_reference.cpp:126:21:126:40 | taint_inner_a_ref output argument [a] | semmle.label | taint_inner_a_ref output argument [inner_nested] |
-| by_reference.cpp:126:21:126:40 | taint_inner_a_ref output argument [inner_nested] | semmle.label | taint_inner_a_ref output argument [a] |
-| by_reference.cpp:126:21:126:40 | taint_inner_a_ref output argument [inner_nested] | semmle.label | taint_inner_a_ref output argument [inner_nested] |
 | by_reference.cpp:130:27:130:27 | a | semmle.label | a |
 | by_reference.cpp:134:29:134:29 | a | semmle.label | a |
 | complex.cpp:40:17:40:17 | *b [a_] | semmle.label | *b [a_] |
-| complex.cpp:40:17:40:17 | *b [a_] | semmle.label | *b [a_] |
-| complex.cpp:40:17:40:17 | *b [a_] | semmle.label | *b [a_] |
-| complex.cpp:40:17:40:17 | *b [b_] | semmle.label | *b [b_] |
-| complex.cpp:40:17:40:17 | *b [b_] | semmle.label | *b [b_] |
 | complex.cpp:40:17:40:17 | *b [b_] | semmle.label | *b [b_] |
 | complex.cpp:51:16:51:16 | Argument -1 indirection [a_] | semmle.label | Argument -1 indirection [a_] |
-| complex.cpp:51:16:51:16 | Argument -1 indirection [a_] | semmle.label | Argument -1 indirection [a_] |
-| complex.cpp:51:16:51:16 | Argument -1 indirection [a_] | semmle.label | Argument -1 indirection [a_] |
 | complex.cpp:51:16:51:16 | Argument -1 indirection [b_] | semmle.label | Argument -1 indirection [b_] |
-| complex.cpp:51:16:51:16 | Argument -1 indirection [b_] | semmle.label | Argument -1 indirection [b_] |
-| complex.cpp:51:16:51:16 | Argument -1 indirection [b_] | semmle.label | Argument -1 indirection [b_] |
-| complex.cpp:51:16:51:16 | a output argument [b_] | semmle.label | a output argument [b_] |
-| complex.cpp:51:16:51:16 | a output argument [b_] | semmle.label | a output argument [b_] |
 | complex.cpp:51:16:51:16 | a output argument [b_] | semmle.label | a output argument [b_] |
 | complex.cpp:51:18:51:18 | call to a | semmle.label | call to a |
 | complex.cpp:52:16:52:16 | Argument -1 indirection [b_] | semmle.label | Argument -1 indirection [b_] |
-| complex.cpp:52:16:52:16 | Argument -1 indirection [b_] | semmle.label | Argument -1 indirection [b_] |
-| complex.cpp:52:16:52:16 | Argument -1 indirection [b_] | semmle.label | Argument -1 indirection [b_] |
 | complex.cpp:52:18:52:18 | call to b | semmle.label | call to b |
 | complex.cpp:62:12:62:12 | setA output argument [a_] | semmle.label | setA output argument [a_] |
-| complex.cpp:62:12:62:12 | setA output argument [a_] | semmle.label | setA output argument [a_] |
-| complex.cpp:62:12:62:12 | setA output argument [a_] | semmle.label | setA output argument [a_] |
 | complex.cpp:62:19:62:28 | call to user_input | semmle.label | call to user_input |
 | complex.cpp:63:12:63:12 | setB output argument [b_] | semmle.label | setB output argument [b_] |
-| complex.cpp:63:12:63:12 | setB output argument [b_] | semmle.label | setB output argument [b_] |
-| complex.cpp:63:12:63:12 | setB output argument [b_] | semmle.label | setB output argument [b_] |
 | complex.cpp:63:19:63:28 | call to user_input | semmle.label | call to user_input |
 | complex.cpp:64:12:64:12 | setA output argument [a_] | semmle.label | setA output argument [a_] |
-| complex.cpp:64:12:64:12 | setA output argument [a_] | semmle.label | setA output argument [a_] |
-| complex.cpp:64:12:64:12 | setA output argument [a_] | semmle.label | setA output argument [a_] |
 | complex.cpp:64:19:64:28 | call to user_input | semmle.label | call to user_input |
 | complex.cpp:65:12:65:12 | Argument -1 indirection [a_] | semmle.label | Argument -1 indirection [a_] |
-| complex.cpp:65:12:65:12 | Argument -1 indirection [a_] | semmle.label | Argument -1 indirection [a_] |
-| complex.cpp:65:12:65:12 | Argument -1 indirection [a_] | semmle.label | Argument -1 indirection [a_] |
 | complex.cpp:65:12:65:12 | setB output argument [a_] | semmle.label | setB output argument [a_] |
-| complex.cpp:65:12:65:12 | setB output argument [a_] | semmle.label | setB output argument [a_] |
-| complex.cpp:65:12:65:12 | setB output argument [a_] | semmle.label | setB output argument [a_] |
-| complex.cpp:65:12:65:12 | setB output argument [b_] | semmle.label | setB output argument [b_] |
-| complex.cpp:65:12:65:12 | setB output argument [b_] | semmle.label | setB output argument [b_] |
 | complex.cpp:65:12:65:12 | setB output argument [b_] | semmle.label | setB output argument [b_] |
 | complex.cpp:65:19:65:28 | call to user_input | semmle.label | call to user_input |
 | complex.cpp:68:7:68:8 | Argument 0 indirection [a_] | semmle.label | Argument 0 indirection [a_] |
-| complex.cpp:68:7:68:8 | Argument 0 indirection [a_] | semmle.label | Argument 0 indirection [a_] |
-| complex.cpp:68:7:68:8 | Argument 0 indirection [a_] | semmle.label | Argument 0 indirection [a_] |
-| complex.cpp:71:7:71:8 | Argument 0 indirection [b_] | semmle.label | Argument 0 indirection [b_] |
-| complex.cpp:71:7:71:8 | Argument 0 indirection [b_] | semmle.label | Argument 0 indirection [b_] |
 | complex.cpp:71:7:71:8 | Argument 0 indirection [b_] | semmle.label | Argument 0 indirection [b_] |
 | complex.cpp:74:7:74:8 | Argument 0 indirection [a_] | semmle.label | Argument 0 indirection [a_] |
-| complex.cpp:74:7:74:8 | Argument 0 indirection [a_] | semmle.label | Argument 0 indirection [a_] |
-| complex.cpp:74:7:74:8 | Argument 0 indirection [a_] | semmle.label | Argument 0 indirection [a_] |
-| complex.cpp:74:7:74:8 | Argument 0 indirection [b_] | semmle.label | Argument 0 indirection [b_] |
-| complex.cpp:74:7:74:8 | Argument 0 indirection [b_] | semmle.label | Argument 0 indirection [b_] |
 | complex.cpp:74:7:74:8 | Argument 0 indirection [b_] | semmle.label | Argument 0 indirection [b_] |
 | constructors.cpp:26:15:26:15 | *f [a_] | semmle.label | *f [a_] |
 | constructors.cpp:26:15:26:15 | *f [b_] | semmle.label | *f [b_] |
@@ -553,35 +350,22 @@ nodes
 | simple.cpp:66:12:66:12 | Store [i] | semmle.label | Store [i] |
 | simple.cpp:67:13:67:13 | i | semmle.label | i |
 | simple.cpp:83:9:83:28 | Chi [f1] | semmle.label | Chi [f1] |
-| simple.cpp:83:9:83:28 | Chi [f1] | semmle.label | Chi [f1] |
-| simple.cpp:83:9:83:28 | Chi [f1] | semmle.label | Chi [f2] |
-| simple.cpp:83:9:83:28 | Chi [f2] | semmle.label | Chi [f1] |
-| simple.cpp:83:9:83:28 | Chi [f2] | semmle.label | Chi [f2] |
 | simple.cpp:83:9:83:28 | Store | semmle.label | Store |
 | simple.cpp:83:17:83:26 | call to user_input | semmle.label | call to user_input |
 | simple.cpp:84:14:84:20 | Argument -1 indirection [f1] | semmle.label | Argument -1 indirection [f1] |
-| simple.cpp:84:14:84:20 | Argument -1 indirection [f1] | semmle.label | Argument -1 indirection [f1] |
-| simple.cpp:84:14:84:20 | Argument -1 indirection [f1] | semmle.label | Argument -1 indirection [f2] |
-| simple.cpp:84:14:84:20 | Argument -1 indirection [f2] | semmle.label | Argument -1 indirection [f1] |
-| simple.cpp:84:14:84:20 | Argument -1 indirection [f2] | semmle.label | Argument -1 indirection [f2] |
 | simple.cpp:84:14:84:20 | call to getf2f1 | semmle.label | call to getf2f1 |
 | struct_init.c:14:24:14:25 | *ab [a] | semmle.label | *ab [a] |
-| struct_init.c:14:24:14:25 | *ab [a] | semmle.label | *ab [a] |
 | struct_init.c:15:12:15:12 | a | semmle.label | a |
 | struct_init.c:20:20:20:29 | Chi [a] | semmle.label | Chi [a] |
-| struct_init.c:20:20:20:29 | Chi [a] | semmle.label | Chi [a] |
 | struct_init.c:20:20:20:29 | Store | semmle.label | Store |
 | struct_init.c:20:20:20:29 | call to user_input | semmle.label | call to user_input |
 | struct_init.c:22:11:22:11 | a | semmle.label | a |
 | struct_init.c:24:10:24:12 | Argument 0 indirection [a] | semmle.label | Argument 0 indirection [a] |
-| struct_init.c:24:10:24:12 | Argument 0 indirection [a] | semmle.label | Argument 0 indirection [a] |
-| struct_init.c:27:7:27:16 | Chi [a] | semmle.label | Chi [a] |
 | struct_init.c:27:7:27:16 | Chi [a] | semmle.label | Chi [a] |
 | struct_init.c:27:7:27:16 | Store | semmle.label | Store |
 | struct_init.c:27:7:27:16 | call to user_input | semmle.label | call to user_input |
 | struct_init.c:31:23:31:23 | a | semmle.label | a |
 | struct_init.c:36:10:36:24 | Argument 0 indirection [a] | semmle.label | Argument 0 indirection [a] |
-| struct_init.c:36:10:36:24 | Argument 0 indirection [a] | semmle.label | Argument 0 indirection [a] |
 #select
 | A.cpp:56:13:56:15 | call to get | A.cpp:55:12:55:19 | (C *)... | A.cpp:56:13:56:15 | call to get | call to get flows from $@ | A.cpp:55:12:55:19 | (C *)... | (C *)... |
 | A.cpp:56:13:56:15 | call to get | A.cpp:55:12:55:19 | new | A.cpp:56:13:56:15 | call to get | call to get flows from $@ | A.cpp:55:12:55:19 | new | new |
@@ -601,7 +385,6 @@ nodes
 | aliasing.cpp:80:12:80:13 | m1 | aliasing.cpp:79:11:79:20 | call to user_input | aliasing.cpp:80:12:80:13 | m1 | m1 flows from $@ | aliasing.cpp:79:11:79:20 | call to user_input | call to user_input |
 | aliasing.cpp:87:12:87:13 | m1 | aliasing.cpp:86:10:86:19 | call to user_input | aliasing.cpp:87:12:87:13 | m1 | m1 flows from $@ | aliasing.cpp:86:10:86:19 | call to user_input | call to user_input |
 | aliasing.cpp:93:12:93:13 | m1 | aliasing.cpp:92:12:92:21 | call to user_input | aliasing.cpp:93:12:93:13 | m1 | m1 flows from $@ | aliasing.cpp:92:12:92:21 | call to user_input | call to user_input |
-| aliasing.cpp:102:8:102:10 | * ... | aliasing.cpp:98:10:98:19 | call to user_input | aliasing.cpp:102:8:102:10 | * ... | * ... flows from $@ | aliasing.cpp:98:10:98:19 | call to user_input | call to user_input |
 | by_reference.cpp:51:10:51:20 | call to getDirectly | by_reference.cpp:50:17:50:26 | call to user_input | by_reference.cpp:51:10:51:20 | call to getDirectly | call to getDirectly flows from $@ | by_reference.cpp:50:17:50:26 | call to user_input | call to user_input |
 | by_reference.cpp:57:10:57:22 | call to getIndirectly | by_reference.cpp:56:19:56:28 | call to user_input | by_reference.cpp:57:10:57:22 | call to getIndirectly | call to getIndirectly flows from $@ | by_reference.cpp:56:19:56:28 | call to user_input | call to user_input |
 | by_reference.cpp:63:10:63:28 | call to getThroughNonMember | by_reference.cpp:62:25:62:34 | call to user_input | by_reference.cpp:63:10:63:28 | call to getThroughNonMember | call to getThroughNonMember flows from $@ | by_reference.cpp:62:25:62:34 | call to user_input | call to user_input |

cpp/ql/test/library-tests/dataflow/fields/partial-definition-diff.expected

@@ -157,7 +157,6 @@
 | aliasing.cpp:86:5:86:6 | m1 | AST only |
 | aliasing.cpp:92:3:92:3 | w | AST only |
 | aliasing.cpp:92:7:92:8 | m1 | AST only |
-| aliasing.cpp:98:5:98:6 | m1 | AST only |
 | by_reference.cpp:12:8:12:8 | a | AST only |
 | by_reference.cpp:16:11:16:11 | a | AST only |
 | by_reference.cpp:20:5:20:8 | this | AST only |

cpp/ql/test/library-tests/dataflow/fields/partial-definition-ir.expected

@@ -26,7 +26,6 @@
 | aliasing.cpp:79:3:79:3 | s |
 | aliasing.cpp:86:3:86:3 | s |
 | aliasing.cpp:92:5:92:5 | s |
-| aliasing.cpp:98:3:98:3 | s |
 | by_reference.cpp:12:5:12:5 | s |
 | by_reference.cpp:16:5:16:8 | this |
 | by_reference.cpp:84:3:84:7 | inner |

cpp/ql/test/library-tests/dataflow/fields/partial-definition.expected

@@ -185,8 +185,6 @@
 | aliasing.cpp:92:3:92:3 | w |
 | aliasing.cpp:92:5:92:5 | s |
 | aliasing.cpp:92:7:92:8 | m1 |
-| aliasing.cpp:98:3:98:3 | s |
-| aliasing.cpp:98:5:98:6 | m1 |
 | by_reference.cpp:12:5:12:5 | s |
 | by_reference.cpp:12:8:12:8 | a |
 | by_reference.cpp:16:5:16:8 | this |

cpp/ql/test/library-tests/dataflow/taint-tests/taint.cpp

@@ -258,7 +258,7 @@ void test_lambdas()
 		c = source();
 	};
 	e(t, u, w);
-	sink(w); // tainted [NOT DETECTED]
+	sink(w); // tainted
 }
 
 // --- taint through return value ---
@@ -348,8 +348,8 @@ void test_outparams()
 	myNotAssign(e, t);
 
 	sink(t); // tainted
-	sink(a); // tainted [NOT DETECTED by IR]
-	sink(b); // tainted [NOT DETECTED by IR]
+	sink(a); // tainted
+	sink(b); // tainted
 	sink(c); // tainted [NOT DETECTED]
 	sink(d); // tainted [NOT DETECTED]
 	sink(e);
@@ -468,7 +468,7 @@ void test_swop() {
 	swop(x, y);
 
 	sink(x); // clean [FALSE POSITIVE]
-	sink(y); // tainted [NOT DETECTED by IR]
+	sink(y); // tainted
 }
 
 // --- getdelim ---

cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected

@@ -16,8 +16,13 @@
 | arrayassignment.cpp:141:7:141:13 | arrayassignment.cpp:139:10:139:15 | IR only |
 | arrayassignment.cpp:145:7:145:13 | arrayassignment.cpp:144:12:144:17 | IR only |
 | arrayassignment.cpp:146:7:146:13 | arrayassignment.cpp:144:12:144:17 | IR only |
+| copyableclass.cpp:40:8:40:9 | copyableclass.cpp:34:22:34:27 | AST only |
+| copyableclass.cpp:41:8:41:9 | copyableclass.cpp:35:24:35:29 | AST only |
+| copyableclass.cpp:42:8:42:9 | copyableclass.cpp:34:22:34:27 | AST only |
+| copyableclass.cpp:43:8:43:9 | copyableclass.cpp:38:8:38:13 | AST only |
+| copyableclass.cpp:65:8:65:9 | copyableclass.cpp:60:40:60:45 | AST only |
+| copyableclass.cpp:66:8:66:9 | copyableclass.cpp:63:24:63:29 | AST only |
 | copyableclass.cpp:67:11:67:11 | copyableclass.cpp:67:13:67:18 | AST only |
-| copyableclass.cpp:67:11:67:21 | copyableclass.cpp:67:13:67:18 | IR only |
 | copyableclass_declonly.cpp:40:8:40:9 | copyableclass_declonly.cpp:34:30:34:35 | AST only |
 | copyableclass_declonly.cpp:41:8:41:9 | copyableclass_declonly.cpp:35:32:35:37 | AST only |
 | copyableclass_declonly.cpp:42:8:42:9 | copyableclass_declonly.cpp:34:30:34:35 | AST only |
@@ -36,8 +41,13 @@
 | format.cpp:105:8:105:13 | format.cpp:104:31:104:45 | AST only |
 | format.cpp:110:8:110:14 | format.cpp:109:38:109:52 | AST only |
 | format.cpp:115:8:115:13 | format.cpp:114:37:114:50 | AST only |
+| movableclass.cpp:44:8:44:9 | movableclass.cpp:39:21:39:26 | AST only |
+| movableclass.cpp:45:8:45:9 | movableclass.cpp:40:23:40:28 | AST only |
+| movableclass.cpp:46:8:46:9 | movableclass.cpp:42:8:42:13 | AST only |
+| movableclass.cpp:54:8:54:9 | movableclass.cpp:50:38:50:43 | AST only |
+| movableclass.cpp:55:8:55:9 | movableclass.cpp:52:23:52:28 | AST only |
+| movableclass.cpp:64:8:64:9 | movableclass.cpp:23:55:23:60 | AST only |
 | movableclass.cpp:65:11:65:11 | movableclass.cpp:65:13:65:18 | AST only |
-| movableclass.cpp:65:11:65:21 | movableclass.cpp:65:13:65:18 | IR only |
 | string.cpp:30:7:30:7 | string.cpp:26:16:26:21 | AST only |
 | string.cpp:32:9:32:13 | string.cpp:26:16:26:21 | AST only |
 | string.cpp:38:13:38:17 | string.cpp:14:10:14:15 | AST only |
@@ -101,6 +111,10 @@
 | string.cpp:341:7:341:7 | string.cpp:335:9:335:23 | AST only |
 | string.cpp:349:7:349:9 | string.cpp:348:18:348:32 | AST only |
 | string.cpp:350:11:350:14 | string.cpp:348:18:348:32 | AST only |
+| structlikeclass.cpp:35:8:35:9 | structlikeclass.cpp:29:22:29:27 | AST only |
+| structlikeclass.cpp:36:8:36:9 | structlikeclass.cpp:30:24:30:29 | AST only |
+| structlikeclass.cpp:37:8:37:9 | structlikeclass.cpp:29:22:29:27 | AST only |
+| structlikeclass.cpp:60:8:60:9 | structlikeclass.cpp:55:40:55:45 | AST only |
 | swap1.cpp:78:12:78:16 | swap1.cpp:69:23:69:23 | AST only |
 | swap1.cpp:87:13:87:17 | swap1.cpp:82:16:82:21 | AST only |
 | swap1.cpp:88:13:88:17 | swap1.cpp:81:27:81:28 | AST only |

cpp/ql/test/library-tests/dataflow/taint-tests/test_ir.expected

@@ -17,32 +17,14 @@
 | arrayassignment.cpp:141:7:141:13 | access to array | arrayassignment.cpp:139:10:139:15 | call to source |
 | arrayassignment.cpp:145:7:145:13 | access to array | arrayassignment.cpp:144:12:144:17 | call to source |
 | arrayassignment.cpp:146:7:146:13 | access to array | arrayassignment.cpp:144:12:144:17 | call to source |
-| copyableclass.cpp:40:8:40:9 | s1 | copyableclass.cpp:34:22:34:27 | call to source |
-| copyableclass.cpp:41:8:41:9 | s2 | copyableclass.cpp:35:24:35:29 | call to source |
-| copyableclass.cpp:42:8:42:9 | s3 | copyableclass.cpp:34:22:34:27 | call to source |
-| copyableclass.cpp:43:8:43:9 | s4 | copyableclass.cpp:38:8:38:13 | call to source |
-| copyableclass.cpp:65:8:65:9 | s1 | copyableclass.cpp:60:40:60:45 | call to source |
-| copyableclass.cpp:66:8:66:9 | s2 | copyableclass.cpp:63:24:63:29 | call to source |
-| copyableclass.cpp:67:11:67:21 | (reference dereference) | copyableclass.cpp:67:13:67:18 | call to source |
 | format.cpp:157:7:157:22 | (int)... | format.cpp:147:12:147:25 | call to source |
 | format.cpp:157:7:157:22 | access to array | format.cpp:147:12:147:25 | call to source |
 | format.cpp:158:7:158:27 | ... + ... | format.cpp:148:16:148:30 | call to source |
-| movableclass.cpp:44:8:44:9 | s1 | movableclass.cpp:39:21:39:26 | call to source |
-| movableclass.cpp:45:8:45:9 | s2 | movableclass.cpp:40:23:40:28 | call to source |
-| movableclass.cpp:46:8:46:9 | s3 | movableclass.cpp:42:8:42:13 | call to source |
-| movableclass.cpp:54:8:54:9 | s1 | movableclass.cpp:50:38:50:43 | call to source |
-| movableclass.cpp:55:8:55:9 | s2 | movableclass.cpp:52:23:52:28 | call to source |
-| movableclass.cpp:64:8:64:9 | s2 | movableclass.cpp:23:55:23:60 | call to source |
-| movableclass.cpp:65:11:65:21 | (reference dereference) | movableclass.cpp:65:13:65:18 | call to source |
 | string.cpp:28:7:28:7 | (const char *)... | string.cpp:24:12:24:17 | call to source |
 | string.cpp:28:7:28:7 | a | string.cpp:24:12:24:17 | call to source |
 | string.cpp:55:7:55:8 | cs | string.cpp:50:19:50:24 | call to source |
 | string.cpp:55:7:55:8 | cs | string.cpp:50:19:50:26 | (const char *)... |
-| structlikeclass.cpp:35:8:35:9 | s1 | structlikeclass.cpp:29:22:29:27 | call to source |
-| structlikeclass.cpp:36:8:36:9 | s2 | structlikeclass.cpp:30:24:30:29 | call to source |
-| structlikeclass.cpp:37:8:37:9 | s3 | structlikeclass.cpp:29:22:29:27 | call to source |
 | structlikeclass.cpp:38:8:38:9 | s4 | structlikeclass.cpp:33:8:33:13 | call to source |
-| structlikeclass.cpp:60:8:60:9 | s1 | structlikeclass.cpp:55:40:55:45 | call to source |
 | structlikeclass.cpp:61:8:61:9 | s2 | structlikeclass.cpp:58:24:58:29 | call to source |
 | structlikeclass.cpp:62:8:62:20 | ... = ... | structlikeclass.cpp:62:13:62:18 | call to source |
 | swap1.cpp:73:12:73:16 | data1 | swap1.cpp:71:15:71:20 | call to source |

cpp/ql/test/library-tests/syntax-zoo/dataflow-consistency.expected

@@ -60,6 +60,7 @@ postHasUniquePre
 uniquePostUpdate
 postIsInSameCallable
 reverseRead
+storeIsPostUpdate
 argHasPostUpdate
 | builtin.cpp:15:31:15:35 | * ... | ArgumentNode is missing PostUpdateNode. |
 | conditional_destructors.cpp:30:9:30:13 | call to C1 | ArgumentNode is missing PostUpdateNode. |

cpp/ql/test/library-tests/syntax-zoo/dataflow-ir-consistency.expected

@@ -1473,4 +1473,5 @@ postHasUniquePre
 uniquePostUpdate
 postIsInSameCallable
 reverseRead
+storeIsPostUpdate
 argHasPostUpdate

cpp/ql/test/query-tests/Security/CWE/CWE-079/semmle/CgiXss/CgiXss.expected

@@ -2,9 +2,6 @@ edges
 | search.c:14:24:14:28 | query | search.c:17:8:17:12 | (const char *)... |
 | search.c:14:24:14:28 | query | search.c:17:8:17:12 | query |
 | search.c:14:24:14:28 | query | search.c:17:8:17:12 | query |
-| search.c:14:24:14:28 | query | search.c:17:8:17:12 | query |
-| search.c:17:8:17:12 | query | search.c:17:8:17:12 | (const char *)... |
-| search.c:17:8:17:12 | query | search.c:17:8:17:12 | query |
 | search.c:22:24:22:28 | query | search.c:23:39:23:43 | query |
 | search.c:22:24:22:28 | query | search.c:23:39:23:43 | query |
 | search.c:41:21:41:26 | call to getenv | search.c:45:17:45:25 | raw_query |

cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/UnboundedWrite.expected

@@ -5,10 +5,6 @@ edges
 | tests.c:28:22:28:25 | argv | tests.c:28:22:28:28 | access to array |
 | tests.c:28:22:28:25 | argv | tests.c:28:22:28:28 | access to array |
 | tests.c:28:22:28:25 | argv | tests.c:28:22:28:28 | access to array |
-| tests.c:28:22:28:25 | argv | tests.c:28:22:28:28 | access to array |
-| tests.c:28:22:28:25 | argv | tests.c:28:22:28:28 | access to array |
-| tests.c:28:22:28:28 | access to array | tests.c:28:22:28:28 | (const char *)... |
-| tests.c:28:22:28:28 | access to array | tests.c:28:22:28:28 | access to array |
 | tests.c:29:28:29:31 | argv | tests.c:29:28:29:34 | access to array |
 | tests.c:29:28:29:31 | argv | tests.c:29:28:29:34 | access to array |
 | tests.c:29:28:29:31 | argv | tests.c:29:28:29:34 | access to array |
@@ -19,10 +15,6 @@ edges
 | tests.c:34:10:34:13 | argv | tests.c:34:10:34:16 | access to array |
 | tests.c:34:10:34:13 | argv | tests.c:34:10:34:16 | access to array |
 | tests.c:34:10:34:13 | argv | tests.c:34:10:34:16 | access to array |
-| tests.c:34:10:34:13 | argv | tests.c:34:10:34:16 | access to array |
-| tests.c:34:10:34:13 | argv | tests.c:34:10:34:16 | access to array |
-| tests.c:34:10:34:16 | access to array | tests.c:34:10:34:16 | (const char *)... |
-| tests.c:34:10:34:16 | access to array | tests.c:34:10:34:16 | access to array |
 nodes
 | tests.c:28:22:28:25 | argv | semmle.label | argv |
 | tests.c:28:22:28:25 | argv | semmle.label | argv |

cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/argv/argvLocal.expected

@@ -5,10 +5,6 @@ edges
 | argvLocal.c:95:9:95:12 | argv | argvLocal.c:95:9:95:15 | access to array |
 | argvLocal.c:95:9:95:12 | argv | argvLocal.c:95:9:95:15 | access to array |
 | argvLocal.c:95:9:95:12 | argv | argvLocal.c:95:9:95:15 | access to array |
-| argvLocal.c:95:9:95:12 | argv | argvLocal.c:95:9:95:15 | access to array |
-| argvLocal.c:95:9:95:12 | argv | argvLocal.c:95:9:95:15 | access to array |
-| argvLocal.c:95:9:95:15 | access to array | argvLocal.c:95:9:95:15 | (const char *)... |
-| argvLocal.c:95:9:95:15 | access to array | argvLocal.c:95:9:95:15 | access to array |
 | argvLocal.c:96:15:96:18 | argv | argvLocal.c:96:15:96:21 | access to array |
 | argvLocal.c:96:15:96:18 | argv | argvLocal.c:96:15:96:21 | access to array |
 | argvLocal.c:96:15:96:18 | argv | argvLocal.c:96:15:96:21 | access to array |
@@ -19,8 +15,6 @@ edges
 | argvLocal.c:100:7:100:10 | argv | argvLocal.c:101:9:101:10 | i1 |
 | argvLocal.c:100:7:100:10 | argv | argvLocal.c:101:9:101:10 | i1 |
 | argvLocal.c:100:7:100:10 | argv | argvLocal.c:101:9:101:10 | i1 |
-| argvLocal.c:100:7:100:10 | argv | argvLocal.c:101:9:101:10 | i1 |
-| argvLocal.c:100:7:100:10 | argv | argvLocal.c:101:9:101:10 | i1 |
 | argvLocal.c:100:7:100:10 | argv | argvLocal.c:102:15:102:16 | i1 |
 | argvLocal.c:100:7:100:10 | argv | argvLocal.c:102:15:102:16 | i1 |
 | argvLocal.c:100:7:100:10 | argv | argvLocal.c:102:15:102:16 | i1 |
@@ -31,22 +25,16 @@ edges
 | argvLocal.c:100:7:100:10 | argv | argvLocal.c:144:9:144:10 | i7 |
 | argvLocal.c:100:7:100:10 | argv | argvLocal.c:144:9:144:10 | i7 |
 | argvLocal.c:100:7:100:10 | argv | argvLocal.c:144:9:144:10 | i7 |
-| argvLocal.c:100:7:100:10 | argv | argvLocal.c:144:9:144:10 | i7 |
-| argvLocal.c:100:7:100:10 | argv | argvLocal.c:144:9:144:10 | i7 |
 | argvLocal.c:100:7:100:10 | argv | argvLocal.c:145:15:145:16 | i7 |
 | argvLocal.c:100:7:100:10 | argv | argvLocal.c:145:15:145:16 | i7 |
 | argvLocal.c:100:7:100:10 | argv | argvLocal.c:145:15:145:16 | i7 |
 | argvLocal.c:100:7:100:10 | argv | argvLocal.c:145:15:145:16 | i7 |
-| argvLocal.c:101:9:101:10 | i1 | argvLocal.c:101:9:101:10 | (const char *)... |
-| argvLocal.c:101:9:101:10 | i1 | argvLocal.c:101:9:101:10 | i1 |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:106:9:106:13 | (const char *)... |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:106:9:106:13 | (const char *)... |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:106:9:106:13 | access to array |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:106:9:106:13 | access to array |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:106:9:106:13 | access to array |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:106:9:106:13 | access to array |
-| argvLocal.c:105:14:105:17 | argv | argvLocal.c:106:9:106:13 | access to array |
-| argvLocal.c:105:14:105:17 | argv | argvLocal.c:106:9:106:13 | access to array |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:107:15:107:19 | access to array |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:107:15:107:19 | access to array |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:107:15:107:19 | access to array |
@@ -57,16 +45,10 @@ edges
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:110:9:110:11 | * ... |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:110:9:110:11 | * ... |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:110:9:110:11 | * ... |
-| argvLocal.c:105:14:105:17 | argv | argvLocal.c:110:9:110:11 | * ... |
-| argvLocal.c:105:14:105:17 | argv | argvLocal.c:110:9:110:11 | * ... |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:111:15:111:17 | * ... |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:111:15:111:17 | * ... |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:111:15:111:17 | * ... |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:111:15:111:17 | * ... |
-| argvLocal.c:106:9:106:13 | access to array | argvLocal.c:106:9:106:13 | (const char *)... |
-| argvLocal.c:106:9:106:13 | access to array | argvLocal.c:106:9:106:13 | access to array |
-| argvLocal.c:110:9:110:11 | * ... | argvLocal.c:110:9:110:11 | (const char *)... |
-| argvLocal.c:110:9:110:11 | * ... | argvLocal.c:110:9:110:11 | * ... |
 | argvLocal.c:115:13:115:16 | argv | argvLocal.c:116:9:116:10 | (const char *)... |
 | argvLocal.c:115:13:115:16 | argv | argvLocal.c:116:9:116:10 | (const char *)... |
 | argvLocal.c:115:13:115:16 | argv | argvLocal.c:116:9:116:10 | i3 |
@@ -143,22 +125,16 @@ edges
 | argvLocal.c:128:15:128:16 | printWrapper output argument | argvLocal.c:131:9:131:14 | ... + ... |
 | argvLocal.c:128:15:128:16 | printWrapper output argument | argvLocal.c:132:15:132:20 | ... + ... |
 | argvLocal.c:128:15:128:16 | printWrapper output argument | argvLocal.c:132:15:132:20 | ... + ... |
-| argvLocal.c:144:9:144:10 | i7 | argvLocal.c:144:9:144:10 | (const char *)... |
-| argvLocal.c:144:9:144:10 | i7 | argvLocal.c:144:9:144:10 | i7 |
 | argvLocal.c:149:11:149:14 | argv | argvLocal.c:150:9:150:10 | (const char *)... |
 | argvLocal.c:149:11:149:14 | argv | argvLocal.c:150:9:150:10 | (const char *)... |
 | argvLocal.c:149:11:149:14 | argv | argvLocal.c:150:9:150:10 | i8 |
 | argvLocal.c:149:11:149:14 | argv | argvLocal.c:150:9:150:10 | i8 |
 | argvLocal.c:149:11:149:14 | argv | argvLocal.c:150:9:150:10 | i8 |
 | argvLocal.c:149:11:149:14 | argv | argvLocal.c:150:9:150:10 | i8 |
-| argvLocal.c:149:11:149:14 | argv | argvLocal.c:150:9:150:10 | i8 |
-| argvLocal.c:149:11:149:14 | argv | argvLocal.c:150:9:150:10 | i8 |
 | argvLocal.c:149:11:149:14 | argv | argvLocal.c:151:15:151:16 | i8 |
 | argvLocal.c:149:11:149:14 | argv | argvLocal.c:151:15:151:16 | i8 |
 | argvLocal.c:149:11:149:14 | argv | argvLocal.c:151:15:151:16 | i8 |
 | argvLocal.c:149:11:149:14 | argv | argvLocal.c:151:15:151:16 | i8 |
-| argvLocal.c:150:9:150:10 | i8 | argvLocal.c:150:9:150:10 | (const char *)... |
-| argvLocal.c:150:9:150:10 | i8 | argvLocal.c:150:9:150:10 | i8 |
 | argvLocal.c:156:23:156:26 | argv | argvLocal.c:157:9:157:10 | (const char *)... |
 | argvLocal.c:156:23:156:26 | argv | argvLocal.c:157:9:157:10 | (const char *)... |
 | argvLocal.c:156:23:156:26 | argv | argvLocal.c:157:9:157:10 | i9 |
@@ -183,21 +159,12 @@ edges
 | argvLocal.c:168:18:168:21 | argv | argvLocal.c:169:18:169:20 | i10 |
 | argvLocal.c:168:18:168:21 | argv | argvLocal.c:169:18:169:20 | i10 |
 | argvLocal.c:168:18:168:21 | argv | argvLocal.c:169:18:169:20 | i10 |
-| argvLocal.c:168:18:168:21 | argv | argvLocal.c:169:18:169:20 | i10 |
-| argvLocal.c:168:18:168:21 | argv | argvLocal.c:169:18:169:20 | i10 |
 | argvLocal.c:168:18:168:21 | argv | argvLocal.c:170:15:170:26 | (char *)... |
 | argvLocal.c:168:18:168:21 | argv | argvLocal.c:170:15:170:26 | (char *)... |
 | argvLocal.c:168:18:168:21 | argv | argvLocal.c:170:24:170:26 | i10 |
 | argvLocal.c:168:18:168:21 | argv | argvLocal.c:170:24:170:26 | i10 |
 | argvLocal.c:168:18:168:21 | argv | argvLocal.c:170:24:170:26 | i10 |
 | argvLocal.c:168:18:168:21 | argv | argvLocal.c:170:24:170:26 | i10 |
-| argvLocal.c:168:18:168:21 | argv | argvLocal.c:170:24:170:26 | i10 |
-| argvLocal.c:168:18:168:21 | argv | argvLocal.c:170:24:170:26 | i10 |
-| argvLocal.c:169:18:169:20 | i10 | argvLocal.c:169:9:169:20 | (char *)... |
-| argvLocal.c:169:18:169:20 | i10 | argvLocal.c:169:9:169:20 | (const char *)... |
-| argvLocal.c:169:18:169:20 | i10 | argvLocal.c:169:18:169:20 | i10 |
-| argvLocal.c:170:24:170:26 | i10 | argvLocal.c:170:15:170:26 | (char *)... |
-| argvLocal.c:170:24:170:26 | i10 | argvLocal.c:170:24:170:26 | i10 |
 nodes
 | argvLocal.c:9:25:9:31 | *correct | semmle.label | *correct |
 | argvLocal.c:9:25:9:31 | correct | semmle.label | correct |

cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/funcs/funcsLocal.expected

@@ -17,14 +17,10 @@ edges
 | funcsLocal.c:31:13:31:17 | call to fgets | funcsLocal.c:32:9:32:10 | i4 |
 | funcsLocal.c:31:13:31:17 | call to fgets | funcsLocal.c:32:9:32:10 | i4 |
 | funcsLocal.c:31:13:31:17 | call to fgets | funcsLocal.c:32:9:32:10 | i4 |
-| funcsLocal.c:31:13:31:17 | call to fgets | funcsLocal.c:32:9:32:10 | i4 |
-| funcsLocal.c:31:13:31:17 | call to fgets | funcsLocal.c:32:9:32:10 | i4 |
 | funcsLocal.c:31:19:31:21 | fgets output argument | funcsLocal.c:32:9:32:10 | (const char *)... |
 | funcsLocal.c:31:19:31:21 | fgets output argument | funcsLocal.c:32:9:32:10 | i4 |
 | funcsLocal.c:31:19:31:21 | i41 | funcsLocal.c:32:9:32:10 | (const char *)... |
 | funcsLocal.c:31:19:31:21 | i41 | funcsLocal.c:32:9:32:10 | i4 |
-| funcsLocal.c:32:9:32:10 | i4 | funcsLocal.c:32:9:32:10 | (const char *)... |
-| funcsLocal.c:32:9:32:10 | i4 | funcsLocal.c:32:9:32:10 | i4 |
 | funcsLocal.c:36:7:36:8 | gets output argument | funcsLocal.c:37:9:37:10 | (const char *)... |
 | funcsLocal.c:36:7:36:8 | gets output argument | funcsLocal.c:37:9:37:10 | i5 |
 | funcsLocal.c:36:7:36:8 | i5 | funcsLocal.c:37:9:37:10 | (const char *)... |
@@ -35,14 +31,10 @@ edges
 | funcsLocal.c:41:13:41:16 | call to gets | funcsLocal.c:42:9:42:10 | i6 |
 | funcsLocal.c:41:13:41:16 | call to gets | funcsLocal.c:42:9:42:10 | i6 |
 | funcsLocal.c:41:13:41:16 | call to gets | funcsLocal.c:42:9:42:10 | i6 |
-| funcsLocal.c:41:13:41:16 | call to gets | funcsLocal.c:42:9:42:10 | i6 |
-| funcsLocal.c:41:13:41:16 | call to gets | funcsLocal.c:42:9:42:10 | i6 |
 | funcsLocal.c:41:18:41:20 | gets output argument | funcsLocal.c:42:9:42:10 | (const char *)... |
 | funcsLocal.c:41:18:41:20 | gets output argument | funcsLocal.c:42:9:42:10 | i6 |
 | funcsLocal.c:41:18:41:20 | i61 | funcsLocal.c:42:9:42:10 | (const char *)... |
 | funcsLocal.c:41:18:41:20 | i61 | funcsLocal.c:42:9:42:10 | i6 |
-| funcsLocal.c:42:9:42:10 | i6 | funcsLocal.c:42:9:42:10 | (const char *)... |
-| funcsLocal.c:42:9:42:10 | i6 | funcsLocal.c:42:9:42:10 | i6 |
 nodes
 | funcsLocal.c:16:8:16:9 | fread output argument | semmle.label | fread output argument |
 | funcsLocal.c:16:8:16:9 | i1 | semmle.label | i1 |

cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/globalVars/UncontrolledFormatStringThroughGlobalVar.expected

@@ -13,8 +13,6 @@ edges
 | globalVars.c:9:7:9:11 | copy2 | globalVars.c:50:9:50:13 | copy2 |
 | globalVars.c:9:7:9:11 | copy2 | globalVars.c:50:9:50:13 | copy2 |
 | globalVars.c:9:7:9:11 | copy2 | globalVars.c:50:9:50:13 | copy2 |
-| globalVars.c:11:22:11:25 | *argv | globalVars.c:12:2:12:15 | Store |
-| globalVars.c:11:22:11:25 | argv | globalVars.c:11:22:11:25 | *argv |
 | globalVars.c:11:22:11:25 | argv | globalVars.c:12:2:12:15 | Store |
 | globalVars.c:12:2:12:15 | Store | globalVars.c:8:7:8:10 | copy |
 | globalVars.c:15:21:15:23 | val | globalVars.c:16:2:16:12 | Store |
@@ -31,7 +29,6 @@ edges
 nodes
 | globalVars.c:8:7:8:10 | copy | semmle.label | copy |
 | globalVars.c:9:7:9:11 | copy2 | semmle.label | copy2 |
-| globalVars.c:11:22:11:25 | *argv | semmle.label | *argv |
 | globalVars.c:11:22:11:25 | argv | semmle.label | argv |
 | globalVars.c:12:2:12:15 | Store | semmle.label | Store |
 | globalVars.c:15:21:15:23 | val | semmle.label | val |

cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/ifs/ifs.expected

@@ -5,110 +5,66 @@ edges
 | ifs.c:61:8:61:11 | argv | ifs.c:62:9:62:10 | c7 |
 | ifs.c:61:8:61:11 | argv | ifs.c:62:9:62:10 | c7 |
 | ifs.c:61:8:61:11 | argv | ifs.c:62:9:62:10 | c7 |
-| ifs.c:61:8:61:11 | argv | ifs.c:62:9:62:10 | c7 |
-| ifs.c:61:8:61:11 | argv | ifs.c:62:9:62:10 | c7 |
-| ifs.c:62:9:62:10 | c7 | ifs.c:62:9:62:10 | (const char *)... |
-| ifs.c:62:9:62:10 | c7 | ifs.c:62:9:62:10 | c7 |
 | ifs.c:68:8:68:11 | argv | ifs.c:69:9:69:10 | (const char *)... |
 | ifs.c:68:8:68:11 | argv | ifs.c:69:9:69:10 | (const char *)... |
 | ifs.c:68:8:68:11 | argv | ifs.c:69:9:69:10 | c8 |
 | ifs.c:68:8:68:11 | argv | ifs.c:69:9:69:10 | c8 |
 | ifs.c:68:8:68:11 | argv | ifs.c:69:9:69:10 | c8 |
 | ifs.c:68:8:68:11 | argv | ifs.c:69:9:69:10 | c8 |
-| ifs.c:68:8:68:11 | argv | ifs.c:69:9:69:10 | c8 |
-| ifs.c:68:8:68:11 | argv | ifs.c:69:9:69:10 | c8 |
-| ifs.c:69:9:69:10 | c8 | ifs.c:69:9:69:10 | (const char *)... |
-| ifs.c:69:9:69:10 | c8 | ifs.c:69:9:69:10 | c8 |
 | ifs.c:74:8:74:11 | argv | ifs.c:75:9:75:10 | (const char *)... |
 | ifs.c:74:8:74:11 | argv | ifs.c:75:9:75:10 | (const char *)... |
 | ifs.c:74:8:74:11 | argv | ifs.c:75:9:75:10 | i1 |
 | ifs.c:74:8:74:11 | argv | ifs.c:75:9:75:10 | i1 |
 | ifs.c:74:8:74:11 | argv | ifs.c:75:9:75:10 | i1 |
 | ifs.c:74:8:74:11 | argv | ifs.c:75:9:75:10 | i1 |
-| ifs.c:74:8:74:11 | argv | ifs.c:75:9:75:10 | i1 |
-| ifs.c:74:8:74:11 | argv | ifs.c:75:9:75:10 | i1 |
-| ifs.c:75:9:75:10 | i1 | ifs.c:75:9:75:10 | (const char *)... |
-| ifs.c:75:9:75:10 | i1 | ifs.c:75:9:75:10 | i1 |
 | ifs.c:80:8:80:11 | argv | ifs.c:81:9:81:10 | (const char *)... |
 | ifs.c:80:8:80:11 | argv | ifs.c:81:9:81:10 | (const char *)... |
 | ifs.c:80:8:80:11 | argv | ifs.c:81:9:81:10 | i2 |
 | ifs.c:80:8:80:11 | argv | ifs.c:81:9:81:10 | i2 |
 | ifs.c:80:8:80:11 | argv | ifs.c:81:9:81:10 | i2 |
 | ifs.c:80:8:80:11 | argv | ifs.c:81:9:81:10 | i2 |
-| ifs.c:80:8:80:11 | argv | ifs.c:81:9:81:10 | i2 |
-| ifs.c:80:8:80:11 | argv | ifs.c:81:9:81:10 | i2 |
-| ifs.c:81:9:81:10 | i2 | ifs.c:81:9:81:10 | (const char *)... |
-| ifs.c:81:9:81:10 | i2 | ifs.c:81:9:81:10 | i2 |
 | ifs.c:86:8:86:11 | argv | ifs.c:87:9:87:10 | (const char *)... |
 | ifs.c:86:8:86:11 | argv | ifs.c:87:9:87:10 | (const char *)... |
 | ifs.c:86:8:86:11 | argv | ifs.c:87:9:87:10 | i3 |
 | ifs.c:86:8:86:11 | argv | ifs.c:87:9:87:10 | i3 |
 | ifs.c:86:8:86:11 | argv | ifs.c:87:9:87:10 | i3 |
 | ifs.c:86:8:86:11 | argv | ifs.c:87:9:87:10 | i3 |
-| ifs.c:86:8:86:11 | argv | ifs.c:87:9:87:10 | i3 |
-| ifs.c:86:8:86:11 | argv | ifs.c:87:9:87:10 | i3 |
-| ifs.c:87:9:87:10 | i3 | ifs.c:87:9:87:10 | (const char *)... |
-| ifs.c:87:9:87:10 | i3 | ifs.c:87:9:87:10 | i3 |
 | ifs.c:92:8:92:11 | argv | ifs.c:93:9:93:10 | (const char *)... |
 | ifs.c:92:8:92:11 | argv | ifs.c:93:9:93:10 | (const char *)... |
 | ifs.c:92:8:92:11 | argv | ifs.c:93:9:93:10 | i4 |
 | ifs.c:92:8:92:11 | argv | ifs.c:93:9:93:10 | i4 |
 | ifs.c:92:8:92:11 | argv | ifs.c:93:9:93:10 | i4 |
 | ifs.c:92:8:92:11 | argv | ifs.c:93:9:93:10 | i4 |
-| ifs.c:92:8:92:11 | argv | ifs.c:93:9:93:10 | i4 |
-| ifs.c:92:8:92:11 | argv | ifs.c:93:9:93:10 | i4 |
-| ifs.c:93:9:93:10 | i4 | ifs.c:93:9:93:10 | (const char *)... |
-| ifs.c:93:9:93:10 | i4 | ifs.c:93:9:93:10 | i4 |
 | ifs.c:98:8:98:11 | argv | ifs.c:99:9:99:10 | (const char *)... |
 | ifs.c:98:8:98:11 | argv | ifs.c:99:9:99:10 | (const char *)... |
 | ifs.c:98:8:98:11 | argv | ifs.c:99:9:99:10 | i5 |
 | ifs.c:98:8:98:11 | argv | ifs.c:99:9:99:10 | i5 |
 | ifs.c:98:8:98:11 | argv | ifs.c:99:9:99:10 | i5 |
 | ifs.c:98:8:98:11 | argv | ifs.c:99:9:99:10 | i5 |
-| ifs.c:98:8:98:11 | argv | ifs.c:99:9:99:10 | i5 |
-| ifs.c:98:8:98:11 | argv | ifs.c:99:9:99:10 | i5 |
-| ifs.c:99:9:99:10 | i5 | ifs.c:99:9:99:10 | (const char *)... |
-| ifs.c:99:9:99:10 | i5 | ifs.c:99:9:99:10 | i5 |
 | ifs.c:105:8:105:11 | argv | ifs.c:106:9:106:10 | (const char *)... |
 | ifs.c:105:8:105:11 | argv | ifs.c:106:9:106:10 | (const char *)... |
 | ifs.c:105:8:105:11 | argv | ifs.c:106:9:106:10 | i6 |
 | ifs.c:105:8:105:11 | argv | ifs.c:106:9:106:10 | i6 |
 | ifs.c:105:8:105:11 | argv | ifs.c:106:9:106:10 | i6 |
 | ifs.c:105:8:105:11 | argv | ifs.c:106:9:106:10 | i6 |
-| ifs.c:105:8:105:11 | argv | ifs.c:106:9:106:10 | i6 |
-| ifs.c:105:8:105:11 | argv | ifs.c:106:9:106:10 | i6 |
-| ifs.c:106:9:106:10 | i6 | ifs.c:106:9:106:10 | (const char *)... |
-| ifs.c:106:9:106:10 | i6 | ifs.c:106:9:106:10 | i6 |
 | ifs.c:111:8:111:11 | argv | ifs.c:112:9:112:10 | (const char *)... |
 | ifs.c:111:8:111:11 | argv | ifs.c:112:9:112:10 | (const char *)... |
 | ifs.c:111:8:111:11 | argv | ifs.c:112:9:112:10 | i7 |
 | ifs.c:111:8:111:11 | argv | ifs.c:112:9:112:10 | i7 |
 | ifs.c:111:8:111:11 | argv | ifs.c:112:9:112:10 | i7 |
 | ifs.c:111:8:111:11 | argv | ifs.c:112:9:112:10 | i7 |
-| ifs.c:111:8:111:11 | argv | ifs.c:112:9:112:10 | i7 |
-| ifs.c:111:8:111:11 | argv | ifs.c:112:9:112:10 | i7 |
-| ifs.c:112:9:112:10 | i7 | ifs.c:112:9:112:10 | (const char *)... |
-| ifs.c:112:9:112:10 | i7 | ifs.c:112:9:112:10 | i7 |
 | ifs.c:117:8:117:11 | argv | ifs.c:118:9:118:10 | (const char *)... |
 | ifs.c:117:8:117:11 | argv | ifs.c:118:9:118:10 | (const char *)... |
 | ifs.c:117:8:117:11 | argv | ifs.c:118:9:118:10 | i8 |
 | ifs.c:117:8:117:11 | argv | ifs.c:118:9:118:10 | i8 |
 | ifs.c:117:8:117:11 | argv | ifs.c:118:9:118:10 | i8 |
 | ifs.c:117:8:117:11 | argv | ifs.c:118:9:118:10 | i8 |
-| ifs.c:117:8:117:11 | argv | ifs.c:118:9:118:10 | i8 |
-| ifs.c:117:8:117:11 | argv | ifs.c:118:9:118:10 | i8 |
-| ifs.c:118:9:118:10 | i8 | ifs.c:118:9:118:10 | (const char *)... |
-| ifs.c:118:9:118:10 | i8 | ifs.c:118:9:118:10 | i8 |
 | ifs.c:123:8:123:11 | argv | ifs.c:124:9:124:10 | (const char *)... |
 | ifs.c:123:8:123:11 | argv | ifs.c:124:9:124:10 | (const char *)... |
 | ifs.c:123:8:123:11 | argv | ifs.c:124:9:124:10 | i9 |
 | ifs.c:123:8:123:11 | argv | ifs.c:124:9:124:10 | i9 |
 | ifs.c:123:8:123:11 | argv | ifs.c:124:9:124:10 | i9 |
 | ifs.c:123:8:123:11 | argv | ifs.c:124:9:124:10 | i9 |
-| ifs.c:123:8:123:11 | argv | ifs.c:124:9:124:10 | i9 |
-| ifs.c:123:8:123:11 | argv | ifs.c:124:9:124:10 | i9 |
-| ifs.c:124:9:124:10 | i9 | ifs.c:124:9:124:10 | (const char *)... |
-| ifs.c:124:9:124:10 | i9 | ifs.c:124:9:124:10 | i9 |
 nodes
 | ifs.c:61:8:61:11 | argv | semmle.label | argv |
 | ifs.c:61:8:61:11 | argv | semmle.label | argv |

cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/TaintedAllocationSize.expected

@@ -5,8 +5,6 @@ edges
 | test.cpp:39:21:39:24 | argv | test.cpp:42:38:42:44 | tainted |
 | test.cpp:39:21:39:24 | argv | test.cpp:42:38:42:44 | tainted |
 | test.cpp:39:21:39:24 | argv | test.cpp:42:38:42:44 | tainted |
-| test.cpp:39:21:39:24 | argv | test.cpp:42:38:42:44 | tainted |
-| test.cpp:39:21:39:24 | argv | test.cpp:42:38:42:44 | tainted |
 | test.cpp:39:21:39:24 | argv | test.cpp:43:38:43:63 | ... * ... |
 | test.cpp:39:21:39:24 | argv | test.cpp:43:38:43:63 | ... * ... |
 | test.cpp:39:21:39:24 | argv | test.cpp:43:38:43:63 | ... * ... |
@@ -21,8 +19,6 @@ edges
 | test.cpp:39:21:39:24 | argv | test.cpp:48:32:48:35 | size |
 | test.cpp:39:21:39:24 | argv | test.cpp:48:32:48:35 | size |
 | test.cpp:39:21:39:24 | argv | test.cpp:48:32:48:35 | size |
-| test.cpp:39:21:39:24 | argv | test.cpp:48:32:48:35 | size |
-| test.cpp:39:21:39:24 | argv | test.cpp:48:32:48:35 | size |
 | test.cpp:39:21:39:24 | argv | test.cpp:49:26:49:29 | size |
 | test.cpp:39:21:39:24 | argv | test.cpp:49:26:49:29 | size |
 | test.cpp:39:21:39:24 | argv | test.cpp:49:26:49:29 | size |
@@ -31,10 +27,6 @@ edges
 | test.cpp:39:21:39:24 | argv | test.cpp:52:35:52:60 | ... * ... |
 | test.cpp:39:21:39:24 | argv | test.cpp:52:35:52:60 | ... * ... |
 | test.cpp:39:21:39:24 | argv | test.cpp:52:35:52:60 | ... * ... |
-| test.cpp:42:38:42:44 | tainted | test.cpp:42:38:42:44 | (size_t)... |
-| test.cpp:42:38:42:44 | tainted | test.cpp:42:38:42:44 | tainted |
-| test.cpp:48:32:48:35 | size | test.cpp:48:32:48:35 | (size_t)... |
-| test.cpp:48:32:48:35 | size | test.cpp:48:32:48:35 | size |
 | test.cpp:123:18:123:23 | call to getenv | test.cpp:127:24:127:41 | ... * ... |
 | test.cpp:123:18:123:23 | call to getenv | test.cpp:127:24:127:41 | ... * ... |
 | test.cpp:123:18:123:31 | (const char *)... | test.cpp:127:24:127:41 | ... * ... |
@@ -58,44 +50,27 @@ edges
 | test.cpp:227:24:227:29 | call to getenv | test.cpp:229:9:229:18 | (size_t)... |
 | test.cpp:227:24:227:29 | call to getenv | test.cpp:229:9:229:18 | local_size |
 | test.cpp:227:24:227:29 | call to getenv | test.cpp:229:9:229:18 | local_size |
-| test.cpp:227:24:227:29 | call to getenv | test.cpp:229:9:229:18 | local_size |
 | test.cpp:227:24:227:29 | call to getenv | test.cpp:235:11:235:20 | (size_t)... |
 | test.cpp:227:24:227:29 | call to getenv | test.cpp:237:10:237:19 | (size_t)... |
 | test.cpp:227:24:227:37 | (const char *)... | test.cpp:229:9:229:18 | (size_t)... |
 | test.cpp:227:24:227:37 | (const char *)... | test.cpp:229:9:229:18 | local_size |
 | test.cpp:227:24:227:37 | (const char *)... | test.cpp:229:9:229:18 | local_size |
-| test.cpp:227:24:227:37 | (const char *)... | test.cpp:229:9:229:18 | local_size |
 | test.cpp:227:24:227:37 | (const char *)... | test.cpp:235:11:235:20 | (size_t)... |
 | test.cpp:227:24:227:37 | (const char *)... | test.cpp:237:10:237:19 | (size_t)... |
-| test.cpp:229:9:229:18 | local_size | test.cpp:229:9:229:18 | (size_t)... |
-| test.cpp:229:9:229:18 | local_size | test.cpp:229:9:229:18 | local_size |
 | test.cpp:235:11:235:20 | (size_t)... | test.cpp:214:23:214:23 | s |
 | test.cpp:237:10:237:19 | (size_t)... | test.cpp:220:21:220:21 | s |
 | test.cpp:241:2:241:32 | Chi | test.cpp:279:17:279:20 | get_size output argument |
 | test.cpp:241:2:241:32 | Chi | test.cpp:295:18:295:21 | get_size output argument |
-| test.cpp:241:2:241:32 | Chi [[0..32)] | test.cpp:279:17:279:20 | get_size output argument [[0..32)] |
-| test.cpp:241:2:241:32 | Chi [[0..32)] | test.cpp:295:18:295:21 | get_size output argument [[0..32)] |
-| test.cpp:241:2:241:32 | Store | test.cpp:241:2:241:32 | Chi [[0..32)] |
 | test.cpp:241:18:241:23 | call to getenv | test.cpp:241:2:241:32 | Chi |
-| test.cpp:241:18:241:23 | call to getenv | test.cpp:241:2:241:32 | Store |
 | test.cpp:241:18:241:31 | (const char *)... | test.cpp:241:2:241:32 | Chi |
-| test.cpp:241:18:241:31 | (const char *)... | test.cpp:241:2:241:32 | Store |
 | test.cpp:249:20:249:25 | call to getenv | test.cpp:253:11:253:29 | ... * ... |
 | test.cpp:249:20:249:25 | call to getenv | test.cpp:253:11:253:29 | ... * ... |
 | test.cpp:249:20:249:33 | (const char *)... | test.cpp:253:11:253:29 | ... * ... |
 | test.cpp:249:20:249:33 | (const char *)... | test.cpp:253:11:253:29 | ... * ... |
-| test.cpp:279:17:279:20 | Chi [[0..32)] | test.cpp:281:11:281:14 | size |
 | test.cpp:279:17:279:20 | get_size output argument | test.cpp:281:11:281:28 | ... * ... |
 | test.cpp:279:17:279:20 | get_size output argument | test.cpp:281:11:281:28 | ... * ... |
-| test.cpp:279:17:279:20 | get_size output argument [[0..32)] | test.cpp:279:17:279:20 | Chi [[0..32)] |
-| test.cpp:281:11:281:14 | size | test.cpp:281:11:281:28 | ... * ... |
-| test.cpp:281:11:281:14 | size | test.cpp:281:11:281:28 | ... * ... |
-| test.cpp:295:18:295:21 | Chi [[0..32)] | test.cpp:298:10:298:13 | size |
 | test.cpp:295:18:295:21 | get_size output argument | test.cpp:298:10:298:27 | ... * ... |
 | test.cpp:295:18:295:21 | get_size output argument | test.cpp:298:10:298:27 | ... * ... |
-| test.cpp:295:18:295:21 | get_size output argument [[0..32)] | test.cpp:295:18:295:21 | Chi [[0..32)] |
-| test.cpp:298:10:298:13 | size | test.cpp:298:10:298:27 | ... * ... |
-| test.cpp:298:10:298:13 | size | test.cpp:298:10:298:27 | ... * ... |
 | test.cpp:301:19:301:24 | call to getenv | test.cpp:305:11:305:28 | ... * ... |
 | test.cpp:301:19:301:24 | call to getenv | test.cpp:305:11:305:28 | ... * ... |
 | test.cpp:301:19:301:32 | (const char *)... | test.cpp:305:11:305:28 | ... * ... |
@@ -168,8 +143,6 @@ nodes
 | test.cpp:235:11:235:20 | (size_t)... | semmle.label | (size_t)... |
 | test.cpp:237:10:237:19 | (size_t)... | semmle.label | (size_t)... |
 | test.cpp:241:2:241:32 | Chi | semmle.label | Chi |
-| test.cpp:241:2:241:32 | Chi [[0..32)] | semmle.label | Chi [[0..32)] |
-| test.cpp:241:2:241:32 | Store | semmle.label | Store |
 | test.cpp:241:18:241:23 | call to getenv | semmle.label | call to getenv |
 | test.cpp:241:18:241:31 | (const char *)... | semmle.label | (const char *)... |
 | test.cpp:249:20:249:25 | call to getenv | semmle.label | call to getenv |
@@ -177,17 +150,11 @@ nodes
 | test.cpp:253:11:253:29 | ... * ... | semmle.label | ... * ... |
 | test.cpp:253:11:253:29 | ... * ... | semmle.label | ... * ... |
 | test.cpp:253:11:253:29 | ... * ... | semmle.label | ... * ... |
-| test.cpp:279:17:279:20 | Chi [[0..32)] | semmle.label | Chi [[0..32)] |
 | test.cpp:279:17:279:20 | get_size output argument | semmle.label | get_size output argument |
-| test.cpp:279:17:279:20 | get_size output argument [[0..32)] | semmle.label | get_size output argument [[0..32)] |
-| test.cpp:281:11:281:14 | size | semmle.label | size |
 | test.cpp:281:11:281:28 | ... * ... | semmle.label | ... * ... |
 | test.cpp:281:11:281:28 | ... * ... | semmle.label | ... * ... |
 | test.cpp:281:11:281:28 | ... * ... | semmle.label | ... * ... |
-| test.cpp:295:18:295:21 | Chi [[0..32)] | semmle.label | Chi [[0..32)] |
 | test.cpp:295:18:295:21 | get_size output argument | semmle.label | get_size output argument |
-| test.cpp:295:18:295:21 | get_size output argument [[0..32)] | semmle.label | get_size output argument [[0..32)] |
-| test.cpp:298:10:298:13 | size | semmle.label | size |
 | test.cpp:298:10:298:27 | ... * ... | semmle.label | ... * ... |
 | test.cpp:298:10:298:27 | ... * ... | semmle.label | ... * ... |
 | test.cpp:298:10:298:27 | ... * ... | semmle.label | ... * ... |

cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/uncontrolled/ArithmeticUncontrolled.expected

@@ -23,14 +23,10 @@ edges
 | test.c:60:13:60:16 | call to rand | test.c:61:5:61:5 | r |
 | test.c:60:13:60:16 | call to rand | test.c:61:5:61:5 | r |
 | test.c:60:13:60:16 | call to rand | test.c:61:5:61:5 | r |
-| test.c:60:13:60:16 | call to rand | test.c:61:5:61:5 | r |
-| test.c:60:13:60:16 | call to rand | test.c:61:5:61:5 | r |
 | test.c:60:13:60:16 | call to rand | test.c:62:5:62:5 | r |
 | test.c:60:13:60:16 | call to rand | test.c:62:5:62:5 | r |
 | test.c:60:13:60:16 | call to rand | test.c:62:5:62:5 | r |
 | test.c:60:13:60:16 | call to rand | test.c:62:5:62:5 | r |
-| test.c:61:5:61:5 | r | test.c:62:5:62:5 | r |
-| test.c:61:5:61:5 | r | test.c:62:5:62:5 | r |
 | test.c:66:13:66:16 | call to rand | test.c:67:5:67:5 | r |
 | test.c:66:13:66:16 | call to rand | test.c:67:5:67:5 | r |
 | test.c:66:13:66:16 | call to rand | test.c:67:5:67:5 | r |
@@ -47,31 +43,17 @@ edges
 | test.cpp:8:9:8:12 | call to rand | test.cpp:8:9:8:12 | Store |
 | test.cpp:8:9:8:12 | call to rand | test.cpp:8:9:8:12 | Store |
 | test.cpp:13:2:13:15 | Chi | test.cpp:30:13:30:14 | get_rand2 output argument |
-| test.cpp:13:2:13:15 | Chi [[0..32)] | test.cpp:30:13:30:14 | get_rand2 output argument [[0..32)] |
-| test.cpp:13:2:13:15 | Store | test.cpp:13:2:13:15 | Chi [[0..32)] |
 | test.cpp:13:10:13:13 | call to rand | test.cpp:13:2:13:15 | Chi |
 | test.cpp:13:10:13:13 | call to rand | test.cpp:13:2:13:15 | Chi |
-| test.cpp:13:10:13:13 | call to rand | test.cpp:13:2:13:15 | Store |
-| test.cpp:13:10:13:13 | call to rand | test.cpp:13:2:13:15 | Store |
 | test.cpp:18:2:18:14 | Chi | test.cpp:36:13:36:13 | get_rand3 output argument |
-| test.cpp:18:2:18:14 | Chi [[0..32)] | test.cpp:36:13:36:13 | get_rand3 output argument [[0..32)] |
-| test.cpp:18:2:18:14 | Store | test.cpp:18:2:18:14 | Chi [[0..32)] |
 | test.cpp:18:9:18:12 | call to rand | test.cpp:18:2:18:14 | Chi |
 | test.cpp:18:9:18:12 | call to rand | test.cpp:18:2:18:14 | Chi |
-| test.cpp:18:9:18:12 | call to rand | test.cpp:18:2:18:14 | Store |
-| test.cpp:18:9:18:12 | call to rand | test.cpp:18:2:18:14 | Store |
 | test.cpp:24:11:24:18 | call to get_rand | test.cpp:25:7:25:7 | r |
 | test.cpp:24:11:24:18 | call to get_rand | test.cpp:25:7:25:7 | r |
-| test.cpp:30:13:30:14 | Chi [[0..32)] | test.cpp:31:7:31:7 | r |
-| test.cpp:30:13:30:14 | Chi [[0..32)] | test.cpp:31:7:31:7 | r |
 | test.cpp:30:13:30:14 | get_rand2 output argument | test.cpp:31:7:31:7 | r |
 | test.cpp:30:13:30:14 | get_rand2 output argument | test.cpp:31:7:31:7 | r |
-| test.cpp:30:13:30:14 | get_rand2 output argument [[0..32)] | test.cpp:30:13:30:14 | Chi [[0..32)] |
-| test.cpp:36:13:36:13 | Chi [[0..32)] | test.cpp:37:7:37:7 | r |
-| test.cpp:36:13:36:13 | Chi [[0..32)] | test.cpp:37:7:37:7 | r |
 | test.cpp:36:13:36:13 | get_rand3 output argument | test.cpp:37:7:37:7 | r |
 | test.cpp:36:13:36:13 | get_rand3 output argument | test.cpp:37:7:37:7 | r |
-| test.cpp:36:13:36:13 | get_rand3 output argument [[0..32)] | test.cpp:36:13:36:13 | Chi [[0..32)] |
 nodes
 | test.c:18:13:18:16 | call to rand | semmle.label | call to rand |
 | test.c:18:13:18:16 | call to rand | semmle.label | call to rand |
@@ -125,28 +107,20 @@ nodes
 | test.cpp:8:9:8:12 | call to rand | semmle.label | call to rand |
 | test.cpp:8:9:8:12 | call to rand | semmle.label | call to rand |
 | test.cpp:13:2:13:15 | Chi | semmle.label | Chi |
-| test.cpp:13:2:13:15 | Chi [[0..32)] | semmle.label | Chi [[0..32)] |
-| test.cpp:13:2:13:15 | Store | semmle.label | Store |
 | test.cpp:13:10:13:13 | call to rand | semmle.label | call to rand |
 | test.cpp:13:10:13:13 | call to rand | semmle.label | call to rand |
 | test.cpp:18:2:18:14 | Chi | semmle.label | Chi |
-| test.cpp:18:2:18:14 | Chi [[0..32)] | semmle.label | Chi [[0..32)] |
-| test.cpp:18:2:18:14 | Store | semmle.label | Store |
 | test.cpp:18:9:18:12 | call to rand | semmle.label | call to rand |
 | test.cpp:18:9:18:12 | call to rand | semmle.label | call to rand |
 | test.cpp:24:11:24:18 | call to get_rand | semmle.label | call to get_rand |
 | test.cpp:25:7:25:7 | r | semmle.label | r |
 | test.cpp:25:7:25:7 | r | semmle.label | r |
 | test.cpp:25:7:25:7 | r | semmle.label | r |
-| test.cpp:30:13:30:14 | Chi [[0..32)] | semmle.label | Chi [[0..32)] |
 | test.cpp:30:13:30:14 | get_rand2 output argument | semmle.label | get_rand2 output argument |
-| test.cpp:30:13:30:14 | get_rand2 output argument [[0..32)] | semmle.label | get_rand2 output argument [[0..32)] |
 | test.cpp:31:7:31:7 | r | semmle.label | r |
 | test.cpp:31:7:31:7 | r | semmle.label | r |
 | test.cpp:31:7:31:7 | r | semmle.label | r |
-| test.cpp:36:13:36:13 | Chi [[0..32)] | semmle.label | Chi [[0..32)] |
 | test.cpp:36:13:36:13 | get_rand3 output argument | semmle.label | get_rand3 output argument |
-| test.cpp:36:13:36:13 | get_rand3 output argument [[0..32)] | semmle.label | get_rand3 output argument [[0..32)] |
 | test.cpp:37:7:37:7 | r | semmle.label | r |
 | test.cpp:37:7:37:7 | r | semmle.label | r |
 | test.cpp:37:7:37:7 | r | semmle.label | r |

cpp/upgrades/098850d25c4e9d417eb74c1bef9deb2f9d2dc417/upgrade.properties

@@ -0,0 +1,3 @@
+description: Add some coroutines types (@co_await, @co_yield, @stmt_co_return)
+compatibility: backwards
+

csharp/ql/src/experimental/ir/implementation/raw/Instruction.qll

@@ -1962,13 +1962,6 @@ class ChiInstruction extends Instruction {
    * Gets the operand that represents the new value written by the memory write.
    */
   final Instruction getPartial() { result = getPartialOperand().getDef() }
-
-  /**
-   * Gets the bit range `[startBit, endBit)` updated by the partial operand of this `ChiInstruction`.
-   */
-  final predicate getUpdatedInterval(int startBit, int endBit) {
-    Construction::getIntervalUpdatedByChi(this, startBit, endBit)
-  }
 }
 
 /**

csharp/ql/src/experimental/ir/implementation/raw/Operand.qll

@@ -328,14 +328,6 @@ class NonPhiMemoryOperand extends NonPhiOperand, MemoryOperand, NonPhiMemoryOper
     not Construction::isInCycle(useInstr) and
     strictcount(Construction::getMemoryOperandDefinition(useInstr, tag, _)) = 1
   }
-
-  /**
-   * Holds if the operand totally overlaps with its definition and consumes the
-   * bit range `[startBitOffset, endBitOffset)`.
-   */
-  predicate getUsedInterval(int startBitOffset, int endBitOffset) {
-    Construction::getUsedInterval(this, startBitOffset, endBitOffset)
-  }
 }
 
 /**

csharp/ql/src/experimental/ir/implementation/raw/internal/IRConstruction.qll

@@ -214,20 +214,6 @@ private module Cached {
     result = getMemoryOperandDefinition(instr, _, _)
   }
 
-  /**
-   * Holds if the partial operand of this `ChiInstruction` updates the bit range
-   * `[startBitOffset, endBitOffset)` of the total operand.
-   */
-  cached
-  predicate getIntervalUpdatedByChi(ChiInstruction chi, int startBit, int endBit) { none() }
-
-  /**
-   * Holds if the operand totally overlaps with its definition and consumes the
-   * bit range `[startBitOffset, endBitOffset)`.
-   */
-  cached
-  predicate getUsedInterval(Operand operand, int startBit, int endBit) { none() }
-
   /**
    * Holds if `instr` is part of a cycle in the operand graph that doesn't go
    * through a phi instruction and therefore should be impossible.

csharp/ql/src/experimental/ir/implementation/unaliased_ssa/Instruction.qll

@@ -1962,13 +1962,6 @@ class ChiInstruction extends Instruction {
    * Gets the operand that represents the new value written by the memory write.
    */
   final Instruction getPartial() { result = getPartialOperand().getDef() }
-
-  /**
-   * Gets the bit range `[startBit, endBit)` updated by the partial operand of this `ChiInstruction`.
-   */
-  final predicate getUpdatedInterval(int startBit, int endBit) {
-    Construction::getIntervalUpdatedByChi(this, startBit, endBit)
-  }
 }
 
 /**

csharp/ql/src/experimental/ir/implementation/unaliased_ssa/Operand.qll

@@ -328,14 +328,6 @@ class NonPhiMemoryOperand extends NonPhiOperand, MemoryOperand, NonPhiMemoryOper
     not Construction::isInCycle(useInstr) and
     strictcount(Construction::getMemoryOperandDefinition(useInstr, tag, _)) = 1
   }
-
-  /**
-   * Holds if the operand totally overlaps with its definition and consumes the
-   * bit range `[startBitOffset, endBitOffset)`.
-   */
-  predicate getUsedInterval(int startBitOffset, int endBitOffset) {
-    Construction::getUsedInterval(this, startBitOffset, endBitOffset)
-  }
 }
 
 /**

csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll

@@ -149,34 +149,6 @@ private module Cached {
     )
   }
 
-  /**
-   * Holds if the partial operand of this `ChiInstruction` updates the bit range
-   * `[startBitOffset, endBitOffset)` of the total operand.
-   */
-  cached
-  predicate getIntervalUpdatedByChi(ChiInstruction chi, int startBitOffset, int endBitOffset) {
-    exists(Alias::MemoryLocation location, OldInstruction oldInstruction |
-      oldInstruction = getOldInstruction(chi.getPartial()) and
-      location = Alias::getResultMemoryLocation(oldInstruction) and
-      startBitOffset = Alias::getStartBitOffset(location) and
-      endBitOffset = Alias::getEndBitOffset(location)
-    )
-  }
-
-  /**
-   * Holds if `operand` totally overlaps with its definition and consumes the bit range
-   * `[startBitOffset, endBitOffset)`.
-   */
-  cached
-  predicate getUsedInterval(NonPhiMemoryOperand operand, int startBitOffset, int endBitOffset) {
-    exists(Alias::MemoryLocation location, OldIR::NonPhiMemoryOperand oldOperand |
-      oldOperand = operand.getUse().(OldInstruction).getAnOperand() and
-      location = Alias::getOperandMemoryLocation(oldOperand) and
-      startBitOffset = Alias::getStartBitOffset(location) and
-      endBitOffset = Alias::getEndBitOffset(location)
-    )
-  }
-
   /**
    * Holds if `instr` is part of a cycle in the operand graph that doesn't go
    * through a phi instruction and therefore should be impossible.

csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/SimpleSSA.qll

@@ -79,9 +79,3 @@ MemoryLocation getResultMemoryLocation(Instruction instr) {
 MemoryLocation getOperandMemoryLocation(MemoryOperand operand) {
   result = getMemoryLocation(getAddressOperandAllocation(operand.getAddressOperand()))
 }
-
-/** Gets the start bit offset of a `MemoryLocation`, if any. */
-int getStartBitOffset(MemoryLocation location) { none() }
-
-/** Gets the end bit offset of a `MemoryLocation`, if any. */
-int getEndBitOffset(MemoryLocation location) { none() }

csharp/ql/src/semmle/code/csharp/controlflow/Guards.qll

@@ -212,12 +212,7 @@ module AbstractValues {
         c.isValidFor(cfe) and
         foreachEmptiness(fs, cfe) and
         e = fs.getIterableExpr()
-      ) and
-      // Only when taking the non-empty successor do we know that the original iterator
-      // expression was non-empty. When taking the empty successor, we may have already
-      // iterated through the `foreach` loop zero or more times, hence the iterator
-      // expression can be both empty and non-empty
-      this.isNonEmpty()
+      )
     }
 
     override EmptyCollectionValue getDualValue() {

csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImplConsistency.qll

@@ -123,18 +123,8 @@ module Consistency {
     n.getEnclosingCallable() != call.getEnclosingCallable()
   }
 
-  // This predicate helps the compiler forget that in some languages
-  // it is impossible for a result of `getPreUpdateNode` to be an
-  // instance of `PostUpdateNode`.
-  private Node getPre(PostUpdateNode n) {
-    result = n.getPreUpdateNode()
-    or
-    none()
-  }
-
   query predicate postIsNotPre(PostUpdateNode n, string msg) {
-    getPre(n) = n and
-    msg = "PostUpdateNode should not equal its pre-update node."
+    n.getPreUpdateNode() = n and msg = "PostUpdateNode should not equal its pre-update node."
   }
 
   query predicate postHasUniquePre(PostUpdateNode n, string msg) {
@@ -162,6 +152,12 @@ module Consistency {
     msg = "Origin of readStep is missing a PostUpdateNode."
   }
 
+  query predicate storeIsPostUpdate(Node n, string msg) {
+    storeStep(_, _, n) and
+    not n instanceof PostUpdateNode and
+    msg = "Store targets should be PostUpdateNodes."
+  }
+
   query predicate argHasPostUpdate(ArgumentNode n, string msg) {
     not hasPost(n) and
     not isImmutableOrUnobservable(n) and

csharp/ql/test/library-tests/controlflow/guards/AbstractValue.expected

@@ -18,7 +18,7 @@ abstractValue
 | 0 | Collections.cs:78:36:78:36 | 0 |
 | 0 | Collections.cs:80:35:80:35 | 0 |
 | 0 | Collections.cs:81:36:81:36 | 0 |
-| 0 | Collections.cs:87:17:87:32 | 0 |
+| 0 | Collections.cs:87:17:87:31 | 0 |
 | 0 | Guards.cs:12:24:12:24 | 0 |
 | 0 | Guards.cs:78:26:78:26 | 0 |
 | 0 | Guards.cs:80:25:80:25 | 0 |
@@ -59,8 +59,8 @@ abstractValue
 | 1 | Guards.cs:331:17:331:19 | access to constant B |
 | 1 | Guards.cs:334:13:334:15 | access to constant B |
 | 1 | Guards.cs:335:18:335:18 | 1 |
-| 3 | Collections.cs:55:13:55:42 | 3 |
-| 3 | Collections.cs:63:17:63:46 | 3 |
+| 3 | Collections.cs:55:13:55:41 | 3 |
+| 3 | Collections.cs:63:17:63:45 | 3 |
 | 10 | Guards.cs:84:25:84:26 | 10 |
 | 10 | Guards.cs:86:26:86:27 | 10 |
 | empty | Collections.cs:54:13:54:16 | access to parameter args |
@@ -69,22 +69,22 @@ abstractValue
 | empty | Collections.cs:58:9:58:13 | ... = ... |
 | empty | Collections.cs:58:13:58:13 | access to local variable x |
 | empty | Collections.cs:65:13:65:13 | access to local variable x |
-| empty | Collections.cs:87:17:87:32 | array creation of type String[] |
-| empty | Collections.cs:87:30:87:32 | { ..., ... } |
-| empty | Collections.cs:88:22:88:24 | { ..., ... } |
+| empty | Collections.cs:87:17:87:31 | array creation of type String[] |
+| empty | Collections.cs:87:30:87:31 | { ..., ... } |
+| empty | Collections.cs:88:22:88:23 | { ..., ... } |
 | false | Guards.cs:178:16:178:20 | false |
 | false | Guards.cs:181:53:181:57 | false |
 | false | Guards.cs:217:18:217:22 | false |
 | false | Guards.cs:228:18:228:22 | false |
 | false | Guards.cs:295:18:295:22 | false |
 | false | Guards.cs:305:18:305:22 | false |
-| non-empty | Collections.cs:55:9:55:42 | ... = ... |
-| non-empty | Collections.cs:55:13:55:42 | array creation of type String[] |
-| non-empty | Collections.cs:55:26:55:42 | { ..., ... } |
+| non-empty | Collections.cs:55:9:55:41 | ... = ... |
+| non-empty | Collections.cs:55:13:55:41 | array creation of type String[] |
+| non-empty | Collections.cs:55:25:55:41 | { ..., ... } |
 | non-empty | Collections.cs:56:9:56:13 | ... = ... |
 | non-empty | Collections.cs:56:13:56:13 | access to local variable x |
-| non-empty | Collections.cs:63:17:63:46 | array creation of type String[] |
-| non-empty | Collections.cs:63:30:63:46 | { ..., ... } |
+| non-empty | Collections.cs:63:17:63:45 | array creation of type String[] |
+| non-empty | Collections.cs:63:29:63:45 | { ..., ... } |
 | non-empty | Collections.cs:68:13:68:13 | access to local variable x |
 | non-empty | Collections.cs:89:9:89:32 | ... = ... |
 | non-empty | Collections.cs:89:13:89:32 | array creation of type String[] |
@@ -155,11 +155,11 @@ abstractValue
 | non-null | Collections.cs:54:13:54:16 | access to parameter args |
 | non-null | Collections.cs:54:13:54:26 | call to method ToArray |
 | non-null | Collections.cs:55:9:55:9 | access to local variable x |
-| non-null | Collections.cs:55:9:55:42 | ... = ... |
-| non-null | Collections.cs:55:13:55:42 | array creation of type String[] |
-| non-null | Collections.cs:55:28:55:30 | "a" |
-| non-null | Collections.cs:55:33:55:35 | "b" |
-| non-null | Collections.cs:55:38:55:40 | "c" |
+| non-null | Collections.cs:55:9:55:41 | ... = ... |
+| non-null | Collections.cs:55:13:55:41 | array creation of type String[] |
+| non-null | Collections.cs:55:27:55:29 | "a" |
+| non-null | Collections.cs:55:32:55:34 | "b" |
+| non-null | Collections.cs:55:37:55:39 | "c" |
 | non-null | Collections.cs:56:9:56:9 | access to local variable x |
 | non-null | Collections.cs:56:9:56:13 | ... = ... |
 | non-null | Collections.cs:56:13:56:13 | access to local variable x |
@@ -169,11 +169,11 @@ abstractValue
 | non-null | Collections.cs:58:9:58:9 | access to local variable x |
 | non-null | Collections.cs:58:9:58:13 | ... = ... |
 | non-null | Collections.cs:58:13:58:13 | access to local variable x |
-| non-null | Collections.cs:63:17:63:46 | array creation of type String[] |
-| non-null | Collections.cs:63:17:63:55 | call to method ToList |
-| non-null | Collections.cs:63:32:63:34 | "a" |
-| non-null | Collections.cs:63:37:63:39 | "b" |
-| non-null | Collections.cs:63:42:63:44 | "c" |
+| non-null | Collections.cs:63:17:63:45 | array creation of type String[] |
+| non-null | Collections.cs:63:17:63:54 | call to method ToList |
+| non-null | Collections.cs:63:31:63:33 | "a" |
+| non-null | Collections.cs:63:36:63:38 | "b" |
+| non-null | Collections.cs:63:41:63:43 | "c" |
 | non-null | Collections.cs:64:9:64:9 | access to local variable x |
 | non-null | Collections.cs:65:13:65:13 | access to local variable x |
 | non-null | Collections.cs:67:13:67:13 | access to local variable x |
@@ -214,20 +214,14 @@ abstractValue
 | non-null | Collections.cs:82:24:82:30 | access to local function IsEmpty |
 | non-null | Collections.cs:82:24:82:30 | delegate creation of type Func<String,Boolean> |
 | non-null | Collections.cs:82:24:82:30 | this access |
-| non-null | Collections.cs:87:17:87:32 | array creation of type String[] |
-| non-null | Collections.cs:88:22:88:24 | array creation of type String[] |
+| non-null | Collections.cs:87:17:87:31 | array creation of type String[] |
+| non-null | Collections.cs:88:22:88:23 | array creation of type String[] |
 | non-null | Collections.cs:89:9:89:9 | access to local variable x |
 | non-null | Collections.cs:89:9:89:32 | ... = ... |
 | non-null | Collections.cs:89:13:89:32 | array creation of type String[] |
 | non-null | Collections.cs:89:28:89:30 | "a" |
 | non-null | Collections.cs:90:22:90:28 | array creation of type String[] |
 | non-null | Collections.cs:90:24:90:26 | "a" |
-| non-null | Collections.cs:95:29:95:32 | access to parameter args |
-| non-null | Collections.cs:96:13:96:19 | access to type Console |
-| non-null | Collections.cs:96:31:96:34 | access to parameter args |
-| non-null | Collections.cs:101:29:101:32 | access to parameter args |
-| non-null | Collections.cs:103:9:103:15 | access to type Console |
-| non-null | Collections.cs:103:27:103:30 | access to parameter args |
 | non-null | Guards.cs:12:13:12:13 | access to parameter s |
 | non-null | Guards.cs:14:13:14:19 | access to type Console |
 | non-null | Guards.cs:14:31:14:31 | access to parameter s |

csharp/ql/test/library-tests/controlflow/guards/Collections.cs

@@ -52,7 +52,7 @@ public class Collections
         var x = args.ToArray();
         args.Clear();
         x = args.ToArray();
-        x = new string[] { "a", "b", "c" };
+        x = new string[]{ "a", "b", "c" };
         x = x;
         x = new string[0];
         x = x;
@@ -60,7 +60,7 @@ public class Collections
 
     void M6()
     {
-        var x = new string[] { "a", "b", "c" }.ToList();
+        var x = new string[]{ "a", "b", "c" }.ToList();
         x.Clear();
         if (x.Count == 0)
         {
@@ -84,23 +84,10 @@ public class Collections
 
     void M8()
     {
-        var x = new string[] { };
-        string[] y = { };
+        var x = new string[] {};
+        string[] y = {};
         x = new string[] { "a" };
         string[] z = { "a" };
     }
-
-    void M9(string[] args)
-    {
-        foreach (var arg in args)
-            Console.WriteLine(args); // guarded by `args` being non-empty
-    }
-
-    void M10(string[] args)
-    {
-        foreach (var arg in args)
-            ;
-        Console.WriteLine(args);
-    }
 }
 

csharp/ql/test/library-tests/controlflow/guards/GuardedControlFlowNode.expected

@@ -37,7 +37,6 @@
 | Collections.cs:67:13:67:13 | access to local variable x | Collections.cs:65:13:65:13 | access to local variable x | Collections.cs:65:13:65:13 | access to local variable x | empty |
 | Collections.cs:67:13:67:13 | access to local variable x | Collections.cs:65:13:65:24 | ... == ... | Collections.cs:65:13:65:13 | access to local variable x | true |
 | Collections.cs:68:13:68:13 | access to local variable x | Collections.cs:65:13:65:24 | ... == ... | Collections.cs:65:13:65:13 | access to local variable x | true |
-| Collections.cs:96:31:96:34 | access to parameter args | Collections.cs:95:29:95:32 | access to parameter args | Collections.cs:95:29:95:32 | access to parameter args | non-empty |
 | Guards.cs:12:13:12:13 | access to parameter s | Guards.cs:10:16:10:16 | access to parameter s | Guards.cs:10:16:10:16 | access to parameter s | non-null |
 | Guards.cs:12:13:12:13 | access to parameter s | Guards.cs:10:16:10:24 | ... == ... | Guards.cs:10:16:10:16 | access to parameter s | false |
 | Guards.cs:14:31:14:31 | access to parameter s | Guards.cs:10:16:10:16 | access to parameter s | Guards.cs:10:16:10:16 | access to parameter s | non-null |

csharp/ql/test/library-tests/controlflow/guards/GuardedExpr.expected

@@ -37,7 +37,6 @@
 | Collections.cs:67:13:67:13 | access to local variable x | Collections.cs:65:13:65:13 | access to local variable x | Collections.cs:65:13:65:13 | access to local variable x | empty |
 | Collections.cs:67:13:67:13 | access to local variable x | Collections.cs:65:13:65:24 | ... == ... | Collections.cs:65:13:65:13 | access to local variable x | true |
 | Collections.cs:68:13:68:13 | access to local variable x | Collections.cs:65:13:65:24 | ... == ... | Collections.cs:65:13:65:13 | access to local variable x | true |
-| Collections.cs:96:31:96:34 | access to parameter args | Collections.cs:95:29:95:32 | access to parameter args | Collections.cs:95:29:95:32 | access to parameter args | non-empty |
 | Guards.cs:12:13:12:13 | access to parameter s | Guards.cs:10:16:10:16 | access to parameter s | Guards.cs:10:16:10:16 | access to parameter s | non-null |
 | Guards.cs:12:13:12:13 | access to parameter s | Guards.cs:10:16:10:24 | ... == ... | Guards.cs:10:16:10:16 | access to parameter s | false |
 | Guards.cs:14:31:14:31 | access to parameter s | Guards.cs:10:16:10:16 | access to parameter s | Guards.cs:10:16:10:16 | access to parameter s | non-null |

csharp/ql/test/library-tests/controlflow/guards/Implications.expected

@@ -180,26 +180,26 @@
 | Collections.cs:45:17:45:26 | call to method Any | true | Collections.cs:45:17:45:20 | access to parameter args | non-empty |
 | Collections.cs:50:13:50:27 | ... == ... | false | Collections.cs:50:13:50:16 | access to parameter args | non-empty |
 | Collections.cs:50:13:50:27 | ... == ... | true | Collections.cs:50:13:50:16 | access to parameter args | empty |
-| Collections.cs:56:13:56:13 | access to local variable x | empty | Collections.cs:55:13:55:42 | array creation of type String[] | empty |
-| Collections.cs:56:13:56:13 | access to local variable x | non-empty | Collections.cs:55:13:55:42 | array creation of type String[] | non-empty |
-| Collections.cs:56:13:56:13 | access to local variable x | non-null | Collections.cs:55:13:55:42 | array creation of type String[] | non-null |
-| Collections.cs:56:13:56:13 | access to local variable x | null | Collections.cs:55:13:55:42 | array creation of type String[] | null |
+| Collections.cs:56:13:56:13 | access to local variable x | empty | Collections.cs:55:13:55:41 | array creation of type String[] | empty |
+| Collections.cs:56:13:56:13 | access to local variable x | non-empty | Collections.cs:55:13:55:41 | array creation of type String[] | non-empty |
+| Collections.cs:56:13:56:13 | access to local variable x | non-null | Collections.cs:55:13:55:41 | array creation of type String[] | non-null |
+| Collections.cs:56:13:56:13 | access to local variable x | null | Collections.cs:55:13:55:41 | array creation of type String[] | null |
 | Collections.cs:58:13:58:13 | access to local variable x | empty | Collections.cs:57:13:57:25 | array creation of type String[] | empty |
 | Collections.cs:58:13:58:13 | access to local variable x | non-empty | Collections.cs:57:13:57:25 | array creation of type String[] | non-empty |
 | Collections.cs:58:13:58:13 | access to local variable x | non-null | Collections.cs:57:13:57:25 | array creation of type String[] | non-null |
 | Collections.cs:58:13:58:13 | access to local variable x | null | Collections.cs:57:13:57:25 | array creation of type String[] | null |
-| Collections.cs:64:9:64:9 | access to local variable x | empty | Collections.cs:63:17:63:55 | call to method ToList | empty |
-| Collections.cs:64:9:64:9 | access to local variable x | non-empty | Collections.cs:63:17:63:55 | call to method ToList | non-empty |
-| Collections.cs:64:9:64:9 | access to local variable x | non-null | Collections.cs:63:17:63:55 | call to method ToList | non-null |
-| Collections.cs:64:9:64:9 | access to local variable x | null | Collections.cs:63:17:63:55 | call to method ToList | null |
-| Collections.cs:65:13:65:13 | access to local variable x | non-null | Collections.cs:63:17:63:55 | call to method ToList | non-null |
-| Collections.cs:65:13:65:13 | access to local variable x | null | Collections.cs:63:17:63:55 | call to method ToList | null |
+| Collections.cs:64:9:64:9 | access to local variable x | empty | Collections.cs:63:17:63:54 | call to method ToList | empty |
+| Collections.cs:64:9:64:9 | access to local variable x | non-empty | Collections.cs:63:17:63:54 | call to method ToList | non-empty |
+| Collections.cs:64:9:64:9 | access to local variable x | non-null | Collections.cs:63:17:63:54 | call to method ToList | non-null |
+| Collections.cs:64:9:64:9 | access to local variable x | null | Collections.cs:63:17:63:54 | call to method ToList | null |
+| Collections.cs:65:13:65:13 | access to local variable x | non-null | Collections.cs:63:17:63:54 | call to method ToList | non-null |
+| Collections.cs:65:13:65:13 | access to local variable x | null | Collections.cs:63:17:63:54 | call to method ToList | null |
 | Collections.cs:65:13:65:24 | ... == ... | false | Collections.cs:65:13:65:13 | access to local variable x | non-empty |
 | Collections.cs:65:13:65:24 | ... == ... | true | Collections.cs:65:13:65:13 | access to local variable x | empty |
-| Collections.cs:67:13:67:13 | access to local variable x | non-null | Collections.cs:63:17:63:55 | call to method ToList | non-null |
-| Collections.cs:67:13:67:13 | access to local variable x | null | Collections.cs:63:17:63:55 | call to method ToList | null |
-| Collections.cs:68:13:68:13 | access to local variable x | non-null | Collections.cs:63:17:63:55 | call to method ToList | non-null |
-| Collections.cs:68:13:68:13 | access to local variable x | null | Collections.cs:63:17:63:55 | call to method ToList | null |
+| Collections.cs:67:13:67:13 | access to local variable x | non-null | Collections.cs:63:17:63:54 | call to method ToList | non-null |
+| Collections.cs:67:13:67:13 | access to local variable x | null | Collections.cs:63:17:63:54 | call to method ToList | null |
+| Collections.cs:68:13:68:13 | access to local variable x | non-null | Collections.cs:63:17:63:54 | call to method ToList | non-null |
+| Collections.cs:68:13:68:13 | access to local variable x | null | Collections.cs:63:17:63:54 | call to method ToList | null |
 | Collections.cs:74:35:74:41 | ... == ... | true | Collections.cs:74:35:74:35 | access to parameter s | non-null |
 | Collections.cs:74:35:74:41 | ... == ... | true | Collections.cs:74:40:74:41 | "" | non-null |
 | Collections.cs:75:17:75:33 | call to method Any | true | Collections.cs:75:17:75:20 | access to parameter args | non-empty |

java/ql/src/Performance/InefficientToArray.java

@@ -0,0 +1,28 @@
+class Company {
+	private List<Customer> customers = ...;
+	
+	public Customer[] getCustomerArray() {
+		// AVOID: Inefficient call to 'toArray' with zero-length argument
+		return customers.toArray(new Customer[0]);
+	}
+}
+
+class Company {
+	private List<Customer> customers = ...;
+	
+	public Customer[] getCustomerArray() {
+		// GOOD: More efficient call to 'toArray' with argument that is big enough to store the list
+		return customers.toArray(new Customer[customers.size()]);
+	}
+}
+
+class Company {
+	private static final Customer[] NO_CUSTOMERS = new Customer[0];
+	
+	private List<Customer> customers = ...;
+
+	public Customer[] getCustomerArray() {
+		// GOOD: Reuse same zero-length array on every invocation
+		return customers.toArray(NO_CUSTOMERS);
+	}
+}

java/ql/src/Performance/InefficientToArray.qhelp

@@ -0,0 +1,61 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+
+
+<overview>
+<p>The <code>java.util.Collection</code> interface provides a <code>toArray</code>
+method that can be used to convert a collection of objects into an array of a particular
+type. This method takes an array as an argument, which is used for two purposes.
+Firstly, it determines the type of the returned array. Secondly, if it is big enough to
+hold all values in the collection, it is filled with those values and returned;
+otherwise, a new array of sufficient size and the appropriate type is allocated and
+filled.</p>
+
+<p>It is common to pass a fresh zero-length array to <code>toArray</code>,
+simply because it is easy to construct one. Unfortunately, this allocation is wasteful,
+because the array clearly is not big enough to hold the elements of the collection. This can cause 
+considerable garbage collector churn, impacting performance.</p>
+
+</overview>
+<recommendation>
+
+<p>There are at least two ways to address this issue.</p>
+
+<p>The first is to always call <code>toArray</code> with a new array allocated with a
+sufficient size to hold the contents of the collection. Usually, this involves calling
+the collection's <code>size</code> method and allocating an array with that many
+elements. While it may seem odd that adding a call to <code>size</code> improves performance, if you 
+do not pass a large enough array, the <code>toArray</code> method makes this call automatically. 
+Calling <code>size</code> explicitly and then calling <code>toArray</code> with a large enough array
+avoids the possible creation of two arrays (one too small and consequently unused).</p>
+
+<p>The second approach is to add a static field holding a constant zero-length array to the
+enclosing class, and pass that field to <code>toArray</code>. In this case, <code>toArray</code>
+will end up allocating a new array in (almost) every case, but because the same zero-length array
+is reused every time, there is almost no overhead. (Note that if <code>toArray</code>
+is invoked on an empty collection, it will return the passed-in array. If your code expects
+a new array from every invocation of <code>toArray</code>, you should use the first method.)</p>
+
+</recommendation>
+<example>
+
+<p>In the following example, the first version of class <code>Company</code> uses an inefficient
+call to <code>toArray</code> by passing a zero-length array. The second and third version
+illustrate the two ways of addressing this issue outlined above.</p>
+
+<sample src="InefficientToArray.java" />
+
+</example>
+<references>
+
+
+<li>
+  Java Platform, Standard Edition 6, API Specification:
+  <a href="http://docs.oracle.com/javase/6/docs/api/java/util/Collection.html#toArray%28T[]%29">toArray</a>.
+</li>
+
+
+</references>
+</qhelp>

java/ql/src/Performance/InefficientToArray.ql

@@ -0,0 +1,53 @@
+/**
+ * @name Inefficient toArray on zero-length argument
+ * @description Calling 'Collection.toArray' with a zero-length array argument is inefficient.
+ * @kind problem
+ * @problem.severity recommendation
+ * @precision low
+ * @id java/inefficient-to-array
+ * @deprecated
+ */
+
+import java
+
+/*
+ * This method uses the toArray() method of a collection derived class, and passes in a
+ * zero-length prototype array argument.
+ *
+ * It is more efficient to  use myCollection.toArray(new Foo[myCollection.size()]).
+ * If the array passed in is big enough to store all of the elements of the collection,
+ * then it is populated and returned directly. This avoids the need to create a
+ * second array (by reflection) to return as the result.
+ *
+ * The new array has to be created as the argument value. Values in both branches of
+ * a conditional has to be an empty array.
+ */
+
+predicate emptyArrayLiteral(Expr e) {
+  // ArrayCreationExpr with zero-length init expr
+  exists(ArrayCreationExpr arr | arr = e |
+    exists(arr.getInit()) and
+    not exists(arr.getInit().getAnInit())
+  )
+  or
+  // ArrayCreationExpr where 0th dimension is zero literal
+  e.(ArrayCreationExpr).getDimension(0).(IntegerLiteral).getIntValue() = 0
+  or
+  exists(ConditionalExpr cond | cond = e |
+    emptyArrayLiteral(cond.getTrueExpr()) and
+    emptyArrayLiteral(cond.getFalseExpr())
+  )
+}
+
+class EmptyArrayLiteral extends Expr {
+  EmptyArrayLiteral() { emptyArrayLiteral(this) }
+}
+
+from EmptyArrayLiteral l, MethodAccess ma, Method m, GenericInterface coll
+where
+  coll.hasQualifiedName("java.util", "Collection") and
+  ma.getMethod() = m and
+  m.hasName("toArray") and
+  m.getDeclaringType().getASupertype*().getSourceDeclaration() = coll and
+  ma.getArgument(0) = l
+select ma, "Collection.toArray(...) called with zero-length array argument."

java/ql/src/Security/CWE/CWE-079/XSS.ql

@@ -12,24 +12,23 @@
 
 import java
 import semmle.code.java.dataflow.FlowSources
+import semmle.code.java.dataflow.TaintTracking2
 import semmle.code.java.security.XSS
-import DataFlow::PathGraph
+import DataFlow2::PathGraph
 
-class XSSConfig extends TaintTracking::Configuration {
+class XSSConfig extends TaintTracking2::Configuration {
   XSSConfig() { this = "XSSConfig" }
 
   override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
 
   override predicate isSink(DataFlow::Node sink) { sink instanceof XssSink }
 
-  override predicate isSanitizer(DataFlow::Node node) { node instanceof XssSanitizer }
-
-  override predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) {
-    any(XssAdditionalTaintStep s).step(node1, node2)
+  override predicate isSanitizer(DataFlow::Node node) {
+    node.getType() instanceof NumericType or node.getType() instanceof BooleanType
   }
 }
 
-from DataFlow::PathNode source, DataFlow::PathNode sink, XSSConfig conf
+from DataFlow2::PathNode source, DataFlow2::PathNode sink, XSSConfig conf
 where conf.hasFlowPath(source, sink)
 select sink.getNode(), source, sink, "Cross-site scripting vulnerability due to $@.",
   source.getNode(), "user-provided value"

java/ql/src/Security/CWE/CWE-079/XSSLocal.ql

@@ -12,10 +12,11 @@
 
 import java
 import semmle.code.java.dataflow.FlowSources
+import semmle.code.java.dataflow.TaintTracking2
 import semmle.code.java.security.XSS
-import DataFlow::PathGraph
+import DataFlow2::PathGraph
 
-class XSSLocalConfig extends TaintTracking::Configuration {
+class XSSLocalConfig extends TaintTracking2::Configuration {
   XSSLocalConfig() { this = "XSSLocalConfig" }
 
   override predicate isSource(DataFlow::Node source) { source instanceof LocalUserInput }
@@ -23,7 +24,7 @@ class XSSLocalConfig extends TaintTracking::Configuration {
   override predicate isSink(DataFlow::Node sink) { sink instanceof XssSink }
 }
 
-from DataFlow::PathNode source, DataFlow::PathNode sink, XSSLocalConfig conf
+from DataFlow2::PathNode source, DataFlow2::PathNode sink, XSSLocalConfig conf
 where conf.hasFlowPath(source, sink)
 select sink.getNode(), source, sink, "Cross-site scripting vulnerability due to $@.",
   source.getNode(), "user-provided value"

java/ql/src/Security/CWE/CWE-209/StackTraceExposure.ql

@@ -14,7 +14,7 @@
 
 import java
 import semmle.code.java.dataflow.DataFlow
-import semmle.code.java.dataflow.TaintTracking
+import semmle.code.java.dataflow.TaintTracking2
 import semmle.code.java.security.XSS
 
 /**
@@ -84,7 +84,7 @@ predicate stackTraceExpr(Expr exception, MethodAccess stackTraceString) {
   )
 }
 
-class StackTraceStringToXssSinkFlowConfig extends TaintTracking::Configuration {
+class StackTraceStringToXssSinkFlowConfig extends TaintTracking2::Configuration {
   StackTraceStringToXssSinkFlowConfig() {
     this = "StackTraceExposure::StackTraceStringToXssSinkFlowConfig"
   }
@@ -124,7 +124,7 @@ class GetMessageFlowSource extends MethodAccess {
   }
 }
 
-class GetMessageFlowSourceToXssSinkFlowConfig extends TaintTracking::Configuration {
+class GetMessageFlowSourceToXssSinkFlowConfig extends TaintTracking2::Configuration {
   GetMessageFlowSourceToXssSinkFlowConfig() {
     this = "StackTraceExposure::GetMessageFlowSourceToXssSinkFlowConfig"
   }

java/ql/src/semmle/code/java/StringFormat.qll

@@ -22,7 +22,6 @@ class StringFormatMethod extends FormatMethod {
   StringFormatMethod() {
     (
       this.hasName("format") or
-      this.hasName("formatted") or
       this.hasName("printf") or
       this.hasName("readLine") or
       this.hasName("readPassword")
@@ -39,8 +38,6 @@ class StringFormatMethod extends FormatMethod {
   override int getFormatStringIndex() {
     result = 0 and this.getSignature() = "format(java.lang.String,java.lang.Object[])"
     or
-    result = -1 and this.getSignature() = "formatted(java.lang.Object[])"
-    or
     result = 0 and this.getSignature() = "printf(java.lang.String,java.lang.Object[])"
     or
     result = 1 and
@@ -94,12 +91,6 @@ class FmtSyntax extends TFmtSyntax {
   predicate isLogger() { this = TFmtLogger() }
 }
 
-private Expr getArgumentOrQualifier(Call c, int i) {
-  result = c.getArgument(i)
-  or
-  result = c.getQualifier() and i = -1
-}
-
 /**
  * Holds if `c` wraps a call to a `StringFormatMethod`, such that `fmtix` is
  * the index of the format string argument to `c` and the following and final
@@ -120,7 +111,7 @@ private predicate formatWrapper(Callable c, int fmtix, FmtSyntax syntax) {
       or
       fmtcall.getCallee().(LoggerFormatMethod).getFormatStringIndex() = i and syntax = TFmtLogger()
     ) and
-    getArgumentOrQualifier(fmtcall, i) = fmt.getAnAccess() and
+    fmtcall.getArgument(i) = fmt.getAnAccess() and
     fmtcall.getArgument(i + 1) = args.getAnAccess()
   )
 }
@@ -164,7 +155,7 @@ class FormattingCall extends Call {
   }
 
   /** Gets the argument to this call in the position of the format string */
-  Expr getFormatArgument() { result = getArgumentOrQualifier(this, this.getFormatStringIndex()) }
+  Expr getFormatArgument() { result = this.getArgument(this.getFormatStringIndex()) }
 
   /** Gets an argument to be formatted. */
   Expr getAnArgumentToBeFormatted() {

java/ql/src/semmle/code/java/dataflow/FlowSources.qll

@@ -15,7 +15,6 @@ import semmle.code.java.frameworks.ApacheHttp
 import semmle.code.java.frameworks.android.XmlParsing
 import semmle.code.java.frameworks.android.WebView
 import semmle.code.java.frameworks.JaxWS
-import semmle.code.java.frameworks.javase.WebSocket
 import semmle.code.java.frameworks.android.Intent
 import semmle.code.java.frameworks.spring.SpringWeb
 import semmle.code.java.frameworks.spring.SpringController
@@ -156,14 +155,6 @@ private class ThriftIfaceParameterSource extends RemoteFlowSource {
   override string getSourceType() { result = "Thrift Iface parameter" }
 }
 
-private class WebSocketMessageParameterSource extends RemoteFlowSource {
-  WebSocketMessageParameterSource() {
-    exists(WebsocketOnText t | t.getParameter(1) = this.asParameter())
-  }
-
-  override string getSourceType() { result = "Websocket onText parameter" }
-}
-
 /** Class for `tainted` user input. */
 abstract class UserInput extends DataFlow::Node { }
 

java/ql/src/semmle/code/java/dataflow/internal/DataFlowImplConsistency.qll

@@ -123,18 +123,8 @@ module Consistency {
     n.getEnclosingCallable() != call.getEnclosingCallable()
   }
 
-  // This predicate helps the compiler forget that in some languages
-  // it is impossible for a result of `getPreUpdateNode` to be an
-  // instance of `PostUpdateNode`.
-  private Node getPre(PostUpdateNode n) {
-    result = n.getPreUpdateNode()
-    or
-    none()
-  }
-
   query predicate postIsNotPre(PostUpdateNode n, string msg) {
-    getPre(n) = n and
-    msg = "PostUpdateNode should not equal its pre-update node."
+    n.getPreUpdateNode() = n and msg = "PostUpdateNode should not equal its pre-update node."
   }
 
   query predicate postHasUniquePre(PostUpdateNode n, string msg) {
@@ -162,6 +152,12 @@ module Consistency {
     msg = "Origin of readStep is missing a PostUpdateNode."
   }
 
+  query predicate storeIsPostUpdate(Node n, string msg) {
+    storeStep(_, _, n) and
+    not n instanceof PostUpdateNode and
+    msg = "Store targets should be PostUpdateNodes."
+  }
+
   query predicate argHasPostUpdate(ArgumentNode n, string msg) {
     not hasPost(n) and
     not isImmutableOrUnobservable(n) and

java/ql/src/semmle/code/java/frameworks/javase/WebSocket.qll

@@ -1,21 +0,0 @@
-/**
- * Provides classes for identifying methods called by the Java SE WebSocket package.
- */
-
-import java
-
-/** The `java.net.http.Websocket.Listener` interface. */
-class WebsocketListener extends Interface {
-  WebsocketListener() { this.hasQualifiedName("java.net.http", "WebSocket$Listener") }
-}
-
-/** The method `onText` on a type that implements the `java.net.http.Websocket.Listener` interface. */
-class WebsocketOnText extends Method {
-  WebsocketOnText() {
-    exists(WebsocketListener l |
-      this.getDeclaringType().extendsOrImplements(l) and
-      // onText(WebSocket webSocket, CharSequence data, boolean last)
-      this.hasName("onText")
-    )
-  }
-}

java/ql/src/semmle/code/java/security/XSS.qll

@@ -1,55 +1,35 @@
-/** Provides classes to reason about Cross-site scripting (XSS) vulnerabilities. */
-
 import java
 import semmle.code.java.frameworks.Servlets
 import semmle.code.java.frameworks.android.WebView
 import semmle.code.java.frameworks.spring.SpringController
 import semmle.code.java.frameworks.spring.SpringHttp
-import semmle.code.java.dataflow.DataFlow
-import semmle.code.java.dataflow.TaintTracking2
+import semmle.code.java.dataflow.TaintTracking
 
-/** A sink that represent a method that outputs data without applying contextual output encoding. */
-abstract class XssSink extends DataFlow::Node { }
-
-/** A sanitizer that neutralizes dangerous characters that can be used to perform a XSS attack. */
-abstract class XssSanitizer extends DataFlow::Node { }
-
-/**
- * A unit class for adding additional taint steps.
- *
- * Extend this class to add additional taint steps that should apply to the XSS
- * taint configuration.
+/*
+ * Definitions for XSS sinks
  */
-abstract class XssAdditionalTaintStep extends TaintTracking2::Unit {
-  /**
-   * Holds if the step from `node1` to `node2` should be considered a taint
-   * step for XSS taint configurations.
-   */
-  abstract predicate step(DataFlow::Node node1, DataFlow::Node node2);
-}
 
-/** A default sink representing methods susceptible to XSS attacks. */
-private class DefaultXssSink extends XssSink {
-  DefaultXssSink() {
+class XssSink extends DataFlow::ExprNode {
+  XssSink() {
     exists(HttpServletResponseSendErrorMethod m, MethodAccess ma |
       ma.getMethod() = m and
-      this.asExpr() = ma.getArgument(1)
+      this.getExpr() = ma.getArgument(1)
     )
     or
     exists(ServletWriterSourceToWritingMethodFlowConfig writer, MethodAccess ma |
       ma.getMethod() instanceof WritingMethod and
       writer.hasFlowToExpr(ma.getQualifier()) and
-      this.asExpr() = ma.getArgument(_)
+      this.getExpr() = ma.getArgument(_)
     )
     or
     exists(Method m |
       m.getDeclaringType() instanceof TypeWebView and
       (
-        m.getAReference().getArgument(0) = this.asExpr() and m.getName() = "loadData"
+        m.getAReference().getArgument(0) = this.getExpr() and m.getName() = "loadData"
         or
-        m.getAReference().getArgument(0) = this.asExpr() and m.getName() = "loadUrl"
+        m.getAReference().getArgument(0) = this.getExpr() and m.getName() = "loadUrl"
         or
-        m.getAReference().getArgument(1) = this.asExpr() and m.getName() = "loadDataWithBaseURL"
+        m.getAReference().getArgument(1) = this.getExpr() and m.getName() = "loadDataWithBaseURL"
       )
     )
     or
@@ -97,15 +77,7 @@ private class DefaultXssSink extends XssSink {
   }
 }
 
-/** A default sanitizer that considers numeric and boolean typed data safe for writing to output. */
-private class DefaultXSSSanitizer extends XssSanitizer {
-  DefaultXSSSanitizer() {
-    this.getType() instanceof NumericType or this.getType() instanceof BooleanType
-  }
-}
-
-/** A configuration that tracks data from a servlet writer to an output method. */
-private class ServletWriterSourceToWritingMethodFlowConfig extends TaintTracking2::Configuration {
+class ServletWriterSourceToWritingMethodFlowConfig extends TaintTracking::Configuration {
   ServletWriterSourceToWritingMethodFlowConfig() {
     this = "XSS::ServletWriterSourceToWritingMethodFlowConfig"
   }
@@ -119,8 +91,7 @@ private class ServletWriterSourceToWritingMethodFlowConfig extends TaintTracking
   }
 }
 
-/** A method that can be used to output data to an output stream or writer. */
-private class WritingMethod extends Method {
+class WritingMethod extends Method {
   WritingMethod() {
     getDeclaringType().getASupertype*().hasQualifiedName("java.io", _) and
     (
@@ -132,7 +103,6 @@ private class WritingMethod extends Method {
   }
 }
 
-/** An output stream or writer that writes to a servlet response. */
 class ServletWriterSource extends MethodAccess {
   ServletWriterSource() {
     this.getMethod() instanceof ServletResponseGetWriterMethod

java/ql/test/query-tests/StringFormat/A.java

@@ -85,9 +85,4 @@ public class A {
     String.format("%s%s", a2); // ok
     String.format("%s", a2); // unused
   }
-
-  void formatted() {
-    "%s%s".formatted(""); // missing
-    "%s".formatted("", ""); // unused
-  }
 }

java/ql/test/query-tests/StringFormat/MissingFormatArg.expected

@@ -17,4 +17,3 @@
 | A.java:74:5:74:47 | format(...) | This format call refers to 2 argument(s) but only supplies 1 argument(s). |
 | A.java:79:5:79:31 | format(...) | This format call refers to 3 argument(s) but only supplies 2 argument(s). |
 | A.java:84:5:84:31 | format(...) | This format call refers to 3 argument(s) but only supplies 2 argument(s). |
-| A.java:90:5:90:24 | formatted(...) | This format call refers to 2 argument(s) but only supplies 1 argument(s). |

java/ql/test/query-tests/StringFormat/UnusedFormatArg.expected

@@ -9,4 +9,3 @@
 | A.java:76:5:76:57 | format(...) | This format call refers to 2 argument(s) but supplies 3 argument(s). |
 | A.java:81:5:81:27 | format(...) | This format call refers to 1 argument(s) but supplies 2 argument(s). |
 | A.java:86:5:86:27 | format(...) | This format call refers to 1 argument(s) but supplies 2 argument(s). |
-| A.java:91:5:91:26 | formatted(...) | This format call refers to 1 argument(s) but supplies 2 argument(s). |

java/ql/test/query-tests/StringFormat/options

@@ -1 +0,0 @@
-//semmle-extractor-options: --javac-args --enable-preview -source 14 -target 14

java/ql/test/query-tests/security/CWE-079/semmle/tests/WebsocketXss.java

@@ -1,27 +0,0 @@
-// package test.cwe079.cwe.examples;
-
-// import java.net.http.HttpClient;
-// import java.net.http.WebSocket;
-// import java.net.URI;
-// import java.util.*;
-// import java.util.concurrent.*;
-
-// public class WebsocketXss {
-//     public static void main(String[] args) throws Exception {
-//         WebSocket.Listener listener = new WebSocket.Listener() {
-//             public CompletionStage<?> onText(WebSocket webSocket, CharSequence message, boolean last) {
-//                 try {
-//                     HttpClient client = HttpClient.newBuilder().build();
-//                     CompletableFuture<WebSocket> ws = client.newWebSocketBuilder()
-//                             .buildAsync(URI.create("ws://websocket.example.com"), null);
-//                     ws.get().sendText(message, false);
-//                 } catch (Exception e) {
-//                     // TODO: handle exception
-//                 }
-
-//                 return null;
-//             };
-//         };
-
-//     }
-// }

javascript/extractor/lib/typescript/package.json

@@ -2,7 +2,7 @@
     "name": "typescript-parser-wrapper",
     "private": true,
     "dependencies": {
-        "typescript": "4.0.2"
+        "typescript": "3.9.2"
     },
     "scripts": {
         "build": "tsc --project tsconfig.json",

javascript/extractor/lib/typescript/yarn.lock

@@ -225,9 +225,9 @@ tsutils@^2.12.1:
   dependencies:
     tslib "^1.8.1"
 
-typescript@4.0.2:
-  version "4.0.2"
-  resolved "https://registry.yarnpkg.com/typescript/-/typescript-4.0.2.tgz#7ea7c88777c723c681e33bf7988be5d008d05ac2"
+typescript@3.9.2:
+  version "3.9.2"
+  resolved typescript-3.9.2.tgz#64e9c8e9be6ea583c54607677dd4680a1cf35db9
 
 wrappy@1:
   version "1.0.2"

javascript/extractor/src/com/semmle/js/ast/NodeCopier.java

@@ -711,7 +711,7 @@ public class NodeCopier implements Visitor<Void, INode> {
 
   @Override
   public INode visit(TupleTypeExpr nd, Void c) {
-    return new TupleTypeExpr(visit(nd.getLoc()), copy(nd.getElementTypes()), copy(nd.getElementNames()));
+    return new TupleTypeExpr(visit(nd.getLoc()), copy(nd.getElementTypes()));
   }
 
   @Override

javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java

@@ -1830,10 +1830,6 @@ public class ASTExtractor {
     @Override
     public Label visit(TupleTypeExpr nd, Context c) {
       Label key = super.visit(nd, c);
-      if (nd.getElementNames() != null) {
-        // Element names are index -1, -2, -3...
-        visitAll(nd.getElementNames(), key, IdContext.typeLabel, -1, -1);
-      }
       visitAll(nd.getElementTypes(), key, IdContext.typeBind, 0);
       return key;
     }

javascript/extractor/src/com/semmle/js/extractor/CFGExtractor.java

@@ -1551,27 +1551,8 @@ public class CFGExtractor {
 
     @Override
     public Void visit(AssignmentExpression nd, SuccessorInfo i) {
-      // `a &&= b` expands to `a || (a = b);`
-      // The CFG is a conditional assignment, so we go through the assignment `nd` last.
-      if ("&&=".equals(nd.getOperator()) || "||=".equals(nd.getOperator()) || "??=".equals(nd.getOperator())) {
-        if ("&&=".equals(nd.getOperator())) {
-          // from lhs to rhs on truthy. from lhs to false-branch on falsy.
-          visit(nd.getLeft(), First.of(nd.getRight()), i.getSuccessors(false));
-        } else if ("||=".equals(nd.getOperator())) {
-          // from lhs to true-branch on truthy. from lhs to rhs on falsy.
-          visit(nd.getLeft(), i.getSuccessors(true), First.of(nd.getRight()));
-        } else { // "??="
-          // the union of the above - truthyness is unknown.
-          visit(nd.getLeft(), union(First.of(nd.getRight()), i.getAllSuccessors()), null);
-        }
-        
-        visit(nd.getRight(), First.of(nd), null); // from right to assignment.
-
-        succ(nd, i.getGuardedSuccessors(nd));
-      } else {
-        visitAssign(nd, nd.getLeft(), nd.getRight());
-        succ(nd, i.getGuardedSuccessors(nd));
-      }
+      visitAssign(nd, nd.getLeft(), nd.getRight());
+      succ(nd, i.getGuardedSuccessors(nd));
       return null;
     }
 

javascript/extractor/src/com/semmle/js/extractor/ExprKinds.java

@@ -79,9 +79,6 @@ public class ExprKinds {
     binOpKinds.put("**", 87);
     binOpKinds.put("**=", 88);
     binOpKinds.put("??", 107);
-    binOpKinds.put("&&=", 116);
-    binOpKinds.put("||=", 117);
-    binOpKinds.put("??=", 118);
   }
 
   private static final Map<String, Integer> unOpKinds = new LinkedHashMap<String, Integer>();

javascript/extractor/src/com/semmle/js/parser/TypeScriptASTConverter.java

@@ -5,7 +5,6 @@ import java.util.Collections;
 import java.util.List;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
-import java.util.stream.Collectors;
 
 import com.google.gson.JsonArray;
 import com.google.gson.JsonElement;
@@ -587,8 +586,6 @@ public class TypeScriptASTConverter {
         return convertTryStatement(node, loc);
       case "TupleType":
         return convertTupleType(node, loc);
-      case "NamedTupleMember": 
-        return convertNamedTupleMember(node, loc);
       case "TypeAliasDeclaration":
         return convertTypeAliasDeclaration(node, loc);
       case "TypeAssertionExpression":
@@ -853,9 +850,6 @@ public class TypeScriptASTConverter {
       case ">>=":
       case "<<=":
       case ">>>=":
-      case "??=":
-      case "&&=":
-      case "||=":
         return new AssignmentExpression(loc, operator, convertLValue(left), right);
 
       default:
@@ -2184,22 +2178,7 @@ public class TypeScriptASTConverter {
   }
 
   private Node convertTupleType(JsonObject node, SourceLocation loc) throws ParseError {
-    List<Identifier> names = new ArrayList<>();
-
-    for (JsonElement element : node.get("elements").getAsJsonArray()) {
-      Identifier id = null;
-      if (getKind(element).equals("NamedTupleMember")) {
-        id = (Identifier)convertNode(element.getAsJsonObject().get("name").getAsJsonObject());
-      }
-      names.add(id);
-    }
-
-    return new TupleTypeExpr(loc, convertChildrenAsTypes(node, "elements"), names);
-  }
-
-  // This method just does a trivial forward to the type. The names have already been extracted in `convertTupleType`.
-  private Node convertNamedTupleMember(JsonObject node, SourceLocation loc) throws ParseError {
-    return convertChild(node, "type");
+    return new TupleTypeExpr(loc, convertChildrenAsTypes(node, "elementTypes"));
   }
 
   private Node convertTypeAliasDeclaration(JsonObject node, SourceLocation loc) throws ParseError {

javascript/extractor/src/com/semmle/ts/ast/TupleTypeExpr.java

@@ -1,6 +1,5 @@
 package com.semmle.ts.ast;
 
-import com.semmle.js.ast.Identifier;
 import com.semmle.js.ast.SourceLocation;
 import com.semmle.js.ast.Visitor;
 import java.util.List;
@@ -8,22 +7,16 @@ import java.util.List;
 /** A tuple type, such as <tt>[number, string]</tt>. */
 public class TupleTypeExpr extends TypeExpression {
   private final List<ITypeExpression> elementTypes;
-  private final List<Identifier> elementNames;
 
-  public TupleTypeExpr(SourceLocation loc, List<ITypeExpression> elementTypes, List<Identifier> elementNames) {
+  public TupleTypeExpr(SourceLocation loc, List<ITypeExpression> elementTypes) {
     super("TupleTypeExpr", loc);
     this.elementTypes = elementTypes;
-    this.elementNames = elementNames;
   }
 
   public List<ITypeExpression> getElementTypes() {
     return elementTypes;
   }
 
-  public List<Identifier> getElementNames() {
-    return elementNames;
-  }
-
   @Override
   public <C, R> R accept(Visitor<C, R> v, C c) {
     return v.visit(this, c);

javascript/ql/src/semmle/javascript/Expr.qll

@@ -1851,8 +1851,7 @@ class AssignExpr extends @assignexpr, Assignment {
 private class TCompoundAssignExpr =
   @assignaddexpr or @assignsubexpr or @assignmulexpr or @assigndivexpr or @assignmodexpr or
       @assignexpexpr or @assignlshiftexpr or @assignrshiftexpr or @assignurshiftexpr or
-      @assignorexpr or @assignxorexpr or @assignandexpr or @assignlogandexpr or @assignlogorexpr or
-      @assignnullishcoalescingexpr;
+      @assignorexpr or @assignxorexpr or @assignandexpr;
 
 /**
  * A compound assign expression.
@@ -1998,39 +1997,6 @@ class AssignXOrExpr extends @assignxorexpr, CompoundAssignExpr { }
  */
 class AssignAndExpr extends @assignandexpr, CompoundAssignExpr { }
 
-/**
- * A logical-'or'-assign expression.
- *
- * Example:
- *
- * ```
- * x ||= y
- * ```
- */
-class AssignLogOrExpr extends @assignlogandexpr, CompoundAssignExpr { }
-
-/**
- * A logical-'and'-assign expression.
- *
- * Example:
- *
- * ```
- * x &&= y
- * ```
- */
-class AssignLogAndExpr extends @assignlogorexpr, CompoundAssignExpr { }
-
-/**
- * A 'nullish-coalescing'-assign expression.
- *
- * Example:
- *
- * ```
- * x ??= y
- * ```
- */
-class AssignNullishCoalescingExpr extends @assignnullishcoalescingexpr, CompoundAssignExpr { }
-
 /**
  * An update expression, that is, an increment or decrement expression.
  *

javascript/ql/src/semmle/javascript/Promises.qll

@@ -249,7 +249,7 @@ private class PromiseStep extends PreCallGraphStep {
  * This module defines how data-flow propagates into and out of a Promise.
  * The data-flow is based on pseudo-properties rather than tainting the Promise object (which is what `PromiseTaintStep` does).
  */
-module PromiseFlow {
+private module PromiseFlow {
   private predicate valueProp = Promises::valueProp/0;
 
   private predicate errorProp = Promises::errorProp/0;

javascript/ql/src/semmle/javascript/TypeScript.qll

@@ -856,22 +856,13 @@ class ParenthesizedTypeExpr extends @parenthesizedtypeexpr, TypeExpr {
  */
 class TupleTypeExpr extends @tupletypeexpr, TypeExpr {
   /** Gets the `n`th element type in the tuple, starting at 0. */
-  TypeExpr getElementType(int n) { result = getChildTypeExpr(n) and n >= 0 }
+  TypeExpr getElementType(int n) { result = getChildTypeExpr(n) }
 
   /** Gets any of the element types in the tuple. */
   TypeExpr getAnElementType() { result = getElementType(_) }
 
   /** Gets the number of elements in the tuple type. */
   int getNumElementType() { result = count(getAnElementType()) }
-
-  /**
-   * Gets the name of the `n`th tuple member, starting at 0.
-   * Only has a result if the tuple members are named.
-   */
-  Identifier getElementName(int n) {
-    // Type element names are at indices -1, -2, -3, ...
-    result = getChild(-(n + 1)) and n >= 0
-  }
 }
 
 /**

javascript/ql/src/semmlecode.javascript.dbscheme

@@ -351,9 +351,6 @@ case @expr.kind of
 | 113 = @e4x_xml_dynamic_qualident
 | 114 = @e4x_xml_dotdotexpr
 | 115 = @importmetaexpr
-| 116 = @assignlogandexpr
-| 117 = @assignlogorexpr
-| 118 = @assignnullishcoalescingexpr
 ;
 
 @varaccess = @proper_varaccess | @export_varaccess;
@@ -375,7 +372,7 @@ case @expr.kind of
 
 @binaryexpr = @comparison | @lshiftexpr | @rshiftexpr | @urshiftexpr | @addexpr | @subexpr | @mulexpr | @divexpr | @modexpr | @expexpr | @bitorexpr | @xorexpr | @bitandexpr | @inexpr | @instanceofexpr | @logandexpr | @logorexpr | @nullishcoalescingexpr;
 
-@assignment = @assignexpr | @assignaddexpr | @assignsubexpr | @assignmulexpr | @assigndivexpr | @assignmodexpr | @assignexpexpr | @assignlshiftexpr | @assignrshiftexpr | @assignurshiftexpr | @assignorexpr | @assignxorexpr | @assignandexpr | @assignlogandexpr | @assignlogorexpr | @assignnullishcoalescingexpr;
+@assignment = @assignexpr | @assignaddexpr | @assignsubexpr | @assignmulexpr | @assigndivexpr | @assignmodexpr | @assignexpexpr | @assignlshiftexpr | @assignrshiftexpr | @assignurshiftexpr | @assignorexpr | @assignxorexpr | @assignandexpr;
 
 @updateexpr = @preincexpr | @postincexpr | @predecexpr | @postdecexpr;
 

javascript/ql/src/semmlecode.javascript.dbscheme.stats

@@ -422,18 +422,6 @@
 <v>222</v>
 </e>
 <e>
-<k>@assignlogandexpr</k>
-<v>1</v>
-</e>
-<e>
-<k>@assignlogorexpr</k>
-<v>1</v>
-</e>
-<e>
-<k>@assignnullishcoalescingexpr</k>
-<v>1</v>
-</e>
-<e>
 <k>@preincexpr</k>
 <v>1792</v>
 </e>

javascript/ql/test/library-tests/Expr/assignment2.ts

@@ -1,9 +0,0 @@
-let a = 2;
-let b = 3;
-
-a = 23;
-a += 19;
-
-a &&= 4;
-a ||= 5;
-a ??= 6;

javascript/ql/test/library-tests/Expr/tests.expected

@@ -1,25 +1,4 @@
 test_getParent
-| assignment2.ts:1:5:1:5 | a | assignment2.ts:1:5:1:9 | a = 2 |
-| assignment2.ts:1:5:1:9 | a = 2 | assignment2.ts:1:1:1:10 | let a = 2; |
-| assignment2.ts:1:9:1:9 | 2 | assignment2.ts:1:5:1:9 | a = 2 |
-| assignment2.ts:2:5:2:5 | b | assignment2.ts:2:5:2:9 | b = 3 |
-| assignment2.ts:2:5:2:9 | b = 3 | assignment2.ts:2:1:2:10 | let b = 3; |
-| assignment2.ts:2:9:2:9 | 3 | assignment2.ts:2:5:2:9 | b = 3 |
-| assignment2.ts:4:1:4:1 | a | assignment2.ts:4:1:4:6 | a = 23 |
-| assignment2.ts:4:1:4:6 | a = 23 | assignment2.ts:4:1:4:7 | a = 23; |
-| assignment2.ts:4:5:4:6 | 23 | assignment2.ts:4:1:4:6 | a = 23 |
-| assignment2.ts:5:1:5:1 | a | assignment2.ts:5:1:5:7 | a += 19 |
-| assignment2.ts:5:1:5:7 | a += 19 | assignment2.ts:5:1:5:8 | a += 19; |
-| assignment2.ts:5:6:5:7 | 19 | assignment2.ts:5:1:5:7 | a += 19 |
-| assignment2.ts:7:1:7:1 | a | assignment2.ts:7:1:7:7 | a &&= 4 |
-| assignment2.ts:7:1:7:7 | a &&= 4 | assignment2.ts:7:1:7:8 | a &&= 4; |
-| assignment2.ts:7:7:7:7 | 4 | assignment2.ts:7:1:7:7 | a &&= 4 |
-| assignment2.ts:8:1:8:1 | a | assignment2.ts:8:1:8:7 | a \|\|= 5 |
-| assignment2.ts:8:1:8:7 | a \|\|= 5 | assignment2.ts:8:1:8:8 | a \|\|= 5; |
-| assignment2.ts:8:7:8:7 | 5 | assignment2.ts:8:1:8:7 | a \|\|= 5 |
-| assignment2.ts:9:1:9:1 | a | assignment2.ts:9:1:9:7 | a ??= 6 |
-| assignment2.ts:9:1:9:7 | a ??= 6 | assignment2.ts:9:1:9:8 | a ??= 6; |
-| assignment2.ts:9:7:9:7 | 6 | assignment2.ts:9:1:9:7 | a ??= 6 |
 | assignment.js:1:1:1:1 | a | assignment.js:1:1:1:6 | a = 23 |
 | assignment.js:1:1:1:6 | a = 23 | assignment.js:1:1:1:7 | a = 23; |
 | assignment.js:1:5:1:6 | 23 | assignment.js:1:1:1:6 | a = 23 |
@@ -489,27 +468,6 @@ test_getParent
 | update.js:4:1:4:1 | b | update.js:4:1:4:3 | b-- |
 | update.js:4:1:4:3 | b-- | update.js:4:1:4:4 | b--; |
 test_getTopLevel
-| assignment2.ts:1:5:1:5 | a | assignment2.ts:1:1:9:8 | <toplevel> |
-| assignment2.ts:1:5:1:9 | a = 2 | assignment2.ts:1:1:9:8 | <toplevel> |
-| assignment2.ts:1:9:1:9 | 2 | assignment2.ts:1:1:9:8 | <toplevel> |
-| assignment2.ts:2:5:2:5 | b | assignment2.ts:1:1:9:8 | <toplevel> |
-| assignment2.ts:2:5:2:9 | b = 3 | assignment2.ts:1:1:9:8 | <toplevel> |
-| assignment2.ts:2:9:2:9 | 3 | assignment2.ts:1:1:9:8 | <toplevel> |
-| assignment2.ts:4:1:4:1 | a | assignment2.ts:1:1:9:8 | <toplevel> |
-| assignment2.ts:4:1:4:6 | a = 23 | assignment2.ts:1:1:9:8 | <toplevel> |
-| assignment2.ts:4:5:4:6 | 23 | assignment2.ts:1:1:9:8 | <toplevel> |
-| assignment2.ts:5:1:5:1 | a | assignment2.ts:1:1:9:8 | <toplevel> |
-| assignment2.ts:5:1:5:7 | a += 19 | assignment2.ts:1:1:9:8 | <toplevel> |
-| assignment2.ts:5:6:5:7 | 19 | assignment2.ts:1:1:9:8 | <toplevel> |
-| assignment2.ts:7:1:7:1 | a | assignment2.ts:1:1:9:8 | <toplevel> |
-| assignment2.ts:7:1:7:7 | a &&= 4 | assignment2.ts:1:1:9:8 | <toplevel> |
-| assignment2.ts:7:7:7:7 | 4 | assignment2.ts:1:1:9:8 | <toplevel> |
-| assignment2.ts:8:1:8:1 | a | assignment2.ts:1:1:9:8 | <toplevel> |
-| assignment2.ts:8:1:8:7 | a \|\|= 5 | assignment2.ts:1:1:9:8 | <toplevel> |
-| assignment2.ts:8:7:8:7 | 5 | assignment2.ts:1:1:9:8 | <toplevel> |
-| assignment2.ts:9:1:9:1 | a | assignment2.ts:1:1:9:8 | <toplevel> |
-| assignment2.ts:9:1:9:7 | a ??= 6 | assignment2.ts:1:1:9:8 | <toplevel> |
-| assignment2.ts:9:7:9:7 | 6 | assignment2.ts:1:1:9:8 | <toplevel> |
 | assignment.js:1:1:1:1 | a | assignment.js:1:1:12:7 | <toplevel> |
 | assignment.js:1:1:1:6 | a = 23 | assignment.js:1:1:12:7 | <toplevel> |
 | assignment.js:1:5:1:6 | 23 | assignment.js:1:1:12:7 | <toplevel> |
@@ -979,20 +937,6 @@ test_getTopLevel
 | update.js:4:1:4:1 | b | update.js:1:1:5:0 | <toplevel> |
 | update.js:4:1:4:3 | b-- | update.js:1:1:5:0 | <toplevel> |
 test_getChild
-| assignment2.ts:1:5:1:9 | a = 2 | 0 | assignment2.ts:1:5:1:5 | a |
-| assignment2.ts:1:5:1:9 | a = 2 | 1 | assignment2.ts:1:9:1:9 | 2 |
-| assignment2.ts:2:5:2:9 | b = 3 | 0 | assignment2.ts:2:5:2:5 | b |
-| assignment2.ts:2:5:2:9 | b = 3 | 1 | assignment2.ts:2:9:2:9 | 3 |
-| assignment2.ts:4:1:4:6 | a = 23 | 0 | assignment2.ts:4:1:4:1 | a |
-| assignment2.ts:4:1:4:6 | a = 23 | 1 | assignment2.ts:4:5:4:6 | 23 |
-| assignment2.ts:5:1:5:7 | a += 19 | 0 | assignment2.ts:5:1:5:1 | a |
-| assignment2.ts:5:1:5:7 | a += 19 | 1 | assignment2.ts:5:6:5:7 | 19 |
-| assignment2.ts:7:1:7:7 | a &&= 4 | 0 | assignment2.ts:7:1:7:1 | a |
-| assignment2.ts:7:1:7:7 | a &&= 4 | 1 | assignment2.ts:7:7:7:7 | 4 |
-| assignment2.ts:8:1:8:7 | a \|\|= 5 | 0 | assignment2.ts:8:1:8:1 | a |
-| assignment2.ts:8:1:8:7 | a \|\|= 5 | 1 | assignment2.ts:8:7:8:7 | 5 |
-| assignment2.ts:9:1:9:7 | a ??= 6 | 0 | assignment2.ts:9:1:9:1 | a |
-| assignment2.ts:9:1:9:7 | a ??= 6 | 1 | assignment2.ts:9:7:9:7 | 6 |
 | assignment.js:1:1:1:6 | a = 23 | 0 | assignment.js:1:1:1:1 | a |
 | assignment.js:1:1:1:6 | a = 23 | 1 | assignment.js:1:5:1:6 | 23 |
 | assignment.js:2:1:2:7 | a += 19 | 0 | assignment.js:2:1:2:1 | a |
@@ -1269,20 +1213,6 @@ test_getChild
 | update.js:3:1:3:3 | --b | 0 | update.js:3:3:3:3 | b |
 | update.js:4:1:4:3 | b-- | 0 | update.js:4:1:4:1 | b |
 test_isPure
-| assignment2.ts:1:5:1:5 | a |
-| assignment2.ts:1:9:1:9 | 2 |
-| assignment2.ts:2:5:2:5 | b |
-| assignment2.ts:2:9:2:9 | 3 |
-| assignment2.ts:4:1:4:1 | a |
-| assignment2.ts:4:5:4:6 | 23 |
-| assignment2.ts:5:1:5:1 | a |
-| assignment2.ts:5:6:5:7 | 19 |
-| assignment2.ts:7:1:7:1 | a |
-| assignment2.ts:7:7:7:7 | 4 |
-| assignment2.ts:8:1:8:1 | a |
-| assignment2.ts:8:7:8:7 | 5 |
-| assignment2.ts:9:1:9:1 | a |
-| assignment2.ts:9:7:9:7 | 6 |
 | assignment.js:1:1:1:1 | a |
 | assignment.js:1:5:1:6 | 23 |
 | assignment.js:2:1:2:1 | a |
@@ -1778,27 +1708,6 @@ test_stripParens
 | primaries.js:28:2:28:5 | (42) | primaries.js:28:3:28:4 | 42 |
 | unary.js:6:5:6:7 | (0) | unary.js:6:6:6:6 | 0 |
 test_getContainer
-| assignment2.ts:1:5:1:5 | a | assignment2.ts:1:1:9:8 | <toplevel> |
-| assignment2.ts:1:5:1:9 | a = 2 | assignment2.ts:1:1:9:8 | <toplevel> |
-| assignment2.ts:1:9:1:9 | 2 | assignment2.ts:1:1:9:8 | <toplevel> |
-| assignment2.ts:2:5:2:5 | b | assignment2.ts:1:1:9:8 | <toplevel> |
-| assignment2.ts:2:5:2:9 | b = 3 | assignment2.ts:1:1:9:8 | <toplevel> |
-| assignment2.ts:2:9:2:9 | 3 | assignment2.ts:1:1:9:8 | <toplevel> |
-| assignment2.ts:4:1:4:1 | a | assignment2.ts:1:1:9:8 | <toplevel> |
-| assignment2.ts:4:1:4:6 | a = 23 | assignment2.ts:1:1:9:8 | <toplevel> |
-| assignment2.ts:4:5:4:6 | 23 | assignment2.ts:1:1:9:8 | <toplevel> |
-| assignment2.ts:5:1:5:1 | a | assignment2.ts:1:1:9:8 | <toplevel> |
-| assignment2.ts:5:1:5:7 | a += 19 | assignment2.ts:1:1:9:8 | <toplevel> |
-| assignment2.ts:5:6:5:7 | 19 | assignment2.ts:1:1:9:8 | <toplevel> |
-| assignment2.ts:7:1:7:1 | a | assignment2.ts:1:1:9:8 | <toplevel> |
-| assignment2.ts:7:1:7:7 | a &&= 4 | assignment2.ts:1:1:9:8 | <toplevel> |
-| assignment2.ts:7:7:7:7 | 4 | assignment2.ts:1:1:9:8 | <toplevel> |
-| assignment2.ts:8:1:8:1 | a | assignment2.ts:1:1:9:8 | <toplevel> |
-| assignment2.ts:8:1:8:7 | a \|\|= 5 | assignment2.ts:1:1:9:8 | <toplevel> |
-| assignment2.ts:8:7:8:7 | 5 | assignment2.ts:1:1:9:8 | <toplevel> |
-| assignment2.ts:9:1:9:1 | a | assignment2.ts:1:1:9:8 | <toplevel> |
-| assignment2.ts:9:1:9:7 | a ??= 6 | assignment2.ts:1:1:9:8 | <toplevel> |
-| assignment2.ts:9:7:9:7 | 6 | assignment2.ts:1:1:9:8 | <toplevel> |
 | assignment.js:1:1:1:1 | a | assignment.js:1:1:12:7 | <toplevel> |
 | assignment.js:1:1:1:6 | a = 23 | assignment.js:1:1:12:7 | <toplevel> |
 | assignment.js:1:5:1:6 | 23 | assignment.js:1:1:12:7 | <toplevel> |
@@ -2268,27 +2177,6 @@ test_getContainer
 | update.js:4:1:4:1 | b | update.js:1:1:5:0 | <toplevel> |
 | update.js:4:1:4:3 | b-- | update.js:1:1:5:0 | <toplevel> |
 test_getEnclosingStmt
-| assignment2.ts:1:5:1:5 | a | assignment2.ts:1:1:1:10 | let a = 2; |
-| assignment2.ts:1:5:1:9 | a = 2 | assignment2.ts:1:1:1:10 | let a = 2; |
-| assignment2.ts:1:9:1:9 | 2 | assignment2.ts:1:1:1:10 | let a = 2; |
-| assignment2.ts:2:5:2:5 | b | assignment2.ts:2:1:2:10 | let b = 3; |
-| assignment2.ts:2:5:2:9 | b = 3 | assignment2.ts:2:1:2:10 | let b = 3; |
-| assignment2.ts:2:9:2:9 | 3 | assignment2.ts:2:1:2:10 | let b = 3; |
-| assignment2.ts:4:1:4:1 | a | assignment2.ts:4:1:4:7 | a = 23; |
-| assignment2.ts:4:1:4:6 | a = 23 | assignment2.ts:4:1:4:7 | a = 23; |
-| assignment2.ts:4:5:4:6 | 23 | assignment2.ts:4:1:4:7 | a = 23; |
-| assignment2.ts:5:1:5:1 | a | assignment2.ts:5:1:5:8 | a += 19; |
-| assignment2.ts:5:1:5:7 | a += 19 | assignment2.ts:5:1:5:8 | a += 19; |
-| assignment2.ts:5:6:5:7 | 19 | assignment2.ts:5:1:5:8 | a += 19; |
-| assignment2.ts:7:1:7:1 | a | assignment2.ts:7:1:7:8 | a &&= 4; |
-| assignment2.ts:7:1:7:7 | a &&= 4 | assignment2.ts:7:1:7:8 | a &&= 4; |
-| assignment2.ts:7:7:7:7 | 4 | assignment2.ts:7:1:7:8 | a &&= 4; |
-| assignment2.ts:8:1:8:1 | a | assignment2.ts:8:1:8:8 | a \|\|= 5; |
-| assignment2.ts:8:1:8:7 | a \|\|= 5 | assignment2.ts:8:1:8:8 | a \|\|= 5; |
-| assignment2.ts:8:7:8:7 | 5 | assignment2.ts:8:1:8:8 | a \|\|= 5; |
-| assignment2.ts:9:1:9:1 | a | assignment2.ts:9:1:9:8 | a ??= 6; |
-| assignment2.ts:9:1:9:7 | a ??= 6 | assignment2.ts:9:1:9:8 | a ??= 6; |
-| assignment2.ts:9:7:9:7 | 6 | assignment2.ts:9:1:9:8 | a ??= 6; |
 | assignment.js:1:1:1:1 | a | assignment.js:1:1:1:7 | a = 23; |
 | assignment.js:1:1:1:6 | a = 23 | assignment.js:1:1:1:7 | a = 23; |
 | assignment.js:1:5:1:6 | 23 | assignment.js:1:1:1:7 | a = 23; |
@@ -2724,14 +2612,6 @@ test_getEnclosingStmt
 | update.js:4:1:4:1 | b | update.js:4:1:4:4 | b--; |
 | update.js:4:1:4:3 | b-- | update.js:4:1:4:4 | b--; |
 test_inNullSensitiveContext
-| assignment2.ts:5:1:5:1 | a |
-| assignment2.ts:5:6:5:7 | 19 |
-| assignment2.ts:7:1:7:1 | a |
-| assignment2.ts:7:7:7:7 | 4 |
-| assignment2.ts:8:1:8:1 | a |
-| assignment2.ts:8:7:8:7 | 5 |
-| assignment2.ts:9:1:9:1 | a |
-| assignment2.ts:9:7:9:7 | 6 |
 | assignment.js:2:1:2:1 | a |
 | assignment.js:2:6:2:7 | 19 |
 | assignment.js:3:1:3:1 | a |

javascript/ql/test/library-tests/TypeScript/TypeAnnotations/TupleTypeExpr.qll

@@ -3,7 +3,3 @@ import javascript
 query predicate test_TupleTypeExpr(TupleTypeExpr type, int n, int res0, TypeExpr res1) {
   res0 = type.getNumElementType() and res1 = type.getElementType(n)
 }
-
-query predicate test_TupleTypeElementName(TupleTypeExpr type, int n, Identifier name) {
-  name = type.getElementName(n)
-}

javascript/ql/test/library-tests/TypeScript/TypeAnnotations/tests.expected

@@ -108,15 +108,6 @@ test_VariableTypes
 | tst.ts:142:17:142:25 | condition | condition | tst.ts:142:28:142:30 | any |
 | tst.ts:142:33:142:35 | msg | msg | tst.ts:142:39:142:44 | string |
 | tst.ts:148:25:148:27 | val | val | tst.ts:148:30:148:32 | any |
-| tst.ts:157:32:157:34 | arr | arr | tst.ts:157:37:157:56 | readonly [any, ...T] |
-| tst.ts:164:47:164:50 | arr1 | arr1 | tst.ts:164:53:164:53 | T |
-| tst.ts:164:56:164:59 | arr2 | arr2 | tst.ts:164:62:164:62 | U |
-| tst.ts:169:31:169:31 | x | x | tst.ts:169:34:169:64 | [first: ... number] |
-| tst.ts:180:5:180:7 | foo | foo | tst.ts:180:10:180:21 | StrStrNumNum |
-| tst.ts:184:7:184:8 | a1 | a1 | tst.ts:184:12:184:17 | number |
-| tst.ts:185:7:185:8 | a2 | a2 | tst.ts:185:12:185:17 | number |
-| tst.ts:186:7:186:8 | a3 | a3 | tst.ts:186:12:186:17 | number |
-| tst.ts:192:18:192:18 | x | x | tst.ts:192:21:192:43 | [first: ... number] |
 test_QualifiedTypeAccess
 | tst.ts:63:19:63:21 | N.I | tst.ts:63:19:63:19 | N | tst.ts:63:21:63:21 | I |
 | tst.ts:64:20:64:24 | N.M.I | tst.ts:64:20:64:22 | N.M | tst.ts:64:24:64:24 | I |
@@ -207,27 +198,6 @@ test_TupleTypeExpr
 | tst.ts:136:39:136:68 | [number ... mber[]] | 0 | 3 | tst.ts:136:40:136:45 | number |
 | tst.ts:136:39:136:68 | [number ... mber[]] | 1 | 3 | tst.ts:136:48:136:54 | string? |
 | tst.ts:136:39:136:68 | [number ... mber[]] | 2 | 3 | tst.ts:136:57:136:67 | ...number[] |
-| tst.ts:157:46:157:56 | [any, ...T] | 0 | 2 | tst.ts:157:47:157:49 | any |
-| tst.ts:157:46:157:56 | [any, ...T] | 1 | 2 | tst.ts:157:52:157:55 | ...T |
-| tst.ts:164:66:164:77 | [...T, ...U] | 0 | 2 | tst.ts:164:67:164:70 | ...T |
-| tst.ts:164:66:164:77 | [...T, ...U] | 1 | 2 | tst.ts:164:73:164:76 | ...U |
-| tst.ts:169:34:169:64 | [first: ... number] | 0 | 2 | tst.ts:169:42:169:47 | number |
-| tst.ts:169:34:169:64 | [first: ... number] | 1 | 2 | tst.ts:169:58:169:63 | number |
-| tst.ts:175:16:175:31 | [string, string] | 0 | 2 | tst.ts:175:17:175:22 | string |
-| tst.ts:175:16:175:31 | [string, string] | 1 | 2 | tst.ts:175:25:175:30 | string |
-| tst.ts:176:16:176:31 | [number, number] | 0 | 2 | tst.ts:176:17:176:22 | number |
-| tst.ts:176:16:176:31 | [number, number] | 1 | 2 | tst.ts:176:25:176:30 | number |
-| tst.ts:179:21:179:44 | [...Str ... umbers] | 0 | 2 | tst.ts:179:22:179:31 | ...Strings |
-| tst.ts:179:21:179:44 | [...Str ... umbers] | 1 | 2 | tst.ts:179:34:179:43 | ...Numbers |
-| tst.ts:192:21:192:43 | [first: ... number] | 0 | 2 | tst.ts:192:29:192:34 | number |
-| tst.ts:192:21:192:43 | [first: ... number] | 1 | 2 | tst.ts:192:37:192:42 | number |
-| tst.ts:192:47:192:70 | [number ... number] | 0 | 2 | tst.ts:192:48:192:53 | number |
-| tst.ts:192:47:192:70 | [number ... number] | 1 | 2 | tst.ts:192:64:192:69 | number |
-test_TupleTypeElementName
-| tst.ts:169:34:169:64 | [first: ... number] | 0 | tst.ts:169:35:169:39 | first |
-| tst.ts:169:34:169:64 | [first: ... number] | 1 | tst.ts:169:50:169:55 | second |
-| tst.ts:192:21:192:43 | [first: ... number] | 0 | tst.ts:192:22:192:26 | first |
-| tst.ts:192:47:192:70 | [number ... number] | 1 | tst.ts:192:56:192:61 | second |
 test_FieldTypes
 | tst.ts:15:3:15:22 | numberField: number; | tst.ts:15:16:15:21 | number |
 | tst.ts:16:3:16:22 | stringField: string; | tst.ts:16:16:16:21 | string |
@@ -249,8 +219,6 @@ test_ArrayTypeExpr
 | tst.ts:81:27:81:34 | string[] | tst.ts:81:27:81:32 | string |
 | tst.ts:135:39:135:46 | string[] | tst.ts:135:39:135:44 | string |
 | tst.ts:136:60:136:67 | number[] | tst.ts:136:60:136:65 | number |
-| tst.ts:157:25:157:29 | any[] | tst.ts:157:25:157:27 | any |
-| tst.ts:163:21:163:25 | any[] | tst.ts:163:21:163:23 | any |
 test_TypeAccessHelpers
 | tst.ts:65:18:65:24 | Generic | 1 | 0 | tst.ts:65:26:65:31 | number |
 | tst.ts:66:18:66:32 | N.InnerGeneric1 | 1 | 0 | tst.ts:66:34:66:39 | number |
@@ -302,9 +270,6 @@ test_ReturnTypes
 | tst.ts:96:1:96:52 | functio ... rn x; } | function f3 | tst.ts:96:38:96:38 | S |
 | tst.ts:142:1:146:1 | functio ... )\\n  }\\n} | function assert | tst.ts:142:48:142:64 | asserts condition |
 | tst.ts:148:1:152:1 | functio ... ;\\n  }\\n} | function assertIsString | tst.ts:148:36:148:56 | asserts ...  string |
-| tst.ts:164:1:166:1 | functio ... rr2];\\n} | function concat | tst.ts:164:66:164:77 | [...T, ...U] |
-| tst.ts:169:1:172:1 | functio ...  + b;\\n} | function labelOnTupleElements | tst.ts:169:68:169:73 | number |
-| tst.ts:192:1:194:1 | functio ... rn x;\\n} | function weirdId | tst.ts:192:47:192:70 | [number ... number] |
 test_KeyofTypeExpr
 | tst.ts:49:16:49:30 | keyof Interface | tst.ts:49:22:49:30 | Interface |
 | tst.ts:113:26:113:35 | keyof Node | tst.ts:113:32:113:35 | Node |

javascript/ql/test/library-tests/TypeScript/TypeAnnotations/tst.ts

@@ -150,45 +150,3 @@ function assertIsString(val: any): asserts val is string {
       throw new AssertionError("Not a string!");
   }
 }
-
-// TypeScript 4.0
- 
-// spreads in tuple type syntax can now be generic
-function tail<T extends any[]>(arr: readonly [any, ...T]) {
-    const [_ignored, ...rest] = arr;
-    return rest;
-}
-
-// spread in tuple in non-last position
-type Arr = readonly any[];
-function concat<T extends Arr, U extends Arr>(arr1: T, arr2: U): [...T, ...U] {
-    return [...arr1, ...arr2];
-}
-
-// labelled tuple elements
-function labelOnTupleElements(x: [first: number, second: number]): number {
-  let [a, b] = x;
-  return a + b;
-}
-
-// spread elements can occur anywhere in a tuple – not just at the end!
-type Strings = [string, string];
-type Numbers = [number, number];
-
-// [string, string, number, number]
-type StrStrNumNum = [...Strings, ...Numbers];
-var foo: StrStrNumNum;
-
-// Short-Circuiting Assignment Operators
-function shortAssignment() {
-  let a1 : number = parseInt("foo");
-  let a2 : number = parseInt("bar");
-  let a3 : number = a1 ||= a2;
-  let a4 = a2 &&= a3;
-  let a5 = a3 ??= a4;
-}
-
-// only label on some tuple elements (is a type-error)
-function weirdId(x: [first: number, number]): [number, second: number] {
-  return x;
-}

javascript/ql/test/library-tests/TypeScript/Types/GetExprType.expected

@@ -67,10 +67,12 @@
 | tst.ts:26:15:26:24 | () => void | () => void |
 | tst.ts:27:5:27:17 | undefinedType | undefined |
 | tst.ts:28:5:28:12 | nullType | null |
+| tst.ts:28:22:28:25 | null | null |
 | tst.ts:29:5:29:13 | neverType | () => never |
 | tst.ts:29:16:29:26 | () => never | () => never |
 | tst.ts:30:5:30:14 | symbolType | symbol |
 | tst.ts:31:7:31:22 | uniqueSymbolType | typeof uniqueSymbolType |
+| tst.ts:31:41:31:44 | null | null |
 | tst.ts:32:5:32:14 | objectType | object |
 | tst.ts:33:5:33:16 | intersection | string & { x: string; } |
 | tst.ts:33:29:33:29 | x | string |
@@ -90,13 +92,6 @@
 | tst.ts:43:26:43:48 | { foo:  ... s const | { readonly foo: "foo"; } |
 | tst.ts:43:28:43:30 | foo | "foo" |
 | tst.ts:43:33:43:37 | "foo" | "foo" |
-| tst.ts:47:8:47:8 | e | unknown |
-| tst.ts:48:7:48:14 | typeof e | "string" \| "number" \| "bigint" \| "boolean" \| "s... |
-| tst.ts:48:7:48:27 | typeof  ... string" | boolean |
-| tst.ts:48:14:48:14 | e | unknown |
-| tst.ts:48:20:48:27 | "string" | "string" |
-| tst.ts:49:11:49:11 | b | string |
-| tst.ts:49:24:49:24 | e | string |
 | type_alias.ts:3:5:3:5 | b | boolean |
 | type_alias.ts:7:5:7:5 | c | ValueOrArray<number> |
 | type_alias.ts:14:9:14:32 | [proper ... ]: Json | any |

javascript/ql/test/library-tests/TypeScript/Types/GetTypeExprType.expected

@@ -68,7 +68,6 @@
 | tst.ts:39:60:39:65 | number | number |
 | tst.ts:39:60:39:67 | number[] | number[] |
 | tst.ts:40:18:40:24 | unknown | unknown |
-| tst.ts:49:15:49:20 | string | string |
 | type_alias.ts:1:6:1:6 | B | boolean |
 | type_alias.ts:1:10:1:16 | boolean | boolean |
 | type_alias.ts:3:8:3:8 | B | boolean |

javascript/ql/test/library-tests/TypeScript/Types/UnknownType.expected

@@ -1,3 +1 @@
 | tst.ts:40:5:40:15 | unknownType | unknown |
-| tst.ts:47:8:47:8 | e | unknown |
-| tst.ts:48:14:48:14 | e | unknown |

javascript/ql/test/library-tests/TypeScript/Types/tst.ts

@@ -41,11 +41,3 @@ let unknownType: unknown;
 
 let constArrayLiteral = [1, 2] as const;
 let constObjectLiteral = { foo: "foo" } as const;
-
-
-try { }
-catch (e: unknown) {
-  if (typeof e === "string") {
-      let b : string = e;
-  }
-}

javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.expected

@@ -3048,239 +3048,6 @@ nodes
 | torrents.js:7:25:7:27 | loc |
 | torrents.js:7:25:7:27 | loc |
 | torrents.js:7:25:7:27 | loc |
-| typescript.ts:9:7:9:48 | path |
-| typescript.ts:9:7:9:48 | path |
-| typescript.ts:9:7:9:48 | path |
-| typescript.ts:9:7:9:48 | path |
-| typescript.ts:9:7:9:48 | path |
-| typescript.ts:9:7:9:48 | path |
-| typescript.ts:9:7:9:48 | path |
-| typescript.ts:9:7:9:48 | path |
-| typescript.ts:9:7:9:48 | path |
-| typescript.ts:9:7:9:48 | path |
-| typescript.ts:9:7:9:48 | path |
-| typescript.ts:9:7:9:48 | path |
-| typescript.ts:9:7:9:48 | path |
-| typescript.ts:9:7:9:48 | path |
-| typescript.ts:9:7:9:48 | path |
-| typescript.ts:9:7:9:48 | path |
-| typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:14:9:43 | url.par ... ).query |
-| typescript.ts:9:14:9:43 | url.par ... ).query |
-| typescript.ts:9:14:9:43 | url.par ... ).query |
-| typescript.ts:9:14:9:43 | url.par ... ).query |
-| typescript.ts:9:14:9:43 | url.par ... ).query |
-| typescript.ts:9:14:9:43 | url.par ... ).query |
-| typescript.ts:9:14:9:43 | url.par ... ).query |
-| typescript.ts:9:14:9:43 | url.par ... ).query |
-| typescript.ts:9:14:9:43 | url.par ... ).query |
-| typescript.ts:9:14:9:43 | url.par ... ).query |
-| typescript.ts:9:14:9:43 | url.par ... ).query |
-| typescript.ts:9:14:9:43 | url.par ... ).query |
-| typescript.ts:9:14:9:43 | url.par ... ).query |
-| typescript.ts:9:14:9:43 | url.par ... ).query |
-| typescript.ts:9:14:9:43 | url.par ... ).query |
-| typescript.ts:9:14:9:43 | url.par ... ).query |
-| typescript.ts:9:14:9:48 | url.par ... ry.path |
-| typescript.ts:9:14:9:48 | url.par ... ry.path |
-| typescript.ts:9:14:9:48 | url.par ... ry.path |
-| typescript.ts:9:14:9:48 | url.par ... ry.path |
-| typescript.ts:9:14:9:48 | url.par ... ry.path |
-| typescript.ts:9:14:9:48 | url.par ... ry.path |
-| typescript.ts:9:14:9:48 | url.par ... ry.path |
-| typescript.ts:9:14:9:48 | url.par ... ry.path |
-| typescript.ts:9:14:9:48 | url.par ... ry.path |
-| typescript.ts:9:14:9:48 | url.par ... ry.path |
-| typescript.ts:9:14:9:48 | url.par ... ry.path |
-| typescript.ts:9:14:9:48 | url.par ... ry.path |
-| typescript.ts:9:14:9:48 | url.par ... ry.path |
-| typescript.ts:9:14:9:48 | url.par ... ry.path |
-| typescript.ts:9:14:9:48 | url.par ... ry.path |
-| typescript.ts:9:14:9:48 | url.par ... ry.path |
-| typescript.ts:9:24:9:30 | req.url |
-| typescript.ts:9:24:9:30 | req.url |
-| typescript.ts:9:24:9:30 | req.url |
-| typescript.ts:9:24:9:30 | req.url |
-| typescript.ts:9:24:9:30 | req.url |
-| typescript.ts:12:29:12:32 | path |
-| typescript.ts:12:29:12:32 | path |
-| typescript.ts:12:29:12:32 | path |
-| typescript.ts:12:29:12:32 | path |
-| typescript.ts:12:29:12:32 | path |
-| typescript.ts:12:29:12:32 | path |
-| typescript.ts:12:29:12:32 | path |
-| typescript.ts:12:29:12:32 | path |
-| typescript.ts:12:29:12:32 | path |
-| typescript.ts:12:29:12:32 | path |
-| typescript.ts:12:29:12:32 | path |
-| typescript.ts:12:29:12:32 | path |
-| typescript.ts:12:29:12:32 | path |
-| typescript.ts:12:29:12:32 | path |
-| typescript.ts:12:29:12:32 | path |
-| typescript.ts:12:29:12:32 | path |
-| typescript.ts:12:29:12:32 | path |
-| typescript.ts:20:7:20:18 | path3 |
-| typescript.ts:20:7:20:18 | path3 |
-| typescript.ts:20:7:20:18 | path3 |
-| typescript.ts:20:7:20:18 | path3 |
-| typescript.ts:20:7:20:18 | path3 |
-| typescript.ts:20:7:20:18 | path3 |
-| typescript.ts:20:7:20:18 | path3 |
-| typescript.ts:20:7:20:18 | path3 |
-| typescript.ts:20:7:20:18 | path3 |
-| typescript.ts:20:7:20:18 | path3 |
-| typescript.ts:20:7:20:18 | path3 |
-| typescript.ts:20:7:20:18 | path3 |
-| typescript.ts:20:7:20:18 | path3 |
-| typescript.ts:20:7:20:18 | path3 |
-| typescript.ts:20:7:20:18 | path3 |
-| typescript.ts:20:7:20:18 | path3 |
-| typescript.ts:20:15:20:18 | path |
-| typescript.ts:20:15:20:18 | path |
-| typescript.ts:20:15:20:18 | path |
-| typescript.ts:20:15:20:18 | path |
-| typescript.ts:20:15:20:18 | path |
-| typescript.ts:20:15:20:18 | path |
-| typescript.ts:20:15:20:18 | path |
-| typescript.ts:20:15:20:18 | path |
-| typescript.ts:20:15:20:18 | path |
-| typescript.ts:20:15:20:18 | path |
-| typescript.ts:20:15:20:18 | path |
-| typescript.ts:20:15:20:18 | path |
-| typescript.ts:20:15:20:18 | path |
-| typescript.ts:20:15:20:18 | path |
-| typescript.ts:20:15:20:18 | path |
-| typescript.ts:20:15:20:18 | path |
-| typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:23:7:23:18 | path4 |
-| typescript.ts:23:7:23:18 | path4 |
-| typescript.ts:23:7:23:18 | path4 |
-| typescript.ts:23:7:23:18 | path4 |
-| typescript.ts:23:7:23:18 | path4 |
-| typescript.ts:23:7:23:18 | path4 |
-| typescript.ts:23:7:23:18 | path4 |
-| typescript.ts:23:7:23:18 | path4 |
-| typescript.ts:23:7:23:18 | path4 |
-| typescript.ts:23:7:23:18 | path4 |
-| typescript.ts:23:7:23:18 | path4 |
-| typescript.ts:23:7:23:18 | path4 |
-| typescript.ts:23:7:23:18 | path4 |
-| typescript.ts:23:7:23:18 | path4 |
-| typescript.ts:23:7:23:18 | path4 |
-| typescript.ts:23:7:23:18 | path4 |
-| typescript.ts:23:15:23:18 | path |
-| typescript.ts:23:15:23:18 | path |
-| typescript.ts:23:15:23:18 | path |
-| typescript.ts:23:15:23:18 | path |
-| typescript.ts:23:15:23:18 | path |
-| typescript.ts:23:15:23:18 | path |
-| typescript.ts:23:15:23:18 | path |
-| typescript.ts:23:15:23:18 | path |
-| typescript.ts:23:15:23:18 | path |
-| typescript.ts:23:15:23:18 | path |
-| typescript.ts:23:15:23:18 | path |
-| typescript.ts:23:15:23:18 | path |
-| typescript.ts:23:15:23:18 | path |
-| typescript.ts:23:15:23:18 | path |
-| typescript.ts:23:15:23:18 | path |
-| typescript.ts:23:15:23:18 | path |
-| typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:30:7:30:18 | path6 |
-| typescript.ts:30:7:30:18 | path6 |
-| typescript.ts:30:7:30:18 | path6 |
-| typescript.ts:30:7:30:18 | path6 |
-| typescript.ts:30:7:30:18 | path6 |
-| typescript.ts:30:7:30:18 | path6 |
-| typescript.ts:30:7:30:18 | path6 |
-| typescript.ts:30:7:30:18 | path6 |
-| typescript.ts:30:7:30:18 | path6 |
-| typescript.ts:30:7:30:18 | path6 |
-| typescript.ts:30:7:30:18 | path6 |
-| typescript.ts:30:7:30:18 | path6 |
-| typescript.ts:30:7:30:18 | path6 |
-| typescript.ts:30:7:30:18 | path6 |
-| typescript.ts:30:7:30:18 | path6 |
-| typescript.ts:30:7:30:18 | path6 |
-| typescript.ts:30:15:30:18 | path |
-| typescript.ts:30:15:30:18 | path |
-| typescript.ts:30:15:30:18 | path |
-| typescript.ts:30:15:30:18 | path |
-| typescript.ts:30:15:30:18 | path |
-| typescript.ts:30:15:30:18 | path |
-| typescript.ts:30:15:30:18 | path |
-| typescript.ts:30:15:30:18 | path |
-| typescript.ts:30:15:30:18 | path |
-| typescript.ts:30:15:30:18 | path |
-| typescript.ts:30:15:30:18 | path |
-| typescript.ts:30:15:30:18 | path |
-| typescript.ts:30:15:30:18 | path |
-| typescript.ts:30:15:30:18 | path |
-| typescript.ts:30:15:30:18 | path |
-| typescript.ts:30:15:30:18 | path |
-| typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:32:29:32:33 | path6 |
 | views.js:1:43:1:55 | req.params[0] |
 | views.js:1:43:1:55 | req.params[0] |
 | views.js:1:43:1:55 | req.params[0] |
@@ -7595,310 +7362,6 @@ edges
 | torrents.js:6:24:6:27 | name | torrents.js:6:12:6:45 | dir + " ... t.data" |
 | torrents.js:6:24:6:27 | name | torrents.js:6:12:6:45 | dir + " ... t.data" |
 | torrents.js:6:24:6:27 | name | torrents.js:6:12:6:45 | dir + " ... t.data" |
-| typescript.ts:9:7:9:48 | path | typescript.ts:12:29:12:32 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:12:29:12:32 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:12:29:12:32 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:12:29:12:32 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:12:29:12:32 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:12:29:12:32 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:12:29:12:32 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:12:29:12:32 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:12:29:12:32 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:12:29:12:32 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:12:29:12:32 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:12:29:12:32 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:12:29:12:32 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:12:29:12:32 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:12:29:12:32 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:12:29:12:32 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:12:29:12:32 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:12:29:12:32 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:12:29:12:32 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:12:29:12:32 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:12:29:12:32 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:12:29:12:32 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:12:29:12:32 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:12:29:12:32 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:12:29:12:32 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:12:29:12:32 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:12:29:12:32 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:12:29:12:32 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:12:29:12:32 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:12:29:12:32 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:12:29:12:32 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:12:29:12:32 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:20:15:20:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:20:15:20:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:20:15:20:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:20:15:20:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:20:15:20:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:20:15:20:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:20:15:20:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:20:15:20:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:20:15:20:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:20:15:20:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:20:15:20:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:20:15:20:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:20:15:20:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:20:15:20:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:20:15:20:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:20:15:20:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:23:15:23:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:23:15:23:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:23:15:23:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:23:15:23:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:23:15:23:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:23:15:23:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:23:15:23:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:23:15:23:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:23:15:23:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:23:15:23:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:23:15:23:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:23:15:23:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:23:15:23:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:23:15:23:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:23:15:23:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:23:15:23:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:30:15:30:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:30:15:30:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:30:15:30:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:30:15:30:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:30:15:30:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:30:15:30:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:30:15:30:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:30:15:30:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:30:15:30:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:30:15:30:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:30:15:30:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:30:15:30:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:30:15:30:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:30:15:30:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:30:15:30:18 | path |
-| typescript.ts:9:7:9:48 | path | typescript.ts:30:15:30:18 | path |
-| typescript.ts:9:14:9:37 | url.par ... , true) | typescript.ts:9:14:9:43 | url.par ... ).query |
-| typescript.ts:9:14:9:37 | url.par ... , true) | typescript.ts:9:14:9:43 | url.par ... ).query |
-| typescript.ts:9:14:9:37 | url.par ... , true) | typescript.ts:9:14:9:43 | url.par ... ).query |
-| typescript.ts:9:14:9:37 | url.par ... , true) | typescript.ts:9:14:9:43 | url.par ... ).query |
-| typescript.ts:9:14:9:37 | url.par ... , true) | typescript.ts:9:14:9:43 | url.par ... ).query |
-| typescript.ts:9:14:9:37 | url.par ... , true) | typescript.ts:9:14:9:43 | url.par ... ).query |
-| typescript.ts:9:14:9:37 | url.par ... , true) | typescript.ts:9:14:9:43 | url.par ... ).query |
-| typescript.ts:9:14:9:37 | url.par ... , true) | typescript.ts:9:14:9:43 | url.par ... ).query |
-| typescript.ts:9:14:9:37 | url.par ... , true) | typescript.ts:9:14:9:43 | url.par ... ).query |
-| typescript.ts:9:14:9:37 | url.par ... , true) | typescript.ts:9:14:9:43 | url.par ... ).query |
-| typescript.ts:9:14:9:37 | url.par ... , true) | typescript.ts:9:14:9:43 | url.par ... ).query |
-| typescript.ts:9:14:9:37 | url.par ... , true) | typescript.ts:9:14:9:43 | url.par ... ).query |
-| typescript.ts:9:14:9:37 | url.par ... , true) | typescript.ts:9:14:9:43 | url.par ... ).query |
-| typescript.ts:9:14:9:37 | url.par ... , true) | typescript.ts:9:14:9:43 | url.par ... ).query |
-| typescript.ts:9:14:9:37 | url.par ... , true) | typescript.ts:9:14:9:43 | url.par ... ).query |
-| typescript.ts:9:14:9:37 | url.par ... , true) | typescript.ts:9:14:9:43 | url.par ... ).query |
-| typescript.ts:9:14:9:43 | url.par ... ).query | typescript.ts:9:14:9:48 | url.par ... ry.path |
-| typescript.ts:9:14:9:43 | url.par ... ).query | typescript.ts:9:14:9:48 | url.par ... ry.path |
-| typescript.ts:9:14:9:43 | url.par ... ).query | typescript.ts:9:14:9:48 | url.par ... ry.path |
-| typescript.ts:9:14:9:43 | url.par ... ).query | typescript.ts:9:14:9:48 | url.par ... ry.path |
-| typescript.ts:9:14:9:43 | url.par ... ).query | typescript.ts:9:14:9:48 | url.par ... ry.path |
-| typescript.ts:9:14:9:43 | url.par ... ).query | typescript.ts:9:14:9:48 | url.par ... ry.path |
-| typescript.ts:9:14:9:43 | url.par ... ).query | typescript.ts:9:14:9:48 | url.par ... ry.path |
-| typescript.ts:9:14:9:43 | url.par ... ).query | typescript.ts:9:14:9:48 | url.par ... ry.path |
-| typescript.ts:9:14:9:43 | url.par ... ).query | typescript.ts:9:14:9:48 | url.par ... ry.path |
-| typescript.ts:9:14:9:43 | url.par ... ).query | typescript.ts:9:14:9:48 | url.par ... ry.path |
-| typescript.ts:9:14:9:43 | url.par ... ).query | typescript.ts:9:14:9:48 | url.par ... ry.path |
-| typescript.ts:9:14:9:43 | url.par ... ).query | typescript.ts:9:14:9:48 | url.par ... ry.path |
-| typescript.ts:9:14:9:43 | url.par ... ).query | typescript.ts:9:14:9:48 | url.par ... ry.path |
-| typescript.ts:9:14:9:43 | url.par ... ).query | typescript.ts:9:14:9:48 | url.par ... ry.path |
-| typescript.ts:9:14:9:43 | url.par ... ).query | typescript.ts:9:14:9:48 | url.par ... ry.path |
-| typescript.ts:9:14:9:43 | url.par ... ).query | typescript.ts:9:14:9:48 | url.par ... ry.path |
-| typescript.ts:9:14:9:48 | url.par ... ry.path | typescript.ts:9:7:9:48 | path |
-| typescript.ts:9:14:9:48 | url.par ... ry.path | typescript.ts:9:7:9:48 | path |
-| typescript.ts:9:14:9:48 | url.par ... ry.path | typescript.ts:9:7:9:48 | path |
-| typescript.ts:9:14:9:48 | url.par ... ry.path | typescript.ts:9:7:9:48 | path |
-| typescript.ts:9:14:9:48 | url.par ... ry.path | typescript.ts:9:7:9:48 | path |
-| typescript.ts:9:14:9:48 | url.par ... ry.path | typescript.ts:9:7:9:48 | path |
-| typescript.ts:9:14:9:48 | url.par ... ry.path | typescript.ts:9:7:9:48 | path |
-| typescript.ts:9:14:9:48 | url.par ... ry.path | typescript.ts:9:7:9:48 | path |
-| typescript.ts:9:14:9:48 | url.par ... ry.path | typescript.ts:9:7:9:48 | path |
-| typescript.ts:9:14:9:48 | url.par ... ry.path | typescript.ts:9:7:9:48 | path |
-| typescript.ts:9:14:9:48 | url.par ... ry.path | typescript.ts:9:7:9:48 | path |
-| typescript.ts:9:14:9:48 | url.par ... ry.path | typescript.ts:9:7:9:48 | path |
-| typescript.ts:9:14:9:48 | url.par ... ry.path | typescript.ts:9:7:9:48 | path |
-| typescript.ts:9:14:9:48 | url.par ... ry.path | typescript.ts:9:7:9:48 | path |
-| typescript.ts:9:14:9:48 | url.par ... ry.path | typescript.ts:9:7:9:48 | path |
-| typescript.ts:9:14:9:48 | url.par ... ry.path | typescript.ts:9:7:9:48 | path |
-| typescript.ts:9:24:9:30 | req.url | typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:24:9:30 | req.url | typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:24:9:30 | req.url | typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:24:9:30 | req.url | typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:24:9:30 | req.url | typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:24:9:30 | req.url | typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:24:9:30 | req.url | typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:24:9:30 | req.url | typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:24:9:30 | req.url | typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:24:9:30 | req.url | typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:24:9:30 | req.url | typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:24:9:30 | req.url | typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:24:9:30 | req.url | typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:24:9:30 | req.url | typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:24:9:30 | req.url | typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:24:9:30 | req.url | typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:24:9:30 | req.url | typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:24:9:30 | req.url | typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:24:9:30 | req.url | typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:24:9:30 | req.url | typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:24:9:30 | req.url | typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:24:9:30 | req.url | typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:24:9:30 | req.url | typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:24:9:30 | req.url | typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:24:9:30 | req.url | typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:24:9:30 | req.url | typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:24:9:30 | req.url | typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:24:9:30 | req.url | typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:24:9:30 | req.url | typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:24:9:30 | req.url | typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:24:9:30 | req.url | typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:9:24:9:30 | req.url | typescript.ts:9:14:9:37 | url.par ... , true) |
-| typescript.ts:20:7:20:18 | path3 | typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:20:7:20:18 | path3 | typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:20:7:20:18 | path3 | typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:20:7:20:18 | path3 | typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:20:7:20:18 | path3 | typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:20:7:20:18 | path3 | typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:20:7:20:18 | path3 | typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:20:7:20:18 | path3 | typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:20:7:20:18 | path3 | typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:20:7:20:18 | path3 | typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:20:7:20:18 | path3 | typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:20:7:20:18 | path3 | typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:20:7:20:18 | path3 | typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:20:7:20:18 | path3 | typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:20:7:20:18 | path3 | typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:20:7:20:18 | path3 | typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:20:7:20:18 | path3 | typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:20:7:20:18 | path3 | typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:20:7:20:18 | path3 | typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:20:7:20:18 | path3 | typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:20:7:20:18 | path3 | typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:20:7:20:18 | path3 | typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:20:7:20:18 | path3 | typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:20:7:20:18 | path3 | typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:20:7:20:18 | path3 | typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:20:7:20:18 | path3 | typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:20:7:20:18 | path3 | typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:20:7:20:18 | path3 | typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:20:7:20:18 | path3 | typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:20:7:20:18 | path3 | typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:20:7:20:18 | path3 | typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:20:7:20:18 | path3 | typescript.ts:21:39:21:43 | path3 |
-| typescript.ts:20:15:20:18 | path | typescript.ts:20:7:20:18 | path3 |
-| typescript.ts:20:15:20:18 | path | typescript.ts:20:7:20:18 | path3 |
-| typescript.ts:20:15:20:18 | path | typescript.ts:20:7:20:18 | path3 |
-| typescript.ts:20:15:20:18 | path | typescript.ts:20:7:20:18 | path3 |
-| typescript.ts:20:15:20:18 | path | typescript.ts:20:7:20:18 | path3 |
-| typescript.ts:20:15:20:18 | path | typescript.ts:20:7:20:18 | path3 |
-| typescript.ts:20:15:20:18 | path | typescript.ts:20:7:20:18 | path3 |
-| typescript.ts:20:15:20:18 | path | typescript.ts:20:7:20:18 | path3 |
-| typescript.ts:20:15:20:18 | path | typescript.ts:20:7:20:18 | path3 |
-| typescript.ts:20:15:20:18 | path | typescript.ts:20:7:20:18 | path3 |
-| typescript.ts:20:15:20:18 | path | typescript.ts:20:7:20:18 | path3 |
-| typescript.ts:20:15:20:18 | path | typescript.ts:20:7:20:18 | path3 |
-| typescript.ts:20:15:20:18 | path | typescript.ts:20:7:20:18 | path3 |
-| typescript.ts:20:15:20:18 | path | typescript.ts:20:7:20:18 | path3 |
-| typescript.ts:20:15:20:18 | path | typescript.ts:20:7:20:18 | path3 |
-| typescript.ts:20:15:20:18 | path | typescript.ts:20:7:20:18 | path3 |
-| typescript.ts:23:7:23:18 | path4 | typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:23:7:23:18 | path4 | typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:23:7:23:18 | path4 | typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:23:7:23:18 | path4 | typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:23:7:23:18 | path4 | typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:23:7:23:18 | path4 | typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:23:7:23:18 | path4 | typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:23:7:23:18 | path4 | typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:23:7:23:18 | path4 | typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:23:7:23:18 | path4 | typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:23:7:23:18 | path4 | typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:23:7:23:18 | path4 | typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:23:7:23:18 | path4 | typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:23:7:23:18 | path4 | typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:23:7:23:18 | path4 | typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:23:7:23:18 | path4 | typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:23:7:23:18 | path4 | typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:23:7:23:18 | path4 | typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:23:7:23:18 | path4 | typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:23:7:23:18 | path4 | typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:23:7:23:18 | path4 | typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:23:7:23:18 | path4 | typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:23:7:23:18 | path4 | typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:23:7:23:18 | path4 | typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:23:7:23:18 | path4 | typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:23:7:23:18 | path4 | typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:23:7:23:18 | path4 | typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:23:7:23:18 | path4 | typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:23:7:23:18 | path4 | typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:23:7:23:18 | path4 | typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:23:7:23:18 | path4 | typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:23:7:23:18 | path4 | typescript.ts:24:39:24:43 | path4 |
-| typescript.ts:23:15:23:18 | path | typescript.ts:23:7:23:18 | path4 |
-| typescript.ts:23:15:23:18 | path | typescript.ts:23:7:23:18 | path4 |
-| typescript.ts:23:15:23:18 | path | typescript.ts:23:7:23:18 | path4 |
-| typescript.ts:23:15:23:18 | path | typescript.ts:23:7:23:18 | path4 |
-| typescript.ts:23:15:23:18 | path | typescript.ts:23:7:23:18 | path4 |
-| typescript.ts:23:15:23:18 | path | typescript.ts:23:7:23:18 | path4 |
-| typescript.ts:23:15:23:18 | path | typescript.ts:23:7:23:18 | path4 |
-| typescript.ts:23:15:23:18 | path | typescript.ts:23:7:23:18 | path4 |
-| typescript.ts:23:15:23:18 | path | typescript.ts:23:7:23:18 | path4 |
-| typescript.ts:23:15:23:18 | path | typescript.ts:23:7:23:18 | path4 |
-| typescript.ts:23:15:23:18 | path | typescript.ts:23:7:23:18 | path4 |
-| typescript.ts:23:15:23:18 | path | typescript.ts:23:7:23:18 | path4 |
-| typescript.ts:23:15:23:18 | path | typescript.ts:23:7:23:18 | path4 |
-| typescript.ts:23:15:23:18 | path | typescript.ts:23:7:23:18 | path4 |
-| typescript.ts:23:15:23:18 | path | typescript.ts:23:7:23:18 | path4 |
-| typescript.ts:23:15:23:18 | path | typescript.ts:23:7:23:18 | path4 |
-| typescript.ts:30:7:30:18 | path6 | typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:30:7:30:18 | path6 | typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:30:7:30:18 | path6 | typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:30:7:30:18 | path6 | typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:30:7:30:18 | path6 | typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:30:7:30:18 | path6 | typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:30:7:30:18 | path6 | typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:30:7:30:18 | path6 | typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:30:7:30:18 | path6 | typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:30:7:30:18 | path6 | typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:30:7:30:18 | path6 | typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:30:7:30:18 | path6 | typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:30:7:30:18 | path6 | typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:30:7:30:18 | path6 | typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:30:7:30:18 | path6 | typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:30:7:30:18 | path6 | typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:30:7:30:18 | path6 | typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:30:7:30:18 | path6 | typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:30:7:30:18 | path6 | typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:30:7:30:18 | path6 | typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:30:7:30:18 | path6 | typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:30:7:30:18 | path6 | typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:30:7:30:18 | path6 | typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:30:7:30:18 | path6 | typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:30:7:30:18 | path6 | typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:30:7:30:18 | path6 | typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:30:7:30:18 | path6 | typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:30:7:30:18 | path6 | typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:30:7:30:18 | path6 | typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:30:7:30:18 | path6 | typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:30:7:30:18 | path6 | typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:30:7:30:18 | path6 | typescript.ts:32:29:32:33 | path6 |
-| typescript.ts:30:15:30:18 | path | typescript.ts:30:7:30:18 | path6 |
-| typescript.ts:30:15:30:18 | path | typescript.ts:30:7:30:18 | path6 |
-| typescript.ts:30:15:30:18 | path | typescript.ts:30:7:30:18 | path6 |
-| typescript.ts:30:15:30:18 | path | typescript.ts:30:7:30:18 | path6 |
-| typescript.ts:30:15:30:18 | path | typescript.ts:30:7:30:18 | path6 |
-| typescript.ts:30:15:30:18 | path | typescript.ts:30:7:30:18 | path6 |
-| typescript.ts:30:15:30:18 | path | typescript.ts:30:7:30:18 | path6 |
-| typescript.ts:30:15:30:18 | path | typescript.ts:30:7:30:18 | path6 |
-| typescript.ts:30:15:30:18 | path | typescript.ts:30:7:30:18 | path6 |
-| typescript.ts:30:15:30:18 | path | typescript.ts:30:7:30:18 | path6 |
-| typescript.ts:30:15:30:18 | path | typescript.ts:30:7:30:18 | path6 |
-| typescript.ts:30:15:30:18 | path | typescript.ts:30:7:30:18 | path6 |
-| typescript.ts:30:15:30:18 | path | typescript.ts:30:7:30:18 | path6 |
-| typescript.ts:30:15:30:18 | path | typescript.ts:30:7:30:18 | path6 |
-| typescript.ts:30:15:30:18 | path | typescript.ts:30:7:30:18 | path6 |
-| typescript.ts:30:15:30:18 | path | typescript.ts:30:7:30:18 | path6 |
 | views.js:1:43:1:55 | req.params[0] | views.js:1:43:1:55 | req.params[0] |
 #select
 | TaintedPath-es6.js:10:26:10:45 | join("public", path) | TaintedPath-es6.js:7:20:7:26 | req.url | TaintedPath-es6.js:10:26:10:45 | join("public", path) | This path depends on $@. | TaintedPath-es6.js:7:20:7:26 | req.url | a user-provided value |
@@ -8034,8 +7497,4 @@ edges
 | tainted-string-steps.js:26:18:26:45 | path.sp ... hatever | tainted-string-steps.js:6:24:6:30 | req.url | tainted-string-steps.js:26:18:26:45 | path.sp ... hatever | This path depends on $@. | tainted-string-steps.js:6:24:6:30 | req.url | a user-provided value |
 | tainted-string-steps.js:27:18:27:36 | path.split(unknown) | tainted-string-steps.js:6:24:6:30 | req.url | tainted-string-steps.js:27:18:27:36 | path.split(unknown) | This path depends on $@. | tainted-string-steps.js:6:24:6:30 | req.url | a user-provided value |
 | torrents.js:7:25:7:27 | loc | torrents.js:5:13:5:38 | parseTo ... t).name | torrents.js:7:25:7:27 | loc | This path depends on $@. | torrents.js:5:13:5:38 | parseTo ... t).name | a user-provided value |
-| typescript.ts:12:29:12:32 | path | typescript.ts:9:24:9:30 | req.url | typescript.ts:12:29:12:32 | path | This path depends on $@. | typescript.ts:9:24:9:30 | req.url | a user-provided value |
-| typescript.ts:21:39:21:43 | path3 | typescript.ts:9:24:9:30 | req.url | typescript.ts:21:39:21:43 | path3 | This path depends on $@. | typescript.ts:9:24:9:30 | req.url | a user-provided value |
-| typescript.ts:24:39:24:43 | path4 | typescript.ts:9:24:9:30 | req.url | typescript.ts:24:39:24:43 | path4 | This path depends on $@. | typescript.ts:9:24:9:30 | req.url | a user-provided value |
-| typescript.ts:32:29:32:33 | path6 | typescript.ts:9:24:9:30 | req.url | typescript.ts:32:29:32:33 | path6 | This path depends on $@. | typescript.ts:9:24:9:30 | req.url | a user-provided value |
 | views.js:1:43:1:55 | req.params[0] | views.js:1:43:1:55 | req.params[0] | views.js:1:43:1:55 | req.params[0] | This path depends on $@. | views.js:1:43:1:55 | req.params[0] | a user-provided value |