yeast: Fix typo

Co-authored-by: Jeroen Ketema <93738568+jketema@users.noreply.github.com>

cpp/ql/lib/change-notes/2026-06-30-mad-qualified-field-names.md

@@ -0,0 +1,4 @@
+---
+category: deprecated
+---
+* Models-as-data flow summaries now use fully qualified field names (for example, `MyNamespace::MyStruct::myField`) instead of unqualified field names such as `myField`. We recommend updating existing flow summaries to use fully qualified field names. Unqualified field names are still supported, but that support will be removed in a future release.

cpp/ql/lib/change-notes/2026-06-30-variables-as-mad-sources-and-sinks.md

@@ -0,0 +1,4 @@
+---
+category: breaking
+---
+* Removed support for using variables as sources and sinks in models-as-data. Users of this feature should convert such sources and sinks to models defined using the QL language.

cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll

@@ -931,31 +931,6 @@ private Element interpretElement0(
     signature = "" and
     elementSpec(namespace, type, subtypes, name, signature, _)
   )
-  or
-  // Member variables
-  elementSpec(namespace, type, subtypes, name, signature, _) and
-  signature = "" and
-  exists(Class namedClass, Class classWithMember, MemberVariable member |
-    member.getName() = name and
-    member = classWithMember.getAMember() and
-    namedClass.hasQualifiedName(namespace, type) and
-    result = member
-  |
-    // field declared in the named type or a subtype of it (or an extension of any)
-    subtypes = true and
-    classWithMember = namedClass.getADerivedClass*()
-    or
-    // field declared directly in the named type (or an extension of it)
-    subtypes = false and
-    classWithMember = namedClass
-  )
-  or
-  // Global or namespace variables
-  elementSpec(namespace, type, subtypes, name, signature, _) and
-  signature = "" and
-  type = "" and
-  subtypes = false and
-  result = any(GlobalOrNamespaceVariable v | v.hasQualifiedName(namespace, name))
 }
 
 cached

cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll

@@ -6,6 +6,7 @@ private import cpp as Cpp
 private import codeql.dataflow.internal.FlowSummaryImpl
 private import codeql.dataflow.internal.AccessPathSyntax as AccessPath
 private import semmle.code.cpp.ir.dataflow.internal.DataFlowPrivate
+private import semmle.code.cpp.ir.dataflow.internal.DataFlowNodes
 private import semmle.code.cpp.ir.dataflow.internal.DataFlowUtil
 private import semmle.code.cpp.ir.dataflow.internal.DataFlowImplSpecific as DataFlowImplSpecific
 private import semmle.code.cpp.dataflow.ExternalFlow
@@ -20,8 +21,22 @@ module Input implements InputSig<Location, DataFlowImplSpecific::CppDataFlow> {
 
   class SinkBase = Void;
 
+  class FlowSummaryCallBase = CallInstruction;
+
   predicate callableFromSource(SummarizedCallableBase c) { exists(c.getBlock()) }
 
+  FlowSummaryCallBase getASourceCall(SummarizedCallableBase sc) {
+    result.getStaticCallTarget() = sc
+  }
+
+  DataFlowCallable getSummarizedCallableAsDataFlowCallable(SummarizedCallableBase c) {
+    result.asSummarizedCallable() = c
+  }
+
+  DataFlowCallable getSourceCallEnclosingCallable(FlowSummaryCallBase call) {
+    result.asSourceCallable() = call.getEnclosingFunction()
+  }
+
   ArgumentPosition callbackSelfParameterPosition() { result = TDirectPosition(-1) }
 
   ReturnKind getStandardReturnValueKind() { result = getReturnValueKind("") }
@@ -30,6 +45,10 @@ module Input implements InputSig<Location, DataFlowImplSpecific::CppDataFlow> {
     arg = repeatStars(result.(NormalReturnKind).getIndirectionIndex())
   }
 
+  ParameterPosition getFlowSummaryParameterPosition(ReturnKind rk) {
+    result = TFlowSummaryPosition(rk)
+  }
+
   string encodeParameterPosition(ParameterPosition pos) { result = pos.toString() }
 
   string encodeArgumentPosition(ArgumentPosition pos) { result = pos.toString() }
@@ -40,12 +59,24 @@ module Input implements InputSig<Location, DataFlowImplSpecific::CppDataFlow> {
     arg = repeatStars(rk.(NormalReturnKind).getIndirectionIndex())
   }
 
+  bindingset[namespace, type, base]
+  private string formatQualifiedName(string namespace, string type, string base) {
+    if namespace = ""
+    then result = type + "::" + base
+    else result = namespace + "::" + type + "::" + base
+  }
+
   string encodeContent(ContentSet cs, string arg) {
-    exists(FieldContent c |
+    exists(FieldContent c, string namespace, string type, string base |
       cs.isSingleton(c) and
       // FieldContent indices have 0 for the address, 1 for content, so we need to subtract one.
       result = "Field" and
-      arg = repeatStars(c.getIndirectionIndex() - 1) + c.getField().getName()
+      c.getField().hasQualifiedName(namespace, type, base)
+    |
+      arg = repeatStars(c.getIndirectionIndex() - 1) + formatQualifiedName(namespace, type, base)
+      or
+      // TODO: This disjunct can be removed once we stop supporting unqualified field names.
+      arg = repeatStars(c.getIndirectionIndex() - 1) + base
     )
     or
     exists(ElementContent ec |
@@ -102,10 +133,22 @@ module Input implements InputSig<Location, DataFlowImplSpecific::CppDataFlow> {
 private import Make<Location, DataFlowImplSpecific::CppDataFlow, Input> as Impl
 
 private module StepsInput implements Impl::Private::StepsInputSig {
+  Impl::Private::SummaryNode getSummaryNode(Node n) {
+    result = n.(FlowSummaryNode).getSummaryNode()
+  }
+
   DataFlowCall getACall(Public::SummarizedCallable sc) {
     result.getStaticCallTarget().getUnderlyingCallable() = sc
   }
 
+  Node getSourceOutNode(Input::FlowSummaryCallBase call, ReturnKind rk) {
+    exists(IndirectReturnOutNode out | result = out |
+      out.getCallInstruction() = call and
+      pragma[only_bind_out](rk.(NormalReturnKind).getIndirectionIndex()) =
+        pragma[only_bind_out](out.getIndirectionIndex())
+    )
+  }
+
   DataFlowCallable getSourceNodeEnclosingCallable(Input::SourceBase source) { none() }
 
   Node getSourceNode(Input::SourceBase source, Impl::Private::SummaryComponentStack s) { none() }
@@ -218,40 +261,11 @@ module SourceSinkInterpretationInput implements
 
   /** Provides additional sink specification logic. */
   bindingset[c]
-  predicate interpretOutput(string c, InterpretNode mid, InterpretNode node) {
-    // Allow variables to be picked as output nodes.
-    exists(Node n, Element ast |
-      n = node.asNode() and
-      ast = mid.asElement()
-    |
-      c = "" and
-      n.asExpr().(VariableAccess).getTarget() = ast
-    )
-  }
+  predicate interpretOutput(string c, InterpretNode mid, InterpretNode node) { none() }
 
   /** Provides additional source specification logic. */
   bindingset[c]
-  predicate interpretInput(string c, InterpretNode mid, InterpretNode node) {
-    exists(Node n, Element ast, VariableAccess e |
-      n = node.asNode() and
-      ast = mid.asElement() and
-      e.getTarget() = ast
-    |
-      // Allow variables to be picked as input nodes.
-      // We could simply do this as `e = n.asExpr()`, but that would not allow
-      // us to pick `x` as a sink in an example such as `x = source()` (but
-      // only subsequent uses of `x`) since the variable access on `x` doesn't
-      // actually load the value of `x`. So instead, we pick the instruction
-      // node corresponding to the generated `StoreInstruction` and use the
-      // expression associated with the destination instruction. This means
-      // that the `x` in `x = source()` can be marked as an input.
-      c = "" and
-      exists(StoreInstruction store |
-        store.getDestinationAddress().getUnconvertedResultExpression() = e and
-        n.asInstruction() = store
-      )
-    )
-  }
+  predicate interpretInput(string c, InterpretNode mid, InterpretNode node) { none() }
 }
 
 module Private {

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowNodes.qll

@@ -1534,12 +1534,8 @@ class FlowSummaryNode extends Node, TFlowSummaryNode {
     result = this.getSummaryNode().getSummarizedCallable()
   }
 
-  /**
-   * Gets the enclosing callable. For a `FlowSummaryNode` this is always the
-   * summarized function this node is part of.
-   */
   override DataFlowCallable getEnclosingCallable() {
-    result.asSummarizedCallable() = this.getSummarizedCallable()
+    result = FlowSummaryImpl::Private::getEnclosingCallable(this.getSummaryNode())
   }
 
   override Location getLocationImpl() { result = this.getSummarizedCallable().getLocation() }

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll

@@ -561,6 +561,21 @@ class SummaryArgumentNode extends ArgumentNode, FlowSummaryNode {
   }
 }
 
+/** An argument node that re-enters return output as input to a flow summary. */
+private class FlowSummaryArgumentNode extends ArgumentNode, FlowSummaryNode {
+  private CallInstruction callInstruction;
+  private ReturnKind rk;
+
+  FlowSummaryArgumentNode() {
+    this.getSummaryNode() = FlowSummaryImpl::Private::summaryArgumentNode(callInstruction, rk)
+  }
+
+  override predicate argumentOf(DataFlowCall call, ArgumentPosition pos) {
+    call.asCallInstruction() = callInstruction and
+    pos = TFlowSummaryPosition(rk)
+  }
+}
+
 /** A parameter position represented by an integer. */
 class ParameterPosition = Position;
 
@@ -616,6 +631,18 @@ class IndirectionPosition extends Position, TIndirectionPosition {
   final override int getIndirectionIndex() { result = indirectionIndex }
 }
 
+class FlowSummaryPosition extends Position, TFlowSummaryPosition {
+  ReturnKind rk;
+
+  FlowSummaryPosition() { this = TFlowSummaryPosition(rk) }
+
+  override string toString() { result = "write to: " + rk.toString() }
+
+  override int getArgumentIndex() { none() }
+
+  final override int getIndirectionIndex() { result = rk.getIndirectionIndex() }
+}
+
 newtype TPosition =
   TDirectPosition(int argumentIndex) {
     exists(any(CallInstruction c).getArgument(argumentIndex))
@@ -634,7 +661,8 @@ newtype TPosition =
       p = f.getParameter(argumentIndex) and
       indirectionIndex = [1 .. Ssa::getMaxIndirectionsForType(p.getUnspecifiedType()) - 1]
     )
-  }
+  } or
+  TFlowSummaryPosition(ReturnKind rk) { FlowSummaryImpl::Private::relevantFlowSummaryPosition(rk) }
 
 private newtype TReturnKind =
   TNormalReturnKind(int indirectionIndex) {
@@ -1378,6 +1406,8 @@ predicate nodeIsHidden(Node n) {
   n instanceof InitialGlobalValue
   or
   n instanceof SsaSynthNode
+  or
+  n.(FlowSummaryNode).getSummaryNode().isHidden()
 }
 
 predicate neverSkipInPathGraph(Node n) {

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll

@@ -158,7 +158,7 @@ private module Cached {
     model = ""
     or
     // models-as-data summarized flow
-    FlowSummaryImpl::Private::Steps::summaryLocalStep(nodeFrom.(FlowSummaryNode).getSummaryNode(),
+    FlowSummaryImpl::Private::Steps::summaryLocalStep(nodeFrom,
       nodeTo.(FlowSummaryNode).getSummaryNode(), true, model)
   }
 

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/TaintTrackingUtil.qll

@@ -67,7 +67,7 @@ private module Cached {
     model = ""
     or
     // models-as-data summarized flow
-    FlowSummaryImpl::Private::Steps::summaryLocalStep(nodeFrom.(FlowSummaryNode).getSummaryNode(),
+    FlowSummaryImpl::Private::Steps::summaryLocalStep(nodeFrom,
       nodeTo.(FlowSummaryNode).getSummaryNode(), false, model)
     or
     // object->field conflation for content that is a `TaintInheritingContent`.

cpp/ql/test/examples/BadLocking/AV Rule 107.qlref

@@ -1 +1,2 @@
-jsf/4.13 Functions/AV Rule 107.ql
+query: jsf/4.13 Functions/AV Rule 107.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

cpp/ql/test/examples/BadLocking/LocalVariableHidesGlobalVariable.qlref

@@ -1 +1,2 @@
-Best Practices/Hiding/LocalVariableHidesGlobalVariable.ql
+query: Best Practices/Hiding/LocalVariableHidesGlobalVariable.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

cpp/ql/test/examples/BadLocking/UnintendedDeclaration.cpp

@@ -48,7 +48,7 @@ void test1()
 
 void test2()
 {
-	Lock<Mutex> myLock(); // BAD (interpreted as a function declaration, this does nothing)
+	Lock<Mutex> myLock(); // $ Alert[cpp/function-in-block] // BAD (interpreted as a function declaration, this does nothing)
 
 	// ...
 }
@@ -62,14 +62,14 @@ void test3()
 
 void test4()
 {
-	Lock<Mutex>(myMutex); // BAD (creates an uninitialized variable called `myMutex`, probably not intended)
+	Lock<Mutex>(myMutex); // $ Alert[cpp/local-variable-hides-global-variable] // BAD (creates an uninitialized variable called `myMutex`, probably not intended)
 
 	// ...
 }
 
 void test5()
 {
-	Lock<Mutex> myLock(Mutex); // BAD (interpreted as a function declaration, this does nothing)
+	Lock<Mutex> myLock(Mutex); // $ Alert[cpp/function-in-block] // BAD (interpreted as a function declaration, this does nothing)
 
 	// ...
 }
@@ -86,7 +86,7 @@ public:
 
 	void test7()
 	{
-		Lock<Mutex>(memberMutex); // BAD (creates an uninitialized variable called `memberMutex`, probably not intended) [NOT DETECTED]
+		Lock<Mutex>(memberMutex); // $ MISSING: Alert // BAD (creates an uninitialized variable called `memberMutex`, probably not intended) [NOT DETECTED]
 
 		// ...
 	}

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-020/NoCheckBeforeUnsafePutUser/NoCheckBeforeUnsafePutUser.qlref

@@ -1 +1,2 @@
-experimental/Security/CWE/CWE-020/NoCheckBeforeUnsafePutUser.ql
+query: experimental/Security/CWE/CWE-020/NoCheckBeforeUnsafePutUser.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-020/NoCheckBeforeUnsafePutUser/test.cpp

@@ -19,7 +19,7 @@ void test1(int p)
 {
 	sys_somesystemcall(&p);
 
-	unsafe_put_user(123, &p); // BAD [NOT DETECTED]
+	unsafe_put_user(123, &p); // $ MISSING: Alert // BAD [NOT DETECTED]
 }
 
 void test2(int p)
@@ -40,7 +40,7 @@ void test3()
 
 	sys_somesystemcall(&v);
 
-	unsafe_put_user(123, &v); // BAD [NOT DETECTED]
+	unsafe_put_user(123, &v); // $ MISSING: Alert // BAD [NOT DETECTED]
 }
 
 void test4()
@@ -68,7 +68,7 @@ void test5()
 
 	sys_somesystemcall(&myData);
 
-	unsafe_put_user(123, &(myData.x)); // BAD [NOT DETECTED]
+	unsafe_put_user(123, &(myData.x)); // $ MISSING: Alert // BAD [NOT DETECTED]
 }
 
 void test6()

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-020/semmle/tests/LateCheckOfFunctionArgument.qlref

@@ -1 +1,2 @@
-experimental/Security/CWE/CWE-020/LateCheckOfFunctionArgument.ql
+query: experimental/Security/CWE/CWE-020/LateCheckOfFunctionArgument.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-020/semmle/tests/test.c

@@ -3,6 +3,6 @@ void workFunction_0(char *s) {
   char buf[80], buf1[8];
   if(len<0) return;
   memset(buf,0,len); //GOOD
-  memset(buf1,0,len1); //BAD
+  memset(buf1,0,len1); // $ Alert //BAD
   if(len1<0) return;
 }

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-078/WordexpTainted.qlref

@@ -1 +1,2 @@
-experimental/Security/CWE/CWE-078/WordexpTainted.ql
+query: experimental/Security/CWE/CWE-078/WordexpTainted.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-078/test.cpp

@@ -19,14 +19,14 @@ enum {
 
 int wordexp(const char *restrict s, wordexp_t *restrict p, int flags);
 
-int main(int argc, char** argv) {
+int main(int argc, char** argv) { // $ Source
   char *filePath = argv[2];
 
   {
     // BAD: the user string is injected directly into `wordexp` which performs command substitution
 
     wordexp_t we;
-    wordexp(filePath, &we, 0);
+    wordexp(filePath, &we, 0); // $ Alert
   }
 
   {

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1041/semmle/tests/FindWrapperFunctions.qlref

@@ -1 +1,2 @@
-experimental/Security/CWE/CWE-1041/FindWrapperFunctions.ql
+query: experimental/Security/CWE/CWE-1041/FindWrapperFunctions.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1041/semmle/tests/test.cpp

@@ -20,7 +20,7 @@ void myFclose(FILE * fmy)
 int main(int argc, char *argv[])
 {
   fe = fopen("myFile.txt", "wt");
-  fclose(fe); // BAD
+  fclose(fe); // $ Alert // BAD
   fe = fopen("myFile.txt", "wt");
   myFclose(fe); // GOOD
   return 0;

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1126/semmle/tests/DeclarationOfVariableWithUnnecessarilyWideScope.qlref

@@ -1 +1,2 @@
-experimental/Security/CWE/CWE-1126/DeclarationOfVariableWithUnnecessarilyWideScope.ql
+query: experimental/Security/CWE/CWE-1126/DeclarationOfVariableWithUnnecessarilyWideScope.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1126/semmle/tests/test.c

@@ -11,7 +11,7 @@ void workFunction_0(char *s) {
   while(intIndex > 2)
   {
     buf[intIndex] = 1;
-    int intIndex; // BAD
+    int intIndex; // $ Alert // BAD
     intIndex--;
   }
   intIndex = 10;

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1240/CustomCryptographicPrimitive.qlref

@@ -1 +1,2 @@
-experimental/Security/CWE/CWE-1240/CustomCryptographicPrimitive.ql
+query: experimental/Security/CWE/CWE-1240/CustomCryptographicPrimitive.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1240/tests_crypto.cpp

@@ -8,7 +8,7 @@ int strlen(const char *string);
 
 // the following function is homebrew crypto written for this test.  This is a bad algorithm
 // on multiple levels and should never be used in cryptography.
-void encryptString(char *string, unsigned int key) {
+void encryptString(char *string, unsigned int key) { // $ Alert
 	char *ptr = string;
 	int len = strlen(string);
 
@@ -27,7 +27,7 @@ void encryptString(char *string, unsigned int key) {
 
 // the following function is homebrew crypto written for this test.  This is a bad algorithm
 // on multiple levels and should never be used in cryptography.
-void MyEncrypt(const unsigned int *dataIn, unsigned int *dataOut, unsigned int dataSize, unsigned int key[2]) {
+void MyEncrypt(const unsigned int *dataIn, unsigned int *dataOut, unsigned int dataSize, unsigned int key[2]) { // $ Alert
 	unsigned int state[2];
 	unsigned int t;
 
@@ -48,7 +48,7 @@ void MyEncrypt(const unsigned int *dataIn, unsigned int *dataOut, unsigned int d
 // the following function resembles an implementation of the AES "mix columns"
 // step. It is not accurate, efficient or safe and should never be used in
 // cryptography.
-void mix_columns(const uint8_t inputs[4], uint8_t outputs[4]) {
+void mix_columns(const uint8_t inputs[4], uint8_t outputs[4]) { // $ Alert
 	// The "mix columns" step takes four bytes as inputs. Each byte represents a
 	// polynomial with 8 one-bit coefficients, e.g. input bits 00001101
 	// represent the polynomial x^3 + x^2 + 1.  Arithmetic is reduced modulo
@@ -80,7 +80,7 @@ void mix_columns(const uint8_t inputs[4], uint8_t outputs[4]) {
 // the following function resembles initialization of an S-box as may be done
 // in an implementation of DES, AES and other encryption algorithms. It is not
 // accurate, efficient or safe and should never be used in cryptography.
-void init_aes_sbox(unsigned char data[256]) {
+void init_aes_sbox(unsigned char data[256]) { // $ Alert
 	// initialize `data` in a loop using lots of ^, ^= and << operations and
 	// a few fixed constants.
 	unsigned int state = 0x12345678;

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-125/semmle/tests/DangerousWorksWithMultibyteOrWideCharacters.qlref

@@ -1 +1,2 @@
-experimental/Security/CWE/CWE-125/DangerousWorksWithMultibyteOrWideCharacters.ql
+query: experimental/Security/CWE/CWE-125/DangerousWorksWithMultibyteOrWideCharacters.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-125/semmle/tests/test.cpp

@@ -63,7 +63,7 @@ static void badTest1(const char* ptr)
   int ret;
   int len;
   len = strlen(ptr);
-  for (wchar_t wc; (ret = mbtowc(&wc, ptr, 4)) > 0; len-=ret) { // BAD:we can get unpredictable results
+  for (wchar_t wc; (ret = mbtowc(&wc, ptr, 4)) > 0; len-=ret) { // $ Alert // BAD:we can get unpredictable results
     wprintf(L"%lc", wc);
     ptr += ret;
   }
@@ -73,7 +73,7 @@ static void badTest2(const char* ptr)
   int ret;
   int len;
   len = strlen(ptr);
-  for (wchar_t wc; (ret = mbtowc(&wc, ptr, sizeof(wchar_t))) > 0; len-=ret) { // BAD:we can get unpredictable results
+  for (wchar_t wc; (ret = mbtowc(&wc, ptr, sizeof(wchar_t))) > 0; len-=ret) { // $ Alert // BAD:we can get unpredictable results
     wprintf(L"%lc", wc);
     ptr += ret;
   }
@@ -103,7 +103,7 @@ static void badTest3(const char* ptr,int wc_len)
   len = wc_len;
   wchar_t *wc = new wchar_t[wc_len];
   while (*ptr && len > 0) {
-    ret = mbtowc(wc, ptr, MB_CUR_MAX); // BAD
+    ret = mbtowc(wc, ptr, MB_CUR_MAX); // $ Alert // BAD
     if (ret <0)
       break;
     if (ret == 0 || ret > len)
@@ -120,7 +120,7 @@ static void badTest4(const char* ptr,int wc_len)
   len = wc_len;
   wchar_t *wc = new wchar_t[wc_len];
   while (*ptr && len > 0) {
-    ret = mbtowc(wc, ptr, 16); // BAD
+    ret = mbtowc(wc, ptr, 16); // $ Alert // BAD
     if (ret <0)
       break;
     if (ret == 0 || ret > len)
@@ -137,7 +137,7 @@ static void badTest5(const char* ptr,int wc_len)
   len = wc_len;
   wchar_t *wc = new wchar_t[wc_len];
   while (*ptr && len > 0) {
-    ret = mbtowc(wc, ptr, sizeof(wchar_t)); // BAD
+    ret = mbtowc(wc, ptr, sizeof(wchar_t)); // $ Alert // BAD
     if (ret <0)
       break;
     if (ret == 0 || ret > len)
@@ -155,7 +155,7 @@ static void badTest6(const char* ptr,int wc_len)
   len = wc_len;
   wchar_t *wc = new wchar_t[wc_len];
   while (*ptr && wc_len > 0) {
-    ret = mbtowc(wc, ptr, wc_len); // BAD
+    ret = mbtowc(wc, ptr, wc_len); // $ Alert // BAD
     if (ret <0)
       if (checkErrors()) {
         ++ptr;
@@ -178,7 +178,7 @@ static void badTest7(const char* ptr,int wc_len)
   len = wc_len;
   wchar_t *wc = new wchar_t[wc_len];
   while (*ptr && wc_len > 0) {
-    ret = mbtowc(wc, ptr, len); // BAD
+    ret = mbtowc(wc, ptr, len); // $ Alert // BAD
     if (ret <0)
         break;
     if (ret == 0 || ret > len)
@@ -194,7 +194,7 @@ static void badTest8(const char* ptr,wchar_t *wc)
   int len;
   len = strlen(ptr);
   while (*ptr && len > 0) {
-    ret = mbtowc(wc, ptr, len); // BAD
+    ret = mbtowc(wc, ptr, len); // $ Alert // BAD
     if (ret <0)
       break;
     if (ret == 0 || ret > len)

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-125/semmle/tests/test1.cpp

@@ -25,8 +25,8 @@ void* calloc (size_t num, size_t size);
 void* malloc (size_t size);
 
 static void badTest1(void *src,  int size) {
-    WideCharToMultiByte(CP_ACP, 0, (LPCWSTR)src, -1, (LPSTR)src, size, 0, 0); // BAD
-    MultiByteToWideChar(CP_ACP, 0, (LPCSTR)src, -1, (LPCWSTR)src, 30); // BAD
+    WideCharToMultiByte(CP_ACP, 0, (LPCWSTR)src, -1, (LPSTR)src, size, 0, 0); // $ Alert // BAD
+    MultiByteToWideChar(CP_ACP, 0, (LPCSTR)src, -1, (LPCWSTR)src, 30); // $ Alert // BAD
 }
 void goodTest2(){
   wchar_t src[] = L"0123456789ABCDEF";
@@ -42,7 +42,7 @@ void goodTest2(){
 static void badTest2(){
   wchar_t src[] = L"0123456789ABCDEF";
   char dst[16];
-  WideCharToMultiByte(CP_UTF8, 0, src, -1, dst, 16, NULL, NULL); // BAD
+  WideCharToMultiByte(CP_UTF8, 0, src, -1, dst, 16, NULL, NULL); // $ Alert // BAD
   printf("%s\n", dst);
 }
 static void goodTest3(){
@@ -55,7 +55,7 @@ static void badTest3(){
   char src[] = "0123456789ABCDEF";
   int size = MultiByteToWideChar(CP_UTF8, 0, src,sizeof(src),NULL,0);
   wchar_t * dst = (wchar_t*)calloc(size + 1, 1);
-  MultiByteToWideChar(CP_UTF8, 0, src, -1, dst, size+1); // BAD
+  MultiByteToWideChar(CP_UTF8, 0, src, -1, dst, size+1); // $ Alert // BAD
 }
 static void goodTest4(){
   char src[] = "0123456789ABCDEF";
@@ -67,13 +67,13 @@ static void badTest4(){
   char src[] = "0123456789ABCDEF";
   int size = MultiByteToWideChar(CP_UTF8, 0, src,sizeof(src),NULL,0);
   wchar_t * dst = (wchar_t*)malloc(size + 1);
-  MultiByteToWideChar(CP_UTF8, 0, src, -1, dst, size+1); // BAD
+  MultiByteToWideChar(CP_UTF8, 0, src, -1, dst, size+1); // $ Alert // BAD
 }
 static int goodTest5(void *src){
   return WideCharToMultiByte(CP_ACP, 0, (LPCWSTR)src, -1, 0, 0, 0, 0); // GOOD
 }
 static int badTest5 (void *src) {
-  return WideCharToMultiByte(CP_ACP, 0, (LPCWSTR)src, -1, 0, 3, 0, 0);  // BAD
+  return WideCharToMultiByte(CP_ACP, 0, (LPCWSTR)src, -1, 0, 3, 0, 0);  // $ Alert // BAD
 }
 static void goodTest6(WCHAR *src)
 {
@@ -90,6 +90,6 @@ static void goodTest6(WCHAR *src)
 static void badTest6(WCHAR *src)
 {
     char dst[5] ="";
-    WideCharToMultiByte(CP_ACP, 0, src, -1, dst, 260, 0, 0); // BAD
+    WideCharToMultiByte(CP_ACP, 0, src, -1, dst, 260, 0, 0); // $ Alert // BAD
     printf("%s\n", dst);
 }

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-125/semmle/tests/test2.cpp

@@ -12,11 +12,11 @@ size_t mbsrtowcs(wchar_t *wcstr,const char *mbstr,size_t count, mbstate_t *mbsta
 
 
 static void badTest1(void *src,  int size) {
-    mbstowcs((wchar_t*)src,(char*)src,size); // BAD
+    mbstowcs((wchar_t*)src,(char*)src,size); // $ Alert // BAD
     _locale_t locale;
-    _mbstowcs_l((wchar_t*)src,(char*)src,size,locale); // BAD
+    _mbstowcs_l((wchar_t*)src,(char*)src,size,locale); // $ Alert // BAD
     mbstate_t *mbstate;
-    mbsrtowcs((wchar_t*)src,(char*)src,size,mbstate); // BAD
+    mbsrtowcs((wchar_t*)src,(char*)src,size,mbstate); // $ Alert // BAD
 }
 static void goodTest2(){
   char src[] = "0123456789ABCDEF";
@@ -32,7 +32,7 @@ static void goodTest2(){
 static void badTest2(){
   char src[] = "0123456789ABCDEF";
   wchar_t dst[16];
-  mbstowcs(dst, src,16); // BAD
+  mbstowcs(dst, src,16); // $ Alert // BAD
   printf("%s\n", dst);
 }
 static void goodTest3(){
@@ -45,7 +45,7 @@ static void badTest3(){
   char src[] = "0123456789ABCDEF";
   int size = mbstowcs(NULL, src,NULL);
   wchar_t * dst = (wchar_t*)calloc(size + 1, 1);
-  mbstowcs(dst, src,size+1); // BAD
+  mbstowcs(dst, src,size+1); // $ Alert // BAD
 }
 static void goodTest4(){
   char src[] = "0123456789ABCDEF";
@@ -57,13 +57,13 @@ static void badTest4(){
   char src[] = "0123456789ABCDEF";
   int size = mbstowcs(NULL, src,NULL);
   wchar_t * dst = (wchar_t*)malloc(size + 1);
-  mbstowcs(dst, src,size+1); // BAD
+  mbstowcs(dst, src,size+1); // $ Alert // BAD
 }
 static int goodTest5(void *src){
   return mbstowcs(NULL, (char*)src,NULL); // GOOD
 }
 static int badTest5 (void *src) {
-  return mbstowcs(NULL, (char*)src,3); // BAD
+  return mbstowcs(NULL, (char*)src,3); // $ Alert // BAD
 }
 static void goodTest6(void *src){
   wchar_t dst[5];
@@ -77,6 +77,6 @@ static void goodTest6(void *src){
 }
 static void badTest6(void *src){
   wchar_t dst[5];
-  mbstowcs(dst, (char*)src,260); // BAD
+  mbstowcs(dst, (char*)src,260); // $ Alert // BAD
   printf("%s\n", dst);
 }

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-125/semmle/tests/test3.cpp

@@ -13,7 +13,7 @@ static size_t badTest1(unsigned char *src){
   int cb = 0;
   unsigned char dst[50];
   while( cb < sizeof(dst) )
-    dst[cb++]=*src++; // BAD
+    dst[cb++]=*src++; // $ Alert // BAD
   return _mbclen(dst);
 }
 static void goodTest2(unsigned char *src){
@@ -33,7 +33,7 @@ static void badTest2(unsigned char *src){
   unsigned char dst[50];
   while( cb < sizeof(dst) )
   {
-    _mbccpy(dst+cb,src); // BAD
+    _mbccpy(dst+cb,src); // $ Alert // BAD
     cb+=_mbclen(src);
     src=_mbsinc(src);
   }
@@ -44,5 +44,5 @@ static void goodTest3(){
 }
 static void badTest3(){
   wchar_t name[50];
-  name[sizeof(name) - 1] = L'\0'; // BAD
+  name[sizeof(name) - 1] = L'\0'; // $ Alert // BAD
 }

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/AllocMultiplicationOverflow/AllocMultiplicationOverflow.qlref

@@ -1 +1,2 @@
-experimental/Security/CWE/CWE-190/AllocMultiplicationOverflow.ql
+query: experimental/Security/CWE/CWE-190/AllocMultiplicationOverflow.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/AllocMultiplicationOverflow/test.cpp

@@ -10,31 +10,31 @@ void test()
 	int y = getAnInt();
 
 	char *buffer1 = (char *)malloc(x + y); // GOOD
-	char *buffer2 = (char *)malloc(x * y); // BAD
+	char *buffer2 = (char *)malloc(x * y); // $ Alert // BAD
 	int *buffer3 = (int *)malloc(x * sizeof(int)); // GOOD
-	int *buffer4 = (int *)malloc(x * y * sizeof(int)); // BAD
+	int *buffer4 = (int *)malloc(x * y * sizeof(int)); // $ Alert // BAD
 
 	if ((x <= 1000) && (y <= 1000))
 	{
-		char *buffer5 = (char *)malloc(x * y); // GOOD [FALSE POSITIVE]
+		char *buffer5 = (char *)malloc(x * y); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE]
 	}
 
-	size_t size1 = x * y;
-	char *buffer5 = (char *)malloc(size1); // BAD
+	size_t size1 = x * y; // $ Source
+	char *buffer5 = (char *)malloc(size1); // $ Alert // BAD
 
 	size_t size2 = x;
 	size2 *= y;
-	char *buffer6 = (char *)malloc(size2); // BAD [NOT DETECTED]
+	char *buffer6 = (char *)malloc(size2); // $ MISSING: Alert // BAD [NOT DETECTED]
 
 	char *buffer7 = new char[x * 10]; // GOOD
-	char *buffer8 = new char[x * y]; // BAD
-	char *buffer9 = new char[x * x]; // BAD
+	char *buffer8 = new char[x * y]; // $ Alert // BAD
+	char *buffer9 = new char[x * x]; // $ Alert // BAD
 }
 
 
 // --- custom allocators ---
- 
-void *MyMalloc1(size_t size) { return malloc(size); } // [additional detection here]
+
+void *MyMalloc1(size_t size) { return malloc(size); } // $ Alert // [additional detection here]
 void *MyMalloc2(size_t size);
 
 void customAllocatorTests()
@@ -42,6 +42,6 @@ void customAllocatorTests()
 	int x = getAnInt();
 	int y = getAnInt();
 
-	char *buffer1 = (char *)MyMalloc1(x * y); // BAD
-	char *buffer2 = (char *)MyMalloc2(x * y); // BAD
+	char *buffer1 = (char *)MyMalloc1(x * y); // $ Alert Source // BAD
+	char *buffer2 = (char *)MyMalloc2(x * y); // $ Alert // BAD
 }

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/DangerousUseOfTransformationAfterOperation/DangerousUseOfTransformationAfterOperation.qlref

@@ -1 +1,2 @@
-experimental/Security/CWE/CWE-190/DangerousUseOfTransformationAfterOperation.ql
+query: experimental/Security/CWE/CWE-190/DangerousUseOfTransformationAfterOperation.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/DangerousUseOfTransformationAfterOperation/test.cpp

@@ -6,17 +6,17 @@ void functionWork(char aA[10],unsigned int aUI) {
   int aI;
 
   aI = (aUI*8)/10; // GOOD
-  aI = aUI*8; // BAD
+  aI = aUI*8; // $ Alert // BAD
   aP = aA+aI;
   aI = (int)aUI*8; // GOOD
-  
-  aL = (unsigned long)(aI*aI); // BAD
+
+  aL = (unsigned long)(aI*aI); // $ Alert // BAD
   aL = ((unsigned long)aI*aI); // GOOD
-  
-  testCall((unsigned long)(aI*aI)); // BAD
+
+  testCall((unsigned long)(aI*aI)); // $ Alert // BAD
   testCall(((unsigned long)aI*aI)); // GOOD
-  
-  if((unsigned long)(aI*aI) > aL) // BAD
+
+  if((unsigned long)(aI*aI) > aL) // $ Alert // BAD
     return;
   if(((unsigned long)aI*aI) > aL) // GOOD
     return;

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/IfStatementAdditionOverflow/IfStatementAdditionOverflow.qlref

@@ -1 +1,2 @@
-experimental/Security/CWE/CWE-190/IfStatementAdditionOverflow.ql
+query: experimental/Security/CWE/CWE-190/IfStatementAdditionOverflow.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/IfStatementAdditionOverflow/test.cpp

@@ -15,49 +15,49 @@ void test()
 	unsigned short b1 = getAnUnsignedShort();
 	unsigned short c1 = getAnUnsignedShort();
 
-	if (a+b>c) a = c-b; // BAD
-	if (a+b>c) { a = c-b; } // BAD
-	if (b+a>c) a = c-b; // BAD
-	if (b+a>c) { a = c-b; } // BAD
-	if (c>a+b) a = c-b; // BAD
-	if (c>a+b) { a = c-b; } // BAD
-	if (c>b+a) a = c-b; // BAD
-	if (c>b+a) { a = c-b; } // BAD
+	if (a+b>c) a = c-b; // $ Alert // BAD
+	if (a+b>c) { a = c-b; } // $ Alert // BAD
+	if (b+a>c) a = c-b; // $ Alert // BAD
+	if (b+a>c) { a = c-b; } // $ Alert // BAD
+	if (c>a+b) a = c-b; // $ Alert // BAD
+	if (c>a+b) { a = c-b; } // $ Alert // BAD
+	if (c>b+a) a = c-b; // $ Alert // BAD
+	if (c>b+a) { a = c-b; } // $ Alert // BAD
 
-	if (a+b>=c) a = c-b; // BAD
-	if (a+b>=c) { a = c-b; } // BAD
-	if (b+a>=c) a = c-b; // BAD
-	if (b+a>=c) { a = c-b; } // BAD
-	if (c>=a+b) a = c-b; // BAD
-	if (c>=a+b) { a = c-b; } // BAD
-	if (c>=b+a) a = c-b; // BAD
-	if (c>=b+a) { a = c-b; } // BAD
+	if (a+b>=c) a = c-b; // $ Alert // BAD
+	if (a+b>=c) { a = c-b; } // $ Alert // BAD
+	if (b+a>=c) a = c-b; // $ Alert // BAD
+	if (b+a>=c) { a = c-b; } // $ Alert // BAD
+	if (c>=a+b) a = c-b; // $ Alert // BAD
+	if (c>=a+b) { a = c-b; } // $ Alert // BAD
+	if (c>=b+a) a = c-b; // $ Alert // BAD
+	if (c>=b+a) { a = c-b; } // $ Alert // BAD
 
-	if (a+b<c) a = c-b; // BAD
-	if (a+b<c) { a = c-b; } // BAD
-	if (b+a<c) a = c-b; // BAD
-	if (b+a<c) { a = c-b; } // BAD
-	if (c<a+b) a = c-b; // BAD
-	if (c<a+b) { a = c-b; } // BAD
-	if (c<b+a) a = c-b; // BAD
-	if (c<b+a) { a = c-b; } // BAD
+	if (a+b<c) a = c-b; // $ Alert // BAD
+	if (a+b<c) { a = c-b; } // $ Alert // BAD
+	if (b+a<c) a = c-b; // $ Alert // BAD
+	if (b+a<c) { a = c-b; } // $ Alert // BAD
+	if (c<a+b) a = c-b; // $ Alert // BAD
+	if (c<a+b) { a = c-b; } // $ Alert // BAD
+	if (c<b+a) a = c-b; // $ Alert // BAD
+	if (c<b+a) { a = c-b; } // $ Alert // BAD
 
-	if (a+b<=c) a = c-b; // BAD
-	if (a+b<=c) { a = c-b; } // BAD
-	if (b+a<=c) a = c-b; // BAD
-	if (b+a<=c) { a = c-b; } // BAD
-	if (c<=a+b) a = c-b; // BAD
-	if (c<=a+b) { a = c-b; } // BAD
-	if (c<=b+a) a = c-b; // BAD
-	if (c<=b+a) { a = c-b; } // BAD
+	if (a+b<=c) a = c-b; // $ Alert // BAD
+	if (a+b<=c) { a = c-b; } // $ Alert // BAD
+	if (b+a<=c) a = c-b; // $ Alert // BAD
+	if (b+a<=c) { a = c-b; } // $ Alert // BAD
+	if (c<=a+b) a = c-b; // $ Alert // BAD
+	if (c<=a+b) { a = c-b; } // $ Alert // BAD
+	if (c<=b+a) a = c-b; // $ Alert // BAD
+	if (c<=b+a) { a = c-b; } // $ Alert // BAD
 
-	if (a+b>d) a = d-b; // BAD
+	if (a+b>d) a = d-b; // $ Alert // BAD
 	if (a+(double)b>c) a = c-b; // GOOD
 	if (a+(-x)>c) a = c-(-y); // GOOD
 	if (a+b>c) { b++; a = c-b; } // GOOD
 	if (a+d>c) a = c-d; // GOOD
 	if (a1+b1>c1) a1 = c1-b1; // GOOD
-	
-	if (a+b<=c) { /* ... */ } else { a = c-b; } // BAD
-	if (a+b<=c) { return; } a = c-b; // BAD
+
+	if (a+b<=c) { /* ... */ } else { a = c-b; } // $ Alert // BAD
+	if (a+b<=c) { return; } a = c-b; // $ Alert // BAD
 }

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/array-access/ArrayAccessProductFlow.qlref

@@ -1 +1,2 @@
-experimental/Likely Bugs/ArrayAccessProductFlow.ql
+query: experimental/Likely Bugs/ArrayAccessProductFlow.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/array-access/test.cpp

@@ -1,13 +1,13 @@
 char *malloc(int size);
 
 void test1(int size) {
-    char *arr = malloc(size);
+    char *arr = malloc(size); // $ Source
     for (int i = 0; i < size; i++) {
         arr[i] = 0; // GOOD
     }
 
     for (int i = 0; i <= size; i++) {
-        arr[i] = i; // BAD
+        arr[i] = i; // $ Alert // BAD
     }
 }
 
@@ -18,7 +18,7 @@ typedef struct {
 
 array_t mk_array(int size) {
     array_t arr;
-    arr.p = malloc(size);
+    arr.p = malloc(size); // $ Source
     arr.size = size;
 
     return arr;
@@ -32,7 +32,7 @@ void test2(int size) {
     }
 
     for (int i = 0; i <= arr.size; i++) {
-        arr.p[i] = i; // BAD
+        arr.p[i] = i; // $ Alert // BAD
     }
 }
 
@@ -42,7 +42,7 @@ void test3_callee(array_t arr) {
     }
 
     for (int i = 0; i <= arr.size; i++) {
-        arr.p[i] = i; // BAD
+        arr.p[i] = i; // $ Alert // BAD
     }
 }
 
@@ -52,7 +52,7 @@ void test3(int size) {
 
 void test4(int size) {
     array_t arr;
-    arr.p = malloc(size);
+    arr.p = malloc(size); // $ Source
     arr.size = size;
 
     for (int i = 0; i < arr.size; i++) {
@@ -60,13 +60,13 @@ void test4(int size) {
     }
 
     for (int i = 0; i <= arr.size; i++) {
-        arr.p[i] = i; // BAD
+        arr.p[i] = i; // $ Alert // BAD
     }
 }
 
 array_t *mk_array_p(int size) {
     array_t *arr = (array_t*) malloc(sizeof(array_t));
-    arr->p = malloc(size);
+    arr->p = malloc(size); // $ Source
     arr->size = size;
 
     return arr;
@@ -80,7 +80,7 @@ void test5(int size) {
     }
 
     for (int i = 0; i <= arr->size; i++) {
-        arr->p[i] = i; // BAD
+        arr->p[i] = i; // $ Alert // BAD
     }
 }
 
@@ -90,7 +90,7 @@ void test6_callee(array_t *arr) {
     }
 
     for (int i = 0; i <= arr->size; i++) {
-        arr->p[i] = i; // BAD
+        arr->p[i] = i; // $ Alert // BAD
     }
 }
 
@@ -105,6 +105,6 @@ void test7(int size) {
     }
 
     for (char *p = arr; p <= arr + size; p++) {
-        *p = 0; // BAD [NOT DETECTED]
+        *p = 0; // $ MISSING: Alert // BAD [NOT DETECTED]
     }
 }

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/constant-size/ConstantSizeArrayOffByOne.qlref

@@ -1 +1,2 @@
-experimental/Security/CWE/CWE-193/ConstantSizeArrayOffByOne.ql
+query: experimental/Security/CWE/CWE-193/ConstantSizeArrayOffByOne.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/constant-size/test.cpp

@@ -32,60 +32,60 @@ void testOneArray(OneArray *arr) {
 
 void testBig(BigArray *arr) {
     arr->buf[MAX_SIZE-1] = 0; // GOOD
-    arr->buf[MAX_SIZE] = 0;   // BAD
-    arr->buf[MAX_SIZE+1] = 0; // BAD
+    arr->buf[MAX_SIZE] = 0;   // $ Alert // BAD
+    arr->buf[MAX_SIZE+1] = 0; // $ Alert // BAD
 
     for(int i = 0; i < MAX_SIZE; i++) {
         arr->buf[i] = 0; // GOOD
     }
-    
+
     for(int i = 0; i <= MAX_SIZE; i++) {
-        arr->buf[i] = 0; // BAD
+        arr->buf[i] = 0; // $ Alert // BAD
     }
 }
 
 void testFields(ArrayAndFields *arr) {
     arr->buf[MAX_SIZE-1] = 0; // GOOD
-    arr->buf[MAX_SIZE] = 0;   // BAD?
-    arr->buf[MAX_SIZE+1] = 0; // BAD?
+    arr->buf[MAX_SIZE] = 0;   // $ Alert // BAD?
+    arr->buf[MAX_SIZE+1] = 0; // $ Alert // BAD?
 
     for(int i = 0; i < MAX_SIZE; i++) {
         arr->buf[i] = 0; // GOOD
     }
-    
+
     for(int i = 0; i <= MAX_SIZE; i++) {
-        arr->buf[i] = 0; // BAD?
+        arr->buf[i] = 0; // $ Alert // BAD?
     }
 
     for(int i = 0; i < MAX_SIZE+2; i++) {
-        arr->buf[i] = 0; // BAD?
+        arr->buf[i] = 0; // $ Alert // BAD?
     }
     // is this different if it's a memcpy?
 }
 
-void assignThroughPointer(int *p) {
+void assignThroughPointer(int *p) { // $ Sink
     *p = 0; // ??? should the result go at a flow source?
 }
 
 void addToPointerAndAssign(int *p) {
     p[MAX_SIZE-1] = 0; // GOOD
-    p[MAX_SIZE] = 0; // BAD
+    p[MAX_SIZE] = 0; // $ Alert // BAD
 }
 
 void testInterproc(BigArray *arr) {
     assignThroughPointer(&arr->buf[MAX_SIZE-1]); // GOOD
-    assignThroughPointer(&arr->buf[MAX_SIZE]); // BAD
+    assignThroughPointer(&arr->buf[MAX_SIZE]); // $ Alert // BAD
 
-    addToPointerAndAssign(arr->buf);
+    addToPointerAndAssign(arr->buf); // $ Source
 }
 
 #define MAX_SIZE_BYTES 4096
 
 void testCharIndex(BigArray *arr) {
-    char *charBuf = (char*) arr->buf;
+    char *charBuf = (char*) arr->buf; // $ Source
 
     charBuf[MAX_SIZE_BYTES - 1] = 0; // GOOD
-    charBuf[MAX_SIZE_BYTES] = 0; // BAD
+    charBuf[MAX_SIZE_BYTES] = 0; // $ Alert // BAD
 }
 
 void testEqRefinement() {
@@ -125,7 +125,7 @@ void testStackAllocated() {
     char *arr[MAX_SIZE];
 
     for(int i = 0; i <= MAX_SIZE; i++) {
-        arr[i] = 0; // BAD
+        arr[i] = 0; // $ Alert // BAD
     }
 }
 
@@ -133,18 +133,18 @@ int strncmp(const char*, const char*, int);
 
 char testStrncmp2(char *arr) {
     if(strncmp(arr, "<test>", 6) == 0) {
-        arr += 6;
+        arr += 6; // $ Alert
     }
-    return *arr; // GOOD [FALSE POSITIVE]
+    return *arr; // $ SPURIOUS: Sink // GOOD [FALSE POSITIVE]
 }
 
 void testStrncmp1() {
     char asdf[5];
-    testStrncmp2(asdf);
+    testStrncmp2(asdf); // $ Source
 }
 
 void countdownBuf1(int **p) {
-  *--(*p) = 1; // GOOD [FALSE POSITIVE]
+  *--(*p) = 1; // $ SPURIOUS: Sink // GOOD [FALSE POSITIVE]
   *--(*p) = 2; // GOOD
   *--(*p) = 3; // GOOD
   *--(*p) = 4; // GOOD
@@ -153,7 +153,7 @@ void countdownBuf1(int **p) {
 void countdownBuf2() {
   int buf[4];
 
-  int *x = buf + 4;
+  int *x = buf + 4; // $ Alert
 
   countdownBuf1(&x);
 }
@@ -182,7 +182,7 @@ int countdownLength1(int *p, int len) {
 }
 
 int callCountdownLength() {
-    
+
     int buf[6];
 
     return countdownLength1(buf, 6);
@@ -192,7 +192,7 @@ int countdownLength2() {
     int buf[6];
     int len = 6;
     int *p = buf;
-    
+
     if(len % 8) {
         return -1;
     }
@@ -215,10 +215,10 @@ int countdownLength2() {
 
 void pointer_size_larger_than_array_element_size() {
     unsigned char buffer[100]; // getByteSize() = 100
-    int *ptr = (int *)buffer; // pai.getElementSize() will be sizeof(int) = 4 -> size = 25
+    int *ptr = (int *)buffer; // $ Source // pai.getElementSize() will be sizeof(int) = 4 -> size = 25
 
     ptr[24] = 0; // GOOD: writes bytes 96, 97, 98, 99
-    ptr[25] = 0; // BAD: writes bytes 100, 101, 102, 103
+    ptr[25] = 0; // $ Alert // BAD: writes bytes 100, 101, 102, 103
 }
 
 struct vec2 { int x, y; };
@@ -226,10 +226,10 @@ struct vec3 { int x, y, z; };
 
 void pointer_size_smaller_than_array_element_size_but_does_not_divide_it() {
     vec3 array[3]; // getByteSize() = 9 * sizeof(int)
-    vec2 *ptr = (vec2 *)array; // pai.getElementSize() will be 2 * sizeof(int) -> size = 4
+    vec2 *ptr = (vec2 *)array; // $ Source // pai.getElementSize() will be 2 * sizeof(int) -> size = 4
 
     ptr[3] = vec2{}; // GOOD: writes ints 6, 7
-    ptr[4] = vec2{}; // BAD: writes ints 8, 9
+    ptr[4] = vec2{}; // $ Alert // BAD: writes ints 8, 9
 }
 
 void pointer_size_larger_than_array_element_size_and_does_not_divide_it() {
@@ -258,7 +258,7 @@ void call_use(unsigned char* p, int n) {
     if(n == 3) {
         unsigned char x = p[0];
         unsigned char y = p[1];
-        unsigned char z = p[2]; // GOOD [FALSE POSITIVE]: `call_use(buffer2, 2)` won't reach this point.
+        unsigned char z = p[2]; // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE]: `call_use(buffer2, 2)` won't reach this point.
         use(x, y, z);
     }
 }
@@ -283,7 +283,7 @@ void test_call_use2() {
     call_call_use(buffer1,1);
 
     unsigned char buffer2[2];
-    call_call_use(buffer2,2);
+    call_call_use(buffer2,2); // $ Source
 
     unsigned char buffer3[3];
     call_call_use(buffer3,3);
@@ -296,7 +296,7 @@ int guardingCallee(int *arr, int size) {
 
     int sum;
     for (int i = 0; i < size; i++) {
-        sum += arr[i]; // GOOD [FALSE POSITIVE] - guarded by size
+        sum += arr[i]; // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] - guarded by size
     }
     return sum;
 }
@@ -304,9 +304,9 @@ int guardingCallee(int *arr, int size) {
 int guardingCaller() {
     int arr1[MAX_SIZE];
     guardingCallee(arr1, MAX_SIZE);
-    
+
     int arr2[10];
-    guardingCallee(arr2, 10);
+    guardingCallee(arr2, 10); // $ Source
 }
 
 // simplified md5 padding
@@ -319,10 +319,10 @@ void correlatedCondition(int num) {
             end = temp + 56;
         }
         else if (num < 64) {
-            end = temp + 64; // GOOD [FALSE POSITVE]
+            end = temp + 64; // $ SPURIOUS: Alert // GOOD [FALSE POSITVE]
         }
         char *temp2 = temp + num;
-        while(temp2 != end) {
+        while(temp2 != end) { // $ Sink
             *temp2 = 0;
             temp2++;
         }

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test1/ExposureSensitiveInformationUnauthorizedActor.qlref

@@ -1 +1,2 @@
-experimental/Security/CWE/CWE-200/ExposureSensitiveInformationUnauthorizedActor.ql
+query: experimental/Security/CWE/CWE-200/ExposureSensitiveInformationUnauthorizedActor.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test1/test.cpp

@@ -9,7 +9,7 @@ int main(int argc, char *argv[])
 {
   //umask(0022);
   FILE *fp;
-  fp = fopen("myFile.txt","w"); // BAD
+  fp = fopen("myFile.txt","w"); // $ Alert // BAD
   //chmod("myFile.txt",0644);
   fprintf(fp,"%s\n","data to file");
   fclose(fp);

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test2/ExposureSensitiveInformationUnauthorizedActor.qlref

@@ -1 +1,2 @@
-experimental/Security/CWE/CWE-200/ExposureSensitiveInformationUnauthorizedActor.ql
+query: experimental/Security/CWE/CWE-200/ExposureSensitiveInformationUnauthorizedActor.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test3/ExposureSensitiveInformationUnauthorizedActor.qlref

@@ -1 +1,2 @@
-experimental/Security/CWE/CWE-200/ExposureSensitiveInformationUnauthorizedActor.ql
+query: experimental/Security/CWE/CWE-200/ExposureSensitiveInformationUnauthorizedActor.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test3/test.cpp

@@ -10,8 +10,8 @@ int main(int argc, char *argv[])
 {
   FILE *fp;
   char buf[128];
-  fp = fopen("myFile.txt","r+"); // BAD [NOT DETECTED]
-  fgets(buf,128,fp); 
+  fp = fopen("myFile.txt","r+"); // $ MISSING: Alert // BAD [NOT DETECTED]
+  fgets(buf,128,fp);
   fprintf(fp,"%s\n","data to file");
   fclose(fp);
   return 0;

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-243/semmle/tests/IncorrectChangingWorkingDirectory.qlref

@@ -1 +1,2 @@
-experimental/Security/CWE/CWE-243/IncorrectChangingWorkingDirectory.ql
+query: experimental/Security/CWE/CWE-243/IncorrectChangingWorkingDirectory.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-243/semmle/tests/test.cpp

@@ -9,13 +9,13 @@ int chdir(char *path);
 void exit(int status);
 
 int funTest1(){
-  if (chroot("/myFold/myTmp") == -1) {  // BAD
+  if (chroot("/myFold/myTmp") == -1) {  // $ Alert // BAD
     exit(-1);
   }
   return 0;
 }
 
-int funTest2(){  
+int funTest2(){
   if (chdir("/myFold/myTmp") == -1) { // GOOD
     exit(-1);
   }
@@ -25,8 +25,8 @@ int funTest2(){
   return 0;
 }
 
-int funTest3(){  
-  chdir("/myFold/myTmp"); // BAD
+int funTest3(){
+  chdir("/myFold/myTmp"); // $ Alert // BAD
   return 0;
 }
 int main(int argc, char *argv[])

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-266/semmle/tests/IncorrectPrivilegeAssignment.qlref

@@ -1 +1,2 @@
-experimental/Security/CWE/CWE-266/IncorrectPrivilegeAssignment.ql
+query: experimental/Security/CWE/CWE-266/IncorrectPrivilegeAssignment.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-266/semmle/tests/test.cpp

@@ -6,7 +6,7 @@ int fclose(FILE *stream);
 
 void funcTest1()
 {
-  umask(0666); // BAD
+  umask(0666); // $ Alert // BAD
   FILE *fe;
   fe = fopen("myFile.txt", "wt");
   fclose(fe);
@@ -27,7 +27,7 @@ void funcTest2(int mode)
   FILE *fe;
   fe = fopen("myFile.txt", "wt");
   fclose(fe);
-  chmod("myFile.txt",0555-mode); // BAD
+  chmod("myFile.txt",0555-mode); // $ Alert // BAD
 }
 
 void funcTest2g(int mode)

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-285/PamAuthorization.qlref

@@ -1 +1,2 @@
-experimental/Security/CWE/CWE-285/PamAuthorization.ql
+query: experimental/Security/CWE/CWE-285/PamAuthorization.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-285/test.cpp

@@ -26,7 +26,7 @@ bool PamAuthBad(const std::string &username_in,
         return false;
     }
 
-    err = pam_authenticate(pamh, 0);
+    err = pam_authenticate(pamh, 0); // $ Alert
     if (err != PAM_SUCCESS)
         return err;
 

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-295/CurlSSL.cpp

@@ -7,7 +7,7 @@ namespace std{
 		CURLOPT_URL,
 		CURLOPT_SSL_VERIFYHOST,
 		CURLOPT_SSL_VERIFYPEER
-	}; 
+	};
 
 	CURL *curl_easy_init();
 	void curl_easy_cleanup(CURL *handle);
@@ -22,8 +22,8 @@ char host[] = "codeql.com";
 
 void bad(void) {
 	std::unique_ptr<CURL> curl = std::unique_ptr<CURL>(curl_easy_init());
-	curl_easy_setopt(curl.get(), CURLOPT_SSL_VERIFYPEER, 0);
-	curl_easy_setopt(curl.get(), CURLOPT_SSL_VERIFYHOST, 0); 
+	curl_easy_setopt(curl.get(), CURLOPT_SSL_VERIFYPEER, 0); // $ Alert
+	curl_easy_setopt(curl.get(), CURLOPT_SSL_VERIFYHOST, 0); // $ Alert
   	curl_easy_setopt(curl.get(), CURLOPT_URL, host);
   	curl_easy_perform(curl.get());
 }
@@ -31,7 +31,7 @@ void bad(void) {
 void good(void) {
 	std::unique_ptr<CURL> curl = std::unique_ptr<CURL>(curl_easy_init());
 	curl_easy_setopt(curl.get(), CURLOPT_SSL_VERIFYPEER, 2);
-	curl_easy_setopt(curl.get(), CURLOPT_SSL_VERIFYHOST, 2); 
+	curl_easy_setopt(curl.get(), CURLOPT_SSL_VERIFYHOST, 2);
   	curl_easy_setopt(curl.get(), CURLOPT_URL, host);
   	curl_easy_perform(curl.get());
 }
@@ -40,4 +40,3 @@ int main(int c, char** argv){
 	bad();
   	good();
 }
-

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-295/CurlSSL.qlref

@@ -1 +1,2 @@
-experimental/Security/CWE/CWE-295/CurlSSL.ql
+query: experimental/Security/CWE/CWE-295/CurlSSL.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-359/semmle/tests/PrivateCleartextWrite.qlref

@@ -1 +1,2 @@
-experimental/Security/CWE/CWE-359/PrivateCleartextWrite.ql
+query: experimental/Security/CWE/CWE-359/PrivateCleartextWrite.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-359/semmle/tests/test.cpp

@@ -54,7 +54,7 @@ void file()
   FILE *file;
 
   // BAD: write zipcode to file in cleartext
-  fputs(theZipcode, file);
+  fputs(theZipcode, file); // $ Alert
 
   // GOOD: encrypt first
   char *encrypted = encrypt(theZipcode);
@@ -71,15 +71,15 @@ int main(int argc, char **argv)
   char *buff4;
 
   // BAD: write medical to buffer in cleartext
-  sprintf(buff1, "%s", medical);
+  sprintf(buff1, "%s", medical); // $ Alert Source
 
   // BAD: write medical to buffer in cleartext
-  char *temp = medical;
-  sprintf(buff2, "%s", temp);
+  char *temp = medical; // $ Source
+  sprintf(buff2, "%s", temp); // $ Alert
 
   // BAD: write medical to buffer in cleartext
-  char *buff5 = func(medical);
-  sprintf(buff3, "%s", buff5);
+  char *buff5 = func(medical); // $ Source
+  sprintf(buff3, "%s", buff5); // $ Alert
 
   char *buff6 = encrypt(medical);
   // GOOD: encrypt first
@@ -93,10 +93,10 @@ void stream()
   ofstream mystream;
 
   // BAD: write zipcode to file in cleartext
-  mystream << "the zipcode is: " << theZipcode;
+  mystream << "the zipcode is: " << theZipcode; // $ Alert Source
 
   // BAD: write zipcode to file in cleartext
-  (mystream << "the zipcode is: ").write(theZipcode, strlen(theZipcode));
+  (mystream << "the zipcode is: ").write(theZipcode, strlen(theZipcode)); // $ Alert
 
   // GOOD: encrypt first
   char *encrypted = encrypt(theZipcode);

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-369/semmle/tests/DivideByZeroUsingReturnValue.qlref

@@ -1 +1,2 @@
-experimental/Security/CWE/CWE-369/DivideByZeroUsingReturnValue.ql
+query: experimental/Security/CWE/CWE-369/DivideByZeroUsingReturnValue.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-369/semmle/tests/test.cpp

@@ -44,13 +44,13 @@ int getSize2(int type) {
 
 int badTestf1(int type, int met) {
   int is = getSize(type);
-  if (met == 1) return 123 / is; // BAD
-  else return 123 / getSize2(type); // BAD
+  if (met == 1) return 123 / is; // $ Alert // BAD
+  else return 123 / getSize2(type); // $ Alert // BAD
 }
 int badTestf2(int type) {
   int is;
   is = getSize(type);
-  return 123 / is; // BAD
+  return 123 / is; // $ Alert // BAD
 }
 
 int badTestf3(int type, int met) {
@@ -58,31 +58,31 @@ int badTestf3(int type, int met) {
   is = getSize(type);
   switch (met) {
   case 1:
-    if (is >= 0) return 123 / is; // BAD [NOT DETECTED]
+    if (is >= 0) return 123 / is; // $ MISSING: Alert // BAD [NOT DETECTED]
   case 2:
-    if (0 == is) return 123 / is; // BAD [NOT DETECTED]
+    if (0 == is) return 123 / is; // $ MISSING: Alert // BAD [NOT DETECTED]
   case 3:
-    if (!is & 123 / is) // BAD
+    if (!is & 123 / is) // $ Alert // BAD
       return 123;
   case 4:
-    if (!is | 123 / is) // BAD
+    if (!is | 123 / is) // $ Alert // BAD
       return 123;
   case 5:
-    if (123 / is || !is) // BAD 
+    if (123 / is || !is) // $ Alert // BAD
       return 123;
   case 6:
-    if (123 / is && !is) // BAD
+    if (123 / is && !is) // $ Alert // BAD
       return 123;
   case 7:
-    if (!is) return 123 / is; // BAD
+    if (!is) return 123 / is; // $ Alert // BAD
   case 8:
-    if (is > -1) return 123 / is; // BAD
+    if (is > -1) return 123 / is; // $ Alert // BAD
   case 9:
-    if (is < 2) return 123 / is; // BAD
+    if (is < 2) return 123 / is; // $ Alert // BAD
   }
   if (is != 0) return -1;
   if (is == 0) type += 1;
-  return 123 / is; // BAD [NOT DETECTED]
+  return 123 / is; // $ MISSING: Alert // BAD [NOT DETECTED]
 }
 
 int goodTestf3(int type, int met) {
@@ -92,7 +92,7 @@ int goodTestf3(int type, int met) {
   case 1:
     if (is < 0) return 123 / is; // GOOD
   case 2:
-    if (!is && 123 / is) // GOOD 
+    if (!is && 123 / is) // GOOD
       return 123;
   case 3:
     if (!is || 123 / is) // GOOD
@@ -112,10 +112,10 @@ int goodTestf3a(int type, int met) {
     if (is < 0)
       return 123 / is; // GOOD
   case 2:
-    if (!is && 123 / is) // GOOD 
+    if (!is && 123 / is) // GOOD
       return 123;
   case 3:
-    if (!is || 123 / is) // GOOD 
+    if (!is || 123 / is) // GOOD
       return 123;
   }
   return 1;
@@ -125,20 +125,20 @@ int badTestf4(int type) {
   int is = getSize(type);
   int d;
   d = type * is;
-  return 123 / d; // BAD
+  return 123 / d; // $ Alert // BAD
 }
 
 int badTestf5(int type) {
   int is = getSize(type);
   int d;
   d = is / type;
-  return 123 / d; // BAD
+  return 123 / d; // $ Alert // BAD
 }
 int badTestf6(int type) {
   int is = getSize(type);
   int d;
   d = is / type;
-  return type * 123 / d; // BAD
+  return type * 123 / d; // $ Alert // BAD
 }
 
 int badTestf7(int type, int met) {
@@ -150,7 +150,7 @@ int badTestf7(int type, int met) {
       return 123 / is; // GOOD
   }
   quit:
-    return 123 / is; // BAD
+    return 123 / is; // $ Alert // BAD
 }
 
 int goodTestf7(int type, int met) {
@@ -169,8 +169,8 @@ int goodTestf7(int type, int met) {
 
 int badTestf8(int type) {
   int is = getSize(type);
-  type /= is; // BAD
-  type %= is; // BAD
+  type /= is; // $ Alert // BAD
+  type %= is; // $ Alert // BAD
   return type;
 }
 
@@ -184,7 +184,7 @@ float getSizeFloat(float type) {
 }
 float badTestf9(float type) {
   float is = getSizeFloat(type);
-  return 123 / is; // BAD
+  return 123 / is; // $ Alert // BAD
 }
 float goodTestf9(float type) {
   float is = getSizeFloat(type);
@@ -196,18 +196,18 @@ int badTestf10(int type) {
   int out = type;
   int is = getSize(type);
   if (is > -2) {
-    out /= 123 / (is + 1); // BAD
+    out /= 123 / (is + 1); // $ Alert // BAD
   }
   if (is > 0) {
-    return 123 / (is - 1); // BAD
+    return 123 / (is - 1); // $ Alert // BAD
   }
   if (is <= 0) return 0;
-  return 123 / (is - 1); // BAD
+  return 123 / (is - 1); // $ Alert // BAD
   return 0;
 }
 int badTestf11(int type) {
   int is = getSize(type);
-  return 123 / (is - 3); // BAD
+  return 123 / (is - 3); // $ Alert // BAD
 }
 
 int goodTestf11(int type) {
@@ -223,7 +223,7 @@ int badTestf12(FILE * f) {
   int a;
   int ret = -1;
   a = getc(f);
-  if (a == 0) ret = 123 / a; // BAD [NOT DETECTED]
+  if (a == 0) ret = 123 / a; // $ MISSING: Alert // BAD [NOT DETECTED]
   return ret;
 }
 
@@ -255,14 +255,14 @@ int badMySubDiv(int type, int is) {
 
 void badTestf13(int type) {
   int is = getSize(type);
-  badMyDiv(type, is); // BAD
-  badMyDiv(type, is - 2); // BAD
-  badMySubDiv(type, is); // BAD
+  badMyDiv(type, is); // $ Alert // BAD
+  badMyDiv(type, is - 2); // $ Alert // BAD
+  badMySubDiv(type, is); // $ Alert // BAD
   goodMyDiv(type, is); // GOOD
   if (is < 5)
-    badMySubDiv(type, is); // BAD
+    badMySubDiv(type, is); // $ Alert // BAD
   if (is < 0)
-    badMySubDiv(type, is); // BAD [NOT DETECTED]
+    badMySubDiv(type, is); // $ MISSING: Alert // BAD [NOT DETECTED]
   if (is > 5)
     badMySubDiv(type, is); // GOOD
   if (is == 0)
@@ -270,9 +270,9 @@ void badTestf13(int type) {
   if (is > 0)
     badMyDiv(type, is); // GOOD
   if (is < 5)
-    badMyDiv(type, is - 3); // BAD
+    badMyDiv(type, is - 3); // $ Alert // BAD
   if (is < 0)
-    badMyDiv(type, is + 1); // BAD
+    badMyDiv(type, is + 1); // $ Alert // BAD
   if (is > 5)
     badMyDiv(type, is - 3); // GOOD
 }

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-377/semmle/tests/InsecureTemporaryFile.qlref

@@ -1 +1,2 @@
-experimental/Security/CWE/CWE-377/InsecureTemporaryFile.ql
+query: experimental/Security/CWE/CWE-377/InsecureTemporaryFile.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-377/semmle/tests/test.cpp

@@ -13,7 +13,7 @@ int fclose(FILE *stream);
 int funcTest1()
 {
   FILE *fp;
-  char *filename = tmpnam(NULL); // BAD
+  char *filename = tmpnam(NULL); // $ Alert // BAD
   fp = fopen(filename,"w");
   fprintf(fp,"%s\n","data to file");
   fclose(fp);
@@ -39,7 +39,7 @@ int funcTest3()
   FILE *fp;
   char filename[80];
   strcat(filename, "/tmp/tmp.name");
-  fp = fopen(filename,"w"); // BAD [NOT DETECTED]
+  fp = fopen(filename,"w"); // $ MISSING: Alert // BAD [NOT DETECTED]
   fprintf(fp,"%s\n","data to file");
   fclose(fp);
   return 0;

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/MemoryLeakOnFailedCallToRealloc.qlref

@@ -1 +1,2 @@
-experimental/Security/CWE/CWE-401/MemoryLeakOnFailedCallToRealloc.ql
+query: experimental/Security/CWE/CWE-401/MemoryLeakOnFailedCallToRealloc.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/test.c

@@ -31,7 +31,7 @@ unsigned char * badResize_0(unsigned char * buffer,size_t currentSize,size_t new
 	// BAD: on unsuccessful call to realloc, we will lose a pointer to a valid memory block
 	if (currentSize < newSize)
 	{
-		buffer = (unsigned char *)realloc(buffer, newSize);
+		buffer = (unsigned char *)realloc(buffer, newSize); // $ Alert
 	}
 	return buffer;
 }
@@ -60,7 +60,7 @@ unsigned char * badResize_1_0(unsigned char * buffer,size_t currentSize,size_t n
 	// BAD: on unsuccessful call to realloc, we will lose a pointer to a valid memory block
 	if (currentSize < newSize)
 	{
-		buffer = (unsigned char *)realloc(buffer, newSize);
+		buffer = (unsigned char *)realloc(buffer, newSize); // $ Alert
 	}
 	return buffer;
 }
@@ -136,7 +136,7 @@ unsigned char * badResize_1_1(unsigned char * buffer,size_t currentSize,size_t n
 	// BAD: on unsuccessful call to realloc, we will lose a pointer to a valid memory block
 	if (currentSize < newSize)
 	{
-		buffer = (unsigned char *)realloc(buffer, newSize);
+		buffer = (unsigned char *)realloc(buffer, newSize); // $ Alert
 	}
 	if(!buffer)
 		aFakeFailed_1(1, 1);
@@ -183,7 +183,7 @@ unsigned char * badResize_2_0(unsigned char * buffer,size_t currentSize,size_t n
 	assert(buffer!=0);
 	if (currentSize < newSize)
 	{
-		buffer = (unsigned char *)realloc(buffer, newSize);
+		buffer = (unsigned char *)realloc(buffer, newSize); // $ Alert
 	}
 	return buffer;
 }
@@ -279,7 +279,7 @@ unsigned char *goodResize_3_1(unsigned char *buffer, size_t currentSize, size_t
 	unsigned char *tmp = buffer;
 	if (currentSize < newSize)
 	{
-		buffer = (unsigned char *)realloc(buffer, newSize);
+		buffer = (unsigned char *)realloc(buffer, newSize); // $ Alert
 		if (buffer == NULL)
 		{
 			free(tmp);
@@ -296,7 +296,7 @@ unsigned char *goodResize_3_2(unsigned char *buffer, size_t currentSize, size_t
 	unsigned char *tmp = buffer;
 	if (currentSize < newSize)
 	{
-		tmp = (unsigned char *)realloc(tmp, newSize);
+		tmp = (unsigned char *)realloc(tmp, newSize); // $ Alert
 		if (tmp != 0)
 		{
 			buffer = tmp;
@@ -325,7 +325,7 @@ unsigned char * badResize_5_2(unsigned char *buffer, size_t currentSize, size_t
 	// BAD: on unsuccessful call to realloc, we will lose a pointer to a valid memory block
 	if (currentSize < newSize)
 	{
-		buffer = (unsigned char *)realloc(buffer, newSize);
+		buffer = (unsigned char *)realloc(buffer, newSize); // $ Alert
 	}
 	if (cond)
 	{
@@ -339,7 +339,7 @@ unsigned char * badResize_5_1(unsigned char *buffer, size_t currentSize, size_t
 	// BAD: on unsuccessful call to realloc, we will lose a pointer to a valid memory block
 	if (currentSize < newSize)
 	{
-		buffer = (unsigned char *)realloc(buffer, newSize);
+		buffer = (unsigned char *)realloc(buffer, newSize); // $ Alert
 		assert(cond); // irrelevant
 	}
 	return buffer;

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/DecompressionBombs.qlref

@@ -1 +1,2 @@
-experimental/Security/CWE/CWE-409/DecompressionBombs.ql
+query: experimental/Security/CWE/CWE-409/DecompressionBombs.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/brotliTest.cpp

@@ -15,12 +15,12 @@ BrotliDecoderResult BrotliDecoderDecompressStream(
 void brotli_test(int argc, const char **argv) {
     uint8_t output[1024];
     size_t output_size = sizeof(output);
-    BrotliDecoderDecompress(1024, (uint8_t *) argv[2], &output_size, output); // BAD
+    BrotliDecoderDecompress(1024, (uint8_t *) argv[2], &output_size, output); // $ Alert // BAD
 
     size_t input_size = 1024;
     const uint8_t *input_p = (const uint8_t*)argv[2];
     uint8_t *output_p = output;
     size_t out_size;
-    BrotliDecoderDecompressStream(0, &input_size, &input_p, &output_size, // BAD
+    BrotliDecoderDecompressStream(0, &input_size, &input_p, &output_size, // $ Alert // BAD
                                   &output_p, &out_size);
 }

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/libarchiveTests.cpp

@@ -19,7 +19,7 @@ static int read_data(archive *ar) {
         size_t size;
         la_int64_t offset;
 
-        int r = archive_read_data_block(ar, &buff, &size, &offset); // BAD
+        int r = archive_read_data_block(ar, &buff, &size, &offset); // $ Alert // BAD
         if (r == ARCHIVE_EOF)
             return ARCHIVE_OK;
         if (r < ARCHIVE_OK)

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/main.cpp

@@ -4,7 +4,7 @@ void minizip_test(int argc, const char **argv);
 void zlib_test(int argc, const char **argv);
 void zstd_test(int argc, const char **argv);
 
-int main(int argc, const char **argv) {
+int main(int argc, const char **argv) { // $ Source
     brotli_test(argc, argv);
     libarchive_test(argc, argv);
     minizip_test(argc, argv);

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/minizipTest.cpp

@@ -14,7 +14,7 @@ void minizip_test(int argc, const char **argv) {
     int32_t bytes_read;
     char buf[4096];
     while(true) {
-        bytes_read = mz_zip_entry_read(zip_handle, (char *) argv[1], sizeof(buf)); // BAD
+        bytes_read = mz_zip_entry_read(zip_handle, (char *) argv[1], sizeof(buf)); // $ Alert // BAD
         if (bytes_read <= 0) {
             break;
         }
@@ -23,7 +23,7 @@ void minizip_test(int argc, const char **argv) {
     void *zip_reader = mz_zip_reader_create();
     mz_zip_reader_open_file(zip_reader, argv[1]);
     mz_zip_reader_goto_first_entry(zip_reader);
-    mz_zip_reader_entry_save(zip_reader, 0, 0); // BAD
+    mz_zip_reader_entry_save(zip_reader, 0, 0); // $ Alert // BAD
 
-    UnzOpen(argv[3]); // BAD
+    UnzOpen(argv[3]); // $ Alert // BAD
 }

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/zlibTest.cpp

@@ -22,7 +22,7 @@ void UnsafeInflate(char *input) {
     infstream.next_out = output; // output char array
 
     inflateInit(&infstream);
-    inflate(&infstream, 0); // BAD
+    inflate(&infstream, 0); // $ Alert // BAD
 }
 
 
@@ -38,7 +38,7 @@ void UnsafeGzread(char *fileName) {
     gzFile inFileZ = gzopen(fileName, "rb");
     unsigned char unzipBuffer[8192];
     while (true) {
-        if (gzread(inFileZ, unzipBuffer, 8192) <= 0) { // BAD
+        if (gzread(inFileZ, unzipBuffer, 8192) <= 0) { // $ Alert // BAD
             break;
         }
     }
@@ -48,7 +48,7 @@ void UnsafeGzfread(char *fileName) {
     gzFile inFileZ = gzopen(fileName, "rb");
     while (true) {
         char buffer[1000];
-        if (!gzfread(buffer, 999, 1, inFileZ)) { // BAD
+        if (!gzfread(buffer, 999, 1, inFileZ)) { // $ Alert // BAD
             break;
         }
     }
@@ -59,7 +59,7 @@ void UnsafeGzgets(char *fileName) {
     char *buffer = new char[4000000000];
     char *result;
     while (true) {
-        result = gzgets(inFileZ, buffer, 1000000000); // BAD
+        result = gzgets(inFileZ, buffer, 1000000000); // $ Alert // BAD
         if (result == nullptr) {
             break;
         }
@@ -74,7 +74,7 @@ void InflateString(char *input) {
     uLong source_length = 500;
     uLong destination_length = sizeof(output);
 
-    uncompress(output, &destination_length, (Bytef *) input, source_length); // BAD
+    uncompress(output, &destination_length, (Bytef *) input, source_length); // $ Alert // BAD
 }
 
 void zlib_test(int argc, char **argv) {

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/zstdTest.cpp

@@ -36,7 +36,7 @@ void zstd_test(int argc, const char **argv) {
         ZSTD_inBuffer input = {buffIn, read, 0};
         while (input.pos < input.size) {
             ZSTD_outBuffer output = {buffOut, buffOutSize, 0};
-            size_t const ret = ZSTD_decompressStream(dctx, &output, &input); // BAD  
+            size_t const ret = ZSTD_decompressStream(dctx, &output, &input); // $ Alert // BAD
             CHECK_ZSTD(ret);
         }
     }

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-415/semmle/tests/DoubleFree.qlref

@@ -1 +1,2 @@
-experimental/Security/CWE/CWE-415/DoubleFree.ql
+query: experimental/Security/CWE/CWE-415/DoubleFree.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-415/semmle/tests/test.c

@@ -8,14 +8,14 @@ void workFunction_0(char *s) {
   char *buf;
   buf = (char *) malloc(intSize);
   free(buf); // GOOD
-  if(buf) free(buf); // BAD
+  if(buf) free(buf); // $ Alert // BAD
 }
 void workFunction_1(char *s) {
   int intSize = 10;
   char *buf;
   buf = (char *) malloc(intSize);
   free(buf); // GOOD
-  free(buf); // BAD
+  free(buf); // $ Alert // BAD
 }
 void workFunction_2(char *s) {
   int intSize = 10;
@@ -54,7 +54,7 @@ void workFunction_5(char *s, int intFlag) {
   if(intFlag) {
     free(buf); // GOOD
   }
-  free(buf); // BAD
+  free(buf); // $ Alert // BAD
 }
 void workFunction_6(char *s, int intFlag) {
   int intSize = 10;
@@ -75,7 +75,7 @@ void workFunction_7(char *s) {
   char *buf1;
   buf = (char *) malloc(intSize);
   buf1 = (char *) realloc(buf,intSize*4);
-  free(buf); // BAD
+  free(buf); // $ Alert // BAD
 }
 void workFunction_8(char *s) {
   int intSize = 10;

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-476/semmle/tests/DangerousUseOfExceptionBlocks.qlref

@@ -1 +1,2 @@
-experimental/Security/CWE/CWE-476/DangerousUseOfExceptionBlocks.ql
+query: experimental/Security/CWE/CWE-476/DangerousUseOfExceptionBlocks.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-476/semmle/tests/test.cpp

@@ -68,7 +68,7 @@ void funcWork1b() {
     }
     delete [] bufMyData;
 
-  }
+  } // $ Alert
 }
 
 void funcWork1() {
@@ -97,7 +97,7 @@ void funcWork1() {
     }
     delete [] bufMyData;
 
-  }
+  } // $ Alert
 }
 
 void funcWork2() {
@@ -125,7 +125,7 @@ void funcWork2() {
     }
     delete [] bufMyData;
 
-  }
+  } // $ Alert
 }
 void funcWork3() {
   int a;
@@ -148,7 +148,7 @@ void funcWork3() {
     }
     delete [] bufMyData;
 
-  }
+  } // $ Alert
 }
 
 
@@ -180,7 +180,7 @@ void funcWork4b() {
   catch (...) 
   {
     delete valData; // BAD
-  }
+  } // $ Alert
 }
 void funcWork5() {
   int a;
@@ -218,7 +218,7 @@ void funcWork5b() {
   catch (...) 
   {
         delete valData; // BAD
-  }
+  } // $ Alert
 }
 void funcWork6() {
   int a;

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-561/semmle/tests/FindIncorrectlyUsedSwitch.qlref

@@ -1 +1,2 @@
-experimental/Security/CWE/CWE-561/FindIncorrectlyUsedSwitch.ql
+query: experimental/Security/CWE/CWE-561/FindIncorrectlyUsedSwitch.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-561/semmle/tests/test.c

@@ -25,7 +25,7 @@ void testFunction(char c1,int i1)
     case 9:
       break;
   dafault:
-  }
+  } // $ Alert
 
   switch(c1){ // BAD
       c1=c1*2;
@@ -35,7 +35,7 @@ void testFunction(char c1,int i1)
       break;
     case 9:
       break;
-  }
+  } // $ Alert
 
   if((c1<6)&&(c1>0))
   switch(c1){ // BAD
@@ -47,7 +47,7 @@ void testFunction(char c1,int i1)
       break;
     case 1:
       break;
-  }
+  } // $ Alert
 
   if((c1<6)&&(c1>0))
   switch(c1){ // BAD
@@ -55,6 +55,6 @@ void testFunction(char c1,int i1)
       break;
     case 1:
       break;
-  }
+  } // $ Alert
   
 }

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-670/semmle/tests/DangerousUseSSL_shutdown.qlref

@@ -1 +1,2 @@
-experimental/Security/CWE/CWE-670/DangerousUseSSL_shutdown.ql
+query: experimental/Security/CWE/CWE-670/DangerousUseSSL_shutdown.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-670/semmle/tests/test.cpp

@@ -42,7 +42,7 @@ int gootTest2(SSL *ssl)
 int badTest1(SSL *ssl)
 {
   int ret;
-    switch ((ret = SSL_shutdown(ssl))) {
+    switch ((ret = SSL_shutdown(ssl))) { // $ Alert
     case 1:
       break;
     case 0:
@@ -58,7 +58,7 @@ int badTest1(SSL *ssl)
 int badTest2(SSL *ssl)
 {
   int ret;
-    ret = SSL_shutdown(ssl);
+    ret = SSL_shutdown(ssl); // $ Alert
     switch (ret) {
     case 1:
       break;

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-675/semmle/tests/DoubleRelease.qlref

@@ -1 +1,2 @@
-experimental/Security/CWE/CWE-675/DoubleRelease.ql
+query: experimental/Security/CWE/CWE-675/DoubleRelease.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-675/semmle/tests/test.cpp

@@ -6,7 +6,7 @@ extern FILE * fe;
 void test1()
 {
   FILE *f;
-  
+
   f = fopen("myFile.txt", "wt");
   fclose(f); // GOOD
   f = NULL;
@@ -15,9 +15,9 @@ void test1()
 void test2()
 {
   FILE *f;
-	
+
   f = fopen("myFile.txt", "wt");
-  fclose(f); // BAD
+  fclose(f); // $ Alert // BAD
   fclose(f);
 }
 
@@ -25,17 +25,17 @@ void test3()
 {
   FILE *f;
   FILE *g;
-	
+
   f = fopen("myFile.txt", "wt");
   g = f;
-  fclose(f); // BAD
+  fclose(f); // $ Alert // BAD
   fclose(g);
 }
 
 int fGtest4_1()
 {
-  fe = fopen("myFile.txt", "wt"); 
-  fclose(fe); // BAD
+  fe = fopen("myFile.txt", "wt");
+  fclose(fe); // $ Alert // BAD
   return -1;
 }
 
@@ -46,7 +46,7 @@ int fGtest4_2()
 }
 
 void Gtest4()
-{   
+{
   fGtest4_1();
   fGtest4_2();
 }
@@ -76,7 +76,7 @@ int main(int argc, char *argv[])
   test1();
   test2();
   test3();
-  
+
   Gtest4();
   Gtest5();
   return 0;

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementAfterRefactoringTheCode.qlref

@@ -1 +1,2 @@
-experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementAfterRefactoringTheCode.ql
+query: experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementAfterRefactoringTheCode.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementWhenUsingBitOperations.qlref

@@ -1 +1,2 @@
-experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.ql
+query: experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/test.c

@@ -5,25 +5,25 @@ void workFunction_0(char *s) {
   int intSize;
   char buf[80];
   if(intSize>0 && intSize<80 && memset(buf,0,intSize)) return; // GOOD
-  if(intSize>0 & intSize<80 & memset(buf,0,intSize)) return; // BAD
+  if(intSize>0 & intSize<80 & memset(buf,0,intSize)) return; // $ Alert[cpp/errors-when-using-bit-operations] // BAD
   if(intSize>0 && tmpFunction()) return;
-  if(intSize<0 & tmpFunction()) return; // BAD
+  if(intSize<0 & tmpFunction()) return; // $ Alert[cpp/errors-when-using-bit-operations] // BAD
 }
 void workFunction_1(char *s) {
   int intA,intB;
 
-  if(intA + intB) return; // BAD
+  if(intA + intB) return; // $ Alert[cpp/errors-after-refactoring] // BAD
   if(intA + intB>4) return; // GOOD
-  if(intA>0 && (intA + intB)) return; // BAD
+  if(intA>0 && (intA + intB)) return; // $ Alert[cpp/errors-after-refactoring] // BAD
   while(intA>0)
   {
     if(intB - intA<10) break;
     intA--;
-  }while(intA>0); // BAD
+  }while(intA>0); // $ Alert[cpp/errors-after-refactoring] // BAD
   for(intA=100; intA>0; intA--)
   {
     if(intB - intA<10) break;
-  }while(intA>0); // BAD
+  }while(intA>0); // $ Alert[cpp/errors-after-refactoring] // BAD
   while(intA>0)
   {
     if(intB - intA<10) break;

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-703/semmle/tests/FindIncorrectlyUsedExceptions.qlref

@@ -1 +1,2 @@
-experimental/Security/CWE/CWE-703/FindIncorrectlyUsedExceptions.ql
+query: experimental/Security/CWE/CWE-703/FindIncorrectlyUsedExceptions.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-703/semmle/tests/test.cpp

@@ -32,13 +32,13 @@ void funcTest2()
 
 void funcTest3()
 {
-  std::runtime_error("msg error"); // BAD
+  std::runtime_error("msg error"); // $ Alert // BAD
   throw std::runtime_error("msg error"); // GOOD
 }
 
 void TestFunc()
 {
-  funcTest1();
-  DllMain();
+  funcTest1(); // $ Alert
+  DllMain(); // $ Alert
   funcTest2();
 }

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-754/semmle/tests/ImproperCheckReturnValueScanf.qlref

@@ -1 +1,2 @@
-experimental/Security/CWE/CWE-754/ImproperCheckReturnValueScanf.ql
+query: experimental/Security/CWE/CWE-754/ImproperCheckReturnValueScanf.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-754/semmle/tests/test.cpp

@@ -49,9 +49,9 @@ int functionWork1b(int retIndex) {
   char a[10];
   int b;
   int *p = &b;
-  scanf("%i", &i); // BAD
-  scanf("%s", a); // BAD
-  scanf("%i", p); // BAD
+  scanf("%i", &i); // $ Alert // BAD
+  scanf("%s", a); // $ Alert // BAD
+  scanf("%i", p); // $ Alert // BAD
   if(retIndex == 0)
     return (int)*a;
   if(retIndex == 1)
@@ -60,7 +60,7 @@ int functionWork1b(int retIndex) {
 }
 int functionWork1_() {
   int i;
-  scanf("%i",&i); // BAD [NOT DETECTED]
+  scanf("%i",&i); // $ MISSING: Alert // BAD [NOT DETECTED]
   if(i<10)
     return -1;
   return i;
@@ -102,9 +102,9 @@ int functionWork2b() {
   char a[10];
   int b;
   int *p = &b;
-  scanf("%i", &i); // BAD
-  scanf("%s", a); // BAD
-  scanf("%i", p); // BAD
+  scanf("%i", &i); // $ Alert // BAD
+  scanf("%s", a); // $ Alert // BAD
+  scanf("%i", p); // $ Alert // BAD
   globalVal = i;
   globalVala = a;
   globalValp = p;
@@ -112,12 +112,12 @@ int functionWork2b() {
 }
 int functionWork2b_() {
   char a[10];
-  scanf("%s", a); // BAD
+  scanf("%s", a); // $ Alert // BAD
   globalVala2 = a[0];
   return 0;
 }
 int functionWork3b(int * i) {
-  scanf("%i", i); // BAD
+  scanf("%i", i); // $ Alert // BAD
   return 0;
 }
 int functionWork3() {

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-758/semmle/tests/UndefinedOrImplementationDefinedBehavior.qlref

@@ -1 +1,2 @@
-experimental/Security/CWE/CWE-758/UndefinedOrImplementationDefinedBehavior.ql
+query: experimental/Security/CWE/CWE-758/UndefinedOrImplementationDefinedBehavior.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-758/semmle/tests/test.c

@@ -10,10 +10,10 @@ char tmpFunction2(char * buf)
 }
 void workFunction_0(char *s, char * buf) {
   int intA;
-  intA = tmpFunction1(buf) + tmpFunction2(buf);  // BAD
+  intA = tmpFunction1(buf) + tmpFunction2(buf);  // $ Alert // BAD
   intA = tmpFunction1(buf);  //GOOD
   intA += tmpFunction2(buf);  // GOOD
-  buf[intA] = intA++; // BAD
+  buf[intA] = intA++; // $ Alert // BAD
   intA++;
   buf[intA] = intA; // GOOD
 }

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-783/semmle/tests/OperatorPrecedenceLogicErrorWhenUseBitwiseOrLogicalOperations.qlref

@@ -1 +1,2 @@
-experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBitwiseOrLogicalOperations.ql
+query: experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBitwiseOrLogicalOperations.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-783/semmle/tests/test.cpp

@@ -1,14 +1,14 @@
 void testFunction(int i1, int i2, int i3, bool b1, bool b2, bool b3, char c1)
 {
-  
-  if(b1||b2&&b3) //BAD
+
+  if(b1||b2&&b3) // $ Alert //BAD
     return;
   if((b1||b2)&&b3) //GOOD
     return;
   if(b1||(b2&&b3)) //GOOD
     return;
 
-  if(b1||b2&i1) //BAD
+  if(b1||b2&i1) // $ Alert //BAD
     return;
   if((b1||b2)&i1) //GOOD
     return;
@@ -16,28 +16,28 @@ void testFunction(int i1, int i2, int i3, bool b1, bool b2, bool b3, char c1)
     return;
   if(b1&&b2&0) //GOOD
     return;
-  if(b1||b2|i1) //BAD
+  if(b1||b2|i1) // $ Alert //BAD
     return;
   if((b1||b2)|i1) //GOOD
     return;
 
-  if(i1|i2&c1) //BAD
+  if(i1|i2&c1) // $ Alert //BAD
     return;
   if((i1|i2)&i3) //GOOD
     return;
-  if(i1^i2&c1) //BAD
+  if(i1^i2&c1) // $ Alert //BAD
     return;
   if((i1^i2)&i3) //GOOD
     return;
-  
-  if(i1|i2^c1) //BAD
+
+  if(i1|i2^c1) // $ Alert //BAD
     return;
   if((i1|i2)^i3) //GOOD
     return;
-  
-  if(b1|b2^b3) //BAD
+
+  if(b1|b2^b3) // $ Alert //BAD
     return;
   if((b1|b2)^b3) //GOOD
     return;
-  
+
 }

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/AccessOfMemoryLocationAfterEndOfBufferUsingStrlen.qlref

@@ -1 +1,2 @@
-experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrlen.ql
+query: experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrlen.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/OperatorPrecedenceLogicErrorWhenUseBoolType.qlref

@@ -1 +1,2 @@
-experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBoolType.ql
+query: experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBoolType.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/test.c

@@ -12,23 +12,23 @@ void strlen_test1(){
   unsigned char buff1[12];
   struct buffers buffAll;
   struct buffers * buffAll1;
-  
-  buff1[strlen(buff1)]=0; // BAD
-  buffAll.array[strlen(buffAll.array)]=0; // BAD
-  buffAll.pointer[strlen(buffAll.pointer)]=0; // BAD
-  buffAll1->array[strlen(buffAll1->array)]=0; // BAD
-  buffAll1->pointer[strlen(buffAll1->pointer)]=0; // BAD
-  globalBuff1.array[strlen(globalBuff1.array)]=0; // BAD
-  globalBuff1.pointer[strlen(globalBuff1.pointer)]=0; // BAD
-  globalBuff2->array[strlen(globalBuff2->array)]=0; // BAD
-  globalBuff2->pointer[strlen(globalBuff2->pointer)]=0; // BAD
+
+  buff1[strlen(buff1)]=0; // $ Alert[cpp/access-memory-location-after-end-buffer-strlen] // BAD
+  buffAll.array[strlen(buffAll.array)]=0; // $ Alert[cpp/access-memory-location-after-end-buffer-strlen] // BAD
+  buffAll.pointer[strlen(buffAll.pointer)]=0; // $ Alert[cpp/access-memory-location-after-end-buffer-strlen] // BAD
+  buffAll1->array[strlen(buffAll1->array)]=0; // $ Alert[cpp/access-memory-location-after-end-buffer-strlen] // BAD
+  buffAll1->pointer[strlen(buffAll1->pointer)]=0; // $ Alert[cpp/access-memory-location-after-end-buffer-strlen] // BAD
+  globalBuff1.array[strlen(globalBuff1.array)]=0; // $ Alert[cpp/access-memory-location-after-end-buffer-strlen] // BAD
+  globalBuff1.pointer[strlen(globalBuff1.pointer)]=0; // $ Alert[cpp/access-memory-location-after-end-buffer-strlen] // BAD
+  globalBuff2->array[strlen(globalBuff2->array)]=0; // $ Alert[cpp/access-memory-location-after-end-buffer-strlen] // BAD
+  globalBuff2->pointer[strlen(globalBuff2->pointer)]=0; // $ Alert[cpp/access-memory-location-after-end-buffer-strlen] // BAD
 }
 
 void strlen_test2(){
   unsigned char buff1[12],buff1_c[12];
   struct buffers buffAll,buffAll_c;
   struct buffers * buffAll1,*buffAll1_c;
-  
+
   buff1[strlen(buff1_c)]=0; // GOOD
   buffAll.array[strlen(buffAll_c.array)]=0; // GOOD
   buffAll.pointer[strlen(buffAll.array)]=0; // GOOD

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/test.cpp

@@ -7,13 +7,13 @@ void testFunction()
   int i1,i2,i3;
   bool b1,b2,b3;
   char c1,c2,c3;
-  b1 = -b2; //BAD
+  b1 = -b2; // $ Alert[cpp/operator-precedence-logic-error-when-use-bool-type] //BAD
   b1 = !b2; //GOOD
-  b1++; //BAD
-  ++b1; //BAD
-  if(i1=tmpFunc()!=i2) //BAD
+  b1++; // $ Alert[cpp/operator-precedence-logic-error-when-use-bool-type] //BAD
+  ++b1; // $ Alert[cpp/operator-precedence-logic-error-when-use-bool-type] //BAD
+  if(i1=tmpFunc()!=i2) // $ Alert[cpp/operator-precedence-logic-error-when-use-bool-type] //BAD
     return;
-  if(i1=tmpFunc()!=11) //BAD
+  if(i1=tmpFunc()!=11) // $ Alert[cpp/operator-precedence-logic-error-when-use-bool-type] //BAD
     return;
   if((i1=tmpFunc())!=i2) //GOOD
     return;

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-805/semmle/tests/BufferAccessWithIncorrectLengthValue.qlref

@@ -1 +1,2 @@
-experimental/Security/CWE/CWE-805/BufferAccessWithIncorrectLengthValue.ql
+query: experimental/Security/CWE/CWE-805/BufferAccessWithIncorrectLengthValue.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-805/semmle/tests/test.cpp

@@ -24,7 +24,7 @@ bool badTest1(SSL *ssl,char *text)
   char buf[256];
   if( peer = SSL_get_peer_certificate(ssl))
   {
-    X509_NAME_oneline(X509_get_subject_name(peer),buf,1024); // BAD
+    X509_NAME_oneline(X509_get_subject_name(peer),buf,1024); // $ Alert // BAD
     if((char*)strcasestr(buf,text)) return true;
   }
   return false;

cpp/ql/test/experimental/query-tests/Security/CWE/semmle/tests/MemoryUnsafeFunctionScan.cpp

@@ -16,7 +16,7 @@ int main(int argc, char **argv)
 
     // BAD, do not use scanf without specifying a length first
     char buf1[10];
-    scanf("%s", buf1);
+    scanf("%s", buf1); // $ Alert
 
     // GOOD, length is specified. The length should be one less than the size of the destination buffer, since the last character is the NULL terminator.
     char buf2[20];
@@ -25,7 +25,7 @@ int main(int argc, char **argv)
 
     // BAD, do not use scanf without specifying a length first
     char file[10];
-    fscanf(file, "%s", buf2);
+    fscanf(file, "%s", buf2); // $ Alert
 
     // GOOD, with 'sscanf' the input can be checked first and enough room allocated [FALSE POSITIVE]
     if (argc >= 1)
@@ -33,7 +33,7 @@ int main(int argc, char **argv)
 		char *src = argv[0];
 		char *dest = (char *)malloc(strlen(src) + 1);
 
-		sscanf(src, "%s", dest);
+		sscanf(src, "%s", dest); // $ Alert
 	}
 
     return 0;

cpp/ql/test/experimental/query-tests/Security/CWE/semmle/tests/MemoryUnsafeFunctionScan.qlref

@@ -1 +1,2 @@
-experimental/Security/CWE/CWE-120/MemoryUnsafeFunctionScan.ql
+query: experimental/Security/CWE/CWE-120/MemoryUnsafeFunctionScan.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

cpp/ql/test/library-tests/dataflow/external-models/flow.expected

@@ -48,19 +48,23 @@ models
 | 47 | Summary: ; ; false; callWithArgument; ; ; Argument[1]; Argument[0].Parameter[0]; value; manual |
 | 48 | Summary: ; ; false; callWithNonTypeTemplate<T>; (const T &); ; Argument[*0]; ReturnValue; value; manual |
 | 49 | Summary: ; ; false; pthread_create; ; ; Argument[@3]; Argument[2].Parameter[@0]; value; manual |
-| 50 | Summary: ; ; false; ymlStepGenerated; ; ; Argument[0]; ReturnValue; taint; df-generated |
-| 51 | Summary: ; ; false; ymlStepManual; ; ; Argument[0]; ReturnValue; taint; manual |
-| 52 | Summary: ; ; false; ymlStepManual_with_body; ; ; Argument[0]; ReturnValue; taint; manual |
-| 53 | Summary: ; TemplateClass1; true; templateFunction2<U,V>; (U,V); ; Argument[1]; ReturnValue; value; manual |
-| 54 | Summary: ; TemplateClass1<T>; false; templateFunction<U>; (T,U); ; Argument[0]; ReturnValue; value; manual |
-| 55 | Summary: ; TemplateClass2<T,U>; true; function; (U,T); ; Argument[1]; ReturnValue; value; manual |
-| 56 | Summary: Azure::Core::IO; BodyStream; true; Read; ; ; Argument[-1]; Argument[*0]; taint; manual |
-| 57 | Summary: Azure::Core::IO; BodyStream; true; ReadToCount; ; ; Argument[-1]; Argument[*0]; taint; manual |
-| 58 | Summary: Azure::Core::IO; BodyStream; true; ReadToEnd; ; ; Argument[-1]; ReturnValue.Element; taint; manual |
-| 59 | Summary: Azure; Nullable; true; Value; ; ; Argument[-1]; ReturnValue[*]; taint; manual |
-| 60 | Summary: boost::asio; ; false; buffer; ; ; Argument[*0]; ReturnValue; taint; manual |
+| 50 | Summary: ; ; false; read_field_from_struct; ; ; Argument[*0].Field[MyNamespace::MyStructInNamespace::myField]; ReturnValue; value; manual |
+| 51 | Summary: ; ; false; read_field_from_struct_2; ; ; Argument[*0].Field[MyGlobalStruct::myField]; ReturnValue; value; manual |
+| 52 | Summary: ; ; false; ymlStepGenerated; ; ; Argument[0]; ReturnValue; taint; df-generated |
+| 53 | Summary: ; ; false; ymlStepManual; ; ; Argument[0]; ReturnValue; taint; manual |
+| 54 | Summary: ; ; false; ymlStepManual_with_body; ; ; Argument[0]; ReturnValue; taint; manual |
+| 55 | Summary: ; MyString; true; operator[]; ; ; Argument[-1]; ReturnValue[*]; taint; manual |
+| 56 | Summary: ; MyString; true; operator[]; ; ; ReturnValue[*]; Argument[-1]; taint; manual |
+| 57 | Summary: ; ReverseFlow; true; get_ptr; ; ; ReturnValue[*]; Argument[-1].Field[ReverseFlow::value]; value; manual |
+| 58 | Summary: ; TemplateClass1; true; templateFunction2<U,V>; (U,V); ; Argument[1]; ReturnValue; value; manual |
+| 59 | Summary: ; TemplateClass1<T>; false; templateFunction<U>; (T,U); ; Argument[0]; ReturnValue; value; manual |
+| 60 | Summary: ; TemplateClass2<T,U>; true; function; (U,T); ; Argument[1]; ReturnValue; value; manual |
+| 61 | Summary: Azure::Core::IO; BodyStream; true; Read; ; ; Argument[-1]; Argument[*0]; taint; manual |
+| 62 | Summary: Azure::Core::IO; BodyStream; true; ReadToCount; ; ; Argument[-1]; Argument[*0]; taint; manual |
+| 63 | Summary: Azure::Core::IO; BodyStream; true; ReadToEnd; ; ; Argument[-1]; ReturnValue.Element; taint; manual |
+| 64 | Summary: Azure; Nullable; true; Value; ; ; Argument[-1]; ReturnValue[*]; taint; manual |
+| 65 | Summary: boost::asio; ; false; buffer; ; ; Argument[*0]; ReturnValue; taint; manual |
 edges
-| asio_streams.cpp:56:18:56:23 | [summary param] *0 in buffer | asio_streams.cpp:56:18:56:23 | [summary] to write: ReturnValue in buffer | provenance | MaD:60 |
 | asio_streams.cpp:87:34:87:44 | read_until output argument | asio_streams.cpp:91:7:91:17 | recv_buffer | provenance | Src:MaD:32  |
 | asio_streams.cpp:87:34:87:44 | read_until output argument | asio_streams.cpp:93:29:93:39 | *recv_buffer | provenance | Src:MaD:32 Sink:MaD:2 |
 | asio_streams.cpp:97:37:97:44 | call to source | asio_streams.cpp:98:7:98:14 | send_str | provenance | TaintFunction |
@@ -68,25 +72,16 @@ edges
 | asio_streams.cpp:100:44:100:62 | call to buffer | asio_streams.cpp:100:44:100:62 | call to buffer | provenance |  |
 | asio_streams.cpp:100:44:100:62 | call to buffer | asio_streams.cpp:101:7:101:17 | send_buffer | provenance |  |
 | asio_streams.cpp:100:44:100:62 | call to buffer | asio_streams.cpp:103:29:103:39 | *send_buffer | provenance | Sink:MaD:2 |
-| asio_streams.cpp:100:64:100:71 | *send_str | asio_streams.cpp:56:18:56:23 | [summary param] *0 in buffer | provenance |  |
-| asio_streams.cpp:100:64:100:71 | *send_str | asio_streams.cpp:100:44:100:62 | call to buffer | provenance | MaD:60 |
-| azure.cpp:62:10:62:14 | [summary param] this in Value | azure.cpp:62:10:62:14 | [summary] to write: ReturnValue[*] in Value | provenance | MaD:59 |
-| azure.cpp:113:16:113:19 | [summary param] this in Read | azure.cpp:113:16:113:19 | [summary param] *0 in Read [Return] | provenance | MaD:56 |
-| azure.cpp:114:16:114:26 | [summary param] this in ReadToCount | azure.cpp:114:16:114:26 | [summary param] *0 in ReadToCount [Return] | provenance | MaD:57 |
-| azure.cpp:115:30:115:38 | [summary param] this in ReadToEnd | azure.cpp:115:30:115:38 | [summary] to write: ReturnValue.Element in ReadToEnd | provenance | MaD:58 |
-| azure.cpp:115:30:115:38 | [summary] to write: ReturnValue.Element in ReadToEnd | azure.cpp:115:30:115:38 | [summary] to write: ReturnValue in ReadToEnd [element] | provenance |  |
+| asio_streams.cpp:100:64:100:71 | *send_str | asio_streams.cpp:100:44:100:62 | call to buffer | provenance | MaD:65 |
 | azure.cpp:253:48:253:60 | *call to GetBodyStream | azure.cpp:253:48:253:60 | *call to GetBodyStream | provenance | Src:MaD:29  |
 | azure.cpp:253:48:253:60 | *call to GetBodyStream | azure.cpp:257:5:257:8 | *resp | provenance |  |
 | azure.cpp:253:48:253:60 | *call to GetBodyStream | azure.cpp:262:5:262:8 | *resp | provenance |  |
 | azure.cpp:253:48:253:60 | *call to GetBodyStream | azure.cpp:266:38:266:41 | *resp | provenance |  |
-| azure.cpp:257:5:257:8 | *resp | azure.cpp:113:16:113:19 | [summary param] this in Read | provenance |  |
-| azure.cpp:257:5:257:8 | *resp | azure.cpp:257:16:257:21 | Read output argument | provenance | MaD:56 |
+| azure.cpp:257:5:257:8 | *resp | azure.cpp:257:16:257:21 | Read output argument | provenance | MaD:61 |
 | azure.cpp:257:16:257:21 | Read output argument | azure.cpp:258:10:258:16 | * ... | provenance |  |
-| azure.cpp:262:5:262:8 | *resp | azure.cpp:114:16:114:26 | [summary param] this in ReadToCount | provenance |  |
-| azure.cpp:262:5:262:8 | *resp | azure.cpp:262:23:262:28 | ReadToCount output argument | provenance | MaD:57 |
+| azure.cpp:262:5:262:8 | *resp | azure.cpp:262:23:262:28 | ReadToCount output argument | provenance | MaD:62 |
 | azure.cpp:262:23:262:28 | ReadToCount output argument | azure.cpp:263:10:263:16 | * ... | provenance |  |
-| azure.cpp:266:38:266:41 | *resp | azure.cpp:115:30:115:38 | [summary param] this in ReadToEnd | provenance |  |
-| azure.cpp:266:38:266:41 | *resp | azure.cpp:266:44:266:52 | call to ReadToEnd [element] | provenance | MaD:58 |
+| azure.cpp:266:38:266:41 | *resp | azure.cpp:266:44:266:52 | call to ReadToEnd [element] | provenance | MaD:63 |
 | azure.cpp:266:44:266:52 | call to ReadToEnd [element] | azure.cpp:266:44:266:52 | call to ReadToEnd [element] | provenance |  |
 | azure.cpp:266:44:266:52 | call to ReadToEnd [element] | azure.cpp:267:10:267:12 | vec [element] | provenance |  |
 | azure.cpp:267:10:267:12 | vec [element] | azure.cpp:267:10:267:12 | vec | provenance |  |
@@ -102,12 +97,10 @@ edges
 | azure.cpp:278:10:278:13 | body | azure.cpp:278:10:278:13 | body | provenance |  |
 | azure.cpp:281:68:281:84 | *call to ExtractBodyStream | azure.cpp:281:68:281:84 | *call to ExtractBodyStream | provenance | Src:MaD:26  |
 | azure.cpp:281:68:281:84 | *call to ExtractBodyStream | azure.cpp:282:21:282:23 | *call to get | provenance |  |
-| azure.cpp:282:21:282:23 | *call to get | azure.cpp:115:30:115:38 | [summary param] this in ReadToEnd | provenance |  |
-| azure.cpp:282:21:282:23 | *call to get | azure.cpp:282:28:282:36 | call to ReadToEnd [element] | provenance | MaD:58 |
+| azure.cpp:282:21:282:23 | *call to get | azure.cpp:282:28:282:36 | call to ReadToEnd [element] | provenance | MaD:63 |
 | azure.cpp:282:28:282:36 | call to ReadToEnd [element] | azure.cpp:282:10:282:38 | call to ReadToEnd | provenance |  |
 | azure.cpp:282:28:282:36 | call to ReadToEnd [element] | azure.cpp:282:28:282:36 | call to ReadToEnd [element] | provenance |  |
-| azure.cpp:289:24:289:56 | call to GetHeader | azure.cpp:62:10:62:14 | [summary param] this in Value | provenance |  |
-| azure.cpp:289:24:289:56 | call to GetHeader | azure.cpp:289:63:289:65 | call to Value | provenance | MaD:59 |
+| azure.cpp:289:24:289:56 | call to GetHeader | azure.cpp:289:63:289:65 | call to Value | provenance | MaD:64 |
 | azure.cpp:289:32:289:40 | call to GetHeader | azure.cpp:289:24:289:56 | call to GetHeader | provenance |  |
 | azure.cpp:289:32:289:40 | call to GetHeader | azure.cpp:289:32:289:40 | call to GetHeader | provenance | Src:MaD:30  |
 | azure.cpp:289:63:289:65 | call to Value | azure.cpp:289:63:289:65 | call to Value | provenance |  |
@@ -119,9 +112,6 @@ edges
 | azure.cpp:294:38:294:53 | call to operator[] | azure.cpp:295:10:295:20 | contentType | provenance |  |
 | azure.cpp:294:38:294:53 | call to operator[] | azure.cpp:295:10:295:20 | contentType | provenance |  |
 | azure.cpp:295:10:295:20 | contentType | azure.cpp:295:10:295:20 | contentType | provenance |  |
-| test.cpp:4:5:4:17 | [summary param] 0 in ymlStepManual | test.cpp:4:5:4:17 | [summary] to write: ReturnValue in ymlStepManual | provenance | MaD:51 |
-| test.cpp:5:5:5:20 | [summary param] 0 in ymlStepGenerated | test.cpp:5:5:5:20 | [summary] to write: ReturnValue in ymlStepGenerated | provenance | MaD:50 |
-| test.cpp:6:5:6:27 | [summary param] 0 in ymlStepManual_with_body | test.cpp:6:5:6:27 | [summary] to write: ReturnValue in ymlStepManual_with_body | provenance | MaD:52 |
 | test.cpp:7:47:7:52 | value2 | test.cpp:7:64:7:69 | value2 | provenance |  |
 | test.cpp:7:64:7:69 | value2 | test.cpp:7:5:7:30 | *ymlStepGenerated_with_body | provenance |  |
 | test.cpp:10:10:10:18 | call to ymlSource | test.cpp:10:10:10:18 | call to ymlSource | provenance | Src:MaD:25  |
@@ -132,16 +122,13 @@ edges
 | test.cpp:10:10:10:18 | call to ymlSource | test.cpp:32:41:32:41 | x | provenance |  |
 | test.cpp:17:10:17:22 | call to ymlStepManual | test.cpp:17:10:17:22 | call to ymlStepManual | provenance |  |
 | test.cpp:17:10:17:22 | call to ymlStepManual | test.cpp:18:10:18:10 | y | provenance | Sink:MaD:1 |
-| test.cpp:17:24:17:24 | x | test.cpp:4:5:4:17 | [summary param] 0 in ymlStepManual | provenance |  |
-| test.cpp:17:24:17:24 | x | test.cpp:17:10:17:22 | call to ymlStepManual | provenance | MaD:51 |
+| test.cpp:17:24:17:24 | x | test.cpp:17:10:17:22 | call to ymlStepManual | provenance | MaD:53 |
 | test.cpp:21:10:21:25 | call to ymlStepGenerated | test.cpp:21:10:21:25 | call to ymlStepGenerated | provenance |  |
 | test.cpp:21:10:21:25 | call to ymlStepGenerated | test.cpp:22:10:22:10 | z | provenance | Sink:MaD:1 |
-| test.cpp:21:27:21:27 | x | test.cpp:5:5:5:20 | [summary param] 0 in ymlStepGenerated | provenance |  |
-| test.cpp:21:27:21:27 | x | test.cpp:21:10:21:25 | call to ymlStepGenerated | provenance | MaD:50 |
+| test.cpp:21:27:21:27 | x | test.cpp:21:10:21:25 | call to ymlStepGenerated | provenance | MaD:52 |
 | test.cpp:25:11:25:33 | call to ymlStepManual_with_body | test.cpp:25:11:25:33 | call to ymlStepManual_with_body | provenance |  |
 | test.cpp:25:11:25:33 | call to ymlStepManual_with_body | test.cpp:26:10:26:11 | y2 | provenance | Sink:MaD:1 |
-| test.cpp:25:35:25:35 | x | test.cpp:6:5:6:27 | [summary param] 0 in ymlStepManual_with_body | provenance |  |
-| test.cpp:25:35:25:35 | x | test.cpp:25:11:25:33 | call to ymlStepManual_with_body | provenance | MaD:52 |
+| test.cpp:25:35:25:35 | x | test.cpp:25:11:25:33 | call to ymlStepManual_with_body | provenance | MaD:54 |
 | test.cpp:32:11:32:36 | call to ymlStepGenerated_with_body | test.cpp:32:11:32:36 | call to ymlStepGenerated_with_body | provenance |  |
 | test.cpp:32:11:32:36 | call to ymlStepGenerated_with_body | test.cpp:33:10:33:11 | z2 | provenance | Sink:MaD:1 |
 | test.cpp:32:41:32:41 | x | test.cpp:7:47:7:52 | value2 | provenance |  |
@@ -149,20 +136,10 @@ edges
 | test.cpp:46:30:46:32 | *arg [x] | test.cpp:47:12:47:19 | *arg [x] | provenance |  |
 | test.cpp:47:12:47:19 | *arg [x] | test.cpp:48:13:48:13 | *s [x] | provenance |  |
 | test.cpp:48:13:48:13 | *s [x] | test.cpp:48:16:48:16 | x | provenance | Sink:MaD:1 |
-| test.cpp:52:5:52:18 | [summary param] *3 in pthread_create [x] | test.cpp:52:5:52:18 | [summary] to write: Argument[2].Parameter[*0] in pthread_create [x] | provenance | MaD:49 |
-| test.cpp:52:5:52:18 | [summary] to write: Argument[2].Parameter[*0] in pthread_create [x] | test.cpp:46:30:46:32 | *arg [x] | provenance |  |
 | test.cpp:56:2:56:2 | *s [post update] [x] | test.cpp:59:55:59:64 | *& ... [x] | provenance |  |
 | test.cpp:56:2:56:18 | ... = ... | test.cpp:56:2:56:2 | *s [post update] [x] | provenance |  |
 | test.cpp:56:8:56:16 | call to ymlSource | test.cpp:56:2:56:18 | ... = ... | provenance | Src:MaD:25  |
-| test.cpp:59:55:59:64 | *& ... [x] | test.cpp:52:5:52:18 | [summary param] *3 in pthread_create [x] | provenance |  |
-| test.cpp:63:6:63:21 | [summary param] 1 in callWithArgument | test.cpp:63:6:63:21 | [summary] to write: Argument[0].Parameter[0] in callWithArgument | provenance | MaD:47 |
-| test.cpp:63:6:63:21 | [summary param] 1 in callWithArgument | test.cpp:63:6:63:21 | [summary] to write: Argument[0].Parameter[0] in callWithArgument | provenance | MaD:47 |
-| test.cpp:63:6:63:21 | [summary param] 1 in callWithArgument | test.cpp:63:6:63:21 | [summary] to write: Argument[0].Parameter[0] in callWithArgument | provenance | MaD:47 |
-| test.cpp:63:6:63:21 | [summary param] 1 in callWithArgument | test.cpp:63:6:63:21 | [summary] to write: Argument[0].Parameter[0] in callWithArgument | provenance | MaD:47 |
-| test.cpp:63:6:63:21 | [summary] to write: Argument[0].Parameter[0] in callWithArgument | test.cpp:68:22:68:22 | y | provenance |  |
-| test.cpp:63:6:63:21 | [summary] to write: Argument[0].Parameter[0] in callWithArgument | test.cpp:74:22:74:22 | y | provenance |  |
-| test.cpp:63:6:63:21 | [summary] to write: Argument[0].Parameter[0] in callWithArgument | test.cpp:82:22:82:22 | y | provenance |  |
-| test.cpp:63:6:63:21 | [summary] to write: Argument[0].Parameter[0] in callWithArgument | test.cpp:88:22:88:22 | y | provenance |  |
+| test.cpp:59:55:59:64 | *& ... [x] | test.cpp:46:30:46:32 | *arg [x] | provenance | MaD:49 |
 | test.cpp:68:22:68:22 | y | test.cpp:69:11:69:11 | y | provenance | Sink:MaD:1 |
 | test.cpp:74:22:74:22 | y | test.cpp:75:11:75:11 | y | provenance | Sink:MaD:1 |
 | test.cpp:82:22:82:22 | y | test.cpp:83:11:83:11 | y | provenance | Sink:MaD:1 |
@@ -172,69 +149,73 @@ edges
 | test.cpp:94:10:94:18 | call to ymlSource | test.cpp:101:26:101:26 | x | provenance |  |
 | test.cpp:94:10:94:18 | call to ymlSource | test.cpp:103:63:103:63 | x | provenance |  |
 | test.cpp:94:10:94:18 | call to ymlSource | test.cpp:104:62:104:62 | x | provenance |  |
-| test.cpp:97:26:97:26 | x | test.cpp:63:6:63:21 | [summary param] 1 in callWithArgument | provenance |  |
-| test.cpp:101:26:101:26 | x | test.cpp:63:6:63:21 | [summary param] 1 in callWithArgument | provenance |  |
-| test.cpp:103:63:103:63 | x | test.cpp:63:6:63:21 | [summary param] 1 in callWithArgument | provenance |  |
-| test.cpp:104:62:104:62 | x | test.cpp:63:6:63:21 | [summary param] 1 in callWithArgument | provenance |  |
-| test.cpp:111:3:111:25 | [summary param] *0 in callWithNonTypeTemplate | test.cpp:111:3:111:25 | [summary] to write: ReturnValue in callWithNonTypeTemplate | provenance | MaD:48 |
+| test.cpp:97:26:97:26 | x | test.cpp:68:22:68:22 | y | provenance | MaD:47 |
+| test.cpp:101:26:101:26 | x | test.cpp:74:22:74:22 | y | provenance | MaD:47 |
+| test.cpp:103:63:103:63 | x | test.cpp:82:22:82:22 | y | provenance | MaD:47 |
+| test.cpp:104:62:104:62 | x | test.cpp:88:22:88:22 | y | provenance | MaD:47 |
 | test.cpp:114:10:114:18 | call to ymlSource | test.cpp:114:10:114:18 | call to ymlSource | provenance | Src:MaD:25  |
 | test.cpp:114:10:114:18 | call to ymlSource | test.cpp:118:44:118:44 | *x | provenance |  |
 | test.cpp:118:11:118:42 | call to callWithNonTypeTemplate | test.cpp:118:11:118:42 | call to callWithNonTypeTemplate | provenance |  |
 | test.cpp:118:11:118:42 | call to callWithNonTypeTemplate | test.cpp:119:10:119:11 | y2 | provenance | Sink:MaD:1 |
-| test.cpp:118:44:118:44 | *x | test.cpp:111:3:111:25 | [summary param] *0 in callWithNonTypeTemplate | provenance |  |
 | test.cpp:118:44:118:44 | *x | test.cpp:118:11:118:42 | call to callWithNonTypeTemplate | provenance | MaD:48 |
-| test.cpp:125:5:125:20 | [summary param] 0 in templateFunction | test.cpp:125:5:125:20 | [summary] to write: ReturnValue in templateFunction | provenance | MaD:54 |
-| test.cpp:128:5:128:21 | [summary param] 1 in templateFunction2 | test.cpp:128:5:128:21 | [summary] to write: ReturnValue in templateFunction2 | provenance | MaD:53 |
 | test.cpp:133:10:133:18 | call to ymlSource | test.cpp:133:10:133:18 | call to ymlSource | provenance | Src:MaD:25  |
 | test.cpp:133:10:133:18 | call to ymlSource | test.cpp:134:45:134:45 | x | provenance |  |
 | test.cpp:134:13:134:43 | call to templateFunction | test.cpp:134:13:134:43 | call to templateFunction | provenance |  |
 | test.cpp:134:13:134:43 | call to templateFunction | test.cpp:135:10:135:10 | y | provenance | Sink:MaD:1 |
-| test.cpp:134:45:134:45 | x | test.cpp:125:5:125:20 | [summary param] 0 in templateFunction | provenance |  |
-| test.cpp:134:45:134:45 | x | test.cpp:134:13:134:43 | call to templateFunction | provenance | MaD:54 |
-| test.cpp:140:4:140:11 | [summary param] 1 in function | test.cpp:140:4:140:11 | [summary] to write: ReturnValue in function | provenance | MaD:55 |
-| test.cpp:140:4:140:11 | [summary param] 1 in function | test.cpp:140:4:140:11 | [summary] to write: ReturnValue in function | provenance | MaD:55 |
+| test.cpp:134:45:134:45 | x | test.cpp:134:13:134:43 | call to templateFunction | provenance | MaD:59 |
 | test.cpp:146:10:146:18 | call to ymlSource | test.cpp:146:10:146:18 | call to ymlSource | provenance | Src:MaD:25  |
 | test.cpp:146:10:146:18 | call to ymlSource | test.cpp:148:26:148:26 | x | provenance |  |
 | test.cpp:148:10:148:27 | call to function | test.cpp:148:10:148:27 | call to function | provenance |  |
 | test.cpp:148:10:148:27 | call to function | test.cpp:149:10:149:10 | z | provenance | Sink:MaD:1 |
-| test.cpp:148:26:148:26 | x | test.cpp:140:4:140:11 | [summary param] 1 in function | provenance |  |
-| test.cpp:148:26:148:26 | x | test.cpp:148:10:148:27 | call to function | provenance | MaD:55 |
+| test.cpp:148:26:148:26 | x | test.cpp:148:10:148:27 | call to function | provenance | MaD:60 |
 | test.cpp:155:10:155:18 | call to ymlSource | test.cpp:155:10:155:18 | call to ymlSource | provenance | Src:MaD:25  |
 | test.cpp:155:10:155:18 | call to ymlSource | test.cpp:157:26:157:26 | x | provenance |  |
 | test.cpp:157:13:157:20 | call to function | test.cpp:157:13:157:20 | call to function | provenance |  |
 | test.cpp:157:13:157:20 | call to function | test.cpp:158:10:158:10 | z | provenance | Sink:MaD:1 |
-| test.cpp:157:26:157:26 | x | test.cpp:140:4:140:11 | [summary param] 1 in function | provenance |  |
-| test.cpp:157:26:157:26 | x | test.cpp:157:13:157:20 | call to function | provenance | MaD:55 |
+| test.cpp:157:26:157:26 | x | test.cpp:157:13:157:20 | call to function | provenance | MaD:60 |
 | test.cpp:164:34:164:34 | x | test.cpp:165:69:165:69 | x | provenance |  |
 | test.cpp:165:12:165:64 | call to templateFunction2 | test.cpp:164:7:164:7 | *templateFunction3 | provenance |  |
 | test.cpp:165:12:165:64 | call to templateFunction2 | test.cpp:165:12:165:64 | call to templateFunction2 | provenance |  |
-| test.cpp:165:69:165:69 | x | test.cpp:128:5:128:21 | [summary param] 1 in templateFunction2 | provenance |  |
-| test.cpp:165:69:165:69 | x | test.cpp:165:12:165:64 | call to templateFunction2 | provenance | MaD:53 |
+| test.cpp:165:69:165:69 | x | test.cpp:165:12:165:64 | call to templateFunction2 | provenance | MaD:58 |
 | test.cpp:170:10:170:18 | call to ymlSource | test.cpp:170:10:170:18 | call to ymlSource | provenance | Src:MaD:25  |
 | test.cpp:170:10:170:18 | call to ymlSource | test.cpp:172:51:172:51 | x | provenance |  |
 | test.cpp:172:13:172:44 | call to templateFunction3 | test.cpp:172:13:172:44 | call to templateFunction3 | provenance |  |
 | test.cpp:172:13:172:44 | call to templateFunction3 | test.cpp:173:10:173:10 | y | provenance | Sink:MaD:1 |
 | test.cpp:172:51:172:51 | x | test.cpp:164:34:164:34 | x | provenance |  |
-| test.cpp:172:51:172:51 | x | test.cpp:172:13:172:44 | call to templateFunction3 | provenance | MaD:53 |
-| windows.cpp:17:8:17:25 | [summary param] *0 in CommandLineToArgvA | windows.cpp:17:8:17:25 | [summary] to write: ReturnValue[**] in CommandLineToArgvA | provenance | MaD:33 |
+| test.cpp:172:51:172:51 | x | test.cpp:172:13:172:44 | call to templateFunction3 | provenance | MaD:58 |
+| test.cpp:186:2:186:2 | *s [post update] [myField] | test.cpp:187:33:187:34 | *& ... [myField] | provenance |  |
+| test.cpp:186:2:186:24 | ... = ... | test.cpp:186:2:186:2 | *s [post update] [myField] | provenance |  |
+| test.cpp:186:14:186:22 | call to ymlSource | test.cpp:186:2:186:24 | ... = ... | provenance | Src:MaD:25  |
+| test.cpp:187:10:187:31 | call to read_field_from_struct | test.cpp:187:10:187:31 | call to read_field_from_struct | provenance |  |
+| test.cpp:187:10:187:31 | call to read_field_from_struct | test.cpp:188:10:188:10 | x | provenance | Sink:MaD:1 |
+| test.cpp:187:33:187:34 | *& ... [myField] | test.cpp:187:10:187:31 | call to read_field_from_struct | provenance | MaD:50 |
+| test.cpp:199:2:199:2 | *s [post update] [myField] | test.cpp:200:35:200:36 | *& ... [myField] | provenance |  |
+| test.cpp:199:2:199:24 | ... = ... | test.cpp:199:2:199:2 | *s [post update] [myField] | provenance |  |
+| test.cpp:199:14:199:22 | call to ymlSource | test.cpp:199:2:199:24 | ... = ... | provenance | Src:MaD:25  |
+| test.cpp:200:10:200:33 | call to read_field_from_struct_2 | test.cpp:200:10:200:33 | call to read_field_from_struct_2 | provenance |  |
+| test.cpp:200:10:200:33 | call to read_field_from_struct_2 | test.cpp:201:10:201:10 | x | provenance | Sink:MaD:1 |
+| test.cpp:200:35:200:36 | *& ... [myField] | test.cpp:200:10:200:33 | call to read_field_from_struct_2 | provenance | MaD:51 |
+| test.cpp:216:3:216:4 | get_ptr output argument [value] | test.cpp:217:11:217:12 | *rf [value] | provenance |  |
+| test.cpp:216:3:216:28 | ... = ... | test.cpp:216:3:216:4 | get_ptr output argument [value] | provenance | MaD:57 |
+| test.cpp:216:18:216:26 | call to ymlSource | test.cpp:216:3:216:28 | ... = ... | provenance | Src:MaD:25  |
+| test.cpp:217:11:217:12 | *rf [value] | test.cpp:217:14:217:18 | value | provenance |  |
+| test.cpp:217:14:217:18 | value | test.cpp:217:14:217:18 | value | provenance |  |
+| test.cpp:217:14:217:18 | value | test.cpp:218:11:218:11 | x | provenance | Sink:MaD:1 |
+| test.cpp:222:3:222:3 | operator[] output argument | test.cpp:223:12:223:12 | *s | provenance |  |
+| test.cpp:222:3:222:20 | ... = ... | test.cpp:222:3:222:3 | operator[] output argument | provenance | MaD:56 |
+| test.cpp:222:10:222:20 | call to ymlSource | test.cpp:222:3:222:20 | ... = ... | provenance | Src:MaD:25  |
+| test.cpp:223:12:223:12 | *s | test.cpp:223:13:223:15 | call to operator[] | provenance | MaD:55 |
+| test.cpp:223:13:223:15 | call to operator[] | test.cpp:223:13:223:15 | call to operator[] | provenance |  |
+| test.cpp:223:13:223:15 | call to operator[] | test.cpp:224:11:224:11 | c | provenance | Sink:MaD:1 |
 | windows.cpp:22:15:22:29 | *call to GetCommandLineA | windows.cpp:22:15:22:29 | *call to GetCommandLineA | provenance | Src:MaD:3  |
 | windows.cpp:22:15:22:29 | *call to GetCommandLineA | windows.cpp:24:8:24:11 | * ... | provenance |  |
 | windows.cpp:22:15:22:29 | *call to GetCommandLineA | windows.cpp:27:36:27:38 | *cmd | provenance |  |
 | windows.cpp:27:17:27:34 | **call to CommandLineToArgvA | windows.cpp:27:17:27:34 | **call to CommandLineToArgvA | provenance |  |
 | windows.cpp:27:17:27:34 | **call to CommandLineToArgvA | windows.cpp:30:8:30:15 | * ... | provenance |  |
-| windows.cpp:27:36:27:38 | *cmd | windows.cpp:17:8:17:25 | [summary param] *0 in CommandLineToArgvA | provenance |  |
 | windows.cpp:27:36:27:38 | *cmd | windows.cpp:27:17:27:34 | **call to CommandLineToArgvA | provenance | MaD:33 |
 | windows.cpp:34:17:34:38 | *call to GetEnvironmentStringsA | windows.cpp:34:17:34:38 | *call to GetEnvironmentStringsA | provenance | Src:MaD:4  |
 | windows.cpp:34:17:34:38 | *call to GetEnvironmentStringsA | windows.cpp:36:10:36:13 | * ... | provenance |  |
 | windows.cpp:39:36:39:38 | GetEnvironmentVariableA output argument | windows.cpp:41:10:41:13 | * ... | provenance | Src:MaD:5  |
-| windows.cpp:90:6:90:15 | [summary param] *3 in ReadFileEx [*hEvent] | windows.cpp:90:6:90:15 | [summary] read: Argument[*3].Field[*hEvent] in ReadFileEx | provenance |  |
-| windows.cpp:90:6:90:15 | [summary param] *3 in ReadFileEx [hEvent] | windows.cpp:90:6:90:15 | [summary] read: Argument[*3].Field[hEvent] in ReadFileEx | provenance |  |
-| windows.cpp:90:6:90:15 | [summary] read: Argument[*3].Field[*hEvent] in ReadFileEx | windows.cpp:90:6:90:15 | [summary] to write: Argument[4].Parameter[*2].Field[*hEvent] in ReadFileEx | provenance | MaD:37 |
-| windows.cpp:90:6:90:15 | [summary] read: Argument[*3].Field[hEvent] in ReadFileEx | windows.cpp:90:6:90:15 | [summary] to write: Argument[4].Parameter[*2].Field[hEvent] in ReadFileEx | provenance | MaD:37 |
-| windows.cpp:90:6:90:15 | [summary] to write: Argument[4].Parameter[*2] in ReadFileEx [*hEvent] | windows.cpp:147:16:147:27 | *lpOverlapped [*hEvent] | provenance |  |
-| windows.cpp:90:6:90:15 | [summary] to write: Argument[4].Parameter[*2] in ReadFileEx [hEvent] | windows.cpp:157:16:157:27 | *lpOverlapped [hEvent] | provenance |  |
-| windows.cpp:90:6:90:15 | [summary] to write: Argument[4].Parameter[*2].Field[*hEvent] in ReadFileEx | windows.cpp:90:6:90:15 | [summary] to write: Argument[4].Parameter[*2] in ReadFileEx [*hEvent] | provenance |  |
-| windows.cpp:90:6:90:15 | [summary] to write: Argument[4].Parameter[*2].Field[hEvent] in ReadFileEx | windows.cpp:90:6:90:15 | [summary] to write: Argument[4].Parameter[*2] in ReadFileEx [hEvent] | provenance |  |
 | windows.cpp:147:16:147:27 | *lpOverlapped [*hEvent] | windows.cpp:149:42:149:53 | *lpOverlapped [*hEvent] | provenance |  |
 | windows.cpp:149:18:149:62 | *hEvent | windows.cpp:149:18:149:62 | *hEvent | provenance |  |
 | windows.cpp:149:18:149:62 | *hEvent | windows.cpp:151:8:151:14 | * ... | provenance |  |
@@ -251,11 +232,11 @@ edges
 | windows.cpp:189:21:189:26 | ReadFile output argument | windows.cpp:190:5:190:56 | *... = ... | provenance | Src:MaD:17  |
 | windows.cpp:190:5:190:14 | *overlapped [post update] [*hEvent] | windows.cpp:192:53:192:63 | *& ... [*hEvent] | provenance |  |
 | windows.cpp:190:5:190:56 | *... = ... | windows.cpp:190:5:190:14 | *overlapped [post update] [*hEvent] | provenance |  |
-| windows.cpp:192:53:192:63 | *& ... [*hEvent] | windows.cpp:90:6:90:15 | [summary param] *3 in ReadFileEx [*hEvent] | provenance |  |
+| windows.cpp:192:53:192:63 | *& ... [*hEvent] | windows.cpp:147:16:147:27 | *lpOverlapped [*hEvent] | provenance | MaD:37 |
 | windows.cpp:198:21:198:26 | ReadFile output argument | windows.cpp:199:5:199:57 | ... = ... | provenance | Src:MaD:17  |
 | windows.cpp:199:5:199:14 | *overlapped [post update] [hEvent] | windows.cpp:201:53:201:63 | *& ... [hEvent] | provenance |  |
 | windows.cpp:199:5:199:57 | ... = ... | windows.cpp:199:5:199:14 | *overlapped [post update] [hEvent] | provenance |  |
-| windows.cpp:201:53:201:63 | *& ... [hEvent] | windows.cpp:90:6:90:15 | [summary param] *3 in ReadFileEx [hEvent] | provenance |  |
+| windows.cpp:201:53:201:63 | *& ... [hEvent] | windows.cpp:157:16:157:27 | *lpOverlapped [hEvent] | provenance | MaD:37 |
 | windows.cpp:209:84:209:89 | NtReadFile output argument | windows.cpp:211:10:211:16 | * ... | provenance | Src:MaD:16  |
 | windows.cpp:286:23:286:35 | *call to MapViewOfFile | windows.cpp:286:23:286:35 | *call to MapViewOfFile | provenance | Src:MaD:12  |
 | windows.cpp:286:23:286:35 | *call to MapViewOfFile | windows.cpp:287:20:287:52 | *pMapView | provenance |  |
@@ -278,12 +259,6 @@ edges
 | windows.cpp:332:23:332:40 | *call to MapViewOfFileNuma2 | windows.cpp:332:23:332:40 | *call to MapViewOfFileNuma2 | provenance | Src:MaD:15  |
 | windows.cpp:332:23:332:40 | *call to MapViewOfFileNuma2 | windows.cpp:333:20:333:52 | *pMapView | provenance |  |
 | windows.cpp:333:20:333:52 | *pMapView | windows.cpp:335:10:335:16 | * ... | provenance |  |
-| windows.cpp:349:8:349:19 | [summary param] *3 in CreateThread [x] | windows.cpp:349:8:349:19 | [summary] to write: Argument[2].Parameter[*0] in CreateThread [x] | provenance | MaD:36 |
-| windows.cpp:349:8:349:19 | [summary] to write: Argument[2].Parameter[*0] in CreateThread [x] | windows.cpp:403:26:403:36 | *lpParameter [x] | provenance |  |
-| windows.cpp:357:8:357:25 | [summary param] *4 in CreateRemoteThread [x] | windows.cpp:357:8:357:25 | [summary] to write: Argument[3].Parameter[*0] in CreateRemoteThread [x] | provenance | MaD:34 |
-| windows.cpp:357:8:357:25 | [summary] to write: Argument[3].Parameter[*0] in CreateRemoteThread [x] | windows.cpp:410:26:410:36 | *lpParameter [x] | provenance |  |
-| windows.cpp:387:8:387:27 | [summary param] *4 in CreateRemoteThreadEx [x] | windows.cpp:387:8:387:27 | [summary] to write: Argument[3].Parameter[*0] in CreateRemoteThreadEx [x] | provenance | MaD:35 |
-| windows.cpp:387:8:387:27 | [summary] to write: Argument[3].Parameter[*0] in CreateRemoteThreadEx [x] | windows.cpp:417:26:417:36 | *lpParameter [x] | provenance |  |
 | windows.cpp:403:26:403:36 | *lpParameter [x] | windows.cpp:405:10:405:25 | *lpParameter [x] | provenance |  |
 | windows.cpp:405:10:405:25 | *lpParameter [x] | windows.cpp:406:8:406:8 | *s [x] | provenance |  |
 | windows.cpp:406:8:406:8 | *s [x] | windows.cpp:406:8:406:11 | x | provenance |  |
@@ -298,22 +273,9 @@ edges
 | windows.cpp:431:3:431:3 | *s [post update] [x] | windows.cpp:464:7:464:8 | *& ... [x] | provenance |  |
 | windows.cpp:431:3:431:16 | ... = ... | windows.cpp:431:3:431:3 | *s [post update] [x] | provenance |  |
 | windows.cpp:431:9:431:14 | call to source | windows.cpp:431:3:431:16 | ... = ... | provenance |  |
-| windows.cpp:439:7:439:8 | *& ... [x] | windows.cpp:349:8:349:19 | [summary param] *3 in CreateThread [x] | provenance |  |
-| windows.cpp:451:7:451:8 | *& ... [x] | windows.cpp:357:8:357:25 | [summary param] *4 in CreateRemoteThread [x] | provenance |  |
-| windows.cpp:464:7:464:8 | *& ... [x] | windows.cpp:387:8:387:27 | [summary param] *4 in CreateRemoteThreadEx [x] | provenance |  |
-| windows.cpp:473:17:473:37 | [summary param] *1 in RtlCopyVolatileMemory | windows.cpp:473:17:473:37 | [summary param] *0 in RtlCopyVolatileMemory [Return] | provenance | MaD:42 |
-| windows.cpp:479:17:479:35 | [summary param] *1 in RtlCopyDeviceMemory | windows.cpp:479:17:479:35 | [summary param] *0 in RtlCopyDeviceMemory [Return] | provenance | MaD:38 |
-| windows.cpp:485:6:485:18 | [summary param] *1 in RtlCopyMemory | windows.cpp:485:6:485:18 | [summary param] *0 in RtlCopyMemory [Return] | provenance | MaD:39 |
-| windows.cpp:493:6:493:29 | [summary param] *1 in RtlCopyMemoryNonTemporal | windows.cpp:493:6:493:29 | [summary param] *0 in RtlCopyMemoryNonTemporal [Return] | provenance | MaD:40 |
-| windows.cpp:510:6:510:25 | [summary param] *1 in RtlCopyUnicodeString [*Buffer] | windows.cpp:510:6:510:25 | [summary] read: Argument[*1].Field[*Buffer] in RtlCopyUnicodeString | provenance |  |
-| windows.cpp:510:6:510:25 | [summary] read: Argument[*1].Field[*Buffer] in RtlCopyUnicodeString | windows.cpp:510:6:510:25 | [summary] to write: Argument[*0].Field[*Buffer] in RtlCopyUnicodeString | provenance | MaD:41 |
-| windows.cpp:510:6:510:25 | [summary] to write: Argument[*0] in RtlCopyUnicodeString [*Buffer] | windows.cpp:510:6:510:25 | [summary param] *0 in RtlCopyUnicodeString [Return] [*Buffer] | provenance |  |
-| windows.cpp:510:6:510:25 | [summary] to write: Argument[*0].Field[*Buffer] in RtlCopyUnicodeString | windows.cpp:510:6:510:25 | [summary] to write: Argument[*0] in RtlCopyUnicodeString [*Buffer] | provenance |  |
-| windows.cpp:515:6:515:18 | [summary param] *1 in RtlMoveMemory | windows.cpp:515:6:515:18 | [summary param] *0 in RtlMoveMemory [Return] | provenance | MaD:44 |
-| windows.cpp:521:17:521:37 | [summary param] *1 in RtlMoveVolatileMemory | windows.cpp:521:17:521:37 | [summary param] *0 in RtlMoveVolatileMemory [Return] | provenance | MaD:45 |
-| windows.cpp:527:6:527:25 | [summary param] *1 in RtlInitUnicodeString | windows.cpp:527:6:527:25 | [summary] to write: Argument[*0].Field[*Buffer] in RtlInitUnicodeString | provenance | MaD:43 |
-| windows.cpp:527:6:527:25 | [summary] to write: Argument[*0] in RtlInitUnicodeString [*Buffer] | windows.cpp:527:6:527:25 | [summary param] *0 in RtlInitUnicodeString [Return] [*Buffer] | provenance |  |
-| windows.cpp:527:6:527:25 | [summary] to write: Argument[*0].Field[*Buffer] in RtlInitUnicodeString | windows.cpp:527:6:527:25 | [summary] to write: Argument[*0] in RtlInitUnicodeString [*Buffer] | provenance |  |
+| windows.cpp:439:7:439:8 | *& ... [x] | windows.cpp:403:26:403:36 | *lpParameter [x] | provenance | MaD:36 |
+| windows.cpp:451:7:451:8 | *& ... [x] | windows.cpp:410:26:410:36 | *lpParameter [x] | provenance | MaD:34 |
+| windows.cpp:464:7:464:8 | *& ... [x] | windows.cpp:417:26:417:36 | *lpParameter [x] | provenance | MaD:35 |
 | windows.cpp:533:11:533:16 | call to source | windows.cpp:533:11:533:16 | call to source | provenance |  |
 | windows.cpp:533:11:533:16 | call to source | windows.cpp:537:40:537:41 | *& ... | provenance |  |
 | windows.cpp:533:11:533:16 | call to source | windows.cpp:542:38:542:39 | *& ... | provenance |  |
@@ -322,37 +284,29 @@ edges
 | windows.cpp:533:11:533:16 | call to source | windows.cpp:568:32:568:33 | *& ... | provenance |  |
 | windows.cpp:533:11:533:16 | call to source | windows.cpp:573:40:573:41 | *& ... | provenance |  |
 | windows.cpp:537:27:537:37 | RtlCopyVolatileMemory output argument | windows.cpp:538:10:538:23 | access to array | provenance |  |
-| windows.cpp:537:40:537:41 | *& ... | windows.cpp:473:17:473:37 | [summary param] *1 in RtlCopyVolatileMemory | provenance |  |
 | windows.cpp:537:40:537:41 | *& ... | windows.cpp:537:27:537:37 | RtlCopyVolatileMemory output argument | provenance | MaD:42 |
 | windows.cpp:542:25:542:35 | RtlCopyDeviceMemory output argument | windows.cpp:543:10:543:23 | access to array | provenance |  |
-| windows.cpp:542:38:542:39 | *& ... | windows.cpp:479:17:479:35 | [summary param] *1 in RtlCopyDeviceMemory | provenance |  |
 | windows.cpp:542:38:542:39 | *& ... | windows.cpp:542:25:542:35 | RtlCopyDeviceMemory output argument | provenance | MaD:38 |
 | windows.cpp:547:19:547:29 | RtlCopyMemory output argument | windows.cpp:548:10:548:23 | access to array | provenance |  |
-| windows.cpp:547:32:547:33 | *& ... | windows.cpp:485:6:485:18 | [summary param] *1 in RtlCopyMemory | provenance |  |
 | windows.cpp:547:32:547:33 | *& ... | windows.cpp:547:19:547:29 | RtlCopyMemory output argument | provenance | MaD:39 |
 | windows.cpp:552:30:552:40 | RtlCopyMemoryNonTemporal output argument | windows.cpp:553:10:553:23 | access to array | provenance |  |
-| windows.cpp:552:43:552:44 | *& ... | windows.cpp:493:6:493:29 | [summary param] *1 in RtlCopyMemoryNonTemporal | provenance |  |
 | windows.cpp:552:43:552:44 | *& ... | windows.cpp:552:30:552:40 | RtlCopyMemoryNonTemporal output argument | provenance | MaD:40 |
 | windows.cpp:559:5:559:24 | ... = ... | windows.cpp:561:39:561:44 | *buffer | provenance |  |
 | windows.cpp:559:17:559:24 | call to source | windows.cpp:559:5:559:24 | ... = ... | provenance |  |
 | windows.cpp:561:26:561:36 | RtlInitUnicodeString output argument [*Buffer] | windows.cpp:562:10:562:19 | *src_string [*Buffer] | provenance |  |
 | windows.cpp:561:26:561:36 | RtlInitUnicodeString output argument [*Buffer] | windows.cpp:563:40:563:50 | *& ... [*Buffer] | provenance |  |
-| windows.cpp:561:39:561:44 | *buffer | windows.cpp:527:6:527:25 | [summary param] *1 in RtlInitUnicodeString | provenance |  |
 | windows.cpp:561:39:561:44 | *buffer | windows.cpp:561:26:561:36 | RtlInitUnicodeString output argument [*Buffer] | provenance | MaD:43 |
 | windows.cpp:562:10:562:19 | *src_string [*Buffer] | windows.cpp:562:10:562:29 | access to array | provenance |  |
 | windows.cpp:562:10:562:19 | *src_string [*Buffer] | windows.cpp:562:21:562:26 | *Buffer | provenance |  |
 | windows.cpp:562:21:562:26 | *Buffer | windows.cpp:562:10:562:29 | access to array | provenance |  |
 | windows.cpp:563:26:563:37 | RtlCopyUnicodeString output argument [*Buffer] | windows.cpp:564:10:564:20 | *dest_string [*Buffer] | provenance |  |
-| windows.cpp:563:40:563:50 | *& ... [*Buffer] | windows.cpp:510:6:510:25 | [summary param] *1 in RtlCopyUnicodeString [*Buffer] | provenance |  |
 | windows.cpp:563:40:563:50 | *& ... [*Buffer] | windows.cpp:563:26:563:37 | RtlCopyUnicodeString output argument [*Buffer] | provenance | MaD:41 |
 | windows.cpp:564:10:564:20 | *dest_string [*Buffer] | windows.cpp:564:10:564:30 | access to array | provenance |  |
 | windows.cpp:564:10:564:20 | *dest_string [*Buffer] | windows.cpp:564:22:564:27 | *Buffer | provenance |  |
 | windows.cpp:564:22:564:27 | *Buffer | windows.cpp:564:10:564:30 | access to array | provenance |  |
 | windows.cpp:568:19:568:29 | RtlMoveMemory output argument | windows.cpp:569:10:569:23 | access to array | provenance |  |
-| windows.cpp:568:32:568:33 | *& ... | windows.cpp:515:6:515:18 | [summary param] *1 in RtlMoveMemory | provenance |  |
 | windows.cpp:568:32:568:33 | *& ... | windows.cpp:568:19:568:29 | RtlMoveMemory output argument | provenance | MaD:44 |
 | windows.cpp:573:27:573:37 | RtlMoveVolatileMemory output argument | windows.cpp:574:10:574:23 | access to array | provenance |  |
-| windows.cpp:573:40:573:41 | *& ... | windows.cpp:521:17:521:37 | [summary param] *1 in RtlMoveVolatileMemory | provenance |  |
 | windows.cpp:573:40:573:41 | *& ... | windows.cpp:573:27:573:37 | RtlMoveVolatileMemory output argument | provenance | MaD:45 |
 | windows.cpp:645:45:645:50 | WinHttpReadData output argument | windows.cpp:647:10:647:16 | * ... | provenance | Src:MaD:23  |
 | windows.cpp:652:48:652:53 | WinHttpReadDataEx output argument | windows.cpp:654:10:654:16 | * ... | provenance | Src:MaD:24  |
@@ -360,10 +314,8 @@ edges
 | windows.cpp:669:70:669:79 | WinHttpQueryHeadersEx output argument | windows.cpp:673:10:673:29 | * ... | provenance | Src:MaD:21  |
 | windows.cpp:669:82:669:87 | WinHttpQueryHeadersEx output argument | windows.cpp:671:10:671:16 | * ... | provenance | Src:MaD:22  |
 | windows.cpp:669:105:669:112 | WinHttpQueryHeadersEx output argument | windows.cpp:675:10:675:27 | * ... | provenance | Src:MaD:20  |
-| windows.cpp:714:6:714:20 | [summary param] *0 in WinHttpCrackUrl | windows.cpp:714:6:714:20 | [summary param] *3 in WinHttpCrackUrl [Return] | provenance | MaD:46 |
 | windows.cpp:728:5:728:28 | ... = ... | windows.cpp:729:35:729:35 | *x | provenance |  |
 | windows.cpp:728:12:728:28 | call to source | windows.cpp:728:5:728:28 | ... = ... | provenance |  |
-| windows.cpp:729:35:729:35 | *x | windows.cpp:714:6:714:20 | [summary param] *0 in WinHttpCrackUrl | provenance |  |
 | windows.cpp:729:35:729:35 | *x | windows.cpp:729:44:729:57 | WinHttpCrackUrl output argument | provenance | MaD:46 |
 | windows.cpp:729:44:729:57 | WinHttpCrackUrl output argument | windows.cpp:731:10:731:36 | * ... | provenance |  |
 | windows.cpp:729:44:729:57 | WinHttpCrackUrl output argument | windows.cpp:733:10:733:35 | * ... | provenance |  |
@@ -386,8 +338,6 @@ edges
 | windows.cpp:936:70:936:78 | HttpReceiveClientCertificate output argument | windows.cpp:941:10:941:31 | * ... | provenance | Src:MaD:6  |
 | windows.cpp:937:15:937:48 | *& ... | windows.cpp:939:10:939:11 | * ... | provenance |  |
 nodes
-| asio_streams.cpp:56:18:56:23 | [summary param] *0 in buffer | semmle.label | [summary param] *0 in buffer |
-| asio_streams.cpp:56:18:56:23 | [summary] to write: ReturnValue in buffer | semmle.label | [summary] to write: ReturnValue in buffer |
 | asio_streams.cpp:87:34:87:44 | read_until output argument | semmle.label | read_until output argument |
 | asio_streams.cpp:91:7:91:17 | recv_buffer | semmle.label | recv_buffer |
 | asio_streams.cpp:93:29:93:39 | *recv_buffer | semmle.label | *recv_buffer |
@@ -398,15 +348,6 @@ nodes
 | asio_streams.cpp:100:64:100:71 | *send_str | semmle.label | *send_str |
 | asio_streams.cpp:101:7:101:17 | send_buffer | semmle.label | send_buffer |
 | asio_streams.cpp:103:29:103:39 | *send_buffer | semmle.label | *send_buffer |
-| azure.cpp:62:10:62:14 | [summary param] this in Value | semmle.label | [summary param] this in Value |
-| azure.cpp:62:10:62:14 | [summary] to write: ReturnValue[*] in Value | semmle.label | [summary] to write: ReturnValue[*] in Value |
-| azure.cpp:113:16:113:19 | [summary param] *0 in Read [Return] | semmle.label | [summary param] *0 in Read [Return] |
-| azure.cpp:113:16:113:19 | [summary param] this in Read | semmle.label | [summary param] this in Read |
-| azure.cpp:114:16:114:26 | [summary param] *0 in ReadToCount [Return] | semmle.label | [summary param] *0 in ReadToCount [Return] |
-| azure.cpp:114:16:114:26 | [summary param] this in ReadToCount | semmle.label | [summary param] this in ReadToCount |
-| azure.cpp:115:30:115:38 | [summary param] this in ReadToEnd | semmle.label | [summary param] this in ReadToEnd |
-| azure.cpp:115:30:115:38 | [summary] to write: ReturnValue in ReadToEnd [element] | semmle.label | [summary] to write: ReturnValue in ReadToEnd [element] |
-| azure.cpp:115:30:115:38 | [summary] to write: ReturnValue.Element in ReadToEnd | semmle.label | [summary] to write: ReturnValue.Element in ReadToEnd |
 | azure.cpp:253:48:253:60 | *call to GetBodyStream | semmle.label | *call to GetBodyStream |
 | azure.cpp:253:48:253:60 | *call to GetBodyStream | semmle.label | *call to GetBodyStream |
 | azure.cpp:257:5:257:8 | *resp | semmle.label | *resp |
@@ -451,12 +392,6 @@ nodes
 | azure.cpp:295:10:295:20 | contentType | semmle.label | contentType |
 | azure.cpp:295:10:295:20 | contentType | semmle.label | contentType |
 | azure.cpp:295:10:295:20 | contentType | semmle.label | contentType |
-| test.cpp:4:5:4:17 | [summary param] 0 in ymlStepManual | semmle.label | [summary param] 0 in ymlStepManual |
-| test.cpp:4:5:4:17 | [summary] to write: ReturnValue in ymlStepManual | semmle.label | [summary] to write: ReturnValue in ymlStepManual |
-| test.cpp:5:5:5:20 | [summary param] 0 in ymlStepGenerated | semmle.label | [summary param] 0 in ymlStepGenerated |
-| test.cpp:5:5:5:20 | [summary] to write: ReturnValue in ymlStepGenerated | semmle.label | [summary] to write: ReturnValue in ymlStepGenerated |
-| test.cpp:6:5:6:27 | [summary param] 0 in ymlStepManual_with_body | semmle.label | [summary param] 0 in ymlStepManual_with_body |
-| test.cpp:6:5:6:27 | [summary] to write: ReturnValue in ymlStepManual_with_body | semmle.label | [summary] to write: ReturnValue in ymlStepManual_with_body |
 | test.cpp:7:5:7:30 | *ymlStepGenerated_with_body | semmle.label | *ymlStepGenerated_with_body |
 | test.cpp:7:47:7:52 | value2 | semmle.label | value2 |
 | test.cpp:7:64:7:69 | value2 | semmle.label | value2 |
@@ -483,20 +418,10 @@ nodes
 | test.cpp:47:12:47:19 | *arg [x] | semmle.label | *arg [x] |
 | test.cpp:48:13:48:13 | *s [x] | semmle.label | *s [x] |
 | test.cpp:48:16:48:16 | x | semmle.label | x |
-| test.cpp:52:5:52:18 | [summary param] *3 in pthread_create [x] | semmle.label | [summary param] *3 in pthread_create [x] |
-| test.cpp:52:5:52:18 | [summary] to write: Argument[2].Parameter[*0] in pthread_create [x] | semmle.label | [summary] to write: Argument[2].Parameter[*0] in pthread_create [x] |
 | test.cpp:56:2:56:2 | *s [post update] [x] | semmle.label | *s [post update] [x] |
 | test.cpp:56:2:56:18 | ... = ... | semmle.label | ... = ... |
 | test.cpp:56:8:56:16 | call to ymlSource | semmle.label | call to ymlSource |
 | test.cpp:59:55:59:64 | *& ... [x] | semmle.label | *& ... [x] |
-| test.cpp:63:6:63:21 | [summary param] 1 in callWithArgument | semmle.label | [summary param] 1 in callWithArgument |
-| test.cpp:63:6:63:21 | [summary param] 1 in callWithArgument | semmle.label | [summary param] 1 in callWithArgument |
-| test.cpp:63:6:63:21 | [summary param] 1 in callWithArgument | semmle.label | [summary param] 1 in callWithArgument |
-| test.cpp:63:6:63:21 | [summary param] 1 in callWithArgument | semmle.label | [summary param] 1 in callWithArgument |
-| test.cpp:63:6:63:21 | [summary] to write: Argument[0].Parameter[0] in callWithArgument | semmle.label | [summary] to write: Argument[0].Parameter[0] in callWithArgument |
-| test.cpp:63:6:63:21 | [summary] to write: Argument[0].Parameter[0] in callWithArgument | semmle.label | [summary] to write: Argument[0].Parameter[0] in callWithArgument |
-| test.cpp:63:6:63:21 | [summary] to write: Argument[0].Parameter[0] in callWithArgument | semmle.label | [summary] to write: Argument[0].Parameter[0] in callWithArgument |
-| test.cpp:63:6:63:21 | [summary] to write: Argument[0].Parameter[0] in callWithArgument | semmle.label | [summary] to write: Argument[0].Parameter[0] in callWithArgument |
 | test.cpp:68:22:68:22 | y | semmle.label | y |
 | test.cpp:69:11:69:11 | y | semmle.label | y |
 | test.cpp:74:22:74:22 | y | semmle.label | y |
@@ -511,28 +436,18 @@ nodes
 | test.cpp:101:26:101:26 | x | semmle.label | x |
 | test.cpp:103:63:103:63 | x | semmle.label | x |
 | test.cpp:104:62:104:62 | x | semmle.label | x |
-| test.cpp:111:3:111:25 | [summary param] *0 in callWithNonTypeTemplate | semmle.label | [summary param] *0 in callWithNonTypeTemplate |
-| test.cpp:111:3:111:25 | [summary] to write: ReturnValue in callWithNonTypeTemplate | semmle.label | [summary] to write: ReturnValue in callWithNonTypeTemplate |
 | test.cpp:114:10:114:18 | call to ymlSource | semmle.label | call to ymlSource |
 | test.cpp:114:10:114:18 | call to ymlSource | semmle.label | call to ymlSource |
 | test.cpp:118:11:118:42 | call to callWithNonTypeTemplate | semmle.label | call to callWithNonTypeTemplate |
 | test.cpp:118:11:118:42 | call to callWithNonTypeTemplate | semmle.label | call to callWithNonTypeTemplate |
 | test.cpp:118:44:118:44 | *x | semmle.label | *x |
 | test.cpp:119:10:119:11 | y2 | semmle.label | y2 |
-| test.cpp:125:5:125:20 | [summary param] 0 in templateFunction | semmle.label | [summary param] 0 in templateFunction |
-| test.cpp:125:5:125:20 | [summary] to write: ReturnValue in templateFunction | semmle.label | [summary] to write: ReturnValue in templateFunction |
-| test.cpp:128:5:128:21 | [summary param] 1 in templateFunction2 | semmle.label | [summary param] 1 in templateFunction2 |
-| test.cpp:128:5:128:21 | [summary] to write: ReturnValue in templateFunction2 | semmle.label | [summary] to write: ReturnValue in templateFunction2 |
 | test.cpp:133:10:133:18 | call to ymlSource | semmle.label | call to ymlSource |
 | test.cpp:133:10:133:18 | call to ymlSource | semmle.label | call to ymlSource |
 | test.cpp:134:13:134:43 | call to templateFunction | semmle.label | call to templateFunction |
 | test.cpp:134:13:134:43 | call to templateFunction | semmle.label | call to templateFunction |
 | test.cpp:134:45:134:45 | x | semmle.label | x |
 | test.cpp:135:10:135:10 | y | semmle.label | y |
-| test.cpp:140:4:140:11 | [summary param] 1 in function | semmle.label | [summary param] 1 in function |
-| test.cpp:140:4:140:11 | [summary param] 1 in function | semmle.label | [summary param] 1 in function |
-| test.cpp:140:4:140:11 | [summary] to write: ReturnValue in function | semmle.label | [summary] to write: ReturnValue in function |
-| test.cpp:140:4:140:11 | [summary] to write: ReturnValue in function | semmle.label | [summary] to write: ReturnValue in function |
 | test.cpp:146:10:146:18 | call to ymlSource | semmle.label | call to ymlSource |
 | test.cpp:146:10:146:18 | call to ymlSource | semmle.label | call to ymlSource |
 | test.cpp:148:10:148:27 | call to function | semmle.label | call to function |
@@ -556,8 +471,34 @@ nodes
 | test.cpp:172:13:172:44 | call to templateFunction3 | semmle.label | call to templateFunction3 |
 | test.cpp:172:51:172:51 | x | semmle.label | x |
 | test.cpp:173:10:173:10 | y | semmle.label | y |
-| windows.cpp:17:8:17:25 | [summary param] *0 in CommandLineToArgvA | semmle.label | [summary param] *0 in CommandLineToArgvA |
-| windows.cpp:17:8:17:25 | [summary] to write: ReturnValue[**] in CommandLineToArgvA | semmle.label | [summary] to write: ReturnValue[**] in CommandLineToArgvA |
+| test.cpp:186:2:186:2 | *s [post update] [myField] | semmle.label | *s [post update] [myField] |
+| test.cpp:186:2:186:24 | ... = ... | semmle.label | ... = ... |
+| test.cpp:186:14:186:22 | call to ymlSource | semmle.label | call to ymlSource |
+| test.cpp:187:10:187:31 | call to read_field_from_struct | semmle.label | call to read_field_from_struct |
+| test.cpp:187:10:187:31 | call to read_field_from_struct | semmle.label | call to read_field_from_struct |
+| test.cpp:187:33:187:34 | *& ... [myField] | semmle.label | *& ... [myField] |
+| test.cpp:188:10:188:10 | x | semmle.label | x |
+| test.cpp:199:2:199:2 | *s [post update] [myField] | semmle.label | *s [post update] [myField] |
+| test.cpp:199:2:199:24 | ... = ... | semmle.label | ... = ... |
+| test.cpp:199:14:199:22 | call to ymlSource | semmle.label | call to ymlSource |
+| test.cpp:200:10:200:33 | call to read_field_from_struct_2 | semmle.label | call to read_field_from_struct_2 |
+| test.cpp:200:10:200:33 | call to read_field_from_struct_2 | semmle.label | call to read_field_from_struct_2 |
+| test.cpp:200:35:200:36 | *& ... [myField] | semmle.label | *& ... [myField] |
+| test.cpp:201:10:201:10 | x | semmle.label | x |
+| test.cpp:216:3:216:4 | get_ptr output argument [value] | semmle.label | get_ptr output argument [value] |
+| test.cpp:216:3:216:28 | ... = ... | semmle.label | ... = ... |
+| test.cpp:216:18:216:26 | call to ymlSource | semmle.label | call to ymlSource |
+| test.cpp:217:11:217:12 | *rf [value] | semmle.label | *rf [value] |
+| test.cpp:217:14:217:18 | value | semmle.label | value |
+| test.cpp:217:14:217:18 | value | semmle.label | value |
+| test.cpp:218:11:218:11 | x | semmle.label | x |
+| test.cpp:222:3:222:3 | operator[] output argument | semmle.label | operator[] output argument |
+| test.cpp:222:3:222:20 | ... = ... | semmle.label | ... = ... |
+| test.cpp:222:10:222:20 | call to ymlSource | semmle.label | call to ymlSource |
+| test.cpp:223:12:223:12 | *s | semmle.label | *s |
+| test.cpp:223:13:223:15 | call to operator[] | semmle.label | call to operator[] |
+| test.cpp:223:13:223:15 | call to operator[] | semmle.label | call to operator[] |
+| test.cpp:224:11:224:11 | c | semmle.label | c |
 | windows.cpp:22:15:22:29 | *call to GetCommandLineA | semmle.label | *call to GetCommandLineA |
 | windows.cpp:22:15:22:29 | *call to GetCommandLineA | semmle.label | *call to GetCommandLineA |
 | windows.cpp:24:8:24:11 | * ... | semmle.label | * ... |
@@ -570,14 +511,6 @@ nodes
 | windows.cpp:36:10:36:13 | * ... | semmle.label | * ... |
 | windows.cpp:39:36:39:38 | GetEnvironmentVariableA output argument | semmle.label | GetEnvironmentVariableA output argument |
 | windows.cpp:41:10:41:13 | * ... | semmle.label | * ... |
-| windows.cpp:90:6:90:15 | [summary param] *3 in ReadFileEx [*hEvent] | semmle.label | [summary param] *3 in ReadFileEx [*hEvent] |
-| windows.cpp:90:6:90:15 | [summary param] *3 in ReadFileEx [hEvent] | semmle.label | [summary param] *3 in ReadFileEx [hEvent] |
-| windows.cpp:90:6:90:15 | [summary] read: Argument[*3].Field[*hEvent] in ReadFileEx | semmle.label | [summary] read: Argument[*3].Field[*hEvent] in ReadFileEx |
-| windows.cpp:90:6:90:15 | [summary] read: Argument[*3].Field[hEvent] in ReadFileEx | semmle.label | [summary] read: Argument[*3].Field[hEvent] in ReadFileEx |
-| windows.cpp:90:6:90:15 | [summary] to write: Argument[4].Parameter[*2] in ReadFileEx [*hEvent] | semmle.label | [summary] to write: Argument[4].Parameter[*2] in ReadFileEx [*hEvent] |
-| windows.cpp:90:6:90:15 | [summary] to write: Argument[4].Parameter[*2] in ReadFileEx [hEvent] | semmle.label | [summary] to write: Argument[4].Parameter[*2] in ReadFileEx [hEvent] |
-| windows.cpp:90:6:90:15 | [summary] to write: Argument[4].Parameter[*2].Field[*hEvent] in ReadFileEx | semmle.label | [summary] to write: Argument[4].Parameter[*2].Field[*hEvent] in ReadFileEx |
-| windows.cpp:90:6:90:15 | [summary] to write: Argument[4].Parameter[*2].Field[hEvent] in ReadFileEx | semmle.label | [summary] to write: Argument[4].Parameter[*2].Field[hEvent] in ReadFileEx |
 | windows.cpp:147:16:147:27 | *lpOverlapped [*hEvent] | semmle.label | *lpOverlapped [*hEvent] |
 | windows.cpp:149:18:149:62 | *hEvent | semmle.label | *hEvent |
 | windows.cpp:149:18:149:62 | *hEvent | semmle.label | *hEvent |
@@ -631,12 +564,6 @@ nodes
 | windows.cpp:332:23:332:40 | *call to MapViewOfFileNuma2 | semmle.label | *call to MapViewOfFileNuma2 |
 | windows.cpp:333:20:333:52 | *pMapView | semmle.label | *pMapView |
 | windows.cpp:335:10:335:16 | * ... | semmle.label | * ... |
-| windows.cpp:349:8:349:19 | [summary param] *3 in CreateThread [x] | semmle.label | [summary param] *3 in CreateThread [x] |
-| windows.cpp:349:8:349:19 | [summary] to write: Argument[2].Parameter[*0] in CreateThread [x] | semmle.label | [summary] to write: Argument[2].Parameter[*0] in CreateThread [x] |
-| windows.cpp:357:8:357:25 | [summary param] *4 in CreateRemoteThread [x] | semmle.label | [summary param] *4 in CreateRemoteThread [x] |
-| windows.cpp:357:8:357:25 | [summary] to write: Argument[3].Parameter[*0] in CreateRemoteThread [x] | semmle.label | [summary] to write: Argument[3].Parameter[*0] in CreateRemoteThread [x] |
-| windows.cpp:387:8:387:27 | [summary param] *4 in CreateRemoteThreadEx [x] | semmle.label | [summary param] *4 in CreateRemoteThreadEx [x] |
-| windows.cpp:387:8:387:27 | [summary] to write: Argument[3].Parameter[*0] in CreateRemoteThreadEx [x] | semmle.label | [summary] to write: Argument[3].Parameter[*0] in CreateRemoteThreadEx [x] |
 | windows.cpp:403:26:403:36 | *lpParameter [x] | semmle.label | *lpParameter [x] |
 | windows.cpp:405:10:405:25 | *lpParameter [x] | semmle.label | *lpParameter [x] |
 | windows.cpp:406:8:406:8 | *s [x] | semmle.label | *s [x] |
@@ -655,27 +582,6 @@ nodes
 | windows.cpp:439:7:439:8 | *& ... [x] | semmle.label | *& ... [x] |
 | windows.cpp:451:7:451:8 | *& ... [x] | semmle.label | *& ... [x] |
 | windows.cpp:464:7:464:8 | *& ... [x] | semmle.label | *& ... [x] |
-| windows.cpp:473:17:473:37 | [summary param] *0 in RtlCopyVolatileMemory [Return] | semmle.label | [summary param] *0 in RtlCopyVolatileMemory [Return] |
-| windows.cpp:473:17:473:37 | [summary param] *1 in RtlCopyVolatileMemory | semmle.label | [summary param] *1 in RtlCopyVolatileMemory |
-| windows.cpp:479:17:479:35 | [summary param] *0 in RtlCopyDeviceMemory [Return] | semmle.label | [summary param] *0 in RtlCopyDeviceMemory [Return] |
-| windows.cpp:479:17:479:35 | [summary param] *1 in RtlCopyDeviceMemory | semmle.label | [summary param] *1 in RtlCopyDeviceMemory |
-| windows.cpp:485:6:485:18 | [summary param] *0 in RtlCopyMemory [Return] | semmle.label | [summary param] *0 in RtlCopyMemory [Return] |
-| windows.cpp:485:6:485:18 | [summary param] *1 in RtlCopyMemory | semmle.label | [summary param] *1 in RtlCopyMemory |
-| windows.cpp:493:6:493:29 | [summary param] *0 in RtlCopyMemoryNonTemporal [Return] | semmle.label | [summary param] *0 in RtlCopyMemoryNonTemporal [Return] |
-| windows.cpp:493:6:493:29 | [summary param] *1 in RtlCopyMemoryNonTemporal | semmle.label | [summary param] *1 in RtlCopyMemoryNonTemporal |
-| windows.cpp:510:6:510:25 | [summary param] *0 in RtlCopyUnicodeString [Return] [*Buffer] | semmle.label | [summary param] *0 in RtlCopyUnicodeString [Return] [*Buffer] |
-| windows.cpp:510:6:510:25 | [summary param] *1 in RtlCopyUnicodeString [*Buffer] | semmle.label | [summary param] *1 in RtlCopyUnicodeString [*Buffer] |
-| windows.cpp:510:6:510:25 | [summary] read: Argument[*1].Field[*Buffer] in RtlCopyUnicodeString | semmle.label | [summary] read: Argument[*1].Field[*Buffer] in RtlCopyUnicodeString |
-| windows.cpp:510:6:510:25 | [summary] to write: Argument[*0] in RtlCopyUnicodeString [*Buffer] | semmle.label | [summary] to write: Argument[*0] in RtlCopyUnicodeString [*Buffer] |
-| windows.cpp:510:6:510:25 | [summary] to write: Argument[*0].Field[*Buffer] in RtlCopyUnicodeString | semmle.label | [summary] to write: Argument[*0].Field[*Buffer] in RtlCopyUnicodeString |
-| windows.cpp:515:6:515:18 | [summary param] *0 in RtlMoveMemory [Return] | semmle.label | [summary param] *0 in RtlMoveMemory [Return] |
-| windows.cpp:515:6:515:18 | [summary param] *1 in RtlMoveMemory | semmle.label | [summary param] *1 in RtlMoveMemory |
-| windows.cpp:521:17:521:37 | [summary param] *0 in RtlMoveVolatileMemory [Return] | semmle.label | [summary param] *0 in RtlMoveVolatileMemory [Return] |
-| windows.cpp:521:17:521:37 | [summary param] *1 in RtlMoveVolatileMemory | semmle.label | [summary param] *1 in RtlMoveVolatileMemory |
-| windows.cpp:527:6:527:25 | [summary param] *0 in RtlInitUnicodeString [Return] [*Buffer] | semmle.label | [summary param] *0 in RtlInitUnicodeString [Return] [*Buffer] |
-| windows.cpp:527:6:527:25 | [summary param] *1 in RtlInitUnicodeString | semmle.label | [summary param] *1 in RtlInitUnicodeString |
-| windows.cpp:527:6:527:25 | [summary] to write: Argument[*0] in RtlInitUnicodeString [*Buffer] | semmle.label | [summary] to write: Argument[*0] in RtlInitUnicodeString [*Buffer] |
-| windows.cpp:527:6:527:25 | [summary] to write: Argument[*0].Field[*Buffer] in RtlInitUnicodeString | semmle.label | [summary] to write: Argument[*0].Field[*Buffer] in RtlInitUnicodeString |
 | windows.cpp:533:11:533:16 | call to source | semmle.label | call to source |
 | windows.cpp:533:11:533:16 | call to source | semmle.label | call to source |
 | windows.cpp:537:27:537:37 | RtlCopyVolatileMemory output argument | semmle.label | RtlCopyVolatileMemory output argument |
@@ -720,8 +626,6 @@ nodes
 | windows.cpp:671:10:671:16 | * ... | semmle.label | * ... |
 | windows.cpp:673:10:673:29 | * ... | semmle.label | * ... |
 | windows.cpp:675:10:675:27 | * ... | semmle.label | * ... |
-| windows.cpp:714:6:714:20 | [summary param] *0 in WinHttpCrackUrl | semmle.label | [summary param] *0 in WinHttpCrackUrl |
-| windows.cpp:714:6:714:20 | [summary param] *3 in WinHttpCrackUrl [Return] | semmle.label | [summary param] *3 in WinHttpCrackUrl [Return] |
 | windows.cpp:728:5:728:28 | ... = ... | semmle.label | ... = ... |
 | windows.cpp:728:12:728:28 | call to source | semmle.label | call to source |
 | windows.cpp:729:35:729:35 | *x | semmle.label | *x |
@@ -750,30 +654,6 @@ nodes
 | windows.cpp:939:10:939:11 | * ... | semmle.label | * ... |
 | windows.cpp:941:10:941:31 | * ... | semmle.label | * ... |
 subpaths
-| asio_streams.cpp:100:64:100:71 | *send_str | asio_streams.cpp:56:18:56:23 | [summary param] *0 in buffer | asio_streams.cpp:56:18:56:23 | [summary] to write: ReturnValue in buffer | asio_streams.cpp:100:44:100:62 | call to buffer |
-| azure.cpp:257:5:257:8 | *resp | azure.cpp:113:16:113:19 | [summary param] this in Read | azure.cpp:113:16:113:19 | [summary param] *0 in Read [Return] | azure.cpp:257:16:257:21 | Read output argument |
-| azure.cpp:262:5:262:8 | *resp | azure.cpp:114:16:114:26 | [summary param] this in ReadToCount | azure.cpp:114:16:114:26 | [summary param] *0 in ReadToCount [Return] | azure.cpp:262:23:262:28 | ReadToCount output argument |
-| azure.cpp:266:38:266:41 | *resp | azure.cpp:115:30:115:38 | [summary param] this in ReadToEnd | azure.cpp:115:30:115:38 | [summary] to write: ReturnValue in ReadToEnd [element] | azure.cpp:266:44:266:52 | call to ReadToEnd [element] |
-| azure.cpp:282:21:282:23 | *call to get | azure.cpp:115:30:115:38 | [summary param] this in ReadToEnd | azure.cpp:115:30:115:38 | [summary] to write: ReturnValue in ReadToEnd [element] | azure.cpp:282:28:282:36 | call to ReadToEnd [element] |
-| azure.cpp:289:24:289:56 | call to GetHeader | azure.cpp:62:10:62:14 | [summary param] this in Value | azure.cpp:62:10:62:14 | [summary] to write: ReturnValue[*] in Value | azure.cpp:289:63:289:65 | call to Value |
-| test.cpp:17:24:17:24 | x | test.cpp:4:5:4:17 | [summary param] 0 in ymlStepManual | test.cpp:4:5:4:17 | [summary] to write: ReturnValue in ymlStepManual | test.cpp:17:10:17:22 | call to ymlStepManual |
-| test.cpp:21:27:21:27 | x | test.cpp:5:5:5:20 | [summary param] 0 in ymlStepGenerated | test.cpp:5:5:5:20 | [summary] to write: ReturnValue in ymlStepGenerated | test.cpp:21:10:21:25 | call to ymlStepGenerated |
-| test.cpp:25:35:25:35 | x | test.cpp:6:5:6:27 | [summary param] 0 in ymlStepManual_with_body | test.cpp:6:5:6:27 | [summary] to write: ReturnValue in ymlStepManual_with_body | test.cpp:25:11:25:33 | call to ymlStepManual_with_body |
 | test.cpp:32:41:32:41 | x | test.cpp:7:47:7:52 | value2 | test.cpp:7:5:7:30 | *ymlStepGenerated_with_body | test.cpp:32:11:32:36 | call to ymlStepGenerated_with_body |
-| test.cpp:118:44:118:44 | *x | test.cpp:111:3:111:25 | [summary param] *0 in callWithNonTypeTemplate | test.cpp:111:3:111:25 | [summary] to write: ReturnValue in callWithNonTypeTemplate | test.cpp:118:11:118:42 | call to callWithNonTypeTemplate |
-| test.cpp:134:45:134:45 | x | test.cpp:125:5:125:20 | [summary param] 0 in templateFunction | test.cpp:125:5:125:20 | [summary] to write: ReturnValue in templateFunction | test.cpp:134:13:134:43 | call to templateFunction |
-| test.cpp:148:26:148:26 | x | test.cpp:140:4:140:11 | [summary param] 1 in function | test.cpp:140:4:140:11 | [summary] to write: ReturnValue in function | test.cpp:148:10:148:27 | call to function |
-| test.cpp:157:26:157:26 | x | test.cpp:140:4:140:11 | [summary param] 1 in function | test.cpp:140:4:140:11 | [summary] to write: ReturnValue in function | test.cpp:157:13:157:20 | call to function |
-| test.cpp:165:69:165:69 | x | test.cpp:128:5:128:21 | [summary param] 1 in templateFunction2 | test.cpp:128:5:128:21 | [summary] to write: ReturnValue in templateFunction2 | test.cpp:165:12:165:64 | call to templateFunction2 |
 | test.cpp:172:51:172:51 | x | test.cpp:164:34:164:34 | x | test.cpp:164:7:164:7 | *templateFunction3 | test.cpp:172:13:172:44 | call to templateFunction3 |
-| windows.cpp:27:36:27:38 | *cmd | windows.cpp:17:8:17:25 | [summary param] *0 in CommandLineToArgvA | windows.cpp:17:8:17:25 | [summary] to write: ReturnValue[**] in CommandLineToArgvA | windows.cpp:27:17:27:34 | **call to CommandLineToArgvA |
-| windows.cpp:537:40:537:41 | *& ... | windows.cpp:473:17:473:37 | [summary param] *1 in RtlCopyVolatileMemory | windows.cpp:473:17:473:37 | [summary param] *0 in RtlCopyVolatileMemory [Return] | windows.cpp:537:27:537:37 | RtlCopyVolatileMemory output argument |
-| windows.cpp:542:38:542:39 | *& ... | windows.cpp:479:17:479:35 | [summary param] *1 in RtlCopyDeviceMemory | windows.cpp:479:17:479:35 | [summary param] *0 in RtlCopyDeviceMemory [Return] | windows.cpp:542:25:542:35 | RtlCopyDeviceMemory output argument |
-| windows.cpp:547:32:547:33 | *& ... | windows.cpp:485:6:485:18 | [summary param] *1 in RtlCopyMemory | windows.cpp:485:6:485:18 | [summary param] *0 in RtlCopyMemory [Return] | windows.cpp:547:19:547:29 | RtlCopyMemory output argument |
-| windows.cpp:552:43:552:44 | *& ... | windows.cpp:493:6:493:29 | [summary param] *1 in RtlCopyMemoryNonTemporal | windows.cpp:493:6:493:29 | [summary param] *0 in RtlCopyMemoryNonTemporal [Return] | windows.cpp:552:30:552:40 | RtlCopyMemoryNonTemporal output argument |
-| windows.cpp:561:39:561:44 | *buffer | windows.cpp:527:6:527:25 | [summary param] *1 in RtlInitUnicodeString | windows.cpp:527:6:527:25 | [summary param] *0 in RtlInitUnicodeString [Return] [*Buffer] | windows.cpp:561:26:561:36 | RtlInitUnicodeString output argument [*Buffer] |
-| windows.cpp:563:40:563:50 | *& ... [*Buffer] | windows.cpp:510:6:510:25 | [summary param] *1 in RtlCopyUnicodeString [*Buffer] | windows.cpp:510:6:510:25 | [summary param] *0 in RtlCopyUnicodeString [Return] [*Buffer] | windows.cpp:563:26:563:37 | RtlCopyUnicodeString output argument [*Buffer] |
-| windows.cpp:568:32:568:33 | *& ... | windows.cpp:515:6:515:18 | [summary param] *1 in RtlMoveMemory | windows.cpp:515:6:515:18 | [summary param] *0 in RtlMoveMemory [Return] | windows.cpp:568:19:568:29 | RtlMoveMemory output argument |
-| windows.cpp:573:40:573:41 | *& ... | windows.cpp:521:17:521:37 | [summary param] *1 in RtlMoveVolatileMemory | windows.cpp:521:17:521:37 | [summary param] *0 in RtlMoveVolatileMemory [Return] | windows.cpp:573:27:573:37 | RtlMoveVolatileMemory output argument |
-| windows.cpp:729:35:729:35 | *x | windows.cpp:714:6:714:20 | [summary param] *0 in WinHttpCrackUrl | windows.cpp:714:6:714:20 | [summary param] *3 in WinHttpCrackUrl [Return] | windows.cpp:729:44:729:57 | WinHttpCrackUrl output argument |
 testFailures

cpp/ql/test/library-tests/dataflow/external-models/flow.ext.yml

@@ -21,4 +21,9 @@ extensions:
       - ["", "", False, "callWithNonTypeTemplate<T>", "(const T &)", "", "Argument[*0]", "ReturnValue", "value", "manual"]
       - ["", "TemplateClass1<T>", False, "templateFunction<U>", "(T,U)", "", "Argument[0]", "ReturnValue", "value", "manual"]
       - ["", "TemplateClass1", True, "templateFunction2<U,V>", "(U,V)", "", "Argument[1]", "ReturnValue", "value", "manual"]
-      - ["", "TemplateClass2<T,U>", True, "function", "(U,T)", "", "Argument[1]", "ReturnValue", "value", "manual"]
+      - ["", "TemplateClass2<T,U>", True, "function", "(U,T)", "", "Argument[1]", "ReturnValue", "value", "manual"]
+      - ["", "", False, "read_field_from_struct", "", "", "Argument[*0].Field[MyNamespace::MyStructInNamespace::myField]", "ReturnValue", "value", "manual"]
+      - ["", "", False, "read_field_from_struct_2", "", "", "Argument[*0].Field[MyGlobalStruct::myField]", "ReturnValue", "value", "manual"]
+      - ["", "ReverseFlow", True, "get_ptr", "", "", "ReturnValue[*]", "Argument[-1].Field[ReverseFlow::value]", "value", "manual"]
+      - ["", "MyString", True, "operator[]", "", "", "ReturnValue[*]", "Argument[-1]", "taint", "manual"]
+      - ["", "MyString", True, "operator[]", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]

cpp/ql/test/library-tests/dataflow/external-models/sinks.expected

@@ -19,3 +19,7 @@
 | test.cpp:149:10:149:10 | z | test-sink |
 | test.cpp:158:10:158:10 | z | test-sink |
 | test.cpp:173:10:173:10 | y | test-sink |
+| test.cpp:188:10:188:10 | x | test-sink |
+| test.cpp:201:10:201:10 | x | test-sink |
+| test.cpp:218:11:218:11 | x | test-sink |
+| test.cpp:224:11:224:11 | c | test-sink |

cpp/ql/test/library-tests/dataflow/external-models/sources.expected

@@ -13,6 +13,10 @@
 | test.cpp:146:10:146:18 | call to ymlSource | local |
 | test.cpp:155:10:155:18 | call to ymlSource | local |
 | test.cpp:170:10:170:18 | call to ymlSource | local |
+| test.cpp:186:14:186:22 | call to ymlSource | local |
+| test.cpp:199:14:199:22 | call to ymlSource | local |
+| test.cpp:216:18:216:26 | call to ymlSource | local |
+| test.cpp:222:10:222:20 | call to ymlSource | local |
 | windows.cpp:22:15:22:29 | *call to GetCommandLineA | local |
 | windows.cpp:34:17:34:38 | *call to GetEnvironmentStringsA | local |
 | windows.cpp:39:36:39:38 | GetEnvironmentVariableA output argument | local |

cpp/ql/test/library-tests/dataflow/external-models/test.cpp

@@ -171,4 +171,56 @@ void test_class1() {
 	Class1<int> c;
 	auto y = c.templateFunction3<unsigned long>(0UL, x);
 	ymlSink(y); // $ ir
+}
+
+namespace MyNamespace {
+	struct MyStructInNamespace {
+		int myField;
+	};
+}
+
+int read_field_from_struct(MyNamespace::MyStructInNamespace* s);
+
+void test_fully_qualified_field_test() {
+	MyNamespace::MyStructInNamespace s;
+	s.myField = ymlSource();
+	int x = read_field_from_struct(&s);
+	ymlSink(x); // $ ir
+}
+
+struct MyGlobalStruct {
+	int myField;
+};
+
+int read_field_from_struct_2(MyGlobalStruct* s);
+
+void test_fully_qualified_field_test_2() {
+	MyGlobalStruct s;
+	s.myField = ymlSource();
+	int x = read_field_from_struct_2(&s);
+	ymlSink(x); // $ ir
+}
+
+struct ReverseFlow {
+	int value;
+	int& get_ptr();
+};
+
+struct MyString {
+	char& operator[](unsigned);
+};
+
+void test_reverse_flow(unsigned i, unsigned j) {
+	{
+		ReverseFlow rf;
+		rf.get_ptr() = ymlSource();
+		int x = rf.value;
+		ymlSink(x); // $ ir
+	}
+	{
+		MyString s;
+		s[i] = ymlSource();
+		char c = s[j];
+		ymlSink(c); // $ ir
+	}
 }