Ruby: update crate versions

.codeqlmanifest.json

@@ -4,10 +4,8 @@
         "*/ql/lib/qlpack.yml",
         "*/ql/test/qlpack.yml",
         "*/ql/examples/qlpack.yml",
-        "*/ql/consistency-queries/qlpack.yml",
         "cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/qlpack.yml",
         "javascript/ql/experimental/adaptivethreatmodeling/lib/qlpack.yml",
-        "javascript/ql/experimental/adaptivethreatmodeling/modelbuilding/qlpack.yml",
         "javascript/ql/experimental/adaptivethreatmodeling/src/qlpack.yml",
         "csharp/ql/campaigns/Solorigate/lib/qlpack.yml",
         "csharp/ql/campaigns/Solorigate/src/qlpack.yml",
@@ -15,6 +13,8 @@
         "misc/legacy-support/*/qlpack.yml",
         "misc/suite-helpers/qlpack.yml",
         "ruby/extractor-pack/codeql-extractor.yml",
+        "ruby/ql/consistency-queries/qlpack.yml",
+        "ql/ql/consistency-queries/qlpack.yml",
         "ql/extractor-pack/codeql-extractor.yml"
     ],
     "versionPolicies": {

.gitattributes

@@ -50,15 +50,4 @@
 *.pdb -text
 
 java/ql/test/stubs/**/*.java linguist-generated=true
-java/ql/test/experimental/stubs/**/*.java linguist-generated=true
-
-# For some languages, upgrade script testing references really old dbscheme
-# files from legacy upgrades that have CRLF line endings. Since upgrade
-# resolution relies on object hashes, we must suppress line ending conversion
-# for those testing dbscheme files.
-*/ql/lib/upgrades/initial/*.dbscheme -text
-
-# Generated test files - these are synced from the standard JavaScript libraries using
-# `javascript/ql/experimental/adaptivethreatmodeling/test/update_endpoint_test_files.py`.
-javascript/ql/experimental/adaptivethreatmodeling/test/endpoint_large_scale/autogenerated/**/*.js linguist-generated=true -merge
-javascript/ql/experimental/adaptivethreatmodeling/test/endpoint_large_scale/autogenerated/**/*.ts linguist-generated=true -merge
+java/ql/test/experimental/stubs/**/*.java linguist-generated=true

.github/workflows/check-change-note.yml

@@ -6,11 +6,8 @@ on:
     paths:
       - "*/ql/src/**/*.ql"
       - "*/ql/src/**/*.qll"
-      - "*/ql/lib/**/*.ql"
-      - "*/ql/lib/**/*.qll"
       - "!**/experimental/**"
       - "!ql/**"
-      - ".github/workflows/check-change-note.yml"
 
 jobs:
   check-change-note:

.github/workflows/codeql-analysis.yml

@@ -27,11 +27,6 @@ jobs:
       pull-requests: read
 
     steps:
-    - name: Setup dotnet
-      uses: actions/setup-dotnet@v1
-      with:
-        dotnet-version: 6.0.101
-
     - name: Checkout repository
       uses: actions/checkout@v2
 
@@ -56,7 +51,7 @@ jobs:
     #    uses a compiled language
 
     - run: |
-       dotnet build csharp /p:UseSharedCompilation=false
+       dotnet build csharp
 
     - name: Perform CodeQL Analysis
       uses: github/codeql-action/analyze@main

.github/workflows/csv-coverage-metrics.yml

@@ -1,43 +0,0 @@
-name: "Publish framework coverage as metrics"
-
-on:
-  schedule:
-    - cron: '5 0 * * *'
-  push:
-    branches:
-      - main
-  workflow_dispatch:
-  pull_request:
-    branches:
-      - main
-    paths:
-      - ".github/workflows/csv-coverage-metrics.yml"
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v2
-      - name: Setup CodeQL
-        uses: ./.github/actions/fetch-codeql
-      - name: Create empty database
-        run: |
-          DATABASE="${{ runner.temp }}/java-database"
-          PROJECT="${{ runner.temp }}/java-project"
-          mkdir -p "$PROJECT/src/tmp/empty"
-          echo "class Empty {}" >> "$PROJECT/src/tmp/empty/Empty.java"
-          codeql database create "$DATABASE" --language=java --source-root="$PROJECT" --command 'javac src/tmp/empty/Empty.java'
-      - name: Capture coverage information
-        run: |
-          DATABASE="${{ runner.temp }}/java-database"
-          codeql database analyze --format=sarif-latest --output=metrics.sarif -- "$DATABASE" ./java/ql/src/Metrics/Summaries/FrameworkCoverage.ql
-      - uses: actions/upload-artifact@v2
-        with:
-          name: metrics.sarif
-          path: metrics.sarif
-          retention-days: 20
-      - name: Upload SARIF file
-        uses: github/codeql-action/upload-sarif@v1
-        with:
-          sarif_file: metrics.sarif

.github/workflows/js-ml-tests.yml

@@ -1,76 +0,0 @@
-name: JS ML-powered queries tests
-
-on:
-  push:
-    paths:
-      - "javascript/ql/experimental/adaptivethreatmodeling/**"
-      - .github/workflows/js-ml-tests.yml
-    branches:
-      - main
-      - "rc/*"
-  pull_request:
-    paths:
-      - "javascript/ql/experimental/adaptivethreatmodeling/**"
-      - .github/workflows/js-ml-tests.yml
-
-defaults:
-  run:
-    working-directory: javascript/ql/experimental/adaptivethreatmodeling
-
-jobs:
-  qlformat:
-    name: Check QL formatting
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-
-      - uses: ./.github/actions/fetch-codeql
-
-      - name: Check QL formatting
-        run: |
-          find . "(" -name "*.ql" -or -name "*.qll" ")" -print0 | \
-            xargs -0 codeql query format --check-only
-
-  qlcompile:
-    name: Check QL compilation
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-
-      - uses: ./.github/actions/fetch-codeql
-
-      - name: Install pack dependencies
-        run: |
-          for pack in modelbuilding src; do
-            codeql pack install --mode verify -- "${pack}"
-          done
-
-      - name: Check QL compilation
-        run: |
-          codeql query compile \
-            --check-only \
-            --ram 5120 \
-            --additional-packs "${{ github.workspace }}" \
-            --threads=0 \
-            -- \
-            lib modelbuilding src
-
-  qltest:
-    name: Run QL tests
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-
-      - uses: ./.github/actions/fetch-codeql
-
-      - name: Install pack dependencies
-        run: codeql pack install -- test
-
-      - name: Run QL tests
-        run: |
-          codeql test run \
-            --threads=0 \
-            --ram 5120 \
-            --additional-packs "${{ github.workspace }}" \
-            -- \
-            test

.github/workflows/mad_modelDiff.yml

@@ -1,103 +0,0 @@
-name: Models as Data - Diff
-
-on:
-  workflow_dispatch:
-    inputs:
-      projects:
-        description: "The projects to generate models for"
-        required: true
-        default: '["netty/netty"]'
-  pull_request:
-    branches:
-      - main
-    paths:
-      - "java/ql/src/utils/model-generator/**/*.*"
-      - ".github/workflows/mad_modelDiff.yml"
-
-permissions:
-  contents: read
-
-jobs:
-  model-diff:
-    name: Model Difference
-    runs-on: ubuntu-latest
-    if: github.repository == 'github/codeql'
-    strategy:
-      matrix:
-        slug: ${{fromJson(github.event.inputs.projects || '["apache/commons-codec", "apache/commons-io", "apache/commons-beanutils", "apache/commons-logging", "apache/commons-fileupload", "apache/commons-lang", "apache/commons-validator", "apache/commons-csv", "apache/dubbo"]' )}}
-    steps:
-      - name: Clone github/codeql from PR
-        uses: actions/checkout@v2
-        if: github.event.pull_request
-        with:
-          path: codeql-pr
-      - name: Clone github/codeql from main
-        uses: actions/checkout@v2
-        with:
-          path: codeql-main
-          ref: main
-      - uses: ./codeql-main/.github/actions/fetch-codeql
-      - name: Download database
-        env:
-          SLUG: ${{ matrix.slug }}
-        run: |
-          set -x
-          mkdir lib-dbs
-          SHORTNAME=${SLUG//[^a-zA-Z0-9_]/}
-          projectId=`curl -s https://lgtm.com/api/v1.0/projects/g/${SLUG} | jq .id`
-          curl -L "https://lgtm.com/api/v1.0/snapshots/$projectId/java" -o "$SHORTNAME.zip"
-          unzip -q -d "${SHORTNAME}-db" "${SHORTNAME}.zip"
-          mkdir "lib-dbs/$SHORTNAME/"
-          mv "${SHORTNAME}-db/"$(ls -1 "${SHORTNAME}"-db)/* "lib-dbs/${SHORTNAME}/"
-      - name: Generate Models (PR and main)
-        run: |
-          set -x
-          mkdir tmp-models
-          MODELS=`pwd`/tmp-models
-          DATABASES=`pwd`/lib-dbs
-
-          analyzeDatabaseWithCheckout() {
-            QL_VARIANT=$1
-            DATABASE=$2
-            cd codeql-$QL_VARIANT
-            SHORTNAME=`basename $DATABASE`
-            python java/ql/src/utils/model-generator/GenerateFlowModel.py $DATABASE $MODELS/${SHORTNAME}.qll
-            mv $MODELS/${SHORTNAME}.qll $MODELS/${SHORTNAME}Generated_${QL_VARIANT}.qll
-            cd ..
-          }
-
-          for d in $DATABASES/*/ ; do
-            ls -1 "$d"
-
-            analyzeDatabaseWithCheckout "main" $d
-            if [[ "$GITHUB_EVENT_NAME" == "pull_request" ]]
-            then
-              analyzeDatabaseWithCheckout "pr" $d
-            fi
-          done
-      - name: Install diff2html
-        if: github.event.pull_request
-        run: |
-          npm install -g diff2html-cli
-      - name: Generate Model Diff
-        if: github.event.pull_request
-        run: |
-          set -x
-          MODELS=`pwd`/tmp-models
-          ls -1 tmp-models/
-          for m in $MODELS/*_main.qll ; do
-            t="${m/main/"pr"}"
-            basename=`basename $m`
-            name="diff_${basename/_main.qll/""}"
-            (diff -w -u $m $t | diff2html -i stdin -F $MODELS/$name.html) || true
-          done
-      - uses: actions/upload-artifact@v2
-        with:
-          name: models
-          path: tmp-models/*.qll
-          retention-days: 20
-      - uses: actions/upload-artifact@v2
-        with:
-          name: diffs
-          path: tmp-models/*.html
-          retention-days: 20

.github/workflows/mad_regenerate-models.yml

@@ -1,62 +0,0 @@
-name: Regenerate framework models
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: "30 2 * * *"
-  pull_request:
-    branches:
-      - main
-    paths:
-      - ".github/workflows/mad_regenerate-models.yml"
-
-jobs:
-  regenerate-models:
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        # placeholder required for each axis, excluded below, replaced by the actual combinations (see include)
-        slug: ["placeholder"]
-        ref: ["placeholder"]
-        include:
-          - slug: "apache/commons-io"
-            ref: "8985de8fe74f6622a419b37a6eed0dbc484dc128"
-        exclude:
-          - slug: "placeholder"
-            ref: "placeholder"
-    steps:
-      - name: Clone self (github/codeql)
-        uses: actions/checkout@v2
-      - name: Setup CodeQL binaries
-        uses: ./.github/actions/fetch-codeql
-      - name: Clone repositories
-        uses: actions/checkout@v2
-        with:
-          path: repos/${{ matrix.ref }}
-          ref: ${{ matrix.ref }}
-          repository: ${{ matrix.slug }}
-      - name: Build database
-        env:
-          SLUG: ${{ matrix.slug }}
-          REF: ${{ matrix.ref }}
-        run: |
-          mkdir dbs
-          cd repos/${REF}
-          SHORTNAME=${SLUG//[^a-zA-Z0-9_]/}
-          codeql database create --language=java ../../dbs/${SHORTNAME}
-      - name: Regenerate models in-place
-        env:
-          SLUG: ${{ matrix.slug }}
-        run: |
-          SHORTNAME=${SLUG//[^a-zA-Z0-9_]/}
-          java/ql/src/utils/model-generator/RegenerateModels.py "${SLUG}" dbs/${SHORTNAME}
-      - name: Stage changes
-        run: |
-          find java -name "*.qll" -print0 | xargs -0 git add
-          git status
-          git diff --cached > models.patch
-      - uses: actions/upload-artifact@v2
-        with:
-          name: patch
-          path: models.patch
-          retention-days: 7

.github/workflows/ql-for-ql-build.yml

@@ -31,13 +31,13 @@ jobs:
         uses: actions/cache@v2
         with:
           path: ${{ runner.temp }}/query-pack.zip
-          key: queries-${{ hashFiles('ql/**/*.ql*') }}-${{ hashFiles('ql/**/qlpack.yml') }}-${{ hashFiles('ql/ql/src/ql.dbscheme*') }}-${{ steps.get-codeql-version.outputs.version }}
+          key: queries-${{ hashFiles('ql/**/*.ql*') }}-${{ hashFiles('ql/ql/src/ql.dbscheme*') }}-${{ steps.get-codeql-version.outputs.version }}
       - name: Build query pack
         if: steps.cache-queries.outputs.cache-hit != 'true'
         run: |
           cd ql/ql/src
           "${CODEQL}" pack create
-          cd .codeql/pack/codeql/ql/0.0.0
+          cd .codeql/pack/codeql/ql-all/0.0.0
           zip "${PACKZIP}" -r .
         env:
           CODEQL: ${{ steps.find-codeql.outputs.codeql-path }}
@@ -189,11 +189,4 @@ jobs:
         uses: github/codeql-action/analyze@erik-krogh/ql
         with: 
           category: "ql-for-ql-${{ matrix.folder }}"
-      - name: Copy sarif file to CWD
-        run: cp ../results/ql.sarif ./${{ matrix.folder }}.sarif
-      - name: Sarif as artifact
-        uses: actions/upload-artifact@v2
-        with:
-          name: ${{ matrix.folder }}.sarif
-          path: ${{ matrix.folder }}.sarif
 

.github/workflows/ql-for-ql-dataset_measure.yml

@@ -17,7 +17,7 @@ jobs:
       CODEQL_THREADS: 4 # TODO: remove this once it's set by the CLI
     strategy:
       matrix:
-        repo:
+        repo: 
           - github/codeql
           - github/codeql-go
     runs-on: ubuntu-latest
@@ -35,7 +35,7 @@ jobs:
             ~/.cargo/registry
             ~/.cargo/git
             ql/target
-          key: ${{ runner.os }}-qltest-cargo-${{ hashFiles('ql/**/Cargo.lock') }}
+          key: ${{ runner.os }}-qltest-cargo-${{ hashFiles('**/Cargo.lock') }}
       - name: Build Extractor
         run: cd ql; env "PATH=$PATH:`dirname ${CODEQL}`" ./create-extractor-pack.sh
         env:

.github/workflows/ql-for-ql-tests.yml

@@ -29,24 +29,24 @@ jobs:
             ~/.cargo/registry
             ~/.cargo/git
             ql/target
-          key: ${{ runner.os }}-qltest-cargo-${{ hashFiles('ql/**/Cargo.lock') }}
+          key: ${{ runner.os }}-qltest-cargo-${{ hashFiles('**/Cargo.lock') }}
       - name: Build extractor
         run: |
           cd ql;
           codeqlpath=$(dirname ${{ steps.find-codeql.outputs.codeql-path }});
           env "PATH=$PATH:$codeqlpath" ./create-extractor-pack.sh
       - name: Run QL tests
-        run: |
+        run: | 
           "${CODEQL}" test run --check-databases --check-unused-labels --check-repeated-labels --check-redefined-labels --check-use-before-definition --search-path "${{ github.workspace }}/ql/extractor-pack" --consistency-queries ql/ql/consistency-queries ql/ql/test
         env:
           CODEQL: ${{ steps.find-codeql.outputs.codeql-path }}
       - name: Check QL formatting
-        run: |
+        run: | 
           find ql/ql "(" -name "*.ql" -or -name "*.qll" ")" -print0 | xargs -0 "${CODEQL}" query format --check-only
         env:
           CODEQL: ${{ steps.find-codeql.outputs.codeql-path }}
       - name: Check QL compilation
-        run: |
+        run: | 
           "${CODEQL}" query compile --check-only --threads=4 --warnings=error --search-path "${{ github.workspace }}/ql/extractor-pack" "ql/ql/src" "ql/ql/examples"
         env:
           CODEQL: ${{ steps.find-codeql.outputs.codeql-path }}

.github/workflows/ruby-build.yml

@@ -50,7 +50,7 @@ jobs:
             ~/.cargo/registry
             ~/.cargo/git
             ruby/target
-          key: ${{ runner.os }}-ruby-rust-cargo-${{ hashFiles('ruby/rust-toolchain.toml', 'ruby/**/Cargo.lock') }}
+          key: ${{ runner.os }}-rust-cargo-${{ hashFiles('**/Cargo.lock') }}
       - name: Check formatting
         run: cargo fmt --all -- --check
       - name: Build

.github/workflows/ruby-qltest.yml

@@ -24,54 +24,27 @@ defaults:
     working-directory: ruby
 
 jobs:
-  qlformat:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-      - uses: ./.github/actions/fetch-codeql
-      - name: Check QL formatting
-        run: find ql "(" -name "*.ql" -or -name "*.qll" ")" -print0 | xargs -0 codeql query format --check-only
-  qlcompile:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-      - uses: ./.github/actions/fetch-codeql
-      - name: Check QL compilation
-        run: |
-          codeql query compile --check-only --threads=0 --ram 5000 --warnings=error "ql/src" "ql/examples"
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-  qlupgrade:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-      - uses: ./.github/actions/fetch-codeql
-      - name: Check DB upgrade scripts
-        run: |
-          echo >empty.trap
-          codeql dataset import -S ql/lib/upgrades/initial/ruby.dbscheme testdb empty.trap
-          codeql dataset upgrade testdb --additional-packs ql/lib
-          diff -q testdb/ruby.dbscheme ql/lib/ruby.dbscheme
-      - name: Check DB downgrade scripts
-        run: |
-          echo >empty.trap
-          rm -rf testdb; codeql dataset import -S ql/lib/ruby.dbscheme testdb empty.trap
-          codeql resolve upgrades --format=lines --allow-downgrades --additional-packs downgrades \
-           --dbscheme=ql/lib/ruby.dbscheme --target-dbscheme=downgrades/initial/ruby.dbscheme |
-           xargs codeql execute upgrades testdb
-          diff -q testdb/ruby.dbscheme downgrades/initial/ruby.dbscheme
   qltest:
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        slice: ["1/2", "2/2"]
     steps:
       - uses: actions/checkout@v2
       - uses: ./.github/actions/fetch-codeql
       - uses: ./ruby/actions/create-extractor-pack
       - name: Run QL tests
         run: |
-          codeql test run --threads=0 --ram 5000 --slice ${{ matrix.slice }} --search-path "${{ github.workspace }}/ruby/extractor-pack" --check-databases --check-unused-labels --check-repeated-labels --check-redefined-labels --check-use-before-definition --consistency-queries ql/consistency-queries ql/test
+          codeql test run --search-path "${{ github.workspace }}/ruby/extractor-pack" --check-databases --check-unused-labels --check-repeated-labels --check-redefined-labels --check-use-before-definition --consistency-queries ql/consistency-queries ql/test
         env:
           GITHUB_TOKEN: ${{ github.token }}
+      - name: Check QL formatting
+        run: find ql "(" -name "*.ql" -or -name "*.qll" ")" -print0 | xargs -0 codeql query format --check-only
+      - name: Check QL compilation
+        run: |
+          codeql query compile --check-only --threads=4 --warnings=error "ql/src" "ql/examples"
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+      - name: Check DB upgrade scripts
+        run: |
+          echo >empty.trap
+          codeql dataset import -S ql/lib/upgrades/initial/ruby.dbscheme testdb empty.trap
+          codeql dataset upgrade testdb --additional-packs ql/lib
+          diff -q testdb/ruby.dbscheme ql/lib/ruby.dbscheme

.github/workflows/validate-change-notes.yml

@@ -1,29 +0,0 @@
-name: Validate change notes
-
-on:
-  push:
-    paths:
-      - "*/ql/*/change-notes/**/*"
-      - ".github/workflows/validate-change-notes.yml"
-    branches:
-      - main
-      - "rc/*"
-  pull_request:
-    paths:
-      - "*/ql/*/change-notes/**/*"
-      - ".github/workflows/validate-change-notes.yml"
-
-jobs:
-  check-change-note:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v2
-
-      - name: Setup CodeQL
-        uses: ./.github/actions/fetch-codeql
-
-      - name: Fail if there are any errors with existing change notes
-
-        run: |
-          codeql pack release --groups cpp,csharp,java,javascript,python,ruby,-examples,-test,-experimental

.pre-commit-config.yaml

@@ -1,29 +0,0 @@
-# See https://pre-commit.com for more information
-# See https://pre-commit.com/hooks.html for more hooks
-exclude: /test/.*$(?<!\.ql)(?<!\.qll)(?<!\.qlref)
-repos:
--   repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v3.2.0
-    hooks:
-    -   id: trailing-whitespace
-    -   id: end-of-file-fixer
-
--   repo: local
-    hooks:
-    -   id: codeql-format
-        name: Fix QL file formatting
-        files: \.qll?$
-        language: system
-        entry: codeql query format --in-place
-
-    -   id: sync-files
-        name: Fix files required to be identical
-        language: system
-        entry: python3 config/sync-files.py --latest
-        pass_filenames: false
-
-    -   id: qhelp
-        name: Check query help generation
-        files: \.qhelp$
-        language: system
-        entry: python3 misc/scripts/check-qhelp.py

CODEOWNERS

@@ -13,9 +13,6 @@
 /python/**/experimental/**/* @github/codeql-python @xcorail
 /ruby/**/experimental/**/* @github/codeql-ruby @xcorail
 
-# ML-powered queries
-/javascript/ql/experimental/adaptivethreatmodeling/ @github/codeql-ml-powered-queries-reviewers
-
 # Notify members of codeql-go about PRs to the shared data-flow library files
 /java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl.qll @github/codeql-java @github/codeql-go
 /java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl2.qll @github/codeql-java @github/codeql-go
@@ -30,4 +27,4 @@
 /docs/query-*-style-guide.md @github/codeql-analysis-reviewers
 
 # QL for QL reviewers
-/ql/ @github/codeql-ql-for-ql-reviewers
+/ql/ @erik-krogh @tausbn

CONTRIBUTING.md

@@ -4,9 +4,6 @@ We welcome contributions to our CodeQL libraries and queries. Got an idea for a
 
 There is lots of useful documentation to help you write queries, ranging from information about query file structure to tutorials for specific target languages. For more information on the documentation available, see [CodeQL queries](https://help.semmle.com/QL/learn-ql/writing-queries/writing-queries.html) on [help.semmle.com](https://help.semmle.com).
 
-## Change notes
-
-Any nontrivial user-visible change to a query pack or library pack should have a change note. For details on how to add a change note for your change, see [this guide](docs/change-notes.md).
 
 ## Submitting a new experimental query
 
@@ -42,11 +39,7 @@ If you have an idea for a query that you would like to share with other CodeQL u
 
     - The queries and libraries must be autoformatted, for example using the "Format Document" command in [CodeQL for Visual Studio Code](https://help.semmle.com/codeql/codeql-for-vscode/procedures/about-codeql-for-vscode.html).
 
-    If you prefer, you can either:
-    1. install the [pre-commit framework](https://pre-commit.com/) and install the configured hooks on this repo via `pre-commit install`, or
-    2. use this [pre-commit hook](misc/scripts/pre-commit) that automatically checks whether your files are correctly formatted.
-
-    See the [pre-commit hook installation guide](docs/pre-commit-hook-setup.md) for instructions on the two approaches.
+    If you prefer, you can use this [pre-commit hook](misc/scripts/pre-commit) that automatically checks whether your files are correctly formatted. See the [pre-commit hook installation guide](docs/pre-commit-hook-setup.md) for instructions on how to install the hook.
 
 4. **Compilation**
 
@@ -67,6 +60,6 @@ After the experimental query is merged, we welcome pull requests to improve it.
 
 ## Using your personal data
 
-If you contribute to this project, we will record your name and email address (as provided by you with your contributions) as part of the code repositories, which are public. We might also use this information to contact you in relation to your contributions, as well as in the normal course of software development. We also store records of CLA agreements signed in the past, but no longer require contributors to sign a CLA. Under GDPR legislation, we do this on the basis of our legitimate interest in creating the CodeQL product.
+If you contribute to this project, we will record your name and email address (as provided by you with your contributions) as part of the code repositories, which are public. We might also use this information to contact you in relation to your contributions, as well as in the normal course of software development. We also store records of CLA agreements signed in the past, but no longer require contributors to sign a CLA. Under GDPR legislation, we do this on the basis of our legitimate interest in creating the CodeQL product. 
 
 Please do get in touch (privacy@github.com) if you have any questions about this or our data protection policies.

config/blame-deprecations.mjs

@@ -1,58 +0,0 @@
-import fs from "fs";
-import path from "path";
-import cp from "child_process";
-function* walk(dir) {
-  for (const file of fs.readdirSync(dir)) {
-    const filePath = path.join(dir, file);
-    if (fs.statSync(filePath).isDirectory()) {
-      yield* walk(filePath);
-    } else {
-      yield filePath;
-    }
-  }
-}
-
-function* deprecatedFiles(dir) {
-  for (const file of walk(dir)) {
-    if (file.endsWith(".ql") || file.endsWith(".qll")) {
-      const contents = fs.readFileSync(file, "utf8");
-      if (/\sdeprecated\s/.test(contents)) {
-        yield file;
-      }
-    }
-  }
-}
-
-const blameRegExp =
-  /^(\^?\w+)\s.+\s+(\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2} (?:\+|-)\d{4})\s+(\d+)\).*$/;
-
-function* deprecationMessages(dir) {
-  for (const file of deprecatedFiles(dir)) {
-    const blame = cp.execFileSync("git", ["blame", "--", file]);
-    const lines = blame.toString().split("\n");
-    for (let i = 0; i < lines.length; i++) {
-      const line = lines[i];
-      if (line.includes(" deprecated ")) {
-        try {
-          const [_, sha, time, lineNumber] = line.match(blameRegExp);
-          const date = new Date(time);
-          // check if it's within the last 14 months (a year, plus 2 months for safety, in case a PR was delayed)
-          if (date.getTime() >= Date.now() - 14 * 31 * 24 * 60 * 60 * 1000) {
-            continue;
-          }
-          const message = `${file}:${lineNumber} was last updated on ${date.getFullYear()}-${date.getMonth()}-${date.getDate()}`;
-          yield [message, date];
-        } catch (e) {
-          console.log(e);
-          console.log("----");
-          console.log(line);
-          console.log("----");
-          process.exit(0);
-        }
-      }
-    }
-  }
-}
-[...deprecationMessages(".")]
-  .sort((a, b) => a[1].getTime() - b[1].getTime())
-  .forEach((msg) => console.log(msg[0]));

config/identical-files.json

@@ -7,7 +7,6 @@
     "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl5.qll",
     "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl6.qll",
     "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImplForSerializability.qll",
-    "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImplForOnActivityResult.qll",
     "cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll",
     "cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll",
     "cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll",
@@ -426,6 +425,7 @@
     "python/ql/src/Lexical/CommentedOutCodeMetricOverview.inc.qhelp"
   ],
   "FLinesOfDuplicatedCodeCommon.inc.qhelp": [
+    "cpp/ql/src/Metrics/Files/FLinesOfDuplicatedCodeCommon.inc.qhelp",
     "java/ql/src/Metrics/Files/FLinesOfDuplicatedCodeCommon.inc.qhelp",
     "javascript/ql/src/Metrics/FLinesOfDuplicatedCodeCommon.inc.qhelp",
     "python/ql/src/Metrics/FLinesOfDuplicatedCodeCommon.inc.qhelp"
@@ -464,8 +464,7 @@
   ],
   "SensitiveDataHeuristics Python/JS": [
     "javascript/ql/lib/semmle/javascript/security/internal/SensitiveDataHeuristics.qll",
-    "python/ql/lib/semmle/python/security/internal/SensitiveDataHeuristics.qll",
-    "ruby/ql/lib/codeql/ruby/security/internal/SensitiveDataHeuristics.qll"
+    "python/ql/lib/semmle/python/security/internal/SensitiveDataHeuristics.qll"
   ],
   "ReDoS Util Python/JS/Ruby": [
     "javascript/ql/lib/semmle/javascript/security/performance/ReDoSUtil.qll",
@@ -501,11 +500,5 @@
     "javascript/ql/lib/tutorial.qll",
     "python/ql/lib/tutorial.qll",
     "ruby/ql/lib/tutorial.qll"
-  ],
-  "AccessPathSyntax": [
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/AccessPathSyntax.qll",
-    "java/ql/lib/semmle/code/java/dataflow/internal/AccessPathSyntax.qll",
-    "javascript/ql/lib/semmle/javascript/frameworks/data/internal/AccessPathSyntax.qll",
-    "ruby/ql/lib/codeql/ruby/dataflow/internal/AccessPathSyntax.qll"
   ]
 }

cpp/autobuilder/Semmle.Autobuild.Cpp.Tests/Semmle.Autobuild.Cpp.Tests.csproj

@@ -2,7 +2,7 @@
 
   <PropertyGroup>
     <OutputType>Exe</OutputType>
-    <TargetFramework>net6.0</TargetFramework>
+    <TargetFramework>net5.0</TargetFramework>
     <GenerateAssemblyInfo>false</GenerateAssemblyInfo>
     <RuntimeIdentifiers>win-x64;linux-x64;osx-x64</RuntimeIdentifiers>
     <Nullable>enable</Nullable>

cpp/autobuilder/Semmle.Autobuild.Cpp/Semmle.Autobuild.Cpp.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
-    <TargetFramework>net6.0</TargetFramework>
+    <TargetFramework>net5.0</TargetFramework>
     <AssemblyName>Semmle.Autobuild.Cpp</AssemblyName>
     <RootNamespace>Semmle.Autobuild.Cpp</RootNamespace>
     <ApplicationIcon />

cpp/config/suites/c/correctness

@@ -31,7 +31,6 @@
 + semmlecode-cpp-queries/Critical/NewArrayDeleteMismatch.ql: /Correctness/Common Errors
 + semmlecode-cpp-queries/Critical/NewDeleteArrayMismatch.ql: /Correctness/Common Errors
 + semmlecode-cpp-queries/Critical/NewFreeMismatch.ql: /Correctness/Common Errors
-+ semmlecode-cpp-queries/Likely Bugs/Memory Management/UsingExpiredStackAddress.ql: /Correctness/Common Errors
   # Use of Libraries
 + semmlecode-cpp-queries/Likely Bugs/Memory Management/SuspiciousCallToMemset.ql: /Correctness/Use of Libraries
 + semmlecode-cpp-queries/Likely Bugs/Memory Management/SuspiciousSizeof.ql: /Correctness/Use of Libraries

cpp/config/suites/cpp/correctness

@@ -34,7 +34,6 @@
 + semmlecode-cpp-queries/Critical/NewArrayDeleteMismatch.ql: /Correctness/Common Errors
 + semmlecode-cpp-queries/Critical/NewDeleteArrayMismatch.ql: /Correctness/Common Errors
 + semmlecode-cpp-queries/Critical/NewFreeMismatch.ql: /Correctness/Common Errors
-+ semmlecode-cpp-queries/Likely Bugs/Memory Management/UsingExpiredStackAddress.ql: /Correctness/Common Errors
   # Exceptions
 + semmlecode-cpp-queries/Best Practices/Exceptions/AccidentalRethrow.ql: /Correctness/Exceptions
 + semmlecode-cpp-queries/Best Practices/Exceptions/CatchingByValue.ql: /Correctness/Exceptions

cpp/config/suites/security/cwe-120

@@ -5,11 +5,9 @@
   @name Badly bounded write (CWE-120)
 + semmlecode-cpp-queries/Security/CWE/CWE-120/OverrunWrite.ql: /CWE/CWE-120
   @name Potentially overrunning write (CWE-120)
-+ semmlecode-cpp-queries/Security/CWE/CWE-120/VeryLikelyOverrunWrite.ql: /CWE/CWE-120
-  @name Likely overrunning write
 + semmlecode-cpp-queries/Security/CWE/CWE-120/OverrunWriteFloat.ql: /CWE/CWE-120
   @name Potentially overrunning write with float to string conversion (CWE-120)
 + semmlecode-cpp-queries/Best Practices/Likely Errors/OffsetUseBeforeRangeCheck.ql: /CWE/CWE-120
   @name Array offset used before range check (CWE-120)
 + semmlecode-cpp-queries/Likely Bugs/Memory Management/UnsafeUseOfStrcat.ql: /CWE/CWE-120
-  @name Potentially unsafe use of strcat (CWE-120)
+    @name Potentially unsafe use of strcat (CWE-120)

cpp/downgrades/2cd420191e5f782589b4e4efb70127de265390dd/upgrade.properties

@@ -1,2 +0,0 @@
-description: Remove unused legacy relations
-compatibility: backwards

cpp/downgrades/bb0f279f2acd793105a347d589b5afc8715d94c4/upgrade.properties

@@ -1,3 +0,0 @@
-description: Add relation for tracking variables from structured binding declarations
-compatibility: full
-is_structured_binding.rel: delete

cpp/downgrades/qlpack.yml

@@ -1,4 +0,0 @@
-name: codeql/cpp-downgrades
-groups: cpp
-downgrades: .
-library: true

cpp/ql/examples/qlpack.yml

@@ -1,6 +1,4 @@
 name: codeql/cpp-examples
-groups: 
-  - cpp
-  - examples
+version: 0.0.2
 dependencies:
   codeql/cpp-all: "*"

cpp/ql/lib/CHANGELOG.md

@@ -1,26 +1,3 @@
-## 0.0.10
-
-### New Features
-
-* Added a `isStructuredBinding` predicate to the `Variable` class which holds when the variable is declared as part of a structured binding declaration.
-
-## 0.0.9
-
-## 0.0.8
-
-### Deprecated APIs
-
-* The `codeql/cpp-upgrades` CodeQL pack has been removed. All upgrades scripts have been merged into the `codeql/cpp-all` CodeQL pack.
-
-### Minor Analysis Improvements
-
-* `FormatLiteral::getMaxConvertedLength` now uses range analysis to provide a
-  more accurate length for integers formatted with `%x`
-
-## 0.0.7
-
-## 0.0.6
-
 ## 0.0.5
 
 ## 0.0.4

cpp/ql/lib/change-notes/2022-02-07-deleted-deprecations.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* All deprecated predicates/classes/modules that have been deprecated for over a year have been deleted.

cpp/ql/lib/change-notes/2022-02-24-structured-bindings-in-ir.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Many queries now support structured bindings, as structured bindings are now handled in the IR translation.

cpp/ql/lib/change-notes/released/0.0.10.md

@@ -1,5 +0,0 @@
-## 0.0.10
-
-### New Features
-
-* Added a `isStructuredBinding` predicate to the `Variable` class which holds when the variable is declared as part of a structured binding declaration.

cpp/ql/lib/change-notes/released/0.0.6.md

@@ -1 +0,0 @@
-## 0.0.6

cpp/ql/lib/change-notes/released/0.0.7.md

@@ -1 +0,0 @@
-## 0.0.7

cpp/ql/lib/change-notes/released/0.0.8.md

@@ -1,10 +0,0 @@
-## 0.0.8
-
-### Deprecated APIs
-
-* The `codeql/cpp-upgrades` CodeQL pack has been removed. All upgrades scripts have been merged into the `codeql/cpp-all` CodeQL pack.
-
-### Minor Analysis Improvements
-
-* `FormatLiteral::getMaxConvertedLength` now uses range analysis to provide a
-  more accurate length for integers formatted with `%x`

cpp/ql/lib/change-notes/released/0.0.9.md

@@ -1,2 +0,0 @@
-## 0.0.9
-

cpp/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.0.10
+lastReleaseVersion: 0.0.5

cpp/ql/lib/cpp.qll

@@ -69,4 +69,6 @@ import semmle.code.cpp.Comments
 import semmle.code.cpp.Preprocessor
 import semmle.code.cpp.Iteration
 import semmle.code.cpp.NameQualifiers
+import semmle.code.cpp.ObjectiveC
+import semmle.code.cpp.exprs.ObjectiveC
 import DefaultOptions

cpp/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cpp-all
-version: 0.0.11-dev
+version: 0.0.6-dev
 groups: cpp
 dbscheme: semmlecode.cpp.dbscheme
 extractor: cpp

cpp/ql/lib/semmle/code/cpp/Class.qll

@@ -111,6 +111,24 @@ class Class extends UserType {
     result = this.getCanonicalMember(index).(TemplateVariable).getAnInstantiation()
   }
 
+  /**
+   * DEPRECATED: Use `getCanonicalMember(int)` or `getAMember(int)` instead.
+   * Gets the `index`th member of this class.
+   */
+  deprecated Declaration getMember(int index) {
+    member(underlyingElement(this), index, unresolveElement(result))
+  }
+
+  /**
+   * DEPRECATED: As this includes a somewhat arbitrary number of
+   *             template instantiations, it is unlikely to do what
+   *             you need.
+   * Gets the number of members that this class has. This includes both
+   * templates that are in this class, and instantiations of those
+   * templates.
+   */
+  deprecated int getNumMember() { result = count(this.getAMember()) }
+
   /**
    * Gets a private member declared in this class, struct or union.
    * For template members, this may be either the template or an
@@ -188,7 +206,26 @@ class Class extends UserType {
    * it is callable by a particular caller. For C++11, there's also a question
    * of whether to include members that are defaulted or deleted.
    */
-  deprecated predicate hasCopyConstructor() { this.getAMemberFunction() instanceof CopyConstructor }
+  deprecated predicate hasCopyConstructor() {
+    exists(CopyConstructor cc | cc = this.getAMemberFunction())
+  }
+
+  /**
+   * Holds if this class has a copy assignment operator that is either
+   * explicitly declared (though possibly `= delete`) or is auto-generated,
+   * non-trivial and called from somewhere.
+   *
+   * DEPRECATED: There is more than one reasonable definition of what it means
+   * to have a copy assignment operator, and we do not want to promote one
+   * particular definition by naming it with this predicate. Having a copy
+   * assignment operator could mean that such a member is declared or defined
+   * in the source or that it is callable by a particular caller. For C++11,
+   * there's also a question of whether to include members that are defaulted
+   * or deleted.
+   */
+  deprecated predicate hasCopyAssignmentOperator() {
+    exists(CopyAssignmentOperator coa | coa = this.getAMemberFunction())
+  }
 
   /**
    * Like accessOfBaseMember but returns multiple results if there are multiple
@@ -850,7 +887,7 @@ class NestedClass extends Class {
  * pure virtual function.
  */
 class AbstractClass extends Class {
-  AbstractClass() { this.getAMemberFunction() instanceof PureVirtualFunction }
+  AbstractClass() { exists(PureVirtualFunction f | this.getAMemberFunction() = f) }
 
   override string getAPrimaryQlClass() { result = "AbstractClass" }
 }
@@ -1035,6 +1072,31 @@ class PartialClassTemplateSpecialization extends ClassTemplateSpecialization {
   override string getAPrimaryQlClass() { result = "PartialClassTemplateSpecialization" }
 }
 
+/**
+ * An "interface" is a class that only contains pure virtual functions (and contains
+ * at least one such function).  For example:
+ * ```
+ * class MyInterfaceClass {
+ * public:
+ *   virtual void myMethod1() = 0;
+ *   virtual void myMethod2() = 0;
+ * };
+ * ```
+ *
+ * DEPRECATED: This class is considered to be too specific for general usage.
+ */
+deprecated class Interface extends Class {
+  Interface() {
+    forex(Declaration m |
+      m.getDeclaringType() = this.getABaseClass*() and not compgenerated(unresolveElement(m))
+    |
+      m instanceof PureVirtualFunction
+    )
+  }
+
+  override string getAPrimaryQlClass() { result = "Interface" }
+}
+
 /**
  * A class/struct derivation that is virtual.  For example the derivation in
  * the following code is a `VirtualClassDerivation`:

cpp/ql/lib/semmle/code/cpp/Element.qll

@@ -55,6 +55,9 @@ class ElementBase extends @element {
   cached
   string toString() { none() }
 
+  /** DEPRECATED: use `getAPrimaryQlClass` instead. */
+  deprecated string getCanonicalQLClass() { result = this.getAPrimaryQlClass() }
+
   /**
    * Gets a comma-separated list of the names of the primary CodeQL classes to which this element belongs.
    */
@@ -88,6 +91,13 @@ class Element extends ElementBase {
    */
   predicate fromSource() { this.getFile().fromSource() }
 
+  /**
+   * Holds if this element may be from a library.
+   *
+   * DEPRECATED: always true.
+   */
+  deprecated predicate fromLibrary() { this.getFile().fromLibrary() }
+
   /** Gets the primary location of this element. */
   Location getLocation() { none() }
 

cpp/ql/lib/semmle/code/cpp/File.qll

@@ -196,11 +196,31 @@ class Folder extends Container, @folder {
    */
   deprecated string getName() { folders(underlyingElement(this), result) }
 
+  /**
+   * DEPRECATED: use `getAbsolutePath` instead.
+   * Holds if this element is named `name`.
+   */
+  deprecated predicate hasName(string name) { name = this.getName() }
+
+  /**
+   * DEPRECATED: use `getAbsolutePath` instead.
+   * Gets the full name of this folder.
+   */
+  deprecated string getFullName() { result = this.getName() }
+
   /**
    * DEPRECATED: use `getBaseName` instead.
    * Gets the last part of the folder name.
    */
   deprecated string getShortName() { result = this.getBaseName() }
+
+  /**
+   * DEPRECATED: use `getParentContainer` instead.
+   * Gets the parent folder.
+   */
+  deprecated Folder getParent() {
+    containerparent(unresolveElement(result), underlyingElement(this))
+  }
 }
 
 /**
@@ -288,6 +308,13 @@ class File extends Container, @file {
    */
   override predicate fromSource() { numlines(underlyingElement(this), _, _, _) }
 
+  /**
+   * Holds if this file may be from a library.
+   *
+   * DEPRECATED: For historical reasons this is true for any file.
+   */
+  deprecated override predicate fromLibrary() { any() }
+
   /** Gets the metric file. */
   MetricFile getMetrics() { result = this }
 
@@ -401,3 +428,25 @@ class CppFile extends File {
 
   override string getAPrimaryQlClass() { result = "CppFile" }
 }
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C source file, as determined by file extension.
+ *
+ * For the related notion of whether a file is compiled as Objective C
+ * code, use `File.compiledAsObjC`.
+ */
+deprecated class ObjCFile extends File {
+  ObjCFile() { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C++ source file, as determined by file extension.
+ *
+ * For the related notion of whether a file is compiled as Objective C++
+ * code, use `File.compiledAsObjCpp`.
+ */
+deprecated class ObjCppFile extends File {
+  ObjCppFile() { none() }
+}

cpp/ql/lib/semmle/code/cpp/Location.qll

@@ -105,6 +105,25 @@ class Location extends @location {
   }
 }
 
+/**
+ * DEPRECATED: Use `Location` instead.
+ * A location of an element. Not used for expressions or statements, which
+ * instead use LocationExpr and LocationStmt respectively.
+ */
+deprecated library class LocationDefault extends Location, @location_default { }
+
+/**
+ * DEPRECATED: Use `Location` instead.
+ * A location of a statement.
+ */
+deprecated library class LocationStmt extends Location, @location_stmt { }
+
+/**
+ * DEPRECATED: Use `Location` instead.
+ * A location of an expression.
+ */
+deprecated library class LocationExpr extends Location, @location_expr { }
+
 /**
  * Gets the length of the longest line in file `f`.
  */

cpp/ql/lib/semmle/code/cpp/Macro.qll

@@ -30,6 +30,16 @@ class Macro extends PreprocessorDirective, @ppd_define {
     else result = "#define " + this.getHead() + " " + this.getBody()
   }
 
+  /**
+   * Holds if the body of the macro starts with an unmatched closing
+   * parenthesis. For example:
+   *
+   *   #define RPAREN() )
+   *
+   * DEPRECATED: This predicate has a misleading name.
+   */
+  deprecated predicate isFunctionLike() { this.getBody().regexpMatch("[^(]*\\).*") }
+
   /**
    * Gets the name of the macro.  For example, `MAX` in
    * `#define MAX(x,y) (((x)>(y))?(x):(y))`.
@@ -251,6 +261,46 @@ class MacroInvocation extends MacroAccess {
   string getExpandedArgument(int i) { macro_argument_expanded(underlyingElement(this), i, result) }
 }
 
+/**
+ * A top-level expression generated by a macro invocation.
+ *
+ * DEPRECATED: Use `MacroInvocation.getExpr()` directly to get an
+ * expression generated at the top-level of a macro invocation.  Use
+ * `MacroInvocation.getAnAffectedElement()` to get any element generated
+ * by a macro invocation.
+ */
+deprecated class MacroInvocationExpr extends Expr {
+  MacroInvocationExpr() { exists(MacroInvocation i | this = i.getExpr()) }
+
+  /**
+   * Gets the macro invocation of which this is the top-level expression.
+   */
+  MacroInvocation getInvocation() { result.getExpr() = this }
+
+  /** Gets the name of the invoked macro. */
+  string getMacroName() { result = this.getInvocation().getMacroName() }
+}
+
+/**
+ * A top-level statement generated by a macro invocation.
+ *
+ * DEPRECATED: Use `MacroInvocation.getStmt()` directly to get a
+ * statement generated at the top-level of a macro invocation.  Use
+ * `MacroInvocation.getAnAffectedElement()` to get any element generated
+ * by a macro invocation.
+ */
+deprecated class MacroInvocationStmt extends Stmt {
+  MacroInvocationStmt() { exists(MacroInvocation i | this = i.getStmt()) }
+
+  /**
+   * Gets the macro invocation of which this is the top-level statement.
+   */
+  MacroInvocation getInvocation() { result.getStmt() = this }
+
+  /** Gets the name of the invoked macro. */
+  string getMacroName() { result = this.getInvocation().getMacroName() }
+}
+
 /** Holds if `l` is the location of a macro. */
 predicate macroLocation(Location l) { macrolocationbind(_, l) }
 

cpp/ql/lib/semmle/code/cpp/MemberFunction.qll

@@ -233,6 +233,40 @@ class ImplicitConversionFunction extends MemberFunction {
   Type getDestType() { none() } // overridden in subclasses
 }
 
+/**
+ * DEPRECATED: as of C++11 this class does not correspond perfectly with the
+ * language definition of a converting constructor.
+ *
+ * A C++ constructor that also defines an implicit conversion. For example the
+ * function `MyClass` in the following code is a `ConversionConstructor`:
+ * ```
+ * class MyClass {
+ * public:
+ *   MyClass(const MyOtherClass &from) {
+ *     ...
+ *   }
+ * };
+ * ```
+ */
+deprecated class ConversionConstructor extends Constructor, ImplicitConversionFunction {
+  ConversionConstructor() {
+    strictcount(Parameter p | p = this.getAParameter() and not p.hasInitializer()) = 1 and
+    not this.hasSpecifier("explicit")
+  }
+
+  override string getAPrimaryQlClass() {
+    not this instanceof CopyConstructor and
+    not this instanceof MoveConstructor and
+    result = "ConversionConstructor"
+  }
+
+  /** Gets the type this `ConversionConstructor` takes as input. */
+  override Type getSourceType() { result = this.getParameter(0).getType() }
+
+  /** Gets the type this `ConversionConstructor` is a constructor of. */
+  override Type getDestType() { result = this.getDeclaringType() }
+}
+
 private predicate hasCopySignature(MemberFunction f) {
   f.getParameter(0).getUnspecifiedType().(LValueReferenceType).getBaseType() = f.getDeclaringType()
 }

cpp/ql/lib/semmle/code/cpp/Namespace.qll

@@ -86,6 +86,13 @@ class Namespace extends NameQualifyingElement, @namespace {
   /** Holds if this namespace may be from source. */
   override predicate fromSource() { this.getADeclaration().fromSource() }
 
+  /**
+   * Holds if this namespace is in a library.
+   *
+   * DEPRECATED: never holds.
+   */
+  deprecated override predicate fromLibrary() { not this.fromSource() }
+
   /** Gets the metric namespace. */
   MetricNamespace getMetrics() { result = this }
 
@@ -226,6 +233,11 @@ class GlobalNamespace extends Namespace {
 
   override Namespace getParentNamespace() { none() }
 
+  /**
+   * DEPRECATED: use `getName()`.
+   */
+  deprecated string getFullName() { result = this.getName() }
+
   override string getFriendlyName() { result = "(global namespace)" }
 }
 

cpp/ql/lib/semmle/code/cpp/ObjectiveC.qll

@@ -0,0 +1,196 @@
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ */
+
+import semmle.code.cpp.Class
+private import semmle.code.cpp.internal.ResolveClass
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C class.
+ */
+deprecated class ObjectiveClass extends Class {
+  ObjectiveClass() { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C protocol.
+ */
+deprecated class Protocol extends Class {
+  Protocol() { none() }
+
+  /**
+   * Holds if the type implements the protocol, either because the type
+   * itself does, or because it is a type conforming to the protocol.
+   */
+  predicate isImplementedBy(Type t) { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * A type which conforms to a protocol. Use `getAProtocol` to get a
+ * protocol that this type conforms to.
+ */
+deprecated class TypeConformingToProtocol extends DerivedType {
+  TypeConformingToProtocol() { none() }
+
+  /** Gets a protocol that this type conforms to. */
+  Protocol getAProtocol() { none() }
+
+  /** Gets the size of this type. */
+  override int getSize() { none() }
+
+  override int getAlignment() { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C `@autoreleasepool` statement, for example
+ * `@autoreleasepool { int x; int y; }`.
+ */
+deprecated class AutoReleasePoolStmt extends Stmt {
+  AutoReleasePoolStmt() { none() }
+
+  override string toString() { none() }
+
+  /** Gets the body statement of this `@autoreleasepool` statement. */
+  Stmt getStmt() { none() }
+
+  override predicate mayBeImpure() { none() }
+
+  override predicate mayBeGloballyImpure() { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C `@synchronized statement`, for example
+ * `@synchronized (x) { [x complicationOperation]; }`.
+ */
+deprecated class SynchronizedStmt extends Stmt {
+  SynchronizedStmt() { none() }
+
+  override string toString() { none() }
+
+  /** Gets the expression which gives the object to be locked. */
+  Expr getLockedObject() { none() }
+
+  /** Gets the body statement of this `@synchronized` statement. */
+  Stmt getStmt() { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C for-in statement.
+ */
+deprecated class ForInStmt extends Loop {
+  ForInStmt() { none() }
+
+  /**
+   * Gets the condition expression of the `while` statement that the
+   * `for...in` statement desugars into.
+   */
+  override Expr getCondition() { none() }
+
+  override Expr getControllingExpr() { none() }
+
+  /** Gets the collection that the loop iterates over. */
+  Expr getCollection() { none() }
+
+  /** Gets the body of the loop. */
+  override Stmt getStmt() { none() }
+
+  override string toString() { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C category or class extension.
+ */
+deprecated class Category extends Class {
+  Category() { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C class extension.
+ */
+deprecated class ClassExtension extends Category {
+  ClassExtension() { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C try statement.
+ */
+deprecated class ObjcTryStmt extends TryStmt {
+  ObjcTryStmt() { none() }
+
+  override string toString() { none() }
+
+  /** Gets the finally clause of this try statement, if any. */
+  FinallyBlock getFinallyClause() { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C `@finally` block.
+ */
+deprecated class FinallyBlock extends BlockStmt {
+  FinallyBlock() { none() }
+
+  /** Gets the try statement corresponding to this finally block. */
+  ObjcTryStmt getTryStmt() { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C `@property`.
+ */
+deprecated class Property extends Declaration {
+  Property() { none() }
+
+  /** Gets the name of this property. */
+  override string getName() { none() }
+
+  /**
+   * Gets nothing (provided for compatibility with Declaration).
+   *
+   * For the attribute list following the `@property` keyword, use
+   * `getAnAttribute()`.
+   */
+  override Specifier getASpecifier() { none() }
+
+  /**
+   * Gets an attribute of this property (such as `readonly`, `nonatomic`,
+   * or `getter=isEnabled`).
+   */
+  Attribute getAnAttribute() { none() }
+
+  override Location getADeclarationLocation() { result = getLocation() }
+
+  override Location getDefinitionLocation() { result = getLocation() }
+
+  override Location getLocation() { none() }
+
+  /** Gets the type of this property. */
+  Type getType() { none() }
+
+  /**
+   * Gets the instance method which is called to get the value of this
+   * property.
+   */
+  MemberFunction getGetter() { none() }
+
+  /**
+   * Gets the instance method which is called to set the value of this
+   * property (if it is a writable property).
+   */
+  MemberFunction getSetter() { none() }
+
+  /**
+   * Gets the instance variable which stores the property value (if this
+   * property was explicitly or automatically `@synthesize`d).
+   */
+  MemberVariable getInstanceVariable() { none() }
+}

cpp/ql/lib/semmle/code/cpp/Parameter.qll

@@ -95,6 +95,22 @@ class Parameter extends LocalScopeVariable, @parameter {
     else result = this.getADeclarationEntry()
   }
 
+  /**
+   * Gets the name of this parameter in the given block (which should be
+   * the body of a function with which the parameter is associated).
+   *
+   * DEPRECATED: this method was used in a previous implementation of
+   * getName, but is no longer in use.
+   */
+  deprecated string getNameInBlock(BlockStmt b) {
+    exists(ParameterDeclarationEntry pde |
+      pde.getFunctionDeclarationEntry().getBlock() = b and
+      this.getFunction().getBlock() = b and
+      pde.getVariable() = this and
+      result = pde.getName()
+    )
+  }
+
   /**
    * Holds if this parameter has a name.
    *

cpp/ql/lib/semmle/code/cpp/Specifier.qll

@@ -286,13 +286,13 @@ class AttributeArgument extends Element, @attribute_arg {
   override Location getLocation() { attribute_args(underlyingElement(this), _, _, _, result) }
 
   override string toString() {
-    if underlyingElement(this) instanceof @attribute_arg_empty
+    if exists(@attribute_arg_empty self | self = underlyingElement(this))
     then result = "empty argument"
     else
       exists(string prefix, string tail |
         (if exists(this.getName()) then prefix = this.getName() + "=" else prefix = "") and
         (
-          if underlyingElement(this) instanceof @attribute_arg_type
+          if exists(@attribute_arg_type self | self = underlyingElement(this))
           then tail = this.getValueType().getName()
           else tail = this.getValueText()
         ) and

cpp/ql/lib/semmle/code/cpp/Type.qll

@@ -1085,6 +1085,50 @@ class DerivedType extends Type, @derivedtype {
   override predicate involvesTemplateParameter() { this.getBaseType().involvesTemplateParameter() }
 
   override Type stripType() { result = this.getBaseType().stripType() }
+
+  /**
+   * Holds if this type has the `__autoreleasing` specifier or if it points to
+   * a type with the `__autoreleasing` specifier.
+   *
+   * DEPRECATED: use `hasSpecifier` directly instead.
+   */
+  deprecated predicate isAutoReleasing() {
+    this.hasSpecifier("__autoreleasing") or
+    this.(PointerType).getBaseType().hasSpecifier("__autoreleasing")
+  }
+
+  /**
+   * Holds if this type has the `__strong` specifier or if it points to
+   * a type with the `__strong` specifier.
+   *
+   * DEPRECATED: use `hasSpecifier` directly instead.
+   */
+  deprecated predicate isStrong() {
+    this.hasSpecifier("__strong") or
+    this.(PointerType).getBaseType().hasSpecifier("__strong")
+  }
+
+  /**
+   * Holds if this type has the `__unsafe_unretained` specifier or if it points
+   * to a type with the `__unsafe_unretained` specifier.
+   *
+   * DEPRECATED: use `hasSpecifier` directly instead.
+   */
+  deprecated predicate isUnsafeRetained() {
+    this.hasSpecifier("__unsafe_unretained") or
+    this.(PointerType).getBaseType().hasSpecifier("__unsafe_unretained")
+  }
+
+  /**
+   * Holds if this type has the `__weak` specifier or if it points to
+   * a type with the `__weak` specifier.
+   *
+   * DEPRECATED: use `hasSpecifier` directly instead.
+   */
+  deprecated predicate isWeak() {
+    this.hasSpecifier("__weak") or
+    this.(PointerType).getBaseType().hasSpecifier("__weak")
+  }
 }
 
 /**

cpp/ql/lib/semmle/code/cpp/TypedefType.qll

@@ -106,4 +106,25 @@ class NestedTypedefType extends TypedefType {
   NestedTypedefType() { this.isMember() }
 
   override string getAPrimaryQlClass() { result = "NestedTypedefType" }
+
+  /**
+   * DEPRECATED: use `.hasSpecifier("private")` instead.
+   *
+   * Holds if this member is private.
+   */
+  deprecated predicate isPrivate() { this.hasSpecifier("private") }
+
+  /**
+   * DEPRECATED: `.hasSpecifier("protected")` instead.
+   *
+   * Holds if this member is protected.
+   */
+  deprecated predicate isProtected() { this.hasSpecifier("protected") }
+
+  /**
+   * DEPRECATED: use `.hasSpecifier("public")` instead.
+   *
+   * Holds if this member is public.
+   */
+  deprecated predicate isPublic() { this.hasSpecifier("public") }
 }

cpp/ql/lib/semmle/code/cpp/Variable.qll

@@ -169,12 +169,6 @@ class Variable extends Declaration, @variable {
     variable_instantiation(underlyingElement(this), unresolveElement(v))
   }
 
-  /**
-   * Holds if this variable is declated as part of a structured binding
-   * declaration. For example, `x` in `auto [x, y] = ...`.
-   */
-  predicate isStructuredBinding() { is_structured_binding(underlyingElement(this)) }
-
   /**
    * Holds if this is a compiler-generated variable. For example, a
    * [range-based for loop](http://en.cppreference.com/w/cpp/language/range-for)
@@ -556,6 +550,24 @@ class MemberVariable extends Variable, @membervariable {
   private Type getAType() { membervariables(underlyingElement(this), unresolveElement(result), _) }
 }
 
+/**
+ * A C/C++ function pointer variable.
+ *
+ * DEPRECATED: use `Variable.getType() instanceof FunctionPointerType` instead.
+ */
+deprecated class FunctionPointerVariable extends Variable {
+  FunctionPointerVariable() { this.getType() instanceof FunctionPointerType }
+}
+
+/**
+ * A C/C++ function pointer member variable.
+ *
+ * DEPRECATED: use `MemberVariable.getType() instanceof FunctionPointerType` instead.
+ */
+deprecated class FunctionPointerMemberVariable extends MemberVariable {
+  FunctionPointerMemberVariable() { this instanceof FunctionPointerVariable }
+}
+
 /**
  * A C++14 variable template. For example, in the following code the variable
  * template `v` defines a family of variables:

cpp/ql/lib/semmle/code/cpp/XML.qll

@@ -12,6 +12,13 @@ class XMLLocatable extends @xmllocatable, TXMLLocatable {
   /** Gets the source location for this element. */
   Location getLocation() { xmllocations(this, result) }
 
+  /**
+   * DEPRECATED: Use `getLocation()` instead.
+   *
+   * Gets the source location for this element.
+   */
+  deprecated Location getALocation() { result = this.getLocation() }
+
   /**
    * Holds if this element is at the specified location.
    * The location spans column `startcolumn` of line `startline` to
@@ -76,6 +83,21 @@ class XMLParent extends @xmlparent {
   /** Gets the number of places in the body of this XML parent where text occurs. */
   int getNumberOfCharacterSets() { result = count(int pos | xmlChars(_, _, this, pos, _, _)) }
 
+  /**
+   * DEPRECATED: Internal.
+   *
+   * Append the character sequences of this XML parent from left to right, separated by a space,
+   * up to a specified (zero-based) index.
+   */
+  deprecated string charsSetUpTo(int n) {
+    n = 0 and xmlChars(_, result, this, 0, _, _)
+    or
+    n > 0 and
+    exists(string chars | xmlChars(_, chars, this, n, _, _) |
+      result = this.charsSetUpTo(n - 1) + " " + chars
+    )
+  }
+
   /**
    * Gets the result of appending all the character sequences of this XML parent from
    * left to right, separated by a space.
@@ -211,7 +233,7 @@ class XMLElement extends @xmlelement, XMLParent, XMLLocatable {
   XMLAttribute getAttribute(string name) { result.getElement() = this and result.getName() = name }
 
   /** Holds if this XML element has an attribute with the specified `name`. */
-  predicate hasAttribute(string name) { exists(this.getAttribute(name)) }
+  predicate hasAttribute(string name) { exists(XMLAttribute a | a = this.getAttribute(name)) }
 
   /** Gets the value of the attribute with the specified `name`, if any. */
   string getAttributeValue(string name) { result = this.getAttribute(name).getValue() }

cpp/ql/lib/semmle/code/cpp/commons/Alloc.qll

@@ -2,6 +2,20 @@ import cpp
 import semmle.code.cpp.models.interfaces.Allocation
 import semmle.code.cpp.models.interfaces.Deallocation
 
+/**
+ * A library routine that allocates memory.
+ *
+ * DEPRECATED: Use the `AllocationFunction` class instead of this predicate.
+ */
+deprecated predicate allocationFunction(Function f) { f instanceof AllocationFunction }
+
+/**
+ * A call to a library routine that allocates memory.
+ *
+ * DEPRECATED: Use `AllocationExpr` instead (this also includes `new` expressions).
+ */
+deprecated predicate allocationCall(FunctionCall fc) { fc instanceof AllocationExpr }
+
 /**
  * A library routine that frees memory.
  */
@@ -19,6 +33,13 @@ predicate freeCall(FunctionCall fc, Expr arg) { arg = fc.(DeallocationExpr).getF
  */
 predicate isMemoryManagementExpr(Expr e) { isAllocationExpr(e) or e instanceof DeallocationExpr }
 
+/**
+ * Is e an allocation from stdlib.h (`malloc`, `realloc` etc)?
+ *
+ * DEPRECATED: Use `AllocationExpr` instead (this also includes `new` expressions).
+ */
+deprecated predicate isStdLibAllocationExpr(Expr e) { allocationCall(e) }
+
 /**
  * Is e some kind of allocation (`new`, `alloc`, `realloc` etc)?
  */
@@ -27,3 +48,19 @@ predicate isAllocationExpr(Expr e) {
   or
   e = any(NewOrNewArrayExpr new | not exists(new.getPlacementPointer()))
 }
+
+/**
+ * Is e some kind of allocation (`new`, `alloc`, `realloc` etc) with a fixed size?
+ *
+ * DEPRECATED: Use `AllocationExpr.getSizeBytes()` instead.
+ */
+deprecated predicate isFixedSizeAllocationExpr(Expr allocExpr, int size) {
+  size = allocExpr.(AllocationExpr).getSizeBytes()
+}
+
+/**
+ * Is e some kind of deallocation (`delete`, `free`, `realloc` etc)?
+ *
+ * DEPRECATED: Use `DeallocationExpr` instead.
+ */
+deprecated predicate isDeallocationExpr(Expr e) { e instanceof DeallocationExpr }

cpp/ql/lib/semmle/code/cpp/commons/NullTermination.qll

@@ -101,21 +101,6 @@ predicate functionArgumentMustBeNullTerminated(Function f, int i) {
   f instanceof StrcatFunction and i = 0
 }
 
-/**
- * Holds if `arg` is a string format argument to a formatting function call
- * `ffc`.
- */
-predicate formatArgumentMustBeNullTerminated(FormattingFunctionCall ffc, Expr arg) {
-  // String argument to a formatting function (such as `printf`)
-  exists(int n, FormatLiteral fl |
-    ffc.getConversionArgument(n) = arg and
-    fl = ffc.getFormat() and
-    fl.getConversionType(n) instanceof PointerType and // `%s`, `%ws` etc
-    not fl.getConversionType(n) instanceof VoidPointerType and // exclude: `%p`
-    not fl.hasPrecision(n) // exclude: `%.*s`
-  )
-}
-
 /**
  * Holds if `va` is a variable access where the contents must be null terminated.
  */
@@ -128,7 +113,13 @@ predicate variableMustBeNullTerminated(VariableAccess va) {
     )
     or
     // String argument to a formatting function (such as `printf`)
-    formatArgumentMustBeNullTerminated(fc, va)
+    exists(int n, FormatLiteral fl |
+      fc.(FormattingFunctionCall).getConversionArgument(n) = va and
+      fl = fc.(FormattingFunctionCall).getFormat() and
+      fl.getConversionType(n) instanceof PointerType and // `%s`, `%ws` etc
+      not fl.getConversionType(n) instanceof VoidPointerType and // exclude: `%p`
+      not fl.hasPrecision(n) // exclude: `%.*s`
+    )
     or
     // Call to a wrapper function that requires null termination
     // (not itself adding a null terminator)

cpp/ql/lib/semmle/code/cpp/commons/Printf.qll

@@ -10,22 +10,10 @@ private import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis
 private import semmle.code.cpp.rangeanalysis.RangeAnalysisUtils
 
 private newtype TBufferWriteEstimationReason =
-  TUnspecifiedEstimateReason() or
+  TNoSpecifiedEstimateReason() or
   TTypeBoundsAnalysis() or
-  TWidenedValueFlowAnalysis() or
   TValueFlowAnalysis()
 
-private predicate gradeToReason(int grade, TBufferWriteEstimationReason reason) {
-  // when combining reasons, lower grade takes precedence
-  grade = 0 and reason = TUnspecifiedEstimateReason()
-  or
-  grade = 1 and reason = TTypeBoundsAnalysis()
-  or
-  grade = 2 and reason = TWidenedValueFlowAnalysis()
-  or
-  grade = 3 and reason = TValueFlowAnalysis()
-}
-
 /**
  * A reason for a specific buffer write size estimate.
  */
@@ -44,13 +32,7 @@ abstract class BufferWriteEstimationReason extends TBufferWriteEstimationReason
    * Combine estimate reasons. Used to give a reason for the size of a format string
    * conversion given reasons coming from its individual specifiers.
    */
-  BufferWriteEstimationReason combineWith(BufferWriteEstimationReason other) {
-    exists(int grade, int otherGrade |
-      gradeToReason(grade, this) and gradeToReason(otherGrade, other)
-    |
-      if otherGrade < grade then result = other else result = this
-    )
-  }
+  abstract BufferWriteEstimationReason combineWith(BufferWriteEstimationReason other);
 }
 
 /**
@@ -58,10 +40,16 @@ abstract class BufferWriteEstimationReason extends TBufferWriteEstimationReason
  * classes derived from BufferWrite and overriding `getMaxData/0` still work with the
  * queries as intended.
  */
-class UnspecifiedEstimateReason extends BufferWriteEstimationReason, TUnspecifiedEstimateReason {
-  override string toString() { result = "UnspecifiedEstimateReason" }
+class NoSpecifiedEstimateReason extends BufferWriteEstimationReason, TNoSpecifiedEstimateReason {
+  override string toString() { result = "NoSpecifiedEstimateReason" }
 
   override string getDescription() { result = "no reason specified" }
+
+  override BufferWriteEstimationReason combineWith(BufferWriteEstimationReason other) {
+    // this reason should not be used in format specifiers, so it should not be combined
+    // with other reasons
+    none()
+  }
 }
 
 /**
@@ -72,24 +60,9 @@ class TypeBoundsAnalysis extends BufferWriteEstimationReason, TTypeBoundsAnalysi
   override string toString() { result = "TypeBoundsAnalysis" }
 
   override string getDescription() { result = "based on type bounds" }
-}
 
-/**
- * The estimation comes from non trivial bounds found via actual flow analysis,
- * but a widening aproximation might have been used for variables in loops.
- * For example
- * ```
- * for (int i = 0; i < 10; ++i) {
- *    int j = i + i;
- *    //...  <- estimation done here based on j
- * }
- * ```
- */
-class WidenedValueFlowAnalysis extends BufferWriteEstimationReason, TWidenedValueFlowAnalysis {
-  override string toString() { result = "WidenedValueFlowAnalysis" }
-
-  override string getDescription() {
-    result = "based on flow analysis of value bounds with a widening approximation"
+  override BufferWriteEstimationReason combineWith(BufferWriteEstimationReason other) {
+    other != TNoSpecifiedEstimateReason() and result = TTypeBoundsAnalysis()
   }
 }
 
@@ -107,6 +80,10 @@ class ValueFlowAnalysis extends BufferWriteEstimationReason, TValueFlowAnalysis
   override string toString() { result = "ValueFlowAnalysis" }
 
   override string getDescription() { result = "based on flow analysis of value bounds" }
+
+  override BufferWriteEstimationReason combineWith(BufferWriteEstimationReason other) {
+    other != TNoSpecifiedEstimateReason() and result = other
+  }
 }
 
 class PrintfFormatAttribute extends FormatAttribute {
@@ -207,6 +184,26 @@ predicate variadicFormatter(Function f, string type, int formatParamIndex, int o
   callsVariadicFormatter(f, type, formatParamIndex, outputParamIndex)
 }
 
+/**
+ * A standard function such as `vprintf` that has a format parameter
+ * and a variable argument list of type `va_arg`.
+ *
+ * DEPRECATED: Use the four argument version instead.
+ */
+deprecated predicate primitiveVariadicFormatter(TopLevelFunction f, int formatParamIndex) {
+  primitiveVariadicFormatter(f, _, formatParamIndex, _)
+}
+
+/**
+ * Holds if `f` is a function such as `vprintf` that has a format parameter
+ * (at `formatParamIndex`) and a variable argument list of type `va_arg`.
+ *
+ * DEPRECATED: Use the four argument version instead.
+ */
+deprecated predicate variadicFormatter(Function f, int formatParamIndex) {
+  variadicFormatter(f, _, formatParamIndex, _)
+}
+
 /**
  * A function not in the standard library which takes a `printf`-like formatting
  * string and a variable number of arguments.
@@ -362,38 +359,6 @@ private int lengthInBase10(float f) {
   result = f.log10().floor() + 1
 }
 
-pragma[nomagic]
-private predicate isPointerTypeWithBase(Type base, PointerType pt) { base = pt.getBaseType() }
-
-bindingset[expr]
-private BufferWriteEstimationReason getEstimationReasonForIntegralExpression(Expr expr) {
-  // we consider the range analysis non trivial if it
-  // * constrained non-trivially both sides of a signed value, or
-  // * constrained non-trivially the positive side of an unsigned value
-  // expr should already be given as getFullyConverted
-  if
-    upperBound(expr) < exprMaxVal(expr) and
-    (exprMinVal(expr) >= 0 or lowerBound(expr) > exprMinVal(expr))
-  then
-    // next we check whether the estimate may have been widened
-    if upperBoundMayBeWidened(expr)
-    then result = TWidenedValueFlowAnalysis()
-    else result = TValueFlowAnalysis()
-  else result = TTypeBoundsAnalysis()
-}
-
-/**
- * Gets the number of hex digits required to represent the integer represented by `f`.
- *
- * `f` is assumed to be nonnegative.
- */
-bindingset[f]
-private int lengthInBase16(float f) {
-  f = 0 and result = 1
-  or
-  result = (f.log2() / 4.0).floor() + 1
-}
-
 /**
  * A class to represent format strings that occur as arguments to invocations of formatting functions.
  */
@@ -408,6 +373,13 @@ class FormatLiteral extends Literal {
    */
   FormattingFunctionCall getUse() { result.getFormat() = this }
 
+  /**
+   * Holds if the default meaning of `%s` is a `wchar_t *`, rather than
+   * a `char *` (either way, `%S` will have the opposite meaning).
+   * DEPRECATED: Use getDefaultCharType() instead.
+   */
+  deprecated predicate isWideCharDefault() { this.getUse().getTarget().isWideCharDefault() }
+
   /**
    * Gets the default character type expected for `%s` by this format literal.  Typically
    * `char` or `wchar_t`.
@@ -938,19 +910,19 @@ class FormatLiteral extends Literal {
       (
         conv = ["s", "S"] and
         len = "h" and
-        isPointerTypeWithBase(any(PlainCharType plainCharType), result)
+        result.(PointerType).getBaseType() instanceof PlainCharType
         or
         conv = ["s", "S"] and
         len = ["l", "w"] and
-        isPointerTypeWithBase(this.getWideCharType(), result)
+        result.(PointerType).getBaseType() = this.getWideCharType()
         or
         conv = "s" and
         (len != "l" and len != "w" and len != "h") and
-        isPointerTypeWithBase(this.getDefaultCharType(), result)
+        result.(PointerType).getBaseType() = this.getDefaultCharType()
         or
         conv = "S" and
         (len != "l" and len != "w" and len != "h") and
-        isPointerTypeWithBase(this.getNonDefaultCharType(), result)
+        result.(PointerType).getBaseType() = this.getNonDefaultCharType()
       )
     )
   }
@@ -1095,7 +1067,7 @@ class FormatLiteral extends Literal {
    * conversion specifier of this format string; has no result if this cannot
    * be determined.
    */
-  int getMaxConvertedLength(int n) { result = max(this.getMaxConvertedLength(n, _)) }
+  int getMaxConvertedLength(int n) { result = max(getMaxConvertedLength(n, _)) }
 
   /**
    * Gets the maximum length of the string that can be produced by the nth
@@ -1185,10 +1157,12 @@ class FormatLiteral extends Literal {
             1 + lengthInBase10(2.pow(this.getIntegralDisplayType(n).getSize() * 8 - 1)) and
           // The second case uses range analysis to deduce a length that's shorter than the length
           // of the number -2^31.
-          exists(Expr arg, float lower, float upper |
+          exists(Expr arg, float lower, float upper, float typeLower, float typeUpper |
             arg = this.getUse().getConversionArgument(n) and
             lower = lowerBound(arg.getFullyConverted()) and
-            upper = upperBound(arg.getFullyConverted())
+            upper = upperBound(arg.getFullyConverted()) and
+            typeLower = exprMinVal(arg.getFullyConverted()) and
+            typeUpper = exprMaxVal(arg.getFullyConverted())
           |
             valueBasedBound =
               max(int cand |
@@ -1205,9 +1179,11 @@ class FormatLiteral extends Literal {
                   else cand = lengthInBase10(upper)
                 )
               ) and
-            // we don't want to call this on `arg.getFullyConverted()` as we want
-            // to detect non-trivial range analysis without taking into account up-casting
-            reason = getEstimationReasonForIntegralExpression(arg)
+            (
+              if lower > typeLower or upper < typeUpper
+              then reason = TValueFlowAnalysis()
+              else reason = TTypeBoundsAnalysis()
+            )
           ) and
           len = valueBasedBound.minimum(typeBasedBound)
         )
@@ -1219,40 +1195,6 @@ class FormatLiteral extends Literal {
           typeBasedBound = lengthInBase10(2.pow(this.getIntegralDisplayType(n).getSize() * 8) - 1) and
           // The second case uses range analysis to deduce a length that's shorter than
           // the length of the number 2^31 - 1.
-          exists(Expr arg, float lower, float upper |
-            arg = this.getUse().getConversionArgument(n) and
-            lower = lowerBound(arg.getFullyConverted()) and
-            upper = upperBound(arg.getFullyConverted())
-          |
-            valueBasedBound =
-              lengthInBase10(max(float cand |
-                  // If lower can be negative we use `(unsigned)-1` as the candidate value.
-                  lower < 0 and
-                  cand = 2.pow(any(IntType t | t.isUnsigned()).getSize() * 8)
-                  or
-                  cand = upper
-                )) and
-            // we don't want to call this on `arg.getFullyConverted()` as we want
-            // to detect non-trivial range analysis without taking into account up-casting
-            reason = getEstimationReasonForIntegralExpression(arg)
-          ) and
-          len = valueBasedBound.minimum(typeBasedBound)
-        )
-        or
-        this.getConversionChar(n).toLowerCase() = "x" and
-        // e.g. "12345678"
-        exists(int baseLen, int typeBasedBound, int valueBasedBound |
-          typeBasedBound =
-            min(int digits |
-              digits = 2 * this.getIntegralDisplayType(n).getSize()
-              or
-              exists(IntegralType t |
-                t = this.getUse().getConversionArgument(n).getType().getUnderlyingType()
-              |
-                t.isUnsigned() and
-                digits = 2 * t.getSize()
-              )
-            ) and
           exists(Expr arg, float lower, float upper, float typeLower, float typeUpper |
             arg = this.getUse().getConversionArgument(n) and
             lower = lowerBound(arg.getFullyConverted()) and
@@ -1261,7 +1203,7 @@ class FormatLiteral extends Literal {
             typeUpper = exprMaxVal(arg.getFullyConverted())
           |
             valueBasedBound =
-              lengthInBase16(max(float cand |
+              lengthInBase10(max(float cand |
                   // If lower can be negative we use `(unsigned)-1` as the candidate value.
                   lower < 0 and
                   cand = 2.pow(any(IntType t | t.isUnsigned()).getSize() * 8)
@@ -1274,10 +1216,29 @@ class FormatLiteral extends Literal {
               else reason = TTypeBoundsAnalysis()
             )
           ) and
-          baseLen = valueBasedBound.minimum(typeBasedBound) and
-          if this.hasAlternateFlag(n) then len = 2 + baseLen else len = baseLen // "0x"
+          len = valueBasedBound.minimum(typeBasedBound)
         )
         or
+        this.getConversionChar(n).toLowerCase() = "x" and
+        // e.g. "12345678"
+        exists(int sizeBytes, int baseLen |
+          sizeBytes =
+            min(int bytes |
+              bytes = this.getIntegralDisplayType(n).getSize()
+              or
+              exists(IntegralType t |
+                t = this.getUse().getConversionArgument(n).getType().getUnderlyingType()
+              |
+                t.isUnsigned() and bytes = t.getSize()
+              )
+            ) and
+          baseLen = sizeBytes * 2 and
+          (
+            if this.hasAlternateFlag(n) then len = 2 + baseLen else len = baseLen // "0x"
+          )
+        ) and
+        reason = TTypeBoundsAnalysis()
+        or
         this.getConversionChar(n).toLowerCase() = "p" and
         exists(PointerType ptrType, int baseLen |
           ptrType = this.getFullyConverted().getType() and
@@ -1326,7 +1287,7 @@ class FormatLiteral extends Literal {
    * determining whether a buffer overflow is caused by long float to string
    * conversions.
    */
-  int getMaxConvertedLengthLimited(int n) { result = max(this.getMaxConvertedLengthLimited(n, _)) }
+  int getMaxConvertedLengthLimited(int n) { result = max(getMaxConvertedLengthLimited(n, _)) }
 
   /**
    * Gets the maximum length of the string that can be produced by the nth

cpp/ql/lib/semmle/code/cpp/commons/unix/Constants.qll

@@ -11,10 +11,10 @@ import cpp
  */
 bindingset[input]
 int parseOctal(string input) {
-  input.regexpMatch("0[0-7]+") and
+  input.charAt(0) = "0" and
   result =
     strictsum(int ix |
-      ix in [1 .. input.length()]
+      ix in [0 .. input.length()]
     |
       8.pow(input.length() - (ix + 1)) * input.charAt(ix).toInt()
     )

cpp/ql/lib/semmle/code/cpp/controlflow/BasicBlocks.qll

@@ -223,6 +223,20 @@ class BasicBlock extends ControlFlowNodeBase {
    */
   predicate inLoop() { this.getASuccessor+() = this }
 
+  /**
+   * DEPRECATED since version 1.11: this predicate does not match the standard
+   * definition of _loop header_.
+   *
+   * Holds if this basic block is in a loop of the control-flow graph and
+   * additionally has an incoming edge that is not part of any loop containing
+   * this basic block. A typical example would be the basic block that computes
+   * `x > 0` in an outermost loop `while (x > 0) { ... }`.
+   */
+  deprecated predicate isLoopHeader() {
+    this.inLoop() and
+    exists(BasicBlock pred | pred = this.getAPredecessor() and not pred = this.getASuccessor+())
+  }
+
   /**
    * Holds if control flow may reach this basic block from a function entry
    * point or any handler of a reachable `try` statement.

cpp/ql/lib/semmle/code/cpp/controlflow/ControlFlowGraph.qll

@@ -94,6 +94,24 @@ import ControlFlowGraphPublic
  */
 class ControlFlowNodeBase extends ElementBase, @cfgnode { }
 
+/**
+ * DEPRECATED: Use `ControlFlowNode.getATrueSuccessor()` instead.
+ * Holds when `n2` is a control-flow node such that the control-flow
+ * edge `(n1, n2)` may be taken when `n1` is an expression that is true.
+ */
+deprecated predicate truecond_base(ControlFlowNodeBase n1, ControlFlowNodeBase n2) {
+  qlCFGTrueSuccessor(n1, n2)
+}
+
+/**
+ * DEPRECATED: Use `ControlFlowNode.getAFalseSuccessor()` instead.
+ * Holds when `n2` is a control-flow node such that the control-flow
+ * edge `(n1, n2)` may be taken when `n1` is an expression that is false.
+ */
+deprecated predicate falsecond_base(ControlFlowNodeBase n1, ControlFlowNodeBase n2) {
+  qlCFGFalseSuccessor(n1, n2)
+}
+
 /**
  * An abstract class that can be extended to add additional edges to the
  * control-flow graph. Instances of this class correspond to the source nodes

cpp/ql/lib/semmle/code/cpp/controlflow/IRGuards.qll

@@ -29,7 +29,7 @@ class GuardCondition extends Expr {
     exists(IRGuardCondition ir | this = ir.getUnconvertedResultExpression())
     or
     // no binary operators in the IR
-    this.(BinaryLogicalOperation).getAnOperand() instanceof GuardCondition
+    exists(GuardCondition gc | this.(BinaryLogicalOperation).getAnOperand() = gc)
     or
     // the IR short-circuits if(!x)
     // don't produce a guard condition for `y = !x` and other non-short-circuited cases
@@ -98,7 +98,7 @@ class GuardCondition extends Expr {
  */
 private class GuardConditionFromBinaryLogicalOperator extends GuardCondition {
   GuardConditionFromBinaryLogicalOperator() {
-    this.(BinaryLogicalOperation).getAnOperand() instanceof GuardCondition
+    exists(GuardCondition gc | this.(BinaryLogicalOperation).getAnOperand() = gc)
   }
 
   override predicate controls(BasicBlock controlled, boolean testIsTrue) {

cpp/ql/lib/semmle/code/cpp/controlflow/LocalScopeVariableReachability.qll

@@ -0,0 +1,393 @@
+/**
+ * DEPRECATED: Use `StackVariableReachability` instead.
+ */
+
+import cpp
+
+/**
+ * DEPRECATED: Use `StackVariableReachability` instead.
+ *
+ * A reachability analysis for control-flow nodes involving stack variables.
+ * This defines sources, sinks, and any other configurable aspect of the
+ * analysis. Multiple analyses can coexist. To create an analysis, extend this
+ * class with a subclass whose characteristic predicate is a unique singleton
+ * string. For example, write
+ *
+ * ```
+ * class MyAnalysisConfiguration extends LocalScopeVariableReachability {
+ *   MyAnalysisConfiguration() { this = "MyAnalysisConfiguration" }
+ *   // Override `isSource` and `isSink`.
+ *   // Override `isBarrier`.
+ * }
+ * ```
+ *
+ * Then, to query whether there is flow between some source and sink, call the
+ * `reaches` predicate on an instance of `MyAnalysisConfiguration`.
+ */
+abstract deprecated class LocalScopeVariableReachability extends string {
+  bindingset[this]
+  LocalScopeVariableReachability() { length() >= 0 }
+
+  /** Holds if `node` is a source for the reachability analysis using variable `v`. */
+  abstract predicate isSource(ControlFlowNode node, LocalScopeVariable v);
+
+  /** Holds if `sink` is a (potential) sink for the reachability analysis using variable `v`. */
+  abstract predicate isSink(ControlFlowNode node, LocalScopeVariable v);
+
+  /** Holds if `node` is a barrier for the reachability analysis using variable `v`. */
+  abstract predicate isBarrier(ControlFlowNode node, LocalScopeVariable v);
+
+  /**
+   * Holds if the source node `source` can reach the sink `sink` without crossing
+   * a barrier. This is (almost) equivalent to the following QL predicate but
+   * uses basic blocks internally for better performance:
+   *
+   * ```
+   * predicate reaches(ControlFlowNode source, SemanticStackVariable v, ControlFlowNode sink) {
+   *   reachesImpl(source, v, sink)
+   *   and
+   *   isSink(sink, v)
+   * }
+   *
+   * predicate reachesImpl(ControlFlowNode source, SemanticStackVariable v, ControlFlowNode sink) {
+   *   sink = source.getASuccessor() and isSource(source, v)
+   *   or
+   *   exists(ControlFlowNode mid | reachesImpl(source, v, mid) |
+   *     not isBarrier(mid, v)
+   *     and
+   *     sink = mid.getASuccessor()
+   *   )
+   * }
+   * ```
+   *
+   * In addition to using a better performing implementation, this analysis
+   * accounts for loops where the condition is provably true upon entry.
+   */
+  predicate reaches(ControlFlowNode source, SemanticStackVariable v, ControlFlowNode sink) {
+    /*
+     * Implementation detail: the predicates in this class are a generalization of
+     * those in DefinitionsAndUses.qll, and should be kept in sync.
+     *
+     * Unfortunately, caching of abstract predicates does not work well, so the
+     * predicates in DefinitionsAndUses.qll cannot use this library.
+     */
+
+    exists(BasicBlock bb, int i |
+      this.isSource(source, v) and
+      bb.getNode(i) = source and
+      not bb.isUnreachable()
+    |
+      exists(int j |
+        j > i and
+        sink = bb.getNode(j) and
+        this.isSink(sink, v) and
+        not exists(int k | this.isBarrier(bb.getNode(k), v) | k in [i + 1 .. j - 1])
+      )
+      or
+      not exists(int k | this.isBarrier(bb.getNode(k), v) | k > i) and
+      this.bbSuccessorEntryReaches(bb, v, sink, _)
+    )
+  }
+
+  private predicate bbSuccessorEntryReaches(
+    BasicBlock bb, SemanticStackVariable v, ControlFlowNode node,
+    boolean skipsFirstLoopAlwaysTrueUponEntry
+  ) {
+    exists(BasicBlock succ, boolean succSkipsFirstLoopAlwaysTrueUponEntry |
+      bbSuccessorEntryReachesLoopInvariant(bb, succ, skipsFirstLoopAlwaysTrueUponEntry,
+        succSkipsFirstLoopAlwaysTrueUponEntry)
+    |
+      this.bbEntryReachesLocally(succ, v, node) and
+      succSkipsFirstLoopAlwaysTrueUponEntry = false
+      or
+      not this.isBarrier(succ.getNode(_), v) and
+      this.bbSuccessorEntryReaches(succ, v, node, succSkipsFirstLoopAlwaysTrueUponEntry)
+    )
+  }
+
+  private predicate bbEntryReachesLocally(
+    BasicBlock bb, SemanticStackVariable v, ControlFlowNode node
+  ) {
+    exists(int n |
+      node = bb.getNode(n) and
+      this.isSink(node, v)
+    |
+      not exists(this.firstBarrierIndexIn(bb, v))
+      or
+      n <= this.firstBarrierIndexIn(bb, v)
+    )
+  }
+
+  private int firstBarrierIndexIn(BasicBlock bb, SemanticStackVariable v) {
+    result = min(int m | this.isBarrier(bb.getNode(m), v))
+  }
+}
+
+/**
+ * Holds if `bb` contains the entry point `loop` for a loop at position `i`.
+ * The condition of that loop is provably true upon entry but not provably
+ * true in general (if it were, the false-successor had already been removed
+ * from the CFG).
+ *
+ * Examples:
+ * ```
+ * for (int i = 0; i < 2; i++) { } // always true upon entry
+ * for (int i = 0; true; i++) { } // always true
+ * ```
+ */
+private predicate bbLoopEntryConditionAlwaysTrueAt(BasicBlock bb, int i, ControlFlowNode loop) {
+  exists(Expr condition |
+    loopConditionAlwaysTrueUponEntry(loop, condition) and
+    not conditionAlwaysTrue(condition) and
+    bb.getNode(i) = loop
+  )
+}
+
+/**
+ * Basic block `pred` contains all or part of the condition belonging to a loop,
+ * and there is an edge from `pred` to `succ` that concludes the condition.
+ * If the edge corrseponds with the loop condition being found to be `true`, then
+ * `skipsLoop` is `false`.  Otherwise the edge corresponds with the loop condition
+ * being found to be `false` and `skipsLoop` is `true`.  Non-concluding edges
+ * within a complex loop condition are not matched by this predicate.
+ */
+private predicate bbLoopConditionAlwaysTrueUponEntrySuccessor(
+  BasicBlock pred, BasicBlock succ, boolean skipsLoop
+) {
+  exists(Expr cond |
+    loopConditionAlwaysTrueUponEntry(_, cond) and
+    cond.getAChild*() = pred.getEnd() and
+    succ = pred.getASuccessor() and
+    not cond.getAChild*() = succ.getStart() and
+    (
+      succ = pred.getAFalseSuccessor() and
+      skipsLoop = true
+      or
+      succ = pred.getATrueSuccessor() and
+      skipsLoop = false
+    )
+  )
+}
+
+/**
+ * Loop invariant for `bbSuccessorEntryReaches`:
+ *
+ * - `succ` is a successor of `pred`.
+ * - `predSkipsFirstLoopAlwaysTrueUponEntry`: whether the path from
+ * `pred` (via `succ`) skips the first loop where the condition is
+ * provably true upon entry.
+ * - `succSkipsFirstLoopAlwaysTrueUponEntry`: whether the path from
+ * `succ` skips the first loop where the condition is provably true
+ * upon entry.
+ * - If `pred` contains the entry point of a loop where the condition
+ * is provably true upon entry, then `succ` is not allowed to skip
+ * that loop (`succSkipsFirstLoopAlwaysTrueUponEntry = false`).
+ */
+predicate bbSuccessorEntryReachesLoopInvariant(
+  BasicBlock pred, BasicBlock succ, boolean predSkipsFirstLoopAlwaysTrueUponEntry,
+  boolean succSkipsFirstLoopAlwaysTrueUponEntry
+) {
+  succ = pred.getASuccessor() and
+  (succSkipsFirstLoopAlwaysTrueUponEntry = true or succSkipsFirstLoopAlwaysTrueUponEntry = false) and
+  (
+    // The edge from `pred` to `succ` is from a loop condition provably
+    // true upon entry, so the value of `predSkipsFirstLoopAlwaysTrueUponEntry`
+    // is determined by whether the true edge or the false edge is chosen,
+    // regardless of the value of `succSkipsFirstLoopAlwaysTrueUponEntry`.
+    bbLoopConditionAlwaysTrueUponEntrySuccessor(pred, succ, predSkipsFirstLoopAlwaysTrueUponEntry)
+    or
+    // The edge from `pred` to `succ` is _not_ from a loop condition provably
+    // true upon entry, so the values of `predSkipsFirstLoopAlwaysTrueUponEntry`
+    // and `succSkipsFirstLoopAlwaysTrueUponEntry` must be the same.
+    not bbLoopConditionAlwaysTrueUponEntrySuccessor(pred, succ, _) and
+    succSkipsFirstLoopAlwaysTrueUponEntry = predSkipsFirstLoopAlwaysTrueUponEntry and
+    // Moreover, if `pred` contains the entry point of a loop where the
+    // condition is provably true upon entry, then `succ` is not allowed
+    // to skip that loop, and hence `succSkipsFirstLoopAlwaysTrueUponEntry = false`.
+    (
+      bbLoopEntryConditionAlwaysTrueAt(pred, _, _)
+      implies
+      succSkipsFirstLoopAlwaysTrueUponEntry = false
+    )
+  )
+}
+
+/**
+ * DEPRECATED: Use `StackVariableReachabilityWithReassignment` instead.
+ *
+ * Reachability analysis for control-flow nodes involving stack variables.
+ * Unlike `LocalScopeVariableReachability`, this analysis takes variable
+ * reassignments into account.
+ *
+ * This class is used like `LocalScopeVariableReachability`, except that
+ * subclasses should override `isSourceActual` and `isSinkActual` instead of
+ * `isSource` and `isSink`, and that there is a `reachesTo` predicate in
+ * addition to `reaches`.
+ */
+abstract deprecated class LocalScopeVariableReachabilityWithReassignment extends LocalScopeVariableReachability {
+  bindingset[this]
+  LocalScopeVariableReachabilityWithReassignment() { length() >= 0 }
+
+  /** Override this predicate rather than `isSource` (`isSource` is used internally). */
+  abstract predicate isSourceActual(ControlFlowNode node, LocalScopeVariable v);
+
+  /** Override this predicate rather than `isSink` (`isSink` is used internally). */
+  abstract predicate isSinkActual(ControlFlowNode node, LocalScopeVariable v);
+
+  /**
+   * Holds if the source node `source` can reach the sink `sink` without crossing
+   * a barrier, taking reassignments into account. This is (almost) equivalent
+   * to the following QL predicate, but uses basic blocks internally for better
+   * performance:
+   *
+   * ```
+   * predicate reaches(ControlFlowNode source, SemanticStackVariable v, ControlFlowNode sink) {
+   *   reachesImpl(source, v, sink)
+   *   and
+   *   isSinkActual(sink, v)
+   * }
+   *
+   * predicate reachesImpl(ControlFlowNode source, SemanticStackVariable v, ControlFlowNode sink) {
+   *   isSourceActual(source, v)
+   *   and
+   *   (
+   *     sink = source.getASuccessor()
+   *     or
+   *     exists(ControlFlowNode mid, SemanticStackVariable v0 | reachesImpl(source, v0, mid) |
+   *       // ordinary successor
+   *       not isBarrier(mid, v) and
+   *       sink = mid.getASuccessor() and
+   *       v = v0
+   *       or
+   *       // reassigned from v0 to v
+   *       exprDefinition(v, mid, v0.getAnAccess()) and
+   *       sink = mid.getASuccessor()
+   *     )
+   *   )
+   * }
+   * ```
+   *
+   * In addition to using a better performing implementation, this analysis
+   * accounts for loops where the condition is provably true upon entry.
+   */
+  override predicate reaches(ControlFlowNode source, SemanticStackVariable v, ControlFlowNode sink) {
+    this.reachesTo(source, v, sink, _)
+  }
+
+  /**
+   * As `reaches`, but also specifies the last variable it was reassigned to (`v0`).
+   */
+  predicate reachesTo(
+    ControlFlowNode source, SemanticStackVariable v, ControlFlowNode sink, SemanticStackVariable v0
+  ) {
+    exists(ControlFlowNode def |
+      this.actualSourceReaches(source, v, def, v0) and
+      LocalScopeVariableReachability.super.reaches(def, v0, sink) and
+      this.isSinkActual(sink, v0)
+    )
+  }
+
+  private predicate actualSourceReaches(
+    ControlFlowNode source, SemanticStackVariable v, ControlFlowNode def, SemanticStackVariable v0
+  ) {
+    this.isSourceActual(source, v) and def = source and v0 = v
+    or
+    exists(ControlFlowNode source1, SemanticStackVariable v1 |
+      this.actualSourceReaches(source, v, source1, v1)
+    |
+      this.reassignment(source1, v1, def, v0)
+    )
+  }
+
+  private predicate reassignment(
+    ControlFlowNode source, SemanticStackVariable v, ControlFlowNode def, SemanticStackVariable v0
+  ) {
+    LocalScopeVariableReachability.super.reaches(source, v, def) and
+    exprDefinition(v0, def, v.getAnAccess())
+  }
+
+  final override predicate isSource(ControlFlowNode node, LocalScopeVariable v) {
+    this.isSourceActual(node, v)
+    or
+    // Reassignment generates a new (non-actual) source
+    this.reassignment(_, _, node, v)
+  }
+
+  final override predicate isSink(ControlFlowNode node, LocalScopeVariable v) {
+    this.isSinkActual(node, v)
+    or
+    // Reassignment generates a new (non-actual) sink
+    exprDefinition(_, node, v.getAnAccess())
+  }
+}
+
+/**
+ * DEPRECATED: Use `StackVariableReachabilityExt` instead.
+ *
+ * Same as `LocalScopeVariableReachability`, but `isBarrier` works on control-flow
+ * edges rather than nodes and is therefore parameterized by the original
+ * source node as well. Otherwise, this class is used like
+ * `LocalScopeVariableReachability`.
+ */
+abstract deprecated class LocalScopeVariableReachabilityExt extends string {
+  bindingset[this]
+  LocalScopeVariableReachabilityExt() { length() >= 0 }
+
+  /** `node` is a source for the reachability analysis using variable `v`. */
+  abstract predicate isSource(ControlFlowNode node, LocalScopeVariable v);
+
+  /** `sink` is a (potential) sink for the reachability analysis using variable `v`. */
+  abstract predicate isSink(ControlFlowNode node, LocalScopeVariable v);
+
+  /** `node` is a barrier for the reachability analysis using variable `v` and starting from `source`. */
+  abstract predicate isBarrier(
+    ControlFlowNode source, ControlFlowNode node, ControlFlowNode next, LocalScopeVariable v
+  );
+
+  /** See `LocalScopeVariableReachability.reaches`. */
+  predicate reaches(ControlFlowNode source, SemanticStackVariable v, ControlFlowNode sink) {
+    exists(BasicBlock bb, int i |
+      this.isSource(source, v) and
+      bb.getNode(i) = source and
+      not bb.isUnreachable()
+    |
+      exists(int j |
+        j > i and
+        sink = bb.getNode(j) and
+        this.isSink(sink, v) and
+        not exists(int k | this.isBarrier(source, bb.getNode(k), bb.getNode(k + 1), v) |
+          k in [i .. j - 1]
+        )
+      )
+      or
+      not exists(int k | this.isBarrier(source, bb.getNode(k), bb.getNode(k + 1), v) | k >= i) and
+      this.bbSuccessorEntryReaches(source, bb, v, sink, _)
+    )
+  }
+
+  private predicate bbSuccessorEntryReaches(
+    ControlFlowNode source, BasicBlock bb, SemanticStackVariable v, ControlFlowNode node,
+    boolean skipsFirstLoopAlwaysTrueUponEntry
+  ) {
+    exists(BasicBlock succ, boolean succSkipsFirstLoopAlwaysTrueUponEntry |
+      bbSuccessorEntryReachesLoopInvariant(bb, succ, skipsFirstLoopAlwaysTrueUponEntry,
+        succSkipsFirstLoopAlwaysTrueUponEntry) and
+      not this.isBarrier(source, bb.getEnd(), succ.getStart(), v)
+    |
+      this.bbEntryReachesLocally(source, succ, v, node) and
+      succSkipsFirstLoopAlwaysTrueUponEntry = false
+      or
+      not exists(int k | this.isBarrier(source, succ.getNode(k), succ.getNode(k + 1), v)) and
+      this.bbSuccessorEntryReaches(source, succ, v, node, succSkipsFirstLoopAlwaysTrueUponEntry)
+    )
+  }
+
+  private predicate bbEntryReachesLocally(
+    ControlFlowNode source, BasicBlock bb, SemanticStackVariable v, ControlFlowNode node
+  ) {
+    this.isSource(source, v) and
+    exists(int n | node = bb.getNode(n) and this.isSink(node, v) |
+      not exists(int m | m < n | this.isBarrier(source, bb.getNode(m), bb.getNode(m + 1), v))
+    )
+  }
+}

cpp/ql/lib/semmle/code/cpp/controlflow/Nullness.qll

@@ -156,6 +156,15 @@ class AnalysedExpr extends Expr {
     this.isValidCheck(v) and result = this.getATrueSuccessor()
   }
 
+  /**
+   * DEPRECATED: Use `getNonNullSuccessor` instead, which does the same.
+   */
+  deprecated ControlFlowNode getValidSuccessor(LocalScopeVariable v) {
+    this.isValidCheck(v) and result = this.getATrueSuccessor()
+    or
+    this.isNullCheck(v) and result = this.getAFalseSuccessor()
+  }
+
   /**
    * Holds if this is a `VariableAccess` of `v` nested inside a condition.
    */

cpp/ql/lib/semmle/code/cpp/controlflow/SSA.qll

@@ -147,4 +147,15 @@ class SsaDefinition extends ControlFlowNodeBase {
   Expr getAnUltimateDefiningValue(StackVariable v) {
     result = this.getAnUltimateSsaDefinition(v).getDefiningValue(v)
   }
+
+  /**
+   * DEPRECATED: this is the old name for `getAnUltimateDefiningValue`. The
+   * name was confusing as it seemed analogous to `getDefinition` rather than
+   * `getDefiningValue`. The SSA libraries for other languages use the name
+   * `getAnUltimateSsaDefinition` to refer to a predicate named
+   * `getAnUltimateSsaDefinition` in this class.
+   */
+  deprecated Expr getAnUltimateDefinition(StackVariable v) {
+    result = this.getAnUltimateDefiningValue(v)
+  }
 }

cpp/ql/lib/semmle/code/cpp/dataflow/TaintTracking.qll

@@ -21,4 +21,9 @@ import semmle.code.cpp.dataflow.DataFlow2
 module TaintTracking {
   import semmle.code.cpp.dataflow.internal.tainttracking1.TaintTrackingImpl
   private import semmle.code.cpp.dataflow.TaintTracking2
+
+  /**
+   * DEPRECATED: Use TaintTracking2::Configuration instead.
+   */
+  deprecated class Configuration2 = TaintTracking2::Configuration;
 }

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplCommon.qll

@@ -3,17 +3,6 @@ private import DataFlowImplSpecific::Public
 import Cached
 
 module DataFlowImplCommonPublic {
-  /** A state value to track during data flow. */
-  class FlowState = string;
-
-  /**
-   * The default state, which is used when the state is unspecified for a source
-   * or a sink.
-   */
-  class FlowStateEmpty extends FlowState {
-    FlowStateEmpty() { this = "" }
-  }
-
   private newtype TFlowFeature =
     TFeatureHasSourceCallContext() or
     TFeatureHasSinkCallContext() or
@@ -1290,7 +1279,7 @@ class DataFlowCallOption extends TDataFlowCallOption {
   }
 }
 
-/** A `Content` tagged with the type of a containing object. */
+/** Content tagged with the type of a containing object. */
 class TypedContent extends MkTypedContent {
   private Content c;
   private DataFlowType t;

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowPrivate.qll

@@ -48,7 +48,7 @@ private class Argument extends Expr {
  */
 class ArgumentNode extends Node {
   ArgumentNode() {
-    this.asExpr() instanceof Argument or
+    exists(Argument arg | this.asExpr() = arg) or
     this = getInstanceArgument(_)
   }
 

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll

@@ -592,14 +592,12 @@ predicate simpleLocalFlowStep(Node nodeFrom, Node nodeTo) {
  * Holds if data flows from `source` to `sink` in zero or more local
  * (intra-procedural) steps.
  */
-pragma[inline]
 predicate localFlow(Node source, Node sink) { localFlowStep*(source, sink) }
 
 /**
  * Holds if data can flow from `e1` to `e2` in zero or more
  * local (intra-procedural) steps.
  */
-pragma[inline]
 predicate localExprFlow(Expr e1, Expr e2) { localFlow(exprNode(e1), exprNode(e2)) }
 
 /**

cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowVar.qll

@@ -113,6 +113,10 @@ private module PartialDefinitions {
   abstract class PartialDefinition extends Expr {
     ControlFlowNode node;
 
+    abstract deprecated predicate partiallyDefines(Variable v);
+
+    abstract deprecated predicate partiallyDefinesThis(ThisExpr e);
+
     /**
      * Gets the subBasicBlock where this `PartialDefinition` is defined.
      */
@@ -185,6 +189,10 @@ private module PartialDefinitions {
       )
     }
 
+    deprecated override predicate partiallyDefines(Variable v) { v = collection }
+
+    deprecated override predicate partiallyDefinesThis(ThisExpr e) { none() }
+
     override predicate definesExpressions(Expr inner, Expr outer) {
       inner = innerDefinedExpr and
       outer = this
@@ -209,6 +217,12 @@ private module PartialDefinitions {
 
     VariablePartialDefinition() { innerDefinedExpr = getInnerDefinedExpr(this, node) }
 
+    deprecated override predicate partiallyDefines(Variable v) {
+      innerDefinedExpr = v.getAnAccess()
+    }
+
+    deprecated override predicate partiallyDefinesThis(ThisExpr e) { innerDefinedExpr = e }
+
     /**
      * Holds if this partial definition may modify `inner` (or what it points
      * to) through `outer`. These expressions will never be `Conversion`s.
@@ -339,9 +353,9 @@ module FlowVar_internal {
         // indirection.
         result = def.getAUse(v)
         or
-        exists(SsaDefinition descendantDef |
-          this.getASuccessorSsaVar+() = TSsaVar(descendantDef, _) and
-          result = descendantDef.getAUse(v)
+        exists(SsaDefinition descendentDef |
+          this.getASuccessorSsaVar+() = TSsaVar(descendentDef, _) and
+          result = descendentDef.getAUse(v)
         )
       )
       or

cpp/ql/lib/semmle/code/cpp/dataflow/internal/TaintTrackingUtil.qll

@@ -47,12 +47,6 @@ predicate defaultImplicitTaintRead(DataFlow::Node node, DataFlow::Content c) { n
  */
 predicate defaultTaintSanitizer(DataFlow::Node node) { none() }
 
-/**
- * Holds if `guard` should be a sanitizer guard in all global taint flow configurations
- * but not in local taint.
- */
-predicate defaultTaintSanitizerGuard(DataFlow::BarrierGuard guard) { none() }
-
 /**
  * Holds if taint can flow in one local step from `nodeFrom` to `nodeTo` excluding
  * local data flow steps. That is, `nodeFrom` and `nodeTo` are likely to represent
@@ -124,14 +118,12 @@ predicate localAdditionalTaintStep(DataFlow::Node nodeFrom, DataFlow::Node nodeT
  * Holds if taint may propagate from `source` to `sink` in zero or more local
  * (intra-procedural) steps.
  */
-pragma[inline]
 predicate localTaint(DataFlow::Node source, DataFlow::Node sink) { localTaintStep*(source, sink) }
 
 /**
  * Holds if taint can flow from `e1` to `e2` in zero or more
  * local (intra-procedural) steps.
  */
-pragma[inline]
 predicate localExprTaint(Expr e1, Expr e2) {
   localTaint(DataFlow::exprNode(e1), DataFlow::exprNode(e2))
 }

cpp/ql/lib/semmle/code/cpp/dataflow/internal/tainttracking1/TaintTrackingImpl.qll

@@ -61,7 +61,7 @@ abstract class Configuration extends DataFlow::Configuration {
    * The smaller this predicate is, the faster `hasFlow()` will converge.
    */
   // overridden to provide taint-tracking specific qldoc
-  override predicate isSource(DataFlow::Node source) { none() }
+  abstract override predicate isSource(DataFlow::Node source);
 
   /**
    * Holds if `sink` is a relevant taint sink.
@@ -69,7 +69,7 @@ abstract class Configuration extends DataFlow::Configuration {
    * The smaller this predicate is, the faster `hasFlow()` will converge.
    */
   // overridden to provide taint-tracking specific qldoc
-  override predicate isSink(DataFlow::Node sink) { none() }
+  abstract override predicate isSink(DataFlow::Node sink);
 
   /** Holds if the node `node` is a taint sanitizer. */
   predicate isSanitizer(DataFlow::Node node) { none() }
@@ -93,7 +93,7 @@ abstract class Configuration extends DataFlow::Configuration {
   predicate isSanitizerGuard(DataFlow::BarrierGuard guard) { none() }
 
   final override predicate isBarrierGuard(DataFlow::BarrierGuard guard) {
-    this.isSanitizerGuard(guard) or defaultTaintSanitizerGuard(guard)
+    this.isSanitizerGuard(guard)
   }
 
   /**

cpp/ql/lib/semmle/code/cpp/dataflow/internal/tainttracking2/TaintTrackingImpl.qll

@@ -61,7 +61,7 @@ abstract class Configuration extends DataFlow::Configuration {
    * The smaller this predicate is, the faster `hasFlow()` will converge.
    */
   // overridden to provide taint-tracking specific qldoc
-  override predicate isSource(DataFlow::Node source) { none() }
+  abstract override predicate isSource(DataFlow::Node source);
 
   /**
    * Holds if `sink` is a relevant taint sink.
@@ -69,7 +69,7 @@ abstract class Configuration extends DataFlow::Configuration {
    * The smaller this predicate is, the faster `hasFlow()` will converge.
    */
   // overridden to provide taint-tracking specific qldoc
-  override predicate isSink(DataFlow::Node sink) { none() }
+  abstract override predicate isSink(DataFlow::Node sink);
 
   /** Holds if the node `node` is a taint sanitizer. */
   predicate isSanitizer(DataFlow::Node node) { none() }
@@ -93,7 +93,7 @@ abstract class Configuration extends DataFlow::Configuration {
   predicate isSanitizerGuard(DataFlow::BarrierGuard guard) { none() }
 
   final override predicate isBarrierGuard(DataFlow::BarrierGuard guard) {
-    this.isSanitizerGuard(guard) or defaultTaintSanitizerGuard(guard)
+    this.isSanitizerGuard(guard)
   }
 
   /**

cpp/ql/lib/semmle/code/cpp/exprs/Access.qll

@@ -84,8 +84,8 @@ class VariableAccess extends Access, @varaccess {
     exists(Assignment a | a.getLValue() = this) or
     exists(CrementOperation c | c.getOperand() = this) or
     exists(AddressOfExpr addof | addof.getOperand() = this) or
-    this.getConversion() instanceof ReferenceToExpr or
-    this.getConversion() instanceof ArrayToPointerConversion
+    exists(ReferenceToExpr rte | this.getConversion() = rte) or
+    exists(ArrayToPointerConversion atpc | this.getConversion() = atpc)
   }
 
   /**
@@ -104,8 +104,8 @@ class VariableAccess extends Access, @varaccess {
   predicate isRValue() {
     not exists(AssignExpr ae | ae.getLValue() = this) and
     not exists(AddressOfExpr addof | addof.getOperand() = this) and
-    not this.getConversion() instanceof ReferenceToExpr and
-    not this.getConversion() instanceof ArrayToPointerConversion
+    not exists(ReferenceToExpr rte | this.getConversion() = rte) and
+    not exists(ArrayToPointerConversion atpc | this.getConversion() = atpc)
   }
 
   /**
@@ -218,7 +218,9 @@ class PointerFieldAccess extends FieldAccess {
 class DotFieldAccess extends FieldAccess {
   override string getAPrimaryQlClass() { result = "DotFieldAccess" }
 
-  DotFieldAccess() { this.getQualifier().getFullyConverted().getUnspecifiedType() instanceof Class }
+  DotFieldAccess() {
+    exists(Class c | c = this.getQualifier().getFullyConverted().getUnspecifiedType())
+  }
 }
 
 /**

cpp/ql/lib/semmle/code/cpp/exprs/Assignment.qll

@@ -226,6 +226,13 @@ class AssignPointerSubExpr extends AssignOperation, @assignpsubexpr {
  * ```
  */
 class ConditionDeclExpr extends Expr, @condition_decl {
+  /**
+   * DEPRECATED: Use `getVariableAccess()` or `getInitializingExpr()` instead.
+   *
+   * Gets the access using the condition for this declaration.
+   */
+  deprecated Expr getExpr() { result = this.getChild(0) }
+
   override string getAPrimaryQlClass() { result = "ConditionDeclExpr" }
 
   /**

cpp/ql/lib/semmle/code/cpp/exprs/BuiltInOperations.qll

@@ -118,6 +118,11 @@ class BuiltInNoOp extends BuiltInOperation, @noopexpr {
   override string getAPrimaryQlClass() { result = "BuiltInNoOp" }
 }
 
+/**
+ * DEPRECATED: Use `BuiltInOperationBuiltInOffsetOf` instead.
+ */
+deprecated class BuiltInOperationOffsetOf = BuiltInOperationBuiltInOffsetOf;
+
 /**
  * A C/C++ `__builtin_offsetof` built-in operation (used by some implementations
  * of `offsetof`).  The operation retains its semantics even in the presence
@@ -460,6 +465,11 @@ class BuiltInOperationIsUnion extends BuiltInOperation, @isunionexpr {
   override string getAPrimaryQlClass() { result = "BuiltInOperationIsUnion" }
 }
 
+/**
+ * DEPRECATED: Use `BuiltInOperationBuiltInTypesCompatibleP` instead.
+ */
+deprecated class BuiltInOperationBuiltInTypes = BuiltInOperationBuiltInTypesCompatibleP;
+
 /**
  * A C++ `__builtin_types_compatible_p` built-in operation (used by some
  * implementations of the `<type_traits>` header).

cpp/ql/lib/semmle/code/cpp/exprs/Call.qll

@@ -35,7 +35,7 @@ class Call extends Expr, NameQualifiableElement, TCall {
    *
    * For example, `ptr->f()` has a qualifier, whereas plain `f()` does not.
    */
-  predicate hasQualifier() { exists(this.getChild(-1)) }
+  predicate hasQualifier() { exists(Expr e | this.getChild(-1) = e) }
 
   /**
    * Gets the expression to the left of the function name or function pointer variable name.

cpp/ql/lib/semmle/code/cpp/exprs/Cast.qll

@@ -666,6 +666,13 @@ class TypeidOperator extends Expr, @type_id {
    */
   Type getResultType() { typeid_bind(underlyingElement(this), unresolveElement(result)) }
 
+  /**
+   * DEPRECATED: Use `getResultType()` instead.
+   *
+   * Gets the type that is returned by this typeid expression.
+   */
+  deprecated Type getSpecifiedType() { result = this.getResultType() }
+
   override string getAPrimaryQlClass() { result = "TypeidOperator" }
 
   /**
@@ -717,13 +724,20 @@ class SizeofOperator extends Expr, @runtime_sizeof {
  * ```
  */
 class SizeofExprOperator extends SizeofOperator {
-  SizeofExprOperator() { exists(this.getChild(0)) }
+  SizeofExprOperator() { exists(Expr e | this.getChild(0) = e) }
 
   override string getAPrimaryQlClass() { result = "SizeofExprOperator" }
 
   /** Gets the contained expression. */
   Expr getExprOperand() { result = this.getChild(0) }
 
+  /**
+   * DEPRECATED: Use `getExprOperand()` instead
+   *
+   * Gets the contained expression.
+   */
+  deprecated Expr getExpr() { result = this.getExprOperand() }
+
   override string toString() { result = "sizeof(<expr>)" }
 
   override predicate mayBeImpure() { this.getExprOperand().mayBeImpure() }
@@ -745,6 +759,13 @@ class SizeofTypeOperator extends SizeofOperator {
   /** Gets the contained type. */
   Type getTypeOperand() { sizeof_bind(underlyingElement(this), unresolveElement(result)) }
 
+  /**
+   * DEPRECATED: Use `getTypeOperand()` instead
+   *
+   * Gets the contained type.
+   */
+  deprecated Type getSpecifiedType() { result = this.getTypeOperand() }
+
   override string toString() { result = "sizeof(" + this.getTypeOperand().getName() + ")" }
 
   override predicate mayBeImpure() { none() }
@@ -766,13 +787,18 @@ class AlignofOperator extends Expr, @runtime_alignof {
  * ```
  */
 class AlignofExprOperator extends AlignofOperator {
-  AlignofExprOperator() { exists(this.getChild(0)) }
+  AlignofExprOperator() { exists(Expr e | this.getChild(0) = e) }
 
   /**
    * Gets the contained expression.
    */
   Expr getExprOperand() { result = this.getChild(0) }
 
+  /**
+   * DEPRECATED: Use `getExprOperand()` instead.
+   */
+  deprecated Expr getExpr() { result = this.getExprOperand() }
+
   override string toString() { result = "alignof(<expr>)" }
 }
 
@@ -788,6 +814,11 @@ class AlignofTypeOperator extends AlignofOperator {
   /** Gets the contained type. */
   Type getTypeOperand() { sizeof_bind(underlyingElement(this), unresolveElement(result)) }
 
+  /**
+   * DEPRECATED: Use `getTypeOperand()` instead.
+   */
+  deprecated Type getSpecifiedType() { result = this.getTypeOperand() }
+
   override string toString() { result = "alignof(" + this.getTypeOperand().getName() + ")" }
 }
 

cpp/ql/lib/semmle/code/cpp/exprs/ComparisonOperation.qll

@@ -48,6 +48,16 @@ class NEExpr extends EqualityOperation, @neexpr {
 class RelationalOperation extends ComparisonOperation, @rel_op_expr {
   override int getPrecedence() { result = 10 }
 
+  /**
+   * DEPRECATED: Use `getGreaterOperand()` instead.
+   */
+  deprecated Expr getLarge() { result = getGreaterOperand() }
+
+  /**
+   * DEPRECATED: Use `getLesserOperand()` instead.
+   */
+  deprecated Expr getSmall() { result = getLesserOperand() }
+
   /**
    * Gets the operand on the "greater" (or "greater-or-equal") side
    * of this relational expression, that is, the side that is larger

cpp/ql/lib/semmle/code/cpp/exprs/Expr.qll

@@ -114,6 +114,13 @@ class Expr extends StmtParent, @expr {
    */
   Type getUnspecifiedType() { result = this.getType().getUnspecifiedType() }
 
+  /**
+   * Gets an integer indicating the type of expression that this represents.
+   *
+   * DEPRECATED: use the subclasses of `Expr` rather than relying on this predicate.
+   */
+  deprecated int getKind() { exprs(underlyingElement(this), result, _) }
+
   /** Gets a textual representation of this expression. */
   override string toString() { none() }
 

cpp/ql/lib/semmle/code/cpp/exprs/Literal.qll

@@ -164,6 +164,16 @@ class HexLiteral extends Literal {
 class AggregateLiteral extends Expr, @aggregateliteral {
   override string getAPrimaryQlClass() { result = "AggregateLiteral" }
 
+  /**
+   * DEPRECATED: Use ClassAggregateLiteral.getFieldExpr() instead.
+   *
+   * Gets the expression within the aggregate literal that is used to initialise field `f`,
+   * if this literal is being used to initialise a class/struct instance.
+   */
+  deprecated Expr getCorrespondingExpr(Field f) {
+    result = this.(ClassAggregateLiteral).getFieldExpr(f)
+  }
+
   override predicate mayBeImpure() { this.getAChild().mayBeImpure() }
 
   override predicate mayBeGloballyImpure() { this.getAChild().mayBeGloballyImpure() }

cpp/ql/lib/semmle/code/cpp/exprs/ObjectiveC.qll

@@ -0,0 +1,297 @@
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ */
+
+import semmle.code.cpp.exprs.Expr
+import semmle.code.cpp.Class
+import semmle.code.cpp.ObjectiveC
+private import semmle.code.cpp.internal.ResolveClass
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C message expression, for example `[myColor changeColorToRed:5.0 green:2.0 blue:6.0]`.
+ */
+deprecated class MessageExpr extends Expr, Call {
+  MessageExpr() { none() }
+
+  override string toString() { none() }
+
+  /**
+   * Gets the selector of this message expression, for example `-changeColorToRed:green:blue:`.
+   */
+  string getSelector() { none() }
+
+  /**
+   * Gets the function invoked by this message expression, as inferred by the compiler.
+   *
+   * If the compiler could infer the type of the receiver, and that type had a method
+   * whose name matched the selector, then the result of this predicate is said method.
+   * Otherwise this predicate has no result.
+   *
+   * In all cases, actual function dispatch isn't performed until runtime, but the
+   * lack of a static target is often cause for concern.
+   */
+  MemberFunction getStaticTarget() { none() }
+
+  /**
+   * Provided for compatibility with Call. It is the same as the static target.
+   */
+  override MemberFunction getTarget() { none() }
+
+  /**
+   * Holds if the compiler could infer a function as the target of this message.
+   *
+   * In all cases, actual function dispatch isn't performed until runtime, but the
+   * lack of a static target is often cause for concern.
+   */
+  predicate hasStaticTarget() { none() }
+
+  /**
+   * Gets the number of arguments passed by this message expression.
+   *
+   * In most cases, this equals the number of colons in the selector, but this needn't be the
+   * case for variadic methods like "-initWithFormat:", which can have more than one argument.
+   */
+  override int getNumberOfArguments() { none() }
+
+  /**
+   * Gets an argument passed by this message expression.
+   */
+  override Expr getAnArgument() { none() }
+
+  /**
+   * Gets the nth argument passed by this message expression.
+   *
+   * The range of `n` is [`0` .. `getNumberOfArguments()`].
+   */
+  override Expr getArgument(int n) { none() }
+
+  override int getPrecedence() { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C message expression whose receiver is `super`, for example `[super init]`.
+ */
+deprecated class SuperMessageExpr extends MessageExpr {
+  SuperMessageExpr() { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C message expression whose receiver is the name of a class, and
+ * is therefore calling a class method rather than an instance method. This occurs
+ * most commonly for the "+alloc", "+new", and "+class" selectors.
+ */
+deprecated class ClassMessageExpr extends MessageExpr {
+  ClassMessageExpr() { none() }
+
+  /**
+   * Gets the class which is the receiver of this message.
+   */
+  Type getReceiver() { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C message expression whose receiver is an expression (which includes the
+ * common case of the receiver being "self").
+ */
+deprecated class ExprMessageExpr extends MessageExpr {
+  ExprMessageExpr() { none() }
+
+  /**
+   * Gets the expression which gives the receiver of this message.
+   */
+  Expr getReceiver() { none() }
+
+  /**
+   * Gets the Objective C class of which the receiving expression is an instance.
+   *
+   * If the receiving expression has type `id` or type `id<P>` for some protocol `P`,
+   * then there will be no result. If the receiving expression has type `C*` or type
+   * `C<P>*` for some protocol `P`, then the result will be the type `C`.
+   */
+  ObjectiveClass getReceiverClass() { none() }
+
+  /**
+   * Gets the Objective C classes and/or protocols which are statically implemented
+   * by the receiving expression.
+   *
+   * If the receiving expression has type `id`, then there will be no result.
+   * If the receiving expression has type `id<P>`, then `P` will be the sole result.
+   * If the receiving expression has type `C*`, then `C` will be the sole result.
+   * If the receiving expression has type `C<P>*`, then `C` and `P` will both be results.
+   */
+  Class getAReceiverClassOrProtocol() { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An access to an Objective C property using dot syntax.
+ *
+ * Such accesses are de-sugared into a message expression to the property's getter or setter.
+ */
+deprecated class PropertyAccess extends ExprMessageExpr {
+  PropertyAccess() { none() }
+
+  /**
+   * Gets the property being accessed by this expression.
+   */
+  Property getProperty() { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C `@selector` expression, for example `@selector(driveForDistance:)`.
+ */
+deprecated class AtSelectorExpr extends Expr {
+  AtSelectorExpr() { none() }
+
+  override string toString() { none() }
+
+  /**
+   * Gets the selector of this `@selector` expression, for example `driveForDistance:`.
+   */
+  string getSelector() { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C `@protocol` expression, for example `@protocol(SomeProtocol)`.
+ */
+deprecated class AtProtocolExpr extends Expr {
+  AtProtocolExpr() { none() }
+
+  override string toString() { none() }
+
+  /**
+   * Gets the protocol of this `@protocol` expression, for example `SomeProtocol`.
+   */
+  Protocol getProtocol() { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C `@encode` expression, for example `@encode(int *)`.
+ */
+deprecated class AtEncodeExpr extends Expr {
+  AtEncodeExpr() { none() }
+
+  override string toString() { none() }
+
+  /**
+   * Gets the type this `@encode` expression encodes, for example `int *`.
+   */
+  Type getEncodedType() { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C throw expression.
+ */
+deprecated class ObjcThrowExpr extends ThrowExpr {
+  ObjcThrowExpr() { none() }
+
+  override string toString() { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C throw expression with no argument (which causes the
+ * current exception to be re-thrown).
+ */
+deprecated class ObjcReThrowExpr extends ReThrowExpr, ObjcThrowExpr {
+  ObjcReThrowExpr() { none() }
+
+  override string toString() { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C @ expression which boxes a single value, such as @(22).
+ */
+deprecated class AtExpr extends UnaryOperation {
+  AtExpr() { none() }
+
+  override string toString() { none() }
+
+  override string getOperator() { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C @[...] literal.
+ */
+deprecated class ArrayLiteral extends Expr {
+  ArrayLiteral() { none() }
+
+  /** Gets a textual representation of this array literal. */
+  override string toString() { none() }
+
+  /** An element of the array */
+  Expr getElement(int i) { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C @{...} literal.
+ */
+deprecated class DictionaryLiteral extends Expr {
+  DictionaryLiteral() { none() }
+
+  /** Gets a textual representation of this dictionary literal. */
+  override string toString() { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C @"..." string literal.
+ */
+deprecated class ObjCLiteralString extends TextLiteral {
+  ObjCLiteralString() { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C/C++ overloaded subscripting access expression.
+ *
+ * Either
+ *     obj[idx]
+ * or
+ *     obj[idx] = expr
+ */
+deprecated class SubscriptExpr extends Expr {
+  SubscriptExpr() { none() }
+
+  /**
+   * Gets the object expression being subscripted.
+   */
+  Expr getSubscriptBase() { none() }
+
+  /**
+   * Gets the expression giving the index into the object.
+   */
+  Expr getSubscriptIndex() { none() }
+
+  /**
+   * Gets the expression being assigned (if this is an assignment).
+   */
+  Expr getAssignedExpr() { none() }
+
+  override string toString() { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C _cmd expression.
+ */
+deprecated class CmdExpr extends Expr {
+  CmdExpr() { none() }
+
+  override string toString() { none() }
+
+  override predicate mayBeImpure() { none() }
+
+  override predicate mayBeGloballyImpure() { none() }
+}

cpp/ql/lib/semmle/code/cpp/headers/MultipleInclusion.qll

@@ -39,6 +39,19 @@ class CorrectIncludeGuard extends IncludeGuardedHeader {
   PreprocessorEndif getEndif() { correctIncludeGuard(this, _, _, result, _) }
 }
 
+/**
+ * DEPRECATED: no longer useful.
+ */
+deprecated class NotIncludedGuard extends IncludeGuardedHeader {
+  NotIncludedGuard() { none() }
+
+  /** Gets the `#ifndef` directive used to prevent multiple inclusion of this file. */
+  PreprocessorIfndef getIfndef() { result.getFile() = this }
+
+  /** Gets the `#endif` directive closing this file. */
+  PreprocessorEndif getEndif() { result.getFile() = this }
+}
+
 /**
  * A file with no code in it.
  */

cpp/ql/lib/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll

@@ -1,8 +1,3 @@
-/**
- * An IR taint tracking library that uses an IR DataFlow configuration to track
- * taint from user inputs as defined by `semmle.code.cpp.security.Security`.
- */
-
 import cpp
 import semmle.code.cpp.security.Security
 private import semmle.code.cpp.ir.dataflow.DataFlow
@@ -241,8 +236,8 @@ private module Cached {
     // For compatibility, send flow from arguments to parameters, even for
     // functions with no body.
     exists(FunctionCall call, int i |
-      sink.asExpr() = call.getArgument(pragma[only_bind_into](i)) and
-      result = resolveCall(call).getParameter(pragma[only_bind_into](i))
+      sink.asExpr() = call.getArgument(i) and
+      result = resolveCall(call).getParameter(i)
     )
     or
     // For compatibility, send flow into a `Variable` if there is flow to any

cpp/ql/lib/semmle/code/cpp/ir/dataflow/MustFlow.qll

@@ -1,270 +0,0 @@
-/**
- * This file provides a library for inter-procedural must-flow data flow analysis.
- * Unlike `DataFlow.qll`, the analysis provided by this file checks whether data _must_ flow
- * from a source to a _sink_.
- */
-
-private import cpp
-import semmle.code.cpp.ir.dataflow.DataFlow
-private import semmle.code.cpp.ir.IR
-
-/**
- * A configuration of a data flow analysis that performs must-flow analysis. This is different
- * from `DataFlow.qll` which performs may-flow analysis (i.e., it finds paths where the source _may_
- * flow to the sink).
- *
- * Like in `DataFlow.qll`, each use of the `MustFlow.qll` library must define its own unique extension
- * of this abstract class. To create a configuration, extend this class with a subclass whose
- * characteristic predicate is a unique singleton string and override `isSource`, `isSink` (and
- * `isAdditionalFlowStep` if additional steps are required).
- */
-abstract class MustFlowConfiguration extends string {
-  bindingset[this]
-  MustFlowConfiguration() { any() }
-
-  /**
-   * Holds if `source` is a relevant data flow source.
-   */
-  abstract predicate isSource(DataFlow::Node source);
-
-  /**
-   * Holds if `sink` is a relevant data flow sink.
-   */
-  abstract predicate isSink(DataFlow::Node sink);
-
-  /**
-   * Holds if the additional flow step from `node1` to `node2` must be taken
-   * into account in the analysis.
-   */
-  predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) { none() }
-
-  /**
-   * Holds if data must flow from `source` to `sink` for this configuration.
-   *
-   * The corresponding paths are generated from the end-points and the graph
-   * included in the module `PathGraph`.
-   */
-  final predicate hasFlowPath(MustFlowPathNode source, MustFlowPathSink sink) {
-    this.isSource(source.getNode()) and
-    source.getASuccessor+() = sink
-  }
-}
-
-/** Holds if `node` flows from a source. */
-pragma[nomagic]
-private predicate flowsFromSource(DataFlow::Node node, MustFlowConfiguration config) {
-  config.isSource(node)
-  or
-  exists(DataFlow::Node mid |
-    step(mid, node, config) and
-    flowsFromSource(mid, pragma[only_bind_into](config))
-  )
-}
-
-/** Holds if `node` flows to a sink. */
-pragma[nomagic]
-private predicate flowsToSink(DataFlow::Node node, MustFlowConfiguration config) {
-  flowsFromSource(node, pragma[only_bind_into](config)) and
-  (
-    config.isSink(node)
-    or
-    exists(DataFlow::Node mid |
-      step(node, mid, config) and
-      flowsToSink(mid, pragma[only_bind_into](config))
-    )
-  )
-}
-
-cached
-private module Cached {
-  /** Holds if `p` is the `n`'th parameter of the non-virtual function `f`. */
-  private predicate parameterOf(Parameter p, Function f, int n) {
-    not f.isVirtual() and f.getParameter(n) = p
-  }
-
-  /**
-   * Holds if `instr` is the `n`'th argument to a call to the non-virtual function `f`, and
-   * `init` is the corresponding initialization instruction that receives the value of `instr` in `f`.
-   */
-  private predicate flowIntoParameter(
-    Function f, int n, CallInstruction call, Instruction instr, InitializeParameterInstruction init
-  ) {
-    not f.isVirtual() and
-    call.getPositionalArgument(n) = instr and
-    f = call.getStaticCallTarget() and
-    getEnclosingNonVirtualFunctionInitializeParameter(init, f) and
-    init.getParameter().getIndex() = pragma[only_bind_into](pragma[only_bind_out](n))
-  }
-
-  /**
-   * Holds if `instr` is an argument to a call to the function `f`, and `init` is the
-   * corresponding initialization instruction that receives the value of `instr` in `f`.
-   */
-  pragma[noinline]
-  private predicate getPositionalArgumentInitParam(
-    CallInstruction call, Instruction instr, InitializeParameterInstruction init, Function f
-  ) {
-    exists(int n |
-      parameterOf(_, f, n) and
-      flowIntoParameter(f, pragma[only_bind_into](pragma[only_bind_out](n)), call, instr, init)
-    )
-  }
-
-  /**
-   * Holds if `instr` is the qualifier to a call to the non-virtual function `f`, and
-   * `init` is the corresponding initialization instruction that receives the value of
-   * `instr` in `f`.
-   */
-  pragma[noinline]
-  private predicate getThisArgumentInitParam(
-    CallInstruction call, Instruction instr, InitializeParameterInstruction init, Function f
-  ) {
-    not f.isVirtual() and
-    call.getStaticCallTarget() = f and
-    getEnclosingNonVirtualFunctionInitializeParameter(init, f) and
-    call.getThisArgument() = instr and
-    init.getIRVariable() instanceof IRThisVariable
-  }
-
-  /** Holds if `f` is the enclosing non-virtual function of `init`. */
-  private predicate getEnclosingNonVirtualFunctionInitializeParameter(
-    InitializeParameterInstruction init, Function f
-  ) {
-    not f.isVirtual() and
-    init.getEnclosingFunction() = f
-  }
-
-  /** Holds if `f` is the enclosing non-virtual function of `init`. */
-  private predicate getEnclosingNonVirtualFunctionInitializeIndirection(
-    InitializeIndirectionInstruction init, Function f
-  ) {
-    not f.isVirtual() and
-    init.getEnclosingFunction() = f
-  }
-
-  /**
-   * Holds if `instr` is an argument (or argument indirection) to a call, and
-   * `succ` is the corresponding initialization instruction in the call target.
-   */
-  private predicate flowThroughCallable(Instruction argument, Instruction parameter) {
-    // Flow from an argument to a parameter
-    exists(CallInstruction call, InitializeParameterInstruction init | init = parameter |
-      getPositionalArgumentInitParam(call, argument, init, call.getStaticCallTarget())
-      or
-      getThisArgumentInitParam(call, argument, init, call.getStaticCallTarget())
-    )
-    or
-    // Flow from argument indirection to parameter indirection
-    exists(
-      CallInstruction call, ReadSideEffectInstruction read, InitializeIndirectionInstruction init
-    |
-      init = parameter and
-      read.getPrimaryInstruction() = call and
-      getEnclosingNonVirtualFunctionInitializeIndirection(init, call.getStaticCallTarget())
-    |
-      exists(int n |
-        read.getSideEffectOperand().getAnyDef() = argument and
-        read.getIndex() = pragma[only_bind_into](n) and
-        init.getParameter().getIndex() = pragma[only_bind_into](n)
-      )
-      or
-      call.getThisArgument() = argument and
-      init.getIRVariable() instanceof IRThisVariable
-    )
-  }
-
-  private predicate instructionToOperandStep(Instruction instr, Operand operand) {
-    operand.getDef() = instr
-  }
-
-  /**
-   * Holds if data flows from `operand` to `instr`.
-   *
-   * This predicate ignores flow through `PhiInstruction`s to create a 'must flow' relation.
-   */
-  private predicate operandToInstructionStep(Operand operand, Instruction instr) {
-    instr.(CopyInstruction).getSourceValueOperand() = operand
-    or
-    instr.(ConvertInstruction).getUnaryOperand() = operand
-    or
-    instr.(CheckedConvertOrNullInstruction).getUnaryOperand() = operand
-    or
-    instr.(InheritanceConversionInstruction).getUnaryOperand() = operand
-    or
-    instr.(ChiInstruction).getTotalOperand() = operand
-  }
-
-  cached
-  predicate step(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
-    instructionToOperandStep(nodeFrom.asInstruction(), nodeTo.asOperand())
-    or
-    flowThroughCallable(nodeFrom.asInstruction(), nodeTo.asInstruction())
-    or
-    operandToInstructionStep(nodeFrom.asOperand(), nodeTo.asInstruction())
-  }
-}
-
-/** Holds if `nodeFrom` flows to `nodeTo`. */
-private predicate step(DataFlow::Node nodeFrom, DataFlow::Node nodeTo, MustFlowConfiguration config) {
-  exists(config) and
-  Cached::step(nodeFrom, nodeTo)
-  or
-  config.isAdditionalFlowStep(nodeFrom, nodeTo)
-}
-
-private newtype TLocalPathNode =
-  MkLocalPathNode(DataFlow::Node n, MustFlowConfiguration config) {
-    flowsToSink(n, config) and
-    (
-      config.isSource(n)
-      or
-      exists(MustFlowPathNode mid | step(mid.getNode(), n, config))
-    )
-  }
-
-/** A `Node` that is in a path from a source to a sink. */
-class MustFlowPathNode extends TLocalPathNode {
-  DataFlow::Node n;
-
-  MustFlowPathNode() { this = MkLocalPathNode(n, _) }
-
-  /** Gets the underlying node. */
-  DataFlow::Node getNode() { result = n }
-
-  /** Gets a textual representation of this node. */
-  string toString() { result = n.toString() }
-
-  /** Gets the location of this element. */
-  Location getLocation() { result = n.getLocation() }
-
-  /** Gets a successor node, if any. */
-  MustFlowPathNode getASuccessor() {
-    step(this.getNode(), result.getNode(), this.getConfiguration())
-  }
-
-  /** Gets the associated configuration. */
-  MustFlowConfiguration getConfiguration() { this = MkLocalPathNode(_, result) }
-}
-
-private class MustFlowPathSink extends MustFlowPathNode {
-  MustFlowPathSink() { this.getConfiguration().isSink(this.getNode()) }
-}
-
-/**
- * Provides the query predicates needed to include a graph in a path-problem query.
- */
-module PathGraph {
-  private predicate reach(MustFlowPathNode n) {
-    n instanceof MustFlowPathSink or reach(n.getASuccessor())
-  }
-
-  /** Holds if `(a,b)` is an edge in the graph of data flow path explanations. */
-  query predicate edges(MustFlowPathNode a, MustFlowPathNode b) {
-    a.getASuccessor() = b and reach(b)
-  }
-
-  /** Holds if `n` is a node in the graph of data flow path explanations. */
-  query predicate nodes(MustFlowPathNode n, string key, string val) {
-    reach(n) and key = "semmle.label" and val = n.toString()
-  }
-}

cpp/ql/lib/semmle/code/cpp/ir/dataflow/TaintTracking.qll

@@ -21,4 +21,9 @@ import semmle.code.cpp.ir.dataflow.DataFlow2
 module TaintTracking {
   import semmle.code.cpp.ir.dataflow.internal.tainttracking1.TaintTrackingImpl
   private import semmle.code.cpp.ir.dataflow.TaintTracking2
+
+  /**
+   * DEPRECATED: Use TaintTracking2::Configuration instead.
+   */
+  deprecated class Configuration2 = TaintTracking2::Configuration;
 }

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplCommon.qll

@@ -3,17 +3,6 @@ private import DataFlowImplSpecific::Public
 import Cached
 
 module DataFlowImplCommonPublic {
-  /** A state value to track during data flow. */
-  class FlowState = string;
-
-  /**
-   * The default state, which is used when the state is unspecified for a source
-   * or a sink.
-   */
-  class FlowStateEmpty extends FlowState {
-    FlowStateEmpty() { this = "" }
-  }
-
   private newtype TFlowFeature =
     TFeatureHasSourceCallContext() or
     TFeatureHasSinkCallContext() or
@@ -1290,7 +1279,7 @@ class DataFlowCallOption extends TDataFlowCallOption {
   }
 }
 
-/** A `Content` tagged with the type of a containing object. */
+/** Content tagged with the type of a containing object. */
 class TypedContent extends MkTypedContent {
   private Content c;
   private DataFlowType t;

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll

@@ -158,6 +158,14 @@ class Node extends TIRDataFlowNode {
    */
   Expr asPartialDefinition() { result = this.(PartialDefinitionNode).getDefinedExpr() }
 
+  /**
+   * DEPRECATED: See UninitializedNode.
+   *
+   * Gets the uninitialized local variable corresponding to this node, if
+   * any.
+   */
+  deprecated LocalVariable asUninitialized() { none() }
+
   /**
    * Gets an upper bound on the type of this node.
    */
@@ -552,6 +560,22 @@ class ParameterIndirectionNode extends ParameterNode {
   override string toString() { result = "*" + instr.getIRVariable().toString() }
 }
 
+/**
+ * DEPRECATED: Data flow was never an accurate way to determine what
+ * expressions might be uninitialized. It errs on the side of saying that
+ * everything is uninitialized, and this is even worse in the IR because the IR
+ * doesn't use syntactic hints to rule out variables that are definitely
+ * initialized.
+ *
+ * The value of an uninitialized local variable, viewed as a node in a data
+ * flow graph.
+ */
+deprecated class UninitializedNode extends Node {
+  UninitializedNode() { none() }
+
+  LocalVariable getLocalVariable() { none() }
+}
+
 /**
  * A node associated with an object after an operation that might have
  * changed its state.
@@ -701,6 +725,14 @@ InstructionNode instructionNode(Instruction instr) { result.getInstruction() = i
  */
 OperandNode operandNode(Operand operand) { result.getOperand() = operand }
 
+/**
+ * DEPRECATED: use `definitionByReferenceNodeFromArgument` instead.
+ *
+ * Gets the `Node` corresponding to a definition by reference of the variable
+ * that is passed as `argument` of a call.
+ */
+deprecated DefinitionByReferenceNode definitionByReferenceNode(Expr e) { result.getArgument() = e }
+
 /**
  * Gets the `Node` corresponding to the value of evaluating `e` or any of its
  * conversions. There is no result if `e` is a `Conversion`. For data flowing
@@ -1000,14 +1032,12 @@ SideEffectInstruction getSideEffectFor(CallInstruction call, int argument) {
  * Holds if data flows from `source` to `sink` in zero or more local
  * (intra-procedural) steps.
  */
-pragma[inline]
 predicate localFlow(Node source, Node sink) { localFlowStep*(source, sink) }
 
 /**
  * Holds if data can flow from `i1` to `i2` in zero or more
  * local (intra-procedural) steps.
  */
-pragma[inline]
 predicate localInstructionFlow(Instruction e1, Instruction e2) {
   localFlow(instructionNode(e1), instructionNode(e2))
 }
@@ -1016,7 +1046,6 @@ predicate localInstructionFlow(Instruction e1, Instruction e2) {
  * Holds if data can flow from `e1` to `e2` in zero or more
  * local (intra-procedural) steps.
  */
-pragma[inline]
 predicate localExprFlow(Expr e1, Expr e2) { localFlow(exprNode(e1), exprNode(e2)) }
 
 private newtype TContent =