Java: Split tests between posix and windows due to different behaviour on windows with java 21.

.github/workflows/cpp-swift-analysis.yml

@@ -1,55 +0,0 @@
-name: "Code scanning - C++"
-
-on:
-  push:
-    branches:
-      - main
-      - 'rc/*'
-  pull_request:
-    branches:
-      - main
-      - 'rc/*'
-    paths:
-      - 'swift/**'
-      - '.github/codeql/**'
-      - '.github/workflows/cpp-swift-analysis.yml'
-  schedule:
-    - cron: '0 9 * * 1'
-
-jobs:
-  CodeQL-Build:
-
-    runs-on: ubuntu-latest
-
-    permissions:
-      contents: read
-      security-events: write
-      pull-requests: read
-
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v4
-
-    # Initializes the CodeQL tools for scanning.
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@main
-      # Override language selection by uncommenting this and choosing your languages
-      with:
-        languages: cpp
-        config-file: ./.github/codeql/codeql-config.yml
-  
-    - name: "[Ubuntu] Remove GCC 13 from runner image"
-      shell: bash
-      run: |
-        sudo rm -f /etc/apt/sources.list.d/ubuntu-toolchain-r-ubuntu-test-jammy.list
-        sudo apt-get update
-        sudo apt-get install -y --allow-downgrades libc6=2.35-* libc6-dev=2.35-* libstdc++6=12.3.0-* libgcc-s1=12.3.0-*
-
-    - name: "Build Swift extractor using Bazel"
-      run: |
-        bazel clean --expunge
-        bazel run //swift:create-extractor-pack --nouse_action_cache --noremote_accept_cached --noremote_upload_local_results --spawn_strategy=local --features=-layering_check
-        bazel shutdown
-
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@main

CODEOWNERS

@@ -1,5 +1,4 @@
 /cpp/ @github/codeql-c-analysis
-/cpp/autobuilder/ @github/codeql-c-extractor
 /csharp/ @github/codeql-csharp
 /go/ @github/codeql-go
 /java/ @github/codeql-java

codeql-workspace.yml

@@ -28,6 +28,7 @@ provide:
   - "misc/suite-helpers/qlpack.yml"
   - "ruby/extractor-pack/codeql-extractor.yml"
   - "swift/extractor-pack/codeql-extractor.yml"
+  - "swift/integration-tests/qlpack.yml"
   - "ql/extractor-pack/codeql-extractor.yml"
   - ".github/codeql/extensions/**/codeql-pack.yml"
 

cpp/downgrades/abfce5c170f93e281948f7689ece373464fdaf87/expr_reuse.ql

@@ -1,7 +0,0 @@
-class Expr extends @expr {
-  string toString() { none() }
-}
-
-from Expr reuse, Expr original
-where expr_reuse(reuse, original, _)
-select reuse, original

cpp/downgrades/abfce5c170f93e281948f7689ece373464fdaf87/expr_types.ql

@@ -1,22 +0,0 @@
-class Expr extends @expr {
-  string toString() { none() }
-}
-
-class Type extends @type {
-  string toString() { none() }
-}
-
-predicate existingType(Expr expr, Type type, int value_category) {
-  expr_types(expr, type, value_category)
-}
-
-predicate reuseType(Expr reuse, Type type, int value_category) {
-  exists(Expr original |
-    expr_reuse(reuse, original, value_category) and
-    expr_types(original, type, _)
-  )
-}
-
-from Expr expr, Type type, int value_category
-where existingType(expr, type, value_category) or reuseType(expr, type, value_category)
-select expr, type, value_category

cpp/downgrades/abfce5c170f93e281948f7689ece373464fdaf87/upgrade.properties

@@ -1,4 +0,0 @@
-description: Add value category to expr_reuse table
-compatibility: full
-expr_reuse.rel: run expr_reuse.qlo
-expr_types.rel: run expr_types.qlo

cpp/ql/lib/CHANGELOG.md

@@ -1,22 +1,3 @@
-## 0.12.10
-
-### New Features
-
-* Added a `TaintInheritingContent` class that can be extended to model taint flowing from a qualifier to a field.
-* Added a predicate `GuardCondition.comparesEq/4` to query whether an expression is compared to a constant. 
-* Added a predicate `GuardCondition.ensuresEq/4` to query whether a basic block is guarded by an expression being equal to a constant.
-* Added a predicate `GuardCondition.comparesLt/4` to query whether an expression is compared to a constant. 
-* Added a predicate `GuardCondition.ensuresLt/4` to query whether a basic block is guarded by an expression being less than a constant.
-* Added a predicate `GuardCondition.valueControls` to query whether a basic block is guarded by a particular `case` of a `switch` statement.
-
-### Minor Analysis Improvements
-
-* Added destructors for temporary objects with extended lifetimes to the intermediate representation.
-
-## 0.12.9
-
-No user-facing changes.
-
 ## 0.12.8
 
 No user-facing changes.

cpp/ql/lib/change-notes/2024-03-15-switches-in-guard-conditions.md

@@ -0,0 +1,4 @@
+---
+category: feature
+---
+* Added a predicate `GuardCondition.valueControls` to query whether a basic block is guarded by a particular `case` of a `switch` statement.

cpp/ql/lib/change-notes/2024-03-19-predicates-for-switches-as-guards-2.md

@@ -0,0 +1,5 @@
+---
+category: feature
+---
+* Added a predicate `GuardCondition.comparesLt/4` to query whether an expression is compared to a constant. 
+* Added a predicate `GuardCondition.ensuresLt/4` to query whether a basic block is guarded by an expression being less than a constant.

cpp/ql/lib/change-notes/2024-03-19-predicates-for-switches-as-guards.md

@@ -0,0 +1,5 @@
+---
+category: feature
+---
+* Added a predicate `GuardCondition.comparesEq/4` to query whether an expression is compared to a constant. 
+* Added a predicate `GuardCondition.ensuresEq/4` to query whether a basic block is guarded by an expression being equal to a constant.

cpp/ql/lib/change-notes/released/0.12.10.md

@@ -1,14 +0,0 @@
-## 0.12.10
-
-### New Features
-
-* Added a `TaintInheritingContent` class that can be extended to model taint flowing from a qualifier to a field.
-* Added a predicate `GuardCondition.comparesEq/4` to query whether an expression is compared to a constant. 
-* Added a predicate `GuardCondition.ensuresEq/4` to query whether a basic block is guarded by an expression being equal to a constant.
-* Added a predicate `GuardCondition.comparesLt/4` to query whether an expression is compared to a constant. 
-* Added a predicate `GuardCondition.ensuresLt/4` to query whether a basic block is guarded by an expression being less than a constant.
-* Added a predicate `GuardCondition.valueControls` to query whether a basic block is guarded by a particular `case` of a `switch` statement.
-
-### Minor Analysis Improvements
-
-* Added destructors for temporary objects with extended lifetimes to the intermediate representation.

cpp/ql/lib/change-notes/released/0.12.9.md

@@ -1,3 +0,0 @@
-## 0.12.9
-
-No user-facing changes.

cpp/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.12.10
+lastReleaseVersion: 0.12.8

cpp/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cpp-all
-version: 0.12.10
+version: 0.12.9-dev
 groups: cpp
 dbscheme: semmlecode.cpp.dbscheme
 extractor: cpp

cpp/ql/lib/semmle/code/cpp/Variable.qll

@@ -590,33 +590,6 @@ class TemplateVariable extends Variable {
   Variable getAnInstantiation() { result.isConstructedFrom(this) }
 }
 
-/**
- * A variable that is an instantiation of a template. For example
- * the instantiation `myTemplateVariable<int>` in the following code:
- * ```
- * template<class T>
- * T myTemplateVariable;
- *
- * void caller(int i) {
- *   myTemplateVariable<int> = i;
- * }
- * ```
- */
-class VariableTemplateInstantiation extends Variable {
-  TemplateVariable tv;
-
-  VariableTemplateInstantiation() { tv.getAnInstantiation() = this }
-
-  override string getAPrimaryQlClass() { result = "VariableTemplateInstantiation" }
-
-  /**
-   * Gets the variable template from which this instantiation was instantiated.
-   *
-   * Example: For `int x<int>`, returns `T x`.
-   */
-  TemplateVariable getTemplate() { result = tv }
-}
-
 /**
  * A non-static local variable or parameter that is not part of an
  * uninstantiated template. Uninstantiated templates are purely syntax, and

cpp/ql/lib/semmle/code/cpp/exprs/Expr.qll

@@ -1340,13 +1340,5 @@ class ReuseExpr extends Expr, @reuseexpr {
   /**
    * Gets the expression that is being re-used.
    */
-  Expr getReusedExpr() { expr_reuse(underlyingElement(this), unresolveElement(result), _) }
-
-  override Type getType() { result = this.getReusedExpr().getType() }
-
-  override predicate isLValueCategory() { expr_reuse(underlyingElement(this), _, 3) }
-
-  override predicate isXValueCategory() { expr_reuse(underlyingElement(this), _, 2) }
-
-  override predicate isPRValueCategory() { expr_reuse(underlyingElement(this), _, 1) }
+  Expr getReusedExpr() { expr_reuse(underlyingElement(this), unresolveElement(result)) }
 }

cpp/ql/lib/semmle/code/cpp/ir/dataflow/FlowSteps.qll

@@ -1,20 +0,0 @@
-/**
- * This file provides an abstract class that can be used to model additional
- * object-to-field taint-flow.
- */
-
-private import codeql.util.Unit
-private import semmle.code.cpp.dataflow.new.DataFlow
-
-/**
- * A `Content` that should be implicitly regarded as tainted whenever an object with such `Content`
- * is itself tainted.
- *
- * For example, if we had a type `struct Container { int field; }`, then by default a tainted
- * `Container` and a `Container` with a tainted `int` stored in its `field` are distinct.
- *
- * If `any(DataFlow::FieldContent fc | fc.getField().hasQualifiedName("Container", "field"))` was
- * included in this type however, then a tainted `Container` would imply that its `field` is also
- * tainted (but not vice versa).
- */
-abstract class TaintInheritingContent extends DataFlow::Content { }

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll

@@ -2301,8 +2301,8 @@ private import ContentStars
 
 /** A reference through a non-union instance field. */
 class FieldContent extends Content, TFieldContent {
-  private Field f;
-  private int indirectionIndex;
+  Field f;
+  int indirectionIndex;
 
   FieldContent() { this = TFieldContent(f, indirectionIndex) }
 
@@ -2329,9 +2329,9 @@ class FieldContent extends Content, TFieldContent {
 
 /** A reference through an instance field of a union. */
 class UnionContent extends Content, TUnionContent {
-  private Union u;
-  private int indirectionIndex;
-  private int bytes;
+  Union u;
+  int indirectionIndex;
+  int bytes;
 
   UnionContent() { this = TUnionContent(u, bytes, indirectionIndex) }
 

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/TaintTrackingUtil.qll

@@ -6,7 +6,6 @@ private import semmle.code.cpp.models.interfaces.SideEffect
 private import DataFlowUtil
 private import DataFlowPrivate
 private import SsaInternals as Ssa
-private import semmle.code.cpp.ir.dataflow.FlowSteps
 
 /**
  * Holds if taint propagates from `nodeFrom` to `nodeTo` in exactly one local
@@ -38,12 +37,6 @@ predicate localAdditionalTaintStep(DataFlow::Node nodeFrom, DataFlow::Node nodeT
   )
   or
   any(Ssa::Indirection ind).isAdditionalTaintStep(nodeFrom, nodeTo)
-  or
-  // object->field conflation for content that is a `TaintInheritingContent`.
-  exists(DataFlow::ContentSet f |
-    readStep(nodeFrom, f, nodeTo) and
-    f.getAReadContent() instanceof TaintInheritingContent
-  )
 }
 
 /**

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedElement.qll

@@ -130,6 +130,11 @@ private predicate ignoreExprAndDescendants(Expr expr) {
   or
   // suppress destructors of temporary variables until proper support is added for them.
   exists(Expr parent | parent.getAnImplicitDestructorCall() = expr)
+  or
+  exists(Stmt parent |
+    parent.getAnImplicitDestructorCall() = expr and
+    expr.(DestructorCall).getQualifier() instanceof ReuseExpr
+  )
 }
 
 /**

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll

@@ -2769,50 +2769,6 @@ class TranslatedTemporaryObjectExpr extends TranslatedNonConstantExpr,
   final override Instruction getResult() { result = this.getTargetAddress() }
 }
 
-/**
- * IR translation of a `ReuseExpr`.
- *
- * This translation produces a copy of the glvalue instruction holding the (unconverted) result
- * of the reused expression. In the case where the original expression was a prvalue, the
- * result will be a copy of the glvalue operand of a `TranslatedLoad`.
- */
-class TranslatedReuseExpr extends TranslatedNonConstantExpr {
-  override ReuseExpr expr;
-
-  override Instruction getFirstInstruction(EdgeKind kind) {
-    result = this.getInstruction(OnlyInstructionTag()) and
-    kind instanceof GotoEdge
-  }
-
-  override predicate hasInstruction(Opcode opcode, InstructionTag tag, CppType resultType) {
-    opcode instanceof Opcode::CopyValue and
-    tag instanceof OnlyInstructionTag and
-    resultType = this.getResultType()
-  }
-
-  override Instruction getResult() { result = this.getInstruction(OnlyInstructionTag()) }
-
-  override Instruction getInstructionSuccessorInternal(InstructionTag tag, EdgeKind kind) {
-    tag = OnlyInstructionTag() and
-    kind instanceof GotoEdge and
-    result = this.getParent().getChildSuccessor(this, kind)
-  }
-
-  override TranslatedElement getChildInternal(int id) { none() }
-
-  override Instruction getALastInstructionInternal() {
-    result = this.getInstruction(OnlyInstructionTag())
-  }
-
-  override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
-    tag = OnlyInstructionTag() and
-    operandTag instanceof UnaryOperandTag and
-    if getTranslatedExpr(expr.getReusedExpr()) instanceof TranslatedLoad
-    then result = getTranslatedExpr(expr.getReusedExpr()).(TranslatedLoad).getOperand().getResult()
-    else result = getTranslatedExpr(expr.getReusedExpr()).getResult()
-  }
-}
-
 /**
  * IR translation of a `throw` expression.
  */

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedStmt.qll

@@ -248,9 +248,19 @@ abstract class TranslatedStmt extends TranslatedElement, TTranslatedStmt {
   final override TranslatedElement getChild(int id) {
     result = this.getChildInternal(id)
     or
-    exists(int destructorIndex |
+    exists(int destructorIndex, int tempDestructorCount |
       result.(TranslatedExpr).getExpr() = stmt.getImplicitDestructorCall(destructorIndex) and
-      id = this.getFirstDestructorCallIndex() + destructorIndex
+      id = this.getFirstDestructorCallIndex() + destructorIndex - tempDestructorCount and
+      // suppress destructors of temporary variables until proper support is added for them.
+      tempDestructorCount =
+        count(DestructorCall call, int tempIndex |
+          stmt.getImplicitDestructorCall(tempIndex) = call and
+          tempIndex < destructorIndex and
+          call.getQualifier() instanceof ReuseExpr
+        |
+          call
+        ) and
+      not stmt.getImplicitDestructorCall(destructorIndex).getQualifier() instanceof ReuseExpr
     )
   }
 
@@ -261,7 +271,11 @@ abstract class TranslatedStmt extends TranslatedElement, TTranslatedStmt {
   }
 
   final override predicate hasAnImplicitDestructorCall() {
-    exists(stmt.getAnImplicitDestructorCall())
+    exists(stmt.getAnImplicitDestructorCall()) and
+    // suppress destructors of temporary variables until proper support is added for them.
+    exists(Expr expr | stmt.getAnImplicitDestructorCall().getQualifier() = expr |
+      not expr instanceof ReuseExpr
+    )
   }
 
   final override string toString() { result = stmt.toString() }

cpp/ql/lib/semmlecode.cpp.dbscheme

@@ -1515,8 +1515,7 @@ exprs(
 
 expr_reuse(
     int reuse: @expr ref,
-    int original: @expr ref,
-    int value_category: int ref
+    int original: @expr ref
 )
 
 /*

cpp/ql/lib/upgrades/aa7ff0ab32cd4674f6ab731d32fea64116997b05/expr_reuse.ql

@@ -1,7 +0,0 @@
-class Expr extends @expr {
-  string toString() { none() }
-}
-
-from Expr reuse, Expr original, int value_category
-where expr_reuse(reuse, original) and expr_types(original, _, value_category)
-select reuse, original, value_category

cpp/ql/lib/upgrades/aa7ff0ab32cd4674f6ab731d32fea64116997b05/upgrade.properties

@@ -1,3 +0,0 @@
-description: Add value category to expr_reuse table
-compatibility: full
-expr_reuse.rel: run expr_reuse.qlo

cpp/ql/src/CHANGELOG.md

@@ -1,23 +1,3 @@
-## 0.9.9
-
-### New Queries
-
-* Added a new query, `cpp/type-confusion`, to detect casts to invalid types.
-
-### Query Metadata Changes
-
-* `@precision medium` metadata was added to the `cpp/boost/tls-settings-misconfiguration` and `cpp/boost/use-of-deprecated-hardcoded-security-protocol` queries, and these queries are now included in the security-extended suite. The `@name` metadata of these queries were also updated.
-
-### Minor Analysis Improvements
-
-* The "Missing return-value check for a 'scanf'-like function" query (`cpp/missing-check-scanf`) has been converted to a `path-problem` query.
-* The "Potentially uninitialized local variable" query (`cpp/uninitialized-local`) has been converted to a `path-problem` query.
-* Added models for `GLib` allocation and deallocation functions.
-
-## 0.9.8
-
-No user-facing changes.
-
 ## 0.9.7
 
 No user-facing changes.

cpp/ql/src/change-notes/2024-03-05-type-confusion-query.md

@@ -0,0 +1,4 @@
+---
+category: newQuery
+---
+* Added a new query, `cpp/type-confusion`, to detect casts to invalid types.

cpp/ql/src/change-notes/2024-03-13-glib-alloc-and-dealloc.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added models for `GLib` allocation and deallocation functions.

cpp/ql/src/change-notes/2024-03-18-uninitialized-local-path-problem.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The "Potentially uninitialized local variable" query (`cpp/uninitialized-local`) has been converted to a `path-problem` query.

cpp/ql/src/change-notes/2024-03-20-missing-check-scanf-path-problem.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The "Missing return-value check for a 'scanf'-like function" query (`cpp/missing-check-scanf`) has been converted to a `path-problem` query.

cpp/ql/src/change-notes/2024-03-22-boost-ssl.md

@@ -0,0 +1,4 @@
+---
+category: queryMetadata
+---
+* `@precision medium` metadata was added to the `cpp/boost/tls-settings-misconfiguration` and `cpp/boost/use-of-deprecated-hardcoded-security-protocol` queries, and these queries are now included in the security-extended suite. The `@name` metadata of these queries were also updated.

cpp/ql/src/change-notes/released/0.9.8.md

@@ -1,3 +0,0 @@
-## 0.9.8
-
-No user-facing changes.

cpp/ql/src/change-notes/released/0.9.9.md

@@ -1,15 +0,0 @@
-## 0.9.9
-
-### New Queries
-
-* Added a new query, `cpp/type-confusion`, to detect casts to invalid types.
-
-### Query Metadata Changes
-
-* `@precision medium` metadata was added to the `cpp/boost/tls-settings-misconfiguration` and `cpp/boost/use-of-deprecated-hardcoded-security-protocol` queries, and these queries are now included in the security-extended suite. The `@name` metadata of these queries were also updated.
-
-### Minor Analysis Improvements
-
-* The "Missing return-value check for a 'scanf'-like function" query (`cpp/missing-check-scanf`) has been converted to a `path-problem` query.
-* The "Potentially uninitialized local variable" query (`cpp/uninitialized-local`) has been converted to a `path-problem` query.
-* Added models for `GLib` allocation and deallocation functions.

cpp/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.9.9
+lastReleaseVersion: 0.9.7

cpp/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cpp-queries
-version: 0.9.9
+version: 0.9.8-dev
 groups:
   - cpp
   - queries

cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected

@@ -6676,7 +6676,6 @@ WARNING: Module TaintTracking has been deprecated and may be removed in future (
 | taint.cpp:757:7:757:10 | path | taint.cpp:759:8:759:11 | path |  |
 | taint.cpp:758:21:758:24 | ref arg path | taint.cpp:759:8:759:11 | path |  |
 | taint.cpp:759:8:759:11 | path | taint.cpp:759:7:759:11 | * ... |  |
-| taint.cpp:769:37:769:42 | call to source | taint.cpp:770:7:770:9 | obj |  |
 | vector.cpp:16:43:16:49 | source1 | vector.cpp:17:26:17:32 | source1 |  |
 | vector.cpp:16:43:16:49 | source1 | vector.cpp:31:38:31:44 | source1 |  |
 | vector.cpp:17:21:17:33 | call to vector | vector.cpp:19:14:19:14 | v |  |

cpp/ql/test/library-tests/dataflow/taint-tests/taint.cpp

@@ -757,15 +757,4 @@ void test_call_sprintf() {
 	char path[10];
 	call_sprintf_twice(path, indirect_source());
 	sink(*path); // $ ast,ir
-}
-
-struct TaintInheritingContentObject {
-	int flowFromObject;
-};
-
-TaintInheritingContentObject source(bool);
-
-void test_TaintInheritingContent() {
-	TaintInheritingContentObject obj = source(true);
-	sink(obj.flowFromObject); // $ ir MISSING: ast
 }

cpp/ql/test/library-tests/dataflow/taint-tests/taint.ql

@@ -76,24 +76,6 @@ module AstTest {
 module IRTest {
   private import semmle.code.cpp.ir.IR
   private import semmle.code.cpp.ir.dataflow.TaintTracking
-  private import semmle.code.cpp.ir.dataflow.FlowSteps
-
-  /**
-   * Object->field flow when the object is of type
-   * TaintInheritingContentObject and the field is named
-   * flowFromObject
-   */
-  class TaintInheritingContentTest extends TaintInheritingContent, DataFlow::FieldContent {
-    TaintInheritingContentTest() {
-      exists(Struct o, Field f |
-        this.getField() = f and
-        f = o.getAField() and
-        o.hasGlobalName("TaintInheritingContentObject") and
-        f.hasName("flowFromObject") and
-        this.getIndirectionIndex() = 1
-      )
-    }
-  }
 
   /** Common data flow configuration to be used by tests. */
   module TestAllocationConfig implements DataFlow::ConfigSig {

cpp/ql/test/library-tests/ir/ir/PrintAST.expected

@@ -15605,7 +15605,7 @@ ir.cpp:
 # 1934|             Type = [ClassTemplateInstantiation,Struct] Bar2<int>
 # 1934|             ValueCategory = lvalue
 # 1935|     getStmt(2): [ReturnStmt] return ...
-# 1938| [GlobalVariable,VariableTemplateInstantiation] char global_template<char>
+# 1938| [GlobalVariable] char global_template<char>
 # 1938|   getInitializer(): [Initializer] initializer for global_template
 # 1938|     getExpr(): [Literal] 42
 # 1938|         Type = [IntType] int
@@ -15616,7 +15616,7 @@ ir.cpp:
 # 1938|         Type = [PlainCharType] char
 # 1938|         Value = [CStyleCast] 42
 # 1938|         ValueCategory = prvalue
-# 1938| [GlobalVariable,VariableTemplateInstantiation] int global_template<int>
+# 1938| [GlobalVariable] int global_template<int>
 # 1938|   getInitializer(): [Initializer] initializer for global_template
 # 1938|     getExpr(): [Literal] 42
 # 1938|         Type = [IntType] int

cpp/ql/test/library-tests/ir/ir/aliased_ir.expected

@@ -891,32 +891,24 @@ destructors_for_temps.cpp:
 
 #   29| void temp_test3()
 #   29|   Block 0
-#   29|     v29_1(void)                          = EnterFunction                          : 
-#   29|     m29_2(unknown)                       = AliasedDefinition                      : 
-#   29|     m29_3(unknown)                       = InitializeNonLocal                     : 
-#   29|     m29_4(unknown)                       = Chi                                    : total:m29_2, partial:m29_3
-#   30|     r30_1(glval<ClassWithDestructor2 &>) = VariableAddress[rs]                    : 
-#   30|     r30_2(glval<ClassWithDestructor2>)   = VariableAddress[#temp30:38]            : 
-#   30|     r30_3(glval<unknown>)                = FunctionAddress[returnValue]           : 
-#   30|     r30_4(ClassWithDestructor2)          = Call[returnValue]                      : func:r30_3
-#   30|     m30_5(unknown)                       = ^CallSideEffect                        : ~m29_4
-#   30|     m30_6(unknown)                       = Chi                                    : total:m29_4, partial:m30_5
-#   30|     m30_7(ClassWithDestructor2)          = Store[#temp30:38]                      : &:r30_2, r30_4
-#   30|     r30_8(glval<ClassWithDestructor2>)   = Convert                                : r30_2
-#   30|     r30_9(ClassWithDestructor2 &)        = CopyValue                              : r30_8
-#   30|     m30_10(ClassWithDestructor2 &)       = Store[rs]                              : &:r30_1, r30_9
-#   31|     v31_1(void)                          = NoOp                                   : 
-#   31|     r31_2(glval<ClassWithDestructor2>)   = CopyValue                              : r30_2
-#   31|     r31_3(glval<unknown>)                = FunctionAddress[~ClassWithDestructor2] : 
-#   31|     v31_4(void)                          = Call[~ClassWithDestructor2]            : func:r31_3, this:r31_2
-#   31|     m31_5(unknown)                       = ^CallSideEffect                        : ~m30_6
-#   31|     m31_6(unknown)                       = Chi                                    : total:m30_6, partial:m31_5
-#   31|     v31_7(void)                          = ^IndirectReadSideEffect[-1]            : &:r31_2, m30_7
-#   31|     m31_8(ClassWithDestructor2)          = ^IndirectMayWriteSideEffect[-1]        : &:r31_2
-#   31|     m31_9(ClassWithDestructor2)          = Chi                                    : total:m30_7, partial:m31_8
-#   29|     v29_5(void)                          = ReturnVoid                             : 
-#   29|     v29_6(void)                          = AliasedUse                             : ~m31_6
-#   29|     v29_7(void)                          = ExitFunction                           : 
+#   29|     v29_1(void)                          = EnterFunction                : 
+#   29|     m29_2(unknown)                       = AliasedDefinition            : 
+#   29|     m29_3(unknown)                       = InitializeNonLocal           : 
+#   29|     m29_4(unknown)                       = Chi                          : total:m29_2, partial:m29_3
+#   30|     r30_1(glval<ClassWithDestructor2 &>) = VariableAddress[rs]          : 
+#   30|     r30_2(glval<ClassWithDestructor2>)   = VariableAddress[#temp30:38]  : 
+#   30|     r30_3(glval<unknown>)                = FunctionAddress[returnValue] : 
+#   30|     r30_4(ClassWithDestructor2)          = Call[returnValue]            : func:r30_3
+#   30|     m30_5(unknown)                       = ^CallSideEffect              : ~m29_4
+#   30|     m30_6(unknown)                       = Chi                          : total:m29_4, partial:m30_5
+#   30|     m30_7(ClassWithDestructor2)          = Store[#temp30:38]            : &:r30_2, r30_4
+#   30|     r30_8(glval<ClassWithDestructor2>)   = Convert                      : r30_2
+#   30|     r30_9(ClassWithDestructor2 &)        = CopyValue                    : r30_8
+#   30|     m30_10(ClassWithDestructor2 &)       = Store[rs]                    : &:r30_1, r30_9
+#   31|     v31_1(void)                          = NoOp                         : 
+#   29|     v29_5(void)                          = ReturnVoid                   : 
+#   29|     v29_6(void)                          = AliasedUse                   : ~m30_6
+#   29|     v29_7(void)                          = ExitFunction                 : 
 
 #   33| void temp_test4()
 #   33|   Block 0
@@ -943,24 +935,16 @@ destructors_for_temps.cpp:
 #   35|     r35_9(ClassWithDestructor2 &)        = CopyValue                              : r35_8
 #   35|     m35_10(ClassWithDestructor2 &)       = Store[rs2]                             : &:r35_1, r35_9
 #   36|     v36_1(void)                          = NoOp                                   : 
-#   36|     r36_2(glval<ClassWithDestructor2>)   = CopyValue                              : r35_2
+#   36|     r36_2(glval<ClassWithDestructor2>)   = VariableAddress[c]                     : 
 #   36|     r36_3(glval<unknown>)                = FunctionAddress[~ClassWithDestructor2] : 
 #   36|     v36_4(void)                          = Call[~ClassWithDestructor2]            : func:r36_3, this:r36_2
 #   36|     m36_5(unknown)                       = ^CallSideEffect                        : ~m35_6
 #   36|     m36_6(unknown)                       = Chi                                    : total:m35_6, partial:m36_5
-#   36|     v36_7(void)                          = ^IndirectReadSideEffect[-1]            : &:r36_2, m35_7
+#   36|     v36_7(void)                          = ^IndirectReadSideEffect[-1]            : &:r36_2, m34_8
 #   36|     m36_8(ClassWithDestructor2)          = ^IndirectMayWriteSideEffect[-1]        : &:r36_2
-#   36|     m36_9(ClassWithDestructor2)          = Chi                                    : total:m35_7, partial:m36_8
-#   36|     r36_10(glval<ClassWithDestructor2>)  = VariableAddress[c]                     : 
-#   36|     r36_11(glval<unknown>)               = FunctionAddress[~ClassWithDestructor2] : 
-#   36|     v36_12(void)                         = Call[~ClassWithDestructor2]            : func:r36_11, this:r36_10
-#   36|     m36_13(unknown)                      = ^CallSideEffect                        : ~m36_6
-#   36|     m36_14(unknown)                      = Chi                                    : total:m36_6, partial:m36_13
-#   36|     v36_15(void)                         = ^IndirectReadSideEffect[-1]            : &:r36_10, m34_8
-#   36|     m36_16(ClassWithDestructor2)         = ^IndirectMayWriteSideEffect[-1]        : &:r36_10
-#   36|     m36_17(ClassWithDestructor2)         = Chi                                    : total:m34_8, partial:m36_16
+#   36|     m36_9(ClassWithDestructor2)          = Chi                                    : total:m34_8, partial:m36_8
 #   33|     v33_5(void)                          = ReturnVoid                             : 
-#   33|     v33_6(void)                          = AliasedUse                             : ~m36_14
+#   33|     v33_6(void)                          = AliasedUse                             : ~m36_6
 #   33|     v33_7(void)                          = ExitFunction                           : 
 
 #   38| void temp_test5(bool)
@@ -8898,24 +8882,16 @@ ir.cpp:
 # 1425|     m1425_5(unknown)         = Chi                               : total:m1423_11, partial:m1425_4
 # 1425|     m1425_6(String)          = Store[#temp1425:5]                : &:r1425_1, r1425_3
 # 1426|     v1426_1(void)            = NoOp                              : 
-# 1426|     r1426_2(glval<String>)   = CopyValue                         : r1416_2
+# 1426|     r1426_2(glval<String>)   = VariableAddress[s]                : 
 # 1426|     r1426_3(glval<unknown>)  = FunctionAddress[~String]          : 
 # 1426|     v1426_4(void)            = Call[~String]                     : func:r1426_3, this:r1426_2
 # 1426|     m1426_5(unknown)         = ^CallSideEffect                   : ~m1425_5
 # 1426|     m1426_6(unknown)         = Chi                               : total:m1425_5, partial:m1426_5
-# 1426|     v1426_7(void)            = ^IndirectReadSideEffect[-1]       : &:r1426_2, m1416_7
+# 1426|     v1426_7(void)            = ^IndirectReadSideEffect[-1]       : &:r1426_2, m1415_6
 # 1426|     m1426_8(String)          = ^IndirectMayWriteSideEffect[-1]   : &:r1426_2
-# 1426|     m1426_9(String)          = Chi                               : total:m1416_7, partial:m1426_8
-# 1426|     r1426_10(glval<String>)  = VariableAddress[s]                : 
-# 1426|     r1426_11(glval<unknown>) = FunctionAddress[~String]          : 
-# 1426|     v1426_12(void)           = Call[~String]                     : func:r1426_11, this:r1426_10
-# 1426|     m1426_13(unknown)        = ^CallSideEffect                   : ~m1426_6
-# 1426|     m1426_14(unknown)        = Chi                               : total:m1426_6, partial:m1426_13
-# 1426|     v1426_15(void)           = ^IndirectReadSideEffect[-1]       : &:r1426_10, m1415_6
-# 1426|     m1426_16(String)         = ^IndirectMayWriteSideEffect[-1]   : &:r1426_10
-# 1426|     m1426_17(String)         = Chi                               : total:m1415_6, partial:m1426_16
+# 1426|     m1426_9(String)          = Chi                               : total:m1415_6, partial:m1426_8
 # 1414|     v1414_5(void)            = ReturnVoid                        : 
-# 1414|     v1414_6(void)            = AliasedUse                        : ~m1426_14
+# 1414|     v1414_6(void)            = AliasedUse                        : ~m1426_6
 # 1414|     v1414_7(void)            = ExitFunction                      : 
 
 # 1428| void temporary_destructor_only()
@@ -8997,24 +8973,16 @@ ir.cpp:
 # 1438|     v1438_7(void)                     = ^IndirectReadSideEffect[-1]       : &:r1438_2, m1431_2
 # 1438|     m1438_8(destructor_only)          = ^IndirectMayWriteSideEffect[-1]   : &:r1438_2
 # 1438|     m1438_9(destructor_only)          = Chi                               : total:m1431_2, partial:m1438_8
-# 1438|     r1438_10(glval<destructor_only>)  = CopyValue                         : r1430_2
+# 1438|     r1438_10(glval<destructor_only>)  = VariableAddress[d]                : 
 # 1438|     r1438_11(glval<unknown>)          = FunctionAddress[~destructor_only] : 
 # 1438|     v1438_12(void)                    = Call[~destructor_only]            : func:r1438_11, this:r1438_10
 # 1438|     m1438_13(unknown)                 = ^CallSideEffect                   : ~m1438_6
 # 1438|     m1438_14(unknown)                 = Chi                               : total:m1438_6, partial:m1438_13
-# 1438|     v1438_15(void)                    = ^IndirectReadSideEffect[-1]       : &:r1438_10, m1430_7
+# 1438|     v1438_15(void)                    = ^IndirectReadSideEffect[-1]       : &:r1438_10, m1429_6
 # 1438|     m1438_16(destructor_only)         = ^IndirectMayWriteSideEffect[-1]   : &:r1438_10
-# 1438|     m1438_17(destructor_only)         = Chi                               : total:m1430_7, partial:m1438_16
-# 1438|     r1438_18(glval<destructor_only>)  = VariableAddress[d]                : 
-# 1438|     r1438_19(glval<unknown>)          = FunctionAddress[~destructor_only] : 
-# 1438|     v1438_20(void)                    = Call[~destructor_only]            : func:r1438_19, this:r1438_18
-# 1438|     m1438_21(unknown)                 = ^CallSideEffect                   : ~m1438_14
-# 1438|     m1438_22(unknown)                 = Chi                               : total:m1438_14, partial:m1438_21
-# 1438|     v1438_23(void)                    = ^IndirectReadSideEffect[-1]       : &:r1438_18, m1429_6
-# 1438|     m1438_24(destructor_only)         = ^IndirectMayWriteSideEffect[-1]   : &:r1438_18
-# 1438|     m1438_25(destructor_only)         = Chi                               : total:m1429_6, partial:m1438_24
+# 1438|     m1438_17(destructor_only)         = Chi                               : total:m1429_6, partial:m1438_16
 # 1428|     v1428_5(void)                     = ReturnVoid                        : 
-# 1428|     v1428_6(void)                     = AliasedUse                        : ~m1438_22
+# 1428|     v1428_6(void)                     = AliasedUse                        : ~m1438_14
 # 1428|     v1428_7(void)                     = ExitFunction                      : 
 
 # 1440| void temporary_copy_constructor()

cpp/ql/test/library-tests/ir/ir/operand_locations.expected

@@ -805,7 +805,7 @@
 | destructors_for_temps.cpp:23:68:23:72 | Unary | r23_27 |
 | destructors_for_temps.cpp:29:6:29:15 | ChiPartial | partial:m29_3 |
 | destructors_for_temps.cpp:29:6:29:15 | ChiTotal | total:m29_2 |
-| destructors_for_temps.cpp:29:6:29:15 | SideEffect | ~m31_6 |
+| destructors_for_temps.cpp:29:6:29:15 | SideEffect | ~m30_6 |
 | destructors_for_temps.cpp:30:33:30:34 | Address | &:r30_1 |
 | destructors_for_temps.cpp:30:38:30:70 | CallTarget | func:r30_3 |
 | destructors_for_temps.cpp:30:38:30:70 | ChiPartial | partial:m30_5 |
@@ -815,21 +815,10 @@
 | destructors_for_temps.cpp:30:38:30:72 | Address | &:r30_2 |
 | destructors_for_temps.cpp:30:38:30:72 | StoreValue | r30_9 |
 | destructors_for_temps.cpp:30:38:30:72 | Unary | r30_2 |
-| destructors_for_temps.cpp:30:38:30:72 | Unary | r30_2 |
 | destructors_for_temps.cpp:30:38:30:72 | Unary | r30_8 |
-| destructors_for_temps.cpp:31:1:31:1 | Address | &:r31_2 |
-| destructors_for_temps.cpp:31:1:31:1 | Address | &:r31_2 |
-| destructors_for_temps.cpp:31:1:31:1 | Arg(this) | this:r31_2 |
-| destructors_for_temps.cpp:31:1:31:1 | CallTarget | func:r31_3 |
-| destructors_for_temps.cpp:31:1:31:1 | ChiPartial | partial:m31_5 |
-| destructors_for_temps.cpp:31:1:31:1 | ChiPartial | partial:m31_8 |
-| destructors_for_temps.cpp:31:1:31:1 | ChiTotal | total:m30_6 |
-| destructors_for_temps.cpp:31:1:31:1 | ChiTotal | total:m30_7 |
-| destructors_for_temps.cpp:31:1:31:1 | SideEffect | m30_7 |
-| destructors_for_temps.cpp:31:1:31:1 | SideEffect | ~m30_6 |
 | destructors_for_temps.cpp:33:6:33:15 | ChiPartial | partial:m33_3 |
 | destructors_for_temps.cpp:33:6:33:15 | ChiTotal | total:m33_2 |
-| destructors_for_temps.cpp:33:6:33:15 | SideEffect | ~m36_14 |
+| destructors_for_temps.cpp:33:6:33:15 | SideEffect | ~m36_6 |
 | destructors_for_temps.cpp:34:26:34:26 | Address | &:r34_1 |
 | destructors_for_temps.cpp:34:26:34:26 | Address | &:r34_1 |
 | destructors_for_temps.cpp:34:26:34:26 | Arg(this) | this:r34_1 |
@@ -848,28 +837,17 @@
 | destructors_for_temps.cpp:35:39:35:73 | Address | &:r35_2 |
 | destructors_for_temps.cpp:35:39:35:73 | StoreValue | r35_9 |
 | destructors_for_temps.cpp:35:39:35:73 | Unary | r35_2 |
-| destructors_for_temps.cpp:35:39:35:73 | Unary | r35_2 |
 | destructors_for_temps.cpp:35:39:35:73 | Unary | r35_8 |
 | destructors_for_temps.cpp:36:1:36:1 | Address | &:r36_2 |
 | destructors_for_temps.cpp:36:1:36:1 | Address | &:r36_2 |
-| destructors_for_temps.cpp:36:1:36:1 | Address | &:r36_10 |
-| destructors_for_temps.cpp:36:1:36:1 | Address | &:r36_10 |
 | destructors_for_temps.cpp:36:1:36:1 | Arg(this) | this:r36_2 |
-| destructors_for_temps.cpp:36:1:36:1 | Arg(this) | this:r36_10 |
 | destructors_for_temps.cpp:36:1:36:1 | CallTarget | func:r36_3 |
-| destructors_for_temps.cpp:36:1:36:1 | CallTarget | func:r36_11 |
 | destructors_for_temps.cpp:36:1:36:1 | ChiPartial | partial:m36_5 |
 | destructors_for_temps.cpp:36:1:36:1 | ChiPartial | partial:m36_8 |
-| destructors_for_temps.cpp:36:1:36:1 | ChiPartial | partial:m36_13 |
-| destructors_for_temps.cpp:36:1:36:1 | ChiPartial | partial:m36_16 |
 | destructors_for_temps.cpp:36:1:36:1 | ChiTotal | total:m34_8 |
 | destructors_for_temps.cpp:36:1:36:1 | ChiTotal | total:m35_6 |
-| destructors_for_temps.cpp:36:1:36:1 | ChiTotal | total:m35_7 |
-| destructors_for_temps.cpp:36:1:36:1 | ChiTotal | total:m36_6 |
 | destructors_for_temps.cpp:36:1:36:1 | SideEffect | m34_8 |
-| destructors_for_temps.cpp:36:1:36:1 | SideEffect | m35_7 |
 | destructors_for_temps.cpp:36:1:36:1 | SideEffect | ~m35_6 |
-| destructors_for_temps.cpp:36:1:36:1 | SideEffect | ~m36_6 |
 | destructors_for_temps.cpp:38:6:38:15 | ChiPartial | partial:m38_3 |
 | destructors_for_temps.cpp:38:6:38:15 | ChiTotal | total:m38_2 |
 | destructors_for_temps.cpp:38:6:38:15 | SideEffect | ~m39_5 |
@@ -7298,7 +7276,7 @@
 | ir.cpp:1376:5:1376:15 | StoreValue | r1376_2 |
 | ir.cpp:1414:6:1414:21 | ChiPartial | partial:m1414_3 |
 | ir.cpp:1414:6:1414:21 | ChiTotal | total:m1414_2 |
-| ir.cpp:1414:6:1414:21 | SideEffect | ~m1426_14 |
+| ir.cpp:1414:6:1414:21 | SideEffect | ~m1426_6 |
 | ir.cpp:1415:12:1415:12 | Address | &:r1415_1 |
 | ir.cpp:1415:16:1415:34 | CallTarget | func:r1415_2 |
 | ir.cpp:1415:16:1415:34 | ChiPartial | partial:m1415_4 |
@@ -7314,7 +7292,6 @@
 | ir.cpp:1416:24:1416:44 | Address | &:r1416_2 |
 | ir.cpp:1416:24:1416:44 | StoreValue | r1416_9 |
 | ir.cpp:1416:24:1416:44 | Unary | r1416_2 |
-| ir.cpp:1416:24:1416:44 | Unary | r1416_2 |
 | ir.cpp:1416:24:1416:44 | Unary | r1416_8 |
 | ir.cpp:1418:5:1418:13 | CallTarget | func:r1418_1 |
 | ir.cpp:1418:5:1418:13 | ChiPartial | partial:m1418_6 |
@@ -7426,27 +7403,17 @@
 | ir.cpp:1425:5:1425:30 | Address | &:r1425_1 |
 | ir.cpp:1426:1:1426:1 | Address | &:r1426_2 |
 | ir.cpp:1426:1:1426:1 | Address | &:r1426_2 |
-| ir.cpp:1426:1:1426:1 | Address | &:r1426_10 |
-| ir.cpp:1426:1:1426:1 | Address | &:r1426_10 |
 | ir.cpp:1426:1:1426:1 | Arg(this) | this:r1426_2 |
-| ir.cpp:1426:1:1426:1 | Arg(this) | this:r1426_10 |
 | ir.cpp:1426:1:1426:1 | CallTarget | func:r1426_3 |
-| ir.cpp:1426:1:1426:1 | CallTarget | func:r1426_11 |
 | ir.cpp:1426:1:1426:1 | ChiPartial | partial:m1426_5 |
 | ir.cpp:1426:1:1426:1 | ChiPartial | partial:m1426_8 |
-| ir.cpp:1426:1:1426:1 | ChiPartial | partial:m1426_13 |
-| ir.cpp:1426:1:1426:1 | ChiPartial | partial:m1426_16 |
 | ir.cpp:1426:1:1426:1 | ChiTotal | total:m1415_6 |
-| ir.cpp:1426:1:1426:1 | ChiTotal | total:m1416_7 |
 | ir.cpp:1426:1:1426:1 | ChiTotal | total:m1425_5 |
-| ir.cpp:1426:1:1426:1 | ChiTotal | total:m1426_6 |
 | ir.cpp:1426:1:1426:1 | SideEffect | m1415_6 |
-| ir.cpp:1426:1:1426:1 | SideEffect | m1416_7 |
 | ir.cpp:1426:1:1426:1 | SideEffect | ~m1425_5 |
-| ir.cpp:1426:1:1426:1 | SideEffect | ~m1426_6 |
 | ir.cpp:1428:6:1428:30 | ChiPartial | partial:m1428_3 |
 | ir.cpp:1428:6:1428:30 | ChiTotal | total:m1428_2 |
-| ir.cpp:1428:6:1428:30 | SideEffect | ~m1438_22 |
+| ir.cpp:1428:6:1428:30 | SideEffect | ~m1438_14 |
 | ir.cpp:1429:21:1429:21 | Address | &:r1429_1 |
 | ir.cpp:1429:25:1429:52 | CallTarget | func:r1429_2 |
 | ir.cpp:1429:25:1429:52 | ChiPartial | partial:m1429_4 |
@@ -7462,7 +7429,6 @@
 | ir.cpp:1430:33:1430:62 | Address | &:r1430_2 |
 | ir.cpp:1430:33:1430:62 | StoreValue | r1430_9 |
 | ir.cpp:1430:33:1430:62 | Unary | r1430_2 |
-| ir.cpp:1430:33:1430:62 | Unary | r1430_2 |
 | ir.cpp:1430:33:1430:62 | Unary | r1430_8 |
 | ir.cpp:1431:21:1431:22 | Address | &:r1431_1 |
 | ir.cpp:1432:5:1432:13 | CallTarget | func:r1432_1 |
@@ -7523,32 +7489,22 @@
 | ir.cpp:1438:1:1438:1 | Address | &:r1438_2 |
 | ir.cpp:1438:1:1438:1 | Address | &:r1438_10 |
 | ir.cpp:1438:1:1438:1 | Address | &:r1438_10 |
-| ir.cpp:1438:1:1438:1 | Address | &:r1438_18 |
-| ir.cpp:1438:1:1438:1 | Address | &:r1438_18 |
 | ir.cpp:1438:1:1438:1 | Arg(this) | this:r1438_2 |
 | ir.cpp:1438:1:1438:1 | Arg(this) | this:r1438_10 |
-| ir.cpp:1438:1:1438:1 | Arg(this) | this:r1438_18 |
 | ir.cpp:1438:1:1438:1 | CallTarget | func:r1438_3 |
 | ir.cpp:1438:1:1438:1 | CallTarget | func:r1438_11 |
-| ir.cpp:1438:1:1438:1 | CallTarget | func:r1438_19 |
 | ir.cpp:1438:1:1438:1 | ChiPartial | partial:m1438_5 |
 | ir.cpp:1438:1:1438:1 | ChiPartial | partial:m1438_8 |
 | ir.cpp:1438:1:1438:1 | ChiPartial | partial:m1438_13 |
 | ir.cpp:1438:1:1438:1 | ChiPartial | partial:m1438_16 |
-| ir.cpp:1438:1:1438:1 | ChiPartial | partial:m1438_21 |
-| ir.cpp:1438:1:1438:1 | ChiPartial | partial:m1438_24 |
 | ir.cpp:1438:1:1438:1 | ChiTotal | total:m1429_6 |
-| ir.cpp:1438:1:1438:1 | ChiTotal | total:m1430_7 |
 | ir.cpp:1438:1:1438:1 | ChiTotal | total:m1431_2 |
 | ir.cpp:1438:1:1438:1 | ChiTotal | total:m1437_5 |
 | ir.cpp:1438:1:1438:1 | ChiTotal | total:m1438_6 |
-| ir.cpp:1438:1:1438:1 | ChiTotal | total:m1438_14 |
 | ir.cpp:1438:1:1438:1 | SideEffect | m1429_6 |
-| ir.cpp:1438:1:1438:1 | SideEffect | m1430_7 |
 | ir.cpp:1438:1:1438:1 | SideEffect | m1431_2 |
 | ir.cpp:1438:1:1438:1 | SideEffect | ~m1437_5 |
 | ir.cpp:1438:1:1438:1 | SideEffect | ~m1438_6 |
-| ir.cpp:1438:1:1438:1 | SideEffect | ~m1438_14 |
 | ir.cpp:1440:6:1440:31 | ChiPartial | partial:m1440_3 |
 | ir.cpp:1440:6:1440:31 | ChiTotal | total:m1440_2 |
 | ir.cpp:1440:6:1440:31 | SideEffect | ~m1450_6 |

cpp/ql/test/library-tests/ir/ir/raw_ir.expected

@@ -849,28 +849,22 @@ destructors_for_temps.cpp:
 
 #   29| void temp_test3()
 #   29|   Block 0
-#   29|     v29_1(void)                          = EnterFunction                          : 
-#   29|     mu29_2(unknown)                      = AliasedDefinition                      : 
-#   29|     mu29_3(unknown)                      = InitializeNonLocal                     : 
-#   30|     r30_1(glval<ClassWithDestructor2 &>) = VariableAddress[rs]                    : 
-#   30|     r30_2(glval<ClassWithDestructor2>)   = VariableAddress[#temp30:38]            : 
-#   30|     r30_3(glval<unknown>)                = FunctionAddress[returnValue]           : 
-#   30|     r30_4(ClassWithDestructor2)          = Call[returnValue]                      : func:r30_3
-#   30|     mu30_5(unknown)                      = ^CallSideEffect                        : ~m?
-#   30|     mu30_6(ClassWithDestructor2)         = Store[#temp30:38]                      : &:r30_2, r30_4
-#   30|     r30_7(glval<ClassWithDestructor2>)   = Convert                                : r30_2
-#   30|     r30_8(ClassWithDestructor2 &)        = CopyValue                              : r30_7
-#   30|     mu30_9(ClassWithDestructor2 &)       = Store[rs]                              : &:r30_1, r30_8
-#   31|     v31_1(void)                          = NoOp                                   : 
-#   31|     r31_2(glval<ClassWithDestructor2>)   = CopyValue                              : r30_2
-#   31|     r31_3(glval<unknown>)                = FunctionAddress[~ClassWithDestructor2] : 
-#   31|     v31_4(void)                          = Call[~ClassWithDestructor2]            : func:r31_3, this:r31_2
-#   31|     mu31_5(unknown)                      = ^CallSideEffect                        : ~m?
-#   31|     v31_6(void)                          = ^IndirectReadSideEffect[-1]            : &:r31_2, ~m?
-#   31|     mu31_7(ClassWithDestructor2)         = ^IndirectMayWriteSideEffect[-1]        : &:r31_2
-#   29|     v29_4(void)                          = ReturnVoid                             : 
-#   29|     v29_5(void)                          = AliasedUse                             : ~m?
-#   29|     v29_6(void)                          = ExitFunction                           : 
+#   29|     v29_1(void)                          = EnterFunction                : 
+#   29|     mu29_2(unknown)                      = AliasedDefinition            : 
+#   29|     mu29_3(unknown)                      = InitializeNonLocal           : 
+#   30|     r30_1(glval<ClassWithDestructor2 &>) = VariableAddress[rs]          : 
+#   30|     r30_2(glval<ClassWithDestructor2>)   = VariableAddress[#temp30:38]  : 
+#   30|     r30_3(glval<unknown>)                = FunctionAddress[returnValue] : 
+#   30|     r30_4(ClassWithDestructor2)          = Call[returnValue]            : func:r30_3
+#   30|     mu30_5(unknown)                      = ^CallSideEffect              : ~m?
+#   30|     mu30_6(ClassWithDestructor2)         = Store[#temp30:38]            : &:r30_2, r30_4
+#   30|     r30_7(glval<ClassWithDestructor2>)   = Convert                      : r30_2
+#   30|     r30_8(ClassWithDestructor2 &)        = CopyValue                    : r30_7
+#   30|     mu30_9(ClassWithDestructor2 &)       = Store[rs]                    : &:r30_1, r30_8
+#   31|     v31_1(void)                          = NoOp                         : 
+#   29|     v29_4(void)                          = ReturnVoid                   : 
+#   29|     v29_5(void)                          = AliasedUse                   : ~m?
+#   29|     v29_6(void)                          = ExitFunction                 : 
 
 #   33| void temp_test4()
 #   33|   Block 0
@@ -893,18 +887,12 @@ destructors_for_temps.cpp:
 #   35|     r35_8(ClassWithDestructor2 &)        = CopyValue                              : r35_7
 #   35|     mu35_9(ClassWithDestructor2 &)       = Store[rs2]                             : &:r35_1, r35_8
 #   36|     v36_1(void)                          = NoOp                                   : 
-#   36|     r36_2(glval<ClassWithDestructor2>)   = CopyValue                              : r35_2
+#   36|     r36_2(glval<ClassWithDestructor2>)   = VariableAddress[c]                     : 
 #   36|     r36_3(glval<unknown>)                = FunctionAddress[~ClassWithDestructor2] : 
 #   36|     v36_4(void)                          = Call[~ClassWithDestructor2]            : func:r36_3, this:r36_2
 #   36|     mu36_5(unknown)                      = ^CallSideEffect                        : ~m?
 #   36|     v36_6(void)                          = ^IndirectReadSideEffect[-1]            : &:r36_2, ~m?
 #   36|     mu36_7(ClassWithDestructor2)         = ^IndirectMayWriteSideEffect[-1]        : &:r36_2
-#   36|     r36_8(glval<ClassWithDestructor2>)   = VariableAddress[c]                     : 
-#   36|     r36_9(glval<unknown>)                = FunctionAddress[~ClassWithDestructor2] : 
-#   36|     v36_10(void)                         = Call[~ClassWithDestructor2]            : func:r36_9, this:r36_8
-#   36|     mu36_11(unknown)                     = ^CallSideEffect                        : ~m?
-#   36|     v36_12(void)                         = ^IndirectReadSideEffect[-1]            : &:r36_8, ~m?
-#   36|     mu36_13(ClassWithDestructor2)        = ^IndirectMayWriteSideEffect[-1]        : &:r36_8
 #   33|     v33_4(void)                          = ReturnVoid                             : 
 #   33|     v33_5(void)                          = AliasedUse                             : ~m?
 #   33|     v33_6(void)                          = ExitFunction                           : 
@@ -8333,18 +8321,12 @@ ir.cpp:
 # 1425|     mu1425_4(unknown)        = ^CallSideEffect                   : ~m?
 # 1425|     mu1425_5(String)         = Store[#temp1425:5]                : &:r1425_1, r1425_3
 # 1426|     v1426_1(void)            = NoOp                              : 
-# 1426|     r1426_2(glval<String>)   = CopyValue                         : r1416_2
+# 1426|     r1426_2(glval<String>)   = VariableAddress[s]                : 
 # 1426|     r1426_3(glval<unknown>)  = FunctionAddress[~String]          : 
 # 1426|     v1426_4(void)            = Call[~String]                     : func:r1426_3, this:r1426_2
 # 1426|     mu1426_5(unknown)        = ^CallSideEffect                   : ~m?
 # 1426|     v1426_6(void)            = ^IndirectReadSideEffect[-1]       : &:r1426_2, ~m?
 # 1426|     mu1426_7(String)         = ^IndirectMayWriteSideEffect[-1]   : &:r1426_2
-# 1426|     r1426_8(glval<String>)   = VariableAddress[s]                : 
-# 1426|     r1426_9(glval<unknown>)  = FunctionAddress[~String]          : 
-# 1426|     v1426_10(void)           = Call[~String]                     : func:r1426_9, this:r1426_8
-# 1426|     mu1426_11(unknown)       = ^CallSideEffect                   : ~m?
-# 1426|     v1426_12(void)           = ^IndirectReadSideEffect[-1]       : &:r1426_8, ~m?
-# 1426|     mu1426_13(String)        = ^IndirectMayWriteSideEffect[-1]   : &:r1426_8
 # 1414|     v1414_4(void)            = ReturnVoid                        : 
 # 1414|     v1414_5(void)            = AliasedUse                        : ~m?
 # 1414|     v1414_6(void)            = ExitFunction                      : 
@@ -8415,18 +8397,12 @@ ir.cpp:
 # 1438|     mu1438_5(unknown)                 = ^CallSideEffect                   : ~m?
 # 1438|     v1438_6(void)                     = ^IndirectReadSideEffect[-1]       : &:r1438_2, ~m?
 # 1438|     mu1438_7(destructor_only)         = ^IndirectMayWriteSideEffect[-1]   : &:r1438_2
-# 1438|     r1438_8(glval<destructor_only>)   = CopyValue                         : r1430_2
+# 1438|     r1438_8(glval<destructor_only>)   = VariableAddress[d]                : 
 # 1438|     r1438_9(glval<unknown>)           = FunctionAddress[~destructor_only] : 
 # 1438|     v1438_10(void)                    = Call[~destructor_only]            : func:r1438_9, this:r1438_8
 # 1438|     mu1438_11(unknown)                = ^CallSideEffect                   : ~m?
 # 1438|     v1438_12(void)                    = ^IndirectReadSideEffect[-1]       : &:r1438_8, ~m?
 # 1438|     mu1438_13(destructor_only)        = ^IndirectMayWriteSideEffect[-1]   : &:r1438_8
-# 1438|     r1438_14(glval<destructor_only>)  = VariableAddress[d]                : 
-# 1438|     r1438_15(glval<unknown>)          = FunctionAddress[~destructor_only] : 
-# 1438|     v1438_16(void)                    = Call[~destructor_only]            : func:r1438_15, this:r1438_14
-# 1438|     mu1438_17(unknown)                = ^CallSideEffect                   : ~m?
-# 1438|     v1438_18(void)                    = ^IndirectReadSideEffect[-1]       : &:r1438_14, ~m?
-# 1438|     mu1438_19(destructor_only)        = ^IndirectMayWriteSideEffect[-1]   : &:r1438_14
 # 1428|     v1428_4(void)                     = ReturnVoid                        : 
 # 1428|     v1428_5(void)                     = AliasedUse                        : ~m?
 # 1428|     v1428_6(void)                     = ExitFunction                      : 

csharp/autobuilder/Semmle.Autobuild.CSharp/CSharpAutobuilder.cs

@@ -51,9 +51,7 @@ namespace Semmle.Autobuild.CSharp
                     break;
                 case CSharpBuildStrategy.Buildless:
                     // No need to check that the extractor has been executed in buildless mode
-                    attempt = BuildScript.Bind(
-                        AddBuildlessStartedDiagnostic() & new StandaloneBuildRule().Analyse(this, false),
-                        AddBuildlessEndedDiagnostic);
+                    attempt = new StandaloneBuildRule().Analyse(this, false);
                     break;
                 case CSharpBuildStrategy.MSBuild:
                     attempt = new MsBuildRule().Analyse(this, false) & CheckExtractorRun(true);
@@ -88,52 +86,6 @@ namespace Semmle.Autobuild.CSharp
                 return 1;
             });
 
-        private BuildScript AddBuildlessStartedDiagnostic()
-        {
-            return BuildScript.Create(actions =>
-            {
-                AddDiagnostic(new DiagnosticMessage(
-                    Options.Language,
-                    "buildless/mode-active",
-                    "C# with build-mode set to 'none'",
-                    visibility: new DiagnosticMessage.TspVisibility(statusPage: true, cliSummaryTable: true, telemetry: true),
-                    markdownMessage: "C# with build-mode set to 'none'. This means that all C# source in the working directory will be scanned, with build tools, such as Nuget and Dotnet CLIs, only contributing information about external dependencies.",
-                    severity: DiagnosticMessage.TspSeverity.Note
-                ));
-                return 0;
-            });
-        }
-
-        private BuildScript AddBuildlessEndedDiagnostic(int buildResult)
-        {
-            return BuildScript.Create(actions =>
-            {
-                if (buildResult == 0)
-                {
-                    AddDiagnostic(new DiagnosticMessage(
-                        Options.Language,
-                        "buildless/complete",
-                        "C# analysis with build-mode 'none' completed",
-                        visibility: new DiagnosticMessage.TspVisibility(statusPage: false, cliSummaryTable: true, telemetry: true),
-                        markdownMessage: "C# analysis with build-mode 'none' completed.",
-                        severity: DiagnosticMessage.TspSeverity.Unknown
-                    ));
-                }
-                else
-                {
-                    AddDiagnostic(new DiagnosticMessage(
-                        Options.Language,
-                        "buildless/failed",
-                        "C# analysis with build-mode 'none' failed",
-                        visibility: new DiagnosticMessage.TspVisibility(statusPage: true, cliSummaryTable: true, telemetry: true),
-                        markdownMessage: "C# analysis with build-mode 'none' failed.",
-                        severity: DiagnosticMessage.TspSeverity.Error
-                    ));
-                }
-                return buildResult;
-            });
-        }
-
         protected override void AutobuildFailureDiagnostic()
         {
             // if `ScriptPath` is not null here, the `BuildCommandAuto` rule was

csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/DependencyManager.cs

@@ -728,11 +728,6 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
         /// </summary>
         public IEnumerable<string> GeneratedSourceFiles => generatedSources;
 
-        /// <summary>
-        /// All of the non-generated source files in the source directory.
-        /// </summary>
-        public IEnumerable<string> NonGeneratedSourcesFiles => nonGeneratedSources;
-
         /// <summary>
         /// All of the source files in the source directory.
         /// </summary>

csharp/extractor/Semmle.Extraction.CSharp.Standalone/Extractor.cs

@@ -146,7 +146,7 @@ namespace Semmle.Extraction.CSharp.Standalone
             logger.Log(Severity.Info, "Extracting C# in buildless mode");
             using var dependencyManager = new DependencyManager(options.SrcDir, logger);
 
-            if (!dependencyManager.NonGeneratedSourcesFiles.Any())
+            if (!dependencyManager.AllSourceFiles.Any())
             {
                 logger.Log(Severity.Error, "No source files found");
                 return ExitCode.Errors;

csharp/extractor/Semmle.Util/ToolStatusPage.cs

@@ -46,7 +46,6 @@ namespace Semmle.Util
         [JsonConverter(typeof(StringEnumConverter), typeof(CamelCaseNamingStrategy))]
         public enum TspSeverity
         {
-            Unknown,
             Note,
             Warning,
             Error

csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md

@@ -1,11 +1,3 @@
-## 1.7.13
-
-No user-facing changes.
-
-## 1.7.12
-
-No user-facing changes.
-
 ## 1.7.11
 
 No user-facing changes.

csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.12.md

@@ -1,3 +0,0 @@
-## 1.7.12
-
-No user-facing changes.

csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.13.md

@@ -1,3 +0,0 @@
-## 1.7.13
-
-No user-facing changes.

csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.7.13
+lastReleaseVersion: 1.7.11

csharp/ql/campaigns/Solorigate/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-all
-version: 1.7.13
+version: 1.7.12-dev
 groups:
   - csharp
   - solorigate

csharp/ql/campaigns/Solorigate/src/CHANGELOG.md

@@ -1,11 +1,3 @@
-## 1.7.13
-
-No user-facing changes.
-
-## 1.7.12
-
-No user-facing changes.
-
 ## 1.7.11
 
 No user-facing changes.

csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.12.md

@@ -1,3 +0,0 @@
-## 1.7.12
-
-No user-facing changes.

csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.13.md

@@ -1,3 +0,0 @@
-## 1.7.13
-
-No user-facing changes.

csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.7.13
+lastReleaseVersion: 1.7.11

csharp/ql/campaigns/Solorigate/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-queries
-version: 1.7.13
+version: 1.7.12-dev
 groups:
   - csharp
   - solorigate

csharp/ql/integration-tests/all-platforms/standalone/diagnostics.expected

@@ -1,28 +0,0 @@
-{
-  "markdownMessage": "C# analysis with build-mode 'none' completed.",
-  "severity": "unknown",
-  "source": {
-    "extractorName": "csharp",
-    "id": "csharp/autobuilder/buildless/complete",
-    "name": "C# analysis with build-mode 'none' completed"
-  },
-  "visibility": {
-    "cliSummaryTable": true,
-    "statusPage": false,
-    "telemetry": true
-  }
-}
-{
-  "markdownMessage": "C# with build-mode set to 'none'. This means that all C# source in the working directory will be scanned, with build tools, such as Nuget and Dotnet CLIs, only contributing information about external dependencies.",
-  "severity": "note",
-  "source": {
-    "extractorName": "csharp",
-    "id": "csharp/autobuilder/buildless/mode-active",
-    "name": "C# with build-mode set to 'none'"
-  },
-  "visibility": {
-    "cliSummaryTable": true,
-    "statusPage": true,
-    "telemetry": true
-  }
-}

csharp/ql/integration-tests/all-platforms/standalone/test.py

@@ -1,9 +1,6 @@
 import os
 from create_database_utils import *
-from diagnostics_test_utils import *
 
 os.environ['CODEQL_EXTRACTOR_CSHARP_OPTION_COMPILER_DIAGNOSTIC_LIMIT'] = '2'
 os.environ['CODEQL_EXTRACTOR_CSHARP_OPTION_MESSAGE_LIMIT'] = '5'
 run_codeql_database_create([], lang="csharp", extra_args=["--build-mode=none"])
-
-check_diagnostics()

csharp/ql/integration-tests/all-platforms/standalone_failed/diagnostics.expected

@@ -1,28 +0,0 @@
-{
-  "markdownMessage": "C# analysis with build-mode 'none' failed.",
-  "severity": "error",
-  "source": {
-    "extractorName": "csharp",
-    "id": "csharp/autobuilder/buildless/failed",
-    "name": "C# analysis with build-mode 'none' failed"
-  },
-  "visibility": {
-    "cliSummaryTable": true,
-    "statusPage": true,
-    "telemetry": true
-  }
-}
-{
-  "markdownMessage": "C# with build-mode set to 'none'. This means that all C# source in the working directory will be scanned, with build tools, such as Nuget and Dotnet CLIs, only contributing information about external dependencies.",
-  "severity": "note",
-  "source": {
-    "extractorName": "csharp",
-    "id": "csharp/autobuilder/buildless/mode-active",
-    "name": "C# with build-mode set to 'none'"
-  },
-  "visibility": {
-    "cliSummaryTable": true,
-    "statusPage": true,
-    "telemetry": true
-  }
-}

csharp/ql/integration-tests/all-platforms/standalone_failed/standalone.csproj

@@ -1,14 +0,0 @@
-<Project Sdk="Microsoft.NET.Sdk">
-
-  <PropertyGroup>
-    <OutputType>Exe</OutputType>
-    <TargetFramework>net8.0</TargetFramework>
-    <ImplicitUsings>enable</ImplicitUsings>
-    <Nullable>enable</Nullable>
-  </PropertyGroup>
-
- <Target Name="DeleteBinObjFolders" BeforeTargets="Clean">
-   <RemoveDir Directories=".\bin" />
-   <RemoveDir Directories=".\obj" />
- </Target>
-</Project>

csharp/ql/integration-tests/all-platforms/standalone_failed/test.py

@@ -1,6 +0,0 @@
-from create_database_utils import *
-from diagnostics_test_utils import *
-
-run_codeql_database_create([], db=None, lang="csharp", extra_args=["--build-mode=none"], runFunction=runUnsuccessfully)
-
-check_diagnostics()

csharp/ql/lib/CHANGELOG.md

@@ -1,25 +1,3 @@
-## 0.9.0
-
-### Breaking Changes
-
-* The CIL extractor has been deleted and the corresponding extractor option `cil` has been removed. It is no longer possible to do CIL extraction.
-* The QL library C# classes no longer extend their corresponding `DotNet` classes. Furthermore, CIL related data flow functionality has been deleted and all `DotNet` and `CIL` related classes have been deprecated. This effectively means that it no longer has any effect to enable CIL extraction.
-
-### Minor Analysis Improvements
-
-* Added new source models for the `Dapper` package. These models can be enabled by enabling the `database` threat model.
-* Additional models have been added for `System.IO`. These are primarily source models with the `file` threat model, and summaries related to reading from a file or stream.
-* Support for C# 12 / .NET8.
-* Added the `windows-registry` source kind and threat model to represent values which come from the registry on Windows.
-* The models for `System.Net.Http.HttpRequestMessage` have been modified to better model the flow of tainted URIs.
-* The .NET standard libraries APIs for accessing command line arguments and environment variables have been modeled using the `commandargs` and `environment` threat models.
-* The `cs/assembly-path-injection` query has been modified so that it's sources rely on `ThreatModelFlowSource`. In order to restore results from command line arguments, you should enable the `commandargs` threat model.
-* The models for `System.IO.TextReader` have been modified to better model the flow of tainted text from a `TextReader`.
-
-## 0.8.12
-
-No user-facing changes.
-
 ## 0.8.11
 
 No user-facing changes.

csharp/ql/lib/change-notes/2024-03-04-deprecate-dotnet-and-cil.md

@@ -0,0 +1,4 @@
+---
+category: breaking
+---
+* The QL library C# classes no longer extend their corresponding `DotNet` classes. Furthermore, CIL related data flow functionality has been deleted and all `DotNet` and `CIL` related classes have been deprecated. This effectively means that it no longer has any effect to enable CIL extraction.

csharp/ql/lib/change-notes/2024-03-04-fixed-system.io.textreader-models.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The models for `System.IO.TextReader` have been modified to better model the flow of tainted text from a `TextReader`.

csharp/ql/lib/change-notes/2024-03-05-new-commandargs-and-environment-models.md

@@ -0,0 +1,5 @@
+---
+category: minorAnalysis
+---
+* The .NET standard libraries APIs for accessing command line arguments and environment variables have been modeled using the `commandargs` and `environment` threat models.
+* The `cs/assembly-path-injection` query has been modified so that it's sources rely on `ThreatModelFlowSource`. In order to restore results from command line arguments, you should enable the `commandargs` threat model.

csharp/ql/lib/change-notes/2024-03-07-remove-cil-extractor.md

@@ -0,0 +1,4 @@
+---
+category: breaking
+---
+* The CIL extractor has been deleted and the corresponding extractor option `cil` has been removed. It is no longer possible to do CIL extraction.

csharp/ql/lib/change-notes/2024-03-07-update-system.net.http.httprequestmessage-models.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The models for `System.Net.Http.HttpRequestMessage` have been modified to better model the flow of tainted URIs.

csharp/ql/lib/change-notes/2024-03-11-csharp12-dotnet8.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Support for C# 12 / .NET8.

csharp/ql/lib/change-notes/2024-03-11-registry-sources.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added the `windows-registry` source kind and threat model to represent values which come from the registry on Windows.

csharp/ql/lib/change-notes/2024-03-13-system.io-models.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Additional models have been added for `System.IO`. These are primarily source models with the `file` threat model, and summaries related to reading from a file or stream.

csharp/ql/lib/change-notes/released/0.8.12.md

@@ -1,3 +0,0 @@
-## 0.8.12
-
-No user-facing changes.

csharp/ql/lib/change-notes/released/0.9.0.md

@@ -1,17 +0,0 @@
-## 0.9.0
-
-### Breaking Changes
-
-* The CIL extractor has been deleted and the corresponding extractor option `cil` has been removed. It is no longer possible to do CIL extraction.
-* The QL library C# classes no longer extend their corresponding `DotNet` classes. Furthermore, CIL related data flow functionality has been deleted and all `DotNet` and `CIL` related classes have been deprecated. This effectively means that it no longer has any effect to enable CIL extraction.
-
-### Minor Analysis Improvements
-
-* Added new source models for the `Dapper` package. These models can be enabled by enabling the `database` threat model.
-* Additional models have been added for `System.IO`. These are primarily source models with the `file` threat model, and summaries related to reading from a file or stream.
-* Support for C# 12 / .NET8.
-* Added the `windows-registry` source kind and threat model to represent values which come from the registry on Windows.
-* The models for `System.Net.Http.HttpRequestMessage` have been modified to better model the flow of tainted URIs.
-* The .NET standard libraries APIs for accessing command line arguments and environment variables have been modeled using the `commandargs` and `environment` threat models.
-* The `cs/assembly-path-injection` query has been modified so that it's sources rely on `ThreatModelFlowSource`. In order to restore results from command line arguments, you should enable the `commandargs` threat model.
-* The models for `System.IO.TextReader` have been modified to better model the flow of tainted text from a `TextReader`.

csharp/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.9.0
+lastReleaseVersion: 0.8.11

csharp/ql/lib/ext/Dapper.model.yml

@@ -58,54 +58,3 @@ extensions:
       - ["Dapper", "SqlMapper", False, "QuerySingleOrDefaultAsync", "(System.Data.IDbConnection,System.String,System.Object,System.Data.IDbTransaction,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>)", "", "Argument[1]", "sql-injection", "manual"]
       - ["Dapper", "SqlMapper", False, "QuerySingleOrDefaultAsync", "(System.Data.IDbConnection,System.Type,System.String,System.Object,System.Data.IDbTransaction,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>)", "", "Argument[2]", "sql-injection", "manual"]
       - ["Dapper", "SqlMapper", False, "QuerySingleOrDefaultAsync<T>", "(System.Data.IDbConnection,System.String,System.Object,System.Data.IDbTransaction,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>)", "", "Argument[1]", "sql-injection", "manual"]
-  - addsTo:
-      pack: codeql/csharp-all
-      extensible: sourceModel
-    data:
-      - ["Dapper", "SqlMapper", False, "ExecuteReader", "", "", "ReturnValue", "database", "manual"]
-      - ["Dapper", "SqlMapper", False, "ExecuteReaderAsync", "", "", "ReturnValue", "database", "manual"]
-      - ["Dapper", "SqlMapper", False, "ExecuteScalar", "", "", "ReturnValue", "database", "manual"]
-      - ["Dapper", "SqlMapper", False, "ExecuteScalar<T>", "", "", "ReturnValue", "database", "manual"]
-      - ["Dapper", "SqlMapper", False, "ExecuteScalarAsync", "", "", "ReturnValue", "database", "manual"]
-      - ["Dapper", "SqlMapper", False, "ExecuteScalarAsync<T>", "", "", "ReturnValue", "database", "manual"]
-      - ["Dapper", "SqlMapper", False, "Query", "", "", "ReturnValue", "database", "manual"]
-      - ["Dapper", "SqlMapper", False, "Query<T>", "", "", "ReturnValue", "database", "manual"]
-      - ["Dapper", "SqlMapper", False, "Query<TFirst,TSecond,TReturn>", "", "", "ReturnValue", "database", "manual"]
-      - ["Dapper", "SqlMapper", False, "Query<TFirst,TSecond,TThird,TFourth,TFifth,TReturn>", "", "", "ReturnValue", "database", "manual"]
-      - ["Dapper", "SqlMapper", False, "Query<TFirst,TSecond,TThird,TFourth,TFifth,TSixth,TReturn>", "", "", "ReturnValue", "database", "manual"]
-      - ["Dapper", "SqlMapper", False, "Query<TFirst,TSecond,TThird,TFourth,TFifth,TSixth,TSeventh,TReturn>", "", "", "ReturnValue", "database", "manual"]
-      - ["Dapper", "SqlMapper", False, "Query<TFirst,TSecond,TThird,TFourth,TReturn>", "", "", "ReturnValue", "database", "manual"]
-      - ["Dapper", "SqlMapper", False, "Query<TFirst,TSecond,TThird,TReturn>", "", "", "ReturnValue", "database", "manual"]
-      - ["Dapper", "SqlMapper", False, "Query<TReturn>", "", "", "ReturnValue", "database", "manual"]
-      - ["Dapper", "SqlMapper", False, "QueryAsync", "", "", "ReturnValue", "database", "manual"]
-      - ["Dapper", "SqlMapper", False, "QueryAsync<T>", "", "", "ReturnValue", "database", "manual"]
-      - ["Dapper", "SqlMapper", False, "QueryAsync<TFirst,TSecond,TReturn>", "", "", "ReturnValue", "database", "manual"]
-      - ["Dapper", "SqlMapper", False, "QueryAsync<TFirst,TSecond,TThird,TFourth,TFifth,TReturn>", "", "", "ReturnValue", "database", "manual"]
-      - ["Dapper", "SqlMapper", False, "QueryAsync<TFirst,TSecond,TThird,TFourth,TFifth,TSixth,TReturn>", "", "", "ReturnValue", "database", "manual"]
-      - ["Dapper", "SqlMapper", False, "QueryAsync<TFirst,TSecond,TThird,TFourth,TFifth,TSixth,TSeventh,TReturn>", "", "", "ReturnValue", "database", "manual"]
-      - ["Dapper", "SqlMapper", False, "QueryAsync<TFirst,TSecond,TThird,TFourth,TReturn>", "", "", "ReturnValue", "database", "manual"]
-      - ["Dapper", "SqlMapper", False, "QueryAsync<TFirst,TSecond,TThird,TReturn>", "", "", "ReturnValue", "database", "manual"]
-      - ["Dapper", "SqlMapper", False, "QueryAsync<TReturn>", "", "", "ReturnValue", "database", "manual"]
-      - ["Dapper", "SqlMapper", False, "QueryFirst", "", "", "ReturnValue", "database", "manual"]
-      - ["Dapper", "SqlMapper", False, "QueryFirst<T>", "", "", "ReturnValue", "database", "manual"]
-      - ["Dapper", "SqlMapper", False, "QueryFirstAsync", "", "", "ReturnValue", "database", "manual"]
-      - ["Dapper", "SqlMapper", False, "QueryFirstAsync<T>", "", "", "ReturnValue", "database", "manual"]
-      - ["Dapper", "SqlMapper", False, "QueryFirstOrDefault", "", "", "ReturnValue", "database", "manual"]
-      - ["Dapper", "SqlMapper", False, "QueryFirstOrDefault<T>", "", "", "ReturnValue", "database", "manual"]
-      - ["Dapper", "SqlMapper", False, "QueryFirstOrDefaultAsync", "", "", "ReturnValue", "database", "manual"]
-      - ["Dapper", "SqlMapper", False, "QueryFirstOrDefaultAsync<T>", "", "", "ReturnValue", "database", "manual"]
-      - ["Dapper", "SqlMapper", False, "QueryMultiple", "", "", "ReturnValue", "database", "manual"]
-      - ["Dapper", "SqlMapper", False, "QueryMultipleAsync", "", "", "ReturnValue", "database", "manual"]
-      - ["Dapper", "SqlMapper", False, "QuerySingle", "", "", "ReturnValue", "database", "manual"]
-      - ["Dapper", "SqlMapper", False, "QuerySingle<T>", "", "", "ReturnValue", "database", "manual"]
-      - ["Dapper", "SqlMapper", False, "QuerySingleAsync", "", "", "ReturnValue", "database", "manual"]
-      - ["Dapper", "SqlMapper", False, "QuerySingleAsync<T>", "", "", "ReturnValue", "database", "manual"]
-      - ["Dapper", "SqlMapper", False, "QuerySingleOrDefault", "", "", "ReturnValue", "database", "manual"]
-      - ["Dapper", "SqlMapper", False, "QuerySingleOrDefault<T>", "", "", "ReturnValue", "database", "manual"]
-      - ["Dapper", "SqlMapper", False, "QuerySingleOrDefaultAsync", "", "", "ReturnValue", "database", "manual"]
-      - ["Dapper", "SqlMapper", False, "QuerySingleOrDefaultAsync<T>", "", "", "ReturnValue", "database", "manual"]
-  - addsTo:
-      pack: codeql/csharp-all
-      extensible: summaryModel
-    data:
-      - ["Dapper", "SqlMapper", False, "AsList<T>", "(System.Collections.Generic.IEnumerable<T>)", "", "Argument[0].Element", "ReturnValue.Element", "value", "manual"]

csharp/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-all
-version: 0.9.0
+version: 0.8.12-dev
 groups: csharp
 dbscheme: semmlecode.csharp.dbscheme
 extractor: csharp

csharp/ql/src/CHANGELOG.md

@@ -1,18 +1,3 @@
-## 0.8.13
-
-### Major Analysis Improvements
-
-* The `Stored` variants of some queries (`cs/stored-command-line-injection`, `cs/web/stored-xss`, `cs/stored-ldap-injection`, `cs/xml/stored-xpath-injection`, `cs/second-order-sql-injection`) have been removed. If you were using these queries, their results can be restored by enabling the `file` and `database` threat models in your threat model configuration.
-
-### Minor Analysis Improvements
-
-* The alert message of `cs/wrong-compareto-signature` has been changed to remove unnecessary element references.
-* Data flow queries that track flow from *local* flow sources now use the current *threat model* configuration instead. This may lead to changes in the produced alerts if the threat model configuration only uses *remote* flow sources. The changed queries are `cs/code-injection`, `cs/resource-injection`, `cs/sql-injection`, and `cs/uncontrolled-format-string`.
-
-## 0.8.12
-
-No user-facing changes.
-
 ## 0.8.11
 
 No user-facing changes.

csharp/ql/src/change-notes/2024-03-06-remove-default-local-sources.md

@@ -0,0 +1,5 @@
+---
+category: minorAnalysis
+---
+* Data flow queries that track flow from *local* flow sources now use the current *threat model* configuration instead. This may lead to changes in the produced alerts if the threat model configuration only uses *remote* flow sources. The changed queries are `cs/code-injection`, `cs/resource-injection`, `cs/sql-injection`, and `cs/uncontrolled-format-string`.
+

csharp/ql/src/change-notes/2024-03-11-remove-stored-query-variants.md

@@ -0,0 +1,5 @@
+---
+category: majorAnalysis
+---
+* The `Stored` variants of some queries (`cs/stored-command-line-injection`, `cs/web/stored-xss`, `cs/stored-ldap-injection`, `cs/xml/stored-xpath-injection`, `cs/second-order-sql-injection`) have been removed. If you were using these queries, their results can be restored by enabling the `file` and `database` threat models in your threat model configuration.
+

csharp/ql/src/change-notes/2024-03-21-change-compareto-signature.md

@@ -0,0 +1,5 @@
+---
+category: minorAnalysis
+---
+* The alert message of `cs/wrong-compareto-signature` has been changed to remove unnecessary element references.
+

csharp/ql/src/change-notes/released/0.8.12.md

@@ -1,3 +0,0 @@
-## 0.8.12
-
-No user-facing changes.

csharp/ql/src/change-notes/released/0.8.13.md

@@ -1,10 +0,0 @@
-## 0.8.13
-
-### Major Analysis Improvements
-
-* The `Stored` variants of some queries (`cs/stored-command-line-injection`, `cs/web/stored-xss`, `cs/stored-ldap-injection`, `cs/xml/stored-xpath-injection`, `cs/second-order-sql-injection`) have been removed. If you were using these queries, their results can be restored by enabling the `file` and `database` threat models in your threat model configuration.
-
-### Minor Analysis Improvements
-
-* The alert message of `cs/wrong-compareto-signature` has been changed to remove unnecessary element references.
-* Data flow queries that track flow from *local* flow sources now use the current *threat model* configuration instead. This may lead to changes in the produced alerts if the threat model configuration only uses *remote* flow sources. The changed queries are `cs/code-injection`, `cs/resource-injection`, `cs/sql-injection`, and `cs/uncontrolled-format-string`.

csharp/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.8.13
+lastReleaseVersion: 0.8.11

csharp/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-queries
-version: 0.8.13
+version: 0.8.12-dev
 groups:
   - csharp
   - queries

csharp/ql/test/library-tests/dataflow/flowsources/stored/database/dapper/DatabaseSources.ext.yml

@@ -1,7 +0,0 @@
-extensions:
-
-  - addsTo:
-      pack: codeql/threat-models
-      extensible: threatModelConfiguration
-    data:
-      - ["database", true, 0]

csharp/ql/test/library-tests/dataflow/flowsources/stored/database/dapper/DatabaseSources.ql

@@ -1,12 +0,0 @@
-import csharp
-import semmle.code.csharp.security.dataflow.flowsources.FlowSources
-import TestUtilities.InlineFlowTest
-import TaintFlowTest<DatabaseConfig>
-
-module DatabaseConfig implements DataFlow::ConfigSig {
-  predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
-
-  predicate isSink(DataFlow::Node sink) {
-    exists(MethodCall mc | mc.getTarget().hasName("Sink") | sink.asExpr() = mc.getArgument(0))
-  }
-}

csharp/ql/test/library-tests/dataflow/flowsources/stored/database/dapper/UseDapper.cs

@@ -1,50 +0,0 @@
-using System;
-using System.Data;
-using System.Data.Entity;
-using System.Data.SqlClient;
-using System.Threading.Tasks;
-using Dapper;
-
-namespace Test
-{
-    class UseDapper
-    {
-        public static void Bad01(string connectionString, string query)
-        {
-            using (var connection = new SqlConnection(connectionString))
-            {
-                var result = connection.Query<object>(query);
-                Sink(result); // $ hasTaintFlow=line:16
-            }
-        }
-
-        public static async Task Bad02(string connectionString, string query)
-        {
-            using (var connection = new SqlConnection(connectionString))
-            {
-                var result = await connection.QueryAsync<object>(query);
-                Sink(result); // $ hasTaintFlow=line:25
-            }
-        }
-
-        public static void Bad03(string connectionString, string query)
-        {
-            using (var connection = new SqlConnection(connectionString))
-            {
-                var result = connection.QueryFirst(query);
-                Sink(result); // $ hasTaintFlow=line:34
-            }
-        }
-
-        public static void Bad04(string connectionString, string query)
-        {
-            using (var connection = new SqlConnection(connectionString))
-            {
-                var results = connection.Query<object>(query).AsList();
-                Sink(results[0]); // $ hasTaintFlow=line:43
-            }
-        }
-
-        public static void Sink(object o) { }
-    }
-}

csharp/ql/test/library-tests/dataflow/flowsources/stored/database/dapper/options

@@ -1,5 +0,0 @@
-semmle-extractor-options: /nostdlib /noconfig
-semmle-extractor-options: --load-sources-from-project:${testdir}/../../../../../../resources/stubs/Dapper/2.1.24/Dapper.csproj
-semmle-extractor-options: --load-sources-from-project:${testdir}/../../../../../../resources/stubs/System.Data.SqlClient/4.8.5/System.Data.SqlClient.csproj
-semmle-extractor-options: --load-sources-from-project:${testdir}/../../../../../../resources/stubs/System.Data.SQLite/1.0.118/System.Data.SQLite.csproj
-semmle-extractor-options: ${testdir}/../../../../../../resources/stubs/System.Windows.cs

csharp/ql/test/library-tests/dataflow/library/FlowSummaries.expected

@@ -1,95 +1,4 @@
 source
-| Dapper;SqlMapper;false;ExecuteReader;(System.Data.IDbConnection,Dapper.CommandDefinition);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;ExecuteReader;(System.Data.IDbConnection,Dapper.CommandDefinition,System.Data.CommandBehavior);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;ExecuteReader;(System.Data.IDbConnection,System.String,System.Object,System.Data.IDbTransaction,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;ExecuteReaderAsync;(System.Data.Common.DbConnection,Dapper.CommandDefinition);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;ExecuteReaderAsync;(System.Data.Common.DbConnection,Dapper.CommandDefinition,System.Data.CommandBehavior);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;ExecuteReaderAsync;(System.Data.Common.DbConnection,System.String,System.Object,System.Data.IDbTransaction,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;ExecuteReaderAsync;(System.Data.IDbConnection,Dapper.CommandDefinition);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;ExecuteReaderAsync;(System.Data.IDbConnection,Dapper.CommandDefinition,System.Data.CommandBehavior);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;ExecuteReaderAsync;(System.Data.IDbConnection,System.String,System.Object,System.Data.IDbTransaction,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;ExecuteScalar;(System.Data.IDbConnection,Dapper.CommandDefinition);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;ExecuteScalar;(System.Data.IDbConnection,System.String,System.Object,System.Data.IDbTransaction,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;ExecuteScalar<T>;(System.Data.IDbConnection,Dapper.CommandDefinition);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;ExecuteScalar<T>;(System.Data.IDbConnection,System.String,System.Object,System.Data.IDbTransaction,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;ExecuteScalarAsync;(System.Data.IDbConnection,Dapper.CommandDefinition);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;ExecuteScalarAsync;(System.Data.IDbConnection,System.String,System.Object,System.Data.IDbTransaction,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;ExecuteScalarAsync<T>;(System.Data.IDbConnection,Dapper.CommandDefinition);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;ExecuteScalarAsync<T>;(System.Data.IDbConnection,System.String,System.Object,System.Data.IDbTransaction,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;Query;(System.Data.IDbConnection,System.String,System.Object,System.Data.IDbTransaction,System.Boolean,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;Query;(System.Data.IDbConnection,System.Type,System.String,System.Object,System.Data.IDbTransaction,System.Boolean,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;Query<T>;(System.Data.IDbConnection,Dapper.CommandDefinition);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;Query<T>;(System.Data.IDbConnection,System.String,System.Object,System.Data.IDbTransaction,System.Boolean,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;Query<TFirst,TSecond,TReturn>;(System.Data.IDbConnection,System.String,System.Func<TFirst,TSecond,TReturn>,System.Object,System.Data.IDbTransaction,System.Boolean,System.String,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;Query<TFirst,TSecond,TThird,TFourth,TFifth,TReturn>;(System.Data.IDbConnection,System.String,System.Func<TFirst,TSecond,TThird,TFourth,TFifth,TReturn>,System.Object,System.Data.IDbTransaction,System.Boolean,System.String,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;Query<TFirst,TSecond,TThird,TFourth,TFifth,TSixth,TReturn>;(System.Data.IDbConnection,System.String,System.Func<TFirst,TSecond,TThird,TFourth,TFifth,TSixth,TReturn>,System.Object,System.Data.IDbTransaction,System.Boolean,System.String,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;Query<TFirst,TSecond,TThird,TFourth,TFifth,TSixth,TSeventh,TReturn>;(System.Data.IDbConnection,System.String,System.Func<TFirst,TSecond,TThird,TFourth,TFifth,TSixth,TSeventh,TReturn>,System.Object,System.Data.IDbTransaction,System.Boolean,System.String,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;Query<TFirst,TSecond,TThird,TFourth,TReturn>;(System.Data.IDbConnection,System.String,System.Func<TFirst,TSecond,TThird,TFourth,TReturn>,System.Object,System.Data.IDbTransaction,System.Boolean,System.String,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;Query<TFirst,TSecond,TThird,TReturn>;(System.Data.IDbConnection,System.String,System.Func<TFirst,TSecond,TThird,TReturn>,System.Object,System.Data.IDbTransaction,System.Boolean,System.String,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;Query<TReturn>;(System.Data.IDbConnection,System.String,System.Type[],System.Func<System.Object[],TReturn>,System.Object,System.Data.IDbTransaction,System.Boolean,System.String,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QueryAsync;(System.Data.IDbConnection,Dapper.CommandDefinition);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QueryAsync;(System.Data.IDbConnection,System.String,System.Object,System.Data.IDbTransaction,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QueryAsync;(System.Data.IDbConnection,System.Type,Dapper.CommandDefinition);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QueryAsync;(System.Data.IDbConnection,System.Type,System.String,System.Object,System.Data.IDbTransaction,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QueryAsync<T>;(System.Data.IDbConnection,Dapper.CommandDefinition);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QueryAsync<T>;(System.Data.IDbConnection,System.String,System.Object,System.Data.IDbTransaction,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QueryAsync<TFirst,TSecond,TReturn>;(System.Data.IDbConnection,Dapper.CommandDefinition,System.Func<TFirst,TSecond,TReturn>,System.String);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QueryAsync<TFirst,TSecond,TReturn>;(System.Data.IDbConnection,System.String,System.Func<TFirst,TSecond,TReturn>,System.Object,System.Data.IDbTransaction,System.Boolean,System.String,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QueryAsync<TFirst,TSecond,TThird,TFourth,TFifth,TReturn>;(System.Data.IDbConnection,Dapper.CommandDefinition,System.Func<TFirst,TSecond,TThird,TFourth,TFifth,TReturn>,System.String);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QueryAsync<TFirst,TSecond,TThird,TFourth,TFifth,TReturn>;(System.Data.IDbConnection,System.String,System.Func<TFirst,TSecond,TThird,TFourth,TFifth,TReturn>,System.Object,System.Data.IDbTransaction,System.Boolean,System.String,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QueryAsync<TFirst,TSecond,TThird,TFourth,TFifth,TSixth,TReturn>;(System.Data.IDbConnection,Dapper.CommandDefinition,System.Func<TFirst,TSecond,TThird,TFourth,TFifth,TSixth,TReturn>,System.String);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QueryAsync<TFirst,TSecond,TThird,TFourth,TFifth,TSixth,TReturn>;(System.Data.IDbConnection,System.String,System.Func<TFirst,TSecond,TThird,TFourth,TFifth,TSixth,TReturn>,System.Object,System.Data.IDbTransaction,System.Boolean,System.String,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QueryAsync<TFirst,TSecond,TThird,TFourth,TFifth,TSixth,TSeventh,TReturn>;(System.Data.IDbConnection,Dapper.CommandDefinition,System.Func<TFirst,TSecond,TThird,TFourth,TFifth,TSixth,TSeventh,TReturn>,System.String);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QueryAsync<TFirst,TSecond,TThird,TFourth,TFifth,TSixth,TSeventh,TReturn>;(System.Data.IDbConnection,System.String,System.Func<TFirst,TSecond,TThird,TFourth,TFifth,TSixth,TSeventh,TReturn>,System.Object,System.Data.IDbTransaction,System.Boolean,System.String,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QueryAsync<TFirst,TSecond,TThird,TFourth,TReturn>;(System.Data.IDbConnection,Dapper.CommandDefinition,System.Func<TFirst,TSecond,TThird,TFourth,TReturn>,System.String);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QueryAsync<TFirst,TSecond,TThird,TFourth,TReturn>;(System.Data.IDbConnection,System.String,System.Func<TFirst,TSecond,TThird,TFourth,TReturn>,System.Object,System.Data.IDbTransaction,System.Boolean,System.String,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QueryAsync<TFirst,TSecond,TThird,TReturn>;(System.Data.IDbConnection,Dapper.CommandDefinition,System.Func<TFirst,TSecond,TThird,TReturn>,System.String);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QueryAsync<TFirst,TSecond,TThird,TReturn>;(System.Data.IDbConnection,System.String,System.Func<TFirst,TSecond,TThird,TReturn>,System.Object,System.Data.IDbTransaction,System.Boolean,System.String,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QueryAsync<TReturn>;(System.Data.IDbConnection,System.String,System.Type[],System.Func<System.Object[],TReturn>,System.Object,System.Data.IDbTransaction,System.Boolean,System.String,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QueryFirst;(System.Data.IDbConnection,System.String,System.Object,System.Data.IDbTransaction,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QueryFirst;(System.Data.IDbConnection,System.Type,System.String,System.Object,System.Data.IDbTransaction,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QueryFirst<T>;(System.Data.IDbConnection,Dapper.CommandDefinition);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QueryFirst<T>;(System.Data.IDbConnection,System.String,System.Object,System.Data.IDbTransaction,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QueryFirstAsync;(System.Data.IDbConnection,Dapper.CommandDefinition);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QueryFirstAsync;(System.Data.IDbConnection,System.String,System.Object,System.Data.IDbTransaction,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QueryFirstAsync;(System.Data.IDbConnection,System.Type,Dapper.CommandDefinition);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QueryFirstAsync;(System.Data.IDbConnection,System.Type,System.String,System.Object,System.Data.IDbTransaction,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QueryFirstAsync<T>;(System.Data.IDbConnection,Dapper.CommandDefinition);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QueryFirstAsync<T>;(System.Data.IDbConnection,System.String,System.Object,System.Data.IDbTransaction,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QueryFirstOrDefault;(System.Data.IDbConnection,System.String,System.Object,System.Data.IDbTransaction,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QueryFirstOrDefault;(System.Data.IDbConnection,System.Type,System.String,System.Object,System.Data.IDbTransaction,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QueryFirstOrDefault<T>;(System.Data.IDbConnection,Dapper.CommandDefinition);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QueryFirstOrDefault<T>;(System.Data.IDbConnection,System.String,System.Object,System.Data.IDbTransaction,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QueryFirstOrDefaultAsync;(System.Data.IDbConnection,Dapper.CommandDefinition);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QueryFirstOrDefaultAsync;(System.Data.IDbConnection,System.String,System.Object,System.Data.IDbTransaction,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QueryFirstOrDefaultAsync;(System.Data.IDbConnection,System.Type,Dapper.CommandDefinition);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QueryFirstOrDefaultAsync;(System.Data.IDbConnection,System.Type,System.String,System.Object,System.Data.IDbTransaction,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QueryFirstOrDefaultAsync<T>;(System.Data.IDbConnection,Dapper.CommandDefinition);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QueryFirstOrDefaultAsync<T>;(System.Data.IDbConnection,System.String,System.Object,System.Data.IDbTransaction,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QueryMultiple;(System.Data.IDbConnection,Dapper.CommandDefinition);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QueryMultiple;(System.Data.IDbConnection,System.String,System.Object,System.Data.IDbTransaction,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QueryMultipleAsync;(System.Data.IDbConnection,Dapper.CommandDefinition);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QueryMultipleAsync;(System.Data.IDbConnection,System.String,System.Object,System.Data.IDbTransaction,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QuerySingle;(System.Data.IDbConnection,System.String,System.Object,System.Data.IDbTransaction,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QuerySingle;(System.Data.IDbConnection,System.Type,System.String,System.Object,System.Data.IDbTransaction,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QuerySingle<T>;(System.Data.IDbConnection,Dapper.CommandDefinition);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QuerySingle<T>;(System.Data.IDbConnection,System.String,System.Object,System.Data.IDbTransaction,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QuerySingleAsync;(System.Data.IDbConnection,Dapper.CommandDefinition);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QuerySingleAsync;(System.Data.IDbConnection,System.String,System.Object,System.Data.IDbTransaction,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QuerySingleAsync;(System.Data.IDbConnection,System.Type,Dapper.CommandDefinition);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QuerySingleAsync;(System.Data.IDbConnection,System.Type,System.String,System.Object,System.Data.IDbTransaction,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QuerySingleAsync<T>;(System.Data.IDbConnection,Dapper.CommandDefinition);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QuerySingleAsync<T>;(System.Data.IDbConnection,System.String,System.Object,System.Data.IDbTransaction,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QuerySingleOrDefault;(System.Data.IDbConnection,System.String,System.Object,System.Data.IDbTransaction,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QuerySingleOrDefault;(System.Data.IDbConnection,System.Type,System.String,System.Object,System.Data.IDbTransaction,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QuerySingleOrDefault<T>;(System.Data.IDbConnection,Dapper.CommandDefinition);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QuerySingleOrDefault<T>;(System.Data.IDbConnection,System.String,System.Object,System.Data.IDbTransaction,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QuerySingleOrDefaultAsync;(System.Data.IDbConnection,Dapper.CommandDefinition);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QuerySingleOrDefaultAsync;(System.Data.IDbConnection,System.String,System.Object,System.Data.IDbTransaction,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QuerySingleOrDefaultAsync;(System.Data.IDbConnection,System.Type,Dapper.CommandDefinition);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QuerySingleOrDefaultAsync;(System.Data.IDbConnection,System.Type,System.String,System.Object,System.Data.IDbTransaction,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QuerySingleOrDefaultAsync<T>;(System.Data.IDbConnection,Dapper.CommandDefinition);;ReturnValue;database;manual |
-| Dapper;SqlMapper;false;QuerySingleOrDefaultAsync<T>;(System.Data.IDbConnection,System.String,System.Object,System.Data.IDbTransaction,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;ReturnValue;database;manual |
 | Microsoft.Extensions.Configuration;EnvironmentVariablesExtensions;false;AddEnvironmentVariables;(Microsoft.Extensions.Configuration.IConfigurationBuilder);;Argument[0];environment;manual |
 | Microsoft.Extensions.Configuration;EnvironmentVariablesExtensions;false;AddEnvironmentVariables;(Microsoft.Extensions.Configuration.IConfigurationBuilder);;ReturnValue;environment;manual |
 | Microsoft.Extensions.Configuration;EnvironmentVariablesExtensions;false;AddEnvironmentVariables;(Microsoft.Extensions.Configuration.IConfigurationBuilder,System.Action<Microsoft.Extensions.Configuration.EnvironmentVariables.EnvironmentVariablesConfigurationSource>);;Argument[0];environment;manual |
@@ -736,7 +645,6 @@ summary
 | Dapper;SqlMapper+GridReader;false;Read<TFirst,TSecond,TThird,TFourth,TReturn>;(System.Func<TFirst,TSecond,TThird,TFourth,TReturn>,System.String,System.Boolean);;Argument[0];Argument[0].Parameter[delegate-self];value;hq-generated |
 | Dapper;SqlMapper+GridReader;false;Read<TFirst,TSecond,TThird,TReturn>;(System.Func<TFirst,TSecond,TThird,TReturn>,System.String,System.Boolean);;Argument[0];Argument[0].Parameter[delegate-self];value;hq-generated |
 | Dapper;SqlMapper+GridReader;false;Read<TReturn>;(System.Type[],System.Func<System.Object[],TReturn>,System.String,System.Boolean);;Argument[1];Argument[1].Parameter[delegate-self];value;hq-generated |
-| Dapper;SqlMapper;false;AsList<T>;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;ReturnValue.Element;value;manual |
 | Dapper;SqlMapper;false;Query<TFirst,TSecond,TReturn>;(System.Data.IDbConnection,System.String,System.Func<TFirst,TSecond,TReturn>,System.Object,System.Data.IDbTransaction,System.Boolean,System.String,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;Argument[2];Argument[2].Parameter[delegate-self];value;hq-generated |
 | Dapper;SqlMapper;false;Query<TFirst,TSecond,TThird,TFourth,TFifth,TReturn>;(System.Data.IDbConnection,System.String,System.Func<TFirst,TSecond,TThird,TFourth,TFifth,TReturn>,System.Object,System.Data.IDbTransaction,System.Boolean,System.String,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;Argument[2];Argument[2].Parameter[delegate-self];value;hq-generated |
 | Dapper;SqlMapper;false;Query<TFirst,TSecond,TThird,TFourth,TFifth,TSixth,TReturn>;(System.Data.IDbConnection,System.String,System.Func<TFirst,TSecond,TThird,TFourth,TFifth,TSixth,TReturn>,System.Object,System.Data.IDbTransaction,System.Boolean,System.String,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;Argument[2];Argument[2].Parameter[delegate-self];value;hq-generated |

csharp/ql/test/library-tests/dataflow/library/FlowSummariesFiltered.expected

@@ -8,7 +8,6 @@
 | Dapper;SqlMapper+GridReader;false;Read<TFirst,TSecond,TThird,TFourth,TReturn>;(System.Func<TFirst,TSecond,TThird,TFourth,TReturn>,System.String,System.Boolean);;Argument[0];Argument[0].Parameter[delegate-self];value;hq-generated |
 | Dapper;SqlMapper+GridReader;false;Read<TFirst,TSecond,TThird,TReturn>;(System.Func<TFirst,TSecond,TThird,TReturn>,System.String,System.Boolean);;Argument[0];Argument[0].Parameter[delegate-self];value;hq-generated |
 | Dapper;SqlMapper+GridReader;false;Read<TReturn>;(System.Type[],System.Func<System.Object[],TReturn>,System.String,System.Boolean);;Argument[1];Argument[1].Parameter[delegate-self];value;hq-generated |
-| Dapper;SqlMapper;false;AsList<T>;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;ReturnValue.Element;value;manual |
 | Dapper;SqlMapper;false;Query<TFirst,TSecond,TReturn>;(System.Data.IDbConnection,System.String,System.Func<TFirst,TSecond,TReturn>,System.Object,System.Data.IDbTransaction,System.Boolean,System.String,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;Argument[2];Argument[2].Parameter[delegate-self];value;hq-generated |
 | Dapper;SqlMapper;false;Query<TFirst,TSecond,TThird,TFourth,TFifth,TReturn>;(System.Data.IDbConnection,System.String,System.Func<TFirst,TSecond,TThird,TFourth,TFifth,TReturn>,System.Object,System.Data.IDbTransaction,System.Boolean,System.String,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;Argument[2];Argument[2].Parameter[delegate-self];value;hq-generated |
 | Dapper;SqlMapper;false;Query<TFirst,TSecond,TThird,TFourth,TFifth,TSixth,TReturn>;(System.Data.IDbConnection,System.String,System.Func<TFirst,TSecond,TThird,TFourth,TFifth,TSixth,TReturn>,System.Object,System.Data.IDbTransaction,System.Boolean,System.String,System.Nullable<System.Int32>,System.Nullable<System.Data.CommandType>);;Argument[2];Argument[2].Parameter[delegate-self];value;hq-generated |

docs/codeql/codeql-language-guides/codeql-for-javascript.rst

@@ -17,7 +17,6 @@ Experiment and learn how to write effective and efficient queries for CodeQL dat
    using-type-tracking-for-api-modeling
    abstract-syntax-tree-classes-for-working-with-javascript-and-typescript-programs
    data-flow-cheat-sheet-for-javascript
-   customizing-library-models-for-javascript
 
 -  :doc:`Basic query for JavaScript and TypeScript code <basic-query-for-javascript-code>`: Learn to write and run a simple CodeQL query.
 
@@ -34,5 +33,3 @@ Experiment and learn how to write effective and efficient queries for CodeQL dat
 -  :doc:`Abstract syntax tree classes for working with JavaScript and TypeScript programs <abstract-syntax-tree-classes-for-working-with-javascript-and-typescript-programs>`: CodeQL has a large selection of classes for representing the abstract syntax tree of JavaScript and TypeScript programs.
 
 -  :doc:`Data flow cheat sheet for JavaScript <data-flow-cheat-sheet-for-javascript>`: This article describes parts of the JavaScript libraries commonly used for variant analysis and in data flow queries.
-
-- :doc:`Customizing library models for JavaScript <customizing-library-models-for-javascript>`: You can model frameworks and libraries that your codebase depends on using data extensions and publish them as CodeQL model packs.

docs/codeql/codeql-language-guides/codeql-for-ruby.rst

@@ -13,7 +13,6 @@ Experiment and learn how to write effective and efficient queries for CodeQL dat
    abstract-syntax-tree-classes-for-working-with-ruby-programs
    analyzing-data-flow-in-ruby
    using-api-graphs-in-ruby
-   customizing-library-models-for-ruby
 
 -  :doc:`Basic query for Ruby code <basic-query-for-ruby-code>`: Learn to write and run a simple CodeQL query.
 
@@ -24,5 +23,3 @@ Experiment and learn how to write effective and efficient queries for CodeQL dat
 -  :doc:`Using API graphs in Ruby <using-api-graphs-in-ruby>`: API graphs are a uniform interface for referring to functions, classes, and methods defined in external libraries.
 
 -  :doc:`Abstract syntax tree classes for working with Ruby programs <abstract-syntax-tree-classes-for-working-with-ruby-programs>`: CodeQL has a large selection of classes for representing the abstract syntax tree of Ruby programs.
-
--  :doc:`Customizing library models for Ruby <customizing-library-models-for-ruby>`: You can model frameworks and libraries that your codebase depends on using data extensions and publish them as CodeQL model packs.

docs/codeql/codeql-language-guides/customizing-library-models-for-javascript.rst

@@ -1,5 +1,8 @@
 .. _customizing-library-models-for-javascript:
 
+:orphan:
+:nosearch:
+
 Customizing Library Models for JavaScript
 =========================================
 
@@ -27,6 +30,8 @@ The CodeQL library for JavaScript exposes the following extensible predicates:
 - **typeModel**\(type1, type2, path)
 - **summaryModel**\(type, path, input, output, kind)
 
+See the `CLI documentation for how to load and use data extensions in a CodeQL evaluation run <https://docs.google.com/document/d/14IYCHX8wWuU-HTvJ2gPSdXQKHKYbWCHQKOgn8oLaa80/edit#heading=h.m0v53lpi6w2n>`__ (internal access required).
+
 We'll explain how to use these using a few examples, and provide some reference material at the end of this article.
 
 Example: Taint sink in the 'execa' package

docs/codeql/codeql-language-guides/customizing-library-models-for-ruby.rst

@@ -1,402 +0,0 @@
-.. _customizing-library-models-for-ruby:
-
-
-Customizing Library Models for Ruby
-===================================
-
-.. include:: ../reusables/beta-note-customizing-library-models.rst
-
-Ruby analysis can be customized by adding library models in data extension files.
-
-A data extension for Ruby is a YAML file of the form:
-
-.. code-block:: yaml
-
-  extensions:
-    - addsTo:
-        pack: codeql/ruby-all
-        extensible: <name of extensible predicate>
-      data:
-        - <tuple1>
-        - <tuple2>
-        - ...
-
-The CodeQL library for Ruby exposes the following extensible predicates:
-
-- **sourceModel**\(type, path, kind)
-- **sinkModel**\(type, path, kind)
-- **typeModel**\(type1, type2, path)
-- **summaryModel**\(type, path, input, output, kind)
-
-We'll explain how to use these using a few examples, and provide some reference material at the end of this article.
-
-Example: Taint sink in the 'tty-command' gem
---------------------------------------------
-
-In this example, we'll show how to add the following argument, passed to **tty-command**, as a command-line injection sink:
-
-.. code-block:: ruby
-
-  tty = TTY::Command.new
-  tty.run(cmd) # <-- add 'cmd' as a taint sink
-
-For this example, you can use the following data extension:
-
-.. code-block:: yaml
-
-  extensions:
-    - addsTo:
-        pack: codeql/ruby-all
-        extensible: sinkModel
-      data:
-        - ["TTY::Command", "Method[run].Argument[0]", "command-injection"]
-
-
-- Since we're adding a new sink, we add a tuple to the **sinkModel** extensible predicate.
-- The first column, **"TTY::Command"**, identifies a set of values from which to begin the search for the sink.
-  The string **"TTY::Command""** means we start at the places where the codebase constructs instances of the class **TTY::Command**.
-- The second column is an access path that is evaluated from left to right, starting at the values that were identified by the first column.
-
-  - **Method[run]** selects calls to the **run** method of the **TTY::Command** class.
-  - **Argument[0]** selects the first argument to calls to that member.
-
-- **command-injection** indicates that this is considered a sink for the command injection query.
-
-Example: Taint sources from 'sinatra' block parameters
-------------------------------------------------------
-
-In this example, we'll show how the 'x' parameter below could be marked as a remote flow source:
-
-.. code-block:: ruby
-
-  class MyApp < Sinatra::Base
-    get '/' do |x| # <-- add 'x' as a taint source
-      # ...
-    end
-  end
-
-For this example you could use the following data extension:
-
-.. code-block:: yaml
-
-  extensions:
-    - addsTo:
-        pack: codeql/ruby-all
-        extensible: sourceModel
-      data:
-        - [
-            "Sinatra::Base!",
-            "Method[get].Argument[block].Parameter[0]",
-            "remote",
-          ]
-
-- Since we're adding a new taint source, we add a tuple to the **sourceModel** extensible predicate.
-- The first column, **"Sinatra::Base!"**, begins the search at references to the **Sinatra::Base** class.
-  The **!** suffix indicates that we want to search for references to the class itself, rather than instances of the class.
-- **Method[get]** selects calls to the **get** method of the **Sinatra::Base** class.
-- **Argument[block]** selects the block argument to the **get** method call.
-- **Parameter[0]** selects the first parameter of the block argument (the parameter named **x**).
-- Finally, the kind **remote** indicates that this is considered a source of remote flow.
-
-Example: Using types to add MySQL injection sinks
--------------------------------------------------
-
-In this example, we'll show how to add the following SQL injection sink:
-
-.. code-block:: ruby
-
-  def submit(q)
-    client = Mysql2::Client.new
-    client.query(q) # <-- add 'q' as a SQL injection sink
-  end
-
-We can recognize this using the following extension:
-
-.. code-block:: yaml
-
-  extensions:
-    - addsTo:
-        pack: codeql/ruby-all
-        extensible: sinkModel
-      data:
-        - ["Mysql2::Client", "Method[query].Argument[0]", "sql-injection"]
-
-- The first column, **"Mysql2::Client"**, begins the search at any instance of the **Mysql2::Client** class.
-- **Method[query]** selects any call to the **query** method on that instance.
-- **Argument[0]** selects the first argument to the method call.
-- **sql-injection** indicates that this is considered a sink for the SQL injection query.
-
-Continued example: Using type models
-------------------------------------
-
-Consider this variation on the previous example, the mysql2 EventMachine API is used.
-The client is obtained via a call to **Mysql2::EM::Client.new**.
-
-.. code-block:: ruby
-
-  def submit(client, q)
-    client = Mysql2::EM::Client.new
-    client.query(q)
-  end
-
-So far we have only one model for **Mysql2::Client**, but in the real world we
-may have many models for the various methods available. Because **Mysql2::EM::Client** is a subclass of **Mysql2::Client**, it inherits all of the same methods.
-Instead of updating all our models to include both classes, we can add a type
-model to indicate that **Mysql2::EM::Client** is a subclass of **Mysql2::Client**:
-
-.. code-block:: yaml
-
-  extensions:
-    - addsTo:
-        pack: codeql/ruby-all
-        extensible: typeModel
-      data:
-        - ["Mysql2::Client", "Mysql2::EM::Client", ""]
-
-Example: Adding flow through 'URI.decode_uri_component'
--------------------------------------------------------
-
-In this example, we'll show how to add flow through calls to 'URI.decode_uri_component':
-
-.. code-block:: ruby
-
-  y = URI.decode_uri_component(x); # add taint flow from 'x' to 'y'
-
-We can model this using the following data extension:
-
-.. code-block:: yaml
-
-  extensions:
-    - addsTo:
-        pack: codeql/ruby-all
-        extensible: summaryModel
-      data:
-        - [
-            "URI!",
-            "Method[decode_uri_component]",
-            "Argument[0]",
-            "ReturnValue",
-            "taint",
-          ]
-
-
-- Since we're adding flow through a method call, we add a tuple to the **summaryModel** extensible predicate.
-- The first column, **"URI!"**, begins the search for relevant calls at references to the **URI** class.
-- The **!** suffix indicates that we are looking for the class itself, rather than instances of the class.
-- The second column, **Method[decode_uri_component]**, is a path leading to the method calls we wish to model.
-  In this case, we select references to the **decode_uri_component** method from the **URI** class.
-- The third column, **Argument[0]**, indicates the input of the flow. In this case, the first argument to the method call.
-- The fourth column, **ReturnValue**, indicates the output of the flow. In this case, the return value of the method call.
-- The last column, **taint**, indicates the kind of flow to add. The value **taint** means the output is not necessarily equal
-  to the input, but was derived from the input in a taint-preserving way.
-
-Example: Adding flow through 'File#each'
-----------------------------------------
-
-In this example, we'll show how to add flow through calls to **File#each** from the standard library, which iterates over the lines of a file:
-
-.. code-block:: ruby
-
-  f = File.new("example.txt")
-  f.each { |line| ... } # add taint flow from `f` to `line`
-
-We can model this using the following data extension:
-
-.. code-block:: yaml
-
-  extensions:
-    - addsTo:
-        pack: codeql/ruby-all
-        extensible: summaryModel
-      data:
-        - [
-            "File",
-            "Method[each]",
-            "Argument[self]",
-            "Argument[block].Parameter[0]",
-            "taint",
-          ]
-
-
-- Since we're adding flow through a method call, we add a tuple to the **summaryModel** extensible predicate.
-- The first column, **"File"**, begins the search for relevant calls at places where the **File** class is used.
-- The second column, **Method[each]**, selects references to the **each** method on the **File** class.
-- The third column specifies the input of the flow. **Argument[self]** selects the **self** argument of **each**, which is the **File** instance being iterated over.
-
-- The fourth column specifies the output of the flow:
-
-  - **Argument[block]** selects the block argument of **each** (the block which is executed for each line in the file).
-  - **Parameter[0]** selects the first parameter of the block (the parameter named **line**).
-
-- The last column, **taint**, indicates the kind of flow to add.
-
-Reference material
-------------------
-
-The following sections provide reference material for extensible predicates, access paths, types, and kinds.
-
-Extensible predicates
----------------------
-
-sourceModel(type, path, kind)
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-Adds a new taint source. Most taint-tracking queries will use the new source.
-
-- **type**: Name of a type from which to evaluate **path**.
-- **path**: Access path leading to the source.
-- **kind**: Kind of source to add. Currently only **remote** is used.
-
-Example:
-
-.. code-block:: yaml
-
-  extensions:
-    - addsTo:
-        pack: codeql/ruby-all
-        extensible: sourceModel
-      data:
-        - ["User", "Method[name]", "remote"]
-
-sinkModel(type, path, kind)
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-Adds a new taint sink. Sinks are query-specific and will typically affect one or two queries.
-
-- **type**: Name of a type from which to evaluate **path**.
-- **path**: Access path leading to the sink.
-- **kind**: Kind of sink to add. See the section on sink kinds for a list of supported kinds.
-
-Example:
-
-.. code-block:: yaml
-
-  extensions:
-    - addsTo:
-        pack: codeql/ruby-all
-        extensible: sinkModel
-      data:
-        - ["ExecuteShell", "Method[run].Argument[0]", "command-injection"]
-
-summaryModel(type, path, input, output, kind)
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-Adds flow through a method call.
-
-- **type**: Name of a type from which to evaluate **path**.
-- **path**: Access path leading to a method call.
-- **input**: Path relative to the method call that leads to input of the flow.
-- **output**: Path relative to the method call leading to the output of the flow.
-- **kind**: Kind of summary to add. Can be **taint** for taint-propagating flow, or **value** for value-preserving flow.
-
-Example:
-
-.. code-block:: yaml
-
-  extensions:
-    - addsTo:
-        pack: codeql/ruby-all
-        extensible: summaryModel
-      data:
-        - [
-            "URI",
-            "Method[decode_uri_component]",
-            "Argument[0]",
-            "ReturnValue",
-            "taint",
-          ]
-
-typeModel(type1, type2, path)
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-Adds a new definition of a type.
-
-- **type1**: Name of the type to define.
-- **type2**: Name of the type from which to evaluate **path**.
-- **path**: Access path leading from **type2** to **type1**.
-
-Example:
-
-.. code-block:: yaml
-
-  extensions:
-  - addsTo:
-      pack: codeql/ruby-all
-      extensible: typeModel
-    data:
-      - [
-          "Mysql2::Client",
-          "MyDbWrapper",
-          "Method[getConnection].ReturnValue",
-        ]
-
-Types
------
-
-A type is a string that identifies a set of values.
-In each of the extensible predicates mentioned in previous section, the first column is always the name of a type.
-A type can be defined by adding **typeModel** tuples for that type.
-
-Access paths
-------------
-
-The **path**, **input**, and **output** columns consist of a **.**-separated list of components, which is evaluated from left to right,
-with each step selecting a new set of values derived from the previous set of values.
-
-The following components are supported:
-
-- **Argument[**\ `number`\ **]** selects the argument at the given index.
-- **Argument[**\ `string`:\ **]** selects the keyword argument with the given name.
-- **Argument[self]** selects the receiver of a method call.
-- **Argument[block]** selects the block argument.
-- **Argument[any]** selects any argument, except self or block arguments.
-- **Argument[any-named]** selects any keyword argument.
-- **Argument[hash-splat]** selects a special argument representing all keyword arguments passed in the method call.
-- **Parameter[**\ `number`\ **]** selects the argument at the given index.
-- **Parameter[**\ `string`:\ **]** selects the keyword argument with the given name.
-- **Parameter[self]** selects the **self** parameter of a method.
-- **Parameter[block]** selects the block parameter.
-- **Parameter[any]** selects any parameter, except self or block parameters.
-- **Parameter[any-named]** selects any keyword parameter.
-- **Parameter[hash-splat]** selects the hash splat parameter, often written as **\*\*kwargs**.
-- **ReturnValue** selects the return value of a call.
-- **Method[**\ `name`\ **]** selects a call to the method with the given name.
-- **Element[any]** selects any element of an array or hash.
-- **Element[**\ `number`\ **]** selects an array element at the given index.
-- **Element[**\ `string`\ **]** selects a hash element at the given key.
-- **Field[@**\ `string`\ **]** selects an instance variable with the given name.
-- **Fuzzy** selects all values that are derived from the current value through a combination of the other operations described in this list.
-  For example, this can be used to find all values that appear to originate from a particular class. This can be useful for finding method calls
-  from a known class, but where the receiver type is not known or is difficult to model.
-
-Additional notes about the syntax of operands:
-
-- Multiple operands may be given to a single component, as a shorthand for the union of the operands. For example, **Method[foo,bar]** matches the union of **Method[foo]** and **Method[bar]**.
-- Numeric operands to **Argument**, **Parameter**, and **Element** may be given as a lower bound. For example, **Argument[1..]** matches all arguments except 0.
-
-Kinds
------
-
-Source kinds
-~~~~~~~~~~~~
-
-- **remote**: A generic source of remote flow. Most taint-tracking queries will use such a source. Currently this is the only supported source kind.
-
-Sink kinds
-~~~~~~~~~~
-
-Unlike sources, sinks tend to be highly query-specific, rarely affecting more than one or two queries.
-Not every query supports customizable sinks. If the following sinks are not suitable for your use case, you should add a new query.
-
-- **code-injection**: A sink that can be used to inject code, such as in calls to **eval**.
-- **command-injection**: A sink that can be used to inject shell commands, such as in calls to **Process.spawn**.
-- **path-injection**: A sink that can be used for path injection in a file system access, such as in calls to **File.open**.
-- **sql-injection**: A sink that can be used for SQL injection, such as in an ActiveRecord **where** call.
-- **url-redirection**: A sink that can be used to redirect the user to a malicious URL.
-- **log-injection**: A sink that can be used for log injection, such as in a **Rails.logger** call.
-
-Summary kinds
-~~~~~~~~~~~~~
-
-- **taint**: A summary that propagates taint. This means the output is not necessarily equal to the input, but it was derived from the input in an unrestrictive way. An attacker who controls the input will have significant control over the output as well.
-- **value**: A summary that preserves the value of the input or creates a copy of the input such that all of its object properties are preserved.

docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.16.5.rst

@@ -1,25 +0,0 @@
-.. _codeql-cli-2.16.5:
-
-==========================
-CodeQL 2.16.5 (2024-03-21)
-==========================
-
-.. contents:: Contents
-   :depth: 2
-   :local:
-   :backlinks: none
-
-This is an overview of changes in the CodeQL CLI and relevant CodeQL query and library packs. For additional updates on changes to the CodeQL code scanning experience, check out the `code scanning section on the GitHub blog <https://github.blog/tag/code-scanning/>`__, `relevant GitHub Changelog updates <https://github.blog/changelog/label/code-scanning/>`__, `changes in the CodeQL extension for Visual Studio Code <https://marketplace.visualstudio.com/items/GitHub.vscode-codeql/changelog>`__, and the `CodeQL Action changelog <https://github.com/github/codeql-action/blob/main/CHANGELOG.md>`__.
-
-Security Coverage
------------------
-
-CodeQL 2.16.5 runs a total of 409 security queries when configured with the Default suite (covering 160 CWE). The Extended suite enables an additional 132 queries (covering 34 more CWE).
-
-CodeQL CLI
-----------
-
-New Features
-~~~~~~~~~~~~
-
-*   Beta support has been added for analyzing Java codebases without needing a working build. To enable this, pass the :code:`--build-mode none` option to :code:`codeql database create`.