Revert "C#: Extract relational patterns"

.github/workflows/check-change-note.yml

@@ -1,21 +0,0 @@
-on:
-  pull_request_target:
-    types: [labeled, unlabeled, opened, synchronize, reopened, ready_for_review]
-    paths:
-      - "*/ql/src/**/*.ql"
-      - "*/ql/src/**/*.qll"
-      - "!**/experimental/**"
-
-jobs:
-  check-change-note:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Fail if no change note found. To fix, either add one, or add the `no-change-note-required` label.
-        if: |
-          github.event.pull_request.draft == false &&
-          !contains(github.event.pull_request.labels.*.name, 'no-change-note-required')
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          gh api 'repos/${{github.repository}}/pulls/${{github.event.number}}/files' --paginate |
-          jq 'any(.[].filename ; test("/change-notes/.*[.]md$"))' --exit-status

.github/workflows/codeql-analysis.yml

@@ -2,15 +2,7 @@ name: "Code scanning - action"
 
 on:
   push:
-    branches:
-      - main
-      - 'rc/*'
   pull_request:
-    branches:
-      - main
-      - 'rc/*'
-    paths:
-      - 'csharp/**'
   schedule:
     - cron: '0 9 * * 1'
 
@@ -22,7 +14,16 @@ jobs:
     steps:
     - name: Checkout repository
       uses: actions/checkout@v2
+      with:
+        # We must fetch at least the immediate parents so that if this is
+        # a pull request then we can checkout the head.
+        fetch-depth: 2
 
+    # If this run was triggered by a pull request event, then checkout
+    # the head of the pull request instead of the merge commit.
+    - run: git checkout HEAD^2
+      if: ${{ github.event_name == 'pull_request' }}
+      
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
       uses: github/codeql-action/init@v1

.gitignore

@@ -17,9 +17,6 @@
 # Byte-compiled python files
 *.pyc
 
-# python virtual environment folder 
-.venv/
-
 # It's useful (though not required) to be able to unpack codeql in the ql checkout itself
 /codeql/
 

CODEOWNERS

@@ -4,9 +4,17 @@
 /javascript/ @github/codeql-javascript
 /python/ @github/codeql-python
 
-# Make @xcorail (GitHub Security Lab) a code owner for experimental queries so he gets pinged when we promote a query out of experimental
-/cpp/**/experimental/**/* @github/codeql-c-analysis @xcorail
-/csharp/**/experimental/**/* @github/codeql-csharp @xcorail
-/java/**/experimental/**/* @github/codeql-java @xcorail
-/javascript/**/experimental/**/* @github/codeql-javascript @xcorail
-/python/**/experimental/**/* @github/codeql-python @xcorail
+# Assign query help for docs review
+/cpp/**/*.qhelp @hubwriter
+/csharp/**/*.qhelp @jf205
+/java/**/*.qhelp @felicitymay
+/javascript/**/*.qhelp @mchammer01
+/python/**/*.qhelp @felicitymay
+/docs/language/ @shati-patel @jf205
+
+# Exclude help for experimental queries from docs review
+/cpp/**/experimental/**/*.qhelp @github/codeql-c-analysis
+/csharp/**/experimental/**/*.qhelp @github/codeql-csharp
+/java/**/experimental/**/*.qhelp @github/codeql-java
+/javascript/**/experimental/**/*.qhelp @github/codeql-javascript
+/python/**/experimental/**/*.qhelp @github/codeql-python

CONTRIBUTING.md

@@ -38,8 +38,6 @@ If you have an idea for a query that you would like to share with other CodeQL u
 
     - The queries and libraries must be autoformatted, for example using the "Format Document" command in [CodeQL for Visual Studio Code](https://help.semmle.com/codeql/codeql-for-vscode/procedures/about-codeql-for-vscode.html).
 
-    If you prefer, you can use this [pre-commit hook](misc/scripts/pre-commit) that automatically checks whether your files are correctly formatted. See the [pre-commit hook installation guide](docs/install-pre-commit-hook.md) for instructions on how to install the hook.
-
 4. **Compilation**
 
     - Compilation of the query and any associated libraries and tests must be resilient to future development of the [supported](docs/supported-queries.md) libraries. This means that the functionality cannot use internal libraries, cannot depend on the output of `getAQlClass`, and cannot make use of regexp matching on `toString`.
@@ -49,11 +47,7 @@ If you have an idea for a query that you would like to share with other CodeQL u
 
     - The query must have at least one true positive result on some revision of a real project.
 
-6. **Query help files and unit tests**
-
-	- Query help (`.qhelp`) files and unit tests are optional (but strongly encouraged!) for queries in the `experimental` directories. For more information about contributing query help files and unit tests, see [Supported CodeQL queries and libraries](docs/supported-queries.md).
-
-Experimental queries and libraries may not be actively maintained as the supported libraries evolve. They may also be changed in backwards-incompatible ways or may be removed entirely in the future without deprecation warnings.
+Experimental queries and libraries may not be actively maintained as the [supported](docs/supported-queries.md) libraries evolve. They may also be changed in backwards-incompatible ways or may be removed entirely in the future without deprecation warnings.
 
 After the experimental query is merged, we welcome pull requests to improve it. Before a query can be moved out of the `experimental` subdirectory, it must satisfy [the requirements for being a supported query](docs/supported-queries.md).
 

change-notes/1.26/analysis-python.md

@@ -4,34 +4,19 @@ The following changes in version 1.26 affect Python analysis in all applications
 
 ## General improvements
 
+
+## New queries
+
+| **Query**                   | **Tags**  | **Purpose**                                                        |
+|-----------------------------|-----------|--------------------------------------------------------------------|
+
+
 ## Changes to existing queries
 
 | **Query**                  | **Expected impact**    | **Change**                                                       |
 |----------------------------|------------------------|------------------------------------------------------------------|
-|`py/unsafe-deserialization` | Different results. | The underlying data flow library has been changed. See below for more details. |
-|`py/path-injection` | Different results. | The underlying data flow library has been changed. See below for more details. |
-|`py/command-line-injection` | Different results. | The underlying data flow library has been changed. See below for more details. |
-|`py/reflective-xss` | Different results. | The underlying data flow library has been changed. See below for more details. |
-|`py/sql-injection` | Different results. | The underlying data flow library has been changed. See below for more details. |
-|`py/code-injection` | Different results. | The underlying data flow library has been changed. See below for more details. |
+
+
 ## Changes to libraries
-* Some of the security queries now use the shared data flow library for data flow and taint tracking. This has resulted in an overall more robust and accurate analysis. The libraries mentioned below have been modelled in this new framework. Other libraries (e.g. the web framework `CherryPy`) have not been modelled yet, and this may lead to a temporary loss of results for these frameworks.
-* Improved modelling of the following serialization libraries:
-  - `PyYAML`
-  - `dill`
-  - `pickle`
-  - `marshal`
-* Improved modelling of the following web frameworks:
-  - `Django` (Note that modelling of class-based response handlers is currently incomplete.)
-  - `Flask`
-* Support for Werkzeug `MultiDict`.
-* Support for the [Python Database API Specification v2.0 (PEP-249)](https://www.python.org/dev/peps/pep-0249/), including the following libraries:
-  - `MySQLdb`
-  - `mysql-connector-python`
-  - `django.db`
-* Improved modelling of the following command execution libraries:
-  - `Fabric`
-  - `Invoke`
-* Improved modelling of security-related standard library modules, such as `os`, `popen2`, `platform`, and `base64`.
-* The original versions of the updated queries have been preserved [here](https://github.com/github/codeql/tree/main/python/ql/src/experimental/Security-old-dataflow).
+
 * Added taint tracking support for string formatting through f-strings.

config/identical-files.json

@@ -356,7 +356,6 @@
   ],
   "Inline Test Expectations": [
     "cpp/ql/test/TestUtilities/InlineExpectationsTest.qll",
-    "java/ql/test/TestUtilities/InlineExpectationsTest.qll",
     "python/ql/test/TestUtilities/InlineExpectationsTest.qll"
   ],
   "C++ ExternalAPIs": [
@@ -425,10 +424,5 @@
     "java/ql/src/IDEContextual.qll",
     "javascript/ql/src/IDEContextual.qll",
     "python/ql/src/analysis/IDEContextual.qll"
-  ],
-  "SSA C#": [
-    "csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImplCommon.qll",
-    "csharp/ql/src/semmle/code/csharp/controlflow/internal/pressa/SsaImplCommon.qll",
-    "csharp/ql/src/semmle/code/csharp/dataflow/internal/basessa/SsaImplCommon.qll"
   ]
-}
+}

cpp/change-notes/2020-11-05-formatting-function.md

@@ -1,4 +0,0 @@
-lgtm,codescanning
-* `FormattingFunction.getOutputParameterIndex` now has a parameter identifying whether the output at that index is a buffer or a stream.
-* `FormattingFunction` now has a predicate `isOutputGlobal` indicating when the output is to a global stream.
-* The `primitiveVariadicFormatter` and `variadicFormatter` predicates have more parameters exposing information about the function.

cpp/change-notes/2021-02-04-unsigned-difference-expression-compared-zero.md

@@ -1,2 +0,0 @@
-lgtm
-* A new query (`cpp/unsigned-difference-expression-compared-zero`) is run but not yet displayed on LGTM. The query finds unsigned subtractions used in relational comparisons with the value 0. This query was originally submitted as an experimental query by @ihsinme in https://github.com/github/codeql/pull/4745.

cpp/change-notes/2021-02-24-memset-may-be-deleted.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* A new query (`cpp/memset-may-be-deleted`) is added to the default query suite. The query finds calls to `memset` that may be removed by the compiler. This behavior can make information-leak vulnerabilities easier to exploit. This query was originally [submitted as an experimental query by @ihsinme](https://github.com/github/codeql/pull/4953).

cpp/config/suites/cpp/correctness

@@ -10,7 +10,6 @@
 + semmlecode-cpp-queries/Likely Bugs/Underspecified Functions/MistypedFunctionArguments.ql: /Correctness/Dangerous Conversions
 + semmlecode-cpp-queries/Security/CWE/CWE-253/HResultBooleanConversion.ql: /Correctness/Dangerous Conversions
 + semmlecode-cpp-queries/Likely Bugs/OO/UnsafeUseOfThis.ql: /Correctness/Dangerous Conversions
-+ semmlecode-cpp-queries/Security/CWE/CWE-191/UnsignedDifferenceExpressionComparedZero.ql: /Correctness/Dangerous Conversions
   # Consistent Use
 + semmlecode-cpp-queries/Critical/ReturnValueIgnored.ql: /Correctness/Consistent Use
 + semmlecode-cpp-queries/Likely Bugs/InconsistentCheckReturnNull.ql: /Correctness/Consistent Use

cpp/ql/src/Architecture/General Class-Level Information/ClassHierarchies.ql

@@ -4,6 +4,9 @@
  * @kind graph
  * @id cpp/architecture/class-hierarchies
  * @graph.layout organic
+ * @workingset jhotdraw
+ * @result succeed 48
+ * @result_ondemand succeed 48
  * @tags maintainability
  */
 

cpp/ql/src/Architecture/General Class-Level Information/InheritanceDepthDistribution.ql

@@ -4,6 +4,9 @@
  * @kind chart
  * @id cpp/architecture/inheritance-depth-distribution
  * @chart.type line
+ * @workingset jhotdraw
+ * @result succeed 48
+ * @result_ondemand succeed 48
  * @tags maintainability
  */
 

cpp/ql/src/Architecture/General Namespace-Level Information/GlobalNamespaceClasses.ql

@@ -1,8 +1,7 @@
 /**
  * @name Global namespace classes
  * @description Finds classes that belong to no namespace.
- * @kind problem
- * @problem.severity recommendation
+ * @kind table
  * @id cpp/architecture/global-namespace-classes
  * @tags maintainability
  *       modularity

cpp/ql/src/Architecture/Refactoring Opportunities/ClassesWithManyDependencies.ql

@@ -4,6 +4,9 @@
  * @kind problem
  * @id cpp/architecture/classes-with-many-dependencies
  * @problem.severity recommendation
+ * @workingset jhotdraw
+ * @result succeed 20
+ * @result_ondemand succeed 20
  * @tags maintainability
  *       statistical
  *       non-attributable

cpp/ql/src/Best Practices/Magic Constants/MagicConstants.qll

@@ -8,41 +8,168 @@ import semmle.code.cpp.AutogeneratedFile
 predicate trivialPositiveIntValue(string s) {
   // Small numbers
   s = [0 .. 20].toString() or
-  s =
-    [
-      // Popular powers of two (decimal)
-      "16", "24", "32", "64", "128", "256", "512", "1024", "2048", "4096", "16384", "32768",
-      "65536", "1048576", "2147483648", "4294967296",
-      // Popular powers of two, minus one (decimal)
-      "15", "31", "63", "127", "255", "511", "1023", "2047", "4095", "16383", "32767", "65535",
-      "1048577", "2147483647", "4294967295",
-      // Popular powers of two (32-bit hex)
-      "0x00000001", "0x00000002", "0x00000004", "0x00000008", "0x00000010", "0x00000020",
-      "0x00000040", "0x00000080", "0x00000100", "0x00000200", "0x00000400", "0x00000800",
-      "0x00001000", "0x00002000", "0x00004000", "0x00008000", "0x00010000", "0x00020000",
-      "0x00040000", "0x00080000", "0x00100000", "0x00200000", "0x00400000", "0x00800000",
-      "0x01000000", "0x02000000", "0x04000000", "0x08000000", "0x10000000", "0x20000000",
-      "0x40000000", "0x80000000",
-      // Popular powers of two, minus one (32-bit hex)
-      "0x00000001", "0x00000003", "0x00000007", "0x0000000f", "0x0000001f", "0x0000003f",
-      "0x0000007f", "0x000000ff", "0x000001ff", "0x000003ff", "0x000007ff", "0x00000fff",
-      "0x00001fff", "0x00003fff", "0x00007fff", "0x0000ffff", "0x0001ffff", "0x0003ffff",
-      "0x0007ffff", "0x000fffff", "0x001fffff", "0x003fffff", "0x007fffff", "0x00ffffff",
-      "0x01ffffff", "0x03ffffff", "0x07ffffff", "0x0fffffff", "0x1fffffff", "0x3fffffff",
-      "0x7fffffff", "0xffffffff",
-      // Popular powers of two (16-bit hex)
-      "0x0001", "0x0002", "0x0004", "0x0008", "0x0010", "0x0020", "0x0040", "0x0080", "0x0100",
-      "0x0200", "0x0400", "0x0800", "0x1000", "0x2000", "0x4000", "0x8000",
-      // Popular powers of two, minus one (16-bit hex)
-      "0x0001", "0x0003", "0x0007", "0x000f", "0x001f", "0x003f", "0x007f", "0x00ff", "0x01ff",
-      "0x03ff", "0x07ff", "0x0fff", "0x1fff", "0x3fff", "0x7fff", "0xffff",
-      // Popular powers of two (8-bit hex)
-      "0x01", "0x02", "0x04", "0x08", "0x10", "0x20", "0x40", "0x80",
-      // Popular powers of two, minus one (8-bit hex)
-      "0x01", "0x03", "0x07", "0x0f", "0x1f", "0x3f", "0x7f", "0xff", "0x00",
-      // Powers of ten
-      "10", "100", "1000", "10000", "100000", "1000000", "10000000", "100000000", "1000000000"
-    ]
+  // Popular powers of two (decimal)
+  s = "16" or
+  s = "24" or
+  s = "32" or
+  s = "64" or
+  s = "128" or
+  s = "256" or
+  s = "512" or
+  s = "1024" or
+  s = "2048" or
+  s = "4096" or
+  s = "16384" or
+  s = "32768" or
+  s = "65536" or
+  s = "1048576" or
+  s = "2147483648" or
+  s = "4294967296" or
+  // Popular powers of two, minus one (decimal)
+  s = "15" or
+  s = "31" or
+  s = "63" or
+  s = "127" or
+  s = "255" or
+  s = "511" or
+  s = "1023" or
+  s = "2047" or
+  s = "4095" or
+  s = "16383" or
+  s = "32767" or
+  s = "65535" or
+  s = "1048577" or
+  s = "2147483647" or
+  s = "4294967295" or
+  // Popular powers of two (32-bit hex)
+  s = "0x00000001" or
+  s = "0x00000002" or
+  s = "0x00000004" or
+  s = "0x00000008" or
+  s = "0x00000010" or
+  s = "0x00000020" or
+  s = "0x00000040" or
+  s = "0x00000080" or
+  s = "0x00000100" or
+  s = "0x00000200" or
+  s = "0x00000400" or
+  s = "0x00000800" or
+  s = "0x00001000" or
+  s = "0x00002000" or
+  s = "0x00004000" or
+  s = "0x00008000" or
+  s = "0x00010000" or
+  s = "0x00020000" or
+  s = "0x00040000" or
+  s = "0x00080000" or
+  s = "0x00100000" or
+  s = "0x00200000" or
+  s = "0x00400000" or
+  s = "0x00800000" or
+  s = "0x01000000" or
+  s = "0x02000000" or
+  s = "0x04000000" or
+  s = "0x08000000" or
+  s = "0x10000000" or
+  s = "0x20000000" or
+  s = "0x40000000" or
+  s = "0x80000000" or
+  // Popular powers of two, minus one (32-bit hex)
+  s = "0x00000001" or
+  s = "0x00000003" or
+  s = "0x00000007" or
+  s = "0x0000000f" or
+  s = "0x0000001f" or
+  s = "0x0000003f" or
+  s = "0x0000007f" or
+  s = "0x000000ff" or
+  s = "0x000001ff" or
+  s = "0x000003ff" or
+  s = "0x000007ff" or
+  s = "0x00000fff" or
+  s = "0x00001fff" or
+  s = "0x00003fff" or
+  s = "0x00007fff" or
+  s = "0x0000ffff" or
+  s = "0x0001ffff" or
+  s = "0x0003ffff" or
+  s = "0x0007ffff" or
+  s = "0x000fffff" or
+  s = "0x001fffff" or
+  s = "0x003fffff" or
+  s = "0x007fffff" or
+  s = "0x00ffffff" or
+  s = "0x01ffffff" or
+  s = "0x03ffffff" or
+  s = "0x07ffffff" or
+  s = "0x0fffffff" or
+  s = "0x1fffffff" or
+  s = "0x3fffffff" or
+  s = "0x7fffffff" or
+  s = "0xffffffff" or
+  // Popular powers of two (16-bit hex)
+  s = "0x0001" or
+  s = "0x0002" or
+  s = "0x0004" or
+  s = "0x0008" or
+  s = "0x0010" or
+  s = "0x0020" or
+  s = "0x0040" or
+  s = "0x0080" or
+  s = "0x0100" or
+  s = "0x0200" or
+  s = "0x0400" or
+  s = "0x0800" or
+  s = "0x1000" or
+  s = "0x2000" or
+  s = "0x4000" or
+  s = "0x8000" or
+  // Popular powers of two, minus one (16-bit hex)
+  s = "0x0001" or
+  s = "0x0003" or
+  s = "0x0007" or
+  s = "0x000f" or
+  s = "0x001f" or
+  s = "0x003f" or
+  s = "0x007f" or
+  s = "0x00ff" or
+  s = "0x01ff" or
+  s = "0x03ff" or
+  s = "0x07ff" or
+  s = "0x0fff" or
+  s = "0x1fff" or
+  s = "0x3fff" or
+  s = "0x7fff" or
+  s = "0xffff" or
+  // Popular powers of two (8-bit hex)
+  s = "0x01" or
+  s = "0x02" or
+  s = "0x04" or
+  s = "0x08" or
+  s = "0x10" or
+  s = "0x20" or
+  s = "0x40" or
+  s = "0x80" or
+  // Popular powers of two, minus one (8-bit hex)
+  s = "0x01" or
+  s = "0x03" or
+  s = "0x07" or
+  s = "0x0f" or
+  s = "0x1f" or
+  s = "0x3f" or
+  s = "0x7f" or
+  s = "0xff" or
+  s = "0x00" or
+  // Powers of ten
+  s = "10" or
+  s = "100" or
+  s = "1000" or
+  s = "10000" or
+  s = "100000" or
+  s = "1000000" or
+  s = "10000000" or
+  s = "100000000" or
+  s = "1000000000"
 }
 
 predicate trivialIntValue(string s) {
@@ -108,7 +235,10 @@ predicate joiningStringTrivial(Literal lit) {
   // understand (which is against the spirit of these queries).
   stringLiteral(lit) and
   exists(FunctionCall fc |
-    fc.getTarget().getName() = ["operator+", "operator<<"] and
+    (
+      fc.getTarget().getName() = "operator+" or
+      fc.getTarget().getName() = "operator<<"
+    ) and
     fc.getAnArgument().getAChild*() = lit
   ) and
   lit.getValue().length() < 16
@@ -161,7 +291,8 @@ predicate arrayInitializerChild(AggregateLiteral parent, Expr e) {
 
 // i.e. not a constant folded expression
 predicate literallyLiteral(Literal lit) {
-  lit.getValueText()
+  lit
+      .getValueText()
       .regexpMatch(".*\".*|\\s*+[-+]?+\\s*+(0[xob][0-9a-fA-F]|[0-9])[0-9a-fA-F,._]*+([eE][-+]?+[0-9,._]*+)?+\\s*+[a-zA-Z]*+\\s*+")
 }
 

cpp/ql/src/DefaultOptions.qll

@@ -59,9 +59,14 @@ class Options extends string {
   predicate exits(Function f) {
     f.getAnAttribute().hasName("noreturn")
     or
-    f.hasGlobalOrStdName([
-        "exit", "_exit", "abort", "__assert_fail", "longjmp", "__builtin_unreachable"
-      ])
+    exists(string name | f.hasGlobalOrStdName(name) |
+      name = "exit" or
+      name = "_exit" or
+      name = "abort" or
+      name = "__assert_fail" or
+      name = "longjmp" or
+      name = "__builtin_unreachable"
+    )
     or
     CustomOptions::exits(f) // old Options.qll
   }

cpp/ql/src/JPL_C/LOC-2/Rule 05/HeapMemory.ql

@@ -21,7 +21,15 @@ class Initialization extends Function {
 }
 
 class Allocation extends FunctionCall {
-  Allocation() { this.getTarget().getName() = ["malloc", "calloc", "alloca", "sbrk", "valloc"] }
+  Allocation() {
+    exists(string name | name = this.getTarget().getName() |
+      name = "malloc" or
+      name = "calloc" or
+      name = "alloca" or
+      name = "sbrk" or
+      name = "valloc"
+    )
+  }
 }
 
 from Function f, Allocation a

cpp/ql/src/JPL_C/LOC-2/Rule 07/ThreadSafety.ql

@@ -13,8 +13,13 @@ import cpp
 
 class ForbiddenCall extends FunctionCall {
   ForbiddenCall() {
-    this.getTarget().getName() =
-      ["task_delay", "taskDelay", "sleep", "nanosleep", "clock_nanosleep"]
+    exists(string name | name = this.getTarget().getName() |
+      name = "task_delay" or
+      name = "taskDelay" or
+      name = "sleep" or
+      name = "nanosleep" or
+      name = "clock_nanosleep"
+    )
   }
 }
 

cpp/ql/src/JPL_C/LOC-2/Rule 09/Semaphores.qll

@@ -6,7 +6,12 @@ import cpp
 
 class SemaphoreCreation extends FunctionCall {
   SemaphoreCreation() {
-    this.getTarget().getName() = ["semBCreate", "semMCreate", "semCCreate", "semRWCreate"]
+    exists(string name | name = this.getTarget().getName() |
+      name = "semBCreate" or
+      name = "semMCreate" or
+      name = "semCCreate" or
+      name = "semRWCreate"
+    )
   }
 
   Variable getSemaphore() { result.getAnAccess() = this.getParent().(Assignment).getLValue() }
@@ -67,7 +72,11 @@ class SemaphoreGive extends UnlockOperation {
 }
 
 class LockingPrimitive extends FunctionCall, LockOperation {
-  LockingPrimitive() { this.getTarget().getName() = ["taskLock", "intLock", "taskRtpLock"] }
+  LockingPrimitive() {
+    exists(string name | name = this.getTarget().getName() |
+      name = "taskLock" or name = "intLock" or name = "taskRtpLock"
+    )
+  }
 
   override Function getLocked() { result = this.getTarget() }
 
@@ -80,7 +89,11 @@ class LockingPrimitive extends FunctionCall, LockOperation {
 }
 
 class UnlockingPrimitive extends FunctionCall, UnlockOperation {
-  UnlockingPrimitive() { this.getTarget().getName() = ["taskUnlock", "intUnlock", "taskRtpUnlock"] }
+  UnlockingPrimitive() {
+    exists(string name | name = this.getTarget().getName() |
+      name = "taskUnlock" or name = "intUnlock" or name = "taskRtpUnlock"
+    )
+  }
 
   Function getLocked() { result = getMatchingLock().getLocked() }
 

cpp/ql/src/JPL_C/LOC-3/Rule 17/BasicIntTypes.ql

@@ -12,7 +12,18 @@
 import cpp
 
 predicate allowedTypedefs(TypedefType t) {
-  t.getName() = ["I64", "U64", "I32", "U32", "I16", "U16", "I8", "U8", "F64", "F32"]
+  exists(string name | name = t.getName() |
+    name = "I64" or
+    name = "U64" or
+    name = "I32" or
+    name = "U32" or
+    name = "I16" or
+    name = "U16" or
+    name = "I8" or
+    name = "U8" or
+    name = "F64" or
+    name = "F32"
+  )
 }
 
 /**

cpp/ql/src/JPL_C/Tasks.qll

@@ -5,8 +5,8 @@ import cpp
  */
 class Task extends Function {
   Task() {
-    exists(FunctionCall taskCreate |
-      taskCreate.getTarget().getName() = ["taskCreate", "taskSpawn"] and
+    exists(FunctionCall taskCreate, string name | name = "taskCreate" or name = "taskSpawn" |
+      name = taskCreate.getTarget().getName() and
       this = taskCreate.getArgument(4).(AddressOfExpr).getAddressable()
     )
   }

cpp/ql/src/Likely Bugs/Conversion/LossyFunctionResultCast.ql

@@ -13,17 +13,38 @@ import cpp
 import semmle.code.cpp.dataflow.DataFlow
 
 predicate whitelist(Function f) {
-  f.getName() =
-    [
-      "ceil", "ceilf", "ceill", "floor", "floorf", "floorl", "nearbyint", "nearbyintf",
-      "nearbyintl", "rint", "rintf", "rintl", "round", "roundf", "roundl", "trunc", "truncf",
-      "truncl"
-    ] or
-  f.getName().matches("__builtin_%")
+  exists(string fName |
+    fName = f.getName() and
+    (
+      fName = "ceil" or
+      fName = "ceilf" or
+      fName = "ceill" or
+      fName = "floor" or
+      fName = "floorf" or
+      fName = "floorl" or
+      fName = "nearbyint" or
+      fName = "nearbyintf" or
+      fName = "nearbyintl" or
+      fName = "rint" or
+      fName = "rintf" or
+      fName = "rintl" or
+      fName = "round" or
+      fName = "roundf" or
+      fName = "roundl" or
+      fName = "trunc" or
+      fName = "truncf" or
+      fName = "truncl" or
+      fName.matches("__builtin_%")
+    )
+  )
 }
 
 predicate whitelistPow(FunctionCall fc) {
-  fc.getTarget().getName() = ["pow", "powf", "powl"] and
+  (
+    fc.getTarget().getName() = "pow" or
+    fc.getTarget().getName() = "powf" or
+    fc.getTarget().getName() = "powl"
+  ) and
   exists(float value |
     value = fc.getArgument(0).getValue().toFloat() and
     (value.floor() - value).abs() < 0.001

cpp/ql/src/Security/CWE/CWE-014/MemsetMayBeDeleted-bad.c

@@ -1,3 +0,0 @@
-char password[MAX_PASSWORD_LENGTH];
-// read and verify password
-memset(password, 0, MAX_PASSWORD_LENGTH);

cpp/ql/src/Security/CWE/CWE-014/MemsetMayBeDeleted-good.c

@@ -1,3 +0,0 @@
-char password[MAX_PASSWORD_LENGTH];
-// read and verify password
-memset_s(password, MAX_PASSWORD_LENGTH, 0, MAX_PASSWORD_LENGTH);

cpp/ql/src/Security/CWE/CWE-014/MemsetMayBeDeleted.qhelp

@@ -1,45 +0,0 @@
-<!DOCTYPE qhelp PUBLIC
-  "-//Semmle//qhelp//EN"
-  "qhelp.dtd">
-<qhelp>
-<overview>
-<p>Calling <code>memset</code> or <code>bzero</code> on a buffer to clear its contents may get optimized
-away by the compiler if the buffer is not subsequently used. This is not desirable behavior if the buffer
-contains sensitive data that could somehow be retrieved by an attacker.</p>
-
-</overview>
-<recommendation>
-
-<p>Use alternative platform-supplied functions that will not get optimized away. Examples of such
-functions include <code>memset_s</code>, <code>SecureZeroMemory</code>, and <code>bzero_explicit</code>.
-Alternatively, passing the <code>-fno-builtin-memset</code> option to the GCC/Clang compiler usually
-also prevents the optimization. Finally, you can use the public-domain <code>secure_memzero</code> function
-(see references below). This function, however, is not guaranteed to work on all platforms and compilers.</p>
-
-</recommendation>
-<example>
-<p>The following program fragment uses <code>memset</code> to erase sensitive information after it is no
-longer needed:</p>
-<sample src="MemsetMayBeDeleted-bad.c" />
-<p>Because of dead store elimination, the call to <code>memset</code> may be removed by the compiler
-(since the buffer is not subsequently used), resulting in potentially sensitive data remaining in memory.
-</p>
-
-<p>The best solution to this problem is to use the <code>memset_s</code> function instead of
-<code>memset</code>:</p>
-<sample src="MemsetMayBeDeleted-good.c" />
-
-</example>
-<references>
-
-<li>
-CERT C Coding Standard:
-<a href="https://wiki.sei.cmu.edu/confluence/display/c/MSC06-C.+Beware+of+compiler+optimizations">MSC06-C. Beware of compiler optimizations</a>.
-</li>
-<li>
-USENIX: The Advanced Computing Systems Association:
-<a href="https://www.usenix.org/system/files/conference/usenixsecurity17/sec17-yang.pdf">Dead Store Elimination (Still) Considered Harmfuls</a>
-</li>
-
-</references>
-</qhelp>

cpp/ql/src/Security/CWE/CWE-014/MemsetMayBeDeleted.ql

@@ -1,81 +0,0 @@
-/**
- * @name Call to `memset` may be deleted
- * @description Using the `memset` function to clear private data in a variable that has no subsequent use
- *              can make information-leak vulnerabilities easier to exploit because the compiler can remove the call.
- * @kind problem
- * @id cpp/memset-may-be-deleted
- * @problem.severity warning
- * @precision high
- * @tags security
- *       external/cwe/cwe-14
- */
-
-import cpp
-import semmle.code.cpp.dataflow.EscapesTree
-import semmle.code.cpp.commons.Exclusions
-import semmle.code.cpp.models.interfaces.Alias
-
-class MemsetFunction extends Function {
-  MemsetFunction() {
-    this.hasGlobalOrStdOrBslName("memset")
-    or
-    this.hasGlobalOrStdName("wmemset")
-    or
-    this.hasGlobalName(["bzero", "__builtin_memset"])
-  }
-}
-
-predicate isNonEscapingArgument(Expr escaped) {
-  exists(Call call, AliasFunction aliasFunction, int i |
-    aliasFunction = call.getTarget() and
-    call.getArgument(i) = escaped.getUnconverted() and
-    (
-      aliasFunction.parameterNeverEscapes(i)
-      or
-      aliasFunction.parameterEscapesOnlyViaReturn(i) and
-      (call instanceof ExprInVoidContext or call.getConversion*() instanceof BoolConversion)
-    )
-  )
-}
-
-pragma[noinline]
-predicate callToMemsetWithRelevantVariable(
-  LocalVariable v, VariableAccess acc, FunctionCall call, MemsetFunction memset
-) {
-  not v.isStatic() and
-  // Reference-typed variables get special treatment in `variableAddressEscapesTree` so we leave them
-  // out of this query.
-  not v.getUnspecifiedType() instanceof ReferenceType and
-  call.getTarget() = memset and
-  acc = v.getAnAccess() and
-  // `v` escapes as the argument to `memset`
-  variableAddressEscapesTree(acc, call.getArgument(0).getFullyConverted())
-}
-
-pragma[noinline]
-predicate relevantVariable(LocalVariable v, FunctionCall call, MemsetFunction memset) {
-  exists(VariableAccess acc, VariableAccess anotherAcc |
-    callToMemsetWithRelevantVariable(v, acc, call, memset) and
-    // `v` is not only just used in the call to `memset`.
-    anotherAcc = v.getAnAccess() and
-    acc != anotherAcc and
-    not anotherAcc.isUnevaluated()
-  )
-}
-
-from FunctionCall call, LocalVariable v, MemsetFunction memset
-where
-  relevantVariable(v, call, memset) and
-  not isFromMacroDefinition(call) and
-  // `v` doesn't escape anywhere else.
-  forall(Expr escape | variableAddressEscapesTree(v.getAnAccess(), escape) |
-    isNonEscapingArgument(escape)
-  ) and
-  // There is no later use of `v`.
-  not v.getAnAccess() = call.getASuccessor*() and
-  // Not using the `-fno-builtin-memset` flag
-  exists(Compilation c |
-    c.getAFileCompiled() = call.getFile() and
-    not c.getAnArgument() = "-fno-builtin-memset"
-  )
-select call, "Call to " + memset.getName() + " may be deleted by the compiler."

cpp/ql/src/Security/CWE/CWE-020/ExternalAPIsSpecific.qll

@@ -46,7 +46,7 @@ class UntrustedDataToExternalAPIConfig extends TaintTracking::Configuration {
   UntrustedDataToExternalAPIConfig() { this = "UntrustedDataToExternalAPIConfig" }
 
   override predicate isSource(DataFlow::Node source) {
-    exists(RemoteFlowSourceFunction remoteFlow |
+    exists(RemoteFlowFunction remoteFlow |
       remoteFlow = source.asExpr().(Call).getTarget() and
       remoteFlow.hasRemoteFlowSource(_, _)
     )

cpp/ql/src/Security/CWE/CWE-079/CgiXss.ql

@@ -29,15 +29,9 @@ class QueryString extends EnvironmentRead {
 }
 
 class Configuration extends TaintTrackingConfiguration {
-  override predicate isSource(Expr source) { source instanceof QueryString }
-
   override predicate isSink(Element tainted) {
     exists(PrintStdoutCall call | call.getAnArgument() = tainted)
   }
-
-  override predicate isBarrier(Expr e) {
-    super.isBarrier(e) or e.getUnspecifiedType() instanceof IntegralType
-  }
 }
 
 from QueryString query, Element printedArg, PathNode sourceNode, PathNode sinkNode

cpp/ql/src/Security/CWE/CWE-089/SqlTainted.ql

@@ -27,10 +27,6 @@ class Configuration extends TaintTrackingConfiguration {
   override predicate isSink(Element tainted) {
     exists(SQLLikeFunction runSql | runSql.outermostWrapperFunctionCall(tainted, _))
   }
-
-  override predicate isBarrier(Expr e) {
-    super.isBarrier(e) or e.getUnspecifiedType() instanceof IntegralType
-  }
 }
 
 from

cpp/ql/src/Security/CWE/CWE-191/UnsignedDifferenceExpressionComparedZero.c

@@ -1,5 +0,0 @@
-unsigned limit = get_limit();
-unsigned total = 0;
-while (limit - total > 0) { // wrong: if `total` is greater than `limit` this will underflow and continue executing the loop.
-  total += get_data();
-}

cpp/ql/src/Security/CWE/CWE-191/UnsignedDifferenceExpressionComparedZero.qhelp

@@ -1,31 +0,0 @@
-<!DOCTYPE qhelp PUBLIC
-  "-//Semmle//qhelp//EN"
-  "qhelp.dtd">
-<qhelp>
-<overview>
-<p>
-This rule finds relational comparisons between the result of an unsigned subtraction and the value <code>0</code>.
-Such comparisons are likely to be wrong as the value of an unsigned subtraction can never be negative. So the
-relational comparison ends up checking whether the result of the subtraction is equal to <code>0</code>.
-This is probably not what the programmer intended.
-</p>
-</overview>
-<recommendation>
-
-<p>If a relational comparison is intended, consider casting the result of the subtraction to a signed type.
-   If the intention was to test for equality, consider replacing the relational comparison with an equality test.
-</p>
-
-</recommendation>
-<example>
-<sample src="UnsignedDifferenceExpressionComparedZero.c" />
-
-</example>
-<references>
-
-<li>SEI CERT C Coding Standard:
-<a href="https://wiki.sei.cmu.edu/confluence/display/c/INT02-C.+Understand+integer+conversion+rules">INT02-C. Understand integer conversion rules</a>.
-</li>
-
-</references>
-</qhelp>

cpp/ql/src/Security/CWE/CWE-191/UnsignedDifferenceExpressionComparedZero.ql

@@ -1,49 +0,0 @@
-/**
- * @name Unsigned difference expression compared to zero
- * @description A subtraction with an unsigned result can never be negative. Using such an expression in a relational comparison with `0` is likely to be wrong.
- * @kind problem
- * @id cpp/unsigned-difference-expression-compared-zero
- * @problem.severity warning
- * @precision medium
- * @tags security
- *       correctness
- *       external/cwe/cwe-191
- */
-
-import cpp
-import semmle.code.cpp.commons.Exclusions
-import semmle.code.cpp.valuenumbering.GlobalValueNumbering
-import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis
-import semmle.code.cpp.controlflow.Guards
-
-/** Holds if `sub` is guarded by a condition which ensures that `left >= right`. */
-pragma[noinline]
-predicate isGuarded(SubExpr sub, Expr left, Expr right) {
-  exists(GuardCondition guard |
-    guard.controls(sub.getBasicBlock(), true) and
-    guard.ensuresLt(left, right, 0, sub.getBasicBlock(), false)
-  )
-}
-
-/** Holds if `sub` will never be negative. */
-predicate nonNegative(SubExpr sub) {
-  not exprMightOverflowNegatively(sub.getFullyConverted())
-  or
-  // The subtraction is guarded by a check of the form `left >= right`.
-  exists(GVN left, GVN right |
-    // This is basically a poor man's version of a directional unbind operator.
-    strictcount([left, globalValueNumber(sub.getLeftOperand())]) = 1 and
-    strictcount([right, globalValueNumber(sub.getRightOperand())]) = 1 and
-    isGuarded(sub, left.getAnExpr(), right.getAnExpr())
-  )
-}
-
-from RelationalOperation ro, SubExpr sub
-where
-  not isFromMacroDefinition(ro) and
-  not isFromMacroDefinition(sub) and
-  ro.getLesserOperand().getValue().toInt() = 0 and
-  ro.getGreaterOperand() = sub and
-  sub.getFullyConverted().getUnspecifiedType().(IntegralType).isUnsigned() and
-  not nonNegative(sub)
-select ro, "Unsigned subtraction can never be negative."

cpp/ql/src/Security/CWE/CWE-313/CleartextSqliteDatabase.ql

@@ -34,10 +34,6 @@ predicate sqlite_encryption_used() {
 }
 
 class Configuration extends TaintTrackingConfiguration {
-  override predicate isSource(Expr source) {
-    super.isSource(source) and source instanceof SensitiveExpr
-  }
-
   override predicate isSink(Element taintedArg) {
     exists(SqliteFunctionCall sqliteCall |
       taintedArg = sqliteCall.getASource() and

cpp/ql/src/Security/CWE/CWE-457/InitializationFunctions.qll

@@ -189,7 +189,8 @@ class InitializationFunction extends Function {
       // Field wise assignment to the parameter
       any(Assignment e).getLValue() = getAFieldAccess(this.getParameter(i)) or
       i =
-        this.(MemberFunction)
+        this
+            .(MemberFunction)
             .getAnOverridingFunction+()
             .(InitializationFunction)
             .initializedParameter() or
@@ -326,37 +327,52 @@ class InitializationFunction extends Function {
       // Return value is not a success code but the output functions never fail.
       name.matches("_Interlocked%")
       or
-      name =
-        [
-          // Functions that never fail, according to MSDN.
-          "QueryPerformanceCounter", "QueryPerformanceFrequency",
-          // Functions that never fail post-Vista, according to MSDN.
-          "InitializeCriticalSectionAndSpinCount",
-          // `rand_s` writes 0 to a non-null argument if it fails, according to MSDN.
-          "rand_s",
-          // IntersectRect initializes the argument regardless of whether the input intersects
-          "IntersectRect", "SetRect", "UnionRect",
-          // These functions appears to have an incorrect CFG, which leads to false positives
-          "PhysicalToLogicalDPIPoint", "LogicalToPhysicalDPIPoint",
-          // Sets NtProductType to default on error
-          "RtlGetNtProductType",
-          // Our CFG is not sophisticated enough to detect that the argument is always initialized
-          "StringCchLengthA",
-          // All paths init the argument, and always returns SUCCESS.
-          "RtlUnicodeToMultiByteSize",
-          // All paths init the argument, and always returns SUCCESS.
-          "RtlMultiByteToUnicodeSize",
-          // All paths init the argument, and always returns SUCCESS.
-          "RtlUnicodeToMultiByteN",
-          // Always initializes argument
-          "RtlGetFirstRange",
-          // Destination range is zeroed out on failure, assuming first two parameters are valid
-          "memcpy_s",
-          // This zeroes the memory unconditionally
-          "SeCreateAccessState",
-          // Argument initialization is optional, but always succeeds
-          "KeGetCurrentProcessorNumberEx"
-        ]
+      // Functions that never fail, according to MSDN.
+      name = "QueryPerformanceCounter"
+      or
+      name = "QueryPerformanceFrequency"
+      or
+      // Functions that never fail post-Vista, according to MSDN.
+      name = "InitializeCriticalSectionAndSpinCount"
+      or
+      // `rand_s` writes 0 to a non-null argument if it fails, according to MSDN.
+      name = "rand_s"
+      or
+      // IntersectRect initializes the argument regardless of whether the input intersects
+      name = "IntersectRect"
+      or
+      name = "SetRect"
+      or
+      name = "UnionRect"
+      or
+      // These functions appears to have an incorrect CFG, which leads to false positives
+      name = "PhysicalToLogicalDPIPoint"
+      or
+      name = "LogicalToPhysicalDPIPoint"
+      or
+      // Sets NtProductType to default on error
+      name = "RtlGetNtProductType"
+      or
+      // Our CFG is not sophisticated enough to detect that the argument is always initialized
+      name = "StringCchLengthA"
+      or
+      // All paths init the argument, and always returns SUCCESS.
+      name = "RtlUnicodeToMultiByteSize"
+      or
+      // All paths init the argument, and always returns SUCCESS.
+      name = "RtlMultiByteToUnicodeSize"
+      or
+      // All paths init the argument, and always returns SUCCESS.
+      name = "RtlUnicodeToMultiByteN"
+      or
+      // Always initializes argument
+      name = "RtlGetFirstRange"
+      or
+      // Destination range is zeroed out on failure, assuming first two parameters are valid
+      name = "memcpy_s"
+      or
+      // This zeroes the memory unconditionally
+      name = "SeCreateAccessState"
     )
   }
 }
@@ -459,9 +475,12 @@ class ConditionalInitializationCall extends FunctionCall {
       fa.getASuccessor+() = result
     ) and
     result =
-      this.getArgument(getTarget(this)
-            .(ConditionalInitializationFunction)
-            .conditionallyInitializedParameter(_)).(AddressOfExpr).getOperand()
+      this
+          .getArgument(getTarget(this)
+                .(ConditionalInitializationFunction)
+                .conditionallyInitializedParameter(_))
+          .(AddressOfExpr)
+          .getOperand()
   }
 
   Variable getStatusVariable() {

cpp/ql/src/Security/CWE/CWE-676/DangerousFunctionOverflow.ql

@@ -8,7 +8,6 @@
  * @tags reliability
  *       security
  *       external/cwe/cwe-242
- *       external/cwe/cwe-676
  */
 
 import cpp

cpp/ql/src/Security/CWE/CWE-732/FilePermissions.qll

@@ -140,9 +140,12 @@ class FopenCreationExpr extends FileCreationExpr {
 
 class FopensCreationExpr extends FileCreationExpr {
   FopensCreationExpr() {
-    this.getTarget().getName() = ["fopen_s", "_wfopen_s"] and
+    exists(string name | name = this.getTarget().getName() |
+      name = "fopen_s" or
+      name = "_wfopen_s"
+    ) and
     exists(string mode |
-      mode = ["w", "a"] and
+      (mode = "w" or mode = "a") and
       this.getArgument(2).getValue().matches(mode + "%")
     )
   }

cpp/ql/src/experimental/Security/CWE/CWE-120/MemoryUnsafeFunctionScan.cpp

@@ -13,10 +13,9 @@ int main(int argc, char **argv)
     char buf1[10];
     scanf("%s", buf1);
 
-    // GOOD, length is specified. The length should be one less than the size of the destination buffer, since the last character is the NULL terminator.
-    char buf2[20];
-    char buf3[10];
-    sscanf(buf2, "%9s", buf3);
+    // GOOD, length is specified. The length should be one less than the size of the buffer, since the last character is the NULL terminator.
+    char buf2[10];
+    sscanf(buf2, "%9s");
 
     // BAD, do not use scanf without specifying a length first
     char file[10];

cpp/ql/src/experimental/Security/CWE/CWE-190/AllocMultiplicationOverflow.cpp

@@ -1,19 +0,0 @@
-
-image::image(int width, int height)
-{
-	int x, y;
-
-	// allocate width * height pixels
-	pixels = new uint32_t[width * height];
-
-	// fill width * height pixels
-	for (y = 0; y < height; y++)
-	{
-		for (x = 0; x < width; x++)
-		{
-			pixels[(y * width) + height] = 0;
-		}
-	}
-
-	// ...
-}

cpp/ql/src/experimental/Security/CWE/CWE-190/AllocMultiplicationOverflow.qhelp

@@ -1,25 +0,0 @@
-<!DOCTYPE qhelp PUBLIC
-  "-//Semmle//qhelp//EN"
-  "qhelp.dtd">
-<qhelp>
-
-<overview>
-<p>The result of a multiplication is used in the size of an allocation. If the multiplication can be made to overflow, a much smaller amount of memory may be allocated than the rest of the code expects. This may lead to overflowing writes when the buffer is accessed later.</p>
-</overview>
-
-<recommendation>
-<p>To fix this issue, ensure that the arithmetic used in the size of an allocation cannot overflow before memory is allocated.</p>
-</recommendation>
-
-<example>
-<p>In the following example, an array of size <code>width * height</code> is allocated and stored as <code>pixels</code>. If <code>width</code> and <code>height</code> are set such that the multiplication overflows and wraps to a small value (say, 4) then the initialization code that follows the allocation will write beyond the end of the array.</p>
-<sample src="AllocMultiplicationOverflow.cpp"/>
-</example>
-
-<references>
-<li>
-  Cplusplus.com: <a href="http://www.cplusplus.com/articles/DE18T05o/">Integer overflow</a>.
-</li>
-</references>
-
-</qhelp>

cpp/ql/src/experimental/Security/CWE/CWE-190/AllocMultiplicationOverflow.ql

@@ -1,40 +0,0 @@
-/**
- * @name Multiplication result may overflow and be used in allocation
- * @description Using a multiplication result that may overflow in the size of an allocation may lead to buffer overflows when the allocated memory is used.
- * @kind path-problem
- * @problem.severity warning
- * @precision low
- * @tags security
- *       correctness
- *       external/cwe/cwe-190
- *       external/cwe/cwe-128
- * @id cpp/multiplication-overflow-in-alloc
- */
-
-import cpp
-import semmle.code.cpp.models.interfaces.Allocation
-import semmle.code.cpp.dataflow.DataFlow
-import DataFlow::PathGraph
-
-class MultToAllocConfig extends DataFlow::Configuration {
-  MultToAllocConfig() { this = "MultToAllocConfig" }
-
-  override predicate isSource(DataFlow::Node node) {
-    // a multiplication of two non-constant expressions
-    exists(MulExpr me |
-      me = node.asExpr() and
-      forall(Expr e | e = me.getAnOperand() | not exists(e.getValue()))
-    )
-  }
-
-  override predicate isSink(DataFlow::Node node) {
-    // something that affects an allocation size
-    node.asExpr() = any(AllocationExpr ae).getSizeExpr().getAChild*()
-  }
-}
-
-from MultToAllocConfig config, DataFlow::PathNode source, DataFlow::PathNode sink
-where config.hasFlowPath(source, sink)
-select sink, source, sink,
-  "Potentially overflowing value from $@ is used in the size of this allocation.", source,
-  "multiplication"

cpp/ql/src/experimental/Security/CWE/CWE-359/PrivateCleartextWrite.ql

@@ -16,6 +16,6 @@ import DataFlow::PathGraph
 
 from WriteConfig b, DataFlow::PathNode source, DataFlow::PathNode sink
 where b.hasFlowPath(source, sink)
-select sink.getNode(), source, sink,
-  "This write into the external location '" + sink.getNode() +
-    "' may contain unencrypted data from $@", source, "this source."
+select sink.getNode(),
+  "This write into the external location '" + sink + "' may contain unencrypted data from $@",
+  source, "this source."

cpp/ql/src/experimental/Security/CWE/CWE-401/MemoryLeakOnFailedCallToRealloc.c

@@ -1,20 +0,0 @@
-// BAD: on unsuccessful call to realloc, we will lose a pointer to a valid memory block
-if (currentSize < newSize)
-{
-	buffer = (unsigned char *)realloc(buffer, newSize);
-}
-
-
-
-// GOOD: this way we will exclude possible memory leak 
-unsigned char * tmp;
-if (currentSize < newSize)
-{
-	tmp = (unsigned char *)realloc(buffer, newSize);
-}
-if (tmp == NULL)
-{
-	free(buffer);
-} 
-else
-	buffer = tmp;

cpp/ql/src/experimental/Security/CWE/CWE-401/MemoryLeakOnFailedCallToRealloc.qhelp

@@ -1,38 +0,0 @@
-<!DOCTYPE qhelp PUBLIC
-  "-//Semmle//qhelp//EN"
-  "qhelp.dtd">
-<qhelp>
-<overview>
-<p>Memory leak on failed call to realloc. 
-The expression <code>mem = realloc (mem, size)</code> is potentially dangerous, if the call fails, we will lose the pointer to the memory block.  
-An unsuccessful call is possible not only when trying to allocate a large amount of memory, but also when the process memory is strongly segmented.</p>
-
-<p>False positives include code in which immediately after calling the realloc function, the pointer is manipulated without first checking for validity. 
-In this case, an exception will occur in the program and it will terminate. 
-But from the point of view of safe coding, these places require the attention of developers.
-At this stage, false positives are also possible in situations where the exception handling is quite complicated and occurs outside the base block in which memory is redistributed.</p>
-
-</overview>
-<recommendation>
-
-<p>We recommend storing the result in a temporary variable and eliminating memory leak.</p>
-
-</recommendation>
-<example>
-<p>The following example demonstrates an erroneous and corrected use of the <code>realloc</code> function.</p>
-<sample src="MemoryLeakOnFailedCallToRealloc.c" />
-
-</example>
-<references>
-
-<li>
-  CERT C++ Coding Standard:
-<a href="https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM51-CPP.+Properly+deallocate+dynamically+allocated+resources">MEM51-CPP. Properly deallocate dynamically allocated resources</a>.
-</li>
-<li>
-  CERT C Coding Standard:
-  <a href="https://wiki.sei.cmu.edu/confluence/display/c/WIN30-C.+Properly+pair+allocation+and+deallocation+functions">WIN30-C. Properly pair allocation and deallocation functions</a>.
-</li>
-
-</references>
-</qhelp>

cpp/ql/src/experimental/Security/CWE/CWE-401/MemoryLeakOnFailedCallToRealloc.ql

@@ -1,61 +0,0 @@
-/**
- * @name Memory leak on failed call to realloc
- * @description The expression mem = realloc (mem, size) is potentially dangerous, if the call fails, we will lose the pointer to the memory block.
- *              We recommend storing the result in a temporary variable and eliminating memory leak.
- * @kind problem
- * @id cpp/memory-leak-on-failed-call-to-realloc
- * @problem.severity warning
- * @precision medium
- * @tags correctness
- *       security
- *       external/cwe/cwe-401
- */
-
-import cpp
-import semmle.code.cpp.controlflow.Guards
-import semmle.code.cpp.valuenumbering.HashCons
-
-/**
- * A function call that potentially does not return (such as `exit`).
- */
-class CallMayNotReturn extends FunctionCall {
-  CallMayNotReturn() {
-    // call that is known to not return
-    not exists(this.(ControlFlowNode).getASuccessor())
-    or
-    // call to another function that may not return
-    exists(CallMayNotReturn exit | getTarget() = exit.getEnclosingFunction())
-  }
-}
-
-/**
- * A call to `realloc` of the form `v = realloc(v, size)`, for some variable `v`.
- */
-class ReallocCallLeak extends FunctionCall {
-  Variable v;
-
-  ReallocCallLeak() {
-    exists(AssignExpr ex |
-      this.getTarget().hasGlobalOrStdName("realloc") and
-      this = ex.getRValue() and
-      hashCons(ex.getLValue()) = hashCons(this.getArgument(0)) and
-      v.getAnAccess() = this.getArgument(0)
-    )
-  }
-
-  /**
-   * Holds if failure of this allocation may be handled by termination, for
-   * example a call to `exit()`.
-   */
-  predicate mayHandleByTermination() {
-    exists(GuardCondition guard, CallMayNotReturn exit |
-      this.(ControlFlowNode).getASuccessor*() = guard and
-      guard.getAChild*() = v.getAnAccess() and
-      guard.controls(exit.getBasicBlock(), _)
-    )
-  }
-}
-
-from ReallocCallLeak rcl
-where not rcl.mayHandleByTermination()
-select rcl, "possible loss of original pointer on unsuccessful call realloc"

cpp/ql/src/experimental/Security/CWE/CWE-570/WrongInDetectingAndHandlingMemoryAllocationErrors.cpp

@@ -1,35 +0,0 @@
-// BAD: on memory allocation error, the program terminates.
-void badFunction(const int *source, std::size_t length) noexcept {
-  int * dest = new int[length];
-  std::memset(dest, 0, length);
-// ..
-}
-// GOOD: memory allocation error will be handled.
-void goodFunction(const int *source, std::size_t length) noexcept {
-  try {
-       int * dest = new int[length];
-  } catch(std::bad_alloc) {
-    // ...
-  }
-  std::memset(dest, 0, length);
-// ..
-}
-// BAD: memory allocation error will not be handled.
-void badFunction(const int *source, std::size_t length) noexcept {
-  try {
-       int * dest = new (std::nothrow) int[length];
-  } catch(std::bad_alloc) {
-    // ...
-  }
-  std::memset(dest, 0, length);
-// ..
-}
-// GOOD: memory allocation error will be handled.
-void goodFunction(const int *source, std::size_t length) noexcept {
-  int * dest = new (std::nothrow) int[length];
-  if (!dest) {
-      return;
-  }
-  std::memset(dest, 0, length);
-// ..
-}

cpp/ql/src/experimental/Security/CWE/CWE-570/WrongInDetectingAndHandlingMemoryAllocationErrors.qhelp

@@ -1,27 +0,0 @@
-<!DOCTYPE qhelp PUBLIC
-  "-//Semmle//qhelp//EN"
-  "qhelp.dtd">
-<qhelp>
-<overview>
-<p>When using the <code>new</code> operator to allocate memory, you need to pay attention to the different ways of detecting errors. <code>::operator new(std::size_t)</code> throws an exception on error, whereas <code>::operator new(std::size_t, const std::nothrow_t &amp;)</code> returns zero on error. The programmer can get confused and check the error that occurs when allocating memory incorrectly. That can lead to an unhandled program termination or to a violation of the program logic.</p>
-
-</overview>
-<recommendation>
-
-<p>Use the correct error detection method corresponding with the memory allocation.</p>
-
-</recommendation>
-<example>
-<p>The following example demonstrates various approaches to detecting memory allocation errors using the <code>new</code> operator.</p>
-<sample src="WrongInDetectingAndHandlingMemoryAllocationErrors.cpp" />
-
-</example>
-<references>
-
-<li>
-  CERT C++ Coding Standard:
-<a href="https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM52-CPP.+Detect+and+handle+memory+allocation+errors">MEM52-CPP. Detect and handle memory allocation errors</a>.
-</li>
-
-</references>
-</qhelp>

cpp/ql/src/experimental/Security/CWE/CWE-570/WrongInDetectingAndHandlingMemoryAllocationErrors.ql

@@ -1,87 +0,0 @@
-/**
- * @name Detect And Handle Memory Allocation Errors
- * @description --::operator new(std::size_t) throws an exception on error, and ::operator new(std::size_t, const std::nothrow_t &) returns zero on error.
- *              --the programmer can get confused when check the error that occurs when allocating memory incorrectly.
- * @kind problem
- * @id cpp/detect-and-handle-memory-allocation-errors
- * @problem.severity warning
- * @precision medium
- * @tags correctness
- *       security
- *       external/cwe/cwe-570
- */
-
-import cpp
-
-/**
- * Lookup if condition compare with 0
- */
-class IfCompareWithZero extends IfStmt {
-  IfCompareWithZero() {
-    this.getCondition().(EQExpr).getAChild().getValue() = "0"
-    or
-    this.getCondition().(NEExpr).getAChild().getValue() = "0" and
-    this.hasElse()
-    or
-    this.getCondition().(NEExpr).getAChild().getValue() = "0" and
-    this.getThen().getAChild*() instanceof ReturnStmt
-  }
-}
-
-/**
- * lookup for calls to `operator new`, with incorrect error handling.
- */
-class WrongCheckErrorOperatorNew extends FunctionCall {
-  Expr exp;
-
-  WrongCheckErrorOperatorNew() {
-    this = exp.(NewOrNewArrayExpr).getAChild().(FunctionCall) and
-    (
-      this.getTarget().hasGlobalOrStdName("operator new")
-      or
-      this.getTarget().hasGlobalOrStdName("operator new[]")
-    )
-  }
-
-  /**
-   * Holds if handler `try ... catch` exists.
-   */
-  predicate isExistsTryCatchBlock() {
-    exists(TryStmt ts | this.getEnclosingStmt() = ts.getStmt().getAChild*())
-  }
-
-  /**
-   * Holds if results call `operator new` check in `operator if`.
-   */
-  predicate isExistsIfCondition() {
-    exists(IfCompareWithZero ifc, AssignExpr aex, Initializer it |
-      // call `operator new` directly from the condition of `operator if`.
-      this = ifc.getCondition().getAChild*()
-      or
-      // check results call `operator new` with variable appropriation
-      postDominates(ifc, this) and
-      aex.getAChild() = exp and
-      ifc.getCondition().getAChild().(VariableAccess).getTarget() =
-        aex.getLValue().(VariableAccess).getTarget()
-      or
-      // check results call `operator new` with declaration variable
-      postDominates(ifc, this) and
-      exp = it.getExpr() and
-      it.getDeclaration() = ifc.getCondition().getAChild().(VariableAccess).getTarget()
-    )
-  }
-
-  /**
-   * Holds if `(std::nothrow)` exists in call `operator new`.
-   */
-  predicate isExistsNothrow() { this.getAChild().toString() = "nothrow" }
-}
-
-from WrongCheckErrorOperatorNew op
-where
-  // use call `operator new` with `(std::nothrow)` and checking error using `try ... catch` block and not `operator if`
-  op.isExistsNothrow() and not op.isExistsIfCondition() and op.isExistsTryCatchBlock()
-  or
-  // use call `operator new` without `(std::nothrow)` and checking error using `operator if` and not  `try ... catch` block
-  not op.isExistsNothrow() and not op.isExistsTryCatchBlock() and op.isExistsIfCondition()
-select op, "memory allocation error check is incorrect or missing"

cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrlen.c

@@ -1,9 +0,0 @@
-// BAD: if buffer does not have a terminal zero, then access outside the allocated memory is possible.
-
-buffer[strlen(buffer)] = 0;
-
-
-// GOOD: we will eliminate dangerous behavior if we use a different method of calculating the length. 
-size_t len;
-...
-buffer[len] = 0

cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrlen.qhelp

@@ -1,31 +0,0 @@
-<!DOCTYPE qhelp PUBLIC
-  "-//Semmle//qhelp//EN"
-  "qhelp.dtd">
-<qhelp>
-<overview>
-<p>Potentially dangerous use of the strlen function to calculate the length of a string.
-The expression <code>buffer[strlen(buffer)] = 0</code> is potentially dangerous, if the variable buffer does not have a terminal zero, then access beyond the bounds of the allocated memory is possible, which will lead to undefined behavior.
-If terminal zero is present, then the specified expression is meaningless.</p>
-
-<p>False positives include heavily nested strlen. This situation is unlikely.</p>
-
-</overview>
-<recommendation>
-
-<p>We recommend using another method for calculating the string length</p>
-
-</recommendation>
-<example>
-<p>The following example demonstrates an erroneous and corrected use of the strlen function.</p>
-<sample src="AccessOfMemoryLocationAfterEndOfBufferUsingStrlen.c" />
-
-</example>
-<references>
-
-<li>
-  CERT C Coding Standard:
-  <a href="https://wiki.sei.cmu.edu/confluence/display/c/STR32-C.+Do+not+pass+a+non-null-terminated+character+sequence+to+a+library+function+that+expects+a+string">STR32-C. Do not pass a non-null-terminated character sequence to a library function that expects a string</a>.
-</li>
-
-</references>
-</qhelp>

cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrlen.ql

@@ -1,34 +0,0 @@
-/**
- * @name Access Of Memory Location After End Of Buffer
- * @description The expression `buffer [strlen (buffer)] = 0` is potentially dangerous, if the variable `buffer` does not have a terminal zero, then access beyond the bounds of the allocated memory is possible, which will lead to undefined behavior.
- *              If terminal zero is present, then the specified expression is meaningless.
- * @kind problem
- * @id cpp/access-memory-location-after-end-buffer
- * @problem.severity warning
- * @precision medium
- * @tags correctness
- *       security
- *       external/cwe/cwe-788
- */
-
-import cpp
-import semmle.code.cpp.valuenumbering.GlobalValueNumbering
-import semmle.code.cpp.dataflow.DataFlow
-
-from StrlenCall fc, AssignExpr expr, ArrayExpr exprarr
-where
-  exprarr = expr.getLValue() and
-  expr.getRValue().getValue().toInt() = 0 and
-  globalValueNumber(exprarr.getArrayOffset()) = globalValueNumber(fc) and
-  not exists(Expr exptmp |
-    (
-      DataFlow::localExprFlow(fc, exptmp) or
-      exptmp.getAChild*() = fc.getArgument(0).(VariableAccess).getTarget().getAnAccess()
-    ) and
-    dominates(exptmp, expr) and
-    postDominates(exptmp, fc) and
-    not exptmp.getEnclosingStmt() = fc.getEnclosingStmt() and
-    not exptmp.getEnclosingStmt() = expr.getEnclosingStmt()
-  ) and
-  globalValueNumber(fc.getArgument(0)) = globalValueNumber(exprarr.getArrayBase())
-select expr, "potential unsafe or redundant assignment."

cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.c

@@ -1,4 +0,0 @@
- 
-strncat(dest, source, sizeof(dest) - strlen(dest)); // BAD: writes a zero byte past the `dest` buffer.
-
-strncat(dest, source, sizeof(dest) - strlen(dest) -1); // GOOD: Reserves space for the zero byte.

cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.qhelp

@@ -1,32 +0,0 @@
-<!DOCTYPE qhelp PUBLIC
-  "-//Semmle//qhelp//EN"
-  "qhelp.dtd">
-<qhelp>
-<overview>
-<p>The standard library function <code>strncat(dest, source, count)</code> appends the <code>source</code> string to the <code>dest</code> string. <code>count</code> specifies the maximum number of characters to append and must be less than the remaining space in the target buffer. Calls of the form <code> strncat (dest, source, sizeof (dest) - strlen (dest)) </code> set the third argument to one more than possible. So when the <code>dest</code> is full, the expression <code> sizeof (dest) - strlen (dest) </code> will be equal to one, and not zero as the programmer might think. Making a call of this type may result in a zero byte being written just outside the <code>dest</code> buffer.</p>
-
-
-</overview>
-<recommendation>
-
-<p>We recommend subtracting one from the third argument. For example, replace <code>strncat(dest, source, sizeof(dest)-strlen(dest))</code> with <code>strncat(dest, source, sizeof(dest)-strlen(dest)-1)</code>.</p>
-
-</recommendation>
-<example>
-<p>The following example demonstrates an erroneous and corrected use of the <code>strncat</code> function.</p>
-<sample src="AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.c" />
-
-</example>
-<references>
-
-<li>
-  CERT C Coding Standard:
-<a href="https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator">STR31-C. Guarantee that storage for strings has sufficient space for character data and the null terminator</a>.
-</li>
-<li>
-  CERT C Coding Standard:
-  <a href="https://wiki.sei.cmu.edu/confluence/display/c/ARR30-C.+Do+not+form+or+use+out-of-bounds+pointers+or+array+subscripts">ARR30-C. Do not form or use out-of-bounds pointers or array subscripts</a>.
-</li>
-
-</references>
-</qhelp>

cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.ql

@@ -1,64 +0,0 @@
-/**
- * @name Access Of Memory Location After The End Of A Buffer Using Strncat
- * @description Calls of the form `strncat(dest, source, sizeof (dest) - strlen (dest))` set the third argument to one more than possible. So when `dest` is full, the expression `sizeof(dest) - strlen (dest)` will be equal to one, and not zero as the programmer might think. Making a call of this type may result in a zero byte being written just outside the `dest` buffer.
- * @kind problem
- * @id cpp/access-memory-location-after-end-buffer
- * @problem.severity warning
- * @precision medium
- * @tags correctness
- *       security
- *       external/cwe/cwe-788
- */
-
-import cpp
-import semmle.code.cpp.valuenumbering.GlobalValueNumbering
-
-/**
- * A call to `strncat` of the form `strncat(buff, str, someExpr - strlen(buf))`, for some expression `someExpr` equal to `sizeof(buff)`.
- */
-class WrongCallStrncat extends FunctionCall {
-  Expr leftsomeExpr;
-
-  WrongCallStrncat() {
-    this.getTarget().hasGlobalOrStdName("strncat") and
-    // the expression of the first argument in `strncat` and `strnlen` is identical
-    globalValueNumber(this.getArgument(0)) =
-      globalValueNumber(this.getArgument(2).(SubExpr).getRightOperand().(StrlenCall).getStringExpr()) and
-    // using a string constant often speaks of manually calculating the length of the required buffer.
-    (
-      not this.getArgument(1) instanceof StringLiteral and
-      not this.getArgument(1) instanceof CharLiteral
-    ) and
-    // for use in predicates
-    leftsomeExpr = this.getArgument(2).(SubExpr).getLeftOperand()
-  }
-
-  /**
-   * Holds if the left side of the expression `someExpr` equal to `sizeof(buf)`.
-   */
-  predicate isExpressionEqualSizeof() {
-    // the left side of the expression `someExpr` is `sizeof(buf)`.
-    globalValueNumber(this.getArgument(0)) =
-      globalValueNumber(leftsomeExpr.(SizeofExprOperator).getExprOperand())
-    or
-    // value of the left side of the expression `someExpr` equal  `sizeof(buf)` value, and `buf` is array.
-    leftsomeExpr.getValue().toInt() = this.getArgument(0).getType().getSize()
-  }
-
-  /**
-   * Holds if the left side of the expression `someExpr` equal to variable containing the length of the memory allocated for the buffer.
-   */
-  predicate isVariableEqualValueSizegBuffer() {
-    // the left side of expression `someExpr` is the variable that was used in the function of allocating memory for the buffer`.
-    exists(AllocationExpr alc |
-      leftsomeExpr.(VariableAccess).getTarget() =
-        alc.(FunctionCall).getArgument(0).(VariableAccess).getTarget()
-    )
-  }
-}
-
-from WrongCallStrncat sc
-where
-  sc.isExpressionEqualSizeof() or
-  sc.isVariableEqualValueSizegBuffer()
-select sc, "if the used buffer is full, writing out of the buffer is possible"

cpp/ql/src/jsf/4.09 Style/AV Rule 48.ql

@@ -31,7 +31,8 @@ predicate canonicalName1(Declaration d, string canonical) {
 
 predicate canonicalName2(Declaration d, string canonical) {
   canonical =
-    d.getName()
+    d
+        .getName()
         .replaceAll("_", "")
         .replaceAll("0", "O")
         .replaceAll("D", "O")

cpp/ql/src/semmle/code/cpp/AutogeneratedFile.qll

@@ -35,7 +35,8 @@ private predicate autogeneratedComment(string comment) {
         .regexpMatch("(?si).*(" +
             // replace `generated` with a regexp that also catches things like
             // `auto-generated`.
-            cond.replaceAll("generated", "(auto[\\w-]*[\\s/\\*\\r\\n]*)?generated")
+            cond
+                .replaceAll("generated", "(auto[\\w-]*[\\s/\\*\\r\\n]*)?generated")
                 // replace `!` with a regexp for end-of-sentence / separator characters.
                 .replaceAll("!", "[\\.\\?\\!\\-\\;\\,]")
                 // replace ` ` with a regexp for one or more whitespace characters

cpp/ql/src/semmle/code/cpp/Class.qll

@@ -236,8 +236,9 @@ class Class extends UserType {
     or
     exists(ClassDerivation cd | cd.getBaseClass() = base |
       result =
-        this.accessOfBaseMemberMulti(cd.getDerivedClass(),
-          fieldInBase.accessInDirectDerived(cd.getASpecifier().(AccessSpecifier)))
+        this
+            .accessOfBaseMemberMulti(cd.getDerivedClass(),
+              fieldInBase.accessInDirectDerived(cd.getASpecifier().(AccessSpecifier)))
     )
   }
 

cpp/ql/src/semmle/code/cpp/Comments.qll

@@ -50,5 +50,5 @@ class CStyleComment extends Comment {
  * ```
  */
 class CppStyleComment extends Comment {
-  CppStyleComment() { this.getContents().matches("//%") }
+  CppStyleComment() { this.getContents().prefix(2) = "//" }
 }

cpp/ql/src/semmle/code/cpp/Declaration.qll

@@ -139,19 +139,6 @@ class Declaration extends Locatable, @declaration {
     this.hasQualifiedName("std", "", name)
   }
 
-  /**
-   * Holds if this declaration has the given name in the global namespace,
-   * the `std` namespace or the `bsl` namespace.
-   * We treat `std` and `bsl` as the same in some of our models.
-   */
-  predicate hasGlobalOrStdOrBslName(string name) {
-    this.hasGlobalName(name)
-    or
-    this.hasQualifiedName("std", "", name)
-    or
-    this.hasQualifiedName("bsl", "", name)
-  }
-
   /** Gets a specifier of this declaration. */
   Specifier getASpecifier() { none() } // overridden in subclasses
 
@@ -491,8 +478,9 @@ class AccessHolder extends Declaration, TAccessHolder {
    */
   pragma[inline]
   predicate canAccessMember(Declaration member, Class derived) {
-    this.couldAccessMember(member.getDeclaringType(), member.getASpecifier().(AccessSpecifier),
-      derived)
+    this
+        .couldAccessMember(member.getDeclaringType(), member.getASpecifier().(AccessSpecifier),
+          derived)
   }
 
   /**

cpp/ql/src/semmle/code/cpp/Element.qll

@@ -270,12 +270,7 @@ private predicate isFromUninstantiatedTemplateRec(Element e, Element template) {
 }
 
 /**
- * A C++11 `static_assert` or C11 `_Static_assert` construct. For example each
- * line in the following example contains a static assert:
- * ```
- * static_assert(sizeof(MyStruct) <= 4096);
- * static_assert(sizeof(MyStruct) <= 4096, "MyStruct is too big!");
- * ```
+ * A C++11 `static_assert` or C11 `_Static_assert` construct.
  */
 class StaticAssert extends Locatable, @static_assert {
   override string toString() { result = "static_assert(..., \"" + getMessage() + "\")" }

cpp/ql/src/semmle/code/cpp/File.qll

@@ -363,8 +363,20 @@ class File extends Container, @file {
  */
 class HeaderFile extends File {
   HeaderFile() {
-    this.getExtension().toLowerCase() =
-      ["h", "r", "hpp", "hxx", "h++", "hh", "hp", "tcc", "tpp", "txx", "t++"]
+    exists(string ext | ext = this.getExtension().toLowerCase() |
+      ext = "h" or
+      ext = "r" or
+      /*    ---   */ ext = "hpp" or
+      ext = "hxx" or
+      ext = "h++" or
+      ext = "hh" or
+      ext = "hp" or
+      ext = "tcc" or
+      ext = "tpp" or
+      ext = "txx" or
+      ext = "t++"
+      /*    ---         ---    */
+    )
     or
     not exists(this.getExtension()) and
     exists(Include i | i.getIncludedFile() = this)
@@ -394,7 +406,7 @@ class HeaderFile extends File {
  * `File.compiledAsC`.
  */
 class CFile extends File {
-  CFile() { this.getExtension().toLowerCase() = ["c", "i"] }
+  CFile() { exists(string ext | ext = this.getExtension().toLowerCase() | ext = "c" or ext = "i") }
 
   override string getAPrimaryQlClass() { result = "CFile" }
 }
@@ -407,10 +419,21 @@ class CFile extends File {
  */
 class CppFile extends File {
   CppFile() {
-    this.getExtension().toLowerCase() =
-      ["cpp", "cxx", "c++", "cc", "cp", "icc", "ipp", "ixx", "i++", "ii"]
-    // Note: .C files are indistinguishable from .c files on some
-    // file systems, so we just treat them as CFile's.
+    exists(string ext | ext = this.getExtension().toLowerCase() |
+      /*     ---     */ ext = "cpp" or
+      ext = "cxx" or
+      ext = "c++" or
+      ext = "cc" or
+      ext = "cp" or
+      ext = "icc" or
+      ext = "ipp" or
+      ext = "ixx" or
+      ext = "i++" or
+      ext = "ii"
+      /*  ---    */
+      // Note: .C files are indistinguishable from .c files on some
+      // file systems, so we just treat them as CFile's.
+    )
   }
 
   override string getAPrimaryQlClass() { result = "CppFile" }

cpp/ql/src/semmle/code/cpp/Function.qll

@@ -334,18 +334,6 @@ class Function extends Declaration, ControlFlowNode, AccessHolder, @function {
     )
   }
 
-  /**
-   * Gets the class of which this function, called `memberName`, is a member.
-   *
-   * Prefer to use `getDeclaringType()` or `getName()` directly if you do not
-   * need to reason about both.
-   */
-  pragma[nomagic]
-  Class getClassAndName(string memberName) {
-    this.hasName(memberName) and
-    this.getDeclaringType() = result
-  }
-
   /**
    * Implements `ControlFlowNode.getControlFlowScope`. The `Function` is
    * used to represent the exit node of the control flow graph, so it is
@@ -403,30 +391,20 @@ class Function extends Declaration, ControlFlowNode, AccessHolder, @function {
   /** Holds if this function has a `noexcept` exception specification. */
   predicate isNoExcept() { getADeclarationEntry().isNoExcept() }
 
-  /**
-   * Gets a function that overloads this one.
-   *
-   * Note: if _overrides_ are wanted rather than _overloads_ then
-   * `MemberFunction::getAnOverridingFunction` should be used instead.
-   */
+  /** Gets a function that overloads this one. */
   Function getAnOverload() {
-    (
-      // If this function is declared in a class, only consider other
-      // functions from the same class.
-      exists(string name, Class declaringType |
-        candGetAnOverloadMember(name, declaringType, this) and
-        candGetAnOverloadMember(name, declaringType, result)
-      )
-      or
-      // Conversely, if this function is not
-      // declared in a class, only consider other functions not declared in a
-      // class.
-      exists(string name, Namespace namespace |
-        candGetAnOverloadNonMember(name, namespace, this) and
-        candGetAnOverloadNonMember(name, namespace, result)
-      )
-    ) and
+    result.getName() = getName() and
+    result.getNamespace() = getNamespace() and
     result != this and
+    // If this function is declared in a class, only consider other
+    // functions from the same class. Conversely, if this function is not
+    // declared in a class, only consider other functions not declared in a
+    // class.
+    (
+      if exists(getDeclaringType())
+      then result.getDeclaringType() = getDeclaringType()
+      else not exists(result.getDeclaringType())
+    ) and
     // Instantiations and specializations don't participate in overload
     // resolution.
     not (
@@ -467,15 +445,50 @@ class Function extends Declaration, ControlFlowNode, AccessHolder, @function {
       // ... and likewise for destructors.
       this.(Destructor).getADestruction().mayBeGloballyImpure()
     else
-      // Unless it's a function that we know is side-effect free, it may
-      // have side-effects.
-      not this.hasGlobalOrStdName([
-          "strcmp", "wcscmp", "_mbscmp", "strlen", "wcslen", "_mbslen", "_mbslen_l", "_mbstrlen",
-          "_mbstrlen_l", "strnlen", "strnlen_s", "wcsnlen", "wcsnlen_s", "_mbsnlen", "_mbsnlen_l",
-          "_mbstrnlen", "_mbstrnlen_l", "strncmp", "wcsncmp", "_mbsncmp", "_mbsncmp_l", "strchr",
-          "memchr", "wmemchr", "memcmp", "wmemcmp", "_memicmp", "_memicmp_l", "feof", "isdigit",
-          "isxdigit", "abs", "fabs", "labs", "floor", "ceil", "atoi", "atol", "atoll", "atof"
-        ])
+      not exists(string name | this.hasGlobalOrStdName(name) |
+        // Unless it's a function that we know is side-effect-free, it may
+        // have side-effects.
+        name = "strcmp" or
+        name = "wcscmp" or
+        name = "_mbscmp" or
+        name = "strlen" or
+        name = "wcslen" or
+        name = "_mbslen" or
+        name = "_mbslen_l" or
+        name = "_mbstrlen" or
+        name = "_mbstrlen_l" or
+        name = "strnlen" or
+        name = "strnlen_s" or
+        name = "wcsnlen" or
+        name = "wcsnlen_s" or
+        name = "_mbsnlen" or
+        name = "_mbsnlen_l" or
+        name = "_mbstrnlen" or
+        name = "_mbstrnlen_l" or
+        name = "strncmp" or
+        name = "wcsncmp" or
+        name = "_mbsncmp" or
+        name = "_mbsncmp_l" or
+        name = "strchr" or
+        name = "memchr" or
+        name = "wmemchr" or
+        name = "memcmp" or
+        name = "wmemcmp" or
+        name = "_memicmp" or
+        name = "_memicmp_l" or
+        name = "feof" or
+        name = "isdigit" or
+        name = "isxdigit" or
+        name = "abs" or
+        name = "fabs" or
+        name = "labs" or
+        name = "floor" or
+        name = "ceil" or
+        name = "atoi" or
+        name = "atol" or
+        name = "atoll" or
+        name = "atof"
+      )
   }
 
   /**
@@ -484,19 +497,6 @@ class Function extends Declaration, ControlFlowNode, AccessHolder, @function {
   override AccessHolder getEnclosingAccessHolder() { result = this.getDeclaringType() }
 }
 
-pragma[noinline]
-private predicate candGetAnOverloadMember(string name, Class declaringType, Function f) {
-  f.getName() = name and
-  f.getDeclaringType() = declaringType
-}
-
-pragma[noinline]
-private predicate candGetAnOverloadNonMember(string name, Namespace namespace, Function f) {
-  f.getName() = name and
-  f.getNamespace() = namespace and
-  not exists(f.getDeclaringType())
-}
-
 /**
  * A particular declaration or definition of a C/C++ function. For example the
  * declaration and definition of `MyFunction` in the following code are each a
@@ -680,7 +680,7 @@ class FunctionDeclarationEntry extends DeclarationEntry, @fun_decl {
 
 /**
  * A C/C++ non-member function (a function that is not a member of any
- * class). For example, in the following code, `MyFunction` is a
+ * class). For example the in the following code, `MyFunction` is a
  * `TopLevelFunction` but `MyMemberFunction` is not:
  * ```
  * void MyFunction() {

cpp/ql/src/semmle/code/cpp/Namespace.qll

@@ -7,21 +7,8 @@ import semmle.code.cpp.Type
 import semmle.code.cpp.metrics.MetricNamespace
 
 /**
- * A C++ namespace. For example the (single) namespace `A` in the following
- * code:
- * ```
- * namespace A
- * {
- *   // ...
- * }
+ * A C++ namespace.
  *
- * // ...
- *
- * namespace A
- * {
- *   // ...
- * }
- * ```
  * Note that namespaces are somewhat nebulous entities, as they do not in
  * general have a single well-defined location in the source code. The
  * related notion of a `NamespaceDeclarationEntry` is rather more concrete,
@@ -109,22 +96,10 @@ class Namespace extends NameQualifyingElement, @namespace {
 }
 
 /**
- * A declaration of (part of) a C++ namespace. This corresponds to a single
- * `namespace N { ... }` occurrence in the source code. For example the two
- * mentions of `A` in the following code:
- * ```
- * namespace A
- * {
- *   // ...
- * }
+ * A declaration of (part of) a C++ namespace.
  *
- * // ...
- *
- * namespace A
- * {
- *   // ...
- * }
- * ```
+ * This corresponds to a single `namespace N { ... }` occurrence in the
+ * source code.
  */
 class NamespaceDeclarationEntry extends Locatable, @namespace_decl {
   /**
@@ -168,9 +143,8 @@ class UsingEntry extends Locatable, @using {
 
 /**
  * A C++ `using` declaration. For example:
- * ```
- * using std::string;
- * ```
+ *
+ *   `using std::string;`
  */
 class UsingDeclarationEntry extends UsingEntry {
   UsingDeclarationEntry() {
@@ -188,9 +162,8 @@ class UsingDeclarationEntry extends UsingEntry {
 
 /**
  * A C++ `using` directive. For example:
- * ```
- * using namespace std;
- * ```
+ *
+ *   `using namespace std;`
  */
 class UsingDirectiveEntry extends UsingEntry {
   UsingDirectiveEntry() {

cpp/ql/src/semmle/code/cpp/Preprocessor.qll

@@ -2,14 +2,9 @@ import semmle.code.cpp.Location
 import semmle.code.cpp.Element
 
 /**
- * A C/C++ preprocessor directive. For example each of the following lines of
- * code contains a `PreprocessorDirective`:
- * ```
- * #pragma once
- * #ifdef MYDEFINE
- * #include "myfile.h"
- * #line 1 "source.c"
- * ```
+ * A C/C++ preprocessor directive.
+ *
+ * For example: `#ifdef`, `#line`, or `#pragma`.
  */
 class PreprocessorDirective extends Locatable, @preprocdirect {
   override string toString() { result = "Preprocessor directive" }
@@ -103,9 +98,9 @@ class PreprocessorBranchDirective extends PreprocessorDirective, TPreprocessorBr
  * A C/C++ preprocessor branching directive: `#if`, `#ifdef`, `#ifndef`, or
  * `#elif`.
  *
- * A branching directive has a condition and that condition may be evaluated
- * at compile-time.  As a result, the preprocessor will either take the
- * branch, or not take the branch.
+ * A branching directive can have its condition evaluated at compile-time,
+ * and as a result, the preprocessor will either take the branch, or not
+ * take the branch.
  *
  * However, there are also situations in which a branch's condition isn't
  * evaluated.  The obvious case of this is when the directive is contained
@@ -141,13 +136,8 @@ class PreprocessorBranch extends PreprocessorBranchDirective, @ppd_branch {
 }
 
 /**
- * A C/C++ preprocessor `#if` directive. For example there is a
- * `PreprocessorIf` on the first line of the following code:
- * ```
- * #if defined(MYDEFINE)
- * // ...
- * #endif
- * ```
+ * A C/C++ preprocessor `#if` directive.
+ *
  * For the related notion of a directive which causes branching (which
  * includes `#if`, plus also `#ifdef`, `#ifndef`, and `#elif`), see
  * `PreprocessorBranch`.
@@ -157,13 +147,8 @@ class PreprocessorIf extends PreprocessorBranch, @ppd_if {
 }
 
 /**
- * A C/C++ preprocessor `#ifdef` directive. For example there is a
- * `PreprocessorIfdef` on the first line of the following code:
- * ```
- * #ifdef MYDEFINE
- * // ...
- * #endif
- * ```
+ * A C/C++ preprocessor `#ifdef` directive.
+ *
  * The syntax `#ifdef X` is shorthand for `#if defined(X)`.
  */
 class PreprocessorIfdef extends PreprocessorBranch, @ppd_ifdef {
@@ -173,13 +158,8 @@ class PreprocessorIfdef extends PreprocessorBranch, @ppd_ifdef {
 }
 
 /**
- * A C/C++ preprocessor `#ifndef` directive. For example there is a
- * `PreprocessorIfndef` on the first line of the following code:
- * ```
- * #ifndef MYDEFINE
- * // ...
- * #endif
- * ```
+ * A C/C++ preprocessor `#ifndef` directive.
+ *
  * The syntax `#ifndef X` is shorthand for `#if !defined(X)`.
  */
 class PreprocessorIfndef extends PreprocessorBranch, @ppd_ifndef {
@@ -187,80 +167,42 @@ class PreprocessorIfndef extends PreprocessorBranch, @ppd_ifndef {
 }
 
 /**
- * A C/C++ preprocessor `#else` directive. For example there is a
- * `PreprocessorElse` on the fifth line of the following code:
- * ```
- * #ifdef MYDEFINE1
- * // ...
- * #elif MYDEFINE2
- * // ...
- * #else
- * // ...
- * #endif
- * ```
+ * A C/C++ preprocessor `#else` directive.
  */
 class PreprocessorElse extends PreprocessorBranchDirective, @ppd_else {
   override string toString() { result = "#else" }
 }
 
 /**
- * A C/C++ preprocessor `#elif` directive. For example there is a
- * `PreprocessorElif` on the third line of the following code:
- * ```
- * #ifdef MYDEFINE1
- * // ...
- * #elif MYDEFINE2
- * // ...
- * #else
- * // ...
- * #endif
- * ```
+ * A C/C++ preprocessor `#elif` directive.
  */
 class PreprocessorElif extends PreprocessorBranch, @ppd_elif {
   override string toString() { result = "#elif " + this.getHead() }
 }
 
 /**
- * A C/C++ preprocessor `#endif` directive. For example there is a
- * `PreprocessorEndif` on the third line of the following code:
- * ```
- * #ifdef MYDEFINE
- * // ...
- * #endif
- * ```
+ * A C/C++ preprocessor `#endif` directive.
  */
 class PreprocessorEndif extends PreprocessorBranchDirective, @ppd_endif {
   override string toString() { result = "#endif" }
 }
 
 /**
- * A C/C++ preprocessor `#warning` directive. For example:
- * ```
- * #warning "This configuration is not supported."
- * ```
+ * A C/C++ preprocessor `#warning` directive.
  */
 class PreprocessorWarning extends PreprocessorDirective, @ppd_warning {
   override string toString() { result = "#warning " + this.getHead() }
 }
 
 /**
- * A C/C++ preprocessor `#error` directive. For example:
- * ```
- * #error "This configuration is not implemented."
- * ```
+ * A C/C++ preprocessor `#error` directive.
  */
 class PreprocessorError extends PreprocessorDirective, @ppd_error {
   override string toString() { result = "#error " + this.getHead() }
 }
 
 /**
- * A C/C++ preprocessor `#undef` directive. For example there is a
- * `PreprocessorUndef` on the second line of the following code:
- * ```
- * #ifdef MYMACRO
- * #undef MYMACRO
- * #endif
- * ```
+ * A C/C++ preprocessor `#undef` directive.
  */
 class PreprocessorUndef extends PreprocessorDirective, @ppd_undef {
   override string toString() { result = "#undef " + this.getHead() }
@@ -272,10 +214,7 @@ class PreprocessorUndef extends PreprocessorDirective, @ppd_undef {
 }
 
 /**
- * A C/C++ preprocessor `#pragma` directive. For example:
- * ```
- * #pragma once
- * ```
+ * A C/C++ preprocessor `#pragma` directive.
  */
 class PreprocessorPragma extends PreprocessorDirective, @ppd_pragma {
   override string toString() {
@@ -284,10 +223,7 @@ class PreprocessorPragma extends PreprocessorDirective, @ppd_pragma {
 }
 
 /**
- * A C/C++ preprocessor `#line` directive. For example:
- * ```
- * #line 1 "source.c"
- * ```
+ * A C/C++ preprocessor `#line` directive.
  */
 class PreprocessorLine extends PreprocessorDirective, @ppd_line {
   override string toString() { result = "#line " + this.getHead() }

cpp/ql/src/semmle/code/cpp/Print.qll

@@ -385,7 +385,7 @@ private class DumpFunction extends DumpDeclaration, Function {
 
   private string getACVQualifier() {
     result = getASpecifier().getName() and
-    result = ["const", "volatile"]
+    (result = "const" or result = "volatile")
   }
 
   private string getDeclaratorSuffix() {

cpp/ql/src/semmle/code/cpp/PrintAST.qll

@@ -34,7 +34,8 @@ private predicate shouldPrintFunction(Function func) {
 bindingset[s]
 private string escapeString(string s) {
   result =
-    s.replaceAll("\\", "\\\\")
+    s
+        .replaceAll("\\", "\\\\")
         .replaceAll("\n", "\\n")
         .replaceAll("\r", "\\r")
         .replaceAll("\t", "\\t")

cpp/ql/src/semmle/code/cpp/Specifier.qll

@@ -171,11 +171,8 @@ class StdAttribute extends Attribute, @stdattribute {
 }
 
 /**
- * An attribute introduced by Microsoft's `__declspec(name)` syntax.  For
- * example the attribute on the following declaration:
- * ```
- * __declspec(dllimport) void myFunction();
- * ```
+ * An attribute introduced by Microsoft's `__declspec(name)` syntax, for
+ * example: `__declspec(dllimport)`.
  */
 class Declspec extends Attribute, @declspec { }
 
@@ -189,13 +186,8 @@ class MicrosoftAttribute extends Attribute, @msattribute {
 }
 
 /**
- * A C++11 `alignas` construct. For example the attribute in the following
- * code:
- * ```
- * struct alignas(16) MyStruct {
- *   int x;
- * };
- * ```
+ * A C++11 `alignas` construct.
+ *
  * Though it doesn't use the attribute syntax, `alignas(...)` is presented
  * as an `Attribute` for consistency with the `[[align(...)]]` attribute.
  */
@@ -205,11 +197,7 @@ class AlignAs extends Attribute, @alignas {
 
 /**
  * A GNU `format` attribute of the form `__attribute__((format(archetype, format-index, first-arg)))`
- * that declares a function to accept a `printf` style format string.  For example the attribute
- * on the following declaration:
- * ```
- * int myPrintf(const char *format, ...) __attribute__((format(printf, 1, 2)));
- * ```
+ * that declares a function to accept a `printf` style format string.
  */
 class FormatAttribute extends GnuAttribute {
   FormatAttribute() { getName() = "format" }
@@ -254,11 +242,7 @@ class FormatAttribute extends GnuAttribute {
 }
 
 /**
- * An argument to an `Attribute`. For example the argument "dllimport" on the
- * attribute in the following code:
- * ```
- * __declspec(dllimport) void myFunction();
- * ```
+ * An argument to an `Attribute`.
  */
 class AttributeArgument extends Element, @attribute_arg {
   /**

cpp/ql/src/semmle/code/cpp/Type.qll

@@ -274,7 +274,7 @@ class Type extends Locatable, @type {
 
   /**
    * Gets this type with any typedefs resolved. For example, given
-   * `typedef C T`, this would resolve `const T&` to `const C&`.
+   * `typedef C T`, this would resolve `const T&` to `const C&`.
    * Note that this will only work if the resolved type actually appears
    * on its own elsewhere in the program.
    */
@@ -1544,9 +1544,9 @@ class FunctionPointerIshType extends DerivedType {
 /**
  * A C++ pointer to data member. See 15.5.
  * ```
- * class C { public: int m; };
+ * class C { int m; };
  * int C::* p = &C::m;          // pointer to data member m of class C
- * class C c;
+ * class C *;
  * int val = c.*p;              // access data member
  * ```
  */

cpp/ql/src/semmle/code/cpp/commons/DateTime.qll

@@ -14,7 +14,11 @@ class PackedTimeType extends Type {
   }
 }
 
-private predicate timeType(string typeName) { typeName = ["_SYSTEMTIME", "SYSTEMTIME", "tm"] }
+private predicate timeType(string typeName) {
+  typeName = "_SYSTEMTIME" or
+  typeName = "SYSTEMTIME" or
+  typeName = "tm"
+}
 
 /**
  * A type that is used to represent times and dates in an 'unpacked' form, that is,

cpp/ql/src/semmle/code/cpp/commons/Printf.qll

@@ -34,95 +34,66 @@ class AttributeFormattingFunction extends FormattingFunction {
 
 /**
  * A standard function such as `vprintf` that has a format parameter
- * and a variable argument list of type `va_arg`. `formatParamIndex` indicates
- * the format parameter and `type` indicates the type of `vprintf`:
- *  - `""` is a `vprintf` variant, `outputParamIndex` is `-1`.
- *  - `"f"` is a `vfprintf` variant, `outputParamIndex` indicates the output stream parameter.
- *  - `"s"` is a `vsprintf` variant, `outputParamIndex` indicates the output buffer parameter.
- *  - `"?"` if the type cannot be deteremined.  `outputParamIndex` is `-1`.
+ * and a variable argument list of type `va_arg`.
  */
-predicate primitiveVariadicFormatter(
-  TopLevelFunction f, string type, int formatParamIndex, int outputParamIndex
-) {
-  type = f.getName().regexpCapture("_?_?va?([fs]?)n?w?printf(_s)?(_p)?(_l)?", 1) and
+predicate primitiveVariadicFormatter(TopLevelFunction f, int formatParamIndex) {
+  f.getName().regexpMatch("_?_?va?[fs]?n?w?printf(_s)?(_p)?(_l)?") and
   (
     if f.getName().matches("%\\_l")
     then formatParamIndex = f.getNumberOfParameters() - 3
     else formatParamIndex = f.getNumberOfParameters() - 2
-  ) and
-  (
-    if type = "" then outputParamIndex = -1 else outputParamIndex = 0 // Conveniently, these buffer parameters are all at index 0.
-  ) and
-  not (
-    // exclude functions with an implementation in the snapshot source
-    // directory, as they may not be standard implementations.
-    exists(f.getBlock()) and
-    exists(f.getFile().getRelativePath())
-  )
-}
-
-private predicate callsVariadicFormatter(
-  Function f, string type, int formatParamIndex, int outputParamIndex
-) {
-  // calls a variadic formatter with `formatParamIndex`, `outputParamIndex` linked
-  exists(FunctionCall fc, int format, int output |
-    variadicFormatter(fc.getTarget(), type, format, output) and
-    fc.getEnclosingFunction() = f and
-    fc.getArgument(format) = f.getParameter(formatParamIndex).getAnAccess() and
-    fc.getArgument(output) = f.getParameter(outputParamIndex).getAnAccess()
-  )
-  or
-  // calls a variadic formatter with only `formatParamIndex` linked
-  exists(FunctionCall fc, string calledType, int format, int output |
-    variadicFormatter(fc.getTarget(), calledType, format, output) and
-    fc.getEnclosingFunction() = f and
-    fc.getArgument(format) = f.getParameter(formatParamIndex).getAnAccess() and
-    not fc.getArgument(output) = f.getParameter(_).getAnAccess() and
-    (
-      calledType = "" and
-      type = ""
-      or
-      calledType != "" and
-      type = "?" // we probably should have an `outputParamIndex` link but have lost it.
-    ) and
-    outputParamIndex = -1
   )
 }
 
 /**
- * Holds if `f` is a function such as `vprintf` that has a format parameter
- * and a variable argument list of type `va_arg`. `formatParamIndex` indicates
- * the format parameter and `type` indicates the type of `vprintf`:
- *  - `""` is a `vprintf` variant, `outputParamIndex` is `-1`.
- *  - `"f"` is a `vfprintf` variant, `outputParamIndex` indicates the output stream parameter.
- *  - `"s"` is a `vsprintf` variant, `outputParamIndex` indicates the output buffer parameter.
- *  - `"?"` if the type cannot be deteremined.  `outputParamIndex` is `-1`.
+ * A standard function such as `vsprintf` that has an output parameter
+ * and a variable argument list of type `va_arg`.
  */
-predicate variadicFormatter(Function f, string type, int formatParamIndex, int outputParamIndex) {
-  primitiveVariadicFormatter(f, type, formatParamIndex, outputParamIndex)
+private predicate primitiveVariadicFormatterOutput(TopLevelFunction f, int outputParamIndex) {
+  // note: this might look like the regular expression in `primitiveVariadicFormatter`, but
+  // there is one important difference: the [fs] part is not optional, as these classify
+  // the `printf` variants that write to a buffer.
+  // Conveniently, these buffer parameters are all at index 0.
+  f.getName().regexpMatch("_?_?va?[fs]n?w?printf(_s)?(_p)?(_l)?") and outputParamIndex = 0
+}
+
+private predicate callsVariadicFormatter(Function f, int formatParamIndex) {
+  exists(FunctionCall fc, int i |
+    variadicFormatter(fc.getTarget(), i) and
+    fc.getEnclosingFunction() = f and
+    fc.getArgument(i) = f.getParameter(formatParamIndex).getAnAccess()
+  )
+}
+
+private predicate callsVariadicFormatterOutput(Function f, int outputParamIndex) {
+  exists(FunctionCall fc, int i |
+    fc.getEnclosingFunction() = f and
+    variadicFormatterOutput(fc.getTarget(), i) and
+    fc.getArgument(i) = f.getParameter(outputParamIndex).getAnAccess()
+  )
+}
+
+/**
+ * Holds if `f` is a function such as `vprintf` that takes variable argument list
+ * of type `va_arg` and writes formatted output to a buffer given as a parameter at
+ * index `outputParamIndex`, if any.
+ */
+private predicate variadicFormatterOutput(Function f, int outputParamIndex) {
+  primitiveVariadicFormatterOutput(f, outputParamIndex)
   or
   not f.isVarargs() and
-  callsVariadicFormatter(f, type, formatParamIndex, outputParamIndex)
-}
-
-/**
- * A standard function such as `vprintf` that has a format parameter
- * and a variable argument list of type `va_arg`.
- *
- * DEPRECATED: Use the four argument version instead.
- */
-deprecated predicate primitiveVariadicFormatter(TopLevelFunction f, int formatParamIndex) {
-  primitiveVariadicFormatter(f, _, formatParamIndex, _)
+  callsVariadicFormatterOutput(f, outputParamIndex)
 }
 
 /**
  * Holds if `f` is a function such as `vprintf` that has a format parameter
  * (at `formatParamIndex`) and a variable argument list of type `va_arg`.
- *
- * DEPRECATED: Use the four argument version instead.
  */
-deprecated predicate variadicFormatter(Function f, int formatParamIndex) {
-  variadicFormatter(f, _, formatParamIndex, _)
+predicate variadicFormatter(Function f, int formatParamIndex) {
+  primitiveVariadicFormatter(f, formatParamIndex)
+  or
+  not f.isVarargs() and
+  callsVariadicFormatter(f, formatParamIndex)
 }
 
 /**
@@ -132,17 +103,11 @@ deprecated predicate variadicFormatter(Function f, int formatParamIndex) {
 class UserDefinedFormattingFunction extends FormattingFunction {
   override string getAPrimaryQlClass() { result = "UserDefinedFormattingFunction" }
 
-  UserDefinedFormattingFunction() { isVarargs() and callsVariadicFormatter(this, _, _, _) }
+  UserDefinedFormattingFunction() { isVarargs() and callsVariadicFormatter(this, _) }
 
-  override int getFormatParameterIndex() { callsVariadicFormatter(this, _, result, _) }
+  override int getFormatParameterIndex() { callsVariadicFormatter(this, result) }
 
-  override int getOutputParameterIndex(boolean isStream) {
-    callsVariadicFormatter(this, "f", _, result) and isStream = true
-    or
-    callsVariadicFormatter(this, "s", _, result) and isStream = false
-  }
-
-  override predicate isOutputGlobal() { callsVariadicFormatter(this, "", _, _) }
+  override int getOutputParameterIndex() { callsVariadicFormatterOutput(this, result) }
 }
 
 /**
@@ -908,7 +873,6 @@ class FormatLiteral extends Literal {
    */
   int getNumArgNeeded(int n) {
     exists(this.getConvSpecOffset(n)) and
-    exists(this.getConversionChar(n)) and
     result = count(int mode | hasFormatArgumentIndexFor(n, mode))
   }
 
@@ -1125,7 +1089,8 @@ class FormatLiteral extends Literal {
     then result = this.getFormat().substring(0, this.getConvSpecOffset(0))
     else
       result =
-        this.getFormat()
+        this
+            .getFormat()
             .substring(this.getConvSpecOffset(n - 1) + this.getConvSpec(n - 1).length(),
               this.getConvSpecOffset(n))
   }
@@ -1141,7 +1106,8 @@ class FormatLiteral extends Literal {
         if n > 0
         then
           result =
-            this.getFormat()
+            this
+                .getFormat()
                 .substring(this.getConvSpecOffset(n - 1) + this.getConvSpec(n - 1).length(),
                   this.getFormat().length())
         else result = this.getFormat()

cpp/ql/src/semmle/code/cpp/commons/Scanf.qll

@@ -34,10 +34,10 @@ class Scanf extends ScanfFunction {
   Scanf() {
     this instanceof TopLevelFunction and
     (
-      hasGlobalOrStdOrBslName("scanf") or // scanf(format, args...)
-      hasGlobalOrStdOrBslName("wscanf") or // wscanf(format, args...)
-      hasGlobalName("_scanf_l") or // _scanf_l(format, locale, args...)
-      hasGlobalName("_wscanf_l") // _wscanf_l(format, locale, args...)
+      hasName("scanf") or // scanf(format, args...)
+      hasName("wscanf") or // wscanf(format, args...)
+      hasName("_scanf_l") or // _scanf_l(format, locale, args...)
+      hasName("_wscanf_l") // _wscanf_l(format, locale, args...)
     )
   }
 
@@ -53,10 +53,10 @@ class Fscanf extends ScanfFunction {
   Fscanf() {
     this instanceof TopLevelFunction and
     (
-      hasGlobalOrStdOrBslName("fscanf") or // fscanf(src_stream, format, args...)
-      hasGlobalOrStdOrBslName("fwscanf") or // fwscanf(src_stream, format, args...)
-      hasGlobalName("_fscanf_l") or // _fscanf_l(src_stream, format, locale, args...)
-      hasGlobalName("_fwscanf_l") // _fwscanf_l(src_stream, format, locale, args...)
+      hasName("fscanf") or // fscanf(src_stream, format, args...)
+      hasName("fwscanf") or // fwscanf(src_stream, format, args...)
+      hasName("_fscanf_l") or // _fscanf_l(src_stream, format, locale, args...)
+      hasName("_fwscanf_l") // _fwscanf_l(src_stream, format, locale, args...)
     )
   }
 
@@ -72,10 +72,10 @@ class Sscanf extends ScanfFunction {
   Sscanf() {
     this instanceof TopLevelFunction and
     (
-      hasGlobalOrStdOrBslName("sscanf") or // sscanf(src_stream, format, args...)
-      hasGlobalOrStdOrBslName("swscanf") or // swscanf(src, format, args...)
-      hasGlobalName("_sscanf_l") or // _sscanf_l(src, format, locale, args...)
-      hasGlobalName("_swscanf_l") // _swscanf_l(src, format, locale, args...)
+      hasName("sscanf") or // sscanf(src_stream, format, args...)
+      hasName("swscanf") or // swscanf(src, format, args...)
+      hasName("_sscanf_l") or // _sscanf_l(src, format, locale, args...)
+      hasName("_swscanf_l") // _swscanf_l(src, format, locale, args...)
     )
   }
 
@@ -91,10 +91,8 @@ class Snscanf extends ScanfFunction {
   Snscanf() {
     this instanceof TopLevelFunction and
     (
-      hasGlobalName("_snscanf") or // _snscanf(src, max_amount, format, args...)
-      hasGlobalName("_snwscanf") or // _snwscanf(src, max_amount, format, args...)
-      hasGlobalName("_snscanf_l") or // _snscanf_l(src, max_amount, format, locale, args...)
-      hasGlobalName("_snwscanf_l") // _snwscanf_l(src, max_amount, format, locale, args...)
+      hasName("_snscanf") or // _snscanf(src, max_amount, format, args...)
+      hasName("_snwscanf") // _snwscanf(src, max_amount, format, args...)
       // note that the max_amount is not a limit on the output length, it's an input length
       // limit used with non null-terminated strings.
     )
@@ -103,12 +101,6 @@ class Snscanf extends ScanfFunction {
   override int getInputParameterIndex() { result = 0 }
 
   override int getFormatParameterIndex() { result = 2 }
-
-  /**
-   * Gets the position at which the maximum number of characters in the
-   * input string is specified.
-   */
-  int getInputLengthParameterIndex() { result = 1 }
 }
 
 /**

cpp/ql/src/semmle/code/cpp/commons/Synchronization.qll

@@ -87,7 +87,7 @@ abstract class MutexType extends Type {
 private Function mustlockCandidate() {
   exists(string name | name = result.getName() |
     name = "lock" or
-    name.matches("%mutex\\_lock")
+    name.suffix(name.length() - 10) = "mutex_lock"
   )
 }
 
@@ -97,7 +97,7 @@ private Function mustlockCandidate() {
 private Function trylockCandidate() {
   exists(string name | name = result.getName() |
     name = "try_lock" or
-    name.matches("%mutex\\_trylock")
+    name.suffix(name.length() - 13) = "mutex_trylock"
   )
 }
 
@@ -107,7 +107,7 @@ private Function trylockCandidate() {
 private Function unlockCandidate() {
   exists(string name | name = result.getName() |
     name = "unlock" or
-    name.matches("%mutex\\_unlock")
+    name.suffix(name.length() - 12) = "mutex_unlock"
   )
 }
 

cpp/ql/src/semmle/code/cpp/controlflow/Dataflow.qll

@@ -13,7 +13,7 @@ import Dereferenced
  * predicates that implement this analysis.
  */
 abstract class DataflowAnnotation extends string {
-  DataflowAnnotation() { this = ["pointer-null", "pointer-valid"] }
+  DataflowAnnotation() { this = "pointer-null" or this = "pointer-valid" }
 
   /** Holds if this annotation is the default annotation. */
   abstract predicate isDefault();
@@ -98,7 +98,7 @@ abstract class DataflowAnnotation extends string {
  * respectively.
  */
 class NullnessAnnotation extends DataflowAnnotation {
-  NullnessAnnotation() { this = ["pointer-null", "pointer-valid"] }
+  NullnessAnnotation() { this = "pointer-null" or this = "pointer-valid" }
 
   override predicate isDefault() { this = "pointer-valid" }
 

cpp/ql/src/semmle/code/cpp/dataflow/internal/AddressFlow.qll

@@ -131,22 +131,7 @@ private predicate lvalueToUpdate(Expr lvalue, Expr outer, ControlFlowNode node)
     exists(Call call | node = call |
       outer = call.getQualifier().getFullyConverted() and
       outer.getUnspecifiedType() instanceof Class and
-      not (
-        call.getTarget().hasSpecifier("const") and
-        // Given the following program:
-        // ```
-        // struct C {
-        //   void* data_;
-        //   void* data() const { return data; }
-        // };
-        // C c;
-        // memcpy(c.data(), source, 16)
-        // ```
-        // the data pointed to by `c.data_` is potentially modified by the call to `memcpy` even though
-        // `C::data` has a const specifier. So we further place the restriction that the type returned
-        // by `call` should not be of the form `const T*` (for some deeply const type `T`).
-        call.getType().isDeeplyConstBelow()
-      )
+      not call.getTarget().hasSpecifier("const")
     )
     or
     assignmentTo(outer, node)
@@ -185,11 +170,7 @@ private predicate pointerToUpdate(Expr pointer, Expr outer, ControlFlowNode node
       or
       outer = call.getQualifier().getFullyConverted() and
       outer.getUnspecifiedType() instanceof PointerType and
-      not (
-        call.getTarget().hasSpecifier("const") and
-        // See the `lvalueToUpdate` case for an explanation of this conjunct.
-        call.getType().isDeeplyConstBelow()
-      )
+      not call.getTarget().hasSpecifier("const")
     )
     or
     exists(PointerFieldAccess fa |

cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImplCommon.qll

@@ -802,9 +802,14 @@ abstract class AccessPathFront extends TAccessPathFront {
 
   abstract boolean toBoolNonEmpty();
 
-  TypedContent getHead() { this = TFrontHead(result) }
+  predicate headUsesContent(TypedContent tc) { this = TFrontHead(tc) }
 
-  predicate isClearedAt(Node n) { clearsContent(n, getHead().getContent()) }
+  predicate isClearedAt(Node n) {
+    exists(TypedContent tc |
+      this.headUsesContent(tc) and
+      clearsContent(n, tc.getContent())
+    )
+  }
 }
 
 class AccessPathFrontNil extends AccessPathFront, TFrontNil {

cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowPrivate.qll

@@ -280,15 +280,6 @@ predicate isUnreachableInCall(Node n, DataFlowCall call) { none() } // stub impl
 
 int accessPathLimit() { result = 5 }
 
-/** The unit type. */
-private newtype TUnit = TMkUnit()
-
-/** The trivial type with a single element. */
-class Unit extends TUnit {
-  /** Gets a textual representation of this element. */
-  string toString() { result = "unit" }
-}
-
 /**
  * Holds if `n` does not require a `PostUpdateNode` as it either cannot be
  * modified or its modification cannot be observed, for example if it is a

cpp/ql/src/semmle/code/cpp/dataflow/internal/FlowVar.qll

@@ -620,8 +620,7 @@ module FlowVar_internal {
   private predicate largeVariable(Variable v, int liveBlocks, int defs) {
     liveBlocks = strictcount(SubBasicBlock sbb | variableLiveInSBB(sbb, v)) and
     defs = strictcount(SubBasicBlock sbb | exists(TBlockVar(sbb, v))) and
-    // Convert to float to avoid int overflow (32-bit two's complement)
-    liveBlocks.(float) * defs.(float) > 100000.0
+    liveBlocks * defs > 1000000
   }
 
   /**

cpp/ql/src/semmle/code/cpp/exprs/Expr.qll

@@ -847,7 +847,8 @@ class NewOrNewArrayExpr extends Expr, @any_new_expr {
    */
   Expr getPlacementPointer() {
     result =
-      this.getAllocatorCall()
+      this
+          .getAllocatorCall()
           .getArgument(this.getAllocator().(OperatorNewAllocationFunction).getPlacementArgument())
   }
 }

cpp/ql/src/semmle/code/cpp/headers/MultipleInclusion.qll

@@ -160,7 +160,8 @@ predicate ifndefDirective(PreprocessorDirective ppd, string macro) {
   ppd instanceof PreprocessorIf and
   exists(string head | head = ppd.getHead() |
     macro =
-      head.replaceAll("(", " ")
+      head
+          .replaceAll("(", " ")
           .replaceAll(")", "")
           .replaceAll("\t", " ")
           .regexpCapture("[ ]*![ ]*defined[ ]+([^ ]*)[ ]*", 1)

cpp/ql/src/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll

@@ -36,33 +36,43 @@ private predicate predictableInstruction(Instruction instr) {
  * library's `returnArgument` predicate.
  */
 predicate predictableOnlyFlow(string name) {
-  name =
-    [
-      "strcasestr", "strchnul", "strchr", "strchrnul", "strcmp", "strcspn", "strncmp", "strndup",
-      "strnlen", "strrchr", "strspn", "strstr", "strtod", "strtof", "strtol", "strtoll", "strtoq",
-      "strtoul"
-    ]
+  name = "strcasestr" or
+  name = "strchnul" or
+  name = "strchr" or
+  name = "strchrnul" or
+  name = "strcmp" or
+  name = "strcspn" or
+  name = "strncmp" or
+  name = "strndup" or
+  name = "strnlen" or
+  name = "strrchr" or
+  name = "strspn" or
+  name = "strstr" or
+  name = "strtod" or
+  name = "strtof" or
+  name = "strtol" or
+  name = "strtoll" or
+  name = "strtoq" or
+  name = "strtoul"
 }
 
 private DataFlow::Node getNodeForSource(Expr source) {
   isUserInput(source, _) and
-  result = getNodeForExpr(source)
-}
-
-private DataFlow::Node getNodeForExpr(Expr node) {
-  result = DataFlow::exprNode(node)
-  or
-  // Some of the sources in `isUserInput` are intended to match the value of
-  // an expression, while others (those modeled below) are intended to match
-  // the taint that propagates out of an argument, like the `char *` argument
-  // to `gets`. It's impossible here to tell which is which, but the "access
-  // to argv" source is definitely not intended to match an output argument,
-  // and it causes false positives if we let it.
-  //
-  // This case goes together with the similar (but not identical) rule in
-  // `nodeIsBarrierIn`.
-  result = DataFlow::definitionByReferenceNodeFromArgument(node) and
-  not argv(node.(VariableAccess).getTarget())
+  (
+    result = DataFlow::exprNode(source)
+    or
+    // Some of the sources in `isUserInput` are intended to match the value of
+    // an expression, while others (those modeled below) are intended to match
+    // the taint that propagates out of an argument, like the `char *` argument
+    // to `gets`. It's impossible here to tell which is which, but the "access
+    // to argv" source is definitely not intended to match an output argument,
+    // and it causes false positives if we let it.
+    //
+    // This case goes together with the similar (but not identical) rule in
+    // `nodeIsBarrierIn`.
+    result = DataFlow::definitionByReferenceNodeFromArgument(source) and
+    not argv(source.(VariableAccess).getTarget())
+  )
 }
 
 private class DefaultTaintTrackingCfg extends DataFlow::Configuration {
@@ -206,27 +216,16 @@ private predicate nodeIsBarrierIn(DataFlow::Node node) {
 
 cached
 private predicate commonTaintStep(DataFlow::Node fromNode, DataFlow::Node toNode) {
+  instructionToInstructionTaintStep(fromNode.asInstruction(), toNode.asInstruction())
+  or
   operandToInstructionTaintStep(fromNode.asOperand(), toNode.asInstruction())
   or
-  instructionToOperandTaintStep(fromNode.asInstruction(), toNode.asOperand())
+  operandToOperandTaintStep(fromNode.asOperand(), toNode.asOperand())
 }
 
-private predicate instructionToOperandTaintStep(Instruction fromInstr, Operand toOperand) {
-  // Propagate flow from the definition of an operand to the operand, even when the overlap is inexact.
-  // We only do this in certain cases:
-  // 1. The instruction's result must not be conflated, and
-  // 2. The instruction's result type is one the types where we expect element-to-object flow. Currently
-  // this is array types and union types. This matches the other two cases of element-to-object flow in
-  // `DefaultTaintTracking`.
-  toOperand.getAnyDef() = fromInstr and
-  not fromInstr.isResultConflated() and
-  (
-    fromInstr.getResultType() instanceof ArrayType or
-    fromInstr.getResultType() instanceof Union
-  )
-  or
+private predicate operandToOperandTaintStep(Operand fromOperand, Operand toOperand) {
   exists(ReadSideEffectInstruction readInstr |
-    fromInstr = readInstr.getArgumentDef() and
+    fromOperand = readInstr.getArgumentOperand() and
     toOperand = readInstr.getSideEffectOperand()
   )
 }
@@ -269,18 +268,18 @@ private predicate operandToInstructionTaintStep(Operand fromOperand, Instruction
         outInstr.getPrimaryInstruction() = call
       )
     )
-  or
+}
+
+private predicate instructionToInstructionTaintStep(Instruction i1, Instruction i2) {
   // Flow through pointer dereference
-  toInstr.(LoadInstruction).getSourceAddressOperand() = fromOperand
+  i2.(LoadInstruction).getSourceAddress() = i1
   or
   // Flow through partial reads of arrays and unions
-  toInstr.(LoadInstruction).getSourceValueOperand() = fromOperand and
-  exists(Instruction fromInstr | fromInstr = fromOperand.getAnyDef() |
-    not fromInstr.isResultConflated() and
-    (
-      fromInstr.getResultType() instanceof ArrayType or
-      fromInstr.getResultType() instanceof Union
-    )
+  i2.(LoadInstruction).getSourceValueOperand().getAnyDef() = i1 and
+  not i1.isResultConflated() and
+  (
+    i1.getResultType() instanceof ArrayType or
+    i1.getResultType() instanceof Union
   )
   or
   // Unary instructions tend to preserve enough information in practice that we
@@ -290,54 +289,63 @@ private predicate operandToInstructionTaintStep(Operand fromOperand, Instruction
   // `FieldAddressInstruction` could cause flow into one field to come out an
   // unrelated field. This would happen across function boundaries, where the IR
   // would not be able to match loads to stores.
-  toInstr.(UnaryInstruction).getUnaryOperand() = fromOperand and
+  i2.(UnaryInstruction).getUnary() = i1 and
   (
-    not toInstr instanceof FieldAddressInstruction
+    not i2 instanceof FieldAddressInstruction
     or
-    toInstr.(FieldAddressInstruction).getField().getDeclaringType() instanceof Union
+    i2.(FieldAddressInstruction).getField().getDeclaringType() instanceof Union
   )
   or
+  // Flow out of definition-by-reference
+  i2.(ChiInstruction).getPartial() = i1.(WriteSideEffectInstruction) and
+  not i2.isResultConflated()
+  or
   // Flow from an element to an array or union that contains it.
-  toInstr.(ChiInstruction).getPartialOperand() = fromOperand and
-  not toInstr.isResultConflated() and
-  exists(Type t | toInstr.getResultLanguageType().hasType(t, false) |
+  i2.(ChiInstruction).getPartial() = i1 and
+  not i2.isResultConflated() and
+  exists(Type t | i2.getResultLanguageType().hasType(t, false) |
     t instanceof Union
     or
     t instanceof ArrayType
   )
   or
   exists(BinaryInstruction bin |
-    bin = toInstr and
-    predictableInstruction(toInstr.getAnOperand().getDef()) and
-    fromOperand = toInstr.getAnOperand()
+    bin = i2 and
+    predictableInstruction(i2.getAnOperand().getDef()) and
+    i1 = i2.getAnOperand().getDef()
   )
   or
   // This is part of the translation of `a[i]`, where we want taint to flow
   // from `a`.
-  toInstr.(PointerAddInstruction).getLeftOperand() = fromOperand
+  i2.(PointerAddInstruction).getLeft() = i1
+  or
+  // Until we have from through indirections across calls, we'll take flow out
+  // of the parameter and into its indirection.
+  exists(IRFunction f, Parameter parameter |
+    i1 = getInitializeParameter(f, parameter) and
+    i2 = getInitializeIndirection(f, parameter)
+  )
   or
   // Until we have flow through indirections across calls, we'll take flow out
   // of the indirection and into the argument.
   // When we get proper flow through indirections across calls, this code can be
   // moved to `adjusedSink` or possibly into the `DataFlow::ExprNode` class.
   exists(ReadSideEffectInstruction read |
-    read.getSideEffectOperand() = fromOperand and
-    read.getArgumentDef() = toInstr
+    read.getAnOperand().(SideEffectOperand).getAnyDef() = i1 and
+    read.getArgumentDef() = i2
   )
-  or
-  // Until we have from through indirections across calls, we'll take flow out
-  // of the parameter and into its indirection.
-  // `InitializeIndirectionInstruction` only has a single operand: the address of the
-  // value whose indirection we are initializing. When initializing an indirection of a parameter `p`,
-  // the IR looks like this:
-  // ```
-  // m1 = InitializeParameter[p] : &r1
-  // r2 = Load[p] : r2, m1
-  // m3 = InitializeIndirection[p] : &r2
-  // ```
-  // So by having flow from `r2` to `m3` we're enabling flow from `m1` to `m3`. This relies on the
-  // `LoadOperand`'s overlap being exact.
-  toInstr.(InitializeIndirectionInstruction).getAnOperand() = fromOperand
+}
+
+pragma[noinline]
+private InitializeIndirectionInstruction getInitializeIndirection(IRFunction f, Parameter p) {
+  result.getParameter() = p and
+  result.getEnclosingIRFunction() = f
+}
+
+pragma[noinline]
+private InitializeParameterInstruction getInitializeParameter(IRFunction f, Parameter p) {
+  result.getParameter() = p and
+  result.getEnclosingIRFunction() = f
 }
 
 /**
@@ -539,15 +547,9 @@ module TaintedWithPath {
    * a characteristic predicate.
    */
   class TaintTrackingConfiguration extends TSingleton {
-    /** Override this to specify which elements are sources in this configuration. */
-    predicate isSource(Expr source) { exists(getNodeForSource(source)) }
-
     /** Override this to specify which elements are sinks in this configuration. */
     abstract predicate isSink(Element e);
 
-    /** Override this to specify which expressions are barriers in this configuration. */
-    predicate isBarrier(Expr e) { nodeIsBarrier(getNodeForExpr(e)) }
-
     /**
      * Override this predicate to `any()` to allow taint to flow through global
      * variables.
@@ -561,11 +563,7 @@ module TaintedWithPath {
   private class AdjustedConfiguration extends DataFlow3::Configuration {
     AdjustedConfiguration() { this = "AdjustedConfiguration" }
 
-    override predicate isSource(DataFlow::Node source) {
-      exists(TaintTrackingConfiguration cfg, Expr e |
-        cfg.isSource(e) and source = getNodeForExpr(e)
-      )
-    }
+    override predicate isSource(DataFlow::Node source) { source = getNodeForSource(_) }
 
     override predicate isSink(DataFlow::Node sink) {
       exists(TaintTrackingConfiguration cfg | cfg.isSink(adjustedSink(sink)))
@@ -581,9 +579,7 @@ module TaintedWithPath {
       )
     }
 
-    override predicate isBarrier(DataFlow::Node node) {
-      exists(TaintTrackingConfiguration cfg, Expr e | cfg.isBarrier(e) and node = getNodeForExpr(e))
-    }
+    override predicate isBarrier(DataFlow::Node node) { nodeIsBarrier(node) }
 
     override predicate isBarrierIn(DataFlow::Node node) { nodeIsBarrierIn(node) }
   }
@@ -610,8 +606,7 @@ module TaintedWithPath {
       exists(AdjustedConfiguration cfg, DataFlow3::Node sourceNode, DataFlow3::Node sinkNode |
         cfg.hasFlow(sourceNode, sinkNode)
       |
-        sourceNode = getNodeForExpr(e) and
-        exists(TaintTrackingConfiguration ttCfg | ttCfg.isSource(e))
+        sourceNode = getNodeForSource(e)
         or
         e = adjustedSink(sinkNode) and
         exists(TaintTrackingConfiguration ttCfg | ttCfg.isSink(e))
@@ -657,7 +652,8 @@ module TaintedWithPath {
     override predicate hasLocationInfo(
       string filepath, int startline, int startcolumn, int endline, int endcolumn
     ) {
-      this.inner()
+      this
+          .inner()
           .getLocation()
           .hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
     }
@@ -665,7 +661,7 @@ module TaintedWithPath {
 
   /** A PathNode whose `Element` is a source. It may also be a sink. */
   private class InitialPathNode extends EndpointPathNode {
-    InitialPathNode() { exists(TaintTrackingConfiguration cfg | cfg.isSource(this.inner())) }
+    InitialPathNode() { exists(getNodeForSource(this.inner())) }
   }
 
   /** A PathNode whose `Element` is a sink. It may also be a source. */
@@ -687,14 +683,14 @@ module TaintedWithPath {
     // Same for the first node
     exists(WrapPathNode sourceNode |
       DataFlow3::PathGraph::edges(sourceNode.inner(), b.(WrapPathNode).inner()) and
-      sourceNode.inner().getNode() = getNodeForExpr(a.(InitialPathNode).inner())
+      sourceNode.inner().getNode() = getNodeForSource(a.(InitialPathNode).inner())
     )
     or
     // Finally, handle the case where the path goes directly from a source to a
     // sink, meaning that they both need to be translated.
     exists(WrapPathNode sinkNode, WrapPathNode sourceNode |
       DataFlow3::PathGraph::edges(sourceNode.inner(), sinkNode.inner()) and
-      sourceNode.inner().getNode() = getNodeForExpr(a.(InitialPathNode).inner()) and
+      sourceNode.inner().getNode() = getNodeForSource(a.(InitialPathNode).inner()) and
       b.(FinalPathNode).inner() = adjustedSink(sinkNode.inner().getNode())
     )
   }
@@ -717,7 +713,7 @@ module TaintedWithPath {
   predicate taintedWithPath(Expr source, Element tainted, PathNode sourceNode, PathNode sinkNode) {
     exists(AdjustedConfiguration cfg, DataFlow3::Node flowSource, DataFlow3::Node flowSink |
       source = sourceNode.(InitialPathNode).inner() and
-      flowSource = getNodeForExpr(source) and
+      flowSource = getNodeForSource(source) and
       cfg.hasFlow(flowSource, flowSink) and
       tainted = adjustedSink(flowSink) and
       tainted = sinkNode.(FinalPathNode).inner()
@@ -739,8 +735,8 @@ module TaintedWithPath {
    * through a global variable.
    */
   predicate taintedWithoutGlobals(Element tainted) {
-    exists(AdjustedConfiguration cfg, PathNode sourceNode, FinalPathNode sinkNode |
-      cfg.isSource(sourceNode.(WrapPathNode).inner().getNode()) and
+    exists(PathNode sourceNode, FinalPathNode sinkNode |
+      sourceNode.(WrapPathNode).inner().getNode() = getNodeForSource(_) and
       edgesWithoutGlobals+(sourceNode, sinkNode) and
       tainted = sinkNode.inner()
     )

cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImplCommon.qll

@@ -802,9 +802,14 @@ abstract class AccessPathFront extends TAccessPathFront {
 
   abstract boolean toBoolNonEmpty();
 
-  TypedContent getHead() { this = TFrontHead(result) }
+  predicate headUsesContent(TypedContent tc) { this = TFrontHead(tc) }
 
-  predicate isClearedAt(Node n) { clearsContent(n, getHead().getContent()) }
+  predicate isClearedAt(Node n) {
+    exists(TypedContent tc |
+      this.headUsesContent(tc) and
+      clearsContent(n, tc.getContent())
+    )
+  }
 }
 
 class AccessPathFrontNil extends AccessPathFront, TFrontNil {

cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll

@@ -503,15 +503,6 @@ predicate isUnreachableInCall(Node n, DataFlowCall call) { none() } // stub impl
 
 int accessPathLimit() { result = 5 }
 
-/** The unit type. */
-private newtype TUnit = TMkUnit()
-
-/** The trivial type with a single element. */
-class Unit extends TUnit {
-  /** Gets a textual representation of this element. */
-  string toString() { result = "unit" }
-}
-
 /**
  * Holds if `n` does not require a `PostUpdateNode` as it either cannot be
  * modified or its modification cannot be observed, for example if it is a

cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll

@@ -95,7 +95,7 @@ class Node extends TIRDataFlowNode {
    * Gets the uninitialized local variable corresponding to this node, if
    * any.
    */
-  deprecated LocalVariable asUninitialized() { none() }
+  LocalVariable asUninitialized() { none() }
 
   /**
    * Gets an upper bound on the type of this node.
@@ -716,15 +716,21 @@ private predicate modelFlow(Operand opFrom, Instruction iTo) {
       iTo = call
       or
       exists(int index, WriteSideEffectInstruction outNode |
-        modelOut.isParameterDerefOrQualifierObject(index) and
+        modelOut.isParameterDeref(index) and
         iTo = outNode and
         outNode = getSideEffectFor(call, index)
       )
+      or
+      exists(WriteSideEffectInstruction outNode |
+        modelOut.isQualifierObject() and
+        iTo = outNode and
+        outNode = getSideEffectFor(call, -1)
+      )
     ) and
     (
       exists(int index |
-        modelIn.isParameterOrQualifierAddress(index) and
-        opFrom = call.getArgumentOperand(index)
+        modelIn.isParameter(index) and
+        opFrom = call.getPositionalArgumentOperand(index)
       )
       or
       exists(int index, ReadSideEffectInstruction read |
@@ -733,6 +739,9 @@ private predicate modelFlow(Operand opFrom, Instruction iTo) {
         opFrom = read.getSideEffectOperand()
       )
       or
+      modelIn.isQualifierAddress() and
+      opFrom = call.getThisArgumentOperand()
+      or
       exists(ReadSideEffectInstruction read |
         modelIn.isQualifierObject() and
         read = getSideEffectFor(call, -1) and

cpp/ql/src/semmle/code/cpp/ir/implementation/IRType.qll

@@ -341,7 +341,7 @@ module IRTypeConsistency {
   query predicate multipleIRTypes(Language::LanguageType type, string message) {
     strictcount(type.getIRType()) > 1 and
     message =
-      "`LanguageType` " + type + " has multiple `IRType`s: " +
+      "`LanguageType` " + type.getAQlClass() + " has multiple `IRType`s: " +
         concat(type.getIRType().toString(), ", ")
   }
 

cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll

@@ -528,9 +528,9 @@ class TranslatedSideEffect extends TranslatedElement, TTranslatedArgumentSideEff
     tag instanceof OnlyInstructionTag and
     operandTag instanceof BufferSizeOperandTag and
     result =
-      getTranslatedExpr(call.getArgument(call.getTarget()
-              .(SideEffectFunction)
-              .getParameterSizeIndex(index)).getFullyConverted()).getResult()
+      getTranslatedExpr(call
+            .getArgument(call.getTarget().(SideEffectFunction).getParameterSizeIndex(index))
+            .getFullyConverted()).getResult()
   }
 
   override CppType getInstructionMemoryOperandType(InstructionTag tag, TypedOperandTag operandTag) {

cpp/ql/src/semmle/code/cpp/models/Models.qll

@@ -15,10 +15,6 @@ private import implementations.Strcat
 private import implementations.Strcpy
 private import implementations.Strdup
 private import implementations.Strftime
-private import implementations.Strtok
-private import implementations.Strset
-private import implementations.Strcrement
-private import implementations.Strnextc
 private import implementations.StdContainer
 private import implementations.StdPair
 private import implementations.StdMap
@@ -27,9 +23,3 @@ private import implementations.StdString
 private import implementations.Swap
 private import implementations.GetDelim
 private import implementations.SmartPointer
-private import implementations.Sscanf
-private import implementations.Send
-private import implementations.Recv
-private import implementations.Accept
-private import implementations.Poll
-private import implementations.Select

cpp/ql/src/semmle/code/cpp/models/implementations/Accept.qll

@@ -1,56 +0,0 @@
-/**
- * Provides implementation classes modeling `accept` and various similar
- * functions. See `semmle.code.cpp.models.Models` for usage information.
- */
-
-import semmle.code.cpp.Function
-import semmle.code.cpp.models.interfaces.ArrayFunction
-import semmle.code.cpp.models.interfaces.Taint
-import semmle.code.cpp.models.interfaces.Alias
-import semmle.code.cpp.models.interfaces.SideEffect
-
-/**
- * The function `accept` and its assorted variants
- */
-private class Accept extends ArrayFunction, AliasFunction, TaintFunction, SideEffectFunction {
-  Accept() { this.hasGlobalName(["accept", "accept4", "WSAAccept"]) }
-
-  override predicate hasArrayWithVariableSize(int bufParam, int countParam) {
-    bufParam = 1 and countParam = 2
-  }
-
-  override predicate hasArrayInput(int bufParam) { bufParam = 1 }
-
-  override predicate hasArrayOutput(int bufParam) { bufParam = 1 }
-
-  override predicate parameterNeverEscapes(int index) { exists(this.getParameter(index)) }
-
-  override predicate parameterEscapesOnlyViaReturn(int index) { none() }
-
-  override predicate parameterIsAlwaysReturned(int index) { none() }
-
-  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
-    (input.isParameter(0) or input.isParameterDeref(1)) and
-    (output.isReturnValue() or output.isParameterDeref(1))
-  }
-
-  override predicate hasSpecificWriteSideEffect(ParameterIndex i, boolean buffer, boolean mustWrite) {
-    i = 1 and buffer = true and mustWrite = false
-    or
-    i = 2 and buffer = false and mustWrite = false
-  }
-
-  override predicate hasSpecificReadSideEffect(ParameterIndex i, boolean buffer) {
-    i = 0 and buffer = true
-    or
-    i = 1 and buffer = false
-  }
-
-  override ParameterIndex getParameterSizeIndex(ParameterIndex i) { i = 1 and result = 2 }
-
-  // NOTE: We implement thse two predicates as none because we can't model the low-level changes made to
-  // the structure pointed to by the file-descriptor argument.
-  override predicate hasOnlySpecificReadSideEffects() { none() }
-
-  override predicate hasOnlySpecificWriteSideEffects() { none() }
-}

cpp/ql/src/semmle/code/cpp/models/implementations/Allocation.qll

@@ -14,58 +14,95 @@ private class MallocAllocationFunction extends AllocationFunction {
   int sizeArg;
 
   MallocAllocationFunction() {
-    // --- C library allocation
-    hasGlobalOrStdOrBslName("malloc") and // malloc(size)
-    sizeArg = 0
-    or
-    hasGlobalName([
-        // --- Windows Memory Management for Windows Drivers
-        "MmAllocateContiguousMemory", // MmAllocateContiguousMemory(size, maxaddress)
-        "MmAllocateContiguousNodeMemory", // MmAllocateContiguousNodeMemory(size, minaddress, maxaddress, bound, flag, prefer)
-        "MmAllocateContiguousMemorySpecifyCache", // MmAllocateContiguousMemorySpecifyCache(size, minaddress, maxaddress, bound, type)
-        "MmAllocateContiguousMemorySpecifyCacheNode", // MmAllocateContiguousMemorySpecifyCacheNode(size, minaddress, maxaddress, bound, type, prefer)
-        "MmAllocateNonCachedMemory", // MmAllocateNonCachedMemory(size)
-        "MmAllocateMappingAddress", // MmAllocateMappingAddress(size, tag)
-        // --- Windows COM allocation
-        "CoTaskMemAlloc", // CoTaskMemAlloc(size)
-        // --- Solaris/BSD kernel memory allocator
-        "kmem_alloc", // kmem_alloc(size, flags)
-        "kmem_zalloc", // kmem_zalloc(size, flags)
-        // --- OpenSSL memory allocation
-        "CRYPTO_malloc", // CRYPTO_malloc(size_t num, const char *file, int line)
-        "CRYPTO_zalloc", // CRYPTO_zalloc(size_t num, const char *file, int line)
-        "CRYPTO_secure_malloc", // CRYPTO_secure_malloc(size_t num, const char *file, int line)
-        "CRYPTO_secure_zalloc" // CRYPTO_secure_zalloc(size_t num, const char *file, int line)
-      ]) and
-    sizeArg = 0
-    or
-    hasGlobalName([
-        // --- Windows Memory Management for Windows Drivers
-        "ExAllocatePool", // ExAllocatePool(type, size)
-        "ExAllocatePoolWithTag", // ExAllocatePool(type, size, tag)
-        "ExAllocatePoolWithTagPriority", // ExAllocatePoolWithTagPriority(type, size, tag, priority)
-        "ExAllocatePoolWithQuota", // ExAllocatePoolWithQuota(type, size)
-        "ExAllocatePoolWithQuotaTag", // ExAllocatePoolWithQuotaTag(type, size, tag)
-        "IoAllocateMdl", // IoAllocateMdl(address, size, flag, flag, irp)
-        "IoAllocateErrorLogEntry", // IoAllocateErrorLogEntry(object, size)
-        // --- Windows Global / Local legacy allocation
-        "LocalAlloc", // LocalAlloc(flags, size)
-        "GlobalAlloc", // GlobalAlloc(flags, size)
-        // --- Windows System Services allocation
-        "VirtualAlloc" // VirtualAlloc(address, size, type, flag)
-      ]) and
-    sizeArg = 1
-    or
-    hasGlobalName(["HeapAlloc"]) and // HeapAlloc(heap, flags, size)
-    sizeArg = 2
-    or
-    hasGlobalName([
-        // --- Windows Memory Management for Windows Drivers
-        "MmAllocatePagesForMdl", // MmAllocatePagesForMdl(minaddress, maxaddress, skip, size)
-        "MmAllocatePagesForMdlEx", // MmAllocatePagesForMdlEx(minaddress, maxaddress, skip, size, type, flags)
-        "MmAllocateNodePagesForMdlEx" // MmAllocateNodePagesForMdlEx(minaddress, maxaddress, skip, size, type, prefer, flags)
-      ]) and
-    sizeArg = 3
+    exists(string name |
+      hasGlobalOrStdName(name) and
+      // malloc(size)
+      (name = "malloc" and sizeArg = 0)
+      or
+      hasGlobalName(name) and
+      (
+        // ExAllocatePool(type, size)
+        name = "ExAllocatePool" and sizeArg = 1
+        or
+        // ExAllocatePool(type, size, tag)
+        name = "ExAllocatePoolWithTag" and sizeArg = 1
+        or
+        // ExAllocatePoolWithTagPriority(type, size, tag, priority)
+        name = "ExAllocatePoolWithTagPriority" and sizeArg = 1
+        or
+        // ExAllocatePoolWithQuota(type, size)
+        name = "ExAllocatePoolWithQuota" and sizeArg = 1
+        or
+        // ExAllocatePoolWithQuotaTag(type, size, tag)
+        name = "ExAllocatePoolWithQuotaTag" and sizeArg = 1
+        or
+        // IoAllocateMdl(address, size, flag, flag, irp)
+        name = "IoAllocateMdl" and sizeArg = 1
+        or
+        // IoAllocateErrorLogEntry(object, size)
+        name = "IoAllocateErrorLogEntry" and sizeArg = 1
+        or
+        // MmAllocateContiguousMemory(size, maxaddress)
+        name = "MmAllocateContiguousMemory" and sizeArg = 0
+        or
+        // MmAllocateContiguousNodeMemory(size, minaddress, maxaddress, bound, flag, prefer)
+        name = "MmAllocateContiguousNodeMemory" and sizeArg = 0
+        or
+        // MmAllocateContiguousMemorySpecifyCache(size, minaddress, maxaddress, bound, type)
+        name = "MmAllocateContiguousMemorySpecifyCache" and sizeArg = 0
+        or
+        // MmAllocateContiguousMemorySpecifyCacheNode(size, minaddress, maxaddress, bound, type, prefer)
+        name = "MmAllocateContiguousMemorySpecifyCacheNode" and sizeArg = 0
+        or
+        // MmAllocateNonCachedMemory(size)
+        name = "MmAllocateNonCachedMemory" and sizeArg = 0
+        or
+        // MmAllocateMappingAddress(size, tag)
+        name = "MmAllocateMappingAddress" and sizeArg = 0
+        or
+        // MmAllocatePagesForMdl(minaddress, maxaddress, skip, size)
+        name = "MmAllocatePagesForMdl" and sizeArg = 3
+        or
+        // MmAllocatePagesForMdlEx(minaddress, maxaddress, skip, size, type, flags)
+        name = "MmAllocatePagesForMdlEx" and sizeArg = 3
+        or
+        // MmAllocateNodePagesForMdlEx(minaddress, maxaddress, skip, size, type, prefer, flags)
+        name = "MmAllocateNodePagesForMdlEx" and sizeArg = 3
+        or
+        // LocalAlloc(flags, size)
+        name = "LocalAlloc" and sizeArg = 1
+        or
+        // GlobalAlloc(flags, size)
+        name = "GlobalAlloc" and sizeArg = 1
+        or
+        // HeapAlloc(heap, flags, size)
+        name = "HeapAlloc" and sizeArg = 2
+        or
+        // VirtualAlloc(address, size, type, flag)
+        name = "VirtualAlloc" and sizeArg = 1
+        or
+        // CoTaskMemAlloc(size)
+        name = "CoTaskMemAlloc" and sizeArg = 0
+        or
+        // kmem_alloc(size, flags)
+        name = "kmem_alloc" and sizeArg = 0
+        or
+        // kmem_zalloc(size, flags)
+        name = "kmem_zalloc" and sizeArg = 0
+        or
+        // CRYPTO_malloc(size_t num, const char *file, int line)
+        name = "CRYPTO_malloc" and sizeArg = 0
+        or
+        // CRYPTO_zalloc(size_t num, const char *file, int line)
+        name = "CRYPTO_zalloc" and sizeArg = 0
+        or
+        // CRYPTO_secure_malloc(size_t num, const char *file, int line)
+        name = "CRYPTO_secure_malloc" and sizeArg = 0
+        or
+        // CRYPTO_secure_zalloc(size_t num, const char *file, int line)
+        name = "CRYPTO_secure_zalloc" and sizeArg = 0
+      )
+    )
   }
 
   override int getSizeArg() { result = sizeArg }
@@ -79,14 +116,16 @@ private class AllocaAllocationFunction extends AllocationFunction {
   int sizeArg;
 
   AllocaAllocationFunction() {
-    hasGlobalName([
-        // --- stack allocation
-        "alloca", // // alloca(size)
-        "__builtin_alloca", // __builtin_alloca(size)
-        "_alloca", // _alloca(size)
-        "_malloca" // _malloca(size)
-      ]) and
-    sizeArg = 0
+    exists(string name |
+      hasGlobalName(name) and
+      (
+        // alloca(size)
+        name = "alloca" and sizeArg = 0
+        or
+        // __builtin_alloca(size)
+        name = "__builtin_alloca" and sizeArg = 0
+      )
+    )
   }
 
   override int getSizeArg() { result = sizeArg }
@@ -103,10 +142,11 @@ private class CallocAllocationFunction extends AllocationFunction {
   int multArg;
 
   CallocAllocationFunction() {
-    // --- C library allocation
-    hasGlobalOrStdOrBslName("calloc") and // calloc(num, size)
-    sizeArg = 1 and
-    multArg = 0
+    exists(string name |
+      hasGlobalOrStdName(name) and
+      // calloc(num, size)
+      (name = "calloc" and sizeArg = 1 and multArg = 0)
+    )
   }
 
   override int getSizeArg() { result = sizeArg }
@@ -123,26 +163,29 @@ private class ReallocAllocationFunction extends AllocationFunction {
   int reallocArg;
 
   ReallocAllocationFunction() {
-    // --- C library allocation
-    hasGlobalOrStdOrBslName("realloc") and // realloc(ptr, size)
-    sizeArg = 1 and
-    reallocArg = 0
-    or
-    hasGlobalName([
-        // --- Windows Global / Local legacy allocation
-        "LocalReAlloc", // LocalReAlloc(ptr, size, flags)
-        "GlobalReAlloc", // GlobalReAlloc(ptr, size, flags)
-        // --- Windows COM allocation
-        "CoTaskMemRealloc", // CoTaskMemRealloc(ptr, size)
-        // --- OpenSSL memory allocation
-        "CRYPTO_realloc" // CRYPTO_realloc(void *addr, size_t num, const char *file, int line)
-      ]) and
-    sizeArg = 1 and
-    reallocArg = 0
-    or
-    hasGlobalName("HeapReAlloc") and // HeapReAlloc(heap, flags, ptr, size)
-    sizeArg = 3 and
-    reallocArg = 2
+    exists(string name |
+      hasGlobalOrStdName(name) and
+      // realloc(ptr, size)
+      (name = "realloc" and sizeArg = 1 and reallocArg = 0)
+      or
+      hasGlobalName(name) and
+      (
+        // LocalReAlloc(ptr, size, flags)
+        name = "LocalReAlloc" and sizeArg = 1 and reallocArg = 0
+        or
+        // GlobalReAlloc(ptr, size, flags)
+        name = "GlobalReAlloc" and sizeArg = 1 and reallocArg = 0
+        or
+        // HeapReAlloc(heap, flags, ptr, size)
+        name = "HeapReAlloc" and sizeArg = 3 and reallocArg = 2
+        or
+        // CoTaskMemRealloc(ptr, size)
+        name = "CoTaskMemRealloc" and sizeArg = 1 and reallocArg = 0
+        or
+        // CRYPTO_realloc(void *addr, size_t num, const char *file, int line);
+        name = "CRYPTO_realloc" and sizeArg = 1 and reallocArg = 0
+      )
+    )
   }
 
   override int getSizeArg() { result = sizeArg }
@@ -156,20 +199,40 @@ private class ReallocAllocationFunction extends AllocationFunction {
  */
 private class SizelessAllocationFunction extends AllocationFunction {
   SizelessAllocationFunction() {
-    hasGlobalName([
-        // --- Windows Memory Management for Windows Drivers
-        "ExAllocateFromLookasideListEx", // ExAllocateFromLookasideListEx(list)
-        "ExAllocateFromPagedLookasideList", // ExAllocateFromPagedLookasideList(list)
-        "ExAllocateFromNPagedLookasideList", // ExAllocateFromNPagedLookasideList(list)
-        "ExAllocateTimer", // ExAllocateTimer(callback, context, attributes)
-        "IoAllocateWorkItem", // IoAllocateWorkItem(object)
-        "MmMapLockedPagesWithReservedMapping", // MmMapLockedPagesWithReservedMapping(address, tag, list, type)
-        "MmMapLockedPages", // MmMapLockedPages(list, mode)
-        "MmMapLockedPagesSpecifyCache", // MmMapLockedPagesSpecifyCache(list, mode, type, address, flag, flag)
-        // --- NetBSD pool manager
-        "pool_get", // pool_get(pool, flags)
-        "pool_cache_get" // pool_cache_get(pool, flags)
-      ])
+    exists(string name |
+      hasGlobalName(name) and
+      (
+        // ExAllocateFromLookasideListEx(list)
+        name = "ExAllocateFromLookasideListEx"
+        or
+        // ExAllocateFromPagedLookasideList(list)
+        name = "ExAllocateFromPagedLookasideList"
+        or
+        // ExAllocateFromNPagedLookasideList(list)
+        name = "ExAllocateFromNPagedLookasideList"
+        or
+        // ExAllocateTimer(callback, context, attributes)
+        name = "ExAllocateTimer"
+        or
+        // IoAllocateWorkItem(object)
+        name = "IoAllocateWorkItem"
+        or
+        // MmMapLockedPagesWithReservedMapping(address, tag, list, type)
+        name = "MmMapLockedPagesWithReservedMapping"
+        or
+        // MmMapLockedPages(list, mode)
+        name = "MmMapLockedPages"
+        or
+        // MmMapLockedPagesSpecifyCache(list, mode, type, address, flag, flag)
+        name = "MmMapLockedPagesSpecifyCache"
+        or
+        // pool_get(pool, flags)
+        name = "pool_get"
+        or
+        // pool_cache_get(pool, flags)
+        name = "pool_cache_get"
+      )
+    )
   }
 }
 

cpp/ql/src/semmle/code/cpp/models/implementations/Deallocation.qll

@@ -13,47 +13,77 @@ private class StandardDeallocationFunction extends DeallocationFunction {
   int freedArg;
 
   StandardDeallocationFunction() {
-    hasGlobalOrStdOrBslName([
-        // --- C library allocation
-        "free", "realloc"
-      ]) and
-    freedArg = 0
-    or
-    hasGlobalName([
-        // --- OpenSSL memory allocation
-        "CRYPTO_free", "CRYPTO_secure_free"
-      ]) and
-    freedArg = 0
-    or
-    hasGlobalOrStdName([
-        // --- Windows Memory Management for Windows Drivers
-        "ExFreePoolWithTag", "ExDeleteTimer", "IoFreeMdl", "IoFreeWorkItem", "IoFreeErrorLogEntry",
-        "MmFreeContiguousMemory", "MmFreeContiguousMemorySpecifyCache", "MmFreeNonCachedMemory",
-        "MmFreeMappingAddress", "MmFreePagesFromMdl", "MmUnmapReservedMapping",
-        "MmUnmapLockedPages",
-        // --- Windows Global / Local legacy allocation
-        "LocalFree", "GlobalFree", "LocalReAlloc", "GlobalReAlloc",
-        // --- Windows System Services allocation
-        "VirtualFree",
-        // --- Windows COM allocation
-        "CoTaskMemFree", "CoTaskMemRealloc",
-        // --- Windows Automation
-        "SysFreeString",
-        // --- Solaris/BSD kernel memory allocator
-        "kmem_free"
-      ]) and
-    freedArg = 0
-    or
-    hasGlobalOrStdName([
-        // --- Windows Memory Management for Windows Drivers
-        "ExFreeToLookasideListEx", "ExFreeToPagedLookasideList", "ExFreeToNPagedLookasideList",
-        // --- NetBSD pool manager
-        "pool_put", "pool_cache_put"
-      ]) and
-    freedArg = 1
-    or
-    hasGlobalOrStdName(["HeapFree", "HeapReAlloc"]) and
-    freedArg = 2
+    exists(string name |
+      hasGlobalName(name) and
+      (
+        name = "free" and freedArg = 0
+        or
+        name = "realloc" and freedArg = 0
+        or
+        name = "CRYPTO_free" and freedArg = 0
+        or
+        name = "CRYPTO_secure_free" and freedArg = 0
+      )
+      or
+      hasGlobalOrStdName(name) and
+      (
+        name = "ExFreePoolWithTag" and freedArg = 0
+        or
+        name = "ExFreeToLookasideListEx" and freedArg = 1
+        or
+        name = "ExFreeToPagedLookasideList" and freedArg = 1
+        or
+        name = "ExFreeToNPagedLookasideList" and freedArg = 1
+        or
+        name = "ExDeleteTimer" and freedArg = 0
+        or
+        name = "IoFreeMdl" and freedArg = 0
+        or
+        name = "IoFreeWorkItem" and freedArg = 0
+        or
+        name = "IoFreeErrorLogEntry" and freedArg = 0
+        or
+        name = "MmFreeContiguousMemory" and freedArg = 0
+        or
+        name = "MmFreeContiguousMemorySpecifyCache" and freedArg = 0
+        or
+        name = "MmFreeNonCachedMemory" and freedArg = 0
+        or
+        name = "MmFreeMappingAddress" and freedArg = 0
+        or
+        name = "MmFreePagesFromMdl" and freedArg = 0
+        or
+        name = "MmUnmapReservedMapping" and freedArg = 0
+        or
+        name = "MmUnmapLockedPages" and freedArg = 0
+        or
+        name = "LocalFree" and freedArg = 0
+        or
+        name = "GlobalFree" and freedArg = 0
+        or
+        name = "HeapFree" and freedArg = 2
+        or
+        name = "VirtualFree" and freedArg = 0
+        or
+        name = "CoTaskMemFree" and freedArg = 0
+        or
+        name = "SysFreeString" and freedArg = 0
+        or
+        name = "LocalReAlloc" and freedArg = 0
+        or
+        name = "GlobalReAlloc" and freedArg = 0
+        or
+        name = "HeapReAlloc" and freedArg = 2
+        or
+        name = "CoTaskMemRealloc" and freedArg = 0
+        or
+        name = "kmem_free" and freedArg = 0
+        or
+        name = "pool_put" and freedArg = 1
+        or
+        name = "pool_cache_put" and freedArg = 1
+      )
+    )
   }
 
   override int getFreedArg() { result = freedArg }

cpp/ql/src/semmle/code/cpp/models/implementations/Fread.qll

@@ -1,8 +1,8 @@
 import semmle.code.cpp.models.interfaces.Alias
 import semmle.code.cpp.models.interfaces.FlowSource
 
-private class Fread extends AliasFunction, RemoteFlowSourceFunction {
-  Fread() { this.hasGlobalOrStdOrBslName("fread") }
+private class Fread extends AliasFunction, RemoteFlowFunction {
+  Fread() { this.hasGlobalName("fread") }
 
   override predicate parameterNeverEscapes(int n) {
     n = 0 or

cpp/ql/src/semmle/code/cpp/models/implementations/GetDelim.qll

@@ -7,7 +7,7 @@ import semmle.code.cpp.models.interfaces.FlowSource
  * The standard functions `getdelim`, `getwdelim` and the glibc variant `__getdelim`.
  */
 private class GetDelimFunction extends TaintFunction, AliasFunction, SideEffectFunction,
-  RemoteFlowSourceFunction {
+  RemoteFlowFunction {
   GetDelimFunction() { hasGlobalName(["getdelim", "getwdelim", "__getdelim"]) }
 
   override predicate hasTaintFlow(FunctionInput i, FunctionOutput o) {