Merge pull request #4321 from jf205/sd-216-ql

CodeQL docs: mention `generate query-help` CLI command

.codeqlmanifest.json

@@ -1,7 +1,5 @@
 { "provide": [ "*/ql/src/qlpack.yml",
-               "*/ql/lib/qlpack.yml",
                "*/ql/test/qlpack.yml",
-               "cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/qlpack.yml",
                "*/ql/examples/qlpack.yml",
                "*/upgrades/qlpack.yml",
                "misc/legacy-support/*/qlpack.yml",

.devcontainer/devcontainer.json

@@ -4,6 +4,6 @@
     "slevesque.vscode-zipexplorer"
   ],
   "settings": {
-    "codeQL.runningQueries.memory": 2048
+    "codeQL.experimentalBqrsParsing": true
   }
 }

.gitattributes

@@ -48,6 +48,3 @@
 *.gif -text
 *.dll -text
 *.pdb -text
-
-java/ql/test/stubs/**/*.java linguist-generated=true
-java/ql/test/experimental/stubs/**/*.java linguist-generated=true

.github/codeql/codeql-config.yml

@@ -7,5 +7,3 @@ paths-ignore:
   - '/cpp/'
   - '/java/'
   - '/python/'
-  - '/javascript/ql/test'
-  - '/javascript/extractor/tests'

.github/workflows/check-change-note.yml

@@ -1,23 +0,0 @@
-name: Check change note
-
-on:
-  pull_request_target:
-    types: [labeled, unlabeled, opened, synchronize, reopened, ready_for_review]
-    paths:
-      - "*/ql/src/**/*.ql"
-      - "*/ql/src/**/*.qll"
-      - "!**/experimental/**"
-
-jobs:
-  check-change-note:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Fail if no change note found. To fix, either add one, or add the `no-change-note-required` label.
-        if: |
-          github.event.pull_request.draft == false &&
-          !contains(github.event.pull_request.labels.*.name, 'no-change-note-required')
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          gh api 'repos/${{github.repository}}/pulls/${{github.event.number}}/files' --paginate --jq 'any(.[].filename ; test("/change-notes/.*[.]md$"))' |
-          grep true -c

.github/workflows/close-stale.yml

@@ -1,30 +0,0 @@
-name: Mark stale issues
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: "30 1 * * *"
-
-jobs:
-  stale:
-    if: github.repository == 'github/codeql'
-
-    runs-on: ubuntu-latest
-
-    steps:
-    - uses: actions/stale@v3
-      with:
-        repo-token: ${{ secrets.GITHUB_TOKEN }}
-        stale-issue-message: 'This issue is stale because it has been open 14 days with no activity. Comment or remove the `Stale` label in order to avoid having this issue closed in 7 days.'
-        close-issue-message: 'This issue was closed because it has been inactive for 7 days.'
-        days-before-stale: 14
-        days-before-close: 7
-        only-labels: awaiting-response
-
-        # do not mark PRs as stale
-        days-before-pr-stale: -1
-        days-before-pr-close: -1
-
-        # Uncomment for dry-run
-        # debug-only: true
-        # operations-per-run: 1000

.github/workflows/codeql-analysis.yml

@@ -2,17 +2,7 @@ name: "Code scanning - action"
 
 on:
   push:
-    branches:
-      - main
-      - 'rc/*'
   pull_request:
-    branches:
-      - main
-      - 'rc/*'
-    paths:
-      - 'csharp/**'
-      - '.github/codeql/**'
-      - '.github/workflows/codeql-analysis.yml'
   schedule:
     - cron: '0 9 * * 1'
 
@@ -21,18 +11,22 @@ jobs:
 
     runs-on: ubuntu-latest
 
-    permissions:
-      contents: read
-      security-events: write
-      pull-requests: read
-
     steps:
     - name: Checkout repository
       uses: actions/checkout@v2
+      with:
+        # We must fetch at least the immediate parents so that if this is
+        # a pull request then we can checkout the head.
+        fetch-depth: 2
 
+    # If this run was triggered by a pull request event, then checkout
+    # the head of the pull request instead of the merge commit.
+    - run: git checkout HEAD^2
+      if: ${{ github.event_name == 'pull_request' }}
+      
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@main
+      uses: github/codeql-action/init@v1
       # Override language selection by uncommenting this and choosing your languages
       with:
         languages: csharp
@@ -40,8 +34,8 @@ jobs:
 
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
-    #- name: Autobuild
-    #  uses: github/codeql-action/autobuild@main
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@v1
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -50,8 +44,9 @@ jobs:
     #    and modify them (or add more) to build your code if your project
     #    uses a compiled language
 
-    - run: |
-       dotnet build csharp
+    #- run: |
+    #   make bootstrap
+    #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@main
+      uses: github/codeql-action/analyze@v1

.github/workflows/csv-coverage-pr-artifacts.yml

@@ -1,97 +0,0 @@
-name: Check framework coverage changes
-
-on:
-  pull_request:
-    paths:
-      - '.github/workflows/csv-coverage-pr-comment.yml'
-      - '*/ql/src/**/*.ql'
-      - '*/ql/src/**/*.qll'
-      - 'misc/scripts/library-coverage/*.py'
-      # input data files
-      - '*/documentation/library-coverage/cwe-sink.csv'
-      - '*/documentation/library-coverage/frameworks.csv'
-    branches:
-      - main
-      - 'rc/*'
-
-jobs:
-  generate:
-    name: Generate framework coverage artifacts
-
-    runs-on: ubuntu-latest
-
-    steps:
-    - name: Dump GitHub context
-      env:
-        GITHUB_CONTEXT: ${{ toJSON(github.event) }}
-      run: echo "$GITHUB_CONTEXT"
-    - name: Clone self (github/codeql) - MERGE
-      uses: actions/checkout@v2
-      with:
-        path: merge
-    - name: Clone self (github/codeql) - BASE
-      uses: actions/checkout@v2
-      with:
-        fetch-depth: 2
-        path: base
-    - run: |
-        git checkout HEAD^1
-        git log -1 --format='%H'
-      working-directory: base
-    - name: Set up Python 3.8
-      uses: actions/setup-python@v2
-      with:
-        python-version: 3.8
-    - name: Download CodeQL CLI
-      env:
-         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: |
-         gh release download --repo "github/codeql-cli-binaries" --pattern "codeql-linux64.zip"
-    - name: Unzip CodeQL CLI
-      run: unzip -d codeql-cli codeql-linux64.zip
-    - name: Generate CSV files on merge commit of the PR
-      run: |
-        echo "Running generator on merge"
-        PATH="$PATH:codeql-cli/codeql" python merge/misc/scripts/library-coverage/generate-report.py ci merge merge
-        mkdir out_merge
-        cp framework-coverage-*.csv out_merge/
-        cp framework-coverage-*.rst out_merge/
-    - name: Generate CSV files on base commit of the PR
-      run: |
-        echo "Running generator on base"
-        PATH="$PATH:codeql-cli/codeql" python base/misc/scripts/library-coverage/generate-report.py ci base base
-        mkdir out_base
-        cp framework-coverage-*.csv out_base/
-        cp framework-coverage-*.rst out_base/
-    - name: Generate diff of coverage reports
-      run: |
-        python base/misc/scripts/library-coverage/compare-folders.py out_base out_merge comparison.md
-    - name: Upload CSV package list
-      uses: actions/upload-artifact@v2
-      with:
-        name: csv-framework-coverage-merge
-        path: |
-          out_merge/framework-coverage-*.csv
-          out_merge/framework-coverage-*.rst
-    - name: Upload CSV package list
-      uses: actions/upload-artifact@v2
-      with:
-        name: csv-framework-coverage-base
-        path: |
-          out_base/framework-coverage-*.csv
-          out_base/framework-coverage-*.rst
-    - name: Upload comparison results
-      uses: actions/upload-artifact@v2
-      with:
-        name: comparison
-        path: |
-          comparison.md
-    - name: Save PR number
-      run: |
-        mkdir -p pr
-        echo ${{ github.event.pull_request.number }} > pr/NR
-    - name: Upload PR number
-      uses: actions/upload-artifact@v2
-      with:
-        name: pr
-        path: pr/

.github/workflows/csv-coverage-pr-comment.yml

@@ -1,34 +0,0 @@
-name: Comment on PR with framework coverage changes
-
-on:
-  workflow_run:
-    workflows: ["Check framework coverage changes"]
-    types:
-      - completed
-
-jobs:
-  check:
-    name: Check framework coverage differences and comment
-    runs-on: ubuntu-latest
-    if: >
-      ${{ github.event.workflow_run.event == 'pull_request' &&
-      github.event.workflow_run.conclusion == 'success' }}
-
-    steps:
-    - name: Dump GitHub context
-      env:
-        GITHUB_CONTEXT: ${{ toJSON(github.event) }}
-      run: echo "$GITHUB_CONTEXT"
-    - name: Clone self (github/codeql)
-      uses: actions/checkout@v2
-    - name: Set up Python 3.8
-      uses: actions/setup-python@v2
-      with:
-        python-version: 3.8
-
-    - name: Check coverage difference file and comment
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        RUN_ID: ${{ github.event.workflow_run.id }}
-      run: |
-        python misc/scripts/library-coverage/comment-pr.py "$GITHUB_REPOSITORY" "$RUN_ID"

.github/workflows/csv-coverage-timeseries.yml

@@ -1,42 +0,0 @@
-name: Build framework coverage timeseries reports
-
-on:
-  workflow_dispatch:
-
-jobs:
-  build:
-
-    runs-on: ubuntu-latest
-
-    steps:
-    - name: Clone self (github/codeql)
-      uses: actions/checkout@v2
-      with:
-        path: script
-    - name: Clone self (github/codeql) for analysis
-      uses: actions/checkout@v2
-      with:
-        path: codeqlModels
-        fetch-depth: 0
-    - name: Set up Python 3.8
-      uses: actions/setup-python@v2
-      with:
-        python-version: 3.8
-    - name: Download CodeQL CLI
-      env:
-         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: |
-         gh release download --repo "github/codeql-cli-binaries" --pattern "codeql-linux64.zip"
-    - name: Unzip CodeQL CLI
-      run: unzip -d codeql-cli codeql-linux64.zip
-    - name: Build modeled package list
-      run: |
-        CLI=$(realpath "codeql-cli/codeql")
-        echo $CLI
-        PATH="$PATH:$CLI" python script/misc/scripts/library-coverage/generate-timeseries.py codeqlModels
-    - name: Upload timeseries CSV
-      uses: actions/upload-artifact@v2
-      with:
-        name: framework-coverage-timeseries
-        path: framework-coverage-timeseries-*.csv
-

.github/workflows/csv-coverage-update.yml

@@ -1,44 +0,0 @@
-name: Update framework coverage reports
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: "0 0 * * *"
-
-jobs:
-  update:
-    name: Update framework coverage report
-    if: github.repository == 'github/codeql'
-    runs-on: ubuntu-latest
-
-    steps:
-    - name: Dump GitHub context
-      env:
-        GITHUB_CONTEXT: ${{ toJSON(github.event) }}
-      run: echo "$GITHUB_CONTEXT"
-    - name: Clone self (github/codeql)
-      uses: actions/checkout@v2
-      with:
-        path: ql
-        fetch-depth: 0
-    - name: Set up Python 3.8
-      uses: actions/setup-python@v2
-      with:
-        python-version: 3.8
-    - name: Download CodeQL CLI
-      env:
-         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: |
-         gh release download --repo "github/codeql-cli-binaries" --pattern "codeql-linux64.zip"
-    - name: Unzip CodeQL CLI
-      run: unzip -d codeql-cli codeql-linux64.zip
-
-    - name: Generate coverage files
-      run: |
-        PATH="$PATH:codeql-cli/codeql" python ql/misc/scripts/library-coverage/generate-report.py ci ql ql
-
-    - name: Create pull request with changes
-      env:
-         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: |
-        python ql/misc/scripts/library-coverage/create-pr.py ql "$GITHUB_REPOSITORY"

.github/workflows/csv-coverage.yml

@@ -1,49 +0,0 @@
-name: Build framework coverage reports
-
-on:
-  workflow_dispatch:
-    inputs:
-      qlModelShaOverride:
-        description: 'github/codeql repo SHA used for looking up the CSV models'
-        required: false
-
-jobs:
-  build:
-
-    runs-on: ubuntu-latest
-
-    steps:
-    - name: Clone self (github/codeql)
-      uses: actions/checkout@v2
-      with:
-        path: script
-    - name: Clone self (github/codeql) for analysis
-      uses: actions/checkout@v2
-      with:
-        path: codeqlModels
-        ref: ${{ github.event.inputs.qlModelShaOverride || github.ref }}
-    - name: Set up Python 3.8
-      uses: actions/setup-python@v2
-      with:
-        python-version: 3.8
-    - name: Download CodeQL CLI
-      env:
-         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: |
-         gh release download --repo "github/codeql-cli-binaries" --pattern "codeql-linux64.zip"
-    - name: Unzip CodeQL CLI
-      run: unzip -d codeql-cli codeql-linux64.zip
-    - name: Build modeled package list
-      run: |
-        PATH="$PATH:codeql-cli/codeql" python script/misc/scripts/library-coverage/generate-report.py ci codeqlModels script
-    - name: Upload CSV package list
-      uses: actions/upload-artifact@v2
-      with:
-        name: framework-coverage-csv
-        path: framework-coverage-*.csv
-    - name: Upload RST package list
-      uses: actions/upload-artifact@v2
-      with:
-        name: framework-coverage-rst
-        path: framework-coverage-*.rst
-

.github/workflows/labeler.yml

@@ -1,11 +0,0 @@
-name: "Pull Request Labeler"
-on:
-- pull_request_target
-
-jobs:
-  triage:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/labeler@v2
-      with:
-        repo-token: "${{ secrets.GITHUB_TOKEN }}"

.github/workflows/query-list.yml

@@ -1,49 +0,0 @@
-name: Build code scanning query list
-
-on:
-  push:
-    branches:
-     - main
-     - 'rc/**'
-  pull_request:
-    paths:
-      - '.github/workflows/query-list.yml'
-      - 'misc/scripts/generate-code-scanning-query-list.py'
-
-jobs:
-  build:
-
-    runs-on: ubuntu-latest
-
-    steps:
-    - name: Clone self (github/codeql)
-      uses: actions/checkout@v2
-      with:
-        path: codeql 
-    - name: Clone github/codeql-go
-      uses: actions/checkout@v2
-      with:
-        repository: 'github/codeql-go'
-        path: codeql-go
-    - name: Set up Python 3.8
-      uses: actions/setup-python@v2
-      with:
-        python-version: 3.8
-    - name: Download CodeQL CLI
-      uses: dsaltares/fetch-gh-release-asset@aa37ae5c44d3c9820bc12fe675e8670ecd93bd1c
-      with:
-        repo: "github/codeql-cli-binaries"
-        version: "latest"
-        file: "codeql-linux64.zip"
-        token: ${{ secrets.GITHUB_TOKEN }}
-    - name: Unzip CodeQL CLI
-      run: unzip -d codeql-cli codeql-linux64.zip
-    - name: Build code scanning query list
-      run: |
-        PATH="$PATH:codeql-cli/codeql" python codeql/misc/scripts/generate-code-scanning-query-list.py > code-scanning-query-list.csv
-    - name: Upload code scanning query list
-      uses: actions/upload-artifact@v2
-      with:
-        name: code-scanning-query-list
-        path: code-scanning-query-list.csv
-    

.gitignore

@@ -17,9 +17,6 @@
 # Byte-compiled python files
 *.pyc
 
-# python virtual environment folder 
-.venv/
-
 # It's useful (though not required) to be able to unpack codeql in the ql checkout itself
 /codeql/
 

.vscode/extensions.json

@@ -3,8 +3,8 @@
     // Extension identifier format: ${publisher}.${name}. Example: vscode.csharp
     // List of extensions which should be recommended for users of this workspace.
     "recommendations": [
-        "GitHub.vscode-codeql"
+        "github.vscode-codeql"
     ],
     // List of extensions recommended by VS Code that should not be recommended for users of this workspace.
     "unwantedRecommendations": []
-}
+}

.vscode/settings.json

@@ -1,3 +1,3 @@
 {
     "omnisharp.autoStart": false
-}
+}

CODEOWNERS

@@ -4,22 +4,17 @@
 /javascript/ @github/codeql-javascript
 /python/ @github/codeql-python
 
-# Make @xcorail (GitHub Security Lab) a code owner for experimental queries so he gets pinged when we promote a query out of experimental
-/cpp/**/experimental/**/* @github/codeql-c-analysis @xcorail
-/csharp/**/experimental/**/* @github/codeql-csharp @xcorail
-/java/**/experimental/**/* @github/codeql-java @xcorail
-/javascript/**/experimental/**/* @github/codeql-javascript @xcorail
-/python/**/experimental/**/* @github/codeql-python @xcorail
+# Assign query help for docs review
+/cpp/**/*.qhelp @hubwriter
+/csharp/**/*.qhelp @jf205
+/java/**/*.qhelp @felicitymay
+/javascript/**/*.qhelp @mchammer01
+/python/**/*.qhelp @felicitymay
+/docs/language/ @shati-patel @jf205
 
-# Notify members of codeql-go about PRs to the shared data-flow library files
-/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl.qll @github/codeql-java @github/codeql-go
-/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl2.qll @github/codeql-java @github/codeql-go
-/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImplCommon.qll @github/codeql-java @github/codeql-go
-/java/ql/src/semmle/code/java/dataflow/internal/tainttracking1/TaintTrackingImpl.qll @github/codeql-java @github/codeql-go
-/java/ql/src/semmle/code/java/dataflow/internal/tainttracking2/TaintTrackingImpl.qll @github/codeql-java @github/codeql-go
-
-# CodeQL tools and associated docs
-/docs/codeql-cli/ @github/codeql-cli-reviewers
-/docs/codeql-for-visual-studio-code/ @github/codeql-vscode-reviewers
-/docs/ql-language-reference/ @github/codeql-frontend-reviewers
-/docs/query-*-style-guide.md @github/codeql-analysis-reviewers
+# Exclude help for experimental queries from docs review
+/cpp/**/experimental/**/*.qhelp @github/codeql-c-analysis
+/csharp/**/experimental/**/*.qhelp @github/codeql-csharp
+/java/**/experimental/**/*.qhelp @github/codeql-java
+/javascript/**/experimental/**/*.qhelp @github/codeql-javascript
+/python/**/experimental/**/*.qhelp @github/codeql-python

CONTRIBUTING.md

@@ -38,8 +38,6 @@ If you have an idea for a query that you would like to share with other CodeQL u
 
     - The queries and libraries must be autoformatted, for example using the "Format Document" command in [CodeQL for Visual Studio Code](https://help.semmle.com/codeql/codeql-for-vscode/procedures/about-codeql-for-vscode.html).
 
-    If you prefer, you can use this [pre-commit hook](misc/scripts/pre-commit) that automatically checks whether your files are correctly formatted. See the [pre-commit hook installation guide](docs/pre-commit-hook-setup.md) for instructions on how to install the hook.
-
 4. **Compilation**
 
     - Compilation of the query and any associated libraries and tests must be resilient to future development of the [supported](docs/supported-queries.md) libraries. This means that the functionality cannot use internal libraries, cannot depend on the output of `getAQlClass`, and cannot make use of regexp matching on `toString`.
@@ -49,11 +47,7 @@ If you have an idea for a query that you would like to share with other CodeQL u
 
     - The query must have at least one true positive result on some revision of a real project.
 
-6. **Query help files and unit tests**
-
-	- Query help (`.qhelp`) files and unit tests are optional (but strongly encouraged!) for queries in the `experimental` directories. For more information about contributing query help files and unit tests, see [Supported CodeQL queries and libraries](docs/supported-queries.md).
-
-Experimental queries and libraries may not be actively maintained as the supported libraries evolve. They may also be changed in backwards-incompatible ways or may be removed entirely in the future without deprecation warnings.
+Experimental queries and libraries may not be actively maintained as the [supported](docs/supported-queries.md) libraries evolve. They may also be changed in backwards-incompatible ways or may be removed entirely in the future without deprecation warnings.
 
 After the experimental query is merged, we welcome pull requests to improve it. Before a query can be moved out of the `experimental` subdirectory, it must satisfy [the requirements for being a supported query](docs/supported-queries.md).
 

README.md

@@ -4,8 +4,8 @@ This open source repository contains the standard CodeQL libraries and queries t
 
 ## How do I learn CodeQL and run queries?
 
-There is [extensive documentation](https://codeql.github.com/docs/) on getting started with writing CodeQL.
-You can use the [interactive query console](https://lgtm.com/help/lgtm/using-query-console) on LGTM.com or the [CodeQL for Visual Studio Code](https://codeql.github.com/docs/codeql-for-visual-studio-code/) extension to try out your queries on any open source project that's currently being analyzed.
+There is [extensive documentation](https://help.semmle.com/QL/learn-ql/) on getting started with writing CodeQL.
+You can use the [interactive query console](https://lgtm.com/help/lgtm/using-query-console) on LGTM.com or the [CodeQL for Visual Studio Code](https://help.semmle.com/codeql/codeql-for-vscode.html) extension to try out your queries on any open source project that's currently being analyzed.
 
 ## Contributing
 

change-notes/1.25/analysis-javascript.md

@@ -30,7 +30,7 @@
   - [yargs](https://www.npmjs.com/package/yargs)
   - [webpack-dev-server](https://www.npmjs.com/package/webpack-dev-server)
 
-* TypeScript 4.0 is now supported.
+* TypeScript 3.9 is now supported.
 
 * TypeScript code embedded in HTML and Vue files is now extracted and analyzed.
 

change-notes/1.26/analysis-cpp.md

@@ -1,31 +0,0 @@
-# Improvements to C/C++ analysis
-
-The following changes in version 1.26 affect C/C++ analysis in all applications.
-
-## General improvements
-
-## New queries
-
-| **Query**                   | **Tags**  | **Purpose**                                                        |
-|-----------------------------|-----------|--------------------------------------------------------------------|
-
-## Changes to existing queries
-
-| **Query**                  | **Expected impact**    | **Change**                                                       |
-|----------------------------|------------------------|------------------------------------------------------------------|
-| Declaration hides parameter (`cpp/declaration-hides-parameter`) | Fewer false positive results | False positives involving template functions have been fixed. |
-| Inconsistent direction of for loop (`cpp/inconsistent-loop-direction`) | Fewer false positive results | The query now accounts for intentional wrapping of an unsigned loop counter. |
-| Overflow in uncontrolled allocation size (`cpp/uncontrolled-allocation-size`) | | The precision of this query has been decreased from "high" to "medium". As a result, the query is still run but results are no longer displayed on LGTM by default. |
-| Comparison result is always the same (`cpp/constant-comparison`) | More correct results | Bounds on expressions involving multiplication can now be determined in more cases. |
-
-## Changes to libraries
-
-* The QL class `Block`, denoting the `{ ... }` statement, is renamed to `BlockStmt`.
-* The models library now models many taint flows through `std::array`, `std::vector`, `std::deque`, `std::list` and `std::forward_list`.
-* The models library now models many more taint flows through `std::string`.
-* The models library now models many taint flows through `std::istream` and `std::ostream`.
-* The models library now models some taint flows through `std::shared_ptr`, `std::unique_ptr`, `std::make_shared` and `std::make_unique`.
-* The models library now models many taint flows through `std::pair`, `std::map`, `std::unordered_map`, `std::set` and `std::unordered_set`.
-* The models library now models `bcopy`.
-* The `SimpleRangeAnalysis` library now supports multiplications of the form
-  `e1 * e2` and `x *= e2` when `e1` and `e2` are unsigned or constant.

change-notes/1.26/analysis-java.md

@@ -1,20 +0,0 @@
-# Improvements to Java analysis
-
-The following changes in version 1.26 affect Java analysis in all applications.
-
-## General improvements
-
-## New queries
-
-| **Query**                   | **Tags**  | **Purpose**                                                        |
-|-----------------------------|-----------|--------------------------------------------------------------------|
-
-
-## Changes to existing queries
-
-| **Query**                    | **Expected impact**    | **Change**                        |
-|------------------------------|------------------------|-----------------------------------|
-
-
-## Changes to libraries
-

change-notes/1.26/analysis-javascript.md

@@ -1,73 +0,0 @@
-# Improvements to JavaScript analysis
-
-## General improvements
-
-* Angular-specific taint sources and sinks are now recognized by the security queries.
-
-* Support for React has improved, with better handling of react hooks, react-router path parameters, lazy-loaded components, and components transformed using `react-redux` and/or `styled-components`.
-
-* Dynamic imports are now analyzed more precisely.
-
-* Support for the following frameworks and libraries has been improved:
-  - [@angular/*](https://www.npmjs.com/package/@angular/core)
-  - [AWS Serverless](https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-resource-function.html)
-  - [Alibaba Serverless](https://www.alibabacloud.com/help/doc-detail/156876.htm)
-  - [debounce](https://www.npmjs.com/package/debounce)
-  - [bluebird](https://www.npmjs.com/package/bluebird)
-  - [call-limit](https://www.npmjs.com/package/call-limit)
-  - [classnames](https://www.npmjs.com/package/classnames)
-  - [clsx](https://www.npmjs.com/package/clsx)
-  - [express](https://www.npmjs.com/package/express)
-  - [fast-json-stable-stringify](https://www.npmjs.com/package/fast-json-stable-stringify)
-  - [fast-safe-stringify](https://www.npmjs.com/package/fast-safe-stringify)
-  - [http](https://nodejs.org/api/http.html)
-  - [javascript-stringify](https://www.npmjs.com/package/javascript-stringify)
-  - [js-stringify](https://www.npmjs.com/package/js-stringify)
-  - [json-stable-stringify](https://www.npmjs.com/package/json-stable-stringify)
-  - [json-stringify-safe](https://www.npmjs.com/package/json-stringify-safe)
-  - [json3](https://www.npmjs.com/package/json3)
-  - [jQuery throttle / debounce](https://github.com/cowboy/jquery-throttle-debounce)
-  - [lodash](https://www.npmjs.com/package/lodash)
-  - [lodash.debounce](https://www.npmjs.com/package/lodash.debounce)
-  - [lodash.throttle](https://www.npmjs.com/package/lodash.throttle)
-  - [needle](https://www.npmjs.com/package/needle)
-  - [object-inspect](https://www.npmjs.com/package/object-inspect)
-  - [pretty-format](https://www.npmjs.com/package/pretty-format)
-  - [react](https://www.npmjs.com/package/react)
-  - [react-router-dom](https://www.npmjs.com/package/react-router-dom)
-  - [react-redux](https://www.npmjs.com/package/react-redux)
-  - [redis](https://www.npmjs.com/package/redis)
-  - [redux](https://www.npmjs.com/package/redux)
-  - [stringify-object](https://www.npmjs.com/package/stringify-object)
-  - [styled-components](https://www.npmjs.com/package/styled-components)
-  - [throttle-debounce](https://www.npmjs.com/package/throttle-debounce)
-  - [underscore](https://www.npmjs.com/package/underscore)
-
-* Analyzing files with the ".cjs" extension is now supported.
-* ES2021 features are now supported.
-
-## New queries
-
-| **Query**                                                                       | **Tags**                                                          | **Purpose**                                                                                                                                                                            |
-|---------------------------------------------------------------------------------|-------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-
-
-## Changes to existing queries
-
-| **Query**                      | **Expected impact**          | **Change**                                                                |
-|--------------------------------|------------------------------|---------------------------------------------------------------------------|
-| Potentially unsafe external link (`js/unsafe-external-link`) | Fewer results | This query no longer flags URLs constructed using a template system where only the hash or query part of the URL is dynamic. |
-| Incomplete URL substring sanitization (`js/incomplete-url-substring-sanitization`) | More results | This query now recognizes additional URLs when the substring check is an inclusion check. |
-| Ambiguous HTML id attribute (`js/duplicate-html-id`) | Results no longer shown | Precision tag reduced to "low". The query is no longer run by default. |
-| Unused loop iteration variable (`js/unused-loop-variable`) | Fewer results | This query no longer flags variables in a destructuring array assignment that are not the last variable in the destructed array. |
-| Unsafe shell command constructed from library input (`js/shell-command-constructed-from-input`) | More results | This query now recognizes more commands where colon, dash, and underscore are used. |
-| Unsafe jQuery plugin (`js/unsafe-jquery-plugin`) | More results | This query now detects more unsafe uses of nested option properties. |
-| Client-side URL redirect (`js/client-side-unvalidated-url-redirection`) | More results | This query now recognizes some unsafe uses of `importScripts()` inside WebWorkers. |
-| Missing CSRF middleware (`js/missing-token-validation`) | More results | This query now recognizes writes to cookie and session variables as potentially vulnerable to CSRF attacks. |
-| Missing CSRF middleware (`js/missing-token-validation`) | Fewer results | This query now recognizes more ways of protecting against CSRF attacks. |
-| Client-side cross-site scripting (`js/xss`) | More results | This query now tracks data flow from `location.hash` more precisely. |
-
-
-## Changes to libraries
-* The predicate `TypeAnnotation.hasQualifiedName` now works in more cases when the imported library was not present during extraction.
-* The class `DomBasedXss::Configuration` has been deprecated, as it has been split into `DomBasedXss::HtmlInjectionConfiguration` and `DomBasedXss::JQueryHtmlOrSelectorInjectionConfiguration`. Unless specifically working with jQuery sinks, subclasses should instead be based on `HtmlInjectionConfiguration`. To use both configurations in a query, see [Xss.ql](https://github.com/github/codeql/blob/main/javascript/ql/src/Security/CWE-079/Xss.ql) for an example.

change-notes/1.26/analysis-python.md

@@ -1,37 +0,0 @@
-# Improvements to Python analysis
-
-The following changes in version 1.26 affect Python analysis in all applications.
-
-## General improvements
-
-## Changes to existing queries
-
-| **Query**                  | **Expected impact**    | **Change**                                                       |
-|----------------------------|------------------------|------------------------------------------------------------------|
-|`py/unsafe-deserialization` | Different results. | The underlying data flow library has been changed. See below for more details. |
-|`py/path-injection` | Different results. | The underlying data flow library has been changed. See below for more details. |
-|`py/command-line-injection` | Different results. | The underlying data flow library has been changed. See below for more details. |
-|`py/reflective-xss` | Different results. | The underlying data flow library has been changed. See below for more details. |
-|`py/sql-injection` | Different results. | The underlying data flow library has been changed. See below for more details. |
-|`py/code-injection` | Different results. | The underlying data flow library has been changed. See below for more details. |
-## Changes to libraries
-* Some of the security queries now use the shared data flow library for data flow and taint tracking. This has resulted in an overall more robust and accurate analysis. The libraries mentioned below have been modelled in this new framework. Other libraries (e.g. the web framework `CherryPy`) have not been modelled yet, and this may lead to a temporary loss of results for these frameworks.
-* Improved modelling of the following serialization libraries:
-  - `PyYAML`
-  - `dill`
-  - `pickle`
-  - `marshal`
-* Improved modelling of the following web frameworks:
-  - `Django` (Note that modelling of class-based response handlers is currently incomplete.)
-  - `Flask`
-* Support for Werkzeug `MultiDict`.
-* Support for the [Python Database API Specification v2.0 (PEP-249)](https://www.python.org/dev/peps/pep-0249/), including the following libraries:
-  - `MySQLdb`
-  - `mysql-connector-python`
-  - `django.db`
-* Improved modelling of the following command execution libraries:
-  - `Fabric`
-  - `Invoke`
-* Improved modelling of security-related standard library modules, such as `os`, `popen2`, `platform`, and `base64`.
-* The original versions of the updated queries have been preserved [here](https://github.com/github/codeql/tree/main/python/ql/src/experimental/Security-old-dataflow).
-* Added taint tracking support for string formatting through f-strings.

config/identical-files.json

@@ -1,333 +1,297 @@
 {
   "DataFlow Java/C++/C#/Python": [
-    "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl.qll",
-    "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl2.qll",
-    "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl3.qll",
-    "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl4.qll",
-    "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl5.qll",
-    "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl6.qll",
-    "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImplForSerializability.qll",
-    "cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll",
-    "cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll",
-    "cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll",
-    "cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll",
-    "cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplLocal.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl2.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl3.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl4.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl5.qll",
-    "python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl.qll",
-    "python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl2.qll",
-    "python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl3.qll",
-    "python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl4.qll"
+    "java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl.qll",
+    "java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl2.qll",
+    "java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl3.qll",
+    "java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl4.qll",
+    "java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl5.qll",
+    "cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll",
+    "cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll",
+    "cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll",
+    "cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll",
+    "cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImplLocal.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl2.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl3.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl4.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl5.qll",
+    "python/ql/src/experimental/dataflow/internal/DataFlowImpl.qll",
+    "python/ql/src/experimental/dataflow/internal/DataFlowImpl2.qll"
   ],
   "DataFlow Java/C++/C#/Python Common": [
-    "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImplCommon.qll",
-    "cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplCommon.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplCommon.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImplCommon.qll",
-    "python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImplCommon.qll"
+    "java/ql/src/semmle/code/java/dataflow/internal/DataFlowImplCommon.qll",
+    "cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImplCommon.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImplCommon.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImplCommon.qll",
+    "python/ql/src/experimental/dataflow/internal/DataFlowImplCommon.qll"
   ],
   "TaintTracking::Configuration Java/C++/C#/Python": [
-    "cpp/ql/lib/semmle/code/cpp/dataflow/internal/tainttracking1/TaintTrackingImpl.qll",
-    "cpp/ql/lib/semmle/code/cpp/dataflow/internal/tainttracking2/TaintTrackingImpl.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/tainttracking1/TaintTrackingImpl.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/tainttracking2/TaintTrackingImpl.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/tainttracking3/TaintTrackingImpl.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/tainttracking1/TaintTrackingImpl.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/tainttracking2/TaintTrackingImpl.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/tainttracking3/TaintTrackingImpl.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/tainttracking4/TaintTrackingImpl.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/tainttracking5/TaintTrackingImpl.qll",
-    "java/ql/lib/semmle/code/java/dataflow/internal/tainttracking1/TaintTrackingImpl.qll",
-    "java/ql/lib/semmle/code/java/dataflow/internal/tainttracking2/TaintTrackingImpl.qll",
-    "python/ql/lib/semmle/python/dataflow/new/internal/tainttracking1/TaintTrackingImpl.qll",
-    "python/ql/lib/semmle/python/dataflow/new/internal/tainttracking2/TaintTrackingImpl.qll",
-    "python/ql/lib/semmle/python/dataflow/new/internal/tainttracking3/TaintTrackingImpl.qll",
-    "python/ql/lib/semmle/python/dataflow/new/internal/tainttracking4/TaintTrackingImpl.qll"
+    "cpp/ql/src/semmle/code/cpp/dataflow/internal/tainttracking1/TaintTrackingImpl.qll",
+    "cpp/ql/src/semmle/code/cpp/dataflow/internal/tainttracking2/TaintTrackingImpl.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/tainttracking1/TaintTrackingImpl.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/tainttracking2/TaintTrackingImpl.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/tainttracking1/TaintTrackingImpl.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/tainttracking2/TaintTrackingImpl.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/tainttracking3/TaintTrackingImpl.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/tainttracking4/TaintTrackingImpl.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/tainttracking5/TaintTrackingImpl.qll",
+    "java/ql/src/semmle/code/java/dataflow/internal/tainttracking1/TaintTrackingImpl.qll",
+    "java/ql/src/semmle/code/java/dataflow/internal/tainttracking2/TaintTrackingImpl.qll",
+    "python/ql/src/experimental/dataflow/internal/tainttracking1/TaintTrackingImpl.qll"
   ],
   "DataFlow Java/C++/C#/Python Consistency checks": [
-    "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImplConsistency.qll",
-    "cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplConsistency.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplConsistency.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImplConsistency.qll",
-    "python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImplConsistency.qll"
-  ],
-  "DataFlow Java/C# Flow Summaries": [
-    "java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll"
-  ],
-  "SsaReadPosition Java/C#": [
-    "java/ql/lib/semmle/code/java/dataflow/internal/rangeanalysis/SsaReadPositionCommon.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/SsaReadPositionCommon.qll"
-  ],
-  "Sign Java/C#": [
-    "java/ql/lib/semmle/code/java/dataflow/internal/rangeanalysis/Sign.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/Sign.qll"
-  ],
-  "SignAnalysis Java/C#": [
-    "java/ql/lib/semmle/code/java/dataflow/internal/rangeanalysis/SignAnalysisCommon.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/SignAnalysisCommon.qll"
-  ],
-  "Bound Java/C#": [
-    "java/ql/lib/semmle/code/java/dataflow/Bound.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/Bound.qll"
-  ],
-  "ModulusAnalysis Java/C#": [
-    "java/ql/lib/semmle/code/java/dataflow/ModulusAnalysis.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/ModulusAnalysis.qll"
+    "java/ql/src/semmle/code/java/dataflow/internal/DataFlowImplConsistency.qll",
+    "cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImplConsistency.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImplConsistency.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImplConsistency.qll",
+    "python/ql/src/experimental/dataflow/internal/DataFlowImplConsistency.qll"
   ],
   "C++ SubBasicBlocks": [
-    "cpp/ql/lib/semmle/code/cpp/controlflow/SubBasicBlocks.qll",
-    "cpp/ql/lib/semmle/code/cpp/dataflow/internal/SubBasicBlocks.qll"
+    "cpp/ql/src/semmle/code/cpp/controlflow/SubBasicBlocks.qll",
+    "cpp/ql/src/semmle/code/cpp/dataflow/internal/SubBasicBlocks.qll"
   ],
   "IR Instruction": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/Instruction.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/Instruction.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll",
     "csharp/ql/src/experimental/ir/implementation/raw/Instruction.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/Instruction.qll"
   ],
   "IR IRBlock": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/IRBlock.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/IRBlock.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/IRBlock.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/IRBlock.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/IRBlock.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/IRBlock.qll",
     "csharp/ql/src/experimental/ir/implementation/raw/IRBlock.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/IRBlock.qll"
   ],
   "IR IRVariable": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/IRVariable.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/IRVariable.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/IRVariable.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/IRVariable.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/IRVariable.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/IRVariable.qll",
     "csharp/ql/src/experimental/ir/implementation/raw/IRVariable.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/IRVariable.qll"
   ],
   "IR IRFunction": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/IRFunction.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/IRFunction.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/IRFunction.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/IRFunction.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/IRFunction.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/IRFunction.qll",
     "csharp/ql/src/experimental/ir/implementation/raw/IRFunction.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/IRFunction.qll"
   ],
   "IR Operand": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/Operand.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/Operand.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/Operand.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/Operand.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/Operand.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/Operand.qll",
     "csharp/ql/src/experimental/ir/implementation/raw/Operand.qll",
-    "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/Operand.qll"
+    "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/Operand.qll" 
   ],
   "IR IRType": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/IRType.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/IRType.qll",
     "csharp/ql/src/experimental/ir/implementation/IRType.qll"
   ],
   "IR IRConfiguration": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/IRConfiguration.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/IRConfiguration.qll",
     "csharp/ql/src/experimental/ir/implementation/IRConfiguration.qll"
   ],
   "IR UseSoundEscapeAnalysis": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/UseSoundEscapeAnalysis.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/UseSoundEscapeAnalysis.qll",
     "csharp/ql/src/experimental/ir/implementation/UseSoundEscapeAnalysis.qll"
   ],
   "IR IRFunctionBase": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/internal/IRFunctionBase.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/internal/IRFunctionBase.qll",
     "csharp/ql/src/experimental/ir/implementation/internal/IRFunctionBase.qll"
   ],
   "IR Operand Tag": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/internal/OperandTag.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/internal/OperandTag.qll",
     "csharp/ql/src/experimental/ir/implementation/internal/OperandTag.qll"
   ],
-  "IR TInstruction": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/internal/TInstruction.qll",
+  "IR TInstruction":[
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/internal/TInstruction.qll",
     "csharp/ql/src/experimental/ir/implementation/internal/TInstruction.qll"
   ],
-  "IR TIRVariable": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/internal/TIRVariable.qll",
+  "IR TIRVariable":[
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/internal/TIRVariable.qll",
     "csharp/ql/src/experimental/ir/implementation/internal/TIRVariable.qll"
   ],
   "IR IR": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/IR.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/IR.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/IR.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/IR.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/IR.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/IR.qll",
     "csharp/ql/src/experimental/ir/implementation/raw/IR.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/IR.qll"
   ],
   "IR IRConsistency": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/IRConsistency.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/IRConsistency.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/IRConsistency.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/IRConsistency.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/IRConsistency.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/IRConsistency.qll",
     "csharp/ql/src/experimental/ir/implementation/raw/IRConsistency.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/IRConsistency.qll"
   ],
   "IR PrintIR": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/PrintIR.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/PrintIR.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/PrintIR.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/PrintIR.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/PrintIR.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/PrintIR.qll",
     "csharp/ql/src/experimental/ir/implementation/raw/PrintIR.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/PrintIR.qll"
   ],
   "IR IntegerConstant": [
-    "cpp/ql/lib/semmle/code/cpp/ir/internal/IntegerConstant.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/internal/IntegerConstant.qll",
     "csharp/ql/src/experimental/ir/internal/IntegerConstant.qll"
   ],
   "IR IntegerInteval": [
-    "cpp/ql/lib/semmle/code/cpp/ir/internal/IntegerInterval.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/internal/IntegerInterval.qll",
     "csharp/ql/src/experimental/ir/internal/IntegerInterval.qll"
   ],
   "IR IntegerPartial": [
-    "cpp/ql/lib/semmle/code/cpp/ir/internal/IntegerPartial.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/internal/IntegerPartial.qll",
     "csharp/ql/src/experimental/ir/internal/IntegerPartial.qll"
   ],
   "IR Overlap": [
-    "cpp/ql/lib/semmle/code/cpp/ir/internal/Overlap.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/internal/Overlap.qll",
     "csharp/ql/src/experimental/ir/internal/Overlap.qll"
   ],
   "IR EdgeKind": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/EdgeKind.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/EdgeKind.qll",
     "csharp/ql/src/experimental/ir/implementation/EdgeKind.qll"
   ],
   "IR MemoryAccessKind": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/MemoryAccessKind.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/MemoryAccessKind.qll",
     "csharp/ql/src/experimental/ir/implementation/MemoryAccessKind.qll"
   ],
   "IR TempVariableTag": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/TempVariableTag.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/TempVariableTag.qll",
     "csharp/ql/src/experimental/ir/implementation/TempVariableTag.qll"
   ],
   "IR Opcode": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/Opcode.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/Opcode.qll",
     "csharp/ql/src/experimental/ir/implementation/Opcode.qll"
   ],
   "IR SSAConsistency": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConsistency.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConsistency.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConsistency.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConsistency.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/SSAConsistency.qll"
   ],
   "C++ IR InstructionImports": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/InstructionImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/InstructionImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/InstructionImports.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/InstructionImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/InstructionImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/InstructionImports.qll"
   ],
   "C++ IR IRImports": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/IRImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/IRImports.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/IRImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/IRImports.qll"
   ],
   "C++ IR IRBlockImports": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/IRBlockImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRBlockImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/IRBlockImports.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/IRBlockImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRBlockImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/IRBlockImports.qll"
   ],
   "C++ IR IRFunctionImports": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/IRFunctionImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRFunctionImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/IRFunctionImports.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/IRFunctionImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRFunctionImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/IRFunctionImports.qll"
   ],
   "C++ IR IRVariableImports": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/IRVariableImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRVariableImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/IRVariableImports.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/IRVariableImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRVariableImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/IRVariableImports.qll"
   ],
   "C++ IR OperandImports": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/OperandImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/OperandImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/OperandImports.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/OperandImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/OperandImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/OperandImports.qll"
   ],
   "C++ IR PrintIRImports": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/PrintIRImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/PrintIRImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/PrintIRImports.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/PrintIRImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/PrintIRImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/PrintIRImports.qll"
   ],
   "C++ SSA SSAConstructionImports": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConstructionImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstructionImports.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConstructionImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstructionImports.qll"
   ],
   "SSA AliasAnalysis": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysis.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysis.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll"
   ],
-  "SSA PrintAliasAnalysis": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/PrintAliasAnalysis.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/PrintAliasAnalysis.qll"
-  ],
   "C++ SSA AliasAnalysisImports": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysisImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysisImports.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysisImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysisImports.qll"
   ],
   "C++ IR ValueNumberingImports": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/gvn/internal/ValueNumberingImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/internal/ValueNumberingImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/internal/ValueNumberingImports.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/gvn/internal/ValueNumberingImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/internal/ValueNumberingImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/internal/ValueNumberingImports.qll"
   ],
   "IR SSA SimpleSSA": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SimpleSSA.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SimpleSSA.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/SimpleSSA.qll"
   ],
   "IR AliasConfiguration (unaliased_ssa)": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasConfiguration.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasConfiguration.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/AliasConfiguration.qll"
   ],
   "IR SSA SSAConstruction": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstruction.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstruction.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll"
   ],
   "IR SSA PrintSSA": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/PrintSSA.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/PrintSSA.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/PrintSSA.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/PrintSSA.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/PrintSSA.qll"
   ],
   "IR ValueNumberInternal": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/gvn/internal/ValueNumberingInternal.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/internal/ValueNumberingInternal.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/internal/ValueNumberingInternal.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/gvn/internal/ValueNumberingInternal.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/internal/ValueNumberingInternal.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/internal/ValueNumberingInternal.qll",
     "csharp/ql/src/experimental/ir/implementation/raw/gvn/internal/ValueNumberingInternal.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/gvn/internal/ValueNumberingInternal.qll"
   ],
   "C++ IR ValueNumber": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/gvn/ValueNumbering.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/ValueNumbering.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/ValueNumbering.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/gvn/ValueNumbering.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/ValueNumbering.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/ValueNumbering.qll",
     "csharp/ql/src/experimental/ir/implementation/raw/gvn/ValueNumbering.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/gvn/ValueNumbering.qll"
   ],
   "C++ IR PrintValueNumbering": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/gvn/PrintValueNumbering.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/PrintValueNumbering.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/PrintValueNumbering.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/gvn/PrintValueNumbering.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/PrintValueNumbering.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/PrintValueNumbering.qll",
     "csharp/ql/src/experimental/ir/implementation/raw/gvn/PrintValueNumbering.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/gvn/PrintValueNumbering.qll"
   ],
   "C++ IR ConstantAnalysis": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/constant/ConstantAnalysis.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/constant/ConstantAnalysis.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/constant/ConstantAnalysis.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/constant/ConstantAnalysis.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/constant/ConstantAnalysis.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/constant/ConstantAnalysis.qll"
   ],
   "C++ IR PrintConstantAnalysis": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/constant/PrintConstantAnalysis.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/constant/PrintConstantAnalysis.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/constant/PrintConstantAnalysis.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/constant/PrintConstantAnalysis.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/constant/PrintConstantAnalysis.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/constant/PrintConstantAnalysis.qll"
   ],
   "C++ IR ReachableBlock": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/reachability/ReachableBlock.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/reachability/ReachableBlock.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/reachability/ReachableBlock.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/reachability/ReachableBlock.qll"
   ],
   "C++ IR PrintReachableBlock": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/reachability/PrintReachableBlock.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/reachability/PrintReachableBlock.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/reachability/PrintReachableBlock.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/reachability/PrintReachableBlock.qll"
   ],
   "C++ IR Dominance": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/reachability/Dominance.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/reachability/Dominance.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/reachability/Dominance.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/reachability/Dominance.qll"
   ],
   "C++ IR PrintDominance": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/reachability/PrintDominance.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/reachability/PrintDominance.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/reachability/PrintDominance.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/reachability/PrintDominance.qll"
   ],
   "C# IR InstructionImports": [
     "csharp/ql/src/experimental/ir/implementation/raw/internal/InstructionImports.qll",
@@ -361,105 +325,11 @@
     "csharp/ql/src/experimental/ir/implementation/raw/gvn/internal/ValueNumberingImports.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/gvn/internal/ValueNumberingImports.qll"
   ],
-  "C# ControlFlowReachability": [
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/ControlFlowReachability.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/ControlFlowReachability.qll"
-  ],
-  "Inline Test Expectations": [
-    "cpp/ql/test/TestUtilities/InlineExpectationsTest.qll",
-    "java/ql/test/TestUtilities/InlineExpectationsTest.qll",
-    "python/ql/test/TestUtilities/InlineExpectationsTest.qll"
-  ],
-  "C++ ExternalAPIs": [
-    "cpp/ql/src/Security/CWE/CWE-020/ExternalAPIs.qll",
-    "cpp/ql/src/Security/CWE/CWE-020/ir/ExternalAPIs.qll"
-  ],
-  "C++ SafeExternalAPIFunction": [
-    "cpp/ql/src/Security/CWE/CWE-020/SafeExternalAPIFunction.qll",
-    "cpp/ql/src/Security/CWE/CWE-020/ir/SafeExternalAPIFunction.qll"
-  ],
   "XML": [
-    "cpp/ql/lib/semmle/code/cpp/XML.qll",
-    "csharp/ql/lib/semmle/code/csharp/XML.qll",
-    "java/ql/lib/semmle/code/xml/XML.qll",
-    "javascript/ql/lib/semmle/javascript/XML.qll",
-    "python/ql/lib/semmle/python/xml/XML.qll"
-  ],
-  "DuplicationProblems.inc.qhelp": [
-    "cpp/ql/src/Metrics/Files/DuplicationProblems.inc.qhelp",
-    "javascript/ql/src/Metrics/DuplicationProblems.inc.qhelp",
-    "python/ql/src/Metrics/DuplicationProblems.inc.qhelp"
-  ],
-  "CommentedOutCodeQuery.inc.qhelp": [
-    "cpp/ql/src/Documentation/CommentedOutCodeQuery.inc.qhelp",
-    "python/ql/src/Lexical/CommentedOutCodeQuery.inc.qhelp",
-    "csharp/ql/src/Bad Practices/Comments/CommentedOutCodeQuery.inc.qhelp",
-    "java/ql/src/Violations of Best Practice/Comments/CommentedOutCodeQuery.inc.qhelp",
-    "javascript/ql/src/Comments/CommentedOutCodeQuery.inc.qhelp"
-  ],
-  "FLinesOfCodeReferences.inc.qhelp": [
-    "java/ql/src/Metrics/Files/FLinesOfCodeReferences.inc.qhelp",
-    "javascript/ql/src/Metrics/FLinesOfCodeReferences.inc.qhelp"
-  ],
-  "FCommentRatioCommon.inc.qhelp": [
-    "java/ql/src/Metrics/Files/FCommentRatioCommon.inc.qhelp",
-    "javascript/ql/src/Metrics/FCommentRatioCommon.inc.qhelp"
-  ],
-  "FLinesOfCodeOverview.inc.qhelp": [
-    "java/ql/src/Metrics/Files/FLinesOfCodeOverview.inc.qhelp",
-    "javascript/ql/src/Metrics/FLinesOfCodeOverview.inc.qhelp"
-  ],
-  "CommentedOutCodeMetricOverview.inc.qhelp": [
-    "cpp/ql/src/Metrics/Files/CommentedOutCodeMetricOverview.inc.qhelp",
-    "csharp/ql/src/Metrics/Files/CommentedOutCodeMetricOverview.inc.qhelp",
-    "java/ql/src/Metrics/Files/CommentedOutCodeMetricOverview.inc.qhelp",
-    "javascript/ql/src/Comments/CommentedOutCodeMetricOverview.inc.qhelp",
-    "python/ql/src/Lexical/CommentedOutCodeMetricOverview.inc.qhelp"
-  ],
-  "FLinesOfDuplicatedCodeCommon.inc.qhelp": [
-    "cpp/ql/src/Metrics/Files/FLinesOfDuplicatedCodeCommon.inc.qhelp",
-    "java/ql/src/Metrics/Files/FLinesOfDuplicatedCodeCommon.inc.qhelp",
-    "javascript/ql/src/Metrics/FLinesOfDuplicatedCodeCommon.inc.qhelp",
-    "python/ql/src/Metrics/FLinesOfDuplicatedCodeCommon.inc.qhelp"
-  ],
-  "CommentedOutCodeReferences.inc.qhelp": [
-    "cpp/ql/src/Metrics/Files/CommentedOutCodeReferences.inc.qhelp",
-    "csharp/ql/src/Metrics/Files/CommentedOutCodeReferences.inc.qhelp",
-    "java/ql/src/Metrics/Files/CommentedOutCodeReferences.inc.qhelp",
-    "javascript/ql/src/Comments/CommentedOutCodeReferences.inc.qhelp",
-    "python/ql/src/Lexical/CommentedOutCodeReferences.inc.qhelp"
-  ],
-  "IDE Contextual Queries": [
-    "cpp/ql/src/IDEContextual.qll",
-    "csharp/ql/src/IDEContextual.qll",
-    "java/ql/src/IDEContextual.qll",
-    "javascript/ql/src/IDEContextual.qll",
-    "python/ql/src/analysis/IDEContextual.qll"
-  ],
-  "SSA C#": [
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/SsaImplCommon.qll",
-    "csharp/ql/lib/semmle/code/csharp/controlflow/internal/pressa/SsaImplCommon.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/basessa/SsaImplCommon.qll",
-    "csharp/ql/lib/semmle/code/cil/internal/SsaImplCommon.qll"
-  ],
-  "CryptoAlgorithms Python/JS": [
-    "javascript/ql/lib/semmle/javascript/security/CryptoAlgorithms.qll",
-    "python/ql/lib/semmle/python/concepts/CryptoAlgorithms.qll"
-  ],
-  "SensitiveDataHeuristics Python/JS": [
-    "javascript/ql/lib/semmle/javascript/security/internal/SensitiveDataHeuristics.qll",
-    "python/ql/lib/semmle/python/security/internal/SensitiveDataHeuristics.qll"
-  ],
-  "ReDoS Util Python/JS": [
-    "javascript/ql/lib/semmle/javascript/security/performance/ReDoSUtil.qll",
-    "python/ql/lib/semmle/python/security/performance/ReDoSUtil.qll"
-  ],
-  "ReDoS Exponential Python/JS": [
-    "javascript/ql/lib/semmle/javascript/security/performance/ExponentialBackTracking.qll",
-    "python/ql/lib/semmle/python/security/performance/ExponentialBackTracking.qll"
-  ],
-  "ReDoS Polynomial Python/JS": [
-    "javascript/ql/lib/semmle/javascript/security/performance/SuperlinearBackTracking.qll",
-    "python/ql/lib/semmle/python/security/performance/SuperlinearBackTracking.qll"
+    "cpp/ql/src/semmle/code/cpp/XML.qll",
+    "csharp/ql/src/semmle/code/csharp/XML.qll",
+    "java/ql/src/semmle/code/xml/XML.qll",
+    "javascript/ql/src/semmle/javascript/XML.qll",
+    "python/ql/src/semmle/python/xml/XML.qll"
   ]
-}
+}

cpp/autobuilder/Semmle.Autobuild.Cpp.Tests/BuildScripts.cs

@@ -5,7 +5,6 @@ using System;
 using System.Linq;
 using Microsoft.Build.Construction;
 using System.Xml;
-using System.IO;
 
 namespace Semmle.Autobuild.Cpp.Tests
 {
@@ -44,8 +43,6 @@ namespace Semmle.Autobuild.Cpp.Tests
         public IDictionary<string, int> RunProcess = new Dictionary<string, int>();
         public IDictionary<string, string> RunProcessOut = new Dictionary<string, string>();
         public IDictionary<string, string> RunProcessWorkingDirectory = new Dictionary<string, string>();
-        public HashSet<string> CreateDirectories { get; } = new HashSet<string>();
-        public HashSet<(string, string)> DownloadFiles { get; } = new HashSet<(string, string)>();
 
         int IBuildActions.RunProcess(string cmd, string args, string? workingDirectory, IDictionary<string, string>? env, out IList<string> stdOut)
         {
@@ -138,14 +135,6 @@ namespace Semmle.Autobuild.Cpp.Tests
 
         string IBuildActions.GetFullPath(string path) => path;
 
-        string? IBuildActions.GetFileName(string? path) => Path.GetFileName(path?.Replace('\\', '/'));
-
-        public string? GetDirectoryName(string? path)
-        {
-            var dir = Path.GetDirectoryName(path?.Replace('\\', '/'));
-            return dir is null ? path : path?.Substring(0, dir.Length);
-        }
-
         void IBuildActions.WriteAllText(string filename, string contents)
         {
         }
@@ -164,18 +153,6 @@ namespace Semmle.Autobuild.Cpp.Tests
                 s = s.Replace($"%{kvp.Key}%", kvp.Value);
             return s;
         }
-
-        public void CreateDirectory(string path)
-        {
-            if (!CreateDirectories.Contains(path))
-                throw new ArgumentException($"Missing CreateDirectory, {path}");
-        }
-
-        public void DownloadFile(string address, string fileName)
-        {
-            if (!DownloadFiles.Contains((address, fileName)))
-                throw new ArgumentException($"Missing DownloadFile, {address}, {fileName}");
-        }
     }
 
     /// <summary>
@@ -236,7 +213,6 @@ namespace Semmle.Autobuild.Cpp.Tests
             Actions.GetEnvironmentVariable[$"CODEQL_EXTRACTOR_{codeqlUpperLanguage}_SOURCE_ARCHIVE_DIR"] = "";
             Actions.GetEnvironmentVariable[$"CODEQL_EXTRACTOR_{codeqlUpperLanguage}_ROOT"] = $@"C:\codeql\{codeqlUpperLanguage.ToLowerInvariant()}";
             Actions.GetEnvironmentVariable["CODEQL_JAVA_HOME"] = @"C:\codeql\tools\java";
-            Actions.GetEnvironmentVariable["CODEQL_PLATFORM"] = "win64";
             Actions.GetEnvironmentVariable["SEMMLE_DIST"] = @"C:\odasa";
             Actions.GetEnvironmentVariable["SEMMLE_JAVA_HOME"] = @"C:\odasa\tools\java";
             Actions.GetEnvironmentVariable["SEMMLE_PLATFORM_TOOLS"] = @"C:\odasa\tools";
@@ -297,8 +273,7 @@ namespace Semmle.Autobuild.Cpp.Tests
         [Fact]
         public void TestCppAutobuilderSuccess()
         {
-            Actions.RunProcess[@"cmd.exe /C nuget restore C:\Project\test.sln -DisableParallelProcessing"] = 1;
-            Actions.RunProcess[@"cmd.exe /C C:\Project\.nuget\nuget.exe restore C:\Project\test.sln -DisableParallelProcessing"] = 0;
+            Actions.RunProcess[@"cmd.exe /C C:\odasa\tools\csharp\nuget\nuget.exe restore C:\Project\test.sln"] = 1;
             Actions.RunProcess[@"cmd.exe /C CALL ^""C:\Program Files ^(x86^)\Microsoft Visual Studio 14.0\VC\vcvarsall.bat^"" && set Platform=&& type NUL && C:\odasa\tools\odasa index --auto msbuild C:\Project\test.sln /p:UseSharedCompilation=false /t:rebuild /p:Platform=""x86"" /p:Configuration=""Release"" /p:MvcBuildViews=true"] = 0;
             Actions.RunProcessOut[@"C:\Program Files (x86)\Microsoft Visual Studio\Installer\vswhere.exe -prerelease -legacy -property installationPath"] = "";
             Actions.RunProcess[@"C:\Program Files (x86)\Microsoft Visual Studio\Installer\vswhere.exe -prerelease -legacy -property installationPath"] = 1;
@@ -311,13 +286,11 @@ namespace Semmle.Autobuild.Cpp.Tests
             Actions.FileExists[@"C:\Program Files (x86)\Microsoft Visual Studio\Installer\vswhere.exe"] = true;
             Actions.EnumerateFiles[@"C:\Project"] = "foo.cs\ntest.slx";
             Actions.EnumerateDirectories[@"C:\Project"] = "";
-            Actions.CreateDirectories.Add(@"C:\Project\.nuget");
-            Actions.DownloadFiles.Add(("https://dist.nuget.org/win-x86-commandline/latest/nuget.exe", @"C:\Project\.nuget\nuget.exe"));
 
             var autobuilder = CreateAutoBuilder(true);
             var solution = new TestSolution(@"C:\Project\test.sln");
             autobuilder.ProjectsOrSolutionsToBuild.Add(solution);
-            TestAutobuilderScript(autobuilder, 0, 3);
+            TestAutobuilderScript(autobuilder, 0, 2);
         }
     }
 }

cpp/autobuilder/Semmle.Autobuild.Cpp.Tests/Semmle.Autobuild.Cpp.Tests.csproj

@@ -2,7 +2,7 @@
 
   <PropertyGroup>
     <OutputType>Exe</OutputType>
-    <TargetFramework>net5.0</TargetFramework>
+    <TargetFramework>netcoreapp3.0</TargetFramework>
     <GenerateAssemblyInfo>false</GenerateAssemblyInfo>
     <RuntimeIdentifiers>win-x64;linux-x64;osx-x64</RuntimeIdentifiers>
     <Nullable>enable</Nullable>

cpp/autobuilder/Semmle.Autobuild.Cpp/Semmle.Autobuild.Cpp.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
-    <TargetFramework>net5.0</TargetFramework>
+    <TargetFramework>netcoreapp3.0</TargetFramework>
     <AssemblyName>Semmle.Autobuild.Cpp</AssemblyName>
     <RootNamespace>Semmle.Autobuild.Cpp</RootNamespace>
     <ApplicationIcon />
@@ -17,7 +17,7 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Build" Version="16.9.0" />
+    <PackageReference Include="Microsoft.Build" Version="16.0.461" />
   </ItemGroup>
 
   <ItemGroup>

cpp/change-notes/2020-09-29-range-analysis-rollup.md

@@ -1,14 +0,0 @@
-lgtm,codescanning
-* The `SimpleRangeAnalysis` library has gained support for several language
-  constructs it did not support previously. These improvements primarily affect
-  the queries `cpp/constant-comparison`, `cpp/comparison-with-wider-type`, and
-  `cpp/integer-multiplication-cast-to-long`. The newly supported language
-  features are:
-    * Multiplication of unsigned numbers.
-    * Multiplication by a constant.
-    * Reference-typed function parameters.
-    * Comparing a variable not equal to an endpoint of its range, thus narrowing the range by one.
-    * Using `if (x)` or `if (!x)` or similar to test for equality to zero.
-* The `SimpleRangeAnalysis` library can now be extended with custom rules. See
-  examples in
-  `cpp/ql/src/experimental/semmle/code/cpp/rangeanalysis/extensions/`.

cpp/change-notes/2020-10-21-erroneous-types.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* The `cpp/wrong-type-format-argument` and `cpp/non-portable-printf` queries have been hardened so that they do not produce nonsensical results on databases that contain errors (specifically the `ErroneousType`).

cpp/change-notes/2020-10-21-size-check-queries.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* The 'Not enough memory allocated for pointer type' (cpp/allocation-too-small) and 'Not enough memory allocated for array of pointer type' (cpp/suspicious-allocation-size) queries have been improved. Previously some allocations would be reported by both queries, this no longer occurs. In addition more allocation functions are now understood by both queries.

cpp/change-notes/2020-11-02-unused-local-variable.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* Two issues causing the 'Unused local variable' query (`cpp/unused-local-variable`) to produce false positive results have been fixed.

cpp/change-notes/2020-11-05-formatting-function.md

@@ -1,4 +0,0 @@
-lgtm,codescanning
-* `FormattingFunction.getOutputParameterIndex` now has a parameter identifying whether the output at that index is a buffer or a stream.
-* `FormattingFunction` now has a predicate `isOutputGlobal` indicating when the output is to a global stream.
-* The `primitiveVariadicFormatter` and `variadicFormatter` predicates have more parameters exposing information about the function.

cpp/change-notes/2020-11-05-private-models.md

@@ -1,3 +0,0 @@
-lgtm,codescanning
-* Various classes in `semmle.code.cpp.models.implementations` have been made private. Users should not depend on library implementation details.
-* The `OperatorNewAllocationFunction`, `OperatorDeleteDeallocationFunction`, `Iterator` and `Snprintf` classes now have interfaces in `semmle.code.cpp.models.interfaces`.

cpp/change-notes/2020-11-12-unsafe-use-of-this.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* A new query (`cpp/unsafe-use-of-this`) has been added. The query finds pure virtual function calls whose qualifier is an object under construction.

cpp/change-notes/2020-11-27-downgrade-to-recommendation.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* The queries `cpp/local-variable-hides-global-variable` and `cpp/missing-header-guard` now have severity `recommendation` instead of `warning`.

cpp/change-notes/2021-02-04-unsigned-difference-expression-compared-zero.md

@@ -1,2 +0,0 @@
-lgtm
-* A new query (`cpp/unsigned-difference-expression-compared-zero`) is run but not yet displayed on LGTM. The query finds unsigned subtractions used in relational comparisons with the value 0. This query was originally submitted as an experimental query by @ihsinme in https://github.com/github/codeql/pull/4745.

cpp/change-notes/2021-02-24-memset-may-be-deleted.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* A new query (`cpp/memset-may-be-deleted`) is added to the default query suite. The query finds calls to `memset` that may be removed by the compiler. This behavior can make information-leak vulnerabilities easier to exploit. This query was originally [submitted as an experimental query by @ihsinme](https://github.com/github/codeql/pull/4953).

cpp/change-notes/2021-03-01-fluent-interface-data-flow.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* The data-flow library now recognises more side-effects of method chaining (e.g. `someObject.setX(clean).setY(tainted).setZ...` having a side-effect on `someObject`), as well as other related circumstances where a function input is directly passed to its output. All queries that use data-flow analysis, including most security queries, may return more results accordingly.

cpp/change-notes/2021-03-11-failed-extractions.md

@@ -1,2 +0,0 @@
-codescanning
-* Added cpp/diagnostics/failed-extractions. This query gives information about which extractions did not run to completion.

cpp/change-notes/2021-03-11-overflow-abs.md

@@ -1,2 +0,0 @@
-lgtm
-* The `cpp/tainted-arithmetic`, `cpp/arithmetic-with-extreme-values`, and `cpp/uncontrolled-arithmetic` queries now recognize more functions as returning the absolute value of their input. As a result, they produce fewer false positives.

cpp/change-notes/2021-03-17-av-rule-79.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* The 'Resource not released in destructor' (cpp/resource-not-released-in-destructor) query has been improved to recognize more releases of resources.

cpp/change-notes/2021-04-06-assign-where-compare-meant.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* The 'Assignment where comparison was intended' (cpp/assign-where-compare-meant) query has been improved to flag fewer benign assignments in conditionals.

cpp/change-notes/2021-04-09-unsigned-difference-expression-compared-zero.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* The 'Unsigned difference expression compared to zero' (cpp/unsigned-difference-expression-compared-zero) query has been improved to produce fewer false positive results.

cpp/change-notes/2021-04-13-arithmetic-queries.md

@@ -1,2 +0,0 @@
-lgtm
-* The queries cpp/tainted-arithmetic, cpp/uncontrolled-arithmetic, and cpp/arithmetic-with-extreme-values have been improved to produce fewer false positives.

cpp/change-notes/2021-04-21-return-stack-allocated-object.md

@@ -1,2 +0,0 @@
-codescanning
-* The 'Pointer to stack object used as return value' (cpp/return-stack-allocated-object) query has been deprecated, and any uses should be replaced with `Returning stack-allocated memory` (cpp/return-stack-allocated-memory).

cpp/change-notes/2021-04-26-more-sound-expr-might-overflow.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* The `exprMightOverflowPositively` and `exprMightOverflowNegatively` predicates from the `SimpleRangeAnalysis` library now recognize more expressions that might overflow.

cpp/change-notes/2021-05-10-comparison-with-wider-type.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* The 'Comparison with wider type' (cpp/comparison-with-wider-type) query has been improved to produce fewer false positives.

cpp/change-notes/2021-05-12-uncontrolled-arithmetic.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* The query "Uncontrolled arithmetic" (`cpp/uncontrolled-arithmetic`) has been improved to produce fewer false positives.

cpp/change-notes/2021-05-14-uncontrolled-allocation-size.md

@@ -1,2 +0,0 @@
-lgtm
-* The "Tainted allocation size" query (cpp/uncontrolled-allocation-size) has been improved to produce fewer false positives.

cpp/change-notes/2021-05-18-static-buffer-overflow.md

@@ -1,2 +0,0 @@
-lgtm
-* The "Static buffer overflow" query (cpp/static-buffer-overflow) has been improved to produce fewer false positives.

cpp/change-notes/2021-05-19-weak-cryptographic-algorithm.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* The "Use of a broken or risky cryptographic algorithm" (`cpp/weak-cryptographic-algorithm`) query has been enhanced to reduce false positive results, and (rarely) find more true positive results.

cpp/change-notes/2021-05-20-incorrect-allocation-error-handling.md

@@ -1,2 +0,0 @@
-lgtm
-* A new query (`cpp/incorrect-allocation-error-handling`) has been added. The query finds incorrect error-handling of calls to `operator new`. This query was originally [submitted as an experimental query by @ihsinme](https://github.com/github/codeql/pull/5010).

cpp/change-notes/2021-05-20-ref-qualifiers.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* lvalue/rvalue ref qualifiers are now accessible via the new predicates on `MemberFunction`(`.isLValueRefQualified`, `.isRValueRefQualified`, and `isRefQualified`).

cpp/change-notes/2021-05-21-unsafe-strncat.md

@@ -1,2 +0,0 @@
-lgtm
-* The "Potentially unsafe call to strncat" query (cpp/unsafe-strncat) query has been improved to detect more cases of unsafe calls to `strncat`.

cpp/change-notes/2021-06-10-std-types.md

@@ -1,4 +0,0 @@
-lgtm,codescanning
-* Added definitions for types found in `cstdint`. Added types `FixedWidthIntegralType`, `MinimumWidthIntegralType`, `FastestMinimumWidthIntegralType`, and `MaximumWidthIntegralType` to describe types such as `int8_t`, `int_least8_t`, `int_fast8_t`, and `intmax_t` respectively. 
-* Changed definition of `Intmax_t` and `Uintmax_t` to be part of the new type structure. 
-* Added a type `FixedWidthEnumType` which describes enums based on a fixed-width integer type. For instance, `enum e: uint8_t = { a, b };`.

cpp/change-notes/2021-06-21-weak-cryptographic-algorithm.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* The "Use of a broken or risky cryptographic algorithm" (`cpp/weak-cryptographic-algorithm`) query has been further improved to reduce false positives and its `@precision` increased to `high`.

cpp/change-notes/2021-06-22-sql-tainted.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* The 'Uncontrolled data in SQL query' (cpp/sql-injection) query now supports the `libpqxx` library.

cpp/change-notes/2021-06-24-dataflow-implicit-reads.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* The DataFlow libraries have been augmented with support for `Configuration`-specific in-place read steps at, for example, sinks and custom taint steps. This means that it is now possible to specify sinks that accept flow with non-empty access paths.

cpp/change-notes/2021-06-24-uncontrolled-arithmetic.md

@@ -1,2 +0,0 @@
-lgtm
-* The 'Uncontrolled data in arithmetic expression' (cpp/uncontrolled-arithmetic) query now recognizes more sources of randomness.

cpp/change-notes/2021-06-30-wrong-type-format-argument.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* The 'Wrong type of arguments to formatting function' (cpp/wrong-type-format-argument) query is now more accepting of the string and character formatting differences between Microsoft and non-Microsoft platforms.  There are now fewer false positive results.

cpp/change-notes/2021-07-13-cleartext-storage-file.md

@@ -1,3 +0,0 @@
-lgtm,codescanning
-* The "Cleartext storage of sensitive information in file" (cpp/cleartext-storage-file) query now uses dataflow to produce additional results.
-* Heuristics in the SensitiveExprs.qll library have been improved, making the "Cleartext storage of sensitive information in file" (cpp/cleartext-storage-file), "Cleartext storage of sensitive information in buffer" (cpp/cleartext-storage-buffer) and "Cleartext storage of sensitive information in an SQLite" (cpp/cleartext-storage-database) queries more accurate.

cpp/change-notes/2021-07-20-toctou-race-condition.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* Improvements have been made to the `cpp/toctou-race-condition` query, both to find more correct results and fewer false positive results.

cpp/change-notes/2021-07-27-uncontrolled-arithmetic.md

@@ -1,2 +0,0 @@
-lgtm
-* Improvements made to the (`cpp/uncontrolled-arithmetic`) query, reducing the frequency of false positive results.

cpp/change-notes/2021-07-29-virtual-function-declaration-specifiers.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* Virtual function specifiers are now accessible via the new predicates on `Function` (`.isDeclaredVirtual`, `.isOverride`, and `.isFinal`).

cpp/change-notes/2021-08-10-has-trailing-return-type.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* Added `Function.hasTrailingReturnType` predicate to check whether a function was declared with a trailing return type.

cpp/change-notes/2021-08-17-has-c-linkage.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* Added `RoutineType.hasCLinkage` predicate to check whether a function type has "C" language linkage.

cpp/change-notes/2021-08-23-ctime-weaken-claims.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* Lowered the precision of `cpp/potentially-dangerous-function` so it is run but not displayed on LGTM by default and so it's only run and displayed on Code Scanning if a broader suite like `cpp-security-extended` is opted into.

cpp/change-notes/2021-08-23-getPrimaryQlClasses.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* Added `Element.getPrimaryQlClasses()` predicate, which gets a comma-separated list of the names of the primary CodeQL classes to which this element belongs.

cpp/change-notes/2021-08-24-implicit-downcast-from-bitfield.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* The query `cpp/implicit-bitfield-downcast` now accounts for C++ reference types, which leads to more true positive results.

cpp/change-notes/2021-08-31-range-analysis-upper-bound.md

@@ -1,4 +0,0 @@
-lgtm,codescanning
-* The `SimpleRangeAnalysis` library includes information from the
-  immediate guard for determining the upper bound of a stack
-  variable for improved accuracy.

cpp/change-notes/2021-09-13-overflow-static.md

@@ -1,4 +0,0 @@
-lgtm,codescanning
-* The `memberMayBeVarSize` predicate considers more fields to be variable size.
-  As a result, the "Static buffer overflow" query (cpp/static-buffer-overflow)
-  produces fewer false positives.

cpp/change-notes/2021-09-27-overflow-static.md

@@ -1,3 +0,0 @@
-lgtm,codescanning
-* Increase precision to high for the "Static buffer overflow" query
-  (`cpp/static-buffer-overflow`). This means the query is run and displayed by default on Code Scanning and LGTM.

cpp/config/suites/cpp/correctness

@@ -9,8 +9,6 @@
 + semmlecode-cpp-queries/Likely Bugs/Conversion/CastArrayPointerArithmetic.ql: /Correctness/Dangerous Conversions
 + semmlecode-cpp-queries/Likely Bugs/Underspecified Functions/MistypedFunctionArguments.ql: /Correctness/Dangerous Conversions
 + semmlecode-cpp-queries/Security/CWE/CWE-253/HResultBooleanConversion.ql: /Correctness/Dangerous Conversions
-+ semmlecode-cpp-queries/Likely Bugs/OO/UnsafeUseOfThis.ql: /Correctness/Dangerous Conversions
-+ semmlecode-cpp-queries/Security/CWE/CWE-191/UnsignedDifferenceExpressionComparedZero.ql: /Correctness/Dangerous Conversions
   # Consistent Use
 + semmlecode-cpp-queries/Critical/ReturnValueIgnored.ql: /Correctness/Consistent Use
 + semmlecode-cpp-queries/Likely Bugs/InconsistentCheckReturnNull.ql: /Correctness/Consistent Use

cpp/ql/examples/qlpack.lock.yml

@@ -1,4 +0,0 @@
----
-dependencies: {}
-compiled: false
-lockVersion: 1.0.0

cpp/ql/examples/qlpack.yml

@@ -1,4 +1,3 @@
-name: codeql/cpp-examples
-version: 0.0.2
-dependencies:
-  codeql/cpp-all: "*"
+name: codeql-cpp-examples
+version: 0.0.0
+libraryPathDependencies: codeql-cpp

cpp/ql/examples/snippets/emptyblock.ql

@@ -9,6 +9,6 @@
 
 import cpp
 
-from BlockStmt blk
+from Block blk
 where blk.getNumStmt() = 0
 select blk

cpp/ql/examples/snippets/emptythen.ql

@@ -13,5 +13,5 @@
 import cpp
 
 from IfStmt i
-where i.getThen().(BlockStmt).getNumStmt() = 0
+where i.getThen().(Block).getNumStmt() = 0
 select i

cpp/ql/examples/snippets/singletonblock.ql

@@ -8,6 +8,6 @@
 
 import cpp
 
-from BlockStmt b
+from Block b
 where b.getNumStmt() = 1
 select b

cpp/ql/lib/experimental/semmle/code/cpp/models/interfaces/SimpleRangeAnalysisDefinition.qll

@@ -1,65 +0,0 @@
-/**
- * EXPERIMENTAL: The API of this module may change without notice.
- *
- * Provides a class for modeling `RangeSsaDefinition`s with a restricted range.
- */
-
-import cpp
-import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis
-
-/**
- * EXPERIMENTAL: The API of this class may change without notice.
- *
- * An SSA definition for which a range can be deduced. As with
- * `RangeSsaDefinition` and `SsaDefinition`, instances of this class
- * correspond to points in the program where one or more variables are defined
- * or have their value constrained in some way.
- *
- * Extend this class to add functionality to the range analysis library.
- */
-abstract class SimpleRangeAnalysisDefinition extends RangeSsaDefinition {
-  /**
-   * Holds if this `SimpleRangeAnalysisDefinition` adds range information for
-   * `v`. Because a `SimpleRangeAnalysisDefinition` is just a point in the
-   * program, it's possible that more than one variable might be defined at
-   * this point. This predicate clarifies which variable(s) should get range
-   * information from `this`.
-   *
-   * This predicate **must be overridden** to hold for any `v` that can show
-   * up in the other members of `SimpleRangeAnalysisDefinition`. Conversely,
-   * the other members **must be accurate** for any `v` in this predicate.
-   */
-  abstract predicate hasRangeInformationFor(StackVariable v);
-
-  /**
-   * Holds if `(this, v)` depends on the range of the unconverted expression
-   * `e`. This information is used to inform the range analysis about cyclic
-   * dependencies. Without this information, range analysis might work for
-   * simple cases but will go into infinite loops on complex code.
-   *
-   * For example, when modelling the definition by reference in a call to an
-   * overloaded `operator=`, written as `v = e`, the definition of `(this, v)`
-   * depends on `e`.
-   */
-  abstract predicate dependsOnExpr(StackVariable v, Expr e);
-
-  /**
-   * Gets the lower bound of the variable `v` defined by this definition.
-   *
-   * Implementations of this predicate should use
-   * `getFullyConvertedLowerBounds` and `getFullyConvertedUpperBounds` for
-   * recursive calls to get the bounds of their dependencies.
-   */
-  abstract float getLowerBounds(StackVariable v);
-
-  /**
-   * Gets the upper bound of the variable `v` defined by this definition.
-   *
-   * Implementations of this predicate should use
-   * `getFullyConvertedLowerBounds` and `getFullyConvertedUpperBounds` for
-   * recursive calls to get the bounds of their dependencies.
-   */
-  abstract float getUpperBounds(StackVariable v);
-}
-
-import SimpleRangeAnalysisInternal

cpp/ql/lib/experimental/semmle/code/cpp/models/interfaces/SimpleRangeAnalysisExpr.qll

@@ -1,78 +0,0 @@
-/**
- * EXPERIMENTAL: The API of this module may change without notice.
- *
- * Provides a class for modeling `Expr`s with a restricted range.
- */
-
-import cpp
-import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis
-
-/**
- * EXPERIMENTAL: The API of this class may change without notice.
- *
- * An expression for which a range can be deduced. Extend this class to add
- * functionality to the range analysis library.
- */
-abstract class SimpleRangeAnalysisExpr extends Expr {
-  /**
-   * Gets the lower bound of the expression.
-   *
-   * Implementations of this predicate should use
-   * `getFullyConvertedLowerBounds` and `getFullyConvertedUpperBounds` for
-   * recursive calls to get the bounds of their children.
-   */
-  abstract float getLowerBounds();
-
-  /**
-   * Gets the upper bound of the expression.
-   *
-   * Implementations of this predicate should use
-   * `getFullyConvertedLowerBounds` and `getFullyConvertedUpperBounds` for
-   * recursive calls to get the bounds of their children.
-   */
-  abstract float getUpperBounds();
-
-  /**
-   * Holds if the range this expression depends on the definition `srcDef` for
-   * StackVariable `srcVar`.
-   *
-   * Because this predicate cannot be recursive, most implementations should
-   * override `dependsOnChild` instead.
-   */
-  predicate dependsOnDef(RangeSsaDefinition srcDef, StackVariable srcVar) { none() }
-
-  /**
-   * Holds if this expression depends on the range of its unconverted
-   * subexpression `child`. This information is used to inform the range
-   * analysis about cyclic dependencies. Without this information, range
-   * analysis might work for simple cases but will go into infinite loops on
-   * complex code.
-   *
-   * For example, when modeling a function call whose return value depends on
-   * all of its arguments, implement this predicate as
-   * `child = this.getAnArgument()`.
-   */
-  abstract predicate dependsOnChild(Expr child);
-}
-
-import SimpleRangeAnalysisInternal
-
-/**
- * This class exists to prevent the QL front end from emitting compile errors
- * inside `SimpleRangeAnalysis.qll` about certain conjuncts being empty
- * because the overrides of `SimpleRangeAnalysisExpr` that happen to be in
- * scope do not make use of every feature it offers.
- */
-private class Empty extends SimpleRangeAnalysisExpr {
-  Empty() {
-    // This predicate is complicated enough that the QL type checker doesn't
-    // see it as empty but simple enough that the optimizer should.
-    this = this and none()
-  }
-
-  override float getLowerBounds() { none() }
-
-  override float getUpperBounds() { none() }
-
-  override predicate dependsOnChild(Expr child) { none() }
-}

cpp/ql/lib/experimental/semmle/code/cpp/rangeanalysis/ExtendedRangeAnalysis.qll

@@ -1,5 +0,0 @@
-import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis
-//
-// Import each extension we want to enable
-import extensions.SubtractSelf
-import extensions.ConstantBitwiseAndExprRange

cpp/ql/lib/experimental/semmle/code/cpp/rangeanalysis/extensions/ConstantBitwiseAndExprRange.qll

@@ -1,90 +0,0 @@
-private import cpp
-private import experimental.semmle.code.cpp.models.interfaces.SimpleRangeAnalysisExpr
-private import semmle.code.cpp.rangeanalysis.RangeAnalysisUtils
-
-/**
- * Holds if `e` is a constant or if it is a variable with a constant value
- */
-float evaluateConstantExpr(Expr e) {
-  result = e.getValue().toFloat()
-  or
-  exists(SsaDefinition defn, StackVariable sv |
-    defn.getAUse(sv) = e and
-    result = defn.getDefiningValue(sv).getValue().toFloat()
-  )
-}
-
-/**
- * The current implementation for `BitwiseAndExpr` only handles cases where both operands are
- * either unsigned or non-negative constants. This class not only covers these cases, but also
- * adds support for `&` expressions between a signed integer with a non-negative range and a
- * non-negative constant. It also adds support for `&=` for the same set of cases as `&`.
- */
-private class ConstantBitwiseAndExprRange extends SimpleRangeAnalysisExpr {
-  ConstantBitwiseAndExprRange() {
-    exists(Expr l, Expr r |
-      l = this.(BitwiseAndExpr).getLeftOperand() and
-      r = this.(BitwiseAndExpr).getRightOperand()
-      or
-      l = this.(AssignAndExpr).getLValue() and
-      r = this.(AssignAndExpr).getRValue()
-    |
-      // No operands can be negative constants
-      not (evaluateConstantExpr(l) < 0 or evaluateConstantExpr(r) < 0) and
-      // At least one operand must be a non-negative constant
-      (evaluateConstantExpr(l) >= 0 or evaluateConstantExpr(r) >= 0)
-    )
-  }
-
-  Expr getLeftOperand() {
-    result = this.(BitwiseAndExpr).getLeftOperand() or
-    result = this.(AssignAndExpr).getLValue()
-  }
-
-  Expr getRightOperand() {
-    result = this.(BitwiseAndExpr).getRightOperand() or
-    result = this.(AssignAndExpr).getRValue()
-  }
-
-  override float getLowerBounds() {
-    // If an operand can have negative values, the lower bound is unconstrained.
-    // Otherwise, the lower bound is zero.
-    exists(float lLower, float rLower |
-      lLower = getFullyConvertedLowerBounds(getLeftOperand()) and
-      rLower = getFullyConvertedLowerBounds(getRightOperand()) and
-      (
-        (lLower < 0 or rLower < 0) and
-        result = exprMinVal(this)
-        or
-        // This technically results in two lowerBounds when an operand range is negative, but
-        // that's fine since `exprMinVal(x) <= 0`. We can't use an if statement here without
-        // non-monotonic recursion issues
-        result = 0
-      )
-    )
-  }
-
-  override float getUpperBounds() {
-    // If an operand can have negative values, the upper bound is unconstrained.
-    // Otherwise, the upper bound is the minimum of the upper bounds of the operands
-    exists(float lLower, float lUpper, float rLower, float rUpper |
-      lLower = getFullyConvertedLowerBounds(getLeftOperand()) and
-      lUpper = getFullyConvertedUpperBounds(getLeftOperand()) and
-      rLower = getFullyConvertedLowerBounds(getRightOperand()) and
-      rUpper = getFullyConvertedUpperBounds(getRightOperand()) and
-      (
-        (lLower < 0 or rLower < 0) and
-        result = exprMaxVal(this)
-        or
-        // This technically results in two upperBounds when an operand range is negative, but
-        // that's fine since `exprMaxVal(b) >= result`. We can't use an if statement here without
-        // non-monotonic recursion issues
-        result = rUpper.minimum(lUpper)
-      )
-    )
-  }
-
-  override predicate dependsOnChild(Expr child) {
-    child = getLeftOperand() or child = getRightOperand()
-  }
-}

cpp/ql/lib/experimental/semmle/code/cpp/rangeanalysis/extensions/SubtractSelf.qll

@@ -1,15 +0,0 @@
-import experimental.semmle.code.cpp.models.interfaces.SimpleRangeAnalysisExpr
-
-private class SelfSub extends SimpleRangeAnalysisExpr, SubExpr {
-  SelfSub() {
-    // Match `x - x` but not `myInt - (unsigned char)myInt`.
-    getLeftOperand().getExplicitlyConverted().(VariableAccess).getTarget() =
-      getRightOperand().getExplicitlyConverted().(VariableAccess).getTarget()
-  }
-
-  override float getLowerBounds() { result = 0 }
-
-  override float getUpperBounds() { result = 0 }
-
-  override predicate dependsOnChild(Expr child) { none() }
-}

cpp/ql/lib/experimental/semmle/code/cpp/security/PrivateCleartextWrite.qll

@@ -1,62 +0,0 @@
-/**
- * Provides a taint-tracking configuration for reasoning about private information flowing unencrypted to an external location.
- */
-
-import cpp
-import semmle.code.cpp.dataflow.TaintTracking
-import experimental.semmle.code.cpp.security.PrivateData
-import semmle.code.cpp.security.FileWrite
-import semmle.code.cpp.security.BufferWrite
-
-module PrivateCleartextWrite {
-  /**
-   * A data flow source for private information flowing unencrypted to an external location.
-   */
-  abstract class Source extends DataFlow::ExprNode { }
-
-  /**
-   * A data flow sink for private information flowing unencrypted to an external location.
-   */
-  abstract class Sink extends DataFlow::ExprNode { }
-
-  /**
-   * A sanitizer for private information flowing unencrypted to an external location.
-   */
-  abstract class Sanitizer extends DataFlow::ExprNode { }
-
-  /** A call to any method whose name suggests that it encodes or encrypts the parameter. */
-  class ProtectSanitizer extends Sanitizer {
-    ProtectSanitizer() {
-      exists(Function m, string s |
-        this.getExpr().(FunctionCall).getTarget() = m and
-        m.getName().regexpMatch("(?i).*" + s + ".*")
-      |
-        s = "protect" or s = "encode" or s = "encrypt"
-      )
-    }
-  }
-
-  class WriteConfig extends TaintTracking::Configuration {
-    WriteConfig() { this = "Write configuration" }
-
-    override predicate isSource(DataFlow::Node source) { source instanceof Source }
-
-    override predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
-
-    override predicate isSanitizer(DataFlow::Node node) { node instanceof Sanitizer }
-  }
-
-  class PrivateDataSource extends Source {
-    PrivateDataSource() { this.getExpr() instanceof PrivateDataExpr }
-  }
-
-  class WriteSink extends Sink {
-    WriteSink() {
-      exists(FileWrite f, BufferWrite b |
-        this.asExpr() = f.getASource()
-        or
-        this.asExpr() = b.getAChild()
-      )
-    }
-  }
-}

cpp/ql/lib/experimental/semmle/code/cpp/security/PrivateData.qll

@@ -1,53 +0,0 @@
-/**
- * Provides classes and predicates for identifying private data and functions for security.
- *
- * 'Private' data in general is anything that would compromise user privacy if exposed. This
- * library tries to guess where private data may either be stored in a variable or produced by a
- * function.
- *
- * This library is not concerned with credentials. See `SensitiveActions` for expressions related
- * to credentials.
- */
-
-import cpp
-
-/** A string for `match` that identifies strings that look like they represent private data. */
-private string privateNames() {
-  // Inspired by the list on https://cwe.mitre.org/data/definitions/359.html
-  // Government identifiers, such as Social Security Numbers
-  result = "%social%security%number%" or
-  // Contact information, such as home addresses and telephone numbers
-  result = "%postcode%" or
-  result = "%zipcode%" or
-  // result = "%telephone%" or
-  // Geographic location - where the user is (or was)
-  result = "%latitude%" or
-  result = "%longitude%" or
-  // Financial data - such as credit card numbers, salary, bank accounts, and debts
-  result = "%creditcard%" or
-  result = "%salary%" or
-  result = "%bankaccount%" or
-  // Communications - e-mail addresses, private e-mail messages, SMS text messages, chat logs, etc.
-  // result = "%email%" or
-  // result = "%mobile%" or
-  result = "%employer%" or
-  // Health - medical conditions, insurance status, prescription records
-  result = "%medical%"
-}
-
-/** An expression that might contain private data. */
-abstract class PrivateDataExpr extends Expr { }
-
-/** A functiond call that might produce private data. */
-class PrivateFunctionCall extends PrivateDataExpr, FunctionCall {
-  PrivateFunctionCall() {
-    exists(string s | this.getTarget().getName().toLowerCase() = s | s.matches(privateNames()))
-  }
-}
-
-/** An access to a variable that might contain private data. */
-class PrivateVariableAccess extends PrivateDataExpr, VariableAccess {
-  PrivateVariableAccess() {
-    exists(string s | this.getTarget().getName().toLowerCase() = s | s.matches(privateNames()))
-  }
-}

cpp/ql/lib/qlpack.lock.yml

@@ -1,4 +0,0 @@
----
-dependencies: {}
-compiled: false
-lockVersion: 1.0.0

cpp/ql/lib/qlpack.yml

@@ -1,7 +0,0 @@
-name: codeql/cpp-all
-version: 0.0.2
-dbscheme: semmlecode.cpp.dbscheme
-extractor: cpp
-library: true
-dependencies:
-  codeql/cpp-upgrades: 0.0.2

cpp/ql/lib/semmle/code/cpp/Comments.qll

@@ -1,54 +0,0 @@
-/**
- * Provides classes representing C and C++ comments.
- */
-
-import semmle.code.cpp.Location
-import semmle.code.cpp.Element
-
-/**
- * A C/C++ comment. For example the comment in the following code:
- * ```
- * // C++ style single-line comment
- * ```
- * or a C style comment (which starts with `/*`).
- */
-class Comment extends Locatable, @comment {
-  override string toString() { result = this.getContents() }
-
-  override Location getLocation() { comments(underlyingElement(this), _, result) }
-
-  /**
-   * Gets the text of this comment, including the opening `//` or `/*`, and the closing `*``/` if
-   * present.
-   */
-  string getContents() { comments(underlyingElement(this), result, _) }
-
-  /**
-   * Gets the AST element this comment is associated with. For example, the comment in the
-   * following code is associated with the declaration of `j`.
-   * ```
-   * int i;
-   * int j; // Comment on j
-   * ```
-   */
-  Element getCommentedElement() {
-    commentbinding(underlyingElement(this), unresolveElement(result))
-  }
-}
-
-/**
- * A C style comment (one which starts with `/*`).
- */
-class CStyleComment extends Comment {
-  CStyleComment() { this.getContents().matches("/*%") }
-}
-
-/**
- * A CPP style comment. For example the comment in the following code:
- * ```
- * // C++ style single-line comment
- * ```
- */
-class CppStyleComment extends Comment {
-  CppStyleComment() { this.getContents().matches("//%") }
-}

cpp/ql/lib/semmle/code/cpp/Declaration.qll

@@ -1,721 +0,0 @@
-/**
- * Provides classes for working with C and C++ declarations.
- */
-
-import semmle.code.cpp.Element
-import semmle.code.cpp.Specifier
-import semmle.code.cpp.Namespace
-private import semmle.code.cpp.internal.QualifiedName as Q
-
-/**
- * A C/C++ declaration: for example, a variable declaration, a type
- * declaration, or a function declaration.
- *
- * This file defines two closely related classes: `Declaration` and
- * `DeclarationEntry`. Some declarations do not correspond to a unique
- * location in the source code. For example, a global variable might
- * be declared in multiple source files:
- * ```
- *   extern int myglobal;
- * ```
- * and defined in one:
- * ```
- *   int myglobal;
- * ```
- * Each of these declarations (including the definition) is given its own
- * distinct `DeclarationEntry`, but they all share the same `Declaration`.
- *
- * Some derived class of `Declaration` do not have a corresponding
- * `DeclarationEntry`, because they always have a unique source location.
- * `EnumConstant` and `FriendDecl` are both examples of this.
- */
-class Declaration extends Locatable, @declaration {
-  /**
-   * Gets the innermost namespace which contains this declaration.
-   *
-   * The result will either be `GlobalNamespace`, or the tightest lexically
-   * enclosing namespace block. In particular, note that for declarations
-   * within structures, the namespace of the declaration is the same as the
-   * namespace of the structure.
-   */
-  Namespace getNamespace() {
-    result = underlyingElement(this).(Q::Declaration).getNamespace()
-    or
-    exists(Parameter p | p = this and result = p.getFunction().getNamespace())
-    or
-    exists(LocalVariable v | v = this and result = v.getFunction().getNamespace())
-  }
-
-  /**
-   * Gets the name of the declaration, fully qualified with its
-   * namespace and declaring type.
-   *
-   * For performance, prefer the multi-argument `hasQualifiedName` or
-   * `hasGlobalName` predicates since they don't construct so many intermediate
-   * strings. For debugging, the `semmle.code.cpp.Print` module produces more
-   * detailed output but are also more expensive to compute.
-   *
-   * Example: `getQualifiedName() =
-   * "namespace1::namespace2::TemplateClass1<int>::Class2::memberName"`.
-   */
-  string getQualifiedName() { result = underlyingElement(this).(Q::Declaration).getQualifiedName() }
-
-  /**
-   * DEPRECATED: Prefer `hasGlobalName` or the 2-argument or 3-argument
-   * `hasQualifiedName` predicates. To get the exact same results as this
-   * predicate in all edge cases, use `getQualifiedName()`.
-   *
-   * Holds if this declaration has the fully-qualified name `qualifiedName`.
-   * See `getQualifiedName`.
-   */
-  predicate hasQualifiedName(string qualifiedName) { this.getQualifiedName() = qualifiedName }
-
-  /**
-   * Holds if this declaration has a fully-qualified name with a name-space
-   * component of `namespaceQualifier`, a declaring type of `typeQualifier`,
-   * and a base name of `baseName`. Template parameters and arguments are
-   * stripped from all components. Missing components are `""`.
-   *
-   * Example: `hasQualifiedName("namespace1::namespace2",
-   * "TemplateClass1::Class2", "memberName")`.
-   *
-   * Example (the class `std::vector`): `hasQualifiedName("std", "", "vector")`
-   * or `hasQualifiedName("std", "vector")`.
-   *
-   * Example (the `size` member function of class `std::vector`):
-   * `hasQualifiedName("std", "vector", "size")`.
-   */
-  predicate hasQualifiedName(string namespaceQualifier, string typeQualifier, string baseName) {
-    underlyingElement(this)
-        .(Q::Declaration)
-        .hasQualifiedName(namespaceQualifier, typeQualifier, baseName)
-  }
-
-  /**
-   * Holds if this declaration has a fully-qualified name with a name-space
-   * component of `namespaceQualifier`, no declaring type, and a base name of
-   * `baseName`.
-   *
-   * See the 3-argument `hasQualifiedName` for examples.
-   */
-  predicate hasQualifiedName(string namespaceQualifier, string baseName) {
-    this.hasQualifiedName(namespaceQualifier, "", baseName)
-  }
-
-  /**
-   * Gets a description of this `Declaration` for display purposes.
-   */
-  string getDescription() { result = this.getName() }
-
-  final override string toString() { result = this.getDescription() }
-
-  /**
-   * Gets the name of this declaration.
-   *
-   * This name doesn't include a namespace or any argument types, so
-   * for example both functions `::open()` and `::std::ifstream::open(...)`
-   * have the same name. The name of a template _class_ includes a string
-   * representation of its parameters, and the names of its instantiations
-   * include string representations of their arguments. Template _functions_
-   * and their instantiations do not include template parameters or arguments.
-   *
-   * To get the name including the namespace, use `hasQualifiedName`.
-   *
-   * To test whether this declaration has a particular name in the global
-   * namespace, use `hasGlobalName`.
-   */
-  string getName() { none() } // overridden in subclasses
-
-  /** Holds if this declaration has the given name. */
-  predicate hasName(string name) { name = this.getName() }
-
-  /** Holds if this declaration has the given name in the global namespace. */
-  predicate hasGlobalName(string name) { this.hasQualifiedName("", "", name) }
-
-  /** Holds if this declaration has the given name in the global namespace or the `std` namespace. */
-  predicate hasGlobalOrStdName(string name) {
-    this.hasGlobalName(name)
-    or
-    this.hasQualifiedName("std", "", name)
-  }
-
-  /**
-   * Holds if this declaration has the given name in the global namespace,
-   * the `std` namespace or the `bsl` namespace.
-   * We treat `std` and `bsl` as the same in some of our models.
-   */
-  predicate hasGlobalOrStdOrBslName(string name) {
-    this.hasGlobalName(name)
-    or
-    this.hasQualifiedName("std", "", name)
-    or
-    this.hasQualifiedName("bsl", "", name)
-  }
-
-  /** Gets a specifier of this declaration. */
-  Specifier getASpecifier() { none() } // overridden in subclasses
-
-  /** Holds if this declaration has a specifier with the given name. */
-  predicate hasSpecifier(string name) { this.getASpecifier().hasName(name) }
-
-  /**
-   * Gets a declaration entry corresponding to this declaration. See the
-   * comment above this class for an explanation of the relationship
-   * between `Declaration` and `DeclarationEntry`.
-   */
-  DeclarationEntry getADeclarationEntry() { none() }
-
-  /**
-   * Gets the location of a declaration entry corresponding to this
-   * declaration.
-   */
-  Location getADeclarationLocation() { none() } // overridden in subclasses
-
-  /**
-   * Gets the declaration entry corresponding to this declaration that is a
-   * definition, if any.
-   */
-  DeclarationEntry getDefinition() { none() }
-
-  /** Gets the location of the definition, if any. */
-  Location getDefinitionLocation() { none() } // overridden in subclasses
-
-  /** Holds if the declaration has a definition. */
-  predicate hasDefinition() { exists(this.getDefinition()) }
-
-  /** DEPRECATED: Use `hasDefinition` instead. */
-  predicate isDefined() { hasDefinition() }
-
-  /** Gets the preferred location of this declaration, if any. */
-  override Location getLocation() { none() }
-
-  /** Gets a file where this element occurs. */
-  File getAFile() { result = this.getADeclarationLocation().getFile() }
-
-  /** Holds if this declaration is a top-level declaration. */
-  predicate isTopLevel() {
-    not (
-      this.isMember() or
-      this instanceof EnumConstant or
-      this instanceof Parameter or
-      this instanceof ProxyClass or
-      this instanceof LocalVariable or
-      this instanceof TemplateParameter or
-      this.(UserType).isLocal()
-    )
-  }
-
-  /** Holds if this declaration is static. */
-  predicate isStatic() { this.hasSpecifier("static") }
-
-  /** Holds if this declaration is a member of a class/struct/union. */
-  predicate isMember() { hasDeclaringType() }
-
-  /** Holds if this declaration is a member of a class/struct/union. */
-  predicate hasDeclaringType() { exists(this.getDeclaringType()) }
-
-  /**
-   * Gets the class where this member is declared, if it is a member.
-   * For templates, both the template itself and all instantiations of
-   * the template are considered to have the same declaring class.
-   */
-  Class getDeclaringType() { this = result.getAMember() }
-
-  /**
-   * Gets a template argument used to instantiate this declaration from a template.
-   * When called on a template, this will return a template parameter type for
-   * both typed and non-typed parameters.
-   */
-  final Locatable getATemplateArgument() { result = getTemplateArgument(_) }
-
-  /**
-   * Gets a template argument used to instantiate this declaration from a template.
-   * When called on a template, this will return a non-typed template
-   * parameter value.
-   */
-  final Locatable getATemplateArgumentKind() { result = getTemplateArgumentKind(_) }
-
-  /**
-   * Gets the `i`th template argument used to instantiate this declaration from a
-   * template.
-   *
-   * For example:
-   *
-   * `template<typename T, T X> class Foo;`
-   *
-   * Will have `getTemplateArgument(0)` return `T`, and
-   * `getTemplateArgument(1)` return `X`.
-   *
-   * `Foo<int, 1> bar;`
-   *
-   * Will have `getTemplateArgument())` return `int`, and
-   * `getTemplateArgument(1)` return `1`.
-   */
-  final Locatable getTemplateArgument(int index) {
-    if exists(getTemplateArgumentValue(index))
-    then result = getTemplateArgumentValue(index)
-    else result = getTemplateArgumentType(index)
-  }
-
-  /**
-   * Gets the `i`th template argument value used to instantiate this declaration
-   * from a template. When called on a template, this will return the `i`th template
-   * parameter value if it exists.
-   *
-   * For example:
-   *
-   * `template<typename T, T X> class Foo;`
-   *
-   * Will have `getTemplateArgumentKind(1)` return `T`, and no result for
-   * `getTemplateArgumentKind(0)`.
-   *
-   * `Foo<int, 10> bar;
-   *
-   * Will have `getTemplateArgumentKind(1)` return `int`, and no result for
-   * `getTemplateArgumentKind(0)`.
-   */
-  final Locatable getTemplateArgumentKind(int index) {
-    if exists(getTemplateArgumentValue(index))
-    then result = getTemplateArgumentType(index)
-    else none()
-  }
-
-  /** Gets the number of template arguments for this declaration. */
-  final int getNumberOfTemplateArguments() {
-    result = count(int i | exists(getTemplateArgument(i)))
-  }
-
-  private Type getTemplateArgumentType(int index) {
-    class_template_argument(underlyingElement(this), index, unresolveElement(result))
-    or
-    function_template_argument(underlyingElement(this), index, unresolveElement(result))
-    or
-    variable_template_argument(underlyingElement(this), index, unresolveElement(result))
-  }
-
-  private Expr getTemplateArgumentValue(int index) {
-    class_template_argument_value(underlyingElement(this), index, unresolveElement(result))
-    or
-    function_template_argument_value(underlyingElement(this), index, unresolveElement(result))
-    or
-    variable_template_argument_value(underlyingElement(this), index, unresolveElement(result))
-  }
-}
-
-private class TDeclarationEntry = @var_decl or @type_decl or @fun_decl;
-
-/**
- * A C/C++ declaration entry. For example the following code contains five
- * declaration entries:
- * ```
- * extern int myGlobal;
- * int myVariable;
- * typedef char MyChar;
- * void myFunction();
- * void myFunction() {
- *   // ...
- * }
- * ```
- * See the comment above `Declaration` for an explanation of the relationship
- * between `Declaration` and `DeclarationEntry`.
- */
-class DeclarationEntry extends Locatable, TDeclarationEntry {
-  /** Gets a specifier associated with this declaration entry. */
-  string getASpecifier() { none() } // overridden in subclasses
-
-  /**
-   * Gets the name associated with the corresponding definition (where
-   * available), or the name declared by this entry otherwise.
-   */
-  string getCanonicalName() {
-    if getDeclaration().hasDefinition()
-    then result = getDeclaration().getDefinition().getName()
-    else result = getName()
-  }
-
-  /**
-   * Gets the declaration for which this is a declaration entry.
-   *
-   * Note that this is *not* always the inverse of
-   * `Declaration.getADeclarationEntry()`, for example if `C` is a
-   * `TemplateClass`, `I` is an instantiation of `C`, and `D` is a
-   * `Declaration` of `C`, then:
-   *  `C.getADeclarationEntry()` returns `D`
-   *  `I.getADeclarationEntry()` returns `D`
-   *  but `D.getDeclaration()` only returns `C`
-   */
-  Declaration getDeclaration() { none() } // overridden in subclasses
-
-  /** Gets the name associated with this declaration entry, if any. */
-  string getName() { none() } // overridden in subclasses
-
-  /**
-   * Gets the type associated with this declaration entry.
-   *
-   * For variable declarations, get the type of the variable.
-   * For function declarations, get the return type of the function.
-   * For type declarations, get the type being declared.
-   */
-  Type getType() { none() } // overridden in subclasses
-
-  /**
-   * Gets the type associated with this declaration entry after specifiers
-   * have been deeply stripped and typedefs have been resolved.
-   *
-   * For variable declarations, get the type of the variable.
-   * For function declarations, get the return type of the function.
-   * For type declarations, get the type being declared.
-   */
-  Type getUnspecifiedType() { result = this.getType().getUnspecifiedType() }
-
-  /**
-   * Holds if this declaration entry has a specifier with the given name.
-   */
-  predicate hasSpecifier(string specifier) { getASpecifier() = specifier }
-
-  /** Holds if this declaration entry is a definition. */
-  predicate isDefinition() { none() } // overridden in subclasses
-
-  override string toString() {
-    if isDefinition()
-    then result = "definition of " + getName()
-    else
-      if getName() = getCanonicalName()
-      then result = "declaration of " + getName()
-      else result = "declaration of " + getCanonicalName() + " as " + getName()
-  }
-}
-
-private class TAccessHolder = @function or @usertype;
-
-/**
- * A declaration that can potentially have more C++ access rights than its
- * enclosing element. This comprises `Class` (they have access to their own
- * private members) along with other `UserType`s and `Function` (they can be
- * the target of `friend` declarations).  For example `MyClass` and
- * `myFunction` in the following code:
- * ```
- * class MyClass
- * {
- * public:
- *   ...
- * };
- *
- * void myFunction() {
- *   // ...
- * }
- * ```
- * In the C++ standard (N4140 11.2), rules for access control revolve around
- * the informal phrase "_R_ occurs in a member or friend of class C", where
- * `AccessHolder` corresponds to this _R_.
- */
-class AccessHolder extends Declaration, TAccessHolder {
-  /**
-   * Holds if `this` can access private members of class `c`.
-   *
-   * This predicate encodes the phrase "occurs in a member or friend" that is
-   * repeated many times in the C++14 standard, section 11.2.
-   */
-  predicate inMemberOrFriendOf(Class c) {
-    this.getEnclosingAccessHolder*() = c
-    or
-    exists(FriendDecl fd | fd.getDeclaringClass() = c |
-      this.getEnclosingAccessHolder*() = fd.getFriend()
-    )
-  }
-
-  /**
-   * Gets the nearest enclosing `AccessHolder`.
-   */
-  AccessHolder getEnclosingAccessHolder() { none() } // overridden in subclasses
-
-  /**
-   * Holds if a base class `base` of `derived` _is accessible at_ `this` (N4140
-   * 11.2/4). When this holds, and `derived` has only one base subobject of
-   * type `base`, code in `this` can implicitly convert a pointer to `derived`
-   * into a pointer to `base`. Conversely, if such a conversion is possible
-   * then this predicate holds.
-   *
-   * For the sake of generality, this predicate also holds whenever `base` =
-   * `derived`.
-   *
-   * This predicate is `pragma[inline]` because it is infeasible to fully
-   * compute it on large code bases: all classes `derived` can be converted to
-   * their public bases `base` from everywhere (`this`), so this predicate
-   * could yield a number of tuples that is quadratic in the size of the
-   * program. To avoid this combinatorial explosion, only use this predicate in
-   * a context where `this` together with `base` or `derived` are sufficiently
-   * restricted.
-   */
-  pragma[inline]
-  predicate canAccessClass(Class base, Class derived) {
-    // This predicate is marked `inline` and implemented in a very particular
-    // way. If we allowed this predicate to be fully computed, it would relate
-    // all `AccessHolder`s to all classes, which would be too much.
-    // There are four rules in N4140 11.2/4. Only the one named (4.4) is
-    // recursive, and it describes a transitive closure: intuitively, if A can
-    // be converted to B, and B can be converted to C, then A can be converted
-    // to C. To limit the number of tuples in the non-inline helper predicates,
-    // we first separate the derivation of 11.2/4 into two cases:
-    // Derivations using only (4.1) and (4.4). Note that these derivations are
-    // independent of `this`, which is why users of this predicate must take
-    // care to avoid a combinatorial explosion.
-    isDirectPublicBaseOf*(base, derived)
-    or
-    exists(DirectAccessHolder n |
-      this.getEnclosingAccessHolder*() = n and
-      // Derivations using (4.2) or (4.3) at least once.
-      n.thisCanAccessClassTrans(base, derived)
-    )
-  }
-
-  /**
-   * Holds if a non-static member `member` _is accessible at_ `this` when named
-   * in a class `derived` that is derived from or equal to the declaring class
-   * of `member` (N4140 11.2/5 and 11.4).
-   *
-   * This predicate determines whether an expression `x.member` would be
-   * allowed in `this` when `x` has type `derived`. The more general syntax
-   * `x.N::member`, where `N` may be a base class of `derived`, is not
-   * supported. This should only affect very rare edge cases of 11.4. This
-   * predicate concerns only _access_ and thus does not determine whether
-   * `member` can be unambiguously named at `this`: multiple overloads may
-   * apply, or `member` may be declared in an ambiguous base class.
-   *
-   * This predicate is `pragma[inline]` because it is infeasible to fully
-   * compute it on large code bases: all public members `member` are accessible
-   * from everywhere (`this`), so this predicate could yield a number of tuples
-   * that is quadratic in the size of the program. To avoid this combinatorial
-   * explosion, only use this predicate in a context where `this` and `member`
-   * are sufficiently restricted when `member` is public.
-   */
-  pragma[inline]
-  predicate canAccessMember(Declaration member, Class derived) {
-    this.couldAccessMember(member.getDeclaringType(), member.getASpecifier().(AccessSpecifier),
-      derived)
-  }
-
-  /**
-   * Holds if a hypothetical non-static member of `memberClass` with access
-   * specifier `memberAccess` _is accessible at_ `this` when named in a class
-   * `derived` that is derived from or equal to `memberClass` (N4140 11.2/5 and
-   * 11.4).
-   *
-   * This predicate determines whether an expression `x.m` would be
-   * allowed in `this` when `x` has type `derived` and `m` has `memberAccess`
-   * in `memberClass`. The more general syntax `x.N::n`, where `N` may be a
-   * base class of `derived`, is not supported. This should only affect very
-   * rare edge cases of 11.4.
-   *
-   * This predicate is `pragma[inline]` because it is infeasible to fully
-   * compute it on large code bases: all classes `memberClass` have their
-   * public members accessible from everywhere (`this`), so this predicate
-   * could yield a number of tuples that is quadratic in the size of the
-   * program. To avoid this combinatorial explosion, only use this predicate in
-   * a context where `this` and `memberClass` are sufficiently restricted when
-   * `memberAccess` is public.
-   */
-  pragma[inline]
-  predicate couldAccessMember(Class memberClass, AccessSpecifier memberAccess, Class derived) {
-    // There are four rules in N4140 11.2/5. To limit the number of tuples in
-    // the non-inline helper predicates, we first separate the derivation of
-    // 11.2/5 into two cases:
-    // Rule (5.1) directly: the member is public, and `derived` uses public
-    // inheritance all the way up to `memberClass`. Note that these derivations
-    // are independent of `this`, which is why users of this predicate must
-    // take care to avoid a combinatorial explosion.
-    everyoneCouldAccessMember(memberClass, memberAccess, derived)
-    or
-    exists(DirectAccessHolder n |
-      this.getEnclosingAccessHolder*() = n and
-      // Any other derivation.
-      n.thisCouldAccessMember(memberClass, memberAccess, derived)
-    )
-  }
-}
-
-/**
- * A declaration that very likely has more C++ access rights than its
- * enclosing element. This comprises `Class` (they have access to their own
- * private members) along with any target of a `friend` declaration.  For
- * example `MyClass` and `friendFunction` in the following code:
- * ```
- * class MyClass
- * {
- * public:
- *   friend void friendFunction();
- * };
- *
- * void friendFunction() {
- *   // ...
- * }
- * ```
- * Most access rights are computed for `DirectAccessHolder` instead of
- * `AccessHolder` -- that's more efficient because there are fewer
- * `DirectAccessHolder`s. If a `DirectAccessHolder` contains an `AccessHolder`,
- * then the contained `AccessHolder` inherits its access rights.
- */
-private class DirectAccessHolder extends Element {
-  DirectAccessHolder() {
-    this instanceof Class
-    or
-    exists(FriendDecl fd | fd.getFriend() = this)
-  }
-
-  /**
-   * Holds if a base class `base` of `derived` _is accessible at_ `this` when
-   * the derivation of that fact uses rule (4.2) and (4.3) of N4140 11.2/4 at
-   * least once. In other words, the `this` parameter is not ignored. This
-   * restriction makes it feasible to fully enumerate this predicate even on
-   * large code bases.
-   */
-  predicate thisCanAccessClassTrans(Class base, Class derived) {
-    // This implementation relies on the following property of our predicates:
-    // if `this.thisCanAccessClassStep(b, d)` and
-    // `isDirectPublicBaseOf(b2, b)`, then
-    // `this.thisCanAccessClassStep(b2, d)`. In other words, if a derivation
-    // uses (4.2) or (4.3) somewhere and uses (4.1) directly above that in the
-    // transitive chain, then the use of (4.1) is redundant. This means we only
-    // need to consider derivations that use (4.2) or (4.3) as the "first"
-    // step, that is, towards `base`, so this implementation is essentially a
-    // transitive closure with a restricted base case.
-    this.thisCanAccessClassStep(base, derived)
-    or
-    exists(Class between | thisCanAccessClassTrans(base, between) |
-      isDirectPublicBaseOf(between, derived) or
-      this.thisCanAccessClassStep(between, derived)
-    )
-    // It is possible that this predicate could be computed faster for deep
-    // hierarchies if we can prove and utilize that all derivations of 11.2/4
-    // can be broken down into steps where `base` is a _direct_ base of
-    // `derived` in each step.
-  }
-
-  /**
-   * Holds if a base class `base` of `derived` _is accessible at_ `this` using
-   * only a single application of rule (4.2) and (4.3) of N4140 11.2/4.
-   */
-  private predicate thisCanAccessClassStep(Class base, Class derived) {
-    exists(AccessSpecifier public | public.hasName("public") |
-      // Rules (4.2) and (4.3) are implemented together as one here with
-      // reflexive-transitive inheritance, where (4.3) is the transitive case,
-      // and (4.2) is the reflexive case.
-      exists(Class p | p = derived.getADerivedClass*() |
-        this.isFriendOfOrEqualTo(p) and
-        // Note: it's crucial that this is `!=` rather than `not =` since
-        // `accessOfBaseMember` does not have a result when the member would be
-        // inaccessible.
-        p.accessOfBaseMember(base, public) != public
-      )
-    ) and
-    // This is the only case that doesn't in itself guarantee that
-    // `derived` < `base`, so we add the check here. The standard suggests
-    // computing `canAccessClass` only for derived classes, but that seems
-    // incompatible with the execution model of QL, so we instead construct
-    // every case to guarantee `derived` < `base`.
-    derived = base.getADerivedClass+()
-  }
-
-  /**
-   * Like `couldAccessMember` but only contains derivations in which either
-   * (5.2), (5.3) or (5.4) must be invoked. In other words, the `this`
-   * parameter is not ignored. This restriction makes it feasible to fully
-   * enumerate this predicate even on large code bases. We check for 11.4 as
-   * part of (5.3), since this further limits the number of tuples produced by
-   * this predicate.
-   */
-  predicate thisCouldAccessMember(Class memberClass, AccessSpecifier memberAccess, Class derived) {
-    // Only (5.4) is recursive, and chains of invocations of (5.4) can always
-    // be collapsed to one invocation by the transitivity of 11.2/4.
-    // Derivations not using (5.4) can always be rewritten to have a (5.4) rule
-    // in front because our encoding of 11.2/4 in `canAccessClass` is
-    // reflexive. Thus, we only need to consider three cases: rule (5.4)
-    // followed by either (5.1), (5.2) or (5.3).
-    // Rule (5.4), using a non-trivial derivation of 11.2/4, followed by (5.1).
-    // If the derivation of 11.2/4 is trivial (only uses (4.1) and (4.4)), this
-    // case can be replaced with purely (5.1) and thus does not need to be in
-    // this predicate.
-    exists(Class between | this.thisCanAccessClassTrans(between, derived) |
-      everyoneCouldAccessMember(memberClass, memberAccess, between)
-    )
-    or
-    // Rule (5.4) followed by Rule (5.2)
-    exists(Class between | this.(AccessHolder).canAccessClass(between, derived) |
-      between.accessOfBaseMember(memberClass, memberAccess).hasName("private") and
-      this.isFriendOfOrEqualTo(between)
-    )
-    or
-    // Rule (5.4) followed by Rule (5.3), integrating 11.4. We integrate 11.4
-    // here because we would otherwise generate too many tuples. This code is
-    // very performance-sensitive, and any changes should be benchmarked on
-    // LibreOffice.
-    // Rule (5.4) requires that `this.canAccessClass(between, derived)`
-    // (implying that `derived <= between` in the class hierarchy) and that
-    // `p <= between`. Rule 11.4 additionally requires `derived <= p`, but
-    // all these rules together result in too much freedom and overlap between
-    // cases. Therefore, for performance, we split into three cases for how
-    // `between` as a base of `derived` is accessible at `this`, where `this`
-    // is the implementation of `p`:
-    // 1. `between` is an accessible base of `derived` by going through `p` as
-    //    an intermediate step.
-    // 2. `this` is part of the implementation of `derived` because it's a
-    //    member or a friend. In this case, we do not need `p` to perform this
-    //    derivation, so we can set `p = derived` and proceed as in case 1.
-    // 3. `derived` has an alternative inheritance path up to `between` that
-    //    bypasses `p`. Then that path must be public, or we are in case 2.
-    exists(AccessSpecifier public | public.hasName("public") |
-      exists(Class between, Class p |
-        between.accessOfBaseMember(memberClass, memberAccess).hasName("protected") and
-        this.isFriendOfOrEqualTo(p) and
-        (
-          // This is case 1 from above. If `p` derives privately from `between`
-          // then the member we're trying to access is private or inaccessible
-          // in `derived`, so either rule (5.2) applies instead, or the member
-          // is inaccessible. Therefore, in this case, `p` must derive at least
-          // protected from `between`. Further, since the access of `derived`
-          // to its base `between` must pass through `p` in this case, we know
-          // that `derived` must derived publicly from `p` unless we are in
-          // case 2; there are no other cases of 11.2/4 where the
-          // implementation of a base class can access itself as a base.
-          p.accessOfBaseMember(between, public).getName() >= "protected" and
-          derived.accessOfBaseMember(p, public) = public
-          or
-          // This is case 3 above.
-          derived.accessOfBaseMember(between, public) = public and
-          derived = p.getADerivedClass*() and
-          exists(p.accessOfBaseMember(between, memberAccess))
-        )
-      )
-    )
-  }
-
-  private predicate isFriendOfOrEqualTo(Class c) {
-    exists(FriendDecl fd | fd.getDeclaringClass() = c | this = fd.getFriend())
-    or
-    this = c
-  }
-}
-
-/**
- * Holds if `base` is a direct public base of `derived`, possibly virtual and
- * possibly through typedefs. The transitive closure of this predicate encodes
- * derivations of N4140 11.2/4 that use only (4.1) and (4.4).
- */
-private predicate isDirectPublicBaseOf(Class base, Class derived) {
-  exists(ClassDerivation cd |
-    cd.getBaseClass() = base and
-    cd.getDerivedClass() = derived and
-    cd.getASpecifier().hasName("public")
-  )
-}
-
-/**
- * Holds if a hypothetical member of `memberClass` with access specifier
- * `memberAccess` would be public when named as a member of `derived`.
- * This encodes N4140 11.2/5 case (5.1).
- */
-private predicate everyoneCouldAccessMember(
-  Class memberClass, AccessSpecifier memberAccess, Class derived
-) {
-  derived.accessOfBaseMember(memberClass, memberAccess).hasName("public")
-}

cpp/ql/lib/semmle/code/cpp/Diagnostics.qll

@@ -1,68 +0,0 @@
-/**
- * Provides classes representing warnings generated during compilation.
- */
-
-import semmle.code.cpp.Location
-
-/** A compiler-generated error, warning or remark. */
-class Diagnostic extends Locatable, @diagnostic {
-  /** Gets the compilation that generated this diagnostic. */
-  Compilation getCompilation() { diagnostic_for(underlyingElement(this), result, _, _) }
-
-  /**
-   * Gets the severity of the message, on a range from 1 to 5: 1=remark,
-   * 2=warning, 3=discretionary error, 4=error, 5=catastrophic error.
-   */
-  int getSeverity() { diagnostics(underlyingElement(this), result, _, _, _, _) }
-
-  /** Gets the error code for this compiler message. */
-  string getTag() { diagnostics(underlyingElement(this), _, result, _, _, _) }
-
-  /** Holds if `s` is the error code for this compiler message. */
-  predicate hasTag(string s) { this.getTag() = s }
-
-  /**
-   * Gets the error message text associated with this compiler
-   * diagnostic.
-   */
-  string getMessage() { diagnostics(underlyingElement(this), _, _, result, _, _) }
-
-  /**
-   * Gets the full error message text associated with this compiler
-   * diagnostic.
-   */
-  string getFullMessage() { diagnostics(underlyingElement(this), _, _, _, result, _) }
-
-  /** Gets the source location corresponding to the compiler message. */
-  override Location getLocation() { diagnostics(underlyingElement(this), _, _, _, _, result) }
-
-  override string toString() { result = this.getMessage() }
-}
-
-/** A compiler-generated remark (milder than a warning). */
-class CompilerRemark extends Diagnostic {
-  CompilerRemark() { this.getSeverity() = 1 }
-}
-
-/** A compiler-generated warning. */
-class CompilerWarning extends Diagnostic {
-  CompilerWarning() { this.getSeverity() = 2 }
-}
-
-/**
- * A compiler-generated discretionary error (a compile-time error that may
- * be suppressed).
- */
-class CompilerDiscretionaryError extends Diagnostic {
-  CompilerDiscretionaryError() { this.getSeverity() = 3 }
-}
-
-/** A compiler error message. */
-class CompilerError extends Diagnostic {
-  CompilerError() { this.getSeverity() = 4 }
-}
-
-/** A compiler error that prevents compilation from continuing. */
-class CompilerCatastrophe extends Diagnostic {
-  CompilerCatastrophe() { this.getSeverity() = 5 }
-}

cpp/ql/lib/semmle/code/cpp/Element.qll

@@ -1,297 +0,0 @@
-/**
- * Provides the `Element` class, which is the base class for all classes representing C or C++
- * program elements.
- */
-
-import semmle.code.cpp.Location
-private import semmle.code.cpp.Enclosing
-private import semmle.code.cpp.internal.ResolveClass
-
-/**
- * Get the `Element` that represents this `@element`.
- * Normally this will simply be a cast of `e`, but sometimes it is not.
- * For example, for an incomplete struct `e` the result may be a
- * complete struct with the same name.
- */
-pragma[inline]
-Element mkElement(@element e) { unresolveElement(result) = e }
-
-/**
- * INTERNAL: Do not use.
- *
- * Gets an `@element` that resolves to the `Element`. This should
- * normally only be called from member predicates, where `e` is not
- * `this` and you need the result for an argument to a database
- * extensional.
- * See `underlyingElement` for when `e` is `this`.
- */
-pragma[inline]
-@element unresolveElement(Element e) {
-  not result instanceof @usertype and
-  result = e
-  or
-  e = resolveClass(result)
-}
-
-/**
- * INTERNAL: Do not use.
- *
- * Gets the `@element` that this `Element` extends. This should normally
- * only be called from member predicates, where `e` is `this` and you
- * need the result for an argument to a database extensional.
- * See `unresolveElement` for when `e` is not `this`.
- */
-@element underlyingElement(Element e) { result = e }
-
-/**
- * A C/C++ element with no member predicates other than `toString`. Not for
- * general use. This class does not define a location, so classes wanting to
- * change their location without affecting other classes can extend
- * `ElementBase` instead of `Element` to create a new rootdef for `getURL`,
- * `getLocation`, or `hasLocationInfo`.
- */
-class ElementBase extends @element {
-  /** Gets a textual representation of this element. */
-  cached
-  string toString() { none() }
-
-  /** DEPRECATED: use `getAPrimaryQlClass` instead. */
-  deprecated string getCanonicalQLClass() { result = this.getAPrimaryQlClass() }
-
-  /**
-   * Gets a comma-separated list of the names of the primary CodeQL classes to which this element belongs.
-   */
-  final string getPrimaryQlClasses() { result = concat(getAPrimaryQlClass(), ",") }
-
-  /**
-   * Gets the name of a primary CodeQL class to which this element belongs.
-   *
-   * For most elements, this is simply the most precise syntactic category to
-   * which they belong; for example, `AddExpr` is a primary class, but
-   * `BinaryOperation` is not.
-   *
-   * This predicate can have multiple results if multiple primary classes match.
-   * For some elements, this predicate may not have a result.
-   */
-  string getAPrimaryQlClass() { none() }
-}
-
-/**
- * A C/C++ element. This class is the base class for all C/C++
- * elements, such as functions, classes, expressions, and so on.
- */
-class Element extends ElementBase {
-  /** Gets the primary file where this element occurs. */
-  File getFile() { result = this.getLocation().getFile() }
-
-  /**
-   * Holds if this element may be from source. This predicate holds for all
-   * elements, except for those in the dummy file, whose name is the empty string.
-   * The dummy file contains declarations that are built directly into the compiler.
-   */
-  predicate fromSource() { this.getFile().fromSource() }
-
-  /**
-   * Holds if this element may be from a library.
-   *
-   * DEPRECATED: always true.
-   */
-  deprecated predicate fromLibrary() { this.getFile().fromLibrary() }
-
-  /** Gets the primary location of this element. */
-  Location getLocation() { none() }
-
-  /**
-   * Gets the source of this element: either itself or a macro that expanded
-   * to this element.
-   *
-   * If the element is not in a macro expansion, then the "root" is just
-   * the element itself. Otherwise, it is the definition of the innermost
-   * macro whose expansion the element is in.
-   *
-   * This method is useful for filtering macro results in checks: simply
-   * blame `e.findRootCause` rather than `e`. This will report only bugs
-   * that are not in macros, and in addition report macros that (somewhere)
-   * expand to a bug.
-   */
-  Element findRootCause() {
-    if exists(MacroInvocation mi | this = mi.getAGeneratedElement())
-    then
-      exists(MacroInvocation mi |
-        this = mi.getAGeneratedElement() and
-        not exists(MacroInvocation closer |
-          this = closer.getAGeneratedElement() and
-          mi = closer.getParentInvocation+()
-        ) and
-        result = mi.getMacro()
-      )
-    else result = this
-  }
-
-  /**
-   * Gets the parent scope of this `Element`, if any.
-   * A scope is a `Type` (`Class` / `Enum`), a `Namespace`, a `BlockStmt`, a `Function`,
-   * or certain kinds of `Statement`.
-   */
-  Element getParentScope() {
-    // result instanceof class
-    exists(Declaration m |
-      m = this and
-      result = m.getDeclaringType() and
-      not this instanceof EnumConstant
-    )
-    or
-    exists(TemplateClass tc | this = tc.getATemplateArgument() and result = tc)
-    or
-    // result instanceof namespace
-    exists(Namespace n | result = n and n.getADeclaration() = this)
-    or
-    exists(FriendDecl d, Namespace n | this = d and n.getADeclaration() = d and result = n)
-    or
-    exists(Namespace n | this = n and result = n.getParentNamespace())
-    or
-    // result instanceof stmt
-    exists(LocalVariable v |
-      this = v and
-      exists(DeclStmt ds | ds.getADeclaration() = v and result = ds.getParent())
-    )
-    or
-    exists(Parameter p | this = p and result = p.getFunction())
-    or
-    exists(GlobalVariable g, Namespace n | this = g and n.getADeclaration() = g and result = n)
-    or
-    exists(EnumConstant e | this = e and result = e.getDeclaringEnum())
-    or
-    // result instanceof block|function
-    exists(BlockStmt b | this = b and blockscope(unresolveElement(b), unresolveElement(result)))
-    or
-    exists(TemplateFunction tf | this = tf.getATemplateArgument() and result = tf)
-    or
-    // result instanceof stmt
-    exists(ControlStructure s | this = s and result = s.getParent())
-    or
-    using_container(unresolveElement(result), underlyingElement(this))
-  }
-
-  /**
-   * Holds if this element comes from a macro expansion. Only elements that
-   * are entirely generated by a macro are included - for elements that
-   * partially come from a macro, see `isAffectedByMacro`.
-   */
-  predicate isInMacroExpansion() { inMacroExpansion(this) }
-
-  /**
-   * Holds if this element is affected in any way by a macro. All elements
-   * that are totally or partially generated by a macro are included, so
-   * this is a super-set of `isInMacroExpansion`.
-   */
-  predicate isAffectedByMacro() { affectedByMacro(this) }
-
-  private Element getEnclosingElementPref() {
-    enclosingfunction(underlyingElement(this), unresolveElement(result)) or
-    result.(Function) = stmtEnclosingElement(this) or
-    this.(LocalScopeVariable).getFunction() = result or
-    enumconstants(underlyingElement(this), unresolveElement(result), _, _, _, _) or
-    derivations(underlyingElement(this), unresolveElement(result), _, _, _) or
-    stmtparents(underlyingElement(this), _, unresolveElement(result)) or
-    exprparents(underlyingElement(this), _, unresolveElement(result)) or
-    namequalifiers(underlyingElement(this), unresolveElement(result), _, _) or
-    initialisers(underlyingElement(this), unresolveElement(result), _, _) or
-    exprconv(unresolveElement(result), underlyingElement(this)) or
-    param_decl_bind(underlyingElement(this), _, unresolveElement(result)) or
-    using_container(unresolveElement(result), underlyingElement(this)) or
-    static_asserts(unresolveElement(this), _, _, _, underlyingElement(result))
-  }
-
-  /** Gets the closest `Element` enclosing this one. */
-  cached
-  Element getEnclosingElement() {
-    result = getEnclosingElementPref()
-    or
-    not exists(getEnclosingElementPref()) and
-    (
-      this = result.(Class).getAMember()
-      or
-      result = exprEnclosingElement(this)
-      or
-      var_decls(underlyingElement(this), unresolveElement(result), _, _, _)
-    )
-  }
-
-  /**
-   * Holds if this `Element` is a part of a template instantiation (but not
-   * the template itself).
-   */
-  predicate isFromTemplateInstantiation(Element instantiation) {
-    exists(Element e | isFromTemplateInstantiationRec(e, instantiation) |
-      this = e or
-      this.(DeclarationEntry).getDeclaration() = e
-    )
-  }
-
-  /**
-   * Holds if this `Element` is part of a template `template` (not if it is
-   * part of an instantiation of `template`). This means it is represented in
-   * the database purely as syntax and without guarantees on the presence or
-   * correctness of type-based operations such as implicit conversions.
-   *
-   * If an element is nested within several templates, this predicate holds with
-   * a value of `template` for each containing template.
-   */
-  predicate isFromUninstantiatedTemplate(Element template) {
-    exists(Element e | isFromUninstantiatedTemplateRec(e, template) |
-      this = e or
-      this.(DeclarationEntry).getDeclaration() = e
-    )
-  }
-}
-
-private predicate isFromTemplateInstantiationRec(Element e, Element instantiation) {
-  instantiation.(Function).isConstructedFrom(_) and
-  e = instantiation
-  or
-  instantiation.(Class).isConstructedFrom(_) and
-  e = instantiation
-  or
-  instantiation.(Variable).isConstructedFrom(_) and
-  e = instantiation
-  or
-  isFromTemplateInstantiationRec(e.getEnclosingElement(), instantiation)
-}
-
-private predicate isFromUninstantiatedTemplateRec(Element e, Element template) {
-  is_class_template(unresolveElement(template)) and
-  e = template
-  or
-  is_function_template(unresolveElement(template)) and
-  e = template
-  or
-  is_variable_template(unresolveElement(template)) and
-  e = template
-  or
-  isFromUninstantiatedTemplateRec(e.getEnclosingElement(), template)
-}
-
-/**
- * A C++11 `static_assert` or C11 `_Static_assert` construct. For example each
- * line in the following example contains a static assert:
- * ```
- * static_assert(sizeof(MyStruct) <= 4096);
- * static_assert(sizeof(MyStruct) <= 4096, "MyStruct is too big!");
- * ```
- */
-class StaticAssert extends Locatable, @static_assert {
-  override string toString() { result = "static_assert(..., \"" + getMessage() + "\")" }
-
-  /**
-   * Gets the expression which this static assertion ensures is true.
-   */
-  Expr getCondition() { static_asserts(underlyingElement(this), unresolveElement(result), _, _, _) }
-
-  /**
-   * Gets the message which will be reported by the compiler if this static assertion fails.
-   */
-  string getMessage() { static_asserts(underlyingElement(this), _, result, _, _) }
-
-  override Location getLocation() { static_asserts(underlyingElement(this), _, _, result, _) }
-}

cpp/ql/lib/semmle/code/cpp/File.qll

@@ -1,448 +0,0 @@
-/**
- * Provides classes representing files and folders.
- */
-
-import semmle.code.cpp.Element
-import semmle.code.cpp.Declaration
-import semmle.code.cpp.metrics.MetricFile
-
-/** A file or folder. */
-class Container extends Locatable, @container {
-  /**
-   * Gets the absolute, canonical path of this container, using forward slashes
-   * as path separator.
-   *
-   * The path starts with a _root prefix_ followed by zero or more _path
-   * segments_ separated by forward slashes.
-   *
-   * The root prefix is of one of the following forms:
-   *
-   *   1. A single forward slash `/` (Unix-style)
-   *   2. An upper-case drive letter followed by a colon and a forward slash,
-   *      such as `C:/` (Windows-style)
-   *   3. Two forward slashes, a computer name, and then another forward slash,
-   *      such as `//FileServer/` (UNC-style)
-   *
-   * Path segments are never empty (that is, absolute paths never contain two
-   * contiguous slashes, except as part of a UNC-style root prefix). Also, path
-   * segments never contain forward slashes, and no path segment is of the
-   * form `.` (one dot) or `..` (two dots).
-   *
-   * Note that an absolute path never ends with a forward slash, except if it is
-   * a bare root prefix, that is, the path has no path segments. A container
-   * whose absolute path has no segments is always a `Folder`, not a `File`.
-   */
-  string getAbsolutePath() { none() } // overridden by subclasses
-
-  /**
-   * DEPRECATED: Use `getLocation` instead.
-   * Gets a URL representing the location of this container.
-   *
-   * For more information see [Providing URLs](https://help.semmle.com/QL/learn-ql/ql/locations.html#providing-urls).
-   */
-  deprecated string getURL() { none() } // overridden by subclasses
-
-  /**
-   * Gets the relative path of this file or folder from the root folder of the
-   * analyzed source location. The relative path of the root folder itself is
-   * the empty string.
-   *
-   * This has no result if the container is outside the source root, that is,
-   * if the root folder is not a reflexive, transitive parent of this container.
-   */
-  string getRelativePath() {
-    exists(string absPath, string pref |
-      absPath = getAbsolutePath() and sourceLocationPrefix(pref)
-    |
-      absPath = pref and result = ""
-      or
-      absPath = pref.regexpReplaceAll("/$", "") + "/" + result and
-      not result.matches("/%")
-    )
-  }
-
-  /**
-   * Gets the base name of this container including extension, that is, the last
-   * segment of its absolute path, or the empty string if it has no segments.
-   *
-   * Here are some examples of absolute paths and the corresponding base names
-   * (surrounded with quotes to avoid ambiguity):
-   *
-   * <table border="1">
-   * <tr><th>Absolute path</th><th>Base name</th></tr>
-   * <tr><td>"/tmp/tst.js"</td><td>"tst.js"</td></tr>
-   * <tr><td>"C:/Program Files (x86)"</td><td>"Program Files (x86)"</td></tr>
-   * <tr><td>"/"</td><td>""</td></tr>
-   * <tr><td>"C:/"</td><td>""</td></tr>
-   * <tr><td>"D:/"</td><td>""</td></tr>
-   * <tr><td>"//FileServer/"</td><td>""</td></tr>
-   * </table>
-   */
-  string getBaseName() {
-    result = getAbsolutePath().regexpCapture(".*/(([^/]*?)(?:\\.([^.]*))?)", 1)
-  }
-
-  /**
-   * Gets the extension of this container, that is, the suffix of its base name
-   * after the last dot character, if any.
-   *
-   * In particular,
-   *
-   *  - if the name does not include a dot, there is no extension, so this
-   *    predicate has no result;
-   *  - if the name ends in a dot, the extension is the empty string;
-   *  - if the name contains multiple dots, the extension follows the last dot.
-   *
-   * Here are some examples of absolute paths and the corresponding extensions
-   * (surrounded with quotes to avoid ambiguity):
-   *
-   * <table border="1">
-   * <tr><th>Absolute path</th><th>Extension</th></tr>
-   * <tr><td>"/tmp/tst.js"</td><td>"js"</td></tr>
-   * <tr><td>"/tmp/.classpath"</td><td>"classpath"</td></tr>
-   * <tr><td>"/bin/bash"</td><td>not defined</td></tr>
-   * <tr><td>"/tmp/tst2."</td><td>""</td></tr>
-   * <tr><td>"/tmp/x.tar.gz"</td><td>"gz"</td></tr>
-   * </table>
-   */
-  string getExtension() { result = getAbsolutePath().regexpCapture(".*/([^/]*?)(\\.([^.]*))?", 3) }
-
-  /**
-   * Gets the stem of this container, that is, the prefix of its base name up to
-   * (but not including) the last dot character if there is one, or the entire
-   * base name if there is not.
-   *
-   * Here are some examples of absolute paths and the corresponding stems
-   * (surrounded with quotes to avoid ambiguity):
-   *
-   * <table border="1">
-   * <tr><th>Absolute path</th><th>Stem</th></tr>
-   * <tr><td>"/tmp/tst.js"</td><td>"tst"</td></tr>
-   * <tr><td>"/tmp/.classpath"</td><td>""</td></tr>
-   * <tr><td>"/bin/bash"</td><td>"bash"</td></tr>
-   * <tr><td>"/tmp/tst2."</td><td>"tst2"</td></tr>
-   * <tr><td>"/tmp/x.tar.gz"</td><td>"x.tar"</td></tr>
-   * </table>
-   */
-  string getStem() { result = getAbsolutePath().regexpCapture(".*/([^/]*?)(?:\\.([^.]*))?", 1) }
-
-  /** Gets the parent container of this file or folder, if any. */
-  Container getParentContainer() {
-    containerparent(unresolveElement(result), underlyingElement(this))
-  }
-
-  /** Gets a file or sub-folder in this container. */
-  Container getAChildContainer() { this = result.getParentContainer() }
-
-  /** Gets a file in this container. */
-  File getAFile() { result = getAChildContainer() }
-
-  /** Gets the file in this container that has the given `baseName`, if any. */
-  File getFile(string baseName) {
-    result = getAFile() and
-    result.getBaseName() = baseName
-  }
-
-  /** Gets a sub-folder in this container. */
-  Folder getAFolder() { result = getAChildContainer() }
-
-  /** Gets the sub-folder in this container that has the given `baseName`, if any. */
-  Folder getFolder(string baseName) {
-    result = getAFolder() and
-    result.getBaseName() = baseName
-  }
-
-  /**
-   * Gets a textual representation of the path of this container.
-   *
-   * This is the absolute path of the container.
-   */
-  override string toString() { result = getAbsolutePath() }
-}
-
-/**
- * A folder that was observed on disk during the build process.
- *
- * For the example folder name of "/usr/home/me", the path decomposes to:
- *
- *  1. "/usr/home" - see `getParentContainer`.
- *  2. "me" - see `getBaseName`.
- *
- * To get the full path, use `getAbsolutePath`.
- */
-class Folder extends Container, @folder {
-  override string getAbsolutePath() { folders(underlyingElement(this), result) }
-
-  override Location getLocation() {
-    result.getContainer() = this and
-    result.hasLocationInfo(_, 0, 0, 0, 0)
-  }
-
-  override string getAPrimaryQlClass() { result = "Folder" }
-
-  /**
-   * DEPRECATED: Use `getLocation` instead.
-   * Gets the URL of this folder.
-   */
-  deprecated override string getURL() { result = "file://" + this.getAbsolutePath() + ":0:0:0:0" }
-
-  /**
-   * DEPRECATED: use `getAbsolutePath` instead.
-   * Gets the name of this folder.
-   */
-  deprecated string getName() { folders(underlyingElement(this), result) }
-
-  /**
-   * DEPRECATED: use `getAbsolutePath` instead.
-   * Holds if this element is named `name`.
-   */
-  deprecated predicate hasName(string name) { name = this.getName() }
-
-  /**
-   * DEPRECATED: use `getAbsolutePath` instead.
-   * Gets the full name of this folder.
-   */
-  deprecated string getFullName() { result = this.getName() }
-
-  /**
-   * DEPRECATED: use `getBaseName` instead.
-   * Gets the last part of the folder name.
-   */
-  deprecated string getShortName() { result = this.getBaseName() }
-
-  /**
-   * DEPRECATED: use `getParentContainer` instead.
-   * Gets the parent folder.
-   */
-  deprecated Folder getParent() {
-    containerparent(unresolveElement(result), underlyingElement(this))
-  }
-}
-
-/**
- * A file that was observed on disk during the build process.
- *
- * For the example filename of "/usr/home/me/myprogram.c", the filename
- * decomposes to:
- *
- *  1. "/usr/home/me" - see `getParentContainer`.
- *  2. "myprogram.c" - see `getBaseName`.
- *
- * The base name further decomposes into the _stem_ and _extension_ -- see
- * `getStem` and `getExtension`. To get the full path, use `getAbsolutePath`.
- */
-class File extends Container, @file {
-  override string getAbsolutePath() { files(underlyingElement(this), result) }
-
-  override string toString() { result = Container.super.toString() }
-
-  override string getAPrimaryQlClass() { result = "File" }
-
-  override Location getLocation() {
-    result.getContainer() = this and
-    result.hasLocationInfo(_, 0, 0, 0, 0)
-  }
-
-  /**
-   * DEPRECATED: Use `getLocation` instead.
-   * Gets the URL of this file.
-   */
-  deprecated override string getURL() { result = "file://" + this.getAbsolutePath() + ":0:0:0:0" }
-
-  /** Holds if this file was compiled as C (at any point). */
-  predicate compiledAsC() { fileannotations(underlyingElement(this), 1, "compiled as c", "1") }
-
-  /** Holds if this file was compiled as C++ (at any point). */
-  predicate compiledAsCpp() { fileannotations(underlyingElement(this), 1, "compiled as c++", "1") }
-
-  /**
-   * Holds if this file was compiled by a Microsoft compiler (at any point).
-   *
-   * Note: currently unreliable - on some projects only some of the files that
-   * are compiled by a Microsoft compiler are detected by this predicate.
-   */
-  predicate compiledAsMicrosoft() {
-    exists(File f, Compilation c |
-      c.getAFileCompiled() = f and
-      (
-        c.getAnArgument() = "--microsoft" or
-        c.getAnArgument()
-            .toLowerCase()
-            .replaceAll("\\", "/")
-            .matches(["%/cl.exe", "%/clang-cl.exe"])
-      ) and
-      f.getAnIncludedFile*() = this
-    )
-  }
-
-  /** Gets a top-level element declared in this file. */
-  Declaration getATopLevelDeclaration() { result.getAFile() = this and result.isTopLevel() }
-
-  /** Gets a declaration in this file. */
-  Declaration getADeclaration() { result.getAFile() = this }
-
-  /** Holds if this file uses the given macro. */
-  predicate usesMacro(Macro m) {
-    exists(MacroInvocation mi |
-      mi.getFile() = this and
-      mi.getMacro() = m
-    )
-  }
-
-  /**
-   * Gets a file that is directly included from this file (using a
-   * pre-processor directive like `#include`).
-   */
-  File getAnIncludedFile() {
-    exists(Include i | i.getFile() = this and i.getIncludedFile() = result)
-  }
-
-  /**
-   * Holds if this file may be from source. This predicate holds for all files
-   * except the dummy file, whose name is the empty string, which contains
-   * declarations that are built into the compiler.
-   */
-  override predicate fromSource() { numlines(underlyingElement(this), _, _, _) }
-
-  /**
-   * Holds if this file may be from a library.
-   *
-   * DEPRECATED: For historical reasons this is true for any file.
-   */
-  deprecated override predicate fromLibrary() { any() }
-
-  /** Gets the metric file. */
-  MetricFile getMetrics() { result = this }
-
-  /**
-   * Gets the remainder of the base name after the first dot character. Note
-   * that the name of this predicate is in plural form, unlike `getExtension`,
-   * which gets the remainder of the base name after the _last_ dot character.
-   *
-   * Predicates `getStem` and `getExtension` should be preferred over
-   * `getShortName` and `getExtensions` since the former pair is compatible
-   * with the file libraries of other languages.
-   * Note the slight difference between this predicate and `getStem`:
-   * for example, for "file.tar.gz", this predicate will have the result
-   * "tar.gz", while `getExtension` will have the result "gz".
-   */
-  string getExtensions() {
-    exists(string name, int firstDotPos |
-      name = this.getBaseName() and
-      firstDotPos = min([name.indexOf("."), name.length() - 1]) and
-      result = name.suffix(firstDotPos + 1)
-    )
-  }
-
-  /**
-   * Gets the short name of this file, that is, the prefix of its base name up
-   * to (but not including) the first dot character if there is one, or the
-   * entire base name if there is not. For example, if the full name is
-   * "/path/to/filename.a.bcd" then the short name is "filename".
-   *
-   * Predicates `getStem` and `getExtension` should be preferred over
-   * `getShortName` and `getExtensions` since the former pair is compatible
-   * with the file libraries of other languages.
-   * Note the slight difference between this predicate and `getStem`:
-   * for example, for "file.tar.gz", this predicate will have the result
-   * "file", while `getStem` will have the result "file.tar".
-   */
-  string getShortName() {
-    exists(string name, int firstDotPos |
-      name = this.getBaseName() and
-      firstDotPos = min([name.indexOf("."), name.length()]) and
-      result = name.prefix(firstDotPos)
-    )
-    or
-    this.getAbsolutePath() = "" and
-    result = ""
-  }
-}
-
-/**
- * Holds if any file was compiled by a Microsoft compiler.
- */
-predicate anyFileCompiledAsMicrosoft() { any(File f).compiledAsMicrosoft() }
-
-/**
- * A C/C++ header file, as determined (mainly) by file extension.
- *
- * For the related notion of whether a file is included anywhere (using a
- * pre-processor directive like `#include`), use `Include.getIncludedFile`.
- */
-class HeaderFile extends File {
-  HeaderFile() {
-    this.getExtension().toLowerCase() =
-      ["h", "r", "hpp", "hxx", "h++", "hh", "hp", "tcc", "tpp", "txx", "t++"]
-    or
-    not exists(this.getExtension()) and
-    exists(Include i | i.getIncludedFile() = this)
-  }
-
-  override string getAPrimaryQlClass() { result = "HeaderFile" }
-
-  /**
-   * Holds if this header file does not contain any declaration entries or top level
-   * declarations.  For example it might be:
-   *  - a file containing only preprocessor directives and/or comments
-   *  - an empty file
-   *  - a file that contains non-top level code or data that's included in an
-   *    unusual way
-   */
-  predicate noTopLevelCode() {
-    not exists(DeclarationEntry de | de.getFile() = this) and
-    not exists(Declaration d | d.getFile() = this and d.isTopLevel()) and
-    not exists(UsingEntry ue | ue.getFile() = this)
-  }
-}
-
-/**
- * A C source file, as determined by file extension.
- *
- * For the related notion of whether a file is compiled as C code, use
- * `File.compiledAsC`.
- */
-class CFile extends File {
-  CFile() { this.getExtension().toLowerCase() = ["c", "i"] }
-
-  override string getAPrimaryQlClass() { result = "CFile" }
-}
-
-/**
- * A C++ source file, as determined by file extension.
- *
- * For the related notion of whether a file is compiled as C++ code, use
- * `File.compiledAsCpp`.
- */
-class CppFile extends File {
-  CppFile() {
-    this.getExtension().toLowerCase() =
-      ["cpp", "cxx", "c++", "cc", "cp", "icc", "ipp", "ixx", "i++", "ii"]
-    // Note: .C files are indistinguishable from .c files on some
-    // file systems, so we just treat them as CFile's.
-  }
-
-  override string getAPrimaryQlClass() { result = "CppFile" }
-}
-
-/**
- * DEPRECATED: Objective-C is no longer supported.
- * An Objective C source file, as determined by file extension.
- *
- * For the related notion of whether a file is compiled as Objective C
- * code, use `File.compiledAsObjC`.
- */
-deprecated class ObjCFile extends File {
-  ObjCFile() { none() }
-}
-
-/**
- * DEPRECATED: Objective-C is no longer supported.
- * An Objective C++ source file, as determined by file extension.
- *
- * For the related notion of whether a file is compiled as Objective C++
- * code, use `File.compiledAsObjCpp`.
- */
-deprecated class ObjCppFile extends File {
-  ObjCppFile() { none() }
-}

cpp/ql/lib/semmle/code/cpp/Function.qll

@@ -1,876 +0,0 @@
-/**
- * Provides classes for working with functions, including template functions.
- */
-
-import semmle.code.cpp.Location
-import semmle.code.cpp.Class
-import semmle.code.cpp.Parameter
-import semmle.code.cpp.exprs.Call
-import semmle.code.cpp.metrics.MetricFunction
-import semmle.code.cpp.Linkage
-private import semmle.code.cpp.internal.ResolveClass
-
-/**
- * A C/C++ function [N4140 8.3.5]. Both member functions and non-member
- * functions are included. For example the function `MyFunction` in:
- * ```
- * void MyFunction() {
- *   DoSomething();
- * }
- * ```
- *
- * Function has a one-to-many relationship with FunctionDeclarationEntry,
- * because the same function can be declared in multiple locations. This
- * relationship between `Declaration` and `DeclarationEntry` is explained
- * in more detail in `Declaration.qll`.
- */
-class Function extends Declaration, ControlFlowNode, AccessHolder, @function {
-  override string getName() { functions(underlyingElement(this), result, _) }
-
-  /**
-   * DEPRECATED: Use `getIdentityString(Declaration)` from `semmle.code.cpp.Print` instead.
-   * Gets the full signature of this function, including return type, parameter
-   * types, and template arguments.
-   *
-   * For example, in the following code:
-   * ```
-   * template<typename T> T min(T x, T y);
-   * int z = min(5, 7);
-   * ```
-   * The full signature of the function called on the last line would be
-   * "min<int>(int, int) -> int", and the full signature of the uninstantiated
-   * template on the first line would be "min<T>(T, T) -> T".
-   */
-  string getFullSignature() {
-    exists(string name, string templateArgs, string args |
-      result = name + templateArgs + args + " -> " + getType().toString() and
-      name = getQualifiedName() and
-      (
-        if exists(getATemplateArgument())
-        then
-          templateArgs =
-            "<" +
-              concat(int i |
-                exists(getTemplateArgument(i))
-              |
-                getTemplateArgument(i).toString(), ", " order by i
-              ) + ">"
-        else templateArgs = ""
-      ) and
-      args =
-        "(" +
-          concat(int i |
-            exists(getParameter(i))
-          |
-            getParameter(i).getType().toString(), ", " order by i
-          ) + ")"
-    )
-  }
-
-  /** Gets a specifier of this function. */
-  override Specifier getASpecifier() {
-    funspecifiers(underlyingElement(this), unresolveElement(result)) or
-    result.hasName(getADeclarationEntry().getASpecifier())
-  }
-
-  /** Gets an attribute of this function. */
-  Attribute getAnAttribute() { funcattributes(underlyingElement(this), unresolveElement(result)) }
-
-  /** Holds if this function is generated by the compiler. */
-  predicate isCompilerGenerated() { compgenerated(underlyingElement(this)) }
-
-  /** Holds if this function is inline. */
-  predicate isInline() { this.hasSpecifier("inline") }
-
-  /**
-   * Holds if this function is virtual.
-   *
-   * Unlike `isDeclaredVirtual()`, `isVirtual()` holds even if the function
-   * is not explicitly declared with the `virtual` specifier.
-   */
-  predicate isVirtual() { this.hasSpecifier("virtual") }
-
-  /** Holds if this function is declared with the `virtual` specifier. */
-  predicate isDeclaredVirtual() { this.hasSpecifier("declared_virtual") }
-
-  /** Holds if this function is declared with the `override` specifier. */
-  predicate isOverride() { this.hasSpecifier("override") }
-
-  /** Holds if this function is declared with the `final` specifier. */
-  predicate isFinal() { this.hasSpecifier("final") }
-
-  /**
-   * Holds if this function is deleted.
-   * This may be because it was explicitly deleted with an `= delete`
-   * definition, or because the compiler was unable to auto-generate a
-   * definition for it.
-   *
-   * Most implicitly deleted functions are omitted from the database.
-   * `Class.implicitCopyConstructorDeleted` and
-   * `Class.implicitCopyAssignmentOperatorDeleted` can be used to find
-   * whether a class would have had those members implicitly deleted.
-   */
-  predicate isDeleted() { function_deleted(underlyingElement(this)) }
-
-  /**
-   * Holds if this function is explicitly defaulted with the `= default`
-   * specifier.
-   */
-  predicate isDefaulted() { function_defaulted(underlyingElement(this)) }
-
-  /**
-   * Holds if this function is declared to be `constexpr`.
-   *
-   * Note that this does not hold if the function has been declared
-   * `consteval`.
-   */
-  predicate isDeclaredConstexpr() { this.hasSpecifier("declared_constexpr") }
-
-  /**
-   * Holds if this function is `constexpr`. Normally, this holds if and
-   * only if `isDeclaredConstexpr()` holds, but in some circumstances
-   * they differ. For example, with
-   * ```
-   * int f(int i) { return 6; }
-   * template <typename T> constexpr int g(T x) { return f(x); }
-   * ```
-   * `g<int>` is declared constexpr, but is not constexpr.
-   *
-   * Will also hold if this function is `consteval`.
-   */
-  predicate isConstexpr() { this.hasSpecifier("is_constexpr") }
-
-  /**
-   * Holds if this function is declared to be `consteval`.
-   */
-  predicate isConsteval() { this.hasSpecifier("is_consteval") }
-
-  /**
-   * Holds if this function is declared with `__attribute__((naked))` or
-   * `__declspec(naked)`.
-   */
-  predicate isNaked() { getAnAttribute().hasName("naked") }
-
-  /**
-   * Holds if this function has a trailing return type.
-   *
-   * Note that this is true whether or not deduction took place. For example,
-   * this holds for both `e` and `f`, but not `g` or `h`:
-   * ```
-   * auto e() -> int { return 0; }
-   * auto f() -> auto { return 0; }
-   * auto g() { return 0; }
-   * int h() { return 0; }
-   * ```
-   */
-  predicate hasTrailingReturnType() { this.hasSpecifier("has_trailing_return_type") }
-
-  /** Gets the return type of this function. */
-  Type getType() { function_return_type(underlyingElement(this), unresolveElement(result)) }
-
-  /**
-   * Gets the return type of this function after specifiers have been deeply
-   * stripped and typedefs have been resolved.
-   */
-  Type getUnspecifiedType() { result = getType().getUnspecifiedType() }
-
-  /**
-   * Gets the nth parameter of this function. There is no result for the
-   * implicit `this` parameter, and there is no `...` varargs pseudo-parameter.
-   */
-  Parameter getParameter(int n) { params(unresolveElement(result), underlyingElement(this), n, _) }
-
-  /**
-   * Gets a parameter of this function. There is no result for the implicit
-   * `this` parameter, and there is no `...` varargs pseudo-parameter.
-   */
-  Parameter getAParameter() { params(unresolveElement(result), underlyingElement(this), _, _) }
-
-  /**
-   * Gets an access of this function.
-   *
-   * To get calls to this function, use `getACallToThisFunction` instead.
-   */
-  FunctionAccess getAnAccess() { result.getTarget() = this }
-
-  /**
-   * Gets the number of parameters of this function, _not_ including any
-   * implicit `this` parameter or any `...` varargs pseudo-parameter.
-   */
-  int getNumberOfParameters() { result = count(this.getAParameter()) }
-
-  /**
-   * Gets the number of parameters of this function, _including_ any implicit
-   * `this` parameter but _not_ including any `...` varargs pseudo-parameter.
-   */
-  int getEffectiveNumberOfParameters() {
-    // This method is overridden in `MemberFunction`, where the result is
-    // adjusted to account for the implicit `this` parameter.
-    result = getNumberOfParameters()
-  }
-
-  /**
-   * Gets a string representing the parameters of this function.
-   *
-   * For example: for a function `int Foo(int p1, int p2)` this would
-   * return `int p1, int p2`.
-   */
-  string getParameterString() {
-    result = concat(int i | | min(getParameter(i).getTypedName()), ", " order by i)
-  }
-
-  /** Gets a call to this function. */
-  FunctionCall getACallToThisFunction() { result.getTarget() = this }
-
-  /**
-   * Gets a declaration entry corresponding to this declaration. The
-   * relationship between `Declaration` and `DeclarationEntry` is explained
-   * in `Declaration.qll`.
-   */
-  override FunctionDeclarationEntry getADeclarationEntry() {
-    if fun_decls(_, underlyingElement(this), _, _, _)
-    then declEntry(result)
-    else
-      exists(Function f |
-        this.isConstructedFrom(f) and
-        fun_decls(unresolveElement(result), unresolveElement(f), _, _, _)
-      )
-  }
-
-  private predicate declEntry(FunctionDeclarationEntry fde) {
-    fun_decls(unresolveElement(fde), underlyingElement(this), _, _, _) and
-    // If one .cpp file specializes a function, and another calls the
-    // specialized function, then when extracting the second we only see an
-    // instantiation, not the specialization. We Therefore need to ignore
-    // any non-specialized declarations if there are any specialized ones.
-    (this.isSpecialization() implies fde.isSpecialization())
-  }
-
-  /**
-   * Gets the location of a `FunctionDeclarationEntry` corresponding to this
-   * declaration.
-   */
-  override Location getADeclarationLocation() { result = getADeclarationEntry().getLocation() }
-
-  /** Holds if this Function is a Template specialization. */
-  predicate isSpecialization() {
-    exists(FunctionDeclarationEntry fde |
-      fun_decls(unresolveElement(fde), underlyingElement(this), _, _, _) and
-      fde.isSpecialization()
-    )
-  }
-
-  /**
-   * Gets the declaration entry corresponding to this declaration that is a
-   * definition, if any.
-   */
-  override FunctionDeclarationEntry getDefinition() {
-    result = getADeclarationEntry() and
-    result.isDefinition()
-  }
-
-  /** Gets the location of the definition, if any. */
-  override Location getDefinitionLocation() {
-    if exists(getDefinition())
-    then result = getDefinition().getLocation()
-    else exists(Function f | this.isConstructedFrom(f) and result = f.getDefinition().getLocation())
-  }
-
-  /**
-   * Gets the preferred location of this declaration. (The location of the
-   * definition, if possible.)
-   */
-  override Location getLocation() {
-    if exists(getDefinition())
-    then result = this.getDefinitionLocation()
-    else result = this.getADeclarationLocation()
-  }
-
-  /** Gets a child declaration of this function. */
-  Declaration getADeclaration() { result = this.getAParameter() }
-
-  /**
-   * Gets the block that is the function body.
-   *
-   * For C++ functions whose body is a function try statement rather than a
-   * block, this gives the block guarded by the try statement. See
-   * `FunctionTryStmt` for further information.
-   */
-  BlockStmt getBlock() { result.getParentScope() = this }
-
-  /** Holds if this function has an entry point. */
-  predicate hasEntryPoint() { exists(getEntryPoint()) }
-
-  /**
-   * Gets the first node in this function's control flow graph.
-   *
-   * For most functions, this first node will be the `BlockStmt` returned by
-   * `getBlock`. However in C++, the first node can also be a
-   * `FunctionTryStmt`.
-   */
-  Stmt getEntryPoint() { function_entry_point(underlyingElement(this), unresolveElement(result)) }
-
-  /**
-   * Gets the metric class. `MetricFunction` has methods for computing
-   * various metrics, such as "number of lines of code" and "number of
-   * function calls".
-   */
-  MetricFunction getMetrics() { result = this }
-
-  /** Holds if this function calls the function `f`. */
-  predicate calls(Function f) { exists(Locatable l | this.calls(f, l)) }
-
-  /**
-   * Holds if this function calls the function `f` in the `FunctionCall`
-   * expression `l`.
-   */
-  predicate calls(Function f, Locatable l) {
-    exists(FunctionCall call |
-      call.getEnclosingFunction() = this and call.getTarget() = f and call = l
-    )
-    or
-    exists(DestructorCall call |
-      call.getEnclosingFunction() = this and call.getTarget() = f and call = l
-    )
-  }
-
-  /** Holds if this function accesses a function or variable or enumerator `a`. */
-  predicate accesses(Declaration a) { exists(Locatable l | this.accesses(a, l)) }
-
-  /**
-   * Holds if this function accesses a function or variable or enumerator `a`
-   * in the `Access` expression `l`.
-   */
-  predicate accesses(Declaration a, Locatable l) {
-    exists(Access access |
-      access.getEnclosingFunction() = this and
-      a = access.getTarget() and
-      access = l
-    )
-  }
-
-  /** Gets a variable that is written-to in this function. */
-  Variable getAWrittenVariable() {
-    exists(ConstructorFieldInit cfi |
-      cfi.getEnclosingFunction() = this and result = cfi.getTarget()
-    )
-    or
-    exists(VariableAccess va |
-      va = result.getAnAccess() and
-      va.isUsedAsLValue() and
-      va.getEnclosingFunction() = this
-    )
-  }
-
-  /**
-   * Gets the class of which this function, called `memberName`, is a member.
-   *
-   * Prefer to use `getDeclaringType()` or `getName()` directly if you do not
-   * need to reason about both.
-   */
-  pragma[nomagic]
-  Class getClassAndName(string memberName) {
-    this.hasName(memberName) and
-    this.getDeclaringType() = result
-  }
-
-  /**
-   * Implements `ControlFlowNode.getControlFlowScope`. The `Function` is
-   * used to represent the exit node of the control flow graph, so it is
-   * its own scope.
-   */
-  override Function getControlFlowScope() { result = this }
-
-  /**
-   * Implements `ControlFlowNode.getEnclosingStmt`. The `Function` is
-   * used to represent the exit node of the control flow graph, so it
-   * has no enclosing statement.
-   */
-  override Stmt getEnclosingStmt() { none() }
-
-  /**
-   * Holds if this function has C linkage, as specified by one of its
-   * declaration entries. For example: `extern "C" void foo();`.
-   */
-  predicate hasCLinkage() { getADeclarationEntry().hasCLinkage() }
-
-  /**
-   * Holds if this function is constructed from `f` as a result
-   * of template instantiation. If so, it originates either from a template
-   * function or from a function nested in a template class.
-   */
-  predicate isConstructedFrom(Function f) {
-    function_instantiation(underlyingElement(this), unresolveElement(f))
-  }
-
-  /**
-   * Holds if this function is defined in several files. This is illegal in
-   * C (though possible in some C++ compilers), and likely indicates that
-   * several functions that are not linked together have been compiled. An
-   * example would be a project with many 'main' functions.
-   */
-  predicate isMultiplyDefined() { strictcount(getFile()) > 1 }
-
-  /** Holds if this function is a varargs function. */
-  predicate isVarargs() { hasSpecifier("varargs") }
-
-  /** Gets a type that is specified to be thrown by the function. */
-  Type getAThrownType() { result = getADeclarationEntry().getAThrownType() }
-
-  /**
-   * Gets the `i`th type specified to be thrown by the function.
-   */
-  Type getThrownType(int i) { result = getADeclarationEntry().getThrownType(i) }
-
-  /** Holds if the function has an exception specification. */
-  predicate hasExceptionSpecification() { getADeclarationEntry().hasExceptionSpecification() }
-
-  /** Holds if this function has a `throw()` exception specification. */
-  predicate isNoThrow() { getADeclarationEntry().isNoThrow() }
-
-  /** Holds if this function has a `noexcept` exception specification. */
-  predicate isNoExcept() { getADeclarationEntry().isNoExcept() }
-
-  /**
-   * Gets a function that overloads this one.
-   *
-   * Note: if _overrides_ are wanted rather than _overloads_ then
-   * `MemberFunction::getAnOverridingFunction` should be used instead.
-   */
-  Function getAnOverload() {
-    (
-      // If this function is declared in a class, only consider other
-      // functions from the same class.
-      exists(string name, Class declaringType |
-        candGetAnOverloadMember(name, declaringType, this) and
-        candGetAnOverloadMember(name, declaringType, result)
-      )
-      or
-      // Conversely, if this function is not
-      // declared in a class, only consider other functions not declared in a
-      // class.
-      exists(string name, Namespace namespace |
-        candGetAnOverloadNonMember(name, namespace, this) and
-        candGetAnOverloadNonMember(name, namespace, result)
-      )
-    ) and
-    result != this and
-    // Instantiations and specializations don't participate in overload
-    // resolution.
-    not (
-      this instanceof FunctionTemplateInstantiation or
-      result instanceof FunctionTemplateInstantiation
-    ) and
-    not (
-      this instanceof FunctionTemplateSpecialization or
-      result instanceof FunctionTemplateSpecialization
-    )
-  }
-
-  /** Gets a link target which compiled or referenced this function. */
-  LinkTarget getALinkTarget() { this = result.getAFunction() }
-
-  /**
-   * Holds if this function is side-effect free (conservative
-   * approximation).
-   */
-  predicate isSideEffectFree() { not this.mayHaveSideEffects() }
-
-  /**
-   * Holds if this function may have side-effects; if in doubt, we assume it
-   * may.
-   */
-  predicate mayHaveSideEffects() {
-    // If we cannot see the definition then we assume that it may have
-    // side-effects.
-    if exists(this.getEntryPoint())
-    then
-      // If it might be globally impure (we don't care about it modifying
-      // temporaries) then it may have side-effects.
-      this.getEntryPoint().mayBeGloballyImpure()
-      or
-      // Constructor initializers are separate from the entry point ...
-      this.(Constructor).getAnInitializer().mayBeGloballyImpure()
-      or
-      // ... and likewise for destructors.
-      this.(Destructor).getADestruction().mayBeGloballyImpure()
-    else
-      // Unless it's a function that we know is side-effect free, it may
-      // have side-effects.
-      not this.hasGlobalOrStdName([
-          "strcmp", "wcscmp", "_mbscmp", "strlen", "wcslen", "_mbslen", "_mbslen_l", "_mbstrlen",
-          "_mbstrlen_l", "strnlen", "strnlen_s", "wcsnlen", "wcsnlen_s", "_mbsnlen", "_mbsnlen_l",
-          "_mbstrnlen", "_mbstrnlen_l", "strncmp", "wcsncmp", "_mbsncmp", "_mbsncmp_l", "strchr",
-          "memchr", "wmemchr", "memcmp", "wmemcmp", "_memicmp", "_memicmp_l", "feof", "isdigit",
-          "isxdigit", "abs", "fabs", "labs", "floor", "ceil", "atoi", "atol", "atoll", "atof"
-        ])
-  }
-
-  /**
-   * Gets the nearest enclosing AccessHolder.
-   */
-  override AccessHolder getEnclosingAccessHolder() { result = this.getDeclaringType() }
-}
-
-pragma[noinline]
-private predicate candGetAnOverloadMember(string name, Class declaringType, Function f) {
-  f.getName() = name and
-  f.getDeclaringType() = declaringType
-}
-
-pragma[noinline]
-private predicate candGetAnOverloadNonMember(string name, Namespace namespace, Function f) {
-  f.getName() = name and
-  f.getNamespace() = namespace and
-  not exists(f.getDeclaringType())
-}
-
-/**
- * A particular declaration or definition of a C/C++ function. For example the
- * declaration and definition of `MyFunction` in the following code are each a
- * `FunctionDeclarationEntry`:
- * ```
- * void MyFunction();
- *
- * void MyFunction() {
- *   DoSomething();
- * }
- * ```
- */
-class FunctionDeclarationEntry extends DeclarationEntry, @fun_decl {
-  /** Gets the function which is being declared or defined. */
-  override Function getDeclaration() { result = getFunction() }
-
-  override string getAPrimaryQlClass() { result = "FunctionDeclarationEntry" }
-
-  /** Gets the function which is being declared or defined. */
-  Function getFunction() { fun_decls(underlyingElement(this), unresolveElement(result), _, _, _) }
-
-  /** Gets the name of the function. */
-  override string getName() { fun_decls(underlyingElement(this), _, _, result, _) }
-
-  /**
-   * Gets the return type of the function which is being declared or
-   * defined.
-   */
-  override Type getType() { fun_decls(underlyingElement(this), _, unresolveElement(result), _, _) }
-
-  /** Gets the location of this declaration entry. */
-  override Location getLocation() { fun_decls(underlyingElement(this), _, _, _, result) }
-
-  /** Gets a specifier associated with this declaration entry. */
-  override string getASpecifier() { fun_decl_specifiers(underlyingElement(this), result) }
-
-  /**
-   * Implements `Element.getEnclosingElement`. A function declaration does
-   * not have an enclosing element.
-   */
-  override Element getEnclosingElement() { none() }
-
-  /**
-   * Gets the typedef type (if any) used for this function declaration. As
-   * an example, the typedef type in the declaration of function foo in the
-   * following is Foo:
-   *
-   * typedef int Foo();
-   * static Foo foo;
-   */
-  TypedefType getTypedefType() {
-    fun_decl_typedef_type(underlyingElement(this), unresolveElement(result))
-  }
-
-  /**
-   * Gets the cyclomatic complexity of this function:
-   *
-   *   The number of branching statements (if, while, do, for, switch,
-   *   case, catch) plus the number of branching expressions (`?`, `&&`,
-   *   `||`) plus one.
-   */
-  int getCyclomaticComplexity() { result = 1 + cyclomaticComplexityBranches(getBlock()) }
-
-  /**
-   * If this is a function definition, get the block containing the
-   * function body.
-   */
-  BlockStmt getBlock() {
-    this.isDefinition() and
-    result = getFunction().getBlock() and
-    result.getFile() = this.getFile()
-  }
-
-  /**
-   * If this is a function definition, get the number of lines of code
-   * associated with it.
-   */
-  pragma[noopt]
-  int getNumberOfLines() {
-    exists(BlockStmt b, Location l, int start, int end, int diff | b = getBlock() |
-      l = b.getLocation() and
-      start = l.getStartLine() and
-      end = l.getEndLine() and
-      diff = end - start and
-      result = diff + 1
-    )
-  }
-
-  /**
-   * Gets the declaration entry for a parameter of this function
-   * declaration.
-   */
-  ParameterDeclarationEntry getAParameterDeclarationEntry() {
-    result = getParameterDeclarationEntry(_)
-  }
-
-  /**
-   * Gets the declaration entry for the nth parameter of this function
-   * declaration.
-   */
-  ParameterDeclarationEntry getParameterDeclarationEntry(int n) {
-    param_decl_bind(unresolveElement(result), n, underlyingElement(this))
-  }
-
-  /** Gets the number of parameters of this function declaration. */
-  int getNumberOfParameters() { result = count(this.getAParameterDeclarationEntry()) }
-
-  /**
-   * Gets a string representing the parameters of this function declaration.
-   *
-   * For example: for a function 'int Foo(int p1, int p2)' this would
-   * return 'int p1, int p2'.
-   */
-  string getParameterString() {
-    result = concat(int i | | min(getParameterDeclarationEntry(i).getTypedName()), ", " order by i)
-  }
-
-  /**
-   * Holds if this declaration entry specifies C linkage:
-   *
-   *    `extern "C" void foo();`
-   */
-  predicate hasCLinkage() { getASpecifier() = "c_linkage" }
-
-  /** Holds if this declaration entry has a void parameter list. */
-  predicate hasVoidParamList() { getASpecifier() = "void_param_list" }
-
-  /** Holds if this declaration is also a definition of its function. */
-  override predicate isDefinition() { fun_def(underlyingElement(this)) }
-
-  /** Holds if this declaration is a Template specialization. */
-  predicate isSpecialization() { fun_specialized(underlyingElement(this)) }
-
-  /**
-   * Holds if this declaration is an implicit function declaration, that is,
-   * where a function is used before it is declared (under older C standards).
-   */
-  predicate isImplicit() { fun_implicit(underlyingElement(this)) }
-
-  /** Gets a type that is specified to be thrown by the declared function. */
-  Type getAThrownType() { result = getThrownType(_) }
-
-  /**
-   * Gets the `i`th type specified to be thrown by the declared function
-   * (where `i` is indexed from 0). For example, if a function is declared
-   * to `throw(int,float)`, then the thrown type with index 0 would be
-   * `int`, and that with index 1 would be `float`.
-   */
-  Type getThrownType(int i) {
-    fun_decl_throws(underlyingElement(this), i, unresolveElement(result))
-  }
-
-  /**
-   * If this declaration has a noexcept-specification [N4140 15.4], then
-   * this predicate returns the argument to `noexcept` if one was given.
-   */
-  Expr getNoExceptExpr() { fun_decl_noexcept(underlyingElement(this), unresolveElement(result)) }
-
-  /**
-   * Holds if the declared function has an exception specification [N4140
-   * 15.4].
-   */
-  predicate hasExceptionSpecification() {
-    fun_decl_throws(underlyingElement(this), _, _) or
-    fun_decl_noexcept(underlyingElement(this), _) or
-    isNoThrow() or
-    isNoExcept()
-  }
-
-  /**
-   * Holds if the declared function has a `throw()` exception specification.
-   */
-  predicate isNoThrow() { fun_decl_empty_throws(underlyingElement(this)) }
-
-  /**
-   * Holds if the declared function has an empty `noexcept` exception
-   * specification.
-   */
-  predicate isNoExcept() { fun_decl_empty_noexcept(underlyingElement(this)) }
-}
-
-/**
- * A C/C++ non-member function (a function that is not a member of any
- * class). For example, in the following code, `MyFunction` is a
- * `TopLevelFunction` but `MyMemberFunction` is not:
- * ```
- * void MyFunction() {
- *   DoSomething();
- * }
- *
- * class MyClass {
- * public:
- *   void MyMemberFunction() {
- *     DoSomething();
- *   }
- * };
- * ```
- */
-class TopLevelFunction extends Function {
-  TopLevelFunction() { not this.isMember() }
-
-  override string getAPrimaryQlClass() { result = "TopLevelFunction" }
-}
-
-/**
- * A C++ user-defined operator [N4140 13.5].
- */
-class Operator extends Function {
-  Operator() { functions(underlyingElement(this), _, 5) }
-
-  override string getAPrimaryQlClass() {
-    not this instanceof MemberFunction and result = "Operator"
-  }
-}
-
-/**
- * A C++ function which has a non-empty template argument list. For example
- * the function `myTemplateFunction` in the following code:
- * ```
- * template<class T>
- * void myTemplateFunction(T t) {
- *   ...
- * }
- * ```
- *
- * This comprises function declarations which are immediately preceded by
- * `template <...>`, where the "..." part is not empty, and therefore it does
- * not include:
- *
- *   1. Full specializations of template functions, as they have an empty
- *      template argument list.
- *   2. Instantiations of template functions, as they don't have an
- *      explicit template argument list.
- *   3. Member functions of template classes - unless they have their own
- *      (non-empty) template argument list.
- */
-class TemplateFunction extends Function {
-  TemplateFunction() {
-    is_function_template(underlyingElement(this)) and exists(getATemplateArgument())
-  }
-
-  override string getAPrimaryQlClass() { result = "TemplateFunction" }
-
-  /**
-   * Gets a compiler-generated instantiation of this function template.
-   */
-  Function getAnInstantiation() {
-    result.isConstructedFrom(this) and
-    not result.isSpecialization()
-  }
-
-  /**
-   * Gets a full specialization of this function template.
-   *
-   * Note that unlike classes, functions overload rather than specialize
-   * partially. Therefore this does not include things which "look like"
-   * partial specializations, nor does it include full specializations of
-   * such things -- see FunctionTemplateSpecialization for further details.
-   */
-  FunctionTemplateSpecialization getASpecialization() { result.getPrimaryTemplate() = this }
-}
-
-/**
- * A function that is an instantiation of a template. For example
- * the instantiation `myTemplateFunction<int>` in the following code:
- * ```
- * template<class T>
- * void myTemplateFunction(T t) {
- *   ...
- * }
- *
- * void caller(int i) {
- *   myTemplateFunction<int>(i);
- * }
- * ```
- */
-class FunctionTemplateInstantiation extends Function {
-  TemplateFunction tf;
-
-  FunctionTemplateInstantiation() { tf.getAnInstantiation() = this }
-
-  override string getAPrimaryQlClass() { result = "FunctionTemplateInstantiation" }
-
-  /**
-   * Gets the function template from which this instantiation was instantiated.
-   *
-   * Example: For `int const& std::min<int>(int const&, int const&)`, returns `T const& min<T>(T const&, T const&)`.
-   */
-  TemplateFunction getTemplate() { result = tf }
-}
-
-/**
- * An explicit specialization of a C++ function template. For example the
- * function `myTemplateFunction<int>` in the following code:
- * ```
- * template<class T>
- * void myTemplateFunction(T t) {
- *   ...
- * }
- *
- * template<>
- * void myTemplateFunction<int>(int i) {
- *   ...
- * }
- * ```
- *
- * Note that unlike classes, functions overload rather than specialize
- * partially. Therefore this only includes the last two of the following
- * four definitions, and in particular does not include the second one:
- *
- * ```
- * template <typename T> void f(T) {...}
- * template <typename T> void f(T*) {...}
- * template <> void f<int>(int *) {...}
- * template <> void f<int*>(int *) {...}
- * ```
- *
- * Furthermore, this does not include compiler-generated instantiations of
- * function templates.
- *
- * For further reference on function template specializations, see:
- *   http://www.gotw.ca/publications/mill17.htm
- */
-class FunctionTemplateSpecialization extends Function {
-  FunctionTemplateSpecialization() { this.isSpecialization() }
-
-  override string getAPrimaryQlClass() { result = "FunctionTemplateSpecialization" }
-
-  /**
-   * Gets the primary template for the specialization (the function template
-   * this specializes).
-   */
-  TemplateFunction getPrimaryTemplate() { this.isConstructedFrom(result) }
-}
-
-/**
- * A GCC built-in function. For example: `__builtin___memcpy_chk`.
- */
-class BuiltInFunction extends Function {
-  BuiltInFunction() { functions(underlyingElement(this), _, 6) }
-
-  /** Gets a dummy location for the built-in function. */
-  override Location getLocation() {
-    suppressUnusedThis(this) and
-    result instanceof UnknownDefaultLocation
-  }
-}
-
-private predicate suppressUnusedThis(Function f) { any() }

cpp/ql/lib/semmle/code/cpp/Location.qll

@@ -1,173 +0,0 @@
-/**
- * Provides classes and predicates for locations in the source code.
- */
-
-import semmle.code.cpp.Element
-import semmle.code.cpp.File
-
-/**
- * A location of a C/C++ artifact.
- */
-class Location extends @location {
-  /** Gets the container corresponding to this location. */
-  Container getContainer() { this.fullLocationInfo(result, _, _, _, _) }
-
-  /** Gets the file corresponding to this location, if any. */
-  File getFile() { result = this.getContainer() }
-
-  /** Gets the 1-based line number (inclusive) where this location starts. */
-  int getStartLine() { this.fullLocationInfo(_, result, _, _, _) }
-
-  /** Gets the 1-based column number (inclusive) where this location starts. */
-  int getStartColumn() { this.fullLocationInfo(_, _, result, _, _) }
-
-  /** Gets the 1-based line number (inclusive) where this location ends. */
-  int getEndLine() { this.fullLocationInfo(_, _, _, result, _) }
-
-  /** Gets the 1-based column number (inclusive) where this location ends. */
-  int getEndColumn() { this.fullLocationInfo(_, _, _, _, result) }
-
-  /**
-   * Gets a textual representation of this element.
-   *
-   * The format is "file://filePath:startLine:startColumn:endLine:endColumn".
-   */
-  string toString() {
-    exists(string filepath, int startline, int startcolumn, int endline, int endcolumn |
-      this.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
-    |
-      toUrl(filepath, startline, startcolumn, endline, endcolumn, result)
-    )
-  }
-
-  /**
-   * Holds if this element is in the specified container.
-   * The location spans column `startcolumn` of line `startline` to
-   * column `endcolumn` of line `endline`.
-   *
-   * This predicate is similar to `hasLocationInfo`, but exposes the `Container`
-   * entity, rather than merely its path.
-   */
-  predicate fullLocationInfo(
-    Container container, int startline, int startcolumn, int endline, int endcolumn
-  ) {
-    locations_default(this, unresolveElement(container), startline, startcolumn, endline, endcolumn) or
-    locations_expr(this, unresolveElement(container), startline, startcolumn, endline, endcolumn) or
-    locations_stmt(this, unresolveElement(container), startline, startcolumn, endline, endcolumn)
-  }
-
-  /**
-   * Holds if this element is at the specified location.
-   * The location spans column `startcolumn` of line `startline` to
-   * column `endcolumn` of line `endline` in file `filepath`.
-   * For more information, see
-   * [Locations](https://help.semmle.com/QL/learn-ql/ql/locations.html).
-   */
-  predicate hasLocationInfo(
-    string filepath, int startline, int startcolumn, int endline, int endcolumn
-  ) {
-    exists(Container f | this.fullLocationInfo(f, startline, startcolumn, endline, endcolumn) |
-      filepath = f.getAbsolutePath()
-    )
-  }
-
-  /** Holds if `this` comes on a line strictly before `l`. */
-  pragma[inline]
-  predicate isBefore(Location l) {
-    this.getFile() = l.getFile() and this.getEndLine() < l.getStartLine()
-  }
-
-  /** Holds if location `l` is completely contained within this one. */
-  predicate subsumes(Location l) {
-    exists(File f | f = getFile() |
-      exists(int thisStart, int thisEnd | charLoc(f, thisStart, thisEnd) |
-        exists(int lStart, int lEnd | l.charLoc(f, lStart, lEnd) |
-          thisStart <= lStart and lEnd <= thisEnd
-        )
-      )
-    )
-  }
-
-  /**
-   * Holds if this location corresponds to file `f` and character "offsets"
-   * `start..end`. Note that these are not real character offsets, because
-   * we use `maxCols` to find the length of the longest line and then pretend
-   * that all the lines are the same length. However, these offsets are
-   * convenient for comparing or sorting locations in a file. For an example,
-   * see `subsumes`.
-   */
-  predicate charLoc(File f, int start, int end) {
-    f = getFile() and
-    exists(int maxCols | maxCols = maxCols(f) |
-      start = getStartLine() * maxCols + getStartColumn() and
-      end = getEndLine() * maxCols + getEndColumn()
-    )
-  }
-}
-
-/**
- * DEPRECATED: Use `Location` instead.
- * A location of an element. Not used for expressions or statements, which
- * instead use LocationExpr and LocationStmt respectively.
- */
-deprecated library class LocationDefault extends Location, @location_default { }
-
-/**
- * DEPRECATED: Use `Location` instead.
- * A location of a statement.
- */
-deprecated library class LocationStmt extends Location, @location_stmt { }
-
-/**
- * DEPRECATED: Use `Location` instead.
- * A location of an expression.
- */
-deprecated library class LocationExpr extends Location, @location_expr { }
-
-/**
- * Gets the length of the longest line in file `f`.
- */
-pragma[nomagic]
-private int maxCols(File f) {
-  result = max(Location l | l.getFile() = f | l.getStartColumn().maximum(l.getEndColumn()))
-}
-
-/**
- * A C/C++ element that has a location in a file
- */
-class Locatable extends Element { }
-
-/**
- * A dummy location which is used when something doesn't have a location in
- * the source code but needs to have a `Location` associated with it. There
- * may be several distinct kinds of unknown locations. For example: one for
- * expressions, one for statements and one for other program elements.
- */
-class UnknownLocation extends Location {
-  UnknownLocation() { getFile().getAbsolutePath() = "" }
-}
-
-/**
- * A dummy location which is used when something doesn't have a location in
- * the source code but needs to have a `Location` associated with it.
- */
-class UnknownDefaultLocation extends UnknownLocation {
-  UnknownDefaultLocation() { locations_default(this, _, 0, 0, 0, 0) }
-}
-
-/**
- * A dummy location which is used when an expression doesn't have a
- * location in the source code but needs to have a `Location` associated
- * with it.
- */
-class UnknownExprLocation extends UnknownLocation {
-  UnknownExprLocation() { locations_expr(this, _, 0, 0, 0, 0) }
-}
-
-/**
- * A dummy location which is used when a statement doesn't have a location
- * in the source code but needs to have a `Location` associated with it.
- */
-class UnknownStmtLocation extends UnknownLocation {
-  UnknownStmtLocation() { locations_stmt(this, _, 0, 0, 0, 0) }
-}

cpp/ql/lib/semmle/code/cpp/MemberFunction.qll

@@ -1,517 +0,0 @@
-/**
- * Provides classes for working with C++ member functions, constructors, destructors,
- * and user-defined operators.
- */
-
-import cpp
-
-/**
- * A C++ function declared as a member of a class [N4140 9.3]. This includes
- * static member functions. For example the functions `MyStaticMemberFunction`
- * and `MyMemberFunction` in:
- * ```
- * class MyClass {
- * public:
- *   void MyMemberFunction() {
- *     DoSomething();
- *   }
- *
- *   static void MyStaticMemberFunction() {
- *     DoSomething();
- *   }
- * };
- * ```
- */
-class MemberFunction extends Function {
-  MemberFunction() { this.isMember() }
-
-  override string getAPrimaryQlClass() {
-    not this instanceof CopyAssignmentOperator and
-    not this instanceof MoveAssignmentOperator and
-    result = "MemberFunction"
-  }
-
-  /**
-   * Gets the number of parameters of this function, including any implicit
-   * `this` parameter.
-   */
-  override int getEffectiveNumberOfParameters() {
-    if isStatic() then result = getNumberOfParameters() else result = getNumberOfParameters() + 1
-  }
-
-  /** Holds if this member is private. */
-  predicate isPrivate() { this.hasSpecifier("private") }
-
-  /** Holds if this member is protected. */
-  predicate isProtected() { this.hasSpecifier("protected") }
-
-  /** Holds if this member is public. */
-  predicate isPublic() { this.hasSpecifier("public") }
-
-  /** Holds if this declaration has the lvalue ref-qualifier */
-  predicate isLValueRefQualified() { hasSpecifier("&") }
-
-  /** Holds if this declaration has the rvalue ref-qualifier */
-  predicate isRValueRefQualified() { hasSpecifier("&&") }
-
-  /** Holds if this declaration has a ref-qualifier */
-  predicate isRefQualified() { isLValueRefQualified() or isRValueRefQualified() }
-
-  /** Holds if this function overrides that function. */
-  predicate overrides(MemberFunction that) {
-    overrides(underlyingElement(this), unresolveElement(that))
-  }
-
-  /** Gets a directly overridden function. */
-  MemberFunction getAnOverriddenFunction() { this.overrides(result) }
-
-  /** Gets a directly overriding function. */
-  MemberFunction getAnOverridingFunction() { result.overrides(this) }
-
-  /**
-   * Gets the declaration entry for this member function that is within the
-   * class body.
-   */
-  FunctionDeclarationEntry getClassBodyDeclarationEntry() {
-    if strictcount(getADeclarationEntry()) = 1
-    then result = getDefinition()
-    else (
-      result = getADeclarationEntry() and result != getDefinition()
-    )
-  }
-
-  /**
-   * Gets the type of the `this` parameter associated with this member function, if any. The type
-   * may have `const` and/or `volatile` qualifiers, matching the function declaration.
-   */
-  PointerType getTypeOfThis() {
-    member_function_this_type(underlyingElement(this), unresolveElement(result))
-  }
-}
-
-/**
- * A C++ virtual function. For example the two functions called
- * `myVirtualFunction` in the following code are each a
- * `VirtualFunction`:
- * ```
- * class A {
- * public:
- *   virtual void myVirtualFunction() = 0;
- * };
- *
- * class B: public A {
- * public:
- *   virtual void myVirtualFunction() {
- *     doSomething();
- *   }
- * };
- * ```
- */
-class VirtualFunction extends MemberFunction {
-  VirtualFunction() { this.hasSpecifier("virtual") or purefunctions(underlyingElement(this)) }
-
-  override string getAPrimaryQlClass() { result = "VirtualFunction" }
-
-  /** Holds if this virtual function is pure. */
-  predicate isPure() { this instanceof PureVirtualFunction }
-
-  /**
-   * Holds if this function was declared with the `override` specifier
-   * [N4140 10.3].
-   */
-  predicate isOverrideExplicit() { this.hasSpecifier("override") }
-}
-
-/**
- * A C++ pure virtual function [N4140 10.4]. For example the first function
- * called `myVirtualFunction` in the following code:
- * ```
- * class A {
- * public:
- *   virtual void myVirtualFunction() = 0;
- * };
- *
- * class B: public A {
- * public:
- *   virtual void myVirtualFunction() {
- *     doSomething();
- *   }
- * };
- * ```
- */
-class PureVirtualFunction extends VirtualFunction {
-  PureVirtualFunction() { purefunctions(underlyingElement(this)) }
-
-  override string getAPrimaryQlClass() { result = "PureVirtualFunction" }
-}
-
-/**
- * A const C++ member function [N4140 9.3.1/4]. A const function has the
- * `const` specifier and does not modify the state of its class. For example
- * the member function `day` in the following code:
- * ```
- * class MyClass {
- *   ...
- *
- *   int day() const {
- *     return d;
- *   }
- *
- *   ...
- * };
- * ```
- */
-class ConstMemberFunction extends MemberFunction {
-  ConstMemberFunction() { this.hasSpecifier("const") }
-
-  override string getAPrimaryQlClass() { result = "ConstMemberFunction" }
-}
-
-/**
- * A C++ constructor [N4140 12.1]. For example the function `MyClass` in the
- * following code is a constructor:
- * ```
- * class MyClass {
- * public:
- *   MyClass() {
- *     ...
- *   }
- * };
- * ```
- */
-class Constructor extends MemberFunction {
-  Constructor() { functions(underlyingElement(this), _, 2) }
-
-  override string getAPrimaryQlClass() { result = "Constructor" }
-
-  /**
-   * Holds if this constructor serves as a default constructor.
-   *
-   * This holds for constructors with zero formal parameters. It also holds
-   * for constructors which have a non-zero number of formal parameters,
-   * provided that every parameter has a default value.
-   */
-  predicate isDefault() { forall(Parameter p | p = this.getAParameter() | p.hasInitializer()) }
-
-  /**
-   * Gets an entry in the constructor's initializer list, or a
-   * compiler-generated action which initializes a base class or member
-   * variable.
-   */
-  ConstructorInit getAnInitializer() { result = getInitializer(_) }
-
-  /**
-   * Gets an entry in the constructor's initializer list, or a
-   * compiler-generated action which initializes a base class or member
-   * variable. The index specifies the order in which the initializer is
-   * to be evaluated.
-   */
-  ConstructorInit getInitializer(int i) {
-    exprparents(unresolveElement(result), i, underlyingElement(this))
-  }
-}
-
-/**
- * A function that defines an implicit conversion.
- */
-class ImplicitConversionFunction extends MemberFunction {
-  ImplicitConversionFunction() {
-    // ConversionOperator
-    functions(underlyingElement(this), _, 4)
-    or
-    // ConversionConstructor (deprecated)
-    strictcount(Parameter p | p = getAParameter() and not p.hasInitializer()) = 1 and
-    not hasSpecifier("explicit")
-  }
-
-  /** Gets the type this `ImplicitConversionFunction` takes as input. */
-  Type getSourceType() { none() } // overridden in subclasses
-
-  /** Gets the type this `ImplicitConversionFunction` converts to. */
-  Type getDestType() { none() } // overridden in subclasses
-}
-
-/**
- * DEPRECATED: as of C++11 this class does not correspond perfectly with the
- * language definition of a converting constructor.
- *
- * A C++ constructor that also defines an implicit conversion. For example the
- * function `MyClass` in the following code is a `ConversionConstructor`:
- * ```
- * class MyClass {
- * public:
- *   MyClass(const MyOtherClass &from) {
- *     ...
- *   }
- * };
- * ```
- */
-deprecated class ConversionConstructor extends Constructor, ImplicitConversionFunction {
-  ConversionConstructor() {
-    strictcount(Parameter p | p = getAParameter() and not p.hasInitializer()) = 1 and
-    not hasSpecifier("explicit")
-  }
-
-  override string getAPrimaryQlClass() {
-    not this instanceof CopyConstructor and
-    not this instanceof MoveConstructor and
-    result = "ConversionConstructor"
-  }
-
-  /** Gets the type this `ConversionConstructor` takes as input. */
-  override Type getSourceType() { result = this.getParameter(0).getType() }
-
-  /** Gets the type this `ConversionConstructor` is a constructor of. */
-  override Type getDestType() { result = this.getDeclaringType() }
-}
-
-private predicate hasCopySignature(MemberFunction f) {
-  f.getParameter(0).getUnspecifiedType().(LValueReferenceType).getBaseType() = f.getDeclaringType()
-}
-
-private predicate hasMoveSignature(MemberFunction f) {
-  f.getParameter(0).getUnspecifiedType().(RValueReferenceType).getBaseType() = f.getDeclaringType()
-}
-
-/**
- * A C++ copy constructor [N4140 12.8]. For example the function `MyClass` in
- * the following code is a `CopyConstructor`:
- * ```
- * class MyClass {
- * public:
- *   MyClass(const MyClass &from) {
- *     ...
- *   }
- * };
- * ```
- *
- * As per the standard, a copy constructor of class `T` is a non-template
- * constructor whose first parameter has type `T&`, `const T&`, `volatile
- * T&`, or `const volatile T&`, and either there are no other parameters,
- * or the rest of the parameters all have default values.
- *
- * For template classes, it can generally not be determined until instantiation
- * whether a constructor is a copy constructor. For such classes, `CopyConstructor`
- * over-approximates the set of copy constructors; if an under-approximation is
- * desired instead, see the member predicate
- * `mayNotBeCopyConstructorInInstantiation`.
- */
-class CopyConstructor extends Constructor {
-  CopyConstructor() {
-    hasCopySignature(this) and
-    (
-      // The rest of the parameters all have default values
-      forall(int i | i > 0 and exists(getParameter(i)) | getParameter(i).hasInitializer())
-      or
-      // or this is a template class, in which case the default values have
-      // not been extracted even if they exist. In that case, we assume that
-      // there are default values present since that is the most common case
-      // in real-world code.
-      getDeclaringType() instanceof TemplateClass
-    ) and
-    not exists(getATemplateArgument())
-  }
-
-  override string getAPrimaryQlClass() { result = "CopyConstructor" }
-
-  /**
-   * Holds if we cannot determine that this constructor will become a copy
-   * constructor in all instantiations. Depending on template parameters of the
-   * enclosing class, this may become an ordinary constructor or a copy
-   * constructor.
-   */
-  predicate mayNotBeCopyConstructorInInstantiation() {
-    // In general, default arguments of template classes can only be
-    // type-checked for each template instantiation; if an argument in an
-    // instantiation fails to type-check then the corresponding parameter has
-    // no default argument in the instantiation.
-    getDeclaringType() instanceof TemplateClass and
-    getNumberOfParameters() > 1
-  }
-}
-
-/**
- * A C++ move constructor [N4140 12.8]. For example the function `MyClass` in
- * the following code is a `MoveConstructor`:
- * ```
- * class MyClass {
- * public:
- *   MyClass(MyClass &&from) {
- *     ...
- *   }
- * };
- * ```
- *
- * As per the standard, a move constructor of class `T` is a non-template
- * constructor whose first parameter is `T&&`, `const T&&`, `volatile T&&`,
- * or `const volatile T&&`, and either there are no other parameters, or
- * the rest of the parameters all have default values.
- *
- * For template classes, it can generally not be determined until instantiation
- * whether a constructor is a move constructor. For such classes, `MoveConstructor`
- * over-approximates the set of move constructors; if an under-approximation is
- * desired instead, see the member predicate
- * `mayNotBeMoveConstructorInInstantiation`.
- */
-class MoveConstructor extends Constructor {
-  MoveConstructor() {
-    hasMoveSignature(this) and
-    (
-      // The rest of the parameters all have default values
-      forall(int i | i > 0 and exists(getParameter(i)) | getParameter(i).hasInitializer())
-      or
-      // or this is a template class, in which case the default values have
-      // not been extracted even if they exist. In that case, we assume that
-      // there are default values present since that is the most common case
-      // in real-world code.
-      getDeclaringType() instanceof TemplateClass
-    ) and
-    not exists(getATemplateArgument())
-  }
-
-  override string getAPrimaryQlClass() { result = "MoveConstructor" }
-
-  /**
-   * Holds if we cannot determine that this constructor will become a move
-   * constructor in all instantiations. Depending on template parameters of the
-   * enclosing class, this may become an ordinary constructor or a move
-   * constructor.
-   */
-  predicate mayNotBeMoveConstructorInInstantiation() {
-    // In general, default arguments of template classes can only be
-    // type-checked for each template instantiation; if an argument in an
-    // instantiation fails to type-check then the corresponding parameter has
-    // no default argument in the instantiation.
-    getDeclaringType() instanceof TemplateClass and
-    getNumberOfParameters() > 1
-  }
-}
-
-/**
- * A C++ constructor that takes no arguments ('default' constructor). This
- * is the constructor that is invoked when no initializer is given. For
- * example the function `MyClass` in the following code is a
- * `NoArgConstructor`:
- * ```
- * class MyClass {
- * public:
- *   MyClass() {
- *     ...
- *   }
- * };
- * ```
- */
-class NoArgConstructor extends Constructor {
-  NoArgConstructor() { this.getNumberOfParameters() = 0 }
-}
-
-/**
- * A C++ destructor [N4140 12.4]. For example the function `~MyClass` in the
- * following code is a destructor:
- * ```
- * class MyClass {
- * public:
- *   ~MyClass() {
- *     ...
- *   }
- * };
- * ```
- */
-class Destructor extends MemberFunction {
-  Destructor() { functions(underlyingElement(this), _, 3) }
-
-  override string getAPrimaryQlClass() { result = "Destructor" }
-
-  /**
-   * Gets a compiler-generated action which destructs a base class or member
-   * variable.
-   */
-  DestructorDestruction getADestruction() { result = getDestruction(_) }
-
-  /**
-   * Gets a compiler-generated action which destructs a base class or member
-   * variable. The index specifies the order in which the destruction should
-   * be evaluated.
-   */
-  DestructorDestruction getDestruction(int i) {
-    exprparents(unresolveElement(result), i, underlyingElement(this))
-  }
-}
-
-/**
- * A C++ conversion operator [N4140 12.3.2]. For example the function
- * `operator int` in the following code is a `ConversionOperator`:
- * ```
- * class MyClass {
- * public:
- *   operator int();
- * };
- * ```
- */
-class ConversionOperator extends MemberFunction, ImplicitConversionFunction {
-  ConversionOperator() { functions(underlyingElement(this), _, 4) }
-
-  override string getAPrimaryQlClass() { result = "ConversionOperator" }
-
-  override Type getSourceType() { result = this.getDeclaringType() }
-
-  override Type getDestType() { result = this.getType() }
-}
-
-/**
- * A C++ copy assignment operator [N4140 12.8]. For example the function
- * `operator=` in the following code is a `CopyAssignmentOperator`:
- * ```
- * class MyClass {
- * public:
- *   MyClass &operator=(const MyClass &other);
- * };
- * ```
- *
- * As per the standard, a copy assignment operator of class `T` is a
- * non-template non-static member function with the name `operator=` that
- * takes exactly one parameter of type `T`, `T&`, `const T&`, `volatile
- * T&`, or `const volatile T&`.
- */
-class CopyAssignmentOperator extends Operator {
-  CopyAssignmentOperator() {
-    hasName("operator=") and
-    (
-      hasCopySignature(this)
-      or
-      // Unlike CopyConstructor, this member allows a non-reference
-      // parameter.
-      getParameter(0).getUnspecifiedType() = getDeclaringType()
-    ) and
-    not exists(this.getParameter(1)) and
-    not exists(getATemplateArgument())
-  }
-
-  override string getAPrimaryQlClass() { result = "CopyAssignmentOperator" }
-}
-
-/**
- * A C++ move assignment operator [N4140 12.8]. For example the function
- * `operator=` in the following code is a `MoveAssignmentOperator`:
- * ```
- * class MyClass {
- * public:
- *   MyClass &operator=(MyClass &&other);
- * };
- * ```
- *
- * As per the standard, a move assignment operator of class `T` is a
- * non-template non-static member function with the name `operator=` that
- * takes exactly one parameter of type `T&&`, `const T&&`, `volatile T&&`,
- * or `const volatile T&&`.
- */
-class MoveAssignmentOperator extends Operator {
-  MoveAssignmentOperator() {
-    hasName("operator=") and
-    hasMoveSignature(this) and
-    not exists(this.getParameter(1)) and
-    not exists(getATemplateArgument())
-  }
-
-  override string getAPrimaryQlClass() { result = "MoveAssignmentOperator" }
-}

cpp/ql/lib/semmle/code/cpp/Namespace.qll

@@ -1,249 +0,0 @@
-/**
- * Provides classes for modeling namespaces, `using` directives and `using` declarations.
- */
-
-import semmle.code.cpp.Element
-import semmle.code.cpp.Type
-import semmle.code.cpp.metrics.MetricNamespace
-
-/**
- * A C++ namespace. For example the (single) namespace `A` in the following
- * code:
- * ```
- * namespace A
- * {
- *   // ...
- * }
- *
- * // ...
- *
- * namespace A
- * {
- *   // ...
- * }
- * ```
- * Note that namespaces are somewhat nebulous entities, as they do not in
- * general have a single well-defined location in the source code. The
- * related notion of a `NamespaceDeclarationEntry` is rather more concrete,
- * and should be used when a location is required. For example, the `std::`
- * namespace is particularly nebulous, as parts of it are defined across a
- * wide range of headers. As a more extreme example, the global namespace
- * is never explicitly declared, but might correspond to a large proportion
- * of the source code.
- */
-class Namespace extends NameQualifyingElement, @namespace {
-  /**
-   * Gets the location of the namespace. Most namespaces do not have a
-   * single well-defined source location, so a dummy location is returned,
-   * unless the namespace has exactly one declaration entry.
-   */
-  override Location getLocation() {
-    if strictcount(getADeclarationEntry()) = 1
-    then result = getADeclarationEntry().getLocation()
-    else result instanceof UnknownDefaultLocation
-  }
-
-  /** Gets the simple name of this namespace. */
-  override string getName() { namespaces(underlyingElement(this), result) }
-
-  /** Holds if this element is named `name`. */
-  predicate hasName(string name) { name = this.getName() }
-
-  /** Holds if this namespace is anonymous. */
-  predicate isAnonymous() { hasName("(unnamed namespace)") }
-
-  /** Gets the name of the parent namespace, if it exists. */
-  private string getParentName() {
-    result = this.getParentNamespace().getName() and
-    result != ""
-  }
-
-  /** Gets the qualified name of this namespace. For example: `a::b`. */
-  string getQualifiedName() {
-    if exists(getParentName())
-    then result = getParentNamespace().getQualifiedName() + "::" + getName()
-    else result = getName()
-  }
-
-  /** Gets the parent namespace, if any. */
-  Namespace getParentNamespace() {
-    namespacembrs(unresolveElement(result), underlyingElement(this))
-    or
-    not namespacembrs(_, underlyingElement(this)) and result instanceof GlobalNamespace
-  }
-
-  /** Gets a child declaration of this namespace. */
-  Declaration getADeclaration() { namespacembrs(underlyingElement(this), unresolveElement(result)) }
-
-  /** Gets a child namespace of this namespace. */
-  Namespace getAChildNamespace() {
-    namespacembrs(underlyingElement(this), unresolveElement(result))
-  }
-
-  /** Holds if the namespace is inline. */
-  predicate isInline() { namespace_inline(underlyingElement(this)) }
-
-  /** Holds if this namespace may be from source. */
-  override predicate fromSource() { this.getADeclaration().fromSource() }
-
-  /**
-   * Holds if this namespace is in a library.
-   *
-   * DEPRECATED: never holds.
-   */
-  deprecated override predicate fromLibrary() { not this.fromSource() }
-
-  /** Gets the metric namespace. */
-  MetricNamespace getMetrics() { result = this }
-
-  /** Gets a version of the `QualifiedName` that is more suitable for display purposes. */
-  string getFriendlyName() { result = this.getQualifiedName() }
-
-  final override string toString() { result = getFriendlyName() }
-
-  /** Gets a declaration of (part of) this namespace. */
-  NamespaceDeclarationEntry getADeclarationEntry() { result.getNamespace() = this }
-
-  /** Gets a file which declares (part of) this namespace. */
-  File getAFile() { result = this.getADeclarationEntry().getLocation().getFile() }
-}
-
-/**
- * A declaration of (part of) a C++ namespace. This corresponds to a single
- * `namespace N { ... }` occurrence in the source code. For example the two
- * mentions of `A` in the following code:
- * ```
- * namespace A
- * {
- *   // ...
- * }
- *
- * // ...
- *
- * namespace A
- * {
- *   // ...
- * }
- * ```
- */
-class NamespaceDeclarationEntry extends Locatable, @namespace_decl {
-  /**
-   * Get the namespace that this declaration entry corresponds to.  There
-   * is a one-to-many relationship between `Namespace` and
-   * `NamespaceDeclarationEntry`.
-   */
-  Namespace getNamespace() {
-    namespace_decls(underlyingElement(this), unresolveElement(result), _, _)
-  }
-
-  override string toString() { result = this.getNamespace().getFriendlyName() }
-
-  /**
-   * Gets the location of the token preceding the namespace declaration
-   * entry's body.
-   *
-   * For named declarations, such as "namespace MyStuff { ... }", this will
-   * give the "MyStuff" token.
-   *
-   * For anonymous declarations, such as "namespace { ... }", this will
-   * give the "namespace" token.
-   */
-  override Location getLocation() { namespace_decls(underlyingElement(this), _, result, _) }
-
-  /**
-   * Gets the location of the namespace declaration entry's body. For
-   * example: the "{ ... }" in "namespace N { ... }".
-   */
-  Location getBodyLocation() { namespace_decls(underlyingElement(this), _, _, result) }
-
-  override string getAPrimaryQlClass() { result = "NamespaceDeclarationEntry" }
-}
-
-/**
- * A C++ `using` directive or `using` declaration.
- */
-class UsingEntry extends Locatable, @using {
-  override Location getLocation() { usings(underlyingElement(this), _, result) }
-}
-
-/**
- * A C++ `using` declaration. For example:
- * ```
- * using std::string;
- * ```
- */
-class UsingDeclarationEntry extends UsingEntry {
-  UsingDeclarationEntry() {
-    not exists(Namespace n | usings(underlyingElement(this), unresolveElement(n), _))
-  }
-
-  /**
-   * Gets the declaration that is referenced by this using declaration. For
-   * example, `std::string` in `using std::string`.
-   */
-  Declaration getDeclaration() { usings(underlyingElement(this), unresolveElement(result), _) }
-
-  override string toString() { result = "using " + this.getDeclaration().getDescription() }
-}
-
-/**
- * A C++ `using` directive. For example:
- * ```
- * using namespace std;
- * ```
- */
-class UsingDirectiveEntry extends UsingEntry {
-  UsingDirectiveEntry() {
-    exists(Namespace n | usings(underlyingElement(this), unresolveElement(n), _))
-  }
-
-  /**
-   * Gets the namespace that is referenced by this using directive. For
-   * example, `std` in `using namespace std`.
-   */
-  Namespace getNamespace() { usings(underlyingElement(this), unresolveElement(result), _) }
-
-  override string toString() { result = "using namespace " + this.getNamespace().getFriendlyName() }
-}
-
-/**
- * Holds if `g` is an instance of `GlobalNamespace`. This predicate
- * is used suppress a warning in `GlobalNamespace.getADeclaration()`
- * by providing a fake use of `this`.
- */
-private predicate suppressWarningForUnused(GlobalNamespace g) { any() }
-
-/**
- * The C/C++ global namespace.
- */
-class GlobalNamespace extends Namespace {
-  GlobalNamespace() { this.hasName("") }
-
-  override Declaration getADeclaration() {
-    suppressWarningForUnused(this) and
-    result.isTopLevel() and
-    not namespacembrs(_, unresolveElement(result))
-  }
-
-  /** Gets a child namespace of the global namespace. */
-  override Namespace getAChildNamespace() {
-    suppressWarningForUnused(this) and
-    not namespacembrs(unresolveElement(result), _)
-  }
-
-  override Namespace getParentNamespace() { none() }
-
-  /**
-   * DEPRECATED: use `getName()`.
-   */
-  deprecated string getFullName() { result = this.getName() }
-
-  override string getFriendlyName() { result = "(global namespace)" }
-}
-
-/**
- * The C++ `std::` namespace.
- */
-class StdNamespace extends Namespace {
-  StdNamespace() { this.hasName("std") and this.getParentNamespace() instanceof GlobalNamespace }
-}

cpp/ql/lib/semmle/code/cpp/Preprocessor.qll

@@ -1,294 +0,0 @@
-import semmle.code.cpp.Location
-import semmle.code.cpp.Element
-
-/**
- * A C/C++ preprocessor directive. For example each of the following lines of
- * code contains a `PreprocessorDirective`:
- * ```
- * #pragma once
- * #ifdef MYDEFINE
- * #include "myfile.h"
- * #line 1 "source.c"
- * ```
- */
-class PreprocessorDirective extends Locatable, @preprocdirect {
-  override string toString() { result = "Preprocessor directive" }
-
-  override Location getLocation() { preprocdirects(underlyingElement(this), _, result) }
-
-  string getHead() { preproctext(underlyingElement(this), result, _) }
-
-  /**
-   * Gets a preprocessor branching directive whose condition affects
-   * whether this directive is performed.
-   *
-   * From a lexical point of view, this returns all `#if`, `#ifdef`,
-   * `#ifndef`, or `#elif` directives which occur before this directive and
-   * have a matching `#endif` which occurs after this directive.
-   */
-  PreprocessorBranch getAGuard() {
-    exists(PreprocessorEndif e, int line |
-      result.getEndIf() = e and
-      e.getFile() = getFile() and
-      result.getFile() = getFile() and
-      line = this.getLocation().getStartLine() and
-      result.getLocation().getStartLine() < line and
-      line < e.getLocation().getEndLine()
-    )
-  }
-}
-
-private class TPreprocessorBranchDirective = @ppd_branch or @ppd_else or @ppd_endif;
-
-/**
- * A C/C++ preprocessor branch related directive: `#if`, `#ifdef`,
- * `#ifndef`, `#elif`, `#else` or `#endif`.
- */
-class PreprocessorBranchDirective extends PreprocessorDirective, TPreprocessorBranchDirective {
-  /**
-   * Gets the `#if`, `#ifdef` or `#ifndef` directive which matches this
-   * branching directive.
-   *
-   * If this branch directive was unbalanced, then there will be no
-   * result. Conversely, if the branch matches different `#if` directives
-   * in different translation units, then there can be more than one
-   * result.
-   */
-  PreprocessorBranch getIf() {
-    result = this.(PreprocessorIf) or
-    result = this.(PreprocessorIfdef) or
-    result = this.(PreprocessorIfndef) or
-    preprocpair(unresolveElement(result), underlyingElement(this))
-  }
-
-  /**
-   * Gets the `#endif` directive which matches this branching directive.
-   *
-   * If this branch directive was unbalanced, then there will be no
-   * result. Conversely, if the branch matched different `#endif`
-   * directives in different translation units, then there can be more than
-   * one result.
-   */
-  PreprocessorEndif getEndIf() { preprocpair(unresolveElement(getIf()), unresolveElement(result)) }
-
-  /**
-   * Gets the next `#elif`, `#else` or `#endif` matching this branching
-   * directive.
-   *
-   * For example `somePreprocessorBranchDirective.getIf().getNext()` gets
-   * the second directive in the same construct as
-   * `somePreprocessorBranchDirective`.
-   */
-  PreprocessorBranchDirective getNext() {
-    exists(PreprocessorBranch branch |
-      this.getIndexInBranch(branch) + 1 = result.getIndexInBranch(branch)
-    )
-  }
-
-  /**
-   * Gets the index of this branching directive within the matching #if,
-   * #ifdef or #ifndef.
-   */
-  private int getIndexInBranch(PreprocessorBranch branch) {
-    this =
-      rank[result](PreprocessorBranchDirective other |
-        other.getIf() = branch
-      |
-        other order by other.getLocation().getStartLine()
-      )
-  }
-}
-
-/**
- * A C/C++ preprocessor branching directive: `#if`, `#ifdef`, `#ifndef`, or
- * `#elif`.
- *
- * A branching directive has a condition and that condition may be evaluated
- * at compile-time.  As a result, the preprocessor will either take the
- * branch, or not take the branch.
- *
- * However, there are also situations in which a branch's condition isn't
- * evaluated.  The obvious case of this is when the directive is contained
- * within a branch which wasn't taken. There is also a much more subtle
- * case involving header guard branches: suitably clever compilers can
- * notice that a branch is a header guard, and can then subsequently ignore
- * a `#include` for the file being guarded. It is for this reason that
- * `wasTaken()` always holds on header guard branches, but `wasNotToken()`
- * rarely holds on header guard branches.
- */
-class PreprocessorBranch extends PreprocessorBranchDirective, @ppd_branch {
-  /**
-   * Holds if at least one translation unit evaluated this directive's
-   * condition and subsequently took the branch.
-   */
-  predicate wasTaken() { preproctrue(underlyingElement(this)) }
-
-  /**
-   * Holds if at least one translation unit evaluated this directive's
-   * condition but then didn't take the branch.
-   *
-   * If `#else` is the next matching directive, then this means that the
-   * `#else` was taken instead.
-   */
-  predicate wasNotTaken() { preprocfalse(underlyingElement(this)) }
-
-  /**
-   * Holds if this directive was either taken by all translation units
-   * which evaluated it, or was not taken by any translation unit which
-   * evaluated it.
-   */
-  predicate wasPredictable() { not (wasTaken() and wasNotTaken()) }
-}
-
-/**
- * A C/C++ preprocessor `#if` directive. For example there is a
- * `PreprocessorIf` on the first line of the following code:
- * ```
- * #if defined(MYDEFINE)
- * // ...
- * #endif
- * ```
- * For the related notion of a directive which causes branching (which
- * includes `#if`, plus also `#ifdef`, `#ifndef`, and `#elif`), see
- * `PreprocessorBranch`.
- */
-class PreprocessorIf extends PreprocessorBranch, @ppd_if {
-  override string toString() { result = "#if " + this.getHead() }
-}
-
-/**
- * A C/C++ preprocessor `#ifdef` directive. For example there is a
- * `PreprocessorIfdef` on the first line of the following code:
- * ```
- * #ifdef MYDEFINE
- * // ...
- * #endif
- * ```
- * The syntax `#ifdef X` is shorthand for `#if defined(X)`.
- */
-class PreprocessorIfdef extends PreprocessorBranch, @ppd_ifdef {
-  override string toString() { result = "#ifdef " + this.getHead() }
-
-  override string getAPrimaryQlClass() { result = "PreprocessorIfdef" }
-}
-
-/**
- * A C/C++ preprocessor `#ifndef` directive. For example there is a
- * `PreprocessorIfndef` on the first line of the following code:
- * ```
- * #ifndef MYDEFINE
- * // ...
- * #endif
- * ```
- * The syntax `#ifndef X` is shorthand for `#if !defined(X)`.
- */
-class PreprocessorIfndef extends PreprocessorBranch, @ppd_ifndef {
-  override string toString() { result = "#ifndef " + this.getHead() }
-}
-
-/**
- * A C/C++ preprocessor `#else` directive. For example there is a
- * `PreprocessorElse` on the fifth line of the following code:
- * ```
- * #ifdef MYDEFINE1
- * // ...
- * #elif MYDEFINE2
- * // ...
- * #else
- * // ...
- * #endif
- * ```
- */
-class PreprocessorElse extends PreprocessorBranchDirective, @ppd_else {
-  override string toString() { result = "#else" }
-}
-
-/**
- * A C/C++ preprocessor `#elif` directive. For example there is a
- * `PreprocessorElif` on the third line of the following code:
- * ```
- * #ifdef MYDEFINE1
- * // ...
- * #elif MYDEFINE2
- * // ...
- * #else
- * // ...
- * #endif
- * ```
- */
-class PreprocessorElif extends PreprocessorBranch, @ppd_elif {
-  override string toString() { result = "#elif " + this.getHead() }
-}
-
-/**
- * A C/C++ preprocessor `#endif` directive. For example there is a
- * `PreprocessorEndif` on the third line of the following code:
- * ```
- * #ifdef MYDEFINE
- * // ...
- * #endif
- * ```
- */
-class PreprocessorEndif extends PreprocessorBranchDirective, @ppd_endif {
-  override string toString() { result = "#endif" }
-}
-
-/**
- * A C/C++ preprocessor `#warning` directive. For example:
- * ```
- * #warning "This configuration is not supported."
- * ```
- */
-class PreprocessorWarning extends PreprocessorDirective, @ppd_warning {
-  override string toString() { result = "#warning " + this.getHead() }
-}
-
-/**
- * A C/C++ preprocessor `#error` directive. For example:
- * ```
- * #error "This configuration is not implemented."
- * ```
- */
-class PreprocessorError extends PreprocessorDirective, @ppd_error {
-  override string toString() { result = "#error " + this.getHead() }
-}
-
-/**
- * A C/C++ preprocessor `#undef` directive. For example there is a
- * `PreprocessorUndef` on the second line of the following code:
- * ```
- * #ifdef MYMACRO
- * #undef MYMACRO
- * #endif
- * ```
- */
-class PreprocessorUndef extends PreprocessorDirective, @ppd_undef {
-  override string toString() { result = "#undef " + this.getHead() }
-
-  /**
-   * Gets the name of the macro that is undefined.
-   */
-  string getName() { result = getHead() }
-}
-
-/**
- * A C/C++ preprocessor `#pragma` directive. For example:
- * ```
- * #pragma once
- * ```
- */
-class PreprocessorPragma extends PreprocessorDirective, @ppd_pragma {
-  override string toString() {
-    if exists(this.getHead()) then result = "#pragma " + this.getHead() else result = "#pragma"
-  }
-}
-
-/**
- * A C/C++ preprocessor `#line` directive. For example:
- * ```
- * #line 1 "source.c"
- * ```
- */
-class PreprocessorLine extends PreprocessorDirective, @ppd_line {
-  override string toString() { result = "#line " + this.getHead() }
-}

cpp/ql/lib/semmle/code/cpp/PrintAST.qll

@@ -1,884 +0,0 @@
-/**
- * Provides queries to pretty-print a C++ AST as a graph.
- *
- * By default, this will print the AST for all functions in the database. To change this behavior,
- * extend `PrintASTConfiguration` and override `shouldPrintFunction` to hold for only the functions
- * you wish to view the AST for.
- */
-
-import cpp
-private import semmle.code.cpp.Print
-
-private newtype TPrintASTConfiguration = MkPrintASTConfiguration()
-
-/**
- * The query can extend this class to control which functions are printed.
- */
-class PrintASTConfiguration extends TPrintASTConfiguration {
-  /**
-   * Gets a textual representation of this `PrintASTConfiguration`.
-   */
-  string toString() { result = "PrintASTConfiguration" }
-
-  /**
-   * Holds if the AST for `func` should be printed. By default, holds for all
-   * functions.
-   */
-  predicate shouldPrintFunction(Function func) { any() }
-}
-
-private predicate shouldPrintFunction(Function func) {
-  exists(PrintASTConfiguration config | config.shouldPrintFunction(func))
-}
-
-bindingset[s]
-private string escapeString(string s) {
-  result =
-    s.replaceAll("\\", "\\\\")
-        .replaceAll("\n", "\\n")
-        .replaceAll("\r", "\\r")
-        .replaceAll("\t", "\\t")
-}
-
-/**
- * Due to extractor issues with ODR violations, a given AST may wind up with
- * multiple locations. This predicate returns a single location - the one whose
- * string representation comes first in lexicographical order.
- */
-private Location getRepresentativeLocation(Locatable ast) {
-  result = min(Location loc | loc = ast.getLocation() | loc order by loc.toString())
-}
-
-/**
- * Computes the sort keys to sort the given AST node by location. An AST without
- * a location gets an empty file name and a zero line and column number.
- */
-private predicate locationSortKeys(Locatable ast, string file, int line, int column) {
-  if exists(getRepresentativeLocation(ast))
-  then
-    exists(Location loc |
-      loc = getRepresentativeLocation(ast) and
-      file = loc.getFile().toString() and
-      line = loc.getStartLine() and
-      column = loc.getStartColumn()
-    )
-  else (
-    file = "" and
-    line = 0 and
-    column = 0
-  )
-}
-
-private Function getEnclosingFunction(Locatable ast) {
-  result = ast.(Expr).getEnclosingFunction()
-  or
-  result = ast.(Stmt).getEnclosingFunction()
-  or
-  result = ast.(Initializer).getExpr().getEnclosingFunction()
-  or
-  result = ast.(Parameter).getFunction()
-  or
-  result = ast
-}
-
-/**
- * Most nodes are just a wrapper around `Locatable`, but we do synthesize new
- * nodes for things like parameter lists and constructor init lists.
- */
-private newtype TPrintASTNode =
-  TASTNode(Locatable ast) { shouldPrintFunction(getEnclosingFunction(ast)) } or
-  TDeclarationEntryNode(DeclStmt stmt, DeclarationEntry entry) {
-    // We create a unique node for each pair of (stmt, entry), to avoid having one node with
-    // multiple parents due to extractor bug CPP-413.
-    stmt.getADeclarationEntry() = entry and
-    shouldPrintFunction(stmt.getEnclosingFunction())
-  } or
-  TParametersNode(Function func) { shouldPrintFunction(func) } or
-  TConstructorInitializersNode(Constructor ctor) {
-    ctor.hasEntryPoint() and
-    shouldPrintFunction(ctor)
-  } or
-  TDestructorDestructionsNode(Destructor dtor) {
-    dtor.hasEntryPoint() and
-    shouldPrintFunction(dtor)
-  }
-
-/**
- * A node in the output tree.
- */
-class PrintASTNode extends TPrintASTNode {
-  /**
-   * Gets a textual representation of this node in the PrintAST output tree.
-   */
-  abstract string toString();
-
-  /**
-   * Gets the child node at index `childIndex`. Child indices must be unique,
-   * but need not be contiguous.
-   */
-  abstract PrintASTNode getChildInternal(int childIndex);
-
-  /**
-   * Gets the child node at index `childIndex`.
-   * Adds edges to fully converted expressions, that are not part of the
-   * regular parent/child relation traversal.
-   */
-  final PrintASTNode getChild(int childIndex) {
-    // The exact value of `childIndex` doesn't matter, as long as we preserve the correct order.
-    result =
-      rank[childIndex](PrintASTNode child, int nonConvertedIndex, boolean isConverted |
-        childAndAccessorPredicate(child, _, nonConvertedIndex, isConverted)
-      |
-        // Unconverted children come first, then sort by original child index within each group.
-        child order by isConverted, nonConvertedIndex
-      )
-  }
-
-  /**
-   * Gets the node for the `.getFullyConverted()` version of the child originally at index
-   * `childIndex`, if that node has any conversions.
-   */
-  private PrintASTNode getConvertedChild(int childIndex) {
-    exists(Expr expr |
-      expr = getChildInternal(childIndex).(ASTNode).getAST() and
-      expr.getFullyConverted() instanceof Conversion and
-      result.(ASTNode).getAST() = expr.getFullyConverted() and
-      not expr instanceof Conversion
-    )
-  }
-
-  /**
-   * Gets the child access predicate for the `.getFullyConverted()` version of the child originally
-   * at index `childIndex`, if that node has any conversions.
-   */
-  private string getConvertedChildAccessorPredicate(int childIndex) {
-    exists(getConvertedChild(childIndex)) and
-    result = getChildAccessorPredicateInternal(childIndex) + ".getFullyConverted()"
-  }
-
-  /**
-   * Holds if this node should be printed in the output. By default, all nodes
-   * within a function are printed, but the query can override
-   * `PrintASTConfiguration.shouldPrintFunction` to filter the output.
-   */
-  final predicate shouldPrint() { shouldPrintFunction(getEnclosingFunction()) }
-
-  /**
-   * Gets the children of this node.
-   */
-  final PrintASTNode getAChild() { result = getChild(_) }
-
-  /**
-   * Gets the parent of this node, if any.
-   */
-  final PrintASTNode getParent() { result.getAChild() = this }
-
-  /**
-   * Gets the location of this node in the source code.
-   */
-  abstract Location getLocation();
-
-  /**
-   * Gets the value of the property of this node, where the name of the property
-   * is `key`.
-   */
-  string getProperty(string key) {
-    key = "semmle.label" and
-    result = toString()
-  }
-
-  /**
-   * Holds if there is a child node `child` for original child index `nonConvertedIndex` with
-   * predicate name `childPredicate`. If the original child at that index has any conversions, there
-   * will be two result tuples for this predicate: one with the original child and predicate, with
-   * `isConverted = false`, and the other with the `.getFullyConverted()` version of the child and
-   * predicate, with `isConverted = true`. For a child without any conversions, there will be only
-   * one result tuple, with `isConverted = false`.
-   */
-  private predicate childAndAccessorPredicate(
-    PrintASTNode child, string childPredicate, int nonConvertedIndex, boolean isConverted
-  ) {
-    child = getChildInternal(nonConvertedIndex) and
-    childPredicate = getChildAccessorPredicateInternal(nonConvertedIndex) and
-    isConverted = false
-    or
-    child = getConvertedChild(nonConvertedIndex) and
-    childPredicate = getConvertedChildAccessorPredicate(nonConvertedIndex) and
-    isConverted = true
-  }
-
-  /**
-   * Gets the QL predicate that can be used to access the child at `childIndex`.
-   * May not always return a QL predicate, see for example `FunctionNode`.
-   */
-  final string getChildAccessorPredicate(int childIndex) {
-    // The exact value of `childIndex` doesn't matter, as long as we preserve the correct order.
-    result =
-      rank[childIndex](string childPredicate, int nonConvertedIndex, boolean isConverted |
-        childAndAccessorPredicate(_, childPredicate, nonConvertedIndex, isConverted)
-      |
-        // Unconverted children come first, then sort by original child index within each group.
-        childPredicate order by isConverted, nonConvertedIndex
-      )
-  }
-
-  /**
-   * Gets the QL predicate that can be used to access the child at `childIndex`.
-   * INTERNAL DO NOT USE: Does not contain accessors for the synthesized nodes for conversions.
-   */
-  abstract string getChildAccessorPredicateInternal(int childIndex);
-
-  /**
-   * Gets the `Function` that contains this node.
-   */
-  private Function getEnclosingFunction() { result = getParent*().(FunctionNode).getFunction() }
-}
-
-/**
- * Class that restricts the elements that we compute `qlClass` for.
- */
-private class PrintableElement extends Element {
-  PrintableElement() {
-    exists(TASTNode(this))
-    or
-    exists(TDeclarationEntryNode(_, this))
-    or
-    this instanceof Type
-  }
-
-  pragma[noinline]
-  string getAPrimaryQlClass0() { result = getAPrimaryQlClass() }
-}
-
-/**
- * Retrieves the canonical QL class(es) for entity `el`
- */
-private string qlClass(PrintableElement el) {
-  result = "[" + concat(el.getAPrimaryQlClass0(), ",") + "] "
-  // Alternative implementation -- do not delete. It is useful for QL class discovery.
-  //result = "["+ concat(el.getAQlClass(), ",") + "] "
-}
-
-/**
- * A node representing an AST node.
- */
-abstract class BaseASTNode extends PrintASTNode {
-  Locatable ast;
-
-  override string toString() { result = qlClass(ast) + ast.toString() }
-
-  final override Location getLocation() { result = getRepresentativeLocation(ast) }
-
-  /**
-   * Gets the AST represented by this node.
-   */
-  final Locatable getAST() { result = ast }
-}
-
-/**
- * A node representing an AST node other than a `DeclarationEntry`.
- */
-abstract class ASTNode extends BaseASTNode, TASTNode {
-  ASTNode() { this = TASTNode(ast) }
-}
-
-/**
- * A node representing an `Expr`.
- */
-class ExprNode extends ASTNode {
-  Expr expr;
-
-  ExprNode() { expr = ast }
-
-  override ASTNode getChildInternal(int childIndex) { result.getAST() = expr.getChild(childIndex) }
-
-  override string getProperty(string key) {
-    result = super.getProperty(key)
-    or
-    key = "Value" and
-    result = qlClass(expr) + getValue()
-    or
-    key = "Type" and
-    result = qlClass(expr.getType()) + expr.getType().toString()
-    or
-    key = "ValueCategory" and
-    result = expr.getValueCategoryString()
-  }
-
-  override string getChildAccessorPredicateInternal(int childIndex) {
-    result = getChildAccessorWithoutConversions(ast, getChildInternal(childIndex).getAST())
-  }
-
-  /**
-   * Gets the value of this expression, if it is a constant.
-   */
-  string getValue() { result = expr.getValue() }
-}
-
-/**
- * A node representing a `StringLiteral`.
- */
-class StringLiteralNode extends ExprNode {
-  StringLiteralNode() { expr instanceof StringLiteral }
-
-  override string toString() { result = escapeString(expr.getValue()) }
-
-  override string getValue() { result = "\"" + escapeString(expr.getValue()) + "\"" }
-}
-
-/**
- * A node representing a `Conversion`.
- */
-class ConversionNode extends ExprNode {
-  Conversion conv;
-
-  ConversionNode() { conv = expr }
-
-  override ASTNode getChildInternal(int childIndex) {
-    childIndex = 0 and
-    result.getAST() = conv.getExpr() and
-    conv.getExpr() instanceof Conversion
-  }
-}
-
-/**
- * A node representing a `Cast`.
- */
-class CastNode extends ConversionNode {
-  Cast cast;
-
-  CastNode() { cast = conv }
-
-  override string getProperty(string key) {
-    result = super.getProperty(key)
-    or
-    key = "Conversion" and
-    result = "[" + qlConversion(cast) + "] " + cast.getSemanticConversionString()
-  }
-}
-
-/**
- * A node representing a `StmtExpr`.
- */
-class StmtExprNode extends ExprNode {
-  override StmtExpr expr;
-
-  override ASTNode getChildInternal(int childIndex) {
-    childIndex = 0 and
-    result.getAST() = expr.getStmt()
-  }
-}
-
-/**
- * A node representing a `DeclarationEntry`.
- */
-class DeclarationEntryNode extends BaseASTNode, TDeclarationEntryNode {
-  override DeclarationEntry ast;
-  DeclStmt declStmt;
-
-  DeclarationEntryNode() { this = TDeclarationEntryNode(declStmt, ast) }
-
-  override PrintASTNode getChildInternal(int childIndex) { none() }
-
-  override string getChildAccessorPredicateInternal(int childIndex) { none() }
-
-  override string getProperty(string key) {
-    result = BaseASTNode.super.getProperty(key)
-    or
-    key = "Type" and
-    result = qlClass(ast.getType()) + ast.getType().toString()
-  }
-}
-
-/**
- * A node representing a `VariableDeclarationEntry`.
- */
-class VariableDeclarationEntryNode extends DeclarationEntryNode {
-  override VariableDeclarationEntry ast;
-
-  override ASTNode getChildInternal(int childIndex) {
-    childIndex = 0 and
-    result.getAST() = ast.getVariable().getInitializer()
-  }
-
-  override string getChildAccessorPredicateInternal(int childIndex) {
-    childIndex = 0 and
-    result = "getVariable().getInitializer()"
-  }
-}
-
-/**
- * A node representing a `Stmt`.
- */
-class StmtNode extends ASTNode {
-  Stmt stmt;
-
-  StmtNode() { stmt = ast }
-
-  override BaseASTNode getChildInternal(int childIndex) {
-    exists(Locatable child |
-      child = stmt.getChild(childIndex) and
-      (
-        result.getAST() = child.(Expr) or
-        result.getAST() = child.(Stmt)
-      )
-    )
-  }
-
-  override string getChildAccessorPredicateInternal(int childIndex) {
-    result = getChildAccessorWithoutConversions(ast, getChildInternal(childIndex).getAST())
-  }
-}
-
-/**
- * A node representing a `DeclStmt`.
- */
-class DeclStmtNode extends StmtNode {
-  DeclStmt declStmt;
-
-  DeclStmtNode() { declStmt = stmt }
-
-  override DeclarationEntryNode getChildInternal(int childIndex) {
-    exists(DeclarationEntry entry |
-      declStmt.getDeclarationEntry(childIndex) = entry and
-      result = TDeclarationEntryNode(declStmt, entry)
-    )
-  }
-}
-
-/**
- * A node representing a `Parameter`.
- */
-class ParameterNode extends ASTNode {
-  Parameter param;
-
-  ParameterNode() { param = ast }
-
-  final override PrintASTNode getChildInternal(int childIndex) { none() }
-
-  final override string getChildAccessorPredicateInternal(int childIndex) { none() }
-
-  final override string getProperty(string key) {
-    result = super.getProperty(key)
-    or
-    key = "Type" and
-    result = qlClass(param.getType()) + param.getType().toString()
-  }
-}
-
-/**
- * A node representing an `Initializer`.
- */
-class InitializerNode extends ASTNode {
-  Initializer init;
-
-  InitializerNode() { init = ast }
-
-  override ASTNode getChildInternal(int childIndex) {
-    childIndex = 0 and
-    result.getAST() = init.getExpr()
-  }
-
-  override string getChildAccessorPredicateInternal(int childIndex) {
-    childIndex = 0 and
-    result = "getExpr()"
-  }
-}
-
-/**
- * A node representing the parameters of a `Function`.
- */
-class ParametersNode extends PrintASTNode, TParametersNode {
-  Function func;
-
-  ParametersNode() { this = TParametersNode(func) }
-
-  final override string toString() { result = "" }
-
-  final override Location getLocation() { result = getRepresentativeLocation(func) }
-
-  override ASTNode getChildInternal(int childIndex) {
-    result.getAST() = func.getParameter(childIndex)
-  }
-
-  override string getChildAccessorPredicateInternal(int childIndex) {
-    exists(getChildInternal(childIndex)) and
-    result = "getParameter(" + childIndex.toString() + ")"
-  }
-
-  /**
-   * Gets the `Function` for which this node represents the parameters.
-   */
-  final Function getFunction() { result = func }
-}
-
-/**
- * A node representing the initializer list of a `Constructor`.
- */
-class ConstructorInitializersNode extends PrintASTNode, TConstructorInitializersNode {
-  Constructor ctor;
-
-  ConstructorInitializersNode() { this = TConstructorInitializersNode(ctor) }
-
-  final override string toString() { result = "" }
-
-  final override Location getLocation() { result = getRepresentativeLocation(ctor) }
-
-  final override ASTNode getChildInternal(int childIndex) {
-    result.getAST() = ctor.getInitializer(childIndex)
-  }
-
-  final override string getChildAccessorPredicateInternal(int childIndex) {
-    exists(getChildInternal(childIndex)) and
-    result = "getInitializer(" + childIndex.toString() + ")"
-  }
-
-  /**
-   * Gets the `Constructor` for which this node represents the initializer list.
-   */
-  final Constructor getConstructor() { result = ctor }
-}
-
-/**
- * A node representing the destruction list of a `Destructor`.
- */
-class DestructorDestructionsNode extends PrintASTNode, TDestructorDestructionsNode {
-  Destructor dtor;
-
-  DestructorDestructionsNode() { this = TDestructorDestructionsNode(dtor) }
-
-  final override string toString() { result = "" }
-
-  final override Location getLocation() { result = getRepresentativeLocation(dtor) }
-
-  final override ASTNode getChildInternal(int childIndex) {
-    result.getAST() = dtor.getDestruction(childIndex)
-  }
-
-  final override string getChildAccessorPredicateInternal(int childIndex) {
-    exists(getChildInternal(childIndex)) and
-    result = "getDestruction(" + childIndex.toString() + ")"
-  }
-
-  /**
-   * Gets the `Destructor` for which this node represents the destruction list.
-   */
-  final Destructor getDestructor() { result = dtor }
-}
-
-/**
- * A node representing a `Function`.
- */
-class FunctionNode extends ASTNode {
-  Function func;
-
-  FunctionNode() { func = ast }
-
-  override string toString() { result = qlClass(func) + getIdentityString(func) }
-
-  override PrintASTNode getChildInternal(int childIndex) {
-    childIndex = 0 and
-    result.(ParametersNode).getFunction() = func
-    or
-    childIndex = 1 and
-    result.(ConstructorInitializersNode).getConstructor() = func
-    or
-    childIndex = 2 and
-    result.(ASTNode).getAST() = func.getEntryPoint()
-    or
-    childIndex = 3 and
-    result.(DestructorDestructionsNode).getDestructor() = func
-  }
-
-  override string getChildAccessorPredicateInternal(int childIndex) {
-    childIndex = 0 and result = "<params>"
-    or
-    childIndex = 1 and result = "<initializations>"
-    or
-    childIndex = 2 and result = "getEntryPoint()"
-    or
-    childIndex = 3 and result = "<destructions>"
-  }
-
-  private int getOrder() {
-    this =
-      rank[result](FunctionNode node, Function function, string file, int line, int column |
-        node.getAST() = function and
-        locationSortKeys(function, file, line, column)
-      |
-        node order by file, line, column, getIdentityString(function)
-      )
-  }
-
-  override string getProperty(string key) {
-    result = super.getProperty(key)
-    or
-    key = "semmle.order" and result = getOrder().toString()
-  }
-
-  /**
-   * Gets the `Function` this node represents.
-   */
-  final Function getFunction() { result = func }
-}
-
-private string getChildAccessorWithoutConversions(Locatable parent, Element child) {
-  shouldPrintFunction(getEnclosingFunction(parent)) and
-  (
-    exists(Stmt s | s = parent |
-      namedStmtChildPredicates(s, child, result)
-      or
-      not namedStmtChildPredicates(s, child, _) and
-      exists(int n | s.getChild(n) = child and result = "getChild(" + n + ")")
-    )
-    or
-    exists(Expr expr | expr = parent |
-      namedExprChildPredicates(expr, child, result)
-      or
-      not namedExprChildPredicates(expr, child, _) and
-      exists(int n | expr.getChild(n) = child and result = "getChild(" + n + ")")
-    )
-  )
-}
-
-private predicate namedStmtChildPredicates(Locatable s, Element e, string pred) {
-  shouldPrintFunction(getEnclosingFunction(s)) and
-  (
-    exists(int n | s.(BlockStmt).getStmt(n) = e and pred = "getStmt(" + n + ")")
-    or
-    s.(ComputedGotoStmt).getExpr() = e and pred = "getExpr()"
-    or
-    s.(ConstexprIfStmt).getCondition() = e and pred = "getCondition()"
-    or
-    s.(ConstexprIfStmt).getThen() = e and pred = "getThen()"
-    or
-    s.(ConstexprIfStmt).getElse() = e and pred = "getElse()"
-    or
-    s.(IfStmt).getCondition() = e and pred = "getCondition()"
-    or
-    s.(IfStmt).getThen() = e and pred = "getThen()"
-    or
-    s.(IfStmt).getElse() = e and pred = "getElse()"
-    or
-    s.(SwitchStmt).getExpr() = e and pred = "getExpr()"
-    or
-    s.(SwitchStmt).getStmt() = e and pred = "getStmt()"
-    or
-    s.(DoStmt).getCondition() = e and pred = "getCondition()"
-    or
-    s.(DoStmt).getStmt() = e and pred = "getStmt()"
-    or
-    s.(ForStmt).getInitialization() = e and pred = "getInitialization()"
-    or
-    s.(ForStmt).getCondition() = e and pred = "getCondition()"
-    or
-    s.(ForStmt).getUpdate() = e and pred = "getUpdate()"
-    or
-    s.(ForStmt).getStmt() = e and pred = "getStmt()"
-    or
-    s.(RangeBasedForStmt).getChild(0) = e and pred = "getChild(0)"
-    or
-    s.(RangeBasedForStmt).getBeginEndDeclaration() = e and pred = "getBeginEndDeclaration()"
-    or
-    s.(RangeBasedForStmt).getCondition() = e and pred = "getCondition()"
-    or
-    s.(RangeBasedForStmt).getUpdate() = e and pred = "getUpdate()"
-    or
-    s.(RangeBasedForStmt).getChild(4) = e and pred = "getChild(4)"
-    or
-    s.(RangeBasedForStmt).getStmt() = e and pred = "getStmt()"
-    or
-    s.(WhileStmt).getCondition() = e and pred = "getCondition()"
-    or
-    s.(WhileStmt).getStmt() = e and pred = "getStmt()"
-    or
-    exists(int n |
-      s.(DeclStmt).getDeclarationEntry(n) = e and pred = "getDeclarationEntry(" + n.toString() + ")"
-    )
-    or
-    // EmptyStmt does not have children
-    s.(ExprStmt).getExpr() = e and pred = "getExpr()"
-    or
-    s.(Handler).getBlock() = e and pred = "getBlock()"
-    or
-    s.(JumpStmt).getTarget() = e and pred = "getTarget()"
-    or
-    s.(MicrosoftTryStmt).getStmt() = e and pred = "getStmt()"
-    or
-    s.(MicrosoftTryExceptStmt).getCondition() = e and pred = "getCondition()"
-    or
-    s.(MicrosoftTryExceptStmt).getExcept() = e and pred = "getExcept()"
-    or
-    s.(MicrosoftTryFinallyStmt).getFinally() = e and pred = "getFinally()"
-    or
-    s.(ReturnStmt).getExpr() = e and pred = "getExpr()"
-    or
-    s.(SwitchCase).getExpr() = e and pred = "getExpr()"
-    or
-    s.(SwitchCase).getEndExpr() = e and pred = "getEndExpr()"
-    or
-    s.(TryStmt).getStmt() = e and pred = "getStmt()"
-    or
-    s.(VlaDimensionStmt).getDimensionExpr() = e and pred = "getDimensionExpr()"
-  )
-}
-
-private predicate namedExprChildPredicates(Expr expr, Element ele, string pred) {
-  shouldPrintFunction(expr.getEnclosingFunction()) and
-  (
-    expr.(Access).getTarget() = ele and pred = "getTarget()"
-    or
-    expr.(VariableAccess).getQualifier() = ele and pred = "getQualifier()"
-    or
-    exists(Field f |
-      expr.(ClassAggregateLiteral).getFieldExpr(f) = ele and
-      pred = "getFieldExpr(" + f.toString() + ")"
-    )
-    or
-    exists(int n |
-      expr.(ArrayOrVectorAggregateLiteral).getElementExpr(n) = ele and
-      pred = "getElementExpr(" + n.toString() + ")"
-    )
-    or
-    expr.(AlignofExprOperator).getExprOperand() = ele and pred = "getExprOperand()"
-    or
-    expr.(ArrayExpr).getArrayBase() = ele and pred = "getArrayBase()"
-    or
-    expr.(ArrayExpr).getArrayOffset() = ele and pred = "getArrayOffset()"
-    or
-    expr.(AssumeExpr).getOperand() = ele and pred = "getOperand()"
-    or
-    expr.(BuiltInComplexOperation).getRealOperand() = ele and pred = "getRealOperand()"
-    or
-    expr.(BuiltInComplexOperation).getImaginaryOperand() = ele and pred = "getImaginaryOperand()"
-    or
-    expr.(BuiltInVarArg).getVAList() = ele and pred = "getVAList()"
-    or
-    expr.(BuiltInVarArgCopy).getDestinationVAList() = ele and pred = "getDestinationVAList()"
-    or
-    expr.(BuiltInVarArgCopy).getSourceVAList() = ele and pred = "getSourceVAList()"
-    or
-    expr.(BuiltInVarArgsEnd).getVAList() = ele and pred = "getVAList()"
-    or
-    expr.(BuiltInVarArgsStart).getVAList() = ele and pred = "getVAList()"
-    or
-    expr.(BuiltInVarArgsStart).getLastNamedParameter() = ele and pred = "getLastNamedParameter()"
-    or
-    expr.(Call).getQualifier() = ele and pred = "getQualifier()"
-    or
-    exists(int n | expr.(Call).getArgument(n) = ele and pred = "getArgument(" + n.toString() + ")")
-    or
-    expr.(ExprCall).getExpr() = ele and pred = "getExpr()"
-    or
-    expr.(OverloadedArrayExpr).getArrayBase() = ele and pred = "getArrayBase()"
-    or
-    expr.(OverloadedArrayExpr).getArrayOffset() = ele and pred = "getArrayOffset()"
-    or
-    expr.(OverloadedPointerDereferenceExpr).getExpr() = ele and pred = "getExpr()"
-    or
-    expr.(CommaExpr).getLeftOperand() = ele and pred = "getLeftOperand()"
-    or
-    expr.(CommaExpr).getRightOperand() = ele and pred = "getRightOperand()"
-    or
-    expr.(ConditionDeclExpr).getVariableAccess() = ele and pred = "getVariableAccess()"
-    or
-    expr.(ConstructorFieldInit).getExpr() = ele and pred = "getExpr()"
-    or
-    expr.(Conversion).getExpr() = ele and pred = "getExpr()"
-    or
-    expr.(DeleteArrayExpr).getAllocatorCall() = ele and pred = "getAllocatorCall()"
-    or
-    expr.(DeleteArrayExpr).getDestructorCall() = ele and pred = "getDestructorCall()"
-    or
-    expr.(DeleteArrayExpr).getExpr() = ele and pred = "getExpr()"
-    or
-    expr.(DeleteExpr).getAllocatorCall() = ele and pred = "getAllocatorCall()"
-    or
-    expr.(DeleteExpr).getDestructorCall() = ele and pred = "getDestructorCall()"
-    or
-    expr.(DeleteExpr).getExpr() = ele and pred = "getExpr()"
-    or
-    expr.(DestructorFieldDestruction).getExpr() = ele and pred = "getExpr()"
-    or
-    expr.(FoldExpr).getInitExpr() = ele and pred = "getInitExpr()"
-    or
-    expr.(FoldExpr).getPackExpr() = ele and pred = "getPackExpr()"
-    or
-    expr.(LambdaExpression).getInitializer() = ele and pred = "getInitializer()"
-    or
-    expr.(NewOrNewArrayExpr).getAllocatorCall() = ele and pred = "getAllocatorCall()"
-    or
-    expr.(NewOrNewArrayExpr).getAlignmentArgument() = ele and pred = "getAlignmentArgument()"
-    or
-    expr.(NewArrayExpr).getInitializer() = ele and pred = "getInitializer()"
-    or
-    expr.(NewArrayExpr).getExtent() = ele and pred = "getExtent()"
-    or
-    expr.(NewExpr).getInitializer() = ele and pred = "getInitializer()"
-    or
-    expr.(NoExceptExpr).getExpr() = ele and pred = "getExpr()"
-    or
-    expr.(Assignment).getLValue() = ele and pred = "getLValue()"
-    or
-    expr.(Assignment).getRValue() = ele and pred = "getRValue()"
-    or
-    not expr instanceof RelationalOperation and
-    expr.(BinaryOperation).getLeftOperand() = ele and
-    pred = "getLeftOperand()"
-    or
-    not expr instanceof RelationalOperation and
-    expr.(BinaryOperation).getRightOperand() = ele and
-    pred = "getRightOperand()"
-    or
-    expr.(RelationalOperation).getGreaterOperand() = ele and pred = "getGreaterOperand()"
-    or
-    expr.(RelationalOperation).getLesserOperand() = ele and pred = "getLesserOperand()"
-    or
-    expr.(ConditionalExpr).getCondition() = ele and pred = "getCondition()"
-    or
-    // If ConditionalExpr is in two-operand form, getThen() = getCondition() holds
-    not expr.(ConditionalExpr).isTwoOperand() and
-    expr.(ConditionalExpr).getThen() = ele and
-    pred = "getThen()"
-    or
-    expr.(ConditionalExpr).getElse() = ele and pred = "getElse()"
-    or
-    expr.(UnaryOperation).getOperand() = ele and pred = "getOperand()"
-    or
-    expr.(SizeofExprOperator).getExprOperand() = ele and pred = "getExprOperand()"
-    or
-    expr.(StmtExpr).getStmt() = ele and pred = "getStmt()"
-    or
-    expr.(ThrowExpr).getExpr() = ele and pred = "getExpr()"
-    or
-    expr.(TypeidOperator).getExpr() = ele and pred = "getExpr()"
-  )
-}
-
-/** Holds if `node` belongs to the output tree, and its property `key` has the given `value`. */
-query predicate nodes(PrintASTNode node, string key, string value) {
-  node.shouldPrint() and
-  value = node.getProperty(key)
-}
-
-/**
- * Holds if `target` is a child of `source` in the AST, and property `key` of the edge has the
- * given `value`.
- */
-query predicate edges(PrintASTNode source, PrintASTNode target, string key, string value) {
-  exists(int childIndex |
-    source.shouldPrint() and
-    target.shouldPrint() and
-    target = source.getChild(childIndex) and
-    (
-      key = "semmle.label" and value = source.getChildAccessorPredicate(childIndex)
-      or
-      key = "semmle.order" and value = childIndex.toString()
-    )
-  )
-}
-
-/** Holds if property `key` of the graph has the given `value`. */
-query predicate graphProperties(string key, string value) {
-  key = "semmle.graphKind" and value = "tree"
-}