Merge pull request #4844 from johnlugton/servicestack

Add provisional support for ServiceStack framework to feature branch

.codeqlmanifest.json

@@ -1,7 +1,5 @@
-{ "provide": [ "*/ql/lib/qlpack.yml",
-               "*/ql/src/qlpack.yml",
+{ "provide": [ "*/ql/src/qlpack.yml",
                "*/ql/test/qlpack.yml",
-               "cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/qlpack.yml",
                "*/ql/examples/qlpack.yml",
                "*/upgrades/qlpack.yml",
                "misc/legacy-support/*/qlpack.yml",

.github/workflows/check-change-note.yml

@@ -1,23 +0,0 @@
-name: Check change note
-
-on:
-  pull_request_target:
-    types: [labeled, unlabeled, opened, synchronize, reopened, ready_for_review]
-    paths:
-      - "*/ql/src/**/*.ql"
-      - "*/ql/src/**/*.qll"
-      - "!**/experimental/**"
-
-jobs:
-  check-change-note:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Fail if no change note found. To fix, either add one, or add the `no-change-note-required` label.
-        if: |
-          github.event.pull_request.draft == false &&
-          !contains(github.event.pull_request.labels.*.name, 'no-change-note-required')
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          gh api 'repos/${{github.repository}}/pulls/${{github.event.number}}/files' --paginate --jq 'any(.[].filename ; test("/change-notes/.*[.]md$"))' |
-          grep true -c

.github/workflows/close-stale.yml

@@ -1,30 +0,0 @@
-name: Mark stale issues
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: "30 1 * * *"
-
-jobs:
-  stale:
-    if: github.repository == 'github/codeql'
-
-    runs-on: ubuntu-latest
-
-    steps:
-    - uses: actions/stale@v3
-      with:
-        repo-token: ${{ secrets.GITHUB_TOKEN }}
-        stale-issue-message: 'This issue is stale because it has been open 14 days with no activity. Comment or remove the `Stale` label in order to avoid having this issue closed in 7 days.'
-        close-issue-message: 'This issue was closed because it has been inactive for 7 days.'
-        days-before-stale: 14
-        days-before-close: 7
-        only-labels: awaiting-response
-
-        # do not mark PRs as stale
-        days-before-pr-stale: -1
-        days-before-pr-close: -1
-
-        # Uncomment for dry-run
-        # debug-only: true
-        # operations-per-run: 1000

.github/workflows/codeql-analysis.yml

@@ -2,15 +2,7 @@ name: "Code scanning - action"
 
 on:
   push:
-    branches:
-      - main
-      - 'rc/*'
   pull_request:
-    branches:
-      - main
-      - 'rc/*'
-    paths:
-      - 'csharp/**'
   schedule:
     - cron: '0 9 * * 1'
 
@@ -19,18 +11,22 @@ jobs:
 
     runs-on: ubuntu-latest
 
-    permissions:
-      contents: read
-      security-events: write
-      pull-requests: read
-
     steps:
     - name: Checkout repository
       uses: actions/checkout@v2
+      with:
+        # We must fetch at least the immediate parents so that if this is
+        # a pull request then we can checkout the head.
+        fetch-depth: 2
 
+    # If this run was triggered by a pull request event, then checkout
+    # the head of the pull request instead of the merge commit.
+    - run: git checkout HEAD^2
+      if: ${{ github.event_name == 'pull_request' }}
+      
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@main
+      uses: github/codeql-action/init@v1
       # Override language selection by uncommenting this and choosing your languages
       with:
         languages: csharp
@@ -39,7 +35,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@main
+      uses: github/codeql-action/autobuild@v1
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -53,4 +49,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@main
+      uses: github/codeql-action/analyze@v1

.github/workflows/csv-coverage-pr-artifacts.yml

@@ -1,97 +0,0 @@
-name: Check framework coverage changes
-
-on:
-  pull_request:
-    paths:
-      - '.github/workflows/csv-coverage-pr-comment.yml'
-      - '*/ql/src/**/*.ql'
-      - '*/ql/src/**/*.qll'
-      - 'misc/scripts/library-coverage/*.py'
-      # input data files
-      - '*/documentation/library-coverage/cwe-sink.csv'
-      - '*/documentation/library-coverage/frameworks.csv'
-    branches:
-      - main
-      - 'rc/*'
-
-jobs:
-  generate:
-    name: Generate framework coverage artifacts
-
-    runs-on: ubuntu-latest
-
-    steps:
-    - name: Dump GitHub context
-      env:
-        GITHUB_CONTEXT: ${{ toJSON(github.event) }}
-      run: echo "$GITHUB_CONTEXT"
-    - name: Clone self (github/codeql) - MERGE
-      uses: actions/checkout@v2
-      with:
-        path: merge
-    - name: Clone self (github/codeql) - BASE
-      uses: actions/checkout@v2
-      with:
-        fetch-depth: 2
-        path: base
-    - run: |
-        git checkout HEAD^1
-        git log -1 --format='%H'
-      working-directory: base
-    - name: Set up Python 3.8
-      uses: actions/setup-python@v2
-      with:
-        python-version: 3.8
-    - name: Download CodeQL CLI
-      env:
-         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: |
-         gh release download --repo "github/codeql-cli-binaries" --pattern "codeql-linux64.zip"
-    - name: Unzip CodeQL CLI
-      run: unzip -d codeql-cli codeql-linux64.zip
-    - name: Generate CSV files on merge commit of the PR
-      run: |
-        echo "Running generator on merge"
-        PATH="$PATH:codeql-cli/codeql" python merge/misc/scripts/library-coverage/generate-report.py ci merge merge
-        mkdir out_merge
-        cp framework-coverage-*.csv out_merge/
-        cp framework-coverage-*.rst out_merge/
-    - name: Generate CSV files on base commit of the PR
-      run: |
-        echo "Running generator on base"
-        PATH="$PATH:codeql-cli/codeql" python base/misc/scripts/library-coverage/generate-report.py ci base base
-        mkdir out_base
-        cp framework-coverage-*.csv out_base/
-        cp framework-coverage-*.rst out_base/
-    - name: Generate diff of coverage reports
-      run: |
-        python base/misc/scripts/library-coverage/compare-folders.py out_base out_merge comparison.md
-    - name: Upload CSV package list
-      uses: actions/upload-artifact@v2
-      with:
-        name: csv-framework-coverage-merge
-        path: |
-          out_merge/framework-coverage-*.csv
-          out_merge/framework-coverage-*.rst
-    - name: Upload CSV package list
-      uses: actions/upload-artifact@v2
-      with:
-        name: csv-framework-coverage-base
-        path: |
-          out_base/framework-coverage-*.csv
-          out_base/framework-coverage-*.rst
-    - name: Upload comparison results
-      uses: actions/upload-artifact@v2
-      with:
-        name: comparison
-        path: |
-          comparison.md
-    - name: Save PR number
-      run: |
-        mkdir -p pr
-        echo ${{ github.event.pull_request.number }} > pr/NR
-    - name: Upload PR number
-      uses: actions/upload-artifact@v2
-      with:
-        name: pr
-        path: pr/

.github/workflows/csv-coverage-pr-comment.yml

@@ -1,34 +0,0 @@
-name: Comment on PR with framework coverage changes
-
-on:
-  workflow_run:
-    workflows: ["Check framework coverage changes"]
-    types:
-      - completed
-
-jobs:
-  check:
-    name: Check framework coverage differences and comment
-    runs-on: ubuntu-latest
-    if: >
-      ${{ github.event.workflow_run.event == 'pull_request' &&
-      github.event.workflow_run.conclusion == 'success' }}
-
-    steps:
-    - name: Dump GitHub context
-      env:
-        GITHUB_CONTEXT: ${{ toJSON(github.event) }}
-      run: echo "$GITHUB_CONTEXT"
-    - name: Clone self (github/codeql)
-      uses: actions/checkout@v2
-    - name: Set up Python 3.8
-      uses: actions/setup-python@v2
-      with:
-        python-version: 3.8
-
-    - name: Check coverage difference file and comment
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        RUN_ID: ${{ github.event.workflow_run.id }}
-      run: |
-        python misc/scripts/library-coverage/comment-pr.py "$GITHUB_REPOSITORY" "$RUN_ID"

.github/workflows/csv-coverage-timeseries.yml

@@ -1,42 +0,0 @@
-name: Build framework coverage timeseries reports
-
-on:
-  workflow_dispatch:
-
-jobs:
-  build:
-
-    runs-on: ubuntu-latest
-
-    steps:
-    - name: Clone self (github/codeql)
-      uses: actions/checkout@v2
-      with:
-        path: script
-    - name: Clone self (github/codeql) for analysis
-      uses: actions/checkout@v2
-      with:
-        path: codeqlModels
-        fetch-depth: 0
-    - name: Set up Python 3.8
-      uses: actions/setup-python@v2
-      with:
-        python-version: 3.8
-    - name: Download CodeQL CLI
-      env:
-         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: |
-         gh release download --repo "github/codeql-cli-binaries" --pattern "codeql-linux64.zip"
-    - name: Unzip CodeQL CLI
-      run: unzip -d codeql-cli codeql-linux64.zip
-    - name: Build modeled package list
-      run: |
-        CLI=$(realpath "codeql-cli/codeql")
-        echo $CLI
-        PATH="$PATH:$CLI" python script/misc/scripts/library-coverage/generate-timeseries.py codeqlModels
-    - name: Upload timeseries CSV
-      uses: actions/upload-artifact@v2
-      with:
-        name: framework-coverage-timeseries
-        path: framework-coverage-timeseries-*.csv
-

.github/workflows/csv-coverage-update.yml

@@ -1,44 +0,0 @@
-name: Update framework coverage reports
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: "0 0 * * *"
-
-jobs:
-  update:
-    name: Update framework coverage report
-    if: github.event.repository.fork == false
-    runs-on: ubuntu-latest
-
-    steps:
-    - name: Dump GitHub context
-      env:
-        GITHUB_CONTEXT: ${{ toJSON(github.event) }}
-      run: echo "$GITHUB_CONTEXT"
-    - name: Clone self (github/codeql)
-      uses: actions/checkout@v2
-      with:
-        path: ql
-        fetch-depth: 0
-    - name: Set up Python 3.8
-      uses: actions/setup-python@v2
-      with:
-        python-version: 3.8
-    - name: Download CodeQL CLI
-      env:
-         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: |
-         gh release download --repo "github/codeql-cli-binaries" --pattern "codeql-linux64.zip"
-    - name: Unzip CodeQL CLI
-      run: unzip -d codeql-cli codeql-linux64.zip
-
-    - name: Generate coverage files
-      run: |
-        PATH="$PATH:codeql-cli/codeql" python ql/misc/scripts/library-coverage/generate-report.py ci ql ql
-
-    - name: Create pull request with changes
-      env:
-         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: |
-        python ql/misc/scripts/library-coverage/create-pr.py ql "$GITHUB_REPOSITORY"

.github/workflows/csv-coverage.yml

@@ -1,49 +0,0 @@
-name: Build framework coverage reports
-
-on:
-  workflow_dispatch:
-    inputs:
-      qlModelShaOverride:
-        description: 'github/codeql repo SHA used for looking up the CSV models'
-        required: false
-
-jobs:
-  build:
-
-    runs-on: ubuntu-latest
-
-    steps:
-    - name: Clone self (github/codeql)
-      uses: actions/checkout@v2
-      with:
-        path: script
-    - name: Clone self (github/codeql) for analysis
-      uses: actions/checkout@v2
-      with:
-        path: codeqlModels
-        ref: ${{ github.event.inputs.qlModelShaOverride || github.ref }}
-    - name: Set up Python 3.8
-      uses: actions/setup-python@v2
-      with:
-        python-version: 3.8
-    - name: Download CodeQL CLI
-      env:
-         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: |
-         gh release download --repo "github/codeql-cli-binaries" --pattern "codeql-linux64.zip"
-    - name: Unzip CodeQL CLI
-      run: unzip -d codeql-cli codeql-linux64.zip
-    - name: Build modeled package list
-      run: |
-        PATH="$PATH:codeql-cli/codeql" python script/misc/scripts/library-coverage/generate-report.py ci codeqlModels script
-    - name: Upload CSV package list
-      uses: actions/upload-artifact@v2
-      with:
-        name: framework-coverage-csv
-        path: framework-coverage-*.csv
-    - name: Upload RST package list
-      uses: actions/upload-artifact@v2
-      with:
-        name: framework-coverage-rst
-        path: framework-coverage-*.rst
-

.github/workflows/generate-query-help-docs.yml

@@ -0,0 +1,57 @@
+name: Generate CodeQL query help documentation using Sphinx
+
+on:
+  push:
+    branches:
+     - main
+     - 'rc/**'
+     - 'lgtm.com'
+  pull_request:
+    paths:
+      - '.github/workflows/generate-query-help-docs.yml'
+      - 'docs/codeql/query-help/**'
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Clone github/codeql
+      uses: actions/checkout@v2
+      with:
+        path: codeql 
+    - name: Clone github/codeql-go
+      uses: actions/checkout@v2
+      with:
+        repository: 'github/codeql-go'
+        path: codeql-go
+    - name: Set up Python 3.8
+      uses: actions/setup-python@v2
+      with:
+        python-version: 3.8
+    - name: Download CodeQL CLI
+      uses: dsaltares/fetch-gh-release-asset@aa37ae5c44d3c9820bc12fe675e8670ecd93bd1c
+      with:
+        repo: "github/codeql-cli-binaries"
+        version: "latest"
+        file: "codeql-linux64.zip"
+        token: ${{ secrets.GITHUB_TOKEN }}
+    - name: Unzip CodeQL CLI
+      run: unzip -d codeql-cli codeql-linux64.zip
+    - name: Set up query help docs folder  
+      run: |
+        cp -r codeql/docs/codeql/** .
+    - name: Query help to markdown
+      run: |
+        PATH="$PATH:codeql-cli/codeql" python codeql/docs/codeql/query-help-markdown.py
+    - name: Run Sphinx for query help
+      uses: ammaraskar/sphinx-action@8b4f60114d7fd1faeba1a712269168508d4750d2 # v0.4
+      with:
+        docs-folder: "query-help/"
+        pre-build-command: "python -m pip install --upgrade recommonmark"
+        build-command: "sphinx-build -b dirhtml . _build" 
+    - name: Upload HTML artifacts
+      uses: actions/upload-artifact@v2
+      with:
+        name: query-help-html
+        path: query-help/_build
+    

.gitignore

@@ -5,7 +5,6 @@
 
 # query compilation caches
 .cache
-data
 
 # qltest projects and artifacts
 */ql/test/**/*.testproj
@@ -18,14 +17,7 @@ data
 # Byte-compiled python files
 *.pyc
 
-# python virtual environment folder 
-.venv/
-
 # It's useful (though not required) to be able to unpack codeql in the ql checkout itself
 /codeql/
 
-# Exclude output directories for compiled packs.
-.codeql/
-
 csharp/extractor/Semmle.Extraction.CSharp.Driver/Properties/launchSettings.json
-

.vscode/settings.json

@@ -1,3 +1,3 @@
 {
     "omnisharp.autoStart": false
-}
+}

CODEOWNERS

@@ -4,16 +4,17 @@
 /javascript/ @github/codeql-javascript
 /python/ @github/codeql-python
 
-# Make @xcorail (GitHub Security Lab) a code owner for experimental queries so he gets pinged when we promote a query out of experimental
-/cpp/**/experimental/**/* @github/codeql-c-analysis @xcorail
-/csharp/**/experimental/**/* @github/codeql-csharp @xcorail
-/java/**/experimental/**/* @github/codeql-java @xcorail
-/javascript/**/experimental/**/* @github/codeql-javascript @xcorail
-/python/**/experimental/**/* @github/codeql-python @xcorail
+# Assign query help for docs review
+/cpp/**/*.qhelp @hubwriter
+/csharp/**/*.qhelp @jf205
+/java/**/*.qhelp @felicitymay
+/javascript/**/*.qhelp @mchammer01
+/python/**/*.qhelp @felicitymay
+/docs/language/ @shati-patel @jf205
 
-# Notify members of codeql-go about PRs to the shared data-flow library files
-/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl.qll @github/codeql-java @github/codeql-go
-/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl2.qll @github/codeql-java @github/codeql-go
-/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImplCommon.qll @github/codeql-java @github/codeql-go
-/java/ql/src/semmle/code/java/dataflow/internal/tainttracking1/TaintTrackingImpl.qll @github/codeql-java @github/codeql-go
-/java/ql/src/semmle/code/java/dataflow/internal/tainttracking2/TaintTrackingImpl.qll @github/codeql-java @github/codeql-go
+# Exclude help for experimental queries from docs review
+/cpp/**/experimental/**/*.qhelp @github/codeql-c-analysis
+/csharp/**/experimental/**/*.qhelp @github/codeql-csharp
+/java/**/experimental/**/*.qhelp @github/codeql-java
+/javascript/**/experimental/**/*.qhelp @github/codeql-javascript
+/python/**/experimental/**/*.qhelp @github/codeql-python

CONTRIBUTING.md

@@ -38,8 +38,6 @@ If you have an idea for a query that you would like to share with other CodeQL u
 
     - The queries and libraries must be autoformatted, for example using the "Format Document" command in [CodeQL for Visual Studio Code](https://help.semmle.com/codeql/codeql-for-vscode/procedures/about-codeql-for-vscode.html).
 
-    If you prefer, you can use this [pre-commit hook](misc/scripts/pre-commit) that automatically checks whether your files are correctly formatted. See the [pre-commit hook installation guide](docs/pre-commit-hook-setup.md) for instructions on how to install the hook.
-
 4. **Compilation**
 
     - Compilation of the query and any associated libraries and tests must be resilient to future development of the [supported](docs/supported-queries.md) libraries. This means that the functionality cannot use internal libraries, cannot depend on the output of `getAQlClass`, and cannot make use of regexp matching on `toString`.
@@ -49,11 +47,7 @@ If you have an idea for a query that you would like to share with other CodeQL u
 
     - The query must have at least one true positive result on some revision of a real project.
 
-6. **Query help files and unit tests**
-
-	- Query help (`.qhelp`) files and unit tests are optional (but strongly encouraged!) for queries in the `experimental` directories. For more information about contributing query help files and unit tests, see [Supported CodeQL queries and libraries](docs/supported-queries.md).
-
-Experimental queries and libraries may not be actively maintained as the supported libraries evolve. They may also be changed in backwards-incompatible ways or may be removed entirely in the future without deprecation warnings.
+Experimental queries and libraries may not be actively maintained as the [supported](docs/supported-queries.md) libraries evolve. They may also be changed in backwards-incompatible ways or may be removed entirely in the future without deprecation warnings.
 
 After the experimental query is merged, we welcome pull requests to improve it. Before a query can be moved out of the `experimental` subdirectory, it must satisfy [the requirements for being a supported query](docs/supported-queries.md).
 

config/identical-files.json

@@ -1,332 +1,322 @@
 {
   "DataFlow Java/C++/C#/Python": [
-    "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl.qll",
-    "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl2.qll",
-    "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl3.qll",
-    "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl4.qll",
-    "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl5.qll",
-    "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl6.qll",
-    "cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll",
-    "cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll",
-    "cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll",
-    "cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll",
-    "cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplLocal.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl2.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl3.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl4.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl5.qll",
-    "python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl.qll",
-    "python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl2.qll",
-    "python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl3.qll",
-    "python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl4.qll"
+    "java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl.qll",
+    "java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl2.qll",
+    "java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl3.qll",
+    "java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl4.qll",
+    "java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl5.qll",
+    "cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll",
+    "cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll",
+    "cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll",
+    "cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll",
+    "cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImplLocal.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl2.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl3.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl4.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl5.qll",
+    "python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl.qll",
+    "python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl2.qll",
+    "python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl3.qll",
+    "python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl4.qll"
   ],
   "DataFlow Java/C++/C#/Python Common": [
-    "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImplCommon.qll",
-    "cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplCommon.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplCommon.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImplCommon.qll",
-    "python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImplCommon.qll"
+    "java/ql/src/semmle/code/java/dataflow/internal/DataFlowImplCommon.qll",
+    "cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImplCommon.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImplCommon.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImplCommon.qll",
+    "python/ql/src/semmle/python/dataflow/new/internal/DataFlowImplCommon.qll"
   ],
   "TaintTracking::Configuration Java/C++/C#/Python": [
-    "cpp/ql/lib/semmle/code/cpp/dataflow/internal/tainttracking1/TaintTrackingImpl.qll",
-    "cpp/ql/lib/semmle/code/cpp/dataflow/internal/tainttracking2/TaintTrackingImpl.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/tainttracking1/TaintTrackingImpl.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/tainttracking2/TaintTrackingImpl.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/tainttracking3/TaintTrackingImpl.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/tainttracking1/TaintTrackingImpl.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/tainttracking2/TaintTrackingImpl.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/tainttracking3/TaintTrackingImpl.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/tainttracking4/TaintTrackingImpl.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/tainttracking5/TaintTrackingImpl.qll",
-    "java/ql/lib/semmle/code/java/dataflow/internal/tainttracking1/TaintTrackingImpl.qll",
-    "java/ql/lib/semmle/code/java/dataflow/internal/tainttracking2/TaintTrackingImpl.qll",
-    "python/ql/lib/semmle/python/dataflow/new/internal/tainttracking1/TaintTrackingImpl.qll",
-    "python/ql/lib/semmle/python/dataflow/new/internal/tainttracking2/TaintTrackingImpl.qll",
-    "python/ql/lib/semmle/python/dataflow/new/internal/tainttracking3/TaintTrackingImpl.qll",
-    "python/ql/lib/semmle/python/dataflow/new/internal/tainttracking4/TaintTrackingImpl.qll"
+    "cpp/ql/src/semmle/code/cpp/dataflow/internal/tainttracking1/TaintTrackingImpl.qll",
+    "cpp/ql/src/semmle/code/cpp/dataflow/internal/tainttracking2/TaintTrackingImpl.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/tainttracking1/TaintTrackingImpl.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/tainttracking2/TaintTrackingImpl.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/tainttracking1/TaintTrackingImpl.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/tainttracking2/TaintTrackingImpl.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/tainttracking3/TaintTrackingImpl.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/tainttracking4/TaintTrackingImpl.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/tainttracking5/TaintTrackingImpl.qll",
+    "java/ql/src/semmle/code/java/dataflow/internal/tainttracking1/TaintTrackingImpl.qll",
+    "java/ql/src/semmle/code/java/dataflow/internal/tainttracking2/TaintTrackingImpl.qll",
+    "python/ql/src/semmle/python/dataflow/new/internal/tainttracking1/TaintTrackingImpl.qll",
+    "python/ql/src/semmle/python/dataflow/new/internal/tainttracking2/TaintTrackingImpl.qll",
+    "python/ql/src/semmle/python/dataflow/new/internal/tainttracking3/TaintTrackingImpl.qll",
+    "python/ql/src/semmle/python/dataflow/new/internal/tainttracking4/TaintTrackingImpl.qll"
   ],
   "DataFlow Java/C++/C#/Python Consistency checks": [
-    "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImplConsistency.qll",
-    "cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplConsistency.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplConsistency.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImplConsistency.qll",
-    "python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImplConsistency.qll"
-  ],
-  "DataFlow Java/C# Flow Summaries": [
-    "java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll"
+    "java/ql/src/semmle/code/java/dataflow/internal/DataFlowImplConsistency.qll",
+    "cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImplConsistency.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImplConsistency.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImplConsistency.qll",
+    "python/ql/src/semmle/python/dataflow/new/internal/DataFlowImplConsistency.qll"
   ],
   "SsaReadPosition Java/C#": [
-    "java/ql/lib/semmle/code/java/dataflow/internal/rangeanalysis/SsaReadPositionCommon.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/SsaReadPositionCommon.qll"
+    "java/ql/src/semmle/code/java/dataflow/internal/rangeanalysis/SsaReadPositionCommon.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/rangeanalysis/SsaReadPositionCommon.qll"
   ],
   "Sign Java/C#": [
-    "java/ql/lib/semmle/code/java/dataflow/internal/rangeanalysis/Sign.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/Sign.qll"
+    "java/ql/src/semmle/code/java/dataflow/internal/rangeanalysis/Sign.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/rangeanalysis/Sign.qll"
   ],
   "SignAnalysis Java/C#": [
-    "java/ql/lib/semmle/code/java/dataflow/internal/rangeanalysis/SignAnalysisCommon.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/SignAnalysisCommon.qll"
+    "java/ql/src/semmle/code/java/dataflow/internal/rangeanalysis/SignAnalysisCommon.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/rangeanalysis/SignAnalysisCommon.qll"
   ],
   "Bound Java/C#": [
-    "java/ql/lib/semmle/code/java/dataflow/Bound.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/Bound.qll"
+    "java/ql/src/semmle/code/java/dataflow/Bound.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/Bound.qll"
   ],
   "ModulusAnalysis Java/C#": [
-    "java/ql/lib/semmle/code/java/dataflow/ModulusAnalysis.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/ModulusAnalysis.qll"
+    "java/ql/src/semmle/code/java/dataflow/ModulusAnalysis.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/ModulusAnalysis.qll"
   ],
   "C++ SubBasicBlocks": [
-    "cpp/ql/lib/semmle/code/cpp/controlflow/SubBasicBlocks.qll",
-    "cpp/ql/lib/semmle/code/cpp/dataflow/internal/SubBasicBlocks.qll"
+    "cpp/ql/src/semmle/code/cpp/controlflow/SubBasicBlocks.qll",
+    "cpp/ql/src/semmle/code/cpp/dataflow/internal/SubBasicBlocks.qll"
   ],
   "IR Instruction": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/Instruction.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/Instruction.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll",
     "csharp/ql/src/experimental/ir/implementation/raw/Instruction.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/Instruction.qll"
   ],
   "IR IRBlock": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/IRBlock.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/IRBlock.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/IRBlock.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/IRBlock.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/IRBlock.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/IRBlock.qll",
     "csharp/ql/src/experimental/ir/implementation/raw/IRBlock.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/IRBlock.qll"
   ],
   "IR IRVariable": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/IRVariable.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/IRVariable.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/IRVariable.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/IRVariable.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/IRVariable.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/IRVariable.qll",
     "csharp/ql/src/experimental/ir/implementation/raw/IRVariable.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/IRVariable.qll"
   ],
   "IR IRFunction": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/IRFunction.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/IRFunction.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/IRFunction.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/IRFunction.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/IRFunction.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/IRFunction.qll",
     "csharp/ql/src/experimental/ir/implementation/raw/IRFunction.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/IRFunction.qll"
   ],
   "IR Operand": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/Operand.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/Operand.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/Operand.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/Operand.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/Operand.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/Operand.qll",
     "csharp/ql/src/experimental/ir/implementation/raw/Operand.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/Operand.qll"
   ],
   "IR IRType": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/IRType.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/IRType.qll",
     "csharp/ql/src/experimental/ir/implementation/IRType.qll"
   ],
   "IR IRConfiguration": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/IRConfiguration.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/IRConfiguration.qll",
     "csharp/ql/src/experimental/ir/implementation/IRConfiguration.qll"
   ],
   "IR UseSoundEscapeAnalysis": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/UseSoundEscapeAnalysis.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/UseSoundEscapeAnalysis.qll",
     "csharp/ql/src/experimental/ir/implementation/UseSoundEscapeAnalysis.qll"
   ],
   "IR IRFunctionBase": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/internal/IRFunctionBase.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/internal/IRFunctionBase.qll",
     "csharp/ql/src/experimental/ir/implementation/internal/IRFunctionBase.qll"
   ],
   "IR Operand Tag": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/internal/OperandTag.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/internal/OperandTag.qll",
     "csharp/ql/src/experimental/ir/implementation/internal/OperandTag.qll"
   ],
   "IR TInstruction": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/internal/TInstruction.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/internal/TInstruction.qll",
     "csharp/ql/src/experimental/ir/implementation/internal/TInstruction.qll"
   ],
   "IR TIRVariable": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/internal/TIRVariable.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/internal/TIRVariable.qll",
     "csharp/ql/src/experimental/ir/implementation/internal/TIRVariable.qll"
   ],
   "IR IR": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/IR.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/IR.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/IR.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/IR.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/IR.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/IR.qll",
     "csharp/ql/src/experimental/ir/implementation/raw/IR.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/IR.qll"
   ],
   "IR IRConsistency": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/IRConsistency.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/IRConsistency.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/IRConsistency.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/IRConsistency.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/IRConsistency.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/IRConsistency.qll",
     "csharp/ql/src/experimental/ir/implementation/raw/IRConsistency.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/IRConsistency.qll"
   ],
   "IR PrintIR": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/PrintIR.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/PrintIR.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/PrintIR.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/PrintIR.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/PrintIR.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/PrintIR.qll",
     "csharp/ql/src/experimental/ir/implementation/raw/PrintIR.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/PrintIR.qll"
   ],
   "IR IntegerConstant": [
-    "cpp/ql/lib/semmle/code/cpp/ir/internal/IntegerConstant.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/internal/IntegerConstant.qll",
     "csharp/ql/src/experimental/ir/internal/IntegerConstant.qll"
   ],
   "IR IntegerInteval": [
-    "cpp/ql/lib/semmle/code/cpp/ir/internal/IntegerInterval.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/internal/IntegerInterval.qll",
     "csharp/ql/src/experimental/ir/internal/IntegerInterval.qll"
   ],
   "IR IntegerPartial": [
-    "cpp/ql/lib/semmle/code/cpp/ir/internal/IntegerPartial.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/internal/IntegerPartial.qll",
     "csharp/ql/src/experimental/ir/internal/IntegerPartial.qll"
   ],
   "IR Overlap": [
-    "cpp/ql/lib/semmle/code/cpp/ir/internal/Overlap.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/internal/Overlap.qll",
     "csharp/ql/src/experimental/ir/internal/Overlap.qll"
   ],
   "IR EdgeKind": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/EdgeKind.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/EdgeKind.qll",
     "csharp/ql/src/experimental/ir/implementation/EdgeKind.qll"
   ],
   "IR MemoryAccessKind": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/MemoryAccessKind.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/MemoryAccessKind.qll",
     "csharp/ql/src/experimental/ir/implementation/MemoryAccessKind.qll"
   ],
   "IR TempVariableTag": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/TempVariableTag.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/TempVariableTag.qll",
     "csharp/ql/src/experimental/ir/implementation/TempVariableTag.qll"
   ],
   "IR Opcode": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/Opcode.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/Opcode.qll",
     "csharp/ql/src/experimental/ir/implementation/Opcode.qll"
   ],
   "IR SSAConsistency": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConsistency.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConsistency.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConsistency.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConsistency.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/SSAConsistency.qll"
   ],
   "C++ IR InstructionImports": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/InstructionImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/InstructionImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/InstructionImports.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/InstructionImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/InstructionImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/InstructionImports.qll"
   ],
   "C++ IR IRImports": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/IRImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/IRImports.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/IRImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/IRImports.qll"
   ],
   "C++ IR IRBlockImports": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/IRBlockImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRBlockImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/IRBlockImports.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/IRBlockImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRBlockImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/IRBlockImports.qll"
   ],
   "C++ IR IRFunctionImports": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/IRFunctionImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRFunctionImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/IRFunctionImports.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/IRFunctionImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRFunctionImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/IRFunctionImports.qll"
   ],
   "C++ IR IRVariableImports": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/IRVariableImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRVariableImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/IRVariableImports.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/IRVariableImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRVariableImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/IRVariableImports.qll"
   ],
   "C++ IR OperandImports": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/OperandImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/OperandImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/OperandImports.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/OperandImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/OperandImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/OperandImports.qll"
   ],
   "C++ IR PrintIRImports": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/PrintIRImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/PrintIRImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/PrintIRImports.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/PrintIRImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/PrintIRImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/PrintIRImports.qll"
   ],
   "C++ SSA SSAConstructionImports": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConstructionImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstructionImports.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConstructionImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstructionImports.qll"
   ],
   "SSA AliasAnalysis": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysis.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysis.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll"
   ],
-  "SSA PrintAliasAnalysis": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/PrintAliasAnalysis.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/PrintAliasAnalysis.qll"
-  ],
   "C++ SSA AliasAnalysisImports": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysisImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysisImports.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysisImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysisImports.qll"
   ],
   "C++ IR ValueNumberingImports": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/gvn/internal/ValueNumberingImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/internal/ValueNumberingImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/internal/ValueNumberingImports.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/gvn/internal/ValueNumberingImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/internal/ValueNumberingImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/internal/ValueNumberingImports.qll"
   ],
   "IR SSA SimpleSSA": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SimpleSSA.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SimpleSSA.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/SimpleSSA.qll"
   ],
   "IR AliasConfiguration (unaliased_ssa)": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasConfiguration.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasConfiguration.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/AliasConfiguration.qll"
   ],
   "IR SSA SSAConstruction": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstruction.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstruction.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll"
   ],
   "IR SSA PrintSSA": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/PrintSSA.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/PrintSSA.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/PrintSSA.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/PrintSSA.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/PrintSSA.qll"
   ],
   "IR ValueNumberInternal": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/gvn/internal/ValueNumberingInternal.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/internal/ValueNumberingInternal.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/internal/ValueNumberingInternal.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/gvn/internal/ValueNumberingInternal.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/internal/ValueNumberingInternal.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/internal/ValueNumberingInternal.qll",
     "csharp/ql/src/experimental/ir/implementation/raw/gvn/internal/ValueNumberingInternal.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/gvn/internal/ValueNumberingInternal.qll"
   ],
   "C++ IR ValueNumber": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/gvn/ValueNumbering.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/ValueNumbering.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/ValueNumbering.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/gvn/ValueNumbering.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/ValueNumbering.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/ValueNumbering.qll",
     "csharp/ql/src/experimental/ir/implementation/raw/gvn/ValueNumbering.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/gvn/ValueNumbering.qll"
   ],
   "C++ IR PrintValueNumbering": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/gvn/PrintValueNumbering.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/PrintValueNumbering.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/PrintValueNumbering.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/gvn/PrintValueNumbering.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/PrintValueNumbering.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/PrintValueNumbering.qll",
     "csharp/ql/src/experimental/ir/implementation/raw/gvn/PrintValueNumbering.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/gvn/PrintValueNumbering.qll"
   ],
   "C++ IR ConstantAnalysis": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/constant/ConstantAnalysis.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/constant/ConstantAnalysis.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/constant/ConstantAnalysis.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/constant/ConstantAnalysis.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/constant/ConstantAnalysis.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/constant/ConstantAnalysis.qll"
   ],
   "C++ IR PrintConstantAnalysis": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/constant/PrintConstantAnalysis.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/constant/PrintConstantAnalysis.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/constant/PrintConstantAnalysis.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/constant/PrintConstantAnalysis.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/constant/PrintConstantAnalysis.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/constant/PrintConstantAnalysis.qll"
   ],
   "C++ IR ReachableBlock": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/reachability/ReachableBlock.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/reachability/ReachableBlock.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/reachability/ReachableBlock.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/reachability/ReachableBlock.qll"
   ],
   "C++ IR PrintReachableBlock": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/reachability/PrintReachableBlock.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/reachability/PrintReachableBlock.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/reachability/PrintReachableBlock.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/reachability/PrintReachableBlock.qll"
   ],
   "C++ IR Dominance": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/reachability/Dominance.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/reachability/Dominance.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/reachability/Dominance.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/reachability/Dominance.qll"
   ],
   "C++ IR PrintDominance": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/reachability/PrintDominance.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/reachability/PrintDominance.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/reachability/PrintDominance.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/reachability/PrintDominance.qll"
   ],
   "C# IR InstructionImports": [
     "csharp/ql/src/experimental/ir/implementation/raw/internal/InstructionImports.qll",
@@ -361,104 +351,63 @@
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/gvn/internal/ValueNumberingImports.qll"
   ],
   "C# ControlFlowReachability": [
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/ControlFlowReachability.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/ControlFlowReachability.qll"
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/ControlFlowReachability.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/rangeanalysis/ControlFlowReachability.qll"
   ],
   "Inline Test Expectations": [
     "cpp/ql/test/TestUtilities/InlineExpectationsTest.qll",
-    "java/ql/test/TestUtilities/InlineExpectationsTest.qll",
     "python/ql/test/TestUtilities/InlineExpectationsTest.qll"
   ],
-  "C++ ExternalAPIs": [
-    "cpp/ql/src/Security/CWE/CWE-020/ExternalAPIs.qll",
-    "cpp/ql/src/Security/CWE/CWE-020/ir/ExternalAPIs.qll"
-  ],
-  "C++ SafeExternalAPIFunction": [
-    "cpp/ql/src/Security/CWE/CWE-020/SafeExternalAPIFunction.qll",
-    "cpp/ql/src/Security/CWE/CWE-020/ir/SafeExternalAPIFunction.qll"
-  ],
   "XML": [
-    "cpp/ql/lib/semmle/code/cpp/XML.qll",
-    "csharp/ql/lib/semmle/code/csharp/XML.qll",
-    "java/ql/lib/semmle/code/xml/XML.qll",
-    "javascript/ql/lib/semmle/javascript/XML.qll",
-    "python/ql/lib/semmle/python/xml/XML.qll"
+    "cpp/ql/src/semmle/code/cpp/XML.qll",
+    "csharp/ql/src/semmle/code/csharp/XML.qll",
+    "java/ql/src/semmle/code/xml/XML.qll",
+    "javascript/ql/src/semmle/javascript/XML.qll",
+    "python/ql/src/semmle/python/xml/XML.qll"
   ],
-  "DuplicationProblems.inc.qhelp": [
-    "cpp/ql/src/Metrics/Files/DuplicationProblems.inc.qhelp",
-    "javascript/ql/src/Metrics/DuplicationProblems.inc.qhelp",
-    "python/ql/src/Metrics/DuplicationProblems.inc.qhelp"
+  "DuplicationProblems.qhelp": [
+    "cpp/ql/src/Metrics/Files/DuplicationProblems.qhelp",
+    "csharp/ql/src/Metrics/Files/DuplicationProblems.qhelp",
+    "javascript/ql/src/Metrics/DuplicationProblems.qhelp",
+    "python/ql/src/Metrics/DuplicationProblems.qhelp"
   ],
-  "CommentedOutCodeQuery.inc.qhelp": [
-    "cpp/ql/src/Documentation/CommentedOutCodeQuery.inc.qhelp",
-    "python/ql/src/Lexical/CommentedOutCodeQuery.inc.qhelp",
-    "csharp/ql/src/Bad Practices/Comments/CommentedOutCodeQuery.inc.qhelp",
-    "java/ql/src/Violations of Best Practice/Comments/CommentedOutCodeQuery.inc.qhelp",
-    "javascript/ql/src/Comments/CommentedOutCodeQuery.inc.qhelp"
+  "CommentedOutCodeQuery.qhelp": [
+    "cpp/ql/src/Documentation/CommentedOutCodeQuery.qhelp",
+    "python/ql/src/Lexical/CommentedOutCodeQuery.qhelp",
+    "csharp/ql/src/Bad Practices/Comments/CommentedOutCodeQuery.qhelp",
+    "java/ql/src/Violations of Best Practice/Comments/CommentedOutCodeQuery.qhelp",
+    "javascript/ql/src/Comments/CommentedOutCodeQuery.qhelp"
   ],
-  "FLinesOfCodeReferences.inc.qhelp": [
-    "java/ql/src/Metrics/Files/FLinesOfCodeReferences.inc.qhelp",
-    "javascript/ql/src/Metrics/FLinesOfCodeReferences.inc.qhelp"
+  "FLinesOfCodeReferences.qhelp": [
+    "java/ql/src/Metrics/Files/FLinesOfCodeReferences.qhelp",
+    "javascript/ql/src/Metrics/FLinesOfCodeReferences.qhelp"
   ],
-  "FCommentRatioCommon.inc.qhelp": [
-    "java/ql/src/Metrics/Files/FCommentRatioCommon.inc.qhelp",
-    "javascript/ql/src/Metrics/FCommentRatioCommon.inc.qhelp"
+  "FCommentRatioCommon.qhelp": [
+    "java/ql/src/Metrics/Files/FCommentRatioCommon.qhelp",
+    "javascript/ql/src/Metrics/FCommentRatioCommon.qhelp"
   ],
-  "FLinesOfCodeOverview.inc.qhelp": [
-    "java/ql/src/Metrics/Files/FLinesOfCodeOverview.inc.qhelp",
-    "javascript/ql/src/Metrics/FLinesOfCodeOverview.inc.qhelp"
+  "FLinesOfCodeOverview.qhelp": [
+    "java/ql/src/Metrics/Files/FLinesOfCodeOverview.qhelp",
+    "javascript/ql/src/Metrics/FLinesOfCodeOverview.qhelp"
   ],
-  "CommentedOutCodeMetricOverview.inc.qhelp": [
-    "cpp/ql/src/Metrics/Files/CommentedOutCodeMetricOverview.inc.qhelp",
-    "csharp/ql/src/Metrics/Files/CommentedOutCodeMetricOverview.inc.qhelp",
-    "java/ql/src/Metrics/Files/CommentedOutCodeMetricOverview.inc.qhelp",
-    "javascript/ql/src/Comments/CommentedOutCodeMetricOverview.inc.qhelp",
-    "python/ql/src/Lexical/CommentedOutCodeMetricOverview.inc.qhelp"
+  "CommentedOutCodeMetricOverview.qhelp": [
+    "cpp/ql/src/Metrics/Files/CommentedOutCodeMetricOverview.qhelp",
+    "csharp/ql/src/Metrics/Files/CommentedOutCodeMetricOverview.qhelp",
+    "java/ql/src/Metrics/Files/CommentedOutCodeMetricOverview.qhelp",
+    "javascript/ql/src/Comments/CommentedOutCodeMetricOverview.qhelp",
+    "python/ql/src/Lexical/CommentedOutCodeMetricOverview.qhelp"
   ],
-  "FLinesOfDuplicatedCodeCommon.inc.qhelp": [
-    "cpp/ql/src/Metrics/Files/FLinesOfDuplicatedCodeCommon.inc.qhelp",
-    "java/ql/src/Metrics/Files/FLinesOfDuplicatedCodeCommon.inc.qhelp",
-    "javascript/ql/src/Metrics/FLinesOfDuplicatedCodeCommon.inc.qhelp",
-    "python/ql/src/Metrics/FLinesOfDuplicatedCodeCommon.inc.qhelp"
+  "FLinesOfDuplicatedCodeCommon.qhelp": [
+    "cpp/ql/src/Metrics/Files/FLinesOfDuplicatedCodeCommon.qhelp",
+    "java/ql/src/Metrics/Files/FLinesOfDuplicatedCodeCommon.qhelp",
+    "javascript/ql/src/Metrics/FLinesOfDuplicatedCodeCommon.qhelp",
+    "python/ql/src/Metrics/FLinesOfDuplicatedCodeCommon.qhelp"
   ],
-  "CommentedOutCodeReferences.inc.qhelp": [
-    "cpp/ql/src/Metrics/Files/CommentedOutCodeReferences.inc.qhelp",
-    "csharp/ql/src/Metrics/Files/CommentedOutCodeReferences.inc.qhelp",
-    "java/ql/src/Metrics/Files/CommentedOutCodeReferences.inc.qhelp",
-    "javascript/ql/src/Comments/CommentedOutCodeReferences.inc.qhelp",
-    "python/ql/src/Lexical/CommentedOutCodeReferences.inc.qhelp"
-  ],
-  "IDE Contextual Queries": [
-    "cpp/ql/lib/IDEContextual.qll",
-    "csharp/ql/lib/IDEContextual.qll",
-    "java/ql/lib/IDEContextual.qll",
-    "javascript/ql/lib/IDEContextual.qll",
-    "python/ql/src/analysis/IDEContextual.qll"
-  ],
-  "SSA C#": [
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/SsaImplCommon.qll",
-    "csharp/ql/lib/semmle/code/csharp/controlflow/internal/pressa/SsaImplCommon.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/basessa/SsaImplCommon.qll",
-    "csharp/ql/lib/semmle/code/cil/internal/SsaImplCommon.qll"
-  ],
-  "CryptoAlgorithms Python/JS": [
-    "javascript/ql/lib/semmle/javascript/security/CryptoAlgorithms.qll",
-    "python/ql/lib/semmle/python/concepts/CryptoAlgorithms.qll"
-  ],
-  "SensitiveDataHeuristics Python/JS": [
-    "javascript/ql/lib/semmle/javascript/security/internal/SensitiveDataHeuristics.qll",
-    "python/ql/lib/semmle/python/security/internal/SensitiveDataHeuristics.qll"
-  ],
-  "ReDoS Util Python/JS": [
-    "javascript/ql/lib/semmle/javascript/security/performance/ReDoSUtil.qll",
-    "python/ql/lib/semmle/python/security/performance/ReDoSUtil.qll"
-  ],
-  "ReDoS Exponential Python/JS": [
-    "javascript/ql/lib/semmle/javascript/security/performance/ExponentialBackTracking.qll",
-    "python/ql/lib/semmle/python/security/performance/ExponentialBackTracking.qll"
-  ],
-  "ReDoS Polynomial Python/JS": [
-    "javascript/ql/lib/semmle/javascript/security/performance/SuperlinearBackTracking.qll",
-    "python/ql/lib/semmle/python/security/performance/SuperlinearBackTracking.qll"
+  "CommentedOutCodeReferences.qhelp": [
+    "cpp/ql/src/Metrics/Files/CommentedOutCodeReferences.qhelp",
+    "csharp/ql/src/Metrics/Files/CommentedOutCodeReferences.qhelp",
+    "java/ql/src/Metrics/Files/CommentedOutCodeReferences.qhelp",
+    "javascript/ql/src/Comments/CommentedOutCodeReferences.qhelp",
+    "python/ql/src/Lexical/CommentedOutCodeReferences.qhelp"
   ]
 }

cpp/autobuilder/Semmle.Autobuild.Cpp.Tests/BuildScripts.cs

@@ -5,7 +5,6 @@ using System;
 using System.Linq;
 using Microsoft.Build.Construction;
 using System.Xml;
-using System.IO;
 
 namespace Semmle.Autobuild.Cpp.Tests
 {
@@ -44,8 +43,6 @@ namespace Semmle.Autobuild.Cpp.Tests
         public IDictionary<string, int> RunProcess = new Dictionary<string, int>();
         public IDictionary<string, string> RunProcessOut = new Dictionary<string, string>();
         public IDictionary<string, string> RunProcessWorkingDirectory = new Dictionary<string, string>();
-        public HashSet<string> CreateDirectories { get; } = new HashSet<string>();
-        public HashSet<(string, string)> DownloadFiles { get; } = new HashSet<(string, string)>();
 
         int IBuildActions.RunProcess(string cmd, string args, string? workingDirectory, IDictionary<string, string>? env, out IList<string> stdOut)
         {
@@ -138,14 +135,6 @@ namespace Semmle.Autobuild.Cpp.Tests
 
         string IBuildActions.GetFullPath(string path) => path;
 
-        string? IBuildActions.GetFileName(string? path) => Path.GetFileName(path?.Replace('\\', '/'));
-
-        public string? GetDirectoryName(string? path)
-        {
-            var dir = Path.GetDirectoryName(path?.Replace('\\', '/'));
-            return dir is null ? path : path?.Substring(0, dir.Length);
-        }
-
         void IBuildActions.WriteAllText(string filename, string contents)
         {
         }
@@ -164,18 +153,6 @@ namespace Semmle.Autobuild.Cpp.Tests
                 s = s.Replace($"%{kvp.Key}%", kvp.Value);
             return s;
         }
-
-        public void CreateDirectory(string path)
-        {
-            if (!CreateDirectories.Contains(path))
-                throw new ArgumentException($"Missing CreateDirectory, {path}");
-        }
-
-        public void DownloadFile(string address, string fileName)
-        {
-            if (!DownloadFiles.Contains((address, fileName)))
-                throw new ArgumentException($"Missing DownloadFile, {address}, {fileName}");
-        }
     }
 
     /// <summary>
@@ -236,7 +213,6 @@ namespace Semmle.Autobuild.Cpp.Tests
             Actions.GetEnvironmentVariable[$"CODEQL_EXTRACTOR_{codeqlUpperLanguage}_SOURCE_ARCHIVE_DIR"] = "";
             Actions.GetEnvironmentVariable[$"CODEQL_EXTRACTOR_{codeqlUpperLanguage}_ROOT"] = $@"C:\codeql\{codeqlUpperLanguage.ToLowerInvariant()}";
             Actions.GetEnvironmentVariable["CODEQL_JAVA_HOME"] = @"C:\codeql\tools\java";
-            Actions.GetEnvironmentVariable["CODEQL_PLATFORM"] = "win64";
             Actions.GetEnvironmentVariable["SEMMLE_DIST"] = @"C:\odasa";
             Actions.GetEnvironmentVariable["SEMMLE_JAVA_HOME"] = @"C:\odasa\tools\java";
             Actions.GetEnvironmentVariable["SEMMLE_PLATFORM_TOOLS"] = @"C:\odasa\tools";
@@ -297,8 +273,7 @@ namespace Semmle.Autobuild.Cpp.Tests
         [Fact]
         public void TestCppAutobuilderSuccess()
         {
-            Actions.RunProcess[@"cmd.exe /C nuget restore C:\Project\test.sln -DisableParallelProcessing"] = 1;
-            Actions.RunProcess[@"cmd.exe /C C:\Project\.nuget\nuget.exe restore C:\Project\test.sln -DisableParallelProcessing"] = 0;
+            Actions.RunProcess[@"cmd.exe /C C:\odasa\tools\csharp\nuget\nuget.exe restore C:\Project\test.sln"] = 1;
             Actions.RunProcess[@"cmd.exe /C CALL ^""C:\Program Files ^(x86^)\Microsoft Visual Studio 14.0\VC\vcvarsall.bat^"" && set Platform=&& type NUL && C:\odasa\tools\odasa index --auto msbuild C:\Project\test.sln /p:UseSharedCompilation=false /t:rebuild /p:Platform=""x86"" /p:Configuration=""Release"" /p:MvcBuildViews=true"] = 0;
             Actions.RunProcessOut[@"C:\Program Files (x86)\Microsoft Visual Studio\Installer\vswhere.exe -prerelease -legacy -property installationPath"] = "";
             Actions.RunProcess[@"C:\Program Files (x86)\Microsoft Visual Studio\Installer\vswhere.exe -prerelease -legacy -property installationPath"] = 1;
@@ -311,13 +286,11 @@ namespace Semmle.Autobuild.Cpp.Tests
             Actions.FileExists[@"C:\Program Files (x86)\Microsoft Visual Studio\Installer\vswhere.exe"] = true;
             Actions.EnumerateFiles[@"C:\Project"] = "foo.cs\ntest.slx";
             Actions.EnumerateDirectories[@"C:\Project"] = "";
-            Actions.CreateDirectories.Add(@"C:\Project\.nuget");
-            Actions.DownloadFiles.Add(("https://dist.nuget.org/win-x86-commandline/latest/nuget.exe", @"C:\Project\.nuget\nuget.exe"));
 
             var autobuilder = CreateAutoBuilder(true);
             var solution = new TestSolution(@"C:\Project\test.sln");
             autobuilder.ProjectsOrSolutionsToBuild.Add(solution);
-            TestAutobuilderScript(autobuilder, 0, 3);
+            TestAutobuilderScript(autobuilder, 0, 2);
         }
     }
 }

cpp/autobuilder/Semmle.Autobuild.Cpp.Tests/Semmle.Autobuild.Cpp.Tests.csproj

@@ -2,7 +2,7 @@
 
   <PropertyGroup>
     <OutputType>Exe</OutputType>
-    <TargetFramework>net5.0</TargetFramework>
+    <TargetFramework>netcoreapp3.1</TargetFramework>
     <GenerateAssemblyInfo>false</GenerateAssemblyInfo>
     <RuntimeIdentifiers>win-x64;linux-x64;osx-x64</RuntimeIdentifiers>
     <Nullable>enable</Nullable>

cpp/autobuilder/Semmle.Autobuild.Cpp/Semmle.Autobuild.Cpp.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
-    <TargetFramework>net5.0</TargetFramework>
+    <TargetFramework>netcoreapp3.1</TargetFramework>
     <AssemblyName>Semmle.Autobuild.Cpp</AssemblyName>
     <RootNamespace>Semmle.Autobuild.Cpp</RootNamespace>
     <ApplicationIcon />
@@ -17,7 +17,7 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Build" Version="16.9.0" />
+    <PackageReference Include="Microsoft.Build" Version="16.0.461" />
   </ItemGroup>
 
   <ItemGroup>

cpp/change-notes/2020-11-02-unused-local-variable.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* Two issues causing the 'Unused local variable' query (`cpp/unused-local-variable`) to produce false positive results have been fixed.

cpp/change-notes/2020-11-05-formatting-function.md

@@ -1,4 +0,0 @@
-lgtm,codescanning
-* `FormattingFunction.getOutputParameterIndex` now has a parameter identifying whether the output at that index is a buffer or a stream.
-* `FormattingFunction` now has a predicate `isOutputGlobal` indicating when the output is to a global stream.
-* The `primitiveVariadicFormatter` and `variadicFormatter` predicates have more parameters exposing information about the function.

cpp/change-notes/2020-11-05-private-models.md

@@ -1,3 +0,0 @@
-lgtm,codescanning
-* Various classes in `semmle.code.cpp.models.implementations` have been made private. Users should not depend on library implementation details.
-* The `OperatorNewAllocationFunction`, `OperatorDeleteDeallocationFunction`, `Iterator` and `Snprintf` classes now have interfaces in `semmle.code.cpp.models.interfaces`.

cpp/change-notes/2020-11-12-unsafe-use-of-this.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* A new query (`cpp/unsafe-use-of-this`) has been added. The query finds pure virtual function calls whose qualifier is an object under construction.

cpp/change-notes/2020-11-27-downgrade-to-recommendation.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* The queries `cpp/local-variable-hides-global-variable` and `cpp/missing-header-guard` now have severity `recommendation` instead of `warning`.

cpp/change-notes/2021-02-04-unsigned-difference-expression-compared-zero.md

@@ -1,2 +0,0 @@
-lgtm
-* A new query (`cpp/unsigned-difference-expression-compared-zero`) is run but not yet displayed on LGTM. The query finds unsigned subtractions used in relational comparisons with the value 0. This query was originally submitted as an experimental query by @ihsinme in https://github.com/github/codeql/pull/4745.

cpp/change-notes/2021-02-24-memset-may-be-deleted.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* A new query (`cpp/memset-may-be-deleted`) is added to the default query suite. The query finds calls to `memset` that may be removed by the compiler. This behavior can make information-leak vulnerabilities easier to exploit. This query was originally [submitted as an experimental query by @ihsinme](https://github.com/github/codeql/pull/4953).

cpp/change-notes/2021-03-01-fluent-interface-data-flow.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* The data-flow library now recognises more side-effects of method chaining (e.g. `someObject.setX(clean).setY(tainted).setZ...` having a side-effect on `someObject`), as well as other related circumstances where a function input is directly passed to its output. All queries that use data-flow analysis, including most security queries, may return more results accordingly.

cpp/change-notes/2021-03-11-failed-extractions.md

@@ -1,2 +0,0 @@
-codescanning
-* Added cpp/diagnostics/failed-extractions. This query gives information about which extractions did not run to completion.

cpp/change-notes/2021-03-11-overflow-abs.md

@@ -1,2 +0,0 @@
-lgtm
-* The `cpp/tainted-arithmetic`, `cpp/arithmetic-with-extreme-values`, and `cpp/uncontrolled-arithmetic` queries now recognize more functions as returning the absolute value of their input. As a result, they produce fewer false positives.

cpp/change-notes/2021-03-17-av-rule-79.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* The 'Resource not released in destructor' (cpp/resource-not-released-in-destructor) query has been improved to recognize more releases of resources.

cpp/change-notes/2021-04-06-assign-where-compare-meant.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* The 'Assignment where comparison was intended' (cpp/assign-where-compare-meant) query has been improved to flag fewer benign assignments in conditionals.

cpp/change-notes/2021-04-09-unsigned-difference-expression-compared-zero.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* The 'Unsigned difference expression compared to zero' (cpp/unsigned-difference-expression-compared-zero) query has been improved to produce fewer false positive results.

cpp/change-notes/2021-04-13-arithmetic-queries.md

@@ -1,2 +0,0 @@
-lgtm
-* The queries cpp/tainted-arithmetic, cpp/uncontrolled-arithmetic, and cpp/arithmetic-with-extreme-values have been improved to produce fewer false positives.

cpp/change-notes/2021-04-21-return-stack-allocated-object.md

@@ -1,2 +0,0 @@
-codescanning
-* The 'Pointer to stack object used as return value' (cpp/return-stack-allocated-object) query has been deprecated, and any uses should be replaced with `Returning stack-allocated memory` (cpp/return-stack-allocated-memory).

cpp/change-notes/2021-04-26-more-sound-expr-might-overflow.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* The `exprMightOverflowPositively` and `exprMightOverflowNegatively` predicates from the `SimpleRangeAnalysis` library now recognize more expressions that might overflow.

cpp/change-notes/2021-05-10-comparison-with-wider-type.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* The 'Comparison with wider type' (cpp/comparison-with-wider-type) query has been improved to produce fewer false positives.

cpp/change-notes/2021-05-12-uncontrolled-arithmetic.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* The query "Uncontrolled arithmetic" (`cpp/uncontrolled-arithmetic`) has been improved to produce fewer false positives.

cpp/change-notes/2021-05-14-uncontrolled-allocation-size.md

@@ -1,2 +0,0 @@
-lgtm
-* The "Tainted allocation size" query (cpp/uncontrolled-allocation-size) has been improved to produce fewer false positives.

cpp/change-notes/2021-05-18-static-buffer-overflow.md

@@ -1,2 +0,0 @@
-lgtm
-* The "Static buffer overflow" query (cpp/static-buffer-overflow) has been improved to produce fewer false positives.

cpp/change-notes/2021-05-19-weak-cryptographic-algorithm.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* The "Use of a broken or risky cryptographic algorithm" (`cpp/weak-cryptographic-algorithm`) query has been enhanced to reduce false positive results, and (rarely) find more true positive results.

cpp/change-notes/2021-05-20-incorrect-allocation-error-handling.md

@@ -1,2 +0,0 @@
-lgtm
-* A new query (`cpp/incorrect-allocation-error-handling`) has been added. The query finds incorrect error-handling of calls to `operator new`. This query was originally [submitted as an experimental query by @ihsinme](https://github.com/github/codeql/pull/5010).

cpp/change-notes/2021-05-20-ref-qualifiers.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* lvalue/rvalue ref qualifiers are now accessible via the new predicates on `MemberFunction`(`.isLValueRefQualified`, `.isRValueRefQualified`, and `isRefQualified`).

cpp/change-notes/2021-05-21-unsafe-strncat.md

@@ -1,2 +0,0 @@
-lgtm
-* The "Potentially unsafe call to strncat" query (cpp/unsafe-strncat) query has been improved to detect more cases of unsafe calls to `strncat`.

cpp/change-notes/2021-06-10-std-types.md

@@ -1,4 +0,0 @@
-lgtm,codescanning
-* Added definitions for types found in `cstdint`. Added types `FixedWidthIntegralType`, `MinimumWidthIntegralType`, `FastestMinimumWidthIntegralType`, and `MaximumWidthIntegralType` to describe types such as `int8_t`, `int_least8_t`, `int_fast8_t`, and `intmax_t` respectively. 
-* Changed definition of `Intmax_t` and `Uintmax_t` to be part of the new type structure. 
-* Added a type `FixedWidthEnumType` which describes enums based on a fixed-width integer type. For instance, `enum e: uint8_t = { a, b };`.

cpp/change-notes/2021-06-21-weak-cryptographic-algorithm.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* The "Use of a broken or risky cryptographic algorithm" (`cpp/weak-cryptographic-algorithm`) query has been further improved to reduce false positives and its `@precision` increased to `high`.

cpp/change-notes/2021-06-24-dataflow-implicit-reads.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* The DataFlow libraries have been augmented with support for `Configuration`-specific in-place read steps at, for example, sinks and custom taint steps. This means that it is now possible to specify sinks that accept flow with non-empty access paths.

cpp/change-notes/2021-06-24-uncontrolled-arithmetic.md

@@ -1,2 +0,0 @@
-lgtm
-* The 'Uncontrolled data in arithmetic expression' (cpp/uncontrolled-arithmetic) query now recognizes more sources of randomness.

cpp/change-notes/2021-06-30-wrong-type-format-argument.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* The 'Wrong type of arguments to formatting function' (cpp/wrong-type-format-argument) query is now more accepting of the string and character formatting differences between Microsoft and non-Microsoft platforms.  There are now fewer false positive results.

cpp/config/suites/cpp/correctness

@@ -9,8 +9,6 @@
 + semmlecode-cpp-queries/Likely Bugs/Conversion/CastArrayPointerArithmetic.ql: /Correctness/Dangerous Conversions
 + semmlecode-cpp-queries/Likely Bugs/Underspecified Functions/MistypedFunctionArguments.ql: /Correctness/Dangerous Conversions
 + semmlecode-cpp-queries/Security/CWE/CWE-253/HResultBooleanConversion.ql: /Correctness/Dangerous Conversions
-+ semmlecode-cpp-queries/Likely Bugs/OO/UnsafeUseOfThis.ql: /Correctness/Dangerous Conversions
-+ semmlecode-cpp-queries/Security/CWE/CWE-191/UnsignedDifferenceExpressionComparedZero.ql: /Correctness/Dangerous Conversions
   # Consistent Use
 + semmlecode-cpp-queries/Critical/ReturnValueIgnored.ql: /Correctness/Consistent Use
 + semmlecode-cpp-queries/Likely Bugs/InconsistentCheckReturnNull.ql: /Correctness/Consistent Use

cpp/ql/examples/qlpack.yml

@@ -1,4 +1,3 @@
-name: codeql/cpp-examples
+name: codeql-cpp-examples
 version: 0.0.0
-dependencies:
-  codeql/cpp-all: ^0.0.1
+libraryPathDependencies: codeql-cpp

cpp/ql/lib/IDEContextual.qll

@@ -1,22 +0,0 @@
-/**
- * Provides shared predicates related to contextual queries in the code viewer.
- */
-
-import semmle.files.FileSystem
-
-/**
- * Returns the `File` matching the given source file name as encoded by the VS
- * Code extension.
- */
-cached
-File getFileBySourceArchiveName(string name) {
-  // The name provided for a file in the source archive by the VS Code extension
-  // has some differences from the absolute path in the database:
-  // 1. colons are replaced by underscores
-  // 2. there's a leading slash, even for Windows paths: "C:/foo/bar" ->
-  //    "/C_/foo/bar"
-  // 3. double slashes in UNC prefixes are replaced with a single slash
-  // We can handle 2 and 3 together by unconditionally adding a leading slash
-  // before replacing double slashes.
-  name = ("/" + result.getAbsolutePath().replaceAll(":", "_")).replaceAll("//", "/")
-}

cpp/ql/lib/definitions.qll

@@ -1,210 +0,0 @@
-/**
- * Provides classes and predicates related to jump-to-definition links
- * in the code viewer.
- */
-
-import cpp
-import IDEContextual
-
-/**
- * Any element that might be the source or target of a jump-to-definition
- * link.
- *
- * In some cases it is preferable to modify locations (the
- * `hasLocationInfo()` predicate) so that they are short, and
- * non-overlapping with other locations that might be highlighted in
- * the LGTM interface.
- *
- * We need to give locations that may not be in the database, so
- * we use `hasLocationInfo()` rather than `getLocation()`.
- */
-class Top extends Element {
-  /**
-   * Holds if this element is at the specified location.
-   * The location spans column `startcolumn` of line `startline` to
-   * column `endcolumn` of line `endline` in file `filepath`.
-   * For more information, see
-   * [Locations](https://help.semmle.com/QL/learn-ql/ql/locations.html).
-   */
-  pragma[noopt]
-  final predicate hasLocationInfo(
-    string filepath, int startline, int startcolumn, int endline, int endcolumn
-  ) {
-    interestingElement(this) and
-    not this instanceof MacroAccess and
-    not this instanceof Include and
-    exists(Location l |
-      l = this.getLocation() and
-      l.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
-    )
-    or
-    // This has a location that covers only the name of the accessed
-    // macro, not its arguments (which are included by `MacroAccess`'s
-    // `getLocation()`).
-    exists(Location l, MacroAccess ma |
-      ma instanceof MacroAccess and
-      ma = this and
-      l = ma.getLocation() and
-      l.hasLocationInfo(filepath, startline, startcolumn, _, _) and
-      endline = startline and
-      exists(string macroName, int nameLength, int nameLengthMinusOne |
-        macroName = ma.getMacroName() and
-        nameLength = macroName.length() and
-        nameLengthMinusOne = nameLength - 1 and
-        endcolumn = startcolumn + nameLengthMinusOne
-      )
-    )
-    or
-    hasLocationInfo_Include(this, filepath, startline, startcolumn, endline, endcolumn)
-  }
-}
-
-/**
- * An `Include` with a `hasLocationInfo` predicate.
- *
- * This has a location that covers only the name of the included
- * file, not the `#include` text or whitespace before it.
- */
-predicate hasLocationInfo_Include(Include i, string path, int sl, int sc, int el, int ec) {
-  exists(Location l |
-    l = i.getLocation() and
-    path = l.getFile().getAbsolutePath() and
-    sl = l.getEndLine() and
-    sc = l.getEndColumn() + 1 - i.getIncludeText().length() and
-    el = l.getEndLine() and
-    ec = l.getEndColumn()
-  )
-}
-
-/** Holds if `e` is a source or a target of jump-to-definition. */
-predicate interestingElement(Element e) {
-  exists(definitionOf(e, _))
-  or
-  e = definitionOf(_, _)
-}
-
-/**
- * Holds if `f`, `line`, `column` indicate the start character
- * of `cc`.
- */
-private predicate constructorCallStartLoc(ConstructorCall cc, File f, int line, int column) {
-  exists(Location l |
-    l = cc.getLocation() and
-    l.getFile() = f and
-    l.getStartLine() = line and
-    l.getStartColumn() = column
-  )
-}
-
-/**
- * Holds if `f`, `line`, `column` indicate the start character
- * of `tm`, which mentions `t`. Type mentions for instantiations
- * are filtered out.
- */
-private predicate typeMentionStartLoc(TypeMention tm, Type t, File f, int line, int column) {
-  exists(Location l |
-    l = tm.getLocation() and
-    l.getFile() = f and
-    l.getStartLine() = line and
-    l.getStartColumn() = column
-  ) and
-  t = tm.getMentionedType() and
-  not t instanceof ClassTemplateInstantiation
-}
-
-/**
- * Holds if `cc` and `tm` begin at the same character.
- */
-cached
-private predicate constructorCallTypeMention(ConstructorCall cc, TypeMention tm) {
-  exists(File f, int line, int column |
-    constructorCallStartLoc(cc, f, line, column) and
-    typeMentionStartLoc(tm, _, f, line, column)
-  )
-}
-
-/**
- * Gets an element, of kind `kind`, that element `e` uses, if any.
- * Attention: This predicate yields multiple definitions for a single location.
- *
- * The `kind` is a string representing what kind of use it is:
- *  - `"M"` for function and method calls
- *  - `"T"` for uses of types
- *  - `"V"` for variable accesses
- *  - `"X"` for macro accesses
- *  - `"I"` for import / include directives
- */
-cached
-Top definitionOf(Top e, string kind) {
-  (
-    // call -> function called
-    kind = "M" and
-    result = e.(Call).getTarget() and
-    not e.(Expr).isCompilerGenerated() and
-    not e instanceof ConstructorCall // handled elsewhere
-    or
-    // access -> function, variable or enum constant accessed
-    kind = "V" and
-    result = e.(Access).getTarget() and
-    not e.(Expr).isCompilerGenerated()
-    or
-    // macro access -> macro accessed
-    kind = "X" and
-    result = e.(MacroAccess).getMacro()
-    or
-    // type mention -> type
-    kind = "T" and
-    e.(TypeMention).getMentionedType() = result and
-    not constructorCallTypeMention(_, e) and // handled elsewhere
-    // Multiple type mentions can be generated when a typedef is used, and
-    // in such cases we want to exclude all but the originating typedef.
-    not exists(Type secondary |
-      exists(TypeMention tm, File f, int startline, int startcol |
-        typeMentionStartLoc(e, result, f, startline, startcol) and
-        typeMentionStartLoc(tm, secondary, f, startline, startcol) and
-        (
-          result = secondary.(TypedefType).getBaseType() or
-          result = secondary.(TypedefType).getBaseType().(SpecifiedType).getBaseType()
-        )
-      )
-    )
-    or
-    // constructor call -> function called
-    //  - but only if there is a corresponding type mention, since
-    //    we don't want links for implicit conversions.
-    //  - using the location of the type mention, since it's
-    //    tighter that the location of the function call.
-    kind = "M" and
-    exists(ConstructorCall cc |
-      constructorCallTypeMention(cc, e) and
-      result = cc.getTarget()
-    )
-    or
-    // include -> included file
-    kind = "I" and
-    result = e.(Include).getIncludedFile() and
-    // exclude `#include` directives containing macros
-    not exists(MacroInvocation mi, Location l1, Location l2 |
-      l1 = e.(Include).getLocation() and
-      l2 = mi.getLocation() and
-      l1.getContainer() = l2.getContainer() and
-      l1.getStartLine() = l2.getStartLine()
-      // (an #include directive must be always on it's own line)
-    )
-  ) and
-  (
-    // exclude things inside macro invocations, as they will overlap
-    // with the macro invocation.
-    not e.(Element).isInMacroExpansion() and
-    // exclude nested macro invocations, as they will overlap with
-    // the top macro invocation.
-    not exists(e.(MacroAccess).getParentInvocation())
-  ) and
-  // Some entities have many locations. This can arise for an external
-  // function that is frequently declared but not defined, or perhaps
-  // for a struct type that is declared in many places. Rather than
-  // letting the result set explode, we just exclude results that are
-  // "too ambiguous" -- we could also arbitrarily pick one location
-  // later on.
-  strictcount(result.getLocation()) < 10
-}

cpp/ql/lib/qlpack.lock.yml

@@ -1,4 +0,0 @@
----
-dependencies: {}
-compiled: false
-lockVersion: 1.0.0

cpp/ql/lib/qlpack.yml

@@ -1,5 +0,0 @@
-name: codeql/cpp-all
-version: 0.0.2
-dbscheme: semmlecode.cpp.dbscheme
-extractor: cpp
-library: true

cpp/ql/lib/semmle/code/cpp/Declaration.qll

@@ -1,721 +0,0 @@
-/**
- * Provides classes for working with C and C++ declarations.
- */
-
-import semmle.code.cpp.Element
-import semmle.code.cpp.Specifier
-import semmle.code.cpp.Namespace
-private import semmle.code.cpp.internal.QualifiedName as Q
-
-/**
- * A C/C++ declaration: for example, a variable declaration, a type
- * declaration, or a function declaration.
- *
- * This file defines two closely related classes: `Declaration` and
- * `DeclarationEntry`. Some declarations do not correspond to a unique
- * location in the source code. For example, a global variable might
- * be declared in multiple source files:
- * ```
- *   extern int myglobal;
- * ```
- * and defined in one:
- * ```
- *   int myglobal;
- * ```
- * Each of these declarations (including the definition) is given its own
- * distinct `DeclarationEntry`, but they all share the same `Declaration`.
- *
- * Some derived class of `Declaration` do not have a corresponding
- * `DeclarationEntry`, because they always have a unique source location.
- * `EnumConstant` and `FriendDecl` are both examples of this.
- */
-class Declaration extends Locatable, @declaration {
-  /**
-   * Gets the innermost namespace which contains this declaration.
-   *
-   * The result will either be `GlobalNamespace`, or the tightest lexically
-   * enclosing namespace block. In particular, note that for declarations
-   * within structures, the namespace of the declaration is the same as the
-   * namespace of the structure.
-   */
-  Namespace getNamespace() {
-    result = underlyingElement(this).(Q::Declaration).getNamespace()
-    or
-    exists(Parameter p | p = this and result = p.getFunction().getNamespace())
-    or
-    exists(LocalVariable v | v = this and result = v.getFunction().getNamespace())
-  }
-
-  /**
-   * Gets the name of the declaration, fully qualified with its
-   * namespace and declaring type.
-   *
-   * For performance, prefer the multi-argument `hasQualifiedName` or
-   * `hasGlobalName` predicates since they don't construct so many intermediate
-   * strings. For debugging, the `semmle.code.cpp.Print` module produces more
-   * detailed output but are also more expensive to compute.
-   *
-   * Example: `getQualifiedName() =
-   * "namespace1::namespace2::TemplateClass1<int>::Class2::memberName"`.
-   */
-  string getQualifiedName() { result = underlyingElement(this).(Q::Declaration).getQualifiedName() }
-
-  /**
-   * DEPRECATED: Prefer `hasGlobalName` or the 2-argument or 3-argument
-   * `hasQualifiedName` predicates. To get the exact same results as this
-   * predicate in all edge cases, use `getQualifiedName()`.
-   *
-   * Holds if this declaration has the fully-qualified name `qualifiedName`.
-   * See `getQualifiedName`.
-   */
-  predicate hasQualifiedName(string qualifiedName) { this.getQualifiedName() = qualifiedName }
-
-  /**
-   * Holds if this declaration has a fully-qualified name with a name-space
-   * component of `namespaceQualifier`, a declaring type of `typeQualifier`,
-   * and a base name of `baseName`. Template parameters and arguments are
-   * stripped from all components. Missing components are `""`.
-   *
-   * Example: `hasQualifiedName("namespace1::namespace2",
-   * "TemplateClass1::Class2", "memberName")`.
-   *
-   * Example (the class `std::vector`): `hasQualifiedName("std", "", "vector")`
-   * or `hasQualifiedName("std", "vector")`.
-   *
-   * Example (the `size` member function of class `std::vector`):
-   * `hasQualifiedName("std", "vector", "size")`.
-   */
-  predicate hasQualifiedName(string namespaceQualifier, string typeQualifier, string baseName) {
-    underlyingElement(this)
-        .(Q::Declaration)
-        .hasQualifiedName(namespaceQualifier, typeQualifier, baseName)
-  }
-
-  /**
-   * Holds if this declaration has a fully-qualified name with a name-space
-   * component of `namespaceQualifier`, no declaring type, and a base name of
-   * `baseName`.
-   *
-   * See the 3-argument `hasQualifiedName` for examples.
-   */
-  predicate hasQualifiedName(string namespaceQualifier, string baseName) {
-    this.hasQualifiedName(namespaceQualifier, "", baseName)
-  }
-
-  /**
-   * Gets a description of this `Declaration` for display purposes.
-   */
-  string getDescription() { result = this.getName() }
-
-  final override string toString() { result = this.getDescription() }
-
-  /**
-   * Gets the name of this declaration.
-   *
-   * This name doesn't include a namespace or any argument types, so
-   * for example both functions `::open()` and `::std::ifstream::open(...)`
-   * have the same name. The name of a template _class_ includes a string
-   * representation of its parameters, and the names of its instantiations
-   * include string representations of their arguments. Template _functions_
-   * and their instantiations do not include template parameters or arguments.
-   *
-   * To get the name including the namespace, use `hasQualifiedName`.
-   *
-   * To test whether this declaration has a particular name in the global
-   * namespace, use `hasGlobalName`.
-   */
-  string getName() { none() } // overridden in subclasses
-
-  /** Holds if this declaration has the given name. */
-  predicate hasName(string name) { name = this.getName() }
-
-  /** Holds if this declaration has the given name in the global namespace. */
-  predicate hasGlobalName(string name) { this.hasQualifiedName("", "", name) }
-
-  /** Holds if this declaration has the given name in the global namespace or the `std` namespace. */
-  predicate hasGlobalOrStdName(string name) {
-    this.hasGlobalName(name)
-    or
-    this.hasQualifiedName("std", "", name)
-  }
-
-  /**
-   * Holds if this declaration has the given name in the global namespace,
-   * the `std` namespace or the `bsl` namespace.
-   * We treat `std` and `bsl` as the same in some of our models.
-   */
-  predicate hasGlobalOrStdOrBslName(string name) {
-    this.hasGlobalName(name)
-    or
-    this.hasQualifiedName("std", "", name)
-    or
-    this.hasQualifiedName("bsl", "", name)
-  }
-
-  /** Gets a specifier of this declaration. */
-  Specifier getASpecifier() { none() } // overridden in subclasses
-
-  /** Holds if this declaration has a specifier with the given name. */
-  predicate hasSpecifier(string name) { this.getASpecifier().hasName(name) }
-
-  /**
-   * Gets a declaration entry corresponding to this declaration. See the
-   * comment above this class for an explanation of the relationship
-   * between `Declaration` and `DeclarationEntry`.
-   */
-  DeclarationEntry getADeclarationEntry() { none() }
-
-  /**
-   * Gets the location of a declaration entry corresponding to this
-   * declaration.
-   */
-  Location getADeclarationLocation() { none() } // overridden in subclasses
-
-  /**
-   * Gets the declaration entry corresponding to this declaration that is a
-   * definition, if any.
-   */
-  DeclarationEntry getDefinition() { none() }
-
-  /** Gets the location of the definition, if any. */
-  Location getDefinitionLocation() { none() } // overridden in subclasses
-
-  /** Holds if the declaration has a definition. */
-  predicate hasDefinition() { exists(this.getDefinition()) }
-
-  /** DEPRECATED: Use `hasDefinition` instead. */
-  predicate isDefined() { hasDefinition() }
-
-  /** Gets the preferred location of this declaration, if any. */
-  override Location getLocation() { none() }
-
-  /** Gets a file where this element occurs. */
-  File getAFile() { result = this.getADeclarationLocation().getFile() }
-
-  /** Holds if this declaration is a top-level declaration. */
-  predicate isTopLevel() {
-    not (
-      this.isMember() or
-      this instanceof EnumConstant or
-      this instanceof Parameter or
-      this instanceof ProxyClass or
-      this instanceof LocalVariable or
-      this instanceof TemplateParameter or
-      this.(UserType).isLocal()
-    )
-  }
-
-  /** Holds if this declaration is static. */
-  predicate isStatic() { this.hasSpecifier("static") }
-
-  /** Holds if this declaration is a member of a class/struct/union. */
-  predicate isMember() { hasDeclaringType() }
-
-  /** Holds if this declaration is a member of a class/struct/union. */
-  predicate hasDeclaringType() { exists(this.getDeclaringType()) }
-
-  /**
-   * Gets the class where this member is declared, if it is a member.
-   * For templates, both the template itself and all instantiations of
-   * the template are considered to have the same declaring class.
-   */
-  Class getDeclaringType() { this = result.getAMember() }
-
-  /**
-   * Gets a template argument used to instantiate this declaration from a template.
-   * When called on a template, this will return a template parameter type for
-   * both typed and non-typed parameters.
-   */
-  final Locatable getATemplateArgument() { result = getTemplateArgument(_) }
-
-  /**
-   * Gets a template argument used to instantiate this declaration from a template.
-   * When called on a template, this will return a non-typed template
-   * parameter value.
-   */
-  final Locatable getATemplateArgumentKind() { result = getTemplateArgumentKind(_) }
-
-  /**
-   * Gets the `i`th template argument used to instantiate this declaration from a
-   * template.
-   *
-   * For example:
-   *
-   * `template<typename T, T X> class Foo;`
-   *
-   * Will have `getTemplateArgument(0)` return `T`, and
-   * `getTemplateArgument(1)` return `X`.
-   *
-   * `Foo<int, 1> bar;`
-   *
-   * Will have `getTemplateArgument())` return `int`, and
-   * `getTemplateArgument(1)` return `1`.
-   */
-  final Locatable getTemplateArgument(int index) {
-    if exists(getTemplateArgumentValue(index))
-    then result = getTemplateArgumentValue(index)
-    else result = getTemplateArgumentType(index)
-  }
-
-  /**
-   * Gets the `i`th template argument value used to instantiate this declaration
-   * from a template. When called on a template, this will return the `i`th template
-   * parameter value if it exists.
-   *
-   * For example:
-   *
-   * `template<typename T, T X> class Foo;`
-   *
-   * Will have `getTemplateArgumentKind(1)` return `T`, and no result for
-   * `getTemplateArgumentKind(0)`.
-   *
-   * `Foo<int, 10> bar;
-   *
-   * Will have `getTemplateArgumentKind(1)` return `int`, and no result for
-   * `getTemplateArgumentKind(0)`.
-   */
-  final Locatable getTemplateArgumentKind(int index) {
-    if exists(getTemplateArgumentValue(index))
-    then result = getTemplateArgumentType(index)
-    else none()
-  }
-
-  /** Gets the number of template arguments for this declaration. */
-  final int getNumberOfTemplateArguments() {
-    result = count(int i | exists(getTemplateArgument(i)))
-  }
-
-  private Type getTemplateArgumentType(int index) {
-    class_template_argument(underlyingElement(this), index, unresolveElement(result))
-    or
-    function_template_argument(underlyingElement(this), index, unresolveElement(result))
-    or
-    variable_template_argument(underlyingElement(this), index, unresolveElement(result))
-  }
-
-  private Expr getTemplateArgumentValue(int index) {
-    class_template_argument_value(underlyingElement(this), index, unresolveElement(result))
-    or
-    function_template_argument_value(underlyingElement(this), index, unresolveElement(result))
-    or
-    variable_template_argument_value(underlyingElement(this), index, unresolveElement(result))
-  }
-}
-
-private class TDeclarationEntry = @var_decl or @type_decl or @fun_decl;
-
-/**
- * A C/C++ declaration entry. For example the following code contains five
- * declaration entries:
- * ```
- * extern int myGlobal;
- * int myVariable;
- * typedef char MyChar;
- * void myFunction();
- * void myFunction() {
- *   // ...
- * }
- * ```
- * See the comment above `Declaration` for an explanation of the relationship
- * between `Declaration` and `DeclarationEntry`.
- */
-class DeclarationEntry extends Locatable, TDeclarationEntry {
-  /** Gets a specifier associated with this declaration entry. */
-  string getASpecifier() { none() } // overridden in subclasses
-
-  /**
-   * Gets the name associated with the corresponding definition (where
-   * available), or the name declared by this entry otherwise.
-   */
-  string getCanonicalName() {
-    if getDeclaration().hasDefinition()
-    then result = getDeclaration().getDefinition().getName()
-    else result = getName()
-  }
-
-  /**
-   * Gets the declaration for which this is a declaration entry.
-   *
-   * Note that this is *not* always the inverse of
-   * `Declaration.getADeclarationEntry()`, for example if `C` is a
-   * `TemplateClass`, `I` is an instantiation of `C`, and `D` is a
-   * `Declaration` of `C`, then:
-   *  `C.getADeclarationEntry()` returns `D`
-   *  `I.getADeclarationEntry()` returns `D`
-   *  but `D.getDeclaration()` only returns `C`
-   */
-  Declaration getDeclaration() { none() } // overridden in subclasses
-
-  /** Gets the name associated with this declaration entry, if any. */
-  string getName() { none() } // overridden in subclasses
-
-  /**
-   * Gets the type associated with this declaration entry.
-   *
-   * For variable declarations, get the type of the variable.
-   * For function declarations, get the return type of the function.
-   * For type declarations, get the type being declared.
-   */
-  Type getType() { none() } // overridden in subclasses
-
-  /**
-   * Gets the type associated with this declaration entry after specifiers
-   * have been deeply stripped and typedefs have been resolved.
-   *
-   * For variable declarations, get the type of the variable.
-   * For function declarations, get the return type of the function.
-   * For type declarations, get the type being declared.
-   */
-  Type getUnspecifiedType() { result = this.getType().getUnspecifiedType() }
-
-  /**
-   * Holds if this declaration entry has a specifier with the given name.
-   */
-  predicate hasSpecifier(string specifier) { getASpecifier() = specifier }
-
-  /** Holds if this declaration entry is a definition. */
-  predicate isDefinition() { none() } // overridden in subclasses
-
-  override string toString() {
-    if isDefinition()
-    then result = "definition of " + getName()
-    else
-      if getName() = getCanonicalName()
-      then result = "declaration of " + getName()
-      else result = "declaration of " + getCanonicalName() + " as " + getName()
-  }
-}
-
-private class TAccessHolder = @function or @usertype;
-
-/**
- * A declaration that can potentially have more C++ access rights than its
- * enclosing element. This comprises `Class` (they have access to their own
- * private members) along with other `UserType`s and `Function` (they can be
- * the target of `friend` declarations).  For example `MyClass` and
- * `myFunction` in the following code:
- * ```
- * class MyClass
- * {
- * public:
- *   ...
- * };
- *
- * void myFunction() {
- *   // ...
- * }
- * ```
- * In the C++ standard (N4140 11.2), rules for access control revolve around
- * the informal phrase "_R_ occurs in a member or friend of class C", where
- * `AccessHolder` corresponds to this _R_.
- */
-class AccessHolder extends Declaration, TAccessHolder {
-  /**
-   * Holds if `this` can access private members of class `c`.
-   *
-   * This predicate encodes the phrase "occurs in a member or friend" that is
-   * repeated many times in the C++14 standard, section 11.2.
-   */
-  predicate inMemberOrFriendOf(Class c) {
-    this.getEnclosingAccessHolder*() = c
-    or
-    exists(FriendDecl fd | fd.getDeclaringClass() = c |
-      this.getEnclosingAccessHolder*() = fd.getFriend()
-    )
-  }
-
-  /**
-   * Gets the nearest enclosing `AccessHolder`.
-   */
-  AccessHolder getEnclosingAccessHolder() { none() } // overridden in subclasses
-
-  /**
-   * Holds if a base class `base` of `derived` _is accessible at_ `this` (N4140
-   * 11.2/4). When this holds, and `derived` has only one base subobject of
-   * type `base`, code in `this` can implicitly convert a pointer to `derived`
-   * into a pointer to `base`. Conversely, if such a conversion is possible
-   * then this predicate holds.
-   *
-   * For the sake of generality, this predicate also holds whenever `base` =
-   * `derived`.
-   *
-   * This predicate is `pragma[inline]` because it is infeasible to fully
-   * compute it on large code bases: all classes `derived` can be converted to
-   * their public bases `base` from everywhere (`this`), so this predicate
-   * could yield a number of tuples that is quadratic in the size of the
-   * program. To avoid this combinatorial explosion, only use this predicate in
-   * a context where `this` together with `base` or `derived` are sufficiently
-   * restricted.
-   */
-  pragma[inline]
-  predicate canAccessClass(Class base, Class derived) {
-    // This predicate is marked `inline` and implemented in a very particular
-    // way. If we allowed this predicate to be fully computed, it would relate
-    // all `AccessHolder`s to all classes, which would be too much.
-    // There are four rules in N4140 11.2/4. Only the one named (4.4) is
-    // recursive, and it describes a transitive closure: intuitively, if A can
-    // be converted to B, and B can be converted to C, then A can be converted
-    // to C. To limit the number of tuples in the non-inline helper predicates,
-    // we first separate the derivation of 11.2/4 into two cases:
-    // Derivations using only (4.1) and (4.4). Note that these derivations are
-    // independent of `this`, which is why users of this predicate must take
-    // care to avoid a combinatorial explosion.
-    isDirectPublicBaseOf*(base, derived)
-    or
-    exists(DirectAccessHolder n |
-      this.getEnclosingAccessHolder*() = n and
-      // Derivations using (4.2) or (4.3) at least once.
-      n.thisCanAccessClassTrans(base, derived)
-    )
-  }
-
-  /**
-   * Holds if a non-static member `member` _is accessible at_ `this` when named
-   * in a class `derived` that is derived from or equal to the declaring class
-   * of `member` (N4140 11.2/5 and 11.4).
-   *
-   * This predicate determines whether an expression `x.member` would be
-   * allowed in `this` when `x` has type `derived`. The more general syntax
-   * `x.N::member`, where `N` may be a base class of `derived`, is not
-   * supported. This should only affect very rare edge cases of 11.4. This
-   * predicate concerns only _access_ and thus does not determine whether
-   * `member` can be unambiguously named at `this`: multiple overloads may
-   * apply, or `member` may be declared in an ambiguous base class.
-   *
-   * This predicate is `pragma[inline]` because it is infeasible to fully
-   * compute it on large code bases: all public members `member` are accessible
-   * from everywhere (`this`), so this predicate could yield a number of tuples
-   * that is quadratic in the size of the program. To avoid this combinatorial
-   * explosion, only use this predicate in a context where `this` and `member`
-   * are sufficiently restricted when `member` is public.
-   */
-  pragma[inline]
-  predicate canAccessMember(Declaration member, Class derived) {
-    this.couldAccessMember(member.getDeclaringType(), member.getASpecifier().(AccessSpecifier),
-      derived)
-  }
-
-  /**
-   * Holds if a hypothetical non-static member of `memberClass` with access
-   * specifier `memberAccess` _is accessible at_ `this` when named in a class
-   * `derived` that is derived from or equal to `memberClass` (N4140 11.2/5 and
-   * 11.4).
-   *
-   * This predicate determines whether an expression `x.m` would be
-   * allowed in `this` when `x` has type `derived` and `m` has `memberAccess`
-   * in `memberClass`. The more general syntax `x.N::n`, where `N` may be a
-   * base class of `derived`, is not supported. This should only affect very
-   * rare edge cases of 11.4.
-   *
-   * This predicate is `pragma[inline]` because it is infeasible to fully
-   * compute it on large code bases: all classes `memberClass` have their
-   * public members accessible from everywhere (`this`), so this predicate
-   * could yield a number of tuples that is quadratic in the size of the
-   * program. To avoid this combinatorial explosion, only use this predicate in
-   * a context where `this` and `memberClass` are sufficiently restricted when
-   * `memberAccess` is public.
-   */
-  pragma[inline]
-  predicate couldAccessMember(Class memberClass, AccessSpecifier memberAccess, Class derived) {
-    // There are four rules in N4140 11.2/5. To limit the number of tuples in
-    // the non-inline helper predicates, we first separate the derivation of
-    // 11.2/5 into two cases:
-    // Rule (5.1) directly: the member is public, and `derived` uses public
-    // inheritance all the way up to `memberClass`. Note that these derivations
-    // are independent of `this`, which is why users of this predicate must
-    // take care to avoid a combinatorial explosion.
-    everyoneCouldAccessMember(memberClass, memberAccess, derived)
-    or
-    exists(DirectAccessHolder n |
-      this.getEnclosingAccessHolder*() = n and
-      // Any other derivation.
-      n.thisCouldAccessMember(memberClass, memberAccess, derived)
-    )
-  }
-}
-
-/**
- * A declaration that very likely has more C++ access rights than its
- * enclosing element. This comprises `Class` (they have access to their own
- * private members) along with any target of a `friend` declaration.  For
- * example `MyClass` and `friendFunction` in the following code:
- * ```
- * class MyClass
- * {
- * public:
- *   friend void friendFunction();
- * };
- *
- * void friendFunction() {
- *   // ...
- * }
- * ```
- * Most access rights are computed for `DirectAccessHolder` instead of
- * `AccessHolder` -- that's more efficient because there are fewer
- * `DirectAccessHolder`s. If a `DirectAccessHolder` contains an `AccessHolder`,
- * then the contained `AccessHolder` inherits its access rights.
- */
-private class DirectAccessHolder extends Element {
-  DirectAccessHolder() {
-    this instanceof Class
-    or
-    exists(FriendDecl fd | fd.getFriend() = this)
-  }
-
-  /**
-   * Holds if a base class `base` of `derived` _is accessible at_ `this` when
-   * the derivation of that fact uses rule (4.2) and (4.3) of N4140 11.2/4 at
-   * least once. In other words, the `this` parameter is not ignored. This
-   * restriction makes it feasible to fully enumerate this predicate even on
-   * large code bases.
-   */
-  predicate thisCanAccessClassTrans(Class base, Class derived) {
-    // This implementation relies on the following property of our predicates:
-    // if `this.thisCanAccessClassStep(b, d)` and
-    // `isDirectPublicBaseOf(b2, b)`, then
-    // `this.thisCanAccessClassStep(b2, d)`. In other words, if a derivation
-    // uses (4.2) or (4.3) somewhere and uses (4.1) directly above that in the
-    // transitive chain, then the use of (4.1) is redundant. This means we only
-    // need to consider derivations that use (4.2) or (4.3) as the "first"
-    // step, that is, towards `base`, so this implementation is essentially a
-    // transitive closure with a restricted base case.
-    this.thisCanAccessClassStep(base, derived)
-    or
-    exists(Class between | thisCanAccessClassTrans(base, between) |
-      isDirectPublicBaseOf(between, derived) or
-      this.thisCanAccessClassStep(between, derived)
-    )
-    // It is possible that this predicate could be computed faster for deep
-    // hierarchies if we can prove and utilize that all derivations of 11.2/4
-    // can be broken down into steps where `base` is a _direct_ base of
-    // `derived` in each step.
-  }
-
-  /**
-   * Holds if a base class `base` of `derived` _is accessible at_ `this` using
-   * only a single application of rule (4.2) and (4.3) of N4140 11.2/4.
-   */
-  private predicate thisCanAccessClassStep(Class base, Class derived) {
-    exists(AccessSpecifier public | public.hasName("public") |
-      // Rules (4.2) and (4.3) are implemented together as one here with
-      // reflexive-transitive inheritance, where (4.3) is the transitive case,
-      // and (4.2) is the reflexive case.
-      exists(Class p | p = derived.getADerivedClass*() |
-        this.isFriendOfOrEqualTo(p) and
-        // Note: it's crucial that this is `!=` rather than `not =` since
-        // `accessOfBaseMember` does not have a result when the member would be
-        // inaccessible.
-        p.accessOfBaseMember(base, public) != public
-      )
-    ) and
-    // This is the only case that doesn't in itself guarantee that
-    // `derived` < `base`, so we add the check here. The standard suggests
-    // computing `canAccessClass` only for derived classes, but that seems
-    // incompatible with the execution model of QL, so we instead construct
-    // every case to guarantee `derived` < `base`.
-    derived = base.getADerivedClass+()
-  }
-
-  /**
-   * Like `couldAccessMember` but only contains derivations in which either
-   * (5.2), (5.3) or (5.4) must be invoked. In other words, the `this`
-   * parameter is not ignored. This restriction makes it feasible to fully
-   * enumerate this predicate even on large code bases. We check for 11.4 as
-   * part of (5.3), since this further limits the number of tuples produced by
-   * this predicate.
-   */
-  predicate thisCouldAccessMember(Class memberClass, AccessSpecifier memberAccess, Class derived) {
-    // Only (5.4) is recursive, and chains of invocations of (5.4) can always
-    // be collapsed to one invocation by the transitivity of 11.2/4.
-    // Derivations not using (5.4) can always be rewritten to have a (5.4) rule
-    // in front because our encoding of 11.2/4 in `canAccessClass` is
-    // reflexive. Thus, we only need to consider three cases: rule (5.4)
-    // followed by either (5.1), (5.2) or (5.3).
-    // Rule (5.4), using a non-trivial derivation of 11.2/4, followed by (5.1).
-    // If the derivation of 11.2/4 is trivial (only uses (4.1) and (4.4)), this
-    // case can be replaced with purely (5.1) and thus does not need to be in
-    // this predicate.
-    exists(Class between | this.thisCanAccessClassTrans(between, derived) |
-      everyoneCouldAccessMember(memberClass, memberAccess, between)
-    )
-    or
-    // Rule (5.4) followed by Rule (5.2)
-    exists(Class between | this.(AccessHolder).canAccessClass(between, derived) |
-      between.accessOfBaseMember(memberClass, memberAccess).hasName("private") and
-      this.isFriendOfOrEqualTo(between)
-    )
-    or
-    // Rule (5.4) followed by Rule (5.3), integrating 11.4. We integrate 11.4
-    // here because we would otherwise generate too many tuples. This code is
-    // very performance-sensitive, and any changes should be benchmarked on
-    // LibreOffice.
-    // Rule (5.4) requires that `this.canAccessClass(between, derived)`
-    // (implying that `derived <= between` in the class hierarchy) and that
-    // `p <= between`. Rule 11.4 additionally requires `derived <= p`, but
-    // all these rules together result in too much freedom and overlap between
-    // cases. Therefore, for performance, we split into three cases for how
-    // `between` as a base of `derived` is accessible at `this`, where `this`
-    // is the implementation of `p`:
-    // 1. `between` is an accessible base of `derived` by going through `p` as
-    //    an intermediate step.
-    // 2. `this` is part of the implementation of `derived` because it's a
-    //    member or a friend. In this case, we do not need `p` to perform this
-    //    derivation, so we can set `p = derived` and proceed as in case 1.
-    // 3. `derived` has an alternative inheritance path up to `between` that
-    //    bypasses `p`. Then that path must be public, or we are in case 2.
-    exists(AccessSpecifier public | public.hasName("public") |
-      exists(Class between, Class p |
-        between.accessOfBaseMember(memberClass, memberAccess).hasName("protected") and
-        this.isFriendOfOrEqualTo(p) and
-        (
-          // This is case 1 from above. If `p` derives privately from `between`
-          // then the member we're trying to access is private or inaccessible
-          // in `derived`, so either rule (5.2) applies instead, or the member
-          // is inaccessible. Therefore, in this case, `p` must derive at least
-          // protected from `between`. Further, since the access of `derived`
-          // to its base `between` must pass through `p` in this case, we know
-          // that `derived` must derived publicly from `p` unless we are in
-          // case 2; there are no other cases of 11.2/4 where the
-          // implementation of a base class can access itself as a base.
-          p.accessOfBaseMember(between, public).getName() >= "protected" and
-          derived.accessOfBaseMember(p, public) = public
-          or
-          // This is case 3 above.
-          derived.accessOfBaseMember(between, public) = public and
-          derived = p.getADerivedClass*() and
-          exists(p.accessOfBaseMember(between, memberAccess))
-        )
-      )
-    )
-  }
-
-  private predicate isFriendOfOrEqualTo(Class c) {
-    exists(FriendDecl fd | fd.getDeclaringClass() = c | this = fd.getFriend())
-    or
-    this = c
-  }
-}
-
-/**
- * Holds if `base` is a direct public base of `derived`, possibly virtual and
- * possibly through typedefs. The transitive closure of this predicate encodes
- * derivations of N4140 11.2/4 that use only (4.1) and (4.4).
- */
-private predicate isDirectPublicBaseOf(Class base, Class derived) {
-  exists(ClassDerivation cd |
-    cd.getBaseClass() = base and
-    cd.getDerivedClass() = derived and
-    cd.getASpecifier().hasName("public")
-  )
-}
-
-/**
- * Holds if a hypothetical member of `memberClass` with access specifier
- * `memberAccess` would be public when named as a member of `derived`.
- * This encodes N4140 11.2/5 case (5.1).
- */
-private predicate everyoneCouldAccessMember(
-  Class memberClass, AccessSpecifier memberAccess, Class derived
-) {
-  derived.accessOfBaseMember(memberClass, memberAccess).hasName("public")
-}

cpp/ql/lib/semmle/code/cpp/Element.qll

@@ -1,292 +0,0 @@
-/**
- * Provides the `Element` class, which is the base class for all classes representing C or C++
- * program elements.
- */
-
-import semmle.code.cpp.Location
-private import semmle.code.cpp.Enclosing
-private import semmle.code.cpp.internal.ResolveClass
-
-/**
- * Get the `Element` that represents this `@element`.
- * Normally this will simply be a cast of `e`, but sometimes it is not.
- * For example, for an incomplete struct `e` the result may be a
- * complete struct with the same name.
- */
-pragma[inline]
-Element mkElement(@element e) { unresolveElement(result) = e }
-
-/**
- * INTERNAL: Do not use.
- *
- * Gets an `@element` that resolves to the `Element`. This should
- * normally only be called from member predicates, where `e` is not
- * `this` and you need the result for an argument to a database
- * extensional.
- * See `underlyingElement` for when `e` is `this`.
- */
-pragma[inline]
-@element unresolveElement(Element e) {
-  not result instanceof @usertype and
-  result = e
-  or
-  e = resolveClass(result)
-}
-
-/**
- * INTERNAL: Do not use.
- *
- * Gets the `@element` that this `Element` extends. This should normally
- * only be called from member predicates, where `e` is `this` and you
- * need the result for an argument to a database extensional.
- * See `unresolveElement` for when `e` is not `this`.
- */
-@element underlyingElement(Element e) { result = e }
-
-/**
- * A C/C++ element with no member predicates other than `toString`. Not for
- * general use. This class does not define a location, so classes wanting to
- * change their location without affecting other classes can extend
- * `ElementBase` instead of `Element` to create a new rootdef for `getURL`,
- * `getLocation`, or `hasLocationInfo`.
- */
-class ElementBase extends @element {
-  /** Gets a textual representation of this element. */
-  cached
-  string toString() { none() }
-
-  /** DEPRECATED: use `getAPrimaryQlClass` instead. */
-  deprecated string getCanonicalQLClass() { result = this.getAPrimaryQlClass() }
-
-  /**
-   * Gets the name of a primary CodeQL class to which this element belongs.
-   *
-   * For most elements, this is simply the most precise syntactic category to
-   * which they belong; for example, `AddExpr` is a primary class, but
-   * `BinaryOperation` is not.
-   *
-   * This predicate can have multiple results if multiple primary classes match.
-   * For some elements, this predicate may not have a result.
-   */
-  string getAPrimaryQlClass() { none() }
-}
-
-/**
- * A C/C++ element. This class is the base class for all C/C++
- * elements, such as functions, classes, expressions, and so on.
- */
-class Element extends ElementBase {
-  /** Gets the primary file where this element occurs. */
-  File getFile() { result = this.getLocation().getFile() }
-
-  /**
-   * Holds if this element may be from source. This predicate holds for all
-   * elements, except for those in the dummy file, whose name is the empty string.
-   * The dummy file contains declarations that are built directly into the compiler.
-   */
-  predicate fromSource() { this.getFile().fromSource() }
-
-  /**
-   * Holds if this element may be from a library.
-   *
-   * DEPRECATED: always true.
-   */
-  deprecated predicate fromLibrary() { this.getFile().fromLibrary() }
-
-  /** Gets the primary location of this element. */
-  Location getLocation() { none() }
-
-  /**
-   * Gets the source of this element: either itself or a macro that expanded
-   * to this element.
-   *
-   * If the element is not in a macro expansion, then the "root" is just
-   * the element itself. Otherwise, it is the definition of the innermost
-   * macro whose expansion the element is in.
-   *
-   * This method is useful for filtering macro results in checks: simply
-   * blame `e.findRootCause` rather than `e`. This will report only bugs
-   * that are not in macros, and in addition report macros that (somewhere)
-   * expand to a bug.
-   */
-  Element findRootCause() {
-    if exists(MacroInvocation mi | this = mi.getAGeneratedElement())
-    then
-      exists(MacroInvocation mi |
-        this = mi.getAGeneratedElement() and
-        not exists(MacroInvocation closer |
-          this = closer.getAGeneratedElement() and
-          mi = closer.getParentInvocation+()
-        ) and
-        result = mi.getMacro()
-      )
-    else result = this
-  }
-
-  /**
-   * Gets the parent scope of this `Element`, if any.
-   * A scope is a `Type` (`Class` / `Enum`), a `Namespace`, a `BlockStmt`, a `Function`,
-   * or certain kinds of `Statement`.
-   */
-  Element getParentScope() {
-    // result instanceof class
-    exists(Declaration m |
-      m = this and
-      result = m.getDeclaringType() and
-      not this instanceof EnumConstant
-    )
-    or
-    exists(TemplateClass tc | this = tc.getATemplateArgument() and result = tc)
-    or
-    // result instanceof namespace
-    exists(Namespace n | result = n and n.getADeclaration() = this)
-    or
-    exists(FriendDecl d, Namespace n | this = d and n.getADeclaration() = d and result = n)
-    or
-    exists(Namespace n | this = n and result = n.getParentNamespace())
-    or
-    // result instanceof stmt
-    exists(LocalVariable v |
-      this = v and
-      exists(DeclStmt ds | ds.getADeclaration() = v and result = ds.getParent())
-    )
-    or
-    exists(Parameter p | this = p and result = p.getFunction())
-    or
-    exists(GlobalVariable g, Namespace n | this = g and n.getADeclaration() = g and result = n)
-    or
-    exists(EnumConstant e | this = e and result = e.getDeclaringEnum())
-    or
-    // result instanceof block|function
-    exists(BlockStmt b | this = b and blockscope(unresolveElement(b), unresolveElement(result)))
-    or
-    exists(TemplateFunction tf | this = tf.getATemplateArgument() and result = tf)
-    or
-    // result instanceof stmt
-    exists(ControlStructure s | this = s and result = s.getParent())
-    or
-    using_container(unresolveElement(result), underlyingElement(this))
-  }
-
-  /**
-   * Holds if this element comes from a macro expansion. Only elements that
-   * are entirely generated by a macro are included - for elements that
-   * partially come from a macro, see `isAffectedByMacro`.
-   */
-  predicate isInMacroExpansion() { inMacroExpansion(this) }
-
-  /**
-   * Holds if this element is affected in any way by a macro. All elements
-   * that are totally or partially generated by a macro are included, so
-   * this is a super-set of `isInMacroExpansion`.
-   */
-  predicate isAffectedByMacro() { affectedByMacro(this) }
-
-  private Element getEnclosingElementPref() {
-    enclosingfunction(underlyingElement(this), unresolveElement(result)) or
-    result.(Function) = stmtEnclosingElement(this) or
-    this.(LocalScopeVariable).getFunction() = result or
-    enumconstants(underlyingElement(this), unresolveElement(result), _, _, _, _) or
-    derivations(underlyingElement(this), unresolveElement(result), _, _, _) or
-    stmtparents(underlyingElement(this), _, unresolveElement(result)) or
-    exprparents(underlyingElement(this), _, unresolveElement(result)) or
-    namequalifiers(underlyingElement(this), unresolveElement(result), _, _) or
-    initialisers(underlyingElement(this), unresolveElement(result), _, _) or
-    exprconv(unresolveElement(result), underlyingElement(this)) or
-    param_decl_bind(underlyingElement(this), _, unresolveElement(result)) or
-    using_container(unresolveElement(result), underlyingElement(this)) or
-    static_asserts(unresolveElement(this), _, _, _, underlyingElement(result))
-  }
-
-  /** Gets the closest `Element` enclosing this one. */
-  cached
-  Element getEnclosingElement() {
-    result = getEnclosingElementPref()
-    or
-    not exists(getEnclosingElementPref()) and
-    (
-      this = result.(Class).getAMember()
-      or
-      result = exprEnclosingElement(this)
-      or
-      var_decls(underlyingElement(this), unresolveElement(result), _, _, _)
-    )
-  }
-
-  /**
-   * Holds if this `Element` is a part of a template instantiation (but not
-   * the template itself).
-   */
-  predicate isFromTemplateInstantiation(Element instantiation) {
-    exists(Element e | isFromTemplateInstantiationRec(e, instantiation) |
-      this = e or
-      this.(DeclarationEntry).getDeclaration() = e
-    )
-  }
-
-  /**
-   * Holds if this `Element` is part of a template `template` (not if it is
-   * part of an instantiation of `template`). This means it is represented in
-   * the database purely as syntax and without guarantees on the presence or
-   * correctness of type-based operations such as implicit conversions.
-   *
-   * If an element is nested within several templates, this predicate holds with
-   * a value of `template` for each containing template.
-   */
-  predicate isFromUninstantiatedTemplate(Element template) {
-    exists(Element e | isFromUninstantiatedTemplateRec(e, template) |
-      this = e or
-      this.(DeclarationEntry).getDeclaration() = e
-    )
-  }
-}
-
-private predicate isFromTemplateInstantiationRec(Element e, Element instantiation) {
-  instantiation.(Function).isConstructedFrom(_) and
-  e = instantiation
-  or
-  instantiation.(Class).isConstructedFrom(_) and
-  e = instantiation
-  or
-  instantiation.(Variable).isConstructedFrom(_) and
-  e = instantiation
-  or
-  isFromTemplateInstantiationRec(e.getEnclosingElement(), instantiation)
-}
-
-private predicate isFromUninstantiatedTemplateRec(Element e, Element template) {
-  is_class_template(unresolveElement(template)) and
-  e = template
-  or
-  is_function_template(unresolveElement(template)) and
-  e = template
-  or
-  is_variable_template(unresolveElement(template)) and
-  e = template
-  or
-  isFromUninstantiatedTemplateRec(e.getEnclosingElement(), template)
-}
-
-/**
- * A C++11 `static_assert` or C11 `_Static_assert` construct. For example each
- * line in the following example contains a static assert:
- * ```
- * static_assert(sizeof(MyStruct) <= 4096);
- * static_assert(sizeof(MyStruct) <= 4096, "MyStruct is too big!");
- * ```
- */
-class StaticAssert extends Locatable, @static_assert {
-  override string toString() { result = "static_assert(..., \"" + getMessage() + "\")" }
-
-  /**
-   * Gets the expression which this static assertion ensures is true.
-   */
-  Expr getCondition() { static_asserts(underlyingElement(this), unresolveElement(result), _, _, _) }
-
-  /**
-   * Gets the message which will be reported by the compiler if this static assertion fails.
-   */
-  string getMessage() { static_asserts(underlyingElement(this), _, result, _, _) }
-
-  override Location getLocation() { static_asserts(underlyingElement(this), _, _, result, _) }
-}

cpp/ql/lib/semmle/code/cpp/File.qll

@@ -1,443 +0,0 @@
-/**
- * Provides classes representing files and folders.
- */
-
-import semmle.code.cpp.Element
-import semmle.code.cpp.Declaration
-import semmle.code.cpp.metrics.MetricFile
-
-/** A file or folder. */
-class Container extends Locatable, @container {
-  /**
-   * Gets the absolute, canonical path of this container, using forward slashes
-   * as path separator.
-   *
-   * The path starts with a _root prefix_ followed by zero or more _path
-   * segments_ separated by forward slashes.
-   *
-   * The root prefix is of one of the following forms:
-   *
-   *   1. A single forward slash `/` (Unix-style)
-   *   2. An upper-case drive letter followed by a colon and a forward slash,
-   *      such as `C:/` (Windows-style)
-   *   3. Two forward slashes, a computer name, and then another forward slash,
-   *      such as `//FileServer/` (UNC-style)
-   *
-   * Path segments are never empty (that is, absolute paths never contain two
-   * contiguous slashes, except as part of a UNC-style root prefix). Also, path
-   * segments never contain forward slashes, and no path segment is of the
-   * form `.` (one dot) or `..` (two dots).
-   *
-   * Note that an absolute path never ends with a forward slash, except if it is
-   * a bare root prefix, that is, the path has no path segments. A container
-   * whose absolute path has no segments is always a `Folder`, not a `File`.
-   */
-  string getAbsolutePath() { none() } // overridden by subclasses
-
-  /**
-   * DEPRECATED: Use `getLocation` instead.
-   * Gets a URL representing the location of this container.
-   *
-   * For more information see [Providing URLs](https://help.semmle.com/QL/learn-ql/ql/locations.html#providing-urls).
-   */
-  deprecated string getURL() { none() } // overridden by subclasses
-
-  /**
-   * Gets the relative path of this file or folder from the root folder of the
-   * analyzed source location. The relative path of the root folder itself is
-   * the empty string.
-   *
-   * This has no result if the container is outside the source root, that is,
-   * if the root folder is not a reflexive, transitive parent of this container.
-   */
-  string getRelativePath() {
-    exists(string absPath, string pref |
-      absPath = getAbsolutePath() and sourceLocationPrefix(pref)
-    |
-      absPath = pref and result = ""
-      or
-      absPath = pref.regexpReplaceAll("/$", "") + "/" + result and
-      not result.matches("/%")
-    )
-  }
-
-  /**
-   * Gets the base name of this container including extension, that is, the last
-   * segment of its absolute path, or the empty string if it has no segments.
-   *
-   * Here are some examples of absolute paths and the corresponding base names
-   * (surrounded with quotes to avoid ambiguity):
-   *
-   * <table border="1">
-   * <tr><th>Absolute path</th><th>Base name</th></tr>
-   * <tr><td>"/tmp/tst.js"</td><td>"tst.js"</td></tr>
-   * <tr><td>"C:/Program Files (x86)"</td><td>"Program Files (x86)"</td></tr>
-   * <tr><td>"/"</td><td>""</td></tr>
-   * <tr><td>"C:/"</td><td>""</td></tr>
-   * <tr><td>"D:/"</td><td>""</td></tr>
-   * <tr><td>"//FileServer/"</td><td>""</td></tr>
-   * </table>
-   */
-  string getBaseName() {
-    result = getAbsolutePath().regexpCapture(".*/(([^/]*?)(?:\\.([^.]*))?)", 1)
-  }
-
-  /**
-   * Gets the extension of this container, that is, the suffix of its base name
-   * after the last dot character, if any.
-   *
-   * In particular,
-   *
-   *  - if the name does not include a dot, there is no extension, so this
-   *    predicate has no result;
-   *  - if the name ends in a dot, the extension is the empty string;
-   *  - if the name contains multiple dots, the extension follows the last dot.
-   *
-   * Here are some examples of absolute paths and the corresponding extensions
-   * (surrounded with quotes to avoid ambiguity):
-   *
-   * <table border="1">
-   * <tr><th>Absolute path</th><th>Extension</th></tr>
-   * <tr><td>"/tmp/tst.js"</td><td>"js"</td></tr>
-   * <tr><td>"/tmp/.classpath"</td><td>"classpath"</td></tr>
-   * <tr><td>"/bin/bash"</td><td>not defined</td></tr>
-   * <tr><td>"/tmp/tst2."</td><td>""</td></tr>
-   * <tr><td>"/tmp/x.tar.gz"</td><td>"gz"</td></tr>
-   * </table>
-   */
-  string getExtension() { result = getAbsolutePath().regexpCapture(".*/([^/]*?)(\\.([^.]*))?", 3) }
-
-  /**
-   * Gets the stem of this container, that is, the prefix of its base name up to
-   * (but not including) the last dot character if there is one, or the entire
-   * base name if there is not.
-   *
-   * Here are some examples of absolute paths and the corresponding stems
-   * (surrounded with quotes to avoid ambiguity):
-   *
-   * <table border="1">
-   * <tr><th>Absolute path</th><th>Stem</th></tr>
-   * <tr><td>"/tmp/tst.js"</td><td>"tst"</td></tr>
-   * <tr><td>"/tmp/.classpath"</td><td>""</td></tr>
-   * <tr><td>"/bin/bash"</td><td>"bash"</td></tr>
-   * <tr><td>"/tmp/tst2."</td><td>"tst2"</td></tr>
-   * <tr><td>"/tmp/x.tar.gz"</td><td>"x.tar"</td></tr>
-   * </table>
-   */
-  string getStem() { result = getAbsolutePath().regexpCapture(".*/([^/]*?)(?:\\.([^.]*))?", 1) }
-
-  /** Gets the parent container of this file or folder, if any. */
-  Container getParentContainer() {
-    containerparent(unresolveElement(result), underlyingElement(this))
-  }
-
-  /** Gets a file or sub-folder in this container. */
-  Container getAChildContainer() { this = result.getParentContainer() }
-
-  /** Gets a file in this container. */
-  File getAFile() { result = getAChildContainer() }
-
-  /** Gets the file in this container that has the given `baseName`, if any. */
-  File getFile(string baseName) {
-    result = getAFile() and
-    result.getBaseName() = baseName
-  }
-
-  /** Gets a sub-folder in this container. */
-  Folder getAFolder() { result = getAChildContainer() }
-
-  /** Gets the sub-folder in this container that has the given `baseName`, if any. */
-  Folder getFolder(string baseName) {
-    result = getAFolder() and
-    result.getBaseName() = baseName
-  }
-
-  /**
-   * Gets a textual representation of the path of this container.
-   *
-   * This is the absolute path of the container.
-   */
-  override string toString() { result = getAbsolutePath() }
-}
-
-/**
- * A folder that was observed on disk during the build process.
- *
- * For the example folder name of "/usr/home/me", the path decomposes to:
- *
- *  1. "/usr/home" - see `getParentContainer`.
- *  2. "me" - see `getBaseName`.
- *
- * To get the full path, use `getAbsolutePath`.
- */
-class Folder extends Container, @folder {
-  override string getAbsolutePath() { folders(underlyingElement(this), result, _) }
-
-  override Location getLocation() {
-    result.getContainer() = this and
-    result.hasLocationInfo(_, 0, 0, 0, 0)
-  }
-
-  override string getAPrimaryQlClass() { result = "Folder" }
-
-  /**
-   * DEPRECATED: Use `getLocation` instead.
-   * Gets the URL of this folder.
-   */
-  deprecated override string getURL() { result = "file://" + this.getAbsolutePath() + ":0:0:0:0" }
-
-  /**
-   * DEPRECATED: use `getAbsolutePath` instead.
-   * Gets the name of this folder.
-   */
-  deprecated string getName() { folders(underlyingElement(this), result, _) }
-
-  /**
-   * DEPRECATED: use `getAbsolutePath` instead.
-   * Holds if this element is named `name`.
-   */
-  deprecated predicate hasName(string name) { name = this.getName() }
-
-  /**
-   * DEPRECATED: use `getAbsolutePath` instead.
-   * Gets the full name of this folder.
-   */
-  deprecated string getFullName() { result = this.getName() }
-
-  /**
-   * DEPRECATED: use `getBaseName` instead.
-   * Gets the last part of the folder name.
-   */
-  deprecated string getShortName() {
-    exists(string longnameRaw, string longname |
-      folders(underlyingElement(this), _, longnameRaw) and
-      longname = longnameRaw.replaceAll("\\", "/")
-    |
-      exists(int index |
-        result = longname.splitAt("/", index) and
-        not exists(longname.splitAt("/", index + 1))
-      )
-    )
-  }
-
-  /**
-   * DEPRECATED: use `getParentContainer` instead.
-   * Gets the parent folder.
-   */
-  deprecated Folder getParent() {
-    containerparent(unresolveElement(result), underlyingElement(this))
-  }
-}
-
-/**
- * A file that was observed on disk during the build process.
- *
- * For the example filename of "/usr/home/me/myprogram.c", the filename
- * decomposes to:
- *
- *  1. "/usr/home/me" - see `getParentContainer`.
- *  2. "myprogram.c" - see `getBaseName`.
- *
- * The base name further decomposes into the _stem_ and _extension_ -- see
- * `getStem` and `getExtension`. To get the full path, use `getAbsolutePath`.
- */
-class File extends Container, @file {
-  override string getAbsolutePath() { files(underlyingElement(this), result, _, _, _) }
-
-  override string toString() { result = Container.super.toString() }
-
-  override string getAPrimaryQlClass() { result = "File" }
-
-  override Location getLocation() {
-    result.getContainer() = this and
-    result.hasLocationInfo(_, 0, 0, 0, 0)
-  }
-
-  /**
-   * DEPRECATED: Use `getLocation` instead.
-   * Gets the URL of this file.
-   */
-  deprecated override string getURL() { result = "file://" + this.getAbsolutePath() + ":0:0:0:0" }
-
-  /** Holds if this file was compiled as C (at any point). */
-  predicate compiledAsC() { fileannotations(underlyingElement(this), 1, "compiled as c", "1") }
-
-  /** Holds if this file was compiled as C++ (at any point). */
-  predicate compiledAsCpp() { fileannotations(underlyingElement(this), 1, "compiled as c++", "1") }
-
-  /**
-   * Holds if this file was compiled by a Microsoft compiler (at any point).
-   *
-   * Note: currently unreliable - on some projects only some of the files that
-   * are compiled by a Microsoft compiler are detected by this predicate.
-   */
-  predicate compiledAsMicrosoft() {
-    exists(File f, Compilation c |
-      c.getAFileCompiled() = f and
-      (
-        c.getAnArgument() = "--microsoft" or
-        c.getAnArgument()
-            .toLowerCase()
-            .replaceAll("\\", "/")
-            .matches(["%/cl.exe", "%/clang-cl.exe"])
-      ) and
-      f.getAnIncludedFile*() = this
-    )
-  }
-
-  /** Gets a top-level element declared in this file. */
-  Declaration getATopLevelDeclaration() { result.getAFile() = this and result.isTopLevel() }
-
-  /** Gets a declaration in this file. */
-  Declaration getADeclaration() { result.getAFile() = this }
-
-  /** Holds if this file uses the given macro. */
-  predicate usesMacro(Macro m) {
-    exists(MacroInvocation mi |
-      mi.getFile() = this and
-      mi.getMacro() = m
-    )
-  }
-
-  /**
-   * Gets a file that is directly included from this file (using a
-   * pre-processor directive like `#include`).
-   */
-  File getAnIncludedFile() {
-    exists(Include i | i.getFile() = this and i.getIncludedFile() = result)
-  }
-
-  /**
-   * Holds if this file may be from source. This predicate holds for all files
-   * except the dummy file, whose name is the empty string, which contains
-   * declarations that are built into the compiler.
-   */
-  override predicate fromSource() { numlines(underlyingElement(this), _, _, _) }
-
-  /**
-   * Holds if this file may be from a library.
-   *
-   * DEPRECATED: For historical reasons this is true for any file.
-   */
-  deprecated override predicate fromLibrary() { any() }
-
-  /** Gets the metric file. */
-  MetricFile getMetrics() { result = this }
-
-  /**
-   * Gets the remainder of the base name after the first dot character. Note
-   * that the name of this predicate is in plural form, unlike `getExtension`,
-   * which gets the remainder of the base name after the _last_ dot character.
-   *
-   * Predicates `getStem` and `getExtension` should be preferred over
-   * `getShortName` and `getExtensions` since the former pair is compatible
-   * with the file libraries of other languages.
-   * Note the slight difference between this predicate and `getStem`:
-   * for example, for "file.tar.gz", this predicate will have the result
-   * "tar.gz", while `getExtension` will have the result "gz".
-   */
-  string getExtensions() { files(underlyingElement(this), _, _, result, _) }
-
-  /**
-   * Gets the short name of this file, that is, the prefix of its base name up
-   * to (but not including) the first dot character if there is one, or the
-   * entire base name if there is not. For example, if the full name is
-   * "/path/to/filename.a.bcd" then the short name is "filename".
-   *
-   * Predicates `getStem` and `getExtension` should be preferred over
-   * `getShortName` and `getExtensions` since the former pair is compatible
-   * with the file libraries of other languages.
-   * Note the slight difference between this predicate and `getStem`:
-   * for example, for "file.tar.gz", this predicate will have the result
-   * "file", while `getStem` will have the result "file.tar".
-   */
-  string getShortName() { files(underlyingElement(this), _, result, _, _) }
-}
-
-/**
- * Holds if any file was compiled by a Microsoft compiler.
- */
-predicate anyFileCompiledAsMicrosoft() { any(File f).compiledAsMicrosoft() }
-
-/**
- * A C/C++ header file, as determined (mainly) by file extension.
- *
- * For the related notion of whether a file is included anywhere (using a
- * pre-processor directive like `#include`), use `Include.getIncludedFile`.
- */
-class HeaderFile extends File {
-  HeaderFile() {
-    this.getExtension().toLowerCase() =
-      ["h", "r", "hpp", "hxx", "h++", "hh", "hp", "tcc", "tpp", "txx", "t++"]
-    or
-    not exists(this.getExtension()) and
-    exists(Include i | i.getIncludedFile() = this)
-  }
-
-  override string getAPrimaryQlClass() { result = "HeaderFile" }
-
-  /**
-   * Holds if this header file does not contain any declaration entries or top level
-   * declarations.  For example it might be:
-   *  - a file containing only preprocessor directives and/or comments
-   *  - an empty file
-   *  - a file that contains non-top level code or data that's included in an
-   *    unusual way
-   */
-  predicate noTopLevelCode() {
-    not exists(DeclarationEntry de | de.getFile() = this) and
-    not exists(Declaration d | d.getFile() = this and d.isTopLevel()) and
-    not exists(UsingEntry ue | ue.getFile() = this)
-  }
-}
-
-/**
- * A C source file, as determined by file extension.
- *
- * For the related notion of whether a file is compiled as C code, use
- * `File.compiledAsC`.
- */
-class CFile extends File {
-  CFile() { this.getExtension().toLowerCase() = ["c", "i"] }
-
-  override string getAPrimaryQlClass() { result = "CFile" }
-}
-
-/**
- * A C++ source file, as determined by file extension.
- *
- * For the related notion of whether a file is compiled as C++ code, use
- * `File.compiledAsCpp`.
- */
-class CppFile extends File {
-  CppFile() {
-    this.getExtension().toLowerCase() =
-      ["cpp", "cxx", "c++", "cc", "cp", "icc", "ipp", "ixx", "i++", "ii"]
-    // Note: .C files are indistinguishable from .c files on some
-    // file systems, so we just treat them as CFile's.
-  }
-
-  override string getAPrimaryQlClass() { result = "CppFile" }
-}
-
-/**
- * DEPRECATED: Objective-C is no longer supported.
- * An Objective C source file, as determined by file extension.
- *
- * For the related notion of whether a file is compiled as Objective C
- * code, use `File.compiledAsObjC`.
- */
-deprecated class ObjCFile extends File {
-  ObjCFile() { none() }
-}
-
-/**
- * DEPRECATED: Objective-C is no longer supported.
- * An Objective C++ source file, as determined by file extension.
- *
- * For the related notion of whether a file is compiled as Objective C++
- * code, use `File.compiledAsObjCpp`.
- */
-deprecated class ObjCppFile extends File {
-  ObjCppFile() { none() }
-}

cpp/ql/lib/semmle/code/cpp/Function.qll

@@ -1,848 +0,0 @@
-/**
- * Provides classes for working with functions, including template functions.
- */
-
-import semmle.code.cpp.Location
-import semmle.code.cpp.Class
-import semmle.code.cpp.Parameter
-import semmle.code.cpp.exprs.Call
-import semmle.code.cpp.metrics.MetricFunction
-import semmle.code.cpp.Linkage
-private import semmle.code.cpp.internal.ResolveClass
-
-/**
- * A C/C++ function [N4140 8.3.5]. Both member functions and non-member
- * functions are included. For example the function `MyFunction` in:
- * ```
- * void MyFunction() {
- *   DoSomething();
- * }
- * ```
- *
- * Function has a one-to-many relationship with FunctionDeclarationEntry,
- * because the same function can be declared in multiple locations. This
- * relationship between `Declaration` and `DeclarationEntry` is explained
- * in more detail in `Declaration.qll`.
- */
-class Function extends Declaration, ControlFlowNode, AccessHolder, @function {
-  override string getName() { functions(underlyingElement(this), result, _) }
-
-  /**
-   * DEPRECATED: Use `getIdentityString(Declaration)` from `semmle.code.cpp.Print` instead.
-   * Gets the full signature of this function, including return type, parameter
-   * types, and template arguments.
-   *
-   * For example, in the following code:
-   * ```
-   * template<typename T> T min(T x, T y);
-   * int z = min(5, 7);
-   * ```
-   * The full signature of the function called on the last line would be
-   * "min<int>(int, int) -> int", and the full signature of the uninstantiated
-   * template on the first line would be "min<T>(T, T) -> T".
-   */
-  string getFullSignature() {
-    exists(string name, string templateArgs, string args |
-      result = name + templateArgs + args + " -> " + getType().toString() and
-      name = getQualifiedName() and
-      (
-        if exists(getATemplateArgument())
-        then
-          templateArgs =
-            "<" +
-              concat(int i |
-                exists(getTemplateArgument(i))
-              |
-                getTemplateArgument(i).toString(), ", " order by i
-              ) + ">"
-        else templateArgs = ""
-      ) and
-      args =
-        "(" +
-          concat(int i |
-            exists(getParameter(i))
-          |
-            getParameter(i).getType().toString(), ", " order by i
-          ) + ")"
-    )
-  }
-
-  /** Gets a specifier of this function. */
-  override Specifier getASpecifier() {
-    funspecifiers(underlyingElement(this), unresolveElement(result)) or
-    result.hasName(getADeclarationEntry().getASpecifier())
-  }
-
-  /** Gets an attribute of this function. */
-  Attribute getAnAttribute() { funcattributes(underlyingElement(this), unresolveElement(result)) }
-
-  /** Holds if this function is generated by the compiler. */
-  predicate isCompilerGenerated() { compgenerated(underlyingElement(this)) }
-
-  /** Holds if this function is inline. */
-  predicate isInline() { this.hasSpecifier("inline") }
-
-  /** Holds if this function is virtual. */
-  predicate isVirtual() { this.hasSpecifier("virtual") }
-
-  /**
-   * Holds if this function is deleted.
-   * This may be because it was explicitly deleted with an `= delete`
-   * definition, or because the compiler was unable to auto-generate a
-   * definition for it.
-   *
-   * Most implicitly deleted functions are omitted from the database.
-   * `Class.implicitCopyConstructorDeleted` and
-   * `Class.implicitCopyAssignmentOperatorDeleted` can be used to find
-   * whether a class would have had those members implicitly deleted.
-   */
-  predicate isDeleted() { function_deleted(underlyingElement(this)) }
-
-  /**
-   * Holds if this function is explicitly defaulted with the `= default`
-   * specifier.
-   */
-  predicate isDefaulted() { function_defaulted(underlyingElement(this)) }
-
-  /**
-   * Holds if this function is declared to be `constexpr`.
-   *
-   * Note that this does not hold if the function has been declared
-   * `consteval`.
-   */
-  predicate isDeclaredConstexpr() { this.hasSpecifier("declared_constexpr") }
-
-  /**
-   * Holds if this function is `constexpr`. Normally, this holds if and
-   * only if `isDeclaredConstexpr()` holds, but in some circumstances
-   * they differ. For example, with
-   * ```
-   * int f(int i) { return 6; }
-   * template <typename T> constexpr int g(T x) { return f(x); }
-   * ```
-   * `g<int>` is declared constexpr, but is not constexpr.
-   *
-   * Will also hold if this function is `consteval`.
-   */
-  predicate isConstexpr() { this.hasSpecifier("is_constexpr") }
-
-  /**
-   * Holds if this function is declared to be `consteval`.
-   */
-  predicate isConsteval() { this.hasSpecifier("is_consteval") }
-
-  /**
-   * Holds if this function is declared with `__attribute__((naked))` or
-   * `__declspec(naked)`.
-   */
-  predicate isNaked() { getAnAttribute().hasName("naked") }
-
-  /** Gets the return type of this function. */
-  Type getType() { function_return_type(underlyingElement(this), unresolveElement(result)) }
-
-  /**
-   * Gets the return type of this function after specifiers have been deeply
-   * stripped and typedefs have been resolved.
-   */
-  Type getUnspecifiedType() { result = getType().getUnspecifiedType() }
-
-  /**
-   * Gets the nth parameter of this function. There is no result for the
-   * implicit `this` parameter, and there is no `...` varargs pseudo-parameter.
-   */
-  Parameter getParameter(int n) { params(unresolveElement(result), underlyingElement(this), n, _) }
-
-  /**
-   * Gets a parameter of this function. There is no result for the implicit
-   * `this` parameter, and there is no `...` varargs pseudo-parameter.
-   */
-  Parameter getAParameter() { params(unresolveElement(result), underlyingElement(this), _, _) }
-
-  /**
-   * Gets an access of this function.
-   *
-   * To get calls to this function, use `getACallToThisFunction` instead.
-   */
-  FunctionAccess getAnAccess() { result.getTarget() = this }
-
-  /**
-   * Gets the number of parameters of this function, _not_ including any
-   * implicit `this` parameter or any `...` varargs pseudo-parameter.
-   */
-  int getNumberOfParameters() { result = count(this.getAParameter()) }
-
-  /**
-   * Gets the number of parameters of this function, _including_ any implicit
-   * `this` parameter but _not_ including any `...` varargs pseudo-parameter.
-   */
-  int getEffectiveNumberOfParameters() {
-    // This method is overridden in `MemberFunction`, where the result is
-    // adjusted to account for the implicit `this` parameter.
-    result = getNumberOfParameters()
-  }
-
-  /**
-   * Gets a string representing the parameters of this function.
-   *
-   * For example: for a function `int Foo(int p1, int p2)` this would
-   * return `int p1, int p2`.
-   */
-  string getParameterString() {
-    result = concat(int i | | min(getParameter(i).getTypedName()), ", " order by i)
-  }
-
-  /** Gets a call to this function. */
-  FunctionCall getACallToThisFunction() { result.getTarget() = this }
-
-  /**
-   * Gets a declaration entry corresponding to this declaration. The
-   * relationship between `Declaration` and `DeclarationEntry` is explained
-   * in `Declaration.qll`.
-   */
-  override FunctionDeclarationEntry getADeclarationEntry() {
-    if fun_decls(_, underlyingElement(this), _, _, _)
-    then declEntry(result)
-    else
-      exists(Function f |
-        this.isConstructedFrom(f) and
-        fun_decls(unresolveElement(result), unresolveElement(f), _, _, _)
-      )
-  }
-
-  private predicate declEntry(FunctionDeclarationEntry fde) {
-    fun_decls(unresolveElement(fde), underlyingElement(this), _, _, _) and
-    // If one .cpp file specializes a function, and another calls the
-    // specialized function, then when extracting the second we only see an
-    // instantiation, not the specialization. We Therefore need to ignore
-    // any non-specialized declarations if there are any specialized ones.
-    (this.isSpecialization() implies fde.isSpecialization())
-  }
-
-  /**
-   * Gets the location of a `FunctionDeclarationEntry` corresponding to this
-   * declaration.
-   */
-  override Location getADeclarationLocation() { result = getADeclarationEntry().getLocation() }
-
-  /** Holds if this Function is a Template specialization. */
-  predicate isSpecialization() {
-    exists(FunctionDeclarationEntry fde |
-      fun_decls(unresolveElement(fde), underlyingElement(this), _, _, _) and
-      fde.isSpecialization()
-    )
-  }
-
-  /**
-   * Gets the declaration entry corresponding to this declaration that is a
-   * definition, if any.
-   */
-  override FunctionDeclarationEntry getDefinition() {
-    result = getADeclarationEntry() and
-    result.isDefinition()
-  }
-
-  /** Gets the location of the definition, if any. */
-  override Location getDefinitionLocation() {
-    if exists(getDefinition())
-    then result = getDefinition().getLocation()
-    else exists(Function f | this.isConstructedFrom(f) and result = f.getDefinition().getLocation())
-  }
-
-  /**
-   * Gets the preferred location of this declaration. (The location of the
-   * definition, if possible.)
-   */
-  override Location getLocation() {
-    if exists(getDefinition())
-    then result = this.getDefinitionLocation()
-    else result = this.getADeclarationLocation()
-  }
-
-  /** Gets a child declaration of this function. */
-  Declaration getADeclaration() { result = this.getAParameter() }
-
-  /**
-   * Gets the block that is the function body.
-   *
-   * For C++ functions whose body is a function try statement rather than a
-   * block, this gives the block guarded by the try statement. See
-   * `FunctionTryStmt` for further information.
-   */
-  BlockStmt getBlock() { result.getParentScope() = this }
-
-  /** Holds if this function has an entry point. */
-  predicate hasEntryPoint() { exists(getEntryPoint()) }
-
-  /**
-   * Gets the first node in this function's control flow graph.
-   *
-   * For most functions, this first node will be the `BlockStmt` returned by
-   * `getBlock`. However in C++, the first node can also be a
-   * `FunctionTryStmt`.
-   */
-  Stmt getEntryPoint() { function_entry_point(underlyingElement(this), unresolveElement(result)) }
-
-  /**
-   * Gets the metric class. `MetricFunction` has methods for computing
-   * various metrics, such as "number of lines of code" and "number of
-   * function calls".
-   */
-  MetricFunction getMetrics() { result = this }
-
-  /** Holds if this function calls the function `f`. */
-  predicate calls(Function f) { exists(Locatable l | this.calls(f, l)) }
-
-  /**
-   * Holds if this function calls the function `f` in the `FunctionCall`
-   * expression `l`.
-   */
-  predicate calls(Function f, Locatable l) {
-    exists(FunctionCall call |
-      call.getEnclosingFunction() = this and call.getTarget() = f and call = l
-    )
-    or
-    exists(DestructorCall call |
-      call.getEnclosingFunction() = this and call.getTarget() = f and call = l
-    )
-  }
-
-  /** Holds if this function accesses a function or variable or enumerator `a`. */
-  predicate accesses(Declaration a) { exists(Locatable l | this.accesses(a, l)) }
-
-  /**
-   * Holds if this function accesses a function or variable or enumerator `a`
-   * in the `Access` expression `l`.
-   */
-  predicate accesses(Declaration a, Locatable l) {
-    exists(Access access |
-      access.getEnclosingFunction() = this and
-      a = access.getTarget() and
-      access = l
-    )
-  }
-
-  /** Gets a variable that is written-to in this function. */
-  Variable getAWrittenVariable() {
-    exists(ConstructorFieldInit cfi |
-      cfi.getEnclosingFunction() = this and result = cfi.getTarget()
-    )
-    or
-    exists(VariableAccess va |
-      va = result.getAnAccess() and
-      va.isUsedAsLValue() and
-      va.getEnclosingFunction() = this
-    )
-  }
-
-  /**
-   * Gets the class of which this function, called `memberName`, is a member.
-   *
-   * Prefer to use `getDeclaringType()` or `getName()` directly if you do not
-   * need to reason about both.
-   */
-  pragma[nomagic]
-  Class getClassAndName(string memberName) {
-    this.hasName(memberName) and
-    this.getDeclaringType() = result
-  }
-
-  /**
-   * Implements `ControlFlowNode.getControlFlowScope`. The `Function` is
-   * used to represent the exit node of the control flow graph, so it is
-   * its own scope.
-   */
-  override Function getControlFlowScope() { result = this }
-
-  /**
-   * Implements `ControlFlowNode.getEnclosingStmt`. The `Function` is
-   * used to represent the exit node of the control flow graph, so it
-   * has no enclosing statement.
-   */
-  override Stmt getEnclosingStmt() { none() }
-
-  /**
-   * Holds if this function has C linkage, as specified by one of its
-   * declaration entries. For example: `extern "C" void foo();`.
-   */
-  predicate hasCLinkage() { getADeclarationEntry().hasCLinkage() }
-
-  /**
-   * Holds if this function is constructed from `f` as a result
-   * of template instantiation. If so, it originates either from a template
-   * function or from a function nested in a template class.
-   */
-  predicate isConstructedFrom(Function f) {
-    function_instantiation(underlyingElement(this), unresolveElement(f))
-  }
-
-  /**
-   * Holds if this function is defined in several files. This is illegal in
-   * C (though possible in some C++ compilers), and likely indicates that
-   * several functions that are not linked together have been compiled. An
-   * example would be a project with many 'main' functions.
-   */
-  predicate isMultiplyDefined() { strictcount(getFile()) > 1 }
-
-  /** Holds if this function is a varargs function. */
-  predicate isVarargs() { hasSpecifier("varargs") }
-
-  /** Gets a type that is specified to be thrown by the function. */
-  Type getAThrownType() { result = getADeclarationEntry().getAThrownType() }
-
-  /**
-   * Gets the `i`th type specified to be thrown by the function.
-   */
-  Type getThrownType(int i) { result = getADeclarationEntry().getThrownType(i) }
-
-  /** Holds if the function has an exception specification. */
-  predicate hasExceptionSpecification() { getADeclarationEntry().hasExceptionSpecification() }
-
-  /** Holds if this function has a `throw()` exception specification. */
-  predicate isNoThrow() { getADeclarationEntry().isNoThrow() }
-
-  /** Holds if this function has a `noexcept` exception specification. */
-  predicate isNoExcept() { getADeclarationEntry().isNoExcept() }
-
-  /**
-   * Gets a function that overloads this one.
-   *
-   * Note: if _overrides_ are wanted rather than _overloads_ then
-   * `MemberFunction::getAnOverridingFunction` should be used instead.
-   */
-  Function getAnOverload() {
-    (
-      // If this function is declared in a class, only consider other
-      // functions from the same class.
-      exists(string name, Class declaringType |
-        candGetAnOverloadMember(name, declaringType, this) and
-        candGetAnOverloadMember(name, declaringType, result)
-      )
-      or
-      // Conversely, if this function is not
-      // declared in a class, only consider other functions not declared in a
-      // class.
-      exists(string name, Namespace namespace |
-        candGetAnOverloadNonMember(name, namespace, this) and
-        candGetAnOverloadNonMember(name, namespace, result)
-      )
-    ) and
-    result != this and
-    // Instantiations and specializations don't participate in overload
-    // resolution.
-    not (
-      this instanceof FunctionTemplateInstantiation or
-      result instanceof FunctionTemplateInstantiation
-    ) and
-    not (
-      this instanceof FunctionTemplateSpecialization or
-      result instanceof FunctionTemplateSpecialization
-    )
-  }
-
-  /** Gets a link target which compiled or referenced this function. */
-  LinkTarget getALinkTarget() { this = result.getAFunction() }
-
-  /**
-   * Holds if this function is side-effect free (conservative
-   * approximation).
-   */
-  predicate isSideEffectFree() { not this.mayHaveSideEffects() }
-
-  /**
-   * Holds if this function may have side-effects; if in doubt, we assume it
-   * may.
-   */
-  predicate mayHaveSideEffects() {
-    // If we cannot see the definition then we assume that it may have
-    // side-effects.
-    if exists(this.getEntryPoint())
-    then
-      // If it might be globally impure (we don't care about it modifying
-      // temporaries) then it may have side-effects.
-      this.getEntryPoint().mayBeGloballyImpure()
-      or
-      // Constructor initializers are separate from the entry point ...
-      this.(Constructor).getAnInitializer().mayBeGloballyImpure()
-      or
-      // ... and likewise for destructors.
-      this.(Destructor).getADestruction().mayBeGloballyImpure()
-    else
-      // Unless it's a function that we know is side-effect free, it may
-      // have side-effects.
-      not this.hasGlobalOrStdName([
-          "strcmp", "wcscmp", "_mbscmp", "strlen", "wcslen", "_mbslen", "_mbslen_l", "_mbstrlen",
-          "_mbstrlen_l", "strnlen", "strnlen_s", "wcsnlen", "wcsnlen_s", "_mbsnlen", "_mbsnlen_l",
-          "_mbstrnlen", "_mbstrnlen_l", "strncmp", "wcsncmp", "_mbsncmp", "_mbsncmp_l", "strchr",
-          "memchr", "wmemchr", "memcmp", "wmemcmp", "_memicmp", "_memicmp_l", "feof", "isdigit",
-          "isxdigit", "abs", "fabs", "labs", "floor", "ceil", "atoi", "atol", "atoll", "atof"
-        ])
-  }
-
-  /**
-   * Gets the nearest enclosing AccessHolder.
-   */
-  override AccessHolder getEnclosingAccessHolder() { result = this.getDeclaringType() }
-}
-
-pragma[noinline]
-private predicate candGetAnOverloadMember(string name, Class declaringType, Function f) {
-  f.getName() = name and
-  f.getDeclaringType() = declaringType
-}
-
-pragma[noinline]
-private predicate candGetAnOverloadNonMember(string name, Namespace namespace, Function f) {
-  f.getName() = name and
-  f.getNamespace() = namespace and
-  not exists(f.getDeclaringType())
-}
-
-/**
- * A particular declaration or definition of a C/C++ function. For example the
- * declaration and definition of `MyFunction` in the following code are each a
- * `FunctionDeclarationEntry`:
- * ```
- * void MyFunction();
- *
- * void MyFunction() {
- *   DoSomething();
- * }
- * ```
- */
-class FunctionDeclarationEntry extends DeclarationEntry, @fun_decl {
-  /** Gets the function which is being declared or defined. */
-  override Function getDeclaration() { result = getFunction() }
-
-  override string getAPrimaryQlClass() { result = "FunctionDeclarationEntry" }
-
-  /** Gets the function which is being declared or defined. */
-  Function getFunction() { fun_decls(underlyingElement(this), unresolveElement(result), _, _, _) }
-
-  /** Gets the name of the function. */
-  override string getName() { fun_decls(underlyingElement(this), _, _, result, _) }
-
-  /**
-   * Gets the return type of the function which is being declared or
-   * defined.
-   */
-  override Type getType() { fun_decls(underlyingElement(this), _, unresolveElement(result), _, _) }
-
-  /** Gets the location of this declaration entry. */
-  override Location getLocation() { fun_decls(underlyingElement(this), _, _, _, result) }
-
-  /** Gets a specifier associated with this declaration entry. */
-  override string getASpecifier() { fun_decl_specifiers(underlyingElement(this), result) }
-
-  /**
-   * Implements `Element.getEnclosingElement`. A function declaration does
-   * not have an enclosing element.
-   */
-  override Element getEnclosingElement() { none() }
-
-  /**
-   * Gets the typedef type (if any) used for this function declaration. As
-   * an example, the typedef type in the declaration of function foo in the
-   * following is Foo:
-   *
-   * typedef int Foo();
-   * static Foo foo;
-   */
-  TypedefType getTypedefType() {
-    fun_decl_typedef_type(underlyingElement(this), unresolveElement(result))
-  }
-
-  /**
-   * Gets the cyclomatic complexity of this function:
-   *
-   *   The number of branching statements (if, while, do, for, switch,
-   *   case, catch) plus the number of branching expressions (`?`, `&&`,
-   *   `||`) plus one.
-   */
-  int getCyclomaticComplexity() { result = 1 + cyclomaticComplexityBranches(getBlock()) }
-
-  /**
-   * If this is a function definition, get the block containing the
-   * function body.
-   */
-  BlockStmt getBlock() {
-    this.isDefinition() and
-    result = getFunction().getBlock() and
-    result.getFile() = this.getFile()
-  }
-
-  /**
-   * If this is a function definition, get the number of lines of code
-   * associated with it.
-   */
-  pragma[noopt]
-  int getNumberOfLines() {
-    exists(BlockStmt b, Location l, int start, int end, int diff | b = getBlock() |
-      l = b.getLocation() and
-      start = l.getStartLine() and
-      end = l.getEndLine() and
-      diff = end - start and
-      result = diff + 1
-    )
-  }
-
-  /**
-   * Gets the declaration entry for a parameter of this function
-   * declaration.
-   */
-  ParameterDeclarationEntry getAParameterDeclarationEntry() {
-    result = getParameterDeclarationEntry(_)
-  }
-
-  /**
-   * Gets the declaration entry for the nth parameter of this function
-   * declaration.
-   */
-  ParameterDeclarationEntry getParameterDeclarationEntry(int n) {
-    param_decl_bind(unresolveElement(result), n, underlyingElement(this))
-  }
-
-  /** Gets the number of parameters of this function declaration. */
-  int getNumberOfParameters() { result = count(this.getAParameterDeclarationEntry()) }
-
-  /**
-   * Gets a string representing the parameters of this function declaration.
-   *
-   * For example: for a function 'int Foo(int p1, int p2)' this would
-   * return 'int p1, int p2'.
-   */
-  string getParameterString() {
-    result = concat(int i | | min(getParameterDeclarationEntry(i).getTypedName()), ", " order by i)
-  }
-
-  /**
-   * Holds if this declaration entry specifies C linkage:
-   *
-   *    `extern "C" void foo();`
-   */
-  predicate hasCLinkage() { getASpecifier() = "c_linkage" }
-
-  /** Holds if this declaration entry has a void parameter list. */
-  predicate hasVoidParamList() { getASpecifier() = "void_param_list" }
-
-  /** Holds if this declaration is also a definition of its function. */
-  override predicate isDefinition() { fun_def(underlyingElement(this)) }
-
-  /** Holds if this declaration is a Template specialization. */
-  predicate isSpecialization() { fun_specialized(underlyingElement(this)) }
-
-  /**
-   * Holds if this declaration is an implicit function declaration, that is,
-   * where a function is used before it is declared (under older C standards).
-   */
-  predicate isImplicit() { fun_implicit(underlyingElement(this)) }
-
-  /** Gets a type that is specified to be thrown by the declared function. */
-  Type getAThrownType() { result = getThrownType(_) }
-
-  /**
-   * Gets the `i`th type specified to be thrown by the declared function
-   * (where `i` is indexed from 0). For example, if a function is declared
-   * to `throw(int,float)`, then the thrown type with index 0 would be
-   * `int`, and that with index 1 would be `float`.
-   */
-  Type getThrownType(int i) {
-    fun_decl_throws(underlyingElement(this), i, unresolveElement(result))
-  }
-
-  /**
-   * If this declaration has a noexcept-specification [N4140 15.4], then
-   * this predicate returns the argument to `noexcept` if one was given.
-   */
-  Expr getNoExceptExpr() { fun_decl_noexcept(underlyingElement(this), unresolveElement(result)) }
-
-  /**
-   * Holds if the declared function has an exception specification [N4140
-   * 15.4].
-   */
-  predicate hasExceptionSpecification() {
-    fun_decl_throws(underlyingElement(this), _, _) or
-    fun_decl_noexcept(underlyingElement(this), _) or
-    isNoThrow() or
-    isNoExcept()
-  }
-
-  /**
-   * Holds if the declared function has a `throw()` exception specification.
-   */
-  predicate isNoThrow() { fun_decl_empty_throws(underlyingElement(this)) }
-
-  /**
-   * Holds if the declared function has an empty `noexcept` exception
-   * specification.
-   */
-  predicate isNoExcept() { fun_decl_empty_noexcept(underlyingElement(this)) }
-}
-
-/**
- * A C/C++ non-member function (a function that is not a member of any
- * class). For example, in the following code, `MyFunction` is a
- * `TopLevelFunction` but `MyMemberFunction` is not:
- * ```
- * void MyFunction() {
- *   DoSomething();
- * }
- *
- * class MyClass {
- * public:
- *   void MyMemberFunction() {
- *     DoSomething();
- *   }
- * };
- * ```
- */
-class TopLevelFunction extends Function {
-  TopLevelFunction() { not this.isMember() }
-
-  override string getAPrimaryQlClass() { result = "TopLevelFunction" }
-}
-
-/**
- * A C++ user-defined operator [N4140 13.5].
- */
-class Operator extends Function {
-  Operator() { functions(underlyingElement(this), _, 5) }
-
-  override string getAPrimaryQlClass() {
-    not this instanceof MemberFunction and result = "Operator"
-  }
-}
-
-/**
- * A C++ function which has a non-empty template argument list. For example
- * the function `myTemplateFunction` in the following code:
- * ```
- * template<class T>
- * void myTemplateFunction(T t) {
- *   ...
- * }
- * ```
- *
- * This comprises function declarations which are immediately preceded by
- * `template <...>`, where the "..." part is not empty, and therefore it does
- * not include:
- *
- *   1. Full specializations of template functions, as they have an empty
- *      template argument list.
- *   2. Instantiations of template functions, as they don't have an
- *      explicit template argument list.
- *   3. Member functions of template classes - unless they have their own
- *      (non-empty) template argument list.
- */
-class TemplateFunction extends Function {
-  TemplateFunction() {
-    is_function_template(underlyingElement(this)) and exists(getATemplateArgument())
-  }
-
-  override string getAPrimaryQlClass() { result = "TemplateFunction" }
-
-  /**
-   * Gets a compiler-generated instantiation of this function template.
-   */
-  Function getAnInstantiation() {
-    result.isConstructedFrom(this) and
-    not result.isSpecialization()
-  }
-
-  /**
-   * Gets a full specialization of this function template.
-   *
-   * Note that unlike classes, functions overload rather than specialize
-   * partially. Therefore this does not include things which "look like"
-   * partial specializations, nor does it include full specializations of
-   * such things -- see FunctionTemplateSpecialization for further details.
-   */
-  FunctionTemplateSpecialization getASpecialization() { result.getPrimaryTemplate() = this }
-}
-
-/**
- * A function that is an instantiation of a template. For example
- * the instantiation `myTemplateFunction<int>` in the following code:
- * ```
- * template<class T>
- * void myTemplateFunction(T t) {
- *   ...
- * }
- *
- * void caller(int i) {
- *   myTemplateFunction<int>(i);
- * }
- * ```
- */
-class FunctionTemplateInstantiation extends Function {
-  TemplateFunction tf;
-
-  FunctionTemplateInstantiation() { tf.getAnInstantiation() = this }
-
-  override string getAPrimaryQlClass() { result = "FunctionTemplateInstantiation" }
-
-  /**
-   * Gets the function template from which this instantiation was instantiated.
-   *
-   * Example: For `int const& std::min<int>(int const&, int const&)`, returns `T const& min<T>(T const&, T const&)`.
-   */
-  TemplateFunction getTemplate() { result = tf }
-}
-
-/**
- * An explicit specialization of a C++ function template. For example the
- * function `myTemplateFunction<int>` in the following code:
- * ```
- * template<class T>
- * void myTemplateFunction(T t) {
- *   ...
- * }
- *
- * template<>
- * void myTemplateFunction<int>(int i) {
- *   ...
- * }
- * ```
- *
- * Note that unlike classes, functions overload rather than specialize
- * partially. Therefore this only includes the last two of the following
- * four definitions, and in particular does not include the second one:
- *
- * ```
- * template <typename T> void f(T) {...}
- * template <typename T> void f(T*) {...}
- * template <> void f<int>(int *) {...}
- * template <> void f<int*>(int *) {...}
- * ```
- *
- * Furthermore, this does not include compiler-generated instantiations of
- * function templates.
- *
- * For further reference on function template specializations, see:
- *   http://www.gotw.ca/publications/mill17.htm
- */
-class FunctionTemplateSpecialization extends Function {
-  FunctionTemplateSpecialization() { this.isSpecialization() }
-
-  override string getAPrimaryQlClass() { result = "FunctionTemplateSpecialization" }
-
-  /**
-   * Gets the primary template for the specialization (the function template
-   * this specializes).
-   */
-  TemplateFunction getPrimaryTemplate() { this.isConstructedFrom(result) }
-}
-
-/**
- * A GCC built-in function. For example: `__builtin___memcpy_chk`.
- */
-class BuiltInFunction extends Function {
-  BuiltInFunction() { functions(underlyingElement(this), _, 6) }
-
-  /** Gets a dummy location for the built-in function. */
-  override Location getLocation() {
-    suppressUnusedThis(this) and
-    result instanceof UnknownDefaultLocation
-  }
-}
-
-private predicate suppressUnusedThis(Function f) { any() }

cpp/ql/lib/semmle/code/cpp/Location.qll

@@ -1,173 +0,0 @@
-/**
- * Provides classes and predicates for locations in the source code.
- */
-
-import semmle.code.cpp.Element
-import semmle.code.cpp.File
-
-/**
- * A location of a C/C++ artifact.
- */
-class Location extends @location {
-  /** Gets the container corresponding to this location. */
-  Container getContainer() { this.fullLocationInfo(result, _, _, _, _) }
-
-  /** Gets the file corresponding to this location, if any. */
-  File getFile() { result = this.getContainer() }
-
-  /** Gets the 1-based line number (inclusive) where this location starts. */
-  int getStartLine() { this.fullLocationInfo(_, result, _, _, _) }
-
-  /** Gets the 1-based column number (inclusive) where this location starts. */
-  int getStartColumn() { this.fullLocationInfo(_, _, result, _, _) }
-
-  /** Gets the 1-based line number (inclusive) where this location ends. */
-  int getEndLine() { this.fullLocationInfo(_, _, _, result, _) }
-
-  /** Gets the 1-based column number (inclusive) where this location ends. */
-  int getEndColumn() { this.fullLocationInfo(_, _, _, _, result) }
-
-  /**
-   * Gets a textual representation of this element.
-   *
-   * The format is "file://filePath:startLine:startColumn:endLine:endColumn".
-   */
-  string toString() {
-    exists(string filepath, int startline, int startcolumn, int endline, int endcolumn |
-      this.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
-    |
-      toUrl(filepath, startline, startcolumn, endline, endcolumn, result)
-    )
-  }
-
-  /**
-   * Holds if this element is in the specified container.
-   * The location spans column `startcolumn` of line `startline` to
-   * column `endcolumn` of line `endline`.
-   *
-   * This predicate is similar to `hasLocationInfo`, but exposes the `Container`
-   * entity, rather than merely its path.
-   */
-  predicate fullLocationInfo(
-    Container container, int startline, int startcolumn, int endline, int endcolumn
-  ) {
-    locations_default(this, unresolveElement(container), startline, startcolumn, endline, endcolumn) or
-    locations_expr(this, unresolveElement(container), startline, startcolumn, endline, endcolumn) or
-    locations_stmt(this, unresolveElement(container), startline, startcolumn, endline, endcolumn)
-  }
-
-  /**
-   * Holds if this element is at the specified location.
-   * The location spans column `startcolumn` of line `startline` to
-   * column `endcolumn` of line `endline` in file `filepath`.
-   * For more information, see
-   * [Locations](https://help.semmle.com/QL/learn-ql/ql/locations.html).
-   */
-  predicate hasLocationInfo(
-    string filepath, int startline, int startcolumn, int endline, int endcolumn
-  ) {
-    exists(Container f | this.fullLocationInfo(f, startline, startcolumn, endline, endcolumn) |
-      filepath = f.getAbsolutePath()
-    )
-  }
-
-  /** Holds if `this` comes on a line strictly before `l`. */
-  pragma[inline]
-  predicate isBefore(Location l) {
-    this.getFile() = l.getFile() and this.getEndLine() < l.getStartLine()
-  }
-
-  /** Holds if location `l` is completely contained within this one. */
-  predicate subsumes(Location l) {
-    exists(File f | f = getFile() |
-      exists(int thisStart, int thisEnd | charLoc(f, thisStart, thisEnd) |
-        exists(int lStart, int lEnd | l.charLoc(f, lStart, lEnd) |
-          thisStart <= lStart and lEnd <= thisEnd
-        )
-      )
-    )
-  }
-
-  /**
-   * Holds if this location corresponds to file `f` and character "offsets"
-   * `start..end`. Note that these are not real character offsets, because
-   * we use `maxCols` to find the length of the longest line and then pretend
-   * that all the lines are the same length. However, these offsets are
-   * convenient for comparing or sorting locations in a file. For an example,
-   * see `subsumes`.
-   */
-  predicate charLoc(File f, int start, int end) {
-    f = getFile() and
-    exists(int maxCols | maxCols = maxCols(f) |
-      start = getStartLine() * maxCols + getStartColumn() and
-      end = getEndLine() * maxCols + getEndColumn()
-    )
-  }
-}
-
-/**
- * DEPRECATED: Use `Location` instead.
- * A location of an element. Not used for expressions or statements, which
- * instead use LocationExpr and LocationStmt respectively.
- */
-deprecated library class LocationDefault extends Location, @location_default { }
-
-/**
- * DEPRECATED: Use `Location` instead.
- * A location of a statement.
- */
-deprecated library class LocationStmt extends Location, @location_stmt { }
-
-/**
- * DEPRECATED: Use `Location` instead.
- * A location of an expression.
- */
-deprecated library class LocationExpr extends Location, @location_expr { }
-
-/**
- * Gets the length of the longest line in file `f`.
- */
-pragma[nomagic]
-private int maxCols(File f) {
-  result = max(Location l | l.getFile() = f | l.getStartColumn().maximum(l.getEndColumn()))
-}
-
-/**
- * A C/C++ element that has a location in a file
- */
-class Locatable extends Element { }
-
-/**
- * A dummy location which is used when something doesn't have a location in
- * the source code but needs to have a `Location` associated with it. There
- * may be several distinct kinds of unknown locations. For example: one for
- * expressions, one for statements and one for other program elements.
- */
-class UnknownLocation extends Location {
-  UnknownLocation() { getFile().getAbsolutePath() = "" }
-}
-
-/**
- * A dummy location which is used when something doesn't have a location in
- * the source code but needs to have a `Location` associated with it.
- */
-class UnknownDefaultLocation extends UnknownLocation {
-  UnknownDefaultLocation() { locations_default(this, _, 0, 0, 0, 0) }
-}
-
-/**
- * A dummy location which is used when an expression doesn't have a
- * location in the source code but needs to have a `Location` associated
- * with it.
- */
-class UnknownExprLocation extends UnknownLocation {
-  UnknownExprLocation() { locations_expr(this, _, 0, 0, 0, 0) }
-}
-
-/**
- * A dummy location which is used when a statement doesn't have a location
- * in the source code but needs to have a `Location` associated with it.
- */
-class UnknownStmtLocation extends UnknownLocation {
-  UnknownStmtLocation() { locations_stmt(this, _, 0, 0, 0, 0) }
-}

cpp/ql/lib/semmle/code/cpp/MemberFunction.qll

@@ -1,517 +0,0 @@
-/**
- * Provides classes for working with C++ member functions, constructors, destructors,
- * and user-defined operators.
- */
-
-import cpp
-
-/**
- * A C++ function declared as a member of a class [N4140 9.3]. This includes
- * static member functions. For example the functions `MyStaticMemberFunction`
- * and `MyMemberFunction` in:
- * ```
- * class MyClass {
- * public:
- *   void MyMemberFunction() {
- *     DoSomething();
- *   }
- *
- *   static void MyStaticMemberFunction() {
- *     DoSomething();
- *   }
- * };
- * ```
- */
-class MemberFunction extends Function {
-  MemberFunction() { this.isMember() }
-
-  override string getAPrimaryQlClass() {
-    not this instanceof CopyAssignmentOperator and
-    not this instanceof MoveAssignmentOperator and
-    result = "MemberFunction"
-  }
-
-  /**
-   * Gets the number of parameters of this function, including any implicit
-   * `this` parameter.
-   */
-  override int getEffectiveNumberOfParameters() {
-    if isStatic() then result = getNumberOfParameters() else result = getNumberOfParameters() + 1
-  }
-
-  /** Holds if this member is private. */
-  predicate isPrivate() { this.hasSpecifier("private") }
-
-  /** Holds if this member is protected. */
-  predicate isProtected() { this.hasSpecifier("protected") }
-
-  /** Holds if this member is public. */
-  predicate isPublic() { this.hasSpecifier("public") }
-
-  /** Holds if this declaration has the lvalue ref-qualifier */
-  predicate isLValueRefQualified() { hasSpecifier("&") }
-
-  /** Holds if this declaration has the rvalue ref-qualifier */
-  predicate isRValueRefQualified() { hasSpecifier("&&") }
-
-  /** Holds if this declaration has a ref-qualifier */
-  predicate isRefQualified() { isLValueRefQualified() or isRValueRefQualified() }
-
-  /** Holds if this function overrides that function. */
-  predicate overrides(MemberFunction that) {
-    overrides(underlyingElement(this), unresolveElement(that))
-  }
-
-  /** Gets a directly overridden function. */
-  MemberFunction getAnOverriddenFunction() { this.overrides(result) }
-
-  /** Gets a directly overriding function. */
-  MemberFunction getAnOverridingFunction() { result.overrides(this) }
-
-  /**
-   * Gets the declaration entry for this member function that is within the
-   * class body.
-   */
-  FunctionDeclarationEntry getClassBodyDeclarationEntry() {
-    if strictcount(getADeclarationEntry()) = 1
-    then result = getDefinition()
-    else (
-      result = getADeclarationEntry() and result != getDefinition()
-    )
-  }
-
-  /**
-   * Gets the type of the `this` parameter associated with this member function, if any. The type
-   * may have `const` and/or `volatile` qualifiers, matching the function declaration.
-   */
-  PointerType getTypeOfThis() {
-    member_function_this_type(underlyingElement(this), unresolveElement(result))
-  }
-}
-
-/**
- * A C++ virtual function. For example the two functions called
- * `myVirtualFunction` in the following code are each a
- * `VirtualFunction`:
- * ```
- * class A {
- * public:
- *   virtual void myVirtualFunction() = 0;
- * };
- *
- * class B: public A {
- * public:
- *   virtual void myVirtualFunction() {
- *     doSomething();
- *   }
- * };
- * ```
- */
-class VirtualFunction extends MemberFunction {
-  VirtualFunction() { this.hasSpecifier("virtual") or purefunctions(underlyingElement(this)) }
-
-  override string getAPrimaryQlClass() { result = "VirtualFunction" }
-
-  /** Holds if this virtual function is pure. */
-  predicate isPure() { this instanceof PureVirtualFunction }
-
-  /**
-   * Holds if this function was declared with the `override` specifier
-   * [N4140 10.3].
-   */
-  predicate isOverrideExplicit() { this.hasSpecifier("override") }
-}
-
-/**
- * A C++ pure virtual function [N4140 10.4]. For example the first function
- * called `myVirtualFunction` in the following code:
- * ```
- * class A {
- * public:
- *   virtual void myVirtualFunction() = 0;
- * };
- *
- * class B: public A {
- * public:
- *   virtual void myVirtualFunction() {
- *     doSomething();
- *   }
- * };
- * ```
- */
-class PureVirtualFunction extends VirtualFunction {
-  PureVirtualFunction() { purefunctions(underlyingElement(this)) }
-
-  override string getAPrimaryQlClass() { result = "PureVirtualFunction" }
-}
-
-/**
- * A const C++ member function [N4140 9.3.1/4]. A const function has the
- * `const` specifier and does not modify the state of its class. For example
- * the member function `day` in the following code:
- * ```
- * class MyClass {
- *   ...
- *
- *   int day() const {
- *     return d;
- *   }
- *
- *   ...
- * };
- * ```
- */
-class ConstMemberFunction extends MemberFunction {
-  ConstMemberFunction() { this.hasSpecifier("const") }
-
-  override string getAPrimaryQlClass() { result = "ConstMemberFunction" }
-}
-
-/**
- * A C++ constructor [N4140 12.1]. For example the function `MyClass` in the
- * following code is a constructor:
- * ```
- * class MyClass {
- * public:
- *   MyClass() {
- *     ...
- *   }
- * };
- * ```
- */
-class Constructor extends MemberFunction {
-  Constructor() { functions(underlyingElement(this), _, 2) }
-
-  override string getAPrimaryQlClass() { result = "Constructor" }
-
-  /**
-   * Holds if this constructor serves as a default constructor.
-   *
-   * This holds for constructors with zero formal parameters. It also holds
-   * for constructors which have a non-zero number of formal parameters,
-   * provided that every parameter has a default value.
-   */
-  predicate isDefault() { forall(Parameter p | p = this.getAParameter() | p.hasInitializer()) }
-
-  /**
-   * Gets an entry in the constructor's initializer list, or a
-   * compiler-generated action which initializes a base class or member
-   * variable.
-   */
-  ConstructorInit getAnInitializer() { result = getInitializer(_) }
-
-  /**
-   * Gets an entry in the constructor's initializer list, or a
-   * compiler-generated action which initializes a base class or member
-   * variable. The index specifies the order in which the initializer is
-   * to be evaluated.
-   */
-  ConstructorInit getInitializer(int i) {
-    exprparents(unresolveElement(result), i, underlyingElement(this))
-  }
-}
-
-/**
- * A function that defines an implicit conversion.
- */
-class ImplicitConversionFunction extends MemberFunction {
-  ImplicitConversionFunction() {
-    // ConversionOperator
-    functions(underlyingElement(this), _, 4)
-    or
-    // ConversionConstructor (deprecated)
-    strictcount(Parameter p | p = getAParameter() and not p.hasInitializer()) = 1 and
-    not hasSpecifier("explicit")
-  }
-
-  /** Gets the type this `ImplicitConversionFunction` takes as input. */
-  Type getSourceType() { none() } // overridden in subclasses
-
-  /** Gets the type this `ImplicitConversionFunction` converts to. */
-  Type getDestType() { none() } // overridden in subclasses
-}
-
-/**
- * DEPRECATED: as of C++11 this class does not correspond perfectly with the
- * language definition of a converting constructor.
- *
- * A C++ constructor that also defines an implicit conversion. For example the
- * function `MyClass` in the following code is a `ConversionConstructor`:
- * ```
- * class MyClass {
- * public:
- *   MyClass(const MyOtherClass &from) {
- *     ...
- *   }
- * };
- * ```
- */
-deprecated class ConversionConstructor extends Constructor, ImplicitConversionFunction {
-  ConversionConstructor() {
-    strictcount(Parameter p | p = getAParameter() and not p.hasInitializer()) = 1 and
-    not hasSpecifier("explicit")
-  }
-
-  override string getAPrimaryQlClass() {
-    not this instanceof CopyConstructor and
-    not this instanceof MoveConstructor and
-    result = "ConversionConstructor"
-  }
-
-  /** Gets the type this `ConversionConstructor` takes as input. */
-  override Type getSourceType() { result = this.getParameter(0).getType() }
-
-  /** Gets the type this `ConversionConstructor` is a constructor of. */
-  override Type getDestType() { result = this.getDeclaringType() }
-}
-
-private predicate hasCopySignature(MemberFunction f) {
-  f.getParameter(0).getUnspecifiedType().(LValueReferenceType).getBaseType() = f.getDeclaringType()
-}
-
-private predicate hasMoveSignature(MemberFunction f) {
-  f.getParameter(0).getUnspecifiedType().(RValueReferenceType).getBaseType() = f.getDeclaringType()
-}
-
-/**
- * A C++ copy constructor [N4140 12.8]. For example the function `MyClass` in
- * the following code is a `CopyConstructor`:
- * ```
- * class MyClass {
- * public:
- *   MyClass(const MyClass &from) {
- *     ...
- *   }
- * };
- * ```
- *
- * As per the standard, a copy constructor of class `T` is a non-template
- * constructor whose first parameter has type `T&`, `const T&`, `volatile
- * T&`, or `const volatile T&`, and either there are no other parameters,
- * or the rest of the parameters all have default values.
- *
- * For template classes, it can generally not be determined until instantiation
- * whether a constructor is a copy constructor. For such classes, `CopyConstructor`
- * over-approximates the set of copy constructors; if an under-approximation is
- * desired instead, see the member predicate
- * `mayNotBeCopyConstructorInInstantiation`.
- */
-class CopyConstructor extends Constructor {
-  CopyConstructor() {
-    hasCopySignature(this) and
-    (
-      // The rest of the parameters all have default values
-      forall(int i | i > 0 and exists(getParameter(i)) | getParameter(i).hasInitializer())
-      or
-      // or this is a template class, in which case the default values have
-      // not been extracted even if they exist. In that case, we assume that
-      // there are default values present since that is the most common case
-      // in real-world code.
-      getDeclaringType() instanceof TemplateClass
-    ) and
-    not exists(getATemplateArgument())
-  }
-
-  override string getAPrimaryQlClass() { result = "CopyConstructor" }
-
-  /**
-   * Holds if we cannot determine that this constructor will become a copy
-   * constructor in all instantiations. Depending on template parameters of the
-   * enclosing class, this may become an ordinary constructor or a copy
-   * constructor.
-   */
-  predicate mayNotBeCopyConstructorInInstantiation() {
-    // In general, default arguments of template classes can only be
-    // type-checked for each template instantiation; if an argument in an
-    // instantiation fails to type-check then the corresponding parameter has
-    // no default argument in the instantiation.
-    getDeclaringType() instanceof TemplateClass and
-    getNumberOfParameters() > 1
-  }
-}
-
-/**
- * A C++ move constructor [N4140 12.8]. For example the function `MyClass` in
- * the following code is a `MoveConstructor`:
- * ```
- * class MyClass {
- * public:
- *   MyClass(MyClass &&from) {
- *     ...
- *   }
- * };
- * ```
- *
- * As per the standard, a move constructor of class `T` is a non-template
- * constructor whose first parameter is `T&&`, `const T&&`, `volatile T&&`,
- * or `const volatile T&&`, and either there are no other parameters, or
- * the rest of the parameters all have default values.
- *
- * For template classes, it can generally not be determined until instantiation
- * whether a constructor is a move constructor. For such classes, `MoveConstructor`
- * over-approximates the set of move constructors; if an under-approximation is
- * desired instead, see the member predicate
- * `mayNotBeMoveConstructorInInstantiation`.
- */
-class MoveConstructor extends Constructor {
-  MoveConstructor() {
-    hasMoveSignature(this) and
-    (
-      // The rest of the parameters all have default values
-      forall(int i | i > 0 and exists(getParameter(i)) | getParameter(i).hasInitializer())
-      or
-      // or this is a template class, in which case the default values have
-      // not been extracted even if they exist. In that case, we assume that
-      // there are default values present since that is the most common case
-      // in real-world code.
-      getDeclaringType() instanceof TemplateClass
-    ) and
-    not exists(getATemplateArgument())
-  }
-
-  override string getAPrimaryQlClass() { result = "MoveConstructor" }
-
-  /**
-   * Holds if we cannot determine that this constructor will become a move
-   * constructor in all instantiations. Depending on template parameters of the
-   * enclosing class, this may become an ordinary constructor or a move
-   * constructor.
-   */
-  predicate mayNotBeMoveConstructorInInstantiation() {
-    // In general, default arguments of template classes can only be
-    // type-checked for each template instantiation; if an argument in an
-    // instantiation fails to type-check then the corresponding parameter has
-    // no default argument in the instantiation.
-    getDeclaringType() instanceof TemplateClass and
-    getNumberOfParameters() > 1
-  }
-}
-
-/**
- * A C++ constructor that takes no arguments ('default' constructor). This
- * is the constructor that is invoked when no initializer is given. For
- * example the function `MyClass` in the following code is a
- * `NoArgConstructor`:
- * ```
- * class MyClass {
- * public:
- *   MyClass() {
- *     ...
- *   }
- * };
- * ```
- */
-class NoArgConstructor extends Constructor {
-  NoArgConstructor() { this.getNumberOfParameters() = 0 }
-}
-
-/**
- * A C++ destructor [N4140 12.4]. For example the function `~MyClass` in the
- * following code is a destructor:
- * ```
- * class MyClass {
- * public:
- *   ~MyClass() {
- *     ...
- *   }
- * };
- * ```
- */
-class Destructor extends MemberFunction {
-  Destructor() { functions(underlyingElement(this), _, 3) }
-
-  override string getAPrimaryQlClass() { result = "Destructor" }
-
-  /**
-   * Gets a compiler-generated action which destructs a base class or member
-   * variable.
-   */
-  DestructorDestruction getADestruction() { result = getDestruction(_) }
-
-  /**
-   * Gets a compiler-generated action which destructs a base class or member
-   * variable. The index specifies the order in which the destruction should
-   * be evaluated.
-   */
-  DestructorDestruction getDestruction(int i) {
-    exprparents(unresolveElement(result), i, underlyingElement(this))
-  }
-}
-
-/**
- * A C++ conversion operator [N4140 12.3.2]. For example the function
- * `operator int` in the following code is a `ConversionOperator`:
- * ```
- * class MyClass {
- * public:
- *   operator int();
- * };
- * ```
- */
-class ConversionOperator extends MemberFunction, ImplicitConversionFunction {
-  ConversionOperator() { functions(underlyingElement(this), _, 4) }
-
-  override string getAPrimaryQlClass() { result = "ConversionOperator" }
-
-  override Type getSourceType() { result = this.getDeclaringType() }
-
-  override Type getDestType() { result = this.getType() }
-}
-
-/**
- * A C++ copy assignment operator [N4140 12.8]. For example the function
- * `operator=` in the following code is a `CopyAssignmentOperator`:
- * ```
- * class MyClass {
- * public:
- *   MyClass &operator=(const MyClass &other);
- * };
- * ```
- *
- * As per the standard, a copy assignment operator of class `T` is a
- * non-template non-static member function with the name `operator=` that
- * takes exactly one parameter of type `T`, `T&`, `const T&`, `volatile
- * T&`, or `const volatile T&`.
- */
-class CopyAssignmentOperator extends Operator {
-  CopyAssignmentOperator() {
-    hasName("operator=") and
-    (
-      hasCopySignature(this)
-      or
-      // Unlike CopyConstructor, this member allows a non-reference
-      // parameter.
-      getParameter(0).getUnspecifiedType() = getDeclaringType()
-    ) and
-    not exists(this.getParameter(1)) and
-    not exists(getATemplateArgument())
-  }
-
-  override string getAPrimaryQlClass() { result = "CopyAssignmentOperator" }
-}
-
-/**
- * A C++ move assignment operator [N4140 12.8]. For example the function
- * `operator=` in the following code is a `MoveAssignmentOperator`:
- * ```
- * class MyClass {
- * public:
- *   MyClass &operator=(MyClass &&other);
- * };
- * ```
- *
- * As per the standard, a move assignment operator of class `T` is a
- * non-template non-static member function with the name `operator=` that
- * takes exactly one parameter of type `T&&`, `const T&&`, `volatile T&&`,
- * or `const volatile T&&`.
- */
-class MoveAssignmentOperator extends Operator {
-  MoveAssignmentOperator() {
-    hasName("operator=") and
-    hasMoveSignature(this) and
-    not exists(this.getParameter(1)) and
-    not exists(getATemplateArgument())
-  }
-
-  override string getAPrimaryQlClass() { result = "MoveAssignmentOperator" }
-}

cpp/ql/lib/semmle/code/cpp/Preprocessor.qll

@@ -1,294 +0,0 @@
-import semmle.code.cpp.Location
-import semmle.code.cpp.Element
-
-/**
- * A C/C++ preprocessor directive. For example each of the following lines of
- * code contains a `PreprocessorDirective`:
- * ```
- * #pragma once
- * #ifdef MYDEFINE
- * #include "myfile.h"
- * #line 1 "source.c"
- * ```
- */
-class PreprocessorDirective extends Locatable, @preprocdirect {
-  override string toString() { result = "Preprocessor directive" }
-
-  override Location getLocation() { preprocdirects(underlyingElement(this), _, result) }
-
-  string getHead() { preproctext(underlyingElement(this), result, _) }
-
-  /**
-   * Gets a preprocessor branching directive whose condition affects
-   * whether this directive is performed.
-   *
-   * From a lexical point of view, this returns all `#if`, `#ifdef`,
-   * `#ifndef`, or `#elif` directives which occur before this directive and
-   * have a matching `#endif` which occurs after this directive.
-   */
-  PreprocessorBranch getAGuard() {
-    exists(PreprocessorEndif e, int line |
-      result.getEndIf() = e and
-      e.getFile() = getFile() and
-      result.getFile() = getFile() and
-      line = this.getLocation().getStartLine() and
-      result.getLocation().getStartLine() < line and
-      line < e.getLocation().getEndLine()
-    )
-  }
-}
-
-private class TPreprocessorBranchDirective = @ppd_branch or @ppd_else or @ppd_endif;
-
-/**
- * A C/C++ preprocessor branch related directive: `#if`, `#ifdef`,
- * `#ifndef`, `#elif`, `#else` or `#endif`.
- */
-class PreprocessorBranchDirective extends PreprocessorDirective, TPreprocessorBranchDirective {
-  /**
-   * Gets the `#if`, `#ifdef` or `#ifndef` directive which matches this
-   * branching directive.
-   *
-   * If this branch directive was unbalanced, then there will be no
-   * result. Conversely, if the branch matches different `#if` directives
-   * in different translation units, then there can be more than one
-   * result.
-   */
-  PreprocessorBranch getIf() {
-    result = this.(PreprocessorIf) or
-    result = this.(PreprocessorIfdef) or
-    result = this.(PreprocessorIfndef) or
-    preprocpair(unresolveElement(result), underlyingElement(this))
-  }
-
-  /**
-   * Gets the `#endif` directive which matches this branching directive.
-   *
-   * If this branch directive was unbalanced, then there will be no
-   * result. Conversely, if the branch matched different `#endif`
-   * directives in different translation units, then there can be more than
-   * one result.
-   */
-  PreprocessorEndif getEndIf() { preprocpair(unresolveElement(getIf()), unresolveElement(result)) }
-
-  /**
-   * Gets the next `#elif`, `#else` or `#endif` matching this branching
-   * directive.
-   *
-   * For example `somePreprocessorBranchDirective.getIf().getNext()` gets
-   * the second directive in the same construct as
-   * `somePreprocessorBranchDirective`.
-   */
-  PreprocessorBranchDirective getNext() {
-    exists(PreprocessorBranch branch |
-      this.getIndexInBranch(branch) + 1 = result.getIndexInBranch(branch)
-    )
-  }
-
-  /**
-   * Gets the index of this branching directive within the matching #if,
-   * #ifdef or #ifndef.
-   */
-  private int getIndexInBranch(PreprocessorBranch branch) {
-    this =
-      rank[result](PreprocessorBranchDirective other |
-        other.getIf() = branch
-      |
-        other order by other.getLocation().getStartLine()
-      )
-  }
-}
-
-/**
- * A C/C++ preprocessor branching directive: `#if`, `#ifdef`, `#ifndef`, or
- * `#elif`.
- *
- * A branching directive has a condition and that condition may be evaluated
- * at compile-time.  As a result, the preprocessor will either take the
- * branch, or not take the branch.
- *
- * However, there are also situations in which a branch's condition isn't
- * evaluated.  The obvious case of this is when the directive is contained
- * within a branch which wasn't taken. There is also a much more subtle
- * case involving header guard branches: suitably clever compilers can
- * notice that a branch is a header guard, and can then subsequently ignore
- * a `#include` for the file being guarded. It is for this reason that
- * `wasTaken()` always holds on header guard branches, but `wasNotToken()`
- * rarely holds on header guard branches.
- */
-class PreprocessorBranch extends PreprocessorBranchDirective, @ppd_branch {
-  /**
-   * Holds if at least one translation unit evaluated this directive's
-   * condition and subsequently took the branch.
-   */
-  predicate wasTaken() { preproctrue(underlyingElement(this)) }
-
-  /**
-   * Holds if at least one translation unit evaluated this directive's
-   * condition but then didn't take the branch.
-   *
-   * If `#else` is the next matching directive, then this means that the
-   * `#else` was taken instead.
-   */
-  predicate wasNotTaken() { preprocfalse(underlyingElement(this)) }
-
-  /**
-   * Holds if this directive was either taken by all translation units
-   * which evaluated it, or was not taken by any translation unit which
-   * evaluated it.
-   */
-  predicate wasPredictable() { not (wasTaken() and wasNotTaken()) }
-}
-
-/**
- * A C/C++ preprocessor `#if` directive. For example there is a
- * `PreprocessorIf` on the first line of the following code:
- * ```
- * #if defined(MYDEFINE)
- * // ...
- * #endif
- * ```
- * For the related notion of a directive which causes branching (which
- * includes `#if`, plus also `#ifdef`, `#ifndef`, and `#elif`), see
- * `PreprocessorBranch`.
- */
-class PreprocessorIf extends PreprocessorBranch, @ppd_if {
-  override string toString() { result = "#if " + this.getHead() }
-}
-
-/**
- * A C/C++ preprocessor `#ifdef` directive. For example there is a
- * `PreprocessorIfdef` on the first line of the following code:
- * ```
- * #ifdef MYDEFINE
- * // ...
- * #endif
- * ```
- * The syntax `#ifdef X` is shorthand for `#if defined(X)`.
- */
-class PreprocessorIfdef extends PreprocessorBranch, @ppd_ifdef {
-  override string toString() { result = "#ifdef " + this.getHead() }
-
-  override string getAPrimaryQlClass() { result = "PreprocessorIfdef" }
-}
-
-/**
- * A C/C++ preprocessor `#ifndef` directive. For example there is a
- * `PreprocessorIfndef` on the first line of the following code:
- * ```
- * #ifndef MYDEFINE
- * // ...
- * #endif
- * ```
- * The syntax `#ifndef X` is shorthand for `#if !defined(X)`.
- */
-class PreprocessorIfndef extends PreprocessorBranch, @ppd_ifndef {
-  override string toString() { result = "#ifndef " + this.getHead() }
-}
-
-/**
- * A C/C++ preprocessor `#else` directive. For example there is a
- * `PreprocessorElse` on the fifth line of the following code:
- * ```
- * #ifdef MYDEFINE1
- * // ...
- * #elif MYDEFINE2
- * // ...
- * #else
- * // ...
- * #endif
- * ```
- */
-class PreprocessorElse extends PreprocessorBranchDirective, @ppd_else {
-  override string toString() { result = "#else" }
-}
-
-/**
- * A C/C++ preprocessor `#elif` directive. For example there is a
- * `PreprocessorElif` on the third line of the following code:
- * ```
- * #ifdef MYDEFINE1
- * // ...
- * #elif MYDEFINE2
- * // ...
- * #else
- * // ...
- * #endif
- * ```
- */
-class PreprocessorElif extends PreprocessorBranch, @ppd_elif {
-  override string toString() { result = "#elif " + this.getHead() }
-}
-
-/**
- * A C/C++ preprocessor `#endif` directive. For example there is a
- * `PreprocessorEndif` on the third line of the following code:
- * ```
- * #ifdef MYDEFINE
- * // ...
- * #endif
- * ```
- */
-class PreprocessorEndif extends PreprocessorBranchDirective, @ppd_endif {
-  override string toString() { result = "#endif" }
-}
-
-/**
- * A C/C++ preprocessor `#warning` directive. For example:
- * ```
- * #warning "This configuration is not supported."
- * ```
- */
-class PreprocessorWarning extends PreprocessorDirective, @ppd_warning {
-  override string toString() { result = "#warning " + this.getHead() }
-}
-
-/**
- * A C/C++ preprocessor `#error` directive. For example:
- * ```
- * #error "This configuration is not implemented."
- * ```
- */
-class PreprocessorError extends PreprocessorDirective, @ppd_error {
-  override string toString() { result = "#error " + this.getHead() }
-}
-
-/**
- * A C/C++ preprocessor `#undef` directive. For example there is a
- * `PreprocessorUndef` on the second line of the following code:
- * ```
- * #ifdef MYMACRO
- * #undef MYMACRO
- * #endif
- * ```
- */
-class PreprocessorUndef extends PreprocessorDirective, @ppd_undef {
-  override string toString() { result = "#undef " + this.getHead() }
-
-  /**
-   * Gets the name of the macro that is undefined.
-   */
-  string getName() { result = getHead() }
-}
-
-/**
- * A C/C++ preprocessor `#pragma` directive. For example:
- * ```
- * #pragma once
- * ```
- */
-class PreprocessorPragma extends PreprocessorDirective, @ppd_pragma {
-  override string toString() {
-    if exists(this.getHead()) then result = "#pragma " + this.getHead() else result = "#pragma"
-  }
-}
-
-/**
- * A C/C++ preprocessor `#line` directive. For example:
- * ```
- * #line 1 "source.c"
- * ```
- */
-class PreprocessorLine extends PreprocessorDirective, @ppd_line {
-  override string toString() { result = "#line " + this.getHead() }
-}

cpp/ql/lib/semmle/code/cpp/XML.qll

@@ -1,343 +0,0 @@
-/**
- * Provides classes and predicates for working with XML files and their content.
- */
-
-import semmle.files.FileSystem
-
-private class TXMLLocatable =
-  @xmldtd or @xmlelement or @xmlattribute or @xmlnamespace or @xmlcomment or @xmlcharacters;
-
-/** An XML element that has a location. */
-class XMLLocatable extends @xmllocatable, TXMLLocatable {
-  /** Gets the source location for this element. */
-  Location getLocation() { xmllocations(this, result) }
-
-  /**
-   * DEPRECATED: Use `getLocation()` instead.
-   *
-   * Gets the source location for this element.
-   */
-  deprecated Location getALocation() { result = this.getLocation() }
-
-  /**
-   * Holds if this element is at the specified location.
-   * The location spans column `startcolumn` of line `startline` to
-   * column `endcolumn` of line `endline` in file `filepath`.
-   * For more information, see
-   * [Locations](https://help.semmle.com/QL/learn-ql/ql/locations.html).
-   */
-  predicate hasLocationInfo(
-    string filepath, int startline, int startcolumn, int endline, int endcolumn
-  ) {
-    exists(File f, Location l | l = this.getLocation() |
-      locations_default(l, f, startline, startcolumn, endline, endcolumn) and
-      filepath = f.getAbsolutePath()
-    )
-  }
-
-  /** Gets a textual representation of this element. */
-  string toString() { none() } // overridden in subclasses
-}
-
-/**
- * An `XMLParent` is either an `XMLElement` or an `XMLFile`,
- * both of which can contain other elements.
- */
-class XMLParent extends @xmlparent {
-  XMLParent() {
-    // explicitly restrict `this` to be either an `XMLElement` or an `XMLFile`;
-    // the type `@xmlparent` currently also includes non-XML files
-    this instanceof @xmlelement or xmlEncoding(this, _)
-  }
-
-  /**
-   * Gets a printable representation of this XML parent.
-   * (Intended to be overridden in subclasses.)
-   */
-  string getName() { none() } // overridden in subclasses
-
-  /** Gets the file to which this XML parent belongs. */
-  XMLFile getFile() { result = this or xmlElements(this, _, _, _, result) }
-
-  /** Gets the child element at a specified index of this XML parent. */
-  XMLElement getChild(int index) { xmlElements(result, _, this, index, _) }
-
-  /** Gets a child element of this XML parent. */
-  XMLElement getAChild() { xmlElements(result, _, this, _, _) }
-
-  /** Gets a child element of this XML parent with the given `name`. */
-  XMLElement getAChild(string name) { xmlElements(result, _, this, _, _) and result.hasName(name) }
-
-  /** Gets a comment that is a child of this XML parent. */
-  XMLComment getAComment() { xmlComments(result, _, this, _) }
-
-  /** Gets a character sequence that is a child of this XML parent. */
-  XMLCharacters getACharactersSet() { xmlChars(result, _, this, _, _, _) }
-
-  /** Gets the depth in the tree. (Overridden in XMLElement.) */
-  int getDepth() { result = 0 }
-
-  /** Gets the number of child XML elements of this XML parent. */
-  int getNumberOfChildren() { result = count(XMLElement e | xmlElements(e, _, this, _, _)) }
-
-  /** Gets the number of places in the body of this XML parent where text occurs. */
-  int getNumberOfCharacterSets() { result = count(int pos | xmlChars(_, _, this, pos, _, _)) }
-
-  /**
-   * DEPRECATED: Internal.
-   *
-   * Append the character sequences of this XML parent from left to right, separated by a space,
-   * up to a specified (zero-based) index.
-   */
-  deprecated string charsSetUpTo(int n) {
-    n = 0 and xmlChars(_, result, this, 0, _, _)
-    or
-    n > 0 and
-    exists(string chars | xmlChars(_, chars, this, n, _, _) |
-      result = this.charsSetUpTo(n - 1) + " " + chars
-    )
-  }
-
-  /**
-   * Gets the result of appending all the character sequences of this XML parent from
-   * left to right, separated by a space.
-   */
-  string allCharactersString() {
-    result =
-      concat(string chars, int pos | xmlChars(_, chars, this, pos, _, _) | chars, " " order by pos)
-  }
-
-  /** Gets the text value contained in this XML parent. */
-  string getTextValue() { result = allCharactersString() }
-
-  /** Gets a printable representation of this XML parent. */
-  string toString() { result = this.getName() }
-}
-
-/** An XML file. */
-class XMLFile extends XMLParent, File {
-  XMLFile() { xmlEncoding(this, _) }
-
-  /** Gets a printable representation of this XML file. */
-  override string toString() { result = getName() }
-
-  /** Gets the name of this XML file. */
-  override string getName() { result = File.super.getAbsolutePath() }
-
-  /**
-   * DEPRECATED: Use `getAbsolutePath()` instead.
-   *
-   * Gets the path of this XML file.
-   */
-  deprecated string getPath() { result = getAbsolutePath() }
-
-  /**
-   * DEPRECATED: Use `getParentContainer().getAbsolutePath()` instead.
-   *
-   * Gets the path of the folder that contains this XML file.
-   */
-  deprecated string getFolder() { result = getParentContainer().getAbsolutePath() }
-
-  /** Gets the encoding of this XML file. */
-  string getEncoding() { xmlEncoding(this, result) }
-
-  /** Gets the XML file itself. */
-  override XMLFile getFile() { result = this }
-
-  /** Gets a top-most element in an XML file. */
-  XMLElement getARootElement() { result = this.getAChild() }
-
-  /** Gets a DTD associated with this XML file. */
-  XMLDTD getADTD() { xmlDTDs(result, _, _, _, this) }
-}
-
-/**
- * An XML document type definition (DTD).
- *
- * Example:
- *
- * ```
- * <!ELEMENT person (firstName, lastName?)>
- * <!ELEMENT firstName (#PCDATA)>
- * <!ELEMENT lastName (#PCDATA)>
- * ```
- */
-class XMLDTD extends XMLLocatable, @xmldtd {
-  /** Gets the name of the root element of this DTD. */
-  string getRoot() { xmlDTDs(this, result, _, _, _) }
-
-  /** Gets the public ID of this DTD. */
-  string getPublicId() { xmlDTDs(this, _, result, _, _) }
-
-  /** Gets the system ID of this DTD. */
-  string getSystemId() { xmlDTDs(this, _, _, result, _) }
-
-  /** Holds if this DTD is public. */
-  predicate isPublic() { not xmlDTDs(this, _, "", _, _) }
-
-  /** Gets the parent of this DTD. */
-  XMLParent getParent() { xmlDTDs(this, _, _, _, result) }
-
-  override string toString() {
-    this.isPublic() and
-    result = this.getRoot() + " PUBLIC '" + this.getPublicId() + "' '" + this.getSystemId() + "'"
-    or
-    not this.isPublic() and
-    result = this.getRoot() + " SYSTEM '" + this.getSystemId() + "'"
-  }
-}
-
-/**
- * An XML element in an XML file.
- *
- * Example:
- *
- * ```
- * <manifest xmlns:android="http://schemas.android.com/apk/res/android"
- *           package="com.example.exampleapp" android:versionCode="1">
- * </manifest>
- * ```
- */
-class XMLElement extends @xmlelement, XMLParent, XMLLocatable {
-  /** Holds if this XML element has the given `name`. */
-  predicate hasName(string name) { name = getName() }
-
-  /** Gets the name of this XML element. */
-  override string getName() { xmlElements(this, result, _, _, _) }
-
-  /** Gets the XML file in which this XML element occurs. */
-  override XMLFile getFile() { xmlElements(this, _, _, _, result) }
-
-  /** Gets the parent of this XML element. */
-  XMLParent getParent() { xmlElements(this, _, result, _, _) }
-
-  /** Gets the index of this XML element among its parent's children. */
-  int getIndex() { xmlElements(this, _, _, result, _) }
-
-  /** Holds if this XML element has a namespace. */
-  predicate hasNamespace() { xmlHasNs(this, _, _) }
-
-  /** Gets the namespace of this XML element, if any. */
-  XMLNamespace getNamespace() { xmlHasNs(this, result, _) }
-
-  /** Gets the index of this XML element among its parent's children. */
-  int getElementPositionIndex() { xmlElements(this, _, _, result, _) }
-
-  /** Gets the depth of this element within the XML file tree structure. */
-  override int getDepth() { result = this.getParent().getDepth() + 1 }
-
-  /** Gets an XML attribute of this XML element. */
-  XMLAttribute getAnAttribute() { result.getElement() = this }
-
-  /** Gets the attribute with the specified `name`, if any. */
-  XMLAttribute getAttribute(string name) { result.getElement() = this and result.getName() = name }
-
-  /** Holds if this XML element has an attribute with the specified `name`. */
-  predicate hasAttribute(string name) { exists(XMLAttribute a | a = this.getAttribute(name)) }
-
-  /** Gets the value of the attribute with the specified `name`, if any. */
-  string getAttributeValue(string name) { result = this.getAttribute(name).getValue() }
-
-  /** Gets a printable representation of this XML element. */
-  override string toString() { result = getName() }
-}
-
-/**
- * An attribute that occurs inside an XML element.
- *
- * Examples:
- *
- * ```
- * package="com.example.exampleapp"
- * android:versionCode="1"
- * ```
- */
-class XMLAttribute extends @xmlattribute, XMLLocatable {
-  /** Gets the name of this attribute. */
-  string getName() { xmlAttrs(this, _, result, _, _, _) }
-
-  /** Gets the XML element to which this attribute belongs. */
-  XMLElement getElement() { xmlAttrs(this, result, _, _, _, _) }
-
-  /** Holds if this attribute has a namespace. */
-  predicate hasNamespace() { xmlHasNs(this, _, _) }
-
-  /** Gets the namespace of this attribute, if any. */
-  XMLNamespace getNamespace() { xmlHasNs(this, result, _) }
-
-  /** Gets the value of this attribute. */
-  string getValue() { xmlAttrs(this, _, _, result, _, _) }
-
-  /** Gets a printable representation of this XML attribute. */
-  override string toString() { result = this.getName() + "=" + this.getValue() }
-}
-
-/**
- * A namespace used in an XML file.
- *
- * Example:
- *
- * ```
- * xmlns:android="http://schemas.android.com/apk/res/android"
- * ```
- */
-class XMLNamespace extends XMLLocatable, @xmlnamespace {
-  /** Gets the prefix of this namespace. */
-  string getPrefix() { xmlNs(this, result, _, _) }
-
-  /** Gets the URI of this namespace. */
-  string getURI() { xmlNs(this, _, result, _) }
-
-  /** Holds if this namespace has no prefix. */
-  predicate isDefault() { this.getPrefix() = "" }
-
-  override string toString() {
-    this.isDefault() and result = this.getURI()
-    or
-    not this.isDefault() and result = this.getPrefix() + ":" + this.getURI()
-  }
-}
-
-/**
- * A comment in an XML file.
- *
- * Example:
- *
- * ```
- * <!-- This is a comment. -->
- * ```
- */
-class XMLComment extends @xmlcomment, XMLLocatable {
-  /** Gets the text content of this XML comment. */
-  string getText() { xmlComments(this, result, _, _) }
-
-  /** Gets the parent of this XML comment. */
-  XMLParent getParent() { xmlComments(this, _, result, _) }
-
-  /** Gets a printable representation of this XML comment. */
-  override string toString() { result = this.getText() }
-}
-
-/**
- * A sequence of characters that occurs between opening and
- * closing tags of an XML element, excluding other elements.
- *
- * Example:
- *
- * ```
- * <content>This is a sequence of characters.</content>
- * ```
- */
-class XMLCharacters extends @xmlcharacters, XMLLocatable {
-  /** Gets the content of this character sequence. */
-  string getCharacters() { xmlChars(this, result, _, _, _, _) }
-
-  /** Gets the parent of this character sequence. */
-  XMLParent getParent() { xmlChars(this, _, result, _, _, _) }
-
-  /** Holds if this character sequence is CDATA. */
-  predicate isCDATA() { xmlChars(this, _, _, _, 1, _) }
-
-  /** Gets a printable representation of this XML character sequence. */
-  override string toString() { result = this.getCharacters() }
-}

cpp/ql/lib/semmle/code/cpp/commons/CommonType.qll

@@ -1,441 +0,0 @@
-import semmle.code.cpp.Type
-
-/**
- * The C/C++ `char*` type.
- */
-class CharPointerType extends PointerType {
-  CharPointerType() { this.getBaseType() instanceof CharType }
-
-  override string getAPrimaryQlClass() { result = "CharPointerType" }
-}
-
-/**
- * The C/C++ `int*` type.
- */
-class IntPointerType extends PointerType {
-  IntPointerType() { this.getBaseType() instanceof IntType }
-
-  override string getAPrimaryQlClass() { result = "IntPointerType" }
-}
-
-/**
- * The C/C++ `void*` type.
- */
-class VoidPointerType extends PointerType {
-  VoidPointerType() { this.getBaseType() instanceof VoidType }
-
-  override string getAPrimaryQlClass() { result = "VoidPointerType" }
-}
-
-/**
- * The C/C++ `size_t` type.
- */
-class Size_t extends Type {
-  Size_t() {
-    this.getUnderlyingType() instanceof IntegralType and
-    this.hasName("size_t")
-  }
-
-  override string getAPrimaryQlClass() { result = "Size_t" }
-}
-
-/**
- * The C/C++ `ssize_t` type.
- */
-class Ssize_t extends Type {
-  Ssize_t() {
-    this.getUnderlyingType() instanceof IntegralType and
-    this.hasName("ssize_t")
-  }
-
-  override string getAPrimaryQlClass() { result = "Ssize_t" }
-}
-
-/**
- * The C/C++ `ptrdiff_t` type.
- */
-class Ptrdiff_t extends Type {
-  Ptrdiff_t() {
-    this.getUnderlyingType() instanceof IntegralType and
-    this.hasName("ptrdiff_t")
-  }
-
-  override string getAPrimaryQlClass() { result = "Ptrdiff_t" }
-}
-
-/**
- * A parent class representing C/C++ a typedef'd `UserType` such as `int8_t`.
- */
-abstract private class IntegralUnderlyingUserType extends UserType {
-  IntegralUnderlyingUserType() { this.getUnderlyingType() instanceof IntegralType }
-}
-
-abstract private class TFixedWidthIntegralType extends IntegralUnderlyingUserType { }
-
-/**
- * A C/C++ fixed-width numeric type, such as `int8_t`.
- */
-class FixedWidthIntegralType extends TFixedWidthIntegralType {
-  FixedWidthIntegralType() { this instanceof TFixedWidthIntegralType }
-}
-
-abstract private class TMinimumWidthIntegralType extends IntegralUnderlyingUserType { }
-
-/**
- * A C/C++ minimum-width numeric type, such as `int_least8_t`.
- */
-class MinimumWidthIntegralType extends TMinimumWidthIntegralType {
-  MinimumWidthIntegralType() { this instanceof TMinimumWidthIntegralType }
-}
-
-abstract private class TFastestMinimumWidthIntegralType extends IntegralUnderlyingUserType { }
-
-/**
- * A C/C++ minimum-width numeric type, representing the fastest integer type with a
- * width of at least `N` such as `int_fast8_t`.
- */
-class FastestMinimumWidthIntegralType extends TFastestMinimumWidthIntegralType {
-  FastestMinimumWidthIntegralType() { this instanceof TFastestMinimumWidthIntegralType }
-}
-
-abstract private class TMaximumWidthIntegralType extends IntegralUnderlyingUserType { }
-
-/**
- * A C/C++ maximum-width numeric type, either `intmax_t` or `uintmax_t`.
- */
-class MaximumWidthIntegralType extends TMaximumWidthIntegralType {
-  MaximumWidthIntegralType() { this instanceof TMaximumWidthIntegralType }
-}
-
-/**
- * An enum type based on a fixed-width integer type. For instance, `enum e: uint8_t = { a, b };`
- */
-class FixedWidthEnumType extends UserType {
-  FixedWidthEnumType() { this.(Enum).getExplicitUnderlyingType() instanceof FixedWidthIntegralType }
-}
-
-/**
- *  The C/C++ `int8_t` type.
- */
-class Int8_t extends TFixedWidthIntegralType {
-  Int8_t() { this.hasGlobalOrStdName("int8_t") }
-
-  override string getAPrimaryQlClass() { result = "Int8_t" }
-}
-
-/**
- *  The C/C++ `int16_t` type.
- */
-class Int16_t extends TFixedWidthIntegralType {
-  Int16_t() { this.hasGlobalOrStdName("int16_t") }
-
-  override string getAPrimaryQlClass() { result = "Int16_t" }
-}
-
-/**
- *  The C/C++ `int32_t` type.
- */
-class Int32_t extends TFixedWidthIntegralType {
-  Int32_t() { this.hasGlobalOrStdName("int32_t") }
-
-  override string getAPrimaryQlClass() { result = "Int32_t" }
-}
-
-/**
- *  The C/C++ `int64_t` type.
- */
-class Int64_t extends TFixedWidthIntegralType {
-  Int64_t() { this.hasGlobalOrStdName("int64_t") }
-
-  override string getAPrimaryQlClass() { result = "Int64_t" }
-}
-
-/**
- *  The C/C++ `uint8_t` type.
- */
-class UInt8_t extends TFixedWidthIntegralType {
-  UInt8_t() { this.hasGlobalOrStdName("uint8_t") }
-
-  override string getAPrimaryQlClass() { result = "UInt8_t" }
-}
-
-/**
- *  The C/C++ `uint16_t` type.
- */
-class UInt16_t extends TFixedWidthIntegralType {
-  UInt16_t() { this.hasGlobalOrStdName("uint16_t") }
-
-  override string getAPrimaryQlClass() { result = "UInt16_t" }
-}
-
-/**
- *  The C/C++ `uint32_t` type.
- */
-class UInt32_t extends TFixedWidthIntegralType {
-  UInt32_t() { this.hasGlobalOrStdName("uint32_t") }
-
-  override string getAPrimaryQlClass() { result = "UInt32_t" }
-}
-
-/**
- *  The C/C++ `uint64_t` type.
- */
-class UInt64_t extends TFixedWidthIntegralType {
-  UInt64_t() { this.hasGlobalOrStdName("uint64_t") }
-
-  override string getAPrimaryQlClass() { result = "UInt64_t" }
-}
-
-/**
- *  The C/C++ `int_least8_t` type.
- */
-class Int_least8_t extends TMinimumWidthIntegralType {
-  Int_least8_t() { this.hasGlobalOrStdName("int_least8_t") }
-
-  override string getAPrimaryQlClass() { result = "Int_least8_t" }
-}
-
-/**
- *  The C/C++ `int_least16_t` type.
- */
-class Int_least16_t extends TMinimumWidthIntegralType {
-  Int_least16_t() { this.hasGlobalOrStdName("int_least16_t") }
-
-  override string getAPrimaryQlClass() { result = "Int_least16_t" }
-}
-
-/**
- *  The C/C++ `int_least32_t` type.
- */
-class Int_least32_t extends TMinimumWidthIntegralType {
-  Int_least32_t() { this.hasGlobalOrStdName("int_least32_t") }
-
-  override string getAPrimaryQlClass() { result = "Int_least32_t" }
-}
-
-/**
- *  The C/C++ `int_least64_t` type.
- */
-class Int_least64_t extends TMinimumWidthIntegralType {
-  Int_least64_t() { this.hasGlobalOrStdName("int_least64_t") }
-
-  override string getAPrimaryQlClass() { result = "Int_least64_t" }
-}
-
-/**
- *  The C/C++ `uint_least8_t` type.
- */
-class UInt_least8_t extends TMinimumWidthIntegralType {
-  UInt_least8_t() { this.hasGlobalOrStdName("uint_least8_t") }
-
-  override string getAPrimaryQlClass() { result = "UInt_least8_t" }
-}
-
-/**
- *  The C/C++ `uint_least16_t` type.
- */
-class UInt_least16_t extends TMinimumWidthIntegralType {
-  UInt_least16_t() { this.hasGlobalOrStdName("uint_least16_t") }
-
-  override string getAPrimaryQlClass() { result = "UInt_least16_t" }
-}
-
-/**
- *  The C/C++ `uint_least32_t` type.
- */
-class UInt_least32_t extends TMinimumWidthIntegralType {
-  UInt_least32_t() { this.hasGlobalOrStdName("uint_least32_t") }
-
-  override string getAPrimaryQlClass() { result = "UInt_least32_t" }
-}
-
-/**
- *  The C/C++ `uint_least64_t` type.
- */
-class UInt_least64_t extends TMinimumWidthIntegralType {
-  UInt_least64_t() { this.hasGlobalOrStdName("uint_least64_t") }
-
-  override string getAPrimaryQlClass() { result = "UInt_least64_t" }
-}
-
-/**
- *  The C/C++ `int_fast8_t` type.
- */
-class Int_fast8_t extends TFastestMinimumWidthIntegralType {
-  Int_fast8_t() { this.hasGlobalOrStdName("int_fast8_t") }
-
-  override string getAPrimaryQlClass() { result = "Int_fast8_t" }
-}
-
-/**
- *  The C/C++ `int_fast16_t` type.
- */
-class Int_fast16_t extends TFastestMinimumWidthIntegralType {
-  Int_fast16_t() { this.hasGlobalOrStdName("int_fast16_t") }
-
-  override string getAPrimaryQlClass() { result = "Int_fast16_t" }
-}
-
-/**
- *  The C/C++ `int_fast32_t` type.
- */
-class Int_fast32_t extends TFastestMinimumWidthIntegralType {
-  Int_fast32_t() { this.hasGlobalOrStdName("int_fast32_t") }
-
-  override string getAPrimaryQlClass() { result = "Int_fast32_t" }
-}
-
-/**
- *  The C/C++ `int_fast64_t` type.
- */
-class Int_fast64_t extends TFastestMinimumWidthIntegralType {
-  Int_fast64_t() { this.hasGlobalOrStdName("int_fast64_t") }
-
-  override string getAPrimaryQlClass() { result = "Int_fast64_t" }
-}
-
-/**
- *  The C/C++ `uint_fast8_t` type.
- */
-class UInt_fast8_t extends TFastestMinimumWidthIntegralType {
-  UInt_fast8_t() { this.hasGlobalOrStdName("uint_fast8_t") }
-
-  override string getAPrimaryQlClass() { result = "UInt_fast8_t" }
-}
-
-/**
- *  The C/C++ `uint_fast16_t` type.
- */
-class UInt_fast16_t extends TFastestMinimumWidthIntegralType {
-  UInt_fast16_t() { this.hasGlobalOrStdName("uint_fast16_t") }
-
-  override string getAPrimaryQlClass() { result = "UInt_fast16_t" }
-}
-
-/**
- *  The C/C++ `uint_fast32_t` type.
- */
-class UInt_fast32_t extends TFastestMinimumWidthIntegralType {
-  UInt_fast32_t() { this.hasGlobalOrStdName("uint_fast32_t") }
-
-  override string getAPrimaryQlClass() { result = "UInt_fast32_t" }
-}
-
-/**
- *  The C/C++ `uint_fast64_t` type.
- */
-class UInt_fast64_t extends TFastestMinimumWidthIntegralType {
-  UInt_fast64_t() { this.hasGlobalOrStdName("uint_fast64_t") }
-
-  override string getAPrimaryQlClass() { result = "UInt_fast64_t" }
-}
-
-/**
- * The C/C++ `intmax_t` type.
- */
-class Intmax_t extends TMaximumWidthIntegralType {
-  Intmax_t() { this.hasGlobalOrStdName("intmax_t") }
-
-  override string getAPrimaryQlClass() { result = "Intmax_t" }
-}
-
-/**
- * The C/C++ `uintmax_t` type.
- */
-class Uintmax_t extends TMaximumWidthIntegralType {
-  Uintmax_t() { this.hasGlobalOrStdName("uintmax_t") }
-
-  override string getAPrimaryQlClass() { result = "Uintmax_t" }
-}
-
-/**
- * The C/C++ `wchar_t` type.
- *
- * Note that on some platforms `wchar_t` doesn't exist as a built-in
- * type but a typedef is provided.  This QL class includes both cases
- * (see also `WideCharType`).
- */
-class Wchar_t extends Type {
-  Wchar_t() {
-    this.getUnderlyingType() instanceof IntegralType and
-    this.hasName("wchar_t")
-  }
-
-  override string getAPrimaryQlClass() { result = "Wchar_t" }
-}
-
-/**
- * The type that the Microsoft C/C++ `__int8` type specifier is a
- * synonym for.  Note that since `__int8` is not a distinct type,
- * `MicrosoftInt8Type` corresponds to an existing `IntegralType` as
- * well.
- *
- * This class is meaningless if a Microsoft compiler was not used.
- */
-class MicrosoftInt8Type extends IntegralType {
-  MicrosoftInt8Type() {
-    this instanceof CharType and
-    not isExplicitlyUnsigned() and
-    not isExplicitlySigned()
-  }
-}
-
-/**
- * The type that the Microsoft C/C++ `__int16` type specifier is a
- * synonym for.  Note that since `__int16` is not a distinct type,
- * `MicrosoftInt16Type` corresponds to an existing `IntegralType` as
- * well.
- *
- * This class is meaningless if a Microsoft compiler was not used.
- */
-class MicrosoftInt16Type extends IntegralType {
-  MicrosoftInt16Type() {
-    this instanceof ShortType and
-    not isExplicitlyUnsigned() and
-    not isExplicitlySigned()
-  }
-}
-
-/**
- * The type that the Microsoft C/C++ `__int32` type specifier is a
- * synonym for.  Note that since `__int32` is not a distinct type,
- * `MicrosoftInt32Type` corresponds to an existing `IntegralType` as
- * well.
- *
- * This class is meaningless if a Microsoft compiler was not used.
- */
-class MicrosoftInt32Type extends IntegralType {
-  MicrosoftInt32Type() {
-    this instanceof IntType and
-    not isExplicitlyUnsigned() and
-    not isExplicitlySigned()
-  }
-}
-
-/**
- * The type that the Microsoft C/C++ `__int64` type specifier is a
- * synonym for.  Note that since `__int64` is not a distinct type,
- * `MicrosoftInt64Type` corresponds to an existing `IntegralType` as
- * well.
- *
- * This class is meaningless if a Microsoft compiler was not used.
- */
-class MicrosoftInt64Type extends IntegralType {
-  MicrosoftInt64Type() {
-    this instanceof LongLongType and
-    not isExplicitlyUnsigned() and
-    not isExplicitlySigned()
-  }
-}
-
-/**
- * The `__builtin_va_list` type, used to provide variadic functionality.
- *
- * This is a complement to the `__builtin_va_start`, `__builtin_va_end`,
- * `__builtin_va_copy` and `__builtin_va_arg` expressions.
- */
-class BuiltInVarArgsList extends Type {
-  BuiltInVarArgsList() { this.hasName("__builtin_va_list") }
-
-  override string getAPrimaryQlClass() { result = "BuiltInVarArgsList" }
-}

cpp/ql/lib/semmle/code/cpp/commons/Strcat.qll

@@ -1,22 +0,0 @@
-import cpp
-
-/**
- * DEPRECATED: use `semmle.code.cpp.models.implementations.Strcat.qll` instead.
- *
- * A function that concatenates the string from its second argument
- * to the string from its first argument, for example `strcat`.
- */
-class StrcatFunction extends Function {
-  StrcatFunction() {
-    getName() =
-      [
-        "strcat", // strcat(dst, src)
-        "strncat", // strncat(dst, src, max_amount)
-        "wcscat", // wcscat(dst, src)
-        "_mbscat", // _mbscat(dst, src)
-        "wcsncat", // wcsncat(dst, src, max_amount)
-        "_mbsncat", // _mbsncat(dst, src, max_amount)
-        "_mbsncat_l" // _mbsncat_l(dst, src, max_amount, locale)
-      ]
-  }
-}

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplConsistency.qll

@@ -1,181 +0,0 @@
-/**
- * Provides consistency queries for checking invariants in the language-specific
- * data-flow classes and predicates.
- */
-
-private import DataFlowImplSpecific::Private
-private import DataFlowImplSpecific::Public
-private import tainttracking1.TaintTrackingParameter::Private
-private import tainttracking1.TaintTrackingParameter::Public
-
-module Consistency {
-  private class RelevantNode extends Node {
-    RelevantNode() {
-      this instanceof ArgumentNode or
-      this instanceof ParameterNode or
-      this instanceof ReturnNode or
-      this = getAnOutNode(_, _) or
-      simpleLocalFlowStep(this, _) or
-      simpleLocalFlowStep(_, this) or
-      jumpStep(this, _) or
-      jumpStep(_, this) or
-      storeStep(this, _, _) or
-      storeStep(_, _, this) or
-      readStep(this, _, _) or
-      readStep(_, _, this) or
-      defaultAdditionalTaintStep(this, _) or
-      defaultAdditionalTaintStep(_, this)
-    }
-  }
-
-  query predicate uniqueEnclosingCallable(Node n, string msg) {
-    exists(int c |
-      n instanceof RelevantNode and
-      c = count(n.getEnclosingCallable()) and
-      c != 1 and
-      msg = "Node should have one enclosing callable but has " + c + "."
-    )
-  }
-
-  query predicate uniqueType(Node n, string msg) {
-    exists(int c |
-      n instanceof RelevantNode and
-      c = count(getNodeType(n)) and
-      c != 1 and
-      msg = "Node should have one type but has " + c + "."
-    )
-  }
-
-  query predicate uniqueNodeLocation(Node n, string msg) {
-    exists(int c |
-      c =
-        count(string filepath, int startline, int startcolumn, int endline, int endcolumn |
-          n.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
-        ) and
-      c != 1 and
-      msg = "Node should have one location but has " + c + "."
-    )
-  }
-
-  query predicate missingLocation(string msg) {
-    exists(int c |
-      c =
-        strictcount(Node n |
-          not exists(string filepath, int startline, int startcolumn, int endline, int endcolumn |
-            n.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
-          )
-        ) and
-      msg = "Nodes without location: " + c
-    )
-  }
-
-  query predicate uniqueNodeToString(Node n, string msg) {
-    exists(int c |
-      c = count(n.toString()) and
-      c != 1 and
-      msg = "Node should have one toString but has " + c + "."
-    )
-  }
-
-  query predicate missingToString(string msg) {
-    exists(int c |
-      c = strictcount(Node n | not exists(n.toString())) and
-      msg = "Nodes without toString: " + c
-    )
-  }
-
-  query predicate parameterCallable(ParameterNode p, string msg) {
-    exists(DataFlowCallable c | p.isParameterOf(c, _) and c != p.getEnclosingCallable()) and
-    msg = "Callable mismatch for parameter."
-  }
-
-  query predicate localFlowIsLocal(Node n1, Node n2, string msg) {
-    simpleLocalFlowStep(n1, n2) and
-    n1.getEnclosingCallable() != n2.getEnclosingCallable() and
-    msg = "Local flow step does not preserve enclosing callable."
-  }
-
-  private DataFlowType typeRepr() { result = getNodeType(_) }
-
-  query predicate compatibleTypesReflexive(DataFlowType t, string msg) {
-    t = typeRepr() and
-    not compatibleTypes(t, t) and
-    msg = "Type compatibility predicate is not reflexive."
-  }
-
-  query predicate unreachableNodeCCtx(Node n, DataFlowCall call, string msg) {
-    isUnreachableInCall(n, call) and
-    exists(DataFlowCallable c |
-      c = n.getEnclosingCallable() and
-      not viableCallable(call) = c
-    ) and
-    msg = "Call context for isUnreachableInCall is inconsistent with call graph."
-  }
-
-  query predicate localCallNodes(DataFlowCall call, Node n, string msg) {
-    (
-      n = getAnOutNode(call, _) and
-      msg = "OutNode and call does not share enclosing callable."
-      or
-      n.(ArgumentNode).argumentOf(call, _) and
-      msg = "ArgumentNode and call does not share enclosing callable."
-    ) and
-    n.getEnclosingCallable() != call.getEnclosingCallable()
-  }
-
-  // This predicate helps the compiler forget that in some languages
-  // it is impossible for a result of `getPreUpdateNode` to be an
-  // instance of `PostUpdateNode`.
-  private Node getPre(PostUpdateNode n) {
-    result = n.getPreUpdateNode()
-    or
-    none()
-  }
-
-  query predicate postIsNotPre(PostUpdateNode n, string msg) {
-    getPre(n) = n and
-    msg = "PostUpdateNode should not equal its pre-update node."
-  }
-
-  query predicate postHasUniquePre(PostUpdateNode n, string msg) {
-    exists(int c |
-      c = count(n.getPreUpdateNode()) and
-      c != 1 and
-      msg = "PostUpdateNode should have one pre-update node but has " + c + "."
-    )
-  }
-
-  query predicate uniquePostUpdate(Node n, string msg) {
-    1 < strictcount(PostUpdateNode post | post.getPreUpdateNode() = n) and
-    msg = "Node has multiple PostUpdateNodes."
-  }
-
-  query predicate postIsInSameCallable(PostUpdateNode n, string msg) {
-    n.getEnclosingCallable() != n.getPreUpdateNode().getEnclosingCallable() and
-    msg = "PostUpdateNode does not share callable with its pre-update node."
-  }
-
-  private predicate hasPost(Node n) { exists(PostUpdateNode post | post.getPreUpdateNode() = n) }
-
-  query predicate reverseRead(Node n, string msg) {
-    exists(Node n2 | readStep(n, _, n2) and hasPost(n2) and not hasPost(n)) and
-    msg = "Origin of readStep is missing a PostUpdateNode."
-  }
-
-  query predicate argHasPostUpdate(ArgumentNode n, string msg) {
-    not hasPost(n) and
-    not isImmutableOrUnobservable(n) and
-    msg = "ArgumentNode is missing PostUpdateNode."
-  }
-
-  // This predicate helps the compiler forget that in some languages
-  // it is impossible for a `PostUpdateNode` to be the target of
-  // `simpleLocalFlowStep`.
-  private predicate isPostUpdateNode(Node n) { n instanceof PostUpdateNode or none() }
-
-  query predicate postWithInFlow(Node n, string msg) {
-    isPostUpdateNode(n) and
-    simpleLocalFlowStep(_, n) and
-    msg = "PostUpdateNode should not be the target of local flow."
-  }
-}

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowPrivate.qll

@@ -1,285 +0,0 @@
-private import cpp
-private import DataFlowUtil
-private import DataFlowDispatch
-private import FlowVar
-
-/** Gets the instance argument of a non-static call. */
-private Node getInstanceArgument(Call call) {
-  result.asExpr() = call.getQualifier()
-  or
-  result.(PreObjectInitializerNode).getExpr().(ConstructorCall) = call
-  // This does not include the implicit `this` argument on auto-generated
-  // base class destructor calls as those do not have an AST element.
-}
-
-/** An argument to a call. */
-private class Argument extends Expr {
-  Call call;
-  int pos;
-
-  Argument() { call.getArgument(pos) = this }
-
-  /** Gets the call that has this argument. */
-  Call getCall() { result = call }
-
-  /** Gets the position of this argument. */
-  int getPosition() { result = pos }
-}
-
-/**
- * A data flow node that occurs as the argument of a call and is passed as-is
- * to the callable. Arguments that are wrapped in an implicit varargs array
- * creation are not included, but the implicitly created array is.
- * Instance arguments are also included.
- */
-class ArgumentNode extends Node {
-  ArgumentNode() {
-    exists(Argument arg | this.asExpr() = arg) or
-    this = getInstanceArgument(_)
-  }
-
-  /**
-   * Holds if this argument occurs at the given position in the given call.
-   * The instance argument is considered to have index `-1`.
-   */
-  predicate argumentOf(DataFlowCall call, int pos) {
-    exists(Argument arg | this.asExpr() = arg | call = arg.getCall() and pos = arg.getPosition())
-    or
-    pos = -1 and this = getInstanceArgument(call)
-  }
-
-  /** Gets the call in which this node is an argument. */
-  DataFlowCall getCall() { this.argumentOf(result, _) }
-}
-
-private newtype TReturnKind =
-  TNormalReturnKind() or
-  TRefReturnKind(int i) { exists(Parameter parameter | i = parameter.getIndex()) }
-
-/**
- * A return kind. A return kind describes how a value can be returned
- * from a callable. For C++, this is simply a function return.
- */
-class ReturnKind extends TReturnKind {
-  /** Gets a textual representation of this return kind. */
-  string toString() {
-    this instanceof TNormalReturnKind and
-    result = "return"
-    or
-    this instanceof TRefReturnKind and
-    result = "ref"
-  }
-}
-
-/** A data flow node that represents a returned value in the called function. */
-abstract class ReturnNode extends Node {
-  /** Gets the kind of this returned value. */
-  abstract ReturnKind getKind();
-}
-
-/** A `ReturnNode` that occurs as the result of a `ReturnStmt`. */
-private class NormalReturnNode extends ReturnNode, ExprNode {
-  NormalReturnNode() { exists(ReturnStmt ret | this.getExpr() = ret.getExpr()) }
-
-  /** Gets the kind of this returned value. */
-  override ReturnKind getKind() { result = TNormalReturnKind() }
-}
-
-/**
- * A `ReturnNode` that occurs as a result of a definition of a reference
- * parameter reaching the end of a function body.
- */
-private class RefReturnNode extends ReturnNode, RefParameterFinalValueNode {
-  /** Gets the kind of this returned value. */
-  override ReturnKind getKind() { result = TRefReturnKind(this.getParameter().getIndex()) }
-}
-
-/** A data flow node that represents the output of a call at the call site. */
-abstract class OutNode extends Node {
-  /** Gets the underlying call. */
-  abstract DataFlowCall getCall();
-}
-
-private class ExprOutNode extends OutNode, ExprNode {
-  ExprOutNode() { this.getExpr() instanceof Call }
-
-  /** Gets the underlying call. */
-  override DataFlowCall getCall() { result = this.getExpr() }
-}
-
-private class RefOutNode extends OutNode, DefinitionByReferenceOrIteratorNode {
-  /** Gets the underlying call. */
-  override DataFlowCall getCall() { result = this.getArgument().getParent() }
-}
-
-/**
- * Gets a node that can read the value returned from `call` with return kind
- * `kind`.
- */
-OutNode getAnOutNode(DataFlowCall call, ReturnKind kind) {
-  result = call.getNode() and
-  kind = TNormalReturnKind()
-  or
-  exists(int i |
-    result.(DefinitionByReferenceOrIteratorNode).getArgument() = call.getArgument(i) and
-    kind = TRefReturnKind(i)
-  )
-}
-
-/**
- * Holds if data can flow from `node1` to `node2` in a way that loses the
- * calling context. For example, this would happen with flow through a
- * global or static variable.
- */
-predicate jumpStep(Node n1, Node n2) { none() }
-
-/**
- * Holds if data can flow from `node1` to `node2` via an assignment to `f`.
- * Thus, `node2` references an object with a field `f` that contains the
- * value of `node1`.
- */
-predicate storeStep(Node node1, Content f, PostUpdateNode node2) {
-  exists(ClassAggregateLiteral aggr, Field field |
-    // The following line requires `node2` to be both an `ExprNode` and a
-    // `PostUpdateNode`, which means it must be an `ObjectInitializerNode`.
-    node2.asExpr() = aggr and
-    f.(FieldContent).getField() = field and
-    aggr.getFieldExpr(field) = node1.asExpr()
-  )
-  or
-  exists(FieldAccess fa |
-    exists(Assignment a |
-      node1.asExpr() = a and
-      a.getLValue() = fa
-    ) and
-    node2.getPreUpdateNode().asExpr() = fa.getQualifier() and
-    f.(FieldContent).getField() = fa.getTarget()
-  )
-  or
-  exists(ConstructorFieldInit cfi |
-    node2.getPreUpdateNode().(PreConstructorInitThis).getConstructorFieldInit() = cfi and
-    f.(FieldContent).getField() = cfi.getTarget() and
-    node1.asExpr() = cfi.getExpr()
-  )
-}
-
-/**
- * Holds if data can flow from `node1` to `node2` via a read of `f`.
- * Thus, `node1` references an object with a field `f` whose value ends up in
- * `node2`.
- */
-predicate readStep(Node node1, Content f, Node node2) {
-  exists(FieldAccess fr |
-    node1.asExpr() = fr.getQualifier() and
-    fr.getTarget() = f.(FieldContent).getField() and
-    fr = node2.asExpr() and
-    not fr = any(AssignExpr a).getLValue()
-  )
-}
-
-/**
- * Holds if values stored inside content `c` are cleared at node `n`.
- */
-predicate clearsContent(Node n, Content c) {
-  none() // stub implementation
-}
-
-/** Gets the type of `n` used for type pruning. */
-Type getNodeType(Node n) {
-  suppressUnusedNode(n) and
-  result instanceof VoidType // stub implementation
-}
-
-/** Gets a string representation of a type returned by `getNodeType`. */
-string ppReprType(Type t) { none() } // stub implementation
-
-/**
- * Holds if `t1` and `t2` are compatible, that is, whether data can flow from
- * a node of type `t1` to a node of type `t2`.
- */
-pragma[inline]
-predicate compatibleTypes(Type t1, Type t2) {
-  any() // stub implementation
-}
-
-private predicate suppressUnusedNode(Node n) { any() }
-
-//////////////////////////////////////////////////////////////////////////////
-// Java QL library compatibility wrappers
-//////////////////////////////////////////////////////////////////////////////
-/** A node that performs a type cast. */
-class CastNode extends Node {
-  CastNode() { none() } // stub implementation
-}
-
-class DataFlowCallable = Function;
-
-class DataFlowExpr = Expr;
-
-class DataFlowType = Type;
-
-/** A function call relevant for data flow. */
-class DataFlowCall extends Expr {
-  DataFlowCall() { this instanceof Call }
-
-  /**
-   * Gets the nth argument for this call.
-   *
-   * The range of `n` is from `0` to `getNumberOfArguments() - 1`.
-   */
-  Expr getArgument(int n) { result = this.(Call).getArgument(n) }
-
-  /** Gets the data flow node corresponding to this call. */
-  ExprNode getNode() { result.getExpr() = this }
-
-  /** Gets the enclosing callable of this call. */
-  Function getEnclosingCallable() { result = this.getEnclosingFunction() }
-}
-
-predicate isUnreachableInCall(Node n, DataFlowCall call) { none() } // stub implementation
-
-int accessPathLimit() { result = 5 }
-
-/** The unit type. */
-private newtype TUnit = TMkUnit()
-
-/** The trivial type with a single element. */
-class Unit extends TUnit {
-  /** Gets a textual representation of this element. */
-  string toString() { result = "unit" }
-}
-
-/**
- * Holds if `n` does not require a `PostUpdateNode` as it either cannot be
- * modified or its modification cannot be observed, for example if it is a
- * freshly created object that is not saved in a variable.
- *
- * This predicate is only used for consistency checks.
- */
-predicate isImmutableOrUnobservable(Node n) {
-  // Is the null pointer (or something that's not really a pointer)
-  exists(n.asExpr().getValue())
-  or
-  // Isn't a pointer or is a pointer to const
-  forall(DerivedType dt | dt = n.asExpr().getActualType() |
-    dt.getBaseType().isConst()
-    or
-    dt.getBaseType() instanceof RoutineType
-  )
-  // The above list of cases isn't exhaustive, but it narrows down the
-  // consistency alerts enough that most of them are interesting.
-}
-
-/** Holds if `n` should be hidden from path explanations. */
-predicate nodeIsHidden(Node n) { none() }
-
-class LambdaCallKind = Unit;
-
-/** Holds if `creation` is an expression that creates a lambda of kind `kind` for `c`. */
-predicate lambdaCreation(Node creation, LambdaCallKind kind, DataFlowCallable c) { none() }
-
-/** Holds if `call` is a lambda call of kind `kind` where `receiver` is the lambda expression. */
-predicate lambdaCall(DataFlowCall call, LambdaCallKind kind, Node receiver) { none() }
-
-/** Extra data-flow steps needed for lambda flow analysis. */
-predicate additionalLambdaFlowStep(Node nodeFrom, Node nodeTo, boolean preservesValue) { none() }

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll

@@ -1,836 +0,0 @@
-/**
- * Provides C++-specific definitions for use in the data flow library.
- */
-
-private import cpp
-private import semmle.code.cpp.dataflow.internal.FlowVar
-private import semmle.code.cpp.models.interfaces.DataFlow
-private import semmle.code.cpp.controlflow.Guards
-private import semmle.code.cpp.dataflow.internal.AddressFlow
-
-cached
-private newtype TNode =
-  TExprNode(Expr e) or
-  TPartialDefinitionNode(PartialDefinition pd) or
-  TPreObjectInitializerNode(Expr e) {
-    e instanceof ConstructorCall
-    or
-    e instanceof ClassAggregateLiteral
-  } or
-  TExplicitParameterNode(Parameter p) { exists(p.getFunction().getBlock()) } or
-  TInstanceParameterNode(MemberFunction f) { exists(f.getBlock()) and not f.isStatic() } or
-  TPreConstructorInitThis(ConstructorFieldInit cfi) or
-  TPostConstructorInitThis(ConstructorFieldInit cfi) or
-  TInnerPartialDefinitionNode(Expr e) {
-    exists(PartialDefinition def, Expr outer |
-      def.definesExpressions(e, outer) and
-      // This condition ensures that we don't get two post-update nodes sharing
-      // the same pre-update node.
-      e != outer
-    )
-  } or
-  TUninitializedNode(LocalVariable v) { not v.hasInitializer() } or
-  TRefParameterFinalValueNode(Parameter p) { exists(FlowVar var | var.reachesRefParameter(p)) }
-
-/**
- * A node in a data flow graph.
- *
- * A node can be either an expression, a parameter, or an uninitialized local
- * variable. Such nodes are created with `DataFlow::exprNode`,
- * `DataFlow::parameterNode`, and `DataFlow::uninitializedNode` respectively.
- */
-class Node extends TNode {
-  /** Gets the function to which this node belongs. */
-  Function getFunction() { none() } // overridden in subclasses
-
-  /**
-   * INTERNAL: Do not use. Alternative name for `getFunction`.
-   */
-  final Function getEnclosingCallable() { result = this.getFunction() }
-
-  /** Gets the type of this node. */
-  Type getType() { none() } // overridden in subclasses
-
-  /**
-   * Gets the expression corresponding to this node, if any. This predicate
-   * only has a result on nodes that represent the value of evaluating the
-   * expression. For data flowing _out of_ an expression, like when an
-   * argument is passed by reference, use `asDefiningArgument` instead of
-   * `asExpr`.
-   */
-  Expr asExpr() { result = this.(ExprNode).getExpr() }
-
-  /** Gets the parameter corresponding to this node, if any. */
-  Parameter asParameter() { result = this.(ExplicitParameterNode).getParameter() }
-
-  /**
-   * Gets the argument that defines this `DefinitionByReferenceNode`, if any.
-   * This predicate should be used instead of `asExpr` when referring to the
-   * value of a reference argument _after_ the call has returned. For example,
-   * in `f(&x)`, this predicate will have `&x` as its result for the `Node`
-   * that represents the new value of `x`.
-   */
-  Expr asDefiningArgument() { result = this.(DefinitionByReferenceNode).getArgument() }
-
-  /**
-   * Gets the expression that is partially defined by this node, if any.
-   *
-   * Partial definitions are created for field stores (`x.y = taint();` is a partial
-   * definition of `x`), and for calls that may change the value of an object (so
-   * `x.set(taint())` is a partial definition of `x`, and `transfer(&x, taint())` is
-   * a partial definition of `&x`).
-   */
-  Expr asPartialDefinition() {
-    this.(PartialDefinitionNode).getPartialDefinition().definesExpressions(_, result)
-  }
-
-  /**
-   * Gets the uninitialized local variable corresponding to this node, if
-   * any.
-   */
-  LocalVariable asUninitialized() { result = this.(UninitializedNode).getLocalVariable() }
-
-  /** Gets a textual representation of this element. */
-  string toString() { none() } // overridden by subclasses
-
-  /** Gets the location of this element. */
-  Location getLocation() { none() } // overridden by subclasses
-
-  /**
-   * Holds if this element is at the specified location.
-   * The location spans column `startcolumn` of line `startline` to
-   * column `endcolumn` of line `endline` in file `filepath`.
-   * For more information, see
-   * [Locations](https://help.semmle.com/QL/learn-ql/ql/locations.html).
-   */
-  predicate hasLocationInfo(
-    string filepath, int startline, int startcolumn, int endline, int endcolumn
-  ) {
-    getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
-  }
-
-  /**
-   * Gets an upper bound on the type of this node.
-   */
-  Type getTypeBound() { result = getType() }
-}
-
-/**
- * An expression, viewed as a node in a data flow graph.
- */
-class ExprNode extends Node, TExprNode {
-  Expr expr;
-
-  ExprNode() { this = TExprNode(expr) }
-
-  override Function getFunction() { result = expr.getEnclosingFunction() }
-
-  override Type getType() { result = expr.getType() }
-
-  override string toString() { result = expr.toString() }
-
-  override Location getLocation() { result = expr.getLocation() }
-
-  /** Gets the expression corresponding to this node. */
-  Expr getExpr() { result = expr }
-}
-
-abstract class ParameterNode extends Node, TNode {
-  /**
-   * Holds if this node is the parameter of `c` at the specified (zero-based)
-   * position. The implicit `this` parameter is considered to have index `-1`.
-   */
-  abstract predicate isParameterOf(Function f, int i);
-}
-
-/**
- * The value of a parameter at function entry, viewed as a node in a data
- * flow graph.
- */
-class ExplicitParameterNode extends ParameterNode, TExplicitParameterNode {
-  Parameter param;
-
-  ExplicitParameterNode() { this = TExplicitParameterNode(param) }
-
-  override Function getFunction() { result = param.getFunction() }
-
-  override Type getType() { result = param.getType() }
-
-  override string toString() { result = param.toString() }
-
-  override Location getLocation() { result = param.getLocation() }
-
-  /** Gets the parameter corresponding to this node. */
-  Parameter getParameter() { result = param }
-
-  override predicate isParameterOf(Function f, int i) { f.getParameter(i) = param }
-}
-
-class ImplicitParameterNode extends ParameterNode, TInstanceParameterNode {
-  MemberFunction f;
-
-  ImplicitParameterNode() { this = TInstanceParameterNode(f) }
-
-  override Function getFunction() { result = f }
-
-  override Type getType() { result = f.getDeclaringType() }
-
-  override string toString() { result = "this" }
-
-  override Location getLocation() { result = f.getLocation() }
-
-  override predicate isParameterOf(Function fun, int i) { f = fun and i = -1 }
-}
-
-/**
- * INTERNAL: do not use.
- *
- * A node that represents the value of a variable after a function call that
- * may have changed the variable because it's passed by reference or because an
- * iterator for it was passed by value or by reference.
- */
-class DefinitionByReferenceOrIteratorNode extends PartialDefinitionNode {
-  Expr inner;
-  Expr argument;
-
-  DefinitionByReferenceOrIteratorNode() {
-    this.getPartialDefinition().definesExpressions(inner, argument) and
-    (
-      this.getPartialDefinition() instanceof DefinitionByReference
-      or
-      this.getPartialDefinition() instanceof DefinitionByIterator
-    )
-  }
-
-  override Function getFunction() { result = inner.getEnclosingFunction() }
-
-  override Type getType() { result = inner.getType() }
-
-  override Location getLocation() { result = argument.getLocation() }
-
-  override ExprNode getPreUpdateNode() { result.getExpr() = argument }
-
-  /** Gets the argument corresponding to this node. */
-  Expr getArgument() { result = argument }
-
-  /** Gets the parameter through which this value is assigned. */
-  Parameter getParameter() {
-    exists(FunctionCall call, int i |
-      argument = call.getArgument(i) and
-      result = call.getTarget().getParameter(i)
-    )
-  }
-}
-
-/**
- * A node that represents the value of a variable after a function call that
- * may have changed the variable because it's passed by reference.
- *
- * A typical example would be a call `f(&x)`. Firstly, there will be flow into
- * `x` from previous definitions of `x`. Secondly, there will be a
- * `DefinitionByReferenceNode` to represent the value of `x` after the call has
- * returned. This node will have its `getArgument()` equal to `&x`.
- */
-class DefinitionByReferenceNode extends DefinitionByReferenceOrIteratorNode {
-  override VariablePartialDefinition pd;
-
-  override string toString() { result = "ref arg " + argument.toString() }
-}
-
-/**
- * The value of an uninitialized local variable, viewed as a node in a data
- * flow graph.
- */
-class UninitializedNode extends Node, TUninitializedNode {
-  LocalVariable v;
-
-  UninitializedNode() { this = TUninitializedNode(v) }
-
-  override Function getFunction() { result = v.getFunction() }
-
-  override Type getType() { result = v.getType() }
-
-  override string toString() { result = v.toString() }
-
-  override Location getLocation() { result = v.getLocation() }
-
-  /** Gets the uninitialized local variable corresponding to this node. */
-  LocalVariable getLocalVariable() { result = v }
-}
-
-/** INTERNAL: do not use. The final value of a non-const ref parameter. */
-class RefParameterFinalValueNode extends Node, TRefParameterFinalValueNode {
-  Parameter p;
-
-  RefParameterFinalValueNode() { this = TRefParameterFinalValueNode(p) }
-
-  override Function getFunction() { result = p.getFunction() }
-
-  override Type getType() { result = p.getType() }
-
-  override string toString() { result = p.toString() }
-
-  override Location getLocation() { result = p.getLocation() }
-
-  Parameter getParameter() { result = p }
-}
-
-/**
- * A node associated with an object after an operation that might have
- * changed its state.
- *
- * This can be either the argument to a callable after the callable returns
- * (which might have mutated the argument), or the qualifier of a field after
- * an update to the field.
- *
- * Nodes corresponding to AST elements, for example `ExprNode`, usually refer
- * to the value before the update with the exception of `ClassInstanceExpr`,
- * which represents the value after the constructor has run.
- */
-abstract class PostUpdateNode extends Node {
-  /**
-   * Gets the node before the state update.
-   */
-  abstract Node getPreUpdateNode();
-
-  override Function getFunction() { result = getPreUpdateNode().getFunction() }
-
-  override Type getType() { result = getPreUpdateNode().getType() }
-
-  override Location getLocation() { result = getPreUpdateNode().getLocation() }
-}
-
-abstract private class PartialDefinitionNode extends PostUpdateNode, TPartialDefinitionNode {
-  PartialDefinition pd;
-
-  PartialDefinitionNode() { this = TPartialDefinitionNode(pd) }
-
-  override Location getLocation() { result = pd.getActualLocation() }
-
-  PartialDefinition getPartialDefinition() { result = pd }
-
-  override string toString() { result = getPreUpdateNode().toString() + " [post update]" }
-}
-
-private class VariablePartialDefinitionNode extends PartialDefinitionNode {
-  override VariablePartialDefinition pd;
-
-  override Node getPreUpdateNode() { pd.definesExpressions(_, result.asExpr()) }
-}
-
-/**
- * INTERNAL: do not use.
- *
- * A synthetic data flow node used for flow into a collection when an iterator
- * write occurs in a callee.
- */
-private class IteratorPartialDefinitionNode extends PartialDefinitionNode {
-  override IteratorPartialDefinition pd;
-
-  override Node getPreUpdateNode() { pd.definesExpressions(_, result.asExpr()) }
-}
-
-/**
- * A post-update node on the `e->f` in `f(&e->f)` (and other forms).
- */
-private class InnerPartialDefinitionNode extends TInnerPartialDefinitionNode, PostUpdateNode {
-  Expr e;
-
-  InnerPartialDefinitionNode() { this = TInnerPartialDefinitionNode(e) }
-
-  override ExprNode getPreUpdateNode() { result.getExpr() = e }
-
-  override Function getFunction() { result = e.getEnclosingFunction() }
-
-  override Type getType() { result = e.getType() }
-
-  override string toString() { result = e.toString() + " [inner post update]" }
-
-  override Location getLocation() { result = e.getLocation() }
-}
-
-/**
- * A node representing the temporary value of an object that was just
- * constructed by a constructor call or an aggregate initializer. This is only
- * for objects, not for pointers to objects.
- *
- * These expressions are their own post-update nodes but instead have synthetic
- * pre-update nodes.
- */
-private class ObjectInitializerNode extends PostUpdateNode, TExprNode {
-  PreObjectInitializerNode pre;
-
-  ObjectInitializerNode() {
-    // If a `Node` is associated with a `PreObjectInitializerNode`, then it's
-    // an `ObjectInitializerNode`.
-    pre.getExpr() = this.asExpr()
-  }
-
-  override PreObjectInitializerNode getPreUpdateNode() { result = pre }
-  // No override of `toString` since these nodes already have a `toString` from
-  // their overlap with `ExprNode`.
-}
-
-/**
- * INTERNAL: do not use.
- *
- * A synthetic data-flow node that plays the role of a temporary object that
- * has not yet been initialized.
- */
-class PreObjectInitializerNode extends Node, TPreObjectInitializerNode {
-  Expr getExpr() { this = TPreObjectInitializerNode(result) }
-
-  override Function getFunction() { result = getExpr().getEnclosingFunction() }
-
-  override Type getType() { result = getExpr().getType() }
-
-  override Location getLocation() { result = getExpr().getLocation() }
-
-  override string toString() { result = getExpr().toString() + " [pre init]" }
-}
-
-/**
- * A synthetic data-flow node that plays the role of the post-update `this`
- * pointer in a `ConstructorFieldInit`. For example, the `x(1)` in
- * `C() : x(1) { }` is roughly equivalent to `this.x = 1`, and this node is
- * equivalent to the `this` _after_ the field has been assigned.
- */
-private class PostConstructorInitThis extends PostUpdateNode, TPostConstructorInitThis {
-  override PreConstructorInitThis getPreUpdateNode() {
-    this = TPostConstructorInitThis(result.getConstructorFieldInit())
-  }
-
-  override string toString() {
-    result = getPreUpdateNode().getConstructorFieldInit().toString() + " [post-this]"
-  }
-}
-
-/**
- * INTERNAL: do not use.
- *
- * A synthetic data-flow node that plays the role of the pre-update `this`
- * pointer in a `ConstructorFieldInit`. For example, the `x(1)` in
- * `C() : x(1) { }` is roughly equivalent to `this.x = 1`, and this node is
- * equivalent to the `this` _before_ the field has been assigned.
- */
-class PreConstructorInitThis extends Node, TPreConstructorInitThis {
-  ConstructorFieldInit getConstructorFieldInit() { this = TPreConstructorInitThis(result) }
-
-  override Constructor getFunction() { result = getConstructorFieldInit().getEnclosingFunction() }
-
-  override PointerType getType() {
-    result.getBaseType() = getConstructorFieldInit().getEnclosingFunction().getDeclaringType()
-  }
-
-  override Location getLocation() { result = getConstructorFieldInit().getLocation() }
-
-  override string toString() { result = getConstructorFieldInit().toString() + " [pre-this]" }
-}
-
-/**
- * Gets the `Node` corresponding to the value of evaluating `e`. For data
- * flowing _out of_ an expression, like when an argument is passed by
- * reference, use `definitionByReferenceNodeFromArgument` instead.
- */
-ExprNode exprNode(Expr e) { result.getExpr() = e }
-
-/**
- * Gets the `Node` corresponding to the value of `p` at function entry.
- */
-ParameterNode parameterNode(Parameter p) { result.(ExplicitParameterNode).getParameter() = p }
-
-/**
- * Gets the `Node` corresponding to a definition by reference of the variable
- * that is passed as `argument` of a call.
- */
-DefinitionByReferenceNode definitionByReferenceNodeFromArgument(Expr argument) {
-  result.getArgument() = argument
-}
-
-/**
- * Gets the `Node` corresponding to the value of an uninitialized local
- * variable `v`.
- */
-UninitializedNode uninitializedNode(LocalVariable v) { result.getLocalVariable() = v }
-
-private module ThisFlow {
-  /**
-   * Gets the 0-based index of `thisNode` in `b`, where `thisNode` is an access
-   * to `this` that may or may not have an associated `PostUpdateNode`. To make
-   * room for synthetic nodes that access `this`, the index may not correspond
-   * to an actual `ControlFlowNode`.
-   */
-  private int basicBlockThisIndex(BasicBlock b, Node thisNode) {
-    // The implicit `this` parameter node is given a very negative offset to
-    // make space for any `ConstructorFieldInit`s there may be between it and
-    // the block contents.
-    thisNode.(ImplicitParameterNode).getFunction().getBlock() = b and
-    result = -2147483648
-    or
-    // Place the synthetic `this` node for a `ConstructorFieldInit` at a
-    // negative offset in the first basic block, between the
-    // `ImplicitParameterNode` and the first statement.
-    exists(Constructor constructor, int i |
-      thisNode.(PreConstructorInitThis).getConstructorFieldInit() = constructor.getInitializer(i) and
-      result = -2147483648 + 1 + i and
-      b = thisNode.getFunction().getBlock()
-    )
-    or
-    b.getNode(result) = thisNode.asExpr().(ThisExpr)
-  }
-
-  private int thisRank(BasicBlock b, Node thisNode) {
-    thisNode = rank[result](Node n, int i | i = basicBlockThisIndex(b, n) | n order by i)
-  }
-
-  private int lastThisRank(BasicBlock b) { result = max(thisRank(b, _)) }
-
-  private predicate thisAccessBlockReaches(BasicBlock b1, BasicBlock b2) {
-    exists(basicBlockThisIndex(b1, _)) and b2 = b1.getASuccessor()
-    or
-    exists(BasicBlock mid |
-      thisAccessBlockReaches(b1, mid) and
-      b2 = mid.getASuccessor() and
-      not exists(basicBlockThisIndex(mid, _))
-    )
-  }
-
-  predicate adjacentThisRefs(Node n1, Node n2) {
-    exists(BasicBlock b | thisRank(b, n1) + 1 = thisRank(b, n2))
-    or
-    exists(BasicBlock b1, BasicBlock b2 |
-      lastThisRank(b1) = thisRank(b1, n1) and
-      thisAccessBlockReaches(b1, b2) and
-      thisRank(b2, n2) = 1
-    )
-  }
-}
-
-/**
- * Holds if data flows from `nodeFrom` to `nodeTo` in exactly one local
- * (intra-procedural) step.
- */
-cached
-predicate localFlowStep(Node nodeFrom, Node nodeTo) {
-  simpleLocalFlowStep(nodeFrom, nodeTo)
-  or
-  // Field flow is not strictly a "step" but covers the whole function
-  // transitively. There's no way to get a step-like relation out of the global
-  // data flow library, so we just have to accept some big steps here.
-  FieldFlow::fieldFlow(nodeFrom, nodeTo)
-}
-
-/**
- * INTERNAL: do not use.
- *
- * This is the local flow predicate that's used as a building block in global
- * data flow. It may have less flow than the `localFlowStep` predicate.
- */
-predicate simpleLocalFlowStep(Node nodeFrom, Node nodeTo) {
-  // Expr -> Expr
-  exprToExprStep_nocfg(nodeFrom.asExpr(), nodeTo.asExpr())
-  or
-  // Assignment -> LValue post-update node
-  //
-  // This is used for assignments whose left-hand side is not a variable
-  // assignment or a storeStep but is still modeled by other means. It could be
-  // a call to `operator*` or `operator[]` where taint should flow to the
-  // post-update node of the qualifier.
-  exists(AssignExpr assign |
-    nodeFrom.asExpr() = assign and
-    nodeTo.(PostUpdateNode).getPreUpdateNode().asExpr() = assign.getLValue()
-  )
-  or
-  // Node -> FlowVar -> VariableAccess
-  exists(FlowVar var |
-    (
-      exprToVarStep(nodeFrom.asExpr(), var)
-      or
-      varSourceBaseCase(var, nodeFrom.asParameter())
-      or
-      varSourceBaseCase(var, nodeFrom.asUninitialized())
-      or
-      var.definedPartiallyAt(nodeFrom.asPartialDefinition())
-    ) and
-    varToNodeStep(var, nodeTo)
-  )
-  or
-  // Expr -> DefinitionByReferenceNode
-  exprToDefinitionByReferenceStep(nodeFrom.asExpr(), nodeTo.asDefiningArgument())
-  or
-  // `this` -> adjacent-`this`
-  ThisFlow::adjacentThisRefs(nodeFrom, nodeTo)
-  or
-  // post-update-`this` -> following-`this`-ref
-  ThisFlow::adjacentThisRefs(nodeFrom.(PostUpdateNode).getPreUpdateNode(), nodeTo)
-  or
-  // In `f(&x->a)`, this step provides the flow from post-`&` to post-`x->a`,
-  // from which there is field flow to `x` via reverse read.
-  exists(PartialDefinition def, Expr inner, Expr outer |
-    def.definesExpressions(inner, outer) and
-    inner = nodeTo.(InnerPartialDefinitionNode).getPreUpdateNode().asExpr() and
-    outer = nodeFrom.(PartialDefinitionNode).getPreUpdateNode().asExpr()
-  )
-  or
-  // Reverse flow: data that flows from the post-update node of a reference
-  // returned by a function call, back into the qualifier of that function.
-  // This allows data to flow 'in' through references returned by a modeled
-  // function such as `operator[]`.
-  exists(DataFlowFunction f, Call call, FunctionInput inModel, FunctionOutput outModel |
-    call.getTarget() = f and
-    inModel.isReturnValueDeref() and
-    outModel.isQualifierObject() and
-    f.hasDataFlow(inModel, outModel) and
-    nodeFrom.(PostUpdateNode).getPreUpdateNode().asExpr() = call and
-    nodeTo.asDefiningArgument() = call.getQualifier()
-  )
-}
-
-/**
- * Holds if data flows from `source` to `sink` in zero or more local
- * (intra-procedural) steps.
- */
-predicate localFlow(Node source, Node sink) { localFlowStep*(source, sink) }
-
-/**
- * Holds if data can flow from `e1` to `e2` in zero or more
- * local (intra-procedural) steps.
- */
-predicate localExprFlow(Expr e1, Expr e2) { localFlow(exprNode(e1), exprNode(e2)) }
-
-/**
- * Holds if the initial value of `v`, if it is a source, flows to `var`.
- */
-private predicate varSourceBaseCase(FlowVar var, Variable v) { var.definedByInitialValue(v) }
-
-/**
- * Holds if `var` is defined by an assignment-like operation that causes flow
- * directly from `assignedExpr` to `var`, _and_ `assignedExpr` evaluates to
- * the same value as what is assigned to `var`.
- */
-private predicate exprToVarStep(Expr assignedExpr, FlowVar var) {
-  exists(ControlFlowNode operation |
-    var.definedByExpr(assignedExpr, operation) and
-    not operation instanceof PostfixCrementOperation
-  )
-}
-
-/**
- * Holds if the node `n` is an access of the variable `var`.
- */
-private predicate varToNodeStep(FlowVar var, Node n) {
-  n.asExpr() = var.getAnAccess()
-  or
-  var.reachesRefParameter(n.(RefParameterFinalValueNode).getParameter())
-}
-
-/**
- * Holds if data flows from `fromExpr` to `toExpr` directly, in the case
- * where `toExpr` is the immediate AST parent of `fromExpr`. For example,
- * data flows from `x` and `y` to `b ? x : y`.
- */
-private predicate exprToExprStep_nocfg(Expr fromExpr, Expr toExpr) {
-  toExpr = any(ConditionalExpr cond | fromExpr = cond.getThen() or fromExpr = cond.getElse())
-  or
-  toExpr = any(AssignExpr assign | fromExpr = assign.getRValue())
-  or
-  toExpr = any(CommaExpr comma | fromExpr = comma.getRightOperand())
-  or
-  toExpr = any(PostfixCrementOperation op | fromExpr = op.getOperand())
-  or
-  toExpr = any(StmtExpr stmtExpr | fromExpr = stmtExpr.getResultExpr())
-  or
-  toExpr.(AddressOfExpr).getOperand() = fromExpr
-  or
-  // This rule enables flow from an array to its elements. Example: `a` to
-  // `a[i]` or `*a`, where `a` is an array type. It does not enable flow from a
-  // pointer to its indirection as in `p[i]` where `p` is a pointer type.
-  exists(Expr toConverted |
-    variablePartiallyAccessed(fromExpr, toConverted) and
-    toExpr = toConverted.getUnconverted() and
-    not toExpr = fromExpr
-  )
-  or
-  toExpr.(BuiltInOperationBuiltInAddressOf).getOperand() = fromExpr
-  or
-  // The following case is needed to track the qualifier object for flow
-  // through fields. It gives flow from `T(x)` to `new T(x)`. That's not
-  // strictly _data_ flow but _taint_ flow because the type of `fromExpr` is
-  // `T` while the type of `toExpr` is `T*`.
-  //
-  // This discrepancy is an artifact of how `new`-expressions are represented
-  // in the database in a way that slightly varies from what the standard
-  // specifies. In the C++ standard, there is no constructor call expression
-  // `T(x)` after `new`. Instead there is a type `T` and an optional
-  // initializer `(x)`.
-  toExpr.(NewExpr).getInitializer() = fromExpr
-  or
-  // A lambda expression (`[captures](params){body}`) is just a thin wrapper
-  // around the desugared closure creation in the form of a
-  // `ClassAggregateLiteral` (`{ capture1, ..., captureN }`).
-  toExpr.(LambdaExpression).getInitializer() = fromExpr
-  or
-  // Data flow through a function model.
-  toExpr =
-    any(Call call |
-      exists(DataFlowFunction f, FunctionInput inModel, FunctionOutput outModel |
-        f.hasDataFlow(inModel, outModel) and
-        (
-          exists(int iIn |
-            inModel.isParameterDeref(iIn) and
-            call.passesByReference(iIn, fromExpr)
-          )
-          or
-          exists(int iIn |
-            inModel.isParameter(iIn) and
-            fromExpr = call.getArgument(iIn)
-          )
-          or
-          inModel.isQualifierObject() and
-          fromExpr = call.getQualifier()
-          or
-          inModel.isQualifierAddress() and
-          fromExpr = call.getQualifier()
-        ) and
-        call.getTarget() = f and
-        // AST dataflow treats a reference as if it were the referred-to object, while the dataflow
-        // models treat references as pointers. If the return type of the call is a reference, then
-        // look for data flow the the referred-to object, rather than the reference itself.
-        if call.getType().getUnspecifiedType() instanceof ReferenceType
-        then outModel.isReturnValueDeref()
-        else outModel.isReturnValue()
-      )
-    )
-}
-
-private predicate exprToDefinitionByReferenceStep(Expr exprIn, Expr argOut) {
-  exists(DataFlowFunction f, Call call, FunctionOutput outModel, int argOutIndex |
-    call.getTarget() = f and
-    argOut = call.getArgument(argOutIndex) and
-    outModel.isParameterDeref(argOutIndex) and
-    exists(int argInIndex, FunctionInput inModel | f.hasDataFlow(inModel, outModel) |
-      inModel.isParameterDeref(argInIndex) and
-      call.passesByReference(argInIndex, exprIn)
-      or
-      inModel.isParameter(argInIndex) and
-      exprIn = call.getArgument(argInIndex)
-    )
-  )
-}
-
-private module FieldFlow {
-  private import DataFlowImplCommon
-  private import DataFlowImplLocal
-  private import DataFlowPrivate
-
-  /**
-   * A configuration for finding local-only flow through fields. This uses the
-   * `Configuration` class in the dedicated `DataFlowImplLocal` copy of the
-   * shared library that's not user-exposed directly.
-   *
-   * To keep the flow local to a single function, we put barriers on parameters
-   * and return statements. Sources and sinks are the values that go into and
-   * out of fields, respectively.
-   */
-  private class FieldConfiguration extends Configuration {
-    FieldConfiguration() { this = "FieldConfiguration" }
-
-    override predicate isSource(Node source) { storeStep(source, _, _) }
-
-    override predicate isSink(Node sink) { readStep(_, _, sink) }
-
-    override predicate isBarrier(Node node) { node instanceof ParameterNode }
-
-    override predicate isBarrierOut(Node node) {
-      node.asExpr().getParent() instanceof ReturnStmt
-      or
-      node.asExpr().getParent() instanceof ThrowExpr
-    }
-  }
-
-  predicate fieldFlow(Node node1, Node node2) {
-    exists(FieldConfiguration cfg | cfg.hasFlow(node1, node2)) and
-    // This configuration should not be able to cross function boundaries, but
-    // we double-check here just to be sure.
-    getNodeEnclosingCallable(node1) = getNodeEnclosingCallable(node2)
-  }
-}
-
-VariableAccess getAnAccessToAssignedVariable(Expr assign) {
-  (
-    assign instanceof Assignment
-    or
-    assign instanceof CrementOperation
-  ) and
-  exists(FlowVar var |
-    var.definedByExpr(_, assign) and
-    result = var.getAnAccess()
-  )
-}
-
-private newtype TContent =
-  TFieldContent(Field f) or
-  TCollectionContent() or
-  TArrayContent()
-
-/**
- * A description of the way data may be stored inside an object. Examples
- * include instance fields, the contents of a collection object, or the contents
- * of an array.
- */
-class Content extends TContent {
-  /** Gets a textual representation of this element. */
-  abstract string toString();
-
-  predicate hasLocationInfo(string path, int sl, int sc, int el, int ec) {
-    path = "" and sl = 0 and sc = 0 and el = 0 and ec = 0
-  }
-}
-
-/** A reference through an instance field. */
-class FieldContent extends Content, TFieldContent {
-  Field f;
-
-  FieldContent() { this = TFieldContent(f) }
-
-  Field getField() { result = f }
-
-  override string toString() { result = f.toString() }
-
-  override predicate hasLocationInfo(string path, int sl, int sc, int el, int ec) {
-    f.getLocation().hasLocationInfo(path, sl, sc, el, ec)
-  }
-}
-
-/** A reference through an array. */
-private class ArrayContent extends Content, TArrayContent {
-  override string toString() { result = "[]" }
-}
-
-/** A reference through the contents of some collection-like container. */
-private class CollectionContent extends Content, TCollectionContent {
-  override string toString() { result = "<element>" }
-}
-
-/**
- * A guard that validates some expression.
- *
- * To use this in a configuration, extend the class and provide a
- * characteristic predicate precisely specifying the guard, and override
- * `checks` to specify what is being validated and in which branch.
- *
- * It is important that all extending classes in scope are disjoint.
- */
-class BarrierGuard extends GuardCondition {
-  /** Override this predicate to hold if this guard validates `e` upon evaluating to `b`. */
-  abstract predicate checks(Expr e, boolean b);
-
-  /** Gets a node guarded by this guard. */
-  final ExprNode getAGuardedNode() {
-    exists(SsaDefinition def, Variable v, boolean branch |
-      result.getExpr() = def.getAUse(v) and
-      this.checks(def.getAUse(v), branch) and
-      this.controls(result.getExpr().getBasicBlock(), branch)
-    )
-  }
-}

cpp/ql/lib/semmle/code/cpp/dataflow/internal/TaintTrackingUtil.qll

@@ -1,279 +0,0 @@
-/**
- * Provides classes for performing local (intra-procedural) and
- * global (inter-procedural) taint-tracking analyses.
- *
- * We define _taint propagation_ informally to mean that a substantial part of
- * the information from the source is preserved at the sink. For example, taint
- * propagates from `x` to `x + 100`, but it does not propagate from `x` to `x >
- * 100` since we consider a single bit of information to be too little.
- */
-
-private import semmle.code.cpp.models.interfaces.DataFlow
-private import semmle.code.cpp.models.interfaces.Taint
-private import semmle.code.cpp.models.interfaces.Iterator
-private import semmle.code.cpp.models.interfaces.PointerWrapper
-
-private module DataFlow {
-  import semmle.code.cpp.dataflow.internal.DataFlowUtil
-}
-
-/**
- * Holds if taint propagates from `nodeFrom` to `nodeTo` in exactly one local
- * (intra-procedural) step.
- */
-predicate localTaintStep(DataFlow::Node src, DataFlow::Node sink) {
-  DataFlow::localFlowStep(src, sink) or
-  localAdditionalTaintStep(src, sink)
-}
-
-/**
- * Holds if the additional step from `src` to `sink` should be included in all
- * global taint flow configurations.
- */
-predicate defaultAdditionalTaintStep(DataFlow::Node src, DataFlow::Node sink) {
-  localAdditionalTaintStep(src, sink)
-}
-
-/**
- * Holds if default `TaintTracking::Configuration`s should allow implicit reads
- * of `c` at sinks and inputs to additional taint steps.
- */
-bindingset[node]
-predicate defaultImplicitTaintRead(DataFlow::Node node, DataFlow::Content c) { none() }
-
-/**
- * Holds if `node` should be a sanitizer in all global taint flow configurations
- * but not in local taint.
- */
-predicate defaultTaintSanitizer(DataFlow::Node node) { none() }
-
-/**
- * Holds if taint can flow in one local step from `nodeFrom` to `nodeTo` excluding
- * local data flow steps. That is, `nodeFrom` and `nodeTo` are likely to represent
- * different objects.
- */
-cached
-predicate localAdditionalTaintStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
-  // Taint can flow through expressions that alter the value but preserve
-  // more than one bit of it _or_ expressions that follow data through
-  // pointer indirections.
-  exists(Expr exprFrom, Expr exprTo |
-    exprFrom = nodeFrom.asExpr() and
-    exprTo = nodeTo.asExpr()
-  |
-    exprFrom = exprTo.getAChild() and
-    not noParentExprFlow(exprFrom, exprTo) and
-    not noFlowFromChildExpr(exprTo)
-    or
-    // Taint can flow from the `x` variable in `x++` to all subsequent
-    // accesses to the unmodified `x` variable.
-    //
-    // `DataFlow` without taint specifies flow from `++x` and `x += 1` into the
-    // variable `x` and thus into subsequent accesses because those expressions
-    // compute the same value as `x`. This is not the case for `x++`, which
-    // computes a different value, so we have to add that ourselves for taint
-    // tracking. The flow from expression `x` into `x++` etc. is handled in the
-    // case above.
-    exprTo = DataFlow::getAnAccessToAssignedVariable(exprFrom.(PostfixCrementOperation))
-    or
-    // In `for (char c : s) { ... c ... }`, this rule propagates taint from `s`
-    // to `c`.
-    exists(RangeBasedForStmt rbf |
-      exprFrom = rbf.getRange() and
-      // It's guaranteed up to at least C++20 that the range-based for loop
-      // desugars to a variable with an initializer.
-      exprTo = rbf.getVariable().getInitializer().getExpr()
-    )
-  )
-  or
-  // Taint can flow through modeled functions
-  exprToExprStep(nodeFrom.asExpr(), nodeTo.asExpr())
-  or
-  exprToDefinitionByReferenceStep(nodeFrom.asExpr(), nodeTo.asDefiningArgument())
-  or
-  exprToPartialDefinitionStep(nodeFrom.asExpr(), nodeTo.asPartialDefinition())
-  or
-  // Reverse taint: taint that flows from the post-update node of a reference
-  // returned by a function call, back into the qualifier of that function.
-  // This allows taint to flow 'in' through references returned by a modeled
-  // function such as `operator[]`.
-  exists(TaintFunction f, Call call, FunctionInput inModel, FunctionOutput outModel |
-    call.getTarget() = f and
-    inModel.isReturnValueDeref() and
-    nodeFrom.(DataFlow::PostUpdateNode).getPreUpdateNode().asExpr() = call and
-    f.hasTaintFlow(inModel, outModel) and
-    (
-      outModel.isQualifierObject() and
-      nodeTo.asDefiningArgument() = call.getQualifier()
-      or
-      exists(int argOutIndex |
-        outModel.isParameterDeref(argOutIndex) and
-        nodeTo.asDefiningArgument() = call.getArgument(argOutIndex)
-      )
-    )
-  )
-}
-
-/**
- * Holds if taint may propagate from `source` to `sink` in zero or more local
- * (intra-procedural) steps.
- */
-predicate localTaint(DataFlow::Node source, DataFlow::Node sink) { localTaintStep*(source, sink) }
-
-/**
- * Holds if taint can flow from `e1` to `e2` in zero or more
- * local (intra-procedural) steps.
- */
-predicate localExprTaint(Expr e1, Expr e2) {
-  localTaint(DataFlow::exprNode(e1), DataFlow::exprNode(e2))
-}
-
-/**
- * Holds if we do not propagate taint from `fromExpr` to `toExpr`
- * even though `toExpr` is the AST parent of `fromExpr`.
- */
-private predicate noParentExprFlow(Expr fromExpr, Expr toExpr) {
-  fromExpr = toExpr.(ConditionalExpr).getCondition()
-  or
-  fromExpr = toExpr.(CommaExpr).getLeftOperand()
-  or
-  fromExpr = toExpr.(AssignExpr).getLValue() // LHS of `=`
-}
-
-/**
- * Holds if we do not propagate taint from a child of `e` to `e` itself.
- */
-private predicate noFlowFromChildExpr(Expr e) {
-  e instanceof ComparisonOperation
-  or
-  e instanceof LogicalAndExpr
-  or
-  e instanceof LogicalOrExpr
-  or
-  // Allow taint from `operator*` on smart pointers.
-  exists(Call call | e = call |
-    not call.getTarget() = any(PointerWrapper wrapper).getAnUnwrapperFunction()
-  )
-  or
-  e instanceof SizeofOperator
-  or
-  e instanceof AlignofOperator
-  or
-  e instanceof ClassAggregateLiteral
-  or
-  e instanceof FieldAccess
-}
-
-private predicate exprToExprStep(Expr exprIn, Expr exprOut) {
-  exists(DataFlowFunction f, Call call, FunctionOutput outModel |
-    call.getTarget() = f and
-    exprOut = call and
-    outModel.isReturnValueDeref() and
-    exists(int argInIndex, FunctionInput inModel | f.hasDataFlow(inModel, outModel) |
-      // Taint flows from a pointer to a dereference, which DataFlow does not handle
-      // dest_ptr = strdup(tainted_ptr)
-      inModel.isParameterDeref(argInIndex) and
-      exprIn = call.getArgument(argInIndex)
-      or
-      inModel.isParameter(argInIndex) and
-      exprIn = call.getArgument(argInIndex)
-    )
-  )
-  or
-  exists(TaintFunction f, Call call, FunctionInput inModel, FunctionOutput outModel |
-    call.getTarget() = f and
-    (
-      exprOut = call and
-      outModel.isReturnValueDeref()
-      or
-      exprOut = call and
-      outModel.isReturnValue()
-    ) and
-    f.hasTaintFlow(inModel, outModel) and
-    (
-      exists(int argInIndex |
-        inModel.isParameterDeref(argInIndex) and
-        exprIn = call.getArgument(argInIndex)
-        or
-        inModel.isParameterDeref(argInIndex) and
-        call.passesByReference(argInIndex, exprIn)
-        or
-        inModel.isParameter(argInIndex) and
-        exprIn = call.getArgument(argInIndex)
-      )
-      or
-      inModel.isQualifierObject() and
-      exprIn = call.getQualifier()
-    )
-  )
-}
-
-private predicate exprToDefinitionByReferenceStep(Expr exprIn, Expr argOut) {
-  exists(DataFlowFunction f, Call call, FunctionOutput outModel, int argOutIndex |
-    call.getTarget() = f and
-    argOut = call.getArgument(argOutIndex) and
-    outModel.isParameterDeref(argOutIndex) and
-    exists(int argInIndex, FunctionInput inModel | f.hasDataFlow(inModel, outModel) |
-      // Taint flows from a pointer to a dereference, which DataFlow does not handle
-      // memcpy(&dest_var, tainted_ptr, len)
-      inModel.isParameterDeref(argInIndex) and
-      exprIn = call.getArgument(argInIndex)
-      or
-      inModel.isParameter(argInIndex) and
-      exprIn = call.getArgument(argInIndex)
-    )
-  )
-  or
-  exists(
-    TaintFunction f, Call call, FunctionInput inModel, FunctionOutput outModel, int argOutIndex
-  |
-    call.getTarget() = f and
-    argOut = call.getArgument(argOutIndex) and
-    outModel.isParameterDeref(argOutIndex) and
-    f.hasTaintFlow(inModel, outModel) and
-    (
-      exists(int argInIndex |
-        inModel.isParameterDeref(argInIndex) and
-        exprIn = call.getArgument(argInIndex)
-        or
-        inModel.isParameterDeref(argInIndex) and
-        call.passesByReference(argInIndex, exprIn)
-        or
-        inModel.isParameter(argInIndex) and
-        exprIn = call.getArgument(argInIndex)
-      )
-      or
-      inModel.isQualifierObject() and
-      exprIn = call.getQualifier()
-    )
-  )
-}
-
-private predicate exprToPartialDefinitionStep(Expr exprIn, Expr exprOut) {
-  exists(TaintFunction f, Call call, FunctionInput inModel, FunctionOutput outModel |
-    call.getTarget() = f and
-    (
-      exprOut = call.getQualifier() and
-      outModel.isQualifierObject()
-    ) and
-    f.hasTaintFlow(inModel, outModel) and
-    exists(int argInIndex |
-      inModel.isParameterDeref(argInIndex) and
-      exprIn = call.getArgument(argInIndex)
-      or
-      inModel.isParameterDeref(argInIndex) and
-      call.passesByReference(argInIndex, exprIn)
-      or
-      inModel.isParameter(argInIndex) and
-      exprIn = call.getArgument(argInIndex)
-    )
-  )
-  or
-  exists(Assignment a |
-    iteratorDereference(exprOut) and
-    a.getLValue() = exprOut and
-    a.getRValue() = exprIn
-  )
-}
-
-private predicate iteratorDereference(Call c) { c.getTarget() instanceof IteratorReferenceFunction }

cpp/ql/lib/semmle/code/cpp/dataflow/internal/tainttracking1/TaintTrackingImpl.qll

@@ -1,120 +0,0 @@
-/**
- * Provides an implementation of global (interprocedural) taint tracking.
- * This file re-exports the local (intraprocedural) taint-tracking analysis
- * from `TaintTrackingParameter::Public` and adds a global analysis, mainly
- * exposed through the `Configuration` class. For some languages, this file
- * exists in several identical copies, allowing queries to use multiple
- * `Configuration` classes that depend on each other without introducing
- * mutual recursion among those configurations.
- */
-
-import TaintTrackingParameter::Public
-private import TaintTrackingParameter::Private
-
-/**
- * A configuration of interprocedural taint tracking analysis. This defines
- * sources, sinks, and any other configurable aspect of the analysis. Each
- * use of the taint tracking library must define its own unique extension of
- * this abstract class.
- *
- * A taint-tracking configuration is a special data flow configuration
- * (`DataFlow::Configuration`) that allows for flow through nodes that do not
- * necessarily preserve values but are still relevant from a taint tracking
- * perspective. (For example, string concatenation, where one of the operands
- * is tainted.)
- *
- * To create a configuration, extend this class with a subclass whose
- * characteristic predicate is a unique singleton string. For example, write
- *
- * ```ql
- * class MyAnalysisConfiguration extends TaintTracking::Configuration {
- *   MyAnalysisConfiguration() { this = "MyAnalysisConfiguration" }
- *   // Override `isSource` and `isSink`.
- *   // Optionally override `isSanitizer`.
- *   // Optionally override `isSanitizerIn`.
- *   // Optionally override `isSanitizerOut`.
- *   // Optionally override `isSanitizerGuard`.
- *   // Optionally override `isAdditionalTaintStep`.
- * }
- * ```
- *
- * Then, to query whether there is flow between some `source` and `sink`,
- * write
- *
- * ```ql
- * exists(MyAnalysisConfiguration cfg | cfg.hasFlow(source, sink))
- * ```
- *
- * Multiple configurations can coexist, but it is unsupported to depend on
- * another `TaintTracking::Configuration` or a `DataFlow::Configuration` in the
- * overridden predicates that define sources, sinks, or additional steps.
- * Instead, the dependency should go to a `TaintTracking2::Configuration` or a
- * `DataFlow2::Configuration`, `DataFlow3::Configuration`, etc.
- */
-abstract class Configuration extends DataFlow::Configuration {
-  bindingset[this]
-  Configuration() { any() }
-
-  /**
-   * Holds if `source` is a relevant taint source.
-   *
-   * The smaller this predicate is, the faster `hasFlow()` will converge.
-   */
-  // overridden to provide taint-tracking specific qldoc
-  abstract override predicate isSource(DataFlow::Node source);
-
-  /**
-   * Holds if `sink` is a relevant taint sink.
-   *
-   * The smaller this predicate is, the faster `hasFlow()` will converge.
-   */
-  // overridden to provide taint-tracking specific qldoc
-  abstract override predicate isSink(DataFlow::Node sink);
-
-  /** Holds if the node `node` is a taint sanitizer. */
-  predicate isSanitizer(DataFlow::Node node) { none() }
-
-  final override predicate isBarrier(DataFlow::Node node) {
-    isSanitizer(node) or
-    defaultTaintSanitizer(node)
-  }
-
-  /** Holds if taint propagation into `node` is prohibited. */
-  predicate isSanitizerIn(DataFlow::Node node) { none() }
-
-  final override predicate isBarrierIn(DataFlow::Node node) { isSanitizerIn(node) }
-
-  /** Holds if taint propagation out of `node` is prohibited. */
-  predicate isSanitizerOut(DataFlow::Node node) { none() }
-
-  final override predicate isBarrierOut(DataFlow::Node node) { isSanitizerOut(node) }
-
-  /** Holds if taint propagation through nodes guarded by `guard` is prohibited. */
-  predicate isSanitizerGuard(DataFlow::BarrierGuard guard) { none() }
-
-  final override predicate isBarrierGuard(DataFlow::BarrierGuard guard) { isSanitizerGuard(guard) }
-
-  /**
-   * Holds if the additional taint propagation step from `node1` to `node2`
-   * must be taken into account in the analysis.
-   */
-  predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) { none() }
-
-  final override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
-    isAdditionalTaintStep(node1, node2) or
-    defaultAdditionalTaintStep(node1, node2)
-  }
-
-  override predicate allowImplicitRead(DataFlow::Node node, DataFlow::Content c) {
-    (this.isSink(node) or this.isAdditionalTaintStep(node, _)) and
-    defaultImplicitTaintRead(node, c)
-  }
-
-  /**
-   * Holds if taint may flow from `source` to `sink` for this configuration.
-   */
-  // overridden to provide taint-tracking specific qldoc
-  override predicate hasFlow(DataFlow::Node source, DataFlow::Node sink) {
-    super.hasFlow(source, sink)
-  }
-}

cpp/ql/lib/semmle/code/cpp/dataflow/internal/tainttracking2/TaintTrackingImpl.qll

@@ -1,120 +0,0 @@
-/**
- * Provides an implementation of global (interprocedural) taint tracking.
- * This file re-exports the local (intraprocedural) taint-tracking analysis
- * from `TaintTrackingParameter::Public` and adds a global analysis, mainly
- * exposed through the `Configuration` class. For some languages, this file
- * exists in several identical copies, allowing queries to use multiple
- * `Configuration` classes that depend on each other without introducing
- * mutual recursion among those configurations.
- */
-
-import TaintTrackingParameter::Public
-private import TaintTrackingParameter::Private
-
-/**
- * A configuration of interprocedural taint tracking analysis. This defines
- * sources, sinks, and any other configurable aspect of the analysis. Each
- * use of the taint tracking library must define its own unique extension of
- * this abstract class.
- *
- * A taint-tracking configuration is a special data flow configuration
- * (`DataFlow::Configuration`) that allows for flow through nodes that do not
- * necessarily preserve values but are still relevant from a taint tracking
- * perspective. (For example, string concatenation, where one of the operands
- * is tainted.)
- *
- * To create a configuration, extend this class with a subclass whose
- * characteristic predicate is a unique singleton string. For example, write
- *
- * ```ql
- * class MyAnalysisConfiguration extends TaintTracking::Configuration {
- *   MyAnalysisConfiguration() { this = "MyAnalysisConfiguration" }
- *   // Override `isSource` and `isSink`.
- *   // Optionally override `isSanitizer`.
- *   // Optionally override `isSanitizerIn`.
- *   // Optionally override `isSanitizerOut`.
- *   // Optionally override `isSanitizerGuard`.
- *   // Optionally override `isAdditionalTaintStep`.
- * }
- * ```
- *
- * Then, to query whether there is flow between some `source` and `sink`,
- * write
- *
- * ```ql
- * exists(MyAnalysisConfiguration cfg | cfg.hasFlow(source, sink))
- * ```
- *
- * Multiple configurations can coexist, but it is unsupported to depend on
- * another `TaintTracking::Configuration` or a `DataFlow::Configuration` in the
- * overridden predicates that define sources, sinks, or additional steps.
- * Instead, the dependency should go to a `TaintTracking2::Configuration` or a
- * `DataFlow2::Configuration`, `DataFlow3::Configuration`, etc.
- */
-abstract class Configuration extends DataFlow::Configuration {
-  bindingset[this]
-  Configuration() { any() }
-
-  /**
-   * Holds if `source` is a relevant taint source.
-   *
-   * The smaller this predicate is, the faster `hasFlow()` will converge.
-   */
-  // overridden to provide taint-tracking specific qldoc
-  abstract override predicate isSource(DataFlow::Node source);
-
-  /**
-   * Holds if `sink` is a relevant taint sink.
-   *
-   * The smaller this predicate is, the faster `hasFlow()` will converge.
-   */
-  // overridden to provide taint-tracking specific qldoc
-  abstract override predicate isSink(DataFlow::Node sink);
-
-  /** Holds if the node `node` is a taint sanitizer. */
-  predicate isSanitizer(DataFlow::Node node) { none() }
-
-  final override predicate isBarrier(DataFlow::Node node) {
-    isSanitizer(node) or
-    defaultTaintSanitizer(node)
-  }
-
-  /** Holds if taint propagation into `node` is prohibited. */
-  predicate isSanitizerIn(DataFlow::Node node) { none() }
-
-  final override predicate isBarrierIn(DataFlow::Node node) { isSanitizerIn(node) }
-
-  /** Holds if taint propagation out of `node` is prohibited. */
-  predicate isSanitizerOut(DataFlow::Node node) { none() }
-
-  final override predicate isBarrierOut(DataFlow::Node node) { isSanitizerOut(node) }
-
-  /** Holds if taint propagation through nodes guarded by `guard` is prohibited. */
-  predicate isSanitizerGuard(DataFlow::BarrierGuard guard) { none() }
-
-  final override predicate isBarrierGuard(DataFlow::BarrierGuard guard) { isSanitizerGuard(guard) }
-
-  /**
-   * Holds if the additional taint propagation step from `node1` to `node2`
-   * must be taken into account in the analysis.
-   */
-  predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) { none() }
-
-  final override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
-    isAdditionalTaintStep(node1, node2) or
-    defaultAdditionalTaintStep(node1, node2)
-  }
-
-  override predicate allowImplicitRead(DataFlow::Node node, DataFlow::Content c) {
-    (this.isSink(node) or this.isAdditionalTaintStep(node, _)) and
-    defaultImplicitTaintRead(node, c)
-  }
-
-  /**
-   * Holds if taint may flow from `source` to `sink` for this configuration.
-   */
-  // overridden to provide taint-tracking specific qldoc
-  override predicate hasFlow(DataFlow::Node source, DataFlow::Node sink) {
-    super.hasFlow(source, sink)
-  }
-}

cpp/ql/lib/semmle/code/cpp/exprs/Call.qll

@@ -1,665 +0,0 @@
-/**
- * Provides classes for modeling call expressions including direct calls to
- * functions, constructor and destructor calls, and calls made through function
- * pointers.
- */
-
-import semmle.code.cpp.exprs.Expr
-import semmle.code.cpp.Function
-private import semmle.code.cpp.dataflow.EscapesTree
-
-private class TCall = @funbindexpr or @callexpr;
-
-/**
- * A C/C++ call.
- */
-class Call extends Expr, NameQualifiableElement, TCall {
-  // `@funbindexpr` (which is the dbscheme type for FunctionCall) is a union type that includes
-  // `@routineexpr. This dbscheme type includes accesses to functions that are not necessarily calls to
-  // that function. That's why the charpred for `FunctionCall` requires:
-  // ```
-  // iscall(underlyingElement(this), _)
-  // ```
-  // So for the charpred for `Call` we include the requirement that if this is an instance of
-  // `@funbindexpr` it must be a _call_ to the function.
-  Call() { this instanceof @callexpr or iscall(underlyingElement(this), _) }
-
-  /**
-   * Gets the number of arguments (actual parameters) of this call. The count
-   * does _not_ include the qualifier of the call, if any.
-   */
-  int getNumberOfArguments() { result = count(this.getAnArgument()) }
-
-  /**
-   * Holds if this call has a qualifier.
-   *
-   * For example, `ptr->f()` has a qualifier, whereas plain `f()` does not.
-   */
-  predicate hasQualifier() { exists(Expr e | this.getChild(-1) = e) }
-
-  /**
-   * Gets the expression to the left of the function name or function pointer variable name.
-   *
-   * As a few examples:
-   *  For the call to `f` in `ptr->f()`, this gives `ptr`.
-   *  For the call to `f` in `(*ptr).f()`, this gives `(*ptr)`.
-   */
-  Expr getQualifier() { result = this.getChild(-1) }
-
-  /**
-   * Gets an argument for this call. To get the qualifier of this call, if
-   * any, use `getQualifier()`.
-   */
-  Expr getAnArgument() { exists(int i | result = this.getChild(i) and i >= 0) }
-
-  /**
-   * Gets the nth argument for this call.
-   *
-   * The range of `n` is from `0` to `getNumberOfArguments() - 1`. To get the
-   * qualifier of this call, if any, use `getQualifier()`.
-   */
-  Expr getArgument(int n) { result = this.getChild(n) and n >= 0 }
-
-  /**
-   * Gets a subexpression of the argument at position `index`. If the
-   * argument itself contains calls, such calls will be considered
-   * leaves in the expression tree. The qualifier of the call, if any, is not
-   * considered to be an argument.
-   *
-   * Example: the call `f(2, 3 + 4, g(4 + 5))` has sub expression(s)
-   * `2` at index 0; `3`, `4`, and `3 + 4` at index 1; and `g(4 + 5)`
-   * at index 2, respectively.
-   */
-  Expr getAnArgumentSubExpr(int index) {
-    result = getArgument(index)
-    or
-    exists(Expr mid |
-      mid = getAnArgumentSubExpr(index) and
-      not mid instanceof Call and
-      not mid instanceof SizeofOperator and
-      result = mid.getAChild()
-    )
-  }
-
-  /**
-   * Gets the target of the call, as best as makes sense for this kind of call.
-   * The precise meaning depends on the kind of call it is:
-   * - For a call to a function, it's the function being called.
-   * - For a C++ method call, it's the statically resolved method.
-   * - For an Objective C message expression, it's the statically resolved
-   *   method, and it might not exist.
-   * - For a variable call, it never exists.
-   */
-  Function getTarget() { none() } // overridden in subclasses
-
-  override int getPrecedence() { result = 17 }
-
-  override string toString() { none() }
-
-  /**
-   * Holds if this call passes the variable accessed by `va` by
-   * reference as the `i`th argument. The qualifier of a call to a member
-   * function is `i = -1`.
-   *
-   * A variable is passed by reference if the `i`th parameter of the function
-   * receives an address that points within the object denoted by `va`. For a
-   * variable named `x`, passing by reference includes both explicit pointers
-   * (`&x`) and implicit conversion to a C++ reference (`x`), but it also
-   * includes deeper expressions such as `&x[0] + length` or `&*&*&x`.
-   *
-   * When `Field`s are involved, an argument `i` may pass more than one
-   * variable by reference simultaneously. For example, the call `f(&x.m1.m2)`
-   * counts as passing both `x`, `m1` and `m2` to argument 0 of `f`.
-   *
-   * This predicate holds for variables passed by reference even if they are
-   * passed as references to `const` and thus cannot be changed through that
-   * reference. See `passesByNonConstReference` for a predicate that only holds
-   * for variables passed by reference to non-const.
-   */
-  predicate passesByReference(int i, VariableAccess va) {
-    variableAddressEscapesTree(va, this.getArgument(i).getFullyConverted())
-    or
-    variableAddressEscapesTree(va, this.getQualifier().getFullyConverted()) and
-    i = -1
-  }
-
-  /**
-   * Holds if this call passes the variable accessed by `va` by
-   * reference to non-const data as the `i`th argument. The qualifier of a
-   * call to a member function is `i = -1`.
-   *
-   * A variable is passed by reference if the `i`th parameter of the function
-   * receives an address that points within the object denoted by `va`. For a
-   * variable named `x`, passing by reference includes both explicit pointers
-   * (`&x`) and implicit conversion to a C++ reference (`x`), but it also
-   * includes deeper expressions such as `&x[0] + length` or `&*&*&x`.
-   *
-   * When `Field`s are involved, an argument `i` may pass more than one
-   * variable by reference simultaneously. For example, the call `f(&x.m1.m2)`
-   * counts as passing both `x`, `m1` and `m2` to argument 0 of `f`.
-   *
-   * This predicate only holds for variables passed by reference to non-const
-   * data and thus can be changed through that reference. See
-   * `passesByReference` for a predicate that also holds for variables passed
-   * by reference to const.
-   */
-  predicate passesByReferenceNonConst(int i, VariableAccess va) {
-    variableAddressEscapesTreeNonConst(va, this.getArgument(i).getFullyConverted())
-    or
-    variableAddressEscapesTreeNonConst(va, this.getQualifier().getFullyConverted()) and
-    i = -1
-  }
-}
-
-/**
- * A C/C++ function call where the name of the target function is known at compile-time.
- *
- * This includes various kinds of call:
- *  1. Calls such as `f(x)` where `f` is the name of a function.
- *  2. Calls such as `ptr->f()` where `f` is the name of a (possibly virtual) member function.
- *  3. Constructor calls for stack-allocated objects.
- *  4. Implicit and explicit calls to user-defined operators.
- *  5. Base class initializers in constructors.
- */
-class FunctionCall extends Call, @funbindexpr {
-  FunctionCall() { iscall(underlyingElement(this), _) }
-
-  override string getAPrimaryQlClass() { result = "FunctionCall" }
-
-  /** Gets an explicit template argument for this call. */
-  Locatable getAnExplicitTemplateArgument() { result = getExplicitTemplateArgument(_) }
-
-  /** Gets an explicit template argument value for this call. */
-  Locatable getAnExplicitTemplateArgumentKind() { result = getExplicitTemplateArgumentKind(_) }
-
-  /** Gets a template argument for this call. */
-  Locatable getATemplateArgument() { result = getTarget().getATemplateArgument() }
-
-  /** Gets a template argument value for this call. */
-  Locatable getATemplateArgumentKind() { result = getTarget().getATemplateArgumentKind() }
-
-  /** Gets the nth explicit template argument for this call. */
-  Locatable getExplicitTemplateArgument(int n) {
-    n < getNumberOfExplicitTemplateArguments() and
-    result = getTemplateArgument(n)
-  }
-
-  /** Gets the nth explicit template argument value for this call. */
-  Locatable getExplicitTemplateArgumentKind(int n) {
-    n < getNumberOfExplicitTemplateArguments() and
-    result = getTemplateArgumentKind(n)
-  }
-
-  /** Gets the number of explicit template arguments for this call. */
-  int getNumberOfExplicitTemplateArguments() {
-    if numtemplatearguments(underlyingElement(this), _)
-    then numtemplatearguments(underlyingElement(this), result)
-    else result = 0
-  }
-
-  /** Gets the number of template arguments for this call. */
-  int getNumberOfTemplateArguments() { result = count(int i | exists(getTemplateArgument(i))) }
-
-  /** Gets the nth template argument for this call (indexed from 0). */
-  Locatable getTemplateArgument(int n) { result = getTarget().getTemplateArgument(n) }
-
-  /** Gets the nth template argument value for this call (indexed from 0). */
-  Locatable getTemplateArgumentKind(int n) { result = getTarget().getTemplateArgumentKind(n) }
-
-  /** Holds if any template arguments for this call are implicit / deduced. */
-  predicate hasImplicitTemplateArguments() {
-    exists(int i |
-      exists(getTemplateArgument(i)) and
-      not exists(getExplicitTemplateArgument(i))
-    )
-  }
-
-  /** Holds if a template argument list was provided for this call. */
-  predicate hasTemplateArgumentList() { numtemplatearguments(underlyingElement(this), _) }
-
-  /**
-   * Gets the `RoutineType` of the call target as visible at the call site.  For
-   * constructor calls, this predicate instead gets the `Class` of the constructor
-   * being called.
-   */
-  Type getTargetType() { result = Call.super.getType().stripType() }
-
-  /**
-   * Gets the expected return type of the function called by this call.
-   *
-   * In most cases, the expected return type will be the return type of the function being called.
-   * It is only different when the function being called is ambiguously declared, at which point
-   * the expected return type is the return type of the (unambiguous) function declaration that was
-   * visible at the call site.
-   */
-  Type getExpectedReturnType() {
-    if getTargetType() instanceof RoutineType
-    then result = getTargetType().(RoutineType).getReturnType()
-    else result = getTarget().getType()
-  }
-
-  /**
-   * Gets the expected type of the nth parameter of the function called by this call.
-   *
-   * In most cases, the expected parameter types match the parameter types of the function being called.
-   * They are only different when the function being called is ambiguously declared, at which point
-   * the expected parameter types are the parameter types of the (unambiguous) function declaration that
-   * was visible at the call site.
-   */
-  Type getExpectedParameterType(int n) {
-    if getTargetType() instanceof RoutineType
-    then result = getTargetType().(RoutineType).getParameterType(n)
-    else result = getTarget().getParameter(n).getType()
-  }
-
-  /**
-   * Gets the function called by this call.
-   *
-   * In the case of virtual function calls, the result is the most-specific function in the override tree (as
-   * determined by the compiler) such that the target at runtime will be one of `result.getAnOverridingFunction*()`.
-   */
-  override Function getTarget() { funbind(underlyingElement(this), unresolveElement(result)) }
-
-  /**
-   * Gets the type of this expression, that is, the return type of the function being called.
-   */
-  override Type getType() { result = getExpectedReturnType() }
-
-  /**
-   * Holds if this is a call to a virtual function.
-   *
-   * Note that this holds even in cases where a sufficiently clever compiler could perform static dispatch.
-   */
-  predicate isVirtual() { iscall(underlyingElement(this), 1) }
-
-  /**
-   * Holds if the target of this function call was found by argument-dependent lookup and wouldn't have been
-   * found by any other means.
-   */
-  predicate isOnlyFoundByADL() { iscall(underlyingElement(this), 2) }
-
-  /** Gets a textual representation of this function call. */
-  override string toString() {
-    if exists(getTarget())
-    then result = "call to " + this.getTarget().getName()
-    else result = "call to unknown function"
-  }
-
-  override predicate mayBeImpure() {
-    this.getChild(_).mayBeImpure() or
-    this.getTarget().mayHaveSideEffects() or
-    isVirtual() or
-    getTarget().getAnAttribute().getName() = "weak"
-  }
-
-  override predicate mayBeGloballyImpure() {
-    this.getChild(_).mayBeGloballyImpure() or
-    this.getTarget().mayHaveSideEffects() or
-    isVirtual() or
-    getTarget().getAnAttribute().getName() = "weak"
-  }
-}
-
-/** A _user-defined_ unary `operator*` function. */
-class OverloadedPointerDereferenceFunction extends Function {
-  OverloadedPointerDereferenceFunction() {
-    this.hasName("operator*") and
-    this.getEffectiveNumberOfParameters() = 1
-  }
-}
-
-/**
- * An instance of a _user-defined_ unary `operator*` applied to its argument.
- * ```
- * T1 operator*(const T2 &);
- * T1 a; T2 b;
- * a = *b;
- * ```
- */
-class OverloadedPointerDereferenceExpr extends FunctionCall {
-  OverloadedPointerDereferenceExpr() {
-    this.getTarget() instanceof OverloadedPointerDereferenceFunction
-  }
-
-  override string getAPrimaryQlClass() { result = "OverloadedPointerDereferenceExpr" }
-
-  /**
-   * Gets the expression this operator * applies to.
-   */
-  Expr getExpr() {
-    result = this.getChild(0) or
-    result = this.getQualifier()
-  }
-
-  override predicate mayBeImpure() {
-    FunctionCall.super.mayBeImpure() and
-    (
-      this.getExpr().mayBeImpure()
-      or
-      not exists(Class declaring |
-        this.getTarget().getDeclaringType().isConstructedFrom*(declaring)
-      |
-        declaring.getNamespace() instanceof StdNamespace
-      )
-    )
-  }
-
-  override predicate mayBeGloballyImpure() {
-    FunctionCall.super.mayBeGloballyImpure() and
-    (
-      this.getExpr().mayBeGloballyImpure()
-      or
-      not exists(Class declaring |
-        this.getTarget().getDeclaringType().isConstructedFrom*(declaring)
-      |
-        declaring.getNamespace() instanceof StdNamespace
-      )
-    )
-  }
-}
-
-/**
- * An instance of a _user-defined_ binary `operator[]` applied to its arguments.
- * ```
- * struct T2 { T1 operator[](const T3 &); };
- * T1 a; T2 b; T3 c;
- * a = b[c];
- * ```
- */
-class OverloadedArrayExpr extends FunctionCall {
-  OverloadedArrayExpr() { getTarget().hasName("operator[]") }
-
-  override string getAPrimaryQlClass() { result = "OverloadedArrayExpr" }
-
-  /**
-   * Gets the expression being subscripted.
-   */
-  Expr getArrayBase() {
-    if exists(this.getQualifier()) then result = this.getQualifier() else result = this.getChild(0)
-  }
-
-  /**
-   * Gets the expression giving the index.
-   */
-  Expr getArrayOffset() {
-    if exists(this.getQualifier()) then result = this.getChild(0) else result = this.getChild(1)
-  }
-}
-
-/**
- * A C/C++ call which is performed through a function pointer.
- *
- * In the call below, `(*funcptr)` may be simplified to just `funcptr`.
- * ```
- * extern int (*funcptr)(int a, int b);
- * int c = (*funcptr)(1, 2);
- * ```
- */
-class ExprCall extends Call, @callexpr {
-  /**
-   * Gets the expression which yields the function pointer to call.
-   */
-  Expr getExpr() { result = this.getChild(0) }
-
-  override string getAPrimaryQlClass() { result = "ExprCall" }
-
-  override Expr getAnArgument() { exists(int i | result = this.getChild(i) and i >= 1) }
-
-  override Expr getArgument(int index) {
-    result = this.getChild(index + 1) and index in [0 .. this.getNumChild() - 2]
-  }
-
-  override string toString() { result = "call to expression" }
-
-  override Function getTarget() { none() }
-}
-
-/**
- * A C/C++ call which is performed through a variable of function pointer type.
- * ```
- * int call_via_ptr(int (*pfn)(int)) {
- *   return pfn(5);
- * }
- * ```
- */
-class VariableCall extends ExprCall {
-  VariableCall() { this.getExpr() instanceof VariableAccess }
-
-  override string getAPrimaryQlClass() { result = "VariableCall" }
-
-  /**
-   * Gets the variable which yields the function pointer to call.
-   */
-  Variable getVariable() { this.getExpr().(VariableAccess).getTarget() = result }
-}
-
-/**
- * A call to a constructor.
- * ```
- * struct S { S(void) {} };
- * S s;
- * ```
- */
-class ConstructorCall extends FunctionCall {
-  ConstructorCall() { super.getTarget() instanceof Constructor }
-
-  override string getAPrimaryQlClass() { result = "ConstructorCall" }
-
-  /** Gets the constructor being called. */
-  override Constructor getTarget() { result = super.getTarget() }
-}
-
-/**
- * A call to a destructor.
- * ```
- * struct S { ~S(void) {} } *s;
- * s->~S();
- * ```
- */
-class DestructorCall extends FunctionCall {
-  DestructorCall() { super.getTarget() instanceof Destructor }
-
-  override string getAPrimaryQlClass() { result = "DestructorCall" }
-
-  /** Gets the destructor being called. */
-  override Destructor getTarget() { result = super.getTarget() }
-}
-
-/**
- * An expression that looks like a destructor call, but has no effect.
- *
- * For example, given a plain old data type `pod_t`, the syntax `ptr->~pod_t()` is
- * a vacuous destructor call, as `~pod_t` isn't actually a function. This can also
- * occur in instantiated templates, as `ptr->~T()` becomes vacuous when `T` is `int`.
- * ```
- * typedef int pod_t;
- * pod_t *s;
- * s->~pod_t();
- * ```
- */
-class VacuousDestructorCall extends Expr, @vacuous_destructor_call {
-  /**
-   * Gets the expression for the object whose destructor would be called.
-   */
-  Expr getQualifier() { result = this.getChild(0) }
-
-  override string getAPrimaryQlClass() { result = "VacuousDestructorCall" }
-
-  override string toString() { result = "(vacuous destructor call)" }
-}
-
-/**
- * An initialization of a base class or member variable performed as part
- * of a constructor's explicit initializer list or implicit actions.
- *
- * This is a QL root class for reprenting various types of constructor
- * initializations.
- */
-class ConstructorInit extends Expr, @ctorinit {
-  override string getAPrimaryQlClass() { result = "ConstructorInit" }
-}
-
-/**
- * A call to a constructor of a base class as part of a constructor's
- * initializer list or compiler-generated actions.
- */
-class ConstructorBaseInit extends ConstructorInit, ConstructorCall {
-  override string getAPrimaryQlClass() { result = "ConstructorBaseInit" }
-}
-
-/**
- * A call to a constructor of a direct non-virtual base class as part of a
- * constructor's initializer list or compiler-generated actions.
- * ```
- * struct S {
- *   int a;
- *   S(int b): a(b) {}
- * };
- * struct T: S {
- *   T(): S(33) {}  // S(33) is a constructor call
- * };
- * ```
- */
-class ConstructorDirectInit extends ConstructorBaseInit, @ctordirectinit {
-  override string getAPrimaryQlClass() { result = "ConstructorDirectInit" }
-}
-
-/**
- * A call to a constructor of a virtual base class as part of a
- * constructor's initializer list or compiler-generated actions.
- *
- * If the virtual base class has already been initialized, then this
- * call won't be performed.
- * ```
- * struct S {
- *   int a;
- *   S(int b): a(b) {}
- * };
- * struct T: virtual S {
- *   T(): S(33) {}  // S(33) is a call to a virtual base constructor
- * };
- * ```
- */
-class ConstructorVirtualInit extends ConstructorBaseInit, @ctorvirtualinit {
-  override string getAPrimaryQlClass() { result = "ConstructorVirtualInit" }
-}
-
-/**
- * A call to a constructor of the same class as part of a constructor's
- * initializer list, which delegates object construction (C++11 only).
- * ```
- * struct S {
- *  int a;
- *  S(int b): a(b) { }
- *  S(): S(0) { } // delegation to another constructor
- * };
- * ```
- */
-class ConstructorDelegationInit extends ConstructorBaseInit, @ctordelegatinginit {
-  override string getAPrimaryQlClass() { result = "ConstructorDelegationInit" }
-}
-
-/**
- * An initialization of a member variable performed as part of a
- * constructor's explicit initializer list or implicit actions.
- * In the example below, member variable `b` is being initialized by
- * constructor parameter `a`:
- * ```
- * struct S {
- *   int b;
- *   S(int a): b(a) {}
- * } s(2);
- * ```
- */
-class ConstructorFieldInit extends ConstructorInit, @ctorfieldinit {
-  /** Gets the field being initialized. */
-  Field getTarget() { varbind(underlyingElement(this), unresolveElement(result)) }
-
-  override string getAPrimaryQlClass() { result = "ConstructorFieldInit" }
-
-  /**
-   * Gets the expression to which the field is initialized.
-   *
-   * This is typically either a Literal or a FunctionCall to a
-   * constructor, but more complex expressions can also occur.
-   */
-  Expr getExpr() { result = this.getChild(0) }
-
-  override string toString() { result = "constructor init of field " + getTarget().getName() }
-
-  override predicate mayBeImpure() { this.getExpr().mayBeImpure() }
-
-  override predicate mayBeGloballyImpure() { this.getExpr().mayBeGloballyImpure() }
-}
-
-/**
- * A call to a destructor of a base class or field as part of a destructor's
- * compiler-generated actions.
- */
-class DestructorDestruction extends Expr, @dtordestruct {
-  override string getAPrimaryQlClass() { result = "DestructorDestruction" }
-}
-
-/**
- * A call to a destructor of a base class as part of a destructor's
- * compiler-generated actions.
- */
-class DestructorBaseDestruction extends DestructorCall, DestructorDestruction {
-  override string getAPrimaryQlClass() { result = "DestructorBaseDestruction" }
-}
-
-/**
- * A call to a destructor of a direct non-virtual base class as part of a
- * destructor's compiler-generated actions.
- * ```
- * struct S {  ~S(void) {} };
- * struct T: S {
- *   ~T(void) {} // will call ~S()
- * };
- * ```
- */
-class DestructorDirectDestruction extends DestructorBaseDestruction, @dtordirectdestruct {
-  override string getAPrimaryQlClass() { result = "DestructorDirectDestruction" }
-}
-
-/**
- * A call to a destructor of a direct virtual base class as part of a
- * destructor's compiler-generated actions.
- *
- * If the virtual base class wasn't initialized by the ConstructorVirtualInit
- * in the corresponding constructor, then this call won't be performed.
- * ```
- * struct S {  ~S(void) {} };
- * struct T: virtual S {
- *   ~T(void) {} // will call ~S()
- * };
- * ```
- */
-class DestructorVirtualDestruction extends DestructorBaseDestruction, @dtorvirtualdestruct {
-  override string getAPrimaryQlClass() { result = "DestructorVirtualDestruction" }
-}
-
-/**
- * A destruction of a member variable performed as part of a
- * destructor's compiler-generated actions.
- * ```
- * struct S {  ~S(void) {} };
- * struct T {
- *   S s;
- *   ~T(void) {}  // will call s.~S()
- * };
- * ```
- */
-class DestructorFieldDestruction extends DestructorDestruction, @dtorfielddestruct {
-  /** Gets the field being destructed. */
-  Field getTarget() { varbind(underlyingElement(this), unresolveElement(result)) }
-
-  override string getAPrimaryQlClass() { result = "DestructorFieldDestruction" }
-
-  /** Gets the compiler-generated call to the variable's destructor. */
-  DestructorCall getExpr() { result = this.getChild(0) }
-
-  override string toString() {
-    result = "destructor field destruction of " + this.getTarget().getName()
-  }
-}

cpp/ql/lib/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll

@@ -1,599 +0,0 @@
-import cpp
-import semmle.code.cpp.security.Security
-private import semmle.code.cpp.ir.dataflow.DataFlow
-private import semmle.code.cpp.ir.dataflow.internal.DataFlowUtil
-private import semmle.code.cpp.ir.dataflow.DataFlow3
-private import semmle.code.cpp.ir.IR
-private import semmle.code.cpp.ir.dataflow.internal.DataFlowDispatch as Dispatch
-private import semmle.code.cpp.controlflow.IRGuards
-private import semmle.code.cpp.models.interfaces.Taint
-private import semmle.code.cpp.models.interfaces.DataFlow
-private import semmle.code.cpp.ir.dataflow.TaintTracking
-private import semmle.code.cpp.ir.dataflow.TaintTracking2
-private import semmle.code.cpp.ir.dataflow.TaintTracking3
-private import semmle.code.cpp.ir.dataflow.internal.ModelUtil
-
-/**
- * A predictable instruction is one where an external user can predict
- * the value. For example, a literal in the source code is considered
- * predictable.
- */
-private predicate predictableInstruction(Instruction instr) {
-  instr instanceof ConstantInstruction
-  or
-  instr instanceof StringConstantInstruction
-  or
-  // This could be a conversion on a string literal
-  predictableInstruction(instr.(UnaryInstruction).getUnary())
-}
-
-/**
- * Functions that we should only allow taint to flow through (to the return
- * value) if all but the source argument are 'predictable'.  This is done to
- * emulate the old security library's implementation rather than due to any
- * strong belief that this is the right approach.
- *
- * Note that the list itself is not very principled; it consists of all the
- * functions listed in the old security library's [default] `isPureFunction`
- * that have more than one argument, but are not in the old taint tracking
- * library's `returnArgument` predicate.
- */
-predicate predictableOnlyFlow(string name) {
-  name =
-    [
-      "strcasestr", "strchnul", "strchr", "strchrnul", "strcmp", "strcspn", "strncmp", "strndup",
-      "strnlen", "strrchr", "strspn", "strstr", "strtod", "strtof", "strtol", "strtoll", "strtoq",
-      "strtoul"
-    ]
-}
-
-private DataFlow::Node getNodeForSource(Expr source) {
-  isUserInput(source, _) and
-  result = getNodeForExpr(source)
-}
-
-private DataFlow::Node getNodeForExpr(Expr node) {
-  result = DataFlow::exprNode(node)
-  or
-  // Some of the sources in `isUserInput` are intended to match the value of
-  // an expression, while others (those modeled below) are intended to match
-  // the taint that propagates out of an argument, like the `char *` argument
-  // to `gets`. It's impossible here to tell which is which, but the "access
-  // to argv" source is definitely not intended to match an output argument,
-  // and it causes false positives if we let it.
-  //
-  // This case goes together with the similar (but not identical) rule in
-  // `nodeIsBarrierIn`.
-  result = DataFlow::definitionByReferenceNodeFromArgument(node) and
-  not argv(node.(VariableAccess).getTarget())
-}
-
-private class DefaultTaintTrackingCfg extends TaintTracking::Configuration {
-  DefaultTaintTrackingCfg() { this = "DefaultTaintTrackingCfg" }
-
-  override predicate isSource(DataFlow::Node source) { source = getNodeForSource(_) }
-
-  override predicate isSink(DataFlow::Node sink) { exists(adjustedSink(sink)) }
-
-  override predicate isSanitizer(DataFlow::Node node) { nodeIsBarrier(node) }
-
-  override predicate isSanitizerIn(DataFlow::Node node) { nodeIsBarrierIn(node) }
-}
-
-private class ToGlobalVarTaintTrackingCfg extends TaintTracking::Configuration {
-  ToGlobalVarTaintTrackingCfg() { this = "GlobalVarTaintTrackingCfg" }
-
-  override predicate isSource(DataFlow::Node source) { source = getNodeForSource(_) }
-
-  override predicate isSink(DataFlow::Node sink) {
-    sink.asVariable() instanceof GlobalOrNamespaceVariable
-  }
-
-  override predicate isAdditionalTaintStep(DataFlow::Node n1, DataFlow::Node n2) {
-    writesVariable(n1.asInstruction(), n2.asVariable().(GlobalOrNamespaceVariable))
-    or
-    readsVariable(n2.asInstruction(), n1.asVariable().(GlobalOrNamespaceVariable))
-  }
-
-  override predicate isSanitizer(DataFlow::Node node) { nodeIsBarrier(node) }
-
-  override predicate isSanitizerIn(DataFlow::Node node) { nodeIsBarrierIn(node) }
-}
-
-private class FromGlobalVarTaintTrackingCfg extends TaintTracking2::Configuration {
-  FromGlobalVarTaintTrackingCfg() { this = "FromGlobalVarTaintTrackingCfg" }
-
-  override predicate isSource(DataFlow::Node source) {
-    // This set of sources should be reasonably small, which is good for
-    // performance since the set of sinks is very large.
-    exists(ToGlobalVarTaintTrackingCfg otherCfg | otherCfg.hasFlowTo(source))
-  }
-
-  override predicate isSink(DataFlow::Node sink) { exists(adjustedSink(sink)) }
-
-  override predicate isAdditionalTaintStep(DataFlow::Node n1, DataFlow::Node n2) {
-    // Additional step for flow out of variables. There is no flow _into_
-    // variables in this configuration, so this step only serves to take flow
-    // out of a variable that's a source.
-    readsVariable(n2.asInstruction(), n1.asVariable())
-  }
-
-  override predicate isSanitizer(DataFlow::Node node) { nodeIsBarrier(node) }
-
-  override predicate isSanitizerIn(DataFlow::Node node) { nodeIsBarrierIn(node) }
-}
-
-private predicate readsVariable(LoadInstruction load, Variable var) {
-  load.getSourceAddress().(VariableAddressInstruction).getASTVariable() = var
-}
-
-private predicate writesVariable(StoreInstruction store, Variable var) {
-  store.getDestinationAddress().(VariableAddressInstruction).getASTVariable() = var
-}
-
-/**
- * A variable that has any kind of upper-bound check anywhere in the program.  This is
- * biased towards being inclusive because there are a lot of valid ways of doing an
- * upper bounds checks if we don't consider where it occurs, for example:
- * ```
- *   if (x < 10) { sink(x); }
- *
- *   if (10 > y) { sink(y); }
- *
- *   if (z > 10) { z = 10; }
- *   sink(z);
- * ```
- */
-// TODO: This coarse overapproximation, ported from the old taint tracking
-// library, could be replaced with an actual semantic check that a particular
-// variable _access_ is guarded by an upper-bound check. We probably don't want
-// to do this right away since it could expose a lot of FPs that were
-// previously suppressed by this predicate by coincidence.
-private predicate hasUpperBoundsCheck(Variable var) {
-  exists(RelationalOperation oper, VariableAccess access |
-    oper.getAnOperand() = access and
-    access.getTarget() = var and
-    // Comparing to 0 is not an upper bound check
-    not oper.getAnOperand().getValue() = "0"
-  )
-}
-
-private predicate nodeIsBarrierEqualityCandidate(
-  DataFlow::Node node, Operand access, Variable checkedVar
-) {
-  readsVariable(node.asInstruction(), checkedVar) and
-  any(IRGuardCondition guard).ensuresEq(access, _, _, node.asInstruction().getBlock(), true)
-}
-
-cached
-private module Cached {
-  cached
-  predicate nodeIsBarrier(DataFlow::Node node) {
-    exists(Variable checkedVar |
-      readsVariable(node.asInstruction(), checkedVar) and
-      hasUpperBoundsCheck(checkedVar)
-    )
-    or
-    exists(Variable checkedVar, Operand access |
-      /*
-       * This node is guarded by a condition that forces the accessed variable
-       * to equal something else.  For example:
-       * ```
-       * x = taintsource()
-       * if (x == 10) {
-       *   taintsink(x); // not considered tainted
-       * }
-       * ```
-       */
-
-      nodeIsBarrierEqualityCandidate(node, access, checkedVar) and
-      readsVariable(access.getDef(), checkedVar)
-    )
-  }
-
-  cached
-  predicate nodeIsBarrierIn(DataFlow::Node node) {
-    // don't use dataflow into taint sources, as this leads to duplicate results.
-    exists(Expr source | isUserInput(source, _) |
-      node = DataFlow::exprNode(source)
-      or
-      // This case goes together with the similar (but not identical) rule in
-      // `getNodeForSource`.
-      node = DataFlow::definitionByReferenceNodeFromArgument(source)
-    )
-    or
-    // don't use dataflow into binary instructions if both operands are unpredictable
-    exists(BinaryInstruction iTo |
-      iTo = node.asInstruction() and
-      not predictableInstruction(iTo.getLeft()) and
-      not predictableInstruction(iTo.getRight()) and
-      // propagate taint from either the pointer or the offset, regardless of predictability
-      not iTo instanceof PointerArithmeticInstruction
-    )
-    or
-    // don't use dataflow through calls to pure functions if two or more operands
-    // are unpredictable
-    exists(Instruction iFrom1, Instruction iFrom2, CallInstruction iTo |
-      iTo = node.asInstruction() and
-      isPureFunction(iTo.getStaticCallTarget().getName()) and
-      iFrom1 = iTo.getAnArgument() and
-      iFrom2 = iTo.getAnArgument() and
-      not predictableInstruction(iFrom1) and
-      not predictableInstruction(iFrom2) and
-      iFrom1 != iFrom2
-    )
-  }
-
-  cached
-  Element adjustedSink(DataFlow::Node sink) {
-    // TODO: is it more appropriate to use asConvertedExpr here and avoid
-    // `getConversion*`? Or will that cause us to miss some cases where there's
-    // flow to a conversion (like a `ReferenceDereferenceExpr`) and we want to
-    // pretend there was flow to the converted `Expr` for the sake of
-    // compatibility.
-    sink.asExpr().getConversion*() = result
-    or
-    // For compatibility, send flow from arguments to parameters, even for
-    // functions with no body.
-    exists(FunctionCall call, int i |
-      sink.asExpr() = call.getArgument(i) and
-      result = resolveCall(call).getParameter(i)
-    )
-    or
-    // For compatibility, send flow into a `Variable` if there is flow to any
-    // Load or Store of that variable.
-    exists(CopyInstruction copy |
-      copy.getSourceValue() = sink.asInstruction() and
-      (
-        readsVariable(copy, result) or
-        writesVariable(copy, result)
-      ) and
-      not hasUpperBoundsCheck(result)
-    )
-    or
-    // For compatibility, send flow into a `NotExpr` even if it's part of a
-    // short-circuiting condition and thus might get skipped.
-    result.(NotExpr).getOperand() = sink.asExpr()
-    or
-    // Taint postfix and prefix crement operations when their operand is tainted.
-    result.(CrementOperation).getAnOperand() = sink.asExpr()
-    or
-    // Taint `e1 += e2`, `e &= e2` and friends when `e1` or `e2` is tainted.
-    result.(AssignOperation).getAnOperand() = sink.asExpr()
-    or
-    result =
-      sink.asOperand()
-          .(SideEffectOperand)
-          .getUse()
-          .(ReadSideEffectInstruction)
-          .getArgumentDef()
-          .getUnconvertedResultExpression()
-  }
-
-  /**
-   * Step to return value of a modeled function when an input taints the
-   * dereference of the return value.
-   */
-  cached
-  predicate additionalTaintStep(DataFlow::Node n1, DataFlow::Node n2) {
-    exists(CallInstruction call, Function func, FunctionInput modelIn, FunctionOutput modelOut |
-      n1.asOperand() = callInput(call, modelIn) and
-      (
-        func.(TaintFunction).hasTaintFlow(modelIn, modelOut)
-        or
-        func.(DataFlowFunction).hasDataFlow(modelIn, modelOut)
-      ) and
-      call.getStaticCallTarget() = func and
-      modelOut.isReturnValueDeref() and
-      call = n2.asInstruction()
-    )
-  }
-}
-
-private import Cached
-
-/**
- * Holds if `tainted` may contain taint from `source`.
- *
- * A tainted expression is either directly user input, or is
- * computed from user input in a way that users can probably
- * control the exact output of the computation.
- *
- * This doesn't include data flow through global variables.
- * If you need that you must call `taintedIncludingGlobalVars`.
- */
-cached
-predicate tainted(Expr source, Element tainted) {
-  exists(DefaultTaintTrackingCfg cfg, DataFlow::Node sink |
-    cfg.hasFlow(getNodeForSource(source), sink) and
-    tainted = adjustedSink(sink)
-  )
-}
-
-/**
- * Holds if `tainted` may contain taint from `source`, where the taint passed
- * through a global variable named `globalVar`.
- *
- * A tainted expression is either directly user input, or is
- * computed from user input in a way that users can probably
- * control the exact output of the computation.
- *
- * This version gives the same results as tainted but also includes
- * data flow through global variables.
- *
- * The parameter `globalVar` is the qualified name of the last global variable
- * used to move the value from source to tainted. If the taint did not pass
- * through a global variable, then `globalVar = ""`.
- */
-cached
-predicate taintedIncludingGlobalVars(Expr source, Element tainted, string globalVar) {
-  tainted(source, tainted) and
-  globalVar = ""
-  or
-  exists(
-    ToGlobalVarTaintTrackingCfg toCfg, FromGlobalVarTaintTrackingCfg fromCfg,
-    DataFlow::VariableNode variableNode, GlobalOrNamespaceVariable global, DataFlow::Node sink
-  |
-    global = variableNode.getVariable() and
-    toCfg.hasFlow(getNodeForSource(source), variableNode) and
-    fromCfg.hasFlow(variableNode, sink) and
-    tainted = adjustedSink(sink) and
-    global = globalVarFromId(globalVar)
-  )
-}
-
-/**
- * Gets the global variable whose qualified name is `id`. Use this predicate
- * together with `taintedIncludingGlobalVars`. Example:
- *
- * ```
- * exists(string varName |
- *   taintedIncludingGlobalVars(source, tainted, varName) and
- *   var = globalVarFromId(varName)
- * )
- * ```
- */
-GlobalOrNamespaceVariable globalVarFromId(string id) { id = result.getQualifiedName() }
-
-/**
- * Resolve potential target function(s) for `call`.
- *
- * If `call` is a call through a function pointer (`ExprCall`) or
- * targets a virtual method, simple data flow analysis is performed
- * in order to identify target(s).
- */
-Function resolveCall(Call call) {
-  exists(CallInstruction callInstruction |
-    callInstruction.getAST() = call and
-    result = Dispatch::viableCallable(callInstruction)
-  )
-}
-
-/**
- * Provides definitions for augmenting source/sink pairs with data-flow paths
- * between them. From a `@kind path-problem` query, import this module in the
- * global scope, extend `TaintTrackingConfiguration`, and use `taintedWithPath`
- * in place of `tainted`.
- *
- * Importing this module will also import the query predicates that contain the
- * taint paths.
- */
-module TaintedWithPath {
-  private newtype TSingleton = MkSingleton()
-
-  /**
-   * A taint-tracking configuration that matches sources and sinks in the same
-   * way as the `tainted` predicate.
-   *
-   * Override `isSink` and `taintThroughGlobals` as needed, but do not provide
-   * a characteristic predicate.
-   */
-  class TaintTrackingConfiguration extends TSingleton {
-    /** Override this to specify which elements are sources in this configuration. */
-    predicate isSource(Expr source) { exists(getNodeForSource(source)) }
-
-    /** Override this to specify which elements are sinks in this configuration. */
-    abstract predicate isSink(Element e);
-
-    /** Override this to specify which expressions are barriers in this configuration. */
-    predicate isBarrier(Expr e) { nodeIsBarrier(getNodeForExpr(e)) }
-
-    /**
-     * Override this predicate to `any()` to allow taint to flow through global
-     * variables.
-     */
-    predicate taintThroughGlobals() { none() }
-
-    /** Gets a textual representation of this element. */
-    string toString() { result = "TaintTrackingConfiguration" }
-  }
-
-  private class AdjustedConfiguration extends TaintTracking3::Configuration {
-    AdjustedConfiguration() { this = "AdjustedConfiguration" }
-
-    override predicate isSource(DataFlow::Node source) {
-      exists(TaintTrackingConfiguration cfg, Expr e |
-        cfg.isSource(e) and source = getNodeForExpr(e)
-      )
-    }
-
-    override predicate isSink(DataFlow::Node sink) {
-      exists(TaintTrackingConfiguration cfg | cfg.isSink(adjustedSink(sink)))
-    }
-
-    override predicate isAdditionalTaintStep(DataFlow::Node n1, DataFlow::Node n2) {
-      // Steps into and out of global variables
-      exists(TaintTrackingConfiguration cfg | cfg.taintThroughGlobals() |
-        writesVariable(n1.asInstruction(), n2.asVariable().(GlobalOrNamespaceVariable))
-        or
-        readsVariable(n2.asInstruction(), n1.asVariable().(GlobalOrNamespaceVariable))
-      )
-      or
-      additionalTaintStep(n1, n2)
-    }
-
-    override predicate isSanitizer(DataFlow::Node node) {
-      exists(TaintTrackingConfiguration cfg, Expr e | cfg.isBarrier(e) and node = getNodeForExpr(e))
-    }
-
-    override predicate isSanitizerIn(DataFlow::Node node) { nodeIsBarrierIn(node) }
-  }
-
-  /*
-   * A sink `Element` may map to multiple `DataFlowX::PathNode`s via (the
-   * inverse of) `adjustedSink`. For example, an `Expr` maps to all its
-   * conversions, and a `Variable` maps to all loads and stores from it. Because
-   * the path node is part of the tuple that constitutes the alert, this leads
-   * to duplicate alerts.
-   *
-   * To avoid showing duplicates, we edit the graph to replace the final node
-   * coming from the data-flow library with a node that matches exactly the
-   * `Element` sink that's requested.
-   *
-   * The same is done for sources.
-   */
-
-  private newtype TPathNode =
-    TWrapPathNode(DataFlow3::PathNode n) or
-    // There's a single newtype constructor for both sources and sinks since
-    // that makes it easiest to deal with the case where source = sink.
-    TEndpointPathNode(Element e) {
-      exists(AdjustedConfiguration cfg, DataFlow3::Node sourceNode, DataFlow3::Node sinkNode |
-        cfg.hasFlow(sourceNode, sinkNode)
-      |
-        sourceNode = getNodeForExpr(e) and
-        exists(TaintTrackingConfiguration ttCfg | ttCfg.isSource(e))
-        or
-        e = adjustedSink(sinkNode) and
-        exists(TaintTrackingConfiguration ttCfg | ttCfg.isSink(e))
-      )
-    }
-
-  /** An opaque type used for the nodes of a data-flow path. */
-  class PathNode extends TPathNode {
-    /** Gets a textual representation of this element. */
-    string toString() { none() }
-
-    /**
-     * Holds if this element is at the specified location.
-     * The location spans column `startcolumn` of line `startline` to
-     * column `endcolumn` of line `endline` in file `filepath`.
-     * For more information, see
-     * [Locations](https://help.semmle.com/QL/learn-ql/ql/locations.html).
-     */
-    predicate hasLocationInfo(
-      string filepath, int startline, int startcolumn, int endline, int endcolumn
-    ) {
-      none()
-    }
-  }
-
-  private class WrapPathNode extends PathNode, TWrapPathNode {
-    DataFlow3::PathNode inner() { this = TWrapPathNode(result) }
-
-    override string toString() { result = this.inner().toString() }
-
-    override predicate hasLocationInfo(
-      string filepath, int startline, int startcolumn, int endline, int endcolumn
-    ) {
-      this.inner().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
-    }
-  }
-
-  private class EndpointPathNode extends PathNode, TEndpointPathNode {
-    Expr inner() { this = TEndpointPathNode(result) }
-
-    override string toString() { result = this.inner().toString() }
-
-    override predicate hasLocationInfo(
-      string filepath, int startline, int startcolumn, int endline, int endcolumn
-    ) {
-      this.inner()
-          .getLocation()
-          .hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
-    }
-  }
-
-  /** A PathNode whose `Element` is a source. It may also be a sink. */
-  private class InitialPathNode extends EndpointPathNode {
-    InitialPathNode() { exists(TaintTrackingConfiguration cfg | cfg.isSource(this.inner())) }
-  }
-
-  /** A PathNode whose `Element` is a sink. It may also be a source. */
-  private class FinalPathNode extends EndpointPathNode {
-    FinalPathNode() { exists(TaintTrackingConfiguration cfg | cfg.isSink(this.inner())) }
-  }
-
-  /** Holds if `(a,b)` is an edge in the graph of data flow path explanations. */
-  query predicate edges(PathNode a, PathNode b) {
-    DataFlow3::PathGraph::edges(a.(WrapPathNode).inner(), b.(WrapPathNode).inner())
-    or
-    // To avoid showing trivial-looking steps, we _replace_ the last node instead
-    // of adding an edge out of it.
-    exists(WrapPathNode sinkNode |
-      DataFlow3::PathGraph::edges(a.(WrapPathNode).inner(), sinkNode.inner()) and
-      b.(FinalPathNode).inner() = adjustedSink(sinkNode.inner().getNode())
-    )
-    or
-    // Same for the first node
-    exists(WrapPathNode sourceNode |
-      DataFlow3::PathGraph::edges(sourceNode.inner(), b.(WrapPathNode).inner()) and
-      sourceNode.inner().getNode() = getNodeForExpr(a.(InitialPathNode).inner())
-    )
-    or
-    // Finally, handle the case where the path goes directly from a source to a
-    // sink, meaning that they both need to be translated.
-    exists(WrapPathNode sinkNode, WrapPathNode sourceNode |
-      DataFlow3::PathGraph::edges(sourceNode.inner(), sinkNode.inner()) and
-      sourceNode.inner().getNode() = getNodeForExpr(a.(InitialPathNode).inner()) and
-      b.(FinalPathNode).inner() = adjustedSink(sinkNode.inner().getNode())
-    )
-  }
-
-  /** Holds if `n` is a node in the graph of data flow path explanations. */
-  query predicate nodes(PathNode n, string key, string val) {
-    key = "semmle.label" and val = n.toString()
-  }
-
-  /**
-   * Holds if `tainted` may contain taint from `source`, where `sourceNode` and
-   * `sinkNode` are the corresponding `PathNode`s that can be used in a query
-   * to provide path explanations. Extend `TaintTrackingConfiguration` to use
-   * this predicate.
-   *
-   * A tainted expression is either directly user input, or is computed from
-   * user input in a way that users can probably control the exact output of
-   * the computation.
-   */
-  predicate taintedWithPath(Expr source, Element tainted, PathNode sourceNode, PathNode sinkNode) {
-    exists(AdjustedConfiguration cfg, DataFlow3::Node flowSource, DataFlow3::Node flowSink |
-      source = sourceNode.(InitialPathNode).inner() and
-      flowSource = getNodeForExpr(source) and
-      cfg.hasFlow(flowSource, flowSink) and
-      tainted = adjustedSink(flowSink) and
-      tainted = sinkNode.(FinalPathNode).inner()
-    )
-  }
-
-  private predicate isGlobalVariablePathNode(WrapPathNode n) {
-    n.inner().getNode().asVariable() instanceof GlobalOrNamespaceVariable
-  }
-
-  private predicate edgesWithoutGlobals(PathNode a, PathNode b) {
-    edges(a, b) and
-    not isGlobalVariablePathNode(a) and
-    not isGlobalVariablePathNode(b)
-  }
-
-  /**
-   * Holds if `tainted` can be reached from a taint source without passing
-   * through a global variable.
-   */
-  predicate taintedWithoutGlobals(Element tainted) {
-    exists(AdjustedConfiguration cfg, PathNode sourceNode, FinalPathNode sinkNode |
-      cfg.isSource(sourceNode.(WrapPathNode).inner().getNode()) and
-      edgesWithoutGlobals+(sourceNode, sinkNode) and
-      tainted = sinkNode.inner()
-    )
-  }
-}

cpp/ql/lib/semmle/code/cpp/ir/dataflow/TaintTracking3.qll

@@ -1,15 +0,0 @@
-/**
- * Provides a `TaintTracking3` module, which is a copy of the `TaintTracking`
- * module. Use this class when data-flow configurations or taint-tracking
- * configurations must depend on each other. Two classes extending
- * `DataFlow::Configuration` should never depend on each other, but one of them
- * should instead depend on a `DataFlow2::Configuration`, a
- * `DataFlow3::Configuration`, or a `DataFlow4::Configuration`. The
- * `TaintTracking::Configuration` class extends `DataFlow::Configuration`, and
- * `TaintTracking2::Configuration` extends `DataFlow2::Configuration`.
- *
- * See `semmle.code.cpp.ir.dataflow.TaintTracking` for the full documentation.
- */
-module TaintTracking3 {
-  import semmle.code.cpp.ir.dataflow.internal.tainttracking3.TaintTrackingImpl
-}

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowDispatch.qll

@@ -1,265 +0,0 @@
-private import cpp
-private import semmle.code.cpp.ir.IR
-private import semmle.code.cpp.ir.dataflow.DataFlow
-private import semmle.code.cpp.ir.dataflow.internal.DataFlowPrivate
-private import DataFlowImplCommon as DataFlowImplCommon
-
-/**
- * Gets a function that might be called by `call`.
- */
-cached
-Function viableCallable(CallInstruction call) {
-  DataFlowImplCommon::forceCachingInSameStage() and
-  result = call.getStaticCallTarget()
-  or
-  // If the target of the call does not have a body in the snapshot, it might
-  // be because the target is just a header declaration, and the real target
-  // will be determined at run time when the caller and callee are linked
-  // together by the operating system's dynamic linker. In case a _unique_
-  // function with the right signature is present in the database, we return
-  // that as a potential callee.
-  exists(string qualifiedName, int nparams |
-    callSignatureWithoutBody(qualifiedName, nparams, call) and
-    functionSignatureWithBody(qualifiedName, nparams, result) and
-    strictcount(Function other | functionSignatureWithBody(qualifiedName, nparams, other)) = 1
-  )
-  or
-  // Virtual dispatch
-  result = call.(VirtualDispatch::DataSensitiveCall).resolve()
-}
-
-/**
- * Provides virtual dispatch support compatible with the original
- * implementation of `semmle.code.cpp.security.TaintTracking`.
- */
-private module VirtualDispatch {
-  /** A call that may dispatch differently depending on the qualifier value. */
-  abstract class DataSensitiveCall extends DataFlowCall {
-    /**
-     * Gets the node whose value determines the target of this call. This node
-     * could be the qualifier of a virtual dispatch or the function-pointer
-     * expression in a call to a function pointer. What they have in common is
-     * that we need to find out which data flows there, and then it's up to the
-     * `resolve` predicate to stitch that information together and resolve the
-     * call.
-     */
-    abstract DataFlow::Node getDispatchValue();
-
-    /** Gets a candidate target for this call. */
-    abstract Function resolve();
-
-    /**
-     * Whether `src` can flow to this call.
-     *
-     * Searches backwards from `getDispatchValue()` to `src`. The `allowFromArg`
-     * parameter is true when the search is allowed to continue backwards into
-     * a parameter; non-recursive callers should pass `_` for `allowFromArg`.
-     */
-    predicate flowsFrom(DataFlow::Node src, boolean allowFromArg) {
-      src = this.getDispatchValue() and allowFromArg = true
-      or
-      exists(DataFlow::Node other, boolean allowOtherFromArg |
-        this.flowsFrom(other, allowOtherFromArg)
-      |
-        // Call argument
-        exists(DataFlowCall call, int i |
-          other.(DataFlow::ParameterNode).isParameterOf(call.getStaticCallTarget(), i) and
-          src.(ArgumentNode).argumentOf(call, i)
-        ) and
-        allowOtherFromArg = true and
-        allowFromArg = true
-        or
-        // Call return
-        exists(DataFlowCall call, ReturnKind returnKind |
-          other = getAnOutNode(call, returnKind) and
-          returnNodeWithKindAndEnclosingCallable(src, returnKind, call.getStaticCallTarget())
-        ) and
-        allowFromArg = false
-        or
-        // Local flow
-        DataFlow::localFlowStep(src, other) and
-        allowFromArg = allowOtherFromArg
-        or
-        // Flow from global variable to load.
-        exists(LoadInstruction load, GlobalOrNamespaceVariable var |
-          var = src.asVariable() and
-          other.asInstruction() = load and
-          addressOfGlobal(load.getSourceAddress(), var) and
-          // The `allowFromArg` concept doesn't play a role when `src` is a
-          // global variable, so we just set it to a single arbitrary value for
-          // performance.
-          allowFromArg = true
-        )
-        or
-        // Flow from store to global variable.
-        exists(StoreInstruction store, GlobalOrNamespaceVariable var |
-          var = other.asVariable() and
-          store = src.asInstruction() and
-          storeIntoGlobal(store, var) and
-          // Setting `allowFromArg` to `true` like in the base case means we
-          // treat a store to a global variable like the dispatch itself: flow
-          // may come from anywhere.
-          allowFromArg = true
-        )
-      )
-    }
-  }
-
-  pragma[noinline]
-  private predicate storeIntoGlobal(StoreInstruction store, GlobalOrNamespaceVariable var) {
-    addressOfGlobal(store.getDestinationAddress(), var)
-  }
-
-  /** Holds if `addressInstr` is an instruction that produces the address of `var`. */
-  private predicate addressOfGlobal(Instruction addressInstr, GlobalOrNamespaceVariable var) {
-    // Access directly to the global variable
-    addressInstr.(VariableAddressInstruction).getASTVariable() = var
-    or
-    // Access to a field on a global union
-    exists(FieldAddressInstruction fa |
-      fa = addressInstr and
-      fa.getObjectAddress().(VariableAddressInstruction).getASTVariable() = var and
-      fa.getField().getDeclaringType() instanceof Union
-    )
-  }
-
-  /**
-   * A ReturnNode with its ReturnKind and its enclosing callable.
-   *
-   * Used to fix a join ordering issue in flowsFrom.
-   */
-  private predicate returnNodeWithKindAndEnclosingCallable(
-    ReturnNode node, ReturnKind kind, DataFlowCallable callable
-  ) {
-    node.getKind() = kind and
-    node.getEnclosingCallable() = callable
-  }
-
-  /** Call through a function pointer. */
-  private class DataSensitiveExprCall extends DataSensitiveCall {
-    DataSensitiveExprCall() { not exists(this.getStaticCallTarget()) }
-
-    override DataFlow::Node getDispatchValue() { result.asInstruction() = this.getCallTarget() }
-
-    override Function resolve() {
-      exists(FunctionInstruction fi |
-        this.flowsFrom(DataFlow::instructionNode(fi), _) and
-        result = fi.getFunctionSymbol()
-      ) and
-      (
-        this.getNumberOfArguments() <= result.getEffectiveNumberOfParameters() and
-        this.getNumberOfArguments() >= result.getEffectiveNumberOfParameters()
-        or
-        result.isVarargs()
-      )
-    }
-  }
-
-  /** Call to a virtual function. */
-  private class DataSensitiveOverriddenFunctionCall extends DataSensitiveCall {
-    DataSensitiveOverriddenFunctionCall() {
-      exists(this.getStaticCallTarget().(VirtualFunction).getAnOverridingFunction())
-    }
-
-    override DataFlow::Node getDispatchValue() { result.asInstruction() = this.getThisArgument() }
-
-    override MemberFunction resolve() {
-      exists(Class overridingClass |
-        this.overrideMayAffectCall(overridingClass, result) and
-        this.hasFlowFromCastFrom(overridingClass)
-      )
-    }
-
-    /**
-     * Holds if `this` is a virtual function call whose static target is
-     * overridden by `overridingFunction` in `overridingClass`.
-     */
-    pragma[noinline]
-    private predicate overrideMayAffectCall(Class overridingClass, MemberFunction overridingFunction) {
-      overridingFunction.getAnOverriddenFunction+() = this.getStaticCallTarget().(VirtualFunction) and
-      overridingFunction.getDeclaringType() = overridingClass
-    }
-
-    /**
-     * Holds if the qualifier of `this` has flow from an upcast from
-     * `derivedClass`.
-     */
-    pragma[noinline]
-    private predicate hasFlowFromCastFrom(Class derivedClass) {
-      exists(ConvertToBaseInstruction toBase |
-        this.flowsFrom(DataFlow::instructionNode(toBase), _) and
-        derivedClass = toBase.getDerivedClass()
-      )
-    }
-  }
-}
-
-/**
- * Holds if `f` is a function with a body that has name `qualifiedName` and
- * `nparams` parameter count. See `functionSignature`.
- */
-private predicate functionSignatureWithBody(string qualifiedName, int nparams, Function f) {
-  functionSignature(f, qualifiedName, nparams) and
-  exists(f.getBlock())
-}
-
-/**
- * Holds if the target of `call` is a function _with no definition_ that has
- * name `qualifiedName` and `nparams` parameter count. See `functionSignature`.
- */
-pragma[noinline]
-private predicate callSignatureWithoutBody(string qualifiedName, int nparams, CallInstruction call) {
-  exists(Function target |
-    target = call.getStaticCallTarget() and
-    not exists(target.getBlock()) and
-    functionSignature(target, qualifiedName, nparams)
-  )
-}
-
-/**
- * Holds if `f` has name `qualifiedName` and `nparams` parameter count. This is
- * an approximation of its signature for the purpose of matching functions that
- * might be the same across link targets.
- */
-private predicate functionSignature(Function f, string qualifiedName, int nparams) {
-  qualifiedName = f.getQualifiedName() and
-  nparams = f.getNumberOfParameters() and
-  not f.isStatic()
-}
-
-/**
- * Holds if the set of viable implementations that can be called by `call`
- * might be improved by knowing the call context.
- */
-predicate mayBenefitFromCallContext(CallInstruction call, Function f) {
-  mayBenefitFromCallContext(call, f, _)
-}
-
-/**
- * Holds if `call` is a call through a function pointer, and the pointer
- * value is given as the `arg`'th argument to `f`.
- */
-private predicate mayBenefitFromCallContext(
-  VirtualDispatch::DataSensitiveCall call, Function f, int arg
-) {
-  f = pragma[only_bind_out](call).getEnclosingCallable() and
-  exists(InitializeParameterInstruction init |
-    not exists(call.getStaticCallTarget()) and
-    init.getEnclosingFunction() = f and
-    call.flowsFrom(DataFlow::instructionNode(init), _) and
-    init.getParameter().getIndex() = arg
-  )
-}
-
-/**
- * Gets a viable dispatch target of `call` in the context `ctx`. This is
- * restricted to those `call`s for which a context might make a difference.
- */
-Function viableImplInCallContext(CallInstruction call, CallInstruction ctx) {
-  result = viableCallable(call) and
-  exists(int i, Function f |
-    mayBenefitFromCallContext(pragma[only_bind_into](call), f, i) and
-    f = ctx.getStaticCallTarget() and
-    result = ctx.getArgument(i).getUnconvertedResultExpression().(FunctionAccess).getTarget()
-  )
-}

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplConsistency.qll

@@ -1,181 +0,0 @@
-/**
- * Provides consistency queries for checking invariants in the language-specific
- * data-flow classes and predicates.
- */
-
-private import DataFlowImplSpecific::Private
-private import DataFlowImplSpecific::Public
-private import tainttracking1.TaintTrackingParameter::Private
-private import tainttracking1.TaintTrackingParameter::Public
-
-module Consistency {
-  private class RelevantNode extends Node {
-    RelevantNode() {
-      this instanceof ArgumentNode or
-      this instanceof ParameterNode or
-      this instanceof ReturnNode or
-      this = getAnOutNode(_, _) or
-      simpleLocalFlowStep(this, _) or
-      simpleLocalFlowStep(_, this) or
-      jumpStep(this, _) or
-      jumpStep(_, this) or
-      storeStep(this, _, _) or
-      storeStep(_, _, this) or
-      readStep(this, _, _) or
-      readStep(_, _, this) or
-      defaultAdditionalTaintStep(this, _) or
-      defaultAdditionalTaintStep(_, this)
-    }
-  }
-
-  query predicate uniqueEnclosingCallable(Node n, string msg) {
-    exists(int c |
-      n instanceof RelevantNode and
-      c = count(n.getEnclosingCallable()) and
-      c != 1 and
-      msg = "Node should have one enclosing callable but has " + c + "."
-    )
-  }
-
-  query predicate uniqueType(Node n, string msg) {
-    exists(int c |
-      n instanceof RelevantNode and
-      c = count(getNodeType(n)) and
-      c != 1 and
-      msg = "Node should have one type but has " + c + "."
-    )
-  }
-
-  query predicate uniqueNodeLocation(Node n, string msg) {
-    exists(int c |
-      c =
-        count(string filepath, int startline, int startcolumn, int endline, int endcolumn |
-          n.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
-        ) and
-      c != 1 and
-      msg = "Node should have one location but has " + c + "."
-    )
-  }
-
-  query predicate missingLocation(string msg) {
-    exists(int c |
-      c =
-        strictcount(Node n |
-          not exists(string filepath, int startline, int startcolumn, int endline, int endcolumn |
-            n.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
-          )
-        ) and
-      msg = "Nodes without location: " + c
-    )
-  }
-
-  query predicate uniqueNodeToString(Node n, string msg) {
-    exists(int c |
-      c = count(n.toString()) and
-      c != 1 and
-      msg = "Node should have one toString but has " + c + "."
-    )
-  }
-
-  query predicate missingToString(string msg) {
-    exists(int c |
-      c = strictcount(Node n | not exists(n.toString())) and
-      msg = "Nodes without toString: " + c
-    )
-  }
-
-  query predicate parameterCallable(ParameterNode p, string msg) {
-    exists(DataFlowCallable c | p.isParameterOf(c, _) and c != p.getEnclosingCallable()) and
-    msg = "Callable mismatch for parameter."
-  }
-
-  query predicate localFlowIsLocal(Node n1, Node n2, string msg) {
-    simpleLocalFlowStep(n1, n2) and
-    n1.getEnclosingCallable() != n2.getEnclosingCallable() and
-    msg = "Local flow step does not preserve enclosing callable."
-  }
-
-  private DataFlowType typeRepr() { result = getNodeType(_) }
-
-  query predicate compatibleTypesReflexive(DataFlowType t, string msg) {
-    t = typeRepr() and
-    not compatibleTypes(t, t) and
-    msg = "Type compatibility predicate is not reflexive."
-  }
-
-  query predicate unreachableNodeCCtx(Node n, DataFlowCall call, string msg) {
-    isUnreachableInCall(n, call) and
-    exists(DataFlowCallable c |
-      c = n.getEnclosingCallable() and
-      not viableCallable(call) = c
-    ) and
-    msg = "Call context for isUnreachableInCall is inconsistent with call graph."
-  }
-
-  query predicate localCallNodes(DataFlowCall call, Node n, string msg) {
-    (
-      n = getAnOutNode(call, _) and
-      msg = "OutNode and call does not share enclosing callable."
-      or
-      n.(ArgumentNode).argumentOf(call, _) and
-      msg = "ArgumentNode and call does not share enclosing callable."
-    ) and
-    n.getEnclosingCallable() != call.getEnclosingCallable()
-  }
-
-  // This predicate helps the compiler forget that in some languages
-  // it is impossible for a result of `getPreUpdateNode` to be an
-  // instance of `PostUpdateNode`.
-  private Node getPre(PostUpdateNode n) {
-    result = n.getPreUpdateNode()
-    or
-    none()
-  }
-
-  query predicate postIsNotPre(PostUpdateNode n, string msg) {
-    getPre(n) = n and
-    msg = "PostUpdateNode should not equal its pre-update node."
-  }
-
-  query predicate postHasUniquePre(PostUpdateNode n, string msg) {
-    exists(int c |
-      c = count(n.getPreUpdateNode()) and
-      c != 1 and
-      msg = "PostUpdateNode should have one pre-update node but has " + c + "."
-    )
-  }
-
-  query predicate uniquePostUpdate(Node n, string msg) {
-    1 < strictcount(PostUpdateNode post | post.getPreUpdateNode() = n) and
-    msg = "Node has multiple PostUpdateNodes."
-  }
-
-  query predicate postIsInSameCallable(PostUpdateNode n, string msg) {
-    n.getEnclosingCallable() != n.getPreUpdateNode().getEnclosingCallable() and
-    msg = "PostUpdateNode does not share callable with its pre-update node."
-  }
-
-  private predicate hasPost(Node n) { exists(PostUpdateNode post | post.getPreUpdateNode() = n) }
-
-  query predicate reverseRead(Node n, string msg) {
-    exists(Node n2 | readStep(n, _, n2) and hasPost(n2) and not hasPost(n)) and
-    msg = "Origin of readStep is missing a PostUpdateNode."
-  }
-
-  query predicate argHasPostUpdate(ArgumentNode n, string msg) {
-    not hasPost(n) and
-    not isImmutableOrUnobservable(n) and
-    msg = "ArgumentNode is missing PostUpdateNode."
-  }
-
-  // This predicate helps the compiler forget that in some languages
-  // it is impossible for a `PostUpdateNode` to be the target of
-  // `simpleLocalFlowStep`.
-  private predicate isPostUpdateNode(Node n) { n instanceof PostUpdateNode or none() }
-
-  query predicate postWithInFlow(Node n, string msg) {
-    isPostUpdateNode(n) and
-    simpleLocalFlowStep(_, n) and
-    msg = "PostUpdateNode should not be the target of local flow."
-  }
-}

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll

@@ -1,503 +0,0 @@
-private import cpp
-private import DataFlowUtil
-private import semmle.code.cpp.ir.IR
-private import DataFlowDispatch
-
-/**
- * A data flow node that occurs as the argument of a call and is passed as-is
- * to the callable. Instance arguments (`this` pointer) and read side effects
- * on parameters are also included.
- */
-abstract class ArgumentNode extends OperandNode {
-  /**
-   * Holds if this argument occurs at the given position in the given call.
-   * The instance argument is considered to have index `-1`.
-   */
-  abstract predicate argumentOf(DataFlowCall call, int pos);
-
-  /** Gets the call in which this node is an argument. */
-  DataFlowCall getCall() { this.argumentOf(result, _) }
-}
-
-/**
- * A data flow node that occurs as the argument to a call, or an
- * implicit `this` pointer argument.
- */
-private class PrimaryArgumentNode extends ArgumentNode {
-  override ArgumentOperand op;
-
-  PrimaryArgumentNode() { exists(CallInstruction call | op = call.getAnArgumentOperand()) }
-
-  override predicate argumentOf(DataFlowCall call, int pos) { op = call.getArgumentOperand(pos) }
-
-  override string toString() {
-    exists(Expr unconverted |
-      unconverted = op.getDef().getUnconvertedResultExpression() and
-      result = unconverted.toString()
-    )
-    or
-    // Certain instructions don't map to an unconverted result expression. For these cases
-    // we fall back to a simpler naming scheme. This can happen in IR-generated constructors.
-    not exists(op.getDef().getUnconvertedResultExpression()) and
-    (
-      result = "Argument " + op.(PositionalArgumentOperand).getIndex()
-      or
-      op instanceof ThisArgumentOperand and result = "Argument this"
-    )
-  }
-}
-
-/**
- * A data flow node representing the read side effect of a call on a
- * specific parameter.
- */
-private class SideEffectArgumentNode extends ArgumentNode {
-  override SideEffectOperand op;
-  ReadSideEffectInstruction read;
-
-  SideEffectArgumentNode() { op = read.getSideEffectOperand() }
-
-  override predicate argumentOf(DataFlowCall call, int pos) {
-    read.getPrimaryInstruction() = call and
-    pos = getArgumentPosOfSideEffect(read.getIndex())
-  }
-
-  override string toString() {
-    result = read.getArgumentDef().getUnconvertedResultExpression().toString() + " indirection"
-    or
-    // Some instructions don't map to an unconverted result expression. For these cases
-    // we fall back to a simpler naming scheme. This can happen in IR-generated constructors.
-    not exists(read.getArgumentDef().getUnconvertedResultExpression()) and
-    (
-      if read.getIndex() = -1
-      then result = "Argument this indirection"
-      else result = "Argument " + read.getIndex() + " indirection"
-    )
-  }
-}
-
-private newtype TReturnKind =
-  TNormalReturnKind() or
-  TIndirectReturnKind(ParameterIndex index)
-
-/**
- * A return kind. A return kind describes how a value can be returned
- * from a callable. For C++, this is simply a function return.
- */
-class ReturnKind extends TReturnKind {
-  /** Gets a textual representation of this return kind. */
-  abstract string toString();
-}
-
-private class NormalReturnKind extends ReturnKind, TNormalReturnKind {
-  override string toString() { result = "return" }
-}
-
-private class IndirectReturnKind extends ReturnKind, TIndirectReturnKind {
-  ParameterIndex index;
-
-  IndirectReturnKind() { this = TIndirectReturnKind(index) }
-
-  override string toString() { result = "outparam[" + index.toString() + "]" }
-}
-
-/** A data flow node that occurs as the result of a `ReturnStmt`. */
-class ReturnNode extends InstructionNode {
-  Instruction primary;
-
-  ReturnNode() {
-    exists(ReturnValueInstruction ret | instr = ret.getReturnValue() and primary = ret)
-    or
-    exists(ReturnIndirectionInstruction rii |
-      instr = rii.getSideEffectOperand().getAnyDef() and primary = rii
-    )
-  }
-
-  /** Gets the kind of this returned value. */
-  abstract ReturnKind getKind();
-}
-
-class ReturnValueNode extends ReturnNode {
-  override ReturnValueInstruction primary;
-
-  override ReturnKind getKind() { result = TNormalReturnKind() }
-}
-
-class ReturnIndirectionNode extends ReturnNode {
-  override ReturnIndirectionInstruction primary;
-
-  override ReturnKind getKind() {
-    exists(int index |
-      primary.hasIndex(index) and
-      result = TIndirectReturnKind(index)
-    )
-  }
-}
-
-/** A data flow node that represents the output of a call. */
-class OutNode extends InstructionNode {
-  OutNode() {
-    instr instanceof CallInstruction or
-    instr instanceof WriteSideEffectInstruction
-  }
-
-  /** Gets the underlying call. */
-  abstract DataFlowCall getCall();
-
-  abstract ReturnKind getReturnKind();
-}
-
-private class CallOutNode extends OutNode {
-  override CallInstruction instr;
-
-  override DataFlowCall getCall() { result = instr }
-
-  override ReturnKind getReturnKind() { result instanceof NormalReturnKind }
-}
-
-private class SideEffectOutNode extends OutNode {
-  override WriteSideEffectInstruction instr;
-
-  override DataFlowCall getCall() { result = instr.getPrimaryInstruction() }
-
-  override ReturnKind getReturnKind() { result = TIndirectReturnKind(instr.getIndex()) }
-}
-
-/**
- * Gets a node that can read the value returned from `call` with return kind
- * `kind`.
- */
-OutNode getAnOutNode(DataFlowCall call, ReturnKind kind) {
-  // There should be only one `OutNode` for a given `(call, kind)` pair. Showing the optimizer that
-  // this is true helps it make better decisions downstream, especially in virtual dispatch.
-  result =
-    unique(OutNode outNode |
-      outNode.getCall() = call and
-      outNode.getReturnKind() = kind
-    )
-}
-
-/**
- * Holds if data can flow from `node1` to `node2` in a way that loses the
- * calling context. For example, this would happen with flow through a
- * global or static variable.
- */
-predicate jumpStep(Node n1, Node n2) { none() }
-
-private predicate fieldStoreStepNoChi(Node node1, FieldContent f, PostUpdateNode node2) {
-  exists(StoreInstruction store, Class c |
-    store = node2.asInstruction() and
-    store.getSourceValueOperand() = node1.asOperand() and
-    getWrittenField(store, f.(FieldContent).getAField(), c) and
-    f.hasOffset(c, _, _)
-  )
-}
-
-private FieldAddressInstruction getFieldInstruction(Instruction instr) {
-  result = instr or
-  result = instr.(CopyValueInstruction).getUnary()
-}
-
-pragma[noinline]
-private predicate getWrittenField(Instruction instr, Field f, Class c) {
-  exists(FieldAddressInstruction fa |
-    fa =
-      getFieldInstruction([
-          instr.(StoreInstruction).getDestinationAddress(),
-          instr.(WriteSideEffectInstruction).getDestinationAddress()
-        ]) and
-    f = fa.getField() and
-    c = f.getDeclaringType()
-  )
-}
-
-private predicate fieldStoreStepChi(Node node1, FieldContent f, PostUpdateNode node2) {
-  exists(ChiPartialOperand operand, ChiInstruction chi |
-    chi.getPartialOperand() = operand and
-    node1.asOperand() = operand and
-    node2.asInstruction() = chi and
-    exists(Class c |
-      c = chi.getResultType() and
-      exists(int startBit, int endBit |
-        chi.getUpdatedInterval(startBit, endBit) and
-        f.hasOffset(c, startBit, endBit)
-      )
-      or
-      getWrittenField(operand.getDef(), f.getAField(), c) and
-      f.hasOffset(c, _, _)
-    )
-  )
-}
-
-private predicate arrayStoreStepChi(Node node1, ArrayContent a, PostUpdateNode node2) {
-  exists(a) and
-  exists(ChiPartialOperand operand, ChiInstruction chi, StoreInstruction store |
-    chi.getPartialOperand() = operand and
-    store = operand.getDef() and
-    node1.asOperand() = operand and
-    // This `ChiInstruction` will always have a non-conflated result because both `ArrayStoreNode`
-    // and `PointerStoreNode` require it in their characteristic predicates.
-    node2.asInstruction() = chi and
-    (
-      // `x[i] = taint()`
-      // This matches the characteristic predicate in `ArrayStoreNode`.
-      store.getDestinationAddress() instanceof PointerAddInstruction
-      or
-      // `*p = taint()`
-      // This matches the characteristic predicate in `PointerStoreNode`.
-      store.getDestinationAddress().(CopyValueInstruction).getUnary() instanceof LoadInstruction
-    )
-  )
-}
-
-/**
- * Holds if data can flow from `node1` to `node2` via an assignment to `f`.
- * Thus, `node2` references an object with a field `f` that contains the
- * value of `node1`.
- */
-predicate storeStep(Node node1, Content f, PostUpdateNode node2) {
-  fieldStoreStepNoChi(node1, f, node2) or
-  fieldStoreStepChi(node1, f, node2) or
-  arrayStoreStepChi(node1, f, node2) or
-  fieldStoreStepAfterArraySuppression(node1, f, node2)
-}
-
-// This predicate pushes the correct `FieldContent` onto the access path when the
-// `suppressArrayRead` predicate has popped off an `ArrayContent`.
-private predicate fieldStoreStepAfterArraySuppression(
-  Node node1, FieldContent f, PostUpdateNode node2
-) {
-  exists(WriteSideEffectInstruction write, ChiInstruction chi, Class c |
-    not chi.isResultConflated() and
-    node1.asInstruction() = chi and
-    node2.asInstruction() = chi and
-    chi.getPartial() = write and
-    getWrittenField(write, f.getAField(), c) and
-    f.hasOffset(c, _, _)
-  )
-}
-
-bindingset[result, i]
-private int unbindInt(int i) { i <= result and i >= result }
-
-pragma[noinline]
-private predicate getLoadedField(LoadInstruction load, Field f, Class c) {
-  exists(FieldAddressInstruction fa |
-    fa = load.getSourceAddress() and
-    f = fa.getField() and
-    c = f.getDeclaringType()
-  )
-}
-
-/**
- * Holds if data can flow from `node1` to `node2` via a read of `f`.
- * Thus, `node1` references an object with a field `f` whose value ends up in
- * `node2`.
- */
-private predicate fieldReadStep(Node node1, FieldContent f, Node node2) {
-  exists(LoadOperand operand |
-    node2.asOperand() = operand and
-    node1.asInstruction() = operand.getAnyDef() and
-    exists(Class c |
-      c = operand.getAnyDef().getResultType() and
-      exists(int startBit, int endBit |
-        operand.getUsedInterval(unbindInt(startBit), unbindInt(endBit)) and
-        f.hasOffset(c, startBit, endBit)
-      )
-      or
-      getLoadedField(operand.getUse(), f.getAField(), c) and
-      f.hasOffset(c, _, _)
-    )
-  )
-}
-
-/**
- * When a store step happens in a function that looks like an array write such as:
- * ```cpp
- * void f(int* pa) {
- *   pa = source();
- * }
- * ```
- * it can be a write to an array, but it can also happen that `f` is called as `f(&a.x)`. If that is
- * the case, the `ArrayContent` that was written by the call to `f` should be popped off the access
- * path, and a `FieldContent` containing `x` should be pushed instead.
- * So this case pops `ArrayContent` off the access path, and the `fieldStoreStepAfterArraySuppression`
- * predicate in `storeStep` ensures that we push the right `FieldContent` onto the access path.
- */
-predicate suppressArrayRead(Node node1, ArrayContent a, Node node2) {
-  exists(a) and
-  exists(WriteSideEffectInstruction write, ChiInstruction chi |
-    node1.asInstruction() = write and
-    node2.asInstruction() = chi and
-    chi.getPartial() = write and
-    getWrittenField(write, _, _)
-  )
-}
-
-private class ArrayToPointerConvertInstruction extends ConvertInstruction {
-  ArrayToPointerConvertInstruction() {
-    this.getUnary().getResultType() instanceof ArrayType and
-    this.getResultType() instanceof PointerType
-  }
-}
-
-private Instruction skipOneCopyValueInstructionRec(CopyValueInstruction copy) {
-  copy.getUnary() = result and not result instanceof CopyValueInstruction
-  or
-  result = skipOneCopyValueInstructionRec(copy.getUnary())
-}
-
-private Instruction skipCopyValueInstructions(Operand op) {
-  not result instanceof CopyValueInstruction and result = op.getDef()
-  or
-  result = skipOneCopyValueInstructionRec(op.getDef())
-}
-
-private predicate arrayReadStep(Node node1, ArrayContent a, Node node2) {
-  exists(a) and
-  // Explicit dereferences such as `*p` or `p[i]` where `p` is a pointer or array.
-  exists(LoadOperand operand, Instruction address |
-    operand.isDefinitionInexact() and
-    node1.asInstruction() = operand.getAnyDef() and
-    operand = node2.asOperand() and
-    address = skipCopyValueInstructions(operand.getAddressOperand()) and
-    (
-      address instanceof LoadInstruction or
-      address instanceof ArrayToPointerConvertInstruction or
-      address instanceof PointerOffsetInstruction
-    )
-  )
-}
-
-/**
- * In cases such as:
- * ```cpp
- * void f(int* pa) {
- *   *pa = source();
- * }
- * ...
- * int x;
- * f(&x);
- * use(x);
- * ```
- * the load on `x` in `use(x)` will exactly overlap with its definition (in this case the definition
- * is a `WriteSideEffect`). This predicate pops the `ArrayContent` (pushed by the store in `f`)
- * from the access path.
- */
-private predicate exactReadStep(Node node1, ArrayContent a, Node node2) {
-  exists(a) and
-  exists(WriteSideEffectInstruction write, ChiInstruction chi |
-    not chi.isResultConflated() and
-    chi.getPartial() = write and
-    node1.asInstruction() = write and
-    node2.asInstruction() = chi and
-    // To distinquish this case from the `arrayReadStep` case we require that the entire variable was
-    // overwritten by the `WriteSideEffectInstruction` (i.e., there is a load that reads the
-    // entire variable).
-    exists(LoadInstruction load | load.getSourceValue() = chi)
-  )
-}
-
-/**
- * Holds if data can flow from `node1` to `node2` via a read of `f`.
- * Thus, `node1` references an object with a field `f` whose value ends up in
- * `node2`.
- */
-predicate readStep(Node node1, Content f, Node node2) {
-  fieldReadStep(node1, f, node2) or
-  arrayReadStep(node1, f, node2) or
-  exactReadStep(node1, f, node2) or
-  suppressArrayRead(node1, f, node2)
-}
-
-/**
- * Holds if values stored inside content `c` are cleared at node `n`.
- */
-predicate clearsContent(Node n, Content c) {
-  none() // stub implementation
-}
-
-/** Gets the type of `n` used for type pruning. */
-IRType getNodeType(Node n) {
-  suppressUnusedNode(n) and
-  result instanceof IRVoidType // stub implementation
-}
-
-/** Gets a string representation of a type returned by `getNodeType`. */
-string ppReprType(IRType t) { none() } // stub implementation
-
-/**
- * Holds if `t1` and `t2` are compatible, that is, whether data can flow from
- * a node of type `t1` to a node of type `t2`.
- */
-pragma[inline]
-predicate compatibleTypes(IRType t1, IRType t2) {
-  any() // stub implementation
-}
-
-private predicate suppressUnusedNode(Node n) { any() }
-
-//////////////////////////////////////////////////////////////////////////////
-// Java QL library compatibility wrappers
-//////////////////////////////////////////////////////////////////////////////
-/** A node that performs a type cast. */
-class CastNode extends InstructionNode {
-  CastNode() { none() } // stub implementation
-}
-
-/**
- * A function that may contain code or a variable that may contain itself. When
- * flow crosses from one _enclosing callable_ to another, the interprocedural
- * data-flow library discards call contexts and inserts a node in the big-step
- * relation used for human-readable path explanations.
- */
-class DataFlowCallable = Declaration;
-
-class DataFlowExpr = Expr;
-
-class DataFlowType = IRType;
-
-/** A function call relevant for data flow. */
-class DataFlowCall extends CallInstruction {
-  Function getEnclosingCallable() { result = this.getEnclosingFunction() }
-}
-
-predicate isUnreachableInCall(Node n, DataFlowCall call) { none() } // stub implementation
-
-int accessPathLimit() { result = 5 }
-
-/** The unit type. */
-private newtype TUnit = TMkUnit()
-
-/** The trivial type with a single element. */
-class Unit extends TUnit {
-  /** Gets a textual representation of this element. */
-  string toString() { result = "unit" }
-}
-
-/**
- * Holds if `n` does not require a `PostUpdateNode` as it either cannot be
- * modified or its modification cannot be observed, for example if it is a
- * freshly created object that is not saved in a variable.
- *
- * This predicate is only used for consistency checks.
- */
-predicate isImmutableOrUnobservable(Node n) {
-  // The rules for whether an IR argument gets a post-update node are too
-  // complex to model here.
-  any()
-}
-
-/** Holds if `n` should be hidden from path explanations. */
-predicate nodeIsHidden(Node n) { n instanceof OperandNode and not n instanceof ArgumentNode }
-
-class LambdaCallKind = Unit;
-
-/** Holds if `creation` is an expression that creates a lambda of kind `kind` for `c`. */
-predicate lambdaCreation(Node creation, LambdaCallKind kind, DataFlowCallable c) { none() }
-
-/** Holds if `call` is a lambda call of kind `kind` where `receiver` is the lambda expression. */
-predicate lambdaCall(DataFlowCall call, LambdaCallKind kind, Node receiver) { none() }
-
-/** Extra data-flow steps needed for lambda flow analysis. */
-predicate additionalLambdaFlowStep(Node nodeFrom, Node nodeTo, boolean preservesValue) { none() }

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll

@@ -1,879 +0,0 @@
-/**
- * Provides C++-specific definitions for use in the data flow library.
- */
-
-private import cpp
-// The `ValueNumbering` library has to be imported right after `cpp` to ensure
-// that the cached IR gets the same checksum here as it does in queries that use
-// `ValueNumbering` without `DataFlow`.
-private import semmle.code.cpp.ir.ValueNumbering
-private import semmle.code.cpp.ir.IR
-private import semmle.code.cpp.controlflow.IRGuards
-private import semmle.code.cpp.models.interfaces.DataFlow
-
-cached
-private module Cached {
-  cached
-  newtype TIRDataFlowNode =
-    TInstructionNode(Instruction i) or
-    TOperandNode(Operand op) or
-    TVariableNode(Variable var)
-
-  cached
-  predicate localFlowStepCached(Node nodeFrom, Node nodeTo) {
-    simpleLocalFlowStep(nodeFrom, nodeTo)
-  }
-}
-
-private import Cached
-
-/**
- * A node in a data flow graph.
- *
- * A node can be either an expression, a parameter, or an uninitialized local
- * variable. Such nodes are created with `DataFlow::exprNode`,
- * `DataFlow::parameterNode`, and `DataFlow::uninitializedNode` respectively.
- */
-class Node extends TIRDataFlowNode {
-  /**
-   * INTERNAL: Do not use.
-   */
-  Declaration getEnclosingCallable() { none() } // overridden in subclasses
-
-  /** Gets the function to which this node belongs, if any. */
-  Function getFunction() { none() } // overridden in subclasses
-
-  /** Gets the type of this node. */
-  IRType getType() { none() } // overridden in subclasses
-
-  /** Gets the instruction corresponding to this node, if any. */
-  Instruction asInstruction() { result = this.(InstructionNode).getInstruction() }
-
-  /** Gets the operands corresponding to this node, if any. */
-  Operand asOperand() { result = this.(OperandNode).getOperand() }
-
-  /**
-   * Gets the non-conversion expression corresponding to this node, if any.
-   * This predicate only has a result on nodes that represent the value of
-   * evaluating the expression. For data flowing _out of_ an expression, like
-   * when an argument is passed by reference, use `asDefiningArgument` instead
-   * of `asExpr`.
-   *
-   * If this node strictly (in the sense of `asConvertedExpr`) corresponds to
-   * a `Conversion`, then the result is the underlying non-`Conversion` base
-   * expression.
-   */
-  Expr asExpr() { result = this.(ExprNode).getExpr() }
-
-  /**
-   * Gets the expression corresponding to this node, if any. The returned
-   * expression may be a `Conversion`.
-   */
-  Expr asConvertedExpr() { result = this.(ExprNode).getConvertedExpr() }
-
-  /**
-   * Gets the argument that defines this `DefinitionByReferenceNode`, if any.
-   * This predicate should be used instead of `asExpr` when referring to the
-   * value of a reference argument _after_ the call has returned. For example,
-   * in `f(&x)`, this predicate will have `&x` as its result for the `Node`
-   * that represents the new value of `x`.
-   */
-  Expr asDefiningArgument() { result = this.(DefinitionByReferenceNode).getArgument() }
-
-  /** Gets the positional parameter corresponding to this node, if any. */
-  Parameter asParameter() { result = this.(ExplicitParameterNode).getParameter() }
-
-  /**
-   * Gets the variable corresponding to this node, if any. This can be used for
-   * modeling flow in and out of global variables.
-   */
-  Variable asVariable() { result = this.(VariableNode).getVariable() }
-
-  /**
-   * Gets the expression that is partially defined by this node, if any.
-   *
-   * Partial definitions are created for field stores (`x.y = taint();` is a partial
-   * definition of `x`), and for calls that may change the value of an object (so
-   * `x.set(taint())` is a partial definition of `x`, and `transfer(&x, taint())` is
-   * a partial definition of `&x`).
-   */
-  Expr asPartialDefinition() { result = this.(PartialDefinitionNode).getDefinedExpr() }
-
-  /**
-   * DEPRECATED: See UninitializedNode.
-   *
-   * Gets the uninitialized local variable corresponding to this node, if
-   * any.
-   */
-  deprecated LocalVariable asUninitialized() { none() }
-
-  /**
-   * Gets an upper bound on the type of this node.
-   */
-  IRType getTypeBound() { result = getType() }
-
-  /** Gets the location of this element. */
-  Location getLocation() { none() } // overridden by subclasses
-
-  /**
-   * Holds if this element is at the specified location.
-   * The location spans column `startcolumn` of line `startline` to
-   * column `endcolumn` of line `endline` in file `filepath`.
-   * For more information, see
-   * [Locations](https://help.semmle.com/QL/learn-ql/ql/locations.html).
-   */
-  predicate hasLocationInfo(
-    string filepath, int startline, int startcolumn, int endline, int endcolumn
-  ) {
-    this.getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
-  }
-
-  /** Gets a textual representation of this element. */
-  string toString() { none() } // overridden by subclasses
-}
-
-/**
- * An instruction, viewed as a node in a data flow graph.
- */
-class InstructionNode extends Node, TInstructionNode {
-  Instruction instr;
-
-  InstructionNode() { this = TInstructionNode(instr) }
-
-  /** Gets the instruction corresponding to this node. */
-  Instruction getInstruction() { result = instr }
-
-  override Declaration getEnclosingCallable() { result = this.getFunction() }
-
-  override Function getFunction() { result = instr.getEnclosingFunction() }
-
-  override IRType getType() { result = instr.getResultIRType() }
-
-  override Location getLocation() { result = instr.getLocation() }
-
-  override string toString() {
-    // This predicate is overridden in subclasses. This default implementation
-    // does not use `Instruction.toString` because that's expensive to compute.
-    result = this.getInstruction().getOpcode().toString()
-  }
-}
-
-/**
- * An operand, viewed as a node in a data flow graph.
- */
-class OperandNode extends Node, TOperandNode {
-  Operand op;
-
-  OperandNode() { this = TOperandNode(op) }
-
-  /** Gets the operand corresponding to this node. */
-  Operand getOperand() { result = op }
-
-  override Declaration getEnclosingCallable() { result = this.getFunction() }
-
-  override Function getFunction() { result = op.getUse().getEnclosingFunction() }
-
-  override IRType getType() { result = op.getIRType() }
-
-  override Location getLocation() { result = op.getLocation() }
-
-  override string toString() { result = this.getOperand().toString() }
-}
-
-/**
- * An expression, viewed as a node in a data flow graph.
- */
-class ExprNode extends InstructionNode {
-  ExprNode() { exists(instr.getConvertedResultExpression()) }
-
-  /**
-   * Gets the non-conversion expression corresponding to this node, if any. If
-   * this node strictly (in the sense of `getConvertedExpr`) corresponds to a
-   * `Conversion`, then the result is that `Conversion`'s non-`Conversion` base
-   * expression.
-   */
-  Expr getExpr() { result = instr.getUnconvertedResultExpression() }
-
-  /**
-   * Gets the expression corresponding to this node, if any. The returned
-   * expression may be a `Conversion`.
-   */
-  Expr getConvertedExpr() { result = instr.getConvertedResultExpression() }
-
-  override string toString() { result = this.asConvertedExpr().toString() }
-}
-
-/**
- * INTERNAL: do not use. Translates a parameter/argument index into a negative
- * number that denotes the index of its side effect (pointer indirection).
- */
-bindingset[index]
-int getArgumentPosOfSideEffect(int index) {
-  // -1 -> -2
-  //  0 -> -3
-  //  1 -> -4
-  // ...
-  result = -3 - index
-}
-
-/**
- * The value of a parameter at function entry, viewed as a node in a data
- * flow graph. This includes both explicit parameters such as `x` in `f(x)`
- * and implicit parameters such as `this` in `x.f()`.
- *
- * To match a specific kind of parameter, consider using one of the subclasses
- * `ExplicitParameterNode`, `ThisParameterNode`, or
- * `ParameterIndirectionNode`.
- */
-class ParameterNode extends InstructionNode {
-  ParameterNode() {
-    // To avoid making this class abstract, we enumerate its values here
-    instr instanceof InitializeParameterInstruction
-    or
-    instr instanceof InitializeIndirectionInstruction
-  }
-
-  /**
-   * Holds if this node is the parameter of `f` at the specified position. The
-   * implicit `this` parameter is considered to have position `-1`, and
-   * pointer-indirection parameters are at further negative positions.
-   */
-  predicate isParameterOf(Function f, int pos) { none() } // overridden by subclasses
-}
-
-/** An explicit positional parameter, not including `this` or `...`. */
-private class ExplicitParameterNode extends ParameterNode {
-  override InitializeParameterInstruction instr;
-
-  ExplicitParameterNode() { exists(instr.getParameter()) }
-
-  override predicate isParameterOf(Function f, int pos) {
-    f.getParameter(pos) = instr.getParameter()
-  }
-
-  /** Gets the `Parameter` associated with this node. */
-  Parameter getParameter() { result = instr.getParameter() }
-
-  override string toString() { result = instr.getParameter().toString() }
-}
-
-/** An implicit `this` parameter. */
-class ThisParameterNode extends ParameterNode {
-  override InitializeParameterInstruction instr;
-
-  ThisParameterNode() { instr.getIRVariable() instanceof IRThisVariable }
-
-  override predicate isParameterOf(Function f, int pos) {
-    pos = -1 and instr.getEnclosingFunction() = f
-  }
-
-  override string toString() { result = "this" }
-}
-
-/** A synthetic parameter to model the pointed-to object of a pointer parameter. */
-class ParameterIndirectionNode extends ParameterNode {
-  override InitializeIndirectionInstruction instr;
-
-  override predicate isParameterOf(Function f, int pos) {
-    exists(int index |
-      instr.getEnclosingFunction() = f and
-      instr.hasIndex(index)
-    |
-      pos = getArgumentPosOfSideEffect(index)
-    )
-  }
-
-  override string toString() { result = "*" + instr.getIRVariable().toString() }
-}
-
-/**
- * DEPRECATED: Data flow was never an accurate way to determine what
- * expressions might be uninitialized. It errs on the side of saying that
- * everything is uninitialized, and this is even worse in the IR because the IR
- * doesn't use syntactic hints to rule out variables that are definitely
- * initialized.
- *
- * The value of an uninitialized local variable, viewed as a node in a data
- * flow graph.
- */
-deprecated class UninitializedNode extends Node {
-  UninitializedNode() { none() }
-
-  LocalVariable getLocalVariable() { none() }
-}
-
-/**
- * A node associated with an object after an operation that might have
- * changed its state.
- *
- * This can be either the argument to a callable after the callable returns
- * (which might have mutated the argument), or the qualifier of a field after
- * an update to the field.
- *
- * Nodes corresponding to AST elements, for example `ExprNode`, usually refer
- * to the value before the update with the exception of `ClassInstanceExpr`,
- * which represents the value after the constructor has run.
- *
- * This class exists to match the interface used by Java. There are currently no non-abstract
- * classes that extend it. When we implement field flow, we can revisit this.
- */
-abstract class PostUpdateNode extends InstructionNode {
-  /**
-   * Gets the node before the state update.
-   */
-  abstract Node getPreUpdateNode();
-}
-
-/**
- * The base class for nodes that perform "partial definitions".
- *
- * In contrast to a normal "definition", which provides a new value for
- * something, a partial definition is an expression that may affect a
- * value, but does not necessarily replace it entirely. For example:
- * ```
- * x.y = 1; // a partial definition of the object `x`.
- * x.y.z = 1; // a partial definition of the object `x.y`.
- * x.setY(1); // a partial definition of the object `x`.
- * setY(&x); // a partial definition of the object `x`.
- * ```
- */
-abstract private class PartialDefinitionNode extends PostUpdateNode {
-  abstract Expr getDefinedExpr();
-}
-
-private class ExplicitFieldStoreQualifierNode extends PartialDefinitionNode {
-  override ChiInstruction instr;
-  StoreInstruction store;
-
-  ExplicitFieldStoreQualifierNode() {
-    not instr.isResultConflated() and
-    instr.getPartial() = store and
-    (
-      instr.getUpdatedInterval(_, _) or
-      store.getDestinationAddress() instanceof FieldAddressInstruction
-    )
-  }
-
-  // By using an operand as the result of this predicate we avoid the dataflow inconsistency errors
-  // caused by having multiple nodes sharing the same pre update node. This inconsistency error can cause
-  // a tuple explosion in the big step dataflow relation since it can make many nodes be the entry node
-  // into a big step.
-  override Node getPreUpdateNode() { result.asOperand() = instr.getTotalOperand() }
-
-  override Expr getDefinedExpr() {
-    result =
-      store
-          .getDestinationAddress()
-          .(FieldAddressInstruction)
-          .getObjectAddress()
-          .getUnconvertedResultExpression()
-  }
-}
-
-/**
- * Not every store instruction generates a chi instruction that we can attach a PostUpdateNode to.
- * For instance, an update to a field of a struct containing only one field. Even if the store does
- * have a chi instruction, a subsequent use of the result of the store may be linked directly to the
- * result of the store as an inexact definition if the store totally overlaps the use. For these
- * cases we attach the PostUpdateNode to the store instruction. There's no obvious pre update node
- * for this case (as the entire memory is updated), so `getPreUpdateNode` is implemented as
- * `none()`.
- */
-private class ExplicitSingleFieldStoreQualifierNode extends PartialDefinitionNode {
-  override StoreInstruction instr;
-
-  ExplicitSingleFieldStoreQualifierNode() {
-    (
-      instr.getAUse().isDefinitionInexact()
-      or
-      not exists(ChiInstruction chi | chi.getPartial() = instr)
-    ) and
-    // Without this condition any store would create a `PostUpdateNode`.
-    instr.getDestinationAddress() instanceof FieldAddressInstruction
-  }
-
-  override Node getPreUpdateNode() { none() }
-
-  override Expr getDefinedExpr() {
-    result =
-      instr
-          .getDestinationAddress()
-          .(FieldAddressInstruction)
-          .getObjectAddress()
-          .getUnconvertedResultExpression()
-  }
-}
-
-private FieldAddressInstruction getFieldInstruction(Instruction instr) {
-  result = instr or
-  result = instr.(CopyValueInstruction).getUnary()
-}
-
-/**
- * The target of a `fieldStoreStepAfterArraySuppression` store step, which is used to convert
- * an `ArrayContent` to a `FieldContent` when the `WriteSideEffect` instruction stores
- * into a field. See the QLDoc for `suppressArrayRead` for an example of where such a conversion
- * is inserted.
- */
-private class WriteSideEffectFieldStoreQualifierNode extends PartialDefinitionNode {
-  override ChiInstruction instr;
-  WriteSideEffectInstruction write;
-  FieldAddressInstruction field;
-
-  WriteSideEffectFieldStoreQualifierNode() {
-    not instr.isResultConflated() and
-    instr.getPartial() = write and
-    field = getFieldInstruction(write.getDestinationAddress())
-  }
-
-  override Node getPreUpdateNode() { result.asOperand() = instr.getTotalOperand() }
-
-  override Expr getDefinedExpr() {
-    result = field.getObjectAddress().getUnconvertedResultExpression()
-  }
-}
-
-/**
- * The `PostUpdateNode` that is the target of a `arrayStoreStepChi` store step. The overriden
- * `ChiInstruction` corresponds to the instruction represented by `node2` in `arrayStoreStepChi`.
- */
-private class ArrayStoreNode extends PartialDefinitionNode {
-  override ChiInstruction instr;
-  PointerAddInstruction add;
-
-  ArrayStoreNode() {
-    not instr.isResultConflated() and
-    exists(StoreInstruction store |
-      instr.getPartial() = store and
-      add = store.getDestinationAddress()
-    )
-  }
-
-  override Node getPreUpdateNode() { result.asOperand() = instr.getTotalOperand() }
-
-  override Expr getDefinedExpr() { result = add.getLeft().getUnconvertedResultExpression() }
-}
-
-/**
- * The `PostUpdateNode` that is the target of a `arrayStoreStepChi` store step. The overriden
- * `ChiInstruction` corresponds to the instruction represented by `node2` in `arrayStoreStepChi`.
- */
-private class PointerStoreNode extends PostUpdateNode {
-  override ChiInstruction instr;
-
-  PointerStoreNode() {
-    not instr.isResultConflated() and
-    exists(StoreInstruction store |
-      instr.getPartial() = store and
-      store.getDestinationAddress().(CopyValueInstruction).getUnary() instanceof LoadInstruction
-    )
-  }
-
-  override Node getPreUpdateNode() { result.asOperand() = instr.getTotalOperand() }
-}
-
-/**
- * A node that represents the value of a variable after a function call that
- * may have changed the variable because it's passed by reference.
- *
- * A typical example would be a call `f(&x)`. Firstly, there will be flow into
- * `x` from previous definitions of `x`. Secondly, there will be a
- * `DefinitionByReferenceNode` to represent the value of `x` after the call has
- * returned. This node will have its `getArgument()` equal to `&x` and its
- * `getVariableAccess()` equal to `x`.
- */
-class DefinitionByReferenceNode extends InstructionNode {
-  override WriteSideEffectInstruction instr;
-
-  /** Gets the unconverted argument corresponding to this node. */
-  Expr getArgument() {
-    result =
-      instr
-          .getPrimaryInstruction()
-          .(CallInstruction)
-          .getArgument(instr.getIndex())
-          .getUnconvertedResultExpression()
-  }
-
-  /** Gets the parameter through which this value is assigned. */
-  Parameter getParameter() {
-    exists(CallInstruction ci | result = ci.getStaticCallTarget().getParameter(instr.getIndex()))
-  }
-
-  override string toString() {
-    // This string should be unique enough to be helpful but common enough to
-    // avoid storing too many different strings.
-    result =
-      instr.getPrimaryInstruction().(CallInstruction).getStaticCallTarget().getName() +
-        " output argument"
-    or
-    not exists(instr.getPrimaryInstruction().(CallInstruction).getStaticCallTarget()) and
-    result = "output argument"
-  }
-}
-
-/**
- * A `Node` corresponding to a variable in the program, as opposed to the
- * value of that variable at some particular point. This can be used for
- * modeling flow in and out of global variables.
- */
-class VariableNode extends Node, TVariableNode {
-  Variable v;
-
-  VariableNode() { this = TVariableNode(v) }
-
-  /** Gets the variable corresponding to this node. */
-  Variable getVariable() { result = v }
-
-  override Function getFunction() { none() }
-
-  override Declaration getEnclosingCallable() {
-    // When flow crosses from one _enclosing callable_ to another, the
-    // interprocedural data-flow library discards call contexts and inserts a
-    // node in the big-step relation used for human-readable path explanations.
-    // Therefore we want a distinct enclosing callable for each `VariableNode`,
-    // and that can be the `Variable` itself.
-    result = v
-  }
-
-  override IRType getType() { result.getCanonicalLanguageType().hasUnspecifiedType(v.getType(), _) }
-
-  override Location getLocation() { result = v.getLocation() }
-
-  override string toString() { result = v.toString() }
-}
-
-/**
- * Gets the node corresponding to `instr`.
- */
-InstructionNode instructionNode(Instruction instr) { result.getInstruction() = instr }
-
-/**
- * DEPRECATED: use `definitionByReferenceNodeFromArgument` instead.
- *
- * Gets the `Node` corresponding to a definition by reference of the variable
- * that is passed as `argument` of a call.
- */
-deprecated DefinitionByReferenceNode definitionByReferenceNode(Expr e) { result.getArgument() = e }
-
-/**
- * Gets the `Node` corresponding to the value of evaluating `e` or any of its
- * conversions. There is no result if `e` is a `Conversion`. For data flowing
- * _out of_ an expression, like when an argument is passed by reference, use
- * `definitionByReferenceNodeFromArgument` instead.
- */
-ExprNode exprNode(Expr e) { result.getExpr() = e }
-
-/**
- * Gets the `Node` corresponding to the value of evaluating `e`. Here, `e` may
- * be a `Conversion`. For data flowing _out of_ an expression, like when an
- * argument is passed by reference, use
- * `definitionByReferenceNodeFromArgument` instead.
- */
-ExprNode convertedExprNode(Expr e) { result.getConvertedExpr() = e }
-
-/**
- * Gets the `Node` corresponding to the value of `p` at function entry.
- */
-ExplicitParameterNode parameterNode(Parameter p) { result.getParameter() = p }
-
-/**
- * Gets the `Node` corresponding to a definition by reference of the variable
- * that is passed as unconverted `argument` of a call.
- */
-DefinitionByReferenceNode definitionByReferenceNodeFromArgument(Expr argument) {
-  result.getArgument() = argument
-}
-
-/** Gets the `VariableNode` corresponding to the variable `v`. */
-VariableNode variableNode(Variable v) { result.getVariable() = v }
-
-/**
- * DEPRECATED: See UninitializedNode.
- *
- * Gets the `Node` corresponding to the value of an uninitialized local
- * variable `v`.
- */
-Node uninitializedNode(LocalVariable v) { none() }
-
-/**
- * Holds if data flows from `nodeFrom` to `nodeTo` in exactly one local
- * (intra-procedural) step.
- */
-predicate localFlowStep = localFlowStepCached/2;
-
-/**
- * INTERNAL: do not use.
- *
- * This is the local flow predicate that's used as a building block in global
- * data flow. It may have less flow than the `localFlowStep` predicate.
- */
-predicate simpleLocalFlowStep(Node nodeFrom, Node nodeTo) {
-  // Operand -> Instruction flow
-  simpleInstructionLocalFlowStep(nodeFrom.asOperand(), nodeTo.asInstruction())
-  or
-  // Instruction -> Operand flow
-  simpleOperandLocalFlowStep(nodeFrom.asInstruction(), nodeTo.asOperand())
-}
-
-pragma[noinline]
-private predicate getFieldSizeOfClass(Class c, Type type, int size) {
-  exists(Field f |
-    f.getDeclaringType() = c and
-    f.getUnderlyingType() = type and
-    type.getSize() = size
-  )
-}
-
-private predicate isSingleFieldClass(Type type, Operand op) {
-  exists(int size, Class c |
-    c = op.getType().getUnderlyingType() and
-    c.getSize() = size and
-    getFieldSizeOfClass(c, type, size)
-  )
-}
-
-private predicate simpleOperandLocalFlowStep(Instruction iFrom, Operand opTo) {
-  // Propagate flow from an instruction to its exact uses.
-  opTo.getDef() = iFrom
-  or
-  opTo = any(ReadSideEffectInstruction read).getSideEffectOperand() and
-  not iFrom.isResultConflated() and
-  iFrom = opTo.getAnyDef()
-  or
-  // Loading a single `int` from an `int *` parameter is not an exact load since
-  // the parameter may point to an entire array rather than a single `int`. The
-  // following rule ensures that any flow going into the
-  // `InitializeIndirectionInstruction`, even if it's for a different array
-  // element, will propagate to a load of the first element.
-  //
-  // Since we're linking `InitializeIndirectionInstruction` and
-  // `LoadInstruction` together directly, this rule will break if there's any
-  // reassignment of the parameter indirection, including a conditional one that
-  // leads to a phi node.
-  exists(InitializeIndirectionInstruction init |
-    iFrom = init and
-    opTo.(LoadOperand).getAnyDef() = init and
-    // Check that the types match. Otherwise we can get flow from an object to
-    // its fields, which leads to field conflation when there's flow from other
-    // fields to the object elsewhere.
-    init.getParameter().getType().getUnspecifiedType().(DerivedType).getBaseType() =
-      opTo.getType().getUnspecifiedType()
-  )
-  or
-  // Flow from stores to structs with a single field to a load of that field.
-  exists(LoadInstruction load |
-    load.getSourceValueOperand() = opTo and
-    opTo.getAnyDef() = iFrom and
-    isSingleFieldClass(pragma[only_bind_out](pragma[only_bind_out](iFrom).getResultType()), opTo)
-  )
-}
-
-private predicate simpleInstructionLocalFlowStep(Operand opFrom, Instruction iTo) {
-  iTo.(CopyInstruction).getSourceValueOperand() = opFrom
-  or
-  iTo.(PhiInstruction).getAnInputOperand() = opFrom
-  or
-  // Treat all conversions as flow, even conversions between different numeric types.
-  iTo.(ConvertInstruction).getUnaryOperand() = opFrom
-  or
-  iTo.(CheckedConvertOrNullInstruction).getUnaryOperand() = opFrom
-  or
-  iTo.(InheritanceConversionInstruction).getUnaryOperand() = opFrom
-  or
-  // A chi instruction represents a point where a new value (the _partial_
-  // operand) may overwrite an old value (the _total_ operand), but the alias
-  // analysis couldn't determine that it surely will overwrite every bit of it or
-  // that it surely will overwrite no bit of it.
-  //
-  // By allowing flow through the total operand, we ensure that flow is not lost
-  // due to shortcomings of the alias analysis. We may get false flow in cases
-  // where the data is indeed overwritten.
-  //
-  // Flow through the partial operand belongs in the taint-tracking libraries
-  // for now.
-  iTo.getAnOperand().(ChiTotalOperand) = opFrom
-  or
-  // Add flow from write side-effects to non-conflated chi instructions through their
-  // partial operands. From there, a `readStep` will find subsequent reads of that field.
-  // Consider the following example:
-  // ```
-  // void setX(Point* p, int new_x) {
-  //   p->x = new_x;
-  // }
-  // ...
-  // setX(&p, taint());
-  // ```
-  // Here, a `WriteSideEffectInstruction` will provide a new definition for `p->x` after the call to
-  // `setX`, which will be melded into `p` through a chi instruction.
-  exists(ChiInstruction chi | chi = iTo |
-    opFrom.getAnyDef() instanceof WriteSideEffectInstruction and
-    chi.getPartialOperand() = opFrom and
-    not chi.isResultConflated() and
-    // In a call such as `set_value(&x->val);` we don't want the memory representing `x` to receive
-    // dataflow by a simple step. Instead, this is handled by field flow. If we add a simple step here
-    // we can get field-to-object flow.
-    not chi.isPartialUpdate()
-  )
-  or
-  // Flow through modeled functions
-  modelFlow(opFrom, iTo)
-}
-
-private predicate modelFlow(Operand opFrom, Instruction iTo) {
-  exists(
-    CallInstruction call, DataFlowFunction func, FunctionInput modelIn, FunctionOutput modelOut
-  |
-    call.getStaticCallTarget() = func and
-    func.hasDataFlow(modelIn, modelOut)
-  |
-    (
-      modelOut.isReturnValue() and
-      iTo = call
-      or
-      // TODO: Add write side effects for return values
-      modelOut.isReturnValueDeref() and
-      iTo = call
-      or
-      exists(int index, WriteSideEffectInstruction outNode |
-        modelOut.isParameterDerefOrQualifierObject(index) and
-        iTo = outNode and
-        outNode = getSideEffectFor(call, index)
-      )
-    ) and
-    (
-      exists(int index |
-        modelIn.isParameterOrQualifierAddress(index) and
-        opFrom = call.getArgumentOperand(index)
-      )
-      or
-      exists(int index, ReadSideEffectInstruction read |
-        modelIn.isParameterDerefOrQualifierObject(index) and
-        read = getSideEffectFor(call, index) and
-        opFrom = read.getSideEffectOperand()
-      )
-    )
-  )
-}
-
-/**
- * Holds if the result is a side effect for instruction `call` on argument
- * index `argument`. This helper predicate makes it easy to join on both of
- * these columns at once, avoiding pathological join orders in case the
- * argument index should get joined first.
- */
-pragma[noinline]
-SideEffectInstruction getSideEffectFor(CallInstruction call, int argument) {
-  call = result.getPrimaryInstruction() and
-  argument = result.(IndexedInstruction).getIndex()
-}
-
-/**
- * Holds if data flows from `source` to `sink` in zero or more local
- * (intra-procedural) steps.
- */
-predicate localFlow(Node source, Node sink) { localFlowStep*(source, sink) }
-
-/**
- * Holds if data can flow from `i1` to `i2` in zero or more
- * local (intra-procedural) steps.
- */
-predicate localInstructionFlow(Instruction e1, Instruction e2) {
-  localFlow(instructionNode(e1), instructionNode(e2))
-}
-
-/**
- * Holds if data can flow from `e1` to `e2` in zero or more
- * local (intra-procedural) steps.
- */
-predicate localExprFlow(Expr e1, Expr e2) { localFlow(exprNode(e1), exprNode(e2)) }
-
-/**
- * Gets a field corresponding to the bit range `[startBit..endBit)` of class `c`, if any.
- */
-private Field getAField(Class c, int startBit, int endBit) {
-  result.getDeclaringType() = c and
-  startBit = 8 * result.getByteOffset() and
-  endBit = 8 * result.getType().getSize() + startBit
-  or
-  exists(Field f, Class cInner |
-    f = c.getAField() and
-    cInner = f.getUnderlyingType() and
-    result = getAField(cInner, startBit - 8 * f.getByteOffset(), endBit - 8 * f.getByteOffset())
-  )
-}
-
-private newtype TContent =
-  TFieldContent(Class c, int startBit, int endBit) { exists(getAField(c, startBit, endBit)) } or
-  TCollectionContent() or
-  TArrayContent()
-
-/**
- * A description of the way data may be stored inside an object. Examples
- * include instance fields, the contents of a collection object, or the contents
- * of an array.
- */
-class Content extends TContent {
-  /** Gets a textual representation of this element. */
-  abstract string toString();
-
-  predicate hasLocationInfo(string path, int sl, int sc, int el, int ec) {
-    path = "" and sl = 0 and sc = 0 and el = 0 and ec = 0
-  }
-}
-
-/** A reference through an instance field. */
-class FieldContent extends Content, TFieldContent {
-  Class c;
-  int startBit;
-  int endBit;
-
-  FieldContent() { this = TFieldContent(c, startBit, endBit) }
-
-  // Ensure that there's just 1 result for `toString`.
-  override string toString() { result = min(Field f | f = getAField() | f.toString()) }
-
-  predicate hasOffset(Class cl, int start, int end) { cl = c and start = startBit and end = endBit }
-
-  Field getAField() { result = getAField(c, startBit, endBit) }
-}
-
-/** A reference through an array. */
-class ArrayContent extends Content, TArrayContent {
-  override string toString() { result = "[]" }
-}
-
-/** A reference through the contents of some collection-like container. */
-private class CollectionContent extends Content, TCollectionContent {
-  override string toString() { result = "<element>" }
-}
-
-/**
- * A guard that validates some instruction.
- *
- * To use this in a configuration, extend the class and provide a
- * characteristic predicate precisely specifying the guard, and override
- * `checks` to specify what is being validated and in which branch.
- *
- * It is important that all extending classes in scope are disjoint.
- */
-class BarrierGuard extends IRGuardCondition {
-  /** Override this predicate to hold if this guard validates `instr` upon evaluating to `b`. */
-  predicate checksInstr(Instruction instr, boolean b) { none() }
-
-  /** Override this predicate to hold if this guard validates `expr` upon evaluating to `b`. */
-  predicate checks(Expr e, boolean b) { none() }
-
-  /** Gets a node guarded by this guard. */
-  final Node getAGuardedNode() {
-    exists(ValueNumber value, boolean edge |
-      (
-        this.checksInstr(value.getAnInstruction(), edge)
-        or
-        this.checks(value.getAnInstruction().getConvertedResultExpression(), edge)
-      ) and
-      result.asInstruction() = value.getAnInstruction() and
-      this.controls(result.asInstruction().getBlock(), edge)
-    )
-  }
-}

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/ModelUtil.qll

@@ -1,42 +0,0 @@
-/**
- * Provides predicates for mapping the `FunctionInput` and `FunctionOutput`
- * classes used in function models to the corresponding instructions.
- */
-
-private import semmle.code.cpp.ir.IR
-private import semmle.code.cpp.ir.dataflow.DataFlow
-
-/**
- * Gets the instruction that goes into `input` for `call`.
- */
-Operand callInput(CallInstruction call, FunctionInput input) {
-  // An argument or qualifier
-  exists(int index |
-    result = call.getArgumentOperand(index) and
-    input.isParameterOrQualifierAddress(index)
-  )
-  or
-  // A value pointed to by an argument or qualifier
-  exists(ReadSideEffectInstruction read |
-    result = read.getSideEffectOperand() and
-    read.getPrimaryInstruction() = call and
-    input.isParameterDerefOrQualifierObject(read.getIndex())
-  )
-}
-
-/**
- * Gets the instruction that holds the `output` for `call`.
- */
-Instruction callOutput(CallInstruction call, FunctionOutput output) {
-  // The return value
-  result = call and
-  output.isReturnValue()
-  or
-  // The side effect of a call on the value pointed to by an argument or qualifier
-  exists(WriteSideEffectInstruction effect |
-    result = effect and
-    effect.getPrimaryInstruction() = call and
-    output.isParameterDerefOrQualifierObject(effect.getIndex())
-  )
-  // TODO: return value dereference
-}

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/PrintIRStoreSteps.qll

@@ -1,33 +0,0 @@
-/**
- * Print the dataflow local store steps in IR dumps.
- */
-
-private import cpp
-// The `ValueNumbering` library has to be imported right after `cpp` to ensure
-// that the cached IR gets the same checksum here as it does in queries that use
-// `ValueNumbering` without `DataFlow`.
-private import semmle.code.cpp.ir.ValueNumbering
-private import semmle.code.cpp.ir.IR
-private import semmle.code.cpp.ir.dataflow.DataFlow
-private import semmle.code.cpp.ir.dataflow.internal.DataFlowUtil
-private import semmle.code.cpp.ir.dataflow.internal.DataFlowPrivate
-private import PrintIRUtilities
-
-/**
- * Property provider for local IR dataflow store steps.
- */
-class LocalFlowPropertyProvider extends IRPropertyProvider {
-  override string getInstructionProperty(Instruction instruction, string key) {
-    exists(DataFlow::Node objectNode, Content content |
-      key = "content[" + content.toString() + "]" and
-      instruction = objectNode.asInstruction() and
-      result =
-        strictconcat(string element, DataFlow::Node fieldNode |
-          storeStep(fieldNode, content, objectNode) and
-          element = nodeId(fieldNode, _, _)
-        |
-          element, ", "
-        )
-    )
-  }
-}

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/PrintIRUtilities.qll

@@ -1,39 +0,0 @@
-/**
- * Shared utilities used when printing dataflow annotations in IR dumps.
- */
-
-private import cpp
-// The `ValueNumbering` library has to be imported right after `cpp` to ensure
-// that the cached IR gets the same checksum here as it does in queries that use
-// `ValueNumbering` without `DataFlow`.
-private import semmle.code.cpp.ir.ValueNumbering
-private import semmle.code.cpp.ir.IR
-private import semmle.code.cpp.ir.dataflow.DataFlow
-
-/**
- * Gets a short ID for an IR dataflow node.
- * - For `Instruction`s, this is just the result ID of the instruction (e.g. `m128`).
- * - For `Operand`s, this is the label of the operand, prefixed with the result ID of the
- *   instruction and a dot (e.g. `m128.left`).
- * - For `Variable`s, this is the qualified name of the variable.
- */
-string nodeId(DataFlow::Node node, int order1, int order2) {
-  exists(Instruction instruction | instruction = node.asInstruction() |
-    result = instruction.getResultId() and
-    order1 = instruction.getBlock().getDisplayIndex() and
-    order2 = instruction.getDisplayIndexInBlock()
-  )
-  or
-  exists(Operand operand, Instruction instruction |
-    operand = node.asOperand() and
-    instruction = operand.getUse()
-  |
-    result = instruction.getResultId() + "." + operand.getDumpId() and
-    order1 = instruction.getBlock().getDisplayIndex() and
-    order2 = instruction.getDisplayIndexInBlock()
-  )
-  or
-  result = "var(" + node.asVariable().getQualifiedName() + ")" and
-  order1 = 1000000 and
-  order2 = 0
-}

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/TaintTrackingUtil.qll

@@ -1,223 +0,0 @@
-private import semmle.code.cpp.ir.IR
-private import semmle.code.cpp.ir.dataflow.DataFlow
-private import ModelUtil
-private import semmle.code.cpp.models.interfaces.DataFlow
-private import semmle.code.cpp.models.interfaces.SideEffect
-
-/**
- * Holds if taint propagates from `nodeFrom` to `nodeTo` in exactly one local
- * (intra-procedural) step.
- */
-predicate localTaintStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
-  DataFlow::localFlowStep(nodeFrom, nodeTo)
-  or
-  localAdditionalTaintStep(nodeFrom, nodeTo)
-}
-
-/**
- * Holds if taint can flow in one local step from `nodeFrom` to `nodeTo` excluding
- * local data flow steps. That is, `nodeFrom` and `nodeTo` are likely to represent
- * different objects.
- */
-cached
-predicate localAdditionalTaintStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
-  operandToInstructionTaintStep(nodeFrom.asOperand(), nodeTo.asInstruction())
-  or
-  instructionToOperandTaintStep(nodeFrom.asInstruction(), nodeTo.asOperand())
-}
-
-private predicate instructionToOperandTaintStep(Instruction fromInstr, Operand toOperand) {
-  // Propagate flow from the definition of an operand to the operand, even when the overlap is inexact.
-  // We only do this in certain cases:
-  // 1. The instruction's result must not be conflated, and
-  // 2. The instruction's result type is one the types where we expect element-to-object flow. Currently
-  // this is array types and union types. This matches the other two cases of element-to-object flow in
-  // `DefaultTaintTracking`.
-  toOperand.getAnyDef() = fromInstr and
-  not fromInstr.isResultConflated() and
-  (
-    fromInstr.getResultType() instanceof ArrayType or
-    fromInstr.getResultType() instanceof Union
-  )
-  or
-  exists(ReadSideEffectInstruction readInstr |
-    fromInstr = readInstr.getArgumentDef() and
-    toOperand = readInstr.getSideEffectOperand()
-  )
-  or
-  toOperand.(LoadOperand).getAnyDef() = fromInstr
-}
-
-/**
- * Holds if taint propagates from `nodeFrom` to `nodeTo` in exactly one local
- * (intra-procedural) step.
- */
-private predicate operandToInstructionTaintStep(Operand opFrom, Instruction instrTo) {
-  // Taint can flow through expressions that alter the value but preserve
-  // more than one bit of it _or_ expressions that follow data through
-  // pointer indirections.
-  instrTo.getAnOperand() = opFrom and
-  (
-    instrTo instanceof ArithmeticInstruction
-    or
-    instrTo instanceof BitwiseInstruction
-    or
-    instrTo instanceof PointerArithmeticInstruction
-    or
-    // The `CopyInstruction` case is also present in non-taint data flow, but
-    // that uses `getDef` rather than `getAnyDef`. For taint, we want flow
-    // from a definition of `myStruct` to a `myStruct.myField` expression.
-    instrTo instanceof CopyInstruction
-  )
-  or
-  // Unary instructions tend to preserve enough information in practice that we
-  // want taint to flow through.
-  // The exception is `FieldAddressInstruction`. Together with the rules below for
-  // `LoadInstruction`s and `ChiInstruction`s, flow through `FieldAddressInstruction`
-  // could cause flow into one field to come out an unrelated field.
-  // This would happen across function boundaries, where the IR would not be able to
-  // match loads to stores.
-  instrTo.(UnaryInstruction).getUnaryOperand() = opFrom and
-  (
-    not instrTo instanceof FieldAddressInstruction
-    or
-    instrTo.(FieldAddressInstruction).getField().getDeclaringType() instanceof Union
-  )
-  or
-  instrTo.(LoadInstruction).getSourceAddressOperand() = opFrom
-  or
-  // Flow from an element to an array or union that contains it.
-  instrTo.(ChiInstruction).getPartialOperand() = opFrom and
-  not instrTo.isResultConflated() and
-  exists(Type t | instrTo.getResultLanguageType().hasType(t, false) |
-    t instanceof Union
-    or
-    t instanceof ArrayType
-  )
-  or
-  // Until we have flow through indirections across calls, we'll take flow out
-  // of the indirection and into the argument.
-  // When we get proper flow through indirections across calls, this code can be
-  // moved to `adjusedSink` or possibly into the `DataFlow::ExprNode` class.
-  exists(ReadSideEffectInstruction read |
-    read.getSideEffectOperand() = opFrom and
-    read.getArgumentDef() = instrTo
-  )
-  or
-  // Until we have from through indirections across calls, we'll take flow out
-  // of the parameter and into its indirection.
-  // `InitializeIndirectionInstruction` only has a single operand: the address of the
-  // value whose indirection we are initializing. When initializing an indirection of a parameter `p`,
-  // the IR looks like this:
-  // ```
-  // m1 = InitializeParameter[p] : &r1
-  // r2 = Load[p] : r2, m1
-  // m3 = InitializeIndirection[p] : &r2
-  // ```
-  // So by having flow from `r2` to `m3` we're enabling flow from `m1` to `m3`. This relies on the
-  // `LoadOperand`'s overlap being exact.
-  instrTo.(InitializeIndirectionInstruction).getAnOperand() = opFrom
-  or
-  modeledTaintStep(opFrom, instrTo)
-}
-
-/**
- * Holds if taint may propagate from `source` to `sink` in zero or more local
- * (intra-procedural) steps.
- */
-predicate localTaint(DataFlow::Node source, DataFlow::Node sink) { localTaintStep*(source, sink) }
-
-/**
- * Holds if taint can flow from `i1` to `i2` in zero or more
- * local (intra-procedural) steps.
- */
-predicate localInstructionTaint(Instruction i1, Instruction i2) {
-  localTaint(DataFlow::instructionNode(i1), DataFlow::instructionNode(i2))
-}
-
-/**
- * Holds if taint can flow from `e1` to `e2` in zero or more
- * local (intra-procedural) steps.
- */
-predicate localExprTaint(Expr e1, Expr e2) {
-  localTaint(DataFlow::exprNode(e1), DataFlow::exprNode(e2))
-}
-
-/**
- * Holds if the additional step from `src` to `sink` should be included in all
- * global taint flow configurations.
- */
-predicate defaultAdditionalTaintStep(DataFlow::Node src, DataFlow::Node sink) {
-  localAdditionalTaintStep(src, sink)
-}
-
-/**
- * Holds if default `TaintTracking::Configuration`s should allow implicit reads
- * of `c` at sinks and inputs to additional taint steps.
- */
-bindingset[node]
-predicate defaultImplicitTaintRead(DataFlow::Node node, DataFlow::Content c) { none() }
-
-/**
- * Holds if `node` should be a sanitizer in all global taint flow configurations
- * but not in local taint.
- */
-predicate defaultTaintSanitizer(DataFlow::Node node) { none() }
-
-/**
- * Holds if taint can flow from `instrIn` to `instrOut` through a call to a
- * modeled function.
- */
-predicate modeledTaintStep(Operand nodeIn, Instruction nodeOut) {
-  exists(CallInstruction call, TaintFunction func, FunctionInput modelIn, FunctionOutput modelOut |
-    (
-      nodeIn = callInput(call, modelIn)
-      or
-      exists(int n |
-        modelIn.isParameterDerefOrQualifierObject(n) and
-        if n = -1
-        then nodeIn = callInput(call, any(InQualifierObject inQualifier))
-        else nodeIn = callInput(call, any(InParameter inParam | inParam.getIndex() = n))
-      )
-    ) and
-    nodeOut = callOutput(call, modelOut) and
-    call.getStaticCallTarget() = func and
-    func.hasTaintFlow(modelIn, modelOut)
-  )
-  or
-  // Taint flow from one argument to another and data flow from an argument to a
-  // return value. This happens in functions like `strcat` and `memcpy`. We
-  // could model this flow in two separate steps, but that would add reverse
-  // flow from the write side-effect to the call instruction, which may not be
-  // desirable.
-  exists(
-    CallInstruction call, Function func, FunctionInput modelIn, OutParameterDeref modelMidOut,
-    int indexMid, InParameter modelMidIn, OutReturnValue modelOut
-  |
-    nodeIn = callInput(call, modelIn) and
-    nodeOut = callOutput(call, modelOut) and
-    call.getStaticCallTarget() = func and
-    func.(TaintFunction).hasTaintFlow(modelIn, modelMidOut) and
-    func.(DataFlowFunction).hasDataFlow(modelMidIn, modelOut) and
-    modelMidOut.isParameterDeref(indexMid) and
-    modelMidIn.isParameter(indexMid)
-  )
-  or
-  // Taint flow from a pointer argument to an output, when the model specifies flow from the deref
-  // to that output, but the deref is not modeled in the IR for the caller.
-  exists(
-    CallInstruction call, ReadSideEffectInstruction read, Function func, FunctionInput modelIn,
-    FunctionOutput modelOut
-  |
-    read.getSideEffectOperand() = callInput(call, modelIn) and
-    read.getArgumentDef() = nodeIn.getDef() and
-    not read.getSideEffect().isResultModeled() and
-    call.getStaticCallTarget() = func and
-    (
-      func.(DataFlowFunction).hasDataFlow(modelIn, modelOut)
-      or
-      func.(TaintFunction).hasTaintFlow(modelIn, modelOut)
-    ) and
-    nodeOut = callOutput(call, modelOut)
-  )
-}

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/tainttracking1/TaintTrackingImpl.qll

@@ -1,120 +0,0 @@
-/**
- * Provides an implementation of global (interprocedural) taint tracking.
- * This file re-exports the local (intraprocedural) taint-tracking analysis
- * from `TaintTrackingParameter::Public` and adds a global analysis, mainly
- * exposed through the `Configuration` class. For some languages, this file
- * exists in several identical copies, allowing queries to use multiple
- * `Configuration` classes that depend on each other without introducing
- * mutual recursion among those configurations.
- */
-
-import TaintTrackingParameter::Public
-private import TaintTrackingParameter::Private
-
-/**
- * A configuration of interprocedural taint tracking analysis. This defines
- * sources, sinks, and any other configurable aspect of the analysis. Each
- * use of the taint tracking library must define its own unique extension of
- * this abstract class.
- *
- * A taint-tracking configuration is a special data flow configuration
- * (`DataFlow::Configuration`) that allows for flow through nodes that do not
- * necessarily preserve values but are still relevant from a taint tracking
- * perspective. (For example, string concatenation, where one of the operands
- * is tainted.)
- *
- * To create a configuration, extend this class with a subclass whose
- * characteristic predicate is a unique singleton string. For example, write
- *
- * ```ql
- * class MyAnalysisConfiguration extends TaintTracking::Configuration {
- *   MyAnalysisConfiguration() { this = "MyAnalysisConfiguration" }
- *   // Override `isSource` and `isSink`.
- *   // Optionally override `isSanitizer`.
- *   // Optionally override `isSanitizerIn`.
- *   // Optionally override `isSanitizerOut`.
- *   // Optionally override `isSanitizerGuard`.
- *   // Optionally override `isAdditionalTaintStep`.
- * }
- * ```
- *
- * Then, to query whether there is flow between some `source` and `sink`,
- * write
- *
- * ```ql
- * exists(MyAnalysisConfiguration cfg | cfg.hasFlow(source, sink))
- * ```
- *
- * Multiple configurations can coexist, but it is unsupported to depend on
- * another `TaintTracking::Configuration` or a `DataFlow::Configuration` in the
- * overridden predicates that define sources, sinks, or additional steps.
- * Instead, the dependency should go to a `TaintTracking2::Configuration` or a
- * `DataFlow2::Configuration`, `DataFlow3::Configuration`, etc.
- */
-abstract class Configuration extends DataFlow::Configuration {
-  bindingset[this]
-  Configuration() { any() }
-
-  /**
-   * Holds if `source` is a relevant taint source.
-   *
-   * The smaller this predicate is, the faster `hasFlow()` will converge.
-   */
-  // overridden to provide taint-tracking specific qldoc
-  abstract override predicate isSource(DataFlow::Node source);
-
-  /**
-   * Holds if `sink` is a relevant taint sink.
-   *
-   * The smaller this predicate is, the faster `hasFlow()` will converge.
-   */
-  // overridden to provide taint-tracking specific qldoc
-  abstract override predicate isSink(DataFlow::Node sink);
-
-  /** Holds if the node `node` is a taint sanitizer. */
-  predicate isSanitizer(DataFlow::Node node) { none() }
-
-  final override predicate isBarrier(DataFlow::Node node) {
-    isSanitizer(node) or
-    defaultTaintSanitizer(node)
-  }
-
-  /** Holds if taint propagation into `node` is prohibited. */
-  predicate isSanitizerIn(DataFlow::Node node) { none() }
-
-  final override predicate isBarrierIn(DataFlow::Node node) { isSanitizerIn(node) }
-
-  /** Holds if taint propagation out of `node` is prohibited. */
-  predicate isSanitizerOut(DataFlow::Node node) { none() }
-
-  final override predicate isBarrierOut(DataFlow::Node node) { isSanitizerOut(node) }
-
-  /** Holds if taint propagation through nodes guarded by `guard` is prohibited. */
-  predicate isSanitizerGuard(DataFlow::BarrierGuard guard) { none() }
-
-  final override predicate isBarrierGuard(DataFlow::BarrierGuard guard) { isSanitizerGuard(guard) }
-
-  /**
-   * Holds if the additional taint propagation step from `node1` to `node2`
-   * must be taken into account in the analysis.
-   */
-  predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) { none() }
-
-  final override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
-    isAdditionalTaintStep(node1, node2) or
-    defaultAdditionalTaintStep(node1, node2)
-  }
-
-  override predicate allowImplicitRead(DataFlow::Node node, DataFlow::Content c) {
-    (this.isSink(node) or this.isAdditionalTaintStep(node, _)) and
-    defaultImplicitTaintRead(node, c)
-  }
-
-  /**
-   * Holds if taint may flow from `source` to `sink` for this configuration.
-   */
-  // overridden to provide taint-tracking specific qldoc
-  override predicate hasFlow(DataFlow::Node source, DataFlow::Node sink) {
-    super.hasFlow(source, sink)
-  }
-}

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/tainttracking2/TaintTrackingImpl.qll

@@ -1,120 +0,0 @@
-/**
- * Provides an implementation of global (interprocedural) taint tracking.
- * This file re-exports the local (intraprocedural) taint-tracking analysis
- * from `TaintTrackingParameter::Public` and adds a global analysis, mainly
- * exposed through the `Configuration` class. For some languages, this file
- * exists in several identical copies, allowing queries to use multiple
- * `Configuration` classes that depend on each other without introducing
- * mutual recursion among those configurations.
- */
-
-import TaintTrackingParameter::Public
-private import TaintTrackingParameter::Private
-
-/**
- * A configuration of interprocedural taint tracking analysis. This defines
- * sources, sinks, and any other configurable aspect of the analysis. Each
- * use of the taint tracking library must define its own unique extension of
- * this abstract class.
- *
- * A taint-tracking configuration is a special data flow configuration
- * (`DataFlow::Configuration`) that allows for flow through nodes that do not
- * necessarily preserve values but are still relevant from a taint tracking
- * perspective. (For example, string concatenation, where one of the operands
- * is tainted.)
- *
- * To create a configuration, extend this class with a subclass whose
- * characteristic predicate is a unique singleton string. For example, write
- *
- * ```ql
- * class MyAnalysisConfiguration extends TaintTracking::Configuration {
- *   MyAnalysisConfiguration() { this = "MyAnalysisConfiguration" }
- *   // Override `isSource` and `isSink`.
- *   // Optionally override `isSanitizer`.
- *   // Optionally override `isSanitizerIn`.
- *   // Optionally override `isSanitizerOut`.
- *   // Optionally override `isSanitizerGuard`.
- *   // Optionally override `isAdditionalTaintStep`.
- * }
- * ```
- *
- * Then, to query whether there is flow between some `source` and `sink`,
- * write
- *
- * ```ql
- * exists(MyAnalysisConfiguration cfg | cfg.hasFlow(source, sink))
- * ```
- *
- * Multiple configurations can coexist, but it is unsupported to depend on
- * another `TaintTracking::Configuration` or a `DataFlow::Configuration` in the
- * overridden predicates that define sources, sinks, or additional steps.
- * Instead, the dependency should go to a `TaintTracking2::Configuration` or a
- * `DataFlow2::Configuration`, `DataFlow3::Configuration`, etc.
- */
-abstract class Configuration extends DataFlow::Configuration {
-  bindingset[this]
-  Configuration() { any() }
-
-  /**
-   * Holds if `source` is a relevant taint source.
-   *
-   * The smaller this predicate is, the faster `hasFlow()` will converge.
-   */
-  // overridden to provide taint-tracking specific qldoc
-  abstract override predicate isSource(DataFlow::Node source);
-
-  /**
-   * Holds if `sink` is a relevant taint sink.
-   *
-   * The smaller this predicate is, the faster `hasFlow()` will converge.
-   */
-  // overridden to provide taint-tracking specific qldoc
-  abstract override predicate isSink(DataFlow::Node sink);
-
-  /** Holds if the node `node` is a taint sanitizer. */
-  predicate isSanitizer(DataFlow::Node node) { none() }
-
-  final override predicate isBarrier(DataFlow::Node node) {
-    isSanitizer(node) or
-    defaultTaintSanitizer(node)
-  }
-
-  /** Holds if taint propagation into `node` is prohibited. */
-  predicate isSanitizerIn(DataFlow::Node node) { none() }
-
-  final override predicate isBarrierIn(DataFlow::Node node) { isSanitizerIn(node) }
-
-  /** Holds if taint propagation out of `node` is prohibited. */
-  predicate isSanitizerOut(DataFlow::Node node) { none() }
-
-  final override predicate isBarrierOut(DataFlow::Node node) { isSanitizerOut(node) }
-
-  /** Holds if taint propagation through nodes guarded by `guard` is prohibited. */
-  predicate isSanitizerGuard(DataFlow::BarrierGuard guard) { none() }
-
-  final override predicate isBarrierGuard(DataFlow::BarrierGuard guard) { isSanitizerGuard(guard) }
-
-  /**
-   * Holds if the additional taint propagation step from `node1` to `node2`
-   * must be taken into account in the analysis.
-   */
-  predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) { none() }
-
-  final override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
-    isAdditionalTaintStep(node1, node2) or
-    defaultAdditionalTaintStep(node1, node2)
-  }
-
-  override predicate allowImplicitRead(DataFlow::Node node, DataFlow::Content c) {
-    (this.isSink(node) or this.isAdditionalTaintStep(node, _)) and
-    defaultImplicitTaintRead(node, c)
-  }
-
-  /**
-   * Holds if taint may flow from `source` to `sink` for this configuration.
-   */
-  // overridden to provide taint-tracking specific qldoc
-  override predicate hasFlow(DataFlow::Node source, DataFlow::Node sink) {
-    super.hasFlow(source, sink)
-  }
-}

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/tainttracking3/TaintTrackingImpl.qll

@@ -1,120 +0,0 @@
-/**
- * Provides an implementation of global (interprocedural) taint tracking.
- * This file re-exports the local (intraprocedural) taint-tracking analysis
- * from `TaintTrackingParameter::Public` and adds a global analysis, mainly
- * exposed through the `Configuration` class. For some languages, this file
- * exists in several identical copies, allowing queries to use multiple
- * `Configuration` classes that depend on each other without introducing
- * mutual recursion among those configurations.
- */
-
-import TaintTrackingParameter::Public
-private import TaintTrackingParameter::Private
-
-/**
- * A configuration of interprocedural taint tracking analysis. This defines
- * sources, sinks, and any other configurable aspect of the analysis. Each
- * use of the taint tracking library must define its own unique extension of
- * this abstract class.
- *
- * A taint-tracking configuration is a special data flow configuration
- * (`DataFlow::Configuration`) that allows for flow through nodes that do not
- * necessarily preserve values but are still relevant from a taint tracking
- * perspective. (For example, string concatenation, where one of the operands
- * is tainted.)
- *
- * To create a configuration, extend this class with a subclass whose
- * characteristic predicate is a unique singleton string. For example, write
- *
- * ```ql
- * class MyAnalysisConfiguration extends TaintTracking::Configuration {
- *   MyAnalysisConfiguration() { this = "MyAnalysisConfiguration" }
- *   // Override `isSource` and `isSink`.
- *   // Optionally override `isSanitizer`.
- *   // Optionally override `isSanitizerIn`.
- *   // Optionally override `isSanitizerOut`.
- *   // Optionally override `isSanitizerGuard`.
- *   // Optionally override `isAdditionalTaintStep`.
- * }
- * ```
- *
- * Then, to query whether there is flow between some `source` and `sink`,
- * write
- *
- * ```ql
- * exists(MyAnalysisConfiguration cfg | cfg.hasFlow(source, sink))
- * ```
- *
- * Multiple configurations can coexist, but it is unsupported to depend on
- * another `TaintTracking::Configuration` or a `DataFlow::Configuration` in the
- * overridden predicates that define sources, sinks, or additional steps.
- * Instead, the dependency should go to a `TaintTracking2::Configuration` or a
- * `DataFlow2::Configuration`, `DataFlow3::Configuration`, etc.
- */
-abstract class Configuration extends DataFlow::Configuration {
-  bindingset[this]
-  Configuration() { any() }
-
-  /**
-   * Holds if `source` is a relevant taint source.
-   *
-   * The smaller this predicate is, the faster `hasFlow()` will converge.
-   */
-  // overridden to provide taint-tracking specific qldoc
-  abstract override predicate isSource(DataFlow::Node source);
-
-  /**
-   * Holds if `sink` is a relevant taint sink.
-   *
-   * The smaller this predicate is, the faster `hasFlow()` will converge.
-   */
-  // overridden to provide taint-tracking specific qldoc
-  abstract override predicate isSink(DataFlow::Node sink);
-
-  /** Holds if the node `node` is a taint sanitizer. */
-  predicate isSanitizer(DataFlow::Node node) { none() }
-
-  final override predicate isBarrier(DataFlow::Node node) {
-    isSanitizer(node) or
-    defaultTaintSanitizer(node)
-  }
-
-  /** Holds if taint propagation into `node` is prohibited. */
-  predicate isSanitizerIn(DataFlow::Node node) { none() }
-
-  final override predicate isBarrierIn(DataFlow::Node node) { isSanitizerIn(node) }
-
-  /** Holds if taint propagation out of `node` is prohibited. */
-  predicate isSanitizerOut(DataFlow::Node node) { none() }
-
-  final override predicate isBarrierOut(DataFlow::Node node) { isSanitizerOut(node) }
-
-  /** Holds if taint propagation through nodes guarded by `guard` is prohibited. */
-  predicate isSanitizerGuard(DataFlow::BarrierGuard guard) { none() }
-
-  final override predicate isBarrierGuard(DataFlow::BarrierGuard guard) { isSanitizerGuard(guard) }
-
-  /**
-   * Holds if the additional taint propagation step from `node1` to `node2`
-   * must be taken into account in the analysis.
-   */
-  predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) { none() }
-
-  final override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
-    isAdditionalTaintStep(node1, node2) or
-    defaultAdditionalTaintStep(node1, node2)
-  }
-
-  override predicate allowImplicitRead(DataFlow::Node node, DataFlow::Content c) {
-    (this.isSink(node) or this.isAdditionalTaintStep(node, _)) and
-    defaultImplicitTaintRead(node, c)
-  }
-
-  /**
-   * Holds if taint may flow from `source` to `sink` for this configuration.
-   */
-  // overridden to provide taint-tracking specific qldoc
-  override predicate hasFlow(DataFlow::Node source, DataFlow::Node sink) {
-    super.hasFlow(source, sink)
-  }
-}

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/tainttracking3/TaintTrackingParameter.qll

@@ -1,5 +0,0 @@
-import semmle.code.cpp.ir.dataflow.internal.TaintTrackingUtil as Public
-
-module Private {
-  import semmle.code.cpp.ir.dataflow.DataFlow3::DataFlow3 as DataFlow
-}

cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/IRBlock.qll

@@ -1,331 +0,0 @@
-/**
- * Provides classes describing basic blocks in the IR of a function.
- */
-
-private import internal.IRInternal
-import Instruction
-private import internal.IRBlockImports as Imports
-import Imports::EdgeKind
-private import Cached
-
-/**
- * A basic block in the IR. A basic block consists of a sequence of `Instructions` with the only
- * incoming edges at the beginning of the sequence and the only outgoing edges at the end of the
- * sequence.
- *
- * This class does not contain any members that query the predecessor or successor edges of the
- * block. This allows different classes that extend `IRBlockBase` to expose different subsets of
- * edges (e.g. ignoring unreachable edges).
- *
- * Most consumers should use the class `IRBlock`.
- */
-class IRBlockBase extends TIRBlock {
-  /** Gets a textual representation of this block. */
-  final string toString() { result = getFirstInstruction(this).toString() }
-
-  /** Gets the source location of the first non-`Phi` instruction in this block. */
-  final Language::Location getLocation() { result = getFirstInstruction().getLocation() }
-
-  /**
-   * INTERNAL: Do not use.
-   *
-   * Gets the zero-based index of the block within its function.
-   *
-   * This predicate is used by debugging and printing code only.
-   */
-  int getDisplayIndex() {
-    exists(IRConfiguration::IRConfiguration config |
-      config.shouldEvaluateDebugStringsForFunction(this.getEnclosingFunction())
-    ) and
-    this =
-      rank[result + 1](IRBlock funcBlock, int sortOverride, int sortKey1, int sortKey2 |
-        funcBlock.getEnclosingFunction() = getEnclosingFunction() and
-        funcBlock.getFirstInstruction().hasSortKeys(sortKey1, sortKey2) and
-        // Ensure that the block containing `EnterFunction` always comes first.
-        if funcBlock.getFirstInstruction() instanceof EnterFunctionInstruction
-        then sortOverride = 0
-        else sortOverride = 1
-      |
-        funcBlock order by sortOverride, sortKey1, sortKey2
-      )
-  }
-
-  /**
-   * Gets the `index`th non-`Phi` instruction in this block.
-   */
-  final Instruction getInstruction(int index) { result = getInstruction(this, index) }
-
-  /**
-   * Get the `Phi` instructions that appear at the start of this block.
-   */
-  final PhiInstruction getAPhiInstruction() {
-    Construction::getPhiInstructionBlockStart(result) = getFirstInstruction()
-  }
-
-  /**
-   * Gets an instruction in this block. This includes `Phi` instructions.
-   */
-  final Instruction getAnInstruction() {
-    result = getInstruction(_) or
-    result = getAPhiInstruction()
-  }
-
-  /**
-   * Gets the first non-`Phi` instruction in this block.
-   */
-  final Instruction getFirstInstruction() { result = getFirstInstruction(this) }
-
-  /**
-   * Gets the last instruction in this block.
-   */
-  final Instruction getLastInstruction() { result = getInstruction(getInstructionCount() - 1) }
-
-  /**
-   * Gets the number of non-`Phi` instructions in this block.
-   */
-  final int getInstructionCount() { result = getInstructionCount(this) }
-
-  /**
-   * Gets the `IRFunction` that contains this block.
-   */
-  final IRFunction getEnclosingIRFunction() {
-    result = getFirstInstruction(this).getEnclosingIRFunction()
-  }
-
-  /**
-   * Gets the `Function` that contains this block.
-   */
-  final Language::Function getEnclosingFunction() {
-    result = getFirstInstruction(this).getEnclosingFunction()
-  }
-}
-
-/**
- * A basic block with additional information about its predecessor and successor edges. Each edge
- * corresponds to the control flow between the last instruction of one block and the first
- * instruction of another block.
- */
-class IRBlock extends IRBlockBase {
-  /**
-   * Gets a block to which control flows directly from this block.
-   */
-  final IRBlock getASuccessor() { blockSuccessor(this, result) }
-
-  /**
-   * Gets a block from which control flows directly to this block.
-   */
-  final IRBlock getAPredecessor() { blockSuccessor(result, this) }
-
-  /**
-   * Gets the block to which control flows directly from this block along an edge of kind `kind`.
-   */
-  final IRBlock getSuccessor(EdgeKind kind) { blockSuccessor(this, result, kind) }
-
-  /**
-   * Gets the block to which control flows directly from this block along a back edge of kind
-   * `kind`.
-   */
-  final IRBlock getBackEdgeSuccessor(EdgeKind kind) { backEdgeSuccessor(this, result, kind) }
-
-  /**
-   * Holds if this block immediately dominates `block`.
-   *
-   * Block `A` immediate dominates block `B` if block `A` strictly dominates block `B` and block `B`
-   * is a direct successor of block `A`.
-   */
-  final predicate immediatelyDominates(IRBlock block) { blockImmediatelyDominates(this, block) }
-
-  /**
-   * Holds if this block strictly dominates `block`.
-   *
-   * Block `A` strictly dominates block `B` if block `A` dominates block `B` and blocks `A` and `B`
-   * are not the same block.
-   */
-  final predicate strictlyDominates(IRBlock block) { blockImmediatelyDominates+(this, block) }
-
-  /**
-   * Holds if this block dominates `block`.
-   *
-   * Block `A` dominates block `B` if any control flow path from the entry block of the function to
-   * block `B` must pass through block `A`. A block always dominates itself.
-   */
-  final predicate dominates(IRBlock block) { strictlyDominates(block) or this = block }
-
-  /**
-   * Gets a block on the dominance frontier of this block.
-   *
-   * The dominance frontier of block `A` is the set of blocks `B` such that block `A` does not
-   * dominate block `B`, but block `A` does dominate an immediate predecessor of block `B`.
-   */
-  pragma[noinline]
-  final IRBlock dominanceFrontier() {
-    dominates(result.getAPredecessor()) and
-    not strictlyDominates(result)
-  }
-
-  /**
-   * Holds if this block immediately post-dominates `block`.
-   *
-   * Block `A` immediate post-dominates block `B` if block `A` strictly post-dominates block `B` and
-   * block `B` is a direct successor of block `A`.
-   */
-  final predicate immediatelyPostDominates(IRBlock block) {
-    blockImmediatelyPostDominates(this, block)
-  }
-
-  /**
-   * Holds if this block strictly post-dominates `block`.
-   *
-   * Block `A` strictly post-dominates block `B` if block `A` post-dominates block `B` and blocks `A`
-   * and `B` are not the same block.
-   */
-  final predicate strictlyPostDominates(IRBlock block) {
-    blockImmediatelyPostDominates+(this, block)
-  }
-
-  /**
-   * Holds if this block is a post-dominator of `block`.
-   *
-   * Block `A` post-dominates block `B` if any control flow path from `B` to the exit block of the
-   * function must pass through block `A`. A block always post-dominates itself.
-   */
-  final predicate postDominates(IRBlock block) { strictlyPostDominates(block) or this = block }
-
-  /**
-   * Gets a block on the post-dominance frontier of this block.
-   *
-   * The post-dominance frontier of block `A` is the set of blocks `B` such that block `A` does not
-   * post-dominate block `B`, but block `A` does post-dominate an immediate successor of block `B`.
-   */
-  pragma[noinline]
-  final IRBlock postPominanceFrontier() {
-    postDominates(result.getASuccessor()) and
-    not strictlyPostDominates(result)
-  }
-
-  /**
-   * Holds if this block is reachable from the entry block of its function.
-   */
-  final predicate isReachableFromFunctionEntry() {
-    this = getEnclosingIRFunction().getEntryBlock() or
-    getAPredecessor().isReachableFromFunctionEntry()
-  }
-}
-
-private predicate startsBasicBlock(Instruction instr) {
-  not instr instanceof PhiInstruction and
-  not adjacentInBlock(_, instr)
-}
-
-/** Holds if `i2` follows `i1` in a `IRBlock`. */
-private predicate adjacentInBlock(Instruction i1, Instruction i2) {
-  // - i2 must be the only successor of i1
-  i2 = unique(Instruction i | i = i1.getASuccessor()) and
-  // - i1 must be the only predecessor of i2
-  i1 = unique(Instruction i | i.getASuccessor() = i2) and
-  // - The edge between the two must be a GotoEdge. We just check that one
-  //   exists since we've already checked that it's unique.
-  exists(GotoEdge edgeKind | exists(i1.getSuccessor(edgeKind))) and
-  // - The edge must not be a back edge. This means we get the same back edges
-  //   in the basic-block graph as we do in the raw CFG.
-  not exists(Construction::getInstructionBackEdgeSuccessor(i1, _))
-  // This predicate could be simplified to remove one of the `unique`s if we
-  // were willing to rely on the CFG being well-formed and thus never having
-  // more than one successor to an instruction that has a `GotoEdge` out of it.
-}
-
-private predicate isEntryBlock(TIRBlock block) {
-  block = MkIRBlock(any(EnterFunctionInstruction enter))
-}
-
-cached
-private module Cached {
-  cached
-  newtype TIRBlock = MkIRBlock(Instruction firstInstr) { startsBasicBlock(firstInstr) }
-
-  /** Holds if `i` is the `index`th instruction the block starting with `first`. */
-  private Instruction getInstructionFromFirst(Instruction first, int index) =
-    shortestDistances(startsBasicBlock/1, adjacentInBlock/2)(first, result, index)
-
-  /** Holds if `i` is the `index`th instruction in `block`. */
-  cached
-  Instruction getInstruction(TIRBlock block, int index) {
-    result = getInstructionFromFirst(getFirstInstruction(block), index)
-  }
-
-  cached
-  int getInstructionCount(TIRBlock block) { result = strictcount(getInstruction(block, _)) }
-
-  cached
-  predicate blockSuccessor(TIRBlock pred, TIRBlock succ, EdgeKind kind) {
-    exists(Instruction predLast, Instruction succFirst |
-      predLast = getInstruction(pred, getInstructionCount(pred) - 1) and
-      succFirst = predLast.getSuccessor(kind) and
-      succ = MkIRBlock(succFirst)
-    )
-  }
-
-  pragma[noinline]
-  private predicate blockIdentity(TIRBlock b1, TIRBlock b2) { b1 = b2 }
-
-  pragma[noopt]
-  cached
-  predicate backEdgeSuccessor(TIRBlock pred, TIRBlock succ, EdgeKind kind) {
-    backEdgeSuccessorRaw(pred, succ, kind)
-    or
-    // See the QLDoc on `backEdgeSuccessorRaw`.
-    exists(TIRBlock pred2 |
-      // Joining with `blockIdentity` is a performance trick to get
-      // `forwardEdgeRaw` on the RHS of a join, where it's fast.
-      blockIdentity(pred, pred2) and
-      forwardEdgeRaw+(pred, pred2)
-    ) and
-    blockSuccessor(pred, succ, kind)
-  }
-
-  /**
-   * Holds if there is an edge from `pred` to `succ` that is not a back edge.
-   */
-  private predicate forwardEdgeRaw(TIRBlock pred, TIRBlock succ) {
-    exists(EdgeKind kind |
-      blockSuccessor(pred, succ, kind) and
-      not backEdgeSuccessorRaw(pred, succ, kind)
-    )
-  }
-
-  /**
-   * Holds if the `kind`-edge from `pred` to `succ` is a back edge according to
-   * `Construction`.
-   *
-   * There could be loops of non-back-edges if there is a flaw in the IR
-   * construction or back-edge detection, and this could cause non-termination
-   * of subsequent analysis. To prevent that, a subsequent predicate further
-   * classifies all edges as back edges if they are involved in a loop of
-   * non-back-edges.
-   */
-  private predicate backEdgeSuccessorRaw(TIRBlock pred, TIRBlock succ, EdgeKind kind) {
-    exists(Instruction predLast, Instruction succFirst |
-      predLast = getInstruction(pred, getInstructionCount(pred) - 1) and
-      succFirst = Construction::getInstructionBackEdgeSuccessor(predLast, kind) and
-      succ = MkIRBlock(succFirst)
-    )
-  }
-
-  cached
-  predicate blockSuccessor(TIRBlock pred, TIRBlock succ) { blockSuccessor(pred, succ, _) }
-
-  cached
-  predicate blockImmediatelyDominates(TIRBlock dominator, TIRBlock block) =
-    idominance(isEntryBlock/1, blockSuccessor/2)(_, dominator, block)
-}
-
-private Instruction getFirstInstruction(TIRBlock block) { block = MkIRBlock(result) }
-
-private predicate blockFunctionExit(IRBlock exit) {
-  exit.getLastInstruction() instanceof ExitFunctionInstruction
-}
-
-private predicate blockPredecessor(IRBlock src, IRBlock pred) { src.getAPredecessor() = pred }
-
-private predicate blockImmediatelyPostDominates(IRBlock postDominator, IRBlock block) =
-  idominance(blockFunctionExit/1, blockPredecessor/2)(_, postDominator, block)

cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/IRConsistency.qll

@@ -1,527 +0,0 @@
-private import IR
-import InstructionConsistency // module is below
-import IRTypeConsistency // module is in IRType.qll
-
-module InstructionConsistency {
-  private import internal.InstructionImports as Imports
-  private import Imports::OperandTag
-  private import Imports::Overlap
-  private import internal.IRInternal
-
-  private newtype TOptionalIRFunction =
-    TPresentIRFunction(IRFunction irFunc) or
-    TMissingIRFunction()
-
-  /**
-   * An `IRFunction` that might not exist. This is used so that we can produce consistency failures
-   * for IR that also incorrectly lacks a `getEnclosingIRFunction()`.
-   */
-  abstract private class OptionalIRFunction extends TOptionalIRFunction {
-    abstract string toString();
-
-    abstract Language::Location getLocation();
-  }
-
-  private class PresentIRFunction extends OptionalIRFunction, TPresentIRFunction {
-    private IRFunction irFunc;
-
-    PresentIRFunction() { this = TPresentIRFunction(irFunc) }
-
-    override string toString() {
-      result = concat(Language::getIdentityString(irFunc.getFunction()), "; ")
-    }
-
-    override Language::Location getLocation() {
-      // To avoid an overwhelming number of results when the extractor merges functions with the
-      // same name, just pick a single location.
-      result =
-        rank[1](Language::Location loc | loc = irFunc.getLocation() | loc order by loc.toString())
-    }
-  }
-
-  private class MissingIRFunction extends OptionalIRFunction, TMissingIRFunction {
-    override string toString() { result = "<Missing IRFunction>" }
-
-    override Language::Location getLocation() { result instanceof Language::UnknownDefaultLocation }
-  }
-
-  private OptionalIRFunction getInstructionIRFunction(Instruction instr) {
-    result = TPresentIRFunction(instr.getEnclosingIRFunction())
-    or
-    not exists(instr.getEnclosingIRFunction()) and result = TMissingIRFunction()
-  }
-
-  pragma[inline]
-  private OptionalIRFunction getInstructionIRFunction(Instruction instr, string irFuncText) {
-    result = getInstructionIRFunction(instr) and
-    irFuncText = result.toString()
-  }
-
-  private OptionalIRFunction getOperandIRFunction(Operand operand) {
-    result = TPresentIRFunction(operand.getEnclosingIRFunction())
-    or
-    not exists(operand.getEnclosingIRFunction()) and result = TMissingIRFunction()
-  }
-
-  pragma[inline]
-  private OptionalIRFunction getOperandIRFunction(Operand operand, string irFuncText) {
-    result = getOperandIRFunction(operand) and
-    irFuncText = result.toString()
-  }
-
-  private OptionalIRFunction getBlockIRFunction(IRBlock block) {
-    result = TPresentIRFunction(block.getEnclosingIRFunction())
-    or
-    not exists(block.getEnclosingIRFunction()) and result = TMissingIRFunction()
-  }
-
-  /**
-   * Holds if instruction `instr` is missing an expected operand with tag `tag`.
-   */
-  query predicate missingOperand(
-    Instruction instr, string message, OptionalIRFunction irFunc, string irFuncText
-  ) {
-    exists(OperandTag tag |
-      instr.getOpcode().hasOperand(tag) and
-      not exists(NonPhiOperand operand |
-        operand = instr.getAnOperand() and
-        operand.getOperandTag() = tag
-      ) and
-      message =
-        "Instruction '" + instr.getOpcode().toString() +
-          "' is missing an expected operand with tag '" + tag.toString() + "' in function '$@'." and
-      irFunc = getInstructionIRFunction(instr, irFuncText)
-    )
-  }
-
-  /**
-   * Holds if instruction `instr` has an unexpected operand with tag `tag`.
-   */
-  query predicate unexpectedOperand(
-    Instruction instr, string message, OptionalIRFunction irFunc, string irFuncText
-  ) {
-    exists(OperandTag tag |
-      exists(NonPhiOperand operand |
-        operand = instr.getAnOperand() and
-        operand.getOperandTag() = tag
-      ) and
-      not instr.getOpcode().hasOperand(tag) and
-      not (instr instanceof CallInstruction and tag instanceof ArgumentOperandTag) and
-      not (
-        instr instanceof BuiltInOperationInstruction and tag instanceof PositionalArgumentOperandTag
-      ) and
-      not (instr instanceof InlineAsmInstruction and tag instanceof AsmOperandTag) and
-      message =
-        "Instruction '" + instr.toString() + "' has unexpected operand '" + tag.toString() +
-          "' in function '$@'." and
-      irFunc = getInstructionIRFunction(instr, irFuncText)
-    )
-  }
-
-  /**
-   * Holds if instruction `instr` has multiple operands with tag `tag`.
-   */
-  query predicate duplicateOperand(
-    Instruction instr, string message, OptionalIRFunction irFunc, string irFuncText
-  ) {
-    exists(OperandTag tag, int operandCount |
-      operandCount =
-        strictcount(NonPhiOperand operand |
-          operand = instr.getAnOperand() and
-          operand.getOperandTag() = tag
-        ) and
-      operandCount > 1 and
-      message =
-        "Instruction has " + operandCount + " operands with tag '" + tag.toString() + "'" +
-          " in function '$@'." and
-      irFunc = getInstructionIRFunction(instr, irFuncText)
-    )
-  }
-
-  /**
-   * Holds if `Phi` instruction `instr` is missing an operand corresponding to
-   * the predecessor block `pred`.
-   */
-  query predicate missingPhiOperand(
-    PhiInstruction instr, string message, OptionalIRFunction irFunc, string irFuncText
-  ) {
-    exists(IRBlock pred |
-      pred = instr.getBlock().getAPredecessor() and
-      not exists(PhiInputOperand operand |
-        operand = instr.getAnOperand() and
-        operand.getPredecessorBlock() = pred
-      ) and
-      message =
-        "Instruction '" + instr.toString() + "' is missing an operand for predecessor block '" +
-          pred.toString() + "' in function '$@'." and
-      irFunc = getInstructionIRFunction(instr, irFuncText)
-    )
-  }
-
-  query predicate missingOperandType(
-    Operand operand, string message, OptionalIRFunction irFunc, string irFuncText
-  ) {
-    exists(Instruction use |
-      not exists(operand.getType()) and
-      use = operand.getUse() and
-      message =
-        "Operand '" + operand.toString() + "' of instruction '" + use.getOpcode().toString() +
-          "' is missing a type in function '$@'." and
-      irFunc = getOperandIRFunction(operand, irFuncText)
-    )
-  }
-
-  query predicate duplicateChiOperand(
-    ChiInstruction chi, string message, OptionalIRFunction irFunc, string irFuncText
-  ) {
-    chi.getTotal() = chi.getPartial() and
-    message =
-      "Chi instruction for " + chi.getPartial().toString() +
-        " has duplicate operands in function '$@'." and
-    irFunc = getInstructionIRFunction(chi, irFuncText)
-  }
-
-  query predicate sideEffectWithoutPrimary(
-    SideEffectInstruction instr, string message, OptionalIRFunction irFunc, string irFuncText
-  ) {
-    not exists(instr.getPrimaryInstruction()) and
-    message =
-      "Side effect instruction '" + instr + "' is missing a primary instruction in function '$@'." and
-    irFunc = getInstructionIRFunction(instr, irFuncText)
-  }
-
-  /**
-   * Holds if an instruction, other than `ExitFunction`, has no successors.
-   */
-  query predicate instructionWithoutSuccessor(
-    Instruction instr, string message, OptionalIRFunction irFunc, string irFuncText
-  ) {
-    not exists(instr.getASuccessor()) and
-    not instr instanceof ExitFunctionInstruction and
-    // Phi instructions aren't linked into the instruction-level flow graph.
-    not instr instanceof PhiInstruction and
-    not instr instanceof UnreachedInstruction and
-    message = "Instruction '" + instr.toString() + "' has no successors in function '$@'." and
-    irFunc = getInstructionIRFunction(instr, irFuncText)
-  }
-
-  /**
-   * Holds if there are multiple edges of the same kind from `source`.
-   */
-  query predicate ambiguousSuccessors(
-    Instruction source, string message, OptionalIRFunction irFunc, string irFuncText
-  ) {
-    exists(EdgeKind kind, int n |
-      n = strictcount(Instruction t | source.getSuccessor(kind) = t) and
-      n > 1 and
-      message =
-        "Instruction '" + source.toString() + "' has " + n.toString() + " successors of kind '" +
-          kind.toString() + "' in function '$@'." and
-      irFunc = getInstructionIRFunction(source, irFuncText)
-    )
-  }
-
-  /**
-   * Holds if `instr` is part of a loop even though the AST of `instr`'s enclosing function
-   * contains no element that can cause loops.
-   */
-  query predicate unexplainedLoop(
-    Instruction instr, string message, OptionalIRFunction irFunc, string irFuncText
-  ) {
-    exists(Language::Function f |
-      exists(IRBlock block |
-        instr.getBlock() = block and
-        block.getEnclosingFunction() = f and
-        block.getASuccessor+() = block
-      ) and
-      not Language::hasPotentialLoop(f) and
-      message =
-        "Instruction '" + instr.toString() + "' is part of an unexplained loop in function '$@'." and
-      irFunc = getInstructionIRFunction(instr, irFuncText)
-    )
-  }
-
-  /**
-   * Holds if a `Phi` instruction is present in a block with fewer than two
-   * predecessors.
-   */
-  query predicate unnecessaryPhiInstruction(
-    PhiInstruction instr, string message, OptionalIRFunction irFunc, string irFuncText
-  ) {
-    exists(int n |
-      n = count(instr.getBlock().getAPredecessor()) and
-      n < 2 and
-      message =
-        "Instruction '" + instr.toString() + "' is in a block with only " + n.toString() +
-          " predecessors in function '$@'." and
-      irFunc = getInstructionIRFunction(instr, irFuncText)
-    )
-  }
-
-  /**
-   * Holds if a memory operand is connected to a definition with an unmodeled result.
-   */
-  query predicate memoryOperandDefinitionIsUnmodeled(
-    Instruction instr, string message, OptionalIRFunction irFunc, string irFuncText
-  ) {
-    exists(MemoryOperand operand, Instruction def |
-      operand = instr.getAnOperand() and
-      def = operand.getAnyDef() and
-      not def.isResultModeled() and
-      message =
-        "Memory operand definition on instruction '" + instr.toString() +
-          "' has unmodeled result in function '$@'." and
-      irFunc = getInstructionIRFunction(instr, irFuncText)
-    )
-  }
-
-  /**
-   * Holds if operand `operand` consumes a value that was defined in
-   * a different function.
-   */
-  query predicate operandAcrossFunctions(
-    Operand operand, string message, OptionalIRFunction useIRFunc, string useIRFuncText,
-    OptionalIRFunction defIRFunc, string defIRFuncText
-  ) {
-    exists(Instruction useInstr, Instruction defInstr |
-      operand.getUse() = useInstr and
-      operand.getAnyDef() = defInstr and
-      useIRFunc = getInstructionIRFunction(useInstr, useIRFuncText) and
-      defIRFunc = getInstructionIRFunction(defInstr, defIRFuncText) and
-      useIRFunc != defIRFunc and
-      message =
-        "Operand '" + operand.toString() + "' is used on instruction '" + useInstr.toString() +
-          "' in function '$@', but is defined on instruction '" + defInstr.toString() +
-          "' in function '$@'."
-    )
-  }
-
-  /**
-   * Holds if instruction `instr` is not in exactly one block.
-   */
-  query predicate instructionWithoutUniqueBlock(
-    Instruction instr, string message, OptionalIRFunction irFunc, string irFuncText
-  ) {
-    exists(int blockCount |
-      blockCount = count(instr.getBlock()) and
-      blockCount != 1 and
-      message =
-        "Instruction '" + instr.toString() + "' is a member of " + blockCount.toString() +
-          " blocks in function '$@'." and
-      irFunc = getInstructionIRFunction(instr, irFuncText)
-    )
-  }
-
-  private predicate forwardEdge(IRBlock b1, IRBlock b2) {
-    b1.getASuccessor() = b2 and
-    not b1.getBackEdgeSuccessor(_) = b2
-  }
-
-  /**
-   * Holds if `f` contains a loop in which no edge is a back edge.
-   *
-   * This check ensures we don't have too _few_ back edges.
-   */
-  query predicate containsLoopOfForwardEdges(IRFunction f, string message) {
-    exists(IRBlock block |
-      forwardEdge+(block, block) and
-      block.getEnclosingIRFunction() = f and
-      message = "Function contains a loop consisting of only forward edges."
-    )
-  }
-
-  /**
-   * Holds if `block` is reachable from its function entry point but would not
-   * be reachable by traversing only forward edges. This check is skipped for
-   * functions containing `goto` statements as the property does not generally
-   * hold there.
-   *
-   * This check ensures we don't have too _many_ back edges.
-   */
-  query predicate lostReachability(
-    IRBlock block, string message, OptionalIRFunction irFunc, string irFuncText
-  ) {
-    exists(IRFunction f, IRBlock entry |
-      entry = f.getEntryBlock() and
-      entry.getASuccessor+() = block and
-      not forwardEdge+(entry, block) and
-      not Language::hasGoto(f.getFunction()) and
-      message =
-        "Block '" + block.toString() +
-          "' is not reachable by traversing only forward edges in function '$@'." and
-      irFunc = TPresentIRFunction(f) and
-      irFuncText = irFunc.toString()
-    )
-  }
-
-  /**
-   * Holds if the number of back edges differs between the `Instruction` graph
-   * and the `IRBlock` graph.
-   */
-  query predicate backEdgeCountMismatch(OptionalIRFunction irFunc, string message) {
-    exists(int fromInstr, int fromBlock |
-      fromInstr =
-        count(Instruction i1, Instruction i2 |
-          getInstructionIRFunction(i1) = irFunc and i1.getBackEdgeSuccessor(_) = i2
-        ) and
-      fromBlock =
-        count(IRBlock b1, IRBlock b2 |
-          getBlockIRFunction(b1) = irFunc and b1.getBackEdgeSuccessor(_) = b2
-        ) and
-      fromInstr != fromBlock and
-      message =
-        "The instruction graph for function '" + irFunc.toString() + "' contains " +
-          fromInstr.toString() + " back edges, but the block graph contains " + fromBlock.toString()
-          + " back edges."
-    )
-  }
-
-  /**
-   * Gets the point in the function at which the specified operand is evaluated. For most operands,
-   * this is at the instruction that consumes the use. For a `PhiInputOperand`, the effective point
-   * of evaluation is at the end of the corresponding predecessor block.
-   */
-  private predicate pointOfEvaluation(Operand operand, IRBlock block, int index) {
-    block = operand.(PhiInputOperand).getPredecessorBlock() and
-    index = block.getInstructionCount()
-    or
-    exists(Instruction use |
-      use = operand.(NonPhiOperand).getUse() and
-      block.getInstruction(index) = use
-    )
-  }
-
-  /**
-   * Holds if `useOperand` has a definition that does not dominate the use.
-   */
-  query predicate useNotDominatedByDefinition(
-    Operand useOperand, string message, OptionalIRFunction irFunc, string irFuncText
-  ) {
-    exists(IRBlock useBlock, int useIndex, Instruction defInstr, IRBlock defBlock, int defIndex |
-      pointOfEvaluation(useOperand, useBlock, useIndex) and
-      defInstr = useOperand.getAnyDef() and
-      (
-        defInstr instanceof PhiInstruction and
-        defBlock = defInstr.getBlock() and
-        defIndex = -1
-        or
-        defBlock.getInstruction(defIndex) = defInstr
-      ) and
-      not (
-        defBlock.strictlyDominates(useBlock)
-        or
-        defBlock = useBlock and
-        defIndex < useIndex
-      ) and
-      message =
-        "Operand '" + useOperand.toString() +
-          "' is not dominated by its definition in function '$@'." and
-      irFunc = getOperandIRFunction(useOperand, irFuncText)
-    )
-  }
-
-  query predicate switchInstructionWithoutDefaultEdge(
-    SwitchInstruction switchInstr, string message, OptionalIRFunction irFunc, string irFuncText
-  ) {
-    not exists(switchInstr.getDefaultSuccessor()) and
-    message =
-      "SwitchInstruction " + switchInstr.toString() + " without a DefaultEdge in function '$@'." and
-    irFunc = getInstructionIRFunction(switchInstr, irFuncText)
-  }
-
-  /**
-   * Holds if `instr` is on the chain of chi/phi instructions for all aliased
-   * memory.
-   */
-  private predicate isOnAliasedDefinitionChain(Instruction instr) {
-    instr instanceof AliasedDefinitionInstruction
-    or
-    isOnAliasedDefinitionChain(instr.(ChiInstruction).getTotal())
-    or
-    isOnAliasedDefinitionChain(instr.(PhiInstruction).getAnInputOperand().getAnyDef())
-  }
-
-  private predicate shouldBeConflated(Instruction instr) {
-    isOnAliasedDefinitionChain(instr)
-    or
-    instr.getOpcode() instanceof Opcode::InitializeNonLocal
-  }
-
-  query predicate notMarkedAsConflated(
-    Instruction instr, string message, OptionalIRFunction irFunc, string irFuncText
-  ) {
-    shouldBeConflated(instr) and
-    not instr.isResultConflated() and
-    message =
-      "Instruction '" + instr.toString() +
-        "' should be marked as having a conflated result in function '$@'." and
-    irFunc = getInstructionIRFunction(instr, irFuncText)
-  }
-
-  query predicate wronglyMarkedAsConflated(
-    Instruction instr, string message, OptionalIRFunction irFunc, string irFuncText
-  ) {
-    instr.isResultConflated() and
-    not shouldBeConflated(instr) and
-    message =
-      "Instruction '" + instr.toString() +
-        "' should not be marked as having a conflated result in function '$@'." and
-    irFunc = getInstructionIRFunction(instr, irFuncText)
-  }
-
-  query predicate invalidOverlap(
-    MemoryOperand useOperand, string message, OptionalIRFunction irFunc, string irFuncText
-  ) {
-    exists(Overlap overlap |
-      overlap = useOperand.getDefinitionOverlap() and
-      overlap instanceof MayPartiallyOverlap and
-      message =
-        "MemoryOperand '" + useOperand.toString() + "' has a `getDefinitionOverlap()` of '" +
-          overlap.toString() + "'." and
-      irFunc = getOperandIRFunction(useOperand, irFuncText)
-    )
-  }
-
-  query predicate nonUniqueEnclosingIRFunction(
-    Instruction instr, string message, OptionalIRFunction irFunc, string irFuncText
-  ) {
-    exists(int irFuncCount |
-      irFuncCount = count(instr.getEnclosingIRFunction()) and
-      irFuncCount != 1 and
-      message =
-        "Instruction '" + instr.toString() + "' has " + irFuncCount.toString() +
-          " results for `getEnclosingIRFunction()` in function '$@'." and
-      irFunc = getInstructionIRFunction(instr, irFuncText)
-    )
-  }
-
-  /**
-   * Holds if the object address operand for the given `FieldAddress` instruction does not have an
-   * address type.
-   */
-  query predicate fieldAddressOnNonPointer(
-    FieldAddressInstruction instr, string message, OptionalIRFunction irFunc, string irFuncText
-  ) {
-    not instr.getObjectAddressOperand().getIRType() instanceof IRAddressType and
-    message =
-      "FieldAddress instruction '" + instr.toString() +
-        "' has an object address operand that is not an address, in function '$@'." and
-    irFunc = getInstructionIRFunction(instr, irFuncText)
-  }
-
-  /**
-   * Holds if the `this` argument operand for the given `Call` instruction does not have an address
-   * type.
-   */
-  query predicate thisArgumentIsNonPointer(
-    CallInstruction instr, string message, OptionalIRFunction irFunc, string irFuncText
-  ) {
-    exists(ThisArgumentOperand thisOperand | thisOperand = instr.getThisArgumentOperand() |
-      not thisOperand.getIRType() instanceof IRAddressType
-    ) and
-    message =
-      "Call instruction '" + instr.toString() +
-        "' has a `this` argument operand that is not an address, in function '$@'." and
-    irFunc = getInstructionIRFunction(instr, irFuncText)
-  }
-}